@yielded/agent-platform-cloudflare 0.1.0-beta.167 → 0.1.0-beta.169

package/src/Alarm.ts

@@ -1,3 +1,4 @@
+import { CurrentNativeSource } from "@yielded/agent-storage-cloudflare/port-routing";
 import { type DurableBindingFailure } from "@yielded/agent/agent-registration";
 import {
   DurableAgentRuntime,
@@ -35,15 +36,16 @@ import {
   Random,
   Ref,
   Result,
+  Scheduler,
   Schema,
   Scope,
   Semaphore,
   Stream,
   Struct,
 } from "effect";
-import { DurableObjectStorage } from "effect-cf";
+import { DurableObjectAlarm, DurableObjectStorage } from "effect-cf";
 import { SqlClient } from "effect/sql/SqlClient";
-import type { SqlError } from "effect/sql/SqlError";
+import { SqlError, UnknownError } from "effect/sql/SqlError";
 
 import { DurableObjectContext } from "./CloudflareBindings.ts";
 import { AuxiliaryDispatchMillis, CloudflareDurableRuntimeConfig } from "./CloudflareConfig.ts";
@@ -51,10 +53,8 @@ import { safeCauseMessage } from "./internal/boundary.ts";
 import * as DueQueue from "./internal/due-queue.ts";
 
 /**
- * The single multiplexed Durable Object alarm (decision D-P6-2). A Durable Object has ONE
- * alarm slot; due work (lease expiry, settlement
- * and abort re-checks, retry backoff) multiplexes into one idempotent maintenance pass, and
- * the slot always holds the EARLIEST deadline any caller asked for.
+ * The maintenance queue owns lease expiry, settlement, retries and dirty generations.
+ * Its manual effect-cf alarm shares the native slot with other registered alarms.
  *
  * The alarm invariant (plan §1.4): every committed actionable mutation carries a newer durable
  * maintenance generation and a committed alarm. Stable externally-driven waits may be
@@ -122,110 +122,268 @@ const makeStorageOperation = Effect.map(
       run(operation, Effect.tryPromise({ try: execute, catch: alarmFailure(operation) })),
 );
 
-/** Native `ctx.storage` alarm slot owned by ThreadMaintenance; storage is truth. */
+/** One manual alarm for the entire consumer-owned maintenance queue. */
+export class ThreadMaintenanceAlarm extends DurableObjectAlarm.Tag<ThreadMaintenanceAlarm>()(
+  "@yielded/agent/thread-maintenance",
+  { "@yielded/agent/thread-maintenance": { payload: Schema.Null, lifecycle: "manual" } },
+) {}
+
+const maintenanceAlarmRef = { tag: "@yielded/agent/thread-maintenance", id: "queue" } as const;
+
+const maintenanceAlarmInput = (deadline: number) => ({
+  ...maintenanceAlarmRef,
+  payload: null,
+  runAt: DateTime.makeUnsafe(deadline),
+});
+
+/** Named maintenance checkpoint; the library owns the shared native alarm slot. */
 export class DurableAlarmService extends Context.Service<
   DurableAlarmService,
   {
-    /** The scheduled deadline in epoch milliseconds, if any. */
     readonly scheduled: Effect.Effect<Option.Option<number>, DurableAlarmError>;
-    /** Replace the slot with this deadline. */
     readonly scheduleAt: (epochMillis: number) => Effect.Effect<void, DurableAlarmError>;
-    /** Keep the EARLIER of the existing deadline and this one (the multiplexing rule). */
     readonly ensureScheduledBy: (epochMillis: number) => Effect.Effect<void, DurableAlarmError>;
-    /**
-     * Arm an immediate alarm (the durable, coalescing local wake) — DEFERRED while a
-     * maintenance pass is executing. Workerd cancels an in-flight alarm handler when a new
-     * EARLIER deadline is written during its execution (`requestScheduledAlarm`), and the
-     * maintenance pass runs INSIDE the alarm handler: an immediate wake landing mid-pass
-     * (a routed port mutation, a sibling's `wake()`, the coordinator's own local notify)
-     * would kill the running Attempt — manufacturing an ownership loss no real eviction
-     * caused, and routing open uncertain-class Tool Calls into spurious Unknown Outcomes.
-     * Deferral is contract-safe: wakes are droppable hints, every mutating entry point
-     * pre-arms BEFORE its first durable mutation (the alarm invariant never rests on this
-     * call). The pass's durable generation check observes any racing mutation, so the
-     * in-memory hint does not need to be flushed after a stable wait is acknowledged.
-     */
+    /** Queue-aware promptness hint; idle queues stay idle and retry floors survive. */
     readonly scheduleNow: Effect.Effect<void, DurableAlarmError>;
-    /**
-     * Run one maintenance pass with wake deferral (see `scheduleNow`). Calls made while `body`
-     * executes are droppable promptness hints; correctness rests on the durable generation.
-     */
-    readonly withWakesDeferred: <A, E, R>(body: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
-    /** Clear the slot; correctness-sensitive clears live in maintenance generation transactions. */
+    /** Coalesce droppable inline hints without delaying committed deadlines or their delivery. */
+    readonly withHintsDeferred: <A, E, R>(body: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
     readonly cancel: Effect.Effect<void, DurableAlarmError>;
   }
 >()("@effect-agent/platform-cloudflare/DurableAlarmService") {
-  static readonly layer: Layer.Layer<DurableAlarmService, never, DurableObjectContext | SqlClient> =
-    Layer.effect(DurableAlarmService)(
-      Effect.gen(function* () {
-        const { ctx } = yield* DurableObjectContext;
-        /**
-         * In-memory pass bookkeeping — a pure CACHE, never state: a fresh incarnation has no
-         * running pass, and a deferred wake lost to eviction was only ever a promptness hint
-         * on top of the already-committed pre-armed alarm.
-         */
-        const runningPasses = yield* Ref.make(0);
-
-        const storageOperation = yield* makeStorageOperation;
-
-        const scheduled = storageOperation("get alarm", () => ctx.storage.getAlarm()).pipe(
-          Effect.map((deadline) =>
-            deadline === null ? Option.none<number>() : Option.some(deadline),
+  static readonly layer = Layer.effect(DurableAlarmService)(
+    Effect.gen(function* () {
+      const alarms = yield* ThreadMaintenanceAlarm;
+      const { ctx } = yield* DurableObjectContext;
+      const run = yield* makeStorageEffect;
+      const inlineWork = yield* Ref.make(0);
+
+      const wrap = <A, E, R>(operation: string, effect: Effect.Effect<A, E, R>) =>
+        run(operation, effect.pipe(Effect.mapError(alarmFailure(operation))));
+
+      return DurableAlarmService.of({
+        scheduled: wrap(
+          "read maintenance checkpoint",
+          alarms.getAlarmStatus(maintenanceAlarmRef),
+        ).pipe(
+          Effect.map((at) =>
+            at === undefined ? Option.none() : Option.some(DateTime.toEpochMillis(at.runAt)),
           ),
-        );
+        ),
+        scheduleAt: (at) =>
+          wrap("replace maintenance checkpoint", alarms.scheduleAlarm(maintenanceAlarmInput(at))),
+        ensureScheduledBy: (at) =>
+          wrap(
+            "advance maintenance checkpoint",
+            alarms.scheduleAlarmEarlier(maintenanceAlarmInput(at)),
+          ),
+        scheduleNow: Ref.get(inlineWork).pipe(
+          Effect.flatMap((active) =>
+            active > 0
+              ? Effect.void
+              : wrap(
+                  "hint maintenance checkpoint",
+                  alarms.transaction((tx) =>
+                    Effect.gen(function* () {
+                      const now = yield* Clock.currentTimeMillis;
+                      const next = DueQueue.next(DueQueue.make(ctx.storage).read());
+
+                      if (Number.isFinite(next))
+                        yield* tx.scheduleAlarmEarlier(maintenanceAlarmInput(Math.max(now, next)));
+                    }),
+                  ),
+                ),
+          ),
+        ),
+        withHintsDeferred: (body) =>
+          Effect.acquireUseRelease(
+            Ref.update(inlineWork, (active) => active + 1),
+            () => body,
+            () => Ref.update(inlineWork, (active) => active - 1),
+          ),
+        cancel: wrap("cancel maintenance checkpoint", alarms.cancelAlarm(maintenanceAlarmRef)),
+      });
+    }),
+  );
+}
 
-        const scheduleAt = (epochMillis: number) =>
-          storageOperation("set alarm", () => ctx.storage.setAlarm(epochMillis));
+type CheckpointIntent = {
+  readonly at: (deadline: number) => void;
+  readonly earlier: (deadline: number) => void;
+  readonly cancel: () => void;
+};
 
-        const ensureScheduledBy = (epochMillis: number) =>
-          storageOperation("ensure alarm", () =>
-            ctx.storage.transaction(async (transaction) => {
-              const existing = await transaction.getAlarm();
+type MaintenanceStorage = Pick<DurableObjectTransaction, "get" | "put" | "delete">;
+type MaintenanceCheckpoint = {
+  readonly mutations: Parameters<
+    Parameters<ThreadMaintenanceAlarm["Service"]["transaction"]>[0]
+  >[0];
+  readonly requireActive: Effect.Effect<void, DurableAlarmError>;
+};
 
-              if (existing === null || existing > epochMillis) {
-                await transaction.setAlarm(epochMillis);
-              }
+const CurrentCheckpoint = Context.Reference<MaintenanceCheckpoint | undefined>(
+  "@yielded/agent/cloudflare/CurrentCheckpoint",
+  { defaultValue: () => undefined },
+);
+
+/** One source transaction owns queue intent and the library checkpoint through commit. */
+const makeAlarmOperation = Effect.gen(function* () {
+  const alarms = yield* ThreadMaintenanceAlarm;
+  const sql = yield* SqlClient;
+  const { ctx } = yield* DurableObjectContext;
+  const queue = DueQueue.make(ctx.storage);
+
+  const transaction: SqlClient["withTransaction"] = (body) =>
+    alarms
+      .transaction(
+        (mutations) =>
+          Effect.withFiber((owner) => {
+            let active = true;
+
+            const requireActive = Effect.withFiber((fiber) =>
+              active && fiber === owner
+                ? Effect.void
+                : Effect.fail(
+                    DurableAlarmError.make({
+                      operation: "enroll maintenance source",
+                      message: "Source intent requires its active transaction callback's fiber",
+                    }),
+                  ),
+            );
+
+            return body.pipe(
+              Effect.provideService(CurrentCheckpoint, { mutations, requireActive }),
+              Effect.ensuring(
+                Effect.sync(() => {
+                  active = false;
+                }),
+              ),
+            );
+          }),
+        { sqlClient: sql },
+      )
+      .pipe(
+        Effect.mapError((cause) =>
+          cause instanceof DurableObjectStorage.StorageOperationError
+            ? SqlError.make({
+                reason: UnknownError.make({
+                  operation: "commit maintenance checkpoint",
+                  message: "Source facts and maintenance checkpoint could not commit",
+                  cause,
+                }),
+              })
+            : cause,
+        ),
+      );
+
+  const withTransaction = <A, E, R>(body: Effect.Effect<A, E, R>) =>
+    Effect.flatMap(Effect.serviceOption(sql.transactionService), (ambient) => {
+      if (ambient._tag === "Some" && !DueQueue.ownsTransaction(ctx.storage, ambient.value[1]))
+        return Effect.fail(
+          SqlError.make({
+            reason: UnknownError.make({
+              operation: "begin maintenance source transaction",
+              message: "Use ThreadMutationGate.withTransaction at the outermost source transaction",
+              cause: new Error("Unwrapped SQL transaction cannot own buffered maintenance intent"),
             }),
-          );
+          }),
+        );
 
-        const armNow = Clock.currentTimeMillis.pipe(
-          Effect.flatMap((now) =>
-            storageOperation("wake maintenance lanes", () =>
-              ctx.storage.transaction(async (transaction) => {
-                const next = DueQueue.next(DueQueue.make(ctx.storage).read());
+      return Effect.uninterruptibleMask((restore) =>
+        Effect.suspend(() => {
+          let frame: ReturnType<typeof queue.begin> | undefined;
 
-                if (Number.isFinite(next))
-                  await ensureTransactionAlarmBy(transaction, Math.max(now, next));
+          return transaction(
+            Effect.flatMap(Effect.serviceOption(sql.transactionService), (transaction) =>
+              Effect.sync(() => {
+                if (transaction._tag === "None") throw new Error("SQL transaction unavailable");
+                frame = queue.begin(transaction.value[1]);
               }),
+            ).pipe(
+              Effect.andThen(restore(body)),
+              Effect.tap(() =>
+                Effect.try({
+                  try: () => {
+                    if (frame !== undefined) queue.flush(frame);
+                  },
+                  catch: (cause) =>
+                    SqlError.make({
+                      reason: UnknownError.make({
+                        cause,
+                        operation: "flush maintenance due queue",
+                        message: "Maintenance intent could not commit",
+                      }),
+                    }),
+                }),
+              ),
             ),
-          ),
-        );
+          ).pipe(
+            Effect.onExit((exit) =>
+              Effect.sync(() => {
+                if (frame !== undefined) queue.finish(frame, Exit.isSuccess(exit));
+              }),
+            ),
+            // A released permit can resume another transaction. Do not auto-yield
+            // between the driver's settlement and removing this transaction's frame.
+            Effect.provideService(Scheduler.PreventSchedulerYield, true),
+          );
+        }),
+      );
+    }).pipe(Effect.provideService(SqlClient, sql));
 
-        const scheduleNow = Ref.get(runningPasses).pipe(
-          Effect.flatMap((passes) => (passes > 0 ? Effect.void : armNow)),
-        );
+  const run = <A>(
+    operation: string,
+    execute: (transaction: MaintenanceStorage, checkpoint: CheckpointIntent) => Promise<A>,
+  ) => {
+    const commit = Effect.flatMap(CurrentCheckpoint, (tx) => {
+      if (tx === undefined)
+        return Effect.die(new Error("Maintenance checkpoint transaction unavailable"));
 
-        const withWakesDeferred = <A, E, R>(body: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
-          Ref.update(runningPasses, (passes) => passes + 1).pipe(
-            Effect.andThen(body),
-            Effect.ensuring(Ref.update(runningPasses, (passes) => passes - 1)),
-          );
+      return tx.requireActive.pipe(
+        Effect.andThen(
+          Effect.suspend(() => {
+            let checkpoint: ReturnType<DurableObjectAlarm.AlarmScheduler["scheduleAlarm"]> =
+              Effect.void;
+
+            const intent: CheckpointIntent = {
+              at: (at) => {
+                checkpoint = tx.mutations.scheduleAlarm(maintenanceAlarmInput(at));
+              },
+              earlier: (at) => {
+                checkpoint = tx.mutations.scheduleAlarmEarlier(maintenanceAlarmInput(at));
+              },
+              cancel: () => {
+                checkpoint = tx.mutations.cancelAlarm(maintenanceAlarmRef);
+              },
+            };
 
-        const cancel = storageOperation("delete alarm", () => ctx.storage.deleteAlarm());
+            // The SQL/alarm callback already owns the native transaction; KV uses the same storage.
+            return Effect.tryPromise({
+              try: () => execute(ctx.storage, intent),
+              catch: alarmFailure(operation),
+            }).pipe(Effect.tap(() => checkpoint));
+          }),
+        ),
+      );
+    });
 
-        return DurableAlarmService.of({
-          scheduled,
-          scheduleAt,
-          ensureScheduledBy,
-          scheduleNow,
-          withWakesDeferred,
-          cancel,
-        });
-      }),
-    );
-}
+    return Effect.gen(function* () {
+      const current = yield* CurrentCheckpoint;
+
+      if (current !== undefined) return yield* commit;
+      const ambient = yield* Effect.serviceOption(sql.transactionService);
+
+      // Preserve eager writes and invalidation for an unwrapped host SQL transaction.
+      return yield* ambient._tag === "Some" && !DueQueue.buffering(ctx.storage)
+        ? transaction(commit).pipe(
+            Effect.ensuring(Effect.sync(() => DueQueue.invalidate(ctx.storage))),
+          )
+        : withTransaction(commit);
+    }).pipe(Effect.uninterruptible, Effect.mapError(alarmFailure(operation)));
+  };
+
+  return { run, withTransaction };
+});
 
-/** What one maintenance pass did — auditable evidence mirroring `NodeDurableHost`'s report. */
 export class MaintenancePassReport extends Schema.Class<MaintenancePassReport>(
   "@effect-agent/platform-cloudflare/MaintenancePassReport",
 )({
@@ -378,6 +536,8 @@ export const ThreadHostMaintenance = Context.Reference<{
 /** @internal Framework handlers are separate from host registrations and their namespace. */
 export const ThreadNativeMaintenance = Context.Reference<{
   readonly lanes: ReadonlyArray<ThreadHostMaintenanceLane>;
+  /** Exact runtime built over a single-Thread placement; never apply to a replacement. */
+  readonly singleThreadRuntime?: DurableAgentRuntime["Service"];
 }>("@effect-agent/platform-cloudflare/ThreadNativeMaintenance", {
   defaultValue: () => ({ lanes: [] }),
 });
@@ -426,6 +586,8 @@ const decodeRecoveryEvent = Schema.decodeUnknownSync(ThreadRecoveryFaultEvent);
  * Object and sequence; callbacks may repeat after interruption. This is a trusted host hook,
  * not pre-authorized UI data: the host owns recipient authorization and safe presentation.
  * Capture services in the Layer. Do not call producers or write the raw alarm slot.
+ * Without this service, maintenance acknowledges and discards transitions. Install the
+ * handler before the first maintenance pass if the application needs that event stream.
  */
 export class ThreadRecoveryEvents extends Context.Service<
   ThreadRecoveryEvents,
@@ -502,7 +664,7 @@ const readRecoveryRecipients = async (
 };
 
 const appendRecoveryRecipients = async (
-  transaction: DurableObjectTransaction,
+  transaction: MaintenanceStorage,
   threadId: ThreadId,
   count: number,
   added: ReadonlyArray<SubmissionId>,
@@ -542,7 +704,7 @@ interface NativePassResult {
   readonly dispatched?: boolean;
 }
 
-/** Independent Threads share two bounded native slots; one active head per Thread. */
+/** Independent Threads share bounded native slots; one active head per Thread. */
 interface NativeDispatch {
   readonly scope: Scope.Scope;
   readonly active: Map<ThreadId, Fiber.Fiber<number, MaintenancePassFailure>>;
@@ -557,7 +719,6 @@ interface NativeDispatch {
   scanRevision?: number;
 }
 
-const nativeDispatchConcurrency = 2;
 /** Post-native delivery shares a finite connection budget across independent host lanes. */
 const afterNativeDispatchConcurrency = 2;
 
@@ -577,8 +738,17 @@ interface NativeRecovery {
   needsCheckpoint: boolean;
   recovered: number;
   repaired: boolean;
+  discoveryPending: boolean;
+  retryAtMillis?: number;
 }
 
+const NativeWorkCursor = Schema.Struct({
+  threadId: ThreadId,
+  cursor: Schema.NonEmptyString.check(Schema.isMaxLength(8192)),
+});
+
+const workCursorKey = (threadId: ThreadId) => `effect-agent:work-recovery-cursor:v1:${threadId}`;
+
 interface MaintenanceObservation {
   readonly queue: Map<string, DueQueue.DueLane>;
   readonly charged: Map<string, number>;
@@ -644,17 +814,6 @@ const readMaintenanceState = async (
     : { state: decodeMaintenanceState(encoded), initialized: true };
 };
 
-const ensureTransactionAlarmBy = async (
-  transaction: Pick<DurableObjectTransaction, "getAlarm" | "setAlarm">,
-  deadline: number,
-): Promise<void> => {
-  const scheduled = await transaction.getAlarm();
-
-  if (scheduled === null || scheduled > deadline) {
-    await transaction.setAlarm(deadline);
-  }
-};
-
 const stableExternalWait = (
   snapshot: SubmissionWorkItem,
   reports: ReadonlyMap<string, RecoveryReport>,
@@ -675,9 +834,7 @@ const stableExternalWait = (
     case "input-applied":
     case "joining":
     case "ready":
-    case "running":
     case "settled":
-    case "terminalizing":
       return false;
   }
 };
@@ -696,18 +853,12 @@ const CurrentMutationLanes = Context.Reference<ReadonlyArray<string>>(
 
 // Source changes made by this pass are certified after its Attempts join. External
 // producers still advance the dirty generation and fence that certification.
-const CurrentNativeSource = Context.Reference<boolean>(
-  "@effect-agent/platform-cloudflare/CurrentNativeSource",
-  {
-    defaultValue: () => false,
-  },
-);
-
 export class ThreadMutationGate extends Context.Service<
   ThreadMutationGate,
   {
-    /** Commit source facts and their scheduling intent together. The flush runs before
-     * native commit; failed or interrupted transactions discard their queue view. */
+    /** Commit source facts and their scheduling intent together. Mutate from this callback's
+     * fiber, or use an explicit child transaction. The flush runs before native commit;
+     * failed or interrupted transactions discard their queue view. */
     readonly withTransaction: <A, E, R>(
       body: Effect.Effect<A, E, R>,
     ) => Effect.Effect<A, E | SqlError, R>;
@@ -779,6 +930,7 @@ export class ThreadMutationGate extends Context.Service<
       const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
 
       const runTransaction = yield* makeStorageOperation;
+      const { run: runAlarmTransaction, withTransaction } = yield* makeAlarmOperation;
 
       const validateSourceBoundary = Effect.flatMap(
         Effect.serviceOption(sql.transactionService),
@@ -800,18 +952,15 @@ export class ThreadMutationGate extends Context.Service<
         dueQueue.register(DueQueue.Native);
       });
 
-      const schedule = Effect.fn("ThreadMutationGate.schedule")(function* (
+      const schedule = Effect.fnUntraced(function* (
         id: string,
         dueAt: number,
         progressCursor?: bigint,
       ) {
         yield* validateSourceBoundary;
         const now = yield* Clock.currentTimeMillis;
-        const current = yield* Effect.serviceOption(sql.transactionService);
 
-        const enroll = async (
-          transaction: Pick<DurableObjectTransaction, "get" | "put" | "getAlarm" | "setAlarm">,
-        ) => {
+        const enroll = async (transaction: MaintenanceStorage, checkpoint: CheckpointIntent) => {
           if (progressCursor === undefined) dueQueue.dirty(id, dueAt);
           else if (
             dueQueue.progress(id, dueAt, progressCursor) &&
@@ -833,17 +982,14 @@ export class ThreadMutationGate extends Context.Service<
           }
           const next = DueQueue.next(dueQueue.read());
 
-          if (Number.isFinite(next))
-            await ensureTransactionAlarmBy(transaction, Math.max(next, now + minimumAlarmDelay));
+          if (Number.isFinite(next)) checkpoint.earlier(Math.max(next, now + minimumAlarmDelay));
         };
 
-        yield* runTransaction("schedule maintenance lane", () =>
-          Option.isSome(current) ? enroll(ctx.storage) : dueQueue.transaction(enroll),
-        );
+        yield* runAlarmTransaction("schedule maintenance lane", enroll);
         yield* notify;
       });
 
-      const beginMutation = Effect.fn("ThreadMaintenance.beginMutation")(function* (
+      const beginMutation = Effect.fnUntraced(function* (
         invalidatesRecovery: boolean,
         lanes: ReadonlyArray<string>,
       ) {
@@ -853,8 +999,9 @@ export class ThreadMutationGate extends Context.Service<
         const publicationRequired = yield* requiresPublication;
 
         if (invalidatesRecovery || lanes.length > 0)
-          yield* runTransaction("advance maintenance generation", () =>
-            dueQueue.transaction(async (transaction) => {
+          yield* runAlarmTransaction(
+            "advance maintenance generation",
+            async (transaction, checkpoint) => {
               const { state, initialized } = await readMaintenanceState(transaction);
 
               if (invalidatesRecovery) {
@@ -864,23 +1011,23 @@ export class ThreadMutationGate extends Context.Service<
               // Enrollment is a crash fallback, not evidence that the body committed.
               for (const id of lanes) dueQueue.dirty(id, now, false);
 
-              const next = ThreadMaintenanceState.make({
-                ...state,
-                dirty: state.dirty + (invalidatesRecovery && !nativeSource ? 1n : 0n),
-              });
-
-              if (invalidatesRecovery || !initialized)
-                await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(next));
+              if (!initialized || (invalidatesRecovery && !nativeSource))
+                await transaction.put(
+                  MAINTENANCE_STATE_KEY,
+                  encodeMaintenanceState(
+                    ThreadMaintenanceState.make({
+                      ...state,
+                      dirty: state.dirty + (invalidatesRecovery && !nativeSource ? 1n : 0n),
+                    }),
+                  ),
+                );
               // The earliest configured retry bounds a newly actionable mutation without relying
               // on its best-effort immediate wake hint.
               const deadline = DueQueue.next(dueQueue.read());
 
               if (Number.isFinite(deadline))
-                await ensureTransactionAlarmBy(
-                  transaction,
-                  Math.max(deadline, now + minimumAlarmDelay),
-                );
-            }),
+                checkpoint.earlier(Math.max(deadline, now + minimumAlarmDelay));
+            },
           );
         yield* failpoint.hit("maintenance:dirty:after");
         yield* Ref.update(activeMutations, (active) => active + 1);
@@ -960,9 +1107,7 @@ export class ThreadMutationGate extends Context.Service<
               ),
         );
 
-      const recordProgress = Effect.fn("ThreadMutationGate.recordProgress")(function* (
-        lanes: ReadonlyArray<string>,
-      ) {
+      const recordProgress = Effect.fnUntraced(function* (lanes: ReadonlyArray<string>) {
         yield* validateSourceBoundary;
         if (Option.isNone(yield* Effect.serviceOption(sql.transactionService)))
           return yield* DurableAlarmError.make({
@@ -979,29 +1124,34 @@ export class ThreadMutationGate extends Context.Service<
         const now = yield* Clock.currentTimeMillis;
         const nativeSource = yield* CurrentNativeSource;
 
-        yield* runTransaction("record maintenance producer progress", async () => {
-          for (const id of affected) dueQueue.dirty(id, now, true);
-          if (affected.has(DueQueue.Native)) {
-            const { state } = await readMaintenanceState(ctx.storage);
+        yield* runAlarmTransaction(
+          "record maintenance producer progress",
+          async (transaction, checkpoint) => {
+            for (const id of affected) dueQueue.dirty(id, now, true);
+            if (affected.has(DueQueue.Native)) {
+              const { state, initialized } = await readMaintenanceState(transaction);
 
-            await ctx.storage.put(
-              MAINTENANCE_STATE_KEY,
-              encodeMaintenanceState(
-                ThreadMaintenanceState.make({
-                  ...Struct.omit(state, ["retry"]),
-                  dirty: state.dirty + (nativeSource ? 0n : 1n),
-                }),
-              ),
-            );
-          }
-          await ensureTransactionAlarmBy(ctx.storage, now + minimumAlarmDelay);
-        });
+              // Native progress already belongs to this generation. Persist only
+              // initialization, external progress, or the removal of a retry budget.
+              if (!initialized || !nativeSource || state.retry !== undefined)
+                await transaction.put(
+                  MAINTENANCE_STATE_KEY,
+                  encodeMaintenanceState(
+                    ThreadMaintenanceState.make({
+                      ...Struct.omit(state, ["retry"]),
+                      dirty: state.dirty + (nativeSource ? 0n : 1n),
+                    }),
+                  ),
+                );
+            }
+            checkpoint.earlier(now + minimumAlarmDelay);
+          },
+        );
         yield* notify;
       });
 
       return ThreadMutationGate.of({
-        withTransaction: <A, E, R>(body: Effect.Effect<A, E, R>) =>
-          dueQueue.withTransaction(body).pipe(Effect.provideService(SqlClient, sql)),
+        withTransaction,
         withMutation,
         schedule,
         recordProgress,
@@ -1032,7 +1182,8 @@ export type MaintenancePassFailure =
  * 2. Reconcile before each head Attempt, then checkpoint only the observed generation. A racing
  *    producer keeps its generation dirty and immediately eligible. Quiescent native retries
  *    retain their durable backoff.
- * 3. Admit at most two independent Thread Attempts, one active head per Thread.
+ * 3. Admit one Attempt for a single-Thread runtime, or at most two independent Thread
+ *    Attempts for a shared host, with one active head per Thread.
  *    Keep native and delivery admission open together while finite waves remain active, so
  *    fresh replies and abort controls can progress during unrelated cleanup. Close atomically
  *    at quiescence, or at the original ten-minute yield deadline, then join admitted waves.
@@ -1073,6 +1224,7 @@ export class ThreadMaintenance extends Context.Service<
     | SubmissionLedger
     | WakeScheduler
     | DurableAlarmService
+    | ThreadMaintenanceAlarm
     | ThreadMaintenanceFailpoint
     | CloudflareDurableRuntimeConfig
     | DurableObjectContext
@@ -1083,7 +1235,8 @@ export class ThreadMaintenance extends Context.Service<
       const recoveryConfig = yield* DurableRuntimeConfig;
       const ledger = yield* SubmissionLedger;
       const wakes = yield* WakeScheduler;
-      const alarm = yield* DurableAlarmService;
+      const hints = yield* DurableAlarmService;
+      const alarms = yield* ThreadMaintenanceAlarm;
       const config = yield* CloudflareDurableRuntimeConfig;
       const { ctx } = yield* DurableObjectContext;
       const dueQueue = DueQueue.make(ctx.storage);
@@ -1103,6 +1256,8 @@ export class ThreadMaintenance extends Context.Service<
       const host = yield* ThreadHostMaintenance;
       const framework = yield* ThreadNativeMaintenance;
 
+      const nativeDispatchConcurrency = () => (framework.singleThreadRuntime === runtime ? 1 : 2);
+
       for (const lane of host.lanes)
         yield* Schema.decodeEffect(DueQueue.HostLaneId)(lane.id).pipe(
           Effect.mapError(alarmFailure("maintenance lane ID")),
@@ -1121,6 +1276,7 @@ export class ThreadMaintenance extends Context.Service<
       const maintenancePassGate = yield* Semaphore.make(1);
       const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
       const runTransaction = yield* makeStorageOperation;
+      const { run: runAlarmTransaction } = yield* makeAlarmOperation;
 
       const queueSnapshot = runTransaction("read maintenance due queue", async () =>
         dueQueue.read(),
@@ -1192,17 +1348,17 @@ export class ThreadMaintenance extends Context.Service<
         return Effect.gen(function* () {
           const now = yield* Clock.currentTimeMillis;
 
-          const claimed = yield* runTransaction("charge maintenance attempt", () =>
-            dueQueue.transaction(async (transaction) => {
+          const claimed = yield* runAlarmTransaction(
+            "charge maintenance attempt",
+            async (_transaction, checkpoint) => {
               const claimed = dueQueue.claim(selected, now);
               const next = DueQueue.next(dueQueue.read());
 
-              if (Number.isFinite(next))
-                await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));
-              else await transaction.deleteAlarm();
+              if (Number.isFinite(next)) checkpoint.at(Math.max(now + minimumAlarmDelay, next));
+              else checkpoint.cancel();
 
               return claimed;
-            }),
+            },
           );
 
           if (claimed === undefined) return Option.none<number>();
@@ -1270,7 +1426,7 @@ export class ThreadMaintenance extends Context.Service<
       };
 
       const appendRecoveryEvents = async (
-        transaction: DurableObjectTransaction,
+        transaction: MaintenanceStorage,
         events: ReadonlyArray<Omit<ThreadRecoveryFaultEvent, "sequence">>,
       ) => {
         if (events.length === 0) return;
@@ -1353,14 +1509,17 @@ export class ThreadMaintenance extends Context.Service<
         }),
       };
 
-      const recordRecoveryFaults = Effect.fn("ThreadMaintenance.recordRecoveryFaults")(function* (
+      const recordRecoveryFaults = Effect.fnUntraced(function* (
         result: RecoverySweepResult,
         recovery: NativeRecovery,
         current?: ReadonlyArray<SubmissionWorkItem>,
+        selectedThread?: ThreadId,
       ) {
         const threads = new Map<ThreadId, RecoveryFailure | undefined>();
 
+        if (selectedThread !== undefined) threads.set(selectedThread, undefined);
         for (const report of result.reports) threads.set(report.threadId, undefined);
+        for (const report of result.workReports ?? []) threads.set(report.threadId, undefined);
         for (const blocked of result.blocked) threads.set(blocked.threadId, blocked.failure);
         if (threads.size === 0) return new Map<ThreadId, ThreadRecoveryFault>();
         const now = yield* Clock.currentTimeMillis;
@@ -1462,27 +1621,59 @@ export class ThreadMaintenance extends Context.Service<
         return retained.faults;
       });
 
-      const recoverThread = Effect.fn("ThreadMaintenance.recoverThread")(function* (
+      const recoverThread = Effect.fnUntraced(function* (
         threadId: ThreadId,
         recovery: NativeRecovery,
       ) {
-        const result = yield* runtime
-          .runRecovery({ threadId })
-          .pipe(Effect.provideService(CurrentNativeSource, true));
+        let cursor = yield* runTransaction("read work recovery cursor", async () => {
+          const retained = await ctx.storage.get(workCursorKey(threadId));
+
+          if (retained === undefined) return undefined;
+          const decoded = Schema.decodeUnknownSync(NativeWorkCursor)(retained);
 
-        // Visibility is committed before a claim or any fallible auxiliary join.
-        const faults = yield* recordRecoveryFaults(result, recovery);
+          if (decoded.threadId !== threadId)
+            throw new Error("Work cursor belongs to another Thread");
 
-        for (const report of result.reports) recovery.reports.set(report.submissionId, report);
-        recovery.faults.delete(threadId);
-        for (const [id, fault] of faults) recovery.faults.set(id, fault);
-        recovery.recovered += result.reports.length + result.blocked.length;
-        recovery.repaired ||= result.reports.some((report) => report.disposition === "repaired");
+          return decoded.cursor;
+        });
+
+        do {
+          const result = yield* runtime
+            .runRecovery({ threadId, ...(cursor === undefined ? {} : { cursor }) })
+            .pipe(Effect.provideService(CurrentNativeSource, true));
+
+          // Persist each bounded pass before a claim; eviction resumes past consumed metadata.
+          const faults = yield* recordRecoveryFaults(result, recovery, undefined, threadId);
+
+          yield* runTransaction("checkpoint work recovery cursor", async () => {
+            if (result.cursor === undefined) await ctx.storage.delete(workCursorKey(threadId));
+            else
+              await ctx.storage.put(
+                workCursorKey(threadId),
+                Schema.encodeSync(NativeWorkCursor)({ threadId, cursor: result.cursor }),
+              );
+          });
+          for (const report of result.reports) recovery.reports.set(report.submissionId, report);
+          recovery.faults.delete(threadId);
+          for (const [id, fault] of faults) recovery.faults.set(id, fault);
+          recovery.recovered +=
+            (result.workReports?.length ?? result.reports.length) + result.blocked.length;
+          recovery.repaired ||= (result.workReports ?? result.reports).some(
+            (report) => report.disposition === "repaired",
+          );
+          for (const report of result.workReports ?? [])
+            if (report.retryAtMillis !== undefined)
+              recovery.retryAtMillis = Math.min(
+                recovery.retryAtMillis ?? Infinity,
+                report.retryAtMillis,
+              );
+          cursor = result.blocked.length > 0 ? undefined : result.cursor;
+        } while (cursor !== undefined);
       });
 
       // Registry changes, including upgrades from timed binding retries, create one native
       // opportunity. Unchanged registries leave parked work dormant across Object eviction.
-      const readCurrentMaintenanceState = async (transaction: DurableObjectTransaction) => {
+      const readCurrentMaintenanceState = async (transaction: MaintenanceStorage) => {
         const current = await readMaintenanceState(transaction);
 
         if (current.state.bindingRegistryKey === runtime.bindingRegistryKey) return current;
@@ -1500,48 +1691,43 @@ export class ThreadMaintenance extends Context.Service<
         return { state, initialized: true };
       };
 
-      const ensureAlarm = Effect.fn("ThreadMaintenance.ensureAlarm")(function* () {
+      const ensureAlarm = Effect.fnUntraced(function* () {
         yield* failpoint.hit("maintenance:ensure:before");
         const now = yield* Clock.currentTimeMillis;
 
-        yield* runTransaction("ensure maintenance alarm", () =>
-          dueQueue.transaction(async (transaction) => {
-            const { state, initialized } = await readCurrentMaintenanceState(transaction);
+        yield* runAlarmTransaction("ensure maintenance alarm", async (transaction, checkpoint) => {
+          const { state, initialized } = await readCurrentMaintenanceState(transaction);
 
-            recoveryEventsPending = hasRecoveryEvents(state);
-            const rows = dueQueue.read();
+          recoveryEventsPending = hasRecoveryEvents(state);
+          const rows = dueQueue.read();
 
-            if (recoveryEventsPending && !rows.some((row) => row.id === DueQueue.RecoveryEvents))
-              dueQueue.dirty(DueQueue.RecoveryEvents, now);
-            if (!initialized)
-              await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
+          if (recoveryEventsPending && !rows.some((row) => row.id === DueQueue.RecoveryEvents))
+            dueQueue.dirty(DueQueue.RecoveryEvents, now);
+          if (!initialized)
+            await transaction.put(MAINTENANCE_STATE_KEY, encodeMaintenanceState(state));
 
-            const native =
-              state.dirty > state.processed
-                ? state.retry?.generation === state.dirty
-                  ? state.retry.notBefore
-                  : (rows.find((row) => row.id === DueQueue.Native)?.dueAt ??
-                    now + minimumAlarmDelay)
-                : null;
+          const native =
+            state.dirty > state.processed
+              ? state.retry?.generation === state.dirty
+                ? state.retry.notBefore
+                : (rows.find((row) => row.id === DueQueue.Native)?.dueAt ?? now + minimumAlarmDelay)
+              : null;
 
-            dueQueue.checkpointNative(native);
-            const next = DueQueue.next(dueQueue.read());
+          dueQueue.checkpointNative(native);
+          const next = DueQueue.next(dueQueue.read());
 
-            if (Number.isFinite(next))
-              await ensureTransactionAlarmBy(transaction, Math.max(now + minimumAlarmDelay, next));
-          }),
-        );
+          if (Number.isFinite(next)) checkpoint.earlier(Math.max(now + minimumAlarmDelay, next));
+        });
         yield* failpoint.hit("maintenance:ensure:after");
       });
 
-      const beginPass = Effect.fn("ThreadMaintenance.beginPass")(function* (
-        observed: MaintenanceObservation,
-      ) {
+      const beginPass = Effect.fnUntraced(function* (observed: MaintenanceObservation) {
         yield* failpoint.hit("maintenance:begin:before");
         const now = yield* Clock.currentTimeMillis;
 
-        const result = yield* runTransaction("begin maintenance pass", () =>
-          dueQueue.transaction(async (transaction) => {
+        const result = yield* runAlarmTransaction(
+          "begin maintenance pass",
+          async (transaction, checkpoint) => {
             const { state, initialized } = await readCurrentMaintenanceState(transaction);
 
             recoveryEventsPending = hasRecoveryEvents(state);
@@ -1582,8 +1768,8 @@ export class ThreadMaintenance extends Context.Service<
             const deadline = DueQueue.next(dueQueue.read());
 
             if (Number.isFinite(deadline))
-              await transaction.setAlarm(Math.max(now + minimumAlarmDelay, deadline));
-            else await transaction.deleteAlarm();
+              checkpoint.at(Math.max(now + minimumAlarmDelay, deadline));
+            else checkpoint.cancel();
 
             return {
               _tag: "Actionable" as const,
@@ -1592,7 +1778,7 @@ export class ThreadMaintenance extends Context.Service<
               nonterminal: state.nonterminal,
               stalls: charged.stalls,
             };
-          }),
+          },
         );
 
         yield* failpoint.hit("maintenance:begin:after");
@@ -1610,16 +1796,11 @@ export class ThreadMaintenance extends Context.Service<
         return Math.ceil(backoff / 2 + (backoff / 2) * jitter);
       };
 
-      const rearmDelay = Effect.fn("ThreadMaintenance.rearmDelay")(function* (
-        progressed: boolean,
-        priorStalls: number,
-      ) {
+      const rearmDelay = Effect.fnUntraced(function* (progressed: boolean, priorStalls: number) {
         return progressed ? config.alarmBackoffBase : backoffDelay(priorStalls, yield* Random.next);
       });
 
-      const rearmFailure = Effect.fn("ThreadMaintenance.rearmFailure")(function* (
-        observed: MaintenanceObservation,
-      ) {
+      const rearmFailure = Effect.fnUntraced(function* (observed: MaintenanceObservation) {
         const { generation, nativeOnly } = observed;
 
         if (generation === undefined) return;
@@ -1630,8 +1811,9 @@ export class ThreadMaintenance extends Context.Service<
 
             const jitter = yield* Random.next;
 
-            yield* runTransaction("back off failed maintenance", () =>
-              dueQueue.transaction(async (transaction) => {
+            yield* runAlarmTransaction(
+              "back off failed maintenance",
+              async (transaction, checkpoint) => {
                 const { state } = await readMaintenanceState(transaction);
 
                 const previous =
@@ -1682,20 +1864,17 @@ export class ThreadMaintenance extends Context.Service<
                 }
                 const next = DueQueue.next(dueQueue.read());
 
-                if (Number.isFinite(next))
-                  await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));
-                else await transaction.deleteAlarm();
-              }),
+                if (Number.isFinite(next)) checkpoint.at(Math.max(now + minimumAlarmDelay, next));
+                else checkpoint.cancel();
+              },
             );
           }),
         );
         yield* failpoint.hit("maintenance:retry:after");
       });
 
-      const beginNative = Effect.fn("ThreadMaintenance.beginNative")(function* (
-        observed: MaintenanceObservation,
-      ) {
-        return yield* mutations.withSnapshot((activeAtStart) =>
+      const beginNative = (observed: MaintenanceObservation) =>
+        mutations.withSnapshot((activeAtStart) =>
           Effect.gen(function* () {
             const generation = yield* beginPass(observed);
 
@@ -1708,9 +1887,8 @@ export class ThreadMaintenance extends Context.Service<
             return { ...generation, activeAtStart };
           }),
         );
-      });
 
-      const attemptSelected = Effect.fn("ThreadMaintenance.attemptSelected")(function* (
+      const attemptSelected = Effect.fnUntraced(function* (
         selected: SubmissionWorkItem,
         previousWaits: ReadonlyArray<BindingWait>,
         yieldAfter: DateTime.Utc,
@@ -1798,7 +1976,7 @@ export class ThreadMaintenance extends Context.Service<
         return Option.isSome(settlement) ? 1 : 0;
       });
 
-      const advance = Effect.fn("ThreadMaintenance.advance")(function* (
+      const advance = Effect.fnUntraced(function* (
         started: Effect.Success<ReturnType<typeof beginNative>>,
         yieldAfter: DateTime.Utc,
         observed: MaintenanceObservation,
@@ -1896,7 +2074,32 @@ export class ThreadMaintenance extends Context.Service<
           activeAtStart: started.activeAtStart,
         });
 
+        const { scannedGeneration, afterWorkThread } = yield* runTransaction(
+          "read work discovery position",
+          async () => {
+            const { state } = await readMaintenanceState(ctx.storage);
+
+            return {
+              scannedGeneration: state.dirty,
+              afterWorkThread: state.lastRecoveredThreadId,
+            };
+          },
+        );
+
         const current = yield* Stream.runCollect(ledger.scanNonterminal);
+
+        let workOwners = yield* runtime
+          .discoverWorkThreads({
+            limit: 32,
+            ...(afterWorkThread === undefined ? {} : { afterThreadId: afterWorkThread }),
+          })
+          .pipe(Effect.provideService(CurrentNativeSource, true));
+
+        if (workOwners.threadIds.length === 0 && afterWorkThread !== undefined)
+          workOwners = yield* runtime
+            .discoverWorkThreads({ limit: 32 })
+            .pipe(Effect.provideService(CurrentNativeSource, true));
+        recovery.discoveryPending ||= workOwners.afterThreadId !== undefined;
         const selectionTime = yield* Clock.currentTimeMillis;
         const submissionsByThread = new Map<ThreadId, Array<SubmissionId>>();
 
@@ -1906,6 +2109,10 @@ export class ThreadMaintenance extends Context.Service<
           ids.push(row.submissionId);
           submissionsByThread.set(row.threadId, ids);
         }
+        // Canonical obligations survive their last Submission. Reload their retained backoff
+        // before selecting recovery, including after eviction or a newer host mutation.
+        for (const threadId of workOwners.threadIds)
+          if (!submissionsByThread.has(threadId)) submissionsByThread.set(threadId, []);
 
         yield* runTransaction("read Thread recovery deadlines", async () => {
           for (const [threadId, ids] of submissionsByThread) {
@@ -2064,7 +2271,7 @@ export class ThreadMaintenance extends Context.Service<
             const selected = dispatch
               ? [...runnable.slice(pivot), ...runnable.slice(0, pivot)].slice(
                   0,
-                  nativeDispatchConcurrency - reserved.size,
+                  nativeDispatchConcurrency() - reserved.size,
                 )
               : [];
 
@@ -2081,7 +2288,7 @@ export class ThreadMaintenance extends Context.Service<
 
             const backlog = recovery.started
               ? []
-              : [...heads.keys()].filter((threadId) => {
+              : [...new Set([...heads.keys(), ...workOwners.threadIds])].filter((threadId) => {
                   const fault = recoveryFaults.get(threadId);
 
                   return (
@@ -2103,7 +2310,12 @@ export class ThreadMaintenance extends Context.Service<
                 threadId <= state.lastRecoveredThreadId,
             );
 
-            return { selected, waits, backlog: [...after, ...before] };
+            return {
+              selected,
+              waits,
+              backlog: [...after, ...before].slice(0, 32),
+              discoveryPending: backlog.length > 32,
+            };
           }),
         );
 
@@ -2111,6 +2323,7 @@ export class ThreadMaintenance extends Context.Service<
         if (!recovery.started) {
           recovery.started = true;
           recovery.needsCheckpoint = selection.backlog.length > 0;
+          recovery.discoveryPending ||= selection.discoveryPending;
           for (const threadId of selection.backlog) recovery.pending.add(threadId);
           yield* Deferred.succeed(recovery.queue, selection.backlog);
         }
@@ -2142,30 +2355,32 @@ export class ThreadMaintenance extends Context.Service<
           };
         }
 
-        const scannedGeneration = yield* runTransaction(
-          "observe native source generation",
-          async () => (await readMaintenanceState(ctx.storage)).state.dirty,
-        );
-
         const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
         const waitingHeads = new Map<ThreadId, boolean>();
 
-        const autonomous = remaining.some((snapshot) => {
-          if (snapshot.state === "unknown" && waiting(snapshot)) return false;
-          const headWaiting = waitingHeads.get(snapshot.threadId);
-
-          if (headWaiting === undefined) waitingHeads.set(snapshot.threadId, waiting(snapshot));
-          // FIFO followers cannot execute through a stable external wait. Only plain queued
-          // input is dormant here; admission repairs and accepted aborts still need a pass.
-          if (
-            headWaiting === true &&
-            snapshot.state === "ready" &&
-            reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput"
-          )
-            return false;
+        // Selected recovery must finish before its generation can be acknowledged: terminal
+        // owners can supply a retry deadline only after their evidence read completes.
+        const autonomous =
+          recovery.pending.size > 0 ||
+          recovery.discoveryPending ||
+          recoveryFaults.size > 0 ||
+          recovery.retryAtMillis !== undefined ||
+          remaining.some((snapshot) => {
+            if (snapshot.state === "unknown" && waiting(snapshot)) return false;
+            const headWaiting = waitingHeads.get(snapshot.threadId);
+
+            if (headWaiting === undefined) waitingHeads.set(snapshot.threadId, waiting(snapshot));
+            // FIFO followers cannot execute through a stable external wait. Only plain queued
+            // input is dormant here; admission repairs and accepted aborts still need a pass.
+            if (
+              headWaiting === true &&
+              snapshot.state === "ready" &&
+              reports.get(snapshot.submissionId)?.decision._tag === "ApplyInput"
+            )
+              return false;
 
-          return !waiting(snapshot);
-        });
+            return !waiting(snapshot);
+          });
 
         const progressed = native.progressed || recovery.repaired;
 
@@ -2180,6 +2395,8 @@ export class ThreadMaintenance extends Context.Service<
               .map(() => now),
           );
 
+        if (recovery.retryAtMillis !== undefined) nextEligible.push(recovery.retryAtMillis);
+
         const retryDelay =
           nextEligible.length === 0 ? 0 : Math.max(0, Math.min(...nextEligible) - now);
 
@@ -2197,10 +2414,14 @@ export class ThreadMaintenance extends Context.Service<
               const mutationOverlap =
                 observation.activeAtStart > 0 || started.activeAtStart > 0 || active > 0;
 
-              // An empty control scan needs no older recovery report. Certify its fresh
-              // snapshot only when no producer overlapped it or advanced the generation.
+              // Only a scan without ledger work or canonical obligations can certify a newer
+              // generation without another recovery wave. Read its generation before discovery
+              // so progress committed during the scan retains its own recovery opportunity.
               const generation =
-                remaining.length === 0 && !mutationOverlap && state.dirty === scannedGeneration
+                remaining.length === 0 &&
+                workOwners.threadIds.length === 0 &&
+                !mutationOverlap &&
+                state.dirty === scannedGeneration
                   ? scannedGeneration
                   : observation.generation;
 
@@ -2250,9 +2471,10 @@ export class ThreadMaintenance extends Context.Service<
         );
 
         yield* failpoint.hit("maintenance:checkpoint:after");
-        // Once this empty recovery wave is checkpointed, its producer overlap must not
-        // prevent a later fresh snapshot from acknowledging native quiescence.
-        if (remaining.length === 0 && recovery.pending.size === 0) delete recovery.observation;
+        // A fresh empty scan may clear earlier producer overlap, but this pass has only
+        // recovered its original generation. Retain that boundary for later canonical work.
+        if (remaining.length === 0 && recovery.pending.size === 0)
+          recovery.observation = { generation: observation.generation, activeAtStart: 0 };
         native.deferred.clear();
         native.progressed = false;
         native.needsCheckpoint = false;
@@ -2264,7 +2486,7 @@ export class ThreadMaintenance extends Context.Service<
         };
       });
 
-      const validateLanes = Effect.fn("ThreadMaintenance.validateLanes")(function* (
+      const validateLanes = Effect.fnUntraced(function* (
         lanes: ReadonlyArray<ThreadHostMaintenanceLane>,
         queued: ReadonlyArray<DueQueue.DueLane>,
       ) {
@@ -2295,7 +2517,7 @@ export class ThreadMaintenance extends Context.Service<
         }
       });
 
-      const dispatch = Effect.fn("ThreadMaintenance.dispatch")(function* (
+      const dispatch = Effect.fnUntraced(function* (
         yieldAfter: DateTime.Utc,
         dispatchUntil: DateTime.Utc,
         observed: MaintenanceObservation,
@@ -2354,6 +2576,7 @@ export class ThreadMaintenance extends Context.Service<
           needsCheckpoint: false,
           recovered: 0,
           repaired: false,
+          discoveryPending: false,
         };
 
         const recoveryFiber = yield* fork(
@@ -2438,7 +2661,7 @@ export class ThreadMaintenance extends Context.Service<
             native = undefined;
             if (result.phase === "actionable") phase = "actionable";
             observed.nativeOnly = dispatch.active.size > 0;
-            if (result.dispatched === true && dispatch.active.size < nativeDispatchConcurrency) {
+            if (result.dispatched === true && dispatch.active.size < nativeDispatchConcurrency()) {
               dispatch.scanGeneration = undefined;
               nativeCheck = true;
             }
@@ -2589,7 +2812,7 @@ export class ThreadMaintenance extends Context.Service<
           if (
             native === undefined &&
             nativeCheck &&
-            dispatch.active.size < nativeDispatchConcurrency
+            dispatch.active.size < nativeDispatchConcurrency()
           ) {
             nativeCheck = false;
             const nativeCheckpoint = dispatch.needsCheckpoint && dispatch.active.size === 0;
@@ -2692,7 +2915,7 @@ export class ThreadMaintenance extends Context.Service<
         return { result, phase, recovered: recovery.recovered, settled: dispatch.settled };
       });
 
-      const pass = Effect.fn("ThreadMaintenance.pass")(function* (
+      const pass = Effect.fnUntraced(function* (
         yieldAfter: DateTime.Utc,
         dispatchUntil: DateTime.Utc,
         observed: MaintenanceObservation,
@@ -2856,8 +3079,9 @@ export class ThreadMaintenance extends Context.Service<
           Effect.gen(function* () {
             const now = yield* Clock.currentTimeMillis;
 
-            return yield* runTransaction("finish maintenance event", () =>
-              dueQueue.transaction(async (transaction) => {
+            return yield* runAlarmTransaction(
+              "finish maintenance event",
+              async (transaction, checkpoint) => {
                 const { state } = await readMaintenanceState(transaction);
 
                 const native =
@@ -2873,14 +3097,14 @@ export class ThreadMaintenance extends Context.Service<
                 const next = DueQueue.next(dueQueue.read());
 
                 if (Number.isFinite(next)) {
-                  await transaction.setAlarm(Math.max(now + minimumAlarmDelay, next));
+                  checkpoint.at(Math.max(now + minimumAlarmDelay, next));
 
                   return "rearmed" as const;
                 }
-                await transaction.deleteAlarm();
+                checkpoint.cancel();
 
                 return "cleared" as const;
-              }),
+              },
             );
           }),
         );
@@ -2920,18 +3144,27 @@ export class ThreadMaintenance extends Context.Service<
             available: new Map(),
           };
 
-          return yield* alarm.withWakesDeferred(
-            maintenancePassGate.withPermit(
-              dueQueue.withView(Effect.scoped(pass(yieldAfter, dispatchUntil, observed))).pipe(
-                // Close event-owned auxiliary work and release Attempt ownership before
-                // failure rearming, while still holding the pass permit.
-                Effect.onErrorIf(
-                  () => true,
-                  () => rearmFailure(observed),
+          return yield* alarms
+            .deferWakes(
+              maintenancePassGate.withPermit(
+                dueQueue.withView(Effect.scoped(pass(yieldAfter, dispatchUntil, observed))).pipe(
+                  // Close event-owned auxiliary work and release Attempt ownership before
+                  // failure rearming, while still holding the pass permit.
+                  Effect.onErrorIf(
+                    () => true,
+                    () => rearmFailure(observed),
+                  ),
                 ),
               ),
-            ),
-          );
+            )
+            .pipe(
+              hints.withHintsDeferred,
+              Effect.catchTags({
+                StorageOperationError: (error) => alarmFailure("defer maintenance wakes")(error),
+                InvalidScheduleConfigurationError: (error) =>
+                  alarmFailure("defer maintenance wakes")(error),
+              }),
+            );
         }).pipe(
           // Include permit waiting, recovery and acknowledgement in the event deadline.
           // Interruption releases Attempt ownership, leaving the prearmed dirty generation