@yielded/agent-storage-memory 0.1.0-beta.166

package/src/MemorySubmissionLedger.ts

@@ -0,0 +1,2844 @@
+import {
+  type ToolCallId,
+  AttemptId,
+  ReceiptId,
+  SubmissionId,
+  type AgentId,
+  type ThreadId,
+  type SettlementId,
+} from "@yielded/agent/identifiers";
+import { InputMessage } from "@yielded/agent/messaging";
+import {
+  PersistedJson,
+  WorkerAdmission,
+  ProducerEpoch,
+  type DefinitionDigests,
+  type DeploymentId,
+  type Digest,
+  type ProducerId,
+  type RecordEnvelope,
+  type SettlementOutcome,
+} from "@yielded/agent/records";
+import {
+  type ParentLinkage,
+  AbortCommand,
+  WorkerStopCommand,
+  WorkerLedgerState,
+  workerTerminalFromRecord,
+  AdmissionAdmitted,
+  AdmissionConflict,
+  AdmissionPolicyError,
+  AdmissionIndeterminate,
+  AdmissionNotAdmitted,
+  AdmissionRequest,
+  SubmissionAdmissionFence,
+  AdmissionResult,
+  ApprovalConflict,
+  ApprovalDecisionCommand,
+  ApprovalDecisionIntent,
+  AttachChildToReservationRequest,
+  BeginChildBudgetReleaseRequest,
+  ChildAttachmentSnapshot,
+  ChildBudgetReservationRequest,
+  ChildBudgetReservationSnapshot,
+  ChildReservationConflict,
+  ChildSettledNotification,
+  Claim,
+  ClaimJoiningRequest,
+  ClaimRequest,
+  DEFAULT_OWNERSHIP_LEASE_DURATION,
+  InputAppliedMarker,
+  JoinSnapshot,
+  JoinedToHost,
+  JoiningClaim,
+  LedgerCapabilities,
+  LedgerError,
+  MarkInputAppliedRequest,
+  MarkJoinedRequest,
+  MarkReadyRequest,
+  MarkUnknownRequest,
+  OwnershipLost,
+  OwnershipRenewal,
+  OwnershipSnapshot,
+  OwnershipToken,
+  QueueSequence,
+  RecoverySnapshot,
+  RecoverySnapshotRequest,
+  ReleaseChildBudgetRequest,
+  ReleaseOwnershipRequest,
+  RenewOwnershipRequest,
+  ReservedChildBudget,
+  ReservedSettlement,
+  RevertJoiningRequest,
+  Settlement,
+  SettlementConflict,
+  SettlementFinalization,
+  SettlementReservation,
+  SettlementReservationSnapshot,
+  settlementFailureFromRecord,
+  AbortIntent,
+  AbortIntentRequest,
+  SubmissionLedger,
+  SubmissionLookup,
+  SubmissionLookupByKey,
+  SubmissionSnapshot,
+  SubmissionWorkItem,
+  SuspendRequest,
+  SuspensionSnapshot,
+  UnknownResolution,
+  UnknownResolutionCommand,
+  UnknownResolutionConflict,
+  UnknownResolutionIntent,
+  type ChildReservationId,
+  type ChildReservationStatus,
+  type ChildSettledOutcome,
+  type IdempotencyKey,
+  type Principal,
+  type SubmissionState,
+  type SuspensionOutcome,
+  type SuspensionReason,
+} from "@yielded/agent/submission-ledger";
+import {
+  Clock,
+  Cause,
+  Exit,
+  Fiber,
+  DateTime,
+  Duration,
+  Effect,
+  Layer,
+  Option,
+  Ref,
+  Schema,
+  Stream,
+} from "effect";
+
+const MAX_SUBMISSIONS = 65_536;
+
+/**
+ * Lifecycle ordering used to advance-but-never-regress the operational state marker: a reclaimed
+ * Attempt must not erase progress markers (input-applied, terminalizing) that an earlier Attempt
+ * already committed.
+ */
+const STATE_RANK: Record<SubmissionState, number> = {
+  admitted: 0,
+  ready: 1,
+  joining: 2,
+  joined: 3,
+  running: 4,
+  "input-applied": 5,
+  suspended: 6,
+  unknown: 7,
+  terminalizing: 8,
+  settled: 9,
+};
+
+interface SubmissionRow {
+  readonly submissionId: SubmissionId;
+  readonly threadId: ThreadId;
+  readonly queueSequence: QueueSequence;
+  readonly principal: Principal;
+  readonly idempotencyKey: IdempotencyKey;
+  readonly agentId: AgentId;
+  readonly agentDigests: DefinitionDigests;
+  readonly deploymentId: DeploymentId;
+  readonly inputPayload: PersistedJson;
+  readonly inputDigest: Digest;
+  readonly receiptId: ReceiptId;
+  readonly state: SubmissionState;
+  readonly settledOutcome: SettlementOutcome | undefined;
+  readonly createdAtMillis: number;
+  readonly readyAtMillis: number | undefined;
+  /** Immutable child-side lineage recorded at admission (spec §12 step 5). */
+  readonly parentLinkage: ParentLinkage | undefined;
+  readonly admissionGroup?: string;
+  readonly admissionFence?: AdmissionRequest["admissionFence"];
+  readonly workerAdmissionJson?: string;
+  readonly messageAdmissionJson?: string;
+}
+
+interface StoredOwnership {
+  readonly attemptId: AttemptId;
+  readonly ownershipToken: OwnershipToken;
+  readonly producerEpoch: ProducerEpoch;
+  readonly ownerProducerId: ProducerId;
+  readonly leaseExpiresAtMillis: number;
+}
+
+interface StoredReservation {
+  readonly settlementId: SettlementId;
+  readonly outcome: SettlementOutcome;
+  readonly record: RecordEnvelope;
+  readonly recordDigest: Digest;
+  readonly finalizedAtMillis: number | undefined;
+}
+
+interface StoredSuspension {
+  readonly reason: SuspensionReason;
+  readonly suspendedAtMillis: number;
+}
+
+interface StoredUnknownMark {
+  readonly reason: MarkUnknownRequest["reason"];
+  readonly toolCallIds: ReadonlyArray<ToolCallId>;
+}
+
+interface StoredUnknownResolution {
+  readonly intent: UnknownResolutionIntent;
+}
+
+interface StoredSubmission {
+  readonly row: SubmissionRow;
+  readonly ownership: StoredOwnership | undefined;
+  readonly inputApplied: InputAppliedMarker | undefined;
+  readonly reservation: StoredReservation | undefined;
+  readonly abortIntent: AbortIntent | undefined;
+  /** Host linkage recorded at `claimJoining` time; cleared by `revertJoining` (DUR-016). */
+  readonly joinedHostSubmissionId: SubmissionId | undefined;
+  readonly suspension: StoredSuspension | undefined;
+  readonly unknownMark: StoredUnknownMark | undefined;
+  readonly approvalDecisions: ReadonlyMap<ToolCallId, ApprovalDecisionIntent>;
+  readonly unknownResolutions: ReadonlyMap<ToolCallId, StoredUnknownResolution>;
+}
+
+/**
+ * States in which `claim` never grants the head: the lane is host-owned (`joining`/`joined`)
+ * or durably suspended rather than worker-claimable. Unknown heads are checked against abort
+ * intent separately: abort authorizes cleanup and settlement, never ordinary Tool replay.
+ */
+const BLOCKED_HEAD_STATES: ReadonlySet<SubmissionState> = new Set([
+  "joining",
+  "joined",
+  "suspended",
+]);
+
+interface LaneState {
+  readonly nextQueueSequence: number;
+  readonly producerEpoch: number;
+}
+
+/** One parent-owned child budget reservation row (spec §12 steps 2 and 6). */
+interface StoredChildReservation {
+  readonly reservationId: ChildReservationId;
+  readonly parentSubmissionId: SubmissionId;
+  readonly parentToolCallId: ToolCallId;
+  readonly childSubmissionId: SubmissionId | undefined;
+  readonly status: ChildReservationStatus;
+  readonly allocation: PersistedJson;
+  readonly allocationDigest: Digest;
+  readonly accounting: PersistedJson | undefined;
+  readonly reservedAtMillis: number;
+  readonly releaseBeganAtMillis: number | undefined;
+  readonly releasedAtMillis: number | undefined;
+}
+
+interface LedgerState {
+  readonly submissions: ReadonlyMap<SubmissionId, StoredSubmission>;
+  readonly admissionIndex: ReadonlyMap<string, SubmissionId>;
+  readonly lanes: ReadonlyMap<ThreadId, LaneState>;
+  readonly childReservations: ReadonlyMap<ChildReservationId, StoredChildReservation>;
+  readonly mintCounter: number;
+  readonly latestByThread: ReadonlyMap<ThreadId, SubmissionId>;
+  readonly activeByThread: ReadonlyMap<ThreadId, ReadonlySet<SubmissionId>>;
+  readonly stoppedWorkers: ReadonlyMap<ThreadId, WorkerLedgerState["terminal"]>;
+}
+
+type Decision<A, E> =
+  | { readonly _tag: "failure"; readonly error: E }
+  | { readonly _tag: "success"; readonly value: A };
+
+const failure = <E>(error: E): Decision<never, E> => ({ _tag: "failure", error });
+const success = <A>(value: A): Decision<A, never> => ({ _tag: "success", value });
+
+const ledgerError = (operation: string, message: string, cause?: unknown): LedgerError =>
+  cause === undefined
+    ? LedgerError.make({ operation, message })
+    : LedgerError.make({ operation, message, cause });
+
+const validate = Effect.fn("MemorySubmissionLedger.validate")(
+  <A, I>(
+    schema: Schema.Codec<A, I>,
+    operation: string,
+    value: unknown,
+  ): Effect.Effect<A, LedgerError> =>
+    Schema.encodeUnknownEffect(schema)(value).pipe(
+      Effect.flatMap(Schema.decodeUnknownEffect(schema)),
+      Effect.mapError((error) => ledgerError(operation, `Invalid ${operation} request`, error)),
+    ),
+);
+
+const decodeSubmissionId = Schema.decodeSync(SubmissionId);
+const decodeReceiptId = Schema.decodeSync(ReceiptId);
+const decodeAttemptId = Schema.decodeSync(AttemptId);
+const decodeOwnershipToken = Schema.decodeSync(OwnershipToken);
+const decodeQueueSequence = Schema.decodeSync(QueueSequence);
+const decodeProducerEpoch = Schema.decodeSync(ProducerEpoch);
+const equivalentPersistedJson = Schema.toEquivalence(PersistedJson);
+const equivalentUnknownResolution = Schema.toEquivalence(UnknownResolution);
+
+const utc = (millis: number): DateTime.Utc => DateTime.toUtc(DateTime.makeUnsafe(millis));
+
+const admissionKey = (
+  threadId: ThreadId,
+  principal: Principal,
+  idempotencyKey: IdempotencyKey,
+): string => JSON.stringify([threadId, principal, idempotencyKey]);
+
+const toSnapshot = (row: SubmissionRow): SubmissionSnapshot =>
+  SubmissionSnapshot.make({
+    submissionId: row.submissionId,
+    threadId: row.threadId,
+    queueSequence: row.queueSequence,
+    principal: row.principal,
+    idempotencyKey: row.idempotencyKey,
+    agentId: row.agentId,
+    agentDigests: row.agentDigests,
+    deploymentId: row.deploymentId,
+    inputPayload: row.inputPayload,
+    inputDigest: row.inputDigest,
+    receiptId: row.receiptId,
+    state: row.state,
+    createdAt: utc(row.createdAtMillis),
+    ...(row.admissionGroup === undefined ? {} : { admissionGroup: row.admissionGroup }),
+    ...(row.admissionFence === undefined ? {} : { admissionFence: row.admissionFence }),
+    ...(row.workerAdmissionJson === undefined
+      ? {}
+      : {
+          workerAdmission: Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
+            row.workerAdmissionJson,
+          ),
+        }),
+    ...(row.messageAdmissionJson === undefined
+      ? {}
+      : {
+          messageAdmission: Schema.decodeSync(Schema.fromJsonString(InputMessage))(
+            row.messageAdmissionJson,
+          ),
+        }),
+    ...(row.settledOutcome === undefined ? {} : { settledOutcome: row.settledOutcome }),
+    ...(row.readyAtMillis === undefined ? {} : { readyAt: utc(row.readyAtMillis) }),
+    ...(row.parentLinkage === undefined ? {} : { parentLinkage: row.parentLinkage }),
+  });
+
+const toReservationSnapshot = (row: StoredChildReservation): ChildBudgetReservationSnapshot =>
+  ChildBudgetReservationSnapshot.make({
+    reservationId: row.reservationId,
+    parentSubmissionId: row.parentSubmissionId,
+    parentToolCallId: row.parentToolCallId,
+    status: row.status,
+    allocation: row.allocation,
+    allocationDigest: row.allocationDigest,
+    reservedAt: utc(row.reservedAtMillis),
+    ...(row.childSubmissionId === undefined ? {} : { childSubmissionId: row.childSubmissionId }),
+    ...(row.accounting === undefined ? {} : { accounting: row.accounting }),
+    ...(row.releaseBeganAtMillis === undefined
+      ? {}
+      : { releaseBeganAt: utc(row.releaseBeganAtMillis) }),
+    ...(row.releasedAtMillis === undefined ? {} : { releasedAt: utc(row.releasedAtMillis) }),
+  });
+
+/** Linkage equality: both absent, or both present naming the same parent Tool Call. */
+const sameParentLinkage = (
+  left: ParentLinkage | undefined,
+  right: ParentLinkage | undefined,
+): boolean =>
+  left === undefined
+    ? right === undefined
+    : right !== undefined &&
+      left.parentSubmissionId === right.parentSubmissionId &&
+      left.parentToolCallId === right.parentToolCallId;
+
+const laneEpoch = (state: LedgerState, threadId: ThreadId): number =>
+  state.lanes.get(threadId)?.producerEpoch ?? 0;
+
+const ownershipLost = (state: LedgerState, stored: StoredSubmission): OwnershipLost =>
+  OwnershipLost.make({
+    submissionId: stored.row.submissionId,
+    actualEpoch: decodeProducerEpoch(laneEpoch(state, stored.row.threadId)),
+  });
+
+/** A retained row token cannot outlive a newer owner of the same Thread. */
+const ownsLane = (
+  state: LedgerState,
+  stored: StoredSubmission,
+  ownershipToken: OwnershipToken,
+): boolean =>
+  stored.ownership !== undefined &&
+  stored.ownership.ownershipToken === ownershipToken &&
+  stored.ownership.producerEpoch === laneEpoch(state, stored.row.threadId);
+
+const withSubmission = (state: LedgerState, stored: StoredSubmission): LedgerState => {
+  const active = new Set(state.activeByThread.get(stored.row.threadId));
+
+  if (stored.row.state === "settled") active.delete(stored.row.submissionId);
+  else active.add(stored.row.submissionId);
+
+  return {
+    ...state,
+    submissions: new Map(state.submissions).set(stored.row.submissionId, stored),
+    activeByThread: new Map(state.activeByThread).set(stored.row.threadId, active),
+  };
+};
+
+const withChildReservation = (
+  state: LedgerState,
+  reservation: StoredChildReservation,
+): LedgerState => ({
+  ...state,
+  childReservations: new Map(state.childReservations).set(reservation.reservationId, reservation),
+});
+
+const findHead = (state: LedgerState, threadId: ThreadId): StoredSubmission | undefined => {
+  let head: StoredSubmission | undefined;
+
+  for (const stored of state.submissions.values()) {
+    if (
+      stored.row.threadId !== threadId ||
+      stored.row.state === "settled" ||
+      (stored.row.state === "unknown" && stored.abortIntent === undefined)
+    )
+      continue;
+    if (head === undefined || stored.row.queueSequence < head.row.queueSequence) head = stored;
+  }
+
+  return head;
+};
+
+/**
+ * Reference in-memory SubmissionLedger. It implements the full port contract — atomic idempotent
+ * admission, eligible FIFO claims, producer-epoch fencing, Clock-driven ownership leases, idempotent
+ * settlement reservation/finalization, and durable abort intent — with every transition applied
+ * as one atomic `Ref.modify`, but its state does not survive the process (`non-durable`).
+ *
+ * Adapter-specific semantics within the port's latitude:
+ *
+ * - Time comes exclusively from the Effect `Clock` service, so `TestClock` drives lease expiry
+ *   deterministically; no wall clock is consulted.
+ * - The ownership lease is pinned to `DEFAULT_OWNERSHIP_LEASE_DURATION` (D5); durable adapters
+ *   own the configuration seam.
+ * - Any live lease in the Thread blocks every new claim, including the same `producerId`.
+ *   Unresolved unknown work is skipped only after ownership is released or expires.
+ * - Claiming advances `ready` to `running` and otherwise preserves the recorded state, so
+ *   progress markers from an earlier Attempt survive a reclaim.
+ * - `renewOwnership` keeps the token stable (the port allows rotation); a replayed admission
+ *   reports the Submission's current state alongside the original identities.
+ * - `claimJoining` walks the strictly-later queue: rows already `joining`/`joined` to the
+ *   SAME host extend the claimed prefix and are skipped, and an aborted-settled row is a
+ *   closed obligation that is also skipped (P7 §7(c)); any other non-`ready` row (an
+ *   `admitted` gap, a non-aborted settled row, foreign-host linkage) breaks the prefix
+ *   conservatively.
+ * - `markJoined` verifies the token against the HOST's live ownership (the lane is
+ *   host-owned), so a later host Attempt can repair a lost marker from history (DUR-016). The
+ *   join marker reuses the input-applied marker: the joined input IS `input:{sid}`.
+ * - `suspend` and `markUnknown` refuse when an exact settlement is already reserved
+ *   (`SettlementConflict` with the reserved outcome) — DUR-011's reservation wins.
+ * - `resolveAdmission` derives its answer from the single strongly consistent store, so it
+ *   never answers `Indeterminate` on its own; the test-only `resolveAdmissionFault` option
+ *   injects the `Indeterminate` classification so SUB-031 callers can be conformance-tested.
+ * - `recordChildSettled` and `suspend(WaitingForChild)` observe child settlement directly from
+ *   the child rows (single-store latitude); no separate notification marker is stored.
+ */
+const makeSubmissionLedger = (options: MemorySubmissionLedgerOptions = {}) =>
+  Effect.gen(function* () {
+    const state = yield* Ref.make<LedgerState>({
+      submissions: new Map(),
+      admissionIndex: new Map(),
+      lanes: new Map(),
+      childReservations: new Map(),
+      mintCounter: 0,
+      stoppedWorkers: new Map(),
+      latestByThread: new Map(),
+      activeByThread: new Map(),
+    });
+
+    const admissionFence = yield* SubmissionAdmissionFence;
+    const leaseMillis = Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION);
+
+    const capabilities = Effect.succeed(LedgerCapabilities.make({ durability: "non-durable" }));
+
+    const admit: SubmissionLedger["Service"]["admit"] = Effect.fn("MemorySubmissionLedger.admit")(
+      (unvalidated) =>
+        Effect.gen(function* () {
+          const request = yield* validate(AdmissionRequest, "admit", unvalidated);
+
+          const workerAdmissionJson =
+            request.workerAdmission === undefined
+              ? undefined
+              : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(
+                  request.workerAdmission,
+                ).pipe(
+                  Effect.mapError(() => ledgerError("admit", "Invalid worker admission metadata")),
+                );
+
+          const messageAdmissionJson =
+            request.messageAdmission === undefined
+              ? undefined
+              : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(
+                  request.messageAdmission,
+                ).pipe(
+                  Effect.mapError(() => ledgerError("admit", "Invalid message admission metadata")),
+                );
+
+          const nowMillis = yield* Clock.currentTimeMillis;
+          const services = yield* Effect.context<never>();
+
+          const decision = yield* Ref.modify(
+            state,
+            (
+              current,
+            ): readonly [
+              (
+                | Decision<AdmissionResult, AdmissionConflict | AdmissionPolicyError | LedgerError>
+                | { readonly _tag: "cause"; readonly cause: Cause.Cause<AdmissionPolicyError> }
+              ),
+              LedgerState,
+            ] => {
+              const key = admissionKey(request.threadId, request.principal, request.idempotencyKey);
+              const existingId = current.admissionIndex.get(key);
+
+              if (existingId !== undefined) {
+                const existing = current.submissions.get(existingId);
+
+                if (existing === undefined) {
+                  return [
+                    failure(
+                      ledgerError("admit", "Admission index references a missing Submission"),
+                    ),
+                    current,
+                  ];
+                }
+                // A replay must repeat the exact canonical input AND the exact parent linkage
+                // (or its absence): linkage is immutable lineage (spec §12 step 5, SUB-016).
+                if (
+                  existing.row.inputDigest !== request.inputDigest ||
+                  !sameParentLinkage(existing.row.parentLinkage, request.parentLinkage) ||
+                  existing.row.admissionGroup !== request.admissionGroup ||
+                  !Schema.toEquivalence(Schema.optional(WorkerAdmission))(
+                    existing.row.workerAdmissionJson === undefined
+                      ? undefined
+                      : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
+                          existing.row.workerAdmissionJson,
+                        ),
+                    request.workerAdmission,
+                  ) ||
+                  !Schema.toEquivalence(Schema.optional(InputMessage))(
+                    existing.row.messageAdmissionJson === undefined
+                      ? undefined
+                      : Schema.decodeSync(Schema.fromJsonString(InputMessage))(
+                          existing.row.messageAdmissionJson,
+                        ),
+                    request.messageAdmission,
+                  ) ||
+                  !Schema.toEquivalence(Schema.optional(Schema.Json))(
+                    existing.row.admissionFence,
+                    request.admissionFence,
+                  )
+                ) {
+                  return [
+                    failure(
+                      AdmissionConflict.make({
+                        threadId: request.threadId,
+                        principal: request.principal,
+                        idempotencyKey: request.idempotencyKey,
+                        existingInputDigest: existing.row.inputDigest,
+                        attemptedInputDigest: request.inputDigest,
+                      }),
+                    ),
+                    current,
+                  ];
+                }
+
+                return [
+                  success(
+                    AdmissionResult.make({
+                      submissionId: existing.row.submissionId,
+                      receiptId: existing.row.receiptId,
+                      queueSequence: existing.row.queueSequence,
+                      state: existing.row.state,
+                      replayed: true,
+                    }),
+                  ),
+                  current,
+                ];
+              }
+
+              if (current.stoppedWorkers.has(request.threadId))
+                return [
+                  failure(AdmissionPolicyError.make({ reason: "refused", code: "worker-stopped" })),
+                  current,
+                ];
+
+              // A Thread's first admission fixes its worker origin before canonical materialization.
+              const first = [...current.submissions.values()].find(
+                ({ row }) => row.threadId === request.threadId,
+              );
+
+              if (first !== undefined) {
+                const previous =
+                  first.row.workerAdmissionJson === undefined
+                    ? undefined
+                    : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(
+                        first.row.workerAdmissionJson,
+                      );
+
+                if (
+                  !Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(
+                    previous?.origin,
+                    request.workerAdmission?.origin,
+                  )
+                )
+                  return [
+                    failure(
+                      AdmissionPolicyError.make({
+                        reason: "refused",
+                        code: "worker-origin-conflict",
+                      }),
+                    ),
+                    current,
+                  ];
+              }
+              // A memory policy and the ledger mutation share one synchronous critical section.
+              // An asynchronous policy cannot fence this Ref and therefore fails closed.
+              const checked = Effect.runSyncExitWith(services)(admissionFence.check(request));
+
+              if (Exit.isFailure(checked)) {
+                return [{ _tag: "cause", cause: checked.cause }, current];
+              }
+              if (
+                request.admissionGroup !== undefined &&
+                [...current.submissions.values()].some(
+                  ({ row }) =>
+                    row.threadId === request.threadId &&
+                    row.admissionGroup === request.admissionGroup &&
+                    row.state !== "settled",
+                )
+              )
+                return [
+                  failure(
+                    AdmissionPolicyError.make({ reason: "occupied", code: "admission-group" }),
+                  ),
+                  current,
+                ];
+              if (current.submissions.size >= MAX_SUBMISSIONS) {
+                return [
+                  failure(
+                    ledgerError("admit", `In-memory submission limit ${MAX_SUBMISSIONS} exceeded`),
+                  ),
+                  current,
+                ];
+              }
+
+              const lane = current.lanes.get(request.threadId) ?? {
+                nextQueueSequence: 1,
+                producerEpoch: 0,
+              };
+
+              const mintCounter = current.mintCounter + 1;
+
+              const row: SubmissionRow = {
+                submissionId: decodeSubmissionId(`submission-memory-${mintCounter}`),
+                threadId: request.threadId,
+                queueSequence: decodeQueueSequence(lane.nextQueueSequence),
+                principal: request.principal,
+                idempotencyKey: request.idempotencyKey,
+                agentId: request.agentId,
+                agentDigests: request.agentDigests,
+                deploymentId: request.deploymentId,
+                inputPayload: request.inputPayload,
+                inputDigest: request.inputDigest,
+                receiptId: decodeReceiptId(`receipt-memory-${mintCounter}`),
+                state: "admitted",
+                settledOutcome: undefined,
+                createdAtMillis: nowMillis,
+                readyAtMillis: undefined,
+                parentLinkage: request.parentLinkage,
+                ...(workerAdmissionJson === undefined ? {} : { workerAdmissionJson }),
+                ...(messageAdmissionJson === undefined ? {} : { messageAdmissionJson }),
+                ...(request.admissionGroup === undefined
+                  ? {}
+                  : { admissionGroup: request.admissionGroup }),
+                ...(request.admissionFence === undefined
+                  ? {}
+                  : { admissionFence: request.admissionFence }),
+              };
+
+              const submissions = new Map(current.submissions).set(row.submissionId, {
+                row,
+                ownership: undefined,
+                inputApplied: undefined,
+                reservation: undefined,
+                abortIntent: undefined,
+                joinedHostSubmissionId: undefined,
+                suspension: undefined,
+                unknownMark: undefined,
+                approvalDecisions: new Map<ToolCallId, ApprovalDecisionIntent>(),
+                unknownResolutions: new Map<ToolCallId, StoredUnknownResolution>(),
+              });
+
+              const admissionIndex = new Map(current.admissionIndex).set(key, row.submissionId);
+
+              const lanes = new Map(current.lanes).set(request.threadId, {
+                nextQueueSequence: lane.nextQueueSequence + 1,
+                producerEpoch: lane.producerEpoch,
+              });
+
+              return [
+                success(
+                  AdmissionResult.make({
+                    submissionId: row.submissionId,
+                    receiptId: row.receiptId,
+                    queueSequence: row.queueSequence,
+                    state: row.state,
+                    replayed: false,
+                  }),
+                ),
+                {
+                  ...current,
+                  submissions,
+                  admissionIndex,
+                  lanes,
+                  mintCounter,
+                  latestByThread: new Map(current.latestByThread).set(
+                    request.threadId,
+                    row.submissionId,
+                  ),
+                  activeByThread: new Map(current.activeByThread).set(
+                    request.threadId,
+                    new Set([
+                      ...(current.activeByThread.get(request.threadId) ?? []),
+                      row.submissionId,
+                    ]),
+                  ),
+                },
+              ];
+            },
+          );
+
+          if (decision._tag === "failure") return yield* decision.error;
+          if (decision._tag === "cause") {
+            for (const reason of decision.cause.reasons) {
+              if (Cause.isDieReason(reason) && Cause.isAsyncFiberError(reason.defect)) {
+                yield* Fiber.interrupt(reason.defect.fiber);
+
+                return yield* AdmissionPolicyError.make({
+                  reason: "unavailable",
+                  code: "synchronous-memory-policy-required",
+                });
+              }
+            }
+
+            return yield* Effect.failCause(decision.cause);
+          }
+
+          return decision.value;
+        }),
+      Effect.uninterruptible,
+    );
+
+    const markReady: SubmissionLedger["Service"]["markReady"] = Effect.fn(
+      "MemorySubmissionLedger.markReady",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(MarkReadyRequest, "markReady", unvalidated);
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const decision = yield* Ref.modify(
+          state,
+          (current): readonly [Decision<void, LedgerError>, LedgerState] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(ledgerError("markReady", `Unknown Submission ${request.submissionId}`)),
+                current,
+              ];
+            }
+            if (stored.row.state !== "admitted") return [success(undefined), current];
+
+            return [
+              success(undefined),
+              withSubmission(current, {
+                ...stored,
+                row: { ...stored.row, state: "ready", readyAtMillis: nowMillis },
+              }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+      }),
+    );
+
+    const lookup: SubmissionLedger["Service"]["lookup"] = Effect.fn(
+      "MemorySubmissionLedger.lookup",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(SubmissionLookup, "lookup", unvalidated);
+        const current = yield* Ref.get(state);
+
+        const submissionId =
+          request._tag === "SubmissionLookupById"
+            ? request.submissionId
+            : current.admissionIndex.get(
+                admissionKey(request.threadId, request.principal, request.idempotencyKey),
+              );
+
+        const stored =
+          submissionId === undefined ? undefined : current.submissions.get(submissionId);
+
+        return stored === undefined ? Option.none() : Option.some(toSnapshot(stored.row));
+      }),
+    );
+
+    const resolveAdmission: SubmissionLedger["Service"]["resolveAdmission"] = Effect.fn(
+      "MemorySubmissionLedger.resolveAdmission",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(SubmissionLookupByKey, "resolveAdmission", unvalidated);
+
+        // Test-only fault seam: lets suites exercise the Indeterminate classification that a
+        // single strongly consistent store never produces on its own (SUB-031, P6 honesty).
+        if (options.resolveAdmissionFault !== undefined) {
+          const fault = yield* options.resolveAdmissionFault;
+
+          if (Option.isSome(fault)) {
+            return AdmissionIndeterminate.make({ reason: fault.value });
+          }
+        }
+        const current = yield* Ref.get(state);
+
+        const submissionId = current.admissionIndex.get(
+          admissionKey(request.threadId, request.principal, request.idempotencyKey),
+        );
+
+        const stored =
+          submissionId === undefined ? undefined : current.submissions.get(submissionId);
+
+        return stored === undefined
+          ? AdmissionNotAdmitted.make()
+          : AdmissionAdmitted.make({ submission: toSnapshot(stored.row) });
+      }),
+    );
+
+    const claim: SubmissionLedger["Service"]["claim"] = Effect.fn("MemorySubmissionLedger.claim")(
+      (unvalidated) =>
+        Effect.gen(function* () {
+          const request = yield* validate(ClaimRequest, "claim", unvalidated);
+          const nowMillis = yield* Clock.currentTimeMillis;
+
+          const decision = yield* Ref.modify(
+            state,
+            (current): readonly [Decision<Option.Option<Claim>, LedgerError>, LedgerState] => {
+              for (const stored of current.submissions.values()) {
+                if (
+                  stored.row.threadId === request.threadId &&
+                  stored.ownership !== undefined &&
+                  stored.ownership.leaseExpiresAtMillis > nowMillis
+                ) {
+                  return [success(Option.none()), current];
+                }
+              }
+              let head = findHead(current, request.threadId);
+
+              if (request.handoff !== undefined) {
+                const handoff = request.handoff;
+
+                if (current.lanes.get(request.threadId)?.producerEpoch !== handoff.producerEpoch)
+                  return [success(Option.none()), current];
+
+                const candidates = [...current.submissions.values()]
+                  .filter(
+                    (entry) =>
+                      entry.row.threadId === request.threadId &&
+                      entry.row.state !== "settled" &&
+                      !(entry.row.state === "unknown" && entry.abortIntent === undefined),
+                  )
+                  .sort((a, b) => a.row.queueSequence - b.row.queueSequence);
+
+                for (const candidate of candidates) {
+                  if (candidate.row.submissionId === handoff.submissionId) {
+                    head = candidate;
+                    break;
+                  }
+                  if (
+                    !handoff.deferredSubmissionIds.includes(candidate.row.submissionId) ||
+                    candidate.row.state !== "input-applied" ||
+                    candidate.abortIntent !== undefined
+                  )
+                    return [success(Option.none()), current];
+                }
+                if (
+                  head?.row.submissionId !== handoff.submissionId ||
+                  (head.row.state !== "ready" &&
+                    head.row.state !== "running" &&
+                    head.row.state !== "input-applied")
+                )
+                  return [success(Option.none()), current];
+              }
+
+              if (head === undefined) return [success(Option.none()), current];
+              if (BLOCKED_HEAD_STATES.has(head.row.state)) return [success(Option.none()), current];
+              const lane = current.lanes.get(request.threadId);
+
+              if (lane === undefined) {
+                return [
+                  failure(ledgerError("claim", "Claimable head without a Thread lane")),
+                  current,
+                ];
+              }
+              const producerEpoch = decodeProducerEpoch(lane.producerEpoch + 1);
+              const mintCounter = current.mintCounter + 1;
+
+              const ownership: StoredOwnership = {
+                attemptId: decodeAttemptId(`attempt-memory-${mintCounter}`),
+                ownershipToken: decodeOwnershipToken(`ownership-memory-${mintCounter}`),
+                producerEpoch,
+                ownerProducerId: request.producerId,
+                leaseExpiresAtMillis: nowMillis + leaseMillis,
+              };
+
+              const row: SubmissionRow =
+                head.row.state === "ready" ? { ...head.row, state: "running" } : head.row;
+
+              const next = withSubmission(current, { ...head, row, ownership });
+
+              const lanes = new Map(next.lanes).set(request.threadId, {
+                nextQueueSequence: lane.nextQueueSequence,
+                producerEpoch: lane.producerEpoch + 1,
+              });
+
+              return [
+                success(
+                  Option.some(
+                    Claim.make({
+                      submissionId: row.submissionId,
+                      attemptId: ownership.attemptId,
+                      ownershipToken: ownership.ownershipToken,
+                      producerEpoch,
+                      leaseExpiresAt: utc(ownership.leaseExpiresAtMillis),
+                      inputPayload: row.inputPayload,
+                    }),
+                  ),
+                ),
+                { ...next, lanes, mintCounter },
+              ];
+            },
+          );
+
+          if (decision._tag === "failure") return yield* decision.error;
+
+          return decision.value;
+        }),
+    );
+
+    const renewOwnership: SubmissionLedger["Service"]["renewOwnership"] = Effect.fn(
+      "MemorySubmissionLedger.renewOwnership",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(RenewOwnershipRequest, "renewOwnership", unvalidated);
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [Decision<OwnershipRenewal, OwnershipLost | LedgerError>, LedgerState] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(
+                  ledgerError("renewOwnership", `Unknown Submission ${request.submissionId}`),
+                ),
+                current,
+              ];
+            }
+            if (
+              stored.ownership === undefined ||
+              !ownsLane(current, stored, request.ownershipToken)
+            ) {
+              return [failure(ownershipLost(current, stored)), current];
+            }
+
+            const ownership: StoredOwnership = {
+              ...stored.ownership,
+              leaseExpiresAtMillis: nowMillis + leaseMillis,
+            };
+
+            return [
+              success(
+                OwnershipRenewal.make({
+                  ownershipToken: ownership.ownershipToken,
+                  leaseExpiresAt: utc(ownership.leaseExpiresAtMillis),
+                }),
+              ),
+              withSubmission(current, { ...stored, ownership }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const releaseOwnership: SubmissionLedger["Service"]["releaseOwnership"] = Effect.fn(
+      "MemorySubmissionLedger.releaseOwnership",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(ReleaseOwnershipRequest, "releaseOwnership", unvalidated);
+
+        const decision = yield* Ref.modify(
+          state,
+          (current): readonly [Decision<void, OwnershipLost | LedgerError>, LedgerState] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(
+                  ledgerError("releaseOwnership", `Unknown Submission ${request.submissionId}`),
+                ),
+                current,
+              ];
+            }
+            if (!ownsLane(current, stored, request.ownershipToken)) {
+              return [failure(ownershipLost(current, stored)), current];
+            }
+
+            return [
+              success(undefined),
+              withSubmission(current, { ...stored, ownership: undefined }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+      }),
+    );
+
+    const markInputApplied: SubmissionLedger["Service"]["markInputApplied"] = Effect.fn(
+      "MemorySubmissionLedger.markInputApplied",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(MarkInputAppliedRequest, "markInputApplied", unvalidated);
+
+        const decision = yield* Ref.modify(
+          state,
+          (current): readonly [Decision<void, OwnershipLost | LedgerError>, LedgerState] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(
+                  ledgerError("markInputApplied", `Unknown Submission ${request.submissionId}`),
+                ),
+                current,
+              ];
+            }
+            if (!ownsLane(current, stored, request.ownershipToken)) {
+              return [failure(ownershipLost(current, stored)), current];
+            }
+
+            if (stored.inputApplied !== undefined) {
+              if (
+                stored.inputApplied.recordId === request.recordId &&
+                stored.inputApplied.sequence === request.sequence
+              ) {
+                return [success(undefined), current];
+              }
+
+              return [
+                failure(
+                  ledgerError(
+                    "markInputApplied",
+                    `A different canonical input marker is already recorded for Submission ${request.submissionId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+
+            const marker = InputAppliedMarker.make({
+              recordId: request.recordId,
+              sequence: request.sequence,
+            });
+
+            const row: SubmissionRow =
+              STATE_RANK[stored.row.state] < STATE_RANK["input-applied"]
+                ? { ...stored.row, state: "input-applied" }
+                : stored.row;
+
+            return [
+              success(undefined),
+              withSubmission(current, { ...stored, row, inputApplied: marker }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+      }),
+    );
+
+    const reserveSettlement: SubmissionLedger["Service"]["reserveSettlement"] = Effect.fn(
+      "MemorySubmissionLedger.reserveSettlement",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(SettlementReservation, "reserveSettlement", unvalidated);
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<ReservedSettlement, SettlementConflict | OwnershipLost | LedgerError>,
+            LedgerState,
+          ] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(
+                  ledgerError("reserveSettlement", `Unknown Submission ${request.submissionId}`),
+                ),
+                current,
+              ];
+            }
+
+            // A `joined` Submission settles WITH its host (plan §2.5) and its lane is never
+            // worker-claimable, so no ownership token can exist for it: the recorded host
+            // linkage authorizes the reservation and the presented token is not consulted.
+            const joinedSettlement =
+              stored.row.state === "joined" && stored.joinedHostSubmissionId !== undefined;
+
+            // P7 §7(c): an aborted, never-claimed, still-queued Submission likewise has no
+            // live ownership to fence against — its durable abort intent authorizes exactly
+            // its ABORTED settlement (`terminalizing` is the same pass's crash replay). Every
+            // other reservation stays fenced by the target lane's live ownership.
+            const queuedAbortSettlement =
+              request.outcome === "aborted" &&
+              stored.abortIntent !== undefined &&
+              stored.ownership === undefined &&
+              (stored.row.state === "ready" || stored.row.state === "terminalizing");
+
+            if (
+              !joinedSettlement &&
+              !queuedAbortSettlement &&
+              !ownsLane(current, stored, request.ownershipToken)
+            ) {
+              return [failure(ownershipLost(current, stored)), current];
+            }
+            const existing = stored.reservation;
+
+            if (existing !== undefined) {
+              if (
+                existing.settlementId !== request.settlementId ||
+                existing.outcome !== request.outcome ||
+                existing.recordDigest !== request.recordDigest
+              ) {
+                return [
+                  failure(
+                    SettlementConflict.make({
+                      submissionId: request.submissionId,
+                      existingOutcome: existing.outcome,
+                    }),
+                  ),
+                  current,
+                ];
+              }
+
+              return [
+                success(
+                  ReservedSettlement.make({
+                    submissionId: request.submissionId,
+                    settlementId: existing.settlementId,
+                    outcome: existing.outcome,
+                    record: existing.record,
+                    recordDigest: existing.recordDigest,
+                    replayed: true,
+                  }),
+                ),
+                current,
+              ];
+            }
+
+            const reservation: StoredReservation = {
+              settlementId: request.settlementId,
+              outcome: request.outcome,
+              record: request.record,
+              recordDigest: request.recordDigest,
+              finalizedAtMillis: undefined,
+            };
+
+            const row: SubmissionRow =
+              STATE_RANK[stored.row.state] < STATE_RANK.terminalizing
+                ? { ...stored.row, state: "terminalizing" }
+                : stored.row;
+
+            return [
+              success(
+                ReservedSettlement.make({
+                  submissionId: request.submissionId,
+                  settlementId: reservation.settlementId,
+                  outcome: reservation.outcome,
+                  record: reservation.record,
+                  recordDigest: reservation.recordDigest,
+                  replayed: false,
+                }),
+              ),
+              withSubmission(current, { ...stored, row, reservation }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const finalizeSettlement: SubmissionLedger["Service"]["finalizeSettlement"] = Effect.fn(
+      "MemorySubmissionLedger.finalizeSettlement",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(SettlementFinalization, "finalizeSettlement", unvalidated);
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [Decision<Settlement, SettlementConflict | LedgerError>, LedgerState] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(
+                  ledgerError("finalizeSettlement", `Unknown Submission ${request.submissionId}`),
+                ),
+                current,
+              ];
+            }
+            const reservation = stored.reservation;
+
+            if (reservation === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "finalizeSettlement",
+                    `No settlement reservation for Submission ${request.submissionId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            const settlementFailure = settlementFailureFromRecord(reservation.record);
+
+            if ((reservation.outcome === "failed") !== (settlementFailure !== undefined)) {
+              return [
+                failure(
+                  ledgerError(
+                    "finalizeSettlement",
+                    `Settlement reservation for Submission ${request.submissionId} has contradictory failure evidence`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            if (reservation.settlementId !== request.settlementId) {
+              return [
+                failure(
+                  SettlementConflict.make({
+                    submissionId: request.submissionId,
+                    existingOutcome: reservation.outcome,
+                  }),
+                ),
+                current,
+              ];
+            }
+            if (reservation.finalizedAtMillis !== undefined) {
+              return [
+                success(
+                  Settlement.make({
+                    submissionId: stored.row.submissionId,
+                    settlementId: reservation.settlementId,
+                    receiptId: stored.row.receiptId,
+                    outcome: reservation.outcome,
+                    ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
+                    settledAt: utc(reservation.finalizedAtMillis),
+                  }),
+                ),
+                current,
+              ];
+            }
+
+            const terminal =
+              stored.row.workerAdmissionJson === undefined
+                ? undefined
+                : workerTerminalFromRecord(toSnapshot(stored.row), reservation.record);
+
+            const latestId = current.latestByThread.get(stored.row.threadId);
+            const latest = latestId === undefined ? undefined : current.submissions.get(latestId);
+
+            const pendingNewer =
+              terminal === "completed" &&
+              latest !== undefined &&
+              latest.row.queueSequence > stored.row.queueSequence &&
+              !(
+                latest.joinedHostSubmissionId === stored.row.submissionId &&
+                latest.inputApplied !== undefined
+              );
+
+            let sealed = current;
+
+            if (
+              terminal !== undefined &&
+              !pendingNewer &&
+              !current.stoppedWorkers.has(stored.row.threadId)
+            ) {
+              const submissions = new Map(current.submissions);
+
+              for (const id of current.activeByThread.get(stored.row.threadId) ?? []) {
+                const other = submissions.get(id);
+
+                if (other === undefined) continue;
+                if (
+                  id !== stored.row.submissionId &&
+                  !(
+                    other.joinedHostSubmissionId === stored.row.submissionId &&
+                    other.inputApplied !== undefined
+                  ) &&
+                  other.abortIntent === undefined
+                ) {
+                  submissions.set(id, {
+                    ...other,
+                    abortIntent: AbortIntent.make({
+                      submissionId: id,
+                      author: stored.row.principal,
+                      reason: `Worker assignment ${terminal}`,
+                      requestedAt: utc(nowMillis),
+                    }),
+                  });
+                }
+              }
+              sealed = {
+                ...current,
+                submissions,
+                stoppedWorkers: new Map(current.stoppedWorkers).set(stored.row.threadId, terminal),
+              };
+            }
+
+            const next = withSubmission(sealed, {
+              ...stored,
+              row: { ...stored.row, state: "settled", settledOutcome: reservation.outcome },
+              ownership: undefined,
+              reservation: { ...reservation, finalizedAtMillis: nowMillis },
+            });
+
+            return [
+              success(
+                Settlement.make({
+                  submissionId: stored.row.submissionId,
+                  settlementId: reservation.settlementId,
+                  receiptId: stored.row.receiptId,
+                  outcome: reservation.outcome,
+                  ...(settlementFailure === undefined ? {} : { failure: settlementFailure }),
+                  settledAt: utc(nowMillis),
+                }),
+              ),
+              next,
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const inspectWorker = Effect.fn("MemorySubmissionLedger.inspectWorker")(function* (
+      threadId: ThreadId,
+    ) {
+      const current = yield* Ref.get(state);
+      const latestId = current.latestByThread.get(threadId);
+      const latest = latestId === undefined ? undefined : current.submissions.get(latestId);
+
+      const active = [...(current.activeByThread.get(threadId) ?? [])]
+        .flatMap((id) => {
+          const row = current.submissions.get(id);
+
+          return row === undefined ? [] : [row];
+        })
+        .sort((a, b) => a.row.queueSequence - b.row.queueSequence)[0];
+
+      const terminal = current.stoppedWorkers.get(threadId);
+
+      return WorkerLedgerState.make({
+        latest: latest === undefined ? null : toSnapshot(latest.row),
+        active: active === undefined ? null : toSnapshot(active.row),
+        stopped: current.stoppedWorkers.has(threadId),
+        ...(terminal === undefined ? {} : { terminal }),
+      });
+    });
+
+    const stopWorker = Effect.fn("MemorySubmissionLedger.stopWorker")(function* (
+      unvalidated: WorkerStopCommand,
+    ) {
+      const request = yield* validate(WorkerStopCommand, "stopWorker", unvalidated);
+      const now = yield* Clock.currentTimeMillis;
+
+      return yield* Ref.modify(state, (current) => {
+        const submissions = new Map(current.submissions);
+        let owned = 0;
+
+        for (const id of current.activeByThread.get(request.threadId) ?? []) {
+          const stored = submissions.get(id);
+
+          if (stored === undefined) continue;
+          if (stored.ownership !== undefined) owned++;
+          if (stored.abortIntent === undefined)
+            submissions.set(id, {
+              ...stored,
+              abortIntent: AbortIntent.make({
+                submissionId: id,
+                author: request.author,
+                reason: "Worker owner stopped the worker",
+                requestedAt: utc(now),
+              }),
+            });
+        }
+
+        return [
+          owned,
+          {
+            ...current,
+            submissions,
+            stoppedWorkers: current.stoppedWorkers.has(request.threadId)
+              ? current.stoppedWorkers
+              : new Map(current.stoppedWorkers).set(request.threadId, undefined),
+          },
+        ] as const;
+      });
+    });
+
+    const requestAbort: SubmissionLedger["Service"]["requestAbort"] = Effect.fn(
+      "MemorySubmissionLedger.requestAbort",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(AbortCommand, "requestAbort", unvalidated);
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<AbortIntent, SettlementConflict | JoinedToHost | LedgerError>,
+            LedgerState,
+          ] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(ledgerError("requestAbort", `Unknown Submission ${request.submissionId}`)),
+                current,
+              ];
+            }
+            // A joined Submission settles WITH its host; the abort target is the host (plan
+            // §2.5). A joining Submission still records the intent: it is honored only if the
+            // host has not consumed the input (revert-then-abort).
+            if (stored.row.state === "joined") {
+              if (stored.joinedHostSubmissionId === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "requestAbort",
+                      `Joined Submission ${request.submissionId} is missing its host linkage`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+
+              return [
+                failure(
+                  JoinedToHost.make({
+                    submissionId: request.submissionId,
+                    hostSubmissionId: stored.joinedHostSubmissionId,
+                  }),
+                ),
+                current,
+              ];
+            }
+            if (stored.row.state === "settled") {
+              if (stored.row.settledOutcome === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "requestAbort",
+                      `Settled Submission ${request.submissionId} is missing its outcome`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+
+              return [
+                failure(
+                  SettlementConflict.make({
+                    submissionId: request.submissionId,
+                    existingOutcome: stored.row.settledOutcome,
+                  }),
+                ),
+                current,
+              ];
+            }
+            if (stored.abortIntent !== undefined) return [success(stored.abortIntent), current];
+
+            const intent = AbortIntent.make({
+              submissionId: request.submissionId,
+              author: request.author,
+              reason: request.reason,
+              requestedAt: utc(nowMillis),
+            });
+
+            return [success(intent), withSubmission(current, { ...stored, abortIntent: intent })];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const claimJoining: SubmissionLedger["Service"]["claimJoining"] = Effect.fn(
+      "MemorySubmissionLedger.claimJoining",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(ClaimJoiningRequest, "claimJoining", unvalidated);
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<ReadonlyArray<JoiningClaim>, OwnershipLost | LedgerError>,
+            LedgerState,
+          ] => {
+            if (current.stoppedWorkers.has(request.threadId)) return [success([]), current];
+
+            const host = current.submissions.get(request.hostSubmissionId);
+
+            if (host === undefined) {
+              return [
+                failure(
+                  ledgerError("claimJoining", `Unknown Submission ${request.hostSubmissionId}`),
+                ),
+                current,
+              ];
+            }
+            if (host.row.threadId !== request.threadId) {
+              return [
+                failure(
+                  ledgerError(
+                    "claimJoining",
+                    `Host Submission ${request.hostSubmissionId} does not belong to Thread ${request.threadId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            if (!ownsLane(current, host, request.ownershipToken)) {
+              return [failure(ownershipLost(current, host)), current];
+            }
+
+            const later = [...current.submissions.values()]
+              .filter(
+                (stored) =>
+                  stored.row.threadId === request.threadId &&
+                  stored.row.queueSequence > host.row.queueSequence,
+              )
+              .sort((left, right) => left.row.queueSequence - right.row.queueSequence);
+
+            const claims: Array<JoiningClaim> = [];
+            const submissions = new Map(current.submissions);
+
+            for (const stored of later) {
+              if (claims.length >= request.maxCount) break;
+              // Rows already claimed by THIS host extend its contiguous prefix and are skipped;
+              // the coordinator re-delivers already-joined input through the coverage rule.
+              if (
+                (stored.row.state === "joining" || stored.row.state === "joined") &&
+                stored.joinedHostSubmissionId === request.hostSubmissionId
+              ) {
+                continue;
+              }
+              // P7 §7(c): an aborted-settled row is a CLOSED obligation, not a gap — recovery
+              // settles aborted never-claimed queued work immediately, and settlement order of
+              // never-run work is not execution order (DUR-004 bounds execution).
+              if (stored.row.state === "settled" && stored.row.settledOutcome === "aborted") {
+                continue;
+              }
+              // Any other non-ready row — an admitted-not-ready gap in particular — breaks the
+              // contiguous ready prefix (plan §2.5); later ready work stays queued (DUR-004).
+              if (stored.row.state !== "ready") break;
+              submissions.set(stored.row.submissionId, {
+                ...stored,
+                row: { ...stored.row, state: "joining" },
+                joinedHostSubmissionId: request.hostSubmissionId,
+              });
+              claims.push(
+                JoiningClaim.make({
+                  submissionId: stored.row.submissionId,
+                  queueSequence: stored.row.queueSequence,
+                  inputPayload: stored.row.inputPayload,
+                }),
+              );
+            }
+
+            return [success(claims), { ...current, submissions }];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const markJoined: SubmissionLedger["Service"]["markJoined"] = Effect.fn(
+      "MemorySubmissionLedger.markJoined",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(MarkJoinedRequest, "markJoined", unvalidated);
+
+        const decision = yield* Ref.modify(
+          state,
+          (current): readonly [Decision<void, OwnershipLost | LedgerError>, LedgerState] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(ledgerError("markJoined", `Unknown Submission ${request.submissionId}`)),
+                current,
+              ];
+            }
+            if (stored.joinedHostSubmissionId === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "markJoined",
+                    `Submission ${request.submissionId} was never claimed for joining`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            const host = current.submissions.get(stored.joinedHostSubmissionId);
+
+            if (host === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "markJoined",
+                    `Host Submission ${stored.joinedHostSubmissionId} is missing`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            // The lane is host-owned: the presented token must own the HOST's ownership period,
+            // which also lets a later host Attempt repair a lost marker from history (DUR-016).
+            if (!ownsLane(current, host, request.ownershipToken)) {
+              return [failure(ownershipLost(current, host)), current];
+            }
+            if (stored.inputApplied !== undefined) {
+              if (
+                stored.inputApplied.recordId === request.recordId &&
+                stored.inputApplied.sequence === request.sequence
+              ) {
+                return [success(undefined), current];
+              }
+
+              return [
+                failure(
+                  ledgerError(
+                    "markJoined",
+                    `A different join marker is already recorded for Submission ${request.submissionId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            if (stored.row.state !== "joining" && stored.row.state !== "joined") {
+              return [
+                failure(
+                  ledgerError(
+                    "markJoined",
+                    `Cannot mark Submission ${request.submissionId} joined from state ${stored.row.state}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+
+            const marker = InputAppliedMarker.make({
+              recordId: request.recordId,
+              sequence: request.sequence,
+            });
+
+            return [
+              success(undefined),
+              withSubmission(current, {
+                ...stored,
+                row: { ...stored.row, state: "joined" },
+                inputApplied: marker,
+              }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+      }),
+    );
+
+    const revertJoining: SubmissionLedger["Service"]["revertJoining"] = Effect.fn(
+      "MemorySubmissionLedger.revertJoining",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(RevertJoiningRequest, "revertJoining", unvalidated);
+
+        const decision = yield* Ref.modify(
+          state,
+          (current): readonly [Decision<void, LedgerError>, LedgerState] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(ledgerError("revertJoining", `Unknown Submission ${request.submissionId}`)),
+                current,
+              ];
+            }
+            // Idempotent and recovery-only: only a still-`joining` Submission reverts; an
+            // already-joined (or already-reverted) Submission is a no-op (DUR-016).
+            if (stored.row.state !== "joining") return [success(undefined), current];
+
+            return [
+              success(undefined),
+              withSubmission(current, {
+                ...stored,
+                row: { ...stored.row, state: "ready" },
+                joinedHostSubmissionId: undefined,
+              }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+      }),
+    );
+
+    const suspend: SubmissionLedger["Service"]["suspend"] = Effect.fn(
+      "MemorySubmissionLedger.suspend",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(SuspendRequest, "suspend", unvalidated);
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<SuspensionOutcome, OwnershipLost | SettlementConflict | LedgerError>,
+            LedgerState,
+          ] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(ledgerError("suspend", `Unknown Submission ${request.submissionId}`)),
+                current,
+              ];
+            }
+            if (stored.row.state === "settled") {
+              if (stored.row.settledOutcome === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "suspend",
+                      `Settled Submission ${request.submissionId} is missing its outcome`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+
+              return [
+                failure(
+                  SettlementConflict.make({
+                    submissionId: request.submissionId,
+                    existingOutcome: stored.row.settledOutcome,
+                  }),
+                ),
+                current,
+              ];
+            }
+            // An exact terminal outcome is already reserved (DUR-011); suspension would
+            // contradict it, so the reservation wins.
+            if (stored.reservation !== undefined) {
+              return [
+                failure(
+                  SettlementConflict.make({
+                    submissionId: request.submissionId,
+                    existingOutcome: stored.reservation.outcome,
+                  }),
+                ),
+                current,
+              ];
+            }
+            if (!ownsLane(current, stored, request.ownershipToken)) {
+              return [failure(ownershipLost(current, stored)), current];
+            }
+
+            // A covering event that raced ahead of the suspend transaction (an approval decision,
+            // or a child settlement observed directly from the child's row in this single store)
+            // resumes the caller immediately WITHOUT releasing the lane (plan §2.6, spec §12).
+            const alreadyCovered =
+              request.reason._tag === "ApprovalPending"
+                ? request.reason.toolCallIds.every((toolCallId) =>
+                    stored.approvalDecisions.has(toolCallId),
+                  )
+                : request.reason.children.every(
+                    (child) =>
+                      current.submissions.get(child.childSubmissionId)?.row.state === "settled",
+                  );
+
+            if (alreadyCovered) {
+              return [success("resume-immediately" as const), current];
+            }
+
+            return [
+              success("suspended" as const),
+              withSubmission(current, {
+                ...stored,
+                row: { ...stored.row, state: "suspended" },
+                ownership: undefined,
+                suspension: { reason: request.reason, suspendedAtMillis: nowMillis },
+              }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const recordApprovalDecision: SubmissionLedger["Service"]["recordApprovalDecision"] = Effect.fn(
+      "MemorySubmissionLedger.recordApprovalDecision",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const command = yield* validate(
+          ApprovalDecisionCommand,
+          "recordApprovalDecision",
+          unvalidated,
+        );
+
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<ApprovalDecisionIntent, ApprovalConflict | SettlementConflict | LedgerError>,
+            LedgerState,
+          ] => {
+            const stored = current.submissions.get(command.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "recordApprovalDecision",
+                    `Unknown Submission ${command.submissionId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            if (stored.row.state === "settled") {
+              if (stored.row.settledOutcome === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "recordApprovalDecision",
+                      `Settled Submission ${command.submissionId} is missing its outcome`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+
+              return [
+                failure(
+                  SettlementConflict.make({
+                    submissionId: command.submissionId,
+                    existingOutcome: stored.row.settledOutcome,
+                  }),
+                ),
+                current,
+              ];
+            }
+            const existing = stored.approvalDecisions.get(command.toolCallId);
+
+            if (existing !== undefined) {
+              if (existing.decision !== command.decision) {
+                return [
+                  failure(
+                    ApprovalConflict.make({
+                      submissionId: command.submissionId,
+                      toolCallId: command.toolCallId,
+                      existingDecision: existing.decision,
+                    }),
+                  ),
+                  current,
+                ];
+              }
+
+              return [success(existing), current];
+            }
+
+            const intent = ApprovalDecisionIntent.make({
+              submissionId: command.submissionId,
+              toolCallId: command.toolCallId,
+              decision: command.decision,
+              resolver: command.resolver,
+              reason: command.reason,
+              decidedAt: utc(nowMillis),
+            });
+
+            const approvalDecisions = new Map(stored.approvalDecisions).set(
+              command.toolCallId,
+              intent,
+            );
+
+            // Once every pending call of an ApprovalPending suspension is decided, the lane
+            // wakes: suspended → input-applied (plan §2.6). A WaitingForChild suspension wakes
+            // only through recordChildSettled.
+            const wakes =
+              stored.row.state === "suspended" &&
+              stored.suspension !== undefined &&
+              stored.suspension.reason._tag === "ApprovalPending" &&
+              stored.suspension.reason.toolCallIds.every((toolCallId) =>
+                approvalDecisions.has(toolCallId),
+              );
+
+            return [
+              success(intent),
+              withSubmission(current, {
+                ...stored,
+                row: wakes ? { ...stored.row, state: "input-applied" } : stored.row,
+                suspension: wakes ? undefined : stored.suspension,
+                approvalDecisions,
+              }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const markUnknown: SubmissionLedger["Service"]["markUnknown"] = Effect.fn(
+      "MemorySubmissionLedger.markUnknown",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(MarkUnknownRequest, "markUnknown", unvalidated);
+
+        const decision = yield* Ref.modify(
+          state,
+          (current): readonly [Decision<void, SettlementConflict | LedgerError>, LedgerState] => {
+            const stored = current.submissions.get(request.submissionId);
+
+            if (stored === undefined) {
+              return [
+                failure(ledgerError("markUnknown", `Unknown Submission ${request.submissionId}`)),
+                current,
+              ];
+            }
+            if (stored.row.state === "settled") {
+              if (stored.row.settledOutcome === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "markUnknown",
+                      `Settled Submission ${request.submissionId} is missing its outcome`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+
+              return [
+                failure(
+                  SettlementConflict.make({
+                    submissionId: request.submissionId,
+                    existingOutcome: stored.row.settledOutcome,
+                  }),
+                ),
+                current,
+              ];
+            }
+            // A reserved exact outcome wins over a late Unknown marking (DUR-011); the recovery
+            // classifier orders reservation ahead of MarkUnknown for the same reason.
+            if (stored.reservation !== undefined) {
+              return [
+                failure(
+                  SettlementConflict.make({
+                    submissionId: request.submissionId,
+                    existingOutcome: stored.reservation.outcome,
+                  }),
+                ),
+                current,
+              ];
+            }
+            // Idempotent merge: repeating is a no-op; additional open calls extend the marked
+            // set while the first recorded reason is kept.
+            const existing = stored.unknownMark;
+            const known = new Set(existing?.toolCallIds ?? []);
+
+            const merged = [
+              ...(existing?.toolCallIds ?? []),
+              ...request.toolCallIds.filter((toolCallId) => !known.has(toolCallId)),
+            ];
+
+            return [
+              success(undefined),
+              withSubmission(current, {
+                ...stored,
+                row:
+                  stored.row.state === "unknown" ? stored.row : { ...stored.row, state: "unknown" },
+                unknownMark: { reason: existing?.reason ?? request.reason, toolCallIds: merged },
+              }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+      }),
+    );
+
+    const recordUnknownResolution: SubmissionLedger["Service"]["recordUnknownResolution"] =
+      Effect.fn("MemorySubmissionLedger.recordUnknownResolution")((unvalidated) =>
+        Effect.gen(function* () {
+          const command = yield* validate(
+            UnknownResolutionCommand,
+            "recordUnknownResolution",
+            unvalidated,
+          );
+
+          const nowMillis = yield* Clock.currentTimeMillis;
+
+          const decision = yield* Ref.modify(
+            state,
+            (
+              current,
+            ): readonly [
+              Decision<
+                UnknownResolutionIntent,
+                UnknownResolutionConflict | SettlementConflict | LedgerError
+              >,
+              LedgerState,
+            ] => {
+              const stored = current.submissions.get(command.submissionId);
+
+              if (stored === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "recordUnknownResolution",
+                      `Unknown Submission ${command.submissionId}`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+              if (stored.row.state === "settled") {
+                if (stored.row.settledOutcome === undefined) {
+                  return [
+                    failure(
+                      ledgerError(
+                        "recordUnknownResolution",
+                        `Settled Submission ${command.submissionId} is missing its outcome`,
+                      ),
+                    ),
+                    current,
+                  ];
+                }
+
+                return [
+                  failure(
+                    SettlementConflict.make({
+                      submissionId: command.submissionId,
+                      existingOutcome: stored.row.settledOutcome,
+                    }),
+                  ),
+                  current,
+                ];
+              }
+              const existing = stored.unknownResolutions.get(command.toolCallId);
+
+              if (
+                existing !== undefined &&
+                !equivalentUnknownResolution(existing.intent.resolution, command.resolution)
+              ) {
+                return [
+                  failure(
+                    UnknownResolutionConflict.make({
+                      submissionId: command.submissionId,
+                      toolCallId: command.toolCallId,
+                    }),
+                  ),
+                  current,
+                ];
+              }
+
+              const intent =
+                existing?.intent ??
+                UnknownResolutionIntent.make({
+                  submissionId: command.submissionId,
+                  toolCallId: command.toolCallId,
+                  author: command.author,
+                  reason: command.reason,
+                  resolution: command.resolution,
+                  resolvedAt: utc(nowMillis),
+                });
+
+              const unknownResolutions =
+                existing !== undefined
+                  ? stored.unknownResolutions
+                  : new Map(stored.unknownResolutions).set(command.toolCallId, {
+                      intent,
+                    });
+
+              // The lane reopens only when EVERY marked open call has a durable resolution
+              // intent: unknown → input-applied (DUR-017). Replays re-run the coverage check so
+              // a recovering caller can wake the lane idempotently.
+              const wakes =
+                stored.row.state === "unknown" &&
+                stored.unknownMark !== undefined &&
+                stored.unknownMark.toolCallIds.every((toolCallId) =>
+                  unknownResolutions.has(toolCallId),
+                );
+
+              return [
+                success(intent),
+                withSubmission(current, {
+                  ...stored,
+                  row: wakes ? { ...stored.row, state: "input-applied" } : stored.row,
+                  unknownMark: wakes ? undefined : stored.unknownMark,
+                  unknownResolutions,
+                }),
+              ];
+            },
+          );
+
+          if (decision._tag === "failure") return yield* decision.error;
+
+          return decision.value;
+        }),
+      );
+
+    const recordChildSettled: SubmissionLedger["Service"]["recordChildSettled"] = Effect.fn(
+      "MemorySubmissionLedger.recordChildSettled",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(
+          ChildSettledNotification,
+          "recordChildSettled",
+          unvalidated,
+        );
+
+        const decision = yield* Ref.modify(
+          state,
+          (current): readonly [Decision<ChildSettledOutcome, LedgerError>, LedgerState] => {
+            const parent = current.submissions.get(request.parentSubmissionId);
+
+            if (parent === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "recordChildSettled",
+                    `Unknown Submission ${request.parentSubmissionId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            // The caller may notify after the canonical Settlement append but before ledger
+            // finalization. In a single store, an exact reservation plus `terminalizing` is the
+            // narrow durable prefix that makes that ordering admissible; earlier states remain
+            // a caller error.
+            const child = current.submissions.get(request.childSubmissionId);
+
+            const announced =
+              child !== undefined &&
+              (child.row.state === "settled" ||
+                (child.row.state === "terminalizing" && child.reservation !== undefined));
+
+            if (!announced) {
+              return [
+                failure(
+                  ledgerError(
+                    "recordChildSettled",
+                    `Child Submission ${request.childSubmissionId} has no recorded settlement`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            if (
+              parent.row.state !== "suspended" ||
+              parent.suspension === undefined ||
+              parent.suspension.reason._tag !== "WaitingForChild"
+            ) {
+              return [success("not-waiting" as const), current];
+            }
+            const children = parent.suspension.reason.children;
+
+            if (!children.some((entry) => entry.childSubmissionId === request.childSubmissionId)) {
+              return [success("not-waiting" as const), current];
+            }
+
+            // Every listed child must be either finalized or canonically announced from the
+            // exact terminalizing reservation. Replays re-run this coverage check idempotently.
+            const allSettled = children.every((entry) => {
+              const listed = current.submissions.get(entry.childSubmissionId);
+
+              return (
+                listed?.row.state === "settled" ||
+                (listed?.row.state === "terminalizing" && listed.reservation !== undefined)
+              );
+            });
+
+            if (!allSettled) return [success("still-waiting" as const), current];
+
+            return [
+              success("woken" as const),
+              withSubmission(current, {
+                ...parent,
+                row: { ...parent.row, state: "input-applied" },
+                suspension: undefined,
+              }),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const reserveChildBudget: SubmissionLedger["Service"]["reserveChildBudget"] = Effect.fn(
+      "MemorySubmissionLedger.reserveChildBudget",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(
+          ChildBudgetReservationRequest,
+          "reserveChildBudget",
+          unvalidated,
+        );
+
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<ReservedChildBudget, ChildReservationConflict | OwnershipLost | LedgerError>,
+            LedgerState,
+          ] => {
+            const existing = current.childReservations.get(request.reservationId);
+
+            if (existing !== undefined) {
+              // Identical replays short-circuit before the fence, mirroring reserveSettlement:
+              // a replay creates nothing, so a recovering caller resumes rather than duplicates.
+              const identical =
+                existing.parentSubmissionId === request.parentSubmissionId &&
+                existing.parentToolCallId === request.parentToolCallId &&
+                existing.allocationDigest === request.allocationDigest &&
+                equivalentPersistedJson(existing.allocation, request.allocation);
+
+              if (!identical) {
+                return [
+                  failure(
+                    ChildReservationConflict.make({
+                      reservationId: request.reservationId,
+                      status: existing.status,
+                      message:
+                        "A reservation with this identity exists with a different parent Tool Call or allocation.",
+                    }),
+                  ),
+                  current,
+                ];
+              }
+
+              return [
+                success(
+                  ReservedChildBudget.make({
+                    reservation: toReservationSnapshot(existing),
+                    replayed: true,
+                  }),
+                ),
+                current,
+              ];
+            }
+            for (const reservation of current.childReservations.values()) {
+              if (
+                reservation.parentSubmissionId === request.parentSubmissionId &&
+                reservation.parentToolCallId === request.parentToolCallId
+              ) {
+                return [
+                  failure(
+                    ChildReservationConflict.make({
+                      reservationId: request.reservationId,
+                      status: reservation.status,
+                      message: `Parent Tool Call ${request.parentToolCallId} already owns reservation ${reservation.reservationId}.`,
+                    }),
+                  ),
+                  current,
+                ];
+              }
+            }
+            const parent = current.submissions.get(request.parentSubmissionId);
+
+            if (parent === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "reserveChildBudget",
+                    `Unknown Submission ${request.parentSubmissionId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            // Creation is fenced by the parent lane's live ownership (spec §12 step 2): a stale
+            // parent Attempt can never create new reservation state.
+            if (!ownsLane(current, parent, request.ownershipToken)) {
+              return [failure(ownershipLost(current, parent)), current];
+            }
+
+            const reservation: StoredChildReservation = {
+              reservationId: request.reservationId,
+              parentSubmissionId: request.parentSubmissionId,
+              parentToolCallId: request.parentToolCallId,
+              childSubmissionId: undefined,
+              status: "reserved",
+              allocation: request.allocation,
+              allocationDigest: request.allocationDigest,
+              accounting: undefined,
+              reservedAtMillis: nowMillis,
+              releaseBeganAtMillis: undefined,
+              releasedAtMillis: undefined,
+            };
+
+            return [
+              success(
+                ReservedChildBudget.make({
+                  reservation: toReservationSnapshot(reservation),
+                  replayed: false,
+                }),
+              ),
+              withChildReservation(current, reservation),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const attachChildToReservation: SubmissionLedger["Service"]["attachChildToReservation"] =
+      Effect.fn("MemorySubmissionLedger.attachChildToReservation")((unvalidated) =>
+        Effect.gen(function* () {
+          const request = yield* validate(
+            AttachChildToReservationRequest,
+            "attachChildToReservation",
+            unvalidated,
+          );
+
+          const decision = yield* Ref.modify(
+            state,
+            (
+              current,
+            ): readonly [
+              Decision<
+                ChildBudgetReservationSnapshot,
+                ChildReservationConflict | OwnershipLost | LedgerError
+              >,
+              LedgerState,
+            ] => {
+              const reservation = current.childReservations.get(request.reservationId);
+
+              if (reservation === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "attachChildToReservation",
+                      `Unknown child reservation ${request.reservationId}`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+              if (reservation.childSubmissionId !== undefined) {
+                // Idempotent replay of the recorded attachment (unfenced — it mutates nothing).
+                if (reservation.childSubmissionId === request.childSubmissionId) {
+                  return [success(toReservationSnapshot(reservation)), current];
+                }
+
+                return [
+                  failure(
+                    ChildReservationConflict.make({
+                      reservationId: request.reservationId,
+                      status: reservation.status,
+                      message: `Reservation ${request.reservationId} already records child ${reservation.childSubmissionId}.`,
+                    }),
+                  ),
+                  current,
+                ];
+              }
+              const parent = current.submissions.get(reservation.parentSubmissionId);
+
+              if (parent === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "attachChildToReservation",
+                      `Unknown Submission ${reservation.parentSubmissionId}`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+              if (!ownsLane(current, parent, request.ownershipToken)) {
+                return [failure(ownershipLost(current, parent)), current];
+              }
+              if (reservation.status !== "reserved") {
+                return [
+                  failure(
+                    ChildReservationConflict.make({
+                      reservationId: request.reservationId,
+                      status: reservation.status,
+                      message: `Cannot attach a child to a ${reservation.status} reservation.`,
+                    }),
+                  ),
+                  current,
+                ];
+              }
+              // Single-store latitude: the admitted child must exist here, so a dangling
+              // attachment can never enter the recovery view.
+              if (!current.submissions.has(request.childSubmissionId)) {
+                return [
+                  failure(
+                    ledgerError(
+                      "attachChildToReservation",
+                      `Unknown child Submission ${request.childSubmissionId}`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+
+              const attached: StoredChildReservation = {
+                ...reservation,
+                childSubmissionId: request.childSubmissionId,
+              };
+
+              return [
+                success(toReservationSnapshot(attached)),
+                withChildReservation(current, attached),
+              ];
+            },
+          );
+
+          if (decision._tag === "failure") return yield* decision.error;
+
+          return decision.value;
+        }),
+      );
+
+    const beginChildBudgetRelease: SubmissionLedger["Service"]["beginChildBudgetRelease"] =
+      Effect.fn("MemorySubmissionLedger.beginChildBudgetRelease")((unvalidated) =>
+        Effect.gen(function* () {
+          const request = yield* validate(
+            BeginChildBudgetReleaseRequest,
+            "beginChildBudgetRelease",
+            unvalidated,
+          );
+
+          const nowMillis = yield* Clock.currentTimeMillis;
+
+          const decision = yield* Ref.modify(
+            state,
+            (
+              current,
+            ): readonly [
+              Decision<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>,
+              LedgerState,
+            ] => {
+              const reservation = current.childReservations.get(request.reservationId);
+
+              if (reservation === undefined) {
+                return [
+                  failure(
+                    ledgerError(
+                      "beginChildBudgetRelease",
+                      `Unknown child reservation ${request.reservationId}`,
+                    ),
+                  ),
+                  current,
+                ];
+              }
+              if (reservation.status !== "reserved") {
+                // The accounting decision was already frozen exactly once; an identical replay is
+                // a no-op and a divergent decision conflicts (spec §12 join step 6).
+                if (
+                  reservation.accounting !== undefined &&
+                  equivalentPersistedJson(reservation.accounting, request.accounting)
+                ) {
+                  return [success(toReservationSnapshot(reservation)), current];
+                }
+
+                return [
+                  failure(
+                    ChildReservationConflict.make({
+                      reservationId: request.reservationId,
+                      status: reservation.status,
+                      message:
+                        "A different accounting decision is already frozen for this reservation.",
+                    }),
+                  ),
+                  current,
+                ];
+              }
+
+              const frozen: StoredChildReservation = {
+                ...reservation,
+                status: "releasePending",
+                accounting: request.accounting,
+                releaseBeganAtMillis: nowMillis,
+              };
+
+              return [
+                success(toReservationSnapshot(frozen)),
+                withChildReservation(current, frozen),
+              ];
+            },
+          );
+
+          if (decision._tag === "failure") return yield* decision.error;
+
+          return decision.value;
+        }),
+      );
+
+    const releaseChildBudget: SubmissionLedger["Service"]["releaseChildBudget"] = Effect.fn(
+      "MemorySubmissionLedger.releaseChildBudget",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(
+          ReleaseChildBudgetRequest,
+          "releaseChildBudget",
+          unvalidated,
+        );
+
+        const nowMillis = yield* Clock.currentTimeMillis;
+
+        const decision = yield* Ref.modify(
+          state,
+          (
+            current,
+          ): readonly [
+            Decision<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>,
+            LedgerState,
+          ] => {
+            const reservation = current.childReservations.get(request.reservationId);
+
+            if (reservation === undefined) {
+              return [
+                failure(
+                  ledgerError(
+                    "releaseChildBudget",
+                    `Unknown child reservation ${request.reservationId}`,
+                  ),
+                ),
+                current,
+              ];
+            }
+            // Applied exactly once: replaying a released reservation returns the stored row
+            // unchanged (spec §12: "never available twice").
+            if (reservation.status === "released") {
+              return [success(toReservationSnapshot(reservation)), current];
+            }
+            if (reservation.status !== "releasePending") {
+              return [
+                failure(
+                  ChildReservationConflict.make({
+                    reservationId: request.reservationId,
+                    status: reservation.status,
+                    message:
+                      "Cannot release a reservation whose accounting decision is not frozen.",
+                  }),
+                ),
+                current,
+              ];
+            }
+
+            const released: StoredChildReservation = {
+              ...reservation,
+              status: "released",
+              releasedAtMillis: nowMillis,
+            };
+
+            return [
+              success(toReservationSnapshot(released)),
+              withChildReservation(current, released),
+            ];
+          },
+        );
+
+        if (decision._tag === "failure") return yield* decision.error;
+
+        return decision.value;
+      }),
+    );
+
+    const scanNonterminal: SubmissionLedger["Service"]["scanNonterminal"] = Stream.unwrap(
+      Ref.get(state).pipe(
+        Effect.map((current) => {
+          const snapshots = [...current.submissions.values()]
+            .filter((stored) => stored.row.state !== "settled")
+            .sort((left, right) =>
+              left.row.threadId < right.row.threadId
+                ? -1
+                : left.row.threadId > right.row.threadId
+                  ? 1
+                  : left.row.queueSequence - right.row.queueSequence,
+            )
+            .map(({ row }) =>
+              SubmissionWorkItem.make({
+                submissionId: row.submissionId,
+                threadId: row.threadId,
+                queueSequence: row.queueSequence,
+                principal: row.principal,
+                idempotencyKey: row.idempotencyKey,
+                deploymentId: row.deploymentId,
+                receiptId: row.receiptId,
+                state: row.state,
+              }),
+            );
+
+          return Stream.fromIterable(snapshots);
+        }),
+      ),
+    );
+
+    const readAbortIntent: SubmissionLedger["Service"]["readAbortIntent"] = Effect.fn(
+      "MemorySubmissionLedger.readAbortIntent",
+    )(function* (unvalidated) {
+      const request = yield* validate(AbortIntentRequest, "readAbortIntent", unvalidated);
+      const stored = (yield* Ref.get(state)).submissions.get(request.submissionId);
+
+      if (stored === undefined) {
+        return yield* ledgerError("readAbortIntent", `Unknown Submission ${request.submissionId}`);
+      }
+
+      return stored.abortIntent;
+    });
+
+    const loadRecoverySnapshot: SubmissionLedger["Service"]["loadRecoverySnapshot"] = Effect.fn(
+      "MemorySubmissionLedger.loadRecoverySnapshot",
+    )((unvalidated) =>
+      Effect.gen(function* () {
+        const request = yield* validate(
+          RecoverySnapshotRequest,
+          "loadRecoverySnapshot",
+          unvalidated,
+        );
+
+        const current = yield* Ref.get(state);
+        const stored = current.submissions.get(request.submissionId);
+
+        if (stored === undefined) {
+          return yield* ledgerError(
+            "loadRecoverySnapshot",
+            `Unknown Submission ${request.submissionId}`,
+          );
+        }
+
+        const joins = [...current.submissions.values()]
+          .filter((candidate) => candidate.joinedHostSubmissionId === request.submissionId)
+          .sort((left, right) => left.row.queueSequence - right.row.queueSequence)
+          .map((candidate) =>
+            JoinSnapshot.make({
+              submissionId: candidate.row.submissionId,
+              state: candidate.row.state,
+              hostSubmissionId: request.submissionId,
+            }),
+          );
+
+        const byToolCallId = <A extends { readonly toolCallId: ToolCallId }>(
+          left: A,
+          right: A,
+        ): number =>
+          left.toolCallId < right.toolCallId ? -1 : left.toolCallId > right.toolCallId ? 1 : 0;
+
+        // Parent-side subagent view: this Submission's child budget reservations in parent Tool
+        // Call order, plus each attached child's current lane state (a disposable derived view;
+        // the canonical records stay the recovery truth, DUR-015).
+        const childReservations = [...current.childReservations.values()]
+          .filter((reservation) => reservation.parentSubmissionId === request.submissionId)
+          .sort((left, right) =>
+            left.parentToolCallId < right.parentToolCallId
+              ? -1
+              : left.parentToolCallId > right.parentToolCallId
+                ? 1
+                : 0,
+          );
+
+        const childAttachments: Array<ChildAttachmentSnapshot> = [];
+
+        for (const reservation of childReservations) {
+          if (reservation.childSubmissionId === undefined) continue;
+          const child = current.submissions.get(reservation.childSubmissionId);
+
+          if (child === undefined) continue;
+          childAttachments.push(
+            ChildAttachmentSnapshot.make({
+              toolCallId: reservation.parentToolCallId,
+              childSubmissionId: reservation.childSubmissionId,
+              childState: child.row.state,
+              ...(child.row.settledOutcome === undefined
+                ? {}
+                : { childOutcome: child.row.settledOutcome }),
+            }),
+          );
+        }
+
+        return RecoverySnapshot.make({
+          submission: toSnapshot(stored.row),
+          joins,
+          approvalDecisions: [...stored.approvalDecisions.values()].sort(byToolCallId),
+          unknownResolutions: [...stored.unknownResolutions.values()]
+            .map((resolution) => resolution.intent)
+            .sort(byToolCallId),
+          childReservations: childReservations.map(toReservationSnapshot),
+          childAttachments,
+          ...(stored.row.parentLinkage === undefined
+            ? {}
+            : { parentLinkage: stored.row.parentLinkage }),
+          ...(stored.joinedHostSubmissionId === undefined
+            ? {}
+            : { hostSubmissionId: stored.joinedHostSubmissionId }),
+          ...(stored.suspension === undefined
+            ? {}
+            : {
+                suspension: SuspensionSnapshot.make({
+                  reason: stored.suspension.reason,
+                  suspendedAt: utc(stored.suspension.suspendedAtMillis),
+                }),
+              }),
+          ...(stored.ownership === undefined
+            ? {}
+            : {
+                ownership: OwnershipSnapshot.make({
+                  attemptId: stored.ownership.attemptId,
+                  ownerProducerId: stored.ownership.ownerProducerId,
+                  producerEpoch: stored.ownership.producerEpoch,
+                  leaseExpiresAt: utc(stored.ownership.leaseExpiresAtMillis),
+                }),
+              }),
+          ...(stored.inputApplied === undefined ? {} : { inputApplied: stored.inputApplied }),
+          ...(stored.reservation === undefined
+            ? {}
+            : {
+                reservation: SettlementReservationSnapshot.make({
+                  settlementId: stored.reservation.settlementId,
+                  outcome: stored.reservation.outcome,
+                  record: stored.reservation.record,
+                  recordDigest: stored.reservation.recordDigest,
+                  finalized: stored.reservation.finalizedAtMillis !== undefined,
+                }),
+              }),
+          ...(stored.abortIntent === undefined ? {} : { abortIntent: stored.abortIntent }),
+        });
+      }),
+    );
+
+    return SubmissionLedger.of({
+      capabilities,
+      admit,
+      markReady,
+      lookup,
+      resolveAdmission,
+      claim,
+      renewOwnership,
+      releaseOwnership,
+      markInputApplied,
+      reserveSettlement,
+      finalizeSettlement,
+      requestAbort,
+      stopWorker,
+      inspectWorker,
+      claimJoining,
+      markJoined,
+      revertJoining,
+      suspend,
+      recordApprovalDecision,
+      markUnknown,
+      recordUnknownResolution,
+      recordChildSettled,
+      reserveChildBudget,
+      attachChildToReservation,
+      beginChildBudgetRelease,
+      releaseChildBudget,
+      scanNonterminal,
+      loadRecoverySnapshot,
+      readAbortIntent,
+    });
+  });
+
+/** Construction options for the in-memory reference SubmissionLedger. */
+export interface MemorySubmissionLedgerOptions {
+  /**
+   * Test-only fault seam for `resolveAdmission` (SUB-031): when the effect yields a reason,
+   * the resolution answers `Indeterminate` with it instead of consulting the store — modelling
+   * an authoritative child owner that is temporarily unreachable. `Option.none()` restores the
+   * store-derived answer. Ledger state is never mutated by the fault.
+   */
+  readonly resolveAdmissionFault?: Effect.Effect<Option.Option<string>>;
+}
+
+/**
+ * In-memory reference SubmissionLedger Layer (durability `non-durable`). All state lives in one
+ * `Ref` owned by the Layer's Scope; no daemon fibers are spawned and no wall clock is consulted.
+ */
+export const memorySubmissionLedgerLayer = (
+  options: MemorySubmissionLedgerOptions = {},
+): Layer.Layer<SubmissionLedger> => Layer.effect(SubmissionLedger, makeSubmissionLedger(options));
+
+export const MemorySubmissionLedgerLive: Layer.Layer<SubmissionLedger> =
+  memorySubmissionLedgerLayer();