@yielded/agent 0.1.0-beta.174 → 0.1.0-beta.175

package/src/durable/RunContinuation.ts

@@ -5,7 +5,7 @@ import { AgentPersistenceCapacityError } from "../core/AgentError.ts";
 import type { RunId, SubmissionId, ThreadId } from "../core/Identifiers.ts";
 import { ToolCallId } from "../core/Identifiers.ts";
 import { utf8ByteLength } from "../core/internal/utf8.ts";
-import { reference, resolveEvidence } from "./internal/evidence.ts";
+import { resolveEvidence } from "./internal/evidence.ts";
 import { continuationUsage } from "./internal/usage-totals.ts";
 export { reference, resolveEvidence } from "./internal/evidence.ts";
 import {
@@ -157,17 +157,14 @@ const isFrozenJsonData = (input: Schema.Json): boolean => {
   return true;
 };
 
-const validateBatchHeader = Schema.decodeSync(
+const validateBatchShape = Schema.decodeUnknownSync(
   Schema.Struct({
     batchId: CanonicalBatch.fields.batchId,
     producerId: CanonicalBatch.fields.producerId,
+    records: Schema.NonEmptyArray(Schema.Unknown).check(Schema.isMaxLength(256)),
   }),
 );
 
-const validateBatchCount = Schema.decodeUnknownSync(
-  Schema.NonEmptyArray(Schema.Unknown).check(Schema.isMaxLength(256)),
-);
-
 const ContinuationBytes = Schema.Struct({
   turnBytes: RunContinuation.fields.turnBytes,
   terminalBytes: RunContinuation.fields.terminalBytes,
@@ -185,15 +182,20 @@ const captureFacts = (batch: CommitBatch) =>
   Effect.try({
     try: () =>
       Result.gen(function* () {
-        const header = validateBatchHeader(batch);
+        const inputs = batch.records;
 
-        validateBatchCount(batch.records);
-        const encodings = yield* Result.all(batch.records.map(captureRecord));
+        const { batchId, producerId } = validateBatchShape({
+          batchId: batch.batchId,
+          producerId: batch.producerId,
+          records: inputs,
+        });
+
+        const encodings = yield* Result.all(inputs.map(captureRecord));
         const records = encodings.map((record) => record.canonical);
 
         return Object.freeze(
           CanonicalBatch.make(
-            { ...header, records: [records[0]!, ...records.slice(1)] },
+            { batchId, producerId, records: [records[0]!, ...records.slice(1)] },
             { disableChecks: true },
           ),
         );
@@ -236,14 +238,6 @@ export const prepareProgressAppend = (
   return Object.freeze(encodings.success.map((record) => record.progress));
 };
 
-const factUsageCharge = (facts: ReadonlyArray<RecordEnvelope>) =>
-  Effect.fromResult(Result.all(facts.map(recordEncoding))).pipe(
-    Effect.map((encodings) =>
-      encodings.reduce((bytes, record) => bytes + record.progress.terminalUsageBytes, 0),
-    ),
-    Effect.mapError((cause) => failure("Cannot account canonical progress facts", cause)),
-  );
-
 /** These values belong to the active Run, not its permanent conversation history. */
 export const isOperationalRecord = ({ payload }: RecordEnvelope): boolean =>
   payload._tag === "RunStarted" ||
@@ -717,9 +711,27 @@ const advanceFacts = Effect.fnUntraced(function* (
   let results = new Map(previous?.results);
   let childResults = new Map(previous?.childResults);
   let completionBytes = previous?.completionBytes;
+  let factBytes = 0;
+  let turn = previous?.continuation.turn ?? 1;
+  let usageCharge = 0;
+  let closingBytes = 0;
+  let closingCount = 0;
 
   for (const fact of facts) {
     const payload = fact.payload;
+    const captured = recordEncoding(fact);
+
+    if (Result.isFailure(captured))
+      return yield* failure("Cannot account canonical progress facts", captured.failure);
+    const encoded = captured.success;
+
+    factBytes += encoded.bytes;
+    if ("turn" in payload) turn = Math.max(turn, payload.turn);
+    usageCharge += encoded.progress.terminalUsageBytes;
+    if (encoded.progress.terminal) {
+      closingBytes += encoded.bytes;
+      closingCount++;
+    }
 
     switch (payload._tag) {
       case "RunStarted":
@@ -728,7 +740,7 @@ const advanceFacts = Effect.fnUntraced(function* (
       case "RunContextRecorded":
         if (savedContext !== undefined)
           return yield* failure("A Run's original context cannot be replaced");
-        savedContext = yield* reference(fact);
+        savedContext = EvidenceReference.make({ recordId: fact.recordId });
         position = "awaiting-model";
         break;
       case "ModelResponseRecorded": {
@@ -782,7 +794,7 @@ const advanceFacts = Effect.fnUntraced(function* (
         accounting.lastInputTokens = summary?.inputTokens ?? payload.inputTokens ?? 0;
         accounting.lastOutputTokens = summary?.outputTokens ?? payload.outputTokens ?? 0;
         accounting.unobservedModelCalls += payload.unobservedModelCalls ?? 0;
-        latestResponse = yield* reference(fact);
+        latestResponse = EvidenceReference.make({ recordId: fact.recordId });
         response = payload;
         results = new Map();
         childResults = new Map();
@@ -866,12 +878,12 @@ const advanceFacts = Effect.fnUntraced(function* (
                 ? 0
                 : utf8ByteLength(JSON.stringify(payload.runDisposition)))
             : undefined;
-        terminal = yield* reference(fact);
+        terminal = EvidenceReference.make({ recordId: fact.recordId });
         position = "settling";
         break;
       case "SubmissionSettled":
         if (payload.submissionId !== submissionId) break;
-        terminal = yield* reference(fact);
+        terminal = EvidenceReference.make({ recordId: fact.recordId });
         position = "settled";
         if (payload.usageSummary !== undefined) {
           accounting.modelCalls = payload.usageSummary.modelCalls;
@@ -929,22 +941,13 @@ const advanceFacts = Effect.fnUntraced(function* (
   if (previous?.continuation.position === "settled") position = "settled";
   else if (previous?.continuation.position === "settling" && position !== "settled")
     position = "settling";
-  const factBytes = facts.reduce((bytes, fact) => bytes + canonicalRecordBytes(fact), 0);
-
-  const turn = facts.reduce(
-    (current, fact) => ("turn" in fact.payload ? Math.max(current, fact.payload.turn) : current),
-    previous?.continuation.turn ?? 1,
-  );
 
   const turnBase =
     (previous?.continuation.turn === turn ? previous.continuation.turnBytes : initialBytes) +
     factBytes;
 
-  const usageCharge = yield* factUsageCharge(facts);
   const terminalUsageBytes = (previous?.continuation.terminalUsageBytes ?? 0) + usageCharge;
 
-  const closing = facts.filter(isTerminalBudgetFact);
-
   return {
     accounting,
     savedContext,
@@ -961,11 +964,9 @@ const advanceFacts = Effect.fnUntraced(function* (
     turnBase,
     usageCharge,
     terminalUsageBytes,
-    terminalBytes:
-      (previous?.continuation.terminalBytes ?? 0) +
-      closing.reduce((bytes, fact) => bytes + canonicalRecordBytes(fact), 0),
-    terminalRecords: (previous?.continuation.terminalRecords ?? 0) + closing.length,
-    closing: closing.length > 0,
+    terminalBytes: (previous?.continuation.terminalBytes ?? 0) + closingBytes,
+    terminalRecords: (previous?.continuation.terminalRecords ?? 0) + closingCount,
+    closing: closingCount > 0,
   };
 });
 
@@ -1046,6 +1047,14 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
   const gate = yield* Semaphore.make(1);
   const cached = new Map<RunId, ProgressState>();
 
+  let verifiedEmpty:
+    | {
+        readonly runId: RunId;
+        readonly through: CanonicalSequence;
+        readonly writer: CurrentRunWriter["Service"];
+      }
+    | undefined;
+
   const reservations = new Map<
     RecordId,
     {
@@ -1180,13 +1189,6 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     };
   });
 
-  const loadState = (runId: RunId, after: CanonicalSequence) =>
-    Effect.suspend(() => {
-      const retained = cached.get(runId);
-
-      return retained === undefined ? loadUncachedState(runId, after) : Effect.succeed(retained);
-    });
-
   const checkFutureShapes = (
     state: ProgressState,
     cursorBytes?: number,
@@ -1316,12 +1318,9 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     if (batch.records.some((record) => record.payload._tag === "RunContinuation"))
       return yield* failure("A caller cannot supply interpreter progress to the progress writer");
 
-    const ownedRecords = yield* Effect.fromResult(
-      Result.all(batch.records.map(captureRecord)),
-    ).pipe(
-      Effect.map((encodings) => encodings.map((record) => record.canonical)),
-      Effect.mapError((cause) => failure("Cannot capture canonical progress facts", cause)),
-    );
+    // Every private caller passes captureFacts' owned snapshot. Keep a mutable
+    // list for settlement accounting without capturing that snapshot a second time.
+    const ownedRecords = [...batch.records];
 
     const groups = new Map<RunId, Array<RecordEnvelope>>();
 
@@ -1338,7 +1337,16 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     let executionCount = 0;
 
     for (const [runId, facts] of groups) {
-      const previous = yield* loadState(runId, after);
+      const empty =
+        verifiedEmpty?.runId === runId &&
+        verifiedEmpty.through === after &&
+        // Settlement preparation need not have a Run writer; absence disables reuse.
+        verifiedEmpty.writer ===
+          Option.getOrUndefined(yield* Effect.serviceOption(CurrentRunWriter));
+
+      const previous = empty
+        ? undefined
+        : (cached.get(runId) ?? (yield* loadUncachedState(runId, after)));
 
       let original = facts.find(
         (record) =>
@@ -1379,7 +1387,7 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
       if (previous === undefined && original === undefined)
         return yield* failure("Run has no accepted original input");
 
-      if (previous === undefined) {
+      if (previous === undefined && !empty) {
         const settled = yield* provide(
           getRecord({
             threadId,
@@ -1460,7 +1468,7 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
           ? previous.continuation.originalInput
           : original === undefined
             ? yield* failure("Run progress has no original input")
-            : yield* reference(original);
+            : EvidenceReference.make({ recordId: original.recordId });
 
       const next = yield* advanceFacts(previous, facts, submissionId, initialBytes);
 
@@ -1498,7 +1506,7 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
         ...(savedContext === undefined ? {} : { savedContext }),
         ...(latestResponse === undefined ? {} : { latestResponse }),
         ...(terminal === undefined ? {} : { terminal }),
-        lastFact: yield* reference(last),
+        lastFact: EvidenceReference.make({ recordId: last.recordId }),
         position,
         accounting,
       }).pipe(
@@ -1824,7 +1832,7 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
 
         yield* prepare(yield* captureFacts(probe), after);
         const recordId = probe.records[0].recordId;
-        const state = yield* loadState(runId, after);
+        const state = cached.get(runId) ?? (yield* loadUncachedState(runId, after));
 
         if (state === undefined) return yield* failure("Dispatch has no canonical Run progress");
         if (reservations.has(recordId))
@@ -1859,7 +1867,10 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
 
         if (response === undefined || response.payload._tag !== "ModelResponseRecorded")
           return yield* failure("Deferred dispatch has no response");
-        const progress = yield* loadState(response.payload.runId, after);
+
+        const progress =
+          cached.get(response.payload.runId) ??
+          (yield* loadUncachedState(response.payload.runId, after));
 
         if (progress === undefined) return yield* failure("Deferred dispatch has no Run progress");
 
@@ -1893,16 +1904,33 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
       }),
     );
 
+  const checkState = (state: ProgressState | undefined, recovered: boolean) => {
+    if (state === undefined) return Effect.fail(failure("Execution has no canonical Run progress"));
+
+    const capacity = () =>
+      state.continuation.position === "settling" || state.continuation.position === "settled"
+        ? Effect.void
+        : checkCapacity(state);
+
+    // Accepted states were shape-checked, but usage and reservations remain live inputs.
+    return recovered ? Effect.andThen(checkFutureShapes(state), capacity) : capacity();
+  };
+
   const check = (runId: RunId) =>
     gate.withPermits(1)(
-      Effect.gen(function* () {
-        const state = yield* loadState(runId, yield* tail);
+      Effect.flatMap(CurrentRunWriter, (writer) => {
+        if (writer.threadId !== threadId)
+          return Effect.fail(failure("Progress writer belongs to another Thread"));
+
+        const retained = cached.get(runId);
 
-        if (state === undefined) return yield* failure("Execution has no canonical Run progress");
-        // Accepted states were shape-checked during preparation; recovered states still need proof.
-        if (cached.get(runId) !== state) yield* checkFutureShapes(state);
-        if (state.continuation.position !== "settling" && state.continuation.position !== "settled")
-          yield* checkCapacity(state);
+        if (retained !== undefined) return checkState(retained, false);
+
+        return Effect.flatMap(writer.tail, (position) =>
+          Effect.flatMap(loadUncachedState(runId, position.sequence), (state) =>
+            checkState(state, true),
+          ),
+        );
       }),
     );
 
@@ -1912,6 +1940,29 @@ export const makeProgressWriter = Effect.fnUntraced(function* (
     reserve,
     defer,
     check,
+    /** Internal read view immediately after this writer's acknowledged commit, while
+     * holding its initialization gates. Never authority across ownership or writes. */
+    acceptedCheckpoint: (runId: RunId) => cached.get(runId)?.checkpoint,
+    /** Scope a verified empty execution/evidence view to one owned initialization body.
+     * The caller holds progress+mutation gates; a changed writer or tail never reuses it. */
+    withVerifiedEmptyRun: <A, E, R>(
+      runId: RunId,
+      through: CanonicalSequence,
+      body: Effect.Effect<A, E, R>,
+    ): Effect.Effect<A, E, R | CurrentRunWriter> =>
+      Effect.flatMap(CurrentRunWriter, (writer) => {
+        const view = { runId, through, writer };
+
+        verifiedEmpty = view;
+
+        return body.pipe(
+          Effect.ensuring(
+            Effect.sync(() => {
+              if (verifiedEmpty === view) verifiedEmpty = undefined;
+            }),
+          ),
+        );
+      }),
     stageUsage: (runId: RunId, bytes: number) => {
       if (bytes === 0) stagedUsage.delete(runId);
       else stagedUsage.set(runId, bytes);

package/src/durable/RunJournal.ts

@@ -13,7 +13,7 @@ import { type ExhaustedLimit } from "../core/RunEvent.ts";
 import { RunPolicyUsage } from "../core/RunPolicyUsage.ts";
 import { type Selection, type Snapshot } from "../core/ToolExposure.ts";
 import type { ToolParameterRejection } from "../core/ToolResult.ts";
-import { ModelCallUsage, summarizeModelUsage, type RunUsageSummary } from "../core/Usage.ts";
+import { type ModelCallUsage, summarizeModelUsage, type RunUsageSummary } from "../core/Usage.ts";
 import type { WorkerRef } from "../core/Worker.ts";
 import {
   CLEARED_TOOL_RESULT,
@@ -436,6 +436,36 @@ export interface RunJournalProjection {
   readonly pendingContextToolCallId?: string | undefined;
 }
 
+const initialPolicyUsage = () => ({
+  committedTurns: 0,
+  toolCalls: 0,
+  programmaticToolCalls: 0,
+  consecutiveToolFailures: 0,
+  finalizationUsed: false,
+  modelRestarts: 0,
+});
+
+const initialUsage = (modelUsage: Array<ModelCallUsage>) => ({
+  modelCalls: 0,
+  inputTokens: 0,
+  outputTokens: 0,
+  lastInputTokens: 0,
+  lastOutputTokens: 0,
+  costMicrousd: 0,
+  modelUsage,
+});
+
+/** Internal first-Run projection after exact input/checkpoint-absence verification. The
+ * new UserInputRecorded contributes no model message; the engine evaluates it later. */
+export const initialRunJournal = (history: Prompt.Prompt): RunJournalProjection => ({
+  policyUsage: RunPolicyUsage.make(initialPolicyUsage()),
+  usage: initialUsage([]),
+  prompt: history,
+  historyBefore: history,
+  historyFrom: CanonicalSequence.make(1),
+  committedTurns: 0,
+});
+
 interface ProjectedResponseUsage {
   readonly modelCalls: number;
   readonly inputTokens: number;
@@ -1050,15 +1080,7 @@ export const projectRunJournalStream = Effect.fnUntraced(function* <
   const modelUsage: Array<ModelCallUsage> = [];
   let unobservedModelCalls = 0;
 
-  const usage = {
-    modelCalls: 0,
-    inputTokens: 0,
-    outputTokens: 0,
-    lastInputTokens: 0,
-    lastOutputTokens: 0,
-    costMicrousd: 0,
-    modelUsage,
-  };
+  const usage = initialUsage(modelUsage);
 
   let toolSelection: Selection | undefined;
   let usageTurn = 0;
@@ -1080,14 +1102,7 @@ export const projectRunJournalStream = Effect.fnUntraced(function* <
   let pendingContextToolCallId: string | undefined;
   let ownerTerminated = false;
 
-  const policyUsage = {
-    committedTurns: 0,
-    toolCalls: 0,
-    programmaticToolCalls: 0,
-    consecutiveToolFailures: 0,
-    finalizationUsed: false,
-    modelRestarts: 0,
-  };
+  const policyUsage = initialPolicyUsage();
 
   const accountResponse = Effect.fnUntraced(function* (
     envelope: JournalRecordEnvelope,
@@ -1639,18 +1654,6 @@ export const promptFromCanonicalRecords = (
   );
 
 /** Everything one committed Turn contributes to its canonical batch. */
-/**
- * Staged usage is validated, never repaired: clamping negatives or truncating
- * fractions would under-record canonical usage, and NaN/Infinity must fail
- * typed instead of escaping as a record-construction defect (RUN-023).
- */
-const validStagedUsage = (label: string, value: number): Effect.Effect<number, RunJournalError> =>
-  Number.isSafeInteger(value) && value >= 0
-    ? Effect.succeed(value)
-    : Effect.fail(
-        journalError(`Staged ${label} must be a non-negative safe integer, got ${String(value)}`),
-      );
-
 export interface TurnCommitInput {
   readonly toolResultMaxBytes?: number | undefined;
   readonly toolSelectionMaxBytes?: number | undefined;
@@ -1695,8 +1698,9 @@ export interface TurnCommitInput {
 }
 
 const decodePersistedJson = Schema.decodeUnknownEffect(PersistedJson);
+const decodeModelResponse = Schema.decodeUnknownEffect(ModelResponseRecorded);
+const decodeToolSettled = Schema.decodeUnknownEffect(ToolCallSettled);
 const encodePrompt = Schema.encodeEffect(Prompt.Prompt);
-const decodeModelUsage = Schema.decodeUnknownEffect(Schema.Array(ModelCallUsage));
 
 const requireCanonicalTurn = (turn: number): Effect.Effect<void, RunJournalError> =>
   !Number.isInteger(turn) || turn <= 0
@@ -1742,30 +1746,60 @@ const modelResponseRecord = Effect.fnUntraced(function* (
     ),
   );
 
-  const modelUsage =
-    input.usage?.modelUsage === undefined
-      ? undefined
-      : yield* decodeModelUsage(input.usage.modelUsage).pipe(
-          Effect.mapError((cause) => journalError("Turn model usage failed to decode", cause)),
-        );
+  // Validate the detached messages and usage together; no mutable caller data is trusted.
+  const modelUsage = input.usage?.modelUsage;
 
-  if (modelUsage !== undefined) {
-    if (modelUsage.length === 0) {
+  const payload = yield* decodeModelResponse({
+    _tag: "ModelResponseRecorded",
+    toolResultMaxBytes: input.toolResultMaxBytes ?? MAX_PERSISTED_JSON_BYTES,
+    toolSelectionMaxBytes: input.toolSelectionMaxBytes ?? 0,
+    toolOperations: input.toolOperations ?? [],
+    ...(input.toolParameterRejections === undefined || input.toolParameterRejections.length === 0
+      ? {}
+      : { toolParameterRejections: input.toolParameterRejections }),
+    ...(input.toolExposure === undefined ? {} : { toolExposure: input.toolExposure }),
+    runId: input.runId,
+    turnId: input.turnId,
+    turn: input.turn,
+    messages,
+    ...(runScopedPrefixLength === undefined ? {} : { runScopedPrefixLength }),
+    ...(modelUsage === undefined ? {} : { modelUsage }),
+    ...(input.unobservedModelCalls === undefined || input.unobservedModelCalls === 0
+      ? {}
+      : {
+          unobservedModelCalls: input.unobservedModelCalls,
+        }),
+    ...(input.usage === undefined
+      ? {}
+      : {
+          inputTokens: input.usage.inputTokens,
+          outputTokens: input.usage.outputTokens,
+          // Written only when non-zero: absent re-seeds as zero, so the
+          // no-estimator case stays byte-identical to pre-cost histories.
+          ...(input.usage.costMicrousd === undefined || input.usage.costMicrousd === 0
+            ? {}
+            : {
+                costMicrousd: input.usage.costMicrousd,
+              }),
+        }),
+  }).pipe(
+    Effect.mapError((cause) => journalError("Invalid model response operation evidence", cause)),
+  );
+
+  if (payload.modelUsage !== undefined) {
+    if (payload.modelUsage.length === 0)
       return yield* journalError("Turn model usage must contain at least one completed call");
-    }
 
-    const summary = yield* continuationUsage(modelUsage).pipe(
+    const summary = yield* continuationUsage(payload.modelUsage).pipe(
       Effect.mapError((cause) => journalError("Turn model usage exceeds accounting bounds", cause)),
     );
 
     if (
-      input.usage === undefined ||
-      input.usage.inputTokens !== summary.inputTokens ||
-      input.usage.outputTokens !== summary.outputTokens ||
-      (input.usage.costMicrousd ?? 0) !== summary.costMicrousd
-    ) {
+      payload.inputTokens !== summary.inputTokens ||
+      payload.outputTokens !== summary.outputTokens ||
+      (payload.costMicrousd ?? 0) !== summary.costMicrousd
+    )
       return yield* journalError("Turn detailed and aggregate model usage disagree");
-    }
   }
 
   return RecordEnvelope.make({
@@ -1774,44 +1808,7 @@ const modelResponseRecord = Effect.fnUntraced(function* (
     schemaVersion: 1,
     createdAt: input.createdAt,
     deploymentId: input.deploymentId,
-    payload: yield* ModelResponseRecorded.makeEffect({
-      toolResultMaxBytes: input.toolResultMaxBytes ?? MAX_PERSISTED_JSON_BYTES,
-      toolSelectionMaxBytes: input.toolSelectionMaxBytes ?? 0,
-      toolOperations: input.toolOperations ?? [],
-      ...(input.toolParameterRejections === undefined || input.toolParameterRejections.length === 0
-        ? {}
-        : { toolParameterRejections: input.toolParameterRejections }),
-      ...(input.toolExposure === undefined ? {} : { toolExposure: input.toolExposure }),
-      runId: input.runId,
-      turnId: input.turnId,
-      turn: input.turn,
-      messages,
-      ...(runScopedPrefixLength === undefined ? {} : { runScopedPrefixLength }),
-      ...(modelUsage === undefined ? {} : { modelUsage }),
-      ...(input.unobservedModelCalls === undefined || input.unobservedModelCalls === 0
-        ? {}
-        : {
-            unobservedModelCalls: yield* validStagedUsage(
-              "unobservedModelCalls",
-              input.unobservedModelCalls,
-            ),
-          }),
-      ...(input.usage === undefined
-        ? {}
-        : {
-            inputTokens: yield* validStagedUsage("inputTokens", input.usage.inputTokens),
-            outputTokens: yield* validStagedUsage("outputTokens", input.usage.outputTokens),
-            // Written only when non-zero: absent re-seeds as zero, so the
-            // no-estimator case stays byte-identical to pre-cost histories.
-            ...(input.usage.costMicrousd === undefined || input.usage.costMicrousd === 0
-              ? {}
-              : {
-                  costMicrousd: yield* validStagedUsage("costMicrousd", input.usage.costMicrousd),
-                }),
-          }),
-    }).pipe(
-      Effect.mapError((cause) => journalError("Invalid model response operation evidence", cause)),
-    ),
+    payload,
   });
 });
 
@@ -1821,33 +1818,27 @@ const toolSettledRecords = Effect.fnUntraced(function* (
   const toolRecords: Array<RecordEnvelope> = [];
 
   for (const part of input.toolResults) {
-    const result = yield* decodePersistedJson(part.result).pipe(
-      Effect.mapError((cause) =>
-        journalError(`Tool result ${part.toolCallId} exceeds canonical persistence bounds`, cause),
-      ),
+    const payload = yield* decodeToolSettled({
+      _tag: "ToolCallSettled",
+      ...(part.toolSelection === undefined ? {} : { toolSelection: part.toolSelection }),
+      runId: input.runId,
+      toolCallId: part.toolCallId,
+      toolName: part.toolName,
+      result: part.result,
+      isFailure: part.isFailure,
+      ...(part.budgetRejected === true ? { budgetRejected: true } : {}),
+    }).pipe(
+      Effect.mapError((cause) => journalError(`Invalid Tool result ${part.toolCallId}`, cause)),
     );
 
-    const toolCallId = yield* Effect.try({
-      try: () => decodeToolCallId(part.toolCallId),
-      catch: (cause) => journalError(`Invalid Tool Call ID ${part.toolCallId}`, cause),
-    });
-
     toolRecords.push(
       RecordEnvelope.make({
-        recordId: toolCallSettledRecordId(input.runId, input.turn, toolCallId),
+        recordId: toolCallSettledRecordId(input.runId, input.turn, payload.toolCallId),
         family: "thread",
         schemaVersion: 1,
         createdAt: input.createdAt,
         deploymentId: input.deploymentId,
-        payload: ToolCallSettled.make({
-          ...(part.toolSelection === undefined ? {} : { toolSelection: part.toolSelection }),
-          runId: input.runId,
-          toolCallId,
-          toolName: part.toolName,
-          result,
-          isFailure: part.isFailure,
-          ...(part.budgetRejected === true ? { budgetRejected: true } : {}),
-        }),
+        payload,
       }),
     );
   }
@@ -1855,7 +1846,7 @@ const toolSettledRecords = Effect.fnUntraced(function* (
   return toolRecords;
 });
 
-const runCompletionRecord = Effect.fnUntraced(function* (input: TurnCommitInput) {
+const runCompletionRecord = (input: TurnCommitInput) => {
   if (input.runCompletion === undefined) return undefined;
   const completion = { runId: input.runId, ...input.runCompletion };
 
@@ -1869,7 +1860,7 @@ const runCompletionRecord = Effect.fnUntraced(function* (input: TurnCommitInput)
       ...completion,
     }),
   });
-});
+};
 
 /**
  * Build a canonical batch from interpreter-validated Turn facts: one
@@ -1887,7 +1878,7 @@ export const turnCanonicalBatch = Effect.fnUntraced(function* (
   yield* requireCanonicalTurn(input.turn);
   const modelResponse = yield* modelResponseRecord(input);
   const toolRecords = yield* toolSettledRecords(input);
-  const completionRecord = yield* runCompletionRecord(input);
+  const completionRecord = runCompletionRecord(input);
 
   return CanonicalBatch.make({
     batchId: turnBatchId(input.runId, input.turn),
@@ -1931,7 +1922,7 @@ export const turnResultsBatch = Effect.fnUntraced(function* (
   yield* requireCanonicalTurn(input.turn);
   const toolRecords = yield* toolSettledRecords(input);
   const first = toolRecords[0];
-  const completionRecord = yield* runCompletionRecord(input);
+  const completionRecord = runCompletionRecord(input);
 
   if (first === undefined) {
     if (completionRecord === undefined) {

package/src/durable/RunStorage.ts

@@ -113,6 +113,11 @@ export interface RunWriter {
 
 export interface RunStorageSession extends RunWriter, RunOwnership {
   readonly claim: Claim;
+  /** Library-only initialization, before application/model IO. Hold progress before mutation
+   * so the captured controls and this owner's acknowledged input remain one read view. */
+  readonly withInitialization?: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | OwnershipLost, R>;
   readonly refresh: Effect.Effect<void, ThreadStoreFailure>;
   readonly publishSettlement: (
     batch: CanonicalBatch,
@@ -316,6 +321,8 @@ export const make = Effect.gen(function* () {
             const session: RunStorageSession = {
               ...writer,
               claim: claimed,
+              withInitialization: (effect) =>
+                owner.withProgress(request.threadId, generation.use(effect)),
               release: generation.release,
               refresh: writer.refresh,
               markInputApplied: (marker) =>