@effect-agent/storage-cloudflare 0.1.0-beta.113 → 0.1.0-beta.115

package/src/DoSubmissionLedger.ts

@@ -16,6 +16,9 @@ import {
 } from "effect-agent/records";
 import {
   AbortCommand,
+  WorkerStopCommand,
+  WorkerLedgerState,
+  workerTerminalFromRecord,
   AbortIntent,
   AbortIntentRequest,
   AdmissionAdmitted,
@@ -1204,6 +1207,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             }).pipe(Effect.mapError(internalFailure(operation)));
           }
 
+          const stopped =
+            yield* sql`SELECT thread_id FROM effect_agent_worker_stops WHERE thread_id = ${validated.threadId}`.pipe(
+              Effect.mapError(sqlFailure(operation)),
+            );
+
+          if (stopped.length > 0)
+            return yield* AdmissionPolicyError.make({ reason: "refused", code: "worker-stopped" });
+
           // The first accepted input fixes ordinary/worker lane identity atomically with admission.
           // Canonical origin materialization can lag admission; a log scan cannot fence that race.
           const firstRows = yield* sql<Record<string, unknown>>`
@@ -1947,7 +1958,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       );
     }
 
-    return { reservation: reservation.value, settlementFailure };
+    return { reservation: reservation.value, reservationRecord, settlementFailure };
   });
 
   const replayFinalization = Effect.fn("DoSubmissionLedger.replayFinalization")(function* (
@@ -2045,13 +2056,49 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           yield* readReservation(operation, validated.submissionId),
         );
 
-        const { reservation, settlementFailure } = state;
+        const { reservation, reservationRecord, settlementFailure } = state;
         const submission = yield* requireSubmission(operation, validated.submissionId);
 
         if (submission.state === "settled")
           return yield* replayFinalization(validated, submission, state);
         const now = yield* currentInstant;
 
+        const terminal =
+          submission.worker_admission_json === null
+            ? undefined
+            : workerTerminalFromRecord(
+                yield* decodeSubmissionSnapshot(operation, submission),
+                reservationRecord,
+              );
+
+        if (terminal !== undefined) {
+          // Admission and finalization serialize here. An accepted correction that this Run
+          // has not applied vetoes its completion, including admission after RunCompleted.
+          const pending =
+            terminal === "completed"
+              ? yield* sql`SELECT submission_id FROM effect_agent_submissions
+                WHERE thread_id = ${submission.thread_id} AND queue_sequence > ${submission.queue_sequence}
+                AND queue_sequence = (SELECT MAX(queue_sequence) FROM effect_agent_submissions WHERE thread_id = ${submission.thread_id})
+                AND (joined_host_submission_id IS NULL OR joined_host_submission_id <> ${submission.submission_id}
+                  OR input_applied_record_id IS NULL) LIMIT 1`.pipe(
+                  Effect.mapError(sqlFailure(operation)),
+                )
+              : [];
+
+          if (pending.length === 0) {
+            yield* sql`INSERT OR IGNORE INTO effect_agent_worker_stops (thread_id, terminal)
+              VALUES (${submission.thread_id}, ${terminal})`.pipe(
+              Effect.mapError(sqlFailure(operation)),
+            );
+            yield* sql`INSERT OR IGNORE INTO effect_agent_abort_intents (submission_id, author, reason, requested_at)
+              SELECT submission_id, ${submission.principal}, ${`Worker assignment ${terminal}`}, ${now.iso}
+              FROM effect_agent_submissions WHERE thread_id = ${submission.thread_id} AND state <> 'settled'
+              AND submission_id <> ${submission.submission_id}
+              AND (joined_host_submission_id IS NULL OR joined_host_submission_id <> ${submission.submission_id}
+                OR input_applied_record_id IS NULL)`.pipe(Effect.mapError(sqlFailure(operation)));
+          }
+        }
+
         yield* sql`
           UPDATE effect_agent_submissions
           SET state = 'settled', settled_outcome = ${reservation.outcome}
@@ -2083,6 +2130,84 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     return settlement;
   });
 
+  const inspectWorker = Effect.fn("DoSubmissionLedger.inspectWorker")(function* (
+    threadId: SubmissionSnapshot["threadId"],
+  ) {
+    const operation = "inspect worker";
+
+    return yield* sql
+      .withTransaction(
+        Effect.gen(function* () {
+          const read = Effect.fnUntraced(function* (active: boolean) {
+            const rows =
+              yield* sql`SELECT ${sql.literal(SUBMISSION_COLUMNS)} FROM effect_agent_submissions
+          WHERE thread_id = ${threadId} ${active ? sql`AND state <> 'settled'` : sql``}
+          ORDER BY queue_sequence ${active ? sql`ASC` : sql`DESC`} LIMIT 1`.pipe(
+                Effect.mapError(sqlFailure(operation)),
+              );
+
+            const decoded = yield* decodeSubmissionRows(operation, threadId, rows);
+
+            return decoded[0] === undefined
+              ? null
+              : yield* decodeSubmissionSnapshot(operation, decoded[0]);
+          });
+
+          const latest = yield* read(false);
+          const active = yield* read(true);
+
+          const stops =
+            yield* sql`SELECT terminal FROM effect_agent_worker_stops WHERE thread_id = ${threadId}`.pipe(
+              Effect.mapError(sqlFailure(operation)),
+            );
+
+          return yield* Schema.decodeUnknownEffect(Schema.toType(WorkerLedgerState))({
+            latest,
+            active,
+            stopped: stops.length > 0,
+            ...(stops[0] === undefined || stops[0].terminal === null
+              ? {}
+              : { terminal: stops[0].terminal }),
+          }).pipe(Effect.mapError(internalFailure(operation)));
+        }),
+      )
+      .pipe(Effect.catchTag("SqlError", (cause) => sqlFailure(operation)(cause)));
+  });
+
+  const stopWorker = Effect.fn("DoSubmissionLedger.stopWorker")(function* (
+    request: WorkerStopCommand,
+  ) {
+    const operation = "ledger stop worker";
+
+    const validated = yield* Schema.decodeEffect(WorkerStopCommand)(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
+    return yield* inWriteTransaction(
+      operation,
+      Effect.gen(function* () {
+        const now = yield* currentInstant;
+
+        yield* sql`INSERT OR IGNORE INTO effect_agent_worker_stops (thread_id) VALUES (${validated.threadId})`.pipe(
+          Effect.mapError(sqlFailure(operation)),
+        );
+        yield* sql`INSERT OR IGNORE INTO effect_agent_abort_intents (submission_id, author, reason, requested_at)
+        SELECT submission_id, ${validated.author}, 'Worker owner stopped the worker', ${now.iso}
+        FROM effect_agent_submissions WHERE thread_id = ${validated.threadId} AND state <> 'settled'`.pipe(
+          Effect.mapError(sqlFailure(operation)),
+        );
+
+        const rows = yield* sql`SELECT o.submission_id FROM effect_agent_submission_ownership o
+        JOIN effect_agent_submissions s ON s.submission_id = o.submission_id
+        WHERE s.thread_id = ${validated.threadId} AND s.state <> 'settled'`.pipe(
+          Effect.mapError(sqlFailure(operation)),
+        );
+
+        return rows.length;
+      }),
+    );
+  });
+
   const requestAbort: SubmissionLedger["Service"]["requestAbort"] = Effect.fn(
     "DoSubmissionLedger.requestAbort",
   )(function* (request: AbortCommand) {
@@ -2208,6 +2333,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         // The host Attempt already owns the lane; no epoch bump happens here (plan §2.5).
         yield* requireOwnership(operation, host, validated.ownershipToken);
 
+        const stopped =
+          yield* sql`SELECT thread_id FROM effect_agent_worker_stops WHERE thread_id = ${validated.threadId}`.pipe(
+            Effect.mapError(sqlFailure(operation)),
+          );
+
+        if (stopped.length > 0) return [];
+
         const laterRows = yield* sql<Record<string, unknown>>`
           SELECT ${sql.literal(SUBMISSION_COLUMNS)}
           FROM effect_agent_submissions
@@ -3610,6 +3742,8 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       reserveSettlement,
       finalizeSettlement,
       requestAbort,
+      stopWorker,
+      inspectWorker,
       claimJoining,
       markJoined,
       revertJoining,

package/src/PortProtocol.ts

@@ -1,4 +1,5 @@
 import { Schema } from "effect";
+import { ThreadId } from "effect-agent/identifiers";
 import {
   MessageDeliveryError,
   MessageDeliveryPageRequest,
@@ -7,6 +8,8 @@ import {
 import { CanonicalRecordEnvelope } from "effect-agent/records";
 import {
   AbortCommand,
+  WorkerStopCommand,
+  WorkerLedgerState,
   AbortIntent,
   AdmissionConflict,
   AdmissionPolicyError,
@@ -123,6 +126,26 @@ export class LedgerResolveAdmissionCall extends Schema.TaggedClass<LedgerResolve
   request: SubmissionLookupByKey,
 }) {}
 
+export class LedgerInspectWorkerCall extends Schema.TaggedClass<LedgerInspectWorkerCall>()(
+  "LedgerInspectWorker",
+  { request: Schema.Struct({ threadId: ThreadId }) },
+) {}
+
+export class LedgerInspectWorkerResult extends Schema.TaggedClass<LedgerInspectWorkerResult>()(
+  "LedgerInspectWorkerResult",
+  { state: WorkerLedgerState },
+) {}
+
+export class LedgerStopWorkerCall extends Schema.TaggedClass<LedgerStopWorkerCall>()(
+  "LedgerStopWorker",
+  { request: WorkerStopCommand },
+) {}
+
+export class LedgerStopWorkerResult extends Schema.TaggedClass<LedgerStopWorkerResult>()(
+  "LedgerStopWorkerResult",
+  { owned: Schema.Natural },
+) {}
+
 /** Routed `SubmissionLedger.requestAbort` — abort propagation across Objects. */
 export class LedgerRequestAbortCall extends Schema.TaggedClass<LedgerRequestAbortCall>(
   "@effect-agent/storage-cloudflare/LedgerRequestAbortCall",
@@ -190,6 +213,8 @@ export const PortRequest = Schema.Union([
   LedgerLookupCall,
   LedgerResolveAdmissionCall,
   LedgerRequestAbortCall,
+  LedgerStopWorkerCall,
+  LedgerInspectWorkerCall,
   LedgerRecordChildSettledCall,
   StoreMaterializeCall,
   StoreAppendCall,
@@ -290,6 +315,8 @@ export const PortResult = Schema.Union([
   LedgerLookupResult,
   LedgerResolveAdmissionResult,
   LedgerRequestAbortResult,
+  LedgerStopWorkerResult,
+  LedgerInspectWorkerResult,
   LedgerRecordChildSettledResult,
   StoreMaterializeResult,
   StoreAppendResult,

package/src/PortRouting.ts

@@ -40,6 +40,10 @@ import {
   LedgerRecordChildSettledCall,
   LedgerRecordChildSettledResult,
   LedgerRequestAbortCall,
+  LedgerStopWorkerCall,
+  LedgerInspectWorkerCall,
+  LedgerInspectWorkerResult,
+  LedgerStopWorkerResult,
   LedgerRequestAbortResult,
   LedgerResolveAdmissionCall,
   LedgerResolveAdmissionResult,
@@ -534,6 +538,39 @@ const makeRoutedLedgerServices = Effect.fn("DoPortRouting.makeRoutedLedgerServic
         ? local.resolveAdmission(request)
         : resolveForeignAdmission(request.threadId, request),
 
+    inspectWorker: (threadId) =>
+      options.ownsThread(threadId)
+        ? local.inspectWorker === undefined
+          ? Effect.fail(
+              LedgerError.make({
+                operation: "inspectWorker",
+                message: "Worker inspection unavailable",
+              }),
+            )
+          : local.inspectWorker(threadId)
+        : foreignLedgerCall(
+            "inspect worker",
+            threadId,
+            LedgerInspectWorkerCall.make({ request: { threadId } }),
+            LedgerInspectWorkerResult,
+            NoAdditionalPortFailure,
+          ).pipe(Effect.map((reply) => reply.state)),
+
+    stopWorker: (request) =>
+      options.ownsThread(request.threadId)
+        ? local.stopWorker === undefined
+          ? Effect.fail(
+              LedgerError.make({ operation: "stopWorker", message: "Worker stop unavailable" }),
+            )
+          : local.stopWorker(request)
+        : foreignLedgerCall(
+            "ledger stop worker",
+            request.threadId,
+            LedgerStopWorkerCall.make({ request }),
+            LedgerStopWorkerResult,
+            NoAdditionalPortFailure,
+          ).pipe(Effect.map((reply) => reply.owned)),
+
     requestAbort: (request) =>
       submissionTarget("ledger request abort", request.submissionId).pipe(
         Effect.flatMap((target) =>
@@ -1065,6 +1102,35 @@ export const executePortRequest = Effect.fn("DoPortRouting.executePortRequest")(
           .pipe(Effect.map((resolution) => LedgerResolveAdmissionResult.make({ resolution }))),
       );
     }
+    case "LedgerInspectWorker": {
+      const ledger = yield* SubmissionLedger;
+
+      return yield* capture(
+        ledger.inspectWorker === undefined
+          ? Effect.fail(
+              LedgerError.make({
+                operation: "inspectWorker",
+                message: "Worker inspection unavailable",
+              }),
+            )
+          : ledger
+              .inspectWorker(request.request.threadId)
+              .pipe(Effect.map((state) => LedgerInspectWorkerResult.make({ state }))),
+      );
+    }
+    case "LedgerStopWorker": {
+      const ledger = yield* SubmissionLedger;
+
+      return yield* capture(
+        ledger.stopWorker === undefined
+          ? Effect.fail(
+              LedgerError.make({ operation: "stopWorker", message: "Worker stop unavailable" }),
+            )
+          : ledger
+              .stopWorker(request.request)
+              .pipe(Effect.map((owned) => LedgerStopWorkerResult.make({ owned }))),
+      );
+    }
     case "LedgerRequestAbort": {
       const ledger = yield* SubmissionLedger;
 

package/src/internal/do-journal.ts

@@ -32,7 +32,12 @@ import {
   type DoStorageFailpointLocation,
 } from "../DoStorageError.ts";
 import { createMessageDeliveryTables } from "./message-delivery-schema.ts";
-import { CurrentDoStorageVersion, createNonterminalIndex, doMigrations } from "./migrations.ts";
+import {
+  CurrentDoStorageVersion,
+  createNonterminalIndex,
+  createWorkerStops,
+  doMigrations,
+} from "./migrations.ts";
 import { createRecoveryCheckpointTable } from "./recovery-checkpoint-schema.ts";
 
 /**
@@ -376,7 +381,7 @@ const predecessorColumns = {
 } as const;
 
 const checkPredecessorLayout = Effect.fn("DoJournal.checkPredecessorLayout")(function* (
-  version: 3 | 4 | 5,
+  version: 3 | 4 | 5 | 7,
 ) {
   const sql = yield* SqlClient.SqlClient;
 
@@ -402,7 +407,15 @@ const checkPredecessorLayout = Effect.fn("DoJournal.checkPredecessorLayout")(fun
 
   const expectedColumns = {
     ...messageColumns,
-    ...(version === 5
+    ...(version === 7
+      ? {
+          effect_agent_canonical_records: [
+            ...predecessorColumns.effect_agent_canonical_records,
+            "outstanding",
+          ],
+        }
+      : {}),
+    ...(version >= 5
       ? {
           effect_agent_recovery_checkpoints: [
             "thread_id",
@@ -462,6 +475,34 @@ const ensureCurrentStorage = Effect.fn("DoJournal.ensureCurrentStorage")(functio
   failpoint: DoJournalFailpoint = noFailpoint,
   maxStoredValueBytes: number,
 ) {
+  const verifyWorkerPredecessor = Effect.fnUntraced(function* (workerContract: boolean) {
+    const requiredRows = yield* sql<Record<string, unknown>>`
+    SELECT name
+    FROM sqlite_master
+    WHERE (type = 'table'
+      AND name IN ${sql.in([...REQUIRED_TABLES, "effect_agent_message_deliveries", "effect_agent_recovery_checkpoints"])}
+    ) OR (type = 'index' AND name IN ('effect_agent_submissions_nonterminal', 'effect_agent_records_subtree', 'effect_agent_message_deliveries_pending', 'effect_agent_records_outstanding', 'effect_agent_records_call', 'effect_agent_records_run_input', 'effect_agent_records_worker_input'))
+    OR (${workerContract ? 1 : 0} = 1 AND name IN ('effect_agent_worker_stops', 'effect_agent_worker_starts', 'effect_agent_worker_pending', 'effect_agent_worker_execution'))
+    ORDER BY name
+  `.pipe(Effect.mapError(storageError("verify storage tables")));
+
+    const required = yield* decodeRows(
+      Schema.Array(DoNameRow),
+      "sqlite_master",
+      "required_tables",
+      requiredRows,
+    );
+
+    if (required.length !== REQUIRED_TABLES.length + 9 + (workerContract ? 4 : 0)) {
+      return yield* DoStorageCompatibilityError.make({
+        actualVersion: CurrentDoStorageVersion,
+        supportedVersion: CurrentDoStorageVersion,
+        message:
+          "The Durable Object claims the current format but is missing required tables or its nonterminal index. Retain the original store for inspection.",
+      });
+    }
+  });
+
   const metaTableRows = yield* sql<Record<string, unknown>>`
     SELECT name
     FROM sqlite_master
@@ -643,7 +684,8 @@ const ensureCurrentStorage = Effect.fn("DoJournal.ensureCurrentStorage")(functio
                 }),
               ),
             );
-            yield* sql`UPDATE effect_agent_meta SET value='7' WHERE key='storage_version'`;
+            yield* createWorkerStops;
+            yield* sql`UPDATE effect_agent_meta SET value='9' WHERE key='storage_version'`;
             yield* failpoint("upgrade:after-version");
           }),
         )
@@ -679,11 +721,11 @@ const ensureCurrentStorage = Effect.fn("DoJournal.ensureCurrentStorage")(functio
               value: string;
             }>`SELECT value FROM effect_agent_meta WHERE key = 'storage_version'`;
 
-            if (current[0]?.value === "7") return;
+            if (current[0]?.value === "9") return;
             if (current[0]?.value !== "6")
               return yield* DoStorageCompatibilityError.make({
                 actualVersion: -1,
-                supportedVersion: 7,
+                supportedVersion: 9,
                 message: "Storage version changed during native index upgrade",
               });
             yield* checkPredecessorLayout(5);
@@ -694,7 +736,7 @@ const ensureCurrentStorage = Effect.fn("DoJournal.ensureCurrentStorage")(functio
             if (requiredIndex.length !== 1)
               return yield* DoStorageCompatibilityError.make({
                 actualVersion: 6,
-                supportedVersion: 7,
+                supportedVersion: 9,
                 message: "Predecessor storage is missing its required nonterminal index",
               });
             yield* failpoint("upgrade:before-mutation");
@@ -711,7 +753,8 @@ const ensureCurrentStorage = Effect.fn("DoJournal.ensureCurrentStorage")(functio
             );
             yield* failpoint("upgrade:after-mutation");
             yield* failpoint("upgrade:before-version");
-            yield* sql`UPDATE effect_agent_meta SET value='7' WHERE key='storage_version'`;
+            yield* createWorkerStops;
+            yield* sql`UPDATE effect_agent_meta SET value='9' WHERE key='storage_version'`;
             yield* failpoint("upgrade:after-version");
           }),
         )
@@ -724,6 +767,96 @@ const ensureCurrentStorage = Effect.fn("DoJournal.ensureCurrentStorage")(functio
             }),
           ),
         );
+    } else if (version.value === "7") {
+      yield* sql
+        .withTransaction(
+          Effect.gen(function* () {
+            const current = yield* sql<{
+              value: string;
+            }>`SELECT value FROM effect_agent_meta WHERE key = 'storage_version'`;
+
+            if (current[0]?.value === "9") return;
+            if (current[0]?.value !== "7")
+              return yield* DoStorageCompatibilityError.make({
+                actualVersion: -1,
+                supportedVersion: 9,
+                message: "Storage version changed during worker stop upgrade",
+              });
+            yield* checkPredecessorLayout(7);
+            yield* verifyWorkerPredecessor(false);
+            yield* failpoint("upgrade:before-mutation");
+            yield* createWorkerStops;
+            yield* failpoint("upgrade:after-mutation");
+            yield* failpoint("upgrade:before-version");
+            yield* sql`UPDATE effect_agent_meta SET value='9' WHERE key='storage_version'`;
+            yield* failpoint("upgrade:after-version");
+          }),
+        )
+        .pipe(
+          Effect.mapError((cause) =>
+            DoStorageError.make({
+              operation: "upgrade worker stop",
+              message: "Worker stop upgrade failed",
+              cause,
+            }),
+          ),
+        );
+    } else if (version.value === "8") {
+      yield* sql
+        .withTransaction(
+          Effect.gen(function* () {
+            const current = yield* sql<{
+              value: string;
+            }>`SELECT value FROM effect_agent_meta WHERE key = 'storage_version'`;
+
+            if (current[0]?.value === "9") return;
+            if (current[0]?.value !== "8")
+              return yield* DoStorageCompatibilityError.make({
+                actualVersion: -1,
+                supportedVersion: 9,
+                message: "Storage version changed during assignment seal upgrade",
+              });
+            yield* checkPredecessorLayout(7);
+            yield* verifyWorkerPredecessor(true);
+            const columns = yield* sql`PRAGMA table_info(effect_agent_worker_stops)`;
+
+            yield* Schema.decodeUnknownEffect(
+              Schema.Tuple([
+                Schema.Struct({
+                  cid: Schema.Literal(0),
+                  name: Schema.Literal("thread_id"),
+                  type: Schema.Literal("TEXT"),
+                  notnull: Schema.Literal(1),
+                  dflt_value: Schema.Null,
+                  pk: Schema.Literal(1),
+                }),
+              ]),
+            )(columns).pipe(
+              Effect.mapError(() =>
+                DoStorageCompatibilityError.make({
+                  actualVersion: 8,
+                  supportedVersion: 9,
+                  message: "Unsupported worker seal layout; no upgrade was committed",
+                }),
+              ),
+            );
+            yield* failpoint("upgrade:before-mutation");
+            yield* sql`ALTER TABLE effect_agent_worker_stops ADD COLUMN terminal TEXT`;
+            yield* failpoint("upgrade:after-mutation");
+            yield* failpoint("upgrade:before-version");
+            yield* sql`UPDATE effect_agent_meta SET value='9' WHERE key='storage_version'`;
+            yield* failpoint("upgrade:after-version");
+          }),
+        )
+        .pipe(
+          Effect.mapError((cause) =>
+            DoStorageError.make({
+              operation: "upgrade assignment seals",
+              message: "Assignment seal upgrade failed",
+              cause,
+            }),
+          ),
+        );
     } else if (version.value !== String(CurrentDoStorageVersion)) {
       const actualVersion = Number.parseInt(version.value, 10);
 
@@ -733,35 +866,12 @@ const ensureCurrentStorage = Effect.fn("DoJournal.ensureCurrentStorage")(functio
         message:
           `The Durable Object uses unsupported storage version ${version.value}; ` +
           `this build supports exactly version ${CurrentDoStorageVersion}. ` +
-          "Only supported v2, v3, v4, v5 and v6 can be upgraded automatically. Keep the original store and use a compatible library version.",
+          "Only supported v2, v3, v4, v5, v6, v7 and v8 can be upgraded automatically. Keep the original store and use a compatible library version.",
       });
     }
   }
 
-  const requiredRows = yield* sql<Record<string, unknown>>`
-    SELECT name
-    FROM sqlite_master
-    WHERE (type = 'table'
-      AND name IN ${sql.in([...REQUIRED_TABLES, "effect_agent_message_deliveries", "effect_agent_recovery_checkpoints"])}
-    ) OR (type = 'index' AND name IN ('effect_agent_submissions_nonterminal', 'effect_agent_records_subtree', 'effect_agent_message_deliveries_pending', 'effect_agent_records_outstanding', 'effect_agent_records_call', 'effect_agent_records_run_input', 'effect_agent_records_worker_input'))
-    ORDER BY name
-  `.pipe(Effect.mapError(storageError("verify storage tables")));
-
-  const required = yield* decodeRows(
-    Schema.Array(DoNameRow),
-    "sqlite_master",
-    "required_tables",
-    requiredRows,
-  );
-
-  if (required.length !== REQUIRED_TABLES.length + 9) {
-    return yield* DoStorageCompatibilityError.make({
-      actualVersion: CurrentDoStorageVersion,
-      supportedVersion: CurrentDoStorageVersion,
-      message:
-        "The Durable Object claims the current format but is missing required tables or its nonterminal index. Retain the original store for inspection.",
-    });
-  }
+  yield* verifyWorkerPredecessor(true);
 
   return makeJournal(sql, failpoint, maxStoredValueBytes);
 });

package/src/internal/migrations.ts

@@ -8,7 +8,23 @@ import { createMessageDeliveryTables } from "./message-delivery-schema.ts";
 import { createRecoveryCheckpointTable } from "./recovery-checkpoint-schema.ts";
 
 /** The current storage version recorded in `effect_agent_meta`. */
-export const CurrentDoStorageVersion = 7;
+export const CurrentDoStorageVersion = 9;
+
+/** One permanent destination inbox fence, including workers stopped before admission. */
+export const createWorkerStops = Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+
+  yield* sql`CREATE TABLE effect_agent_worker_stops (thread_id TEXT PRIMARY KEY NOT NULL, terminal TEXT)`;
+  yield* sql`CREATE INDEX effect_agent_worker_starts ON effect_agent_message_deliveries(owner_thread_id,
+    json_extract(record_json, '$.envelope.workerAdmission.origin.worker.delegationId'),
+    json_extract(record_json, '$.envelope.workerAdmission.origin.worker.targetAgentId'), message_id)
+    WHERE message_id = json_extract(record_json, '$.envelope.workerAdmission.origin.firstMessageId')`;
+  yield* sql`CREATE INDEX effect_agent_worker_pending ON effect_agent_message_deliveries(owner_thread_id,
+    json_extract(record_json, '$.envelope.workerAdmission.origin.worker.threadId'), message_id)
+    WHERE state IN ('pending', 'parked') AND json_extract(record_json, '$.receipt') IS NULL`;
+  yield* sql`CREATE INDEX effect_agent_worker_execution ON effect_agent_canonical_records(thread_id,
+    json_extract(record_json, '$.payload._tag'), sequence) WHERE json_extract(record_json, '$.payload.runId') IS NOT NULL`;
+});
 
 /** Index only outstanding obligations, ordered by the recovery scan's stable cursor. */
 export const createNonterminalIndex = Effect.gen(function* () {
@@ -272,6 +288,7 @@ export const doMigrations = SqliteMigrator.fromRecord({
     yield* createMessageDeliveryTables;
     yield* createMessageDeliveryPendingIndex;
     yield* createRecoveryCheckpointTable;
+    yield* createWorkerStops;
     yield* sql`
       CREATE TABLE effect_agent_meta (
         key TEXT PRIMARY KEY NOT NULL,