@effect-agent/storage-memory 0.1.0-beta.11 → 0.1.0-beta.110

package/src/{memory-ledger.ts → MemorySubmissionLedger.ts}

@@ -1,19 +1,48 @@
 import {
+  Clock,
+  Cause,
+  Exit,
+  Fiber,
+  DateTime,
+  Duration,
+  Effect,
+  Layer,
+  Option,
+  Ref,
+  Schema,
+  Stream,
+} from "effect";
+import {
+  type ToolCallId,
   AttemptId,
   ReceiptId,
   SubmissionId,
-  ToolCallId,
   type AgentId,
-  type ConversationId,
+  type ThreadId,
   type SettlementId,
-} from "@effect-agent/core";
+} from "effect-agent/identifiers";
+import { InputMessage } from "effect-agent/messaging";
+import {
+  PersistedJson,
+  WorkerAdmission,
+  ProducerEpoch,
+  type DefinitionDigests,
+  type DeploymentId,
+  type Digest,
+  type ProducerId,
+  type RecordEnvelope,
+  type SettlementOutcome,
+} from "effect-agent/records";
 import {
+  type ParentLinkage,
   AbortCommand,
   AdmissionAdmitted,
   AdmissionConflict,
+  AdmissionPolicyError,
   AdmissionIndeterminate,
   AdmissionNotAdmitted,
   AdmissionRequest,
+  SubmissionAdmissionFence,
   AdmissionResult,
   ApprovalConflict,
   ApprovalDecisionCommand,
@@ -43,8 +72,6 @@ import {
   OwnershipRenewal,
   OwnershipSnapshot,
   OwnershipToken,
-  ParentLinkage,
-  ProducerEpoch,
   QueueSequence,
   RecoverySnapshot,
   RecoverySnapshotRequest,
@@ -59,7 +86,9 @@ import {
   SettlementFinalization,
   SettlementReservation,
   SettlementReservationSnapshot,
+  settlementFailureFromRecord,
   AbortIntent,
+  AbortIntentRequest,
   SubmissionLedger,
   SubmissionLookup,
   SubmissionLookupByKey,
@@ -73,20 +102,12 @@ import {
   type ChildReservationId,
   type ChildReservationStatus,
   type ChildSettledOutcome,
-  type DefinitionDigests,
-  type DeploymentId,
-  type Digest,
   type IdempotencyKey,
-  type PersistedJson,
   type Principal,
-  type ProducerId,
-  type RecordEnvelope,
-  type SettlementOutcome,
   type SubmissionState,
   type SuspensionOutcome,
   type SuspensionReason,
-} from "@effect-agent/session";
-import { Clock, DateTime, Duration, Effect, Layer, Option, Ref, Schema, Stream } from "effect";
+} from "effect-agent/submission-ledger";
 
 const MAX_SUBMISSIONS = 65_536;
 
@@ -110,7 +131,7 @@ const STATE_RANK: Record<SubmissionState, number> = {
 
 interface SubmissionRow {
   readonly submissionId: SubmissionId;
-  readonly conversationId: ConversationId;
+  readonly threadId: ThreadId;
   readonly queueSequence: QueueSequence;
   readonly principal: Principal;
   readonly idempotencyKey: IdempotencyKey;
@@ -126,6 +147,10 @@ interface SubmissionRow {
   readonly readyAtMillis: number | undefined;
   /** Immutable child-side lineage recorded at admission (spec §12 step 5). */
   readonly parentLinkage: ParentLinkage | undefined;
+  readonly admissionGroup?: string;
+  readonly admissionFence?: AdmissionRequest["admissionFence"];
+  readonly workerAdmissionJson?: string;
+  readonly messageAdmissionJson?: string;
 }
 
 interface StoredOwnership {
@@ -156,8 +181,6 @@ interface StoredUnknownMark {
 
 interface StoredUnknownResolution {
   readonly intent: UnknownResolutionIntent;
-  /** Canonical JSON of the Schema-encoded resolution, for divergent re-resolution detection. */
-  readonly resolutionJson: string;
 }
 
 interface StoredSubmission {
@@ -176,13 +199,13 @@ interface StoredSubmission {
 
 /**
  * States in which `claim` never grants the head: the lane is host-owned (`joining`/`joined`)
- * or durably blocked (`suspended`/`unknown`) rather than worker-claimable.
+ * or durably suspended rather than worker-claimable. Unknown heads are checked against abort
+ * intent separately: abort authorizes cleanup and settlement, never ordinary Tool replay.
  */
 const BLOCKED_HEAD_STATES: ReadonlySet<SubmissionState> = new Set([
   "joining",
   "joined",
   "suspended",
-  "unknown",
 ]);
 
 interface LaneState {
@@ -198,12 +221,8 @@ interface StoredChildReservation {
   readonly childSubmissionId: SubmissionId | undefined;
   readonly status: ChildReservationStatus;
   readonly allocation: PersistedJson;
-  /** Canonical JSON of the allocation, for divergent-replay detection. */
-  readonly allocationJson: string;
   readonly allocationDigest: Digest;
   readonly accounting: PersistedJson | undefined;
-  /** Canonical JSON of the frozen accounting decision, for divergent-freeze detection. */
-  readonly accountingJson: string | undefined;
   readonly reservedAtMillis: number;
   readonly releaseBeganAtMillis: number | undefined;
   readonly releasedAtMillis: number | undefined;
@@ -212,7 +231,7 @@ interface StoredChildReservation {
 interface LedgerState {
   readonly submissions: ReadonlyMap<SubmissionId, StoredSubmission>;
   readonly admissionIndex: ReadonlyMap<string, SubmissionId>;
-  readonly lanes: ReadonlyMap<ConversationId, LaneState>;
+  readonly lanes: ReadonlyMap<ThreadId, LaneState>;
   readonly childReservations: ReadonlyMap<ChildReservationId, StoredChildReservation>;
   readonly mintCounter: number;
 }
@@ -247,19 +266,21 @@ const decodeAttemptId = Schema.decodeSync(AttemptId);
 const decodeOwnershipToken = Schema.decodeSync(OwnershipToken);
 const decodeQueueSequence = Schema.decodeSync(QueueSequence);
 const decodeProducerEpoch = Schema.decodeSync(ProducerEpoch);
+const equivalentPersistedJson = Schema.toEquivalence(PersistedJson);
+const equivalentUnknownResolution = Schema.toEquivalence(UnknownResolution);
 
 const utc = (millis: number): DateTime.Utc => DateTime.toUtc(DateTime.makeUnsafe(millis));
 
 const admissionKey = (
-  conversationId: ConversationId,
+  threadId: ThreadId,
   principal: Principal,
   idempotencyKey: IdempotencyKey,
-): string => `${conversationId}\u001f${principal}\u001f${idempotencyKey}`;
+): string => JSON.stringify([threadId, principal, idempotencyKey]);
 
 const toSnapshot = (row: SubmissionRow): SubmissionSnapshot =>
   SubmissionSnapshot.make({
     submissionId: row.submissionId,
-    conversationId: row.conversationId,
+    threadId: row.threadId,
     queueSequence: row.queueSequence,
     principal: row.principal,
     idempotencyKey: row.idempotencyKey,
@@ -271,6 +292,22 @@ const toSnapshot = (row: SubmissionRow): SubmissionSnapshot =>
     receiptId: row.receiptId,
     state: row.state,
     createdAt: utc(row.createdAtMillis),
+    ...(row.admissionGroup === undefined ? {} : { admissionGroup: row.admissionGroup }),
+    ...(row.admissionFence === undefined ? {} : { admissionFence: row.admissionFence }),
+    ...(row.workerAdmissionJson === undefined
+      ? {}
+      : {
+          workerAdmission: Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
+            row.workerAdmissionJson,
+          ),
+        }),
+    ...(row.messageAdmissionJson === undefined
+      ? {}
+      : {
+          messageAdmission: Schema.decodeSync(Schema.fromJsonString(InputMessage))(
+            row.messageAdmissionJson,
+          ),
+        }),
     ...(row.settledOutcome === undefined ? {} : { settledOutcome: row.settledOutcome }),
     ...(row.readyAtMillis === undefined ? {} : { readyAt: utc(row.readyAtMillis) }),
     ...(row.parentLinkage === undefined ? {} : { parentLinkage: row.parentLinkage }),
@@ -304,18 +341,24 @@ const sameParentLinkage = (
       left.parentSubmissionId === right.parentSubmissionId &&
       left.parentToolCallId === right.parentToolCallId;
 
-const laneEpoch = (state: LedgerState, conversationId: ConversationId): number =>
-  state.lanes.get(conversationId)?.producerEpoch ?? 0;
+const laneEpoch = (state: LedgerState, threadId: ThreadId): number =>
+  state.lanes.get(threadId)?.producerEpoch ?? 0;
 
 const ownershipLost = (state: LedgerState, stored: StoredSubmission): OwnershipLost =>
   OwnershipLost.make({
     submissionId: stored.row.submissionId,
-    actualEpoch: decodeProducerEpoch(laneEpoch(state, stored.row.conversationId)),
+    actualEpoch: decodeProducerEpoch(laneEpoch(state, stored.row.threadId)),
   });
 
-/** The presented token owns the lane only while it matches the live ownership record. */
-const ownsLane = (stored: StoredSubmission, ownershipToken: OwnershipToken): boolean =>
-  stored.ownership !== undefined && stored.ownership.ownershipToken === ownershipToken;
+/** A retained row token cannot outlive a newer owner of the same Thread. */
+const ownsLane = (
+  state: LedgerState,
+  stored: StoredSubmission,
+  ownershipToken: OwnershipToken,
+): boolean =>
+  stored.ownership !== undefined &&
+  stored.ownership.ownershipToken === ownershipToken &&
+  stored.ownership.producerEpoch === laneEpoch(state, stored.row.threadId);
 
 const withSubmission = (state: LedgerState, stored: StoredSubmission): LedgerState => ({
   ...state,
@@ -330,21 +373,25 @@ const withChildReservation = (
   childReservations: new Map(state.childReservations).set(reservation.reservationId, reservation),
 });
 
-const findHead = (
-  state: LedgerState,
-  conversationId: ConversationId,
-): StoredSubmission | undefined => {
+const findHead = (state: LedgerState, threadId: ThreadId): StoredSubmission | undefined => {
   let head: StoredSubmission | undefined;
+
   for (const stored of state.submissions.values()) {
-    if (stored.row.conversationId !== conversationId || stored.row.state === "settled") continue;
+    if (
+      stored.row.threadId !== threadId ||
+      stored.row.state === "settled" ||
+      (stored.row.state === "unknown" && stored.abortIntent === undefined)
+    )
+      continue;
     if (head === undefined || stored.row.queueSequence < head.row.queueSequence) head = stored;
   }
+
   return head;
 };
 
 /**
  * Reference in-memory SubmissionLedger. It implements the full port contract — atomic idempotent
- * admission, FIFO-head claims, producer-epoch fencing, Clock-driven ownership leases, idempotent
+ * admission, eligible FIFO claims, producer-epoch fencing, Clock-driven ownership leases, idempotent
  * settlement reservation/finalization, and durable abort intent — with every transition applied
  * as one atomic `Ref.modify`, but its state does not survive the process (`non-durable`).
  *
@@ -354,8 +401,8 @@ const findHead = (
  *   deterministically; no wall clock is consulted.
  * - The ownership lease is pinned to `DEFAULT_OWNERSHIP_LEASE_DURATION` (D5); durable adapters
  *   own the configuration seam.
- * - A live lease blocks claims from other producers only: the same `producerId` may reclaim its
- *   own live lease (restart recovery), which supersedes and fences the prior Attempt's token.
+ * - Any live lease in the Thread blocks every new claim, including the same `producerId`.
+ *   Unresolved unknown work is skipped only after ownership is released or expires.
  * - Claiming advances `ready` to `running` and otherwise preserves the recorded state, so
  *   progress markers from an earlier Attempt survive a reclaim.
  * - `renewOwnership` keeps the token stable (the port allows rotation); a replayed admission
@@ -385,6 +432,8 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       childReservations: new Map(),
       mintCounter: 0,
     });
+
+    const admissionFence = yield* SubmissionAdmissionFence;
     const leaseMillis = Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION);
 
     const capabilities = Effect.succeed(LedgerCapabilities.make({ durability: "non-durable" }));
@@ -393,23 +442,45 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       (unvalidated) =>
         Effect.gen(function* () {
           const request = yield* validate(AdmissionRequest, "admit", unvalidated);
+
+          const workerAdmissionJson =
+            request.workerAdmission === undefined
+              ? undefined
+              : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(
+                  request.workerAdmission,
+                ).pipe(
+                  Effect.mapError(() => ledgerError("admit", "Invalid worker admission metadata")),
+                );
+
+          const messageAdmissionJson =
+            request.messageAdmission === undefined
+              ? undefined
+              : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(
+                  request.messageAdmission,
+                ).pipe(
+                  Effect.mapError(() => ledgerError("admit", "Invalid message admission metadata")),
+                );
+
           const nowMillis = yield* Clock.currentTimeMillis;
+          const services = yield* Effect.context<never>();
+
           const decision = yield* Ref.modify(
             state,
             (
               current,
             ): readonly [
-              Decision<AdmissionResult, AdmissionConflict | LedgerError>,
+              (
+                | Decision<AdmissionResult, AdmissionConflict | AdmissionPolicyError | LedgerError>
+                | { readonly _tag: "cause"; readonly cause: Cause.Cause<AdmissionPolicyError> }
+              ),
               LedgerState,
             ] => {
-              const key = admissionKey(
-                request.conversationId,
-                request.principal,
-                request.idempotencyKey,
-              );
+              const key = admissionKey(request.threadId, request.principal, request.idempotencyKey);
               const existingId = current.admissionIndex.get(key);
+
               if (existingId !== undefined) {
                 const existing = current.submissions.get(existingId);
+
                 if (existing === undefined) {
                   return [
                     failure(
@@ -422,12 +493,33 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 // (or its absence): linkage is immutable lineage (spec §12 step 5, SUB-016).
                 if (
                   existing.row.inputDigest !== request.inputDigest ||
-                  !sameParentLinkage(existing.row.parentLinkage, request.parentLinkage)
+                  !sameParentLinkage(existing.row.parentLinkage, request.parentLinkage) ||
+                  existing.row.admissionGroup !== request.admissionGroup ||
+                  !Schema.toEquivalence(Schema.optional(WorkerAdmission))(
+                    existing.row.workerAdmissionJson === undefined
+                      ? undefined
+                      : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
+                          existing.row.workerAdmissionJson,
+                        ),
+                    request.workerAdmission,
+                  ) ||
+                  !Schema.toEquivalence(Schema.optional(InputMessage))(
+                    existing.row.messageAdmissionJson === undefined
+                      ? undefined
+                      : Schema.decodeSync(Schema.fromJsonString(InputMessage))(
+                          existing.row.messageAdmissionJson,
+                        ),
+                    request.messageAdmission,
+                  ) ||
+                  !Schema.toEquivalence(Schema.optional(Schema.Json))(
+                    existing.row.admissionFence,
+                    request.admissionFence,
+                  )
                 ) {
                   return [
                     failure(
                       AdmissionConflict.make({
-                        conversationId: request.conversationId,
+                        threadId: request.threadId,
                         principal: request.principal,
                         idempotencyKey: request.idempotencyKey,
                         existingInputDigest: existing.row.inputDigest,
@@ -437,6 +529,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                     current,
                   ];
                 }
+
                 return [
                   success(
                     AdmissionResult.make({
@@ -450,6 +543,58 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
+              // A Thread's first admission fixes its worker origin before canonical materialization.
+              const first = [...current.submissions.values()].find(
+                ({ row }) => row.threadId === request.threadId,
+              );
+
+              if (first !== undefined) {
+                const previous =
+                  first.row.workerAdmissionJson === undefined
+                    ? undefined
+                    : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
+                        first.row.workerAdmissionJson,
+                      );
+
+                if (
+                  !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
+                    previous?.origin,
+                    request.workerAdmission?.origin,
+                  )
+                )
+                  return [
+                    failure(
+                      AdmissionPolicyError.make({
+                        reason: "refused",
+                        code: "worker-origin-conflict",
+                      }),
+                    ),
+                    current,
+                  ];
+              }
+              // A memory policy and the ledger mutation share one synchronous critical section.
+              // An asynchronous policy cannot fence this Ref and therefore fails closed.
+              const checked = Effect.runSyncExitWith(services)(admissionFence.check(request));
+
+              if (Exit.isFailure(checked)) {
+                return [{ _tag: "cause", cause: checked.cause }, current];
+              }
+              if (
+                request.admissionGroup !== undefined &&
+                [...current.submissions.values()].some(
+                  ({ row }) =>
+                    row.threadId === request.threadId &&
+                    row.admissionGroup === request.admissionGroup &&
+                    row.state !== "settled",
+                )
+              )
+                return [
+                  failure(
+                    AdmissionPolicyError.make({ reason: "occupied", code: "admission-group" }),
+                  ),
+                  current,
+                ];
               if (current.submissions.size >= MAX_SUBMISSIONS) {
                 return [
                   failure(
@@ -458,14 +603,17 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
-              const lane = current.lanes.get(request.conversationId) ?? {
+
+              const lane = current.lanes.get(request.threadId) ?? {
                 nextQueueSequence: 1,
                 producerEpoch: 0,
               };
+
               const mintCounter = current.mintCounter + 1;
+
               const row: SubmissionRow = {
                 submissionId: decodeSubmissionId(`submission-memory-${mintCounter}`),
-                conversationId: request.conversationId,
+                threadId: request.threadId,
                 queueSequence: decodeQueueSequence(lane.nextQueueSequence),
                 principal: request.principal,
                 idempotencyKey: request.idempotencyKey,
@@ -480,7 +628,16 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 createdAtMillis: nowMillis,
                 readyAtMillis: undefined,
                 parentLinkage: request.parentLinkage,
+                ...(workerAdmissionJson === undefined ? {} : { workerAdmissionJson }),
+                ...(messageAdmissionJson === undefined ? {} : { messageAdmissionJson }),
+                ...(request.admissionGroup === undefined
+                  ? {}
+                  : { admissionGroup: request.admissionGroup }),
+                ...(request.admissionFence === undefined
+                  ? {}
+                  : { admissionFence: request.admissionFence }),
               };
+
               const submissions = new Map(current.submissions).set(row.submissionId, {
                 row,
                 ownership: undefined,
@@ -493,11 +650,14 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 approvalDecisions: new Map<ToolCallId, ApprovalDecisionIntent>(),
                 unknownResolutions: new Map<ToolCallId, StoredUnknownResolution>(),
               });
+
               const admissionIndex = new Map(current.admissionIndex).set(key, row.submissionId);
-              const lanes = new Map(current.lanes).set(request.conversationId, {
+
+              const lanes = new Map(current.lanes).set(request.threadId, {
                 nextQueueSequence: lane.nextQueueSequence + 1,
                 producerEpoch: lane.producerEpoch,
               });
+
               return [
                 success(
                   AdmissionResult.make({
@@ -512,9 +672,26 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ];
             },
           );
+
           if (decision._tag === "failure") return yield* decision.error;
+          if (decision._tag === "cause") {
+            for (const reason of decision.cause.reasons) {
+              if (Cause.isDieReason(reason) && Cause.isAsyncFiberError(reason.defect)) {
+                yield* Fiber.interrupt(reason.defect.fiber);
+
+                return yield* AdmissionPolicyError.make({
+                  reason: "unavailable",
+                  code: "synchronous-memory-policy-required",
+                });
+              }
+            }
+
+            return yield* Effect.failCause(decision.cause);
+          }
+
           return decision.value;
         }),
+      Effect.uninterruptible,
     );
 
     const markReady: SubmissionLedger["Service"]["markReady"] = Effect.fn(
@@ -523,10 +700,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       Effect.gen(function* () {
         const request = yield* validate(MarkReadyRequest, "markReady", unvalidated);
         const nowMillis = yield* Clock.currentTimeMillis;
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<void, LedgerError>, LedgerState] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(ledgerError("markReady", `Unknown Submission ${request.submissionId}`)),
@@ -534,6 +713,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ];
             }
             if (stored.row.state !== "admitted") return [success(undefined), current];
+
             return [
               success(undefined),
               withSubmission(current, {
@@ -543,6 +723,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
       }),
     );
@@ -553,14 +734,17 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       Effect.gen(function* () {
         const request = yield* validate(SubmissionLookup, "lookup", unvalidated);
         const current = yield* Ref.get(state);
+
         const submissionId =
           request._tag === "SubmissionLookupById"
             ? request.submissionId
             : current.admissionIndex.get(
-                admissionKey(request.conversationId, request.principal, request.idempotencyKey),
+                admissionKey(request.threadId, request.principal, request.idempotencyKey),
               );
+
         const stored =
           submissionId === undefined ? undefined : current.submissions.get(submissionId);
+
         return stored === undefined ? Option.none() : Option.some(toSnapshot(stored.row));
       }),
     );
@@ -570,20 +754,25 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(SubmissionLookupByKey, "resolveAdmission", unvalidated);
+
         // Test-only fault seam: lets suites exercise the Indeterminate classification that a
         // single strongly consistent store never produces on its own (SUB-031, P6 honesty).
         if (options.resolveAdmissionFault !== undefined) {
           const fault = yield* options.resolveAdmissionFault;
+
           if (Option.isSome(fault)) {
             return AdmissionIndeterminate.make({ reason: fault.value });
           }
         }
         const current = yield* Ref.get(state);
+
         const submissionId = current.admissionIndex.get(
-          admissionKey(request.conversationId, request.principal, request.idempotencyKey),
+          admissionKey(request.threadId, request.principal, request.idempotencyKey),
         );
+
         const stored =
           submissionId === undefined ? undefined : current.submissions.get(submissionId);
+
         return stored === undefined
           ? AdmissionNotAdmitted.make()
           : AdmissionAdmitted.make({ submission: toSnapshot(stored.row) });
@@ -595,30 +784,34 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         Effect.gen(function* () {
           const request = yield* validate(ClaimRequest, "claim", unvalidated);
           const nowMillis = yield* Clock.currentTimeMillis;
+
           const decision = yield* Ref.modify(
             state,
             (current): readonly [Decision<Option.Option<Claim>, LedgerError>, LedgerState] => {
-              const head = findHead(current, request.conversationId);
+              for (const stored of current.submissions.values()) {
+                if (
+                  stored.row.threadId === request.threadId &&
+                  stored.ownership !== undefined &&
+                  stored.ownership.leaseExpiresAtMillis > nowMillis
+                ) {
+                  return [success(Option.none()), current];
+                }
+              }
+              const head = findHead(current, request.threadId);
+
               if (head === undefined) return [success(Option.none()), current];
-              // A joining/joined head is host-owned and a suspended/unknown head is durably
-              // blocked; the lane produces no claim and later ready work is never skipped.
               if (BLOCKED_HEAD_STATES.has(head.row.state)) return [success(Option.none()), current];
-              if (
-                head.ownership !== undefined &&
-                head.ownership.leaseExpiresAtMillis > nowMillis &&
-                head.ownership.ownerProducerId !== request.producerId
-              ) {
-                return [success(Option.none()), current];
-              }
-              const lane = current.lanes.get(request.conversationId);
+              const lane = current.lanes.get(request.threadId);
+
               if (lane === undefined) {
                 return [
-                  failure(ledgerError("claim", "Claimable head without a Conversation lane")),
+                  failure(ledgerError("claim", "Claimable head without a Thread lane")),
                   current,
                 ];
               }
               const producerEpoch = decodeProducerEpoch(lane.producerEpoch + 1);
               const mintCounter = current.mintCounter + 1;
+
               const ownership: StoredOwnership = {
                 attemptId: decodeAttemptId(`attempt-memory-${mintCounter}`),
                 ownershipToken: decodeOwnershipToken(`ownership-memory-${mintCounter}`),
@@ -626,13 +819,17 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 ownerProducerId: request.producerId,
                 leaseExpiresAtMillis: nowMillis + leaseMillis,
               };
+
               const row: SubmissionRow =
                 head.row.state === "ready" ? { ...head.row, state: "running" } : head.row;
+
               const next = withSubmission(current, { ...head, row, ownership });
-              const lanes = new Map(next.lanes).set(request.conversationId, {
+
+              const lanes = new Map(next.lanes).set(request.threadId, {
                 nextQueueSequence: lane.nextQueueSequence,
                 producerEpoch: lane.producerEpoch + 1,
               });
+
               return [
                 success(
                   Option.some(
@@ -650,7 +847,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ];
             },
           );
+
           if (decision._tag === "failure") return yield* decision.error;
+
           return decision.value;
         }),
     );
@@ -661,12 +860,14 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       Effect.gen(function* () {
         const request = yield* validate(RenewOwnershipRequest, "renewOwnership", unvalidated);
         const nowMillis = yield* Clock.currentTimeMillis;
+
         const decision = yield* Ref.modify(
           state,
           (
             current,
           ): readonly [Decision<OwnershipRenewal, OwnershipLost | LedgerError>, LedgerState] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(
@@ -675,13 +876,18 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            if (stored.ownership === undefined || !ownsLane(stored, request.ownershipToken)) {
+            if (
+              stored.ownership === undefined ||
+              !ownsLane(current, stored, request.ownershipToken)
+            ) {
               return [failure(ownershipLost(current, stored)), current];
             }
+
             const ownership: StoredOwnership = {
               ...stored.ownership,
               leaseExpiresAtMillis: nowMillis + leaseMillis,
             };
+
             return [
               success(
                 OwnershipRenewal.make({
@@ -693,7 +899,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -703,10 +911,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(ReleaseOwnershipRequest, "releaseOwnership", unvalidated);
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<void, OwnershipLost | LedgerError>, LedgerState] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(
@@ -715,15 +925,17 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            if (!ownsLane(stored, request.ownershipToken)) {
+            if (!ownsLane(current, stored, request.ownershipToken)) {
               return [failure(ownershipLost(current, stored)), current];
             }
+
             return [
               success(undefined),
               withSubmission(current, { ...stored, ownership: undefined }),
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
       }),
     );
@@ -733,10 +945,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(MarkInputAppliedRequest, "markInputApplied", unvalidated);
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<void, OwnershipLost | LedgerError>, LedgerState] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(
@@ -745,23 +959,46 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            if (!ownsLane(stored, request.ownershipToken)) {
+            if (!ownsLane(current, stored, request.ownershipToken)) {
               return [failure(ownershipLost(current, stored)), current];
             }
+
+            if (stored.inputApplied !== undefined) {
+              if (
+                stored.inputApplied.recordId === request.recordId &&
+                stored.inputApplied.sequence === request.sequence
+              ) {
+                return [success(undefined), current];
+              }
+
+              return [
+                failure(
+                  ledgerError(
+                    "markInputApplied",
+                    `A different canonical input marker is already recorded for Submission ${request.submissionId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+
             const marker = InputAppliedMarker.make({
               recordId: request.recordId,
               sequence: request.sequence,
             });
+
             const row: SubmissionRow =
               STATE_RANK[stored.row.state] < STATE_RANK["input-applied"]
                 ? { ...stored.row, state: "input-applied" }
                 : stored.row;
+
             return [
               success(undefined),
               withSubmission(current, { ...stored, row, inputApplied: marker }),
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
       }),
     );
@@ -771,6 +1008,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(SettlementReservation, "reserveSettlement", unvalidated);
+
         const decision = yield* Ref.modify(
           state,
           (
@@ -780,6 +1018,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             LedgerState,
           ] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(
@@ -788,11 +1027,13 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
+
             // A `joined` Submission settles WITH its host (plan §2.5) and its lane is never
             // worker-claimable, so no ownership token can exist for it: the recorded host
             // linkage authorizes the reservation and the presented token is not consulted.
             const joinedSettlement =
               stored.row.state === "joined" && stored.joinedHostSubmissionId !== undefined;
+
             // P7 §7(c): an aborted, never-claimed, still-queued Submission likewise has no
             // live ownership to fence against — its durable abort intent authorizes exactly
             // its ABORTED settlement (`terminalizing` is the same pass's crash replay). Every
@@ -802,14 +1043,16 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               stored.abortIntent !== undefined &&
               stored.ownership === undefined &&
               (stored.row.state === "ready" || stored.row.state === "terminalizing");
+
             if (
               !joinedSettlement &&
               !queuedAbortSettlement &&
-              !ownsLane(stored, request.ownershipToken)
+              !ownsLane(current, stored, request.ownershipToken)
             ) {
               return [failure(ownershipLost(current, stored)), current];
             }
             const existing = stored.reservation;
+
             if (existing !== undefined) {
               if (
                 existing.settlementId !== request.settlementId ||
@@ -826,6 +1069,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               return [
                 success(
                   ReservedSettlement.make({
@@ -840,6 +1084,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
+
             const reservation: StoredReservation = {
               settlementId: request.settlementId,
               outcome: request.outcome,
@@ -847,10 +1092,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               recordDigest: request.recordDigest,
               finalizedAtMillis: undefined,
             };
+
             const row: SubmissionRow =
               STATE_RANK[stored.row.state] < STATE_RANK.terminalizing
                 ? { ...stored.row, state: "terminalizing" }
                 : stored.row;
+
             return [
               success(
                 ReservedSettlement.make({
@@ -866,7 +1113,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -877,12 +1126,14 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       Effect.gen(function* () {
         const request = yield* validate(SettlementFinalization, "finalizeSettlement", unvalidated);
         const nowMillis = yield* Clock.currentTimeMillis;
+
         const decision = yield* Ref.modify(
           state,
           (
             current,
           ): readonly [Decision<Settlement, SettlementConflict | LedgerError>, LedgerState] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(
@@ -892,6 +1143,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ];
             }
             const reservation = stored.reservation;
+
             if (reservation === undefined) {
               return [
                 failure(
@@ -903,6 +1155,19 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
+            const settlementFailure = settlementFailureFromRecord(reservation.record);
+
+            if ((reservation.outcome === "failed") !== (settlementFailure !== undefined)) {
+              return [
+                failure(
+                  ledgerError(
+                    "finalizeSettlement",
+                    `Settlement reservation for Submission ${request.submissionId} has contradictory failure evidence`,
+                  ),
+                ),
+                current,
+              ];
+            }
             if (reservation.settlementId !== request.settlementId) {
               return [
                 failure(
@@ -922,18 +1187,21 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                     settlementId: reservation.settlementId,
                     receiptId: stored.row.receiptId,
                     outcome: reservation.outcome,
+                    ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
                     settledAt: utc(reservation.finalizedAtMillis),
                   }),
                 ),
                 current,
               ];
             }
+
             const next = withSubmission(current, {
               ...stored,
               row: { ...stored.row, state: "settled", settledOutcome: reservation.outcome },
               ownership: undefined,
               reservation: { ...reservation, finalizedAtMillis: nowMillis },
             });
+
             return [
               success(
                 Settlement.make({
@@ -941,6 +1209,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   settlementId: reservation.settlementId,
                   receiptId: stored.row.receiptId,
                   outcome: reservation.outcome,
+                  ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
                   settledAt: utc(nowMillis),
                 }),
               ),
@@ -948,7 +1217,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -959,6 +1230,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       Effect.gen(function* () {
         const request = yield* validate(AbortCommand, "requestAbort", unvalidated);
         const nowMillis = yield* Clock.currentTimeMillis;
+
         const decision = yield* Ref.modify(
           state,
           (
@@ -968,6 +1240,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             LedgerState,
           ] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(ledgerError("requestAbort", `Unknown Submission ${request.submissionId}`)),
@@ -989,6 +1262,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               return [
                 failure(
                   JoinedToHost.make({
@@ -1011,6 +1285,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               return [
                 failure(
                   SettlementConflict.make({
@@ -1022,16 +1297,20 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ];
             }
             if (stored.abortIntent !== undefined) return [success(stored.abortIntent), current];
+
             const intent = AbortIntent.make({
               submissionId: request.submissionId,
               author: request.author,
               reason: request.reason,
               requestedAt: utc(nowMillis),
             });
+
             return [success(intent), withSubmission(current, { ...stored, abortIntent: intent })];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -1041,6 +1320,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(ClaimJoiningRequest, "claimJoining", unvalidated);
+
         const decision = yield* Ref.modify(
           state,
           (
@@ -1050,6 +1330,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             LedgerState,
           ] => {
             const host = current.submissions.get(request.hostSubmissionId);
+
             if (host === undefined) {
               return [
                 failure(
@@ -1058,29 +1339,32 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            if (host.row.conversationId !== request.conversationId) {
+            if (host.row.threadId !== request.threadId) {
               return [
                 failure(
                   ledgerError(
                     "claimJoining",
-                    `Host Submission ${request.hostSubmissionId} does not belong to Conversation ${request.conversationId}`,
+                    `Host Submission ${request.hostSubmissionId} does not belong to Thread ${request.threadId}`,
                   ),
                 ),
                 current,
               ];
             }
-            if (!ownsLane(host, request.ownershipToken)) {
+            if (!ownsLane(current, host, request.ownershipToken)) {
               return [failure(ownershipLost(current, host)), current];
             }
+
             const later = [...current.submissions.values()]
               .filter(
                 (stored) =>
-                  stored.row.conversationId === request.conversationId &&
+                  stored.row.threadId === request.threadId &&
                   stored.row.queueSequence > host.row.queueSequence,
               )
               .sort((left, right) => left.row.queueSequence - right.row.queueSequence);
+
             const claims: Array<JoiningClaim> = [];
             const submissions = new Map(current.submissions);
+
             for (const stored of later) {
               if (claims.length >= request.maxCount) break;
               // Rows already claimed by THIS host extend its contiguous prefix and are skipped;
@@ -1113,10 +1397,13 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 }),
               );
             }
+
             return [success(claims), { ...current, submissions }];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -1126,10 +1413,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(MarkJoinedRequest, "markJoined", unvalidated);
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<void, OwnershipLost | LedgerError>, LedgerState] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(ledgerError("markJoined", `Unknown Submission ${request.submissionId}`)),
@@ -1148,6 +1437,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ];
             }
             const host = current.submissions.get(stored.joinedHostSubmissionId);
+
             if (host === undefined) {
               return [
                 failure(
@@ -1161,7 +1451,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             }
             // The lane is host-owned: the presented token must own the HOST's ownership period,
             // which also lets a later host Attempt repair a lost marker from history (DUR-016).
-            if (!ownsLane(host, request.ownershipToken)) {
+            if (!ownsLane(current, host, request.ownershipToken)) {
               return [failure(ownershipLost(current, host)), current];
             }
             if (stored.inputApplied !== undefined) {
@@ -1171,6 +1461,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ) {
                 return [success(undefined), current];
               }
+
               return [
                 failure(
                   ledgerError(
@@ -1192,10 +1483,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
+
             const marker = InputAppliedMarker.make({
               recordId: request.recordId,
               sequence: request.sequence,
             });
+
             return [
               success(undefined),
               withSubmission(current, {
@@ -1206,6 +1499,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
       }),
     );
@@ -1215,10 +1509,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(RevertJoiningRequest, "revertJoining", unvalidated);
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<void, LedgerError>, LedgerState] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(ledgerError("revertJoining", `Unknown Submission ${request.submissionId}`)),
@@ -1228,6 +1524,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             // Idempotent and recovery-only: only a still-`joining` Submission reverts; an
             // already-joined (or already-reverted) Submission is a no-op (DUR-016).
             if (stored.row.state !== "joining") return [success(undefined), current];
+
             return [
               success(undefined),
               withSubmission(current, {
@@ -1238,6 +1535,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
       }),
     );
@@ -1248,6 +1546,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       Effect.gen(function* () {
         const request = yield* validate(SuspendRequest, "suspend", unvalidated);
         const nowMillis = yield* Clock.currentTimeMillis;
+
         const decision = yield* Ref.modify(
           state,
           (
@@ -1257,6 +1556,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             LedgerState,
           ] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(ledgerError("suspend", `Unknown Submission ${request.submissionId}`)),
@@ -1275,6 +1575,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               return [
                 failure(
                   SettlementConflict.make({
@@ -1298,9 +1599,10 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            if (!ownsLane(stored, request.ownershipToken)) {
+            if (!ownsLane(current, stored, request.ownershipToken)) {
               return [failure(ownershipLost(current, stored)), current];
             }
+
             // A covering event that raced ahead of the suspend transaction (an approval decision,
             // or a child settlement observed directly from the child's row in this single store)
             // resumes the caller immediately WITHOUT releasing the lane (plan §2.6, spec §12).
@@ -1313,9 +1615,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                     (child) =>
                       current.submissions.get(child.childSubmissionId)?.row.state === "settled",
                   );
+
             if (alreadyCovered) {
               return [success("resume-immediately" as const), current];
             }
+
             return [
               success("suspended" as const),
               withSubmission(current, {
@@ -1327,7 +1631,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -1341,7 +1647,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
           "recordApprovalDecision",
           unvalidated,
         );
+
         const nowMillis = yield* Clock.currentTimeMillis;
+
         const decision = yield* Ref.modify(
           state,
           (
@@ -1351,6 +1659,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             LedgerState,
           ] => {
             const stored = current.submissions.get(command.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(
@@ -1374,6 +1683,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               return [
                 failure(
                   SettlementConflict.make({
@@ -1385,6 +1695,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ];
             }
             const existing = stored.approvalDecisions.get(command.toolCallId);
+
             if (existing !== undefined) {
               if (existing.decision !== command.decision) {
                 return [
@@ -1398,8 +1709,10 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               return [success(existing), current];
             }
+
             const intent = ApprovalDecisionIntent.make({
               submissionId: command.submissionId,
               toolCallId: command.toolCallId,
@@ -1408,10 +1721,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               reason: command.reason,
               decidedAt: utc(nowMillis),
             });
+
             const approvalDecisions = new Map(stored.approvalDecisions).set(
               command.toolCallId,
               intent,
             );
+
             // Once every pending call of an ApprovalPending suspension is decided, the lane
             // wakes: suspended → input-applied (plan §2.6). A WaitingForChild suspension wakes
             // only through recordChildSettled.
@@ -1422,6 +1737,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               stored.suspension.reason.toolCallIds.every((toolCallId) =>
                 approvalDecisions.has(toolCallId),
               );
+
             return [
               success(intent),
               withSubmission(current, {
@@ -1433,7 +1749,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -1443,10 +1761,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(MarkUnknownRequest, "markUnknown", unvalidated);
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<void, SettlementConflict | LedgerError>, LedgerState] => {
             const stored = current.submissions.get(request.submissionId);
+
             if (stored === undefined) {
               return [
                 failure(ledgerError("markUnknown", `Unknown Submission ${request.submissionId}`)),
@@ -1465,6 +1785,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               return [
                 failure(
                   SettlementConflict.make({
@@ -1492,10 +1813,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             // set while the first recorded reason is kept.
             const existing = stored.unknownMark;
             const known = new Set(existing?.toolCallIds ?? []);
+
             const merged = [
               ...(existing?.toolCallIds ?? []),
               ...request.toolCallIds.filter((toolCallId) => !known.has(toolCallId)),
             ];
+
             return [
               success(undefined),
               withSubmission(current, {
@@ -1507,6 +1830,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
       }),
     );
@@ -1519,15 +1843,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             "recordUnknownResolution",
             unvalidated,
           );
+
           const nowMillis = yield* Clock.currentTimeMillis;
-          const encodedResolution = yield* Schema.encodeUnknownEffect(UnknownResolution)(
-            command.resolution,
-          ).pipe(
-            Effect.mapError((error) =>
-              ledgerError("recordUnknownResolution", "Invalid unknown-outcome resolution", error),
-            ),
-          );
-          const resolutionJson = JSON.stringify(encodedResolution);
+
           const decision = yield* Ref.modify(
             state,
             (
@@ -1540,6 +1858,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               LedgerState,
             ] => {
               const stored = current.submissions.get(command.submissionId);
+
               if (stored === undefined) {
                 return [
                   failure(
@@ -1563,6 +1882,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                     current,
                   ];
                 }
+
                 return [
                   failure(
                     SettlementConflict.make({
@@ -1574,7 +1894,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 ];
               }
               const existing = stored.unknownResolutions.get(command.toolCallId);
-              if (existing !== undefined && existing.resolutionJson !== resolutionJson) {
+
+              if (
+                existing !== undefined &&
+                !equivalentUnknownResolution(existing.intent.resolution, command.resolution)
+              ) {
                 return [
                   failure(
                     UnknownResolutionConflict.make({
@@ -1585,6 +1909,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               const intent =
                 existing?.intent ??
                 UnknownResolutionIntent.make({
@@ -1595,13 +1920,14 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   resolution: command.resolution,
                   resolvedAt: utc(nowMillis),
                 });
+
               const unknownResolutions =
                 existing !== undefined
                   ? stored.unknownResolutions
                   : new Map(stored.unknownResolutions).set(command.toolCallId, {
                       intent,
-                      resolutionJson,
                     });
+
               // The lane reopens only when EVERY marked open call has a durable resolution
               // intent: unknown → input-applied (DUR-017). Replays re-run the coverage check so
               // a recovering caller can wake the lane idempotently.
@@ -1611,6 +1937,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 stored.unknownMark.toolCallIds.every((toolCallId) =>
                   unknownResolutions.has(toolCallId),
                 );
+
               return [
                 success(intent),
                 withSubmission(current, {
@@ -1622,7 +1949,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               ];
             },
           );
+
           if (decision._tag === "failure") return yield* decision.error;
+
           return decision.value;
         }),
       );
@@ -1636,10 +1965,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
           "recordChildSettled",
           unvalidated,
         );
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<ChildSettledOutcome, LedgerError>, LedgerState] => {
             const parent = current.submissions.get(request.parentSubmissionId);
+
             if (parent === undefined) {
               return [
                 failure(
@@ -1651,10 +1982,18 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            // The child's canonical Settlement is the authority for this wake; a notification
-            // for an unsettled (or unknown) child is a caller error in a single-store adapter.
+            // The caller may notify after the canonical Settlement append but before ledger
+            // finalization. In a single store, an exact reservation plus `terminalizing` is the
+            // narrow durable prefix that makes that ordering admissible; earlier states remain
+            // a caller error.
             const child = current.submissions.get(request.childSubmissionId);
-            if (child === undefined || child.row.state !== "settled") {
+
+            const announced =
+              child !== undefined &&
+              (child.row.state === "settled" ||
+                (child.row.state === "terminalizing" && child.reservation !== undefined));
+
+            if (!announced) {
               return [
                 failure(
                   ledgerError(
@@ -1673,16 +2012,24 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               return [success("not-waiting" as const), current];
             }
             const children = parent.suspension.reason.children;
+
             if (!children.some((entry) => entry.childSubmissionId === request.childSubmissionId)) {
               return [success("not-waiting" as const), current];
             }
-            // The parent wakes exactly when EVERY listed child is settled (spec §12 step 10);
-            // replays re-run the coverage check so a recovering caller wakes the lane
-            // idempotently.
-            const allSettled = children.every(
-              (entry) => current.submissions.get(entry.childSubmissionId)?.row.state === "settled",
-            );
+
+            // Every listed child must be either finalized or canonically announced from the
+            // exact terminalizing reservation. Replays re-run this coverage check idempotently.
+            const allSettled = children.every((entry) => {
+              const listed = current.submissions.get(entry.childSubmissionId);
+
+              return (
+                listed?.row.state === "settled" ||
+                (listed?.row.state === "terminalizing" && listed.reservation !== undefined)
+              );
+            });
+
             if (!allSettled) return [success("still-waiting" as const), current];
+
             return [
               success("woken" as const),
               withSubmission(current, {
@@ -1693,7 +2040,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -1707,8 +2056,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
           "reserveChildBudget",
           unvalidated,
         );
+
         const nowMillis = yield* Clock.currentTimeMillis;
-        const allocationJson = JSON.stringify(request.allocation);
+
         const decision = yield* Ref.modify(
           state,
           (
@@ -1718,6 +2068,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             LedgerState,
           ] => {
             const existing = current.childReservations.get(request.reservationId);
+
             if (existing !== undefined) {
               // Identical replays short-circuit before the fence, mirroring reserveSettlement:
               // a replay creates nothing, so a recovering caller resumes rather than duplicates.
@@ -1725,7 +2076,8 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 existing.parentSubmissionId === request.parentSubmissionId &&
                 existing.parentToolCallId === request.parentToolCallId &&
                 existing.allocationDigest === request.allocationDigest &&
-                existing.allocationJson === allocationJson;
+                equivalentPersistedJson(existing.allocation, request.allocation);
+
               if (!identical) {
                 return [
                   failure(
@@ -1739,6 +2091,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               return [
                 success(
                   ReservedChildBudget.make({
@@ -1767,6 +2120,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               }
             }
             const parent = current.submissions.get(request.parentSubmissionId);
+
             if (parent === undefined) {
               return [
                 failure(
@@ -1780,9 +2134,10 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             }
             // Creation is fenced by the parent lane's live ownership (spec §12 step 2): a stale
             // parent Attempt can never create new reservation state.
-            if (!ownsLane(parent, request.ownershipToken)) {
+            if (!ownsLane(current, parent, request.ownershipToken)) {
               return [failure(ownershipLost(current, parent)), current];
             }
+
             const reservation: StoredChildReservation = {
               reservationId: request.reservationId,
               parentSubmissionId: request.parentSubmissionId,
@@ -1790,14 +2145,13 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               childSubmissionId: undefined,
               status: "reserved",
               allocation: request.allocation,
-              allocationJson,
               allocationDigest: request.allocationDigest,
               accounting: undefined,
-              accountingJson: undefined,
               reservedAtMillis: nowMillis,
               releaseBeganAtMillis: undefined,
               releasedAtMillis: undefined,
             };
+
             return [
               success(
                 ReservedChildBudget.make({
@@ -1809,7 +2163,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -1822,6 +2178,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             "attachChildToReservation",
             unvalidated,
           );
+
           const decision = yield* Ref.modify(
             state,
             (
@@ -1834,6 +2191,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               LedgerState,
             ] => {
               const reservation = current.childReservations.get(request.reservationId);
+
               if (reservation === undefined) {
                 return [
                   failure(
@@ -1850,6 +2208,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 if (reservation.childSubmissionId === request.childSubmissionId) {
                   return [success(toReservationSnapshot(reservation)), current];
                 }
+
                 return [
                   failure(
                     ChildReservationConflict.make({
@@ -1862,6 +2221,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 ];
               }
               const parent = current.submissions.get(reservation.parentSubmissionId);
+
               if (parent === undefined) {
                 return [
                   failure(
@@ -1873,7 +2233,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
-              if (!ownsLane(parent, request.ownershipToken)) {
+              if (!ownsLane(current, parent, request.ownershipToken)) {
                 return [failure(ownershipLost(current, parent)), current];
               }
               if (reservation.status !== "reserved") {
@@ -1901,17 +2261,21 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               const attached: StoredChildReservation = {
                 ...reservation,
                 childSubmissionId: request.childSubmissionId,
               };
+
               return [
                 success(toReservationSnapshot(attached)),
                 withChildReservation(current, attached),
               ];
             },
           );
+
           if (decision._tag === "failure") return yield* decision.error;
+
           return decision.value;
         }),
       );
@@ -1924,8 +2288,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             "beginChildBudgetRelease",
             unvalidated,
           );
+
           const nowMillis = yield* Clock.currentTimeMillis;
-          const accountingJson = JSON.stringify(request.accounting);
+
           const decision = yield* Ref.modify(
             state,
             (
@@ -1935,6 +2300,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               LedgerState,
             ] => {
               const reservation = current.childReservations.get(request.reservationId);
+
               if (reservation === undefined) {
                 return [
                   failure(
@@ -1949,9 +2315,13 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               if (reservation.status !== "reserved") {
                 // The accounting decision was already frozen exactly once; an identical replay is
                 // a no-op and a divergent decision conflicts (spec §12 join step 6).
-                if (reservation.accountingJson === accountingJson) {
+                if (
+                  reservation.accounting !== undefined &&
+                  equivalentPersistedJson(reservation.accounting, request.accounting)
+                ) {
                   return [success(toReservationSnapshot(reservation)), current];
                 }
+
                 return [
                   failure(
                     ChildReservationConflict.make({
@@ -1964,20 +2334,23 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   current,
                 ];
               }
+
               const frozen: StoredChildReservation = {
                 ...reservation,
                 status: "releasePending",
                 accounting: request.accounting,
-                accountingJson,
                 releaseBeganAtMillis: nowMillis,
               };
+
               return [
                 success(toReservationSnapshot(frozen)),
                 withChildReservation(current, frozen),
               ];
             },
           );
+
           if (decision._tag === "failure") return yield* decision.error;
+
           return decision.value;
         }),
       );
@@ -1991,7 +2364,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
           "releaseChildBudget",
           unvalidated,
         );
+
         const nowMillis = yield* Clock.currentTimeMillis;
+
         const decision = yield* Ref.modify(
           state,
           (
@@ -2001,6 +2376,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             LedgerState,
           ] => {
             const reservation = current.childReservations.get(request.reservationId);
+
             if (reservation === undefined) {
               return [
                 failure(
@@ -2030,18 +2406,22 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
+
             const released: StoredChildReservation = {
               ...reservation,
               status: "released",
               releasedAtMillis: nowMillis,
             };
+
             return [
               success(toReservationSnapshot(released)),
               withChildReservation(current, released),
             ];
           },
         );
+
         if (decision._tag === "failure") return yield* decision.error;
+
         return decision.value;
       }),
     );
@@ -2052,18 +2432,32 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
           const snapshots = [...current.submissions.values()]
             .filter((stored) => stored.row.state !== "settled")
             .sort((left, right) =>
-              left.row.conversationId < right.row.conversationId
+              left.row.threadId < right.row.threadId
                 ? -1
-                : left.row.conversationId > right.row.conversationId
+                : left.row.threadId > right.row.threadId
                   ? 1
                   : left.row.queueSequence - right.row.queueSequence,
             )
             .map((stored) => toSnapshot(stored.row));
+
           return Stream.fromIterable(snapshots);
         }),
       ),
     );
 
+    const readAbortIntent: SubmissionLedger["Service"]["readAbortIntent"] = Effect.fn(
+      "MemorySubmissionLedger.readAbortIntent",
+    )(function* (unvalidated) {
+      const request = yield* validate(AbortIntentRequest, "readAbortIntent", unvalidated);
+      const stored = (yield* Ref.get(state)).submissions.get(request.submissionId);
+
+      if (stored === undefined) {
+        return yield* ledgerError("readAbortIntent", `Unknown Submission ${request.submissionId}`);
+      }
+
+      return stored.abortIntent;
+    });
+
     const loadRecoverySnapshot: SubmissionLedger["Service"]["loadRecoverySnapshot"] = Effect.fn(
       "MemorySubmissionLedger.loadRecoverySnapshot",
     )((unvalidated) =>
@@ -2073,14 +2467,17 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
           "loadRecoverySnapshot",
           unvalidated,
         );
+
         const current = yield* Ref.get(state);
         const stored = current.submissions.get(request.submissionId);
+
         if (stored === undefined) {
           return yield* ledgerError(
             "loadRecoverySnapshot",
             `Unknown Submission ${request.submissionId}`,
           );
         }
+
         const joins = [...current.submissions.values()]
           .filter((candidate) => candidate.joinedHostSubmissionId === request.submissionId)
           .sort((left, right) => left.row.queueSequence - right.row.queueSequence)
@@ -2091,11 +2488,13 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               hostSubmissionId: request.submissionId,
             }),
           );
+
         const byToolCallId = <A extends { readonly toolCallId: ToolCallId }>(
           left: A,
           right: A,
         ): number =>
           left.toolCallId < right.toolCallId ? -1 : left.toolCallId > right.toolCallId ? 1 : 0;
+
         // Parent-side subagent view: this Submission's child budget reservations in parent Tool
         // Call order, plus each attached child's current lane state (a disposable derived view;
         // the canonical records stay the recovery truth, DUR-015).
@@ -2108,10 +2507,13 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 ? 1
                 : 0,
           );
+
         const childAttachments: Array<ChildAttachmentSnapshot> = [];
+
         for (const reservation of childReservations) {
           if (reservation.childSubmissionId === undefined) continue;
           const child = current.submissions.get(reservation.childSubmissionId);
+
           if (child === undefined) continue;
           childAttachments.push(
             ChildAttachmentSnapshot.make({
@@ -2124,6 +2526,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             }),
           );
         }
+
         return RecoverySnapshot.make({
           submission: toSnapshot(stored.row),
           joins,
@@ -2201,6 +2604,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       releaseChildBudget,
       scanNonterminal,
       loadRecoverySnapshot,
+      readAbortIntent,
     });
   });