@yielded/agent-storage-cloudflare 0.1.0-beta.166 → 0.1.0-beta.168

package/src/DoSubmissionLedger.ts

@@ -1,10 +1,22 @@
 import { BrowserCrypto } from "@effect/platform-browser";
 import { SqliteClient } from "@effect/sql-sqlite-do";
+import {
+  decodeAbortFact,
+  decodeAdmissionFact,
+  decodeApprovalFact,
+  decodeResolutionFact,
+} from "@yielded/agent-storage-sql/sql-admission-facts";
+import {
+  definitionJson,
+  makeCanonicalStorage,
+  recordBatchId,
+  runKey,
+} from "@yielded/agent-storage-sql/sql-canonical-storage";
 import {
   SqlStorageProgress,
   type SqlStorageProgressKind,
 } from "@yielded/agent-storage-sql/sql-storage-progress";
-import { EMPTY_TAIL_DIGEST } from "@yielded/agent/digest";
+import { canonicalRecordJson } from "@yielded/agent-storage-sql/sql-thread-archive-range";
 import type { LifecyclePublicationFact } from "@yielded/agent/lifecycle-publication";
 import { InputMessage } from "@yielded/agent/messaging";
 import {
@@ -14,10 +26,18 @@ import {
   Digest,
   PersistedJson,
   WorkerAdmission,
-  ProducerEpoch,
   RecordEnvelope,
   SettlementOutcome,
 } from "@yielded/agent/records";
+import { runIdForSubmission } from "@yielded/agent/run-journal";
+import { StorageOwner } from "@yielded/agent/run-storage";
+import {
+  SettlementPublicationResult,
+  SettlementPublisher,
+  validatePublication,
+  validateCanonicalSettlement,
+  validateJoinedSettlement,
+} from "@yielded/agent/settlement-publisher";
 import {
   AbortCommand,
   WorkerStopCommand,
@@ -37,6 +57,7 @@ import {
   ApprovalConflict,
   ApprovalDecisionCommand,
   ApprovalDecisionIntent,
+  approvalDecisionsCover,
   AttachChildToReservationRequest,
   BeginChildBudgetReleaseRequest,
   ChildAttachmentSnapshot,
@@ -59,29 +80,24 @@ import {
   MarkReadyRequest,
   MarkUnknownRequest,
   OwnershipLost,
-  OwnershipRenewal,
-  OwnershipSnapshot,
   ParentLinkage,
   QueueSequence,
   RecoverySnapshot,
   RecoverySnapshotRequest,
   ReleaseChildBudgetRequest,
-  ReleaseOwnershipRequest,
-  RenewOwnershipRequest,
   ReservedChildBudget,
-  ReservedSettlement,
   RevertJoiningRequest,
   Settlement,
   SettlementConflict,
   SettlementFinalization,
-  SettlementReservation,
   SubmissionLedger,
   SubmissionLookup,
   SubmissionLookupByKey,
   SubmissionSnapshot,
+  FundingOwnerRequest,
+  FundingOwner,
   SubmissionWorkItem,
   SubmissionState,
-  SettlementReservationSnapshot,
   settlementFailureFromRecord,
   SuspendRequest,
   SuspensionReason,
@@ -90,11 +106,22 @@ import {
   UnknownResolutionCommand,
   UnknownResolutionConflict,
   UnknownResolutionIntent,
+  UnknownResolutionKind,
+  unknownResolutionKind,
+  unknownResolutionMatchesResult,
   submissionAbortRecordId,
+  submissionSettlementRecordId,
+  submissionSettlementBatchId,
   type ChildSettledOutcome,
   type SuspensionOutcome,
 } from "@yielded/agent/submission-ledger";
-import { ThreadStoreDiagnostic } from "@yielded/agent/thread-store";
+import {
+  makeTransferFactCheck,
+  AppendConflict,
+  ThreadNotMaterialized,
+  ThreadStoreDiagnostic,
+  ThreadStoreError,
+} from "@yielded/agent/thread-store";
 import { AssignmentTerminal } from "@yielded/agent/worker";
 import {
   Cause,
@@ -125,9 +152,9 @@ import {
   type DoStorageInitializationError,
   type DoStorageOptions,
 } from "./DoThreadStore.ts";
+import { prepareCanonicalAppend } from "./internal/canonical-append.ts";
 import { decodeRows, initializeDoJournal } from "./internal/do-journal.ts";
 import { ownedRows } from "./internal/owned-state.ts";
-import { withStorageSpan } from "./internal/storage-span.ts";
 
 type SubmissionId = SubmissionSnapshot["submissionId"];
 
@@ -140,7 +167,7 @@ const BoundedIdentifier = Schema.NonEmptyString.check(Schema.isMaxLength(1024));
 const BoundedTimestamp = Schema.NonEmptyString.check(Schema.isMaxLength(128));
 
 const SCAN_PAGE_SIZE = 256;
-const EPOCH_ZERO = Schema.decodeSync(ProducerEpoch)(0);
+const admissionFitsTransfer = makeTransferFactCheck(AdmissionRequest);
 const RESUME_IMMEDIATELY: SuspensionOutcome = "resume-immediately";
 const SUSPENDED: SuspensionOutcome = "suspended";
 const NOT_WAITING: ChildSettledOutcome = "not-waiting";
@@ -162,6 +189,8 @@ class SubmissionRow extends Schema.Class<SubmissionRow>("SubmissionRow")({
   receipt_id: BoundedIdentifier,
   state: SubmissionState,
   settled_outcome: Schema.NullOr(SettlementOutcome),
+  settled_record_id: Schema.NullOr(BoundedIdentifier),
+  finalized_at: Schema.NullOr(BoundedTimestamp),
   created_at: BoundedTimestamp,
   ready_at: Schema.NullOr(BoundedTimestamp),
   input_applied_record_id: Schema.NullOr(BoundedIdentifier),
@@ -226,32 +255,13 @@ class ApprovalDecisionRow extends Schema.Class<ApprovalDecisionRow>("ApprovalDec
 class UnknownResolutionRow extends Schema.Class<UnknownResolutionRow>("UnknownResolutionRow")({
   submission_id: BoundedIdentifier,
   tool_call_id: BoundedIdentifier,
+  resolution_kind: UnknownResolutionKind,
   author: BoundedIdentifier,
   reason: BoundedStoredText,
   resolution_json: BoundedStoredText,
   resolved_at: BoundedTimestamp,
 }) {}
 
-class OwnershipRow extends Schema.Class<OwnershipRow>("OwnershipRow")({
-  submission_id: BoundedIdentifier,
-  attempt_id: BoundedIdentifier,
-  ownership_token: BoundedIdentifier,
-  producer_epoch: ProducerEpoch,
-  owner_producer_id: BoundedIdentifier,
-  lease_expires_at: BoundedTimestamp,
-}) {}
-
-class ReservationRow extends Schema.Class<ReservationRow>("ReservationRow")({
-  submission_id: BoundedIdentifier,
-  settlement_id: BoundedIdentifier,
-  outcome: SettlementOutcome,
-  record_id: BoundedIdentifier,
-  record_json: BoundedStoredText,
-  record_digest: Digest,
-  reserved_at: BoundedTimestamp,
-  finalized_at: Schema.NullOr(BoundedTimestamp),
-}) {}
-
 class AbortIntentRow extends Schema.Class<AbortIntentRow>("AbortIntentRow")({
   submission_id: BoundedIdentifier,
   author: BoundedIdentifier,
@@ -276,13 +286,14 @@ const SUBMISSION_COLUMNS = `
   principal,
   idempotency_key,
   agent_id,
-  agent_digests_json,
   deployment_id,
   input_json,
   input_digest,
   receipt_id,
   state,
   settled_outcome,
+  settled_record_id,
+  finalized_at,
   created_at,
   ready_at,
   input_applied_record_id,
@@ -320,7 +331,6 @@ const ToolCallIdList = Schema.Array(ToolCallIdSchema);
 
 const encodePersistedJsonText = Schema.encodeEffect(Schema.fromJsonString(PersistedJson));
 const encodeDefinitionDigestsText = Schema.encodeEffect(Schema.fromJsonString(DefinitionDigests));
-const encodeRecordEnvelopeText = Schema.encodeEffect(Schema.fromJsonString(RecordEnvelope));
 const decodeRecordEnvelopeText = Schema.decodeEffect(Schema.fromJsonString(RecordEnvelope));
 const encodeSuspensionReasonText = Schema.encodeEffect(Schema.fromJsonString(SuspensionReason));
 const encodeUnknownResolutionText = Schema.encodeEffect(Schema.fromJsonString(UnknownResolution));
@@ -329,12 +339,15 @@ const decodeToolCallIdsText = Schema.decodeEffect(Schema.fromJsonString(ToolCall
 const parseStoredJsonText = Schema.decodeEffect(Schema.fromJsonString(Schema.Json));
 const decodeAdmissionResult = Schema.decodeUnknownEffect(AdmissionResult);
 const decodeClaim = Schema.decodeUnknownEffect(Claim);
-const decodeOwnershipRenewal = Schema.decodeUnknownEffect(OwnershipRenewal);
 const decodeSettlement = Schema.decodeUnknownEffect(Settlement);
 const decodeAbortIntent = Schema.decodeUnknownEffect(AbortIntent);
-const decodeOwnershipSnapshot = Schema.decodeUnknownEffect(OwnershipSnapshot);
 const decodeInputAppliedMarker = Schema.decodeUnknownEffect(InputAppliedMarker);
-const decodeSubmissionSnapshotUnknown = Schema.decodeUnknownEffect(SubmissionSnapshot);
+
+const decodeSubmissionSnapshotType = (input: typeof SubmissionSnapshot.Type) =>
+  Schema.decodeEffect(Schema.toType(Schema.Struct(SubmissionSnapshot.fields)))(input).pipe(
+    Effect.map((fields) => SubmissionSnapshot.make(fields)),
+  );
+
 const decodeSubmissionId = Schema.decodeUnknownEffect(SubmissionSnapshot.fields.submissionId);
 const decodeQueueSequence = Schema.decodeUnknownEffect(QueueSequence);
 const decodeUtcInstant = Schema.decodeUnknownEffect(Schema.DateTimeUtcFromString);
@@ -385,20 +398,7 @@ const submissionsRows = ownedRows(
   (row) => row.submission_id,
   "submission_id",
   [["thread_id", "principal", "idempotency_key"]],
-);
-
-const ownershipRows = ownedRows(
-  OwnershipRow,
-  "effect_agent_submission_ownership",
-  (row) => row.submission_id,
-  "submission_id",
-);
-
-const reservationsRows = ownedRows(
-  ReservationRow,
-  "effect_agent_settlement_reservations",
-  (row) => row.submission_id,
-  "submission_id",
+  (sql) => sql`*, ${definitionJson(sql)} AS agent_digests_json`,
 );
 
 const abortsRows = ownedRows(
@@ -413,7 +413,7 @@ const approvalsRows = ownedRows(ApprovalDecisionRow, "effect_agent_approval_deci
 );
 
 const resolutionsRows = ownedRows(UnknownResolutionRow, "effect_agent_unknown_resolutions", (row) =>
-  JSON.stringify([row.submission_id, row.tool_call_id]),
+  JSON.stringify([row.submission_id, row.tool_call_id, row.resolution_kind]),
 );
 
 const childSettlementsRows = ownedRows(
@@ -442,7 +442,7 @@ const submissionWorkRows = ownedRows(
   (row) => row.submission_id,
 );
 
-const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
+const makeServices = Effect.fnUntraced(function* () {
   const progress = yield* SqlStorageProgress;
 
   const recordProgress = (kind: SqlStorageProgressKind, operation: string) =>
@@ -458,10 +458,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
   const failpoint = yield* DoStorageFailpoint;
   const sql = yield* SqlClientService.SqlClient;
   const crypto = yield* Crypto.Crypto;
+  const physical = yield* makeCanonicalStorage();
+  const submissionColumns = sql`${sql.literal(SUBMISSION_COLUMNS)}, ${definitionJson(sql)} AS agent_digests_json`;
   const admissionFence = yield* SubmissionAdmissionFence;
   const journal = yield* initializeDoJournal(sql, failpoint.hit, config.maxStoredValueBytes);
   const lifecycle = journal.lifecycle;
   const state = journal.state;
+  const owner = state.owner;
   const submissionViews = submissionsRows(state, sql);
   const workRows = submissionWorkRows(state, sql);
 
@@ -476,8 +479,6 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           .write(effect)
           .pipe(Effect.tap((changed) => workRows.write(Effect.succeed(changed)))),
     },
-    ownership: ownershipRows(state, sql),
-    reservations: reservationsRows(state, sql),
     aborts: abortsRows(state, sql),
     approvals: approvalsRows(state, sql),
     resolutions: resolutionsRows(state, sql),
@@ -492,46 +493,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     operation: string,
   ) => effect.pipe(Effect.mapError(internalFailure(operation)));
 
-  // Small lanes share control metadata; large retained histories keep indexed SQL reads.
-  const laneWork = Effect.fnUntraced(function* (threadId: string, operation: string) {
-    const work = yield* cached(
-      workRows.matching(
-        JSON.stringify(["lane", threadId]),
-        (row) => row.thread_id === threadId,
-        sql`SELECT submission_id, thread_id, queue_sequence, principal, idempotency_key,
-        deployment_id, receipt_id, state FROM effect_agent_submissions WHERE thread_id = ${threadId} LIMIT 129`,
-        128,
-      ),
-      operation,
-    );
-
-    return work.length > 128
-      ? undefined
-      : [...work].sort((a, b) => a.queue_sequence - b.queue_sequence);
-  });
-
   const byKey = Effect.fnUntraced(function* (
     request: Pick<SubmissionLookupByKey, "threadId" | "principal" | "idempotencyKey">,
     operation: string,
   ) {
-    const lane = yield* laneWork(request.threadId, operation);
-
-    if (lane === undefined)
-      return yield* cached(
-        rows.submissions.byFields([
-          ["thread_id", request.threadId],
-          ["principal", request.principal],
-          ["idempotency_key", request.idempotencyKey],
-        ]),
-        operation,
-      );
-
-    const matches = lane.filter(
-      (row) =>
-        row.principal === request.principal && row.idempotency_key === request.idempotencyKey,
+    return yield* cached(
+      rows.submissions.byFields([
+        ["thread_id", request.threadId],
+        ["principal", request.principal],
+        ["idempotency_key", request.idempotencyKey],
+      ]),
+      operation,
     );
-
-    return yield* Effect.forEach(matches, (row) => requireSubmission(operation, row.submission_id));
   }, state.read);
 
   const retainLifecycle = (submission: SubmissionRow, fact: LifecyclePublicationFact) =>
@@ -624,27 +597,19 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       );
 
   const mintUuid = (operation: string): Effect.Effect<string, LedgerError> =>
-    crypto.randomUUIDv7.pipe(Effect.mapError((error) => internalFailure(operation)(error)));
+    crypto.randomUUIDv7().pipe(Effect.mapError((error) => internalFailure(operation)(error)));
 
   const currentInstant = Effect.map(Clock.currentTimeMillis, (millis) => ({
     millis,
     iso: new Date(millis).toISOString(),
   }));
 
-  const timestampMillis = (operation: string, rowKey: string) => (timestamp: string) =>
-    decodeUtcInstant(timestamp).pipe(
-      Effect.map(DateTime.toEpochMillis),
-      Effect.mapError((error) =>
-        corruptionFailure(operation, "effect_agent_submission_ownership", rowKey, error.message),
-      ),
-    );
-
   const decodeSubmissionRows = (operation: string, rowKey: string, rows: unknown) =>
     decodeRows(Schema.Array(SubmissionRow), "effect_agent_submissions", rowKey, rows).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
-  const readSubmission = Effect.fn("DoSubmissionLedger.readSubmission")(function* (
+  const readSubmission = Effect.fnUntraced(function* (
     operation: string,
     submissionId: string,
   ): Effect.fn.Return<Option.Option<SubmissionRow>, LedgerError> {
@@ -653,7 +618,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     return Option.fromUndefinedOr(found[0]);
   });
 
-  const requireSubmission = Effect.fn("DoSubmissionLedger.requireSubmission")(function* (
+  const requireSubmission = Effect.fnUntraced(function* (
     operation: string,
     submissionId: string,
   ): Effect.fn.Return<SubmissionRow, LedgerError> {
@@ -669,167 +634,122 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     return submission.value;
   });
 
-  const readOwnership = Effect.fn("DoSubmissionLedger.readOwnership")(function* (
+  const requireOwner = Effect.fnUntraced(function* (
     operation: string,
-    submissionId: string,
-  ): Effect.fn.Return<Option.Option<OwnershipRow>, LedgerError> {
-    const found = yield* cached(rows.ownership.by("submission_id", submissionId), operation);
+    submission: SubmissionRow,
+  ): Effect.fn.Return<void, OwnershipLost | LedgerError> {
+    if (owner.hasOwner(submission.thread_id, submission.submission_id)) return;
 
-    return Option.fromUndefinedOr(found[0]);
+    const submissionId = yield* decodeSubmissionId(submission.submission_id).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
+    return yield* OwnershipLost.make({ submissionId });
   });
 
-  const threadEpoch = Effect.fn("DoSubmissionLedger.threadEpoch")(function* (
-    operation: string,
-    threadId: string,
-  ): Effect.fn.Return<ProducerEpoch, LedgerError> {
-    const threads = yield* journal
-      .getThread(threadId)
-      .pipe(Effect.mapError(internalFailure(operation)));
+  const submissions = new WeakMap<SubmissionRow, SubmissionSnapshot>();
 
-    return threads.length === 0 ? EPOCH_ZERO : threads[0].producer_epoch;
-  });
+  const decodeSubmissionSnapshot = Effect.fnUntraced(function* (
+    operation: string,
+    row: SubmissionRow,
+  ): Effect.fn.Return<SubmissionSnapshot, LedgerError> {
+    const existing = submissions.get(row);
+
+    if (existing !== undefined) return existing;
+
+    const decodeFailure = (error: Schema.SchemaError) =>
+      internalFailure(operation)(
+        DoStorageCorruptionError.make({
+          table: "effect_agent_submissions",
+          rowKey: row.submission_id,
+          message: "Stored submission does not satisfy the ledger schema",
+          diagnostic: ThreadStoreDiagnostic.make({
+            causeTag: error._tag,
+            operation,
+            decoder: "SubmissionSnapshot",
+            issueTag: error.issue._tag,
+          }),
+        }),
+      );
 
-  /**
-   * Verify inside the surrounding write transaction that the presented token still owns the
-   * Submission's lane; a superseded or missing token fails with OwnershipLost carrying the
-   * Thread's current producer epoch (DUR-006).
-   */
-  const requireOwnership = Effect.fnUntraced(
-    function* (
-      operation: string,
-      submission: SubmissionRow,
-      ownershipToken: string,
-    ): Effect.fn.Return<OwnershipRow, OwnershipLost | LedgerError> {
-      const ownership = yield* readOwnership(operation, submission.submission_id);
-      const actualEpoch = yield* threadEpoch(operation, submission.thread_id);
+    if ((row.parent_submission_id === null) !== (row.parent_tool_call_id === null)) {
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_submissions",
+        row.submission_id,
+        "A parent linkage must record both the parent Submission and the parent Tool Call.",
+      );
+    }
 
-      if (
-        Option.isNone(ownership) ||
-        ownership.value.ownership_token !== ownershipToken ||
-        ownership.value.producer_epoch !== actualEpoch
-      ) {
-        const submissionId = yield* Schema.decodeEffect(SubmissionSnapshot.fields.submissionId)(
-          submission.submission_id,
-        ).pipe(Effect.mapError(internalFailure(operation)));
+    const admission = yield* decodeAdmissionFact(row).pipe(Effect.mapError(decodeFailure));
 
-        return yield* OwnershipLost.make({ submissionId, actualEpoch });
-      }
+    const readyAt =
+      row.ready_at === null
+        ? undefined
+        : yield* decodeUtcInstant(row.ready_at).pipe(Effect.mapError(decodeFailure));
 
-      return ownership.value;
-    },
-    withStorageSpan(
-      "DoSubmissionLedger.requireOwnership",
-      (error) => error._tag === "OwnershipLost",
-    ),
-  );
+    const snapshot = yield* decodeSubmissionSnapshotType({
+      ...admission,
+      state: row.state,
+      ...(row.settled_outcome === null ? {} : { settledOutcome: row.settled_outcome }),
+      ...(readyAt === undefined ? {} : { readyAt }),
+    }).pipe(Effect.mapError(decodeFailure));
 
-  const submissions = new WeakMap<SubmissionRow, SubmissionSnapshot>();
+    submissions.set(row, snapshot);
 
-  const decodeSubmissionSnapshot = Effect.fn("DoSubmissionLedger.decodeSubmissionSnapshot")(
-    function* (
-      operation: string,
-      row: SubmissionRow,
-    ): Effect.fn.Return<SubmissionSnapshot, LedgerError> {
-      const existing = submissions.get(row);
-
-      if (existing !== undefined) return existing;
-
-      const decodeFailure = (error: Schema.SchemaError) =>
-        internalFailure(operation)(
-          DoStorageCorruptionError.make({
-            table: "effect_agent_submissions",
-            rowKey: row.submission_id,
-            message: "Stored submission does not satisfy the ledger schema",
-            diagnostic: ThreadStoreDiagnostic.make({
-              causeTag: error._tag,
-              operation,
-              decoder: "SubmissionSnapshot",
-              issueTag: error.issue._tag,
-            }),
-          }),
-        );
+    return snapshot;
+  });
 
-      const agentDigests = yield* parseStoredJsonText(row.agent_digests_json).pipe(
-        Effect.mapError(decodeFailure),
-      );
+  const readCanonicalSettlement = Effect.fnUntraced(function* (
+    operation: string,
+    submission: SubmissionRow,
+  ) {
+    const expected = yield* decodeSubmissionSnapshot(operation, submission);
+    const recordId = submissionSettlementRecordId(expected.submissionId);
 
-      const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
-        Effect.mapError(decodeFailure),
-      );
+    const found =
+      yield* sql`SELECT ${recordBatchId(sql)} AS batch_id, record_id, ${canonicalRecordJson(sql)} AS record_json
+      FROM effect_agent_canonical_records WHERE thread_id = ${submission.thread_id}
+      AND record_id = ${JSON.stringify(recordId)}`.pipe(Effect.mapError(sqlFailure(operation)));
 
-      if ((row.parent_submission_id === null) !== (row.parent_tool_call_id === null)) {
-        return yield* corruptionFailure(
-          operation,
-          "effect_agent_submissions",
-          row.submission_id,
-          "A parent linkage must record both the parent Submission and the parent Tool Call.",
-        );
-      }
+    const decoded = yield* decodeRows(
+      Schema.Array(
+        Schema.Struct({
+          batch_id: Schema.fromJsonString(BoundedIdentifier),
+          record_id: Schema.fromJsonString(BoundedIdentifier),
+          record_json: BoundedStoredText,
+        }),
+      ),
+      "effect_agent_canonical_records",
+      recordId,
+      found,
+    ).pipe(Effect.mapError(internalFailure(operation)));
 
-      const snapshot = yield* decodeSubmissionSnapshotUnknown({
-        submissionId: row.submission_id,
-        threadId: row.thread_id,
-        queueSequence: row.queue_sequence,
-        principal: row.principal,
-        idempotencyKey: row.idempotency_key,
-        agentId: row.agent_id,
-        agentDigests,
-        deploymentId: row.deployment_id,
-        inputPayload,
-        inputDigest: row.input_digest,
-        receiptId: row.receipt_id,
-        state: row.state,
-        createdAt: row.created_at,
-        ...(row.admission_group === null ? {} : { admissionGroup: row.admission_group }),
-        ...(row.worker_admission_json === null
-          ? {}
-          : {
-              workerAdmission: yield* parseStoredJsonText(row.worker_admission_json).pipe(
-                Effect.mapError(decodeFailure),
-              ),
-            }),
-        ...(row.message_admission_json === null
-          ? {}
-          : {
-              messageAdmission: yield* parseStoredJsonText(row.message_admission_json).pipe(
-                Effect.mapError(decodeFailure),
-              ),
-            }),
-        ...(row.admission_fence_json === null
-          ? {}
-          : {
-              admissionFence: yield* parseStoredJsonText(row.admission_fence_json).pipe(
-                Effect.mapError(decodeFailure),
-              ),
-            }),
-        ...(row.settled_outcome === null ? {} : { settledOutcome: row.settled_outcome }),
-        ...(row.ready_at === null ? {} : { readyAt: row.ready_at }),
-        ...(row.parent_submission_id === null || row.parent_tool_call_id === null
-          ? {}
-          : {
-              parentLinkage: {
-                parentSubmissionId: row.parent_submission_id,
-                parentToolCallId: row.parent_tool_call_id,
-              },
-            }),
-      }).pipe(Effect.mapError(decodeFailure));
+    if (decoded.length === 0) return undefined;
+    const row = decoded[0];
 
-      submissions.set(row, snapshot);
+    if (
+      decoded.length !== 1 ||
+      row.batch_id !== submissionSettlementBatchId(expected.submissionId) ||
+      row.record_id !== recordId
+    )
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_canonical_records",
+        recordId,
+        "Canonical settlement identity is inconsistent.",
+      );
 
-      return snapshot;
-    },
-  );
+    const record = yield* decodeRecordEnvelopeText(row.record_json).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
-  const readReservation = Effect.fn("DoSubmissionLedger.readReservation")(function* (
-    operation: string,
-    submissionId: string,
-  ): Effect.fn.Return<Option.Option<ReservationRow>, LedgerError> {
-    const found = yield* cached(rows.reservations.by("submission_id", submissionId), operation);
+    const settlement = yield* validateCanonicalSettlement(record, expected);
 
-    return Option.fromUndefinedOr(found[0]);
+    return { record, settlement };
   });
 
-  const readAbortIntent = Effect.fn("DoSubmissionLedger.readAbortIntent")(function* (
+  const readAbortIntent = Effect.fnUntraced(function* (
     operation: string,
     submissionId: string,
   ): Effect.fn.Return<Option.Option<AbortIntentRow>, LedgerError> {
@@ -843,25 +763,23 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
    * Submission (the DC realization of the port's "cross-store adapters record a durable
    * notification marker" contract).
    */
-  const readChildSettlementMarkers = Effect.fn("DoSubmissionLedger.readChildSettlementMarkers")(
-    function* (
-      operation: string,
-      parentSubmissionId: string,
-    ): Effect.fn.Return<ReadonlyArray<ChildSettlementMarkerRow>, LedgerError> {
-      const found = yield* cached(
-        rows.childSettlements.by("parent_submission_id", parentSubmissionId),
-        operation,
-      );
+  const readChildSettlementMarkers = Effect.fnUntraced(function* (
+    operation: string,
+    parentSubmissionId: string,
+  ): Effect.fn.Return<ReadonlyArray<ChildSettlementMarkerRow>, LedgerError> {
+    const found = yield* cached(
+      rows.childSettlements.by("parent_submission_id", parentSubmissionId),
+      operation,
+    );
 
-      return found.toSorted((a, b) =>
-        a.child_submission_id < b.child_submission_id
-          ? -1
-          : a.child_submission_id > b.child_submission_id
-            ? 1
-            : 0,
-      );
-    },
-  );
+    return found.toSorted((a, b) =>
+      a.child_submission_id < b.child_submission_id
+        ? -1
+        : a.child_submission_id > b.child_submission_id
+          ? 1
+          : 0,
+    );
+  });
 
   /**
    * Whether one listed child is provably settled from THIS store: either its own row lives
@@ -869,7 +787,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
    * cross-store notification marker was recorded for it (the child's row lives in another
    * Durable Object and its owner reported the settlement through `recordChildSettled`).
    */
-  const childProvablySettled = Effect.fn("DoSubmissionLedger.childProvablySettled")(function* (
+  const childProvablySettled = Effect.fnUntraced(function* (
     operation: string,
     markerChildren: ReadonlySet<string>,
     childSubmissionId: string,
@@ -877,7 +795,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     if (markerChildren.has(childSubmissionId)) return true;
     const childRow = yield* readSubmission(operation, childSubmissionId);
 
-    return Option.isSome(childRow) && childRow.value.state === "settled";
+    return (
+      Option.isSome(childRow) &&
+      (yield* readCanonicalSettlement(operation, childRow.value)) !== undefined
+    );
   });
 
   const decodeChildReservationRows = (operation: string, rowKey: string, rows: unknown) =>
@@ -888,7 +809,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       rows,
     ).pipe(Effect.mapError(internalFailure(operation)));
 
-  const readChildReservation = Effect.fn("DoSubmissionLedger.readChildReservation")(function* (
+  const readChildReservation = Effect.fnUntraced(function* (
     operation: string,
     reservationId: string,
   ): Effect.fn.Return<Option.Option<ChildReservationRow>, LedgerError> {
@@ -912,41 +833,37 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
   });
 
-  const readChildReservationForCall = Effect.fn("DoSubmissionLedger.readChildReservationForCall")(
-    function* (
-      operation: string,
-      parentSubmissionId: string,
-      parentToolCallId: string,
-    ): Effect.fn.Return<Option.Option<ChildReservationRow>, LedgerError> {
-      const rows = yield* sql<Record<string, unknown>>`
+  const readChildReservationForCall = Effect.fnUntraced(function* (
+    operation: string,
+    parentSubmissionId: string,
+    parentToolCallId: string,
+  ): Effect.fn.Return<Option.Option<ChildReservationRow>, LedgerError> {
+    const rows = yield* sql<Record<string, unknown>>`
         SELECT ${sql.literal(CHILD_RESERVATION_COLUMNS)}
         FROM effect_agent_child_reservations
         WHERE parent_submission_id = ${parentSubmissionId}
           AND parent_tool_call_id = ${parentToolCallId}
       `.pipe(Effect.mapError(sqlFailure(operation)));
 
-      const decoded = yield* decodeChildReservationRows(
+    const decoded = yield* decodeChildReservationRows(
+      operation,
+      `${parentSubmissionId}/${parentToolCallId}`,
+      rows,
+    );
+
+    if (decoded.length > 1) {
+      return yield* corruptionFailure(
         operation,
+        "effect_agent_child_reservations",
         `${parentSubmissionId}/${parentToolCallId}`,
-        rows,
+        "A parent Tool Call returned more than one child reservation.",
       );
+    }
 
-      if (decoded.length > 1) {
-        return yield* corruptionFailure(
-          operation,
-          "effect_agent_child_reservations",
-          `${parentSubmissionId}/${parentToolCallId}`,
-          "A parent Tool Call returned more than one child reservation.",
-        );
-      }
-
-      return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
-    },
-  );
+    return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
+  });
 
-  const childReservationSnapshotFromRow = Effect.fn(
-    "DoSubmissionLedger.childReservationSnapshotFromRow",
-  )(function* (
+  const childReservationSnapshotFromRow = Effect.fnUntraced(function* (
     operation: string,
     row: ChildReservationRow,
   ): Effect.fn.Return<ChildBudgetReservationSnapshot, LedgerError> {
@@ -982,7 +899,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     }).pipe(Effect.mapError(rowFailure));
   });
 
-  const readApprovalDecisions = Effect.fn("DoSubmissionLedger.readApprovalDecisions")(function* (
+  const readApprovalDecisions = Effect.fnUntraced(function* (
     operation: string,
     submissionId: string,
   ): Effect.fn.Return<ReadonlyArray<ApprovalDecisionRow>, LedgerError> {
@@ -993,18 +910,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     );
   });
 
-  const approvalIntentFromRow = Effect.fn("DoSubmissionLedger.approvalIntentFromRow")(function* (
+  const approvalIntentFromRow = (
     operation: string,
     row: ApprovalDecisionRow,
-  ): Effect.fn.Return<ApprovalDecisionIntent, LedgerError> {
-    return yield* decodeApprovalDecisionIntent({
-      submissionId: row.submission_id,
-      toolCallId: row.tool_call_id,
-      decision: row.decision,
-      resolver: row.resolver,
-      reason: row.reason,
-      decidedAt: row.decided_at,
-    }).pipe(
+  ): Effect.Effect<ApprovalDecisionIntent, LedgerError> =>
+    decodeApprovalFact(row).pipe(
       Effect.mapError((error) =>
         corruptionFailure(
           operation,
@@ -1014,9 +924,8 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         ),
       ),
     );
-  });
 
-  const readUnknownResolutions = Effect.fn("DoSubmissionLedger.readUnknownResolutions")(function* (
+  const readUnknownResolutions = Effect.fnUntraced(function* (
     operation: string,
     submissionId: string,
   ): Effect.fn.Return<ReadonlyArray<UnknownResolutionRow>, LedgerError> {
@@ -1027,13 +936,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     );
   });
 
-  const unknownResolutionIntentFromRow = Effect.fn(
-    "DoSubmissionLedger.unknownResolutionIntentFromRow",
-  )(function* (
+  const unknownResolutionIntentFromRow = Effect.fnUntraced(function* (
     operation: string,
     row: UnknownResolutionRow,
   ): Effect.fn.Return<UnknownResolutionIntent, LedgerError> {
-    const resolution = yield* parseStoredJsonText(row.resolution_json).pipe(
+    return yield* decodeResolutionFact(row).pipe(
       Effect.mapError((error) =>
         corruptionFailure(
           operation,
@@ -1043,57 +950,37 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         ),
       ),
     );
+  });
+
+  /** The Submission's marked-unknown open Tool Call identities, empty when never marked. */
+  const storedUnknownToolCallIds = Effect.fnUntraced(function* (
+    operation: string,
+    submission: SubmissionRow,
+  ): Effect.fn.Return<ReadonlyArray<typeof ToolCallIdSchema.Type>, LedgerError> {
+    if (submission.unknown_tool_call_ids_json === null) return [];
 
-    return yield* decodeUnknownResolutionIntent({
-      submissionId: row.submission_id,
-      toolCallId: row.tool_call_id,
-      author: row.author,
-      reason: row.reason,
-      resolution,
-      resolvedAt: row.resolved_at,
-    }).pipe(
+    return yield* decodeToolCallIdsText(submission.unknown_tool_call_ids_json).pipe(
       Effect.mapError((error) =>
         corruptionFailure(
           operation,
-          "effect_agent_unknown_resolutions",
-          `${row.submission_id}/${row.tool_call_id}`,
+          "effect_agent_submissions",
+          submission.submission_id,
           error.message,
         ),
       ),
     );
   });
 
-  /** The Submission's marked-unknown open Tool Call identities, empty when never marked. */
-  const storedUnknownToolCallIds = Effect.fn("DoSubmissionLedger.storedUnknownToolCallIds")(
-    function* (
-      operation: string,
-      submission: SubmissionRow,
-    ): Effect.fn.Return<ReadonlyArray<typeof ToolCallIdSchema.Type>, LedgerError> {
-      if (submission.unknown_tool_call_ids_json === null) return [];
-
-      return yield* decodeToolCallIdsText(submission.unknown_tool_call_ids_json).pipe(
-        Effect.mapError((error) =>
-          corruptionFailure(
-            operation,
-            "effect_agent_submissions",
-            submission.submission_id,
-            error.message,
-          ),
-        ),
-      );
-    },
-  );
-
   /**
    * Canonical history is the abort authority (DUR-015): the intent's canonicalRecordId is
    * derived from the shared canonical-records table using the deterministic abort record
    * identity, never from a cached ledger marker.
    */
-  const canonicalAbortRecordId = Effect.fn("DoSubmissionLedger.canonicalAbortRecordId")(function* (
+  const canonicalAbortRecordId = Effect.fnUntraced(function* (
     operation: string,
     threadId: string,
     submissionId: SubmissionId,
-  ): Effect.fn.Return<string | undefined, LedgerError> {
+  ): Effect.fn.Return<AbortIntent["canonicalRecordId"], LedgerError> {
     const recordId = submissionAbortRecordId(submissionId);
 
     const present = yield* journal
@@ -1103,7 +990,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     return present ? recordId : undefined;
   });
 
-  const abortIntentFromRow = Effect.fn("DoSubmissionLedger.abortIntentFromRow")(function* (
+  const abortIntentFromRow = Effect.fnUntraced(function* (
     operation: string,
     submission: SubmissionRow,
     submissionId: SubmissionId,
@@ -1115,13 +1002,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       submissionId,
     );
 
-    return yield* decodeAbortIntent({
-      submissionId: row.submission_id,
-      author: row.author,
-      reason: row.reason,
-      requestedAt: row.requested_at,
-      ...(canonicalRecordId === undefined ? {} : { canonicalRecordId }),
-    }).pipe(
+    const fact = yield* decodeAbortFact(row).pipe(
       Effect.mapError((error) =>
         corruptionFailure(
           operation,
@@ -1131,6 +1012,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         ),
       ),
     );
+
+    return AbortIntent.make({
+      ...fact,
+      ...(canonicalRecordId === undefined ? {} : { canonicalRecordId }),
+    });
   });
 
   // Durable Object storage is the single serialized owner: writes confirm through output
@@ -1140,257 +1026,254 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     LedgerCapabilities.make({ durability: "durable-cloudflare" }),
   );
 
-  const admit: SubmissionLedger["Service"]["admit"] = Effect.fn("DoSubmissionLedger.admit")(
-    function* (request: AdmissionRequest) {
-      const operation = "ledger admit";
-
-      const validated = yield* Schema.decodeEffect(Schema.toType(AdmissionRequest))(request).pipe(
-        Effect.mapError(internalFailure(operation)),
-      );
-
-      const inputJson = yield* encodePersistedJsonText(validated.inputPayload).pipe(
-        Effect.mapError(internalFailure(operation)),
-      );
+  const admit: SubmissionLedger["Service"]["admit"] = Effect.fnUntraced(function* (
+    request: AdmissionRequest,
+  ) {
+    const operation = "ledger admit";
 
-      // The platform's ~2 MB per-value bound, refused typed BEFORE any durable mutation
-      // (resource-limits gate; oversized payloads are the designed R2 overflow path).
-      yield* journal
-        .checkValueBound(operation, inputJson)
-        .pipe(Effect.mapError(internalFailure(operation)));
+    const validated = yield* Schema.decodeEffect(Schema.toType(AdmissionRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
-      const workerAdmissionJson =
-        validated.workerAdmission === undefined
-          ? null
-          : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(
-              validated.workerAdmission,
-            ).pipe(Effect.mapError(internalFailure(operation)));
+    const inputJson = yield* encodePersistedJsonText(validated.inputPayload).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
-      if (
-        workerAdmissionJson !== null &&
-        new TextEncoder().encode(workerAdmissionJson).byteLength > config.maxStoredValueBytes
-      ) {
-        return yield* LedgerError.make({
-          operation,
-          message: "Worker admission metadata exceeds the stored value bound",
-        });
-      }
+    // The platform's ~2 MB per-value bound, refused typed BEFORE any durable mutation
+    // (resource-limits gate; oversized payloads are the designed R2 overflow path).
+    yield* journal
+      .checkValueBound(operation, inputJson)
+      .pipe(Effect.mapError(internalFailure(operation)));
 
-      const messageAdmissionJson =
-        validated.messageAdmission === undefined
-          ? null
-          : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(
-              validated.messageAdmission,
-            ).pipe(Effect.mapError(internalFailure(operation)));
+    const workerAdmissionJson =
+      validated.workerAdmission === undefined
+        ? null
+        : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(
+            validated.workerAdmission,
+          ).pipe(Effect.mapError(internalFailure(operation)));
 
-      if (
-        messageAdmissionJson !== null &&
-        new TextEncoder().encode(messageAdmissionJson).byteLength > config.maxStoredValueBytes
-      ) {
-        return yield* LedgerError.make({
-          operation,
-          message: "Message admission metadata exceeds the stored value bound",
-        });
-      }
+    if (
+      workerAdmissionJson !== null &&
+      new TextEncoder().encode(workerAdmissionJson).byteLength > config.maxStoredValueBytes
+    ) {
+      return yield* LedgerError.make({
+        operation,
+        message: "Worker admission metadata exceeds the stored value bound",
+      });
+    }
 
-      const agentDigestsJson = yield* encodeDefinitionDigestsText(validated.agentDigests).pipe(
-        Effect.mapError(internalFailure(operation)),
-      );
+    const messageAdmissionJson =
+      validated.messageAdmission === undefined
+        ? null
+        : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(
+            validated.messageAdmission,
+          ).pipe(Effect.mapError(internalFailure(operation)));
 
-      // Routable Submission identity (D-P6-5): `{uuidv7}:{threadId}`. The cross-DO
-      // routing layer parses ITS OWN minted format (split at the first ":") to address
-      // submissionId-only operations to the owning Thread Object; the id stays opaque
-      // to every other component, exactly like DN's `submission-{uuid}` prefix.
-      const mintedSubmissionId = `${yield* mintUuid(operation)}:${validated.threadId}`;
+    if (
+      messageAdmissionJson !== null &&
+      new TextEncoder().encode(messageAdmissionJson).byteLength > config.maxStoredValueBytes
+    ) {
+      return yield* LedgerError.make({
+        operation,
+        message: "Message admission metadata exceeds the stored value bound",
+      });
+    }
 
-      if (mintedSubmissionId.length > MAX_IDENTIFIER_LENGTH) {
-        return yield* LedgerError.make({
-          operation,
-          message:
-            `A routable Submission identity of ${mintedSubmissionId.length} characters exceeds ` +
-            `the ${MAX_IDENTIFIER_LENGTH}-character ledger row bound; shorten the Thread identity.`,
-        });
-      }
-      const mintedReceiptId = `receipt-${yield* mintUuid(operation)}`;
+    const agentDigestsJson = yield* encodeDefinitionDigestsText(validated.agentDigests).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
-      yield* hitFailpoint("ledger:admit:before", operation);
+    // Routable Submission identity (D-P6-5): `{uuidv7}:{threadId}`. The cross-DO
+    // routing layer parses ITS OWN minted format (split at the first ":") to address
+    // submissionId-only operations to the owning Thread Object; the id stays opaque
+    // to every other component, exactly like DN's `submission-{uuid}` prefix.
+    const mintedSubmissionId = `${yield* mintUuid(operation)}:${validated.threadId}`;
 
-      const result = yield* inWriteTransaction(
+    if (mintedSubmissionId.length > MAX_IDENTIFIER_LENGTH) {
+      return yield* LedgerError.make({
         operation,
-        Effect.gen(function* () {
-          const keyRowKey = `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`;
+        message:
+          `A routable Submission identity of ${mintedSubmissionId.length} characters exceeds ` +
+          `the ${MAX_IDENTIFIER_LENGTH}-character ledger row bound; shorten the Thread identity.`,
+      });
+    }
+    const mintedReceiptId = `receipt-${yield* mintUuid(operation)}`;
 
-          const existingRows = yield* byKey(validated, operation);
+    yield* hitFailpoint("ledger:admit:before", operation);
 
-          const existing = yield* decodeSubmissionRows(operation, keyRowKey, existingRows);
+    const result = yield* inWriteTransaction(
+      operation,
+      Effect.gen(function* () {
+        const keyRowKey = `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`;
 
-          if (existing.length > 1) {
-            return yield* corruptionFailure(
-              operation,
-              "effect_agent_submissions",
-              keyRowKey,
-              "An admission idempotency key returned more than one row.",
-            );
-          }
-          if (existing.length === 1) {
-            // A replay must repeat the exact canonical input AND the exact parent linkage (or
-            // its absence): linkage is immutable child lineage (spec §12 step 5, SUB-016).
-            const sameLinkage =
-              validated.parentLinkage === undefined
-                ? existing[0].parent_submission_id === null &&
-                  existing[0].parent_tool_call_id === null
-                : existing[0].parent_submission_id === validated.parentLinkage.parentSubmissionId &&
-                  existing[0].parent_tool_call_id === validated.parentLinkage.parentToolCallId;
-
-            if (existing[0].input_digest !== validated.inputDigest || !sameLinkage) {
-              return yield* AdmissionConflict.make({
-                threadId: validated.threadId,
-                principal: validated.principal,
-                idempotencyKey: validated.idempotencyKey,
-                existingInputDigest: existing[0].input_digest,
-                attemptedInputDigest: validated.inputDigest,
-              });
-            }
+        const existingRows = yield* byKey(validated, operation);
 
-            const retainedWorkerAdmission =
-              existing[0].worker_admission_json === null
-                ? undefined
-                : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(
-                    existing[0].worker_admission_json,
-                  ).pipe(Effect.mapError(internalFailure(operation)));
+        const existing = yield* decodeSubmissionRows(operation, keyRowKey, existingRows);
 
-            const retainedInputMessage =
-              existing[0].message_admission_json === null
-                ? undefined
-                : yield* Schema.decodeEffect(Schema.fromJsonString(InputMessage))(
-                    existing[0].message_admission_json,
-                  ).pipe(Effect.mapError(internalFailure(operation)));
+        if (existing.length > 1) {
+          return yield* corruptionFailure(
+            operation,
+            "effect_agent_submissions",
+            keyRowKey,
+            "An admission idempotency key returned more than one row.",
+          );
+        }
+        if (existing.length === 1) {
+          // A replay must repeat the exact canonical input AND the exact parent linkage (or
+          // its absence): linkage is immutable child lineage (spec §12 step 5, SUB-016).
+          const sameLinkage =
+            validated.parentLinkage === undefined
+              ? existing[0].parent_submission_id === null &&
+                existing[0].parent_tool_call_id === null
+              : existing[0].parent_submission_id === validated.parentLinkage.parentSubmissionId &&
+                existing[0].parent_tool_call_id === validated.parentLinkage.parentToolCallId;
+
+          if (existing[0].input_digest !== validated.inputDigest || !sameLinkage) {
+            return yield* AdmissionConflict.make({
+              threadId: validated.threadId,
+              principal: validated.principal,
+              idempotencyKey: validated.idempotencyKey,
+              existingInputDigest: existing[0].input_digest,
+              attemptedInputDigest: validated.inputDigest,
+            });
+          }
 
-            const retainedFence =
-              existing[0].admission_fence_json === null
-                ? undefined
-                : yield* Schema.decodeEffect(Schema.fromJsonString(AdmissionFence))(
-                    existing[0].admission_fence_json,
-                  ).pipe(Effect.mapError(internalFailure(operation)));
+          const retainedWorkerAdmission =
+            existing[0].worker_admission_json === null
+              ? undefined
+              : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(
+                  existing[0].worker_admission_json,
+                ).pipe(Effect.mapError(internalFailure(operation)));
+
+          const retainedInputMessage =
+            existing[0].message_admission_json === null
+              ? undefined
+              : yield* Schema.decodeEffect(Schema.fromJsonString(InputMessage))(
+                  existing[0].message_admission_json,
+                ).pipe(Effect.mapError(internalFailure(operation)));
+
+          const retainedFence =
+            existing[0].admission_fence_json === null
+              ? undefined
+              : yield* Schema.decodeEffect(Schema.fromJsonString(AdmissionFence))(
+                  existing[0].admission_fence_json,
+                ).pipe(Effect.mapError(internalFailure(operation)));
 
-            if (
-              (existing[0].admission_group ?? undefined) !== validated.admissionGroup ||
-              !Schema.toEquivalence(Schema.optional(WorkerAdmission))(
-                retainedWorkerAdmission,
-                validated.workerAdmission,
-              ) ||
-              !Schema.toEquivalence(Schema.optional(InputMessage))(
-                retainedInputMessage,
-                validated.messageAdmission,
-              ) ||
-              !Schema.toEquivalence(Schema.optional(AdmissionFence))(
-                retainedFence,
-                validated.admissionFence,
-              )
+          if (
+            (existing[0].admission_group ?? undefined) !== validated.admissionGroup ||
+            !Schema.toEquivalence(Schema.optional(WorkerAdmission))(
+              retainedWorkerAdmission,
+              validated.workerAdmission,
+            ) ||
+            !Schema.toEquivalence(Schema.optional(InputMessage))(
+              retainedInputMessage,
+              validated.messageAdmission,
+            ) ||
+            !Schema.toEquivalence(Schema.optional(AdmissionFence))(
+              retainedFence,
+              validated.admissionFence,
             )
-              return yield* AdmissionConflict.make({
-                threadId: validated.threadId,
-                principal: validated.principal,
-                idempotencyKey: validated.idempotencyKey,
-                existingInputDigest: existing[0].input_digest,
-                attemptedInputDigest: validated.inputDigest,
-              });
+          )
+            return yield* AdmissionConflict.make({
+              threadId: validated.threadId,
+              principal: validated.principal,
+              idempotencyKey: validated.idempotencyKey,
+              existingInputDigest: existing[0].input_digest,
+              attemptedInputDigest: validated.inputDigest,
+            });
 
-            return yield* decodeAdmissionResult({
-              submissionId: existing[0].submission_id,
-              receiptId: existing[0].receipt_id,
-              queueSequence: existing[0].queue_sequence,
-              state: existing[0].state,
-              replayed: true,
-            }).pipe(Effect.mapError(internalFailure(operation)));
-          }
+          return yield* decodeAdmissionResult({
+            submissionId: existing[0].submission_id,
+            receiptId: existing[0].receipt_id,
+            queueSequence: existing[0].queue_sequence,
+            state: existing[0].state,
+            replayed: true,
+          }).pipe(Effect.mapError(internalFailure(operation)));
+        }
 
-          const stopped = yield* cached(
-            rows.workerStops.by("thread_id", validated.threadId),
+        if (!admissionFitsTransfer(validated.threadId, validated))
+          return yield* LedgerError.make({
             operation,
-          );
-
-          if (stopped.length > 0)
-            return yield* AdmissionPolicyError.make({ reason: "refused", code: "worker-stopped" });
+            message: "Admission exceeds the complete transfer page byte bound",
+          });
 
-          // The first accepted input fixes ordinary/worker lane identity atomically with admission.
-          // Canonical origin materialization can lag admission; a log scan cannot fence that race.
-          const lane = yield* laneWork(validated.threadId, operation);
+        const stopped = yield* cached(
+          rows.workerStops.by("thread_id", validated.threadId),
+          operation,
+        );
 
-          const firstRows =
-            lane === undefined
-              ? yield* sql<Record<string, unknown>>`
+        if (stopped.length > 0)
+          return yield* AdmissionPolicyError.make({ reason: "refused", code: "worker-stopped" });
+
+        // The first accepted input fixes ordinary/worker lane identity atomically with admission.
+        // Canonical origin materialization can lag admission; a log scan cannot fence that race.
+        const firstRows = yield* sql<Record<string, unknown>>`
             SELECT worker_admission_json FROM effect_agent_submissions
             WHERE thread_id=${validated.threadId} ORDER BY queue_sequence LIMIT 1
-          `.pipe(Effect.mapError(sqlFailure(operation)))
-              : lane[0] === undefined
-                ? []
-                : [yield* requireSubmission(operation, lane[0].submission_id)];
-
-          const first = yield* Schema.decodeUnknownEffect(
-            Schema.Array(
-              Schema.Struct({
-                worker_admission_json: Schema.NullOr(BoundedStoredText),
-              }),
-            ),
-          )(firstRows).pipe(Effect.mapError(internalFailure(operation)));
+          `.pipe(Effect.mapError(sqlFailure(operation)));
 
-          if (first[0] !== undefined) {
-            const previous =
-              first[0].worker_admission_json === null
-                ? undefined
-                : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(
-                    first[0].worker_admission_json,
-                  ).pipe(Effect.mapError(internalFailure(operation)));
+        const first = yield* Schema.decodeUnknownEffect(
+          Schema.Array(
+            Schema.Struct({
+              worker_admission_json: Schema.NullOr(BoundedStoredText),
+            }),
+          ),
+        )(firstRows).pipe(Effect.mapError(internalFailure(operation)));
 
-            if (
-              !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
-                previous?.origin,
-                validated.workerAdmission?.origin,
-              )
+        if (first[0] !== undefined) {
+          const previous =
+            first[0].worker_admission_json === null
+              ? undefined
+              : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(
+                  first[0].worker_admission_json,
+                ).pipe(Effect.mapError(internalFailure(operation)));
+
+          if (
+            !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
+              previous?.origin,
+              validated.workerAdmission?.origin,
             )
-              return yield* AdmissionPolicyError.make({
-                reason: "refused",
-                code: "worker-origin-conflict",
-              });
-          }
+          )
+            return yield* AdmissionPolicyError.make({
+              reason: "refused",
+              code: "worker-origin-conflict",
+            });
+        }
 
-          yield* admissionFence.check(validated);
-          if (validated.admissionGroup !== undefined) {
-            const occupied = yield* sql<Record<string, unknown>>`
+        yield* admissionFence.check(validated);
+        if (validated.admissionGroup !== undefined) {
+          const occupied = yield* sql<Record<string, unknown>>`
               SELECT submission_id FROM effect_agent_submissions
               WHERE thread_id=${validated.threadId} AND admission_group=${validated.admissionGroup} AND state<>'settled' LIMIT 1
             `.pipe(Effect.mapError(sqlFailure(operation)));
 
-            if (occupied.length > 0)
-              return yield* AdmissionPolicyError.make({
-                reason: "occupied",
-                code: "admission-group",
-              });
-          }
+          if (occupied.length > 0)
+            return yield* AdmissionPolicyError.make({
+              reason: "occupied",
+              code: "admission-group",
+            });
+        }
 
-          const maxRows =
-            lane === undefined
-              ? yield* sql<Record<string, unknown>>`
+        const maxRows = yield* sql<Record<string, unknown>>`
             SELECT COALESCE(MAX(queue_sequence), 0) AS max_queue_sequence
             FROM effect_agent_submissions
             WHERE thread_id = ${validated.threadId}
-          `.pipe(Effect.mapError(sqlFailure(operation)))
-              : [{ max_queue_sequence: lane.at(-1)?.queue_sequence ?? 0 }];
+          `.pipe(Effect.mapError(sqlFailure(operation)));
 
-          const decodedMax = yield* decodeRows(
-            Schema.Array(MaxQueueSequenceRow),
-            "effect_agent_submissions",
-            validated.threadId,
-            maxRows,
-          ).pipe(Effect.mapError(internalFailure(operation)));
+        const decodedMax = yield* decodeRows(
+          Schema.Array(MaxQueueSequenceRow),
+          "effect_agent_submissions",
+          validated.threadId,
+          maxRows,
+        ).pipe(Effect.mapError(internalFailure(operation)));
 
-          const queueSequence = yield* decodeQueueSequence(
-            (decodedMax[0]?.max_queue_sequence ?? 0) + 1,
-          ).pipe(Effect.mapError(internalFailure(operation)));
+        const queueSequence = yield* decodeQueueSequence(
+          (decodedMax[0]?.max_queue_sequence ?? 0) + 1,
+        ).pipe(Effect.mapError(internalFailure(operation)));
 
-          const now = yield* currentInstant;
+        const now = yield* currentInstant;
 
-          yield* sql`
+        yield* sql`
             INSERT INTO effect_agent_submissions (
               submission_id,
               thread_id,
@@ -1398,7 +1281,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               principal,
               idempotency_key,
               agent_id,
-              agent_digests_json,
+              definition_key,
               deployment_id,
               input_json,
               input_digest,
@@ -1418,7 +1301,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               ${validated.principal},
               ${validated.idempotencyKey},
               ${validated.agentId},
-              ${agentDigestsJson},
+              ${yield* physical.definition(agentDigestsJson).pipe(Effect.mapError(internalFailure(operation)))},
               ${validated.deploymentId},
               ${inputJson},
               ${validated.inputDigest},
@@ -1432,40 +1315,51 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               ${workerAdmissionJson},
               ${messageAdmissionJson}
             )
-           RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+           RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+          rows.submissions.write,
+          Effect.mapError(internalFailure(operation)),
+        );
 
-          // The INSERT (never replay or hydration) proves these new submission-owned sets
-          // empty. Gated writes update them; rollback/invalidation discards that proof.
-          rows.aborts.seed("submission_id", mintedSubmissionId, []);
-          rows.ownership.seed("submission_id", mintedSubmissionId, []);
-          rows.reservations.seed("submission_id", mintedSubmissionId, []);
-          rows.submissions.seed("joined_host_submission_id", mintedSubmissionId, []);
-          rows.approvals.seed("submission_id", mintedSubmissionId, []);
-          rows.resolutions.seed("submission_id", mintedSubmissionId, []);
-          rows.childReservations.seed("parent_submission_id", mintedSubmissionId, []);
-          rows.childSettlements.seed("parent_submission_id", mintedSubmissionId, []);
+        if (queueSequence === 1) {
+          const threads = yield* journal
+            .getThread(validated.threadId)
+            .pipe(Effect.mapError(internalFailure(operation)));
 
-          yield* recordProgress("submission", operation);
+          if (threads.length === 0)
+            yield* journal.work
+              .initialize(validated.threadId)
+              .pipe(Effect.mapError(internalFailure(operation)));
+        }
 
-          return yield* decodeAdmissionResult({
-            submissionId: mintedSubmissionId,
-            receiptId: mintedReceiptId,
-            queueSequence,
-            state: "admitted",
-            replayed: false,
-          }).pipe(Effect.mapError(internalFailure(operation)));
-        }),
-      );
+        // The INSERT (never replay or hydration) proves these new submission-owned sets
+        // empty. Gated writes update them; rollback/invalidation discards that proof.
+        rows.aborts.seed("submission_id", mintedSubmissionId, []);
+        rows.submissions.seed("joined_host_submission_id", mintedSubmissionId, []);
+        rows.approvals.seed("submission_id", mintedSubmissionId, []);
+        rows.resolutions.seed("submission_id", mintedSubmissionId, []);
+        rows.childReservations.seed("parent_submission_id", mintedSubmissionId, []);
+        rows.childSettlements.seed("parent_submission_id", mintedSubmissionId, []);
 
-      yield* hitFailpoint("ledger:admit:after", operation);
+        yield* recordProgress("submission", operation);
 
-      return result;
-    },
-  );
+        return yield* decodeAdmissionResult({
+          submissionId: mintedSubmissionId,
+          receiptId: mintedReceiptId,
+          queueSequence,
+          state: "admitted",
+          replayed: false,
+        }).pipe(Effect.mapError(internalFailure(operation)));
+      }),
+    );
 
-  const markReady: SubmissionLedger["Service"]["markReady"] = Effect.fn(
-    "DoSubmissionLedger.markReady",
-  )(function* (request: MarkReadyRequest) {
+    yield* hitFailpoint("ledger:admit:after", operation);
+
+    return result;
+  });
+
+  const markReady: SubmissionLedger["Service"]["markReady"] = Effect.fnUntraced(function* (
+    request: MarkReadyRequest,
+  ) {
     const operation = "ledger mark ready";
 
     const validated = yield* Schema.decodeEffect(Schema.toType(MarkReadyRequest))(request).pipe(
@@ -1485,7 +1379,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           UPDATE effect_agent_submissions
           SET state = 'ready', ready_at = ${now.iso}
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+          rows.submissions.write,
+          Effect.mapError(internalFailure(operation)),
+        );
         yield* recordProgress("submission", operation);
         yield* retainLifecycle(submission, {
           _tag: "SubmissionReady",
@@ -1496,56 +1393,82 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     yield* hitFailpoint("ledger:mark-ready:after", operation);
   });
 
-  const lookup: SubmissionLedger["Service"]["lookup"] = Effect.fn("DoSubmissionLedger.lookup")(
-    function* (request: SubmissionLookup) {
-      const operation = "ledger lookup";
+  const resolveFundingOwner: NonNullable<SubmissionLedger["Service"]["resolveFundingOwner"]> =
+    Effect.fnUntraced(function* (input) {
+      const operation = "resolve funding owner";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookup))(request).pipe(
+      const request = yield* Schema.decodeEffect(FundingOwnerRequest)(input).pipe(
         Effect.mapError(internalFailure(operation)),
       );
 
-      if (validated._tag === "SubmissionLookupById") {
-        const row = yield* readSubmission(operation, validated.submissionId);
-
-        if (Option.isNone(row)) return Option.none();
-
-        return Option.some(yield* decodeSubmissionSnapshot(operation, row.value));
-      }
+      const selected = yield* requireSubmission(operation, request.submissionId);
 
-      const foundRows = yield* byKey(validated, operation);
+      if (selected.thread_id !== request.threadId)
+        return yield* LedgerError.make({
+          operation,
+          message: "Selected funding input belongs to another Thread.",
+        });
+      if (selected.state === "joining")
+        return yield* LedgerError.make({
+          operation,
+          message: "Selected funding input is still joining; retry after durable binding.",
+        });
+      const hostId = selected.joined_host_submission_id;
 
-      const decoded = yield* decodeSubmissionRows(
-        operation,
-        `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
-        foundRows,
-      );
+      if (hostId === null && selected.state === "joined")
+        return yield* corruptionFailure(
+          operation,
+          "effect_agent_submissions",
+          selected.submission_id,
+          "Joined input has no stable host identity.",
+        );
+      if (hostId !== null && selected.state !== "joined" && selected.state !== "settled")
+        return yield* corruptionFailure(
+          operation,
+          "effect_agent_submissions",
+          selected.submission_id,
+          "Host linkage is inconsistent with selected input state.",
+        );
+      const owner = hostId === null ? selected : yield* requireSubmission(operation, hostId);
 
-      if (decoded.length > 1) {
+      if (
+        owner.thread_id !== request.threadId ||
+        (hostId !== null &&
+          (owner.submission_id === selected.submission_id ||
+            owner.joined_host_submission_id !== null ||
+            owner.state === "joining" ||
+            owner.state === "joined" ||
+            owner.queue_sequence >= selected.queue_sequence))
+      )
         return yield* corruptionFailure(
           operation,
           "effect_agent_submissions",
-          `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
-          "An admission idempotency key returned more than one row.",
+          selected.submission_id,
+          "Funding host is not a stable earlier input in this Thread.",
         );
-      }
-      if (decoded.length === 0) return Option.none();
 
-      return Option.some(yield* decodeSubmissionSnapshot(operation, decoded[0]));
-    },
-  );
+      return yield* Schema.decodeEffect(Schema.toType(FundingOwner))({
+        selected: yield* decodeSubmissionSnapshot(operation, selected),
+        owner: yield* decodeSubmissionSnapshot(operation, owner),
+      }).pipe(Effect.mapError(internalFailure(operation)));
+    }, state.read);
 
-  // This LOCAL facet is the authoritative owner of every Thread stored in this Durable
-  // Object, so the key-scoped read IS the admission truth and the tri-state degenerates to
-  // NotAdmitted or Admitted (SUB-031). `AdmissionIndeterminate` becomes real one layer out:
-  // the WP2 routed decorator answers it when the OWNING Durable Object is unreachable.
-  const resolveAdmission: SubmissionLedger["Service"]["resolveAdmission"] = Effect.fn(
-    "DoSubmissionLedger.resolveAdmission",
-  )(function* (request: SubmissionLookupByKey) {
-    const operation = "ledger resolve admission";
+  const lookup: SubmissionLedger["Service"]["lookup"] = Effect.fnUntraced(function* (
+    request: SubmissionLookup,
+  ) {
+    const operation = "ledger lookup";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookupByKey))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+    const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookup))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
+
+    if (validated._tag === "SubmissionLookupById") {
+      const row = yield* readSubmission(operation, validated.submissionId);
+
+      if (Option.isNone(row)) return Option.none();
+
+      return Option.some(yield* decodeSubmissionSnapshot(operation, row.value));
+    }
 
     const foundRows = yield* byKey(validated, operation);
 
@@ -1563,76 +1486,66 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         "An admission idempotency key returned more than one row.",
       );
     }
-    if (decoded.length === 0) return AdmissionNotAdmitted.make();
+    if (decoded.length === 0) return Option.none();
 
-    return AdmissionAdmitted.make({
-      submission: yield* decodeSubmissionSnapshot(operation, decoded[0]),
-    });
+    return Option.some(yield* decodeSubmissionSnapshot(operation, decoded[0]));
   });
 
-  const claim: SubmissionLedger["Service"]["claim"] = Effect.fn("DoSubmissionLedger.claim")(
-    function* (request: ClaimRequest) {
-      const operation = "ledger claim";
+  // This LOCAL facet is the authoritative owner of every Thread stored in this Durable
+  // Object, so the key-scoped read IS the admission truth and the tri-state degenerates to
+  // NotAdmitted or Admitted (SUB-031). `AdmissionIndeterminate` becomes real one layer out:
+  // the WP2 routed decorator answers it when the OWNING Durable Object is unreachable.
+  const resolveAdmission: SubmissionLedger["Service"]["resolveAdmission"] = Effect.fnUntraced(
+    function* (request: SubmissionLookupByKey) {
+      const operation = "ledger resolve admission";
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookupByKey))(
+        request,
+      ).pipe(Effect.mapError(internalFailure(operation)));
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(ClaimRequest))(request).pipe(
-        Effect.mapError(internalFailure(operation)),
+      const foundRows = yield* byKey(validated, operation);
+
+      const decoded = yield* decodeSubmissionRows(
+        operation,
+        `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
+        foundRows,
       );
 
-      const attemptId = `attempt-${yield* mintUuid(operation)}`;
-      const ownershipToken = `owner-${yield* mintUuid(operation)}`;
+      if (decoded.length > 1) {
+        return yield* corruptionFailure(
+          operation,
+          "effect_agent_submissions",
+          `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
+          "An admission idempotency key returned more than one row.",
+        );
+      }
+      if (decoded.length === 0) return AdmissionNotAdmitted.make();
+
+      return AdmissionAdmitted.make({
+        submission: yield* decodeSubmissionSnapshot(operation, decoded[0]),
+      });
+    },
+  );
 
-      yield* hitFailpoint("ledger:claim:before", operation);
+  const selectHead: SubmissionLedger["Service"]["selectHead"] = Effect.fn(
+    "DoSubmissionLedger.selectHead",
+  )(function* (request: ClaimRequest) {
+    const operation = "ledger select head";
 
-      const claimed = yield* inWriteTransaction(
-        operation,
-        Effect.gen(function* () {
-          const now = yield* currentInstant;
+    const validated = yield* Schema.decodeEffect(Schema.toType(ClaimRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
-          // Ownership belongs to the whole Thread, including unknown work skipped below.
-          // Stored lease instants are normalized UTC strings, so the latest expiry covers
-          // every live lease. This check and the epoch grant share one write transaction.
-          const lane = yield* laneWork(validated.threadId, operation);
-
-          const ownershipRows =
-            lane === undefined
-              ? yield* sql<Record<string, unknown>>`
-            SELECT ownership.*
-            FROM effect_agent_submission_ownership AS ownership
-            JOIN effect_agent_submissions AS submission
-              ON submission.submission_id = ownership.submission_id
-            WHERE submission.thread_id = ${validated.threadId}
-            ORDER BY ownership.lease_expires_at DESC
-            LIMIT 1
-          `.pipe(Effect.mapError(sqlFailure(operation)))
-              : (yield* Effect.forEach(
-                  lane.filter((item) => item.state !== "settled"),
-                  (item) =>
-                    cached(rows.ownership.by("submission_id", item.submission_id), operation),
-                ))
-                  .flat()
-                  .sort((a, b) => b.lease_expires_at.localeCompare(a.lease_expires_at))
-                  .slice(0, 1);
-
-          const ownership = yield* decodeRows(
-            Schema.Array(OwnershipRow),
-            "effect_agent_submission_ownership",
-            validated.threadId,
-            ownershipRows,
-          ).pipe(Effect.mapError(internalFailure(operation)));
+    const attemptId = `attempt-${yield* mintUuid(operation)}`;
 
-          if (ownership.length > 0) {
-            const expiresAt = yield* timestampMillis(
-              operation,
-              ownership[0].submission_id,
-            )(ownership[0].lease_expires_at);
+    yield* hitFailpoint("ledger:claim:before", operation);
 
-            if (expiresAt > now.millis) return Option.none<Claim>();
-          }
+    const claimed = yield* owner.withMutation(
+      Effect.gen(function* () {
+        if (owner.hasOwner(validated.threadId)) return Option.none<Claim>();
 
-          const headRows =
-            lane === undefined
-              ? yield* sql<Record<string, unknown>>`
-            SELECT ${sql.literal(SUBMISSION_COLUMNS)}
+        const headRows = yield* sql<Record<string, unknown>>`
+            SELECT ${submissionColumns}
             FROM effect_agent_submissions
             WHERE thread_id = ${validated.threadId}
               AND state <> 'settled'
@@ -1644,533 +1557,330 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               )
             ORDER BY queue_sequence ASC
             LIMIT ${validated.handoff === undefined ? 1 : validated.handoff.deferredSubmissionIds.length + 1}
-          `.pipe(Effect.mapError(sqlFailure(operation)))
-              : yield* Effect.gen(function* () {
-                  const heads: Array<SubmissionRow> = [];
-
-                  for (const item of lane) {
-                    if (item.state === "settled") continue;
-                    if (
-                      item.state === "unknown" &&
-                      Option.isNone(yield* readAbortIntent(operation, item.submission_id))
-                    )
-                      continue;
-                    heads.push(yield* requireSubmission(operation, item.submission_id));
-                    if (
-                      heads.length >=
-                      (validated.handoff === undefined
-                        ? 1
-                        : validated.handoff.deferredSubmissionIds.length + 1)
-                    )
-                      break;
-                  }
-
-                  return heads;
-                });
+          `.pipe(Effect.mapError(sqlFailure(operation)));
 
-          const heads = yield* decodeSubmissionRows(operation, validated.threadId, headRows);
+        const heads = yield* decodeSubmissionRows(operation, validated.threadId, headRows);
 
-          if (heads.length === 0) return Option.none<Claim>();
-          let head = heads[0];
+        if (heads.length === 0) return Option.none<Claim>();
+        let head = heads[0];
 
-          if (validated.handoff !== undefined) {
-            const handoff = validated.handoff;
+        if (validated.handoff !== undefined) {
+          const handoff = validated.handoff;
 
-            for (const candidate of heads) {
-              if (candidate.submission_id === handoff.submissionId) {
-                head = candidate;
-                break;
-              }
-              if (
-                !handoff.deferredSubmissionIds.some((id) => id === candidate.submission_id) ||
-                candidate.state !== "input-applied" ||
-                Option.isSome(yield* readAbortIntent(operation, candidate.submission_id))
-              )
-                return Option.none<Claim>();
+          for (const candidate of heads) {
+            if (candidate.submission_id === handoff.submissionId) {
+              head = candidate;
+              break;
             }
             if (
-              head.submission_id !== handoff.submissionId ||
-              (head.state !== "ready" && head.state !== "running" && head.state !== "input-applied")
+              !handoff.deferredSubmissionIds.some((id) => id === candidate.submission_id) ||
+              candidate.state !== "input-applied" ||
+              Option.isSome(yield* readAbortIntent(operation, candidate.submission_id))
             )
               return Option.none<Claim>();
           }
-
-          // Approval/delegation suspension and joined work retain their queue barrier.
-          // Unknown work with an abort intent is selected for cleanup without Tool replay.
-          if (
-            head.state === "joining" ||
-            head.state === "joined" ||
-            head.state === "suspended" ||
-            (head.state === "unknown" &&
-              Option.isNone(yield* readAbortIntent(operation, head.submission_id)))
-          ) {
-            return Option.none<Claim>();
-          }
-
-          // Bump the Thread's producer epoch atomically with the claim so every stale
-          // Attempt is fenced out of canonical appends (DUR-006). A Thread that was
-          // never materialized (eviction between admission and materialization) is created
-          // here so recovery can claim first and re-materialize idempotently at this epoch.
-          const threads = yield* journal
-            .getThread(head.thread_id)
-            .pipe(Effect.mapError(internalFailure(operation)));
-
           if (
-            validated.handoff !== undefined &&
-            threads[0]?.producer_epoch !== validated.handoff.producerEpoch
+            head.submission_id !== handoff.submissionId ||
+            (head.state !== "ready" && head.state !== "input-applied")
           )
             return Option.none<Claim>();
+        }
 
-          let producerEpoch: number;
-
-          if (threads.length === 0) {
-            producerEpoch = 1;
-            yield* sql`
-              INSERT INTO effect_agent_threads (
-                thread_id,
-                created_at,
-                tail_sequence,
-                tail_digest,
-                producer_epoch
-              ) VALUES (
-                ${head.thread_id},
-                ${now.iso},
-                0,
-                ${EMPTY_TAIL_DIGEST},
-                ${producerEpoch}
-              )
-             RETURNING *`.pipe(rows.threads.write, Effect.mapError(internalFailure(operation)));
-          } else {
-            producerEpoch = threads[0].producer_epoch + 1;
-            yield* sql`
-              UPDATE effect_agent_threads
-              SET producer_epoch = ${producerEpoch}
-              WHERE thread_id = ${head.thread_id}
-             RETURNING *`.pipe(rows.threads.write, Effect.mapError(internalFailure(operation)));
-          }
-
-          const leaseExpiresAt = new Date(now.millis + config.ownershipLeaseDuration).toISOString();
-
-          yield* sql`
-            INSERT INTO effect_agent_submission_ownership (
-              submission_id,
-              attempt_id,
-              ownership_token,
-              producer_epoch,
-              owner_producer_id,
-              lease_expires_at
-            ) VALUES (
-              ${head.submission_id},
-              ${attemptId},
-              ${ownershipToken},
-              ${producerEpoch},
-              ${validated.producerId},
-              ${leaseExpiresAt}
-            )
-            ON CONFLICT (submission_id) DO UPDATE SET
-              attempt_id = excluded.attempt_id,
-              ownership_token = excluded.ownership_token,
-              producer_epoch = excluded.producer_epoch,
-              owner_producer_id = excluded.owner_producer_id,
-              lease_expires_at = excluded.lease_expires_at
-           RETURNING *`.pipe(rows.ownership.write, Effect.mapError(internalFailure(operation)));
-
-          yield* sql`
-            INSERT INTO effect_agent_attempts (
-              attempt_id,
-              submission_id,
-              thread_id,
-              owner_producer_id,
-              producer_epoch,
-              claimed_at
-            ) VALUES (
-              ${attemptId},
-              ${head.submission_id},
-              ${head.thread_id},
-              ${validated.producerId},
-              ${producerEpoch},
-              ${now.iso}
-            )
-          `.pipe(Effect.mapError(sqlFailure(operation)));
-
-          if (head.state === "ready") {
-            yield* sql`
-              UPDATE effect_agent_submissions
-              SET state = 'running'
-              WHERE submission_id = ${head.submission_id}
-             RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-          }
+        // Approval/delegation suspension and joined work retain their queue barrier.
+        // Unknown work with an abort intent is selected for cleanup without Tool replay.
+        if (
+          head.state === "joining" ||
+          head.state === "joined" ||
+          head.state === "suspended" ||
+          (head.state === "unknown" &&
+            Option.isNone(yield* readAbortIntent(operation, head.submission_id)))
+        ) {
+          return Option.none<Claim>();
+        }
 
-          const inputPayload = yield* parseStoredJsonText(head.input_json).pipe(
-            Effect.mapError((error) =>
-              corruptionFailure(
-                operation,
-                "effect_agent_submissions",
-                head.submission_id,
-                error.message,
-              ),
+        const inputPayload = yield* parseStoredJsonText(head.input_json).pipe(
+          Effect.mapError((error) =>
+            corruptionFailure(
+              operation,
+              "effect_agent_submissions",
+              head.submission_id,
+              error.message,
             ),
-          );
-
-          return Option.some(
-            yield* decodeClaim({
-              submissionId: head.submission_id,
-              attemptId,
-              ownershipToken,
-              producerEpoch,
-              leaseExpiresAt,
-              inputPayload,
-            }).pipe(Effect.mapError(internalFailure(operation))),
-          );
-        }),
-      );
-
-      yield* hitFailpoint("ledger:claim:after", operation);
-
-      return claimed;
-    },
-  );
-
-  const renewOwnership: SubmissionLedger["Service"]["renewOwnership"] = Effect.fn(
-    "DoSubmissionLedger.renewOwnership",
-  )(function* (request: RenewOwnershipRequest) {
-    const operation = "ledger renew ownership";
-
-    const validated = yield* Schema.decodeEffect(Schema.toType(RenewOwnershipRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
-
-    yield* hitFailpoint("ledger:renew:before", operation);
-
-    const renewal = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const submission = yield* requireSubmission(operation, validated.submissionId);
-
-        yield* requireOwnership(operation, submission, validated.ownershipToken);
-        const now = yield* currentInstant;
-        const leaseExpiresAt = new Date(now.millis + config.ownershipLeaseDuration).toISOString();
-
-        yield* sql`
-          UPDATE effect_agent_submission_ownership
-          SET lease_expires_at = ${leaseExpiresAt}
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.ownership.write, Effect.mapError(internalFailure(operation)));
+          ),
+        );
 
-        return yield* decodeOwnershipRenewal({
-          ownershipToken: validated.ownershipToken,
-          leaseExpiresAt,
-        }).pipe(Effect.mapError(internalFailure(operation)));
+        return Option.some(
+          yield* decodeClaim({
+            submissionId: head.submission_id,
+            attemptId,
+            inputPayload,
+          }).pipe(Effect.mapError(internalFailure(operation))),
+        );
       }),
     );
 
-    yield* hitFailpoint("ledger:renew:after", operation);
+    yield* hitFailpoint("ledger:claim:after", operation);
 
-    return renewal;
+    return claimed;
   });
 
-  const releaseOwnership: SubmissionLedger["Service"]["releaseOwnership"] = Effect.fnUntraced(
-    function* (request: ReleaseOwnershipRequest) {
-      const operation = "ledger release ownership";
+  const markInputApplied: SubmissionLedger["Service"]["markInputApplied"] = Effect.fnUntraced(
+    function* (request: MarkInputAppliedRequest) {
+      const operation = "ledger mark input applied";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseOwnershipRequest))(
+      const validated = yield* Schema.decodeEffect(Schema.toType(MarkInputAppliedRequest))(
         request,
       ).pipe(Effect.mapError(internalFailure(operation)));
 
-      yield* hitFailpoint("ledger:release:before", operation);
-      // Settlement and suspension already remove ownership. Cleanup can observe that without
-      // opening a transaction; an owned lane must still pass the atomic check below.
-      const current = yield* requireSubmission(operation, validated.submissionId);
-
-      yield* requireOwnership(operation, current, validated.ownershipToken);
+      yield* hitFailpoint("ledger:mark-input-applied:before", operation);
       yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
           const submission = yield* requireSubmission(operation, validated.submissionId);
 
-          yield* requireOwnership(operation, submission, validated.ownershipToken);
+          yield* requireOwner(operation, submission);
+          if (submission.input_applied_record_id !== null) {
+            if (
+              submission.input_applied_record_id === validated.recordId &&
+              submission.input_applied_sequence === validated.sequence
+            ) {
+              return;
+            }
+
+            return yield* corruptionFailure(
+              operation,
+              "effect_agent_submissions",
+              validated.submissionId,
+              "A different canonical input marker is already recorded for this Submission.",
+            );
+          }
           yield* sql`
-          DELETE FROM effect_agent_submission_ownership
+          UPDATE effect_agent_submissions
+          SET
+            input_applied_record_id = ${validated.recordId},
+            input_applied_sequence = ${validated.sequence},
+            state = CASE
+              WHEN state IN ('admitted', 'ready') THEN 'input-applied'
+              ELSE state
+            END
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.ownership.remove, Effect.mapError(internalFailure(operation)));
-          if (submission.state === "running") {
-            yield* sql`
-            UPDATE effect_agent_submissions
-            SET state = 'ready'
-            WHERE submission_id = ${validated.submissionId}
-           RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-          }
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+            rows.submissions.write,
+            Effect.mapError(internalFailure(operation)),
+          );
         }),
-        (error) => error._tag === "OwnershipLost",
       );
-      yield* hitFailpoint("ledger:release:after", operation);
+      yield* hitFailpoint("ledger:mark-input-applied:after", operation);
     },
-    withStorageSpan(
-      "DoSubmissionLedger.releaseOwnership",
-      (error) => error._tag === "OwnershipLost",
-    ),
   );
 
-  const markInputApplied: SubmissionLedger["Service"]["markInputApplied"] = Effect.fn(
-    "DoSubmissionLedger.markInputApplied",
-  )(function* (request: MarkInputAppliedRequest) {
-    const operation = "ledger mark input applied";
+  const publish: SettlementPublisher["Service"]["publish"] = Effect.fn(
+    "DoSubmissionLedger.publishSettlement",
+  )(function* (input) {
+    const operation = "publish settlement";
+    const { request, record, settlement } = yield* validatePublication(input);
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(MarkInputAppliedRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+    const prepared = yield* prepareCanonicalAppend(request.append).pipe(
+      Effect.provideService(Crypto.Crypto, crypto),
+    );
 
-    yield* hitFailpoint("ledger:mark-input-applied:before", operation);
-    yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const submission = yield* requireSubmission(operation, validated.submissionId);
-
-        yield* requireOwnership(operation, submission, validated.ownershipToken);
-        if (submission.input_applied_record_id !== null) {
-          if (
-            submission.input_applied_record_id === validated.recordId &&
-            submission.input_applied_sequence === validated.sequence
-          ) {
-            return;
-          }
-
-          return yield* corruptionFailure(
-            operation,
-            "effect_agent_submissions",
-            validated.submissionId,
-            "A different canonical input marker is already recorded for this Submission.",
-          );
-        }
-        yield* sql`
-          UPDATE effect_agent_submissions
-          SET
-            input_applied_record_id = ${validated.recordId},
-            input_applied_sequence = ${validated.sequence},
-            state = CASE
-              WHEN state IN ('admitted', 'ready', 'running') THEN 'input-applied'
-              ELSE state
-            END
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-      }),
-    );
-    yield* hitFailpoint("ledger:mark-input-applied:after", operation);
-  });
-
-  const reserveSettlement: SubmissionLedger["Service"]["reserveSettlement"] = Effect.fn(
-    "DoSubmissionLedger.reserveSettlement",
-  )(function* (request: SettlementReservation) {
-    const operation = "ledger reserve settlement";
-
-    const validated = yield* Schema.decodeEffect(Schema.toType(SettlementReservation))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+    const mapAppendError = (error: { readonly _tag: string; readonly message: string }) =>
+      ThreadStoreError.make({ operation, message: error.message, cause: error });
 
-    const recordJson = yield* encodeRecordEnvelopeText(validated.record).pipe(
-      Effect.mapError(internalFailure(operation)),
-    );
-
-    // The reserved record is appended canonically later; refuse over-bound payloads typed
-    // before the reservation row exists.
-    yield* journal
-      .checkValueBound(operation, recordJson)
-      .pipe(Effect.mapError(internalFailure(operation)));
-    yield* hitFailpoint("ledger:reserve-settlement:before", operation);
-
-    const reserved = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const existing = yield* readReservation(operation, validated.submissionId);
-
-        if (Option.isSome(existing)) {
-          const identical =
-            existing.value.settlement_id === validated.settlementId &&
-            existing.value.outcome === validated.outcome &&
-            existing.value.record_digest === validated.recordDigest &&
-            existing.value.record_json === recordJson;
-
-          if (!identical) {
-            return yield* SettlementConflict.make({
-              submissionId: validated.submissionId,
-              existingOutcome: existing.value.outcome,
-            });
-          }
-
-          const record = yield* decodeRecordEnvelopeText(existing.value.record_json).pipe(
-            Effect.mapError((error) =>
-              corruptionFailure(
-                operation,
-                "effect_agent_settlement_reservations",
-                validated.submissionId,
-                error.message,
-              ),
-            ),
-          );
-
-          return ReservedSettlement.make({
-            submissionId: validated.submissionId,
-            settlementId: validated.settlementId,
-            outcome: validated.outcome,
-            record,
-            recordDigest: validated.recordDigest,
-            replayed: true,
-          });
-        }
-
-        const submission = yield* requireSubmission(operation, validated.submissionId);
+    yield* journal.prepareAppend(prepared.raw).pipe(Effect.mapError(mapAppendError));
 
-        if (submission.state === "settled") {
-          if (submission.settled_outcome === null) {
-            return yield* corruptionFailure(
-              operation,
-              "effect_agent_submissions",
-              validated.submissionId,
-              "A settled Submission carries no terminal outcome.",
+    return yield* owner.withProgress(
+      request.append.threadId,
+      owner.withMutation(
+        Effect.gen(function* () {
+          yield* hitFailpoint("append:before", operation);
+
+          const result = yield* journal
+            .withWriteTransaction(operation)(
+              Effect.gen(function* () {
+                const submission = yield* requireSubmission(operation, request.submissionId);
+
+                if (submission.thread_id !== prepared.request.threadId)
+                  return yield* LedgerError.make({
+                    operation,
+                    message: "Settlement publication belongs to another Thread.",
+                  });
+                const snapshot = yield* decodeSubmissionSnapshot(operation, submission);
+
+                yield* validateCanonicalSettlement(record, snapshot);
+                const existing = yield* readCanonicalSettlement(operation, submission);
+                const thread = (yield* journal.getThread(prepared.request.threadId))[0];
+
+                if (thread === undefined)
+                  return yield* ThreadNotMaterialized.make({ threadId: prepared.request.threadId });
+
+                // Replay still requires authority: finalization releases Owned tokens, while
+                // retained host linkage or abort intent can authorize tokenless settled replay.
+                switch (request.authority._tag) {
+                  case "Owned":
+                    yield* requireOwner(operation, submission);
+                    yield* validateCanonicalSettlement(record, {
+                      submissionId: request.submissionId,
+                      receiptId: snapshot.receiptId,
+                      ...(settlement.outcome === "aborted" && settlement.runId === undefined
+                        ? {}
+                        : { runId: runIdForSubmission(request.submissionId) }),
+                    });
+                    break;
+                  case "Joined": {
+                    if (
+                      (submission.state !== "joined" &&
+                        !(submission.state === "settled" && existing !== undefined)) ||
+                      submission.joined_host_submission_id !== request.authority.hostSubmissionId
+                    )
+                      return yield* LedgerError.make({
+                        operation,
+                        message: "Submission is not joined to the named host.",
+                      });
+
+                    const host = yield* requireSubmission(
+                      operation,
+                      request.authority.hostSubmissionId,
+                    );
+
+                    if (host.thread_id !== submission.thread_id)
+                      return yield* LedgerError.make({
+                        operation,
+                        message: "Joined host belongs to another Thread.",
+                      });
+                    const canonicalHost = yield* readCanonicalSettlement(operation, host);
+
+                    if (canonicalHost === undefined)
+                      return yield* LedgerError.make({
+                        operation,
+                        message: "Joined host has no canonical settlement.",
+                      });
+                    yield* validateJoinedSettlement(settlement, canonicalHost.settlement);
+                    break;
+                  }
+                  case "QueuedAbort":
+                    if (
+                      (submission.state !== "ready" &&
+                        !(submission.state === "settled" && existing !== undefined)) ||
+                      settlement.outcome !== "aborted" ||
+                      Option.isNone(yield* readAbortIntent(operation, request.submissionId)) ||
+                      owner.hasOwner(submission.thread_id, request.submissionId)
+                    )
+                      return yield* LedgerError.make({
+                        operation,
+                        message: "Queued abort is no longer authorized.",
+                      });
+                    yield* validateCanonicalSettlement(record, {
+                      submissionId: request.submissionId,
+                      receiptId: snapshot.receiptId,
+                      runId: undefined,
+                    });
+                }
+                if (existing !== undefined) {
+                  yield* journal.checkCommitIntent(prepared.raw);
+
+                  return SettlementPublicationResult.make({
+                    record: existing.record,
+                    tailSequence: thread.tail_sequence,
+                    replayed: true,
+                  });
+                }
+                if (submission.state === "settled")
+                  return yield* LedgerError.make({
+                    operation,
+                    message: "Finalized Submission has no canonical settlement.",
+                  });
+                const appended = yield* journal.appendPrepared(prepared.raw);
+
+                return SettlementPublicationResult.make({
+                  record,
+                  tailSequence: appended.lastSequence,
+                  replayed: appended.replayed,
+                });
+              }),
+            )
+            .pipe(
+              Effect.mapError((error) => {
+                if (error._tag === "DoAppendConflict")
+                  return AppendConflict.make({
+                    threadId: prepared.request.threadId,
+                    batchId: prepared.request.batch.batchId,
+                    reason: error.reason,
+                    ...(error.actualTailSequence !== undefined
+                      ? {
+                          actualTailSequence: error.actualTailSequence,
+                        }
+                      : {}),
+                  });
+
+                return isDoStorageError(error) ||
+                  error._tag === "DoStorageCorruptionError" ||
+                  error._tag === "DoStorageFailpointError" ||
+                  error._tag === "DoValueBoundExceeded"
+                  ? mapAppendError(error)
+                  : error;
+              }),
             );
-          }
-
-          return yield* SettlementConflict.make({
-            submissionId: validated.submissionId,
-            existingOutcome: submission.settled_outcome,
-          });
-        }
-        // A `joined` Submission settles WITH its host (plan §2.5) and its lane is never
-        // worker-claimable, so no ownership token can exist for it: the recorded host linkage
-        // authorizes the reservation and the presented token is not consulted.
-        if (!(submission.state === "joined" && submission.joined_host_submission_id !== null)) {
-          // P7 §7(c): an aborted, never-claimed, still-queued Submission likewise has no live
-          // ownership to fence against — its durable abort intent authorizes exactly its
-          // ABORTED settlement (`terminalizing` is the same pass's crash replay). Every other
-          // reservation stays fenced by the target lane's live ownership.
-          let queuedAbortSettlement = false;
-
-          if (
-            validated.outcome === "aborted" &&
-            (submission.state === "ready" || submission.state === "terminalizing")
-          ) {
-            const abortIntent = yield* readAbortIntent(operation, validated.submissionId);
-
-            if (Option.isSome(abortIntent)) {
-              const ownership = yield* readOwnership(operation, validated.submissionId);
-
-              queuedAbortSettlement = Option.isNone(ownership);
-            }
-          }
-          if (!queuedAbortSettlement) {
-            yield* requireOwnership(operation, submission, validated.ownershipToken);
-          }
-        }
-        const now = yield* currentInstant;
 
-        yield* sql`
-          INSERT INTO effect_agent_settlement_reservations (
-            submission_id,
-            settlement_id,
-            outcome,
-            record_id,
-            record_json,
-            record_digest,
-            reserved_at
-          ) VALUES (
-            ${validated.submissionId},
-            ${validated.settlementId},
-            ${validated.outcome},
-            ${validated.record.recordId},
-            ${recordJson},
-            ${validated.recordDigest},
-            ${now.iso}
-          )
-         RETURNING *`.pipe(rows.reservations.write, Effect.mapError(internalFailure(operation)));
-        yield* sql`
-          UPDATE effect_agent_submissions
-          SET state = 'terminalizing'
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+          yield* hitFailpoint("append:after", operation);
 
-        return ReservedSettlement.make({
-          submissionId: validated.submissionId,
-          settlementId: validated.settlementId,
-          outcome: validated.outcome,
-          record: validated.record,
-          recordDigest: validated.recordDigest,
-          replayed: false,
-        });
-      }),
+          return result;
+        }),
+      ),
     );
-
-    yield* hitFailpoint("ledger:reserve-settlement:after", operation);
-
-    return reserved;
   });
 
-  const validateFinalization = Effect.fn("DoSubmissionLedger.validateFinalization")(function* (
+  const validateFinalization = Effect.fnUntraced(function* (
     validated: SettlementFinalization,
-    reservation: Option.Option<ReservationRow>,
+    submission: SubmissionRow,
   ) {
     const operation = "ledger finalize settlement";
+    const canonical = yield* readCanonicalSettlement(operation, submission);
 
-    if (Option.isNone(reservation)) {
+    if (canonical === undefined)
       return yield* LedgerError.make({
         operation,
-        message: `No settlement reservation exists for submission ${validated.submissionId}.`,
+        message: `No canonical settlement exists for submission ${validated.submissionId}.`,
       });
-    }
-    if (reservation.value.settlement_id !== validated.settlementId) {
+    if (canonical.settlement.settlementId !== validated.settlementId)
       return yield* SettlementConflict.make({
         submissionId: validated.submissionId,
-        existingOutcome: reservation.value.outcome,
+        existingOutcome: canonical.settlement.outcome,
       });
-    }
-
-    const reservationRecord = yield* decodeRecordEnvelopeText(reservation.value.record_json).pipe(
-      Effect.mapError((error) =>
-        corruptionFailure(
-          operation,
-          "effect_agent_settlement_reservations",
-          validated.submissionId,
-          error.message,
-        ),
-      ),
-    );
 
-    const settlementFailure = settlementFailureFromRecord(reservationRecord);
-
-    if ((reservation.value.outcome === "failed") !== (settlementFailure !== undefined)) {
-      return yield* corruptionFailure(
-        operation,
-        "effect_agent_settlement_reservations",
-        validated.submissionId,
-        "The reserved outcome and canonical failure diagnostic disagree.",
-      );
-    }
-
-    return { reservation: reservation.value, reservationRecord, settlementFailure };
+    return { ...canonical, settlementFailure: settlementFailureFromRecord(canonical.record) };
   });
 
-  const replayFinalization = Effect.fn("DoSubmissionLedger.replayFinalization")(function* (
+  const replayFinalization = Effect.fnUntraced(function* (
     validated: SettlementFinalization,
     submission: SubmissionRow,
-    { reservation, settlementFailure }: Effect.Success<ReturnType<typeof validateFinalization>>,
+    {
+      record,
+      settlement,
+      settlementFailure,
+    }: Effect.Success<ReturnType<typeof validateFinalization>>,
   ) {
     const operation = "ledger finalize settlement";
 
-    if (reservation.finalized_at === null) {
+    if (
+      submission.finalized_at === null ||
+      submission.settled_record_id !== record.recordId ||
+      submission.settled_outcome !== settlement.outcome
+    )
       return yield* corruptionFailure(
         operation,
-        "effect_agent_settlement_reservations",
+        "effect_agent_submissions",
         validated.submissionId,
-        "A settled Submission's reservation carries no finalization timestamp.",
+        "Settled projection disagrees with its canonical settlement.",
       );
-    }
 
     return yield* decodeSettlement({
       submissionId: validated.submissionId,
       settlementId: validated.settlementId,
       receiptId: submission.receipt_id,
-      outcome: reservation.outcome,
+      outcome: settlement.outcome,
       ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
-      settledAt: reservation.finalized_at,
+      settledAt: submission.finalized_at,
     }).pipe(Effect.mapError(internalFailure(operation)));
   });
 
@@ -2192,34 +1902,39 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 
         if (Option.isNone(submission) || submission.value.state !== "settled") return Option.none();
 
-        const finalization = yield* validateFinalization(
-          validated,
-          yield* readReservation(operation, validated.submissionId),
-        );
+        const finalization = yield* validateFinalization(validated, submission.value);
 
-        return Option.some(yield* replayFinalization(validated, submission.value, finalization));
+        return Option.some({
+          settlement: yield* replayFinalization(validated, submission.value, finalization),
+          threadId: submission.value.thread_id,
+        });
       }),
     );
 
     if (Option.isSome(replay)) {
+      owner.closeSubmission(replay.value.threadId, validated.submissionId);
       yield* hitFailpoint("ledger:finalize-settlement:after", operation);
 
-      return replay.value;
+      return replay.value.settlement;
     }
 
     const settlement = yield* inWriteTransaction(
       operation,
       Effect.gen(function* () {
-        const state = yield* validateFinalization(
-          validated,
-          yield* readReservation(operation, validated.submissionId),
-        );
-
-        const { reservation, reservationRecord, settlementFailure } = state;
         const submission = yield* requireSubmission(operation, validated.submissionId);
+        const state = yield* validateFinalization(validated, submission);
+
+        const {
+          settlement: canonicalSettlement,
+          record: canonicalRecord,
+          settlementFailure,
+        } = state;
 
         if (submission.state === "settled")
-          return yield* replayFinalization(validated, submission, state);
+          return {
+            settlement: yield* replayFinalization(validated, submission, state),
+            threadId: submission.thread_id,
+          };
         const now = yield* currentInstant;
 
         const terminal =
@@ -2227,7 +1942,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             ? undefined
             : workerTerminalFromRecord(
                 yield* decodeSubmissionSnapshot(operation, submission),
-                reservationRecord,
+                canonicalRecord,
               );
 
         let sealedTerminal: typeof terminal;
@@ -2269,55 +1984,51 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 
         yield* sql`
           UPDATE effect_agent_submissions
-          SET state = 'settled', settled_outcome = ${reservation.outcome}
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-        yield* sql`
-          UPDATE effect_agent_settlement_reservations
-          SET finalized_at = ${now.iso}
+          SET state = 'settled', settled_outcome = ${canonicalSettlement.outcome},
+              settled_record_id = ${canonicalRecord.recordId}, finalized_at = ${now.iso}
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.reservations.write, Effect.mapError(internalFailure(operation)));
-        yield* sql`
-          DELETE FROM effect_agent_submission_ownership
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.ownership.remove, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+          rows.submissions.write,
+          Effect.mapError(internalFailure(operation)),
+        );
 
         yield* recordProgress("submission", operation);
 
         if (sealedTerminal !== undefined)
           yield* retainWorkerSeal(submission.thread_id, sealedTerminal);
 
-        return yield* decodeSettlement({
-          submissionId: validated.submissionId,
-          settlementId: validated.settlementId,
-          receiptId: submission.receipt_id,
-          outcome: reservation.outcome,
-          ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
-          settledAt: now.iso,
-        }).pipe(Effect.mapError(internalFailure(operation)));
+        return {
+          threadId: submission.thread_id,
+          settlement: yield* decodeSettlement({
+            submissionId: validated.submissionId,
+            settlementId: validated.settlementId,
+            receiptId: submission.receipt_id,
+            outcome: canonicalSettlement.outcome,
+            ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
+            settledAt: now.iso,
+          }).pipe(Effect.mapError(internalFailure(operation))),
+        };
       }),
     );
 
+    owner.closeSubmission(settlement.threadId, validated.submissionId);
     yield* hitFailpoint("ledger:finalize-settlement:after", operation);
 
-    return settlement;
+    return settlement.settlement;
   });
 
-  const inspectWorker = Effect.fn("DoSubmissionLedger.inspectWorker")(function* (
-    threadId: SubmissionSnapshot["threadId"],
-  ) {
+  const inspectWorker = Effect.fnUntraced(function* (threadId: SubmissionSnapshot["threadId"]) {
     const operation = "inspect worker";
 
     return yield* state
       .transaction(
         Effect.gen(function* () {
           const read = Effect.fnUntraced(function* (active: boolean) {
-            const rows =
-              yield* sql`SELECT ${sql.literal(SUBMISSION_COLUMNS)} FROM effect_agent_submissions
+            const rows = yield* sql`SELECT ${submissionColumns} FROM effect_agent_submissions
           WHERE thread_id = ${threadId} ${active ? sql`AND state <> 'settled'` : sql``}
           ORDER BY queue_sequence ${active ? sql`ASC` : sql`DESC`} LIMIT 1`.pipe(
-                Effect.mapError(sqlFailure(operation)),
-              );
+              Effect.mapError(sqlFailure(operation)),
+            );
 
             const decoded = yield* decodeSubmissionRows(operation, threadId, rows);
 
@@ -2347,9 +2058,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       );
   });
 
-  const stopWorker = Effect.fn("DoSubmissionLedger.stopWorker")(function* (
-    request: WorkerStopCommand,
-  ) {
+  const stopWorker = Effect.fnUntraced(function* (request: WorkerStopCommand) {
     const operation = "ledger stop worker";
 
     const validated = yield* Schema.decodeEffect(WorkerStopCommand)(request).pipe(
@@ -2375,23 +2084,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             Effect.mapError(internalFailure(operation)),
           );
 
-        const owners = yield* sql`SELECT o.submission_id FROM effect_agent_submission_ownership o
-        JOIN effect_agent_submissions s ON s.submission_id = o.submission_id
-        WHERE s.thread_id = ${validated.threadId} AND s.state <> 'settled'`.pipe(
-          Effect.mapError(sqlFailure(operation)),
-        );
-
         if (sealed.length > 0 || aborted.length > 0) yield* recordProgress("control", operation);
         if (sealed.length > 0) yield* retainWorkerSeal(validated.threadId, null);
 
-        return owners.length;
+        return owner.hasOwner(validated.threadId) ? 1 : 0;
       }),
     );
   });
 
-  const requestAbort: SubmissionLedger["Service"]["requestAbort"] = Effect.fn(
-    "DoSubmissionLedger.requestAbort",
-  )(function* (request: AbortCommand) {
+  const requestAbort: SubmissionLedger["Service"]["requestAbort"] = Effect.fnUntraced(function* (
+    request: AbortCommand,
+  ) {
     const operation = "ledger request abort";
 
     const validated = yield* Schema.decodeEffect(Schema.toType(AbortCommand))(request).pipe(
@@ -2495,9 +2198,9 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     return intent;
   });
 
-  const claimJoining: SubmissionLedger["Service"]["claimJoining"] = Effect.fn(
-    "DoSubmissionLedger.claimJoining",
-  )(function* (request: ClaimJoiningRequest) {
+  const claimJoining: SubmissionLedger["Service"]["claimJoining"] = Effect.fnUntraced(function* (
+    request: ClaimJoiningRequest,
+  ) {
     const operation = "ledger claim joining";
 
     const validated = yield* Schema.decodeEffect(Schema.toType(ClaimJoiningRequest))(request).pipe(
@@ -2517,8 +2220,8 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             message: `Host submission ${validated.hostSubmissionId} does not belong to thread ${validated.threadId}.`,
           });
         }
-        // The host Attempt already owns the lane; no epoch bump happens here (plan §2.5).
-        yield* requireOwnership(operation, host, validated.ownershipToken);
+        // The host Attempt retains its local ownership while the ready prefix joins it.
+        yield* requireOwner(operation, host);
 
         const stopped = yield* cached(
           rows.workerStops.by("thread_id", validated.threadId),
@@ -2527,21 +2230,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 
         if (stopped.length > 0) return [];
 
-        const lane = yield* laneWork(validated.threadId, operation);
-
-        const laterRows =
-          lane === undefined
-            ? yield* sql<Record<string, unknown>>`
-          SELECT ${sql.literal(SUBMISSION_COLUMNS)}
+        const laterRows = yield* sql<Record<string, unknown>>`
+          SELECT ${submissionColumns}
           FROM effect_agent_submissions
           WHERE thread_id = ${validated.threadId}
             AND queue_sequence > ${host.queue_sequence}
           ORDER BY queue_sequence ASC
-        `.pipe(Effect.mapError(sqlFailure(operation)))
-            : yield* Effect.forEach(
-                lane.filter((item) => item.queue_sequence > host.queue_sequence),
-                (item) => requireSubmission(operation, item.submission_id),
-              );
+        `.pipe(Effect.mapError(sqlFailure(operation)));
 
         const later = yield* decodeSubmissionRows(operation, validated.threadId, laterRows);
         const claimed: Array<JoiningClaim> = [];
@@ -2563,11 +2258,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           // Any other non-ready row — an admitted-not-ready gap in particular — breaks the
           // contiguous ready prefix (plan §2.5); later ready work stays queued (DUR-004).
           if (row.state !== "ready") break;
+          const canonical = yield* readCanonicalSettlement(operation, row);
+
+          if (canonical?.settlement.outcome === "aborted") continue;
+          if (canonical !== undefined) break;
           yield* sql`
             UPDATE effect_agent_submissions
             SET state = 'joining', joined_host_submission_id = ${validated.hostSubmissionId}
             WHERE submission_id = ${row.submission_id}
-           RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+           RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+            rows.submissions.write,
+            Effect.mapError(internalFailure(operation)),
+          );
 
           const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
             Effect.mapError((error) =>
@@ -2598,9 +2300,9 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     return claims;
   });
 
-  const markJoined: SubmissionLedger["Service"]["markJoined"] = Effect.fn(
-    "DoSubmissionLedger.markJoined",
-  )(function* (request: MarkJoinedRequest) {
+  const markJoined: SubmissionLedger["Service"]["markJoined"] = Effect.fnUntraced(function* (
+    request: MarkJoinedRequest,
+  ) {
     const operation = "ledger mark joined";
 
     const validated = yield* Schema.decodeEffect(Schema.toType(MarkJoinedRequest))(request).pipe(
@@ -2623,7 +2325,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 
         // The lane is host-owned: the presented token must own the HOST's ownership period,
         // which also lets a later host Attempt repair a lost marker from history (DUR-016).
-        yield* requireOwnership(operation, host, validated.ownershipToken);
+        yield* requireOwner(operation, host);
         if (submission.input_applied_record_id !== null) {
           if (
             submission.input_applied_record_id === validated.recordId &&
@@ -2652,15 +2354,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             input_applied_sequence = ${validated.sequence},
             state = 'joined'
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+          rows.submissions.write,
+          Effect.mapError(internalFailure(operation)),
+        );
       }),
     );
     yield* hitFailpoint("ledger:mark-joined:after", operation);
   });
 
-  const revertJoining: SubmissionLedger["Service"]["revertJoining"] = Effect.fn(
-    "DoSubmissionLedger.revertJoining",
-  )(function* (request: RevertJoiningRequest) {
+  const revertJoining: SubmissionLedger["Service"]["revertJoining"] = Effect.fnUntraced(function* (
+    request: RevertJoiningRequest,
+  ) {
     const operation = "ledger revert joining";
 
     const validated = yield* Schema.decodeEffect(Schema.toType(RevertJoiningRequest))(request).pipe(
@@ -2676,135 +2381,169 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         // Idempotent and recovery-only: only a still-`joining` Submission reverts; an
         // already-joined (or already-reverted) Submission is a no-op (DUR-016).
         if (submission.state !== "joining") return;
+        const guard = validated.guard;
+
+        if (guard !== undefined) {
+          if (submission.joined_host_submission_id !== guard.hostSubmissionId) return;
+          const host = yield* requireSubmission(operation, guard.hostSubmissionId);
+
+          if (host.thread_id !== submission.thread_id)
+            return yield* corruptionFailure(
+              operation,
+              "effect_agent_submissions",
+              validated.submissionId,
+              "The joined host belongs to another Thread.",
+            );
+          if (host.state !== "settled") {
+            yield* requireOwner(operation, host).pipe(
+              Effect.mapError((cause) =>
+                cause._tag === "OwnershipLost"
+                  ? LedgerError.make({
+                      operation,
+                      message: "Joining recovery no longer owns the linked host.",
+                      cause,
+                    })
+                  : cause,
+              ),
+            );
+          }
+        }
         yield* sql`
           UPDATE effect_agent_submissions
           SET state = 'ready', joined_host_submission_id = NULL
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+          rows.submissions.write,
+          Effect.mapError(internalFailure(operation)),
+        );
       }),
     );
     yield* hitFailpoint("ledger:revert-joining:after", operation);
   });
 
-  const suspend: SubmissionLedger["Service"]["suspend"] = Effect.fn("DoSubmissionLedger.suspend")(
-    function* (request: SuspendRequest) {
-      const operation = "ledger suspend";
-
-      const validated = yield* Schema.decodeEffect(Schema.toType(SuspendRequest))(request).pipe(
-        Effect.mapError(internalFailure(operation)),
-      );
+  const suspend: SubmissionLedger["Service"]["suspend"] = Effect.fnUntraced(function* (
+    request: SuspendRequest,
+  ) {
+    const operation = "ledger suspend";
 
-      const reasonJson = yield* encodeSuspensionReasonText(validated.reason).pipe(
-        Effect.mapError(internalFailure(operation)),
-      );
+    const validated = yield* Schema.decodeEffect(Schema.toType(SuspendRequest))(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
-      yield* hitFailpoint("ledger:suspend:before", operation);
+    const reasonJson = yield* encodeSuspensionReasonText(validated.reason).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
-      const outcome = yield* inWriteTransaction(
-        operation,
-        Effect.gen(function* () {
-          const submission = yield* requireSubmission(operation, validated.submissionId);
+    yield* hitFailpoint("ledger:suspend:before", operation);
 
-          if (submission.state === "settled") {
-            if (submission.settled_outcome === null) {
-              return yield* corruptionFailure(
-                operation,
-                "effect_agent_submissions",
-                validated.submissionId,
-                "A settled Submission carries no terminal outcome.",
-              );
-            }
+    const outcome = yield* inWriteTransaction(
+      operation,
+      Effect.gen(function* () {
+        const submission = yield* requireSubmission(operation, validated.submissionId);
 
-            return yield* SettlementConflict.make({
-              submissionId: validated.submissionId,
-              existingOutcome: submission.settled_outcome,
-            });
+        if (submission.state === "settled") {
+          if (submission.settled_outcome === null) {
+            return yield* corruptionFailure(
+              operation,
+              "effect_agent_submissions",
+              validated.submissionId,
+              "A settled Submission carries no terminal outcome.",
+            );
           }
-          // An exact terminal outcome is already reserved (DUR-011); suspension would
-          // contradict it, so the reservation wins.
-          const reservation = yield* readReservation(operation, validated.submissionId);
 
-          if (Option.isSome(reservation)) {
-            return yield* SettlementConflict.make({
-              submissionId: validated.submissionId,
-              existingOutcome: reservation.value.outcome,
-            });
+          return yield* SettlementConflict.make({
+            submissionId: validated.submissionId,
+            existingOutcome: submission.settled_outcome,
+          });
+        }
+        // Canonical terminal intent wins over a later suspension.
+        const canonical = yield* readCanonicalSettlement(operation, submission);
+
+        if (canonical !== undefined) {
+          return yield* SettlementConflict.make({
+            submissionId: validated.submissionId,
+            existingOutcome: canonical.settlement.outcome,
+          });
+        }
+        yield* requireOwner(operation, submission);
+        // A covering event that raced ahead of the suspend transaction resumes the caller
+        // immediately WITHOUT releasing the lane (plan §2.6, §12). For WaitingForChild the
+        // covering evidence is EITHER a locally settled child row OR a durable cross-store
+        // notification marker: parent and child Threads live in different Durable
+        // Objects, and the port contract requires that a child settlement reported (via
+        // `recordChildSettled` → marker) before this suspend commits is observed here.
+        if (validated.reason._tag === "ApprovalPending") {
+          const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
+          const decided = new Map(decisions.map((row) => [row.tool_call_id, row.decision]));
+
+          if (
+            approvalDecisionsCover(validated.reason.toolCallIds, (toolCallId) =>
+              decided.get(toolCallId),
+            )
+          ) {
+            return { outcome: RESUME_IMMEDIATELY, threadId: submission.thread_id };
           }
-          yield* requireOwnership(operation, submission, validated.ownershipToken);
-          // A covering event that raced ahead of the suspend transaction resumes the caller
-          // immediately WITHOUT releasing the lane (plan §2.6, §12). For WaitingForChild the
-          // covering evidence is EITHER a locally settled child row OR a durable cross-store
-          // notification marker: parent and child Threads live in different Durable
-          // Objects, and the port contract requires that a child settlement reported (via
-          // `recordChildSettled` → marker) before this suspend commits is observed here.
-          if (validated.reason._tag === "ApprovalPending") {
-            const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
-            const decided = new Set(decisions.map((row) => row.tool_call_id));
-
-            if (validated.reason.toolCallIds.every((toolCallId) => decided.has(toolCallId))) {
-              return RESUME_IMMEDIATELY;
-            }
-          } else {
-            const markers = yield* readChildSettlementMarkers(operation, validated.submissionId);
-            const markerChildren = new Set(markers.map((row) => row.child_submission_id));
-            let allSettled = true;
+        } else {
+          const markers = yield* readChildSettlementMarkers(operation, validated.submissionId);
+          const markerChildren = new Set(markers.map((row) => row.child_submission_id));
+          let allSettled = true;
 
-            for (const child of validated.reason.children) {
-              const settled = yield* childProvablySettled(
-                operation,
-                markerChildren,
-                child.childSubmissionId,
-              );
+          for (const child of validated.reason.children) {
+            const settled = yield* childProvablySettled(
+              operation,
+              markerChildren,
+              child.childSubmissionId,
+            );
 
-              if (!settled) {
-                allSettled = false;
-                break;
-              }
-            }
-            if (allSettled) {
-              return RESUME_IMMEDIATELY;
+            if (!settled) {
+              allSettled = false;
+              break;
             }
           }
-          const now = yield* currentInstant;
+          if (allSettled) {
+            return { outcome: RESUME_IMMEDIATELY, threadId: submission.thread_id };
+          }
+        }
+        const now = yield* currentInstant;
 
-          yield* sql`
+        yield* sql`
             UPDATE effect_agent_submissions
             SET
               state = 'suspended',
               suspended_reason_json = ${reasonJson},
               suspended_at = ${now.iso}
             WHERE submission_id = ${validated.submissionId}
-           RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-          // Suspension ends the ownership period WITHOUT settling: the accepted-work
-          // obligation stays owed while the lane consumes no worker permit (plan §2.6).
-          yield* sql`
-            DELETE FROM effect_agent_submission_ownership
-            WHERE submission_id = ${validated.submissionId}
-           RETURNING *`.pipe(rows.ownership.remove, Effect.mapError(internalFailure(operation)));
+           RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+          rows.submissions.write,
+          Effect.mapError(internalFailure(operation)),
+        );
+        // Suspension ends the ownership period WITHOUT settling: the accepted-work
+        // obligation stays owed while the lane consumes no worker permit (plan §2.6).
 
-          yield* retainLifecycle(submission, {
-            _tag: "SubmissionSuspended",
-            submissionId: validated.submissionId,
-            reason: validated.reason,
-          });
+        yield* retainLifecycle(submission, {
+          _tag: "SubmissionSuspended",
+          submissionId: validated.submissionId,
+          reason: validated.reason,
+        });
 
-          return SUSPENDED;
-        }),
-      );
+        return { outcome: SUSPENDED, threadId: submission.thread_id };
+      }),
+    );
 
-      yield* hitFailpoint("ledger:suspend:after", operation);
+    if (outcome.outcome === SUSPENDED)
+      owner.closeSubmission(outcome.threadId, validated.submissionId);
+    yield* hitFailpoint("ledger:suspend:after", operation);
 
-      return outcome;
-    },
-  );
+    return outcome.outcome;
+  });
 
   /**
-   * Once every pending call of a recorded ApprovalPending suspension has a decision intent,
+   * Once one pending call is denied or every pending call has a decision intent,
    * the lane wakes: suspended → input-applied, suspension cleared (plan §2.6). A
    * WaitingForChild suspension wakes only through recordChildSettled. Runs inside the caller's
    * write transaction.
    */
-  const wakeSuspendedIfCovered = Effect.fn("DoSubmissionLedger.wakeSuspendedIfCovered")(function* (
+  const wakeSuspendedIfCovered = Effect.fnUntraced(function* (
     operation: string,
     submission: SubmissionRow,
   ): Effect.fn.Return<void, LedgerError> {
@@ -2825,9 +2564,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 
     if (reason._tag !== "ApprovalPending") return;
     const decisions = yield* readApprovalDecisions(operation, submission.submission_id);
-    const decided = new Set(decisions.map((row) => row.tool_call_id));
+    const decided = new Map(decisions.map((row) => [row.tool_call_id, row.decision]));
 
-    if (!reason.toolCallIds.every((toolCallId) => decided.has(toolCallId))) return;
+    if (!approvalDecisionsCover(reason.toolCallIds, (toolCallId) => decided.get(toolCallId)))
+      return;
     yield* sql`
       UPDATE effect_agent_submissions
       SET
@@ -2835,7 +2575,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         suspended_reason_json = NULL,
         suspended_at = NULL
       WHERE submission_id = ${submission.submission_id}
-     RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+     RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+      rows.submissions.write,
+      Effect.mapError(internalFailure(operation)),
+    );
     yield* retainLifecycle(submission, {
       _tag: "SubmissionResumed",
       submissionId: yield* decodeSubmissionId(submission.submission_id).pipe(
@@ -2844,56 +2587,55 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     });
   });
 
-  const recordApprovalDecision: SubmissionLedger["Service"]["recordApprovalDecision"] = Effect.fn(
-    "DoSubmissionLedger.recordApprovalDecision",
-  )(function* (command: ApprovalDecisionCommand) {
-    const operation = "ledger record approval decision";
+  const recordApprovalDecision: SubmissionLedger["Service"]["recordApprovalDecision"] =
+    Effect.fnUntraced(function* (command: ApprovalDecisionCommand) {
+      const operation = "ledger record approval decision";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(ApprovalDecisionCommand))(
-      command,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+      const validated = yield* Schema.decodeEffect(Schema.toType(ApprovalDecisionCommand))(
+        command,
+      ).pipe(Effect.mapError(internalFailure(operation)));
 
-    yield* hitFailpoint("ledger:approval-decision:before", operation);
+      yield* hitFailpoint("ledger:approval-decision:before", operation);
 
-    const intent = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const submission = yield* requireSubmission(operation, validated.submissionId);
+      const intent = yield* inWriteTransaction(
+        operation,
+        Effect.gen(function* () {
+          const submission = yield* requireSubmission(operation, validated.submissionId);
 
-        if (submission.state === "settled") {
-          if (submission.settled_outcome === null) {
-            return yield* corruptionFailure(
-              operation,
-              "effect_agent_submissions",
-              validated.submissionId,
-              "A settled Submission carries no terminal outcome.",
-            );
-          }
+          if (submission.state === "settled") {
+            if (submission.settled_outcome === null) {
+              return yield* corruptionFailure(
+                operation,
+                "effect_agent_submissions",
+                validated.submissionId,
+                "A settled Submission carries no terminal outcome.",
+              );
+            }
 
-          return yield* SettlementConflict.make({
-            submissionId: validated.submissionId,
-            existingOutcome: submission.settled_outcome,
-          });
-        }
-        const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
-        const existing = decisions.find((row) => row.tool_call_id === validated.toolCallId);
-
-        if (existing !== undefined) {
-          // Idempotent per (submissionId, toolCallId): repeating the SAME decision replays
-          // the recorded intent unchanged; a divergent re-decision conflicts.
-          if (existing.decision !== validated.decision) {
-            return yield* ApprovalConflict.make({
+            return yield* SettlementConflict.make({
               submissionId: validated.submissionId,
-              toolCallId: validated.toolCallId,
-              existingDecision: existing.decision,
+              existingOutcome: submission.settled_outcome,
             });
           }
+          const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
+          const existing = decisions.find((row) => row.tool_call_id === validated.toolCallId);
+
+          if (existing !== undefined) {
+            // Idempotent per (submissionId, toolCallId): repeating the SAME decision replays
+            // the recorded intent unchanged; a divergent re-decision conflicts.
+            if (existing.decision !== validated.decision) {
+              return yield* ApprovalConflict.make({
+                submissionId: validated.submissionId,
+                toolCallId: validated.toolCallId,
+                existingDecision: existing.decision,
+              });
+            }
 
-          return yield* approvalIntentFromRow(operation, existing);
-        }
-        const now = yield* currentInstant;
+            return yield* approvalIntentFromRow(operation, existing);
+          }
+          const now = yield* currentInstant;
 
-        yield* sql`
+          yield* sql`
           INSERT INTO effect_agent_approval_decisions (
             submission_id,
             tool_call_id,
@@ -2910,28 +2652,28 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             ${now.iso}
           )
          RETURNING *`.pipe(rows.approvals.write, Effect.mapError(internalFailure(operation)));
-        yield* recordProgress("control", operation);
-        yield* wakeSuspendedIfCovered(operation, submission);
+          yield* recordProgress("control", operation);
+          yield* wakeSuspendedIfCovered(operation, submission);
 
-        return yield* decodeApprovalDecisionIntent({
-          submissionId: validated.submissionId,
-          toolCallId: validated.toolCallId,
-          decision: validated.decision,
-          resolver: validated.resolver,
-          reason: validated.reason,
-          decidedAt: now.iso,
-        }).pipe(Effect.mapError(internalFailure(operation)));
-      }),
-    );
+          return yield* decodeApprovalDecisionIntent({
+            submissionId: validated.submissionId,
+            toolCallId: validated.toolCallId,
+            decision: validated.decision,
+            resolver: validated.resolver,
+            reason: validated.reason,
+            decidedAt: now.iso,
+          }).pipe(Effect.mapError(internalFailure(operation)));
+        }),
+      );
 
-    yield* hitFailpoint("ledger:approval-decision:after", operation);
+      yield* hitFailpoint("ledger:approval-decision:after", operation);
 
-    return intent;
-  });
+      return intent;
+    });
 
-  const markUnknown: SubmissionLedger["Service"]["markUnknown"] = Effect.fn(
-    "DoSubmissionLedger.markUnknown",
-  )(function* (request: MarkUnknownRequest) {
+  const markUnknown: SubmissionLedger["Service"]["markUnknown"] = Effect.fnUntraced(function* (
+    request: MarkUnknownRequest,
+  ) {
     const operation = "ledger mark unknown";
 
     const validated = yield* Schema.decodeEffect(Schema.toType(MarkUnknownRequest))(request).pipe(
@@ -2959,14 +2701,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             existingOutcome: submission.settled_outcome,
           });
         }
-        // A reserved exact outcome wins over a late Unknown marking (DUR-011); the recovery
-        // classifier orders reservation ahead of MarkUnknown for the same reason.
-        const reservation = yield* readReservation(operation, validated.submissionId);
+        // Canonical terminal intent wins over a late Unknown marking.
+        const canonical = yield* readCanonicalSettlement(operation, submission);
 
-        if (Option.isSome(reservation)) {
+        if (canonical !== undefined) {
           return yield* SettlementConflict.make({
             submissionId: validated.submissionId,
-            existingOutcome: reservation.value.outcome,
+            existingOutcome: canonical.settlement.outcome,
           });
         }
         // Idempotent merge: repeating is a no-op; additional open calls extend the marked
@@ -2990,7 +2731,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             unknown_reason = ${submission.unknown_reason ?? validated.reason},
             unknown_tool_call_ids_json = ${idsJson}
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+          rows.submissions.write,
+          Effect.mapError(internalFailure(operation)),
+        );
         if (submission.state !== "unknown")
           yield* retainLifecycle(submission, {
             _tag: "SubmissionUnknown",
@@ -3001,71 +2745,136 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     yield* hitFailpoint("ledger:mark-unknown:after", operation);
   });
 
-  const recordUnknownResolution: SubmissionLedger["Service"]["recordUnknownResolution"] = Effect.fn(
-    "DoSubmissionLedger.recordUnknownResolution",
-  )(function* (command: UnknownResolutionCommand) {
-    const operation = "ledger record unknown resolution";
+  const recordUnknownResolution: SubmissionLedger["Service"]["recordUnknownResolution"] =
+    Effect.fnUntraced(function* (command: UnknownResolutionCommand) {
+      const operation = "ledger record unknown resolution";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(UnknownResolutionCommand))(
-      command,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+      const validated = yield* Schema.decodeEffect(Schema.toType(UnknownResolutionCommand))(
+        command,
+      ).pipe(Effect.mapError(internalFailure(operation)));
 
-    const resolutionJson = yield* encodeUnknownResolutionText(validated.resolution).pipe(
-      Effect.mapError(internalFailure(operation)),
-    );
+      const resolutionJson = yield* encodeUnknownResolutionText(validated.resolution).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
 
-    yield* hitFailpoint("ledger:unknown-resolution:before", operation);
+      yield* hitFailpoint("ledger:unknown-resolution:before", operation);
 
-    const intent = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const submission = yield* requireSubmission(operation, validated.submissionId);
+      const intent = yield* inWriteTransaction(
+        operation,
+        Effect.gen(function* () {
+          const submission = yield* requireSubmission(operation, validated.submissionId);
 
-        if (submission.state === "settled") {
-          if (submission.settled_outcome === null) {
-            return yield* corruptionFailure(
-              operation,
-              "effect_agent_submissions",
-              validated.submissionId,
-              "A settled Submission carries no terminal outcome.",
-            );
+          if (submission.state === "settled") {
+            if (submission.settled_outcome === null) {
+              return yield* corruptionFailure(
+                operation,
+                "effect_agent_submissions",
+                validated.submissionId,
+                "A settled Submission carries no terminal outcome.",
+              );
+            }
+
+            // Factual closure may outlive settlement; it never restores execution authority.
+            if (
+              validated.resolution._tag !== "CompletedWithResult" &&
+              validated.resolution._tag !== "NeverHappened"
+            )
+              return yield* SettlementConflict.make({
+                submissionId: validated.submissionId,
+                existingOutcome: submission.settled_outcome,
+              });
           }
+          const resolutions = yield* readUnknownResolutions(operation, validated.submissionId);
+          const kind = unknownResolutionKind(validated.resolution);
 
-          return yield* SettlementConflict.make({
-            submissionId: validated.submissionId,
-            existingOutcome: submission.settled_outcome,
-          });
-        }
-        const resolutions = yield* readUnknownResolutions(operation, validated.submissionId);
-        const existing = resolutions.find((row) => row.tool_call_id === validated.toolCallId);
+          const existing = resolutions.find(
+            (row) => row.tool_call_id === validated.toolCallId && row.resolution_kind === kind,
+          );
 
-        const existingIntent =
-          existing === undefined
-            ? undefined
-            : yield* unknownResolutionIntentFromRow(operation, existing);
+          const existingIntent =
+            existing === undefined
+              ? undefined
+              : yield* unknownResolutionIntentFromRow(operation, existing);
 
-        if (
-          existingIntent !== undefined &&
-          !equivalentUnknownResolution(existingIntent.resolution, validated.resolution)
-        ) {
-          return yield* UnknownResolutionConflict.make({
-            submissionId: validated.submissionId,
-            toolCallId: validated.toolCallId,
-          });
-        }
-        let resolved: UnknownResolutionIntent;
+          if (
+            (existingIntent !== undefined &&
+              !equivalentUnknownResolution(existingIntent.resolution, validated.resolution)) ||
+            (existing === undefined &&
+              kind === "execution" &&
+              resolutions.some(
+                (row) =>
+                  row.tool_call_id === validated.toolCallId && row.resolution_kind === "factual",
+              ))
+          ) {
+            return yield* UnknownResolutionConflict.make({
+              submissionId: validated.submissionId,
+              toolCallId: validated.toolCallId,
+            });
+          }
 
-        if (existingIntent !== undefined) {
-          // Idempotent replay of the recorded intent (author/reason may differ; the stored
-          // audit fields win, exactly like requestAbort).
-          resolved = existingIntent;
-        } else {
-          const now = yield* currentInstant;
+          if (existingIntent === undefined && kind === "factual") {
+            const runId = runIdForSubmission(validated.submissionId);
 
-          yield* sql`
+            const found = yield* sql`
+              SELECT ${canonicalRecordJson(sql)} AS record_json FROM effect_agent_canonical_records
+              WHERE thread_id = ${submission.thread_id}
+                AND record_tag = 27
+                AND run_id = ${runKey(sql, sql`${submission.thread_id}`, sql`${JSON.stringify(runId)}`)}
+                AND tool_call_id = ${JSON.stringify(validated.toolCallId)}
+              LIMIT 2
+            `.pipe(Effect.mapError(sqlFailure(operation)));
+
+            const outcomes = yield* decodeRows(
+              Schema.Array(Schema.Struct({ record_json: BoundedStoredText })),
+              "effect_agent_canonical_records",
+              validated.toolCallId,
+              found,
+            ).pipe(Effect.mapError(internalFailure(operation)));
+
+            const result =
+              outcomes[0] === undefined
+                ? undefined
+                : (yield* decodeRecordEnvelopeText(outcomes[0].record_json).pipe(
+                    Effect.mapError(internalFailure(operation)),
+                  )).payload;
+
+            if (
+              outcomes.length > 1 ||
+              (result !== undefined &&
+                (result._tag !== "ToolCallSettled" ||
+                  result.runId !== runId ||
+                  result.toolCallId !== validated.toolCallId))
+            )
+              return yield* corruptionFailure(
+                operation,
+                "effect_agent_canonical_records",
+                validated.toolCallId,
+                "Canonical Tool result identity is inconsistent.",
+              );
+
+            if (
+              result?._tag === "ToolCallSettled" &&
+              !unknownResolutionMatchesResult(validated.resolution, result)
+            )
+              return yield* UnknownResolutionConflict.make({
+                submissionId: validated.submissionId,
+                toolCallId: validated.toolCallId,
+              });
+          }
+          let resolved: UnknownResolutionIntent;
+
+          if (existingIntent !== undefined) {
+            // Idempotent replay of the recorded intent (author/reason may differ; the stored
+            // audit fields win, exactly like requestAbort).
+            resolved = existingIntent;
+          } else {
+            const now = yield* currentInstant;
+
+            yield* sql`
             INSERT INTO effect_agent_unknown_resolutions (
               submission_id,
               tool_call_id,
+              resolution_kind,
               author,
               reason,
               resolution_json,
@@ -3073,101 +2882,103 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             ) VALUES (
               ${validated.submissionId},
               ${validated.toolCallId},
+              ${kind},
               ${validated.author},
               ${validated.reason},
               ${resolutionJson},
               ${now.iso}
             )
            RETURNING *`.pipe(rows.resolutions.write, Effect.mapError(internalFailure(operation)));
-          yield* recordProgress("control", operation);
+            yield* recordProgress("control", operation);
 
-          const resolution = yield* parseStoredJsonText(resolutionJson).pipe(
-            Effect.mapError(internalFailure(operation)),
-          );
+            const resolution = yield* parseStoredJsonText(resolutionJson).pipe(
+              Effect.mapError(internalFailure(operation)),
+            );
 
-          resolved = yield* decodeUnknownResolutionIntent({
-            submissionId: validated.submissionId,
-            toolCallId: validated.toolCallId,
-            author: validated.author,
-            reason: validated.reason,
-            resolution,
-            resolvedAt: now.iso,
-          }).pipe(Effect.mapError(internalFailure(operation)));
-        }
-        // The lane reopens only when EVERY marked open call has a durable resolution intent:
-        // unknown → input-applied (DUR-017). Replays re-run the coverage check so a
-        // recovering caller can wake the lane idempotently.
-        if (submission.state === "unknown" && submission.unknown_tool_call_ids_json !== null) {
-          const markedIds = yield* storedUnknownToolCallIds(operation, submission);
-          const covering = yield* readUnknownResolutions(operation, validated.submissionId);
-          const coveredIds = new Set(covering.map((row) => row.tool_call_id));
-
-          if (markedIds.every((toolCallId) => coveredIds.has(toolCallId))) {
-            yield* sql`
+            resolved = yield* decodeUnknownResolutionIntent({
+              submissionId: validated.submissionId,
+              toolCallId: validated.toolCallId,
+              author: validated.author,
+              reason: validated.reason,
+              resolution,
+              resolvedAt: now.iso,
+            }).pipe(Effect.mapError(internalFailure(operation)));
+          }
+          // The lane reopens only when EVERY marked open call has a durable resolution intent:
+          // unknown → input-applied (DUR-017). Replays re-run the coverage check so a
+          // recovering caller can wake the lane idempotently.
+          if (submission.state === "unknown" && submission.unknown_tool_call_ids_json !== null) {
+            const markedIds = yield* storedUnknownToolCallIds(operation, submission);
+            const covering = yield* readUnknownResolutions(operation, validated.submissionId);
+            const coveredIds = new Set(covering.map((row) => row.tool_call_id));
+
+            if (markedIds.every((toolCallId) => coveredIds.has(toolCallId))) {
+              yield* sql`
               UPDATE effect_agent_submissions
               SET
                 state = 'input-applied',
                 unknown_reason = NULL,
                 unknown_tool_call_ids_json = NULL
               WHERE submission_id = ${validated.submissionId}
-             RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-            yield* retainLifecycle(submission, {
-              _tag: "SubmissionResumed",
-              submissionId: validated.submissionId,
-            });
+             RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+                rows.submissions.write,
+                Effect.mapError(internalFailure(operation)),
+              );
+              yield* retainLifecycle(submission, {
+                _tag: "SubmissionResumed",
+                submissionId: validated.submissionId,
+              });
+            }
           }
-        }
 
-        return resolved;
-      }),
-    );
+          return resolved;
+        }),
+      );
 
-    yield* hitFailpoint("ledger:unknown-resolution:after", operation);
+      yield* hitFailpoint("ledger:unknown-resolution:after", operation);
 
-    return intent;
-  });
+      return intent;
+    });
 
-  const recordChildSettled: SubmissionLedger["Service"]["recordChildSettled"] = Effect.fn(
-    "DoSubmissionLedger.recordChildSettled",
-  )(function* (request: ChildSettledNotification) {
-    const operation = "ledger record child settled";
+  const recordChildSettled: SubmissionLedger["Service"]["recordChildSettled"] = Effect.fnUntraced(
+    function* (request: ChildSettledNotification) {
+      const operation = "ledger record child settled";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(ChildSettledNotification))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
-
-    yield* hitFailpoint("ledger:child-settled:before", operation);
+      const validated = yield* Schema.decodeEffect(Schema.toType(ChildSettledNotification))(
+        request,
+      ).pipe(Effect.mapError(internalFailure(operation)));
 
-    const outcome = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
-        // The child's canonical Settlement is the authority for this wake. When the child's
-        // row lives in THIS store (single-store latitude, and every conformance lane), either a
-        // finalized row or an exact terminalizing reservation admits the notification: the
-        // runtime calls only after the canonical append and before ledger finalization. When the
-        // row does not live here — the normal cross-DO case — the routed notification from the
-        // child's owning Durable Object is the settlement evidence this store records durably.
-        const child = yield* readSubmission(operation, validated.childSubmissionId);
-        const childReservation = yield* readReservation(operation, validated.childSubmissionId);
+      yield* hitFailpoint("ledger:child-settled:before", operation);
 
-        if (
-          Option.isSome(child) &&
-          child.value.state !== "settled" &&
-          !(child.value.state === "terminalizing" && Option.isSome(childReservation))
-        ) {
-          return yield* LedgerError.make({
-            operation,
-            message: `Child submission ${validated.childSubmissionId} has no recorded settlement.`,
-          });
-        }
-        // Record the durable notification marker FIRST and unconditionally (idempotent):
-        // the port's cross-store race guarantee requires that a notification committed
-        // before the parent's suspend transaction is observed by that suspend's covering
-        // check, even when the parent is not (or not yet) suspended.
-        const now = yield* currentInstant;
+      const outcome = yield* inWriteTransaction(
+        operation,
+        Effect.gen(function* () {
+          const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
+          // The child's canonical Settlement is the authority for this wake. When the child's
+          // row lives in THIS store (single-store latitude, and every conformance lane), either a
+          // canonical settlement admits the notification: the
+          // runtime calls only after the canonical append and before ledger finalization. When the
+          // row does not live here — the normal cross-DO case — the routed notification from the
+          // child's owning Durable Object is the settlement evidence this store records durably.
+          const child = yield* readSubmission(operation, validated.childSubmissionId);
+
+          const childCanonical = Option.isSome(child)
+            ? yield* readCanonicalSettlement(operation, child.value)
+            : undefined;
+
+          if (Option.isSome(child) && childCanonical === undefined) {
+            return yield* LedgerError.make({
+              operation,
+              message: `Child submission ${validated.childSubmissionId} has no recorded settlement.`,
+            });
+          }
+          // Record the durable notification marker FIRST and unconditionally (idempotent):
+          // the port's cross-store race guarantee requires that a notification committed
+          // before the parent's suspend transaction is observed by that suspend's covering
+          // check, even when the parent is not (or not yet) suspended.
+          const now = yield* currentInstant;
 
-        const added = yield* sql`
+          const added = yield* sql`
           INSERT INTO effect_agent_child_settlements (
             parent_submission_id,
             child_submission_id,
@@ -3176,158 +2987,162 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           ) VALUES (
             ${validated.parentSubmissionId},
             ${validated.childSubmissionId},
-            ${
-              Option.isSome(child) && child.value.state === "settled"
-                ? child.value.settled_outcome
-                : Option.isSome(childReservation)
-                  ? childReservation.value.outcome
-                  : null
-            },
+            ${childCanonical?.settlement.outcome ?? null},
             ${now.iso}
           )
           ON CONFLICT (parent_submission_id, child_submission_id) DO NOTHING
          RETURNING *`.pipe(
-          rows.childSettlements.write,
-          Effect.mapError(internalFailure(operation)),
-        );
+            rows.childSettlements.write,
+            Effect.mapError(internalFailure(operation)),
+          );
 
-        if (added.length > 0) yield* recordProgress("control", operation);
+          if (added.length > 0) yield* recordProgress("control", operation);
 
-        if (parent.state !== "suspended" || parent.suspended_reason_json === null) {
-          return NOT_WAITING;
-        }
+          if (parent.state !== "suspended" || parent.suspended_reason_json === null) {
+            return NOT_WAITING;
+          }
 
-        const reason = yield* Schema.decodeEffect(Schema.fromJsonString(SuspensionReason))(
-          parent.suspended_reason_json,
-        ).pipe(
-          Effect.mapError((error) =>
-            corruptionFailure(
-              operation,
-              "effect_agent_submissions",
-              parent.submission_id,
-              error.message,
+          const reason = yield* Schema.decodeEffect(Schema.fromJsonString(SuspensionReason))(
+            parent.suspended_reason_json,
+          ).pipe(
+            Effect.mapError((error) =>
+              corruptionFailure(
+                operation,
+                "effect_agent_submissions",
+                parent.submission_id,
+                error.message,
+              ),
             ),
-          ),
-        );
+          );
 
-        if (reason._tag !== "WaitingForChild") {
-          return NOT_WAITING;
-        }
-        if (
-          !reason.children.some((entry) => entry.childSubmissionId === validated.childSubmissionId)
-        ) {
-          return NOT_WAITING;
-        }
-        // The parent wakes exactly when EVERY listed child is provably settled — from its
-        // local row or a recorded marker (spec §12 step 10); replays re-run the coverage
-        // check so a recovering caller wakes the lane idempotently.
-        const markers = yield* readChildSettlementMarkers(operation, validated.parentSubmissionId);
-        const markerChildren = new Set(markers.map((row) => row.child_submission_id));
-
-        for (const entry of reason.children) {
-          const settled = yield* childProvablySettled(
+          if (reason._tag !== "WaitingForChild") {
+            return NOT_WAITING;
+          }
+          if (
+            !reason.children.some(
+              (entry) => entry.childSubmissionId === validated.childSubmissionId,
+            )
+          ) {
+            return NOT_WAITING;
+          }
+
+          // The parent wakes exactly when EVERY listed child is provably settled — from its
+          // local row or a recorded marker (spec §12 step 10); replays re-run the coverage
+          // check so a recovering caller wakes the lane idempotently.
+          const markers = yield* readChildSettlementMarkers(
             operation,
-            markerChildren,
-            entry.childSubmissionId,
+            validated.parentSubmissionId,
           );
 
-          if (!settled) {
-            return STILL_WAITING;
+          const markerChildren = new Set(markers.map((row) => row.child_submission_id));
+
+          for (const entry of reason.children) {
+            const settled = yield* childProvablySettled(
+              operation,
+              markerChildren,
+              entry.childSubmissionId,
+            );
+
+            if (!settled) {
+              return STILL_WAITING;
+            }
           }
-        }
-        yield* sql`
+          yield* sql`
           UPDATE effect_agent_submissions
           SET
             state = 'input-applied',
             suspended_reason_json = NULL,
             suspended_at = NULL
           WHERE submission_id = ${validated.parentSubmissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+            rows.submissions.write,
+            Effect.mapError(internalFailure(operation)),
+          );
 
-        yield* retainLifecycle(parent, {
-          _tag: "SubmissionResumed",
-          submissionId: validated.parentSubmissionId,
-        });
+          yield* retainLifecycle(parent, {
+            _tag: "SubmissionResumed",
+            submissionId: validated.parentSubmissionId,
+          });
 
-        return WOKEN;
-      }),
-    );
+          return WOKEN;
+        }),
+      );
 
-    yield* hitFailpoint("ledger:child-settled:after", operation);
+      yield* hitFailpoint("ledger:child-settled:after", operation);
 
-    return outcome;
-  });
+      return outcome;
+    },
+  );
 
-  const reserveChildBudget: SubmissionLedger["Service"]["reserveChildBudget"] = Effect.fn(
-    "DoSubmissionLedger.reserveChildBudget",
-  )(function* (request: ChildBudgetReservationRequest) {
-    const operation = "ledger reserve child budget";
+  const reserveChildBudget: SubmissionLedger["Service"]["reserveChildBudget"] = Effect.fnUntraced(
+    function* (request: ChildBudgetReservationRequest) {
+      const operation = "ledger reserve child budget";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(ChildBudgetReservationRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+      const validated = yield* Schema.decodeEffect(Schema.toType(ChildBudgetReservationRequest))(
+        request,
+      ).pipe(Effect.mapError(internalFailure(operation)));
 
-    const allocationJson = yield* encodePersistedJsonText(validated.allocation).pipe(
-      Effect.mapError(internalFailure(operation)),
-    );
+      const allocationJson = yield* encodePersistedJsonText(validated.allocation).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
 
-    yield* hitFailpoint("ledger:child-reservation:before", operation);
+      yield* hitFailpoint("ledger:child-reservation:before", operation);
 
-    const reserved = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const existing = yield* readChildReservation(operation, validated.reservationId);
+      const reserved = yield* inWriteTransaction(
+        operation,
+        Effect.gen(function* () {
+          const existing = yield* readChildReservation(operation, validated.reservationId);
 
-        if (Option.isSome(existing)) {
-          const existingSnapshot = yield* childReservationSnapshotFromRow(
+          if (Option.isSome(existing)) {
+            const existingSnapshot = yield* childReservationSnapshotFromRow(
+              operation,
+              existing.value,
+            );
+
+            // Identical replays short-circuit before the fence, retaining its first committed allocation: a
+            // replay creates nothing, so a recovering caller resumes rather than duplicates.
+            const identical =
+              existing.value.parent_submission_id === validated.parentSubmissionId &&
+              existing.value.parent_tool_call_id === validated.parentToolCallId &&
+              existing.value.allocation_digest === validated.allocationDigest &&
+              equivalentPersistedJson(existingSnapshot.allocation, validated.allocation);
+
+            if (!identical) {
+              return yield* ChildReservationConflict.make({
+                reservationId: validated.reservationId,
+                status: existing.value.status,
+                message:
+                  "A reservation with this identity exists with a different parent Tool Call or allocation.",
+              });
+            }
+
+            return ReservedChildBudget.make({
+              reservation: existingSnapshot,
+              replayed: true,
+            });
+          }
+
+          const collision = yield* readChildReservationForCall(
             operation,
-            existing.value,
+            validated.parentSubmissionId,
+            validated.parentToolCallId,
           );
 
-          // Identical replays short-circuit before the fence, mirroring reserveSettlement: a
-          // replay creates nothing, so a recovering caller resumes rather than duplicates.
-          const identical =
-            existing.value.parent_submission_id === validated.parentSubmissionId &&
-            existing.value.parent_tool_call_id === validated.parentToolCallId &&
-            existing.value.allocation_digest === validated.allocationDigest &&
-            equivalentPersistedJson(existingSnapshot.allocation, validated.allocation);
-
-          if (!identical) {
+          if (Option.isSome(collision)) {
             return yield* ChildReservationConflict.make({
               reservationId: validated.reservationId,
-              status: existing.value.status,
-              message:
-                "A reservation with this identity exists with a different parent Tool Call or allocation.",
+              status: collision.value.status,
+              message: `Parent Tool Call ${validated.parentToolCallId} already owns reservation ${collision.value.reservation_id}.`,
             });
           }
+          const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
 
-          return ReservedChildBudget.make({
-            reservation: existingSnapshot,
-            replayed: true,
-          });
-        }
-
-        const collision = yield* readChildReservationForCall(
-          operation,
-          validated.parentSubmissionId,
-          validated.parentToolCallId,
-        );
-
-        if (Option.isSome(collision)) {
-          return yield* ChildReservationConflict.make({
-            reservationId: validated.reservationId,
-            status: collision.value.status,
-            message: `Parent Tool Call ${validated.parentToolCallId} already owns reservation ${collision.value.reservation_id}.`,
-          });
-        }
-        const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
-
-        // Creation is fenced by the parent lane's live ownership (spec §12 step 2): a stale
-        // parent Attempt can never create new reservation state.
-        yield* requireOwnership(operation, parent, validated.ownershipToken);
-        const now = yield* currentInstant;
+          // Creation is fenced by the parent lane's live ownership (spec §12 step 2): a stale
+          // parent Attempt can never create new reservation state.
+          yield* requireOwner(operation, parent);
+          const now = yield* currentInstant;
 
-        yield* sql`
+          yield* sql`
           INSERT INTO effect_agent_child_reservations (
             reservation_id,
             parent_submission_id,
@@ -3346,45 +3161,198 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             ${now.iso}
           )
          RETURNING *`.pipe(
-          rows.childReservations.write,
-          Effect.mapError(internalFailure(operation)),
-        );
-        const inserted = yield* readChildReservation(operation, validated.reservationId);
-
-        if (Option.isNone(inserted)) {
-          return yield* corruptionFailure(
-            operation,
-            "effect_agent_child_reservations",
-            validated.reservationId,
-            "An inserted child reservation row is missing inside its own transaction.",
+            rows.childReservations.write,
+            Effect.mapError(internalFailure(operation)),
           );
-        }
+          const inserted = yield* readChildReservation(operation, validated.reservationId);
 
-        return ReservedChildBudget.make({
-          reservation: yield* childReservationSnapshotFromRow(operation, inserted.value),
-          replayed: false,
-        });
-      }),
-    );
+          if (Option.isNone(inserted)) {
+            return yield* corruptionFailure(
+              operation,
+              "effect_agent_child_reservations",
+              validated.reservationId,
+              "An inserted child reservation row is missing inside its own transaction.",
+            );
+          }
+
+          return ReservedChildBudget.make({
+            reservation: yield* childReservationSnapshotFromRow(operation, inserted.value),
+            replayed: false,
+          });
+        }),
+      );
 
-    yield* hitFailpoint("ledger:child-reservation:after", operation);
+      yield* hitFailpoint("ledger:child-reservation:after", operation);
 
-    return reserved;
-  });
+      return reserved;
+    },
+  );
 
   const attachChildToReservation: SubmissionLedger["Service"]["attachChildToReservation"] =
-    Effect.fn("DoSubmissionLedger.attachChildToReservation")(function* (
-      request: AttachChildToReservationRequest,
-    ) {
+    Effect.fnUntraced(function* (request: AttachChildToReservationRequest) {
       const operation = "ledger attach child to reservation";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(AttachChildToReservationRequest))(
+      const validated = yield* Schema.decodeEffect(Schema.toType(AttachChildToReservationRequest))(
+        request,
+      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      yield* hitFailpoint("ledger:child-attach:before", operation);
+
+      const attached = yield* inWriteTransaction(
+        operation,
+        Effect.gen(function* () {
+          const existing = yield* readChildReservation(operation, validated.reservationId);
+
+          if (Option.isNone(existing)) {
+            return yield* LedgerError.make({
+              operation,
+              message: `Unknown child reservation ${validated.reservationId}.`,
+            });
+          }
+          if (existing.value.child_submission_id !== null) {
+            // Idempotent replay of the recorded attachment (unfenced — it mutates nothing).
+            if (existing.value.child_submission_id === validated.childSubmissionId) {
+              return yield* childReservationSnapshotFromRow(operation, existing.value);
+            }
+
+            return yield* ChildReservationConflict.make({
+              reservationId: validated.reservationId,
+              status: existing.value.status,
+              message: `Reservation ${validated.reservationId} already records child ${existing.value.child_submission_id}.`,
+            });
+          }
+          const parent = yield* requireSubmission(operation, existing.value.parent_submission_id);
+
+          yield* requireOwner(operation, parent);
+          if (existing.value.status !== "reserved") {
+            return yield* ChildReservationConflict.make({
+              reservationId: validated.reservationId,
+              status: existing.value.status,
+              message: `Cannot attach a child to a ${existing.value.status} reservation.`,
+            });
+          }
+          // Unlike the single-store Node adapter, the admitted child's row lives in ANOTHER
+          // Durable Object, so no local existence check is possible here. The canonical
+          // `SubagentStarted` record remains the attachment's repair authority (DUR-015),
+          // and the coordinator only attaches after the child's admission committed.
+          yield* sql`
+            UPDATE effect_agent_child_reservations
+            SET child_submission_id = ${validated.childSubmissionId}
+            WHERE reservation_id = ${validated.reservationId}
+           RETURNING *`.pipe(
+            rows.childReservations.write,
+            Effect.mapError(internalFailure(operation)),
+          );
+          const updated = yield* readChildReservation(operation, validated.reservationId);
+
+          if (Option.isNone(updated)) {
+            return yield* corruptionFailure(
+              operation,
+              "effect_agent_child_reservations",
+              validated.reservationId,
+              "An updated child reservation row is missing inside its own transaction.",
+            );
+          }
+
+          return yield* childReservationSnapshotFromRow(operation, updated.value);
+        }),
+      );
+
+      yield* hitFailpoint("ledger:child-attach:after", operation);
+
+      return attached;
+    });
+
+  const beginChildBudgetRelease: SubmissionLedger["Service"]["beginChildBudgetRelease"] =
+    Effect.fnUntraced(function* (request: BeginChildBudgetReleaseRequest) {
+      const operation = "ledger begin child budget release";
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(BeginChildBudgetReleaseRequest))(
+        request,
+      ).pipe(Effect.mapError(internalFailure(operation)));
+
+      const accountingJson = yield* encodePersistedJsonText(validated.accounting).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
+
+      yield* hitFailpoint("ledger:child-release-pending:before", operation);
+
+      const frozen = yield* inWriteTransaction(
+        operation,
+        Effect.gen(function* () {
+          const existing = yield* readChildReservation(operation, validated.reservationId);
+
+          if (Option.isNone(existing)) {
+            return yield* LedgerError.make({
+              operation,
+              message: `Unknown child reservation ${validated.reservationId}.`,
+            });
+          }
+          if (existing.value.status !== "reserved") {
+            const existingSnapshot = yield* childReservationSnapshotFromRow(
+              operation,
+              existing.value,
+            );
+
+            // The accounting decision was already frozen exactly once; an identical replay is a
+            // no-op and a divergent decision conflicts (spec §12 join step 6).
+            if (
+              existingSnapshot.accounting !== undefined &&
+              equivalentPersistedJson(existingSnapshot.accounting, validated.accounting)
+            ) {
+              return existingSnapshot;
+            }
+
+            return yield* ChildReservationConflict.make({
+              reservationId: validated.reservationId,
+              status: existing.value.status,
+              message: "A different accounting decision is already frozen for this reservation.",
+            });
+          }
+          const now = yield* currentInstant;
+
+          yield* sql`
+          UPDATE effect_agent_child_reservations
+          SET
+            status = 'releasePending',
+            accounting_json = ${accountingJson},
+            release_began_at = ${now.iso}
+          WHERE reservation_id = ${validated.reservationId}
+         RETURNING *`.pipe(
+            rows.childReservations.write,
+            Effect.mapError(internalFailure(operation)),
+          );
+          const updated = yield* readChildReservation(operation, validated.reservationId);
+
+          if (Option.isNone(updated)) {
+            return yield* corruptionFailure(
+              operation,
+              "effect_agent_child_reservations",
+              validated.reservationId,
+              "An updated child reservation row is missing inside its own transaction.",
+            );
+          }
+
+          return yield* childReservationSnapshotFromRow(operation, updated.value);
+        }),
+      );
+
+      yield* hitFailpoint("ledger:child-release-pending:after", operation);
+
+      return frozen;
+    });
+
+  const releaseChildBudget: SubmissionLedger["Service"]["releaseChildBudget"] = Effect.fnUntraced(
+    function* (request: ReleaseChildBudgetRequest) {
+      const operation = "ledger release child budget";
+
+      const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseChildBudgetRequest))(
         request,
       ).pipe(Effect.mapError(internalFailure(operation)));
 
-      yield* hitFailpoint("ledger:child-attach:before", operation);
+      yield* hitFailpoint("ledger:child-release:before", operation);
 
-      const attached = yield* inWriteTransaction(
+      const released = yield* inWriteTransaction(
         operation,
         Effect.gen(function* () {
           const existing = yield* readChildReservation(operation, validated.reservationId);
@@ -3395,37 +3363,25 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               message: `Unknown child reservation ${validated.reservationId}.`,
             });
           }
-          if (existing.value.child_submission_id !== null) {
-            // Idempotent replay of the recorded attachment (unfenced — it mutates nothing).
-            if (existing.value.child_submission_id === validated.childSubmissionId) {
-              return yield* childReservationSnapshotFromRow(operation, existing.value);
-            }
-
-            return yield* ChildReservationConflict.make({
-              reservationId: validated.reservationId,
-              status: existing.value.status,
-              message: `Reservation ${validated.reservationId} already records child ${existing.value.child_submission_id}.`,
-            });
+          // Applied exactly once: replaying a released reservation returns the stored row
+          // unchanged (spec §12: "never available twice").
+          if (existing.value.status === "released") {
+            return yield* childReservationSnapshotFromRow(operation, existing.value);
           }
-          const parent = yield* requireSubmission(operation, existing.value.parent_submission_id);
-
-          yield* requireOwnership(operation, parent, validated.ownershipToken);
-          if (existing.value.status !== "reserved") {
+          if (existing.value.status !== "releasePending") {
             return yield* ChildReservationConflict.make({
               reservationId: validated.reservationId,
               status: existing.value.status,
-              message: `Cannot attach a child to a ${existing.value.status} reservation.`,
+              message: "Cannot release a reservation whose accounting decision is not frozen.",
             });
           }
-          // Unlike the single-store Node adapter, the admitted child's row lives in ANOTHER
-          // Durable Object, so no local existence check is possible here. The canonical
-          // `SubagentStarted` record remains the attachment's repair authority (DUR-015),
-          // and the coordinator only attaches after the child's admission committed.
+          const now = yield* currentInstant;
+
           yield* sql`
-            UPDATE effect_agent_child_reservations
-            SET child_submission_id = ${validated.childSubmissionId}
-            WHERE reservation_id = ${validated.reservationId}
-           RETURNING *`.pipe(
+          UPDATE effect_agent_child_reservations
+          SET status = 'released', released_at = ${now.iso}
+          WHERE reservation_id = ${validated.reservationId}
+         RETURNING *`.pipe(
             rows.childReservations.write,
             Effect.mapError(internalFailure(operation)),
           );
@@ -3444,161 +3400,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         }),
       );
 
-      yield* hitFailpoint("ledger:child-attach:after", operation);
-
-      return attached;
-    });
-
-  const beginChildBudgetRelease: SubmissionLedger["Service"]["beginChildBudgetRelease"] = Effect.fn(
-    "DoSubmissionLedger.beginChildBudgetRelease",
-  )(function* (request: BeginChildBudgetReleaseRequest) {
-    const operation = "ledger begin child budget release";
-
-    const validated = yield* Schema.decodeEffect(Schema.toType(BeginChildBudgetReleaseRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
-
-    const accountingJson = yield* encodePersistedJsonText(validated.accounting).pipe(
-      Effect.mapError(internalFailure(operation)),
-    );
-
-    yield* hitFailpoint("ledger:child-release-pending:before", operation);
-
-    const frozen = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const existing = yield* readChildReservation(operation, validated.reservationId);
-
-        if (Option.isNone(existing)) {
-          return yield* LedgerError.make({
-            operation,
-            message: `Unknown child reservation ${validated.reservationId}.`,
-          });
-        }
-        if (existing.value.status !== "reserved") {
-          const existingSnapshot = yield* childReservationSnapshotFromRow(
-            operation,
-            existing.value,
-          );
-
-          // The accounting decision was already frozen exactly once; an identical replay is a
-          // no-op and a divergent decision conflicts (spec §12 join step 6).
-          if (
-            existingSnapshot.accounting !== undefined &&
-            equivalentPersistedJson(existingSnapshot.accounting, validated.accounting)
-          ) {
-            return existingSnapshot;
-          }
-
-          return yield* ChildReservationConflict.make({
-            reservationId: validated.reservationId,
-            status: existing.value.status,
-            message: "A different accounting decision is already frozen for this reservation.",
-          });
-        }
-        const now = yield* currentInstant;
-
-        yield* sql`
-          UPDATE effect_agent_child_reservations
-          SET
-            status = 'releasePending',
-            accounting_json = ${accountingJson},
-            release_began_at = ${now.iso}
-          WHERE reservation_id = ${validated.reservationId}
-         RETURNING *`.pipe(
-          rows.childReservations.write,
-          Effect.mapError(internalFailure(operation)),
-        );
-        const updated = yield* readChildReservation(operation, validated.reservationId);
-
-        if (Option.isNone(updated)) {
-          return yield* corruptionFailure(
-            operation,
-            "effect_agent_child_reservations",
-            validated.reservationId,
-            "An updated child reservation row is missing inside its own transaction.",
-          );
-        }
-
-        return yield* childReservationSnapshotFromRow(operation, updated.value);
-      }),
-    );
-
-    yield* hitFailpoint("ledger:child-release-pending:after", operation);
-
-    return frozen;
-  });
-
-  const releaseChildBudget: SubmissionLedger["Service"]["releaseChildBudget"] = Effect.fn(
-    "DoSubmissionLedger.releaseChildBudget",
-  )(function* (request: ReleaseChildBudgetRequest) {
-    const operation = "ledger release child budget";
-
-    const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseChildBudgetRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
-
-    yield* hitFailpoint("ledger:child-release:before", operation);
-
-    const released = yield* inWriteTransaction(
-      operation,
-      Effect.gen(function* () {
-        const existing = yield* readChildReservation(operation, validated.reservationId);
-
-        if (Option.isNone(existing)) {
-          return yield* LedgerError.make({
-            operation,
-            message: `Unknown child reservation ${validated.reservationId}.`,
-          });
-        }
-        // Applied exactly once: replaying a released reservation returns the stored row
-        // unchanged (spec §12: "never available twice").
-        if (existing.value.status === "released") {
-          return yield* childReservationSnapshotFromRow(operation, existing.value);
-        }
-        if (existing.value.status !== "releasePending") {
-          return yield* ChildReservationConflict.make({
-            reservationId: validated.reservationId,
-            status: existing.value.status,
-            message: "Cannot release a reservation whose accounting decision is not frozen.",
-          });
-        }
-        const now = yield* currentInstant;
-
-        yield* sql`
-          UPDATE effect_agent_child_reservations
-          SET status = 'released', released_at = ${now.iso}
-          WHERE reservation_id = ${validated.reservationId}
-         RETURNING *`.pipe(
-          rows.childReservations.write,
-          Effect.mapError(internalFailure(operation)),
-        );
-        const updated = yield* readChildReservation(operation, validated.reservationId);
+      yield* hitFailpoint("ledger:child-release:after", operation);
 
-        if (Option.isNone(updated)) {
-          return yield* corruptionFailure(
-            operation,
-            "effect_agent_child_reservations",
-            validated.reservationId,
-            "An updated child reservation row is missing inside its own transaction.",
-          );
-        }
-
-        return yield* childReservationSnapshotFromRow(operation, updated.value);
-      }),
-    );
-
-    yield* hitFailpoint("ledger:child-release:after", operation);
-
-    return released;
-  });
+      return released;
+    },
+  );
 
   interface ScanCursor {
     readonly threadId: string;
     readonly queueSequence: number;
   }
 
-  const scanPage = Effect.fn("DoSubmissionLedger.scanPage")(function* (
+  const scanPage = Effect.fnUntraced(function* (
     cursor: ScanCursor | undefined,
   ): Effect.fn.Return<
     readonly [ReadonlyArray<SubmissionWorkItem>, Option.Option<ScanCursor | undefined>],
@@ -3698,264 +3511,226 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
     ),
   );
 
-  const readAbortIntentForSubmission: SubmissionLedger["Service"]["readAbortIntent"] = Effect.fn(
-    "DoSubmissionLedger.readAbortIntentForSubmission",
-  )(function* (request) {
-    const operation = "ledger read abort intent";
-
-    const validated = yield* Schema.decodeEffect(Schema.toType(AbortIntentRequest))(request).pipe(
-      Effect.mapError(internalFailure(operation)),
-    );
-
-    return yield* state.read(
-      Effect.gen(function* () {
-        const submission = yield* requireSubmission(operation, validated.submissionId);
-        const intent = yield* readAbortIntent(operation, validated.submissionId);
+  const readAbortIntentForSubmission: SubmissionLedger["Service"]["readAbortIntent"] =
+    Effect.fnUntraced(function* (request) {
+      const operation = "ledger read abort intent";
 
-        return Option.isNone(intent)
-          ? undefined
-          : yield* abortIntentFromRow(operation, submission, validated.submissionId, intent.value);
-      }),
-    );
-  });
+      const validated = yield* Schema.decodeEffect(Schema.toType(AbortIntentRequest))(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
 
-  const loadRecoverySnapshot: SubmissionLedger["Service"]["loadRecoverySnapshot"] = Effect.fn(
-    "DoSubmissionLedger.loadRecoverySnapshot",
-  )(function* (request: RecoverySnapshotRequest) {
-    const operation = "ledger load recovery snapshot";
+      return yield* state.read(
+        Effect.gen(function* () {
+          const submission = yield* requireSubmission(operation, validated.submissionId);
+          const intent = yield* readAbortIntent(operation, validated.submissionId);
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(RecoverySnapshotRequest))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+          return Option.isNone(intent)
+            ? undefined
+            : yield* abortIntentFromRow(
+                operation,
+                submission,
+                validated.submissionId,
+                intent.value,
+              );
+        }),
+      );
+    });
 
-    return yield* state.read(
-      Effect.gen(function* () {
-        const submissionRow = yield* requireSubmission(operation, validated.submissionId);
-        const submission = yield* decodeSubmissionSnapshot(operation, submissionRow);
-
-        let ownership: OwnershipSnapshot | undefined;
-        const ownershipRow = yield* readOwnership(operation, validated.submissionId);
-
-        if (Option.isSome(ownershipRow)) {
-          ownership = yield* decodeOwnershipSnapshot({
-            attemptId: ownershipRow.value.attempt_id,
-            ownerProducerId: ownershipRow.value.owner_producer_id,
-            producerEpoch: ownershipRow.value.producer_epoch,
-            leaseExpiresAt: ownershipRow.value.lease_expires_at,
-          }).pipe(Effect.mapError(internalFailure(operation)));
-        }
+  const loadRecoverySnapshot: SubmissionLedger["Service"]["loadRecoverySnapshot"] =
+    Effect.fnUntraced(function* (request: RecoverySnapshotRequest) {
+      const operation = "ledger load recovery snapshot";
 
-        let inputApplied: InputAppliedMarker | undefined;
+      const validated = yield* Schema.decodeEffect(Schema.toType(RecoverySnapshotRequest))(
+        request,
+      ).pipe(Effect.mapError(internalFailure(operation)));
 
-        if (
-          submissionRow.input_applied_record_id !== null &&
-          submissionRow.input_applied_sequence !== null
-        ) {
-          inputApplied = yield* decodeInputAppliedMarker({
-            recordId: submissionRow.input_applied_record_id,
-            sequence: submissionRow.input_applied_sequence,
-          }).pipe(Effect.mapError(internalFailure(operation)));
-        }
+      return yield* state.read(
+        Effect.gen(function* () {
+          const submissionRow = yield* requireSubmission(operation, validated.submissionId);
+          const submission = yield* decodeSubmissionSnapshot(operation, submissionRow);
 
-        let reservation: SettlementReservationSnapshot | undefined;
-        const reservationRow = yield* readReservation(operation, validated.submissionId);
+          let inputApplied: InputAppliedMarker | undefined;
 
-        if (Option.isSome(reservationRow)) {
-          const record = yield* decodeRecordEnvelopeText(reservationRow.value.record_json).pipe(
-            Effect.mapError((error) =>
-              corruptionFailure(
-                operation,
-                "effect_agent_settlement_reservations",
-                validated.submissionId,
-                error.message,
-              ),
-            ),
-          );
+          if (
+            submissionRow.input_applied_record_id !== null &&
+            submissionRow.input_applied_sequence !== null
+          ) {
+            inputApplied = yield* decodeInputAppliedMarker({
+              recordId: submissionRow.input_applied_record_id,
+              sequence: submissionRow.input_applied_sequence,
+            }).pipe(Effect.mapError(internalFailure(operation)));
+          }
 
-          const settlementId = yield* Schema.decodeEffect(
-            SettlementReservationSnapshot.fields.settlementId,
-          )(reservationRow.value.settlement_id).pipe(Effect.mapError(internalFailure(operation)));
+          let abortIntent: AbortIntent | undefined;
+          const abortRow = yield* readAbortIntent(operation, validated.submissionId);
 
-          reservation = SettlementReservationSnapshot.make({
-            settlementId,
-            outcome: reservationRow.value.outcome,
-            record,
-            recordDigest: reservationRow.value.record_digest,
-            finalized: reservationRow.value.finalized_at !== null,
-          });
-        }
+          if (Option.isSome(abortRow)) {
+            abortIntent = yield* abortIntentFromRow(
+              operation,
+              submissionRow,
+              validated.submissionId,
+              abortRow.value,
+            );
+          }
 
-        let abortIntent: AbortIntent | undefined;
-        const abortRow = yield* readAbortIntent(operation, validated.submissionId);
+          // Host-side view: every Submission whose host linkage points here, in queue order
+          // (the terminalize loop settles them with the host outcome, DUR-002).
+          const joinRows = (yield* cached(
+            rows.submissions.by("joined_host_submission_id", validated.submissionId),
+            operation,
+          ))
+            .filter((row) => row.joined_host_submission_id === validated.submissionId)
+            .sort((a, b) => a.queue_sequence - b.queue_sequence);
 
-        if (Option.isSome(abortRow)) {
-          abortIntent = yield* abortIntentFromRow(
+          const joinSubmissions = yield* decodeSubmissionRows(
             operation,
-            submissionRow,
             validated.submissionId,
-            abortRow.value,
+            joinRows,
           );
-        }
 
-        // Host-side view: every Submission whose host linkage points here, in queue order
-        // (the terminalize loop settles them with the host outcome, DUR-002).
-        const joinRows = (yield* cached(
-          rows.submissions.by("joined_host_submission_id", validated.submissionId),
-          operation,
-        ))
-          .filter((row) => row.joined_host_submission_id === validated.submissionId)
-          .sort((a, b) => a.queue_sequence - b.queue_sequence);
-
-        const joinSubmissions = yield* decodeSubmissionRows(
-          operation,
-          validated.submissionId,
-          joinRows,
-        );
-
-        const joins = yield* Effect.forEach(joinSubmissions, (row) =>
-          decodeJoinSnapshot({
-            submissionId: row.submission_id,
-            state: row.state,
-            hostSubmissionId: validated.submissionId,
-          }).pipe(Effect.mapError(internalFailure(operation))),
-        );
-
-        let hostSubmissionId: RecoverySnapshot["hostSubmissionId"];
+          const joins = yield* Effect.forEach(joinSubmissions, (row) =>
+            decodeJoinSnapshot({
+              submissionId: row.submission_id,
+              state: row.state,
+              hostSubmissionId: validated.submissionId,
+            }).pipe(Effect.mapError(internalFailure(operation))),
+          );
 
-        if (submissionRow.joined_host_submission_id !== null) {
-          hostSubmissionId = yield* decodeSubmissionId(
-            submissionRow.joined_host_submission_id,
-          ).pipe(Effect.mapError(internalFailure(operation)));
-        }
+          let hostSubmissionId: RecoverySnapshot["hostSubmissionId"];
 
-        let suspension: SuspensionSnapshot | undefined;
+          if (submissionRow.joined_host_submission_id !== null) {
+            hostSubmissionId = yield* decodeSubmissionId(
+              submissionRow.joined_host_submission_id,
+            ).pipe(Effect.mapError(internalFailure(operation)));
+          }
 
-        if (submissionRow.suspended_reason_json !== null && submissionRow.suspended_at !== null) {
-          const reason = yield* parseStoredJsonText(submissionRow.suspended_reason_json).pipe(
-            Effect.mapError((error) =>
-              corruptionFailure(
-                operation,
-                "effect_agent_submissions",
-                validated.submissionId,
-                error.message,
+          let suspension: SuspensionSnapshot | undefined;
+
+          if (submissionRow.suspended_reason_json !== null && submissionRow.suspended_at !== null) {
+            const reason = yield* parseStoredJsonText(submissionRow.suspended_reason_json).pipe(
+              Effect.mapError((error) =>
+                corruptionFailure(
+                  operation,
+                  "effect_agent_submissions",
+                  validated.submissionId,
+                  error.message,
+                ),
               ),
-            ),
-          );
+            );
 
-          suspension = yield* decodeSuspensionSnapshot({
-            reason,
-            suspendedAt: submissionRow.suspended_at,
-          }).pipe(
-            Effect.mapError((error) =>
-              corruptionFailure(
-                operation,
-                "effect_agent_submissions",
-                validated.submissionId,
-                error.message,
+            suspension = yield* decodeSuspensionSnapshot({
+              reason,
+              suspendedAt: submissionRow.suspended_at,
+            }).pipe(
+              Effect.mapError((error) =>
+                corruptionFailure(
+                  operation,
+                  "effect_agent_submissions",
+                  validated.submissionId,
+                  error.message,
+                ),
               ),
-            ),
-          );
-        }
-
-        const decisionRows = yield* readApprovalDecisions(operation, validated.submissionId);
+            );
+          }
 
-        const approvalDecisions = yield* Effect.forEach(decisionRows, (row) =>
-          approvalIntentFromRow(operation, row),
-        );
+          const decisionRows = yield* readApprovalDecisions(operation, validated.submissionId);
 
-        const resolutionRows = yield* readUnknownResolutions(operation, validated.submissionId);
+          const approvalDecisions = yield* Effect.forEach(decisionRows, (row) =>
+            approvalIntentFromRow(operation, row),
+          );
 
-        const unknownResolutions = yield* Effect.forEach(resolutionRows, (row) =>
-          unknownResolutionIntentFromRow(operation, row),
-        );
+          const resolutionRows = yield* readUnknownResolutions(operation, validated.submissionId);
 
-        // Parent-side subagent view: this Submission's child budget reservations in parent
-        // Tool Call order, plus each attached child's current lane state (a disposable
-        // derived view; canonical records stay the recovery truth, DUR-015). The child's
-        // state comes from its local row when this store holds it, and otherwise from the
-        // durable cross-store settlement marker; a child that is neither local nor marked
-        // settled is enriched by the routed per-child lookup one layer out (plan §1.3).
-        const childReservationRows = (yield* cached(
-          rows.childReservations.by("parent_submission_id", validated.submissionId),
-          operation,
-        ))
-          .filter((row) => row.parent_submission_id === validated.submissionId)
-          .sort((a, b) => a.parent_tool_call_id.localeCompare(b.parent_tool_call_id));
+          const unknownResolutions = yield* Effect.forEach(resolutionRows, (row) =>
+            unknownResolutionIntentFromRow(operation, row),
+          );
 
-        const decodedChildReservations = yield* decodeChildReservationRows(
-          operation,
-          validated.submissionId,
-          childReservationRows,
-        );
+          // Parent-side subagent view: this Submission's child budget reservations in parent
+          // Tool Call order, plus each attached child's current lane state (a disposable
+          // derived view; canonical records stay the recovery truth, DUR-015). The child's
+          // state comes from its local row when this store holds it, and otherwise from the
+          // durable cross-store settlement marker; a child that is neither local nor marked
+          // settled is enriched by the routed per-child lookup one layer out (plan §1.3).
+          const childReservationRows = (yield* cached(
+            rows.childReservations.by("parent_submission_id", validated.submissionId),
+            operation,
+          ))
+            .filter((row) => row.parent_submission_id === validated.submissionId)
+            .sort((a, b) => a.parent_tool_call_id.localeCompare(b.parent_tool_call_id));
 
-        const childReservations = yield* Effect.forEach(decodedChildReservations, (row) =>
-          childReservationSnapshotFromRow(operation, row),
-        );
+          const decodedChildReservations = yield* decodeChildReservationRows(
+            operation,
+            validated.submissionId,
+            childReservationRows,
+          );
 
-        const markers = yield* readChildSettlementMarkers(operation, validated.submissionId);
-        const markersByChild = new Map(markers.map((row) => [row.child_submission_id, row]));
-        const childAttachments: Array<ChildAttachmentSnapshot> = [];
+          const childReservations = yield* Effect.forEach(decodedChildReservations, (row) =>
+            childReservationSnapshotFromRow(operation, row),
+          );
 
-        for (const row of decodedChildReservations) {
-          if (row.child_submission_id === null) continue;
-          const child = yield* readSubmission(operation, row.child_submission_id);
+          const markers = yield* readChildSettlementMarkers(operation, validated.submissionId);
+          const markersByChild = new Map(markers.map((row) => [row.child_submission_id, row]));
+          const childAttachments: Array<ChildAttachmentSnapshot> = [];
+
+          for (const row of decodedChildReservations) {
+            if (row.child_submission_id === null) continue;
+            const child = yield* readSubmission(operation, row.child_submission_id);
+
+            if (Option.isSome(child)) {
+              childAttachments.push(
+                yield* decodeChildAttachmentSnapshot({
+                  toolCallId: row.parent_tool_call_id,
+                  childSubmissionId: row.child_submission_id,
+                  childState: child.value.state,
+                  ...(child.value.settled_outcome === null
+                    ? {}
+                    : { childOutcome: child.value.settled_outcome }),
+                }).pipe(Effect.mapError(internalFailure(operation))),
+              );
+              continue;
+            }
+            const marker = markersByChild.get(row.child_submission_id);
 
-          if (Option.isSome(child)) {
+            if (marker === undefined) continue;
             childAttachments.push(
               yield* decodeChildAttachmentSnapshot({
                 toolCallId: row.parent_tool_call_id,
                 childSubmissionId: row.child_submission_id,
-                childState: child.value.state,
-                ...(child.value.settled_outcome === null
-                  ? {}
-                  : { childOutcome: child.value.settled_outcome }),
+                childState: "settled",
+                ...(marker.child_outcome === null ? {} : { childOutcome: marker.child_outcome }),
               }).pipe(Effect.mapError(internalFailure(operation))),
             );
-            continue;
           }
-          const marker = markersByChild.get(row.child_submission_id);
-
-          if (marker === undefined) continue;
-          childAttachments.push(
-            yield* decodeChildAttachmentSnapshot({
-              toolCallId: row.parent_tool_call_id,
-              childSubmissionId: row.child_submission_id,
-              childState: "settled",
-              ...(marker.child_outcome === null ? {} : { childOutcome: marker.child_outcome }),
-            }).pipe(Effect.mapError(internalFailure(operation))),
-          );
-        }
 
-        let parentLinkage: ParentLinkage | undefined;
+          let parentLinkage: ParentLinkage | undefined;
 
-        if (
-          submissionRow.parent_submission_id !== null &&
-          submissionRow.parent_tool_call_id !== null
-        ) {
-          parentLinkage = yield* decodeParentLinkage({
-            parentSubmissionId: submissionRow.parent_submission_id,
-            parentToolCallId: submissionRow.parent_tool_call_id,
-          }).pipe(Effect.mapError(internalFailure(operation)));
-        }
+          if (
+            submissionRow.parent_submission_id !== null &&
+            submissionRow.parent_tool_call_id !== null
+          ) {
+            parentLinkage = yield* decodeParentLinkage({
+              parentSubmissionId: submissionRow.parent_submission_id,
+              parentToolCallId: submissionRow.parent_tool_call_id,
+            }).pipe(Effect.mapError(internalFailure(operation)));
+          }
 
-        return RecoverySnapshot.make({
-          submission,
-          joins,
-          approvalDecisions,
-          unknownResolutions,
-          childReservations,
-          childAttachments,
-          ...(parentLinkage === undefined ? {} : { parentLinkage }),
-          ...(hostSubmissionId === undefined ? {} : { hostSubmissionId }),
-          ...(suspension === undefined ? {} : { suspension }),
-          ...(ownership === undefined ? {} : { ownership }),
-          ...(inputApplied === undefined ? {} : { inputApplied }),
-          ...(reservation === undefined ? {} : { reservation }),
-          ...(abortIntent === undefined ? {} : { abortIntent }),
-        });
-      }),
-    );
-  });
+          return RecoverySnapshot.make({
+            submission,
+            joins,
+            approvalDecisions,
+            unknownResolutions,
+            childReservations,
+            childAttachments,
+            ...(parentLinkage === undefined ? {} : { parentLinkage }),
+            ...(hostSubmissionId === undefined ? {} : { hostSubmissionId }),
+            ...(suspension === undefined ? {} : { suspension }),
+            hasOwner: owner.hasOwner(submissionRow.thread_id, submissionRow.submission_id),
+            ...(inputApplied === undefined ? {} : { inputApplied }),
+            ...(abortIntent === undefined ? {} : { abortIntent }),
+          });
+        }),
+      );
+    });
 
   return Context.make(
     SubmissionLedger,
@@ -3964,20 +3739,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       admit,
       markReady,
       lookup,
+      resolveFundingOwner,
       resolveAdmission,
-      claim,
-      renewOwnership,
-      releaseOwnership,
+      selectHead,
       markInputApplied,
-      reserveSettlement,
-      finalizeSettlement,
+      finalizeSettlement: (request) => owner.withMutation(finalizeSettlement(request)),
       requestAbort,
       stopWorker,
       inspectWorker,
       claimJoining,
       markJoined,
       revertJoining,
-      suspend,
+      suspend: (request) => owner.withMutation(suspend(request)),
       recordApprovalDecision,
       markUnknown,
       recordUnknownResolution,
@@ -3990,27 +3763,30 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
       loadRecoverySnapshot,
       readAbortIntent: readAbortIntentForSubmission,
     }),
-  );
+  ).pipe(Context.add(StorageOwner, owner), Context.add(SettlementPublisher, { publish }));
 });
 
 /**
  * Durable Object SubmissionLedger implementation sharing the journal's private SQLite
- * database, storage-backed transaction discipline, and producer-epoch fencing substrate.
+ * database, storage-backed transactions, and scoped local owner.
  * Configuration, failpoint, SQL, and Crypto authority stay visible in the input channel.
  */
 export const submissionLedgerLayer: Layer.Layer<
-  SubmissionLedger,
+  SubmissionLedger | SettlementPublisher | StorageOwner,
   DoStorageInitializationError,
   DoStorageConfig | DoStorageFailpoint | SqlClientService.SqlClient | Crypto.Crypto
 > = Layer.effectContext(makeServices());
 
 /**
  * A composition-root convenience Layer for the durable Submission Ledger. Point it at the
- * same `ctx.storage` as the ThreadStore so claims fence the same producer epochs.
+ * same `ctx.storage` as the ThreadStore so both share the same scoped storage owner.
  */
 export const ledgerLayer = (
   options: DoStorageOptions,
-): Layer.Layer<SubmissionLedger, DoStorageInitializationError> =>
+): Layer.Layer<
+  SubmissionLedger | SettlementPublisher | StorageOwner,
+  DoStorageInitializationError
+> =>
   Layer.unwrap(
     Effect.map(DoStorageConfig, (config) =>
       submissionLedgerLayer.pipe(