effect-agent 0.1.0-beta.134 → 0.1.0-beta.136

package/src/durable/RunJournal.ts

@@ -555,6 +555,9 @@ const PROMPT_TRANSPARENT_TAGS: ReadonlySet<string> = new Set([
  * are never canonical settlements or evidence for compaction, recovery or accounting. Real
  * results replace them at the original declaration, including results appended after another Run.
  * Prior user intent and assistant text remain visible; prior system instructions do not.
+ * Each Run retains the history preceding its start and its own continuation. Other Runs'
+ * subsequent Turns cannot replace its input. Compaction covers only its creator's Run view;
+ * a projection without an owner retains interleaved exchanges from the complete Thread history.
  */
 /** @internal Lightweight canonical boundaries collected without retaining record payloads. */
 export interface JournalBoundary {
@@ -598,13 +601,11 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
     committedTurns: seed?.committedTurns ?? 0,
   };
 
-  // RUN-026 pre-scan: the widest VALID compaction bounds govern the fold. A
-  // valid record covers strictly below its own sequence and never splits a response from its
-  // settled tool results. Pruning and rollovers may cover complete owner-Run batches;
-  // a summarize record must carry its summary. Invalid records
-  // are ignored fail-safe — the full history stays authoritative. Ties on
-  // coversThrough resolve to the record appended later (higher sequence),
-  // matching at-most-once replay intent.
+  // RUN-026 pre-scan: valid compactions retire only their creator's Run view. A bound
+  // stays below its own sequence and cannot split a visible response from its settled results.
+  // Pruning and rollovers may cover complete owner-Run batches; a summarize record carries
+  // its summary. Invalid records leave full history authoritative. A wider containing view
+  // replaces earlier coverage, with equal bounds preferring the later record.
   // One span per settled record, paired with its declaring response the same
   // way the fold pairs them: a settled belongs to the most recent
   // ModelResponseRecorded of its Run. A bound inside (response, settled)
@@ -634,9 +635,39 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
     toolExecutionEvidence,
     settledToolCallRecordIds,
     settledById,
-    compactions,
   } = metadata;
 
+  const declarationByResultSequence = new Map(settledSpans.map(({ from, to }) => [to, from]));
+
+  const isInRunView = (
+    sequence: number,
+    payload: { readonly _tag: string; readonly runId?: RunId | undefined },
+    runId: RunId | undefined,
+  ): boolean => {
+    if (runId === undefined || payload.runId === undefined || payload.runId === runId) return true;
+    const first = firstSequenceByRun.get(runId) ?? Number.POSITIVE_INFINITY;
+
+    return (
+      sequence < first ||
+      (payload._tag === "ToolCallSettled" &&
+        (declarationByResultSequence.get(sequence) ?? Number.POSITIVE_INFINITY) < first)
+    );
+  };
+
+  const compactions = metadata.compactions.filter(({ sequence, payload }) =>
+    isInRunView(sequence, payload, ownerRunId),
+  );
+
+  const recordsForRun = records.pipe(
+    Stream.filter(({ sequence, record: { payload } }) =>
+      isInRunView(sequence, payload, ownerRunId),
+    ),
+  );
+
+  const isCovered = (envelope: CanonicalRecordEnvelope, compaction: CompactionCreated): boolean =>
+    envelope.sequence <= compaction.coversThrough &&
+    isInRunView(envelope.sequence, envelope.record.payload, compaction.runId);
+
   const settledCoverage = compactions.reduce(
     (through, { payload }) =>
       payload.kind !== "summarize" ? Math.max(through, payload.coversThrough) : through,
@@ -671,7 +702,7 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
       : yield* decodePromptMessages(seed.protectedContext);
 
   if (settledCoverage > 0) {
-    yield* Stream.runForEach(records, (envelope) =>
+    yield* Stream.runForEach(recordsForRun, (envelope) =>
       Effect.gen(function* () {
         const payload = envelope.record.payload;
 
@@ -727,21 +758,54 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
       incompleteResponseSequences.some(
         (response) =>
           response.sequence <= coversThrough &&
+          isInRunView(
+            response.sequence,
+            { _tag: "ModelResponseRecorded", runId: response.runId },
+            runId,
+          ) &&
           !isTerminalPriorRun(response.runId, runId, ownSequence),
       )
     )
       return false;
     for (const span of settledSpans) {
-      if (span.from <= coversThrough && coversThrough < span.to) return false;
+      if (
+        span.from <= coversThrough &&
+        coversThrough < span.to &&
+        isInRunView(span.from, { _tag: "ModelResponseRecorded", runId: span.runId }, runId)
+      )
+        return false;
     }
 
     return true;
   };
 
-  let summarizeBound = 0;
-  let replacement: CompactionCreated | undefined;
-  let summarizeSequence = -1;
-  let clearBound = 0;
+  type CompactionView = (typeof compactions)[number];
+
+  let replacements: ReadonlyArray<CompactionView> = [];
+  let clearings: ReadonlyArray<CompactionView> = [];
+
+  const retainCompaction = (views: ReadonlyArray<CompactionView>, next: CompactionView) => {
+    // Independent Run views overlap without containing one another. Retire an overlay only
+    // when the replacement actually contains its view, not merely a larger sequence number.
+    if (
+      views.some(
+        (prior) =>
+          prior.payload.coversThrough > next.payload.coversThrough &&
+          isInRunView(next.sequence, next.payload, prior.payload.runId),
+      )
+    )
+      return views;
+
+    return [
+      ...views.filter(
+        (prior) =>
+          next.payload.coversThrough < prior.payload.coversThrough ||
+          !isInRunView(prior.sequence, prior.payload, next.payload.runId),
+      ),
+      next,
+    ];
+  };
+
   let latestWindowId: string | undefined = seed?.contextWindowId;
   let latestWindowSequence = seed?.throughSequence ?? -1;
   let rolloverCoveredThrough = 0;
@@ -756,53 +820,48 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
       rolloverCoveredThrough = Math.max(rolloverCoveredThrough, payload.coversThrough);
     if (payload.kind === "summarize" || payload.kind === "rollover") {
       if (payload.kind === "summarize" && payload.summary === undefined) continue;
-      if (
-        payload.coversThrough > summarizeBound ||
-        (payload.coversThrough === summarizeBound && sequence > summarizeSequence)
-      ) {
-        summarizeBound = payload.coversThrough;
-        summarizeSequence = sequence;
-        replacement = payload;
-      }
-    } else if (payload.coversThrough > clearBound) {
-      clearBound = payload.coversThrough;
-    }
+      replacements = retainCompaction(replacements, { payload, sequence });
+    } else clearings = retainCompaction(clearings, { payload, sequence });
   }
   let summaryEmitted = false;
 
-  const retainedPrefix =
-    replacement?.kind === "rollover" &&
-    replacement.runId === ownerRunId &&
-    ownerPrefixSequence <= summarizeBound
-      ? (protectedContext?.content ?? [])
-      : [];
+  const retainedPrefix = replacements.some(
+    ({ payload }) =>
+      payload.kind === "rollover" &&
+      payload.runId === ownerRunId &&
+      ownerPrefixSequence <= payload.coversThrough,
+  )
+    ? (protectedContext?.content ?? [])
+    : [];
 
-  const replacementLength = replacement === undefined ? 0 : retainedPrefix.length + 1;
+  const replacementLength = retainedPrefix.length + replacements.length;
 
   if (seed?.frontier !== undefined)
     onBoundary?.({ ...seed.frontier, promptLength: replacementLength });
 
   const emitSummary = () => {
-    if (summaryEmitted || replacement === undefined) return;
+    if (summaryEmitted || replacements.length === 0) return;
     summaryEmitted = true;
+    state.all.push(...retainedPrefix);
+    for (const { payload: replacement } of replacements) {
+      const message =
+        replacement.kind === "rollover"
+          ? contextWindowMessage(
+              contextWindowId(replacement.runId, replacement.turn),
+              replacement.handoff,
+            )
+          : Prompt.makeMessage("user", {
+              content: [
+                Prompt.makePart("text", {
+                  text: `${COMPACTION_SUMMARY_PREFIX}${replacement.summary}`,
+                }),
+              ],
+            });
 
-    const message =
-      replacement.kind === "rollover"
-        ? contextWindowMessage(
-            contextWindowId(replacement.runId, replacement.turn),
-            replacement.handoff,
-          )
-        : Prompt.makeMessage("user", {
-            content: [
-              Prompt.makePart("text", {
-                text: `${COMPACTION_SUMMARY_PREFIX}${replacement.summary}`,
-              }),
-            ],
-          });
-
-    state.all.push(...retainedPrefix, message);
-    if (replacement.kind !== "rollover" || replacement.runId !== ownerRunId)
-      state.before.push(message);
+      state.all.push(message);
+      if (replacement.kind !== "rollover" || replacement.runId !== ownerRunId)
+        state.before.push(message);
+    }
   };
 
   const modelUsage: Array<ModelCallUsage> = [];
@@ -986,7 +1045,7 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
     };
   });
 
-  yield* Stream.runForEach(records, (envelope) =>
+  yield* Stream.runForEach(recordsForRun, (envelope) =>
     Effect.gen(function* () {
       const payload = envelope.record.payload;
 
@@ -1020,8 +1079,8 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
         (payload._tag === "ModelResponseRecorded" || payload._tag === "ToolCallSettled")
       )
         return;
-      if (envelope.sequence <= summarizeBound) {
-        // Projecting an earlier Run after a later summary still accounts for its covered responses.
+      if (replacements.some(({ payload }) => isCovered(envelope, payload))) {
+        // Retiring Prompt payloads does not retire the owning Run's policy or usage accounting.
         if (payload._tag === "ModelResponseRecorded" && payload.runId === ownerRunId) {
           const messages = yield* decodePromptMessages(payload.messages);
 
@@ -1032,7 +1091,7 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
           onBoundary?.({
             sequence: envelope.sequence,
             tag: payload._tag,
-            promptLength: replacementLength,
+            promptLength: Math.max(replacementLength, state.all.length),
             ...(isTerminalPriorRun(payload.runId, ownerRunId, Number.POSITIVE_INFINITY)
               ? { terminalPriorRun: true }
               : {}),
@@ -1059,7 +1118,9 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
           slot.parts[slot.partIndex] = Prompt.makePart("tool-result", {
             id: payload.toolCallId,
             name: payload.toolName,
-            result: envelope.sequence <= clearBound ? CLEARED_TOOL_RESULT : payload.result,
+            result: clearings.some(({ payload }) => isCovered(envelope, payload))
+              ? CLEARED_TOOL_RESULT
+              : payload.result,
             isFailure: payload.isFailure,
             providerExecuted: false,
           });
@@ -1086,7 +1147,10 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
         ) {
           state = yield* flushTools(state);
         }
-        state.pendingTools.push({ record: payload, cleared: envelope.sequence <= clearBound });
+        state.pendingTools.push({
+          record: payload,
+          cleared: clearings.some(({ payload }) => isCovered(envelope, payload)),
+        });
         state = {
           ...state,
           pendingToolsForRun: payload.runId === ownerRunId,

package/src/durable/SubmissionLedger.ts

@@ -85,6 +85,21 @@ export const SubmissionState = Schema.Literals([
 
 export type SubmissionState = typeof SubmissionState.Type;
 
+/**
+ * Opt-in host policy for handling the next runnable same-Agent input in its own Run at a complete Turn
+ * boundary. This never joins inputs or changes their principals, grants, or receipts. The
+ * runtime selects the ordered candidate; policy cannot select an arbitrary Submission.
+ * Approval waits, child waits and incomplete Tool batches are not handoff boundaries. Hosts
+ * retaining independent replies must also leave those inputs unclaimed by `claimJoining`.
+ * In-flight model requests and Tool batches run to their existing safe boundary.
+ */
+export const SubmissionScheduling = Context.Reference<{
+  readonly yieldTo?: (request: {
+    readonly active: SubmissionSnapshot;
+    readonly next: SubmissionSnapshot;
+  }) => Effect.Effect<boolean, LedgerError>;
+}>("@effect-agent/thread/SubmissionScheduling", { defaultValue: () => ({}) });
+
 /**
  * Default ownership lease duration (D5). The lease is a liveness hint that makes an abandoned
  * claim reclaimable; correctness never depends on it because every canonical append is fenced by
@@ -289,9 +304,21 @@ export const AdmissionResolution = Schema.Union([
 
 export type AdmissionResolution = typeof AdmissionResolution.Type;
 
+/**
+ * A trusted runtime's advisory handoff after committing a complete Turn and closing its
+ * Attempt. The epoch fences the observation; an intervening claim invalidates it. Deferred
+ * Runs retain their identities and obligations. Losing this hint resumes ordinary FIFO.
+ */
+export class ClaimHandoff extends Schema.Class<ClaimHandoff>("@effect-agent/thread/ClaimHandoff")({
+  producerEpoch: ProducerEpoch,
+  deferredSubmissionIds: Schema.NonEmptyArray(SubmissionId),
+  submissionId: SubmissionId,
+}) {}
+
 export class ClaimRequest extends Schema.Class<ClaimRequest>("@effect-agent/thread/ClaimRequest")({
   threadId: ThreadId,
   producerId: ProducerId,
+  handoff: Schema.optionalKey(ClaimHandoff),
 }) {}
 
 /**
@@ -1019,6 +1046,11 @@ export type SubmissionLedgerFailure =
  *   `attemptId` and `ownershipToken`, and starts the ownership lease (D5: adapters default to
  *   `DEFAULT_OWNERSHIP_LEASE_DURATION`, configurable). An expired lease makes the head
  *   claimable; expiry alone never revokes correctness, only permission to assume liveness.
+ *   An optional trusted-runtime `handoff` can defer only the named `input-applied` prefix,
+ *   with no abort intent, to claim the exact next runnable Submission. It is checked atomically
+ *   against the current producer epoch and the same whole-Thread ownership fence. Admission
+ *   gaps, approval/child waits and joined work cannot be bypassed. Hints are not durable facts;
+ *   recovery resumes the same retained Runs and can select another complete-Turn handoff.
  * - `renewOwnership` — extends the lease while the token still owns the lane; fails with
  *   `OwnershipLost` once superseded. Renewal after lease expiry succeeds if no other claim has
  *   taken the lane in between.

package/src/durable/SubmissionLedgerConformance.ts

@@ -45,6 +45,7 @@ import {
   ChildSettledNotification,
   ClaimJoiningRequest,
   ClaimRequest,
+  ClaimHandoff,
   IdempotencyKey,
   JoinedToHost,
   LedgerError,
@@ -4770,6 +4771,124 @@ const assignmentSettlement = conformanceCase(
     }),
 );
 
+// Native turn-boundary yielding retained the active FIFO head:
+// https://github.com/danieljvdm/effect-agent/commit/2259fc05eec3bfac2a92a8d055953f3482e54735
+const cooperativeHandoff = conformanceCase(
+  "hands off complete Turns without bypassing ownership, ordering, cancellation or approval",
+  ({ ensure, expectSome }) =>
+    Effect.gen(function* () {
+      const ledger = yield* SubmissionLedger;
+
+      for (const scenario of [
+        "ready",
+        "live",
+        "stale",
+        "abort",
+        "approval",
+        "gap",
+        "ready-prefix",
+        "unapplied",
+        "foreign",
+      ] as const) {
+        const threadId = decodeThreadId(`ledger-handoff-${scenario}`);
+        const first = yield* admitReady(threadId, "first", { work: "old" });
+        const claim = yield* expectSome("original claim", yield* claimLane(threadId, PRODUCER_A));
+
+        if (scenario !== "unapplied")
+          yield* ledger.markInputApplied(
+            MarkInputAppliedRequest.make({
+              submissionId: first.submissionId,
+              ownershipToken: claim.ownershipToken,
+              recordId: submissionInputRecordId(first.submissionId),
+              sequence: decodeSequence(1),
+            }),
+          );
+        if (scenario === "gap")
+          yield* ledger.admit(yield* admissionRequest(threadId, "gap", { work: "not-ready" }));
+        if (scenario === "ready-prefix") yield* admitReady(threadId, "prefix", { work: "earlier" });
+        const next = yield* admitReady(threadId, "next", { work: "human" });
+
+        const handoff = ClaimHandoff.make({
+          producerEpoch: claim.producerEpoch,
+          deferredSubmissionIds: [first.submissionId],
+          submissionId: scenario === "foreign" ? decodeSubmissionId("foreign") : next.submissionId,
+        });
+
+        if (scenario === "approval") {
+          yield* ledger.suspend(
+            SuspendRequest.make({
+              submissionId: first.submissionId,
+              ownershipToken: claim.ownershipToken,
+              reason: ApprovalPendingSuspension.make({
+                toolCallIds: [decodeToolCallId("purchase")],
+              }),
+            }),
+          );
+        } else if (scenario !== "live") {
+          yield* ledger.releaseOwnership(
+            ReleaseOwnershipRequest.make({
+              submissionId: first.submissionId,
+              ownershipToken: claim.ownershipToken,
+            }),
+          );
+        }
+        if (scenario === "abort")
+          yield* ledger.requestAbort(
+            AbortCommand.make({
+              submissionId: first.submissionId,
+              author: "human",
+              reason: "stop",
+            }),
+          );
+        if (scenario === "stale") {
+          const intervening = yield* expectSome(
+            "intervening claim",
+            yield* claimLane(threadId, PRODUCER_B),
+          );
+
+          yield* ledger.releaseOwnership(
+            ReleaseOwnershipRequest.make({
+              submissionId: first.submissionId,
+              ownershipToken: intervening.ownershipToken,
+            }),
+          );
+        }
+
+        const selected = yield* ledger.claim(
+          ClaimRequest.make({ threadId, producerId: PRODUCER_B, handoff }),
+        );
+
+        if (scenario !== "ready") {
+          yield* ensure(Option.isNone(selected), `Handoff must preserve the ${scenario} boundary`);
+          continue;
+        }
+        const nextClaim = yield* expectSome("ordered handoff claim", selected);
+
+        yield* ensure(
+          nextClaim.submissionId === next.submissionId &&
+            nextClaim.producerEpoch > claim.producerEpoch,
+          "Handoff must claim the next Submission with a new epoch",
+        );
+        yield* settleClaimed(next, nextClaim.ownershipToken);
+
+        const resumed = yield* expectSome(
+          "original Run resumes",
+          yield* claimLane(threadId, PRODUCER_A),
+        );
+
+        yield* ensure(
+          resumed.submissionId === first.submissionId,
+          "The deferred Submission must retain its original obligation",
+        );
+        yield* ensure(
+          (yield* recoverySnapshot(first.submissionId)).submission.receiptId === first.receiptId &&
+            (yield* recoverySnapshot(next.submissionId)).submission.receiptId === next.receiptId,
+          "Handoff must preserve both receipt identities",
+        );
+      }
+    }),
+);
+
 /**
  * The shared, adapter-parameterized SubmissionLedger contract suite (STORE-010). Every durable
  * ledger adapter test suite must execute each case against its own ledger provisioning, inside
@@ -4788,6 +4907,7 @@ export const submissionLedgerConformanceCases: ReadonlyArray<SubmissionLedgerCon
   admissionTupleBoundaries,
   concurrentAdmissionFifo,
   fifoHeadClaim,
+  cooperativeHandoff,
   leaseExpiryReclaim,
   releaseMakesHeadClaimable,
   inputAppliedIdempotency,

package/src/durable/internal/journal-checkpoint.ts

@@ -56,7 +56,7 @@ export class RecoveryCheckpointContents extends Schema.Class<RecoveryCheckpointC
   digest: Digest,
 }) {}
 
-export const RECOVERY_ENGINE_VERSION = "effect-agent/recovery@1";
+export const RECOVERY_ENGINE_VERSION = "effect-agent/recovery@2";
 
 /**
  * Late evidence can invalidate an old compaction. Such histories use full canonical replay;

package/src/durable/internal/journal-metadata.ts

@@ -14,7 +14,11 @@ export interface JournalMetadata {
   readonly firstSequenceByRun: ReadonlyMap<string, number>;
   readonly lastResponseSequenceByRun: ReadonlyMap<string, number>;
   readonly terminalSequenceByRun: ReadonlyMap<string, number>;
-  readonly settledSpans: ReadonlyArray<{ readonly from: number; readonly to: number }>;
+  readonly settledSpans: ReadonlyArray<{
+    readonly from: number;
+    readonly to: number;
+    readonly runId: RunId;
+  }>;
   readonly toolExecutionEvidence: ReadonlySet<string>;
   readonly settledToolCallRecordIds: ReadonlySet<string>;
   readonly settledById: ReadonlyMap<
@@ -45,7 +49,10 @@ export const makeJournalMetadata = (
   if (seed?.firstSequence !== undefined) firstSequenceByRun.set(seed.runId, seed.firstSequence);
   const lastResponseSequenceByRun = new Map<string, number>();
   const terminalSequenceByRun = new Map<string, number>();
-  const settledSpans: Array<{ readonly from: number; readonly to: number }> = [];
+
+  const settledSpans: Array<{ readonly from: number; readonly to: number; readonly runId: RunId }> =
+    [];
+
   const toolExecutionEvidence = new Set<string>();
   const settledToolCallRecordIds = new Set<string>();
 
@@ -98,7 +105,7 @@ export const makeJournalMetadata = (
         const from = lastResponseSequenceByRun.get(payload.runId);
 
         if (from !== undefined && from < envelope.sequence)
-          settledSpans.push({ from, to: envelope.sequence });
+          settledSpans.push({ from, to: envelope.sequence, runId: payload.runId });
       }
     },
     snapshot: (): JournalMetadata => ({