@yielded/agent 0.1.0-beta.173 → 0.1.0-beta.175

package/src/durable/DurableAgentRuntime.ts

@@ -63,6 +63,7 @@ import {
   getToolExecutionKind,
   SubagentParentLink,
 } from "../core/SubagentContract.ts";
+import { Store as ConversationStore, makeMemoryStore } from "../core/Thread.ts";
 import { Selection, Snapshot } from "../core/ToolExposure.ts";
 import type { ToolParameterRejection } from "../core/ToolResult.ts";
 import {
@@ -280,6 +281,7 @@ import {
   modelResponseInterruptedRecordId,
   modelResponseRecordId,
   projectRunJournalStream,
+  initialRunJournal,
   type JournalBoundary,
   type RunJournalProjection,
   type RunJournalContext,
@@ -846,6 +848,11 @@ export class RecoverySweepResult extends Schema.Class<RecoverySweepResult>("Reco
 /** Recover one bounded page of native work, optionally confined to one Thread. */
 export interface RecoverySweepOptions {
   readonly threadId?: ThreadId;
+  /** Leave this incarnation's untouched root admissions to their first actual claim.
+   * A verified sole admission needs no recovery inventory; other owners retain bounded
+   * discovery and deferred reports. Neither case supplies ownership or a recovery decision:
+   * the Attempt still verifies current controls, journal, fencing and historyDigest. */
+  readonly deferUnclaimedAdmissions?: boolean;
   /** Continue the previous pass with the same Thread selection until its result has no cursor. */
   readonly cursor?: string;
 }
@@ -1374,6 +1381,11 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
   const reader = ThreadReader.fromStore(store);
   const promptHistory = yield* makePromptHistoryCache();
 
+  // One incarnation remembers only newly accepted root input, never a recovery decision.
+  // A claim consumes the hint before binding/application code can run. Cold owners,
+  // replays, linked inputs, and any changed ledger state retain the recovery path.
+  const unclaimedAdmissions = new Map<SubmissionId, ThreadId>();
+
   const workDiscovery = yield* ThreadWorkDiscovery.pipe(
     Effect.provide(ThreadWorkDiscovery.layer),
     Effect.provideService(ThreadStore, store),
@@ -1444,6 +1456,17 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
   // observer must never replace this host choice on a fresh or replacement Attempt.
   const toolFailureObserver = yield* CurrentToolFailureObserver;
 
+  const runServices = Context.make(CurrentToolFailureObserver, toolFailureObserver).pipe(
+    Context.add(RunToolVisibility, runToolVisibility),
+    Context.add(RunToolScheduling, runToolScheduling),
+    Context.add(ContextCompactor, compactor),
+    Context.add(RunContextPreparation, runContextPreparation),
+  );
+
+  const journalServices = Context.make(ThreadReader, reader).pipe(
+    Context.add(Crypto.Crypto, crypto),
+  );
+
   const withCrypto = <A, E>(effect: Effect.Effect<A, E, Crypto.Crypto>): Effect.Effect<A, E> =>
     Effect.provideService(effect, Crypto.Crypto, crypto);
 
@@ -1453,8 +1476,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     suffix: ReadonlyArray<CanonicalRecordEnvelope>,
   ) =>
     initialContext(original).pipe(
-      Effect.provideService(ThreadReader, reader),
-      Effect.provideService(Crypto.Crypto, crypto),
+      Effect.provideContext(journalServices),
       Effect.map((history) => history.concat(suffix)),
     );
 
@@ -1662,6 +1684,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     let context: RunJournalContext | undefined;
     let progress: RunContinuation | undefined;
     let progressThrough: CanonicalSequence | undefined;
+    let operational: ReadonlyArray<RecordEnvelope> = [];
 
     const invalid = (message: string) =>
       ThreadStoreError.make({
@@ -1707,10 +1730,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
 
         if (found === undefined) {
           // An exact lookup distinguishes missing evidence from an incomplete native index.
-          yield* resolveEvidence(threadId, ref).pipe(
-            Effect.provideService(ThreadReader, reader),
-            Effect.provideService(Crypto.Crypto, crypto),
-          );
+          yield* resolveEvidence(threadId, ref).pipe(Effect.provideContext(journalServices));
 
           return yield* invalid(
             "Required Run evidence is absent from its locator; rebuild the index explicitly",
@@ -1777,8 +1797,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
         } else {
           saved = yield* readRunContext(initial, input, cursor.savedContext.recordId).pipe(
             Effect.provide(RunContextReader.layer(threadId)),
-            Effect.provideService(ThreadReader, reader),
-            Effect.provideService(Crypto.Crypto, crypto),
+            Effect.provideContext(journalServices),
             Effect.mapError(() =>
               invalid("Saved original context cannot be resolved from its evidence"),
             ),
@@ -1822,6 +1841,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
         context = saved;
         progress = cursor;
         progressThrough = envelope.throughSequence;
+        operational = envelope.operational;
       }
     }
 
@@ -1833,7 +1853,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       ).values(),
     ].sort((left, right) => left.sequence - right.sequence);
 
-    return { canonical: Stream.fromIterable(records), context, progress, progressThrough };
+    return { records, context, progress, progressThrough, operational };
   });
 
   const readControl = Effect.fnUntraced(function* (
@@ -1843,9 +1863,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     const tail = yield* store.inspectTail(ThreadTailRequest.make({ threadId }));
     const view = yield* recoveryView(threadId, tail.tailSequence, submissionIds);
 
-    return yield* Stream.runCollect(
-      view.canonical.pipe(Stream.filter(controlRecords(submissionIds))),
-    );
+    return view.records.filter(controlRecords(submissionIds));
   });
 
   const readAllTolerant = (
@@ -1888,9 +1906,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       return { records: [], materialized: false, throughSequence: ZERO_SEQUENCE, submissionIds };
 
     const records = yield* recoveryView(threadId, tail.value.tailSequence, submissionIds).pipe(
-      Effect.flatMap((view) =>
-        Stream.runCollect(view.canonical.pipe(Stream.filter(controlRecords(submissionIds)))),
-      ),
+      Effect.map((view) => view.records.filter(controlRecords(submissionIds))),
       Effect.catchTag("ThreadNotMaterialized", (error) =>
         ThreadStoreError.make({
           operation: "read recovery history",
@@ -2575,8 +2591,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     const progress =
       active?.writer ??
       (yield* makeProgressWriter(writer.threadId, config.deploymentId).pipe(
-        Effect.provideService(ThreadReader, reader),
-        Effect.provideService(Crypto.Crypto, crypto),
+        Effect.provideContext(journalServices),
       ));
 
     const owned: RunWriter = {
@@ -2629,50 +2644,48 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
   // also covers a destination handoff written before dispatch or after Run settlement.
   const progressStore = ThreadStore.of({
     ...store,
-    append: (request) =>
-      Effect.gen(function* () {
-        const active = activeProgress.get(request.threadId);
+    append: Effect.fnUntraced(function* (request) {
+      const active = activeProgress.get(request.threadId);
 
-        const progress =
-          active?.writer ??
-          (yield* makeProgressWriter(request.threadId, config.deploymentId).pipe(
-            Effect.provideService(ThreadReader, reader),
-            Effect.provideService(Crypto.Crypto, crypto),
-          ));
+      const progress =
+        active?.writer ??
+        (yield* makeProgressWriter(request.threadId, config.deploymentId).pipe(
+          Effect.provideContext(journalServices),
+        ));
 
-        let tail = {
-          sequence: request.expectedTailSequence,
-        };
+      let tail = {
+        sequence: request.expectedTailSequence,
+      };
 
-        return yield* progress.commit(request.batch).pipe(
-          Effect.provideService(CurrentRunWriter, {
-            threadId: request.threadId,
-            tail: Effect.sync(() => tail),
-            withProgress: (effect) => storageOwner.withProgress(request.threadId, effect),
-            append: (batch, executions) =>
-              store
-                .append(
-                  AppendRequest.make({
-                    ...request,
-                    expectedTailSequence: tail.sequence,
-
-                    batch,
-                    executions,
+      return yield* progress.commit(request.batch).pipe(
+        Effect.provideService(CurrentRunWriter, {
+          threadId: request.threadId,
+          tail: Effect.sync(() => tail),
+          withProgress: (effect) => storageOwner.withProgress(request.threadId, effect),
+          append: (batch, executions) =>
+            store
+              .append(
+                AppendRequest.make({
+                  ...request,
+                  expectedTailSequence: tail.sequence,
+
+                  batch,
+                  executions,
+                }),
+              )
+              .pipe(
+                Effect.tapErrorTag("AppendConflict", (conflict) =>
+                  Effect.sync(() => {
+                    if (conflict.reason === "tail" && conflict.actualTailSequence !== undefined)
+                      tail = {
+                        sequence: conflict.actualTailSequence,
+                      };
                   }),
-                )
-                .pipe(
-                  Effect.tapErrorTag("AppendConflict", (conflict) =>
-                    Effect.sync(() => {
-                      if (conflict.reason === "tail" && conflict.actualTailSequence !== undefined)
-                        tail = {
-                          sequence: conflict.actualTailSequence,
-                        };
-                    }),
-                  ),
                 ),
-          }),
-        );
-      }),
+              ),
+        }),
+      );
+    }),
   });
 
   const appendBatch = (ctx: Pick<RunWriter, "threadId" | "append">, batch: CanonicalBatch) =>
@@ -2701,51 +2714,49 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
             threadId: ctx.threadId,
             tail: ctx.tail,
             withProgress: ctx.withProgress,
-            publishSettlement: (prepared, executions) =>
-              Effect.gen(function* () {
-                let tail = yield* ctx.tail;
-
-                for (let retries = 0; ; retries++) {
-                  const result = yield* runStorage
-                    .publishSettlement(
-                      SettlementPublication.make({
-                        submissionId,
-                        authority,
-                        append: AppendRequest.make({
-                          threadId: ctx.threadId,
-                          expectedTailSequence: tail.sequence,
-
-                          batch: prepared,
-                          executions,
-                        }),
-                      }),
-                    )
-                    .pipe(
-                      (effect) =>
-                        storageOwner.withMutation(Effect.andThen(ctx.checkActive, effect)),
-                      Effect.catchTag("AppendConflict", (conflict) => {
-                        if (
-                          conflict.reason !== "tail" ||
-                          conflict.actualTailSequence === undefined ||
-                          retries >= 8
-                        )
-                          return Effect.fail(conflict);
-                        tail = {
-                          sequence: conflict.actualTailSequence,
-                        };
-
-                        if (executions !== undefined && executions.length > 0)
-                          return ctx.refresh.pipe(Effect.andThen(Effect.fail(conflict)));
-
-                        return Effect.succeed(undefined);
+            publishSettlement: Effect.fnUntraced(function* (prepared, executions) {
+              let tail = yield* ctx.tail;
+
+              for (let retries = 0; ; retries++) {
+                const result = yield* runStorage
+                  .publishSettlement(
+                    SettlementPublication.make({
+                      submissionId,
+                      authority,
+                      append: AppendRequest.make({
+                        threadId: ctx.threadId,
+                        expectedTailSequence: tail.sequence,
+
+                        batch: prepared,
+                        executions,
                       }),
-                    );
+                    }),
+                  )
+                  .pipe(
+                    (effect) => storageOwner.withMutation(Effect.andThen(ctx.checkActive, effect)),
+                    Effect.catchTag("AppendConflict", (conflict) => {
+                      if (
+                        conflict.reason !== "tail" ||
+                        conflict.actualTailSequence === undefined ||
+                        retries >= 8
+                      )
+                        return Effect.fail(conflict);
+                      tail = {
+                        sequence: conflict.actualTailSequence,
+                      };
 
-                  if (result === undefined) continue;
+                      if (executions !== undefined && executions.length > 0)
+                        return ctx.refresh.pipe(Effect.andThen(Effect.fail(conflict)));
 
-                  return result;
-                }
-              }),
+                      return Effect.succeed(undefined);
+                    }),
+                  );
+
+                if (result === undefined) continue;
+
+                return result;
+              }
+            }),
           }),
         );
       });
@@ -3207,15 +3218,23 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     yield* ownership.markInputApplied({ recordId, sequence: result.firstSequence });
   });
 
-  const readRunStart = Effect.fnUntraced(function* (threadId: ThreadId, runId: RunId) {
-    const loaded = yield* reader
-      .readExecution({ threadId, runId })
-      .pipe(Effect.catchTag("ThreadNotMaterialized", () => Effect.succeed(Option.none())));
+  const readRunStart = Effect.fnUntraced(function* (
+    threadId: ThreadId,
+    runId: RunId,
+    operational?: ReadonlyArray<RecordEnvelope>,
+  ) {
+    if (operational === undefined) {
+      const loaded = yield* reader
+        .readExecution({ threadId, runId })
+        .pipe(Effect.catchTag("ThreadNotMaterialized", () => Effect.succeed(Option.none())));
+
+      if (Option.isNone(loaded)) return undefined;
+      operational = loaded.value.operational;
+    }
 
-    if (Option.isNone(loaded)) return undefined;
     const recordId = runStartedRecordId(runId);
-    const starts = loaded.value.operational.filter(({ payload }) => payload._tag === "RunStarted");
-    const existing = loaded.value.operational.find((record) => record.recordId === recordId);
+    const starts = operational.filter(({ payload }) => payload._tag === "RunStarted");
+    const existing = operational.find((record) => record.recordId === recordId);
 
     if (
       starts.length > 1 ||
@@ -3234,11 +3253,12 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     submission: SubmissionSnapshot,
     maxDurationMillis: number,
     records: ReadonlyArray<CanonicalRecordEnvelope>,
+    operational: ReadonlyArray<RecordEnvelope>,
   ) {
     const writer = yield* CurrentRunWriter;
     const runId = runIdForSubmission(submission.submissionId);
     const recordId = runStartedRecordId(runId);
-    const existing = yield* readRunStart(submission.threadId, runId);
+    const existing = yield* readRunStart(submission.threadId, runId, operational);
     let start: RecordEnvelope;
     let allowance = maxDurationMillis;
     let committed = existing !== undefined;
@@ -4762,70 +4782,71 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     knownIds.add(recordId);
   });
 
-  /**
-   * Drive the shared interpreter Effect with history rebuilt by the run journal, commit
-   * each Turn under the local owner, and watch for durable abort intent. Engine Run failures settle `failed`; coordinator failures abort the
-   * Attempt cleanly with the obligation still owed.
-   *
-   * The interpreter supplies validated response, closed Tool-result, and completion facts.
-   * Responses precede approval and effectful dispatch; readonly responses may join their closed
-   * results. Tool results precede input drains and the next Turn. A no-tool response and Run
-   * completion share one batch. A completion Tool's result
-   * precedes its terminal-only completion batch, so recovery can repeat a pure output projection
-   * without replaying the handler. Pending batches resume from their canonical declarations.
-   */
-  const runModel = <
-    InputSchema extends Schema.Top,
-    OutputSchema extends Schema.Top,
-    Instructions,
-    Tools extends Record<string, Tool.Any>,
-    Provider,
-    ModelProvides,
-    ModelRequires,
-    InstructionError = InstructionErrorOf<Instructions, InputSchema["Type"]>,
-    InstructionRequirements = InstructionRequirementsOf<Instructions, InputSchema["Type"]>,
-    RunDispositionValue extends
-      | RunDispositionDeclaration<OutputSchema["Type"], Schema.Top>
-      | undefined = undefined,
-    InputPromptValue extends InputPromptSource<InputSchema["Type"], unknown, unknown> | undefined =
-      undefined,
-    UpdatesSchema extends Schema.Top | undefined = undefined,
-  >(
-    agent: RuntimeBinding<
-      InputSchema,
-      OutputSchema,
+  const runModel = Effect.fnUntraced(
+    /**
+     * Drive the shared interpreter Effect with history rebuilt by the run journal, commit
+     * each Turn under the local owner, and watch for durable abort intent. Engine Run failures settle `failed`; coordinator failures abort the
+     * Attempt cleanly with the obligation still owed.
+     *
+     * The interpreter supplies validated response, closed Tool-result, and completion facts.
+     * Responses precede approval and effectful dispatch; readonly responses may join their closed
+     * results. Tool results precede input drains and the next Turn. A no-tool response and Run
+     * completion share one batch. A completion Tool's result
+     * precedes its terminal-only completion batch, so recovery can repeat a pure output projection
+     * without replaying the handler. Pending batches resume from their canonical declarations.
+     */
+    function* <
+      InputSchema extends Schema.Top,
+      OutputSchema extends Schema.Top,
       Instructions,
-      Tools,
+      Tools extends Record<string, Tool.Any>,
       Provider,
       ModelProvides,
       ModelRequires,
-      InstructionError,
-      InstructionRequirements,
-      RunDispositionValue,
-      InputPromptValue,
-      UpdatesSchema
-    >,
-    ctx: AttemptAppendContext,
-    submission: SubmissionSnapshot,
-    session: RunStorageSession,
-    records: ReadonlyArray<CanonicalRecordEnvelope>,
-    canonical: Stream.Stream<
-      JournalRecordEnvelope,
-      ThreadStoreError | ThreadNotMaterialized | RunJournalError
-    >,
-    initialJournal: InitialJournalSource | undefined,
-    canonicalThrough: CanonicalSequence,
-    progressThrough: CanonicalSequence | undefined,
-    continuation: RunContinuation | undefined,
-    priorContext: RunJournalContext | undefined,
-    journalMetadata: JournalMetadata | undefined,
-    lineage: AttemptLineage,
-    approvalDecisions: ReadonlyArray<ApprovalDecisionIntent>,
-    currentContracts: Readonly<Record<string, Digest>>,
-    runTiming: RunTiming,
-    yieldAfter?: DateTime.Utc,
-  ) =>
-    Effect.gen(function* () {
+      InstructionError = InstructionErrorOf<Instructions, InputSchema["Type"]>,
+      InstructionRequirements = InstructionRequirementsOf<Instructions, InputSchema["Type"]>,
+      RunDispositionValue extends
+        | RunDispositionDeclaration<OutputSchema["Type"], Schema.Top>
+        | undefined = undefined,
+      InputPromptValue extends
+        | InputPromptSource<InputSchema["Type"], unknown, unknown>
+        | undefined = undefined,
+      UpdatesSchema extends Schema.Top | undefined = undefined,
+    >(
+      agent: RuntimeBinding<
+        InputSchema,
+        OutputSchema,
+        Instructions,
+        Tools,
+        Provider,
+        ModelProvides,
+        ModelRequires,
+        InstructionError,
+        InstructionRequirements,
+        RunDispositionValue,
+        InputPromptValue,
+        UpdatesSchema
+      >,
+      ctx: AttemptAppendContext,
+      submission: SubmissionSnapshot,
+      session: RunStorageSession,
+      records: ReadonlyArray<CanonicalRecordEnvelope>,
+      canonical: Stream.Stream<
+        JournalRecordEnvelope,
+        ThreadStoreError | ThreadNotMaterialized | RunJournalError
+      >,
+      initialJournal: InitialJournalSource | undefined,
+      canonicalThrough: CanonicalSequence,
+      progressThrough: CanonicalSequence | undefined,
+      continuation: RunContinuation | undefined,
+      priorContext: RunJournalContext | undefined,
+      journalMetadata: JournalMetadata | undefined,
+      lineage: AttemptLineage,
+      approvalDecisions: ReadonlyArray<ApprovalDecisionIntent>,
+      currentContracts: Readonly<Record<string, Digest>>,
+      runTiming: RunTiming,
+      yieldAfter?: DateTime.Utc,
+    ) {
       const submissionId = submission.submissionId;
 
       const runId = runIdForSubmission(submissionId);
@@ -4851,23 +4872,35 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
           historyEvidence.set(entry.record.recordId, entry);
       };
 
+      // An exact cache prefix followed only by this fresh input has no response,
+      // policy reservation or context to replay. Keep recovery on the full projector.
+      const freshPrefix =
+        priorContext === undefined &&
+        initialJournal?.prefix !== undefined &&
+        initialJournal.records?.length === 1 &&
+        initialJournal.records[0] === originalInput
+          ? initialJournal.prefix.prompt
+          : undefined;
+
       let journal =
-        cached !== undefined &&
-        cached.threadId === ctx.threadId &&
-        cached.through === projectionThrough &&
-        cached.runId === runId &&
-        cached.contextRecordId === priorContext?.recordId
-          ? (boundaries.push(...cached.boundaries),
-            cached.contextEvidence.forEach(retainHistory),
-            cached.journal)
-          : yield* projectRunJournalStream(
-              canonical,
-              runId,
-              (boundary) => boundaries.push(boundary),
-              priorContext,
-              journalMetadata,
-              priorContext === undefined ? retainHistory : undefined,
-            );
+        freshPrefix !== undefined
+          ? initialRunJournal(freshPrefix)
+          : cached !== undefined &&
+              cached.threadId === ctx.threadId &&
+              cached.through === projectionThrough &&
+              cached.runId === runId &&
+              cached.contextRecordId === priorContext?.recordId
+            ? (boundaries.push(...cached.boundaries),
+              cached.contextEvidence.forEach(retainHistory),
+              cached.journal)
+            : yield* projectRunJournalStream(
+                canonical,
+                runId,
+                (boundary) => boundaries.push(boundary),
+                priorContext,
+                journalMetadata,
+                priorContext === undefined ? retainHistory : undefined,
+              );
 
       if (initialJournal?.prefix !== undefined) {
         const prompt = initialJournal.prefix.prompt;
@@ -5187,9 +5220,6 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
           ),
         );
 
-      const addUsageTotal = (field: string, left: number, right: number) =>
-        checkedUsageTotal(field, left + right);
-
       const subtractUsageTotal = (field: string, left: number, right: number) =>
         checkedUsageTotal(field, left - right);
 
@@ -5199,11 +5229,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
           let unobservedModelCalls = journal.usage.unobservedModelCalls ?? 0;
 
           for (const count of stagedUnobservedCalls.values()) {
-            unobservedModelCalls = yield* addUsageTotal(
-              "unobservedModelCalls",
-              unobservedModelCalls,
-              count,
-            );
+            unobservedModelCalls += count;
           }
           const detailedCalls = [...journal.usage.modelUsage, ...stagedCalls];
 
@@ -5224,17 +5250,15 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
           let costMicrousd = journal.usage.costMicrousd;
 
           for (const usage of stagedUsage.values()) {
-            inputTokens = yield* addUsageTotal("inputTokens", inputTokens, usage.inputTokens);
-            outputTokens = yield* addUsageTotal("outputTokens", outputTokens, usage.outputTokens);
-            costMicrousd = yield* addUsageTotal("costMicrousd", costMicrousd, usage.costMicrousd);
+            inputTokens += usage.inputTokens;
+            outputTokens += usage.outputTokens;
+            costMicrousd += usage.costMicrousd;
           }
 
-          const modelCalls = yield* addUsageTotal(
-            "modelCalls",
-            journal.usage.modelCalls,
-            stagedCalls.length,
-          );
+          const modelCalls = journal.usage.modelCalls + stagedCalls.length;
 
+          // Reconciliation must reject negative legacy deltas independently of
+          // the final summary's complete safe-integer and additive checks.
           const legacyCalls = yield* subtractUsageTotal(
             "legacy.modelCalls",
             modelCalls,
@@ -5278,81 +5302,52 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
 
             const existing = existingIndex < 0 ? undefined : byModel[existingIndex];
 
-            const legacyGroup = ModelUsageGroup.make({
+            const legacyGroup = yield* ModelUsageGroup.makeEffect({
               provider: "unknown",
               model: "legacy-record",
-              modelCalls: yield* addUsageTotal(
-                "byModel.modelCalls",
-                existing?.modelCalls ?? 0,
-                legacyCalls,
-              ),
-              inputTokens: InputTokenUsage.make({
-                total: yield* addUsageTotal(
-                  "byModel.inputTokens.total",
-                  existing?.inputTokens.total ?? 0,
-                  legacyInput,
-                ),
-                uncached: yield* addUsageTotal(
-                  "byModel.inputTokens.uncached",
-                  existing?.inputTokens.uncached ?? 0,
-                  legacyInput,
-                ),
+              modelCalls: (existing?.modelCalls ?? 0) + legacyCalls,
+              inputTokens: {
+                total: (existing?.inputTokens.total ?? 0) + legacyInput,
+                uncached: (existing?.inputTokens.uncached ?? 0) + legacyInput,
                 cacheRead: existing?.inputTokens.cacheRead ?? 0,
                 cacheWrite: existing?.inputTokens.cacheWrite ?? 0,
-              }),
-              outputTokens: OutputTokenUsage.make({
-                total: yield* addUsageTotal(
-                  "byModel.outputTokens.total",
-                  existing?.outputTokens.total ?? 0,
-                  legacyOutput,
-                ),
-                text: yield* addUsageTotal(
-                  "byModel.outputTokens.text",
-                  existing?.outputTokens.text ?? 0,
-                  legacyOutput,
-                ),
+              },
+              outputTokens: {
+                total: (existing?.outputTokens.total ?? 0) + legacyOutput,
+                text: (existing?.outputTokens.text ?? 0) + legacyOutput,
                 reasoning: existing?.outputTokens.reasoning ?? 0,
-              }),
-              costMicrousd: yield* addUsageTotal(
-                "byModel.costMicrousd",
-                existing?.costMicrousd ?? 0,
-                legacyCost,
+              },
+              costMicrousd: (existing?.costMicrousd ?? 0) + legacyCost,
+            }).pipe(
+              Effect.mapError((cause) =>
+                RunJournalError.make({
+                  message: "Run legacy usage exceeds safe-integer accounting bounds",
+                  cause,
+                }),
               ),
-            });
+            );
 
             if (existingIndex < 0) byModel.push(legacyGroup);
             else byModel[existingIndex] = legacyGroup;
           }
 
-          const uncached = yield* addUsageTotal(
-            "inputTokens.uncached",
-            detailed.inputTokens.uncached,
-            legacyInput,
-          );
-
-          const text = yield* addUsageTotal(
-            "outputTokens.text",
-            detailed.outputTokens.text,
-            legacyOutput,
-          );
-
-          return RunUsageSummary.make({
+          return yield* RunUsageSummary.makeEffect({
             ...(legacyCalls === 0 && detailed.webSearchCalls !== undefined
               ? { webSearchCalls: detailed.webSearchCalls }
               : {}),
             modelCalls,
-            inputTokens: InputTokenUsage.make({
+            inputTokens: {
               total: inputTokens,
               // Legacy aggregate inputs are conservatively classified as uncached.
-              uncached,
+              uncached: detailed.inputTokens.uncached + legacyInput,
               cacheRead: detailed.inputTokens.cacheRead,
               cacheWrite: detailed.inputTokens.cacheWrite,
-            }),
-            outputTokens: OutputTokenUsage.make({
+            },
+            outputTokens: {
               total: outputTokens,
-              text,
+              text: detailed.outputTokens.text + legacyOutput,
               reasoning: detailed.outputTokens.reasoning,
-            }),
+            },
             costMicrousd,
             byModel,
             unobservedModelCalls,
@@ -5368,7 +5363,14 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
                   ? "unknown"
                   : "partial"
                 : detailed.pricingStatus,
-          });
+          }).pipe(
+            Effect.mapError((cause) =>
+              RunJournalError.make({
+                message: "Run usage summary exceeds safe-integer accounting bounds",
+                cause,
+              }),
+            ),
+          );
         });
 
       const activeExecution = yield* reader.readExecution({ threadId: ctx.threadId, runId });
@@ -5544,37 +5546,38 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       const recordHalt = <A, R>(
         effect: Effect.Effect<A, DurableWorkerFailure, R>,
       ): Effect.Effect<A, CoordinatorHalt | AgentPersistenceCapacityError, R> =>
-        effect.pipe(
-          Effect.tapError((failure) =>
-            failure instanceof ThreadStoreError &&
-            failure.cause instanceof AgentPersistenceCapacityError
-              ? Effect.void
-              : Ref.set(haltRef, failure),
-          ),
-          Effect.catchCause((cause) =>
-            Effect.failCause(
-              Cause.map(cause, (failure) =>
-                failure instanceof ThreadStoreError &&
-                failure.cause instanceof AgentPersistenceCapacityError
-                  ? failure.cause
-                  : new CoordinatorHalt(failure),
-              ),
+        Effect.catchCause(effect, (cause) => {
+          const first = Cause.findErrorOption(cause);
+
+          const failure = Effect.failCause(
+            Cause.map(cause, (error) =>
+              error instanceof ThreadStoreError &&
+              error.cause instanceof AgentPersistenceCapacityError
+                ? error.cause
+                : new CoordinatorHalt(error),
             ),
-          ),
-        );
+          );
+
+          return Option.isNone(first) ||
+            (first.value instanceof ThreadStoreError &&
+              first.value.cause instanceof AgentPersistenceCapacityError)
+            ? failure
+            : Effect.andThen(Ref.set(haltRef, first.value), failure);
+        });
 
       // Infrastructure errors can be wrapped by broker/Tool APIs. The interpreter checks this
       // authority before semantic work; progress delivery is not a coordinator checkpoint.
-      const checkpoint = recordHalt(
-        Effect.gen(function* () {
-          const failure = yield* Ref.get(haltRef);
+      const progress = progressWriters.get(ctx);
 
-          if (failure !== undefined) return yield* failure;
-          const progress = progressWriters.get(ctx);
+      const checkProgress =
+        progress === undefined
+          ? Effect.void
+          : progress.check(runId).pipe(Effect.provideService(CurrentRunWriter, ctx));
 
-          if (progress !== undefined)
-            yield* progress.check(runId).pipe(Effect.provideService(CurrentRunWriter, ctx));
-        }),
+      const checkpoint = recordHalt(
+        Effect.flatMap(Ref.get(haltRef), (failure) =>
+          failure === undefined ? checkProgress : Effect.fail(failure),
+        ),
       );
 
       // One readonly Turn may own its response without publishing it. Promotion and settlement
@@ -6065,9 +6068,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
                 // The interpreter supplies only closed siblings, in declaration order.
                 // Per-call identities retain each result before the child suspension.
                 for (const result of toolResults) {
-                  const batch = yield* withCrypto(
-                    turnResultsBatch({ ...input, toolResults: [result] }),
-                  );
+                  const batch = yield* turnResultsBatch({ ...input, toolResults: [result] });
 
                   yield* appendBatch(
                     ctx,
@@ -6100,47 +6101,45 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
                   turnId: commit.turnId,
                   // The journal owns encoded messages. Detach the remaining small metadata
                   // trees too: Schema validation alone is not an ownership transfer.
-                  batch: yield* withCrypto(
-                    turnCanonicalBatch({
-                      ...input,
-                      toolParameterRejections: input.toolParameterRejections?.map((rejection) => ({
-                        ...rejection,
-                        parameters: copyJson(rejection.parameters),
-                        error: { ...rejection.error, reason: { ...rejection.error.reason } },
-                      })),
-                      toolExposure:
-                        input.toolExposure === undefined
-                          ? undefined
-                          : Snapshot.make({
-                              exposedToolNames: [...input.toolExposure.exposedToolNames],
-                              ...(input.toolExposure.selection === undefined
-                                ? {}
-                                : {
-                                    selection: Selection.make({
-                                      toolNames: [...input.toolExposure.selection.toolNames],
-                                    }),
+                  batch: yield* turnCanonicalBatch({
+                    ...input,
+                    toolParameterRejections: input.toolParameterRejections?.map((rejection) => ({
+                      ...rejection,
+                      parameters: copyJson(rejection.parameters),
+                      error: { ...rejection.error, reason: { ...rejection.error.reason } },
+                    })),
+                    toolExposure:
+                      input.toolExposure === undefined
+                        ? undefined
+                        : Snapshot.make({
+                            exposedToolNames: [...input.toolExposure.exposedToolNames],
+                            ...(input.toolExposure.selection === undefined
+                              ? {}
+                              : {
+                                  selection: Selection.make({
+                                    toolNames: [...input.toolExposure.selection.toolNames],
                                   }),
-                            }),
-                      usage:
-                        input.usage === undefined
-                          ? undefined
-                          : {
-                              ...input.usage,
-                              modelUsage: input.usage.modelUsage?.map((usage) =>
-                                ModelCallUsage.make({
-                                  ...usage,
-                                  ...(usage.response === undefined
-                                    ? {}
-                                    : {
-                                        response: ModelResponseIdentity.make({ ...usage.response }),
-                                      }),
-                                  inputTokens: InputTokenUsage.make({ ...usage.inputTokens }),
-                                  outputTokens: OutputTokenUsage.make({ ...usage.outputTokens }),
                                 }),
-                              ),
-                            },
-                    }),
-                  ),
+                          }),
+                    usage:
+                      input.usage === undefined
+                        ? undefined
+                        : {
+                            ...input.usage,
+                            modelUsage: input.usage.modelUsage?.map((usage) =>
+                              ModelCallUsage.make({
+                                ...usage,
+                                ...(usage.response === undefined
+                                  ? {}
+                                  : {
+                                      response: ModelResponseIdentity.make({ ...usage.response }),
+                                    }),
+                                inputTokens: InputTokenUsage.make({ ...usage.inputTokens }),
+                                outputTokens: OutputTokenUsage.make({ ...usage.outputTokens }),
+                              }),
+                            ),
+                          },
+                  }),
                 };
 
                 const progress = progressWriters.get(ctx);
@@ -6163,17 +6162,15 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
               let batch: CanonicalBatch;
 
               if (deferred === undefined) {
-                batch = yield* withCrypto(
-                  commit._tag === "Response"
-                    ? turnResponseBatch(input)
-                    : response === undefined
-                      ? turnResultsBatch(input)
-                      : turnCanonicalBatch(input),
-                );
+                batch = yield* commit._tag === "Response"
+                  ? turnResponseBatch(input)
+                  : response === undefined
+                    ? turnResultsBatch(input)
+                    : turnCanonicalBatch(input);
               } else if (toolResults.length === 0 && runCompletion === undefined) {
                 batch = deferred.batch;
               } else {
-                const results = yield* withCrypto(turnResultsBatch(input));
+                const results = yield* turnResultsBatch(input);
 
                 batch = CanonicalBatch.make({
                   ...deferred.batch,
@@ -6347,214 +6344,208 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
               .get(ctx)
               ?.stageUsage(runId, terminalUsageCharge(uncommittedModelUsage()));
           }),
-        commitCompaction: (commit) =>
-          Effect.gen(function* () {
-            const canonicalTurn = commit.turn;
-            const recordId = compactionRecordId(runId, canonicalTurn, commit.kind);
-
-            if (knownIds.has(recordId)) {
-              return yield* CompactionError.make({
-                message: "Compaction is already committed for this Turn and kind",
-              });
-            }
+        commitCompaction: Effect.fnUntraced(function* (commit) {
+          const canonicalTurn = commit.turn;
+          const recordId = compactionRecordId(runId, canonicalTurn, commit.kind);
 
-            let sourceJournal = journal;
-            let sourceBoundaries = boundaries;
+          if (knownIds.has(recordId)) {
+            return yield* CompactionError.make({
+              message: "Compaction is already committed for this Turn and kind",
+            });
+          }
 
-            if (initialJournal !== undefined) {
-              initialJournal.cacheable = false;
-              initialJournal.history = undefined;
-            }
-            if (commit.kind !== "summarize" || initialJournal?.prefix !== undefined) {
-              // Results must be canonical before pruning or rollover can cover them. Newly committed
-              // compactions remain overlays on this Attempt's append-only source, so omit those
-              // overlays while reconstructing the exact source-to-record mapping.
-              const tail = yield* ctx.tail;
-
-              const source =
-                initialJournal === undefined
-                  ? canonical
-                  : Stream.fromIterable(
-                      yield* recordHalt(
-                        readInitialJournal(initialJournal.original, initialJournal.suffix),
-                      ),
-                    );
+          let sourceJournal = journal;
+          let sourceBoundaries = boundaries;
 
-              sourceBoundaries = [];
-              sourceJournal = yield* recordHalt(
-                projectRunJournalStream(
-                  Stream.concat(
-                    source,
-                    Stream.fromIterable(
-                      yield* recordHalt(
-                        selectedRange(
-                          ctx.threadId,
-                          [submissionId],
-                          tail.sequence,
-                          canonicalThrough,
-                        ),
-                      ),
+          if (initialJournal !== undefined) {
+            initialJournal.cacheable = false;
+            initialJournal.history = undefined;
+          }
+          if (commit.kind !== "summarize" || initialJournal?.prefix !== undefined) {
+            // Results must be canonical before pruning or rollover can cover them. Newly committed
+            // compactions remain overlays on this Attempt's append-only source, so omit those
+            // overlays while reconstructing the exact source-to-record mapping.
+            const tail = yield* ctx.tail;
+
+            const source =
+              initialJournal === undefined
+                ? canonical
+                : Stream.fromIterable(
+                    yield* recordHalt(
+                      readInitialJournal(initialJournal.original, initialJournal.suffix),
                     ),
-                  ).pipe(
-                    Stream.filter(
-                      (envelope) =>
-                        envelope.record.payload._tag !== "CompactionCreated" ||
-                        envelope.sequence <= canonicalThrough,
+                  );
+
+            sourceBoundaries = [];
+            sourceJournal = yield* recordHalt(
+              projectRunJournalStream(
+                Stream.concat(
+                  source,
+                  Stream.fromIterable(
+                    yield* recordHalt(
+                      selectedRange(ctx.threadId, [submissionId], tail.sequence, canonicalThrough),
                     ),
                   ),
-                  runId,
-                  (boundary) => sourceBoundaries.push(boundary),
-                  priorContext,
+                ).pipe(
+                  Stream.filter(
+                    (envelope) =>
+                      envelope.record.payload._tag !== "CompactionCreated" ||
+                      envelope.sequence <= canonicalThrough,
+                  ),
                 ),
-              );
-            }
-
-            // Summaries use the initial prior-Run boundaries; pruning and rollover also admit
-            // complete current-Run boundaries from the fresh canonical source above.
-            const coverable = sourceBoundaries.filter(
-              (boundary) =>
-                commit.kind !== "summarize" ||
-                ownerFirstSequence === undefined ||
-                boundary.sequence < ownerFirstSequence,
-            );
-
-            if (coverable.length === 0) {
-              return yield* CompactionError.make({
-                message:
-                  commit.kind === "rollover"
-                    ? "Durable rollover requires complete canonical records"
-                    : "Durable compaction requires eligible canonical records",
-              });
-            }
-
-            const comparisonView = instructionView(
-              sourceJournal.prompt.content,
-              initialInstructions,
-              false,
-              sourceJournal.historyBefore.content.length,
+                runId,
+                (boundary) => sourceBoundaries.push(boundary),
+                priorContext,
+              ),
             );
+          }
 
-            // Compare each visible message once. A transformed source can authorize only its
-            // exact canonical prefix; no per-candidate rereads or full encoded Prompt copies.
-            let matchingPrefix = 0;
-            let requiredThrough = 0;
-            const comparisonLimit = Math.min(comparisonView.messages.length, commit.through);
+          // Summaries use the initial prior-Run boundaries; pruning and rollover also admit
+          // complete current-Run boundaries from the fresh canonical source above.
+          const coverable = sourceBoundaries.filter(
+            (boundary) =>
+              commit.kind !== "summarize" ||
+              ownerFirstSequence === undefined ||
+              boundary.sequence < ownerFirstSequence,
+          );
 
-            for (let index = 0; index < commit.through; index += 1) {
-              const message = commit.source.content[index];
+          if (coverable.length === 0) {
+            return yield* CompactionError.make({
+              message:
+                commit.kind === "rollover"
+                  ? "Durable rollover requires complete canonical records"
+                  : "Durable compaction requires eligible canonical records",
+            });
+          }
 
-              if (
-                message !== undefined &&
-                (commit.kind === "clear-tool-results"
-                  ? message.role === "tool"
-                  : message.role !== "system")
-              )
-                requiredThrough = index + 1;
-              if (index >= comparisonLimit || index !== matchingPrefix || message === undefined)
-                continue;
-              const canonicalMessage = comparisonView.messages[index];
-
-              if (canonicalMessage === undefined) continue;
-
-              // Preserve Prompt's JSON projection while ignoring persisted object-key order.
-              const encode = (entry: Prompt.Message) =>
-                encodeCompactionMessageJson(entry).pipe(
-                  Effect.flatMap(decodeCompactionMessageJson),
-                  Effect.map(canonicalJson),
-                  Effect.mapError((cause) =>
-                    CompactionError.make({
-                      message: "Could not encode the canonical compaction prefix",
-                      cause,
-                    }),
-                  ),
-                );
+          const comparisonView = instructionView(
+            sourceJournal.prompt.content,
+            initialInstructions,
+            false,
+            sourceJournal.historyBefore.content.length,
+          );
 
-              const left = yield* encode(canonicalMessage);
-              const right = yield* encode(message);
+          // Compare each visible message once. A transformed source can authorize only its
+          // exact canonical prefix; no per-candidate rereads or full encoded Prompt copies.
+          let matchingPrefix = 0;
+          let requiredThrough = 0;
+          const comparisonLimit = Math.min(comparisonView.messages.length, commit.through);
 
-              if (left === right) matchingPrefix += 1;
-            }
+          for (let index = 0; index < commit.through; index += 1) {
+            const message = commit.source.content[index];
 
-            let lastCovered: JournalBoundary | undefined;
+            if (
+              message !== undefined &&
+              (commit.kind === "clear-tool-results"
+                ? message.role === "tool"
+                : message.role !== "system")
+            )
+              requiredThrough = index + 1;
+            if (index >= comparisonLimit || index !== matchingPrefix || message === undefined)
+              continue;
+            const canonicalMessage = comparisonView.messages[index];
+
+            if (canonicalMessage === undefined) continue;
+
+            // Preserve Prompt's JSON projection while ignoring persisted object-key order.
+            const encode = (entry: Prompt.Message) =>
+              encodeCompactionMessageJson(entry).pipe(
+                Effect.flatMap(decodeCompactionMessageJson),
+                Effect.map(canonicalJson),
+                Effect.mapError((cause) =>
+                  CompactionError.make({
+                    message: "Could not encode the canonical compaction prefix",
+                    cause,
+                  }),
+                ),
+              );
 
-            for (let index = 0; index < coverable.length; index += 1) {
-              const candidate = coverable[index];
+            const left = yield* encode(canonicalMessage);
+            const right = yield* encode(message);
 
-              if (candidate === undefined) continue;
-              const following = coverable[index + 1];
+            if (left === right) matchingPrefix += 1;
+          }
 
-              if (following?.tag === "ToolCallSettled") continue;
+          let lastCovered: JournalBoundary | undefined;
 
-              const length = comparisonView.prefixLength(candidate.promptLength);
+          for (let index = 0; index < coverable.length; index += 1) {
+            const candidate = coverable[index];
 
-              if (length === 0 || length > commit.through) continue;
-              if (length < requiredThrough || length > matchingPrefix) continue;
-              lastCovered = candidate;
-            }
-            if (lastCovered === undefined) {
-              return yield* CompactionError.make({
-                message:
-                  commit.kind === "rollover"
-                    ? "Rollover coverage cannot be mapped to complete canonical records"
-                    : "Compaction coverage cannot be mapped to complete canonical records",
-              });
-            }
-            const coveredSequence = lastCovered.sequence;
+            if (candidate === undefined) continue;
+            const following = coverable[index + 1];
 
-            if (
-              commit.kind !== "summarize" &&
-              sourceBoundaries.some(
-                (boundary) =>
-                  boundary.incomplete === true &&
-                  boundary.terminalPriorRun !== true &&
-                  boundary.sequence <= coveredSequence,
-              )
-            ) {
-              return yield* CompactionError.make({
-                message: "Compaction cannot cover an incomplete Tool batch",
-              });
-            }
-            if (commit.kind === "summarize" && (commit.summary ?? "").trim().length === 0) {
-              return yield* CompactionError.make({
-                message: "A summarize compaction commit carried no summary",
-              });
-            }
+            if (following?.tag === "ToolCallSettled") continue;
 
-            const payload = yield* Schema.decodeEffect(CompactionCreated)({
-              _tag: "CompactionCreated",
-              runId,
-              turn: canonicalTurn,
-              kind: commit.kind,
-              coversThrough: lastCovered.sequence,
-              ...(commit.kind === "summarize" ? { summary: commit.summary } : {}),
-              ...(commit.kind === "rollover" && commit.handoff !== undefined
-                ? { handoff: commit.handoff }
-                : {}),
-            }).pipe(
-              Effect.mapError((cause) =>
-                CompactionError.make({
-                  message: "Compaction decision exceeds canonical persistence bounds",
-                  cause,
-                }),
-              ),
-            );
+            const length = comparisonView.prefixLength(candidate.promptLength);
 
-            const envelope = yield* recordHalt(makeEnvelope(recordId, payload));
+            if (length === 0 || length > commit.through) continue;
+            if (length < requiredThrough || length > matchingPrefix) continue;
+            lastCovered = candidate;
+          }
+          if (lastCovered === undefined) {
+            return yield* CompactionError.make({
+              message:
+                commit.kind === "rollover"
+                  ? "Rollover coverage cannot be mapped to complete canonical records"
+                  : "Compaction coverage cannot be mapped to complete canonical records",
+            });
+          }
+          const coveredSequence = lastCovered.sequence;
 
-            yield* recordHalt(hit("compaction:before-canonical-append"));
-            yield* recordHalt(
-              appendBatch(
-                ctx,
-                CanonicalBatch.make({
-                  batchId: compactionBatchId(runId, canonicalTurn, commit.kind),
-                  producerId: config.producerId,
-                  records: [envelope],
-                }),
-              ),
-            );
-            knownIds.add(recordId);
-            yield* recordHalt(hit("compaction:after-canonical-append"));
-          }),
+          if (
+            commit.kind !== "summarize" &&
+            sourceBoundaries.some(
+              (boundary) =>
+                boundary.incomplete === true &&
+                boundary.terminalPriorRun !== true &&
+                boundary.sequence <= coveredSequence,
+            )
+          ) {
+            return yield* CompactionError.make({
+              message: "Compaction cannot cover an incomplete Tool batch",
+            });
+          }
+          if (commit.kind === "summarize" && (commit.summary ?? "").trim().length === 0) {
+            return yield* CompactionError.make({
+              message: "A summarize compaction commit carried no summary",
+            });
+          }
+
+          const payload = yield* Schema.decodeEffect(CompactionCreated)({
+            _tag: "CompactionCreated",
+            runId,
+            turn: canonicalTurn,
+            kind: commit.kind,
+            coversThrough: lastCovered.sequence,
+            ...(commit.kind === "summarize" ? { summary: commit.summary } : {}),
+            ...(commit.kind === "rollover" && commit.handoff !== undefined
+              ? { handoff: commit.handoff }
+              : {}),
+          }).pipe(
+            Effect.mapError((cause) =>
+              CompactionError.make({
+                message: "Compaction decision exceeds canonical persistence bounds",
+                cause,
+              }),
+            ),
+          );
+
+          const envelope = yield* recordHalt(makeEnvelope(recordId, payload));
+
+          yield* recordHalt(hit("compaction:before-canonical-append"));
+          yield* recordHalt(
+            appendBatch(
+              ctx,
+              CanonicalBatch.make({
+                batchId: compactionBatchId(runId, canonicalTurn, commit.kind),
+                producerId: config.producerId,
+                records: [envelope],
+              }),
+            ),
+          );
+          knownIds.add(recordId);
+          yield* recordHalt(hit("compaction:after-canonical-append"));
+        }),
       };
 
       /** Digest of one declared call's canonical encoded parameters (the original normalized wire). */
@@ -6803,37 +6794,34 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
        * so the next Turn's response commit makes it model-visible canonically — exactly the
        * prompt-coverage rule recovery relies on.
        */
-      const renderJoinedInput = ({
-        input: encodedInput,
-        messageAdmission,
-      }: Pick<UserInputRecorded, "input" | "messageAdmission">) =>
-        Effect.gen(function* () {
-          if (Schema.is(FrameworkMessage)(messageAdmission))
-            return yield* Schema.encodeEffect(Schema.fromJsonString(FrameworkMessage))(
-              messageAdmission,
-            ).pipe(
-              Effect.mapError(() =>
-                AgentInputError.make({ message: "Invalid worker completion message" }),
-              ),
-            );
-          const inputPrompt = agent.definition.inputPrompt;
-
-          if (inputPrompt === undefined) {
-            return yield* renderInputPrompt(undefined, encodedInput, encodedInput);
-          }
-
-          const decodedInput = yield* Schema.decodeEffect(agent.definition.input)(
-            encodedInput,
+      const renderJoinedInput = Effect.fnUntraced(function* (
+        encodedInput: UserInputRecorded["input"],
+        messageAdmission: UserInputRecorded["messageAdmission"],
+      ) {
+        if (Schema.is(FrameworkMessage)(messageAdmission))
+          return yield* Schema.encodeEffect(Schema.fromJsonString(FrameworkMessage))(
+            messageAdmission,
           ).pipe(
-            Effect.mapError((cause) =>
-              AgentInputDecodeError.make({
-                message: cause.message,
-              }),
+            Effect.mapError(() =>
+              AgentInputError.make({ message: "Invalid worker completion message" }),
             ),
           );
+        const inputPrompt = agent.definition.inputPrompt;
 
-          return yield* renderInputPrompt(inputPrompt, decodedInput, encodedInput);
-        });
+        if (inputPrompt === undefined) {
+          return yield* renderInputPrompt(undefined, encodedInput, encodedInput);
+        }
+
+        const decodedInput = yield* Schema.decodeEffect(agent.definition.input)(encodedInput).pipe(
+          Effect.mapError((cause) =>
+            AgentInputDecodeError.make({
+              message: cause.message,
+            }),
+          ),
+        );
+
+        return yield* renderInputPrompt(inputPrompt, decodedInput, encodedInput);
+      });
 
       // Claims are authority, wakes are hints. A cancelled waiter retains every claim
       // for the seam drain; it never appends input while an old response can still commit.
@@ -6892,7 +6880,9 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
                 : { messageAdmission: snapshot.submission.messageAdmission }),
             };
 
-            const rendered = yield* Effect.result(renderJoinedInput(input));
+            const rendered = yield* Effect.result(
+              renderJoinedInput(input.input, input.messageAdmission),
+            );
 
             if (Result.isFailure(rendered)) {
               // A rejected prompt and its suffix retain their own Runs in queue order.
@@ -6932,118 +6922,117 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
         Agent.DefinitionRequirements<(typeof agent)["definition"]>
       > = {
         awaitJoin,
-        drain: (policy) =>
-          Effect.gen(function* () {
-            const joinedInputs = yield* recordHalt(
-              Effect.gen(function* () {
-                const limit = policy === "one" ? 1 : MAX_JOIN_DRAIN;
+        drain: Effect.fnUntraced(function* (policy) {
+          const joinedInputs = yield* recordHalt(
+            Effect.gen(function* () {
+              const limit = policy === "one" ? 1 : MAX_JOIN_DRAIN;
 
-                const joinedInputs: Array<
-                  Pick<UserInputRecorded, "input" | "messageAdmission"> & {
-                    readonly rendered?: Prompt.RawInput;
-                  }
-                > = [];
+              const joinedInputs: Array<
+                Pick<UserInputRecorded, "input" | "messageAdmission"> & {
+                  readonly rendered?: Prompt.RawInput;
+                }
+              > = [];
 
-                if (joinBacklog === undefined) {
-                  const hostSnapshot = yield* ledger.loadRecoverySnapshot(
-                    RecoverySnapshotRequest.make({ submissionId }),
-                  );
+              if (joinBacklog === undefined) {
+                const hostSnapshot = yield* ledger.loadRecoverySnapshot(
+                  RecoverySnapshotRequest.make({ submissionId }),
+                );
 
-                  joinBacklog = hostSnapshot.joins;
+                joinBacklog = hostSnapshot.joins;
+              }
+              // These inputs were already consumed by an earlier attempt. Restore the
+              // entire uncovered prompt; only fresh claims are subject to the drain bound.
+              for (const join of joinBacklog) {
+                const joinId = join.submissionId;
+
+                if (deliveredJoinInputs.has(joinId)) continue;
+                if (join.state !== "joining" && join.state !== "joined") continue;
+                const existing = joinedInputEnvelopes.get(joinId);
+
+                if (existing === undefined) continue;
+                if (join.state === "joining") {
+                  // Canonical input without its joined marker (crash between the append and
+                  // `markJoined`): repair the marker from history before reattaching.
+                  yield* session.markJoined(joinId, {
+                    recordId: existing.record.recordId,
+                    sequence: existing.sequence,
+                  });
                 }
-                // These inputs were already consumed by an earlier attempt. Restore the
-                // entire uncovered prompt; only fresh claims are subject to the drain bound.
-                for (const join of joinBacklog) {
-                  const joinId = join.submissionId;
-
-                  if (deliveredJoinInputs.has(joinId)) continue;
-                  if (join.state !== "joining" && join.state !== "joined") continue;
-                  const existing = joinedInputEnvelopes.get(joinId);
-
-                  if (existing === undefined) continue;
-                  if (join.state === "joining") {
-                    // Canonical input without its joined marker (crash between the append and
-                    // `markJoined`): repair the marker from history before reattaching.
-                    yield* session.markJoined(joinId, {
-                      recordId: existing.record.recordId,
-                      sequence: existing.sequence,
-                    });
-                  }
-                  deliveredJoinInputs.add(joinId);
-                  if (
-                    lastHostResponseSequence !== undefined &&
-                    lastHostResponseSequence > existing.sequence
-                  ) {
-                    continue;
-                  }
-                  const payload = existing.record.payload;
-
-                  if (payload._tag !== "UserInputRecorded") continue;
-                  joinedInputs.push(payload);
+                deliveredJoinInputs.add(joinId);
+                if (
+                  lastHostResponseSequence !== undefined &&
+                  lastHostResponseSequence > existing.sequence
+                ) {
+                  continue;
                 }
-                const claims = yield* prepareInputs(limit);
-
-                pendingJoinClaims.splice(0, claims.length);
-                for (const { claim, input: payload, rendered } of claims) {
-                  const recordId = submissionInputRecordId(claim.submissionId);
-                  let sequence: CanonicalSequence;
-                  const existing = joinedInputEnvelopes.get(claim.submissionId);
-
-                  if (existing !== undefined) {
-                    // Defensive reattach: the exact record is already canonical, so only the
-                    // marker and the delivery remain (DUR-016 — never a duplicate append).
-                    sequence = existing.sequence;
-                  } else {
-                    const envelope = yield* makeEnvelope(
-                      recordId,
-                      UserInputRecorded.make({
-                        submissionId: claim.submissionId,
-                        kind: "steering",
-                        runId,
-                        input: claim.inputPayload,
-                        ...(payload.messageAdmission === undefined
-                          ? {}
-                          : { messageAdmission: payload.messageAdmission }),
-                      }),
-                    );
+                const payload = existing.record.payload;
 
-                    const result = yield* appendBatch(
-                      ctx,
-                      CanonicalBatch.make({
-                        batchId: submissionInputBatchId(claim.submissionId),
-                        producerId: config.producerId,
-                        records: [envelope],
-                      }),
-                    );
+                if (payload._tag !== "UserInputRecorded") continue;
+                joinedInputs.push(payload);
+              }
+              const claims = yield* prepareInputs(limit);
+
+              pendingJoinClaims.splice(0, claims.length);
+              for (const { claim, input: payload, rendered } of claims) {
+                const recordId = submissionInputRecordId(claim.submissionId);
+                let sequence: CanonicalSequence;
+                const existing = joinedInputEnvelopes.get(claim.submissionId);
+
+                if (existing !== undefined) {
+                  // Defensive reattach: the exact record is already canonical, so only the
+                  // marker and the delivery remain (DUR-016 — never a duplicate append).
+                  sequence = existing.sequence;
+                } else {
+                  const envelope = yield* makeEnvelope(
+                    recordId,
+                    UserInputRecorded.make({
+                      submissionId: claim.submissionId,
+                      kind: "steering",
+                      runId,
+                      input: claim.inputPayload,
+                      ...(payload.messageAdmission === undefined
+                        ? {}
+                        : { messageAdmission: payload.messageAdmission }),
+                    }),
+                  );
 
-                    sequence = result.firstSequence;
-                    knownIds.add(recordId);
-                    yield* hit("join:after-canonical-append");
-                  }
-                  yield* session.markJoined(claim.submissionId, { recordId, sequence });
-                  deliveredJoinInputs.add(claim.submissionId);
-                  joinedInputs.push({
-                    ...payload,
-                    rendered,
-                  });
+                  const result = yield* appendBatch(
+                    ctx,
+                    CanonicalBatch.make({
+                      batchId: submissionInputBatchId(claim.submissionId),
+                      producerId: config.producerId,
+                      records: [envelope],
+                    }),
+                  );
+
+                  sequence = result.firstSequence;
+                  knownIds.add(recordId);
+                  yield* hit("join:after-canonical-append");
                 }
+                yield* session.markJoined(claim.submissionId, { recordId, sequence });
+                deliveredJoinInputs.add(claim.submissionId);
+                joinedInputs.push({
+                  ...payload,
+                  rendered,
+                });
+              }
 
-                return joinedInputs;
-              }),
-            );
+              return joinedInputs;
+            }),
+          );
 
-            return yield* Effect.forEach(joinedInputs, (joinedInput) =>
-              (joinedInput.rendered === undefined
-                ? renderJoinedInput(joinedInput)
-                : Effect.succeed(joinedInput.rendered)
-              ).pipe(
-                Effect.map((input): RunInputCommand => ({
-                  kind: "steering",
-                  input,
-                })),
-              ),
-            );
-          }),
+          return yield* Effect.forEach(joinedInputs, (joinedInput) =>
+            (joinedInput.rendered === undefined
+              ? renderJoinedInput(joinedInput.input, joinedInput.messageAdmission)
+              : Effect.succeed(joinedInput.rendered)
+            ).pipe(
+              Effect.map((input): RunInputCommand => ({
+                kind: "steering",
+                input,
+              })),
+            ),
+          );
+        }),
       };
 
       /**
@@ -7726,50 +7715,49 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
               },
             }),
         ...(preparedContext === undefined ? {} : { context: preparedContext }),
-        beforeTurn: () =>
-          Effect.gen(function* () {
+        beforeTurn: Effect.fnUntraced(function* () {
+          if (
+            yieldAfter !== undefined &&
+            (yield* Clock.currentTimeMillis) >= DateTime.toEpochMillis(yieldAfter)
+          ) {
+            yield* Deferred.succeed(yieldSignal, undefined);
+
+            // The successful signal wins the outer race and closes the execution Scope;
+            // no synthetic engine RunFailed event or terminal Settlement is produced.
+            return yield* Effect.never;
+          }
+          if (submissionScheduling.yieldTo !== undefined && (yield* Ref.get(turnCounter)) > 0) {
+            const candidate = yield* recordHalt(
+              eligibleThreadHead(submission.threadId, submission.queueSequence),
+            );
+
             if (
-              yieldAfter !== undefined &&
-              (yield* Clock.currentTimeMillis) >= DateTime.toEpochMillis(yieldAfter)
+              Option.isSome(candidate) &&
+              (candidate.value.state === "ready" || candidate.value.state === "input-applied")
             ) {
-              yield* Deferred.succeed(yieldSignal, undefined);
-
-              // The successful signal wins the outer race and closes the execution Scope;
-              // no synthetic engine RunFailed event or terminal Settlement is produced.
-              return yield* Effect.never;
-            }
-            if (submissionScheduling.yieldTo !== undefined && (yield* Ref.get(turnCounter)) > 0) {
-              const candidate = yield* recordHalt(
-                eligibleThreadHead(submission.threadId, submission.queueSequence),
+              const next = yield* recordHalt(
+                ledger.lookup(
+                  SubmissionLookupById.make({
+                    submissionId: candidate.value.submissionId,
+                  }),
+                ),
               );
 
               if (
-                Option.isSome(candidate) &&
-                (candidate.value.state === "ready" || candidate.value.state === "input-applied")
+                Option.isSome(next) &&
+                next.value.agentId === submission.agentId &&
+                (next.value.state === "ready" || next.value.state === "input-applied") &&
+                (yield* recordHalt(
+                  submissionScheduling.yieldTo({ active: submission, next: next.value }),
+                ))
               ) {
-                const next = yield* recordHalt(
-                  ledger.lookup(
-                    SubmissionLookupById.make({
-                      submissionId: candidate.value.submissionId,
-                    }),
-                  ),
-                );
+                yield* Deferred.succeed(yieldSignal, next.value.submissionId);
 
-                if (
-                  Option.isSome(next) &&
-                  next.value.agentId === submission.agentId &&
-                  (next.value.state === "ready" || next.value.state === "input-applied") &&
-                  (yield* recordHalt(
-                    submissionScheduling.yieldTo({ active: submission, next: next.value }),
-                  ))
-                ) {
-                  yield* Deferred.succeed(yieldSignal, next.value.submissionId);
-
-                  return yield* Effect.never;
-                }
+                return yield* Effect.never;
               }
             }
-          }),
+          }
+        }),
         ...(runContextPreparation.transientContext === undefined
           ? {}
           : { transientContext: runContextPreparation.transientContext }),
@@ -7844,35 +7832,39 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
               stagedUnobservedCalls.set(turn, (stagedUnobservedCalls.get(turn) ?? 0) + 1);
             }),
         }),
-        Effect.provide(ThreadHistory.layer),
-        Effect.provideService(SubagentHost.forTool, (source) =>
-          source.threadId !== submission.threadId ||
-          source.agentId !== submission.agentId ||
-          source.runId !== runId
-            ? SubagentHost.unavailable
-            : workerRuntime.facet(
-                {
-                  source,
-                  policy: agent.definition.policy,
-                  depth: delegationDepth,
-                  ...(inheritedGrant === undefined ? {} : { grant: inheritedGrant }),
-                },
-                submission.principal,
-                submission.submissionId,
-              ),
-        ),
-        Effect.provideService(MessagingHost.forTool, (source) =>
-          source.threadId !== submission.threadId ||
-          source.agentId !== submission.agentId ||
-          source.runId !== runId
-            ? MessagingHost.unavailable
-            : messagingRuntime.forTool(source, submission.principal),
+        (body) =>
+          body.pipe(
+            Effect.provideServiceEffect(ThreadHistory, ThreadHistory.makeFromStore),
+            Effect.provideServiceEffect(ConversationStore, makeMemoryStore),
+            Effect.scoped,
+          ),
+        Effect.provideContext(
+          runServices.pipe(
+            Context.add(SubagentHost.forTool, (source) =>
+              source.threadId !== submission.threadId ||
+              source.agentId !== submission.agentId ||
+              source.runId !== runId
+                ? SubagentHost.unavailable
+                : workerRuntime.facet(
+                    {
+                      source,
+                      policy: agent.definition.policy,
+                      depth: delegationDepth,
+                      ...(inheritedGrant === undefined ? {} : { grant: inheritedGrant }),
+                    },
+                    submission.principal,
+                    submission.submissionId,
+                  ),
+            ),
+            Context.add(MessagingHost.forTool, (source) =>
+              source.threadId !== submission.threadId ||
+              source.agentId !== submission.agentId ||
+              source.runId !== runId
+                ? MessagingHost.unavailable
+                : messagingRuntime.forTool(source, submission.principal),
+            ),
+          ),
         ),
-        Effect.provideService(CurrentToolFailureObserver, toolFailureObserver),
-        Effect.provideService(RunToolVisibility, runToolVisibility),
-        Effect.provideService(RunToolScheduling, runToolScheduling),
-        Effect.provideService(ContextCompactor, compactor),
-        Effect.provideService(RunContextPreparation, runContextPreparation),
         Effect.andThen(checkpoint),
         // A wrapped Tool/approval failure cannot outrank retained infrastructure authority.
         // Preserve independent defects, interruptions and already-marked coordinator failures.
@@ -7919,21 +7911,20 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
         }),
       );
 
-      const execution = Effect.raceFirst(consume, abortWatcher);
-
-      const raced = (
-        yieldAfter === undefined && submissionScheduling.yieldTo === undefined
-          ? execution
-          : Effect.raceFirst(
-              execution,
+      const raced = Effect.raceAllFirst([
+        consume,
+        abortWatcher,
+        ...(yieldAfter === undefined && submissionScheduling.yieldTo === undefined
+          ? []
+          : [
               Deferred.await(yieldSignal).pipe(
                 Effect.map((nextSubmissionId) => ({
                   _tag: "yielded" as const,
                   ...(nextSubmissionId === undefined ? {} : { nextSubmissionId }),
                 })),
               ),
-            )
-      ).pipe(Effect.provideService(IdGenerator, idGenerator));
+            ]),
+      ]).pipe(Effect.provideService(IdGenerator, idGenerator));
 
       const result = yield* raced.pipe(
         Effect.catchCauseFilter(
@@ -8112,7 +8103,8 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       };
 
       return completed;
-    });
+    },
+  );
 
   /**
    * One ownership period over the claimed lane head. The step order mirrors the pure recovery
@@ -8121,53 +8113,51 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
    * (Unknown Outcomes, or a durable approval suspension) — no settlement occurs and the
    * obligation stays owed.
    */
-  const runAttempt = <
-    InputSchema extends Schema.Top,
-    OutputSchema extends Schema.Top,
-    Instructions,
-    Tools extends Record<string, Tool.Any>,
-    Provider,
-    ModelProvides,
-    ModelRequires,
-    InstructionError = InstructionErrorOf<Instructions, InputSchema["Type"]>,
-    InstructionRequirements = InstructionRequirementsOf<Instructions, InputSchema["Type"]>,
-    RunDispositionValue extends
-      | RunDispositionDeclaration<OutputSchema["Type"], Schema.Top>
-      | undefined = undefined,
-    InputPromptValue extends InputPromptSource<InputSchema["Type"], unknown, unknown> | undefined =
-      undefined,
-    UpdatesSchema extends Schema.Top | undefined = undefined,
-  >(
-    registeredAgent: RuntimeBinding<
-      InputSchema,
-      OutputSchema,
+  const runAttempt = Effect.fnUntraced(
+    function* <
+      InputSchema extends Schema.Top,
+      OutputSchema extends Schema.Top,
       Instructions,
-      Tools,
+      Tools extends Record<string, Tool.Any>,
       Provider,
       ModelProvides,
       ModelRequires,
-      InstructionError,
-      InstructionRequirements,
-      RunDispositionValue,
-      InputPromptValue,
-      UpdatesSchema
-    >,
-    session: RunStorageSession,
-    resumeAfterRetention: () => void,
-    onHandoff: (nextSubmissionId: SubmissionId) => void,
-    yieldAfter?: DateTime.Utc,
-  ) =>
-    Effect.gen(function* () {
+      InstructionError = InstructionErrorOf<Instructions, InputSchema["Type"]>,
+      InstructionRequirements = InstructionRequirementsOf<Instructions, InputSchema["Type"]>,
+      RunDispositionValue extends
+        | RunDispositionDeclaration<OutputSchema["Type"], Schema.Top>
+        | undefined = undefined,
+      InputPromptValue extends
+        | InputPromptSource<InputSchema["Type"], unknown, unknown>
+        | undefined = undefined,
+      UpdatesSchema extends Schema.Top | undefined = undefined,
+    >(
+      registeredAgent: RuntimeBinding<
+        InputSchema,
+        OutputSchema,
+        Instructions,
+        Tools,
+        Provider,
+        ModelProvides,
+        ModelRequires,
+        InstructionError,
+        InstructionRequirements,
+        RunDispositionValue,
+        InputPromptValue,
+        UpdatesSchema
+      >,
+      session: RunStorageSession,
+      resumeAfterRetention: () => void,
+      onHandoff: (nextSubmissionId: SubmissionId) => void,
+      yieldAfter?: DateTime.Utc,
+      freshlyAdmitted = false,
+    ) {
       // Recheck ownership outside the disposable cache's failure recovery.
       yield* session.checkActive;
 
       const checkpointPrompt = yield* promptHistory
         .take({ threadId: session.threadId })
-        .pipe(
-          Effect.provideService(ThreadStore, store),
-          Effect.provideService(ThreadReader, reader),
-          Effect.provideService(Crypto.Crypto, crypto),
-        );
+        .pipe(Effect.provideService(ThreadStore, store), Effect.provideContext(journalServices));
 
       // withProgressSession exposes only progress.commit/publish. Their prepare step owns and
       // freezes each canonical fact before reaching this raw writer. Snapshot the private array
@@ -8181,7 +8171,8 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
           committedPromptSuffix = undefined;
         }),
       );
-      session = yield* withProgressSession({
+
+      const promptSession: RunStorageSession = {
         ...storageSession,
         append: (batch, executions) => {
           const suffix = committedPromptSuffix;
@@ -8216,17 +8207,117 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
             Effect.tapCause(() => Effect.sync(() => suffix.discard())),
           );
         },
-      });
+      };
+
+      session = yield* withProgressSession(promptSession);
       const { claim, threadId } = session;
       const submissionId = claim.submissionId;
 
-      const snapshot = yield* ledger.loadRecoverySnapshot(
-        RecoverySnapshotRequest.make({ submissionId }),
-      );
+      // The hint only selects this preparation. A real claim, current controls, exact
+      // evidence and checkpoint absence are verified under its owner before any reuse.
+      // No binding, instructions, model, Tool or cross-Thread operation runs in the window.
+      let prepared =
+        freshlyAdmitted && session.withInitialization !== undefined
+          ? yield* session.withInitialization(
+              Effect.gen(function* () {
+                const snapshot = yield* ledger.loadRecoverySnapshot(
+                  RecoverySnapshotRequest.make({ submissionId }),
+                );
+
+                const submission = snapshot.submission;
+
+                if (
+                  submission.state !== "ready" ||
+                  submission.workerAdmission !== undefined ||
+                  submission.messageAdmission !== undefined ||
+                  submission.parentLinkage !== undefined ||
+                  snapshot.inputApplied !== undefined ||
+                  snapshot.abortIntent !== undefined ||
+                  snapshot.approvalDecisions.length !== 0
+                )
+                  return undefined;
+                yield* ensureThreadCreated(threadId, submission.agentId, submission.agentDigests);
+                yield* session.refresh;
+                const before = (yield* session.tail).sequence;
+
+                const view = yield* recoveryView(
+                  threadId,
+                  before,
+                  [submissionId],
+                  runIdForSubmission(submissionId),
+                );
+
+                if (
+                  view.progress !== undefined ||
+                  view.context !== undefined ||
+                  view.operational.length !== 0 ||
+                  view.records.some(({ record }) => record.payload._tag !== "ThreadCreated")
+                )
+                  return undefined;
+                const progress = progressWriters.get(session);
+
+                const applyInput = applyCanonicalInput(
+                  session,
+                  submission,
+                  session,
+                  view.records,
+                  undefined,
+                );
+
+                yield* progress === undefined
+                  ? applyInput
+                  : progress
+                      .withVerifiedEmptyRun(runIdForSubmission(submissionId), before, applyInput)
+                      .pipe(Effect.provideService(CurrentRunWriter, promptSession));
+                const through = (yield* session.tail).sequence;
+                const added = yield* selectedRange(threadId, [submissionId], through, before);
+                const records = [...view.records, ...added];
+
+                const accepted = progressWriters
+                  .get(session)
+                  ?.acceptedCheckpoint(runIdForSubmission(submissionId));
+
+                if (
+                  accepted === undefined ||
+                  accepted.throughSequence !== through ||
+                  accepted.progress.runId !== runIdForSubmission(submissionId) ||
+                  accepted.progress.submissionId !== submissionId
+                )
+                  return undefined;
+
+                const start = yield* makeRunStart(
+                  submission,
+                  Duration.toMillis(registeredAgent.definition.policy.maxDuration),
+                  records,
+                  view.operational,
+                ).pipe(Effect.provideService(CurrentRunWriter, session));
+
+                return {
+                  snapshot,
+                  through,
+                  view: {
+                    ...view,
+                    records,
+                    progress: accepted.progress,
+                    progressThrough: accepted.throughSequence,
+                    operational: accepted.operational,
+                  },
+                  start,
+                };
+              }),
+            )
+          : undefined;
+
+      const preparedInput = prepared !== undefined;
+
+      const snapshot =
+        prepared?.snapshot ??
+        (yield* ledger.loadRecoverySnapshot(RecoverySnapshotRequest.make({ submissionId })));
 
       const submission = snapshot.submission;
 
-      yield* ensureThreadCreated(threadId, submission.agentId, submission.agentDigests);
+      if (prepared === undefined)
+        yield* ensureThreadCreated(threadId, submission.agentId, submission.agentDigests);
       if (submission.workerAdmission?.origin.reporting?.mode === "standard")
         yield* updateRuntime.repairRun(threadId, submissionId);
       if (submission.workerAdmission !== undefined) {
@@ -8241,18 +8332,20 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       if (submission.state === "admitted") {
         yield* ledger.markReady(MarkReadyRequest.make({ submissionId }));
       }
-      yield* session.refresh;
+      if (prepared === undefined) yield* session.refresh;
       const ctx: AttemptAppendContext = session;
-      let controlThrough = (yield* session.tail).sequence;
+      let controlThrough = prepared?.through ?? (yield* session.tail).sequence;
 
       const initialThrough = controlThrough;
 
-      const initialView = yield* recoveryView(
-        threadId,
-        initialThrough,
-        [submissionId],
-        runIdForSubmission(submissionId),
-      );
+      const initialView =
+        prepared?.view ??
+        (yield* recoveryView(
+          threadId,
+          initialThrough,
+          [submissionId],
+          runIdForSubmission(submissionId),
+        ));
 
       let journalMetadata: ReturnType<typeof makeJournalMetadata> | undefined;
 
@@ -8273,9 +8366,8 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
         return metadata;
       };
 
-      let records: ReadonlyArray<CanonicalRecordEnvelope> = yield* Stream.runCollect(
-        initialView.canonical.pipe(Stream.filter(collectControl)),
-      );
+      let records: ReadonlyArray<CanonicalRecordEnvelope> =
+        initialView.records.filter(collectControl);
 
       // The append-only prefix remains valid for this Attempt. Retain only this Run's control
       // evidence and validate each newly visible suffix against its own captured tail.
@@ -8376,13 +8468,17 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
           ),
         );
       }
-      yield* applyCanonicalInput(ctx, submission, session, records, snapshot.inputApplied);
+      if (prepared === undefined)
+        yield* applyCanonicalInput(ctx, submission, session, records, snapshot.inputApplied);
 
-      const start = yield* makeRunStart(
-        submission,
-        Duration.toMillis(agent.definition.policy.maxDuration),
-        yield* refreshControl(),
-      ).pipe(Effect.provideService(CurrentRunWriter, ctx));
+      const start =
+        prepared?.start ??
+        (yield* makeRunStart(
+          submission,
+          Duration.toMillis(agent.definition.policy.maxDuration),
+          yield* refreshControl(),
+          initialView.operational,
+        ).pipe(Effect.provideService(CurrentRunWriter, ctx)));
 
       const savedRunTiming = start.timing;
 
@@ -8404,8 +8500,11 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
             };
 
       let expiredChildObligation = false;
+      let preparedControl = prepared !== undefined;
 
       if ((yield* Clock.currentTimeMillis) >= DateTime.toEpochMillis(runTiming.deadline)) {
+        prepared = undefined;
+        preparedControl = false;
         yield* commitStart;
         yield* reconcileRetainedChildren(ctx, submission, session);
         expiredChildObligation = yield* completeJoinedReleases(submission);
@@ -8413,7 +8512,9 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
 
       // Recheck after duration interruption too: that Attempt may have declared new ordinary calls.
       const ordinaryCallsResolved = Effect.gen(function* () {
-        const reconciliationRecords = yield* refreshControl();
+        const reconciliationRecords = preparedControl ? records : yield* refreshControl();
+
+        preparedControl = false;
 
         const reconciliationEvidence = yield* evidenceFor(
           reconciliationRecords,
@@ -8463,7 +8564,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       if (!expiredChildObligation && !(yield* ordinaryCallsResolved))
         return Option.none<Settlement>();
 
-      const continuationRecords = yield* refreshControl();
+      const continuationRecords = prepared === undefined ? yield* refreshControl() : records;
 
       const continuation = yield* pendingToolBatchFor(
         continuationRecords,
@@ -8603,29 +8704,35 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
 
       const lineage: AttemptLineage = {
         attemptId: claim.attemptId,
-        inputWasRecorded: evidence.inputRecorded,
+        inputWasRecorded: !preparedInput && evidence.inputRecorded,
       };
 
       let approvalDecisionIntents = snapshot.approvalDecisions;
 
       while (true) {
-        yield* session.refresh;
+        const initialization = prepared;
+
+        prepared = undefined;
+        if (initialization === undefined) yield* session.refresh;
         const tail = yield* session.tail;
 
-        const currentRecords = yield* refreshControl(tail.sequence);
+        const currentRecords =
+          initialization === undefined ? yield* refreshControl(tail.sequence) : records;
 
-        const view = yield* recoveryView(
-          threadId,
-          tail.sequence,
-          [submissionId],
-          runIdForSubmission(submissionId),
-          currentRecords,
-        );
+        const view =
+          initialization?.view ??
+          (yield* recoveryView(
+            threadId,
+            tail.sequence,
+            [submissionId],
+            runIdForSubmission(submissionId),
+            currentRecords,
+          ));
 
         let canonical: Stream.Stream<
           JournalRecordEnvelope,
           ThreadStoreError | ThreadNotMaterialized | RunJournalError
-        > = view.canonical;
+        > = Stream.fromIterable(view.records);
 
         let initialJournal: InitialJournalSource | undefined;
 
@@ -8885,7 +8992,9 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
 
         return Option.some(settlement);
       }
-    }).pipe(Effect.scoped);
+    },
+    (effect) => effect.pipe(Effect.scoped),
+  );
 
   /** A missing current binding leaves both roots and children owed, with their claims released. */
   type CapturedWorkerBinding = Effect.Success<ReturnType<typeof makeLegacyWorkerBinding>>;
@@ -8938,6 +9047,9 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
           const session = claimed.value;
           const { claim } = session;
 
+          const freshlyAdmitted = unclaimedAdmissions.get(claim.submissionId) === threadId;
+
+          unclaimedAdmissions.delete(claim.submissionId);
           firstClaimedSubmissionId ??= claim.submissionId;
 
           const attributes = {
@@ -9022,6 +9134,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
                   });
                 },
                 options?.yieldAfter,
+                freshlyAdmitted,
               ),
             threadId,
             claim,
@@ -9094,7 +9207,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       }
     }).pipe((body) => withProcessing(threadId, body));
 
-  const processThreadImpl = <
+  const processThreadImpl = Effect.fnUntraced(function* <
     InputSchema extends Schema.Top,
     OutputSchema extends Schema.Top,
     Instructions,
@@ -9126,26 +9239,25 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       UpdatesSchema
     >,
     threadId: ThreadId,
-  ) =>
-    Effect.gen(function* () {
-      // The legacy single-binding worker is a singleton resolver (plan §1.7): identity-exact —
-      // a claimed head with a different Agent never runs against this binding (the latent P4
-      // gap) — and digest-transparent, because this call site registers no digest authority.
-      const binding = yield* makeLegacyWorkerBinding(agent);
-
-      return yield* drainThread(
-        (submission) =>
-          submission.agentId === binding.agentId
-            ? Effect.succeed(binding)
-            : Effect.fail(
-                BindingUnavailable.make({
-                  agentId: submission.agentId,
-                  message: `This worker is bound to Agent ${binding.agentId}; the claimed head belongs to Agent ${submission.agentId} (SUB-023)`,
-                }),
-              ),
-        threadId,
-      );
-    });
+  ) {
+    // The legacy single-binding worker is a singleton resolver (plan §1.7): identity-exact —
+    // a claimed head with a different Agent never runs against this binding (the latent P4
+    // gap) — and digest-transparent, because this call site registers no digest authority.
+    const binding = yield* makeLegacyWorkerBinding(agent);
+
+    return yield* drainThread(
+      (submission) =>
+        submission.agentId === binding.agentId
+          ? Effect.succeed(binding)
+          : Effect.fail(
+              BindingUnavailable.make({
+                agentId: submission.agentId,
+                message: `This worker is bound to Agent ${binding.agentId}; the claimed head belongs to Agent ${submission.agentId} (SUB-023)`,
+              }),
+            ),
+      threadId,
+    );
+  });
 
   const processThreadResolvedImpl = (
     threadId: ThreadId,
@@ -10057,9 +10169,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       const hostId = snapshot.hostSubmissionId;
       const hostView = yield* recoveryView(submission.threadId, history.throughSequence, [hostId]);
 
-      const hostRecords = yield* Stream.runCollect(
-        hostView.canonical.pipe(Stream.filter(controlRecords([hostId]))),
-      );
+      const hostRecords = hostView.records.filter(controlRecords([hostId]));
 
       const merged = new Map(history.records.map((entry) => [entry.sequence, entry]));
 
@@ -10403,6 +10513,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
   const recoverOwnedWork = Effect.fnUntraced(function* (
     request: WorkRecoveryRequest,
     recoveredAdmissions = new Map<SubmissionId, RecoveryReport>(),
+    deferUnclaimedAdmissions = false,
   ): Effect.fn.Return<WorkRecoveryReport, DurableWorkerFailure> {
     const { threadId, work: entry } = yield* Schema.decodeEffect(WorkRecoveryRequest)(request).pipe(
       Effect.mapError((cause) =>
@@ -10456,6 +10567,21 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
       const original = yield* lookupKnownSubmission("recover work", owner.submissionId);
 
       if (original.threadId !== threadId) return yield* invalid();
+      if (
+        deferUnclaimedAdmissions &&
+        unclaimedAdmissions.get(owner.submissionId) === threadId &&
+        original.state === "ready" &&
+        !storageOwner.hasOwner(threadId) &&
+        (yield* ledger.readAbortIntent(
+          AbortIntentRequest.make({ submissionId: owner.submissionId }),
+        )) === undefined
+      ) {
+        // The worker's first scoped claim performs the authoritative control/journal
+        // read. This hint skips only a redundant pre-claim recovery traversal; it grants
+        // no claim, synthesizes no decision, and supplies no model-visible facts.
+        return report("deferred");
+      }
+      unclaimedAdmissions.delete(owner.submissionId);
       const submission = yield* recoverAdmission(owner.submissionId);
 
       return report(submission.disposition, submission);
@@ -10934,6 +11060,29 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
 
       const outcome = yield* isolateRecovery(
         Effect.gen(function* () {
+          // This incarnation admitted the sole untouched root. The native snapshot proves
+          // there is no old owner to repair; claim and live controls still run normally.
+          // New source mutations retain their dirty generation for the next maintenance scan.
+          if (
+            workCursor === undefined &&
+            options?.deferUnclaimedAdmissions === true &&
+            workDiscovery.isOnlyFreshAdmission !== undefined &&
+            !storageOwner.hasOwner(threadId)
+          ) {
+            const fresh = [...unclaimedAdmissions].find(([, owner]) => owner === threadId);
+
+            if (
+              fresh !== undefined &&
+              (yield* workDiscovery.isOnlyFreshAdmission({
+                threadId,
+                submissionId: fresh[0],
+              }))
+            ) {
+              complete = true;
+
+              return;
+            }
+          }
           for (
             let pages = 0;
             pages < MAX_RECOVERY_PAGES && workReports.length < MAX_RECOVERY_WORK_ITEMS;
@@ -10949,7 +11098,11 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
 
             phase = "recovery";
             for (const work of workPage.entries) {
-              const repaired = yield* recoverOwnedWork({ threadId, work }, recoveredAdmissions);
+              const repaired = yield* recoverOwnedWork(
+                { threadId, work },
+                recoveredAdmissions,
+                options?.deferUnclaimedAdmissions === true,
+              );
 
               workReports.push(repaired);
               if (
@@ -11173,7 +11326,7 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
         queueSequence: admitted.queueSequence,
       });
     }
-    const admitted = yield* ledger.admit(request);
+    const admitted = yield* ledger.admit(request, { readyIfInitialized: true });
 
     yield* hit("submit:after-admit");
 
@@ -11189,10 +11342,24 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     if (admitted.replayed && admitted.state !== "admitted") {
       return receipt;
     }
-    yield* materializeThread(options.threadId);
-    yield* ensureThreadCreated(options.threadId, agent.definition.id, options.definitions);
-    yield* hit("submit:after-materialize");
-    yield* ledger.markReady(MarkReadyRequest.make({ submissionId: admitted.submissionId }));
+    if (admitted.state === "admitted") {
+      yield* materializeThread(options.threadId);
+      yield* ensureThreadCreated(options.threadId, agent.definition.id, options.definitions);
+      yield* hit("submit:after-materialize");
+      yield* ledger.markReady(MarkReadyRequest.make({ submissionId: admitted.submissionId }));
+    }
+    if (
+      !admitted.replayed &&
+      messageAdmission === undefined &&
+      options.workerAdmission === undefined
+    ) {
+      unclaimedAdmissions.set(admitted.submissionId, options.threadId);
+      if (unclaimedAdmissions.size > 128) {
+        const oldest = unclaimedAdmissions.keys().next().value;
+
+        if (oldest !== undefined) unclaimedAdmissions.delete(oldest);
+      }
+    }
     yield* wake.notify(options.threadId);
 
     return receipt;
@@ -11248,14 +11415,8 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     }
     if (snapshot.value.state !== "settled") return Option.none();
 
-    // Finalization replay reads the canonical outcome without changing settledAt.
-    const settlement = yield* ledger.finalizeSettlement(
-      SettlementFinalization.make({
-        submissionId: receipt.submissionId,
-        settlementId: submissionSettlementId(receipt.submissionId),
-      }),
-    );
-
+    // Finalization replay reads the canonical outcome for adapters without finalized
+    // metadata. Native projections already retain the first settledAt and exact record.
     const canonical = yield* getRecord({
       threadId: receipt.threadId,
       recordId: submissionSettlementRecordId(receipt.submissionId),
@@ -11278,6 +11439,40 @@ const make = Effect.fnUntraced(function* (bindings: ReadonlyArray<ResolvedBindin
     }
 
     const record = yield* settlementPayloadFromRecord(canonical.value.record, receipt.submissionId);
+    const finalized = snapshot.value;
+
+    const retainedFinalization =
+      finalized.settledAt !== undefined &&
+      finalized.settledRecordId !== undefined &&
+      finalized.settledOutcome !== undefined;
+
+    if (
+      retainedFinalization &&
+      (finalized.settledRecordId !== canonical.value.record.recordId ||
+        finalized.settledOutcome !== record.outcome ||
+        canonical.value.batchId !== submissionSettlementBatchId(receipt.submissionId))
+    ) {
+      return yield* LedgerError.make({
+        operation: "awaitSettlement",
+        message: "Settled projection disagrees with its canonical Settlement",
+      });
+    }
+
+    const settlement = retainedFinalization
+      ? Settlement.make({
+          submissionId: receipt.submissionId,
+          settlementId: record.settlementId,
+          receiptId: record.receiptId,
+          outcome: record.outcome,
+          ...(record.outcome === "failed" ? { failure: record.result } : {}),
+          settledAt: finalized.settledAt,
+        })
+      : yield* ledger.finalizeSettlement(
+          SettlementFinalization.make({
+            submissionId: receipt.submissionId,
+            settlementId: submissionSettlementId(receipt.submissionId),
+          }),
+        );
 
     if (
       record.receiptId !== receipt.receiptId ||