Method enqueueRuntimeEventStore

packages/runtime/src/agent-run.ts:1638–1685

(
    label: string,
    operation: () => Promise<void>,
    options: { rethrow?: boolean } = {},
  )

  }

  private enqueueRuntimeEventStore(
    label: string,
    operation: () => Promise<void>,
    options: { rethrow?: boolean } = {},
  ): Promise<void> {
    if (!this.input.runtimeEventStore || !this.runtimeEventStoreAvailable) return Promise.resolve();
    const next = this.runtimeEventQueue.then(operation, operation).catch(async (error) => {
      // A rejection is the ledger refusing one malformed candidate, not the
      // store going away: it stays healthy and readable, so the latch would
      // only cost this run the writes it still owes — above all its own
      // terminal event, which `recordRuntimeEvents` refuses once the store
      // reads unavailable. That is how a single refused append left a run at
      // `running` with no terminal event and no visible failure (#2234). The
      // append still fails the caller (a producer bug must not pass quietly),
      // but the ledger stays open so the turn can end the way every other
      // failure ends.
      //
      // Only that one class is exempt. A store that went away keeps latching:
      // nothing this run emits next can land.
      //
      // `ToolLedgerCorruptionError` also keeps latching, and that is the
      // right economy for THIS path: stream writes stay fail-closed against
      // a damaged ledger. What the latch must not cost is the terminal fact
      // (#2313): the health scan gates only tool-bearing appends, so the
      // terminal event is a write the damaged ledger would have taken.
      // `commitTerminalRun` therefore carries the one exception: under a
      // corruption latch it still attempts the terminal durability barrier
      // (the barrier is its own scoped probe), so the run says it ended
      // while everything routed through here keeps failing closed.
      if (error instanceof RunSealedError) {
        // A refusal that is correct in itself (#2311): the run already owns
        // its terminal fact, and a straggler from the still-draining stream
        // is by definition not part of it. Neither the store nor this run's
        // durable history is at fault, so no latch and no trace-write
        // failure; a caller that asked for the rejection still receives it.
        if (options.rethrow) throw error;
        return;
      }
      if (!(error instanceof ToolLedgerRejectionError)) {
        this.runtimeEventStoreAvailable = false;
        this.runtimeEventStoreFailure = error;
      }
      await this.enqueueTraceWriteFailure(error, label);
      if (options.rethrow) throw error;
    });
    this.runtimeEventQueue = next.catch(() => {});
    return next;
  }

  private async recordRuntimePartial(event: RuntimeEvent, streamKey: string): Promise<void> {
    const store = this.input.runtimeEventStore;