@yielded/agent-storage-cloudflare 0.1.0-beta.167 → 0.1.0-beta.169

package/dist/DoSubmissionLedger.mjs

@@ -2,19 +2,24 @@ import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { DoStorageConfig } from "./DoStorageConfig.mjs";
 import { DoStorageFailpoint } from "./DoStorageFailpoint.mjs";
 import { DoLedgerError, DoStorageCorruptionError, DoStorageError } from "./DoStorageError.mjs";
-import { n as ownedRows } from "./owned-state-DHm2aRXx.mjs";
-import { a as initializeDoJournal, i as decodeRows, s as withStorageSpan } from "./do-journal-DUhjZkOf.mjs";
-import { storageConfigLayer, storageFailpointLayer } from "./DoThreadStore.mjs";
+import { n as ownedRows } from "./owned-state-BHzUi0eb.mjs";
+import { i as initializeDoJournal, r as decodeRows } from "./do-journal-Cawnsetj.mjs";
+import { l as prepareCanonicalAppend, o as storageConfigLayer, s as storageFailpointLayer } from "./DoThreadStore-CwBvTLoq.mjs";
+import { BrowserCrypto } from "@effect/platform-browser";
 import { Cause, Clock, Context, Crypto, DateTime, Effect, Layer, Option, Schema, Stream } from "effect";
 import * as SqlClientService from "effect/sql/SqlClient";
-import { SqliteClient } from "@effect/sql-sqlite-do";
+import { definitionJson, makeCanonicalStorage, recordBatchId, runKey } from "@yielded/agent-storage-sql/sql-canonical-storage";
 import { SqlStorageProgress } from "@yielded/agent-storage-sql/sql-storage-progress";
-import { EMPTY_TAIL_DIGEST } from "@yielded/agent/digest";
-import { ApprovalDecision, CanonicalSequence, DefinitionDigests, Digest, PersistedJson, ProducerEpoch, RecordEnvelope, SettlementOutcome, WorkerAdmission } from "@yielded/agent/records";
-import { ThreadStoreDiagnostic } from "@yielded/agent/thread-store";
-import { BrowserCrypto } from "@effect/platform-browser";
+import { canonicalRecordJson } from "@yielded/agent-storage-sql/sql-thread-archive-range";
+import { ApprovalDecision, CanonicalSequence, DefinitionDigests, Digest, PersistedJson, RecordEnvelope, SettlementOutcome, WorkerAdmission } from "@yielded/agent/records";
+import { AppendConflict, ThreadNotMaterialized, ThreadStoreDiagnostic, ThreadStoreError, makeTransferFactCheck } from "@yielded/agent/thread-store";
+import { SqliteClient } from "@effect/sql-sqlite-do";
+import { StorageOwner } from "@yielded/agent/run-storage";
+import { decodeAbortFact, decodeAdmissionFact, decodeApprovalFact, decodeResolutionFact } from "@yielded/agent-storage-sql/sql-admission-facts";
 import { InputMessage } from "@yielded/agent/messaging";
-import { AbortCommand, AbortIntent, AbortIntentRequest, AdmissionAdmitted, AdmissionConflict, AdmissionFence, AdmissionGroup, AdmissionNotAdmitted, AdmissionPolicyError, AdmissionRequest, AdmissionResult, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, ChildAttachmentSnapshot, ChildBudgetReservationRequest, ChildBudgetReservationSnapshot, ChildReservationConflict, ChildReservationStatus, ChildSettledNotification, Claim, ClaimJoiningRequest, ClaimRequest, InputAppliedMarker, JoinSnapshot, JoinedToHost, JoiningClaim, LedgerCapabilities, LedgerError, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, OwnershipLost, OwnershipRenewal, OwnershipSnapshot, ParentLinkage, QueueSequence, RecoverySnapshot, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReleaseOwnershipRequest, RenewOwnershipRequest, ReservedChildBudget, ReservedSettlement, RevertJoiningRequest, Settlement, SettlementConflict, SettlementFinalization, SettlementReservation, SettlementReservationSnapshot, SubmissionAdmissionFence, SubmissionLedger, SubmissionLookup, SubmissionLookupByKey, SubmissionSnapshot, SubmissionState, SubmissionWorkItem, SuspendRequest, SuspensionReason, SuspensionSnapshot, UnknownResolution, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, WorkerLedgerState, WorkerStopCommand, settlementFailureFromRecord, submissionAbortRecordId, workerTerminalFromRecord } from "@yielded/agent/submission-ledger";
+import { runIdForSubmission } from "@yielded/agent/run-journal";
+import { SettlementPublicationResult, SettlementPublisher, validateCanonicalSettlement, validateJoinedSettlement, validatePublication } from "@yielded/agent/settlement-publisher";
+import { AbortCommand, AbortIntent, AbortIntentRequest, AdmissionAdmitted, AdmissionConflict, AdmissionFence, AdmissionGroup, AdmissionNotAdmitted, AdmissionPolicyError, AdmissionRequest, AdmissionResult, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, ChildAttachmentSnapshot, ChildBudgetReservationRequest, ChildBudgetReservationSnapshot, ChildReservationConflict, ChildReservationStatus, ChildSettledNotification, Claim, ClaimJoiningRequest, ClaimRequest, FundingOwner, FundingOwnerRequest, InputAppliedMarker, JoinSnapshot, JoinedToHost, JoiningClaim, LedgerCapabilities, LedgerError, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, OwnershipLost, ParentLinkage, QueueSequence, RecoverySnapshot, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReservedChildBudget, RevertJoiningRequest, Settlement, SettlementConflict, SettlementFinalization, SubmissionAdmissionFence, SubmissionLedger, SubmissionLookup, SubmissionLookupByKey, SubmissionSnapshot, SubmissionState, SubmissionWorkItem, SuspendRequest, SuspensionReason, SuspensionSnapshot, UnknownResolution, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, UnknownResolutionKind, WorkerLedgerState, WorkerStopCommand, approvalDecisionsCover, settlementFailureFromRecord, submissionAbortRecordId, submissionSettlementBatchId, submissionSettlementRecordId, unknownResolutionKind, unknownResolutionMatchesResult, workerTerminalFromRecord } from "@yielded/agent/submission-ledger";
 import { AssignmentTerminal } from "@yielded/agent/worker";
 //#region src/DoSubmissionLedger.ts
 var DoSubmissionLedger_exports = /* @__PURE__ */ __exportAll({
@@ -29,7 +34,7 @@ const BoundedStoredText = Schema.String.check(Schema.isMaxLength(2e6));
 const BoundedIdentifier = Schema.NonEmptyString.check(Schema.isMaxLength(1024));
 const BoundedTimestamp = Schema.NonEmptyString.check(Schema.isMaxLength(128));
 const SCAN_PAGE_SIZE = 256;
-const EPOCH_ZERO = Schema.decodeSync(ProducerEpoch)(0);
+const admissionFitsTransfer = makeTransferFactCheck(AdmissionRequest);
 const RESUME_IMMEDIATELY = "resume-immediately";
 const SUSPENDED = "suspended";
 const NOT_WAITING = "not-waiting";
@@ -50,6 +55,8 @@ var SubmissionRow = class extends Schema.Class("SubmissionRow")({
 	receipt_id: BoundedIdentifier,
 	state: SubmissionState,
 	settled_outcome: Schema.NullOr(SettlementOutcome),
+	settled_record_id: Schema.NullOr(BoundedIdentifier),
+	finalized_at: Schema.NullOr(BoundedTimestamp),
 	created_at: BoundedTimestamp,
 	ready_at: Schema.NullOr(BoundedTimestamp),
 	input_applied_record_id: Schema.NullOr(BoundedIdentifier),
@@ -106,29 +113,12 @@ var ApprovalDecisionRow = class extends Schema.Class("ApprovalDecisionRow")({
 var UnknownResolutionRow = class extends Schema.Class("UnknownResolutionRow")({
 	submission_id: BoundedIdentifier,
 	tool_call_id: BoundedIdentifier,
+	resolution_kind: UnknownResolutionKind,
 	author: BoundedIdentifier,
 	reason: BoundedStoredText,
 	resolution_json: BoundedStoredText,
 	resolved_at: BoundedTimestamp
 }) {};
-var OwnershipRow = class extends Schema.Class("OwnershipRow")({
-	submission_id: BoundedIdentifier,
-	attempt_id: BoundedIdentifier,
-	ownership_token: BoundedIdentifier,
-	producer_epoch: ProducerEpoch,
-	owner_producer_id: BoundedIdentifier,
-	lease_expires_at: BoundedTimestamp
-}) {};
-var ReservationRow = class extends Schema.Class("ReservationRow")({
-	submission_id: BoundedIdentifier,
-	settlement_id: BoundedIdentifier,
-	outcome: SettlementOutcome,
-	record_id: BoundedIdentifier,
-	record_json: BoundedStoredText,
-	record_digest: Digest,
-	reserved_at: BoundedTimestamp,
-	finalized_at: Schema.NullOr(BoundedTimestamp)
-}) {};
 var AbortIntentRow = class extends Schema.Class("AbortIntentRow")({
 	submission_id: BoundedIdentifier,
 	author: BoundedIdentifier,
@@ -148,13 +138,14 @@ const SUBMISSION_COLUMNS = `
   principal,
   idempotency_key,
   agent_id,
-  agent_digests_json,
   deployment_id,
   input_json,
   input_digest,
   receipt_id,
   state,
   settled_outcome,
+  settled_record_id,
+  finalized_at,
   created_at,
   ready_at,
   input_applied_record_id,
@@ -189,7 +180,6 @@ const ToolCallIdSchema = ApprovalDecisionCommand.fields.toolCallId;
 const ToolCallIdList = Schema.Array(ToolCallIdSchema);
 const encodePersistedJsonText = Schema.encodeEffect(Schema.fromJsonString(PersistedJson));
 const encodeDefinitionDigestsText = Schema.encodeEffect(Schema.fromJsonString(DefinitionDigests));
-const encodeRecordEnvelopeText = Schema.encodeEffect(Schema.fromJsonString(RecordEnvelope));
 const decodeRecordEnvelopeText = Schema.decodeEffect(Schema.fromJsonString(RecordEnvelope));
 const encodeSuspensionReasonText = Schema.encodeEffect(Schema.fromJsonString(SuspensionReason));
 const encodeUnknownResolutionText = Schema.encodeEffect(Schema.fromJsonString(UnknownResolution));
@@ -198,12 +188,10 @@ const decodeToolCallIdsText = Schema.decodeEffect(Schema.fromJsonString(ToolCall
 const parseStoredJsonText = Schema.decodeEffect(Schema.fromJsonString(Schema.Json));
 const decodeAdmissionResult = Schema.decodeUnknownEffect(AdmissionResult);
 const decodeClaim = Schema.decodeUnknownEffect(Claim);
-const decodeOwnershipRenewal = Schema.decodeUnknownEffect(OwnershipRenewal);
 const decodeSettlement = Schema.decodeUnknownEffect(Settlement);
 const decodeAbortIntent = Schema.decodeUnknownEffect(AbortIntent);
-const decodeOwnershipSnapshot = Schema.decodeUnknownEffect(OwnershipSnapshot);
 const decodeInputAppliedMarker = Schema.decodeUnknownEffect(InputAppliedMarker);
-const decodeSubmissionSnapshotUnknown = Schema.decodeUnknownEffect(SubmissionSnapshot);
+const decodeSubmissionSnapshotType = (input) => Schema.decodeEffect(Schema.toType(Schema.Struct(SubmissionSnapshot.fields)))(input).pipe(Effect.map((fields) => SubmissionSnapshot.make(fields)));
 const decodeSubmissionId = Schema.decodeUnknownEffect(SubmissionSnapshot.fields.submissionId);
 const decodeQueueSequence = Schema.decodeUnknownEffect(QueueSequence);
 const decodeUtcInstant = Schema.decodeUnknownEffect(Schema.DateTimeUtcFromString);
@@ -243,27 +231,32 @@ const submissionsRows = ownedRows(SubmissionRow, "effect_agent_submissions", (ro
 	"thread_id",
 	"principal",
 	"idempotency_key"
-]]);
-const ownershipRows = ownedRows(OwnershipRow, "effect_agent_submission_ownership", (row) => row.submission_id, "submission_id");
-const reservationsRows = ownedRows(ReservationRow, "effect_agent_settlement_reservations", (row) => row.submission_id, "submission_id");
+]], (sql) => sql`*, ${definitionJson(sql)} AS agent_digests_json`);
 const abortsRows = ownedRows(AbortIntentRow, "effect_agent_abort_intents", (row) => row.submission_id, "submission_id");
 const approvalsRows = ownedRows(ApprovalDecisionRow, "effect_agent_approval_decisions", (row) => JSON.stringify([row.submission_id, row.tool_call_id]));
-const resolutionsRows = ownedRows(UnknownResolutionRow, "effect_agent_unknown_resolutions", (row) => JSON.stringify([row.submission_id, row.tool_call_id]));
+const resolutionsRows = ownedRows(UnknownResolutionRow, "effect_agent_unknown_resolutions", (row) => JSON.stringify([
+	row.submission_id,
+	row.tool_call_id,
+	row.resolution_kind
+]));
 const childSettlementsRows = ownedRows(ChildSettlementMarkerRow, "effect_agent_child_settlements", (row) => JSON.stringify([row.parent_submission_id, row.child_submission_id]));
 const childReservationsRows = ownedRows(ChildReservationRow, "effect_agent_child_reservations", (row) => row.reservation_id, "reservation_id");
 const workerStopsRows = ownedRows(WorkerStopRow, "effect_agent_worker_stops", (row) => row.thread_id, "thread_id");
 const submissionWorkRows = ownedRows(SubmissionWorkRow, "effect_agent_submissions", (row) => row.submission_id);
-const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
+const makeServices = Effect.fnUntraced(function* () {
 	const progress = yield* SqlStorageProgress;
 	const recordProgress = (kind, operation) => progress.committed(kind).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, internalFailure(operation)))));
 	const config = yield* DoStorageConfig;
 	const failpoint = yield* DoStorageFailpoint;
 	const sql = yield* SqlClientService.SqlClient;
 	const crypto = yield* Crypto.Crypto;
+	const physical = yield* makeCanonicalStorage();
+	const submissionColumns = sql`${sql.literal(SUBMISSION_COLUMNS)}, ${definitionJson(sql)} AS agent_digests_json`;
 	const admissionFence = yield* SubmissionAdmissionFence;
 	const journal = yield* initializeDoJournal(sql, failpoint.hit, config.maxStoredValueBytes);
 	const lifecycle = journal.lifecycle;
 	const state = journal.state;
+	const owner = state.owner;
 	const submissionViews = submissionsRows(state, sql);
 	const workRows = submissionWorkRows(state, sql);
 	const rows = {
@@ -273,8 +266,6 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 			seed: submissionViews.seed,
 			write: (effect) => submissionViews.write(effect).pipe(Effect.tap((changed) => workRows.write(Effect.succeed(changed))))
 		},
-		ownership: ownershipRows(state, sql),
-		reservations: reservationsRows(state, sql),
 		aborts: abortsRows(state, sql),
 		approvals: approvalsRows(state, sql),
 		resolutions: resolutionsRows(state, sql),
@@ -284,20 +275,12 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		workerStops: workerStopsRows(state, sql)
 	};
 	const cached = (effect, operation) => effect.pipe(Effect.mapError(internalFailure(operation)));
-	const laneWork = Effect.fnUntraced(function* (threadId, operation) {
-		const work = yield* cached(workRows.matching(JSON.stringify(["lane", threadId]), (row) => row.thread_id === threadId, sql`SELECT submission_id, thread_id, queue_sequence, principal, idempotency_key,
-        deployment_id, receipt_id, state FROM effect_agent_submissions WHERE thread_id = ${threadId} LIMIT 129`, 128), operation);
-		return work.length > 128 ? void 0 : [...work].sort((a, b) => a.queue_sequence - b.queue_sequence);
-	});
 	const byKey = Effect.fnUntraced(function* (request, operation) {
-		const lane = yield* laneWork(request.threadId, operation);
-		if (lane === void 0) return yield* cached(rows.submissions.byFields([
+		return yield* cached(rows.submissions.byFields([
 			["thread_id", request.threadId],
 			["principal", request.principal],
 			["idempotency_key", request.idempotencyKey]
 		]), operation);
-		const matches = lane.filter((row) => row.principal === request.principal && row.idempotency_key === request.idempotencyKey);
-		return yield* Effect.forEach(matches, (row) => requireSubmission(operation, row.submission_id));
 	}, state.read);
 	const retainLifecycle = (submission, fact) => lifecycle === void 0 ? Effect.void : Effect.gen(function* () {
 		const ownerThreadId = yield* Schema.decodeEffect(SubmissionSnapshot.fields.threadId)(submission.thread_id).pipe(Effect.mapError(internalFailure("lifecycle owner")));
@@ -331,18 +314,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 	* failures surface as LedgerError carrying the typed `DoStorageError` as cause.
 	*/
 	const inWriteTransaction = (operation, effect, expected) => journal.withWriteTransaction(operation, expected)(effect).pipe(Effect.mapError((error) => isDoStorageError(error) ? internalFailure(operation)(error) : error));
-	const mintUuid = (operation) => crypto.randomUUIDv7.pipe(Effect.mapError((error) => internalFailure(operation)(error)));
+	const mintUuid = (operation) => crypto.randomUUIDv7().pipe(Effect.mapError((error) => internalFailure(operation)(error)));
 	const currentInstant = Effect.map(Clock.currentTimeMillis, (millis) => ({
 		millis,
 		iso: new Date(millis).toISOString()
 	}));
-	const timestampMillis = (operation, rowKey) => (timestamp) => decodeUtcInstant(timestamp).pipe(Effect.map(DateTime.toEpochMillis), Effect.mapError((error) => corruptionFailure(operation, "effect_agent_submission_ownership", rowKey, error.message)));
 	const decodeSubmissionRows = (operation, rowKey, rows) => decodeRows(Schema.Array(SubmissionRow), "effect_agent_submissions", rowKey, rows).pipe(Effect.mapError(internalFailure(operation)));
-	const readSubmission = Effect.fn("DoSubmissionLedger.readSubmission")(function* (operation, submissionId) {
+	const readSubmission = Effect.fnUntraced(function* (operation, submissionId) {
 		const found = yield* cached(rows.submissions.by("submission_id", submissionId), operation);
 		return Option.fromUndefinedOr(found[0]);
 	});
-	const requireSubmission = Effect.fn("DoSubmissionLedger.requireSubmission")(function* (operation, submissionId) {
+	const requireSubmission = Effect.fnUntraced(function* (operation, submissionId) {
 		const submission = yield* readSubmission(operation, submissionId);
 		if (Option.isNone(submission)) return yield* LedgerError.make({
 			operation,
@@ -350,33 +332,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		});
 		return submission.value;
 	});
-	const readOwnership = Effect.fn("DoSubmissionLedger.readOwnership")(function* (operation, submissionId) {
-		const found = yield* cached(rows.ownership.by("submission_id", submissionId), operation);
-		return Option.fromUndefinedOr(found[0]);
-	});
-	const threadEpoch = Effect.fn("DoSubmissionLedger.threadEpoch")(function* (operation, threadId) {
-		const threads = yield* journal.getThread(threadId).pipe(Effect.mapError(internalFailure(operation)));
-		return threads.length === 0 ? EPOCH_ZERO : threads[0].producer_epoch;
+	const requireOwner = Effect.fnUntraced(function* (operation, submission) {
+		if (owner.hasOwner(submission.thread_id, submission.submission_id)) return;
+		const submissionId = yield* decodeSubmissionId(submission.submission_id).pipe(Effect.mapError(internalFailure(operation)));
+		return yield* OwnershipLost.make({ submissionId });
 	});
-	/**
-	* Verify inside the surrounding write transaction that the presented token still owns the
-	* Submission's lane; a superseded or missing token fails with OwnershipLost carrying the
-	* Thread's current producer epoch (DUR-006).
-	*/
-	const requireOwnership = Effect.fnUntraced(function* (operation, submission, ownershipToken) {
-		const ownership = yield* readOwnership(operation, submission.submission_id);
-		const actualEpoch = yield* threadEpoch(operation, submission.thread_id);
-		if (Option.isNone(ownership) || ownership.value.ownership_token !== ownershipToken || ownership.value.producer_epoch !== actualEpoch) {
-			const submissionId = yield* Schema.decodeEffect(SubmissionSnapshot.fields.submissionId)(submission.submission_id).pipe(Effect.mapError(internalFailure(operation)));
-			return yield* OwnershipLost.make({
-				submissionId,
-				actualEpoch
-			});
-		}
-		return ownership.value;
-	}, withStorageSpan("DoSubmissionLedger.requireOwnership", (error) => error._tag === "OwnershipLost"));
 	const submissions = /* @__PURE__ */ new WeakMap();
-	const decodeSubmissionSnapshot = Effect.fn("DoSubmissionLedger.decodeSubmissionSnapshot")(function* (operation, row) {
+	const decodeSubmissionSnapshot = Effect.fnUntraced(function* (operation, row) {
 		const existing = submissions.get(row);
 		if (existing !== void 0) return existing;
 		const decodeFailure = (error) => internalFailure(operation)(DoStorageCorruptionError.make({
@@ -390,42 +352,39 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 				issueTag: error.issue._tag
 			})
 		}));
-		const agentDigests = yield* parseStoredJsonText(row.agent_digests_json).pipe(Effect.mapError(decodeFailure));
-		const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(Effect.mapError(decodeFailure));
 		if (row.parent_submission_id === null !== (row.parent_tool_call_id === null)) return yield* corruptionFailure(operation, "effect_agent_submissions", row.submission_id, "A parent linkage must record both the parent Submission and the parent Tool Call.");
-		const snapshot = yield* decodeSubmissionSnapshotUnknown({
-			submissionId: row.submission_id,
-			threadId: row.thread_id,
-			queueSequence: row.queue_sequence,
-			principal: row.principal,
-			idempotencyKey: row.idempotency_key,
-			agentId: row.agent_id,
-			agentDigests,
-			deploymentId: row.deployment_id,
-			inputPayload,
-			inputDigest: row.input_digest,
-			receiptId: row.receipt_id,
+		const admission = yield* decodeAdmissionFact(row).pipe(Effect.mapError(decodeFailure));
+		const readyAt = row.ready_at === null ? void 0 : yield* decodeUtcInstant(row.ready_at).pipe(Effect.mapError(decodeFailure));
+		const snapshot = yield* decodeSubmissionSnapshotType({
+			...admission,
 			state: row.state,
-			createdAt: row.created_at,
-			...row.admission_group === null ? {} : { admissionGroup: row.admission_group },
-			...row.worker_admission_json === null ? {} : { workerAdmission: yield* parseStoredJsonText(row.worker_admission_json).pipe(Effect.mapError(decodeFailure)) },
-			...row.message_admission_json === null ? {} : { messageAdmission: yield* parseStoredJsonText(row.message_admission_json).pipe(Effect.mapError(decodeFailure)) },
-			...row.admission_fence_json === null ? {} : { admissionFence: yield* parseStoredJsonText(row.admission_fence_json).pipe(Effect.mapError(decodeFailure)) },
 			...row.settled_outcome === null ? {} : { settledOutcome: row.settled_outcome },
-			...row.ready_at === null ? {} : { readyAt: row.ready_at },
-			...row.parent_submission_id === null || row.parent_tool_call_id === null ? {} : { parentLinkage: {
-				parentSubmissionId: row.parent_submission_id,
-				parentToolCallId: row.parent_tool_call_id
-			} }
+			...readyAt === void 0 ? {} : { readyAt }
 		}).pipe(Effect.mapError(decodeFailure));
 		submissions.set(row, snapshot);
 		return snapshot;
 	});
-	const readReservation = Effect.fn("DoSubmissionLedger.readReservation")(function* (operation, submissionId) {
-		const found = yield* cached(rows.reservations.by("submission_id", submissionId), operation);
-		return Option.fromUndefinedOr(found[0]);
+	const readCanonicalSettlement = Effect.fnUntraced(function* (operation, submission) {
+		const expected = yield* decodeSubmissionSnapshot(operation, submission);
+		const recordId = submissionSettlementRecordId(expected.submissionId);
+		const found = yield* sql`SELECT ${recordBatchId(sql)} AS batch_id, record_id, ${canonicalRecordJson(sql)} AS record_json
+      FROM effect_agent_canonical_records WHERE thread_id = ${submission.thread_id}
+      AND record_id = ${JSON.stringify(recordId)}`.pipe(Effect.mapError(sqlFailure(operation)));
+		const decoded = yield* decodeRows(Schema.Array(Schema.Struct({
+			batch_id: Schema.fromJsonString(BoundedIdentifier),
+			record_id: Schema.fromJsonString(BoundedIdentifier),
+			record_json: BoundedStoredText
+		})), "effect_agent_canonical_records", recordId, found).pipe(Effect.mapError(internalFailure(operation)));
+		if (decoded.length === 0) return void 0;
+		const row = decoded[0];
+		if (decoded.length !== 1 || row.batch_id !== submissionSettlementBatchId(expected.submissionId) || row.record_id !== recordId) return yield* corruptionFailure(operation, "effect_agent_canonical_records", recordId, "Canonical settlement identity is inconsistent.");
+		const record = yield* decodeRecordEnvelopeText(row.record_json).pipe(Effect.mapError(internalFailure(operation)));
+		return {
+			record,
+			settlement: yield* validateCanonicalSettlement(record, expected)
+		};
 	});
-	const readAbortIntent = Effect.fn("DoSubmissionLedger.readAbortIntent")(function* (operation, submissionId) {
+	const readAbortIntent = Effect.fnUntraced(function* (operation, submissionId) {
 		const found = yield* cached(rows.aborts.by("submission_id", submissionId), operation);
 		return Option.fromUndefinedOr(found[0]);
 	});
@@ -434,7 +393,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 	* Submission (the DC realization of the port's "cross-store adapters record a durable
 	* notification marker" contract).
 	*/
-	const readChildSettlementMarkers = Effect.fn("DoSubmissionLedger.readChildSettlementMarkers")(function* (operation, parentSubmissionId) {
+	const readChildSettlementMarkers = Effect.fnUntraced(function* (operation, parentSubmissionId) {
 		return (yield* cached(rows.childSettlements.by("parent_submission_id", parentSubmissionId), operation)).toSorted((a, b) => a.child_submission_id < b.child_submission_id ? -1 : a.child_submission_id > b.child_submission_id ? 1 : 0);
 	});
 	/**
@@ -443,13 +402,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 	* cross-store notification marker was recorded for it (the child's row lives in another
 	* Durable Object and its owner reported the settlement through `recordChildSettled`).
 	*/
-	const childProvablySettled = Effect.fn("DoSubmissionLedger.childProvablySettled")(function* (operation, markerChildren, childSubmissionId) {
+	const childProvablySettled = Effect.fnUntraced(function* (operation, markerChildren, childSubmissionId) {
 		if (markerChildren.has(childSubmissionId)) return true;
 		const childRow = yield* readSubmission(operation, childSubmissionId);
-		return Option.isSome(childRow) && childRow.value.state === "settled";
+		return Option.isSome(childRow) && (yield* readCanonicalSettlement(operation, childRow.value)) !== void 0;
 	});
 	const decodeChildReservationRows = (operation, rowKey, rows) => decodeRows(Schema.Array(ChildReservationRow), "effect_agent_child_reservations", rowKey, rows).pipe(Effect.mapError(internalFailure(operation)));
-	const readChildReservation = Effect.fn("DoSubmissionLedger.readChildReservation")(function* (operation, reservationId) {
+	const readChildReservation = Effect.fnUntraced(function* (operation, reservationId) {
 		const rows = yield* sql`
       SELECT ${sql.literal(CHILD_RESERVATION_COLUMNS)}
       FROM effect_agent_child_reservations
@@ -459,7 +418,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		if (decoded.length > 1) return yield* corruptionFailure(operation, "effect_agent_child_reservations", reservationId, "A child reservation primary key returned more than one row.");
 		return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
 	});
-	const readChildReservationForCall = Effect.fn("DoSubmissionLedger.readChildReservationForCall")(function* (operation, parentSubmissionId, parentToolCallId) {
+	const readChildReservationForCall = Effect.fnUntraced(function* (operation, parentSubmissionId, parentToolCallId) {
 		const rows = yield* sql`
         SELECT ${sql.literal(CHILD_RESERVATION_COLUMNS)}
         FROM effect_agent_child_reservations
@@ -470,7 +429,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		if (decoded.length > 1) return yield* corruptionFailure(operation, "effect_agent_child_reservations", `${parentSubmissionId}/${parentToolCallId}`, "A parent Tool Call returned more than one child reservation.");
 		return decoded.length === 0 ? Option.none() : Option.some(decoded[0]);
 	});
-	const childReservationSnapshotFromRow = Effect.fn("DoSubmissionLedger.childReservationSnapshotFromRow")(function* (operation, row) {
+	const childReservationSnapshotFromRow = Effect.fnUntraced(function* (operation, row) {
 		const rowFailure = (error) => corruptionFailure(operation, "effect_agent_child_reservations", row.reservation_id, error.message);
 		const allocation = yield* parseStoredJsonText(row.allocation_json).pipe(Effect.mapError(rowFailure));
 		const accounting = row.accounting_json === null ? void 0 : yield* parseStoredJsonText(row.accounting_json).pipe(Effect.mapError(rowFailure));
@@ -488,35 +447,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 			...row.released_at === null ? {} : { releasedAt: row.released_at }
 		}).pipe(Effect.mapError(rowFailure));
 	});
-	const readApprovalDecisions = Effect.fn("DoSubmissionLedger.readApprovalDecisions")(function* (operation, submissionId) {
+	const readApprovalDecisions = Effect.fnUntraced(function* (operation, submissionId) {
 		return (yield* cached(rows.approvals.by("submission_id", submissionId), operation)).toSorted((a, b) => a.tool_call_id < b.tool_call_id ? -1 : a.tool_call_id > b.tool_call_id ? 1 : 0);
 	});
-	const approvalIntentFromRow = Effect.fn("DoSubmissionLedger.approvalIntentFromRow")(function* (operation, row) {
-		return yield* decodeApprovalDecisionIntent({
-			submissionId: row.submission_id,
-			toolCallId: row.tool_call_id,
-			decision: row.decision,
-			resolver: row.resolver,
-			reason: row.reason,
-			decidedAt: row.decided_at
-		}).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_approval_decisions", `${row.submission_id}/${row.tool_call_id}`, error.message)));
-	});
-	const readUnknownResolutions = Effect.fn("DoSubmissionLedger.readUnknownResolutions")(function* (operation, submissionId) {
+	const approvalIntentFromRow = (operation, row) => decodeApprovalFact(row).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_approval_decisions", `${row.submission_id}/${row.tool_call_id}`, error.message)));
+	const readUnknownResolutions = Effect.fnUntraced(function* (operation, submissionId) {
 		return (yield* cached(rows.resolutions.by("submission_id", submissionId), operation)).toSorted((a, b) => a.tool_call_id < b.tool_call_id ? -1 : a.tool_call_id > b.tool_call_id ? 1 : 0);
 	});
-	const unknownResolutionIntentFromRow = Effect.fn("DoSubmissionLedger.unknownResolutionIntentFromRow")(function* (operation, row) {
-		const resolution = yield* parseStoredJsonText(row.resolution_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_unknown_resolutions", `${row.submission_id}/${row.tool_call_id}`, error.message)));
-		return yield* decodeUnknownResolutionIntent({
-			submissionId: row.submission_id,
-			toolCallId: row.tool_call_id,
-			author: row.author,
-			reason: row.reason,
-			resolution,
-			resolvedAt: row.resolved_at
-		}).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_unknown_resolutions", `${row.submission_id}/${row.tool_call_id}`, error.message)));
+	const unknownResolutionIntentFromRow = Effect.fnUntraced(function* (operation, row) {
+		return yield* decodeResolutionFact(row).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_unknown_resolutions", `${row.submission_id}/${row.tool_call_id}`, error.message)));
 	});
 	/** The Submission's marked-unknown open Tool Call identities, empty when never marked. */
-	const storedUnknownToolCallIds = Effect.fn("DoSubmissionLedger.storedUnknownToolCallIds")(function* (operation, submission) {
+	const storedUnknownToolCallIds = Effect.fnUntraced(function* (operation, submission) {
 		if (submission.unknown_tool_call_ids_json === null) return [];
 		return yield* decodeToolCallIdsText(submission.unknown_tool_call_ids_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_submissions", submission.submission_id, error.message)));
 	});
@@ -525,22 +467,20 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 	* derived from the shared canonical-records table using the deterministic abort record
 	* identity, never from a cached ledger marker.
 	*/
-	const canonicalAbortRecordId = Effect.fn("DoSubmissionLedger.canonicalAbortRecordId")(function* (operation, threadId, submissionId) {
+	const canonicalAbortRecordId = Effect.fnUntraced(function* (operation, threadId, submissionId) {
 		const recordId = submissionAbortRecordId(submissionId);
 		return (yield* journal.hasRecord(threadId, recordId).pipe(Effect.mapError(internalFailure(operation)))) ? recordId : void 0;
 	});
-	const abortIntentFromRow = Effect.fn("DoSubmissionLedger.abortIntentFromRow")(function* (operation, submission, submissionId, row) {
+	const abortIntentFromRow = Effect.fnUntraced(function* (operation, submission, submissionId, row) {
 		const canonicalRecordId = yield* canonicalAbortRecordId(operation, submission.thread_id, submissionId);
-		return yield* decodeAbortIntent({
-			submissionId: row.submission_id,
-			author: row.author,
-			reason: row.reason,
-			requestedAt: row.requested_at,
+		const fact = yield* decodeAbortFact(row).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_abort_intents", row.submission_id, error.message)));
+		return AbortIntent.make({
+			...fact,
 			...canonicalRecordId === void 0 ? {} : { canonicalRecordId }
-		}).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_abort_intents", row.submission_id, error.message)));
+		});
 	});
 	const capabilities = Effect.succeed(LedgerCapabilities.make({ durability: "durable-cloudflare" }));
-	const admit = Effect.fn("DoSubmissionLedger.admit")(function* (request) {
+	const admit = Effect.fnUntraced(function* (request) {
 		const operation = "ledger admit";
 		const validated = yield* Schema.decodeEffect(Schema.toType(AdmissionRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		const inputJson = yield* encodePersistedJsonText(validated.inputPayload).pipe(Effect.mapError(internalFailure(operation)));
@@ -595,15 +535,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 					replayed: true
 				}).pipe(Effect.mapError(internalFailure(operation)));
 			}
+			if (!admissionFitsTransfer(validated.threadId, validated)) return yield* LedgerError.make({
+				operation,
+				message: "Admission exceeds the complete transfer page byte bound"
+			});
 			if ((yield* cached(rows.workerStops.by("thread_id", validated.threadId), operation)).length > 0) return yield* AdmissionPolicyError.make({
 				reason: "refused",
 				code: "worker-stopped"
 			});
-			const lane = yield* laneWork(validated.threadId, operation);
-			const firstRows = lane === void 0 ? yield* sql`
+			const firstRows = yield* sql`
             SELECT worker_admission_json FROM effect_agent_submissions
             WHERE thread_id=${validated.threadId} ORDER BY queue_sequence LIMIT 1
-          `.pipe(Effect.mapError(sqlFailure(operation))) : lane[0] === void 0 ? [] : [yield* requireSubmission(operation, lane[0].submission_id)];
+          `.pipe(Effect.mapError(sqlFailure(operation)));
 			const first = yield* Schema.decodeUnknownEffect(Schema.Array(Schema.Struct({ worker_admission_json: Schema.NullOr(BoundedStoredText) })))(firstRows).pipe(Effect.mapError(internalFailure(operation)));
 			if (first[0] !== void 0) {
 				const previous = first[0].worker_admission_json === null ? void 0 : yield* Schema.decodeEffect(Schema.fromJsonString(WorkerAdmission))(first[0].worker_admission_json).pipe(Effect.mapError(internalFailure(operation)));
@@ -622,11 +565,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 					code: "admission-group"
 				});
 			}
-			const maxRows = lane === void 0 ? yield* sql`
+			const maxRows = yield* sql`
             SELECT COALESCE(MAX(queue_sequence), 0) AS max_queue_sequence
             FROM effect_agent_submissions
             WHERE thread_id = ${validated.threadId}
-          `.pipe(Effect.mapError(sqlFailure(operation))) : [{ max_queue_sequence: lane.at(-1)?.queue_sequence ?? 0 }];
+          `.pipe(Effect.mapError(sqlFailure(operation)));
 			const decodedMax = yield* decodeRows(Schema.Array(MaxQueueSequenceRow), "effect_agent_submissions", validated.threadId, maxRows).pipe(Effect.mapError(internalFailure(operation)));
 			const queueSequence = yield* decodeQueueSequence((decodedMax[0]?.max_queue_sequence ?? 0) + 1).pipe(Effect.mapError(internalFailure(operation)));
 			const now = yield* currentInstant;
@@ -638,7 +581,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               principal,
               idempotency_key,
               agent_id,
-              agent_digests_json,
+              definition_key,
               deployment_id,
               input_json,
               input_digest,
@@ -658,7 +601,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               ${validated.principal},
               ${validated.idempotencyKey},
               ${validated.agentId},
-              ${agentDigestsJson},
+              ${yield* physical.definition(agentDigestsJson).pipe(Effect.mapError(internalFailure(operation)))},
               ${validated.deploymentId},
               ${inputJson},
               ${validated.inputDigest},
@@ -672,10 +615,11 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               ${workerAdmissionJson},
               ${messageAdmissionJson}
             )
-           RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+           RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+			if (queueSequence === 1) {
+				if ((yield* journal.getThread(validated.threadId).pipe(Effect.mapError(internalFailure(operation)))).length === 0) yield* journal.work.initialize(validated.threadId).pipe(Effect.mapError(internalFailure(operation)));
+			}
 			rows.aborts.seed("submission_id", mintedSubmissionId, []);
-			rows.ownership.seed("submission_id", mintedSubmissionId, []);
-			rows.reservations.seed("submission_id", mintedSubmissionId, []);
 			rows.submissions.seed("joined_host_submission_id", mintedSubmissionId, []);
 			rows.approvals.seed("submission_id", mintedSubmissionId, []);
 			rows.resolutions.seed("submission_id", mintedSubmissionId, []);
@@ -693,7 +637,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:admit:after", operation);
 		return result;
 	});
-	const markReady = Effect.fn("DoSubmissionLedger.markReady")(function* (request) {
+	const markReady = Effect.fnUntraced(function* (request) {
 		const operation = "ledger mark ready";
 		const validated = yield* Schema.decodeEffect(Schema.toType(MarkReadyRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:mark-ready:before", operation);
@@ -705,7 +649,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           UPDATE effect_agent_submissions
           SET state = 'ready', ready_at = ${now.iso}
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 			yield* recordProgress("submission", operation);
 			yield* retainLifecycle(submission, {
 				_tag: "SubmissionReady",
@@ -714,7 +658,29 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		}));
 		yield* hitFailpoint("ledger:mark-ready:after", operation);
 	});
-	const lookup = Effect.fn("DoSubmissionLedger.lookup")(function* (request) {
+	const resolveFundingOwner = Effect.fnUntraced(function* (input) {
+		const operation = "resolve funding owner";
+		const request = yield* Schema.decodeEffect(FundingOwnerRequest)(input).pipe(Effect.mapError(internalFailure(operation)));
+		const selected = yield* requireSubmission(operation, request.submissionId);
+		if (selected.thread_id !== request.threadId) return yield* LedgerError.make({
+			operation,
+			message: "Selected funding input belongs to another Thread."
+		});
+		if (selected.state === "joining") return yield* LedgerError.make({
+			operation,
+			message: "Selected funding input is still joining; retry after durable binding."
+		});
+		const hostId = selected.joined_host_submission_id;
+		if (hostId === null && selected.state === "joined") return yield* corruptionFailure(operation, "effect_agent_submissions", selected.submission_id, "Joined input has no stable host identity.");
+		if (hostId !== null && selected.state !== "joined" && selected.state !== "settled") return yield* corruptionFailure(operation, "effect_agent_submissions", selected.submission_id, "Host linkage is inconsistent with selected input state.");
+		const owner = hostId === null ? selected : yield* requireSubmission(operation, hostId);
+		if (owner.thread_id !== request.threadId || hostId !== null && (owner.submission_id === selected.submission_id || owner.joined_host_submission_id !== null || owner.state === "joining" || owner.state === "joined" || owner.queue_sequence >= selected.queue_sequence)) return yield* corruptionFailure(operation, "effect_agent_submissions", selected.submission_id, "Funding host is not a stable earlier input in this Thread.");
+		return yield* Schema.decodeEffect(Schema.toType(FundingOwner))({
+			selected: yield* decodeSubmissionSnapshot(operation, selected),
+			owner: yield* decodeSubmissionSnapshot(operation, owner)
+		}).pipe(Effect.mapError(internalFailure(operation)));
+	}, state.read);
+	const lookup = Effect.fnUntraced(function* (request) {
 		const operation = "ledger lookup";
 		const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookup))(request).pipe(Effect.mapError(internalFailure(operation)));
 		if (validated._tag === "SubmissionLookupById") {
@@ -728,7 +694,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		if (decoded.length === 0) return Option.none();
 		return Option.some(yield* decodeSubmissionSnapshot(operation, decoded[0]));
 	});
-	const resolveAdmission = Effect.fn("DoSubmissionLedger.resolveAdmission")(function* (request) {
+	const resolveAdmission = Effect.fnUntraced(function* (request) {
 		const operation = "ledger resolve admission";
 		const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookupByKey))(request).pipe(Effect.mapError(internalFailure(operation)));
 		const foundRows = yield* byKey(validated, operation);
@@ -737,30 +703,15 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		if (decoded.length === 0) return AdmissionNotAdmitted.make();
 		return AdmissionAdmitted.make({ submission: yield* decodeSubmissionSnapshot(operation, decoded[0]) });
 	});
-	const claim = Effect.fn("DoSubmissionLedger.claim")(function* (request) {
-		const operation = "ledger claim";
+	const selectHead = Effect.fn("DoSubmissionLedger.selectHead")(function* (request) {
+		const operation = "ledger select head";
 		const validated = yield* Schema.decodeEffect(Schema.toType(ClaimRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		const attemptId = `attempt-${yield* mintUuid(operation)}`;
-		const ownershipToken = `owner-${yield* mintUuid(operation)}`;
 		yield* hitFailpoint("ledger:claim:before", operation);
-		const claimed = yield* inWriteTransaction(operation, Effect.gen(function* () {
-			const now = yield* currentInstant;
-			const lane = yield* laneWork(validated.threadId, operation);
-			const ownershipRows = lane === void 0 ? yield* sql`
-            SELECT ownership.*
-            FROM effect_agent_submission_ownership AS ownership
-            JOIN effect_agent_submissions AS submission
-              ON submission.submission_id = ownership.submission_id
-            WHERE submission.thread_id = ${validated.threadId}
-            ORDER BY ownership.lease_expires_at DESC
-            LIMIT 1
-          `.pipe(Effect.mapError(sqlFailure(operation))) : (yield* Effect.forEach(lane.filter((item) => item.state !== "settled"), (item) => cached(rows.ownership.by("submission_id", item.submission_id), operation))).flat().sort((a, b) => b.lease_expires_at.localeCompare(a.lease_expires_at)).slice(0, 1);
-			const ownership = yield* decodeRows(Schema.Array(OwnershipRow), "effect_agent_submission_ownership", validated.threadId, ownershipRows).pipe(Effect.mapError(internalFailure(operation)));
-			if (ownership.length > 0) {
-				if ((yield* timestampMillis(operation, ownership[0].submission_id)(ownership[0].lease_expires_at)) > now.millis) return Option.none();
-			}
-			const headRows = lane === void 0 ? yield* sql`
-            SELECT ${sql.literal(SUBMISSION_COLUMNS)}
+		const claimed = yield* owner.withMutation(Effect.gen(function* () {
+			if (owner.hasOwner(validated.threadId)) return Option.none();
+			const headRows = yield* sql`
+            SELECT ${submissionColumns}
             FROM effect_agent_submissions
             WHERE thread_id = ${validated.threadId}
               AND state <> 'settled'
@@ -772,16 +723,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               )
             ORDER BY queue_sequence ASC
             LIMIT ${validated.handoff === void 0 ? 1 : validated.handoff.deferredSubmissionIds.length + 1}
-          `.pipe(Effect.mapError(sqlFailure(operation))) : yield* Effect.gen(function* () {
-				const heads = [];
-				for (const item of lane) {
-					if (item.state === "settled") continue;
-					if (item.state === "unknown" && Option.isNone(yield* readAbortIntent(operation, item.submission_id))) continue;
-					heads.push(yield* requireSubmission(operation, item.submission_id));
-					if (heads.length >= (validated.handoff === void 0 ? 1 : validated.handoff.deferredSubmissionIds.length + 1)) break;
-				}
-				return heads;
-			});
+          `.pipe(Effect.mapError(sqlFailure(operation)));
 			const heads = yield* decodeSubmissionRows(operation, validated.threadId, headRows);
 			if (heads.length === 0) return Option.none();
 			let head = heads[0];
@@ -794,146 +736,26 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 					}
 					if (!handoff.deferredSubmissionIds.some((id) => id === candidate.submission_id) || candidate.state !== "input-applied" || Option.isSome(yield* readAbortIntent(operation, candidate.submission_id))) return Option.none();
 				}
-				if (head.submission_id !== handoff.submissionId || head.state !== "ready" && head.state !== "running" && head.state !== "input-applied") return Option.none();
+				if (head.submission_id !== handoff.submissionId || head.state !== "ready" && head.state !== "input-applied") return Option.none();
 			}
 			if (head.state === "joining" || head.state === "joined" || head.state === "suspended" || head.state === "unknown" && Option.isNone(yield* readAbortIntent(operation, head.submission_id))) return Option.none();
-			const threads = yield* journal.getThread(head.thread_id).pipe(Effect.mapError(internalFailure(operation)));
-			if (validated.handoff !== void 0 && threads[0]?.producer_epoch !== validated.handoff.producerEpoch) return Option.none();
-			let producerEpoch;
-			if (threads.length === 0) {
-				producerEpoch = 1;
-				yield* sql`
-              INSERT INTO effect_agent_threads (
-                thread_id,
-                created_at,
-                tail_sequence,
-                tail_digest,
-                producer_epoch
-              ) VALUES (
-                ${head.thread_id},
-                ${now.iso},
-                0,
-                ${EMPTY_TAIL_DIGEST},
-                ${producerEpoch}
-              )
-             RETURNING *`.pipe(rows.threads.write, Effect.mapError(internalFailure(operation)));
-			} else {
-				producerEpoch = threads[0].producer_epoch + 1;
-				yield* sql`
-              UPDATE effect_agent_threads
-              SET producer_epoch = ${producerEpoch}
-              WHERE thread_id = ${head.thread_id}
-             RETURNING *`.pipe(rows.threads.write, Effect.mapError(internalFailure(operation)));
-			}
-			const leaseExpiresAt = new Date(now.millis + config.ownershipLeaseDuration).toISOString();
-			yield* sql`
-            INSERT INTO effect_agent_submission_ownership (
-              submission_id,
-              attempt_id,
-              ownership_token,
-              producer_epoch,
-              owner_producer_id,
-              lease_expires_at
-            ) VALUES (
-              ${head.submission_id},
-              ${attemptId},
-              ${ownershipToken},
-              ${producerEpoch},
-              ${validated.producerId},
-              ${leaseExpiresAt}
-            )
-            ON CONFLICT (submission_id) DO UPDATE SET
-              attempt_id = excluded.attempt_id,
-              ownership_token = excluded.ownership_token,
-              producer_epoch = excluded.producer_epoch,
-              owner_producer_id = excluded.owner_producer_id,
-              lease_expires_at = excluded.lease_expires_at
-           RETURNING *`.pipe(rows.ownership.write, Effect.mapError(internalFailure(operation)));
-			yield* sql`
-            INSERT INTO effect_agent_attempts (
-              attempt_id,
-              submission_id,
-              thread_id,
-              owner_producer_id,
-              producer_epoch,
-              claimed_at
-            ) VALUES (
-              ${attemptId},
-              ${head.submission_id},
-              ${head.thread_id},
-              ${validated.producerId},
-              ${producerEpoch},
-              ${now.iso}
-            )
-          `.pipe(Effect.mapError(sqlFailure(operation)));
-			if (head.state === "ready") yield* sql`
-              UPDATE effect_agent_submissions
-              SET state = 'running'
-              WHERE submission_id = ${head.submission_id}
-             RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 			const inputPayload = yield* parseStoredJsonText(head.input_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_submissions", head.submission_id, error.message)));
 			return Option.some(yield* decodeClaim({
 				submissionId: head.submission_id,
 				attemptId,
-				ownershipToken,
-				producerEpoch,
-				leaseExpiresAt,
 				inputPayload
 			}).pipe(Effect.mapError(internalFailure(operation))));
 		}));
 		yield* hitFailpoint("ledger:claim:after", operation);
 		return claimed;
 	});
-	const renewOwnership = Effect.fn("DoSubmissionLedger.renewOwnership")(function* (request) {
-		const operation = "ledger renew ownership";
-		const validated = yield* Schema.decodeEffect(Schema.toType(RenewOwnershipRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
-		yield* hitFailpoint("ledger:renew:before", operation);
-		const renewal = yield* inWriteTransaction(operation, Effect.gen(function* () {
-			const submission = yield* requireSubmission(operation, validated.submissionId);
-			yield* requireOwnership(operation, submission, validated.ownershipToken);
-			const now = yield* currentInstant;
-			const leaseExpiresAt = new Date(now.millis + config.ownershipLeaseDuration).toISOString();
-			yield* sql`
-          UPDATE effect_agent_submission_ownership
-          SET lease_expires_at = ${leaseExpiresAt}
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.ownership.write, Effect.mapError(internalFailure(operation)));
-			return yield* decodeOwnershipRenewal({
-				ownershipToken: validated.ownershipToken,
-				leaseExpiresAt
-			}).pipe(Effect.mapError(internalFailure(operation)));
-		}));
-		yield* hitFailpoint("ledger:renew:after", operation);
-		return renewal;
-	});
-	const releaseOwnership = Effect.fnUntraced(function* (request) {
-		const operation = "ledger release ownership";
-		const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseOwnershipRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
-		yield* hitFailpoint("ledger:release:before", operation);
-		const current = yield* requireSubmission(operation, validated.submissionId);
-		yield* requireOwnership(operation, current, validated.ownershipToken);
-		yield* inWriteTransaction(operation, Effect.gen(function* () {
-			const submission = yield* requireSubmission(operation, validated.submissionId);
-			yield* requireOwnership(operation, submission, validated.ownershipToken);
-			yield* sql`
-          DELETE FROM effect_agent_submission_ownership
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.ownership.remove, Effect.mapError(internalFailure(operation)));
-			if (submission.state === "running") yield* sql`
-            UPDATE effect_agent_submissions
-            SET state = 'ready'
-            WHERE submission_id = ${validated.submissionId}
-           RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-		}), (error) => error._tag === "OwnershipLost");
-		yield* hitFailpoint("ledger:release:after", operation);
-	}, withStorageSpan("DoSubmissionLedger.releaseOwnership", (error) => error._tag === "OwnershipLost"));
-	const markInputApplied = Effect.fn("DoSubmissionLedger.markInputApplied")(function* (request) {
+	const markInputApplied = Effect.fnUntraced(function* (request) {
 		const operation = "ledger mark input applied";
 		const validated = yield* Schema.decodeEffect(Schema.toType(MarkInputAppliedRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:mark-input-applied:before", operation);
 		yield* inWriteTransaction(operation, Effect.gen(function* () {
 			const submission = yield* requireSubmission(operation, validated.submissionId);
-			yield* requireOwnership(operation, submission, validated.ownershipToken);
+			yield* requireOwner(operation, submission);
 			if (submission.input_applied_record_id !== null) {
 				if (submission.input_applied_record_id === validated.recordId && submission.input_applied_sequence === validated.sequence) return;
 				return yield* corruptionFailure(operation, "effect_agent_submissions", validated.submissionId, "A different canonical input marker is already recorded for this Submission.");
@@ -944,122 +766,132 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             input_applied_record_id = ${validated.recordId},
             input_applied_sequence = ${validated.sequence},
             state = CASE
-              WHEN state IN ('admitted', 'ready', 'running') THEN 'input-applied'
+              WHEN state IN ('admitted', 'ready') THEN 'input-applied'
               ELSE state
             END
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 		}));
 		yield* hitFailpoint("ledger:mark-input-applied:after", operation);
 	});
-	const reserveSettlement = Effect.fn("DoSubmissionLedger.reserveSettlement")(function* (request) {
-		const operation = "ledger reserve settlement";
-		const validated = yield* Schema.decodeEffect(Schema.toType(SettlementReservation))(request).pipe(Effect.mapError(internalFailure(operation)));
-		const recordJson = yield* encodeRecordEnvelopeText(validated.record).pipe(Effect.mapError(internalFailure(operation)));
-		yield* journal.checkValueBound(operation, recordJson).pipe(Effect.mapError(internalFailure(operation)));
-		yield* hitFailpoint("ledger:reserve-settlement:before", operation);
-		const reserved = yield* inWriteTransaction(operation, Effect.gen(function* () {
-			const existing = yield* readReservation(operation, validated.submissionId);
-			if (Option.isSome(existing)) {
-				if (!(existing.value.settlement_id === validated.settlementId && existing.value.outcome === validated.outcome && existing.value.record_digest === validated.recordDigest && existing.value.record_json === recordJson)) return yield* SettlementConflict.make({
-					submissionId: validated.submissionId,
-					existingOutcome: existing.value.outcome
+	const publish = Effect.fn("DoSubmissionLedger.publishSettlement")(function* (input) {
+		const operation = "publish settlement";
+		const { request, record, settlement } = yield* validatePublication(input);
+		const prepared = yield* prepareCanonicalAppend(request.append).pipe(Effect.provideService(Crypto.Crypto, crypto));
+		const mapAppendError = (error) => ThreadStoreError.make({
+			operation,
+			message: error.message,
+			cause: error
+		});
+		yield* journal.prepareAppend(prepared.raw).pipe(Effect.mapError(mapAppendError));
+		return yield* owner.withProgress(request.append.threadId, owner.withMutation(Effect.gen(function* () {
+			yield* hitFailpoint("append:before", operation);
+			const result = yield* journal.withWriteTransaction(operation)(Effect.gen(function* () {
+				const submission = yield* requireSubmission(operation, request.submissionId);
+				if (submission.thread_id !== prepared.request.threadId) return yield* LedgerError.make({
+					operation,
+					message: "Settlement publication belongs to another Thread."
 				});
-				const record = yield* decodeRecordEnvelopeText(existing.value.record_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_settlement_reservations", validated.submissionId, error.message)));
-				return ReservedSettlement.make({
-					submissionId: validated.submissionId,
-					settlementId: validated.settlementId,
-					outcome: validated.outcome,
+				const snapshot = yield* decodeSubmissionSnapshot(operation, submission);
+				yield* validateCanonicalSettlement(record, snapshot);
+				const existing = yield* readCanonicalSettlement(operation, submission);
+				const thread = (yield* journal.getThread(prepared.request.threadId))[0];
+				if (thread === void 0) return yield* ThreadNotMaterialized.make({ threadId: prepared.request.threadId });
+				switch (request.authority._tag) {
+					case "Owned":
+						yield* requireOwner(operation, submission);
+						yield* validateCanonicalSettlement(record, {
+							submissionId: request.submissionId,
+							receiptId: snapshot.receiptId,
+							...settlement.outcome === "aborted" && settlement.runId === void 0 ? {} : { runId: runIdForSubmission(request.submissionId) }
+						});
+						break;
+					case "Joined": {
+						if (submission.state !== "joined" && !(submission.state === "settled" && existing !== void 0) || submission.joined_host_submission_id !== request.authority.hostSubmissionId) return yield* LedgerError.make({
+							operation,
+							message: "Submission is not joined to the named host."
+						});
+						const host = yield* requireSubmission(operation, request.authority.hostSubmissionId);
+						if (host.thread_id !== submission.thread_id) return yield* LedgerError.make({
+							operation,
+							message: "Joined host belongs to another Thread."
+						});
+						const canonicalHost = yield* readCanonicalSettlement(operation, host);
+						if (canonicalHost === void 0) return yield* LedgerError.make({
+							operation,
+							message: "Joined host has no canonical settlement."
+						});
+						yield* validateJoinedSettlement(settlement, canonicalHost.settlement);
+						break;
+					}
+					case "QueuedAbort":
+						if (submission.state !== "ready" && !(submission.state === "settled" && existing !== void 0) || settlement.outcome !== "aborted" || Option.isNone(yield* readAbortIntent(operation, request.submissionId)) || owner.hasOwner(submission.thread_id, request.submissionId)) return yield* LedgerError.make({
+							operation,
+							message: "Queued abort is no longer authorized."
+						});
+						yield* validateCanonicalSettlement(record, {
+							submissionId: request.submissionId,
+							receiptId: snapshot.receiptId,
+							runId: void 0
+						});
+				}
+				if (existing !== void 0) {
+					yield* journal.checkCommitIntent(prepared.raw);
+					return SettlementPublicationResult.make({
+						record: existing.record,
+						tailSequence: thread.tail_sequence,
+						replayed: true
+					});
+				}
+				if (submission.state === "settled") return yield* LedgerError.make({
+					operation,
+					message: "Finalized Submission has no canonical settlement."
+				});
+				const appended = yield* journal.appendPrepared(prepared.raw);
+				return SettlementPublicationResult.make({
 					record,
-					recordDigest: validated.recordDigest,
-					replayed: true
+					tailSequence: appended.lastSequence,
+					replayed: appended.replayed
 				});
-			}
-			const submission = yield* requireSubmission(operation, validated.submissionId);
-			if (submission.state === "settled") {
-				if (submission.settled_outcome === null) return yield* corruptionFailure(operation, "effect_agent_submissions", validated.submissionId, "A settled Submission carries no terminal outcome.");
-				return yield* SettlementConflict.make({
-					submissionId: validated.submissionId,
-					existingOutcome: submission.settled_outcome
+			})).pipe(Effect.mapError((error) => {
+				if (error._tag === "DoAppendConflict") return AppendConflict.make({
+					threadId: prepared.request.threadId,
+					batchId: prepared.request.batch.batchId,
+					reason: error.reason,
+					...error.actualTailSequence !== void 0 ? { actualTailSequence: error.actualTailSequence } : {}
 				});
-			}
-			if (!(submission.state === "joined" && submission.joined_host_submission_id !== null)) {
-				let queuedAbortSettlement = false;
-				if (validated.outcome === "aborted" && (submission.state === "ready" || submission.state === "terminalizing")) {
-					const abortIntent = yield* readAbortIntent(operation, validated.submissionId);
-					if (Option.isSome(abortIntent)) {
-						const ownership = yield* readOwnership(operation, validated.submissionId);
-						queuedAbortSettlement = Option.isNone(ownership);
-					}
-				}
-				if (!queuedAbortSettlement) yield* requireOwnership(operation, submission, validated.ownershipToken);
-			}
-			const now = yield* currentInstant;
-			yield* sql`
-          INSERT INTO effect_agent_settlement_reservations (
-            submission_id,
-            settlement_id,
-            outcome,
-            record_id,
-            record_json,
-            record_digest,
-            reserved_at
-          ) VALUES (
-            ${validated.submissionId},
-            ${validated.settlementId},
-            ${validated.outcome},
-            ${validated.record.recordId},
-            ${recordJson},
-            ${validated.recordDigest},
-            ${now.iso}
-          )
-         RETURNING *`.pipe(rows.reservations.write, Effect.mapError(internalFailure(operation)));
-			yield* sql`
-          UPDATE effect_agent_submissions
-          SET state = 'terminalizing'
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-			return ReservedSettlement.make({
-				submissionId: validated.submissionId,
-				settlementId: validated.settlementId,
-				outcome: validated.outcome,
-				record: validated.record,
-				recordDigest: validated.recordDigest,
-				replayed: false
-			});
-		}));
-		yield* hitFailpoint("ledger:reserve-settlement:after", operation);
-		return reserved;
+				return isDoStorageError(error) || error._tag === "DoStorageCorruptionError" || error._tag === "DoStorageFailpointError" || error._tag === "DoValueBoundExceeded" ? mapAppendError(error) : error;
+			}));
+			yield* hitFailpoint("append:after", operation);
+			return result;
+		})));
 	});
-	const validateFinalization = Effect.fn("DoSubmissionLedger.validateFinalization")(function* (validated, reservation) {
+	const validateFinalization = Effect.fnUntraced(function* (validated, submission) {
 		const operation = "ledger finalize settlement";
-		if (Option.isNone(reservation)) return yield* LedgerError.make({
+		const canonical = yield* readCanonicalSettlement(operation, submission);
+		if (canonical === void 0) return yield* LedgerError.make({
 			operation,
-			message: `No settlement reservation exists for submission ${validated.submissionId}.`
+			message: `No canonical settlement exists for submission ${validated.submissionId}.`
 		});
-		if (reservation.value.settlement_id !== validated.settlementId) return yield* SettlementConflict.make({
+		if (canonical.settlement.settlementId !== validated.settlementId) return yield* SettlementConflict.make({
 			submissionId: validated.submissionId,
-			existingOutcome: reservation.value.outcome
+			existingOutcome: canonical.settlement.outcome
 		});
-		const reservationRecord = yield* decodeRecordEnvelopeText(reservation.value.record_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_settlement_reservations", validated.submissionId, error.message)));
-		const settlementFailure = settlementFailureFromRecord(reservationRecord);
-		if (reservation.value.outcome === "failed" !== (settlementFailure !== void 0)) return yield* corruptionFailure(operation, "effect_agent_settlement_reservations", validated.submissionId, "The reserved outcome and canonical failure diagnostic disagree.");
 		return {
-			reservation: reservation.value,
-			reservationRecord,
-			settlementFailure
+			...canonical,
+			settlementFailure: settlementFailureFromRecord(canonical.record)
 		};
 	});
-	const replayFinalization = Effect.fn("DoSubmissionLedger.replayFinalization")(function* (validated, submission, { reservation, settlementFailure }) {
+	const replayFinalization = Effect.fnUntraced(function* (validated, submission, { record, settlement, settlementFailure }) {
 		const operation = "ledger finalize settlement";
-		if (reservation.finalized_at === null) return yield* corruptionFailure(operation, "effect_agent_settlement_reservations", validated.submissionId, "A settled Submission's reservation carries no finalization timestamp.");
+		if (submission.finalized_at === null || submission.settled_record_id !== record.recordId || submission.settled_outcome !== settlement.outcome) return yield* corruptionFailure(operation, "effect_agent_submissions", validated.submissionId, "Settled projection disagrees with its canonical settlement.");
 		return yield* decodeSettlement({
 			submissionId: validated.submissionId,
 			settlementId: validated.settlementId,
 			receiptId: submission.receipt_id,
-			outcome: reservation.outcome,
+			outcome: settlement.outcome,
 			...settlementFailure === void 0 ? {} : { failure: settlementFailure },
-			settledAt: reservation.finalized_at
+			settledAt: submission.finalized_at
 		}).pipe(Effect.mapError(internalFailure(operation)));
 	});
 	const finalizeSettlement = Effect.fn("DoSubmissionLedger.finalizeSettlement")(function* (request) {
@@ -1069,20 +901,27 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		const replay = yield* state.read(Effect.gen(function* () {
 			const submission = yield* readSubmission(operation, validated.submissionId);
 			if (Option.isNone(submission) || submission.value.state !== "settled") return Option.none();
-			const finalization = yield* validateFinalization(validated, yield* readReservation(operation, validated.submissionId));
-			return Option.some(yield* replayFinalization(validated, submission.value, finalization));
+			const finalization = yield* validateFinalization(validated, submission.value);
+			return Option.some({
+				settlement: yield* replayFinalization(validated, submission.value, finalization),
+				threadId: submission.value.thread_id
+			});
 		}));
 		if (Option.isSome(replay)) {
+			owner.closeSubmission(replay.value.threadId, validated.submissionId);
 			yield* hitFailpoint("ledger:finalize-settlement:after", operation);
-			return replay.value;
+			return replay.value.settlement;
 		}
 		const settlement = yield* inWriteTransaction(operation, Effect.gen(function* () {
-			const state = yield* validateFinalization(validated, yield* readReservation(operation, validated.submissionId));
-			const { reservation, reservationRecord, settlementFailure } = state;
 			const submission = yield* requireSubmission(operation, validated.submissionId);
-			if (submission.state === "settled") return yield* replayFinalization(validated, submission, state);
+			const state = yield* validateFinalization(validated, submission);
+			const { settlement: canonicalSettlement, record: canonicalRecord, settlementFailure } = state;
+			if (submission.state === "settled") return {
+				settlement: yield* replayFinalization(validated, submission, state),
+				threadId: submission.thread_id
+			};
 			const now = yield* currentInstant;
-			const terminal = submission.worker_admission_json === null ? void 0 : workerTerminalFromRecord(yield* decodeSubmissionSnapshot(operation, submission), reservationRecord);
+			const terminal = submission.worker_admission_json === null ? void 0 : workerTerminalFromRecord(yield* decodeSubmissionSnapshot(operation, submission), canonicalRecord);
 			let sealedTerminal;
 			if (terminal !== void 0) {
 				if ((terminal === "completed" ? yield* sql`SELECT submission_id FROM effect_agent_submissions
@@ -1103,37 +942,33 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 			}
 			yield* sql`
           UPDATE effect_agent_submissions
-          SET state = 'settled', settled_outcome = ${reservation.outcome}
+          SET state = 'settled', settled_outcome = ${canonicalSettlement.outcome},
+              settled_record_id = ${canonicalRecord.recordId}, finalized_at = ${now.iso}
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-			yield* sql`
-          UPDATE effect_agent_settlement_reservations
-          SET finalized_at = ${now.iso}
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.reservations.write, Effect.mapError(internalFailure(operation)));
-			yield* sql`
-          DELETE FROM effect_agent_submission_ownership
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.ownership.remove, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 			yield* recordProgress("submission", operation);
 			if (sealedTerminal !== void 0) yield* retainWorkerSeal(submission.thread_id, sealedTerminal);
-			return yield* decodeSettlement({
-				submissionId: validated.submissionId,
-				settlementId: validated.settlementId,
-				receiptId: submission.receipt_id,
-				outcome: reservation.outcome,
-				...settlementFailure === void 0 ? {} : { failure: settlementFailure },
-				settledAt: now.iso
-			}).pipe(Effect.mapError(internalFailure(operation)));
+			return {
+				threadId: submission.thread_id,
+				settlement: yield* decodeSettlement({
+					submissionId: validated.submissionId,
+					settlementId: validated.settlementId,
+					receiptId: submission.receipt_id,
+					outcome: canonicalSettlement.outcome,
+					...settlementFailure === void 0 ? {} : { failure: settlementFailure },
+					settledAt: now.iso
+				}).pipe(Effect.mapError(internalFailure(operation)))
+			};
 		}));
+		owner.closeSubmission(settlement.threadId, validated.submissionId);
 		yield* hitFailpoint("ledger:finalize-settlement:after", operation);
-		return settlement;
+		return settlement.settlement;
 	});
-	const inspectWorker = Effect.fn("DoSubmissionLedger.inspectWorker")(function* (threadId) {
+	const inspectWorker = Effect.fnUntraced(function* (threadId) {
 		const operation = "inspect worker";
 		return yield* state.transaction(Effect.gen(function* () {
 			const read = Effect.fnUntraced(function* (active) {
-				const rows = yield* sql`SELECT ${sql.literal(SUBMISSION_COLUMNS)} FROM effect_agent_submissions
+				const rows = yield* sql`SELECT ${submissionColumns} FROM effect_agent_submissions
           WHERE thread_id = ${threadId} ${active ? sql`AND state <> 'settled'` : sql``}
           ORDER BY queue_sequence ${active ? sql`ASC` : sql`DESC`} LIMIT 1`.pipe(Effect.mapError(sqlFailure(operation)));
 				const decoded = yield* decodeSubmissionRows(operation, threadId, rows);
@@ -1150,7 +985,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 			}).pipe(Effect.mapError(internalFailure(operation)));
 		})).pipe(Effect.provideService(SqlClientService.SqlClient, sql), Effect.catchTag("SqlError", (cause) => sqlFailure(operation)(cause)));
 	});
-	const stopWorker = Effect.fn("DoSubmissionLedger.stopWorker")(function* (request) {
+	const stopWorker = Effect.fnUntraced(function* (request) {
 		const operation = "ledger stop worker";
 		const validated = yield* Schema.decodeEffect(WorkerStopCommand)(request).pipe(Effect.mapError(internalFailure(operation)));
 		return yield* inWriteTransaction(operation, Effect.gen(function* () {
@@ -1159,15 +994,12 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 			const aborted = yield* sql`INSERT OR IGNORE INTO effect_agent_abort_intents (submission_id, author, reason, requested_at)
         SELECT submission_id, ${validated.author}, 'Worker owner stopped the worker', ${now.iso}
         FROM effect_agent_submissions WHERE thread_id = ${validated.threadId} AND state <> 'settled' RETURNING *`.pipe(rows.aborts.write, Effect.mapError(internalFailure(operation)));
-			const owners = yield* sql`SELECT o.submission_id FROM effect_agent_submission_ownership o
-        JOIN effect_agent_submissions s ON s.submission_id = o.submission_id
-        WHERE s.thread_id = ${validated.threadId} AND s.state <> 'settled'`.pipe(Effect.mapError(sqlFailure(operation)));
 			if (sealed.length > 0 || aborted.length > 0) yield* recordProgress("control", operation);
 			if (sealed.length > 0) yield* retainWorkerSeal(validated.threadId, null);
-			return owners.length;
+			return owner.hasOwner(validated.threadId) ? 1 : 0;
 		}));
 	});
-	const requestAbort = Effect.fn("DoSubmissionLedger.requestAbort")(function* (request) {
+	const requestAbort = Effect.fnUntraced(function* (request) {
 		const operation = "ledger request abort";
 		const validated = yield* Schema.decodeEffect(Schema.toType(AbortCommand))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:request-abort:before", operation);
@@ -1222,7 +1054,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:request-abort:after", operation);
 		return intent;
 	});
-	const claimJoining = Effect.fn("DoSubmissionLedger.claimJoining")(function* (request) {
+	const claimJoining = Effect.fnUntraced(function* (request) {
 		const operation = "ledger claim joining";
 		const validated = yield* Schema.decodeEffect(Schema.toType(ClaimJoiningRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:claim-joining:before", operation);
@@ -1232,16 +1064,15 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 				operation,
 				message: `Host submission ${validated.hostSubmissionId} does not belong to thread ${validated.threadId}.`
 			});
-			yield* requireOwnership(operation, host, validated.ownershipToken);
+			yield* requireOwner(operation, host);
 			if ((yield* cached(rows.workerStops.by("thread_id", validated.threadId), operation)).length > 0) return [];
-			const lane = yield* laneWork(validated.threadId, operation);
-			const laterRows = lane === void 0 ? yield* sql`
-          SELECT ${sql.literal(SUBMISSION_COLUMNS)}
+			const laterRows = yield* sql`
+          SELECT ${submissionColumns}
           FROM effect_agent_submissions
           WHERE thread_id = ${validated.threadId}
             AND queue_sequence > ${host.queue_sequence}
           ORDER BY queue_sequence ASC
-        `.pipe(Effect.mapError(sqlFailure(operation))) : yield* Effect.forEach(lane.filter((item) => item.queue_sequence > host.queue_sequence), (item) => requireSubmission(operation, item.submission_id));
+        `.pipe(Effect.mapError(sqlFailure(operation)));
 			const later = yield* decodeSubmissionRows(operation, validated.threadId, laterRows);
 			const claimed = [];
 			for (const row of later) {
@@ -1249,11 +1080,14 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 				if ((row.state === "joining" || row.state === "joined") && row.joined_host_submission_id === validated.hostSubmissionId) continue;
 				if (row.state === "settled" && row.settled_outcome === "aborted") continue;
 				if (row.state !== "ready") break;
+				const canonical = yield* readCanonicalSettlement(operation, row);
+				if (canonical?.settlement.outcome === "aborted") continue;
+				if (canonical !== void 0) break;
 				yield* sql`
             UPDATE effect_agent_submissions
             SET state = 'joining', joined_host_submission_id = ${validated.hostSubmissionId}
             WHERE submission_id = ${row.submission_id}
-           RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+           RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 				const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_submissions", row.submission_id, error.message)));
 				claimed.push(yield* decodeJoiningClaim({
 					submissionId: row.submission_id,
@@ -1266,7 +1100,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:claim-joining:after", operation);
 		return claims;
 	});
-	const markJoined = Effect.fn("DoSubmissionLedger.markJoined")(function* (request) {
+	const markJoined = Effect.fnUntraced(function* (request) {
 		const operation = "ledger mark joined";
 		const validated = yield* Schema.decodeEffect(Schema.toType(MarkJoinedRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:mark-joined:before", operation);
@@ -1277,7 +1111,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 				message: `Submission ${validated.submissionId} was never claimed for joining.`
 			});
 			const host = yield* requireSubmission(operation, submission.joined_host_submission_id);
-			yield* requireOwnership(operation, host, validated.ownershipToken);
+			yield* requireOwner(operation, host);
 			if (submission.input_applied_record_id !== null) {
 				if (submission.input_applied_record_id === validated.recordId && submission.input_applied_sequence === validated.sequence) return;
 				return yield* corruptionFailure(operation, "effect_agent_submissions", validated.submissionId, "A different join marker is already recorded for this Submission.");
@@ -1293,25 +1127,37 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             input_applied_sequence = ${validated.sequence},
             state = 'joined'
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 		}));
 		yield* hitFailpoint("ledger:mark-joined:after", operation);
 	});
-	const revertJoining = Effect.fn("DoSubmissionLedger.revertJoining")(function* (request) {
+	const revertJoining = Effect.fnUntraced(function* (request) {
 		const operation = "ledger revert joining";
 		const validated = yield* Schema.decodeEffect(Schema.toType(RevertJoiningRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:revert-joining:before", operation);
 		yield* inWriteTransaction(operation, Effect.gen(function* () {
-			if ((yield* requireSubmission(operation, validated.submissionId)).state !== "joining") return;
+			const submission = yield* requireSubmission(operation, validated.submissionId);
+			if (submission.state !== "joining") return;
+			const guard = validated.guard;
+			if (guard !== void 0) {
+				if (submission.joined_host_submission_id !== guard.hostSubmissionId) return;
+				const host = yield* requireSubmission(operation, guard.hostSubmissionId);
+				if (host.thread_id !== submission.thread_id) return yield* corruptionFailure(operation, "effect_agent_submissions", validated.submissionId, "The joined host belongs to another Thread.");
+				if (host.state !== "settled") yield* requireOwner(operation, host).pipe(Effect.mapError((cause) => cause._tag === "OwnershipLost" ? LedgerError.make({
+					operation,
+					message: "Joining recovery no longer owns the linked host.",
+					cause
+				}) : cause));
+			}
 			yield* sql`
           UPDATE effect_agent_submissions
           SET state = 'ready', joined_host_submission_id = NULL
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 		}));
 		yield* hitFailpoint("ledger:revert-joining:after", operation);
 	});
-	const suspend = Effect.fn("DoSubmissionLedger.suspend")(function* (request) {
+	const suspend = Effect.fnUntraced(function* (request) {
 		const operation = "ledger suspend";
 		const validated = yield* Schema.decodeEffect(Schema.toType(SuspendRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		const reasonJson = yield* encodeSuspensionReasonText(validated.reason).pipe(Effect.mapError(internalFailure(operation)));
@@ -1325,16 +1171,19 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 					existingOutcome: submission.settled_outcome
 				});
 			}
-			const reservation = yield* readReservation(operation, validated.submissionId);
-			if (Option.isSome(reservation)) return yield* SettlementConflict.make({
+			const canonical = yield* readCanonicalSettlement(operation, submission);
+			if (canonical !== void 0) return yield* SettlementConflict.make({
 				submissionId: validated.submissionId,
-				existingOutcome: reservation.value.outcome
+				existingOutcome: canonical.settlement.outcome
 			});
-			yield* requireOwnership(operation, submission, validated.ownershipToken);
+			yield* requireOwner(operation, submission);
 			if (validated.reason._tag === "ApprovalPending") {
 				const decisions = yield* readApprovalDecisions(operation, validated.submissionId);
-				const decided = new Set(decisions.map((row) => row.tool_call_id));
-				if (validated.reason.toolCallIds.every((toolCallId) => decided.has(toolCallId))) return RESUME_IMMEDIATELY;
+				const decided = new Map(decisions.map((row) => [row.tool_call_id, row.decision]));
+				if (approvalDecisionsCover(validated.reason.toolCallIds, (toolCallId) => decided.get(toolCallId))) return {
+					outcome: RESUME_IMMEDIATELY,
+					threadId: submission.thread_id
+				};
 			} else {
 				const markers = yield* readChildSettlementMarkers(operation, validated.submissionId);
 				const markerChildren = new Set(markers.map((row) => row.child_submission_id));
@@ -1343,7 +1192,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 					allSettled = false;
 					break;
 				}
-				if (allSettled) return RESUME_IMMEDIATELY;
+				if (allSettled) return {
+					outcome: RESUME_IMMEDIATELY,
+					threadId: submission.thread_id
+				};
 			}
 			const now = yield* currentInstant;
 			yield* sql`
@@ -1353,34 +1205,34 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
               suspended_reason_json = ${reasonJson},
               suspended_at = ${now.iso}
             WHERE submission_id = ${validated.submissionId}
-           RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
-			yield* sql`
-            DELETE FROM effect_agent_submission_ownership
-            WHERE submission_id = ${validated.submissionId}
-           RETURNING *`.pipe(rows.ownership.remove, Effect.mapError(internalFailure(operation)));
+           RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 			yield* retainLifecycle(submission, {
 				_tag: "SubmissionSuspended",
 				submissionId: validated.submissionId,
 				reason: validated.reason
 			});
-			return SUSPENDED;
+			return {
+				outcome: SUSPENDED,
+				threadId: submission.thread_id
+			};
 		}));
+		if (outcome.outcome === SUSPENDED) owner.closeSubmission(outcome.threadId, validated.submissionId);
 		yield* hitFailpoint("ledger:suspend:after", operation);
-		return outcome;
+		return outcome.outcome;
 	});
 	/**
-	* Once every pending call of a recorded ApprovalPending suspension has a decision intent,
+	* Once one pending call is denied or every pending call has a decision intent,
 	* the lane wakes: suspended → input-applied, suspension cleared (plan §2.6). A
 	* WaitingForChild suspension wakes only through recordChildSettled. Runs inside the caller's
 	* write transaction.
 	*/
-	const wakeSuspendedIfCovered = Effect.fn("DoSubmissionLedger.wakeSuspendedIfCovered")(function* (operation, submission) {
+	const wakeSuspendedIfCovered = Effect.fnUntraced(function* (operation, submission) {
 		if (submission.state !== "suspended" || submission.suspended_reason_json === null) return;
 		const reason = yield* Schema.decodeEffect(Schema.fromJsonString(SuspensionReason))(submission.suspended_reason_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_submissions", submission.submission_id, error.message)));
 		if (reason._tag !== "ApprovalPending") return;
 		const decisions = yield* readApprovalDecisions(operation, submission.submission_id);
-		const decided = new Set(decisions.map((row) => row.tool_call_id));
-		if (!reason.toolCallIds.every((toolCallId) => decided.has(toolCallId))) return;
+		const decided = new Map(decisions.map((row) => [row.tool_call_id, row.decision]));
+		if (!approvalDecisionsCover(reason.toolCallIds, (toolCallId) => decided.get(toolCallId))) return;
 		yield* sql`
       UPDATE effect_agent_submissions
       SET
@@ -1388,13 +1240,13 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
         suspended_reason_json = NULL,
         suspended_at = NULL
       WHERE submission_id = ${submission.submission_id}
-     RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+     RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 		yield* retainLifecycle(submission, {
 			_tag: "SubmissionResumed",
 			submissionId: yield* decodeSubmissionId(submission.submission_id).pipe(Effect.mapError(internalFailure(operation)))
 		});
 	});
-	const recordApprovalDecision = Effect.fn("DoSubmissionLedger.recordApprovalDecision")(function* (command) {
+	const recordApprovalDecision = Effect.fnUntraced(function* (command) {
 		const operation = "ledger record approval decision";
 		const validated = yield* Schema.decodeEffect(Schema.toType(ApprovalDecisionCommand))(command).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:approval-decision:before", operation);
@@ -1448,7 +1300,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:approval-decision:after", operation);
 		return intent;
 	});
-	const markUnknown = Effect.fn("DoSubmissionLedger.markUnknown")(function* (request) {
+	const markUnknown = Effect.fnUntraced(function* (request) {
 		const operation = "ledger mark unknown";
 		const validated = yield* Schema.decodeEffect(Schema.toType(MarkUnknownRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:mark-unknown:before", operation);
@@ -1461,10 +1313,10 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 					existingOutcome: submission.settled_outcome
 				});
 			}
-			const reservation = yield* readReservation(operation, validated.submissionId);
-			if (Option.isSome(reservation)) return yield* SettlementConflict.make({
+			const canonical = yield* readCanonicalSettlement(operation, submission);
+			if (canonical !== void 0) return yield* SettlementConflict.make({
 				submissionId: validated.submissionId,
-				existingOutcome: reservation.value.outcome
+				existingOutcome: canonical.settlement.outcome
 			});
 			const existingIds = yield* storedUnknownToolCallIds(operation, submission);
 			const known = new Set(existingIds);
@@ -1477,7 +1329,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             unknown_reason = ${submission.unknown_reason ?? validated.reason},
             unknown_tool_call_ids_json = ${idsJson}
           WHERE submission_id = ${validated.submissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 			if (submission.state !== "unknown") yield* retainLifecycle(submission, {
 				_tag: "SubmissionUnknown",
 				submissionId: validated.submissionId
@@ -1485,7 +1337,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		}));
 		yield* hitFailpoint("ledger:mark-unknown:after", operation);
 	});
-	const recordUnknownResolution = Effect.fn("DoSubmissionLedger.recordUnknownResolution")(function* (command) {
+	const recordUnknownResolution = Effect.fnUntraced(function* (command) {
 		const operation = "ledger record unknown resolution";
 		const validated = yield* Schema.decodeEffect(Schema.toType(UnknownResolutionCommand))(command).pipe(Effect.mapError(internalFailure(operation)));
 		const resolutionJson = yield* encodeUnknownResolutionText(validated.resolution).pipe(Effect.mapError(internalFailure(operation)));
@@ -1494,17 +1346,37 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 			const submission = yield* requireSubmission(operation, validated.submissionId);
 			if (submission.state === "settled") {
 				if (submission.settled_outcome === null) return yield* corruptionFailure(operation, "effect_agent_submissions", validated.submissionId, "A settled Submission carries no terminal outcome.");
-				return yield* SettlementConflict.make({
+				if (validated.resolution._tag !== "CompletedWithResult" && validated.resolution._tag !== "NeverHappened") return yield* SettlementConflict.make({
 					submissionId: validated.submissionId,
 					existingOutcome: submission.settled_outcome
 				});
 			}
-			const existing = (yield* readUnknownResolutions(operation, validated.submissionId)).find((row) => row.tool_call_id === validated.toolCallId);
+			const resolutions = yield* readUnknownResolutions(operation, validated.submissionId);
+			const kind = unknownResolutionKind(validated.resolution);
+			const existing = resolutions.find((row) => row.tool_call_id === validated.toolCallId && row.resolution_kind === kind);
 			const existingIntent = existing === void 0 ? void 0 : yield* unknownResolutionIntentFromRow(operation, existing);
-			if (existingIntent !== void 0 && !equivalentUnknownResolution(existingIntent.resolution, validated.resolution)) return yield* UnknownResolutionConflict.make({
+			if (existingIntent !== void 0 && !equivalentUnknownResolution(existingIntent.resolution, validated.resolution) || existing === void 0 && kind === "execution" && resolutions.some((row) => row.tool_call_id === validated.toolCallId && row.resolution_kind === "factual")) return yield* UnknownResolutionConflict.make({
 				submissionId: validated.submissionId,
 				toolCallId: validated.toolCallId
 			});
+			if (existingIntent === void 0 && kind === "factual") {
+				const runId = runIdForSubmission(validated.submissionId);
+				const found = yield* sql`
+              SELECT ${canonicalRecordJson(sql)} AS record_json FROM effect_agent_canonical_records
+              WHERE thread_id = ${submission.thread_id}
+                AND record_tag = 27
+                AND run_id = ${runKey(sql, sql`${submission.thread_id}`, sql`${JSON.stringify(runId)}`)}
+                AND tool_call_id = ${JSON.stringify(validated.toolCallId)}
+              LIMIT 2
+            `.pipe(Effect.mapError(sqlFailure(operation)));
+				const outcomes = yield* decodeRows(Schema.Array(Schema.Struct({ record_json: BoundedStoredText })), "effect_agent_canonical_records", validated.toolCallId, found).pipe(Effect.mapError(internalFailure(operation)));
+				const result = outcomes[0] === void 0 ? void 0 : (yield* decodeRecordEnvelopeText(outcomes[0].record_json).pipe(Effect.mapError(internalFailure(operation)))).payload;
+				if (outcomes.length > 1 || result !== void 0 && (result._tag !== "ToolCallSettled" || result.runId !== runId || result.toolCallId !== validated.toolCallId)) return yield* corruptionFailure(operation, "effect_agent_canonical_records", validated.toolCallId, "Canonical Tool result identity is inconsistent.");
+				if (result?._tag === "ToolCallSettled" && !unknownResolutionMatchesResult(validated.resolution, result)) return yield* UnknownResolutionConflict.make({
+					submissionId: validated.submissionId,
+					toolCallId: validated.toolCallId
+				});
+			}
 			let resolved;
 			if (existingIntent !== void 0) resolved = existingIntent;
 			else {
@@ -1513,6 +1385,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             INSERT INTO effect_agent_unknown_resolutions (
               submission_id,
               tool_call_id,
+              resolution_kind,
               author,
               reason,
               resolution_json,
@@ -1520,6 +1393,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             ) VALUES (
               ${validated.submissionId},
               ${validated.toolCallId},
+              ${kind},
               ${validated.author},
               ${validated.reason},
               ${resolutionJson},
@@ -1549,7 +1423,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
                 unknown_reason = NULL,
                 unknown_tool_call_ids_json = NULL
               WHERE submission_id = ${validated.submissionId}
-             RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+             RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 					yield* retainLifecycle(submission, {
 						_tag: "SubmissionResumed",
 						submissionId: validated.submissionId
@@ -1561,15 +1435,15 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:unknown-resolution:after", operation);
 		return intent;
 	});
-	const recordChildSettled = Effect.fn("DoSubmissionLedger.recordChildSettled")(function* (request) {
+	const recordChildSettled = Effect.fnUntraced(function* (request) {
 		const operation = "ledger record child settled";
 		const validated = yield* Schema.decodeEffect(Schema.toType(ChildSettledNotification))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:child-settled:before", operation);
 		const outcome = yield* inWriteTransaction(operation, Effect.gen(function* () {
 			const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
 			const child = yield* readSubmission(operation, validated.childSubmissionId);
-			const childReservation = yield* readReservation(operation, validated.childSubmissionId);
-			if (Option.isSome(child) && child.value.state !== "settled" && !(child.value.state === "terminalizing" && Option.isSome(childReservation))) return yield* LedgerError.make({
+			const childCanonical = Option.isSome(child) ? yield* readCanonicalSettlement(operation, child.value) : void 0;
+			if (Option.isSome(child) && childCanonical === void 0) return yield* LedgerError.make({
 				operation,
 				message: `Child submission ${validated.childSubmissionId} has no recorded settlement.`
 			});
@@ -1583,7 +1457,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
           ) VALUES (
             ${validated.parentSubmissionId},
             ${validated.childSubmissionId},
-            ${Option.isSome(child) && child.value.state === "settled" ? child.value.settled_outcome : Option.isSome(childReservation) ? childReservation.value.outcome : null},
+            ${childCanonical?.settlement.outcome ?? null},
             ${now.iso}
           )
           ON CONFLICT (parent_submission_id, child_submission_id) DO NOTHING
@@ -1602,7 +1476,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
             suspended_reason_json = NULL,
             suspended_at = NULL
           WHERE submission_id = ${validated.parentSubmissionId}
-         RETURNING *`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
+         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(rows.submissions.write, Effect.mapError(internalFailure(operation)));
 			yield* retainLifecycle(parent, {
 				_tag: "SubmissionResumed",
 				submissionId: validated.parentSubmissionId
@@ -1612,7 +1486,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:child-settled:after", operation);
 		return outcome;
 	});
-	const reserveChildBudget = Effect.fn("DoSubmissionLedger.reserveChildBudget")(function* (request) {
+	const reserveChildBudget = Effect.fnUntraced(function* (request) {
 		const operation = "ledger reserve child budget";
 		const validated = yield* Schema.decodeEffect(Schema.toType(ChildBudgetReservationRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		const allocationJson = yield* encodePersistedJsonText(validated.allocation).pipe(Effect.mapError(internalFailure(operation)));
@@ -1638,7 +1512,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 				message: `Parent Tool Call ${validated.parentToolCallId} already owns reservation ${collision.value.reservation_id}.`
 			});
 			const parent = yield* requireSubmission(operation, validated.parentSubmissionId);
-			yield* requireOwnership(operation, parent, validated.ownershipToken);
+			yield* requireOwner(operation, parent);
 			const now = yield* currentInstant;
 			yield* sql`
           INSERT INTO effect_agent_child_reservations (
@@ -1669,7 +1543,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:child-reservation:after", operation);
 		return reserved;
 	});
-	const attachChildToReservation = Effect.fn("DoSubmissionLedger.attachChildToReservation")(function* (request) {
+	const attachChildToReservation = Effect.fnUntraced(function* (request) {
 		const operation = "ledger attach child to reservation";
 		const validated = yield* Schema.decodeEffect(Schema.toType(AttachChildToReservationRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:child-attach:before", operation);
@@ -1688,7 +1562,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 				});
 			}
 			const parent = yield* requireSubmission(operation, existing.value.parent_submission_id);
-			yield* requireOwnership(operation, parent, validated.ownershipToken);
+			yield* requireOwner(operation, parent);
 			if (existing.value.status !== "reserved") return yield* ChildReservationConflict.make({
 				reservationId: validated.reservationId,
 				status: existing.value.status,
@@ -1706,7 +1580,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:child-attach:after", operation);
 		return attached;
 	});
-	const beginChildBudgetRelease = Effect.fn("DoSubmissionLedger.beginChildBudgetRelease")(function* (request) {
+	const beginChildBudgetRelease = Effect.fnUntraced(function* (request) {
 		const operation = "ledger begin child budget release";
 		const validated = yield* Schema.decodeEffect(Schema.toType(BeginChildBudgetReleaseRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		const accountingJson = yield* encodePersistedJsonText(validated.accounting).pipe(Effect.mapError(internalFailure(operation)));
@@ -1742,7 +1616,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:child-release-pending:after", operation);
 		return frozen;
 	});
-	const releaseChildBudget = Effect.fn("DoSubmissionLedger.releaseChildBudget")(function* (request) {
+	const releaseChildBudget = Effect.fnUntraced(function* (request) {
 		const operation = "ledger release child budget";
 		const validated = yield* Schema.decodeEffect(Schema.toType(ReleaseChildBudgetRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		yield* hitFailpoint("ledger:child-release:before", operation);
@@ -1771,7 +1645,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		yield* hitFailpoint("ledger:child-release:after", operation);
 		return released;
 	});
-	const scanPage = Effect.fn("DoSubmissionLedger.scanPage")(function* (cursor) {
+	const scanPage = Effect.fnUntraced(function* (cursor) {
 		const operation = "ledger scan nonterminal";
 		const rows = yield* (cursor === void 0 ? sql`
           SELECT submission_id AS "submissionId", thread_id AS "threadId",
@@ -1816,7 +1690,7 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		}))).pipe(Effect.mapError(internalFailure("ledger scan nonterminal")));
 		return Stream.fromIterable(work);
 	})));
-	const readAbortIntentForSubmission = Effect.fn("DoSubmissionLedger.readAbortIntentForSubmission")(function* (request) {
+	const readAbortIntentForSubmission = Effect.fnUntraced(function* (request) {
 		const operation = "ledger read abort intent";
 		const validated = yield* Schema.decodeEffect(Schema.toType(AbortIntentRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		return yield* state.read(Effect.gen(function* () {
@@ -1825,38 +1699,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 			return Option.isNone(intent) ? void 0 : yield* abortIntentFromRow(operation, submission, validated.submissionId, intent.value);
 		}));
 	});
-	const loadRecoverySnapshot = Effect.fn("DoSubmissionLedger.loadRecoverySnapshot")(function* (request) {
+	const loadRecoverySnapshot = Effect.fnUntraced(function* (request) {
 		const operation = "ledger load recovery snapshot";
 		const validated = yield* Schema.decodeEffect(Schema.toType(RecoverySnapshotRequest))(request).pipe(Effect.mapError(internalFailure(operation)));
 		return yield* state.read(Effect.gen(function* () {
 			const submissionRow = yield* requireSubmission(operation, validated.submissionId);
 			const submission = yield* decodeSubmissionSnapshot(operation, submissionRow);
-			let ownership;
-			const ownershipRow = yield* readOwnership(operation, validated.submissionId);
-			if (Option.isSome(ownershipRow)) ownership = yield* decodeOwnershipSnapshot({
-				attemptId: ownershipRow.value.attempt_id,
-				ownerProducerId: ownershipRow.value.owner_producer_id,
-				producerEpoch: ownershipRow.value.producer_epoch,
-				leaseExpiresAt: ownershipRow.value.lease_expires_at
-			}).pipe(Effect.mapError(internalFailure(operation)));
 			let inputApplied;
 			if (submissionRow.input_applied_record_id !== null && submissionRow.input_applied_sequence !== null) inputApplied = yield* decodeInputAppliedMarker({
 				recordId: submissionRow.input_applied_record_id,
 				sequence: submissionRow.input_applied_sequence
 			}).pipe(Effect.mapError(internalFailure(operation)));
-			let reservation;
-			const reservationRow = yield* readReservation(operation, validated.submissionId);
-			if (Option.isSome(reservationRow)) {
-				const record = yield* decodeRecordEnvelopeText(reservationRow.value.record_json).pipe(Effect.mapError((error) => corruptionFailure(operation, "effect_agent_settlement_reservations", validated.submissionId, error.message)));
-				const settlementId = yield* Schema.decodeEffect(SettlementReservationSnapshot.fields.settlementId)(reservationRow.value.settlement_id).pipe(Effect.mapError(internalFailure(operation)));
-				reservation = SettlementReservationSnapshot.make({
-					settlementId,
-					outcome: reservationRow.value.outcome,
-					record,
-					recordDigest: reservationRow.value.record_digest,
-					finalized: reservationRow.value.finalized_at !== null
-				});
-			}
 			let abortIntent;
 			const abortRow = yield* readAbortIntent(operation, validated.submissionId);
 			if (Option.isSome(abortRow)) abortIntent = yield* abortIntentFromRow(operation, submissionRow, validated.submissionId, abortRow.value);
@@ -1923,9 +1776,8 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 				...parentLinkage === void 0 ? {} : { parentLinkage },
 				...hostSubmissionId === void 0 ? {} : { hostSubmissionId },
 				...suspension === void 0 ? {} : { suspension },
-				...ownership === void 0 ? {} : { ownership },
+				hasOwner: owner.hasOwner(submissionRow.thread_id, submissionRow.submission_id),
 				...inputApplied === void 0 ? {} : { inputApplied },
-				...reservation === void 0 ? {} : { reservation },
 				...abortIntent === void 0 ? {} : { abortIntent }
 			});
 		}));
@@ -1935,20 +1787,18 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		admit,
 		markReady,
 		lookup,
+		resolveFundingOwner,
 		resolveAdmission,
-		claim,
-		renewOwnership,
-		releaseOwnership,
+		selectHead,
 		markInputApplied,
-		reserveSettlement,
-		finalizeSettlement,
+		finalizeSettlement: (request) => owner.withMutation(finalizeSettlement(request)),
 		requestAbort,
 		stopWorker,
 		inspectWorker,
 		claimJoining,
 		markJoined,
 		revertJoining,
-		suspend,
+		suspend: (request) => owner.withMutation(suspend(request)),
 		recordApprovalDecision,
 		markUnknown,
 		recordUnknownResolution,
@@ -1960,17 +1810,17 @@ const makeServices = Effect.fn("DoSubmissionLedger.makeServices")(function* () {
 		scanNonterminal,
 		loadRecoverySnapshot,
 		readAbortIntent: readAbortIntentForSubmission
-	}));
+	})).pipe(Context.add(StorageOwner, owner), Context.add(SettlementPublisher, { publish }));
 });
 /**
 * Durable Object SubmissionLedger implementation sharing the journal's private SQLite
-* database, storage-backed transaction discipline, and producer-epoch fencing substrate.
+* database, storage-backed transactions, and scoped local owner.
 * Configuration, failpoint, SQL, and Crypto authority stay visible in the input channel.
 */
 const submissionLedgerLayer = Layer.effectContext(makeServices());
 /**
 * A composition-root convenience Layer for the durable Submission Ledger. Point it at the
-* same `ctx.storage` as the ThreadStore so claims fence the same producer epochs.
+* same `ctx.storage` as the ThreadStore so both share the same scoped storage owner.
 */
 const ledgerLayer = (options) => Layer.unwrap(Effect.map(DoStorageConfig, (config) => submissionLedgerLayer.pipe(Layer.provide(Layer.mergeAll(Layer.succeed(DoStorageConfig)(config), storageFailpointLayer(options), SqliteClient.layer({ storage: options.storage }), BrowserCrypto.layer))))).pipe(Layer.provide(storageConfigLayer(options)));
 //#endregion