effect-agent 0.1.0-beta.97 → 0.1.0-beta.99

package/src/durable/DurableFailpoint.ts

@@ -32,6 +32,8 @@ export const DurableRuntimeFailpointLocation = Schema.Literals([
   "checkpoint:after-save",
   "tools:after-prepared-append",
   "tools:before-prepared-append",
+  "tools:before-unavailable-append",
+  "tools:after-unavailable-append",
   "policy:before-reservation-append",
   "policy:after-reservation-append",
   "step:after-step-append",

package/src/durable/Records.ts

@@ -200,17 +200,17 @@ export class DefinitionDigestInput extends Schema.Class<DefinitionDigestInput>(
   tools: PersistedJson,
 }) {}
 
-/** The contracts a retained Run may decode or execute, independent of its deployment. */
+/** Admission-time operation fingerprints. Agent fingerprints remain immutable evidence only. */
 export class ReplayContract extends Schema.Class<ReplayContract>(
   "@effect-agent/thread/ReplayContract",
 )({
   agent: Digest,
-  /** Agent semantics and output/completion codecs; the saved input is checked separately. */
+  /** Retained for reading earlier admissions; never selects executable code. */
   agentBehavior: Schema.optionalKey(Digest),
   tools: Schema.Record(Schema.String, Digest),
 }) {}
 
-/** Digests identify admission exactly; replay contracts separately authorize continuation. */
+/** Digests identify admission exactly; only an unfinished operation needs replay compatibility. */
 export class DefinitionDigests extends Schema.Class<DefinitionDigests>(
   "@effect-agent/thread/DefinitionDigests",
 )({
@@ -292,6 +292,24 @@ export class ToolCallSettled extends Schema.TaggedClass<ToolCallSettled>(
   budgetRejected: Schema.optionalKey(Schema.Literal(true)),
 }) {}
 
+/** Compact execution evidence committed with a declaration, before any handler can start. */
+export class ToolOperation extends Schema.Class<ToolOperation>(
+  "@effect-agent/thread/ToolOperation",
+)({
+  toolCallId: ToolCallId,
+  toolName: BoundedName,
+  executionClass: Schema.Literals(["readonly", "idempotent", "uncertain"]),
+  executionKind: ToolExecutionKind,
+  replay: Digest,
+}) {}
+
+/** A retired call's runtime result. Unavailable readonly work may already have been observed. */
+export class ToolUnavailable extends Schema.TaggedClass<ToolUnavailable>()("ToolUnavailable", {
+  toolName: BoundedName,
+  execution: Schema.Literals(["not-executed", "unavailable"]),
+  message: BoundedText,
+}) {}
+
 /**
  * One committed model Turn. `messages` carries the Schema-encoded Effect AI Prompt messages this
  * Turn appended (assistant response plus any tool-call declarations), committed atomically at the
@@ -299,6 +317,8 @@ export class ToolCallSettled extends Schema.TaggedClass<ToolCallSettled>(
  * `messagesDigest` pins the exact encoded content.
  */
 const ModelResponseRecordedFields = Schema.Struct({
+  /** Original operation identity/semantics, independent of later Agent and toolbox changes. */
+  toolOperations: Schema.optionalKey(Schema.Array(ToolOperation)),
   /** Explicit pre-execution failures, committed with the original arguments before any approval. */
   toolParameterRejections: Schema.optionalKey(Schema.Array(ToolParameterRejection)),
   toolExposure: Schema.optionalKey(Snapshot),
@@ -309,8 +329,9 @@ const ModelResponseRecordedFields = Schema.Struct({
   messagesDigest: Digest,
   /**
    * Number of leading messages that belong only to this Run's evaluated instructions and wake
-   * input. They remain canonical and are visible while recovering this Run, but later Runs omit
-   * them from their model-facing history. Records without this field retain their full history.
+   * input. They remain canonical. Continuations replace the instruction messages with current
+   * instructions while retaining user input; later Runs also retain that original user intent.
+   * Records without this field retain their full history.
    */
   runScopedPrefixLength: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThan(0))),
   /**
@@ -366,6 +387,8 @@ export class ToolCallPrepared extends Schema.TaggedClass<ToolCallPrepared>(
   parametersDigest: Digest,
   /** Absent legacy evidence grants no delegation replay authority. */
   executionKind: Schema.optionalKey(ToolExecutionKind),
+  executionClass: Schema.optionalKey(ToolOperation.fields.executionClass),
+  replay: Schema.optionalKey(Digest),
 }) {}
 
 /** Monotonic reservations charged before programmatic execution or grace finalization. */
@@ -520,6 +543,8 @@ export class RunFailed extends Schema.TaggedClass<RunFailed>("@effect-agent/thre
 const RunCompletedFields = Schema.Struct({
   runId: RunId,
   output: PersistedJson,
+  /** Integrity of validated terminal values, independent of future application codecs. */
+  resultDigest: Schema.optionalKey(Digest),
   /** Application disposition captured with an ordinary completion. */
   runDisposition: Schema.optionalKey(PersistedJson),
   /** Honest soft-landing marker, present exactly when `exhausted` is present. */

package/src/durable/Recovery.ts

@@ -22,8 +22,8 @@ export class OpenToolCallEvidence extends Schema.Class<OpenToolCallEvidence>(
 
 /**
  * A committed tool-declaring response with ZERO prepared and ZERO settled records for its Turn:
- * the provably-safe durability §15 window — no prepared records means no handler ran, so the
- * declared batch resumes without model re-invocation and without Unknown.
+ * the durability §15 batch-resume window. Mutation preparation has not committed; readonly
+ * handlers may already have run. The worker checks each unfinished operation before execution.
  */
 export class DeclaredPendingBatchEvidence extends Schema.Class<DeclaredPendingBatchEvidence>(
   "@effect-agent/thread/DeclaredPendingBatchEvidence",
@@ -217,7 +217,7 @@ export class MarkUnknown extends Schema.TaggedClass<MarkUnknown>(
 }) {}
 
 /** A committed tool-declaring response has zero prepared and zero settled records: a worker
- * resumes the declared batch — no model re-invocation, no Unknown (durability §15). S2 also
+ * checks unfinished contracts and resumes the declared batch without model re-invocation. S2 also
  * routes an open delegation call WITHOUT establishment evidence here (spec §13 row 1): the
  * declared batch re-executes and the idempotent establishment converges on one child. */
 export class ResumePendingToolBatch extends Schema.TaggedClass<ResumePendingToolBatch>(
@@ -239,14 +239,14 @@ export class ResumeSuspended extends Schema.TaggedClass<ResumeSuspended>(
   "@effect-agent/thread/ResumeSuspended",
 )("ResumeSuspended", { submissionId: SubmissionId }) {}
 
-/** Unknown Outcomes lack covering resolutions: the lane stays blocked awaiting the authorized
+/** Unknown Outcomes lack covering resolutions: this Submission stays parked awaiting the authorized
  * DUR-017 resolution path; the obligation stays visible, nothing replays. */
 export class AwaitUnknownResolution extends Schema.TaggedClass<AwaitUnknownResolution>(
   "@effect-agent/thread/AwaitUnknownResolution",
 )("AwaitUnknownResolution", { submissionId: SubmissionId }) {}
 
-/** Durable resolution intents cover every open call: apply them canonically
- * (`ToolCallResolved` + `ToolCallSettled` for recovered results) and reopen the lane. */
+/** Durable resolution intents cover every open call: wake the original Submission when its
+ * required retry contract is supported. Canonical outcomes are applied by the next claim. */
 export class ApplyUnknownResolutions extends Schema.TaggedClass<ApplyUnknownResolutions>(
   "@effect-agent/thread/ApplyUnknownResolutions",
 )("ApplyUnknownResolutions", { submissionId: SubmissionId }) {}
@@ -843,8 +843,8 @@ const classifyDelegationAbort = (
  *    ApplyJoinAccounting → CompleteChildAdmission → RepairSubagentStartLink →
  *    AwaitChildAdmissionResolution → ResumePendingToolBatch (idempotent handler re-entry) →
  *    EnsureWaitingForChild → ResumeWaitingParent → ReleaseOrphanChildReservation.
- * 10. declared-but-unprepared tool batch → ResumePendingToolBatch — no handler ran (no prepared
- *     records), so the batch resumes with no model re-invocation and no Unknown (§15).
+ * 10. declared-but-unprepared tool batch → ResumePendingToolBatch — the worker checks original
+ *     operation contracts; missing preparation proves no mutation dispatch, not readonly nonexecution (§15).
  * 11. `admitted` → a parent-linked Submission whose Thread lacks the canonical lineage
  *     record defers (AwaitParentEstablishment: the parent's idempotent establishment
  *     completes it); otherwise

package/src/durable/RunJournal.ts

@@ -372,7 +372,7 @@ export interface RunJournalProjection {
   readonly policyUsage: RunPolicyUsage;
   /** Canonical projection for the requested Run; may end at its resumable Tool declaration. */
   readonly prompt: Prompt.Prompt;
-  /** Valid prior-Run history excluding the projected Run's records and orphan Tool batches. */
+  /** Prior-Run history with model-only unknown results closing incomplete application calls. */
   readonly historyBefore: Prompt.Prompt;
   /** Number of canonical Turns already committed for the projected Run. */
   readonly committedTurns: number;
@@ -471,13 +471,6 @@ const declaredApplicationToolCallIds = (prompt: Prompt.Prompt): ReadonlyArray<st
   return ids;
 };
 
-const withoutApplicationToolCallMessages = (prompt: Prompt.Prompt): ReadonlyArray<Prompt.Message> =>
-  prompt.content.filter(
-    (message) =>
-      message.role !== "assistant" ||
-      !message.content.some((part) => part.type === "tool-call" && !part.providerExecuted),
-  );
-
 /**
  * Phase 5 audit tags that are prompt-transparent: they carry durability evidence (preparation,
  * unknown marking, resolution, Step results, approvals, interruption) but contribute nothing to
@@ -517,9 +510,8 @@ const PROMPT_TRANSPARENT_TAGS: ReadonlySet<string> = new Set([
 
 /**
  * Pure projection: rebuild one Run's resume state from canonical records (DUR-015). Canonical
- * order is authoritative; the fold projects each complete `ModelResponseRecorded` Turn and the
- * owning Run's resumable incomplete Tool Turn, while excluding incomplete Tool batches from prior
- * Runs. It flushes each contiguous group of valid `ToolCallSettled` records into one Tool message,
+ * order is authoritative; the fold projects each `ModelResponseRecorded` Turn and the
+ * owning Run's resumable incomplete Tool Turn. It flushes each contiguous group of valid `ToolCallSettled` records into one Tool message,
  * exactly mirroring the per-Turn commit shape produced by `turnCanonicalBatch` (no-tool Turns) and
  * by the
  * `turnResponseBatch`/`turnResultsBatch` split (tool-declaring Turns). The Phase 5 audit tags
@@ -528,8 +520,10 @@ const PROMPT_TRANSPARENT_TAGS: ReadonlySet<string> = new Set([
  *
  * An incomplete application Tool turn remains visible while projecting its owning Run so active
  * recovery can resume the declared batch. It is not a valid model-visible Turn boundary for a
- * later Run: the orphan assistant Tool declaration and any partial Tool results from that Turn
- * are excluded, while preceding instruction/user messages in the response record remain history.
+ * later Run until model-only unknown results close its missing calls. Those explanatory results
+ * are never canonical settlements or evidence for compaction, recovery or accounting. Real
+ * results replace them at the original declaration, including results appended after another Run.
+ * Prior user intent and assistant text remain visible; prior system instructions do not.
  */
 /** @internal Lightweight canonical boundaries collected without retaining record payloads. */
 export interface JournalBoundary {
@@ -921,6 +915,18 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
     }
   });
 
+  // Slots refer to the retained Prompt itself, not an additional history payload index.
+  // Only still-unseen results retain a slot; late results fill the original declaration in place.
+  const historicalResults = new Map<
+    string,
+    {
+      readonly allIndex: number;
+      readonly beforeIndex: number;
+      readonly parts: Array<Prompt.ToolResultPart>;
+      readonly partIndex: number;
+    }
+  >();
+
   let pendingToolOrder = new Map<string, number>();
 
   const flushTools = Effect.fn("RunJournal.flushTools")(function* (
@@ -1009,12 +1015,32 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
       }
       emitSummary();
       if (payload._tag === "ToolCallSettled") {
-        if (payload.runId !== ownerRunId && incompleteToolCalls.has(envelope.record.recordId)) {
+        if (payload.runId !== ownerRunId) {
+          const slot = historicalResults.get(envelope.record.recordId);
+
+          if (slot === undefined)
+            return yield* journalError("Historical Tool result has no matching declaration");
+          const declared = slot.parts[slot.partIndex];
+
+          if (declared?.id !== payload.toolCallId || declared.name !== payload.toolName)
+            return yield* journalError("Historical Tool result differs from its declaration");
+          slot.parts[slot.partIndex] = Prompt.makePart("tool-result", {
+            id: payload.toolCallId,
+            name: payload.toolName,
+            result: envelope.sequence <= clearBound ? CLEARED_TOOL_RESULT : payload.result,
+            isFailure: payload.isFailure,
+            providerExecuted: false,
+          });
+          const message = Prompt.makeMessage("tool", { content: [...slot.parts] });
+
+          state.all[slot.allIndex] = message;
+          state.before[slot.beforeIndex] = message;
+          historicalResults.delete(envelope.record.recordId);
           onBoundary?.({
             sequence: envelope.sequence,
             tag: payload._tag,
-            promptLength: state.all.length + (state.pendingTools.length === 0 ? 0 : 1),
-            incomplete: true,
+            promptLength: state.all.length,
+            ...(incompleteToolCalls.has(envelope.record.recordId) ? { incomplete: true } : {}),
             ...(isTerminalPriorRun(payload.runId, ownerRunId, Number.POSITIVE_INFINITY)
               ? { terminalPriorRun: true }
               : {}),
@@ -1066,20 +1092,59 @@ export const projectRunJournalStream = Effect.fn("RunJournal.projectRunJournalSt
 
       yield* accountResponse(envelope, payload, messages);
 
-      const modelVisible =
-        !forRun && payload.runScopedPrefixLength !== undefined
-          ? Prompt.fromMessages(messages.content.slice(payload.runScopedPrefixLength))
-          : messages;
-
-      const visibleMessages =
-        !forRun && incompleteToolTurns.has(envelope.record.recordId)
-          ? withoutApplicationToolCallMessages(modelVisible)
-          : modelVisible.content;
+      const visibleMessages = forRun
+        ? messages.content
+        : messages.content.filter((message) => message.role !== "system");
 
       for (const message of visibleMessages) {
         state.all.push(message);
         if (!forRun) state.before.push(message);
       }
+      if (!forRun) {
+        const calls = messages.content.flatMap((message) =>
+          message.role === "assistant"
+            ? message.content.filter(
+                (part): part is Prompt.ToolCallPart =>
+                  part.type === "tool-call" && !part.providerExecuted,
+              )
+            : [],
+        );
+
+        if (calls.length > 0) {
+          const parts = calls.map((call) =>
+            Prompt.makePart("tool-result", {
+              id: call.id,
+              name: call.name,
+              result: {
+                _tag: "ToolOutcomeUnknown",
+                message:
+                  "This earlier operation has no recorded outcome. It may have executed. Do not assume success or retry it; its original operation remains unresolved.",
+              },
+              isFailure: true,
+              providerExecuted: false,
+            }),
+          );
+
+          const allIndex = state.all.length;
+          const beforeIndex = state.before.length;
+          const message = Prompt.makeMessage("tool", { content: parts });
+
+          state.all.push(message);
+          state.before.push(message);
+          for (const [partIndex, call] of calls.entries()) {
+            const callId = yield* Schema.decodeEffect(ToolCallId)(call.id).pipe(
+              Effect.mapError((cause) => journalError("Invalid historical Tool Call ID", cause)),
+            );
+
+            historicalResults.set(toolCallSettledRecordId(payload.runId, payload.turn, callId), {
+              allIndex,
+              beforeIndex,
+              parts,
+              partIndex,
+            });
+          }
+        }
+      }
       state = {
         ...state,
         committedTurns: forRun
@@ -1158,6 +1223,7 @@ const validStagedUsage = (label: string, value: number): Effect.Effect<number, R
       );
 
 export interface TurnCommitInput {
+  readonly toolOperations?: ModelResponseRecorded["toolOperations"] | undefined;
   readonly toolParameterRejections?: ReadonlyArray<ToolParameterRejection> | undefined;
   readonly toolExposure?: Snapshot | undefined;
   readonly toolSelections?: ReadonlyMap<string, Selection> | undefined;
@@ -1300,6 +1366,7 @@ const modelResponseRecord = Effect.fn("RunJournal.modelResponseRecord")(function
     createdAt: input.createdAt,
     deploymentId: input.deploymentId,
     payload: ModelResponseRecorded.make({
+      ...(input.toolOperations === undefined ? {} : { toolOperations: input.toolOperations }),
       ...(input.toolParameterRejections === undefined || input.toolParameterRejections.length === 0
         ? {}
         : { toolParameterRejections: input.toolParameterRejections }),
@@ -1379,29 +1446,39 @@ const toolSettledRecords = Effect.fn("RunJournal.toolSettledRecords")(function*
   return toolRecords;
 });
 
-const runCompletionRecord = (input: TurnCommitInput): RecordEnvelope | undefined =>
-  input.runCompletion === undefined
-    ? undefined
-    : RecordEnvelope.make({
-        recordId: runCompletedRecordId(input.runId),
-        family: "thread",
-        schemaVersion: 1,
-        createdAt: input.createdAt,
-        deploymentId: input.deploymentId,
-        payload: RunCompleted.make({
-          runId: input.runId,
-          output: input.runCompletion.output,
-          ...(input.runCompletion.runDisposition === undefined
-            ? {}
-            : { runDisposition: input.runCompletion.runDisposition }),
-          ...(input.runCompletion.finishReason === undefined
-            ? {}
-            : { finishReason: input.runCompletion.finishReason }),
-          ...(input.runCompletion.exhausted === undefined
-            ? {}
-            : { exhausted: input.runCompletion.exhausted }),
-        }),
-      });
+/** Integrity of the original validated terminal values; never a current-code projection. */
+export const runCompletionDigest = (
+  completion: Pick<
+    RunCompleted,
+    "runId" | "output" | "runDisposition" | "finishReason" | "exhausted"
+  >,
+) =>
+  digestJson({
+    runId: completion.runId,
+    output: completion.output,
+    runDisposition: completion.runDisposition ?? null,
+    finishReason: completion.finishReason ?? null,
+    exhausted: completion.exhausted ?? null,
+  });
+
+const runCompletionRecord = Effect.fn("RunJournal.runCompletionRecord")(function* (
+  input: TurnCommitInput,
+) {
+  if (input.runCompletion === undefined) return undefined;
+  const completion = { runId: input.runId, ...input.runCompletion };
+
+  return RecordEnvelope.make({
+    recordId: runCompletedRecordId(input.runId),
+    family: "thread",
+    schemaVersion: 1,
+    createdAt: input.createdAt,
+    deploymentId: input.deploymentId,
+    payload: RunCompleted.make({
+      ...completion,
+      resultDigest: yield* runCompletionDigest(completion),
+    }),
+  });
+});
 
 /**
  * Pure per-Turn canonical batch builder (TurnCompleted seam fold, D6/D8): one
@@ -1420,7 +1497,7 @@ export const turnCanonicalBatch = Effect.fn("RunJournal.turnCanonicalBatch")(fun
   const { promptMessages, toolParts } = splitTurnMessages(input.appended);
   const modelResponse = yield* modelResponseRecord(input, promptMessages);
   const toolRecords = yield* toolSettledRecords(input, toolParts);
-  const completionRecord = runCompletionRecord(input);
+  const completionRecord = yield* runCompletionRecord(input);
 
   return CanonicalBatch.make({
     batchId: turnBatchId(input.runId, input.turn),
@@ -1465,7 +1542,7 @@ export const turnResponseBatch = Effect.fn("RunJournal.turnResponseBatch")(funct
  */
 export const turnResultsBatch = Effect.fn("RunJournal.turnResultsBatch")(function* (
   input: TurnCommitInput,
-): Effect.fn.Return<CanonicalBatch, RunJournalError> {
+): Effect.fn.Return<CanonicalBatch, RunJournalError | DigestError, Crypto.Crypto> {
   yield* requireCanonicalTurn(input.turn);
   const { toolParts } = splitTurnMessages(input.appended);
   const toolRecords = yield* toolSettledRecords(input, toolParts);
@@ -1477,7 +1554,7 @@ export const turnResultsBatch = Effect.fn("RunJournal.turnResultsBatch")(functio
   if (input.runCompletion !== undefined && toolRecords.length !== 1) {
     return yield* journalError("A terminal Tool completion requires exactly one settled result");
   }
-  const completionRecord = runCompletionRecord(input);
+  const completionRecord = yield* runCompletionRecord(input);
 
   return CanonicalBatch.make({
     batchId: turnResultsBatchId(input.runId, input.turn),

package/src/durable/SubmissionLedger.ts

@@ -61,12 +61,12 @@ export type OwnershipToken = typeof OwnershipToken.Type;
  *   host Run's outcome.
  * - `suspended` — durably waiting for explicit approval decisions; the ownership period has
  *   ended and the lane consumes no worker permit while the obligation stays owed.
- * - `unknown` — at least one ordinary Tool Call has a durable Unknown Outcome; the lane is
- *   blocked until an authorized resolution covers every open call or a durable abort intent
- *   authorizes cleanup and aborted settlement without Tool replay (DUR-012/DUR-017).
+ * - `unknown` — at least one Tool Call has a durable Unknown Outcome; this Submission is
+ *   parked until an authorized resolution covers every open call or a durable abort intent
+ *   authorizes cleanup without Tool replay. Later eligible input may run (DUR-012/DUR-017).
  *
- * `claim` never grants a `joining`, `joined`, or `suspended` head. An `unknown` head is
- * claimable only with a durable abort intent, under the ordinary lease and fencing rules.
+ * `claim` never grants or bypasses a `joining`, `joined`, or `suspended` head. It skips unknown
+ * work without an abort intent. Any live ownership in the Thread prevents another claim.
  */
 export const SubmissionState = Schema.Literals([
   "admitted",
@@ -676,7 +676,7 @@ export class ApprovalDecisionIntent extends Schema.Class<ApprovalDecisionIntent>
 
 /**
  * Durable Unknown marking for one Submission's open ordinary Tool Calls (DUR-009): state →
- * `unknown`, the lane blocks, ownership-free (recovery may mark without a claim). Idempotent.
+ * `unknown`, parking that Submission without changing ownership or the Thread epoch. Idempotent.
  */
 export class MarkUnknownRequest extends Schema.Class<MarkUnknownRequest>(
   "@effect-agent/thread/MarkUnknownRequest",
@@ -954,10 +954,10 @@ export type SubmissionLedgerFailure =
  *   Marking an already-ready (or later-state) Submission is a no-op.
  * - `lookup` — read one Submission by identity or scoped idempotency key; strongly consistent
  *   with prior ledger writes.
- * - `claim` — FIFO-head claim rule: claims ONLY the lowest unsettled `queueSequence` of the
- *   requested Thread lane (DUR-004/DUR-005), regardless of that head's nonterminal state,
- *   and returns `Option.none` when the lane has no unsettled work or the head's lease is still
- *   live under another owner. A successful claim atomically bumps the Thread's producer
+ * - `claim` — claims the lowest unsettled `queueSequence` after skipping only unknown rows
+ *   without abort intent. Approval, joining and child-wait barriers remain ordered. Returns
+ *   `Option.none` when no eligible work exists or ANY lease in the Thread is live, including
+ *   a lease belonging to the same producer. A successful claim atomically bumps the Thread's producer
  *   epoch — fencing every stale Attempt out of canonical appends (DUR-006) — mints a fresh
  *   `attemptId` and `ownershipToken`, and starts the ownership lease (D5: adapters default to
  *   `DEFAULT_OWNERSHIP_LEASE_DURATION`, configurable). An expired lease makes the head
@@ -1040,8 +1040,9 @@ export type SubmissionLedgerFailure =
  *   with `ChildReservationConflict`. "A crash before release leaves budget unavailable until
  *   repair, never available twice" (spec §12).
  * - `markUnknown` — idempotent, ownership-free (canonical evidence authorizes it): state →
- *   `unknown`, the lane blocks and stops consuming worker permits while the accepted settlement
- *   obligation stays visible (DUR-009/DUR-017). Fails with `SettlementConflict` once settled.
+ *   `unknown`, parking the Submission while its accepted settlement obligation stays visible.
+ *   Existing ownership must release or expire before another claim (DUR-009/DUR-017).
+ *   Fails with `SettlementConflict` once settled.
  * - `recordUnknownResolution` — durable, idempotent per `(submissionId, toolCallId)`; a
  *   divergent re-resolution fails with `UnknownResolutionConflict`. Transitions
  *   `unknown → input-applied` once no open call remains, waking the lane. Fails with

package/src/durable/SubmissionLedgerConformance.ts

@@ -2877,9 +2877,20 @@ const unknownAbortClaim = conformanceCase(
         }
         yield* advancePastLease(original.leaseExpiresAt);
         if (!abortFirst) {
+          const later = yield* expectSome(
+            "runnable follower behind unknown work",
+            yield* claimLane(threadId, PRODUCER_B),
+          );
+
           yield* ensure(
-            Option.isNone(yield* claimLane(threadId, PRODUCER_B)),
-            "Unknown work and its follower must wait without an authorized abort",
+            later.submissionId === follower.submissionId,
+            "Unknown work must preserve the queue order of runnable followers",
+          );
+          yield* ledger.releaseOwnership(
+            ReleaseOwnershipRequest.make({
+              submissionId: later.submissionId,
+              ownershipToken: later.ownershipToken,
+            }),
           );
         }
         const intent = yield* ledger.requestAbort(command);

package/src/durable/ThreadInvariants.ts

@@ -10,6 +10,7 @@ import {
   type ProducerId,
   type RecordEnvelope,
 } from "./Records.ts";
+import { runIdForSubmission } from "./RunJournal.ts";
 import {
   submissionInputRecordId,
   submissionSettlementRecordId,
@@ -110,7 +111,9 @@ const batchRunsOf = (records: ReadonlyArray<CanonicalRecordEnvelope>): Array<Bat
  * 4. `digest-chain` — the tail digest recomputes from `EMPTY_TAIL_DIGEST` through every batch
  *    (requires the per-batch producer directory; skipped honestly otherwise).
  * 5. `fifo-input-order` / `fifo-settlement-order` — canonical input and settlement records
- *    follow the admitted queue order (DUR-004). Aborted settlements of never-run work (no
+ *    follow the admitted queue order (DUR-004), except a later input may settle before a Run
+ *    with canonically unresolved unknown calls when that input became active. Resolving those
+ *    calls later does not revoke the later Run's ownership. Aborted settlements of never-run work (no
  *    canonical `input:{sid}` record) are exempt from the settlement comparison: P7 §7(c)
  *    settles them immediately without waiting for the head, and DUR-004 bounds execution
  *    order, which never-run work has none of.
@@ -279,14 +282,65 @@ export const verifyThreadInvariants = Effect.fn("Thread.verifyThreadInvariants")
   // 5b. fifo-settlement-order — P7 §7(c) exemption: an ABORTED settlement for never-run work
   // (no canonical `input:{sid}` record) settles immediately by design, without waiting to
   // head the lane, so it is excluded from the FIFO comparison. DUR-004 bounds EXECUTION
-  // order; the exempted rows provably never executed.
+  // order; the exempted rows provably never executed. Unknown work can also be bypassed,
+  // but only the inputs that became active while it was parked may settle ahead of it.
   {
     const recordIdSet = new Set<string>(recordIds);
     const abortedNeverRun = new Set<string>();
 
+    const settlementByRun = new Map<string, string>(
+      ordered.map((row) => [
+        runIdForSubmission(row.submissionId),
+        submissionSettlementRecordId(row.submissionId),
+      ]),
+    );
+
+    const inputSettlements = new Map(
+      ordered.map((row) => [
+        submissionInputRecordId(row.submissionId),
+        submissionSettlementRecordId(row.submissionId),
+      ]),
+    );
+
+    const unknownCalls = new Map<string, Set<string>>();
+    const abortsOrTerminals = new Set<string>();
+    const bypassedSettlements = new Map<string, Set<string>>();
+
     for (const envelope of records) {
       const payload = envelope.record.payload;
 
+      if (payload._tag === "ToolCallUnknown" && !abortsOrTerminals.has(payload.runId)) {
+        const calls = unknownCalls.get(payload.runId) ?? new Set<string>();
+
+        calls.add(payload.toolCallId);
+        unknownCalls.set(payload.runId, calls);
+      } else if (payload._tag === "ToolCallResolved" || payload._tag === "ToolCallSettled") {
+        const calls = unknownCalls.get(payload.runId);
+
+        calls?.delete(payload.toolCallId);
+        if (calls?.size === 0) unknownCalls.delete(payload.runId);
+      } else if (payload._tag === "AbortRequested" || payload._tag === "SubmissionSettled") {
+        const runId = runIdForSubmission(payload.submissionId);
+
+        abortsOrTerminals.add(runId);
+        unknownCalls.delete(runId);
+      } else if (payload._tag === "RunCompleted" || payload._tag === "RunFailed") {
+        abortsOrTerminals.add(payload.runId);
+        unknownCalls.delete(payload.runId);
+      } else if (payload._tag === "UserInputRecorded") {
+        const settlementId = inputSettlements.get(envelope.record.recordId);
+
+        if (settlementId !== undefined) {
+          const bypassed = new Set<string>();
+
+          for (const runId of unknownCalls.keys()) {
+            const earlier = settlementByRun.get(runId);
+
+            if (earlier !== undefined) bypassed.add(earlier);
+          }
+          bypassedSettlements.set(settlementId, bypassed);
+        }
+      }
       if (
         payload._tag === "SubmissionSettled" &&
         payload.outcome === "aborted" &&
@@ -309,9 +363,20 @@ export const verifyThreadInvariants = Effect.fn("Thread.verifyThreadInvariants")
       presentSettlements.has(expected),
     );
 
-    const matches =
-      settlementOrder.length === expectedPresent.length &&
-      settlementOrder.every((recordId, index) => recordId === expectedPresent[index]);
+    const remaining = new Set(expectedPresent);
+    let matches = settlementOrder.length === expectedPresent.length;
+
+    for (const recordId of settlementOrder) {
+      for (const earlier of remaining) {
+        if (earlier === recordId) break;
+        if (!bypassedSettlements.get(recordId)?.has(earlier)) {
+          matches = false;
+          break;
+        }
+      }
+      if (!matches) break;
+      remaining.delete(recordId);
+    }
 
     checks.push(
       matches

package/src/durable/ToolReconciler.ts

@@ -20,9 +20,12 @@ export class PreparedToolCallEvidence extends Schema.Class<PreparedToolCallEvide
   toolName: ToolCallPrepared.fields.toolName,
   parameters: PersistedJson,
   parametersDigest: Digest,
+  executionKind: ToolCallPrepared.fields.executionKind,
+  executionClass: ToolCallPrepared.fields.executionClass,
+  replay: ToolCallPrepared.fields.replay,
 }) {}
 
-/** Proof that the external execution never started: the call may re-execute on resume. */
+/** Proof of nonexecution: resume the original operation or report it unavailable. */
 export class ReconciliationNeverStarted extends Schema.TaggedClass<ReconciliationNeverStarted>(
   "@effect-agent/thread/ReconciliationNeverStarted",
 )("NeverStarted", {}) {}
@@ -38,7 +41,7 @@ export class ReconciliationCompleted extends Schema.TaggedClass<ReconciliationCo
   isFailure: Schema.Boolean,
 }) {}
 
-/** The call is safe to repeat under a stable external idempotency contract. */
+/** Only the original operation, identity and parameters may repeat under supported semantics. */
 export class ReconciliationSafeToRetry extends Schema.TaggedClass<ReconciliationSafeToRetry>(
   "@effect-agent/thread/ReconciliationSafeToRetry",
 )("SafeToRetry", {}) {}
@@ -54,7 +57,8 @@ export class ReconciliationUncertain extends Schema.TaggedClass<ReconciliationUn
  * What a reconciliation policy can prove about one prepared-but-unsettled ordinary Tool Call
  * (durability §10): execution never started, execution completed with a recoverable result,
  * execution is safe to repeat, or nothing — in which case the Run enters Unknown. The engine
- * never manufactures an error result and continues.
+ * never invents an external result. Proven nonexecution can close a retired operation with
+ * an explicit not-executed result; uncertainty stays parked.
  */
 export const ReconciliationDecision = Schema.Union([
   ReconciliationNeverStarted,