@yielded/agent 0.1.0-beta.174 → 0.1.0-beta.176

package/src/durable/RunJournal.ts

@@ -13,7 +13,7 @@ import { type ExhaustedLimit } from "../core/RunEvent.ts";
 import { RunPolicyUsage } from "../core/RunPolicyUsage.ts";
 import { type Selection, type Snapshot } from "../core/ToolExposure.ts";
 import type { ToolParameterRejection } from "../core/ToolResult.ts";
-import { ModelCallUsage, summarizeModelUsage, type RunUsageSummary } from "../core/Usage.ts";
+import { type ModelCallUsage, summarizeModelUsage, type RunUsageSummary } from "../core/Usage.ts";
 import type { WorkerRef } from "../core/Worker.ts";
 import {
   CLEARED_TOOL_RESULT,
@@ -436,6 +436,36 @@ export interface RunJournalProjection {
   readonly pendingContextToolCallId?: string | undefined;
 }
 
+const initialPolicyUsage = () => ({
+  committedTurns: 0,
+  toolCalls: 0,
+  programmaticToolCalls: 0,
+  consecutiveToolFailures: 0,
+  finalizationUsed: false,
+  modelRestarts: 0,
+});
+
+const initialUsage = (modelUsage: Array<ModelCallUsage>) => ({
+  modelCalls: 0,
+  inputTokens: 0,
+  outputTokens: 0,
+  lastInputTokens: 0,
+  lastOutputTokens: 0,
+  costMicrousd: 0,
+  modelUsage,
+});
+
+/** Internal first-Run projection after exact input/checkpoint-absence verification. The
+ * new UserInputRecorded contributes no model message; the engine evaluates it later. */
+export const initialRunJournal = (history: Prompt.Prompt): RunJournalProjection => ({
+  policyUsage: RunPolicyUsage.make(initialPolicyUsage()),
+  usage: initialUsage([]),
+  prompt: history,
+  historyBefore: history,
+  historyFrom: CanonicalSequence.make(1),
+  committedTurns: 0,
+});
+
 interface ProjectedResponseUsage {
   readonly modelCalls: number;
   readonly inputTokens: number;
@@ -1050,15 +1080,7 @@ export const projectRunJournalStream = Effect.fnUntraced(function* <
   const modelUsage: Array<ModelCallUsage> = [];
   let unobservedModelCalls = 0;
 
-  const usage = {
-    modelCalls: 0,
-    inputTokens: 0,
-    outputTokens: 0,
-    lastInputTokens: 0,
-    lastOutputTokens: 0,
-    costMicrousd: 0,
-    modelUsage,
-  };
+  const usage = initialUsage(modelUsage);
 
   let toolSelection: Selection | undefined;
   let usageTurn = 0;
@@ -1080,14 +1102,7 @@ export const projectRunJournalStream = Effect.fnUntraced(function* <
   let pendingContextToolCallId: string | undefined;
   let ownerTerminated = false;
 
-  const policyUsage = {
-    committedTurns: 0,
-    toolCalls: 0,
-    programmaticToolCalls: 0,
-    consecutiveToolFailures: 0,
-    finalizationUsed: false,
-    modelRestarts: 0,
-  };
+  const policyUsage = initialPolicyUsage();
 
   const accountResponse = Effect.fnUntraced(function* (
     envelope: JournalRecordEnvelope,
@@ -1639,18 +1654,6 @@ export const promptFromCanonicalRecords = (
   );
 
 /** Everything one committed Turn contributes to its canonical batch. */
-/**
- * Staged usage is validated, never repaired: clamping negatives or truncating
- * fractions would under-record canonical usage, and NaN/Infinity must fail
- * typed instead of escaping as a record-construction defect (RUN-023).
- */
-const validStagedUsage = (label: string, value: number): Effect.Effect<number, RunJournalError> =>
-  Number.isSafeInteger(value) && value >= 0
-    ? Effect.succeed(value)
-    : Effect.fail(
-        journalError(`Staged ${label} must be a non-negative safe integer, got ${String(value)}`),
-      );
-
 export interface TurnCommitInput {
   readonly toolResultMaxBytes?: number | undefined;
   readonly toolSelectionMaxBytes?: number | undefined;
@@ -1695,8 +1698,9 @@ export interface TurnCommitInput {
 }
 
 const decodePersistedJson = Schema.decodeUnknownEffect(PersistedJson);
+const decodeModelResponse = Schema.decodeUnknownEffect(ModelResponseRecorded);
+const decodeToolSettled = Schema.decodeUnknownEffect(ToolCallSettled);
 const encodePrompt = Schema.encodeEffect(Prompt.Prompt);
-const decodeModelUsage = Schema.decodeUnknownEffect(Schema.Array(ModelCallUsage));
 
 const requireCanonicalTurn = (turn: number): Effect.Effect<void, RunJournalError> =>
   !Number.isInteger(turn) || turn <= 0
@@ -1732,40 +1736,74 @@ const modelResponseRecord = Effect.fnUntraced(function* (
   }
 
   const encodedMessages = yield* encodePrompt(Prompt.fromMessages([...promptMessages])).pipe(
-    Effect.mapError((cause) => journalError("Turn Prompt messages failed to encode", cause)),
+    Effect.mapErrorEager((cause) => journalError("Turn Prompt messages failed to encode", cause)),
   );
 
   const messages = yield* decodePersistedJson(encodedMessages).pipe(
-    Effect.map(copyJson),
-    Effect.mapError((cause) =>
+    Effect.mapEager(copyJson),
+    Effect.mapErrorEager((cause) =>
       journalError("Turn Prompt messages exceed canonical persistence bounds", cause),
     ),
   );
 
-  const modelUsage =
-    input.usage?.modelUsage === undefined
-      ? undefined
-      : yield* decodeModelUsage(input.usage.modelUsage).pipe(
-          Effect.mapError((cause) => journalError("Turn model usage failed to decode", cause)),
-        );
+  // Validate the detached messages and usage together; no mutable caller data is trusted.
+  const modelUsage = input.usage?.modelUsage;
+
+  const payload = yield* decodeModelResponse({
+    _tag: "ModelResponseRecorded",
+    toolResultMaxBytes: input.toolResultMaxBytes ?? MAX_PERSISTED_JSON_BYTES,
+    toolSelectionMaxBytes: input.toolSelectionMaxBytes ?? 0,
+    toolOperations: input.toolOperations ?? [],
+    ...(input.toolParameterRejections === undefined || input.toolParameterRejections.length === 0
+      ? {}
+      : { toolParameterRejections: input.toolParameterRejections }),
+    ...(input.toolExposure === undefined ? {} : { toolExposure: input.toolExposure }),
+    runId: input.runId,
+    turnId: input.turnId,
+    turn: input.turn,
+    messages,
+    ...(runScopedPrefixLength === undefined ? {} : { runScopedPrefixLength }),
+    ...(modelUsage === undefined ? {} : { modelUsage }),
+    ...(input.unobservedModelCalls === undefined || input.unobservedModelCalls === 0
+      ? {}
+      : {
+          unobservedModelCalls: input.unobservedModelCalls,
+        }),
+    ...(input.usage === undefined
+      ? {}
+      : {
+          inputTokens: input.usage.inputTokens,
+          outputTokens: input.usage.outputTokens,
+          // Written only when non-zero: absent re-seeds as zero, so the
+          // no-estimator case stays byte-identical to pre-cost histories.
+          ...(input.usage.costMicrousd === undefined || input.usage.costMicrousd === 0
+            ? {}
+            : {
+                costMicrousd: input.usage.costMicrousd,
+              }),
+        }),
+  }).pipe(
+    Effect.mapErrorEager((cause) =>
+      journalError("Invalid model response operation evidence", cause),
+    ),
+  );
 
-  if (modelUsage !== undefined) {
-    if (modelUsage.length === 0) {
+  if (payload.modelUsage !== undefined) {
+    if (payload.modelUsage.length === 0)
       return yield* journalError("Turn model usage must contain at least one completed call");
-    }
 
-    const summary = yield* continuationUsage(modelUsage).pipe(
-      Effect.mapError((cause) => journalError("Turn model usage exceeds accounting bounds", cause)),
+    const summary = yield* continuationUsage(payload.modelUsage).pipe(
+      Effect.mapErrorEager((cause) =>
+        journalError("Turn model usage exceeds accounting bounds", cause),
+      ),
     );
 
     if (
-      input.usage === undefined ||
-      input.usage.inputTokens !== summary.inputTokens ||
-      input.usage.outputTokens !== summary.outputTokens ||
-      (input.usage.costMicrousd ?? 0) !== summary.costMicrousd
-    ) {
+      payload.inputTokens !== summary.inputTokens ||
+      payload.outputTokens !== summary.outputTokens ||
+      (payload.costMicrousd ?? 0) !== summary.costMicrousd
+    )
       return yield* journalError("Turn detailed and aggregate model usage disagree");
-    }
   }
 
   return RecordEnvelope.make({
@@ -1774,44 +1812,7 @@ const modelResponseRecord = Effect.fnUntraced(function* (
     schemaVersion: 1,
     createdAt: input.createdAt,
     deploymentId: input.deploymentId,
-    payload: yield* ModelResponseRecorded.makeEffect({
-      toolResultMaxBytes: input.toolResultMaxBytes ?? MAX_PERSISTED_JSON_BYTES,
-      toolSelectionMaxBytes: input.toolSelectionMaxBytes ?? 0,
-      toolOperations: input.toolOperations ?? [],
-      ...(input.toolParameterRejections === undefined || input.toolParameterRejections.length === 0
-        ? {}
-        : { toolParameterRejections: input.toolParameterRejections }),
-      ...(input.toolExposure === undefined ? {} : { toolExposure: input.toolExposure }),
-      runId: input.runId,
-      turnId: input.turnId,
-      turn: input.turn,
-      messages,
-      ...(runScopedPrefixLength === undefined ? {} : { runScopedPrefixLength }),
-      ...(modelUsage === undefined ? {} : { modelUsage }),
-      ...(input.unobservedModelCalls === undefined || input.unobservedModelCalls === 0
-        ? {}
-        : {
-            unobservedModelCalls: yield* validStagedUsage(
-              "unobservedModelCalls",
-              input.unobservedModelCalls,
-            ),
-          }),
-      ...(input.usage === undefined
-        ? {}
-        : {
-            inputTokens: yield* validStagedUsage("inputTokens", input.usage.inputTokens),
-            outputTokens: yield* validStagedUsage("outputTokens", input.usage.outputTokens),
-            // Written only when non-zero: absent re-seeds as zero, so the
-            // no-estimator case stays byte-identical to pre-cost histories.
-            ...(input.usage.costMicrousd === undefined || input.usage.costMicrousd === 0
-              ? {}
-              : {
-                  costMicrousd: yield* validStagedUsage("costMicrousd", input.usage.costMicrousd),
-                }),
-          }),
-    }).pipe(
-      Effect.mapError((cause) => journalError("Invalid model response operation evidence", cause)),
-    ),
+    payload,
   });
 });
 
@@ -1821,33 +1822,27 @@ const toolSettledRecords = Effect.fnUntraced(function* (
   const toolRecords: Array<RecordEnvelope> = [];
 
   for (const part of input.toolResults) {
-    const result = yield* decodePersistedJson(part.result).pipe(
-      Effect.mapError((cause) =>
-        journalError(`Tool result ${part.toolCallId} exceeds canonical persistence bounds`, cause),
-      ),
+    const payload = yield* decodeToolSettled({
+      _tag: "ToolCallSettled",
+      ...(part.toolSelection === undefined ? {} : { toolSelection: part.toolSelection }),
+      runId: input.runId,
+      toolCallId: part.toolCallId,
+      toolName: part.toolName,
+      result: part.result,
+      isFailure: part.isFailure,
+      ...(part.budgetRejected === true ? { budgetRejected: true } : {}),
+    }).pipe(
+      Effect.mapError((cause) => journalError(`Invalid Tool result ${part.toolCallId}`, cause)),
     );
 
-    const toolCallId = yield* Effect.try({
-      try: () => decodeToolCallId(part.toolCallId),
-      catch: (cause) => journalError(`Invalid Tool Call ID ${part.toolCallId}`, cause),
-    });
-
     toolRecords.push(
       RecordEnvelope.make({
-        recordId: toolCallSettledRecordId(input.runId, input.turn, toolCallId),
+        recordId: toolCallSettledRecordId(input.runId, input.turn, payload.toolCallId),
         family: "thread",
         schemaVersion: 1,
         createdAt: input.createdAt,
         deploymentId: input.deploymentId,
-        payload: ToolCallSettled.make({
-          ...(part.toolSelection === undefined ? {} : { toolSelection: part.toolSelection }),
-          runId: input.runId,
-          toolCallId,
-          toolName: part.toolName,
-          result,
-          isFailure: part.isFailure,
-          ...(part.budgetRejected === true ? { budgetRejected: true } : {}),
-        }),
+        payload,
       }),
     );
   }
@@ -1855,7 +1850,7 @@ const toolSettledRecords = Effect.fnUntraced(function* (
   return toolRecords;
 });
 
-const runCompletionRecord = Effect.fnUntraced(function* (input: TurnCommitInput) {
+const runCompletionRecord = (input: TurnCommitInput) => {
   if (input.runCompletion === undefined) return undefined;
   const completion = { runId: input.runId, ...input.runCompletion };
 
@@ -1869,7 +1864,7 @@ const runCompletionRecord = Effect.fnUntraced(function* (input: TurnCommitInput)
       ...completion,
     }),
   });
-});
+};
 
 /**
  * Build a canonical batch from interpreter-validated Turn facts: one
@@ -1887,7 +1882,7 @@ export const turnCanonicalBatch = Effect.fnUntraced(function* (
   yield* requireCanonicalTurn(input.turn);
   const modelResponse = yield* modelResponseRecord(input);
   const toolRecords = yield* toolSettledRecords(input);
-  const completionRecord = yield* runCompletionRecord(input);
+  const completionRecord = runCompletionRecord(input);
 
   return CanonicalBatch.make({
     batchId: turnBatchId(input.runId, input.turn),
@@ -1931,7 +1926,7 @@ export const turnResultsBatch = Effect.fnUntraced(function* (
   yield* requireCanonicalTurn(input.turn);
   const toolRecords = yield* toolSettledRecords(input);
   const first = toolRecords[0];
-  const completionRecord = yield* runCompletionRecord(input);
+  const completionRecord = runCompletionRecord(input);
 
   if (first === undefined) {
     if (completionRecord === undefined) {

package/src/durable/RunStorage.ts

@@ -113,6 +113,13 @@ export interface RunWriter {
 
 export interface RunStorageSession extends RunWriter, RunOwnership {
   readonly claim: Claim;
+  /** Atomic original input/context plus the ledger marker, when the adapter supports it. */
+  readonly appendInput?: RunWriter["append"];
+  /** Library-only initialization, before application/model IO. Hold progress before mutation
+   * so the captured controls and this owner's acknowledged input remain one read view. */
+  readonly withInitialization?: <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E | OwnershipLost, R>;
   readonly refresh: Effect.Effect<void, ThreadStoreFailure>;
   readonly publishSettlement: (
     batch: CanonicalBatch,
@@ -171,69 +178,75 @@ const makeWriter = Effect.fnUntraced(function* (threadId: ThreadId) {
     }),
   );
 
-  const append: RunWriter["append"] = Effect.fnUntraced(function* (batch, executions) {
-    const captured = yield* PreparedAppend.capture(
-      AppendRequest.make({
-        threadId,
-        expectedTailSequence: tail.sequence,
-        batch,
-        ...(executions === undefined ? {} : { executions }),
-      }),
-    ).pipe(
-      Effect.mapError((cause) =>
-        ThreadStoreError.make({
-          operation: "capture append",
-          message: cause.message,
-          cause,
+  const makeAppend = Effect.gen(function* () {
+    const publisher = yield* ThreadStore;
+
+    const append: RunWriter["append"] = Effect.fnUntraced(function* (batch, executions) {
+      const captured = yield* PreparedAppend.capture(
+        AppendRequest.make({
+          threadId,
+          expectedTailSequence: tail.sequence,
+          batch,
+          ...(executions === undefined ? {} : { executions }),
         }),
-      ),
-    );
+      ).pipe(
+        Effect.mapError((cause) =>
+          ThreadStoreError.make({
+            operation: "capture append",
+            message: cause.message,
+            cause,
+          }),
+        ),
+      );
 
-    return yield* owner.withProgress(
-      threadId,
-      owner.withMutation(
-        Effect.gen(function* () {
-          yield* checkActive;
-          for (let retries = 0; ; retries++) {
-            const result = yield* store
-              .append(
-                captured.expectedTailSequence === tail.sequence
-                  ? captured
-                  : AppendRequest.make({
-                      ...captured,
-                      expectedTailSequence: tail.sequence,
-                    }),
-              )
-              .pipe(
-                Effect.catchTag("AppendConflict", (conflict) => {
-                  if (
-                    conflict.reason !== "tail" ||
-                    conflict.actualTailSequence === undefined ||
-                    retries >= 8
-                  )
-                    return Effect.fail(conflict);
-                  tail = { sequence: conflict.actualTailSequence };
-                  if (captured.executions !== undefined) return Effect.fail(conflict);
-
-                  return Effect.succeed(undefined);
-                }),
-              );
-
-            if (result === undefined) continue;
-            // A historical replay returns its original coordinates, not today's canonical tail.
-            if (result.replayed) yield* refresh;
-            else tail = { sequence: result.lastSequence };
-
-            return result;
-          }
-        }).pipe(
-          // Revoke uncertain writes before releasing the writer's mutation gate.
-          Effect.onError((cause) =>
-            isDefiniteWriteFailure(cause) ? Effect.void : ownership.release,
+      return yield* owner.withProgress(
+        threadId,
+        owner.withMutation(
+          Effect.gen(function* () {
+            yield* checkActive;
+            for (let retries = 0; ; retries++) {
+              const result = yield* publisher
+                .append(
+                  captured.expectedTailSequence === tail.sequence
+                    ? captured
+                    : AppendRequest.make({
+                        ...captured,
+                        expectedTailSequence: tail.sequence,
+                      }),
+                )
+                .pipe(
+                  Effect.catchTag("AppendConflict", (conflict) => {
+                    if (
+                      conflict.reason !== "tail" ||
+                      conflict.actualTailSequence === undefined ||
+                      retries >= 8
+                    )
+                      return Effect.fail(conflict);
+                    tail = { sequence: conflict.actualTailSequence };
+                    if (captured.executions !== undefined) return Effect.fail(conflict);
+
+                    return Effect.succeed(undefined);
+                  }),
+                );
+
+              if (result === undefined) continue;
+              // A historical replay returns its original coordinates, not today's canonical tail.
+              if (result.replayed) yield* refresh;
+              else tail = { sequence: result.lastSequence };
+
+              return result;
+            }
+          }).pipe(
+            // Revoke uncertain writes before releasing the writer's mutation gate.
+            Effect.onError((cause) =>
+              isDefiniteWriteFailure(cause) ? Effect.void : ownership.release,
+            ),
           ),
         ),
-      ),
-    );
+      );
+    });
+
+    return append;
   });
 
   const writer = {
@@ -242,13 +255,14 @@ const makeWriter = Effect.fnUntraced(function* (threadId: ThreadId) {
     withProgress: <A, E, R>(effect: Effect.Effect<A, E, R>) =>
       owner.withProgress(threadId, Effect.andThen(checkActive, effect)),
     tail: Effect.sync(() => tail),
-    append,
+    append: yield* makeAppend,
     checkActive: owner.withMutation(checkActive),
     refresh,
   };
 
   return {
     writer,
+    makeAppend,
     adoptTail: (sequence: CanonicalSequence) => {
       tail = { sequence };
     },
@@ -305,7 +319,7 @@ export const make = Effect.gen(function* () {
               });
             yield* store.materialize(ThreadMaterialization.make({ threadId: request.threadId }));
 
-            const { writer, adoptTail } = yield* makeWriter(request.threadId).pipe(
+            const { writer, makeAppend, adoptTail } = yield* makeWriter(request.threadId).pipe(
               Effect.provideService(WriterOwnership, generation),
               Effect.provideService(ThreadStore, store),
               Effect.provideService(StorageOwner, owner),
@@ -313,9 +327,24 @@ export const make = Effect.gen(function* () {
 
             const owned = <A, E>(effect: Effect.Effect<A, E>) => generation.use(effect);
 
+            const inputPublisher = ledger.appendInput;
+
+            const appendInput =
+              inputPublisher === undefined
+                ? undefined
+                : yield* makeAppend.pipe(
+                    Effect.provideService(ThreadStore, {
+                      ...store,
+                      append: (request) => inputPublisher(claimed.submissionId, request),
+                    }),
+                  );
+
             const session: RunStorageSession = {
               ...writer,
               claim: claimed,
+              ...(appendInput === undefined ? {} : { appendInput }),
+              withInitialization: (effect) =>
+                owner.withProgress(request.threadId, generation.use(effect)),
               release: generation.release,
               refresh: writer.refresh,
               markInputApplied: (marker) =>

package/src/durable/SqlMemoryStore.ts

@@ -33,11 +33,13 @@ const EncodedMemoryChange = Schema.Struct({
   resultJson: StoredJson,
 });
 
-const equivalentContent = Schema.toEquivalence(
-  Schema.toEncoded(MemoryWrite.Wire.members[0].fields.content),
-);
+const makeEquivalentContent = () =>
+  Schema.toEquivalence(Schema.toEncoded(MemoryWrite.Wire.members[0].fields.content));
+
+let equivalentContent: ReturnType<typeof makeEquivalentContent> | undefined;
 
-const equivalentScopes = Schema.toEquivalence(MemoryWrite.Wire.members[0].fields.scopes);
+const makeEquivalentScopes = () => Schema.toEquivalence(MemoryWrite.Wire.members[0].fields.scopes);
+let equivalentScopes: ReturnType<typeof makeEquivalentScopes> | undefined;
 
 /** Ordered commands committed atomically by the SQL memory adapter. */
 export const SqlMemoryWriteBatch = Schema.Array(MemoryWrite.Wire).check(Schema.isMaxLength(128));
@@ -388,8 +390,8 @@ const validateReceiptResult = Effect.fnUntraced(function* (
       return yield* storageError(operation, "corrupt");
     }
     if (
-      !equivalentContent(command.content, result.content) ||
-      !equivalentScopes(command.scopes, result.scopes)
+      !(equivalentContent ??= makeEquivalentContent())(command.content, result.content) ||
+      !(equivalentScopes ??= makeEquivalentScopes())(command.scopes, result.scopes)
     ) {
       return yield* storageError(operation, "corrupt");
     }

package/src/durable/SubmissionLedger.ts

@@ -36,6 +36,7 @@ import {
   ToolCallUnknown,
   WorkerAdmission,
 } from "./Records.ts";
+import type { AppendRequest, AppendResult, ThreadStoreFailure } from "./ThreadStore.ts";
 
 export { IdempotencyKey, JoinedToHost, QueueSequence, Principal } from "../core/Receipt.ts";
 
@@ -989,6 +990,10 @@ export type SubmissionLedgerFailure =
  *   An optional `parentLinkage` is recorded immutably at first admission (SUB-016); a replay
  *   whose linkage diverges (present vs. absent, or different identities) fails with
  *   `AdmissionConflict` even when the input digest matches.
+ *   With `readyIfInitialized`, an adapter may insert a fresh ordinary Submission as ready
+ *   when it proves Thread initialization under the admission's owner transaction. Readiness,
+ *   its lifecycle fact and source progress commit with the receipt. Otherwise it returns
+ *   admitted and the caller completes materialization and `markReady` as usual.
  * - `resolveAdmission` — authoritative tri-state admission lookup by scoped idempotency key
  *   (SUB-031): `NotAdmitted` proves absence, `Admitted` carries the full snapshot, and
  *   `Indeterminate` states that the adapter cannot currently prove either. Only `NotAdmitted`
@@ -1093,6 +1098,7 @@ export class SubmissionLedger extends Context.Service<
     readonly capabilities: Effect.Effect<LedgerCapabilities>;
     readonly admit: (
       request: AdmissionRequest,
+      options?: { readonly readyIfInitialized?: boolean },
     ) => Effect.Effect<AdmissionResult, AdmissionConflict | AdmissionPolicyError | LedgerError>;
     readonly markReady: (request: MarkReadyRequest) => Effect.Effect<void, LedgerError>;
     readonly lookup: (
@@ -1108,6 +1114,13 @@ export class SubmissionLedger extends Context.Service<
     readonly selectHead: (
       request: ClaimRequest,
     ) => Effect.Effect<Option.Option<Claim>, LedgerError>;
+    /** Atomically publish a captured original input, active context and applied marker.
+     * Optional adapters retain the ordinary append-then-repair protocol. The captured input
+     * must be this owner's deterministic admission; a moved context boundary is refused. */
+    readonly appendInput?: (
+      submissionId: SubmissionId,
+      request: AppendRequest,
+    ) => Effect.Effect<AppendResult, ThreadStoreFailure>;
     readonly markInputApplied: (
       request: MarkInputAppliedRequest,
     ) => Effect.Effect<void, OwnershipLost | LedgerError>;
@@ -1168,6 +1181,8 @@ export class SubmissionLedger extends Context.Service<
       request: ReleaseChildBudgetRequest,
     ) => Effect.Effect<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>;
     readonly scanNonterminal: Stream.Stream<SubmissionWorkItem, LedgerError>;
+    /** Optional native snapshot for hosts that need the complete control worklist. */
+    readonly listNonterminal?: Effect.Effect<ReadonlyArray<SubmissionWorkItem>, LedgerError>;
     readonly loadRecoverySnapshot: (
       request: RecoverySnapshotRequest,
     ) => Effect.Effect<RecoverySnapshot, LedgerError>;