@yielded/agent-storage-memory 0.1.0-beta.166 → 0.1.0-beta.168

package/src/MemorySubmissionLedger.ts

@@ -1,3 +1,4 @@
+import { canonicalJson, utf8ByteLength } from "@yielded/agent/digest";
 import {
   type ToolCallId,
   AttemptId,
@@ -10,16 +11,26 @@ import {
 import { InputMessage } from "@yielded/agent/messaging";
 import {
   PersistedJson,
+  MAX_RUN_EVIDENCE_RECORDS,
+  MAX_RUN_EVIDENCE_BYTES,
   WorkerAdmission,
-  ProducerEpoch,
   type DefinitionDigests,
   type DeploymentId,
   type Digest,
-  type ProducerId,
   type RecordEnvelope,
   type SettlementOutcome,
 } from "@yielded/agent/records";
+import { runIdForSubmission } from "@yielded/agent/run-journal";
 import {
+  SettlementPublisher,
+  SettlementPublicationResult,
+  validatePublication,
+  validateCanonicalSettlement,
+  validateJoinedSettlement,
+} from "@yielded/agent/settlement-publisher";
+import {
+  FundingOwnerRequest,
+  FundingOwner,
   type ParentLinkage,
   AbortCommand,
   WorkerStopCommand,
@@ -36,6 +47,7 @@ import {
   ApprovalConflict,
   ApprovalDecisionCommand,
   ApprovalDecisionIntent,
+  approvalDecisionsCover,
   AttachChildToReservationRequest,
   BeginChildBudgetReleaseRequest,
   ChildAttachmentSnapshot,
@@ -46,7 +58,6 @@ import {
   Claim,
   ClaimJoiningRequest,
   ClaimRequest,
-  DEFAULT_OWNERSHIP_LEASE_DURATION,
   InputAppliedMarker,
   JoinSnapshot,
   JoinedToHost,
@@ -58,24 +69,17 @@ import {
   MarkReadyRequest,
   MarkUnknownRequest,
   OwnershipLost,
-  OwnershipRenewal,
-  OwnershipSnapshot,
-  OwnershipToken,
   QueueSequence,
   RecoverySnapshot,
   RecoverySnapshotRequest,
   ReleaseChildBudgetRequest,
-  ReleaseOwnershipRequest,
-  RenewOwnershipRequest,
   ReservedChildBudget,
-  ReservedSettlement,
   RevertJoiningRequest,
   Settlement,
   SettlementConflict,
   SettlementFinalization,
-  SettlementReservation,
-  SettlementReservationSnapshot,
   settlementFailureFromRecord,
+  submissionSettlementRecordId,
   AbortIntent,
   AbortIntentRequest,
   SubmissionLedger,
@@ -89,6 +93,8 @@ import {
   UnknownResolutionCommand,
   UnknownResolutionConflict,
   UnknownResolutionIntent,
+  unknownResolutionKind,
+  unknownResolutionMatchesResult,
   type ChildReservationId,
   type ChildReservationStatus,
   type ChildSettledOutcome,
@@ -98,26 +104,46 @@ import {
   type SuspensionOutcome,
   type SuspensionReason,
 } from "@yielded/agent/submission-ledger";
+import {
+  rebuildClosedSubmission,
+  invalidThreadArchive,
+  RebuiltSubmission,
+  ThreadImportRejected,
+} from "@yielded/agent/thread-import";
+import {
+  ThreadAdmission,
+  ThreadStoreError,
+  ThreadAbortFact,
+  ThreadApprovalFact,
+  ThreadResolutionFact,
+  makeTransferFactCheck,
+  transferPageFits,
+} from "@yielded/agent/thread-store";
+import { admissionWork } from "@yielded/agent/thread-work";
 import {
   Clock,
+  Context,
   Cause,
+  Crypto,
   Exit,
   Fiber,
   DateTime,
-  Duration,
   Effect,
   Layer,
+  MutableRef,
   Option,
   Ref,
+  Result,
   Schema,
   Stream,
 } from "effect";
 
-const MAX_SUBMISSIONS = 65_536;
+import { MemoryThreadStoreKernel } from "./internal/MemoryThreadStoreKernel.ts";
+import { boundedWorkSelection } from "./internal/WorkSelection.ts";
 
 /**
  * Lifecycle ordering used to advance-but-never-regress the operational state marker: a reclaimed
- * Attempt must not erase progress markers (input-applied, terminalizing) that an earlier Attempt
+ * Attempt must not erase progress markers (input-applied) that an earlier Attempt
  * already committed.
  */
 const STATE_RANK: Record<SubmissionState, number> = {
@@ -125,12 +151,10 @@ const STATE_RANK: Record<SubmissionState, number> = {
   ready: 1,
   joining: 2,
   joined: 3,
-  running: 4,
   "input-applied": 5,
   suspended: 6,
   unknown: 7,
-  terminalizing: 8,
-  settled: 9,
+  settled: 8,
 };
 
 interface SubmissionRow {
@@ -157,20 +181,10 @@ interface SubmissionRow {
   readonly messageAdmissionJson?: string;
 }
 
-interface StoredOwnership {
-  readonly attemptId: AttemptId;
-  readonly ownershipToken: OwnershipToken;
-  readonly producerEpoch: ProducerEpoch;
-  readonly ownerProducerId: ProducerId;
-  readonly leaseExpiresAtMillis: number;
-}
-
-interface StoredReservation {
+interface StoredFinalization {
   readonly settlementId: SettlementId;
-  readonly outcome: SettlementOutcome;
-  readonly record: RecordEnvelope;
-  readonly recordDigest: Digest;
-  readonly finalizedAtMillis: number | undefined;
+  readonly finalizedAtMillis: number;
+  readonly recordId: RecordEnvelope["recordId"];
 }
 
 interface StoredSuspension {
@@ -189,16 +203,15 @@ interface StoredUnknownResolution {
 
 interface StoredSubmission {
   readonly row: SubmissionRow;
-  readonly ownership: StoredOwnership | undefined;
   readonly inputApplied: InputAppliedMarker | undefined;
-  readonly reservation: StoredReservation | undefined;
+  readonly finalization: StoredFinalization | undefined;
   readonly abortIntent: AbortIntent | undefined;
   /** Host linkage recorded at `claimJoining` time; cleared by `revertJoining` (DUR-016). */
   readonly joinedHostSubmissionId: SubmissionId | undefined;
   readonly suspension: StoredSuspension | undefined;
   readonly unknownMark: StoredUnknownMark | undefined;
   readonly approvalDecisions: ReadonlyMap<ToolCallId, ApprovalDecisionIntent>;
-  readonly unknownResolutions: ReadonlyMap<ToolCallId, StoredUnknownResolution>;
+  readonly unknownResolutions: ReadonlyMap<string, StoredUnknownResolution>;
 }
 
 /**
@@ -214,7 +227,6 @@ const BLOCKED_HEAD_STATES: ReadonlySet<SubmissionState> = new Set([
 
 interface LaneState {
   readonly nextQueueSequence: number;
-  readonly producerEpoch: number;
 }
 
 /** One parent-owned child budget reservation row (spec §12 steps 2 and 6). */
@@ -232,15 +244,69 @@ interface StoredChildReservation {
   readonly releasedAtMillis: number | undefined;
 }
 
+interface ThreadDirectory {
+  readonly ordered: Array<SubmissionId>;
+  readonly commands: {
+    readonly aborts: Array<CommandLocator>;
+    readonly approvals: Array<CommandLocator>;
+    readonly resolutions: Array<CommandLocator>;
+  };
+  children: number;
+  workers: number;
+  reservations: number;
+}
+interface CommandLocator {
+  readonly key: string;
+  readonly submissionId: SubmissionId;
+  readonly toolCallId?: ToolCallId;
+  readonly resolutionKey?: string;
+}
+
+const commandPosition = (entries: ReadonlyArray<CommandLocator>, key: string) => {
+  let low = 0;
+  let high = entries.length;
+
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+
+    if (entries[middle].key < key) low = middle + 1;
+    else high = middle;
+  }
+
+  return low;
+};
+
+const retainCommand = (
+  entries: Array<CommandLocator>,
+  submissionId: SubmissionId,
+  toolCallId?: ToolCallId,
+  resolutionKey?: string,
+) => {
+  // Acceptance order is native, stable and append-only; publishing a command never shifts history.
+  const key = String(entries.length + 1).padStart(16, "0");
+
+  entries.push({
+    key,
+    submissionId,
+    ...(toolCallId === undefined ? {} : { toolCallId }),
+    ...(resolutionKey === undefined ? {} : { resolutionKey }),
+  });
+};
+
 interface LedgerState {
-  readonly submissions: ReadonlyMap<SubmissionId, StoredSubmission>;
-  readonly admissionIndex: ReadonlyMap<string, SubmissionId>;
-  readonly lanes: ReadonlyMap<ThreadId, LaneState>;
-  readonly childReservations: ReadonlyMap<ChildReservationId, StoredChildReservation>;
-  readonly mintCounter: number;
-  readonly latestByThread: ReadonlyMap<ThreadId, SubmissionId>;
-  readonly activeByThread: ReadonlyMap<ThreadId, ReadonlySet<SubmissionId>>;
-  readonly stoppedWorkers: ReadonlyMap<ThreadId, WorkerLedgerState["terminal"]>;
+  readonly byThread: Map<ThreadId, ThreadDirectory>;
+  readonly receipts: Map<ReceiptId, SubmissionId>;
+  readonly joinsByHost: Map<SubmissionId, Set<SubmissionId>>;
+  readonly childrenByParent: Map<SubmissionId, Set<ChildReservationId>>;
+  readonly submissions: Map<SubmissionId, StoredSubmission>;
+  readonly admissionIndex: Map<string, SubmissionId>;
+  readonly lanes: Map<ThreadId, LaneState>;
+  readonly childReservations: Map<ChildReservationId, StoredChildReservation>;
+  /** Bounded local ordering for fresh work identities; imported facts never seed it. */
+  readonly freshAdmissionSequence: number;
+  readonly latestByThread: Map<ThreadId, SubmissionId>;
+  readonly activeByThread: Map<ThreadId, Set<SubmissionId>>;
+  readonly stoppedWorkers: Map<ThreadId, WorkerLedgerState["terminal"]>;
 }
 
 type Decision<A, E> =
@@ -255,26 +321,31 @@ const ledgerError = (operation: string, message: string, cause?: unknown): Ledge
     ? LedgerError.make({ operation, message })
     : LedgerError.make({ operation, message, cause });
 
-const validate = Effect.fn("MemorySubmissionLedger.validate")(
-  <A, I>(
-    schema: Schema.Codec<A, I>,
-    operation: string,
-    value: unknown,
-  ): Effect.Effect<A, LedgerError> =>
-    Schema.encodeUnknownEffect(schema)(value).pipe(
-      Effect.flatMap(Schema.decodeUnknownEffect(schema)),
-      Effect.mapError((error) => ledgerError(operation, `Invalid ${operation} request`, error)),
-    ),
-);
+const validate = <A, I>(
+  schema: Schema.Codec<A, I>,
+  operation: string,
+  value: unknown,
+): Effect.Effect<A, LedgerError> =>
+  Schema.encodeUnknownEffect(schema)(value).pipe(
+    Effect.flatMap(Schema.decodeUnknownEffect(schema)),
+    Effect.mapError((error) => ledgerError(operation, `Invalid ${operation} request`, error)),
+  );
 
 const decodeSubmissionId = Schema.decodeSync(SubmissionId);
 const decodeReceiptId = Schema.decodeSync(ReceiptId);
 const decodeAttemptId = Schema.decodeSync(AttemptId);
-const decodeOwnershipToken = Schema.decodeSync(OwnershipToken);
+// Imported identities are opaque facts and never influence fresh identity sizes.
+const MemoryIdentityNonce = Schema.String.check(Schema.isUUID(4));
 const decodeQueueSequence = Schema.decodeSync(QueueSequence);
-const decodeProducerEpoch = Schema.decodeSync(ProducerEpoch);
 const equivalentPersistedJson = Schema.toEquivalence(PersistedJson);
 const equivalentUnknownResolution = Schema.toEquivalence(UnknownResolution);
+const admissionFitsTransfer = makeTransferFactCheck(ThreadAdmission);
+const abortFitsTransfer = makeTransferFactCheck(ThreadAbortFact);
+const approvalFitsTransfer = makeTransferFactCheck(ThreadApprovalFact);
+const resolutionFitsTransfer = makeTransferFactCheck(ThreadResolutionFact);
+
+const transferCapacityError = (operation: string) =>
+  ledgerError(operation, "Accepted fact exceeds its bounded transfer representation");
 
 const utc = (millis: number): DateTime.Utc => DateTime.toUtc(DateTime.makeUnsafe(millis));
 
@@ -337,6 +408,91 @@ const toReservationSnapshot = (row: StoredChildReservation): ChildBudgetReservat
     ...(row.releasedAtMillis === undefined ? {} : { releasedAt: utc(row.releasedAtMillis) }),
   });
 
+const fromRebuilt = (rebuilt: RebuiltSubmission): StoredSubmission => {
+  const admission = rebuilt.admission;
+  const threadId = admission.threadId;
+  const canonicalSettlement = rebuilt.settlement?.payload;
+
+  const settlement =
+    canonicalSettlement?._tag === "SubmissionSettled" ? canonicalSettlement : undefined;
+
+  return {
+    row: {
+      submissionId: admission.submissionId,
+      threadId,
+      queueSequence: admission.queueSequence,
+      principal: admission.principal,
+      idempotencyKey: admission.idempotencyKey,
+      agentId: admission.agentId,
+      agentDigests: admission.agentDigests,
+      deploymentId: admission.deploymentId,
+      inputPayload: admission.inputPayload,
+      inputDigest: admission.inputDigest,
+      receiptId: admission.receiptId,
+      state: rebuilt.state,
+      settledOutcome: settlement?.outcome,
+      createdAtMillis: DateTime.toEpochMillis(admission.createdAt),
+      readyAtMillis:
+        rebuilt.state === "ready" ? DateTime.toEpochMillis(admission.createdAt) : undefined,
+      parentLinkage: admission.parentLinkage,
+      ...(admission.workerAdmission === undefined
+        ? {}
+        : {
+            workerAdmissionJson: Schema.encodeSync(Schema.fromJsonString(WorkerAdmission))(
+              admission.workerAdmission,
+            ),
+          }),
+      ...(admission.messageAdmission === undefined
+        ? {}
+        : {
+            messageAdmissionJson: Schema.encodeSync(Schema.fromJsonString(InputMessage))(
+              admission.messageAdmission,
+            ),
+          }),
+      ...(admission.admissionGroup === undefined
+        ? {}
+        : { admissionGroup: admission.admissionGroup }),
+      ...(admission.admissionFence === undefined
+        ? {}
+        : { admissionFence: admission.admissionFence }),
+    },
+    inputApplied: rebuilt.inputApplied,
+    finalization:
+      settlement === undefined ||
+      rebuilt.settlement === undefined ||
+      admission.settledAt === undefined
+        ? undefined
+        : {
+            settlementId: settlement.settlementId,
+            recordId: rebuilt.settlement.recordId,
+            finalizedAtMillis: DateTime.toEpochMillis(admission.settledAt),
+          },
+    abortIntent: rebuilt.abort,
+    joinedHostSubmissionId: rebuilt.joinedHostSubmissionId,
+    suspension:
+      rebuilt.suspension === undefined
+        ? undefined
+        : {
+            reason: rebuilt.suspension.reason,
+            suspendedAtMillis: DateTime.toEpochMillis(rebuilt.suspension.suspendedAt),
+          },
+    unknownMark:
+      rebuilt.unknownToolCallIds.length === 0
+        ? undefined
+        : {
+            reason: "Unresolved Tool execution recovered from the canonical log",
+            toolCallIds: rebuilt.unknownToolCallIds,
+          },
+    approvalDecisions: new Map(rebuilt.approvals.map((intent) => [intent.toolCallId, intent])),
+    unknownResolutions: new Map(
+      rebuilt.resolutions.map((intent) => [
+        JSON.stringify([intent.toolCallId, unknownResolutionKind(intent.resolution)]),
+        { intent },
+      ]),
+    ),
+  };
+};
+
 /** Linkage equality: both absent, or both present naming the same parent Tool Call. */
 const sameParentLinkage = (
   left: ParentLinkage | undefined,
@@ -348,53 +504,136 @@ const sameParentLinkage = (
       left.parentSubmissionId === right.parentSubmissionId &&
       left.parentToolCallId === right.parentToolCallId;
 
-const laneEpoch = (state: LedgerState, threadId: ThreadId): number =>
-  state.lanes.get(threadId)?.producerEpoch ?? 0;
-
-const ownershipLost = (state: LedgerState, stored: StoredSubmission): OwnershipLost =>
-  OwnershipLost.make({
-    submissionId: stored.row.submissionId,
-    actualEpoch: decodeProducerEpoch(laneEpoch(state, stored.row.threadId)),
-  });
-
-/** A retained row token cannot outlive a newer owner of the same Thread. */
-const ownsLane = (
-  state: LedgerState,
-  stored: StoredSubmission,
-  ownershipToken: OwnershipToken,
-): boolean =>
-  stored.ownership !== undefined &&
-  stored.ownership.ownershipToken === ownershipToken &&
-  stored.ownership.producerEpoch === laneEpoch(state, stored.row.threadId);
+const ownershipLost = (stored: StoredSubmission): OwnershipLost =>
+  OwnershipLost.make({ submissionId: stored.row.submissionId });
 
 const withSubmission = (state: LedgerState, stored: StoredSubmission): LedgerState => {
-  const active = new Set(state.activeByThread.get(stored.row.threadId));
+  const row = stored.row;
+  const previous = state.submissions.get(row.submissionId);
+  let directory = state.byThread.get(row.threadId);
+
+  if (directory === undefined) {
+    directory = {
+      ordered: [],
+      commands: { aborts: [], approvals: [], resolutions: [] },
+      children: 0,
+      workers: 0,
+      reservations: 0,
+    };
+    state.byThread.set(row.threadId, directory);
+  }
+  if (previous === undefined) {
+    let low = 0;
+    let high = directory.ordered.length;
+
+    while (low < high) {
+      const middle = Math.floor((low + high) / 2);
+      const candidate = state.submissions.get(directory.ordered[middle]);
+
+      if (candidate !== undefined && candidate.row.queueSequence < row.queueSequence)
+        low = middle + 1;
+      else high = middle;
+    }
+    directory.ordered.splice(low, 0, row.submissionId);
+    state.receipts.set(row.receiptId, row.submissionId);
+    state.admissionIndex.set(
+      admissionKey(row.threadId, row.principal, row.idempotencyKey),
+      row.submissionId,
+    );
+    const latest = state.latestByThread.get(row.threadId);
+
+    if (
+      latest === undefined ||
+      (state.submissions.get(latest)?.row.queueSequence ?? -1) < row.queueSequence
+    )
+      state.latestByThread.set(row.threadId, row.submissionId);
+  }
+  directory.children +=
+    Number(row.state !== "settled" && row.parentLinkage !== undefined) -
+    Number(
+      previous !== undefined &&
+        previous.row.state !== "settled" &&
+        previous.row.parentLinkage !== undefined,
+    );
+  directory.workers +=
+    Number(row.state !== "settled" && row.workerAdmissionJson !== undefined) -
+    Number(
+      previous !== undefined &&
+        previous.row.state !== "settled" &&
+        previous.row.workerAdmissionJson !== undefined,
+    );
+  if (stored.abortIntent !== undefined && previous?.abortIntent === undefined)
+    retainCommand(directory.commands.aborts, row.submissionId);
+  if (stored.approvalDecisions !== previous?.approvalDecisions)
+    for (const id of stored.approvalDecisions.keys())
+      if (!previous?.approvalDecisions.has(id))
+        retainCommand(directory.commands.approvals, row.submissionId, id);
+  if (stored.unknownResolutions !== previous?.unknownResolutions)
+    for (const [id, value] of stored.unknownResolutions)
+      if (!previous?.unknownResolutions.has(id))
+        retainCommand(
+          directory.commands.resolutions,
+          row.submissionId,
+          value.intent.toolCallId,
+          id,
+        );
+  if (
+    previous?.joinedHostSubmissionId !== undefined &&
+    previous.joinedHostSubmissionId !== stored.joinedHostSubmissionId
+  )
+    state.joinsByHost.get(previous.joinedHostSubmissionId)?.delete(row.submissionId);
+  if (stored.joinedHostSubmissionId !== undefined) {
+    let joins = state.joinsByHost.get(stored.joinedHostSubmissionId);
+
+    if (joins === undefined)
+      state.joinsByHost.set(stored.joinedHostSubmissionId, (joins = new Set()));
+    joins.add(row.submissionId);
+  }
+  let active = state.activeByThread.get(row.threadId);
 
-  if (stored.row.state === "settled") active.delete(stored.row.submissionId);
-  else active.add(stored.row.submissionId);
+  if (active === undefined) state.activeByThread.set(row.threadId, (active = new Set()));
+  if (row.state === "settled") active.delete(row.submissionId);
+  else active.add(row.submissionId);
+  state.submissions.set(row.submissionId, stored);
 
-  return {
-    ...state,
-    submissions: new Map(state.submissions).set(stored.row.submissionId, stored),
-    activeByThread: new Map(state.activeByThread).set(stored.row.threadId, active),
-  };
+  return state;
 };
 
 const withChildReservation = (
   state: LedgerState,
   reservation: StoredChildReservation,
-): LedgerState => ({
-  ...state,
-  childReservations: new Map(state.childReservations).set(reservation.reservationId, reservation),
-});
+): LedgerState => {
+  const previous = state.childReservations.get(reservation.reservationId);
+
+  state.childReservations.set(reservation.reservationId, reservation);
+  let children = state.childrenByParent.get(reservation.parentSubmissionId);
+
+  if (children === undefined)
+    state.childrenByParent.set(reservation.parentSubmissionId, (children = new Set()));
+  children.add(reservation.reservationId);
+  const parent = state.submissions.get(reservation.parentSubmissionId);
+
+  if (parent !== undefined) {
+    const directory = state.byThread.get(parent.row.threadId);
+
+    if (directory !== undefined) {
+      directory.reservations +=
+        Number(reservation.status !== "released") -
+        Number(previous !== undefined && previous.status !== "released");
+    }
+  }
+
+  return state;
+};
 
 const findHead = (state: LedgerState, threadId: ThreadId): StoredSubmission | undefined => {
   let head: StoredSubmission | undefined;
 
-  for (const stored of state.submissions.values()) {
+  for (const id of state.activeByThread.get(threadId) ?? []) {
+    const stored = state.submissions.get(id);
+
     if (
-      stored.row.threadId !== threadId ||
-      stored.row.state === "settled" ||
+      stored === undefined ||
       (stored.row.state === "unknown" && stored.abortIntent === undefined)
     )
       continue;
@@ -404,341 +643,411 @@ const findHead = (state: LedgerState, threadId: ThreadId): StoredSubmission | un
   return head;
 };
 
+function* threadRows(state: LedgerState, threadId: ThreadId, after = -1) {
+  const ordered = state.byThread.get(threadId)?.ordered ?? [];
+  let low = 0;
+  let high = ordered.length;
+
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+
+    if ((state.submissions.get(ordered[middle])?.row.queueSequence ?? -1) <= after)
+      low = middle + 1;
+    else high = middle;
+  }
+  for (let index = low; index < ordered.length; index++) {
+    const stored = state.submissions.get(ordered[index]);
+
+    if (stored !== undefined) yield stored;
+  }
+}
+
 /**
- * Reference in-memory SubmissionLedger. It implements the full port contract — atomic idempotent
- * admission, eligible FIFO claims, producer-epoch fencing, Clock-driven ownership leases, idempotent
- * settlement reservation/finalization, and durable abort intent — with every transition applied
- * as one atomic `Ref.modify`, but its state does not survive the process (`non-durable`).
- *
- * Adapter-specific semantics within the port's latitude:
+ * Reference in-memory SubmissionLedger. Admission, ordered selection and canonical settlement
+ * share the Memory kernel's mutation gate. The kernel Scope owns local Run capabilities;
+ * selecting work does not write execution ownership into the ledger.
  *
- * - Time comes exclusively from the Effect `Clock` service, so `TestClock` drives lease expiry
- *   deterministically; no wall clock is consulted.
- * - The ownership lease is pinned to `DEFAULT_OWNERSHIP_LEASE_DURATION` (D5); durable adapters
- *   own the configuration seam.
- * - Any live lease in the Thread blocks every new claim, including the same `producerId`.
- *   Unresolved unknown work is skipped only after ownership is released or expires.
- * - Claiming advances `ready` to `running` and otherwise preserves the recorded state, so
- *   progress markers from an earlier Attempt survive a reclaim.
- * - `renewOwnership` keeps the token stable (the port allows rotation); a replayed admission
- *   reports the Submission's current state alongside the original identities.
- * - `claimJoining` walks the strictly-later queue: rows already `joining`/`joined` to the
- *   SAME host extend the claimed prefix and are skipped, and an aborted-settled row is a
- *   closed obligation that is also skipped (P7 §7(c)); any other non-`ready` row (an
- *   `admitted` gap, a non-aborted settled row, foreign-host linkage) breaks the prefix
- *   conservatively.
- * - `markJoined` verifies the token against the HOST's live ownership (the lane is
- *   host-owned), so a later host Attempt can repair a lost marker from history (DUR-016). The
- *   join marker reuses the input-applied marker: the joined input IS `input:{sid}`.
- * - `suspend` and `markUnknown` refuse when an exact settlement is already reserved
- *   (`SettlementConflict` with the reserved outcome) — DUR-011's reservation wins.
- * - `resolveAdmission` derives its answer from the single strongly consistent store, so it
- *   never answers `Indeterminate` on its own; the test-only `resolveAdmissionFault` option
- *   injects the `Indeterminate` classification so SUB-031 callers can be conformance-tested.
- * - `recordChildSettled` and `suspend(WaitingForChild)` observe child settlement directly from
- *   the child rows (single-store latitude); no separate notification marker is stored.
+ * Joining retains the contiguous ready prefix and exact host linkage. Canonical settlement
+ * authorizes finalization and child wake repair, while bound sessions reject late commands.
+ * Child wake checks read the child rows directly, without a separate notification marker.
+ * Admission resolution is strongly consistent; resolveAdmissionFault injects the
+ * Indeterminate outcome for existing caller conformance workflows.
  */
 const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
   Effect.gen(function* () {
+    const journal = yield* MemoryThreadStoreKernel;
+    const crypto = yield* Crypto.Crypto;
+
+    const mintIdentity = (operation: string) =>
+      crypto.randomUUIDv4().pipe(
+        Effect.flatMap(Schema.decodeEffect(MemoryIdentityNonce)),
+        Effect.mapError((cause) => ledgerError(operation, "Cannot mint a Memory identity", cause)),
+      );
+
     const state = yield* Ref.make<LedgerState>({
+      byThread: new Map(),
+      receipts: new Map(),
+      joinsByHost: new Map(),
+      childrenByParent: new Map(),
       submissions: new Map(),
       admissionIndex: new Map(),
       lanes: new Map(),
       childReservations: new Map(),
-      mintCounter: 0,
+      freshAdmissionSequence: 0,
       stoppedWorkers: new Map(),
       latestByThread: new Map(),
       activeByThread: new Map(),
     });
 
-    const admissionFence = yield* SubmissionAdmissionFence;
-    const leaseMillis = Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION);
+    yield* journal.registerWorkOwner("admissions", {
+      threads: (request) =>
+        Ref.get(state).pipe(
+          Effect.map((current) => {
+            const candidates = boundedWorkSelection<ThreadId>(
+              request.limit,
+              (id) => id,
+              request.afterThreadId,
+            );
 
-    const capabilities = Effect.succeed(LedgerCapabilities.make({ durability: "non-durable" }));
+            for (const [threadId, ids] of current.activeByThread)
+              if (ids.size > 0) candidates.add(threadId);
+            const threadIds = candidates.values;
 
-    const admit: SubmissionLedger["Service"]["admit"] = Effect.fn("MemorySubmissionLedger.admit")(
-      (unvalidated) =>
+            const afterThreadId = threadIds.length === request.limit ? threadIds.at(-1) : undefined;
+
+            return {
+              threadIds,
+              ...(afterThreadId === undefined ? {} : { afterThreadId }),
+            };
+          }),
+        ),
+      page: (threadId, after, limit) =>
         Effect.gen(function* () {
-          const request = yield* validate(AdmissionRequest, "admit", unvalidated);
-
-          const workerAdmissionJson =
-            request.workerAdmission === undefined
-              ? undefined
-              : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(
-                  request.workerAdmission,
-                ).pipe(
-                  Effect.mapError(() => ledgerError("admit", "Invalid worker admission metadata")),
-                );
+          const current = yield* Ref.get(state);
 
-          const messageAdmissionJson =
-            request.messageAdmission === undefined
-              ? undefined
-              : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(
-                  request.messageAdmission,
-                ).pipe(
-                  Effect.mapError(() => ledgerError("admit", "Invalid message admission metadata")),
-                );
+          const candidates = boundedWorkSelection<SubmissionId>(limit + 1, (id) => id, after);
 
-          const nowMillis = yield* Clock.currentTimeMillis;
-          const services = yield* Effect.context<never>();
+          for (const id of current.activeByThread.get(threadId) ?? []) candidates.add(id);
+          const ids = candidates.values;
 
-          const decision = yield* Ref.modify(
-            state,
-            (
-              current,
-            ): readonly [
-              (
-                | Decision<AdmissionResult, AdmissionConflict | AdmissionPolicyError | LedgerError>
-                | { readonly _tag: "cause"; readonly cause: Cause.Cause<AdmissionPolicyError> }
-              ),
-              LedgerState,
-            ] => {
-              const key = admissionKey(request.threadId, request.principal, request.idempotencyKey);
-              const existingId = current.admissionIndex.get(key);
-
-              if (existingId !== undefined) {
-                const existing = current.submissions.get(existingId);
-
-                if (existing === undefined) {
-                  return [
-                    failure(
-                      ledgerError("admit", "Admission index references a missing Submission"),
-                    ),
-                    current,
-                  ];
-                }
-                // A replay must repeat the exact canonical input AND the exact parent linkage
-                // (or its absence): linkage is immutable lineage (spec §12 step 5, SUB-016).
-                if (
-                  existing.row.inputDigest !== request.inputDigest ||
-                  !sameParentLinkage(existing.row.parentLinkage, request.parentLinkage) ||
-                  existing.row.admissionGroup !== request.admissionGroup ||
-                  !Schema.toEquivalence(Schema.optional(WorkerAdmission))(
-                    existing.row.workerAdmissionJson === undefined
-                      ? undefined
-                      : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
-                          existing.row.workerAdmissionJson,
-                        ),
-                    request.workerAdmission,
-                  ) ||
-                  !Schema.toEquivalence(Schema.optional(InputMessage))(
-                    existing.row.messageAdmissionJson === undefined
-                      ? undefined
-                      : Schema.decodeSync(Schema.fromJsonString(InputMessage))(
-                          existing.row.messageAdmissionJson,
-                        ),
-                    request.messageAdmission,
-                  ) ||
-                  !Schema.toEquivalence(Schema.optional(Schema.Json))(
-                    existing.row.admissionFence,
-                    request.admissionFence,
-                  )
-                ) {
-                  return [
-                    failure(
-                      AdmissionConflict.make({
-                        threadId: request.threadId,
-                        principal: request.principal,
-                        idempotencyKey: request.idempotencyKey,
-                        existingInputDigest: existing.row.inputDigest,
-                        attemptedInputDigest: request.inputDigest,
-                      }),
-                    ),
-                    current,
-                  ];
-                }
+          const entries = [];
 
-                return [
-                  success(
-                    AdmissionResult.make({
-                      submissionId: existing.row.submissionId,
-                      receiptId: existing.row.receiptId,
-                      queueSequence: existing.row.queueSequence,
-                      state: existing.row.state,
-                      replayed: true,
-                    }),
-                  ),
-                  current,
-                ];
-              }
+          for (const id of ids.slice(0, limit)) {
+            const stored = current.submissions.get(id);
 
-              if (current.stoppedWorkers.has(request.threadId))
-                return [
-                  failure(AdmissionPolicyError.make({ reason: "refused", code: "worker-stopped" })),
-                  current,
-                ];
+            if (
+              stored === undefined ||
+              stored.row.threadId !== threadId ||
+              stored.row.state === "settled"
+            )
+              return yield* ThreadStoreError.make({
+                operation: "admission work",
+                message: "Active admission index is incomplete or corrupt",
+              });
+            const entry = admissionWork(stored.row);
+
+            entries.push(
+              stored.suspension === undefined
+                ? entry
+                : {
+                    ...entry,
+                    wait:
+                      stored.suspension.reason._tag === "WaitingForChild"
+                        ? ("child" as const)
+                        : ("approval" as const),
+                  },
+            );
+          }
+          const next = ids.length > limit ? ids[limit - 1] : undefined;
 
-              // A Thread's first admission fixes its worker origin before canonical materialization.
-              const first = [...current.submissions.values()].find(
-                ({ row }) => row.threadId === request.threadId,
-              );
+          return { entries, ...(next === undefined ? {} : { after: next }) };
+        }),
+    });
 
-              if (first !== undefined) {
-                const previous =
-                  first.row.workerAdmissionJson === undefined
-                    ? undefined
-                    : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
-                        first.row.workerAdmissionJson,
-                      );
+    const admissionFence = yield* SubmissionAdmissionFence;
 
-                if (
-                  !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
-                    previous?.origin,
-                    request.workerAdmission?.origin,
-                  )
-                )
-                  return [
-                    failure(
-                      AdmissionPolicyError.make({
-                        reason: "refused",
-                        code: "worker-origin-conflict",
-                      }),
-                    ),
-                    current,
-                  ];
-              }
-              // A memory policy and the ledger mutation share one synchronous critical section.
-              // An asynchronous policy cannot fence this Ref and therefore fails closed.
-              const checked = Effect.runSyncExitWith(services)(admissionFence.check(request));
+    const capabilities = Effect.succeed(LedgerCapabilities.make({ durability: "non-durable" }));
 
-              if (Exit.isFailure(checked)) {
-                return [{ _tag: "cause", cause: checked.cause }, current];
-              }
-              if (
-                request.admissionGroup !== undefined &&
-                [...current.submissions.values()].some(
-                  ({ row }) =>
-                    row.threadId === request.threadId &&
-                    row.admissionGroup === request.admissionGroup &&
-                    row.state !== "settled",
-                )
-              )
-                return [
-                  failure(
-                    AdmissionPolicyError.make({ reason: "occupied", code: "admission-group" }),
-                  ),
-                  current,
-                ];
-              if (current.submissions.size >= MAX_SUBMISSIONS) {
-                return [
-                  failure(
-                    ledgerError("admit", `In-memory submission limit ${MAX_SUBMISSIONS} exceeded`),
-                  ),
-                  current,
-                ];
-              }
+    const admit: SubmissionLedger["Service"]["admit"] = Effect.fnUntraced(function* (unvalidated) {
+      const request = yield* validate(AdmissionRequest, "admit", unvalidated);
 
-              const lane = current.lanes.get(request.threadId) ?? {
-                nextQueueSequence: 1,
-                producerEpoch: 0,
-              };
+      const workerAdmissionJson =
+        request.workerAdmission === undefined
+          ? undefined
+          : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(
+              request.workerAdmission,
+            ).pipe(
+              Effect.mapError(() => ledgerError("admit", "Invalid worker admission metadata")),
+            );
 
-              const mintCounter = current.mintCounter + 1;
-
-              const row: SubmissionRow = {
-                submissionId: decodeSubmissionId(`submission-memory-${mintCounter}`),
-                threadId: request.threadId,
-                queueSequence: decodeQueueSequence(lane.nextQueueSequence),
-                principal: request.principal,
-                idempotencyKey: request.idempotencyKey,
-                agentId: request.agentId,
-                agentDigests: request.agentDigests,
-                deploymentId: request.deploymentId,
-                inputPayload: request.inputPayload,
-                inputDigest: request.inputDigest,
-                receiptId: decodeReceiptId(`receipt-memory-${mintCounter}`),
-                state: "admitted",
-                settledOutcome: undefined,
-                createdAtMillis: nowMillis,
-                readyAtMillis: undefined,
-                parentLinkage: request.parentLinkage,
-                ...(workerAdmissionJson === undefined ? {} : { workerAdmissionJson }),
-                ...(messageAdmissionJson === undefined ? {} : { messageAdmissionJson }),
-                ...(request.admissionGroup === undefined
-                  ? {}
-                  : { admissionGroup: request.admissionGroup }),
-                ...(request.admissionFence === undefined
-                  ? {}
-                  : { admissionFence: request.admissionFence }),
-              };
+      const messageAdmissionJson =
+        request.messageAdmission === undefined
+          ? undefined
+          : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(
+              request.messageAdmission,
+            ).pipe(
+              Effect.mapError(() => ledgerError("admit", "Invalid message admission metadata")),
+            );
 
-              const submissions = new Map(current.submissions).set(row.submissionId, {
-                row,
-                ownership: undefined,
-                inputApplied: undefined,
-                reservation: undefined,
-                abortIntent: undefined,
-                joinedHostSubmissionId: undefined,
-                suspension: undefined,
-                unknownMark: undefined,
-                approvalDecisions: new Map<ToolCallId, ApprovalDecisionIntent>(),
-                unknownResolutions: new Map<ToolCallId, StoredUnknownResolution>(),
-              });
+      yield* journal
+        .checkThreadCapacity(request.threadId)
+        .pipe(Effect.mapError((cause) => ledgerError("admit", cause.message, cause)));
+      const nowMillis = yield* Clock.currentTimeMillis;
+      const retained = yield* Ref.get(state);
+
+      const identity = retained.admissionIndex.has(
+        admissionKey(request.threadId, request.principal, request.idempotencyKey),
+      )
+        ? Result.fail(ledgerError("admit", "Retained admission disappeared"))
+        : yield* Effect.result(mintIdentity("admit"));
+
+      const services = yield* Effect.context<never>();
+
+      const decision = yield* Ref.modify(
+        state,
+        (
+          current,
+        ): readonly [
+          (
+            | Decision<AdmissionResult, AdmissionConflict | AdmissionPolicyError | LedgerError>
+            | { readonly _tag: "cause"; readonly cause: Cause.Cause<AdmissionPolicyError> }
+          ),
+          LedgerState,
+        ] => {
+          const key = admissionKey(request.threadId, request.principal, request.idempotencyKey);
+          const existingId = current.admissionIndex.get(key);
 
-              const admissionIndex = new Map(current.admissionIndex).set(key, row.submissionId);
+          if (existingId !== undefined) {
+            const existing = current.submissions.get(existingId);
 
-              const lanes = new Map(current.lanes).set(request.threadId, {
-                nextQueueSequence: lane.nextQueueSequence + 1,
-                producerEpoch: lane.producerEpoch,
-              });
+            if (existing === undefined) {
+              return [
+                failure(ledgerError("admit", "Admission index references a missing Submission")),
+                current,
+              ];
+            }
+            // A replay must repeat the exact canonical input AND the exact parent linkage
+            // (or its absence): linkage is immutable lineage (spec §12 step 5, SUB-016).
+            if (
+              existing.row.inputDigest !== request.inputDigest ||
+              !sameParentLinkage(existing.row.parentLinkage, request.parentLinkage) ||
+              existing.row.admissionGroup !== request.admissionGroup ||
+              !Schema.toEquivalence(Schema.optional(WorkerAdmission))(
+                existing.row.workerAdmissionJson === undefined
+                  ? undefined
+                  : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
+                      existing.row.workerAdmissionJson,
+                    ),
+                request.workerAdmission,
+              ) ||
+              !Schema.toEquivalence(Schema.optional(InputMessage))(
+                existing.row.messageAdmissionJson === undefined
+                  ? undefined
+                  : Schema.decodeSync(Schema.fromJsonString(InputMessage))(
+                      existing.row.messageAdmissionJson,
+                    ),
+                request.messageAdmission,
+              ) ||
+              !Schema.toEquivalence(Schema.optional(Schema.Json))(
+                existing.row.admissionFence,
+                request.admissionFence,
+              )
+            ) {
+              return [
+                failure(
+                  AdmissionConflict.make({
+                    threadId: request.threadId,
+                    principal: request.principal,
+                    idempotencyKey: request.idempotencyKey,
+                    existingInputDigest: existing.row.inputDigest,
+                    attemptedInputDigest: request.inputDigest,
+                  }),
+                ),
+                current,
+              ];
+            }
+
+            return [
+              success(
+                AdmissionResult.make({
+                  submissionId: existing.row.submissionId,
+                  receiptId: existing.row.receiptId,
+                  queueSequence: existing.row.queueSequence,
+                  state: existing.row.state,
+                  replayed: true,
+                }),
+              ),
+              current,
+            ];
+          }
+
+          if (current.stoppedWorkers.has(request.threadId))
+            return [
+              failure(AdmissionPolicyError.make({ reason: "refused", code: "worker-stopped" })),
+              current,
+            ];
 
+          // A Thread's first admission fixes its worker origin before canonical materialization.
+          const first = threadRows(current, request.threadId).next().value;
+
+          if (first !== undefined) {
+            const previous =
+              first.row.workerAdmissionJson === undefined
+                ? undefined
+                : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
+                    first.row.workerAdmissionJson,
+                  );
+
+            if (
+              !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
+                previous?.origin,
+                request.workerAdmission?.origin,
+              )
+            )
               return [
-                success(
-                  AdmissionResult.make({
-                    submissionId: row.submissionId,
-                    receiptId: row.receiptId,
-                    queueSequence: row.queueSequence,
-                    state: row.state,
-                    replayed: false,
+                failure(
+                  AdmissionPolicyError.make({
+                    reason: "refused",
+                    code: "worker-origin-conflict",
                   }),
                 ),
-                {
-                  ...current,
-                  submissions,
-                  admissionIndex,
-                  lanes,
-                  mintCounter,
-                  latestByThread: new Map(current.latestByThread).set(
-                    request.threadId,
-                    row.submissionId,
-                  ),
-                  activeByThread: new Map(current.activeByThread).set(
-                    request.threadId,
-                    new Set([
-                      ...(current.activeByThread.get(request.threadId) ?? []),
-                      row.submissionId,
-                    ]),
-                  ),
-                },
+                current,
               ];
-            },
-          );
+          }
+          // A memory policy and the ledger mutation share one synchronous critical section.
+          // An asynchronous policy cannot fence this Ref and therefore fails closed.
+          const checked = Effect.runSyncExitWith(services)(admissionFence.check(request));
+
+          if (Exit.isFailure(checked)) {
+            return [{ _tag: "cause", cause: checked.cause }, current];
+          }
+          if (
+            request.admissionGroup !== undefined &&
+            Array.from(current.activeByThread.get(request.threadId) ?? []).some(
+              (id) => current.submissions.get(id)?.row.admissionGroup === request.admissionGroup,
+            )
+          )
+            return [
+              failure(AdmissionPolicyError.make({ reason: "occupied", code: "admission-group" })),
+              current,
+            ];
 
-          if (decision._tag === "failure") return yield* decision.error;
-          if (decision._tag === "cause") {
-            for (const reason of decision.cause.reasons) {
-              if (Cause.isDieReason(reason) && Cause.isAsyncFiberError(reason.defect)) {
-                yield* Fiber.interrupt(reason.defect.fiber);
+          // A concurrent matching acceptance still wins over a failed fresh allocation.
+          if (Result.isFailure(identity)) return [failure(identity.failure), current];
 
-                return yield* AdmissionPolicyError.make({
-                  reason: "unavailable",
-                  code: "synchronous-memory-policy-required",
-                });
-              }
-            }
+          const lane = current.lanes.get(request.threadId) ?? {
+            nextQueueSequence: 1,
+          };
+
+          const freshAdmissionSequence = current.freshAdmissionSequence + 1;
+
+          if (!Number.isSafeInteger(freshAdmissionSequence))
+            return [
+              failure(ledgerError("admit", "Fresh admission sequence is exhausted")),
+              current,
+            ];
+
+          // Native work scans compare Submission identities lexically.
+          const orderedIdentity = `${String(freshAdmissionSequence).padStart(16, "0")}-${identity.success}`;
+          const submissionId = decodeSubmissionId(`submission-memory-${orderedIdentity}`);
+          const receiptId = decodeReceiptId(`receipt-memory-${orderedIdentity}`);
+
+          if (current.submissions.has(submissionId) || current.receipts.has(receiptId))
+            return [
+              failure(ledgerError("admit", "Fresh admission identity already exists")),
+              current,
+            ];
+
+          const row: SubmissionRow = {
+            submissionId,
+            threadId: request.threadId,
+            queueSequence: decodeQueueSequence(lane.nextQueueSequence),
+            principal: request.principal,
+            idempotencyKey: request.idempotencyKey,
+            agentId: request.agentId,
+            agentDigests: request.agentDigests,
+            deploymentId: request.deploymentId,
+            inputPayload: request.inputPayload,
+            inputDigest: request.inputDigest,
+            receiptId,
+            state: "admitted",
+            settledOutcome: undefined,
+            createdAtMillis: nowMillis,
+            readyAtMillis: undefined,
+            parentLinkage: request.parentLinkage,
+            ...(workerAdmissionJson === undefined ? {} : { workerAdmissionJson }),
+            ...(messageAdmissionJson === undefined ? {} : { messageAdmissionJson }),
+            ...(request.admissionGroup === undefined
+              ? {}
+              : { admissionGroup: request.admissionGroup }),
+            ...(request.admissionFence === undefined
+              ? {}
+              : { admissionFence: request.admissionFence }),
+          };
+
+          const stored: StoredSubmission = {
+            row,
+            inputApplied: undefined,
+            finalization: undefined,
+            abortIntent: undefined,
+            joinedHostSubmissionId: undefined,
+            suspension: undefined,
+            unknownMark: undefined,
+            approvalDecisions: new Map<ToolCallId, ApprovalDecisionIntent>(),
+            unknownResolutions: new Map<string, StoredUnknownResolution>(),
+          };
+
+          if (!admissionFitsTransfer(request.threadId, toAdmission(row)))
+            return [failure(transferCapacityError("admit")), current];
+
+          journal.initializeWork(request.threadId);
+          const admissionIndex = current.admissionIndex;
+
+          const lanes = current.lanes.set(request.threadId, {
+            nextQueueSequence: lane.nextQueueSequence + 1,
+          });
+
+          return [
+            success(
+              AdmissionResult.make({
+                submissionId: row.submissionId,
+                receiptId: row.receiptId,
+                queueSequence: row.queueSequence,
+                state: row.state,
+                replayed: false,
+              }),
+            ),
+            {
+              ...withSubmission(current, stored),
+              admissionIndex,
+              lanes,
+              freshAdmissionSequence,
+            },
+          ];
+        },
+      );
 
-            return yield* Effect.failCause(decision.cause);
+      if (decision._tag === "failure") return yield* decision.error;
+      if (decision._tag === "cause") {
+        for (const reason of decision.cause.reasons) {
+          if (Cause.isDieReason(reason) && Cause.isAsyncFiberError(reason.defect)) {
+            yield* Fiber.interrupt(reason.defect.fiber);
+
+            return yield* AdmissionPolicyError.make({
+              reason: "unavailable",
+              code: "synchronous-memory-policy-required",
+            });
           }
+        }
 
-          return decision.value;
-        }),
-      Effect.uninterruptible,
-    );
+        return yield* Effect.failCause(decision.cause);
+      }
 
-    const markReady: SubmissionLedger["Service"]["markReady"] = Effect.fn(
-      "MemorySubmissionLedger.markReady",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+      return decision.value;
+    }, Effect.uninterruptible);
+
+    const markReady: SubmissionLedger["Service"]["markReady"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(MarkReadyRequest, "markReady", unvalidated);
         const nowMillis = yield* Clock.currentTimeMillis;
 
@@ -766,13 +1075,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         );
 
         if (decision._tag === "failure") return yield* decision.error;
-      }),
+      },
     );
 
-    const lookup: SubmissionLedger["Service"]["lookup"] = Effect.fn(
-      "MemorySubmissionLedger.lookup",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const lookup: SubmissionLedger["Service"]["lookup"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(SubmissionLookup, "lookup", unvalidated);
         const current = yield* Ref.get(state);
 
@@ -787,13 +1094,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
           submissionId === undefined ? undefined : current.submissions.get(submissionId);
 
         return stored === undefined ? Option.none() : Option.some(toSnapshot(stored.row));
-      }),
+      },
     );
 
-    const resolveAdmission: SubmissionLedger["Service"]["resolveAdmission"] = Effect.fn(
-      "MemorySubmissionLedger.resolveAdmission",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const resolveAdmission: SubmissionLedger["Service"]["resolveAdmission"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(SubmissionLookupByKey, "resolveAdmission", unvalidated);
 
         // Test-only fault seam: lets suites exercise the Indeterminate classification that a
@@ -817,210 +1122,81 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         return stored === undefined
           ? AdmissionNotAdmitted.make()
           : AdmissionAdmitted.make({ submission: toSnapshot(stored.row) });
-      }),
+      },
     );
 
-    const claim: SubmissionLedger["Service"]["claim"] = Effect.fn("MemorySubmissionLedger.claim")(
-      (unvalidated) =>
-        Effect.gen(function* () {
-          const request = yield* validate(ClaimRequest, "claim", unvalidated);
-          const nowMillis = yield* Clock.currentTimeMillis;
-
-          const decision = yield* Ref.modify(
-            state,
-            (current): readonly [Decision<Option.Option<Claim>, LedgerError>, LedgerState] => {
-              for (const stored of current.submissions.values()) {
-                if (
-                  stored.row.threadId === request.threadId &&
-                  stored.ownership !== undefined &&
-                  stored.ownership.leaseExpiresAtMillis > nowMillis
-                ) {
-                  return [success(Option.none()), current];
-                }
-              }
-              let head = findHead(current, request.threadId);
+    const selectHead: SubmissionLedger["Service"]["selectHead"] = Effect.fn(
+      "MemorySubmissionLedger.selectHead",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(ClaimRequest, "claim", unvalidated);
+        const identity = yield* mintIdentity("claim");
 
-              if (request.handoff !== undefined) {
-                const handoff = request.handoff;
+        const decision = yield* Ref.modify(
+          state,
+          (current): readonly [Decision<Option.Option<Claim>, LedgerError>, LedgerState] => {
+            if (journal.owner.hasOwner(request.threadId)) return [success(Option.none()), current];
+            let head = findHead(current, request.threadId);
 
-                if (current.lanes.get(request.threadId)?.producerEpoch !== handoff.producerEpoch)
-                  return [success(Option.none()), current];
+            if (request.handoff !== undefined) {
+              const handoff = request.handoff;
 
-                const candidates = [...current.submissions.values()]
-                  .filter(
-                    (entry) =>
-                      entry.row.threadId === request.threadId &&
-                      entry.row.state !== "settled" &&
-                      !(entry.row.state === "unknown" && entry.abortIntent === undefined),
-                  )
-                  .sort((a, b) => a.row.queueSequence - b.row.queueSequence);
+              const candidates = Array.from(
+                current.activeByThread.get(request.threadId) ?? [],
+                (id) => current.submissions.get(id),
+              )
+                .filter(
+                  (entry): entry is StoredSubmission =>
+                    entry !== undefined &&
+                    !(entry.row.state === "unknown" && entry.abortIntent === undefined),
+                )
+                .sort((a, b) => a.row.queueSequence - b.row.queueSequence);
 
-                for (const candidate of candidates) {
-                  if (candidate.row.submissionId === handoff.submissionId) {
-                    head = candidate;
-                    break;
-                  }
-                  if (
-                    !handoff.deferredSubmissionIds.includes(candidate.row.submissionId) ||
-                    candidate.row.state !== "input-applied" ||
-                    candidate.abortIntent !== undefined
-                  )
-                    return [success(Option.none()), current];
+              for (const candidate of candidates) {
+                if (candidate.row.submissionId === handoff.submissionId) {
+                  head = candidate;
+                  break;
                 }
                 if (
-                  head?.row.submissionId !== handoff.submissionId ||
-                  (head.row.state !== "ready" &&
-                    head.row.state !== "running" &&
-                    head.row.state !== "input-applied")
+                  !handoff.deferredSubmissionIds.includes(candidate.row.submissionId) ||
+                  candidate.row.state !== "input-applied" ||
+                  candidate.abortIntent !== undefined
                 )
                   return [success(Option.none()), current];
               }
+              if (
+                head?.row.submissionId !== handoff.submissionId ||
+                (head.row.state !== "ready" && head.row.state !== "input-applied")
+              )
+                return [success(Option.none()), current];
+            }
 
-              if (head === undefined) return [success(Option.none()), current];
-              if (BLOCKED_HEAD_STATES.has(head.row.state)) return [success(Option.none()), current];
-              const lane = current.lanes.get(request.threadId);
+            if (head === undefined) return [success(Option.none()), current];
+            if (BLOCKED_HEAD_STATES.has(head.row.state)) return [success(Option.none()), current];
 
-              if (lane === undefined) {
-                return [
-                  failure(ledgerError("claim", "Claimable head without a Thread lane")),
-                  current,
-                ];
-              }
-              const producerEpoch = decodeProducerEpoch(lane.producerEpoch + 1);
-              const mintCounter = current.mintCounter + 1;
-
-              const ownership: StoredOwnership = {
-                attemptId: decodeAttemptId(`attempt-memory-${mintCounter}`),
-                ownershipToken: decodeOwnershipToken(`ownership-memory-${mintCounter}`),
-                producerEpoch,
-                ownerProducerId: request.producerId,
-                leaseExpiresAtMillis: nowMillis + leaseMillis,
-              };
+            return [
+              success(
+                Option.some(
+                  Claim.make({
+                    submissionId: head.row.submissionId,
+                    attemptId: decodeAttemptId(`attempt-memory-${identity}`),
+                    inputPayload: head.row.inputPayload,
+                  }),
+                ),
+              ),
+              current,
+            ];
+          },
+        );
 
-              const row: SubmissionRow =
-                head.row.state === "ready" ? { ...head.row, state: "running" } : head.row;
+        if (decision._tag === "failure") return yield* decision.error;
 
-              const next = withSubmission(current, { ...head, row, ownership });
+        return decision.value;
+      }),
+    );
 
-              const lanes = new Map(next.lanes).set(request.threadId, {
-                nextQueueSequence: lane.nextQueueSequence,
-                producerEpoch: lane.producerEpoch + 1,
-              });
-
-              return [
-                success(
-                  Option.some(
-                    Claim.make({
-                      submissionId: row.submissionId,
-                      attemptId: ownership.attemptId,
-                      ownershipToken: ownership.ownershipToken,
-                      producerEpoch,
-                      leaseExpiresAt: utc(ownership.leaseExpiresAtMillis),
-                      inputPayload: row.inputPayload,
-                    }),
-                  ),
-                ),
-                { ...next, lanes, mintCounter },
-              ];
-            },
-          );
-
-          if (decision._tag === "failure") return yield* decision.error;
-
-          return decision.value;
-        }),
-    );
-
-    const renewOwnership: SubmissionLedger["Service"]["renewOwnership"] = Effect.fn(
-      "MemorySubmissionLedger.renewOwnership",
-    )((unvalidated) =>
-      Effect.gen(function* () {
-        const request = yield* validate(RenewOwnershipRequest, "renewOwnership", unvalidated);
-        const nowMillis = yield* Clock.currentTimeMillis;
-
-        const decision = yield* Ref.modify(
-          state,
-          (
-            current,
-          ): readonly [Decision<OwnershipRenewal, OwnershipLost | LedgerError>, LedgerState] => {
-            const stored = current.submissions.get(request.submissionId);
-
-            if (stored === undefined) {
-              return [
-                failure(
-                  ledgerError("renewOwnership", `Unknown Submission ${request.submissionId}`),
-                ),
-                current,
-              ];
-            }
-            if (
-              stored.ownership === undefined ||
-              !ownsLane(current, stored, request.ownershipToken)
-            ) {
-              return [failure(ownershipLost(current, stored)), current];
-            }
-
-            const ownership: StoredOwnership = {
-              ...stored.ownership,
-              leaseExpiresAtMillis: nowMillis + leaseMillis,
-            };
-
-            return [
-              success(
-                OwnershipRenewal.make({
-                  ownershipToken: ownership.ownershipToken,
-                  leaseExpiresAt: utc(ownership.leaseExpiresAtMillis),
-                }),
-              ),
-              withSubmission(current, { ...stored, ownership }),
-            ];
-          },
-        );
-
-        if (decision._tag === "failure") return yield* decision.error;
-
-        return decision.value;
-      }),
-    );
-
-    const releaseOwnership: SubmissionLedger["Service"]["releaseOwnership"] = Effect.fn(
-      "MemorySubmissionLedger.releaseOwnership",
-    )((unvalidated) =>
-      Effect.gen(function* () {
-        const request = yield* validate(ReleaseOwnershipRequest, "releaseOwnership", unvalidated);
-
-        const decision = yield* Ref.modify(
-          state,
-          (current): readonly [Decision<void, OwnershipLost | LedgerError>, LedgerState] => {
-            const stored = current.submissions.get(request.submissionId);
-
-            if (stored === undefined) {
-              return [
-                failure(
-                  ledgerError("releaseOwnership", `Unknown Submission ${request.submissionId}`),
-                ),
-                current,
-              ];
-            }
-            if (!ownsLane(current, stored, request.ownershipToken)) {
-              return [failure(ownershipLost(current, stored)), current];
-            }
-
-            return [
-              success(undefined),
-              withSubmission(current, { ...stored, ownership: undefined }),
-            ];
-          },
-        );
-
-        if (decision._tag === "failure") return yield* decision.error;
-      }),
-    );
-
-    const markInputApplied: SubmissionLedger["Service"]["markInputApplied"] = Effect.fn(
-      "MemorySubmissionLedger.markInputApplied",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const markInputApplied: SubmissionLedger["Service"]["markInputApplied"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(MarkInputAppliedRequest, "markInputApplied", unvalidated);
 
         const decision = yield* Ref.modify(
@@ -1036,8 +1212,8 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            if (!ownsLane(current, stored, request.ownershipToken)) {
-              return [failure(ownershipLost(current, stored)), current];
+            if (!journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId)) {
+              return [failure(ownershipLost(stored)), current];
             }
 
             if (stored.inputApplied !== undefined) {
@@ -1077,131 +1253,134 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         );
 
         if (decision._tag === "failure") return yield* decision.error;
-      }),
+      },
     );
 
-    const reserveSettlement: SubmissionLedger["Service"]["reserveSettlement"] = Effect.fn(
-      "MemorySubmissionLedger.reserveSettlement",
-    )((unvalidated) =>
-      Effect.gen(function* () {
-        const request = yield* validate(SettlementReservation, "reserveSettlement", unvalidated);
+    const canonicalSettlement = Effect.fnUntraced(function* (submission: SubmissionRow) {
+      const record = yield* journal.record(
+        submission.threadId,
+        submissionSettlementRecordId(submission.submissionId),
+      );
 
-        const decision = yield* Ref.modify(
-          state,
-          (
-            current,
-          ): readonly [
-            Decision<ReservedSettlement, SettlementConflict | OwnershipLost | LedgerError>,
-            LedgerState,
-          ] => {
-            const stored = current.submissions.get(request.submissionId);
+      if (record === undefined) return undefined;
+      const settlement = yield* validateCanonicalSettlement(record, submission);
 
-            if (stored === undefined) {
-              return [
-                failure(
-                  ledgerError("reserveSettlement", `Unknown Submission ${request.submissionId}`),
-                ),
-                current,
-              ];
-            }
+      return { record, settlement };
+    });
 
-            // A `joined` Submission settles WITH its host (plan §2.5) and its lane is never
-            // worker-claimable, so no ownership token can exist for it: the recorded host
-            // linkage authorizes the reservation and the presented token is not consulted.
-            const joinedSettlement =
-              stored.row.state === "joined" && stored.joinedHostSubmissionId !== undefined;
+    const publish: SettlementPublisher["Service"]["publish"] = Effect.fn(
+      "MemorySettlementPublisher.publish",
+    )(function* (input) {
+      const { request, record, settlement } = yield* validatePublication(input);
+      const prepared = yield* journal.prepareAppend(request.append);
+
+      return yield* journal.owner.withProgress(
+        request.append.threadId,
+        journal.withMutation(
+          Effect.gen(function* () {
+            const current = yield* Ref.get(state);
+            const stored = current.submissions.get(request.submissionId);
 
-            // P7 §7(c): an aborted, never-claimed, still-queued Submission likewise has no
-            // live ownership to fence against — its durable abort intent authorizes exactly
-            // its ABORTED settlement (`terminalizing` is the same pass's crash replay). Every
-            // other reservation stays fenced by the target lane's live ownership.
-            const queuedAbortSettlement =
-              request.outcome === "aborted" &&
-              stored.abortIntent !== undefined &&
-              stored.ownership === undefined &&
-              (stored.row.state === "ready" || stored.row.state === "terminalizing");
+            if (stored === undefined)
+              return yield* ledgerError("publish settlement", "Unknown Submission");
+            if (stored.row.threadId !== prepared.request.threadId)
+              return yield* ledgerError("publish settlement", "Publication targets another Thread");
+            yield* validateCanonicalSettlement(record, stored.row);
+            const existing = yield* canonicalSettlement(stored.row);
+            const tail = yield* journal.tail(stored.row.threadId);
+
+            // Replay still requires authority: finalization releases Owned tokens, while
+            // retained host linkage or abort intent can authorize tokenless settled replay.
+            switch (request.authority._tag) {
+              case "Owned":
+                if (!journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId))
+                  return yield* ownershipLost(stored);
+                yield* validateCanonicalSettlement(record, {
+                  submissionId: request.submissionId,
+                  receiptId: stored.row.receiptId,
+                  ...(settlement.outcome === "aborted" && settlement.runId === undefined
+                    ? {}
+                    : { runId: runIdForSubmission(request.submissionId) }),
+                });
+                break;
+              case "Joined": {
+                if (
+                  (stored.row.state !== "joined" &&
+                    !(stored.row.state === "settled" && existing !== undefined)) ||
+                  stored.joinedHostSubmissionId !== request.authority.hostSubmissionId
+                )
+                  return yield* ledgerError(
+                    "publish settlement",
+                    "Submission is not joined to this host",
+                  );
+                const host = current.submissions.get(request.authority.hostSubmissionId);
 
-            if (
-              !joinedSettlement &&
-              !queuedAbortSettlement &&
-              !ownsLane(current, stored, request.ownershipToken)
-            ) {
-              return [failure(ownershipLost(current, stored)), current];
-            }
-            const existing = stored.reservation;
+                const canonicalHost =
+                  host === undefined || host.row.threadId !== stored.row.threadId
+                    ? undefined
+                    : yield* canonicalSettlement(host.row);
 
-            if (existing !== undefined) {
-              if (
-                existing.settlementId !== request.settlementId ||
-                existing.outcome !== request.outcome ||
-                existing.recordDigest !== request.recordDigest
-              ) {
-                return [
-                  failure(
-                    SettlementConflict.make({
-                      submissionId: request.submissionId,
-                      existingOutcome: existing.outcome,
-                    }),
-                  ),
-                  current,
-                ];
+                if (canonicalHost === undefined)
+                  return yield* ledgerError(
+                    "publish settlement",
+                    "Joined host has no canonical settlement",
+                  );
+                yield* validateJoinedSettlement(settlement, canonicalHost.settlement);
+                break;
               }
-
-              return [
-                success(
-                  ReservedSettlement.make({
-                    submissionId: request.submissionId,
-                    settlementId: existing.settlementId,
-                    outcome: existing.outcome,
-                    record: existing.record,
-                    recordDigest: existing.recordDigest,
-                    replayed: true,
-                  }),
-                ),
-                current,
-              ];
-            }
-
-            const reservation: StoredReservation = {
-              settlementId: request.settlementId,
-              outcome: request.outcome,
-              record: request.record,
-              recordDigest: request.recordDigest,
-              finalizedAtMillis: undefined,
-            };
-
-            const row: SubmissionRow =
-              STATE_RANK[stored.row.state] < STATE_RANK.terminalizing
-                ? { ...stored.row, state: "terminalizing" }
-                : stored.row;
-
-            return [
-              success(
-                ReservedSettlement.make({
+              case "QueuedAbort":
+                if (
+                  (stored.row.state !== "ready" &&
+                    !(stored.row.state === "settled" && existing !== undefined)) ||
+                  stored.abortIntent === undefined ||
+                  journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId) ||
+                  settlement.outcome !== "aborted"
+                )
+                  return yield* ledgerError(
+                    "publish settlement",
+                    "Submission is not an unclaimed queued abort",
+                  );
+                yield* validateCanonicalSettlement(record, {
                   submissionId: request.submissionId,
-                  settlementId: reservation.settlementId,
-                  outcome: reservation.outcome,
-                  record: reservation.record,
-                  recordDigest: reservation.recordDigest,
-                  replayed: false,
-                }),
-              ),
-              withSubmission(current, { ...stored, row, reservation }),
-            ];
-          },
-        );
-
-        if (decision._tag === "failure") return yield* decision.error;
+                  receiptId: stored.row.receiptId,
+                  runId: undefined,
+                });
+                break;
+            }
+            if (existing !== undefined)
+              return SettlementPublicationResult.make({
+                record: existing.record,
+                tailSequence: tail.tailSequence,
+                replayed: true,
+              });
+            if (stored.row.state === "settled")
+              return yield* ledgerError(
+                "publish settlement",
+                "Finalized Submission has no canonical settlement",
+              );
+            const appended = yield* journal.appendPrepared(prepared);
 
-        return decision.value;
-      }),
-    );
+            return SettlementPublicationResult.make({
+              record,
+              tailSequence: appended.lastSequence,
+              replayed: false,
+            });
+          }),
+        ),
+      );
+    });
 
     const finalizeSettlement: SubmissionLedger["Service"]["finalizeSettlement"] = Effect.fn(
       "MemorySubmissionLedger.finalizeSettlement",
     )((unvalidated) =>
       Effect.gen(function* () {
         const request = yield* validate(SettlementFinalization, "finalizeSettlement", unvalidated);
+        const before = (yield* Ref.get(state)).submissions.get(request.submissionId);
+        const canonical = before === undefined ? undefined : yield* canonicalSettlement(before.row);
+
+        if (canonical === undefined)
+          return yield* ledgerError("finalizeSettlement", "Submission has no canonical settlement");
+        const { record, settlement } = canonical;
         const nowMillis = yield* Clock.currentTimeMillis;
 
         const decision = yield* Ref.modify(
@@ -1219,63 +1398,60 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            const reservation = stored.reservation;
-
-            if (reservation === undefined) {
-              return [
-                failure(
-                  ledgerError(
-                    "finalizeSettlement",
-                    `No settlement reservation for Submission ${request.submissionId}`,
-                  ),
-                ),
-                current,
-              ];
-            }
-            const settlementFailure = settlementFailureFromRecord(reservation.record);
+            const settlementFailure = settlementFailureFromRecord(record);
 
-            if ((reservation.outcome === "failed") !== (settlementFailure !== undefined)) {
-              return [
-                failure(
-                  ledgerError(
-                    "finalizeSettlement",
-                    `Settlement reservation for Submission ${request.submissionId} has contradictory failure evidence`,
-                  ),
-                ),
-                current,
-              ];
-            }
-            if (reservation.settlementId !== request.settlementId) {
+            if (settlement.settlementId !== request.settlementId) {
               return [
                 failure(
                   SettlementConflict.make({
                     submissionId: request.submissionId,
-                    existingOutcome: reservation.outcome,
+                    existingOutcome: settlement.outcome,
                   }),
                 ),
                 current,
               ];
             }
-            if (reservation.finalizedAtMillis !== undefined) {
+            if (stored.finalization !== undefined) {
+              if (
+                stored.row.state !== "settled" ||
+                stored.row.settledOutcome !== settlement.outcome ||
+                stored.finalization.settlementId !== request.settlementId ||
+                stored.finalization.recordId !== record.recordId
+              )
+                return [
+                  failure(
+                    ledgerError(
+                      "finalizeSettlement",
+                      "Finalized identity disagrees with canonical settlement",
+                    ),
+                  ),
+                  current,
+                ];
+
               return [
                 success(
                   Settlement.make({
                     submissionId: stored.row.submissionId,
-                    settlementId: reservation.settlementId,
+                    settlementId: settlement.settlementId,
                     receiptId: stored.row.receiptId,
-                    outcome: reservation.outcome,
+                    outcome: settlement.outcome,
                     ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
-                    settledAt: utc(reservation.finalizedAtMillis),
+                    settledAt: utc(stored.finalization.finalizedAtMillis),
                   }),
                 ),
                 current,
               ];
             }
+            if (stored.row.state === "settled")
+              return [
+                failure(ledgerError("finalizeSettlement", "Finalized timestamp is missing")),
+                current,
+              ];
 
             const terminal =
               stored.row.workerAdmissionJson === undefined
                 ? undefined
-                : workerTerminalFromRecord(toSnapshot(stored.row), reservation.record);
+                : workerTerminalFromRecord(toSnapshot(stored.row), record);
 
             const latestId = current.latestByThread.get(stored.row.threadId);
             const latest = latestId === undefined ? undefined : current.submissions.get(latestId);
@@ -1296,52 +1472,66 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               !pendingNewer &&
               !current.stoppedWorkers.has(stored.row.threadId)
             ) {
-              const submissions = new Map(current.submissions);
+              const submissions = current.submissions;
 
-              for (const id of current.activeByThread.get(stored.row.threadId) ?? []) {
-                const other = submissions.get(id);
+              if (!transferPageFits(stored.row.threadId))
+                return [failure(transferCapacityError("finalizeSettlement")), current];
 
-                if (other === undefined) continue;
-                if (
-                  id !== stored.row.submissionId &&
-                  !(
-                    other.joinedHostSubmissionId === stored.row.submissionId &&
-                    other.inputApplied !== undefined
-                  ) &&
-                  other.abortIntent === undefined
-                ) {
-                  submissions.set(id, {
-                    ...other,
-                    abortIntent: AbortIntent.make({
+              // Validate every fresh fact before mutating, without retaining a second active set.
+              for (const apply of [false, true]) {
+                for (const id of current.activeByThread.get(stored.row.threadId) ?? []) {
+                  const other = submissions.get(id);
+
+                  if (other === undefined) continue;
+                  if (
+                    id !== stored.row.submissionId &&
+                    !(
+                      other.joinedHostSubmissionId === stored.row.submissionId &&
+                      other.inputApplied !== undefined
+                    ) &&
+                    other.abortIntent === undefined
+                  ) {
+                    const abortIntent = AbortIntent.make({
                       submissionId: id,
                       author: stored.row.principal,
                       reason: `Worker assignment ${terminal}`,
                       requestedAt: utc(nowMillis),
-                    }),
-                  });
+                    });
+
+                    if (!apply && !abortFitsTransfer(other.row.threadId, abortIntent))
+                      return [failure(transferCapacityError("finalizeSettlement")), current];
+                    if (apply)
+                      withSubmission(current, {
+                        ...other,
+                        abortIntent,
+                      });
+                  }
                 }
               }
               sealed = {
                 ...current,
                 submissions,
-                stoppedWorkers: new Map(current.stoppedWorkers).set(stored.row.threadId, terminal),
+                stoppedWorkers: current.stoppedWorkers.set(stored.row.threadId, terminal),
               };
             }
 
             const next = withSubmission(sealed, {
               ...stored,
-              row: { ...stored.row, state: "settled", settledOutcome: reservation.outcome },
-              ownership: undefined,
-              reservation: { ...reservation, finalizedAtMillis: nowMillis },
+              row: { ...stored.row, state: "settled", settledOutcome: settlement.outcome },
+              finalization: {
+                settlementId: settlement.settlementId,
+                recordId: record.recordId,
+                finalizedAtMillis: nowMillis,
+              },
             });
 
             return [
               success(
                 Settlement.make({
                   submissionId: stored.row.submissionId,
-                  settlementId: reservation.settlementId,
+                  settlementId: settlement.settlementId,
                   receiptId: stored.row.receiptId,
-                  outcome: reservation.outcome,
+                  outcome: settlement.outcome,
                   ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
                   settledAt: utc(nowMillis),
                 }),
@@ -1353,13 +1543,14 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
 
         if (decision._tag === "failure") return yield* decision.error;
 
+        if (before !== undefined)
+          journal.owner.closeSubmission(before.row.threadId, request.submissionId);
+
         return decision.value;
       }),
     );
 
-    const inspectWorker = Effect.fn("MemorySubmissionLedger.inspectWorker")(function* (
-      threadId: ThreadId,
-    ) {
+    const inspectWorker = Effect.fnUntraced(function* (threadId: ThreadId) {
       const current = yield* Ref.get(state);
       const latestId = current.latestByThread.get(threadId);
       const latest = latestId === undefined ? undefined : current.submissions.get(latestId);
@@ -1382,50 +1573,62 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
       });
     });
 
-    const stopWorker = Effect.fn("MemorySubmissionLedger.stopWorker")(function* (
-      unvalidated: WorkerStopCommand,
-    ) {
+    const stopWorker = Effect.fnUntraced(function* (unvalidated: WorkerStopCommand) {
       const request = yield* validate(WorkerStopCommand, "stopWorker", unvalidated);
       const now = yield* Clock.currentTimeMillis;
 
-      return yield* Ref.modify(state, (current) => {
-        const submissions = new Map(current.submissions);
-        let owned = 0;
+      const decision = yield* Ref.modify(
+        state,
+        (current): readonly [Decision<number, LedgerError>, LedgerState] => {
+          const submissions = current.submissions;
+          let owned = 0;
+
+          if (!current.stoppedWorkers.has(request.threadId) && !transferPageFits(request.threadId))
+            return [failure(transferCapacityError("stopWorker")), current];
+
+          // Both passes run in this Ref.modify; no mutation precedes complete validation.
+          for (const apply of [false, true]) {
+            for (const id of current.activeByThread.get(request.threadId) ?? []) {
+              const stored = submissions.get(id);
+
+              if (stored === undefined) continue;
+              if (!apply && journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId))
+                owned++;
+              if (stored.abortIntent === undefined) {
+                const abortIntent = AbortIntent.make({
+                  submissionId: id,
+                  author: request.author,
+                  reason: "Worker owner stopped the worker",
+                  requestedAt: utc(now),
+                });
+
+                if (!apply && !abortFitsTransfer(stored.row.threadId, abortIntent))
+                  return [failure(transferCapacityError("stopWorker")), current];
+                if (apply) withSubmission(current, { ...stored, abortIntent });
+              }
+            }
+          }
 
-        for (const id of current.activeByThread.get(request.threadId) ?? []) {
-          const stored = submissions.get(id);
+          return [
+            success(owned),
+            {
+              ...current,
+              submissions,
+              stoppedWorkers: current.stoppedWorkers.has(request.threadId)
+                ? current.stoppedWorkers
+                : current.stoppedWorkers.set(request.threadId, undefined),
+            },
+          ] as const;
+        },
+      );
 
-          if (stored === undefined) continue;
-          if (stored.ownership !== undefined) owned++;
-          if (stored.abortIntent === undefined)
-            submissions.set(id, {
-              ...stored,
-              abortIntent: AbortIntent.make({
-                submissionId: id,
-                author: request.author,
-                reason: "Worker owner stopped the worker",
-                requestedAt: utc(now),
-              }),
-            });
-        }
+      if (decision._tag === "failure") return yield* decision.error;
 
-        return [
-          owned,
-          {
-            ...current,
-            submissions,
-            stoppedWorkers: current.stoppedWorkers.has(request.threadId)
-              ? current.stoppedWorkers
-              : new Map(current.stoppedWorkers).set(request.threadId, undefined),
-          },
-        ] as const;
-      });
+      return decision.value;
     });
 
-    const requestAbort: SubmissionLedger["Service"]["requestAbort"] = Effect.fn(
-      "MemorySubmissionLedger.requestAbort",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const requestAbort: SubmissionLedger["Service"]["requestAbort"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(AbortCommand, "requestAbort", unvalidated);
         const nowMillis = yield* Clock.currentTimeMillis;
 
@@ -1503,6 +1706,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               requestedAt: utc(nowMillis),
             });
 
+            if (!abortFitsTransfer(stored.row.threadId, intent))
+              return [failure(transferCapacityError("requestAbort")), current];
+
             return [success(intent), withSubmission(current, { ...stored, abortIntent: intent })];
           },
         );
@@ -1510,14 +1716,25 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         if (decision._tag === "failure") return yield* decision.error;
 
         return decision.value;
-      }),
+      },
     );
 
-    const claimJoining: SubmissionLedger["Service"]["claimJoining"] = Effect.fn(
-      "MemorySubmissionLedger.claimJoining",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const claimJoining: SubmissionLedger["Service"]["claimJoining"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(ClaimJoiningRequest, "claimJoining", unvalidated);
+        const published = new Map<SubmissionId, Settlement["outcome"]>();
+
+        const before = yield* Ref.get(state);
+
+        for (const id of before.activeByThread.get(request.threadId) ?? []) {
+          const stored = before.submissions.get(id);
+
+          if (stored === undefined || stored.row.state !== "ready") continue;
+          const canonical = yield* canonicalSettlement(stored.row);
+
+          if (canonical !== undefined)
+            published.set(stored.row.submissionId, canonical.settlement.outcome);
+        }
 
         const decision = yield* Ref.modify(
           state,
@@ -1550,20 +1767,14 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            if (!ownsLane(current, host, request.ownershipToken)) {
-              return [failure(ownershipLost(current, host)), current];
+            if (!journal.owner.hasOwner(host.row.threadId, host.row.submissionId)) {
+              return [failure(ownershipLost(host)), current];
             }
 
-            const later = [...current.submissions.values()]
-              .filter(
-                (stored) =>
-                  stored.row.threadId === request.threadId &&
-                  stored.row.queueSequence > host.row.queueSequence,
-              )
-              .sort((left, right) => left.row.queueSequence - right.row.queueSequence);
+            const later = threadRows(current, request.threadId, host.row.queueSequence);
 
             const claims: Array<JoiningClaim> = [];
-            const submissions = new Map(current.submissions);
+            const submissions = current.submissions;
 
             for (const stored of later) {
               if (claims.length >= request.maxCount) break;
@@ -1584,7 +1795,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               // Any other non-ready row — an admitted-not-ready gap in particular — breaks the
               // contiguous ready prefix (plan §2.5); later ready work stays queued (DUR-004).
               if (stored.row.state !== "ready") break;
-              submissions.set(stored.row.submissionId, {
+              const terminal = published.get(stored.row.submissionId);
+
+              if (terminal === "aborted") continue;
+              if (terminal !== undefined) break;
+              withSubmission(current, {
                 ...stored,
                 row: { ...stored.row, state: "joining" },
                 joinedHostSubmissionId: request.hostSubmissionId,
@@ -1605,13 +1820,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         if (decision._tag === "failure") return yield* decision.error;
 
         return decision.value;
-      }),
+      },
     );
 
-    const markJoined: SubmissionLedger["Service"]["markJoined"] = Effect.fn(
-      "MemorySubmissionLedger.markJoined",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const markJoined: SubmissionLedger["Service"]["markJoined"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(MarkJoinedRequest, "markJoined", unvalidated);
 
         const decision = yield* Ref.modify(
@@ -1651,8 +1864,8 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             }
             // The lane is host-owned: the presented token must own the HOST's ownership period,
             // which also lets a later host Attempt repair a lost marker from history (DUR-016).
-            if (!ownsLane(current, host, request.ownershipToken)) {
-              return [failure(ownershipLost(current, host)), current];
+            if (!journal.owner.hasOwner(host.row.threadId, host.row.submissionId)) {
+              return [failure(ownershipLost(host)), current];
             }
             if (stored.inputApplied !== undefined) {
               if (
@@ -1701,13 +1914,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         );
 
         if (decision._tag === "failure") return yield* decision.error;
-      }),
+      },
     );
 
-    const revertJoining: SubmissionLedger["Service"]["revertJoining"] = Effect.fn(
-      "MemorySubmissionLedger.revertJoining",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const revertJoining: SubmissionLedger["Service"]["revertJoining"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(RevertJoiningRequest, "revertJoining", unvalidated);
 
         const decision = yield* Ref.modify(
@@ -1725,28 +1936,71 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             // already-joined (or already-reverted) Submission is a no-op (DUR-016).
             if (stored.row.state !== "joining") return [success(undefined), current];
 
-            return [
-              success(undefined),
-              withSubmission(current, {
-                ...stored,
-                row: { ...stored.row, state: "ready" },
-                joinedHostSubmissionId: undefined,
-              }),
-            ];
-          },
-        );
+            const guard = request.guard;
 
-        if (decision._tag === "failure") return yield* decision.error;
-      }),
-    );
+            if (guard !== undefined) {
+              if (stored.joinedHostSubmissionId !== guard.hostSubmissionId)
+                return [success(undefined), current];
+              const host = current.submissions.get(guard.hostSubmissionId);
 
-    const suspend: SubmissionLedger["Service"]["suspend"] = Effect.fn(
-      "MemorySubmissionLedger.suspend",
-    )((unvalidated) =>
-      Effect.gen(function* () {
-        const request = yield* validate(SuspendRequest, "suspend", unvalidated);
+              if (host === undefined || host.row.threadId !== stored.row.threadId) {
+                return [
+                  failure(
+                    ledgerError(
+                      "revertJoining",
+                      `Host Submission ${guard.hostSubmissionId} is missing or belongs to another Thread`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+              if (
+                host.row.state !== "settled" &&
+                !journal.owner.hasOwner(host.row.threadId, host.row.submissionId)
+              )
+                return [
+                  failure(
+                    ledgerError("revertJoining", "The linked host has no active local session"),
+                  ),
+                  current,
+                ];
+            }
+
+            return [
+              success(undefined),
+              withSubmission(current, {
+                ...stored,
+                row: { ...stored.row, state: "ready" },
+                joinedHostSubmissionId: undefined,
+              }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+      },
+    );
+
+    const suspend: SubmissionLedger["Service"]["suspend"] = Effect.fnUntraced(
+      function* (unvalidated) {
+        const request = yield* validate(SuspendRequest, "suspend", unvalidated);
         const nowMillis = yield* Clock.currentTimeMillis;
 
+        const target = (yield* Ref.get(state)).submissions.get(request.submissionId);
+        const canonical = target === undefined ? undefined : yield* canonicalSettlement(target.row);
+        const announcedChildren = new Set<SubmissionId>();
+
+        if (request.reason._tag === "WaitingForChild") {
+          const current = yield* Ref.get(state);
+
+          for (const { childSubmissionId } of request.reason.children) {
+            const child = current.submissions.get(childSubmissionId);
+
+            if (child !== undefined && (yield* canonicalSettlement(child.row)) !== undefined)
+              announcedChildren.add(childSubmissionId);
+          }
+        }
+
         const decision = yield* Ref.modify(
           state,
           (
@@ -1786,21 +2040,20 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            // An exact terminal outcome is already reserved (DUR-011); suspension would
-            // contradict it, so the reservation wins.
-            if (stored.reservation !== undefined) {
+            // Canonical publication wins over a late parking transition.
+            if (canonical !== undefined) {
               return [
                 failure(
                   SettlementConflict.make({
                     submissionId: request.submissionId,
-                    existingOutcome: stored.reservation.outcome,
+                    existingOutcome: canonical.settlement.outcome,
                   }),
                 ),
                 current,
               ];
             }
-            if (!ownsLane(current, stored, request.ownershipToken)) {
-              return [failure(ownershipLost(current, stored)), current];
+            if (!journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId)) {
+              return [failure(ownershipLost(stored)), current];
             }
 
             // A covering event that raced ahead of the suspend transaction (an approval decision,
@@ -1808,12 +2061,12 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             // resumes the caller immediately WITHOUT releasing the lane (plan §2.6, spec §12).
             const alreadyCovered =
               request.reason._tag === "ApprovalPending"
-                ? request.reason.toolCallIds.every((toolCallId) =>
-                    stored.approvalDecisions.has(toolCallId),
+                ? approvalDecisionsCover(
+                    request.reason.toolCallIds,
+                    (toolCallId) => stored.approvalDecisions.get(toolCallId)?.decision,
                   )
-                : request.reason.children.every(
-                    (child) =>
-                      current.submissions.get(child.childSubmissionId)?.row.state === "settled",
+                : request.reason.children.every((child) =>
+                    announcedChildren.has(child.childSubmissionId),
                   );
 
             if (alreadyCovered) {
@@ -1825,7 +2078,6 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               withSubmission(current, {
                 ...stored,
                 row: { ...stored.row, state: "suspended" },
-                ownership: undefined,
                 suspension: { reason: request.reason, suspendedAtMillis: nowMillis },
               }),
             ];
@@ -1834,14 +2086,15 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
 
         if (decision._tag === "failure") return yield* decision.error;
 
+        if (decision.value === "suspended" && target !== undefined)
+          journal.owner.closeSubmission(target.row.threadId, request.submissionId);
+
         return decision.value;
-      }),
+      },
     );
 
-    const recordApprovalDecision: SubmissionLedger["Service"]["recordApprovalDecision"] = Effect.fn(
-      "MemorySubmissionLedger.recordApprovalDecision",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const recordApprovalDecision: SubmissionLedger["Service"]["recordApprovalDecision"] =
+      Effect.fnUntraced(function* (unvalidated) {
         const command = yield* validate(
           ApprovalDecisionCommand,
           "recordApprovalDecision",
@@ -1922,20 +2175,24 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               decidedAt: utc(nowMillis),
             });
 
+            if (!approvalFitsTransfer(stored.row.threadId, intent))
+              return [failure(transferCapacityError("recordApprovalDecision")), current];
+
             const approvalDecisions = new Map(stored.approvalDecisions).set(
               command.toolCallId,
               intent,
             );
 
-            // Once every pending call of an ApprovalPending suspension is decided, the lane
-            // wakes: suspended → input-applied (plan §2.6). A WaitingForChild suspension wakes
+            // A denial or decisions for every pending call wake an ApprovalPending lane:
+            // suspended → input-applied. A WaitingForChild suspension wakes
             // only through recordChildSettled.
             const wakes =
               stored.row.state === "suspended" &&
               stored.suspension !== undefined &&
               stored.suspension.reason._tag === "ApprovalPending" &&
-              stored.suspension.reason.toolCallIds.every((toolCallId) =>
-                approvalDecisions.has(toolCallId),
+              approvalDecisionsCover(
+                stored.suspension.reason.toolCallIds,
+                (toolCallId) => approvalDecisions.get(toolCallId)?.decision,
               );
 
             return [
@@ -1953,15 +2210,15 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         if (decision._tag === "failure") return yield* decision.error;
 
         return decision.value;
-      }),
-    );
+      });
 
-    const markUnknown: SubmissionLedger["Service"]["markUnknown"] = Effect.fn(
-      "MemorySubmissionLedger.markUnknown",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const markUnknown: SubmissionLedger["Service"]["markUnknown"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(MarkUnknownRequest, "markUnknown", unvalidated);
 
+        const target = (yield* Ref.get(state)).submissions.get(request.submissionId);
+        const canonical = target === undefined ? undefined : yield* canonicalSettlement(target.row);
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<void, SettlementConflict | LedgerError>, LedgerState] => {
@@ -1996,14 +2253,13 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            // A reserved exact outcome wins over a late Unknown marking (DUR-011); the recovery
-            // classifier orders reservation ahead of MarkUnknown for the same reason.
-            if (stored.reservation !== undefined) {
+            // Canonical publication wins over a late Unknown marking.
+            if (canonical !== undefined) {
               return [
                 failure(
                   SettlementConflict.make({
                     submissionId: request.submissionId,
-                    existingOutcome: stored.reservation.outcome,
+                    existingOutcome: canonical.settlement.outcome,
                   }),
                 ),
                 current,
@@ -2032,57 +2288,101 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         );
 
         if (decision._tag === "failure") return yield* decision.error;
-      }),
+      },
     );
 
     const recordUnknownResolution: SubmissionLedger["Service"]["recordUnknownResolution"] =
-      Effect.fn("MemorySubmissionLedger.recordUnknownResolution")((unvalidated) =>
-        Effect.gen(function* () {
-          const command = yield* validate(
-            UnknownResolutionCommand,
-            "recordUnknownResolution",
-            unvalidated,
+      Effect.fnUntraced(function* (unvalidated) {
+        const command = yield* validate(
+          UnknownResolutionCommand,
+          "recordUnknownResolution",
+          unvalidated,
+        );
+
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const before = (yield* Ref.get(state)).submissions.get(command.submissionId);
+        const kind = unknownResolutionKind(command.resolution);
+
+        if (
+          before !== undefined &&
+          kind === "factual" &&
+          !before.unknownResolutions.has(JSON.stringify([command.toolCallId, kind]))
+        ) {
+          const runId = runIdForSubmission(before.row.submissionId);
+
+          const outcomes = yield* journal.toolCallResults(
+            before.row.threadId,
+            runId,
+            command.toolCallId,
           );
 
-          const nowMillis = yield* Clock.currentTimeMillis;
+          const result = outcomes[0]?.payload;
+
+          if (
+            outcomes.length > 1 ||
+            (result !== undefined &&
+              (result._tag !== "ToolCallSettled" ||
+                result.runId !== runId ||
+                result.toolCallId !== command.toolCallId))
+          )
+            return yield* ledgerError(
+              "recordUnknownResolution",
+              "Canonical Tool result identity is inconsistent",
+            );
 
-          const decision = yield* Ref.modify(
-            state,
-            (
-              current,
-            ): readonly [
-              Decision<
-                UnknownResolutionIntent,
-                UnknownResolutionConflict | SettlementConflict | LedgerError
-              >,
-              LedgerState,
-            ] => {
-              const stored = current.submissions.get(command.submissionId);
-
-              if (stored === undefined) {
+          if (
+            result?._tag === "ToolCallSettled" &&
+            !unknownResolutionMatchesResult(command.resolution, result)
+          )
+            return yield* UnknownResolutionConflict.make({
+              submissionId: command.submissionId,
+              toolCallId: command.toolCallId,
+            });
+        }
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<
+              UnknownResolutionIntent,
+              UnknownResolutionConflict | SettlementConflict | LedgerError
+            >,
+            LedgerState,
+          ] => {
+            const stored = current.submissions.get(command.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "recordUnknownResolution",
+                    `Unknown Submission ${command.submissionId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            if (stored.row.state === "settled") {
+              if (stored.row.settledOutcome === undefined) {
                 return [
                   failure(
                     ledgerError(
                       "recordUnknownResolution",
-                      `Unknown Submission ${command.submissionId}`,
+                      `Settled Submission ${command.submissionId} is missing its outcome`,
                     ),
                   ),
                   current,
                 ];
               }
-              if (stored.row.state === "settled") {
-                if (stored.row.settledOutcome === undefined) {
-                  return [
-                    failure(
-                      ledgerError(
-                        "recordUnknownResolution",
-                        `Settled Submission ${command.submissionId} is missing its outcome`,
-                      ),
-                    ),
-                    current,
-                  ];
-                }
 
+              // Factual closure may outlive settlement; it never restores execution authority.
+              if (
+                command.resolution._tag !== "CompletedWithResult" &&
+                command.resolution._tag !== "NeverHappened"
+              )
                 return [
                   failure(
                     SettlementConflict.make({
@@ -2092,80 +2392,105 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   ),
                   current,
                 ];
-              }
-              const existing = stored.unknownResolutions.get(command.toolCallId);
+            }
+            const key = JSON.stringify([command.toolCallId, kind]);
+            const existing = stored.unknownResolutions.get(key);
 
-              if (
-                existing !== undefined &&
-                !equivalentUnknownResolution(existing.intent.resolution, command.resolution)
-              ) {
-                return [
-                  failure(
-                    UnknownResolutionConflict.make({
-                      submissionId: command.submissionId,
-                      toolCallId: command.toolCallId,
-                    }),
-                  ),
-                  current,
-                ];
-              }
+            if (
+              (existing !== undefined &&
+                !equivalentUnknownResolution(existing.intent.resolution, command.resolution)) ||
+              (existing === undefined &&
+                kind === "execution" &&
+                stored.unknownResolutions.has(JSON.stringify([command.toolCallId, "factual"])))
+            ) {
+              return [
+                failure(
+                  UnknownResolutionConflict.make({
+                    submissionId: command.submissionId,
+                    toolCallId: command.toolCallId,
+                  }),
+                ),
+                current,
+              ];
+            }
 
-              const intent =
-                existing?.intent ??
-                UnknownResolutionIntent.make({
-                  submissionId: command.submissionId,
-                  toolCallId: command.toolCallId,
-                  author: command.author,
-                  reason: command.reason,
-                  resolution: command.resolution,
-                  resolvedAt: utc(nowMillis),
-                });
+            const intent =
+              existing?.intent ??
+              UnknownResolutionIntent.make({
+                submissionId: command.submissionId,
+                toolCallId: command.toolCallId,
+                author: command.author,
+                reason: command.reason,
+                resolution: command.resolution,
+                resolvedAt: utc(nowMillis),
+              });
 
-              const unknownResolutions =
-                existing !== undefined
-                  ? stored.unknownResolutions
-                  : new Map(stored.unknownResolutions).set(command.toolCallId, {
-                      intent,
-                    });
+            if (existing === undefined && !resolutionFitsTransfer(stored.row.threadId, intent))
+              return [failure(transferCapacityError("recordUnknownResolution")), current];
 
-              // The lane reopens only when EVERY marked open call has a durable resolution
-              // intent: unknown → input-applied (DUR-017). Replays re-run the coverage check so
-              // a recovering caller can wake the lane idempotently.
-              const wakes =
-                stored.row.state === "unknown" &&
-                stored.unknownMark !== undefined &&
-                stored.unknownMark.toolCallIds.every((toolCallId) =>
-                  unknownResolutions.has(toolCallId),
-                );
+            const unknownResolutions =
+              existing !== undefined
+                ? stored.unknownResolutions
+                : new Map(stored.unknownResolutions).set(key, {
+                    intent,
+                  });
 
-              return [
-                success(intent),
-                withSubmission(current, {
-                  ...stored,
-                  row: wakes ? { ...stored.row, state: "input-applied" } : stored.row,
-                  unknownMark: wakes ? undefined : stored.unknownMark,
-                  unknownResolutions,
-                }),
-              ];
-            },
-          );
+            // The lane reopens only when EVERY marked open call has a durable resolution
+            // intent: unknown → input-applied (DUR-017). Replays re-run the coverage check so
+            // a recovering caller can wake the lane idempotently.
+            const wakes =
+              stored.row.state === "unknown" &&
+              stored.unknownMark !== undefined &&
+              stored.unknownMark.toolCallIds.every(
+                (toolCallId) =>
+                  unknownResolutions.has(JSON.stringify([toolCallId, "execution"])) ||
+                  unknownResolutions.has(JSON.stringify([toolCallId, "factual"])),
+              );
 
-          if (decision._tag === "failure") return yield* decision.error;
+            return [
+              success(intent),
+              withSubmission(current, {
+                ...stored,
+                row: wakes ? { ...stored.row, state: "input-applied" } : stored.row,
+                unknownMark: wakes ? undefined : stored.unknownMark,
+                unknownResolutions,
+              }),
+            ];
+          },
+        );
 
-          return decision.value;
-        }),
-      );
+        if (decision._tag === "failure") return yield* decision.error;
 
-    const recordChildSettled: SubmissionLedger["Service"]["recordChildSettled"] = Effect.fn(
-      "MemorySubmissionLedger.recordChildSettled",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+        return decision.value;
+      });
+
+    const recordChildSettled: SubmissionLedger["Service"]["recordChildSettled"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(
           ChildSettledNotification,
           "recordChildSettled",
           unvalidated,
         );
 
+        const before = yield* Ref.get(state);
+        const waiting = before.submissions.get(request.parentSubmissionId)?.suspension?.reason;
+
+        const ids = new Set([
+          request.childSubmissionId,
+          ...(waiting?._tag === "WaitingForChild"
+            ? waiting.children.map((child) => child.childSubmissionId)
+            : []),
+        ]);
+
+        const announcedChildren = new Set<SubmissionId>();
+
+        for (const id of ids) {
+          const child = before.submissions.get(id);
+
+          if (child !== undefined && (yield* canonicalSettlement(child.row)) !== undefined)
+            announcedChildren.add(id);
+        }
+
         const decision = yield* Ref.modify(
           state,
           (current): readonly [Decision<ChildSettledOutcome, LedgerError>, LedgerState] => {
@@ -2182,16 +2507,8 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            // The caller may notify after the canonical Settlement append but before ledger
-            // finalization. In a single store, an exact reservation plus `terminalizing` is the
-            // narrow durable prefix that makes that ordering admissible; earlier states remain
-            // a caller error.
-            const child = current.submissions.get(request.childSubmissionId);
-
-            const announced =
-              child !== undefined &&
-              (child.row.state === "settled" ||
-                (child.row.state === "terminalizing" && child.reservation !== undefined));
+            // Canonical publication is visible before child ledger finalization.
+            const announced = announcedChildren.has(request.childSubmissionId);
 
             if (!announced) {
               return [
@@ -2217,16 +2534,9 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
               return [success("not-waiting" as const), current];
             }
 
-            // Every listed child must be either finalized or canonically announced from the
-            // exact terminalizing reservation. Replays re-run this coverage check idempotently.
-            const allSettled = children.every((entry) => {
-              const listed = current.submissions.get(entry.childSubmissionId);
-
-              return (
-                listed?.row.state === "settled" ||
-                (listed?.row.state === "terminalizing" && listed.reservation !== undefined)
-              );
-            });
+            const allSettled = children.every((entry) =>
+              announcedChildren.has(entry.childSubmissionId),
+            );
 
             if (!allSettled) return [success("still-waiting" as const), current];
 
@@ -2244,13 +2554,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         if (decision._tag === "failure") return yield* decision.error;
 
         return decision.value;
-      }),
+      },
     );
 
-    const reserveChildBudget: SubmissionLedger["Service"]["reserveChildBudget"] = Effect.fn(
-      "MemorySubmissionLedger.reserveChildBudget",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const reserveChildBudget: SubmissionLedger["Service"]["reserveChildBudget"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(
           ChildBudgetReservationRequest,
           "reserveChildBudget",
@@ -2270,7 +2578,7 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             const existing = current.childReservations.get(request.reservationId);
 
             if (existing !== undefined) {
-              // Identical replays short-circuit before the fence, mirroring reserveSettlement:
+              // Identical replays short-circuit before the fence, retaining the first committed allocation:
               // a replay creates nothing, so a recovering caller resumes rather than duplicates.
               const identical =
                 existing.parentSubmissionId === request.parentSubmissionId &&
@@ -2302,7 +2610,10 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                 current,
               ];
             }
-            for (const reservation of current.childReservations.values()) {
+            for (const id of current.childrenByParent.get(request.parentSubmissionId) ?? []) {
+              const reservation = current.childReservations.get(id);
+
+              if (reservation === undefined) continue;
               if (
                 reservation.parentSubmissionId === request.parentSubmissionId &&
                 reservation.parentToolCallId === request.parentToolCallId
@@ -2334,8 +2645,8 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
             }
             // Creation is fenced by the parent lane's live ownership (spec §12 step 2): a stale
             // parent Attempt can never create new reservation state.
-            if (!ownsLane(current, parent, request.ownershipToken)) {
-              return [failure(ownershipLost(current, parent)), current];
+            if (!journal.owner.hasOwner(parent.row.threadId, parent.row.submissionId)) {
+              return [failure(ownershipLost(parent)), current];
             }
 
             const reservation: StoredChildReservation = {
@@ -2367,198 +2678,189 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         if (decision._tag === "failure") return yield* decision.error;
 
         return decision.value;
-      }),
+      },
     );
 
     const attachChildToReservation: SubmissionLedger["Service"]["attachChildToReservation"] =
-      Effect.fn("MemorySubmissionLedger.attachChildToReservation")((unvalidated) =>
-        Effect.gen(function* () {
-          const request = yield* validate(
-            AttachChildToReservationRequest,
-            "attachChildToReservation",
-            unvalidated,
-          );
+      Effect.fnUntraced(function* (unvalidated) {
+        const request = yield* validate(
+          AttachChildToReservationRequest,
+          "attachChildToReservation",
+          unvalidated,
+        );
 
-          const decision = yield* Ref.modify(
-            state,
-            (
-              current,
-            ): readonly [
-              Decision<
-                ChildBudgetReservationSnapshot,
-                ChildReservationConflict | OwnershipLost | LedgerError
-              >,
-              LedgerState,
-            ] => {
-              const reservation = current.childReservations.get(request.reservationId);
-
-              if (reservation === undefined) {
-                return [
-                  failure(
-                    ledgerError(
-                      "attachChildToReservation",
-                      `Unknown child reservation ${request.reservationId}`,
-                    ),
-                  ),
-                  current,
-                ];
-              }
-              if (reservation.childSubmissionId !== undefined) {
-                // Idempotent replay of the recorded attachment (unfenced — it mutates nothing).
-                if (reservation.childSubmissionId === request.childSubmissionId) {
-                  return [success(toReservationSnapshot(reservation)), current];
-                }
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<
+              ChildBudgetReservationSnapshot,
+              ChildReservationConflict | OwnershipLost | LedgerError
+            >,
+            LedgerState,
+          ] => {
+            const reservation = current.childReservations.get(request.reservationId);
 
-                return [
-                  failure(
-                    ChildReservationConflict.make({
-                      reservationId: request.reservationId,
-                      status: reservation.status,
-                      message: `Reservation ${request.reservationId} already records child ${reservation.childSubmissionId}.`,
-                    }),
+            if (reservation === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "attachChildToReservation",
+                    `Unknown child reservation ${request.reservationId}`,
                   ),
-                  current,
-                ];
+                ),
+                current,
+              ];
+            }
+            if (reservation.childSubmissionId !== undefined) {
+              // Idempotent replay of the recorded attachment (unfenced — it mutates nothing).
+              if (reservation.childSubmissionId === request.childSubmissionId) {
+                return [success(toReservationSnapshot(reservation)), current];
               }
-              const parent = current.submissions.get(reservation.parentSubmissionId);
 
-              if (parent === undefined) {
-                return [
-                  failure(
-                    ledgerError(
-                      "attachChildToReservation",
-                      `Unknown Submission ${reservation.parentSubmissionId}`,
-                    ),
-                  ),
-                  current,
-                ];
-              }
-              if (!ownsLane(current, parent, request.ownershipToken)) {
-                return [failure(ownershipLost(current, parent)), current];
-              }
-              if (reservation.status !== "reserved") {
-                return [
-                  failure(
-                    ChildReservationConflict.make({
-                      reservationId: request.reservationId,
-                      status: reservation.status,
-                      message: `Cannot attach a child to a ${reservation.status} reservation.`,
-                    }),
+              return [
+                failure(
+                  ChildReservationConflict.make({
+                    reservationId: request.reservationId,
+                    status: reservation.status,
+                    message: `Reservation ${request.reservationId} already records child ${reservation.childSubmissionId}.`,
+                  }),
+                ),
+                current,
+              ];
+            }
+            const parent = current.submissions.get(reservation.parentSubmissionId);
+
+            if (parent === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "attachChildToReservation",
+                    `Unknown Submission ${reservation.parentSubmissionId}`,
                   ),
-                  current,
-                ];
-              }
-              // Single-store latitude: the admitted child must exist here, so a dangling
-              // attachment can never enter the recovery view.
-              if (!current.submissions.has(request.childSubmissionId)) {
-                return [
-                  failure(
-                    ledgerError(
-                      "attachChildToReservation",
-                      `Unknown child Submission ${request.childSubmissionId}`,
-                    ),
+                ),
+                current,
+              ];
+            }
+            if (!journal.owner.hasOwner(parent.row.threadId, parent.row.submissionId)) {
+              return [failure(ownershipLost(parent)), current];
+            }
+            if (reservation.status !== "reserved") {
+              return [
+                failure(
+                  ChildReservationConflict.make({
+                    reservationId: request.reservationId,
+                    status: reservation.status,
+                    message: `Cannot attach a child to a ${reservation.status} reservation.`,
+                  }),
+                ),
+                current,
+              ];
+            }
+            // Single-store latitude: the admitted child must exist here, so a dangling
+            // attachment can never enter the recovery view.
+            if (!current.submissions.has(request.childSubmissionId)) {
+              return [
+                failure(
+                  ledgerError(
+                    "attachChildToReservation",
+                    `Unknown child Submission ${request.childSubmissionId}`,
                   ),
-                  current,
-                ];
-              }
+                ),
+                current,
+              ];
+            }
 
-              const attached: StoredChildReservation = {
-                ...reservation,
-                childSubmissionId: request.childSubmissionId,
-              };
+            const attached: StoredChildReservation = {
+              ...reservation,
+              childSubmissionId: request.childSubmissionId,
+            };
 
-              return [
-                success(toReservationSnapshot(attached)),
-                withChildReservation(current, attached),
-              ];
-            },
-          );
+            return [
+              success(toReservationSnapshot(attached)),
+              withChildReservation(current, attached),
+            ];
+          },
+        );
 
-          if (decision._tag === "failure") return yield* decision.error;
+        if (decision._tag === "failure") return yield* decision.error;
 
-          return decision.value;
-        }),
-      );
+        return decision.value;
+      });
 
     const beginChildBudgetRelease: SubmissionLedger["Service"]["beginChildBudgetRelease"] =
-      Effect.fn("MemorySubmissionLedger.beginChildBudgetRelease")((unvalidated) =>
-        Effect.gen(function* () {
-          const request = yield* validate(
-            BeginChildBudgetReleaseRequest,
-            "beginChildBudgetRelease",
-            unvalidated,
-          );
-
-          const nowMillis = yield* Clock.currentTimeMillis;
+      Effect.fnUntraced(function* (unvalidated) {
+        const request = yield* validate(
+          BeginChildBudgetReleaseRequest,
+          "beginChildBudgetRelease",
+          unvalidated,
+        );
 
-          const decision = yield* Ref.modify(
-            state,
-            (
-              current,
-            ): readonly [
-              Decision<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>,
-              LedgerState,
-            ] => {
-              const reservation = current.childReservations.get(request.reservationId);
+        const nowMillis = yield* Clock.currentTimeMillis;
 
-              if (reservation === undefined) {
-                return [
-                  failure(
-                    ledgerError(
-                      "beginChildBudgetRelease",
-                      `Unknown child reservation ${request.reservationId}`,
-                    ),
-                  ),
-                  current,
-                ];
-              }
-              if (reservation.status !== "reserved") {
-                // The accounting decision was already frozen exactly once; an identical replay is
-                // a no-op and a divergent decision conflicts (spec §12 join step 6).
-                if (
-                  reservation.accounting !== undefined &&
-                  equivalentPersistedJson(reservation.accounting, request.accounting)
-                ) {
-                  return [success(toReservationSnapshot(reservation)), current];
-                }
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>,
+            LedgerState,
+          ] => {
+            const reservation = current.childReservations.get(request.reservationId);
 
-                return [
-                  failure(
-                    ChildReservationConflict.make({
-                      reservationId: request.reservationId,
-                      status: reservation.status,
-                      message:
-                        "A different accounting decision is already frozen for this reservation.",
-                    }),
+            if (reservation === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "beginChildBudgetRelease",
+                    `Unknown child reservation ${request.reservationId}`,
                   ),
-                  current,
-                ];
+                ),
+                current,
+              ];
+            }
+            if (reservation.status !== "reserved") {
+              // The accounting decision was already frozen exactly once; an identical replay is
+              // a no-op and a divergent decision conflicts (spec §12 join step 6).
+              if (
+                reservation.accounting !== undefined &&
+                equivalentPersistedJson(reservation.accounting, request.accounting)
+              ) {
+                return [success(toReservationSnapshot(reservation)), current];
               }
 
-              const frozen: StoredChildReservation = {
-                ...reservation,
-                status: "releasePending",
-                accounting: request.accounting,
-                releaseBeganAtMillis: nowMillis,
-              };
-
               return [
-                success(toReservationSnapshot(frozen)),
-                withChildReservation(current, frozen),
+                failure(
+                  ChildReservationConflict.make({
+                    reservationId: request.reservationId,
+                    status: reservation.status,
+                    message:
+                      "A different accounting decision is already frozen for this reservation.",
+                  }),
+                ),
+                current,
               ];
-            },
-          );
+            }
 
-          if (decision._tag === "failure") return yield* decision.error;
+            const frozen: StoredChildReservation = {
+              ...reservation,
+              status: "releasePending",
+              accounting: request.accounting,
+              releaseBeganAtMillis: nowMillis,
+            };
 
-          return decision.value;
-        }),
-      );
+            return [success(toReservationSnapshot(frozen)), withChildReservation(current, frozen)];
+          },
+        );
 
-    const releaseChildBudget: SubmissionLedger["Service"]["releaseChildBudget"] = Effect.fn(
-      "MemorySubmissionLedger.releaseChildBudget",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      });
+
+    const releaseChildBudget: SubmissionLedger["Service"]["releaseChildBudget"] = Effect.fnUntraced(
+      function* (unvalidated) {
         const request = yield* validate(
           ReleaseChildBudgetRequest,
           "releaseChildBudget",
@@ -2623,56 +2925,60 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         if (decision._tag === "failure") return yield* decision.error;
 
         return decision.value;
-      }),
+      },
     );
 
-    const scanNonterminal: SubmissionLedger["Service"]["scanNonterminal"] = Stream.unwrap(
-      Ref.get(state).pipe(
-        Effect.map((current) => {
-          const snapshots = [...current.submissions.values()]
-            .filter((stored) => stored.row.state !== "settled")
-            .sort((left, right) =>
-              left.row.threadId < right.row.threadId
-                ? -1
-                : left.row.threadId > right.row.threadId
-                  ? 1
-                  : left.row.queueSequence - right.row.queueSequence,
-            )
-            .map(({ row }) =>
-              SubmissionWorkItem.make({
-                submissionId: row.submissionId,
-                threadId: row.threadId,
-                queueSequence: row.queueSequence,
-                principal: row.principal,
-                idempotencyKey: row.idempotencyKey,
-                deploymentId: row.deploymentId,
-                receiptId: row.receiptId,
-                state: row.state,
-              }),
-            );
+    const scanNonterminal: SubmissionLedger["Service"]["scanNonterminal"] = Stream.paginate<
+      string | undefined,
+      SubmissionWorkItem,
+      never
+    >(undefined, (after) =>
+      Effect.sync(() => {
+        const current = MutableRef.get(state.ref);
+
+        const candidates = boundedWorkSelection<StoredSubmission>(
+          8,
+          (stored) =>
+            `${stored.row.threadId}\u0000${String(stored.row.queueSequence).padStart(16, "0")}`,
+          after,
+        );
 
-          return Stream.fromIterable(snapshots);
-        }),
-      ),
+        for (const ids of current.activeByThread.values())
+          for (const id of ids) {
+            const stored = current.submissions.get(id);
+
+            if (stored !== undefined) candidates.add(stored);
+          }
+        const items = candidates.values.map(({ row }) => SubmissionWorkItem.make(row));
+        const last = candidates.values.at(-1)?.row;
+
+        return [
+          items,
+          last === undefined
+            ? Option.none<string | undefined>()
+            : Option.some(`${last.threadId}\u0000${String(last.queueSequence).padStart(16, "0")}`),
+        ] as const;
+      }),
     );
 
-    const readAbortIntent: SubmissionLedger["Service"]["readAbortIntent"] = Effect.fn(
-      "MemorySubmissionLedger.readAbortIntent",
-    )(function* (unvalidated) {
-      const request = yield* validate(AbortIntentRequest, "readAbortIntent", unvalidated);
-      const stored = (yield* Ref.get(state)).submissions.get(request.submissionId);
+    const readAbortIntent: SubmissionLedger["Service"]["readAbortIntent"] = Effect.fnUntraced(
+      function* (unvalidated) {
+        const request = yield* validate(AbortIntentRequest, "readAbortIntent", unvalidated);
+        const stored = (yield* Ref.get(state)).submissions.get(request.submissionId);
 
-      if (stored === undefined) {
-        return yield* ledgerError("readAbortIntent", `Unknown Submission ${request.submissionId}`);
-      }
+        if (stored === undefined) {
+          return yield* ledgerError(
+            "readAbortIntent",
+            `Unknown Submission ${request.submissionId}`,
+          );
+        }
 
-      return stored.abortIntent;
-    });
+        return stored.abortIntent;
+      },
+    );
 
-    const loadRecoverySnapshot: SubmissionLedger["Service"]["loadRecoverySnapshot"] = Effect.fn(
-      "MemorySubmissionLedger.loadRecoverySnapshot",
-    )((unvalidated) =>
-      Effect.gen(function* () {
+    const loadRecoverySnapshot: SubmissionLedger["Service"]["loadRecoverySnapshot"] =
+      Effect.fnUntraced(function* (unvalidated) {
         const request = yield* validate(
           RecoverySnapshotRequest,
           "loadRecoverySnapshot",
@@ -2689,8 +2995,10 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
           );
         }
 
-        const joins = [...current.submissions.values()]
-          .filter((candidate) => candidate.joinedHostSubmissionId === request.submissionId)
+        const joins = Array.from(current.joinsByHost.get(request.submissionId) ?? [], (id) =>
+          current.submissions.get(id),
+        )
+          .filter((candidate): candidate is StoredSubmission => candidate !== undefined)
           .sort((left, right) => left.row.queueSequence - right.row.queueSequence)
           .map((candidate) =>
             JoinSnapshot.make({
@@ -2709,8 +3017,11 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
         // Parent-side subagent view: this Submission's child budget reservations in parent Tool
         // Call order, plus each attached child's current lane state (a disposable derived view;
         // the canonical records stay the recovery truth, DUR-015).
-        const childReservations = [...current.childReservations.values()]
-          .filter((reservation) => reservation.parentSubmissionId === request.submissionId)
+        const childReservations = Array.from(
+          current.childrenByParent.get(request.submissionId) ?? [],
+          (id) => current.childReservations.get(id),
+        )
+          .filter((reservation): reservation is StoredChildReservation => reservation !== undefined)
           .sort((left, right) =>
             left.parentToolCallId < right.parentToolCallId
               ? -1
@@ -2761,64 +3072,455 @@ const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
                   suspendedAt: utc(stored.suspension.suspendedAtMillis),
                 }),
               }),
-          ...(stored.ownership === undefined
-            ? {}
-            : {
-                ownership: OwnershipSnapshot.make({
-                  attemptId: stored.ownership.attemptId,
-                  ownerProducerId: stored.ownership.ownerProducerId,
-                  producerEpoch: stored.ownership.producerEpoch,
-                  leaseExpiresAt: utc(stored.ownership.leaseExpiresAtMillis),
-                }),
-              }),
+          hasOwner: journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId),
           ...(stored.inputApplied === undefined ? {} : { inputApplied: stored.inputApplied }),
-          ...(stored.reservation === undefined
-            ? {}
-            : {
-                reservation: SettlementReservationSnapshot.make({
-                  settlementId: stored.reservation.settlementId,
-                  outcome: stored.reservation.outcome,
-                  record: stored.reservation.record,
-                  recordDigest: stored.reservation.recordDigest,
-                  finalized: stored.reservation.finalizedAtMillis !== undefined,
-                }),
-              }),
           ...(stored.abortIntent === undefined ? {} : { abortIntent: stored.abortIntent }),
         });
-      }),
-    );
+      });
 
-    return SubmissionLedger.of({
+    const ledger = SubmissionLedger.of({
       capabilities,
-      admit,
-      markReady,
+      resolveFundingOwner: Effect.fnUntraced(function* (unvalidated) {
+        const request = yield* validate(FundingOwnerRequest, "funding owner", unvalidated);
+        const current = MutableRef.get(state.ref);
+        const selected = current.submissions.get(request.submissionId);
+
+        if (selected === undefined || selected.row.threadId !== request.threadId)
+          return yield* ledgerError(
+            "funding owner",
+            "Selected admission belongs to another Thread or is missing",
+          );
+        if (
+          selected.row.state === "joining" ||
+          (selected.joinedHostSubmissionId !== undefined && selected.inputApplied === undefined)
+        )
+          return yield* ledgerError(
+            "funding owner",
+            "Joining funding owner is not yet frozen by exact applied input evidence",
+          );
+
+        const owner =
+          selected.joinedHostSubmissionId === undefined
+            ? selected
+            : current.submissions.get(selected.joinedHostSubmissionId);
+
+        if (
+          owner === undefined ||
+          owner.row.threadId !== request.threadId ||
+          (owner !== selected && owner.row.queueSequence >= selected.row.queueSequence)
+        )
+          return yield* ledgerError(
+            "funding owner",
+            "Exact joined funding owner is missing or inconsistent",
+          );
+
+        return FundingOwner.make({
+          selected: toSnapshot(selected.row),
+          owner: toSnapshot(owner.row),
+        });
+      }),
+      admit: (request) => journal.withMutation(admit(request)),
+      markReady: (request) => journal.withMutation(markReady(request)),
       lookup,
       resolveAdmission,
-      claim,
-      renewOwnership,
-      releaseOwnership,
-      markInputApplied,
-      reserveSettlement,
-      finalizeSettlement,
-      requestAbort,
-      stopWorker,
+      selectHead: (request) => journal.withMutation(selectHead(request)),
+      markInputApplied: (request) => journal.withMutation(markInputApplied(request)),
+      finalizeSettlement: (request) => journal.withMutation(finalizeSettlement(request)),
+      requestAbort: (request) => journal.withMutation(requestAbort(request)),
+      stopWorker: (request) => journal.withMutation(stopWorker(request)),
       inspectWorker,
-      claimJoining,
-      markJoined,
-      revertJoining,
-      suspend,
-      recordApprovalDecision,
-      markUnknown,
-      recordUnknownResolution,
-      recordChildSettled,
-      reserveChildBudget,
-      attachChildToReservation,
-      beginChildBudgetRelease,
-      releaseChildBudget,
+      claimJoining: (request) => journal.withMutation(claimJoining(request)),
+      markJoined: (request) => journal.withMutation(markJoined(request)),
+      revertJoining: (request) => journal.withMutation(revertJoining(request)),
+      suspend: (request) => journal.withMutation(suspend(request)),
+      recordApprovalDecision: (request) => journal.withMutation(recordApprovalDecision(request)),
+      markUnknown: (request) => journal.withMutation(markUnknown(request)),
+      recordUnknownResolution: (request) => journal.withMutation(recordUnknownResolution(request)),
+      recordChildSettled: (request) => journal.withMutation(recordChildSettled(request)),
+      reserveChildBudget: (request) => journal.withMutation(reserveChildBudget(request)),
+      attachChildToReservation: (request) =>
+        journal.withMutation(attachChildToReservation(request)),
+      beginChildBudgetRelease: (request) => journal.withMutation(beginChildBudgetRelease(request)),
+      releaseChildBudget: (request) => journal.withMutation(releaseChildBudget(request)),
       scanNonterminal,
       loadRecoverySnapshot,
       readAbortIntent,
     });
+
+    const toAdmission = (row: SubmissionRow, settledAtMillis?: number) =>
+      ThreadAdmission.make({
+        ...toSnapshot(row),
+        ...(settledAtMillis === undefined ? {} : { settledAt: utc(settledAtMillis) }),
+      });
+
+    const cleanCommand = <A extends { readonly canonicalRecordId?: RecordEnvelope["recordId"] }>(
+      value: A,
+    ) => {
+      const { canonicalRecordId: _, ...fact } = value;
+
+      return fact;
+    };
+
+    const commands = (stored: StoredSubmission | undefined) => {
+      return {
+        aborts: stored?.abortIntent === undefined ? [] : [cleanCommand(stored.abortIntent)],
+        approvals: Array.from(stored?.approvalDecisions.values() ?? [], cleanCommand),
+        resolutions: Array.from(stored?.unknownResolutions.values() ?? [], ({ intent }) =>
+          cleanCommand(intent),
+        ),
+      };
+    };
+
+    const readCommands = Effect.fnUntraced(function* (stored: StoredSubmission | undefined) {
+      if (
+        (stored?.approvalDecisions.size ?? 0) > MAX_RUN_EVIDENCE_RECORDS ||
+        (stored?.unknownResolutions.size ?? 0) > MAX_RUN_EVIDENCE_RECORDS
+      )
+        return yield* ThreadStoreError.make({
+          operation: "read commands",
+          message: "Accepted commands exceed Run record bounds",
+        });
+      let bytes = 0;
+
+      const add = <A, I>(schema: Schema.Codec<A, I>, value: A) =>
+        Schema.encodeEffect(Schema.toCodecJson(schema))(value).pipe(
+          Effect.mapError(() =>
+            ThreadStoreError.make({
+              operation: "read commands",
+              message: "Invalid accepted command wire",
+            }),
+          ),
+          Effect.flatMap((wire) => {
+            bytes += utf8ByteLength(canonicalJson(wire));
+
+            return bytes > MAX_RUN_EVIDENCE_BYTES
+              ? Effect.fail(
+                  ThreadStoreError.make({
+                    operation: "read commands",
+                    message: "Accepted commands exceed Run byte bounds",
+                  }),
+                )
+              : Effect.void;
+          }),
+        );
+
+      if (stored?.abortIntent !== undefined) yield* add(AbortIntent, stored.abortIntent);
+      for (const value of stored?.approvalDecisions.values() ?? [])
+        yield* add(ApprovalDecisionIntent, value);
+      for (const { intent } of stored?.unknownResolutions.values() ?? [])
+        yield* add(UnknownResolutionIntent, intent);
+
+      return commands(stored);
+    });
+
+    const lookupAdmission = (threadId: ThreadId, submissionId: SubmissionId) =>
+      Effect.sync(() => {
+        const stored = MutableRef.get(state.ref).submissions.get(submissionId);
+
+        return stored?.row.threadId === threadId
+          ? toAdmission(stored.row, stored.finalization?.finalizedAtMillis)
+          : undefined;
+      });
+
+    yield* journal.registerLedgerTransfer({
+      admission: lookupAdmission,
+      commands: (id) => readCommands(MutableRef.get(state.ref).submissions.get(id)),
+      snapshot: (threadId) =>
+        Effect.sync(() => {
+          const current = MutableRef.get(state.ref);
+          const directory = current.byThread.get(threadId);
+
+          return {
+            idle:
+              (current.activeByThread.get(threadId)?.size ?? 0) === 0 &&
+              (directory?.reservations ?? 0) === 0,
+            admissions: directory?.ordered.length ?? 0,
+            aborts: directory?.commands.aborts.length ?? 0,
+            approvals: directory?.commands.approvals.length ?? 0,
+            resolutions: directory?.commands.resolutions.length ?? 0,
+            ...(current.stoppedWorkers.has(threadId)
+              ? {
+                  workerSeal:
+                    current.stoppedWorkers.get(threadId) === undefined
+                      ? {}
+                      : { terminal: current.stoppedWorkers.get(threadId) },
+                }
+              : {}),
+          };
+        }),
+      facts: (threadId, section, after) =>
+        Effect.sync(() => {
+          const current = MutableRef.get(state.ref);
+
+          const facts = {
+            admissions: new Array<ThreadAdmission>(),
+            commands: commands(undefined),
+            deliveries: [],
+          };
+
+          let next = after ?? "";
+
+          if (section === "admissions") {
+            const stored = threadRows(
+              current,
+              threadId,
+              after === undefined ? -1 : Number(after),
+            ).next().value;
+
+            if (stored !== undefined) {
+              facts.admissions.push(
+                toAdmission(stored.row, stored.finalization?.finalizedAtMillis),
+              );
+              next = String(stored.row.queueSequence);
+            }
+          } else {
+            const entries = current.byThread.get(threadId)?.commands[section] ?? [];
+            const at = after === undefined ? 0 : commandPosition(entries, after);
+            const choice = entries[at + Number(after !== undefined && entries[at]?.key === after)];
+
+            if (choice !== undefined) {
+              next = choice.key;
+              const stored = current.submissions.get(choice.submissionId);
+
+              if (section === "aborts" && stored?.abortIntent !== undefined)
+                facts.commands.aborts.push(cleanCommand(stored.abortIntent));
+              else if (section === "approvals" && choice.toolCallId !== undefined) {
+                const value = stored?.approvalDecisions.get(choice.toolCallId);
+
+                if (value !== undefined) facts.commands.approvals.push(cleanCommand(value));
+              } else if (section === "resolutions" && choice.resolutionKey !== undefined) {
+                const value = stored?.unknownResolutions.get(choice.resolutionKey);
+
+                if (value !== undefined)
+                  facts.commands.resolutions.push(cleanCommand(value.intent));
+              }
+            }
+          }
+
+          return { facts, after: next };
+        }),
+      submissions: (threadId) =>
+        Stream.paginate(-1, (after) =>
+          Effect.sync(() => {
+            const stored = threadRows(MutableRef.get(state.ref), threadId, after).next().value;
+
+            return [
+              stored === undefined ? [] : [toSnapshot(stored.row)],
+              stored === undefined ? Option.none<number>() : Option.some(stored.row.queueSequence),
+            ] as const;
+          }),
+        ),
+      startImport: Effect.fnUntraced(function* (threadId) {
+        const current = yield* Ref.get(state);
+
+        if (
+          current.lanes.has(threadId) ||
+          current.byThread.has(threadId) ||
+          current.stoppedWorkers.has(threadId)
+        )
+          return yield* ThreadImportRejected.make({
+            threadId,
+            reason: "target-not-empty",
+            message: "Destination ledger contains Thread data",
+          });
+
+        const staged: LedgerState = {
+          submissions: new Map(),
+          admissionIndex: new Map(),
+          lanes: new Map(),
+          childReservations: new Map(),
+          freshAdmissionSequence: current.freshAdmissionSequence,
+          stoppedWorkers: new Map(),
+          latestByThread: new Map(),
+          activeByThread: new Map(),
+          byThread: new Map(),
+          receipts: new Map(),
+          joinsByHost: new Map(),
+          childrenByParent: new Map(),
+        };
+
+        const commandBytes = new Map<SubmissionId, number>();
+        const settledTimes = new Map<SubmissionId, number>();
+
+        const retainCommandBytes = Effect.fnUntraced(function* <A, I>(
+          schema: Schema.Codec<A, I>,
+          value: A,
+          id: SubmissionId,
+        ) {
+          const wire = yield* Schema.encodeEffect(Schema.toCodecJson(schema))(value).pipe(
+            Effect.mapError(() => invalidThreadArchive("Invalid accepted command wire", threadId)),
+          );
+
+          const bytes = (commandBytes.get(id) ?? 0) + utf8ByteLength(canonicalJson(wire));
+
+          if (bytes > MAX_RUN_EVIDENCE_BYTES)
+            return yield* invalidThreadArchive(
+              "Accepted commands exceed Run byte bounds",
+              threadId,
+            );
+          commandBytes.set(id, bytes);
+        });
+
+        const reader = {
+          admission: (id: SubmissionId) =>
+            Effect.sync(() => {
+              const stored = staged.submissions.get(id);
+
+              return stored === undefined
+                ? undefined
+                : toAdmission(stored.row, settledTimes.get(id));
+            }),
+          runOwner: (runId: import("@yielded/agent/identifiers").RunId) =>
+            Effect.sync(() => {
+              if (!runId.startsWith("run:")) return undefined;
+              const id = Schema.decodeSync(SubmissionId)(runId.slice(4));
+              const stored = staged.submissions.get(id);
+
+              return stored === undefined
+                ? undefined
+                : toAdmission(stored.row, settledTimes.get(id));
+            }),
+          commands: (id: SubmissionId) => readCommands(staged.submissions.get(id)),
+        };
+
+        return {
+          reader,
+          stage: Effect.fnUntraced(function* (page) {
+            for (const a of page.archive.admissions) {
+              const key = admissionKey(threadId, a.principal, a.idempotencyKey);
+
+              if (
+                current.submissions.has(a.submissionId) ||
+                staged.submissions.has(a.submissionId) ||
+                current.receipts.has(a.receiptId) ||
+                staged.receipts.has(a.receiptId) ||
+                current.admissionIndex.has(key) ||
+                staged.admissionIndex.has(key)
+              )
+                return yield* ThreadImportRejected.make({
+                  threadId,
+                  reason: "destination-conflict",
+                  message: "Admission, receipt, or immutable admission key already exists",
+                });
+              const previous = threadRows(staged, threadId, a.queueSequence - 1).next().value;
+
+              if (previous?.row.queueSequence === a.queueSequence)
+                return yield* invalidThreadArchive("Duplicate admission queue position", threadId);
+              if (a.settledAt !== undefined)
+                settledTimes.set(a.submissionId, DateTime.toEpochMillis(a.settledAt));
+              withSubmission(
+                staged,
+                fromRebuilt(
+                  RebuiltSubmission.make({
+                    admission: a,
+                    state: "admitted",
+                    unknownToolCallIds: [],
+                    approvals: [],
+                    resolutions: [],
+                  }),
+                ),
+              );
+            }
+            for (const fact of page.archive.commands.aborts) {
+              const stored = staged.submissions.get(fact.submissionId);
+
+              if (stored === undefined || stored.abortIntent !== undefined)
+                return yield* invalidThreadArchive(
+                  "Missing admission or duplicate abort",
+                  threadId,
+                );
+              const intent = AbortIntent.make(fact);
+
+              yield* retainCommandBytes(AbortIntent, intent, fact.submissionId);
+              withSubmission(staged, { ...stored, abortIntent: intent });
+            }
+            for (const fact of page.archive.commands.approvals) {
+              const stored = staged.submissions.get(fact.submissionId);
+
+              if (stored === undefined || stored.approvalDecisions.has(fact.toolCallId))
+                return yield* invalidThreadArchive(
+                  "Missing admission or duplicate approval",
+                  threadId,
+                );
+              if (stored.approvalDecisions.size >= MAX_RUN_EVIDENCE_RECORDS)
+                return yield* invalidThreadArchive(
+                  "Accepted approvals exceed Run record bounds",
+                  threadId,
+                );
+              const intent = ApprovalDecisionIntent.make(fact);
+
+              yield* retainCommandBytes(ApprovalDecisionIntent, intent, fact.submissionId);
+
+              const approvals = new Map(stored.approvalDecisions).set(fact.toolCallId, intent);
+
+              withSubmission(staged, { ...stored, approvalDecisions: approvals });
+            }
+            for (const fact of page.archive.commands.resolutions) {
+              const stored = staged.submissions.get(fact.submissionId);
+              const key = JSON.stringify([fact.toolCallId, unknownResolutionKind(fact.resolution)]);
+
+              if (stored === undefined || stored.unknownResolutions.has(key))
+                return yield* invalidThreadArchive(
+                  "Missing admission or duplicate resolution",
+                  threadId,
+                );
+              if (stored.unknownResolutions.size >= MAX_RUN_EVIDENCE_RECORDS)
+                return yield* invalidThreadArchive(
+                  "Accepted resolutions exceed Run record bounds",
+                  threadId,
+                );
+              const intent = UnknownResolutionIntent.make(fact);
+
+              yield* retainCommandBytes(UnknownResolutionIntent, intent, fact.submissionId);
+
+              const resolutions = new Map(stored.unknownResolutions).set(key, { intent });
+
+              withSubmission(staged, { ...stored, unknownResolutions: resolutions });
+            }
+          }),
+          prepareCommit: Effect.fnUntraced(function* (workerSeal) {
+            let lastQueue = 0;
+            let terminalEvidence = workerSeal?.terminal === undefined;
+
+            for (const stored of threadRows(staged, threadId)) {
+              const a = toAdmission(stored.row, settledTimes.get(stored.row.submissionId));
+              const rebuilt = yield* rebuildClosedSubmission(a);
+
+              if (
+                rebuilt.settlement !== undefined &&
+                workerTerminalFromRecord(toSnapshot(stored.row), rebuilt.settlement) ===
+                  workerSeal?.terminal
+              )
+                terminalEvidence = true;
+              withSubmission(staged, fromRebuilt(rebuilt));
+              lastQueue = Math.max(lastQueue, a.queueSequence);
+            }
+            if (!terminalEvidence)
+              return yield* invalidThreadArchive(
+                "Worker seal terminal has no exact completed input evidence",
+                threadId,
+              );
+            if (!Number.isSafeInteger(lastQueue + 1))
+              return yield* ThreadImportRejected.make({
+                threadId,
+                reason: "unsupported-capacity",
+                message: "Admission queue sequence is exhausted",
+              });
+
+            return () => {
+              for (const stored of staged.submissions.values()) withSubmission(current, stored);
+              current.lanes.set(threadId, { nextQueueSequence: lastQueue + 1 });
+              if (workerSeal !== undefined)
+                current.stoppedWorkers.set(threadId, workerSeal.terminal);
+            };
+          }),
+        };
+      }),
+    });
+
+    return Context.make(SubmissionLedger, ledger).pipe(
+      Context.add(SettlementPublisher, { publish }),
+    );
   });
 
 /** Construction options for the in-memory reference SubmissionLedger. */
@@ -2834,11 +3536,19 @@ export interface MemorySubmissionLedgerOptions {
 
 /**
  * In-memory reference SubmissionLedger Layer (durability `non-durable`). All state lives in one
- * `Ref` owned by the Layer's Scope; no daemon fibers are spawned and no wall clock is consulted.
+ * `Ref` owned by the Layer's Scope. Fresh identities use the supplied `Crypto` service;
+ * imported identities remain unchanged. No daemon fibers are spawned and no wall clock is consulted.
  */
 export const memorySubmissionLedgerLayer = (
   options: MemorySubmissionLedgerOptions = {},
-): Layer.Layer<SubmissionLedger> => Layer.effect(SubmissionLedger, makeSubmissionLedger(options));
-
-export const MemorySubmissionLedgerLive: Layer.Layer<SubmissionLedger> =
-  memorySubmissionLedgerLayer();
+): Layer.Layer<
+  SubmissionLedger | SettlementPublisher,
+  never,
+  MemoryThreadStoreKernel | Crypto.Crypto
+> => Layer.effectContext(makeSubmissionLedger(options));
+
+export const MemorySubmissionLedgerLive: Layer.Layer<
+  SubmissionLedger | SettlementPublisher,
+  never,
+  MemoryThreadStoreKernel | Crypto.Crypto
+> = memorySubmissionLedgerLayer();