effect-agent 0.1.0-beta.85 → 0.1.0-beta.87

package/dist/durable/Admin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Admin.mjs","names":[],"sources":["../../src/durable/Admin.ts"],"sourcesContent":["import { DateTime, Schema } from \"effect\";\n\nimport { ThreadId, SubmissionId, ToolCallId } from \"../core/Identifiers.ts\";\nimport { CanonicalSequence, SettlementOutcome, ToolCallUnknown } from \"./Records.ts\";\nimport {\n  OpenDelegationCallEvidence,\n  OpenToolCallEvidence,\n  PendingApprovalEvidence,\n  RecoveryDecision,\n} from \"./Recovery.ts\";\nimport {\n  AbortIntent,\n  AbortCommand,\n  ApprovalDecisionIntent,\n  ChildAttachmentSnapshot,\n  JoinSnapshot,\n  ParentLinkage,\n  QueueSequence,\n  SubmissionState,\n  SuspensionSnapshot,\n  UnknownResolutionIntent,\n  type RecoverySnapshot,\n} from \"./SubmissionLedger.ts\";\n\n/**\n * Pure report logic for the P7 administrative operations (plan §3): the Schema classes carried\n * by `DurableAgentRuntime.explain`/`verify`/`scanObligations`, the operator meaning table for\n * every recovery decision tag, and the text renderer. Everything here is pure — no port access,\n * no clocks, no writes — so hosts, CLIs, and wire envelopes share one report vocabulary.\n */\n\nconst BoundedDetail = Schema.String.check(Schema.isMaxLength(4_096));\n\n/** Non-negative whole seconds derived from the Effect Clock. */\nconst AgeSeconds = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));\n\n// ---------------------------------------------------------------------------\n// explain — RecoveryExplanation\n// ---------------------------------------------------------------------------\n\n/**\n * The disposition family of `RecoveryReport`, reused verbatim so an explanation predicts exactly\n * what `runRecovery`/`retry` would report for the same decision.\n */\nexport const RecoveryDisposition = Schema.Literals([\"repaired\", \"deferred\", \"none\", \"unknown\"]);\nexport type RecoveryDisposition = typeof RecoveryDisposition.Type;\n\n/** Submission identity, lane position, and Clock-derived ages (DUR-017 obligation visibility). */\nexport class ExplainedSubmission extends Schema.Class<ExplainedSubmission>(\n  \"@effect-agent/thread/ExplainedSubmission\",\n)({\n  submissionId: SubmissionId,\n  threadId: ThreadId,\n  state: SubmissionState,\n  queueSequence: QueueSequence,\n  createdAt: Schema.DateTimeUtcFromString,\n  readyAt: Schema.optionalKey(Schema.DateTimeUtcFromString),\n  /** Whole seconds since admission (`createdAt`). */\n  ageSeconds: AgeSeconds,\n  /** Whole seconds since readiness, present exactly when `readyAt` is recorded. */\n  readyAgeSeconds: Schema.optionalKey(AgeSeconds),\n  parentLinkage: Schema.optionalKey(ParentLinkage),\n}) {}\n\n/** One durable Unknown Outcome and whether a covering resolution intent exists (DUR-017). */\nexport class ExplainedUnknownCall extends Schema.Class<ExplainedUnknownCall>(\n  \"@effect-agent/thread/ExplainedUnknownCall\",\n)({\n  toolCallId: ToolCallId,\n  toolName: ToolCallUnknown.fields.toolName,\n  reason: ToolCallUnknown.fields.reason,\n  recordedAt: Schema.DateTimeUtcFromString,\n  /** A durable `resolveUnknown` intent covers this call. */\n  resolved: Schema.Boolean,\n}) {}\n\n/**\n * The evidence summary of one explanation: the classifier's canonical-history inputs plus the\n * durable intents and subagent attachments the ledger snapshot carries. Everything is read-only\n * observation — assembling this value performs zero writes.\n */\nexport class ExplainedEvidence extends Schema.Class<ExplainedEvidence>(\n  \"@effect-agent/thread/ExplainedEvidence\",\n)({\n  threadMaterialized: Schema.Boolean,\n  inputRecorded: Schema.Boolean,\n  abortRecorded: Schema.Boolean,\n  recordedSettlementOutcome: Schema.optionalKey(SettlementOutcome),\n  /** Prepared ordinary Tool Calls without a canonical outcome (DUR-009). */\n  openToolCalls: Schema.Array(OpenToolCallEvidence),\n  /** Delegation Tool Calls with an open parent-side obligation. */\n  openDelegationCalls: Schema.Array(OpenDelegationCallEvidence),\n  /** Canonically requested approvals without a canonical decision. */\n  approvalsPending: Schema.Array(PendingApprovalEvidence),\n  /** Durable Unknown Outcomes with their resolution coverage (DUR-017). */\n  unknownCalls: Schema.Array(ExplainedUnknownCall),\n  /** Durable approval decisions recorded against this Submission. */\n  approvalDecisions: Schema.Array(ApprovalDecisionIntent),\n  /** Durable unknown-outcome resolutions recorded against this Submission. */\n  unknownResolutions: Schema.Array(UnknownResolutionIntent),\n  /** Parent-side child attachments. */\n  childAttachments: Schema.Array(ChildAttachmentSnapshot),\n  /** Host-side joined/joining members of this Submission's Run (DUR-016). */\n  joins: Schema.Array(JoinSnapshot),\n  /** Joined-side host identity, when this Submission is joined to a host Run. */\n  hostSubmissionId: Schema.optionalKey(SubmissionId),\n  suspension: Schema.optionalKey(SuspensionSnapshot),\n  abortIntent: Schema.optionalKey(AbortIntent),\n}) {}\n\n/**\n * The read-only recovery explanation of one Submission (P7 exit gate \"operators can explain\n * recovery state without editing storage\"): the submission summary, the evidence the pure\n * classifier consumed, the exact `RecoveryDecision` it selected, that decision's operator\n * meaning, and the disposition the recovery pass would report for it.\n */\nexport class RecoveryExplanation extends Schema.Class<RecoveryExplanation>(\n  \"@effect-agent/thread/RecoveryExplanation\",\n)({\n  submission: ExplainedSubmission,\n  evidence: ExplainedEvidence,\n  decision: RecoveryDecision,\n  /** Static operator meaning of `decision._tag` (see `RECOVERY_DECISION_MEANINGS`). */\n  decisionMeaning: BoundedDetail,\n  /**\n   * The disposition `runRecovery` would report when this decision executes without claim\n   * contention (see `predictRecoveryDisposition`): `repaired` = the recovery pass itself fixes\n   * it; `deferred` = a claiming worker must finish it; `unknown` = durably blocked on the\n   * authorized DUR-017 resolution path; `none` = settled, nothing owed.\n   */\n  disposition: RecoveryDisposition,\n  explainedAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/**\n * Operator meaning of every recovery decision tag, matching the classifier docstrings in\n * `recovery.ts` (the classifier remains the semantic authority; this table is its operator\n * rendering). Exhaustive over `RecoveryDecision` — adding a decision without a meaning is a\n * compile error here.\n */\nexport const RECOVERY_DECISION_MEANINGS: Readonly<Record<RecoveryDecision[\"_tag\"], string>> = {\n  CompleteMaterialization:\n    \"Ledger admission committed but the Thread is not durable: recovery finishes materialization, appends ThreadCreated, and marks readiness.\",\n  RepairReadiness:\n    \"The Thread is durable but the readiness marker is missing: recovery replays the idempotent markReady.\",\n  ApplyInput:\n    \"No canonical input record exists yet: recovery appends the deterministic UserInputRecorded record and marks it applied.\",\n  RepairInputMarker:\n    \"The canonical input record exists but the ledger marker was lost: recovery repairs the marker from history, never the reverse (DUR-015).\",\n  ResumeFromTurnBoundary:\n    \"Input is applied and no terminal work is reserved: a claiming worker resumes the Run from the last committed Turn boundary; the model may be re-invoked and any duplicate cost is observable (durability §9).\",\n  AppendReservedSettlement:\n    \"A settlement is reserved but not canonical: recovery appends the EXACT reserved record, then finalizes (DUR-011).\",\n  FinalizeLedgerFromHistory:\n    \"The canonical settlement record exists: recovery rebuilds/finalizes the ledger from history and never rewrites history from the cached ledger status (DUR-011, DUR-015).\",\n  SettleAborted:\n    \"A durable abort intent exists with no reserved outcome and no open attached-child obligation: recovery settles aborted, first recording ToolCallUnknown audits for open ordinary calls — abort never asserts external rollback (durability §13).\",\n  MarkUnknown:\n    \"Prepared ordinary Tool Calls have no canonical outcome: recovery reconciles each open call and marks the remainder Unknown — never an automatic replay (DUR-009/DUR-017).\",\n  ResumePendingToolBatch:\n    \"A committed tool-declaring response has zero prepared and zero settled records: a claiming worker resumes the declared batch without model re-invocation and without Unknown (durability §15).\",\n  AwaitApprovalDecision:\n    \"Canonically requested approvals lack decisions: the lane waits durably for the authorized resolveApproval path (recovery repairs a lost suspend transition from history).\",\n  ResumeSuspended:\n    \"Every pending approval has a durable decision: a claiming worker resumes the declared batch, appending the canonical ToolApprovalDecided records first.\",\n  AwaitUnknownResolution:\n    \"Unknown Outcomes lack covering resolutions: the lane stays blocked awaiting the authorized DUR-017 resolveUnknown path; the obligation stays visible, nothing replays.\",\n  ApplyUnknownResolutions:\n    \"Durable resolution intents cover every open call: recovery applies them canonically and reopens the lane.\",\n  RevertJoining:\n    \"The Submission is joining without a canonical input record: recovery reverts it to ready — the input was never consumed and will be delivered exactly once later (DUR-016).\",\n  RepairJoinMarker:\n    \"The canonical joined input exists but the joined marker was lost: recovery repairs the marker only; the input reattaches, never duplicates (DUR-015/DUR-016).\",\n  SettleJoinedWithHost:\n    \"The host Run settled canonically: recovery settles this joined Submission with the host outcome — each joined Submission is owed its own settlement (DUR-002).\",\n  AwaitHostSettlement:\n    \"The Submission is joined and its host Run is still live: nothing to repair — the input reattaches through the host's resume and the Submission settles with the host.\",\n  CompleteChildAdmission:\n    \"A canonical SubagentRequested exists and the authoritative lookup proved not-admitted: recovery idempotently admits the intended child from the canonical request payload alone.\",\n  AwaitChildAdmissionResolution:\n    \"The authoritative child-admission lookup answered indeterminate (or was not performed): recovery waits and retries the authoritative owner; a second admission never occurs (SUB-031).\",\n  RepairSubagentStartLink:\n    \"The child is admitted but the parent's SubagentStarted link (or reservation attachment) is missing: recovery resolves the SAME child by its deterministic key and appends the exact link (SUB-016/SUB-017).\",\n  EnsureWaitingForChild:\n    \"Children are established and at least one is nonterminal while the parent lane is not durably suspended: recovery restores the waitingForChild suspension; it reattaches the one existing child and never spawns a replacement (SUB-018/SUB-030).\",\n  AwaitChildSettlement:\n    \"The parent is durably suspended waitingForChild and a listed child is not yet provably settled: the lane stays dormant, consumes no worker permit, and the child's Settlement wakes it durably (SUB-021/SUB-030).\",\n  ResumeWaitingParent:\n    \"Every relevant child is provably settled but the parent has not joined: recovery replays the idempotent wake so a claiming worker resumes the declared batch and joins each child's canonical Settlement.\",\n  ApplyJoinAccounting:\n    \"The canonical SubagentJoined record exists but the reservation release is incomplete: recovery replays the accounting decision FROM the canonical record — budget stays unavailable until repair, never available twice (DUR-015).\",\n  PropagateChildAbort:\n    \"Parent abort is canonical while attached children are nonterminal: recovery idempotently issues each child's durable abort command and keeps the parent waiting for the joins — request-abort-and-join is the only close behavior.\",\n  ReleaseOrphanChildReservation:\n    \"A child budget reservation can no longer bind a child: recovery freezes the deterministic zero-consumed accounting decision and releases the unused allocation exactly once.\",\n  AwaitParentEstablishment:\n    \"The Submission is a parent-linked child whose Thread lacks the canonical lineage record: the child lane defers its own readiness repair — the parent's idempotent establishment completes it, so a child never runs a Turn before its lineage is canonical (P7 §7(a), SUB-016).\",\n  NoAction: \"The Submission is settled; nothing is owed.\",\n};\n\n/** The operator meaning of one recovery decision tag. */\nexport const recoveryDecisionMeaning = (tag: RecoveryDecision[\"_tag\"]): string =>\n  RECOVERY_DECISION_MEANINGS[tag];\n\n/**\n * The disposition the recovery executor reports for a decision when its repair executes without\n * claim contention (pure prediction; `executeRecoveryDecision` in the coordinator remains the\n * execution authority — a lane concurrently claimed by a worker can always defer instead).\n * `AwaitApprovalDecision` depends on the snapshot: an already-suspended lane waits (`deferred`),\n * while a claimable lane with a lost suspend transition is repaired.\n */\nexport const predictRecoveryDisposition = (\n  decision: RecoveryDecision,\n  snapshot: RecoverySnapshot,\n): RecoveryDisposition => {\n  switch (decision._tag) {\n    case \"NoAction\":\n      return \"none\";\n    case \"AwaitUnknownResolution\":\n    case \"MarkUnknown\":\n      return \"unknown\";\n    case \"ResumeFromTurnBoundary\":\n    case \"ResumePendingToolBatch\":\n    case \"ResumeSuspended\":\n    case \"AwaitHostSettlement\":\n    case \"AwaitChildAdmissionResolution\":\n    case \"AwaitChildSettlement\":\n    case \"AwaitParentEstablishment\":\n      return \"deferred\";\n    case \"AwaitApprovalDecision\":\n      return snapshot.submission.state === \"suspended\" ? \"deferred\" : \"repaired\";\n    default:\n      return \"repaired\";\n  }\n};\n\nconst formatUtc = (value: DateTime.Utc): string => DateTime.formatIso(value);\n\n/** Pure operator text for one explanation (the CLI's `explain` output body). */\nexport const renderRecoveryExplanation = (explanation: RecoveryExplanation): string => {\n  const submission = explanation.submission;\n  const evidence = explanation.evidence;\n\n  const lines: Array<string> = [\n    `Submission ${submission.submissionId} (thread ${submission.threadId})`,\n    `  state: ${submission.state}  queue: ${submission.queueSequence}  age: ${submission.ageSeconds}s`,\n    `  admitted: ${formatUtc(submission.createdAt)}${\n      submission.readyAt === undefined ? \"\" : `  ready: ${formatUtc(submission.readyAt)}`\n    }`,\n  ];\n\n  if (submission.parentLinkage !== undefined) {\n    lines.push(\n      `  attached child of ${submission.parentLinkage.parentSubmissionId} (tool call ${submission.parentLinkage.parentToolCallId})`,\n    );\n  }\n  lines.push(\n    `  evidence: input=${evidence.inputRecorded ? \"recorded\" : \"missing\"}` +\n      ` settlement=${evidence.recordedSettlementOutcome ?? \"none\"}` +\n      ` abort=${evidence.abortRecorded ? \"recorded\" : \"none\"}` +\n      ` materialized=${evidence.threadMaterialized ? \"yes\" : \"no\"}`,\n  );\n  if (evidence.openToolCalls.length > 0) {\n    lines.push(\n      `  open ordinary tool calls: ${evidence.openToolCalls\n        .map((call) => `${call.toolName}#${call.toolCallId}`)\n        .join(\", \")}`,\n    );\n  }\n  if (evidence.openDelegationCalls.length > 0) {\n    lines.push(\n      `  open delegation calls: ${evidence.openDelegationCalls\n        .map(\n          (call) =>\n            `${call.toolName}#${call.toolCallId}(requested=${call.requested} started=${call.started} joined=${call.joined})`,\n        )\n        .join(\", \")}`,\n    );\n  }\n  if (evidence.approvalsPending.length > 0) {\n    lines.push(\n      `  approvals pending: ${evidence.approvalsPending\n        .map((pending) => pending.toolCallId)\n        .join(\", \")}`,\n    );\n  }\n  for (const unknown of evidence.unknownCalls) {\n    lines.push(\n      `  unknown outcome: ${unknown.toolName}#${unknown.toolCallId} recorded ${formatUtc(unknown.recordedAt)} ${\n        unknown.resolved ? \"(resolution intent recorded)\" : \"(awaiting resolveUnknown)\"\n      }`,\n    );\n  }\n  if (evidence.childAttachments.length > 0) {\n    lines.push(\n      `  attached children: ${evidence.childAttachments\n        .map((child) => `${child.childSubmissionId}(${child.childState})`)\n        .join(\", \")}`,\n    );\n  }\n  if (evidence.joins.length > 0) {\n    lines.push(\n      `  joined members: ${evidence.joins\n        .map((join) => `${join.submissionId}(${join.state})`)\n        .join(\", \")}`,\n    );\n  }\n  if (evidence.hostSubmissionId !== undefined) {\n    lines.push(`  joined to host: ${evidence.hostSubmissionId}`);\n  }\n  if (evidence.suspension !== undefined) {\n    lines.push(\n      `  suspended (${evidence.suspension.reason._tag}) since ${formatUtc(evidence.suspension.suspendedAt)}`,\n    );\n  }\n  if (evidence.abortIntent !== undefined) {\n    lines.push(\n      `  abort intent by ${evidence.abortIntent.author} at ${formatUtc(evidence.abortIntent.requestedAt)}`,\n    );\n  }\n  lines.push(\n    `  decision: ${explanation.decision._tag} → disposition ${explanation.disposition}`,\n    `  meaning: ${explanation.decisionMeaning}`,\n  );\n\n  return lines.join(\"\\n\");\n};\n\n// ---------------------------------------------------------------------------\n// verify — IntegrityReport\n// ---------------------------------------------------------------------------\n\n/** The named integrity checks `verifyThreadInvariants` performs. */\nexport const IntegrityCheckName = Schema.Literals([\n  /** Every exported envelope round-trips its canonical Schema. */\n  \"schema-round-trip\",\n  /** No canonical record identity appears twice (DUR-007). */\n  \"record-identity\",\n  /** Canonical sequences are gap-free from 1 through the exported tail. */\n  \"sequence-contiguity\",\n  /** The tail digest chain recomputes from EMPTY_TAIL_DIGEST over every batch (DUR-006/DUR-007). */\n  \"digest-chain\",\n  /** Canonical `input:{sid}` records follow the admitted FIFO order (DUR-004). */\n  \"fifo-input-order\",\n  /** Canonical settlement records follow the admitted FIFO order (DUR-004); aborted\n   * settlements of never-run work are exempt by design (P7 §7(c)). */\n  \"fifo-settlement-order\",\n  /** At most one canonical terminal record per Submission; exactly one per settled row (DUR-002). */\n  \"terminal-uniqueness\",\n  /** Ledger terminal state agrees with the canonical settlement record (DUR-015). */\n  \"ledger-canonical-agreement\",\n  /** The stored checkpoint binds to the recomputed digest chain at its sequence. */\n  \"checkpoint-binding\",\n  /** Convergence mode only: every known Submission is settled. */\n  \"all-settled\",\n]);\n\nexport type IntegrityCheckName = typeof IntegrityCheckName.Type;\n\nexport const IntegrityCheckStatus = Schema.Literals([\"passed\", \"failed\", \"skipped\"]);\nexport type IntegrityCheckStatus = typeof IntegrityCheckStatus.Type;\n\n/** One typed check result; `detail` explains a failure or the honest reason for a skip. */\nexport class IntegrityCheck extends Schema.Class<IntegrityCheck>(\n  \"@effect-agent/thread/IntegrityCheck\",\n)({\n  name: IntegrityCheckName,\n  status: IntegrityCheckStatus,\n  detail: Schema.optionalKey(BoundedDetail),\n}) {}\n\n/**\n * The read-only integrity verdict for one Thread (plan §3 `verify`): typed per-check\n * results, never a repair. `ok` is true exactly when no check failed — skipped checks are\n * honest scope statements, not silent passes.\n */\nexport class IntegrityReport extends Schema.Class<IntegrityReport>(\n  \"@effect-agent/thread/IntegrityReport\",\n)({\n  threadId: ThreadId,\n  tailSequence: CanonicalSequence,\n  recordCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  submissionCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  checks: Schema.Array(IntegrityCheck),\n  ok: Schema.Boolean,\n}) {}\n\n// ---------------------------------------------------------------------------\n// scanObligations — ObligationReport\n// ---------------------------------------------------------------------------\n\n/**\n * What one nonterminal Submission is visibly blocked on (DUR-017 operator surface; OPS-001).\n * `ready-aged`/`running-aged` are not blocks — they are accepted work whose settlement age is\n * measurable and alertable.\n */\nexport const ObligationBlockedOn = Schema.Literals([\n  \"unknown\",\n  \"approval\",\n  \"waitingForChild\",\n  \"ready-aged\",\n  \"running-aged\",\n]);\n\nexport type ObligationBlockedOn = typeof ObligationBlockedOn.Type;\n\nexport const ObligationSeverity = Schema.Literals([\"ok\", \"aging\", \"overdue\"]);\nexport type ObligationSeverity = typeof ObligationSeverity.Type;\n\n/** Host-supplied age thresholds; the framework deliberately does not own the alert loop. */\nexport class ObligationThresholds extends Schema.Class<ObligationThresholds>(\n  \"@effect-agent/thread/ObligationThresholds\",\n)({\n  /** Age (whole seconds) at which an obligation is reported `aging`. */\n  agingSeconds: AgeSeconds,\n  /** Age (whole seconds) at which an obligation is reported `overdue`. */\n  overdueSeconds: AgeSeconds,\n}) {}\n\n/** One nonterminal accepted-work obligation with its age and severity. */\nexport class ObligationEntry extends Schema.Class<ObligationEntry>(\n  \"@effect-agent/thread/ObligationEntry\",\n)({\n  submissionId: SubmissionId,\n  threadId: ThreadId,\n  state: SubmissionState,\n  blockedOn: ObligationBlockedOn,\n  ageSeconds: AgeSeconds,\n  severity: ObligationSeverity,\n}) {}\n\n/**\n * The scan-based DUR-017/OPS-001 operator surface (plan §3): a fold of the ledger's nonterminal\n * scan into aged, severity-classified rows. Scan-based, never a daemon — hosts run it\n * periodically and export logs/metrics; ages need no storage-version bump because every source\n * timestamp already exists (`createdAt`/`readyAt`, `suspendedAt`, the canonical\n * `ToolCallUnknown` record's `createdAt`).\n */\nexport class ObligationReport extends Schema.Class<ObligationReport>(\n  \"@effect-agent/thread/ObligationReport\",\n)({\n  thresholds: ObligationThresholds,\n  entries: Schema.Array(ObligationEntry),\n  generatedAt: Schema.DateTimeUtcFromString,\n}) {}\n\n/** Severity of one obligation age under the supplied thresholds. */\nexport const obligationSeverityOf = (\n  ageSeconds: number,\n  thresholds: ObligationThresholds,\n): ObligationSeverity =>\n  ageSeconds >= thresholds.overdueSeconds\n    ? \"overdue\"\n    : ageSeconds >= thresholds.agingSeconds\n      ? \"aging\"\n      : \"ok\";\n\n// ---------------------------------------------------------------------------\n// retry — typed command and refusals\n// ---------------------------------------------------------------------------\n\n/**\n * The mandatory-audit retry command (SEC-011): `author`/`reason` carry the same bounds as the\n * canonical abort command so every mutating administrative operation stays attributable. The\n * executed repair itself appends the deterministic `RepairAnnotated` audit record (DUR-013) —\n * retry adds no new canonical record type.\n */\nexport class RetryCommand extends Schema.Class<RetryCommand>(\"@effect-agent/thread/RetryCommand\")({\n  submissionId: SubmissionId,\n  author: AbortCommand.fields.author,\n  reason: AbortCommand.fields.reason,\n}) {}\n\n/** Why a retry was refused without executing anything. */\nexport const RetryRefusalReason = Schema.Literals([\n  /** The Submission is settled; terminal outcomes are never revisited (DUR-002). */\n  \"settled\",\n  /** The lane is durably blocked on Unknown Outcomes; use `resolveUnknown` (DUR-017). */\n  \"await-unknown-resolution\",\n  /** The lane is durably waiting for approval decisions; use `resolveApproval`. */\n  \"await-approval-decision\",\n]);\n\nexport type RetryRefusalReason = typeof RetryRefusalReason.Type;\n\n/**\n * Typed refusal of `retry` (plan §3): lanes blocked on `AwaitUnknownResolution` or\n * `AwaitApprovalDecision` have their own authorized operations, and settled work is never\n * re-driven. The refusal names the classifier decision so the operator sees WHY.\n */\nexport class RetryRefused extends Schema.TaggedError<RetryRefused>()(\"RetryRefused\", {\n  submissionId: SubmissionId,\n  refusal: RetryRefusalReason,\n  decisionTag: Schema.String.check(Schema.isMaxLength(256)),\n  message: Schema.String.check(Schema.isMaxLength(4_096)),\n}) {}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,gBAAgB,OAAO,OAAO,MAAM,OAAO,YAAY,IAAK,CAAC;;AAGnE,MAAM,aAAa,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;;;;;AAUpE,MAAa,sBAAsB,OAAO,SAAS;CAAC;CAAY;CAAY;CAAQ;AAAS,CAAC;;AAI9F,IAAa,sBAAb,cAAyC,OAAO,MAC9C,0CACF,CAAC,CAAC;CACA,cAAc;CACd,UAAU;CACV,OAAO;CACP,eAAe;CACf,WAAW,OAAO;CAClB,SAAS,OAAO,YAAY,OAAO,qBAAqB;;CAExD,YAAY;;CAEZ,iBAAiB,OAAO,YAAY,UAAU;CAC9C,eAAe,OAAO,YAAY,aAAa;AACjD,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,uBAAb,cAA0C,OAAO,MAC/C,2CACF,CAAC,CAAC;CACA,YAAY;CACZ,UAAU,gBAAgB,OAAO;CACjC,QAAQ,gBAAgB,OAAO;CAC/B,YAAY,OAAO;;CAEnB,UAAU,OAAO;AACnB,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,oBAAb,cAAuC,OAAO,MAC5C,wCACF,CAAC,CAAC;CACA,oBAAoB,OAAO;CAC3B,eAAe,OAAO;CACtB,eAAe,OAAO;CACtB,2BAA2B,OAAO,YAAY,iBAAiB;;CAE/D,eAAe,OAAO,MAAM,oBAAoB;;CAEhD,qBAAqB,OAAO,MAAM,0BAA0B;;CAE5D,kBAAkB,OAAO,MAAM,uBAAuB;;CAEtD,cAAc,OAAO,MAAM,oBAAoB;;CAE/C,mBAAmB,OAAO,MAAM,sBAAsB;;CAEtD,oBAAoB,OAAO,MAAM,uBAAuB;;CAExD,kBAAkB,OAAO,MAAM,uBAAuB;;CAEtD,OAAO,OAAO,MAAM,YAAY;;CAEhC,kBAAkB,OAAO,YAAY,YAAY;CACjD,YAAY,OAAO,YAAY,kBAAkB;CACjD,aAAa,OAAO,YAAY,WAAW;AAC7C,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,sBAAb,cAAyC,OAAO,MAC9C,0CACF,CAAC,CAAC;CACA,YAAY;CACZ,UAAU;CACV,UAAU;;CAEV,iBAAiB;;;;;;;CAOjB,aAAa;CACb,aAAa,OAAO;AACtB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,MAAa,6BAAiF;CAC5F,yBACE;CACF,iBACE;CACF,YACE;CACF,mBACE;CACF,wBACE;CACF,0BACE;CACF,2BACE;CACF,eACE;CACF,aACE;CACF,wBACE;CACF,uBACE;CACF,iBACE;CACF,wBACE;CACF,yBACE;CACF,eACE;CACF,kBACE;CACF,sBACE;CACF,qBACE;CACF,wBACE;CACF,+BACE;CACF,yBACE;CACF,uBACE;CACF,sBACE;CACF,qBACE;CACF,qBACE;CACF,qBACE;CACF,+BACE;CACF,0BACE;CACF,UAAU;AACZ;;AAGA,MAAa,2BAA2B,QACtC,2BAA2B;;;;;;;;AAS7B,MAAa,8BACX,UACA,aACwB;CACxB,QAAQ,SAAS,MAAjB;EACE,KAAK,YACH,OAAO;EACT,KAAK;EACL,KAAK,eACH,OAAO;EACT,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,4BACH,OAAO;EACT,KAAK,yBACH,OAAO,SAAS,WAAW,UAAU,cAAc,aAAa;EAClE,SACE,OAAO;CACX;AACF;AAEA,MAAM,aAAa,UAAgC,SAAS,UAAU,KAAK;;AAG3E,MAAa,6BAA6B,gBAA6C;CACrF,MAAM,aAAa,YAAY;CAC/B,MAAM,WAAW,YAAY;CAE7B,MAAM,QAAuB;EAC3B,cAAc,WAAW,aAAa,WAAW,WAAW,SAAS;EACrE,YAAY,WAAW,MAAM,WAAW,WAAW,cAAc,SAAS,WAAW,WAAW;EAChG,eAAe,UAAU,WAAW,SAAS,IAC3C,WAAW,YAAY,KAAA,IAAY,KAAK,YAAY,UAAU,WAAW,OAAO;CAEpF;CAEA,IAAI,WAAW,kBAAkB,KAAA,GAC/B,MAAM,KACJ,uBAAuB,WAAW,cAAc,mBAAmB,cAAc,WAAW,cAAc,iBAAiB,EAC7H;CAEF,MAAM,KACJ,qBAAqB,SAAS,gBAAgB,aAAa,UAAA,cAC1C,SAAS,6BAA6B,OAAA,SAC3C,SAAS,gBAAgB,aAAa,OAAA,gBAC/B,SAAS,qBAAqB,QAAQ,MAC3D;CACA,IAAI,SAAS,cAAc,SAAS,GAClC,MAAM,KACJ,+BAA+B,SAAS,cACrC,KAAK,SAAS,GAAG,KAAK,SAAS,GAAG,KAAK,YAAY,CAAC,CACpD,KAAK,IAAI,GACd;CAEF,IAAI,SAAS,oBAAoB,SAAS,GACxC,MAAM,KACJ,4BAA4B,SAAS,oBAClC,KACE,SACC,GAAG,KAAK,SAAS,GAAG,KAAK,WAAW,aAAa,KAAK,UAAU,WAAW,KAAK,QAAQ,UAAU,KAAK,OAAO,EAClH,CAAC,CACA,KAAK,IAAI,GACd;CAEF,IAAI,SAAS,iBAAiB,SAAS,GACrC,MAAM,KACJ,wBAAwB,SAAS,iBAC9B,KAAK,YAAY,QAAQ,UAAU,CAAC,CACpC,KAAK,IAAI,GACd;CAEF,KAAK,MAAM,WAAW,SAAS,cAC7B,MAAM,KACJ,sBAAsB,QAAQ,SAAS,GAAG,QAAQ,WAAW,YAAY,UAAU,QAAQ,UAAU,EAAE,GACrG,QAAQ,WAAW,iCAAiC,6BAExD;CAEF,IAAI,SAAS,iBAAiB,SAAS,GACrC,MAAM,KACJ,wBAAwB,SAAS,iBAC9B,KAAK,UAAU,GAAG,MAAM,kBAAkB,GAAG,MAAM,WAAW,EAAE,CAAC,CACjE,KAAK,IAAI,GACd;CAEF,IAAI,SAAS,MAAM,SAAS,GAC1B,MAAM,KACJ,qBAAqB,SAAS,MAC3B,KAAK,SAAS,GAAG,KAAK,aAAa,GAAG,KAAK,MAAM,EAAE,CAAC,CACpD,KAAK,IAAI,GACd;CAEF,IAAI,SAAS,qBAAqB,KAAA,GAChC,MAAM,KAAK,qBAAqB,SAAS,kBAAkB;CAE7D,IAAI,SAAS,eAAe,KAAA,GAC1B,MAAM,KACJ,gBAAgB,SAAS,WAAW,OAAO,KAAK,UAAU,UAAU,SAAS,WAAW,WAAW,GACrG;CAEF,IAAI,SAAS,gBAAgB,KAAA,GAC3B,MAAM,KACJ,qBAAqB,SAAS,YAAY,OAAO,MAAM,UAAU,SAAS,YAAY,WAAW,GACnG;CAEF,MAAM,KACJ,eAAe,YAAY,SAAS,KAAK,iBAAiB,YAAY,eACtE,cAAc,YAAY,iBAC5B;CAEA,OAAO,MAAM,KAAK,IAAI;AACxB;;AAOA,MAAa,qBAAqB,OAAO,SAAS;CAEhD;CAEA;CAEA;CAEA;CAEA;CAGA;CAEA;CAEA;CAEA;CAEA;AACF,CAAC;AAID,MAAa,uBAAuB,OAAO,SAAS;CAAC;CAAU;CAAU;AAAS,CAAC;;AAInF,IAAa,iBAAb,cAAoC,OAAO,MACzC,qCACF,CAAC,CAAC;CACA,MAAM;CACN,QAAQ;CACR,QAAQ,OAAO,YAAY,aAAa;AAC1C,CAAC,CAAC,CAAC,CAAC;;;;;;AAOJ,IAAa,kBAAb,cAAqC,OAAO,MAC1C,sCACF,CAAC,CAAC;CACA,UAAU;CACV,cAAc;CACd,aAAa,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;CAC9D,iBAAiB,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;CAClE,QAAQ,OAAO,MAAM,cAAc;CACnC,IAAI,OAAO;AACb,CAAC,CAAC,CAAC,CAAC;;;;;;AAWJ,MAAa,sBAAsB,OAAO,SAAS;CACjD;CACA;CACA;CACA;CACA;AACF,CAAC;AAID,MAAa,qBAAqB,OAAO,SAAS;CAAC;CAAM;CAAS;AAAS,CAAC;;AAI5E,IAAa,uBAAb,cAA0C,OAAO,MAC/C,2CACF,CAAC,CAAC;;CAEA,cAAc;;CAEd,gBAAgB;AAClB,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,kBAAb,cAAqC,OAAO,MAC1C,sCACF,CAAC,CAAC;CACA,cAAc;CACd,UAAU;CACV,OAAO;CACP,WAAW;CACX,YAAY;CACZ,UAAU;AACZ,CAAC,CAAC,CAAC,CAAC;;;;;;;;AASJ,IAAa,mBAAb,cAAsC,OAAO,MAC3C,uCACF,CAAC,CAAC;CACA,YAAY;CACZ,SAAS,OAAO,MAAM,eAAe;CACrC,aAAa,OAAO;AACtB,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,wBACX,YACA,eAEA,cAAc,WAAW,iBACrB,YACA,cAAc,WAAW,eACvB,UACA;;;;;;;AAYR,IAAa,eAAb,cAAkC,OAAO,MAAoB,mCAAmC,CAAC,CAAC;CAChG,cAAc;CACd,QAAQ,aAAa,OAAO;CAC5B,QAAQ,aAAa,OAAO;AAC9B,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,qBAAqB,OAAO,SAAS;CAEhD;CAEA;CAEA;AACF,CAAC;;;;;;AASD,IAAa,eAAb,cAAkC,OAAO,YAA0B,CAAC,CAAC,gBAAgB;CACnF,cAAc;CACd,SAAS;CACT,aAAa,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC;CACxD,SAAS,OAAO,OAAO,MAAM,OAAO,YAAY,IAAK,CAAC;AACxD,CAAC,CAAC,CAAC,CAAC"}

package/dist/durable/AgentRegistration.d.mts

@@ -0,0 +1,2 @@
+import { Br as definitionDigestsEqual, Fr as DurableBindingFailure, Ir as DurableWorkerBinding, Lr as ExecutableAgentBinding, Mr as AgentRegistration, Nr as BindingDigestMismatch, Pr as BindingUnavailable, Rr as ResolvedBinding, jr as AgentAttemptContext, zr as compileRegistrations } from "../Records-BAGkekt8.mjs";
+export { type AgentAttemptContext, type AgentRegistration, BindingDigestMismatch, BindingUnavailable, type DurableBindingFailure, DurableWorkerBinding, type ExecutableAgentBinding, type ResolvedBinding, compileRegistrations, definitionDigestsEqual };

package/dist/durable/AgentRegistration.mjs

@@ -0,0 +1,14 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { a as definitionDigestsEqual, i as compileRegistrations, n as BindingUnavailable, r as DurableWorkerBinding, t as BindingDigestMismatch } from "../agent-registration-CWDMOAZA.mjs";
+//#region src/durable/AgentRegistration.ts
+var AgentRegistration_exports = /* @__PURE__ */ __exportAll({
+	BindingDigestMismatch: () => BindingDigestMismatch,
+	BindingUnavailable: () => BindingUnavailable,
+	DurableWorkerBinding: () => DurableWorkerBinding,
+	compileRegistrations: () => compileRegistrations,
+	definitionDigestsEqual: () => definitionDigestsEqual
+});
+//#endregion
+export { BindingDigestMismatch, BindingUnavailable, DurableWorkerBinding, compileRegistrations, definitionDigestsEqual, AgentRegistration_exports as t };
+
+//# sourceMappingURL=AgentRegistration.mjs.map

package/dist/durable/AgentRegistration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AgentRegistration.mjs","names":[],"sources":["../../src/durable/AgentRegistration.ts"],"sourcesContent":["/** Public AgentRegistration API. Implementation helpers remain private. */\nexport {\n  BindingUnavailable,\n  BindingDigestMismatch,\n  DurableWorkerBinding,\n  compileRegistrations,\n  definitionDigestsEqual,\n  type AgentRegistration,\n  type AgentAttemptContext,\n  type ExecutableAgentBinding,\n  type DurableBindingFailure,\n  type ResolvedBinding,\n} from \"./internal/agent-registration.ts\";\n"],"mappings":""}

package/dist/durable/Certification.d.mts

@@ -0,0 +1,111 @@
+import { Va as SubmissionLedger, nn as ThreadStore } from "../Records-BAGkekt8.mjs";
+import { Crypto, Effect, Schema } from "effect";
+//#region src/durable/Certification.d.ts
+declare const CertifiedAdapterIdentity_base: Schema.Class<CertifiedAdapterIdentity, Schema.Struct<{
+  /** Workspace/package name of the adapter pair under certification. */
+  readonly name: Schema.NonEmptyString;
+  readonly version: Schema.optionalKey<Schema.String>;
+  readonly durability: Schema.Literals<readonly ["durable-node", "durable-cloudflare", "non-durable"]>;
+}>, {}>;
+/**
+ * Adapter self-description carried by a certificate. `durability` is read from the candidate
+ * ledger's `capabilities` — the adapter's honest claim (persistence.md), never inferred by the
+ * certification runner.
+ */
+declare class CertifiedAdapterIdentity extends CertifiedAdapterIdentity_base {}
+/** Which shared suite one Tier-1 (or lever-driven Tier-3) case belongs to. */
+declare const CertificationSuite: Schema.Literals<readonly ["submission-ledger", "thread-store", "real-loss"]>;
+type CertificationSuite = typeof CertificationSuite.Type;
+declare const CertificationCaseResult_base: Schema.Class<CertificationCaseResult, Schema.Struct<{
+  readonly suite: Schema.Literals<readonly ["submission-ledger", "thread-store", "real-loss"]>;
+  readonly name: Schema.NonEmptyString;
+  readonly status: Schema.Literals<readonly ["passed", "failed"]>;
+  readonly detail: Schema.optionalKey<Schema.String>;
+}>, {}>;
+/** One executed certification case: a conformance contract case or a Tier-3 lever row. */
+declare class CertificationCaseResult extends CertificationCaseResult_base {}
+/**
+ * The six Tier-2 scenario shapes: each reached coordinator fault boundary is armed once
+ * per shape. Locations outside a shape's path share its verified clean run.
+ */
+declare const CertificationScenario: Schema.Literals<readonly ["plain", "uncertain-tool", "durable-steps", "approval", "join", "delegation"]>;
+type CertificationScenario = typeof CertificationScenario.Type;
+/**
+ * Outcome of one Tier-2 sweep cell:
+ *
+ * - `converged` — the armed fault fired once, recovery classified the state, and the re-drive
+ *   converged to verified invariants;
+ * - `not-triggered` — the location was not reached with that fault armed, or was absent from
+ *   the scenario's verified clean path (shared across such locations). Never fault coverage;
+ * - `failed` — anything else.
+ */
+declare const CertificationSweepStatus: Schema.Literals<readonly ["converged", "not-triggered", "failed"]>;
+type CertificationSweepStatus = typeof CertificationSweepStatus.Type;
+declare const CertificationSweepResult_base: Schema.Class<CertificationSweepResult, Schema.Struct<{
+  readonly scenario: Schema.Literals<readonly ["plain", "uncertain-tool", "durable-steps", "approval", "join", "delegation"]>;
+  readonly location: Schema.Literals<readonly ["submit:after-admit", "submit:after-materialize", "claim:after-claim", "input:after-canonical-append", "run:before-start-append", "run:after-start-append", "turn:after-canonical-append", "turn:after-response-append", "turn:after-results-append", "compaction:before-canonical-append", "compaction:after-canonical-append", "checkpoint:before-save", "checkpoint:after-save", "tools:after-prepared-append", "tools:before-prepared-append", "policy:before-reservation-append", "policy:after-reservation-append", "step:after-step-append", "approval:after-request-append", "approval:after-suspend", "join:after-claim", "join:after-canonical-append", "resolve:after-intent", "terminalize:after-reserve", "terminalize:after-canonical-append", "abort:after-intent", "subagent:after-reserve", "subagent:after-request-append", "subagent:after-admit", "subagent:after-child-ready", "subagent:after-start-append", "subagent:after-sibling-settle", "subagent:after-suspend", "subagent:after-child-abort-intent", "subagent:before-join-append", "subagent:after-join-append", "subagent:after-release-pending", "subagent:after-release", "worker:before-source-append", "worker:after-source-append", "worker:before-origin-append", "worker:after-origin-append", "worker:before-completion-append", "worker:after-completion-append", "worker:before-subtree-append", "worker:after-subtree-append", "worker:before-report-append", "worker:after-report-append", "worker:before-report-delivery", "worker:after-report-delivery", "update:before-canonical-append", "update:after-canonical-append", "update:before-delivery-insert", "update:after-delivery-insert"]>;
+  /** The armed fault actually fired (one-shot) somewhere in the cell's drive or re-drive. */
+  readonly failpointFired: Schema.Boolean;
+  readonly status: Schema.Literals<readonly ["converged", "not-triggered", "failed"]>;
+  /**
+   * Every lane's digest chain recomputed from `EMPTY_TAIL_DIGEST` and matched the exported
+   * tail — fully discharged here because the runner captures per-batch producer identity at
+   * append time (the port-only admin `verify` reports this check `skipped` instead).
+   * Unreached locations may share the scenario's clean-run verification.
+   */
+  readonly digestChainVerified: Schema.Boolean;
+  readonly detail: Schema.optionalKey<Schema.String>;
+}>, {}>;
+/** One Tier-2 scenario/location result, including locations outside the verified path. */
+declare class CertificationSweepResult extends CertificationSweepResult_base {}
+/**
+ * How the real-loss tier was discharged. Tier 3 is never silently claimed: an adapter either
+ * exercised a real loss lever in this run (`exercised`), cites committed real-loss evidence
+ * (`recorded-evidence`), honestly records that nothing exercised it (`not-exercised`), or is a
+ * non-durable reference adapter with no real loss to exercise (`not-applicable`).
+ */
+declare const CertificationTierThreeStatus: Schema.Literals<readonly ["exercised", "recorded-evidence", "not-exercised", "not-applicable"]>;
+type CertificationTierThreeStatus = typeof CertificationTierThreeStatus.Type;
+declare const CertificationTierThreeReport_base: Schema.Class<CertificationTierThreeReport, Schema.Struct<{
+  readonly status: Schema.Literals<readonly ["exercised", "recorded-evidence", "not-exercised", "not-applicable"]>;
+  /** Cited real-loss suites. The runner does not execute or verify these references. */
+  readonly evidence: Schema.$Array<Schema.String>;
+  /** Rows executed by a supplied crash lever in THIS run (`suite: "real-loss"`). */
+  readonly cases: Schema.$Array<typeof CertificationCaseResult>;
+  readonly detail: Schema.optionalKey<Schema.String>;
+}>, {}>;
+/** The Tier-3 (real loss lever) section of a certificate. */
+declare class CertificationTierThreeReport extends CertificationTierThreeReport_base {}
+declare const CertificationReport_base: Schema.Class<CertificationReport, Schema.Struct<{
+  readonly format: Schema.Literal<"effect-agent/certification@2">;
+  readonly adapter: typeof CertifiedAdapterIdentity;
+  readonly generatedAt: Schema.DateTimeUtcFromString;
+  readonly tier1: Schema.$Array<typeof CertificationCaseResult>;
+  readonly tier2: Schema.$Array<typeof CertificationSweepResult>;
+  readonly tier3: typeof CertificationTierThreeReport;
+  readonly ok: Schema.Boolean;
+  readonly fullyCertified: Schema.Boolean;
+}>, {}>;
+/**
+ * The Schema-encoded certification report (plan §1): Tier 1 = the two shared port contract
+ * suites verbatim; Tier 2 = the coordinator failpoint convergence sweep; Tier 3 = the real
+ * loss lever record. `ok` is true exactly when every EXECUTED check passed — honest scope
+ * statements (`not-triggered`, `recorded-evidence`, `not-exercised`, `not-applicable`) never
+ * count as failures and never count as silent coverage. `fullyCertified` additionally requires
+ * a durable adapter and passing real-loss cases executed in this run. Citations alone do not
+ * certify recovery. A non-durable adapter can pass conformance but is never fully certified.
+ * The semantic assertions live in the runner tests.
+ */
+declare class CertificationReport extends CertificationReport_base {}
+/**
+ * Tier 1 — port contract (plan §1): run BOTH shared conformance case arrays verbatim against
+ * the provided candidate adapters and fold every case into a typed result. Case failures are
+ * captured per-case (never short-circuiting the sweep), so a certificate always reports the
+ * complete contract surface. Requires the candidate `SubmissionLedger` and `ThreadStore`
+ * plus `Crypto.Crypto`, and must run under a TestClock (the ledger cases drive lease expiry
+ * through virtual time).
+ */
+declare const certifyPorts: () => Effect.Effect<readonly CertificationCaseResult[], never, Crypto.Crypto | SubmissionLedger | ThreadStore>;
+//#endregion
+export { CertificationCaseResult, CertificationReport, CertificationScenario, CertificationSuite, CertificationSweepResult, CertificationSweepStatus, CertificationTierThreeReport, CertificationTierThreeStatus, CertifiedAdapterIdentity, certifyPorts };
+//# sourceMappingURL=Certification.d.mts.map

package/dist/durable/Certification.mjs

@@ -0,0 +1,159 @@
+import { LedgerCapabilities } from "./SubmissionLedger.mjs";
+import { DurableRuntimeFailpointLocation } from "./DurableFailpoint.mjs";
+import { n as safeUnknownString, t as inspectForeignDiagnostic } from "../foreign-diagnostic-DBQ1XHKh.mjs";
+import { submissionLedgerConformanceCases } from "./SubmissionLedgerConformance.mjs";
+import { threadStoreConformanceCases } from "./ThreadStoreConformance.mjs";
+import { Cause, Effect, Exit, Option, Schema } from "effect";
+//#region src/durable/Certification.ts
+const BoundedCertificationDetail = Schema.String.check(Schema.isMaxLength(4096));
+/**
+* Adapter self-description carried by a certificate. `durability` is read from the candidate
+* ledger's `capabilities` — the adapter's honest claim (persistence.md), never inferred by the
+* certification runner.
+*/
+var CertifiedAdapterIdentity = class extends Schema.Class("@effect-agent/thread/CertifiedAdapterIdentity")({
+	/** Workspace/package name of the adapter pair under certification. */
+	name: Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+	version: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),
+	durability: LedgerCapabilities.fields.durability
+}) {};
+/** Which shared suite one Tier-1 (or lever-driven Tier-3) case belongs to. */
+const CertificationSuite = Schema.Literals([
+	"submission-ledger",
+	"thread-store",
+	"real-loss"
+]);
+/** One executed certification case: a conformance contract case or a Tier-3 lever row. */
+var CertificationCaseResult = class extends Schema.Class("@effect-agent/thread/CertificationCaseResult")({
+	suite: CertificationSuite,
+	name: Schema.NonEmptyString.check(Schema.isMaxLength(512)),
+	status: Schema.Literals(["passed", "failed"]),
+	detail: Schema.optionalKey(BoundedCertificationDetail)
+}) {};
+/**
+* The six Tier-2 scenario shapes: each reached coordinator fault boundary is armed once
+* per shape. Locations outside a shape's path share its verified clean run.
+*/
+const CertificationScenario = Schema.Literals([
+	"plain",
+	"uncertain-tool",
+	"durable-steps",
+	"approval",
+	"join",
+	"delegation"
+]);
+/**
+* Outcome of one Tier-2 sweep cell:
+*
+* - `converged` — the armed fault fired once, recovery classified the state, and the re-drive
+*   converged to verified invariants;
+* - `not-triggered` — the location was not reached with that fault armed, or was absent from
+*   the scenario's verified clean path (shared across such locations). Never fault coverage;
+* - `failed` — anything else.
+*/
+const CertificationSweepStatus = Schema.Literals([
+	"converged",
+	"not-triggered",
+	"failed"
+]);
+/** One Tier-2 scenario/location result, including locations outside the verified path. */
+var CertificationSweepResult = class extends Schema.Class("@effect-agent/thread/CertificationSweepResult")({
+	scenario: CertificationScenario,
+	location: DurableRuntimeFailpointLocation,
+	/** The armed fault actually fired (one-shot) somewhere in the cell's drive or re-drive. */
+	failpointFired: Schema.Boolean,
+	status: CertificationSweepStatus,
+	/**
+	* Every lane's digest chain recomputed from `EMPTY_TAIL_DIGEST` and matched the exported
+	* tail — fully discharged here because the runner captures per-batch producer identity at
+	* append time (the port-only admin `verify` reports this check `skipped` instead).
+	* Unreached locations may share the scenario's clean-run verification.
+	*/
+	digestChainVerified: Schema.Boolean,
+	detail: Schema.optionalKey(BoundedCertificationDetail)
+}) {};
+/**
+* How the real-loss tier was discharged. Tier 3 is never silently claimed: an adapter either
+* exercised a real loss lever in this run (`exercised`), cites committed real-loss evidence
+* (`recorded-evidence`), honestly records that nothing exercised it (`not-exercised`), or is a
+* non-durable reference adapter with no real loss to exercise (`not-applicable`).
+*/
+const CertificationTierThreeStatus = Schema.Literals([
+	"exercised",
+	"recorded-evidence",
+	"not-exercised",
+	"not-applicable"
+]);
+/** The Tier-3 (real loss lever) section of a certificate. */
+var CertificationTierThreeReport = class extends Schema.Class("@effect-agent/thread/CertificationTierThreeReport")({
+	status: CertificationTierThreeStatus,
+	/** Cited real-loss suites. The runner does not execute or verify these references. */
+	evidence: Schema.Array(BoundedCertificationDetail),
+	/** Rows executed by a supplied crash lever in THIS run (`suite: "real-loss"`). */
+	cases: Schema.Array(CertificationCaseResult),
+	detail: Schema.optionalKey(BoundedCertificationDetail)
+}) {};
+/**
+* The Schema-encoded certification report (plan §1): Tier 1 = the two shared port contract
+* suites verbatim; Tier 2 = the coordinator failpoint convergence sweep; Tier 3 = the real
+* loss lever record. `ok` is true exactly when every EXECUTED check passed — honest scope
+* statements (`not-triggered`, `recorded-evidence`, `not-exercised`, `not-applicable`) never
+* count as failures and never count as silent coverage. `fullyCertified` additionally requires
+* a durable adapter and passing real-loss cases executed in this run. Citations alone do not
+* certify recovery. A non-durable adapter can pass conformance but is never fully certified.
+* The semantic assertions live in the runner tests.
+*/
+var CertificationReport = class extends Schema.Class("@effect-agent/thread/CertificationReport")({
+	format: Schema.Literal("effect-agent/certification@2"),
+	adapter: CertifiedAdapterIdentity,
+	generatedAt: Schema.DateTimeUtcFromString,
+	tier1: Schema.Array(CertificationCaseResult),
+	tier2: Schema.Array(CertificationSweepResult),
+	tier3: CertificationTierThreeReport,
+	ok: Schema.Boolean,
+	fullyCertified: Schema.Boolean
+}) {};
+/** Bounded operator-readable rendering of one failure Cause for a certification detail. */
+const causeDetail = (cause) => {
+	const failure = Cause.findErrorOption(cause);
+	if (Option.isSome(failure)) {
+		const diagnostic = inspectForeignDiagnostic(failure.value);
+		if (diagnostic.tag !== void 0 || diagnostic.message !== void 0) return `${diagnostic.tag ?? "Error"}${diagnostic.message === void 0 ? "" : `: ${diagnostic.message}`}`.slice(0, 4096);
+		return safeUnknownString(failure.value, "Unknown foreign failure").slice(0, 4096);
+	}
+	return `defect: ${safeUnknownString(cause, "Unknown defect")}`.slice(0, 4096);
+};
+const caseResult = (suite, name, exit) => Exit.isSuccess(exit) ? CertificationCaseResult.make({
+	suite,
+	name,
+	status: "passed"
+}) : CertificationCaseResult.make({
+	suite,
+	name,
+	status: "failed",
+	detail: causeDetail(exit.cause)
+});
+/**
+* Tier 1 — port contract (plan §1): run BOTH shared conformance case arrays verbatim against
+* the provided candidate adapters and fold every case into a typed result. Case failures are
+* captured per-case (never short-circuiting the sweep), so a certificate always reports the
+* complete contract surface. Requires the candidate `SubmissionLedger` and `ThreadStore`
+* plus `Crypto.Crypto`, and must run under a TestClock (the ledger cases drive lease expiry
+* through virtual time).
+*/
+const certifyPorts = Effect.fn("Thread.certifyPorts")(function* () {
+	const results = [];
+	for (const contractCase of submissionLedgerConformanceCases) {
+		const exit = yield* Effect.exit(contractCase.run);
+		results.push(caseResult("submission-ledger", contractCase.name, exit));
+	}
+	for (const contractCase of threadStoreConformanceCases) {
+		const exit = yield* Effect.exit(contractCase.run);
+		results.push(caseResult("thread-store", contractCase.name, exit));
+	}
+	return results;
+});
+//#endregion
+export { CertificationCaseResult, CertificationReport, CertificationScenario, CertificationSuite, CertificationSweepResult, CertificationSweepStatus, CertificationTierThreeReport, CertificationTierThreeStatus, CertifiedAdapterIdentity, certifyPorts };
+
+//# sourceMappingURL=Certification.mjs.map

package/dist/durable/Certification.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Certification.mjs","names":[],"sources":["../../src/durable/Certification.ts"],"sourcesContent":["import type { Crypto } from \"effect\";\nimport { Cause, Effect, Exit, Option, Schema } from \"effect\";\n\nimport { DurableRuntimeFailpointLocation } from \"./DurableFailpoint.ts\";\nimport { inspectForeignDiagnostic, safeUnknownString } from \"./internal/foreign-diagnostic.ts\";\nimport type { SubmissionLedger } from \"./SubmissionLedger.ts\";\nimport { LedgerCapabilities } from \"./SubmissionLedger.ts\";\nimport { submissionLedgerConformanceCases } from \"./SubmissionLedgerConformance.ts\";\nimport type { ThreadStore } from \"./ThreadStore.ts\";\nimport { threadStoreConformanceCases } from \"./ThreadStoreConformance.ts\";\n\n// ---------------------------------------------------------------------------\n// Certification report vocabulary (WP2, plan §1)\n// ---------------------------------------------------------------------------\n\nconst BoundedCertificationDetail = Schema.String.check(Schema.isMaxLength(4_096));\n\n/**\n * Adapter self-description carried by a certificate. `durability` is read from the candidate\n * ledger's `capabilities` — the adapter's honest claim (persistence.md), never inferred by the\n * certification runner.\n */\nexport class CertifiedAdapterIdentity extends Schema.Class<CertifiedAdapterIdentity>(\n  \"@effect-agent/thread/CertifiedAdapterIdentity\",\n)({\n  /** Workspace/package name of the adapter pair under certification. */\n  name: Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n  version: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(256))),\n  durability: LedgerCapabilities.fields.durability,\n}) {}\n\n/** Which shared suite one Tier-1 (or lever-driven Tier-3) case belongs to. */\nexport const CertificationSuite = Schema.Literals([\n  \"submission-ledger\",\n  \"thread-store\",\n  \"real-loss\",\n]);\n\nexport type CertificationSuite = typeof CertificationSuite.Type;\n\n/** One executed certification case: a conformance contract case or a Tier-3 lever row. */\nexport class CertificationCaseResult extends Schema.Class<CertificationCaseResult>(\n  \"@effect-agent/thread/CertificationCaseResult\",\n)({\n  suite: CertificationSuite,\n  name: Schema.NonEmptyString.check(Schema.isMaxLength(512)),\n  status: Schema.Literals([\"passed\", \"failed\"]),\n  detail: Schema.optionalKey(BoundedCertificationDetail),\n}) {}\n\n/**\n * The six Tier-2 scenario shapes: each reached coordinator fault boundary is armed once\n * per shape. Locations outside a shape's path share its verified clean run.\n */\nexport const CertificationScenario = Schema.Literals([\n  \"plain\",\n  \"uncertain-tool\",\n  \"durable-steps\",\n  \"approval\",\n  \"join\",\n  \"delegation\",\n]);\n\nexport type CertificationScenario = typeof CertificationScenario.Type;\n\n/**\n * Outcome of one Tier-2 sweep cell:\n *\n * - `converged` — the armed fault fired once, recovery classified the state, and the re-drive\n *   converged to verified invariants;\n * - `not-triggered` — the location was not reached with that fault armed, or was absent from\n *   the scenario's verified clean path (shared across such locations). Never fault coverage;\n * - `failed` — anything else.\n */\nexport const CertificationSweepStatus = Schema.Literals([\"converged\", \"not-triggered\", \"failed\"]);\nexport type CertificationSweepStatus = typeof CertificationSweepStatus.Type;\n\n/** One Tier-2 scenario/location result, including locations outside the verified path. */\nexport class CertificationSweepResult extends Schema.Class<CertificationSweepResult>(\n  \"@effect-agent/thread/CertificationSweepResult\",\n)({\n  scenario: CertificationScenario,\n  location: DurableRuntimeFailpointLocation,\n  /** The armed fault actually fired (one-shot) somewhere in the cell's drive or re-drive. */\n  failpointFired: Schema.Boolean,\n  status: CertificationSweepStatus,\n  /**\n   * Every lane's digest chain recomputed from `EMPTY_TAIL_DIGEST` and matched the exported\n   * tail — fully discharged here because the runner captures per-batch producer identity at\n   * append time (the port-only admin `verify` reports this check `skipped` instead).\n   * Unreached locations may share the scenario's clean-run verification.\n   */\n  digestChainVerified: Schema.Boolean,\n  detail: Schema.optionalKey(BoundedCertificationDetail),\n}) {}\n\n/**\n * How the real-loss tier was discharged. Tier 3 is never silently claimed: an adapter either\n * exercised a real loss lever in this run (`exercised`), cites committed real-loss evidence\n * (`recorded-evidence`), honestly records that nothing exercised it (`not-exercised`), or is a\n * non-durable reference adapter with no real loss to exercise (`not-applicable`).\n */\nexport const CertificationTierThreeStatus = Schema.Literals([\n  \"exercised\",\n  \"recorded-evidence\",\n  \"not-exercised\",\n  \"not-applicable\",\n]);\n\nexport type CertificationTierThreeStatus = typeof CertificationTierThreeStatus.Type;\n\n/** The Tier-3 (real loss lever) section of a certificate. */\nexport class CertificationTierThreeReport extends Schema.Class<CertificationTierThreeReport>(\n  \"@effect-agent/thread/CertificationTierThreeReport\",\n)({\n  status: CertificationTierThreeStatus,\n  /** Cited real-loss suites. The runner does not execute or verify these references. */\n  evidence: Schema.Array(BoundedCertificationDetail),\n  /** Rows executed by a supplied crash lever in THIS run (`suite: \"real-loss\"`). */\n  cases: Schema.Array(CertificationCaseResult),\n  detail: Schema.optionalKey(BoundedCertificationDetail),\n}) {}\n\n/**\n * The Schema-encoded certification report (plan §1): Tier 1 = the two shared port contract\n * suites verbatim; Tier 2 = the coordinator failpoint convergence sweep; Tier 3 = the real\n * loss lever record. `ok` is true exactly when every EXECUTED check passed — honest scope\n * statements (`not-triggered`, `recorded-evidence`, `not-exercised`, `not-applicable`) never\n * count as failures and never count as silent coverage. `fullyCertified` additionally requires\n * a durable adapter and passing real-loss cases executed in this run. Citations alone do not\n * certify recovery. A non-durable adapter can pass conformance but is never fully certified.\n * The semantic assertions live in the runner tests.\n */\nexport class CertificationReport extends Schema.Class<CertificationReport>(\n  \"@effect-agent/thread/CertificationReport\",\n)({\n  format: Schema.Literal(\"effect-agent/certification@2\"),\n  adapter: CertifiedAdapterIdentity,\n  generatedAt: Schema.DateTimeUtcFromString,\n  tier1: Schema.Array(CertificationCaseResult),\n  tier2: Schema.Array(CertificationSweepResult),\n  tier3: CertificationTierThreeReport,\n  ok: Schema.Boolean,\n  fullyCertified: Schema.Boolean,\n}) {}\n\n/** Bounded operator-readable rendering of one failure Cause for a certification detail. */\nconst causeDetail = (cause: Cause.Cause<unknown>): string => {\n  const failure = Cause.findErrorOption(cause);\n\n  if (Option.isSome(failure)) {\n    const diagnostic = inspectForeignDiagnostic(failure.value);\n\n    if (diagnostic.tag !== undefined || diagnostic.message !== undefined) {\n      const tag = diagnostic.tag ?? \"Error\";\n\n      return `${tag}${diagnostic.message === undefined ? \"\" : `: ${diagnostic.message}`}`.slice(\n        0,\n        4_096,\n      );\n    }\n\n    return safeUnknownString(failure.value, \"Unknown foreign failure\").slice(0, 4_096);\n  }\n\n  return `defect: ${safeUnknownString(cause, \"Unknown defect\")}`.slice(0, 4_096);\n};\n\nconst caseResult = <A, E>(\n  suite: CertificationSuite,\n  name: string,\n  exit: Exit.Exit<A, E>,\n): CertificationCaseResult =>\n  Exit.isSuccess(exit)\n    ? CertificationCaseResult.make({ suite, name, status: \"passed\" })\n    : CertificationCaseResult.make({\n        suite,\n        name,\n        status: \"failed\",\n        detail: causeDetail(exit.cause),\n      });\n\n/**\n * Tier 1 — port contract (plan §1): run BOTH shared conformance case arrays verbatim against\n * the provided candidate adapters and fold every case into a typed result. Case failures are\n * captured per-case (never short-circuiting the sweep), so a certificate always reports the\n * complete contract surface. Requires the candidate `SubmissionLedger` and `ThreadStore`\n * plus `Crypto.Crypto`, and must run under a TestClock (the ledger cases drive lease expiry\n * through virtual time).\n */\nexport const certifyPorts = Effect.fn(\"Thread.certifyPorts\")(function* (): Effect.fn.Return<\n  ReadonlyArray<CertificationCaseResult>,\n  never,\n  SubmissionLedger | ThreadStore | Crypto.Crypto\n> {\n  const results: Array<CertificationCaseResult> = [];\n\n  for (const contractCase of submissionLedgerConformanceCases) {\n    const exit = yield* Effect.exit(contractCase.run);\n\n    results.push(caseResult(\"submission-ledger\", contractCase.name, exit));\n  }\n  for (const contractCase of threadStoreConformanceCases) {\n    const exit = yield* Effect.exit(contractCase.run);\n\n    results.push(caseResult(\"thread-store\", contractCase.name, exit));\n  }\n\n  return results;\n});\n"],"mappings":";;;;;;;AAeA,MAAM,6BAA6B,OAAO,OAAO,MAAM,OAAO,YAAY,IAAK,CAAC;;;;;;AAOhF,IAAa,2BAAb,cAA8C,OAAO,MACnD,+CACF,CAAC,CAAC;;CAEA,MAAM,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACzD,SAAS,OAAO,YAAY,OAAO,OAAO,MAAM,OAAO,YAAY,GAAG,CAAC,CAAC;CACxE,YAAY,mBAAmB,OAAO;AACxC,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,qBAAqB,OAAO,SAAS;CAChD;CACA;CACA;AACF,CAAC;;AAKD,IAAa,0BAAb,cAA6C,OAAO,MAClD,8CACF,CAAC,CAAC;CACA,OAAO;CACP,MAAM,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;CACzD,QAAQ,OAAO,SAAS,CAAC,UAAU,QAAQ,CAAC;CAC5C,QAAQ,OAAO,YAAY,0BAA0B;AACvD,CAAC,CAAC,CAAC,CAAC;;;;;AAMJ,MAAa,wBAAwB,OAAO,SAAS;CACnD;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;;;AAaD,MAAa,2BAA2B,OAAO,SAAS;CAAC;CAAa;CAAiB;AAAQ,CAAC;;AAIhG,IAAa,2BAAb,cAA8C,OAAO,MACnD,+CACF,CAAC,CAAC;CACA,UAAU;CACV,UAAU;;CAEV,gBAAgB,OAAO;CACvB,QAAQ;;;;;;;CAOR,qBAAqB,OAAO;CAC5B,QAAQ,OAAO,YAAY,0BAA0B;AACvD,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,MAAa,+BAA+B,OAAO,SAAS;CAC1D;CACA;CACA;CACA;AACF,CAAC;;AAKD,IAAa,+BAAb,cAAkD,OAAO,MACvD,mDACF,CAAC,CAAC;CACA,QAAQ;;CAER,UAAU,OAAO,MAAM,0BAA0B;;CAEjD,OAAO,OAAO,MAAM,uBAAuB;CAC3C,QAAQ,OAAO,YAAY,0BAA0B;AACvD,CAAC,CAAC,CAAC,CAAC;;;;;;;;;;;AAYJ,IAAa,sBAAb,cAAyC,OAAO,MAC9C,0CACF,CAAC,CAAC;CACA,QAAQ,OAAO,QAAQ,8BAA8B;CACrD,SAAS;CACT,aAAa,OAAO;CACpB,OAAO,OAAO,MAAM,uBAAuB;CAC3C,OAAO,OAAO,MAAM,wBAAwB;CAC5C,OAAO;CACP,IAAI,OAAO;CACX,gBAAgB,OAAO;AACzB,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAM,eAAe,UAAwC;CAC3D,MAAM,UAAU,MAAM,gBAAgB,KAAK;CAE3C,IAAI,OAAO,OAAO,OAAO,GAAG;EAC1B,MAAM,aAAa,yBAAyB,QAAQ,KAAK;EAEzD,IAAI,WAAW,QAAQ,KAAA,KAAa,WAAW,YAAY,KAAA,GAGzD,OAAO,GAFK,WAAW,OAAO,UAEd,WAAW,YAAY,KAAA,IAAY,KAAK,KAAK,WAAW,YAAY,MAClF,GACA,IACF;EAGF,OAAO,kBAAkB,QAAQ,OAAO,yBAAyB,CAAC,CAAC,MAAM,GAAG,IAAK;CACnF;CAEA,OAAO,WAAW,kBAAkB,OAAO,gBAAgB,IAAI,MAAM,GAAG,IAAK;AAC/E;AAEA,MAAM,cACJ,OACA,MACA,SAEA,KAAK,UAAU,IAAI,IACf,wBAAwB,KAAK;CAAE;CAAO;CAAM,QAAQ;AAAS,CAAC,IAC9D,wBAAwB,KAAK;CAC3B;CACA;CACA,QAAQ;CACR,QAAQ,YAAY,KAAK,KAAK;AAChC,CAAC;;;;;;;;;AAUP,MAAa,eAAe,OAAO,GAAG,qBAAqB,CAAC,CAAC,aAI3D;CACA,MAAM,UAA0C,CAAC;CAEjD,KAAK,MAAM,gBAAgB,kCAAkC;EAC3D,MAAM,OAAO,OAAO,OAAO,KAAK,aAAa,GAAG;EAEhD,QAAQ,KAAK,WAAW,qBAAqB,aAAa,MAAM,IAAI,CAAC;CACvE;CACA,KAAK,MAAM,gBAAgB,6BAA6B;EACtD,MAAM,OAAO,OAAO,OAAO,KAAK,aAAa,GAAG;EAEhD,QAAQ,KAAK,WAAW,gBAAgB,aAAa,MAAM,IAAI,CAAC;CAClE;CAEA,OAAO;AACT,CAAC"}

package/dist/durable/CommittedActivity.d.mts

@@ -0,0 +1,62 @@
+import { O as PersistedJson, Qt as ThreadNotMaterialized, Vr as DigestError, l as CanonicalRecordEnvelope, nn as ThreadStore, rn as ThreadStoreError } from "../Records-BAGkekt8.mjs";
+import { ActivityProcessorKey, ActivityProcessorStore, ActivityStoreFailure, PreparedActivity } from "./ActivityStore.mjs";
+import { Crypto, Effect, Schema, Scope } from "effect";
+declare namespace CommittedActivity_d_exports {
+  export { ActivityPassLimits, ActivityPassResult, ActivityProcessingError, CommittedActivityProcessor, activityWorkId, processCommittedActivity };
+}
+declare const ActivityPassLimits_base: Schema.Class<ActivityPassLimits, Schema.Struct<{
+  readonly maxRecords: Schema.Int;
+  readonly pageSize: Schema.Int;
+  readonly timeoutMillis: Schema.Int;
+  readonly leaseMillis: Schema.Int;
+}>, {}>;
+declare class ActivityPassLimits extends ActivityPassLimits_base {}
+declare const ActivityProcessingError_base: Schema.Class<ActivityProcessingError, Schema.TaggedStruct<"ActivityProcessingError", {
+  readonly reason: Schema.Literals<readonly ["invalid-input", "noncontiguous", "timeout"]>;
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+declare class ActivityProcessingError extends ActivityProcessingError_base {}
+declare const ActivityPassResult_base: Schema.Class<ActivityPassResult, Schema.Struct<{
+  readonly key: typeof ActivityProcessorKey;
+  readonly capturedTail: Schema.brand<Schema.Natural, "@effect-agent/thread/CanonicalSequence">;
+  readonly throughSequence: Schema.brand<Schema.Natural, "@effect-agent/thread/CanonicalSequence">;
+  readonly processed: Schema.Natural;
+  readonly pendingRecords: Schema.Natural;
+  readonly startedAt: Schema.Finite;
+  readonly finishedAt: Schema.Finite;
+}>, {}>;
+declare class ActivityPassResult extends ActivityPassResult_base {}
+interface CommittedActivityProcessor<E = never, R = never, EApply = never, RApply = never> {
+  readonly key: ActivityProcessorKey;
+  /** Unique to this worker lifetime; it is not canonical Thread ownership. */
+  readonly owner: string;
+  readonly limits: ActivityPassLimits;
+  /** Select eligibility and encode an application Schema; null can represent no output. */
+  readonly extract: (record: CanonicalRecordEnvelope) => Effect.Effect<PersistedJson, E, R>;
+  /**
+   * Must durably reconcile workId before returning, using atomic idempotency and conditional
+   * writes. This may run again after any lost acknowledgement. A stale invocation can finish
+   * only the already pinned output; it must not overwrite a later correction or withdrawal.
+   * Retain reconciliation evidence for the lifetime of pending work, including any supported
+   * backup/restore window. Returning before durable application would permit skipped output.
+   */
+  readonly apply: (work: PreparedActivity) => Effect.Effect<void, EApply, RApply>;
+}
+/** Stable work identity independent of worker claims, retry count, extraction, and clocks. */
+declare const activityWorkId: (key: ActivityProcessorKey, sequence: number & import("effect/Brand").Brand<"@effect-agent/thread/CanonicalSequence">) => Effect.Effect<string & import("effect/Brand").Brand<"@effect-agent/thread/Digest">, DigestError, Crypto.Crypto>;
+/**
+ * Process one bounded committed prefix of one application-selected Thread. Nothing runs until
+ * invoked, and no daemon, global Thread directory, admission ledger, or engine checkpoint is
+ * involved. PersistentHistory makes a successful Run's batch visible together; durable Runs
+ * expose incremental committed records. The application decides what each record means.
+ *
+ * A durable pending output wins over a new extraction after restart. Apply finishes before
+ * progress advances, so separate output stores require durable idempotency. This does not
+ * promise exactly-once external side effects. Each callback owns a Scope; the finite pass has
+ * a timeout and a longer lease. Claim release has a separate 500ms deadline; failure leaves
+ * the bounded lease to expire.
+ */
+declare const processCommittedActivity: <E = never, R = never, EApply = never, RApply = never>(processor: CommittedActivityProcessor<E, R, EApply, RApply>) => Effect.Effect<ActivityPassResult, E | EApply | ActivityProcessingError | DigestError | ThreadNotMaterialized | ThreadStoreError | ActivityStoreFailure, ActivityProcessorStore | Crypto.Crypto | ThreadStore | Exclude<R, Scope.Scope> | Exclude<RApply, Scope.Scope>>;
+//#endregion
+export { ActivityPassLimits, ActivityPassResult, ActivityProcessingError, CommittedActivityProcessor, activityWorkId, processCommittedActivity, CommittedActivity_d_exports as t };
+//# sourceMappingURL=CommittedActivity.d.mts.map

package/dist/durable/CommittedActivity.mjs

@@ -0,0 +1,159 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { CanonicalRecordEnvelope, CanonicalSequence, PersistedJson, RecordEnvelope } from "./Records.mjs";
+import { ActivityClaim, ActivityClaimRequest, ActivityProcessorKey, ActivityProcessorStore, PreparedActivity } from "./ActivityStore.mjs";
+import { digestJson } from "./Digest.mjs";
+import { ThreadRead, ThreadStore, ThreadTail, ThreadTailRequest } from "./ThreadStore.mjs";
+import { Clock, Effect, Schema, Stream } from "effect";
+//#region src/durable/CommittedActivity.ts
+var CommittedActivity_exports = /* @__PURE__ */ __exportAll({
+	ActivityPassLimits: () => ActivityPassLimits,
+	ActivityPassResult: () => ActivityPassResult,
+	ActivityProcessingError: () => ActivityProcessingError,
+	activityWorkId: () => activityWorkId,
+	processCommittedActivity: () => processCommittedActivity
+});
+var ActivityPassLimits = class extends Schema.Class("@effect-agent/thread/ActivityPassLimits")({
+	maxRecords: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 4096
+	})),
+	pageSize: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 128
+	})),
+	timeoutMillis: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 3e5
+	})),
+	leaseMillis: ActivityClaimRequest.fields.leaseMillis
+}) {};
+var ActivityProcessingError = class extends Schema.TaggedError()("ActivityProcessingError", {
+	reason: Schema.Literals([
+		"invalid-input",
+		"noncontiguous",
+		"timeout"
+	]),
+	message: Schema.String.check(Schema.isMaxLength(1024))
+}) {};
+var ActivityPassResult = class extends Schema.Class("@effect-agent/thread/ActivityPassResult")({
+	key: ActivityProcessorKey,
+	capturedTail: CanonicalSequence,
+	throughSequence: CanonicalSequence,
+	processed: Schema.Natural,
+	pendingRecords: Schema.Natural,
+	startedAt: Schema.Finite,
+	finishedAt: Schema.Finite
+}) {};
+const invalid = (message) => ActivityProcessingError.make({
+	reason: "invalid-input",
+	message
+});
+const contiguous = () => ActivityProcessingError.make({
+	reason: "noncontiguous",
+	message: "Committed activity does not match its captured Thread prefix or pinned record"
+});
+/** Stable work identity independent of worker claims, retry count, extraction, and clocks. */
+const activityWorkId = Effect.fn("activityWorkId")(function* (key, sequence) {
+	return yield* digestJson([
+		"effect-agent/activity@1",
+		key.processorId,
+		key.processorVersion,
+		key.threadId,
+		sequence
+	]);
+});
+/**
+* Process one bounded committed prefix of one application-selected Thread. Nothing runs until
+* invoked, and no daemon, global Thread directory, admission ledger, or engine checkpoint is
+* involved. PersistentHistory makes a successful Run's batch visible together; durable Runs
+* expose incremental committed records. The application decides what each record means.
+*
+* A durable pending output wins over a new extraction after restart. Apply finishes before
+* progress advances, so separate output stores require durable idempotency. This does not
+* promise exactly-once external side effects. Each callback owns a Scope; the finite pass has
+* a timeout and a longer lease. Claim release has a separate 500ms deadline; failure leaves
+* the bounded lease to expire.
+*/
+const processCommittedActivity = Effect.fn("processCommittedActivity")(function* (processor) {
+	const key = yield* Schema.decodeEffect(ActivityProcessorKey)(processor.key).pipe(Effect.mapError(() => invalid("Invalid activity processor key")));
+	const limits = yield* Schema.decodeEffect(ActivityPassLimits)(processor.limits).pipe(Effect.mapError(() => invalid("Invalid activity pass limits")));
+	if (limits.leaseMillis < limits.timeoutMillis + 1e3) return yield* invalid("The activity lease must exceed the pass timeout by at least 1000ms");
+	const request = yield* ActivityClaimRequest.makeEffect({
+		key,
+		owner: processor.owner,
+		leaseMillis: limits.leaseMillis
+	}).pipe(Effect.mapError(() => invalid("Invalid activity worker identity")));
+	const progress = yield* ActivityProcessorStore;
+	const threads = yield* ThreadStore;
+	return yield* Effect.scoped(Effect.gen(function* () {
+		const acquired = yield* Effect.acquireRelease(progress.claim(request).pipe(Effect.interruptible), (claim) => progress.release(claim).pipe(Effect.interruptible, Effect.timeoutOption(500), Effect.ignore));
+		let claim = yield* Schema.decodeEffect(ActivityClaim)(acquired).pipe(Effect.mapError(() => invalid("Malformed activity claim")));
+		if (!Schema.toEquivalence(ActivityProcessorKey)(claim.key, key) || claim.owner !== request.owner) return yield* invalid("Activity claim identity does not match its request");
+		const startedAt = yield* Clock.currentTimeMillis;
+		const tail = yield* threads.inspectTail(ThreadTailRequest.make({ threadId: key.threadId })).pipe(Effect.flatMap((value) => Schema.decodeEffect(ThreadTail)(value).pipe(Effect.mapError(contiguous))));
+		if (tail.threadId !== key.threadId || tail.tailSequence < claim.throughSequence || claim.pending !== null && tail.tailSequence < claim.pending.sequence) return yield* contiguous();
+		const through = Math.min(tail.tailSequence, claim.throughSequence + limits.maxRecords);
+		let processed = 0;
+		while (claim.throughSequence < through) {
+			const limit = Math.min(limits.pageSize, through - claim.throughSequence);
+			const page = yield* threads.read(ThreadRead.make({
+				threadId: key.threadId,
+				afterSequence: claim.throughSequence,
+				limit
+			})).pipe(Stream.take(limit + 1), Stream.runCollect);
+			if (page.length !== limit) return yield* contiguous();
+			for (const rawRecord of page) {
+				const record = yield* Schema.decodeEffect(Schema.toType(CanonicalRecordEnvelope))(rawRecord).pipe(Effect.mapError(contiguous));
+				if (record.threadId !== key.threadId || record.sequence !== claim.throughSequence + 1) return yield* contiguous();
+				const workId = yield* activityWorkId(key, record.sequence);
+				const encodedRecord = yield* Schema.encodeEffect(RecordEnvelope)(record.record).pipe(Effect.mapError(contiguous));
+				const recordDigest = yield* digestJson(encodedRecord);
+				let work = claim.pending;
+				if (work === null) {
+					const output = yield* Effect.scoped(processor.extract(record)).pipe(Effect.flatMap((value) => Schema.decodeEffect(PersistedJson)(value).pipe(Effect.mapError(() => invalid("Malformed activity output")))));
+					work = yield* progress.prepare({
+						claim,
+						work: PreparedActivity.make({
+							version: 1,
+							key,
+							sequence: record.sequence,
+							workId,
+							recordId: record.record.recordId,
+							recordDigest,
+							output
+						})
+					});
+				}
+				const prepared = yield* Schema.decodeEffect(PreparedActivity)(work).pipe(Effect.mapError(() => invalid("Malformed prepared activity")));
+				if (!Schema.toEquivalence(ActivityProcessorKey)(prepared.key, key) || prepared.sequence !== record.sequence || prepared.workId !== workId || prepared.recordId !== record.record.recordId || prepared.recordDigest !== recordDigest) return yield* contiguous();
+				yield* Effect.scoped(processor.apply(prepared));
+				const next = yield* progress.advance({
+					claim,
+					workId
+				}).pipe(Effect.flatMap((value) => Schema.decodeEffect(ActivityClaim)(value).pipe(Effect.mapError(() => invalid("Malformed activity progress")))));
+				if (!Schema.toEquivalence(ActivityProcessorKey)(next.key, key) || next.owner !== claim.owner || next.epoch !== claim.epoch || next.throughSequence !== record.sequence || next.pending !== null) return yield* invalid("Activity progress advanced outside the claimed record");
+				claim = next;
+				processed += 1;
+			}
+		}
+		return ActivityPassResult.make({
+			key,
+			capturedTail: tail.tailSequence,
+			throughSequence: claim.throughSequence,
+			processed,
+			pendingRecords: tail.tailSequence - claim.throughSequence,
+			startedAt,
+			finishedAt: yield* Clock.currentTimeMillis
+		});
+	})).pipe(Effect.timeoutOrElse({
+		duration: limits.timeoutMillis,
+		orElse: () => Effect.fail(ActivityProcessingError.make({
+			reason: "timeout",
+			message: "Activity pass timed out"
+		}))
+	}));
+});
+//#endregion
+export { ActivityPassLimits, ActivityPassResult, ActivityProcessingError, activityWorkId, processCommittedActivity, CommittedActivity_exports as t };
+
+//# sourceMappingURL=CommittedActivity.mjs.map