@yielded/agent-platform-cloudflare 0.1.0-beta.173 → 0.1.0-beta.175

package/src/Alarm.ts

@@ -47,7 +47,7 @@ import { DurableObjectAlarm, DurableObjectStorage } from "effect-cf";
 import { SqlClient } from "effect/sql/SqlClient";
 import { SqlError, UnknownError } from "effect/sql/SqlError";
 
-import { DurableObjectContext } from "./CloudflareBindings.ts";
+import { DurableObjectContext, ThreadObjectPlacement } from "./CloudflareBindings.ts";
 import { AuxiliaryDispatchMillis, CloudflareDurableRuntimeConfig } from "./CloudflareConfig.ts";
 import { safeCauseMessage } from "./internal/boundary.ts";
 import * as DueQueue from "./internal/due-queue.ts";
@@ -283,7 +283,7 @@ const makeAlarmOperation = Effect.gen(function* () {
             reason: UnknownError.make({
               operation: "begin maintenance source transaction",
               message: "Use ThreadMutationGate.withTransaction at the outermost source transaction",
-              cause: new Error("Unwrapped SQL transaction cannot own buffered maintenance intent"),
+              cause: "Unwrapped SQL transaction cannot own buffered maintenance intent",
             }),
           }),
         );
@@ -294,8 +294,15 @@ const makeAlarmOperation = Effect.gen(function* () {
 
           return transaction(
             Effect.flatMap(Effect.serviceOption(sql.transactionService), (transaction) =>
-              Effect.sync(() => {
-                if (transaction._tag === "None") throw new Error("SQL transaction unavailable");
+              Effect.gen(function* () {
+                if (transaction._tag === "None")
+                  return yield* SqlError.make({
+                    reason: UnknownError.make({
+                      operation: "begin maintenance source transaction",
+                      message: "SQL transaction unavailable",
+                      cause: "SQL transaction unavailable",
+                    }),
+                  });
                 frame = queue.begin(transaction.value[1]);
               }),
             ).pipe(
@@ -334,9 +341,16 @@ const makeAlarmOperation = Effect.gen(function* () {
     operation: string,
     execute: (transaction: MaintenanceStorage, checkpoint: CheckpointIntent) => Promise<A>,
   ) => {
-    const commit = Effect.flatMap(CurrentCheckpoint, (tx) => {
+    const commit = Effect.withFiber((fiber) => {
+      const tx = fiber.getRef(CurrentCheckpoint);
+
       if (tx === undefined)
-        return Effect.die(new Error("Maintenance checkpoint transaction unavailable"));
+        return Effect.die(
+          DurableAlarmError.make({
+            operation: "checkpoint",
+            message: "Maintenance checkpoint transaction unavailable",
+          }),
+        );
 
       return tx.requireActive.pipe(
         Effect.andThen(
@@ -366,14 +380,14 @@ const makeAlarmOperation = Effect.gen(function* () {
       );
     });
 
-    return Effect.gen(function* () {
-      const current = yield* CurrentCheckpoint;
+    return Effect.withFiber((fiber) => {
+      const current = fiber.getRef(CurrentCheckpoint);
 
-      if (current !== undefined) return yield* commit;
-      const ambient = yield* Effect.serviceOption(sql.transactionService);
+      if (current !== undefined) return commit;
+      const ambient = Context.getOption(fiber.context, sql.transactionService);
 
       // Preserve eager writes and invalidation for an unwrapped host SQL transaction.
-      return yield* ambient._tag === "Some" && !DueQueue.buffering(ctx.storage)
+      return ambient._tag === "Some" && !DueQueue.buffering(ctx.storage)
         ? transaction(commit).pipe(
             Effect.ensuring(Effect.sync(() => DueQueue.invalidate(ctx.storage))),
           )
@@ -629,6 +643,7 @@ const decodeRecoveryFaultValue = Schema.decodeUnknownSync(ThreadRecoveryFault);
 const decodeRecoveryFault = (threadId: ThreadId, encoded: unknown) => {
   const fault = decodeRecoveryFaultValue(encoded);
 
+  // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Native Durable Object transaction decoder must abort before corrupt persisted data can be committed.
   if (fault.threadId !== threadId) throw new Error("Recovery status does not match its Thread key");
 
   return fault;
@@ -719,6 +734,25 @@ interface NativeDispatch {
   scanRevision?: number;
 }
 
+/** Observe already-owned waves without creating one waiter fiber for each wave. */
+const awaitAnyCompletion = Effect.fnUntraced(function* (
+  fibers: ReadonlyArray<Fiber.Fiber<unknown, MaintenancePassFailure>>,
+  revision: number,
+) {
+  const mutations = yield* ThreadMutationGate;
+
+  return yield* Effect.acquireUseRelease(
+    Effect.sync<Array<() => void>>(() => []),
+    (observers) =>
+      Effect.callback<"completed" | "scan">((resume) => {
+        observers.push(mutations.observeChange(revision, () => resume(Effect.succeed("scan"))));
+        for (const fiber of fibers)
+          observers.push(fiber.addObserver(() => resume(Effect.succeed("completed"))));
+      }),
+    (observers) => Effect.sync(() => observers.forEach((remove) => remove())),
+  );
+});
+
 /** Post-native delivery shares a finite connection budget across independent host lanes. */
 const afterNativeDispatchConcurrency = 2;
 
@@ -899,6 +933,8 @@ export class ThreadMutationGate extends Context.Service<
     readonly activeLanes: Effect.Effect<ReadonlySet<string>>;
     readonly revision: Effect.Effect<number>;
     readonly awaitChange: (revision: number) => Effect.Effect<void>;
+    /** Register an incarnation-local observer; its caller must detach it on completion. */
+    readonly observeChange: (revision: number, notify: () => void) => () => void;
     readonly withSnapshot: <A, E, R>(
       body: (active: number) => Effect.Effect<A, E, R>,
     ) => Effect.Effect<A, E, R>;
@@ -909,6 +945,8 @@ export class ThreadMutationGate extends Context.Service<
       const { ctx } = yield* DurableObjectContext;
       const sql = yield* SqlClient;
       const dueQueue = DueQueue.make(ctx.storage);
+      const placement = yield* Effect.serviceOption(ThreadObjectPlacement);
+      const singleThread = Option.isSome(placement) && placement.value.threadId !== undefined;
 
       const config = yield* CloudflareDurableRuntimeConfig;
       const failpoint = yield* ThreadMaintenanceFailpoint;
@@ -917,14 +955,27 @@ export class ThreadMutationGate extends Context.Service<
       const activeLanes = new Map<string, number>();
       const generationGate = yield* Semaphore.make(1);
       let revision = 0;
-      let changed = yield* Deferred.make<void>();
+      const listeners = new Set<() => void>();
+
+      const observeChange = (observed: number, listener: () => void): (() => void) => {
+        if (observed !== revision) {
+          listener();
 
-      const notify = Effect.gen(function* () {
-        const previous = changed;
+          return () => {};
+        }
+        listeners.add(listener);
 
-        changed = yield* Deferred.make<void>();
+        return () => {
+          listeners.delete(listener);
+        };
+      };
+
+      const notify = Effect.sync(() => {
         revision++;
-        yield* Deferred.succeed(previous, undefined);
+        const pending = [...listeners];
+
+        listeners.clear();
+        for (const listener of pending) listener();
       });
 
       const minimumAlarmDelay = Math.max(1, Math.ceil(config.alarmBackoffBase / 2));
@@ -1127,7 +1178,12 @@ export class ThreadMutationGate extends Context.Service<
         yield* runAlarmTransaction(
           "record maintenance producer progress",
           async (transaction, checkpoint) => {
-            for (const id of affected) dueQueue.dirty(id, now, true);
+            for (const id of affected) {
+              // Shared hosts need every revision to discover newly actionable sibling Threads.
+              if (singleThread && nativeSource && id === DueQueue.Native)
+                dueQueue.progressNative(now);
+              else dueQueue.dirty(id, now, true);
+            }
             if (affected.has(DueQueue.Native)) {
               const { state, initialized } = await readMaintenanceState(transaction);
 
@@ -1147,7 +1203,10 @@ export class ThreadMutationGate extends Context.Service<
             checkpoint.earlier(now + minimumAlarmDelay);
           },
         );
-        yield* notify;
+        // Maintenance already awaits this native fiber's completion. With one Thread,
+        // native-only progress cannot free another dispatch slot or enroll an auxiliary lane.
+        if (!(singleThread && nativeSource && affected.size === 1 && affected.has(DueQueue.Native)))
+          yield* notify;
       });
 
       return ThreadMutationGate.of({
@@ -1157,8 +1216,13 @@ export class ThreadMutationGate extends Context.Service<
         recordProgress,
         activeLanes: Effect.sync(() => new Set(activeLanes.keys())),
         revision: Effect.sync(() => revision),
+        observeChange,
         awaitChange: (observed) =>
-          Effect.suspend(() => (observed === revision ? Deferred.await(changed) : Effect.void)),
+          Effect.callback((resume) => {
+            const remove = observeChange(observed, () => resume(Effect.void));
+
+            return Effect.sync(remove);
+          }),
         withSnapshot: (body) =>
           generationGate.withPermit(Effect.flatMap(Ref.get(activeMutations), body)),
       });
@@ -1234,6 +1298,7 @@ export class ThreadMaintenance extends Context.Service<
       const runtime = yield* DurableAgentRuntime;
       const recoveryConfig = yield* DurableRuntimeConfig;
       const ledger = yield* SubmissionLedger;
+      const listNonterminal = ledger.listNonterminal ?? Stream.runCollect(ledger.scanNonterminal);
       const wakes = yield* WakeScheduler;
       const hints = yield* DurableAlarmService;
       const alarms = yield* ThreadMaintenanceAlarm;
@@ -1255,6 +1320,8 @@ export class ThreadMaintenance extends Context.Service<
       const messages = yield* ThreadMessageDelivery;
       const host = yield* ThreadHostMaintenance;
       const framework = yield* ThreadNativeMaintenance;
+      const placement = yield* Effect.serviceOption(ThreadObjectPlacement);
+      const nativeThread = Option.isSome(placement) ? placement.value.threadId : undefined;
 
       const nativeDispatchConcurrency = () => (framework.singleThreadRuntime === runtime ? 1 : 2);
 
@@ -1471,14 +1538,15 @@ export class ThreadMaintenance extends Context.Service<
           );
 
           for (let sequence = range.next; sequence <= range.through; sequence++) {
-            const event = yield* runTransaction("read recovery event", async () => {
-              const event = decodeRecoveryEvent(await ctx.storage.get(recoveryEventKey(sequence)));
-
-              if (event.sequence !== sequence)
-                throw new Error("Recovery event does not match its sequence key");
+            const event = yield* runTransaction("read recovery event", async () =>
+              decodeRecoveryEvent(await ctx.storage.get(recoveryEventKey(sequence))),
+            );
 
-              return event;
-            });
+            if (event.sequence !== sequence)
+              return yield* DurableAlarmError.make({
+                operation: "read recovery event",
+                message: "Recovery event does not match its sequence key",
+              });
 
             // No storage reservation or source mutation gate is held during host delivery.
             yield* recoveryEvents.publish(event);
@@ -1521,13 +1589,24 @@ export class ThreadMaintenance extends Context.Service<
         for (const report of result.reports) threads.set(report.threadId, undefined);
         for (const report of result.workReports ?? []) threads.set(report.threadId, undefined);
         for (const blocked of result.blocked) threads.set(blocked.threadId, blocked.failure);
-        if (threads.size === 0) return new Map<ThreadId, ThreadRecoveryFault>();
+
+        // This pass owns fault writes. Known absence needs no second transaction;
+        // blocked results and retained faults still commit their transitions.
+        if (
+          threads.size === 0 ||
+          [...threads].every(
+            ([threadId, failure]) =>
+              failure === undefined &&
+              recovery.loaded.has(threadId) &&
+              !recovery.faults.has(threadId),
+          )
+        )
+          return new Map<ThreadId, ThreadRecoveryFault>();
+
         const now = yield* Clock.currentTimeMillis;
 
         // Fault-only discovery uses control state even when retained payloads cannot decode.
-        const submissions =
-          current ??
-          (result.blocked.length === 0 ? [] : yield* Stream.runCollect(ledger.scanNonterminal));
+        const submissions = current ?? (result.blocked.length === 0 ? [] : yield* listNonterminal);
 
         yield* failpoint.hit("maintenance:recovery-status:before");
 
@@ -1625,34 +1704,42 @@ export class ThreadMaintenance extends Context.Service<
         threadId: ThreadId,
         recovery: NativeRecovery,
       ) {
-        let cursor = yield* runTransaction("read work recovery cursor", async () => {
-          const retained = await ctx.storage.get(workCursorKey(threadId));
-
-          if (retained === undefined) return undefined;
-          const decoded = Schema.decodeUnknownSync(NativeWorkCursor)(retained);
+        const retained = yield* runTransaction("read work recovery cursor", async () => {
+          const value = await ctx.storage.get(workCursorKey(threadId));
 
-          if (decoded.threadId !== threadId)
-            throw new Error("Work cursor belongs to another Thread");
-
-          return decoded.cursor;
+          return value === undefined
+            ? undefined
+            : Schema.decodeUnknownSync(NativeWorkCursor)(value);
         });
 
+        if (retained !== undefined && retained.threadId !== threadId)
+          return yield* DurableAlarmError.make({
+            operation: "read work recovery cursor",
+            message: "Work cursor belongs to another Thread",
+          });
+        let cursor = retained?.cursor;
+
         do {
           const result = yield* runtime
-            .runRecovery({ threadId, ...(cursor === undefined ? {} : { cursor }) })
+            .runRecovery({
+              threadId,
+              deferUnclaimedAdmissions: true,
+              ...(cursor === undefined ? {} : { cursor }),
+            })
             .pipe(Effect.provideService(CurrentNativeSource, true));
 
           // Persist each bounded pass before a claim; eviction resumes past consumed metadata.
           const faults = yield* recordRecoveryFaults(result, recovery, undefined, threadId);
 
-          yield* runTransaction("checkpoint work recovery cursor", async () => {
-            if (result.cursor === undefined) await ctx.storage.delete(workCursorKey(threadId));
-            else
-              await ctx.storage.put(
-                workCursorKey(threadId),
-                Schema.encodeSync(NativeWorkCursor)({ threadId, cursor: result.cursor }),
-              );
-          });
+          if (cursor !== undefined || result.cursor !== undefined)
+            yield* runTransaction("checkpoint work recovery cursor", async () => {
+              if (result.cursor === undefined) await ctx.storage.delete(workCursorKey(threadId));
+              else
+                await ctx.storage.put(
+                  workCursorKey(threadId),
+                  Schema.encodeSync(NativeWorkCursor)({ threadId, cursor: result.cursor }),
+                );
+            });
           for (const report of result.reports) recovery.reports.set(report.submissionId, report);
           recovery.faults.delete(threadId);
           for (const [id, fault] of faults) recovery.faults.set(id, fault);
@@ -2081,19 +2168,31 @@ export class ThreadMaintenance extends Context.Service<
 
             return {
               scannedGeneration: state.dirty,
-              afterWorkThread: state.lastRecoveredThreadId,
+              // Single-Thread placement would immediately wrap past its own cursor.
+              afterWorkThread:
+                framework.singleThreadRuntime === runtime &&
+                state.lastRecoveredThreadId === nativeThread
+                  ? undefined
+                  : state.lastRecoveredThreadId,
             };
           },
         );
 
-        const current = yield* Stream.runCollect(ledger.scanNonterminal);
-
-        let workOwners = yield* runtime
-          .discoverWorkThreads({
-            limit: 32,
-            ...(afterWorkThread === undefined ? {} : { afterThreadId: afterWorkThread }),
-          })
-          .pipe(Effect.provideService(CurrentNativeSource, true));
+        const current = yield* listNonterminal;
+
+        // A current admission proves this native placement is materialized. Empty Objects
+        // still discover retained canonical obligations without inventing a recovery owner.
+        let workOwners =
+          framework.singleThreadRuntime === runtime &&
+          nativeThread !== undefined &&
+          current.some((submission) => submission.threadId === nativeThread)
+            ? { threadIds: [nativeThread], afterThreadId: undefined }
+            : yield* runtime
+                .discoverWorkThreads({
+                  limit: 32,
+                  ...(afterWorkThread === undefined ? {} : { afterThreadId: afterWorkThread }),
+                })
+                .pipe(Effect.provideService(CurrentNativeSource, true));
 
         if (workOwners.threadIds.length === 0 && afterWorkThread !== undefined)
           workOwners = yield* runtime
@@ -2277,7 +2376,7 @@ export class ThreadMaintenance extends Context.Service<
 
             const next = selected.at(-1);
 
-            if (next !== undefined) {
+            if (next !== undefined && next !== state.lastServedThreadId) {
               await transaction.put(
                 MAINTENANCE_STATE_KEY,
                 encodeMaintenanceState(
@@ -2355,7 +2454,7 @@ export class ThreadMaintenance extends Context.Service<
           };
         }
 
-        const remaining = yield* Stream.runCollect(ledger.scanNonterminal);
+        const remaining = yield* listNonterminal;
         const waitingHeads = new Map<ThreadId, boolean>();
 
         // Selected recovery must finish before its generation can be acknowledged: terminal
@@ -2522,12 +2621,22 @@ export class ThreadMaintenance extends Context.Service<
         dispatchUntil: DateTime.Utc,
         observed: MaintenanceObservation,
       ) {
+        const leanSelection =
+          framework.singleThreadRuntime === runtime &&
+          publication === emptyPublication &&
+          host.lanes.length === 0 &&
+          framework.lanes.length === 0;
+
         // Subscribe before the first snapshot. Durable enrollment recovers eviction;
         // producer completion and wake hints make work visible during this incarnation.
-        const notified = (yield* Stream.toPull(wakes.wakes)).pipe(
-          Effect.asVoid,
-          Effect.catch(() => Effect.never),
-        );
+        // Native source mutations already notify the revision waiter below. A replacement
+        // or shared runtime keeps the generic wake stream; hints confer no authority.
+        const notified = leanSelection
+          ? Effect.never
+          : (yield* Stream.toPull(wakes.wakes)).pipe(
+              Effect.asVoid,
+              Effect.catch(() => Effect.never),
+            );
 
         // A wake may observe temporary backoff while this event's recovery is still running.
         // Its completion must retain the original actionable observation for acknowledgement.
@@ -2579,56 +2688,8 @@ export class ThreadMaintenance extends Context.Service<
           discoveryPending: false,
         };
 
-        const recoveryFiber = yield* fork(
-          Effect.gen(function* () {
-            for (const threadId of yield* Deferred.await(recovery.queue)) {
-              yield* failpoint.hit("maintenance:select:before");
-              yield* runTransaction("select old recovery lane", () =>
-                dueQueue.transaction(async (transaction) => {
-                  const { state } = await readMaintenanceState(transaction);
-
-                  await transaction.put(
-                    MAINTENANCE_STATE_KEY,
-                    encodeMaintenanceState(
-                      ThreadMaintenanceState.make({
-                        ...state,
-                        lastRecoveredThreadId: threadId,
-                      }),
-                    ),
-                  );
-                }),
-              );
-              yield* failpoint.hit("maintenance:select:after");
-              yield* recoverThread(threadId, recovery);
-              recovery.pending.delete(threadId);
-              if (!recovery.faults.has(threadId)) yield* wakes.notify(threadId);
-            }
-          }),
-        );
-
-        // Backfill is one disposable wave; native and host work keep their own opportunities.
-        const backfill = yield* fork(
-          Effect.gen(function* () {
-            if ((yield* mutations.activeLanes).has(DueQueue.Projection)) return;
-            const row = (yield* queueSnapshot).find((row) => row.id === DueQueue.Projection);
-
-            if (
-              row?.dueAt === null ||
-              row === undefined ||
-              row.dueAt > (yield* Clock.currentTimeMillis)
-            )
-              return;
-
-            return yield* runQueued(
-              row,
-              projection.drain.pipe(Effect.andThen(projection.pendingDeadline)),
-              observed,
-            ).pipe(Effect.timeoutOption(config.projectionDispatchTimeoutMillis));
-          }),
-        );
-
-        let backfillObserved = false;
-        let recoveryObserved = false;
+        let recoveryFiber: Fiber.Fiber<void, MaintenancePassFailure> | undefined;
+        let backfill: Fiber.Fiber<void, DurableAlarmError | ThreadProjectionError> | undefined;
 
         const dispatch: NativeDispatch = {
           scope: auxiliaryScope,
@@ -2640,18 +2701,79 @@ export class ThreadMaintenance extends Context.Service<
           needsCheckpoint: false,
         };
 
-        let native: Fiber.Fiber<NativePassResult, MaintenancePassFailure> | undefined = yield* fork(
-          advance(started, yieldAfter, observed, recovery, dispatch),
-        );
+        // Selection is bounded local work, not an independently owned wave. It opens
+        // actual Attempt scopes, then returns; empty lanes create no fibers.
+        let native: Fiber.Fiber<NativePassResult, MaintenancePassFailure> | undefined;
+        let result: NativePassResult;
+        let backlog: ReadonlyArray<ThreadId> | undefined;
 
-        let result: NativePassResult = {
-          phase: "caught-up",
-          nonterminal: started.nonterminal,
-          nextAttemptAt: undefined,
-        };
+        if (leanSelection) {
+          result = yield* advance(started, yieldAfter, observed, recovery, dispatch);
+          recovery.started = true;
+          yield* Deferred.succeed(recovery.queue, []);
+          backlog = yield* Deferred.await(recovery.queue);
+        } else {
+          // Required publication and arbitrary host lanes keep independent opportunities
+          // while selection is suspended in an application callback.
+          native = yield* fork(advance(started, yieldAfter, observed, recovery, dispatch));
+          result = {
+            phase: "caught-up",
+            nonterminal: started.nonterminal,
+            nextAttemptAt: undefined,
+          };
+        }
+
+        if (backlog === undefined || backlog.length > 0) {
+          recoveryFiber = yield* fork(
+            Effect.gen(function* () {
+              for (const threadId of backlog ?? (yield* Deferred.await(recovery.queue))) {
+                yield* failpoint.hit("maintenance:select:before");
+                yield* runTransaction("select old recovery lane", () =>
+                  dueQueue.transaction(async (transaction) => {
+                    const { state } = await readMaintenanceState(transaction);
+
+                    await transaction.put(
+                      MAINTENANCE_STATE_KEY,
+                      encodeMaintenanceState(
+                        ThreadMaintenanceState.make({
+                          ...state,
+                          lastRecoveredThreadId: threadId,
+                        }),
+                      ),
+                    );
+                  }),
+                );
+                yield* failpoint.hit("maintenance:select:after");
+                yield* recoverThread(threadId, recovery);
+                recovery.pending.delete(threadId);
+                if (!recovery.faults.has(threadId)) yield* wakes.notify(threadId);
+              }
+            }),
+          );
+        }
+        const projectionRow = (yield* queueSnapshot).find((row) => row.id === DueQueue.Projection);
+
+        if (
+          projectionRow !== undefined &&
+          projectionRow.dueAt !== null &&
+          projectionRow.dueAt <= (yield* Clock.currentTimeMillis) &&
+          !(yield* mutations.activeLanes).has(DueQueue.Projection)
+        ) {
+          backfill = yield* fork(
+            runQueued(
+              projectionRow,
+              projection.drain.pipe(Effect.andThen(projection.pendingDeadline)),
+              observed,
+            ).pipe(Effect.timeoutOption(config.projectionDispatchTimeoutMillis), Effect.asVoid),
+          );
+        }
 
         let phase = result.phase;
-        let nativeCheck = false;
+
+        let nativeCheck =
+          result.dispatched === true && dispatch.active.size < nativeDispatchConcurrency();
+
+        observed.nativeOnly = dispatch.active.size > 0;
         const until = DateTime.toEpochMillis(yieldAfter);
         const dispatchEnd = DateTime.toEpochMillis(dispatchUntil);
 
@@ -2682,19 +2804,17 @@ export class ThreadMaintenance extends Context.Service<
             if (exit.value === 0) dispatch.deferred.add(threadId);
             nativeCheck = true;
           }
-          if (!recoveryObserved && recoveryFiber.pollUnsafe() !== undefined) {
+          if (recoveryFiber?.pollUnsafe() !== undefined) {
             yield* Fiber.join(recoveryFiber);
-            recoveryObserved = true;
+            recoveryFiber = undefined;
             dispatch.scanGeneration = undefined;
             nativeCheck ||= recovery.needsCheckpoint;
           }
-          if (!backfillObserved) {
-            const exit = backfill.pollUnsafe();
+          const backfillExit = backfill?.pollUnsafe();
 
-            if (exit !== undefined) {
-              backfillObserved = true;
-              if (Exit.isFailure(exit)) failure ??= exit.cause;
-            }
+          if (backfillExit !== undefined) {
+            backfill = undefined;
+            if (Exit.isFailure(backfillExit)) failure ??= backfillExit.cause;
           }
           for (const lane of lanes) {
             const exit = lane.fiber?.pollUnsafe();
@@ -2801,9 +2921,9 @@ export class ThreadMaintenance extends Context.Service<
           if (
             native === undefined &&
             dispatch.active.size === 0 &&
-            recoveryObserved &&
+            recoveryFiber === undefined &&
             !recovery.needsCheckpoint &&
-            backfillObserved &&
+            backfill === undefined &&
             delivery === undefined &&
             lanes.every((lane) => lane.fiber === undefined)
           )
@@ -2816,7 +2936,9 @@ export class ThreadMaintenance extends Context.Service<
           ) {
             nativeCheck = false;
             const nativeCheckpoint = dispatch.needsCheckpoint && dispatch.active.size === 0;
-            const checkpoint = (recoveryObserved && recovery.needsCheckpoint) || nativeCheckpoint;
+
+            const checkpoint =
+              (recoveryFiber === undefined && recovery.needsCheckpoint) || nativeCheckpoint;
 
             if (checkpoint) recovery.needsCheckpoint = false;
             // Keep this opportunity's reservations across beginNative's storage awaits.
@@ -2851,26 +2973,39 @@ export class ThreadMaintenance extends Context.Service<
           );
 
           const completing = [
-            ...(native === undefined ? [] : [native]),
+            native,
             ...dispatch.active.values(),
-            ...(recoveryObserved ? [] : [recoveryFiber]),
-            ...(backfillObserved ? [] : [backfill]),
-            ...(delivery === undefined ? [] : [delivery]),
-            ...lanes.flatMap((lane) => (lane.fiber === undefined ? [] : [lane.fiber])),
-          ];
-
-          const ready = yield* Effect.raceAllFirst([
-            ...completing.map((fiber) =>
-              Fiber.await<unknown, MaintenancePassFailure>(fiber).pipe(
-                Effect.as("completed" as const),
-              ),
-            ),
-            Effect.raceAllFirst([
-              notified,
-              mutations.awaitChange(queueRevision),
-              Effect.sleep(Math.max(0, next - now)),
-            ]).pipe(Effect.as("scan" as const)),
-          ]);
+            recoveryFiber,
+            backfill,
+            delivery,
+            ...lanes.map((lane) => lane.fiber),
+          ].filter((fiber) => fiber !== undefined);
+
+          const changed = awaitAnyCompletion(completing, queueRevision);
+
+          // An occupied native-only slot cannot admit another Attempt. With no auxiliary
+          // wake before yield, the timer would only switch to joining that same Attempt.
+          // Incoming work still wakes this callback; all new waves recheck the deadline.
+          const joiningNative =
+            leanSelection &&
+            native === undefined &&
+            dispatch.active.size === 1 &&
+            completing.length === 1 &&
+            !queued.some(
+              (row) =>
+                row.id !== DueQueue.Native &&
+                row.dueAt !== null &&
+                row.dueAt > now &&
+                row.dueAt < until,
+            );
+
+          const ready = yield* joiningNative
+            ? changed
+            : Effect.raceAllFirst([
+                changed,
+                ...(leanSelection ? [] : [notified.pipe(Effect.as("scan" as const))]),
+                Effect.sleep(Math.max(0, next - now)).pipe(Effect.as("scan" as const)),
+              ]);
 
           if (ready === "scan") {
             nativeCheck = true;
@@ -2896,9 +3031,10 @@ export class ThreadMaintenance extends Context.Service<
         for (const fiber of [
           recoveryFiber,
           backfill,
-          ...(delivery === undefined ? [] : [delivery]),
-          ...lanes.flatMap((lane) => (lane.fiber === undefined ? [] : [lane.fiber])),
+          delivery,
+          ...lanes.map((lane) => lane.fiber),
         ]) {
+          if (fiber === undefined) continue;
           // Await exits without failing fast: every admitted wave owns its original
           // bounded allowance and cleanup even if another wave has already failed.
           const exit = yield* Fiber.await<unknown, MaintenancePassFailure>(fiber);
@@ -2921,7 +3057,9 @@ export class ThreadMaintenance extends Context.Service<
         observed: MaintenanceObservation,
       ): Effect.fn.Return<MaintenancePassReport, MaintenancePassFailure, Scope.Scope> {
         const concurrent = yield* Effect.exit(
-          Effect.scoped(dispatch(yieldAfter, dispatchUntil, observed)),
+          Effect.scoped(dispatch(yieldAfter, dispatchUntil, observed)).pipe(
+            Effect.provideService(ThreadMutationGate, mutations),
+          ),
         );
 
         // Closing the concurrent scope first releases every native Attempt and its resources.