experimental-a2 0.21.1 → 0.22.0

package/src/store-redis-core.ts

@@ -9,7 +9,14 @@
  * entries are immutable; dispatch bookkeeping lives on consumer cursors.
  * Every write path is one atomic Lua script.
  *
- * The cursor layout, per session `{p}:{s}:`:
+ * Every key of a session is `{p}:{"<session id as JSON>"}:<name>`, one hash
+ * tag per session (`redisSessionKey`). Each script declares keys of one
+ * session only and derives the rest, so on Upstash a script that sets
+ * `allow-key-locking` locks only its session instead of the database. Redis
+ * and Valkey reject that flag, so the store asks the server once whether it
+ * accepts it.
+ *
+ * The cursor layout, per session:
  *
  * - `heads:{chunk}` holds one row per (head index, consumer) in hashes of
  *   META_CHUNK_SIZE consecutive indexes: a head's attempt and failure
@@ -31,27 +38,26 @@
  * log cursor records are reset lazily against the marker and swept by
  * reclaim.
  *
- * `{p}:schema` records the layout, and a prefix holding another one is
- * rejected. A session from before cursors (0.17 to 0.20) opens as is: its
- * log, counter, clear marker, snapshots, and ids read the same, and its
- * dispatch keys (`meta`, `meta:{chunk}`, `meta-split`, `pending`, `ready`,
- * `snapshot-pins:{index}`, `snapshot-pin-counts`) share no name with the
- * cursor layout's, so they're never read. Its unfinished work is dropped.
+ * `{p}:schema` records the layout. A store claims it once, before its first
+ * script, and refuses a prefix holding another. Keys of an unrecorded layout
+ * have other names, so they are never read.
  *
- * Global event-id ownership is one key per id, so no key grows with the
- * number of sessions. The conformance suite in test/conformance is the
- * executable contract, run against a real spawned `redis-server`.
+ * Event ids are unique per session: `id:{event id}` holds the index an id
+ * names, and leaves with its session. The conformance suite in
+ * test/conformance is the executable contract, run against a real spawned
+ * `redis-server`, and over REST behind a shim that applies Upstash's
+ * key-locking rules.
  *
  * Timestamps and claim expiry come from the injected clock so tests can
- * time-travel against a real server. Cluster mode is out: the atomic
- * scripts span keys.
+ * time-travel against a real server.
  */
 
 import type { PresencePatch } from './contract.ts'
 import { A2Error, supersededAttemptError } from './errors.ts'
 import { CLEAR_EVENT_TYPE, sessionClearedError } from './session-clear.ts'
 import { idempotentReplay } from './idempotent-replay.ts'
-import { nullProtoRecord } from './internal.ts'
+import { NOTIFY_TIMINGS, nullProtoRecord } from './internal.ts'
+import { retryableLazy } from './retryable-lazy.ts'
 import { decodeCause } from './store-codec.ts'
 import type { SerializedEvent } from './stream-buffer.ts'
 import type {
@@ -102,9 +108,9 @@ export type RedisStreamRead = (options: {
 export type RedisStoreCore = Omit<A2Store, 'stream' | 'presence'> & {
   /**
    * The storage half of the presence capability, shared by both
-   * transports. `set` returns the applied patch for local loopback,
-   * or null when every field lost the LWW race. The script publishes
-   * the applied fields for remote subscribers.
+   * transports. `set` returns the applied patch for local loopback, with
+   * the publish to remote subscribers already under way, or null when
+   * every field lost the LWW race.
    */
   presence: {
     set(
@@ -112,9 +118,14 @@ export type RedisStoreCore = Omit<A2Store, 'stream' | 'presence'> & {
       participant: string,
       values: Record<string, unknown | null>,
       meta: { seen: number; at: Date; ttlMs: number },
-    ): Promise<PresencePatch | null>
+    ): Promise<{ patch: PresencePatch; published: Promise<void> } | null>
     read(ns: string): Promise<PresenceRow[]>
   }
+  /**
+   * The latest clear marker's index, or 0. Entries below it are an old
+   * lifetime's until reclaim deletes them, so a feed starts no lower.
+   */
+  clearIndex(sessionId: string): Promise<number>
   /** XRANGE pages — the full-row catch-up read. */
   readRange(
     sessionId: string,
@@ -140,7 +151,8 @@ export type RedisStoreCore = Omit<A2Store, 'stream' | 'presence'> & {
   }) => AsyncGenerator<SerializedEvent[], void>
   /**
    * Events from `fromIndex` through `throughIndex` or the newest entry in
-   * one newest-first page, or null when the range doesn't fit in one.
+   * one newest-first page, or null when the range doesn't fit in one or
+   * starts below the latest clear.
    */
   readTail(
     sessionId: string,
@@ -154,8 +166,16 @@ export const FEED_PAGE_SIZE = 1000
 const READ_CONCURRENCY = 16
 
 /** The key layout this core writes; any other is rejected. */
-export const REDIS_LAYOUT = 'cursors-2'
-const LAYOUT_ERROR = 'A2_LAYOUT'
+export const REDIS_LAYOUT = 'tagged-1'
+
+/**
+ * Upstash runs a script under a database-wide lock unless it opts into
+ * locking only its keys' hash tags. Redis and Valkey reject the flag, and
+ * have no such lock to opt out of: one thread runs every command.
+ */
+const KEY_LOCKING = '#!lua flags=allow-key-locking'
+const READ_ONLY_KEY_LOCKING = '#!lua flags=no-writes,allow-key-locking'
+const SHEBANG_REJECTED = /shebang|unexpected symbol near '#'/i
 
 const META_CHUNK_SIZE = 1000
 
@@ -165,16 +185,11 @@ const HEAD_COLUMNS = `{ 'd', 'fc', 'lc', 'ch', 'ce', 'a', 'lf', 'lfa', 'e', 'f'
 // ── Lua scripts (each runs atomically) ───────────────────────────────
 
 /**
- * Upstash bills every call a script makes, so scripts read the counter,
- * clear marker, layout, typed-type index, and id keys with one MGET
- * (`read_bounds`), read rows with one HMGET per chunk (`read_rows`), and
- * buffer hash writes (`put`, `drop`) into one HSET and one HDEL per hash
- * (`flush`). Buffered writes are invisible to reads until flushed, so a
- * script must not read a field it has buffered. Every script binds KEYS[1]
- * to the session's counter and KEYS[2] to the prefix's layout key, and
- * derives the session's other keys.
+ * Issues a variadic command in calls of at most 1000 arguments, since Lua's
+ * `unpack` is bounded by its stack, and concatenates table replies. An even
+ * slice size keeps HSET's field/value pairs together.
  */
-const BASE_LUA = `
+const SLICED_LUA = `
 local function sliced(command, key, args)
   local results = {}
   for first = 1, #args, 1000 do
@@ -191,32 +206,56 @@ local function sliced(command, key, args)
   end
   return results
 end
-local COUNTER, SCHEMA = KEYS[1], KEYS[2]
+`
+
+/**
+ * Upstash bills every call a script makes, so scripts read the counter,
+ * clear marker, typed-type index, and event-id owners with one MGET
+ * (`read_bounds`), read rows with one HMGET per chunk
+ * (`read_rows`), and buffer hash writes (`put`, `drop`) into one HSET and
+ * one HDEL per hash (`flush`). Buffered writes are invisible to reads until
+ * flushed, so a script must not read a field it has buffered. Every script
+ * binds KEYS[1] to the session's counter and derives the session's other
+ * keys, which share its hash tag.
+ */
+const BASE_LUA = `${SLICED_LUA}
+local COUNTER = KEYS[1]
 local SESSION = string.sub(COUNTER, 1, -6)
 local LOG, CLEAR = SESSION .. 'log', SESSION .. 'clear'
 local META, READY, CURSORS = SESSION .. 'heads', SESSION .. 'runnable', SESSION .. 'cursors'
 local PIN_COUNTS, TYPED = SESSION .. 'pins', SESSION .. 'typed'
 local CLEAR_TYPE = '${CLEAR_EVENT_TYPE}'
-local total, boundary, schema_missing = 0, 0, false
+local total, boundary = 0, 0
 -- The event types typed log cursors read: type → { from, last }. The type's
 -- index holds every event of it above \`from\`, and no event of it lies above
 -- \`last\`.
 local typed, typed_dirty = {}, false
--- Reads the counter, the latest clear marker, the layout, the typed types,
--- and the extra keys in one MGET. Returns the extra keys' values, or nil when
--- the prefix holds another layout.
-local function read_bounds(extra)
-  local keys = { COUNTER, CLEAR, SCHEMA, TYPED }
-  for _, key in ipairs(extra or {}) do keys[#keys + 1] = key end
+-- One key per event id holds the index it names in this session. The
+-- \`id:\` namespace keeps a raw id from spelling another session key.
+local function id_key(id) return SESSION .. 'id:' .. id end
+-- Reads the counter, the latest clear marker, the typed types, and the
+-- owners of \`ids\` in one MGET. Returns each id's index, or false.
+local function read_bounds(ids)
+  local keys = { COUNTER, CLEAR, TYPED }
+  for _, id in ipairs(ids or {}) do keys[#keys + 1] = id_key(id) end
   local values = sliced('MGET', nil, keys)
-  if values[3] and values[3] ~= '${REDIS_LAYOUT}' then return nil end
-  total = tonumber(values[1] or '0')
+  total = tonumber(values[1] or values[2] or '0')
   boundary = tonumber(values[2] or '0')
-  schema_missing = not values[3]
-  if values[4] then typed = cjson.decode(values[4]) end
-  local rest = {}
-  for i = 5, #keys do rest[i - 4] = values[i] end
-  return rest
+  if values[3] then typed = cjson.decode(values[3]) end
+  local owners = {}
+  for i = 4, #keys do owners[i - 3] = values[i] end
+  return owners
+end
+-- Event-id owners from read_bounds: an id recorded below the latest clear
+-- is free.
+local function owners_of(values)
+  local owners = {}
+  for i = 1, #values do
+    local owner = values[i]
+    if owner and tonumber(owner) < boundary then owner = false end
+    owners[i] = owner
+  end
+  return owners
 end
 local function entry_index(id) return tonumber(string.match(id, '^(%d+)')) end
 local function cid_of(consumer, tag)
@@ -662,82 +701,28 @@ local function enqueue(batch)
     state.dirty = true
   end
 end
--- Event-id owners for the extra keys read_bounds returned. A record this
--- session made below its latest clear is free.
-local function owners_of(values, session)
-  local owners = {}
-  for i = 1, #values do
-    local owner = values[i]
-    if owner then
-      local rec = cjson.decode(owner)
-      if rec[1] == session and tonumber(rec[2]) < boundary then owner = false end
-    end
-    owners[i] = owner
-  end
-  return owners
-end
 `
 
-const WAKE_PAYLOAD_LIMIT = 32_768
-
 /**
- * Wake-up messages carry the events they announce, so a subscribed reader
- * that is caught up applies them without reading the stream:
- * `{"f":frontier,"t":createdAt,"e":[[index,id,type,payload],...]}`. Payloads
- * are the stored JSON text, inlined verbatim. A batch over
- * WAKE_PAYLOAD_LIMIT bytes publishes `{"f":frontier}` and readers catch up
- * with XRANGE.
- */
-const WAKE_LUA = `
-local wake_entries, wake_bytes = {}, 0
-local function wake_add(field, id, typ, payload)
-  if wake_bytes + #payload > ${WAKE_PAYLOAD_LIMIT} then
-    wake_bytes = ${WAKE_PAYLOAD_LIMIT} + 1
-    return
-  end
-  local entry = '[' .. field .. ',' .. cjson.encode(id) .. ',' ..
-    cjson.encode(typ) .. ',' .. payload .. ']'
-  wake_bytes = wake_bytes + #entry + 1
-  if wake_bytes <= ${WAKE_PAYLOAD_LIMIT} then
-    wake_entries[#wake_entries + 1] = entry
-  end
-end
-local function wake(channel, frontier, created_at)
-  local message = '{"f":' .. frontier .. '}'
-  if wake_bytes <= ${WAKE_PAYLOAD_LIMIT} then
-    message = '{"f":' .. frontier .. ',"t":' .. created_at .. ',"e":[' ..
-      table.concat(wake_entries, ',') .. ']}'
-  end
-  redis.pcall('PUBLISH', channel, message)
-end
-`
-
-/**
- * KEYS: counter, layout, then one id ownership key per event.
- * ARGV: sessionId, nowMs, n, served consumers, notify channel, origin index
- * or '', then per event: id, type, payloadJson, causeJson or '', targets.
+ * KEYS: counter.
+ * ARGV: sessionId, nowMs, n, served consumers, origin index or '', then per
+ * event: id, type, payloadJson, causeJson or '', targets.
  * Returns ['empty', hasPending] | ['ok', firstIndex, hasPending] |
  * ['dup', hasPending, ...indexes] | ['partial', count] |
- * ['foreign', eventId] | ['superseded', position] | ['cleared', originIndex] |
+ * ['superseded', position] | ['cleared', originIndex] |
  * ['index', type, after].
  */
-const APPEND_LUA = `${BASE_LUA}${CURSOR_LUA}${WAKE_LUA}
-local session_id, now, n = ARGV[1], ARGV[2], tonumber(ARGV[3])
+const APPEND_LUA = `${BASE_LUA}${CURSOR_LUA}
+local now, n = ARGV[2], tonumber(ARGV[3])
 use_served(ARGV[4])
 if n == 0 then return { 'empty', has_pending() } end
-local id_keys = {}
-for i = 1, n do id_keys[i] = KEYS[2 + i] end
-local values = read_bounds(id_keys)
-if not values then return redis.error_reply('${LAYOUT_ERROR}') end
-local owners = owners_of(values, session_id)
+local ids = {}
+for i = 1, n do ids[i] = ARGV[5 + (i - 1) * 5 + 1] end
+local owners = owners_of(read_bounds(ids))
 local base = total
 local dups = {}
 for i = 1, n do
-  if owners[i] then
-    local rec = cjson.decode(owners[i])
-    if rec[1] ~= session_id then return { 'foreign', ARGV[6 + (i - 1) * 5 + 1] } end
-    dups[#dups + 1] = tostring(rec[2])
-  end
+  if owners[i] then dups[#dups + 1] = owners[i] end
 end
 if #dups == n then
   local res = { 'dup', has_pending() }
@@ -745,13 +730,13 @@ if #dups == n then
   return res
 end
 if #dups > 0 then return { 'partial', tostring(#dups) } end
-local origin = ARGV[6]
+local origin = ARGV[5]
 if origin ~= '' and tonumber(origin) <= boundary then return { 'cleared', origin } end
 -- The attempt-currency fence: a cause's head row must still be its cursor's
 -- head, at that attempt, not dead-lettered.
 local refs, fenced = {}, {}
 for i = 1, n do
-  local raw = ARGV[6 + (i - 1) * 5 + 4]
+  local raw = ARGV[5 + (i - 1) * 5 + 4]
   if raw ~= '' then
     local cause = cjson.decode(raw)
     local index = tonumber(cause.index)
@@ -773,60 +758,55 @@ for k, cause in ipairs(fenced) do
 end
 local batch = {}
 for i = 1, n do
-  local o = 6 + (i - 1) * 5
+  local o = 5 + (i - 1) * 5
   batch[i] = { idx = base + i, type = ARGV[o + 2], targets = targets_of(ARGV[o + 5]) }
 end
 local planned, missing, after = plan(batch, base)
 if not planned then return { 'index', missing, tostring(after) } end
-local owner_writes = {}
+local marks = {}
 for i = 1, n do
-  local o = 6 + (i - 1) * 5
+  local o = 5 + (i - 1) * 5
   local field = tostring(base + i)
   redis.call('XADD', LOG, field .. '-0',
     'id', ARGV[o + 1], 'type', ARGV[o + 2], 'payload', ARGV[o + 3],
     'created_at', now, 'cause', ARGV[o + 4])
-  owner_writes[#owner_writes + 1] = KEYS[2 + i]
-  owner_writes[#owner_writes + 1] = cjson.encode({ session_id, base + i })
-  wake_add(field, ARGV[o + 1], ARGV[o + 2], ARGV[o + 3])
+  marks[#marks + 1] = id_key(ARGV[o + 1])
+  marks[#marks + 1] = field
 end
 index_batch(batch)
 enqueue(batch)
-owner_writes[#owner_writes + 1] = COUNTER
-owner_writes[#owner_writes + 1] = tostring(base + n)
-if schema_missing then
-  owner_writes[#owner_writes + 1] = SCHEMA
-  owner_writes[#owner_writes + 1] = '${REDIS_LAYOUT}'
-end
+marks[#marks + 1] = COUNTER
+marks[#marks + 1] = tostring(base + n)
 if typed_dirty then
-  owner_writes[#owner_writes + 1] = TYPED
-  owner_writes[#owner_writes + 1] = cjson.encode(typed)
+  marks[#marks + 1] = TYPED
+  marks[#marks + 1] = cjson.encode(typed)
 end
-sliced('MSET', nil, owner_writes)
+sliced('MSET', nil, marks)
 flush_states()
 flush()
 flush_ready()
-local pending = has_pending()
-wake(ARGV[5], tostring(base + n), now)
-return { 'ok', tostring(base + 1), pending }
+return { 'ok', tostring(base + 1), has_pending() }
 `
 
 /**
- * KEYS: counter, layout.
+ * KEYS: counter.
  * ARGV: type, after. Indexes one page of the stored log below the type's
  * index, toward `after`, registering the type first if no cursor read it
  * yet. Returns ['1'] once the index reaches `after`, else ['0'].
  */
 const INDEX_TYPE_LUA = `${BASE_LUA}
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
+read_bounds()
 local name, after = ARGV[1], tonumber(ARGV[2])
 local entry = typed[name]
 if not entry then
   entry = { total, total }
   typed[name] = entry
 end
-if entry[1] > after then
+-- Entries below the latest clear belong to an old lifetime: never indexed.
+local floor = math.max(after, boundary - 1)
+if entry[1] > floor then
   local entries = redis.call('XREVRANGE', LOG, tostring(entry[1]) .. '-0',
-    tostring(after + 1) .. '-0', 'COUNT', ${READ_PAGE_SIZE})
+    tostring(floor + 1) .. '-0', 'COUNT', ${READ_PAGE_SIZE})
   local adds = {}
   for _, stored in ipairs(entries) do
     local fields = stored[2]
@@ -847,13 +827,15 @@ if entry[1] > after then
   else
     entry[1] = entry_index(entries[#entries][1]) - 1
   end
+elseif entry[1] > after then
+  entry[1] = after
 end
 redis.call('SET', TYPED, cjson.encode(typed))
 return { entry[1] <= after and '1' or '0' }
 `
 
 /**
- * KEYS: counter, layout.
+ * KEYS: counter.
  * ARGV: holder, nowMs, expiresAtMs, maxFailures or '', served consumers,
  * the highest head to claim or '', excluded count, then per excluded head:
  * consumer, tag.
@@ -863,7 +845,7 @@ return { entry[1] <= after and '1' or '0' }
 const CLAIM_AVAILABLE_LUA = `${BASE_LUA}${CURSOR_LUA}
 local ready = redis.call('ZRANGEBYSCORE', READY, 1, ARGV[6] == '' and '+inf' or ARGV[6], 'WITHSCORES')
 if #ready == 0 then return { 'settled' } end
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
+read_bounds()
 local holder, now, expires_at = ARGV[1], tonumber(ARGV[2]), ARGV[3]
 local max_failures = tonumber(ARGV[4])
 use_served(ARGV[5])
@@ -957,13 +939,13 @@ return result
 `
 
 /**
- * KEYS: counter, layout.
+ * KEYS: counter.
  * ARGV: holder, nowMs, expiresAtMs, n, then per claim: consumer, tag, index,
  * attempt. Returns [renewedCount, ...renewed, ...superseded] as 1-based
  * positions in the request.
  */
 const RENEW_CLAIMS_LUA = `${BASE_LUA}
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
+read_bounds()
 local holder, now, expires_at = ARGV[1], tonumber(ARGV[2]), ARGV[3]
 local refs, items, superseded = {}, {}, {}
 for i = 1, tonumber(ARGV[4]) do
@@ -1000,21 +982,19 @@ return result
 `
 
 /**
- * KEYS: counter, layout, then one id ownership key per child.
+ * KEYS: counter.
  * ARGV: sessionId, nowMs, consumer, tag, index, attempt, child causeJson,
- * served consumers, notify channel, returned idsJson, n, then per child: id,
- * type, payloadJson, targets.
+ * served consumers, returned idsJson, n, then per child: id, type,
+ * payloadJson, targets.
  */
-const COMPLETE_ATTEMPT_LUA = `${BASE_LUA}${CURSOR_LUA}${WAKE_LUA}
-local session_id, now = ARGV[1], ARGV[2]
+const COMPLETE_ATTEMPT_LUA = `${BASE_LUA}${CURSOR_LUA}
+local now = ARGV[2]
 local consumer, tag, idx, attempt = ARGV[3], ARGV[4], tonumber(ARGV[5]), tonumber(ARGV[6])
 local at = row_of(consumer, tag)
-local n = tonumber(ARGV[11])
-local id_keys = {}
-for i = 1, n do id_keys[i] = KEYS[2 + i] end
-local values = read_bounds(id_keys)
-if not values then return redis.error_reply('${LAYOUT_ERROR}') end
-local owners = owners_of(values, session_id)
+local n = tonumber(ARGV[10])
+local ids = {}
+for i = 1, n do ids[i] = ARGV[10 + (i - 1) * 4 + 1] end
+local owners = owners_of(read_bounds(ids))
 if idx <= boundary then return { 'superseded' } end
 if idx < 1 or idx > total then return { 'missing' } end
 local row = read_rows({ { idx, at } }, { 'd', 'p', 'pa', 'ri', 'ch', 'f', 'l', 'next', 'pins' })[1]
@@ -1025,14 +1005,12 @@ if row[2] then
   local recorded = cjson.decode(row[4] or '[]')
   if #recorded ~= n then return { 'partial' } end
   for i = 1, n do
-    if recorded[i] ~= ARGV[11 + (i - 1) * 4 + 1] then return { 'partial' } end
+    if recorded[i] ~= ARGV[10 + (i - 1) * 4 + 1] then return { 'partial' } end
   end
   local result = { 'duplicate' }
   for i = 1, n do
     if not owners[i] then return { 'partial' } end
-    local rec = cjson.decode(owners[i])
-    if rec[1] ~= session_id then return { 'partial' } end
-    result[#result + 1] = tostring(rec[2])
+    result[#result + 1] = owners[i]
   end
   return result
 end
@@ -1045,7 +1023,7 @@ end
 use_served(ARGV[8])
 local batch = {}
 for i = 1, n do
-  local o = 11 + (i - 1) * 4
+  local o = 10 + (i - 1) * 4
   batch[i] = { idx = total + i, type = ARGV[o + 2], targets = targets_of(ARGV[o + 4]) }
 end
 local moved, missing = advance(consumer, row[7], idx, row[8], batch)
@@ -1054,48 +1032,42 @@ local planned, unindexed, after = plan(batch, total)
 if not planned then return { 'index', unindexed, tostring(after) } end
 put_row(idx, at, 'p', now)
 put_row(idx, at, 'pa', ARGV[6])
-put_row(idx, at, 'ri', ARGV[10])
+put_row(idx, at, 'ri', ARGV[9])
 release_pins(idx, at, row[9])
-local owner_writes = {}
+local marks = {}
 for i = 1, n do
-  local o = 11 + (i - 1) * 4
+  local o = 10 + (i - 1) * 4
   local field = tostring(total + i)
   redis.call('XADD', LOG, field .. '-0',
     'id', ARGV[o + 1], 'type', ARGV[o + 2], 'payload', ARGV[o + 3],
     'created_at', now, 'cause', ARGV[7])
-  owner_writes[#owner_writes + 1] = KEYS[2 + i]
-  owner_writes[#owner_writes + 1] = cjson.encode({ session_id, total + i })
-  wake_add(field, ARGV[o + 1], ARGV[o + 2], ARGV[o + 3])
+  marks[#marks + 1] = id_key(ARGV[o + 1])
+  marks[#marks + 1] = field
 end
 index_batch(batch)
 enqueue(batch)
 if n > 0 then
-  owner_writes[#owner_writes + 1] = COUNTER
-  owner_writes[#owner_writes + 1] = tostring(total + n)
-  if schema_missing then
-    owner_writes[#owner_writes + 1] = SCHEMA
-    owner_writes[#owner_writes + 1] = '${REDIS_LAYOUT}'
-  end
+  marks[#marks + 1] = COUNTER
+  marks[#marks + 1] = tostring(total + n)
 end
 if typed_dirty then
-  owner_writes[#owner_writes + 1] = TYPED
-  owner_writes[#owner_writes + 1] = cjson.encode(typed)
+  marks[#marks + 1] = TYPED
+  marks[#marks + 1] = cjson.encode(typed)
 end
-sliced('MSET', nil, owner_writes)
+sliced('MSET', nil, marks)
 flush_states()
 flush()
 flush_ready()
-if n > 0 then wake(ARGV[9], tostring(total + n), now) end
 return { 'ok', tostring(total + 1) }
 `
 
 /**
- * KEYS: counter, layout.
+ * KEYS: counter.
  * ARGV: consumer, tag, index, attempt, error, maxFailures, nowMs, retryAtMs
  * or ''.
  */
 const FAIL_ATTEMPT_LUA = `${BASE_LUA}
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
+read_bounds()
 local consumer, tag, idx, attempt = ARGV[1], ARGV[2], tonumber(ARGV[3]), tonumber(ARGV[4])
 local at = row_of(consumer, tag)
 if idx <= boundary then return { 'superseded', '0' } end
@@ -1132,13 +1104,13 @@ return { dead and 'dead_lettered' or 'failed', tostring(failures) }
 `
 
 /**
- * KEYS: counter, layout. ARGV: consumer, index, action, nowMs, served
+ * KEYS: counter. ARGV: consumer, index, action, nowMs, served
  * consumers. Returns [redriven, hasPending] | ['index', type, after]. Acts
  * only on the consumer's dead-lettered head at the index, above the clear
  * marker.
  */
 const REDRIVE_LUA = `${BASE_LUA}${CURSOR_LUA}
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
+read_bounds()
 use_served(ARGV[5])
 local consumer, idx = ARGV[1], tonumber(ARGV[2])
 local function result(redriven) return { redriven, has_pending() } end
@@ -1172,7 +1144,7 @@ return result('1')
 `
 
 /**
- * KEYS: counter, layout. ARGV: consumer, lane, types JSON or '*', backfill
+ * KEYS: counter. ARGV: consumer, lane, types JSON or '*', backfill
  * ('1' or '0'). Brings one log cursor up to date without an append, as
  * `plan` and `enqueue` would for an append carrying its types: a missing
  * cursor starts at the clear marker with backfill, else at the head with
@@ -1182,7 +1154,7 @@ return result('1')
  * columns, session head] | ['index', type, after].
  */
 const WAKE_LOG_LUA = `${BASE_LUA}${CURSOR_LUA}
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
+read_bounds()
 local consumer, lane, ty = ARGV[1], ARGV[2], ARGV[3]
 local types = types_of(ty)
 local cid = cid_of(consumer, 'G' .. lane)
@@ -1228,13 +1200,13 @@ return { 'ok', tostring(state.p), state.h and tostring(state.h) or false, column
 `
 
 /**
- * KEYS: counter, layout. Returns the dead-lettered heads above the clear
+ * KEYS: counter. Returns the dead-lettered heads above the clear
  * marker as [consumer, tag, index, columns, entry] tuples.
  */
 const DEAD_LETTERS_LUA = `${BASE_LUA}
 local dead = redis.call('ZRANGEBYSCORE', READY, '-inf', '(0', 'WITHSCORES')
 if #dead == 0 then return {} end
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
+read_bounds()
 local refs, items = {}, {}
 for i = 1, #dead, 2 do
   local consumer, tag = parse_cid(dead[i])
@@ -1256,12 +1228,12 @@ return result
 `
 
 /**
- * KEYS: counter, layout. Returns every listed cursor as [consumer, tag,
+ * KEYS: counter. Returns every listed cursor as [consumer, tag,
  * position, head or nil, columns]: lane and log cursors from the cursor
  * hash, read against the clear marker, then the event cursors with a head.
  */
 const CURSORS_LUA = `${BASE_LUA}
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
+read_bounds()
 local listed = {}
 local fields = redis.call('HGETALL', CURSORS)
 local records, order = {}, {}
@@ -1315,7 +1287,7 @@ return result
 `
 
 /**
- * KEYS: counter, layout, head, history.
+ * KEYS: counter, head, history.
  * ARGV: write count, then per write: index, snapshot JSON, pin count, then
  * per pin: consumer, tag, index; finally the reducer name. Writes from
  * before the latest clear are dropped, and a head from before it is
@@ -1323,8 +1295,8 @@ return result
  * claimed row says so itself, an unclaimed head by its cursor's ready score.
  */
 const PUT_SNAPSHOTS_LUA = `${BASE_LUA}
-if not read_bounds() then return redis.error_reply('${LAYOUT_ERROR}') end
-local HEAD, HISTORY = KEYS[3], KEYS[4]
+read_bounds()
+local HEAD, HISTORY = KEYS[2], KEYS[3]
 local entries, refs, pins = {}, {}, {}
 local offset = 2
 for w = 1, tonumber(ARGV[1]) do
@@ -1440,79 +1412,78 @@ return 1
 `
 
 /**
- * KEYS: presence hash. ARGV: atMs, ttlMs, n, then per entry:
- * hashField, valueJson ('' deletes), patchFieldJson; finally channel and
- * message prefix. Wire fragments stay JSON text to preserve arrays
- * and numeric precision through Lua. Field-wise LWW by the sender's
- * `at`: a stored entry with a strictly newer stamp survives; ties go
- * to the incoming write (memory-tier parity). Returns the applied
- * 1-based entry positions. The whole-key PEXPIRE is the coarse bound,
- * sound because core sends one uniform ttlMs; the per-entry `e` stamp
- * is the fine bound (the injected storage clock at the applied set
- * plus ttlMs — never the sender stamp), pruned on read against the
- * same clock.
+ * Presence entries are `{"a":at,"e":expiresAt,"s":seen,"v":value}`, stamps
+ * first and both integers, so scripts read them with a pattern instead of
+ * decoding the value.
  */
-const PRESENCE_SET_LUA = `
-local at = tonumber(ARGV[1])
-local applied = {}
-local published = {}
-local n = tonumber(ARGV[3])
+const PRESENCE_STAMPS_LUA = `
+local function stamps(entry)
+  local a, e = string.match(entry, '^{"a":(%-?%d+),"e":(%-?%d+),')
+  return tonumber(a), tonumber(e)
+end
+`
+
+/**
+ * KEYS: presence hash. ARGV: atMs, ttlMs, nowMs, n, then per entry:
+ * hashField, entryJson (a null value is a tombstone). Field-wise LWW by the
+ * sender's `at`: an unexpired stored entry with a strictly newer stamp
+ * survives; ties go to the incoming write (memory-tier parity). Returns the applied 1-based entry
+ * positions. The whole-key PEXPIRE is the coarse bound, sound because core
+ * sends one uniform ttlMs; the per-entry `e` stamp is the fine bound (the
+ * injected storage clock at the applied set plus ttlMs — never the sender
+ * stamp), filtered on read against the same clock.
+ */
+const PRESENCE_SET_LUA = `${SLICED_LUA}${PRESENCE_STAMPS_LUA}
+local at, now, n = tonumber(ARGV[1]), tonumber(ARGV[3]), tonumber(ARGV[4])
+local fields = {}
+for i = 1, n do fields[i] = ARGV[4 + (i - 1) * 2 + 1] end
+local stored = sliced('HMGET', KEYS[1], fields)
+local applied, sets = {}, {}
 for i = 1, n do
-  local field = ARGV[3 + (i - 1) * 3 + 1]
-  local value = ARGV[3 + (i - 1) * 3 + 2]
-  local existing = redis.call('HGET', KEYS[1], field)
-  if not existing or tonumber(cjson.decode(existing)['a']) <= at then
-    if value == '' then
-      redis.call('HDEL', KEYS[1], field)
-    else
-      redis.call('HSET', KEYS[1], field, value)
-    end
+  local a, e = false, false
+  if stored[i] then a, e = stamps(stored[i]) end
+  if not stored[i] or a <= at or e <= now then
+    sets[#sets + 1] = fields[i]
+    sets[#sets + 1] = ARGV[4 + (i - 1) * 2 + 2]
     applied[#applied + 1] = tostring(i)
-    published[#published + 1] = ARGV[3 + (i - 1) * 3 + 3]
   end
 end
-if #applied > 0 then
-  redis.call('PEXPIRE', KEYS[1], ARGV[2])
-  redis.pcall('PUBLISH', ARGV[4 + n * 3], ARGV[5 + n * 3] .. table.concat(published, ',') .. '}}')
-end
+sliced('HSET', KEYS[1], sets)
+if #applied > 0 then redis.call('PEXPIRE', KEYS[1], ARGV[2]) end
 return applied
 `
 
 /**
- * KEYS: presence hash. ARGV: nowMs (the injected clock, so tests can
- * time-travel expiry against a real server). Returns the live
- * [field, value, ...] pairs; entries at or past their fine-bound
- * expiry are HDELed in the same atomic step, so a stale reader can
- * never sweep a concurrently refreshed field.
+ * KEYS: presence hash. ARGV: nowMs, then the fields a read saw expired.
+ * Deletes those still at or past their expiry, re-checked in this atomic
+ * step so a stale reader never sweeps a concurrently refreshed field.
  */
-const PRESENCE_READ_LUA = `
+const PRESENCE_PRUNE_LUA = `${SLICED_LUA}${PRESENCE_STAMPS_LUA}
 local now = tonumber(ARGV[1])
-local rows = redis.call('HGETALL', KEYS[1])
-local live = {}
-for i = 1, #rows, 2 do
-  if tonumber(cjson.decode(rows[i + 1])['e']) <= now then
-    redis.call('HDEL', KEYS[1], rows[i])
-  else
-    live[#live + 1] = rows[i]
-    live[#live + 1] = rows[i + 1]
+local fields = {}
+for i = 2, #ARGV do fields[#fields + 1] = ARGV[i] end
+local stored = sliced('HMGET', KEYS[1], fields)
+local stale = {}
+for i = 1, #fields do
+  if stored[i] then
+    local _, e = stamps(stored[i])
+    if e <= now then stale[#stale + 1] = fields[i] end
   end
 end
-return live
+sliced('HDEL', KEYS[1], stale)
+return 1
 `
 
 /**
- * KEYS: counter, layout, head, history. ARGV: snapshot frontier or ''.
+ * KEYS: counter, head, history. ARGV: snapshot frontier or ''.
  * Returns one atomic multiversion-cache-plus-log-frontier read, with the
  * clear boundary; checkpoints from before it are ignored.
  */
 const READ_STATE_LUA = `
 local session = string.sub(KEYS[1], 1, -6)
-local counts = redis.call('MGET', KEYS[1], session .. 'clear', KEYS[2])
-if counts[3] and counts[3] ~= '${REDIS_LAYOUT}' then
-  return redis.error_reply('${LAYOUT_ERROR}')
-end
+local counts = redis.call('MGET', KEYS[1], session .. 'clear')
 local boundary = tonumber(counts[2] or '0')
-local head = redis.call('GET', KEYS[3])
+local head = redis.call('GET', KEYS[2])
 local head_index = head and cjson.decode(head)['index'] or nil
 if head and (type(head_index) ~= 'number' or head_index < 0 or head_index > 9007199254740991 or head_index ~= math.floor(head_index)) then
   return redis.error_reply('invalid snapshot head index')
@@ -1527,19 +1498,25 @@ if head_index and (cap == '' or head_index <= tonumber(cap)) then
   snapshot = head
 else
   local upper = cap == '' and '+inf' or cap
-  local historical = redis.call('ZREVRANGEBYSCORE', KEYS[4], upper, boundary, 'LIMIT', 0, 1)
+  local historical = redis.call('ZREVRANGEBYSCORE', KEYS[3], upper, boundary, 'LIMIT', 0, 1)
   if #historical > 0 then snapshot = historical[1] end
 end
-return { head_index or '', snapshot or '', counts[1] or '0', tostring(boundary) }
+return { head_index or '', snapshot or '', counts[1] or counts[2] or '0', tostring(boundary) }
 `
 
 /**
- * What reclaim removes once a session has no moved log left: every
+ * What reclaim removes once no entry is left below the latest clear: every
  * registered reducer's checkpoints below the latest clear and the pin counts
  * naming them (snapshot writes register each reducer in
  * {prefix}:{session}:snap-reducers, so no key scan is needed), every head
  * row below it (whole chunks, then the boundary chunk's older rows), the
  * type indexes' older entries, and the lane cursors it left idle.
+ *
+ * A lifetime that ended empty then collapses to the clear marker, the log
+ * holding it (readers resuming before the marker still read it), and the log
+ * cursors the sweep reset to the marker. The counter reads from the marker
+ * when absent, type indexes rebuild lazily, and the marker's own id key goes
+ * too.
  */
 const SWEEP_LUA = `
 local function sweep(boundary)
@@ -1606,23 +1583,46 @@ local function sweep(boundary)
   end
   sliced('HDEL', CURSORS, idle)
   sliced('HSET', CURSORS, moved)
+  local count = redis.call('GET', COUNTER)
+  if not count or tonumber(count) ~= boundary or redis.call('ZCARD', READY) > 0 then
+    return
+  end
+  local stale = { COUNTER, TYPED, PIN_COUNTS, chunk_key(boundary) }
+  local reducers = SESSION .. 'snap-reducers'
+  for _, reducer in ipairs(redis.call('SMEMBERS', reducers)) do
+    stale[#stale + 1] = SESSION .. 'snap:' .. reducer
+    stale[#stale + 1] = SESSION .. 'snap-history:' .. reducer
+  end
+  stale[#stale + 1] = reducers
+  local types = redis.call('GET', TYPED)
+  if types then
+    for name in pairs(cjson.decode(types)) do stale[#stale + 1] = type_key(name) end
+  end
+  local marker = redis.call('XRANGE', LOG, boundary .. '-0', boundary .. '-0')[1]
+  if marker then
+    for i = 1, #marker[2], 2 do
+      if marker[2][i] == 'id' then stale[#stale + 1] = id_key(marker[2][i + 1]) end
+    end
+  end
+  sliced('UNLINK', nil, stale)
 end
 `
 
 /**
- * KEYS: counter, layout, marker id ownership key.
+ * KEYS: counter.
  * ARGV: sessionId, nowMs, ifLastIndex or '', cause consumer or '', cause tag,
- * cause index, cause attempt, marker id, notify channel.
- * Returns ['ok', cleared, head, boundary] | ['superseded'] | ['foreign'].
- * The old lifetime's log moves aside in one RENAME, so every read of the log
- * starts at the marker, and its ready set is unlinked, so claims and pending
- * checks see only the new lifetime; deletion drains the moved log. Type
- * indexes keep their older entries until then: lookups start above the
- * marker.
+ * cause index, cause attempt, marker id.
+ * Returns ['ok', cleared, head, boundary, appended?] | ['superseded'] |
+ * ['foreign']; `appended` is '1' when this call appended the marker.
+ * The marker joins the same log: the old lifetime's entries stay below it
+ * until reclaim deletes them, and every read of the log starts at the
+ * marker. (A stream can't be renamed aside: Upstash refuses RENAME on one.)
+ * The ready set is unlinked, so claims and pending checks see only the new
+ * lifetime. Type indexes keep their older entries until reclaim too:
+ * lookups start above the marker.
  */
-const CLEAR_LUA = `${BASE_LUA}${WAKE_LUA}
-local values = read_bounds({ KEYS[3] })
-if not values then return redis.error_reply('${LAYOUT_ERROR}') end
+const CLEAR_LUA = `${BASE_LUA}
+local marker_owner = owners_of(read_bounds({ ARGV[8] }))[1]
 local head = total
 if ARGV[4] ~= '' then
   local idx = tonumber(ARGV[6])
@@ -1642,61 +1642,47 @@ end
 if head == 0 or boundary == head then
   return { 'ok', '1', tostring(head), tostring(boundary) }
 end
-if values[1] then return { 'foreign' } end
+if marker_owner then return { 'foreign' } end
 local field = tostring(head + 1)
-local moved = SESSION .. 'cleared:' .. field
-redis.call('RENAME', LOG, moved)
 redis.call('UNLINK', READY)
-redis.call('SADD', SESSION .. 'cleared', moved)
 redis.call('XADD', LOG, field .. '-0',
   'id', ARGV[8], 'type', CLEAR_TYPE, 'payload', 'null',
   'created_at', ARGV[2], 'cause', '')
-local marker = { KEYS[3], cjson.encode({ ARGV[1], head + 1 }), COUNTER, field, CLEAR, field }
-if schema_missing then
-  marker[#marker + 1] = SCHEMA
-  marker[#marker + 1] = '${REDIS_LAYOUT}'
-end
-redis.call('MSET', unpack(marker))
-wake_add(field, ARGV[8], CLEAR_TYPE, 'null')
-wake(ARGV[9], field, ARGV[2])
-return { 'ok', '1', field, field }
+redis.call('MSET', id_key(ARGV[8]), field, COUNTER, field, CLEAR, field)
+return { 'ok', '1', field, field, '1' }
 `
 
 /**
- * KEYS: counter, layout. ARGV: page size.
- * The next deletion batch: a moved log and up to a page of its [index, id]
- * pairs, without payloads. Empty moved logs are dropped; with none left it
- * sweeps what the old lifetime left and returns nothing, so a retry
- * finishes an interrupted deletion.
+ * KEYS: counter. ARGV: page size.
+ * The next deletion batch: up to a page of [index, id] pairs of the log's
+ * entries below the latest clear. With none left it sweeps what the old
+ * lifetimes left and returns nothing, so a retry finishes an interrupted
+ * deletion.
  */
 const RECLAIM_BATCH_LUA = `${BASE_LUA}${SWEEP_LUA}
 local boundary = tonumber(redis.call('GET', CLEAR) or '0')
 if boundary == 0 then return {} end
-for _, log in ipairs(redis.call('SMEMBERS', SESSION .. 'cleared')) do
-  local entries = redis.call('XRANGE', log, '-', '+', 'COUNT', ARGV[1])
-  if #entries > 0 then
-    local batch = { log }
-    for _, entry in ipairs(entries) do
-      local fields = entry[2]
-      for i = 1, #fields, 2 do
-        if fields[i] == 'id' then
-          batch[#batch + 1] = string.match(entry[1], '^(%d+)')
-          batch[#batch + 1] = fields[i + 1]
-          break
-        end
-      end
+local entries = redis.call('XRANGE', LOG, '-', tostring(boundary - 1) .. '-0', 'COUNT', ARGV[1])
+if #entries == 0 then
+  sweep(boundary)
+  return {}
+end
+local batch = {}
+for _, entry in ipairs(entries) do
+  local fields = entry[2]
+  for i = 1, #fields, 2 do
+    if fields[i] == 'id' then
+      batch[#batch + 1] = string.match(entry[1], '^(%d+)')
+      batch[#batch + 1] = fields[i + 1]
+      break
     end
-    return batch
   end
-  redis.call('DEL', log)
-  redis.call('SREM', SESSION .. 'cleared', log)
 end
-sweep(boundary)
-return {}
+return batch
 `
 
 /**
- * KEYS: counter, layout, moved log, then one id ownership key per entry.
+ * KEYS: counter.
  * ARGV: sessionId, n, then per entry: index, id.
  * Deletes the listed entries below the latest clear and their id records.
  * An id record survives when it names another event, so an id reused in the
@@ -1704,45 +1690,70 @@ return {}
  */
 const RECLAIM_LUA = `${BASE_LUA}${SWEEP_LUA}
 local boundary = tonumber(redis.call('GET', CLEAR) or '0')
-local MOVED = KEYS[3]
-local id_keys, indexes, stream_ids = {}, {}, {}
+local ids, indexes, stream_ids = {}, {}, {}
 -- A concurrent reclaim may list the same batch; only XDEL says who removed it.
 local removed = 0
 for i = 1, tonumber(ARGV[2]) do
   local field = ARGV[2 + (i - 1) * 2 + 1]
   if tonumber(field) < boundary then
-    id_keys[#id_keys + 1] = KEYS[3 + i]
-    indexes[#id_keys] = tonumber(field)
-    stream_ids[#id_keys] = field .. '-0'
-  end
-end
-if #id_keys > 0 then
-  local owners, stale_ids = sliced('MGET', nil, id_keys), {}
-  for i = 1, #id_keys do
-    if owners[i] then
-      local rec = cjson.decode(owners[i])
-      if rec[1] == ARGV[1] and tonumber(rec[2]) == indexes[i] then
-        stale_ids[#stale_ids + 1] = id_keys[i]
-      end
+    ids[#ids + 1] = ARGV[2 + (i - 1) * 2 + 2]
+    indexes[#ids] = tonumber(field)
+    stream_ids[#ids] = field .. '-0'
+  end
+end
+if #ids > 0 then
+  local keys = {}
+  for i = 1, #ids do keys[i] = id_key(ids[i]) end
+  local owners, stale = sliced('MGET', nil, keys), {}
+  for i = 1, #ids do
+    if owners[i] and tonumber(owners[i]) == indexes[i] then
+      stale[#stale + 1] = keys[i]
     end
   end
-  sliced('DEL', nil, stale_ids)
-  removed = redis.call('XDEL', MOVED, unpack(stream_ids))
+  sliced('DEL', nil, stale)
+  removed = redis.call('XDEL', LOG, unpack(stream_ids))
 end
 local done = 0
-if redis.call('XLEN', MOVED) == 0 then
-  redis.call('DEL', MOVED)
-  redis.call('SREM', SESSION .. 'cleared', MOVED)
-  if redis.call('SCARD', SESSION .. 'cleared') == 0 then
-    sweep(boundary)
-    done = 1
-  end
+if #redis.call('XRANGE', LOG, '-', tostring(boundary - 1) .. '-0', 'COUNT', 1) == 0 then
+  sweep(boundary)
+  done = 1
 end
 return { removed, done }
 `
 
 // ── wire helpers ─────────────────────────────────────────────────────
 
+const WAKE_PAYLOAD_LIMIT = 32_768
+const encoder = new TextEncoder()
+
+/**
+ * A wake-up announcing events through `frontier`. It carries them, so a
+ * caught-up reader applies them without reading the stream:
+ * `{"f":frontier,"t":createdAt,"e":[[index,id,type,payload],...]}`, with
+ * payloads inlined as their stored JSON text. One over WAKE_PAYLOAD_LIMIT
+ * bytes, or one without entries, announces only `{"f":frontier}`, and
+ * readers catch up with XRANGE.
+ */
+const wakeMessage = (
+  frontier: number,
+  createdAt: number,
+  entries: ReadonlyArray<
+    readonly [index: number, id: string, type: string, payloadJson: string]
+  >,
+): string => {
+  const bare = `{"f":${frontier}}`
+  if (entries.length === 0) return bare
+  const carried = `{"f":${frontier},"t":${createdAt},"e":[${entries
+    .map(
+      ([index, id, type, payload]) =>
+        `[${index},${JSON.stringify(id)},${JSON.stringify(type)},${payload}]`,
+    )
+    .join(',')}]}`
+  return encoder.encode(carried).byteLength > WAKE_PAYLOAD_LIMIT
+    ? bare
+    : carried
+}
+
 export type StreamEntry = [id: string, fields: string[]]
 
 const fieldMap = (fields: string[]): Record<string, string> => {
@@ -2000,9 +2011,9 @@ const toIndex = ({
 }
 
 /**
- * A range read that met a gap. A clear moves the old lifetime's log aside, so
- * a read whose bounds predate it finds nothing where it expected events;
- * anywhere else a gap is corruption.
+ * A range read that met a gap. Reclaim deletes the entries below a clear, so
+ * a read whose bounds predate the clear finds nothing where it expected
+ * events; anywhere else a gap is corruption.
  */
 const rangeGap = (sessionId: string, message: string): A2Error =>
   Object.assign(
@@ -2042,29 +2053,49 @@ const wrap = async <T>(fn: () => Promise<T>): Promise<T> => {
   }
 }
 
+/**
+ * A session's key. Every key of a session shares one hash tag, so a script
+ * locks only its session on Upstash and stays in one slot on a cluster. The
+ * tag is the session id as JSON with its braces escaped: it can't end early,
+ * and no session's tag spells another's.
+ */
+export const redisSessionKey = ({
+  prefix,
+  sessionId,
+  suffix,
+}: {
+  prefix: string
+  sessionId: string
+  suffix: string
+}): string =>
+  `${prefix}:{${JSON.stringify(sessionId).replaceAll('{', '\\u007b').replaceAll('}', '\\u007d')}}:${suffix}`
+
 export function createRedisStoreCore(
   options: RedisStoreCoreOptions,
 ): RedisStoreCore {
   const { call, callBytes, clock } = options
   const generateId = options.ids
   const prefix = options.keyPrefix
+  if (prefix.includes('{') || prefix.includes('}')) {
+    throw new TypeError(
+      'a redis keyPrefix cannot contain braces: they would set the hash tag of every key',
+    )
+  }
 
-  const storeKey = (s: string): string => `${prefix}:${s}:log`
-  const countKey = (s: string): string => `${prefix}:${s}:count`
+  const sessionKey = (sessionId: string, suffix: string): string =>
+    redisSessionKey({ prefix, sessionId, suffix })
+  const storeKey = (s: string): string => sessionKey(s, 'log')
+  const countKey = (s: string): string => sessionKey(s, 'count')
   // Scripts derive the session's other keys from the counter; keep them in step.
-  const clearKey = (s: string): string => `${prefix}:${s}:clear`
+  const clearKey = (s: string): string => sessionKey(s, 'clear')
   const schemaKey = `${prefix}:schema`
-  const snapKey = (s: string, r: string): string => `${prefix}:${s}:snap:${r}`
+  const snapKey = (s: string, r: string): string => sessionKey(s, `snap:${r}`)
   const snapHistoryKey = (s: string, r: string): string =>
-    `${prefix}:${s}:snap-history:${r}`
-  const presenceKey = (s: string): string => `${prefix}:${s}:presence`
+    sessionKey(s, `snap-history:${r}`)
+  const presenceKey = (s: string): string => sessionKey(s, 'presence')
+  // Channels aren't keys; the notify store subscribes by these names.
   const notifyChannel = (s: string): string => `${prefix}:${s}:notify`
-  // One ownership key per event id; reclaim deletes those naming cleared events.
-  // Session ids are raw and may contain colons, so a raw id could name a
-  // session key (`ids:count`). A JSON string with escaped colons starts with
-  // a quote and has no colon, so it never matches a session key's suffix.
-  const idKey = (id: string): string =>
-    `${prefix}:ids:${JSON.stringify(id).replaceAll(':', '\\u003a')}`
+  const presenceChannel = (s: string): string => `${prefix}:${s}:presence`
 
   const layoutError = (): A2Error =>
     new A2Error(
@@ -2072,21 +2103,80 @@ export function createRedisStoreCore(
       `the redis keys under prefix '${prefix}' hold an A2 layout other than '${REDIS_LAYOUT}', from another release; point the store at a fresh keyPrefix, or give the contract a new name so it starts new sessions`,
     )
 
-  /** Runs a script over a session: KEYS start with its counter and the layout key. */
-  const evalScript = async (
+  /**
+   * Once per store, before its first script: claim or check the prefix's
+   * layout, and ask the server whether scripts may lock only their keys.
+   * Only the server's own rejection of the flag means no; a transport error
+   * fails this attempt, and the next operation asks again.
+   */
+  const prepared = retryableLazy(async () => {
+    const [, keyLocking] = await Promise.all([
+      (async () => {
+        await call('SET', schemaKey, REDIS_LAYOUT, 'NX')
+        if ((await call('GET', schemaKey)) !== REDIS_LAYOUT) throw layoutError()
+      })(),
+      call('EVAL', `${KEY_LOCKING}\nreturn 1`, 1, schemaKey).then(
+        () => true,
+        (error: unknown) => {
+          if (SHEBANG_REJECTED.test(String((error as Error)?.message)))
+            return false
+          throw error
+        },
+      ),
+    ])
+    return { keyLocking }
+  })
+
+  /** Runs a script; a `readOnly` one takes Upstash's shared lock. */
+  const runScript = async ({
+    script,
+    keys,
+    args,
+    readOnly,
+  }: {
+    script: string
+    keys: string[]
+    args: Array<string | number>
+    readOnly: boolean
+  }): Promise<unknown> => {
+    const { keyLocking } = await prepared.get()
+    let source = script
+    if (keyLocking)
+      source = `${readOnly ? READ_ONLY_KEY_LOCKING : KEY_LOCKING}\n${script}`
+    return call('EVAL', source, keys.length, ...keys, ...args)
+  }
+
+  /** Runs a writing script over a session: KEYS start with its counter. */
+  const evalScript = (
     script: string,
     sessionId: string,
     keys: string[],
     args: Array<string | number>,
-  ): Promise<unknown> => {
-    const allKeys = [countKey(sessionId), schemaKey, ...keys]
-    try {
-      return await call('EVAL', script, allKeys.length, ...allKeys, ...args)
-    } catch (error) {
-      if (String((error as Error)?.message).includes(LAYOUT_ERROR))
-        throw layoutError()
-      throw error
-    }
+  ): Promise<unknown> =>
+    runScript({
+      script,
+      keys: [countKey(sessionId), ...keys],
+      args,
+      readOnly: false,
+    })
+
+  /**
+   * Publishes a write's wake-up after its script, never inside it: a script
+   * holds its lock while PUBLISH waits on subscribers. Wake-ups are hints (a
+   * lost one costs subscribers a catch-up read, never an event), so a failed
+   * publish is dropped and the write waits for it at most
+   * NOTIFY_TIMINGS.publishMs.
+   */
+  const publish = async (channel: string, message: string): Promise<void> => {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    await Promise.race([
+      call('PUBLISH', channel, message).catch(() => undefined),
+      new Promise<void>((resolve) => {
+        timer = setTimeout(resolve, NOTIFY_TIMINGS.publishMs)
+        ;(timer as { unref?: () => void }).unref?.()
+      }),
+    ])
+    clearTimeout(timer)
   }
 
   /**
@@ -2115,25 +2205,36 @@ export function createRedisStoreCore(
     }
   }
 
-  /** The frontier and clear marker, checking the layout in the same MGET. */
+  /** The frontier and clear marker, in one MGET. */
   const readBounds = async (
     sessionId: string,
   ): Promise<{ frontier: number; clearIndex: number }> => {
-    const [count, cleared, schema] = (await call(
+    await prepared.get()
+    const [count, cleared] = (await call(
       'MGET',
       countKey(sessionId),
       clearKey(sessionId),
-      schemaKey,
-    )) as [unknown, unknown, unknown]
-    if (schema !== null && schema !== undefined && schema !== REDIS_LAYOUT) {
-      throw layoutError()
-    }
+    )) as [unknown, unknown]
     return {
-      frontier: toIndex({ raw: count, sessionId, name: 'event count' }),
+      // A collapsed session keeps only its clear marker.
+      frontier: toIndex({
+        raw: count ?? cleared,
+        sessionId,
+        name: 'event count',
+      }),
       clearIndex: toIndex({ raw: cleared, sessionId, name: 'clear boundary' }),
     }
   }
 
+  const readClearIndex = async (sessionId: string): Promise<number> => {
+    await prepared.get()
+    return toIndex({
+      raw: await call('GET', clearKey(sessionId)),
+      sessionId,
+      name: 'clear boundary',
+    })
+  }
+
   const readEventPages = async (
     sessionId: string,
     afterIndex: number,
@@ -2314,22 +2415,22 @@ export function createRedisStoreCore(
           cause: e.cause ? { ...e.cause } : null,
           targets: e.targets,
         }))
+        const payloads = withIds.map((e) => json(e.payload))
         const reply = (await indexing(sessionId, () =>
           evalScript(
             APPEND_LUA,
             sessionId,
-            withIds.map((e) => idKey(e.id)),
+            [],
             [
               sessionId,
               now,
               withIds.length,
               servedArg(appendOptions?.consumers),
-              notifyChannel(sessionId),
               appendOptions?.originIndex ?? '',
-              ...withIds.flatMap((e) => [
+              ...withIds.flatMap((e, i) => [
                 e.id,
                 e.type,
-                json(e.payload),
+                payloads[i]!,
                 e.cause ? json(e.cause) : '',
                 targetsArg(e.targets),
               ]),
@@ -2341,12 +2442,6 @@ export function createRedisStoreCore(
         if (verdict === 'empty') {
           return { events: [], hasPending: reply[1] === '1' }
         }
-        if (verdict === 'foreign') {
-          throw new A2Error(
-            'PARTIAL_DUPLICATE_BATCH',
-            `event id '${reply[1]}' already exists in another session`,
-          )
-        }
         if (verdict === 'cleared') {
           throw sessionClearedError(
             `scheduled work from event ${reply[1]} was cleared in session '${sessionId}'`,
@@ -2382,12 +2477,23 @@ export function createRedisStoreCore(
               `session '${sessionId}' was cleared while an append retry replayed; retry it`,
             )
           }
-          return {
-            events: idempotentReplay(events, existing),
-            hasPending,
-          }
+          const replayed = idempotentReplay(events, existing)
+          // The first attempt may have committed without publishing.
+          await publish(
+            notifyChannel(sessionId),
+            wakeMessage(firstIndex + events.length - 1, now, []),
+          )
+          return { events: replayed, hasPending }
         }
         const base = Number(reply[1]) - 1
+        await publish(
+          notifyChannel(sessionId),
+          wakeMessage(
+            base + withIds.length,
+            now,
+            withIds.map((e, i) => [base + 1 + i, e.id, e.type, payloads[i]!]),
+          ),
+        )
         return {
           events: withIds.map((e, i) => ({
             id: e.id,
@@ -2405,12 +2511,12 @@ export function createRedisStoreCore(
 
     async cursors(sessionId) {
       return wrap(async () => {
-        const reply = (await evalScript(
-          CURSORS_LUA,
-          sessionId,
-          [],
-          [],
-        )) as Array<
+        const reply = (await runScript({
+          script: CURSORS_LUA,
+          keys: [countKey(sessionId)],
+          args: [],
+          readOnly: true,
+        })) as Array<
           [
             consumer: string,
             tag: string,
@@ -2544,11 +2650,12 @@ export function createRedisStoreCore(
         }
         const now = clock.now().getTime()
         const cause: EventCause = { consumer, lane, index, attempt }
+        const payloads = events.map((event) => json(event.payload))
         const reply = (await indexing(sessionId, () =>
           evalScript(
             COMPLETE_ATTEMPT_LUA,
             sessionId,
-            ids.map((id) => idKey(id)),
+            [],
             [
               sessionId,
               now,
@@ -2558,13 +2665,12 @@ export function createRedisStoreCore(
               attempt,
               json(cause),
               servedArg(consumers),
-              notifyChannel(sessionId),
               json(ids),
               events.length,
-              ...events.flatMap((event) => [
+              ...events.flatMap((event, i) => [
                 event.id,
                 event.type,
-                json(event.payload),
+                payloads[i]!,
                 targetsArg(event.targets),
               ]),
             ],
@@ -2586,6 +2692,21 @@ export function createRedisStoreCore(
 
         if (outcome === 'ok') {
           const base = Number(reply[1]) - 1
+          if (events.length > 0) {
+            await publish(
+              notifyChannel(sessionId),
+              wakeMessage(
+                base + events.length,
+                now,
+                events.map((event, i) => [
+                  base + 1 + i,
+                  event.id,
+                  event.type,
+                  payloads[i]!,
+                ]),
+              ),
+            )
+          }
           return {
             outcome: 'completed',
             events: events.map((event, i) => ({
@@ -2627,10 +2748,13 @@ export function createRedisStoreCore(
               'returned event retry does not match the committed batch',
             )
           }
-          return {
-            outcome: 'completed',
-            events: idempotentReplay(events, existing),
-          }
+          const replayed = idempotentReplay(events, existing)
+          // The first attempt may have committed without publishing.
+          await publish(
+            notifyChannel(sessionId),
+            wakeMessage(firstIndex + events.length - 1, now, []),
+          )
+          return { outcome: 'completed', events: replayed }
         }
         throw new TypeError(`unexpected completion outcome '${outcome}'`)
       })
@@ -2678,12 +2802,12 @@ export function createRedisStoreCore(
 
     async deadLetters(sessionId) {
       return wrap(async () => {
-        const reply = (await evalScript(
-          DEAD_LETTERS_LUA,
-          sessionId,
-          [],
-          [],
-        )) as HeadTuple[]
+        const reply = (await runScript({
+          script: DEAD_LETTERS_LUA,
+          keys: [countKey(sessionId)],
+          args: [],
+          readOnly: true,
+        })) as HeadTuple[]
         return reply
           .map((head) => toHeadEvent(sessionId, head))
           .toSorted(byHead)
@@ -2742,19 +2866,20 @@ export function createRedisStoreCore(
     async readState(sessionId, reducerName, stateOptions) {
       return wrap(() =>
         retryAfterGap(async () => {
-          const reply = (await evalScript(
-            READ_STATE_LUA,
-            sessionId,
-            [
+          const reply = (await runScript({
+            script: READ_STATE_LUA,
+            keys: [
+              countKey(sessionId),
               snapKey(sessionId, reducerName),
               snapHistoryKey(sessionId, reducerName),
             ],
-            [
+            args: [
               stateOptions?.snapshotThroughIndex ??
                 stateOptions?.throughIndex ??
                 '',
             ],
-          )) as [number | string, string, string, string]
+            readOnly: true,
+          })) as [number | string, string, string, string]
           const rawHead = reply[0]
           const raw = reply[1]
           const headIndex = rawHead === '' ? null : Number(rawHead)
@@ -2864,71 +2989,76 @@ export function createRedisStoreCore(
           // Expiry anchors on the injected storage clock — the sender's
           // `a` stamp orders writes, the `e` stamp bounds their
           // lifetime, and the two clocks never mix.
-          const expiresAtMs = clock.now().getTime() + meta.ttlMs
+          const nowMs = clock.now().getTime()
+          const expiresAtMs = nowMs + meta.ttlMs
           // The hash field is JSON `[participant, field]`: both are
           // caller strings, so no separator character is
           // collision-safe — the JSON array is.
-          const applied = (await call(
-            'EVAL',
-            PRESENCE_SET_LUA,
-            1,
-            presenceKey(ns),
-            atMs,
-            meta.ttlMs,
-            entries.length,
-            ...entries.flatMap(([field, value]) => [
-              JSON.stringify([participant, field]),
-              value === null
-                ? ''
-                : json({
-                    v: value,
-                    s: meta.seen,
-                    a: atMs,
-                    e: expiresAtMs,
-                  }),
-              `${json(field)}:${json(value)}`,
-            ]),
-            presenceKey(ns),
-            `${json({ src: options.presenceSource, participant, seen: meta.seen, at: atMs }).slice(0, -1)},"values":{`,
-          )) as string[]
+          const applied = (await runScript({
+            script: PRESENCE_SET_LUA,
+            keys: [presenceKey(ns)],
+            args: [
+              atMs,
+              meta.ttlMs,
+              nowMs,
+              entries.length,
+              // A null is stored as a tombstone: it keeps its stamp, so an
+              // older set that arrives after it still loses.
+              ...entries.flatMap(([field, value]) => [
+                JSON.stringify([participant, field]),
+                json({ a: atMs, e: expiresAtMs, s: meta.seen, v: value }),
+              ]),
+            ],
+            readOnly: false,
+          })) as string[]
           if (applied.length === 0) return null
           // Field-keyed and caller-named — null-prototype, like every
           // presence map (see `nullProtoRecord`).
           const appliedValues: Record<string, unknown> = nullProtoRecord()
+          const published: string[] = []
           for (const position of applied) {
             const [field, value] = entries[Number(position) - 1]!
             appliedValues[field] = structuredClone(value)
+            published.push(`${json(field)}:${json(value)}`)
           }
           return {
-            participant,
-            values: appliedValues,
-            seen: meta.seen,
-            at: new Date(atMs),
+            patch: {
+              participant,
+              values: appliedValues,
+              seen: meta.seen,
+              at: new Date(atMs),
+            },
+            published: publish(
+              presenceChannel(ns),
+              `${json({ src: options.presenceSource, participant, seen: meta.seen, at: atMs }).slice(0, -1)},"values":{${published.join(',')}}}`,
+            ),
           }
         })
       },
 
       async read(ns) {
         return wrap(async () => {
-          const reply = (await call(
-            'EVAL',
-            PRESENCE_READ_LUA,
-            1,
-            presenceKey(ns),
-            clock.now().getTime(),
-          )) as string[]
+          const key = presenceKey(ns)
+          const reply = (await call('HGETALL', key)) as string[]
+          const nowMs = clock.now().getTime()
           const rows: PresenceRow[] = []
+          const expired: string[] = []
           for (let i = 0; i + 1 < reply.length; i += 2) {
-            const [participant, field] = JSON.parse(reply[i]!) as [
-              string,
-              string,
-            ]
             const entry = JSON.parse(reply[i + 1]!) as {
               v: unknown
               s: number
               a: number
               e: number
             }
+            if (entry.e <= nowMs) {
+              expired.push(reply[i]!)
+              continue
+            }
+            if (entry.v === null) continue
+            const [participant, field] = JSON.parse(reply[i]!) as [
+              string,
+              string,
+            ]
             rows.push({
               participant,
               field,
@@ -2938,6 +3068,16 @@ export function createRedisStoreCore(
               expiresAt: new Date(entry.e),
             })
           }
+          // The rows are already filtered; a failed prune only defers the
+          // deletion to the next read.
+          if (expired.length > 0) {
+            await runScript({
+              script: PRESENCE_PRUNE_LUA,
+              keys: [key],
+              args: [nowMs, ...expired],
+              readOnly: false,
+            }).catch(() => undefined)
+          }
           return rows
         })
       },
@@ -2949,14 +3089,20 @@ export function createRedisStoreCore(
 
     async readTail(sessionId, fromIndex, throughIndex) {
       return wrap(async () => {
-        const newest = (await call(
-          'XREVRANGE',
-          storeKey(sessionId),
-          throughIndex === undefined ? '+' : `${throughIndex}-0`,
-          `${fromIndex}-0`,
-          'COUNT',
-          READ_PAGE_SIZE,
-        )) as StreamEntry[]
+        // Entries below the latest clear are an old lifetime's, awaiting
+        // reclaim: a tail that reaches them is the boundary-aware reads' job.
+        const [newest, clearIndex] = await Promise.all([
+          call(
+            'XREVRANGE',
+            storeKey(sessionId),
+            throughIndex === undefined ? '+' : `${throughIndex}-0`,
+            `${fromIndex}-0`,
+            'COUNT',
+            READ_PAGE_SIZE,
+          ) as Promise<StreamEntry[]>,
+          readClearIndex(sessionId),
+        ])
+        if (clearIndex > fromIndex) return null
         const page = newest
           .toReversed()
           .map((entry) => toEvent(sessionId, entry))
@@ -2976,20 +3122,20 @@ export function createRedisStoreCore(
     async clear({ sessionId, ifLastIndex, cause }) {
       return wrap(async () => {
         const markerId = generateId()
+        const now = clock.now().getTime()
         const reply = (await evalScript(
           CLEAR_LUA,
           sessionId,
-          [idKey(markerId)],
+          [],
           [
             sessionId,
-            clock.now().getTime(),
+            now,
             ifLastIndex ?? '',
             cause?.consumer ?? '',
             cause ? tagOf(cause.lane) : '',
             cause?.index ?? '',
             cause?.attempt ?? '',
             markerId,
-            notifyChannel(sessionId),
           ],
         )) as string[]
         if (reply[0] === 'superseded') {
@@ -3001,6 +3147,18 @@ export function createRedisStoreCore(
             `the clear marker id '${markerId}' already exists`,
           )
         }
+        const head = Number(reply[2])
+        if (reply[4] === '1') {
+          await publish(
+            notifyChannel(sessionId),
+            wakeMessage(head, now, [
+              [head, markerId, CLEAR_EVENT_TYPE, 'null'],
+            ]),
+          )
+        } else if (reply[1] === '1' && head > 0) {
+          // An earlier attempt may have appended the marker without publishing.
+          await publish(notifyChannel(sessionId), wakeMessage(head, now, []))
+        }
         return {
           cleared: reply[1] === '1',
           index: Number(reply[2]),
@@ -3011,27 +3169,25 @@ export function createRedisStoreCore(
 
     async reclaim(sessionId) {
       return wrap(async () => {
-        const [log, ...pairs] = (await evalScript(
+        const pairs = (await evalScript(
           RECLAIM_BATCH_LUA,
           sessionId,
           [],
           [READ_PAGE_SIZE],
         )) as string[]
-        if (log === undefined) return { deleted: 0, done: true }
-        // Id keys are built here, like append's: they use JSON.stringify,
-        // whose escaping cjson does not reproduce.
-        const ids: string[] = []
-        for (let i = 1; i < pairs.length; i += 2) ids.push(pairs[i]!)
+        if (pairs.length === 0) return { deleted: 0, done: true }
         const [deleted, done] = (await evalScript(
           RECLAIM_LUA,
           sessionId,
-          [log, ...ids.map((id) => idKey(id))],
-          [sessionId, ids.length, ...pairs],
+          [],
+          [sessionId, pairs.length / 2, ...pairs],
         )) as [number, number]
         return { deleted: Number(deleted), done: Number(done) === 1 }
       })
     },
 
+    clearIndex: (sessionId) => wrap(() => readClearIndex(sessionId)),
+
     async readEvents(sessionId, afterIndex) {
       return wrap(async () => {
         const entries = (await call(