effect-agent 0.1.0-beta.150 → 0.1.0-beta.152

package/dist/{Admin-B8ISZyYf.d.mts → Admin-CKIdJoP8.d.mts}

@@ -1884,6 +1884,11 @@ declare const ThreadStore_base: Context.ServiceClass<ThreadStore, "@effect-agent
   readonly countPeerMessages?: ((request: ThreadPeerCountRequest) => Effect.Effect<number, ThreadStoreError | ThreadNotMaterialized>) | undefined;
 }>;
 declare class ThreadStore extends ThreadStore_base {}
+//#endregion
+//#region src/durable/internal/thread-initialization.d.ts
+/** Stable identities retained across admission retries and recovery. */
+declare const threadCreatedBatchId: (threadId: ThreadId) => BatchId;
+declare const threadCreatedRecordId: (threadId: ThreadId) => RecordId;
 declare namespace DurableAgentRuntime_d_exports {
   export { ApprovalSuspensionError, DurableAbortFailure, DurableAgentRuntime, DurableApprovalFailure, DurableApprovalResolver, DurableApprovalSuspension, DurableAwaitFailure, DurableExplainFailure, DurableObligationFailure, DurableObserveOptions, DurableProgressFailure, DurableResolveFailure, DurableRetryFailure, DurableRuntimeConfig, DurableRuntimeConfigOptions, DurableSubmitAgent, DurableSubmitFailure, DurableSubmitOptions, DurableVerifyFailure, DurableWorkerFailure, DurableWorkerRequirements, Receipt, RecoveryBlocked, RecoveryFailure, RecoveryReport, RecoverySweepOptions, RecoverySweepResult, childReservationIdFor, isolateRecovery, recoveryRepairBatchId, recoveryRepairRecordId, threadCreatedBatchId, threadCreatedRecordId };
 }
@@ -1901,10 +1906,6 @@ type InstructionRequirementsOf<Instructions, Input> = InstructionResultOf<Instru
  * so a replayed establishment converges on the one existing row (SUB-016).
  */
 declare const childReservationIdFor: (runId: RunId, toolCallId: ToolCallId) => ChildReservationId;
-/** Deterministic batch identity of one Thread's initial `ThreadCreated` append. */
-declare const threadCreatedBatchId: (threadId: ThreadId) => BatchId;
-/** Deterministic record identity of one Thread's `ThreadCreated` record. */
-declare const threadCreatedRecordId: (threadId: ThreadId) => RecordId;
 /** Deterministic batch identity of one executed recovery decision's audit append (DUR-013). */
 declare const recoveryRepairBatchId: (submissionId: SubmissionId, decisionTag: string) => BatchId;
 /** Deterministic record identity of one executed recovery decision's `RepairAnnotated` record. */
@@ -4232,4 +4233,4 @@ declare const RetryRefused_base: Schema.Class<RetryRefused, Schema.TaggedStruct<
 declare class RetryRefused extends RetryRefused_base {}
 //#endregion
 export { RepairSubagentStartLink as $, runDurationBatchId as $i, DurableApprovalFailure as $n, ThreadRecoveryCheckpoints as $r, ParentLinkage as $t, AwaitChildSettlement as A, turnResultsBatchId as Aa, JournalBoundary as Ai, SuspensionReason as An, CheckpointRejected as Ar, ChildReservationConflict as At, MarkUnknown as B, ExecutableAgentBinding as Ba, compactionBatchId as Bi, settlementFailureFromRecord as Bn, ThreadExport as Br, InputAppliedMarker as Bt, renderRecoveryExplanation as C, turnBatchId as Ca, drainLifecyclePublications as Ci, SubmissionLookupByKey as Cn, isolateRecovery as Cr, ApprovalDecisionIntent as Ct, ApplyUnknownResolutions as D, turnResponseBatch as Da, SettledSubmission as Di, SubmissionWorkItem as Dn, threadCreatedRecordId as Dr, ChildAttachmentSnapshot as Dt, ApplyJoinAccounting as E, turnPreparedBatchId as Ea, PendingSubmission as Ei, SubmissionState as En, threadCreatedBatchId as Er, BeginChildBudgetReleaseRequest as Et, CompleteMaterialization as F, AgentAttemptContext as Fa, TurnCommitInput as Fi, UnknownResolutionIntent as Fn, SaveCheckpointRequest as Fr, Claim as Ft, PropagateChildAbort as G, definitionDigestsEqual as Ga, modelResponseInterruptedRecordId as Gi, submissionSettlementBatchId as Gn, ThreadNotMaterialized as Gr, MarkInputAppliedRequest as Gt, OpenDelegationCallEvidence as H, ResolvedBinding as Ha, firstWorkerInputRecordId as Hi, submissionAbortRecordId as Hn, ThreadIdentity as Hr, JoiningClaim as Ht, DeclaredPendingBatchEvidence as I, AgentRegistration as Ia, agentUpdateRecordId as Ii, WaitingChild as In, SaveRecoveryCheckpointRequest as Ir, ClaimHandoff as It, Recovery_d_exports as J, projectRunJournal as Ji, workerTerminalFromRecord as Jn, ThreadOutstandingRequest as Jr, MarkUnknownRequest as Jt, RecoveryDecision as K, modelResponseRecordId as Ki, submissionSettlementId as Kn, ThreadObservation as Kr, MarkJoinedRequest as Kt, DelegationAdmissionEvidence as L, BindingUnavailable as La, approvalDecisionBatchId as Li, WaitingForChildSuspension as Ln, SelectedThreadRead as Lr, ClaimJoiningRequest as Lt, AwaitParentEstablishment as M, workerOriginRecordId as Ma, RunJournalProjection as Mi, UnknownResolution as Mn, FencedAppendRequest as Mr, ChildReservationStatus as Mt, AwaitUnknownResolution as N, workerReportRecordId as Na, RunJournalUsage as Ni, UnknownResolutionCommand as Nn, LoadCheckpointRequest as Nr, ChildSettledNotification as Nt, AwaitApprovalDecision as O, turnResponseBatchId as Oa, SubmissionStatus as Oi, SuspendRequest as On, AppendConflict as Or, ChildBudgetReservationRequest as Ot, CompleteChildAdmission as P, AgentRegistration_d_exports as Pa, RunJournal_d_exports as Pi, UnknownResolutionConflict as Pn, MAX_THREAD_EXPORT_RECORDS as Pr, ChildSettledOutcome as Pt, RepairReadiness as Q, runCompletionDigest as Qi, DurableAgentRuntime_d_exports as Qn, ThreadRecordRequest as Qr, OwnershipToken as Qt, EnsureWaitingForChild as R, DurableBindingFailure as Ra, childIdempotencyKeyFor as Ri, WorkerLedgerState as Rn, ThreadCheckpoint as Rr, ClaimRequest as Rt, recoveryDecisionMeaning as S, turnApprovalsBatchId as Sa, LifecyclePublication_d_exports as Si, SubmissionLookupById as Sn, childReservationIdFor as Sr, ApprovalDecisionCommand as St, ApplyInput as T, turnIdForRun as Ta, lifecyclePublicationLayer as Ti, SubmissionSnapshot as Tn, recoveryRepairRecordId as Tr, AttachChildToReservationRequest as Tt, OpenToolCallEvidence as U, compileBindingContracts as Ua, markUnknownBatchId as Ui, submissionInputBatchId as Un, ThreadIdentityRequest as Ur, LedgerCapabilities as Ut, NoAction as V, ReplayVersions as Va, compactionRecordId as Vi, submissionAbortBatchId as Vn, ThreadExportRequest as Vr, JoinSnapshot as Vt, PendingApprovalEvidence as W, compileRegistrations as Wa, modelResponseInterruptedBatchId as Wi, submissionInputRecordId as Wn, ThreadMaterialization as Wr, LedgerError as Wt, RepairInputMarker as X, promptFromCanonicalRecords as Xi, DurableAbortFailure as Xn, ThreadRead as Xr, OwnershipRenewal as Xt, ReleaseOrphanChildReservation as Y, projectRunJournalStream as Yi, ApprovalSuspensionError as Yn, ThreadPeerCountRequest as Yr, OwnershipLost as Yt, RepairJoinMarker as Z, runCompletedRecordId as Zi, DurableAgentRuntime as Zn, ThreadReadRequest as Zr, OwnershipSnapshot as Zt, RetryCommand as _, toolCallResultBatchId as _a, LifecyclePublicationError as _i, SubmissionAdmissionFence as _n, RecoveryBlocked as _r, AdmissionPolicyError as _t, IntegrityCheck as a, subagentJoinedRecordId as aa, ThreadStoreFailure as ai, ReservedChildBudget as an, DurableObserveOptions as ar, SettleAborted as at, obligationSeverityOf as b, toolStepSettledBatchId as ba, LifecyclePublicationSource as bi, SubmissionLedger_d_exports as bn, RecoverySweepOptions as br, AdmissionResult as bt, IntegrityReport as c, subagentRequestedBatchId as ca, ThreadTailRequest as ci, ResolutionCompletedWithResult as cn, DurableRetryFailure as cr, AbortCommand as ct, ObligationReport as d, subagentStartedRecordId as da, getRunInput as di, RevertJoiningRequest as dn, DurableSubmitAgent as dr, AdmissionAdmitted as dt, runDurationRecordId as ea, ThreadRunInputRequest as ei, RecoverySnapshot as en, DurableApprovalResolver as er, ResumeFromTurnBoundary as et, ObligationSeverity as f, toolApprovalDecisionRecordId as fa, readOutstanding as fi, Settlement as fn, DurableSubmitFailure as fr, AdmissionConflict as ft, RecoveryExplanation as g, toolCallResolvedRecordId as ga, LifecyclePublicationConfig as gi, SettlementReservationSnapshot as gn, DurableWorkerRequirements as gr, AdmissionNotAdmitted as gt, RecoveryDisposition as h, toolCallResolutionBatchId as ha, LifecyclePublicationBatch as hi, SettlementReservation as hn, DurableWorkerFailure as hr, AdmissionIndeterminate as ht, ExplainedUnknownCall as i, subagentJoinBatchId as ia, ThreadStoreError as ii, RenewOwnershipRequest as in, DurableObligationFailure as ir, RevertJoining as it, AwaitHostSettlement as j, workerInputRecordId as ja, RunJournalError as ji, SuspensionSnapshot as jn, FenceRejected as jr, ChildReservationId as jt, AwaitChildAdmissionResolution as k, turnResultsBatch as ka, SubmissionStatus_d_exports as ki, SuspensionOutcome as kn, AppendResult as kr, ChildBudgetReservationSnapshot as kt, ObligationBlockedOn as l, subagentRequestedRecordId as la, ThreadWorkerStateRequest as li, ResolutionNeverHappened as ln, DurableRuntimeConfig as lr, AbortIntent as lt, RECOVERY_DECISION_MEANINGS as m, toolCallPreparedRecordId as ma, LifecyclePublication as mi, SettlementFinalization as mn, DurableVerifyFailure as mr, AdmissionGroup as mt, ExplainedEvidence as n, runStartedBatchId as na, ThreadStore as ni, ReleaseChildBudgetRequest as nn, DurableAwaitFailure as nr, ResumeSuspended as nt, IntegrityCheckName as o, subagentLineageBatchId as oa, ThreadStore_d_exports as oi, ReservedSettlement as on, DurableProgressFailure as or, SettleJoinedWithHost as ot, ObligationThresholds as p, toolApprovalRequestRecordId as pa, readWorkerState as pi, SettlementConflict as pn, DurableSubmitOptions as pr, AdmissionFence as pt, RecoveryEvidence as q, peerMessageRecordId as qi, submissionSettlementRecordId as qn, ThreadOutstanding as qr, MarkReadyRequest as qt, ExplainedSubmission as r, runStartedRecordId as ra, ThreadStoreDiagnostic as ri, ReleaseOwnershipRequest as rn, DurableExplainFailure as rr, ResumeWaitingParent as rt, IntegrityCheckStatus as s, subagentLineageRecordId as sa, ThreadTail as si, ResolutionAbortSubmission as sn, DurableResolveFailure as sr, classifyRecovery as st, Admin_d_exports as t, runIdForSubmission as ta, ThreadSelection as ti, RecoverySnapshotRequest as tn, DurableApprovalSuspension as tr, ResumePendingToolBatch as tt, ObligationEntry as u, subagentStartedBatchId as ua, getRecord as ui, ResolutionSafeToRetry as un, DurableRuntimeConfigOptions as ur, AbortIntentRequest as ut, RetryRefusalReason as v, toolCallSettledRecordId as va, LifecyclePublicationFact as vi, SubmissionLedger as vn, RecoveryFailure as vr, AdmissionRequest as vt, AppendReservedSettlement as w, turnCanonicalBatch as wa, lifecyclePublicationBatchMaxFacts as wi, SubmissionScheduling as wn, recoveryRepairBatchId as wr, ApprovalPendingSuspension as wt, predictRecoveryDisposition as x, toolStepSettledRecordId as xa, LifecyclePublicationStorage as xi, SubmissionLookup as xn, RecoverySweepResult as xr, ApprovalConflict as xt, RetryRefused as y, toolCallUnknownRecordId as ya, LifecyclePublicationHandler as yi, SubmissionLedgerFailure as yn, RecoveryReport as yr, AdmissionResolution as yt, FinalizeLedgerFromHistory as z, DurableWorkerBinding as za, childThreadIdFor as zi, WorkerStopCommand as zn, ThreadCheckpoints as zr, DEFAULT_OWNERSHIP_LEASE_DURATION as zt };
-//# sourceMappingURL=Admin-B8ISZyYf.d.mts.map
+//# sourceMappingURL=Admin-CKIdJoP8.d.mts.map

package/dist/{DurableAgentRuntime-DLa4IwFi.mjs → DurableAgentRuntime-DQFV26SB.mjs}

@@ -21,7 +21,7 @@ import { getToolExecutionClass } from "./engine/DurableStep.mjs";
 import { CompactionError, ContextCompactor } from "./engine/ContextCompactor.mjs";
 import { RunPolicyUsage } from "./core/RunPolicyUsage.mjs";
 import { AgentUpdateAcceptance, CurrentToolFailureObserver, ModelUsageAccounting, RunContextPreparation, RunContextPreparationPassthrough, RunToolAuthorization, RunToolScheduling } from "./engine/RunOptions.mjs";
-import { AbortRequested, AgentUpdateEmitted, BatchId, CanonicalBatch, CanonicalRecordEnvelope, CanonicalSequence, CompactionCreated, DefinitionDigests, Digest, ModelResponseInterrupted, PeerMessagePrepared, PersistedJson, ProducerEpoch, RecordEnvelope, RecordId, RepairAnnotated, RunDurationExhausted, RunPolicyUsageReserved, RunStartedRecord, SettlementFailureDiagnostic, SubagentJoined, SubagentLineageRecorded, SubagentRequested, SubagentStarted, SubmissionSettled, SubmissionSettledRecord, SubtreeBudgetReserved, ThreadCreated, ToolApprovalDecided, ToolApprovalRequested, ToolCallPrepared, ToolCallResolved, ToolCallSettled, ToolCallUnknown, ToolOperation, ToolStepSettled, ToolUnavailable, UserInputRecorded, WorkerAdmission, WorkerContinuation, WorkerInputCompleted, WorkerInputRequested, WorkerOrigin, WorkerOriginRecorded, WorkerReportPrepared, WorkerReportRefused, WorkerReportingIntent, WorkerStopRequested } from "./durable/Records.mjs";
+import { AbortRequested, AgentUpdateEmitted, BatchId, CanonicalBatch, CanonicalRecordEnvelope, CanonicalSequence, CompactionCreated, DefinitionDigests, Digest, ModelResponseInterrupted, PeerMessagePrepared, PersistedJson, ProducerEpoch, RecordEnvelope, RecordId, RepairAnnotated, RunDurationExhausted, RunPolicyUsageReserved, RunStartedRecord, SettlementFailureDiagnostic, SubagentJoined, SubagentLineageRecorded, SubagentRequested, SubagentStarted, SubmissionSettled, SubmissionSettledRecord, SubtreeBudgetReserved, ToolApprovalDecided, ToolApprovalRequested, ToolCallPrepared, ToolCallResolved, ToolCallSettled, ToolCallUnknown, ToolOperation, ToolStepSettled, ToolUnavailable, UserInputRecorded, WorkerAdmission, WorkerContinuation, WorkerInputCompleted, WorkerInputRequested, WorkerOrigin, WorkerReportPrepared, WorkerReportRefused, WorkerReportingIntent, WorkerStopRequested } from "./durable/Records.mjs";
 import { AbortCommand, AbortIntentRequest, AdmissionPolicyError, AdmissionRequest, ApprovalDecisionCommand, ApprovalPendingSuspension, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, ChildBudgetReservationRequest, ChildReservationId, ChildSettledNotification, ClaimHandoff, ClaimJoiningRequest, ClaimRequest, LedgerError, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, OwnershipToken, ParentLinkage, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReleaseOwnershipRequest, RenewOwnershipRequest, RevertJoiningRequest, Settlement, SettlementFinalization, SettlementReservation, SubmissionLedger, SubmissionLookupById, SubmissionLookupByKey, SubmissionScheduling, SuspendRequest, UnknownResolutionCommand, WaitingChild, WaitingForChildSuspension, WorkerLedgerState, submissionAbortBatchId, submissionAbortRecordId, submissionInputBatchId, submissionInputRecordId, submissionSettlementBatchId, submissionSettlementId, submissionSettlementRecordId } from "./durable/SubmissionLedger.mjs";
 import { DeclaredPendingBatchEvidence, OpenDelegationCallEvidence, OpenToolCallEvidence, PendingApprovalEvidence, RecoveryDecision, RecoveryEvidence, classifyRecovery } from "./durable/Recovery.mjs";
 import { ExplainedEvidence, ExplainedSubmission, ExplainedUnknownCall, IntegrityCheck, IntegrityReport, ObligationEntry, ObligationReport, RecoveryExplanation, RetryRefused, obligationSeverityOf, predictRecoveryDisposition, recoveryDecisionMeaning } from "./durable/Admin.mjs";
@@ -36,6 +36,7 @@ import { PreparedInput } from "./durable/Subscription.mjs";
 import { MessageDeliveryDriver, MessageDeliveryFailpoint, MessageDeliveryRecord, MessageDeliveryStore, messageDeliveryCapacity, messageDeliveryUsesCapacity, prepareMessageDelivery } from "./durable/MessageDelivery.mjs";
 import { WakeScheduler } from "./durable/WakeScheduler.mjs";
 import { n as safeUnknownString, t as inspectForeignDiagnostic } from "./foreign-diagnostic-DBQ1XHKh.mjs";
+import { c as threadCreatedBatchId, l as threadCreatedRecordId, n as WorkerAdmissionPort, o as ensureThreadCreated, r as WorkerAdmissionRequest, s as ensureWorkerOrigin } from "./WorkerAdmission-CJ_oWRuS.mjs";
 import { WorkerBudgetAuthorizer, WorkerConcurrencyLimit, WorkerConcurrencyResolver, WorkerHostAuthorizer, WorkerHostConfig, WorkerPolicyResolver } from "./durable/WorkerHost.mjs";
 import { OperationAuthorizationRequest, OperationAuthorizer, OperationDenied } from "./durable/OperationAuthorizer.mjs";
 import { PendingSubmission, SettledSubmission } from "./durable/SubmissionStatus.mjs";
@@ -767,7 +768,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 					recordId: Schema.decodeSync(RecordId)(id),
 					family: "thread",
 					schemaVersion: 1,
-					createdAt: DateTime.makeUnsafe(payload._tag === "WorkerInputRequested" ? payload.admission.createdAtMillis : payload._tag === "WorkerOriginRecorded" ? payload.origin.createdAtMillis : payload._tag === "WorkerInputCompleted" ? payload.completedAtMillis : yield* Clock.currentTimeMillis),
+					createdAt: DateTime.makeUnsafe(payload._tag === "WorkerInputRequested" ? payload.admission.createdAtMillis : payload._tag === "WorkerInputCompleted" ? payload.completedAtMillis : yield* Clock.currentTimeMillis),
 					deploymentId: deps.deploymentId,
 					payload
 				}), ...acknowledgements.map((completion) => RecordEnvelope.make({
@@ -784,20 +785,19 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 		return result;
 	}, Effect.mapError(storageFailure("start")));
 	const requests = (records) => records.flatMap(({ record }) => record.payload._tag === "WorkerInputRequested" ? [record.payload] : []);
+	const completedMessageIds = (records) => new Set(records.flatMap(({ record }) => record.payload._tag === "WorkerInputCompleted" && record.payload.effectsResolved ? [record.payload.messageId] : []));
 	const completedInputs = Effect.fn("WorkerHost.completedInputs")(function* (rows, sourceRecords) {
-		const completed = new Set(sourceRecords.flatMap(({ record }) => record.payload._tag === "WorkerInputCompleted" && record.payload.effectsResolved ? [record.payload.messageId] : []));
-		const acknowledgements = [];
-		for (const { admission } of rows) {
-			if (completed.has(admission.messageId)) continue;
+		const completed = completedMessageIds(sourceRecords);
+		const acknowledgements = (yield* Effect.forEach(rows.filter(({ admission }) => !completed.has(admission.messageId)), Effect.fnUntraced(function* ({ admission }) {
 			const receipt = Option.getOrUndefined(yield* getRecord({
 				threadId: admission.origin.worker.threadId,
 				recordId: Schema.decodeSync(RecordId)(`worker-effects-resolved:${admission.messageId}`)
 			}).pipe(Effect.provideService(ThreadStore, deps.store), Effect.catchTag("ThreadNotMaterialized", () => Effect.succeed(Option.none())), Effect.mapError(storageFailure("start"))))?.record.payload;
-			if (receipt === void 0) continue;
+			if (receipt === void 0) return;
 			if (receipt._tag !== "WorkerInputCompleted" || !receipt.effectsResolved || receipt.messageId !== admission.messageId || receipt.workerThreadId !== admission.origin.worker.threadId) return yield* failure("start", "corrupt");
-			completed.add(admission.messageId);
-			acknowledgements.push(receipt);
-		}
+			return receipt;
+		}), { concurrency: 8 })).filter((receipt) => receipt !== void 0);
+		for (const receipt of acknowledgements) completed.add(receipt.messageId);
 		return {
 			completed,
 			acknowledgements
@@ -946,10 +946,18 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 				const limit = Math.min(caps[cap] ?? Infinity, residual);
 				if (rows.reduce((sum, row) => sum + row.budget.allocation[amount], payload.budget.allocation[amount]) > limit) return yield* failure("start", "capacity");
 			}
-			const completedWorkers = yield* completedInputs(requests(source.current.records), source.current.records);
 			const completedAttached = new Set(source.current.records.flatMap(({ record }) => record.payload._tag === "SubagentJoined" ? [record.payload.reservationId] : []));
-			const active = new Set(rows.filter((row) => row.lifetime === "background" ? !completedWorkers.completed.has(row.reservationId) : !completedAttached.has(row.reservationId)).map((row) => row.childThreadId));
-			if (!active.has(payload.childThreadId) && active.size >= Math.min(caps.maxConcurrentChildren ?? Infinity, source.policy.toolConcurrency)) return yield* failure("start", "capacity");
+			const activeLimit = Math.min(caps.maxConcurrentChildren ?? Infinity, source.policy.toolConcurrency);
+			const hasSlot = (completed, conservative = false) => {
+				const active = new Set(rows.filter((row) => row.lifetime === "background" ? !completed.has(row.reservationId) : !completedAttached.has(row.reservationId)).map((row) => row.childThreadId));
+				return active.has(payload.childThreadId) ? !conservative || active.size <= activeLimit : active.size < activeLimit;
+			};
+			const localCompletions = completedMessageIds(source.current.records);
+			const completedWorkers = hasSlot(localCompletions, true) ? {
+				completed: localCompletions,
+				acknowledgements: []
+			} : yield* completedInputs(requests(source.current.records), source.current.records);
+			if (!hasSlot(completedWorkers.completed)) return yield* failure("start", "capacity");
 			if (yield* append(sourceThreadId, recordId, payload, source.current, "subtree", completedWorkers.acknowledgements)) return;
 		}
 		return yield* failure("start", "storage");
@@ -1015,10 +1023,6 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 				const limit = Math.min(caps[cap] ?? Infinity, ceilings[cap] ?? Infinity);
 				if (chargedRows.reduce((sum, row) => sum + row.admission.origin.budget.allocation[amount], origin.budget.allocation[amount]) > limit) return yield* failure("start", "capacity");
 			}
-			const completed = yield* completedInputs(rows, current.records);
-			const pendingRows = rows.filter((row) => !completed.completed.has(row.admission.messageId));
-			const activeWorkers = new Set(pendingRows.map((row) => row.admission.origin.worker.threadId));
-			const pendingOwn = pendingRows.filter((row) => row.admission.origin.worker.threadId === origin.worker.threadId && row.admission.reportKind === admission.reportKind).length;
 			const selectedConcurrency = yield* deps.concurrencyResolver.resolve({
 				source: origin.source,
 				worker: origin.worker,
@@ -1027,7 +1031,18 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 				...source.submission === void 0 ? {} : { sourceSubmission: source.submission }
 			});
 			const sourceConcurrency = Option.isSome(selectedConcurrency) ? (yield* decode(WorkerConcurrencyLimit, selectedConcurrency.value, "start")).maxActiveWorkersPerSource : Infinity;
-			if (pendingOwn >= (admission.reportKind === "update" ? deps.limits.maxPendingUpdateInputsPerWorker ?? 32 : deps.limits.maxPendingInputsPerWorker) || !activeWorkers.has(origin.worker.threadId) && activeWorkers.size >= Math.min(sourceConcurrency, deps.limits.maxActiveWorkersPerSource ?? source.policy.toolConcurrency, independent ? Infinity : Math.min(caps.maxConcurrentChildren ?? Infinity, source.policy.toolConcurrency))) return yield* WorkerError.make({
+			const activeLimit = Math.min(sourceConcurrency, deps.limits.maxActiveWorkersPerSource ?? source.policy.toolConcurrency, independent ? Infinity : Math.min(caps.maxConcurrentChildren ?? Infinity, source.policy.toolConcurrency));
+			const hasCapacity = (completed, conservative = false) => {
+				const pendingRows = rows.filter((row) => !completed.has(row.admission.messageId));
+				const activeWorkers = new Set(pendingRows.map((row) => row.admission.origin.worker.threadId));
+				return pendingRows.filter((row) => row.admission.origin.worker.threadId === origin.worker.threadId && row.admission.reportKind === admission.reportKind).length < (admission.reportKind === "update" ? deps.limits.maxPendingUpdateInputsPerWorker ?? 32 : deps.limits.maxPendingInputsPerWorker) && (activeWorkers.has(origin.worker.threadId) ? !conservative || activeWorkers.size <= activeLimit : activeWorkers.size < activeLimit);
+			};
+			const localCompletions = completedMessageIds(current.records);
+			const completed = hasCapacity(localCompletions, true) ? {
+				completed: localCompletions,
+				acknowledgements: []
+			} : yield* completedInputs(rows, current.records);
+			if (!hasCapacity(completed.completed)) return yield* WorkerError.make({
 				operation: "start",
 				reason: "capacity",
 				retryable: true
@@ -1049,20 +1064,10 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 		}
 		return yield* failure("start", "storage");
 	});
-	const ensureOrigin = Effect.fn("WorkerHost.ensureOrigin")(function* (origin) {
-		for (let attempt = 0; attempt < 16; attempt++) {
-			const current = yield* readIdentity(origin.worker.threadId, "start");
-			const existing = current.records.find(({ record }) => record.payload._tag === "WorkerOriginRecorded")?.record.payload;
-			if (existing?._tag === "WorkerOriginRecorded") {
-				if (!sameOrigin(existing.origin, origin)) return yield* failure("start", "worker-mismatch");
-				return;
-			}
-			const first = current.records[0]?.record.payload;
-			if (first?._tag !== "ThreadCreated" || first.agentId !== origin.worker.targetAgentId || !definitionDigestsEqual(first.definitions, origin.targetDigests) || current.records.some(({ record }) => record.payload._tag === "SubagentLineageRecorded")) return yield* failure("start", "worker-mismatch");
-			if (yield* append(origin.worker.threadId, workerOriginRecordId(origin.worker.threadId), WorkerOriginRecorded.make({ origin }), current, "origin")) return;
-		}
-		return yield* failure("start", "storage");
-	});
+	const ensureOrigin = (origin) => ensureWorkerOrigin({
+		producerId: deps.producerId,
+		deploymentId: deps.deploymentId
+	}, origin).pipe(Effect.provideService(ThreadStore, deps.store), Effect.provideService(DurableRuntimeFailpoint, deps.failpoint));
 	const validateAdmission = Effect.fn("WorkerHost.validateAdmission")(function* (unvalidated, options, agentId, inputDigest, input) {
 		const admission = yield* decode(WorkerAdmission, unvalidated, "start");
 		if (admission.reportKind === "update") {
@@ -2084,10 +2089,6 @@ const childUsageReportsOf = (state) => [...state.started.entries()].map(([toolCa
 		})
 	});
 });
-/** Deterministic batch identity of one Thread's initial `ThreadCreated` append. */
-const threadCreatedBatchId = (threadId) => decodeBatchId(`thread-created:${threadId}`);
-/** Deterministic record identity of one Thread's `ThreadCreated` record. */
-const threadCreatedRecordId = (threadId) => decodeRecordId(`thread-created:${threadId}`);
 /** Deterministic batch identity of one executed recovery decision's audit append (DUR-013). */
 const recoveryRepairBatchId = (submissionId, decisionTag) => decodeBatchId(`repair:${submissionId}:${decisionTag}`);
 /** Deterministic record identity of one executed recovery decision's `RepairAnnotated` record. */
@@ -2368,6 +2369,7 @@ const declaredToolCalls = Effect.fn("DurableAgentRuntime.declaredToolCalls")((me
 const declaredApplicationCalls = Effect.fn("DurableAgentRuntime.declaredApplicationCalls")((messages) => declaredToolCalls(messages).pipe(Effect.map(({ application }) => application)));
 const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 	const registeredBindings = [...bindings];
+	const workerAdmissionPort = yield* WorkerAdmissionPort;
 	const ledger = yield* SubmissionLedger;
 	const submissionScheduling = yield* SubmissionScheduling;
 	const store = yield* ThreadStore;
@@ -2910,35 +2912,10 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		threadId,
 		producerEpoch
 	})).pipe(Effect.catchTag("FenceRejected", () => Effect.void));
-	/**
-	* Coordinator invariant: every Thread's first canonical record is `ThreadCreated`,
-	* so `tailSequence >= 1` is the deterministic already-created check. A lost race (conflict or
-	* fence) is verified against that invariant instead of being trusted blindly. An admitted
-	* child can be claimed before it is runnable; that advances the shared storage fence without
-	* appending anything. Re-read and retry that initialization race with the current fence.
-	*/
-	const ensureThreadCreated = Effect.fn("DurableAgentRuntime.ensureThreadCreated")(function* (threadId, agentId, definitions) {
-		const tail = yield* store.inspectTail(ThreadTailRequest.make({ threadId }));
-		if (tail.tailSequence > 0) return;
-		const record = yield* makeEnvelope(threadCreatedRecordId(threadId), ThreadCreated.make({
-			agentId,
-			definitions
-		}));
-		yield* store.append(FencedAppendRequest.make({
-			threadId,
-			batch: CanonicalBatch.make({
-				batchId: threadCreatedBatchId(threadId),
-				producerId: config.producerId,
-				records: [record]
-			}),
-			expectedTailSequence: tail.tailSequence,
-			expectedTailDigest: tail.tailDigest,
-			producerEpoch: tail.producerEpoch
-		})).pipe(Effect.catchTag(["AppendConflict", "FenceRejected"], (error) => store.inspectTail(ThreadTailRequest.make({ threadId })).pipe(Effect.flatMap((current) => current.tailSequence > 0 ? Effect.void : Effect.fail(error)))), Effect.andThen(wake.notify(threadId)), Effect.asVoid);
-	}, (effect) => effect.pipe(Effect.retry({
-		times: 7,
-		while: (error) => error._tag === "AppendConflict" || error._tag === "FenceRejected"
-	})));
+	const ensureThreadCreated$1 = (threadId, agentId, definitions) => ensureThreadCreated({
+		producerId: config.producerId,
+		deploymentId: config.deploymentId
+	}, threadId, agentId, definitions).pipe(Effect.provideService(ThreadStore, store), Effect.provideService(WakeScheduler, wake));
 	const attemptContextFor = Effect.fn("DurableAgentRuntime.attemptContextFor")(function* (threadId, producerEpoch) {
 		const tail = yield* store.inspectTail(ThreadTailRequest.make({ threadId }));
 		return {
@@ -3652,7 +3629,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		}
 		yield* hit("subagent:after-admit");
 		yield* materializeAtLeast(request.childThreadId, ZERO_EPOCH);
-		yield* ensureThreadCreated(request.childThreadId, request.targetAgentId, request.targetDigests);
+		yield* ensureThreadCreated$1(request.childThreadId, request.targetAgentId, request.targetDigests);
 		const childRead = yield* readAllTolerant(request.childThreadId, []);
 		yield* ensureChildLineage(parent, request, childRead.records);
 		yield* ledger.markReady(MarkReadyRequest.make({ submissionId: childSubmissionId }));
@@ -5261,7 +5238,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			...Schema.is(FrameworkMessage)(submission.messageAdmission) ? { frameworkMessage: submission.messageAdmission } : {},
 			approval,
 			toolAuthorization,
-			...journal.toolSelection === void 0 ? {} : { toolSelection: journal.toolSelection },
+			...journal.toolSelection === void 0 ? {} : { toolSelection: { toolNames: journal.toolSelection.toolNames.filter((name) => Object.hasOwn(agent.definition.toolkit.tools, name)) } },
 			durability,
 			subagent,
 			delegationDepth,
@@ -5652,7 +5629,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		}));
 		const snapshot = yield* ledger.loadRecoverySnapshot(RecoverySnapshotRequest.make({ submissionId }));
 		const submission = snapshot.submission;
-		yield* ensureThreadCreated(threadId, submission.agentId, submission.agentDigests);
+		yield* ensureThreadCreated$1(threadId, submission.agentId, submission.agentDigests);
 		if (submission.workerAdmission?.origin.reporting?.mode === "standard") yield* updateRuntime.repair(threadId);
 		if (submission.workerAdmission !== void 0) yield* workerRuntime.ensureOrigin(submission.workerAdmission.origin).pipe(Effect.mapError((cause) => LedgerError.make({
 			operation: "worker-origin",
@@ -6094,7 +6071,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		if (Option.isNone(claimed)) {
 			if (submission.state === "ready" && snapshot.ownership === void 0) return yield* Effect.gen(function* () {
 				yield* materializeAtLeast(submission.threadId, ZERO_EPOCH);
-				yield* ensureThreadCreated(submission.threadId, submission.agentId, submission.agentDigests);
+				yield* ensureThreadCreated$1(submission.threadId, submission.agentId, submission.agentDigests);
 				const ctx = yield* attemptContextAtTail(submission.threadId);
 				const tokenRef = yield* Ref.make(QUEUED_ABORT_SETTLEMENT_TOKEN);
 				yield* settleAborted(ctx, submission, tokenRef, intent, evidence, knownRecordIdsOf(records));
@@ -6111,7 +6088,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			threadId: submission.threadId,
 			producerEpoch: claim.producerEpoch
 		}));
-		yield* ensureThreadCreated(submission.threadId, submission.agentId, submission.agentDigests);
+		yield* ensureThreadCreated$1(submission.threadId, submission.agentId, submission.agentDigests);
 		const ctx = yield* attemptContextFor(submission.threadId, claim.producerEpoch);
 		const tokenRef = yield* Ref.make(claim.ownershipToken);
 		yield* settleAborted(ctx, submission, tokenRef, intent, evidence, knownRecordIdsOf(records));
@@ -6308,7 +6285,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			case "CompleteMaterialization":
 			case "RepairReadiness":
 				yield* materializeAtLeast(submission.threadId, ZERO_EPOCH);
-				yield* ensureThreadCreated(submission.threadId, submission.agentId, submission.agentDigests);
+				yield* ensureThreadCreated$1(submission.threadId, submission.agentId, submission.agentDigests);
 				if (submission.workerAdmission !== void 0) yield* workerRuntime.ensureOrigin(submission.workerAdmission.origin).pipe(Effect.mapError((cause) => LedgerError.make({
 					operation: "worker-origin",
 					message: cause.reason,
@@ -6325,7 +6302,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 					threadId: submission.threadId,
 					producerEpoch: claim.producerEpoch
 				}));
-				yield* ensureThreadCreated(submission.threadId, submission.agentId, submission.agentDigests);
+				yield* ensureThreadCreated$1(submission.threadId, submission.agentId, submission.agentDigests);
 				const ctx = yield* attemptContextFor(submission.threadId, claim.producerEpoch);
 				const tokenRef = yield* Ref.make(claim.ownershipToken);
 				const currentRecords = yield* refreshRecoveryHistory(submission.threadId, records, history.throughSequence, history.submissionIds);
@@ -6603,7 +6580,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				code: "unregistered-replay-contract"
 			});
 		}
-		const admitted = yield* ledger.admit(yield* Schema.decodeEffect(AdmissionRequest)({
+		const request = yield* Schema.decodeEffect(AdmissionRequest)({
 			threadId: options.threadId,
 			principal: options.principal,
 			idempotencyKey: options.idempotencyKey,
@@ -6622,7 +6599,21 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		}).pipe(Effect.mapError(() => LedgerError.make({
 			operation: "submit",
 			message: "Admission fields do not satisfy the ledger contract"
-		}))));
+		})));
+		if (workerAdmission !== void 0) {
+			const admitted = yield* workerAdmissionPort.admit(WorkerAdmissionRequest.make({
+				...request,
+				workerAdmission,
+				producerId: config.producerId
+			})).pipe(Effect.provideService(SubmissionLedger, ledger), Effect.provideService(ThreadStore, store), Effect.provideService(WakeScheduler, wake), Effect.provideService(DurableRuntimeFailpoint, failpoint));
+			return Receipt.make({
+				receiptId: admitted.receiptId,
+				submissionId: admitted.submissionId,
+				threadId: request.threadId,
+				queueSequence: admitted.queueSequence
+			});
+		}
+		const admitted = yield* ledger.admit(request);
 		yield* hit("submit:after-admit");
 		const receipt = Receipt.make({
 			receiptId: admitted.receiptId,
@@ -6632,12 +6623,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		});
 		if (admitted.replayed && admitted.state !== "admitted") return receipt;
 		yield* materializeAtLeast(options.threadId, ZERO_EPOCH);
-		yield* ensureThreadCreated(options.threadId, agent.definition.id, options.definitions);
-		if (workerAdmission !== void 0) yield* workerRuntime.ensureOrigin(workerAdmission.origin).pipe(Effect.mapError((cause) => LedgerError.make({
-			operation: "worker-origin",
-			message: cause.reason,
-			cause
-		})));
+		yield* ensureThreadCreated$1(options.threadId, agent.definition.id, options.definitions);
 		yield* hit("submit:after-materialize");
 		yield* ledger.markReady(MarkReadyRequest.make({ submissionId: admitted.submissionId }));
 		yield* wake.notify(options.threadId);
@@ -7216,6 +7202,6 @@ var DurableAgentRuntime = class DurableAgentRuntime extends Context.Service()("@
 	static layer = DurableAgentRuntime.layerWithServices.pipe(Layer.provide([RunContextPreparationPassthrough, RunToolAuthorization.allowAll]));
 };
 //#endregion
-export { DurableApprovalSuspension as a, RecoveryFailure as c, childReservationIdFor as d, isolateRecovery as f, threadCreatedRecordId as g, threadCreatedBatchId as h, DurableApprovalResolver as i, RecoveryReport as l, recoveryRepairRecordId as m, DurableAgentRuntime as n, DurableRuntimeConfig as o, recoveryRepairBatchId as p, DurableAgentRuntime_exports as r, RecoveryBlocked as s, ApprovalSuspensionError as t, RecoverySweepResult as u };
+export { DurableApprovalSuspension as a, RecoveryFailure as c, childReservationIdFor as d, isolateRecovery as f, DurableApprovalResolver as i, RecoveryReport as l, recoveryRepairRecordId as m, DurableAgentRuntime as n, DurableRuntimeConfig as o, recoveryRepairBatchId as p, DurableAgentRuntime_exports as r, RecoveryBlocked as s, ApprovalSuspensionError as t, RecoverySweepResult as u };
 
-//# sourceMappingURL=DurableAgentRuntime-DLa4IwFi.mjs.map
+//# sourceMappingURL=DurableAgentRuntime-DQFV26SB.mjs.map