@yielded/agent 0.1.0-beta.173 → 0.1.0-beta.175

package/src/durable/RunContinuation.ts

@@ -1,12 +1,12 @@
-import { Context, Crypto, DateTime, Effect, Option, Schema, Semaphore, Stream } from "effect";
+import { Context, DateTime, Effect, Option, Result, Schema, Semaphore, Stream } from "effect";
 import { Prompt } from "effect/ai";
 
 import { AgentPersistenceCapacityError } from "../core/AgentError.ts";
 import type { RunId, SubmissionId, ThreadId } from "../core/Identifiers.ts";
 import { ToolCallId } from "../core/Identifiers.ts";
 import { utf8ByteLength } from "../core/internal/utf8.ts";
-import { summarizeModelUsage } from "../core/Usage.ts";
-import { reference, resolveEvidence } from "./internal/evidence.ts";
+import { resolveEvidence } from "./internal/evidence.ts";
+import { continuationUsage } from "./internal/usage-totals.ts";
 export { reference, resolveEvidence } from "./internal/evidence.ts";
 import {
   captureRecord,
@@ -119,56 +119,124 @@ const isExecutionProgressRecord = (
   record.payload._tag === "RunContinuation";
 
 const decodeResponsePrompt = Schema.decodeUnknownEffect(Prompt.Prompt);
+// The decoded Prompt stays private. Progress and capacity are recomputed on every invocation.
+const responsePrompts = new WeakMap<ModelResponseRecorded, Prompt.Prompt>();
 
-const validateBatchHeader = Schema.decodeSync(
+/** Cache eligibility only: freezing does not make accessors or custom iterators immutable. */
+const isFrozenJsonData = (input: Schema.Json): boolean => {
+  const pending: Array<unknown> = [input];
+  const seen = new WeakSet<object>();
+
+  while (pending.length > 0) {
+    const value = pending.pop();
+
+    if (value === null) continue;
+    if (typeof value !== "object") {
+      if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+        return false;
+      continue;
+    }
+    if (seen.has(value)) continue;
+    seen.add(value);
+    const prototype = Object.getPrototypeOf(value);
+
+    if (
+      !Object.isFrozen(value) ||
+      (prototype !== null && prototype !== Object.prototype && prototype !== Array.prototype)
+    )
+      return false;
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== "string") return false;
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+
+      if (descriptor === undefined || !("value" in descriptor)) return false;
+      pending.push(descriptor.value);
+    }
+  }
+
+  return true;
+};
+
+const validateBatchShape = Schema.decodeUnknownSync(
   Schema.Struct({
     batchId: CanonicalBatch.fields.batchId,
     producerId: CanonicalBatch.fields.producerId,
+    records: Schema.NonEmptyArray(Schema.Unknown).check(Schema.isMaxLength(256)),
   }),
 );
 
-const validateBatchCount = Schema.decodeUnknownSync(
-  Schema.NonEmptyArray(Schema.Unknown).check(Schema.isMaxLength(256)),
-);
-
 const ContinuationBytes = Schema.Struct({
   turnBytes: RunContinuation.fields.turnBytes,
   terminalBytes: RunContinuation.fields.terminalBytes,
 });
 
+const decodeExecutionFrontier = Schema.decodeUnknownEffect(
+  Schema.Struct({
+    canonicalRecords: ExecutionCheckpoint.fields.canonicalRecords,
+    throughSequence: ExecutionCheckpoint.fields.throughSequence,
+  }),
+);
+
 /** One private snapshot for every retry; callers cannot change facts while awaiting the gate. */
 const captureFacts = (batch: CommitBatch) =>
   Effect.try({
-    try: () => {
-      const header = validateBatchHeader(batch);
+    try: () =>
+      Result.gen(function* () {
+        const inputs = batch.records;
+
+        const { batchId, producerId } = validateBatchShape({
+          batchId: batch.batchId,
+          producerId: batch.producerId,
+          records: inputs,
+        });
 
-      validateBatchCount(batch.records);
-      const records = batch.records.map((record) => captureRecord(record).canonical);
+        const encodings = yield* Result.all(inputs.map(captureRecord));
+        const records = encodings.map((record) => record.canonical);
 
-      return Object.freeze(
-        new CanonicalBatch(
-          { ...header, records: [records[0]!, ...records.slice(1)] },
-          { disableChecks: true },
-        ),
-      );
-    },
+        return Object.freeze(
+          CanonicalBatch.make(
+            { batchId, producerId, records: [records[0]!, ...records.slice(1)] },
+            { disableChecks: true },
+          ),
+        );
+      }),
     catch: (cause) => failure("Cannot capture canonical progress facts", cause),
-  });
+  }).pipe(
+    Effect.flatMap(Effect.fromResult),
+    Effect.mapError((cause) =>
+      Schema.is(ThreadStoreError)(cause)
+        ? cause
+        : failure("Cannot capture canonical progress facts", cause),
+    ),
+  );
 
 /** Exact UTF-8 wire accounting reuses the append's privately captured Schema encoding. */
-export const canonicalRecordBytes = (record: RecordEnvelope): number =>
-  recordEncoding(record).bytes;
+export const canonicalRecordBytes = (record: RecordEnvelope): number => {
+  const encoded = recordEncoding(record);
+
+  if (Result.isFailure(encoded)) {
+    // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Public synchronous byte-accounting validation must reject malformed records before returning a number.
+    throw encoded.failure.cause ?? new RangeError(encoded.failure.message);
+  }
+
+  return encoded.success.bytes;
+};
 
 export type { ProgressAppendRecord } from "./internal/record-encoding.ts";
 
 /** Capture before acquiring the mutation owner; summaries never cross a wire boundary. */
 export const prepareProgressAppend = (
   records: ReadonlyArray<RecordEnvelope>,
-): ReadonlyArray<ProgressAppendRecord> =>
-  Object.freeze(records.map((record) => captureRecord(record).progress));
+): ReadonlyArray<ProgressAppendRecord> => {
+  const encodings = Result.all(records.map(captureRecord));
+
+  if (Result.isFailure(encodings)) {
+    // oxlint-disable-next-line effect/no-untyped-throw, effect/no-native-error -- Public synchronous progress construction must reject malformed records before acquiring a mutation owner.
+    throw encodings.failure.cause ?? new RangeError(encodings.failure.message);
+  }
 
-const factUsageCharge = (facts: ReadonlyArray<RecordEnvelope>): number =>
-  facts.reduce((bytes, record) => bytes + recordEncoding(record).progress.terminalUsageBytes, 0);
+  return Object.freeze(encodings.success.map((record) => record.progress));
+};
 
 /** These values belong to the active Run, not its permanent conversation history. */
 export const isOperationalRecord = ({ payload }: RecordEnvelope): boolean =>
@@ -643,9 +711,27 @@ const advanceFacts = Effect.fnUntraced(function* (
   let results = new Map(previous?.results);
   let childResults = new Map(previous?.childResults);
   let completionBytes = previous?.completionBytes;
+  let factBytes = 0;
+  let turn = previous?.continuation.turn ?? 1;
+  let usageCharge = 0;
+  let closingBytes = 0;
+  let closingCount = 0;
 
   for (const fact of facts) {
     const payload = fact.payload;
+    const captured = recordEncoding(fact);
+
+    if (Result.isFailure(captured))
+      return yield* failure("Cannot account canonical progress facts", captured.failure);
+    const encoded = captured.success;
+
+    factBytes += encoded.bytes;
+    if ("turn" in payload) turn = Math.max(turn, payload.turn);
+    usageCharge += encoded.progress.terminalUsageBytes;
+    if (encoded.progress.terminal) {
+      closingBytes += encoded.bytes;
+      closingCount++;
+    }
 
     switch (payload._tag) {
       case "RunStarted":
@@ -654,7 +740,7 @@ const advanceFacts = Effect.fnUntraced(function* (
       case "RunContextRecorded":
         if (savedContext !== undefined)
           return yield* failure("A Run's original context cannot be replaced");
-        savedContext = yield* reference(fact);
+        savedContext = EvidenceReference.make({ recordId: fact.recordId });
         position = "awaiting-model";
         break;
       case "ModelResponseRecorded": {
@@ -663,10 +749,27 @@ const advanceFacts = Effect.fnUntraced(function* (
         if (payload.turn !== accounting.committedTurns + 1)
           return yield* failure("Canonical Turn progress must advance once");
 
-        const messages = yield* decodeResponsePrompt(payload.messages).pipe(
-          Effect.mapError((cause) => failure("Invalid model evidence", cause)),
-        );
+        const promptInput = payload.messages;
+        const retainedPrompt = responsePrompts.get(payload);
 
+        const messages =
+          retainedPrompt ??
+          (yield* decodeResponsePrompt(promptInput).pipe(
+            Effect.mapError((cause) => failure("Invalid model evidence", cause)),
+          ));
+
+        if (retainedPrompt === undefined) {
+          const property = Object.getOwnPropertyDescriptor(payload, "messages");
+
+          if (
+            Object.isFrozen(payload) &&
+            property !== undefined &&
+            "value" in property &&
+            property.value === promptInput &&
+            isFrozenJsonData(promptInput)
+          )
+            responsePrompts.set(payload, messages);
+        }
         responsePrompt = messages;
 
         const calls = messages.content.flatMap((message) =>
@@ -678,20 +781,20 @@ const advanceFacts = Effect.fnUntraced(function* (
         const summary =
           payload.modelUsage === undefined
             ? undefined
-            : yield* summarizeModelUsage(payload.modelUsage).pipe(
+            : yield* continuationUsage(payload.modelUsage).pipe(
                 Effect.mapError((cause) => failure("Invalid usage evidence", cause)),
               );
 
         accounting.committedTurns = payload.turn;
         accounting.toolCalls += calls.length;
         accounting.modelCalls += summary?.modelCalls ?? 1;
-        accounting.inputTokens += summary?.inputTokens.total ?? payload.inputTokens ?? 0;
-        accounting.outputTokens += summary?.outputTokens.total ?? payload.outputTokens ?? 0;
+        accounting.inputTokens += summary?.inputTokens ?? payload.inputTokens ?? 0;
+        accounting.outputTokens += summary?.outputTokens ?? payload.outputTokens ?? 0;
         accounting.costMicrousd += summary?.costMicrousd ?? payload.costMicrousd ?? 0;
-        accounting.lastInputTokens = summary?.inputTokens.total ?? payload.inputTokens ?? 0;
-        accounting.lastOutputTokens = summary?.outputTokens.total ?? payload.outputTokens ?? 0;
+        accounting.lastInputTokens = summary?.inputTokens ?? payload.inputTokens ?? 0;
+        accounting.lastOutputTokens = summary?.outputTokens ?? payload.outputTokens ?? 0;
         accounting.unobservedModelCalls += payload.unobservedModelCalls ?? 0;
-        latestResponse = yield* reference(fact);
+        latestResponse = EvidenceReference.make({ recordId: fact.recordId });
         response = payload;
         results = new Map();
         childResults = new Map();
@@ -754,14 +857,14 @@ const advanceFacts = Effect.fnUntraced(function* (
         if (payload.restart !== (accounting.modelRestarts ?? 0) + 1)
           return yield* failure("Model restart progress must advance once");
 
-        const summary = yield* summarizeModelUsage(payload.modelUsage).pipe(
+        const summary = yield* continuationUsage(payload.modelUsage).pipe(
           Effect.mapError((cause) => failure("Invalid cancelled model usage", cause)),
         );
 
         accounting.modelRestarts = payload.restart;
         accounting.modelCalls += summary.modelCalls;
-        accounting.inputTokens += summary.inputTokens.total;
-        accounting.outputTokens += summary.outputTokens.total;
+        accounting.inputTokens += summary.inputTokens;
+        accounting.outputTokens += summary.outputTokens;
         accounting.costMicrousd += summary.costMicrousd;
         accounting.unobservedModelCalls += payload.unobservedModelCalls;
         break;
@@ -775,12 +878,12 @@ const advanceFacts = Effect.fnUntraced(function* (
                 ? 0
                 : utf8ByteLength(JSON.stringify(payload.runDisposition)))
             : undefined;
-        terminal = yield* reference(fact);
+        terminal = EvidenceReference.make({ recordId: fact.recordId });
         position = "settling";
         break;
       case "SubmissionSettled":
         if (payload.submissionId !== submissionId) break;
-        terminal = yield* reference(fact);
+        terminal = EvidenceReference.make({ recordId: fact.recordId });
         position = "settled";
         if (payload.usageSummary !== undefined) {
           accounting.modelCalls = payload.usageSummary.modelCalls;
@@ -802,6 +905,7 @@ const advanceFacts = Effect.fnUntraced(function* (
   ) {
     const messages =
       responsePrompt ??
+      responsePrompts.get(response) ??
       (yield* decodeResponsePrompt(response.messages).pipe(
         Effect.mapError((cause) => failure("Invalid batch evidence", cause)),
       ));
@@ -837,22 +941,13 @@ const advanceFacts = Effect.fnUntraced(function* (
   if (previous?.continuation.position === "settled") position = "settled";
   else if (previous?.continuation.position === "settling" && position !== "settled")
     position = "settling";
-  const factBytes = facts.reduce((bytes, fact) => bytes + canonicalRecordBytes(fact), 0);
-
-  const turn = facts.reduce(
-    (current, fact) => ("turn" in fact.payload ? Math.max(current, fact.payload.turn) : current),
-    previous?.continuation.turn ?? 1,
-  );
 
   const turnBase =
     (previous?.continuation.turn === turn ? previous.continuation.turnBytes : initialBytes) +
     factBytes;
 
-  const usageCharge = factUsageCharge(facts);
   const terminalUsageBytes = (previous?.continuation.terminalUsageBytes ?? 0) + usageCharge;
 
-  const closing = facts.filter(isTerminalBudgetFact);
-
   return {
     accounting,
     savedContext,
@@ -869,11 +964,9 @@ const advanceFacts = Effect.fnUntraced(function* (
     turnBase,
     usageCharge,
     terminalUsageBytes,
-    terminalBytes:
-      (previous?.continuation.terminalBytes ?? 0) +
-      closing.reduce((bytes, fact) => bytes + canonicalRecordBytes(fact), 0),
-    terminalRecords: (previous?.continuation.terminalRecords ?? 0) + closing.length,
-    closing: closing.length > 0,
+    terminalBytes: (previous?.continuation.terminalBytes ?? 0) + closingBytes,
+    terminalRecords: (previous?.continuation.terminalRecords ?? 0) + closingCount,
+    closing: closingCount > 0,
   };
 });
 
@@ -951,10 +1044,17 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
   deploymentId: DeploymentId,
 ) {
   const reader = yield* ThreadReader;
-  const crypto = yield* Crypto.Crypto;
   const gate = yield* Semaphore.make(1);
   const cached = new Map<RunId, ProgressState>();
 
+  let verifiedEmpty:
+    | {
+        readonly runId: RunId;
+        readonly through: CanonicalSequence;
+        readonly writer: CurrentRunWriter["Service"];
+      }
+    | undefined;
+
   const reservations = new Map<
     RecordId,
     {
@@ -967,16 +1067,10 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
 
   const stagedUsage = new Map<RunId, number>();
 
-  const provide = <A, E>(effect: Effect.Effect<A, E, ThreadReader | Crypto.Crypto>) =>
-    effect.pipe(
-      Effect.provideService(ThreadReader, reader),
-      Effect.provideService(Crypto.Crypto, crypto),
-    );
-
-  const loadState = Effect.fnUntraced(function* (runId: RunId, after: CanonicalSequence) {
-    const retained = cached.get(runId);
+  const provide = <A, E>(effect: Effect.Effect<A, E, ThreadReader>) =>
+    Effect.provideService(effect, ThreadReader, reader);
 
-    if (retained !== undefined) return retained;
+  const loadUncachedState = Effect.fnUntraced(function* (runId: RunId, after: CanonicalSequence) {
     const loaded = yield* provide(readContinuation(threadId, runId, after));
 
     if (Option.isNone(loaded)) return undefined;
@@ -1095,11 +1189,14 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     };
   });
 
-  const checkFutureShapes = (state: ProgressState): Effect.Effect<void, ThreadStoreError> => {
+  const checkFutureShapes = (
+    state: ProgressState,
+    cursorBytes?: number,
+  ): Effect.Effect<void, ThreadStoreError> => {
     const progress = state.continuation;
 
     if (progress.position === "settled") return Effect.void;
-    const size = canonicalRecordBytes(state.record);
+    const size = cursorBytes ?? canonicalRecordBytes(state.record);
     const textBytes = (value: string) => utf8ByteLength(JSON.stringify(value));
     const refBytes = (value: EvidenceReference) => utf8ByteLength(JSON.stringify(value));
 
@@ -1213,14 +1310,17 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     return Effect.void;
   };
 
-  const prepare = Effect.fnUntraced(function* (batch: CanonicalBatch, after: CanonicalSequence) {
+  const prepare = Effect.fnUntraced(function* (
+    batch: CanonicalBatch,
+    after: CanonicalSequence,
+    mode: "commit" | "preflight" = "commit",
+  ) {
     if (batch.records.some((record) => record.payload._tag === "RunContinuation"))
       return yield* failure("A caller cannot supply interpreter progress to the progress writer");
 
-    const ownedRecords = yield* Effect.try({
-      try: () => batch.records.map((record) => captureRecord(record).canonical),
-      catch: (cause) => failure("Cannot capture canonical progress facts", cause),
-    });
+    // Every private caller passes captureFacts' owned snapshot. Keep a mutable
+    // list for settlement accounting without capturing that snapshot a second time.
+    const ownedRecords = [...batch.records];
 
     const groups = new Map<RunId, Array<RecordEnvelope>>();
 
@@ -1234,9 +1334,19 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     }
     const executions: Array<ExecutionUpdate> = [];
     const accepted = new Map<RunId, ProgressState>();
+    let executionCount = 0;
 
     for (const [runId, facts] of groups) {
-      const previous = yield* loadState(runId, after);
+      const empty =
+        verifiedEmpty?.runId === runId &&
+        verifiedEmpty.through === after &&
+        // Settlement preparation need not have a Run writer; absence disables reuse.
+        verifiedEmpty.writer ===
+          Option.getOrUndefined(yield* Effect.serviceOption(CurrentRunWriter));
+
+      const previous = empty
+        ? undefined
+        : (cached.get(runId) ?? (yield* loadUncachedState(runId, after)));
 
       let original = facts.find(
         (record) =>
@@ -1277,7 +1387,7 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
       if (previous === undefined && original === undefined)
         return yield* failure("Run has no accepted original input");
 
-      if (previous === undefined) {
+      if (previous === undefined && !empty) {
         const settled = yield* provide(
           getRecord({
             threadId,
@@ -1337,12 +1447,17 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
 
         if (payload._tag !== "SubmissionSettled" || payload.runId !== runId) continue;
 
-        const retained = captureRecord(
-          RecordEnvelope.make({
-            ...fact,
-            payload: { ...payload, historyRecordCount: canonicalRecords },
-          }),
-        ).canonical;
+        const retained = yield* Effect.fromResult(
+          captureRecord(
+            RecordEnvelope.make({
+              ...fact,
+              payload: { ...payload, historyRecordCount: canonicalRecords },
+            }),
+          ),
+        ).pipe(
+          Effect.map((record) => record.canonical),
+          Effect.mapError((cause) => failure("Cannot capture canonical progress facts", cause)),
+        );
 
         facts[index] = retained;
         ownedRecords[ownedRecords.indexOf(fact)] = retained;
@@ -1353,9 +1468,9 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
           ? previous.continuation.originalInput
           : original === undefined
             ? yield* failure("Run progress has no original input")
-            : yield* provide(reference(original));
+            : EvidenceReference.make({ recordId: original.recordId });
 
-      const next = yield* provide(advanceFacts(previous, facts, submissionId, initialBytes));
+      const next = yield* advanceFacts(previous, facts, submissionId, initialBytes);
 
       const {
         accounting,
@@ -1391,7 +1506,7 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
         ...(savedContext === undefined ? {} : { savedContext }),
         ...(latestResponse === undefined ? {} : { latestResponse }),
         ...(terminal === undefined ? {} : { terminal }),
-        lastFact: yield* provide(reference(last)),
+        lastFact: EvidenceReference.make({ recordId: last.recordId }),
         position,
         accounting,
       }).pipe(
@@ -1451,23 +1566,63 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
       );
 
       // Every other field was checked above; byte accounting changes only these counters.
-      continuation = new RunContinuation(
+      continuation = RunContinuation.make(
         { ...continuation, ...checkedBytes },
         { disableChecks: true },
       );
 
-      const record = captureRecord(
-        new RecordEnvelope({ ...header, payload: continuation }, { disableChecks: true }),
-      ).canonical;
+      const proposedRecord = RecordEnvelope.make(
+        { ...header, payload: continuation },
+        { disableChecks: true },
+      );
 
-      if (!isExecutionProgressRecord(record))
-        return yield* failure("Captured execution has no Run continuation");
-      if (canonicalRecordBytes(record) !== turnBytes - turnBase)
-        return yield* failure("Continuation byte accounting differs from its Schema encoding");
-      if (canonicalRecordBytes(record) > MAX_RUN_CONTINUATION_BYTES)
+      const cursorBytes = turnBytes - turnBase;
+
+      if (cursorBytes > MAX_RUN_CONTINUATION_BYTES)
         return yield* capacityFailure(
           "Encoded continuation exceeds 8192 bytes including its envelope",
         );
+      executionCount++;
+      if (
+        mode === "preflight" &&
+        previous?.checkpoint !== undefined &&
+        facts.every(({ payload }) => payload._tag === "ModelResponseRecorded")
+      ) {
+        // The payload and header are validated, and operational facts are unchanged.
+        // Dispatch needs their capacity proof; only a commit needs checkpoint wire.
+        yield* decodeExecutionFrontier({
+          canonicalRecords,
+          throughSequence: after + ownedRecords.filter((fact) => !isOperationalRecord(fact)).length,
+        }).pipe(Effect.mapError((cause) => failure("Active execution exceeds its bounds", cause)));
+
+        const state: ProgressState = {
+          continuation,
+          record: proposedRecord,
+          ...(response === undefined ? {} : { response }),
+          results,
+          childResults,
+          ...(completionBytes === undefined ? {} : { completionBytes }),
+        };
+
+        yield* checkCapacity(
+          state,
+          new Set(batch.records.map(({ recordId }) => recordId)),
+          undefined,
+          usageCharge,
+        );
+        yield* checkFutureShapes(state, cursorBytes);
+        continue;
+      }
+
+      const record = yield* Effect.fromResult(captureRecord(proposedRecord)).pipe(
+        Effect.map((record) => record.canonical),
+        Effect.mapError((cause) => failure("Cannot capture canonical progress facts", cause)),
+      );
+
+      if (!isExecutionProgressRecord(record))
+        return yield* failure("Captured execution has no Run continuation");
+      if (canonicalRecordBytes(record) !== cursorBytes)
+        return yield* failure("Continuation byte accounting differs from its Schema encoding");
 
       const operational = new Map(
         (previous?.checkpoint?.operational ?? []).map((fact) => [fact.recordId, fact]),
@@ -1478,7 +1633,15 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
       for (const fact of changed) {
         const prior = operational.get(fact.recordId);
 
-        if (prior !== undefined && recordEncoding(prior).json !== recordEncoding(fact).json)
+        if (
+          prior !== undefined &&
+          (yield* Effect.fromResult(recordEncoding(prior)).pipe(
+            Effect.mapError((cause) => failure("Cannot encode active Run fact", cause)),
+          )).json !==
+            (yield* Effect.fromResult(recordEncoding(fact)).pipe(
+              Effect.mapError((cause) => failure("Cannot encode active Run fact", cause)),
+            )).json
+        )
           return yield* failure("An active Run fact cannot change after becoming durable");
         operational.set(fact.recordId, fact);
       }
@@ -1535,10 +1698,10 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
       accepted.set(runId, state);
     }
 
-    if (ownedRecords.length + executions.length > 256)
+    if (ownedRecords.length + executionCount > 256)
       return yield* failure("Progress and facts exceed the atomic batch bound");
 
-    const prepared = new CommitBatch(
+    const prepared = CommitBatch.make(
       {
         ...batch,
         records: ownedRecords.filter((fact) => !isOperationalRecord(fact)),
@@ -1566,14 +1729,11 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     };
   });
 
-  const tail = Effect.gen(function* () {
-    const writer = yield* CurrentRunWriter;
-
-    if (writer.threadId !== threadId)
-      return yield* failure("Progress writer belongs to another Thread");
-
-    return (yield* writer.tail).sequence;
-  });
+  const tail = Effect.flatMap(CurrentRunWriter, (writer) =>
+    writer.threadId !== threadId
+      ? Effect.fail(failure("Progress writer belongs to another Thread"))
+      : Effect.map(writer.tail, (position) => position.sequence),
+  );
 
   const commitCaptured = Effect.fnUntraced(
     function* (batch: CanonicalBatch) {
@@ -1672,7 +1832,7 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
 
         yield* prepare(yield* captureFacts(probe), after);
         const recordId = probe.records[0].recordId;
-        const state = yield* loadState(runId, after);
+        const state = cached.get(runId) ?? (yield* loadUncachedState(runId, after));
 
         if (state === undefined) return yield* failure("Dispatch has no canonical Run progress");
         if (reservations.has(recordId))
@@ -1699,7 +1859,7 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
 
         const owned = yield* captureFacts(batch);
 
-        yield* prepare(owned, after);
+        yield* prepare(owned, after, "preflight");
 
         const response = owned.records.find(
           (record) => record.payload._tag === "ModelResponseRecorded",
@@ -1707,7 +1867,10 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
 
         if (response === undefined || response.payload._tag !== "ModelResponseRecorded")
           return yield* failure("Deferred dispatch has no response");
-        const progress = yield* loadState(response.payload.runId, after);
+
+        const progress =
+          cached.get(response.payload.runId) ??
+          (yield* loadUncachedState(response.payload.runId, after));
 
         if (progress === undefined) return yield* failure("Deferred dispatch has no Run progress");
 
@@ -1741,16 +1904,33 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
       }),
     );
 
+  const checkState = (state: ProgressState | undefined, recovered: boolean) => {
+    if (state === undefined) return Effect.fail(failure("Execution has no canonical Run progress"));
+
+    const capacity = () =>
+      state.continuation.position === "settling" || state.continuation.position === "settled"
+        ? Effect.void
+        : checkCapacity(state);
+
+    // Accepted states were shape-checked, but usage and reservations remain live inputs.
+    return recovered ? Effect.andThen(checkFutureShapes(state), capacity) : capacity();
+  };
+
   const check = (runId: RunId) =>
     gate.withPermits(1)(
-      Effect.gen(function* () {
-        const state = yield* loadState(runId, yield* tail);
+      Effect.flatMap(CurrentRunWriter, (writer) => {
+        if (writer.threadId !== threadId)
+          return Effect.fail(failure("Progress writer belongs to another Thread"));
 
-        if (state === undefined) return yield* failure("Execution has no canonical Run progress");
-        // Accepted states were shape-checked during preparation; recovered states still need proof.
-        if (cached.get(runId) !== state) yield* checkFutureShapes(state);
-        if (state.continuation.position !== "settling" && state.continuation.position !== "settled")
-          yield* checkCapacity(state);
+        const retained = cached.get(runId);
+
+        if (retained !== undefined) return checkState(retained, false);
+
+        return Effect.flatMap(writer.tail, (position) =>
+          Effect.flatMap(loadUncachedState(runId, position.sequence), (state) =>
+            checkState(state, true),
+          ),
+        );
       }),
     );
 
@@ -1760,6 +1940,29 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     reserve,
     defer,
     check,
+    /** Internal read view immediately after this writer's acknowledged commit, while
+     * holding its initialization gates. Never authority across ownership or writes. */
+    acceptedCheckpoint: (runId: RunId) => cached.get(runId)?.checkpoint,
+    /** Scope a verified empty execution/evidence view to one owned initialization body.
+     * The caller holds progress+mutation gates; a changed writer or tail never reuses it. */
+    withVerifiedEmptyRun: <A, E, R>(
+      runId: RunId,
+      through: CanonicalSequence,
+      body: Effect.Effect<A, E, R>,
+    ): Effect.Effect<A, E, R | CurrentRunWriter> =>
+      Effect.flatMap(CurrentRunWriter, (writer) => {
+        const view = { runId, through, writer };
+
+        verifiedEmpty = view;
+
+        return body.pipe(
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (verifiedEmpty === view) verifiedEmpty = undefined;
+            }),
+          ),
+        );
+      }),
     stageUsage: (runId: RunId, bytes: number) => {
       if (bytes === 0) stagedUsage.delete(runId);
       else stagedUsage.set(runId, bytes);