@yielded/agent-platform-cloudflare 0.0.0-stage → 0.1.0-beta.167

package/dist/Alarm-B0ODr1NE.mjs

@@ -0,0 +1,1738 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { DurableObjectContext } from "./CloudflareBindings.mjs";
+import { AuxiliaryDispatchMillis, CloudflareDurableRuntimeConfig } from "./CloudflareConfig.mjs";
+import { r as safeCauseMessage } from "./boundary-BguazVkh.mjs";
+import "@yielded/agent/agent-registration";
+import { DurableAgentRuntime, DurableRuntimeConfig, RecoveryBlocked, RecoveryFailure, RecoverySweepResult, isolateRecovery } from "@yielded/agent/durable-agent-runtime";
+import { SubmissionId, ThreadId } from "@yielded/agent/identifiers";
+import { AbortIntentRequest, SubmissionLedger } from "@yielded/agent/submission-ledger";
+import { ThreadProjectionMaintenance } from "@yielded/agent/thread-projection-maintenance";
+import { WakeScheduler } from "@yielded/agent/wake-scheduler";
+import { Cause, Clock, Context, DateTime, Deferred, Effect, ErrorReporter, Exit, Fiber, Layer, Option, Random, Ref, Result, Scheduler, Schema, Scope, Semaphore, Stream, Struct } from "effect";
+import { DurableObjectStorage } from "effect-cf";
+import { SqlClient } from "effect/sql/SqlClient";
+import { SqlError, UnknownError } from "effect/sql/SqlError";
+//#region src/internal/due-queue.ts
+const LaneId = Schema.NonEmptyString.check(Schema.isMaxLength(256));
+const HostLaneId = LaneId.check(Schema.isPattern(/^(?!effect-agent:)/, { message: "The effect-agent: namespace is reserved for framework maintenance lanes" }));
+const Deadline = Schema.NullOr(Schema.Finite);
+const MinimumRetryMillis = 1e3;
+const ParkedRetryMillis = 36e5;
+/** Scheduling metadata only. Domain outboxes, claims and receipts remain authoritative. */
+var DueLane = class extends Schema.Class("CloudflareDueLane")({
+	id: LaneId,
+	revision: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	dueAt: Deadline,
+	stalls: Schema.Int.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 30
+	})),
+	progressKey: Schema.NullOr(Schema.NonEmptyString.check(Schema.isMaxLength(512))),
+	notBefore: Schema.Finite,
+	state: Schema.Literals([
+		"idle",
+		"pending",
+		"parked"
+	]),
+	reported: Schema.Literals([0, 1])
+}) {};
+const Native = "effect-agent:native";
+const Publication = "effect-agent:publication";
+const Projection = "effect-agent:projection";
+const Messages = "effect-agent:messages";
+const RecoveryEvents = "effect-agent:recovery-events";
+const Lifecycle = "effect-agent:lifecycle";
+const decode = Schema.decodeUnknownSync(Schema.Array(DueLane));
+const equivalent = Schema.toEquivalence(DueLane);
+const views = /* @__PURE__ */ new WeakMap();
+/** Only the explicit source boundary may retain speculative rows across operations. */
+const buffering = (storage) => views.get(storage)?.frame !== void 0;
+const ownsTransaction = (storage, depth) => views.get(storage)?.frame?.sqlDepth === depth;
+const invalidate = (storage) => {
+	const view = views.get(storage);
+	if (view !== void 0) view.rows = void 0;
+};
+/** Callers reserve the shared SQL connection through commit. Keep the complete view
+* during a transaction, then retain at most 128 lanes between transactions. Intent
+* flushes before source commit; claims and prearming commit before fallible work. */
+const make = (storage) => {
+	const sql = storage.sql;
+	let view = views.get(storage);
+	if (view === void 0) {
+		view = {
+			rows: void 0,
+			frame: void 0,
+			retained: 0,
+			changes: /* @__PURE__ */ new Map(),
+			deadlines: /* @__PURE__ */ new Map()
+		};
+		views.set(storage, view);
+	}
+	const current = view;
+	const trim = () => {
+		if (current.frame === void 0 && current.retained === 0 && (current.rows?.length ?? 0) > 128) current.rows = void 0;
+	};
+	/** Retain the pass's write-through view without deferring claims or source commits.
+	* Failed source transactions still invalidate it; large views are released at exit. */
+	const withView = (body) => Effect.acquireUseRelease(Effect.sync(() => {
+		current.retained++;
+	}), () => body, () => Effect.sync(() => {
+		current.retained--;
+		trim();
+	}));
+	const begin = (sqlDepth) => {
+		const frame = {
+			parent: current.frame,
+			sqlDepth,
+			rows: current.rows,
+			changes: current.changes,
+			deadlines: current.deadlines
+		};
+		current.frame = frame;
+		current.changes = new Map(current.changes);
+		current.deadlines = new Map(current.deadlines);
+		return frame;
+	};
+	const finish = (frame, success) => {
+		current.frame = frame.parent;
+		if (!success) {
+			current.rows = frame.parent === void 0 ? void 0 : frame.rows;
+			current.changes = frame.changes;
+			current.deadlines = frame.deadlines;
+		}
+		if (frame.parent === void 0) {
+			current.changes.clear();
+			current.deadlines.clear();
+			trim();
+		}
+	};
+	const write = (changes) => {
+		if (decode(sql.exec(`WITH changes (id, revision, dueAt, stalls, progressKey, notBefore, state, reported, expected_revision) AS (
+            VALUES ${changes.map(() => "(?, ?, ?, ?, ?, ?, ?, ?, ?)").join(", ")}
+          ) INSERT INTO platform_cloudflare_due_queue
+            (id, revision, dueAt, stalls, progressKey, notBefore, state, reported)
+          SELECT id, revision, dueAt, stalls, progressKey, notBefore, state, reported FROM changes WHERE 1
+          ON CONFLICT(id) DO UPDATE SET revision = excluded.revision, dueAt = excluded.dueAt,
+            stalls = excluded.stalls, progressKey = excluded.progressKey,
+            notBefore = excluded.notBefore, state = excluded.state, reported = excluded.reported
+          WHERE platform_cloudflare_due_queue.revision = (
+            SELECT expected_revision FROM changes WHERE changes.id = excluded.id
+          ) RETURNING id, revision, dueAt, stalls, progressKey, notBefore, state, reported`, ...changes.flatMap(({ before, after }) => [
+			after.id,
+			after.revision,
+			after.dueAt,
+			after.stalls,
+			after.progressKey,
+			after.notBefore,
+			after.state,
+			after.reported,
+			before?.revision ?? -1
+		])).toArray()).length !== changes.length) throw new Error("Maintenance due revision changed during transaction");
+	};
+	const flush = (frame) => {
+		if (frame.parent !== void 0) return;
+		const changes = [...current.changes.values()].filter(({ before, after }) => before === void 0 || !equivalent(before, after));
+		for (let offset = 0; offset < changes.length; offset += 11) write(changes.slice(offset, offset + 11));
+	};
+	/** Own the flush inside the source transaction without changing the SQL service.
+	* Acquire its shared connection permit through Effect requirements. Cleanup follows
+	* native settlement, including commit rejection or interruption. */
+	const withTransaction = (body) => Effect.flatMap(SqlClient, (client) => Effect.flatMap(Effect.serviceOption(client.transactionService), (ambient) => {
+		if (ambient._tag === "Some" && !ownsTransaction(storage, ambient.value[1])) return Effect.fail(SqlError.make({ reason: UnknownError.make({
+			operation: "begin maintenance source transaction",
+			message: "Use ThreadMutationGate.withTransaction at the outermost source transaction",
+			cause: /* @__PURE__ */ new Error("Unwrapped SQL transaction cannot own buffered maintenance intent")
+		}) }));
+		return Effect.uninterruptibleMask((restore) => Effect.suspend(() => {
+			let frame;
+			return client.withTransaction(Effect.flatMap(Effect.serviceOption(client.transactionService), (transaction) => Effect.sync(() => {
+				if (transaction._tag === "None") throw new Error("SQL transaction unavailable");
+				frame = begin(transaction.value[1]);
+			})).pipe(Effect.andThen(restore(body)), Effect.tap(() => Effect.try({
+				try: () => {
+					if (frame !== void 0) flush(frame);
+				},
+				catch: (cause) => SqlError.make({ reason: UnknownError.make({
+					cause,
+					operation: "flush maintenance due queue",
+					message: "Maintenance intent could not commit"
+				}) })
+			})))).pipe(Effect.onExit((exit) => Effect.sync(() => {
+				if (frame !== void 0) finish(frame, Exit.isSuccess(exit));
+			})), Effect.provideService(Scheduler.PreventSchedulerYield, true));
+		}));
+	}));
+	const transaction = async (body) => {
+		let frame;
+		try {
+			const result = await storage.transaction(async (transaction) => {
+				frame = begin();
+				const result = await body(transaction);
+				flush(frame);
+				return result;
+			});
+			if (frame !== void 0) finish(frame, true);
+			return result;
+		} catch (cause) {
+			if (frame !== void 0) finish(frame, false);
+			throw cause;
+		}
+	};
+	const initialize = () => {
+		sql.exec(`CREATE TABLE IF NOT EXISTS platform_cloudflare_due_queue (
+    id TEXT PRIMARY KEY, revision INTEGER NOT NULL, dueAt REAL, stalls INTEGER NOT NULL,
+    progressKey TEXT, notBefore REAL NOT NULL DEFAULT 0, state TEXT NOT NULL DEFAULT 'pending',
+    reported INTEGER NOT NULL DEFAULT 0
+  )`);
+		const columns = new Set(sql.exec("PRAGMA table_info(platform_cloudflare_due_queue)").toArray().map((row) => row.name));
+		if (!columns.has("reported")) sql.exec("ALTER TABLE platform_cloudflare_due_queue ADD COLUMN reported INTEGER NOT NULL DEFAULT 0");
+		if (!columns.has("progressKey")) sql.exec("ALTER TABLE platform_cloudflare_due_queue ADD COLUMN progressKey TEXT");
+		if (!columns.has("notBefore")) sql.exec("ALTER TABLE platform_cloudflare_due_queue ADD COLUMN notBefore REAL NOT NULL DEFAULT 0");
+		if (!columns.has("state")) {
+			sql.exec("ALTER TABLE platform_cloudflare_due_queue ADD COLUMN state TEXT NOT NULL DEFAULT 'pending'");
+			sql.exec("UPDATE platform_cloudflare_due_queue SET state = 'idle' WHERE dueAt IS NULL");
+		}
+	};
+	/** Keep dormant rows so delete/reinsert cannot reuse a revision held by an older wave. */
+	const read = () => {
+		if (current.rows !== void 0) return current.rows;
+		const rows = decode(sql.exec("SELECT id, revision, dueAt, stalls, progressKey, notBefore, state, reported FROM platform_cloudflare_due_queue").toArray());
+		if (current.frame !== void 0 || current.retained > 0 || rows.length <= 128) current.rows = rows;
+		return rows;
+	};
+	const set = (after) => {
+		const rows = read();
+		const before = rows.find((row) => row.id === after.id);
+		if (before !== void 0 && equivalent(before, after)) return before;
+		const previous = current.changes.get(after.id);
+		const change = {
+			before: previous === void 0 ? before : previous.before,
+			after
+		};
+		if (current.frame === void 0) write([change]);
+		else current.changes.set(after.id, change);
+		current.rows = [...rows.filter((row) => row.id !== after.id), after];
+		trim();
+		return after;
+	};
+	const dirty = (id, dueAt, progress = false, progressKey) => {
+		Schema.decodeSync(LaneId)(id);
+		Schema.decodeSync(Schema.Finite)(dueAt);
+		const row = read().find((row) => row.id === id);
+		const earliest = Math.min(current.deadlines.get(id) ?? dueAt, dueAt);
+		if (current.frame !== void 0) current.deadlines.set(id, earliest);
+		return set(DueLane.make({
+			id,
+			revision: row === void 0 ? 1 : row.revision + Number(progress),
+			dueAt: row === void 0 || progress ? earliest : Math.max(row.notBefore, Math.min(row.dueAt ?? Infinity, earliest)),
+			state: progress || (row?.stalls ?? 0) < 8 ? "pending" : row?.state ?? "pending",
+			stalls: progress ? 0 : row?.stalls ?? 0,
+			notBefore: progress ? 0 : row?.notBefore ?? 0,
+			reported: progress ? 0 : row?.reported ?? 0,
+			progressKey: progressKey ?? row?.progressKey ?? null
+		}));
+	};
+	/** A strictly increasing source cursor; old or repeated notices cannot renew a budget. */
+	const progress = (id, dueAt, cursor) => {
+		Schema.decodeSync(Schema.BigInt.check(Schema.isGreaterThanOrEqualToBigInt(0n)))(cursor);
+		const previous = read().find((row) => row.id === id)?.progressKey;
+		if (previous !== void 0 && previous !== null && cursor <= BigInt(previous)) return false;
+		dirty(id, dueAt, true, String(cursor));
+		return true;
+	};
+	/** One initial native discovery wave; host lanes always require explicit enrollment. */
+	const register = (id) => {
+		if (read().some((row) => row.id === id)) return;
+		set(DueLane.make({
+			id,
+			revision: 0,
+			dueAt: 0,
+			stalls: 0,
+			progressKey: null,
+			notBefore: 0,
+			state: "pending",
+			reported: 0
+		}));
+	};
+	/** This transaction must commit before fallible work: never defer a debit across a wave. */
+	const claim = (lane, nowMillis, native = false) => {
+		const row = read().find((row) => row.id === lane.id);
+		if (row === void 0 || row.revision !== lane.revision || row.dueAt === null || !(row.dueAt <= nowMillis || native && row.notBefore <= nowMillis)) return;
+		const stalls = Math.min(row.stalls + 1, 8);
+		const notBefore = nowMillis + (stalls >= 8 ? ParkedRetryMillis : Math.min(6e4, MinimumRetryMillis * 2 ** row.stalls));
+		return set(DueLane.make({
+			...row,
+			stalls,
+			notBefore,
+			dueAt: notBefore,
+			state: stalls >= 8 ? "parked" : "pending"
+		}));
+	};
+	const complete = (lane, dueAt) => {
+		Schema.decodeSync(Deadline)(dueAt);
+		const row = read().find((row) => row.id === lane.id);
+		if (row === void 0 || row.revision !== lane.revision) return;
+		const after = DueLane.make({
+			...row,
+			dueAt: dueAt === null ? null : Math.max(dueAt, row.notBefore),
+			state: dueAt === null ? "idle" : row.stalls >= 8 ? "parked" : "pending",
+			stalls: dueAt === null ? 0 : row.stalls,
+			notBefore: dueAt === null ? 0 : row.notBefore,
+			reported: dueAt === null ? 0 : row.reported
+		});
+		return set(DueLane.make({
+			...after,
+			revision: row.revision + 1
+		}));
+	};
+	/** Native checkpoints already fence their own dirty/processed generation. */
+	const checkpointNative = (dueAt) => {
+		Schema.decodeSync(Deadline)(dueAt);
+		const rows = read();
+		const row = rows.find((row) => row.id === Native);
+		if (row === void 0) return;
+		const publication = rows.find((row) => row.id === Publication);
+		set(DueLane.make({
+			...row,
+			dueAt: dueAt === null || publication?.state === "parked" ? null : Math.max(dueAt, row.notBefore),
+			state: dueAt === null ? "idle" : row.stalls >= 8 ? "parked" : "pending",
+			stalls: dueAt === null ? 0 : row.stalls,
+			notBefore: dueAt === null ? 0 : row.notBefore,
+			reported: dueAt === null ? 0 : row.reported
+		}));
+	};
+	const takeParkedReports = () => read().filter((row) => row.state === "parked" && row.reported === 0).map((row) => set(DueLane.make({
+		...row,
+		reported: 1
+	})));
+	return {
+		initialize,
+		withView,
+		withTransaction,
+		transaction,
+		read,
+		dirty,
+		progress,
+		register,
+		claim,
+		complete,
+		checkpointNative,
+		takeParkedReports
+	};
+};
+const next = (rows) => rows.reduce((next, row) => Math.min(next, row.dueAt ?? Infinity), Infinity);
+//#endregion
+//#region src/Alarm.ts
+var Alarm_exports = /* @__PURE__ */ __exportAll({
+	DurableAlarmError: () => DurableAlarmError,
+	DurableAlarmService: () => DurableAlarmService,
+	MaintenancePassReport: () => MaintenancePassReport,
+	ThreadHostMaintenance: () => ThreadHostMaintenance,
+	ThreadMaintenance: () => ThreadMaintenance,
+	ThreadMaintenanceFailpoint: () => ThreadMaintenanceFailpoint,
+	ThreadMessageDelivery: () => ThreadMessageDelivery,
+	ThreadMutationGate: () => ThreadMutationGate,
+	ThreadNativeMaintenance: () => ThreadNativeMaintenance,
+	ThreadPublication: () => ThreadPublication,
+	ThreadRecoveryEvents: () => ThreadRecoveryEvents,
+	ThreadRecoveryFaultEvent: () => ThreadRecoveryFaultEvent,
+	publishCommitted: () => publishCommitted
+});
+/**
+* The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE
+* alarm slot; due work (lease expiry, settlement
+* and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and
+* the slot always holds the EARLIEST deadline any caller asked for.
+*
+* The alarm invariant (plan §1.4): every committed actionable mutation carries a newer durable
+* maintenance generation and a committed alarm. Stable externally-driven waits may be
+* nonterminal without retaining an alarm; their resolving mutation advances the generation and
+* restores the alarm atomically.
+*/
+/** The Durable Object alarm API failed; surfaces on host entry points as a typed refusal. */
+var DurableAlarmError = class extends Schema.TaggedError()("DurableAlarmError", {
+	operation: Schema.String,
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/** Content-free operational notice: pending work now retries at the hourly ceiling. */
+var MaintenanceRetryParked = class extends Schema.TaggedError()("MaintenanceRetryParked", {
+	lane: Schema.String,
+	retryAfterMillis: Schema.Number
+}) {};
+const alarmFailure = (operation) => (cause) => DurableAlarmError.make({
+	operation,
+	message: safeCauseMessage(cause, "The Cloudflare alarm API failed without a diagnostic"),
+	cause
+});
+const makeStorageEffect = Effect.gen(function* () {
+	const sql = yield* SqlClient;
+	const { ctx } = yield* DurableObjectContext;
+	const invalidate$1 = Effect.sync(() => invalidate(ctx.storage));
+	return (operation, execute) => Effect.flatMap(Effect.serviceOption(sql.transactionService), (current) => {
+		const body = Effect.uninterruptible(execute);
+		if (current._tag === "Some") {
+			if (buffering(ctx.storage)) return body;
+			return body.pipe(Effect.ensuring(invalidate$1));
+		}
+		return Effect.scoped(Effect.andThen(sql.reserve.pipe(Effect.mapError(alarmFailure(operation))), body.pipe(Effect.onExit((exit) => Exit.isFailure(exit) ? invalidate$1 : Effect.void))));
+	});
+});
+const makeStorageOperation = Effect.map(makeStorageEffect, (run) => (operation, execute) => run(operation, Effect.tryPromise({
+	try: execute,
+	catch: alarmFailure(operation)
+})));
+/** Native `ctx.storage` alarm slot owned by ThreadMaintenance; storage is truth. */
+var DurableAlarmService = class DurableAlarmService extends Context.Service()("@effect-agent/platform-cloudflare/DurableAlarmService") {
+	static layer = Layer.effect(DurableAlarmService)(Effect.gen(function* () {
+		const { ctx } = yield* DurableObjectContext;
+		/**
+		* In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no
+		* running pass, and a deferred wake lost to eviction was only ever a promptness hint
+		* on top of the already-committed pre-armed alarm.
+		*/
+		const runningPasses = yield* Ref.make(0);
+		const storageOperation = yield* makeStorageOperation;
+		const scheduled = storageOperation("get alarm", () => ctx.storage.getAlarm()).pipe(Effect.map((deadline) => deadline === null ? Option.none() : Option.some(deadline)));
+		const scheduleAt = (epochMillis) => storageOperation("set alarm", () => ctx.storage.setAlarm(epochMillis));
+		const ensureScheduledBy = (epochMillis) => storageOperation("ensure alarm", () => ctx.storage.transaction(async (transaction) => {
+			const existing = await transaction.getAlarm();
+			if (existing === null || existing > epochMillis) await transaction.setAlarm(epochMillis);
+		}));
+		const armNow = Clock.currentTimeMillis.pipe(Effect.flatMap((now) => storageOperation("wake maintenance lanes", () => ctx.storage.transaction(async (transaction) => {
+			const next$7 = next(make(ctx.storage).read());
+			if (Number.isFinite(next$7)) await ensureTransactionAlarmBy(transaction, Math.max(now, next$7));
+		}))));
+		const scheduleNow = Ref.get(runningPasses).pipe(Effect.flatMap((passes) => passes > 0 ? Effect.void : armNow));
+		const withWakesDeferred = (body) => Ref.update(runningPasses, (passes) => passes + 1).pipe(Effect.andThen(body), Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1)));
+		const cancel = storageOperation("delete alarm", () => ctx.storage.deleteAlarm());
+		return DurableAlarmService.of({
+			scheduled,
+			scheduleAt,
+			ensureScheduledBy,
+			scheduleNow,
+			withWakesDeferred,
+			cancel
+		});
+	}));
+};
+/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */
+var MaintenancePassReport = class extends Schema.Class("@effect-agent/platform-cloudflare/MaintenancePassReport")({
+	/** `caught-up` ran no runtime work (publication may be pending); `actionable` ran recovery. */
+	phase: Schema.Literals(["caught-up", "actionable"]),
+	/** Recovery decisions and Thread faults observed during this event. */
+	recovered: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Head Attempts settled during the event. Joined input may settle with each head. */
+	settled: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Submissions still nonterminal after the pass (suspended/unknown lanes stay honest). */
+	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** `rearmed` for dirty/autonomous work, `cleared` for stable waits or settlement. */
+	alarm: Schema.Literals(["rearmed", "cleared"])
+}) {};
+/** Test-only fault authority; production uses the inert layer. */
+var ThreadMaintenanceFailpoint = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadMaintenanceFailpoint") {
+	static layer = Layer.succeed(this)({ hit: () => Effect.void });
+};
+const emptyPublication = {
+	invalidate: Effect.void,
+	prepareGeneration: () => Effect.void,
+	drain: Effect.succeed(Option.none())
+};
+/** Opt in with `ThreadObject.layer(registrations, { publication: Layer.effect(ThreadPublication)(...) })`. */
+var ThreadPublication = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadPublication") {
+	static layer = Layer.succeed(this)(emptyPublication);
+};
+const requiresPublication = Effect.map(Effect.serviceOption(ThreadPublication), (service) => Option.isNone(service) || service.value !== emptyPublication);
+/**
+* Host-assembled native message recovery. Preparation is a bounded local selection; the
+* driver bounds each actual Claim and persists its timeout/retry before `run` returns.
+* The alarm must not add a timer starting at selection: Claim setup and retry commits belong
+* to the driver. The prepared allowance decides only whether a wave fits this event.
+*/
+const ThreadMessageDelivery = Context.Reference("@effect-agent/platform-cloudflare/ThreadMessageDelivery", { defaultValue: () => ({ prepare: Effect.succeed({
+	timeoutMillis: 1,
+	run: Effect.succeed(Option.none())
+}) }) });
+/** Independent lanes share the existing alarm; compose hosts by concatenating their lanes. */
+const ThreadHostMaintenance = Context.Reference("@effect-agent/platform-cloudflare/ThreadHostMaintenance", { defaultValue: () => ({ lanes: [] }) });
+/** @internal Framework handlers are separate from host registrations and their namespace. */
+const ThreadNativeMaintenance = Context.Reference("@effect-agent/platform-cloudflare/ThreadNativeMaintenance", { defaultValue: () => ({ lanes: [] }) });
+/** @internal Required host publication only; native lifecycle facts use a maintenance lane. */
+const publishCommitted = Effect.gen(function* () {
+	const publication = yield* ThreadPublication;
+	yield* publication.invalidate;
+	yield* publication.drain;
+}).pipe(Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.logError("Thread publication deferred after source commit", cause)));
+const MaintenanceGeneration = Schema.BigIntFromString.check(Schema.isGreaterThanOrEqualToBigInt(0n));
+/** A committed recovery transition for one affected Submission; never a Settlement. */
+var ThreadRecoveryFaultEvent = class extends Schema.Class("@effect-agent/platform-cloudflare/ThreadRecoveryFaultEvent")({
+	schemaVersion: Schema.Literal(1),
+	/** Monotonic within the physical Object; retained unchanged on delivery retries. */
+	sequence: MaintenanceGeneration,
+	transition: Schema.Literals([
+		"created",
+		"changed",
+		"cleared"
+	]),
+	threadId: ThreadId,
+	submissionId: SubmissionId,
+	occurredAt: Schema.Finite,
+	firstFailedAt: Schema.Finite,
+	/** The current failure, or the last failure for a cleared event. */
+	failure: RecoveryFailure
+}) {};
+const recoveryEventKey = (sequence) => `effect-agent:thread-recovery-event:v1:${sequence}`;
+const encodeRecoveryEvent = Schema.encodeSync(ThreadRecoveryFaultEvent);
+const decodeRecoveryEvent = Schema.decodeUnknownSync(ThreadRecoveryFaultEvent);
+/**
+* Ordered, at-least-once delivery through the existing host maintenance lane. Return only
+* after durably applying the event or retaining it in a host outbox. Deduplicate by physical
+* Object and sequence; callbacks may repeat after interruption. This is a trusted host hook,
+* not pre-authorized UI data: the host owns recipient authorization and safe presentation.
+* Capture services in the Layer. Do not call producers or write the raw alarm slot.
+*/
+var ThreadRecoveryEvents = class extends Context.Service()("@effect-agent/platform-cloudflare/ThreadRecoveryEvents") {};
+var BindingWait = class extends Schema.Class("BindingWait")({
+	threadId: ThreadId,
+	submissionId: SubmissionId,
+	reportedAt: Schema.Finite
+}) {};
+/**
+* A durable observation of blocked recovery, independent of the execution journal. This is
+* neither a Settlement nor proof that external effects did not happen. A successful recovery
+* sweep clears it; repair must preserve canonical history and the original admission identity.
+*/
+var ThreadRecoveryFault = class extends Schema.Class("@effect-agent/platform-cloudflare/ThreadRecoveryFault")({
+	schemaVersion: Schema.Literal(1),
+	threadId: ThreadId,
+	firstFailedAt: Schema.Finite,
+	lastFailedAt: Schema.Finite,
+	/** Earliest automatic recovery retry; new admissions do not erase this deadline. */
+	retryAt: Schema.Finite,
+	/** Saturates at 2^31 - 1; one observation per Thread per recovery sweep. */
+	attempts: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(2147483647)),
+	failure: RecoveryFailure,
+	/** Individually retained recipients survive settlement until their clear commits. */
+	recipientCount: Schema.optionalKey(Schema.Natural)
+}) {};
+const recoveryFaultKey = (threadId) => `effect-agent:thread-recovery-fault:v1:${threadId}`;
+const decodeRecoveryFaultValue = Schema.decodeUnknownSync(ThreadRecoveryFault);
+const decodeRecoveryFault = (threadId, encoded) => {
+	const fault = decodeRecoveryFaultValue(encoded);
+	if (fault.threadId !== threadId) throw new Error("Recovery status does not match its Thread key");
+	return fault;
+};
+const encodeRecoveryFault = Schema.encodeSync(ThreadRecoveryFault);
+const sameRecoveryFailure = Schema.toEquivalence(RecoveryFailure);
+const decodeRecoveryRecipient = Schema.decodeUnknownSync(SubmissionId);
+const encodeRecoveryRecipient = Schema.encodeSync(SubmissionId);
+const recoveryRecipientKey = (threadId, index) => `effect-agent:recovery-recipient:v1:${threadId.length}:${threadId}:${index}`;
+const recoveryRecipientKeys = (fault, start) => Array.from({ length: Math.min(128, (fault.recipientCount ?? 0) - start) }, (_, offset) => recoveryRecipientKey(fault.threadId, start + offset));
+const readRecoveryRecipients = async (storage, fault) => {
+	const ids = [];
+	for (let start = 0; start < (fault.recipientCount ?? 0); start += 128) {
+		const keys = recoveryRecipientKeys(fault, start);
+		const values = await storage.get(keys);
+		for (const key of keys) ids.push(decodeRecoveryRecipient(values.get(key)));
+	}
+	return ids;
+};
+const appendRecoveryRecipients = async (transaction, threadId, count, added) => {
+	for (let start = 0; start < added.length; start += 128) await transaction.put(Object.fromEntries(added.slice(start, start + 128).map((id, offset) => [recoveryRecipientKey(threadId, count + start + offset), encodeRecoveryRecipient(id)])));
+};
+const recoveryEvent = (fault, submissionId, transition, occurredAt) => ({
+	schemaVersion: 1,
+	transition,
+	threadId: fault.threadId,
+	submissionId,
+	occurredAt,
+	firstFailedAt: fault.firstFailedAt,
+	failure: fault.failure
+});
+const nativeDispatchConcurrency = 2;
+/** Post-native delivery shares a finite connection budget across independent host lanes. */
+const afterNativeDispatchConcurrency = 2;
+var MaintenanceRetry = class extends Schema.Class("MaintenanceRetry")({
+	generation: MaintenanceGeneration,
+	notBefore: Schema.Finite,
+	nativeOnly: Schema.Boolean,
+	stalls: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(30))
+}) {};
+/** Versioned, platform-private maintenance state stored through Durable Object KV. */
+var ThreadMaintenanceState = class extends Schema.Class("@effect-agent/platform-cloudflare/ThreadMaintenanceState")({
+	schemaVersion: Schema.Literal(1),
+	dirty: MaintenanceGeneration,
+	processed: MaintenanceGeneration,
+	nonterminal: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** One physical-owner cursor; old single-lane records need no conversion. */
+	lastServedThreadId: Schema.optionalKey(ThreadId),
+	/** Rotate old recovery independently of dispatch, including after eviction or timeout. */
+	lastRecoveredThreadId: Schema.optionalKey(ThreadId),
+	/** Rotate bounded post-native admission across full events and Object eviction. */
+	lastAfterNativeLaneId: Schema.optionalKey(LaneId),
+	bindingRegistryKey: Schema.optionalKey(Schema.String),
+	bindingWaits: Schema.optionalKey(Schema.Array(BindingWait)),
+	recoveryEventSequence: Schema.optionalKey(MaintenanceGeneration),
+	recoveryEventAcknowledged: Schema.optionalKey(MaintenanceGeneration),
+	/** Absent on older records. A newer mutation makes this retry obsolete. */
+	retry: Schema.optionalKey(MaintenanceRetry)
+}) {};
+const MAINTENANCE_STATE_KEY = "effect-agent:thread-maintenance:v1";
+const decodeMaintenanceState = Schema.decodeUnknownSync(ThreadMaintenanceState);
+const encodeMaintenanceState = Schema.encodeSync(ThreadMaintenanceState);
+const hasRecoveryEvents = (state) => (state.recoveryEventSequence ?? 0n) > (state.recoveryEventAcknowledged ?? 0n);
+const initialMaintenanceState = () => ThreadMaintenanceState.make({
+	schemaVersion: 1,
+	dirty: 1n,
+	processed: 0n,
+	nonterminal: 0
+});
+const readMaintenanceState = async (transaction) => {
+	const encoded = await transaction.get(MAINTENANCE_STATE_KEY);
+	return encoded === void 0 ? {
+		state: initialMaintenanceState(),
+		initialized: false
+	} : {
+		state: decodeMaintenanceState(encoded),
+		initialized: true
+	};
+};
+const ensureTransactionAlarmBy = async (transaction, deadline) => {
+	const scheduled = await transaction.getAlarm();
+	if (scheduled === null || scheduled > deadline) await transaction.setAlarm(deadline);
+};
+const stableExternalWait = (snapshot, reports) => {
+	const report = reports.get(snapshot.submissionId);
+	if (report?.decision._tag === "SettleAborted") return false;
+	switch (snapshot.state) {
+		case "suspended":
+		case "joined": return true;
+		case "unknown": return report?.disposition === "unknown";
+		case "admitted": return reports.get(snapshot.submissionId)?.decision._tag === "AwaitParentEstablishment";
+		case "input-applied":
+		case "joining":
+		case "ready":
+		case "running":
+		case "settled":
+		case "terminalizing": return false;
+	}
+};
+/**
+* Shared prearm/acknowledgement boundary for ingress and runtime-owned producers.
+* `ThreadObject.layer` provides this same instance in its Services. Rebuilt runtime/maintenance
+* Layers must reuse that instance; a second gate cannot observe the native producers' activity.
+*/
+const CurrentMutationLanes = Context.Reference("@effect-agent/platform-cloudflare/CurrentMutationLanes", { defaultValue: () => [] });
+const CurrentNativeSource = Context.Reference("@effect-agent/platform-cloudflare/CurrentNativeSource", { defaultValue: () => false });
+var ThreadMutationGate = class ThreadMutationGate extends Context.Service()("@effect-agent/platform-cloudflare/internal/ThreadMutationGate") {
+	static layer = Layer.effect(this)(Effect.gen(function* () {
+		const { ctx } = yield* DurableObjectContext;
+		const sql = yield* SqlClient;
+		const dueQueue = make(ctx.storage);
+		const config = yield* CloudflareDurableRuntimeConfig;
+		const failpoint = yield* ThreadMaintenanceFailpoint;
+		const activeMutations = yield* Ref.make(0);
+		const activeLanes = /* @__PURE__ */ new Map();
+		const generationGate = yield* Semaphore.make(1);
+		let revision = 0;
+		let changed = yield* Deferred.make();
+		const notify = Effect.gen(function* () {
+			const previous = changed;
+			changed = yield* Deferred.make();
+			revision++;
+			yield* Deferred.succeed(previous, void 0);
+		});
+		const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
+		const runTransaction = yield* makeStorageOperation;
+		const validateSourceBoundary = Effect.flatMap(Effect.serviceOption(sql.transactionService), (current) => current._tag === "Some" && buffering(ctx.storage) && !ownsTransaction(ctx.storage, current.value[1]) ? Effect.fail(DurableAlarmError.make({
+			operation: "enroll maintenance source",
+			message: "Nested source scheduling requires ThreadMutationGate.withTransaction"
+		})) : Effect.void);
+		yield* runTransaction("initialize maintenance due queue", async () => {
+			dueQueue.initialize();
+			dueQueue.register(Native);
+		});
+		const schedule = Effect.fn("ThreadMutationGate.schedule")(function* (id, dueAt, progressCursor) {
+			yield* validateSourceBoundary;
+			const now = yield* Clock.currentTimeMillis;
+			const current = yield* Effect.serviceOption(sql.transactionService);
+			const enroll = async (transaction) => {
+				if (progressCursor === void 0) dueQueue.dirty(id, dueAt);
+				else if (dueQueue.progress(id, dueAt, progressCursor) && (id === "effect-agent:native" || id === "effect-agent:publication")) {
+					if (id === "effect-agent:publication") dueQueue.dirty(Native, dueAt, true);
+					const { state } = await readMaintenanceState(transaction);
+					await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+						...Struct.omit(state, ["retry"]),
+						dirty: state.dirty + 1n
+					})));
+				}
+				const next$2 = next(dueQueue.read());
+				if (Number.isFinite(next$2)) await ensureTransactionAlarmBy(transaction, Math.max(next$2, now + minimumAlarmDelay));
+			};
+			yield* runTransaction("schedule maintenance lane", () => Option.isSome(current) ? enroll(ctx.storage) : dueQueue.transaction(enroll));
+			yield* notify;
+		});
+		const beginMutation = Effect.fn("ThreadMaintenance.beginMutation")(function* (invalidatesRecovery, lanes) {
+			yield* failpoint.hit("maintenance:dirty:before");
+			const now = yield* Clock.currentTimeMillis;
+			const nativeSource = yield* CurrentNativeSource;
+			const publicationRequired = yield* requiresPublication;
+			if (invalidatesRecovery || lanes.length > 0) yield* runTransaction("advance maintenance generation", () => dueQueue.transaction(async (transaction) => {
+				const { state, initialized } = await readMaintenanceState(transaction);
+				if (invalidatesRecovery) {
+					dueQueue.dirty(Native, now);
+					if (publicationRequired) dueQueue.dirty(Publication, now);
+				}
+				for (const id of lanes) dueQueue.dirty(id, now, false);
+				const next$1 = ThreadMaintenanceState.make({
+					...state,
+					dirty: state.dirty + (invalidatesRecovery && !nativeSource ? 1n : 0n)
+				});
+				if (invalidatesRecovery || !initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next$1));
+				const deadline = next(dueQueue.read());
+				if (Number.isFinite(deadline)) await ensureTransactionAlarmBy(transaction, Math.max(deadline, now + minimumAlarmDelay));
+			}));
+			yield* failpoint.hit("maintenance:dirty:after");
+			yield* Ref.update(activeMutations, (active) => active + 1);
+			const enrolled = /* @__PURE__ */ new Set([...lanes, ...invalidatesRecovery ? [Native, ...publicationRequired ? [Publication] : []] : []]);
+			for (const id of enrolled) activeLanes.set(id, (activeLanes.get(id) ?? 0) + 1);
+			return enrolled;
+		});
+		const releaseLanes = (enrolled, committed = false) => Effect.sync(() => {
+			for (const id of enrolled) {
+				if (committed && (id === "effect-agent:native" || id === "effect-agent:publication")) continue;
+				const remaining = (activeLanes.get(id) ?? 1) - 1;
+				if (remaining === 0) activeLanes.delete(id);
+				else activeLanes.set(id, remaining);
+				enrolled.delete(id);
+			}
+		});
+		const endMutation = (enrolled) => generationGate.withPermit(releaseLanes(enrolled).pipe(Effect.andThen(Ref.update(activeMutations, (active) => Math.max(0, active - 1)))));
+		const withMutation = (body, options) => Effect.flatMap(Effect.serviceOption(sql.transactionService), (current) => Option.isSome(current) ? Effect.fail(DurableAlarmError.make({
+			operation: "prearm maintenance mutation",
+			message: "Run withMutation outside the source SQL transaction so prearming commits first"
+		})) : Effect.acquireUseRelease(generationGate.withPermit(beginMutation(options?.invalidatesRecovery ?? true, options?.lanes ?? [])), (enrolled) => failpoint.hit("maintenance:mutation:armed").pipe(Effect.andThen(Effect.flatMap(CurrentMutationLanes, (current) => body.pipe(Effect.provideService(CurrentMutationLanes, [.../* @__PURE__ */ new Set([...current, ...enrolled])])))), Effect.tap(() => releaseLanes(enrolled, true).pipe(Effect.andThen(notify))), Effect.tap(() => failpoint.hit("maintenance:mutation:finished"))), (enrolled) => endMutation(enrolled).pipe(Effect.andThen(notify))));
+		const recordProgress = Effect.fn("ThreadMutationGate.recordProgress")(function* (lanes) {
+			yield* validateSourceBoundary;
+			if (Option.isNone(yield* Effect.serviceOption(sql.transactionService))) return yield* DurableAlarmError.make({
+				operation: "record source progress",
+				message: "Source progress requires its authoritative SQL transaction"
+			});
+			const affected = /* @__PURE__ */ new Set([...lanes, ...yield* CurrentMutationLanes]);
+			if (!(yield* requiresPublication)) affected.delete(Publication);
+			if (affected.has("effect-agent:publication")) affected.add(Native);
+			if (affected.size === 0) return;
+			const now = yield* Clock.currentTimeMillis;
+			const nativeSource = yield* CurrentNativeSource;
+			yield* runTransaction("record maintenance producer progress", async () => {
+				for (const id of affected) dueQueue.dirty(id, now, true);
+				if (affected.has("effect-agent:native")) {
+					const { state } = await readMaintenanceState(ctx.storage);
+					await ctx.storage.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+						...Struct.omit(state, ["retry"]),
+						dirty: state.dirty + (nativeSource ? 0n : 1n)
+					})));
+				}
+				await ensureTransactionAlarmBy(ctx.storage, now + minimumAlarmDelay);
+			});
+			yield* notify;
+		});
+		return ThreadMutationGate.of({
+			withTransaction: (body) => dueQueue.withTransaction(body).pipe(Effect.provideService(SqlClient, sql)),
+			withMutation,
+			schedule,
+			recordProgress,
+			activeLanes: Effect.sync(() => new Set(activeLanes.keys())),
+			revision: Effect.sync(() => revision),
+			awaitChange: (observed) => Effect.suspend(() => observed === revision ? Deferred.await(changed) : Effect.void),
+			withSnapshot: (body) => generationGate.withPermit(Effect.flatMap(Ref.get(activeMutations), body))
+		});
+	}));
+};
+/**
+* Incremental, quiescent maintenance over a durable dirty/processed generation (issue #93).
+*
+* One physical event owns native scheduling, auxiliary delivery and final alarm rearming.
+*
+* 1. Prearm before any work. A caught-up native step uses the O(1) generation record without
+*    recovery, ledger scans or canonical-history reads.
+* 2. Reconcile before each head Attempt, then checkpoint only the observed generation. A racing
+*    producer keeps its generation dirty and immediately eligible. Quiescent native retries
+*    retain their durable backoff.
+* 3. Admit at most two independent Thread Attempts, one active head per Thread.
+*    Keep native and delivery admission open together while finite waves remain active, so
+*    fresh replies and abort controls can progress during unrelated cleanup. Close atomically
+*    at quiescence, or at the original ten-minute yield deadline, then join admitted waves.
+* 4. Native message delivery retains its driver-owned Claim deadline. Host/backfill waves are
+*    bounded independently; incoming native work never restarts or cancels their attempts.
+*    Auxiliary failures are reported after the current native opportunity.
+* 5. Close every event resource before the final gated deadline snapshot and alarm decision.
+*    The whole event retains one fourteen-minute cooperative timeout.
+*/
+var ThreadMaintenance = class ThreadMaintenance extends Context.Service()("@effect-agent/platform-cloudflare/ThreadMaintenance") {
+	static layer = Layer.effect(ThreadMaintenance)(Effect.gen(function* () {
+		const runtime = yield* DurableAgentRuntime;
+		const recoveryConfig = yield* DurableRuntimeConfig;
+		const ledger = yield* SubmissionLedger;
+		const wakes = yield* WakeScheduler;
+		const alarm = yield* DurableAlarmService;
+		const config = yield* CloudflareDurableRuntimeConfig;
+		const { ctx } = yield* DurableObjectContext;
+		const dueQueue = make(ctx.storage);
+		const storage = DurableObjectStorage.fromDurableObjectStorage(ctx.storage);
+		const runStorage = yield* makeStorageEffect;
+		const failpoint = yield* ThreadMaintenanceFailpoint;
+		const mutations = yield* ThreadMutationGate;
+		const publication = yield* ThreadPublication;
+		const publicationContext = yield* Effect.context();
+		const projection = yield* ThreadProjectionMaintenance;
+		const messages = yield* ThreadMessageDelivery;
+		const host = yield* ThreadHostMaintenance;
+		const framework = yield* ThreadNativeMaintenance;
+		for (const lane of host.lanes) yield* Schema.decodeEffect(HostLaneId)(lane.id).pipe(Effect.mapError(alarmFailure("maintenance lane ID")));
+		const recoveryEvents = Option.getOrElse(yield* Effect.serviceOption(ThreadRecoveryEvents), () => ThreadRecoveryEvents.of({ publish: () => Effect.void }));
+		let recoveryEventsPending = false;
+		const maintenancePassGate = yield* Semaphore.make(1);
+		const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
+		const runTransaction = yield* makeStorageOperation;
+		const queueSnapshot = runTransaction("read maintenance due queue", async () => dueQueue.read());
+		const reportParked = Effect.gen(function* () {
+			if (!(yield* queueSnapshot).some((row) => row.state === "parked" && row.reported === 0)) return;
+			const rows = yield* runTransaction("mark parked maintenance reports", () => dueQueue.transaction(async () => dueQueue.takeParkedReports()));
+			for (const row of rows) {
+				const lane = [
+					"effect-agent:native",
+					"effect-agent:publication",
+					"effect-agent:projection",
+					"effect-agent:messages",
+					"effect-agent:recovery-events",
+					"effect-agent:lifecycle"
+				].includes(row.id) ? row.id.slice(13) : "host";
+				yield* ErrorReporter.report(Cause.fail(MaintenanceRetryParked.make({
+					lane,
+					retryAfterMillis: ParkedRetryMillis
+				})));
+			}
+		}).pipe(Effect.catchCause((cause) => ErrorReporter.report(cause)));
+		yield* runTransaction("register native maintenance lanes", () => dueQueue.transaction(async () => {
+			for (const id of [
+				Publication,
+				Projection,
+				Messages,
+				...framework.lanes.map((lane) => lane.id)
+			]) dueQueue.register(id);
+			if (framework.lanes.some((lane) => lane.id === "effect-agent:lifecycle")) {
+				const start = dueQueue.read().find((row) => row.id === "effect-agent:lifecycle-start");
+				if (start !== void 0 && start.dueAt !== null) {
+					dueQueue.dirty(Lifecycle, start.dueAt);
+					dueQueue.complete(start, null);
+				}
+			}
+		}));
+		const runQueued = (selected, work, observed, yielded) => {
+			let row = selected;
+			let charged = false;
+			return Effect.gen(function* () {
+				const now = yield* Clock.currentTimeMillis;
+				const claimed = yield* runTransaction("charge maintenance attempt", () => dueQueue.transaction(async (transaction) => {
+					const claimed = dueQueue.claim(selected, now);
+					const next$5 = next(dueQueue.read());
+					if (Number.isFinite(next$5)) await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next$5));
+					else await transaction.deleteAlarm();
+					return claimed;
+				}));
+				if (claimed === void 0) return Option.none();
+				row = claimed;
+				charged = true;
+				observed.charged.set(row.id, row.revision);
+				observed.queue.set(row.id, row);
+				observed.available.set(row.id, row.revision);
+				return yield* work;
+			}).pipe(Effect.onExit((exit) => {
+				if (!charged) return Effect.void;
+				if (yielded?.() === true && Exit.isFailure(exit) && Cause.hasInterruptsOnly(exit.cause)) {
+					observed.queue.delete(row.id);
+					return Effect.void;
+				}
+				return mutations.withSnapshot(() => Effect.gen(function* () {
+					const active = (yield* mutations.activeLanes).has(row.id);
+					const now = yield* Clock.currentTimeMillis;
+					const next = Exit.isFailure(exit) ? now + backoffDelay(row.stalls, yield* Random.next) : Option.getOrNull(exit.value);
+					const checkpointed = yield* runTransaction("checkpoint maintenance lane", () => dueQueue.transaction(async () => {
+						if (active) return;
+						if (dueQueue.read().find((lane) => lane.id === row.id)?.revision !== row.revision) return;
+						return dueQueue.complete(row, next)?.revision;
+					}));
+					if (checkpointed !== void 0) observed.available.set(row.id, checkpointed);
+				})).pipe(Effect.interruptible);
+			}));
+		};
+		const appendRecoveryEvents = async (transaction, events) => {
+			if (events.length === 0) return;
+			const { state } = await readMaintenanceState(transaction);
+			let sequence = state.recoveryEventSequence ?? 0n;
+			for (const event of events) {
+				sequence++;
+				await transaction.put(recoveryEventKey(sequence), encodeRecoveryEvent(ThreadRecoveryFaultEvent.make({
+					...event,
+					sequence
+				})));
+			}
+			await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+				...state,
+				recoveryEventSequence: sequence
+			})));
+			dueQueue.dirty(RecoveryEvents, 0, true);
+			recoveryEventsPending = true;
+		};
+		const recoveryEventLane = {
+			id: RecoveryEvents,
+			dispatchTimeoutMillis: 3e4,
+			run: Effect.gen(function* () {
+				if (!recoveryEventsPending) return Option.none();
+				const range = yield* runTransaction("select recovery events", () => dueQueue.transaction(async (transaction) => {
+					const { state } = await readMaintenanceState(transaction);
+					return {
+						next: (state.recoveryEventAcknowledged ?? 0n) + 1n,
+						through: state.recoveryEventSequence ?? 0n
+					};
+				}));
+				for (let sequence = range.next; sequence <= range.through; sequence++) {
+					const event = yield* runTransaction("read recovery event", async () => {
+						const event = decodeRecoveryEvent(await ctx.storage.get(recoveryEventKey(sequence)));
+						if (event.sequence !== sequence) throw new Error("Recovery event does not match its sequence key");
+						return event;
+					});
+					yield* recoveryEvents.publish(event);
+					const acknowledgedAt = yield* Clock.currentTimeMillis;
+					yield* runTransaction("acknowledge recovery event", () => dueQueue.transaction(async (transaction) => {
+						const { state } = await readMaintenanceState(transaction);
+						const next = ThreadMaintenanceState.make({
+							...state,
+							recoveryEventAcknowledged: sequence
+						});
+						await transaction.delete(recoveryEventKey(sequence));
+						await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+						recoveryEventsPending = hasRecoveryEvents(next);
+						dueQueue.progress(RecoveryEvents, acknowledgedAt, sequence);
+						const lane = dueQueue.read().find((row) => row.id === RecoveryEvents);
+						if (lane !== void 0) dueQueue.complete(lane, recoveryEventsPending ? acknowledgedAt : null);
+					}));
+				}
+				return recoveryEventsPending ? Option.some(0) : Option.none();
+			})
+		};
+		const recordRecoveryFaults = Effect.fn("ThreadMaintenance.recordRecoveryFaults")(function* (result, recovery, current) {
+			const threads = /* @__PURE__ */ new Map();
+			for (const report of result.reports) threads.set(report.threadId, void 0);
+			for (const blocked of result.blocked) threads.set(blocked.threadId, blocked.failure);
+			if (threads.size === 0) return /* @__PURE__ */ new Map();
+			const now = yield* Clock.currentTimeMillis;
+			const submissions = current ?? (result.blocked.length === 0 ? [] : yield* Stream.runCollect(ledger.scanNonterminal));
+			yield* failpoint.hit("maintenance:recovery-status:before");
+			const retained = yield* runTransaction("record Thread recovery faults", () => dueQueue.transaction(async (transaction) => {
+				const events = [];
+				const newlyBlocked = [];
+				const faults = /* @__PURE__ */ new Map();
+				const recipients = /* @__PURE__ */ new Map();
+				for (const [threadId, failure] of threads) {
+					const key = recoveryFaultKey(threadId);
+					const encoded = await transaction.get(key);
+					const previous = encoded === void 0 ? void 0 : decodeRecoveryFault(threadId, encoded);
+					const previousIds = previous === void 0 ? [] : await readRecoveryRecipients(transaction, previous);
+					const known = new Set(previousIds);
+					recipients.set(threadId, known);
+					if (failure === void 0) {
+						if (previous !== void 0) {
+							await transaction.delete(key);
+							for (let start = 0; start < (previous.recipientCount ?? 0); start += 128) await transaction.delete(recoveryRecipientKeys(previous, start));
+							for (const id of previous.recipientCount === void 0 ? result.reports.filter((report) => report.threadId === threadId).map((report) => report.submissionId) : previousIds) events.push(recoveryEvent(previous, id, "cleared", now));
+						}
+						continue;
+					}
+					const added = submissions.filter((row) => row.threadId === threadId && !known.has(row.submissionId)).map((row) => row.submissionId);
+					await appendRecoveryRecipients(transaction, threadId, previousIds.length, added);
+					const fault = ThreadRecoveryFault.make({
+						schemaVersion: 1,
+						threadId,
+						firstFailedAt: previous?.firstFailedAt ?? now,
+						lastFailedAt: now,
+						attempts: Math.min(2147483647, (previous?.attempts ?? 0) + 1),
+						retryAt: now + Math.min(6e4, 5e3 * 2 ** Math.min(30, previous?.attempts ?? 0)),
+						failure,
+						recipientCount: previousIds.length + added.length
+					});
+					await transaction.put(key, encodeRecoveryFault(fault));
+					if (previous !== void 0 && !sameRecoveryFailure(previous.failure, failure)) for (const id of previousIds) events.push(recoveryEvent(fault, id, "changed", now));
+					for (const id of added) {
+						known.add(id);
+						events.push(recoveryEvent(fault, id, "created", now));
+					}
+					faults.set(threadId, fault);
+					if (previous === void 0) newlyBlocked.push(fault);
+				}
+				await appendRecoveryEvents(transaction, events);
+				return {
+					changed: new Set(events.map((event) => event.threadId)),
+					newlyBlocked,
+					faults,
+					recipients
+				};
+			}));
+			yield* failpoint.hit("maintenance:recovery-status:after");
+			for (const [threadId, ids] of retained.recipients) recovery.recipients.set(threadId, ids);
+			for (const threadId of retained.changed) yield* wakes.notify(threadId);
+			for (const fault of retained.newlyBlocked) yield* Effect.logError("Native Thread recovery blocked; accepted work remains pending", fault.failure.reason === "defect" ? Cause.die(fault.failure) : Cause.fail(fault.failure)).pipe(Effect.annotateLogs({ threadId: fault.threadId }));
+			return retained.faults;
+		});
+		const recoverThread = Effect.fn("ThreadMaintenance.recoverThread")(function* (threadId, recovery) {
+			const result = yield* runtime.runRecovery({ threadId }).pipe(Effect.provideService(CurrentNativeSource, true));
+			const faults = yield* recordRecoveryFaults(result, recovery);
+			for (const report of result.reports) recovery.reports.set(report.submissionId, report);
+			recovery.faults.delete(threadId);
+			for (const [id, fault] of faults) recovery.faults.set(id, fault);
+			recovery.recovered += result.reports.length + result.blocked.length;
+			recovery.repaired ||= result.reports.some((report) => report.disposition === "repaired");
+		});
+		const readCurrentMaintenanceState = async (transaction) => {
+			const current = await readMaintenanceState(transaction);
+			if (current.state.bindingRegistryKey === runtime.bindingRegistryKey) return current;
+			const state = ThreadMaintenanceState.make({
+				...Struct.omit(current.state, ["retry"]),
+				bindingRegistryKey: runtime.bindingRegistryKey,
+				bindingWaits: [],
+				dirty: current.state.dirty + 1n
+			});
+			await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+			dueQueue.dirty(Native, 0, true);
+			return {
+				state,
+				initialized: true
+			};
+		};
+		const ensureAlarm = Effect.fn("ThreadMaintenance.ensureAlarm")(function* () {
+			yield* failpoint.hit("maintenance:ensure:before");
+			const now = yield* Clock.currentTimeMillis;
+			yield* runTransaction("ensure maintenance alarm", () => dueQueue.transaction(async (transaction) => {
+				const { state, initialized } = await readCurrentMaintenanceState(transaction);
+				recoveryEventsPending = hasRecoveryEvents(state);
+				const rows = dueQueue.read();
+				if (recoveryEventsPending && !rows.some((row) => row.id === "effect-agent:recovery-events")) dueQueue.dirty(RecoveryEvents, now);
+				if (!initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+				const native = state.dirty > state.processed ? state.retry?.generation === state.dirty ? state.retry.notBefore : rows.find((row) => row.id === "effect-agent:native")?.dueAt ?? now + minimumAlarmDelay : null;
+				dueQueue.checkpointNative(native);
+				const next$3 = next(dueQueue.read());
+				if (Number.isFinite(next$3)) await ensureTransactionAlarmBy(transaction, Math.max(now + minimumAlarmDelay, next$3));
+			}));
+			yield* failpoint.hit("maintenance:ensure:after");
+		});
+		const beginPass = Effect.fn("ThreadMaintenance.beginPass")(function* (observed) {
+			yield* failpoint.hit("maintenance:begin:before");
+			const now = yield* Clock.currentTimeMillis;
+			const result = yield* runTransaction("begin maintenance pass", () => dueQueue.transaction(async (transaction) => {
+				const { state, initialized } = await readCurrentMaintenanceState(transaction);
+				recoveryEventsPending = hasRecoveryEvents(state);
+				observed.generation = state.dirty;
+				if (!initialized) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+				const retryAt = state.retry?.generation === state.dirty ? state.retry.notBefore : 0;
+				const rows = dueQueue.read();
+				const native = rows.find((row) => row.id === Native);
+				const publication = rows.find((row) => row.id === Publication);
+				if (state.processed >= state.dirty || retryAt > now || native === void 0 || native.dueAt === null || native.notBefore > now || publication?.state === "parked") return {
+					_tag: "CaughtUp",
+					nonterminal: state.nonterminal
+				};
+				const charged = observed.charged.get("effect-agent:native") === native.revision ? native : dueQueue.claim(native, now, true);
+				if (charged === void 0) return {
+					_tag: "CaughtUp",
+					nonterminal: state.nonterminal
+				};
+				observed.queue.set(Native, charged);
+				observed.charged.set(Native, charged.revision);
+				const deadline = next(dueQueue.read());
+				if (Number.isFinite(deadline)) await transaction.setAlarm(Math.max(now + minimumAlarmDelay, deadline));
+				else await transaction.deleteAlarm();
+				return {
+					_tag: "Actionable",
+					generation: state.dirty,
+					sourceRevision: charged.revision,
+					nonterminal: state.nonterminal,
+					stalls: charged.stalls
+				};
+			}));
+			yield* failpoint.hit("maintenance:begin:after");
+			return result;
+		});
+		const backoffDelay = (priorStalls, jitter) => {
+			const backoff = Math.min(config.alarmBackoffCap, config.alarmBackoffBase * 2 ** Math.min(priorStalls, 30));
+			return Math.ceil(backoff / 2 + backoff / 2 * jitter);
+		};
+		const rearmDelay = Effect.fn("ThreadMaintenance.rearmDelay")(function* (progressed, priorStalls) {
+			return progressed ? config.alarmBackoffBase : backoffDelay(priorStalls, yield* Random.next);
+		});
+		const rearmFailure = Effect.fn("ThreadMaintenance.rearmFailure")(function* (observed) {
+			const { generation, nativeOnly } = observed;
+			if (generation === void 0) return;
+			yield* failpoint.hit("maintenance:retry:before");
+			yield* mutations.withSnapshot((active) => Effect.gen(function* () {
+				const now = yield* Clock.currentTimeMillis;
+				const jitter = yield* Random.next;
+				yield* runTransaction("back off failed maintenance", () => dueQueue.transaction(async (transaction) => {
+					const { state } = await readMaintenanceState(transaction);
+					const previous = state.retry?.generation === generation && state.retry.nativeOnly === nativeOnly ? state.retry : void 0;
+					const retry = state.retry?.generation === generation && state.retry.nativeOnly ? state.retry : MaintenanceRetry.make({
+						generation,
+						notBefore: Math.max(previous?.notBefore ?? 0, now + backoffDelay(previous?.stalls ?? 0, jitter)),
+						nativeOnly,
+						stalls: Math.min(30, (previous?.stalls ?? 0) + 1)
+					});
+					await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+						...state,
+						retry
+					})));
+					const nativeDeadline = active > 0 || state.dirty !== generation ? now + minimumAlarmDelay : retry.notBefore;
+					dueQueue.checkpointNative(state.dirty > state.processed || active > 0 ? nativeDeadline : null);
+					for (const row of observed.queue.values()) if (row.id !== "effect-agent:native" && row.dueAt !== null && row.dueAt <= now) {
+						const charged = observed.charged.get(row.id) === row.revision ? row : dueQueue.claim(row, now);
+						if (charged !== void 0) dueQueue.complete(charged, now + backoffDelay(charged.stalls, jitter));
+					}
+					const next$4 = next(dueQueue.read());
+					if (Number.isFinite(next$4)) await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next$4));
+					else await transaction.deleteAlarm();
+				}));
+			}));
+			yield* failpoint.hit("maintenance:retry:after");
+		});
+		const beginNative = Effect.fn("ThreadMaintenance.beginNative")(function* (observed) {
+			return yield* mutations.withSnapshot((activeAtStart) => Effect.gen(function* () {
+				const generation = yield* beginPass(observed);
+				if (activeAtStart === 0) {
+					const native = (yield* queueSnapshot).find((row) => row.id === Native);
+					if (native !== void 0) observed.available.set(native.id, native.revision);
+				}
+				return {
+					...generation,
+					activeAtStart
+				};
+			}));
+		});
+		const attemptSelected = Effect.fn("ThreadMaintenance.attemptSelected")(function* (selected, previousWaits, yieldAfter, recovery) {
+			yield* recoverThread(selected.threadId, recovery);
+			let bindingFailure;
+			const settlement = recovery.faults.has(selected.threadId) ? Option.none() : yield* runtime.processThreadHead(selected.threadId, { yieldAfter }).pipe(Effect.provideService(CurrentNativeSource, true), Effect.catchTag("BindingUnavailable", (failure) => {
+				bindingFailure = failure;
+				return Effect.succeed(Option.none());
+			}));
+			const previous = previousWaits.find((wait) => wait.submissionId === selected.submissionId);
+			const wait = bindingFailure === void 0 ? void 0 : BindingWait.make({
+				threadId: selected.threadId,
+				submissionId: selected.submissionId,
+				reportedAt: previous?.reportedAt ?? (yield* Clock.currentTimeMillis)
+			});
+			if (bindingFailure !== void 0 && previous === void 0) yield* Effect.logError("Thread parked until its agent binding registry changes; original work remains pending", Cause.fail(bindingFailure)).pipe(Effect.annotateLogs({
+				threadId: selected.threadId,
+				submissionId: selected.submissionId
+			}));
+			if (wait !== void 0 || previous !== void 0) {
+				yield* failpoint.hit("maintenance:binding-retry:before");
+				yield* runStorage("record submission binding wait", storage.transaction((transaction) => Effect.gen(function* () {
+					const encoded = yield* transaction.get(MAINTENANCE_STATE_KEY);
+					const state = encoded === void 0 ? initialMaintenanceState() : yield* Schema.decodeUnknownEffect(ThreadMaintenanceState)(encoded);
+					const bindingWaits = [...(state.bindingWaits ?? []).filter((entry) => entry.submissionId !== selected.submissionId), ...wait === void 0 ? [] : [wait]];
+					yield* transaction.put(MAINTENANCE_STATE_KEY, yield* Schema.encodeEffect(ThreadMaintenanceState)(ThreadMaintenanceState.make({
+						...state,
+						bindingWaits
+					})));
+				})).pipe(Effect.mapError(alarmFailure("record submission binding wait"))));
+				yield* failpoint.hit("maintenance:binding-retry:after");
+			}
+			return Option.isSome(settlement) ? 1 : 0;
+		});
+		const advance = Effect.fn("ThreadMaintenance.advance")(function* (started, yieldAfter, observed, recovery, native, dispatch = true, reserved = new Set(native.active.keys())) {
+			let publicationRow = (yield* queueSnapshot).find((row) => row.id === Publication);
+			if (publicationRow !== void 0 && publicationRow.dueAt !== null && publicationRow.dueAt <= (yield* Clock.currentTimeMillis)) {
+				yield* runQueued(publicationRow, mutations.withSnapshot((active) => started._tag === "Actionable" && active === 0 ? publication.prepareGeneration(started.generation) : Effect.void).pipe(Effect.andThen(publication.drain)), observed);
+				publicationRow = (yield* queueSnapshot).find((row) => row.id === Publication);
+			}
+			const pending = Option.fromNullishOr(publicationRow?.dueAt);
+			if (started._tag === "CaughtUp" || Option.isSome(pending) || publicationRow?.state === "parked") {
+				const nextAttemptAt = yield* mutations.withSnapshot((active) => Effect.gen(function* () {
+					const now = yield* Clock.currentTimeMillis;
+					const { state } = yield* runTransaction("read native maintenance deadline", () => dueQueue.transaction((transaction) => readMaintenanceState(transaction)));
+					const native = active > 0 || state.dirty > state.processed ? state.retry?.generation === state.dirty && active === 0 ? state.retry.notBefore : now + minimumAlarmDelay : Infinity;
+					const next = Option.isSome(pending) ? pending.value : native;
+					return Number.isFinite(next) ? Math.max(now + minimumAlarmDelay, next) : void 0;
+				}));
+				return {
+					phase: "caught-up",
+					nonterminal: started.nonterminal,
+					nextAttemptAt
+				};
+			}
+			if (native.generation !== started.generation || native.sourceRevision !== started.sourceRevision) {
+				native.deferred.clear();
+				native.generation = started.generation;
+				native.sourceRevision = started.sourceRevision;
+			}
+			if (native.active.size > 0 && native.scanGeneration === started.generation && native.scanRevision === started.sourceRevision) return {
+				phase: "actionable",
+				nonterminal: started.nonterminal,
+				nextAttemptAt: void 0
+			};
+			native.scanGeneration = started.activeAtStart === 0 ? started.generation : void 0;
+			native.scanRevision = started.activeAtStart === 0 ? started.sourceRevision : void 0;
+			observed.nativeOnly = true;
+			const observation = recovery.observation ??= {
+				generation: started.generation,
+				activeAtStart: started.activeAtStart
+			};
+			const current = yield* Stream.runCollect(ledger.scanNonterminal);
+			const selectionTime = yield* Clock.currentTimeMillis;
+			const submissionsByThread = /* @__PURE__ */ new Map();
+			for (const row of current) {
+				const ids = submissionsByThread.get(row.threadId) ?? [];
+				ids.push(row.submissionId);
+				submissionsByThread.set(row.threadId, ids);
+			}
+			yield* runTransaction("read Thread recovery deadlines", async () => {
+				for (const [threadId, ids] of submissionsByThread) {
+					if (!recovery.loaded.has(threadId)) {
+						const encoded = await ctx.storage.get(recoveryFaultKey(threadId));
+						if (encoded !== void 0) {
+							const fault = decodeRecoveryFault(threadId, encoded);
+							recovery.faults.set(threadId, fault);
+							recovery.recipients.set(threadId, new Set(await readRecoveryRecipients(ctx.storage, fault)));
+						}
+						recovery.loaded.add(threadId);
+					}
+					if (recovery.faults.get(threadId) === void 0 || ids.every((id) => recovery.recipients.get(threadId)?.has(id))) continue;
+					await dueQueue.transaction(async (transaction) => {
+						const encoded = await transaction.get(recoveryFaultKey(threadId));
+						if (encoded === void 0) return;
+						const previous = decodeRecoveryFault(threadId, encoded);
+						const previousIds = await readRecoveryRecipients(transaction, previous);
+						const known = new Set(previousIds);
+						const added = ids.filter((id) => !known.has(id));
+						if (added.length === 0) return;
+						const updated = ThreadRecoveryFault.make({
+							...previous,
+							recipientCount: previousIds.length + added.length
+						});
+						await appendRecoveryRecipients(transaction, threadId, previousIds.length, added);
+						await transaction.put(recoveryFaultKey(threadId), encodeRecoveryFault(updated));
+						await appendRecoveryEvents(transaction, added.map((id) => recoveryEvent(updated, id, "created", selectionTime)));
+						recovery.faults.set(threadId, updated);
+						recovery.recipients.set(threadId, /* @__PURE__ */ new Set([...previousIds, ...added]));
+					});
+				}
+			});
+			const reports = recovery.reports;
+			const recoveryFaults = recovery.faults;
+			const bindingWaits = yield* runTransaction("read binding waits", async () => (await readMaintenanceState(ctx.storage)).state.bindingWaits ?? []);
+			const parked = new Set(bindingWaits.map((wait) => wait.submissionId));
+			const waiting = (row) => !recovery.pending.has(row.threadId) && !recoveryFaults.has(row.threadId) && (parked.has(row.submissionId) || stableExternalWait(row, reports));
+			const heads = /* @__PURE__ */ new Map();
+			for (const row of current) {
+				if (row.state === "unknown" && waiting(row)) continue;
+				if (!heads.has(row.threadId)) heads.set(row.threadId, row);
+			}
+			const stopping = /* @__PURE__ */ new Set();
+			for (const head of heads.values()) {
+				if (head.state !== "ready" || native.active.has(head.threadId) || recovery.pending.has(head.threadId) || recoveryFaults.has(head.threadId)) continue;
+				const intent = yield* isolateRecovery(ledger.readAbortIntent(AbortIntentRequest.make({ submissionId: head.submissionId })), {
+					timeout: recoveryConfig.recoveryTimeout,
+					phase: () => "recovery",
+					operation: "read abort intent"
+				});
+				if (Result.isSuccess(intent)) {
+					if (intent.success !== void 0) stopping.add(head.threadId);
+				} else {
+					const faults = yield* recordRecoveryFaults(RecoverySweepResult.make({
+						reports: [],
+						blocked: [RecoveryBlocked.make({
+							threadId: head.threadId,
+							failure: intent.failure
+						})]
+					}), recovery, current);
+					for (const [threadId, fault] of faults) recoveryFaults.set(threadId, fault);
+					recovery.recovered++;
+				}
+			}
+			const eligible = [...heads.values()].filter((head) => !recovery.pending.has(head.threadId) && !stopping.has(head.threadId) && !recoveryFaults.has(head.threadId) && !waiting(head) && (head.state === "ready" || reports.has(head.submissionId))).map((head) => head.threadId).sort();
+			yield* failpoint.hit("maintenance:select:before");
+			const selection = yield* runTransaction("select maintenance lane", () => dueQueue.transaction(async (transaction) => {
+				const { state } = await readMaintenanceState(transaction);
+				const waits = (state.bindingWaits ?? []).filter((retry) => heads.get(retry.threadId)?.submissionId === retry.submissionId);
+				const runnable = eligible.filter((threadId) => !reserved.has(threadId) && !native.active.has(threadId) && !native.deferred.has(threadId) && !waits.some((wait) => wait.threadId === threadId));
+				const pivot = Math.max(0, runnable.findIndex((threadId) => state.lastServedThreadId === void 0 || threadId > state.lastServedThreadId));
+				const selected = dispatch ? [...runnable.slice(pivot), ...runnable.slice(0, pivot)].slice(0, nativeDispatchConcurrency - reserved.size) : [];
+				const next = selected.at(-1);
+				if (next !== void 0) await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+					...state,
+					lastServedThreadId: next
+				})));
+				const backlog = recovery.started ? [] : [...heads.keys()].filter((threadId) => {
+					const fault = recoveryFaults.get(threadId);
+					return !eligible.includes(threadId) && (fault === void 0 || fault.retryAt <= selectionTime);
+				});
+				const after = backlog.filter((threadId) => state.lastRecoveredThreadId === void 0 || threadId > state.lastRecoveredThreadId);
+				const before = backlog.filter((threadId) => state.lastRecoveredThreadId !== void 0 && threadId <= state.lastRecoveredThreadId);
+				return {
+					selected,
+					waits,
+					backlog: [...after, ...before]
+				};
+			}));
+			yield* failpoint.hit("maintenance:select:after");
+			if (!recovery.started) {
+				recovery.started = true;
+				recovery.needsCheckpoint = selection.backlog.length > 0;
+				for (const threadId of selection.backlog) recovery.pending.add(threadId);
+				yield* Deferred.succeed(recovery.queue, selection.backlog);
+			}
+			for (const threadId of selection.selected) {
+				const selected = heads.get(threadId);
+				if (selected === void 0) continue;
+				native.dispatched++;
+				native.active.set(threadId, yield* Effect.forkIn(attemptSelected(selected, selection.waits, yieldAfter, recovery), native.scope));
+			}
+			if (native.active.size > 0) return {
+				phase: "actionable",
+				nonterminal: current.length,
+				nextAttemptAt: void 0,
+				dispatched: selection.selected.length > 0
+			};
+			const scannedGeneration = yield* runTransaction("observe native source generation", async () => (await readMaintenanceState(ctx.storage)).state.dirty);
+			const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
+			const waitingHeads = /* @__PURE__ */ new Map();
+			const autonomous = remaining.some((snapshot) => {
+				if (snapshot.state === "unknown" && waiting(snapshot)) return false;
+				const headWaiting = waitingHeads.get(snapshot.threadId);
+				if (headWaiting === void 0) waitingHeads.set(snapshot.threadId, waiting(snapshot));
+				if (headWaiting === true && snapshot.state === "ready" && reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput") return false;
+				return !waiting(snapshot);
+			});
+			const progressed = native.progressed || recovery.repaired;
+			const now = yield* Clock.currentTimeMillis;
+			const ordinaryDelay = autonomous ? yield* rearmDelay(progressed, started.stalls) : 0;
+			const nextEligible = [...recoveryFaults.values()].map((fault) => fault.retryAt).concat(eligible.filter((threadId) => !selection.waits.some((wait) => wait.threadId === threadId)).map(() => now));
+			const retryDelay = nextEligible.length === 0 ? 0 : Math.max(0, Math.min(...nextEligible) - now);
+			const delay = Math.max(ordinaryDelay, retryDelay);
+			yield* failpoint.hit("maintenance:checkpoint:before");
+			const nextAttemptAt = yield* mutations.withSnapshot((active) => runTransaction("checkpoint native maintenance", () => dueQueue.transaction(async (transaction) => {
+				const { state } = await readMaintenanceState(transaction);
+				const mutationOverlap = observation.activeAtStart > 0 || started.activeAtStart > 0 || active > 0;
+				const generation = remaining.length === 0 && !mutationOverlap && state.dirty === scannedGeneration ? scannedGeneration : observation.generation;
+				const processed = autonomous || mutationOverlap ? state.processed : state.processed > generation ? state.processed : generation;
+				const canBackoff = !mutationOverlap && state.dirty === started.generation;
+				const next = ThreadMaintenanceState.make({
+					...Struct.omit(state, ["retry"]),
+					processed,
+					nonterminal: remaining.length,
+					bindingWaits: (state.bindingWaits ?? []).filter((retry) => remaining.some((row) => row.submissionId === retry.submissionId)),
+					...autonomous && !progressed && canBackoff ? { retry: MaintenanceRetry.make({
+						generation: started.generation,
+						notBefore: now + delay,
+						nativeOnly: true,
+						stalls: Math.min(30, started.stalls + 1)
+					}) } : {}
+				});
+				await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+				const dueAt = autonomous ? now + (canBackoff ? delay : minimumAlarmDelay) : mutationOverlap || next.dirty > next.processed ? now + minimumAlarmDelay : null;
+				dueQueue.checkpointNative(dueAt);
+				return dueAt ?? void 0;
+			})));
+			yield* failpoint.hit("maintenance:checkpoint:after");
+			if (remaining.length === 0 && recovery.pending.size === 0) delete recovery.observation;
+			native.deferred.clear();
+			native.progressed = false;
+			native.needsCheckpoint = false;
+			return {
+				phase: "actionable",
+				nonterminal: remaining.length,
+				nextAttemptAt
+			};
+		});
+		const validateLanes = Effect.fn("ThreadMaintenance.validateLanes")(function* (lanes, queued) {
+			const ids = /* @__PURE__ */ new Set([
+				Native,
+				Publication,
+				Projection,
+				Messages
+			]);
+			for (const lane of lanes) {
+				yield* Schema.decodeEffect(LaneId)(lane.id).pipe(Effect.mapError(alarmFailure("maintenance lane ID")));
+				if (ids.has(lane.id)) return yield* DurableAlarmError.make({
+					operation: "maintenance lane ID",
+					message: `Duplicate maintenance lane: ${lane.id}`
+				});
+				ids.add(lane.id);
+			}
+			for (const row of queued) if (row.dueAt !== null && !ids.has(row.id)) return yield* DurableAlarmError.make({
+				operation: "maintenance lane ID",
+				message: `No handler registered for scheduled lane: ${row.id}`
+			});
+		});
+		const dispatch = Effect.fn("ThreadMaintenance.dispatch")(function* (yieldAfter, dispatchUntil, observed) {
+			const notified = (yield* Stream.toPull(wakes.wakes)).pipe(Effect.asVoid, Effect.catch(() => Effect.never));
+			const started = yield* beginNative(observed);
+			yield* mutations.withSnapshot(() => Effect.gen(function* () {
+				const queued = yield* queueSnapshot;
+				const producing = yield* mutations.activeLanes;
+				for (const row of queued) {
+					observed.queue.set(row.id, row);
+					if (!producing.has(row.id)) observed.available.set(row.id, row.revision);
+				}
+			}));
+			const auxiliaryScope = yield* Effect.acquireRelease(Scope.make("parallel"), (scope, exit) => Scope.close(scope, exit));
+			const fork = (work) => Effect.forkIn(work, auxiliaryScope);
+			const lanes = [
+				recoveryEventLane,
+				...framework.lanes,
+				...host.lanes
+			].map((lane) => ({
+				...lane,
+				exhausted: false,
+				fiber: void 0
+			}));
+			let messageExhausted = false;
+			let delivery;
+			let failure;
+			const recovery = {
+				queue: yield* Deferred.make(),
+				pending: /* @__PURE__ */ new Set(),
+				loaded: /* @__PURE__ */ new Set(),
+				reports: /* @__PURE__ */ new Map(),
+				faults: /* @__PURE__ */ new Map(),
+				recipients: /* @__PURE__ */ new Map(),
+				started: false,
+				needsCheckpoint: false,
+				recovered: 0,
+				repaired: false
+			};
+			const recoveryFiber = yield* fork(Effect.gen(function* () {
+				for (const threadId of yield* Deferred.await(recovery.queue)) {
+					yield* failpoint.hit("maintenance:select:before");
+					yield* runTransaction("select old recovery lane", () => dueQueue.transaction(async (transaction) => {
+						const { state } = await readMaintenanceState(transaction);
+						await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+							...state,
+							lastRecoveredThreadId: threadId
+						})));
+					}));
+					yield* failpoint.hit("maintenance:select:after");
+					yield* recoverThread(threadId, recovery);
+					recovery.pending.delete(threadId);
+					if (!recovery.faults.has(threadId)) yield* wakes.notify(threadId);
+				}
+			}));
+			const backfill = yield* fork(Effect.gen(function* () {
+				if ((yield* mutations.activeLanes).has("effect-agent:projection")) return;
+				const row = (yield* queueSnapshot).find((row) => row.id === Projection);
+				if (row?.dueAt === null || row === void 0 || row.dueAt > (yield* Clock.currentTimeMillis)) return;
+				return yield* runQueued(row, projection.drain.pipe(Effect.andThen(projection.pendingDeadline)), observed).pipe(Effect.timeoutOption(config.projectionDispatchTimeoutMillis));
+			}));
+			let backfillObserved = false;
+			let recoveryObserved = false;
+			const dispatch = {
+				scope: auxiliaryScope,
+				active: /* @__PURE__ */ new Map(),
+				deferred: /* @__PURE__ */ new Set(),
+				dispatched: 0,
+				settled: 0,
+				progressed: false,
+				needsCheckpoint: false
+			};
+			let native = yield* fork(advance(started, yieldAfter, observed, recovery, dispatch));
+			let result = {
+				phase: "caught-up",
+				nonterminal: started.nonterminal,
+				nextAttemptAt: void 0
+			};
+			let phase = result.phase;
+			let nativeCheck = false;
+			const until = DateTime.toEpochMillis(yieldAfter);
+			const dispatchEnd = DateTime.toEpochMillis(dispatchUntil);
+			while (true) {
+				if (native?.pollUnsafe() !== void 0) {
+					result = yield* Fiber.join(native);
+					native = void 0;
+					if (result.phase === "actionable") phase = "actionable";
+					observed.nativeOnly = dispatch.active.size > 0;
+					if (result.dispatched === true && dispatch.active.size < nativeDispatchConcurrency) {
+						dispatch.scanGeneration = void 0;
+						nativeCheck = true;
+					}
+					recovery.started = true;
+					yield* Deferred.succeed(recovery.queue, []);
+				}
+				for (const [threadId, attempt] of dispatch.active) {
+					const exit = attempt.pollUnsafe();
+					if (exit === void 0) continue;
+					dispatch.active.delete(threadId);
+					dispatch.scanGeneration = void 0;
+					if (Exit.isFailure(exit)) return yield* Effect.failCause(exit.cause);
+					dispatch.settled += exit.value;
+					dispatch.progressed ||= exit.value > 0;
+					dispatch.needsCheckpoint = true;
+					if (exit.value === 0) dispatch.deferred.add(threadId);
+					nativeCheck = true;
+				}
+				if (!recoveryObserved && recoveryFiber.pollUnsafe() !== void 0) {
+					yield* Fiber.join(recoveryFiber);
+					recoveryObserved = true;
+					dispatch.scanGeneration = void 0;
+					nativeCheck ||= recovery.needsCheckpoint;
+				}
+				if (!backfillObserved) {
+					const exit = backfill.pollUnsafe();
+					if (exit !== void 0) {
+						backfillObserved = true;
+						if (Exit.isFailure(exit)) failure ??= exit.cause;
+					}
+				}
+				for (const lane of lanes) {
+					const exit = lane.fiber?.pollUnsafe();
+					if (exit === void 0) continue;
+					lane.fiber = void 0;
+					if (Exit.isFailure(exit)) {
+						failure ??= exit.cause;
+						lane.exhausted = true;
+					}
+				}
+				const deliveryExit = delivery?.pollUnsafe();
+				if (deliveryExit !== void 0) {
+					delivery = void 0;
+					if (Exit.isFailure(deliveryExit)) {
+						failure ??= deliveryExit.cause;
+						messageExhausted = true;
+					}
+				}
+				const now = yield* Clock.currentTimeMillis;
+				if (now >= until) break;
+				const queueRevision = yield* mutations.revision;
+				const queued = yield* queueSnapshot;
+				const producing = yield* mutations.activeLanes;
+				yield* validateLanes(lanes, queued);
+				for (const lane of lanes) {
+					if (lane.phase === "after-native" || lane.fiber !== void 0 || lane.exhausted || producing.has(lane.id)) continue;
+					const row = queued.find((row) => row.id === lane.id);
+					if (row === void 0 || row.dueAt === null || row.dueAt > now) continue;
+					const dueAt = row.dueAt;
+					lane.fiber = yield* fork(Effect.gen(function* () {
+						yield* Schema.decodeEffect(AuxiliaryDispatchMillis)(lane.dispatchTimeoutMillis).pipe(Effect.mapError(alarmFailure("host dispatch allowance")));
+						const selectedAt = yield* Clock.currentTimeMillis;
+						if (selectedAt >= until || selectedAt + lane.dispatchTimeoutMillis > dispatchEnd) {
+							lane.exhausted = true;
+							return Option.some(dueAt);
+						}
+						return yield* runQueued(row, lane.run.pipe(Effect.scoped), observed).pipe(Effect.timeoutOrElse({
+							duration: lane.dispatchTimeoutMillis,
+							orElse: () => DurableAlarmError.make({
+								operation: "host dispatch allowance",
+								message: "The admitted host wave exceeded its allowance; durable work remains pending"
+							})
+						}));
+					}));
+				}
+				if (delivery === void 0 && !messageExhausted && !producing.has("effect-agent:messages")) {
+					const row = queued.find((row) => row.id === Messages);
+					if (row !== void 0 && row.dueAt !== null && row.dueAt <= now) delivery = yield* fork(runQueued(row, Effect.gen(function* () {
+						const wave = yield* messages.prepare;
+						const selectedAt = yield* Clock.currentTimeMillis;
+						if (selectedAt >= until || selectedAt + wave.timeoutMillis > dispatchEnd) {
+							messageExhausted = true;
+							return Option.fromNullishOr(row.dueAt);
+						}
+						return yield* wave.run;
+					}), observed).pipe(Effect.asVoid));
+				}
+				if (native === void 0 && dispatch.active.size === 0 && recoveryObserved && !recovery.needsCheckpoint && backfillObserved && delivery === void 0 && lanes.every((lane) => lane.fiber === void 0)) break;
+				if (native === void 0 && nativeCheck && dispatch.active.size < nativeDispatchConcurrency) {
+					nativeCheck = false;
+					const nativeCheckpoint = dispatch.needsCheckpoint && dispatch.active.size === 0;
+					const checkpoint = recoveryObserved && recovery.needsCheckpoint || nativeCheckpoint;
+					if (checkpoint) recovery.needsCheckpoint = false;
+					const reserved = new Set(dispatch.active.keys());
+					native = yield* fork(Effect.gen(function* () {
+						const awakened = checkpoint ? started : yield* beginNative(observed);
+						return yield* advance(awakened, yieldAfter, observed, recovery, dispatch, !nativeCheckpoint && (!checkpoint || dispatch.settled === 0), reserved);
+					}));
+				}
+				const next = Math.min(native === void 0 ? result.nextAttemptAt ?? Infinity : Infinity, ...queued.flatMap((row) => row.id !== "effect-agent:native" && row.dueAt !== null && row.dueAt > now ? [row.dueAt] : []), until);
+				const completing = [
+					...native === void 0 ? [] : [native],
+					...dispatch.active.values(),
+					...recoveryObserved ? [] : [recoveryFiber],
+					...backfillObserved ? [] : [backfill],
+					...delivery === void 0 ? [] : [delivery],
+					...lanes.flatMap((lane) => lane.fiber === void 0 ? [] : [lane.fiber])
+				];
+				if ((yield* Effect.raceAllFirst([...completing.map((fiber) => Fiber.await(fiber).pipe(Effect.as("completed"))), Effect.raceAllFirst([
+					notified,
+					mutations.awaitChange(queueRevision),
+					Effect.sleep(Math.max(0, next - now))
+				]).pipe(Effect.as("scan"))])) === "scan") nativeCheck = true;
+			}
+			if (native !== void 0) {
+				result = yield* Fiber.join(native);
+				if (result.phase === "actionable") phase = "actionable";
+				observed.nativeOnly = dispatch.active.size > 0;
+				recovery.started = true;
+				yield* Deferred.succeed(recovery.queue, []);
+			}
+			for (const attempt of dispatch.active.values()) {
+				const settled = yield* Fiber.join(attempt);
+				dispatch.settled += settled;
+				dispatch.progressed ||= settled > 0;
+			}
+			dispatch.active.clear();
+			observed.nativeOnly = false;
+			for (const fiber of [
+				recoveryFiber,
+				backfill,
+				...delivery === void 0 ? [] : [delivery],
+				...lanes.flatMap((lane) => lane.fiber === void 0 ? [] : [lane.fiber])
+			]) {
+				const exit = yield* Fiber.await(fiber);
+				if (Exit.isFailure(exit)) failure ??= exit.cause;
+			}
+			if (failure !== void 0) return yield* Effect.failCause(failure);
+			if (recovery.needsCheckpoint || dispatch.dispatched > 0) {
+				result = yield* advance(started, yieldAfter, observed, recovery, dispatch, false);
+				if (result.phase === "actionable") phase = "actionable";
+			}
+			yield* Scope.close(auxiliaryScope, Exit.void);
+			return {
+				result,
+				phase,
+				recovered: recovery.recovered,
+				settled: dispatch.settled
+			};
+		});
+		const pass = Effect.fn("ThreadMaintenance.pass")(function* (yieldAfter, dispatchUntil, observed) {
+			const concurrent = yield* Effect.exit(Effect.scoped(dispatch(yieldAfter, dispatchUntil, observed)));
+			const afterNative = yield* Effect.gen(function* () {
+				const lanes = [
+					recoveryEventLane,
+					...framework.lanes,
+					...host.lanes
+				];
+				const selected = lanes.filter((lane) => lane.phase === "after-native");
+				if (selected.length === 0) return [];
+				const queued = yield* queueSnapshot;
+				const producing = yield* mutations.activeLanes;
+				for (const row of queued) if (!producing.has(row.id)) observed.available.set(row.id, row.revision);
+				const dispatchEnd = DateTime.toEpochMillis(dispatchUntil);
+				const afterNativeIds = new Set(selected.map((lane) => lane.id));
+				const completed = [];
+				let yielded = false;
+				const yieldToConcurrent = Effect.gen(function* () {
+					while (true) {
+						const revision = yield* mutations.revision;
+						const now = yield* Clock.currentTimeMillis;
+						const current = yield* queueSnapshot;
+						const active = yield* mutations.activeLanes;
+						if (current.some((row) => !afterNativeIds.has(row.id) && !active.has(row.id) && row.dueAt !== null && row.dueAt <= now && row.revision !== observed.available.get(row.id))) {
+							yielded = true;
+							return completed;
+						}
+						yield* mutations.awaitChange(revision);
+					}
+				});
+				yield* validateLanes(lanes, queued);
+				const cursor = yield* mutations.withSnapshot(() => runTransaction("read post-native dispatch cursor", () => dueQueue.transaction(async (transaction) => (await readMaintenanceState(transaction)).state.lastAfterNativeLaneId)));
+				const ordered = selected.toSorted((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0);
+				const after = cursor === void 0 ? 0 : ordered.findIndex((lane) => lane.id > cursor);
+				const rotated = after <= 0 ? ordered : [...ordered.slice(after), ...ordered.slice(0, after)];
+				const waves = Effect.forEach(rotated, (lane) => Effect.gen(function* () {
+					const row = queued.find((row) => row.id === lane.id);
+					const now = yield* Clock.currentTimeMillis;
+					if (row === void 0 || row.dueAt === null || row.dueAt > now || producing.has(lane.id)) return;
+					yield* Schema.decodeEffect(AuxiliaryDispatchMillis)(lane.dispatchTimeoutMillis).pipe(Effect.mapError(alarmFailure("host dispatch allowance")));
+					if (now + lane.dispatchTimeoutMillis > dispatchEnd) return;
+					const admit = mutations.withSnapshot(() => runTransaction("advance post-native dispatch cursor", () => dueQueue.transaction(async (transaction) => {
+						const { state } = await readMaintenanceState(transaction);
+						await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(ThreadMaintenanceState.make({
+							...state,
+							lastAfterNativeLaneId: lane.id
+						})));
+					})));
+					yield* runQueued(row, admit.pipe(Effect.andThen(lane.run.pipe(Effect.scoped))), observed, () => yielded).pipe(Effect.timeoutOrElse({
+						duration: lane.dispatchTimeoutMillis,
+						orElse: () => DurableAlarmError.make({
+							operation: "host dispatch allowance",
+							message: "The admitted host wave exceeded its allowance; durable work remains pending"
+						})
+					}));
+				}).pipe(Effect.exit, Effect.tap((exit) => Effect.sync(() => {
+					if (!yielded || Exit.isSuccess(exit) || !Cause.hasInterruptsOnly(exit.cause)) completed.push(exit);
+				}))), { concurrency: afterNativeDispatchConcurrency }).pipe(Effect.as(completed));
+				return yield* Effect.raceFirst(waves, yieldToConcurrent);
+			}).pipe(Effect.exit);
+			let failure = Exit.isFailure(concurrent) ? concurrent.cause : Cause.empty;
+			if (Exit.isFailure(afterNative)) failure = Cause.combine(failure, afterNative.cause);
+			else for (const exit of afterNative.value) if (Exit.isFailure(exit)) failure = Cause.combine(failure, exit.cause);
+			if (Exit.isFailure(concurrent) || failure.reasons.length > 0) return yield* Effect.failCause(failure);
+			const { result, phase, recovered, settled } = concurrent.value;
+			yield* failpoint.hit("maintenance:finish:before");
+			const disposition = yield* mutations.withSnapshot((active) => Effect.gen(function* () {
+				const now = yield* Clock.currentTimeMillis;
+				return yield* runTransaction("finish maintenance event", () => dueQueue.transaction(async (transaction) => {
+					const { state } = await readMaintenanceState(transaction);
+					const native = active > 0 || state.dirty > state.processed ? state.retry?.generation === state.dirty && active === 0 ? Math.max(now + minimumAlarmDelay, state.retry.notBefore) : state.dirty === observed.generation && active === 0 ? result.nextAttemptAt ?? now + minimumAlarmDelay : now + minimumAlarmDelay : Infinity;
+					dueQueue.checkpointNative(Number.isFinite(native) ? native : null);
+					const next$6 = next(dueQueue.read());
+					if (Number.isFinite(next$6)) {
+						await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next$6));
+						return "rearmed";
+					}
+					await transaction.deleteAlarm();
+					return "cleared";
+				}));
+			}));
+			yield* failpoint.hit("maintenance:finish:after");
+			const report = MaintenancePassReport.make({
+				phase,
+				recovered,
+				settled,
+				nonterminal: result.nonterminal,
+				alarm: disposition
+			});
+			yield* Effect.annotateCurrentSpan({
+				phase: report.phase,
+				recovered: report.recovered,
+				settled: report.settled,
+				nonterminal: report.nonterminal,
+				alarm: report.alarm
+			});
+			return report;
+		});
+		return ThreadMaintenance.of({
+			pass: Effect.gen(function* () {
+				const now = yield* Clock.currentTimeMillis;
+				const yieldAfter = DateTime.makeUnsafe(now + 6e5);
+				const dispatchUntil = DateTime.makeUnsafe(now + 84e4);
+				const observed = {
+					nativeOnly: false,
+					queue: /* @__PURE__ */ new Map(),
+					charged: /* @__PURE__ */ new Map(),
+					available: /* @__PURE__ */ new Map()
+				};
+				return yield* alarm.withWakesDeferred(maintenancePassGate.withPermit(dueQueue.withView(Effect.scoped(pass(yieldAfter, dispatchUntil, observed))).pipe(Effect.onErrorIf(() => true, () => rearmFailure(observed)))));
+			}).pipe(Effect.timeoutOrElse({
+				duration: "14 minutes",
+				orElse: () => DurableAlarmError.make({
+					operation: "maintenance pass deadline",
+					message: "The maintenance event exceeded its 14 minute deadline; durable recovery remains pending"
+				})
+			}), Effect.ensuring(reportParked)),
+			ensureAlarm: mutations.withSnapshot(() => ensureAlarm()).pipe(Effect.tap(() => reportParked)),
+			withMutation: (body) => mutations.withMutation(body.pipe(Effect.tap(() => publishCommitted.pipe(Effect.provide(publicationContext)))))
+		});
+	}));
+};
+//#endregion
+export { Messages as _, ThreadHostMaintenance as a, Publication as b, ThreadMessageDelivery as c, ThreadPublication as d, ThreadRecoveryEvents as f, Lifecycle as g, HostLaneId as h, MaintenancePassReport as i, ThreadMutationGate as l, publishCommitted as m, DurableAlarmError as n, ThreadMaintenance as o, ThreadRecoveryFaultEvent as p, DurableAlarmService as r, ThreadMaintenanceFailpoint as s, Alarm_exports as t, ThreadNativeMaintenance as u, Native as v, Projection as y };
+
+//# sourceMappingURL=Alarm-B0ODr1NE.mjs.map