@yielded/agent-storage-memory 0.1.0-beta.167 → 0.1.0-beta.168

package/dist/MemoryMessageDeliveryStore.d.mts

@@ -1,3 +1,4 @@
+import { t as MemoryThreadStoreKernel } from "./MemoryThreadStoreKernel-DYNDjlhO.mjs";
 import { Layer } from "effect";
 import { MessageDeliveryError, MessageDeliveryStore, MessageDeliveryStoreLimits } from "@yielded/agent/message-delivery";
 declare namespace MemoryMessageDeliveryStore_d_exports {
@@ -7,9 +8,12 @@ export interface MemoryMessageDeliveryStoreOptions {
   /** UTF-8 bound on the complete stored record, including a processed Settlement. */
   readonly maxStoredValueBytes?: number;
 }
-/** Reference adapter. All retained rows are bounded; completed deduplication evidence is never evicted. */
-export declare const memoryMessageDeliveryStoreLayer: (limits?: MessageDeliveryStoreLimits, options?: MemoryMessageDeliveryStoreOptions) => Layer.Layer<MessageDeliveryStore, MessageDeliveryError>;
-export declare const MemoryMessageDeliveryStoreLive: Layer.Layer<MessageDeliveryStore, MessageDeliveryError, never>;
+/**
+ * Pair with MemoryThreadStoreLive so export/import sees every retained delivery obligation.
+ * Each retained value and live partition is bounded; completed deduplication evidence is never evicted.
+ */
+export declare const memoryMessageDeliveryStoreLayer: (limits?: MessageDeliveryStoreLimits, options?: MemoryMessageDeliveryStoreOptions) => Layer.Layer<MessageDeliveryStore, MessageDeliveryError, MemoryThreadStoreKernel>;
+export declare const MemoryMessageDeliveryStoreLive: Layer.Layer<MessageDeliveryStore, MessageDeliveryError, MemoryThreadStoreKernel>;
 //#endregion
 export { MemoryMessageDeliveryStore_d_exports as t };
 //# sourceMappingURL=MemoryMessageDeliveryStore.d.mts.map

package/dist/MemoryMessageDeliveryStore.mjs

@@ -1,14 +1,29 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { n as MemoryThreadStoreKernel, t as boundedWorkSelection } from "./WorkSelection-CmqTuws3.mjs";
 import { ScheduleInstant } from "@yielded/agent/schedule";
-import { Effect, Layer, Ref, Schema, Semaphore } from "effect";
+import { Effect, Layer, MutableRef, Ref, Schema } from "effect";
 import { ThreadId } from "@yielded/agent/identifiers";
 import { MessageDeliveryChange, MessageDeliveryError, MessageDeliveryFailpoint, MessageDeliveryKey, MessageDeliveryPageRequest, MessageDeliveryRecord, MessageDeliveryStore, MessageDeliveryStoreLimits, applyMessageDeliveryChange, defaultMessageDeliveryStoreLimits, isWorkerUpdateDelivery, messageDeliveryCapacity, messageDeliveryDeadline, messageDeliveryKeyString, messageDeliveryUsesCapacity, sameMessageDeliveryIdentity, validateMessageDelivery } from "@yielded/agent/message-delivery";
+import { validateCanonicalSettlement } from "@yielded/agent/settlement-publisher";
+import { Settlement, settlementFailureFromRecord, submissionSettlementId, submissionSettlementRecordId } from "@yielded/agent/submission-ledger";
+import { PreparedInput } from "@yielded/agent/subscription";
+import { ThreadDeliveryImportReader, ThreadImportRejected, invalidThreadArchive } from "@yielded/agent/thread-import";
+import { ThreadStoreError, makeTransferFactCheck } from "@yielded/agent/thread-store";
+import { workId } from "@yielded/agent/thread-work";
 //#region src/MemoryMessageDeliveryStore.ts
 var MemoryMessageDeliveryStore_exports = /* @__PURE__ */ __exportAll({
 	MemoryMessageDeliveryStoreLive: () => MemoryMessageDeliveryStoreLive,
 	memoryMessageDeliveryStoreLayer: () => memoryMessageDeliveryStoreLayer
 });
 const codec = Schema.fromJsonString(MessageDeliveryRecord);
+const deliveryFitsTransfer = makeTransferFactCheck(MessageDeliveryRecord);
+const checkTransfer = (record) => deliveryFitsTransfer(record.key.ownerThreadId, {
+	...record,
+	leaseUntilMillis: null
+}) ? Effect.void : Effect.fail(MessageDeliveryError.make({
+	reason: "capacity",
+	operation: "transfer-page-bytes"
+}));
 const decode = (text) => Schema.decodeEffect(codec)(text).pipe(Effect.mapError(() => MessageDeliveryError.make({
 	reason: "corrupt",
 	operation: "decode"
@@ -18,48 +33,186 @@ const Scan = Schema.Struct({
 	limit: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(100)),
 	ownerThreadId: Schema.optionalKey(ThreadId)
 });
-/** Reference adapter. All retained rows are bounded; completed deduplication evidence is never evicted. */
+const position = (keys, key) => {
+	let low = 0;
+	let high = keys.length;
+	while (low < high) {
+		const mid = Math.floor((low + high) / 2);
+		if (keys[mid] < key) low = mid + 1;
+		else high = mid;
+	}
+	return low;
+};
+const retainKey = (keys, key) => {
+	const at = position(keys, key);
+	if (keys[at] !== key) keys.splice(at, 0, key);
+};
+const removeKey = (keys, key) => {
+	const at = position(keys, key);
+	if (keys[at] === key) keys.splice(at, 1);
+};
+const backend = () => ({
+	records: /* @__PURE__ */ new Map(),
+	work: /* @__PURE__ */ new Map(),
+	ordered: /* @__PURE__ */ new Map(),
+	pending: /* @__PURE__ */ new Map(),
+	counts: /* @__PURE__ */ new Map(),
+	metadata: /* @__PURE__ */ new Map(),
+	deadlines: /* @__PURE__ */ new Map(),
+	deadlineKeys: new Array(),
+	ownerDeadlineKeys: /* @__PURE__ */ new Map()
+});
+const ownerKey = (id) => JSON.stringify([id]);
+const keysFor = (current, key) => {
+	let keys = current.ordered.get(key);
+	if (keys === void 0) current.ordered.set(key, keys = []);
+	return keys;
+};
+/**
+* Pair with MemoryThreadStoreLive so export/import sees every retained delivery obligation.
+* Each retained value and live partition is bounded; completed deduplication evidence is never evicted.
+*/
 const memoryMessageDeliveryStoreLayer = (limits = defaultMessageDeliveryStoreLimits, options = {}) => Layer.effect(MessageDeliveryStore, Effect.gen(function* () {
+	const journal = yield* MemoryThreadStoreKernel;
 	const config = yield* validateMessageDelivery(MessageDeliveryStoreLimits, limits, "limits");
 	const maxStoredValueBytes = yield* validateMessageDelivery(Schema.Int.check(Schema.isGreaterThan(0)), options.maxStoredValueBytes ?? 16777216, "stored-value-limit");
-	const state = yield* Ref.make({
-		records: /* @__PURE__ */ new Map(),
-		pending: /* @__PURE__ */ new Map(),
-		workers: /* @__PURE__ */ new Map()
+	const state = yield* Ref.make(backend());
+	yield* journal.registerDeliveryLookup((threadId, messageId) => MutableRef.get(state.ref).records.has(messageDeliveryKeyString({
+		ownerThreadId: threadId,
+		messageId
+	})));
+	yield* journal.registerWorkOwner("deliveries", {
+		threads: (request) => Ref.get(state).pipe(Effect.map((current) => {
+			const candidates = boundedWorkSelection(request.limit, (id) => id, request.afterThreadId);
+			for (const threadId of current.pending.keys()) candidates.add(threadId);
+			const threadIds = candidates.values;
+			const afterThreadId = threadIds.length === request.limit ? threadIds.at(-1) : void 0;
+			return {
+				threadIds,
+				...afterThreadId === void 0 ? {} : { afterThreadId }
+			};
+		})),
+		page: (threadId, after, limit) => Effect.gen(function* () {
+			const current = yield* Ref.get(state);
+			const candidates = boundedWorkSelection(limit + 1, (id) => id, after);
+			for (const id of current.pending.get(threadId) ?? []) candidates.add(id);
+			const ids = candidates.values;
+			const entries = [];
+			for (const messageId of ids.slice(0, limit)) {
+				const key = messageDeliveryKeyString({
+					ownerThreadId: threadId,
+					messageId
+				});
+				const entry = current.work.get(key);
+				if (entry === void 0 || !current.records.has(key)) return yield* ThreadStoreError.make({
+					operation: "delivery work",
+					message: "Pending delivery index is incomplete or corrupt"
+				});
+				entries.push(entry);
+			}
+			const next = ids.length > limit ? ids[limit - 1] : void 0;
+			return {
+				entries,
+				...next === void 0 ? {} : { after: next }
+			};
+		})
 	});
-	const commit = (record, encoded) => Ref.update(state, (current) => {
+	const commitInto = (current, record, encoded, publish) => {
 		const key = messageDeliveryKeyString(record.key);
-		const keys = new Set(current.pending.get(record.key.ownerThreadId));
-		if (messageDeliveryUsesCapacity(record)) keys.add(record.key.messageId);
-		else keys.delete(record.key.messageId);
-		const pending = new Map(current.pending);
-		if (keys.size === 0) pending.delete(record.key.ownerThreadId);
-		else pending.set(record.key.ownerThreadId, keys);
-		const workers = new Map(current.workers);
+		const owner = record.key.ownerThreadId;
+		const old = current.metadata.get(key);
+		const update = isWorkerUpdateDelivery(record);
+		const pending = messageDeliveryUsesCapacity(record);
+		const peer = record.envelope.messageAdmission !== void 0 && "peerName" in record.envelope.messageAdmission;
+		let counts = current.counts.get(owner);
+		if (counts === void 0) current.counts.set(owner, counts = {
+			retained: 0,
+			ordinary: 0,
+			update: 0,
+			peer: 0
+		});
+		if (old === void 0) counts.retained++;
+		if (old?.pending) {
+			if (old.update) counts.update--;
+			else counts.ordinary--;
+			if (old.peer) counts.peer--;
+		}
+		if (pending) {
+			if (update) counts.update++;
+			else counts.ordinary++;
+			if (peer) counts.peer++;
+		}
+		let owned = current.pending.get(owner);
+		if (owned === void 0) current.pending.set(owner, owned = /* @__PURE__ */ new Set());
+		if (pending) owned.add(record.key.messageId);
+		else owned.delete(record.key.messageId);
+		if (owned.size === 0) current.pending.delete(owner);
+		retainKey(keysFor(current, ownerKey(owner)), record.key.messageId);
 		const admission = record.envelope.workerAdmission;
 		if (admission !== void 0) {
 			const worker = admission.origin.worker;
-			const startKey = JSON.stringify([
-				record.key.ownerThreadId,
+			if (record.key.messageId === admission.origin.firstMessageId) retainKey(keysFor(current, JSON.stringify([
+				owner,
 				worker.delegationId,
 				worker.targetAgentId
-			]);
-			if (record.key.messageId === admission.origin.firstMessageId) workers.set(startKey, /* @__PURE__ */ new Set([...workers.get(startKey) ?? [], record.key.messageId]));
-			const pendingKey = JSON.stringify([record.key.ownerThreadId, worker.threadId]);
-			const inputs = new Set(workers.get(pendingKey));
-			if ((record.status === "pending" || record.status === "parked") && record.receipt === null) inputs.add(record.key.messageId);
-			else inputs.delete(record.key.messageId);
-			workers.set(pendingKey, inputs);
+			])), record.key.messageId);
+			const inputs = keysFor(current, JSON.stringify([owner, worker.threadId]));
+			if ((record.status === "pending" || record.status === "parked") && record.receipt === null) retainKey(inputs, record.key.messageId);
+			else removeKey(inputs, record.key.messageId);
+		}
+		const deadline = messageDeliveryDeadline(record);
+		let ownerDeadlines = current.ownerDeadlineKeys.get(owner);
+		if (ownerDeadlines === void 0) current.ownerDeadlineKeys.set(owner, ownerDeadlines = []);
+		if (old?.deadlineKey !== void 0) {
+			current.deadlines.delete(old.deadlineKey);
+			removeKey(current.deadlineKeys, old.deadlineKey);
+			removeKey(ownerDeadlines, old.deadlineKey);
+		}
+		const deadlineKey = deadline === null ? void 0 : `${String(deadline).padStart(16, "0")}:${key}`;
+		if (deadlineKey !== void 0 && deadline !== null) {
+			current.deadlines.set(deadlineKey, {
+				key: record.key,
+				deadline
+			});
+			retainKey(current.deadlineKeys, deadlineKey);
+			retainKey(ownerDeadlines, deadlineKey);
 		}
-		return {
-			records: new Map(current.records).set(key, encoded),
+		current.metadata.set(key, {
+			update,
 			pending,
-			workers
-		};
-	});
-	const lock = yield* Semaphore.make(1);
+			peer,
+			...deadlineKey === void 0 ? {} : { deadlineKey }
+		});
+		if (pending) current.work.set(key, {
+			id: workId("delivery", record.key.messageId),
+			owner: {
+				_tag: "Delivery",
+				messageId: record.key.messageId
+			},
+			partition: update ? "update" : "ordinary",
+			stateReference: {
+				_tag: "Delivery",
+				messageId: record.key.messageId,
+				version: record.version
+			},
+			state: record.status === "pending" ? "ready" : "waiting",
+			...record.status === "parked" ? { wait: "parked" } : record.receipt !== null ? { wait: "destination" } : {},
+			...deadline === null ? {} : { notBeforeMillis: deadline },
+			...record.receipt === null ? {} : {
+				receiptId: record.receipt.receiptId,
+				queueSequence: record.receipt.queueSequence
+			}
+		});
+		else current.work.delete(key);
+		current.records.set(key, encoded);
+		if (publish) {
+			journal.initializeWork(owner);
+			journal.retainDelivery(owner, record.key.messageId);
+		}
+	};
+	const commit = (record, encoded) => Effect.sync(() => commitInto(MutableRef.get(state.ref), record, encoded, true));
 	const failpoint = yield* MessageDeliveryFailpoint;
-	const encode = Effect.fn("MemoryMessageDeliveryStore.encode")(function* (record) {
+	const encode = Effect.fnUntraced(function* (record) {
 		const text = yield* Schema.encodeEffect(codec)(record).pipe(Effect.mapError(() => MessageDeliveryError.make({
 			reason: "corrupt",
 			operation: "encode"
@@ -70,10 +223,7 @@ const memoryMessageDeliveryStoreLayer = (limits = defaultMessageDeliveryStoreLim
 		});
 		return text;
 	});
-	const all = Effect.fn("MemoryMessageDeliveryStore.all")(function* () {
-		return yield* Effect.forEach((yield* Ref.get(state)).records.values(), decode);
-	});
-	const insert = Effect.fn("MemoryMessageDeliveryStore.insert")(function* (record) {
+	const insert = Effect.fnUntraced(function* (record) {
 		const encoded = yield* encode(record);
 		const input = yield* decode(encoded);
 		if (input.version !== 1 || input.status !== "pending" || input.leaseUntilMillis !== null || input.retry.attempts !== 0 || input.retry.generation !== 0 || input.retry.automaticAttempts !== 0 || input.retry.nextAttemptAtMillis !== input.createdAtMillis || input.retry.lastAttemptAtMillis !== null || input.retry.lastFailure !== null || input.deadlineAtMillis !== input.initialDeadlineAtMillis) return yield* MessageDeliveryError.make({
@@ -85,7 +235,11 @@ const memoryMessageDeliveryStoreLayer = (limits = defaultMessageDeliveryStoreLim
 			operation: "envelope-bytes"
 		});
 		yield* failpoint.hit("message-delivery:insert:before");
-		const inserted = yield* lock.withPermit(Effect.uninterruptible(Effect.gen(function* () {
+		const inserted = yield* journal.withMutation(Effect.uninterruptible(Effect.gen(function* () {
+			yield* journal.checkThreadCapacity(input.key.ownerThreadId).pipe(Effect.mapError(() => MessageDeliveryError.make({
+				reason: "capacity",
+				operation: "Thread capacity"
+			})));
 			const { records } = yield* Ref.get(state);
 			const key = messageDeliveryKeyString(input.key);
 			const existingText = records.get(key);
@@ -95,11 +249,14 @@ const memoryMessageDeliveryStoreLayer = (limits = defaultMessageDeliveryStoreLim
 					reason: "conflict",
 					operation: "insert"
 				});
+				journal.retainDelivery(existing.key.ownerThreadId, existing.key.messageId);
 				return existing;
 			}
-			const owned = (yield* all()).filter((record) => record.key.ownerThreadId === input.key.ownerThreadId && isWorkerUpdateDelivery(record) === isWorkerUpdateDelivery(input));
-			const capacity = messageDeliveryCapacity(config, isWorkerUpdateDelivery(input));
-			if (owned.length >= capacity.retained || owned.filter(messageDeliveryUsesCapacity).length >= capacity.pending) return yield* MessageDeliveryError.make({
+			yield* checkTransfer(input);
+			const update = isWorkerUpdateDelivery(input);
+			const counts = MutableRef.get(state.ref).counts.get(input.key.ownerThreadId);
+			const capacity = messageDeliveryCapacity(config, update);
+			if ((update ? counts?.update ?? 0 : counts?.ordinary ?? 0) >= capacity.pending) return yield* MessageDeliveryError.make({
 				reason: "capacity",
 				operation: "insert"
 			});
@@ -109,23 +266,25 @@ const memoryMessageDeliveryStoreLayer = (limits = defaultMessageDeliveryStoreLim
 		yield* failpoint.hit("message-delivery:insert:after");
 		return yield* decode(yield* encode(inserted));
 	});
-	const get = Effect.fn("MemoryMessageDeliveryStore.get")(function* (key) {
+	const get = Effect.fnUntraced(function* (key) {
 		const input = yield* validateMessageDelivery(MessageDeliveryKey, key, "get");
 		const text = (yield* Ref.get(state)).records.get(messageDeliveryKeyString(input));
 		return text === void 0 ? null : yield* decode(text);
 	});
-	const change = Effect.fn("MemoryMessageDeliveryStore.change")(function* (key, change) {
+	const change = Effect.fnUntraced(function* (key, change) {
 		const input = yield* validateMessageDelivery(MessageDeliveryChange, change, "change");
 		const decodedKey = yield* validateMessageDelivery(MessageDeliveryKey, key, "change");
 		const point = `message-delivery:${input._tag.toLowerCase()}`;
 		yield* failpoint.hit(`${point}:before`);
-		const changed = yield* lock.withPermit(Effect.uninterruptible(Effect.gen(function* () {
+		const changed = yield* journal.withMutation(Effect.uninterruptible(Effect.gen(function* () {
 			const existing = yield* get(decodedKey);
 			if (existing === null) return yield* MessageDeliveryError.make({
 				reason: "not-found",
 				operation: "change"
 			});
 			const next = yield* Effect.fromResult(applyMessageDeliveryChange(existing, input));
+			if (next === existing) return existing;
+			yield* checkTransfer(next);
 			const encoded = yield* encode(next);
 			yield* commit(next, encoded);
 			return next;
@@ -133,13 +292,196 @@ const memoryMessageDeliveryStoreLayer = (limits = defaultMessageDeliveryStoreLim
 		yield* failpoint.hit(`${point}:after`);
 		return yield* decode(yield* encode(changed));
 	});
+	const transferDecode = (text) => decode(text).pipe(Effect.mapError(() => ThreadStoreError.make({
+		operation: "delivery transfer",
+		message: "Invalid retained delivery wire"
+	})));
+	yield* journal.registerDeliveryTransfer({
+		record: (threadId, messageId) => {
+			const text = MutableRef.get(state.ref).records.get(messageDeliveryKeyString({
+				ownerThreadId: threadId,
+				messageId
+			}));
+			return text === void 0 ? Effect.succeed(void 0) : transferDecode(text);
+		},
+		snapshot: (threadId) => {
+			const counts = MutableRef.get(state.ref).counts.get(threadId);
+			return {
+				idle: (MutableRef.get(state.ref).pending.get(threadId)?.size ?? 0) === 0,
+				deliveries: counts?.retained ?? 0
+			};
+		},
+		pendingPeerCount: (threadId, limit) => Math.min(MutableRef.get(state.ref).counts.get(threadId)?.peer ?? 0, limit),
+		facts: Effect.fnUntraced(function* (threadId, after) {
+			const current = MutableRef.get(state.ref);
+			const keys = current.ordered.get(ownerKey(threadId)) ?? [];
+			const messageId = keys[after === void 0 ? 0 : position(keys, after) + Number(keys[position(keys, after)] === after)];
+			const record = messageId === void 0 ? void 0 : yield* transferDecode(current.records.get(messageDeliveryKeyString({
+				ownerThreadId: threadId,
+				messageId: Schema.decodeSync(MessageDeliveryKey.fields.messageId)(messageId)
+			})) ?? "");
+			return {
+				facts: {
+					admissions: [],
+					commands: {
+						aborts: [],
+						approvals: [],
+						resolutions: []
+					},
+					deliveries: record === void 0 ? [] : [MessageDeliveryRecord.make({
+						...record,
+						leaseUntilMillis: null
+					})]
+				},
+				after: messageId ?? after ?? ""
+			};
+		}),
+		startImport: Effect.fnUntraced(function* (threadId) {
+			const current = MutableRef.get(state.ref);
+			if ((current.counts.get(threadId)?.retained ?? 0) > 0) return yield* ThreadImportRejected.make({
+				threadId,
+				reason: "target-not-empty",
+				message: "Destination Thread owns retained deliveries"
+			});
+			const staged = backend();
+			return {
+				record: (messageId) => {
+					const text = staged.records.get(messageDeliveryKeyString({
+						ownerThreadId: threadId,
+						messageId
+					}));
+					return text === void 0 ? Effect.succeed(void 0) : transferDecode(text);
+				},
+				has: (messageId) => staged.records.has(messageDeliveryKeyString({
+					ownerThreadId: threadId,
+					messageId
+				})),
+				stage: Effect.fnUntraced(function* (page) {
+					for (const record of page.archive.deliveries) {
+						const key = messageDeliveryKeyString(record.key);
+						if (staged.records.has(key) || current.records.has(key)) return yield* invalidThreadArchive("Duplicate retained delivery", threadId);
+						const text = yield* encode(record).pipe(Effect.mapError(() => ThreadImportRejected.make({
+							threadId,
+							reason: "unsupported-capacity",
+							message: "Delivery wire exceeds destination stored-value bound"
+						})));
+						if (new TextEncoder().encode(JSON.stringify(yield* Schema.encodeEffect(PreparedInput)(record.envelope).pipe(Effect.mapError(() => invalidThreadArchive("Invalid delivery envelope", threadId))))).byteLength > config.maxEnvelopeBytes) return yield* ThreadImportRejected.make({
+							threadId,
+							reason: "unsupported-capacity",
+							message: "Delivery envelope exceeds destination bound"
+						});
+						const counts = staged.counts.get(threadId);
+						if (messageDeliveryUsesCapacity(record) && (isWorkerUpdateDelivery(record) ? counts?.update ?? 0 : counts?.ordinary ?? 0) >= messageDeliveryCapacity(config, isWorkerUpdateDelivery(record)).pending) return yield* ThreadImportRejected.make({
+							threadId,
+							reason: "unsupported-capacity",
+							message: "Pending delivery capacity exceeded"
+						});
+						commitInto(staged, record, text, false);
+					}
+				}),
+				prepareCommit: Effect.fnUntraced(function* () {
+					const reader = yield* ThreadDeliveryImportReader;
+					const read = (messageId) => {
+						const text = staged.records.get(messageDeliveryKeyString({
+							ownerThreadId: threadId,
+							messageId
+						}));
+						return text === void 0 ? Effect.fail(invalidThreadArchive("Missing delivery predecessor", threadId)) : transferDecode(text);
+					};
+					const visit = (messageId) => {
+						const metadata = staged.metadata.get(messageDeliveryKeyString({
+							ownerThreadId: threadId,
+							messageId
+						}));
+						return metadata === void 0 ? Effect.fail(invalidThreadArchive("Missing delivery predecessor metadata", threadId)) : Effect.succeed(metadata);
+					};
+					const verifyPredecessors = Effect.fnUntraced(function* (start) {
+						let cursor = start;
+						while (cursor !== void 0) {
+							const metadata = yield* visit(cursor);
+							if (metadata.importVisit === "verified") break;
+							if (metadata.importVisit === "visiting") return yield* invalidThreadArchive("Delivery predecessor cycle", threadId);
+							metadata.importVisit = "visiting";
+							const record = yield* read(cursor);
+							if (record.predecessor !== void 0 && (yield* read(record.predecessor)).createdAtMillis > record.createdAtMillis) return yield* invalidThreadArchive("Delivery predecessor has a later boundary", threadId);
+							cursor = record.predecessor;
+						}
+						cursor = start;
+						while (cursor !== void 0) {
+							const metadata = yield* visit(cursor);
+							if (metadata.importVisit === "verified") break;
+							metadata.importVisit = "verified";
+							cursor = (yield* read(cursor)).predecessor;
+						}
+					});
+					for (const text of staged.records.values()) {
+						const d = yield* transferDecode(text);
+						yield* verifyPredecessors(d.key.messageId);
+						if (d.receipt !== null) {
+							if (d.settlement !== null && d.settlement.settlementId !== submissionSettlementId(d.receipt.submissionId)) return yield* invalidThreadArchive("Delivery settlement identity is not canonical", threadId);
+							const foreign = d.receipt.threadId !== threadId;
+							if (foreign && d.status !== "processed") return yield* ThreadImportRejected.make({
+								threadId,
+								reason: "unsupported-obligations",
+								message: "Live foreign delivery receipt cannot be restored"
+							});
+							const destination = yield* reader.admission(d.receipt.threadId, d.receipt.submissionId);
+							if (destination === void 0) {
+								if (foreign && d.status === "processed") continue;
+								return yield* invalidThreadArchive("Destination delivery receipt evidence is missing", threadId);
+							}
+							const expected = PreparedInput.make({
+								schemaVersion: 1,
+								authorization: d.envelope.authorization,
+								threadId: destination.threadId,
+								deliveryPrincipal: destination.principal,
+								admissionKey: destination.idempotencyKey,
+								agentId: destination.agentId,
+								definitions: destination.agentDigests,
+								input: destination.inputPayload,
+								inputDigest: destination.inputDigest,
+								...destination.admissionGroup === void 0 ? {} : { admissionGroup: destination.admissionGroup },
+								...destination.admissionFence === void 0 ? {} : { admissionFence: destination.admissionFence },
+								...destination.workerAdmission === void 0 ? {} : { workerAdmission: destination.workerAdmission },
+								...destination.messageAdmission === void 0 ? {} : { messageAdmission: destination.messageAdmission }
+							});
+							if (d.receipt.receiptId !== destination.receiptId || d.receipt.queueSequence !== destination.queueSequence || !Schema.toEquivalence(PreparedInput)(d.envelope, expected)) return yield* invalidThreadArchive("Delivery envelope differs from destination admission", threadId);
+							if (d.settlement !== null) {
+								const record = yield* reader.record(destination.threadId, submissionSettlementRecordId(destination.submissionId));
+								if (record === void 0) {
+									if (foreign) continue;
+									return yield* invalidThreadArchive("Processed delivery has no destination settlement", threadId);
+								}
+								const settled = yield* validateCanonicalSettlement(record, destination).pipe(Effect.mapError(() => invalidThreadArchive("Invalid destination settlement", threadId)));
+								const failure = settlementFailureFromRecord(record);
+								const expected = Settlement.make({
+									submissionId: settled.submissionId,
+									receiptId: settled.receiptId,
+									settlementId: settled.settlementId,
+									outcome: settled.outcome,
+									settledAt: d.settlement.settledAt,
+									...failure === void 0 ? {} : { failure },
+									...d.settlement.runDisposition === void 0 || settled.runDisposition === void 0 ? {} : { runDisposition: settled.runDisposition },
+									...d.settlement.usageSummary === void 0 || settled.usageSummary === void 0 ? {} : { usageSummary: settled.usageSummary }
+								});
+								if (!Schema.toEquivalence(Settlement)(d.settlement, expected)) return yield* invalidThreadArchive("Delivery settlement differs from destination evidence", threadId);
+							}
+						}
+					}
+					return () => {
+						for (const text of staged.records.values()) commitInto(current, Schema.decodeSync(codec)(text), text, true);
+					};
+				})
+			};
+		})
+	});
 	return MessageDeliveryStore.of({
 		limits: config,
 		maxStoredValueBytes,
 		insert,
 		get,
 		change,
-		list: Effect.fn("MemoryMessageDeliveryStore.list")(function* (request) {
+		list: Effect.fnUntraced(function* (request) {
 			const input = yield* validateMessageDelivery(MessageDeliveryPageRequest, request, "list");
 			const current = yield* Ref.get(state);
 			const workerKey = input.workerStarts !== void 0 ? JSON.stringify([
@@ -147,39 +489,60 @@ const memoryMessageDeliveryStoreLayer = (limits = defaultMessageDeliveryStoreLim
 				input.workerStarts.delegationId,
 				input.workerStarts.targetAgentId
 			]) : input.pendingWorker !== void 0 ? JSON.stringify([input.ownerThreadId, input.pendingWorker]) : void 0;
-			const records = (workerKey !== void 0 || input.pendingOnly ? yield* Effect.forEach([...(workerKey === void 0 ? current.pending.get(input.ownerThreadId) : current.workers.get(workerKey)) ?? []].filter((messageId) => input.after === void 0 || messageId > input.after).sort().slice(0, input.limit + 1), (messageId) => decode(current.records.get(messageDeliveryKeyString({
-				ownerThreadId: input.ownerThreadId,
-				messageId
-			})) ?? "")) : yield* all()).filter((record) => record.key.ownerThreadId === input.ownerThreadId && (input.after === void 0 || record.key.messageId > input.after)).sort((left, right) => left.key.messageId < right.key.messageId ? -1 : left.key.messageId > right.key.messageId ? 1 : 0);
-			const items = records.slice(0, input.limit);
+			const keys = workerKey === void 0 ? input.pendingOnly ? Array.from(current.pending.get(input.ownerThreadId) ?? []).sort() : current.ordered.get(ownerKey(input.ownerThreadId)) ?? [] : current.ordered.get(workerKey) ?? [];
+			const start = input.after === void 0 ? 0 : position(keys, input.after) + Number(keys[position(keys, input.after)] === input.after);
+			const items = [];
+			let bytes = 0;
+			let at = start;
+			while (at < keys.length && items.length < input.limit) {
+				const text = current.records.get(messageDeliveryKeyString({
+					ownerThreadId: input.ownerThreadId,
+					messageId: Schema.decodeSync(MessageDeliveryKey.fields.messageId)(keys[at])
+				}));
+				if (text === void 0) return yield* MessageDeliveryError.make({
+					reason: "corrupt",
+					operation: "list locator"
+				});
+				const size = new TextEncoder().encode(text).byteLength;
+				if (size > 33554432) return yield* MessageDeliveryError.make({
+					reason: "capacity",
+					operation: "list byte bound"
+				});
+				if (bytes + size > 33554432) break;
+				items.push(yield* decode(text));
+				bytes += size;
+				at++;
+			}
 			return {
 				items,
-				next: records.length > input.limit ? items.at(-1)?.key.messageId ?? null : null
+				next: at < keys.length ? items.at(-1)?.key.messageId ?? null : null
 			};
 		}),
-		due: Effect.fn("MemoryMessageDeliveryStore.due")(function* (nowMillis, limit, ownerThreadId) {
+		due: Effect.fnUntraced(function* (nowMillis, limit, ownerThreadId) {
 			const input = yield* validateMessageDelivery(Scan, {
 				nowMillis,
 				limit,
 				...ownerThreadId === void 0 ? {} : { ownerThreadId }
 			}, "due");
-			return (yield* all()).flatMap((record) => {
-				const deadline = messageDeliveryDeadline(record);
-				return deadline !== null && deadline <= input.nowMillis && (input.ownerThreadId === void 0 || input.ownerThreadId === record.key.ownerThreadId) ? [{
-					key: record.key,
-					deadline
-				}] : [];
-			}).sort((left, right) => left.deadline - right.deadline || (messageDeliveryKeyString(left.key) < messageDeliveryKeyString(right.key) ? -1 : 1)).slice(0, input.limit).map((record) => record.key);
+			const current = MutableRef.get(state.ref);
+			const keys = input.ownerThreadId === void 0 ? current.deadlineKeys : current.ownerDeadlineKeys.get(input.ownerThreadId) ?? [];
+			const selected = [];
+			for (const key of keys) {
+				const row = current.deadlines.get(key);
+				if (row === void 0) return yield* MessageDeliveryError.make({
+					reason: "corrupt",
+					operation: "deadline index"
+				});
+				if (row.deadline > input.nowMillis || selected.length === input.limit) break;
+				selected.push(row.key);
+			}
+			return selected;
 		}),
-		nextDeadline: Effect.fn("MemoryMessageDeliveryStore.nextDeadline")(function* (ownerThreadId) {
+		nextDeadline: Effect.fnUntraced(function* (ownerThreadId) {
 			if (ownerThreadId !== void 0) yield* validateMessageDelivery(ThreadId, ownerThreadId, "nextDeadline");
-			let next = null;
-			for (const record of yield* all()) {
-				if (ownerThreadId !== void 0 && ownerThreadId !== record.key.ownerThreadId) continue;
-				const deadline = messageDeliveryDeadline(record);
-				if (deadline !== null && (next === null || deadline < next)) next = deadline;
-			}
-			return next;
+			const current = MutableRef.get(state.ref);
+			const first = (ownerThreadId === void 0 ? current.deadlineKeys : current.ownerDeadlineKeys.get(ownerThreadId))?.[0];
+			return first === void 0 ? null : current.deadlines.get(first)?.deadline ?? null;
 		})
 	});
 }));