@effect-agent/storage-cloudflare 0.0.1-beta.0

package/src/do-storage-config.ts

@@ -0,0 +1,53 @@
+import { Context, Schema } from "effect";
+
+const ObservationPollInterval = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+const OwnershipLeaseMillis = Schema.Int.check(Schema.isGreaterThan(0));
+
+/**
+ * Default per-value byte bound, kept under the Durable Object platform's 2 MB SQLite value
+ * limit with a safety margin. This is the DC analogue of Node's 16 MB `BoundedStoredText`
+ * bound: both fail typed before mutating, only the threshold differs (a documented DN/DC
+ * behavioral difference; Travel Planner payloads sit orders of magnitude below both).
+ */
+export const DEFAULT_MAX_STORED_VALUE_BYTES = 1_900_000;
+
+/** The hard schema ceiling for the configurable bound: never at or above the platform limit. */
+const MaxStoredValueBytes = Schema.Int.check(
+  Schema.isGreaterThan(0),
+  Schema.isLessThanOrEqualTo(2_000_000),
+);
+
+/**
+ * Validated construction configuration consumed by the Durable Object storage Layers. The
+ * storage identity itself belongs to the SqlClient Layer (built from `ctx.storage`);
+ * duplicating it here could silently diverge from the handle actually in use.
+ */
+export class DoStorageConfigValue extends Schema.Class<DoStorageConfigValue>(
+  "@effect-agent/storage-cloudflare/DoStorageConfigValue",
+)({
+  observationPollInterval: ObservationPollInterval,
+  /**
+   * Submission ownership lease duration in milliseconds (D5). Inside one Durable Object the
+   * object itself is the serialized owner, so the lease's primary DC role is fencing work
+   * across DO incarnations (an evicted incarnation's claim becomes reclaimable); correctness
+   * never depends on it because every canonical append is fenced by producer epoch.
+   */
+  ownershipLeaseDuration: OwnershipLeaseMillis,
+  /**
+   * Maximum bytes for any single stored text value (canonical batch/record JSON, admission
+   * input payload, checkpoint JSON). Enforced typed BEFORE any write; must stay under the
+   * platform's 2 MB per-value limit.
+   */
+  maxStoredValueBytes: MaxStoredValueBytes,
+  /**
+   * Re-verify every stored payload and digest chain while opening the store. Per-operation
+   * Schema decoding and the digest chain already fail clearly on corrupt rows, so the full
+   * scan is an explicit opt-in integrity audit rather than a startup requirement.
+   */
+  verifyOnOpen: Schema.Boolean,
+}) {}
+
+/** Explicit Durable Object storage configuration authority. */
+export class DoStorageConfig extends Context.Service<DoStorageConfig, DoStorageConfigValue>()(
+  "@effect-agent/storage-cloudflare/DoStorageConfig",
+) {}

package/src/do-storage-failpoint.ts

@@ -0,0 +1,87 @@
+import { Context, Effect, Layer, Ref } from "effect";
+
+import { DoStorageFailpointError, type DoStorageFailpointLocation } from "./errors.ts";
+
+export type DoStorageFailpointHandler = (
+  location: DoStorageFailpointLocation,
+) => Effect.Effect<void, DoStorageFailpointError>;
+
+const noFailpoint: DoStorageFailpointHandler = () => Effect.void;
+
+/** Test-only control for replacing the active Durable Object failpoint handler. */
+export class DoStorageFailpointTestControl extends Context.Service<
+  DoStorageFailpointTestControl,
+  {
+    readonly clear: Effect.Effect<void>;
+    readonly setHandler: (handler: DoStorageFailpointHandler) => Effect.Effect<void>;
+  }
+>()("@effect-agent/storage-cloudflare/DoStorageFailpointTestControl") {}
+
+/** Explicit fault-injection authority used at Durable Object storage operation boundaries. */
+export class DoStorageFailpoint extends Context.Service<
+  DoStorageFailpoint,
+  {
+    readonly hit: DoStorageFailpointHandler;
+  }
+>()("@effect-agent/storage-cloudflare/DoStorageFailpoint") {
+  /** Production default: no fault injection. */
+  static readonly layer = Layer.succeed(this)({ hit: noFailpoint });
+
+  /** Reusable test Layer with a control service backed by the same handler Ref. */
+  static readonly layerTest = Layer.effectContext(
+    Effect.gen(function* () {
+      const handler = yield* Ref.make<DoStorageFailpointHandler>(noFailpoint);
+      return Context.make(
+        DoStorageFailpoint,
+        DoStorageFailpoint.of({
+          hit: (location) => Ref.get(handler).pipe(Effect.flatMap((current) => current(location))),
+        }),
+      ).pipe(
+        Context.add(
+          DoStorageFailpointTestControl,
+          DoStorageFailpointTestControl.of({
+            clear: Ref.set(handler, noFailpoint),
+            setHandler: (next) => Ref.set(handler, next),
+          }),
+        ),
+      );
+    }),
+  );
+}
+
+/**
+ * The DC-specific eviction failpoint mode: instead of failing typed, an armed hit evicts the
+ * Durable Object through an injected `evict` thunk — in production-shaped harnesses that thunk
+ * is `() => ctx.abort()`, the platform's real failure mode. `ctx.abort()` never returns (it
+ * throws while destroying the in-memory instance and every in-flight implicit or explicit
+ * storage transaction rolls back), so an armed hit ends the current Attempt exactly like an
+ * unannounced platform eviction; DO storage — the only correctness-critical state — survives
+ * for the next incarnation, which the persisted alarm wakes without any incoming request.
+ *
+ * The handles stay injected: this package never imports `cloudflare:workers`, so the harness
+ * that owns a `DurableObjectState` supplies the thunk.
+ */
+export const evictionFailpointHandler =
+  (options: {
+    readonly isArmed: (location: DoStorageFailpointLocation) => Effect.Effect<boolean>;
+    /** Kills the incarnation — e.g. `() => ctx.abort()`. Typed `void` because the platform
+     * declares `abort` as returning, but it throws while destroying the instance. */
+    readonly evict: (location: DoStorageFailpointLocation) => void;
+  }): DoStorageFailpointHandler =>
+  (location) =>
+    options.isArmed(location).pipe(
+      Effect.flatMap((armed) =>
+        armed
+          ? // `ctx.abort()` throws while destroying the instance; that throw surfaces as a
+            // defect in the (already dying) incarnation. The defensive throw below keeps the
+            // guarantee — nothing after an armed hit may observe in-memory state — even if a
+            // harness supplies an evict thunk that returns.
+            Effect.sync((): never => {
+              options.evict(location);
+              throw new Error(
+                `Durable Object eviction did not interrupt execution at ${location}.`,
+              );
+            })
+          : Effect.void,
+      ),
+    );

package/src/errors.ts

@@ -0,0 +1,170 @@
+import { CanonicalSequence, ProducerEpoch } from "@effect-agent/session";
+import { Schema } from "effect";
+
+/** The Durable Object's SQLite storage uses a private-development format this adapter cannot read. */
+export class DoStorageCompatibilityError extends Schema.TaggedError<DoStorageCompatibilityError>()(
+  "DoStorageCompatibilityError",
+  {
+    actualVersion: Schema.Int,
+    message: Schema.String,
+    supportedVersion: Schema.Int,
+  },
+) {}
+
+/** Stored bytes failed the current Schema and cannot be used as recovery truth. */
+export class DoStorageCorruptionError extends Schema.TaggedError<DoStorageCorruptionError>()(
+  "DoStorageCorruptionError",
+  {
+    message: Schema.String,
+    rowKey: Schema.String,
+    table: Schema.String,
+  },
+) {}
+
+/** Durable Object SQLite infrastructure failed while opening or operating the store. */
+export class DoStorageError extends Schema.TaggedError<DoStorageError>()("DoStorageError", {
+  cause: Schema.optionalKey(Schema.Defect()),
+  message: Schema.String,
+  operation: Schema.String,
+}) {}
+
+/**
+ * Durable Object SQLite infrastructure failed while operating the Submission Ledger. Surfaces
+ * at the SubmissionLedger port as the typed `LedgerError` with this error preserved as its
+ * cause, so the adapter-level tag is never erased.
+ */
+export class DoLedgerError extends Schema.TaggedError<DoLedgerError>()("DoLedgerError", {
+  cause: Schema.optionalKey(Schema.Defect()),
+  message: Schema.String,
+  operation: Schema.String,
+}) {}
+
+/**
+ * A value to be stored exceeds the configured Durable Object per-value bound
+ * (`DoStorageConfigValue.maxStoredValueBytes`, kept under the platform's 2 MB SQLite value
+ * limit). The refusal happens typed BEFORE any durable mutation; no partial state is written.
+ * Payloads of this size are the designed overflow case for a future R2-backed AttachmentStore
+ * (deployment spec §3.1, deferred until a real attachment requirement exists).
+ */
+export class DoValueBoundExceeded extends Schema.TaggedError<DoValueBoundExceeded>()(
+  "DoValueBoundExceeded",
+  {
+    actualBytes: Schema.Int,
+    maxBytes: Schema.Int,
+    operation: Schema.String,
+  },
+) {
+  override get message() {
+    return (
+      `A stored value of ${this.actualBytes} bytes exceeds the Durable Object per-value bound ` +
+      `of ${this.maxBytes} bytes during ${this.operation}. Nothing was written. Values of this ` +
+      "size are the designed R2 AttachmentStore overflow path (deferred, deployment spec §3.1)."
+    );
+  }
+}
+
+/**
+ * A canonical batch retry conflicts with existing append state. Tail conflicts carry the
+ * actual committed tail as a diagnostic resume hint.
+ */
+export class DoAppendConflict extends Schema.TaggedError<DoAppendConflict>()("DoAppendConflict", {
+  message: Schema.String,
+  reason: Schema.Literals(["batch-digest", "record-identity", "tail"]),
+  actualTailSequence: Schema.optionalKey(CanonicalSequence),
+  actualTailDigest: Schema.optionalKey(Schema.String),
+}) {}
+
+/**
+ * A producer epoch does not match the Conversation's current writer registration. Appends
+ * require the exact registered epoch, so both older and newer unregistered epochs are fenced;
+ * a newer epoch takes over by materializing first.
+ */
+export class DoFenceRejected extends Schema.TaggedError<DoFenceRejected>()("DoFenceRejected", {
+  actualEpoch: ProducerEpoch,
+  message: Schema.String,
+  producerEpoch: ProducerEpoch,
+}) {}
+
+/** A checkpoint conflicts with a previously stored checkpoint at the same offset. */
+export class DoCheckpointConflict extends Schema.TaggedError<DoCheckpointConflict>()(
+  "DoCheckpointConflict",
+  {
+    message: Schema.String,
+  },
+) {}
+
+/**
+ * Deterministic fault-injection locations at Durable Object storage operation boundaries.
+ *
+ * The string list is copied VERBATIM from `SqliteStorageFailpointLocation`
+ * (`packages/storage-sqlite/src/errors.ts`) so every crash-matrix row keeps the same name on
+ * both platforms — the DN process-kill evidence and the DC eviction evidence address identical
+ * locations. There is intentionally no Cloudflare-only location.
+ */
+export const DoStorageFailpointLocation = Schema.Literals([
+  "materialize:before",
+  "materialize:after",
+  "append:before",
+  "append:after-batch-insert",
+  "append:after-record-insert",
+  "append:after-tail-update",
+  "append:after",
+  "export:after-conversation-read",
+  "save-checkpoint:before",
+  "save-checkpoint:after",
+  "ledger:admit:before",
+  "ledger:admit:after",
+  "ledger:mark-ready:before",
+  "ledger:mark-ready:after",
+  "ledger:claim:before",
+  "ledger:claim:after",
+  "ledger:mark-input-applied:before",
+  "ledger:mark-input-applied:after",
+  "ledger:renew:before",
+  "ledger:renew:after",
+  "ledger:reserve-settlement:before",
+  "ledger:reserve-settlement:after",
+  "ledger:finalize-settlement:before",
+  "ledger:finalize-settlement:after",
+  "ledger:request-abort:before",
+  "ledger:request-abort:after",
+  "ledger:release:before",
+  "ledger:release:after",
+  "ledger:claim-joining:before",
+  "ledger:claim-joining:after",
+  "ledger:mark-joined:before",
+  "ledger:mark-joined:after",
+  "ledger:revert-joining:before",
+  "ledger:revert-joining:after",
+  "ledger:suspend:before",
+  "ledger:suspend:after",
+  "ledger:approval-decision:before",
+  "ledger:approval-decision:after",
+  "ledger:mark-unknown:before",
+  "ledger:mark-unknown:after",
+  "ledger:unknown-resolution:before",
+  "ledger:unknown-resolution:after",
+  "ledger:child-reservation:before",
+  "ledger:child-reservation:after",
+  "ledger:child-attach:before",
+  "ledger:child-attach:after",
+  "ledger:child-release-pending:before",
+  "ledger:child-release-pending:after",
+  "ledger:child-release:before",
+  "ledger:child-release:after",
+  "ledger:child-settled:before",
+  "ledger:child-settled:after",
+]);
+export type DoStorageFailpointLocation = typeof DoStorageFailpointLocation.Type;
+
+/** Deterministic test-only fault or pause injected at a Durable Object storage boundary. */
+export class DoStorageFailpointError extends Schema.TaggedError<DoStorageFailpointError>()(
+  "DoStorageFailpointError",
+  {
+    location: DoStorageFailpointLocation,
+  },
+) {
+  override get message() {
+    return `Injected Durable Object storage failure at ${this.location}.`;
+  }
+}

package/src/index.ts

@@ -0,0 +1,32 @@
+/**
+ * `@effect-agent/storage-cloudflare` — Durable Object SQLite adapters for the session ports
+ * (`ConversationStore`, `SubmissionLedger`).
+ *
+ * WP1 lands the LOCAL facets: the full port implementations against one Conversation Durable
+ * Object's private SQLite database, structurally mirroring the Node/SQLite adapters (same
+ * tables, same failpoint-location names, same conformance suites) with the DC-specific
+ * differences documented in each module — Durable Object storage-backed transactions instead
+ * of `BEGIN IMMEDIATE`, an `effect_agent_meta` exact-or-fresh version gate instead of
+ * `PRAGMA user_version`, a ~1.9 MB per-value bound instead of 16 MB, routable minted
+ * Submission identities, and the durable `effect_agent_child_settlements` cross-store
+ * notification marker.
+ *
+ * WP2 adds the cross-Object distribution seam: `port-protocol.ts` (the Schema
+ * request/response/failure envelopes for the CLOSED route-capable port subset) and
+ * `routing.ts` (the `ConversationPortTransport` service, the routed decorator Layers over
+ * the local facets — this-conversation → local, route-capable foreign → transport, anything
+ * else foreign → fail fast typed — and the owner-side `handleEncodedPortRequest` endpoint
+ * body for the Conversation Object's `portCall`).
+ *
+ * This package never imports the `cloudflare:workers` runtime module — Durable Object handles
+ * (`ctx.storage`) are injected as Layer construction values, and `@cloudflare/workers-types`
+ * stays a types-only devDependency.
+ */
+export * from "./errors.ts";
+export * from "./migrations.ts";
+export * from "./do-conversation-store.ts";
+export * from "./do-ledger.ts";
+export * from "./do-storage-config.ts";
+export * from "./do-storage-failpoint.ts";
+export * from "./port-protocol.ts";
+export * from "./routing.ts";

package/src/migrations.ts

@@ -0,0 +1,267 @@
+import { SqliteMigrator } from "@effect/sql-sqlite-do";
+import { Effect } from "effect";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+
+/**
+ * The exact-or-fresh storage version recorded in `effect_agent_meta`. Cloudflare is a fresh
+ * platform, so there is exactly ONE migration carrying the complete current schema — no
+ * v1→v4 history to replay (deployment spec §9: no rolling data-version promise during
+ * private development).
+ */
+export const CurrentDoStorageVersion = 1;
+
+/**
+ * The Conversation Durable Object schema. Table names and columns mirror the Node/SQLite v4
+ * schema byte-for-byte (`packages/storage-sqlite/src/migrations.ts`, migrations 1–4 collapsed
+ * into their final shape) so the shared conformance suites and crash-matrix rows address
+ * identical durable state. Two DC-specific additions:
+ *
+ * 1. `effect_agent_meta` replaces `PRAGMA user_version` as the exact-or-fresh version gate —
+ *    a meta table is portable regardless of which PRAGMAs Durable Object SQL storage allows.
+ * 2. `effect_agent_child_settlements` is the durable cross-store notification marker the
+ *    SubmissionLedger port contract mandates for cross-store adapters (`suspend`'s covering
+ *    check and `recordChildSettled`'s wake both consult it): parent and child Conversations
+ *    live in different Durable Objects, so a child settlement reported before the parent's
+ *    suspend commits must be observable from the PARENT's own storage.
+ */
+export const doMigrations = SqliteMigrator.fromRecord({
+  "1_current_cloudflare_conversation_object": Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+
+    yield* sql`
+      CREATE TABLE effect_agent_conversations (
+        conversation_id TEXT PRIMARY KEY NOT NULL,
+        created_at TEXT NOT NULL,
+        tail_sequence INTEGER NOT NULL,
+        tail_digest TEXT NOT NULL,
+        producer_epoch INTEGER NOT NULL
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_canonical_batches (
+        conversation_id TEXT NOT NULL,
+        batch_id TEXT NOT NULL,
+        first_sequence INTEGER NOT NULL,
+        last_sequence INTEGER NOT NULL,
+        batch_digest TEXT NOT NULL,
+        tail_digest TEXT NOT NULL,
+        batch_json TEXT NOT NULL,
+        PRIMARY KEY (conversation_id, batch_id),
+        FOREIGN KEY (conversation_id)
+          REFERENCES effect_agent_conversations(conversation_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_canonical_records (
+        conversation_id TEXT NOT NULL,
+        sequence INTEGER NOT NULL,
+        record_id TEXT NOT NULL,
+        batch_id TEXT NOT NULL,
+        record_json TEXT NOT NULL,
+        PRIMARY KEY (conversation_id, sequence),
+        UNIQUE (conversation_id, record_id),
+        FOREIGN KEY (conversation_id, batch_id)
+          REFERENCES effect_agent_canonical_batches(conversation_id, batch_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE INDEX effect_agent_canonical_records_batch
+        ON effect_agent_canonical_records (conversation_id, batch_id, sequence)
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_checkpoints (
+        conversation_id TEXT NOT NULL,
+        through_sequence INTEGER NOT NULL,
+        tail_digest TEXT NOT NULL,
+        checkpoint_json TEXT NOT NULL,
+        PRIMARY KEY (conversation_id, through_sequence),
+        FOREIGN KEY (conversation_id)
+          REFERENCES effect_agent_conversations(conversation_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    // Admission rows exist before Conversation materialization (durability §4), so
+    // conversation_id intentionally carries no foreign key into effect_agent_conversations.
+    yield* sql`
+      CREATE TABLE effect_agent_submissions (
+        submission_id TEXT PRIMARY KEY NOT NULL,
+        conversation_id TEXT NOT NULL,
+        queue_sequence INTEGER NOT NULL,
+        principal TEXT NOT NULL,
+        idempotency_key TEXT NOT NULL,
+        agent_id TEXT NOT NULL,
+        agent_digests_json TEXT NOT NULL,
+        deployment_id TEXT NOT NULL,
+        input_json TEXT NOT NULL,
+        input_digest TEXT NOT NULL,
+        receipt_id TEXT NOT NULL,
+        state TEXT NOT NULL,
+        settled_outcome TEXT,
+        created_at TEXT NOT NULL,
+        ready_at TEXT,
+        input_applied_record_id TEXT,
+        input_applied_sequence INTEGER,
+        joined_host_submission_id TEXT,
+        suspended_reason_json TEXT,
+        suspended_at TEXT,
+        unknown_reason TEXT,
+        unknown_tool_call_ids_json TEXT,
+        parent_submission_id TEXT,
+        parent_tool_call_id TEXT,
+        UNIQUE (conversation_id, principal, idempotency_key),
+        UNIQUE (conversation_id, queue_sequence)
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE INDEX effect_agent_submissions_joined_host
+        ON effect_agent_submissions (joined_host_submission_id)
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE INDEX effect_agent_submissions_parent
+        ON effect_agent_submissions (parent_submission_id)
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_submission_ownership (
+        submission_id TEXT PRIMARY KEY NOT NULL,
+        attempt_id TEXT NOT NULL,
+        ownership_token TEXT NOT NULL,
+        producer_epoch INTEGER NOT NULL,
+        owner_producer_id TEXT NOT NULL,
+        lease_expires_at TEXT NOT NULL,
+        FOREIGN KEY (submission_id)
+          REFERENCES effect_agent_submissions(submission_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_attempts (
+        attempt_id TEXT PRIMARY KEY NOT NULL,
+        submission_id TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        owner_producer_id TEXT NOT NULL,
+        producer_epoch INTEGER NOT NULL,
+        claimed_at TEXT NOT NULL,
+        FOREIGN KEY (submission_id)
+          REFERENCES effect_agent_submissions(submission_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_settlement_reservations (
+        submission_id TEXT PRIMARY KEY NOT NULL,
+        settlement_id TEXT NOT NULL,
+        outcome TEXT NOT NULL,
+        record_id TEXT NOT NULL,
+        record_json TEXT NOT NULL,
+        record_digest TEXT NOT NULL,
+        reserved_at TEXT NOT NULL,
+        finalized_at TEXT,
+        FOREIGN KEY (submission_id)
+          REFERENCES effect_agent_submissions(submission_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_abort_intents (
+        submission_id TEXT PRIMARY KEY NOT NULL,
+        author TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        requested_at TEXT NOT NULL,
+        canonical_record_id TEXT,
+        FOREIGN KEY (submission_id)
+          REFERENCES effect_agent_submissions(submission_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_approval_decisions (
+        submission_id TEXT NOT NULL,
+        tool_call_id TEXT NOT NULL,
+        decision TEXT NOT NULL,
+        resolver TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        decided_at TEXT NOT NULL,
+        PRIMARY KEY (submission_id, tool_call_id),
+        FOREIGN KEY (submission_id)
+          REFERENCES effect_agent_submissions(submission_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_unknown_resolutions (
+        submission_id TEXT NOT NULL,
+        tool_call_id TEXT NOT NULL,
+        author TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        resolution_json TEXT NOT NULL,
+        resolved_at TEXT NOT NULL,
+        PRIMARY KEY (submission_id, tool_call_id),
+        FOREIGN KEY (submission_id)
+          REFERENCES effect_agent_submissions(submission_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_child_reservations (
+        reservation_id TEXT PRIMARY KEY NOT NULL,
+        parent_submission_id TEXT NOT NULL,
+        parent_tool_call_id TEXT NOT NULL,
+        child_submission_id TEXT,
+        status TEXT NOT NULL,
+        allocation_json TEXT NOT NULL,
+        allocation_digest TEXT NOT NULL,
+        accounting_json TEXT,
+        reserved_at TEXT NOT NULL,
+        release_began_at TEXT,
+        released_at TEXT,
+        UNIQUE (parent_submission_id, parent_tool_call_id),
+        FOREIGN KEY (parent_submission_id)
+          REFERENCES effect_agent_submissions(submission_id)
+          ON DELETE RESTRICT
+      )
+    `.withoutTransform;
+
+    // Durable cross-store child-settlement notification marker (parent-side; the child's row
+    // lives in ANOTHER Durable Object). child_outcome is nullable: the notification command
+    // carries identities only, and the child's canonical Settlement stays the outcome
+    // authority (DUR-015). No foreign keys: the parent row is checked by the operation, and
+    // the child row is intentionally foreign.
+    yield* sql`
+      CREATE TABLE effect_agent_child_settlements (
+        parent_submission_id TEXT NOT NULL,
+        child_submission_id TEXT NOT NULL,
+        child_outcome TEXT,
+        recorded_at TEXT NOT NULL,
+        PRIMARY KEY (parent_submission_id, child_submission_id)
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      CREATE TABLE effect_agent_meta (
+        key TEXT PRIMARY KEY NOT NULL,
+        value TEXT NOT NULL
+      )
+    `.withoutTransform;
+
+    yield* sql`
+      INSERT INTO effect_agent_meta (key, value)
+      VALUES ('storage_version', ${String(CurrentDoStorageVersion)})
+    `.withoutTransform;
+  }),
+});