@effect-agent/storage-cloudflare 0.1.0-beta.11 → 0.1.0-beta.110

package/src/{do-ledger.ts → DoSubmissionLedger.ts}

@@ -1,18 +1,37 @@
+import { BrowserCrypto } from "@effect/platform-browser";
+import { SqliteClient } from "@effect/sql-sqlite-do";
+import { Clock, Context, Crypto, DateTime, Effect, Layer, Option, Schema, Stream } from "effect";
+import { EMPTY_TAIL_DIGEST } from "effect-agent/digest";
+import { InputMessage } from "effect-agent/messaging";
+import {
+  ApprovalDecision,
+  CanonicalSequence,
+  DefinitionDigests,
+  Digest,
+  PersistedJson,
+  WorkerAdmission,
+  ProducerEpoch,
+  RecordEnvelope,
+  SettlementOutcome,
+} from "effect-agent/records";
 import {
   AbortCommand,
   AbortIntent,
+  AbortIntentRequest,
   AdmissionAdmitted,
   AdmissionConflict,
+  AdmissionFence,
+  AdmissionGroup,
+  AdmissionPolicyError,
   AdmissionNotAdmitted,
   AdmissionRequest,
+  SubmissionAdmissionFence,
   AdmissionResult,
   ApprovalConflict,
-  ApprovalDecision,
   ApprovalDecisionCommand,
   ApprovalDecisionIntent,
   AttachChildToReservationRequest,
   BeginChildBudgetReleaseRequest,
-  CanonicalSequence,
   ChildAttachmentSnapshot,
   ChildBudgetReservationRequest,
   ChildBudgetReservationSnapshot,
@@ -22,9 +41,6 @@ import {
   Claim,
   ClaimJoiningRequest,
   ClaimRequest,
-  DefinitionDigests,
-  Digest,
-  EMPTY_TAIL_DIGEST,
   InputAppliedMarker,
   JoinSnapshot,
   JoinedToHost,
@@ -39,10 +55,7 @@ import {
   OwnershipRenewal,
   OwnershipSnapshot,
   ParentLinkage,
-  PersistedJson,
-  ProducerEpoch,
   QueueSequence,
-  RecordEnvelope,
   RecoverySnapshot,
   RecoverySnapshotRequest,
   ReleaseChildBudgetRequest,
@@ -54,7 +67,6 @@ import {
   Settlement,
   SettlementConflict,
   SettlementFinalization,
-  SettlementOutcome,
   SettlementReservation,
   SubmissionLedger,
   SubmissionLookup,
@@ -62,6 +74,7 @@ import {
   SubmissionSnapshot,
   SubmissionState,
   SettlementReservationSnapshot,
+  settlementFailureFromRecord,
   SuspendRequest,
   SuspensionReason,
   SuspensionSnapshot,
@@ -72,28 +85,25 @@ import {
   submissionAbortRecordId,
   type ChildSettledOutcome,
   type SuspensionOutcome,
-} from "@effect-agent/session";
-import { BrowserCrypto } from "@effect/platform-browser";
-import { SqliteClient } from "@effect/sql-sqlite-do";
-import { Clock, Context, Crypto, DateTime, Effect, Layer, Option, Schema, Stream } from "effect";
+} from "effect-agent/submission-ledger";
 import * as SqlClientService from "effect/unstable/sql/SqlClient";
 import type { SqlError } from "effect/unstable/sql/SqlError";
 
-import {
-  storageConfigLayer,
-  storageFailpointLayer,
-  type DoStorageInitializationError,
-  type DoStorageOptions,
-} from "./do-conversation-store.ts";
-import { decodeRows, initializeDoJournal } from "./do-journal.ts";
-import { DoStorageConfig } from "./do-storage-config.ts";
-import { DoStorageFailpoint } from "./do-storage-failpoint.ts";
+import { DoStorageConfig } from "./DoStorageConfig.ts";
 import {
   DoLedgerError,
   DoStorageCorruptionError,
   DoStorageError,
   type DoStorageFailpointLocation,
-} from "./errors.ts";
+} from "./DoStorageError.ts";
+import { DoStorageFailpoint } from "./DoStorageFailpoint.ts";
+import {
+  storageConfigLayer,
+  storageFailpointLayer,
+  type DoStorageInitializationError,
+  type DoStorageOptions,
+} from "./DoThreadStore.ts";
+import { decodeRows, initializeDoJournal } from "./internal/do-journal.ts";
 
 type SubmissionId = SubmissionSnapshot["submissionId"];
 
@@ -107,11 +117,16 @@ const BoundedTimestamp = Schema.NonEmptyString.check(Schema.isMaxLength(128));
 
 const SCAN_PAGE_SIZE = 256;
 const EPOCH_ZERO = Schema.decodeSync(ProducerEpoch)(0);
+const RESUME_IMMEDIATELY: SuspensionOutcome = "resume-immediately";
+const SUSPENDED: SuspensionOutcome = "suspended";
+const NOT_WAITING: ChildSettledOutcome = "not-waiting";
+const STILL_WAITING: ChildSettledOutcome = "still-waiting";
+const WOKEN: ChildSettledOutcome = "woken";
 const MAX_IDENTIFIER_LENGTH = 1_024;
 
 class SubmissionRow extends Schema.Class<SubmissionRow>("SubmissionRow")({
   submission_id: BoundedIdentifier,
-  conversation_id: BoundedIdentifier,
+  thread_id: BoundedIdentifier,
   queue_sequence: QueueSequence,
   principal: BoundedIdentifier,
   idempotency_key: BoundedIdentifier,
@@ -134,6 +149,10 @@ class SubmissionRow extends Schema.Class<SubmissionRow>("SubmissionRow")({
   unknown_tool_call_ids_json: Schema.NullOr(BoundedStoredText),
   parent_submission_id: Schema.NullOr(BoundedIdentifier),
   parent_tool_call_id: Schema.NullOr(BoundedIdentifier),
+  admission_group: Schema.NullOr(AdmissionGroup),
+  admission_fence_json: Schema.NullOr(BoundedStoredText),
+  worker_admission_json: Schema.NullOr(BoundedStoredText),
+  message_admission_json: Schema.NullOr(BoundedStoredText),
 }) {}
 
 class ChildReservationRow extends Schema.Class<ChildReservationRow>("ChildReservationRow")({
@@ -209,13 +228,22 @@ class MaxQueueSequenceRow extends Schema.Class<MaxQueueSequenceRow>("MaxQueueSeq
   max_queue_sequence: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
 }) {}
 
+class AbortIntentLookupRow extends Schema.Class<AbortIntentLookupRow>("AbortIntentLookupRow")({
+  submission_id: BoundedIdentifier,
+  abort_submission_id: Schema.NullOr(BoundedIdentifier),
+  author: Schema.NullOr(BoundedIdentifier),
+  reason: Schema.NullOr(BoundedStoredText),
+  requested_at: Schema.NullOr(BoundedTimestamp),
+  canonical_record_id: Schema.NullOr(BoundedIdentifier),
+}) {}
+
 class CanonicalRecordIdRow extends Schema.Class<CanonicalRecordIdRow>("CanonicalRecordIdRow")({
   record_id: BoundedIdentifier,
 }) {}
 
 const SUBMISSION_COLUMNS = `
   submission_id,
-  conversation_id,
+  thread_id,
   queue_sequence,
   principal,
   idempotency_key,
@@ -237,7 +265,11 @@ const SUBMISSION_COLUMNS = `
   unknown_reason,
   unknown_tool_call_ids_json,
   parent_submission_id,
-  parent_tool_call_id
+  parent_tool_call_id,
+  admission_group,
+  admission_fence_json,
+  worker_admission_json,
+  message_admission_json
 `;
 
 const CHILD_RESERVATION_COLUMNS = `
@@ -254,7 +286,7 @@ const CHILD_RESERVATION_COLUMNS = `
   released_at
 `;
 
-/** The branded ToolCallId schema, reached through the session port so no core import is needed. */
+/** The branded ToolCallId schema, reached through the thread port so no core import is needed. */
 const ToolCallIdSchema = ApprovalDecisionCommand.fields.toolCallId;
 const ToolCallIdList = Schema.Array(ToolCallIdSchema);
 
@@ -284,10 +316,15 @@ const decodeSuspensionSnapshot = Schema.decodeUnknownEffect(SuspensionSnapshot);
 const decodeApprovalDecisionIntent = Schema.decodeUnknownEffect(ApprovalDecisionIntent);
 const decodeUnknownResolutionIntent = Schema.decodeUnknownEffect(UnknownResolutionIntent);
 const decodeParentLinkage = Schema.decodeUnknownEffect(ParentLinkage);
+
 const decodeChildReservationSnapshotUnknown = Schema.decodeUnknownEffect(
   ChildBudgetReservationSnapshot,
 );
+
 const decodeChildAttachmentSnapshot = Schema.decodeUnknownEffect(ChildAttachmentSnapshot);
+const equivalentPersistedJson = Schema.toEquivalence(PersistedJson);
+const equivalentUnknownResolution = Schema.toEquivalence(UnknownResolution);
+const isDoStorageError = Schema.is(DoStorageError);
 
 /** Wrap an adapter-internal failure into the port's LedgerError without erasing its tag. */
 const internalFailure =
@@ -319,6 +356,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
   const failpoint = yield* DoStorageFailpoint;
   const sql = yield* SqlClientService.SqlClient;
   const crypto = yield* Crypto.Crypto;
+  const admissionFence = yield* SubmissionAdmissionFence;
   const journal = yield* initializeDoJournal(sql, failpoint.hit, config.maxStoredValueBytes);
 
   const hitFailpoint = (
@@ -336,6 +374,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     A,
     E extends
       | AdmissionConflict
+      | AdmissionPolicyError
       | ApprovalConflict
       | ChildReservationConflict
       | JoinedToHost
@@ -351,7 +390,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       .withWriteTransaction(operation)(effect)
       .pipe(
         Effect.mapError((error) =>
-          error instanceof DoStorageError ? internalFailure(operation)(error) : error,
+          isDoStorageError(error) ? internalFailure(operation)(error) : error,
         ),
       );
 
@@ -385,7 +424,9 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       FROM effect_agent_submissions
       WHERE submission_id = ${submissionId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeSubmissionRows(operation, submissionId, rows);
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -394,6 +435,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         "A submission primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -402,12 +444,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     submissionId: string,
   ): Effect.fn.Return<SubmissionRow, LedgerError> {
     const submission = yield* readSubmission(operation, submissionId);
+
     if (Option.isNone(submission)) {
       return yield* LedgerError.make({
         operation,
         message: `Unknown submission ${submissionId}.`,
       });
     }
+
     return submission.value;
   });
 
@@ -426,12 +470,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       FROM effect_agent_submission_ownership
       WHERE submission_id = ${submissionId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeRows(
       Schema.Array(OwnershipRow),
       "effect_agent_submission_ownership",
       submissionId,
       rows,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -440,23 +486,25 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         "An ownership primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
-  const conversationEpoch = Effect.fn("DoSubmissionLedger.conversationEpoch")(function* (
+  const threadEpoch = Effect.fn("DoSubmissionLedger.threadEpoch")(function* (
     operation: string,
-    conversationId: string,
+    threadId: string,
   ): Effect.fn.Return<ProducerEpoch, LedgerError> {
-    const conversations = yield* journal
-      .getConversation(conversationId)
+    const threads = yield* journal
+      .getThread(threadId)
       .pipe(Effect.mapError(internalFailure(operation)));
-    return conversations.length === 0 ? EPOCH_ZERO : conversations[0].producer_epoch;
+
+    return threads.length === 0 ? EPOCH_ZERO : threads[0].producer_epoch;
   });
 
   /**
    * Verify inside the surrounding write transaction that the presented token still owns the
    * Submission's lane; a superseded or missing token fails with OwnershipLost carrying the
-   * Conversation's current producer epoch (DUR-006).
+   * Thread's current producer epoch (DUR-006).
    */
   const requireOwnership = Effect.fn("DoSubmissionLedger.requireOwnership")(function* (
     operation: string,
@@ -464,13 +512,20 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     ownershipToken: string,
   ): Effect.fn.Return<OwnershipRow, OwnershipLost | LedgerError> {
     const ownership = yield* readOwnership(operation, submission.submission_id);
-    if (Option.isNone(ownership) || ownership.value.ownership_token !== ownershipToken) {
-      const actualEpoch = yield* conversationEpoch(operation, submission.conversation_id);
-      const submissionId = yield* Schema.decodeUnknownEffect(
-        SubmissionSnapshot.fields.submissionId,
-      )(submission.submission_id).pipe(Effect.mapError(internalFailure(operation)));
+    const actualEpoch = yield* threadEpoch(operation, submission.thread_id);
+
+    if (
+      Option.isNone(ownership) ||
+      ownership.value.ownership_token !== ownershipToken ||
+      ownership.value.producer_epoch !== actualEpoch
+    ) {
+      const submissionId = yield* Schema.decodeEffect(SubmissionSnapshot.fields.submissionId)(
+        submission.submission_id,
+      ).pipe(Effect.mapError(internalFailure(operation)));
+
       return yield* OwnershipLost.make({ submissionId, actualEpoch });
     }
+
     return ownership.value;
   });
 
@@ -489,6 +544,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           ),
         ),
       );
+
       const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
         Effect.mapError((error) =>
           corruptionFailure(
@@ -499,6 +555,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           ),
         ),
       );
+
       if ((row.parent_submission_id === null) !== (row.parent_tool_call_id === null)) {
         return yield* corruptionFailure(
           operation,
@@ -507,9 +564,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           "A parent linkage must record both the parent Submission and the parent Tool Call.",
         );
       }
+
       return yield* decodeSubmissionSnapshotUnknown({
         submissionId: row.submission_id,
-        conversationId: row.conversation_id,
+        threadId: row.thread_id,
         queueSequence: row.queue_sequence,
         principal: row.principal,
         idempotencyKey: row.idempotency_key,
@@ -521,6 +579,28 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         receiptId: row.receipt_id,
         state: row.state,
         createdAt: row.created_at,
+        ...(row.admission_group === null ? {} : { admissionGroup: row.admission_group }),
+        ...(row.worker_admission_json === null
+          ? {}
+          : {
+              workerAdmission: yield* parseStoredJsonText(row.worker_admission_json).pipe(
+                Effect.mapError(internalFailure(operation)),
+              ),
+            }),
+        ...(row.message_admission_json === null
+          ? {}
+          : {
+              messageAdmission: yield* parseStoredJsonText(row.message_admission_json).pipe(
+                Effect.mapError(internalFailure(operation)),
+              ),
+            }),
+        ...(row.admission_fence_json === null
+          ? {}
+          : {
+              admissionFence: yield* parseStoredJsonText(row.admission_fence_json).pipe(
+                Effect.mapError(internalFailure(operation)),
+              ),
+            }),
         ...(row.settled_outcome === null ? {} : { settledOutcome: row.settled_outcome }),
         ...(row.ready_at === null ? {} : { readyAt: row.ready_at }),
         ...(row.parent_submission_id === null || row.parent_tool_call_id === null
@@ -561,12 +641,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       FROM effect_agent_settlement_reservations
       WHERE submission_id = ${submissionId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeRows(
       Schema.Array(ReservationRow),
       "effect_agent_settlement_reservations",
       submissionId,
       rows,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -575,6 +657,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         "A settlement reservation primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -592,12 +675,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       FROM effect_agent_abort_intents
       WHERE submission_id = ${submissionId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeRows(
       Schema.Array(AbortIntentRow),
       "effect_agent_abort_intents",
       submissionId,
       rows,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -606,6 +691,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         "An abort intent primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -629,6 +715,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         WHERE parent_submission_id = ${parentSubmissionId}
         ORDER BY child_submission_id ASC
       `.pipe(Effect.mapError(sqlFailure(operation)));
+
       return yield* decodeRows(
         Schema.Array(ChildSettlementMarkerRow),
         "effect_agent_child_settlements",
@@ -651,6 +738,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
   ): Effect.fn.Return<boolean, LedgerError> {
     if (markerChildren.has(childSubmissionId)) return true;
     const childRow = yield* readSubmission(operation, childSubmissionId);
+
     return Option.isSome(childRow) && childRow.value.state === "settled";
   });
 
@@ -671,7 +759,9 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       FROM effect_agent_child_reservations
       WHERE reservation_id = ${reservationId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeChildReservationRows(operation, reservationId, rows);
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -680,6 +770,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         "A child reservation primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -695,11 +786,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         WHERE parent_submission_id = ${parentSubmissionId}
           AND parent_tool_call_id = ${parentToolCallId}
       `.pipe(Effect.mapError(sqlFailure(operation)));
+
       const decoded = yield* decodeChildReservationRows(
         operation,
         `${parentSubmissionId}/${parentToolCallId}`,
         rows,
       );
+
       if (decoded.length > 1) {
         return yield* corruptionFailure(
           operation,
@@ -708,6 +801,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           "A parent Tool Call returned more than one child reservation.",
         );
       }
+
       return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
     },
   );
@@ -725,13 +819,16 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         row.reservation_id,
         error.message,
       );
+
     const allocation = yield* parseStoredJsonText(row.allocation_json).pipe(
       Effect.mapError(rowFailure),
     );
+
     const accounting =
       row.accounting_json === null
         ? undefined
         : yield* parseStoredJsonText(row.accounting_json).pipe(Effect.mapError(rowFailure));
+
     return yield* decodeChildReservationSnapshotUnknown({
       reservationId: row.reservation_id,
       parentSubmissionId: row.parent_submission_id,
@@ -763,6 +860,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       WHERE submission_id = ${submissionId}
       ORDER BY tool_call_id ASC
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     return yield* decodeRows(
       Schema.Array(ApprovalDecisionRow),
       "effect_agent_approval_decisions",
@@ -810,6 +908,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       WHERE submission_id = ${submissionId}
       ORDER BY tool_call_id ASC
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     return yield* decodeRows(
       Schema.Array(UnknownResolutionRow),
       "effect_agent_unknown_resolutions",
@@ -834,6 +933,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         ),
       ),
     );
+
     return yield* decodeUnknownResolutionIntent({
       submissionId: row.submission_id,
       toolCallId: row.tool_call_id,
@@ -860,6 +960,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       submission: SubmissionRow,
     ): Effect.fn.Return<ReadonlyArray<typeof ToolCallIdSchema.Type>, LedgerError> {
       if (submission.unknown_tool_call_ids_json === null) return [];
+
       return yield* decodeToolCallIdsText(submission.unknown_tool_call_ids_json).pipe(
         Effect.mapError((error) =>
           corruptionFailure(
@@ -880,22 +981,25 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
    */
   const canonicalAbortRecordId = Effect.fn("DoSubmissionLedger.canonicalAbortRecordId")(function* (
     operation: string,
-    conversationId: string,
+    threadId: string,
     submissionId: SubmissionId,
   ): Effect.fn.Return<string | undefined, LedgerError> {
     const recordId = submissionAbortRecordId(submissionId);
+
     const rows = yield* sql<Record<string, unknown>>`
       SELECT record_id
       FROM effect_agent_canonical_records
-      WHERE conversation_id = ${conversationId}
+      WHERE thread_id = ${threadId}
         AND record_id = ${recordId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeRows(
       Schema.Array(CanonicalRecordIdRow),
       "effect_agent_canonical_records",
-      `${conversationId}/${recordId}`,
+      `${threadId}/${recordId}`,
       rows,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     return decoded.length === 0 ? undefined : recordId;
   });
 
@@ -907,9 +1011,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
   ): Effect.fn.Return<AbortIntent, LedgerError> {
     const canonicalRecordId = yield* canonicalAbortRecordId(
       operation,
-      submission.conversation_id,
+      submission.thread_id,
       submissionId,
     );
+
     return yield* decodeAbortIntent({
       submissionId: row.submission_id,
       author: row.author,
@@ -938,47 +1043,92 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
   const admit: SubmissionLedger["Service"]["admit"] = Effect.fn("DoSubmissionLedger.admit")(
     function* (request: AdmissionRequest) {
       const operation = "ledger admit";
-      const validated = yield* Schema.decodeUnknownEffect(Schema.toType(AdmissionRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(AdmissionRequest))(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
+
       const inputJson = yield* encodePersistedJsonText(validated.inputPayload).pipe(
         Effect.mapError(internalFailure(operation)),
       );
+
       // The platform's ~2 MB per-value bound, refused typed BEFORE any durable mutation
       // (resource-limits gate; oversized payloads are the designed R2 overflow path).
       yield* journal
         .checkValueBound(operation, inputJson)
         .pipe(Effect.mapError(internalFailure(operation)));
+
+      const workerAdmissionJson =
+        validated.workerAdmission === undefined
+          ? null
+          : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(
+              validated.workerAdmission,
+            ).pipe(Effect.mapError(internalFailure(operation)));
+
+      if (
+        workerAdmissionJson !== null &&
+        new TextEncoder().encode(workerAdmissionJson).byteLength > config.maxStoredValueBytes
+      ) {
+        return yield* LedgerError.make({
+          operation,
+          message: "Worker admission metadata exceeds the stored value bound",
+        });
+      }
+
+      const messageAdmissionJson =
+        validated.messageAdmission === undefined
+          ? null
+          : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(
+              validated.messageAdmission,
+            ).pipe(Effect.mapError(internalFailure(operation)));
+
+      if (
+        messageAdmissionJson !== null &&
+        new TextEncoder().encode(messageAdmissionJson).byteLength > config.maxStoredValueBytes
+      ) {
+        return yield* LedgerError.make({
+          operation,
+          message: "Message admission metadata exceeds the stored value bound",
+        });
+      }
+
       const agentDigestsJson = yield* encodeDefinitionDigestsText(validated.agentDigests).pipe(
         Effect.mapError(internalFailure(operation)),
       );
-      // Routable Submission identity (D-P6-5): `{uuidv7}:{conversationId}`. The cross-DO
+
+      // Routable Submission identity (D-P6-5): `{uuidv7}:{threadId}`. The cross-DO
       // routing layer parses ITS OWN minted format (split at the first ":") to address
-      // submissionId-only operations to the owning Conversation Object; the id stays opaque
+      // submissionId-only operations to the owning Thread Object; the id stays opaque
       // to every other component, exactly like DN's `submission-{uuid}` prefix.
-      const mintedSubmissionId = `${yield* mintUuid(operation)}:${validated.conversationId}`;
+      const mintedSubmissionId = `${yield* mintUuid(operation)}:${validated.threadId}`;
+
       if (mintedSubmissionId.length > MAX_IDENTIFIER_LENGTH) {
         return yield* LedgerError.make({
           operation,
           message:
             `A routable Submission identity of ${mintedSubmissionId.length} characters exceeds ` +
-            `the ${MAX_IDENTIFIER_LENGTH}-character ledger row bound; shorten the Conversation identity.`,
+            `the ${MAX_IDENTIFIER_LENGTH}-character ledger row bound; shorten the Thread identity.`,
         });
       }
       const mintedReceiptId = `receipt-${yield* mintUuid(operation)}`;
+
       yield* hitFailpoint("ledger:admit:before", operation);
+
       const result = yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
-          const keyRowKey = `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`;
+          const keyRowKey = `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`;
+
           const existingRows = yield* sql<Record<string, unknown>>`
             SELECT ${sql.literal(SUBMISSION_COLUMNS)}
             FROM effect_agent_submissions
-            WHERE conversation_id = ${validated.conversationId}
+            WHERE thread_id = ${validated.threadId}
               AND principal = ${validated.principal}
               AND idempotency_key = ${validated.idempotencyKey}
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const existing = yield* decodeSubmissionRows(operation, keyRowKey, existingRows);
+
           if (existing.length > 1) {
             return yield* corruptionFailure(
               operation,
@@ -996,15 +1146,61 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
                   existing[0].parent_tool_call_id === null
                 : existing[0].parent_submission_id === validated.parentLinkage.parentSubmissionId &&
                   existing[0].parent_tool_call_id === validated.parentLinkage.parentToolCallId;
+
             if (existing[0].input_digest !== validated.inputDigest || !sameLinkage) {
               return yield* AdmissionConflict.make({
-                conversationId: validated.conversationId,
+                threadId: validated.threadId,
                 principal: validated.principal,
                 idempotencyKey: validated.idempotencyKey,
                 existingInputDigest: existing[0].input_digest,
                 attemptedInputDigest: validated.inputDigest,
               });
             }
+
+            const retainedWorkerAdmission =
+              existing[0].worker_admission_json === null
+                ? undefined
+                : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(
+                    existing[0].worker_admission_json,
+                  ).pipe(Effect.mapError(internalFailure(operation)));
+
+            const retainedInputMessage =
+              existing[0].message_admission_json === null
+                ? undefined
+                : yield* Schema.decodeEffect(Schema.fromJsonString(InputMessage))(
+                    existing[0].message_admission_json,
+                  ).pipe(Effect.mapError(internalFailure(operation)));
+
+            const retainedFence =
+              existing[0].admission_fence_json === null
+                ? undefined
+                : yield* Schema.decodeEffect(Schema.fromJsonString(AdmissionFence))(
+                    existing[0].admission_fence_json,
+                  ).pipe(Effect.mapError(internalFailure(operation)));
+
+            if (
+              (existing[0].admission_group ?? undefined) !== validated.admissionGroup ||
+              !Schema.toEquivalence(Schema.optional(WorkerAdmission))(
+                retainedWorkerAdmission,
+                validated.workerAdmission,
+              ) ||
+              !Schema.toEquivalence(Schema.optional(InputMessage))(
+                retainedInputMessage,
+                validated.messageAdmission,
+              ) ||
+              !Schema.toEquivalence(Schema.optional(AdmissionFence))(
+                retainedFence,
+                validated.admissionFence,
+              )
+            )
+              return yield* AdmissionConflict.make({
+                threadId: validated.threadId,
+                principal: validated.principal,
+                idempotencyKey: validated.idempotencyKey,
+                existingInputDigest: existing[0].input_digest,
+                attemptedInputDigest: validated.inputDigest,
+              });
+
             return yield* decodeAdmissionResult({
               submissionId: existing[0].submission_id,
               receiptId: existing[0].receipt_id,
@@ -1014,26 +1210,78 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             }).pipe(Effect.mapError(internalFailure(operation)));
           }
 
+          // The first accepted input fixes ordinary/worker lane identity atomically with admission.
+          // Canonical origin materialization can lag admission; a log scan cannot fence that race.
+          const firstRows = yield* sql<Record<string, unknown>>`
+            SELECT worker_admission_json FROM effect_agent_submissions
+            WHERE thread_id=${validated.threadId} ORDER BY queue_sequence LIMIT 1
+          `.pipe(Effect.mapError(sqlFailure(operation)));
+
+          const first = yield* Schema.decodeUnknownEffect(
+            Schema.Array(
+              Schema.Struct({
+                worker_admission_json: Schema.NullOr(BoundedStoredText),
+              }),
+            ),
+          )(firstRows).pipe(Effect.mapError(internalFailure(operation)));
+
+          if (first[0] !== undefined) {
+            const previous =
+              first[0].worker_admission_json === null
+                ? undefined
+                : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(
+                    first[0].worker_admission_json,
+                  ).pipe(Effect.mapError(internalFailure(operation)));
+
+            if (
+              !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
+                previous?.origin,
+                validated.workerAdmission?.origin,
+              )
+            )
+              return yield* AdmissionPolicyError.make({
+                reason: "refused",
+                code: "worker-origin-conflict",
+              });
+          }
+
+          yield* admissionFence.check(validated);
+          if (validated.admissionGroup !== undefined) {
+            const occupied = yield* sql<Record<string, unknown>>`
+              SELECT submission_id FROM effect_agent_submissions
+              WHERE thread_id=${validated.threadId} AND admission_group=${validated.admissionGroup} AND state<>'settled' LIMIT 1
+            `.pipe(Effect.mapError(sqlFailure(operation)));
+
+            if (occupied.length > 0)
+              return yield* AdmissionPolicyError.make({
+                reason: "occupied",
+                code: "admission-group",
+              });
+          }
+
           const maxRows = yield* sql<Record<string, unknown>>`
             SELECT COALESCE(MAX(queue_sequence), 0) AS max_queue_sequence
             FROM effect_agent_submissions
-            WHERE conversation_id = ${validated.conversationId}
+            WHERE thread_id = ${validated.threadId}
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const decodedMax = yield* decodeRows(
             Schema.Array(MaxQueueSequenceRow),
             "effect_agent_submissions",
-            validated.conversationId,
+            validated.threadId,
             maxRows,
           ).pipe(Effect.mapError(internalFailure(operation)));
+
           const queueSequence = yield* decodeQueueSequence(
             (decodedMax[0]?.max_queue_sequence ?? 0) + 1,
           ).pipe(Effect.mapError(internalFailure(operation)));
+
           const now = yield* currentInstant;
 
           yield* sql`
             INSERT INTO effect_agent_submissions (
               submission_id,
-              conversation_id,
+              thread_id,
               queue_sequence,
               principal,
               idempotency_key,
@@ -1046,10 +1294,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               state,
               created_at,
               parent_submission_id,
-              parent_tool_call_id
+              parent_tool_call_id,
+              admission_group,
+              admission_fence_json,
+  worker_admission_json,
+  message_admission_json
             ) VALUES (
               ${mintedSubmissionId},
-              ${validated.conversationId},
+              ${validated.threadId},
               ${queueSequence},
               ${validated.principal},
               ${validated.idempotencyKey},
@@ -1062,7 +1314,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               'admitted',
               ${now.iso},
               ${validated.parentLinkage?.parentSubmissionId ?? null},
-              ${validated.parentLinkage?.parentToolCallId ?? null}
+              ${validated.parentLinkage?.parentToolCallId ?? null},
+              ${validated.admissionGroup ?? null},
+              ${validated.admissionFence === undefined ? null : JSON.stringify(validated.admissionFence)},
+              ${workerAdmissionJson},
+              ${messageAdmissionJson}
             )
           `.pipe(Effect.mapError(sqlFailure(operation)));
 
@@ -1075,7 +1331,9 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           }).pipe(Effect.mapError(internalFailure(operation)));
         }),
       );
+
       yield* hitFailpoint("ledger:admit:after", operation);
+
       return result;
     },
   );
@@ -1084,16 +1342,20 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.markReady",
   )(function* (request: MarkReadyRequest) {
     const operation = "ledger mark ready";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(MarkReadyRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(MarkReadyRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:mark-ready:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state !== "admitted") return;
         const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_submissions
           SET state = 'ready', ready_at = ${now.iso}
@@ -1107,40 +1369,48 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
   const lookup: SubmissionLedger["Service"]["lookup"] = Effect.fn("DoSubmissionLedger.lookup")(
     function* (request: SubmissionLookup) {
       const operation = "ledger lookup";
-      const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SubmissionLookup))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookup))(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
+
       if (validated._tag === "SubmissionLookupById") {
         const row = yield* readSubmission(operation, validated.submissionId);
+
         if (Option.isNone(row)) return Option.none();
+
         return Option.some(yield* decodeSubmissionSnapshot(operation, row.value));
       }
+
       const rows = yield* sql<Record<string, unknown>>`
       SELECT ${sql.literal(SUBMISSION_COLUMNS)}
       FROM effect_agent_submissions
-      WHERE conversation_id = ${validated.conversationId}
+      WHERE thread_id = ${validated.threadId}
         AND principal = ${validated.principal}
         AND idempotency_key = ${validated.idempotencyKey}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
       const decoded = yield* decodeSubmissionRows(
         operation,
-        `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`,
+        `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
         rows,
       );
+
       if (decoded.length > 1) {
         return yield* corruptionFailure(
           operation,
           "effect_agent_submissions",
-          `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`,
+          `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
           "An admission idempotency key returned more than one row.",
         );
       }
       if (decoded.length === 0) return Option.none();
+
       return Option.some(yield* decodeSubmissionSnapshot(operation, decoded[0]));
     },
   );
 
-  // This LOCAL facet is the authoritative owner of every Conversation stored in this Durable
+  // This LOCAL facet is the authoritative owner of every Thread stored in this Durable
   // Object, so the key-scoped read IS the admission truth and the tri-state degenerates to
   // NotAdmitted or Admitted (SUB-031). `AdmissionIndeterminate` becomes real one layer out:
   // the WP2 routed decorator answers it when the OWNING Durable Object is unreachable.
@@ -1148,30 +1418,35 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.resolveAdmission",
   )(function* (request: SubmissionLookupByKey) {
     const operation = "ledger resolve admission";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SubmissionLookupByKey))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookupByKey))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     const rows = yield* sql<Record<string, unknown>>`
       SELECT ${sql.literal(SUBMISSION_COLUMNS)}
       FROM effect_agent_submissions
-      WHERE conversation_id = ${validated.conversationId}
+      WHERE thread_id = ${validated.threadId}
         AND principal = ${validated.principal}
         AND idempotency_key = ${validated.idempotencyKey}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeSubmissionRows(
       operation,
-      `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`,
+      `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
       rows,
     );
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
         "effect_agent_submissions",
-        `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`,
+        `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
         "An admission idempotency key returned more than one row.",
       );
     }
     if (decoded.length === 0) return AdmissionNotAdmitted.make();
+
     return AdmissionAdmitted.make({
       submission: yield* decodeSubmissionSnapshot(operation, decoded[0]),
     });
@@ -1180,71 +1455,103 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
   const claim: SubmissionLedger["Service"]["claim"] = Effect.fn("DoSubmissionLedger.claim")(
     function* (request: ClaimRequest) {
       const operation = "ledger claim";
-      const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ClaimRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(ClaimRequest))(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
+
       const attemptId = `attempt-${yield* mintUuid(operation)}`;
       const ownershipToken = `owner-${yield* mintUuid(operation)}`;
+
       yield* hitFailpoint("ledger:claim:before", operation);
+
       const claimed = yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
+          const now = yield* currentInstant;
+
+          // Ownership belongs to the whole Thread, including unknown work skipped below.
+          // Stored lease instants are normalized UTC strings, so the latest expiry covers
+          // every live lease. This check and the epoch grant share one write transaction.
+          const ownershipRows = yield* sql<Record<string, unknown>>`
+            SELECT ownership.*
+            FROM effect_agent_submission_ownership AS ownership
+            JOIN effect_agent_submissions AS submission
+              ON submission.submission_id = ownership.submission_id
+            WHERE submission.thread_id = ${validated.threadId}
+            ORDER BY ownership.lease_expires_at DESC
+            LIMIT 1
+          `.pipe(Effect.mapError(sqlFailure(operation)));
+
+          const ownership = yield* decodeRows(
+            Schema.Array(OwnershipRow),
+            "effect_agent_submission_ownership",
+            validated.threadId,
+            ownershipRows,
+          ).pipe(Effect.mapError(internalFailure(operation)));
+
+          if (ownership.length > 0) {
+            const expiresAt = yield* timestampMillis(
+              operation,
+              ownership[0].submission_id,
+            )(ownership[0].lease_expires_at);
+
+            if (expiresAt > now.millis) return Option.none<Claim>();
+          }
+
           const headRows = yield* sql<Record<string, unknown>>`
             SELECT ${sql.literal(SUBMISSION_COLUMNS)}
             FROM effect_agent_submissions
-            WHERE conversation_id = ${validated.conversationId}
+            WHERE thread_id = ${validated.threadId}
               AND state <> 'settled'
+              AND (
+                state <> 'unknown' OR EXISTS (
+                  SELECT 1 FROM effect_agent_abort_intents
+                  WHERE submission_id = effect_agent_submissions.submission_id
+                )
+              )
             ORDER BY queue_sequence ASC
             LIMIT 1
           `.pipe(Effect.mapError(sqlFailure(operation)));
-          const heads = yield* decodeSubmissionRows(operation, validated.conversationId, headRows);
+
+          const heads = yield* decodeSubmissionRows(operation, validated.threadId, headRows);
+
           if (heads.length === 0) return Option.none<Claim>();
           const head = heads[0];
 
-          // A joining/joined head is host-owned and a suspended/unknown head is durably
-          // blocked (DUR-017); the lane produces no claim and later ready work is never
-          // skipped past the blocked head (DUR-004).
+          // Approval/delegation suspension and joined work retain their queue barrier.
+          // Unknown work with an abort intent is selected for cleanup without Tool replay.
           if (
             head.state === "joining" ||
             head.state === "joined" ||
             head.state === "suspended" ||
-            head.state === "unknown"
+            (head.state === "unknown" &&
+              Option.isNone(yield* readAbortIntent(operation, head.submission_id)))
           ) {
             return Option.none<Claim>();
           }
 
-          const now = yield* currentInstant;
-          const ownership = yield* readOwnership(operation, head.submission_id);
-          if (Option.isSome(ownership)) {
-            const expiresAt = yield* timestampMillis(
-              operation,
-              head.submission_id,
-            )(ownership.value.lease_expires_at);
-            // A live lease blocks every new claim; expiry alone only revokes the liveness
-            // assumption — correctness stays with producer-epoch fencing (D5). In DC a live
-            // lease under another token can only come from an evicted incarnation.
-            if (expiresAt > now.millis) return Option.none<Claim>();
-          }
-
-          // Bump the Conversation's producer epoch atomically with the claim so every stale
-          // Attempt is fenced out of canonical appends (DUR-006). A Conversation that was
+          // Bump the Thread's producer epoch atomically with the claim so every stale
+          // Attempt is fenced out of canonical appends (DUR-006). A Thread that was
           // never materialized (eviction between admission and materialization) is created
           // here so recovery can claim first and re-materialize idempotently at this epoch.
-          const conversations = yield* journal
-            .getConversation(head.conversation_id)
+          const threads = yield* journal
+            .getThread(head.thread_id)
             .pipe(Effect.mapError(internalFailure(operation)));
+
           let producerEpoch: number;
-          if (conversations.length === 0) {
+
+          if (threads.length === 0) {
             producerEpoch = 1;
             yield* sql`
-              INSERT INTO effect_agent_conversations (
-                conversation_id,
+              INSERT INTO effect_agent_threads (
+                thread_id,
                 created_at,
                 tail_sequence,
                 tail_digest,
                 producer_epoch
               ) VALUES (
-                ${head.conversation_id},
+                ${head.thread_id},
                 ${now.iso},
                 0,
                 ${EMPTY_TAIL_DIGEST},
@@ -1252,15 +1559,16 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               )
             `.pipe(Effect.mapError(sqlFailure(operation)));
           } else {
-            producerEpoch = conversations[0].producer_epoch + 1;
+            producerEpoch = threads[0].producer_epoch + 1;
             yield* sql`
-              UPDATE effect_agent_conversations
+              UPDATE effect_agent_threads
               SET producer_epoch = ${producerEpoch}
-              WHERE conversation_id = ${head.conversation_id}
+              WHERE thread_id = ${head.thread_id}
             `.pipe(Effect.mapError(sqlFailure(operation)));
           }
 
           const leaseExpiresAt = new Date(now.millis + config.ownershipLeaseDuration).toISOString();
+
           yield* sql`
             INSERT INTO effect_agent_submission_ownership (
               submission_id,
@@ -1289,14 +1597,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             INSERT INTO effect_agent_attempts (
               attempt_id,
               submission_id,
-              conversation_id,
+              thread_id,
               owner_producer_id,
               producer_epoch,
               claimed_at
             ) VALUES (
               ${attemptId},
               ${head.submission_id},
-              ${head.conversation_id},
+              ${head.thread_id},
               ${validated.producerId},
               ${producerEpoch},
               ${now.iso}
@@ -1321,6 +1629,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               ),
             ),
           );
+
           return Option.some(
             yield* decodeClaim({
               submissionId: head.submission_id,
@@ -1333,7 +1642,9 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           );
         }),
       );
+
       yield* hitFailpoint("ledger:claim:after", operation);
+
       return claimed;
     },
   );
@@ -1342,29 +1653,37 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.renewOwnership",
   )(function* (request: RenewOwnershipRequest) {
     const operation = "ledger renew ownership";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(RenewOwnershipRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(RenewOwnershipRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:renew:before", operation);
+
     const renewal = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         yield* requireOwnership(operation, submission, validated.ownershipToken);
         const now = yield* currentInstant;
         const leaseExpiresAt = new Date(now.millis + config.ownershipLeaseDuration).toISOString();
+
         yield* sql`
           UPDATE effect_agent_submission_ownership
           SET lease_expires_at = ${leaseExpiresAt}
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
+
         return yield* decodeOwnershipRenewal({
           ownershipToken: validated.ownershipToken,
           leaseExpiresAt,
         }).pipe(Effect.mapError(internalFailure(operation)));
       }),
     );
+
     yield* hitFailpoint("ledger:renew:after", operation);
+
     return renewal;
   });
 
@@ -1372,14 +1691,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.releaseOwnership",
   )(function* (request: ReleaseOwnershipRequest) {
     const operation = "ledger release ownership";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ReleaseOwnershipRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseOwnershipRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:release:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         yield* requireOwnership(operation, submission, validated.ownershipToken);
         yield* sql`
           DELETE FROM effect_agent_submission_ownership
@@ -1401,14 +1723,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.markInputApplied",
   )(function* (request: MarkInputAppliedRequest) {
     const operation = "ledger mark input applied";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(MarkInputAppliedRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(MarkInputAppliedRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:mark-input-applied:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         yield* requireOwnership(operation, submission, validated.ownershipToken);
         if (submission.input_applied_record_id !== null) {
           if (
@@ -1417,6 +1742,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           ) {
             return;
           }
+
           return yield* corruptionFailure(
             operation,
             "effect_agent_submissions",
@@ -1444,34 +1770,41 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.reserveSettlement",
   )(function* (request: SettlementReservation) {
     const operation = "ledger reserve settlement";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SettlementReservation))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(SettlementReservation))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     const recordJson = yield* encodeRecordEnvelopeText(validated.record).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     // The reserved record is appended canonically later; refuse over-bound payloads typed
     // before the reservation row exists.
     yield* journal
       .checkValueBound(operation, recordJson)
       .pipe(Effect.mapError(internalFailure(operation)));
     yield* hitFailpoint("ledger:reserve-settlement:before", operation);
+
     const reserved = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const existing = yield* readReservation(operation, validated.submissionId);
+
         if (Option.isSome(existing)) {
           const identical =
             existing.value.settlement_id === validated.settlementId &&
             existing.value.outcome === validated.outcome &&
             existing.value.record_digest === validated.recordDigest &&
             existing.value.record_json === recordJson;
+
           if (!identical) {
             return yield* SettlementConflict.make({
               submissionId: validated.submissionId,
               existingOutcome: existing.value.outcome,
             });
           }
+
           const record = yield* decodeRecordEnvelopeText(existing.value.record_json).pipe(
             Effect.mapError((error) =>
               corruptionFailure(
@@ -1482,6 +1815,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               ),
             ),
           );
+
           return ReservedSettlement.make({
             submissionId: validated.submissionId,
             settlementId: validated.settlementId,
@@ -1493,6 +1827,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         }
 
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -1502,6 +1837,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -1516,13 +1852,16 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           // ABORTED settlement (`terminalizing` is the same pass's crash replay). Every other
           // reservation stays fenced by the target lane's live ownership.
           let queuedAbortSettlement = false;
+
           if (
             validated.outcome === "aborted" &&
             (submission.state === "ready" || submission.state === "terminalizing")
           ) {
             const abortIntent = yield* readAbortIntent(operation, validated.submissionId);
+
             if (Option.isSome(abortIntent)) {
               const ownership = yield* readOwnership(operation, validated.submissionId);
+
               queuedAbortSettlement = Option.isNone(ownership);
             }
           }
@@ -1531,6 +1870,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           }
         }
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_settlement_reservations (
             submission_id,
@@ -1555,6 +1895,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           SET state = 'terminalizing'
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
+
         return ReservedSettlement.make({
           submissionId: validated.submissionId,
           settlementId: validated.settlementId,
@@ -1565,56 +1906,161 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         });
       }),
     );
+
     yield* hitFailpoint("ledger:reserve-settlement:after", operation);
+
     return reserved;
   });
 
-  const finalizeSettlement: SubmissionLedger["Service"]["finalizeSettlement"] = Effect.fn(
-    "DoSubmissionLedger.finalizeSettlement",
-  )(function* (request: SettlementFinalization) {
+  const validateFinalization = Effect.fn("DoSubmissionLedger.validateFinalization")(function* (
+    validated: SettlementFinalization,
+    reservation: Option.Option<ReservationRow>,
+  ) {
     const operation = "ledger finalize settlement";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SettlementFinalization))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
-    yield* hitFailpoint("ledger:finalize-settlement:before", operation);
-    const settlement = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const reservation = yield* readReservation(operation, validated.submissionId);
-        if (Option.isNone(reservation)) {
-          return yield* LedgerError.make({
+
+    if (Option.isNone(reservation)) {
+      return yield* LedgerError.make({
+        operation,
+        message: `No settlement reservation exists for submission ${validated.submissionId}.`,
+      });
+    }
+    if (reservation.value.settlement_id !== validated.settlementId) {
+      return yield* SettlementConflict.make({
+        submissionId: validated.submissionId,
+        existingOutcome: reservation.value.outcome,
+      });
+    }
+
+    const reservationRecord = yield* decodeRecordEnvelopeText(reservation.value.record_json).pipe(
+      Effect.mapError((error) =>
+        corruptionFailure(
+          operation,
+          "effect_agent_settlement_reservations",
+          validated.submissionId,
+          error.message,
+        ),
+      ),
+    );
+
+    const settlementFailure = settlementFailureFromRecord(reservationRecord);
+
+    if ((reservation.value.outcome === "failed") !== (settlementFailure !== undefined)) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_settlement_reservations",
+        validated.submissionId,
+        "The reserved outcome and canonical failure diagnostic disagree.",
+      );
+    }
+
+    return { reservation: reservation.value, settlementFailure };
+  });
+
+  const replayFinalization = Effect.fn("DoSubmissionLedger.replayFinalization")(function* (
+    validated: SettlementFinalization,
+    submission: SubmissionRow,
+    { reservation, settlementFailure }: Effect.Success<ReturnType<typeof validateFinalization>>,
+  ) {
+    const operation = "ledger finalize settlement";
+
+    if (reservation.finalized_at === null) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_settlement_reservations",
+        validated.submissionId,
+        "A settled Submission's reservation carries no finalization timestamp.",
+      );
+    }
+
+    return yield* decodeSettlement({
+      submissionId: validated.submissionId,
+      settlementId: validated.settlementId,
+      receiptId: submission.receipt_id,
+      outcome: reservation.outcome,
+      ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
+      settledAt: reservation.finalized_at,
+    }).pipe(Effect.mapError(internalFailure(operation)));
+  });
+
+  const finalizeSettlement: SubmissionLedger["Service"]["finalizeSettlement"] = Effect.fn(
+    "DoSubmissionLedger.finalizeSettlement",
+  )(function* (request: SettlementFinalization) {
+    const operation = "ledger finalize settlement";
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(SettlementFinalization))(
+      request,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    yield* hitFailpoint("ledger:finalize-settlement:before", operation);
+
+    // A single statement captures the settled row and its immutable reservation together.
+    // A miss does not authorize finalization: the write path re-reads under its transaction.
+    const replayRows = yield* sql<Record<string, unknown>>`
+      SELECT submission.*, reservation.settlement_id, reservation.outcome,
+        reservation.record_id, reservation.record_json, reservation.record_digest,
+        reservation.reserved_at, reservation.finalized_at
+      FROM effect_agent_submissions AS submission
+      INNER JOIN effect_agent_settlement_reservations AS reservation
+        ON reservation.submission_id = submission.submission_id
+      WHERE submission.submission_id = ${validated.submissionId} AND submission.state = 'settled'
+    `.pipe(Effect.mapError(sqlFailure(operation)));
+
+    if (replayRows.length > 1) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_submissions",
+        validated.submissionId,
+        "A submission primary key returned more than one row.",
+      );
+    }
+    const replayRow = replayRows[0];
+
+    if (replayRow !== undefined) {
+      const reservations = yield* decodeRows(
+        Schema.Array(ReservationRow),
+        "effect_agent_settlement_reservations",
+        validated.submissionId,
+        replayRows,
+      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const state = yield* validateFinalization(validated, Option.fromUndefinedOr(reservations[0]));
+
+      const submission = yield* Schema.decodeUnknownEffect(SubmissionRow)(replayRow).pipe(
+        Effect.mapError((error) =>
+          corruptionFailure(
             operation,
-            message: `No settlement reservation exists for submission ${validated.submissionId}.`,
-          });
-        }
-        if (reservation.value.settlement_id !== validated.settlementId) {
-          return yield* SettlementConflict.make({
-            submissionId: validated.submissionId,
-            existingOutcome: reservation.value.outcome,
-          });
-        }
+            "effect_agent_submissions",
+            validated.submissionId,
+            error.message,
+          ),
+        ),
+      );
+
+      const settlement = yield* replayFinalization(validated, submission, state);
+
+      yield* hitFailpoint("ledger:finalize-settlement:after", operation);
+
+      return settlement;
+    }
+
+    const settlement = yield* inWriteTransaction(
+      operation,
+      Effect.gen(function* () {
+        const state = yield* validateFinalization(
+          validated,
+          yield* readReservation(operation, validated.submissionId),
+        );
+
+        const { reservation, settlementFailure } = state;
         const submission = yield* requireSubmission(operation, validated.submissionId);
-        if (submission.state === "settled") {
-          if (reservation.value.finalized_at === null) {
-            return yield* corruptionFailure(
-              operation,
-              "effect_agent_settlement_reservations",
-              validated.submissionId,
-              "A settled Submission's reservation carries no finalization timestamp.",
-            );
-          }
-          return yield* decodeSettlement({
-            submissionId: validated.submissionId,
-            settlementId: validated.settlementId,
-            receiptId: submission.receipt_id,
-            outcome: reservation.value.outcome,
-            settledAt: reservation.value.finalized_at,
-          }).pipe(Effect.mapError(internalFailure(operation)));
-        }
+
+        if (submission.state === "settled")
+          return yield* replayFinalization(validated, submission, state);
         const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_submissions
-          SET state = 'settled', settled_outcome = ${reservation.value.outcome}
+          SET state = 'settled', settled_outcome = ${reservation.outcome}
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
         yield* sql`
@@ -1626,16 +2072,20 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           DELETE FROM effect_agent_submission_ownership
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
+
         return yield* decodeSettlement({
           submissionId: validated.submissionId,
           settlementId: validated.settlementId,
           receiptId: submission.receipt_id,
-          outcome: reservation.value.outcome,
+          outcome: reservation.outcome,
+          ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
           settledAt: now.iso,
         }).pipe(Effect.mapError(internalFailure(operation)));
       }),
     );
+
     yield* hitFailpoint("ledger:finalize-settlement:after", operation);
+
     return settlement;
   });
 
@@ -1643,14 +2093,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.requestAbort",
   )(function* (request: AbortCommand) {
     const operation = "ledger request abort";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(AbortCommand))(request).pipe(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(AbortCommand))(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:request-abort:before", operation);
+
     const intent = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -1660,6 +2114,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -1677,15 +2132,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               "A joined Submission carries no host linkage.",
             );
           }
+
           const hostSubmissionId = yield* decodeSubmissionId(
             submission.joined_host_submission_id,
           ).pipe(Effect.mapError(internalFailure(operation)));
+
           return yield* JoinedToHost.make({
             submissionId: validated.submissionId,
             hostSubmissionId,
           });
         }
         const existing = yield* readAbortIntent(operation, validated.submissionId);
+
         if (Option.isSome(existing)) {
           return yield* abortIntentFromRow(
             operation,
@@ -1695,6 +2153,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           );
         }
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_abort_intents (
             submission_id,
@@ -1708,11 +2167,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             ${now.iso}
           )
         `.pipe(Effect.mapError(sqlFailure(operation)));
+
         const canonicalRecordId = yield* canonicalAbortRecordId(
           operation,
-          submission.conversation_id,
+          submission.thread_id,
           validated.submissionId,
         );
+
         return yield* decodeAbortIntent({
           submissionId: validated.submissionId,
           author: validated.author,
@@ -1722,7 +2183,9 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         }).pipe(Effect.mapError(internalFailure(operation)));
       }),
     );
+
     yield* hitFailpoint("ledger:request-abort:after", operation);
+
     return intent;
   });
 
@@ -1730,31 +2193,38 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.claimJoining",
   )(function* (request: ClaimJoiningRequest) {
     const operation = "ledger claim joining";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ClaimJoiningRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ClaimJoiningRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:claim-joining:before", operation);
+
     const claims = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const host = yield* requireSubmission(operation, validated.hostSubmissionId);
-        if (host.conversation_id !== validated.conversationId) {
+
+        if (host.thread_id !== validated.threadId) {
           return yield* LedgerError.make({
             operation,
-            message: `Host submission ${validated.hostSubmissionId} does not belong to conversation ${validated.conversationId}.`,
+            message: `Host submission ${validated.hostSubmissionId} does not belong to thread ${validated.threadId}.`,
           });
         }
         // The host Attempt already owns the lane; no epoch bump happens here (plan §2.5).
         yield* requireOwnership(operation, host, validated.ownershipToken);
+
         const laterRows = yield* sql<Record<string, unknown>>`
           SELECT ${sql.literal(SUBMISSION_COLUMNS)}
           FROM effect_agent_submissions
-          WHERE conversation_id = ${validated.conversationId}
+          WHERE thread_id = ${validated.threadId}
             AND queue_sequence > ${host.queue_sequence}
           ORDER BY queue_sequence ASC
         `.pipe(Effect.mapError(sqlFailure(operation)));
-        const later = yield* decodeSubmissionRows(operation, validated.conversationId, laterRows);
+
+        const later = yield* decodeSubmissionRows(operation, validated.threadId, laterRows);
         const claimed: Array<JoiningClaim> = [];
+
         for (const row of later) {
           if (claimed.length >= validated.maxCount) break;
           // Rows already claimed by THIS host extend its contiguous prefix and are skipped;
@@ -1777,6 +2247,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             SET state = 'joining', joined_host_submission_id = ${validated.hostSubmissionId}
             WHERE submission_id = ${row.submission_id}
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
             Effect.mapError((error) =>
               corruptionFailure(
@@ -1787,6 +2258,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               ),
             ),
           );
+
           claimed.push(
             yield* decodeJoiningClaim({
               submissionId: row.submission_id,
@@ -1795,10 +2267,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             }).pipe(Effect.mapError(internalFailure(operation))),
           );
         }
-        return claimed as ReadonlyArray<JoiningClaim>;
+
+        return claimed;
       }),
     );
+
     yield* hitFailpoint("ledger:claim-joining:after", operation);
+
     return claims;
   });
 
@@ -1806,14 +2281,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.markJoined",
   )(function* (request: MarkJoinedRequest) {
     const operation = "ledger mark joined";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(MarkJoinedRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(MarkJoinedRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:mark-joined:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.joined_host_submission_id === null) {
           return yield* LedgerError.make({
             operation,
@@ -1821,6 +2299,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           });
         }
         const host = yield* requireSubmission(operation, submission.joined_host_submission_id);
+
         // The lane is host-owned: the presented token must own the HOST's ownership period,
         // which also lets a later host Attempt repair a lost marker from history (DUR-016).
         yield* requireOwnership(operation, host, validated.ownershipToken);
@@ -1831,6 +2310,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           ) {
             return;
           }
+
           return yield* corruptionFailure(
             operation,
             "effect_agent_submissions",
@@ -1861,14 +2341,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.revertJoining",
   )(function* (request: RevertJoiningRequest) {
     const operation = "ledger revert joining";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(RevertJoiningRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(RevertJoiningRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:revert-joining:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         // Idempotent and recovery-only: only a still-`joining` Submission reverts; an
         // already-joined (or already-reverted) Submission is a no-op (DUR-016).
         if (submission.state !== "joining") return;
@@ -1885,17 +2368,22 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
   const suspend: SubmissionLedger["Service"]["suspend"] = Effect.fn("DoSubmissionLedger.suspend")(
     function* (request: SuspendRequest) {
       const operation = "ledger suspend";
-      const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SuspendRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(SuspendRequest))(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
+
       const reasonJson = yield* encodeSuspensionReasonText(validated.reason).pipe(
         Effect.mapError(internalFailure(operation)),
       );
+
       yield* hitFailpoint("ledger:suspend:before", operation);
+
       const outcome = yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
           const submission = yield* requireSubmission(operation, validated.submissionId);
+
           if (submission.state === "settled") {
             if (submission.settled_outcome === null) {
               return yield* corruptionFailure(
@@ -1905,6 +2393,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
                 "A settled Submission carries no terminal outcome.",
               );
             }
+
             return yield* SettlementConflict.make({
               submissionId: validated.submissionId,
               existingOutcome: submission.settled_outcome,
@@ -1913,6 +2402,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           // An exact terminal outcome is already reserved (DUR-011); suspension would
           // contradict it, so the reservation wins.
           const reservation = yield* readReservation(operation, validated.submissionId);
+
           if (Option.isSome(reservation)) {
             return yield* SettlementConflict.make({
               submissionId: validated.submissionId,
@@ -1923,35 +2413,39 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           // A covering event that raced ahead of the suspend transaction resumes the caller
           // immediately WITHOUT releasing the lane (plan §2.6, §12). For WaitingForChild the
           // covering evidence is EITHER a locally settled child row OR a durable cross-store
-          // notification marker: parent and child Conversations live in different Durable
+          // notification marker: parent and child Threads live in different Durable
           // Objects, and the port contract requires that a child settlement reported (via
           // `recordChildSettled` → marker) before this suspend commits is observed here.
           if (validated.reason._tag === "ApprovalPending") {
             const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
             const decided = new Set(decisions.map((row) => row.tool_call_id));
+
             if (validated.reason.toolCallIds.every((toolCallId) => decided.has(toolCallId))) {
-              return "resume-immediately" as SuspensionOutcome;
+              return RESUME_IMMEDIATELY;
             }
           } else {
             const markers = yield* readChildSettlementMarkers(operation, validated.submissionId);
             const markerChildren = new Set(markers.map((row) => row.child_submission_id));
             let allSettled = true;
+
             for (const child of validated.reason.children) {
               const settled = yield* childProvablySettled(
                 operation,
                 markerChildren,
                 child.childSubmissionId,
               );
+
               if (!settled) {
                 allSettled = false;
                 break;
               }
             }
             if (allSettled) {
-              return "resume-immediately" as SuspensionOutcome;
+              return RESUME_IMMEDIATELY;
             }
           }
           const now = yield* currentInstant;
+
           yield* sql`
             UPDATE effect_agent_submissions
             SET
@@ -1966,10 +2460,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             DELETE FROM effect_agent_submission_ownership
             WHERE submission_id = ${validated.submissionId}
           `.pipe(Effect.mapError(sqlFailure(operation)));
-          return "suspended" as SuspensionOutcome;
+
+          return SUSPENDED;
         }),
       );
+
       yield* hitFailpoint("ledger:suspend:after", operation);
+
       return outcome;
     },
   );
@@ -1985,6 +2482,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     submission: SubmissionRow,
   ): Effect.fn.Return<void, LedgerError> {
     if (submission.state !== "suspended" || submission.suspended_reason_json === null) return;
+
     const reason = yield* Schema.decodeEffect(Schema.fromJsonString(SuspensionReason))(
       submission.suspended_reason_json,
     ).pipe(
@@ -1997,9 +2495,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         ),
       ),
     );
+
     if (reason._tag !== "ApprovalPending") return;
     const decisions = yield* readApprovalDecisions(operation, submission.submission_id);
     const decided = new Set(decisions.map((row) => row.tool_call_id));
+
     if (!reason.toolCallIds.every((toolCallId) => decided.has(toolCallId))) return;
     yield* sql`
       UPDATE effect_agent_submissions
@@ -2015,14 +2515,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.recordApprovalDecision",
   )(function* (command: ApprovalDecisionCommand) {
     const operation = "ledger record approval decision";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ApprovalDecisionCommand))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ApprovalDecisionCommand))(
       command,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:approval-decision:before", operation);
+
     const intent = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -2032,6 +2536,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -2039,6 +2544,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         }
         const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
         const existing = decisions.find((row) => row.tool_call_id === validated.toolCallId);
+
         if (existing !== undefined) {
           // Idempotent per (submissionId, toolCallId): repeating the SAME decision replays
           // the recorded intent unchanged; a divergent re-decision conflicts.
@@ -2049,9 +2555,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               existingDecision: existing.decision,
             });
           }
+
           return yield* approvalIntentFromRow(operation, existing);
         }
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_approval_decisions (
             submission_id,
@@ -2070,6 +2578,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           )
         `.pipe(Effect.mapError(sqlFailure(operation)));
         yield* wakeSuspendedIfCovered(operation, submission);
+
         return yield* decodeApprovalDecisionIntent({
           submissionId: validated.submissionId,
           toolCallId: validated.toolCallId,
@@ -2080,7 +2589,9 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         }).pipe(Effect.mapError(internalFailure(operation)));
       }),
     );
+
     yield* hitFailpoint("ledger:approval-decision:after", operation);
+
     return intent;
   });
 
@@ -2088,14 +2599,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.markUnknown",
   )(function* (request: MarkUnknownRequest) {
     const operation = "ledger mark unknown";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(MarkUnknownRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(MarkUnknownRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:mark-unknown:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -2105,6 +2619,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -2113,6 +2628,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         // A reserved exact outcome wins over a late Unknown marking (DUR-011); the recovery
         // classifier orders reservation ahead of MarkUnknown for the same reason.
         const reservation = yield* readReservation(operation, validated.submissionId);
+
         if (Option.isSome(reservation)) {
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
@@ -2123,13 +2639,16 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         // set while the first recorded reason is kept.
         const existingIds = yield* storedUnknownToolCallIds(operation, submission);
         const known = new Set(existingIds);
+
         const merged = [
           ...existingIds,
           ...validated.toolCallIds.filter((toolCallId) => !known.has(toolCallId)),
         ];
+
         const idsJson = yield* encodeToolCallIdsText(merged).pipe(
           Effect.mapError(internalFailure(operation)),
         );
+
         yield* sql`
           UPDATE effect_agent_submissions
           SET
@@ -2147,17 +2666,22 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.recordUnknownResolution",
   )(function* (command: UnknownResolutionCommand) {
     const operation = "ledger record unknown resolution";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(UnknownResolutionCommand))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(UnknownResolutionCommand))(
       command,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     const resolutionJson = yield* encodeUnknownResolutionText(validated.resolution).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:unknown-resolution:before", operation);
+
     const intent = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -2167,6 +2691,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -2174,19 +2699,30 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         }
         const resolutions = yield* readUnknownResolutions(operation, validated.submissionId);
         const existing = resolutions.find((row) => row.tool_call_id === validated.toolCallId);
-        if (existing !== undefined && existing.resolution_json !== resolutionJson) {
+
+        const existingIntent =
+          existing === undefined
+            ? undefined
+            : yield* unknownResolutionIntentFromRow(operation, existing);
+
+        if (
+          existingIntent !== undefined &&
+          !equivalentUnknownResolution(existingIntent.resolution, validated.resolution)
+        ) {
           return yield* UnknownResolutionConflict.make({
             submissionId: validated.submissionId,
             toolCallId: validated.toolCallId,
           });
         }
         let resolved: UnknownResolutionIntent;
-        if (existing !== undefined) {
+
+        if (existingIntent !== undefined) {
           // Idempotent replay of the recorded intent (author/reason may differ; the stored
           // audit fields win, exactly like requestAbort).
-          resolved = yield* unknownResolutionIntentFromRow(operation, existing);
+          resolved = existingIntent;
         } else {
           const now = yield* currentInstant;
+
           yield* sql`
             INSERT INTO effect_agent_unknown_resolutions (
               submission_id,
@@ -2204,9 +2740,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               ${now.iso}
             )
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const resolution = yield* parseStoredJsonText(resolutionJson).pipe(
             Effect.mapError(internalFailure(operation)),
           );
+
           resolved = yield* decodeUnknownResolutionIntent({
             submissionId: validated.submissionId,
             toolCallId: validated.toolCallId,
@@ -2223,6 +2761,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           const markedIds = yield* storedUnknownToolCallIds(operation, submission);
           const covering = yield* readUnknownResolutions(operation, validated.submissionId);
           const coveredIds = new Set(covering.map((row) => row.tool_call_id));
+
           if (markedIds.every((toolCallId) => coveredIds.has(toolCallId))) {
             yield* sql`
               UPDATE effect_agent_submissions
@@ -2234,10 +2773,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             `.pipe(Effect.mapError(sqlFailure(operation)));
           }
         }
+
         return resolved;
       }),
     );
+
     yield* hitFailpoint("ledger:unknown-resolution:after", operation);
+
     return intent;
   });
 
@@ -2245,21 +2787,31 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.recordChildSettled",
   )(function* (request: ChildSettledNotification) {
     const operation = "ledger record child settled";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ChildSettledNotification))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ChildSettledNotification))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:child-settled:before", operation);
+
     const outcome = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
         // The child's canonical Settlement is the authority for this wake. When the child's
-        // row lives in THIS store (single-store latitude, and every conformance lane), an
-        // unsettled child makes the notification a caller error exactly as on Node. When it
-        // does not — the normal cross-DO case — the routed notification from the child's
-        // owning Durable Object is the settlement evidence this store records durably.
+        // row lives in THIS store (single-store latitude, and every conformance lane), either a
+        // finalized row or an exact terminalizing reservation admits the notification: the
+        // runtime calls only after the canonical append and before ledger finalization. When the
+        // row does not live here — the normal cross-DO case — the routed notification from the
+        // child's owning Durable Object is the settlement evidence this store records durably.
         const child = yield* readSubmission(operation, validated.childSubmissionId);
-        if (Option.isSome(child) && child.value.state !== "settled") {
+        const childReservation = yield* readReservation(operation, validated.childSubmissionId);
+
+        if (
+          Option.isSome(child) &&
+          child.value.state !== "settled" &&
+          !(child.value.state === "terminalizing" && Option.isSome(childReservation))
+        ) {
           return yield* LedgerError.make({
             operation,
             message: `Child submission ${validated.childSubmissionId} has no recorded settlement.`,
@@ -2270,6 +2822,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         // before the parent's suspend transaction is observed by that suspend's covering
         // check, even when the parent is not (or not yet) suspended.
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_child_settlements (
             parent_submission_id,
@@ -2279,15 +2832,22 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           ) VALUES (
             ${validated.parentSubmissionId},
             ${validated.childSubmissionId},
-            ${Option.isSome(child) ? child.value.settled_outcome : null},
+            ${
+              Option.isSome(child) && child.value.state === "settled"
+                ? child.value.settled_outcome
+                : Option.isSome(childReservation)
+                  ? childReservation.value.outcome
+                  : null
+            },
             ${now.iso}
           )
           ON CONFLICT (parent_submission_id, child_submission_id) DO NOTHING
         `.pipe(Effect.mapError(sqlFailure(operation)));
 
         if (parent.state !== "suspended" || parent.suspended_reason_json === null) {
-          return "not-waiting" as ChildSettledOutcome;
+          return NOT_WAITING;
         }
+
         const reason = yield* Schema.decodeEffect(Schema.fromJsonString(SuspensionReason))(
           parent.suspended_reason_json,
         ).pipe(
@@ -2300,27 +2860,30 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             ),
           ),
         );
+
         if (reason._tag !== "WaitingForChild") {
-          return "not-waiting" as ChildSettledOutcome;
+          return NOT_WAITING;
         }
         if (
           !reason.children.some((entry) => entry.childSubmissionId === validated.childSubmissionId)
         ) {
-          return "not-waiting" as ChildSettledOutcome;
+          return NOT_WAITING;
         }
         // The parent wakes exactly when EVERY listed child is provably settled — from its
         // local row or a recorded marker (spec §12 step 10); replays re-run the coverage
         // check so a recovering caller wakes the lane idempotently.
         const markers = yield* readChildSettlementMarkers(operation, validated.parentSubmissionId);
         const markerChildren = new Set(markers.map((row) => row.child_submission_id));
+
         for (const entry of reason.children) {
           const settled = yield* childProvablySettled(
             operation,
             markerChildren,
             entry.childSubmissionId,
           );
+
           if (!settled) {
-            return "still-waiting" as ChildSettledOutcome;
+            return STILL_WAITING;
           }
         }
         yield* sql`
@@ -2331,10 +2894,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             suspended_at = NULL
           WHERE submission_id = ${validated.parentSubmissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
-        return "woken" as ChildSettledOutcome;
+
+        return WOKEN;
       }),
     );
+
     yield* hitFailpoint("ledger:child-settled:after", operation);
+
     return outcome;
   });
 
@@ -2342,25 +2908,36 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.reserveChildBudget",
   )(function* (request: ChildBudgetReservationRequest) {
     const operation = "ledger reserve child budget";
-    const validated = yield* Schema.decodeUnknownEffect(
-      Schema.toType(ChildBudgetReservationRequest),
-    )(request).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ChildBudgetReservationRequest))(
+      request,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
     const allocationJson = yield* encodePersistedJsonText(validated.allocation).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:child-reservation:before", operation);
+
     const reserved = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const existing = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isSome(existing)) {
+          const existingSnapshot = yield* childReservationSnapshotFromRow(
+            operation,
+            existing.value,
+          );
+
           // Identical replays short-circuit before the fence, mirroring reserveSettlement: a
           // replay creates nothing, so a recovering caller resumes rather than duplicates.
           const identical =
             existing.value.parent_submission_id === validated.parentSubmissionId &&
             existing.value.parent_tool_call_id === validated.parentToolCallId &&
             existing.value.allocation_digest === validated.allocationDigest &&
-            existing.value.allocation_json === allocationJson;
+            equivalentPersistedJson(existingSnapshot.allocation, validated.allocation);
+
           if (!identical) {
             return yield* ChildReservationConflict.make({
               reservationId: validated.reservationId,
@@ -2369,16 +2946,19 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
                 "A reservation with this identity exists with a different parent Tool Call or allocation.",
             });
           }
+
           return ReservedChildBudget.make({
-            reservation: yield* childReservationSnapshotFromRow(operation, existing.value),
+            reservation: existingSnapshot,
             replayed: true,
           });
         }
+
         const collision = yield* readChildReservationForCall(
           operation,
           validated.parentSubmissionId,
           validated.parentToolCallId,
         );
+
         if (Option.isSome(collision)) {
           return yield* ChildReservationConflict.make({
             reservationId: validated.reservationId,
@@ -2387,10 +2967,12 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           });
         }
         const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
+
         // Creation is fenced by the parent lane's live ownership (spec §12 step 2): a stale
         // parent Attempt can never create new reservation state.
         yield* requireOwnership(operation, parent, validated.ownershipToken);
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_child_reservations (
             reservation_id,
@@ -2411,6 +2993,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           )
         `.pipe(Effect.mapError(sqlFailure(operation)));
         const inserted = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(inserted)) {
           return yield* corruptionFailure(
             operation,
@@ -2419,13 +3002,16 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             "An inserted child reservation row is missing inside its own transaction.",
           );
         }
+
         return ReservedChildBudget.make({
           reservation: yield* childReservationSnapshotFromRow(operation, inserted.value),
           replayed: false,
         });
       }),
     );
+
     yield* hitFailpoint("ledger:child-reservation:after", operation);
+
     return reserved;
   });
 
@@ -2434,14 +3020,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       request: AttachChildToReservationRequest,
     ) {
       const operation = "ledger attach child to reservation";
-      const validated = yield* Schema.decodeUnknownEffect(
-        Schema.toType(AttachChildToReservationRequest),
-      )(request).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(AttachChildToReservationRequest))(
+        request,
+      ).pipe(Effect.mapError(internalFailure(operation)));
+
       yield* hitFailpoint("ledger:child-attach:before", operation);
+
       const attached = yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
           const existing = yield* readChildReservation(operation, validated.reservationId);
+
           if (Option.isNone(existing)) {
             return yield* LedgerError.make({
               operation,
@@ -2453,6 +3043,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             if (existing.value.child_submission_id === validated.childSubmissionId) {
               return yield* childReservationSnapshotFromRow(operation, existing.value);
             }
+
             return yield* ChildReservationConflict.make({
               reservationId: validated.reservationId,
               status: existing.value.status,
@@ -2460,6 +3051,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             });
           }
           const parent = yield* requireSubmission(operation, existing.value.parent_submission_id);
+
           yield* requireOwnership(operation, parent, validated.ownershipToken);
           if (existing.value.status !== "reserved") {
             return yield* ChildReservationConflict.make({
@@ -2478,6 +3070,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             WHERE reservation_id = ${validated.reservationId}
           `.pipe(Effect.mapError(sqlFailure(operation)));
           const updated = yield* readChildReservation(operation, validated.reservationId);
+
           if (Option.isNone(updated)) {
             return yield* corruptionFailure(
               operation,
@@ -2486,10 +3079,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               "An updated child reservation row is missing inside its own transaction.",
             );
           }
+
           return yield* childReservationSnapshotFromRow(operation, updated.value);
         }),
       );
+
       yield* hitFailpoint("ledger:child-attach:after", operation);
+
       return attached;
     });
 
@@ -2497,17 +3093,22 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.beginChildBudgetRelease",
   )(function* (request: BeginChildBudgetReleaseRequest) {
     const operation = "ledger begin child budget release";
-    const validated = yield* Schema.decodeUnknownEffect(
-      Schema.toType(BeginChildBudgetReleaseRequest),
-    )(request).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(BeginChildBudgetReleaseRequest))(
+      request,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
     const accountingJson = yield* encodePersistedJsonText(validated.accounting).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:child-release-pending:before", operation);
+
     const frozen = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const existing = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(existing)) {
           return yield* LedgerError.make({
             operation,
@@ -2515,11 +3116,20 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           });
         }
         if (existing.value.status !== "reserved") {
+          const existingSnapshot = yield* childReservationSnapshotFromRow(
+            operation,
+            existing.value,
+          );
+
           // The accounting decision was already frozen exactly once; an identical replay is a
           // no-op and a divergent decision conflicts (spec §12 join step 6).
-          if (existing.value.accounting_json === accountingJson) {
-            return yield* childReservationSnapshotFromRow(operation, existing.value);
+          if (
+            existingSnapshot.accounting !== undefined &&
+            equivalentPersistedJson(existingSnapshot.accounting, validated.accounting)
+          ) {
+            return existingSnapshot;
           }
+
           return yield* ChildReservationConflict.make({
             reservationId: validated.reservationId,
             status: existing.value.status,
@@ -2527,6 +3137,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           });
         }
         const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_child_reservations
           SET
@@ -2536,6 +3147,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           WHERE reservation_id = ${validated.reservationId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
         const updated = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(updated)) {
           return yield* corruptionFailure(
             operation,
@@ -2544,10 +3156,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             "An updated child reservation row is missing inside its own transaction.",
           );
         }
+
         return yield* childReservationSnapshotFromRow(operation, updated.value);
       }),
     );
+
     yield* hitFailpoint("ledger:child-release-pending:after", operation);
+
     return frozen;
   });
 
@@ -2555,14 +3170,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     "DoSubmissionLedger.releaseChildBudget",
   )(function* (request: ReleaseChildBudgetRequest) {
     const operation = "ledger release child budget";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ReleaseChildBudgetRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseChildBudgetRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:child-release:before", operation);
+
     const released = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const existing = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(existing)) {
           return yield* LedgerError.make({
             operation,
@@ -2582,12 +3201,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           });
         }
         const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_child_reservations
           SET status = 'released', released_at = ${now.iso}
           WHERE reservation_id = ${validated.reservationId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
         const updated = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(updated)) {
           return yield* corruptionFailure(
             operation,
@@ -2596,15 +3217,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             "An updated child reservation row is missing inside its own transaction.",
           );
         }
+
         return yield* childReservationSnapshotFromRow(operation, updated.value);
       }),
     );
+
     yield* hitFailpoint("ledger:child-release:after", operation);
+
     return released;
   });
 
   interface ScanCursor {
-    readonly conversationId: string;
+    readonly threadId: string;
     readonly queueSequence: number;
   }
 
@@ -2615,57 +3239,131 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     LedgerError
   > {
     const operation = "ledger scan nonterminal";
+
     const rows = yield* (
       cursor === undefined
         ? sql<Record<string, unknown>>`
           SELECT ${sql.literal(SUBMISSION_COLUMNS)}
           FROM effect_agent_submissions
           WHERE state <> 'settled'
-          ORDER BY conversation_id ASC, queue_sequence ASC
+          ORDER BY thread_id ASC, queue_sequence ASC
           LIMIT ${SCAN_PAGE_SIZE}
         `
         : sql<Record<string, unknown>>`
           SELECT ${sql.literal(SUBMISSION_COLUMNS)}
           FROM effect_agent_submissions
           WHERE state <> 'settled'
-            AND (
-              conversation_id > ${cursor.conversationId}
-              OR (
-                conversation_id = ${cursor.conversationId}
-                AND queue_sequence > ${cursor.queueSequence}
-              )
-            )
-          ORDER BY conversation_id ASC, queue_sequence ASC
+            AND (thread_id, queue_sequence) > (${cursor.threadId}, ${cursor.queueSequence})
+          ORDER BY thread_id ASC, queue_sequence ASC
           LIMIT ${SCAN_PAGE_SIZE}
         `
     ).pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeSubmissionRows(operation, "nonterminal_scan", rows);
+
     const snapshots = yield* Effect.forEach(decoded, (row) =>
       decodeSubmissionSnapshot(operation, row),
     );
+
     const last = decoded[decoded.length - 1];
+
     const next: Option.Option<ScanCursor | undefined> =
       last === undefined || decoded.length < SCAN_PAGE_SIZE
         ? Option.none()
         : Option.some({
-            conversationId: last.conversation_id,
+            threadId: last.thread_id,
             queueSequence: last.queue_sequence,
           });
+
     return [snapshots, next] as const;
   });
 
-  const scanNonterminal: Stream.Stream<SubmissionSnapshot, LedgerError> = Stream.paginate(
-    undefined as ScanCursor | undefined,
-    scanPage,
-  );
+  const scanNonterminal: Stream.Stream<SubmissionSnapshot, LedgerError> = Stream.paginate<
+    ScanCursor | undefined,
+    SubmissionSnapshot,
+    LedgerError
+  >(undefined, scanPage);
+
+  const readAbortIntentForSubmission: SubmissionLedger["Service"]["readAbortIntent"] = Effect.fn(
+    "DoSubmissionLedger.readAbortIntentForSubmission",
+  )(function* (request) {
+    const operation = "ledger read abort intent";
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(AbortIntentRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
+    const recordId = submissionAbortRecordId(validated.submissionId);
+
+    const rows = yield* sql<Record<string, unknown>>`
+      SELECT
+        submission.submission_id,
+        abort.submission_id AS abort_submission_id,
+        abort.author,
+        abort.reason,
+        abort.requested_at,
+        canonical.record_id AS canonical_record_id
+      FROM effect_agent_submissions AS submission
+      LEFT JOIN effect_agent_abort_intents AS abort
+        ON abort.submission_id = submission.submission_id
+      LEFT JOIN effect_agent_canonical_records AS canonical
+        ON canonical.thread_id = submission.thread_id
+          AND canonical.record_id = ${recordId}
+      WHERE submission.submission_id = ${validated.submissionId}
+    `.pipe(Effect.mapError(sqlFailure(operation)));
+
+    const decoded = yield* decodeRows(
+      Schema.Array(AbortIntentLookupRow),
+      "effect_agent_abort_intents",
+      validated.submissionId,
+      rows,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    if (decoded.length === 0) {
+      return yield* LedgerError.make({
+        operation,
+        message: `Unknown submission ${validated.submissionId}.`,
+      });
+    }
+    if (decoded.length !== 1) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_abort_intents",
+        validated.submissionId,
+        "An abort intent lookup returned more than one row.",
+      );
+    }
+    const row = decoded[0];
+
+    if (row.abort_submission_id === null) return undefined;
+
+    return yield* decodeAbortIntent({
+      submissionId: row.abort_submission_id,
+      author: row.author,
+      reason: row.reason,
+      requestedAt: row.requested_at,
+      ...(row.canonical_record_id === null ? {} : { canonicalRecordId: row.canonical_record_id }),
+    }).pipe(
+      Effect.mapError((error) =>
+        corruptionFailure(
+          operation,
+          "effect_agent_abort_intents",
+          validated.submissionId,
+          error.message,
+        ),
+      ),
+    );
+  });
 
   const loadRecoverySnapshot: SubmissionLedger["Service"]["loadRecoverySnapshot"] = Effect.fn(
     "DoSubmissionLedger.loadRecoverySnapshot",
   )(function* (request: RecoverySnapshotRequest) {
     const operation = "ledger load recovery snapshot";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(RecoverySnapshotRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(RecoverySnapshotRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     return yield* sql
       .withTransaction(
         Effect.gen(function* () {
@@ -2674,6 +3372,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 
           let ownership: OwnershipSnapshot | undefined;
           const ownershipRow = yield* readOwnership(operation, validated.submissionId);
+
           if (Option.isSome(ownershipRow)) {
             ownership = yield* decodeOwnershipSnapshot({
               attemptId: ownershipRow.value.attempt_id,
@@ -2684,6 +3383,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           }
 
           let inputApplied: InputAppliedMarker | undefined;
+
           if (
             submissionRow.input_applied_record_id !== null &&
             submissionRow.input_applied_sequence !== null
@@ -2696,6 +3396,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 
           let reservation: SettlementReservationSnapshot | undefined;
           const reservationRow = yield* readReservation(operation, validated.submissionId);
+
           if (Option.isSome(reservationRow)) {
             const record = yield* decodeRecordEnvelopeText(reservationRow.value.record_json).pipe(
               Effect.mapError((error) =>
@@ -2707,9 +3408,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
                 ),
               ),
             );
-            const settlementId = yield* Schema.decodeUnknownEffect(
+
+            const settlementId = yield* Schema.decodeEffect(
               SettlementReservationSnapshot.fields.settlementId,
             )(reservationRow.value.settlement_id).pipe(Effect.mapError(internalFailure(operation)));
+
             reservation = SettlementReservationSnapshot.make({
               settlementId,
               outcome: reservationRow.value.outcome,
@@ -2721,6 +3424,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 
           let abortIntent: AbortIntent | undefined;
           const abortRow = yield* readAbortIntent(operation, validated.submissionId);
+
           if (Option.isSome(abortRow)) {
             abortIntent = yield* abortIntentFromRow(
               operation,
@@ -2738,11 +3442,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             WHERE joined_host_submission_id = ${validated.submissionId}
             ORDER BY queue_sequence ASC
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const joinSubmissions = yield* decodeSubmissionRows(
             operation,
             validated.submissionId,
             joinRows,
           );
+
           const joins = yield* Effect.forEach(joinSubmissions, (row) =>
             decodeJoinSnapshot({
               submissionId: row.submission_id,
@@ -2752,6 +3458,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           );
 
           let hostSubmissionId: RecoverySnapshot["hostSubmissionId"];
+
           if (submissionRow.joined_host_submission_id !== null) {
             hostSubmissionId = yield* decodeSubmissionId(
               submissionRow.joined_host_submission_id,
@@ -2759,6 +3466,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           }
 
           let suspension: SuspensionSnapshot | undefined;
+
           if (submissionRow.suspended_reason_json !== null && submissionRow.suspended_at !== null) {
             const reason = yield* parseStoredJsonText(submissionRow.suspended_reason_json).pipe(
               Effect.mapError((error) =>
@@ -2770,6 +3478,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
                 ),
               ),
             );
+
             suspension = yield* decodeSuspensionSnapshot({
               reason,
               suspendedAt: submissionRow.suspended_at,
@@ -2786,11 +3495,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           }
 
           const decisionRows = yield* readApprovalDecisions(operation, validated.submissionId);
+
           const approvalDecisions = yield* Effect.forEach(decisionRows, (row) =>
             approvalIntentFromRow(operation, row),
           );
 
           const resolutionRows = yield* readUnknownResolutions(operation, validated.submissionId);
+
           const unknownResolutions = yield* Effect.forEach(resolutionRows, (row) =>
             unknownResolutionIntentFromRow(operation, row),
           );
@@ -2807,20 +3518,25 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             WHERE parent_submission_id = ${validated.submissionId}
             ORDER BY parent_tool_call_id ASC
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const decodedChildReservations = yield* decodeChildReservationRows(
             operation,
             validated.submissionId,
             childReservationRows,
           );
+
           const childReservations = yield* Effect.forEach(decodedChildReservations, (row) =>
             childReservationSnapshotFromRow(operation, row),
           );
+
           const markers = yield* readChildSettlementMarkers(operation, validated.submissionId);
           const markersByChild = new Map(markers.map((row) => [row.child_submission_id, row]));
           const childAttachments: Array<ChildAttachmentSnapshot> = [];
+
           for (const row of decodedChildReservations) {
             if (row.child_submission_id === null) continue;
             const child = yield* readSubmission(operation, row.child_submission_id);
+
             if (Option.isSome(child)) {
               childAttachments.push(
                 yield* decodeChildAttachmentSnapshot({
@@ -2835,6 +3551,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               continue;
             }
             const marker = markersByChild.get(row.child_submission_id);
+
             if (marker === undefined) continue;
             childAttachments.push(
               yield* decodeChildAttachmentSnapshot({
@@ -2847,6 +3564,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           }
 
           let parentLinkage: ParentLinkage | undefined;
+
           if (
             submissionRow.parent_submission_id !== null &&
             submissionRow.parent_tool_call_id !== null
@@ -2906,6 +3624,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       releaseChildBudget,
       scanNonterminal,
       loadRecoverySnapshot,
+      readAbortIntent: readAbortIntentForSubmission,
     }),
   );
 });
@@ -2923,18 +3642,22 @@ export const submissionLedgerLayer: Layer.Layer<
 
 /**
  * A composition-root convenience Layer for the durable Submission Ledger. Point it at the
- * same `ctx.storage` as the ConversationStore so claims fence the same producer epochs.
+ * same `ctx.storage` as the ThreadStore so claims fence the same producer epochs.
  */
 export const ledgerLayer = (
   options: DoStorageOptions,
 ): Layer.Layer<SubmissionLedger, DoStorageInitializationError> =>
-  submissionLedgerLayer.pipe(
-    Layer.provide(
-      Layer.mergeAll(
-        storageConfigLayer(options),
-        storageFailpointLayer(options),
-        SqliteClient.layer({ storage: options.storage }),
-        BrowserCrypto.layer,
+  Layer.unwrap(
+    Effect.map(DoStorageConfig, (config) =>
+      submissionLedgerLayer.pipe(
+        Layer.provide(
+          Layer.mergeAll(
+            Layer.succeed(DoStorageConfig)(config),
+            storageFailpointLayer(options),
+            SqliteClient.layer({ storage: options.storage }),
+            BrowserCrypto.layer,
+          ),
+        ),
       ),
     ),
-  );
+  ).pipe(Layer.provide(storageConfigLayer(options)));