effect-agent 0.1.0-beta.111 → 0.1.0-beta.113

package/dist/durable/SubmissionLedger.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"SubmissionLedger.mjs","names":["FailureDiagnostic.Value"],"sources":["../../src/durable/SubmissionLedger.ts"],"sourcesContent":["import type { Option, Stream } from \"effect\";\nimport { Context, Duration, Effect, Schema } from \"effect\";\n\nimport { InputMessage } from \"../capabilities/Messaging.ts\";\nimport * as FailureDiagnostic from \"../core/FailureDiagnostic.ts\";\nimport {\n  AgentId,\n  AttemptId,\n  ThreadId,\n  ReceiptId,\n  SettlementId,\n  SubmissionId,\n  ToolCallId,\n} from \"../core/Identifiers.ts\";\nimport type { JoinedToHost } from \"../core/Receipt.ts\";\nimport { IdempotencyKey, QueueSequence, Principal } from \"../core/Receipt.ts\";\nimport { RunUsageSummary } from \"../core/Usage.ts\";\nimport {\n  AbortRequested,\n  ApprovalDecision,\n  BatchId,\n  CanonicalSequence,\n  DefinitionDigests,\n  DeploymentId,\n  Digest,\n  PersistedJson,\n  ProducerEpoch,\n  ProducerId,\n  RecordEnvelope,\n  RecordId,\n  SettlementFailureDiagnostic,\n  SettlementOutcome,\n  ToolApprovalDecided,\n  ToolCallResolved,\n  ToolCallUnknown,\n  WorkerAdmission,\n} from \"./Records.ts\";\n\nexport { IdempotencyKey, JoinedToHost, QueueSequence, Principal } from \"../core/Receipt.ts\";\n\nconst identifier = <const Name extends string>(name: Name) =>\n  Schema.NonEmptyString.check(Schema.isMaxLength(256)).pipe(\n    Schema.brand(`@effect-agent/thread/${name}`),\n  );\n\n/**\n * Opaque proof that one Attempt currently owns a Submission's lane. It authorizes ledger\n * mutations only; canonical-log fencing authority remains the producer epoch (DUR-006).\n */\nexport const OwnershipToken = identifier(\"OwnershipToken\");\nexport type OwnershipToken = typeof OwnershipToken.Type;\n\n/**\n * Ledger lifecycle states for one Submission. `settled` is the only terminal state; every other\n * state carries an outstanding accepted-work obligation (Accepted-work Contract, DUR-002).\n *\n * Phase 5 states:\n *\n * - `joining` — a queued Submission claimed by an active host Run, before its canonical\n *   `UserInputRecorded` append; recovery reverts it to `ready` (DUR-016).\n * - `joined` — the input is canonical and linked to its host; the Submission settles WITH the\n *   host Run's outcome.\n * - `suspended` — durably waiting for explicit approval decisions; the ownership period has\n *   ended and the lane consumes no worker permit while the obligation stays owed.\n * - `unknown` — at least one Tool Call has a durable Unknown Outcome; this Submission is\n *   parked until an authorized resolution covers every open call or a durable abort intent\n *   authorizes cleanup without Tool replay. Later eligible input may run (DUR-012/DUR-017).\n *\n * `claim` never grants or bypasses a `joining`, `joined`, or `suspended` head. It skips unknown\n * work without an abort intent. Any live ownership in the Thread prevents another claim.\n */\nexport const SubmissionState = Schema.Literals([\n  \"admitted\",\n  \"ready\",\n  \"joining\",\n  \"joined\",\n  \"running\",\n  \"input-applied\",\n  \"suspended\",\n  \"unknown\",\n  \"terminalizing\",\n  \"settled\",\n]);\n\nexport type SubmissionState = typeof SubmissionState.Type;\n\n/**\n * Default ownership lease duration (D5). The lease is a liveness hint that makes an abandoned\n * claim reclaimable; correctness never depends on it because every canonical append is fenced by\n * producer epoch. Adapters expose this as configuration and use this value when unconfigured.\n */\nexport const DEFAULT_OWNERSHIP_LEASE_DURATION: Duration.Duration = Duration.seconds(30);\n\n/**\n * What a SubmissionLedger adapter claims about itself. `durable-node` asserts single-node\n * process-crash durability (fsync-backed storage); `durable-cloudflare` asserts the same\n * single-serialized-owner crash durability through Durable Object storage output gates;\n * `non-durable` marks reference adapters whose state does not survive the process (in-memory\n * conformance/test adapters). The label is an honest self-description for reports and\n * evidence — no runtime behavior branches on it.\n */\nexport class LedgerCapabilities extends Schema.Class<LedgerCapabilities>(\n  \"@effect-agent/thread/LedgerCapabilities\",\n)({\n  durability: Schema.Literals([\"durable-node\", \"durable-cloudflare\", \"non-durable\"]),\n}) {}\n\n/**\n * Immutable lineage from a child Submission to the exact parent Tool Call that established it\n * (spec §12 step 5, SUB-004). Recorded once at admission and never rewritten; it is an\n * identifier, not an authorization capability (D10) — the join path verifies the canonical\n * Parent Link records, never this marker alone.\n */\nexport class ParentLinkage extends Schema.Class<ParentLinkage>(\n  \"@effect-agent/thread/ParentLinkage\",\n)({\n  parentSubmissionId: SubmissionId,\n  parentToolCallId: ToolCallId,\n}) {}\n\n/** Host-owned policy coordinates, interpreted only by the destination transaction owner. */\nexport const AdmissionFence = Schema.Struct({\n  policyId: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  key: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  revision: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n});\n\nexport type AdmissionFence = typeof AdmissionFence.Type;\nexport const AdmissionGroup = Schema.NonEmptyString.check(Schema.isMaxLength(256));\n\n/** Fresh admission alone may be refused; unavailability never proves non-admission. */\nexport class AdmissionPolicyError extends Schema.TaggedError<AdmissionPolicyError>()(\n  \"AdmissionPolicyError\",\n  {\n    reason: Schema.Literals([\"refused\", \"unavailable\", \"occupied\"]),\n    code: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n    cause: Schema.optionalKey(FailureDiagnostic.Value),\n    stack: Schema.optionalKey(Schema.String),\n  },\n) {}\n\n/**\n * Durable admission input. `inputDigest` must be the digest of the canonical JSON encoding of\n * `inputPayload` (see `digestJson`); admission idempotency compares digests, never re-encodes.\n * `agentId`/`agentDigests`/`deploymentId` are persisted so recovery can complete Thread\n * materialization without the submitting client. `parentLinkage` is present exactly when the\n * Submission is a durable attached child (spec §12); an admission replay must repeat the same\n * linkage (or its absence) or fail with `AdmissionConflict`.\n */\nexport class AdmissionRequest extends Schema.Class<AdmissionRequest>(\n  \"@effect-agent/thread/AdmissionRequest\",\n)({\n  threadId: ThreadId,\n  principal: Principal,\n  idempotencyKey: IdempotencyKey,\n  agentId: AgentId,\n  agentDigests: DefinitionDigests,\n  deploymentId: DeploymentId,\n  inputPayload: PersistedJson,\n  inputDigest: Digest,\n  parentLinkage: Schema.optionalKey(ParentLinkage),\n  workerAdmission: Schema.optionalKey(WorkerAdmission),\n  messageAdmission: Schema.optionalKey(InputMessage),\n  admissionGroup: Schema.optionalKey(AdmissionGroup),\n  admissionFence: Schema.optionalKey(AdmissionFence),\n}) {}\n\n/**\n * The committed admission row. `replayed` is true when an identical (thread, principal,\n * idempotencyKey, inputDigest) admission already existed; the original identities are returned\n * unchanged so a client retry resumes rather than duplicates (DUR-001).\n */\nexport class AdmissionResult extends Schema.Class<AdmissionResult>(\n  \"@effect-agent/thread/AdmissionResult\",\n)({\n  submissionId: SubmissionId,\n  receiptId: ReceiptId,\n  queueSequence: QueueSequence,\n  state: SubmissionState,\n  replayed: Schema.Boolean,\n}) {}\n\nexport class MarkReadyRequest extends Schema.Class<MarkReadyRequest>(\n  \"@effect-agent/thread/MarkReadyRequest\",\n)({\n  submissionId: SubmissionId,\n}) {}\n\nexport class SubmissionLookupById extends Schema.TaggedClass<SubmissionLookupById>(\n  \"@effect-agent/thread/SubmissionLookupById\",\n)(\"SubmissionLookupById\", {\n  submissionId: SubmissionId,\n}) {}\n\nexport class SubmissionLookupByKey extends Schema.TaggedClass<SubmissionLookupByKey>(\n  \"@effect-agent/thread/SubmissionLookupByKey\",\n)(\"SubmissionLookupByKey\", {\n  threadId: ThreadId,\n  principal: Principal,\n  idempotencyKey: IdempotencyKey,\n}) {}\n\n/** Lookup by Submission identity or by the scoped client idempotency key. */\nexport const SubmissionLookup = Schema.Union([SubmissionLookupById, SubmissionLookupByKey]);\nexport type SubmissionLookup = typeof SubmissionLookup.Type;\n\n/** The full durable ledger view of one Submission. */\nexport class SubmissionSnapshot extends Schema.Class<SubmissionSnapshot>(\n  \"@effect-agent/thread/SubmissionSnapshot\",\n)({\n  submissionId: SubmissionId,\n  threadId: ThreadId,\n  queueSequence: QueueSequence,\n  principal: Principal,\n  idempotencyKey: IdempotencyKey,\n  agentId: AgentId,\n  agentDigests: DefinitionDigests,\n  deploymentId: DeploymentId,\n  inputPayload: PersistedJson,\n  inputDigest: Digest,\n  receiptId: ReceiptId,\n  state: SubmissionState,\n  settledOutcome: Schema.optionalKey(SettlementOutcome),\n  createdAt: Schema.DateTimeUtcFromString,\n  readyAt: Schema.optionalKey(Schema.DateTimeUtcFromString),\n  admissionGroup: Schema.optionalKey(AdmissionGroup),\n  admissionFence: Schema.optionalKey(AdmissionFence),\n  parentLinkage: Schema.optionalKey(ParentLinkage),\n  workerAdmission: Schema.optionalKey(WorkerAdmission),\n  messageAdmission: Schema.optionalKey(InputMessage),\n}) {}\n\n/** The authoritative store proves the scoped idempotency key was never admitted (SUB-031). */\nexport class AdmissionNotAdmitted extends Schema.TaggedClass<AdmissionNotAdmitted>(\n  \"@effect-agent/thread/AdmissionNotAdmitted\",\n)(\"NotAdmitted\", {}) {}\n\n/** The scoped idempotency key was admitted; the full Submission snapshot is authoritative. */\nexport class AdmissionAdmitted extends Schema.TaggedClass<AdmissionAdmitted>(\n  \"@effect-agent/thread/AdmissionAdmitted\",\n)(\"Admitted\", {\n  submission: SubmissionSnapshot,\n}) {}\n\n/**\n * The adapter cannot currently prove admission or its absence (e.g. the authoritative child\n * owner is unreachable on a partitioned platform). Callers wait and retry; an indeterminate\n * answer NEVER permits a second admission attempt (SUB-031).\n */\nexport class AdmissionIndeterminate extends Schema.TaggedClass<AdmissionIndeterminate>(\n  \"@effect-agent/thread/AdmissionIndeterminate\",\n)(\"Indeterminate\", {\n  reason: Schema.String.check(Schema.isMaxLength(4096)),\n}) {}\n\n/**\n * The tri-state answer of `resolveAdmission` (spec §12: \"absence from an eventually consistent\n * projection is never proof\"). Single strongly consistent stores derive `NotAdmitted`/`Admitted`\n * from a direct lookup; only adapters that can genuinely fail to reach the authoritative owner\n * answer `Indeterminate`.\n */\nexport const AdmissionResolution = Schema.Union([\n  AdmissionNotAdmitted,\n  AdmissionAdmitted,\n  AdmissionIndeterminate,\n]);\n\nexport type AdmissionResolution = typeof AdmissionResolution.Type;\n\nexport class ClaimRequest extends Schema.Class<ClaimRequest>(\"@effect-agent/thread/ClaimRequest\")({\n  threadId: ThreadId,\n  producerId: ProducerId,\n}) {}\n\n/**\n * One granted ownership period. `producerEpoch` is the fencing token for every canonical append\n * this Attempt performs; `leaseExpiresAt` is when the claim becomes reclaimable unless renewed.\n */\nexport class Claim extends Schema.Class<Claim>(\"@effect-agent/thread/Claim\")({\n  submissionId: SubmissionId,\n  attemptId: AttemptId,\n  ownershipToken: OwnershipToken,\n  producerEpoch: ProducerEpoch,\n  leaseExpiresAt: Schema.DateTimeUtcFromString,\n  inputPayload: PersistedJson,\n}) {}\n\nexport class RenewOwnershipRequest extends Schema.Class<RenewOwnershipRequest>(\n  \"@effect-agent/thread/RenewOwnershipRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n}) {}\n\n/**\n * A renewed lease. Adapters MAY rotate the token; callers must use the returned token for every\n * later ledger mutation.\n */\nexport class OwnershipRenewal extends Schema.Class<OwnershipRenewal>(\n  \"@effect-agent/thread/OwnershipRenewal\",\n)({\n  ownershipToken: OwnershipToken,\n  leaseExpiresAt: Schema.DateTimeUtcFromString,\n}) {}\n\nexport class ReleaseOwnershipRequest extends Schema.Class<ReleaseOwnershipRequest>(\n  \"@effect-agent/thread/ReleaseOwnershipRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n}) {}\n\n/**\n * The canonical position of the applied `UserInputRecorded` record for one Submission.\n */\nexport class MarkInputAppliedRequest extends Schema.Class<MarkInputAppliedRequest>(\n  \"@effect-agent/thread/MarkInputAppliedRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  recordId: RecordId,\n  sequence: CanonicalSequence,\n}) {}\n\nexport class InputAppliedMarker extends Schema.Class<InputAppliedMarker>(\n  \"@effect-agent/thread/InputAppliedMarker\",\n)({\n  recordId: RecordId,\n  sequence: CanonicalSequence,\n}) {}\n\n/**\n * Reservation of the single exact settlement record for one Submission (DUR-011). `record` is\n * the complete canonical envelope that will be appended — including `createdAt` — so a recovering\n * Attempt can re-append byte-identical content without a batch-digest conflict. `recordDigest`\n * must be the digest of the canonical JSON encoding of the Schema-encoded envelope.\n */\nexport class SettlementReservation extends Schema.Class<SettlementReservation>(\n  \"@effect-agent/thread/SettlementReservation\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  settlementId: SettlementId,\n  outcome: SettlementOutcome,\n  record: RecordEnvelope,\n  recordDigest: Digest,\n}) {}\n\n/**\n * The committed reservation. `replayed` is true when an identical reservation already existed;\n * the stored exact record is returned so recovery appends precisely what was reserved.\n */\nexport class ReservedSettlement extends Schema.Class<ReservedSettlement>(\n  \"@effect-agent/thread/ReservedSettlement\",\n)({\n  submissionId: SubmissionId,\n  settlementId: SettlementId,\n  outcome: SettlementOutcome,\n  record: RecordEnvelope,\n  recordDigest: Digest,\n  replayed: Schema.Boolean,\n}) {}\n\nexport class SettlementFinalization extends Schema.Class<SettlementFinalization>(\n  \"@effect-agent/thread/SettlementFinalization\",\n)({\n  submissionId: SubmissionId,\n  settlementId: SettlementId,\n}) {}\n\nconst SettlementFields = Schema.Struct({\n  submissionId: SubmissionId,\n  settlementId: SettlementId,\n  receiptId: ReceiptId,\n  outcome: SettlementOutcome,\n  /** Schema-encoded application disposition materialized from the exact canonical reservation. */\n  runDisposition: Schema.optionalKey(PersistedJson),\n  /** Canonical aggregate of model usage and estimated spend for this Run. */\n  usageSummary: Schema.optionalKey(RunUsageSummary),\n  /** Present exactly for `failed`; its Schema rejects excess keys before canonical projection. */\n  failure: Schema.optionalKey(SettlementFailureDiagnostic),\n  settledAt: Schema.DateTimeUtcFromString,\n}).check(\n  Schema.makeFilter(\n    (settlement) => (settlement.outcome === \"failed\") === (settlement.failure !== undefined),\n    { title: \"failure exactly on a failed Settlement\" },\n  ),\n);\n\n/** The single durable terminal outcome recorded for one accepted Submission (DUR-002). */\nexport class Settlement extends Schema.Class<Settlement>(\"@effect-agent/thread/Settlement\")(\n  SettlementFields,\n) {}\n\n/**\n * Project the bounded failed-settlement diagnostic from an already Schema-validated exact\n * reservation. Storage adapters use this when materializing their operational Settlement value;\n * the canonical record remains the authority.\n */\nexport const settlementFailureFromRecord = (\n  record: RecordEnvelope,\n): SettlementFailureDiagnostic | undefined => {\n  const payload = record.payload;\n\n  return payload._tag === \"SubmissionSettled\" && payload.outcome === \"failed\"\n    ? payload.result\n    : undefined;\n};\n\n/**\n * A durable abort command (durability §13). Field bounds are exactly those of the canonical\n * `AbortRequested` payload so the intent can become canonical without re-validation.\n */\nexport class AbortCommand extends Schema.Class<AbortCommand>(\"@effect-agent/thread/AbortCommand\")({\n  submissionId: SubmissionId,\n  author: AbortRequested.fields.author,\n  reason: AbortRequested.fields.reason,\n}) {}\n\n/**\n * The recorded abort intent. `canonicalRecordId` is present once the corresponding canonical\n * `AbortRequested` record has been appended (its identity is deterministic; see\n * `submissionAbortRecordId`).\n */\nexport class AbortIntent extends Schema.Class<AbortIntent>(\"@effect-agent/thread/AbortIntent\")({\n  submissionId: SubmissionId,\n  author: AbortRequested.fields.author,\n  reason: AbortRequested.fields.reason,\n  requestedAt: Schema.DateTimeUtcFromString,\n  canonicalRecordId: Schema.optionalKey(RecordId),\n}) {}\n\n/** Address one lane-local abort intent without loading unrelated recovery state. */\nexport class AbortIntentRequest extends Schema.Class<AbortIntentRequest>(\n  \"@effect-agent/thread/AbortIntentRequest\",\n)({ submissionId: SubmissionId }) {}\n\n/**\n * Atomic claim of the contiguous ready prefix of strictly-later queued Submissions for joining\n * into the active host Run (plan §2.5). Fenced by the host Attempt's ownership token — no epoch\n * bump, the host already owns the lane. An `admitted`-but-not-`ready` row breaks the prefix;\n * an aborted-settled row is a closed obligation and is skipped as a non-gap (P7 §7(c)).\n */\nexport class ClaimJoiningRequest extends Schema.Class<ClaimJoiningRequest>(\n  \"@effect-agent/thread/ClaimJoiningRequest\",\n)({\n  threadId: ThreadId,\n  hostSubmissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  maxCount: Schema.Int.check(Schema.isGreaterThan(0)),\n}) {}\n\n/** One queued Submission transitioned to `joining` under the host's ownership. */\nexport class JoiningClaim extends Schema.Class<JoiningClaim>(\"@effect-agent/thread/JoiningClaim\")({\n  submissionId: SubmissionId,\n  queueSequence: QueueSequence,\n  inputPayload: PersistedJson,\n}) {}\n\n/**\n * The canonical position of one joined Submission's `UserInputRecorded` record (`input:{sid}`).\n * Marking transitions `joining → joined` and records the host linkage established at claim time.\n */\nexport class MarkJoinedRequest extends Schema.Class<MarkJoinedRequest>(\n  \"@effect-agent/thread/MarkJoinedRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  recordId: RecordId,\n  sequence: CanonicalSequence,\n}) {}\n\n/**\n * Recovery-only revert of a `joining` Submission whose canonical input append never committed\n * (DUR-016): `joining → ready`, idempotent, a no-op when the Submission already joined.\n */\nexport class RevertJoiningRequest extends Schema.Class<RevertJoiningRequest>(\n  \"@effect-agent/thread/RevertJoiningRequest\",\n)({\n  submissionId: SubmissionId,\n}) {}\n\n/**\n * Why one Submission is durably suspended. Approval was the only Phase 5 reason; S2 adds\n * `WaitingForChild` (spec §12 step 10) and the union keeps later suspension families (e.g.\n * operator quarantine) additive.\n */\nexport class ApprovalPendingSuspension extends Schema.TaggedClass<ApprovalPendingSuspension>(\n  \"@effect-agent/thread/ApprovalPendingSuspension\",\n)(\"ApprovalPending\", {\n  toolCallIds: Schema.NonEmptyArray(ToolCallId),\n}) {}\n\n/** One attached child a `waitingForChild` parent is durably waiting on (spec §12 step 10). */\nexport class WaitingChild extends Schema.Class<WaitingChild>(\"@effect-agent/thread/WaitingChild\")({\n  toolCallId: ToolCallId,\n  childSubmissionId: SubmissionId,\n}) {}\n\n/**\n * The parent Attempt ended without settling because attached durable children must settle and\n * join first (spec §12 step 10, SUB-030). The suspended lane holds no worker permit; each listed\n * child settles on its own Thread lane and `recordChildSettled` wakes the parent once\n * every listed child is settled.\n */\nexport class WaitingForChildSuspension extends Schema.TaggedClass<WaitingForChildSuspension>(\n  \"@effect-agent/thread/WaitingForChildSuspension\",\n)(\"WaitingForChild\", {\n  children: Schema.NonEmptyArray(WaitingChild),\n}) {}\n\nexport const SuspensionReason = Schema.Union([\n  ApprovalPendingSuspension,\n  WaitingForChildSuspension,\n]);\n\nexport type SuspensionReason = typeof SuspensionReason.Type;\n\n/**\n * Durable suspension of owned work (plan §2.6): `input-applied`/`running` → `suspended`, the\n * ownership period ends, NO settlement occurs — the accepted-work obligation stays owed while\n * the lane consumes no worker permit.\n */\nexport class SuspendRequest extends Schema.Class<SuspendRequest>(\n  \"@effect-agent/thread/SuspendRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  reason: SuspensionReason,\n}) {}\n\n/**\n * `suspended` when the lane is now durably waiting; `resume-immediately` when the suspension\n * reason is already fully covered (a covering decision or child settlement raced ahead of the\n * suspend transaction), so the caller resumes without releasing the lane.\n */\nexport const SuspensionOutcome = Schema.Literals([\"suspended\", \"resume-immediately\"]);\nexport type SuspensionOutcome = typeof SuspensionOutcome.Type;\n\n/**\n * A durable child-settlement notification for one waitingForChild parent (spec §12 step 10).\n * The child's canonical Settlement is the authority; this command only drives the parent lane's\n * wake transition.\n */\nexport class ChildSettledNotification extends Schema.Class<ChildSettledNotification>(\n  \"@effect-agent/thread/ChildSettledNotification\",\n)({\n  parentSubmissionId: SubmissionId,\n  childSubmissionId: SubmissionId,\n}) {}\n\n/**\n * `woken` when this notification completed the waiting set and the parent transitioned\n * `suspended(WaitingForChild) → input-applied`; `still-waiting` while other listed children are\n * unsettled; `not-waiting` when the parent is not (or no longer) suspended waiting on this\n * child — including replays after a wake, so the operation is idempotent.\n */\nexport const ChildSettledOutcome = Schema.Literals([\"woken\", \"still-waiting\", \"not-waiting\"]);\nexport type ChildSettledOutcome = typeof ChildSettledOutcome.Type;\n\n/** Parent-owned child budget reservation identity, deterministically derived by the\n * coordinator from the parent Run and Tool Call identity (spec §12 step 2). */\nexport const ChildReservationId = identifier(\"ChildReservationId\");\nexport type ChildReservationId = typeof ChildReservationId.Type;\n\n/**\n * The reservation state machine (spec §12 steps 2 and 6): `reserved` while the child may still\n * consume the allocation, `releasePending` once the final accounting decision is frozen, and\n * `released` after the unused allocation returned exactly once.\n */\nexport const ChildReservationStatus = Schema.Literals([\"reserved\", \"releasePending\", \"released\"]);\nexport type ChildReservationStatus = typeof ChildReservationStatus.Type;\n\n/**\n * Creation input for one parent-owned child budget reservation. The allocation is an opaque\n * Schema-encoded budget document (D8: adapters implement transitions only and never interpret\n * budget dimensions); `allocationDigest` must be the digest of its canonical JSON encoding.\n */\nexport class ChildBudgetReservationRequest extends Schema.Class<ChildBudgetReservationRequest>(\n  \"@effect-agent/thread/ChildBudgetReservationRequest\",\n)({\n  reservationId: ChildReservationId,\n  parentSubmissionId: SubmissionId,\n  parentToolCallId: ToolCallId,\n  ownershipToken: OwnershipToken,\n  allocation: PersistedJson,\n  allocationDigest: Digest,\n}) {}\n\n/** One child budget reservation row as the port exposes it. */\nexport class ChildBudgetReservationSnapshot extends Schema.Class<ChildBudgetReservationSnapshot>(\n  \"@effect-agent/thread/ChildBudgetReservationSnapshot\",\n)({\n  reservationId: ChildReservationId,\n  parentSubmissionId: SubmissionId,\n  parentToolCallId: ToolCallId,\n  childSubmissionId: Schema.optionalKey(SubmissionId),\n  status: ChildReservationStatus,\n  allocation: PersistedJson,\n  allocationDigest: Digest,\n  accounting: Schema.optionalKey(PersistedJson),\n  reservedAt: Schema.DateTimeUtcFromString,\n  releaseBeganAt: Schema.optionalKey(Schema.DateTimeUtcFromString),\n  releasedAt: Schema.optionalKey(Schema.DateTimeUtcFromString),\n}) {}\n\n/**\n * The committed reservation. `replayed` is true when an identical reservation already existed;\n * the stored row is returned unchanged so a recovering caller resumes rather than duplicates\n * (SUB-016).\n */\nexport class ReservedChildBudget extends Schema.Class<ReservedChildBudget>(\n  \"@effect-agent/thread/ReservedChildBudget\",\n)({\n  reservation: ChildBudgetReservationSnapshot,\n  replayed: Schema.Boolean,\n}) {}\n\n/** Records the admitted child on its reservation row (repairable from `SubagentStarted`). */\nexport class AttachChildToReservationRequest extends Schema.Class<AttachChildToReservationRequest>(\n  \"@effect-agent/thread/AttachChildToReservationRequest\",\n)({\n  reservationId: ChildReservationId,\n  ownershipToken: OwnershipToken,\n  childSubmissionId: SubmissionId,\n}) {}\n\n/**\n * Freezes the final consumed/released accounting decision (spec §12 join step 6). The\n * accounting is an opaque Schema-encoded document replayed from the canonical `SubagentJoined`\n * record (or the deterministic zero-consumed decision for an orphaned reservation), so the\n * decision itself authorizes the transition — no ownership token is consulted (DUR-015).\n */\nexport class BeginChildBudgetReleaseRequest extends Schema.Class<BeginChildBudgetReleaseRequest>(\n  \"@effect-agent/thread/BeginChildBudgetReleaseRequest\",\n)({\n  reservationId: ChildReservationId,\n  accounting: PersistedJson,\n}) {}\n\n/** Applies the frozen accounting decision: `releasePending → released`, exactly once. */\nexport class ReleaseChildBudgetRequest extends Schema.Class<ReleaseChildBudgetRequest>(\n  \"@effect-agent/thread/ReleaseChildBudgetRequest\",\n)({\n  reservationId: ChildReservationId,\n}) {}\n\n/**\n * A durable approval decision command (plan §2.6, `abort`-shaped). Field bounds are exactly those\n * of the canonical `ToolApprovalDecided` payload so the intent can become canonical without\n * re-validation.\n */\nexport class ApprovalDecisionCommand extends Schema.Class<ApprovalDecisionCommand>(\n  \"@effect-agent/thread/ApprovalDecisionCommand\",\n)({\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  decision: ApprovalDecision,\n  resolver: ToolApprovalDecided.fields.resolver,\n  reason: ToolApprovalDecided.fields.reason,\n}) {}\n\n/**\n * The recorded approval-decision intent, idempotent per `(submissionId, toolCallId)`.\n * `canonicalRecordId` is present once the corresponding canonical `ToolApprovalDecided` record\n * has been appended (see `toolApprovalDecisionRecordId`).\n */\nexport class ApprovalDecisionIntent extends Schema.Class<ApprovalDecisionIntent>(\n  \"@effect-agent/thread/ApprovalDecisionIntent\",\n)({\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  decision: ApprovalDecision,\n  resolver: ToolApprovalDecided.fields.resolver,\n  reason: ToolApprovalDecided.fields.reason,\n  decidedAt: Schema.DateTimeUtcFromString,\n  canonicalRecordId: Schema.optionalKey(RecordId),\n}) {}\n\n/**\n * Durable Unknown marking for one Submission's open ordinary Tool Calls (DUR-009): state →\n * `unknown`, parking that Submission without changing ownership or the Thread epoch. Idempotent.\n */\nexport class MarkUnknownRequest extends Schema.Class<MarkUnknownRequest>(\n  \"@effect-agent/thread/MarkUnknownRequest\",\n)({\n  submissionId: SubmissionId,\n  toolCallIds: Schema.NonEmptyArray(ToolCallId),\n  reason: ToolCallUnknown.fields.reason,\n}) {}\n\n/** The recovered supplier truth: the external effect completed with this exact result. */\nexport class ResolutionCompletedWithResult extends Schema.TaggedClass<ResolutionCompletedWithResult>(\n  \"@effect-agent/thread/ResolutionCompletedWithResult\",\n)(\"CompletedWithResult\", {\n  result: PersistedJson,\n  isFailure: Schema.Boolean,\n}) {}\n\n/** The external effect provably never happened; the call may re-execute on resume. */\nexport class ResolutionNeverHappened extends Schema.TaggedClass<ResolutionNeverHappened>(\n  \"@effect-agent/thread/ResolutionNeverHappened\",\n)(\"NeverHappened\", {}) {}\n\n/** The call is safe to repeat under the external system's idempotency contract. */\nexport class ResolutionSafeToRetry extends Schema.TaggedClass<ResolutionSafeToRetry>(\n  \"@effect-agent/thread/ResolutionSafeToRetry\",\n)(\"SafeToRetry\", {}) {}\n\n/** Give up on the Submission: route into the abort path (unknown calls stay recorded; abort\n * never claims external rollback, durability §13). */\nexport class ResolutionAbortSubmission extends Schema.TaggedClass<ResolutionAbortSubmission>(\n  \"@effect-agent/thread/ResolutionAbortSubmission\",\n)(\"AbortSubmission\", {}) {}\n\n/** How an authorized resolver closed one Unknown Outcome (DUR-017). */\nexport const UnknownResolution = Schema.Union([\n  ResolutionCompletedWithResult,\n  ResolutionNeverHappened,\n  ResolutionSafeToRetry,\n  ResolutionAbortSubmission,\n]);\n\nexport type UnknownResolution = typeof UnknownResolution.Type;\n\n/**\n * A durable Unknown-Outcome resolution command (DUR-017, `abort`-shaped). Possession of the\n * runtime service plus the mandatory `author`/`reason` audit fields is the Phase 5 authorization\n * boundary — identical to `abort`; the authenticated operator surface is a P7 deliverable.\n * Field bounds are exactly those of the canonical `ToolCallResolved` payload.\n */\nexport class UnknownResolutionCommand extends Schema.Class<UnknownResolutionCommand>(\n  \"@effect-agent/thread/UnknownResolutionCommand\",\n)({\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  author: ToolCallResolved.fields.author,\n  reason: ToolCallResolved.fields.reason,\n  resolution: UnknownResolution,\n}) {}\n\n/**\n * The recorded resolution intent, idempotent per `(submissionId, toolCallId)`. The canonical\n * `ToolCallResolved` (+ `ToolCallSettled` for `CompletedWithResult`) is appended by the recovery\n * pass or the next owning Attempt; `canonicalRecordId` is present once it is.\n */\nexport class UnknownResolutionIntent extends Schema.Class<UnknownResolutionIntent>(\n  \"@effect-agent/thread/UnknownResolutionIntent\",\n)({\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  author: ToolCallResolved.fields.author,\n  reason: ToolCallResolved.fields.reason,\n  resolution: UnknownResolution,\n  resolvedAt: Schema.DateTimeUtcFromString,\n  canonicalRecordId: Schema.optionalKey(RecordId),\n}) {}\n\n/** Current ownership as recovery sees it. The live owner's token is never exposed here. */\nexport class OwnershipSnapshot extends Schema.Class<OwnershipSnapshot>(\n  \"@effect-agent/thread/OwnershipSnapshot\",\n)({\n  attemptId: AttemptId,\n  ownerProducerId: ProducerId,\n  producerEpoch: ProducerEpoch,\n  leaseExpiresAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/** A settlement reservation as recovery sees it. */\nexport class SettlementReservationSnapshot extends Schema.Class<SettlementReservationSnapshot>(\n  \"@effect-agent/thread/SettlementReservationSnapshot\",\n)({\n  settlementId: SettlementId,\n  outcome: SettlementOutcome,\n  record: RecordEnvelope,\n  recordDigest: Digest,\n  finalized: Schema.Boolean,\n}) {}\n\nexport class RecoverySnapshotRequest extends Schema.Class<RecoverySnapshotRequest>(\n  \"@effect-agent/thread/RecoverySnapshotRequest\",\n)({\n  submissionId: SubmissionId,\n}) {}\n\n/** One joined/joining Submission of a host Run, as the host's recovery sees it. */\nexport class JoinSnapshot extends Schema.Class<JoinSnapshot>(\"@effect-agent/thread/JoinSnapshot\")({\n  submissionId: SubmissionId,\n  state: SubmissionState,\n  hostSubmissionId: SubmissionId,\n}) {}\n\n/** A durable suspension as recovery sees it. */\nexport class SuspensionSnapshot extends Schema.Class<SuspensionSnapshot>(\n  \"@effect-agent/thread/SuspensionSnapshot\",\n)({\n  reason: SuspensionReason,\n  suspendedAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/**\n * One attached child of this parent as its recovery sees it: the reservation's recorded child\n * plus that child's current lane state. A disposable derived view — the canonical\n * `SubagentRequested`/`SubagentStarted` records and the child's own canonical Settlement remain\n * the recovery truth (DUR-015).\n */\nexport class ChildAttachmentSnapshot extends Schema.Class<ChildAttachmentSnapshot>(\n  \"@effect-agent/thread/ChildAttachmentSnapshot\",\n)({\n  toolCallId: ToolCallId,\n  childSubmissionId: SubmissionId,\n  childState: SubmissionState,\n  childOutcome: Schema.optionalKey(SettlementOutcome),\n}) {}\n\n/**\n * Everything the pure recovery classifier needs about one Submission, read strongly consistently\n * (STORE-003). Canonical history still wins over every marker in this snapshot (DUR-015).\n *\n * Phase 5 fields: `joins` is the host-side view (every Submission `joining`/`joined` to this\n * one); `hostSubmissionId` is the joined-side view; `suspension` mirrors the `suspended` state;\n * `approvalDecisions` and `unknownResolutions` are the durable intents recorded against this\n * Submission (empty when none exist).\n *\n * S2 fields: `childReservations`/`childAttachments` are the parent-side subagent view (ordered\n * by parent Tool Call id) and `parentLinkage` is the child-side view. They default to\n * empty/absent at construction so pre-S2 call sites stay valid; adapters always populate them.\n */\nexport class RecoverySnapshot extends Schema.Class<RecoverySnapshot>(\n  \"@effect-agent/thread/RecoverySnapshot\",\n)({\n  submission: SubmissionSnapshot,\n  ownership: Schema.optionalKey(OwnershipSnapshot),\n  inputApplied: Schema.optionalKey(InputAppliedMarker),\n  reservation: Schema.optionalKey(SettlementReservationSnapshot),\n  abortIntent: Schema.optionalKey(AbortIntent),\n  joins: Schema.Array(JoinSnapshot),\n  hostSubmissionId: Schema.optionalKey(SubmissionId),\n  suspension: Schema.optionalKey(SuspensionSnapshot),\n  approvalDecisions: Schema.Array(ApprovalDecisionIntent),\n  unknownResolutions: Schema.Array(UnknownResolutionIntent),\n  childReservations: Schema.Array(ChildBudgetReservationSnapshot).pipe(\n    Schema.withConstructorDefault(Effect.succeed([])),\n  ),\n  childAttachments: Schema.Array(ChildAttachmentSnapshot).pipe(\n    Schema.withConstructorDefault(Effect.succeed([])),\n  ),\n  parentLinkage: Schema.optionalKey(ParentLinkage),\n}) {}\n\n/** The same idempotency key was admitted with different canonical input content. */\nexport class AdmissionConflict extends Schema.TaggedError<AdmissionConflict>()(\n  \"AdmissionConflict\",\n  {\n    threadId: ThreadId,\n    principal: Principal,\n    idempotencyKey: IdempotencyKey,\n    existingInputDigest: Digest,\n    attemptedInputDigest: Digest,\n  },\n) {}\n\n/**\n * The presented ownership token no longer owns the Submission's lane. `actualEpoch` is the\n * thread's current producer epoch so a stale Attempt can prove to itself it was superseded.\n */\nexport class OwnershipLost extends Schema.TaggedError<OwnershipLost>()(\"OwnershipLost\", {\n  submissionId: SubmissionId,\n  actualEpoch: ProducerEpoch,\n}) {}\n\n/** A conflicting terminal outcome was already reserved or finalized (DUR-002, DUR-012). */\nexport class SettlementConflict extends Schema.TaggedError<SettlementConflict>()(\n  \"SettlementConflict\",\n  {\n    submissionId: SubmissionId,\n    existingOutcome: SettlementOutcome,\n  },\n) {}\n\n/**\n * A divergent approval re-decision for an already-decided `(submissionId, toolCallId)` pair.\n * Repeating the SAME decision replays the recorded intent instead (idempotency).\n */\nexport class ApprovalConflict extends Schema.TaggedError<ApprovalConflict>()(\"ApprovalConflict\", {\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  existingDecision: ApprovalDecision,\n}) {}\n\n/**\n * A divergent unknown-outcome re-resolution for an already-resolved `(submissionId, toolCallId)`\n * pair (DUR-017). Repeating the SAME resolution replays the recorded intent instead.\n */\nexport class UnknownResolutionConflict extends Schema.TaggedError<UnknownResolutionConflict>()(\n  \"UnknownResolutionConflict\",\n  {\n    submissionId: SubmissionId,\n    toolCallId: ToolCallId,\n  },\n) {}\n\n/**\n * A child budget reservation request contradicts recorded reservation state: a divergent\n * allocation for the same reservation id, a second reservation id for the same parent Tool\n * Call, a divergent child attachment, a divergent accounting freeze, or an out-of-order state\n * transition. `status` reports the existing row's status. Identical replays never conflict.\n */\nexport class ChildReservationConflict extends Schema.TaggedError<ChildReservationConflict>()(\n  \"ChildReservationConflict\",\n  {\n    reservationId: ChildReservationId,\n    status: ChildReservationStatus,\n    message: Schema.String,\n  },\n) {}\n\n/** Adapter-level ledger failure (storage unavailable, unknown submission, corrupt row, ...). */\nexport class LedgerError extends Schema.TaggedError<LedgerError>()(\"LedgerError\", {\n  operation: Schema.String,\n  message: Schema.String,\n  cause: Schema.optionalKey(FailureDiagnostic.Value),\n}) {}\n\nexport type SubmissionLedgerFailure =\n  | AdmissionConflict\n  | OwnershipLost\n  | SettlementConflict\n  | ApprovalConflict\n  | UnknownResolutionConflict\n  | JoinedToHost\n  | ChildReservationConflict\n  | LedgerError\n  | AdmissionPolicyError;\n\n/**\n * Operational durable state for accepted work: admission, FIFO readiness, ownership, leases,\n * abort intent, and settlement obligations (STORE-001). The Thread Log remains the\n * authority for applied input and terminal outcomes; every marker in this ledger can be rebuilt\n * from canonical history (DUR-015).\n *\n * Operation contracts:\n *\n * - `admit` — atomic and idempotent by (threadId, principal, idempotencyKey). A replay\n *   with the same `inputDigest` returns the original `AdmissionResult` with `replayed` set; a\n *   replay with a different digest fails with `AdmissionConflict`. Admission allocates the\n *   Submission's `queueSequence` (FIFO position, DUR-004) and mints `submissionId`/`receiptId`.\n *   An optional `parentLinkage` is recorded immutably at first admission (SUB-016); a replay\n *   whose linkage diverges (present vs. absent, or different identities) fails with\n *   `AdmissionConflict` even when the input digest matches.\n * - `resolveAdmission` — authoritative tri-state admission lookup by scoped idempotency key\n *   (SUB-031): `NotAdmitted` proves absence, `Admitted` carries the full snapshot, and\n *   `Indeterminate` states that the adapter cannot currently prove either. Only `NotAdmitted`\n *   permits an admission attempt. Single strongly consistent stores derive the answer from a\n *   direct lookup and never answer `Indeterminate`.\n * - `markReady` — idempotent transition admitted → ready after Thread materialization.\n *   Marking an already-ready (or later-state) Submission is a no-op.\n * - `lookup` — read one Submission by identity or scoped idempotency key; strongly consistent\n *   with prior ledger writes.\n * - `claim` — claims the lowest unsettled `queueSequence` after skipping only unknown rows\n *   without abort intent. Approval, joining and child-wait barriers remain ordered. Returns\n *   `Option.none` when no eligible work exists or ANY lease in the Thread is live, including\n *   a lease belonging to the same producer. A successful claim atomically bumps the Thread's producer\n *   epoch — fencing every stale Attempt out of canonical appends (DUR-006) — mints a fresh\n *   `attemptId` and `ownershipToken`, and starts the ownership lease (D5: adapters default to\n *   `DEFAULT_OWNERSHIP_LEASE_DURATION`, configurable). An expired lease makes the head\n *   claimable; expiry alone never revokes correctness, only permission to assume liveness.\n * - `renewOwnership` — extends the lease while the token still owns the lane; fails with\n *   `OwnershipLost` once superseded. Renewal after lease expiry succeeds if no other claim has\n *   taken the lane in between.\n * - `releaseOwnership` — graceful drain: ends the ownership period without settling, returning\n *   a nonterminal head to claimable state. Fails with `OwnershipLost` once superseded.\n * - `markInputApplied` — idempotent marker that the deterministic `UserInputRecorded` record is\n *   canonical (state → input-applied). Recovery repairs this marker from history when the append\n *   committed but the marker write was lost.\n * - `reserveSettlement` — reserves the Submission's single exact settlement record\n *   (state → terminalizing). Idempotent: an identical reservation replays with `replayed` set; a\n *   different outcome or content fails with `SettlementConflict{existingOutcome}` (DUR-011).\n *   For a `joined` Submission the reservation is authorized by its recorded host linkage — a\n *   joined lane is never worker-claimable, so no ownership token can exist for it and the\n *   presented token is not consulted (plan §2.5: joined Submissions settle with the host).\n *   Likewise, an ABORTED reservation for a `ready`/`terminalizing` Submission that carries a\n *   durable abort intent and holds no live ownership is authorized by that intent (P7 §7(c)):\n *   recovery settles aborted never-claimed queued work immediately, without waiting for it to\n *   head the lane. Both exceptions are outcome- and state-narrow; everything else stays fenced.\n * - `finalizeSettlement` — idempotent terminal transition (state → settled) after the reserved\n *   record is canonical; releases the lane so the next `queueSequence` becomes claimable. It\n *   requires no ownership token: canonical history authorizes finalization (DUR-015). A\n *   finalization that disagrees with the recorded outcome fails with `SettlementConflict`.\n * - `requestAbort` — durable, idempotent by `submissionId`: repeating returns the recorded\n *   intent unchanged (DUR-012). Fails with `SettlementConflict` once the Submission is settled;\n *   abort never rewrites a terminal outcome. Fails with `JoinedToHost` for a `joined` Submission\n *   — it settles with its host, so the abort target is the host (plan §2.5). Abort of a\n *   `joining` Submission records the intent; it is honored only if the host has not consumed the\n *   input (revert-then-abort).\n * - `claimJoining` — atomic: transitions the contiguous `ready` prefix of strictly-later\n *   `queueSequence`s (up to `maxCount`) to `joining` under the host's ownership token, recording\n *   the host linkage; no epoch bump (the host Attempt already owns the lane). An\n *   `admitted`-not-`ready` row breaks the prefix; an aborted-settled row is a closed obligation\n *   and is skipped as a non-gap (P7 §7(c)). Fails with `OwnershipLost` once superseded.\n * - `markJoined` — idempotent `joining → joined` with the canonical input record position;\n *   repairable from history when the append committed but the marker write was lost (DUR-016).\n * - `revertJoining` — recovery-only, idempotent `joining → ready`; a no-op when already joined.\n * - `suspend` — `input-applied`/`running` → `suspended`; ends the ownership period WITHOUT\n *   settling (the obligation stays owed, the lane consumes no worker permit). Returns\n *   `resume-immediately` when the reason is already fully covered: for `ApprovalPending`,\n *   recorded decisions cover every pending call; for `WaitingForChild`, every listed child is\n *   already provably settled. Adapters must guarantee that a child settlement reported before\n *   the suspend transaction commits is observed by that suspend (single-store adapters derive\n *   this from the child's own row; cross-store adapters record a durable notification marker).\n *   Fails with `SettlementConflict` once settled.\n * - `recordApprovalDecision` — durable, idempotent per `(submissionId, toolCallId)`: repeating\n *   the same decision replays the intent; a divergent re-decision fails with `ApprovalConflict`.\n *   Transitions `suspended(ApprovalPending) → input-applied` once every pending call of the\n *   suspension reason is decided, waking the lane. Fails with `SettlementConflict` once settled.\n * - `recordChildSettled` — idempotent cross-lane wake (spec §12 step 10): transitions\n *   `suspended(WaitingForChild) → input-applied` exactly when EVERY listed child is settled,\n *   answering `woken`; `still-waiting` while any listed child is unsettled; `not-waiting` when\n *   the parent is not suspended waiting on this child (including replays after the wake). The\n *   child's canonical Settlement is the authority. The runtime reports it after the exact\n *   reserved record is appended and before ledger finalization, so same-store adapters accept\n *   `terminalizing` only when its exact reservation exists; an earlier child is an\n *   adapter-checked caller error. It never settles the parent and requires no ownership token:\n *   the canonically recorded child settlement authorizes the wake.\n * - `reserveChildBudget` — idempotent get-or-create of the parent-owned child budget\n *   reservation (spec §12 step 2), fenced by the parent lane's live `OwnershipToken`. An\n *   identical replay returns the stored row with `replayed` set (unfenced, mirroring\n *   `reserveSettlement`); a divergent allocation for the same id, or a second id for the same\n *   `(parentSubmissionId, parentToolCallId)`, fails with `ChildReservationConflict`.\n * - `attachChildToReservation` — idempotent: records the admitted child on the reservation row\n *   (repairable from the canonical `SubagentStarted` record). A replay with the recorded child\n *   is a no-op; the first attach is fenced by the parent token and requires status `reserved`;\n *   a divergent child fails with `ChildReservationConflict`.\n * - `beginChildBudgetRelease` — `reserved → releasePending`: freezes the final accounting\n *   decision exactly once. Replaying the identical accounting (at `releasePending` or\n *   `released`) is a no-op; a divergent accounting fails with `ChildReservationConflict`.\n *   Requires no ownership token: the accounting is replayed from the canonical `SubagentJoined`\n *   record (or is the deterministic zero-consumed decision for an orphaned reservation), so\n *   canonical history authorizes the transition (DUR-015) and the freeze comparison — not a\n *   fence — guarantees one decision.\n * - `releaseChildBudget` — `releasePending → released`, applied exactly once; replaying returns\n *   the released row unchanged. Releasing a still-`reserved` row (no frozen accounting) fails\n *   with `ChildReservationConflict`. \"A crash before release leaves budget unavailable until\n *   repair, never available twice\" (spec §12).\n * - `markUnknown` — idempotent, ownership-free (canonical evidence authorizes it): state →\n *   `unknown`, parking the Submission while its accepted settlement obligation stays visible.\n *   Existing ownership must release or expire before another claim (DUR-009/DUR-017).\n *   Fails with `SettlementConflict` once settled.\n * - `recordUnknownResolution` — durable, idempotent per `(submissionId, toolCallId)`; a\n *   divergent re-resolution fails with `UnknownResolutionConflict`. Transitions\n *   `unknown → input-applied` once no open call remains, waking the lane. Fails with\n *   `SettlementConflict` once settled.\n * - `scanNonterminal` — streams every Submission whose state is not `settled`, ordered by\n *   (threadId, queueSequence); recovery's admission-independent worklist (DUR-014).\n * - `loadRecoverySnapshot` — strongly consistent full snapshot for the pure recovery classifier.\n *\n * No operation claims exactly-once external side effects; the ledger records decisions\n * exactly once (DUR-003).\n */\nexport class SubmissionLedger extends Context.Service<\n  SubmissionLedger,\n  {\n    readonly capabilities: Effect.Effect<LedgerCapabilities>;\n    readonly admit: (\n      request: AdmissionRequest,\n    ) => Effect.Effect<AdmissionResult, AdmissionConflict | AdmissionPolicyError | LedgerError>;\n    readonly markReady: (request: MarkReadyRequest) => Effect.Effect<void, LedgerError>;\n    readonly lookup: (\n      request: SubmissionLookup,\n    ) => Effect.Effect<Option.Option<SubmissionSnapshot>, LedgerError>;\n    readonly resolveAdmission: (\n      request: SubmissionLookupByKey,\n    ) => Effect.Effect<AdmissionResolution, LedgerError>;\n    readonly claim: (request: ClaimRequest) => Effect.Effect<Option.Option<Claim>, LedgerError>;\n    readonly renewOwnership: (\n      request: RenewOwnershipRequest,\n    ) => Effect.Effect<OwnershipRenewal, OwnershipLost | LedgerError>;\n    readonly releaseOwnership: (\n      request: ReleaseOwnershipRequest,\n    ) => Effect.Effect<void, OwnershipLost | LedgerError>;\n    readonly markInputApplied: (\n      request: MarkInputAppliedRequest,\n    ) => Effect.Effect<void, OwnershipLost | LedgerError>;\n    readonly reserveSettlement: (\n      request: SettlementReservation,\n    ) => Effect.Effect<ReservedSettlement, SettlementConflict | OwnershipLost | LedgerError>;\n    readonly finalizeSettlement: (\n      request: SettlementFinalization,\n    ) => Effect.Effect<Settlement, SettlementConflict | LedgerError>;\n    readonly requestAbort: (\n      request: AbortCommand,\n    ) => Effect.Effect<AbortIntent, SettlementConflict | JoinedToHost | LedgerError>;\n    /**\n     * Strongly consistent lane-local read. Unknown Submissions fail with LedgerError. Canonical\n     * proof has the same meaning as in RecoverySnapshot; this read grants no execution authority.\n     */\n    readonly readAbortIntent: (\n      request: AbortIntentRequest,\n    ) => Effect.Effect<AbortIntent | undefined, LedgerError>;\n    readonly claimJoining: (\n      request: ClaimJoiningRequest,\n    ) => Effect.Effect<ReadonlyArray<JoiningClaim>, OwnershipLost | LedgerError>;\n    readonly markJoined: (\n      request: MarkJoinedRequest,\n    ) => Effect.Effect<void, OwnershipLost | LedgerError>;\n    readonly revertJoining: (request: RevertJoiningRequest) => Effect.Effect<void, LedgerError>;\n    readonly suspend: (\n      request: SuspendRequest,\n    ) => Effect.Effect<SuspensionOutcome, OwnershipLost | SettlementConflict | LedgerError>;\n    readonly recordApprovalDecision: (\n      command: ApprovalDecisionCommand,\n    ) => Effect.Effect<ApprovalDecisionIntent, ApprovalConflict | SettlementConflict | LedgerError>;\n    readonly markUnknown: (\n      request: MarkUnknownRequest,\n    ) => Effect.Effect<void, SettlementConflict | LedgerError>;\n    readonly recordUnknownResolution: (\n      command: UnknownResolutionCommand,\n    ) => Effect.Effect<\n      UnknownResolutionIntent,\n      UnknownResolutionConflict | SettlementConflict | LedgerError\n    >;\n    readonly recordChildSettled: (\n      request: ChildSettledNotification,\n    ) => Effect.Effect<ChildSettledOutcome, LedgerError>;\n    readonly reserveChildBudget: (\n      request: ChildBudgetReservationRequest,\n    ) => Effect.Effect<ReservedChildBudget, ChildReservationConflict | OwnershipLost | LedgerError>;\n    readonly attachChildToReservation: (\n      request: AttachChildToReservationRequest,\n    ) => Effect.Effect<\n      ChildBudgetReservationSnapshot,\n      ChildReservationConflict | OwnershipLost | LedgerError\n    >;\n    readonly beginChildBudgetRelease: (\n      request: BeginChildBudgetReleaseRequest,\n    ) => Effect.Effect<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>;\n    readonly releaseChildBudget: (\n      request: ReleaseChildBudgetRequest,\n    ) => Effect.Effect<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>;\n    readonly scanNonterminal: Stream.Stream<SubmissionSnapshot, LedgerError>;\n    readonly loadRecoverySnapshot: (\n      request: RecoverySnapshotRequest,\n    ) => Effect.Effect<RecoverySnapshot, LedgerError>;\n  }\n>()(\"@effect-agent/thread/SubmissionLedger\") {}\n\nconst decodeBatchId = Schema.decodeSync(BatchId);\nconst decodeRecordId = Schema.decodeSync(RecordId);\nconst decodeSettlementId = Schema.decodeSync(SettlementId);\n\n/**\n * Deterministic identity rules shared by every adapter and the durable coordinator. The batch\n * carrying one Submission's canonical `UserInputRecorded` record is `submission-input:{sid}` and\n * the record is `input:{sid}`, so batch idempotency (DUR-007) makes the input append\n * exactly-once-canonical across Attempts.\n */\nexport const submissionInputBatchId = (submissionId: SubmissionId): BatchId =>\n  decodeBatchId(`submission-input:${submissionId}`);\n\n/** Deterministic canonical record identity of one Submission's `UserInputRecorded` record. */\nexport const submissionInputRecordId = (submissionId: SubmissionId): RecordId =>\n  decodeRecordId(`input:${submissionId}`);\n\n/** Deterministic `SettlementId` for one Submission: `settlement:{sid}`. */\nexport const submissionSettlementId = (submissionId: SubmissionId): SettlementId =>\n  decodeSettlementId(`settlement:${submissionId}`);\n\n/** Deterministic batch identity of one Submission's canonical `SubmissionSettled` append. */\nexport const submissionSettlementBatchId = (submissionId: SubmissionId): BatchId =>\n  decodeBatchId(`submission-settlement:${submissionId}`);\n\n/** Deterministic canonical record identity of one Submission's `SubmissionSettled` record. */\nexport const submissionSettlementRecordId = (submissionId: SubmissionId): RecordId =>\n  decodeRecordId(`settlement:${submissionId}`);\n\n/** Deterministic batch identity of one Submission's canonical `AbortRequested` append. */\nexport const submissionAbortBatchId = (submissionId: SubmissionId): BatchId =>\n  decodeBatchId(`submission-abort:${submissionId}`);\n\n/** Deterministic canonical record identity of one Submission's `AbortRequested` record. */\nexport const submissionAbortRecordId = (submissionId: SubmissionId): RecordId =>\n  decodeRecordId(`abort:${submissionId}`);\n\n/** Destination policy, captured when the ledger is acquired. It runs inside fresh admission's\n * serialization after replay lookup. The host must keep it bounded and must not reenter admit.\n * The callback must read authoritative policy in this SAME local transaction, through the\n * acquired SqlClient. Memory evaluates the callback synchronously inside its atomic mutation;\n * an async callback fails with `unavailable/synchronous-memory-policy-required`. Remote reads do not fence remote changes.\n * All policy writers must use that transaction owner. Do not fork, reenter admission, or retain\n * transaction resources. Failure/defect/interruption commits no fresh admission.\n * Current policy never invalidates an exact retained receipt. A supplied fence fails closed\n * unless the destination installed an interpreter for it. */\nexport const SubmissionAdmissionFence = Context.Reference<{\n  readonly check: (request: AdmissionRequest) => Effect.Effect<void, AdmissionPolicyError>;\n}>(\"@effect-agent/thread/SubmissionAdmissionFence\", {\n  defaultValue: () => ({\n    check: (request) =>\n      request.admissionFence === undefined\n        ? Effect.void\n        : AdmissionPolicyError.make({\n            reason: \"refused\",\n            code: \"unsupported-policy\",\n          }),\n  }),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAM,cAAyC,SAC7C,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KACnD,OAAO,MAAM,wBAAwB,MAAM,CAC7C;;;;;AAMF,MAAa,iBAAiB,WAAW,gBAAgB;;;;;;;;;;;;;;;;;;;;AAsBzD,MAAa,kBAAkB,OAAO,SAAS;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AASD,MAAa,mCAAsD,SAAS,QAAQ,EAAE;;;;;;;;;AAUtF,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC,EACA,YAAY,OAAO,SAAS;CAAC;CAAgB;CAAsB;AAAa,CAAC,EACnF,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,gBAAb,cAAmC,OAAO,MACxC,oCACF,CAAC,CAAC;CACA,oBAAoB;CACpB,kBAAkB;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,iBAAiB,OAAO,OAAO;CAC1C,UAAU,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC7D,KAAK,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACxD,UAAU,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AAC/D,CAAC;AAGD,MAAa,iBAAiB,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;;AAGjF,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA;CACE,QAAQ,OAAO,SAAS;EAAC;EAAW;EAAe;CAAU,CAAC;CAC9D,MAAM,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACzD,OAAO,OAAO,YAAYA,KAAuB;CACjD,OAAO,OAAO,YAAY,OAAO,MAAM;AACzC,CACF,CAAC,CAAC,CAAC;;;;;;;;;AAUH,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,UAAU;CACV,WAAW;CACX,gBAAgB;CAChB,SAAS;CACT,cAAc;CACd,cAAc;CACd,cAAc;CACd,aAAa;CACb,eAAe,OAAO,YAAY,aAAa;CAC/C,iBAAiB,OAAO,YAAY,eAAe;CACnD,kBAAkB,OAAO,YAAY,YAAY;CACjD,gBAAgB,OAAO,YAAY,cAAc;CACjD,gBAAgB,OAAO,YAAY,cAAc;AACnD,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,kBAAb,cAAqC,OAAO,MAC1C,sCACF,CAAC,CAAC;CACA,cAAc;CACd,WAAW;CACX,eAAe;CACf,OAAO;CACP,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC,EACA,cAAc,aAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,uBAAb,cAA0C,OAAO,YAC/C,2CACF,CAAC,CAAC,wBAAwB,EACxB,cAAc,aAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,YAChD,4CACF,CAAC,CAAC,yBAAyB;CACzB,UAAU;CACV,WAAW;CACX,gBAAgB;AAClB,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,mBAAmB,OAAO,MAAM,CAAC,sBAAsB,qBAAqB,CAAC;;AAI1F,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,cAAc;CACd,UAAU;CACV,eAAe;CACf,WAAW;CACX,gBAAgB;CAChB,SAAS;CACT,cAAc;CACd,cAAc;CACd,cAAc;CACd,aAAa;CACb,WAAW;CACX,OAAO;CACP,gBAAgB,OAAO,YAAY,iBAAiB;CACpD,WAAW,OAAO;CAClB,SAAS,OAAO,YAAY,OAAO,qBAAqB;CACxD,gBAAgB,OAAO,YAAY,cAAc;CACjD,gBAAgB,OAAO,YAAY,cAAc;CACjD,eAAe,OAAO,YAAY,aAAa;CAC/C,iBAAiB,OAAO,YAAY,eAAe;CACnD,kBAAkB,OAAO,YAAY,YAAY;AACnD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,uBAAb,cAA0C,OAAO,YAC/C,2CACF,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;;AAGtB,IAAa,oBAAb,cAAuC,OAAO,YAC5C,wCACF,CAAC,CAAC,YAAY,EACZ,YAAY,mBACd,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,yBAAb,cAA4C,OAAO,YACjD,6CACF,CAAC,CAAC,iBAAiB,EACjB,QAAQ,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,EACtD,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,MAAa,sBAAsB,OAAO,MAAM;CAC9C;CACA;CACA;AACF,CAAC;AAID,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,UAAU;CACV,YAAY;AACd,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,QAAb,cAA2B,OAAO,MAAa,4BAA4B,CAAC,CAAC;CAC3E,cAAc;CACd,WAAW;CACX,gBAAgB;CAChB,eAAe;CACf,gBAAgB,OAAO;CACvB,cAAc;AAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,4CACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;AAClB,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,gBAAgB;CAChB,gBAAgB,OAAO;AACzB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;AAClB,CAAC,CAAC,CAAC,CAAC;;;;AAKJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;CAChB,UAAU;CACV,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,UAAU;CACV,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,4CACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;CAChB,cAAc;CACd,SAAS;CACT,QAAQ;CACR,cAAc;AAChB,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,cAAc;CACd,cAAc;CACd,SAAS;CACT,QAAQ;CACR,cAAc;CACd,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,yBAAb,cAA4C,OAAO,MACjD,6CACF,CAAC,CAAC;CACA,cAAc;CACd,cAAc;AAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,mBAAmB,OAAO,OAAO;CACrC,cAAc;CACd,cAAc;CACd,WAAW;CACX,SAAS;;CAET,gBAAgB,OAAO,YAAY,aAAa;;CAEhD,cAAc,OAAO,YAAY,eAAe;;CAEhD,SAAS,OAAO,YAAY,2BAA2B;CACvD,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,MACD,OAAO,YACJ,eAAgB,WAAW,YAAY,cAAe,WAAW,YAAY,KAAA,IAC9E,EAAE,OAAO,yCAAyC,CACpD,CACF;;AAGA,IAAa,aAAb,cAAgC,OAAO,MAAkB,iCAAiC,CAAC,CACzF,gBACF,CAAC,CAAC,CAAC;;;;;;AAOH,MAAa,+BACX,WAC4C;CAC5C,MAAM,UAAU,OAAO;CAEvB,OAAO,QAAQ,SAAS,uBAAuB,QAAQ,YAAY,WAC/D,QAAQ,SACR,KAAA;AACN;;;;;AAMA,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,cAAc;CACd,QAAQ,eAAe,OAAO;CAC9B,QAAQ,eAAe,OAAO;AAChC,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,cAAb,cAAiC,OAAO,MAAmB,kCAAkC,CAAC,CAAC;CAC7F,cAAc;CACd,QAAQ,eAAe,OAAO;CAC9B,QAAQ,eAAe,OAAO;CAC9B,aAAa,OAAO;CACpB,mBAAmB,OAAO,YAAY,QAAQ;AAChD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC,EAAE,cAAc,aAAa,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQnC,IAAa,sBAAb,cAAyC,OAAO,MAC9C,0CACF,CAAC,CAAC;CACA,UAAU;CACV,kBAAkB;CAClB,gBAAgB;CAChB,UAAU,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,cAAc;CACd,eAAe;CACf,cAAc;AAChB,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,oBAAb,cAAuC,OAAO,MAC5C,wCACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;CAChB,UAAU;CACV,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,uBAAb,cAA0C,OAAO,MAC/C,2CACF,CAAC,CAAC,EACA,cAAc,aAChB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,4BAAb,cAA+C,OAAO,YACpD,gDACF,CAAC,CAAC,mBAAmB,EACnB,aAAa,OAAO,cAAc,UAAU,EAC9C,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,YAAY;CACZ,mBAAmB;AACrB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,4BAAb,cAA+C,OAAO,YACpD,gDACF,CAAC,CAAC,mBAAmB,EACnB,UAAU,OAAO,cAAc,YAAY,EAC7C,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,mBAAmB,OAAO,MAAM,CAC3C,2BACA,yBACF,CAAC;;;;;;AASD,IAAa,iBAAb,cAAoC,OAAO,MACzC,qCACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;CAChB,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,MAAa,oBAAoB,OAAO,SAAS,CAAC,aAAa,oBAAoB,CAAC;;;;;;AAQpF,IAAa,2BAAb,cAA8C,OAAO,MACnD,+CACF,CAAC,CAAC;CACA,oBAAoB;CACpB,mBAAmB;AACrB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,MAAa,sBAAsB,OAAO,SAAS;CAAC;CAAS;CAAiB;AAAa,CAAC;;;AAK5F,MAAa,qBAAqB,WAAW,oBAAoB;;;;;;AAQjE,MAAa,yBAAyB,OAAO,SAAS;CAAC;CAAY;CAAkB;AAAU,CAAC;;;;;;AAQhG,IAAa,gCAAb,cAAmD,OAAO,MACxD,oDACF,CAAC,CAAC;CACA,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,gBAAgB;CAChB,YAAY;CACZ,kBAAkB;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,iCAAb,cAAoD,OAAO,MACzD,qDACF,CAAC,CAAC;CACA,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,mBAAmB,OAAO,YAAY,YAAY;CAClD,QAAQ;CACR,YAAY;CACZ,kBAAkB;CAClB,YAAY,OAAO,YAAY,aAAa;CAC5C,YAAY,OAAO;CACnB,gBAAgB,OAAO,YAAY,OAAO,qBAAqB;CAC/D,YAAY,OAAO,YAAY,OAAO,qBAAqB;AAC7D,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,sBAAb,cAAyC,OAAO,MAC9C,0CACF,CAAC,CAAC;CACA,aAAa;CACb,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,kCAAb,cAAqD,OAAO,MAC1D,sDACF,CAAC,CAAC;CACA,eAAe;CACf,gBAAgB;CAChB,mBAAmB;AACrB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,iCAAb,cAAoD,OAAO,MACzD,qDACF,CAAC,CAAC;CACA,eAAe;CACf,YAAY;AACd,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,4BAAb,cAA+C,OAAO,MACpD,gDACF,CAAC,CAAC,EACA,eAAe,mBACjB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,cAAc;CACd,YAAY;CACZ,UAAU;CACV,UAAU,oBAAoB,OAAO;CACrC,QAAQ,oBAAoB,OAAO;AACrC,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,yBAAb,cAA4C,OAAO,MACjD,6CACF,CAAC,CAAC;CACA,cAAc;CACd,YAAY;CACZ,UAAU;CACV,UAAU,oBAAoB,OAAO;CACrC,QAAQ,oBAAoB,OAAO;CACnC,WAAW,OAAO;CAClB,mBAAmB,OAAO,YAAY,QAAQ;AAChD,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,cAAc;CACd,aAAa,OAAO,cAAc,UAAU;CAC5C,QAAQ,gBAAgB,OAAO;AACjC,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gCAAb,cAAmD,OAAO,YACxD,oDACF,CAAC,CAAC,uBAAuB;CACvB,QAAQ;CACR,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,0BAAb,cAA6C,OAAO,YAClD,8CACF,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;;AAGxB,IAAa,wBAAb,cAA2C,OAAO,YAChD,4CACF,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;;;AAItB,IAAa,4BAAb,cAA+C,OAAO,YACpD,gDACF,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;;AAG1B,MAAa,oBAAoB,OAAO,MAAM;CAC5C;CACA;CACA;CACA;AACF,CAAC;;;;;;;AAUD,IAAa,2BAAb,cAA8C,OAAO,MACnD,+CACF,CAAC,CAAC;CACA,cAAc;CACd,YAAY;CACZ,QAAQ,iBAAiB,OAAO;CAChC,QAAQ,iBAAiB,OAAO;CAChC,YAAY;AACd,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,cAAc;CACd,YAAY;CACZ,QAAQ,iBAAiB,OAAO;CAChC,QAAQ,iBAAiB,OAAO;CAChC,YAAY;CACZ,YAAY,OAAO;CACnB,mBAAmB,OAAO,YAAY,QAAQ;AAChD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,oBAAb,cAAuC,OAAO,MAC5C,wCACF,CAAC,CAAC;CACA,WAAW;CACX,iBAAiB;CACjB,eAAe;CACf,gBAAgB,OAAO;AACzB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gCAAb,cAAmD,OAAO,MACxD,oDACF,CAAC,CAAC;CACA,cAAc;CACd,SAAS;CACT,QAAQ;CACR,cAAc;CACd,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC,EACA,cAAc,aAChB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,cAAc;CACd,OAAO;CACP,kBAAkB;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,QAAQ;CACR,aAAa,OAAO;AACtB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,YAAY;CACZ,mBAAmB;CACnB,YAAY;CACZ,cAAc,OAAO,YAAY,iBAAiB;AACpD,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;AAeJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,YAAY;CACZ,WAAW,OAAO,YAAY,iBAAiB;CAC/C,cAAc,OAAO,YAAY,kBAAkB;CACnD,aAAa,OAAO,YAAY,6BAA6B;CAC7D,aAAa,OAAO,YAAY,WAAW;CAC3C,OAAO,OAAO,MAAM,YAAY;CAChC,kBAAkB,OAAO,YAAY,YAAY;CACjD,YAAY,OAAO,YAAY,kBAAkB;CACjD,mBAAmB,OAAO,MAAM,sBAAsB;CACtD,oBAAoB,OAAO,MAAM,uBAAuB;CACxD,mBAAmB,OAAO,MAAM,8BAA8B,CAAC,CAAC,KAC9D,OAAO,uBAAuB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAClD;CACA,kBAAkB,OAAO,MAAM,uBAAuB,CAAC,CAAC,KACtD,OAAO,uBAAuB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAClD;CACA,eAAe,OAAO,YAAY,aAAa;AACjD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA;CACE,UAAU;CACV,WAAW;CACX,gBAAgB;CAChB,qBAAqB;CACrB,sBAAsB;AACxB,CACF,CAAC,CAAC,CAAC;;;;;AAMH,IAAa,gBAAb,cAAmC,OAAO,YAA2B,CAAC,CAAC,iBAAiB;CACtF,cAAc;CACd,aAAa;AACf,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA;CACE,cAAc;CACd,iBAAiB;AACnB,CACF,CAAC,CAAC,CAAC;;;;;AAMH,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAAC,oBAAoB;CAC/F,cAAc;CACd,YAAY;CACZ,kBAAkB;AACpB,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA;CACE,cAAc;CACd,YAAY;AACd,CACF,CAAC,CAAC,CAAC;;;;;;;AAQH,IAAa,2BAAb,cAA8C,OAAO,YAAsC,CAAC,CAC1F,4BACA;CACE,eAAe;CACf,QAAQ;CACR,SAAS,OAAO;AAClB,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe;CAChF,WAAW,OAAO;CAClB,SAAS,OAAO;CAChB,OAAO,OAAO,YAAYA,KAAuB;AACnD,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyIJ,IAAa,mBAAb,cAAsC,QAAQ,QAqF5C,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC;AAE9C,MAAM,gBAAgB,OAAO,WAAW,OAAO;AAC/C,MAAM,iBAAiB,OAAO,WAAW,QAAQ;AACjD,MAAM,qBAAqB,OAAO,WAAW,YAAY;;;;;;;AAQzD,MAAa,0BAA0B,iBACrC,cAAc,oBAAoB,cAAc;;AAGlD,MAAa,2BAA2B,iBACtC,eAAe,SAAS,cAAc;;AAGxC,MAAa,0BAA0B,iBACrC,mBAAmB,cAAc,cAAc;;AAGjD,MAAa,+BAA+B,iBAC1C,cAAc,yBAAyB,cAAc;;AAGvD,MAAa,gCAAgC,iBAC3C,eAAe,cAAc,cAAc;;AAG7C,MAAa,0BAA0B,iBACrC,cAAc,oBAAoB,cAAc;;AAGlD,MAAa,2BAA2B,iBACtC,eAAe,SAAS,cAAc;;;;;;;;;;AAWxC,MAAa,2BAA2B,QAAQ,UAE7C,iDAAiD,EAClD,qBAAqB,EACnB,QAAQ,YACN,QAAQ,mBAAmB,KAAA,IACvB,OAAO,OACP,qBAAqB,KAAK;CACxB,QAAQ;CACR,MAAM;AACR,CAAC,EACT,GACF,CAAC"}
+{"version":3,"file":"SubmissionLedger.mjs","names":["FailureDiagnostic.Value"],"sources":["../../src/durable/SubmissionLedger.ts"],"sourcesContent":["import type { Option, Stream } from \"effect\";\nimport { Context, Duration, Effect, Schema } from \"effect\";\n\nimport { InputMessage } from \"../capabilities/Messaging.ts\";\nimport * as FailureDiagnostic from \"../core/FailureDiagnostic.ts\";\nimport {\n  AgentId,\n  AttemptId,\n  ThreadId,\n  ReceiptId,\n  SettlementId,\n  SubmissionId,\n  ToolCallId,\n} from \"../core/Identifiers.ts\";\nimport type { JoinedToHost } from \"../core/Receipt.ts\";\nimport { IdempotencyKey, QueueSequence, Principal } from \"../core/Receipt.ts\";\nimport { RunUsageSummary } from \"../core/Usage.ts\";\nimport {\n  AbortRequested,\n  ApprovalDecision,\n  BatchId,\n  CanonicalSequence,\n  DefinitionDigests,\n  DeploymentId,\n  Digest,\n  PersistedJson,\n  ProducerEpoch,\n  ProducerId,\n  RecordEnvelope,\n  RecordId,\n  SettlementFailureDiagnostic,\n  SettlementOutcome,\n  ToolApprovalDecided,\n  ToolCallResolved,\n  ToolCallUnknown,\n  WorkerAdmission,\n} from \"./Records.ts\";\n\nexport { IdempotencyKey, JoinedToHost, QueueSequence, Principal } from \"../core/Receipt.ts\";\n\nconst identifier = <const Name extends string>(name: Name) =>\n  Schema.NonEmptyString.check(Schema.isMaxLength(256)).pipe(\n    Schema.brand(`@effect-agent/thread/${name}`),\n  );\n\n/**\n * Opaque proof that one Attempt currently owns a Submission's lane. It authorizes ledger\n * mutations only; canonical-log fencing authority remains the producer epoch (DUR-006).\n */\nexport const OwnershipToken = identifier(\"OwnershipToken\");\nexport type OwnershipToken = typeof OwnershipToken.Type;\n\n/**\n * Ledger lifecycle states for one Submission. `settled` is the only terminal state; every other\n * state carries an outstanding accepted-work obligation (Accepted-work Contract, DUR-002).\n *\n * Phase 5 states:\n *\n * - `joining` — a queued Submission claimed by an active host Run, before its canonical\n *   `UserInputRecorded` append; recovery reverts it to `ready` (DUR-016).\n * - `joined` — the input is canonical and linked to its host; the Submission settles WITH the\n *   host Run's outcome.\n * - `suspended` — durably waiting for explicit approval decisions; the ownership period has\n *   ended and the lane consumes no worker permit while the obligation stays owed.\n * - `unknown` — at least one Tool Call has a durable Unknown Outcome; this Submission is\n *   parked until an authorized resolution covers every open call or a durable abort intent\n *   authorizes cleanup without Tool replay. Later eligible input may run (DUR-012/DUR-017).\n *\n * `claim` never grants or bypasses a `joining`, `joined`, or `suspended` head. It skips unknown\n * work without an abort intent. Any live ownership in the Thread prevents another claim.\n */\nexport const SubmissionState = Schema.Literals([\n  \"admitted\",\n  \"ready\",\n  \"joining\",\n  \"joined\",\n  \"running\",\n  \"input-applied\",\n  \"suspended\",\n  \"unknown\",\n  \"terminalizing\",\n  \"settled\",\n]);\n\nexport type SubmissionState = typeof SubmissionState.Type;\n\n/**\n * Default ownership lease duration (D5). The lease is a liveness hint that makes an abandoned\n * claim reclaimable; correctness never depends on it because every canonical append is fenced by\n * producer epoch. Adapters expose this as configuration and use this value when unconfigured.\n */\nexport const DEFAULT_OWNERSHIP_LEASE_DURATION: Duration.Duration = Duration.seconds(30);\n\n/**\n * What a SubmissionLedger adapter claims about itself. `durable-node` asserts single-node\n * process-crash durability (fsync-backed storage); `durable-cloudflare` asserts the same\n * single-serialized-owner crash durability through Durable Object storage output gates;\n * `non-durable` marks reference adapters whose state does not survive the process (in-memory\n * conformance/test adapters). The label is an honest self-description for reports and\n * evidence — no runtime behavior branches on it.\n */\nexport class LedgerCapabilities extends Schema.Class<LedgerCapabilities>(\n  \"@effect-agent/thread/LedgerCapabilities\",\n)({\n  durability: Schema.Literals([\"durable-node\", \"durable-cloudflare\", \"non-durable\"]),\n}) {}\n\n/**\n * Immutable lineage from a child Submission to the exact parent Tool Call that established it\n * (spec §12 step 5, SUB-004). Recorded once at admission and never rewritten; it is an\n * identifier, not an authorization capability (D10) — the join path verifies the canonical\n * Parent Link records, never this marker alone.\n */\nexport class ParentLinkage extends Schema.Class<ParentLinkage>(\n  \"@effect-agent/thread/ParentLinkage\",\n)({\n  parentSubmissionId: SubmissionId,\n  parentToolCallId: ToolCallId,\n}) {}\n\n/** Host-owned policy coordinates, interpreted only by the destination transaction owner. */\nexport const AdmissionFence = Schema.Struct({\n  policyId: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  key: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  revision: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n});\n\nexport type AdmissionFence = typeof AdmissionFence.Type;\nexport const AdmissionGroup = Schema.NonEmptyString.check(Schema.isMaxLength(256));\n\n/** Fresh admission alone may be refused; unavailability never proves non-admission. */\nexport class AdmissionPolicyError extends Schema.TaggedError<AdmissionPolicyError>()(\n  \"AdmissionPolicyError\",\n  {\n    reason: Schema.Literals([\"refused\", \"unavailable\", \"occupied\"]),\n    code: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n    cause: Schema.optionalKey(FailureDiagnostic.Value),\n    stack: Schema.optionalKey(Schema.String),\n  },\n) {}\n\n/**\n * Durable admission input. `inputDigest` must be the digest of the canonical JSON encoding of\n * `inputPayload` (see `digestJson`); admission idempotency compares digests, never re-encodes.\n * `agentId`/`agentDigests`/`deploymentId` are persisted so recovery can complete Thread\n * materialization without the submitting client. `parentLinkage` is present exactly when the\n * Submission is a durable attached child (spec §12); an admission replay must repeat the same\n * linkage (or its absence) or fail with `AdmissionConflict`.\n */\nexport class AdmissionRequest extends Schema.Class<AdmissionRequest>(\n  \"@effect-agent/thread/AdmissionRequest\",\n)({\n  threadId: ThreadId,\n  principal: Principal,\n  idempotencyKey: IdempotencyKey,\n  agentId: AgentId,\n  agentDigests: DefinitionDigests,\n  deploymentId: DeploymentId,\n  inputPayload: PersistedJson,\n  inputDigest: Digest,\n  parentLinkage: Schema.optionalKey(ParentLinkage),\n  workerAdmission: Schema.optionalKey(WorkerAdmission),\n  messageAdmission: Schema.optionalKey(InputMessage),\n  admissionGroup: Schema.optionalKey(AdmissionGroup),\n  admissionFence: Schema.optionalKey(AdmissionFence),\n}) {}\n\n/**\n * The committed admission row. `replayed` is true when an identical (thread, principal,\n * idempotencyKey, inputDigest) admission already existed; the original identities are returned\n * unchanged so a client retry resumes rather than duplicates (DUR-001).\n */\nexport class AdmissionResult extends Schema.Class<AdmissionResult>(\n  \"@effect-agent/thread/AdmissionResult\",\n)({\n  submissionId: SubmissionId,\n  receiptId: ReceiptId,\n  queueSequence: QueueSequence,\n  state: SubmissionState,\n  replayed: Schema.Boolean,\n}) {}\n\nexport class MarkReadyRequest extends Schema.Class<MarkReadyRequest>(\n  \"@effect-agent/thread/MarkReadyRequest\",\n)({\n  submissionId: SubmissionId,\n}) {}\n\nexport class SubmissionLookupById extends Schema.TaggedClass<SubmissionLookupById>(\n  \"@effect-agent/thread/SubmissionLookupById\",\n)(\"SubmissionLookupById\", {\n  submissionId: SubmissionId,\n}) {}\n\nexport class SubmissionLookupByKey extends Schema.TaggedClass<SubmissionLookupByKey>(\n  \"@effect-agent/thread/SubmissionLookupByKey\",\n)(\"SubmissionLookupByKey\", {\n  threadId: ThreadId,\n  principal: Principal,\n  idempotencyKey: IdempotencyKey,\n}) {}\n\n/** Lookup by Submission identity or by the scoped client idempotency key. */\nexport const SubmissionLookup = Schema.Union([SubmissionLookupById, SubmissionLookupByKey]);\nexport type SubmissionLookup = typeof SubmissionLookup.Type;\n\n/**\n * Control-only worklist entry. Discovery validates identities, ordering and state without\n * decoding retained execution payloads. Hydrate only the selected Thread through `lookup`\n * or `loadRecoverySnapshot`, inside its recovery failure boundary.\n */\nexport class SubmissionWorkItem extends Schema.Class<SubmissionWorkItem>(\n  \"@effect-agent/thread/SubmissionWorkItem\",\n)({\n  submissionId: SubmissionId,\n  threadId: ThreadId,\n  queueSequence: QueueSequence,\n  principal: Principal,\n  idempotencyKey: IdempotencyKey,\n  deploymentId: DeploymentId,\n  receiptId: ReceiptId,\n  state: SubmissionState,\n}) {}\n\n/** The full durable ledger view of one Submission. */\nexport class SubmissionSnapshot extends Schema.Class<SubmissionSnapshot>(\n  \"@effect-agent/thread/SubmissionSnapshot\",\n)({\n  ...SubmissionWorkItem.fields,\n  agentId: AgentId,\n  agentDigests: DefinitionDigests,\n  inputPayload: PersistedJson,\n  inputDigest: Digest,\n  settledOutcome: Schema.optionalKey(SettlementOutcome),\n  createdAt: Schema.DateTimeUtcFromString,\n  readyAt: Schema.optionalKey(Schema.DateTimeUtcFromString),\n  admissionGroup: Schema.optionalKey(AdmissionGroup),\n  admissionFence: Schema.optionalKey(AdmissionFence),\n  parentLinkage: Schema.optionalKey(ParentLinkage),\n  workerAdmission: Schema.optionalKey(WorkerAdmission),\n  messageAdmission: Schema.optionalKey(InputMessage),\n}) {}\n\n/** The authoritative store proves the scoped idempotency key was never admitted (SUB-031). */\nexport class AdmissionNotAdmitted extends Schema.TaggedClass<AdmissionNotAdmitted>(\n  \"@effect-agent/thread/AdmissionNotAdmitted\",\n)(\"NotAdmitted\", {}) {}\n\n/** The scoped idempotency key was admitted; the full Submission snapshot is authoritative. */\nexport class AdmissionAdmitted extends Schema.TaggedClass<AdmissionAdmitted>(\n  \"@effect-agent/thread/AdmissionAdmitted\",\n)(\"Admitted\", {\n  submission: SubmissionSnapshot,\n}) {}\n\n/**\n * The adapter cannot currently prove admission or its absence (e.g. the authoritative child\n * owner is unreachable on a partitioned platform). Callers wait and retry; an indeterminate\n * answer NEVER permits a second admission attempt (SUB-031).\n */\nexport class AdmissionIndeterminate extends Schema.TaggedClass<AdmissionIndeterminate>(\n  \"@effect-agent/thread/AdmissionIndeterminate\",\n)(\"Indeterminate\", {\n  reason: Schema.String.check(Schema.isMaxLength(4096)),\n}) {}\n\n/**\n * The tri-state answer of `resolveAdmission` (spec §12: \"absence from an eventually consistent\n * projection is never proof\"). Single strongly consistent stores derive `NotAdmitted`/`Admitted`\n * from a direct lookup; only adapters that can genuinely fail to reach the authoritative owner\n * answer `Indeterminate`.\n */\nexport const AdmissionResolution = Schema.Union([\n  AdmissionNotAdmitted,\n  AdmissionAdmitted,\n  AdmissionIndeterminate,\n]);\n\nexport type AdmissionResolution = typeof AdmissionResolution.Type;\n\nexport class ClaimRequest extends Schema.Class<ClaimRequest>(\"@effect-agent/thread/ClaimRequest\")({\n  threadId: ThreadId,\n  producerId: ProducerId,\n}) {}\n\n/**\n * One granted ownership period. `producerEpoch` is the fencing token for every canonical append\n * this Attempt performs; `leaseExpiresAt` is when the claim becomes reclaimable unless renewed.\n */\nexport class Claim extends Schema.Class<Claim>(\"@effect-agent/thread/Claim\")({\n  submissionId: SubmissionId,\n  attemptId: AttemptId,\n  ownershipToken: OwnershipToken,\n  producerEpoch: ProducerEpoch,\n  leaseExpiresAt: Schema.DateTimeUtcFromString,\n  inputPayload: PersistedJson,\n}) {}\n\nexport class RenewOwnershipRequest extends Schema.Class<RenewOwnershipRequest>(\n  \"@effect-agent/thread/RenewOwnershipRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n}) {}\n\n/**\n * A renewed lease. Adapters MAY rotate the token; callers must use the returned token for every\n * later ledger mutation.\n */\nexport class OwnershipRenewal extends Schema.Class<OwnershipRenewal>(\n  \"@effect-agent/thread/OwnershipRenewal\",\n)({\n  ownershipToken: OwnershipToken,\n  leaseExpiresAt: Schema.DateTimeUtcFromString,\n}) {}\n\nexport class ReleaseOwnershipRequest extends Schema.Class<ReleaseOwnershipRequest>(\n  \"@effect-agent/thread/ReleaseOwnershipRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n}) {}\n\n/**\n * The canonical position of the applied `UserInputRecorded` record for one Submission.\n */\nexport class MarkInputAppliedRequest extends Schema.Class<MarkInputAppliedRequest>(\n  \"@effect-agent/thread/MarkInputAppliedRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  recordId: RecordId,\n  sequence: CanonicalSequence,\n}) {}\n\nexport class InputAppliedMarker extends Schema.Class<InputAppliedMarker>(\n  \"@effect-agent/thread/InputAppliedMarker\",\n)({\n  recordId: RecordId,\n  sequence: CanonicalSequence,\n}) {}\n\n/**\n * Reservation of the single exact settlement record for one Submission (DUR-011). `record` is\n * the complete canonical envelope that will be appended — including `createdAt` — so a recovering\n * Attempt can re-append byte-identical content without a batch-digest conflict. `recordDigest`\n * must be the digest of the canonical JSON encoding of the Schema-encoded envelope.\n */\nexport class SettlementReservation extends Schema.Class<SettlementReservation>(\n  \"@effect-agent/thread/SettlementReservation\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  settlementId: SettlementId,\n  outcome: SettlementOutcome,\n  record: RecordEnvelope,\n  recordDigest: Digest,\n}) {}\n\n/**\n * The committed reservation. `replayed` is true when an identical reservation already existed;\n * the stored exact record is returned so recovery appends precisely what was reserved.\n */\nexport class ReservedSettlement extends Schema.Class<ReservedSettlement>(\n  \"@effect-agent/thread/ReservedSettlement\",\n)({\n  submissionId: SubmissionId,\n  settlementId: SettlementId,\n  outcome: SettlementOutcome,\n  record: RecordEnvelope,\n  recordDigest: Digest,\n  replayed: Schema.Boolean,\n}) {}\n\nexport class SettlementFinalization extends Schema.Class<SettlementFinalization>(\n  \"@effect-agent/thread/SettlementFinalization\",\n)({\n  submissionId: SubmissionId,\n  settlementId: SettlementId,\n}) {}\n\nconst SettlementFields = Schema.Struct({\n  submissionId: SubmissionId,\n  settlementId: SettlementId,\n  receiptId: ReceiptId,\n  outcome: SettlementOutcome,\n  /** Schema-encoded application disposition materialized from the exact canonical reservation. */\n  runDisposition: Schema.optionalKey(PersistedJson),\n  /** Canonical aggregate of model usage and estimated spend for this Run. */\n  usageSummary: Schema.optionalKey(RunUsageSummary),\n  /** Present exactly for `failed`; its Schema rejects excess keys before canonical projection. */\n  failure: Schema.optionalKey(SettlementFailureDiagnostic),\n  settledAt: Schema.DateTimeUtcFromString,\n}).check(\n  Schema.makeFilter(\n    (settlement) => (settlement.outcome === \"failed\") === (settlement.failure !== undefined),\n    { title: \"failure exactly on a failed Settlement\" },\n  ),\n);\n\n/** The single durable terminal outcome recorded for one accepted Submission (DUR-002). */\nexport class Settlement extends Schema.Class<Settlement>(\"@effect-agent/thread/Settlement\")(\n  SettlementFields,\n) {}\n\n/**\n * Project the bounded failed-settlement diagnostic from an already Schema-validated exact\n * reservation. Storage adapters use this when materializing their operational Settlement value;\n * the canonical record remains the authority.\n */\nexport const settlementFailureFromRecord = (\n  record: RecordEnvelope,\n): SettlementFailureDiagnostic | undefined => {\n  const payload = record.payload;\n\n  return payload._tag === \"SubmissionSettled\" && payload.outcome === \"failed\"\n    ? payload.result\n    : undefined;\n};\n\n/**\n * A durable abort command (durability §13). Field bounds are exactly those of the canonical\n * `AbortRequested` payload so the intent can become canonical without re-validation.\n */\nexport class AbortCommand extends Schema.Class<AbortCommand>(\"@effect-agent/thread/AbortCommand\")({\n  submissionId: SubmissionId,\n  author: AbortRequested.fields.author,\n  reason: AbortRequested.fields.reason,\n}) {}\n\n/**\n * The recorded abort intent. `canonicalRecordId` is present once the corresponding canonical\n * `AbortRequested` record has been appended (its identity is deterministic; see\n * `submissionAbortRecordId`).\n */\nexport class AbortIntent extends Schema.Class<AbortIntent>(\"@effect-agent/thread/AbortIntent\")({\n  submissionId: SubmissionId,\n  author: AbortRequested.fields.author,\n  reason: AbortRequested.fields.reason,\n  requestedAt: Schema.DateTimeUtcFromString,\n  canonicalRecordId: Schema.optionalKey(RecordId),\n}) {}\n\n/** Address one lane-local abort intent without loading unrelated recovery state. */\nexport class AbortIntentRequest extends Schema.Class<AbortIntentRequest>(\n  \"@effect-agent/thread/AbortIntentRequest\",\n)({ submissionId: SubmissionId }) {}\n\n/**\n * Atomic claim of the contiguous ready prefix of strictly-later queued Submissions for joining\n * into the active host Run (plan §2.5). Fenced by the host Attempt's ownership token — no epoch\n * bump, the host already owns the lane. An `admitted`-but-not-`ready` row breaks the prefix;\n * an aborted-settled row is a closed obligation and is skipped as a non-gap (P7 §7(c)).\n */\nexport class ClaimJoiningRequest extends Schema.Class<ClaimJoiningRequest>(\n  \"@effect-agent/thread/ClaimJoiningRequest\",\n)({\n  threadId: ThreadId,\n  hostSubmissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  maxCount: Schema.Int.check(Schema.isGreaterThan(0)),\n}) {}\n\n/** One queued Submission transitioned to `joining` under the host's ownership. */\nexport class JoiningClaim extends Schema.Class<JoiningClaim>(\"@effect-agent/thread/JoiningClaim\")({\n  submissionId: SubmissionId,\n  queueSequence: QueueSequence,\n  inputPayload: PersistedJson,\n}) {}\n\n/**\n * The canonical position of one joined Submission's `UserInputRecorded` record (`input:{sid}`).\n * Marking transitions `joining → joined` and records the host linkage established at claim time.\n */\nexport class MarkJoinedRequest extends Schema.Class<MarkJoinedRequest>(\n  \"@effect-agent/thread/MarkJoinedRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  recordId: RecordId,\n  sequence: CanonicalSequence,\n}) {}\n\n/**\n * Recovery-only revert of a `joining` Submission whose canonical input append never committed\n * (DUR-016): `joining → ready`, idempotent, a no-op when the Submission already joined.\n */\nexport class RevertJoiningRequest extends Schema.Class<RevertJoiningRequest>(\n  \"@effect-agent/thread/RevertJoiningRequest\",\n)({\n  submissionId: SubmissionId,\n}) {}\n\n/**\n * Why one Submission is durably suspended. Approval was the only Phase 5 reason; S2 adds\n * `WaitingForChild` (spec §12 step 10) and the union keeps later suspension families (e.g.\n * operator quarantine) additive.\n */\nexport class ApprovalPendingSuspension extends Schema.TaggedClass<ApprovalPendingSuspension>(\n  \"@effect-agent/thread/ApprovalPendingSuspension\",\n)(\"ApprovalPending\", {\n  toolCallIds: Schema.NonEmptyArray(ToolCallId),\n}) {}\n\n/** One attached child a `waitingForChild` parent is durably waiting on (spec §12 step 10). */\nexport class WaitingChild extends Schema.Class<WaitingChild>(\"@effect-agent/thread/WaitingChild\")({\n  toolCallId: ToolCallId,\n  childSubmissionId: SubmissionId,\n}) {}\n\n/**\n * The parent Attempt ended without settling because attached durable children must settle and\n * join first (spec §12 step 10, SUB-030). The suspended lane holds no worker permit; each listed\n * child settles on its own Thread lane and `recordChildSettled` wakes the parent once\n * every listed child is settled.\n */\nexport class WaitingForChildSuspension extends Schema.TaggedClass<WaitingForChildSuspension>(\n  \"@effect-agent/thread/WaitingForChildSuspension\",\n)(\"WaitingForChild\", {\n  children: Schema.NonEmptyArray(WaitingChild),\n}) {}\n\nexport const SuspensionReason = Schema.Union([\n  ApprovalPendingSuspension,\n  WaitingForChildSuspension,\n]);\n\nexport type SuspensionReason = typeof SuspensionReason.Type;\n\n/**\n * Durable suspension of owned work (plan §2.6): `input-applied`/`running` → `suspended`, the\n * ownership period ends, NO settlement occurs — the accepted-work obligation stays owed while\n * the lane consumes no worker permit.\n */\nexport class SuspendRequest extends Schema.Class<SuspendRequest>(\n  \"@effect-agent/thread/SuspendRequest\",\n)({\n  submissionId: SubmissionId,\n  ownershipToken: OwnershipToken,\n  reason: SuspensionReason,\n}) {}\n\n/**\n * `suspended` when the lane is now durably waiting; `resume-immediately` when the suspension\n * reason is already fully covered (a covering decision or child settlement raced ahead of the\n * suspend transaction), so the caller resumes without releasing the lane.\n */\nexport const SuspensionOutcome = Schema.Literals([\"suspended\", \"resume-immediately\"]);\nexport type SuspensionOutcome = typeof SuspensionOutcome.Type;\n\n/**\n * A durable child-settlement notification for one waitingForChild parent (spec §12 step 10).\n * The child's canonical Settlement is the authority; this command only drives the parent lane's\n * wake transition.\n */\nexport class ChildSettledNotification extends Schema.Class<ChildSettledNotification>(\n  \"@effect-agent/thread/ChildSettledNotification\",\n)({\n  parentSubmissionId: SubmissionId,\n  childSubmissionId: SubmissionId,\n}) {}\n\n/**\n * `woken` when this notification completed the waiting set and the parent transitioned\n * `suspended(WaitingForChild) → input-applied`; `still-waiting` while other listed children are\n * unsettled; `not-waiting` when the parent is not (or no longer) suspended waiting on this\n * child — including replays after a wake, so the operation is idempotent.\n */\nexport const ChildSettledOutcome = Schema.Literals([\"woken\", \"still-waiting\", \"not-waiting\"]);\nexport type ChildSettledOutcome = typeof ChildSettledOutcome.Type;\n\n/** Parent-owned child budget reservation identity, deterministically derived by the\n * coordinator from the parent Run and Tool Call identity (spec §12 step 2). */\nexport const ChildReservationId = identifier(\"ChildReservationId\");\nexport type ChildReservationId = typeof ChildReservationId.Type;\n\n/**\n * The reservation state machine (spec §12 steps 2 and 6): `reserved` while the child may still\n * consume the allocation, `releasePending` once the final accounting decision is frozen, and\n * `released` after the unused allocation returned exactly once.\n */\nexport const ChildReservationStatus = Schema.Literals([\"reserved\", \"releasePending\", \"released\"]);\nexport type ChildReservationStatus = typeof ChildReservationStatus.Type;\n\n/**\n * Creation input for one parent-owned child budget reservation. The allocation is an opaque\n * Schema-encoded budget document (D8: adapters implement transitions only and never interpret\n * budget dimensions); `allocationDigest` must be the digest of its canonical JSON encoding.\n */\nexport class ChildBudgetReservationRequest extends Schema.Class<ChildBudgetReservationRequest>(\n  \"@effect-agent/thread/ChildBudgetReservationRequest\",\n)({\n  reservationId: ChildReservationId,\n  parentSubmissionId: SubmissionId,\n  parentToolCallId: ToolCallId,\n  ownershipToken: OwnershipToken,\n  allocation: PersistedJson,\n  allocationDigest: Digest,\n}) {}\n\n/** One child budget reservation row as the port exposes it. */\nexport class ChildBudgetReservationSnapshot extends Schema.Class<ChildBudgetReservationSnapshot>(\n  \"@effect-agent/thread/ChildBudgetReservationSnapshot\",\n)({\n  reservationId: ChildReservationId,\n  parentSubmissionId: SubmissionId,\n  parentToolCallId: ToolCallId,\n  childSubmissionId: Schema.optionalKey(SubmissionId),\n  status: ChildReservationStatus,\n  allocation: PersistedJson,\n  allocationDigest: Digest,\n  accounting: Schema.optionalKey(PersistedJson),\n  reservedAt: Schema.DateTimeUtcFromString,\n  releaseBeganAt: Schema.optionalKey(Schema.DateTimeUtcFromString),\n  releasedAt: Schema.optionalKey(Schema.DateTimeUtcFromString),\n}) {}\n\n/**\n * The committed reservation. `replayed` is true when an identical reservation already existed;\n * the stored row is returned unchanged so a recovering caller resumes rather than duplicates\n * (SUB-016).\n */\nexport class ReservedChildBudget extends Schema.Class<ReservedChildBudget>(\n  \"@effect-agent/thread/ReservedChildBudget\",\n)({\n  reservation: ChildBudgetReservationSnapshot,\n  replayed: Schema.Boolean,\n}) {}\n\n/** Records the admitted child on its reservation row (repairable from `SubagentStarted`). */\nexport class AttachChildToReservationRequest extends Schema.Class<AttachChildToReservationRequest>(\n  \"@effect-agent/thread/AttachChildToReservationRequest\",\n)({\n  reservationId: ChildReservationId,\n  ownershipToken: OwnershipToken,\n  childSubmissionId: SubmissionId,\n}) {}\n\n/**\n * Freezes the final consumed/released accounting decision (spec §12 join step 6). The\n * accounting is an opaque Schema-encoded document replayed from the canonical `SubagentJoined`\n * record (or the deterministic zero-consumed decision for an orphaned reservation), so the\n * decision itself authorizes the transition — no ownership token is consulted (DUR-015).\n */\nexport class BeginChildBudgetReleaseRequest extends Schema.Class<BeginChildBudgetReleaseRequest>(\n  \"@effect-agent/thread/BeginChildBudgetReleaseRequest\",\n)({\n  reservationId: ChildReservationId,\n  accounting: PersistedJson,\n}) {}\n\n/** Applies the frozen accounting decision: `releasePending → released`, exactly once. */\nexport class ReleaseChildBudgetRequest extends Schema.Class<ReleaseChildBudgetRequest>(\n  \"@effect-agent/thread/ReleaseChildBudgetRequest\",\n)({\n  reservationId: ChildReservationId,\n}) {}\n\n/**\n * A durable approval decision command (plan §2.6, `abort`-shaped). Field bounds are exactly those\n * of the canonical `ToolApprovalDecided` payload so the intent can become canonical without\n * re-validation.\n */\nexport class ApprovalDecisionCommand extends Schema.Class<ApprovalDecisionCommand>(\n  \"@effect-agent/thread/ApprovalDecisionCommand\",\n)({\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  decision: ApprovalDecision,\n  resolver: ToolApprovalDecided.fields.resolver,\n  reason: ToolApprovalDecided.fields.reason,\n}) {}\n\n/**\n * The recorded approval-decision intent, idempotent per `(submissionId, toolCallId)`.\n * `canonicalRecordId` is present once the corresponding canonical `ToolApprovalDecided` record\n * has been appended (see `toolApprovalDecisionRecordId`).\n */\nexport class ApprovalDecisionIntent extends Schema.Class<ApprovalDecisionIntent>(\n  \"@effect-agent/thread/ApprovalDecisionIntent\",\n)({\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  decision: ApprovalDecision,\n  resolver: ToolApprovalDecided.fields.resolver,\n  reason: ToolApprovalDecided.fields.reason,\n  decidedAt: Schema.DateTimeUtcFromString,\n  canonicalRecordId: Schema.optionalKey(RecordId),\n}) {}\n\n/**\n * Durable Unknown marking for one Submission's open ordinary Tool Calls (DUR-009): state →\n * `unknown`, parking that Submission without changing ownership or the Thread epoch. Idempotent.\n */\nexport class MarkUnknownRequest extends Schema.Class<MarkUnknownRequest>(\n  \"@effect-agent/thread/MarkUnknownRequest\",\n)({\n  submissionId: SubmissionId,\n  toolCallIds: Schema.NonEmptyArray(ToolCallId),\n  reason: ToolCallUnknown.fields.reason,\n}) {}\n\n/** The recovered supplier truth: the external effect completed with this exact result. */\nexport class ResolutionCompletedWithResult extends Schema.TaggedClass<ResolutionCompletedWithResult>(\n  \"@effect-agent/thread/ResolutionCompletedWithResult\",\n)(\"CompletedWithResult\", {\n  result: PersistedJson,\n  isFailure: Schema.Boolean,\n}) {}\n\n/** The external effect provably never happened; the call may re-execute on resume. */\nexport class ResolutionNeverHappened extends Schema.TaggedClass<ResolutionNeverHappened>(\n  \"@effect-agent/thread/ResolutionNeverHappened\",\n)(\"NeverHappened\", {}) {}\n\n/** The call is safe to repeat under the external system's idempotency contract. */\nexport class ResolutionSafeToRetry extends Schema.TaggedClass<ResolutionSafeToRetry>(\n  \"@effect-agent/thread/ResolutionSafeToRetry\",\n)(\"SafeToRetry\", {}) {}\n\n/** Give up on the Submission: route into the abort path (unknown calls stay recorded; abort\n * never claims external rollback, durability §13). */\nexport class ResolutionAbortSubmission extends Schema.TaggedClass<ResolutionAbortSubmission>(\n  \"@effect-agent/thread/ResolutionAbortSubmission\",\n)(\"AbortSubmission\", {}) {}\n\n/** How an authorized resolver closed one Unknown Outcome (DUR-017). */\nexport const UnknownResolution = Schema.Union([\n  ResolutionCompletedWithResult,\n  ResolutionNeverHappened,\n  ResolutionSafeToRetry,\n  ResolutionAbortSubmission,\n]);\n\nexport type UnknownResolution = typeof UnknownResolution.Type;\n\n/**\n * A durable Unknown-Outcome resolution command (DUR-017, `abort`-shaped). Possession of the\n * runtime service plus the mandatory `author`/`reason` audit fields is the Phase 5 authorization\n * boundary — identical to `abort`; the authenticated operator surface is a P7 deliverable.\n * Field bounds are exactly those of the canonical `ToolCallResolved` payload.\n */\nexport class UnknownResolutionCommand extends Schema.Class<UnknownResolutionCommand>(\n  \"@effect-agent/thread/UnknownResolutionCommand\",\n)({\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  author: ToolCallResolved.fields.author,\n  reason: ToolCallResolved.fields.reason,\n  resolution: UnknownResolution,\n}) {}\n\n/**\n * The recorded resolution intent, idempotent per `(submissionId, toolCallId)`. The canonical\n * `ToolCallResolved` (+ `ToolCallSettled` for `CompletedWithResult`) is appended by the recovery\n * pass or the next owning Attempt; `canonicalRecordId` is present once it is.\n */\nexport class UnknownResolutionIntent extends Schema.Class<UnknownResolutionIntent>(\n  \"@effect-agent/thread/UnknownResolutionIntent\",\n)({\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  author: ToolCallResolved.fields.author,\n  reason: ToolCallResolved.fields.reason,\n  resolution: UnknownResolution,\n  resolvedAt: Schema.DateTimeUtcFromString,\n  canonicalRecordId: Schema.optionalKey(RecordId),\n}) {}\n\n/** Current ownership as recovery sees it. The live owner's token is never exposed here. */\nexport class OwnershipSnapshot extends Schema.Class<OwnershipSnapshot>(\n  \"@effect-agent/thread/OwnershipSnapshot\",\n)({\n  attemptId: AttemptId,\n  ownerProducerId: ProducerId,\n  producerEpoch: ProducerEpoch,\n  leaseExpiresAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/** A settlement reservation as recovery sees it. */\nexport class SettlementReservationSnapshot extends Schema.Class<SettlementReservationSnapshot>(\n  \"@effect-agent/thread/SettlementReservationSnapshot\",\n)({\n  settlementId: SettlementId,\n  outcome: SettlementOutcome,\n  record: RecordEnvelope,\n  recordDigest: Digest,\n  finalized: Schema.Boolean,\n}) {}\n\nexport class RecoverySnapshotRequest extends Schema.Class<RecoverySnapshotRequest>(\n  \"@effect-agent/thread/RecoverySnapshotRequest\",\n)({\n  submissionId: SubmissionId,\n}) {}\n\n/** One joined/joining Submission of a host Run, as the host's recovery sees it. */\nexport class JoinSnapshot extends Schema.Class<JoinSnapshot>(\"@effect-agent/thread/JoinSnapshot\")({\n  submissionId: SubmissionId,\n  state: SubmissionState,\n  hostSubmissionId: SubmissionId,\n}) {}\n\n/** A durable suspension as recovery sees it. */\nexport class SuspensionSnapshot extends Schema.Class<SuspensionSnapshot>(\n  \"@effect-agent/thread/SuspensionSnapshot\",\n)({\n  reason: SuspensionReason,\n  suspendedAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/**\n * One attached child of this parent as its recovery sees it: the reservation's recorded child\n * plus that child's current lane state. A disposable derived view — the canonical\n * `SubagentRequested`/`SubagentStarted` records and the child's own canonical Settlement remain\n * the recovery truth (DUR-015).\n */\nexport class ChildAttachmentSnapshot extends Schema.Class<ChildAttachmentSnapshot>(\n  \"@effect-agent/thread/ChildAttachmentSnapshot\",\n)({\n  toolCallId: ToolCallId,\n  childSubmissionId: SubmissionId,\n  childState: SubmissionState,\n  childOutcome: Schema.optionalKey(SettlementOutcome),\n}) {}\n\n/**\n * Everything the pure recovery classifier needs about one Submission, read strongly consistently\n * (STORE-003). Canonical history still wins over every marker in this snapshot (DUR-015).\n *\n * Phase 5 fields: `joins` is the host-side view (every Submission `joining`/`joined` to this\n * one); `hostSubmissionId` is the joined-side view; `suspension` mirrors the `suspended` state;\n * `approvalDecisions` and `unknownResolutions` are the durable intents recorded against this\n * Submission (empty when none exist).\n *\n * S2 fields: `childReservations`/`childAttachments` are the parent-side subagent view (ordered\n * by parent Tool Call id) and `parentLinkage` is the child-side view. They default to\n * empty/absent at construction so pre-S2 call sites stay valid; adapters always populate them.\n */\nexport class RecoverySnapshot extends Schema.Class<RecoverySnapshot>(\n  \"@effect-agent/thread/RecoverySnapshot\",\n)({\n  submission: SubmissionSnapshot,\n  ownership: Schema.optionalKey(OwnershipSnapshot),\n  inputApplied: Schema.optionalKey(InputAppliedMarker),\n  reservation: Schema.optionalKey(SettlementReservationSnapshot),\n  abortIntent: Schema.optionalKey(AbortIntent),\n  joins: Schema.Array(JoinSnapshot),\n  hostSubmissionId: Schema.optionalKey(SubmissionId),\n  suspension: Schema.optionalKey(SuspensionSnapshot),\n  approvalDecisions: Schema.Array(ApprovalDecisionIntent),\n  unknownResolutions: Schema.Array(UnknownResolutionIntent),\n  childReservations: Schema.Array(ChildBudgetReservationSnapshot).pipe(\n    Schema.withConstructorDefault(Effect.succeed([])),\n  ),\n  childAttachments: Schema.Array(ChildAttachmentSnapshot).pipe(\n    Schema.withConstructorDefault(Effect.succeed([])),\n  ),\n  parentLinkage: Schema.optionalKey(ParentLinkage),\n}) {}\n\n/** The same idempotency key was admitted with different canonical input content. */\nexport class AdmissionConflict extends Schema.TaggedError<AdmissionConflict>()(\n  \"AdmissionConflict\",\n  {\n    threadId: ThreadId,\n    principal: Principal,\n    idempotencyKey: IdempotencyKey,\n    existingInputDigest: Digest,\n    attemptedInputDigest: Digest,\n  },\n) {}\n\n/**\n * The presented ownership token no longer owns the Submission's lane. `actualEpoch` is the\n * thread's current producer epoch so a stale Attempt can prove to itself it was superseded.\n */\nexport class OwnershipLost extends Schema.TaggedError<OwnershipLost>()(\"OwnershipLost\", {\n  submissionId: SubmissionId,\n  actualEpoch: ProducerEpoch,\n}) {}\n\n/** A conflicting terminal outcome was already reserved or finalized (DUR-002, DUR-012). */\nexport class SettlementConflict extends Schema.TaggedError<SettlementConflict>()(\n  \"SettlementConflict\",\n  {\n    submissionId: SubmissionId,\n    existingOutcome: SettlementOutcome,\n  },\n) {}\n\n/**\n * A divergent approval re-decision for an already-decided `(submissionId, toolCallId)` pair.\n * Repeating the SAME decision replays the recorded intent instead (idempotency).\n */\nexport class ApprovalConflict extends Schema.TaggedError<ApprovalConflict>()(\"ApprovalConflict\", {\n  submissionId: SubmissionId,\n  toolCallId: ToolCallId,\n  existingDecision: ApprovalDecision,\n}) {}\n\n/**\n * A divergent unknown-outcome re-resolution for an already-resolved `(submissionId, toolCallId)`\n * pair (DUR-017). Repeating the SAME resolution replays the recorded intent instead.\n */\nexport class UnknownResolutionConflict extends Schema.TaggedError<UnknownResolutionConflict>()(\n  \"UnknownResolutionConflict\",\n  {\n    submissionId: SubmissionId,\n    toolCallId: ToolCallId,\n  },\n) {}\n\n/**\n * A child budget reservation request contradicts recorded reservation state: a divergent\n * allocation for the same reservation id, a second reservation id for the same parent Tool\n * Call, a divergent child attachment, a divergent accounting freeze, or an out-of-order state\n * transition. `status` reports the existing row's status. Identical replays never conflict.\n */\nexport class ChildReservationConflict extends Schema.TaggedError<ChildReservationConflict>()(\n  \"ChildReservationConflict\",\n  {\n    reservationId: ChildReservationId,\n    status: ChildReservationStatus,\n    message: Schema.String,\n  },\n) {}\n\n/** Adapter-level ledger failure (storage unavailable, unknown submission, corrupt row, ...). */\nexport class LedgerError extends Schema.TaggedError<LedgerError>()(\"LedgerError\", {\n  operation: Schema.String,\n  message: Schema.String,\n  cause: Schema.optionalKey(FailureDiagnostic.Value),\n}) {}\n\nexport type SubmissionLedgerFailure =\n  | AdmissionConflict\n  | OwnershipLost\n  | SettlementConflict\n  | ApprovalConflict\n  | UnknownResolutionConflict\n  | JoinedToHost\n  | ChildReservationConflict\n  | LedgerError\n  | AdmissionPolicyError;\n\n/**\n * Operational durable state for accepted work: admission, FIFO readiness, ownership, leases,\n * abort intent, and settlement obligations (STORE-001). The Thread Log remains the\n * authority for applied input and terminal outcomes; every marker in this ledger can be rebuilt\n * from canonical history (DUR-015).\n *\n * Operation contracts:\n *\n * - `admit` — atomic and idempotent by (threadId, principal, idempotencyKey). A replay\n *   with the same `inputDigest` returns the original `AdmissionResult` with `replayed` set; a\n *   replay with a different digest fails with `AdmissionConflict`. Admission allocates the\n *   Submission's `queueSequence` (FIFO position, DUR-004) and mints `submissionId`/`receiptId`.\n *   An optional `parentLinkage` is recorded immutably at first admission (SUB-016); a replay\n *   whose linkage diverges (present vs. absent, or different identities) fails with\n *   `AdmissionConflict` even when the input digest matches.\n * - `resolveAdmission` — authoritative tri-state admission lookup by scoped idempotency key\n *   (SUB-031): `NotAdmitted` proves absence, `Admitted` carries the full snapshot, and\n *   `Indeterminate` states that the adapter cannot currently prove either. Only `NotAdmitted`\n *   permits an admission attempt. Single strongly consistent stores derive the answer from a\n *   direct lookup and never answer `Indeterminate`.\n * - `markReady` — idempotent transition admitted → ready after Thread materialization.\n *   Marking an already-ready (or later-state) Submission is a no-op.\n * - `lookup` — read one Submission by identity or scoped idempotency key; strongly consistent\n *   with prior ledger writes.\n * - `claim` — claims the lowest unsettled `queueSequence` after skipping only unknown rows\n *   without abort intent. Approval, joining and child-wait barriers remain ordered. Returns\n *   `Option.none` when no eligible work exists or ANY lease in the Thread is live, including\n *   a lease belonging to the same producer. A successful claim atomically bumps the Thread's producer\n *   epoch — fencing every stale Attempt out of canonical appends (DUR-006) — mints a fresh\n *   `attemptId` and `ownershipToken`, and starts the ownership lease (D5: adapters default to\n *   `DEFAULT_OWNERSHIP_LEASE_DURATION`, configurable). An expired lease makes the head\n *   claimable; expiry alone never revokes correctness, only permission to assume liveness.\n * - `renewOwnership` — extends the lease while the token still owns the lane; fails with\n *   `OwnershipLost` once superseded. Renewal after lease expiry succeeds if no other claim has\n *   taken the lane in between.\n * - `releaseOwnership` — graceful drain: ends the ownership period without settling, returning\n *   a nonterminal head to claimable state. Fails with `OwnershipLost` once superseded.\n * - `markInputApplied` — idempotent marker that the deterministic `UserInputRecorded` record is\n *   canonical (state → input-applied). Recovery repairs this marker from history when the append\n *   committed but the marker write was lost.\n * - `reserveSettlement` — reserves the Submission's single exact settlement record\n *   (state → terminalizing). Idempotent: an identical reservation replays with `replayed` set; a\n *   different outcome or content fails with `SettlementConflict{existingOutcome}` (DUR-011).\n *   For a `joined` Submission the reservation is authorized by its recorded host linkage — a\n *   joined lane is never worker-claimable, so no ownership token can exist for it and the\n *   presented token is not consulted (plan §2.5: joined Submissions settle with the host).\n *   Likewise, an ABORTED reservation for a `ready`/`terminalizing` Submission that carries a\n *   durable abort intent and holds no live ownership is authorized by that intent (P7 §7(c)):\n *   recovery settles aborted never-claimed queued work immediately, without waiting for it to\n *   head the lane. Both exceptions are outcome- and state-narrow; everything else stays fenced.\n * - `finalizeSettlement` — idempotent terminal transition (state → settled) after the reserved\n *   record is canonical; releases the lane so the next `queueSequence` becomes claimable. It\n *   requires no ownership token: canonical history authorizes finalization (DUR-015). A\n *   finalization that disagrees with the recorded outcome fails with `SettlementConflict`.\n * - `requestAbort` — durable, idempotent by `submissionId`: repeating returns the recorded\n *   intent unchanged (DUR-012). Fails with `SettlementConflict` once the Submission is settled;\n *   abort never rewrites a terminal outcome. Fails with `JoinedToHost` for a `joined` Submission\n *   — it settles with its host, so the abort target is the host (plan §2.5). Abort of a\n *   `joining` Submission records the intent; it is honored only if the host has not consumed the\n *   input (revert-then-abort).\n * - `claimJoining` — atomic: transitions the contiguous `ready` prefix of strictly-later\n *   `queueSequence`s (up to `maxCount`) to `joining` under the host's ownership token, recording\n *   the host linkage; no epoch bump (the host Attempt already owns the lane). An\n *   `admitted`-not-`ready` row breaks the prefix; an aborted-settled row is a closed obligation\n *   and is skipped as a non-gap (P7 §7(c)). Fails with `OwnershipLost` once superseded.\n * - `markJoined` — idempotent `joining → joined` with the canonical input record position;\n *   repairable from history when the append committed but the marker write was lost (DUR-016).\n * - `revertJoining` — recovery-only, idempotent `joining → ready`; a no-op when already joined.\n * - `suspend` — `input-applied`/`running` → `suspended`; ends the ownership period WITHOUT\n *   settling (the obligation stays owed, the lane consumes no worker permit). Returns\n *   `resume-immediately` when the reason is already fully covered: for `ApprovalPending`,\n *   recorded decisions cover every pending call; for `WaitingForChild`, every listed child is\n *   already provably settled. Adapters must guarantee that a child settlement reported before\n *   the suspend transaction commits is observed by that suspend (single-store adapters derive\n *   this from the child's own row; cross-store adapters record a durable notification marker).\n *   Fails with `SettlementConflict` once settled.\n * - `recordApprovalDecision` — durable, idempotent per `(submissionId, toolCallId)`: repeating\n *   the same decision replays the intent; a divergent re-decision fails with `ApprovalConflict`.\n *   Transitions `suspended(ApprovalPending) → input-applied` once every pending call of the\n *   suspension reason is decided, waking the lane. Fails with `SettlementConflict` once settled.\n * - `recordChildSettled` — idempotent cross-lane wake (spec §12 step 10): transitions\n *   `suspended(WaitingForChild) → input-applied` exactly when EVERY listed child is settled,\n *   answering `woken`; `still-waiting` while any listed child is unsettled; `not-waiting` when\n *   the parent is not suspended waiting on this child (including replays after the wake). The\n *   child's canonical Settlement is the authority. The runtime reports it after the exact\n *   reserved record is appended and before ledger finalization, so same-store adapters accept\n *   `terminalizing` only when its exact reservation exists; an earlier child is an\n *   adapter-checked caller error. It never settles the parent and requires no ownership token:\n *   the canonically recorded child settlement authorizes the wake.\n * - `reserveChildBudget` — idempotent get-or-create of the parent-owned child budget\n *   reservation (spec §12 step 2), fenced by the parent lane's live `OwnershipToken`. An\n *   identical replay returns the stored row with `replayed` set (unfenced, mirroring\n *   `reserveSettlement`); a divergent allocation for the same id, or a second id for the same\n *   `(parentSubmissionId, parentToolCallId)`, fails with `ChildReservationConflict`.\n * - `attachChildToReservation` — idempotent: records the admitted child on the reservation row\n *   (repairable from the canonical `SubagentStarted` record). A replay with the recorded child\n *   is a no-op; the first attach is fenced by the parent token and requires status `reserved`;\n *   a divergent child fails with `ChildReservationConflict`.\n * - `beginChildBudgetRelease` — `reserved → releasePending`: freezes the final accounting\n *   decision exactly once. Replaying the identical accounting (at `releasePending` or\n *   `released`) is a no-op; a divergent accounting fails with `ChildReservationConflict`.\n *   Requires no ownership token: the accounting is replayed from the canonical `SubagentJoined`\n *   record (or is the deterministic zero-consumed decision for an orphaned reservation), so\n *   canonical history authorizes the transition (DUR-015) and the freeze comparison — not a\n *   fence — guarantees one decision.\n * - `releaseChildBudget` — `releasePending → released`, applied exactly once; replaying returns\n *   the released row unchanged. Releasing a still-`reserved` row (no frozen accounting) fails\n *   with `ChildReservationConflict`. \"A crash before release leaves budget unavailable until\n *   repair, never available twice\" (spec §12).\n * - `markUnknown` — idempotent, ownership-free (canonical evidence authorizes it): state →\n *   `unknown`, parking the Submission while its accepted settlement obligation stays visible.\n *   Existing ownership must release or expire before another claim (DUR-009/DUR-017).\n *   Fails with `SettlementConflict` once settled.\n * - `recordUnknownResolution` — durable, idempotent per `(submissionId, toolCallId)`; a\n *   divergent re-resolution fails with `UnknownResolutionConflict`. Transitions\n *   `unknown → input-applied` once no open call remains, waking the lane. Fails with\n *   `SettlementConflict` once settled.\n * - `scanNonterminal` — streams control-only entries for every Submission whose state is not\n *   `settled`, ordered by (threadId, queueSequence); recovery's admission-independent worklist\n *   (DUR-014). It must not decode execution payloads. SQL or control-identity corruption fails\n *   the scan; selected-Thread payload hydration belongs inside the caller's isolation boundary.\n * - `loadRecoverySnapshot` — strongly consistent full snapshot for the pure recovery classifier.\n *\n * No operation claims exactly-once external side effects; the ledger records decisions\n * exactly once (DUR-003).\n */\nexport class SubmissionLedger extends Context.Service<\n  SubmissionLedger,\n  {\n    readonly capabilities: Effect.Effect<LedgerCapabilities>;\n    readonly admit: (\n      request: AdmissionRequest,\n    ) => Effect.Effect<AdmissionResult, AdmissionConflict | AdmissionPolicyError | LedgerError>;\n    readonly markReady: (request: MarkReadyRequest) => Effect.Effect<void, LedgerError>;\n    readonly lookup: (\n      request: SubmissionLookup,\n    ) => Effect.Effect<Option.Option<SubmissionSnapshot>, LedgerError>;\n    readonly resolveAdmission: (\n      request: SubmissionLookupByKey,\n    ) => Effect.Effect<AdmissionResolution, LedgerError>;\n    readonly claim: (request: ClaimRequest) => Effect.Effect<Option.Option<Claim>, LedgerError>;\n    readonly renewOwnership: (\n      request: RenewOwnershipRequest,\n    ) => Effect.Effect<OwnershipRenewal, OwnershipLost | LedgerError>;\n    readonly releaseOwnership: (\n      request: ReleaseOwnershipRequest,\n    ) => Effect.Effect<void, OwnershipLost | LedgerError>;\n    readonly markInputApplied: (\n      request: MarkInputAppliedRequest,\n    ) => Effect.Effect<void, OwnershipLost | LedgerError>;\n    readonly reserveSettlement: (\n      request: SettlementReservation,\n    ) => Effect.Effect<ReservedSettlement, SettlementConflict | OwnershipLost | LedgerError>;\n    readonly finalizeSettlement: (\n      request: SettlementFinalization,\n    ) => Effect.Effect<Settlement, SettlementConflict | LedgerError>;\n    readonly requestAbort: (\n      request: AbortCommand,\n    ) => Effect.Effect<AbortIntent, SettlementConflict | JoinedToHost | LedgerError>;\n    /**\n     * Strongly consistent lane-local read. Unknown Submissions fail with LedgerError. Canonical\n     * proof has the same meaning as in RecoverySnapshot; this read grants no execution authority.\n     */\n    readonly readAbortIntent: (\n      request: AbortIntentRequest,\n    ) => Effect.Effect<AbortIntent | undefined, LedgerError>;\n    readonly claimJoining: (\n      request: ClaimJoiningRequest,\n    ) => Effect.Effect<ReadonlyArray<JoiningClaim>, OwnershipLost | LedgerError>;\n    readonly markJoined: (\n      request: MarkJoinedRequest,\n    ) => Effect.Effect<void, OwnershipLost | LedgerError>;\n    readonly revertJoining: (request: RevertJoiningRequest) => Effect.Effect<void, LedgerError>;\n    readonly suspend: (\n      request: SuspendRequest,\n    ) => Effect.Effect<SuspensionOutcome, OwnershipLost | SettlementConflict | LedgerError>;\n    readonly recordApprovalDecision: (\n      command: ApprovalDecisionCommand,\n    ) => Effect.Effect<ApprovalDecisionIntent, ApprovalConflict | SettlementConflict | LedgerError>;\n    readonly markUnknown: (\n      request: MarkUnknownRequest,\n    ) => Effect.Effect<void, SettlementConflict | LedgerError>;\n    readonly recordUnknownResolution: (\n      command: UnknownResolutionCommand,\n    ) => Effect.Effect<\n      UnknownResolutionIntent,\n      UnknownResolutionConflict | SettlementConflict | LedgerError\n    >;\n    readonly recordChildSettled: (\n      request: ChildSettledNotification,\n    ) => Effect.Effect<ChildSettledOutcome, LedgerError>;\n    readonly reserveChildBudget: (\n      request: ChildBudgetReservationRequest,\n    ) => Effect.Effect<ReservedChildBudget, ChildReservationConflict | OwnershipLost | LedgerError>;\n    readonly attachChildToReservation: (\n      request: AttachChildToReservationRequest,\n    ) => Effect.Effect<\n      ChildBudgetReservationSnapshot,\n      ChildReservationConflict | OwnershipLost | LedgerError\n    >;\n    readonly beginChildBudgetRelease: (\n      request: BeginChildBudgetReleaseRequest,\n    ) => Effect.Effect<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>;\n    readonly releaseChildBudget: (\n      request: ReleaseChildBudgetRequest,\n    ) => Effect.Effect<ChildBudgetReservationSnapshot, ChildReservationConflict | LedgerError>;\n    readonly scanNonterminal: Stream.Stream<SubmissionWorkItem, LedgerError>;\n    readonly loadRecoverySnapshot: (\n      request: RecoverySnapshotRequest,\n    ) => Effect.Effect<RecoverySnapshot, LedgerError>;\n  }\n>()(\"@effect-agent/thread/SubmissionLedger\") {}\n\nconst decodeBatchId = Schema.decodeSync(BatchId);\nconst decodeRecordId = Schema.decodeSync(RecordId);\nconst decodeSettlementId = Schema.decodeSync(SettlementId);\n\n/**\n * Deterministic identity rules shared by every adapter and the durable coordinator. The batch\n * carrying one Submission's canonical `UserInputRecorded` record is `submission-input:{sid}` and\n * the record is `input:{sid}`, so batch idempotency (DUR-007) makes the input append\n * exactly-once-canonical across Attempts.\n */\nexport const submissionInputBatchId = (submissionId: SubmissionId): BatchId =>\n  decodeBatchId(`submission-input:${submissionId}`);\n\n/** Deterministic canonical record identity of one Submission's `UserInputRecorded` record. */\nexport const submissionInputRecordId = (submissionId: SubmissionId): RecordId =>\n  decodeRecordId(`input:${submissionId}`);\n\n/** Deterministic `SettlementId` for one Submission: `settlement:{sid}`. */\nexport const submissionSettlementId = (submissionId: SubmissionId): SettlementId =>\n  decodeSettlementId(`settlement:${submissionId}`);\n\n/** Deterministic batch identity of one Submission's canonical `SubmissionSettled` append. */\nexport const submissionSettlementBatchId = (submissionId: SubmissionId): BatchId =>\n  decodeBatchId(`submission-settlement:${submissionId}`);\n\n/** Deterministic canonical record identity of one Submission's `SubmissionSettled` record. */\nexport const submissionSettlementRecordId = (submissionId: SubmissionId): RecordId =>\n  decodeRecordId(`settlement:${submissionId}`);\n\n/** Deterministic batch identity of one Submission's canonical `AbortRequested` append. */\nexport const submissionAbortBatchId = (submissionId: SubmissionId): BatchId =>\n  decodeBatchId(`submission-abort:${submissionId}`);\n\n/** Deterministic canonical record identity of one Submission's `AbortRequested` record. */\nexport const submissionAbortRecordId = (submissionId: SubmissionId): RecordId =>\n  decodeRecordId(`abort:${submissionId}`);\n\n/** Destination policy, captured when the ledger is acquired. It runs inside fresh admission's\n * serialization after replay lookup. The host must keep it bounded and must not reenter admit.\n * The callback must read authoritative policy in this SAME local transaction, through the\n * acquired SqlClient. Memory evaluates the callback synchronously inside its atomic mutation;\n * an async callback fails with `unavailable/synchronous-memory-policy-required`. Remote reads do not fence remote changes.\n * All policy writers must use that transaction owner. Do not fork, reenter admission, or retain\n * transaction resources. Failure/defect/interruption commits no fresh admission.\n * Current policy never invalidates an exact retained receipt. A supplied fence fails closed\n * unless the destination installed an interpreter for it. */\nexport const SubmissionAdmissionFence = Context.Reference<{\n  readonly check: (request: AdmissionRequest) => Effect.Effect<void, AdmissionPolicyError>;\n}>(\"@effect-agent/thread/SubmissionAdmissionFence\", {\n  defaultValue: () => ({\n    check: (request) =>\n      request.admissionFence === undefined\n        ? Effect.void\n        : AdmissionPolicyError.make({\n            reason: \"refused\",\n            code: \"unsupported-policy\",\n          }),\n  }),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAM,cAAyC,SAC7C,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC,CAAC,KACnD,OAAO,MAAM,wBAAwB,MAAM,CAC7C;;;;;AAMF,MAAa,iBAAiB,WAAW,gBAAgB;;;;;;;;;;;;;;;;;;;;AAsBzD,MAAa,kBAAkB,OAAO,SAAS;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AASD,MAAa,mCAAsD,SAAS,QAAQ,EAAE;;;;;;;;;AAUtF,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC,EACA,YAAY,OAAO,SAAS;CAAC;CAAgB;CAAsB;AAAa,CAAC,EACnF,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,gBAAb,cAAmC,OAAO,MACxC,oCACF,CAAC,CAAC;CACA,oBAAoB;CACpB,kBAAkB;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,iBAAiB,OAAO,OAAO;CAC1C,UAAU,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CAC7D,KAAK,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACxD,UAAU,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AAC/D,CAAC;AAGD,MAAa,iBAAiB,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;;AAGjF,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA;CACE,QAAQ,OAAO,SAAS;EAAC;EAAW;EAAe;CAAU,CAAC;CAC9D,MAAM,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACzD,OAAO,OAAO,YAAYA,KAAuB;CACjD,OAAO,OAAO,YAAY,OAAO,MAAM;AACzC,CACF,CAAC,CAAC,CAAC;;;;;;;;;AAUH,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,UAAU;CACV,WAAW;CACX,gBAAgB;CAChB,SAAS;CACT,cAAc;CACd,cAAc;CACd,cAAc;CACd,aAAa;CACb,eAAe,OAAO,YAAY,aAAa;CAC/C,iBAAiB,OAAO,YAAY,eAAe;CACnD,kBAAkB,OAAO,YAAY,YAAY;CACjD,gBAAgB,OAAO,YAAY,cAAc;CACjD,gBAAgB,OAAO,YAAY,cAAc;AACnD,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,kBAAb,cAAqC,OAAO,MAC1C,sCACF,CAAC,CAAC;CACA,cAAc;CACd,WAAW;CACX,eAAe;CACf,OAAO;CACP,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC,EACA,cAAc,aAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,uBAAb,cAA0C,OAAO,YAC/C,2CACF,CAAC,CAAC,wBAAwB,EACxB,cAAc,aAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,YAChD,4CACF,CAAC,CAAC,yBAAyB;CACzB,UAAU;CACV,WAAW;CACX,gBAAgB;AAClB,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,mBAAmB,OAAO,MAAM,CAAC,sBAAsB,qBAAqB,CAAC;;;;;;AAQ1F,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,cAAc;CACd,UAAU;CACV,eAAe;CACf,WAAW;CACX,gBAAgB;CAChB,cAAc;CACd,WAAW;CACX,OAAO;AACT,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,GAAG,mBAAmB;CACtB,SAAS;CACT,cAAc;CACd,cAAc;CACd,aAAa;CACb,gBAAgB,OAAO,YAAY,iBAAiB;CACpD,WAAW,OAAO;CAClB,SAAS,OAAO,YAAY,OAAO,qBAAqB;CACxD,gBAAgB,OAAO,YAAY,cAAc;CACjD,gBAAgB,OAAO,YAAY,cAAc;CACjD,eAAe,OAAO,YAAY,aAAa;CAC/C,iBAAiB,OAAO,YAAY,eAAe;CACnD,kBAAkB,OAAO,YAAY,YAAY;AACnD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,uBAAb,cAA0C,OAAO,YAC/C,2CACF,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;;AAGtB,IAAa,oBAAb,cAAuC,OAAO,YAC5C,wCACF,CAAC,CAAC,YAAY,EACZ,YAAY,mBACd,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,yBAAb,cAA4C,OAAO,YACjD,6CACF,CAAC,CAAC,iBAAiB,EACjB,QAAQ,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC,EACtD,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,MAAa,sBAAsB,OAAO,MAAM;CAC9C;CACA;CACA;AACF,CAAC;AAID,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,UAAU;CACV,YAAY;AACd,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,QAAb,cAA2B,OAAO,MAAa,4BAA4B,CAAC,CAAC;CAC3E,cAAc;CACd,WAAW;CACX,gBAAgB;CAChB,eAAe;CACf,gBAAgB,OAAO;CACvB,cAAc;AAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,4CACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;AAClB,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,gBAAgB;CAChB,gBAAgB,OAAO;AACzB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;AAClB,CAAC,CAAC,CAAC,CAAC;;;;AAKJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;CAChB,UAAU;CACV,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,UAAU;CACV,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,wBAAb,cAA2C,OAAO,MAChD,4CACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;CAChB,cAAc;CACd,SAAS;CACT,QAAQ;CACR,cAAc;AAChB,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,cAAc;CACd,cAAc;CACd,SAAS;CACT,QAAQ;CACR,cAAc;CACd,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,yBAAb,cAA4C,OAAO,MACjD,6CACF,CAAC,CAAC;CACA,cAAc;CACd,cAAc;AAChB,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAM,mBAAmB,OAAO,OAAO;CACrC,cAAc;CACd,cAAc;CACd,WAAW;CACX,SAAS;;CAET,gBAAgB,OAAO,YAAY,aAAa;;CAEhD,cAAc,OAAO,YAAY,eAAe;;CAEhD,SAAS,OAAO,YAAY,2BAA2B;CACvD,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,MACD,OAAO,YACJ,eAAgB,WAAW,YAAY,cAAe,WAAW,YAAY,KAAA,IAC9E,EAAE,OAAO,yCAAyC,CACpD,CACF;;AAGA,IAAa,aAAb,cAAgC,OAAO,MAAkB,iCAAiC,CAAC,CACzF,gBACF,CAAC,CAAC,CAAC;;;;;;AAOH,MAAa,+BACX,WAC4C;CAC5C,MAAM,UAAU,OAAO;CAEvB,OAAO,QAAQ,SAAS,uBAAuB,QAAQ,YAAY,WAC/D,QAAQ,SACR,KAAA;AACN;;;;;AAMA,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,cAAc;CACd,QAAQ,eAAe,OAAO;CAC9B,QAAQ,eAAe,OAAO;AAChC,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,cAAb,cAAiC,OAAO,MAAmB,kCAAkC,CAAC,CAAC;CAC7F,cAAc;CACd,QAAQ,eAAe,OAAO;CAC9B,QAAQ,eAAe,OAAO;CAC9B,aAAa,OAAO;CACpB,mBAAmB,OAAO,YAAY,QAAQ;AAChD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC,EAAE,cAAc,aAAa,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQnC,IAAa,sBAAb,cAAyC,OAAO,MAC9C,0CACF,CAAC,CAAC;CACA,UAAU;CACV,kBAAkB;CAClB,gBAAgB;CAChB,UAAU,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,cAAc;CACd,eAAe;CACf,cAAc;AAChB,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,oBAAb,cAAuC,OAAO,MAC5C,wCACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;CAChB,UAAU;CACV,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,uBAAb,cAA0C,OAAO,MAC/C,2CACF,CAAC,CAAC,EACA,cAAc,aAChB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,4BAAb,cAA+C,OAAO,YACpD,gDACF,CAAC,CAAC,mBAAmB,EACnB,aAAa,OAAO,cAAc,UAAU,EAC9C,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,YAAY;CACZ,mBAAmB;AACrB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,4BAAb,cAA+C,OAAO,YACpD,gDACF,CAAC,CAAC,mBAAmB,EACnB,UAAU,OAAO,cAAc,YAAY,EAC7C,CAAC,CAAC,CAAC,CAAC;AAEJ,MAAa,mBAAmB,OAAO,MAAM,CAC3C,2BACA,yBACF,CAAC;;;;;;AASD,IAAa,iBAAb,cAAoC,OAAO,MACzC,qCACF,CAAC,CAAC;CACA,cAAc;CACd,gBAAgB;CAChB,QAAQ;AACV,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,MAAa,oBAAoB,OAAO,SAAS,CAAC,aAAa,oBAAoB,CAAC;;;;;;AAQpF,IAAa,2BAAb,cAA8C,OAAO,MACnD,+CACF,CAAC,CAAC;CACA,oBAAoB;CACpB,mBAAmB;AACrB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,MAAa,sBAAsB,OAAO,SAAS;CAAC;CAAS;CAAiB;AAAa,CAAC;;;AAK5F,MAAa,qBAAqB,WAAW,oBAAoB;;;;;;AAQjE,MAAa,yBAAyB,OAAO,SAAS;CAAC;CAAY;CAAkB;AAAU,CAAC;;;;;;AAQhG,IAAa,gCAAb,cAAmD,OAAO,MACxD,oDACF,CAAC,CAAC;CACA,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,gBAAgB;CAChB,YAAY;CACZ,kBAAkB;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,iCAAb,cAAoD,OAAO,MACzD,qDACF,CAAC,CAAC;CACA,eAAe;CACf,oBAAoB;CACpB,kBAAkB;CAClB,mBAAmB,OAAO,YAAY,YAAY;CAClD,QAAQ;CACR,YAAY;CACZ,kBAAkB;CAClB,YAAY,OAAO,YAAY,aAAa;CAC5C,YAAY,OAAO;CACnB,gBAAgB,OAAO,YAAY,OAAO,qBAAqB;CAC/D,YAAY,OAAO,YAAY,OAAO,qBAAqB;AAC7D,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,sBAAb,cAAyC,OAAO,MAC9C,0CACF,CAAC,CAAC;CACA,aAAa;CACb,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,kCAAb,cAAqD,OAAO,MAC1D,sDACF,CAAC,CAAC;CACA,eAAe;CACf,gBAAgB;CAChB,mBAAmB;AACrB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,iCAAb,cAAoD,OAAO,MACzD,qDACF,CAAC,CAAC;CACA,eAAe;CACf,YAAY;AACd,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,4BAAb,cAA+C,OAAO,MACpD,gDACF,CAAC,CAAC,EACA,eAAe,mBACjB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,cAAc;CACd,YAAY;CACZ,UAAU;CACV,UAAU,oBAAoB,OAAO;CACrC,QAAQ,oBAAoB,OAAO;AACrC,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,yBAAb,cAA4C,OAAO,MACjD,6CACF,CAAC,CAAC;CACA,cAAc;CACd,YAAY;CACZ,UAAU;CACV,UAAU,oBAAoB,OAAO;CACrC,QAAQ,oBAAoB,OAAO;CACnC,WAAW,OAAO;CAClB,mBAAmB,OAAO,YAAY,QAAQ;AAChD,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,cAAc;CACd,aAAa,OAAO,cAAc,UAAU;CAC5C,QAAQ,gBAAgB,OAAO;AACjC,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gCAAb,cAAmD,OAAO,YACxD,oDACF,CAAC,CAAC,uBAAuB;CACvB,QAAQ;CACR,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,0BAAb,cAA6C,OAAO,YAClD,8CACF,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;;AAGxB,IAAa,wBAAb,cAA2C,OAAO,YAChD,4CACF,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;;;AAItB,IAAa,4BAAb,cAA+C,OAAO,YACpD,gDACF,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;;AAG1B,MAAa,oBAAoB,OAAO,MAAM;CAC5C;CACA;CACA;CACA;AACF,CAAC;;;;;;;AAUD,IAAa,2BAAb,cAA8C,OAAO,MACnD,+CACF,CAAC,CAAC;CACA,cAAc;CACd,YAAY;CACZ,QAAQ,iBAAiB,OAAO;CAChC,QAAQ,iBAAiB,OAAO;CAChC,YAAY;AACd,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,cAAc;CACd,YAAY;CACZ,QAAQ,iBAAiB,OAAO;CAChC,QAAQ,iBAAiB,OAAO;CAChC,YAAY;CACZ,YAAY,OAAO;CACnB,mBAAmB,OAAO,YAAY,QAAQ;AAChD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,oBAAb,cAAuC,OAAO,MAC5C,wCACF,CAAC,CAAC;CACA,WAAW;CACX,iBAAiB;CACjB,eAAe;CACf,gBAAgB,OAAO;AACzB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,gCAAb,cAAmD,OAAO,MACxD,oDACF,CAAC,CAAC;CACA,cAAc;CACd,SAAS;CACT,QAAQ;CACR,cAAc;CACd,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC,EACA,cAAc,aAChB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,cAAc;CACd,OAAO;CACP,kBAAkB;AACpB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,MAC7C,yCACF,CAAC,CAAC;CACA,QAAQ;CACR,aAAa,OAAO;AACtB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,YAAY;CACZ,mBAAmB;CACnB,YAAY;CACZ,cAAc,OAAO,YAAY,iBAAiB;AACpD,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;AAeJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,YAAY;CACZ,WAAW,OAAO,YAAY,iBAAiB;CAC/C,cAAc,OAAO,YAAY,kBAAkB;CACnD,aAAa,OAAO,YAAY,6BAA6B;CAC7D,aAAa,OAAO,YAAY,WAAW;CAC3C,OAAO,OAAO,MAAM,YAAY;CAChC,kBAAkB,OAAO,YAAY,YAAY;CACjD,YAAY,OAAO,YAAY,kBAAkB;CACjD,mBAAmB,OAAO,MAAM,sBAAsB;CACtD,oBAAoB,OAAO,MAAM,uBAAuB;CACxD,mBAAmB,OAAO,MAAM,8BAA8B,CAAC,CAAC,KAC9D,OAAO,uBAAuB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAClD;CACA,kBAAkB,OAAO,MAAM,uBAAuB,CAAC,CAAC,KACtD,OAAO,uBAAuB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAClD;CACA,eAAe,OAAO,YAAY,aAAa;AACjD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,oBAAb,cAAuC,OAAO,YAA+B,CAAC,CAC5E,qBACA;CACE,UAAU;CACV,WAAW;CACX,gBAAgB;CAChB,qBAAqB;CACrB,sBAAsB;AACxB,CACF,CAAC,CAAC,CAAC;;;;;AAMH,IAAa,gBAAb,cAAmC,OAAO,YAA2B,CAAC,CAAC,iBAAiB;CACtF,cAAc;CACd,aAAa;AACf,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA;CACE,cAAc;CACd,iBAAiB;AACnB,CACF,CAAC,CAAC,CAAC;;;;;AAMH,IAAa,mBAAb,cAAsC,OAAO,YAA8B,CAAC,CAAC,oBAAoB;CAC/F,cAAc;CACd,YAAY;CACZ,kBAAkB;AACpB,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA;CACE,cAAc;CACd,YAAY;AACd,CACF,CAAC,CAAC,CAAC;;;;;;;AAQH,IAAa,2BAAb,cAA8C,OAAO,YAAsC,CAAC,CAC1F,4BACA;CACE,eAAe;CACf,QAAQ;CACR,SAAS,OAAO;AAClB,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,cAAb,cAAiC,OAAO,YAAyB,CAAC,CAAC,eAAe;CAChF,WAAW,OAAO;CAClB,SAAS,OAAO;CAChB,OAAO,OAAO,YAAYA,KAAuB;AACnD,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2IJ,IAAa,mBAAb,cAAsC,QAAQ,QAqF5C,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC;AAE9C,MAAM,gBAAgB,OAAO,WAAW,OAAO;AAC/C,MAAM,iBAAiB,OAAO,WAAW,QAAQ;AACjD,MAAM,qBAAqB,OAAO,WAAW,YAAY;;;;;;;AAQzD,MAAa,0BAA0B,iBACrC,cAAc,oBAAoB,cAAc;;AAGlD,MAAa,2BAA2B,iBACtC,eAAe,SAAS,cAAc;;AAGxC,MAAa,0BAA0B,iBACrC,mBAAmB,cAAc,cAAc;;AAGjD,MAAa,+BAA+B,iBAC1C,cAAc,yBAAyB,cAAc;;AAGvD,MAAa,gCAAgC,iBAC3C,eAAe,cAAc,cAAc;;AAG7C,MAAa,0BAA0B,iBACrC,cAAc,oBAAoB,cAAc;;AAGlD,MAAa,2BAA2B,iBACtC,eAAe,SAAS,cAAc;;;;;;;;;;AAWxC,MAAa,2BAA2B,QAAQ,UAE7C,iDAAiD,EAClD,qBAAqB,EACnB,QAAQ,YACN,QAAQ,mBAAmB,KAAA,IACvB,OAAO,OACP,qBAAqB,KAAK;CACxB,QAAQ;CACR,MAAM;AACR,CAAC,EACT,GACF,CAAC"}

package/dist/durable/SubmissionLedgerConformance.d.mts

@@ -1,4 +1,4 @@
-import { ho as SubmissionLedgerFailure, mi as DigestError, mo as SubmissionLedger } from "../Records-4qnRmniE.mjs";
+import { bi as DigestError, bo as SubmissionLedger, xo as SubmissionLedgerFailure } from "../Records-BtxMy8xD.mjs";
 import { Crypto, Effect, Schema } from "effect";
 //#region src/durable/SubmissionLedgerConformance.d.ts
 declare const SubmissionLedgerConformanceViolation_base: Schema.Class<SubmissionLedgerConformanceViolation, Schema.TaggedStruct<"SubmissionLedgerConformanceViolation", {

package/dist/durable/SubmissionLedgerConformance.mjs

@@ -885,7 +885,8 @@ const scanNonterminalWorklist = conformanceCase("scans exactly the unsettled wor
 	yield* ensure(scanned.every((snapshot) => snapshot.state !== "settled"), "scanNonterminal must never emit settled Submissions");
 	const mine = scanned.filter((snapshot) => snapshot.threadId === laneA || snapshot.threadId === laneB);
 	yield* ensure(mine.length === 2 && mine.at(0)?.submissionId === second.submissionId && mine.at(1)?.submissionId === third.submissionId, "scanNonterminal must emit exactly the unsettled Submissions in queue-sequence order");
-	yield* ensure(mine.at(0)?.state === "running" && mine.at(1)?.state === "ready", "scanNonterminal snapshots must carry the current Submission states");
+	yield* ensure(mine.at(0)?.state === "running" && mine.at(1)?.state === "ready", "scanNonterminal entries must carry the current Submission states");
+	yield* ensure(mine.at(0)?.receiptId === second.receiptId && mine.at(1)?.receiptId === third.receiptId && mine.every((entry) => entry.principal === CONFORMANCE_PRINCIPAL && !("inputPayload" in entry) && !("workerAdmission" in entry) && !("messageAdmission" in entry)), "The worklist retains receipt and principal identity without execution payloads");
 	const start = scanned.findIndex((snapshot) => snapshot.submissionId === second.submissionId);
 	yield* ensure(start >= 0 && scanned.at(start + 1)?.submissionId === third.submissionId, "One lane's unsettled Submissions must be contiguous in (thread, sequence) order");
 }));