@yielded/agent-storage-memory 0.1.0-beta.167 → 0.1.0-beta.169

package/dist/MemorySubmissionLedger.mjs

@@ -1,18 +1,24 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { Cause, Clock, DateTime, Duration, Effect, Exit, Fiber, Layer, Option, Ref, Schema, Stream } from "effect";
+import { n as MemoryThreadStoreKernel, t as boundedWorkSelection } from "./WorkSelection-CmqTuws3.mjs";
+import { Cause, Clock, Context, Crypto, DateTime, Effect, Exit, Fiber, Layer, MutableRef, Option, Ref, Result, Schema, Stream } from "effect";
 import { AttemptId, ReceiptId, SubmissionId } from "@yielded/agent/identifiers";
+import { SettlementPublicationResult, SettlementPublisher, validateCanonicalSettlement, validateJoinedSettlement, validatePublication } from "@yielded/agent/settlement-publisher";
+import { AbortCommand, AbortIntent, AbortIntentRequest, AdmissionAdmitted, AdmissionConflict, AdmissionIndeterminate, AdmissionNotAdmitted, AdmissionPolicyError, AdmissionRequest, AdmissionResult, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, ChildAttachmentSnapshot, ChildBudgetReservationRequest, ChildBudgetReservationSnapshot, ChildReservationConflict, ChildSettledNotification, Claim, ClaimJoiningRequest, ClaimRequest, FundingOwner, FundingOwnerRequest, InputAppliedMarker, JoinSnapshot, JoinedToHost, JoiningClaim, LedgerCapabilities, LedgerError, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, OwnershipLost, QueueSequence, RecoverySnapshot, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReservedChildBudget, RevertJoiningRequest, Settlement, SettlementConflict, SettlementFinalization, SubmissionAdmissionFence, SubmissionLedger, SubmissionLookup, SubmissionLookupByKey, SubmissionSnapshot, SubmissionWorkItem, SuspendRequest, SuspensionSnapshot, UnknownResolution, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, WorkerLedgerState, WorkerStopCommand, approvalDecisionsCover, settlementFailureFromRecord, submissionSettlementRecordId, unknownResolutionKind, unknownResolutionMatchesResult, workerTerminalFromRecord } from "@yielded/agent/submission-ledger";
+import { RebuiltSubmission, ThreadImportRejected, invalidThreadArchive, rebuildClosedSubmission } from "@yielded/agent/thread-import";
+import { ThreadAbortFact, ThreadAdmission, ThreadApprovalFact, ThreadResolutionFact, ThreadStoreError, makeTransferFactCheck, transferPageFits } from "@yielded/agent/thread-store";
+import { admissionWork } from "@yielded/agent/thread-work";
+import { canonicalJson, utf8ByteLength } from "@yielded/agent/digest";
 import { InputMessage } from "@yielded/agent/messaging";
-import { PersistedJson, ProducerEpoch, WorkerAdmission } from "@yielded/agent/records";
-import { AbortCommand, AbortIntent, AbortIntentRequest, AdmissionAdmitted, AdmissionConflict, AdmissionIndeterminate, AdmissionNotAdmitted, AdmissionPolicyError, AdmissionRequest, AdmissionResult, ApprovalConflict, ApprovalDecisionCommand, ApprovalDecisionIntent, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, ChildAttachmentSnapshot, ChildBudgetReservationRequest, ChildBudgetReservationSnapshot, ChildReservationConflict, ChildSettledNotification, Claim, ClaimJoiningRequest, ClaimRequest, DEFAULT_OWNERSHIP_LEASE_DURATION, InputAppliedMarker, JoinSnapshot, JoinedToHost, JoiningClaim, LedgerCapabilities, LedgerError, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, OwnershipLost, OwnershipRenewal, OwnershipSnapshot, OwnershipToken, QueueSequence, RecoverySnapshot, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReleaseOwnershipRequest, RenewOwnershipRequest, ReservedChildBudget, ReservedSettlement, RevertJoiningRequest, Settlement, SettlementConflict, SettlementFinalization, SettlementReservation, SettlementReservationSnapshot, SubmissionAdmissionFence, SubmissionLedger, SubmissionLookup, SubmissionLookupByKey, SubmissionSnapshot, SubmissionWorkItem, SuspendRequest, SuspensionSnapshot, UnknownResolution, UnknownResolutionCommand, UnknownResolutionConflict, UnknownResolutionIntent, WorkerLedgerState, WorkerStopCommand, settlementFailureFromRecord, workerTerminalFromRecord } from "@yielded/agent/submission-ledger";
+import { MAX_RUN_EVIDENCE_BYTES, MAX_RUN_EVIDENCE_RECORDS, PersistedJson, WorkerAdmission } from "@yielded/agent/records";
+import { runIdForSubmission } from "@yielded/agent/run-journal";
 //#region src/MemorySubmissionLedger.ts
 var MemorySubmissionLedger_exports = /* @__PURE__ */ __exportAll({
 	MemorySubmissionLedgerLive: () => MemorySubmissionLedgerLive,
 	memorySubmissionLedgerLayer: () => memorySubmissionLedgerLayer
 });
-const MAX_SUBMISSIONS = 65536;
 /**
 * Lifecycle ordering used to advance-but-never-regress the operational state marker: a reclaimed
-* Attempt must not erase progress markers (input-applied, terminalizing) that an earlier Attempt
+* Attempt must not erase progress markers (input-applied) that an earlier Attempt
 * already committed.
 */
 const STATE_RANK = {
@@ -20,12 +26,10 @@ const STATE_RANK = {
 	ready: 1,
 	joining: 2,
 	joined: 3,
-	running: 4,
 	"input-applied": 5,
 	suspended: 6,
 	unknown: 7,
-	terminalizing: 8,
-	settled: 9
+	settled: 8
 };
 /**
 * States in which `claim` never grants the head: the lane is host-owned (`joining`/`joined`)
@@ -37,6 +41,25 @@ const BLOCKED_HEAD_STATES = /* @__PURE__ */ new Set([
 	"joined",
 	"suspended"
 ]);
+const commandPosition = (entries, key) => {
+	let low = 0;
+	let high = entries.length;
+	while (low < high) {
+		const middle = Math.floor((low + high) / 2);
+		if (entries[middle].key < key) low = middle + 1;
+		else high = middle;
+	}
+	return low;
+};
+const retainCommand = (entries, submissionId, toolCallId, resolutionKey) => {
+	const key = String(entries.length + 1).padStart(16, "0");
+	entries.push({
+		key,
+		submissionId,
+		...toolCallId === void 0 ? {} : { toolCallId },
+		...resolutionKey === void 0 ? {} : { resolutionKey }
+	});
+};
 const failure = (error) => ({
 	_tag: "failure",
 	error
@@ -53,15 +76,19 @@ const ledgerError = (operation, message, cause) => cause === void 0 ? LedgerErro
 	message,
 	cause
 });
-const validate = Effect.fn("MemorySubmissionLedger.validate")((schema, operation, value) => Schema.encodeUnknownEffect(schema)(value).pipe(Effect.flatMap(Schema.decodeUnknownEffect(schema)), Effect.mapError((error) => ledgerError(operation, `Invalid ${operation} request`, error))));
+const validate = (schema, operation, value) => Schema.encodeUnknownEffect(schema)(value).pipe(Effect.flatMap(Schema.decodeUnknownEffect(schema)), Effect.mapError((error) => ledgerError(operation, `Invalid ${operation} request`, error)));
 const decodeSubmissionId = Schema.decodeSync(SubmissionId);
 const decodeReceiptId = Schema.decodeSync(ReceiptId);
 const decodeAttemptId = Schema.decodeSync(AttemptId);
-const decodeOwnershipToken = Schema.decodeSync(OwnershipToken);
+const MemoryIdentityNonce = Schema.String.check(Schema.isUUID(4));
 const decodeQueueSequence = Schema.decodeSync(QueueSequence);
-const decodeProducerEpoch = Schema.decodeSync(ProducerEpoch);
 const equivalentPersistedJson = Schema.toEquivalence(PersistedJson);
 const equivalentUnknownResolution = Schema.toEquivalence(UnknownResolution);
+const admissionFitsTransfer = makeTransferFactCheck(ThreadAdmission);
+const abortFitsTransfer = makeTransferFactCheck(ThreadAbortFact);
+const approvalFitsTransfer = makeTransferFactCheck(ThreadApprovalFact);
+const resolutionFitsTransfer = makeTransferFactCheck(ThreadResolutionFact);
+const transferCapacityError = (operation) => ledgerError(operation, "Accepted fact exceeds its bounded transfer representation");
 const utc = (millis) => DateTime.toUtc(DateTime.makeUnsafe(millis));
 const admissionKey = (threadId, principal, idempotencyKey) => JSON.stringify([
 	threadId,
@@ -103,90 +130,222 @@ const toReservationSnapshot = (row) => ChildBudgetReservationSnapshot.make({
 	...row.releaseBeganAtMillis === void 0 ? {} : { releaseBeganAt: utc(row.releaseBeganAtMillis) },
 	...row.releasedAtMillis === void 0 ? {} : { releasedAt: utc(row.releasedAtMillis) }
 });
+const fromRebuilt = (rebuilt) => {
+	const admission = rebuilt.admission;
+	const threadId = admission.threadId;
+	const canonicalSettlement = rebuilt.settlement?.payload;
+	const settlement = canonicalSettlement?._tag === "SubmissionSettled" ? canonicalSettlement : void 0;
+	return {
+		row: {
+			submissionId: admission.submissionId,
+			threadId,
+			queueSequence: admission.queueSequence,
+			principal: admission.principal,
+			idempotencyKey: admission.idempotencyKey,
+			agentId: admission.agentId,
+			agentDigests: admission.agentDigests,
+			deploymentId: admission.deploymentId,
+			inputPayload: admission.inputPayload,
+			inputDigest: admission.inputDigest,
+			receiptId: admission.receiptId,
+			state: rebuilt.state,
+			settledOutcome: settlement?.outcome,
+			createdAtMillis: DateTime.toEpochMillis(admission.createdAt),
+			readyAtMillis: rebuilt.state === "ready" ? DateTime.toEpochMillis(admission.createdAt) : void 0,
+			parentLinkage: admission.parentLinkage,
+			...admission.workerAdmission === void 0 ? {} : { workerAdmissionJson: Schema.encodeSync(Schema.fromJsonString(WorkerAdmission))(admission.workerAdmission) },
+			...admission.messageAdmission === void 0 ? {} : { messageAdmissionJson: Schema.encodeSync(Schema.fromJsonString(InputMessage))(admission.messageAdmission) },
+			...admission.admissionGroup === void 0 ? {} : { admissionGroup: admission.admissionGroup },
+			...admission.admissionFence === void 0 ? {} : { admissionFence: admission.admissionFence }
+		},
+		inputApplied: rebuilt.inputApplied,
+		finalization: settlement === void 0 || rebuilt.settlement === void 0 || admission.settledAt === void 0 ? void 0 : {
+			settlementId: settlement.settlementId,
+			recordId: rebuilt.settlement.recordId,
+			finalizedAtMillis: DateTime.toEpochMillis(admission.settledAt)
+		},
+		abortIntent: rebuilt.abort,
+		joinedHostSubmissionId: rebuilt.joinedHostSubmissionId,
+		suspension: rebuilt.suspension === void 0 ? void 0 : {
+			reason: rebuilt.suspension.reason,
+			suspendedAtMillis: DateTime.toEpochMillis(rebuilt.suspension.suspendedAt)
+		},
+		unknownMark: rebuilt.unknownToolCallIds.length === 0 ? void 0 : {
+			reason: "Unresolved Tool execution recovered from the canonical log",
+			toolCallIds: rebuilt.unknownToolCallIds
+		},
+		approvalDecisions: new Map(rebuilt.approvals.map((intent) => [intent.toolCallId, intent])),
+		unknownResolutions: new Map(rebuilt.resolutions.map((intent) => [JSON.stringify([intent.toolCallId, unknownResolutionKind(intent.resolution)]), { intent }]))
+	};
+};
 /** Linkage equality: both absent, or both present naming the same parent Tool Call. */
 const sameParentLinkage = (left, right) => left === void 0 ? right === void 0 : right !== void 0 && left.parentSubmissionId === right.parentSubmissionId && left.parentToolCallId === right.parentToolCallId;
-const laneEpoch = (state, threadId) => state.lanes.get(threadId)?.producerEpoch ?? 0;
-const ownershipLost = (state, stored) => OwnershipLost.make({
-	submissionId: stored.row.submissionId,
-	actualEpoch: decodeProducerEpoch(laneEpoch(state, stored.row.threadId))
-});
-/** A retained row token cannot outlive a newer owner of the same Thread. */
-const ownsLane = (state, stored, ownershipToken) => stored.ownership !== void 0 && stored.ownership.ownershipToken === ownershipToken && stored.ownership.producerEpoch === laneEpoch(state, stored.row.threadId);
+const ownershipLost = (stored) => OwnershipLost.make({ submissionId: stored.row.submissionId });
 const withSubmission = (state, stored) => {
-	const active = new Set(state.activeByThread.get(stored.row.threadId));
-	if (stored.row.state === "settled") active.delete(stored.row.submissionId);
-	else active.add(stored.row.submissionId);
-	return {
-		...state,
-		submissions: new Map(state.submissions).set(stored.row.submissionId, stored),
-		activeByThread: new Map(state.activeByThread).set(stored.row.threadId, active)
-	};
+	const row = stored.row;
+	const previous = state.submissions.get(row.submissionId);
+	let directory = state.byThread.get(row.threadId);
+	if (directory === void 0) {
+		directory = {
+			ordered: [],
+			commands: {
+				aborts: [],
+				approvals: [],
+				resolutions: []
+			},
+			children: 0,
+			workers: 0,
+			reservations: 0
+		};
+		state.byThread.set(row.threadId, directory);
+	}
+	if (previous === void 0) {
+		let low = 0;
+		let high = directory.ordered.length;
+		while (low < high) {
+			const middle = Math.floor((low + high) / 2);
+			const candidate = state.submissions.get(directory.ordered[middle]);
+			if (candidate !== void 0 && candidate.row.queueSequence < row.queueSequence) low = middle + 1;
+			else high = middle;
+		}
+		directory.ordered.splice(low, 0, row.submissionId);
+		state.receipts.set(row.receiptId, row.submissionId);
+		state.admissionIndex.set(admissionKey(row.threadId, row.principal, row.idempotencyKey), row.submissionId);
+		const latest = state.latestByThread.get(row.threadId);
+		if (latest === void 0 || (state.submissions.get(latest)?.row.queueSequence ?? -1) < row.queueSequence) state.latestByThread.set(row.threadId, row.submissionId);
+	}
+	directory.children += Number(row.state !== "settled" && row.parentLinkage !== void 0) - Number(previous !== void 0 && previous.row.state !== "settled" && previous.row.parentLinkage !== void 0);
+	directory.workers += Number(row.state !== "settled" && row.workerAdmissionJson !== void 0) - Number(previous !== void 0 && previous.row.state !== "settled" && previous.row.workerAdmissionJson !== void 0);
+	if (stored.abortIntent !== void 0 && previous?.abortIntent === void 0) retainCommand(directory.commands.aborts, row.submissionId);
+	if (stored.approvalDecisions !== previous?.approvalDecisions) {
+		for (const id of stored.approvalDecisions.keys()) if (!previous?.approvalDecisions.has(id)) retainCommand(directory.commands.approvals, row.submissionId, id);
+	}
+	if (stored.unknownResolutions !== previous?.unknownResolutions) {
+		for (const [id, value] of stored.unknownResolutions) if (!previous?.unknownResolutions.has(id)) retainCommand(directory.commands.resolutions, row.submissionId, value.intent.toolCallId, id);
+	}
+	if (previous?.joinedHostSubmissionId !== void 0 && previous.joinedHostSubmissionId !== stored.joinedHostSubmissionId) state.joinsByHost.get(previous.joinedHostSubmissionId)?.delete(row.submissionId);
+	if (stored.joinedHostSubmissionId !== void 0) {
+		let joins = state.joinsByHost.get(stored.joinedHostSubmissionId);
+		if (joins === void 0) state.joinsByHost.set(stored.joinedHostSubmissionId, joins = /* @__PURE__ */ new Set());
+		joins.add(row.submissionId);
+	}
+	let active = state.activeByThread.get(row.threadId);
+	if (active === void 0) state.activeByThread.set(row.threadId, active = /* @__PURE__ */ new Set());
+	if (row.state === "settled") active.delete(row.submissionId);
+	else active.add(row.submissionId);
+	state.submissions.set(row.submissionId, stored);
+	return state;
+};
+const withChildReservation = (state, reservation) => {
+	const previous = state.childReservations.get(reservation.reservationId);
+	state.childReservations.set(reservation.reservationId, reservation);
+	let children = state.childrenByParent.get(reservation.parentSubmissionId);
+	if (children === void 0) state.childrenByParent.set(reservation.parentSubmissionId, children = /* @__PURE__ */ new Set());
+	children.add(reservation.reservationId);
+	const parent = state.submissions.get(reservation.parentSubmissionId);
+	if (parent !== void 0) {
+		const directory = state.byThread.get(parent.row.threadId);
+		if (directory !== void 0) directory.reservations += Number(reservation.status !== "released") - Number(previous !== void 0 && previous.status !== "released");
+	}
+	return state;
 };
-const withChildReservation = (state, reservation) => ({
-	...state,
-	childReservations: new Map(state.childReservations).set(reservation.reservationId, reservation)
-});
 const findHead = (state, threadId) => {
 	let head;
-	for (const stored of state.submissions.values()) {
-		if (stored.row.threadId !== threadId || stored.row.state === "settled" || stored.row.state === "unknown" && stored.abortIntent === void 0) continue;
+	for (const id of state.activeByThread.get(threadId) ?? []) {
+		const stored = state.submissions.get(id);
+		if (stored === void 0 || stored.row.state === "unknown" && stored.abortIntent === void 0) continue;
 		if (head === void 0 || stored.row.queueSequence < head.row.queueSequence) head = stored;
 	}
 	return head;
 };
+function* threadRows(state, threadId, after = -1) {
+	const ordered = state.byThread.get(threadId)?.ordered ?? [];
+	let low = 0;
+	let high = ordered.length;
+	while (low < high) {
+		const middle = Math.floor((low + high) / 2);
+		if ((state.submissions.get(ordered[middle])?.row.queueSequence ?? -1) <= after) low = middle + 1;
+		else high = middle;
+	}
+	for (let index = low; index < ordered.length; index++) {
+		const stored = state.submissions.get(ordered[index]);
+		if (stored !== void 0) yield stored;
+	}
+}
 /**
-* Reference in-memory SubmissionLedger. It implements the full port contract — atomic idempotent
-* admission, eligible FIFO claims, producer-epoch fencing, Clock-driven ownership leases, idempotent
-* settlement reservation/finalization, and durable abort intent — with every transition applied
-* as one atomic `Ref.modify`, but its state does not survive the process (`non-durable`).
+* Reference in-memory SubmissionLedger. Admission, ordered selection and canonical settlement
+* share the Memory kernel's mutation gate. The kernel Scope owns local Run capabilities;
+* selecting work does not write execution ownership into the ledger.
 *
-* Adapter-specific semantics within the port's latitude:
-*
-* - Time comes exclusively from the Effect `Clock` service, so `TestClock` drives lease expiry
-*   deterministically; no wall clock is consulted.
-* - The ownership lease is pinned to `DEFAULT_OWNERSHIP_LEASE_DURATION` (D5); durable adapters
-*   own the configuration seam.
-* - Any live lease in the Thread blocks every new claim, including the same `producerId`.
-*   Unresolved unknown work is skipped only after ownership is released or expires.
-* - Claiming advances `ready` to `running` and otherwise preserves the recorded state, so
-*   progress markers from an earlier Attempt survive a reclaim.
-* - `renewOwnership` keeps the token stable (the port allows rotation); a replayed admission
-*   reports the Submission's current state alongside the original identities.
-* - `claimJoining` walks the strictly-later queue: rows already `joining`/`joined` to the
-*   SAME host extend the claimed prefix and are skipped, and an aborted-settled row is a
-*   closed obligation that is also skipped (P7 §7(c)); any other non-`ready` row (an
-*   `admitted` gap, a non-aborted settled row, foreign-host linkage) breaks the prefix
-*   conservatively.
-* - `markJoined` verifies the token against the HOST's live ownership (the lane is
-*   host-owned), so a later host Attempt can repair a lost marker from history (DUR-016). The
-*   join marker reuses the input-applied marker: the joined input IS `input:{sid}`.
-* - `suspend` and `markUnknown` refuse when an exact settlement is already reserved
-*   (`SettlementConflict` with the reserved outcome) — DUR-011's reservation wins.
-* - `resolveAdmission` derives its answer from the single strongly consistent store, so it
-*   never answers `Indeterminate` on its own; the test-only `resolveAdmissionFault` option
-*   injects the `Indeterminate` classification so SUB-031 callers can be conformance-tested.
-* - `recordChildSettled` and `suspend(WaitingForChild)` observe child settlement directly from
-*   the child rows (single-store latitude); no separate notification marker is stored.
+* Joining retains the contiguous ready prefix and exact host linkage. Canonical settlement
+* authorizes finalization and child wake repair, while bound sessions reject late commands.
+* Child wake checks read the child rows directly, without a separate notification marker.
+* Admission resolution is strongly consistent; resolveAdmissionFault injects the
+* Indeterminate outcome for existing caller conformance workflows.
 */
 const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
+	const journal = yield* MemoryThreadStoreKernel;
+	const crypto = yield* Crypto.Crypto;
+	const mintIdentity = (operation) => crypto.randomUUIDv4().pipe(Effect.flatMap(Schema.decodeEffect(MemoryIdentityNonce)), Effect.mapError((cause) => ledgerError(operation, "Cannot mint a Memory identity", cause)));
 	const state = yield* Ref.make({
+		byThread: /* @__PURE__ */ new Map(),
+		receipts: /* @__PURE__ */ new Map(),
+		joinsByHost: /* @__PURE__ */ new Map(),
+		childrenByParent: /* @__PURE__ */ new Map(),
 		submissions: /* @__PURE__ */ new Map(),
 		admissionIndex: /* @__PURE__ */ new Map(),
 		lanes: /* @__PURE__ */ new Map(),
 		childReservations: /* @__PURE__ */ new Map(),
-		mintCounter: 0,
+		freshAdmissionSequence: 0,
 		stoppedWorkers: /* @__PURE__ */ new Map(),
 		latestByThread: /* @__PURE__ */ new Map(),
 		activeByThread: /* @__PURE__ */ new Map()
 	});
+	yield* journal.registerWorkOwner("admissions", {
+		threads: (request) => Ref.get(state).pipe(Effect.map((current) => {
+			const candidates = boundedWorkSelection(request.limit, (id) => id, request.afterThreadId);
+			for (const [threadId, ids] of current.activeByThread) if (ids.size > 0) candidates.add(threadId);
+			const threadIds = candidates.values;
+			const afterThreadId = threadIds.length === request.limit ? threadIds.at(-1) : void 0;
+			return {
+				threadIds,
+				...afterThreadId === void 0 ? {} : { afterThreadId }
+			};
+		})),
+		page: (threadId, after, limit) => Effect.gen(function* () {
+			const current = yield* Ref.get(state);
+			const candidates = boundedWorkSelection(limit + 1, (id) => id, after);
+			for (const id of current.activeByThread.get(threadId) ?? []) candidates.add(id);
+			const ids = candidates.values;
+			const entries = [];
+			for (const id of ids.slice(0, limit)) {
+				const stored = current.submissions.get(id);
+				if (stored === void 0 || stored.row.threadId !== threadId || stored.row.state === "settled") return yield* ThreadStoreError.make({
+					operation: "admission work",
+					message: "Active admission index is incomplete or corrupt"
+				});
+				const entry = admissionWork(stored.row);
+				entries.push(stored.suspension === void 0 ? entry : {
+					...entry,
+					wait: stored.suspension.reason._tag === "WaitingForChild" ? "child" : "approval"
+				});
+			}
+			const next = ids.length > limit ? ids[limit - 1] : void 0;
+			return {
+				entries,
+				...next === void 0 ? {} : { after: next }
+			};
+		})
+	});
 	const admissionFence = yield* SubmissionAdmissionFence;
-	const leaseMillis = Duration.toMillis(DEFAULT_OWNERSHIP_LEASE_DURATION);
 	const capabilities = Effect.succeed(LedgerCapabilities.make({ durability: "non-durable" }));
-	const admit = Effect.fn("MemorySubmissionLedger.admit")((unvalidated) => Effect.gen(function* () {
+	const admit = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(AdmissionRequest, "admit", unvalidated);
 		const workerAdmissionJson = request.workerAdmission === void 0 ? void 0 : yield* Schema.encodeEffect(Schema.fromJsonString(WorkerAdmission))(request.workerAdmission).pipe(Effect.mapError(() => ledgerError("admit", "Invalid worker admission metadata")));
 		const messageAdmissionJson = request.messageAdmission === void 0 ? void 0 : yield* Schema.encodeEffect(Schema.fromJsonString(InputMessage))(request.messageAdmission).pipe(Effect.mapError(() => ledgerError("admit", "Invalid message admission metadata")));
+		yield* journal.checkThreadCapacity(request.threadId).pipe(Effect.mapError((cause) => ledgerError("admit", cause.message, cause)));
 		const nowMillis = yield* Clock.currentTimeMillis;
+		const identity = (yield* Ref.get(state)).admissionIndex.has(admissionKey(request.threadId, request.principal, request.idempotencyKey)) ? Result.fail(ledgerError("admit", "Retained admission disappeared")) : yield* Effect.result(mintIdentity("admit"));
 		const services = yield* Effect.context();
 		const decision = yield* Ref.modify(state, (current) => {
 			const key = admissionKey(request.threadId, request.principal, request.idempotencyKey);
@@ -213,7 +372,7 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				reason: "refused",
 				code: "worker-stopped"
 			})), current];
-			const first = [...current.submissions.values()].find(({ row }) => row.threadId === request.threadId);
+			const first = threadRows(current, request.threadId).next().value;
 			if (first !== void 0) {
 				const previous = first.row.workerAdmissionJson === void 0 ? void 0 : Schema.decodeSync(Schema.fromJsonString(WorkerAdmission))(first.row.workerAdmissionJson);
 				if (!Schema.toEquivalence(Schema.optional(WorkerAdmission.fields.origin))(previous?.origin, request.workerAdmission?.origin)) return [failure(AdmissionPolicyError.make({
@@ -226,18 +385,20 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				_tag: "cause",
 				cause: checked.cause
 			}, current];
-			if (request.admissionGroup !== void 0 && [...current.submissions.values()].some(({ row }) => row.threadId === request.threadId && row.admissionGroup === request.admissionGroup && row.state !== "settled")) return [failure(AdmissionPolicyError.make({
+			if (request.admissionGroup !== void 0 && Array.from(current.activeByThread.get(request.threadId) ?? []).some((id) => current.submissions.get(id)?.row.admissionGroup === request.admissionGroup)) return [failure(AdmissionPolicyError.make({
 				reason: "occupied",
 				code: "admission-group"
 			})), current];
-			if (current.submissions.size >= MAX_SUBMISSIONS) return [failure(ledgerError("admit", `In-memory submission limit ${MAX_SUBMISSIONS} exceeded`)), current];
-			const lane = current.lanes.get(request.threadId) ?? {
-				nextQueueSequence: 1,
-				producerEpoch: 0
-			};
-			const mintCounter = current.mintCounter + 1;
+			if (Result.isFailure(identity)) return [failure(identity.failure), current];
+			const lane = current.lanes.get(request.threadId) ?? { nextQueueSequence: 1 };
+			const freshAdmissionSequence = current.freshAdmissionSequence + 1;
+			if (!Number.isSafeInteger(freshAdmissionSequence)) return [failure(ledgerError("admit", "Fresh admission sequence is exhausted")), current];
+			const orderedIdentity = `${String(freshAdmissionSequence).padStart(16, "0")}-${identity.success}`;
+			const submissionId = decodeSubmissionId(`submission-memory-${orderedIdentity}`);
+			const receiptId = decodeReceiptId(`receipt-memory-${orderedIdentity}`);
+			if (current.submissions.has(submissionId) || current.receipts.has(receiptId)) return [failure(ledgerError("admit", "Fresh admission identity already exists")), current];
 			const row = {
-				submissionId: decodeSubmissionId(`submission-memory-${mintCounter}`),
+				submissionId,
 				threadId: request.threadId,
 				queueSequence: decodeQueueSequence(lane.nextQueueSequence),
 				principal: request.principal,
@@ -247,7 +408,7 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				deploymentId: request.deploymentId,
 				inputPayload: request.inputPayload,
 				inputDigest: request.inputDigest,
-				receiptId: decodeReceiptId(`receipt-memory-${mintCounter}`),
+				receiptId,
 				state: "admitted",
 				settledOutcome: void 0,
 				createdAtMillis: nowMillis,
@@ -258,23 +419,21 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				...request.admissionGroup === void 0 ? {} : { admissionGroup: request.admissionGroup },
 				...request.admissionFence === void 0 ? {} : { admissionFence: request.admissionFence }
 			};
-			const submissions = new Map(current.submissions).set(row.submissionId, {
+			const stored = {
 				row,
-				ownership: void 0,
 				inputApplied: void 0,
-				reservation: void 0,
+				finalization: void 0,
 				abortIntent: void 0,
 				joinedHostSubmissionId: void 0,
 				suspension: void 0,
 				unknownMark: void 0,
 				approvalDecisions: /* @__PURE__ */ new Map(),
 				unknownResolutions: /* @__PURE__ */ new Map()
-			});
-			const admissionIndex = new Map(current.admissionIndex).set(key, row.submissionId);
-			const lanes = new Map(current.lanes).set(request.threadId, {
-				nextQueueSequence: lane.nextQueueSequence + 1,
-				producerEpoch: lane.producerEpoch
-			});
+			};
+			if (!admissionFitsTransfer(request.threadId, toAdmission(row))) return [failure(transferCapacityError("admit")), current];
+			journal.initializeWork(request.threadId);
+			const admissionIndex = current.admissionIndex;
+			const lanes = current.lanes.set(request.threadId, { nextQueueSequence: lane.nextQueueSequence + 1 });
 			return [success(AdmissionResult.make({
 				submissionId: row.submissionId,
 				receiptId: row.receiptId,
@@ -282,13 +441,10 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				state: row.state,
 				replayed: false
 			})), {
-				...current,
-				submissions,
+				...withSubmission(current, stored),
 				admissionIndex,
 				lanes,
-				mintCounter,
-				latestByThread: new Map(current.latestByThread).set(request.threadId, row.submissionId),
-				activeByThread: new Map(current.activeByThread).set(request.threadId, /* @__PURE__ */ new Set([...current.activeByThread.get(request.threadId) ?? [], row.submissionId]))
+				freshAdmissionSequence
 			}];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
@@ -303,8 +459,8 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			return yield* Effect.failCause(decision.cause);
 		}
 		return decision.value;
-	}), Effect.uninterruptible);
-	const markReady = Effect.fn("MemorySubmissionLedger.markReady")((unvalidated) => Effect.gen(function* () {
+	}, Effect.uninterruptible);
+	const markReady = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(MarkReadyRequest, "markReady", unvalidated);
 		const nowMillis = yield* Clock.currentTimeMillis;
 		const decision = yield* Ref.modify(state, (current) => {
@@ -321,15 +477,15 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			})];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
-	}));
-	const lookup = Effect.fn("MemorySubmissionLedger.lookup")((unvalidated) => Effect.gen(function* () {
+	});
+	const lookup = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(SubmissionLookup, "lookup", unvalidated);
 		const current = yield* Ref.get(state);
 		const submissionId = request._tag === "SubmissionLookupById" ? request.submissionId : current.admissionIndex.get(admissionKey(request.threadId, request.principal, request.idempotencyKey));
 		const stored = submissionId === void 0 ? void 0 : current.submissions.get(submissionId);
 		return stored === void 0 ? Option.none() : Option.some(toSnapshot(stored.row));
-	}));
-	const resolveAdmission = Effect.fn("MemorySubmissionLedger.resolveAdmission")((unvalidated) => Effect.gen(function* () {
+	});
+	const resolveAdmission = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(SubmissionLookupByKey, "resolveAdmission", unvalidated);
 		if (options.resolveAdmissionFault !== void 0) {
 			const fault = yield* options.resolveAdmissionFault;
@@ -339,17 +495,16 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		const submissionId = current.admissionIndex.get(admissionKey(request.threadId, request.principal, request.idempotencyKey));
 		const stored = submissionId === void 0 ? void 0 : current.submissions.get(submissionId);
 		return stored === void 0 ? AdmissionNotAdmitted.make() : AdmissionAdmitted.make({ submission: toSnapshot(stored.row) });
-	}));
-	const claim = Effect.fn("MemorySubmissionLedger.claim")((unvalidated) => Effect.gen(function* () {
+	});
+	const selectHead = Effect.fn("MemorySubmissionLedger.selectHead")((unvalidated) => Effect.gen(function* () {
 		const request = yield* validate(ClaimRequest, "claim", unvalidated);
-		const nowMillis = yield* Clock.currentTimeMillis;
+		const identity = yield* mintIdentity("claim");
 		const decision = yield* Ref.modify(state, (current) => {
-			for (const stored of current.submissions.values()) if (stored.row.threadId === request.threadId && stored.ownership !== void 0 && stored.ownership.leaseExpiresAtMillis > nowMillis) return [success(Option.none()), current];
+			if (journal.owner.hasOwner(request.threadId)) return [success(Option.none()), current];
 			let head = findHead(current, request.threadId);
 			if (request.handoff !== void 0) {
 				const handoff = request.handoff;
-				if (current.lanes.get(request.threadId)?.producerEpoch !== handoff.producerEpoch) return [success(Option.none()), current];
-				const candidates = [...current.submissions.values()].filter((entry) => entry.row.threadId === request.threadId && entry.row.state !== "settled" && !(entry.row.state === "unknown" && entry.abortIntent === void 0)).sort((a, b) => a.row.queueSequence - b.row.queueSequence);
+				const candidates = Array.from(current.activeByThread.get(request.threadId) ?? [], (id) => current.submissions.get(id)).filter((entry) => entry !== void 0 && !(entry.row.state === "unknown" && entry.abortIntent === void 0)).sort((a, b) => a.row.queueSequence - b.row.queueSequence);
 				for (const candidate of candidates) {
 					if (candidate.row.submissionId === handoff.submissionId) {
 						head = candidate;
@@ -357,91 +512,25 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 					}
 					if (!handoff.deferredSubmissionIds.includes(candidate.row.submissionId) || candidate.row.state !== "input-applied" || candidate.abortIntent !== void 0) return [success(Option.none()), current];
 				}
-				if (head?.row.submissionId !== handoff.submissionId || head.row.state !== "ready" && head.row.state !== "running" && head.row.state !== "input-applied") return [success(Option.none()), current];
+				if (head?.row.submissionId !== handoff.submissionId || head.row.state !== "ready" && head.row.state !== "input-applied") return [success(Option.none()), current];
 			}
 			if (head === void 0) return [success(Option.none()), current];
 			if (BLOCKED_HEAD_STATES.has(head.row.state)) return [success(Option.none()), current];
-			const lane = current.lanes.get(request.threadId);
-			if (lane === void 0) return [failure(ledgerError("claim", "Claimable head without a Thread lane")), current];
-			const producerEpoch = decodeProducerEpoch(lane.producerEpoch + 1);
-			const mintCounter = current.mintCounter + 1;
-			const ownership = {
-				attemptId: decodeAttemptId(`attempt-memory-${mintCounter}`),
-				ownershipToken: decodeOwnershipToken(`ownership-memory-${mintCounter}`),
-				producerEpoch,
-				ownerProducerId: request.producerId,
-				leaseExpiresAtMillis: nowMillis + leaseMillis
-			};
-			const row = head.row.state === "ready" ? {
-				...head.row,
-				state: "running"
-			} : head.row;
-			const next = withSubmission(current, {
-				...head,
-				row,
-				ownership
-			});
-			const lanes = new Map(next.lanes).set(request.threadId, {
-				nextQueueSequence: lane.nextQueueSequence,
-				producerEpoch: lane.producerEpoch + 1
-			});
 			return [success(Option.some(Claim.make({
-				submissionId: row.submissionId,
-				attemptId: ownership.attemptId,
-				ownershipToken: ownership.ownershipToken,
-				producerEpoch,
-				leaseExpiresAt: utc(ownership.leaseExpiresAtMillis),
-				inputPayload: row.inputPayload
-			}))), {
-				...next,
-				lanes,
-				mintCounter
-			}];
-		});
-		if (decision._tag === "failure") return yield* decision.error;
-		return decision.value;
-	}));
-	const renewOwnership = Effect.fn("MemorySubmissionLedger.renewOwnership")((unvalidated) => Effect.gen(function* () {
-		const request = yield* validate(RenewOwnershipRequest, "renewOwnership", unvalidated);
-		const nowMillis = yield* Clock.currentTimeMillis;
-		const decision = yield* Ref.modify(state, (current) => {
-			const stored = current.submissions.get(request.submissionId);
-			if (stored === void 0) return [failure(ledgerError("renewOwnership", `Unknown Submission ${request.submissionId}`)), current];
-			if (stored.ownership === void 0 || !ownsLane(current, stored, request.ownershipToken)) return [failure(ownershipLost(current, stored)), current];
-			const ownership = {
-				...stored.ownership,
-				leaseExpiresAtMillis: nowMillis + leaseMillis
-			};
-			return [success(OwnershipRenewal.make({
-				ownershipToken: ownership.ownershipToken,
-				leaseExpiresAt: utc(ownership.leaseExpiresAtMillis)
-			})), withSubmission(current, {
-				...stored,
-				ownership
-			})];
+				submissionId: head.row.submissionId,
+				attemptId: decodeAttemptId(`attempt-memory-${identity}`),
+				inputPayload: head.row.inputPayload
+			}))), current];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
 	}));
-	const releaseOwnership = Effect.fn("MemorySubmissionLedger.releaseOwnership")((unvalidated) => Effect.gen(function* () {
-		const request = yield* validate(ReleaseOwnershipRequest, "releaseOwnership", unvalidated);
-		const decision = yield* Ref.modify(state, (current) => {
-			const stored = current.submissions.get(request.submissionId);
-			if (stored === void 0) return [failure(ledgerError("releaseOwnership", `Unknown Submission ${request.submissionId}`)), current];
-			if (!ownsLane(current, stored, request.ownershipToken)) return [failure(ownershipLost(current, stored)), current];
-			return [success(void 0), withSubmission(current, {
-				...stored,
-				ownership: void 0
-			})];
-		});
-		if (decision._tag === "failure") return yield* decision.error;
-	}));
-	const markInputApplied = Effect.fn("MemorySubmissionLedger.markInputApplied")((unvalidated) => Effect.gen(function* () {
+	const markInputApplied = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(MarkInputAppliedRequest, "markInputApplied", unvalidated);
 		const decision = yield* Ref.modify(state, (current) => {
 			const stored = current.submissions.get(request.submissionId);
 			if (stored === void 0) return [failure(ledgerError("markInputApplied", `Unknown Submission ${request.submissionId}`)), current];
-			if (!ownsLane(current, stored, request.ownershipToken)) return [failure(ownershipLost(current, stored)), current];
+			if (!journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId)) return [failure(ownershipLost(stored)), current];
 			if (stored.inputApplied !== void 0) {
 				if (stored.inputApplied.recordId === request.recordId && stored.inputApplied.sequence === request.sequence) return [success(void 0), current];
 				return [failure(ledgerError("markInputApplied", `A different canonical input marker is already recorded for Submission ${request.submissionId}`)), current];
@@ -461,103 +550,121 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			})];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
-	}));
-	const reserveSettlement = Effect.fn("MemorySubmissionLedger.reserveSettlement")((unvalidated) => Effect.gen(function* () {
-		const request = yield* validate(SettlementReservation, "reserveSettlement", unvalidated);
-		const decision = yield* Ref.modify(state, (current) => {
+	});
+	const canonicalSettlement = Effect.fnUntraced(function* (submission) {
+		const record = yield* journal.record(submission.threadId, submissionSettlementRecordId(submission.submissionId));
+		if (record === void 0) return void 0;
+		return {
+			record,
+			settlement: yield* validateCanonicalSettlement(record, submission)
+		};
+	});
+	const publish = Effect.fn("MemorySettlementPublisher.publish")(function* (input) {
+		const { request, record, settlement } = yield* validatePublication(input);
+		const prepared = yield* journal.prepareAppend(request.append);
+		return yield* journal.owner.withProgress(request.append.threadId, journal.withMutation(Effect.gen(function* () {
+			const current = yield* Ref.get(state);
 			const stored = current.submissions.get(request.submissionId);
-			if (stored === void 0) return [failure(ledgerError("reserveSettlement", `Unknown Submission ${request.submissionId}`)), current];
-			const joinedSettlement = stored.row.state === "joined" && stored.joinedHostSubmissionId !== void 0;
-			const queuedAbortSettlement = request.outcome === "aborted" && stored.abortIntent !== void 0 && stored.ownership === void 0 && (stored.row.state === "ready" || stored.row.state === "terminalizing");
-			if (!joinedSettlement && !queuedAbortSettlement && !ownsLane(current, stored, request.ownershipToken)) return [failure(ownershipLost(current, stored)), current];
-			const existing = stored.reservation;
-			if (existing !== void 0) {
-				if (existing.settlementId !== request.settlementId || existing.outcome !== request.outcome || existing.recordDigest !== request.recordDigest) return [failure(SettlementConflict.make({
-					submissionId: request.submissionId,
-					existingOutcome: existing.outcome
-				})), current];
-				return [success(ReservedSettlement.make({
-					submissionId: request.submissionId,
-					settlementId: existing.settlementId,
-					outcome: existing.outcome,
-					record: existing.record,
-					recordDigest: existing.recordDigest,
-					replayed: true
-				})), current];
+			if (stored === void 0) return yield* ledgerError("publish settlement", "Unknown Submission");
+			if (stored.row.threadId !== prepared.request.threadId) return yield* ledgerError("publish settlement", "Publication targets another Thread");
+			yield* validateCanonicalSettlement(record, stored.row);
+			const existing = yield* canonicalSettlement(stored.row);
+			const tail = yield* journal.tail(stored.row.threadId);
+			switch (request.authority._tag) {
+				case "Owned":
+					if (!journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId)) return yield* ownershipLost(stored);
+					yield* validateCanonicalSettlement(record, {
+						submissionId: request.submissionId,
+						receiptId: stored.row.receiptId,
+						...settlement.outcome === "aborted" && settlement.runId === void 0 ? {} : { runId: runIdForSubmission(request.submissionId) }
+					});
+					break;
+				case "Joined": {
+					if (stored.row.state !== "joined" && !(stored.row.state === "settled" && existing !== void 0) || stored.joinedHostSubmissionId !== request.authority.hostSubmissionId) return yield* ledgerError("publish settlement", "Submission is not joined to this host");
+					const host = current.submissions.get(request.authority.hostSubmissionId);
+					const canonicalHost = host === void 0 || host.row.threadId !== stored.row.threadId ? void 0 : yield* canonicalSettlement(host.row);
+					if (canonicalHost === void 0) return yield* ledgerError("publish settlement", "Joined host has no canonical settlement");
+					yield* validateJoinedSettlement(settlement, canonicalHost.settlement);
+					break;
+				}
+				case "QueuedAbort":
+					if (stored.row.state !== "ready" && !(stored.row.state === "settled" && existing !== void 0) || stored.abortIntent === void 0 || journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId) || settlement.outcome !== "aborted") return yield* ledgerError("publish settlement", "Submission is not an unclaimed queued abort");
+					yield* validateCanonicalSettlement(record, {
+						submissionId: request.submissionId,
+						receiptId: stored.row.receiptId,
+						runId: void 0
+					});
 			}
-			const reservation = {
-				settlementId: request.settlementId,
-				outcome: request.outcome,
-				record: request.record,
-				recordDigest: request.recordDigest,
-				finalizedAtMillis: void 0
-			};
-			const row = STATE_RANK[stored.row.state] < STATE_RANK.terminalizing ? {
-				...stored.row,
-				state: "terminalizing"
-			} : stored.row;
-			return [success(ReservedSettlement.make({
-				submissionId: request.submissionId,
-				settlementId: reservation.settlementId,
-				outcome: reservation.outcome,
-				record: reservation.record,
-				recordDigest: reservation.recordDigest,
+			if (existing !== void 0) return SettlementPublicationResult.make({
+				record: existing.record,
+				tailSequence: tail.tailSequence,
+				replayed: true
+			});
+			if (stored.row.state === "settled") return yield* ledgerError("publish settlement", "Finalized Submission has no canonical settlement");
+			const appended = yield* journal.appendPrepared(prepared);
+			return SettlementPublicationResult.make({
+				record,
+				tailSequence: appended.lastSequence,
 				replayed: false
-			})), withSubmission(current, {
-				...stored,
-				row,
-				reservation
-			})];
-		});
-		if (decision._tag === "failure") return yield* decision.error;
-		return decision.value;
-	}));
+			});
+		})));
+	});
 	const finalizeSettlement = Effect.fn("MemorySubmissionLedger.finalizeSettlement")((unvalidated) => Effect.gen(function* () {
 		const request = yield* validate(SettlementFinalization, "finalizeSettlement", unvalidated);
+		const before = (yield* Ref.get(state)).submissions.get(request.submissionId);
+		const canonical = before === void 0 ? void 0 : yield* canonicalSettlement(before.row);
+		if (canonical === void 0) return yield* ledgerError("finalizeSettlement", "Submission has no canonical settlement");
+		const { record, settlement } = canonical;
 		const nowMillis = yield* Clock.currentTimeMillis;
 		const decision = yield* Ref.modify(state, (current) => {
 			const stored = current.submissions.get(request.submissionId);
 			if (stored === void 0) return [failure(ledgerError("finalizeSettlement", `Unknown Submission ${request.submissionId}`)), current];
-			const reservation = stored.reservation;
-			if (reservation === void 0) return [failure(ledgerError("finalizeSettlement", `No settlement reservation for Submission ${request.submissionId}`)), current];
-			const settlementFailure = settlementFailureFromRecord(reservation.record);
-			if (reservation.outcome === "failed" !== (settlementFailure !== void 0)) return [failure(ledgerError("finalizeSettlement", `Settlement reservation for Submission ${request.submissionId} has contradictory failure evidence`)), current];
-			if (reservation.settlementId !== request.settlementId) return [failure(SettlementConflict.make({
+			const settlementFailure = settlementFailureFromRecord(record);
+			if (settlement.settlementId !== request.settlementId) return [failure(SettlementConflict.make({
 				submissionId: request.submissionId,
-				existingOutcome: reservation.outcome
-			})), current];
-			if (reservation.finalizedAtMillis !== void 0) return [success(Settlement.make({
-				submissionId: stored.row.submissionId,
-				settlementId: reservation.settlementId,
-				receiptId: stored.row.receiptId,
-				outcome: reservation.outcome,
-				...settlementFailure === void 0 ? {} : { failure: settlementFailure },
-				settledAt: utc(reservation.finalizedAtMillis)
+				existingOutcome: settlement.outcome
 			})), current];
-			const terminal = stored.row.workerAdmissionJson === void 0 ? void 0 : workerTerminalFromRecord(toSnapshot(stored.row), reservation.record);
+			if (stored.finalization !== void 0) {
+				if (stored.row.state !== "settled" || stored.row.settledOutcome !== settlement.outcome || stored.finalization.settlementId !== request.settlementId || stored.finalization.recordId !== record.recordId) return [failure(ledgerError("finalizeSettlement", "Finalized identity disagrees with canonical settlement")), current];
+				return [success(Settlement.make({
+					submissionId: stored.row.submissionId,
+					settlementId: settlement.settlementId,
+					receiptId: stored.row.receiptId,
+					outcome: settlement.outcome,
+					...settlementFailure === void 0 ? {} : { failure: settlementFailure },
+					settledAt: utc(stored.finalization.finalizedAtMillis)
+				})), current];
+			}
+			if (stored.row.state === "settled") return [failure(ledgerError("finalizeSettlement", "Finalized timestamp is missing")), current];
+			const terminal = stored.row.workerAdmissionJson === void 0 ? void 0 : workerTerminalFromRecord(toSnapshot(stored.row), record);
 			const latestId = current.latestByThread.get(stored.row.threadId);
 			const latest = latestId === void 0 ? void 0 : current.submissions.get(latestId);
 			const pendingNewer = terminal === "completed" && latest !== void 0 && latest.row.queueSequence > stored.row.queueSequence && !(latest.joinedHostSubmissionId === stored.row.submissionId && latest.inputApplied !== void 0);
 			let sealed = current;
 			if (terminal !== void 0 && !pendingNewer && !current.stoppedWorkers.has(stored.row.threadId)) {
-				const submissions = new Map(current.submissions);
-				for (const id of current.activeByThread.get(stored.row.threadId) ?? []) {
+				const submissions = current.submissions;
+				if (!transferPageFits(stored.row.threadId)) return [failure(transferCapacityError("finalizeSettlement")), current];
+				for (const apply of [false, true]) for (const id of current.activeByThread.get(stored.row.threadId) ?? []) {
 					const other = submissions.get(id);
 					if (other === void 0) continue;
-					if (id !== stored.row.submissionId && !(other.joinedHostSubmissionId === stored.row.submissionId && other.inputApplied !== void 0) && other.abortIntent === void 0) submissions.set(id, {
-						...other,
-						abortIntent: AbortIntent.make({
+					if (id !== stored.row.submissionId && !(other.joinedHostSubmissionId === stored.row.submissionId && other.inputApplied !== void 0) && other.abortIntent === void 0) {
+						const abortIntent = AbortIntent.make({
 							submissionId: id,
 							author: stored.row.principal,
 							reason: `Worker assignment ${terminal}`,
 							requestedAt: utc(nowMillis)
-						})
-					});
+						});
+						if (!apply && !abortFitsTransfer(other.row.threadId, abortIntent)) return [failure(transferCapacityError("finalizeSettlement")), current];
+						if (apply) withSubmission(current, {
+							...other,
+							abortIntent
+						});
+					}
 				}
 				sealed = {
 					...current,
 					submissions,
-					stoppedWorkers: new Map(current.stoppedWorkers).set(stored.row.threadId, terminal)
+					stoppedWorkers: current.stoppedWorkers.set(stored.row.threadId, terminal)
 				};
 			}
 			const next = withSubmission(sealed, {
@@ -565,27 +672,28 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				row: {
 					...stored.row,
 					state: "settled",
-					settledOutcome: reservation.outcome
+					settledOutcome: settlement.outcome
 				},
-				ownership: void 0,
-				reservation: {
-					...reservation,
+				finalization: {
+					settlementId: settlement.settlementId,
+					recordId: record.recordId,
 					finalizedAtMillis: nowMillis
 				}
 			});
 			return [success(Settlement.make({
 				submissionId: stored.row.submissionId,
-				settlementId: reservation.settlementId,
+				settlementId: settlement.settlementId,
 				receiptId: stored.row.receiptId,
-				outcome: reservation.outcome,
+				outcome: settlement.outcome,
 				...settlementFailure === void 0 ? {} : { failure: settlementFailure },
 				settledAt: utc(nowMillis)
 			})), next];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
+		if (before !== void 0) journal.owner.closeSubmission(before.row.threadId, request.submissionId);
 		return decision.value;
 	}));
-	const inspectWorker = Effect.fn("MemorySubmissionLedger.inspectWorker")(function* (threadId) {
+	const inspectWorker = Effect.fnUntraced(function* (threadId) {
 		const current = yield* Ref.get(state);
 		const latestId = current.latestByThread.get(threadId);
 		const latest = latestId === void 0 ? void 0 : current.submissions.get(latestId);
@@ -601,34 +709,41 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			...terminal === void 0 ? {} : { terminal }
 		});
 	});
-	const stopWorker = Effect.fn("MemorySubmissionLedger.stopWorker")(function* (unvalidated) {
+	const stopWorker = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(WorkerStopCommand, "stopWorker", unvalidated);
 		const now = yield* Clock.currentTimeMillis;
-		return yield* Ref.modify(state, (current) => {
-			const submissions = new Map(current.submissions);
+		const decision = yield* Ref.modify(state, (current) => {
+			const submissions = current.submissions;
 			let owned = 0;
-			for (const id of current.activeByThread.get(request.threadId) ?? []) {
+			if (!current.stoppedWorkers.has(request.threadId) && !transferPageFits(request.threadId)) return [failure(transferCapacityError("stopWorker")), current];
+			for (const apply of [false, true]) for (const id of current.activeByThread.get(request.threadId) ?? []) {
 				const stored = submissions.get(id);
 				if (stored === void 0) continue;
-				if (stored.ownership !== void 0) owned++;
-				if (stored.abortIntent === void 0) submissions.set(id, {
-					...stored,
-					abortIntent: AbortIntent.make({
+				if (!apply && journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId)) owned++;
+				if (stored.abortIntent === void 0) {
+					const abortIntent = AbortIntent.make({
 						submissionId: id,
 						author: request.author,
 						reason: "Worker owner stopped the worker",
 						requestedAt: utc(now)
-					})
-				});
+					});
+					if (!apply && !abortFitsTransfer(stored.row.threadId, abortIntent)) return [failure(transferCapacityError("stopWorker")), current];
+					if (apply) withSubmission(current, {
+						...stored,
+						abortIntent
+					});
+				}
 			}
-			return [owned, {
+			return [success(owned), {
 				...current,
 				submissions,
-				stoppedWorkers: current.stoppedWorkers.has(request.threadId) ? current.stoppedWorkers : new Map(current.stoppedWorkers).set(request.threadId, void 0)
+				stoppedWorkers: current.stoppedWorkers.has(request.threadId) ? current.stoppedWorkers : current.stoppedWorkers.set(request.threadId, void 0)
 			}];
 		});
+		if (decision._tag === "failure") return yield* decision.error;
+		return decision.value;
 	});
-	const requestAbort = Effect.fn("MemorySubmissionLedger.requestAbort")((unvalidated) => Effect.gen(function* () {
+	const requestAbort = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(AbortCommand, "requestAbort", unvalidated);
 		const nowMillis = yield* Clock.currentTimeMillis;
 		const decision = yield* Ref.modify(state, (current) => {
@@ -655,6 +770,7 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				reason: request.reason,
 				requestedAt: utc(nowMillis)
 			});
+			if (!abortFitsTransfer(stored.row.threadId, intent)) return [failure(transferCapacityError("requestAbort")), current];
 			return [success(intent), withSubmission(current, {
 				...stored,
 				abortIntent: intent
@@ -662,24 +778,35 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
-	}));
-	const claimJoining = Effect.fn("MemorySubmissionLedger.claimJoining")((unvalidated) => Effect.gen(function* () {
+	});
+	const claimJoining = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(ClaimJoiningRequest, "claimJoining", unvalidated);
+		const published = /* @__PURE__ */ new Map();
+		const before = yield* Ref.get(state);
+		for (const id of before.activeByThread.get(request.threadId) ?? []) {
+			const stored = before.submissions.get(id);
+			if (stored === void 0 || stored.row.state !== "ready") continue;
+			const canonical = yield* canonicalSettlement(stored.row);
+			if (canonical !== void 0) published.set(stored.row.submissionId, canonical.settlement.outcome);
+		}
 		const decision = yield* Ref.modify(state, (current) => {
 			if (current.stoppedWorkers.has(request.threadId)) return [success([]), current];
 			const host = current.submissions.get(request.hostSubmissionId);
 			if (host === void 0) return [failure(ledgerError("claimJoining", `Unknown Submission ${request.hostSubmissionId}`)), current];
 			if (host.row.threadId !== request.threadId) return [failure(ledgerError("claimJoining", `Host Submission ${request.hostSubmissionId} does not belong to Thread ${request.threadId}`)), current];
-			if (!ownsLane(current, host, request.ownershipToken)) return [failure(ownershipLost(current, host)), current];
-			const later = [...current.submissions.values()].filter((stored) => stored.row.threadId === request.threadId && stored.row.queueSequence > host.row.queueSequence).sort((left, right) => left.row.queueSequence - right.row.queueSequence);
+			if (!journal.owner.hasOwner(host.row.threadId, host.row.submissionId)) return [failure(ownershipLost(host)), current];
+			const later = threadRows(current, request.threadId, host.row.queueSequence);
 			const claims = [];
-			const submissions = new Map(current.submissions);
+			const submissions = current.submissions;
 			for (const stored of later) {
 				if (claims.length >= request.maxCount) break;
 				if ((stored.row.state === "joining" || stored.row.state === "joined") && stored.joinedHostSubmissionId === request.hostSubmissionId) continue;
 				if (stored.row.state === "settled" && stored.row.settledOutcome === "aborted") continue;
 				if (stored.row.state !== "ready") break;
-				submissions.set(stored.row.submissionId, {
+				const terminal = published.get(stored.row.submissionId);
+				if (terminal === "aborted") continue;
+				if (terminal !== void 0) break;
+				withSubmission(current, {
 					...stored,
 					row: {
 						...stored.row,
@@ -700,8 +827,8 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
-	}));
-	const markJoined = Effect.fn("MemorySubmissionLedger.markJoined")((unvalidated) => Effect.gen(function* () {
+	});
+	const markJoined = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(MarkJoinedRequest, "markJoined", unvalidated);
 		const decision = yield* Ref.modify(state, (current) => {
 			const stored = current.submissions.get(request.submissionId);
@@ -709,7 +836,7 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			if (stored.joinedHostSubmissionId === void 0) return [failure(ledgerError("markJoined", `Submission ${request.submissionId} was never claimed for joining`)), current];
 			const host = current.submissions.get(stored.joinedHostSubmissionId);
 			if (host === void 0) return [failure(ledgerError("markJoined", `Host Submission ${stored.joinedHostSubmissionId} is missing`)), current];
-			if (!ownsLane(current, host, request.ownershipToken)) return [failure(ownershipLost(current, host)), current];
+			if (!journal.owner.hasOwner(host.row.threadId, host.row.submissionId)) return [failure(ownershipLost(host)), current];
 			if (stored.inputApplied !== void 0) {
 				if (stored.inputApplied.recordId === request.recordId && stored.inputApplied.sequence === request.sequence) return [success(void 0), current];
 				return [failure(ledgerError("markJoined", `A different join marker is already recorded for Submission ${request.submissionId}`)), current];
@@ -729,13 +856,20 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			})];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
-	}));
-	const revertJoining = Effect.fn("MemorySubmissionLedger.revertJoining")((unvalidated) => Effect.gen(function* () {
+	});
+	const revertJoining = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(RevertJoiningRequest, "revertJoining", unvalidated);
 		const decision = yield* Ref.modify(state, (current) => {
 			const stored = current.submissions.get(request.submissionId);
 			if (stored === void 0) return [failure(ledgerError("revertJoining", `Unknown Submission ${request.submissionId}`)), current];
 			if (stored.row.state !== "joining") return [success(void 0), current];
+			const guard = request.guard;
+			if (guard !== void 0) {
+				if (stored.joinedHostSubmissionId !== guard.hostSubmissionId) return [success(void 0), current];
+				const host = current.submissions.get(guard.hostSubmissionId);
+				if (host === void 0 || host.row.threadId !== stored.row.threadId) return [failure(ledgerError("revertJoining", `Host Submission ${guard.hostSubmissionId} is missing or belongs to another Thread`)), current];
+				if (host.row.state !== "settled" && !journal.owner.hasOwner(host.row.threadId, host.row.submissionId)) return [failure(ledgerError("revertJoining", "The linked host has no active local session")), current];
+			}
 			return [success(void 0), withSubmission(current, {
 				...stored,
 				row: {
@@ -746,10 +880,20 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			})];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
-	}));
-	const suspend = Effect.fn("MemorySubmissionLedger.suspend")((unvalidated) => Effect.gen(function* () {
+	});
+	const suspend = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(SuspendRequest, "suspend", unvalidated);
 		const nowMillis = yield* Clock.currentTimeMillis;
+		const target = (yield* Ref.get(state)).submissions.get(request.submissionId);
+		const canonical = target === void 0 ? void 0 : yield* canonicalSettlement(target.row);
+		const announcedChildren = /* @__PURE__ */ new Set();
+		if (request.reason._tag === "WaitingForChild") {
+			const current = yield* Ref.get(state);
+			for (const { childSubmissionId } of request.reason.children) {
+				const child = current.submissions.get(childSubmissionId);
+				if (child !== void 0 && (yield* canonicalSettlement(child.row)) !== void 0) announcedChildren.add(childSubmissionId);
+			}
+		}
 		const decision = yield* Ref.modify(state, (current) => {
 			const stored = current.submissions.get(request.submissionId);
 			if (stored === void 0) return [failure(ledgerError("suspend", `Unknown Submission ${request.submissionId}`)), current];
@@ -760,19 +904,18 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 					existingOutcome: stored.row.settledOutcome
 				})), current];
 			}
-			if (stored.reservation !== void 0) return [failure(SettlementConflict.make({
+			if (canonical !== void 0) return [failure(SettlementConflict.make({
 				submissionId: request.submissionId,
-				existingOutcome: stored.reservation.outcome
+				existingOutcome: canonical.settlement.outcome
 			})), current];
-			if (!ownsLane(current, stored, request.ownershipToken)) return [failure(ownershipLost(current, stored)), current];
-			if (request.reason._tag === "ApprovalPending" ? request.reason.toolCallIds.every((toolCallId) => stored.approvalDecisions.has(toolCallId)) : request.reason.children.every((child) => current.submissions.get(child.childSubmissionId)?.row.state === "settled")) return [success("resume-immediately"), current];
+			if (!journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId)) return [failure(ownershipLost(stored)), current];
+			if (request.reason._tag === "ApprovalPending" ? approvalDecisionsCover(request.reason.toolCallIds, (toolCallId) => stored.approvalDecisions.get(toolCallId)?.decision) : request.reason.children.every((child) => announcedChildren.has(child.childSubmissionId))) return [success("resume-immediately"), current];
 			return [success("suspended"), withSubmission(current, {
 				...stored,
 				row: {
 					...stored.row,
 					state: "suspended"
 				},
-				ownership: void 0,
 				suspension: {
 					reason: request.reason,
 					suspendedAtMillis: nowMillis
@@ -780,9 +923,10 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			})];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
+		if (decision.value === "suspended" && target !== void 0) journal.owner.closeSubmission(target.row.threadId, request.submissionId);
 		return decision.value;
-	}));
-	const recordApprovalDecision = Effect.fn("MemorySubmissionLedger.recordApprovalDecision")((unvalidated) => Effect.gen(function* () {
+	});
+	const recordApprovalDecision = Effect.fnUntraced(function* (unvalidated) {
 		const command = yield* validate(ApprovalDecisionCommand, "recordApprovalDecision", unvalidated);
 		const nowMillis = yield* Clock.currentTimeMillis;
 		const decision = yield* Ref.modify(state, (current) => {
@@ -812,8 +956,9 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				reason: command.reason,
 				decidedAt: utc(nowMillis)
 			});
+			if (!approvalFitsTransfer(stored.row.threadId, intent)) return [failure(transferCapacityError("recordApprovalDecision")), current];
 			const approvalDecisions = new Map(stored.approvalDecisions).set(command.toolCallId, intent);
-			const wakes = stored.row.state === "suspended" && stored.suspension !== void 0 && stored.suspension.reason._tag === "ApprovalPending" && stored.suspension.reason.toolCallIds.every((toolCallId) => approvalDecisions.has(toolCallId));
+			const wakes = stored.row.state === "suspended" && stored.suspension !== void 0 && stored.suspension.reason._tag === "ApprovalPending" && approvalDecisionsCover(stored.suspension.reason.toolCallIds, (toolCallId) => approvalDecisions.get(toolCallId)?.decision);
 			return [success(intent), withSubmission(current, {
 				...stored,
 				row: wakes ? {
@@ -826,9 +971,11 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
-	}));
-	const markUnknown = Effect.fn("MemorySubmissionLedger.markUnknown")((unvalidated) => Effect.gen(function* () {
+	});
+	const markUnknown = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(MarkUnknownRequest, "markUnknown", unvalidated);
+		const target = (yield* Ref.get(state)).submissions.get(request.submissionId);
+		const canonical = target === void 0 ? void 0 : yield* canonicalSettlement(target.row);
 		const decision = yield* Ref.modify(state, (current) => {
 			const stored = current.submissions.get(request.submissionId);
 			if (stored === void 0) return [failure(ledgerError("markUnknown", `Unknown Submission ${request.submissionId}`)), current];
@@ -839,9 +986,9 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 					existingOutcome: stored.row.settledOutcome
 				})), current];
 			}
-			if (stored.reservation !== void 0) return [failure(SettlementConflict.make({
+			if (canonical !== void 0) return [failure(SettlementConflict.make({
 				submissionId: request.submissionId,
-				existingOutcome: stored.reservation.outcome
+				existingOutcome: canonical.settlement.outcome
 			})), current];
 			const existing = stored.unknownMark;
 			const known = new Set(existing?.toolCallIds ?? []);
@@ -859,22 +1006,35 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			})];
 		});
 		if (decision._tag === "failure") return yield* decision.error;
-	}));
-	const recordUnknownResolution = Effect.fn("MemorySubmissionLedger.recordUnknownResolution")((unvalidated) => Effect.gen(function* () {
+	});
+	const recordUnknownResolution = Effect.fnUntraced(function* (unvalidated) {
 		const command = yield* validate(UnknownResolutionCommand, "recordUnknownResolution", unvalidated);
 		const nowMillis = yield* Clock.currentTimeMillis;
+		const before = (yield* Ref.get(state)).submissions.get(command.submissionId);
+		const kind = unknownResolutionKind(command.resolution);
+		if (before !== void 0 && kind === "factual" && !before.unknownResolutions.has(JSON.stringify([command.toolCallId, kind]))) {
+			const runId = runIdForSubmission(before.row.submissionId);
+			const outcomes = yield* journal.toolCallResults(before.row.threadId, runId, command.toolCallId);
+			const result = outcomes[0]?.payload;
+			if (outcomes.length > 1 || result !== void 0 && (result._tag !== "ToolCallSettled" || result.runId !== runId || result.toolCallId !== command.toolCallId)) return yield* ledgerError("recordUnknownResolution", "Canonical Tool result identity is inconsistent");
+			if (result?._tag === "ToolCallSettled" && !unknownResolutionMatchesResult(command.resolution, result)) return yield* UnknownResolutionConflict.make({
+				submissionId: command.submissionId,
+				toolCallId: command.toolCallId
+			});
+		}
 		const decision = yield* Ref.modify(state, (current) => {
 			const stored = current.submissions.get(command.submissionId);
 			if (stored === void 0) return [failure(ledgerError("recordUnknownResolution", `Unknown Submission ${command.submissionId}`)), current];
 			if (stored.row.state === "settled") {
 				if (stored.row.settledOutcome === void 0) return [failure(ledgerError("recordUnknownResolution", `Settled Submission ${command.submissionId} is missing its outcome`)), current];
-				return [failure(SettlementConflict.make({
+				if (command.resolution._tag !== "CompletedWithResult" && command.resolution._tag !== "NeverHappened") return [failure(SettlementConflict.make({
 					submissionId: command.submissionId,
 					existingOutcome: stored.row.settledOutcome
 				})), current];
 			}
-			const existing = stored.unknownResolutions.get(command.toolCallId);
-			if (existing !== void 0 && !equivalentUnknownResolution(existing.intent.resolution, command.resolution)) return [failure(UnknownResolutionConflict.make({
+			const key = JSON.stringify([command.toolCallId, kind]);
+			const existing = stored.unknownResolutions.get(key);
+			if (existing !== void 0 && !equivalentUnknownResolution(existing.intent.resolution, command.resolution) || existing === void 0 && kind === "execution" && stored.unknownResolutions.has(JSON.stringify([command.toolCallId, "factual"]))) return [failure(UnknownResolutionConflict.make({
 				submissionId: command.submissionId,
 				toolCallId: command.toolCallId
 			})), current];
@@ -886,8 +1046,9 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				resolution: command.resolution,
 				resolvedAt: utc(nowMillis)
 			});
-			const unknownResolutions = existing !== void 0 ? stored.unknownResolutions : new Map(stored.unknownResolutions).set(command.toolCallId, { intent });
-			const wakes = stored.row.state === "unknown" && stored.unknownMark !== void 0 && stored.unknownMark.toolCallIds.every((toolCallId) => unknownResolutions.has(toolCallId));
+			if (existing === void 0 && !resolutionFitsTransfer(stored.row.threadId, intent)) return [failure(transferCapacityError("recordUnknownResolution")), current];
+			const unknownResolutions = existing !== void 0 ? stored.unknownResolutions : new Map(stored.unknownResolutions).set(key, { intent });
+			const wakes = stored.row.state === "unknown" && stored.unknownMark !== void 0 && stored.unknownMark.toolCallIds.every((toolCallId) => unknownResolutions.has(JSON.stringify([toolCallId, "execution"])) || unknownResolutions.has(JSON.stringify([toolCallId, "factual"])));
 			return [success(intent), withSubmission(current, {
 				...stored,
 				row: wakes ? {
@@ -900,21 +1061,25 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
-	}));
-	const recordChildSettled = Effect.fn("MemorySubmissionLedger.recordChildSettled")((unvalidated) => Effect.gen(function* () {
+	});
+	const recordChildSettled = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(ChildSettledNotification, "recordChildSettled", unvalidated);
+		const before = yield* Ref.get(state);
+		const waiting = before.submissions.get(request.parentSubmissionId)?.suspension?.reason;
+		const ids = /* @__PURE__ */ new Set([request.childSubmissionId, ...waiting?._tag === "WaitingForChild" ? waiting.children.map((child) => child.childSubmissionId) : []]);
+		const announcedChildren = /* @__PURE__ */ new Set();
+		for (const id of ids) {
+			const child = before.submissions.get(id);
+			if (child !== void 0 && (yield* canonicalSettlement(child.row)) !== void 0) announcedChildren.add(id);
+		}
 		const decision = yield* Ref.modify(state, (current) => {
 			const parent = current.submissions.get(request.parentSubmissionId);
 			if (parent === void 0) return [failure(ledgerError("recordChildSettled", `Unknown Submission ${request.parentSubmissionId}`)), current];
-			const child = current.submissions.get(request.childSubmissionId);
-			if (!(child !== void 0 && (child.row.state === "settled" || child.row.state === "terminalizing" && child.reservation !== void 0))) return [failure(ledgerError("recordChildSettled", `Child Submission ${request.childSubmissionId} has no recorded settlement`)), current];
+			if (!announcedChildren.has(request.childSubmissionId)) return [failure(ledgerError("recordChildSettled", `Child Submission ${request.childSubmissionId} has no recorded settlement`)), current];
 			if (parent.row.state !== "suspended" || parent.suspension === void 0 || parent.suspension.reason._tag !== "WaitingForChild") return [success("not-waiting"), current];
 			const children = parent.suspension.reason.children;
 			if (!children.some((entry) => entry.childSubmissionId === request.childSubmissionId)) return [success("not-waiting"), current];
-			if (!children.every((entry) => {
-				const listed = current.submissions.get(entry.childSubmissionId);
-				return listed?.row.state === "settled" || listed?.row.state === "terminalizing" && listed.reservation !== void 0;
-			})) return [success("still-waiting"), current];
+			if (!children.every((entry) => announcedChildren.has(entry.childSubmissionId))) return [success("still-waiting"), current];
 			return [success("woken"), withSubmission(current, {
 				...parent,
 				row: {
@@ -926,8 +1091,8 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
-	}));
-	const reserveChildBudget = Effect.fn("MemorySubmissionLedger.reserveChildBudget")((unvalidated) => Effect.gen(function* () {
+	});
+	const reserveChildBudget = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(ChildBudgetReservationRequest, "reserveChildBudget", unvalidated);
 		const nowMillis = yield* Clock.currentTimeMillis;
 		const decision = yield* Ref.modify(state, (current) => {
@@ -943,14 +1108,18 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 					replayed: true
 				})), current];
 			}
-			for (const reservation of current.childReservations.values()) if (reservation.parentSubmissionId === request.parentSubmissionId && reservation.parentToolCallId === request.parentToolCallId) return [failure(ChildReservationConflict.make({
-				reservationId: request.reservationId,
-				status: reservation.status,
-				message: `Parent Tool Call ${request.parentToolCallId} already owns reservation ${reservation.reservationId}.`
-			})), current];
+			for (const id of current.childrenByParent.get(request.parentSubmissionId) ?? []) {
+				const reservation = current.childReservations.get(id);
+				if (reservation === void 0) continue;
+				if (reservation.parentSubmissionId === request.parentSubmissionId && reservation.parentToolCallId === request.parentToolCallId) return [failure(ChildReservationConflict.make({
+					reservationId: request.reservationId,
+					status: reservation.status,
+					message: `Parent Tool Call ${request.parentToolCallId} already owns reservation ${reservation.reservationId}.`
+				})), current];
+			}
 			const parent = current.submissions.get(request.parentSubmissionId);
 			if (parent === void 0) return [failure(ledgerError("reserveChildBudget", `Unknown Submission ${request.parentSubmissionId}`)), current];
-			if (!ownsLane(current, parent, request.ownershipToken)) return [failure(ownershipLost(current, parent)), current];
+			if (!journal.owner.hasOwner(parent.row.threadId, parent.row.submissionId)) return [failure(ownershipLost(parent)), current];
 			const reservation = {
 				reservationId: request.reservationId,
 				parentSubmissionId: request.parentSubmissionId,
@@ -971,8 +1140,8 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
-	}));
-	const attachChildToReservation = Effect.fn("MemorySubmissionLedger.attachChildToReservation")((unvalidated) => Effect.gen(function* () {
+	});
+	const attachChildToReservation = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(AttachChildToReservationRequest, "attachChildToReservation", unvalidated);
 		const decision = yield* Ref.modify(state, (current) => {
 			const reservation = current.childReservations.get(request.reservationId);
@@ -987,7 +1156,7 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 			}
 			const parent = current.submissions.get(reservation.parentSubmissionId);
 			if (parent === void 0) return [failure(ledgerError("attachChildToReservation", `Unknown Submission ${reservation.parentSubmissionId}`)), current];
-			if (!ownsLane(current, parent, request.ownershipToken)) return [failure(ownershipLost(current, parent)), current];
+			if (!journal.owner.hasOwner(parent.row.threadId, parent.row.submissionId)) return [failure(ownershipLost(parent)), current];
 			if (reservation.status !== "reserved") return [failure(ChildReservationConflict.make({
 				reservationId: request.reservationId,
 				status: reservation.status,
@@ -1002,8 +1171,8 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
-	}));
-	const beginChildBudgetRelease = Effect.fn("MemorySubmissionLedger.beginChildBudgetRelease")((unvalidated) => Effect.gen(function* () {
+	});
+	const beginChildBudgetRelease = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(BeginChildBudgetReleaseRequest, "beginChildBudgetRelease", unvalidated);
 		const nowMillis = yield* Clock.currentTimeMillis;
 		const decision = yield* Ref.modify(state, (current) => {
@@ -1027,8 +1196,8 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
-	}));
-	const releaseChildBudget = Effect.fn("MemorySubmissionLedger.releaseChildBudget")((unvalidated) => Effect.gen(function* () {
+	});
+	const releaseChildBudget = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(ReleaseChildBudgetRequest, "releaseChildBudget", unvalidated);
 		const nowMillis = yield* Clock.currentTimeMillis;
 		const decision = yield* Ref.modify(state, (current) => {
@@ -1049,38 +1218,36 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 		});
 		if (decision._tag === "failure") return yield* decision.error;
 		return decision.value;
+	});
+	const scanNonterminal = Stream.paginate(void 0, (after) => Effect.sync(() => {
+		const current = MutableRef.get(state.ref);
+		const candidates = boundedWorkSelection(8, (stored) => `${stored.row.threadId}\u0000${String(stored.row.queueSequence).padStart(16, "0")}`, after);
+		for (const ids of current.activeByThread.values()) for (const id of ids) {
+			const stored = current.submissions.get(id);
+			if (stored !== void 0) candidates.add(stored);
+		}
+		const items = candidates.values.map(({ row }) => SubmissionWorkItem.make(row));
+		const last = candidates.values.at(-1)?.row;
+		return [items, last === void 0 ? Option.none() : Option.some(`${last.threadId}\u0000${String(last.queueSequence).padStart(16, "0")}`)];
 	}));
-	const scanNonterminal = Stream.unwrap(Ref.get(state).pipe(Effect.map((current) => {
-		const snapshots = [...current.submissions.values()].filter((stored) => stored.row.state !== "settled").sort((left, right) => left.row.threadId < right.row.threadId ? -1 : left.row.threadId > right.row.threadId ? 1 : left.row.queueSequence - right.row.queueSequence).map(({ row }) => SubmissionWorkItem.make({
-			submissionId: row.submissionId,
-			threadId: row.threadId,
-			queueSequence: row.queueSequence,
-			principal: row.principal,
-			idempotencyKey: row.idempotencyKey,
-			deploymentId: row.deploymentId,
-			receiptId: row.receiptId,
-			state: row.state
-		}));
-		return Stream.fromIterable(snapshots);
-	})));
-	const readAbortIntent = Effect.fn("MemorySubmissionLedger.readAbortIntent")(function* (unvalidated) {
+	const readAbortIntent = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(AbortIntentRequest, "readAbortIntent", unvalidated);
 		const stored = (yield* Ref.get(state)).submissions.get(request.submissionId);
 		if (stored === void 0) return yield* ledgerError("readAbortIntent", `Unknown Submission ${request.submissionId}`);
 		return stored.abortIntent;
 	});
-	const loadRecoverySnapshot = Effect.fn("MemorySubmissionLedger.loadRecoverySnapshot")((unvalidated) => Effect.gen(function* () {
+	const loadRecoverySnapshot = Effect.fnUntraced(function* (unvalidated) {
 		const request = yield* validate(RecoverySnapshotRequest, "loadRecoverySnapshot", unvalidated);
 		const current = yield* Ref.get(state);
 		const stored = current.submissions.get(request.submissionId);
 		if (stored === void 0) return yield* ledgerError("loadRecoverySnapshot", `Unknown Submission ${request.submissionId}`);
-		const joins = [...current.submissions.values()].filter((candidate) => candidate.joinedHostSubmissionId === request.submissionId).sort((left, right) => left.row.queueSequence - right.row.queueSequence).map((candidate) => JoinSnapshot.make({
+		const joins = Array.from(current.joinsByHost.get(request.submissionId) ?? [], (id) => current.submissions.get(id)).filter((candidate) => candidate !== void 0).sort((left, right) => left.row.queueSequence - right.row.queueSequence).map((candidate) => JoinSnapshot.make({
 			submissionId: candidate.row.submissionId,
 			state: candidate.row.state,
 			hostSubmissionId: request.submissionId
 		}));
 		const byToolCallId = (left, right) => left.toolCallId < right.toolCallId ? -1 : left.toolCallId > right.toolCallId ? 1 : 0;
-		const childReservations = [...current.childReservations.values()].filter((reservation) => reservation.parentSubmissionId === request.submissionId).sort((left, right) => left.parentToolCallId < right.parentToolCallId ? -1 : left.parentToolCallId > right.parentToolCallId ? 1 : 0);
+		const childReservations = Array.from(current.childrenByParent.get(request.submissionId) ?? [], (id) => current.childReservations.get(id)).filter((reservation) => reservation !== void 0).sort((left, right) => left.parentToolCallId < right.parentToolCallId ? -1 : left.parentToolCallId > right.parentToolCallId ? 1 : 0);
 		const childAttachments = [];
 		for (const reservation of childReservations) {
 			if (reservation.childSubmissionId === void 0) continue;
@@ -1106,60 +1273,277 @@ const makeSubmissionLedger = (options = {}) => Effect.gen(function* () {
 				reason: stored.suspension.reason,
 				suspendedAt: utc(stored.suspension.suspendedAtMillis)
 			}) },
-			...stored.ownership === void 0 ? {} : { ownership: OwnershipSnapshot.make({
-				attemptId: stored.ownership.attemptId,
-				ownerProducerId: stored.ownership.ownerProducerId,
-				producerEpoch: stored.ownership.producerEpoch,
-				leaseExpiresAt: utc(stored.ownership.leaseExpiresAtMillis)
-			}) },
+			hasOwner: journal.owner.hasOwner(stored.row.threadId, stored.row.submissionId),
 			...stored.inputApplied === void 0 ? {} : { inputApplied: stored.inputApplied },
-			...stored.reservation === void 0 ? {} : { reservation: SettlementReservationSnapshot.make({
-				settlementId: stored.reservation.settlementId,
-				outcome: stored.reservation.outcome,
-				record: stored.reservation.record,
-				recordDigest: stored.reservation.recordDigest,
-				finalized: stored.reservation.finalizedAtMillis !== void 0
-			}) },
 			...stored.abortIntent === void 0 ? {} : { abortIntent: stored.abortIntent }
 		});
-	}));
-	return SubmissionLedger.of({
+	});
+	const ledger = SubmissionLedger.of({
 		capabilities,
-		admit,
-		markReady,
+		resolveFundingOwner: Effect.fnUntraced(function* (unvalidated) {
+			const request = yield* validate(FundingOwnerRequest, "funding owner", unvalidated);
+			const current = MutableRef.get(state.ref);
+			const selected = current.submissions.get(request.submissionId);
+			if (selected === void 0 || selected.row.threadId !== request.threadId) return yield* ledgerError("funding owner", "Selected admission belongs to another Thread or is missing");
+			if (selected.row.state === "joining" || selected.joinedHostSubmissionId !== void 0 && selected.inputApplied === void 0) return yield* ledgerError("funding owner", "Joining funding owner is not yet frozen by exact applied input evidence");
+			const owner = selected.joinedHostSubmissionId === void 0 ? selected : current.submissions.get(selected.joinedHostSubmissionId);
+			if (owner === void 0 || owner.row.threadId !== request.threadId || owner !== selected && owner.row.queueSequence >= selected.row.queueSequence) return yield* ledgerError("funding owner", "Exact joined funding owner is missing or inconsistent");
+			return FundingOwner.make({
+				selected: toSnapshot(selected.row),
+				owner: toSnapshot(owner.row)
+			});
+		}),
+		admit: (request) => journal.withMutation(admit(request)),
+		markReady: (request) => journal.withMutation(markReady(request)),
 		lookup,
 		resolveAdmission,
-		claim,
-		renewOwnership,
-		releaseOwnership,
-		markInputApplied,
-		reserveSettlement,
-		finalizeSettlement,
-		requestAbort,
-		stopWorker,
+		selectHead: (request) => journal.withMutation(selectHead(request)),
+		markInputApplied: (request) => journal.withMutation(markInputApplied(request)),
+		finalizeSettlement: (request) => journal.withMutation(finalizeSettlement(request)),
+		requestAbort: (request) => journal.withMutation(requestAbort(request)),
+		stopWorker: (request) => journal.withMutation(stopWorker(request)),
 		inspectWorker,
-		claimJoining,
-		markJoined,
-		revertJoining,
-		suspend,
-		recordApprovalDecision,
-		markUnknown,
-		recordUnknownResolution,
-		recordChildSettled,
-		reserveChildBudget,
-		attachChildToReservation,
-		beginChildBudgetRelease,
-		releaseChildBudget,
+		claimJoining: (request) => journal.withMutation(claimJoining(request)),
+		markJoined: (request) => journal.withMutation(markJoined(request)),
+		revertJoining: (request) => journal.withMutation(revertJoining(request)),
+		suspend: (request) => journal.withMutation(suspend(request)),
+		recordApprovalDecision: (request) => journal.withMutation(recordApprovalDecision(request)),
+		markUnknown: (request) => journal.withMutation(markUnknown(request)),
+		recordUnknownResolution: (request) => journal.withMutation(recordUnknownResolution(request)),
+		recordChildSettled: (request) => journal.withMutation(recordChildSettled(request)),
+		reserveChildBudget: (request) => journal.withMutation(reserveChildBudget(request)),
+		attachChildToReservation: (request) => journal.withMutation(attachChildToReservation(request)),
+		beginChildBudgetRelease: (request) => journal.withMutation(beginChildBudgetRelease(request)),
+		releaseChildBudget: (request) => journal.withMutation(releaseChildBudget(request)),
 		scanNonterminal,
 		loadRecoverySnapshot,
 		readAbortIntent
 	});
+	const toAdmission = (row, settledAtMillis) => ThreadAdmission.make({
+		...toSnapshot(row),
+		...settledAtMillis === void 0 ? {} : { settledAt: utc(settledAtMillis) }
+	});
+	const cleanCommand = (value) => {
+		const { canonicalRecordId: _, ...fact } = value;
+		return fact;
+	};
+	const commands = (stored) => {
+		return {
+			aborts: stored?.abortIntent === void 0 ? [] : [cleanCommand(stored.abortIntent)],
+			approvals: Array.from(stored?.approvalDecisions.values() ?? [], cleanCommand),
+			resolutions: Array.from(stored?.unknownResolutions.values() ?? [], ({ intent }) => cleanCommand(intent))
+		};
+	};
+	const readCommands = Effect.fnUntraced(function* (stored) {
+		if ((stored?.approvalDecisions.size ?? 0) > MAX_RUN_EVIDENCE_RECORDS || (stored?.unknownResolutions.size ?? 0) > MAX_RUN_EVIDENCE_RECORDS) return yield* ThreadStoreError.make({
+			operation: "read commands",
+			message: "Accepted commands exceed Run record bounds"
+		});
+		let bytes = 0;
+		const add = (schema, value) => Schema.encodeEffect(Schema.toCodecJson(schema))(value).pipe(Effect.mapError(() => ThreadStoreError.make({
+			operation: "read commands",
+			message: "Invalid accepted command wire"
+		})), Effect.flatMap((wire) => {
+			bytes += utf8ByteLength(canonicalJson(wire));
+			return bytes > MAX_RUN_EVIDENCE_BYTES ? Effect.fail(ThreadStoreError.make({
+				operation: "read commands",
+				message: "Accepted commands exceed Run byte bounds"
+			})) : Effect.void;
+		}));
+		if (stored?.abortIntent !== void 0) yield* add(AbortIntent, stored.abortIntent);
+		for (const value of stored?.approvalDecisions.values() ?? []) yield* add(ApprovalDecisionIntent, value);
+		for (const { intent } of stored?.unknownResolutions.values() ?? []) yield* add(UnknownResolutionIntent, intent);
+		return commands(stored);
+	});
+	const lookupAdmission = (threadId, submissionId) => Effect.sync(() => {
+		const stored = MutableRef.get(state.ref).submissions.get(submissionId);
+		return stored?.row.threadId === threadId ? toAdmission(stored.row, stored.finalization?.finalizedAtMillis) : void 0;
+	});
+	yield* journal.registerLedgerTransfer({
+		admission: lookupAdmission,
+		commands: (id) => readCommands(MutableRef.get(state.ref).submissions.get(id)),
+		snapshot: (threadId) => Effect.sync(() => {
+			const current = MutableRef.get(state.ref);
+			const directory = current.byThread.get(threadId);
+			return {
+				idle: (current.activeByThread.get(threadId)?.size ?? 0) === 0 && (directory?.reservations ?? 0) === 0,
+				admissions: directory?.ordered.length ?? 0,
+				aborts: directory?.commands.aborts.length ?? 0,
+				approvals: directory?.commands.approvals.length ?? 0,
+				resolutions: directory?.commands.resolutions.length ?? 0,
+				...current.stoppedWorkers.has(threadId) ? { workerSeal: current.stoppedWorkers.get(threadId) === void 0 ? {} : { terminal: current.stoppedWorkers.get(threadId) } } : {}
+			};
+		}),
+		facts: (threadId, section, after) => Effect.sync(() => {
+			const current = MutableRef.get(state.ref);
+			const facts = {
+				admissions: new Array(),
+				commands: commands(void 0),
+				deliveries: []
+			};
+			let next = after ?? "";
+			if (section === "admissions") {
+				const stored = threadRows(current, threadId, after === void 0 ? -1 : Number(after)).next().value;
+				if (stored !== void 0) {
+					facts.admissions.push(toAdmission(stored.row, stored.finalization?.finalizedAtMillis));
+					next = String(stored.row.queueSequence);
+				}
+			} else {
+				const entries = current.byThread.get(threadId)?.commands[section] ?? [];
+				const at = after === void 0 ? 0 : commandPosition(entries, after);
+				const choice = entries[at + Number(after !== void 0 && entries[at]?.key === after)];
+				if (choice !== void 0) {
+					next = choice.key;
+					const stored = current.submissions.get(choice.submissionId);
+					if (section === "aborts" && stored?.abortIntent !== void 0) facts.commands.aborts.push(cleanCommand(stored.abortIntent));
+					else if (section === "approvals" && choice.toolCallId !== void 0) {
+						const value = stored?.approvalDecisions.get(choice.toolCallId);
+						if (value !== void 0) facts.commands.approvals.push(cleanCommand(value));
+					} else if (section === "resolutions" && choice.resolutionKey !== void 0) {
+						const value = stored?.unknownResolutions.get(choice.resolutionKey);
+						if (value !== void 0) facts.commands.resolutions.push(cleanCommand(value.intent));
+					}
+				}
+			}
+			return {
+				facts,
+				after: next
+			};
+		}),
+		submissions: (threadId) => Stream.paginate(-1, (after) => Effect.sync(() => {
+			const stored = threadRows(MutableRef.get(state.ref), threadId, after).next().value;
+			return [stored === void 0 ? [] : [toSnapshot(stored.row)], stored === void 0 ? Option.none() : Option.some(stored.row.queueSequence)];
+		})),
+		startImport: Effect.fnUntraced(function* (threadId) {
+			const current = yield* Ref.get(state);
+			if (current.lanes.has(threadId) || current.byThread.has(threadId) || current.stoppedWorkers.has(threadId)) return yield* ThreadImportRejected.make({
+				threadId,
+				reason: "target-not-empty",
+				message: "Destination ledger contains Thread data"
+			});
+			const staged = {
+				submissions: /* @__PURE__ */ new Map(),
+				admissionIndex: /* @__PURE__ */ new Map(),
+				lanes: /* @__PURE__ */ new Map(),
+				childReservations: /* @__PURE__ */ new Map(),
+				freshAdmissionSequence: current.freshAdmissionSequence,
+				stoppedWorkers: /* @__PURE__ */ new Map(),
+				latestByThread: /* @__PURE__ */ new Map(),
+				activeByThread: /* @__PURE__ */ new Map(),
+				byThread: /* @__PURE__ */ new Map(),
+				receipts: /* @__PURE__ */ new Map(),
+				joinsByHost: /* @__PURE__ */ new Map(),
+				childrenByParent: /* @__PURE__ */ new Map()
+			};
+			const commandBytes = /* @__PURE__ */ new Map();
+			const settledTimes = /* @__PURE__ */ new Map();
+			const retainCommandBytes = Effect.fnUntraced(function* (schema, value, id) {
+				const wire = yield* Schema.encodeEffect(Schema.toCodecJson(schema))(value).pipe(Effect.mapError(() => invalidThreadArchive("Invalid accepted command wire", threadId)));
+				const bytes = (commandBytes.get(id) ?? 0) + utf8ByteLength(canonicalJson(wire));
+				if (bytes > MAX_RUN_EVIDENCE_BYTES) return yield* invalidThreadArchive("Accepted commands exceed Run byte bounds", threadId);
+				commandBytes.set(id, bytes);
+			});
+			return {
+				reader: {
+					admission: (id) => Effect.sync(() => {
+						const stored = staged.submissions.get(id);
+						return stored === void 0 ? void 0 : toAdmission(stored.row, settledTimes.get(id));
+					}),
+					runOwner: (runId) => Effect.sync(() => {
+						if (!runId.startsWith("run:")) return void 0;
+						const id = Schema.decodeSync(SubmissionId)(runId.slice(4));
+						const stored = staged.submissions.get(id);
+						return stored === void 0 ? void 0 : toAdmission(stored.row, settledTimes.get(id));
+					}),
+					commands: (id) => readCommands(staged.submissions.get(id))
+				},
+				stage: Effect.fnUntraced(function* (page) {
+					for (const a of page.archive.admissions) {
+						const key = admissionKey(threadId, a.principal, a.idempotencyKey);
+						if (current.submissions.has(a.submissionId) || staged.submissions.has(a.submissionId) || current.receipts.has(a.receiptId) || staged.receipts.has(a.receiptId) || current.admissionIndex.has(key) || staged.admissionIndex.has(key)) return yield* ThreadImportRejected.make({
+							threadId,
+							reason: "destination-conflict",
+							message: "Admission, receipt, or immutable admission key already exists"
+						});
+						if (threadRows(staged, threadId, a.queueSequence - 1).next().value?.row.queueSequence === a.queueSequence) return yield* invalidThreadArchive("Duplicate admission queue position", threadId);
+						if (a.settledAt !== void 0) settledTimes.set(a.submissionId, DateTime.toEpochMillis(a.settledAt));
+						withSubmission(staged, fromRebuilt(RebuiltSubmission.make({
+							admission: a,
+							state: "admitted",
+							unknownToolCallIds: [],
+							approvals: [],
+							resolutions: []
+						})));
+					}
+					for (const fact of page.archive.commands.aborts) {
+						const stored = staged.submissions.get(fact.submissionId);
+						if (stored === void 0 || stored.abortIntent !== void 0) return yield* invalidThreadArchive("Missing admission or duplicate abort", threadId);
+						const intent = AbortIntent.make(fact);
+						yield* retainCommandBytes(AbortIntent, intent, fact.submissionId);
+						withSubmission(staged, {
+							...stored,
+							abortIntent: intent
+						});
+					}
+					for (const fact of page.archive.commands.approvals) {
+						const stored = staged.submissions.get(fact.submissionId);
+						if (stored === void 0 || stored.approvalDecisions.has(fact.toolCallId)) return yield* invalidThreadArchive("Missing admission or duplicate approval", threadId);
+						if (stored.approvalDecisions.size >= MAX_RUN_EVIDENCE_RECORDS) return yield* invalidThreadArchive("Accepted approvals exceed Run record bounds", threadId);
+						const intent = ApprovalDecisionIntent.make(fact);
+						yield* retainCommandBytes(ApprovalDecisionIntent, intent, fact.submissionId);
+						const approvals = new Map(stored.approvalDecisions).set(fact.toolCallId, intent);
+						withSubmission(staged, {
+							...stored,
+							approvalDecisions: approvals
+						});
+					}
+					for (const fact of page.archive.commands.resolutions) {
+						const stored = staged.submissions.get(fact.submissionId);
+						const key = JSON.stringify([fact.toolCallId, unknownResolutionKind(fact.resolution)]);
+						if (stored === void 0 || stored.unknownResolutions.has(key)) return yield* invalidThreadArchive("Missing admission or duplicate resolution", threadId);
+						if (stored.unknownResolutions.size >= MAX_RUN_EVIDENCE_RECORDS) return yield* invalidThreadArchive("Accepted resolutions exceed Run record bounds", threadId);
+						const intent = UnknownResolutionIntent.make(fact);
+						yield* retainCommandBytes(UnknownResolutionIntent, intent, fact.submissionId);
+						const resolutions = new Map(stored.unknownResolutions).set(key, { intent });
+						withSubmission(staged, {
+							...stored,
+							unknownResolutions: resolutions
+						});
+					}
+				}),
+				prepareCommit: Effect.fnUntraced(function* (workerSeal) {
+					let lastQueue = 0;
+					let terminalEvidence = workerSeal?.terminal === void 0;
+					for (const stored of threadRows(staged, threadId)) {
+						const a = toAdmission(stored.row, settledTimes.get(stored.row.submissionId));
+						const rebuilt = yield* rebuildClosedSubmission(a);
+						if (rebuilt.settlement !== void 0 && workerTerminalFromRecord(toSnapshot(stored.row), rebuilt.settlement) === workerSeal?.terminal) terminalEvidence = true;
+						withSubmission(staged, fromRebuilt(rebuilt));
+						lastQueue = Math.max(lastQueue, a.queueSequence);
+					}
+					if (!terminalEvidence) return yield* invalidThreadArchive("Worker seal terminal has no exact completed input evidence", threadId);
+					if (!Number.isSafeInteger(lastQueue + 1)) return yield* ThreadImportRejected.make({
+						threadId,
+						reason: "unsupported-capacity",
+						message: "Admission queue sequence is exhausted"
+					});
+					return () => {
+						for (const stored of staged.submissions.values()) withSubmission(current, stored);
+						current.lanes.set(threadId, { nextQueueSequence: lastQueue + 1 });
+						if (workerSeal !== void 0) current.stoppedWorkers.set(threadId, workerSeal.terminal);
+					};
+				})
+			};
+		})
+	});
+	return Context.make(SubmissionLedger, ledger).pipe(Context.add(SettlementPublisher, { publish }));
 });
 /**
 * In-memory reference SubmissionLedger Layer (durability `non-durable`). All state lives in one
-* `Ref` owned by the Layer's Scope; no daemon fibers are spawned and no wall clock is consulted.
+* `Ref` owned by the Layer's Scope. Fresh identities use the supplied `Crypto` service;
+* imported identities remain unchanged. No daemon fibers are spawned and no wall clock is consulted.
 */
-const memorySubmissionLedgerLayer = (options = {}) => Layer.effect(SubmissionLedger, makeSubmissionLedger(options));
+const memorySubmissionLedgerLayer = (options = {}) => Layer.effectContext(makeSubmissionLedger(options));
 const MemorySubmissionLedgerLive = memorySubmissionLedgerLayer();
 //#endregion
 export { MemorySubmissionLedgerLive, memorySubmissionLedgerLayer, MemorySubmissionLedger_exports as t };