@yielded/agent 0.1.0-beta.181 → 0.1.0-beta.183

package/src/engine/internal/agent-runtime.ts

@@ -757,7 +757,7 @@ const acceptTurnCommit = <E, R>(
   trace: TurnTrace,
   durability: RunDurabilityHook<E, R> | undefined,
   commit: RunTurnCommit,
-): Effect.Effect<void, E | ModelProtocolError | AgentPolicyError, R> =>
+): Effect.Effect<void | "capacity-refused", E | ModelProtocolError | AgentPolicyError, R> =>
   Effect.suspend(() => {
     if (trace.commitFailed) return Effect.void;
 
@@ -767,6 +767,15 @@ const acceptTurnCommit = <E, R>(
 
     return Effect.onExitPrimitive(
       Effect.flatMap(accepted, (receipt) => {
+        if (receipt === "capacity-refused")
+          return commit._tag === "Response" && trace.responseCommitted !== true
+            ? Effect.succeed(receipt)
+            : Effect.fail(
+                ModelProtocolError.make({
+                  message: "Durability refused capacity after response acceptance",
+                }),
+              );
+
         if (receipt === "deferred")
           return commit._tag === "Response" && commit.defer === true
             ? Effect.void
@@ -837,7 +846,7 @@ const settleTurn = <E, R>(
                   ...(response === undefined ? {} : { response }),
                   results,
                   ...(completion === undefined ? {} : { completion }),
-                }),
+                }).pipe(Effect.asVoid),
         );
       });
 
@@ -1020,22 +1029,20 @@ const inspectModelResponsePartCapacity = (
   part: unknown,
   limits: EffectiveRunBufferLimits,
   knownSafePrototypes: ReadonlySet<object> = knownSafeModelResponsePrototypes,
-): Effect.Effect<number, ModelProtocolError> =>
-  Effect.suspend(() => {
-    const bytes = boundedValueFootprint(
-      part,
-      limits.maxModelResponseBytes - usage.responsePartBytes,
-      knownSafePrototypes,
-    );
+): number | ModelProtocolError => {
+  const bytes = boundedValueFootprint(
+    part,
+    limits.maxModelResponseBytes - usage.responsePartBytes,
+    knownSafePrototypes,
+  );
 
-    return bytes === undefined
-      ? Effect.fail(
-          ModelProtocolError.make({
-            message: `Model response exceeded the ${limits.maxModelResponseBytes}-byte retained response limit`,
-          }),
-        )
-      : Effect.succeed(bytes);
-  });
+  return (
+    bytes ??
+    ModelProtocolError.make({
+      message: `Model response exceeded the ${limits.maxModelResponseBytes}-byte retained response limit`,
+    })
+  );
+};
 
 /**
  * LanguageModel validates encoded parameters even with automatic resolution disabled.
@@ -1128,7 +1135,7 @@ const modelResponseParsersFor = (toolkit: Toolkit.Any) => {
   return parsers;
 };
 
-const captureModelResponsePartGeneral = Effect.fnUntraced(function* <
+const captureModelResponsePartGeneral = Effect.fnUntracedEager(function* <
   Tools extends Record<string, Tool.Any>,
 >(
   part: unknown,
@@ -1155,19 +1162,23 @@ const captureModelResponsePartGeneral = Effect.fnUntraced(function* <
   if (directInputBytes === undefined) {
     const preflight = schemaClassToolPartPreflight(part, toolkit);
 
-    yield* inspectModelResponsePartCapacity(usage, preflight ?? part, limits);
+    const capacity = inspectModelResponsePartCapacity(usage, preflight ?? part, limits);
+
+    if (typeof capacity !== "number") return yield* capacity;
   }
   const parsers = modelResponseParsersFor(toolkit);
 
   const encoded = yield* parsers
     .encode(part)
     .pipe(
-      Effect.mapError(() =>
+      Effect.mapErrorEager(() =>
         ModelProtocolError.make({ message: "Model response part failed canonical encoding" }),
       ),
     );
 
-  const retainedBytes = yield* inspectModelResponsePartCapacity(usage, encoded, limits);
+  const retainedBytes = inspectModelResponsePartCapacity(usage, encoded, limits);
+
+  if (typeof retainedBytes !== "number") return yield* retainedBytes;
 
   if (typeof structuredCloneFunction !== "function") {
     return yield* ModelProtocolError.make({
@@ -1175,17 +1186,15 @@ const captureModelResponsePartGeneral = Effect.fnUntraced(function* <
     });
   }
 
-  const ownedEncoded = yield* Effect.try({
-    try: () => {
-      const cloned: unknown = Reflect.apply(structuredCloneFunction, globalThis, [encoded]);
+  let ownedEncoded: unknown;
 
-      return cloned;
-    },
-    catch: () =>
-      ModelProtocolError.make({
-        message: "Model response part could not be converted into engine-owned data",
-      }),
-  });
+  try {
+    ownedEncoded = Reflect.apply(structuredCloneFunction, globalThis, [encoded]);
+  } catch {
+    return yield* ModelProtocolError.make({
+      message: "Model response part could not be converted into engine-owned data",
+    });
+  }
 
   return { encodedPart: ownedEncoded, retainedBytes };
 });
@@ -1208,49 +1217,51 @@ const decodePrimitiveModelResponsePart = Schema.decodeUnknownEffect(
   ),
 );
 
-/** Reject trailing content before its capture can run an application codec or suspend. */
+/**
+ * Called once by the executing consumer. Pure capture stays in that step; application
+ * codecs may suspend in the same fiber. Reject trailing content before either path.
+ */
 const ownModelResponsePart = <Tools extends Record<string, Tool.Any>>(
   part: unknown,
   toolkit: Toolkit.Toolkit<Tools>,
   usage: ModelResponseBufferUsage,
   limits: EffectiveRunBufferLimits,
   finished: boolean,
-): Effect.Effect<OwnedModelResponsePart, ModelProtocolError> =>
-  Effect.suspend((): Effect.Effect<OwnedModelResponsePart, ModelProtocolError> => {
-    if (finished) {
-      return Effect.fail(
-        ModelProtocolError.make({
-          message: "Model response emitted content after its finish part",
-        }),
-      );
-    }
+): Effect.Effect<OwnedModelResponsePart, ModelProtocolError> => {
+  if (finished) {
+    return Effect.fail(
+      ModelProtocolError.make({
+        message: "Model response emitted content after its finish part",
+      }),
+    );
+  }
 
-    const primitive =
-      usage.responsePartCount < limits.maxModelResponseParts
-        ? capturePrimitiveTextPart(part, limits.maxModelResponseBytes - usage.responsePartBytes)
-        : undefined;
+  const primitive =
+    usage.responsePartCount < limits.maxModelResponseParts
+      ? capturePrimitiveTextPart(part, limits.maxModelResponseBytes - usage.responsePartBytes)
+      : undefined;
+
+  // Complete primitive snapshots need validation, but no defaults or transformation.
+  // Schema.toType retains every constraint from the native Response part schemas.
+  if (primitive !== undefined) {
+    return Effect.mapBothEager(decodePrimitiveModelResponsePart(primitive.part), {
+      onFailure: () =>
+        ModelProtocolError.make({ message: "Model response part failed canonical decoding" }),
+      onSuccess: (ownedPart) => ({ ownedPart, retainedBytes: primitive.retainedBytes }),
+    });
+  }
 
-    // Complete primitive snapshots need validation, but no defaults or transformation.
-    // Schema.toType retains every constraint from the native Response part schemas.
-    if (primitive !== undefined) {
-      return Effect.mapBothEager(decodePrimitiveModelResponsePart(primitive.part), {
+  // Pending application codecs keep normal Effect execution in this same consumer fiber.
+  return Effect.flatMapEager(
+    captureModelResponsePartGeneral(part, toolkit, usage, limits),
+    (captured) =>
+      Effect.mapBothEager(modelResponseParsersFor(toolkit).decode(captured.encodedPart), {
         onFailure: () =>
           ModelProtocolError.make({ message: "Model response part failed canonical decoding" }),
-        onSuccess: (ownedPart) => ({ ownedPart, retainedBytes: primitive.retainedBytes }),
-      });
-    }
-
-    // Pending application codecs keep normal Effect execution in this same consumer fiber.
-    return Effect.flatMapEager(
-      captureModelResponsePartGeneral(part, toolkit, usage, limits),
-      (captured) =>
-        Effect.mapBothEager(modelResponseParsersFor(toolkit).decode(captured.encodedPart), {
-          onFailure: () =>
-            ModelProtocolError.make({ message: "Model response part failed canonical decoding" }),
-          onSuccess: (ownedPart) => ({ ownedPart, retainedBytes: captured.retainedBytes }),
-        }),
-    );
-  });
+        onSuccess: (ownedPart) => ({ ownedPart, retainedBytes: captured.retainedBytes }),
+      }),
+  );
+};
 
 type PartLifecycle = "open" | "closed";
 
@@ -1307,10 +1318,12 @@ const endPart = (
   parts: Map<string, PartLifecycle>,
   id: string,
   description: string,
-): Effect.Effect<void, ModelProtocolError> =>
-  continuePart(parts, id, `${description} end`).pipe(
-    Effect.tap(() => Effect.sync(() => parts.set(id, "closed"))),
-  );
+): Effect.Effect<void, ModelProtocolError> => {
+  if (parts.get(id) !== "open") return continuePart(parts, id, `${description} end`);
+  parts.set(id, "closed");
+
+  return Effect.void;
+};
 
 const firstOpenPart = (trace: TurnTrace): string | undefined => {
   for (const [id, state] of trace.textParts) {
@@ -1663,7 +1676,7 @@ const makeToolFailedEvent = Effect.fnUntraced(function* (
 /**
  * Settle a rejected Tool batch without starting any handler: every open
  * application call receives the encoded failure as its model-visible result.
- * Only budget rejections (RUN-018) are exempt from repeated-failure folding;
+ * Policy and persistence budget rejections are exempt from repeated-failure folding;
  * correctable model declarations count as ordinary failed calls. Emit one
  * `ToolCallFailed` per call with no `ToolCallStarted` (the
  * approval-denied precedent). The caller hands the trace to
@@ -1676,10 +1689,10 @@ const settleRejectedBatch = Effect.fnUntraced(function* (
   context: RunContext,
   turnId: TurnId,
   trace: TurnTrace,
-  error: AgentPolicyError | ModelProtocolError,
+  error: AgentPolicyError | AgentPersistenceCapacityError | ModelProtocolError,
   alreadySettled?: ReadonlySet<string>,
 ): Effect.fn.Return<ReadonlyArray<RunEvent>, ModelProtocolError> {
-  const budgetRejected = error._tag === "AgentPolicyError" ? true : undefined;
+  const budgetRejected = error._tag !== "ModelProtocolError" ? true : undefined;
 
   const encodedResult = {
     _tag: error._tag,
@@ -3349,9 +3362,13 @@ const decodeUsageTotal = Schema.decodeEffect(Schema.Natural);
 const decodeProviderUsage = Schema.decodeEffect(ProviderUsage);
 
 const decodeProviderUsageTotal = (value: number): Effect.Effect<number, ModelProtocolError> =>
-  decodeUsageTotal(value).pipe(Effect.mapError(() => invalidProviderUsage()));
+  decodeUsageTotal(value).pipe(Effect.mapErrorEager(() => invalidProviderUsage()));
 
-const consumeUsage = <AgentValue extends Agent.Any, HookError, HookRequirements>(
+const consumeUsage = Effect.fnUntracedEager(function* <
+  AgentValue extends Agent.Any,
+  HookError,
+  HookRequirements,
+>(
   agent: AgentValue,
   context: RunContext,
   usage: Response.Usage | undefined,
@@ -3362,337 +3379,332 @@ const consumeUsage = <AgentValue extends Agent.Any, HookError, HookRequirements>
     RunCostEstimateRequest,
     "response" | "finishMetadata" | "purpose" | "webSearchCalls"
   > = {},
-): Effect.Effect<
+): Effect.fn.Return<
   ConsumedUsage,
   AgentPolicyError | ModelProtocolError | HookError,
   HookRequirements | Model.ProviderName | Model.ModelName
-> =>
-  Effect.gen(function* () {
-    if (usage === undefined) {
-      return yield* AgentPolicyError.make({
-        limit: "usage",
-        message: "A completed model response did not report usage",
-      });
-    }
+> {
+  if (usage === undefined) {
+    return yield* AgentPolicyError.make({
+      limit: "usage",
+      message: "A completed model response did not report usage",
+    });
+  }
 
-    const webSearchCalls = yield* decodeProviderUsageTotal(response.webSearchCalls ?? 0);
+  const webSearchCalls = yield* decodeProviderUsageTotal(response.webSearchCalls ?? 0);
 
-    const providerUsage = yield* decodeProviderUsage(usage).pipe(
-      Effect.mapError(() => invalidProviderUsage()),
-    );
+  const providerUsage = yield* decodeProviderUsage(usage).pipe(
+    Effect.mapErrorEager(() => invalidProviderUsage()),
+  );
 
-    const reportedUncached = providerUsage.inputTokens.uncached ?? 0;
-    const cacheRead = providerUsage.inputTokens.cacheRead ?? 0;
-    const cacheWrite = providerUsage.inputTokens.cacheWrite ?? 0;
-    const reportedText = providerUsage.outputTokens.text ?? 0;
-    const reasoning = providerUsage.outputTokens.reasoning ?? 0;
-    // Gross token accounting never discounts cache activity. An omitted
-    // aggregate is derived from present components; an omitted component may
-    // receive the aggregate remainder. Explicitly contradictory fields fail.
-    // Some providers include cache writes in `uncached` while also reporting
-    // them separately. Separate that overlap before constructing the canonical,
-    // additive input components, but retain the raw provider usage for pricing.
-    const reportedInputTotal = providerUsage.inputTokens.total;
-    const reportedInputWithoutWrite = reportedUncached + cacheRead;
-
-    const cacheWriteOverlapsUncached =
-      reportedInputTotal !== undefined &&
-      providerUsage.inputTokens.uncached !== undefined &&
-      providerUsage.inputTokens.cacheWrite !== undefined &&
-      cacheWrite <= reportedUncached &&
-      reportedInputWithoutWrite <= reportedInputTotal &&
-      cacheWrite > reportedInputTotal - reportedInputWithoutWrite;
-
-    const disjointReportedUncached =
-      reportedUncached - (cacheWriteOverlapsUncached ? cacheWrite : 0);
-
-    const reportedInputComponents = disjointReportedUncached + cacheRead + cacheWrite;
-
-    const allInputComponentsReported =
-      providerUsage.inputTokens.uncached !== undefined &&
-      providerUsage.inputTokens.cacheRead !== undefined &&
-      providerUsage.inputTokens.cacheWrite !== undefined;
+  const reportedUncached = providerUsage.inputTokens.uncached ?? 0;
+  const cacheRead = providerUsage.inputTokens.cacheRead ?? 0;
+  const cacheWrite = providerUsage.inputTokens.cacheWrite ?? 0;
+  const reportedText = providerUsage.outputTokens.text ?? 0;
+  const reasoning = providerUsage.outputTokens.reasoning ?? 0;
+  // Gross token accounting never discounts cache activity. An omitted
+  // aggregate is derived from present components; an omitted component may
+  // receive the aggregate remainder. Explicitly contradictory fields fail.
+  // Some providers include cache writes in `uncached` while also reporting
+  // them separately. Separate that overlap before constructing the canonical,
+  // additive input components, but retain the raw provider usage for pricing.
+  const reportedInputTotal = providerUsage.inputTokens.total;
+  const reportedInputWithoutWrite = reportedUncached + cacheRead;
+
+  const cacheWriteOverlapsUncached =
+    reportedInputTotal !== undefined &&
+    providerUsage.inputTokens.uncached !== undefined &&
+    providerUsage.inputTokens.cacheWrite !== undefined &&
+    cacheWrite <= reportedUncached &&
+    reportedInputWithoutWrite <= reportedInputTotal &&
+    cacheWrite > reportedInputTotal - reportedInputWithoutWrite;
+
+  const disjointReportedUncached = reportedUncached - (cacheWriteOverlapsUncached ? cacheWrite : 0);
+
+  const reportedInputComponents = disjointReportedUncached + cacheRead + cacheWrite;
+
+  const allInputComponentsReported =
+    providerUsage.inputTokens.uncached !== undefined &&
+    providerUsage.inputTokens.cacheRead !== undefined &&
+    providerUsage.inputTokens.cacheWrite !== undefined;
 
-    if (
-      reportedInputTotal !== undefined &&
-      (reportedInputTotal < reportedInputComponents ||
-        (allInputComponentsReported && reportedInputTotal !== reportedInputComponents))
-    ) {
-      return yield* invalidProviderUsage();
-    }
-    const inputTokens = reportedInputTotal ?? reportedInputComponents;
-    const reportedOutputComponents = reportedText + reasoning;
-    const reportedOutputTotal = providerUsage.outputTokens.total;
+  if (
+    reportedInputTotal !== undefined &&
+    (reportedInputTotal < reportedInputComponents ||
+      (allInputComponentsReported && reportedInputTotal !== reportedInputComponents))
+  ) {
+    return yield* invalidProviderUsage();
+  }
+  const inputTokens = reportedInputTotal ?? reportedInputComponents;
+  const reportedOutputComponents = reportedText + reasoning;
+  const reportedOutputTotal = providerUsage.outputTokens.total;
 
-    const allOutputComponentsReported =
-      providerUsage.outputTokens.text !== undefined &&
-      providerUsage.outputTokens.reasoning !== undefined;
+  const allOutputComponentsReported =
+    providerUsage.outputTokens.text !== undefined &&
+    providerUsage.outputTokens.reasoning !== undefined;
 
-    if (
-      reportedOutputTotal !== undefined &&
-      (reportedOutputTotal < reportedOutputComponents ||
-        (allOutputComponentsReported && reportedOutputTotal !== reportedOutputComponents))
-    ) {
-      return yield* invalidProviderUsage();
-    }
-    const outputTokens = reportedOutputTotal ?? reportedOutputComponents;
-    // When a provider reports only aggregates, classify the unexplained input
-    // conservatively as uncached and non-reasoning output as text when those
-    // fields are absent. If either was explicit, assign the remainder to the
-    // first genuinely omitted component so no provider-supplied value changes.
-    const inputRemainder = inputTokens - reportedInputComponents;
-    const outputRemainder = outputTokens - reportedOutputComponents;
-
-    const uncached =
-      disjointReportedUncached +
-      (providerUsage.inputTokens.uncached === undefined ? inputRemainder : 0);
-
-    const normalizedCacheRead =
-      cacheRead +
-      (providerUsage.inputTokens.uncached !== undefined &&
-      providerUsage.inputTokens.cacheRead === undefined
-        ? inputRemainder
-        : 0);
-
-    const normalizedCacheWrite =
-      cacheWrite +
-      (providerUsage.inputTokens.uncached !== undefined &&
-      providerUsage.inputTokens.cacheRead !== undefined &&
-      providerUsage.inputTokens.cacheWrite === undefined
-        ? inputRemainder
-        : 0);
-
-    const text =
-      reportedText + (providerUsage.outputTokens.text === undefined ? outputRemainder : 0);
-
-    const normalizedReasoning =
-      reasoning +
-      (providerUsage.outputTokens.text !== undefined &&
-      providerUsage.outputTokens.reasoning === undefined
-        ? outputRemainder
-        : 0);
-
-    // Validate the complete additive components before pricing or staging usage.
-    const inputUsage = yield* InputTokenUsage.makeEffect({
-      total: inputTokens,
-      uncached,
-      cacheRead: normalizedCacheRead,
-      cacheWrite: normalizedCacheWrite,
-    }).pipe(Effect.mapError(() => invalidProviderUsage()));
-
-    const outputUsage = yield* OutputTokenUsage.makeEffect({
-      total: outputTokens,
-      text,
-      reasoning: normalizedReasoning,
-    }).pipe(Effect.mapError(() => invalidProviderUsage()));
-
-    const totalTokens = yield* decodeProviderUsageTotal(inputTokens + outputTokens);
-    const provider = yield* Model.ProviderName;
-    const model = yield* Model.ModelName;
-
-    const estimate =
-      options.estimateCostMicrousd === undefined
-        ? 0
-        : yield* options.estimateCostMicrousd(usage, {
-            provider,
-            model,
-            usage,
-            ...response,
-            webSearchCalls,
-          });
+  if (
+    reportedOutputTotal !== undefined &&
+    (reportedOutputTotal < reportedOutputComponents ||
+      (allOutputComponentsReported && reportedOutputTotal !== reportedOutputComponents))
+  ) {
+    return yield* invalidProviderUsage();
+  }
+  const outputTokens = reportedOutputTotal ?? reportedOutputComponents;
+  // When a provider reports only aggregates, classify the unexplained input
+  // conservatively as uncached and non-reasoning output as text when those
+  // fields are absent. If either was explicit, assign the remainder to the
+  // first genuinely omitted component so no provider-supplied value changes.
+  const inputRemainder = inputTokens - reportedInputComponents;
+  const outputRemainder = outputTokens - reportedOutputComponents;
+
+  const uncached =
+    disjointReportedUncached +
+    (providerUsage.inputTokens.uncached === undefined ? inputRemainder : 0);
+
+  const normalizedCacheRead =
+    cacheRead +
+    (providerUsage.inputTokens.uncached !== undefined &&
+    providerUsage.inputTokens.cacheRead === undefined
+      ? inputRemainder
+      : 0);
+
+  const normalizedCacheWrite =
+    cacheWrite +
+    (providerUsage.inputTokens.uncached !== undefined &&
+    providerUsage.inputTokens.cacheRead !== undefined &&
+    providerUsage.inputTokens.cacheWrite === undefined
+      ? inputRemainder
+      : 0);
+
+  const text = reportedText + (providerUsage.outputTokens.text === undefined ? outputRemainder : 0);
+
+  const normalizedReasoning =
+    reasoning +
+    (providerUsage.outputTokens.text !== undefined &&
+    providerUsage.outputTokens.reasoning === undefined
+      ? outputRemainder
+      : 0);
+
+  // Validate the complete additive components before pricing or staging usage.
+  const inputUsage = yield* InputTokenUsage.makeEffect({
+    total: inputTokens,
+    uncached,
+    cacheRead: normalizedCacheRead,
+    cacheWrite: normalizedCacheWrite,
+  }).pipe(Effect.mapErrorEager(() => invalidProviderUsage()));
+
+  const outputUsage = yield* OutputTokenUsage.makeEffect({
+    total: outputTokens,
+    text,
+    reasoning: normalizedReasoning,
+  }).pipe(Effect.mapErrorEager(() => invalidProviderUsage()));
+
+  const totalTokens = yield* decodeProviderUsageTotal(inputTokens + outputTokens);
+  const provider = yield* Model.ProviderName;
+  const model = yield* Model.ModelName;
 
-    const costMicrousd = typeof estimate === "number" ? estimate : estimate.costMicrousd;
+  const estimate =
+    options.estimateCostMicrousd === undefined
+      ? 0
+      : yield* options.estimateCostMicrousd(usage, {
+          provider,
+          model,
+          usage,
+          ...response,
+          webSearchCalls,
+        });
 
-    if (!Number.isSafeInteger(costMicrousd) || costMicrousd < 0) {
-      return yield* AgentPolicyError.make({
-        limit: "cost",
-        message: "Model cost estimation must produce a non-negative integer number of microdollars",
-      });
-    }
-    const serviceTier = typeof estimate === "number" ? undefined : estimate.serviceTier;
-    const pricingVersion = typeof estimate === "number" ? undefined : estimate.pricingVersion;
+  const costMicrousd = typeof estimate === "number" ? estimate : estimate.costMicrousd;
 
-    const pricingStatus =
-      options.estimateCostMicrousd === undefined
-        ? "unknown"
-        : typeof estimate === "number"
-          ? "estimated"
-          : (estimate.pricingStatus ?? "estimated");
+  if (!Number.isSafeInteger(costMicrousd) || costMicrousd < 0) {
+    return yield* AgentPolicyError.make({
+      limit: "cost",
+      message: "Model cost estimation must produce a non-negative integer number of microdollars",
+    });
+  }
+  const serviceTier = typeof estimate === "number" ? undefined : estimate.serviceTier;
+  const pricingVersion = typeof estimate === "number" ? undefined : estimate.pricingVersion;
 
-    const validPricingIdentity = (value: string | undefined): boolean =>
-      value === undefined || (value.length > 0 && value.length <= 256);
+  const pricingStatus =
+    options.estimateCostMicrousd === undefined
+      ? "unknown"
+      : typeof estimate === "number"
+        ? "estimated"
+        : (estimate.pricingStatus ?? "estimated");
 
-    if (!validPricingIdentity(serviceTier) || !validPricingIdentity(pricingVersion)) {
-      return yield* AgentPolicyError.make({
-        limit: "cost",
-        message: "Model cost estimation returned an invalid service tier or pricing version",
-      });
-    }
+  const validPricingIdentity = (value: string | undefined): boolean =>
+    value === undefined || (value.length > 0 && value.length <= 256);
 
-    const modelUsage = ModelCallUsage.make({
-      webSearchCalls,
-      provider,
-      model,
-      ...(response.response === undefined
-        ? {}
-        : { response: ModelResponseIdentity.make(response.response) }),
-      purpose: response.purpose ?? "turn",
-      usageStatus:
-        Object.values(providerUsage.inputTokens).every((value) => value === undefined) &&
-        Object.values(providerUsage.outputTokens).every((value) => value === undefined)
-          ? "unknown"
-          : [
-                providerUsage.inputTokens.uncached,
-                providerUsage.inputTokens.cacheRead,
-                providerUsage.inputTokens.cacheWrite,
-                providerUsage.outputTokens.text,
-                providerUsage.outputTokens.reasoning,
-              ].every((value) => value !== undefined)
-            ? "complete"
-            : "partial",
-      pricingStatus,
-      ...(serviceTier === undefined ? {} : { serviceTier }),
-      ...(pricingVersion === undefined ? {} : { pricingVersion }),
-      inputTokens: inputUsage,
-      outputTokens: outputUsage,
-      costMicrousd,
+  if (!validPricingIdentity(serviceTier) || !validPricingIdentity(pricingVersion)) {
+    return yield* AgentPolicyError.make({
+      limit: "cost",
+      message: "Model cost estimation returned an invalid service tier or pricing version",
     });
+  }
 
-    const modelCalls = yield* decodeProviderUsageTotal(context.modelCalls + 1);
+  const modelUsage = ModelCallUsage.make({
+    webSearchCalls,
+    provider,
+    model,
+    ...(response.response === undefined
+      ? {}
+      : { response: ModelResponseIdentity.make(response.response) }),
+    purpose: response.purpose ?? "turn",
+    usageStatus:
+      Object.values(providerUsage.inputTokens).every((value) => value === undefined) &&
+      Object.values(providerUsage.outputTokens).every((value) => value === undefined)
+        ? "unknown"
+        : [
+              providerUsage.inputTokens.uncached,
+              providerUsage.inputTokens.cacheRead,
+              providerUsage.inputTokens.cacheWrite,
+              providerUsage.outputTokens.text,
+              providerUsage.outputTokens.reasoning,
+            ].every((value) => value !== undefined)
+          ? "complete"
+          : "partial",
+    pricingStatus,
+    ...(serviceTier === undefined ? {} : { serviceTier }),
+    ...(pricingVersion === undefined ? {} : { pricingVersion }),
+    inputTokens: inputUsage,
+    outputTokens: outputUsage,
+    costMicrousd,
+  });
 
-    const cumulativeWebSearchCalls =
-      context.webSearchCalls === undefined
-        ? undefined
-        : yield* decodeProviderUsageTotal(context.webSearchCalls + webSearchCalls);
+  const modelCalls = yield* decodeProviderUsageTotal(context.modelCalls + 1);
 
-    const cumulativeInputTokens = yield* decodeProviderUsageTotal(
-      context.inputTokens + inputTokens,
-    );
+  const cumulativeWebSearchCalls =
+    context.webSearchCalls === undefined
+      ? undefined
+      : yield* decodeProviderUsageTotal(context.webSearchCalls + webSearchCalls);
 
-    const cumulativeOutputTokens = yield* decodeProviderUsageTotal(
-      context.outputTokens + outputTokens,
-    );
+  const cumulativeInputTokens = yield* decodeProviderUsageTotal(context.inputTokens + inputTokens);
 
-    const cumulativeCostMicrousd = context.costMicrousd + costMicrousd;
+  const cumulativeOutputTokens = yield* decodeProviderUsageTotal(
+    context.outputTokens + outputTokens,
+  );
 
-    if (!Number.isSafeInteger(cumulativeCostMicrousd)) {
-      return yield* AgentPolicyError.make({
-        limit: "cost",
-        message: "Cumulative model cost exceeds safe-integer accounting capacity",
-      });
-    }
-    const firstObserved = context.modelCalls === 0 && context.unobservedModelCalls === 0;
+  const cumulativeCostMicrousd = context.costMicrousd + costMicrousd;
 
-    const combineStatus = (
-      prior: typeof UsageCompleteness.Type,
-      next: typeof UsageCompleteness.Type,
-    ) => (firstObserved && prior === "complete" ? next : prior === next ? prior : "partial");
+  if (!Number.isSafeInteger(cumulativeCostMicrousd)) {
+    return yield* AgentPolicyError.make({
+      limit: "cost",
+      message: "Cumulative model cost exceeds safe-integer accounting capacity",
+    });
+  }
+  const firstObserved = context.modelCalls === 0 && context.unobservedModelCalls === 0;
 
-    context.usageStatus = combineStatus(context.usageStatus, modelUsage.usageStatus ?? "unknown");
-    context.pricingStatus = combineStatus(
-      context.pricingStatus,
-      pricingStatus === "estimated" ? "complete" : "unknown",
-    );
-    context.modelCalls = modelCalls;
-    context.webSearchCalls = cumulativeWebSearchCalls;
-    context.inputTokens = cumulativeInputTokens;
-    context.outputTokens = cumulativeOutputTokens;
-    context.lastInputTokens = inputTokens;
-    context.lastOutputTokens = outputTokens;
-    context.costMicrousd = cumulativeCostMicrousd;
-    context.lastCostMicrousd = costMicrousd;
-
-    if (options.durability !== undefined) {
-      // Stage before enforcing hard rails: a response that spends past the
-      // cost/token budget still becomes auditable in its canonical Turn and
-      // terminal settlement.
-      yield* options.durability.noteTurnUsage({ turn, usage: modelUsage });
-    }
+  const combineStatus = (
+    prior: typeof UsageCompleteness.Type,
+    next: typeof UsageCompleteness.Type,
+  ) => (firstObserved && prior === "complete" ? next : prior === next ? prior : "partial");
 
-    const policy = agent.definition.policy;
-    const consumedTokens = context.inputTokens + context.outputTokens;
-    const tokenBudget = policy.tokenBudget;
-    let breach: AgentPolicyError | undefined;
+  context.usageStatus = combineStatus(context.usageStatus, modelUsage.usageStatus ?? "unknown");
+  context.pricingStatus = combineStatus(
+    context.pricingStatus,
+    pricingStatus === "estimated" ? "complete" : "unknown",
+  );
+  context.modelCalls = modelCalls;
+  context.webSearchCalls = cumulativeWebSearchCalls;
+  context.inputTokens = cumulativeInputTokens;
+  context.outputTokens = cumulativeOutputTokens;
+  context.lastInputTokens = inputTokens;
+  context.lastOutputTokens = outputTokens;
+  context.costMicrousd = cumulativeCostMicrousd;
+  context.lastCostMicrousd = costMicrousd;
+
+  if (options.durability !== undefined) {
+    // Stage before enforcing hard rails: a response that spends past the
+    // cost/token budget still becomes auditable in its canonical Turn and
+    // terminal settlement.
+    yield* options.durability.noteTurnUsage({ turn, usage: modelUsage });
+  }
 
-    if (
-      !context.finalizing &&
-      !context.tokenExhausted &&
-      tokenBudget !== undefined &&
-      consumedTokens > tokenBudget
-    ) {
-      breach = AgentPolicyError.make({
-        limit: "tokens",
-        message: `Agent exceeded its ${tokenBudget} token budget`,
+  const policy = agent.definition.policy;
+  const consumedTokens = context.inputTokens + context.outputTokens;
+  const tokenBudget = policy.tokenBudget;
+  let breach: AgentPolicyError | undefined;
+
+  if (
+    !context.finalizing &&
+    !context.tokenExhausted &&
+    tokenBudget !== undefined &&
+    consumedTokens > tokenBudget
+  ) {
+    breach = AgentPolicyError.make({
+      limit: "tokens",
+      message: `Agent exceeded its ${tokenBudget} token budget`,
+    });
+    // Fail mode rejects before any declared application Handler starts.
+    if (policy.onExhaustion === "fail") {
+      return yield* breach;
+    }
+    // One-shot (RUN-025): the flag joins the final-answer derivation so the
+    // grace Turn's own usage accumulates and charges without re-breaching.
+    context.tokenExhausted = true;
+    context.exhaustedDimension ??= "tokens";
+  }
+  // Cost is an unconditional hard rail (runtime spec §3): it is enforced on
+  // every response, including one that just soft-breached the token budget —
+  // a simultaneous breach fails typed instead of soft-landing on overspend.
+  const costBudget = policy.costBudgetMicrousd;
+
+  if (costBudget !== undefined) {
+    if (options.estimateCostMicrousd === undefined) {
+      return yield* AgentPolicyError.make({
+        limit: "cost",
+        message: "Agent cost budget requires a model cost estimator",
       });
-      // Fail mode rejects before any declared application Handler starts.
-      if (policy.onExhaustion === "fail") {
-        return yield* breach;
-      }
-      // One-shot (RUN-025): the flag joins the final-answer derivation so the
-      // grace Turn's own usage accumulates and charges without re-breaching.
-      context.tokenExhausted = true;
-      context.exhaustedDimension ??= "tokens";
     }
-    // Cost is an unconditional hard rail (runtime spec §3): it is enforced on
-    // every response, including one that just soft-breached the token budget —
-    // a simultaneous breach fails typed instead of soft-landing on overspend.
-    const costBudget = policy.costBudgetMicrousd;
-
-    if (costBudget !== undefined) {
-      if (options.estimateCostMicrousd === undefined) {
-        return yield* AgentPolicyError.make({
-          limit: "cost",
-          message: "Agent cost budget requires a model cost estimator",
-        });
-      }
-      if (pricingStatus === "unknown") {
-        return yield* AgentPolicyError.make({
-          limit: "cost",
-          message: "Agent cost budget requires a known model cost estimate",
-        });
-      }
-      if (context.costMicrousd > costBudget) {
-        // Cost is spend, not context: it never earns a grace Turn.
-        return yield* AgentPolicyError.make({
-          limit: "cost",
-          message: `Agent exceeded its ${costBudget} microdollar cost budget`,
-        });
-      }
+    if (pricingStatus === "unknown") {
+      return yield* AgentPolicyError.make({
+        limit: "cost",
+        message: "Agent cost budget requires a known model cost estimate",
+      });
     }
-    if (options.budget !== undefined) {
-      const delta: RunUsageDelta = {
-        modelCalls: 1,
-        inputTokens,
-        outputTokens,
-        totalTokens,
-        toolCalls: toolCallCount,
-        costMicrousd,
-        usage,
-        modelUsage,
-      };
-
-      yield* options.budget.consume(delta);
+    if (context.costMicrousd > costBudget) {
+      // Cost is spend, not context: it never earns a grace Turn.
+      return yield* AgentPolicyError.make({
+        limit: "cost",
+        message: `Agent exceeded its ${costBudget} microdollar cost budget`,
+      });
     }
-    const warnings: Array<RunEvent> | undefined = context.publish === undefined ? undefined : [];
+  }
+  if (options.budget !== undefined) {
+    const delta: RunUsageDelta = {
+      modelCalls: 1,
+      inputTokens,
+      outputTokens,
+      totalTokens,
+      toolCalls: toolCallCount,
+      costMicrousd,
+      usage,
+      modelUsage,
+    };
 
-    if (
-      tokenBudget !== undefined &&
-      !context.warnedLimits.has("tokens") &&
-      nearingLimit(consumedTokens, tokenBudget)
-    ) {
-      context.warnedLimits.add("tokens");
-      warnings?.push(
-        BudgetWarning.make({
-          ...(yield* eventBase(context)),
-          limit: "tokens",
-          consumed: consumedTokens,
-          limitValue: tokenBudget,
-        }),
-      );
-    }
+    yield* options.budget.consume(delta);
+  }
+  const warnings: Array<RunEvent> | undefined = context.publish === undefined ? undefined : [];
 
-    return { breach, warnings: warnings ?? noEvents, modelUsage };
-  });
+  if (
+    tokenBudget !== undefined &&
+    !context.warnedLimits.has("tokens") &&
+    nearingLimit(consumedTokens, tokenBudget)
+  ) {
+    context.warnedLimits.add("tokens");
+    warnings?.push(
+      BudgetWarning.make({
+        ...(yield* eventBase(context)),
+        limit: "tokens",
+        consumed: consumedTokens,
+        limitValue: tokenBudget,
+      }),
+    );
+  }
+
+  return { breach, warnings: warnings ?? noEvents, modelUsage };
+});
 
 // `Effect.fnUntraced`: this helper runs for every streamed Response Part, so a
 // named span here would emit one span per TextDelta/ReasoningDelta. Spans stay
@@ -5765,13 +5777,6 @@ const makeTurn = <
 
       const started = Effect.gen(function* () {
         yield* Metric.update(modelCounter, 1);
-        yield* Effect.logDebug("agent model call started").pipe(
-          Effect.annotateLogs({
-            agentId: context.agentId,
-            runId: context.runId,
-            turnId,
-          }),
-        );
 
         if (context.publish === undefined) return;
 
@@ -5791,7 +5796,7 @@ const makeTurn = <
         ]);
 
         return;
-      }).pipe(Effect.withLogSpan("AgentRuntime.model"));
+      });
 
       // Final-answer mode (RUN-018/RUN-019, extended to tokens by RUN-025):
       // once the Turn, Tool Call, or token budget is
@@ -6548,8 +6553,8 @@ const makeTurn = <
                           activeProvisionalText = provisionalText;
                         }),
                       ),
-                      Stream.runForEachArray((parts) =>
-                        Effect.gen(function* () {
+                      Stream.runForEachArray(
+                        Effect.fnUntracedEager(function* (parts) {
                           for (const part of parts) {
                             const owned = yield* ownModelResponsePart(
                               part,
@@ -7349,9 +7354,10 @@ const makeTurn = <
                     return yield* ModelProtocolError.make({
                       message: "Tool dispatch has no validated response facts",
                     });
+
                   // Idempotency only permits replay of the original operation. Re-asking the
                   // model could choose different arguments or a new key, so it keeps the barrier.
-                  yield* acceptTurnCommit(context, trace, options.durability, {
+                  const admission = yield* acceptTurnCommit(context, trace, options.durability, {
                     _tag: "Response",
                     turn,
                     turnId,
@@ -7370,6 +7376,33 @@ const makeTurn = <
                       ? { defer: true as const }
                       : {}),
                   });
+
+                  if (admission === "capacity-refused") {
+                    const rejection = yield* settleRejectedBatch(
+                      context,
+                      turnId,
+                      trace,
+                      AgentPersistenceCapacityError.make({
+                        message:
+                          "This application tool batch was not dispatched because its durable results exceed available capacity. Retry the needed application tools in smaller batches. Earlier tool results remain valid.",
+                      }),
+                    );
+
+                    return publishEvents(context, rejection).pipe(
+                      Effect.andThen(
+                        toolBatchContinuation(
+                          agent,
+                          context,
+                          trace,
+                          prompt,
+                          turn,
+                          turnId,
+                          toolCalls,
+                          options,
+                        ),
+                      ),
+                    );
+                  }
                 }
 
                 const toolResults = executeToolBatch(
@@ -8839,13 +8872,10 @@ function executeWithCompletion<
 
           const started = Effect.gen(function* () {
             yield* Metric.update(runCounter, 1);
-            yield* Effect.logDebug("agent run started").pipe(
-              Effect.annotateLogs({ agentId: context.agentId, runId: context.runId }),
-            );
             yield* publishEvent(context, () =>
               eventBase(context).pipe(Effect.map((base) => RunStarted.make(base))),
             );
-          }).pipe(Effect.withLogSpan("AgentRuntime.run"));
+          });
 
           const execution = Effect.flatten(
             Effect.gen(function* () {
@@ -9156,6 +9186,7 @@ function executeWithCompletion<
               history,
               preparation,
               agent.definition.policy,
+              DateTime.makeUnsafe(context.durationDeadlineMillis),
               options.subagentGrant,
               options.subagentBudget,
               options.subagentBudgetScope,
@@ -11091,6 +11122,8 @@ const spawnWithParent = (
 export interface AgentSpawnerService {
   /** Resolved defaults for this parent Run; never includes its tools or handlers. */
   readonly policy: AgentPolicy;
+  /** Effective deadline of this active parent execution, including RunOptions.durationDeadline. */
+  readonly durationDeadline: DateTime.Utc;
   readonly depth: number;
   readonly grant?: SubagentGrant;
   readonly budget?: SubagentBudgetReservation;
@@ -11199,6 +11232,7 @@ const makeAgentSpawner = (
   history: ThreadHistory["Service"],
   preparation: RunContextPreparation["Service"],
   policy: AgentPolicy,
+  durationDeadline: DateTime.Utc,
   grant?: SubagentGrant,
   budget?: SubagentBudgetReservation,
   budgetScope?: WorkerBudgetScope,
@@ -11208,6 +11242,7 @@ const makeAgentSpawner = (
   ...(budget === undefined ? {} : { budget }),
   ...(budgetScope === undefined ? {} : { budgetScope }),
   policy,
+  durationDeadline,
   depth,
   parent,
   spawn: spawnWithParent(parent, depth, history, preparation, onChild),