@effect-agent/platform-cloudflare 0.1.0-beta.132 → 0.1.0-beta.133

package/dist/{ThreadObject-D8GzJxJB.d.mts → ThreadObject-D1CWZ8j3.d.mts}

@@ -114,7 +114,10 @@ type CloudflareDurableRuntimeInitializationError = CloudflarePlatformConfigError
 type CloudflareDurableRuntimeServices = DurableAgentRuntime | SubmissionLedger | ThreadStore | MessageDeliveryStore | WakeScheduler | DurableAlarmService | ThreadMaintenance | ThreadMutationGate | ThreadPublication | ThreadProjectionMaintenance | ThreadObjectPorts | ProgressWaitRegistry | SqlClient;
 declare const ThreadObjectPorts_base: Context.ServiceClass<ThreadObjectPorts, "@effect-agent/platform-cloudflare/ThreadObjectPorts", {
   readonly handle: (request: PortRequest) => Effect.Effect<PortResponse>;
-  /** Local-only identity check before a bound RPC can read or mutate a Submission. */
+  /**
+   * Local-only lookup: encoded identities and returned rows must belong to this physical
+   * owner. Addressed RPCs additionally validate the exact logical Thread.
+   */
   readonly lookupSubmission: (submissionId: SubmissionId) => Effect.Effect<Option.Option<SubmissionSnapshot>, LedgerError>;
 }>;
 /**
@@ -359,13 +362,13 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
         readonly author: string;
         readonly reason: string;
         readonly resolution: {
+          readonly _tag: "SafeToRetry";
+        } | {
           readonly _tag: "CompletedWithResult";
           readonly result: Schema.Json;
           readonly isFailure: boolean;
         } | {
           readonly _tag: "NeverHappened";
-        } | {
-          readonly _tag: "SafeToRetry";
         } | {
           readonly _tag: "AbortSubmission";
         };
@@ -705,13 +708,20 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
 } | {
   readonly _tag: "AdminFailed";
   readonly failure: {
-    readonly _tag: "DurableAlarmError";
+    readonly _tag: "AdmissionPolicyError";
+    readonly reason: "occupied" | "refused" | "unavailable";
+    readonly code: string;
+    readonly cause?: import("effect-agent/failure-diagnostic").Diagnostic | undefined;
+    readonly stack?: string | undefined;
+  } | {
+    readonly _tag: "SettlementConflict";
+    readonly submissionId: string;
+    readonly existingOutcome: "aborted" | "completed" | "failed";
+  } | {
+    readonly _tag: "LedgerError";
     readonly operation: string;
     readonly message: string;
-    readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "ThreadNotMaterialized";
-    readonly threadId: string;
+    readonly cause?: import("effect-agent/failure-diagnostic").Diagnostic | undefined;
   } | {
     readonly _tag: "ThreadStoreError";
     readonly operation: string;
@@ -725,10 +735,8 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
       readonly sequence?: number | undefined;
     } | undefined;
   } | {
-    readonly _tag: "LedgerError";
-    readonly operation: string;
-    readonly message: string;
-    readonly cause?: import("effect-agent/failure-diagnostic").Diagnostic | undefined;
+    readonly _tag: "ThreadNotMaterialized";
+    readonly threadId: string;
   } | {
     readonly _tag: "AppendConflict";
     readonly threadId: string;
@@ -741,18 +749,17 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
     readonly threadId: string;
     readonly actualEpoch: number;
     readonly attemptedEpoch: number;
+  } | {
+    readonly _tag: "DurableAlarmError";
+    readonly operation: string;
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
   } | {
     readonly _tag: "OperationDenied";
     readonly operation: "abort" | "awaitSettlement" | "explain" | "observe" | "resolveApproval" | "resolveUnknown" | "retry" | "scanObligations" | "verify" | "wake";
     readonly reason: string;
     readonly threadId?: string | undefined;
     readonly submissionId?: string | undefined;
-  } | {
-    readonly _tag: "AdmissionPolicyError";
-    readonly reason: "occupied" | "refused" | "unavailable";
-    readonly code: string;
-    readonly cause?: import("effect-agent/failure-diagnostic").Diagnostic | undefined;
-    readonly stack?: string | undefined;
   } | {
     readonly _tag: "DigestError";
     readonly message: string;
@@ -760,10 +767,6 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
   } | {
     readonly _tag: "DurableRuntimeFailpointError";
     readonly location: "abort:after-intent" | "approval:after-request-append" | "approval:after-suspend" | "checkpoint:after-save" | "checkpoint:before-save" | "claim:after-claim" | "compaction:after-canonical-append" | "compaction:before-canonical-append" | "input:after-canonical-append" | "join:after-canonical-append" | "join:after-claim" | "policy:after-reservation-append" | "policy:before-reservation-append" | "resolve:after-intent" | "run:after-duration-append" | "run:after-start-append" | "run:before-duration-append" | "run:before-start-append" | "step:after-step-append" | "subagent:after-admit" | "subagent:after-child-abort-intent" | "subagent:after-child-ready" | "subagent:after-join-append" | "subagent:after-release" | "subagent:after-release-pending" | "subagent:after-request-append" | "subagent:after-reserve" | "subagent:after-sibling-settle" | "subagent:after-start-append" | "subagent:after-suspend" | "subagent:before-join-append" | "submit:after-admit" | "submit:after-materialize" | "terminalize:after-canonical-append" | "terminalize:after-reserve" | "tools:after-prepared-append" | "tools:after-unavailable-append" | "tools:before-prepared-append" | "tools:before-unavailable-append" | "turn:after-canonical-append" | "turn:after-response-append" | "turn:after-results-append" | "update:after-canonical-append" | "update:after-delivery-insert" | "update:before-canonical-append" | "update:before-delivery-insert" | "worker:after-completion-append" | "worker:after-origin-append" | "worker:after-report-append" | "worker:after-report-delivery" | "worker:after-source-append" | "worker:after-stop-append" | "worker:after-stop-seal" | "worker:after-subtree-append" | "worker:before-completion-append" | "worker:before-origin-append" | "worker:before-report-append" | "worker:before-report-delivery" | "worker:before-source-append" | "worker:before-stop-append" | "worker:before-stop-seal" | "worker:before-subtree-append";
-  } | {
-    readonly _tag: "SettlementConflict";
-    readonly submissionId: string;
-    readonly existingOutcome: "aborted" | "completed" | "failed";
   } | {
     readonly _tag: "ApprovalSuspensionError";
     readonly cause: Schema.Json;
@@ -814,7 +817,7 @@ interface Instance<EventServices = never> extends InstanceType<DurableObject.Dur
   verifyEncoded(encoded: unknown): Promise<unknown>;
   retryEncoded(encoded: unknown): Promise<unknown>;
   obligationsEncoded(encoded: unknown): Promise<unknown>;
-  portCall(encoded: unknown): Promise<unknown>;
+  portCall(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   wake(): Promise<void>;
   alarm(alarmInfo?: AlarmInvocationInfo): Promise<void> | void;
 }
@@ -836,4 +839,4 @@ interface Class<EventServices = never> {
 declare const make: <ApplicationServices, ApplicationError, EventServices = never, EventLayerError = never>(applicationLayer: Layer.Layer<CloudflareDurableRuntimeServices | ApplicationServices, ApplicationError, CloudflareBootstrapServices | DurableObjectState$1.DurableObjectState | WorkerEnvironment | DurableObjectContext | ThreadObjectNamespace>, options: Options<ApplicationServices, EventServices, EventLayerError>) => Class<ApplicationServices | EventServices>;
 //#endregion
 export { ThreadPublicationOptions as A, portCall as C, CloudflareDurableRuntimeOptions as D, CloudflareDurableRuntimeInitializationError as E, layerConfig as M, layerHostConfig as N, CloudflareDurableRuntimeServices as O, layerInHost as P, make as S, CloudflareBootstrapServices as T, decodeAdminVerifyRequest as _, AdminVerifyRequest as a, encodeAdminResponse as b, Instance as c, RetryExecuted as d, ThreadObject_d_exports as f, decodeAdminResponse as g, decodeAdminExplainRequest as h, AdminResponse as i, layer as j, ThreadObjectPorts as k, ObligationsScanned as l, VerifiedIntegrity as m, AdminFailed as n, Class as o, ThreadRpcOperation as p, AdminFailure as r, ExplainedRecovery as s, AdminExplainRequest as t, Options as u, decodeObligationThresholds as v, submit as w, handleRpc as x, decodeRetryCommand as y };
-//# sourceMappingURL=ThreadObject-D8GzJxJB.d.mts.map
+//# sourceMappingURL=ThreadObject-D1CWZ8j3.d.mts.map

package/dist/ThreadObject.d.mts

@@ -1,2 +1,2 @@
-import { A as ThreadPublicationOptions, C as portCall, D as CloudflareDurableRuntimeOptions, E as CloudflareDurableRuntimeInitializationError, M as layerConfig, N as layerHostConfig, O as CloudflareDurableRuntimeServices, P as layerInHost, S as make, T as CloudflareBootstrapServices, _ as decodeAdminVerifyRequest, a as AdminVerifyRequest, b as encodeAdminResponse, c as Instance, d as RetryExecuted, g as decodeAdminResponse, h as decodeAdminExplainRequest, i as AdminResponse, j as layer, k as ThreadObjectPorts, l as ObligationsScanned, m as VerifiedIntegrity, n as AdminFailed, o as Class, p as ThreadRpcOperation, r as AdminFailure, s as ExplainedRecovery, t as AdminExplainRequest, u as Options, v as decodeObligationThresholds, w as submit, x as handleRpc, y as decodeRetryCommand } from "./ThreadObject-D8GzJxJB.mjs";
+import { A as ThreadPublicationOptions, C as portCall, D as CloudflareDurableRuntimeOptions, E as CloudflareDurableRuntimeInitializationError, M as layerConfig, N as layerHostConfig, O as CloudflareDurableRuntimeServices, P as layerInHost, S as make, T as CloudflareBootstrapServices, _ as decodeAdminVerifyRequest, a as AdminVerifyRequest, b as encodeAdminResponse, c as Instance, d as RetryExecuted, g as decodeAdminResponse, h as decodeAdminExplainRequest, i as AdminResponse, j as layer, k as ThreadObjectPorts, l as ObligationsScanned, m as VerifiedIntegrity, n as AdminFailed, o as Class, p as ThreadRpcOperation, r as AdminFailure, s as ExplainedRecovery, t as AdminExplainRequest, u as Options, v as decodeObligationThresholds, w as submit, x as handleRpc, y as decodeRetryCommand } from "./ThreadObject-D1CWZ8j3.mjs";
 export { AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, type CloudflareBootstrapServices as BootstrapServices, Class, ExplainedRecovery, type CloudflareDurableRuntimeInitializationError as InitializationError, Instance, ObligationsScanned, Options, type ThreadPublicationOptions as PublicationOptions, RetryExecuted, type CloudflareDurableRuntimeOptions as RuntimeOptions, type CloudflareDurableRuntimeServices as Services, ThreadObjectPorts, ThreadRpcOperation, VerifiedIntegrity, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeObligationThresholds, decodeRetryCommand, encodeAdminResponse, handleRpc, layer, layerConfig, layerHostConfig, layerInHost, make, portCall, submit };

package/dist/ThreadObject.mjs

@@ -1,3 +1,3 @@
 import "./CloudflareThreadClient.mjs";
-import { C as layer, E as layerInHost, S as ThreadObjectPorts, T as layerHostConfig, _ as encodeAdminResponse, a as AdminVerifyRequest, b as portCall, c as RetryExecuted, d as VerifiedIntegrity, f as decodeAdminExplainRequest, g as decodeRetryCommand, h as decodeObligationThresholds, i as AdminResponse, m as decodeAdminVerifyRequest, n as AdminFailed, o as ExplainedRecovery, p as decodeAdminResponse, r as AdminFailure, s as ObligationsScanned, t as AdminExplainRequest, u as ThreadRpcOperation, v as handleRpc, w as layerConfig, x as submit, y as make } from "./ThreadObject-CVhZC-7l.mjs";
+import { C as layer, E as layerInHost, S as ThreadObjectPorts, T as layerHostConfig, _ as encodeAdminResponse, a as AdminVerifyRequest, b as portCall, c as RetryExecuted, d as VerifiedIntegrity, f as decodeAdminExplainRequest, g as decodeRetryCommand, h as decodeObligationThresholds, i as AdminResponse, m as decodeAdminVerifyRequest, n as AdminFailed, o as ExplainedRecovery, p as decodeAdminResponse, r as AdminFailure, s as ObligationsScanned, t as AdminExplainRequest, u as ThreadRpcOperation, v as handleRpc, w as layerConfig, x as submit, y as make } from "./ThreadObject-BkLV7hMd.mjs";
 export { AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, ExplainedRecovery, ObligationsScanned, RetryExecuted, ThreadObjectPorts, ThreadRpcOperation, VerifiedIntegrity, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeObligationThresholds, decodeRetryCommand, encodeAdminResponse, handleRpc, layer, layerConfig, layerHostConfig, layerInHost, make, portCall, submit };

package/dist/index.d.mts

@@ -10,6 +10,6 @@ import { t as CloudflareMemory_d_exports } from "./CloudflareMemory.mjs";
 import { t as CloudflareScheduling_d_exports } from "./CloudflareScheduling.mjs";
 import { t as CloudflareSubscriptions_d_exports } from "./CloudflareSubscriptions.mjs";
 import { t as CloudflareThreadClient_d_exports } from "./CloudflareThreadClient.mjs";
-import { f as ThreadObject_d_exports } from "./ThreadObject-D8GzJxJB.mjs";
+import { f as ThreadObject_d_exports } from "./ThreadObject-D1CWZ8j3.mjs";
 import { t as WakeScheduler_d_exports } from "./WakeScheduler.mjs";
 export { Alarm_d_exports as Alarm, BrowserCredentials_d_exports as BrowserCredentials, BrowserSession_d_exports as BrowserSession, CloudflareAiGateway_d_exports as CloudflareAiGateway, CloudflareBindings_d_exports as CloudflareBindings, CloudflareBrowser_d_exports as CloudflareBrowser, CloudflareCodeMode_d_exports as CloudflareCodeMode, CloudflareConfig_d_exports as CloudflareConfig, CloudflareMemory_d_exports as CloudflareMemory, CloudflareScheduling_d_exports as CloudflareScheduling, CloudflareSubscriptions_d_exports as CloudflareSubscriptions, CloudflareThreadClient_d_exports as CloudflareThreadClient, ThreadObject_d_exports as ThreadObject, WakeScheduler_d_exports as WakeScheduler };

package/dist/index.mjs

@@ -8,7 +8,7 @@ import { t as CloudflareThreadClient_exports } from "./CloudflareThreadClient.mj
 import { t as CloudflareScheduling_exports } from "./CloudflareScheduling.mjs";
 import { t as CloudflareSubscriptions_exports } from "./CloudflareSubscriptions.mjs";
 import { t as WakeScheduler_exports } from "./WakeScheduler.mjs";
-import { l as ThreadObject_exports } from "./ThreadObject-CVhZC-7l.mjs";
+import { l as ThreadObject_exports } from "./ThreadObject-BkLV7hMd.mjs";
 import { t as CloudflareAiGateway_exports } from "./CloudflareAiGateway.mjs";
 import { t as BrowserCredentials_exports } from "./BrowserCredentials.mjs";
 import { i as BrowserSession_exports } from "./BrowserSession-DWoRC_iM.mjs";

package/package.json

@@ -1 +1 @@
-{"name":"@effect-agent/platform-cloudflare","version":"0.1.0-beta.132","dependencies":{"@effect-agent/storage-cloudflare":"0.1.0-beta.132","@effect/platform-browser":"4.0.0-rc.116","@effect/sql-sqlite-do":"4.0.0-rc.116","effect-agent":"0.1.0-beta.132","puppeteer-core":"24.29.0"},"devDependencies":{"@cloudflare/vitest-pool-workers":"0.21.3","@cloudflare/workers-types":"5.20260825.1","@effect-agent/testing":"0.1.0-beta.132","@effect/platform-node":"4.0.0-rc.116","@effect/sql-d1":"4.0.0-rc.116","@effect/vitest":"4.0.0-rc.116","effect":"4.0.0-rc.116","effect-cf":"0.44.1","esbuild":"0.28.1","miniflare":"5.20260811.1-alpha","typescript":"7.0.2","vite-plus":"0.3.2","vitest":"4.1.11"},"peerDependencies":{"effect":"^4.0.0-rc.116","effect-cf":"^0.44.1 || ^0.45.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./alarm":{"types":"./dist/Alarm.d.mts","default":"./dist/Alarm.mjs"},"./browser-rest-capture":{"types":"./dist/BrowserRestCapture.d.mts","default":"./dist/BrowserRestCapture.mjs"},"./browser-rest-crawl":{"types":"./dist/BrowserRestCrawl.d.mts","default":"./dist/BrowserRestCrawl.mjs"},"./cloudflare-bindings":{"types":"./dist/CloudflareBindings.d.mts","default":"./dist/CloudflareBindings.mjs"},"./cloudflare-browser":{"types":"./dist/CloudflareBrowser.d.mts","default":"./dist/CloudflareBrowser.mjs"},"./cloudflare-code-mode":{"types":"./dist/CloudflareCodeMode.d.mts","default":"./dist/CloudflareCodeMode.mjs"},"./cloudflare-config":{"types":"./dist/CloudflareConfig.d.mts","default":"./dist/CloudflareConfig.mjs"},"./cloudflare-memory":{"types":"./dist/CloudflareMemory.d.mts","default":"./dist/CloudflareMemory.mjs"},"./cloudflare-scheduling":{"types":"./dist/CloudflareScheduling.d.mts","default":"./dist/CloudflareScheduling.mjs"},"./cloudflare-subscriptions":{"types":"./dist/CloudflareSubscriptions.d.mts","default":"./dist/CloudflareSubscriptions.mjs"},"./cloudflare-thread-client":{"types":"./dist/CloudflareThreadClient.d.mts","default":"./dist/CloudflareThreadClient.mjs"},"./interactive-browser":{"types":"./dist/InteractiveBrowser.d.mts","default":"./dist/InteractiveBrowser.mjs"},"./browser-session":{"types":"./dist/BrowserSession.d.mts","default":"./dist/BrowserSession.mjs"},"./browser-credentials":{"types":"./dist/BrowserCredentials.d.mts","default":"./dist/BrowserCredentials.mjs"},"./thread-object":{"types":"./dist/ThreadObject.d.mts","default":"./dist/ThreadObject.mjs"},"./wake-scheduler":{"types":"./dist/WakeScheduler.d.mts","default":"./dist/WakeScheduler.mjs"},"./cloudflare-ai-gateway":{"types":"./dist/CloudflareAiGateway.d.mts","default":"./dist/CloudflareAiGateway.mjs"}},"description":"Cloudflare Layer assembly for Effect Agent: Durable Objects and Browser Run adapters.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-agent.git","directory":"packages/platform-cloudflare"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json"}}
+{"name":"@effect-agent/platform-cloudflare","version":"0.1.0-beta.133","dependencies":{"@effect-agent/storage-cloudflare":"0.1.0-beta.133","@effect/platform-browser":"4.0.0-rc.116","@effect/sql-sqlite-do":"4.0.0-rc.116","effect-agent":"0.1.0-beta.133","puppeteer-core":"24.29.0"},"devDependencies":{"@cloudflare/vitest-pool-workers":"0.21.3","@cloudflare/workers-types":"5.20260825.1","@effect-agent/testing":"0.1.0-beta.133","@effect/platform-node":"4.0.0-rc.116","@effect/sql-d1":"4.0.0-rc.116","@effect/vitest":"4.0.0-rc.116","effect":"4.0.0-rc.116","effect-cf":"0.44.1","esbuild":"0.28.1","miniflare":"5.20260811.1-alpha","typescript":"7.0.2","vite-plus":"0.3.2","vitest":"4.1.11"},"peerDependencies":{"effect":"^4.0.0-rc.116","effect-cf":"^0.44.1 || ^0.45.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./alarm":{"types":"./dist/Alarm.d.mts","default":"./dist/Alarm.mjs"},"./browser-rest-capture":{"types":"./dist/BrowserRestCapture.d.mts","default":"./dist/BrowserRestCapture.mjs"},"./browser-rest-crawl":{"types":"./dist/BrowserRestCrawl.d.mts","default":"./dist/BrowserRestCrawl.mjs"},"./cloudflare-bindings":{"types":"./dist/CloudflareBindings.d.mts","default":"./dist/CloudflareBindings.mjs"},"./cloudflare-browser":{"types":"./dist/CloudflareBrowser.d.mts","default":"./dist/CloudflareBrowser.mjs"},"./cloudflare-code-mode":{"types":"./dist/CloudflareCodeMode.d.mts","default":"./dist/CloudflareCodeMode.mjs"},"./cloudflare-config":{"types":"./dist/CloudflareConfig.d.mts","default":"./dist/CloudflareConfig.mjs"},"./cloudflare-memory":{"types":"./dist/CloudflareMemory.d.mts","default":"./dist/CloudflareMemory.mjs"},"./cloudflare-scheduling":{"types":"./dist/CloudflareScheduling.d.mts","default":"./dist/CloudflareScheduling.mjs"},"./cloudflare-subscriptions":{"types":"./dist/CloudflareSubscriptions.d.mts","default":"./dist/CloudflareSubscriptions.mjs"},"./cloudflare-thread-client":{"types":"./dist/CloudflareThreadClient.d.mts","default":"./dist/CloudflareThreadClient.mjs"},"./interactive-browser":{"types":"./dist/InteractiveBrowser.d.mts","default":"./dist/InteractiveBrowser.mjs"},"./browser-session":{"types":"./dist/BrowserSession.d.mts","default":"./dist/BrowserSession.mjs"},"./browser-credentials":{"types":"./dist/BrowserCredentials.d.mts","default":"./dist/BrowserCredentials.mjs"},"./thread-object":{"types":"./dist/ThreadObject.d.mts","default":"./dist/ThreadObject.mjs"},"./wake-scheduler":{"types":"./dist/WakeScheduler.d.mts","default":"./dist/WakeScheduler.mjs"},"./cloudflare-ai-gateway":{"types":"./dist/CloudflareAiGateway.d.mts","default":"./dist/CloudflareAiGateway.mjs"}},"description":"Cloudflare Layer assembly for Effect Agent: Durable Objects and Browser Run adapters.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-agent.git","directory":"packages/platform-cloudflare"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json"}}

package/src/Alarm.ts

@@ -1483,6 +1483,9 @@ export class ThreadMaintenance extends Context.Service<
         );
 
         yield* failpoint.hit("maintenance:checkpoint:after");
+        // Once this empty recovery wave is checkpointed, its producer overlap must not
+        // prevent a later fresh snapshot from acknowledging native quiescence.
+        if (remaining.length === 0 && recovery.pending.size === 0) delete recovery.observation;
         native.deferred.clear();
         native.progressed = false;
         native.needsCheckpoint = false;

package/src/CloudflareBindings.ts

@@ -27,7 +27,7 @@ export class CloudflareBindingError extends Schema.TaggedError<CloudflareBinding
  * points, `@effect-agent/storage-cloudflare` port envelopes for `portCall`), so the RPC
  * boundary carries only structured-cloneable JSON. The optional trailing trace context is
  * transient native RPC metadata, stripped by an opted-in effect-cf receiver before decoding
- * the host envelope. It never enters durable state.
+ * the host or port envelope. It never enters durable state.
  */
 export interface ThreadObjectRpc extends Rpc.DurableObjectBranded {
   /** Admission-limits gate + `DurableAgentRuntime.submit`; answers a `SubmitResponse`. */
@@ -48,7 +48,7 @@ export interface ThreadObjectRpc extends Rpc.DurableObjectBranded {
   /** Authorized DUR-017 Unknown-Outcome resolution; answers a `ResolveUnknownResponse`. */
   resolveUnknownEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   /** Owner-side cross-Object port endpoint (WP2 envelopes, executed on LOCAL facets). */
-  portCall(encoded: unknown): Promise<unknown>;
+  portCall(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   /** Droppable liveness hint from another Object: arms an immediate alarm. */
   wake(): Promise<void>;
 }

package/src/ThreadObject.ts

@@ -196,6 +196,7 @@ const isMutatingPortRequest = (request: PortRequest): boolean => {
     case "LedgerResolveAdmission":
     case "StoreReadPage":
     case "StoreInspectTail":
+    case "StoreReadIdentity":
     case "StoreCountPeerMessages":
     case "StoreExport":
     case "MessageDeliveryList":
@@ -374,6 +375,7 @@ const requirePortThread = (request: PortRequest) => {
     case "StoreAppend":
     case "StoreReadPage":
     case "StoreInspectTail":
+    case "StoreReadIdentity":
     case "StoreCountPeerMessages":
     case "StoreExport":
       return requireReceiptThread(request.request.threadId);
@@ -1074,7 +1076,7 @@ export interface Instance<EventServices = never> extends InstanceType<
   verifyEncoded(encoded: unknown): Promise<unknown>;
   retryEncoded(encoded: unknown): Promise<unknown>;
   obligationsEncoded(encoded: unknown): Promise<unknown>;
-  portCall(encoded: unknown): Promise<unknown>;
+  portCall(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   wake(): Promise<void>;
   alarm(alarmInfo?: AlarmInvocationInfo): Promise<void> | void;
 }

package/src/internal/layers.ts

@@ -17,6 +17,7 @@ import {
 } from "@effect-agent/storage-cloudflare/port-protocol";
 import {
   executePortRequest,
+  makeLocalSubmissionLookup,
   routedMessageDeliveryStoreLayer,
   routedThreadStoreLayer,
   routedSubmissionLedgerLayer,
@@ -71,7 +72,6 @@ import {
 import {
   LedgerError,
   SubmissionLedger,
-  SubmissionLookupById,
   type SubmissionSnapshot,
 } from "effect-agent/submission-ledger";
 import { ThreadProjectionMaintenance } from "effect-agent/thread-projection-maintenance";
@@ -228,7 +228,10 @@ export class ThreadObjectPorts extends Context.Service<
   ThreadObjectPorts,
   {
     readonly handle: (request: PortRequest) => Effect.Effect<PortResponse>;
-    /** Local-only identity check before a bound RPC can read or mutate a Submission. */
+    /**
+     * Local-only lookup: encoded identities and returned rows must belong to this physical
+     * owner. Addressed RPCs additionally validate the exact logical Thread.
+     */
     readonly lookupSubmission: (
       submissionId: SubmissionId,
     ) => Effect.Effect<Option.Option<SubmissionSnapshot>, LedgerError>;
@@ -726,12 +729,12 @@ const sharedLayer = <A, E, R, PE = never, PR = never>(
             SubmissionLedger | ThreadStore | MessageDeliveryStore
           >();
 
-          const ledger = Context.get(local, SubmissionLedger);
+          const lookupSubmission = makeLocalSubmissionLookup({ ownsThread });
 
           return ThreadObjectPorts.of({
             handle: (request) => executePortRequest(request).pipe(Effect.provide(local)),
             lookupSubmission: (submissionId) =>
-              ledger.lookup(SubmissionLookupById.make({ submissionId })),
+              lookupSubmission(submissionId).pipe(Effect.provide(local)),
           });
         }),
       ).pipe(Layer.provide(localPorts), Layer.provide(messageStore));

package/src/internal/transport.ts

@@ -3,6 +3,8 @@ import {
   portTransportFailure,
 } from "@effect-agent/storage-cloudflare/port-routing";
 import { Effect, Layer } from "effect";
+import type { ThreadId } from "effect-agent/identifiers";
+import { RpcTracing } from "effect-cf";
 
 import { callThreadObject, ThreadObjectNamespace } from "../CloudflareBindings.ts";
 
@@ -13,6 +15,8 @@ import { callThreadObject, ThreadObjectNamespace } from "../CloudflareBindings.t
  * already Schema-encoded JSON, so the RPC boundary carries only structured-cloneable values;
  * the protocol module stays transport-agnostic and fetch-with-JSON remains the documented
  * fallback carrier.
+ * The namespace's optional `rpcTracing` setting uses the same transient trailing context
+ * as host calls; it never changes the encoded port envelope.
  *
  * Every delivery problem — stub construction, RPC rejection, overload, deploy-in-progress —
  * surfaces as `PortTransportError` (preserving the platform stub's own `retryable` signal
@@ -26,19 +30,27 @@ export const threadPortTransportLayer: Layer.Layer<
 > = Layer.effect(ThreadPortTransport)(
   Effect.gen(function* () {
     const namespace = yield* ThreadObjectNamespace;
+    const { rpcTracing } = namespace;
 
     return ThreadPortTransport.of({
-      call: (threadId, request) =>
-        callThreadObject(
-          threadId,
-          (target) => target.portCall(request),
-          (cause) => portTransportFailure(threadId, cause),
-        ).pipe(
-          Effect.provideService(ThreadObjectNamespace, namespace),
-          Effect.withSpan("CloudflarePortTransport.call", {
-            attributes: { threadId },
-          }),
-        ),
+      call: Effect.fn(
+        function* (threadId: ThreadId, request: unknown) {
+          const traceArgs =
+            rpcTracing === undefined ? [] : yield* RpcTracing.withRpcTraceContext([]);
+
+          return yield* callThreadObject(
+            threadId,
+            (target) => target.portCall(request, ...traceArgs),
+            (cause) => portTransportFailure(threadId, cause),
+          ).pipe(Effect.provideService(ThreadObjectNamespace, namespace));
+        },
+        (effect, threadId) =>
+          rpcTracing === undefined
+            ? Effect.withSpan(effect, "CloudflarePortTransport.call", {
+                attributes: { threadId },
+              })
+            : RpcTracing.withRpcClientSpan(effect, rpcTracing, "portCall"),
+      ),
     });
   }),
 );