@yielded/agent-storage-cloudflare 0.1.0-beta.173 → 0.1.0-beta.175

package/src/DoSubmissionLedger.ts

@@ -27,6 +27,7 @@ import {
   PersistedJson,
   WorkerAdmission,
   RecordEnvelope,
+  RecordId,
   SettlementOutcome,
 } from "@yielded/agent/records";
 import { runIdForSubmission } from "@yielded/agent/run-journal";
@@ -189,7 +190,7 @@ class SubmissionRow extends Schema.Class<SubmissionRow>("SubmissionRow")({
   receipt_id: BoundedIdentifier,
   state: SubmissionState,
   settled_outcome: Schema.NullOr(SettlementOutcome),
-  settled_record_id: Schema.NullOr(BoundedIdentifier),
+  settled_record_id: Schema.NullOr(BoundedIdentifier.pipe(Schema.decodeTo(RecordId))),
   finalized_at: Schema.NullOr(BoundedTimestamp),
   created_at: BoundedTimestamp,
   ready_at: Schema.NullOr(BoundedTimestamp),
@@ -344,8 +345,8 @@ const decodeAbortIntent = Schema.decodeUnknownEffect(AbortIntent);
 const decodeInputAppliedMarker = Schema.decodeUnknownEffect(InputAppliedMarker);
 
 const decodeSubmissionSnapshotType = (input: typeof SubmissionSnapshot.Type) =>
-  Schema.decodeEffect(Schema.toType(Schema.Struct(SubmissionSnapshot.fields)))(input).pipe(
-    Effect.map((fields) => SubmissionSnapshot.make(fields)),
+  SubmissionSnapshot.makeEffect(input).pipe(
+    Effect.mapError((issue) => new Schema.SchemaError(issue)),
   );
 
 const decodeSubmissionId = Schema.decodeUnknownEffect(SubmissionSnapshot.fields.submissionId);
@@ -365,6 +366,46 @@ const decodeChildReservationSnapshotUnknown = Schema.decodeUnknownEffect(
 const decodeChildAttachmentSnapshot = Schema.decodeUnknownEffect(ChildAttachmentSnapshot);
 const equivalentPersistedJson = Schema.toEquivalence(PersistedJson);
 const equivalentUnknownResolution = Schema.toEquivalence(UnknownResolution);
+const decodeAdmissionRequestType = Schema.decodeEffect(Schema.toType(AdmissionRequest));
+const decodeSubmissionLookupType = Schema.decodeEffect(Schema.toType(SubmissionLookup));
+const decodeClaimRequestType = Schema.decodeEffect(Schema.toType(ClaimRequest));
+
+const decodeMarkInputAppliedRequestType = Schema.decodeEffect(
+  Schema.toType(MarkInputAppliedRequest),
+);
+
+const decodeSettlementFinalizationType = Schema.decodeEffect(Schema.toType(SettlementFinalization));
+const decodeClaimJoiningRequestType = Schema.decodeEffect(Schema.toType(ClaimJoiningRequest));
+
+const decodeAbortIntentRequestType = Schema.decodeEffect(Schema.toType(AbortIntentRequest));
+
+const decodeRecoverySnapshotRequestType = Schema.decodeEffect(
+  Schema.toType(RecoverySnapshotRequest),
+);
+
+const SubmissionRows = Schema.Array(SubmissionRow);
+const ChildReservationRows = Schema.Array(ChildReservationRow);
+const MaxQueueSequenceRows = Schema.Array(MaxQueueSequenceRow);
+const SubmissionWorkItems = Schema.Array(SubmissionWorkItem);
+const decodeSubmissionWorkItems = Schema.decodeEffect(SubmissionWorkItems);
+const equivalentWorkerOrigin = Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin));
+
+const decodeFirstWorkerAdmissions = Schema.decodeUnknownEffect(
+  Schema.Array(
+    Schema.Struct({
+      worker_admission_json: Schema.NullOr(BoundedStoredText),
+    }),
+  ),
+);
+
+const CanonicalSettlementRows = Schema.Array(
+  Schema.Struct({
+    batch_id: Schema.fromJsonString(BoundedIdentifier),
+    record_id: Schema.fromJsonString(BoundedIdentifier),
+    record_json: BoundedStoredText,
+  }),
+);
+
 const isDoStorageError = Schema.is(DoStorageError);
 
 /** Wrap an adapter-internal failure into the port's LedgerError without erasing its tag. */
@@ -605,7 +646,7 @@ const makeServices = Effect.fnUntraced(function* () {
   }));
 
   const decodeSubmissionRows = (operation: string, rowKey: string, rows: unknown) =>
-    decodeRows(Schema.Array(SubmissionRow), "effect_agent_submissions", rowKey, rows).pipe(
+    decodeRows(SubmissionRows, "effect_agent_submissions", rowKey, rows).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
@@ -683,6 +724,11 @@ const makeServices = Effect.fnUntraced(function* () {
 
     const admission = yield* decodeAdmissionFact(row).pipe(Effect.mapError(decodeFailure));
 
+    const settledAt =
+      row.finalized_at === null
+        ? undefined
+        : yield* decodeUtcInstant(row.finalized_at).pipe(Effect.mapError(decodeFailure));
+
     const readyAt =
       row.ready_at === null
         ? undefined
@@ -692,6 +738,8 @@ const makeServices = Effect.fnUntraced(function* () {
       ...admission,
       state: row.state,
       ...(row.settled_outcome === null ? {} : { settledOutcome: row.settled_outcome }),
+      ...(settledAt === undefined ? {} : { settledAt }),
+      ...(row.settled_record_id === null ? {} : { settledRecordId: row.settled_record_id }),
       ...(readyAt === undefined ? {} : { readyAt }),
     }).pipe(Effect.mapError(decodeFailure));
 
@@ -713,13 +761,7 @@ const makeServices = Effect.fnUntraced(function* () {
       AND record_id = ${JSON.stringify(recordId)}`.pipe(Effect.mapError(sqlFailure(operation)));
 
     const decoded = yield* decodeRows(
-      Schema.Array(
-        Schema.Struct({
-          batch_id: Schema.fromJsonString(BoundedIdentifier),
-          record_id: Schema.fromJsonString(BoundedIdentifier),
-          record_json: BoundedStoredText,
-        }),
-      ),
+      CanonicalSettlementRows,
       "effect_agent_canonical_records",
       recordId,
       found,
@@ -802,12 +844,9 @@ const makeServices = Effect.fnUntraced(function* () {
   });
 
   const decodeChildReservationRows = (operation: string, rowKey: string, rows: unknown) =>
-    decodeRows(
-      Schema.Array(ChildReservationRow),
-      "effect_agent_child_reservations",
-      rowKey,
-      rows,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+    decodeRows(ChildReservationRows, "effect_agent_child_reservations", rowKey, rows).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
   const readChildReservation = Effect.fnUntraced(function* (
     operation: string,
@@ -1028,10 +1067,11 @@ const makeServices = Effect.fnUntraced(function* () {
 
   const admit: SubmissionLedger["Service"]["admit"] = Effect.fnUntraced(function* (
     request: AdmissionRequest,
+    options?: { readonly readyIfInitialized?: boolean },
   ) {
     const operation = "ledger admit";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(AdmissionRequest))(request).pipe(
+    const validated = yield* decodeAdmissionRequestType(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
@@ -1212,13 +1252,9 @@ const makeServices = Effect.fnUntraced(function* () {
             WHERE thread_id=${validated.threadId} ORDER BY queue_sequence LIMIT 1
           `.pipe(Effect.mapError(sqlFailure(operation)));
 
-        const first = yield* Schema.decodeUnknownEffect(
-          Schema.Array(
-            Schema.Struct({
-              worker_admission_json: Schema.NullOr(BoundedStoredText),
-            }),
-          ),
-        )(firstRows).pipe(Effect.mapError(internalFailure(operation)));
+        const first = yield* decodeFirstWorkerAdmissions(firstRows).pipe(
+          Effect.mapError(internalFailure(operation)),
+        );
 
         if (first[0] !== undefined) {
           const previous =
@@ -1228,12 +1264,7 @@ const makeServices = Effect.fnUntraced(function* () {
                   first[0].worker_admission_json,
                 ).pipe(Effect.mapError(internalFailure(operation)));
 
-          if (
-            !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
-              previous?.origin,
-              validated.workerAdmission?.origin,
-            )
-          )
+          if (!equivalentWorkerOrigin(previous?.origin, validated.workerAdmission?.origin))
             return yield* AdmissionPolicyError.make({
               reason: "refused",
               code: "worker-origin-conflict",
@@ -1261,7 +1292,7 @@ const makeServices = Effect.fnUntraced(function* () {
           `.pipe(Effect.mapError(sqlFailure(operation)));
 
         const decodedMax = yield* decodeRows(
-          Schema.Array(MaxQueueSequenceRow),
+          MaxQueueSequenceRows,
           "effect_agent_submissions",
           validated.threadId,
           maxRows,
@@ -1273,6 +1304,17 @@ const makeServices = Effect.fnUntraced(function* () {
 
         const now = yield* currentInstant;
 
+        // The first canonical record is ThreadCreated. This is the same positive-tail proof
+        // used by ensureThreadCreated, captured under this admission's owner transaction.
+        const ready =
+          options?.readyIfInitialized === true &&
+          validated.workerAdmission === undefined &&
+          (yield* journal
+            .getThread(validated.threadId)
+            .pipe(Effect.mapError(internalFailure(operation)))).some(
+            (thread) => thread.tail_sequence > 0,
+          );
+
         yield* sql`
             INSERT INTO effect_agent_submissions (
               submission_id,
@@ -1288,6 +1330,7 @@ const makeServices = Effect.fnUntraced(function* () {
               receipt_id,
               state,
               created_at,
+              ready_at,
               parent_submission_id,
               parent_tool_call_id,
               admission_group,
@@ -1306,8 +1349,9 @@ const makeServices = Effect.fnUntraced(function* () {
               ${inputJson},
               ${validated.inputDigest},
               ${mintedReceiptId},
-              'admitted',
+              ${ready ? "ready" : "admitted"},
               ${now.iso},
+              ${ready ? now.iso : null},
               ${validated.parentLinkage?.parentSubmissionId ?? null},
               ${validated.parentLinkage?.parentToolCallId ?? null},
               ${validated.admissionGroup ?? null},
@@ -1333,6 +1377,14 @@ const makeServices = Effect.fnUntraced(function* () {
 
         // The INSERT (never replay or hydration) proves these new submission-owned sets
         // empty. Gated writes update them; rollback/invalidation discards that proof.
+        // MAX(queue_sequence) and this insert share the transaction: no later row exists.
+        // Every matching admission invalidates this complete empty suffix before readiness.
+        submissionViews.seedMatching(
+          JSON.stringify(["joining-suffix", validated.threadId, queueSequence]),
+          (row) => row.thread_id === validated.threadId && row.queue_sequence > queueSequence,
+          [],
+          0,
+        );
         rows.aborts.seed("submission_id", mintedSubmissionId, []);
         rows.submissions.seed("joined_host_submission_id", mintedSubmissionId, []);
         rows.approvals.seed("submission_id", mintedSubmissionId, []);
@@ -1342,13 +1394,21 @@ const makeServices = Effect.fnUntraced(function* () {
 
         yield* recordProgress("submission", operation);
 
-        return yield* decodeAdmissionResult({
+        const admitted = yield* decodeAdmissionResult({
           submissionId: mintedSubmissionId,
           receiptId: mintedReceiptId,
           queueSequence,
-          state: "admitted",
+          state: ready ? "ready" : "admitted",
           replayed: false,
         }).pipe(Effect.mapError(internalFailure(operation)));
+
+        if (ready && lifecycle !== undefined)
+          yield* retainLifecycle(yield* requireSubmission(operation, mintedSubmissionId), {
+            _tag: "SubmissionReady",
+            submissionId: admitted.submissionId,
+          });
+
+        return admitted;
       }),
     );
 
@@ -1458,7 +1518,7 @@ const makeServices = Effect.fnUntraced(function* () {
   ) {
     const operation = "ledger lookup";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookup))(request).pipe(
+    const validated = yield* decodeSubmissionLookupType(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
@@ -1532,7 +1592,7 @@ const makeServices = Effect.fnUntraced(function* () {
   )(function* (request: ClaimRequest) {
     const operation = "ledger select head";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(ClaimRequest))(request).pipe(
+    const validated = yield* decodeClaimRequestType(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
@@ -1544,7 +1604,28 @@ const makeServices = Effect.fnUntraced(function* () {
       Effect.gen(function* () {
         if (owner.hasOwner(validated.threadId)) return Option.none<Claim>();
 
-        const headRows = yield* sql<Record<string, unknown>>`
+        const active = yield* activeNonterminal;
+        const heads: Array<SubmissionRow> = [];
+
+        const limit =
+          validated.handoff === undefined ? 1 : validated.handoff.deferredSubmissionIds.length + 1;
+
+        if (active.length <= 128) {
+          const candidates = active
+            .filter((row) => row.thread_id === validated.threadId)
+            .sort((left, right) => left.queue_sequence - right.queue_sequence);
+
+          for (const candidate of candidates) {
+            if (
+              candidate.state === "unknown" &&
+              Option.isNone(yield* readAbortIntent(operation, candidate.submission_id))
+            )
+              continue;
+            heads.push(yield* requireSubmission(operation, candidate.submission_id));
+            if (heads.length === limit) break;
+          }
+        } else {
+          const headRows = yield* sql<Record<string, unknown>>`
             SELECT ${submissionColumns}
             FROM effect_agent_submissions
             WHERE thread_id = ${validated.threadId}
@@ -1559,7 +1640,8 @@ const makeServices = Effect.fnUntraced(function* () {
             LIMIT ${validated.handoff === undefined ? 1 : validated.handoff.deferredSubmissionIds.length + 1}
           `.pipe(Effect.mapError(sqlFailure(operation)));
 
-        const heads = yield* decodeSubmissionRows(operation, validated.threadId, headRows);
+          heads.push(...(yield* decodeSubmissionRows(operation, validated.threadId, headRows)));
+        }
 
         if (heads.length === 0) return Option.none<Claim>();
         let head = heads[0];
@@ -1628,9 +1710,9 @@ const makeServices = Effect.fnUntraced(function* () {
     function* (request: MarkInputAppliedRequest) {
       const operation = "ledger mark input applied";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(MarkInputAppliedRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+      const validated = yield* decodeMarkInputAppliedRequestType(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
 
       yield* hitFailpoint("ledger:mark-input-applied:before", operation);
       yield* inWriteTransaction(
@@ -1889,9 +1971,9 @@ const makeServices = Effect.fnUntraced(function* () {
   )(function* (request: SettlementFinalization) {
     const operation = "ledger finalize settlement";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(SettlementFinalization))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+    const validated = yield* decodeSettlementFinalizationType(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
     yield* hitFailpoint("ledger:finalize-settlement:before", operation);
 
@@ -2203,14 +2285,13 @@ const makeServices = Effect.fnUntraced(function* () {
   ) {
     const operation = "ledger claim joining";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(ClaimJoiningRequest))(request).pipe(
+    const validated = yield* decodeClaimJoiningRequestType(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
     yield* hitFailpoint("ledger:claim-joining:before", operation);
 
-    const claims = yield* inWriteTransaction(
-      operation,
+    const claims = yield* owner.withMutation(
       Effect.gen(function* () {
         const host = yield* requireSubmission(operation, validated.hostSubmissionId);
 
@@ -2230,68 +2311,92 @@ const makeServices = Effect.fnUntraced(function* () {
 
         if (stopped.length > 0) return [];
 
-        const laterRows = yield* sql<Record<string, unknown>>`
-          SELECT ${submissionColumns}
-          FROM effect_agent_submissions
-          WHERE thread_id = ${validated.threadId}
-            AND queue_sequence > ${host.queue_sequence}
-          ORDER BY queue_sequence ASC
-        `.pipe(Effect.mapError(sqlFailure(operation)));
-
-        const later = yield* decodeSubmissionRows(operation, validated.threadId, laterRows);
-        const claimed: Array<JoiningClaim> = [];
-
-        for (const row of later) {
-          if (claimed.length >= validated.maxCount) break;
-          // Rows already claimed by THIS host extend its contiguous prefix and are skipped;
-          // the coordinator re-delivers already-joined input through the coverage rule.
-          if (
-            (row.state === "joining" || row.state === "joined") &&
-            row.joined_host_submission_id === validated.hostSubmissionId
-          ) {
-            continue;
-          }
-          // P7 §7(c): an aborted-settled row is a CLOSED obligation, not a gap — recovery
-          // settles aborted never-claimed queued work immediately, and settlement order of
-          // never-run work is not execution order (DUR-004 bounds execution).
-          if (row.state === "settled" && row.settled_outcome === "aborted") continue;
-          // Any other non-ready row — an admitted-not-ready gap in particular — breaks the
-          // contiguous ready prefix (plan §2.5); later ready work stays queued (DUR-004).
-          if (row.state !== "ready") break;
-          const canonical = yield* readCanonicalSettlement(operation, row);
-
-          if (canonical?.settlement.outcome === "aborted") continue;
-          if (canonical !== undefined) break;
-          yield* sql`
+        // Retain only an empty complete suffix. Any later admission invalidates this view;
+        // nonempty rows keep their SQL ordering, and rollback discards the empty proof.
+        const later = yield* submissionViews
+          .matching(
+            JSON.stringify(["joining-suffix", validated.threadId, host.queue_sequence]),
+            (row) =>
+              row.thread_id === validated.threadId && row.queue_sequence > host.queue_sequence,
+            sql`
+              SELECT ${submissionColumns}
+              FROM effect_agent_submissions
+              WHERE thread_id = ${validated.threadId}
+                AND queue_sequence > ${host.queue_sequence}
+              ORDER BY queue_sequence ASC
+            `,
+            0,
+          )
+          .pipe(
+            Effect.mapError((error) =>
+              error._tag === "SqlError"
+                ? sqlFailure(operation)(error)
+                : internalFailure(operation)(error),
+            ),
+          );
+
+        if (later.length === 0) return [];
+
+        // The reader gate stays held through promotion. Nonempty candidates retain
+        // their native transaction, live-owner checks and contiguous-prefix rules.
+        return yield* inWriteTransaction(
+          operation,
+          Effect.gen(function* () {
+            const claimed: Array<JoiningClaim> = [];
+
+            for (const row of later) {
+              if (claimed.length >= validated.maxCount) break;
+              // Rows already claimed by THIS host extend its contiguous prefix and are skipped;
+              // the coordinator re-delivers already-joined input through the coverage rule.
+              if (
+                (row.state === "joining" || row.state === "joined") &&
+                row.joined_host_submission_id === validated.hostSubmissionId
+              ) {
+                continue;
+              }
+              // P7 §7(c): an aborted-settled row is a CLOSED obligation, not a gap — recovery
+              // settles aborted never-claimed queued work immediately, and settlement order of
+              // never-run work is not execution order (DUR-004 bounds execution).
+              if (row.state === "settled" && row.settled_outcome === "aborted") continue;
+              // Any other non-ready row — an admitted-not-ready gap in particular — breaks the
+              // contiguous ready prefix (plan §2.5); later ready work stays queued (DUR-004).
+              if (row.state !== "ready") break;
+              const canonical = yield* readCanonicalSettlement(operation, row);
+
+              if (canonical?.settlement.outcome === "aborted") continue;
+              if (canonical !== undefined) break;
+              yield* sql`
             UPDATE effect_agent_submissions
             SET state = 'joining', joined_host_submission_id = ${validated.hostSubmissionId}
             WHERE submission_id = ${row.submission_id}
            RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
-            rows.submissions.write,
-            Effect.mapError(internalFailure(operation)),
-          );
+                rows.submissions.write,
+                Effect.mapError(internalFailure(operation)),
+              );
 
-          const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
-            Effect.mapError((error) =>
-              corruptionFailure(
-                operation,
-                "effect_agent_submissions",
-                row.submission_id,
-                error.message,
-              ),
-            ),
-          );
+              const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
+                Effect.mapError((error) =>
+                  corruptionFailure(
+                    operation,
+                    "effect_agent_submissions",
+                    row.submission_id,
+                    error.message,
+                  ),
+                ),
+              );
 
-          claimed.push(
-            yield* decodeJoiningClaim({
-              submissionId: row.submission_id,
-              queueSequence: row.queue_sequence,
-              inputPayload,
-            }).pipe(Effect.mapError(internalFailure(operation))),
-          );
-        }
+              claimed.push(
+                yield* decodeJoiningClaim({
+                  submissionId: row.submission_id,
+                  queueSequence: row.queue_sequence,
+                  inputPayload,
+                }).pipe(Effect.mapError(internalFailure(operation))),
+              );
+            }
 
-        return claimed;
+            return claimed;
+          }),
+        );
       }),
     );
 
@@ -3443,7 +3548,7 @@ const makeServices = Effect.fnUntraced(function* () {
     ).pipe(Effect.mapError(sqlFailure(operation)));
 
     const decoded = yield* decodeRows(
-      Schema.Array(SubmissionWorkItem),
+      SubmissionWorkItems,
       "effect_agent_submissions",
       "nonterminal_scan",
       rows,
@@ -3463,59 +3568,74 @@ const makeServices = Effect.fnUntraced(function* () {
     return [decoded, next] as const;
   });
 
-  const scanNonterminal: Stream.Stream<SubmissionWorkItem, LedgerError> = Stream.unwrap(
-    state.read(
-      Effect.gen(function* () {
-        // Cache only a complete bounded active set. Large hosts keep the paged scan.
-        const active = yield* cached(
-          workRows.matching(
-            "nonterminal",
-            (row) => row.state !== "settled",
-            sql`SELECT submission_id, thread_id, queue_sequence, principal, idempotency_key,
-              deployment_id, receipt_id, state
-              FROM effect_agent_submissions WHERE state <> 'settled' LIMIT 129`,
-            128,
-          ),
-          "ledger scan nonterminal",
-        );
+  // Both discovery and head selection use this same complete, owner-invalidated bounded view.
+  const activeNonterminal = cached(
+    workRows.matching(
+      "nonterminal",
+      (row) => row.state !== "settled",
+      sql`SELECT submission_id, thread_id, queue_sequence, principal, idempotency_key,
+          deployment_id, receipt_id, state
+          FROM effect_agent_submissions WHERE state <> 'settled' LIMIT 129`,
+      128,
+    ),
+    "ledger scan nonterminal",
+  );
 
-        if (active.length > 128)
-          return Stream.paginate<ScanCursor | undefined, SubmissionWorkItem, LedgerError>(
-            undefined,
-            scanPage,
-          );
+  const boundedNonterminal = state.read(
+    Effect.gen(function* () {
+      // Cache only a complete bounded active set. Large hosts keep the paged scan.
+      const active = yield* activeNonterminal;
 
-        const sorted = [...active].sort((left, right) =>
-          left.thread_id < right.thread_id
-            ? -1
-            : left.thread_id > right.thread_id
-              ? 1
-              : left.queue_sequence - right.queue_sequence,
-        );
+      if (active.length > 128) return undefined;
 
-        const work = yield* Schema.decodeEffect(Schema.Array(SubmissionWorkItem))(
-          sorted.map((row) => ({
-            submissionId: row.submission_id,
-            threadId: row.thread_id,
-            queueSequence: row.queue_sequence,
-            principal: row.principal,
-            idempotencyKey: row.idempotency_key,
-            deploymentId: row.deployment_id,
-            receiptId: row.receipt_id,
-            state: row.state,
-          })),
-        ).pipe(Effect.mapError(internalFailure("ledger scan nonterminal")));
-
-        return Stream.fromIterable(work);
-      }),
+      const sorted = [...active].sort((left, right) =>
+        left.thread_id < right.thread_id
+          ? -1
+          : left.thread_id > right.thread_id
+            ? 1
+            : left.queue_sequence - right.queue_sequence,
+      );
+
+      const work = yield* decodeSubmissionWorkItems(
+        sorted.map((row) => ({
+          submissionId: row.submission_id,
+          threadId: row.thread_id,
+          queueSequence: row.queue_sequence,
+          principal: row.principal,
+          idempotencyKey: row.idempotency_key,
+          deploymentId: row.deployment_id,
+          receiptId: row.receipt_id,
+          state: row.state,
+        })),
+      ).pipe(Effect.mapError(internalFailure("ledger scan nonterminal")));
+
+      return work;
+    }),
+  );
+
+  const pagedNonterminal = Stream.paginate<ScanCursor | undefined, SubmissionWorkItem, LedgerError>(
+    undefined,
+    scanPage,
+  );
+
+  // Large scans keep their bounded page lifetime and streaming backpressure.
+  const scanNonterminal = Stream.unwrap(
+    Effect.map(boundedNonterminal, (work) =>
+      work === undefined ? pagedNonterminal : Stream.fromIterable(work),
     ),
   );
 
+  const listNonterminal = Effect.filterOrElse(
+    boundedNonterminal,
+    (work) => work !== undefined,
+    () => Stream.runCollect(pagedNonterminal),
+  );
+
   const readAbortIntentForSubmission: SubmissionLedger["Service"]["readAbortIntent"] =
     Effect.fnUntraced(function* (request) {
       const operation = "ledger read abort intent";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(AbortIntentRequest))(request).pipe(
+      const validated = yield* decodeAbortIntentRequestType(request).pipe(
         Effect.mapError(internalFailure(operation)),
       );
 
@@ -3540,9 +3660,9 @@ const makeServices = Effect.fnUntraced(function* () {
     Effect.fnUntraced(function* (request: RecoverySnapshotRequest) {
       const operation = "ledger load recovery snapshot";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(RecoverySnapshotRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+      const validated = yield* decodeRecoverySnapshotRequestType(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
 
       return yield* state.read(
         Effect.gen(function* () {
@@ -3760,6 +3880,7 @@ const makeServices = Effect.fnUntraced(function* () {
       beginChildBudgetRelease,
       releaseChildBudget,
       scanNonterminal,
+      listNonterminal,
       loadRecoverySnapshot,
       readAbortIntent: readAbortIntentForSubmission,
     }),

package/src/DoSubscriptionStore.ts

@@ -89,6 +89,7 @@ const layoutStatements = [
 const layoutObjects = layoutStatements.map((statement, index) => {
   const name = /^CREATE (TABLE|INDEX) ([a-z_][a-z_0-9]*)/.exec(statement);
 
+  // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Module initialization validates developer-authored SQL constants before any storage workflow starts.
   if (name === null) throw new Error("Invalid subscription layout statement");
 
   return [name[1].toLowerCase(), name[2], index] as const;