@zachwill/pi-orchestrate 0.8.0 → 0.9.2

package/extension/runtime.ts

@@ -1,49 +1,53 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
 import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
-import { Effect, Option } from "effect";
+import {
+  Cause,
+  Clock,
+  Context,
+  Deferred,
+  Effect,
+  Exit,
+  Fiber,
+  FiberMap,
+  FiberSet,
+  Layer,
+  Schema,
+} from "effect";
 import {
   CANCELLATION_GRACE_MS,
   EMPTY_WORKER_USAGE,
   MAX_WORKER_INSTRUCTIONS_LENGTH,
   MAX_WORKER_TITLE_LENGTH,
+  OrchestrateTaskInput,
+  RunId,
+  WorkerId,
   createRandomIdFactories,
   findWorkerByName,
   isTerminalWorkerStatus,
   transitionWorkerStatus,
   type OrchestrateIdFactories,
-  type OrchestrateTaskInput,
-  type RunId,
   type RunMode,
   type RunRecord,
   type WorkerCatalog,
   type WorkerDefinition,
-  type WorkerId,
   type WorkerOutcome,
   type WorkerRecord,
   type WorkerUsage,
 } from "./domain.js";
 import {
-  createWorkflowScheduler,
-  type WorkflowScheduler,
-} from "./scheduler.js";
-import {
-  resolveWorkerModel,
-  type WorkerSessionFactory,
+  ChildSessions,
+  type ChildSessionsService,
+  type WorkerSessionAbortError,
   type WorkerSessionHandle,
+  type WorkerSessionObservation,
 } from "./worker-session.js";
 import type {
   SettlementFailureStage,
   WorkerSettlement,
 } from "./worker-settlement.js";
 
-export type {
-  SettlementFailureStage,
-  WorkerSettlement,
-} from "./worker-settlement.js";
-
 export const MAX_TERMINAL_WORKER_HISTORY = 100;
 export const MAX_COMPLETED_RUN_HISTORY = 100;
-/** Shutdown waits this long for interrupted bootstrap/prompt promises, then returns best-effort. */
 export const SHUTDOWN_CLEANUP_GRACE_MS = CANCELLATION_GRACE_MS;
 
 export interface OrchestrationContext {
@@ -92,433 +96,679 @@ export interface RuntimeSnapshot {
 
 export type SettlementListener = (settlement: WorkerSettlement) => void;
 export type UnsubscribeSettlement = () => void;
-export type StateListener = (ownerSessionId: string) => void;
-
-export type AbortTarget =
-  | {
-      readonly workerIds: readonly WorkerId[];
-      readonly all?: never;
-    }
-  | {
-      readonly all: true;
-      readonly workerIds?: never;
-    };
+export type StateListener = (snapshot: RuntimeSnapshot) => void;
 
-export type DeadlineResult = "settled" | "timed-out";
-
-export interface BestEffortDeadline {
-  wait(promise: Promise<unknown>, timeoutMs: number): Promise<DeadlineResult>;
+export interface AbortTarget {
+  readonly workerIds?: readonly string[];
+  readonly all?: boolean;
 }
 
-export interface OrchestratorRuntimeOptions {
-  readonly workerSessionFactory: WorkerSessionFactory;
+export interface OrchestrationLayerOptions {
   readonly idFactories?: OrchestrateIdFactories;
-  readonly clock?: () => number;
-  readonly scheduler?: WorkflowScheduler<WorkerId>;
-  readonly bestEffortDeadline?: BestEffortDeadline;
 }
 
-export interface OrchestratorRuntime {
+const OrchestrationOperation = Schema.Literals([
+  "orchestrate",
+  "sendInteractive",
+  "abort",
+  "closeInteractive",
+  "snapshot",
+]);
+type OrchestrationOperation = typeof OrchestrationOperation.Type;
+
+const OrchestrationRejectionReason = Schema.Literals([
+  "shutdown",
+  "validation",
+  "ownership",
+  "target",
+  "worker-state",
+  "unknown-worker",
+  "model-unavailable",
+]);
+type OrchestrationRejectionReason = typeof OrchestrationRejectionReason.Type;
+
+export class OrchestrationActionRejected extends Schema.TaggedError<OrchestrationActionRejected>()(
+  "Orchestration.ActionRejected",
+  {
+    operation: OrchestrationOperation,
+    reason: OrchestrationRejectionReason,
+    message: Schema.String,
+  },
+) {}
+
+export interface OrchestrationService {
   orchestrate(
     context: OrchestrationContext,
     task: OrchestrateTaskInput,
     mode: "async",
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun>;
+  ): Effect.Effect<AcceptedRun, OrchestrationActionRejected>;
   orchestrate(
     context: OrchestrationContext,
     task: OrchestrateTaskInput,
     mode: "inline",
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<CompletedRun>;
+  ): Effect.Effect<CompletedRun, OrchestrationActionRejected>;
   orchestrate(
     context: OrchestrationContext,
     task: OrchestrateTaskInput,
     mode: RunMode,
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun | CompletedRun>;
+  ): Effect.Effect<AcceptedRun | CompletedRun, OrchestrationActionRejected>;
   sendInteractive(
     context: OrchestrationContext,
-    workerId: WorkerId,
+    workerId: string,
     instructions: string,
     mode: "async",
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun>;
+  ): Effect.Effect<AcceptedRun, OrchestrationActionRejected>;
   sendInteractive(
     context: OrchestrationContext,
-    workerId: WorkerId,
+    workerId: string,
     instructions: string,
     mode: "inline",
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<CompletedRun>;
+  ): Effect.Effect<CompletedRun, OrchestrationActionRejected>;
   sendInteractive(
     context: OrchestrationContext,
-    workerId: WorkerId,
+    workerId: string,
     instructions: string,
     mode: RunMode,
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun | CompletedRun>;
-  abort(ownerSessionId: string, target: AbortTarget): Promise<void>;
-  closeInteractive(ownerSessionId: string, workerId: WorkerId): Promise<void>;
-  snapshot(ownerSessionId: string): Promise<RuntimeSnapshot>;
-  subscribeSettlement(listener: SettlementListener): UnsubscribeSettlement;
-  subscribeState(listener: StateListener): () => void;
-  shutdown(): Promise<void>;
+  ): Effect.Effect<AcceptedRun | CompletedRun, OrchestrationActionRejected>;
+  readonly abort: (
+    ownerSessionId: string,
+    target: AbortTarget,
+  ) => Effect.Effect<void, OrchestrationActionRejected>;
+  readonly closeInteractive: (
+    ownerSessionId: string,
+    workerId: string,
+  ) => Effect.Effect<void, OrchestrationActionRejected>;
+  readonly snapshot: (
+    ownerSessionId: string,
+  ) => Effect.Effect<RuntimeSnapshot, OrchestrationActionRejected>;
+  readonly subscribeSettlement: (
+    listener: SettlementListener,
+  ) => UnsubscribeSettlement;
+  readonly subscribeState: (
+    ownerSessionId: string,
+    listener: StateListener,
+  ) => () => void;
+  readonly shutdown: () => Effect.Effect<void>;
 }
 
-interface RuntimeEntry {
+export class Orchestration extends Context.Service<Orchestration, OrchestrationService>()(
+  "@zachwill/pi-orchestrate/Orchestration",
+) {}
+
+interface RuntimeWorker {
+  readonly record: WorkerRecord;
   readonly context: OrchestrationContext;
   readonly definition: WorkerDefinition;
-  generation: number;
-  session?: WorkerSessionHandle;
-  unsubscribeUsage?: () => void;
-  unsubscribeActivity?: () => void;
-  unsubscribeMessageDirection?: () => void;
+  // Worker-local authority fence; stale asynchronous callbacks must revalidate it.
+  readonly generation: number;
+  readonly session?: WorkerSessionHandle;
+  readonly observationRelease?: () => void;
+  readonly cancellation?: Deferred.Deferred<void>;
 }
 
-interface RunWaiter {
-  readonly promise: Promise<CompletedRun>;
-  settled: boolean;
-  onSettled?: () => void;
-  resolve(run: CompletedRun): void;
+interface RunningRuntimeRun {
+  readonly _tag: "running";
+  readonly record: RunRecord;
+  readonly completion: Deferred.Deferred<CompletedRun>;
+  readonly settlementListener?: SettlementListener;
 }
 
-const defaultBestEffortDeadline: BestEffortDeadline = {
-  wait(promise, timeoutMs) {
-    const settled = Effect.promise(() => promise.then(
-      () => "settled" as const,
-      () => "settled" as const,
-    ));
-    return Effect.runPromise(
-      settled.pipe(
-        Effect.timeoutOption(timeoutMs),
-        Effect.map((result) => Option.getOrElse(result, () => "timed-out" as const)),
-      ),
-    );
-  },
-};
-
-class DefaultOrchestratorRuntime implements OrchestratorRuntime {
-  private readonly workerSessionFactory: WorkerSessionFactory;
-  private readonly idFactories: OrchestrateIdFactories;
-  private readonly clock: () => number;
-  private readonly scheduler: WorkflowScheduler<WorkerId>;
-  private readonly bestEffortDeadline: BestEffortDeadline;
-  private readonly workers = new Map<WorkerId, WorkerRecord>();
-  private readonly runs = new Map<RunId, RunRecord>();
-  private readonly entries = new Map<WorkerId, RuntimeEntry>();
-  private readonly runWaiters = new Map<RunId, RunWaiter>();
-  private readonly completedRuns = new Map<RunId, CompletedRun>();
-  private readonly cancellationPromises = new Map<WorkerId, Promise<void>>();
-  private readonly cleanupOperations = new Set<Promise<void>>();
-  private readonly terminalWorkerOrder: WorkerId[] = [];
-  private readonly completedRunOrder: RunId[] = [];
+type RuntimeRun = RunningRuntimeRun | RunRecord;
+type RuntimeLifecycle = "open" | "shutting-down" | "shutdown";
+
+interface RuntimeState {
+  workers: Map<WorkerId, RuntimeWorker>;
+  runs: Map<RunId, RuntimeRun>;
+  terminalWorkerOrder: WorkerId[];
+  completedRunOrder: RunId[];
+  settlementSequence: number;
+  lifecycle: RuntimeLifecycle;
+}
+
+type CommittedAction = () => void;
+type PostCommitAction = (
+  state: RuntimeState,
+  settlementListeners: ReadonlySet<SettlementListener>,
+  stateListeners: ReadonlyMap<string, ReadonlySet<StateListener>>,
+) => CommittedAction;
+
+interface TransactionMutation<A> {
+  readonly value: A;
+  readonly actions?: readonly PostCommitAction[];
+}
+
+type Decision<A> =
+  | {
+      readonly _tag: "accepted";
+      readonly value: A;
+    }
+  | {
+      readonly _tag: "rejected";
+      readonly error: OrchestrationActionRejected;
+    };
+
+class StatefulOrchestration implements OrchestrationService {
+  private readonly actionQueue: CommittedAction[] = [];
   private readonly settlementListeners = new Set<SettlementListener>();
-  private readonly runSettlementListeners = new Map<RunId, SettlementListener>();
-  private readonly stateListeners = new Set<StateListener>();
-  private settlementSequence = 0;
-  private readonly disposedSessions = new WeakSet<WorkerSessionHandle>();
-  private shuttingDown = false;
-  private shutdownPromise: Promise<void> | undefined;
-
-  constructor(options: OrchestratorRuntimeOptions) {
-    this.workerSessionFactory = options.workerSessionFactory;
-    this.idFactories = options.idFactories ?? createRandomIdFactories();
-    this.clock = options.clock ?? Date.now;
-    this.scheduler = options.scheduler ?? createWorkflowScheduler<WorkerId>();
-    this.bestEffortDeadline = options.bestEffortDeadline ?? defaultBestEffortDeadline;
+  private readonly stateListeners = new Map<string, Set<StateListener>>();
+  private drainingActions = false;
+  private state: RuntimeState;
+
+  constructor(
+    private readonly childSessions: ChildSessionsService,
+    private readonly generations: FiberMap.FiberMap<WorkerId, void, never>,
+    private readonly runGeneration: (
+      key: WorkerId,
+      effect: Effect.Effect<void, never>,
+    ) => Fiber.Fiber<void, never>,
+    private readonly cancellations: FiberSet.FiberSet<void, never>,
+    private readonly runCancellation: (
+      effect: Effect.Effect<void, never>,
+    ) => Fiber.Fiber<void, never>,
+    private readonly cleanups: FiberSet.FiberSet<void, never>,
+    private readonly clock: Clock.Clock,
+    private readonly idFactories: OrchestrateIdFactories,
+    private readonly shutdownCompletion: Deferred.Deferred<void>,
+  ) {
+    this.state = initialState();
   }
 
   orchestrate(
     context: OrchestrationContext,
     task: OrchestrateTaskInput,
     mode: "async",
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun>;
+  ): Effect.Effect<AcceptedRun, OrchestrationActionRejected>;
   orchestrate(
     context: OrchestrationContext,
     task: OrchestrateTaskInput,
     mode: "inline",
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<CompletedRun>;
+  ): Effect.Effect<CompletedRun, OrchestrationActionRejected>;
   orchestrate(
     context: OrchestrationContext,
     task: OrchestrateTaskInput,
     mode: RunMode,
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun | CompletedRun>;
-  async orchestrate(
+  ): Effect.Effect<AcceptedRun | CompletedRun, OrchestrationActionRejected>;
+  orchestrate(
     context: OrchestrationContext,
     task: OrchestrateTaskInput,
     mode: RunMode,
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun | CompletedRun> {
-    this.assertOpen();
-    throwIfAborted(signal);
-    const definition = this.validateTask(context, task, mode);
-
-    const runId = this.idFactories.runId();
-    const workerId = this.idFactories.workerId();
-    this.assertFreshIds(runId, workerId);
-
-    const run: RunRecord = {
-      id: runId,
-      ownerSessionId: context.ownerSessionId,
-      workerId,
-      mode,
-      state: "running",
-      createdAt: this.clock(),
-      ...(context.synthesisGroup
-        ? {
-            synthesisGroupId: context.synthesisGroup.id,
-            synthesisGroupSize: context.synthesisGroup.size,
-          }
-        : {}),
-    };
-    const record: WorkerRecord = {
-      id: workerId,
-      worker: definition.name,
-      ownerSessionId: context.ownerSessionId,
-      runId,
-      title: task.title,
-      instructions: task.instructions,
-      lifecycle: definition.lifecycle,
-      status: "starting",
-      usage: copyUsage(EMPTY_WORKER_USAGE),
-      messageDirection: "to-model",
-      startedAt: this.clock(),
-    };
+  ): Effect.Effect<AcceptedRun | CompletedRun, OrchestrationActionRejected> {
+    return Effect.fn("Orchestration.orchestrate")(function* (
+      this: StatefulOrchestration,
+    ) {
+      const validated = yield* this.validateTask(context, task, mode);
+      const preflight = this.preflightOpen("orchestrate");
+      if (preflight._tag === "rejected") yield* Effect.fail(preflight.error);
+      // Keep user-supplied ID factories outside the transaction: a reentrant
+      // factory cannot commit an outer stale draft. Admission rechecks all
+      // authority below, so a race may burn an ID but cannot create a run.
+      const runId = this.idFactories.runId();
+      const workerId = this.idFactories.workerId();
+      const completion = yield* Deferred.make<CompletedRun>();
+      const now = this.clock.currentTimeMillisUnsafe();
+      const runRecord = makeRunRecord(runId, workerId, context, mode, now);
+      const workerRecord = makeWorkerRecord(
+        workerId,
+        runId,
+        context.ownerSessionId,
+        validated.definition,
+        validated.task,
+        now,
+      );
 
-    const waiter = makeRunWaiter();
-    this.runs.set(runId, run);
-    this.runWaiters.set(runId, waiter);
-    if (onSettlement) this.runSettlementListeners.set(runId, onSettlement);
-    this.workers.set(workerId, record);
-    this.entries.set(workerId, { context, definition, generation: 1 });
-    this.emitState(context.ownerSessionId);
-    this.launchBootstrap(workerId, 1);
-
-    if (mode === "inline") {
-      return this.awaitInlineRun(run, waiter, signal);
-    }
-    return freezeAcceptedRun(runId, workerId);
+      const admission = this.transact((draft) => {
+        const open = openDecision(draft, "orchestrate");
+        if (open._tag === "rejected") return { value: open };
+        if (draft.runs.has(runId)) throw new Error(`Duplicate run ID: ${runId}`);
+        if (draft.workers.has(workerId)) {
+          throw new Error(`Duplicate worker ID: ${workerId}`);
+        }
+
+        draft.runs.set(runId, {
+          _tag: "running",
+          record: runRecord,
+          completion,
+          ...(onSettlement ? { settlementListener: onSettlement } : {}),
+        });
+        draft.workers.set(workerId, {
+          record: workerRecord,
+          context,
+          definition: validated.definition,
+          generation: 1,
+        });
+
+        return {
+          value: accepted(undefined),
+          actions: [
+            publishState(context.ownerSessionId),
+            runAction(() => this.launchBootstrap(workerId, 1)),
+          ],
+        };
+      });
+      if (admission._tag === "rejected") return yield* Effect.fail(admission.error);
+
+      if (mode === "inline") {
+        return yield* this.awaitInlineRun(runRecord, completion);
+      }
+      return freezeAcceptedRun(runId, workerId);
+    }).call(this);
   }
 
   sendInteractive(
     context: OrchestrationContext,
-    workerId: WorkerId,
+    workerId: string,
     instructions: string,
     mode: "async",
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun>;
+  ): Effect.Effect<AcceptedRun, OrchestrationActionRejected>;
   sendInteractive(
     context: OrchestrationContext,
-    workerId: WorkerId,
+    workerId: string,
     instructions: string,
     mode: "inline",
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<CompletedRun>;
+  ): Effect.Effect<CompletedRun, OrchestrationActionRejected>;
   sendInteractive(
     context: OrchestrationContext,
-    workerId: WorkerId,
+    workerId: string,
     instructions: string,
     mode: RunMode,
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun | CompletedRun>;
-  async sendInteractive(
+  ): Effect.Effect<AcceptedRun | CompletedRun, OrchestrationActionRejected>;
+  sendInteractive(
     context: OrchestrationContext,
-    workerId: WorkerId,
+    workerId: string,
     instructions: string,
     mode: RunMode,
-    signal?: AbortSignal,
     onSettlement?: SettlementListener,
-  ): Promise<AcceptedRun | CompletedRun> {
-    this.assertOpen();
-    throwIfAborted(signal);
-    validateContextOwner(context.ownerSessionId);
-    validateMode(mode);
-    validateText("instructions", instructions, MAX_WORKER_INSTRUCTIONS_LENGTH);
-
-    const current = this.ownedWorker(context.ownerSessionId, workerId);
-    if (current.lifecycle !== "interactive" || current.status !== "ready") {
-      throw new Error("interactive_send requires an owned ready interactive worker");
-    }
-    const entry = this.entries.get(workerId);
-    if (!entry?.session) throw new Error("Ready interactive worker has no session handle");
-
-    const runId = this.idFactories.runId();
-    if (this.runs.has(runId)) throw new Error(`Duplicate run ID: ${runId}`);
-    const run: RunRecord = {
-      id: runId,
-      ownerSessionId: context.ownerSessionId,
-      workerId,
-      mode,
-      state: "running",
-      createdAt: this.clock(),
-    };
-    const running: WorkerRecord = {
-      ...transitionWorkerStatus(current, "running"),
-      runId,
-      instructions,
-      activity: undefined,
-      messageDirection: "to-model",
-      startedAt: this.clock(),
-      settledAt: undefined,
-    };
-    const waiter = makeRunWaiter();
-
-    entry.generation += 1;
-    const generation = entry.generation;
-    this.runs.set(runId, run);
-    this.runWaiters.set(runId, waiter);
-    if (onSettlement) this.runSettlementListeners.set(runId, onSettlement);
-    this.workers.set(workerId, running);
-    this.subscribeEntryObservability(workerId, entry, entry.session, generation);
-    this.emitState(context.ownerSessionId);
-    this.launchPrompt(workerId, generation, entry.session, instructions);
-
-    if (mode === "inline") {
-      return this.awaitInlineRun(run, waiter, signal);
-    }
-    return freezeAcceptedRun(runId, workerId);
+  ): Effect.Effect<AcceptedRun | CompletedRun, OrchestrationActionRejected> {
+    return Effect.fn("Orchestration.sendInteractive")(function* (
+      this: StatefulOrchestration,
+    ) {
+      yield* validateContextOwner("sendInteractive", context.ownerSessionId);
+      yield* validateMode("sendInteractive", mode);
+      yield* validateText(
+        "sendInteractive",
+        "instructions",
+        instructions,
+        MAX_WORKER_INSTRUCTIONS_LENGTH,
+      );
+      const validatedWorkerId = yield* validateWorkerId(
+        "sendInteractive",
+        workerId,
+      );
+      const preflight = this.preflightReadyInteractive(
+        context.ownerSessionId,
+        validatedWorkerId,
+      );
+      if (preflight._tag === "rejected") yield* Effect.fail(preflight.error);
+      // See orchestrate: allocation remains outside copy-on-write reducers so
+      // reentrant factories cannot invalidate transaction atomicity.
+      const runId = this.idFactories.runId();
+      const completion = yield* Deferred.make<CompletedRun>();
+      const now = this.clock.currentTimeMillisUnsafe();
+      const runRecord: RunRecord = {
+        id: runId,
+        ownerSessionId: context.ownerSessionId,
+        workerId: validatedWorkerId,
+        mode,
+        state: "running",
+        createdAt: now,
+      };
+
+      const admission = this.transact((draft) => {
+        const ready = readyInteractiveDecision(
+          draft,
+          context.ownerSessionId,
+          validatedWorkerId,
+        );
+        if (ready._tag === "rejected") return { value: ready };
+        if (draft.runs.has(runId)) throw new Error(`Duplicate run ID: ${runId}`);
+
+        const { worker, session } = ready.value;
+        const generation = worker.generation + 1;
+        const runningRecord: WorkerRecord = {
+          ...transitionWorkerStatus(worker.record, "running"),
+          runId,
+          instructions,
+          activity: undefined,
+          messageDirection: "to-model",
+          startedAt: now,
+          settledAt: undefined,
+        };
+        draft.runs.set(runId, {
+          _tag: "running",
+          record: runRecord,
+          completion,
+          ...(onSettlement ? { settlementListener: onSettlement } : {}),
+        });
+        draft.workers.set(validatedWorkerId, {
+          ...worker,
+          record: runningRecord,
+          generation,
+          observationRelease: undefined,
+          cancellation: undefined,
+        });
+
+        return {
+          value: accepted(undefined),
+          actions: [
+            runAction(() => {
+              safelyCall(worker.observationRelease);
+              this.subscribeObservation(validatedWorkerId, generation, session);
+            }),
+            publishState(context.ownerSessionId),
+            runAction(() => {
+              this.launchPrompt(
+                validatedWorkerId,
+                generation,
+                session,
+                instructions,
+              );
+            }),
+          ],
+        };
+      });
+      if (admission._tag === "rejected") return yield* Effect.fail(admission.error);
+
+      if (mode === "inline") {
+        return yield* this.awaitInlineRun(runRecord, completion);
+      }
+      return freezeAcceptedRun(runId, validatedWorkerId);
+    }).call(this);
   }
 
-  async abort(ownerSessionId: string, target: AbortTarget): Promise<void> {
-    this.assertOpen();
-    validateContextOwner(ownerSessionId);
-    const targets = this.resolveAbortTargets(ownerSessionId, target);
-    await this.cancelWorkers(targets);
+  abort(
+    ownerSessionId: string,
+    target: AbortTarget,
+  ): Effect.Effect<void, OrchestrationActionRejected> {
+    return Effect.fn("Orchestration.abort")(function* (
+      this: StatefulOrchestration,
+    ) {
+      yield* validateContextOwner("abort", ownerSessionId);
+      const validatedTarget = yield* validateAbortTarget(target);
+      const candidateIds = validatedTarget._tag === "ids"
+        ? validatedTarget.workerIds
+        : activeWorkerIds(this.current(), ownerSessionId);
+      const candidates = yield* makeCancellationCandidates(candidateIds);
+      const cancellation = this.beginCancellation(
+        "abort",
+        ownerSessionId,
+        validatedTarget,
+        candidates,
+      );
+      if (cancellation._tag === "rejected") {
+        return yield* Effect.fail(cancellation.error);
+      }
+      yield* awaitAll(cancellation.value);
+    }).call(this);
   }
 
-  async closeInteractive(ownerSessionId: string, workerId: WorkerId): Promise<void> {
-    this.assertOpen();
-    validateContextOwner(ownerSessionId);
-    const current = this.ownedWorker(ownerSessionId, workerId);
-    if (current.lifecycle !== "interactive" || current.status !== "ready") {
-      throw new Error("interactive_close requires an owned ready interactive worker");
-    }
-    this.closeReadyInteractiveWorker(current);
+  closeInteractive(
+    ownerSessionId: string,
+    workerId: string,
+  ): Effect.Effect<void, OrchestrationActionRejected> {
+    return Effect.fn("Orchestration.closeInteractive")(function* (
+      this: StatefulOrchestration,
+    ) {
+      yield* validateContextOwner("closeInteractive", ownerSessionId);
+      const id = yield* validateWorkerId("closeInteractive", workerId);
+      const now = this.clock.currentTimeMillisUnsafe();
+      const decision = this.transact((draft) => {
+        const open = openDecision(draft, "closeInteractive");
+        if (open._tag === "rejected") return { value: open };
+        const ownership = ownedWorkerDecision(
+          draft,
+          "closeInteractive",
+          ownerSessionId,
+          id,
+        );
+        if (ownership._tag === "rejected") return { value: ownership };
+        if (
+          ownership.value.record.lifecycle !== "interactive" ||
+          ownership.value.record.status !== "ready"
+        ) {
+          return {
+            value: rejected(
+              "closeInteractive",
+              "worker-state",
+              "interactive_close requires an owned ready interactive worker",
+            ),
+          };
+        }
+        const actions = this.closeReadyWorker(draft, ownership.value, now);
+        actions.push(...stateActionsAfterPrune(draft, ownerSessionId));
+        return {
+          value: accepted(undefined),
+          actions,
+        };
+      });
+      if (decision._tag === "rejected") yield* Effect.fail(decision.error);
+    }).call(this);
   }
 
-  async snapshot(ownerSessionId: string): Promise<RuntimeSnapshot> {
-    validateContextOwner(ownerSessionId);
-    const runs = [...this.runs.values()]
-      .filter((run) => run.ownerSessionId === ownerSessionId)
-      .map(copyRunRecord);
-    const workers = [...this.workers.values()]
-      .filter((worker) => worker.ownerSessionId === ownerSessionId)
-      .map(copyWorkerRecord);
-    return Object.freeze({
-      runs: Object.freeze(runs),
-      workers: Object.freeze(workers),
-    });
+  snapshot(
+    ownerSessionId: string,
+  ): Effect.Effect<RuntimeSnapshot, OrchestrationActionRejected> {
+    return validateContextOwner("snapshot", ownerSessionId).pipe(
+      Effect.andThen(Effect.sync(() => snapshotFor(this.current(), ownerSessionId))),
+    );
   }
 
   subscribeSettlement(listener: SettlementListener): UnsubscribeSettlement {
-    if (typeof listener !== "function") throw new Error("Settlement listener must be a function");
+    if (typeof listener !== "function") {
+      throw new Error("Settlement listener must be a function");
+    }
+    if (this.state.lifecycle !== "open") return noOp;
     this.settlementListeners.add(listener);
-    let subscribed = true;
+
+    let active = true;
     return () => {
-      if (!subscribed) return;
-      subscribed = false;
+      if (!active) return;
+      active = false;
       this.settlementListeners.delete(listener);
     };
   }
 
-  subscribeState(listener: StateListener): () => void {
-    if (typeof listener !== "function") throw new Error("State listener must be a function");
-    this.stateListeners.add(listener);
-    let subscribed = true;
+  subscribeState(ownerSessionId: string, listener: StateListener): () => void {
+    if (typeof ownerSessionId !== "string" || ownerSessionId.trim() === "") {
+      throw new Error("ownerSessionId must not be blank");
+    }
+    if (typeof listener !== "function") {
+      throw new Error("State listener must be a function");
+    }
+
+    if (this.state.lifecycle !== "open") return noOp;
+    const ownerListeners = this.stateListeners.get(ownerSessionId) ?? new Set();
+    ownerListeners.add(listener);
+    this.stateListeners.set(ownerSessionId, ownerListeners);
+    this.enqueueActions([
+      publishStateTo(ownerSessionId, listener)(
+        this.state,
+        this.settlementListeners,
+        this.stateListeners,
+      ),
+    ]);
+
+    let active = true;
     return () => {
-      if (!subscribed) return;
-      subscribed = false;
-      this.stateListeners.delete(listener);
+      if (!active) return;
+      active = false;
+      ownerListeners.delete(listener);
+      if (ownerListeners.size === 0) this.stateListeners.delete(ownerSessionId);
     };
   }
 
-  shutdown(): Promise<void> {
-    if (this.shutdownPromise) return this.shutdownPromise;
-    this.shuttingDown = true;
-    this.shutdownPromise = this.performShutdown();
-    return this.shutdownPromise;
+  /** Calling shutdown closes admission synchronously, before the returned Effect runs. */
+  shutdown(): Effect.Effect<void> {
+    const first = this.transact((draft) => {
+      if (draft.lifecycle !== "open") return { value: false };
+      draft.lifecycle = "shutting-down";
+      return { value: true };
+    });
+    if (!first) return Deferred.await(this.shutdownCompletion);
+
+    return this.performShutdown().pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          this.transact((draft) => {
+            draft.lifecycle = "shutdown";
+            for (const [runId, run] of draft.runs) {
+              if (isRunningRuntimeRun(run) && run.settlementListener) {
+                draft.runs.set(runId, { ...run, settlementListener: undefined });
+              }
+            }
+            return { value: undefined };
+          });
+          this.settlementListeners.clear();
+          this.stateListeners.clear();
+          Deferred.doneUnsafe(this.shutdownCompletion, Effect.void);
+        }),
+      ),
+    );
   }
 
-  private async performShutdown(): Promise<void> {
-    try {
-      this.closeReadyInteractiveWorkersForShutdown();
-      const active = [...this.workers.values()]
-        .filter((worker) => isActiveWorkerStatus(worker.status))
-        .map((worker) => worker.id);
-      await this.cancelWorkers(active);
-    } finally {
-      try {
-        await this.scheduler.close();
-      } catch {
-        // Scheduler closure is best-effort during process shutdown.
-      } finally {
-        await this.awaitTrackedCleanupBestEffort();
-        this.runSettlementListeners.clear();
-        this.settlementListeners.clear();
-        this.stateListeners.clear();
-      }
-    }
+  private performShutdown(): Effect.Effect<void> {
+    return Effect.fn("Orchestration.shutdown")(function* (
+      this: StatefulOrchestration,
+    ) {
+      const now = this.clock.currentTimeMillisUnsafe();
+      this.transact((draft) => {
+        const owners = new Set<string>();
+        const actions: PostCommitAction[] = [];
+        for (const worker of draft.workers.values()) {
+          if (
+            worker.record.lifecycle === "interactive" &&
+            worker.record.status === "ready"
+          ) {
+            this.closeReadyWorker(draft, worker, now, actions);
+            owners.add(worker.record.ownerSessionId);
+          }
+        }
+        addAll(owners, pruneHistory(draft));
+        actions.push(...publishOwners(owners));
+        return { value: undefined, actions };
+      });
+
+      const activeIds = activeWorkerIds(this.current());
+      const candidates = yield* makeCancellationCandidates(activeIds);
+      const cancellations = this.beginShutdownCancellation(candidates);
+      yield* awaitAll(cancellations);
+      yield* this.childSessions.shutdown().pipe(Effect.catchCause(() => Effect.void));
+      yield* FiberSet.awaitEmpty(this.cleanups).pipe(
+        Effect.timeoutOption(SHUTDOWN_CLEANUP_GRACE_MS),
+        Effect.ignore,
+      );
+    }).call(this);
   }
 
   private validateTask(
     context: OrchestrationContext,
     task: OrchestrateTaskInput,
     mode: RunMode,
-  ): WorkerDefinition {
-    validateContextOwner(context.ownerSessionId);
-    validateMode(mode);
-    if (!task || typeof task !== "object" || Array.isArray(task)) {
-      throw new Error("orchestrate requires one task object");
-    }
-    if (context.synthesisGroup) {
-      validateText("synthesis group ID", context.synthesisGroup.id, MAX_WORKER_TITLE_LENGTH);
-      if (mode !== "async") throw new Error("Sibling synthesis requires an async task");
-      if (!Number.isSafeInteger(context.synthesisGroup.size) || context.synthesisGroup.size < 2) {
-        throw new Error("Synthesis group size must be an integer of at least 2");
+  ): Effect.Effect<
+    { definition: WorkerDefinition; task: OrchestrateTaskInput },
+    OrchestrationActionRejected
+  > {
+    return Effect.gen(function* () {
+      yield* validateContextOwner("orchestrate", context.ownerSessionId);
+      yield* validateMode("orchestrate", mode);
+      if (!task || typeof task !== "object" || Array.isArray(task)) {
+        return yield* rejectAction(
+          "orchestrate",
+          "validation",
+          "orchestrate requires one task object",
+        );
       }
-    }
-
-    validateText("worker", task.worker, MAX_WORKER_TITLE_LENGTH);
-    validateText("title", task.title, MAX_WORKER_TITLE_LENGTH);
-    validateText("instructions", task.instructions, MAX_WORKER_INSTRUCTIONS_LENGTH);
-    const definition = findWorkerByName(context.catalog, task.worker);
-    if (!definition) throw new Error(`Unknown worker: ${task.worker}`);
-    resolveWorkerModel(definition, context.parentModel, context.modelRegistry);
-    return definition;
-  }
-
-  private assertFreshIds(runId: RunId, workerId: WorkerId): void {
-    if (this.runs.has(runId)) throw new Error(`Duplicate run ID: ${runId}`);
-    if (this.workers.has(workerId)) throw new Error(`Duplicate worker ID: ${workerId}`);
+      if (context.synthesisGroup) {
+        yield* validateText(
+          "orchestrate",
+          "synthesis group ID",
+          context.synthesisGroup.id,
+          MAX_WORKER_TITLE_LENGTH,
+        );
+        if (mode !== "async") {
+          return yield* rejectAction(
+            "orchestrate",
+            "validation",
+            "Sibling synthesis requires an async task",
+          );
+        }
+        if (
+          !Number.isSafeInteger(context.synthesisGroup.size) ||
+          context.synthesisGroup.size < 2
+        ) {
+          return yield* rejectAction(
+            "orchestrate",
+            "validation",
+            "Synthesis group size must be an integer of at least 2",
+          );
+        }
+      }
+      yield* validateText(
+        "orchestrate",
+        "worker",
+        task.worker,
+        MAX_WORKER_TITLE_LENGTH,
+      );
+      yield* validateText(
+        "orchestrate",
+        "title",
+        task.title,
+        MAX_WORKER_TITLE_LENGTH,
+      );
+      yield* validateText(
+        "orchestrate",
+        "instructions",
+        task.instructions,
+        MAX_WORKER_INSTRUCTIONS_LENGTH,
+      );
+      const definition = findWorkerByName(context.catalog, task.worker);
+      if (!definition) {
+        return yield* rejectAction(
+          "orchestrate",
+          "unknown-worker",
+          `Unknown worker: ${task.worker}`,
+        );
+      }
+      const configured = definition.model;
+      if (!configured && !context.parentModel) {
+        return yield* rejectAction(
+          "orchestrate",
+          "model-unavailable",
+          `Worker "${definition.name}" has no configured model and no parent model is available`,
+        );
+      }
+      if (
+        configured &&
+        !context.modelRegistry.find(configured.provider, configured.modelId)
+      ) {
+        return yield* rejectAction(
+          "orchestrate",
+          "model-unavailable",
+          `Worker "${definition.name}" configured model "${configured.provider}/${configured.modelId}" was not found`,
+        );
+      }
+      return { definition, task };
+    });
   }
 
   private launchBootstrap(workerId: WorkerId, generation: number): void {
-    try {
-      this.scheduler.start(
-        workerId,
-        this.bootstrapAndPrompt(workerId, generation),
-        (error) => this.settleWorkflowDefect(workerId, generation, error),
-      );
-    } catch (error) {
-      this.settleWorkflowDefect(workerId, generation, error);
-    }
+    this.launchGeneration(
+      workerId,
+      generation,
+      this.bootstrapAndPrompt(workerId, generation),
+    );
   }
 
   private launchPrompt(
@@ -526,29 +776,74 @@ class DefaultOrchestratorRuntime implements OrchestratorRuntime {
     generation: number,
     session: WorkerSessionHandle,
     instructions: string,
+  ): void {
+    this.launchGeneration(
+      workerId,
+      generation,
+      this.executePrompt(workerId, generation, session, instructions),
+    );
+  }
+
+  private launchGeneration(
+    workerId: WorkerId,
+    generation: number,
+    workflow: Effect.Effect<void, never>,
   ): void {
     try {
-      this.scheduler.start(
+      const fiber = this.runGeneration(
         workerId,
-        this.executePrompt(workerId, generation, session, instructions),
-        (error) => this.settleWorkflowDefect(workerId, generation, error),
+        workflow.pipe(
+          Effect.catchCause((cause) => {
+            if (Cause.hasInterruptsOnly(cause)) return Effect.void;
+            return Effect.sync(() => {
+              this.settleWorkflowDefect(workerId, generation, Cause.squash(cause));
+            });
+          }),
+        ),
       );
+      const exit = fiber.pollUnsafe();
+      // A closed FiberMap rejects admission with an interrupted sentinel.
+      if (exit && Exit.isFailure(exit) && Cause.hasInterruptsOnly(exit.cause)) {
+        this.settleGenerationLaunchFailure(workerId, generation);
+      }
     } catch (error) {
       this.settleWorkflowDefect(workerId, generation, error);
     }
   }
 
+  private settleGenerationLaunchFailure(
+    workerId: WorkerId,
+    generation: number,
+  ): void {
+    this.settleActiveWorker(
+      workerId,
+      generation,
+      ["starting", "running"],
+      "failed",
+      {
+        status: "failed",
+        message: "Worker generation could not start because orchestration is closed",
+      },
+      "workflow",
+      true,
+    );
+  }
+
   private bootstrapAndPrompt(
     workerId: WorkerId,
     generation: number,
   ): Effect.Effect<void, never> {
-    const runtime = this;
-    return Effect.gen(function* () {
-      const session = yield* runtime.bootstrap(workerId, generation);
+    return Effect.gen({ self: this }, function* () {
+      const session = yield* this.bootstrap(workerId, generation);
       if (!session) return;
-      const current = runtime.workers.get(workerId);
-      if (!current) return;
-      yield* runtime.executePrompt(workerId, generation, session, current.instructions);
+      const worker = this.current().workers.get(workerId);
+      if (!worker) return;
+      yield* this.executePrompt(
+        workerId,
+        generation,
+        session,
+        worker.record.instructions,
+      );
     });
   }
 
@@ -557,89 +852,109 @@ class DefaultOrchestratorRuntime implements OrchestratorRuntime {
     generation: number,
   ): Effect.Effect<WorkerSessionHandle | undefined, never> {
     return Effect.suspend(() => {
-      const entry = this.entries.get(workerId);
-      if (!entry) return Effect.succeed(undefined);
-
-      let creation: Promise<WorkerSessionHandle>;
-      try {
-        creation = this.workerSessionFactory.create({
-          cwd: entry.context.cwd,
-          agentDir: entry.context.agentDir,
-          parentSessionFile: entry.context.parentSessionFile,
-          projectTrusted: entry.context.projectTrusted,
-          definition: entry.definition,
-          parentModel: entry.context.parentModel,
-          modelRegistry: entry.context.modelRegistry,
-        });
-      } catch (error) {
-        this.settleCreationFailure(workerId, generation, error);
+      const expected = this.current().workers.get(workerId);
+      if (!expected || expected.generation !== generation) {
         return Effect.succeed(undefined);
       }
-
-      this.trackCleanup(creation.then(() => undefined, () => undefined));
-      void creation.then((session) => {
-        if (!this.canAdoptCreatedSession(workerId, generation, entry)) {
-          this.disposeSession(session);
-        }
-      }, () => undefined);
-
-      return Effect.tryPromise({
-        try: () => creation,
-        catch: (error) => error,
-      }).pipe(
+      return this.childSessions.acquire(
+        {
+          cwd: expected.context.cwd,
+          agentDir: expected.context.agentDir,
+          parentSessionFile: expected.context.parentSessionFile,
+          projectTrusted: expected.context.projectTrusted,
+          definition: expected.definition,
+          parentModel: expected.context.parentModel,
+          modelRegistry: expected.context.modelRegistry,
+        },
+        (session) => this.adoptCreatedSession(workerId, generation, session),
+      ).pipe(
         Effect.match({
           onFailure: (error) => {
             this.settleCreationFailure(workerId, generation, error);
             return undefined;
           },
-          onSuccess: (session) => this.adoptCreatedSession(
-            workerId,
-            generation,
-            entry,
-            session,
-          ),
+          onSuccess: (session) => session,
         }),
       );
     });
   }
 
-  private canAdoptCreatedSession(
-    workerId: WorkerId,
-    generation: number,
-    entry: RuntimeEntry,
-  ): boolean {
-    const current = this.workers.get(workerId);
-    return !this.shuttingDown &&
-      current?.status === "starting" &&
-      entry.generation === generation;
-  }
-
   private adoptCreatedSession(
     workerId: WorkerId,
     generation: number,
-    entry: RuntimeEntry,
     session: WorkerSessionHandle,
   ): WorkerSessionHandle | undefined {
-    const current = this.workers.get(workerId);
-    if (!this.canAdoptCreatedSession(workerId, generation, entry) || !current) {
-      this.disposeSession(session);
+    let release: () => void;
+    try {
+      release = session.subscribeObservation((observation) => {
+        this.updateObservation(workerId, generation, session, observation);
+      });
+    } catch (error) {
+      this.settleCreationFailure(workerId, generation, error);
       return undefined;
     }
 
+    const adopted = this.transact((draft) => {
+      const worker = draft.workers.get(workerId);
+      if (
+        draft.lifecycle !== "open" ||
+        !worker ||
+        worker.generation !== generation ||
+        worker.record.status !== "starting"
+      ) {
+        return {
+          value: false,
+          actions: [runAction(() => safelyCall(release))],
+        };
+      }
+      draft.workers.set(workerId, {
+        ...worker,
+        session,
+        observationRelease: release,
+        record: {
+          ...transitionWorkerStatus(worker.record, "running"),
+          sessionFile: session.sessionFile,
+        },
+      });
+      return {
+        value: true,
+        actions: [publishState(worker.record.ownerSessionId)],
+      };
+    });
+    return adopted ? session : undefined;
+  }
+
+  private subscribeObservation(
+    workerId: WorkerId,
+    generation: number,
+    session: WorkerSessionHandle,
+  ): void {
+    let release: () => void;
     try {
-      entry.session = session;
-      this.subscribeEntryObservability(workerId, entry, session, generation);
-      this.workers.set(workerId, {
-        ...transitionWorkerStatus(current, "running"),
-        sessionFile: session.sessionFile,
+      release = session.subscribeObservation((observation) => {
+        this.updateObservation(workerId, generation, session, observation);
       });
-      this.emitState(current.ownerSessionId);
-      return session;
     } catch (error) {
-      this.disposeEntrySession(entry);
-      this.settleCreationFailure(workerId, generation, error);
-      return undefined;
+      this.settleWorkflowDefect(workerId, generation, error);
+      return;
     }
+
+    this.transact((draft) => {
+      const worker = draft.workers.get(workerId);
+      if (
+        !worker ||
+        worker.generation !== generation ||
+        worker.session !== session ||
+        worker.record.status !== "running"
+      ) {
+        return {
+          value: undefined,
+          actions: [runAction(() => safelyCall(release))],
+        };
+      }
+      draft.workers.set(workerId, { ...worker, observationRelease: release });
+      return { value: undefined };
+    });
   }
 
   private executePrompt(
@@ -649,34 +964,16 @@ class DefaultOrchestratorRuntime implements OrchestratorRuntime {
     instructions: string,
   ): Effect.Effect<void, never> {
     return Effect.suspend(() => {
-      const before = this.workers.get(workerId);
-      const entry = this.entries.get(workerId);
+      const worker = this.current().workers.get(workerId);
       if (
-        !before ||
-        before.status !== "running" ||
-        !entry ||
-        entry.generation !== generation ||
-        entry.session !== session
+        !worker ||
+        worker.record.status !== "running" ||
+        worker.generation !== generation ||
+        worker.session !== session
       ) {
         return Effect.void;
       }
-
-      let prompt: Promise<WorkerOutcome>;
-      try {
-        prompt = session.prompt(instructions);
-      } catch (error) {
-        this.settleOutcome(workerId, generation, session, {
-          status: "failed",
-          message: describeError(error, "Worker prompt failed"),
-        });
-        return Effect.void;
-      }
-      this.trackCleanup(prompt.then(() => undefined, () => undefined));
-
-      return Effect.tryPromise({
-        try: () => prompt,
-        catch: (error) => error,
-      }).pipe(
+      return session.prompt(instructions).pipe(
         Effect.match({
           onFailure: (error): WorkerOutcome => ({
             status: "failed",
@@ -697,13 +994,18 @@ class DefaultOrchestratorRuntime implements OrchestratorRuntime {
     generation: number,
     error: unknown,
   ): void {
-    const current = this.workers.get(workerId);
-    const entry = this.entries.get(workerId);
-    if (!current || current.status !== "starting" || entry?.generation !== generation) return;
-    this.settleTerminalWorker(current, "failed", {
-      status: "failed",
-      message: describeError(error, "Worker session creation failed"),
-    }, "startup");
+    this.settleActiveWorker(
+      workerId,
+      generation,
+      ["starting"],
+      "failed",
+      {
+        status: "failed",
+        message: describeError(error, "Worker session creation failed"),
+      },
+      "startup",
+      false,
+    );
   }
 
   private settleWorkflowDefect(
@@ -711,19 +1013,18 @@ class DefaultOrchestratorRuntime implements OrchestratorRuntime {
     generation: number,
     error: unknown,
   ): void {
-    const current = this.workers.get(workerId);
-    const entry = this.entries.get(workerId);
-    if (!current || entry?.generation !== generation) return;
-    if (!isActiveWorkerStatus(current.status)) {
-      this.maybeCompleteRun(current.runId);
-      return;
-    }
-
-    this.disposeEntrySession(entry);
-    this.settleTerminalWorker(current, "failed", {
-      status: "failed",
-      message: describeError(error, "Worker workflow failed"),
-    }, "workflow");
+    this.settleActiveWorker(
+      workerId,
+      generation,
+      ["starting", "running", "stopping"],
+      "failed",
+      {
+        status: "failed",
+        message: describeError(error, "Worker workflow failed"),
+      },
+      "workflow",
+      true,
+    );
   }
 
   private settleOutcome(
@@ -732,14 +1033,12 @@ class DefaultOrchestratorRuntime implements OrchestratorRuntime {
     session: WorkerSessionHandle,
     outcome: WorkerOutcome,
   ): void {
-    const current = this.workers.get(workerId);
-    const entry = this.entries.get(workerId);
+    const worker = this.current().workers.get(workerId);
     if (
-      !current ||
-      current.status !== "running" ||
-      !entry ||
-      entry.generation !== generation ||
-      entry.session !== session
+      !worker ||
+      worker.generation !== generation ||
+      worker.session !== session ||
+      worker.record.status !== "running"
     ) {
       return;
     }
@@ -748,549 +1047,1033 @@ class DefaultOrchestratorRuntime implements OrchestratorRuntime {
     let status: "ready" | "completed" | "failed" | "aborted";
     if (outcome.status === "failed" || outcome.status === "aborted") {
       status = outcome.status;
-    } else if (current.lifecycle === "interactive" && outcome.status === "ready") {
+    } else if (
+      worker.record.lifecycle === "interactive" &&
+      outcome.status === "ready"
+    ) {
       status = "ready";
-    } else if (current.lifecycle === "one-shot" && outcome.status === "completed") {
+    } else if (
+      worker.record.lifecycle === "one-shot" &&
+      outcome.status === "completed"
+    ) {
       status = "completed";
     } else {
       status = "failed";
       settledOutcome = {
         status: "failed",
-        message: `Worker session returned ${outcome.status} for a ${current.lifecycle} worker`,
+        message: `Worker session returned ${outcome.status} for a ${worker.record.lifecycle} worker`,
       };
     }
-
-    const settledAt = this.clock();
-    this.workers.set(workerId, {
-      ...transitionWorkerStatus(current, status),
-      activity: undefined,
-      outcome: copyOutcome(settledOutcome),
-      settledAt,
-    });
-    if (status !== "ready") this.disposeEntrySession(entry);
-    this.maybeCompleteRun(current.runId);
-    const affectedOwners = new Set([current.ownerSessionId]);
-    this.emitSettlement(
+    this.settleActiveWorker(
       workerId,
       generation,
-      settledAt,
+      ["running"],
+      status,
+      settledOutcome,
       status === "failed" ? "prompt" : undefined,
+      status !== "ready",
     );
-    if (isTerminalWorkerStatus(status)) {
-      addAll(affectedOwners, this.rememberTerminalWorker(workerId));
-    } else {
-      addAll(affectedOwners, this.pruneHistory());
-    }
-    this.emitStateForOwners(affectedOwners);
   }
 
-  private settleTerminalWorker(
-    current: WorkerRecord,
-    status: "failed" | "aborted",
+  private settleActiveWorker(
+    workerId: WorkerId,
+    generation: number,
+    expectedStatuses: readonly WorkerRecord["status"][],
+    status: "ready" | "completed" | "failed" | "aborted",
     outcome: WorkerOutcome,
-    failureStage?: SettlementFailureStage,
+    failureStage: SettlementFailureStage | undefined,
+    dispose: boolean,
   ): void {
-    const settledAt = this.clock();
-    this.workers.set(current.id, {
-      ...transitionWorkerStatus(current, status),
-      activity: undefined,
-      outcome: copyOutcome(outcome),
-      settledAt,
+    const settledAt = this.clock.currentTimeMillisUnsafe();
+    this.transact((draft) => {
+      const worker = draft.workers.get(workerId);
+      if (
+        !worker ||
+        worker.generation !== generation ||
+        !expectedStatuses.includes(worker.record.status)
+      ) {
+        return { value: undefined };
+      }
+
+      const settledRecord: WorkerRecord = {
+        ...transitionWorkerStatus(worker.record, status),
+        activity: undefined,
+        outcome: copyOutcome(outcome),
+        settledAt,
+      };
+      const actions: PostCommitAction[] = [];
+      let settledWorker: RuntimeWorker = { ...worker, record: settledRecord };
+      if (dispose) {
+        actions.push(...this.releaseWorkerResources(settledWorker));
+        settledWorker = {
+          ...settledWorker,
+          session: undefined,
+          observationRelease: undefined,
+        };
+      }
+      draft.workers.set(workerId, settledWorker);
+      const settlement = makeSettlement(
+        draft,
+        settledWorker,
+        settledAt,
+        failureStage,
+      );
+      actions.push(...completeRun(draft, workerId));
+      if (settlement) actions.push(settlement);
+      if (isTerminalWorkerStatus(status)) rememberTerminalWorker(draft, workerId);
+      actions.push(...stateActionsAfterPrune(draft, worker.record.ownerSessionId));
+      return { value: undefined, actions };
     });
-    this.maybeCompleteRun(current.runId);
-    const affectedOwners = new Set([current.ownerSessionId]);
-    const generation = this.entries.get(current.id)?.generation;
-    if (generation !== undefined) {
-      this.emitSettlement(current.id, generation, settledAt, failureStage);
-    }
-    addAll(affectedOwners, this.rememberTerminalWorker(current.id));
-    this.emitStateForOwners(affectedOwners);
   }
 
-  private emitSettlement(
+  private updateObservation(
     workerId: WorkerId,
     generation: number,
-    settledAt: number,
-    failureStage?: SettlementFailureStage,
+    session: WorkerSessionHandle,
+    observation: WorkerSessionObservation,
   ): void {
-    const worker = this.workers.get(workerId);
-    const run = worker ? this.runs.get(worker.runId) : undefined;
-    if (!worker || !run || !worker.outcome || !isSettledWorkerStatus(worker.status)) return;
-    if (worker.outcome.status === "closed") return;
-
-    const sequence = ++this.settlementSequence;
-    const settlement: WorkerSettlement = Object.freeze({
-      eventId: `${sequence}:${run.id}:${workerId}:${generation}`,
-      sequence,
-      ownerSessionId: worker.ownerSessionId,
-      runId: run.id,
-      workerId,
-      generation,
-      mode: run.mode,
-      worker: worker.worker,
-      title: worker.title,
-      lifecycle: worker.lifecycle,
-      status: worker.status,
-      outcome: Object.freeze(copyOutcome(worker.outcome)),
-      ...(failureStage ? { failureStage } : {}),
-      usage: Object.freeze(copyUsage(worker.usage)),
-      startedAt: worker.startedAt,
-      settledAt,
-      ...(run.synthesisGroupId && run.synthesisGroupSize
-        ? {
-            synthesisGroupId: run.synthesisGroupId,
-            synthesisGroupSize: run.synthesisGroupSize,
-          }
-        : {}),
-      ...(worker.sessionFile !== undefined ? { sessionFile: worker.sessionFile } : {}),
+    this.transact((draft) => {
+      const worker = draft.workers.get(workerId);
+      if (
+        !worker ||
+        worker.generation !== generation ||
+        worker.session !== session ||
+        (worker.record.status !== "starting" && worker.record.status !== "running")
+      ) {
+        return { value: undefined };
+      }
+      const nextRecord: WorkerRecord = {
+        ...worker.record,
+        usage: copyUsage(observation.usage),
+        activity: observation.activity,
+        messageDirection: observation.messageDirection,
+      };
+      if (observationsEqual(worker.record, nextRecord)) {
+        return { value: undefined };
+      }
+      draft.workers.set(workerId, { ...worker, record: nextRecord });
+      return {
+        value: undefined,
+        actions: [publishState(worker.record.ownerSessionId)],
+      };
     });
-
-    const localListener = this.runSettlementListeners.get(run.id);
-    this.runSettlementListeners.delete(run.id);
-    notifySettlementListener(localListener, settlement);
-    for (const listener of [...this.settlementListeners]) {
-      notifySettlementListener(listener, settlement);
-    }
   }
 
-  private maybeCompleteRun(runId: RunId): void {
-    if (this.completedRuns.has(runId)) return;
-    const run = this.runs.get(runId);
-    if (!run) return;
-    const worker = this.workers.get(run.workerId);
-    if (!worker || worker.runId !== runId || !worker.outcome || isActiveWorkerStatus(worker.status)) {
-      return;
-    }
-
-    const completed = freezeCompletedRun(run, worker);
-    this.completedRuns.set(runId, completed);
-    this.completedRunOrder.push(runId);
-    this.runs.set(runId, { ...run, state: "complete" });
-    this.runWaiters.get(runId)?.resolve(completed);
-    this.runWaiters.delete(runId);
-  }
+  private beginCancellation(
+    operation: "abort",
+    ownerSessionId: string,
+    target: ValidatedAbortTarget,
+    candidates: ReadonlyMap<WorkerId, Deferred.Deferred<void>>,
+  ): Decision<readonly Deferred.Deferred<void>[]> {
+    return this.transact((draft) => {
+      const open = openDecision(draft, operation);
+      if (open._tag === "rejected") return { value: open };
+      const workers = target._tag === "all"
+        ? [...draft.workers.values()].filter((worker) => (
+            worker.record.ownerSessionId === ownerSessionId &&
+            isActiveWorkerStatus(worker.record.status)
+          ))
+        : target.workerIds.map((id) => draft.workers.get(id));
+
+      if (target._tag === "ids") {
+        for (let index = 0; index < target.workerIds.length; index += 1) {
+          const worker = workers[index];
+          if (!worker || worker.record.ownerSessionId !== ownerSessionId) {
+            return {
+              value: rejected(
+                operation,
+                "ownership",
+                "Worker is not owned by this session",
+              ),
+            };
+          }
+          if (worker.record.status === "ready") {
+            return {
+              value: rejected(
+                operation,
+                "worker-state",
+                "Ready interactive workers are not active; use interactive_close",
+              ),
+            };
+          }
+          if (!isActiveWorkerStatus(worker.record.status)) {
+            return {
+              value: rejected(
+                operation,
+                "worker-state",
+                "worker_abort requires owned active workers",
+              ),
+            };
+          }
+        }
+      }
 
-  private rememberTerminalWorker(workerId: WorkerId): Set<string> {
-    if (!this.terminalWorkerOrder.includes(workerId)) {
-      this.terminalWorkerOrder.push(workerId);
-    }
-    return this.pruneHistory();
+      const activeWorkers = workers.filter(isRuntimeWorker);
+      const marked = this.markWorkersStopping(draft, activeWorkers, candidates);
+      return {
+        value: accepted(marked.completions),
+        actions: [
+          ...marked.actions,
+          ...publishOwners(new Set(
+            activeWorkers.map((worker) => worker.record.ownerSessionId),
+          )),
+        ],
+      };
+    });
   }
 
-  private pruneHistory(): Set<string> {
-    const affectedOwners = new Set<string>();
-    while (this.completedRunOrder.length > MAX_COMPLETED_RUN_HISTORY) {
-      const runId = this.completedRunOrder.shift();
-      if (!runId) break;
-      this.completedRuns.delete(runId);
-      const run = this.runs.get(runId);
-      if (run) affectedOwners.add(run.ownerSessionId);
-      this.runs.delete(runId);
-    }
-
-    while (this.terminalWorkerOrder.length > MAX_TERMINAL_WORKER_HISTORY) {
-      const removableIndex = this.terminalWorkerOrder.findIndex((workerId) => {
-        const worker = this.workers.get(workerId);
-        if (!worker || !isTerminalWorkerStatus(worker.status)) return true;
-        return this.runs.get(worker.runId)?.state !== "running";
-      });
-      if (removableIndex < 0) return affectedOwners;
-      const [workerId] = this.terminalWorkerOrder.splice(removableIndex, 1);
-      if (!workerId) return affectedOwners;
-      const worker = this.workers.get(workerId);
-      if (worker) affectedOwners.add(worker.ownerSessionId);
-      this.workers.delete(workerId);
-      this.entries.delete(workerId);
-    }
-
-    return affectedOwners;
+  private beginShutdownCancellation(
+    candidates: ReadonlyMap<WorkerId, Deferred.Deferred<void>>,
+  ): readonly Deferred.Deferred<void>[] {
+    return this.transact((draft) => {
+      const workers = [...draft.workers.values()].filter((worker) => (
+        isActiveWorkerStatus(worker.record.status)
+      ));
+      const marked = this.markWorkersStopping(draft, workers, candidates);
+      return {
+        value: marked.completions,
+        actions: [
+          ...marked.actions,
+          ...publishOwners(new Set(
+            workers.map((worker) => worker.record.ownerSessionId),
+          )),
+        ],
+      };
+    });
   }
 
-  private resolveAbortTargets(ownerSessionId: string, target: AbortTarget): WorkerId[] {
-    if (!target || typeof target !== "object") throw new Error("Invalid abort target");
-    const candidate = target as {
-      workerIds?: readonly WorkerId[];
-      all?: boolean;
-    };
-    const selected = [
-      candidate.workerIds !== undefined,
-      candidate.all !== undefined,
-    ].filter(Boolean).length;
-    if (selected !== 1 || (candidate.all !== undefined && candidate.all !== true)) {
-      throw new Error("Abort target must specify exactly one of workerIds or all: true");
-    }
-
-    if (candidate.workerIds !== undefined) {
-      if (!Array.isArray(candidate.workerIds) || candidate.workerIds.length === 0) {
-        throw new Error("workerIds must contain at least one worker ID");
+  // Commit stopping and one shared completion before post-commit physical abort
+  // and generation interruption; every cancellation caller joins it.
+  private markWorkersStopping(
+    draft: RuntimeState,
+    workers: readonly RuntimeWorker[],
+    candidates: ReadonlyMap<WorkerId, Deferred.Deferred<void>>,
+  ): {
+    readonly completions: readonly Deferred.Deferred<void>[];
+    readonly actions: readonly PostCommitAction[];
+  } {
+    const completions: Deferred.Deferred<void>[] = [];
+    const actions: PostCommitAction[] = [];
+    for (const worker of workers) {
+      if (worker.cancellation) {
+        completions.push(worker.cancellation);
+        continue;
       }
-      const unique = [...new Set(candidate.workerIds)];
-      for (const workerId of unique) {
-        const worker = this.ownedWorker(ownerSessionId, workerId);
-        if (worker.status === "ready") {
-          throw new Error("Ready interactive workers are not active; use interactive_close");
-        }
-        if (!isActiveWorkerStatus(worker.status)) {
-          throw new Error("worker_abort requires owned active workers");
-        }
+      const completion = candidates.get(worker.record.id);
+      if (!completion) {
+        throw new Error(`Missing cancellation candidate: ${worker.record.id}`);
       }
-      return unique;
+      const stoppingRecord = worker.record.status === "stopping"
+        ? worker.record
+        : {
+            ...transitionWorkerStatus(worker.record, "stopping"),
+            activity: undefined,
+          };
+      draft.workers.set(worker.record.id, {
+        ...worker,
+        record: stoppingRecord,
+        cancellation: completion,
+      });
+      completions.push(completion);
+      actions.push(runAction(() => {
+        this.launchCancellationOrSettleAfterClosure(worker.record.id, completion);
+      }));
     }
-
-    return [...this.workers.values()]
-      .filter(
-        (worker) =>
-          worker.ownerSessionId === ownerSessionId && isActiveWorkerStatus(worker.status),
-      )
-      .map((worker) => worker.id);
+    return { completions, actions };
   }
 
-  private async cancelWorkers(workerIds: readonly WorkerId[]): Promise<void> {
-    const owners = new Set<string>();
-    const cancellations: Promise<void>[] = [];
-
-    for (const workerId of workerIds) {
-      const current = this.workers.get(workerId);
-      if (!current || !isActiveWorkerStatus(current.status)) continue;
-      if (current.status !== "stopping") {
-        this.workers.set(workerId, {
-          ...transitionWorkerStatus(current, "stopping"),
-          activity: undefined,
-        });
-      }
-      owners.add(current.ownerSessionId);
-      cancellations.push(this.cancellationFor(workerId));
+  private launchCancellationOrSettleAfterClosure(
+    workerId: WorkerId,
+    completion: Deferred.Deferred<void>,
+  ): void {
+    const fiber = this.runCancellation(this.cancelWorker(workerId, completion));
+    const exit = fiber.pollUnsafe();
+    // A closed FiberSet rejects admission with an interrupted sentinel.
+    if (!exit || Exit.isSuccess(exit) || !Cause.hasInterruptsOnly(exit.cause)) return;
+
+    const worker = this.current().workers.get(workerId);
+    if (worker?.record.status === "stopping") {
+      this.settleActiveWorker(
+        workerId,
+        worker.generation,
+        ["stopping"],
+        "aborted",
+        { status: "aborted" },
+        "cancellation",
+        true,
+      );
     }
-
-    this.emitStateForOwners(owners);
-    await Promise.all(cancellations);
+    this.completeCancellation(workerId, completion);
   }
 
-  private cancellationFor(workerId: WorkerId): Promise<void> {
-    const existing = this.cancellationPromises.get(workerId);
-    if (existing) return existing;
-
-    const cancellation = Promise.resolve()
-      .then(() => this.cancelWorker(workerId))
-      .catch((error) => {
-        this.settleCancellationFailure(workerId, error);
-      });
-    this.cancellationPromises.set(workerId, cancellation);
-    void cancellation.then(() => {
-      if (this.cancellationPromises.get(workerId) === cancellation) {
-        this.cancellationPromises.delete(workerId);
-      }
-    });
-    return cancellation;
-  }
-
-  private async cancelWorker(workerId: WorkerId): Promise<void> {
-    const entry = this.entries.get(workerId);
-    const session = entry?.session;
-
-    try {
+  private cancelWorker(
+    workerId: WorkerId,
+    completion: Deferred.Deferred<void>,
+  ): Effect.Effect<void> {
+    return Effect.gen({ self: this }, function* () {
+      const session = this.current().workers.get(workerId)?.session;
       if (session) {
-        const abortOperation = Promise.resolve()
-          .then(() => session.abort())
-          .catch(() => undefined);
-        await this.waitBestEffort(abortOperation, CANCELLATION_GRACE_MS);
-      }
-      try {
-        await this.scheduler.remove(workerId);
-      } catch {
-        // Worker state still settles even if scheduler cleanup fails.
+        yield* session.abort().pipe(
+          Effect.catchTag(
+            "WorkerSession.AbortError",
+            (_: WorkerSessionAbortError) => Effect.void,
+          ),
+          Effect.timeoutOption(CANCELLATION_GRACE_MS),
+          Effect.ignore,
+        );
       }
-    } finally {
-      if (entry) this.disposeEntrySession(entry);
-      const current = this.workers.get(workerId);
-      if (current?.status === "stopping") {
-        this.settleTerminalWorker(
-          current,
-          "aborted",
-          { status: "aborted" },
+      const removal = yield* FiberSet.run(
+        this.cancellations,
+        FiberMap.remove(this.generations, workerId).pipe(
+          Effect.catchCause(() => Effect.void),
+        ),
+      );
+      yield* Fiber.await(removal).pipe(
+        Effect.timeoutOption(CANCELLATION_GRACE_MS),
+        Effect.ignore,
+      );
+      this.settleActiveWorker(
+        workerId,
+        this.current().workers.get(workerId)?.generation ?? -1,
+        ["stopping"],
+        "aborted",
+        { status: "aborted" },
+        "cancellation",
+        true,
+      );
+    }).pipe(
+      Effect.catchCause((cause) => Effect.sync(() => {
+        const generation = this.current().workers.get(workerId)?.generation;
+        if (generation === undefined) return;
+        this.settleActiveWorker(
+          workerId,
+          generation,
+          ["stopping"],
+          "failed",
+          {
+            status: "failed",
+            message: describeError(
+              Cause.squash(cause),
+              "Worker cancellation failed",
+            ),
+          },
           "cancellation",
+          true,
         );
-      }
-    }
-  }
-
-  private settleCancellationFailure(workerId: WorkerId, error: unknown): void {
-    const current = this.workers.get(workerId);
-    if (!current || current.status !== "stopping") return;
-    const entry = this.entries.get(workerId);
-    if (entry) this.disposeEntrySession(entry);
-    this.settleTerminalWorker(current, "failed", {
-      status: "failed",
-      message: describeError(error, "Worker cancellation failed"),
-    }, "cancellation");
+      })),
+      Effect.ensuring(
+        Effect.sync(() => this.completeCancellation(workerId, completion)),
+      ),
+    );
   }
 
-  private async cancelExactRun(run: RunRecord): Promise<void> {
-    const worker = this.workers.get(run.workerId);
-    const active = worker?.ownerSessionId === run.ownerSessionId &&
-        worker.runId === run.id &&
-        isActiveWorkerStatus(worker.status)
-      ? [worker.id]
-      : [];
-    await this.cancelWorkers(active);
-    this.maybeCompleteRun(run.id);
+  private completeCancellation(
+    workerId: WorkerId,
+    completion: Deferred.Deferred<void>,
+  ): void {
+    this.transact((draft) => {
+      const worker = draft.workers.get(workerId);
+      if (worker?.cancellation === completion) {
+        draft.workers.set(workerId, { ...worker, cancellation: undefined });
+      }
+      return { value: undefined };
+    });
+    Deferred.doneUnsafe(completion, Effect.void);
   }
 
   private awaitInlineRun(
     run: RunRecord,
-    waiter: RunWaiter,
-    signal: AbortSignal | undefined,
-  ): Promise<CompletedRun> {
-    if (!signal) return waiter.promise;
-
-    return new Promise<CompletedRun>((resolve, reject) => {
-      let abortClaimed = false;
-      const removeAbortListener = () => signal.removeEventListener("abort", onAbort);
-      const onAbort = () => {
-        if (abortClaimed || waiter.settled) return;
-        abortClaimed = true;
-        removeAbortListener();
-        const reason = abortSignalReason(signal);
-        void this.cancelExactRun(run).then(
-          () => reject(reason),
-          () => reject(reason),
-        );
-      };
-
-      waiter.onSettled = () => {
-        removeAbortListener();
-        if (!abortClaimed) waiter.promise.then(resolve, reject);
-      };
-      signal.addEventListener("abort", onAbort, { once: true });
+    completion: Deferred.Deferred<CompletedRun>,
+  ): Effect.Effect<CompletedRun> {
+    return Deferred.await(completion).pipe(
+      Effect.onInterrupt(() => this.cancelExactRun(run)),
+    );
+  }
 
-      if (signal.aborted) onAbort();
-      else if (waiter.settled) waiter.onSettled();
+  private cancelExactRun(run: RunRecord): Effect.Effect<void> {
+    return Effect.gen({ self: this }, function* () {
+      const candidate = yield* Deferred.make<void>();
+      const candidates = new Map([[run.workerId, candidate]]);
+      const completions = this.transact((draft) => {
+        const worker = draft.workers.get(run.workerId);
+        if (
+          !worker ||
+          worker.record.ownerSessionId !== run.ownerSessionId ||
+          worker.record.runId !== run.id ||
+          !isActiveWorkerStatus(worker.record.status)
+        ) {
+          return { value: [] as readonly Deferred.Deferred<void>[] };
+        }
+        const marked = this.markWorkersStopping(draft, [worker], candidates);
+        return {
+          value: marked.completions,
+          actions: [...marked.actions, publishState(run.ownerSessionId)],
+        };
+      });
+      yield* awaitAll(completions);
     });
   }
 
-  private closeReadyInteractiveWorker(current: WorkerRecord): void {
-    const entry = this.entries.get(current.id);
-    if (entry) this.disposeEntrySession(entry);
-    this.workers.set(current.id, {
-      ...transitionWorkerStatus(current, "closed"),
+  private closeReadyWorker(
+    draft: RuntimeState,
+    worker: RuntimeWorker,
+    settledAt: number,
+    actions: PostCommitAction[] = [],
+  ): PostCommitAction[] {
+    const closedRecord: WorkerRecord = {
+      ...transitionWorkerStatus(worker.record, "closed"),
       activity: undefined,
       outcome: { status: "closed" },
-      settledAt: this.clock(),
+      settledAt,
+    };
+    actions.push(...this.releaseWorkerResources(worker));
+    draft.workers.set(worker.record.id, {
+      ...worker,
+      record: closedRecord,
+      session: undefined,
+      observationRelease: undefined,
     });
-    this.maybeCompleteRun(current.runId);
-    const affectedOwners = this.rememberTerminalWorker(current.id);
-    affectedOwners.add(current.ownerSessionId);
-    this.emitStateForOwners(affectedOwners);
+    rememberTerminalWorker(draft, worker.record.id);
+    return actions;
   }
 
-  private closeReadyInteractiveWorkersForShutdown(): void {
-    const readyInteractiveWorkers = [...this.workers.values()].filter(
-      (worker) => worker.lifecycle === "interactive" && worker.status === "ready",
-    );
-    for (const worker of readyInteractiveWorkers) {
-      this.closeReadyInteractiveWorker(worker);
+  private releaseWorkerResources(worker: RuntimeWorker): PostCommitAction[] {
+    const actions: PostCommitAction[] = [];
+    if (worker.observationRelease) {
+      actions.push(runAction(() => safelyCall(worker.observationRelease)));
+    }
+    const session = worker.session;
+    if (session) {
+      actions.push(runAction(() => {
+        this.launchCleanup(
+          Effect.suspend(() => session.dispose()).pipe(
+            Effect.catchCause(() => Effect.void),
+            Effect.uninterruptible,
+          ),
+        );
+      }));
     }
+    return actions;
+  }
+
+  private launchCleanup(cleanup: Effect.Effect<void>): void {
+    const fiber = Effect.runFork(cleanup);
+    FiberSet.addUnsafe(this.cleanups, fiber);
   }
 
-  private subscribeEntryObservability(
+  private preflightOpen(
+    operation: OrchestrationOperation,
+  ): Decision<void> {
+    return this.transact((draft) => ({
+      value: openDecision(draft, operation),
+    }));
+  }
+
+  private preflightReadyInteractive(
+    ownerSessionId: string,
     workerId: WorkerId,
-    entry: RuntimeEntry,
-    session: WorkerSessionHandle,
-    generation: number,
-  ): void {
-    this.unsubscribeEntryObservability(entry);
-    entry.unsubscribeUsage = session.subscribeUsage((usage) => {
-      const latest = this.workers.get(workerId);
-      if (!latest || entry.session !== session || entry.generation !== generation) return;
-      if (latest.status !== "starting" && latest.status !== "running") return;
-      this.workers.set(workerId, { ...latest, usage: copyUsage(usage) });
-      this.emitState(latest.ownerSessionId);
-    });
-    entry.unsubscribeActivity = session.subscribeActivity((activity) => {
-      const latest = this.workers.get(workerId);
-      if (!latest || entry.session !== session || entry.generation !== generation) return;
-      if (latest.status !== "starting" && latest.status !== "running") return;
-      if (latest.activity === activity) return;
-      this.workers.set(workerId, { ...latest, activity });
-      this.emitState(latest.ownerSessionId);
-    });
-    entry.unsubscribeMessageDirection = session.subscribeMessageDirection((messageDirection) => {
-      const latest = this.workers.get(workerId);
-      if (!latest || entry.session !== session || entry.generation !== generation) return;
-      if (latest.status !== "starting" && latest.status !== "running") return;
-      if (latest.messageDirection === messageDirection) return;
-      this.workers.set(workerId, { ...latest, messageDirection });
-      this.emitState(latest.ownerSessionId);
+  ): Decision<void> {
+    return this.transact((draft) => {
+      const ready = readyInteractiveDecision(draft, ownerSessionId, workerId);
+      return {
+        value: ready._tag === "accepted"
+          ? accepted(undefined)
+          : ready,
+      };
     });
   }
 
-  private emitState(ownerSessionId: string): void {
-    for (const listener of [...this.stateListeners]) {
-      try {
-        listener(ownerSessionId);
-      } catch {
-        // One subscriber cannot prevent runtime mutations or other notifications.
-      }
-    }
+  private current(): RuntimeState {
+    return this.state;
   }
 
-  private emitStateForOwners(ownerSessionIds: ReadonlySet<string>): void {
-    for (const ownerSessionId of ownerSessionIds) this.emitState(ownerSessionId);
+  private transact<A>(
+    reducer: (draft: RuntimeState) => TransactionMutation<A>,
+  ): A {
+    const draft = makeDraft(this.state);
+    const mutation = reducer(draft);
+    // Commit before action factories capture the snapshot and callbacks can run.
+    this.state = Object.freeze(draft);
+    this.enqueueActions((mutation.actions ?? []).map((action) => action(
+      this.state,
+      this.settlementListeners,
+      this.stateListeners,
+    )));
+    return mutation.value;
   }
 
-  private ownedWorker(ownerSessionId: string, workerId: WorkerId): WorkerRecord {
-    const worker = this.workers.get(workerId);
-    if (!worker || worker.ownerSessionId !== ownerSessionId) {
-      throw new Error("Worker is not owned by this session");
+  private enqueueActions(actions: readonly CommittedAction[]): void {
+    // Reentrant actions queue behind this drain; drain all before rethrowing the first failure.
+    this.actionQueue.push(...actions);
+    if (this.drainingActions) return;
+
+    this.drainingActions = true;
+    let hasFailure = false;
+    let firstFailure: unknown;
+    try {
+      while (this.actionQueue.length > 0) {
+        const action = this.actionQueue.shift();
+        if (!action) continue;
+        try {
+          action();
+        } catch (error) {
+          if (!hasFailure) firstFailure = error;
+          hasFailure = true;
+        }
+      }
+    } finally {
+      this.drainingActions = false;
     }
-    return worker;
+    if (hasFailure) throw firstFailure;
   }
+}
+
+export function orchestrationLayer(
+  options: OrchestrationLayerOptions = {},
+): Layer.Layer<Orchestration, never, ChildSessions> {
+  return Layer.effect(
+    Orchestration,
+    Effect.gen(function* () {
+      const childSessions = yield* ChildSessions;
+      // Scope finalizers run in reverse acquisition order. Keep cleanup open while
+      // generation and cancellation interruption settle workers and enqueue disposal.
+      const cleanups = yield* FiberSet.make<void, never>();
+      const cancellations = yield* FiberSet.make<void, never>();
+      const runCancellation = yield* FiberSet.runtime(cancellations)<never>();
+      const generations = yield* FiberMap.make<WorkerId, void, never>();
+      const runGeneration = yield* FiberMap.runtime(generations)<never>();
+      const clock = yield* Clock.Clock;
+      const shutdownCompletion = yield* Deferred.make<void>();
+      return Orchestration.of(new StatefulOrchestration(
+        childSessions,
+        generations,
+        runGeneration,
+        cancellations,
+        runCancellation,
+        cleanups,
+        clock,
+        options.idFactories ?? createRandomIdFactories(),
+        shutdownCompletion,
+      ));
+    }),
+  );
+}
+
+function initialState(): RuntimeState {
+  return Object.freeze({
+    workers: new Map<WorkerId, RuntimeWorker>(),
+    runs: new Map<RunId, RuntimeRun>(),
+    terminalWorkerOrder: [],
+    completedRunOrder: [],
+    settlementSequence: 0,
+    lifecycle: "open",
+  });
+}
 
-  private unsubscribeEntryObservability(entry: RuntimeEntry): void {
-    safelyCall(entry.unsubscribeUsage);
-    entry.unsubscribeUsage = undefined;
-    safelyCall(entry.unsubscribeActivity);
-    entry.unsubscribeActivity = undefined;
-    safelyCall(entry.unsubscribeMessageDirection);
-    entry.unsubscribeMessageDirection = undefined;
+function makeDraft(state: RuntimeState): RuntimeState {
+  return {
+    ...state,
+    workers: new Map(state.workers),
+    runs: new Map(state.runs),
+    terminalWorkerOrder: [...state.terminalWorkerOrder],
+    completedRunOrder: [...state.completedRunOrder],
+  };
+}
+
+function completeRun(
+  state: RuntimeState,
+  workerId: WorkerId,
+): PostCommitAction[] {
+  const worker = state.workers.get(workerId);
+  if (!worker) return [];
+  const run = state.runs.get(worker.record.runId);
+  if (!run || !isRunningRuntimeRun(run) || !isCompletedRunWorker(worker.record)) {
+    return [];
   }
 
-  private disposeEntrySession(entry: RuntimeEntry): void {
-    this.unsubscribeEntryObservability(entry);
-    if (entry.session) this.disposeSession(entry.session);
-    entry.session = undefined;
+  const completed = freezeCompletedRun(run.record, worker.record);
+  state.runs.set(run.record.id, { ...run.record, state: "complete" });
+  state.completedRunOrder.push(run.record.id);
+  return [runAction(() => {
+    Deferred.doneUnsafe(run.completion, Effect.succeed(completed));
+  })];
+}
+
+function makeSettlement(
+  draft: RuntimeState,
+  worker: RuntimeWorker,
+  settledAt: number,
+  failureStage: SettlementFailureStage | undefined,
+): PostCommitAction | undefined {
+  const run = draft.runs.get(worker.record.runId);
+  if (!run || !isCompletedRunWorker(worker.record)) {
+    return undefined;
   }
+  const runRecord = runtimeRunRecord(run);
+  const sequence = draft.settlementSequence + 1;
+  draft.settlementSequence = sequence;
+  const settlement: WorkerSettlement = Object.freeze({
+    eventId: `${sequence}:${runRecord.id}:${worker.record.id}:${worker.generation}`,
+    sequence,
+    ownerSessionId: worker.record.ownerSessionId,
+    runId: runRecord.id,
+    workerId: worker.record.id,
+    generation: worker.generation,
+    mode: runRecord.mode,
+    worker: worker.record.worker,
+    title: worker.record.title,
+    lifecycle: worker.record.lifecycle,
+    status: worker.record.status,
+    outcome: Object.freeze(copyOutcome(worker.record.outcome)),
+    ...(failureStage ? { failureStage } : {}),
+    usage: Object.freeze(copyUsage(worker.record.usage)),
+    startedAt: worker.record.startedAt,
+    settledAt,
+    ...(runRecord.synthesisGroupId && runRecord.synthesisGroupSize
+      ? {
+          synthesisGroupId: runRecord.synthesisGroupId,
+          synthesisGroupSize: runRecord.synthesisGroupSize,
+        }
+      : {}),
+    ...(worker.record.sessionFile !== undefined
+      ? { sessionFile: worker.record.sessionFile }
+      : {}),
+  });
+  return publishSettlement(
+    settlement,
+    isRunningRuntimeRun(run) ? run.settlementListener : undefined,
+  );
+}
 
-  private disposeSession(session: WorkerSessionHandle): void {
-    if (this.disposedSessions.has(session)) return;
-    this.disposedSessions.add(session);
+function stateActionsAfterPrune(
+  draft: RuntimeState,
+  ownerSessionId: string,
+): PostCommitAction[] {
+  const owners = pruneHistory(draft);
+  owners.add(ownerSessionId);
+  return publishOwners(owners);
+}
 
-    try {
-      this.trackCleanup(session.dispose());
-    } catch {
-      // Cleanup is best-effort and cannot leave lifecycle state unsettled.
-    }
+function pruneHistory(draft: RuntimeState): Set<string> {
+  const owners = new Set<string>();
+  while (draft.completedRunOrder.length > MAX_COMPLETED_RUN_HISTORY) {
+    const runId = draft.completedRunOrder.shift();
+    if (!runId) break;
+    const run = draft.runs.get(runId);
+    if (run) owners.add(runtimeRunRecord(run).ownerSessionId);
+    draft.runs.delete(runId);
   }
+  while (draft.terminalWorkerOrder.length > MAX_TERMINAL_WORKER_HISTORY) {
+    const index = draft.terminalWorkerOrder.findIndex((workerId) => {
+      const worker = draft.workers.get(workerId);
+      return !worker || isTerminalWorkerStatus(worker.record.status);
+    });
+    if (index < 0) break;
+    const removed = draft.terminalWorkerOrder.splice(index, 1)[0];
+    if (!removed) break;
+    const worker = draft.workers.get(removed);
+    if (worker) owners.add(worker.record.ownerSessionId);
+    draft.workers.delete(removed);
+  }
+  return owners;
+}
 
-  private trackCleanup(operation: Promise<void>): Promise<void> {
-    this.cleanupOperations.add(operation);
-    const forget = () => this.cleanupOperations.delete(operation);
-    void operation.then(forget, forget);
-    return operation;
+function rememberTerminalWorker(
+  draft: RuntimeState,
+  workerId: WorkerId,
+): void {
+  if (!draft.terminalWorkerOrder.includes(workerId)) {
+    draft.terminalWorkerOrder.push(workerId);
   }
+}
+
+function snapshotFor(
+  state: RuntimeState,
+  ownerSessionId: string,
+): RuntimeSnapshot {
+  return Object.freeze({
+    runs: Object.freeze(
+      [...state.runs.values()]
+        .map(runtimeRunRecord)
+        .filter((run) => run.ownerSessionId === ownerSessionId)
+        .map(copyRunRecord),
+    ),
+    workers: Object.freeze(
+      [...state.workers.values()]
+        .map((worker) => worker.record)
+        .filter((worker) => worker.ownerSessionId === ownerSessionId)
+        .map(copyWorkerRecord),
+    ),
+  });
+}
+
+function runtimeRunRecord(run: RuntimeRun): RunRecord {
+  return isRunningRuntimeRun(run) ? run.record : run;
+}
 
-  private async awaitTrackedCleanupBestEffort(): Promise<void> {
-    const operations = [...this.cleanupOperations];
-    if (operations.length === 0) return;
-    await this.waitBestEffort(
-      Promise.allSettled(operations).then(() => undefined),
-      SHUTDOWN_CLEANUP_GRACE_MS,
+function isRunningRuntimeRun(run: RuntimeRun): run is RunningRuntimeRun {
+  return "_tag" in run;
+}
+
+function makeRunRecord(
+  runId: RunId,
+  workerId: WorkerId,
+  context: OrchestrationContext,
+  mode: RunMode,
+  createdAt: number,
+): RunRecord {
+  return {
+    id: runId,
+    ownerSessionId: context.ownerSessionId,
+    workerId,
+    mode,
+    state: "running",
+    createdAt,
+    ...(context.synthesisGroup
+      ? {
+          synthesisGroupId: context.synthesisGroup.id,
+          synthesisGroupSize: context.synthesisGroup.size,
+        }
+      : {}),
+  };
+}
+
+function makeWorkerRecord(
+  workerId: WorkerId,
+  runId: RunId,
+  ownerSessionId: string,
+  definition: WorkerDefinition,
+  task: OrchestrateTaskInput,
+  startedAt: number,
+): WorkerRecord {
+  return {
+    id: workerId,
+    worker: definition.name,
+    ownerSessionId,
+    runId,
+    title: task.title,
+    instructions: task.instructions,
+    lifecycle: definition.lifecycle,
+    status: "starting",
+    usage: copyUsage(EMPTY_WORKER_USAGE),
+    messageDirection: "to-model",
+    startedAt,
+  };
+}
+
+function publishState(ownerSessionId: string): PostCommitAction {
+  return (state, _settlementListeners, stateListeners) => {
+    const snapshot = snapshotFor(state, ownerSessionId);
+    const listeners = [...(stateListeners.get(ownerSessionId) ?? [])];
+    return () => {
+      for (const listener of listeners) safelyNotify(() => listener(snapshot));
+    };
+  };
+}
+
+function publishStateTo(
+  ownerSessionId: string,
+  listener: StateListener,
+): PostCommitAction {
+  return (state) => {
+    const snapshot = snapshotFor(state, ownerSessionId);
+    return () => safelyNotify(() => listener(snapshot));
+  };
+}
+
+function publishSettlement(
+  settlement: WorkerSettlement,
+  localListener: SettlementListener | undefined,
+): PostCommitAction {
+  return (_state, settlementListeners) => {
+    const listeners = [...settlementListeners];
+    return () => {
+      if (localListener) safelyNotify(() => localListener(settlement));
+      for (const listener of listeners) safelyNotify(() => listener(settlement));
+    };
+  };
+}
+
+function publishOwners(owners: ReadonlySet<string>): PostCommitAction[] {
+  return [...owners].map(publishState);
+}
+
+function runAction(run: () => void): PostCommitAction {
+  return () => run;
+}
+
+function openDecision(
+  draft: RuntimeState,
+  operation: OrchestrationOperation,
+): Decision<void> {
+  return draft.lifecycle === "open"
+    ? accepted(undefined)
+    : rejected(
+        operation,
+        "shutdown",
+        "Orchestrator runtime is shutting down",
+      );
+}
+
+function ownedWorkerDecision(
+  draft: RuntimeState,
+  operation: OrchestrationOperation,
+  ownerSessionId: string,
+  workerId: WorkerId,
+): Decision<RuntimeWorker> {
+  const worker = draft.workers.get(workerId);
+  return !worker || worker.record.ownerSessionId !== ownerSessionId
+    ? rejected(
+        operation,
+        "ownership",
+        "Worker is not owned by this session",
+      )
+    : accepted(worker);
+}
+
+function readyInteractiveDecision(
+  draft: RuntimeState,
+  ownerSessionId: string,
+  workerId: WorkerId,
+): Decision<{
+  readonly worker: RuntimeWorker;
+  readonly session: WorkerSessionHandle;
+}> {
+  const open = openDecision(draft, "sendInteractive");
+  if (open._tag === "rejected") return open;
+  const ownership = ownedWorkerDecision(
+    draft,
+    "sendInteractive",
+    ownerSessionId,
+    workerId,
+  );
+  if (ownership._tag === "rejected") return ownership;
+  const worker = ownership.value;
+  if (
+    worker.record.lifecycle !== "interactive" ||
+    worker.record.status !== "ready" ||
+    !worker.session
+  ) {
+    return rejected(
+      "sendInteractive",
+      "worker-state",
+      "interactive_send requires an owned ready interactive worker",
     );
   }
+  return accepted({ worker, session: worker.session });
+}
 
-  private async waitBestEffort(promise: Promise<unknown>, timeoutMs: number): Promise<void> {
-    try {
-      await this.bestEffortDeadline.wait(promise, timeoutMs);
-    } catch {
-      // A deadline implementation cannot prevent lifecycle settlement.
-    }
-  }
+function accepted<A>(value: A): Decision<A> {
+  return { _tag: "accepted", value };
+}
 
-  private assertOpen(): void {
-    if (this.shuttingDown) throw new Error("Orchestrator runtime is shutting down");
-  }
+function rejected(
+  operation: OrchestrationOperation,
+  reason: OrchestrationRejectionReason,
+  message: string,
+): Decision<never> {
+  return {
+    _tag: "rejected",
+    error: actionRejection(operation, reason, message),
+  };
+}
+
+function actionRejection(
+  operation: OrchestrationOperation,
+  reason: OrchestrationRejectionReason,
+  message: string,
+): OrchestrationActionRejected {
+  return new OrchestrationActionRejected({ operation, reason, message });
 }
 
-export function createOrchestratorRuntime(
-  options: OrchestratorRuntimeOptions,
-): OrchestratorRuntime {
-  return new DefaultOrchestratorRuntime(options);
+function rejectAction(
+  operation: OrchestrationOperation,
+  reason: OrchestrationRejectionReason,
+  message: string,
+): Effect.Effect<never, OrchestrationActionRejected> {
+  return Effect.fail(actionRejection(operation, reason, message));
 }
 
-function validateContextOwner(ownerSessionId: string): void {
-  if (typeof ownerSessionId !== "string" || ownerSessionId.trim() === "") {
-    throw new Error("ownerSessionId must not be blank");
+function validateContextOwner(
+  operation: OrchestrationOperation,
+  ownerSessionId: string,
+): Effect.Effect<void, OrchestrationActionRejected> {
+  return typeof ownerSessionId !== "string" || ownerSessionId.trim() === ""
+    ? rejectAction(
+        operation,
+        "validation",
+        "ownerSessionId must not be blank",
+      )
+    : Effect.void;
+}
+
+function validateWorkerId(
+  operation: OrchestrationOperation,
+  workerId: string,
+): Effect.Effect<WorkerId, OrchestrationActionRejected> {
+  if (typeof workerId !== "string" || workerId.trim() === "") {
+    return rejectAction(
+      operation,
+      "validation",
+      "worker_id must not be blank",
+    );
   }
+  return Schema.decodeUnknownEffect(WorkerId)(workerId).pipe(
+    Effect.mapError(() => actionRejection(
+      operation,
+      "validation",
+      "worker_id must use the canonical worker- prefix",
+    )),
+  );
 }
 
-function validateMode(mode: RunMode): void {
-  if (mode !== "async" && mode !== "inline") throw new Error("Invalid orchestration mode");
+function validateMode(
+  operation: OrchestrationOperation,
+  mode: RunMode,
+): Effect.Effect<void, OrchestrationActionRejected> {
+  return mode !== "async" && mode !== "inline"
+    ? rejectAction(operation, "validation", "Invalid orchestration mode")
+    : Effect.void;
 }
 
-function validateText(name: string, value: string, maximumLength: number): void {
+function validateText(
+  operation: OrchestrationOperation,
+  name: string,
+  value: string,
+  maximumLength: number,
+): Effect.Effect<void, OrchestrationActionRejected> {
   if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(`${name} must not be blank`);
-  }
-  if (value.length > maximumLength) {
-    throw new Error(`${name} must be at most ${maximumLength} characters`);
+    return rejectAction(operation, "validation", `${name} must not be blank`);
   }
+  return value.length > maximumLength
+    ? rejectAction(
+        operation,
+        "validation",
+        `${name} must be at most ${maximumLength} characters`,
+      )
+    : Effect.void;
 }
 
-function describeError(error: unknown, fallback: string): string {
-  if (error instanceof Error && error.message !== "") return error.message;
-  if (typeof error === "string" && error !== "") return error;
-  return fallback;
+type ValidatedAbortTarget =
+  | {
+      readonly _tag: "ids";
+      readonly workerIds: readonly WorkerId[];
+    }
+  | {
+      readonly _tag: "all";
+    };
+
+function validateAbortTarget(
+  target: AbortTarget,
+): Effect.Effect<ValidatedAbortTarget, OrchestrationActionRejected> {
+  return Effect.gen(function* () {
+    if (!target || typeof target !== "object") {
+      return yield* rejectAction("abort", "target", "Invalid abort target");
+    }
+    const selected = [target.workerIds !== undefined, target.all !== undefined]
+      .filter(Boolean).length;
+    if (selected !== 1 || (target.all !== undefined && target.all !== true)) {
+      return yield* rejectAction(
+        "abort",
+        "target",
+        "Abort target must specify exactly one of workerIds or all: true",
+      );
+    }
+    if (target.workerIds === undefined) return { _tag: "all" };
+    if (!Array.isArray(target.workerIds) || target.workerIds.length === 0) {
+      return yield* rejectAction(
+        "abort",
+        "target",
+        "workerIds must contain at least one worker ID",
+      );
+    }
+    const workerIds = yield* Effect.all(
+      [...new Set(target.workerIds)].map((id) => validateWorkerId("abort", id)),
+    );
+    return { _tag: "ids", workerIds };
+  });
 }
 
-function isActiveWorkerStatus(status: WorkerRecord["status"]): boolean {
-  return status === "starting" || status === "running" || status === "stopping";
+function makeCancellationCandidates(
+  workerIds: readonly WorkerId[],
+): Effect.Effect<ReadonlyMap<WorkerId, Deferred.Deferred<void>>> {
+  return Effect.forEach(workerIds, (workerId) => Deferred.make<void>().pipe(
+    Effect.map((completion) => [workerId, completion] as const),
+  )).pipe(Effect.map((entries) => new Map(entries)));
 }
 
-function isSettledWorkerStatus(
-  status: WorkerRecord["status"],
-): status is RunResult["status"] {
-  return status === "completed" || status === "ready" || status === "failed" || status === "aborted";
+function activeWorkerIds(
+  state: RuntimeState,
+  ownerSessionId?: string,
+): WorkerId[] {
+  return [...state.workers.values()]
+    .filter((worker) => (
+      (ownerSessionId === undefined ||
+        worker.record.ownerSessionId === ownerSessionId) &&
+      isActiveWorkerStatus(worker.record.status)
+    ))
+    .map((worker) => worker.record.id);
 }
 
-function safelyCall(callback: (() => void) | undefined): void {
-  if (!callback) return;
-  try {
-    callback();
-  } catch {
-    // Session cleanup is idempotent best-effort and must not strand lifecycle state.
-  }
+function awaitAll(
+  deferreds: readonly Deferred.Deferred<void>[],
+): Effect.Effect<void> {
+  return Effect.forEach(
+    deferreds,
+    (deferred) => Deferred.await(deferred),
+    { concurrency: "unbounded", discard: true },
+  );
 }
 
-function throwIfAborted(signal: AbortSignal | undefined): void {
-  if (signal?.aborted) throw abortSignalReason(signal);
+function isRuntimeWorker(
+  worker: RuntimeWorker | undefined,
+): worker is RuntimeWorker {
+  return worker !== undefined;
 }
 
-function abortSignalReason(signal: AbortSignal): unknown {
-  if ("reason" in signal) return signal.reason;
-  return new DOMException("This operation was aborted", "AbortError");
+function isActiveWorkerStatus(status: WorkerRecord["status"]): boolean {
+  return status === "starting" || status === "running" || status === "stopping";
 }
 
-function addAll(target: Set<string>, source: ReadonlySet<string>): void {
-  for (const value of source) target.add(value);
+function isCompletedRunWorker(
+  record: WorkerRecord,
+): record is WorkerRecord & {
+  readonly status: RunResult["status"];
+  readonly outcome: Exclude<WorkerOutcome, { readonly status: "closed" }>;
+  readonly settledAt: number;
+} {
+  return (
+    (record.status === "completed" ||
+      record.status === "ready" ||
+      record.status === "failed" ||
+      record.status === "aborted") &&
+    record.outcome !== undefined &&
+    record.outcome.status !== "closed" &&
+    record.settledAt !== undefined
+  );
 }
 
-function notifySettlementListener(
-  listener: SettlementListener | undefined,
-  settlement: WorkerSettlement,
-): void {
-  if (!listener) return;
-  try {
-    listener(settlement);
-  } catch {
-    // One observer cannot prevent settlement or other observers from being notified.
-  }
+function observationsEqual(
+  previous: WorkerRecord,
+  next: WorkerRecord,
+): boolean {
+  return (
+    previous.activity === next.activity &&
+    previous.messageDirection === next.messageDirection &&
+    usageEquals(previous.usage, next.usage)
+  );
 }
 
-function makeRunWaiter(): RunWaiter {
-  let complete!: (run: CompletedRun) => void;
-  const waiter: RunWaiter = {
-    promise: new Promise<CompletedRun>((resolve) => {
-      complete = resolve;
-    }),
-    settled: false,
-    resolve(run) {
-      if (waiter.settled) return;
-      waiter.settled = true;
-      waiter.onSettled?.();
-      complete(run);
-    },
-  };
-  return waiter;
+function usageEquals(left: WorkerUsage, right: WorkerUsage): boolean {
+  return (
+    left.input === right.input &&
+    left.output === right.output &&
+    left.cacheRead === right.cacheRead &&
+    left.cacheWrite === right.cacheWrite &&
+    left.cost === right.cost &&
+    left.contextTokens === right.contextTokens &&
+    left.turns === right.turns
+  );
 }
 
 function copyUsage(usage: WorkerUsage): WorkerUsage {
@@ -1317,7 +2100,9 @@ function copyWorkerRecord(worker: WorkerRecord): WorkerRecord {
   return Object.freeze({
     ...worker,
     usage: Object.freeze(copyUsage(worker.usage)),
-    ...(worker.outcome ? { outcome: Object.freeze(copyOutcome(worker.outcome)) } : {}),
+    ...(worker.outcome
+      ? { outcome: Object.freeze(copyOutcome(worker.outcome)) }
+      : {}),
   });
 }
 
@@ -1327,21 +2112,18 @@ function freezeAcceptedRun(id: RunId, workerId: WorkerId): AcceptedRun {
 
 function freezeCompletedRun(
   run: RunRecord,
-  record: WorkerRecord,
+  record: WorkerRecord & {
+    readonly status: RunResult["status"];
+    readonly outcome: Exclude<WorkerOutcome, { readonly status: "closed" }>;
+    readonly settledAt: number;
+  },
 ): CompletedRun {
-  const outcome = record.outcome;
-  if (!outcome || outcome.status === "closed") {
-    throw new Error("Completed run requires a worker response outcome");
-  }
-  if (record.settledAt === undefined) {
-    throw new Error("Completed run requires a settlement timestamp");
-  }
   const result: RunResult = Object.freeze({
     workerId: record.id,
     worker: record.worker,
     title: record.title,
-    status: record.status as RunResult["status"],
-    outcome: Object.freeze(copyOutcome(outcome)),
+    status: record.status,
+    outcome: Object.freeze(copyOutcome(record.outcome)),
     usage: Object.freeze(copyUsage(record.usage)),
     startedAt: record.startedAt,
     settledAt: record.settledAt,
@@ -1354,3 +2136,27 @@ function freezeCompletedRun(
     result,
   });
 }
+
+function describeError(error: unknown, fallback: string): string {
+  if (error instanceof Error && error.message !== "") return error.message;
+  if (typeof error === "string" && error !== "") return error;
+  return fallback;
+}
+
+function safelyCall(callback: (() => void) | undefined): void {
+  if (callback) safelyNotify(callback);
+}
+
+function safelyNotify(callback: () => void): void {
+  try {
+    callback();
+  } catch {
+    // Observers and best-effort cleanup cannot block committed state transitions.
+  }
+}
+
+function addAll(target: Set<string>, source: ReadonlySet<string>): void {
+  for (const value of source) target.add(value);
+}
+
+function noOp(): void {}