@yielded/agent-platform-cloudflare 0.1.0-beta.166 → 0.1.0-beta.168

package/src/ThreadObject.ts

@@ -22,6 +22,7 @@ import {
   DurableAgentRuntime,
   DurableRuntimeConfig,
   RecoveryReport,
+  RecoveryBlocked,
   type DurableSubmitAgent,
 } from "@yielded/agent/durable-agent-runtime";
 import { DurableRuntimeFailpointError } from "@yielded/agent/durable-failpoint";
@@ -48,18 +49,20 @@ import {
   ThreadRead,
   ThreadStore,
   ThreadStoreError,
-  FenceRejected,
 } from "@yielded/agent/thread-store";
+import { WorkDiscoveryUnavailable } from "@yielded/agent/thread-work";
 import { WakeScheduler } from "@yielded/agent/wake-scheduler";
-import { Effect, Layer, Option, Schema, Stream } from "effect";
+import { Effect, Layer, Option, Schema, Stream, type Scope } from "effect";
 import {
   DurableObject as EffectCfDurableObject,
+  DurableObjectAlarm,
   DurableObjectState as EffectCfDurableObjectState,
   WorkerEnvironment,
 } from "effect-cf";
 
 import {
   ThreadMaintenance,
+  ThreadMaintenanceAlarm,
   DurableAlarmError,
   DurableAlarmService,
   ThreadMutationGate,
@@ -84,6 +87,7 @@ import {
   ProgressObserved,
   ProgressCancelled,
   SettlementReached,
+  SettlementRecordReached,
   SubmissionStatusResponse,
   SubmitSucceeded,
   UnknownResolutionRecorded,
@@ -109,6 +113,8 @@ import {
   type CloudflareDurableRuntimeServices,
   type CloudflareBootstrapServices,
 } from "./internal/layers.ts";
+import { Request as WatchTextRequest } from "./internal/live-text-protocol.ts";
+import { LiveTextHub } from "./internal/live-text.ts";
 import { ProgressWaitRegistry } from "./internal/progress-wait.ts";
 
 export {
@@ -146,11 +152,50 @@ export {
  * `runRecovery({ threadId })` BEFORE that Thread's claim; old recovery cannot gate fresh dispatch.
  */
 
+type ApplicationAlarmRegistration<ApplicationServices, EventServices, AlarmServices, AlarmError> =
+  DurableObjectAlarm.AlarmRegistration<
+    AlarmServices,
+    | RuntimeServices
+    | ApplicationServices
+    | EventServices
+    | NoInfer<AlarmServices>
+    | EffectCfDurableObjectState.DurableObjectState
+    | WorkerEnvironment
+    | Scope.Scope,
+    AlarmError
+  >;
+
 /** Construction options for one deployed Thread Object class. */
-export interface Options<
+export type Options<
   ApplicationServices = never,
   EventServices = never,
   EventLayerError = never,
+  AlarmServices = never,
+  AlarmError = never,
+> = BaseOptions<ApplicationServices, EventServices, EventLayerError, AlarmServices> &
+  ([AlarmServices] extends [never]
+    ? {
+        readonly alarms?: ApplicationAlarmRegistration<
+          ApplicationServices,
+          EventServices,
+          AlarmServices,
+          AlarmError
+        >;
+      }
+    : {
+        readonly alarms: ApplicationAlarmRegistration<
+          ApplicationServices,
+          EventServices,
+          AlarmServices,
+          AlarmError
+        >;
+      });
+
+interface BaseOptions<
+  ApplicationServices,
+  EventServices,
+  EventLayerError,
+  AlarmServices,
 > extends CloudflareDurableRuntimeOptions {
   /** Accept transient native RPC tracing through effect-cf; disabled by default. */
   readonly rpcTracing?: boolean;
@@ -166,6 +211,7 @@ export interface Options<
     EventLayerError,
     | RuntimeServices
     | ApplicationServices
+    | NoInfer<AlarmServices>
     | EffectCfDurableObjectState.DurableObjectState
     | WorkerEnvironment
   >;
@@ -192,16 +238,28 @@ const isMutatingPortRequest = (request: PortRequest): boolean => {
     case "LedgerRecordChildSettled":
     case "StoreMaterialize":
     case "StoreAppend":
+    case "StoreWorkRebuild":
+    case "StoreRangeSeal":
+    case "StoreRangeArchive":
+    case "SettlementPublish":
     case "MessageDeliveryComplete":
       return true;
     case "LedgerInspectWorker":
     case "LedgerLookup":
     case "LedgerResolveAdmission":
+    case "LedgerFundingOwner":
     case "StoreReadPage":
+    case "StoreReadPrompt":
+    case "StoreReadExecution":
+    case "StoreWorkPage":
     case "StoreInspectTail":
     case "StoreReadIdentity":
     case "StoreCountPeerMessages":
     case "StoreExport":
+    case "StoreRangePage":
+    case "StoreRangeVerify":
+    case "StoreVerification":
+    case "StoreWorkerCapacity":
     case "MessageDeliveryList":
       return false;
   }
@@ -253,7 +311,7 @@ const utf8Bytes = (value: PersistedJson): number =>
  * exempt: its accepted-work obligation already exists, and returning the original Receipt
  * consumes no new quota. Refusals are typed `AdmissionLimitExceeded` and nothing is written.
  */
-const gateAdmissionLimits = Effect.fn("ThreadObject.gateAdmissionLimits")(function* (
+const gateAdmissionLimits = Effect.fnUntraced(function* (
   threadId: ThreadId,
   request: {
     readonly principal: SubmissionLookupByKey["principal"];
@@ -323,9 +381,7 @@ const passthroughSubmitAgent = (agentId: AgentId): DurableSubmitAgent<typeof Per
 });
 
 /** A physical owner may hold other Threads; an addressed request cannot act on their IDs. */
-const lookupAddressedSubmission = Effect.fn("ThreadObject.lookupAddressedSubmission")(function* (
-  submissionId: SubmissionId,
-) {
+const lookupAddressedSubmission = Effect.fnUntraced(function* (submissionId: SubmissionId) {
   const { threadId } = yield* ThreadObjectIdentity;
   const ports = yield* ThreadObjectPorts;
   const submission = yield* ports.lookupSubmission(submissionId);
@@ -336,9 +392,7 @@ const lookupAddressedSubmission = Effect.fn("ThreadObject.lookupAddressedSubmiss
   return submission;
 });
 
-const requireSubmissionThread = Effect.fn("ThreadObject.requireSubmissionThread")(function* (
-  submissionId: SubmissionId,
-) {
+const requireSubmissionThread = Effect.fnUntraced(function* (submissionId: SubmissionId) {
   const submission = yield* lookupAddressedSubmission(submissionId);
 
   if (Option.isNone(submission))
@@ -348,9 +402,7 @@ const requireSubmissionThread = Effect.fn("ThreadObject.requireSubmissionThread"
     });
 });
 
-const requireReceiptThread = Effect.fn("ThreadObject.requireReceiptThread")(function* (
-  threadId: ThreadId,
-) {
+const requireReceiptThread = Effect.fnUntraced(function* (threadId: ThreadId) {
   const identity = yield* ThreadObjectIdentity;
 
   if (threadId !== identity.threadId)
@@ -359,6 +411,10 @@ const requireReceiptThread = Effect.fn("ThreadObject.requireReceiptThread")(func
 
 const requirePortThread = (request: PortRequest) => {
   switch (request._tag) {
+    case "SettlementPublish":
+      return requireReceiptThread(request.request.append.threadId).pipe(
+        Effect.andThen(requireSubmissionThread(request.request.submissionId)),
+      );
     case "MessageDeliveryComplete":
       return requireReceiptThread(request.key.ownerThreadId);
     case "MessageDeliveryList":
@@ -372,6 +428,10 @@ const requirePortThread = (request: PortRequest) => {
       return requireSubmissionThread(request.request.submissionId);
     case "LedgerRecordChildSettled":
       return requireSubmissionThread(request.request.parentSubmissionId);
+    case "LedgerFundingOwner":
+      return requireReceiptThread(request.request.threadId).pipe(
+        Effect.andThen(requireSubmissionThread(request.request.submissionId)),
+      );
     case "LedgerInspectWorker":
     case "LedgerStopWorker":
     case "WorkerAdmit":
@@ -380,10 +440,20 @@ const requirePortThread = (request: PortRequest) => {
     case "StoreMaterialize":
     case "StoreAppend":
     case "StoreReadPage":
+    case "StoreReadPrompt":
+    case "StoreReadExecution":
     case "StoreInspectTail":
     case "StoreReadIdentity":
     case "StoreCountPeerMessages":
     case "StoreExport":
+    case "StoreWorkPage":
+    case "StoreWorkRebuild":
+    case "StoreRangePage":
+    case "StoreRangeSeal":
+    case "StoreRangeArchive":
+    case "StoreRangeVerify":
+    case "StoreVerification":
+    case "StoreWorkerCapacity":
       return requireReceiptThread(request.request.threadId);
   }
   request satisfies never;
@@ -392,22 +462,21 @@ const requirePortThread = (request: PortRequest) => {
 /**
  * Admit an already Schema-decoded request to a logical Thread in this physical owner.
  * Custom hosts validate local placement before calling this Effect and provide their same
- * runtime/maintenance instances. The native endpoint uses this path too: queue limits,
+ * runtime, maintenance and alarm instances. The native endpoint uses this path too: queue limits,
  * idempotent receipts and the pre-admission generation/alarm commit have one owner.
  */
-export const submit = Effect.fn("ThreadObject.submit")(function* (
-  threadId: ThreadId,
-  request: SubmitRequest,
-) {
+export const submit = Effect.fnUntraced(function* (threadId: ThreadId, request: SubmitRequest) {
   const placement = yield* ThreadObjectPlacement;
 
   if (!placement.ownsThread(threadId))
     return yield* HostProtocolError.make({ message: "The Thread belongs to another Object" });
   const mutations = yield* ThreadMutationGate;
   const runtime = yield* DurableAgentRuntime;
+  const alarm = yield* DurableAlarmService;
 
   yield* gateAdmissionLimits(threadId, request);
 
+  // The mutation gate pre-arms durable maintenance; publication keeps its own wake behavior.
   return yield* mutations.withMutation(
     runtime
       .submit(passthroughSubmitAgent(request.agentId), request.inputPayload, {
@@ -424,7 +493,10 @@ export const submit = Effect.fn("ThreadObject.submit")(function* (
           : { messageAdmission: request.messageAdmission }),
         definitions: request.definitions,
       })
-      .pipe(Effect.tap(() => publishCommitted)),
+      .pipe(
+        alarm.withHintsDeferred,
+        Effect.tap(() => publishCommitted),
+      ),
   );
 });
 
@@ -435,6 +507,18 @@ const submitEndpoint = (encoded: unknown): Effect.Effect<unknown, never, Endpoin
       Effect.gen(function* () {
         const identity = yield* ThreadObjectIdentity;
         const receipt = yield* submit(identity.threadId, request);
+        const scheduling = yield* DurableObjectAlarm.ScheduleConfiguration;
+
+        if (scheduling.dispatchAfterEvent === true) {
+          const alarms = yield* DurableAlarmService;
+
+          // Make accepted work eligible for post-response dispatch without changing queue retry floors.
+          yield* alarms.scheduleNow.pipe(
+            Effect.catch((error) =>
+              Effect.logWarning("Post-admission maintenance hint failed", error),
+            ),
+          );
+        }
 
         return SubmitSucceeded.make({ receipt });
       }),
@@ -472,6 +556,7 @@ const submissionStatusEndpoint = (
 
 const awaitSettlementEndpoint = (
   encoded: unknown,
+  includeRecord = false,
 ): Effect.Effect<unknown, never, EndpointServices> =>
   decodeReceipt(encoded).pipe(
     Effect.mapError(protocolFailure("The receipt could not be decoded")),
@@ -486,12 +571,23 @@ const awaitSettlementEndpoint = (
             submissionId: receipt.submissionId,
           }),
         );
+        if (includeRecord)
+          yield* authorizer.authorize(
+            OperationAuthorizationRequest.make({
+              operation: "observe",
+              threadId: receipt.threadId,
+            }),
+          );
         yield* requireReceiptThread(receipt.threadId);
         yield* requireSubmissionThread(receipt.submissionId);
         const runtime = yield* DurableAgentRuntime;
-        const settlement = yield* runtime.awaitSettlement(receipt);
 
-        return SettlementReached.make({ settlement });
+        if (includeRecord)
+          return SettlementRecordReached.make({
+            record: yield* runtime.awaitSettlementRecord(receipt),
+          });
+
+        return SettlementReached.make({ settlement: yield* runtime.awaitSettlement(receipt) });
       }),
     ),
     respond,
@@ -583,6 +679,25 @@ const observePageEndpoint = (encoded: unknown): Effect.Effect<unknown, never, En
     Effect.flatMap(encodeResponse),
   );
 
+const watchTextEndpoint = (encoded: unknown): Effect.Effect<unknown, never, EndpointServices> =>
+  Schema.decodeUnknownEffect(WatchTextRequest)(encoded).pipe(
+    Effect.mapError(protocolFailure("The provisional text request could not be decoded")),
+    Effect.flatMap(() =>
+      Effect.gen(function* () {
+        const { threadId } = yield* ThreadObjectIdentity;
+        const authorizer = yield* OperationAuthorizer;
+
+        yield* authorizer.authorize(
+          OperationAuthorizationRequest.make({ operation: "observe", threadId }),
+        );
+        const hub = yield* LiveTextHub;
+
+        return yield* hub.open(threadId);
+      }),
+    ),
+    Effect.catch((failure) => encodeResponse(HostFailed.make({ failure }))),
+  );
+
 const abortEndpoint = (encoded: unknown): Effect.Effect<unknown, never, EndpointServices> =>
   decodeAbortCommand(encoded).pipe(
     Effect.mapError(protocolFailure("The abort command could not be decoded")),
@@ -696,10 +811,11 @@ export const AdminFailure = Schema.Union([
   ThreadStoreError,
   ThreadNotMaterialized,
   AppendConflict,
-  FenceRejected,
   DurableRuntimeFailpointError,
   DurableAlarmError,
   HostProtocolError,
+  RecoveryBlocked,
+  WorkDiscoveryUnavailable,
 ]);
 
 export type AdminFailure = typeof AdminFailure.Type;
@@ -955,8 +1071,10 @@ export const ThreadRpcOperation = Schema.Literals([
   "submitEncoded",
   "submissionStatusEncoded",
   "awaitSettlementEncoded",
+  "awaitSettlementRecordEncoded",
   "awaitProgressEncoded",
   "cancelProgressEncoded",
+  "watchTextEncoded",
   "observePage",
   "abortEncoded",
   "resolveApprovalEncoded",
@@ -971,8 +1089,10 @@ const threadRpc = {
   submitEncoded: submitEndpoint,
   submissionStatusEncoded: submissionStatusEndpoint,
   awaitSettlementEncoded: awaitSettlementEndpoint,
+  awaitSettlementRecordEncoded: (encoded) => awaitSettlementEndpoint(encoded, true),
   awaitProgressEncoded: awaitProgressEndpoint,
   cancelProgressEncoded: cancelProgressEndpoint,
+  watchTextEncoded: watchTextEndpoint,
   observePage: observePageEndpoint,
   abortEncoded: abortEndpoint,
   resolveApprovalEncoded: resolveApprovalEndpoint,
@@ -991,7 +1111,7 @@ const threadRpc = {
  * The producer comes from the actual runtime configuration, never from caller input. These
  * guards supplement the existing current model/Tool and operation authorization policies.
  */
-export const handleRpc = Effect.fn("ThreadObject.handleRpc")(function* (
+export const handleRpc = Effect.fnUntraced(function* (
   threadId: ThreadId,
   operation: ThreadRpcOperation,
   encoded: unknown,
@@ -1007,15 +1127,11 @@ export const handleRpc = Effect.fn("ThreadObject.handleRpc")(function* (
   );
 });
 
-const alarmEndpoint: Effect.Effect<void, MaintenancePassFailure, EndpointServices> = Effect.gen(
-  function* () {
-    const maintenance = yield* ThreadMaintenance;
-
-    // Typed pass failures propagate: the rejected promise makes workerd retry the alarm
-    // (at-least-once delivery), and the dirty generation retains a committed slot meanwhile.
-    yield* maintenance.pass;
-  },
-);
+/** Compose with application registrations on a shared physical object. */
+export const alarms = ThreadMaintenanceAlarm.handlers({
+  "@yielded/agent/thread-maintenance": () =>
+    Effect.flatMap(ThreadMaintenance, (maintenance) => Effect.asVoid(maintenance.pass)),
+});
 
 const gateEndpoint: Effect.Effect<void, MaintenancePassFailure, EndpointServices> = Effect.gen(
   function* () {
@@ -1067,13 +1183,18 @@ const effectCfPlatformLayer = (
 
 /** The public endpoints and effect-cf invocation hook of one Thread Object instance. */
 export interface Instance<EventServices = never> extends InstanceType<
-  EffectCfDurableObject.DurableObjectClass<Record<never, never>, RuntimeServices | EventServices>
+  EffectCfDurableObject.DurableObjectClass<
+    Record<never, never>,
+    RuntimeServices | EventServices | ThreadMaintenanceAlarm
+  >
 > {
   submitEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   submissionStatusEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   awaitSettlementEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  awaitSettlementRecordEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   awaitProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   cancelProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  watchTextEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   observePage(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   abortEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   resolveApprovalEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
@@ -1108,18 +1229,22 @@ export const make = <
   ApplicationError,
   EventServices = never,
   EventLayerError = never,
+  AlarmServices = never,
+  AlarmError = never,
 >(
   applicationLayer: Layer.Layer<
     CloudflareDurableRuntimeServices | ApplicationServices,
     ApplicationError,
     | CloudflareBootstrapServices
+    | ThreadMaintenanceAlarm
+    | NoInfer<AlarmServices>
     | EffectCfDurableObjectState.DurableObjectState
     | WorkerEnvironment
     | DurableObjectContext
     | ThreadObjectNamespace
   >,
-  options: Options<ApplicationServices, EventServices, EventLayerError>,
-): Class<ApplicationServices | EventServices> => {
+  options: Options<ApplicationServices, EventServices, EventLayerError, AlarmServices, AlarmError>,
+): Class<ApplicationServices | EventServices | AlarmServices> => {
   const application = applicationLayer.pipe(
     Layer.provideMerge(layerConfig(options)),
     Layer.provideMerge(effectCfPlatformLayer(options.namespaceBinding, options.rpcTracing)),
@@ -1131,7 +1256,10 @@ export const make = <
   const runtime: Layer.Layer<
     RuntimeServices | ApplicationServices,
     ThreadObjectInitializationError | ApplicationError,
-    EffectCfDurableObjectState.DurableObjectState | WorkerEnvironment
+    | EffectCfDurableObjectState.DurableObjectState
+    | WorkerEnvironment
+    | ThreadMaintenanceAlarm
+    | AlarmServices
   > = Layer.effectContext(
     Effect.gen(function* () {
       const state = yield* EffectCfDurableObjectState.DurableObjectState;
@@ -1163,15 +1291,17 @@ export const make = <
     RuntimeServices | ApplicationServices,
     EventServices,
     EventLayerError,
-    typeof rpc
+    typeof rpc,
+    ThreadMaintenanceAlarm | AlarmServices
   >;
 
-  const EffectCfThreadObject = EffectCfDurableObject.make<
+  return EffectCfDurableObject.make<
     RuntimeServices | ApplicationServices,
     ThreadObjectInitializationError | ApplicationError,
     EventServices,
     EventLayerError,
-    typeof rpc
+    typeof rpc,
+    ThreadMaintenanceAlarm | AlarmServices
   >(runtime, {
     ...(options.rpcTracing === true ? { rpcTracing: { service: options.namespaceBinding } } : {}),
     ...(options.eventLayer === undefined ? {} : { eventLayer: options.eventLayer }),
@@ -1179,20 +1309,10 @@ export const make = <
     // in each bounded pass so cross-Object initialization cannot deadlock.
     initialize: Effect.void,
     rpc,
-    alarm: () => alarmEndpoint,
-    // This host owns the raw alarm and supplies event services through options.eventLayer.
+    alarms:
+      options.alarms === undefined ? alarms : DurableObjectAlarm.mergeAll(options.alarms, alarms),
+    // The named registration supplies its scheduler before the constructor builds application services.
     // Upstream's conditional alarm-registration check cannot reduce over generic application
     // services. Options and the rpc satisfies check above retain their Effect requirements.
   } as NativeOptions);
-
-  // effect-cf's class type keeps `alarm` optional even when the handler option is present. This
-  // concrete override reflects this factory's stronger contract while delegating execution to
-  // the effect-cf runtime unchanged.
-  class ThreadObject extends EffectCfThreadObject {
-    override alarm(alarmInfo?: AlarmInvocationInfo): Promise<void> | void {
-      return super.alarm?.(alarmInfo);
-    }
-  }
-
-  return ThreadObject;
 };

package/src/WakeScheduler.ts

@@ -11,8 +11,8 @@ import {
 import { safeCauseMessage } from "./internal/boundary.ts";
 
 /**
- * Bounded in-memory wake buffer for same-incarnation `awaitSettlement` subscribers. Wake
- * hints are droppable by contract (consumers pair every subscription with ledger polls), so
+ * Bounded in-memory wake buffer for same-incarnation workers. Wake
+ * hints are droppable by contract (consumers pair hints with durable authority), so
  * a full buffer slides out the oldest hint and an eviction simply loses the buffer — the
  * poll interval and the persisted alarm keep liveness (persistence §14).
  */
@@ -28,14 +28,15 @@ class RemoteWakeDropped extends Schema.TaggedError<RemoteWakeDropped>()("RemoteW
 /**
  * The DC `WakeScheduler` (plan §1.4):
  *
- * - `notify(local)` → `setAlarm(now)` — durable, cheap, coalescing (the alarm slot keeps the
- *   earliest deadline) — plus a same-incarnation PubSub hint for `awaitSettlement` waiters.
+ * - `notify(local)` wakes progress and settlement registrations, publishes a worker hint, and
+ *   schedules the earliest alarm. Processing an owned Thread defers immediate alarms until
+ *   processing exits; pre-armed recovery deadlines remain active. Progress hints skip settlement
+ *   registrations only.
  * - `notify(remote)` → fire-and-forget `wake()` on the owning Object's stub with every error
  *   swallowed and logged: hints are droppable, and the target's own alarm/scan pairing (the
  *   maintenance pass re-polls unsettled children) guarantees liveness without this call.
- * - `wakes` → the bounded sliding PubSub only. No important state lives in memory: the
- *   subscription accelerates waiters within one incarnation and the settlement poll interval
- *   is the correctness path.
+ * - `wakes` → the bounded sliding PubSub only. Thread waiters use Scope-owned one-shot hubs;
+ *   the settlement poll interval and persisted alarm retain liveness after hint loss.
  */
 export const cloudflareWakeSchedulerLayer: Layer.Layer<
   WakeScheduler,
@@ -48,18 +49,23 @@ export const cloudflareWakeSchedulerLayer: Layer.Layer<
     const namespace = yield* ThreadObjectNamespace;
     const hints = yield* PubSub.sliding<ThreadId>(WAKE_BUFFER_CAPACITY);
     const progress = yield* makeWakeSubscriptionHub;
+    const settlements = yield* makeWakeSubscriptionHub;
 
     yield* Effect.addFinalizer(() => PubSub.shutdown(hints));
 
-    const notifyLocal = (threadId: ThreadId) =>
-      progress.notify(threadId).pipe(
+    const scheduleLocal = alarm.scheduleNow.pipe(
+      Effect.catch((error) =>
+        Effect.logWarning("CloudflareWakeScheduler: local alarm wake failed", error),
+      ),
+    );
+
+    const notifyLocal = (threadId: ThreadId, kind?: "progress") =>
+      (kind === "progress"
+        ? progress.notify(threadId)
+        : settlements.notify(threadId).pipe(Effect.andThen(progress.notify(threadId)))
+      ).pipe(
         Effect.andThen(PubSub.publish(hints, threadId)),
-        Effect.andThen(alarm.scheduleNow),
-        Effect.catch((error) =>
-          // `notify` never fails by contract; a failed alarm write degrades to "hint lost"
-          // and the pass re-arm (or the next entry point's pre-arm) restores the invariant.
-          Effect.logWarning("CloudflareWakeScheduler: local alarm wake failed", error),
-        ),
+        Effect.andThen(scheduleLocal),
         Effect.asVoid,
       );
 
@@ -82,9 +88,14 @@ export const cloudflareWakeSchedulerLayer: Layer.Layer<
       );
 
     return WakeScheduler.of({
-      notify: (threadId) =>
-        placement.ownsThread(threadId) ? notifyLocal(threadId) : notifyRemote(threadId),
-      subscribe: progress.subscribe,
+      withProcessing: (threadId, body) =>
+        placement.ownsThread(threadId)
+          ? alarm.withHintsDeferred(body).pipe(Effect.ensuring(scheduleLocal))
+          : body,
+      notify: (threadId, kind) =>
+        placement.ownsThread(threadId) ? notifyLocal(threadId, kind) : notifyRemote(threadId),
+      subscribe: (threadId, kind) =>
+        (kind === "settlement" ? settlements : progress).subscribe(threadId),
       wakes: Stream.fromPubSub(hints),
     });
   }),

package/src/index.ts

@@ -12,3 +12,4 @@ export * as WakeScheduler from "./WakeScheduler.ts";
 export * as CloudflareAiGateway from "./CloudflareAiGateway.ts";
 export * as BrowserSession from "./BrowserSession.ts";
 export * as BrowserCredentials from "./BrowserCredentials.ts";
+export * as BrowserUse from "./BrowserUse.ts";