@yielded/agent-storage-cloudflare 0.1.0-beta.174 → 0.1.0-beta.176

package/src/DoSubmissionLedger.ts

@@ -110,6 +110,8 @@ import {
   UnknownResolutionKind,
   unknownResolutionKind,
   unknownResolutionMatchesResult,
+  submissionInputRecordId,
+  submissionInputBatchId,
   submissionAbortRecordId,
   submissionSettlementRecordId,
   submissionSettlementBatchId,
@@ -345,8 +347,8 @@ const decodeAbortIntent = Schema.decodeUnknownEffect(AbortIntent);
 const decodeInputAppliedMarker = Schema.decodeUnknownEffect(InputAppliedMarker);
 
 const decodeSubmissionSnapshotType = (input: typeof SubmissionSnapshot.Type) =>
-  Schema.decodeEffect(Schema.toType(Schema.Struct(SubmissionSnapshot.fields)))(input).pipe(
-    Effect.map((fields) => SubmissionSnapshot.make(fields)),
+  SubmissionSnapshot.makeEffect(input).pipe(
+    Effect.mapError((issue) => new Schema.SchemaError(issue)),
   );
 
 const decodeSubmissionId = Schema.decodeUnknownEffect(SubmissionSnapshot.fields.submissionId);
@@ -366,6 +368,46 @@ const decodeChildReservationSnapshotUnknown = Schema.decodeUnknownEffect(
 const decodeChildAttachmentSnapshot = Schema.decodeUnknownEffect(ChildAttachmentSnapshot);
 const equivalentPersistedJson = Schema.toEquivalence(PersistedJson);
 const equivalentUnknownResolution = Schema.toEquivalence(UnknownResolution);
+const decodeAdmissionRequestType = Schema.decodeEffect(Schema.toType(AdmissionRequest));
+const decodeSubmissionLookupType = Schema.decodeEffect(Schema.toType(SubmissionLookup));
+const decodeClaimRequestType = Schema.decodeEffect(Schema.toType(ClaimRequest));
+
+const decodeMarkInputAppliedRequestType = Schema.decodeEffect(
+  Schema.toType(MarkInputAppliedRequest),
+);
+
+const decodeSettlementFinalizationType = Schema.decodeEffect(Schema.toType(SettlementFinalization));
+const decodeClaimJoiningRequestType = Schema.decodeEffect(Schema.toType(ClaimJoiningRequest));
+
+const decodeAbortIntentRequestType = Schema.decodeEffect(Schema.toType(AbortIntentRequest));
+
+const decodeRecoverySnapshotRequestType = Schema.decodeEffect(
+  Schema.toType(RecoverySnapshotRequest),
+);
+
+const SubmissionRows = Schema.Array(SubmissionRow);
+const ChildReservationRows = Schema.Array(ChildReservationRow);
+const MaxQueueSequenceRows = Schema.Array(MaxQueueSequenceRow);
+const SubmissionWorkItems = Schema.Array(SubmissionWorkItem);
+const decodeSubmissionWorkItems = Schema.decodeEffect(SubmissionWorkItems);
+const equivalentWorkerOrigin = Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin));
+
+const decodeFirstWorkerAdmissions = Schema.decodeUnknownEffect(
+  Schema.Array(
+    Schema.Struct({
+      worker_admission_json: Schema.NullOr(BoundedStoredText),
+    }),
+  ),
+);
+
+const CanonicalSettlementRows = Schema.Array(
+  Schema.Struct({
+    batch_id: Schema.fromJsonString(BoundedIdentifier),
+    record_id: Schema.fromJsonString(BoundedIdentifier),
+    record_json: BoundedStoredText,
+  }),
+);
+
 const isDoStorageError = Schema.is(DoStorageError);
 
 /** Wrap an adapter-internal failure into the port's LedgerError without erasing its tag. */
@@ -606,7 +648,7 @@ const makeServices = Effect.fnUntraced(function* () {
   }));
 
   const decodeSubmissionRows = (operation: string, rowKey: string, rows: unknown) =>
-    decodeRows(Schema.Array(SubmissionRow), "effect_agent_submissions", rowKey, rows).pipe(
+    decodeRows(SubmissionRows, "effect_agent_submissions", rowKey, rows).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
@@ -721,13 +763,7 @@ const makeServices = Effect.fnUntraced(function* () {
       AND record_id = ${JSON.stringify(recordId)}`.pipe(Effect.mapError(sqlFailure(operation)));
 
     const decoded = yield* decodeRows(
-      Schema.Array(
-        Schema.Struct({
-          batch_id: Schema.fromJsonString(BoundedIdentifier),
-          record_id: Schema.fromJsonString(BoundedIdentifier),
-          record_json: BoundedStoredText,
-        }),
-      ),
+      CanonicalSettlementRows,
       "effect_agent_canonical_records",
       recordId,
       found,
@@ -810,12 +846,9 @@ const makeServices = Effect.fnUntraced(function* () {
   });
 
   const decodeChildReservationRows = (operation: string, rowKey: string, rows: unknown) =>
-    decodeRows(
-      Schema.Array(ChildReservationRow),
-      "effect_agent_child_reservations",
-      rowKey,
-      rows,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+    decodeRows(ChildReservationRows, "effect_agent_child_reservations", rowKey, rows).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
   const readChildReservation = Effect.fnUntraced(function* (
     operation: string,
@@ -1036,10 +1069,11 @@ const makeServices = Effect.fnUntraced(function* () {
 
   const admit: SubmissionLedger["Service"]["admit"] = Effect.fnUntraced(function* (
     request: AdmissionRequest,
+    options?: { readonly readyIfInitialized?: boolean },
   ) {
     const operation = "ledger admit";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(AdmissionRequest))(request).pipe(
+    const validated = yield* decodeAdmissionRequestType(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
@@ -1114,9 +1148,7 @@ const makeServices = Effect.fnUntraced(function* () {
       Effect.gen(function* () {
         const keyRowKey = `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`;
 
-        const existingRows = yield* byKey(validated, operation);
-
-        const existing = yield* decodeSubmissionRows(operation, keyRowKey, existingRows);
+        const existing = yield* byKey(validated, operation);
 
         if (existing.length > 1) {
           return yield* corruptionFailure(
@@ -1220,13 +1252,9 @@ const makeServices = Effect.fnUntraced(function* () {
             WHERE thread_id=${validated.threadId} ORDER BY queue_sequence LIMIT 1
           `.pipe(Effect.mapError(sqlFailure(operation)));
 
-        const first = yield* Schema.decodeUnknownEffect(
-          Schema.Array(
-            Schema.Struct({
-              worker_admission_json: Schema.NullOr(BoundedStoredText),
-            }),
-          ),
-        )(firstRows).pipe(Effect.mapError(internalFailure(operation)));
+        const first = yield* decodeFirstWorkerAdmissions(firstRows).pipe(
+          Effect.mapError(internalFailure(operation)),
+        );
 
         if (first[0] !== undefined) {
           const previous =
@@ -1236,12 +1264,7 @@ const makeServices = Effect.fnUntraced(function* () {
                   first[0].worker_admission_json,
                 ).pipe(Effect.mapError(internalFailure(operation)));
 
-          if (
-            !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
-              previous?.origin,
-              validated.workerAdmission?.origin,
-            )
-          )
+          if (!equivalentWorkerOrigin(previous?.origin, validated.workerAdmission?.origin))
             return yield* AdmissionPolicyError.make({
               reason: "refused",
               code: "worker-origin-conflict",
@@ -1269,7 +1292,7 @@ const makeServices = Effect.fnUntraced(function* () {
           `.pipe(Effect.mapError(sqlFailure(operation)));
 
         const decodedMax = yield* decodeRows(
-          Schema.Array(MaxQueueSequenceRow),
+          MaxQueueSequenceRows,
           "effect_agent_submissions",
           validated.threadId,
           maxRows,
@@ -1281,6 +1304,17 @@ const makeServices = Effect.fnUntraced(function* () {
 
         const now = yield* currentInstant;
 
+        // The first canonical record is ThreadCreated. This is the same positive-tail proof
+        // used by ensureThreadCreated, captured under this admission's owner transaction.
+        const ready =
+          options?.readyIfInitialized === true &&
+          validated.workerAdmission === undefined &&
+          (yield* journal
+            .getThread(validated.threadId)
+            .pipe(Effect.mapError(internalFailure(operation)))).some(
+            (thread) => thread.tail_sequence > 0,
+          );
+
         yield* sql`
             INSERT INTO effect_agent_submissions (
               submission_id,
@@ -1296,6 +1330,7 @@ const makeServices = Effect.fnUntraced(function* () {
               receipt_id,
               state,
               created_at,
+              ready_at,
               parent_submission_id,
               parent_tool_call_id,
               admission_group,
@@ -1314,8 +1349,9 @@ const makeServices = Effect.fnUntraced(function* () {
               ${inputJson},
               ${validated.inputDigest},
               ${mintedReceiptId},
-              'admitted',
+              ${ready ? "ready" : "admitted"},
               ${now.iso},
+              ${ready ? now.iso : null},
               ${validated.parentLinkage?.parentSubmissionId ?? null},
               ${validated.parentLinkage?.parentToolCallId ?? null},
               ${validated.admissionGroup ?? null},
@@ -1341,6 +1377,14 @@ const makeServices = Effect.fnUntraced(function* () {
 
         // The INSERT (never replay or hydration) proves these new submission-owned sets
         // empty. Gated writes update them; rollback/invalidation discards that proof.
+        // MAX(queue_sequence) and this insert share the transaction: no later row exists.
+        // Every matching admission invalidates this complete empty suffix before readiness.
+        submissionViews.seedMatching(
+          JSON.stringify(["joining-suffix", validated.threadId, queueSequence]),
+          (row) => row.thread_id === validated.threadId && row.queue_sequence > queueSequence,
+          [],
+          0,
+        );
         rows.aborts.seed("submission_id", mintedSubmissionId, []);
         rows.submissions.seed("joined_host_submission_id", mintedSubmissionId, []);
         rows.approvals.seed("submission_id", mintedSubmissionId, []);
@@ -1350,13 +1394,21 @@ const makeServices = Effect.fnUntraced(function* () {
 
         yield* recordProgress("submission", operation);
 
-        return yield* decodeAdmissionResult({
+        const admitted = yield* decodeAdmissionResult({
           submissionId: mintedSubmissionId,
           receiptId: mintedReceiptId,
           queueSequence,
-          state: "admitted",
+          state: ready ? "ready" : "admitted",
           replayed: false,
         }).pipe(Effect.mapError(internalFailure(operation)));
+
+        if (ready && lifecycle !== undefined)
+          yield* retainLifecycle(yield* requireSubmission(operation, mintedSubmissionId), {
+            _tag: "SubmissionReady",
+            submissionId: admitted.submissionId,
+          });
+
+        return admitted;
       }),
     );
 
@@ -1466,7 +1518,7 @@ const makeServices = Effect.fnUntraced(function* () {
   ) {
     const operation = "ledger lookup";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(SubmissionLookup))(request).pipe(
+    const validated = yield* decodeSubmissionLookupType(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
@@ -1478,13 +1530,7 @@ const makeServices = Effect.fnUntraced(function* () {
       return Option.some(yield* decodeSubmissionSnapshot(operation, row.value));
     }
 
-    const foundRows = yield* byKey(validated, operation);
-
-    const decoded = yield* decodeSubmissionRows(
-      operation,
-      `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
-      foundRows,
-    );
+    const decoded = yield* byKey(validated, operation);
 
     if (decoded.length > 1) {
       return yield* corruptionFailure(
@@ -1511,13 +1557,7 @@ const makeServices = Effect.fnUntraced(function* () {
         request,
       ).pipe(Effect.mapError(internalFailure(operation)));
 
-      const foundRows = yield* byKey(validated, operation);
-
-      const decoded = yield* decodeSubmissionRows(
-        operation,
-        `${validated.threadId}/${validated.principal}/${validated.idempotencyKey}`,
-        foundRows,
-      );
+      const decoded = yield* byKey(validated, operation);
 
       if (decoded.length > 1) {
         return yield* corruptionFailure(
@@ -1540,7 +1580,7 @@ const makeServices = Effect.fnUntraced(function* () {
   )(function* (request: ClaimRequest) {
     const operation = "ledger select head";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(ClaimRequest))(request).pipe(
+    const validated = yield* decodeClaimRequestType(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
@@ -1552,7 +1592,28 @@ const makeServices = Effect.fnUntraced(function* () {
       Effect.gen(function* () {
         if (owner.hasOwner(validated.threadId)) return Option.none<Claim>();
 
-        const headRows = yield* sql<Record<string, unknown>>`
+        const active = yield* activeNonterminal;
+        const heads: Array<SubmissionRow> = [];
+
+        const limit =
+          validated.handoff === undefined ? 1 : validated.handoff.deferredSubmissionIds.length + 1;
+
+        if (active.length <= 128) {
+          const candidates = active
+            .filter((row) => row.thread_id === validated.threadId)
+            .sort((left, right) => left.queue_sequence - right.queue_sequence);
+
+          for (const candidate of candidates) {
+            if (
+              candidate.state === "unknown" &&
+              Option.isNone(yield* readAbortIntent(operation, candidate.submission_id))
+            )
+              continue;
+            heads.push(yield* requireSubmission(operation, candidate.submission_id));
+            if (heads.length === limit) break;
+          }
+        } else {
+          const headRows = yield* sql<Record<string, unknown>>`
             SELECT ${submissionColumns}
             FROM effect_agent_submissions
             WHERE thread_id = ${validated.threadId}
@@ -1567,7 +1628,8 @@ const makeServices = Effect.fnUntraced(function* () {
             LIMIT ${validated.handoff === undefined ? 1 : validated.handoff.deferredSubmissionIds.length + 1}
           `.pipe(Effect.mapError(sqlFailure(operation)));
 
-        const heads = yield* decodeSubmissionRows(operation, validated.threadId, headRows);
+          heads.push(...(yield* decodeSubmissionRows(operation, validated.threadId, headRows)));
+        }
 
         if (heads.length === 0) return Option.none<Claim>();
         let head = heads[0];
@@ -1632,53 +1694,159 @@ const makeServices = Effect.fnUntraced(function* () {
     return claimed;
   });
 
+  const markInputAppliedInTransaction = Effect.fnUntraced(function* (
+    validated: MarkInputAppliedRequest,
+  ) {
+    const operation = "ledger mark input applied";
+
+    const submission = yield* requireSubmission(operation, validated.submissionId);
+
+    yield* requireOwner(operation, submission);
+    if (submission.input_applied_record_id !== null) {
+      if (
+        submission.input_applied_record_id === validated.recordId &&
+        submission.input_applied_sequence === validated.sequence
+      ) {
+        return;
+      }
+
+      return yield* corruptionFailure(
+        operation,
+        "effect_agent_submissions",
+        validated.submissionId,
+        "A different canonical input marker is already recorded for this Submission.",
+      );
+    }
+    yield* sql`
+    UPDATE effect_agent_submissions
+    SET
+      input_applied_record_id = ${validated.recordId},
+      input_applied_sequence = ${validated.sequence},
+      state = CASE
+        WHEN state IN ('admitted', 'ready') THEN 'input-applied'
+        ELSE state
+      END
+    WHERE submission_id = ${validated.submissionId}
+   RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
+      rows.submissions.write,
+      Effect.mapError(internalFailure(operation)),
+    );
+  });
+
   const markInputApplied: SubmissionLedger["Service"]["markInputApplied"] = Effect.fnUntraced(
     function* (request: MarkInputAppliedRequest) {
       const operation = "ledger mark input applied";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(MarkInputAppliedRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+      const validated = yield* decodeMarkInputAppliedRequestType(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
 
       yield* hitFailpoint("ledger:mark-input-applied:before", operation);
-      yield* inWriteTransaction(
-        operation,
-        Effect.gen(function* () {
-          const submission = yield* requireSubmission(operation, validated.submissionId);
+      yield* inWriteTransaction(operation, markInputAppliedInTransaction(validated));
+      yield* hitFailpoint("ledger:mark-input-applied:after", operation);
+    },
+  );
 
-          yield* requireOwner(operation, submission);
-          if (submission.input_applied_record_id !== null) {
-            if (
-              submission.input_applied_record_id === validated.recordId &&
-              submission.input_applied_sequence === validated.sequence
-            ) {
-              return;
-            }
+  const appendInput: NonNullable<SubmissionLedger["Service"]["appendInput"]> = Effect.fnUntraced(
+    function* (submissionId, request) {
+      const operation = "append original input and context";
 
-            return yield* corruptionFailure(
-              operation,
-              "effect_agent_submissions",
-              validated.submissionId,
-              "A different canonical input marker is already recorded for this Submission.",
-            );
-          }
-          yield* sql`
-          UPDATE effect_agent_submissions
-          SET
-            input_applied_record_id = ${validated.recordId},
-            input_applied_sequence = ${validated.sequence},
-            state = CASE
-              WHEN state IN ('admitted', 'ready') THEN 'input-applied'
-              ELSE state
-            END
-          WHERE submission_id = ${validated.submissionId}
-         RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
-            rows.submissions.write,
-            Effect.mapError(internalFailure(operation)),
-          );
-        }),
+      const prepared = yield* prepareCanonicalAppend(request).pipe(
+        Effect.provideService(Crypto.Crypto, crypto),
+      );
+
+      const record = prepared.request.batch.records[0];
+
+      const context = prepared.request.executions
+        ?.flatMap((update) => update.facts ?? [])
+        .find(({ payload }) => payload._tag === "RunContextRecorded");
+
+      if (
+        prepared.request.executions?.length !== 1 ||
+        prepared.request.executions[0]?.previousRevision !== 0 ||
+        prepared.request.batch.records.length !== 1 ||
+        record?.payload._tag !== "UserInputRecorded" ||
+        record.payload.kind !== "user" ||
+        record.payload.submissionId !== submissionId ||
+        record.payload.runId !== runIdForSubmission(submissionId) ||
+        record.recordId !== submissionInputRecordId(submissionId) ||
+        prepared.request.batch.batchId !== submissionInputBatchId(submissionId) ||
+        (context?.payload._tag === "RunContextRecorded" &&
+          context.payload.historyThrough !== prepared.request.expectedTailSequence)
+      )
+        return yield* ThreadStoreError.make({
+          operation,
+          message: "Original input publication has a different context boundary",
+        });
+
+      const mapError = (cause: { readonly message: string }) =>
+        ThreadStoreError.make({ operation, message: cause.message, cause });
+
+      yield* journal.prepareAppend(prepared.raw).pipe(Effect.mapError(mapError));
+
+      return yield* owner.withProgress(
+        prepared.request.threadId,
+        owner.withMutation(
+          Effect.gen(function* () {
+            yield* hitFailpoint("append:before", operation);
+            yield* hitFailpoint("ledger:mark-input-applied:before", operation);
+
+            const result = yield* journal
+              .withWriteTransaction(operation)(
+                Effect.gen(function* () {
+                  const submission = yield* requireSubmission(operation, submissionId);
+
+                  yield* requireOwner(operation, submission);
+                  if (submission.thread_id !== prepared.request.threadId)
+                    return yield* LedgerError.make({
+                      operation,
+                      message: "Original input belongs to another Thread",
+                    });
+                  const result = yield* journal.appendPrepared(prepared.raw);
+
+                  yield* markInputAppliedInTransaction(
+                    MarkInputAppliedRequest.make({
+                      submissionId,
+                      recordId: record.recordId,
+                      sequence: result.firstSequence,
+                    }),
+                  );
+
+                  return result;
+                }),
+              )
+              .pipe(
+                Effect.mapError((error) =>
+                  error._tag === "DoAppendConflict"
+                    ? AppendConflict.make({
+                        threadId: prepared.request.threadId,
+                        batchId: prepared.request.batch.batchId,
+                        reason: error.reason,
+                        ...(error.actualTailSequence === undefined
+                          ? {}
+                          : { actualTailSequence: error.actualTailSequence }),
+                      })
+                    : error._tag === "OwnershipLost"
+                      ? error
+                      : mapError(error),
+                ),
+              );
+
+            yield* hitFailpoint("ledger:mark-input-applied:after", operation);
+            yield* hitFailpoint("append:after", operation);
+
+            return result;
+          }).pipe(
+            Effect.mapError((error) =>
+              error._tag === "OwnershipLost" ||
+              error._tag === "ThreadStoreError" ||
+              error._tag === "AppendConflict"
+                ? error
+                : mapError(error),
+            ),
+          ),
+        ),
       );
-      yield* hitFailpoint("ledger:mark-input-applied:after", operation);
     },
   );
 
@@ -1897,9 +2065,9 @@ const makeServices = Effect.fnUntraced(function* () {
   )(function* (request: SettlementFinalization) {
     const operation = "ledger finalize settlement";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(SettlementFinalization))(
-      request,
-    ).pipe(Effect.mapError(internalFailure(operation)));
+    const validated = yield* decodeSettlementFinalizationType(request).pipe(
+      Effect.mapError(internalFailure(operation)),
+    );
 
     yield* hitFailpoint("ledger:finalize-settlement:before", operation);
 
@@ -2211,14 +2379,13 @@ const makeServices = Effect.fnUntraced(function* () {
   ) {
     const operation = "ledger claim joining";
 
-    const validated = yield* Schema.decodeEffect(Schema.toType(ClaimJoiningRequest))(request).pipe(
+    const validated = yield* decodeClaimJoiningRequestType(request).pipe(
       Effect.mapError(internalFailure(operation)),
     );
 
     yield* hitFailpoint("ledger:claim-joining:before", operation);
 
-    const claims = yield* inWriteTransaction(
-      operation,
+    const claims = yield* owner.withMutation(
       Effect.gen(function* () {
         const host = yield* requireSubmission(operation, validated.hostSubmissionId);
 
@@ -2238,68 +2405,92 @@ const makeServices = Effect.fnUntraced(function* () {
 
         if (stopped.length > 0) return [];
 
-        const laterRows = yield* sql<Record<string, unknown>>`
-          SELECT ${submissionColumns}
-          FROM effect_agent_submissions
-          WHERE thread_id = ${validated.threadId}
-            AND queue_sequence > ${host.queue_sequence}
-          ORDER BY queue_sequence ASC
-        `.pipe(Effect.mapError(sqlFailure(operation)));
-
-        const later = yield* decodeSubmissionRows(operation, validated.threadId, laterRows);
-        const claimed: Array<JoiningClaim> = [];
-
-        for (const row of later) {
-          if (claimed.length >= validated.maxCount) break;
-          // Rows already claimed by THIS host extend its contiguous prefix and are skipped;
-          // the coordinator re-delivers already-joined input through the coverage rule.
-          if (
-            (row.state === "joining" || row.state === "joined") &&
-            row.joined_host_submission_id === validated.hostSubmissionId
-          ) {
-            continue;
-          }
-          // P7 §7(c): an aborted-settled row is a CLOSED obligation, not a gap — recovery
-          // settles aborted never-claimed queued work immediately, and settlement order of
-          // never-run work is not execution order (DUR-004 bounds execution).
-          if (row.state === "settled" && row.settled_outcome === "aborted") continue;
-          // Any other non-ready row — an admitted-not-ready gap in particular — breaks the
-          // contiguous ready prefix (plan §2.5); later ready work stays queued (DUR-004).
-          if (row.state !== "ready") break;
-          const canonical = yield* readCanonicalSettlement(operation, row);
-
-          if (canonical?.settlement.outcome === "aborted") continue;
-          if (canonical !== undefined) break;
-          yield* sql`
+        // Retain only an empty complete suffix. Any later admission invalidates this view;
+        // nonempty rows keep their SQL ordering, and rollback discards the empty proof.
+        const later = yield* submissionViews
+          .matching(
+            JSON.stringify(["joining-suffix", validated.threadId, host.queue_sequence]),
+            (row) =>
+              row.thread_id === validated.threadId && row.queue_sequence > host.queue_sequence,
+            sql`
+              SELECT ${submissionColumns}
+              FROM effect_agent_submissions
+              WHERE thread_id = ${validated.threadId}
+                AND queue_sequence > ${host.queue_sequence}
+              ORDER BY queue_sequence ASC
+            `,
+            0,
+          )
+          .pipe(
+            Effect.mapError((error) =>
+              error._tag === "SqlError"
+                ? sqlFailure(operation)(error)
+                : internalFailure(operation)(error),
+            ),
+          );
+
+        if (later.length === 0) return [];
+
+        // The reader gate stays held through promotion. Nonempty candidates retain
+        // their native transaction, live-owner checks and contiguous-prefix rules.
+        return yield* inWriteTransaction(
+          operation,
+          Effect.gen(function* () {
+            const claimed: Array<JoiningClaim> = [];
+
+            for (const row of later) {
+              if (claimed.length >= validated.maxCount) break;
+              // Rows already claimed by THIS host extend its contiguous prefix and are skipped;
+              // the coordinator re-delivers already-joined input through the coverage rule.
+              if (
+                (row.state === "joining" || row.state === "joined") &&
+                row.joined_host_submission_id === validated.hostSubmissionId
+              ) {
+                continue;
+              }
+              // P7 §7(c): an aborted-settled row is a CLOSED obligation, not a gap — recovery
+              // settles aborted never-claimed queued work immediately, and settlement order of
+              // never-run work is not execution order (DUR-004 bounds execution).
+              if (row.state === "settled" && row.settled_outcome === "aborted") continue;
+              // Any other non-ready row — an admitted-not-ready gap in particular — breaks the
+              // contiguous ready prefix (plan §2.5); later ready work stays queued (DUR-004).
+              if (row.state !== "ready") break;
+              const canonical = yield* readCanonicalSettlement(operation, row);
+
+              if (canonical?.settlement.outcome === "aborted") continue;
+              if (canonical !== undefined) break;
+              yield* sql`
             UPDATE effect_agent_submissions
             SET state = 'joining', joined_host_submission_id = ${validated.hostSubmissionId}
             WHERE submission_id = ${row.submission_id}
            RETURNING *, ${definitionJson(sql)} AS agent_digests_json`.pipe(
-            rows.submissions.write,
-            Effect.mapError(internalFailure(operation)),
-          );
+                rows.submissions.write,
+                Effect.mapError(internalFailure(operation)),
+              );
 
-          const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
-            Effect.mapError((error) =>
-              corruptionFailure(
-                operation,
-                "effect_agent_submissions",
-                row.submission_id,
-                error.message,
-              ),
-            ),
-          );
+              const inputPayload = yield* parseStoredJsonText(row.input_json).pipe(
+                Effect.mapError((error) =>
+                  corruptionFailure(
+                    operation,
+                    "effect_agent_submissions",
+                    row.submission_id,
+                    error.message,
+                  ),
+                ),
+              );
 
-          claimed.push(
-            yield* decodeJoiningClaim({
-              submissionId: row.submission_id,
-              queueSequence: row.queue_sequence,
-              inputPayload,
-            }).pipe(Effect.mapError(internalFailure(operation))),
-          );
-        }
+              claimed.push(
+                yield* decodeJoiningClaim({
+                  submissionId: row.submission_id,
+                  queueSequence: row.queue_sequence,
+                  inputPayload,
+                }).pipe(Effect.mapError(internalFailure(operation))),
+              );
+            }
 
-        return claimed;
+            return claimed;
+          }),
+        );
       }),
     );
 
@@ -3451,7 +3642,7 @@ const makeServices = Effect.fnUntraced(function* () {
     ).pipe(Effect.mapError(sqlFailure(operation)));
 
     const decoded = yield* decodeRows(
-      Schema.Array(SubmissionWorkItem),
+      SubmissionWorkItems,
       "effect_agent_submissions",
       "nonterminal_scan",
       rows,
@@ -3471,59 +3662,74 @@ const makeServices = Effect.fnUntraced(function* () {
     return [decoded, next] as const;
   });
 
-  const scanNonterminal: Stream.Stream<SubmissionWorkItem, LedgerError> = Stream.unwrap(
-    state.read(
-      Effect.gen(function* () {
-        // Cache only a complete bounded active set. Large hosts keep the paged scan.
-        const active = yield* cached(
-          workRows.matching(
-            "nonterminal",
-            (row) => row.state !== "settled",
-            sql`SELECT submission_id, thread_id, queue_sequence, principal, idempotency_key,
-              deployment_id, receipt_id, state
-              FROM effect_agent_submissions WHERE state <> 'settled' LIMIT 129`,
-            128,
-          ),
-          "ledger scan nonterminal",
-        );
+  // Both discovery and head selection use this same complete, owner-invalidated bounded view.
+  const activeNonterminal = cached(
+    workRows.matching(
+      "nonterminal",
+      (row) => row.state !== "settled",
+      sql`SELECT submission_id, thread_id, queue_sequence, principal, idempotency_key,
+          deployment_id, receipt_id, state
+          FROM effect_agent_submissions WHERE state <> 'settled' LIMIT 129`,
+      128,
+    ),
+    "ledger scan nonterminal",
+  );
 
-        if (active.length > 128)
-          return Stream.paginate<ScanCursor | undefined, SubmissionWorkItem, LedgerError>(
-            undefined,
-            scanPage,
-          );
+  const boundedNonterminal = state.read(
+    Effect.gen(function* () {
+      // Cache only a complete bounded active set. Large hosts keep the paged scan.
+      const active = yield* activeNonterminal;
 
-        const sorted = [...active].sort((left, right) =>
-          left.thread_id < right.thread_id
-            ? -1
-            : left.thread_id > right.thread_id
-              ? 1
-              : left.queue_sequence - right.queue_sequence,
-        );
+      if (active.length > 128) return undefined;
 
-        const work = yield* Schema.decodeEffect(Schema.Array(SubmissionWorkItem))(
-          sorted.map((row) => ({
-            submissionId: row.submission_id,
-            threadId: row.thread_id,
-            queueSequence: row.queue_sequence,
-            principal: row.principal,
-            idempotencyKey: row.idempotency_key,
-            deploymentId: row.deployment_id,
-            receiptId: row.receipt_id,
-            state: row.state,
-          })),
-        ).pipe(Effect.mapError(internalFailure("ledger scan nonterminal")));
-
-        return Stream.fromIterable(work);
-      }),
+      const sorted = [...active].sort((left, right) =>
+        left.thread_id < right.thread_id
+          ? -1
+          : left.thread_id > right.thread_id
+            ? 1
+            : left.queue_sequence - right.queue_sequence,
+      );
+
+      const work = yield* decodeSubmissionWorkItems(
+        sorted.map((row) => ({
+          submissionId: row.submission_id,
+          threadId: row.thread_id,
+          queueSequence: row.queue_sequence,
+          principal: row.principal,
+          idempotencyKey: row.idempotency_key,
+          deploymentId: row.deployment_id,
+          receiptId: row.receipt_id,
+          state: row.state,
+        })),
+      ).pipe(Effect.mapError(internalFailure("ledger scan nonterminal")));
+
+      return work;
+    }),
+  );
+
+  const pagedNonterminal = Stream.paginate<ScanCursor | undefined, SubmissionWorkItem, LedgerError>(
+    undefined,
+    scanPage,
+  );
+
+  // Large scans keep their bounded page lifetime and streaming backpressure.
+  const scanNonterminal = Stream.unwrap(
+    Effect.map(boundedNonterminal, (work) =>
+      work === undefined ? pagedNonterminal : Stream.fromIterable(work),
     ),
   );
 
+  const listNonterminal = Effect.filterOrElse(
+    boundedNonterminal,
+    (work) => work !== undefined,
+    () => Stream.runCollect(pagedNonterminal),
+  );
+
   const readAbortIntentForSubmission: SubmissionLedger["Service"]["readAbortIntent"] =
     Effect.fnUntraced(function* (request) {
       const operation = "ledger read abort intent";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(AbortIntentRequest))(request).pipe(
+      const validated = yield* decodeAbortIntentRequestType(request).pipe(
         Effect.mapError(internalFailure(operation)),
       );
 
@@ -3548,9 +3754,9 @@ const makeServices = Effect.fnUntraced(function* () {
     Effect.fnUntraced(function* (request: RecoverySnapshotRequest) {
       const operation = "ledger load recovery snapshot";
 
-      const validated = yield* Schema.decodeEffect(Schema.toType(RecoverySnapshotRequest))(
-        request,
-      ).pipe(Effect.mapError(internalFailure(operation)));
+      const validated = yield* decodeRecoverySnapshotRequestType(request).pipe(
+        Effect.mapError(internalFailure(operation)),
+      );
 
       return yield* state.read(
         Effect.gen(function* () {
@@ -3590,19 +3796,16 @@ const makeServices = Effect.fnUntraced(function* () {
             .filter((row) => row.joined_host_submission_id === validated.submissionId)
             .sort((a, b) => a.queue_sequence - b.queue_sequence);
 
-          const joinSubmissions = yield* decodeSubmissionRows(
-            operation,
-            validated.submissionId,
-            joinRows,
-          );
+          const joins: Array<JoinSnapshot> = [];
 
-          const joins = yield* Effect.forEach(joinSubmissions, (row) =>
-            decodeJoinSnapshot({
-              submissionId: row.submission_id,
-              state: row.state,
-              hostSubmissionId: validated.submissionId,
-            }).pipe(Effect.mapError(internalFailure(operation))),
-          );
+          for (const row of joinRows)
+            joins.push(
+              yield* decodeJoinSnapshot({
+                submissionId: row.submission_id,
+                state: row.state,
+                hostSubmissionId: validated.submissionId,
+              }).pipe(Effect.mapError(internalFailure(operation))),
+            );
 
           let hostSubmissionId: RecoverySnapshot["hostSubmissionId"];
 
@@ -3643,15 +3846,17 @@ const makeServices = Effect.fnUntraced(function* () {
 
           const decisionRows = yield* readApprovalDecisions(operation, validated.submissionId);
 
-          const approvalDecisions = yield* Effect.forEach(decisionRows, (row) =>
-            approvalIntentFromRow(operation, row),
-          );
+          const approvalDecisions: Array<ApprovalDecisionIntent> = [];
+
+          for (const row of decisionRows)
+            approvalDecisions.push(yield* approvalIntentFromRow(operation, row));
 
           const resolutionRows = yield* readUnknownResolutions(operation, validated.submissionId);
 
-          const unknownResolutions = yield* Effect.forEach(resolutionRows, (row) =>
-            unknownResolutionIntentFromRow(operation, row),
-          );
+          const unknownResolutions: Array<UnknownResolutionIntent> = [];
+
+          for (const row of resolutionRows)
+            unknownResolutions.push(yield* unknownResolutionIntentFromRow(operation, row));
 
           // Parent-side subagent view: this Submission's child budget reservations in parent
           // Tool Call order, plus each attached child's current lane state (a disposable
@@ -3666,21 +3871,16 @@ const makeServices = Effect.fnUntraced(function* () {
             .filter((row) => row.parent_submission_id === validated.submissionId)
             .sort((a, b) => a.parent_tool_call_id.localeCompare(b.parent_tool_call_id));
 
-          const decodedChildReservations = yield* decodeChildReservationRows(
-            operation,
-            validated.submissionId,
-            childReservationRows,
-          );
+          const childReservations: Array<ChildBudgetReservationSnapshot> = [];
 
-          const childReservations = yield* Effect.forEach(decodedChildReservations, (row) =>
-            childReservationSnapshotFromRow(operation, row),
-          );
+          for (const row of childReservationRows)
+            childReservations.push(yield* childReservationSnapshotFromRow(operation, row));
 
           const markers = yield* readChildSettlementMarkers(operation, validated.submissionId);
           const markersByChild = new Map(markers.map((row) => [row.child_submission_id, row]));
           const childAttachments: Array<ChildAttachmentSnapshot> = [];
 
-          for (const row of decodedChildReservations) {
+          for (const row of childReservationRows) {
             if (row.child_submission_id === null) continue;
             const child = yield* readSubmission(operation, row.child_submission_id);
 
@@ -3751,6 +3951,7 @@ const makeServices = Effect.fnUntraced(function* () {
       resolveAdmission,
       selectHead,
       markInputApplied,
+      appendInput,
       finalizeSettlement: (request) => owner.withMutation(finalizeSettlement(request)),
       requestAbort,
       stopWorker,
@@ -3768,6 +3969,7 @@ const makeServices = Effect.fnUntraced(function* () {
       beginChildBudgetRelease,
       releaseChildBudget,
       scanNonterminal,
+      listNonterminal,
       loadRecoverySnapshot,
       readAbortIntent: readAbortIntentForSubmission,
     }),