@effect-agent/platform-cloudflare 0.1.0-beta.6 → 0.1.0-beta.60

package/src/{conversation-object.ts → ThreadObject.ts}

@@ -1,35 +1,49 @@
-import type { AgentId } from "@effect-agent/core";
-import { SubmissionId } from "@effect-agent/core";
+import { type AgentId } from "@effect-agent/core/Identifiers";
+import { SubmissionId } from "@effect-agent/core/Identifiers";
+import {
+  decodePortRequest,
+  encodePortResponse,
+  type PortRequest,
+} from "@effect-agent/storage-cloudflare/PortProtocol";
 import {
-  AppendConflict,
-  ConversationNotMaterialized,
-  ConversationRead,
-  ConversationStore,
-  ConversationStoreError,
-  DigestError,
-  DurableAgentRuntime,
-  DurableRuntimeFailpointError,
-  FenceRejected,
   IntegrityReport,
-  LedgerError,
   ObligationReport,
   ObligationThresholds,
+  RecoveryExplanation,
+  RetryCommand,
+  RetryRefused,
+} from "@effect-agent/thread/Admin";
+import { DigestError } from "@effect-agent/thread/Digest";
+import {
+  DurableAgentRuntime,
+  RecoveryReport,
+  type DurableSubmitAgent,
+} from "@effect-agent/thread/DurableAgentRuntime";
+import { DurableRuntimeFailpointError } from "@effect-agent/thread/DurableFailpoint";
+import {
   OperationAuthorizationRequest,
   OperationAuthorizer,
   OperationDenied,
+} from "@effect-agent/thread/OperationAuthorizer";
+import { PersistedJson } from "@effect-agent/thread/Records";
+import { RunJournalError } from "@effect-agent/thread/RunJournal";
+import {
+  AdmissionPolicyError,
+  LedgerError,
   OwnershipLost,
-  PersistedJson,
-  RecoveryExplanation,
-  RecoveryReport,
-  RetryCommand,
-  RetryRefused,
-  RunJournalError,
   SettlementConflict,
   SubmissionLedger,
   SubmissionLookupByKey,
-  type DurableSubmitAgent,
-} from "@effect-agent/session";
-import type { DurableObject as CloudflareDurableObject } from "cloudflare:workers";
+} from "@effect-agent/thread/SubmissionLedger";
+import {
+  AppendConflict,
+  ThreadNotMaterialized,
+  ThreadRead,
+  ThreadStore,
+  ThreadStoreError,
+  FenceRejected,
+} from "@effect-agent/thread/ThreadStore";
+import { WakeScheduler } from "@effect-agent/thread/WakeScheduler";
 import { Effect, Layer, Option, Schema, Stream } from "effect";
 import {
   DurableObject as EffectCfDurableObject,
@@ -38,29 +52,35 @@ import {
 } from "effect-cf";
 
 import {
-  ConversationMaintenance,
+  ThreadMaintenance,
   DurableAlarmError,
   DurableAlarmService,
   type MaintenancePassFailure,
-} from "./alarm.ts";
+} from "./Alarm.ts";
 import {
-  ConversationObjectIdentity,
+  ThreadObjectIdentity,
   DurableObjectContext,
-  ConversationObjectNamespace,
-  conversationNamespaceFromEnv,
+  ThreadObjectNamespace,
+  threadNamespaceFromEnv,
   type CloudflareBindingError,
-} from "./bindings.ts";
+} from "./CloudflareBindings.ts";
+import { AdmissionLimitExceeded, CloudflareDurableRuntimeConfig } from "./CloudflareConfig.ts";
 import {
   AbortRecorded,
   ApprovalRecorded,
   HostFailed,
   HostProtocolError,
   ObservedPage,
+  ProgressObserved,
+  ProgressCancelled,
   SettlementReached,
+  SubmissionStatusResponse,
   SubmitSucceeded,
   UnknownResolutionRecorded,
   boundHostDiagnostic,
   decodeAbortCommand,
+  decodeAwaitProgressRequest,
+  decodeCancelProgressRequest,
   decodeApprovalDecisionCommand,
   decodeObservePageRequest,
   decodeReceipt,
@@ -69,25 +89,39 @@ import {
   encodeHostResponse,
   type HostFailure,
   type HostResponse,
-} from "./client.ts";
-import { AdmissionLimitExceeded, CloudflareDurableRuntimeConfig } from "./config.ts";
+} from "./CloudflareThreadClient.ts";
 import {
-  CloudflareDurableRuntime,
-  ConversationObjectPorts,
+  layerConfig,
+  ThreadObjectPorts,
   type CloudflareDurableRuntimeInitializationError,
   type CloudflareDurableRuntimeOptions,
   type CloudflareDurableRuntimeServices,
-} from "./layers.ts";
+  type CloudflareBootstrapServices,
+} from "./internal/layers.ts";
+import { ProgressWaitRegistry } from "./internal/progress-wait.ts";
+
+export {
+  layer,
+  layerConfig,
+  type ThreadPublicationOptions as PublicationOptions,
+  type CloudflareDurableRuntimeOptions as RuntimeOptions,
+  type CloudflareDurableRuntimeServices as Services,
+  type CloudflareDurableRuntimeInitializationError as InitializationError,
+  type CloudflareBootstrapServices as BootstrapServices,
+} from "./internal/layers.ts";
 
 /**
- * `makeConversationObjectClass(options, observability?)` — the Conversation Durable Object
+ * `ThreadObject.make(application, options)` — the Thread Durable Object
  * (plan §1.4,
  * D-P6-1): a factory returning a class that applications export from their Worker entry.
- * One SQLite-backed Object per Conversation is the serialized owner (durability §6); the
+ * One SQLite-backed Object per Thread is the serialized owner (durability §6); the
  * Object never runs `runResolvedWorker`'s infinite loop — each ingress event or alarm runs
- * ONE bounded `runRecovery` + `processConversationResolved` pass, and the persisted alarm
+ * ONE bounded `runRecovery` + `processThreadHead` pass, and the persisted alarm
  * (the single multiplexed slot, D-P6-2) finishes accepted work across evictions WITHOUT any
  * incoming request.
+ * `Services` exposes the same owner `SqlClient` used by the Thread stores. Compose optional
+ * local repositories after `ThreadObject.layer`; never acquire another independently locked
+ * SQL client for the same Object. Exposing the client installs no additional storage schemas.
  *
  * Constructor gate (`blockConcurrencyWhile`) is LOCAL-ONLY: schema migration and the
  * exact-version check, configuration decode, and the defensive ensure-alarm half of the
@@ -97,39 +131,62 @@ import {
  * `runRecovery` BEFORE any claim, so reconciliation still strictly precedes new work.
  */
 
-/** Construction options for one deployed Conversation Object class. */
-export interface ConversationObjectOptions extends CloudflareDurableRuntimeOptions {
+/** Construction options for one deployed Thread Object class. */
+export interface Options<
+  ApplicationServices = never,
+  EventServices = never,
+  EventLayerError = never,
+> extends CloudflareDurableRuntimeOptions {
+  /** Accept transient native RPC tracing through effect-cf; disabled by default. */
+  readonly rpcTracing?: boolean;
   /**
    * Name of the Worker `env` binding carrying THIS class's `DurableObjectNamespace` — the
-   * Object's route back to sibling Conversation Objects for the WP2 cross-Object port calls
+   * Object's route back to sibling Thread Objects for the WP2 cross-Object port calls
    * and remote wakes (DEPLOY-010: the binding enters through a Layer, never ambiently).
    */
   readonly namespaceBinding: string;
+  /** Acquired and finalized per native event, with access to the complete application runtime. */
+  readonly eventLayer?: Layer.Layer<
+    EventServices,
+    EventLayerError,
+    | RuntimeServices
+    | ApplicationServices
+    | EffectCfDurableObjectState.DurableObjectState
+    | WorkerEnvironment
+  >;
 }
 
-type EndpointServices = CloudflareDurableRuntimeServices | DurableObjectContext;
-type RuntimeServices = EndpointServices | ConversationObjectNamespace;
-type ConversationObjectInitializationError =
+type EndpointServices =
+  | CloudflareDurableRuntimeServices
+  | CloudflareBootstrapServices
+  | DurableObjectContext;
+type RuntimeServices = EndpointServices | ThreadObjectNamespace;
+type ThreadObjectInitializationError =
   | CloudflareDurableRuntimeInitializationError
   | CloudflareBindingError
   | MaintenancePassFailure;
 
-/** Port envelope tags whose owner-side execution durably mutates this Object's lane. */
-const MUTATING_PORT_TAGS: ReadonlySet<string> = new Set([
-  "LedgerAdmit",
-  "LedgerMarkReady",
-  "LedgerRequestAbort",
-  "LedgerRecordChildSettled",
-  "StoreMaterialize",
-  "StoreAppend",
-]);
+/** Classify only a decoded port request so new protocol members cannot bypass pre-arming. */
+const isMutatingPortRequest = (request: PortRequest): boolean => {
+  switch (request._tag) {
+    case "LedgerAdmit":
+    case "LedgerMarkReady":
+    case "LedgerRequestAbort":
+    case "LedgerRecordChildSettled":
+    case "StoreMaterialize":
+    case "StoreAppend":
+      return true;
+    case "LedgerLookup":
+    case "LedgerResolveAdmission":
+    case "StoreReadPage":
+    case "StoreInspectTail":
+    case "StoreExport":
+      return false;
+  }
+  request satisfies never;
 
-const isMutatingPortRequest = (encoded: unknown): boolean =>
-  typeof encoded === "object" &&
-  encoded !== null &&
-  "_tag" in encoded &&
-  typeof encoded._tag === "string" &&
-  MUTATING_PORT_TAGS.has(encoded._tag);
+  return false;
+};
 
 /** The literal encoded `PortFailed(PortProtocolError)` fallback (same shape as WP2's). */
 const encodedPortProtocolFailure = (message: string): unknown => ({
@@ -165,7 +222,7 @@ const encodeResponse = (response: HostResponse): Effect.Effect<unknown> =>
     ),
   );
 
-const utf8Bytes = (value: unknown): number =>
+const utf8Bytes = (value: PersistedJson): number =>
   new TextEncoder().encode(JSON.stringify(value)).length;
 
 /**
@@ -174,55 +231,57 @@ const utf8Bytes = (value: unknown): number =>
  * exempt: its accepted-work obligation already exists, and returning the original Receipt
  * consumes no new quota. Refusals are typed `AdmissionLimitExceeded` and nothing is written.
  */
-const gateAdmissionLimits = Effect.fn("ConversationObject.gateAdmissionLimits")(
-  function* (request: {
-    readonly principal: SubmissionLookupByKey["principal"];
-    readonly idempotencyKey: SubmissionLookupByKey["idempotencyKey"];
-    readonly inputPayload: PersistedJson;
-  }) {
-    const identity = yield* ConversationObjectIdentity;
-    const config = yield* CloudflareDurableRuntimeConfig;
-    const ledger = yield* SubmissionLedger;
-    const { ctx } = yield* DurableObjectContext;
-
-    const existing = yield* ledger.lookup(
-      SubmissionLookupByKey.make({
-        conversationId: identity.conversationId,
-        principal: request.principal,
-        idempotencyKey: request.idempotencyKey,
-      }),
-    );
-    if (Option.isSome(existing)) return;
-
-    const inputBytes = utf8Bytes(request.inputPayload);
-    if (inputBytes > config.limits.maxInputBytes) {
-      return yield* AdmissionLimitExceeded.make({
-        limit: "input-bytes",
-        actual: inputBytes,
-        maximum: config.limits.maxInputBytes,
-      });
-    }
+const gateAdmissionLimits = Effect.fn("ThreadObject.gateAdmissionLimits")(function* (request: {
+  readonly principal: SubmissionLookupByKey["principal"];
+  readonly idempotencyKey: SubmissionLookupByKey["idempotencyKey"];
+  readonly inputPayload: PersistedJson;
+}) {
+  const identity = yield* ThreadObjectIdentity;
+  const config = yield* CloudflareDurableRuntimeConfig;
+  const ledger = yield* SubmissionLedger;
+  const { ctx } = yield* DurableObjectContext;
+
+  const existing = yield* ledger.lookup(
+    SubmissionLookupByKey.make({
+      threadId: identity.threadId,
+      principal: request.principal,
+      idempotencyKey: request.idempotencyKey,
+    }),
+  );
 
-    // One Conversation per Object (durability §5): the local scan IS this lane's queue.
-    const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
-    if (nonterminal.length >= config.limits.maxQueueDepthPerLane) {
-      return yield* AdmissionLimitExceeded.make({
-        limit: "queue-depth",
-        actual: nonterminal.length,
-        maximum: config.limits.maxQueueDepthPerLane,
-      });
-    }
+  if (Option.isSome(existing)) return;
 
-    const databaseBytes = yield* Effect.sync(() => ctx.storage.sql.databaseSize);
-    if (databaseBytes > config.limits.maxDatabaseBytes) {
-      return yield* AdmissionLimitExceeded.make({
-        limit: "database-bytes",
-        actual: databaseBytes,
-        maximum: config.limits.maxDatabaseBytes,
-      });
-    }
-  },
-);
+  const inputBytes = utf8Bytes(request.inputPayload);
+
+  if (inputBytes > config.limits.maxInputBytes) {
+    return yield* AdmissionLimitExceeded.make({
+      limit: "input-bytes",
+      actual: inputBytes,
+      maximum: config.limits.maxInputBytes,
+    });
+  }
+
+  // One Thread per Object (durability §5): the local scan IS this lane's queue.
+  const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
+
+  if (nonterminal.length >= config.limits.maxQueueDepthPerLane) {
+    return yield* AdmissionLimitExceeded.make({
+      limit: "queue-depth",
+      actual: nonterminal.length,
+      maximum: config.limits.maxQueueDepthPerLane,
+    });
+  }
+
+  const databaseBytes = yield* Effect.sync(() => ctx.storage.sql.databaseSize);
+
+  if (databaseBytes > config.limits.maxDatabaseBytes) {
+    return yield* AdmissionLimitExceeded.make({
+      limit: "database-bytes",
+      actual: databaseBytes,
+      maximum: config.limits.maxDatabaseBytes,
+    });
+  }
+});
 
 /**
  * The submit-capable projection of an Agent Binding on the OBJECT side: the input arrived
@@ -242,22 +301,35 @@ const submitEndpoint = (encoded: unknown): Effect.Effect<unknown, never, Endpoin
     Effect.mapError(protocolFailure("The submit request could not be decoded")),
     Effect.flatMap((request) =>
       Effect.gen(function* () {
-        const identity = yield* ConversationObjectIdentity;
-        const maintenance = yield* ConversationMaintenance;
+        const identity = yield* ThreadObjectIdentity;
+        const maintenance = yield* ThreadMaintenance;
         const runtime = yield* DurableAgentRuntime;
+
         yield* gateAdmissionLimits(request);
-        // Alarm invariant: the alarm commits BEFORE the admission it will finish (D-P6-2).
-        yield* maintenance.preArm;
-        const receipt = yield* runtime.submit(
-          passthroughSubmitAgent(request.agentId),
-          request.inputPayload,
-          {
-            conversationId: identity.conversationId,
+
+        // Alarm invariant: the generation + alarm commit BEFORE the admission, and maintenance
+        // cannot acknowledge that generation until this mutation leaves its public RPC seam.
+        const receipt = yield* maintenance.withMutation(
+          runtime.submit(passthroughSubmitAgent(request.agentId), request.inputPayload, {
+            threadId: identity.threadId,
             principal: request.principal,
             idempotencyKey: request.idempotencyKey,
+            ...(request.admissionGroup === undefined
+              ? {}
+              : { admissionGroup: request.admissionGroup }),
+            ...(request.admissionFence === undefined
+              ? {}
+              : { admissionFence: request.admissionFence }),
+            ...(request.workerAdmission === undefined
+              ? {}
+              : { workerAdmission: request.workerAdmission }),
+            ...(request.messageAdmission === undefined
+              ? {}
+              : { messageAdmission: request.messageAdmission }),
             definitions: request.definitions,
-          },
+          }),
         );
+
         return SubmitSucceeded.make({ receipt });
       }),
     ),
@@ -265,6 +337,22 @@ const submitEndpoint = (encoded: unknown): Effect.Effect<unknown, never, Endpoin
     Effect.flatMap(encodeResponse),
   );
 
+const submissionStatusEndpoint = (
+  encoded: unknown,
+): Effect.Effect<unknown, never, EndpointServices> =>
+  decodeReceipt(encoded).pipe(
+    Effect.mapError(protocolFailure("The receipt could not be decoded")),
+    Effect.flatMap((receipt) =>
+      Effect.gen(function* () {
+        const runtime = yield* DurableAgentRuntime;
+
+        return SubmissionStatusResponse.make({ status: yield* runtime.submissionStatus(receipt) });
+      }),
+    ),
+    respond,
+    Effect.flatMap(encodeResponse),
+  );
+
 const awaitSettlementEndpoint = (
   encoded: unknown,
 ): Effect.Effect<unknown, never, EndpointServices> =>
@@ -274,6 +362,7 @@ const awaitSettlementEndpoint = (
       Effect.gen(function* () {
         const runtime = yield* DurableAgentRuntime;
         const settlement = yield* runtime.awaitSettlement(receipt);
+
         return SettlementReached.make({ settlement });
       }),
     ),
@@ -281,28 +370,73 @@ const awaitSettlementEndpoint = (
     Effect.flatMap(encodeResponse),
   );
 
+const awaitProgressEndpoint = (encoded: unknown): Effect.Effect<unknown, never, EndpointServices> =>
+  decodeAwaitProgressRequest(encoded).pipe(
+    Effect.mapError(protocolFailure("The progress request could not be decoded")),
+    Effect.flatMap((request) =>
+      Effect.gen(function* () {
+        const identity = yield* ThreadObjectIdentity;
+        const runtime = yield* DurableAgentRuntime;
+        const registry = yield* ProgressWaitRegistry;
+
+        yield* Effect.scoped(
+          Effect.gen(function* () {
+            const cancelled = yield* registry.subscribe(request.waiterId);
+
+            yield* Effect.raceFirst(
+              runtime.awaitProgress(identity.threadId, request.afterSequence),
+              cancelled,
+            );
+          }),
+        );
+
+        return ProgressObserved.make();
+      }),
+    ),
+    respond,
+    Effect.flatMap(encodeResponse),
+  );
+
+const cancelProgressEndpoint = (
+  encoded: unknown,
+): Effect.Effect<unknown, never, EndpointServices> =>
+  decodeCancelProgressRequest(encoded).pipe(
+    Effect.mapError(protocolFailure("The progress cancellation could not be decoded")),
+    Effect.flatMap((request) =>
+      Effect.gen(function* () {
+        const registry = yield* ProgressWaitRegistry;
+
+        yield* registry.cancel(request.waiterId);
+
+        return ProgressCancelled.make();
+      }),
+    ),
+    respond,
+    Effect.flatMap(encodeResponse),
+  );
+
 const observePageEndpoint = (encoded: unknown): Effect.Effect<unknown, never, EndpointServices> =>
   decodeObservePageRequest(encoded).pipe(
     Effect.mapError(protocolFailure("The observe request could not be decoded")),
     Effect.flatMap((request) =>
       Effect.gen(function* () {
-        const identity = yield* ConversationObjectIdentity;
-        const store = yield* ConversationStore;
+        const identity = yield* ThreadObjectIdentity;
+        const store = yield* ThreadStore;
         // The same fail-closed authorization seam the runtime's `observe` consults (P7 WP1);
         // the default reference preserves the possession behavior.
         const authorizer = yield* OperationAuthorizer;
-        yield* authorizer
-          .authorize(
-            OperationAuthorizationRequest.make({
-              operation: "observe",
-              conversationId: identity.conversationId,
-            }),
-          )
-          .pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
+
+        yield* authorizer.authorize(
+          OperationAuthorizationRequest.make({
+            operation: "observe",
+            threadId: identity.threadId,
+          }),
+        );
+
         const records = yield* Stream.runCollect(
           store.read(
-            ConversationRead.make({
-              conversationId: identity.conversationId,
+            ThreadRead.make({
+              threadId: identity.threadId,
               ...(request.afterSequence === undefined
                 ? {}
                 : { afterSequence: request.afterSequence }),
@@ -310,6 +444,7 @@ const observePageEndpoint = (encoded: unknown): Effect.Effect<unknown, never, En
             }),
           ),
         );
+
         return ObservedPage.make({ records: [...records] });
       }),
     ),
@@ -322,10 +457,10 @@ const abortEndpoint = (encoded: unknown): Effect.Effect<unknown, never, Endpoint
     Effect.mapError(protocolFailure("The abort command could not be decoded")),
     Effect.flatMap((command) =>
       Effect.gen(function* () {
-        const maintenance = yield* ConversationMaintenance;
+        const maintenance = yield* ThreadMaintenance;
         const runtime = yield* DurableAgentRuntime;
-        yield* maintenance.preArm;
-        const intent = yield* runtime.abort(command);
+        const intent = yield* maintenance.withMutation(runtime.abort(command));
+
         return AbortRecorded.make({ intent });
       }),
     ),
@@ -333,24 +468,6 @@ const abortEndpoint = (encoded: unknown): Effect.Effect<unknown, never, Endpoint
     Effect.flatMap(encodeResponse),
   );
 
-/**
- * The pre-P7 host protocol's failure union does not carry `OperationDenied` (the Worker client
- * predates the authorizer). This assembly always runs the default possession authorizer — no
- * `CloudflareDurableRuntimeOptions` authorizer lever exists yet — so a denial here is
- * unreachable today; if one ever surfaces it degrades to the protocol failure instead of an
- * out-of-contract throw. The four P7 admin entry points below carry `OperationDenied` typed.
- */
-const deniedToProtocolFailure = (
-  denied: OperationDenied,
-): Effect.Effect<never, HostProtocolError> =>
-  Effect.fail(
-    HostProtocolError.make({
-      message: boundHostDiagnostic(
-        `The ${denied.operation} operation was denied: ${denied.reason}`,
-      ),
-    }),
-  );
-
 const resolveApprovalEndpoint = (
   encoded: unknown,
 ): Effect.Effect<unknown, never, EndpointServices> =>
@@ -358,12 +475,10 @@ const resolveApprovalEndpoint = (
     Effect.mapError(protocolFailure("The approval command could not be decoded")),
     Effect.flatMap((command) =>
       Effect.gen(function* () {
-        const maintenance = yield* ConversationMaintenance;
+        const maintenance = yield* ThreadMaintenance;
         const runtime = yield* DurableAgentRuntime;
-        yield* maintenance.preArm;
-        const intent = yield* runtime
-          .resolveApproval(command)
-          .pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
+        const intent = yield* maintenance.withMutation(runtime.resolveApproval(command));
+
         return ApprovalRecorded.make({ intent });
       }),
     ),
@@ -378,12 +493,10 @@ const resolveUnknownEndpoint = (
     Effect.mapError(protocolFailure("The resolution command could not be decoded")),
     Effect.flatMap((command) =>
       Effect.gen(function* () {
-        const maintenance = yield* ConversationMaintenance;
+        const maintenance = yield* ThreadMaintenance;
         const runtime = yield* DurableAgentRuntime;
-        yield* maintenance.preArm;
-        const intent = yield* runtime
-          .resolveUnknown(command)
-          .pipe(Effect.catchTag("OperationDenied", deniedToProtocolFailure));
+        const intent = yield* maintenance.withMutation(runtime.resolveUnknown(command));
+
         return UnknownResolutionRecorded.make({ intent });
       }),
     ),
@@ -413,6 +526,7 @@ export class AdminVerifyRequest extends Schema.Class<AdminVerifyRequest>(
 
 /** Every typed failure of the four admin entry points, plus the protocol's own errors. */
 export const AdminFailure = Schema.Union([
+  AdmissionPolicyError,
   OperationDenied,
   RetryRefused,
   LedgerError,
@@ -420,14 +534,15 @@ export const AdminFailure = Schema.Union([
   DigestError,
   OwnershipLost,
   SettlementConflict,
-  ConversationStoreError,
-  ConversationNotMaterialized,
+  ThreadStoreError,
+  ThreadNotMaterialized,
   AppendConflict,
   FenceRejected,
   DurableRuntimeFailpointError,
   DurableAlarmError,
   HostProtocolError,
 ]);
+
 export type AdminFailure = typeof AdminFailure.Type;
 
 export class ExplainedRecovery extends Schema.TaggedClass<ExplainedRecovery>(
@@ -469,6 +584,7 @@ export const AdminResponse = Schema.Union([
   ObligationsScanned,
   AdminFailed,
 ]);
+
 export type AdminResponse = typeof AdminResponse.Type;
 
 export const decodeAdminExplainRequest = Schema.decodeUnknownEffect(AdminExplainRequest);
@@ -506,12 +622,14 @@ const explainEndpoint = (encoded: unknown): Effect.Effect<unknown, never, Endpoi
     Effect.mapError(protocolFailure("The explain request could not be decoded")),
     Effect.flatMap((request) =>
       Effect.gen(function* () {
-        const identity = yield* ConversationObjectIdentity;
+        const identity = yield* ThreadObjectIdentity;
         const runtime = yield* DurableAgentRuntime;
+
         const explanations =
           request.submissionId === undefined
-            ? yield* runtime.explainConversation(identity.conversationId)
+            ? yield* runtime.explainThread(identity.threadId)
             : [yield* runtime.explain(request.submissionId)];
+
         return ExplainedRecovery.make({ explanations });
       }),
     ),
@@ -524,9 +642,10 @@ const verifyEndpoint = (encoded: unknown): Effect.Effect<unknown, never, Endpoin
     Effect.mapError(protocolFailure("The verify request could not be decoded")),
     Effect.flatMap(() =>
       Effect.gen(function* () {
-        const identity = yield* ConversationObjectIdentity;
+        const identity = yield* ThreadObjectIdentity;
         const runtime = yield* DurableAgentRuntime;
-        const report = yield* runtime.verify(identity.conversationId);
+        const report = yield* runtime.verify(identity.threadId);
+
         return VerifiedIntegrity.make({ report });
       }),
     ),
@@ -539,12 +658,11 @@ const retryEndpoint = (encoded: unknown): Effect.Effect<unknown, never, Endpoint
     Effect.mapError(protocolFailure("The retry command could not be decoded")),
     Effect.flatMap((command) =>
       Effect.gen(function* () {
-        const maintenance = yield* ConversationMaintenance;
+        const maintenance = yield* ThreadMaintenance;
         const runtime = yield* DurableAgentRuntime;
-        // Alarm invariant: retry may repair durable state, so the alarm that will finish the
-        // lane commits BEFORE the mutation (D-P6-2), exactly like abort.
-        yield* maintenance.preArm;
-        const report = yield* runtime.retry(command);
+        // Retry may repair durable state, so its generation + alarm commit before the mutation.
+        const report = yield* maintenance.withMutation(runtime.retry(command));
+
         return RetryExecuted.make({ report });
       }),
     ),
@@ -559,6 +677,7 @@ const obligationsEndpoint = (encoded: unknown): Effect.Effect<unknown, never, En
       Effect.gen(function* () {
         const runtime = yield* DurableAgentRuntime;
         const report = yield* runtime.scanObligations(thresholds);
+
         return ObligationsScanned.make({ report });
       }),
     ),
@@ -567,62 +686,90 @@ const obligationsEndpoint = (encoded: unknown): Effect.Effect<unknown, never, En
   );
 
 /**
- * Owner-side `portCall`: pre-arm before a mutating envelope (a routed admission committed by
- * THIS Object must already carry the alarm that will finish it), execute on the LOCAL facets
- * (never the routed decorators), then arm an immediate alarm so the mutated lane is
- * processed promptly. Protocol anomalies answer `PortFailed(PortProtocolError)`.
+ * Owner-side `portCall`: wrap a mutating envelope in the same pre-armed generation protocol as
+ * public RPC (a routed mutation committed by THIS Object must already carry the alarm that will
+ * finish it), execute on the LOCAL facets (never the routed decorators), then arm an immediate
+ * alarm so the mutated lane is processed promptly. Protocol anomalies answer
+ * `PortFailed(PortProtocolError)`.
  */
 const portCallEndpoint = (encoded: unknown): Effect.Effect<unknown, never, EndpointServices> =>
   Effect.gen(function* () {
-    const ports = yield* ConversationObjectPorts;
-    const maintenance = yield* ConversationMaintenance;
+    const ports = yield* ThreadObjectPorts;
+    const maintenance = yield* ThreadMaintenance;
     const alarm = yield* DurableAlarmService;
-    const mutating = isMutatingPortRequest(encoded);
-    if (mutating) {
-      const preArmed = yield* maintenance.preArm.pipe(Effect.exit);
-      if (preArmed._tag === "Failure") {
-        // Without the committed alarm the invariant cannot be promised; refuse the mutation.
-        return encodedPortProtocolFailure(
-          "The owner Object could not arm its maintenance alarm before the mutation.",
-        );
-      }
+
+    const decoded = yield* decodePortRequest(encoded).pipe(
+      Effect.map((request) => ({ _tag: "success" as const, request })),
+      Effect.catch((error) => Effect.succeed({ _tag: "failure" as const, message: error.message })),
+    );
+
+    if (decoded._tag === "failure") {
+      return encodedPortProtocolFailure(
+        `The port request could not be decoded: ${decoded.message}`,
+      );
+    }
+    const mutating = isMutatingPortRequest(decoded.request);
+
+    const handled = yield* (
+      mutating
+        ? maintenance.withMutation(ports.handle(decoded.request))
+        : ports.handle(decoded.request)
+    ).pipe(Effect.exit);
+
+    if (handled._tag === "Failure") {
+      // Without the committed generation/alarm the invariant cannot be promised; refuse before
+      // the port mutation runs. `ports.handle` itself is total, so this is the maintenance error.
+      return encodedPortProtocolFailure(
+        "The owner Object could not arm its maintenance alarm before the mutation.",
+      );
     }
-    const response = yield* ports.handle(encoded);
+
+    const response = yield* encodePortResponse(handled.value).pipe(
+      Effect.catch((error) =>
+        Effect.succeed(
+          encodedPortProtocolFailure(`The port response could not be encoded: ${error.message}`),
+        ),
+      ),
+    );
+
     if (mutating) {
       // Prompt processing hint; the pre-armed alarm already guarantees convergence.
       yield* alarm.scheduleNow.pipe(
         Effect.catch((error) =>
-          Effect.logWarning("ConversationObject.portCall: immediate re-arm failed", error),
+          Effect.logWarning("ThreadObject.portCall: immediate re-arm failed", error),
         ),
       );
     }
+
     return response;
   });
 
 const wakeEndpoint: Effect.Effect<void, never, EndpointServices> = Effect.gen(function* () {
-  const alarm = yield* DurableAlarmService;
-  // Wake hints are droppable by contract: a failed alarm write is logged and swallowed; the
-  // sender's own alarm/scan pairing (or this Object's next entry point) restores liveness.
-  yield* alarm.scheduleNow.pipe(
-    Effect.catch((error) => Effect.logWarning("ConversationObject.wake dropped", error)),
-  );
+  const identity = yield* ThreadObjectIdentity;
+  const wake = yield* WakeScheduler;
+
+  // Route the remote hint through this incarnation's scheduler so scoped progress waiters and
+  // the alarm receive the same hint. Delivery remains droppable; canonical storage is authority.
+  yield* wake.notify(identity.threadId);
 });
 
 const alarmEndpoint: Effect.Effect<void, MaintenancePassFailure, EndpointServices> = Effect.gen(
   function* () {
-    const maintenance = yield* ConversationMaintenance;
+    const maintenance = yield* ThreadMaintenance;
+
     // Typed pass failures propagate: the rejected promise makes workerd retry the alarm
-    // (at-least-once delivery), and the pass's own pre-arm keeps the slot committed meanwhile.
+    // (at-least-once delivery), and the dirty generation retains a committed slot meanwhile.
     yield* maintenance.pass;
   },
 );
 
 const gateEndpoint: Effect.Effect<void, MaintenancePassFailure, EndpointServices> = Effect.gen(
   function* () {
-    // Forcing ConversationMaintenance forces the whole Layer stack: migration + exact-version
+    // Forcing ThreadMaintenance forces the whole Layer stack: migration + exact-version
     // check + configuration decode (DEPLOY-008 fails typed here, before any mutation), then
     // the defensive local ensure-alarm half of the invariant. LOCAL-ONLY by construction.
-    const maintenance = yield* ConversationMaintenance;
+    const maintenance = yield* ThreadMaintenance;
+
     yield* maintenance.ensureAlarm;
   },
 );
@@ -634,8 +781,9 @@ const gateEndpoint: Effect.Effect<void, MaintenancePassFailure, EndpointServices
  */
 const effectCfPlatformLayer = (
   namespaceBinding: string,
+  rpcTracing = false,
 ): Layer.Layer<
-  DurableObjectContext | ConversationObjectNamespace,
+  DurableObjectContext | ThreadObjectNamespace,
   CloudflareBindingError,
   EffectCfDurableObjectState.DurableObjectState | WorkerEnvironment
 > => {
@@ -643,27 +791,39 @@ const effectCfPlatformLayer = (
     Effect.gen(function* () {
       const state = yield* EffectCfDurableObjectState.DurableObjectState;
       const env = yield* WorkerEnvironment;
+
       return DurableObjectContext.of({ ctx: state.raw, env });
     }),
   );
-  const namespace = Layer.effect(ConversationObjectNamespace)(
+
+  const namespace = Layer.effect(ThreadObjectNamespace)(
     Effect.gen(function* () {
       const env = yield* WorkerEnvironment;
-      const binding = yield* conversationNamespaceFromEnv(env, namespaceBinding);
-      return ConversationObjectNamespace.of({ namespace: binding });
+      const binding = yield* threadNamespaceFromEnv(env, namespaceBinding);
+
+      return ThreadObjectNamespace.of({
+        namespace: binding,
+        ...(rpcTracing === true ? { rpcTracing: namespaceBinding } : {}),
+      });
     }),
   );
+
   return Layer.merge(context, namespace);
 };
 
-/** The public endpoint surface of one Conversation Object instance. */
-export interface ConversationObjectInstance extends CloudflareDurableObject {
-  submitEncoded(encoded: unknown): Promise<unknown>;
-  awaitSettlementEncoded(encoded: unknown): Promise<unknown>;
-  observePage(encoded: unknown): Promise<unknown>;
-  abortEncoded(encoded: unknown): Promise<unknown>;
-  resolveApprovalEncoded(encoded: unknown): Promise<unknown>;
-  resolveUnknownEncoded(encoded: unknown): Promise<unknown>;
+/** The public endpoints and effect-cf invocation hook of one Thread Object instance. */
+export interface Instance<EventServices = never> extends InstanceType<
+  EffectCfDurableObject.DurableObjectClass<Record<never, never>, RuntimeServices | EventServices>
+> {
+  submitEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  submissionStatusEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  awaitSettlementEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  awaitProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  cancelProgressEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  observePage(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  abortEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  resolveApprovalEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
+  resolveUnknownEncoded(encoded: unknown, traceContext?: unknown): Promise<unknown>;
   explainEncoded(encoded: unknown): Promise<unknown>;
   verifyEncoded(encoded: unknown): Promise<unknown>;
   retryEncoded(encoded: unknown): Promise<unknown>;
@@ -673,52 +833,60 @@ export interface ConversationObjectInstance extends CloudflareDurableObject {
   alarm(alarmInfo?: AlarmInvocationInfo): Promise<void> | void;
 }
 
-/** The constructor shape workerd instantiates for each Conversation Object. */
-export interface ConversationObjectClass {
-  new (ctx: DurableObjectState, env: Cloudflare.Env): ConversationObjectInstance;
+/** The constructor shape workerd instantiates for each Thread Object. */
+export interface Class<EventServices = never> {
+  new (ctx: DurableObjectState, env: Cloudflare.Env): Instance<EventServices>;
 }
 
 /**
- * Build the application's Conversation Object class (export it from the Worker entry).
- * effect-cf owns the cached ManagedRuntime, native RPC methods, event scopes, and post-handler
- * OTLP flush scheduling for RPC and alarm events. The optional outer Layer is built per native
- * event, so a host can install Tracer/Logger/Metric services and `OtlpExporter.Flusher` without
- * Effect Agent owning exporter lifecycle machinery.
+ * Export a composed application Layer as a native Durable Object class.
+ * Bootstrap services are provided to the whole graph before it acquires, so application Layers
+ * can yield effect-cf's WorkerEnvironment and DurableObjectState, derived identity, and Crypto.
+ * Application dependencies remain visible until Layer.provide satisfies them. effect-cf owns the
+ * cached ManagedRuntime, native RPC methods, event scopes, and telemetry flushing.
+ * Initialization is local and bounded inside the constructor gate. Cloudflare eviction does not
+ * guarantee finalizers; put resources requiring timely release in scoped operations or eventLayer.
  */
-export const makeConversationObjectClass = <EventLayerError = never, EventServices = never>(
-  options: ConversationObjectOptions,
-  observability?: Layer.Layer<
-    EventServices,
-    EventLayerError,
-    | DurableObjectContext
-    | ConversationObjectNamespace
+export const make = <
+  ApplicationServices,
+  ApplicationError,
+  EventServices = never,
+  EventLayerError = never,
+>(
+  applicationLayer: Layer.Layer<
+    CloudflareDurableRuntimeServices | ApplicationServices,
+    ApplicationError,
+    | CloudflareBootstrapServices
     | EffectCfDurableObjectState.DurableObjectState
     | WorkerEnvironment
+    | DurableObjectContext
+    | ThreadObjectNamespace
   >,
-): ConversationObjectClass => {
-  const application: Layer.Layer<
-    RuntimeServices,
-    CloudflareDurableRuntimeInitializationError | CloudflareBindingError,
-    EffectCfDurableObjectState.DurableObjectState | WorkerEnvironment
-  > = CloudflareDurableRuntime.layer(options).pipe(
-    Layer.provideMerge(effectCfPlatformLayer(options.namespaceBinding)),
+  options: Options<ApplicationServices, EventServices, EventLayerError>,
+): Class<ApplicationServices | EventServices> => {
+  const application = applicationLayer.pipe(
+    Layer.provideMerge(layerConfig(options)),
+    Layer.provideMerge(effectCfPlatformLayer(options.namespaceBinding, options.rpcTracing)),
   );
 
   // The storage/config Layer must acquire inside Cloudflare's constructor gate. effect-cf owns
   // the ManagedRuntime, while this effectContext ensures its first Layer build enters the gate
   // before migration, compatibility checks, or alarm inspection touch Object storage.
   const runtime: Layer.Layer<
-    RuntimeServices,
-    ConversationObjectInitializationError,
+    RuntimeServices | ApplicationServices,
+    ThreadObjectInitializationError | ApplicationError,
     EffectCfDurableObjectState.DurableObjectState | WorkerEnvironment
   > = Layer.effectContext(
     Effect.gen(function* () {
       const state = yield* EffectCfDurableObjectState.DurableObjectState;
       const scope = yield* Effect.scope;
+
       return yield* state.blockConcurrencyWhile(
         Effect.gen(function* () {
           const services = yield* Layer.buildWithScope(application, scope);
+
           yield* gateEndpoint.pipe(Effect.provide(services));
+
           return services;
         }),
       );
@@ -727,7 +895,10 @@ export const makeConversationObjectClass = <EventLayerError = never, EventServic
 
   const rpc = {
     submitEncoded: (encoded: unknown) => submitEndpoint(encoded),
+    submissionStatusEncoded: (encoded: unknown) => submissionStatusEndpoint(encoded),
     awaitSettlementEncoded: (encoded: unknown) => awaitSettlementEndpoint(encoded),
+    awaitProgressEncoded: (encoded: unknown) => awaitProgressEndpoint(encoded),
+    cancelProgressEncoded: (encoded: unknown) => cancelProgressEndpoint(encoded),
     observePage: (encoded: unknown) => observePageEndpoint(encoded),
     abortEncoded: (encoded: unknown) => abortEndpoint(encoded),
     resolveApprovalEncoded: (encoded: unknown) => resolveApprovalEndpoint(encoded),
@@ -738,31 +909,44 @@ export const makeConversationObjectClass = <EventLayerError = never, EventServic
     obligationsEncoded: (encoded: unknown) => obligationsEndpoint(encoded),
     portCall: (encoded: unknown) => portCallEndpoint(encoded),
     wake: () => wakeEndpoint,
-  } satisfies EffectCfDurableObject.DurableObjectRpc<RuntimeServices | EventServices>;
+  } satisfies EffectCfDurableObject.DurableObjectRpc<
+    RuntimeServices | ApplicationServices | EventServices
+  >;
 
-  const EffectCfConversationObject = EffectCfDurableObject.make<
-    RuntimeServices,
-    ConversationObjectInitializationError,
+  type NativeOptions = EffectCfDurableObject.DurableObjectOptions<
+    RuntimeServices | ApplicationServices,
+    EventServices,
+    EventLayerError,
+    typeof rpc
+  >;
+
+  const EffectCfThreadObject = EffectCfDurableObject.make<
+    RuntimeServices | ApplicationServices,
+    ThreadObjectInitializationError | ApplicationError,
     EventServices,
     EventLayerError,
     typeof rpc
   >(runtime, {
-    ...(observability === undefined ? {} : { eventLayer: observability }),
+    ...(options.rpcTracing === true ? { rpcTracing: { service: options.namespaceBinding } } : {}),
+    ...(options.eventLayer === undefined ? {} : { eventLayer: options.eventLayer }),
     // Force the gated runtime Layer when Cloudflare loads this Object incarnation. Recovery stays
     // in each bounded pass so cross-Object initialization cannot deadlock.
     initialize: Effect.void,
     rpc,
     alarm: () => alarmEndpoint,
-  });
+    // This host owns the raw alarm and supplies event services through options.eventLayer.
+    // Upstream's conditional alarm-registration check cannot reduce over generic application
+    // services. Options and the rpc satisfies check above retain their Effect requirements.
+  } as NativeOptions);
 
   // effect-cf's class type keeps `alarm` optional even when the handler option is present. This
   // concrete override reflects this factory's stronger contract while delegating execution to
   // the effect-cf runtime unchanged.
-  class ConversationObject extends EffectCfConversationObject {
+  class ThreadObject extends EffectCfThreadObject {
     override alarm(alarmInfo?: AlarmInvocationInfo): Promise<void> | void {
       return super.alarm?.(alarmInfo);
     }
   }
 
-  return ConversationObject;
+  return ThreadObject;
 };