effect-agent 0.1.0-beta.96 → 0.1.0-beta.98

package/dist/{DurableAgentRuntime-BGwGUIT-.mjs → DurableAgentRuntime-gF4YiEj2.mjs}

@@ -7,24 +7,25 @@ import { Update, UpdateError } from "./core/AgentUpdates.mjs";
 import { AgentApprovalDenied, AgentApprovalPending, AgentInputError, AgentToolAuthorizationDenied, PolicyLimit } from "./core/AgentError.mjs";
 import { IdGenerator as IdGenerator$1 } from "./core/IdGenerator.mjs";
 import { DelegationDepth, SubagentBudgetReservation, SubagentDelegationCaps, SubagentGrant, SubagentParentLink, SubagentReservationAmounts, getToolExecutionKind } from "./core/SubagentContract.mjs";
-import { o as Selection } from "./ToolExposure-C93U1sPu.mjs";
+import { o as Selection, s as Snapshot } from "./ToolExposure-C93U1sPu.mjs";
 import { ChildRunUsage, InputTokenUsage, ModelUsageGroup, OutputTokenUsage, RunUsageReport, RunUsageSummary, emptyRunTotals, runTotalsFromSummary, sumRunTotals, summarizeModelUsage, unknownRunTotals } from "./core/Usage.mjs";
 import { FrameworkMessage, WorkerCompletion, WorkerError, WorkerHistoryEntry, WorkerRef, WorkerUpdate } from "./core/Worker.mjs";
 import { a as PeerMessageCapacity, d as MessageAdmission, f as MessageRef, h as PeerName, i as PeerDeliveryLifetime, m as MessagingError, o as PeerRoutes, p as MessageStatus, r as PeerAuthorizer, t as MessagingHost } from "./MessagingHost-CWi_PP3g.mjs";
 import { SubagentHost } from "./engine/SubagentHost.mjs";
 import { ThreadHistory } from "./engine/ThreadHistory.mjs";
 import { n as RunToolVisibility } from "./ToolExposure-9uF_Yo0T.mjs";
-import { c as decodeFinalOutput, d as projectCompletionOutput, f as renderInputPrompt, l as encodeRunDisposition, n as AgentChildPending, u as projectCompletionFromToolOutput, y as streamWithUsageAccountingUnknown } from "./AgentRuntime-Cdvqw7l_.mjs";
+import { f as renderInputPrompt, n as AgentChildPending, y as streamWithUsageAccountingUnknown } from "./AgentRuntime-BWOnNc0d.mjs";
+import { ContextRolloverTool } from "./engine/ContextWindow.mjs";
 import { getToolExecutionClass } from "./engine/DurableStep.mjs";
 import { CompactionError, ContextCompactor } from "./engine/ContextCompactor.mjs";
 import { RunPolicyUsage } from "./core/RunPolicyUsage.mjs";
 import { AgentUpdateAcceptance, CurrentToolFailureObserver, ModelUsageAccounting, RunContextPreparation, RunContextPreparationPassthrough, RunToolAuthorization, RunToolScheduling } from "./engine/RunOptions.mjs";
-import { $ as ToolCallSettled, B as SubagentJoined, E as ProducerEpoch, G as SubmissionSettledRecord, H as SubagentRequested, I as RunPolicyUsageReserved, J as ToolApprovalDecided, K as SubtreeBudgetReserved, L as RunStartedRecord, O as RecordEnvelope, P as RunDurationExhausted, Q as ToolCallResolved, R as SettlementFailureDiagnostic, T as PersistedJson, U as SubagentStarted, V as SubagentLineageRecorded, W as SubmissionSettled, X as ToolCallPrepared, Y as ToolApprovalRequested, at as WorkerInputRequested, c as CanonicalRecordEnvelope, ct as WorkerReportPrepared, d as CompactionCreated, et as ToolCallUnknown, h as Digest, i as BatchId, it as WorkerInputCompleted, j as RepairAnnotated, k as RecordId, lt as WorkerReportRefused, n as AgentUpdateEmitted, nt as UserInputRecorded, o as CanonicalBatch, ot as WorkerOrigin, p as DefinitionDigests, q as ThreadCreated, rt as WorkerAdmission, st as WorkerOriginRecorded, t as AbortRequested, tt as ToolStepSettled, u as CanonicalSequence, ut as WorkerReportingIntent, w as PeerMessagePrepared, x as ModelResponseInterrupted } from "./Records-BEz5IFUu.mjs";
+import { $ as ToolCallSettled, B as SubagentJoined, E as ProducerEpoch, G as SubmissionSettledRecord, H as SubagentRequested, I as RunPolicyUsageReserved, J as ToolApprovalDecided, K as SubtreeBudgetReserved, L as RunStartedRecord, O as RecordEnvelope, P as RunDurationExhausted, Q as ToolCallResolved, R as SettlementFailureDiagnostic, T as PersistedJson, U as SubagentStarted, V as SubagentLineageRecorded, W as SubmissionSettled, X as ToolCallPrepared, Y as ToolApprovalRequested, at as WorkerAdmission, c as CanonicalRecordEnvelope, ct as WorkerOrigin, d as CompactionCreated, dt as WorkerReportRefused, et as ToolCallUnknown, ft as WorkerReportingIntent, h as Digest, i as BatchId, it as UserInputRecorded, j as RepairAnnotated, k as RecordId, lt as WorkerOriginRecorded, n as AgentUpdateEmitted, nt as ToolStepSettled, o as CanonicalBatch, ot as WorkerInputCompleted, p as DefinitionDigests, q as ThreadCreated, rt as ToolUnavailable, st as WorkerInputRequested, t as AbortRequested, tt as ToolOperation, u as CanonicalSequence, ut as WorkerReportPrepared, w as PeerMessagePrepared, x as ModelResponseInterrupted } from "./Records-DR1xtbXY.mjs";
 import { AbortCommand, AbortIntentRequest, AdmissionPolicyError, AdmissionRequest, ApprovalDecisionCommand, ApprovalPendingSuspension, AttachChildToReservationRequest, BeginChildBudgetReleaseRequest, ChildBudgetReservationRequest, ChildReservationId, ChildSettledNotification, ClaimJoiningRequest, ClaimRequest, LedgerError, MarkInputAppliedRequest, MarkJoinedRequest, MarkReadyRequest, MarkUnknownRequest, OwnershipToken, ParentLinkage, RecoverySnapshotRequest, ReleaseChildBudgetRequest, ReleaseOwnershipRequest, RenewOwnershipRequest, RevertJoiningRequest, Settlement, SettlementFinalization, SettlementReservation, SubmissionLedger, SubmissionLookupById, SubmissionLookupByKey, SuspendRequest, UnknownResolutionCommand, WaitingChild, WaitingForChildSuspension, submissionAbortBatchId, submissionAbortRecordId, submissionInputBatchId, submissionInputRecordId, submissionSettlementBatchId, submissionSettlementId, submissionSettlementRecordId } from "./durable/SubmissionLedger.mjs";
 import { DeclaredPendingBatchEvidence, OpenDelegationCallEvidence, OpenToolCallEvidence, PendingApprovalEvidence, RecoveryDecision, RecoveryEvidence, classifyRecovery } from "./durable/Recovery.mjs";
 import { ExplainedEvidence, ExplainedSubmission, ExplainedUnknownCall, IntegrityCheck, IntegrityReport, ObligationEntry, ObligationReport, RecoveryExplanation, RetryRefused, obligationSeverityOf, predictRecoveryDisposition, recoveryDecisionMeaning } from "./durable/Admin.mjs";
 import { digestJson } from "./durable/Digest.mjs";
-import { a as bindingSupports, d as resolveWorkerBinding, l as makeLegacyWorkerBinding, o as compileRegistrations, r as BindingUnavailable, s as definitionDigestsEqual, u as resolveDefinitionBinding } from "./agent-registration-BTa5vmQF.mjs";
+import { a as definitionDigestsEqual, c as resolveWorkerBinding, i as compileRegistrations, l as toolReplayContracts, o as makeLegacyWorkerBinding, s as resolveDefinitionBinding, t as BindingUnavailable } from "./agent-registration-cXpB8cBU.mjs";
 import { FencedAppendRequest, LoadCheckpointRequest, SaveRecoveryCheckpointRequest, ThreadCheckpoint, ThreadExportRequest, ThreadMaterialization, ThreadObservation, ThreadRead, ThreadStore, ThreadStoreError, ThreadTailRequest } from "./durable/ThreadStore.mjs";
 import { DurableRuntimeFailpoint } from "./durable/DurableFailpoint.mjs";
 import { ScheduledInputRefused, ScheduledInputRetryable } from "./durable/Schedule.mjs";
@@ -32,7 +33,7 @@ import { PreparedInputAdmission } from "./durable/PreparedInputAdmission.mjs";
 import { PreparedInput } from "./durable/Subscription.mjs";
 import { MessageDeliveryDriver, MessageDeliveryFailpoint, MessageDeliveryRecord, MessageDeliveryStore, messageDeliveryCapacity, messageDeliveryUsesCapacity, prepareMessageDelivery } from "./durable/MessageDelivery.mjs";
 import { n as safeUnknownString, t as inspectForeignDiagnostic } from "./foreign-diagnostic-DBQ1XHKh.mjs";
-import { A as toolApprovalRequestRecordId, C as subagentLineageBatchId, D as subagentStartedBatchId, E as subagentRequestedRecordId, F as toolCallSettledRecordId, H as turnIdForRun, I as toolCallUnknownRecordId, J as makeJournalMetadata, K as turnResultsBatch, L as toolStepSettledBatchId, M as toolCallResolutionBatchId, N as toolCallResolvedRecordId, O as subagentStartedRecordId, P as toolCallResultBatchId, R as toolStepSettledRecordId, S as subagentJoinedRecordId, T as subagentRequestedBatchId, U as turnPreparedBatchId, V as turnCanonicalBatch, W as turnResponseBatch, _ as runDurationRecordId, a as childThreadIdFor, b as runStartedRecordId, c as markUnknownBatchId, d as modelResponseRecordId, g as runDurationBatchId, h as runCompletedRecordId, i as childIdempotencyKeyFor, j as toolCallPreparedRecordId, k as toolApprovalDecisionRecordId, l as modelResponseInterruptedBatchId, o as compactionBatchId, p as projectRunJournalStream, r as approvalDecisionBatchId, s as compactionRecordId, t as RunJournalError, u as modelResponseInterruptedRecordId, v as runIdForSubmission, w as subagentLineageRecordId, x as subagentJoinBatchId, y as runStartedBatchId, z as turnApprovalsBatchId } from "./RunJournal-B_fxe57c.mjs";
+import { A as toolApprovalDecisionRecordId, B as turnApprovalsBatchId, C as subagentJoinedRecordId, D as subagentRequestedRecordId, E as subagentRequestedBatchId, F as toolCallResultBatchId, G as turnResponseBatch, H as turnCanonicalBatch, I as toolCallSettledRecordId, L as toolCallUnknownRecordId, M as toolCallPreparedRecordId, N as toolCallResolutionBatchId, O as subagentStartedBatchId, P as toolCallResolvedRecordId, R as toolStepSettledBatchId, S as subagentJoinBatchId, T as subagentLineageRecordId, U as turnIdForRun, W as turnPreparedBatchId, Y as makeJournalMetadata, _ as runDurationBatchId, a as childThreadIdFor, b as runStartedBatchId, c as markUnknownBatchId, d as modelResponseRecordId, g as runCompletionDigest, h as runCompletedRecordId, i as childIdempotencyKeyFor, j as toolApprovalRequestRecordId, k as subagentStartedRecordId, l as modelResponseInterruptedBatchId, o as compactionBatchId, p as projectRunJournalStream, q as turnResultsBatch, r as approvalDecisionBatchId, s as compactionRecordId, t as RunJournalError, u as modelResponseInterruptedRecordId, v as runDurationRecordId, w as subagentLineageBatchId, x as runStartedRecordId, y as runIdForSubmission, z as toolStepSettledRecordId } from "./RunJournal-DNs3PM4K.mjs";
 import { WorkerBudgetAuthorizer, WorkerConcurrencyLimit, WorkerConcurrencyResolver, WorkerHostAuthorizer, WorkerHostConfig, WorkerPolicyResolver } from "./durable/WorkerHost.mjs";
 import { OperationAuthorizationRequest, OperationAuthorizer, OperationDenied } from "./durable/OperationAuthorizer.mjs";
 import { PendingSubmission, SettledSubmission } from "./durable/SubmissionStatus.mjs";
@@ -272,7 +273,7 @@ const makeMessagingRuntime = Effect.fn("MessagingHost.make")(function* (options)
 		const log = yield* read(threadId);
 		const created = log.records[0]?.record.payload;
 		if (created?._tag !== "ThreadCreated") return yield* failure$1("context", "not-found");
-		if (deps.bindings.filter((binding) => binding.agentId === created.agentId && bindingSupports(binding, created.definitions)).length !== 1) return yield* failure$1("context", "binding-mismatch");
+		if (deps.bindings.filter((binding) => binding.agentId === created.agentId).length !== 1) return yield* failure$1("context", "binding-mismatch");
 		return {
 			log,
 			address: {
@@ -375,7 +376,7 @@ const makeMessagingRuntime = Effect.fn("MessagingHost.make")(function* (options)
 				if (prior !== void 0) {
 					saved = yield* decodeProof(prior);
 					const metadata = saved.envelope.messageAdmission;
-					if (!Schema.is(MessageAdmission)(metadata) || metadata.peerName !== request.name || saved.envelope.agentId !== target.agentId || !bindingSupports(target, saved.envelope.definitions) || !sameJson$1(saved.envelope.input, input) || (inReplyTo === void 0 || metadata.inReplyTo === void 0 ? inReplyTo !== metadata.inReplyTo : !sameRef(inReplyTo, metadata.inReplyTo))) return yield* failure$1(operation, "conflict");
+					if (!Schema.is(MessageAdmission)(metadata) || metadata.peerName !== request.name || saved.envelope.agentId !== target.agentId || !sameJson$1(saved.envelope.input, input) || (inReplyTo === void 0 || metadata.inReplyTo === void 0 ? inReplyTo !== metadata.inReplyTo : !sameRef(inReplyTo, metadata.inReplyTo))) return yield* failure$1(operation, "conflict");
 					yield* authorize(operation, "send", request, {
 						threadId: saved.envelope.threadId,
 						agentId: target.agentId
@@ -676,11 +677,15 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			...report.destination === void 0 ? {} : { destinationDelegationId: report.destination.delegationId }
 		};
 	});
+	const currentBinding = (agentId) => {
+		const matches = deps.bindings.filter((entry) => entry.agentId === agentId);
+		return matches.length === 1 ? matches[0] : void 0;
+	};
 	const sourceAuthority = Effect.fn("WorkerHost.sourceAuthority")(function* (threadId, submissionId) {
 		const current = yield* read(threadId, "start");
 		const created = current.records[0]?.record.payload;
 		if (created?._tag !== "ThreadCreated") return yield* failure("start", "not-found");
-		const binding = deps.bindings.find((entry) => entry.agentId === created.agentId && bindingSupports(entry, created.definitions));
+		const binding = currentBinding(created.agentId);
 		const worker = current.records.find(({ record }) => record.payload._tag === "WorkerOriginRecorded")?.record.payload;
 		const attached = current.records.find(({ record }) => record.payload._tag === "SubagentLineageRecorded")?.record.payload;
 		const nested = worker?._tag === "WorkerOriginRecorded" || attached?._tag === "SubagentLineageRecorded";
@@ -693,9 +698,11 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			if (worker?._tag === "WorkerOriginRecorded" && (submission.value.workerAdmission === void 0 || !sameOrigin(submission.value.workerAdmission.origin, worker.origin))) return yield* failure("start", "denied");
 			if (attached?._tag === "SubagentLineageRecorded" && (submission.value.parentLinkage?.parentSubmissionId !== attached.parentSubmissionId || submission.value.parentLinkage.parentToolCallId !== attached.parentLink.parentToolCallId)) return yield* failure("start", "denied");
 		}
+		const ownerBinding = ownerSubmission === void 0 ? void 0 : currentBinding(ownerSubmission.agentId);
+		const selectedBinding = ownerBinding ?? binding;
 		if (worker?._tag === "WorkerOriginRecorded") return {
 			current,
-			binding,
+			binding: selectedBinding,
 			submission: ownerSubmission,
 			policyOverride: Option.none(),
 			policy: worker.origin.policy,
@@ -708,7 +715,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			if (attached.policy === void 0 || attached.budget === void 0 || attached.grant === void 0) return yield* failure("start", "denied");
 			return {
 				current,
-				binding,
+				binding: selectedBinding,
 				submission: ownerSubmission,
 				policyOverride: Option.none(),
 				policy: attached.policy,
@@ -718,8 +725,6 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 				depth: attached.parentLink.depth
 			};
 		}
-		const ownerBinding = ownerSubmission === void 0 ? void 0 : deps.bindings.find((entry) => entry.agentId === ownerSubmission.agentId && bindingSupports(entry, ownerSubmission.agentDigests));
-		const selectedBinding = ownerBinding ?? binding;
 		const changedRootAgent = ownerSubmission !== void 0 && ownerSubmission.agentId !== created.agentId;
 		if (selectedBinding === void 0 || changedRootAgent && ownerBinding === void 0) return yield* failure("start", "declaration-unavailable");
 		const selected = yield* deps.policyResolver.resolveSource({
@@ -729,7 +734,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			...ownerSubmission === void 0 ? {} : { submission: ownerSubmission }
 		});
 		if (Option.isSome(selected) && ownerSubmission !== void 0 && ownerBinding === void 0) return yield* failure("start", "declaration-unavailable");
-		const effectiveBinding = Option.isSome(selected) || changedRootAgent ? selectedBinding : binding;
+		const effectiveBinding = Option.isSome(selected) || changedRootAgent || binding === void 0 ? selectedBinding : binding;
 		if (effectiveBinding === void 0) return yield* failure("start", "declaration-unavailable");
 		const policy = Option.isNone(selected) ? effectiveBinding.definition.policy : yield* decode(AgentPolicy, selected.value, "start");
 		return {
@@ -802,7 +807,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 		}
 		return yield* failure("start", "storage");
 	});
-	const reservation = Effect.fn("WorkerHost.reserveInput")(function* (admission, inputDigest, input, principal) {
+	const reservation = Effect.fn("WorkerHost.reserveInput")(function* (admission, inputDigest, input, principal, retainedFrameworkInput) {
 		const origin = admission.origin;
 		const id = `worker-input:${admission.messageId}`;
 		for (let attempt = 0; attempt < 16; attempt++) {
@@ -823,9 +828,9 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			if (prior === void 0 && admission.messageId !== origin.firstMessageId) return yield* failure("start", "not-found");
 			const caps = origin.budget.caps;
 			const sourceBinding = source.binding;
-			const targetBinding = deps.bindings.find((entry) => entry.agentId === origin.worker.targetAgentId && bindingSupports(entry, origin.targetDigests));
+			const targetBinding = currentBinding(origin.worker.targetAgentId);
 			if (sourceBinding === void 0 || targetBinding === void 0) return yield* failure("start", "declaration-unavailable");
-			yield* Schema.decodeEffect(Schema.toEncoded(targetBinding.definition.input))(input).pipe(Effect.mapError(() => failure("start", "corrupt")));
+			if (!retainedFrameworkInput) yield* Schema.decodeEffect(Schema.toEncoded(targetBinding.definition.input))(input).pipe(Effect.mapError(() => failure("start", "corrupt")));
 			const targetRequest = {
 				definition: targetBinding.definition,
 				definitions: targetBinding.digests,
@@ -922,7 +927,9 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 		});
 		yield* authorizeBudget(admission.origin, options.principal);
 		if (admission.origin.worker.threadId !== options.threadId || admission.origin.worker.targetAgentId !== agentId || !definitionDigestsEqual(admission.origin.targetDigests, options.definitions) || options.idempotencyKey !== admission.messageId || admission.deliveryPrincipal !== void 0 && admission.deliveryPrincipal !== options.principal) return yield* failure("start", "worker-mismatch");
-		yield* reservation(admission, inputDigest, input, options.principal);
+		const retainedFrameworkInput = Schema.is(FrameworkMessage)(options.messageAdmission);
+		if (retainedFrameworkInput && admission.reportKind !== "update") yield* validateCompletion(options.messageAdmission, options, agentId, inputDigest);
+		yield* reservation(admission, inputDigest, input, options.principal, retainedFrameworkInput);
 		return admission;
 	});
 	const prepareUpdate = Effect.fn("WorkerHost.prepareUpdate")(function* (update, submission, messageId) {
@@ -930,23 +937,22 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 		const intent = origin?.reporting;
 		if (origin === void 0 || intent?.mode !== "standard") return void 0;
 		if (update.threadId !== submission.threadId || update.agentId !== origin.worker.targetAgentId) return yield* failure("followUp", "worker-mismatch");
-		const sourceBinding = deps.bindings.find((entry) => entry.agentId === origin.source.agentId && bindingSupports(entry, intent.sourceDigests));
-		const targetBinding = deps.bindings.find((entry) => entry.agentId === origin.worker.targetAgentId && bindingSupports(entry, origin.targetDigests));
-		const reports = sourceBinding?.reporting?.filter((entry) => entry.delegationId === origin.worker.delegationId) ?? [];
-		if (sourceBinding === void 0 || targetBinding === void 0 || reports.length !== 1 || reports[0]?.mode !== "standard" || reports[0].target !== targetBinding.definition || !definitionDigestsEqual(submission.agentDigests, origin.targetDigests)) return yield* failure("followUp", "declaration-unavailable");
 		const sourceHistory = yield* read(origin.source.threadId, "followUp");
 		const first = requests(sourceHistory.records).find((row) => row.admission.messageId === origin.firstMessageId);
 		if (first === void 0 || !sameOrigin(first.admission.origin, origin)) return yield* failure("followUp", "corrupt");
 		const source = yield* sourceAuthority(origin.source.threadId, first.admission.sourceSubmissionId);
-		if (source.binding === void 0 || source.submission === void 0 || !bindingSupports(source.binding, intent.sourceDigests)) return yield* failure("followUp", "declaration-unavailable");
+		if (source.binding === void 0 || source.submission === void 0) return yield* failure("followUp", "declaration-unavailable");
+		const sourceBinding = currentBinding(origin.source.agentId);
+		const targetBinding = currentBinding(origin.worker.targetAgentId);
+		const reports = sourceBinding?.reporting?.filter((entry) => entry.delegationId === origin.worker.delegationId) ?? [];
+		if (sourceBinding === void 0 || targetBinding === void 0 || reports.length !== 1 || reports[0]?.mode !== "standard" || reports[0].target !== targetBinding.definition || !definitionDigestsEqual(submission.agentDigests, origin.targetDigests)) return yield* failure("followUp", "declaration-unavailable");
 		const recorded = source.current.records.find(({ record }) => record.payload._tag === "WorkerOriginRecorded")?.record.payload;
 		const receivingOrigin = recorded?._tag === "WorkerOriginRecorded" ? recorded.origin : void 0;
 		if (source.depth !== 0 && receivingOrigin === void 0) return yield* failure("followUp", "denied");
 		const now = yield* Clock.currentTimeMillis;
 		const deadlineAtMillis = Math.min(origin.expiresAtMillis, receivingOrigin?.expiresAtMillis ?? Infinity);
 		if (now >= deadlineAtMillis) return yield* failure("followUp", "denied");
-		const sourceSubmission = source.submission;
-		const input = yield* Schema.decodeEffect(Schema.toEncoded(sourceBinding.definition.input))(source.submission.inputPayload).pipe(Effect.flatMap(() => Schema.decodeEffect(PersistedJson)(sourceSubmission.inputPayload)), Effect.mapError(() => failure("followUp", "corrupt")));
+		const input = source.submission.inputPayload;
 		let workerAdmission;
 		let principal = submission.principal;
 		if (receivingOrigin !== void 0) {
@@ -1029,11 +1035,6 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 				messageId,
 				reason
 			});
-			const sourceBinding = deps.bindings.find((entry) => entry.agentId === origin.source.agentId && bindingSupports(entry, intent.sourceDigests));
-			const targetBinding = deps.bindings.find((entry) => entry.agentId === origin.worker.targetAgentId && bindingSupports(entry, origin.targetDigests));
-			const reports = sourceBinding?.reporting?.filter((entry) => entry.delegationId === origin.worker.delegationId) ?? [];
-			const descriptor = reports[0];
-			if (sourceBinding === void 0 || targetBinding === void 0 || descriptor === void 0 || reports.length !== 1 || !Object.is(descriptor.target, targetBinding.definition) || descriptor.mode !== "standard" && !Object.is(descriptor.input, sourceBinding.definition.input) || descriptor.mode !== intent.mode || descriptor.destination?.delegationId !== intent.destinationDelegationId || descriptor.destination !== void 0 && !Object.is(descriptor.destination.target, sourceBinding.definition)) return refused("declaration-unavailable");
 			const selected = yield* deps.ledger.lookup(SubmissionLookupById.make({ submissionId: host.submissionId })).pipe(Effect.mapError(storageFailure("inspect")));
 			if (Option.isNone(selected) || selected.value.threadId !== submission.threadId || selected.value.receiptId !== host.receiptId || selected.value.workerAdmission === void 0 || !sameOrigin(selected.value.workerAdmission.origin, origin)) return yield* failure("inspect", "corrupt");
 			const hostSubmission = selected.value;
@@ -1042,7 +1043,12 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			const firstInput = requests(sourceHistory.records).find((row) => row.admission.messageId === origin.firstMessageId);
 			if (firstInput === void 0 || !sameOrigin(firstInput.admission.origin, origin)) return yield* failure("inspect", "corrupt");
 			const source = yield* sourceAuthority(origin.source.threadId, firstInput.admission.sourceSubmissionId);
-			if (source.binding === void 0 || !bindingSupports(source.binding, intent.sourceDigests)) return refused("declaration-unavailable");
+			if (source.binding === void 0) return refused("declaration-unavailable");
+			const sourceBinding = currentBinding(origin.source.agentId);
+			const targetBinding = currentBinding(origin.worker.targetAgentId);
+			const reports = sourceBinding?.reporting?.filter((entry) => entry.delegationId === origin.worker.delegationId) ?? [];
+			const descriptor = reports[0];
+			if (sourceBinding === void 0 || targetBinding === void 0 || descriptor === void 0 || reports.length !== 1 || !Object.is(descriptor.target, targetBinding.definition) || descriptor.mode !== "standard" && !Object.is(descriptor.input, sourceBinding.definition.input) || descriptor.mode !== intent.mode || descriptor.destination?.delegationId !== intent.destinationDelegationId || descriptor.destination !== void 0 && !Object.is(descriptor.destination.target, sourceBinding.definition)) return refused("declaration-unavailable");
 			const sourceOriginRecord = source.current.records.find(({ record }) => record.payload._tag === "WorkerOriginRecorded")?.record.payload;
 			const sourceOrigin = sourceOriginRecord?._tag === "WorkerOriginRecorded" ? sourceOriginRecord.origin : void 0;
 			if (source.depth !== 0 && sourceOrigin === void 0) return refused("destination");
@@ -1087,7 +1093,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 				if (!Schema.toEquivalence(WorkerRef)(message.report.worker, origin.worker) || !Schema.toEquivalence(Receipt)(message.report.receipt, report.observation.receipt) || message.report.runId !== runId || message.report.settlementId !== host.settlementId || message.report.outcome !== host.outcome || message.budgetExhausted !== report.observation.budgetExhausted) return refused("input");
 			} else if (projection.value.message !== void 0) return refused("input");
 			const reportInput = descriptor.mode === "standard" ? source.submission?.inputPayload : projection.value.encodedInput;
-			const validated = yield* Schema.decodeEffect(Schema.toEncoded(sourceBinding.definition.input))(reportInput).pipe(Effect.flatMap(() => Schema.decodeUnknownEffect(PersistedJson)(reportInput)), Effect.option);
+			const validated = yield* (descriptor.mode === "standard" ? Schema.decodeUnknownEffect(PersistedJson)(reportInput) : Schema.decodeEffect(Schema.toEncoded(sourceBinding.definition.input))(reportInput).pipe(Effect.flatMap(() => Schema.decodeUnknownEffect(PersistedJson)(reportInput)))).pipe(Effect.option);
 			if (Option.isNone(validated)) return refused("input");
 			const input = validated.value;
 			const inputDigest = yield* withCrypto(digestJson(input)).pipe(Effect.mapError(storageFailure("inspect")));
@@ -1236,12 +1242,12 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			};
 		});
 		const findOrigin = Effect.fn("WorkerHost.findOrigin")(function* (worker, target, operation) {
-			const resolved = yield* binding(target, operation);
+			yield* binding(target, operation);
 			if (worker.targetAgentId !== target.id) return yield* failure(operation, "worker-mismatch");
 			const source = yield* read(context.source.threadId, operation);
 			const origin = requests(source.records).find((row) => row.admission.origin.worker.threadId === worker.threadId)?.admission.origin;
 			if (origin === void 0) return yield* failure(operation, "not-found");
-			if (origin.worker.delegationId !== worker.delegationId || !bindingSupports(resolved, origin.targetDigests)) return yield* failure(operation, "worker-mismatch");
+			if (origin.worker.delegationId !== worker.delegationId) return yield* failure(operation, "worker-mismatch");
 			return origin;
 		});
 		const receiptInput = Effect.fn("WorkerHost.receiptInput")(function* (request, operation) {
@@ -1418,7 +1424,7 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 						threadId: Schema.decodeSync(ThreadId)(messageId)
 					},
 					source: existing?.envelope.workerAdmission?.origin.source ?? context.source,
-					targetDigests: resolved.digests,
+					targetDigests: previousOrigin?.targetDigests ?? resolved.digests,
 					policy: request.policy,
 					budget: request.budget,
 					...request.budgetScope === void 0 ? {} : { budgetScope: request.budgetScope },
@@ -1570,12 +1576,12 @@ const makeWorkerRuntime = Effect.fn("WorkerHost.make")(function* (options) {
 			const current = yield* read(sourceThreadId, "context");
 			const created = current.records[0]?.record.payload;
 			if (created?._tag !== "ThreadCreated") return yield* failure("context", "not-found");
-			const resolved = deps.bindings.find((entry) => entry.agentId === created.agentId && bindingSupports(entry, created.definitions));
+			const selected = request.sourceSubmissionId === void 0 ? void 0 : yield* sourceAuthority(sourceThreadId, request.sourceSubmissionId);
+			const resolved = selected === void 0 ? currentBinding(created.agentId) : selected.binding;
 			if (resolved === void 0) return yield* failure("context", "declaration-unavailable");
 			const origin = current.records.find(({ record }) => record.payload._tag === "WorkerOriginRecorded")?.record.payload;
 			const attached = current.records.find(({ record }) => record.payload._tag === "SubagentLineageRecorded")?.record.payload;
 			const retained = origin?._tag === "WorkerOriginRecorded" ? origin.origin : attached?._tag === "SubagentLineageRecorded" ? attached : void 0;
-			const selected = request.sourceSubmissionId === void 0 ? void 0 : yield* sourceAuthority(sourceThreadId, request.sourceSubmissionId);
 			return facet({
 				source: {
 					_tag: "programmatic",
@@ -1729,7 +1735,7 @@ var RecoveryReport = class extends Schema.Class("@effect-agent/thread/RecoveryRe
 	decision: RecoveryDecision,
 	/**
 	* `repaired` = executed; `deferred` = a claiming worker must finish it; `none` = settled;
-	* `unknown` = the lane is durably blocked on an Unknown Outcome awaiting the authorized
+	* `unknown` = this Submission is parked on an Unknown Outcome awaiting the authorized
 	* DUR-017 resolution path — the settlement obligation stays visible while no worker permit
 	* is consumed (durability §16).
 	*/
@@ -1866,18 +1872,6 @@ const declaredToolCalls = Effect.fn("DurableAgentRuntime.declaredToolCalls")((me
 })));
 /** Application calls alone drive durable preparation, settlement, and batch resume. */
 const declaredApplicationCalls = Effect.fn("DurableAgentRuntime.declaredApplicationCalls")((messages) => declaredToolCalls(messages).pipe(Effect.map(({ application }) => application)));
-/** Rebuild the exact JSON text that the engine decoded from one terminal no-Tool response. */
-const terminalAssistantText = Effect.fn("DurableAgentRuntime.terminalAssistantText")((messages) => decodePrompt(messages).pipe(Effect.mapError((cause) => RunJournalError.make({
-	message: "ModelResponseRecorded messages are not Schema-encoded Prompt messages",
-	cause
-})), Effect.map((prompt) => {
-	let text = "";
-	for (const message of prompt.content) {
-		if (message.role !== "assistant") continue;
-		for (const part of message.content) if (part.type === "text") text += part.text;
-	}
-	return text;
-})));
 const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 	const registeredBindings = [...bindings];
 	const ledger = yield* SubmissionLedger;
@@ -1899,6 +1893,34 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 	const operationAuthorizer = yield* OperationAuthorizer;
 	const toolFailureObserver = yield* CurrentToolFailureObserver;
 	const withCrypto = (effect) => Effect.provideService(effect, Crypto.Crypto, crypto);
+	const contractsFor = (definition) => {
+		const registered = registeredBindings.filter((binding) => binding.agentId === definition.id);
+		const binding = registered.length === 1 ? registered[0] : void 0;
+		const current = binding?.definition === definition ? binding : void 0;
+		const contracts = current?.digests.replay?.tools;
+		return contracts === void 0 ? withCrypto(toolReplayContracts(definition, void 0, current?.digests.tools ?? config.deploymentId)) : Effect.succeed(contracts);
+	};
+	const currentOperationsFor = Effect.fnUntraced(function* (agentId) {
+		const registered = registeredBindings.filter((binding) => binding.agentId === agentId);
+		const binding = registered.length === 1 ? registered[0] : void 0;
+		return binding === void 0 ? void 0 : {
+			definition: binding.definition,
+			contracts: yield* contractsFor(binding.definition)
+		};
+	});
+	const operationsFor = (records, runId) => {
+		const operations = /* @__PURE__ */ new Map();
+		for (const { record: { payload } } of records) {
+			if (payload._tag !== "ModelResponseRecorded" || payload.runId !== runId) continue;
+			for (const operation of payload.toolOperations ?? []) operations.set(operation.toolCallId, operation);
+		}
+		return operations;
+	};
+	const supportsOperation = (submission, call, operation, prepared, current) => {
+		const tool = current?.definition.toolkit.tools[call.toolName];
+		const replay = operation?.replay ?? prepared?.replay ?? submission.agentDigests.replay?.tools[call.toolName];
+		return tool !== void 0 && replay !== void 0 && current?.contracts[call.toolName] === replay && (operation === void 0 || operation.toolName === call.toolName && operation.executionClass === getToolExecutionClass(tool) && operation.executionKind === getToolExecutionKind(tool.annotations)) && (prepared === void 0 || prepared.toolName === call.toolName && (prepared.executionClass === void 0 || prepared.executionClass === getToolExecutionClass(tool)) && (prepared.executionKind ?? "ordinary") === getToolExecutionKind(tool.annotations));
+	};
 	const hit = (location) => failpoint.hit(location);
 	const makeEnvelope = (recordId, payload) => Effect.map(nowUtc, (createdAt) => RecordEnvelope.make({
 		recordId,
@@ -1979,7 +2001,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		return yield* Stream.runCollect(view.canonical.pipe(Stream.filter(controlRecords(submissionIds))));
 	});
 	/** A checkpoint is useful only for its explicitly retained submissions and exact definitions. */
-	const recoveryView = Effect.fn("DurableAgentRuntime.recoveryView")(function* (threadId, throughSequence, submissionIds) {
+	const recoveryView = Effect.fn("DurableAgentRuntime.recoveryView")(function* (threadId, throughSequence, submissionIds, journalOwner) {
 		const full = { canonical: canonicalRange(threadId, throughSequence) };
 		if (store.recoveryCheckpoints === void 0) return full;
 		const loaded = yield* store.recoveryCheckpoints.load(LoadCheckpointRequest.make({
@@ -1992,7 +2014,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const decoded = yield* Schema.decodeUnknownEffect(RecoveryCheckpointContents)(checkpoint.state).pipe(Effect.option);
 		if (Option.isNone(decoded)) return full;
 		const { state, digest } = decoded.value;
-		if (!submissionIds.every((id) => state.submissionIds.includes(id)) || state.seed.runId !== runIdForSubmission(state.submissionId)) return full;
+		if (!submissionIds.every((id) => state.submissionIds.includes(id)) || state.seed.runId !== runIdForSubmission(state.submissionId) || journalOwner !== void 0 && state.seed.runId !== journalOwner) return full;
 		const encoded = yield* Schema.encodeEffect(RecoveryCheckpointState)(state).pipe(Effect.mapError((cause) => ThreadStoreError.make({
 			operation: "decode recovery checkpoint",
 			message: "Invalid recovery state",
@@ -2119,6 +2141,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const preparedTurns = /* @__PURE__ */ new Set();
 		const settledIds = /* @__PURE__ */ new Set();
 		const resolvedIds = /* @__PURE__ */ new Set();
+		const unknownIds = /* @__PURE__ */ new Set();
 		const requested = [];
 		const decidedIds = /* @__PURE__ */ new Set();
 		let lastResponse;
@@ -2159,8 +2182,11 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				case "ToolCallSettled":
 					if (payload.runId === runId) settledIds.add(payload.toolCallId);
 					break;
+				case "ToolCallUnknown":
+					if (payload.runId === runId) unknownIds.add(payload.toolCallId);
+					break;
 				case "ToolCallResolved":
-					if (payload.runId === runId) resolvedIds.add(payload.toolCallId);
+					if (payload.runId === runId && (payload.resolution === "completed-with-result" || payload.resolution === "failed-with-error")) resolvedIds.add(payload.toolCallId);
 					break;
 				case "ToolApprovalRequested":
 					if (payload.runId !== runId) break;
@@ -2241,8 +2267,8 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			}));
 		}
 		const isPreparedWorker = (call) => preparedKinds.get(toolCallPreparedRecordId(runId, call.turn, call.toolCallId)) === "orchestration";
-		const openWorkerCalls = allOpenCalls.filter(isPreparedWorker);
-		const openToolCalls = allOpenCalls.filter((call) => !isPreparedDelegation(call) && !isPreparedWorker(call));
+		const openWorkerCalls = allOpenCalls.filter((call) => isPreparedWorker(call) && !unknownIds.has(call.toolCallId));
+		const openToolCalls = allOpenCalls.filter((call) => unknownIds.has(call.toolCallId) || !isPreparedDelegation(call) && !isPreparedWorker(call));
 		let declaredPendingBatch;
 		if (lastResponse !== void 0 && !preparedTurns.has(lastResponse.turn)) {
 			const declared = yield* declaredApplicationCalls(lastResponse.messages);
@@ -2267,6 +2293,25 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			...hostSettlementOutcome === void 0 ? {} : { hostSettlementOutcome }
 		});
 	});
+	/** Verify immutable preparation against the original declaration before any recovery side effect. */
+	const validatePreparedCall = Effect.fnUntraced(function* (prepared, declared, operations) {
+		const call = declared.application.find((call) => call.id === prepared.toolCallId);
+		if (call === void 0 || prepared.toolName !== call.name) return yield* RunJournalError.make({ message: `Prepared Tool ${prepared.toolCallId} differs from its original declaration` });
+		const parameters = yield* decodePersisted(call.params).pipe(Effect.mapError((cause) => RunJournalError.make({
+			message: "Invalid canonical Tool parameters",
+			cause
+		})));
+		const declarationDigest = yield* withCrypto(digestJson(parameters)).pipe(Effect.mapError((cause) => RunJournalError.make({
+			message: "Cannot verify declared Tool parameters",
+			cause
+		})));
+		const preparedDigest = yield* withCrypto(digestJson(prepared.parameters)).pipe(Effect.mapError((cause) => RunJournalError.make({
+			message: "Cannot verify prepared Tool parameters",
+			cause
+		})));
+		const operation = operations?.find((entry) => entry.toolCallId === prepared.toolCallId);
+		if (prepared.parametersDigest !== declarationDigest || preparedDigest !== declarationDigest || operation !== void 0 && (prepared.executionClass !== void 0 && prepared.executionClass !== operation.executionClass || (prepared.executionKind ?? "ordinary") !== operation.executionKind || prepared.replay !== void 0 && prepared.replay !== operation.replay)) return yield* RunJournalError.make({ message: `Prepared Tool ${prepared.toolCallId} differs from its original operation` });
+	});
 	/**
 	* The declared-but-unsettled Tool batch of the Run's LAST committed Turn (§2.4). Keyed on
 	* SETTLED coverage deliberately: a call closed by a never-started/safe-retry `ToolCallResolved`
@@ -2285,12 +2330,15 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 						turn: payload.turn,
 						messages: payload.messages,
 						toolParameterRejections: payload.toolParameterRejections,
+						toolOperations: payload.toolOperations,
 						...payload.toolExposure === void 0 ? {} : { toolExposure: payload.toolExposure }
 					};
 				}
 				continue;
 			}
 			if (payload._tag === "ToolCallSettled" && payload.runId === runId) settledByCallId.set(payload.toolCallId, {
+				recordId: envelope.record.recordId,
+				toolName: payload.toolName,
 				result: payload.result,
 				isFailure: payload.isFailure,
 				...payload.budgetRejected === true ? { budgetRejected: true } : {},
@@ -2301,6 +2349,18 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const declared = yield* declaredToolCalls(lastResponse.messages);
 		if (declared.application.length === 0) return void 0;
 		const calls = declared.all;
+		if (lastResponse.toolOperations !== void 0) {
+			const identities = /* @__PURE__ */ new Set();
+			for (const operation of lastResponse.toolOperations) {
+				if (identities.has(operation.toolCallId) || !declared.application.some((call) => call.id === operation.toolCallId && call.name === operation.toolName)) return yield* RunJournalError.make({ message: "Operation evidence differs from the declared Tool batch" });
+				identities.add(operation.toolCallId);
+			}
+			if (identities.size !== declared.application.length) return yield* RunJournalError.make({ message: "Declared Tool batch has incomplete operation evidence" });
+		}
+		for (const { record: { payload } } of records) {
+			if (payload._tag !== "ToolCallPrepared" || payload.runId !== runId || payload.turn !== lastResponse.turn) continue;
+			yield* validatePreparedCall(payload, declared, lastResponse.toolOperations);
+		}
 		for (const part of declared.providerResults) {
 			const result = yield* decodePersisted(part.result).pipe(Effect.mapError((cause) => RunJournalError.make({
 				message: `Invalid canonical provider result ${part.id}`,
@@ -2315,10 +2375,14 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		for (const call of calls) {
 			const recorded = settledByCallId.get(call.id);
 			if (call.providerExecuted === true && recorded === void 0) return yield* RunJournalError.make({ message: `Pending Turn lacks canonical provider result for ${call.id}` });
-			if (recorded !== void 0) settled.push({
-				id: call.id,
-				...recorded
-			});
+			if (recorded !== void 0) {
+				const { recordId, toolName, ...result } = recorded;
+				if (call.providerExecuted !== true && (toolName !== call.name || recordId !== toolCallSettledRecordId(runId, lastResponse.turn, Schema.decodeSync(ToolCallId)(call.id)))) return yield* RunJournalError.make({ message: `Settled Tool ${call.id} differs from its original declaration` });
+				settled.push({
+					id: call.id,
+					...result
+				});
+			}
 		}
 		const completionCall = declared.application[0];
 		const projectSettledCompletion = declared.application.length === 1 && completionCall !== void 0 && completionTools.includes(completionCall.name) && settledByCallId.get(completionCall.id)?.isFailure === false && !records.some(({ record }) => record.payload._tag === "RunCompleted" && record.payload.runId === runId);
@@ -2332,6 +2396,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			responseRecordId: modelResponseRecordId(runId, lastResponse.turn),
 			messages: lastResponse.messages,
 			toolParameterRejections: lastResponse.toolParameterRejections,
+			toolOperations: lastResponse.toolOperations,
 			...lastResponse.toolExposure === void 0 ? {} : { toolExposure: lastResponse.toolExposure }
 		};
 	});
@@ -2392,9 +2457,9 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		};
 	});
 	/**
-	* Append context at the Thread's CURRENT fence, without a claim. Used only where no live
-	* owner can exist (an `unknown` head is never claimable, WP2 claim rule): record-identity
-	* dedupe absorbs a racing recovery process, and a fence advance defers to the advancing owner.
+	* Existing ownership-free settlement protocol for queued aborts and joined outcomes.
+	* Its canonical settlement reservation authorizes the append; it never authorizes tool
+	* execution, unknown-resolution appends, or repair audits beside a live writer.
 	*/
 	const attemptContextAtTail = Effect.fn("DurableAgentRuntime.attemptContextAtTail")(function* (threadId) {
 		const tail = yield* store.inspectTail(ThreadTailRequest.make({ threadId }));
@@ -2538,16 +2603,28 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 	* `Uncertain` collects for Unknown marking, and a reconciler FAILURE is no proof at all (the
 	* call stays open and blocked without being marked). Nothing here ever executes a handler.
 	*/
-	const reconcileOpenCalls = Effect.fn("DurableAgentRuntime.reconcileOpenCalls")(function* (ctx, submission, snapshot, records, openCalls, knownIds, executionClassFor) {
+	const reconcileOpenCalls = Effect.fn("DurableAgentRuntime.reconcileOpenCalls")(function* (ctx, submission, snapshot, records, openCalls, knownIds, current) {
 		const submissionId = submission.submissionId;
 		const runId = runIdForSubmission(submissionId);
+		yield* pendingToolBatchFor(records, runId);
+		const operations = operationsFor(records, runId);
 		const preparedByCallId = /* @__PURE__ */ new Map();
-		for (const envelope of records) {
-			const payload = envelope.record.payload;
-			if (payload._tag === "ToolCallPrepared" && payload.runId === runId) preparedByCallId.set(payload.toolCallId, payload);
+		for (const { record } of records) {
+			const payload = record.payload;
+			if (payload._tag === "ToolCallPrepared" && payload.runId === runId && openCalls.some((call) => call.toolCallId === payload.toolCallId && call.turn === payload.turn)) {
+				if (preparedByCallId.has(payload.toolCallId) || record.recordId !== toolCallPreparedRecordId(runId, payload.turn, payload.toolCallId)) return yield* RunJournalError.make({ message: `Prepared Tool ${payload.toolCallId} has inconsistent canonical identity` });
+				preparedByCallId.set(payload.toolCallId, payload);
+			}
 		}
-		const intents = /* @__PURE__ */ new Map();
-		for (const intent of snapshot.unknownResolutions) intents.set(intent.toolCallId, intent);
+		for (const call of openCalls) {
+			const prepared = preparedByCallId.get(call.toolCallId);
+			const responses = records.filter(({ record }) => record.payload._tag === "ModelResponseRecorded" && record.payload.runId === runId && record.payload.turn === call.turn);
+			const response = responses[0]?.record;
+			if (prepared === void 0 || prepared.turn !== call.turn || prepared.toolName !== call.toolName || responses.length !== 1 || response?.payload._tag !== "ModelResponseRecorded" || response.recordId !== modelResponseRecordId(runId, call.turn) || response.payload.turnId !== turnIdForRun(runId, call.turn)) return yield* RunJournalError.make({ message: `Prepared Tool ${call.toolCallId} has no unique original response` });
+			if ((yield* withCrypto(digestJson(response.payload.messages))) !== response.payload.messagesDigest) return yield* RunJournalError.make({ message: `Original response for Tool ${call.toolCallId} has an invalid digest` });
+			yield* validatePreparedCall(prepared, yield* declaredToolCalls(response.payload.messages), response.payload.toolOperations);
+		}
+		const intents = new Map(snapshot.unknownResolutions.map((intent) => [intent.toolCallId, intent]));
 		const review = {
 			uncertain: [],
 			unproven: [],
@@ -2556,7 +2633,39 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		};
 		let recovered = 0;
 		for (const call of openCalls) {
+			const prepared = preparedByCallId.get(call.toolCallId);
+			const operation = operations.get(call.toolCallId);
+			const supported = supportsOperation(submission, call, operation, prepared, current);
 			const intent = intents.get(call.toolCallId);
+			const author = intent?.author ?? RECONCILER_AUTHOR;
+			const reason = intent?.reason ?? "A registered reconciliation policy recovered the external outcome";
+			const neverStarted = Effect.gen(function* () {
+				if (current === void 0) {
+					review.unproven.push(call);
+					return;
+				}
+				if (supported) {
+					review.retryable.push(call);
+					return;
+				}
+				const unavailable = yield* Schema.encodeEffect(ToolUnavailable)(ToolUnavailable.make({
+					toolName: call.toolName,
+					execution: "not-executed",
+					message: "This operation never started and its original implementation is unavailable. Continue with the current tools."
+				})).pipe(Effect.flatMap(decodePersisted), Effect.orDie);
+				yield* hit("tools:before-unavailable-append");
+				yield* appendClosedCall(ctx, submissionId, knownIds, call, {
+					result: {
+						value: unavailable,
+						isFailure: true
+					},
+					resolution: "never-started",
+					author,
+					reason
+				});
+				yield* hit("tools:after-unavailable-append");
+				recovered += 1;
+			});
 			if (intent !== void 0) switch (intent.resolution._tag) {
 				case "AbortSubmission": continue;
 				case "CompletedWithResult":
@@ -2566,33 +2675,29 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 							isFailure: intent.resolution.isFailure
 						},
 						resolution: intent.resolution.isFailure ? "failed-with-error" : "completed-with-result",
-						author: intent.author,
-						reason: intent.reason
+						author,
+						reason
 					});
 					recovered += 1;
 					continue;
 				case "NeverHappened":
-					yield* appendClosedCall(ctx, submissionId, knownIds, call, {
-						resolution: "never-started",
-						author: intent.author,
-						reason: intent.reason
-					});
-					review.retryable.push(call);
+					yield* neverStarted;
 					continue;
 				case "SafeToRetry":
-					yield* appendClosedCall(ctx, submissionId, knownIds, call, {
-						resolution: "safe-retry",
-						author: intent.author,
-						reason: intent.reason
-					});
-					review.retryable.push(call);
+					if (current === void 0) review.unproven.push(call);
+					else if (supported) review.retryable.push(call);
+					else review.uncertain.push(call);
 					continue;
 			}
-			if (executionClassFor(call.toolName) === "idempotent") {
+			const tool = current?.definition.toolkit.tools[call.toolName];
+			if (current === void 0 && (operation?.executionClass ?? prepared?.executionClass) === "idempotent") {
+				review.unproven.push(call);
+				continue;
+			}
+			if (supported && tool !== void 0 && getToolExecutionClass(tool) === "idempotent") {
 				review.retryable.push(call);
 				continue;
 			}
-			const prepared = preparedByCallId.get(call.toolCallId);
 			if (prepared === void 0) {
 				review.unproven.push(call);
 				continue;
@@ -2605,7 +2710,10 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				toolCallId: prepared.toolCallId,
 				toolName: prepared.toolName,
 				parameters: prepared.parameters,
-				parametersDigest: prepared.parametersDigest
+				parametersDigest: prepared.parametersDigest,
+				...prepared.executionKind === void 0 ? {} : { executionKind: prepared.executionKind },
+				...prepared.executionClass === void 0 ? {} : { executionClass: prepared.executionClass },
+				...prepared.replay === void 0 ? {} : { replay: prepared.replay }
 			})).pipe(Effect.map(Option.some), Effect.catchTag("ToolReconcilerError", () => Effect.succeed(Option.none())));
 			if (Option.isNone(reconciled)) {
 				review.unproven.push(call);
@@ -2620,14 +2728,18 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 							isFailure: decision.isFailure
 						},
 						resolution: decision.isFailure ? "failed-with-error" : "completed-with-result",
-						author: RECONCILER_AUTHOR,
-						reason: "A registered reconciliation policy recovered the external outcome"
+						author,
+						reason
 					});
 					recovered += 1;
 					continue;
 				case "NeverStarted":
+					yield* neverStarted;
+					continue;
 				case "SafeToRetry":
-					review.retryable.push(call);
+					if (current === void 0) review.unproven.push(call);
+					else if (supported) review.retryable.push(call);
+					else review.uncertain.push(call);
 					continue;
 				case "Uncertain":
 					review.uncertain.push(call);
@@ -3168,11 +3280,11 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 	* Join a settled child after parent abort or expiry without running application handlers.
 	* The canonical child outcome stays intact; the parent result records why it cannot continue.
 	*/
-	const joinSettledChildForClosedParent = Effect.fn("DurableAgentRuntime.joinSettledChildForClosedParent")(function* (ctx, parent, knownIds, subagent, reservation, toolCallId, childSubmissionId, reason) {
+	const joinSettledChildWithoutHandler = Effect.fn("DurableAgentRuntime.joinSettledChildWithoutHandler")(function* (ctx, parent, knownIds, subagent, reservation, toolCallId, childSubmissionId, reason) {
 		const runId = runIdForSubmission(parent.submissionId);
 		const request = subagent.requested.get(toolCallId);
 		if (request === void 0) return yield* LedgerError.make({
-			operation: "joinSettledChildForClosedParent",
+			operation: "joinSettledChildWithoutHandler",
 			message: `Tool Call ${toolCallId} has an attached child but no canonical SubagentRequested record`
 		});
 		const joinedRecordId = subagentJoinedRecordId(runId, toolCallId);
@@ -3182,16 +3294,21 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		else {
 			const verification = yield* verifySettledChild(parent, request, childSubmissionId);
 			if (verification._tag === "mismatch") return yield* LedgerError.make({
-				operation: "joinSettledChildForClosedParent",
+				operation: "joinSettledChildWithoutHandler",
 				message: `Child Settlement verification failed for Tool Call ${toolCallId}: ${verification.message}`
 			});
 			const verified = verification.value;
-			const boundedResult = yield* decodePersisted({
+			const boundedResult = yield* decodePersisted(reason === "unavailable" ? {
+				_tag: "ToolUnavailable",
+				toolName: subagent.preparedNames.get(toolCallId) ?? request.delegationId,
+				execution: "unavailable",
+				message: `The original delegation implementation is unavailable. Its original child settled ${verified.outcome}; no replacement child was started.`
+			} : {
 				errorTag: reason === "aborted" ? "SubagentParentAborted" : "SubagentParentDurationExceeded",
 				message: boundedText(`The parent Submission ${reason === "aborted" ? "aborted" : "exceeded its duration"}; attached child ${childSubmissionId} settled ${verified.outcome}`)
 			}).pipe(Effect.orDie);
 			finalAccounting = yield* decodePersisted({
-				basis: reason === "aborted" ? "aborted-conservative" : "duration-conservative",
+				basis: `${reason}-conservative`,
 				allocation: reservation.allocation
 			}).pipe(Effect.orDie);
 			const childRunId = runIdForSubmission(childSubmissionId);
@@ -3262,25 +3379,51 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		return open;
 	});
 	/** Release unused reservations or repair and join existing children, never admit new work. */
-	const reconcileExpiredChildren = Effect.fn("DurableAgentRuntime.reconcileExpiredChildren")(function* (ctx, parent, ownershipToken) {
+	const reconcileRetainedChildren = Effect.fn("DurableAgentRuntime.reconcileRetainedChildren")(function* (ctx, parent, ownershipToken, unavailableCalls) {
 		const snapshot = yield* ledger.loadRecoverySnapshot(RecoverySnapshotRequest.make({ submissionId: parent.submissionId }));
 		const records = yield* readControl(parent.threadId, [parent.submissionId]);
 		const runId = runIdForSubmission(parent.submissionId);
 		const pending = yield* pendingToolBatchFor(records, runId);
 		const knownIds = knownRecordIdsOf(records);
 		const subagent = subagentRecordsOf(records, runId);
+		const notExecuted = /* @__PURE__ */ new Set();
+		const waiting = [];
+		const indeterminate = /* @__PURE__ */ new Set();
+		for (const toolCallId of unavailableCalls ?? []) {
+			if (snapshot.childReservations.some((reservation) => reservation.parentToolCallId === toolCallId)) continue;
+			if (subagent.requested.has(toolCallId) || subagent.started.has(toolCallId)) return yield* LedgerError.make({
+				operation: "reconcileRetainedChildren",
+				message: "Child request has no original reservation"
+			});
+			notExecuted.add(toolCallId);
+		}
 		for (const reservation of snapshot.childReservations) {
 			const toolCallId = reservation.parentToolCallId;
-			if (reservation.status !== "reserved" || subagent.joined.has(toolCallId)) continue;
+			if (unavailableCalls !== void 0 && !unavailableCalls.has(toolCallId)) continue;
+			const joined = subagent.joined.get(toolCallId);
+			if (joined !== void 0) {
+				yield* applyReservationRelease(reservation.reservationId, joined.finalAccounting);
+				continue;
+			}
+			if (reservation.status !== "reserved") {
+				if (reservation.accounting !== void 0) yield* applyReservationRelease(reservation.reservationId, reservation.accounting);
+				if (reservation.childSubmissionId !== void 0 || subagent.started.has(toolCallId)) return yield* LedgerError.make({
+					operation: "reconcileRetainedChildren",
+					message: "Unjoined child reservation was already released"
+				});
+				notExecuted.add(toolCallId);
+				continue;
+			}
 			let started = subagent.started.get(toolCallId);
 			const request = subagent.requested.get(toolCallId);
 			if (started === void 0 && request === void 0 && reservation.childSubmissionId === void 0) {
 				yield* releaseOrphanReservation(reservation.reservationId);
+				notExecuted.add(toolCallId);
 				continue;
 			}
 			const call = pending?.calls.find((candidate) => candidate.id === toolCallId);
 			if (pending === void 0 || call === void 0 || request === void 0 || subagent.preparedNames.get(toolCallId) !== call.name || request.delegationId !== call.name || reservation.parentSubmissionId !== parent.submissionId || request.reservationId !== reservation.reservationId || request.reservationDigest !== reservation.allocationDigest || request.turn !== pending.turn || request.turnId !== pending.turnId) return yield* LedgerError.make({
-				operation: "reconcileExpiredChildren",
+				operation: "reconcileRetainedChildren",
 				message: `Tool Call ${toolCallId} has inconsistent canonical child request evidence`
 			});
 			if (started === void 0) {
@@ -3289,17 +3432,26 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 					principal: decodePrincipalSync(request.childPrincipal),
 					idempotencyKey: decodeIdempotencyKeySync(request.childIdempotencyKey)
 				}));
-				if (resolution._tag === "Indeterminate") continue;
+				if (resolution._tag === "Indeterminate") {
+					indeterminate.add(toolCallId);
+					continue;
+				}
 				if (resolution._tag === "NotAdmitted") {
 					if (reservation.childSubmissionId !== void 0) return yield* LedgerError.make({
-						operation: "reconcileExpiredChildren",
+						operation: "reconcileRetainedChildren",
 						message: `Tool Call ${toolCallId} has an attachment but no admitted child`
 					});
-					yield* releaseOrphanReservation(reservation.reservationId);
+					if (unavailableCalls === void 0) {
+						yield* releaseOrphanReservation(reservation.reservationId);
+						notExecuted.add(toolCallId);
+						continue;
+					}
+				}
+				const admission = yield* establishChildFromRequest(parent, request, unavailableCalls !== void 0);
+				if (admission._tag === "indeterminate") {
+					indeterminate.add(toolCallId);
 					continue;
 				}
-				const admission = yield* establishChildFromRequest(parent, request, false);
-				if (admission._tag === "indeterminate") continue;
 				started = SubagentStarted.make({
 					runId,
 					toolCallId,
@@ -3321,7 +3473,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			}
 			const child = yield* ledger.lookup(SubmissionLookupById.make({ submissionId: started.childSubmissionId }));
 			if (Option.isNone(child) || reservation.childSubmissionId !== void 0 && reservation.childSubmissionId !== started.childSubmissionId || request.childThreadId !== started.childThreadId || started.childThreadId !== child.value.threadId || started.childReceiptId !== child.value.receiptId || started.childRunId !== runIdForSubmission(started.childSubmissionId)) return yield* LedgerError.make({
-				operation: "reconcileExpiredChildren",
+				operation: "reconcileRetainedChildren",
 				message: `Tool Call ${call.id} has inconsistent canonical child attachment evidence`
 			});
 			yield* ledger.attachChildToReservation(AttachChildToReservationRequest.make({
@@ -3329,9 +3481,21 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				ownershipToken,
 				childSubmissionId: started.childSubmissionId
 			})).pipe(Effect.catchTag("ChildReservationConflict", conflictToLedgerError("attachChildToReservation")));
-			if (child.value.state !== "settled") continue;
-			yield* joinSettledChildForClosedParent(ctx, parent, knownIds, subagent, reservation, started.toolCallId, started.childSubmissionId, "duration");
+			if (child.value.state !== "settled") {
+				waiting.push(WaitingChild.make({
+					toolCallId,
+					childSubmissionId: started.childSubmissionId
+				}));
+				yield* wake.notify(child.value.threadId);
+				continue;
+			}
+			yield* joinSettledChildWithoutHandler(ctx, parent, knownIds, subagent, reservation, started.toolCallId, started.childSubmissionId, unavailableCalls === void 0 ? "duration" : "unavailable");
 		}
+		return {
+			notExecuted,
+			waiting,
+			indeterminate
+		};
 	});
 	/**
 	* Request-abort-and-join over every attached child of an aborting parent (spec §13.1,
@@ -3385,7 +3549,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 					message: `Attached child ${childSubmissionId} is unknown to the ledger`
 				});
 				if (child.value.state === "settled") {
-					yield* joinSettledChildForClosedParent(ctx, parent, knownIds, subagent, reservation, toolCallId, childSubmissionId, "aborted");
+					yield* joinSettledChildWithoutHandler(ctx, parent, knownIds, subagent, reservation, toolCallId, childSubmissionId, "aborted");
 					continue;
 				}
 				yield* ledger.requestAbort(AbortCommand.make({
@@ -3613,14 +3777,20 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		if (submission.parentLinkage !== void 0 && (childLineage?._tag !== "SubagentLineageRecorded" || childLineage.parentSubmissionId !== submission.parentLinkage.parentSubmissionId || childLineage.parentLink.parentToolCallId !== submission.parentLinkage.parentToolCallId || !definitionDigestsEqual(childLineage.childDefinitionDigests, submission.agentDigests) || childLineage.childInputDigest !== submission.inputDigest)) return yield* RunJournalError.make({ message: "The child Run has no matching canonical lineage and execution bounds" });
 		const pending = yield* pendingToolBatchFor(records, runId, agent.definition.completionFromTools?.map((declaration) => declaration.tool));
 		const resumeProjection = pending === void 0 ? journal : yield* projectRunJournalStream(withoutPendingBatch(canonical, pending, runId), runId, void 0, journalSeed);
-		const tools = agent.definition.toolkit.tools;
-		for (const envelope of records) {
-			const payload = envelope.record.payload;
-			if (payload._tag !== "ToolCallPrepared" || payload.runId !== runId) continue;
-			const tool = tools[payload.toolName];
-			const kind = tool === void 0 ? "ordinary" : getToolExecutionKind(tool.annotations);
-			if (tool === void 0 || (payload.executionKind ?? "ordinary") !== kind) return yield* RunJournalError.make({ message: `Prepared Tool ${payload.toolCallId} classification conflicts with the resolved binding` });
-		}
+		const currentContracts = yield* contractsFor(agent.definition);
+		const rolloverOperation = journal.pendingContextToolCallId === void 0 ? void 0 : operationsFor(records, runId).get(journal.pendingContextToolCallId);
+		const rolloverTool = rolloverOperation === void 0 ? void 0 : agent.definition.toolkit.tools[rolloverOperation.toolName];
+		const pendingContextToolCallId = rolloverOperation !== void 0 && rolloverTool !== void 0 && Context.get(rolloverTool.annotations, ContextRolloverTool) && currentContracts[rolloverOperation.toolName] === rolloverOperation.replay ? journal.pendingContextToolCallId : void 0;
+		const applicationCalls = pending?.calls.filter((call) => !call.providerExecuted);
+		const completionCandidate = applicationCalls?.length === 1 && agent.definition.completionFromTools?.some((declaration) => declaration.tool === applicationCalls[0]?.name) && pending?.settled.some((result) => result.id === applicationCalls[0]?.id && !result.isFailure) ? applicationCalls[0] : void 0;
+		const settledCompletion = pending !== void 0 && completionCandidate !== void 0 && supportsOperation(submission, OpenToolCallEvidence.make({
+			toolCallId: Schema.decodeSync(ToolCallId)(completionCandidate.id),
+			toolName: completionCandidate.name,
+			turn: pending.turn
+		}), pending.toolOperations?.find((operation) => operation.toolCallId === completionCandidate.id), void 0, {
+			definition: agent.definition,
+			contracts: currentContracts
+		}) ? Schema.decodeSync(ToolCallId)(completionCandidate.id) : void 0;
 		const knownIds = knownRecordIdsOf(records);
 		const stepOutputs = /* @__PURE__ */ new Map();
 		for (const envelope of records) {
@@ -3740,51 +3910,12 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			const response = [...records].reverse().find((envelope) => envelope.record.payload._tag === "ModelResponseRecorded" && envelope.record.payload.runId === runId)?.record.payload;
 			if (response?._tag !== "ModelResponseRecorded") return yield* RunJournalError.make({ message: `Run ${runId} has a terminal completion marker without a response` });
 			const calls = (yield* declaredToolCalls(response.messages)).application;
-			let expectedOutput;
 			if (calls.length > 0) {
-				const completion = agent.definition.completion;
 				const call = calls[0];
-				const actionCompletion = agent.definition.completionFromTools?.find((declaration) => declaration.tool === call?.name);
-				const settled = call === void 0 ? void 0 : records.find((envelope) => envelope.record.payload._tag === "ToolCallSettled" && envelope.record.payload.runId === runId && envelope.record.payload.toolCallId === call.id)?.record.payload;
-				if (calls.length !== 1 || call === void 0 || call.name !== completion?.tool && actionCompletion === void 0 || settled?._tag !== "ToolCallSettled" || settled.toolName !== call.name || settled.isFailure) return yield* RunJournalError.make({ message: `Run ${runId} has a terminal completion marker without one successful declared completion Tool result` });
-				const projected = yield* (actionCompletion !== void 0 ? projectCompletionFromToolOutput(agent, actionCompletion, call.params, settled.result) : completion !== void 0 ? Effect.map(projectCompletionOutput(agent, completion, call.params, settled.result), Option.some) : Effect.succeed(Option.none())).pipe(Effect.mapError((cause) => RunJournalError.make({
-					message: `Run ${runId} completion Tool output failed recovery projection`,
-					cause
-				})));
-				if (Option.isNone(projected)) return yield* RunJournalError.make({ message: `Run ${runId} completion Tool declined its recorded terminal output` });
-				expectedOutput = projected.value;
-			} else {
-				const responseText = yield* terminalAssistantText(response.messages);
-				expectedOutput = yield* decodeFinalOutput(agent, responseText).pipe(Effect.mapError((cause) => RunJournalError.make({
-					message: `Run ${runId} final response output failed recovery decoding`,
-					cause
-				})));
-			}
-			const boundedExpectedOutput = yield* decodePersisted(expectedOutput.encoded).pipe(Effect.mapError((cause) => RunJournalError.make({
-				message: `Run ${runId} reconstructed output exceeds canonical persistence bounds`,
-				cause
-			})));
-			const [expectedOutputDigest, recordedOutputDigest] = yield* Effect.all([withCrypto(digestJson(boundedExpectedOutput)), withCrypto(digestJson(recordedCompletion.output))]).pipe(Effect.mapError((cause) => RunJournalError.make({
-				message: `Run ${runId} completion output comparison failed`,
-				cause
-			})));
-			if (expectedOutputDigest !== recordedOutputDigest) return yield* RunJournalError.make({ message: `Run ${runId} terminal completion output disagrees with its canonical response or Tool result` });
-			const expectedRunDisposition = recordedCompletion.finishReason === "budget-exhausted" ? void 0 : yield* encodeRunDisposition(agent, expectedOutput.decoded).pipe(Effect.mapError((cause) => RunJournalError.make({
-				message: `Run ${runId} run disposition failed recovery projection`,
-				cause
-			})));
-			if (expectedRunDisposition === void 0 !== (recordedCompletion.runDisposition === void 0)) return yield* RunJournalError.make({ message: `Run ${runId} terminal run disposition disagrees with its reconstructed output` });
-			if (expectedRunDisposition !== void 0 && recordedCompletion.runDisposition !== void 0) {
-				const boundedExpectedRunDisposition = yield* decodePersisted(expectedRunDisposition).pipe(Effect.mapError((cause) => RunJournalError.make({
-					message: `Run ${runId} reconstructed run disposition exceeds canonical persistence bounds`,
-					cause
-				})));
-				const [expectedRunDispositionDigest, recordedRunDispositionDigest] = yield* Effect.all([withCrypto(digestJson(boundedExpectedRunDisposition)), withCrypto(digestJson(recordedCompletion.runDisposition))]).pipe(Effect.mapError((cause) => RunJournalError.make({
-					message: `Run ${runId} run disposition comparison failed`,
-					cause
-				})));
-				if (expectedRunDispositionDigest !== recordedRunDispositionDigest) return yield* RunJournalError.make({ message: `Run ${runId} terminal run disposition disagrees with its reconstructed output` });
+				const settled = call === void 0 ? void 0 : records.find(({ record }) => record.payload._tag === "ToolCallSettled" && record.payload.runId === runId && record.payload.toolCallId === call.id)?.record.payload;
+				if (calls.length !== 1 || call === void 0 || settled?._tag !== "ToolCallSettled" || settled.toolName !== call.name || settled.isFailure) return yield* RunJournalError.make({ message: `Run ${runId} has a terminal completion marker without one successful declared Tool result` });
 			}
+			if (recordedCompletion.resultDigest !== void 0 && recordedCompletion.resultDigest !== (yield* withCrypto(runCompletionDigest(recordedCompletion)))) return yield* RunJournalError.make({ message: "RunCompleted terminal values failed their integrity check" });
 			return {
 				_tag: "completed",
 				result: recordedCompletion.output,
@@ -3822,7 +3953,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				cause
 			})));
 			const firstAssistant = pendingMessages.content.findIndex((message) => message.role === "assistant");
-			if (firstAssistant > 0) resumeLeadingMessages = Prompt.fromMessages(pendingMessages.content.slice(0, firstAssistant));
+			if (firstAssistant > 0) resumeLeadingMessages = Prompt.fromMessages(pendingMessages.content.slice(0, firstAssistant).filter((message) => message.role !== "system"));
 			if (firstAssistant >= 0) resumeResponseMessages = Prompt.fromMessages(pendingMessages.content.slice(firstAssistant));
 		}
 		let currentToolTurn = pending === void 0 ? void 0 : {
@@ -3859,7 +3990,24 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			...state,
 			history
 		});
-		const resumeContext = { prepare: ({ source }) => Ref.get(stateRef).pipe(Effect.map((state) => ({ prompt: Prompt.fromMessages([...resumeProjection.prompt.content, ...source.content.slice(state.baseLen ?? source.content.length)]) }))) };
+		const instructionView = (messages, instructions, insertWhenAbsent) => {
+			const projected = [];
+			const lengths = [0];
+			let inserted = false;
+			for (const message of messages) {
+				if (message.role === "system") {
+					if (!inserted) projected.push(...instructions);
+					inserted = true;
+				} else projected.push(message);
+				lengths.push(projected.length);
+			}
+			if (!inserted && insertWhenAbsent) projected.push(...instructions);
+			return {
+				messages: projected,
+				prefixLength: (length) => lengths[length] ?? projected.length
+			};
+		};
+		const resumeContext = { prepare: ({ source }) => Ref.get(stateRef).pipe(Effect.map((state) => ({ prompt: Prompt.fromMessages([...instructionView(resumeProjection.prompt.content, source.content.slice(0, state.baseLen).filter((message) => message.role === "system"), true).messages, ...source.content.slice(state.baseLen ?? source.content.length)]) }))) };
 		const externalContext = runContextPreparation.hook;
 		const preparedContext = externalContext === void 0 ? journal.committedTurns === 0 ? void 0 : resumeContext : { prepare: (request) => (journal.committedTurns === 0 ? Effect.succeed({ prompt: request.source }) : resumeContext.prepare(request)).pipe(Effect.flatMap(({ prompt }) => externalContext.prepare({
 			...request,
@@ -3904,6 +4052,13 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				const createdAt = yield* nowUtc;
 				const batch = yield* withCrypto(turnResponseBatch({
 					toolExposure: commit.toolExposure,
+					toolOperations: commit.calls.map((call) => ToolOperation.make({
+						toolCallId: call.toolCallId,
+						toolName: call.toolName,
+						executionClass: call.executionClass,
+						executionKind: call.executionKind,
+						replay: currentContracts[call.toolName]
+					})),
 					toolParameterRejections: commit.toolParameterRejections,
 					runId,
 					turn: canonicalTurn,
@@ -3942,7 +4097,9 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 						toolName: call.toolName,
 						parameters,
 						parametersDigest,
-						executionKind: call.executionKind
+						executionKind: call.executionKind,
+						executionClass: call.executionClass,
+						replay: currentContracts[call.toolName]
 					})));
 				}
 				const head = preparedRecords[0];
@@ -4010,14 +4167,16 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				}
 				const coverable = sourceBoundaries.filter((boundary) => commit.kind !== "summarize" || ownerFirstSequence === void 0 || boundary.sequence < ownerFirstSequence);
 				if (coverable.length === 0) return yield* CompactionError.make({ message: commit.kind === "rollover" ? "Durable rollover requires complete canonical records" : "Durable compaction requires eligible canonical records" });
+				const state = yield* Ref.get(stateRef);
+				const comparisonView = instructionView(sourceJournal.prompt.content, state.history?.content.slice(0, state.baseLen).filter((message) => message.role === "system") ?? [], false);
 				let matchingPrefix = 0;
 				let requiredThrough = 0;
-				const comparisonLimit = Math.min(sourceJournal.prompt.content.length, commit.through);
+				const comparisonLimit = Math.min(comparisonView.messages.length, commit.through);
 				for (let index = 0; index < commit.through; index += 1) {
 					const message = commit.source.content[index];
 					if (message !== void 0 && (commit.kind === "clear-tool-results" ? message.role === "tool" : message.role !== "system")) requiredThrough = index + 1;
 					if (index >= comparisonLimit || index !== matchingPrefix || message === void 0) continue;
-					const canonicalMessage = sourceJournal.prompt.content[index];
+					const canonicalMessage = comparisonView.messages[index];
 					if (canonicalMessage === void 0) continue;
 					const encode = (entry) => Schema.encodeEffect(Prompt.Message)(entry).pipe(Effect.mapError((cause) => CompactionError.make({
 						message: "Could not encode the canonical compaction prefix",
@@ -4033,7 +4192,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 					if (candidate === void 0) continue;
 					const following = coverable[index + 1];
 					if (following !== void 0 && following.tag !== "ModelResponseRecorded") continue;
-					const length = candidate.promptLength;
+					const length = comparisonView.prefixLength(candidate.promptLength);
 					if (length === 0 || length > commit.through) continue;
 					if (length < requiredThrough || length > matchingPrefix) continue;
 					lastCovered = candidate;
@@ -4576,6 +4735,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			history: pending === void 0 ? journal.historyBefore : resumeProjection.historyBefore,
 			onHistory,
 			input,
+			...journal.committedTurns > 0 || Schema.is(FrameworkMessage)(submission.messageAdmission) ? { retainedInput: submission.inputPayload } : {},
 			...Schema.is(FrameworkMessage)(submission.messageAdmission) ? { frameworkMessage: submission.messageAdmission } : {},
 			approval,
 			toolAuthorization,
@@ -4591,12 +4751,13 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			...submission.workerAdmission === void 0 ? {} : { toolCallAllowance: submission.workerAdmission.origin.toolCallAllowance },
 			...submission.parentLinkage !== void 0 && childLineage?._tag === "SubagentLineageRecorded" ? { toolCallAllowance: childLineage.toolCallAllowance } : {},
 			...pending === void 0 ? {} : { resume: {
+				...settledCompletion === void 0 ? {} : { settledCompletion },
 				turn: pending.turn,
 				turnId: pending.turnId,
 				calls: pending.calls,
 				toolParameterRejections: pending.toolParameterRejections,
 				settled: pending.settled,
-				...pending.toolExposure === void 0 ? {} : { toolExposure: pending.toolExposure },
+				toolExposure: pending.toolExposure ?? Snapshot.make({ exposedToolNames: [...new Set(pending.calls.map((call) => call.name))] }),
 				...resumeLeadingMessages === void 0 ? {} : { leadingMessages: resumeLeadingMessages },
 				...resumeResponseMessages === void 0 ? {} : { responseMessages: resumeResponseMessages }
 			} },
@@ -4618,7 +4779,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			},
 			...journal.contextWindowId === void 0 ? {} : { initialContextWindowId: journal.contextWindowId },
 			...journal.protectedContext === void 0 ? {} : { protectedContext: journal.protectedContext },
-			...journal.pendingContextToolCallId === void 0 ? {} : { pendingContextToolCallId: journal.pendingContextToolCallId }
+			...pendingContextToolCallId === void 0 ? {} : { pendingContextToolCallId }
 		};
 		const commitPendingTurn = Effect.gen(function* () {
 			const state = yield* Ref.get(stateRef);
@@ -4664,7 +4825,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 					const completion = agent.definition.completion;
 					const completionPart = resultParts[0];
 					const runCompletion = resultParts.length === 1 && (completionPart?.name === completion?.tool || agent.definition.completionFromTools?.some((declaration) => declaration.tool === completionPart?.name)) && completionPart.isFailure !== true && completedRun !== void 0 ? completedRun : void 0;
-					const batch = yield* turnResultsBatch({
+					const batch = yield* withCrypto(turnResultsBatch({
 						toolSelections: stagedToolSelections,
 						budgetRejectedCalls,
 						runId,
@@ -4675,7 +4836,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 						deploymentId: config.deploymentId,
 						createdAt,
 						...runCompletion === void 0 ? {} : { runCompletion }
-					});
+					}));
 					let pendingBatch = batch;
 					if (settledCompletionPart !== void 0) {
 						const completionRecord = batch.records.find((record) => record.payload._tag === "RunCompleted");
@@ -4946,7 +5107,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const ctx = yield* attemptContextFor(threadId, claim.producerEpoch);
 		let controlThrough = (yield* store.inspectTail(ThreadTailRequest.make({ threadId }))).tailSequence;
 		const initialThrough = controlThrough;
-		const initialView = yield* recoveryView(threadId, initialThrough, [submissionId]);
+		const initialView = yield* recoveryView(threadId, initialThrough, [submissionId], runIdForSubmission(submissionId));
 		let journalMetadata = initialView.seed === void 0 ? makeJournalMetadata(runIdForSubmission(submissionId)) : void 0;
 		const retainControl = controlRecords([submissionId]);
 		const collectControl = (record) => {
@@ -5005,7 +5166,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		};
 		let expiredChildObligation = false;
 		if ((yield* Clock.currentTimeMillis) >= DateTime.toEpochMillis(runTiming.deadline)) {
-			yield* reconcileExpiredChildren(ctx, submission, yield* Ref.get(tokenRef));
+			yield* reconcileRetainedChildren(ctx, submission, yield* Ref.get(tokenRef));
 			expiredChildObligation = yield* completeJoinedReleases(submission);
 		}
 		const ordinaryCallsResolved = Effect.gen(function* () {
@@ -5014,10 +5175,9 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			const reconciliationEvidence = yield* evidenceFor(reconciliationRecords, submissionId, true, reconciliationSnapshot.hostSubmissionId);
 			if (reconciliationEvidence.openToolCalls.length === 0) return true;
 			for (const envelope of reconciliationRecords) knownIds.add(envelope.record.recordId);
-			const tools = agent.definition.toolkit.tools;
-			const review = yield* reconcileOpenCalls(ctx, submission, reconciliationSnapshot, reconciliationRecords, reconciliationEvidence.openToolCalls, knownIds, (toolName) => {
-				const tool = tools[toolName];
-				return tool === void 0 ? void 0 : getToolExecutionClass(tool);
+			const review = yield* reconcileOpenCalls(ctx, submission, reconciliationSnapshot, reconciliationRecords, reconciliationEvidence.openToolCalls, knownIds, {
+				definition: agent.definition,
+				contracts: yield* contractsFor(agent.definition)
 			});
 			if (review.uncertain.length > 0 || review.unproven.length > 0) {
 				if (review.uncertain.length > 0) yield* markCallsUnknown(ctx, submissionId, knownIds, review.uncertain, "An ordinary Tool call may have executed without a canonical outcome");
@@ -5031,6 +5191,74 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			return true;
 		});
 		if (!expiredChildObligation && !(yield* ordinaryCallsResolved)) return Option.none();
+		const continuationRecords = yield* refreshControl();
+		const continuation = yield* pendingToolBatchFor(continuationRecords, runIdForSubmission(submissionId));
+		if (continuation !== void 0) {
+			const current = {
+				definition: agent.definition,
+				contracts: yield* contractsFor(agent.definition)
+			};
+			const operations = operationsFor(continuationRecords, runIdForSubmission(submissionId));
+			const settled = new Set(continuation.settled.map((call) => call.id));
+			const rejected = new Set(continuation.toolParameterRejections?.map((call) => call.toolCallId));
+			const unsupported = [];
+			const unavailableDelegations = /* @__PURE__ */ new Set();
+			for (const call of continuation.calls) {
+				const original = continuationRecords.map(({ record }) => record.payload).find((payload) => payload._tag === "ToolCallPrepared" && payload.runId === runIdForSubmission(submissionId) && payload.toolCallId === call.id);
+				if (original?._tag === "ToolCallPrepared" && original.executionKind === "delegation" && !settled.has(call.id) && !supportsOperation(submission, OpenToolCallEvidence.make(original), operations.get(call.id), original, current)) unavailableDelegations.add(original.toolCallId);
+			}
+			const children = unavailableDelegations.size === 0 ? void 0 : yield* reconcileRetainedChildren(ctx, submission, yield* Ref.get(tokenRef), unavailableDelegations);
+			for (const envelope of yield* refreshControl()) knownIds.add(envelope.record.recordId);
+			for (const call of continuation.calls) {
+				if (call.providerExecuted || settled.has(call.id) || rejected.has(Schema.decodeSync(ToolCallId)(call.id))) continue;
+				const evidence = OpenToolCallEvidence.make({
+					toolCallId: Schema.decodeSync(ToolCallId)(call.id),
+					toolName: call.name,
+					turn: continuation.turn
+				});
+				const operation = operations.get(call.id);
+				const prepared = continuationRecords.map(({ record }) => record.payload).find((payload) => payload._tag === "ToolCallPrepared" && payload.runId === runIdForSubmission(submissionId) && payload.turn === continuation.turn && payload.toolCallId === call.id);
+				const preparation = prepared?._tag === "ToolCallPrepared" ? prepared : void 0;
+				if (supportsOperation(submission, evidence, operation, preparation, current)) continue;
+				if (preparation !== void 0 && !children?.notExecuted.has(evidence.toolCallId)) {
+					if (!unavailableDelegations.has(evidence.toolCallId)) unsupported.push(evidence);
+					continue;
+				}
+				const execution = children?.notExecuted.has(evidence.toolCallId) || operation !== void 0 && (operation.executionClass !== "readonly" || operation.executionKind !== "ordinary") ? "not-executed" : "unavailable";
+				const result = yield* Schema.encodeEffect(ToolUnavailable)(ToolUnavailable.make({
+					toolName: call.name,
+					execution,
+					message: execution === "not-executed" ? "This operation was not executed and its original implementation is unavailable. Continue with the current tools." : "The original operation is unavailable. No mutating handler was dispatched; readonly work may have run without a recorded result."
+				})).pipe(Effect.flatMap(decodePersisted), Effect.orDie);
+				yield* hit("tools:before-unavailable-append");
+				yield* appendClosedCall(ctx, submissionId, knownIds, evidence, {
+					result: {
+						value: result,
+						isFailure: true
+					},
+					resolution: execution === "not-executed" ? "never-started" : "failed-with-error",
+					author: "runtime",
+					reason: "The declared operation cannot execute under its original contract"
+				});
+				yield* hit("tools:after-unavailable-append");
+			}
+			const firstWaiting = children?.waiting[0];
+			if (children !== void 0 && firstWaiting !== void 0) {
+				const disposition = yield* ledger.suspend(SuspendRequest.make({
+					submissionId,
+					ownershipToken: yield* Ref.get(tokenRef),
+					reason: WaitingForChildSuspension.make({ children: [firstWaiting, ...children.waiting.slice(1)] })
+				}));
+				yield* hit("subagent:after-suspend");
+				if (disposition === "resume-immediately") yield* wake.notify(threadId);
+				return Option.none();
+			}
+			if ((children?.indeterminate.size ?? 0) > 0) return Option.none();
+			if (unsupported.length > 0) {
+				yield* markCallsUnknown(ctx, submissionId, knownIds, unsupported, "The unfinished operation has no supported recovery implementation; its original identity and evidence remain unresolved");
+				return Option.none();
+			}
+		}
 		const lineage = {
 			attemptId: claim.attemptId,
 			supersededEpoch,
@@ -5099,7 +5327,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 					}));
 					yield* hit("run:after-duration-append");
 				}
-				yield* reconcileExpiredChildren(ctx, submission, yield* Ref.get(tokenRef));
+				yield* reconcileRetainedChildren(ctx, submission, yield* Ref.get(tokenRef));
 			}
 			if (yield* completeJoinedReleases(submission)) {
 				if (outcome._tag === "failed") {
@@ -5168,24 +5396,24 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const resolution = yield* resolve(submission).pipe(Effect.map((binding) => ({
 			_tag: "resolved",
 			binding
-		})), Effect.catchTags({
-			BindingUnavailable: (failure) => Effect.succeed({
-				_tag: "refused",
-				failure
-			}),
-			BindingDigestMismatch: (failure) => Effect.succeed({
-				_tag: "refused",
-				failure
-			})
-		}));
+		})), Effect.catchTags({ BindingUnavailable: (failure) => Effect.succeed({
+			_tag: "refused",
+			failure
+		}) }));
 		if (resolution._tag === "refused") return yield* resolution.failure;
 		return yield* resolution.binding.attempt((agent, attemptThreadId, attemptClaim) => runAttempt(agent, attemptThreadId, attemptClaim, tokenRef, options?.yieldAfter), threadId, claim);
 	})).pipe(withThreadHeadSpan);
+	const eligibleThreadHead = (threadId) => Stream.runHead(ledger.scanNonterminal.pipe(Stream.filter((entry) => entry.threadId === threadId), Stream.filterEffect((entry) => entry.state !== "unknown" ? Effect.succeed(true) : ledger.loadRecoverySnapshot(RecoverySnapshotRequest.make({ submissionId: entry.submissionId })).pipe(Effect.map((snapshot) => snapshot.abortIntent !== void 0)))));
 	const drainThread = (resolve, threadId) => Effect.gen(function* () {
 		const settlements = [];
 		while (true) {
+			const before = yield* eligibleThreadHead(threadId);
 			const settlement = yield* processThreadHead(resolve, threadId);
-			if (Option.isNone(settlement)) return settlements;
+			if (Option.isNone(settlement)) {
+				const after = yield* eligibleThreadHead(threadId);
+				if (Option.isSome(before) && Option.isSome(after) && before.value.submissionId !== after.value.submissionId) continue;
+				return settlements;
+			}
 			settlements.push(settlement.value);
 		}
 	});
@@ -5196,25 +5424,11 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			message: `This worker is bound to Agent ${binding.agentId}; the claimed head belongs to Agent ${submission.agentId} (SUB-023)`
 		})), threadId);
 	});
-	const resolveRetainedBinding = Effect.fn("DurableAgentRuntime.resolveRetainedBinding")(function* (submission) {
-		const exact = registeredBindings.find((binding) => binding.agentId === submission.agentId && definitionDigestsEqual(binding.digests, submission.agentDigests));
-		if (exact !== void 0) return exact;
-		const candidates = registeredBindings.filter((binding) => binding.agentId === submission.agentId);
-		const candidate = candidates[0];
-		if (candidate === void 0 || candidates.length !== 1) return yield* resolveWorkerBinding(registeredBindings, submission.agentId, submission.agentDigests);
-		if (bindingSupports(candidate, submission.agentDigests)) return candidate;
-		const records = yield* Effect.gen(function* () {
-			const tail = yield* store.inspectTail(ThreadTailRequest.make({ threadId: submission.threadId }));
-			return yield* Stream.runCollect(canonicalRange(submission.threadId, tail.tailSequence).pipe(Stream.filter(controlRecords([submission.submissionId]))));
-		}).pipe(Effect.catchTag("ThreadNotMaterialized", () => Effect.succeed([])));
-		const completionTools = candidate === void 0 ? [] : [...candidate.definition.completion === void 0 ? [] : [candidate.definition.completion.tool], ...candidate.definition.completionFromTools?.map((entry) => entry.tool) ?? []];
-		const pending = yield* pendingToolBatchFor(records, runIdForSubmission(submission.submissionId), completionTools);
-		return yield* resolveWorkerBinding(registeredBindings, submission.agentId, submission.agentDigests, pending?.calls.filter((call) => call.providerExecuted !== true || completionTools.includes(call.name)).map((call) => call.name) ?? []);
-	});
-	const processThreadResolvedImpl = (threadId) => drainThread(resolveRetainedBinding, threadId);
-	const processThreadHeadImpl = (threadId, options) => processThreadHead(resolveRetainedBinding, threadId, options);
-	const claimFor = Effect.fn("DurableAgentRuntime.claimFor")(function* (submission) {
-		const head = yield* Stream.runHead(ledger.scanNonterminal.pipe(Stream.filter((entry) => entry.threadId === submission.threadId)));
+	const resolveCurrentBinding = (submission) => resolveWorkerBinding(registeredBindings, submission.agentId);
+	const processThreadResolvedImpl = (threadId) => drainThread(resolveCurrentBinding, threadId);
+	const processThreadHeadImpl = (threadId, options) => processThreadHead(resolveCurrentBinding, threadId, options);
+	const claimFor = Effect.fn("DurableAgentRuntime.claimFor")(function* (submission, decision) {
+		const head = yield* eligibleThreadHead(submission.threadId);
 		if (Option.isNone(head) || head.value.submissionId !== submission.submissionId) return Option.none();
 		const claimed = yield* acquireClaim(submission.threadId);
 		if (Option.isNone(claimed)) return Option.none();
@@ -5225,35 +5439,40 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			})).pipe(Effect.catchTag("OwnershipLost", () => Effect.void));
 			return Option.none();
 		}
+		yield* annotateRepair(submission.threadId, decision, claimed.value.claim.producerEpoch);
 		return Option.some(claimed.value.claim);
 	});
 	/**
-	* DUR-013 audit: one deterministic `RepairAnnotated` record per executed (submission, decision)
-	* pair. Conflicts mean the annotation is already canonical (or a newer epoch owns the lane), so
-	* they never fail the already-idempotent repair itself.
+	* Best-effort DUR-013 audit of an owned repair attempt, before it can release its claim.
+	* The fixed granted epoch never borrows a later writer's authority. State-only repairs
+	* omit canonical annotations; their decision and operator author/reason remain in telemetry.
 	*/
-	const annotateRepair = (threadId, submissionId, decision) => Effect.gen(function* () {
+	const annotateRepair = (threadId, decision, producerEpoch) => Effect.gen(function* () {
+		yield* store.materialize(ThreadMaterialization.make({
+			threadId,
+			producerEpoch
+		}));
+		const tail = yield* store.inspectTail(ThreadTailRequest.make({ threadId }));
+		if (tail.tailSequence === ZERO_SEQUENCE) return;
 		const encodedDecision = yield* Schema.encodeEffect(RecoveryDecision)(decision).pipe(Effect.orDie);
 		const details = yield* Schema.decodeEffect(PersistedJson)(encodedDecision).pipe(Effect.orDie);
-		const envelope = yield* makeEnvelope(recoveryRepairRecordId(submissionId, decision._tag), RepairAnnotated.make({
+		const envelope = yield* makeEnvelope(recoveryRepairRecordId(decision.submissionId, decision._tag), RepairAnnotated.make({
 			reason: `recovery:${decision._tag}`,
 			details
 		}));
-		const tail = yield* store.inspectTail(ThreadTailRequest.make({ threadId }));
 		yield* store.append(FencedAppendRequest.make({
 			threadId,
 			batch: CanonicalBatch.make({
-				batchId: recoveryRepairBatchId(submissionId, decision._tag),
+				batchId: recoveryRepairBatchId(decision.submissionId, decision._tag),
 				producerId: config.producerId,
 				records: [envelope]
 			}),
 			expectedTailSequence: tail.tailSequence,
 			expectedTailDigest: tail.tailDigest,
-			producerEpoch: tail.producerEpoch
+			producerEpoch
 		}));
-		yield* wake.notify(threadId);
 	}).pipe(Effect.ignore);
-	const settleAbortedForRecovery = Effect.fn("DurableAgentRuntime.settleAbortedForRecovery")(function* (snapshot, evidence, records, _decision) {
+	const settleAbortedForRecovery = Effect.fn("DurableAgentRuntime.settleAbortedForRecovery")(function* (snapshot, evidence, records, decision) {
 		const intent = snapshot.abortIntent;
 		if (intent === void 0) return "deferred";
 		const submission = snapshot.submission;
@@ -5280,7 +5499,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				}
 			}
 		}
-		const claimed = yield* claimFor(submission);
+		const claimed = yield* claimFor(submission, decision);
 		if (Option.isNone(claimed)) {
 			if (submission.state === "ready" && snapshot.ownership === void 0) return yield* Effect.gen(function* () {
 				yield* materializeAtLeast(submission.threadId, ZERO_EPOCH);
@@ -5308,15 +5527,15 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		return "repaired";
 	});
 	/**
-	* Execute the reconcile-then-mark flow for a `MarkUnknown` decision (plan §2.2). The recovery
-	* pass has no Agent Binding, so no execution-class annotation is visible here — every call
-	* without a durable intent or reconciler proof stays fail-closed uncertain. A lane whose open
-	* calls all closed reports `repaired`; provably-retryable calls defer to a worker's batch
-	* resume; the rest become Unknown Outcomes and report the `unknown` disposition.
+	* Execute the reconcile-then-mark flow for a `MarkUnknown` decision (plan §2.2). Current
+	* registration metadata checks retry support when available. Low-level drivers supply their
+	* Agent at claim time, so retry proofs defer that check without permitting execution. Calls
+	* without a durable intent, original idempotent declaration, or reconciler proof stay uncertain.
+	* Closed calls report `repaired`; deferred checks report `deferred`; uncertain calls become Unknown.
 	*/
 	const markUnknownForRecovery = Effect.fn("DurableAgentRuntime.markUnknownForRecovery")(function* (snapshot, evidence, records, decision) {
 		const submission = snapshot.submission;
-		const claimed = yield* claimFor(submission);
+		const claimed = yield* claimFor(submission, decision);
 		if (Option.isNone(claimed)) return "deferred";
 		const claim = claimed.value;
 		yield* store.materialize(ThreadMaterialization.make({
@@ -5326,7 +5545,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const ctx = yield* attemptContextFor(submission.threadId, claim.producerEpoch);
 		const knownIds = knownRecordIdsOf(records);
 		const markableIds = new Set(decision.openToolCallIds);
-		const review = yield* reconcileOpenCalls(ctx, submission, snapshot, records, evidence.openToolCalls.filter((call) => markableIds.has(call.toolCallId)), knownIds, () => void 0);
+		const review = yield* reconcileOpenCalls(ctx, submission, snapshot, records, evidence.openToolCalls.filter((call) => markableIds.has(call.toolCallId)), knownIds, yield* currentOperationsFor(submission.agentId));
 		let disposition;
 		if (review.uncertain.length > 0) {
 			yield* markCallsUnknown(ctx, submission.submissionId, knownIds, review.uncertain, decision.reason);
@@ -5339,17 +5558,25 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		})).pipe(Effect.catchTag("OwnershipLost", () => Effect.void));
 		return disposition;
 	});
+	/** A retry intent permits only the saved operation under its supported current contract. */
+	const hasUnsupportedRetry = Effect.fnUntraced(function* (snapshot, records) {
+		if (!snapshot.unknownResolutions.some((intent) => intent.resolution._tag === "SafeToRetry")) return false;
+		const submission = snapshot.submission;
+		const current = yield* currentOperationsFor(submission.agentId);
+		const operations = operationsFor(records, runIdForSubmission(submission.submissionId));
+		for (const intent of snapshot.unknownResolutions) if (intent.resolution._tag === "SafeToRetry") {
+			const prepared = records.map(({ record }) => record.payload).find((payload) => payload._tag === "ToolCallPrepared" && payload.runId === runIdForSubmission(submission.submissionId) && payload.toolCallId === intent.toolCallId);
+			if (prepared?._tag !== "ToolCallPrepared" || current !== void 0 && !supportsOperation(submission, OpenToolCallEvidence.make(prepared), operations.get(intent.toolCallId), prepared, current)) return true;
+		}
+		return false;
+	});
 	/**
-	* Apply covering DUR-017 resolution intents canonically and wake the lane. The `unknown` head
-	* is never claimable, so the appends run unfenced at the current tail (no live owner can
-	* exist); the wake itself is the ledger's idempotent re-check on intent replay (WP2), so a
-	* crash anywhere in this pass converges on the next one.
+	* Replay covering resolution intents as state-only wakes. Canonical outcomes wait for an
+	* actual claim, so resolving an older request cannot append using a later writer's epoch.
 	*/
-	const applyUnknownResolutionsForRecovery = Effect.fn("DurableAgentRuntime.applyUnknownResolutionsForRecovery")(function* (snapshot, evidence, records) {
+	const applyUnknownResolutionsForRecovery = Effect.fn("DurableAgentRuntime.applyUnknownResolutionsForRecovery")(function* (snapshot, _evidence, records) {
+		if (yield* hasUnsupportedRetry(snapshot, records)) return "unknown";
 		const submission = snapshot.submission;
-		const ctx = yield* attemptContextAtTail(submission.threadId);
-		const knownIds = knownRecordIdsOf(records);
-		if (!(yield* reconcileOpenCalls(ctx, submission, snapshot, records, evidence.openToolCalls, knownIds, () => void 0).pipe(Effect.as(true), Effect.catchTag("FenceRejected", () => Effect.succeed(false))))) return "deferred";
 		for (const intent of snapshot.unknownResolutions) yield* ledger.recordUnknownResolution(UnknownResolutionCommand.make({
 			submissionId: intent.submissionId,
 			toolCallId: intent.toolCallId,
@@ -5374,14 +5601,14 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 	* permit, and stays `deferred`. Decisions that raced ahead of the repair leave the lane to a
 	* worker's batch resume (`deferred`).
 	*/
-	const awaitApprovalForRecovery = Effect.fn("DurableAgentRuntime.awaitApprovalForRecovery")(function* (snapshot, evidence) {
+	const awaitApprovalForRecovery = Effect.fn("DurableAgentRuntime.awaitApprovalForRecovery")(function* (snapshot, evidence, decision) {
 		const submission = snapshot.submission;
 		if (submission.state === "suspended") return "deferred";
 		const decided = new Set(snapshot.approvalDecisions.map((decision) => decision.toolCallId));
 		const undecided = evidence.approvalsPending.filter((pending) => !decided.has(pending.toolCallId));
 		const first = undecided[0];
 		if (first === void 0) return "deferred";
-		const claimed = yield* claimFor(submission);
+		const claimed = yield* claimFor(submission, decision);
 		if (Option.isNone(claimed)) return "deferred";
 		const claim = claimed.value;
 		const outcome = yield* ledger.suspend(SuspendRequest.make({
@@ -5416,7 +5643,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const runId = runIdForSubmission(submission.submissionId);
 		const start = yield* canonicalRunStartFromRecords(records, runId);
 		if (start?.payload._tag === "RunStarted" && start.payload.runId === runId && (records.some(({ record }) => record.payload._tag === "RunDurationExhausted" && record.payload.runId === runId) || submission.workerAdmission !== void 0 && (yield* Clock.currentTimeMillis) >= submission.workerAdmission.origin.expiresAtMillis) && (decision._tag === "CompleteChildAdmission" || decision._tag === "RepairSubagentStartLink" || decision._tag === "AwaitChildAdmissionResolution" || decision._tag === "MarkUnknown" && snapshot.childReservations.some((reservation) => reservation.status !== "released"))) {
-			const claimed = yield* claimFor(submission);
+			const claimed = yield* claimFor(submission, decision);
 			if (Option.isNone(claimed)) return "deferred";
 			const claim = claimed.value;
 			yield* store.materialize(ThreadMaterialization.make({
@@ -5424,7 +5651,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				producerEpoch: claim.producerEpoch
 			}));
 			const ctx = yield* attemptContextFor(submission.threadId, claim.producerEpoch);
-			yield* reconcileExpiredChildren(ctx, submission, claim.ownershipToken);
+			yield* reconcileRetainedChildren(ctx, submission, claim.ownershipToken);
 			const open = yield* completeJoinedReleases(submission);
 			yield* ledger.releaseOwnership(ReleaseOwnershipRequest.make({
 				submissionId: submission.submissionId,
@@ -5439,7 +5666,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			case "MarkUnknown": return yield* markUnknownForRecovery(snapshot, evidence, records, decision);
 			case "ApplyUnknownResolutions": return yield* applyUnknownResolutionsForRecovery(snapshot, evidence, records);
 			case "AwaitUnknownResolution": return "unknown";
-			case "AwaitApprovalDecision": return yield* awaitApprovalForRecovery(snapshot, evidence);
+			case "AwaitApprovalDecision": return yield* awaitApprovalForRecovery(snapshot, evidence, decision);
 			case "ResumeSuspended": return yield* resumeSuspendedForRecovery(snapshot);
 			case "RevertJoining":
 				yield* ledger.revertJoining(RevertJoiningRequest.make({ submissionId: submission.submissionId }));
@@ -5460,7 +5687,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				}
 				const host = yield* ledger.lookup(SubmissionLookupById.make({ submissionId: hostSubmissionId }));
 				if (Option.isNone(host)) return "deferred";
-				const claimed = yield* claimFor(host.value);
+				const claimed = yield* claimFor(host.value, decision);
 				if (Option.isNone(claimed)) return "deferred";
 				const claim = claimed.value;
 				yield* ledger.markJoined(MarkJoinedRequest.make({
@@ -5499,7 +5726,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				return "repaired";
 			case "ApplyInput":
 			case "RepairInputMarker": {
-				const claimed = yield* claimFor(submission);
+				const claimed = yield* claimFor(submission, decision);
 				if (Option.isNone(claimed)) return "deferred";
 				const claim = claimed.value;
 				yield* store.materialize(ThreadMaterialization.make({
@@ -5521,7 +5748,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			case "AppendReservedSettlement": {
 				const reservation = snapshot.reservation;
 				if (reservation === void 0) return "deferred";
-				const claimed = yield* claimFor(submission);
+				const claimed = yield* claimFor(submission, decision);
 				if (Option.isNone(claimed)) {
 					if (reservation.outcome === "aborted" && snapshot.abortIntent !== void 0 && snapshot.ownership === void 0) {
 						const ctx = yield* attemptContextAtTail(submission.threadId);
@@ -5558,7 +5785,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				if (requestedPayload === void 0) return "deferred";
 				const admission = yield* establishChildFromRequest(submission, requestedPayload);
 				if (admission._tag === "indeterminate") return "deferred";
-				const claimed = yield* claimFor(submission);
+				const claimed = yield* claimFor(submission, decision);
 				if (Option.isNone(claimed)) return "deferred";
 				const claim = claimed.value;
 				yield* store.materialize(ThreadMaterialization.make({
@@ -5598,7 +5825,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				return "repaired";
 			}
 			case "EnsureWaitingForChild": {
-				const claimed = yield* claimFor(submission);
+				const claimed = yield* claimFor(submission, decision);
 				if (Option.isNone(claimed)) return "deferred";
 				const claim = claimed.value;
 				const suspension = yield* ledger.suspend(SuspendRequest.make({
@@ -5653,7 +5880,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 					if (Option.isSome(childRow)) yield* wake.notify(childRow.value.threadId);
 				}
 				if (submission.state !== "suspended") {
-					const claimed = yield* claimFor(submission);
+					const claimed = yield* claimFor(submission, decision);
 					if (Option.isNone(claimed)) return "deferred";
 					const claim = claimed.value;
 					const suspension = yield* ledger.suspend(SuspendRequest.make({
@@ -5697,7 +5924,6 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const evidence = yield* evidenceFor(history.records, submission.submissionId, history.materialized, snapshot.hostSubmissionId);
 		const decision = classifyRecovery(snapshot, evidence);
 		const disposition = decision._tag === "ApplyInput" && snapshot.submission.state === "ready" ? "deferred" : yield* Effect.scoped(executeRecoveryDecision(snapshot, evidence, decision, history.records, history));
-		if (disposition === "repaired") yield* annotateRepair(submission.threadId, submission.submissionId, decision);
 		return RecoveryReport.make({
 			submissionId: submission.submissionId,
 			threadId: submission.threadId,
@@ -5754,10 +5980,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			reason: cause.reason === "storage" || cause.reason === "unavailable" ? "unavailable" : "refused",
 			code: `message-${cause.reason}`
 		})));
-		if (options.definitions.replay !== void 0 && workerAdmission === void 0 && messageAdmission === void 0 && !registeredBindings.some((binding) => binding.agentId === agent.definition.id && (definitionDigestsEqual(binding.digests, options.definitions) || binding.retainedManifests?.some((retained) => definitionDigestsEqual(DefinitionDigests.make({
-			...retained.digests,
-			replay: retained.replay
-		}), options.definitions))))) {
+		if (options.definitions.replay !== void 0 && workerAdmission === void 0 && messageAdmission === void 0 && !registeredBindings.some((binding) => binding.agentId === agent.definition.id && definitionDigestsEqual(binding.digests, options.definitions))) {
 			const retained = yield* ledger.lookup(SubmissionLookupByKey.make({
 				threadId: options.threadId,
 				principal: options.principal,
@@ -5976,7 +6199,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 		const nowMillis = yield* Clock.currentTimeMillis;
 		const explainedAt = yield* nowUtc;
 		const runId = runIdForSubmission(submission.submissionId);
-		const resolvedIds = new Set(snapshot.unknownResolutions.map((intent) => intent.toolCallId));
+		const resolvedIds = new Set(read.records.flatMap(({ record }) => record.payload._tag === "ToolCallSettled" && record.payload.runId === runId ? [record.payload.toolCallId] : []));
 		const unknownCalls = [];
 		for (const envelope of read.records) {
 			const payload = envelope.record.payload;
@@ -6009,6 +6232,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				inputRecorded: evidence.inputRecorded,
 				abortRecorded: evidence.abortRecorded,
 				openToolCalls: evidence.openToolCalls,
+				pendingOperations: read.records.flatMap(({ record }) => record.payload._tag === "ToolCallPrepared" && record.payload.runId === runId && !resolvedIds.has(record.payload.toolCallId) ? [record.payload] : []),
 				openDelegationCalls: evidence.openDelegationCalls,
 				approvalsPending: evidence.approvalsPending,
 				unknownCalls,
@@ -6023,7 +6247,10 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			}),
 			decision,
 			decisionMeaning: recoveryDecisionMeaning(decision._tag),
-			disposition: predictRecoveryDisposition(decision, snapshot),
+			disposition: decision._tag === "ApplyUnknownResolutions" && (yield* hasUnsupportedRetry(snapshot, read.records).pipe(Effect.mapError((cause) => RunJournalError.make({
+				message: "Cannot verify the pending retry contract",
+				cause
+			})))) ? "unknown" : predictRecoveryDisposition(decision, snapshot),
 			explainedAt
 		});
 	});
@@ -6101,9 +6328,9 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 	});
 	/**
 	* Safe re-drive of exactly one Submission's recovery decision (plan §3): classify, execute
-	* the ONE repair the classifier names, append the deterministic `RepairAnnotated` audit when
-	* it repairs (DUR-013 — retry adds no new record type), and wake the lane. Typed refusals
-	* protect the paths that own their own operations: settled work (`NoAction`), lanes blocked
+	* the ONE repair the classifier names, annotate owned repair attempts with their actual
+	* claim epoch (DUR-013), and wake the lane. Typed refusals
+	* protect the paths that own their own operations: settled work (`NoAction`), requests parked
 	* on Unknown Outcomes (`resolveUnknown`, DUR-017), and lanes awaiting approval decisions
 	* (`resolveApproval`). The mandatory `author`/`reason` audit fields (SEC-011) annotate the
 	* structured operator log.
@@ -6128,7 +6355,7 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			submissionId: command.submissionId,
 			refusal: "await-unknown-resolution",
 			decisionTag: decision._tag,
-			message: "The lane is durably blocked on Unknown Outcomes; resolve them through the authorized resolveUnknown path (DUR-017) instead of retrying."
+			message: "This Submission is parked on Unknown Outcomes; resolve them through the authorized resolveUnknown path (DUR-017) instead of retrying."
 		});
 		if (decision._tag === "AwaitApprovalDecision") return yield* RetryRefused.make({
 			submissionId: command.submissionId,
@@ -6144,7 +6371,6 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 			decision: decision._tag
 		}));
 		const disposition = yield* Effect.scoped(executeRecoveryDecision(snapshot, evidence, decision, read.records, read));
-		if (disposition === "repaired") yield* annotateRepair(submission.threadId, command.submissionId, decision);
 		yield* wake.notify(submission.threadId);
 		return RecoveryReport.make({
 			submissionId: command.submissionId,
@@ -6181,8 +6407,8 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 				case "unknown": {
 					blockedOn = "unknown";
 					const records = (yield* readAllTolerant(submission.threadId, [submission.submissionId])).records;
-					const resolvedIds = new Set(snapshot.unknownResolutions.map((intent) => intent.toolCallId));
 					const runId = runIdForSubmission(submission.submissionId);
+					const resolvedIds = new Set(records.flatMap(({ record }) => record.payload._tag === "ToolCallSettled" && record.payload.runId === runId ? [record.payload.toolCallId] : []));
 					let earliest;
 					for (const envelope of records) {
 						const payload = envelope.record.payload;
@@ -6334,19 +6560,16 @@ const make = Effect.fn("DurableAgentRuntime.make")(function* (bindings) {
 *   the next model request, reattaches through the prompt-coverage rule after a crash, and the
 *   joined Submissions settle with the host outcome (DUR-002/DUR-016).
 * - `runWorker(agent)` — scan-seeded, wake-driven worker loop over every lane (WP4's host driver),
-*   reimplemented over a singleton identity-exact (digest-transparent) Binding resolution: a
-*   claimed head belonging to a different Agent never runs against this binding (SUB-023); a
-*   parent-linked head refused this way settles with the framework `ChildCompatibilityFailure`.
+*   over a singleton current Binding: a claimed head belonging to a different Agent never
+*   runs against this binding. Missing bindings leave accepted roots and children owed.
 * - `processThreadResolved(threadId)` / `runResolvedWorker` — the
-*   S2 multi-binding equivalents over registrations owned by the runtime Layer (spec §11, D7): every claimed
-*   head's stored `(agentId, agentDigests)` resolves to the exact registered Binding before any
-*   code runs; an unresolvable parent-linked child settles with the Schema-stable framework
-*   `ChildCompatibilityFailure` (no application code, the child never executes), and an
-*   unresolvable root surfaces the typed refusal after releasing the claim.
+*   equivalents over registrations owned by the runtime Layer: each stable `agentId` selects
+*   one current Binding. Unfinished operation contracts gate handler execution independently
+*   of immutable admission evidence; missing bindings release the claim with a typed refusal.
 * - `runRecovery()` — classify every nonterminal Submission with the pure `classifyRecovery` and
-*   execute the repair decisions, appending a `RepairAnnotated` audit record per executed decision
+*   execute repair decisions, annotating owned repair attempts with their granted epochs
 *   (DUR-013). Untouched ready input and model-resuming work are reported `deferred` for a
-*   worker claim; lanes blocked on
+*   worker claim; Submissions parked on
 *   Unknown Outcomes are reported `unknown`. The S2 binding-free Subagent executors (admission
 *   completion, start-link repair, waiting restoration, wake replay, canonical join accounting,
 *   abort propagation, orphan reservation release) run here; the settlement join itself is
@@ -6381,4 +6604,4 @@ var DurableAgentRuntime = class DurableAgentRuntime extends Context.Service()("@
 //#endregion
 export { RecoveryReport as a, recoveryRepairRecordId as c, DurableRuntimeConfig as i, threadCreatedBatchId as l, DurableAgentRuntime_exports as n, childReservationIdFor as o, DurableApprovalResolver as r, recoveryRepairBatchId as s, DurableAgentRuntime as t, threadCreatedRecordId as u };
 
-//# sourceMappingURL=DurableAgentRuntime-BGwGUIT-.mjs.map
+//# sourceMappingURL=DurableAgentRuntime-gF4YiEj2.mjs.map