@effect-agent/storage-sqlite 0.1.0-beta.12 → 0.1.0-beta.120

package/src/{sqlite-ledger.ts → SqliteSubmissionLedger.ts}

@@ -1,18 +1,40 @@
+import { NodeCrypto } from "@effect/platform-node";
+import { SqliteClient } from "@effect/sql-sqlite-node";
+import { Clock, Context, Crypto, DateTime, Effect, Layer, Option, Schema, Stream } from "effect";
+import { EMPTY_TAIL_DIGEST } from "effect-agent/digest";
+import { InputMessage } from "effect-agent/messaging";
+import {
+  ApprovalDecision,
+  CanonicalSequence,
+  DefinitionDigests,
+  Digest,
+  PersistedJson,
+  WorkerAdmission,
+  ProducerEpoch,
+  RecordEnvelope,
+  SettlementOutcome,
+} from "effect-agent/records";
 import {
   AbortCommand,
+  WorkerStopCommand,
+  WorkerLedgerState,
+  workerTerminalFromRecord,
   AbortIntent,
+  AbortIntentRequest,
   AdmissionAdmitted,
   AdmissionConflict,
+  AdmissionFence,
+  AdmissionGroup,
+  AdmissionPolicyError,
   AdmissionNotAdmitted,
   AdmissionRequest,
+  SubmissionAdmissionFence,
   AdmissionResult,
   ApprovalConflict,
-  ApprovalDecision,
   ApprovalDecisionCommand,
   ApprovalDecisionIntent,
   AttachChildToReservationRequest,
   BeginChildBudgetReleaseRequest,
-  CanonicalSequence,
   ChildAttachmentSnapshot,
   ChildBudgetReservationRequest,
   ChildBudgetReservationSnapshot,
@@ -22,9 +44,6 @@ import {
   Claim,
   ClaimJoiningRequest,
   ClaimRequest,
-  DefinitionDigests,
-  Digest,
-  EMPTY_TAIL_DIGEST,
   InputAppliedMarker,
   JoinSnapshot,
   JoinedToHost,
@@ -39,10 +58,7 @@ import {
   OwnershipRenewal,
   OwnershipSnapshot,
   ParentLinkage,
-  PersistedJson,
-  ProducerEpoch,
   QueueSequence,
-  RecordEnvelope,
   RecoverySnapshot,
   RecoverySnapshotRequest,
   ReleaseChildBudgetRequest,
@@ -54,14 +70,15 @@ import {
   Settlement,
   SettlementConflict,
   SettlementFinalization,
-  SettlementOutcome,
   SettlementReservation,
   SubmissionLedger,
   SubmissionLookup,
   SubmissionLookupByKey,
   SubmissionSnapshot,
+  SubmissionWorkItem,
   SubmissionState,
   SettlementReservationSnapshot,
+  settlementFailureFromRecord,
   SuspendRequest,
   SuspensionReason,
   SuspensionSnapshot,
@@ -72,29 +89,26 @@ import {
   submissionAbortRecordId,
   type ChildSettledOutcome,
   type SuspensionOutcome,
-} from "@effect-agent/session";
-import { NodeCrypto } from "@effect/platform-node";
-import { SqliteClient } from "@effect/sql-sqlite-node";
-import { Clock, Context, Crypto, DateTime, Effect, Layer, Option, Schema, Stream } from "effect";
+} from "effect-agent/submission-ledger";
 import * as SqlClientService from "effect/unstable/sql/SqlClient";
 import type { SqlError } from "effect/unstable/sql/SqlError";
 
+import { decodeRows, initializeSqliteJournal } from "./internal/sqlite-journal.ts";
+import { SqliteStorageConfig } from "./SqliteStorageConfig.ts";
 import {
   SqliteLedgerError,
   SqliteStorageCorruptionError,
   SqliteStorageError,
   SqliteWriteContention,
   type SqliteStorageFailpointLocation,
-} from "./errors.ts";
+} from "./SqliteStorageError.ts";
+import { SqliteStorageFailpoint } from "./SqliteStorageFailpoint.ts";
 import {
   storageConfigLayer,
   storageFailpointLayer,
   type SqliteStorageInitializationError,
   type SqliteStorageOptions,
-} from "./sqlite-conversation-store.ts";
-import { decodeRows, initializeSqliteJournal } from "./sqlite-journal.ts";
-import { SqliteStorageConfig } from "./sqlite-storage-config.ts";
-import { SqliteStorageFailpoint } from "./sqlite-storage-failpoint.ts";
+} from "./SqliteThreadStore.ts";
 
 type SubmissionId = SubmissionSnapshot["submissionId"];
 
@@ -104,10 +118,15 @@ const BoundedTimestamp = Schema.NonEmptyString.check(Schema.isMaxLength(128));
 
 const SCAN_PAGE_SIZE = 256;
 const EPOCH_ZERO = Schema.decodeSync(ProducerEpoch)(0);
+const RESUME_IMMEDIATELY: SuspensionOutcome = "resume-immediately";
+const SUSPENDED: SuspensionOutcome = "suspended";
+const NOT_WAITING: ChildSettledOutcome = "not-waiting";
+const STILL_WAITING: ChildSettledOutcome = "still-waiting";
+const WOKEN: ChildSettledOutcome = "woken";
 
 class SubmissionRow extends Schema.Class<SubmissionRow>("SubmissionRow")({
   submission_id: BoundedIdentifier,
-  conversation_id: BoundedIdentifier,
+  thread_id: BoundedIdentifier,
   queue_sequence: QueueSequence,
   principal: BoundedIdentifier,
   idempotency_key: BoundedIdentifier,
@@ -130,6 +149,10 @@ class SubmissionRow extends Schema.Class<SubmissionRow>("SubmissionRow")({
   unknown_tool_call_ids_json: Schema.NullOr(BoundedStoredText),
   parent_submission_id: Schema.NullOr(BoundedIdentifier),
   parent_tool_call_id: Schema.NullOr(BoundedIdentifier),
+  admission_group: Schema.NullOr(AdmissionGroup),
+  admission_fence_json: Schema.NullOr(BoundedStoredText),
+  worker_admission_json: Schema.NullOr(BoundedStoredText),
+  message_admission_json: Schema.NullOr(BoundedStoredText),
 }) {}
 
 class ChildReservationRow extends Schema.Class<ChildReservationRow>("ChildReservationRow")({
@@ -196,13 +219,22 @@ class MaxQueueSequenceRow extends Schema.Class<MaxQueueSequenceRow>("MaxQueueSeq
   max_queue_sequence: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
 }) {}
 
+class AbortIntentLookupRow extends Schema.Class<AbortIntentLookupRow>("AbortIntentLookupRow")({
+  submission_id: BoundedIdentifier,
+  abort_submission_id: Schema.NullOr(BoundedIdentifier),
+  author: Schema.NullOr(BoundedIdentifier),
+  reason: Schema.NullOr(BoundedStoredText),
+  requested_at: Schema.NullOr(BoundedTimestamp),
+  canonical_record_id: Schema.NullOr(BoundedIdentifier),
+}) {}
+
 class CanonicalRecordIdRow extends Schema.Class<CanonicalRecordIdRow>("CanonicalRecordIdRow")({
   record_id: BoundedIdentifier,
 }) {}
 
 const SUBMISSION_COLUMNS = `
   submission_id,
-  conversation_id,
+  thread_id,
   queue_sequence,
   principal,
   idempotency_key,
@@ -224,7 +256,11 @@ const SUBMISSION_COLUMNS = `
   unknown_reason,
   unknown_tool_call_ids_json,
   parent_submission_id,
-  parent_tool_call_id
+  parent_tool_call_id,
+  admission_group,
+  admission_fence_json,
+  worker_admission_json,
+  message_admission_json
 `;
 
 const CHILD_RESERVATION_COLUMNS = `
@@ -241,7 +277,7 @@ const CHILD_RESERVATION_COLUMNS = `
   released_at
 `;
 
-/** The branded ToolCallId schema, reached through the session port so no core import is needed. */
+/** The branded ToolCallId schema, reached through the thread port so no core import is needed. */
 const ToolCallIdSchema = ApprovalDecisionCommand.fields.toolCallId;
 const ToolCallIdList = Schema.Array(ToolCallIdSchema);
 
@@ -271,10 +307,18 @@ const decodeSuspensionSnapshot = Schema.decodeUnknownEffect(SuspensionSnapshot);
 const decodeApprovalDecisionIntent = Schema.decodeUnknownEffect(ApprovalDecisionIntent);
 const decodeUnknownResolutionIntent = Schema.decodeUnknownEffect(UnknownResolutionIntent);
 const decodeParentLinkage = Schema.decodeUnknownEffect(ParentLinkage);
+
 const decodeChildReservationSnapshotUnknown = Schema.decodeUnknownEffect(
   ChildBudgetReservationSnapshot,
 );
+
 const decodeChildAttachmentSnapshot = Schema.decodeUnknownEffect(ChildAttachmentSnapshot);
+const equivalentPersistedJson = Schema.toEquivalence(PersistedJson);
+const equivalentUnknownResolution = Schema.toEquivalence(UnknownResolution);
+
+const isSqliteTransactionFailure = Schema.is(
+  Schema.Union([SqliteStorageError, SqliteWriteContention]),
+);
 
 /** Wrap an adapter-internal failure into the port's LedgerError without erasing its tag. */
 const internalFailure =
@@ -298,6 +342,7 @@ const sqlFailure =
             operation,
             message: error.message,
           });
+
     return internalFailure(operation)(internal);
   };
 
@@ -309,7 +354,8 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
   const failpoint = yield* SqliteStorageFailpoint;
   const sql = yield* SqlClientService.SqlClient;
   const crypto = yield* Crypto.Crypto;
-  const journal = yield* initializeSqliteJournal(sql, failpoint.hit, config.busyTimeout);
+  const admissionFence = yield* SubmissionAdmissionFence;
+  const journal = yield* initializeSqliteJournal();
 
   const hitFailpoint = (
     location: SqliteStorageFailpointLocation,
@@ -327,6 +373,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     A,
     E extends
       | AdmissionConflict
+      | AdmissionPolicyError
       | ApprovalConflict
       | ChildReservationConflict
       | JoinedToHost
@@ -342,9 +389,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       .withWriteTransaction(operation)(effect)
       .pipe(
         Effect.mapError((error) =>
-          error instanceof SqliteStorageError || error instanceof SqliteWriteContention
-            ? internalFailure(operation)(error)
-            : error,
+          isSqliteTransactionFailure(error) ? internalFailure(operation)(error) : error,
         ),
       );
 
@@ -381,7 +426,9 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       FROM effect_agent_submissions
       WHERE submission_id = ${submissionId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeSubmissionRows(operation, submissionId, rows);
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -390,6 +437,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         "A submission primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -398,12 +446,14 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     submissionId: string,
   ): Effect.fn.Return<SubmissionRow, LedgerError> {
     const submission = yield* readSubmission(operation, submissionId);
+
     if (Option.isNone(submission)) {
       return yield* LedgerError.make({
         operation,
         message: `Unknown submission ${submissionId}.`,
       });
     }
+
     return submission.value;
   });
 
@@ -422,12 +472,14 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       FROM effect_agent_submission_ownership
       WHERE submission_id = ${submissionId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeRows(
       Schema.Array(OwnershipRow),
       "effect_agent_submission_ownership",
       submissionId,
       rows,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -436,23 +488,25 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         "An ownership primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
-  const conversationEpoch = Effect.fn("SqliteSubmissionLedger.conversationEpoch")(function* (
+  const threadEpoch = Effect.fn("SqliteSubmissionLedger.threadEpoch")(function* (
     operation: string,
-    conversationId: string,
+    threadId: string,
   ): Effect.fn.Return<ProducerEpoch, LedgerError> {
-    const conversations = yield* journal
-      .getConversation(conversationId)
+    const threads = yield* journal
+      .getThread(threadId)
       .pipe(Effect.mapError(internalFailure(operation)));
-    return conversations.length === 0 ? EPOCH_ZERO : conversations[0].producer_epoch;
+
+    return threads.length === 0 ? EPOCH_ZERO : threads[0].producer_epoch;
   });
 
   /**
    * Verify inside the surrounding write transaction that the presented token still owns the
    * Submission's lane; a superseded or missing token fails with OwnershipLost carrying the
-   * Conversation's current producer epoch (DUR-006).
+   * Thread's current producer epoch (DUR-006).
    */
   const requireOwnership = Effect.fn("SqliteSubmissionLedger.requireOwnership")(function* (
     operation: string,
@@ -460,13 +514,20 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     ownershipToken: string,
   ): Effect.fn.Return<OwnershipRow, OwnershipLost | LedgerError> {
     const ownership = yield* readOwnership(operation, submission.submission_id);
-    if (Option.isNone(ownership) || ownership.value.ownership_token !== ownershipToken) {
-      const actualEpoch = yield* conversationEpoch(operation, submission.conversation_id);
-      const submissionId = yield* Schema.decodeUnknownEffect(
-        SubmissionSnapshot.fields.submissionId,
-      )(submission.submission_id).pipe(Effect.mapError(internalFailure(operation)));
+    const actualEpoch = yield* threadEpoch(operation, submission.thread_id);
+
+    if (
+      Option.isNone(ownership) ||
+      ownership.value.ownership_token !== ownershipToken ||
+      ownership.value.producer_epoch !== actualEpoch
+    ) {
+      const submissionId = yield* Schema.decodeEffect(SubmissionSnapshot.fields.submissionId)(
+        submission.submission_id,
+      ).pipe(Effect.mapError(internalFailure(operation)));
+
       return yield* OwnershipLost.make({ submissionId, actualEpoch });
     }
+
     return ownership.value;
   });
 
@@ -485,6 +546,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           ),
         ),
       );
+
       const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
         Effect.mapError((error) =>
           corruptionFailure(
@@ -495,6 +557,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           ),
         ),
       );
+
       if ((row.parent_submission_id === null) !== (row.parent_tool_call_id === null)) {
         return yield* corruptionFailure(
           operation,
@@ -503,9 +566,10 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           "A parent linkage must record both the parent Submission and the parent Tool Call.",
         );
       }
+
       return yield* decodeSubmissionSnapshotUnknown({
         submissionId: row.submission_id,
-        conversationId: row.conversation_id,
+        threadId: row.thread_id,
         queueSequence: row.queue_sequence,
         principal: row.principal,
         idempotencyKey: row.idempotency_key,
@@ -517,6 +581,28 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         receiptId: row.receipt_id,
         state: row.state,
         createdAt: row.created_at,
+        ...(row.admission_group === null ? {} : { admissionGroup: row.admission_group }),
+        ...(row.worker_admission_json === null
+          ? {}
+          : {
+              workerAdmission: yield* parseStoredJsonText(row.worker_admission_json).pipe(
+                Effect.mapError(internalFailure(operation)),
+              ),
+            }),
+        ...(row.message_admission_json === null
+          ? {}
+          : {
+              messageAdmission: yield* parseStoredJsonText(row.message_admission_json).pipe(
+                Effect.mapError(internalFailure(operation)),
+              ),
+            }),
+        ...(row.admission_fence_json === null
+          ? {}
+          : {
+              admissionFence: yield* parseStoredJsonText(row.admission_fence_json).pipe(
+                Effect.mapError(internalFailure(operation)),
+              ),
+            }),
         ...(row.settled_outcome === null ? {} : { settledOutcome: row.settled_outcome }),
         ...(row.ready_at === null ? {} : { readyAt: row.ready_at }),
         ...(row.parent_submission_id === null || row.parent_tool_call_id === null
@@ -557,12 +643,14 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       FROM effect_agent_settlement_reservations
       WHERE submission_id = ${submissionId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeRows(
       Schema.Array(ReservationRow),
       "effect_agent_settlement_reservations",
       submissionId,
       rows,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -571,6 +659,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         "A settlement reservation primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -588,12 +677,14 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       FROM effect_agent_abort_intents
       WHERE submission_id = ${submissionId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeRows(
       Schema.Array(AbortIntentRow),
       "effect_agent_abort_intents",
       submissionId,
       rows,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -602,6 +693,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         "An abort intent primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -622,7 +714,9 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       FROM effect_agent_child_reservations
       WHERE reservation_id = ${reservationId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeChildReservationRows(operation, reservationId, rows);
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -631,6 +725,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         "A child reservation primary key returned more than one row.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -647,11 +742,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       WHERE parent_submission_id = ${parentSubmissionId}
         AND parent_tool_call_id = ${parentToolCallId}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeChildReservationRows(
       operation,
       `${parentSubmissionId}/${parentToolCallId}`,
       rows,
     );
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
@@ -660,6 +757,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         "A parent Tool Call returned more than one child reservation.",
       );
     }
+
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
@@ -676,13 +774,16 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         row.reservation_id,
         error.message,
       );
+
     const allocation = yield* parseStoredJsonText(row.allocation_json).pipe(
       Effect.mapError(rowFailure),
     );
+
     const accounting =
       row.accounting_json === null
         ? undefined
         : yield* parseStoredJsonText(row.accounting_json).pipe(Effect.mapError(rowFailure));
+
     return yield* decodeChildReservationSnapshotUnknown({
       reservationId: row.reservation_id,
       parentSubmissionId: row.parent_submission_id,
@@ -715,6 +816,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         WHERE submission_id = ${submissionId}
         ORDER BY tool_call_id ASC
       `.pipe(Effect.mapError(sqlFailure(operation)));
+
       return yield* decodeRows(
         Schema.Array(ApprovalDecisionRow),
         "effect_agent_approval_decisions",
@@ -766,6 +868,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         WHERE submission_id = ${submissionId}
         ORDER BY tool_call_id ASC
       `.pipe(Effect.mapError(sqlFailure(operation)));
+
       return yield* decodeRows(
         Schema.Array(UnknownResolutionRow),
         "effect_agent_unknown_resolutions",
@@ -791,6 +894,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         ),
       ),
     );
+
     return yield* decodeUnknownResolutionIntent({
       submissionId: row.submission_id,
       toolCallId: row.tool_call_id,
@@ -817,6 +921,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       submission: SubmissionRow,
     ): Effect.fn.Return<ReadonlyArray<typeof ToolCallIdSchema.Type>, LedgerError> {
       if (submission.unknown_tool_call_ids_json === null) return [];
+
       return yield* decodeToolCallIdsText(submission.unknown_tool_call_ids_json).pipe(
         Effect.mapError((error) =>
           corruptionFailure(
@@ -838,22 +943,25 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
   const canonicalAbortRecordId = Effect.fn("SqliteSubmissionLedger.canonicalAbortRecordId")(
     function* (
       operation: string,
-      conversationId: string,
+      threadId: string,
       submissionId: SubmissionId,
     ): Effect.fn.Return<string | undefined, LedgerError> {
       const recordId = submissionAbortRecordId(submissionId);
+
       const rows = yield* sql<Record<string, unknown>>`
         SELECT record_id
         FROM effect_agent_canonical_records
-        WHERE conversation_id = ${conversationId}
+        WHERE thread_id = ${threadId}
           AND record_id = ${recordId}
       `.pipe(Effect.mapError(sqlFailure(operation)));
+
       const decoded = yield* decodeRows(
         Schema.Array(CanonicalRecordIdRow),
         "effect_agent_canonical_records",
-        `${conversationId}/${recordId}`,
+        `${threadId}/${recordId}`,
         rows,
       ).pipe(Effect.mapError(internalFailure(operation)));
+
       return decoded.length === 0 ? undefined : recordId;
     },
   );
@@ -866,9 +974,10 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
   ): Effect.fn.Return<AbortIntent, LedgerError> {
     const canonicalRecordId = yield* canonicalAbortRecordId(
       operation,
-      submission.conversation_id,
+      submission.thread_id,
       submissionId,
     );
+
     return yield* decodeAbortIntent({
       submissionId: row.submission_id,
       author: row.author,
@@ -892,30 +1001,73 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
   const admit: SubmissionLedger["Service"]["admit"] = Effect.fn("SqliteSubmissionLedger.admit")(
     function* (request: AdmissionRequest) {
       const operation = "ledger admit";
-      const validated = yield* Schema.decodeUnknownEffect(Schema.toType(AdmissionRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(AdmissionRequest))(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
+
       const inputJson = yield* encodePersistedJsonText(validated.inputPayload).pipe(
         Effect.mapError(internalFailure(operation)),
       );
+
+      const workerAdmissionJson =
+        validated.workerAdmission === undefined
+          ? null
+          : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(
+              validated.workerAdmission,
+            ).pipe(Effect.mapError(internalFailure(operation)));
+
+      if (
+        workerAdmissionJson !== null &&
+        new TextEncoder().encode(workerAdmissionJson).byteLength > 16 * 1024 * 1024
+      ) {
+        return yield* LedgerError.make({
+          operation,
+          message: "Worker admission metadata exceeds the stored value bound",
+        });
+      }
+
+      const messageAdmissionJson =
+        validated.messageAdmission === undefined
+          ? null
+          : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(
+              validated.messageAdmission,
+            ).pipe(Effect.mapError(internalFailure(operation)));
+
+      if (
+        messageAdmissionJson !== null &&
+        new TextEncoder().encode(messageAdmissionJson).byteLength > 16 * 1024 * 1024
+      ) {
+        return yield* LedgerError.make({
+          operation,
+          message: "Message admission metadata exceeds the stored value bound",
+        });
+      }
+
       const agentDigestsJson = yield* encodeDefinitionDigestsText(validated.agentDigests).pipe(
         Effect.mapError(internalFailure(operation)),
       );
+
       const mintedSubmissionId = yield* mintIdentifier("submission", operation);
       const mintedReceiptId = yield* mintIdentifier("receipt", operation);
+
       yield* hitFailpoint("ledger:admit:before", operation);
+
       const result = yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
-          const keyRowKey = `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`;
+          const keyRowKey = `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`;
+
           const existingRows = yield* sql<Record<string, unknown>>`
             SELECT ${sql.literal(SUBMISSION_COLUMNS)}
             FROM effect_agent_submissions
-            WHERE conversation_id = ${validated.conversationId}
+            WHERE thread_id = ${validated.threadId}
               AND principal = ${validated.principal}
               AND idempotency_key = ${validated.idempotencyKey}
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const existing = yield* decodeSubmissionRows(operation, keyRowKey, existingRows);
+
           if (existing.length > 1) {
             return yield* corruptionFailure(
               operation,
@@ -933,15 +1085,61 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
                   existing[0].parent_tool_call_id === null
                 : existing[0].parent_submission_id === validated.parentLinkage.parentSubmissionId &&
                   existing[0].parent_tool_call_id === validated.parentLinkage.parentToolCallId;
+
             if (existing[0].input_digest !== validated.inputDigest || !sameLinkage) {
               return yield* AdmissionConflict.make({
-                conversationId: validated.conversationId,
+                threadId: validated.threadId,
                 principal: validated.principal,
                 idempotencyKey: validated.idempotencyKey,
                 existingInputDigest: existing[0].input_digest,
                 attemptedInputDigest: validated.inputDigest,
               });
             }
+
+            const retainedWorkerAdmission =
+              existing[0].worker_admission_json === null
+                ? undefined
+                : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(
+                    existing[0].worker_admission_json,
+                  ).pipe(Effect.mapError(internalFailure(operation)));
+
+            const retainedInputMessage =
+              existing[0].message_admission_json === null
+                ? undefined
+                : yield* Schema.decodeEffect(Schema.fromJsonString(InputMessage))(
+                    existing[0].message_admission_json,
+                  ).pipe(Effect.mapError(internalFailure(operation)));
+
+            const retainedFence =
+              existing[0].admission_fence_json === null
+                ? undefined
+                : yield* Schema.decodeEffect(Schema.fromJsonString(AdmissionFence))(
+                    existing[0].admission_fence_json,
+                  ).pipe(Effect.mapError(internalFailure(operation)));
+
+            if (
+              (existing[0].admission_group ?? undefined) !== validated.admissionGroup ||
+              !Schema.toEquivalence(Schema.optional(WorkerAdmission))(
+                retainedWorkerAdmission,
+                validated.workerAdmission,
+              ) ||
+              !Schema.toEquivalence(Schema.optional(InputMessage))(
+                retainedInputMessage,
+                validated.messageAdmission,
+              ) ||
+              !Schema.toEquivalence(Schema.optional(AdmissionFence))(
+                retainedFence,
+                validated.admissionFence,
+              )
+            )
+              return yield* AdmissionConflict.make({
+                threadId: validated.threadId,
+                principal: validated.principal,
+                idempotencyKey: validated.idempotencyKey,
+                existingInputDigest: existing[0].input_digest,
+                attemptedInputDigest: validated.inputDigest,
+              });
+
             return yield* decodeAdmissionResult({
               submissionId: existing[0].submission_id,
               receiptId: existing[0].receipt_id,
@@ -951,26 +1149,86 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             }).pipe(Effect.mapError(internalFailure(operation)));
           }
 
+          const stopped =
+            yield* sql`SELECT thread_id FROM effect_agent_worker_stops WHERE thread_id = ${validated.threadId}`.pipe(
+              Effect.mapError(sqlFailure(operation)),
+            );
+
+          if (stopped.length > 0)
+            return yield* AdmissionPolicyError.make({ reason: "refused", code: "worker-stopped" });
+
+          // The first accepted input fixes ordinary/worker lane identity atomically with admission.
+          // Canonical origin materialization can lag admission; a log scan cannot fence that race.
+          const firstRows = yield* sql<Record<string, unknown>>`
+            SELECT worker_admission_json FROM effect_agent_submissions
+            WHERE thread_id=${validated.threadId} ORDER BY queue_sequence LIMIT 1
+          `.pipe(Effect.mapError(sqlFailure(operation)));
+
+          const first = yield* Schema.decodeUnknownEffect(
+            Schema.Array(
+              Schema.Struct({
+                worker_admission_json: Schema.NullOr(BoundedStoredText),
+              }),
+            ),
+          )(firstRows).pipe(Effect.mapError(internalFailure(operation)));
+
+          if (first[0] !== undefined) {
+            const previous =
+              first[0].worker_admission_json === null
+                ? undefined
+                : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(
+                    first[0].worker_admission_json,
+                  ).pipe(Effect.mapError(internalFailure(operation)));
+
+            if (
+              !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
+                previous?.origin,
+                validated.workerAdmission?.origin,
+              )
+            )
+              return yield* AdmissionPolicyError.make({
+                reason: "refused",
+                code: "worker-origin-conflict",
+              });
+          }
+
+          yield* admissionFence.check(validated);
+          if (validated.admissionGroup !== undefined) {
+            const occupied = yield* sql<Record<string, unknown>>`
+              SELECT submission_id FROM effect_agent_submissions
+              WHERE thread_id=${validated.threadId} AND admission_group=${validated.admissionGroup} AND state<>'settled' LIMIT 1
+            `.pipe(Effect.mapError(sqlFailure(operation)));
+
+            if (occupied.length > 0)
+              return yield* AdmissionPolicyError.make({
+                reason: "occupied",
+                code: "admission-group",
+              });
+          }
+
           const maxRows = yield* sql<Record<string, unknown>>`
             SELECT COALESCE(MAX(queue_sequence), 0) AS max_queue_sequence
             FROM effect_agent_submissions
-            WHERE conversation_id = ${validated.conversationId}
+            WHERE thread_id = ${validated.threadId}
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const decodedMax = yield* decodeRows(
             Schema.Array(MaxQueueSequenceRow),
             "effect_agent_submissions",
-            validated.conversationId,
+            validated.threadId,
             maxRows,
           ).pipe(Effect.mapError(internalFailure(operation)));
+
           const queueSequence = yield* decodeQueueSequence(
             (decodedMax[0]?.max_queue_sequence ?? 0) + 1,
           ).pipe(Effect.mapError(internalFailure(operation)));
+
           const now = yield* currentInstant;
 
           yield* sql`
             INSERT INTO effect_agent_submissions (
               submission_id,
-              conversation_id,
+              thread_id,
               queue_sequence,
               principal,
               idempotency_key,
@@ -983,10 +1241,14 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               state,
               created_at,
               parent_submission_id,
-              parent_tool_call_id
+              parent_tool_call_id,
+              admission_group,
+              admission_fence_json,
+  worker_admission_json,
+  message_admission_json
             ) VALUES (
               ${mintedSubmissionId},
-              ${validated.conversationId},
+              ${validated.threadId},
               ${queueSequence},
               ${validated.principal},
               ${validated.idempotencyKey},
@@ -999,7 +1261,11 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               'admitted',
               ${now.iso},
               ${validated.parentLinkage?.parentSubmissionId ?? null},
-              ${validated.parentLinkage?.parentToolCallId ?? null}
+              ${validated.parentLinkage?.parentToolCallId ?? null},
+              ${validated.admissionGroup ?? null},
+              ${validated.admissionFence === undefined ? null : JSON.stringify(validated.admissionFence)},
+              ${workerAdmissionJson},
+              ${messageAdmissionJson}
             )
           `.pipe(Effect.mapError(sqlFailure(operation)));
 
@@ -1012,7 +1278,9 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           }).pipe(Effect.mapError(internalFailure(operation)));
         }),
       );
+
       yield* hitFailpoint("ledger:admit:after", operation);
+
       return result;
     },
   );
@@ -1021,16 +1289,20 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.markReady",
   )(function* (request: MarkReadyRequest) {
     const operation = "ledger mark ready";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(MarkReadyRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(MarkReadyRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:mark-ready:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state !== "admitted") return;
         const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_submissions
           SET state = 'ready', ready_at = ${now.iso}
@@ -1044,35 +1316,43 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
   const lookup: SubmissionLedger["Service"]["lookup"] = Effect.fn("SqliteSubmissionLedger.lookup")(
     function* (request: SubmissionLookup) {
       const operation = "ledger lookup";
-      const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SubmissionLookup))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookup))(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
+
       if (validated._tag === "SubmissionLookupById") {
         const row = yield* readSubmission(operation, validated.submissionId);
+
         if (Option.isNone(row)) return Option.none();
+
         return Option.some(yield* decodeSubmissionSnapshot(operation, row.value));
       }
+
       const rows = yield* sql<Record<string, unknown>>`
       SELECT ${sql.literal(SUBMISSION_COLUMNS)}
       FROM effect_agent_submissions
-      WHERE conversation_id = ${validated.conversationId}
+      WHERE thread_id = ${validated.threadId}
         AND principal = ${validated.principal}
         AND idempotency_key = ${validated.idempotencyKey}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
       const decoded = yield* decodeSubmissionRows(
         operation,
-        `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`,
+        `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
         rows,
       );
+
       if (decoded.length > 1) {
         return yield* corruptionFailure(
           operation,
           "effect_agent_submissions",
-          `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`,
+          `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
           "An admission idempotency key returned more than one row.",
         );
       }
       if (decoded.length === 0) return Option.none();
+
       return Option.some(yield* decodeSubmissionSnapshot(operation, decoded[0]));
     },
   );
@@ -1084,30 +1364,35 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.resolveAdmission",
   )(function* (request: SubmissionLookupByKey) {
     const operation = "ledger resolve admission";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SubmissionLookupByKey))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookupByKey))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     const rows = yield* sql<Record<string, unknown>>`
       SELECT ${sql.literal(SUBMISSION_COLUMNS)}
       FROM effect_agent_submissions
-      WHERE conversation_id = ${validated.conversationId}
+      WHERE thread_id = ${validated.threadId}
         AND principal = ${validated.principal}
         AND idempotency_key = ${validated.idempotencyKey}
     `.pipe(Effect.mapError(sqlFailure(operation)));
+
     const decoded = yield* decodeSubmissionRows(
       operation,
-      `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`,
+      `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
       rows,
     );
+
     if (decoded.length > 1) {
       return yield* corruptionFailure(
         operation,
         "effect_agent_submissions",
-        `${validated.conversationId}/${validated.principal}/${validated.idempotencyKey}`,
+        `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
         "An admission idempotency key returned more than one row.",
       );
     }
     if (decoded.length === 0) return AdmissionNotAdmitted.make();
+
     return AdmissionAdmitted.make({
       submission: yield* decodeSubmissionSnapshot(operation, decoded[0]),
     });
@@ -1116,70 +1401,103 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
   const claim: SubmissionLedger["Service"]["claim"] = Effect.fn("SqliteSubmissionLedger.claim")(
     function* (request: ClaimRequest) {
       const operation = "ledger claim";
-      const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ClaimRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(ClaimRequest))(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
+
       const attemptId = yield* mintIdentifier("attempt", operation);
       const ownershipToken = yield* mintIdentifier("owner", operation);
+
       yield* hitFailpoint("ledger:claim:before", operation);
+
       const claimed = yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
+          const now = yield* currentInstant;
+
+          // Ownership belongs to the whole Thread, including unknown work skipped below.
+          // Stored lease instants are normalized UTC strings, so the latest expiry covers
+          // every live lease. This check and the epoch grant share one write transaction.
+          const ownershipRows = yield* sql<Record<string, unknown>>`
+            SELECT ownership.*
+            FROM effect_agent_submission_ownership AS ownership
+            JOIN effect_agent_submissions AS submission
+              ON submission.submission_id = ownership.submission_id
+            WHERE submission.thread_id = ${validated.threadId}
+            ORDER BY ownership.lease_expires_at DESC
+            LIMIT 1
+          `.pipe(Effect.mapError(sqlFailure(operation)));
+
+          const ownership = yield* decodeRows(
+            Schema.Array(OwnershipRow),
+            "effect_agent_submission_ownership",
+            validated.threadId,
+            ownershipRows,
+          ).pipe(Effect.mapError(internalFailure(operation)));
+
+          if (ownership.length > 0) {
+            const expiresAt = yield* timestampMillis(
+              operation,
+              ownership[0].submission_id,
+            )(ownership[0].lease_expires_at);
+
+            if (expiresAt > now.millis) return Option.none<Claim>();
+          }
+
           const headRows = yield* sql<Record<string, unknown>>`
             SELECT ${sql.literal(SUBMISSION_COLUMNS)}
             FROM effect_agent_submissions
-            WHERE conversation_id = ${validated.conversationId}
+            WHERE thread_id = ${validated.threadId}
               AND state <> 'settled'
+              AND (
+                state <> 'unknown' OR EXISTS (
+                  SELECT 1 FROM effect_agent_abort_intents
+                  WHERE submission_id = effect_agent_submissions.submission_id
+                )
+              )
             ORDER BY queue_sequence ASC
             LIMIT 1
           `.pipe(Effect.mapError(sqlFailure(operation)));
-          const heads = yield* decodeSubmissionRows(operation, validated.conversationId, headRows);
+
+          const heads = yield* decodeSubmissionRows(operation, validated.threadId, headRows);
+
           if (heads.length === 0) return Option.none<Claim>();
           const head = heads[0];
 
-          // A joining/joined head is host-owned and a suspended/unknown head is durably
-          // blocked (DUR-017); the lane produces no claim and later ready work is never
-          // skipped past the blocked head (DUR-004).
+          // Approval/delegation suspension and joined work retain their queue barrier.
+          // Unknown work with an abort intent is selected for cleanup without Tool replay.
           if (
             head.state === "joining" ||
             head.state === "joined" ||
             head.state === "suspended" ||
-            head.state === "unknown"
+            (head.state === "unknown" &&
+              Option.isNone(yield* readAbortIntent(operation, head.submission_id)))
           ) {
             return Option.none<Claim>();
           }
 
-          const now = yield* currentInstant;
-          const ownership = yield* readOwnership(operation, head.submission_id);
-          if (Option.isSome(ownership)) {
-            const expiresAt = yield* timestampMillis(
-              operation,
-              head.submission_id,
-            )(ownership.value.lease_expires_at);
-            // A live lease blocks every new claim; expiry alone only revokes the liveness
-            // assumption — correctness stays with producer-epoch fencing (D5).
-            if (expiresAt > now.millis) return Option.none<Claim>();
-          }
-
-          // Bump the Conversation's producer epoch atomically with the claim so every stale
-          // Attempt is fenced out of canonical appends (DUR-006). A Conversation that was
+          // Bump the Thread's producer epoch atomically with the claim so every stale
+          // Attempt is fenced out of canonical appends (DUR-006). A Thread that was
           // never materialized (crash between admission and materialization) is created here
           // so recovery can claim first and re-materialize idempotently at this epoch.
-          const conversations = yield* journal
-            .getConversation(head.conversation_id)
+          const threads = yield* journal
+            .getThread(head.thread_id)
             .pipe(Effect.mapError(internalFailure(operation)));
+
           let producerEpoch: number;
-          if (conversations.length === 0) {
+
+          if (threads.length === 0) {
             producerEpoch = 1;
             yield* sql`
-              INSERT INTO effect_agent_conversations (
-                conversation_id,
+              INSERT INTO effect_agent_threads (
+                thread_id,
                 created_at,
                 tail_sequence,
                 tail_digest,
                 producer_epoch
               ) VALUES (
-                ${head.conversation_id},
+                ${head.thread_id},
                 ${now.iso},
                 0,
                 ${EMPTY_TAIL_DIGEST},
@@ -1187,15 +1505,16 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               )
             `.pipe(Effect.mapError(sqlFailure(operation)));
           } else {
-            producerEpoch = conversations[0].producer_epoch + 1;
+            producerEpoch = threads[0].producer_epoch + 1;
             yield* sql`
-              UPDATE effect_agent_conversations
+              UPDATE effect_agent_threads
               SET producer_epoch = ${producerEpoch}
-              WHERE conversation_id = ${head.conversation_id}
+              WHERE thread_id = ${head.thread_id}
             `.pipe(Effect.mapError(sqlFailure(operation)));
           }
 
           const leaseExpiresAt = new Date(now.millis + config.ownershipLeaseDuration).toISOString();
+
           yield* sql`
             INSERT INTO effect_agent_submission_ownership (
               submission_id,
@@ -1224,14 +1543,14 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             INSERT INTO effect_agent_attempts (
               attempt_id,
               submission_id,
-              conversation_id,
+              thread_id,
               owner_producer_id,
               producer_epoch,
               claimed_at
             ) VALUES (
               ${attemptId},
               ${head.submission_id},
-              ${head.conversation_id},
+              ${head.thread_id},
               ${validated.producerId},
               ${producerEpoch},
               ${now.iso}
@@ -1256,6 +1575,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               ),
             ),
           );
+
           return Option.some(
             yield* decodeClaim({
               submissionId: head.submission_id,
@@ -1268,7 +1588,9 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           );
         }),
       );
+
       yield* hitFailpoint("ledger:claim:after", operation);
+
       return claimed;
     },
   );
@@ -1277,29 +1599,37 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.renewOwnership",
   )(function* (request: RenewOwnershipRequest) {
     const operation = "ledger renew ownership";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(RenewOwnershipRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(RenewOwnershipRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:renew:before", operation);
+
     const renewal = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         yield* requireOwnership(operation, submission, validated.ownershipToken);
         const now = yield* currentInstant;
         const leaseExpiresAt = new Date(now.millis + config.ownershipLeaseDuration).toISOString();
+
         yield* sql`
           UPDATE effect_agent_submission_ownership
           SET lease_expires_at = ${leaseExpiresAt}
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
+
         return yield* decodeOwnershipRenewal({
           ownershipToken: validated.ownershipToken,
           leaseExpiresAt,
         }).pipe(Effect.mapError(internalFailure(operation)));
       }),
     );
+
     yield* hitFailpoint("ledger:renew:after", operation);
+
     return renewal;
   });
 
@@ -1307,14 +1637,17 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.releaseOwnership",
   )(function* (request: ReleaseOwnershipRequest) {
     const operation = "ledger release ownership";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ReleaseOwnershipRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseOwnershipRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:release:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         yield* requireOwnership(operation, submission, validated.ownershipToken);
         yield* sql`
           DELETE FROM effect_agent_submission_ownership
@@ -1336,14 +1669,17 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.markInputApplied",
   )(function* (request: MarkInputAppliedRequest) {
     const operation = "ledger mark input applied";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(MarkInputAppliedRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(MarkInputAppliedRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:mark-input-applied:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         yield* requireOwnership(operation, submission, validated.ownershipToken);
         if (submission.input_applied_record_id !== null) {
           if (
@@ -1352,6 +1688,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           ) {
             return;
           }
+
           return yield* corruptionFailure(
             operation,
             "effect_agent_submissions",
@@ -1379,29 +1716,36 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.reserveSettlement",
   )(function* (request: SettlementReservation) {
     const operation = "ledger reserve settlement";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SettlementReservation))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(SettlementReservation))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     const recordJson = yield* encodeRecordEnvelopeText(validated.record).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:reserve-settlement:before", operation);
+
     const reserved = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const existing = yield* readReservation(operation, validated.submissionId);
+
         if (Option.isSome(existing)) {
           const identical =
             existing.value.settlement_id === validated.settlementId &&
             existing.value.outcome === validated.outcome &&
             existing.value.record_digest === validated.recordDigest &&
             existing.value.record_json === recordJson;
+
           if (!identical) {
             return yield* SettlementConflict.make({
               submissionId: validated.submissionId,
               existingOutcome: existing.value.outcome,
             });
           }
+
           const record = yield* decodeRecordEnvelopeText(existing.value.record_json).pipe(
             Effect.mapError((error) =>
               corruptionFailure(
@@ -1412,6 +1756,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               ),
             ),
           );
+
           return ReservedSettlement.make({
             submissionId: validated.submissionId,
             settlementId: validated.settlementId,
@@ -1423,6 +1768,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         }
 
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -1432,6 +1778,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -1446,13 +1793,16 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           // ABORTED settlement (`terminalizing` is the same pass's crash replay). Every other
           // reservation stays fenced by the target lane's live ownership.
           let queuedAbortSettlement = false;
+
           if (
             validated.outcome === "aborted" &&
             (submission.state === "ready" || submission.state === "terminalizing")
           ) {
             const abortIntent = yield* readAbortIntent(operation, validated.submissionId);
+
             if (Option.isSome(abortIntent)) {
               const ownership = yield* readOwnership(operation, validated.submissionId);
+
               queuedAbortSettlement = Option.isNone(ownership);
             }
           }
@@ -1461,6 +1811,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           }
         }
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_settlement_reservations (
             submission_id,
@@ -1485,6 +1836,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           SET state = 'terminalizing'
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
+
         return ReservedSettlement.make({
           submissionId: validated.submissionId,
           settlementId: validated.settlementId,
@@ -1495,56 +1847,197 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         });
       }),
     );
+
     yield* hitFailpoint("ledger:reserve-settlement:after", operation);
+
     return reserved;
   });
 
-  const finalizeSettlement: SubmissionLedger["Service"]["finalizeSettlement"] = Effect.fn(
-    "SqliteSubmissionLedger.finalizeSettlement",
-  )(function* (request: SettlementFinalization) {
+  const validateFinalization = Effect.fn("SqliteSubmissionLedger.validateFinalization")(function* (
+    validated: SettlementFinalization,
+    reservation: Option.Option<ReservationRow>,
+  ) {
     const operation = "ledger finalize settlement";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SettlementFinalization))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
-    yield* hitFailpoint("ledger:finalize-settlement:before", operation);
-    const settlement = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const reservation = yield* readReservation(operation, validated.submissionId);
-        if (Option.isNone(reservation)) {
-          return yield* LedgerError.make({
-            operation,
-            message: `No settlement reservation exists for submission ${validated.submissionId}.`,
-          });
-        }
-        if (reservation.value.settlement_id !== validated.settlementId) {
-          return yield* SettlementConflict.make({
-            submissionId: validated.submissionId,
-            existingOutcome: reservation.value.outcome,
-          });
-        }
-        const submission = yield* requireSubmission(operation, validated.submissionId);
-        if (submission.state === "settled") {
-          if (reservation.value.finalized_at === null) {
-            return yield* corruptionFailure(
-              operation,
-              "effect_agent_settlement_reservations",
-              validated.submissionId,
-              "A settled Submission's reservation carries no finalization timestamp.",
+
+    if (Option.isNone(reservation)) {
+      return yield* LedgerError.make({
+        operation,
+        message: `No settlement reservation exists for submission ${validated.submissionId}.`,
+      });
+    }
+    if (reservation.value.settlement_id !== validated.settlementId) {
+      return yield* SettlementConflict.make({
+        submissionId: validated.submissionId,
+        existingOutcome: reservation.value.outcome,
+      });
+    }
+
+    const reservationRecord = yield* decodeRecordEnvelopeText(reservation.value.record_json).pipe(
+      Effect.mapError((error) =>
+        corruptionFailure(
+          operation,
+          "effect_agent_settlement_reservations",
+          validated.submissionId,
+          error.message,
+        ),
+      ),
+    );
+
+    const settlementFailure = settlementFailureFromRecord(reservationRecord);
+
+    if ((reservation.value.outcome === "failed") !== (settlementFailure !== undefined)) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_settlement_reservations",
+        validated.submissionId,
+        "The reserved outcome and canonical failure diagnostic disagree.",
+      );
+    }
+
+    return { reservation: reservation.value, reservationRecord, settlementFailure };
+  });
+
+  const replayFinalization = Effect.fn("SqliteSubmissionLedger.replayFinalization")(function* (
+    validated: SettlementFinalization,
+    submission: SubmissionRow,
+    { reservation, settlementFailure }: Effect.Success<ReturnType<typeof validateFinalization>>,
+  ) {
+    const operation = "ledger finalize settlement";
+
+    if (reservation.finalized_at === null) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_settlement_reservations",
+        validated.submissionId,
+        "A settled Submission's reservation carries no finalization timestamp.",
+      );
+    }
+
+    return yield* decodeSettlement({
+      submissionId: validated.submissionId,
+      settlementId: validated.settlementId,
+      receiptId: submission.receipt_id,
+      outcome: reservation.outcome,
+      ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
+      settledAt: reservation.finalized_at,
+    }).pipe(Effect.mapError(internalFailure(operation)));
+  });
+
+  const finalizeSettlement: SubmissionLedger["Service"]["finalizeSettlement"] = Effect.fn(
+    "SqliteSubmissionLedger.finalizeSettlement",
+  )(function* (request: SettlementFinalization) {
+    const operation = "ledger finalize settlement";
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(SettlementFinalization))(
+      request,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    yield* hitFailpoint("ledger:finalize-settlement:before", operation);
+
+    // A single statement captures the settled row and its immutable reservation together.
+    // A miss does not authorize finalization: the write path re-reads under its transaction.
+    const replayRows = yield* sql<Record<string, unknown>>`
+      SELECT submission.*, reservation.settlement_id, reservation.outcome,
+        reservation.record_id, reservation.record_json, reservation.record_digest,
+        reservation.reserved_at, reservation.finalized_at
+      FROM effect_agent_submissions AS submission
+      INNER JOIN effect_agent_settlement_reservations AS reservation
+        ON reservation.submission_id = submission.submission_id
+      WHERE submission.submission_id = ${validated.submissionId} AND submission.state = 'settled'
+    `.pipe(Effect.mapError(sqlFailure(operation)));
+
+    if (replayRows.length > 1) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_submissions",
+        validated.submissionId,
+        "A submission primary key returned more than one row.",
+      );
+    }
+    const replayRow = replayRows[0];
+
+    if (replayRow !== undefined) {
+      const reservations = yield* decodeRows(
+        Schema.Array(ReservationRow),
+        "effect_agent_settlement_reservations",
+        validated.submissionId,
+        replayRows,
+      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const state = yield* validateFinalization(validated, Option.fromUndefinedOr(reservations[0]));
+
+      const submission = yield* Schema.decodeUnknownEffect(SubmissionRow)(replayRow).pipe(
+        Effect.mapError((error) =>
+          corruptionFailure(
+            operation,
+            "effect_agent_submissions",
+            validated.submissionId,
+            error.message,
+          ),
+        ),
+      );
+
+      const settlement = yield* replayFinalization(validated, submission, state);
+
+      yield* hitFailpoint("ledger:finalize-settlement:after", operation);
+
+      return settlement;
+    }
+
+    const settlement = yield* inWriteTransaction(
+      operation,
+      Effect.gen(function* () {
+        const state = yield* validateFinalization(
+          validated,
+          yield* readReservation(operation, validated.submissionId),
+        );
+
+        const { reservation, reservationRecord, settlementFailure } = state;
+        const submission = yield* requireSubmission(operation, validated.submissionId);
+
+        if (submission.state === "settled")
+          return yield* replayFinalization(validated, submission, state);
+        const now = yield* currentInstant;
+
+        const terminal =
+          submission.worker_admission_json === null
+            ? undefined
+            : workerTerminalFromRecord(
+                yield* decodeSubmissionSnapshot(operation, submission),
+                reservationRecord,
+              );
+
+        if (terminal !== undefined) {
+          // Admission and finalization serialize here. An accepted correction that this Run
+          // has not applied vetoes its completion, including admission after RunCompleted.
+          const pending =
+            terminal === "completed"
+              ? yield* sql`SELECT submission_id FROM effect_agent_submissions
+                WHERE thread_id = ${submission.thread_id} AND queue_sequence > ${submission.queue_sequence}
+                AND queue_sequence = (SELECT MAX(queue_sequence) FROM effect_agent_submissions WHERE thread_id = ${submission.thread_id})
+                AND (joined_host_submission_id IS NULL OR joined_host_submission_id <> ${submission.submission_id}
+                  OR input_applied_record_id IS NULL) LIMIT 1`.pipe(
+                  Effect.mapError(sqlFailure(operation)),
+                )
+              : [];
+
+          if (pending.length === 0) {
+            yield* sql`INSERT OR IGNORE INTO effect_agent_worker_stops (thread_id, terminal)
+              VALUES (${submission.thread_id}, ${terminal})`.pipe(
+              Effect.mapError(sqlFailure(operation)),
             );
+            yield* sql`INSERT OR IGNORE INTO effect_agent_abort_intents (submission_id, author, reason, requested_at)
+              SELECT submission_id, ${submission.principal}, ${`Worker assignment ${terminal}`}, ${now.iso}
+              FROM effect_agent_submissions WHERE thread_id = ${submission.thread_id} AND state <> 'settled'
+              AND submission_id <> ${submission.submission_id}
+              AND (joined_host_submission_id IS NULL OR joined_host_submission_id <> ${submission.submission_id}
+                OR input_applied_record_id IS NULL)`.pipe(Effect.mapError(sqlFailure(operation)));
           }
-          return yield* decodeSettlement({
-            submissionId: validated.submissionId,
-            settlementId: validated.settlementId,
-            receiptId: submission.receipt_id,
-            outcome: reservation.value.outcome,
-            settledAt: reservation.value.finalized_at,
-          }).pipe(Effect.mapError(internalFailure(operation)));
         }
-        const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_submissions
-          SET state = 'settled', settled_outcome = ${reservation.value.outcome}
+          SET state = 'settled', settled_outcome = ${reservation.outcome}
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
         yield* sql`
@@ -1556,31 +2049,117 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           DELETE FROM effect_agent_submission_ownership
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
+
         return yield* decodeSettlement({
           submissionId: validated.submissionId,
           settlementId: validated.settlementId,
           receiptId: submission.receipt_id,
-          outcome: reservation.value.outcome,
+          outcome: reservation.outcome,
+          ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
           settledAt: now.iso,
         }).pipe(Effect.mapError(internalFailure(operation)));
       }),
     );
+
     yield* hitFailpoint("ledger:finalize-settlement:after", operation);
+
     return settlement;
   });
 
+  const inspectWorker = Effect.fn("SqliteSubmissionLedger.inspectWorker")(function* (
+    threadId: SubmissionSnapshot["threadId"],
+  ) {
+    const operation = "inspect worker";
+
+    return yield* sql
+      .withTransaction(
+        Effect.gen(function* () {
+          const read = Effect.fnUntraced(function* (active: boolean) {
+            const rows =
+              yield* sql`SELECT ${sql.literal(SUBMISSION_COLUMNS)} FROM effect_agent_submissions
+          WHERE thread_id = ${threadId} ${active ? sql`AND state <> 'settled'` : sql``}
+          ORDER BY queue_sequence ${active ? sql`ASC` : sql`DESC`} LIMIT 1`.pipe(
+                Effect.mapError(sqlFailure(operation)),
+              );
+
+            const decoded = yield* decodeSubmissionRows(operation, threadId, rows);
+
+            return decoded[0] === undefined
+              ? null
+              : yield* decodeSubmissionSnapshot(operation, decoded[0]);
+          });
+
+          const latest = yield* read(false);
+          const active = yield* read(true);
+
+          const stops =
+            yield* sql`SELECT terminal FROM effect_agent_worker_stops WHERE thread_id = ${threadId}`.pipe(
+              Effect.mapError(sqlFailure(operation)),
+            );
+
+          return yield* Schema.decodeUnknownEffect(Schema.toType(WorkerLedgerState))({
+            latest,
+            active,
+            stopped: stops.length > 0,
+            ...(stops[0] === undefined || stops[0].terminal === null
+              ? {}
+              : { terminal: stops[0].terminal }),
+          }).pipe(Effect.mapError(internalFailure(operation)));
+        }),
+      )
+      .pipe(Effect.catchTag("SqlError", (cause) => sqlFailure(operation)(cause)));
+  });
+
+  const stopWorker = Effect.fn("SqliteSubmissionLedger.stopWorker")(function* (
+    request: WorkerStopCommand,
+  ) {
+    const operation = "ledger stop worker";
+
+    const validated = yield* Schema.decodeEffect(WorkerStopCommand)(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
+    return yield* inWriteTransaction(
+      operation,
+      Effect.gen(function* () {
+        const now = yield* currentInstant;
+
+        yield* sql`INSERT OR IGNORE INTO effect_agent_worker_stops (thread_id) VALUES (${validated.threadId})`.pipe(
+          Effect.mapError(sqlFailure(operation)),
+        );
+        yield* sql`INSERT OR IGNORE INTO effect_agent_abort_intents (submission_id, author, reason, requested_at)
+        SELECT submission_id, ${validated.author}, 'Worker owner stopped the worker', ${now.iso}
+        FROM effect_agent_submissions WHERE thread_id = ${validated.threadId} AND state <> 'settled'`.pipe(
+          Effect.mapError(sqlFailure(operation)),
+        );
+
+        const rows = yield* sql`SELECT o.submission_id FROM effect_agent_submission_ownership o
+        JOIN effect_agent_submissions s ON s.submission_id = o.submission_id
+        WHERE s.thread_id = ${validated.threadId} AND s.state <> 'settled'`.pipe(
+          Effect.mapError(sqlFailure(operation)),
+        );
+
+        return rows.length;
+      }),
+    );
+  });
+
   const requestAbort: SubmissionLedger["Service"]["requestAbort"] = Effect.fn(
     "SqliteSubmissionLedger.requestAbort",
   )(function* (request: AbortCommand) {
     const operation = "ledger request abort";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(AbortCommand))(request).pipe(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(AbortCommand))(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:request-abort:before", operation);
+
     const intent = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -1590,6 +2169,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -1607,15 +2187,18 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               "A joined Submission carries no host linkage.",
             );
           }
+
           const hostSubmissionId = yield* decodeSubmissionId(
             submission.joined_host_submission_id,
           ).pipe(Effect.mapError(internalFailure(operation)));
+
           return yield* JoinedToHost.make({
             submissionId: validated.submissionId,
             hostSubmissionId,
           });
         }
         const existing = yield* readAbortIntent(operation, validated.submissionId);
+
         if (Option.isSome(existing)) {
           return yield* abortIntentFromRow(
             operation,
@@ -1625,6 +2208,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           );
         }
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_abort_intents (
             submission_id,
@@ -1638,11 +2222,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             ${now.iso}
           )
         `.pipe(Effect.mapError(sqlFailure(operation)));
+
         const canonicalRecordId = yield* canonicalAbortRecordId(
           operation,
-          submission.conversation_id,
+          submission.thread_id,
           validated.submissionId,
         );
+
         return yield* decodeAbortIntent({
           submissionId: validated.submissionId,
           author: validated.author,
@@ -1652,7 +2238,9 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         }).pipe(Effect.mapError(internalFailure(operation)));
       }),
     );
+
     yield* hitFailpoint("ledger:request-abort:after", operation);
+
     return intent;
   });
 
@@ -1660,31 +2248,45 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.claimJoining",
   )(function* (request: ClaimJoiningRequest) {
     const operation = "ledger claim joining";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ClaimJoiningRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ClaimJoiningRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:claim-joining:before", operation);
+
     const claims = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const host = yield* requireSubmission(operation, validated.hostSubmissionId);
-        if (host.conversation_id !== validated.conversationId) {
+
+        if (host.thread_id !== validated.threadId) {
           return yield* LedgerError.make({
             operation,
-            message: `Host submission ${validated.hostSubmissionId} does not belong to conversation ${validated.conversationId}.`,
+            message: `Host submission ${validated.hostSubmissionId} does not belong to thread ${validated.threadId}.`,
           });
         }
         // The host Attempt already owns the lane; no epoch bump happens here (plan §2.5).
         yield* requireOwnership(operation, host, validated.ownershipToken);
+
+        const stopped =
+          yield* sql`SELECT thread_id FROM effect_agent_worker_stops WHERE thread_id = ${validated.threadId}`.pipe(
+            Effect.mapError(sqlFailure(operation)),
+          );
+
+        if (stopped.length > 0) return [];
+
         const laterRows = yield* sql<Record<string, unknown>>`
           SELECT ${sql.literal(SUBMISSION_COLUMNS)}
           FROM effect_agent_submissions
-          WHERE conversation_id = ${validated.conversationId}
+          WHERE thread_id = ${validated.threadId}
             AND queue_sequence > ${host.queue_sequence}
           ORDER BY queue_sequence ASC
         `.pipe(Effect.mapError(sqlFailure(operation)));
-        const later = yield* decodeSubmissionRows(operation, validated.conversationId, laterRows);
+
+        const later = yield* decodeSubmissionRows(operation, validated.threadId, laterRows);
         const claimed: Array<JoiningClaim> = [];
+
         for (const row of later) {
           if (claimed.length >= validated.maxCount) break;
           // Rows already claimed by THIS host extend its contiguous prefix and are skipped;
@@ -1707,6 +2309,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             SET state = 'joining', joined_host_submission_id = ${validated.hostSubmissionId}
             WHERE submission_id = ${row.submission_id}
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
             Effect.mapError((error) =>
               corruptionFailure(
@@ -1717,6 +2320,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               ),
             ),
           );
+
           claimed.push(
             yield* decodeJoiningClaim({
               submissionId: row.submission_id,
@@ -1725,10 +2329,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             }).pipe(Effect.mapError(internalFailure(operation))),
           );
         }
-        return claimed as ReadonlyArray<JoiningClaim>;
+
+        return claimed;
       }),
     );
+
     yield* hitFailpoint("ledger:claim-joining:after", operation);
+
     return claims;
   });
 
@@ -1736,14 +2343,17 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.markJoined",
   )(function* (request: MarkJoinedRequest) {
     const operation = "ledger mark joined";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(MarkJoinedRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(MarkJoinedRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:mark-joined:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.joined_host_submission_id === null) {
           return yield* LedgerError.make({
             operation,
@@ -1751,6 +2361,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           });
         }
         const host = yield* requireSubmission(operation, submission.joined_host_submission_id);
+
         // The lane is host-owned: the presented token must own the HOST's ownership period,
         // which also lets a later host Attempt repair a lost marker from history (DUR-016).
         yield* requireOwnership(operation, host, validated.ownershipToken);
@@ -1761,6 +2372,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           ) {
             return;
           }
+
           return yield* corruptionFailure(
             operation,
             "effect_agent_submissions",
@@ -1791,14 +2403,17 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.revertJoining",
   )(function* (request: RevertJoiningRequest) {
     const operation = "ledger revert joining";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(RevertJoiningRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(RevertJoiningRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:revert-joining:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         // Idempotent and recovery-only: only a still-`joining` Submission reverts; an
         // already-joined (or already-reverted) Submission is a no-op (DUR-016).
         if (submission.state !== "joining") return;
@@ -1816,17 +2431,22 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.suspend",
   )(function* (request: SuspendRequest) {
     const operation = "ledger suspend";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(SuspendRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(SuspendRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     const reasonJson = yield* encodeSuspensionReasonText(validated.reason).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:suspend:before", operation);
+
     const outcome = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -1836,6 +2456,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -1844,6 +2465,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         // An exact terminal outcome is already reserved (DUR-011); suspension would
         // contradict it, so the reservation wins.
         const reservation = yield* readReservation(operation, validated.submissionId);
+
         if (Option.isSome(reservation)) {
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
@@ -1857,23 +2479,27 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         if (validated.reason._tag === "ApprovalPending") {
           const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
           const decided = new Set(decisions.map((row) => row.tool_call_id));
+
           if (validated.reason.toolCallIds.every((toolCallId) => decided.has(toolCallId))) {
-            return "resume-immediately" as SuspensionOutcome;
+            return RESUME_IMMEDIATELY;
           }
         } else {
           let allSettled = true;
+
           for (const child of validated.reason.children) {
             const childRow = yield* readSubmission(operation, child.childSubmissionId);
+
             if (Option.isNone(childRow) || childRow.value.state !== "settled") {
               allSettled = false;
               break;
             }
           }
           if (allSettled) {
-            return "resume-immediately" as SuspensionOutcome;
+            return RESUME_IMMEDIATELY;
           }
         }
         const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_submissions
           SET
@@ -1888,10 +2514,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           DELETE FROM effect_agent_submission_ownership
           WHERE submission_id = ${validated.submissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
-        return "suspended" as SuspensionOutcome;
+
+        return SUSPENDED;
       }),
     );
+
     yield* hitFailpoint("ledger:suspend:after", operation);
+
     return outcome;
   });
 
@@ -1904,6 +2533,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
   const wakeSuspendedIfCovered = Effect.fn("SqliteSubmissionLedger.wakeSuspendedIfCovered")(
     function* (operation: string, submission: SubmissionRow): Effect.fn.Return<void, LedgerError> {
       if (submission.state !== "suspended" || submission.suspended_reason_json === null) return;
+
       const reason = yield* Schema.decodeEffect(Schema.fromJsonString(SuspensionReason))(
         submission.suspended_reason_json,
       ).pipe(
@@ -1916,9 +2546,11 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           ),
         ),
       );
+
       if (reason._tag !== "ApprovalPending") return;
       const decisions = yield* readApprovalDecisions(operation, submission.submission_id);
       const decided = new Set(decisions.map((row) => row.tool_call_id));
+
       if (!reason.toolCallIds.every((toolCallId) => decided.has(toolCallId))) return;
       yield* sql`
         UPDATE effect_agent_submissions
@@ -1935,14 +2567,18 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.recordApprovalDecision",
   )(function* (command: ApprovalDecisionCommand) {
     const operation = "ledger record approval decision";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ApprovalDecisionCommand))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ApprovalDecisionCommand))(
       command,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:approval-decision:before", operation);
+
     const intent = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -1952,6 +2588,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -1959,6 +2596,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         }
         const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
         const existing = decisions.find((row) => row.tool_call_id === validated.toolCallId);
+
         if (existing !== undefined) {
           // Idempotent per (submissionId, toolCallId): repeating the SAME decision replays
           // the recorded intent unchanged; a divergent re-decision conflicts.
@@ -1969,9 +2607,11 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               existingDecision: existing.decision,
             });
           }
+
           return yield* approvalIntentFromRow(operation, existing);
         }
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_approval_decisions (
             submission_id,
@@ -1990,6 +2630,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           )
         `.pipe(Effect.mapError(sqlFailure(operation)));
         yield* wakeSuspendedIfCovered(operation, submission);
+
         return yield* decodeApprovalDecisionIntent({
           submissionId: validated.submissionId,
           toolCallId: validated.toolCallId,
@@ -2000,7 +2641,9 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         }).pipe(Effect.mapError(internalFailure(operation)));
       }),
     );
+
     yield* hitFailpoint("ledger:approval-decision:after", operation);
+
     return intent;
   });
 
@@ -2008,14 +2651,17 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.markUnknown",
   )(function* (request: MarkUnknownRequest) {
     const operation = "ledger mark unknown";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(MarkUnknownRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(MarkUnknownRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
     yield* hitFailpoint("ledger:mark-unknown:before", operation);
     yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -2025,6 +2671,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -2033,6 +2680,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         // A reserved exact outcome wins over a late Unknown marking (DUR-011); the recovery
         // classifier orders reservation ahead of MarkUnknown for the same reason.
         const reservation = yield* readReservation(operation, validated.submissionId);
+
         if (Option.isSome(reservation)) {
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
@@ -2043,13 +2691,16 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         // set while the first recorded reason is kept.
         const existingIds = yield* storedUnknownToolCallIds(operation, submission);
         const known = new Set(existingIds);
+
         const merged = [
           ...existingIds,
           ...validated.toolCallIds.filter((toolCallId) => !known.has(toolCallId)),
         ];
+
         const idsJson = yield* encodeToolCallIdsText(merged).pipe(
           Effect.mapError(internalFailure(operation)),
         );
+
         yield* sql`
           UPDATE effect_agent_submissions
           SET
@@ -2067,17 +2718,22 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.recordUnknownResolution",
   )(function* (command: UnknownResolutionCommand) {
     const operation = "ledger record unknown resolution";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(UnknownResolutionCommand))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(UnknownResolutionCommand))(
       command,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     const resolutionJson = yield* encodeUnknownResolutionText(validated.resolution).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:unknown-resolution:before", operation);
+
     const intent = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const submission = yield* requireSubmission(operation, validated.submissionId);
+
         if (submission.state === "settled") {
           if (submission.settled_outcome === null) {
             return yield* corruptionFailure(
@@ -2087,6 +2743,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               "A settled Submission carries no terminal outcome.",
             );
           }
+
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
             existingOutcome: submission.settled_outcome,
@@ -2094,19 +2751,30 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
         }
         const resolutions = yield* readUnknownResolutions(operation, validated.submissionId);
         const existing = resolutions.find((row) => row.tool_call_id === validated.toolCallId);
-        if (existing !== undefined && existing.resolution_json !== resolutionJson) {
+
+        const existingIntent =
+          existing === undefined
+            ? undefined
+            : yield* unknownResolutionIntentFromRow(operation, existing);
+
+        if (
+          existingIntent !== undefined &&
+          !equivalentUnknownResolution(existingIntent.resolution, validated.resolution)
+        ) {
           return yield* UnknownResolutionConflict.make({
             submissionId: validated.submissionId,
             toolCallId: validated.toolCallId,
           });
         }
         let resolved: UnknownResolutionIntent;
-        if (existing !== undefined) {
+
+        if (existingIntent !== undefined) {
           // Idempotent replay of the recorded intent (author/reason may differ; the stored
           // audit fields win, exactly like requestAbort).
-          resolved = yield* unknownResolutionIntentFromRow(operation, existing);
+          resolved = existingIntent;
         } else {
           const now = yield* currentInstant;
+
           yield* sql`
             INSERT INTO effect_agent_unknown_resolutions (
               submission_id,
@@ -2124,9 +2792,11 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               ${now.iso}
             )
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const resolution = yield* parseStoredJsonText(resolutionJson).pipe(
             Effect.mapError(internalFailure(operation)),
           );
+
           resolved = yield* decodeUnknownResolutionIntent({
             submissionId: validated.submissionId,
             toolCallId: validated.toolCallId,
@@ -2143,6 +2813,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           const markedIds = yield* storedUnknownToolCallIds(operation, submission);
           const covering = yield* readUnknownResolutions(operation, validated.submissionId);
           const coveredIds = new Set(covering.map((row) => row.tool_call_id));
+
           if (markedIds.every((toolCallId) => coveredIds.has(toolCallId))) {
             yield* sql`
               UPDATE effect_agent_submissions
@@ -2154,10 +2825,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             `.pipe(Effect.mapError(sqlFailure(operation)));
           }
         }
+
         return resolved;
       }),
     );
+
     yield* hitFailpoint("ledger:unknown-resolution:after", operation);
+
     return intent;
   });
 
@@ -2165,26 +2839,38 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.recordChildSettled",
   )(function* (request: ChildSettledNotification) {
     const operation = "ledger record child settled";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ChildSettledNotification))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ChildSettledNotification))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:child-settled:before", operation);
+
     const outcome = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
-        // The child's canonical Settlement is the authority for this wake; a notification for
-        // an unsettled (or unknown) child is a caller error in a single-store adapter.
+        // The caller may notify after the canonical Settlement append but before ledger
+        // finalization. An exact reservation plus `terminalizing` is the narrow durable prefix
+        // that makes that ordering admissible; earlier states remain a caller error.
         const child = yield* readSubmission(operation, validated.childSubmissionId);
-        if (Option.isNone(child) || child.value.state !== "settled") {
+        const childReservation = yield* readReservation(operation, validated.childSubmissionId);
+
+        const announced =
+          Option.isSome(child) &&
+          (child.value.state === "settled" ||
+            (child.value.state === "terminalizing" && Option.isSome(childReservation)));
+
+        if (!announced) {
           return yield* LedgerError.make({
             operation,
             message: `Child submission ${validated.childSubmissionId} has no recorded settlement.`,
           });
         }
         if (parent.state !== "suspended" || parent.suspended_reason_json === null) {
-          return "not-waiting" as ChildSettledOutcome;
+          return NOT_WAITING;
         }
+
         const reason = yield* Schema.decodeEffect(Schema.fromJsonString(SuspensionReason))(
           parent.suspended_reason_json,
         ).pipe(
@@ -2197,20 +2883,28 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             ),
           ),
         );
+
         if (reason._tag !== "WaitingForChild") {
-          return "not-waiting" as ChildSettledOutcome;
+          return NOT_WAITING;
         }
         if (
           !reason.children.some((entry) => entry.childSubmissionId === validated.childSubmissionId)
         ) {
-          return "not-waiting" as ChildSettledOutcome;
+          return NOT_WAITING;
         }
-        // The parent wakes exactly when EVERY listed child is settled (spec §12 step 10);
-        // replays re-run the coverage check so a recovering caller wakes the lane idempotently.
+        // Every listed child must be either finalized or canonically announced from the exact
+        // terminalizing reservation. Replays re-run this coverage check idempotently.
         for (const entry of reason.children) {
           const listed = yield* readSubmission(operation, entry.childSubmissionId);
-          if (Option.isNone(listed) || listed.value.state !== "settled") {
-            return "still-waiting" as ChildSettledOutcome;
+          const reservation = yield* readReservation(operation, entry.childSubmissionId);
+
+          const covered =
+            Option.isSome(listed) &&
+            (listed.value.state === "settled" ||
+              (listed.value.state === "terminalizing" && Option.isSome(reservation)));
+
+          if (!covered) {
+            return STILL_WAITING;
           }
         }
         yield* sql`
@@ -2221,10 +2915,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             suspended_at = NULL
           WHERE submission_id = ${validated.parentSubmissionId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
-        return "woken" as ChildSettledOutcome;
+
+        return WOKEN;
       }),
     );
+
     yield* hitFailpoint("ledger:child-settled:after", operation);
+
     return outcome;
   });
 
@@ -2232,25 +2929,36 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.reserveChildBudget",
   )(function* (request: ChildBudgetReservationRequest) {
     const operation = "ledger reserve child budget";
-    const validated = yield* Schema.decodeUnknownEffect(
-      Schema.toType(ChildBudgetReservationRequest),
-    )(request).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ChildBudgetReservationRequest))(
+      request,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
     const allocationJson = yield* encodePersistedJsonText(validated.allocation).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:child-reservation:before", operation);
+
     const reserved = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const existing = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isSome(existing)) {
+          const existingSnapshot = yield* childReservationSnapshotFromRow(
+            operation,
+            existing.value,
+          );
+
           // Identical replays short-circuit before the fence, mirroring reserveSettlement: a
           // replay creates nothing, so a recovering caller resumes rather than duplicates.
           const identical =
             existing.value.parent_submission_id === validated.parentSubmissionId &&
             existing.value.parent_tool_call_id === validated.parentToolCallId &&
             existing.value.allocation_digest === validated.allocationDigest &&
-            existing.value.allocation_json === allocationJson;
+            equivalentPersistedJson(existingSnapshot.allocation, validated.allocation);
+
           if (!identical) {
             return yield* ChildReservationConflict.make({
               reservationId: validated.reservationId,
@@ -2259,16 +2967,19 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
                 "A reservation with this identity exists with a different parent Tool Call or allocation.",
             });
           }
+
           return ReservedChildBudget.make({
-            reservation: yield* childReservationSnapshotFromRow(operation, existing.value),
+            reservation: existingSnapshot,
             replayed: true,
           });
         }
+
         const collision = yield* readChildReservationForCall(
           operation,
           validated.parentSubmissionId,
           validated.parentToolCallId,
         );
+
         if (Option.isSome(collision)) {
           return yield* ChildReservationConflict.make({
             reservationId: validated.reservationId,
@@ -2277,10 +2988,12 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           });
         }
         const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
+
         // Creation is fenced by the parent lane's live ownership (spec §12 step 2): a stale
         // parent Attempt can never create new reservation state.
         yield* requireOwnership(operation, parent, validated.ownershipToken);
         const now = yield* currentInstant;
+
         yield* sql`
           INSERT INTO effect_agent_child_reservations (
             reservation_id,
@@ -2301,6 +3014,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           )
         `.pipe(Effect.mapError(sqlFailure(operation)));
         const inserted = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(inserted)) {
           return yield* corruptionFailure(
             operation,
@@ -2309,13 +3023,16 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             "An inserted child reservation row is missing inside its own transaction.",
           );
         }
+
         return ReservedChildBudget.make({
           reservation: yield* childReservationSnapshotFromRow(operation, inserted.value),
           replayed: false,
         });
       }),
     );
+
     yield* hitFailpoint("ledger:child-reservation:after", operation);
+
     return reserved;
   });
 
@@ -2324,14 +3041,18 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       request: AttachChildToReservationRequest,
     ) {
       const operation = "ledger attach child to reservation";
-      const validated = yield* Schema.decodeUnknownEffect(
-        Schema.toType(AttachChildToReservationRequest),
-      )(request).pipe(Effect.mapError(internalFailure(operation)));
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(AttachChildToReservationRequest))(
+        request,
+      ).pipe(Effect.mapError(internalFailure(operation)));
+
       yield* hitFailpoint("ledger:child-attach:before", operation);
+
       const attached = yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
           const existing = yield* readChildReservation(operation, validated.reservationId);
+
           if (Option.isNone(existing)) {
             return yield* LedgerError.make({
               operation,
@@ -2343,6 +3064,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             if (existing.value.child_submission_id === validated.childSubmissionId) {
               return yield* childReservationSnapshotFromRow(operation, existing.value);
             }
+
             return yield* ChildReservationConflict.make({
               reservationId: validated.reservationId,
               status: existing.value.status,
@@ -2350,6 +3072,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             });
           }
           const parent = yield* requireSubmission(operation, existing.value.parent_submission_id);
+
           yield* requireOwnership(operation, parent, validated.ownershipToken);
           if (existing.value.status !== "reserved") {
             return yield* ChildReservationConflict.make({
@@ -2361,6 +3084,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           // Single-store latitude: the admitted child must exist here, so a dangling
           // attachment can never enter the recovery view.
           const child = yield* readSubmission(operation, validated.childSubmissionId);
+
           if (Option.isNone(child)) {
             return yield* LedgerError.make({
               operation,
@@ -2373,6 +3097,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             WHERE reservation_id = ${validated.reservationId}
           `.pipe(Effect.mapError(sqlFailure(operation)));
           const updated = yield* readChildReservation(operation, validated.reservationId);
+
           if (Option.isNone(updated)) {
             return yield* corruptionFailure(
               operation,
@@ -2381,10 +3106,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
               "An updated child reservation row is missing inside its own transaction.",
             );
           }
+
           return yield* childReservationSnapshotFromRow(operation, updated.value);
         }),
       );
+
       yield* hitFailpoint("ledger:child-attach:after", operation);
+
       return attached;
     });
 
@@ -2392,17 +3120,22 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.beginChildBudgetRelease",
   )(function* (request: BeginChildBudgetReleaseRequest) {
     const operation = "ledger begin child budget release";
-    const validated = yield* Schema.decodeUnknownEffect(
-      Schema.toType(BeginChildBudgetReleaseRequest),
-    )(request).pipe(Effect.mapError(internalFailure(operation)));
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(BeginChildBudgetReleaseRequest))(
+      request,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
     const accountingJson = yield* encodePersistedJsonText(validated.accounting).pipe(
       Effect.mapError(internalFailure(operation)),
     );
+
     yield* hitFailpoint("ledger:child-release-pending:before", operation);
+
     const frozen = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const existing = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(existing)) {
           return yield* LedgerError.make({
             operation,
@@ -2410,11 +3143,20 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           });
         }
         if (existing.value.status !== "reserved") {
+          const existingSnapshot = yield* childReservationSnapshotFromRow(
+            operation,
+            existing.value,
+          );
+
           // The accounting decision was already frozen exactly once; an identical replay is a
           // no-op and a divergent decision conflicts (spec §12 join step 6).
-          if (existing.value.accounting_json === accountingJson) {
-            return yield* childReservationSnapshotFromRow(operation, existing.value);
+          if (
+            existingSnapshot.accounting !== undefined &&
+            equivalentPersistedJson(existingSnapshot.accounting, validated.accounting)
+          ) {
+            return existingSnapshot;
           }
+
           return yield* ChildReservationConflict.make({
             reservationId: validated.reservationId,
             status: existing.value.status,
@@ -2422,6 +3164,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           });
         }
         const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_child_reservations
           SET
@@ -2431,6 +3174,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           WHERE reservation_id = ${validated.reservationId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
         const updated = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(updated)) {
           return yield* corruptionFailure(
             operation,
@@ -2439,10 +3183,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             "An updated child reservation row is missing inside its own transaction.",
           );
         }
+
         return yield* childReservationSnapshotFromRow(operation, updated.value);
       }),
     );
+
     yield* hitFailpoint("ledger:child-release-pending:after", operation);
+
     return frozen;
   });
 
@@ -2450,14 +3197,18 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
     "SqliteSubmissionLedger.releaseChildBudget",
   )(function* (request: ReleaseChildBudgetRequest) {
     const operation = "ledger release child budget";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(ReleaseChildBudgetRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseChildBudgetRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
+
     yield* hitFailpoint("ledger:child-release:before", operation);
+
     const released = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
         const existing = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(existing)) {
           return yield* LedgerError.make({
             operation,
@@ -2477,12 +3228,14 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           });
         }
         const now = yield* currentInstant;
+
         yield* sql`
           UPDATE effect_agent_child_reservations
           SET status = 'released', released_at = ${now.iso}
           WHERE reservation_id = ${validated.reservationId}
         `.pipe(Effect.mapError(sqlFailure(operation)));
         const updated = yield* readChildReservation(operation, validated.reservationId);
+
         if (Option.isNone(updated)) {
           return yield* corruptionFailure(
             operation,
@@ -2491,84 +3244,167 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             "An updated child reservation row is missing inside its own transaction.",
           );
         }
+
         return yield* childReservationSnapshotFromRow(operation, updated.value);
       }),
     );
+
     yield* hitFailpoint("ledger:child-release:after", operation);
+
     return released;
   });
 
   interface ScanCursor {
-    readonly conversationId: string;
+    readonly threadId: string;
     readonly queueSequence: number;
   }
 
   const scanPage = Effect.fn("SqliteSubmissionLedger.scanPage")(function* (
     cursor: ScanCursor | undefined,
   ): Effect.fn.Return<
-    readonly [ReadonlyArray<SubmissionSnapshot>, Option.Option<ScanCursor | undefined>],
+    readonly [ReadonlyArray<SubmissionWorkItem>, Option.Option<ScanCursor | undefined>],
     LedgerError
   > {
     const operation = "ledger scan nonterminal";
+
     const rows = yield* (
       cursor === undefined
         ? sql<Record<string, unknown>>`
-          SELECT ${sql.literal(SUBMISSION_COLUMNS)}
+          SELECT submission_id AS "submissionId", thread_id AS "threadId",
+            queue_sequence AS "queueSequence", principal, idempotency_key AS "idempotencyKey",
+            deployment_id AS "deploymentId", receipt_id AS "receiptId", state
           FROM effect_agent_submissions
           WHERE state <> 'settled'
-          ORDER BY conversation_id ASC, queue_sequence ASC
+          ORDER BY thread_id ASC, queue_sequence ASC
           LIMIT ${SCAN_PAGE_SIZE}
         `
         : sql<Record<string, unknown>>`
-          SELECT ${sql.literal(SUBMISSION_COLUMNS)}
+          SELECT submission_id AS "submissionId", thread_id AS "threadId",
+            queue_sequence AS "queueSequence", principal, idempotency_key AS "idempotencyKey",
+            deployment_id AS "deploymentId", receipt_id AS "receiptId", state
           FROM effect_agent_submissions
           WHERE state <> 'settled'
-            AND (
-              conversation_id > ${cursor.conversationId}
-              OR (
-                conversation_id = ${cursor.conversationId}
-                AND queue_sequence > ${cursor.queueSequence}
-              )
-            )
-          ORDER BY conversation_id ASC, queue_sequence ASC
+            AND (thread_id, queue_sequence) > (${cursor.threadId}, ${cursor.queueSequence})
+          ORDER BY thread_id ASC, queue_sequence ASC
           LIMIT ${SCAN_PAGE_SIZE}
         `
     ).pipe(Effect.mapError(sqlFailure(operation)));
-    const decoded = yield* decodeSubmissionRows(operation, "nonterminal_scan", rows);
-    const snapshots = yield* Effect.forEach(decoded, (row) =>
-      decodeSubmissionSnapshot(operation, row),
-    );
+
+    const decoded = yield* decodeRows(
+      Schema.Array(SubmissionWorkItem),
+      "effect_agent_submissions",
+      "nonterminal_scan",
+      rows,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
     const last = decoded[decoded.length - 1];
+
     const next: Option.Option<ScanCursor | undefined> =
       last === undefined || decoded.length < SCAN_PAGE_SIZE
         ? Option.none()
         : Option.some({
-            conversationId: last.conversation_id,
-            queueSequence: last.queue_sequence,
+            threadId: last.threadId,
+            queueSequence: last.queueSequence,
           });
-    return [snapshots, next] as const;
+
+    return [decoded, next] as const;
   });
 
-  const scanNonterminal: Stream.Stream<SubmissionSnapshot, LedgerError> = Stream.paginate(
-    undefined as ScanCursor | undefined,
-    scanPage,
-  );
+  const scanNonterminal: Stream.Stream<SubmissionWorkItem, LedgerError> = Stream.paginate<
+    ScanCursor | undefined,
+    SubmissionWorkItem,
+    LedgerError
+  >(undefined, scanPage);
+
+  const readAbortIntentForSubmission: SubmissionLedger["Service"]["readAbortIntent"] = Effect.fn(
+    "SqliteSubmissionLedger.readAbortIntentForSubmission",
+  )(function* (request) {
+    const operation = "ledger read abort intent";
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(AbortIntentRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
+    const recordId = submissionAbortRecordId(validated.submissionId);
+
+    const rows = yield* sql<Record<string, unknown>>`
+      SELECT
+        submission.submission_id,
+        abort.submission_id AS abort_submission_id,
+        abort.author,
+        abort.reason,
+        abort.requested_at,
+        canonical.record_id AS canonical_record_id
+      FROM effect_agent_submissions AS submission
+      LEFT JOIN effect_agent_abort_intents AS abort
+        ON abort.submission_id = submission.submission_id
+      LEFT JOIN effect_agent_canonical_records AS canonical
+        ON canonical.thread_id = submission.thread_id
+          AND canonical.record_id = ${recordId}
+      WHERE submission.submission_id = ${validated.submissionId}
+    `.pipe(Effect.mapError(sqlFailure(operation)));
+
+    const decoded = yield* decodeRows(
+      Schema.Array(AbortIntentLookupRow),
+      "effect_agent_abort_intents",
+      validated.submissionId,
+      rows,
+    ).pipe(Effect.mapError(internalFailure(operation)));
+
+    if (decoded.length === 0) {
+      return yield* LedgerError.make({
+        operation,
+        message: `Unknown submission ${validated.submissionId}.`,
+      });
+    }
+    if (decoded.length !== 1) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_abort_intents",
+        validated.submissionId,
+        "An abort intent lookup returned more than one row.",
+      );
+    }
+    const row = decoded[0];
+
+    if (row.abort_submission_id === null) return undefined;
+
+    return yield* decodeAbortIntent({
+      submissionId: row.abort_submission_id,
+      author: row.author,
+      reason: row.reason,
+      requestedAt: row.requested_at,
+      ...(row.canonical_record_id === null ? {} : { canonicalRecordId: row.canonical_record_id }),
+    }).pipe(
+      Effect.mapError((error) =>
+        corruptionFailure(
+          operation,
+          "effect_agent_abort_intents",
+          validated.submissionId,
+          error.message,
+        ),
+      ),
+    );
+  });
 
   const loadRecoverySnapshot: SubmissionLedger["Service"]["loadRecoverySnapshot"] = Effect.fn(
     "SqliteSubmissionLedger.loadRecoverySnapshot",
   )(function* (request: RecoverySnapshotRequest) {
     const operation = "ledger load recovery snapshot";
-    const validated = yield* Schema.decodeUnknownEffect(Schema.toType(RecoverySnapshotRequest))(
+
+    const validated = yield* Schema.decodeEffect(Schema.toType(RecoverySnapshotRequest))(
       request,
     ).pipe(Effect.mapError(internalFailure(operation)));
-    return yield* sql
-      .withTransaction(
+
+    return yield* journal
+      .withReadTransaction(operation)(
         Effect.gen(function* () {
           const submissionRow = yield* requireSubmission(operation, validated.submissionId);
           const submission = yield* decodeSubmissionSnapshot(operation, submissionRow);
 
           let ownership: OwnershipSnapshot | undefined;
           const ownershipRow = yield* readOwnership(operation, validated.submissionId);
+
           if (Option.isSome(ownershipRow)) {
             ownership = yield* decodeOwnershipSnapshot({
               attemptId: ownershipRow.value.attempt_id,
@@ -2579,6 +3415,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           }
 
           let inputApplied: InputAppliedMarker | undefined;
+
           if (
             submissionRow.input_applied_record_id !== null &&
             submissionRow.input_applied_sequence !== null
@@ -2591,6 +3428,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
 
           let reservation: SettlementReservationSnapshot | undefined;
           const reservationRow = yield* readReservation(operation, validated.submissionId);
+
           if (Option.isSome(reservationRow)) {
             const record = yield* decodeRecordEnvelopeText(reservationRow.value.record_json).pipe(
               Effect.mapError((error) =>
@@ -2602,9 +3440,11 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
                 ),
               ),
             );
-            const settlementId = yield* Schema.decodeUnknownEffect(
+
+            const settlementId = yield* Schema.decodeEffect(
               SettlementReservationSnapshot.fields.settlementId,
             )(reservationRow.value.settlement_id).pipe(Effect.mapError(internalFailure(operation)));
+
             reservation = SettlementReservationSnapshot.make({
               settlementId,
               outcome: reservationRow.value.outcome,
@@ -2616,6 +3456,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
 
           let abortIntent: AbortIntent | undefined;
           const abortRow = yield* readAbortIntent(operation, validated.submissionId);
+
           if (Option.isSome(abortRow)) {
             abortIntent = yield* abortIntentFromRow(
               operation,
@@ -2633,11 +3474,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             WHERE joined_host_submission_id = ${validated.submissionId}
             ORDER BY queue_sequence ASC
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const joinSubmissions = yield* decodeSubmissionRows(
             operation,
             validated.submissionId,
             joinRows,
           );
+
           const joins = yield* Effect.forEach(joinSubmissions, (row) =>
             decodeJoinSnapshot({
               submissionId: row.submission_id,
@@ -2647,6 +3490,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           );
 
           let hostSubmissionId: RecoverySnapshot["hostSubmissionId"];
+
           if (submissionRow.joined_host_submission_id !== null) {
             hostSubmissionId = yield* decodeSubmissionId(
               submissionRow.joined_host_submission_id,
@@ -2654,6 +3498,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           }
 
           let suspension: SuspensionSnapshot | undefined;
+
           if (submissionRow.suspended_reason_json !== null && submissionRow.suspended_at !== null) {
             const reason = yield* parseStoredJsonText(submissionRow.suspended_reason_json).pipe(
               Effect.mapError((error) =>
@@ -2665,6 +3510,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
                 ),
               ),
             );
+
             suspension = yield* decodeSuspensionSnapshot({
               reason,
               suspendedAt: submissionRow.suspended_at,
@@ -2681,11 +3527,13 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           }
 
           const decisionRows = yield* readApprovalDecisions(operation, validated.submissionId);
+
           const approvalDecisions = yield* Effect.forEach(decisionRows, (row) =>
             approvalIntentFromRow(operation, row),
           );
 
           const resolutionRows = yield* readUnknownResolutions(operation, validated.submissionId);
+
           const unknownResolutions = yield* Effect.forEach(resolutionRows, (row) =>
             unknownResolutionIntentFromRow(operation, row),
           );
@@ -2699,18 +3547,23 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
             WHERE parent_submission_id = ${validated.submissionId}
             ORDER BY parent_tool_call_id ASC
           `.pipe(Effect.mapError(sqlFailure(operation)));
+
           const decodedChildReservations = yield* decodeChildReservationRows(
             operation,
             validated.submissionId,
             childReservationRows,
           );
+
           const childReservations = yield* Effect.forEach(decodedChildReservations, (row) =>
             childReservationSnapshotFromRow(operation, row),
           );
+
           const childAttachments: Array<ChildAttachmentSnapshot> = [];
+
           for (const row of decodedChildReservations) {
             if (row.child_submission_id === null) continue;
             const child = yield* readSubmission(operation, row.child_submission_id);
+
             if (Option.isNone(child)) continue;
             childAttachments.push(
               yield* decodeChildAttachmentSnapshot({
@@ -2725,6 +3578,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           }
 
           let parentLinkage: ParentLinkage | undefined;
+
           if (
             submissionRow.parent_submission_id !== null &&
             submissionRow.parent_tool_call_id !== null
@@ -2752,7 +3606,11 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
           });
         }),
       )
-      .pipe(Effect.catchTag("SqlError", (error) => Effect.fail(sqlFailure(operation)(error))));
+      .pipe(
+        Effect.catchTag("SqliteStorageError", (error) =>
+          Effect.fail(internalFailure(operation)(error)),
+        ),
+      );
   });
 
   return Context.make(
@@ -2770,6 +3628,8 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       reserveSettlement,
       finalizeSettlement,
       requestAbort,
+      stopWorker,
+      inspectWorker,
       claimJoining,
       markJoined,
       revertJoining,
@@ -2784,6 +3644,7 @@ const makeServices = Effect.fn("SqliteSubmissionLedger.makeServices")(function*
       releaseChildBudget,
       scanNonterminal,
       loadRecoverySnapshot,
+      readAbortIntent: readAbortIntentForSubmission,
     }),
   );
 });
@@ -2801,18 +3662,22 @@ export const submissionLedgerLayer: Layer.Layer<
 
 /**
  * A composition-root convenience Layer for the durable Submission Ledger. Point it at the
- * same database file as the ConversationStore so claims fence the same producer epochs.
+ * same database file as the ThreadStore so claims fence the same producer epochs.
  */
 export const ledgerLayer = (
   options: SqliteStorageOptions,
 ): Layer.Layer<SubmissionLedger, SqliteStorageInitializationError> =>
-  submissionLedgerLayer.pipe(
-    Layer.provide(
-      Layer.mergeAll(
-        storageConfigLayer(options),
-        storageFailpointLayer(options),
-        SqliteClient.layer({ filename: options.filename }),
-        NodeCrypto.layer,
+  Layer.unwrap(
+    Effect.map(SqliteStorageConfig, (config) =>
+      submissionLedgerLayer.pipe(
+        Layer.provide(
+          Layer.mergeAll(
+            Layer.succeed(SqliteStorageConfig)(config),
+            storageFailpointLayer(options),
+            SqliteClient.layer({ filename: options.filename }),
+            NodeCrypto.layer,
+          ),
+        ),
       ),
     ),
-  );
+  ).pipe(Layer.provide(storageConfigLayer(options)));