@effect-agent/testing 0.0.1-beta.0

package/dist/index.mjs

@@ -0,0 +1,4205 @@
+import { McpConnectionRequest, McpConnector, McpServerIdentity, McpToolkitMismatch, Redactor, Subagent, SubagentPolicy, SubagentReservationsMemoryLive, SubagentRuntime, connectMcp, delegationAllocationFromPolicy } from "@effect-agent/capabilities";
+import { Agent, AgentId, AgentPolicy, ConversationId, IdGenerator, RunId, SubmissionId, ToolCallId, TurnId } from "@effect-agent/core";
+import { DurableStep, DurableStepError, ToolExecutionClass } from "@effect-agent/engine";
+import { AbortCommand, AgentBindingResolver, ApprovalDecisionCommand, BatchId, CanonicalBatch, CanonicalRecordEnvelope, CertificationReport, CertificationSweepResult, CertificationTierThreeReport, CertifiedAdapterIdentity, ConversationCheckpoint, ConversationExportRequest, ConversationProjection, ConversationStore, DEFAULT_OWNERSHIP_LEASE_DURATION, DefinitionDigests, DeploymentId, Digest, DurableAgentRuntime, DurableRuntimeConfig, DurableRuntimeFailpoint, DurableRuntimeFailpointError, DurableRuntimeFailpointLocation, DurableRuntimeFailpointTestControl, DurableWorkerBinding, IdempotencyKey, LoadCheckpointRequest, ObligationThresholds, PersistedJson, Principal, ProducerId, ReconciliationCompleted, ReconciliationSafeToRetry, ReconciliationUncertain, RecordEnvelope, RecordId, ResolutionAbortSubmission, ResolutionCompletedWithResult, ResolutionNeverHappened, ResolutionSafeToRetry, SubmissionLedger, SubmissionLookupById, ToolReconciler, ToolReconcilerError, UnknownResolutionCommand, WakeScheduler, certifyPorts, childConversationIdFor, verifyConversationInvariants } from "@effect-agent/session";
+import { Cause, Clock, Context, DateTime, Deferred, Duration, Effect, Exit, Layer, Option, Ref, Schema, Stream } from "effect";
+import { FastCheck, TestClock } from "effect/testing";
+import { AiError, LanguageModel, Model, Response, Tool, Toolkit } from "effect/unstable/ai";
+import * as McpSchema from "effect/unstable/ai/McpSchema";
+//#region src/certification.ts
+/** The six Tier-2 scenario shapes in sweep order. */
+const CERTIFICATION_SCENARIOS = [
+	"plain",
+	"uncertain-tool",
+	"durable-steps",
+	"approval",
+	"join",
+	"delegation"
+];
+/**
+* Coordinator failpoint locations that none of the six scenario shapes can reach, recorded
+* honestly instead of silently claimed: all three sit on operator/abort paths the shapes do
+* not take. They are pinned in-process by the P5/S2 suites
+* (`packages/testing/test/durable-tools.test.ts` "resolveUnknown is idempotent across the
+* intent failpoint", `durable-runtime.test.ts` abort rows,
+* `durable-subagents.test.ts` abort propagation) and by the process-kill/eviction crash
+* matrices. Runner tests assert the observed never-fired set equals EXACTLY this list, so a
+* protocol change that silently stops exercising a location fails the certification.
+*/
+const TIER2_UNREACHED_LOCATIONS = [
+	"abort:after-intent",
+	"resolve:after-intent",
+	"subagent:after-child-abort-intent"
+];
+/** Locations of `tier2` rows whose armed fault never fired in ANY scenario, sorted. */
+const tier2NeverFiredLocations = (tier2) => {
+	const fired = /* @__PURE__ */ new Set();
+	for (const row of tier2) if (row.failpointFired) fired.add(row.location);
+	return DurableRuntimeFailpointLocation.literals.filter((location) => !fired.has(location)).sort();
+};
+const SHA_A = Schema.decodeSync(Digest)("a".repeat(64));
+const DIGESTS = DefinitionDigests.make({
+	agent: SHA_A,
+	model: SHA_A,
+	tools: SHA_A
+});
+const CHILD_DIGEST_STRINGS = {
+	agent: "b".repeat(64),
+	model: "c".repeat(64),
+	tools: "d".repeat(64)
+};
+const CHILD_DIGESTS = DefinitionDigests.make({
+	agent: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.agent),
+	model: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.model),
+	tools: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.tools)
+});
+const PRINCIPAL = Schema.decodeSync(Principal)("principal-certification");
+const decodeConversationId$1 = Schema.decodeSync(ConversationId);
+const decodeIdempotencyKey$1 = Schema.decodeSync(IdempotencyKey);
+const decodeToolCallId$1 = Schema.decodeSync(ToolCallId);
+const usage$2 = {
+	inputTokens: {},
+	outputTokens: {}
+};
+const finalParts$1 = (text) => [
+	{
+		type: "text-start",
+		id: "answer"
+	},
+	{
+		type: "text-delta",
+		id: "answer",
+		delta: text
+	},
+	{
+		type: "text-end",
+		id: "answer"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: usage$2
+	}
+];
+const toolCallPart$1 = (id, name, params) => ({
+	type: "tool-call",
+	id,
+	name,
+	params,
+	providerExecuted: false
+});
+const toolTurn$1 = (...calls) => [...calls, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: usage$2
+}];
+/**
+* Stateless scripted model that decides by PROMPT SHAPE instead of call count: while the
+* prompt carries no committed tool result the model declares `toolParts` (when given),
+* otherwise it answers with the final text. Deciding on the canonical prompt keeps every cell
+* deterministic regardless of where the injected fault fell — a re-invoked Turn re-declares
+* the same batch and a resumed batch flows into the final answer, so every scenario always
+* exercises its tool path and always converges.
+*/
+const promptShapeModel = (name, finalText, toolParts) => Model.make("scripted", name, Layer.effect(LanguageModel.LanguageModel, LanguageModel.make({
+	generateText: () => Effect.succeed([]),
+	streamText: (request) => {
+		const hasToolResult = request.prompt.content.some((message) => message.role === "tool");
+		const parts = toolParts === void 0 || hasToolResult ? finalParts$1(finalText) : toolParts;
+		return Stream.fromIterable(parts);
+	}
+})));
+const policy$1 = AgentPolicy.make({
+	maxTurns: 4,
+	maxToolCalls: 4,
+	maxDuration: "30 seconds",
+	toolConcurrency: 2
+});
+const QuestionInput = Schema.Struct({ question: Schema.String });
+const AnswerOutput = Schema.Struct({ answer: Schema.String });
+/** plain / join: no tools — the pure Turn/submission/join seams. */
+const plainDefinition$1 = Agent.define("certify-plain", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Answer as JSON.",
+	toolkit: Toolkit.empty,
+	policy: policy$1
+});
+/** uncertain-tool: unannotated → fail-closed `uncertain`, enters the prepared/settled protocol. */
+const Book = Tool.make("book", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ confirmation: Schema.String })
+});
+const bookToolkit = Toolkit.make(Book);
+const uncertainDefinition = Agent.define("certify-uncertain", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Book it.",
+	toolkit: bookToolkit,
+	policy: policy$1
+});
+/** durable-steps: declaring `DurableStep` as a dependency is what makes the Tool durable. */
+const Itinerary$2 = Tool.make("itinerary", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ state: Schema.String }),
+	failure: DurableStepError,
+	dependencies: [DurableStep]
+});
+const itineraryToolkit = Toolkit.make(Itinerary$2);
+const stepsDefinition = Agent.define("certify-steps", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Reserve the itinerary.",
+	toolkit: itineraryToolkit,
+	policy: policy$1
+});
+/** approval: fail-closed — no `DurableApprovalResolver` Layer, so undecided approvals suspend. */
+const BookApproval$1 = Tool.make("book", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ confirmation: Schema.String }),
+	needsApproval: true
+});
+const approvalToolkit = Toolkit.make(BookApproval$1);
+const approvalDefinition$1 = Agent.define("certify-approval", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Book after approval.",
+	toolkit: approvalToolkit,
+	policy: policy$1
+});
+/** delegation: durable attached child plus an ordinary uncertain sibling in ONE batch. */
+const childDefinition$1 = Agent.define("certify-child", {
+	input: QuestionInput,
+	output: AnswerOutput,
+	instructions: "Answer as JSON.",
+	toolkit: Toolkit.empty,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 1,
+		maxDuration: "30 seconds",
+		toolConcurrency: 1
+	})
+});
+var CertifyDelegationFailed = class extends Schema.TaggedErrorClass()("CertifyDelegationFailed", { childErrorTag: Schema.String }) {};
+const researchDelegation = Subagent.define("delegate_research", {
+	description: "Research one bounded question and return findings.",
+	target: childDefinition$1,
+	parameters: Schema.Struct({ topic: Schema.String }),
+	success: Schema.Struct({ summary: Schema.String }),
+	failure: CertifyDelegationFailed,
+	prepareInput: ({ topic }) => Effect.succeed({ question: `research:${topic}` }),
+	projectResult: (output) => Effect.succeed({ summary: `finding:${output.answer}` }),
+	policy: SubagentPolicy.make({
+		maxChildren: 2,
+		maxConcurrency: 2,
+		maxTurns: 4,
+		maxToolCalls: 4,
+		maxDuration: "10 seconds"
+	})
+});
+const Lookup = Tool.make("lookup", {
+	parameters: Schema.Struct({ key: Schema.String }),
+	success: Schema.Struct({ value: Schema.String })
+});
+const coordinatorDefinition$1 = Agent.define("certify-coordinator", {
+	input: Schema.Struct({ mission: Schema.String }),
+	output: Schema.Struct({ report: Schema.String }),
+	instructions: "Delegate and look up, then answer as JSON.",
+	toolkit: Toolkit.make(researchDelegation.tool, Lookup),
+	policy: AgentPolicy.make({
+		maxTurns: 4,
+		maxToolCalls: 3,
+		maxDuration: "30 seconds",
+		toolConcurrency: 2
+	})
+});
+const mapChildFailure = (failure) => CertifyDelegationFailed.make({ childErrorTag: failure._tag });
+const DELEGATE_CALL = decodeToolCallId$1("delegate-1");
+/** Fixture-only identity source consumed by the delegation Layer's ephemeral capture. */
+const identifiers = Layer.effect(IdGenerator, Effect.gen(function* () {
+	const counter = yield* Ref.make(0);
+	const next = (decode, prefix) => Ref.getAndUpdate(counter, (value) => value + 1).pipe(Effect.map((value) => decode(`${prefix}-${value}`)));
+	return {
+		nextConversationId: next(decodeConversationId$1, "certify-fixture-conversation"),
+		nextRunId: next(Schema.decodeSync(RunId), "certify-fixture-run"),
+		nextTurnId: next(Schema.decodeSync(TurnId), "certify-fixture-turn")
+	};
+}));
+const delegationSupport$1 = Layer.mergeAll(SubagentReservationsMemoryLive, identifiers);
+const submitOptionsFor = (slug, conversationId) => ({
+	conversationId,
+	principal: PRINCIPAL,
+	idempotencyKey: decodeIdempotencyKey$1(`certify-key-${slug}`),
+	definitions: DIGESTS
+});
+/** One single-agent cell: one lane, one Submission, one registered exact-digest binding. */
+const makeSingleAgentCell = (definition, resolved, slug) => {
+	const conversationId = decodeConversationId$1(`certify-${slug}`);
+	const submit = Effect.gen(function* () {
+		return [yield* (yield* DurableAgentRuntime).submit({ definition: {
+			id: definition.id,
+			input: definition.input
+		} }, { question: `certify ${slug}` }, submitOptionsFor(slug, conversationId))];
+	});
+	return {
+		resolver: AgentBindingResolver.fromBindings([resolved]),
+		submit,
+		lanes: () => [conversationId]
+	};
+};
+const makeCell = Effect.fn("Certification.makeCell")(function* (scenario, slug) {
+	switch (scenario) {
+		case "plain": {
+			const binding = Agent.withModel(plainDefinition$1, promptShapeModel("certify-plain", "{\"answer\":\"done\"}"));
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS);
+			return makeSingleAgentCell(plainDefinition$1, resolved, slug);
+		}
+		case "uncertain-tool": {
+			const binding = Agent.withModel(uncertainDefinition, promptShapeModel("certify-uncertain", "{\"answer\":\"booked\"}", toolTurn$1(toolCallPart$1("book-1", "book", { ref: `r-${slug}` }))));
+			const toolLayer = bookToolkit.toLayer({ book: ({ ref }) => Effect.succeed({ confirmation: `confirmed-${ref}` }) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(uncertainDefinition, resolved, slug);
+		}
+		case "durable-steps": {
+			const binding = Agent.withModel(stepsDefinition, promptShapeModel("certify-steps", "{\"answer\":\"reserved\"}", toolTurn$1(toolCallPart$1("itinerary-1", "itinerary", { ref: `trip-${slug}` }))));
+			const toolLayer = itineraryToolkit.toLayer({ itinerary: ({ ref }) => Effect.gen(function* () {
+				const step = yield* DurableStep;
+				return { state: `${yield* step.do("reserve-flight", Schema.String, Effect.succeed(`flight-${ref}`))}+${yield* step.do("reserve-lodging", Schema.String, Effect.succeed(`lodging-${ref}`))}` };
+			}) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(stepsDefinition, resolved, slug);
+		}
+		case "approval": {
+			const binding = Agent.withModel(approvalDefinition$1, promptShapeModel("certify-approval", "{\"answer\":\"approved\"}", toolTurn$1(toolCallPart$1("book-1", "book", { ref: `r-${slug}` }))));
+			const toolLayer = approvalToolkit.toLayer({ book: ({ ref }) => Effect.succeed({ confirmation: `confirmed-${ref}` }) });
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(Effect.provide(toolLayer));
+			return makeSingleAgentCell(approvalDefinition$1, resolved, slug);
+		}
+		case "join": {
+			const binding = Agent.withModel(plainDefinition$1, promptShapeModel("certify-join", "{\"answer\":\"host answer\"}"));
+			const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS);
+			const conversationId = decodeConversationId$1(`certify-${slug}`);
+			const submitOne = (key, question) => Effect.gen(function* () {
+				return yield* (yield* DurableAgentRuntime).submit({ definition: {
+					id: plainDefinition$1.id,
+					input: plainDefinition$1.input
+				} }, { question }, {
+					conversationId,
+					principal: PRINCIPAL,
+					idempotencyKey: decodeIdempotencyKey$1(key),
+					definitions: DIGESTS
+				});
+			});
+			return {
+				resolver: AgentBindingResolver.fromBindings([resolved]),
+				submit: Effect.gen(function* () {
+					return [yield* submitOne(`certify-key-${slug}-host`, "host question"), yield* submitOne(`certify-key-${slug}-queued`, "queued question")];
+				}),
+				lanes: () => [conversationId]
+			};
+		}
+		case "delegation": {
+			const childBinding = Agent.withModel(childDefinition$1, promptShapeModel("certify-child", "{\"answer\":\"child-answer\"}"));
+			const parentBinding = Agent.withModel(coordinatorDefinition$1, promptShapeModel("certify-parent", "{\"report\":\"done\"}", toolTurn$1(toolCallPart$1("delegate-1", "delegate_research", { topic: "paris" }), toolCallPart$1("lookup-1", "lookup", { key: "hotels" }))));
+			const delegationLayer = SubagentRuntime.layer(researchDelegation, childBinding, {
+				mapChildFailure,
+				durable: { targetDigests: CHILD_DIGEST_STRINGS }
+			}).pipe(Layer.provide(delegationSupport$1));
+			const lookupLayer = Toolkit.make(Lookup).toLayer({ lookup: ({ key }) => Effect.succeed({ value: `found-${key}` }) });
+			const parentResolved = yield* DurableWorkerBinding.make(parentBinding, DIGESTS).pipe(Effect.provide(Layer.mergeAll(delegationLayer, lookupLayer)));
+			const childResolved = yield* DurableWorkerBinding.make(childBinding, CHILD_DIGESTS);
+			const conversationId = decodeConversationId$1(`certify-${slug}`);
+			return {
+				resolver: AgentBindingResolver.fromBindings([parentResolved, childResolved]),
+				submit: Effect.gen(function* () {
+					return [yield* (yield* DurableAgentRuntime).submit({ definition: {
+						id: coordinatorDefinition$1.id,
+						input: coordinatorDefinition$1.input
+					} }, { mission: "plan" }, submitOptionsFor(slug, conversationId))];
+				}),
+				lanes: (receipts) => {
+					const parent = receipts.at(0);
+					return parent === void 0 ? [conversationId] : [conversationId, childConversationIdFor(parent.submissionId, DELEGATE_CALL)];
+				}
+			};
+		}
+	}
+});
+/** Maximum recovery/drive/unblock rounds before a cell is reported non-convergent. */
+const MAX_REDRIVE_ROUNDS = 8;
+/**
+* Verify one lane after convergence: canonical export + every lane Submission the ledger or
+* the log names (the same collection rule as the admin `verify` member), fed to the shared
+* invariant checker in convergence mode WITH the captured per-batch producer directory, so
+* the digest chain is fully recomputed instead of skipped.
+*/
+const verifyLane = Effect.fn("Certification.verifyLane")(function* (lane, batchProducers) {
+	const store = yield* ConversationStore;
+	const ledger = yield* SubmissionLedger;
+	const exported = yield* store.export(ConversationExportRequest.make({ conversationId: lane }));
+	const rows = /* @__PURE__ */ new Map();
+	const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
+	for (const submission of nonterminal) if (submission.conversationId === lane) rows.set(submission.submissionId, submission);
+	const named = /* @__PURE__ */ new Set();
+	for (const envelope of exported.records) {
+		const payload = envelope.record.payload;
+		if (payload._tag === "UserInputRecorded" || payload._tag === "SubmissionSettled" || payload._tag === "AbortRequested") named.add(payload.submissionId);
+	}
+	for (const submissionId of named) {
+		if (rows.has(submissionId)) continue;
+		const found = yield* ledger.lookup(SubmissionLookupById.make({ submissionId }));
+		if (Option.isSome(found) && found.value.conversationId === lane) rows.set(submissionId, found.value);
+	}
+	const checkpoint = yield* store.loadCheckpoint(LoadCheckpointRequest.make({ conversationId: lane }));
+	return yield* verifyConversationInvariants({
+		export: exported,
+		submissions: [...rows.values()],
+		batchProducers,
+		checkpoint: Option.getOrUndefined(checkpoint),
+		requireAllSettled: true
+	});
+});
+const failureTagOf = (cause) => {
+	const failure = Cause.findErrorOption(cause);
+	if (Option.isSome(failure)) {
+		const error = failure.value;
+		if (typeof error === "object" && error !== null && "_tag" in error) return String(error._tag);
+		return String(error).slice(0, 256);
+	}
+	return "defect";
+};
+/** One Tier-2 sweep cell: arm `location` one-shot, drive `scenario`, converge, verify. */
+const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (scenario, location, batchProducers, leaseAdvance) {
+	const runtime = yield* DurableAgentRuntime;
+	const ledger = yield* SubmissionLedger;
+	const control = yield* DurableRuntimeFailpointTestControl;
+	const slug = `${scenario}-${location.replaceAll(":", "-")}`;
+	const failed = (detail, fired) => CertificationSweepResult.make({
+		scenario,
+		location,
+		failpointFired: fired,
+		status: "failed",
+		digestChainVerified: false,
+		detail: detail.slice(0, 4096)
+	});
+	const cell = yield* makeCell(scenario, slug);
+	const fired = yield* Ref.make(false);
+	yield* control.setHandler((hit) => hit !== location ? Effect.void : Ref.getAndSet(fired, true).pipe(Effect.flatMap((already) => already ? Effect.void : Effect.fail(DurableRuntimeFailpointError.make({ location: hit })))));
+	let receipts;
+	const firstSubmit = yield* Effect.exit(cell.submit);
+	if (Exit.isSuccess(firstSubmit)) receipts = firstSubmit.value;
+	else {
+		const secondSubmit = yield* Effect.exit(cell.submit);
+		if (Exit.isFailure(secondSubmit)) {
+			yield* control.clear;
+			return failed(`submission replay did not recover: ${failureTagOf(secondSubmit.cause)}`, yield* Ref.get(fired));
+		}
+		receipts = secondSubmit.value;
+	}
+	const lanes = cell.lanes(receipts);
+	const driveLane = (lane) => runtime.processConversationResolved(lane).pipe(Effect.provideService(AgentBindingResolver, cell.resolver));
+	const allSettled = Effect.gen(function* () {
+		for (const receipt of receipts) {
+			const snapshot = yield* ledger.lookup(SubmissionLookupById.make({ submissionId: receipt.submissionId }));
+			if (Option.isNone(snapshot) || snapshot.value.state !== "settled") return false;
+		}
+		return true;
+	});
+	let converged = false;
+	for (let round = 0; round < MAX_REDRIVE_ROUNDS && !converged; round++) {
+		yield* TestClock.adjust(leaseAdvance);
+		yield* Effect.exit(runtime.runRecovery);
+		for (const lane of lanes) yield* Effect.exit(driveLane(lane));
+		for (const lane of lanes) {
+			const explains = yield* Effect.exit(runtime.explainConversation(lane));
+			if (Exit.isFailure(explains)) continue;
+			for (const explanation of explains.value) {
+				for (const unknown of explanation.evidence.unknownCalls) {
+					if (unknown.resolved) continue;
+					yield* Effect.exit(runtime.resolveUnknown(UnknownResolutionCommand.make({
+						submissionId: explanation.submission.submissionId,
+						toolCallId: unknown.toolCallId,
+						author: "certification-runner",
+						reason: `re-drive after injected fault at ${location}`,
+						resolution: ResolutionSafeToRetry.make()
+					})));
+				}
+				for (const pending of explanation.evidence.approvalsPending) {
+					if (explanation.evidence.approvalDecisions.some((decision) => decision.toolCallId === pending.toolCallId)) continue;
+					yield* Effect.exit(runtime.resolveApproval(ApprovalDecisionCommand.make({
+						submissionId: explanation.submission.submissionId,
+						toolCallId: pending.toolCallId,
+						decision: "approved",
+						resolver: "certification-runner",
+						reason: `re-drive after injected fault at ${location}`
+					})));
+				}
+			}
+		}
+		const settled = yield* Effect.exit(allSettled);
+		converged = Exit.isSuccess(settled) && settled.value;
+	}
+	yield* control.clear;
+	const wasFired = yield* Ref.get(fired);
+	if (!converged) return failed(`did not converge within ${MAX_REDRIVE_ROUNDS} re-drive rounds`, wasFired);
+	let digestChainVerified = true;
+	const failedChecks = [];
+	for (const lane of lanes) {
+		const verdict = yield* Effect.exit(verifyLane(lane, batchProducers));
+		if (Exit.isFailure(verdict)) return failed(`lane ${lane} could not be verified: ${failureTagOf(verdict.cause)}`, wasFired);
+		for (const check of verdict.value.checks) {
+			if (check.status === "failed") failedChecks.push(`${lane}:${check.name}${check.detail === void 0 ? "" : ` (${check.detail})`}`);
+			if (check.name === "digest-chain" && check.status !== "passed") digestChainVerified = false;
+		}
+	}
+	if (failedChecks.length > 0 || !digestChainVerified) return failed(failedChecks.length > 0 ? `invariant checks failed: ${failedChecks.join("; ")}` : "the digest chain was not fully recomputed", wasFired);
+	return CertificationSweepResult.make({
+		scenario,
+		location,
+		failpointFired: wasFired,
+		status: wasFired ? "converged" : "not-triggered",
+		digestChainVerified
+	});
+});
+/**
+* Resolve the Tier-3 record honestly (plan §1): a non-durable reference adapter has no real
+* loss to exercise (`not-applicable`); a supplied lever runs NOW (`exercised`); committed
+* real-loss citations are recorded (`recorded-evidence`); otherwise the certificate says
+* `not-exercised` — a scoped statement, never a silent claim.
+*/
+const resolveTierThree = Effect.fn("Certification.resolveTierThree")(function* (durability, options) {
+	if (durability === "non-durable") return CertificationTierThreeReport.make({
+		status: "not-applicable",
+		evidence: [],
+		cases: [],
+		detail: "the adapter declares non-durable state (reference/conformance adapter); there is no real loss to exercise"
+	});
+	if (options.crashLever !== void 0) {
+		const cases = yield* options.crashLever;
+		return CertificationTierThreeReport.make({
+			status: "exercised",
+			evidence: options.tierThreeEvidence ?? [],
+			cases
+		});
+	}
+	if (options.tierThreeEvidence !== void 0 && options.tierThreeEvidence.length > 0) return CertificationTierThreeReport.make({
+		status: "recorded-evidence",
+		evidence: options.tierThreeEvidence,
+		cases: []
+	});
+	return CertificationTierThreeReport.make({
+		status: "not-exercised",
+		evidence: [],
+		cases: [],
+		detail: "no crash lever was supplied and no committed real-loss evidence was cited; Tier 3 is NOT discharged for this adapter"
+	});
+});
+const nowUtc = Effect.map(Clock.currentTimeMillis, (millis) => DateTime.toUtc(DateTime.makeUnsafe(millis)));
+/**
+* Certify one durable adapter pair (plan §1, §8 WP2). Runs Tier 2 FIRST over pristine
+* storage (each cell converges to all-settled before the next starts, so the recovery scan
+* never sees foreign leftovers), then Tier 1's port contract cases (whose lanes deliberately
+* end in every nonterminal shape), then records Tier 3. Requires `Crypto.Crypto` and a
+* TestClock-backed environment; the candidate Layers are built exactly once.
+*/
+const certifyDurableAdapters = (options) => {
+	const batchProducers = /* @__PURE__ */ new Map();
+	const capturingStore = Layer.effect(ConversationStore)(Effect.gen(function* () {
+		const inner = yield* ConversationStore;
+		return ConversationStore.of({
+			...inner,
+			append: (request) => Effect.sync(() => {
+				batchProducers.set(request.batch.batchId, request.batch.producerId);
+			}).pipe(Effect.andThen(inner.append(request)))
+		});
+	})).pipe(Layer.provide(options.conversationStore));
+	const support = Layer.mergeAll(options.submissionLedger, capturingStore, options.wakeScheduler ?? WakeScheduler.layerNoop, DurableRuntimeFailpoint.layerTest, ToolReconciler.uncertain, DurableRuntimeConfig.layer({
+		deploymentId: Schema.decodeSync(DeploymentId)("deployment-certification"),
+		producerId: Schema.decodeSync(ProducerId)("producer-certification"),
+		settlementPollInterval: Duration.millis(50),
+		leaseRenewalInterval: Duration.seconds(5),
+		abortPollInterval: Duration.millis(50)
+	}));
+	const environment = DurableAgentRuntime.layer.pipe(Layer.provideMerge(support));
+	const leaseAdvance = Duration.millis(Duration.toMillis(options.ownershipLeaseDuration ?? DEFAULT_OWNERSHIP_LEASE_DURATION) + 1e3);
+	return Effect.gen(function* () {
+		const ledger = yield* SubmissionLedger;
+		const tier2 = [];
+		for (const scenario of CERTIFICATION_SCENARIOS) for (const location of DurableRuntimeFailpointLocation.literals) tier2.push(yield* runSweepCell(scenario, location, batchProducers, leaseAdvance));
+		const tier1 = yield* certifyPorts();
+		const capabilities = yield* ledger.capabilities;
+		const tier3 = yield* resolveTierThree(capabilities.durability, options);
+		const generatedAt = yield* nowUtc;
+		const ok = tier1.every((result) => result.status === "passed") && tier2.every((result) => result.status !== "failed") && tier3.cases.every((result) => result.status === "passed");
+		return CertificationReport.make({
+			format: "effect-agent/certification@1",
+			adapter: CertifiedAdapterIdentity.make({
+				name: options.adapter.name,
+				...options.adapter.version === void 0 ? {} : { version: options.adapter.version },
+				durability: capabilities.durability
+			}),
+			generatedAt,
+			tier1,
+			tier2,
+			tier3,
+			ok
+		});
+	}).pipe(Effect.provide(environment));
+};
+//#endregion
+//#region src/chaos.ts
+/**
+* P7 WP4 chaos machinery (plan §5): a Schema-first `ChaosPlan`, a seeded generator over
+* `effect/testing/FastCheck` (already inside the pinned Effect — no new dependency), and a
+* deterministic runner that drives the durable coordinator over whatever adapter pair the test
+* provides. Every plan ends in the SAME claims the crash matrices make:
+*
+* 1. `verifyConversationInvariants` in convergence mode over every touched Conversation (the
+*    shared WP1 checker — one set of claims for admin verify, certification, chaos, and soak);
+* 2. `scanObligations` returning ZERO entries (everything settled; nothing invisibly stuck);
+* 3. supplier non-fabrication wherever the deterministic desk was in play (durability §10: no
+*    canonical Tool success exists that the external store did not actually produce).
+*
+* Replay contract: the memory/SQLite chaos tests derive every plan from one root seed
+* (`CHAOS_SEED` env override; see `chaosSeedFromEnv`) and print that seed plus the failing
+* plan's own seed in the failure output, so any red run is replayable byte-for-byte.
+*/
+/** The six durable scenario flavors a chaos lane can exercise (plan §5). */
+const ChaosScenarioKind = Schema.Literals([
+	"plain",
+	"uncertain-tool",
+	"durable-steps",
+	"approval",
+	"join",
+	"delegation"
+]);
+const LaneIndex = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(7));
+/** One Submission of a plan: which lane it queues into and that lane's scenario flavor. */
+var ChaosSubmissionSpec = class extends Schema.Class("@effect-agent/testing/ChaosSubmissionSpec")({
+	lane: LaneIndex,
+	/** The lane's flavor; the FIRST spec of a lane fixes the lane's agent. */
+	kind: ChaosScenarioKind
+}) {};
+/** How the runner resolves a durable Unknown Outcome it encounters (DUR-017 driver). */
+const ChaosResolutionKind = Schema.Literals([
+	"never-happened",
+	"completed-from-supplier",
+	"abort-submission"
+]);
+const ChaosApprovalDecision = Schema.Literals(["approved", "denied"]);
+const BoundedAdapterArm = Schema.String.check(Schema.isMaxLength(128));
+/**
+* One seeded chaos plan (plan §5): the full fault schedule is data, so a failing run replays
+* from the plan alone. `failpointArms` are coordinator locations; `adapterArms` are
+* adapter-owned location names the adapter test validates (the memory runner has none).
+*/
+var ChaosPlan = class extends Schema.Class("@effect-agent/testing/ChaosPlan")({
+	/** Identifies this plan in failure output; derived from the root seed plus the plan index. */
+	seed: Schema.Int,
+	/** Lane count; submissions address lanes `0..lanes-1`. */
+	lanes: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(8)),
+	submissions: Schema.NonEmptyArray(ChaosSubmissionSpec),
+	/** Coordinator failpoint arms, consumed one per round (each fails every hit that round). */
+	failpointArms: Schema.Array(DurableRuntimeFailpointLocation),
+	/** Adapter-owned failpoint arms (e.g. SQLite `ledger:*`/`append:*` locations). */
+	adapterArms: Schema.Array(BoundedAdapterArm),
+	/** Flattened submission indices to abort mid-plan (modulo the submission count). */
+	abortInjections: Schema.Array(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))),
+	/** Resolution choices for Unknown Outcomes, indexed deterministically per open call. */
+	resolutionInjections: Schema.Array(ChaosResolutionKind),
+	/** Approval decisions for suspended approval lanes, indexed deterministically per call. */
+	approvalDecisions: Schema.Array(ChaosApprovalDecision)
+}) {};
+/** Per-lane verification result inside a plan report. */
+var ChaosLaneReport = class extends Schema.Class("@effect-agent/testing/ChaosLaneReport")({
+	conversationId: ConversationId,
+	kind: ChaosScenarioKind,
+	submissionCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	/** Verdict of `verifyConversationInvariants` in convergence mode. */
+	verified: Schema.Boolean
+}) {};
+/** The Schema-first outcome of one executed chaos plan. */
+var ChaosPlanReport = class extends Schema.Class("@effect-agent/testing/ChaosPlanReport")({
+	seed: Schema.Int,
+	rounds: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	lanes: Schema.Array(ChaosLaneReport),
+	/** `scanObligations` entries after convergence — MUST be zero. */
+	openObligations: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+}) {};
+/** Typed convergence/verification failure of one chaos plan (never a bare defect). */
+var ChaosConvergenceFailure = class extends Schema.TaggedErrorClass()("ChaosConvergenceFailure", {
+	seed: Schema.Int,
+	message: Schema.String.check(Schema.isMaxLength(16384))
+}) {};
+/** Default root seed for chaos suites; override with the `CHAOS_SEED` environment variable. */
+const DEFAULT_CHAOS_SEED = 20260813;
+/** The root seed for this run: `CHAOS_SEED` when set to an integer, the default otherwise. */
+const chaosSeedFromEnv = (env) => {
+	const raw = env["CHAOS_SEED"];
+	if (raw === void 0 || raw === "") return DEFAULT_CHAOS_SEED;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isSafeInteger(parsed) ? parsed : DEFAULT_CHAOS_SEED;
+};
+const laneArbitrary = FastCheck.constantFrom("plain", "uncertain-tool", "durable-steps", "approval", "join", "delegation").chain((kind) => kind === "join" ? FastCheck.integer({
+	min: 2,
+	max: 3
+}).map((depth) => ({
+	kind,
+	depth
+})) : kind === "plain" ? FastCheck.integer({
+	min: 1,
+	max: 2
+}).map((depth) => ({
+	kind,
+	depth
+})) : FastCheck.constant({
+	kind,
+	depth: 1
+}));
+const planShapeArbitrary = (adapterArms) => FastCheck.record({
+	lanes: FastCheck.array(laneArbitrary, {
+		minLength: 1,
+		maxLength: 3
+	}),
+	failpointArms: FastCheck.uniqueArray(FastCheck.constantFrom(...DurableRuntimeFailpointLocation.literals), { maxLength: 3 }),
+	adapterArms: adapterArms.length === 0 ? FastCheck.constant([]) : FastCheck.uniqueArray(FastCheck.constantFrom(...adapterArms), { maxLength: 2 }),
+	abortInjections: FastCheck.uniqueArray(FastCheck.integer({
+		min: 0,
+		max: 15
+	}), { maxLength: 2 }),
+	resolutionInjections: FastCheck.array(FastCheck.constantFrom("never-happened", "completed-from-supplier", "abort-submission"), { maxLength: 4 }),
+	approvalDecisions: FastCheck.array(FastCheck.constantFrom("approved", "denied"), { maxLength: 2 })
+}).map((shape) => {
+	const [first, ...rest] = shape.lanes.flatMap((lane, index) => Array.from({ length: lane.depth }, () => ChaosSubmissionSpec.make({
+		lane: index,
+		kind: lane.kind
+	})));
+	if (first === void 0) throw new Error("chaos generator produced an empty plan");
+	return {
+		lanes: shape.lanes.length,
+		submissions: [first, ...rest],
+		failpointArms: shape.failpointArms,
+		adapterArms: shape.adapterArms,
+		abortInjections: shape.abortInjections,
+		resolutionInjections: shape.resolutionInjections,
+		approvalDecisions: shape.approvalDecisions
+	};
+});
+/**
+* Derive `count` chaos plans deterministically from one root seed. The same
+* `{seed, count, adapterArms}` triple always yields byte-identical plans, so a failure line
+* `CHAOS_SEED=<seed>` replays the exact schedule.
+*/
+const generateChaosPlans = (options) => {
+	return FastCheck.sample(planShapeArbitrary(options.adapterArms ?? []), {
+		seed: options.seed,
+		numRuns: options.count
+	}).map((shape, index) => ChaosPlan.make({
+		...shape,
+		seed: Math.imul(options.seed, 31) + index | 0
+	}));
+};
+/** Deterministic PRNG for the runner's small ordering choices (lane drive order). */
+const mulberry32 = (seed) => {
+	let state = seed | 0;
+	return () => {
+		state = state + 1831565813 | 0;
+		let t = Math.imul(state ^ state >>> 15, 1 | state);
+		t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
+		return ((t ^ t >>> 14) >>> 0) / 4294967296;
+	};
+};
+const usage$1 = {
+	inputTokens: {},
+	outputTokens: {}
+};
+const finalParts = (text) => [
+	{
+		type: "text-start",
+		id: "answer"
+	},
+	{
+		type: "text-delta",
+		id: "answer",
+		delta: text
+	},
+	{
+		type: "text-end",
+		id: "answer"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: usage$1
+	}
+];
+const toolTurn = (...calls) => [...calls, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: usage$1
+}];
+const toolCallPart = (id, name, params) => ({
+	type: "tool-call",
+	id,
+	name,
+	params,
+	providerExecuted: false
+});
+/**
+* Prompt-shaped scripted model: the response depends ONLY on the request prompt, so it stays
+* deterministic across Attempt re-invocations, batch resumes, and joined steering — no counter
+* to drift when chaos re-enters a Turn.
+*/
+const promptScriptedModel = (label, script) => Model.make("scripted", label, Layer.effect(LanguageModel.LanguageModel, LanguageModel.make({
+	generateText: () => Effect.succeed([]),
+	streamText: (request) => Stream.fromIterable(script(request.prompt))
+})));
+const lastRole = (prompt) => prompt.content.at(-1)?.role;
+const policy = AgentPolicy.make({
+	maxTurns: 3,
+	maxToolCalls: 4,
+	maxDuration: "30 seconds",
+	toolConcurrency: 2
+});
+const PlainInput = Schema.Struct({ question: Schema.String });
+const PlainOutput = Schema.Struct({ answer: Schema.String });
+const plainDefinition = Agent.define("chaos-plain", {
+	input: PlainInput,
+	output: PlainOutput,
+	instructions: "Answer as JSON.",
+	toolkit: Toolkit.empty,
+	policy
+});
+/** Unannotated → fail-closed `uncertain`: enters the prepared/settled protocol (DUR-009). */
+const BookUncertain = Tool.make("book", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ confirmation: Schema.String })
+});
+const bookTools = Toolkit.make(BookUncertain);
+const bookDefinition = Agent.define("chaos-book", {
+	input: PlainInput,
+	output: PlainOutput,
+	instructions: "Book it.",
+	toolkit: bookTools,
+	policy
+});
+const BookApproval = Tool.make("book", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ confirmation: Schema.String }),
+	needsApproval: true
+});
+const approvalTools = Toolkit.make(BookApproval);
+const approvalDefinition = Agent.define("chaos-approval", {
+	input: PlainInput,
+	output: PlainOutput,
+	instructions: "Book after approval.",
+	toolkit: approvalTools,
+	policy
+});
+const Itinerary$1 = Tool.make("itinerary", {
+	parameters: Schema.Struct({ ref: Schema.String }),
+	success: Schema.Struct({ state: Schema.String }),
+	failure: DurableStepError,
+	dependencies: [DurableStep]
+}).annotate(ToolExecutionClass, "uncertain");
+const itineraryTools = Toolkit.make(Itinerary$1);
+const itineraryDefinition = Agent.define("chaos-itinerary", {
+	input: PlainInput,
+	output: PlainOutput,
+	instructions: "Reserve the itinerary.",
+	toolkit: itineraryTools,
+	policy
+});
+const childDefinition = Agent.define("chaos-child", {
+	input: PlainInput,
+	output: PlainOutput,
+	instructions: "Answer as JSON.",
+	toolkit: Toolkit.empty,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 1,
+		maxDuration: "30 seconds",
+		toolConcurrency: 1
+	})
+});
+var ChaosDelegationFailed = class extends Schema.TaggedErrorClass()("ChaosDelegationFailed", { childErrorTag: Schema.String }) {};
+const chaosDelegation = Subagent.define("delegate_chaos", {
+	description: "Delegate one bounded chaos question.",
+	target: childDefinition,
+	parameters: Schema.Struct({ topic: Schema.String }),
+	success: Schema.Struct({ summary: Schema.String }),
+	failure: ChaosDelegationFailed,
+	prepareInput: ({ topic }) => Effect.succeed({ question: `chaos:${topic}` }),
+	projectResult: (output) => Effect.succeed({ summary: `finding:${output.answer}` }),
+	policy: SubagentPolicy.make({
+		maxChildren: 2,
+		maxConcurrency: 2,
+		maxTurns: 4,
+		maxToolCalls: 4,
+		maxDuration: "30 seconds"
+	})
+});
+const coordinatorDefinition = Agent.define("chaos-coordinator", {
+	input: Schema.Struct({ mission: Schema.String }),
+	output: Schema.Struct({ report: Schema.String }),
+	instructions: "Delegate, then report as JSON.",
+	toolkit: Toolkit.make(chaosDelegation.tool),
+	policy
+});
+const DELEGATE_CALL_ID = "chaos-delegate-1";
+const HEX = "0123456789abcdef";
+const decodeDigest = Schema.decodeSync(Digest);
+const laneDigests = (lane) => {
+	const digest = decodeDigest(HEX[lane % 8].repeat(64));
+	return DefinitionDigests.make({
+		agent: digest,
+		model: digest,
+		tools: digest
+	});
+};
+const childDigestStrings = (lane) => {
+	const char = HEX[8 + lane % 8];
+	return {
+		agent: char.repeat(64),
+		model: char.repeat(64),
+		tools: char.repeat(64)
+	};
+};
+const childLaneDigests = (lane) => {
+	const strings = childDigestStrings(lane);
+	return DefinitionDigests.make({
+		agent: decodeDigest(strings.agent),
+		model: decodeDigest(strings.model),
+		tools: decodeDigest(strings.tools)
+	});
+};
+const CHAOS_PRINCIPAL = Schema.decodeSync(Principal)("principal-chaos");
+const decodeConversationId = Schema.decodeSync(ConversationId);
+const decodeIdempotencyKey = Schema.decodeSync(IdempotencyKey);
+const decodeToolCallId = Schema.decodeSync(ToolCallId);
+const decodeRunId = Schema.decodeSync(RunId);
+const decodeTurnId = Schema.decodeSync(TurnId);
+/** Fixture-only identity source consumed by the delegation Layer's ephemeral capture. */
+const chaosIdentifiers = Layer.effect(IdGenerator, Effect.gen(function* () {
+	const counter = yield* Ref.make(0);
+	const next = (decode, prefix) => Ref.getAndUpdate(counter, (value) => value + 1).pipe(Effect.map((value) => decode(`${prefix}-${value}`)));
+	return {
+		nextConversationId: next(decodeConversationId, "chaos-fixture-conversation"),
+		nextRunId: next(decodeRunId, "chaos-fixture-run"),
+		nextTurnId: next(decodeTurnId, "chaos-fixture-turn")
+	};
+}));
+const delegationSupport = Layer.mergeAll(SubagentReservationsMemoryLive, chaosIdentifiers);
+const makeChaosDesk = Effect.gen(function* () {
+	const produced = yield* Ref.make(/* @__PURE__ */ new Set());
+	return {
+		produced: Ref.get(produced),
+		record: (value) => Ref.update(produced, (current) => new Set(current).add(value))
+	};
+});
+const bookConfirmation = (ref) => `confirmed-${ref}`;
+const flightValue = (ref) => `flight-${ref}`;
+const lodgingValue = (ref) => `lodging-${ref}`;
+/** Success → Some; typed failure → None (chaos tolerates it); defect → rethrown loudly. */
+const tolerateTyped = (effect) => effect.pipe(Effect.exit, Effect.flatMap((exit) => {
+	if (Exit.isSuccess(exit)) return Effect.succeed(Option.some(exit.value));
+	if (Option.isSome(Cause.findErrorOption(exit.cause))) return Effect.succeed(Option.none());
+	return Effect.die(/* @__PURE__ */ new Error(`chaos step died: ${Cause.pretty(exit.cause)}`));
+}));
+const scriptFor = (kind, ref) => {
+	switch (kind) {
+		case "plain":
+		case "join": return () => finalParts("{\"answer\":\"chaos\"}");
+		case "uncertain-tool":
+		case "approval": return (prompt) => lastRole(prompt) === "tool" ? finalParts("{\"answer\":\"booked\"}") : toolTurn(toolCallPart(`book-${ref}`, "book", { ref }));
+		case "durable-steps": return (prompt) => lastRole(prompt) === "tool" ? finalParts("{\"answer\":\"reserved\"}") : toolTurn(toolCallPart(`itinerary-${ref}`, "itinerary", { ref }));
+		case "delegation": return (prompt) => lastRole(prompt) === "tool" ? finalParts("{\"report\":\"done\"}") : toolTurn(toolCallPart(DELEGATE_CALL_ID, "delegate_chaos", { topic: ref }));
+	}
+};
+const makeLaneFixture = Effect.fn("Chaos.makeLaneFixture")(function* (plan, laneIndex, kind, submissionIndexes, desk) {
+	const runtime = yield* DurableAgentRuntime;
+	const conversationId = decodeConversationId(`chaos-${plan.seed}-lane-${laneIndex}`);
+	const ref = `ref-l${laneIndex}`;
+	const script = scriptFor(kind, ref);
+	const model = promptScriptedModel(`chaos-${kind}-${laneIndex}`, script);
+	const digests = laneDigests(laneIndex);
+	const submitOptionsFor = (flatIndex) => ({
+		conversationId,
+		principal: CHAOS_PRINCIPAL,
+		idempotencyKey: decodeIdempotencyKey(`chaos-${plan.seed}-s${flatIndex}`),
+		definitions: digests
+	});
+	const bookToolLayerFor = (tools) => tools.toLayer({ book: ({ ref: called }) => desk.record(bookConfirmation(called)).pipe(Effect.as({ confirmation: bookConfirmation(called) })) });
+	const plainLaneFixture = (deskInPlay, drive, submitOne) => ({
+		index: laneIndex,
+		kind,
+		conversationId,
+		ref,
+		deskInPlay,
+		submissionIndexes,
+		submitOne,
+		drives: () => [drive],
+		childConversationOf: () => void 0
+	});
+	switch (kind) {
+		case "plain":
+		case "join": {
+			const agent = Agent.withModel(plainDefinition, model);
+			return plainLaneFixture(false, runtime.processConversation(agent, conversationId), (flatIndex) => runtime.submit(agent, { question: `chaos ${flatIndex}` }, submitOptionsFor(flatIndex)));
+		}
+		case "uncertain-tool": {
+			const agent = Agent.withModel(bookDefinition, model);
+			return plainLaneFixture(true, runtime.processConversation(agent, conversationId).pipe(Effect.provide(bookToolLayerFor(bookTools))), (flatIndex) => runtime.submit(agent, { question: `chaos ${flatIndex}` }, submitOptionsFor(flatIndex)));
+		}
+		case "approval": {
+			const agent = Agent.withModel(approvalDefinition, model);
+			return plainLaneFixture(true, runtime.processConversation(agent, conversationId).pipe(Effect.provide(bookToolLayerFor(approvalTools))), (flatIndex) => runtime.submit(agent, { question: `chaos ${flatIndex}` }, submitOptionsFor(flatIndex)));
+		}
+		case "durable-steps": {
+			const agent = Agent.withModel(itineraryDefinition, model);
+			const toolLayer = itineraryTools.toLayer({ itinerary: ({ ref: called }) => Effect.gen(function* () {
+				const step = yield* DurableStep;
+				return { state: `${yield* step.do("reserve-flight", Schema.String, desk.record(flightValue(called)).pipe(Effect.as(flightValue(called))))}+${yield* step.do("reserve-lodging", Schema.String, desk.record(lodgingValue(called)).pipe(Effect.as(lodgingValue(called))))}` };
+			}) });
+			return plainLaneFixture(true, runtime.processConversation(agent, conversationId).pipe(Effect.provide(toolLayer)), (flatIndex) => runtime.submit(agent, { question: `chaos ${flatIndex}` }, submitOptionsFor(flatIndex)));
+		}
+		case "delegation": {
+			const parentBinding = Agent.withModel(coordinatorDefinition, model);
+			const childModel = promptScriptedModel(`chaos-child-${laneIndex}`, () => finalParts("{\"answer\":\"child\"}"));
+			const childBinding = Agent.withModel(childDefinition, childModel);
+			const delegationLayer = SubagentRuntime.layer(chaosDelegation, childBinding, {
+				mapChildFailure: (failure) => ChaosDelegationFailed.make({ childErrorTag: failure._tag }),
+				durable: { targetDigests: childDigestStrings(laneIndex) }
+			}).pipe(Layer.provide(delegationSupport));
+			const parentResolved = yield* DurableWorkerBinding.make(parentBinding, digests).pipe(Effect.provide(delegationLayer));
+			const childResolved = yield* DurableWorkerBinding.make(childBinding, childLaneDigests(laneIndex));
+			const resolver = AgentBindingResolver.fromBindings([parentResolved, childResolved]);
+			const driveResolved = (conversation) => runtime.processConversationResolved(conversation).pipe(Effect.provideService(AgentBindingResolver, resolver));
+			return {
+				index: laneIndex,
+				kind,
+				conversationId,
+				ref,
+				deskInPlay: false,
+				submissionIndexes,
+				submitOne: (flatIndex) => runtime.submit({ definition: {
+					id: coordinatorDefinition.id,
+					input: coordinatorDefinition.input
+				} }, { mission: `chaos ${flatIndex}` }, submitOptionsFor(flatIndex)),
+				drives: (firstReceipt) => {
+					const drives = [driveResolved(conversationId)];
+					if (firstReceipt !== void 0) drives.push(driveResolved(childConversationIdFor(firstReceipt.submissionId, decodeToolCallId(DELEGATE_CALL_ID))));
+					return drives;
+				},
+				childConversationOf: (firstReceipt) => childConversationIdFor(firstReceipt.submissionId, decodeToolCallId(DELEGATE_CALL_ID))
+			};
+		}
+	}
+});
+/** Stable per-call index into an injection list (identical across resolution passes). */
+const injectionIndex = (submissionFlatIndex, callId, length) => {
+	let hash = submissionFlatIndex + 1;
+	for (const char of callId) hash = Math.imul(hash, 31) + char.charCodeAt(0) | 0;
+	return (hash % length + length) % length;
+};
+const resolutionFor = (kind, toolName, ref, produced) => {
+	switch (kind) {
+		case "abort-submission": return ResolutionAbortSubmission.make();
+		case "completed-from-supplier":
+			if (toolName === "book" && produced.has(bookConfirmation(ref))) return ResolutionCompletedWithResult.make({
+				result: { confirmation: bookConfirmation(ref) },
+				isFailure: false
+			});
+			if (toolName === "itinerary" && produced.has(flightValue(ref)) && produced.has(lodgingValue(ref))) return ResolutionCompletedWithResult.make({
+				result: { state: `${flightValue(ref)}+${lodgingValue(ref)}` },
+				isFailure: false
+			});
+			return ResolutionNeverHappened.make();
+		case "never-happened": return ResolutionNeverHappened.make();
+	}
+};
+/** Drive one DUR-017 pass: resolve Unknown Outcomes and pending approvals from the plan. */
+const resolutionPass = Effect.fn("Chaos.resolutionPass")(function* (plan, states, desk) {
+	const runtime = yield* DurableAgentRuntime;
+	const ledger = yield* SubmissionLedger;
+	const produced = yield* desk.produced;
+	const nonterminal = yield* tolerateTyped(Stream.runCollect(ledger.scanNonterminal));
+	if (Option.isNone(nonterminal)) return;
+	const byId = /* @__PURE__ */ new Map();
+	for (const state of states) if (state.receipt !== void 0) byId.set(state.receipt.submissionId, state);
+	for (const row of nonterminal.value) {
+		if (row.state !== "unknown" && row.state !== "suspended") continue;
+		const state = byId.get(row.submissionId);
+		const explanation = yield* tolerateTyped(runtime.explain(row.submissionId));
+		if (Option.isNone(explanation)) continue;
+		const flatIndex = state?.flatIndex ?? 0;
+		const ref = state?.lane.ref ?? "ref-child";
+		if (row.state === "unknown") for (const call of explanation.value.evidence.unknownCalls) {
+			if (call.resolved) continue;
+			const kind = plan.resolutionInjections.length === 0 ? "never-happened" : plan.resolutionInjections[injectionIndex(flatIndex, call.toolCallId, plan.resolutionInjections.length)];
+			yield* tolerateTyped(runtime.resolveUnknown(UnknownResolutionCommand.make({
+				submissionId: row.submissionId,
+				toolCallId: call.toolCallId,
+				author: "chaos-runner",
+				reason: `chaos plan ${plan.seed} resolution (${kind})`,
+				resolution: resolutionFor(kind, call.toolName, ref, produced)
+			})));
+		}
+		else for (const pending of explanation.value.evidence.approvalsPending) {
+			const decision = plan.approvalDecisions.length === 0 ? "approved" : plan.approvalDecisions[injectionIndex(flatIndex, pending.toolCallId, plan.approvalDecisions.length)];
+			yield* tolerateTyped(runtime.resolveApproval(ApprovalDecisionCommand.make({
+				submissionId: row.submissionId,
+				toolCallId: pending.toolCallId,
+				decision,
+				resolver: "chaos-runner",
+				reason: `chaos plan ${plan.seed} approval (${decision})`
+			})));
+		}
+	}
+});
+const submissionIdsNamedBy = (records) => {
+	const named = /* @__PURE__ */ new Set();
+	for (const envelope of records) {
+		const payload = envelope.record.payload;
+		if (payload._tag === "UserInputRecorded" || payload._tag === "SubmissionSettled" || payload._tag === "AbortRequested") named.add(payload.submissionId);
+	}
+	return named;
+};
+/**
+* The final non-fabrication sweep (durability §10): every canonical Tool success recorded on a
+* desk-backed lane must be a value the desk actually produced.
+*/
+const BookResult = Schema.Struct({ confirmation: Schema.String });
+const ItineraryResult = Schema.Struct({ state: Schema.String });
+const decodeBookResult = Schema.decodeUnknownOption(BookResult);
+const decodeItineraryResult = Schema.decodeUnknownOption(ItineraryResult);
+const decodeStepOutput = Schema.decodeUnknownOption(Schema.String);
+const assertNoFabrication = (plan, records, produced) => {
+	const fabricated = [];
+	const requireProduced = (value, label) => {
+		if (!produced.has(value)) fabricated.push(`${label} "${value}"`);
+	};
+	for (const envelope of records) {
+		const payload = envelope.record.payload;
+		if (payload._tag === "ToolCallSettled" && !payload.isFailure) {
+			if (payload.toolName === "book") {
+				const result = decodeBookResult(payload.result);
+				if (Option.isSome(result)) requireProduced(result.value.confirmation, "book result");
+			}
+			if (payload.toolName === "itinerary") {
+				const result = decodeItineraryResult(payload.result);
+				if (Option.isSome(result)) for (const part of result.value.state.split("+")) requireProduced(part, "itinerary step result");
+			}
+		}
+		if (payload._tag === "ToolStepSettled") {
+			const output = decodeStepOutput(payload.output);
+			if (Option.isSome(output)) requireProduced(output.value, "step output");
+		}
+	}
+	return fabricated.length === 0 ? Effect.void : Effect.fail(ChaosConvergenceFailure.make({
+		seed: plan.seed,
+		message: `fabricated Tool results absent from the desk: ${fabricated.join(", ")}`
+	}));
+};
+/**
+* Execute one chaos plan against whatever adapters the ambient Layer provides and end in the
+* shared invariant claims. Deterministic: same plan + same adapters → same schedule.
+*/
+const runChaosPlan = Effect.fn("Chaos.runChaosPlan")(function* (plan, options) {
+	const runtime = yield* DurableAgentRuntime;
+	const ledger = yield* SubmissionLedger;
+	const store = yield* ConversationStore;
+	const config = yield* DurableRuntimeConfig;
+	const failpoints = yield* DurableRuntimeFailpointTestControl;
+	const random = mulberry32(plan.seed);
+	const desk = yield* makeChaosDesk;
+	const laneKinds = /* @__PURE__ */ new Map();
+	const laneSubmissions = /* @__PURE__ */ new Map();
+	plan.submissions.forEach((spec, flatIndex) => {
+		const lane = spec.lane % plan.lanes;
+		if (!laneKinds.has(lane)) laneKinds.set(lane, spec.kind);
+		const list = laneSubmissions.get(lane) ?? [];
+		list.push(flatIndex);
+		laneSubmissions.set(lane, list);
+	});
+	const lanes = [];
+	for (const [lane, kind] of laneKinds) lanes.push(yield* makeLaneFixture(plan, lane, kind, laneSubmissions.get(lane) ?? [], desk));
+	const states = plan.submissions.map((spec, flatIndex) => ({
+		flatIndex,
+		lane: lanes.find((fixture) => fixture.index === spec.lane % plan.lanes),
+		receipt: void 0
+	}));
+	const appliedAborts = /* @__PURE__ */ new Set();
+	const armQueue = [...plan.failpointArms.map((location) => ({
+		family: "coordinator",
+		location
+	})), ...plan.adapterArms.map((location) => ({
+		family: "adapter",
+		location
+	}))];
+	const allSettled = Effect.gen(function* () {
+		if (states.some((state) => state.receipt === void 0)) return false;
+		const nonterminal = yield* tolerateTyped(Stream.runCollect(ledger.scanNonterminal));
+		return Option.isSome(nonterminal) && Array.from(nonterminal.value).length === 0;
+	});
+	const maxRounds = armQueue.length + states.length * 2 + 12;
+	let rounds = 0;
+	let converged = false;
+	for (let round = 0; round < maxRounds; round++) {
+		rounds = round + 1;
+		const arm = armQueue[round];
+		if (arm?.family === "coordinator") {
+			const location = arm.location;
+			yield* failpoints.setHandler((hit) => hit === location ? Effect.fail(DurableRuntimeFailpointError.make({ location: hit })) : Effect.void);
+		} else if (arm?.family === "adapter" && options?.adapterFailpoints !== void 0) yield* options.adapterFailpoints.arm(arm.location);
+		for (const state of states) {
+			if (state.receipt !== void 0) continue;
+			const receipt = yield* tolerateTyped(state.lane.submitOne(state.flatIndex));
+			if (Option.isSome(receipt)) state.receipt = receipt.value;
+		}
+		const order = [...lanes].sort(() => random() - .5);
+		for (const lane of order) {
+			const firstFlat = lane.submissionIndexes[0];
+			const firstReceipt = firstFlat === void 0 ? void 0 : states[firstFlat]?.receipt;
+			for (const drive of lane.drives(firstReceipt)) yield* tolerateTyped(drive);
+		}
+		if (round >= 1) for (const rawIndex of plan.abortInjections) {
+			const index = rawIndex % states.length;
+			if (appliedAborts.has(index)) continue;
+			const receipt = states[index]?.receipt;
+			if (receipt === void 0) continue;
+			appliedAborts.add(index);
+			yield* tolerateTyped(runtime.abort(AbortCommand.make({
+				submissionId: receipt.submissionId,
+				author: "chaos-runner",
+				reason: `chaos plan ${plan.seed} abort injection`
+			})));
+		}
+		yield* resolutionPass(plan, states, desk);
+		yield* failpoints.clear;
+		if (options?.adapterFailpoints !== void 0) yield* options.adapterFailpoints.clear;
+		yield* tolerateTyped(runtime.runRecovery);
+		yield* resolutionPass(plan, states, desk);
+		if (yield* allSettled) {
+			converged = true;
+			break;
+		}
+		if (options?.betweenRounds !== void 0) yield* options.betweenRounds;
+	}
+	if (!converged) {
+		const nonterminal = yield* tolerateTyped(Stream.runCollect(ledger.scanNonterminal));
+		const detail = Option.isSome(nonterminal) ? Array.from(nonterminal.value).map((row) => `${row.submissionId}(${row.state})`).join(", ") : "ledger scan failed";
+		return yield* ChaosConvergenceFailure.make({
+			seed: plan.seed,
+			message: `plan did not converge within ${maxRounds} rounds; nonterminal: [${detail}]; pending receipts: ${states.filter((state) => state.receipt === void 0).length}`
+		});
+	}
+	const produced = yield* desk.produced;
+	const laneReports = [];
+	const verifyConversation = Effect.fn("Chaos.verifyConversation")(function* (conversationId, kind, deskInPlay) {
+		const exported = yield* store.export(ConversationExportRequest.make({ conversationId })).pipe(Effect.mapError((error) => ChaosConvergenceFailure.make({
+			seed: plan.seed,
+			message: `export of ${conversationId} failed: ${String(error)}`
+		})));
+		const rows = [];
+		for (const submissionId of submissionIdsNamedBy(exported.records)) {
+			const found = yield* ledger.lookup(SubmissionLookupById.make({ submissionId })).pipe(Effect.mapError((error) => ChaosConvergenceFailure.make({
+				seed: plan.seed,
+				message: `lookup of ${submissionId} failed: ${String(error)}`
+			})));
+			if (Option.isSome(found)) rows.push(found.value);
+		}
+		const report = yield* verifyConversationInvariants({
+			export: exported,
+			submissions: rows,
+			batchProducers: new Map(exported.records.map((envelope) => [envelope.batchId, config.producerId])),
+			requireAllSettled: true
+		});
+		if (!report.ok) {
+			const failed = report.checks.filter((check) => check.status === "failed").map((check) => `${check.name}: ${check.detail ?? "failed"}`).join("; ");
+			return yield* ChaosConvergenceFailure.make({
+				seed: plan.seed,
+				message: `invariants failed for ${conversationId} (${kind}): ${failed}`
+			});
+		}
+		if (deskInPlay) yield* assertNoFabrication(plan, exported.records, produced);
+		laneReports.push(ChaosLaneReport.make({
+			conversationId,
+			kind,
+			submissionCount: rows.length,
+			verified: report.ok
+		}));
+	});
+	for (const lane of lanes) {
+		yield* verifyConversation(lane.conversationId, lane.kind, lane.deskInPlay);
+		for (const flatIndex of lane.submissionIndexes) {
+			const receipt = states[flatIndex]?.receipt;
+			if (receipt === void 0) continue;
+			const child = lane.childConversationOf(receipt);
+			if (child === void 0) continue;
+			const childExport = yield* Effect.exit(store.export(ConversationExportRequest.make({ conversationId: child })));
+			if (Exit.isSuccess(childExport) && childExport.value.records.length > 0) yield* verifyConversation(child, "plain", false);
+		}
+	}
+	const obligations = yield* runtime.scanObligations(ObligationThresholds.make({
+		agingSeconds: 0,
+		overdueSeconds: 0
+	})).pipe(Effect.mapError((error) => ChaosConvergenceFailure.make({
+		seed: plan.seed,
+		message: `scanObligations failed: ${String(error)}`
+	})));
+	if (obligations.entries.length > 0) return yield* ChaosConvergenceFailure.make({
+		seed: plan.seed,
+		message: `open obligations after convergence: ${obligations.entries.map((entry) => `${entry.submissionId}(${entry.blockedOn})`).join(", ")}`
+	});
+	return ChaosPlanReport.make({
+		seed: plan.seed,
+		rounds,
+		lanes: laneReports,
+		openObligations: obligations.entries.length
+	});
+});
+//#endregion
+//#region src/fixtures/docs-researcher/definition.ts
+const ResearchDocumentId = Schema.NonEmptyString.check(Schema.isMaxLength(64)).pipe(Schema.brand("@effect-agent/testing/docs-researcher/ResearchDocumentId"));
+const BoundedTitle = Schema.NonEmptyString.check(Schema.isMaxLength(120));
+const BoundedBody = Schema.NonEmptyString.check(Schema.isMaxLength(16 * 1024));
+/** Bounded summary text: the ONLY child-derived text that may cross to the parent. */
+const BoundedSummary = Schema.NonEmptyString.check(Schema.isMaxLength(240));
+var DocumentQuery = class extends Schema.Class("DocumentQuery")({ documentId: ResearchDocumentId }) {};
+/** One bounded research document as the MCP content server exposes it. */
+var ResearchDocument = class extends Schema.Class("ResearchDocument")({
+	documentId: ResearchDocumentId,
+	title: BoundedTitle,
+	body: BoundedBody
+}) {};
+var DocumentUnavailable = class extends Schema.TaggedErrorClass()("DocumentUnavailable", {
+	documentId: ResearchDocumentId,
+	message: Schema.String
+}) {};
+/** The content store behind the scripted MCP server. */
+var DocumentLibrary = class extends Context.Service()("@effect-agent/testing/docs-researcher/DocumentLibrary") {};
+/**
+* The one content tool the doc-summarizer child uses. Its authored JSON
+* schema is what MCP discovery must serve byte-for-byte: the scripted MCP
+* fixture derives its discovery entry from `Tool.getJsonSchema(FetchDocument)`
+* and `validateMcpDiscovery` re-derives and digests both sides (CAP-009).
+*/
+const FetchDocument = Tool.make("fetch_document", {
+	description: "Fetch one bounded research document by its identifier.",
+	parameters: DocumentQuery,
+	success: ResearchDocument,
+	failure: DocumentUnavailable,
+	failureMode: "error",
+	dependencies: [DocumentLibrary]
+});
+const DocContentToolkit = Toolkit.make(FetchDocument);
+const docContentToolkitLayer = DocContentToolkit.toLayer({ fetch_document: (query) => Effect.flatMap(DocumentLibrary, (library) => library.fetch(query)) });
+/** Never allowed outside a child Conversation or an unredacted fixture value. */
+const docsDocumentBodySecret = "docs-vault-secret-771";
+const decodeDocumentId = Schema.decodeSync(ResearchDocumentId);
+const corpusEntries = new Map([{
+	documentId: "durability-notes",
+	title: "Durability protocol notes",
+	bodyPhrase: "amber-ledger-passage",
+	summary: "Settlement results are recorded exactly once while external side effects stay at-least-once."
+}, {
+	documentId: "subagent-notes",
+	title: "Subagent join notes",
+	bodyPhrase: "cobalt-join-corridor",
+	summary: "A parent joins only the verified settlement of its own established child."
+}].map((entry) => [entry.documentId, {
+	document: ResearchDocument.make({
+		documentId: decodeDocumentId(entry.documentId),
+		title: entry.title,
+		body: `${entry.bodyPhrase}: internal working notes. ${docsDocumentBodySecret}. ${entry.summary} Raw notes stay inside the child Conversation.`
+	}),
+	bodyPhrase: entry.bodyPhrase,
+	summary: entry.summary
+}]));
+/** The corpus document ids in canonical fixture order. */
+const researchCorpusDocumentIds = [decodeDocumentId("durability-notes"), decodeDocumentId("subagent-notes")];
+const requireCorpusEntry = (documentId) => {
+	const entry = corpusEntries.get(documentId);
+	if (entry === void 0) throw new Error(`No deterministic corpus entry exists for document ${documentId}`);
+	return entry;
+};
+/** Deterministic library lookup shared by the scripted MCP content handlers. */
+const researchDocumentLookup = (query) => {
+	const entry = corpusEntries.get(query.documentId);
+	return entry === void 0 ? Effect.fail(DocumentUnavailable.make({
+		documentId: query.documentId,
+		message: "No deterministic corpus entry exists for this document."
+	})) : Effect.succeed(entry.document);
+};
+/** The full fixture document (body includes the secret marker — child-side only). */
+const researchDocumentFor = (documentId) => requireCorpusEntry(documentId).document;
+/** The distinctive body phrase used by context-isolation assertions. */
+const documentBodyPhrase = (documentId) => requireCorpusEntry(documentId).bodyPhrase;
+var SummaryBrief = class extends Schema.Class("SummaryBrief")({
+	documentId: ResearchDocumentId,
+	focus: Schema.NonEmptyString
+}) {};
+var DocumentSummary = class extends Schema.Class("DocumentSummary")({
+	documentId: ResearchDocumentId,
+	summary: BoundedSummary
+}) {};
+/** The summary the scripted child writes after fetching the document. */
+const documentSummaryFor = (documentId) => DocumentSummary.make({
+	documentId: requireCorpusEntry(documentId).document.documentId,
+	summary: requireCorpusEntry(documentId).summary
+});
+const encodedDocumentSummary = (documentId) => JSON.stringify(Schema.encodeSync(DocumentSummary)(documentSummaryFor(documentId)));
+const DocSummarizer = Agent.define("doc-summarizer", {
+	input: SummaryBrief,
+	output: DocumentSummary,
+	instructions: "Fetch the briefed document with fetch_document exactly once, then return only a JSON document summary. Never copy raw notes or secrets into the summary.",
+	toolkit: DocContentToolkit,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 1,
+		maxDuration: "30 seconds",
+		toolConcurrency: 1
+	}),
+	description: "Summarize one bounded research document fetched through MCP content tools.",
+	metadata: {
+		deploymentClass: "DN",
+		phase: "P7"
+	}
+});
+var SummaryRequest = class extends Schema.Class("SummaryRequest")({ documentId: ResearchDocumentId }) {};
+var SummaryFinding = class extends Schema.Class("SummaryFinding")({
+	documentId: ResearchDocumentId,
+	summary: BoundedSummary
+}) {};
+var DocumentSummaryFailed = class extends Schema.TaggedErrorClass()("DocumentSummaryFailed", { childErrorTag: Schema.NonEmptyString }) {};
+/** Finite per-invocation bounds (SUB-009): one fetch per child, two children per Run. */
+const documentSummaryPolicy = SubagentPolicy.make({
+	maxChildren: 2,
+	maxConcurrency: 2,
+	maxTurns: 2,
+	maxToolCalls: 1,
+	maxDuration: "10 seconds"
+});
+const delegateDocumentSummary = Subagent.define("delegate_document_summary", {
+	description: "Summarize one research document through the doc-summarizer child and return a bounded finding.",
+	target: DocSummarizer,
+	parameters: SummaryRequest,
+	success: SummaryFinding,
+	failure: DocumentSummaryFailed,
+	prepareInput: (request) => Effect.succeed(SummaryBrief.make({
+		documentId: request.documentId,
+		focus: "summarize:durability-claims"
+	})),
+	projectResult: (summary) => Effect.succeed(SummaryFinding.make({
+		documentId: summary.documentId,
+		summary: summary.summary
+	})),
+	policy: documentSummaryPolicy
+});
+/** Total mapping from every expected child Run failure to the declared Tool failure (SUB-028). */
+const mapSummaryChildFailure = (failure) => DocumentSummaryFailed.make({ childErrorTag: failure._tag });
+/** The exact digest strings the durable declaration AND host registration must share (SUB-023). */
+const docsSummarizerDigestStrings = {
+	agent: "50".repeat(32),
+	model: "51".repeat(32),
+	tools: "52".repeat(32)
+};
+/** Runtime wiring: the immutable delegation plus one explicit child Binding (S2 declaration). */
+const docsSummaryHandlersLayer = (childBinding) => SubagentRuntime.layer(delegateDocumentSummary, childBinding, {
+	mapChildFailure: mapSummaryChildFailure,
+	durable: { targetDigests: docsSummarizerDigestStrings }
+});
+var ResearchRequest = class extends Schema.Class("ResearchRequest")({
+	question: Schema.NonEmptyString,
+	documentIds: Schema.Array(ResearchDocumentId).check(Schema.isMinLength(1))
+}) {};
+var ResearchDigest = class extends Schema.Class("ResearchDigest")({
+	findings: Schema.Array(SummaryFinding),
+	nextAction: Schema.Literal("review")
+}) {};
+/** Parent-only transcript markers proving child context isolation (SUB-006/SUB-015). */
+const docsCoordinatorConfidentialMarker = "docs-coordinator-vault-19x";
+const docsMissionConfidentialMarker = "docs-mission-dossier-42f";
+const DocsResearcherToolkit = Toolkit.make(delegateDocumentSummary.tool);
+const DocsResearcher = Agent.define("docs-researcher", {
+	input: ResearchRequest,
+	output: ResearchDigest,
+	instructions: [
+		"You are the Effect Agent P7 docs-researcher coordinator.",
+		`Coordinator-only context: ${docsCoordinatorConfidentialMarker}.`,
+		"Call delegate_document_summary once per requested document in one Tool batch.",
+		"Return only a JSON digest built from the delegated findings. This is read-only research."
+	].join("\n"),
+	toolkit: DocsResearcherToolkit,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 2,
+		maxDuration: "30 seconds",
+		toolConcurrency: 2
+	}),
+	description: "Coordinate per-document summarization through one declared delegation Tool.",
+	metadata: {
+		deploymentClass: "DN",
+		phase: "P7"
+	}
+});
+/** The default two-document research mission. */
+const researchMissionRequest = ResearchRequest.make({
+	question: `Summarize the durability and subagent notes; keep ${docsMissionConfidentialMarker} inside the coordinator conversation.`,
+	documentIds: researchCorpusDocumentIds
+});
+/** The coordinator's expected final digest for the given documents. */
+const expectedResearchDigest = (documentIds = researchCorpusDocumentIds) => ResearchDigest.make({
+	findings: documentIds.map((documentId) => {
+		const summary = documentSummaryFor(documentId);
+		return SummaryFinding.make({
+			documentId: summary.documentId,
+			summary: summary.summary
+		});
+	}),
+	nextAction: "review"
+});
+//#endregion
+//#region src/fixtures/travel-planner/definition.ts
+const AirportCode = Schema.NonEmptyString.pipe(Schema.brand("@effect-agent/testing/travel-planner/AirportCode"));
+const QuoteId = Schema.NonEmptyString.pipe(Schema.brand("@effect-agent/testing/travel-planner/QuoteId"));
+var TripRequest = class extends Schema.Class("TripRequest")({
+	request: Schema.NonEmptyString,
+	origin: AirportCode,
+	destination: AirportCode,
+	departOn: Schema.String,
+	nights: Schema.Int.check(Schema.isGreaterThan(0)),
+	travelers: Schema.Int.check(Schema.isGreaterThan(0)),
+	budgetCents: Schema.Int.check(Schema.isGreaterThan(0)),
+	currency: Schema.Literal("USD")
+}) {};
+var FlightQuery = class extends Schema.Class("FlightQuery")({
+	origin: AirportCode,
+	destination: AirportCode,
+	departOn: Schema.String,
+	travelers: Schema.Int.check(Schema.isGreaterThan(0))
+}) {};
+var LodgingQuery = class extends Schema.Class("LodgingQuery")({
+	destination: AirportCode,
+	departOn: Schema.String,
+	nights: Schema.Int.check(Schema.isGreaterThan(0)),
+	travelers: Schema.Int.check(Schema.isGreaterThan(0))
+}) {};
+var ActivityQuery = class extends Schema.Class("ActivityQuery")({
+	destination: AirportCode,
+	departOn: Schema.String,
+	nights: Schema.Int.check(Schema.isGreaterThan(0)),
+	travelers: Schema.Int.check(Schema.isGreaterThan(0))
+}) {};
+var FlightOption = class extends Schema.Class("FlightOption")({
+	quoteId: QuoteId,
+	flight: Schema.String,
+	estimatedCents: Schema.Int.check(Schema.isGreaterThan(0)),
+	currency: Schema.Literal("USD")
+}) {};
+var LodgingOption = class extends Schema.Class("LodgingOption")({
+	lodging: Schema.String,
+	estimatedCents: Schema.Int.check(Schema.isGreaterThan(0)),
+	currency: Schema.Literal("USD")
+}) {};
+/** A successful empty activity search is distinct from supplier unavailability. */
+var ActivitySearchResult = class extends Schema.Class("ActivitySearchResult")({ activities: Schema.Array(Schema.String) }) {};
+var Itinerary = class extends Schema.Class("Itinerary")({
+	title: Schema.String,
+	route: Schema.String,
+	dates: Schema.String,
+	flight: Schema.String,
+	lodging: Schema.String,
+	activities: Schema.Array(Schema.String),
+	estimatedTotalCents: Schema.Int.check(Schema.isGreaterThan(0)),
+	currency: Schema.Literal("USD"),
+	quoteId: QuoteId,
+	assumptions: Schema.Array(Schema.String),
+	unresolvedConstraints: Schema.Array(Schema.String),
+	nextAction: Schema.Literal("review")
+}) {};
+var TravelPlan = class extends Schema.Class("TravelPlan")({ itineraries: Schema.Array(Itinerary) }) {};
+const unavailableFields = {
+	query: Schema.String,
+	message: Schema.String
+};
+var FlightUnavailable = class extends Schema.TaggedErrorClass()("FlightUnavailable", unavailableFields) {};
+var LodgingUnavailable = class extends Schema.TaggedErrorClass()("LodgingUnavailable", unavailableFields) {};
+var ActivityUnavailable = class extends Schema.TaggedErrorClass()("ActivityUnavailable", unavailableFields) {};
+var GuidanceFailure = class extends Schema.TaggedErrorClass()("GuidanceFailure", { message: Schema.String }) {};
+var FlightCatalog = class extends Context.Service()("@effect-agent/testing/travel-planner/FlightCatalog") {};
+var LodgingCatalog = class extends Context.Service()("@effect-agent/testing/travel-planner/LodgingCatalog") {};
+var ActivityCatalog = class extends Context.Service()("@effect-agent/testing/travel-planner/ActivityCatalog") {};
+var TravelGuidance = class extends Context.Service()("@effect-agent/testing/travel-planner/TravelGuidance") {};
+const SearchFlights = Tool.make("search_flights", {
+	parameters: FlightQuery,
+	success: FlightOption,
+	failure: FlightUnavailable,
+	failureMode: "error",
+	dependencies: [FlightCatalog]
+});
+const SearchLodging = Tool.make("search_lodging", {
+	parameters: LodgingQuery,
+	success: LodgingOption,
+	failure: LodgingUnavailable,
+	failureMode: "error",
+	dependencies: [LodgingCatalog]
+});
+const SearchActivities = Tool.make("search_activities", {
+	parameters: ActivityQuery,
+	success: ActivitySearchResult,
+	failure: ActivityUnavailable,
+	failureMode: "error",
+	dependencies: [ActivityCatalog]
+});
+const TravelPlannerToolkit = Toolkit.make(SearchFlights, SearchLodging, SearchActivities);
+const TravelPlannerToolkitLayer = TravelPlannerToolkit.toLayer({
+	search_flights: (query) => Effect.flatMap(FlightCatalog, (catalog) => catalog.search(query)),
+	search_lodging: (query) => Effect.flatMap(LodgingCatalog, (catalog) => catalog.search(query)),
+	search_activities: (query) => Effect.flatMap(ActivityCatalog, (catalog) => catalog.search(query))
+});
+const TravelPlanner = Agent.define("travel-planner", {
+	input: TripRequest,
+	output: TravelPlan,
+	instructions: (input) => Effect.flatMap(TravelGuidance, (guidance) => guidance.instructions(input)),
+	toolkit: TravelPlannerToolkit,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 3,
+		maxDuration: "30 seconds",
+		toolConcurrency: 3
+	}),
+	description: "Build one review-only itinerary from bounded parallel deterministic searches.",
+	metadata: {
+		deploymentClass: "E",
+		phase: "P1"
+	}
+});
+//#endregion
+//#region src/fixtures/travel-planner/deterministic-layers.ts
+var CatalogLifecycleCounts = class extends Schema.Class("CatalogLifecycleCounts")({
+	acquired: Schema.Natural,
+	finalized: Schema.Natural
+}) {};
+var CatalogLifecycle = class CatalogLifecycle extends Context.Service()("@effect-agent/testing/travel-planner/CatalogLifecycle") {
+	static layerNoDeps = Layer.effect(this, Effect.gen(function* () {
+		const acquired = yield* Ref.make(0);
+		const finalized = yield* Ref.make(0);
+		return CatalogLifecycle.of({
+			markAcquired: Ref.update(acquired, (n) => n + 1),
+			markFinalized: Ref.update(finalized, (n) => n + 1),
+			counts: Effect.all({
+				acquired: Ref.get(acquired),
+				finalized: Ref.get(finalized)
+			}).pipe(Effect.map((counts) => CatalogLifecycleCounts.make(counts)))
+		});
+	}));
+};
+const flight = FlightOption.make({
+	quoteId: Schema.decodeSync(QuoteId)("quote-sfo-lhr-001"),
+	flight: "EA 218 · nonstop · SFO 18:40 → LHR 13:05+1",
+	estimatedCents: 18e4,
+	currency: "USD"
+});
+const lodging = LodgingOption.make({
+	lodging: "Bloomsbury House · refundable studio · 4 nights",
+	estimatedCents: 104e3,
+	currency: "USD"
+});
+const activities = ActivitySearchResult.make({ activities: ["British Museum timed entry", "Thames evening walk"] });
+const ReverseCompletionToolkitLayer = Effect.gen(function* () {
+	const flightStarted = yield* Deferred.make();
+	const lodgingStarted = yield* Deferred.make();
+	const activityStarted = yield* Deferred.make();
+	const releaseFlight = yield* Deferred.make();
+	const releaseLodging = yield* Deferred.make();
+	const releaseActivity = yield* Deferred.make();
+	const awaitRelease = (started, release, value) => Deferred.succeed(started, void 0).pipe(Effect.andThen(Deferred.await(release)), Effect.as(value));
+	return {
+		controls: {
+			flightStarted: Deferred.await(flightStarted),
+			lodgingStarted: Deferred.await(lodgingStarted),
+			activityStarted: Deferred.await(activityStarted),
+			releaseFlight: Deferred.succeed(releaseFlight, void 0).pipe(Effect.asVoid),
+			releaseLodging: Deferred.succeed(releaseLodging, void 0).pipe(Effect.asVoid),
+			releaseActivity: Deferred.succeed(releaseActivity, void 0).pipe(Effect.asVoid)
+		},
+		layer: TravelPlannerToolkit.toLayer({
+			search_flights: () => awaitRelease(flightStarted, releaseFlight, flight),
+			search_lodging: () => awaitRelease(lodgingStarted, releaseLodging, lodging),
+			search_activities: () => awaitRelease(activityStarted, releaseActivity, activities)
+		})
+	};
+});
+const FlightCatalogLayer = Layer.effect(FlightCatalog, Effect.gen(function* () {
+	const lifecycle = yield* CatalogLifecycle;
+	yield* Effect.acquireRelease(lifecycle.markAcquired, () => lifecycle.markFinalized);
+	return FlightCatalog.of({ search: (query) => query.origin === query.destination ? Effect.fail(FlightUnavailable.make({
+		query: `${query.origin}-${query.destination}`,
+		message: "Origin and destination must differ."
+	})) : Effect.succeed(flight) });
+}));
+const LodgingCatalogLayer = Layer.effect(LodgingCatalog, Effect.gen(function* () {
+	const lifecycle = yield* CatalogLifecycle;
+	yield* Effect.acquireRelease(lifecycle.markAcquired, () => lifecycle.markFinalized);
+	return LodgingCatalog.of({ search: (query) => query.nights < 1 ? Effect.fail(LodgingUnavailable.make({
+		query: query.destination,
+		message: "At least one night is required."
+	})) : Effect.succeed(lodging) });
+}));
+const ActivityCatalogLayer = Layer.effect(ActivityCatalog, Effect.gen(function* () {
+	const lifecycle = yield* CatalogLifecycle;
+	yield* Effect.acquireRelease(lifecycle.markAcquired, () => lifecycle.markFinalized);
+	return ActivityCatalog.of({ search: (query) => query.destination === "" ? Effect.fail(ActivityUnavailable.make({
+		query: query.destination,
+		message: "Destination is required."
+	})) : Effect.succeed(activities) });
+}));
+/** Stable supplier-side booking identity, minted deterministically from the idempotency key. */
+const BookingRef = Schema.NonEmptyString.pipe(Schema.brand("@effect-agent/testing/travel-planner/BookingRef"));
+/** The supplier desk operations the P5 booking Tools and Steps invoke. */
+const SupplierOperation = Schema.Literals([
+	"book-flight",
+	"cancel-booking",
+	"reserve-flight",
+	"reserve-lodging",
+	"issue-confirmation"
+]);
+/**
+* One row of external supplier truth. The desk deduplicates by `idempotencyKey` — replaying a
+* call with the same key returns this exact record without creating a second booking — which is
+* precisely the honesty model of DUR-010: the framework never makes an external call
+* exactly-once; the supplier's idempotency key does.
+*/
+var SupplierBookingRecord = class extends Schema.Class("@effect-agent/testing/travel-planner/SupplierBookingRecord")({
+	bookingRef: BookingRef,
+	idempotencyKey: Schema.NonEmptyString,
+	operation: SupplierOperation,
+	detail: Schema.NonEmptyString,
+	status: Schema.Literals(["confirmed", "cancelled"])
+}) {};
+var SupplierUnavailable = class extends Schema.TaggedErrorClass()("SupplierUnavailable", { message: Schema.String }) {};
+/** The desk-internal idempotency key of one cancellation: cancel is idempotent by bookingRef. */
+const cancelBookingIdempotencyKey = (bookingRef) => `cancel-booking:${bookingRef}`;
+/** The deterministic bookingRef the desk mints for one idempotency key. */
+const supplierBookingRefFor = (idempotencyKey) => Schema.decodeSync(BookingRef)(`ref:${idempotencyKey}`);
+/**
+* The deterministic in-memory supplier: an idempotency-keyed booking store with per-key call
+* counters and injectable crash windows.
+*
+* - `book`/`cancel` always count the call (at-least-once execution stays observable), then
+*   dedupe the external effect by idempotency key — the supplier-side contract the P5 Tools and
+*   Steps rely on.
+* - `holdAfterWrite` arms a one-shot crash window: the next call with that key performs its
+*   supplier write, signals `held`, and never returns. Interrupting the Attempt at that point
+*   models "the external effect happened but no outcome was recorded" without any wall clock.
+* - `bookings`/`lookup` expose external truth for the reconciler and for never-fabricate
+*   assertions.
+*/
+var SupplierBookingDesk = class SupplierBookingDesk extends Context.Service()("@effect-agent/testing/travel-planner/SupplierBookingDesk") {
+	static layer = Layer.effect(this, Effect.gen(function* () {
+		const state = yield* Ref.make({
+			bookings: /* @__PURE__ */ new Map(),
+			counts: /* @__PURE__ */ new Map(),
+			holds: /* @__PURE__ */ new Map()
+		});
+		const enterHold = (hold) => Option.isSome(hold) ? Deferred.succeed(hold.value.held, void 0).pipe(Effect.andThen(Deferred.await(hold.value.release))) : Effect.void;
+		const book = (request) => Ref.modify(state, (current) => {
+			const counts = new Map(current.counts).set(request.idempotencyKey, (current.counts.get(request.idempotencyKey) ?? 0) + 1);
+			const existing = current.bookings.get(request.idempotencyKey);
+			const record = existing ?? SupplierBookingRecord.make({
+				bookingRef: supplierBookingRefFor(request.idempotencyKey),
+				idempotencyKey: request.idempotencyKey,
+				operation: request.operation,
+				detail: request.detail,
+				status: "confirmed"
+			});
+			const bookings = existing === void 0 ? new Map(current.bookings).set(request.idempotencyKey, record) : current.bookings;
+			const hold = Option.fromNullishOr(current.holds.get(request.idempotencyKey));
+			const holds = Option.isSome(hold) ? (() => {
+				const next = new Map(current.holds);
+				next.delete(request.idempotencyKey);
+				return next;
+			})() : current.holds;
+			return [{
+				record,
+				hold
+			}, {
+				bookings,
+				counts,
+				holds
+			}];
+		}).pipe(Effect.flatMap(({ hold, record }) => enterHold(hold).pipe(Effect.as(record))));
+		const cancel = (bookingRef) => Ref.modify(state, (current) => {
+			const key = cancelBookingIdempotencyKey(bookingRef);
+			const counts = new Map(current.counts).set(key, (current.counts.get(key) ?? 0) + 1);
+			const existingEntry = [...current.bookings.entries()].find(([, record]) => record.bookingRef === bookingRef);
+			if (existingEntry === void 0) return [{
+				record: Option.none(),
+				hold: Option.none()
+			}, {
+				...current,
+				counts
+			}];
+			const [storeKey, existing] = existingEntry;
+			const cancelled = existing.status === "cancelled" ? existing : SupplierBookingRecord.make({
+				...existing,
+				status: "cancelled"
+			});
+			const bookings = new Map(current.bookings).set(storeKey, cancelled);
+			const hold = Option.fromNullishOr(current.holds.get(key));
+			const holds = Option.isSome(hold) ? (() => {
+				const next = new Map(current.holds);
+				next.delete(key);
+				return next;
+			})() : current.holds;
+			return [{
+				record: Option.some(cancelled),
+				hold
+			}, {
+				bookings,
+				counts,
+				holds
+			}];
+		}).pipe(Effect.flatMap(({ hold, record }) => Option.isNone(record) ? Effect.fail(SupplierUnavailable.make({ message: `The supplier desk has no booking under ${bookingRef}.` })) : enterHold(hold).pipe(Effect.as(record.value))));
+		return SupplierBookingDesk.of({
+			book,
+			cancel,
+			lookup: (idempotencyKey) => Ref.get(state).pipe(Effect.map((current) => Option.fromNullishOr(current.bookings.get(idempotencyKey)))),
+			bookings: Ref.get(state).pipe(Effect.map((current) => [...current.bookings.values()])),
+			callCount: (idempotencyKey) => Ref.get(state).pipe(Effect.map((current) => current.counts.get(idempotencyKey) ?? 0)),
+			holdAfterWrite: (idempotencyKey) => Effect.gen(function* () {
+				const held = yield* Deferred.make();
+				const release = yield* Deferred.make();
+				yield* Ref.update(state, (current) => ({
+					...current,
+					holds: new Map(current.holds).set(idempotencyKey, {
+						held,
+						release
+					})
+				}));
+				return {
+					held: Deferred.await(held),
+					release: Deferred.succeed(release, void 0).pipe(Effect.asVoid)
+				};
+			})
+		});
+	}));
+};
+const TravelGuidanceLayer = Layer.succeed(TravelGuidance, TravelGuidance.of({ instructions: (input) => Effect.succeed([
+	"You are the Effect Agent Travel Planner P1 interpreter fixture.",
+	`The user asked: ${input.request}`,
+	"Call search_flights, search_lodging, and search_activities exactly once in one Tool batch.",
+	"Then return only a JSON object of exactly this shape, no prose:",
+	"{\"itineraries\": [{\"title\": \"<short itinerary name>\", \"route\": \"<origin-destination>\", \"dates\": \"<date range>\", \"flight\": \"<flight description from the Tool result>\", \"lodging\": \"<lodging description from the Tool result>\", \"activities\": [\"<activity>\", \"...\"], \"estimatedTotalCents\": <positive integer total in cents>, \"currency\": \"USD\", \"quoteId\": \"<quoteId from the flight Tool result>\", \"assumptions\": [\"<assumption>\", \"...\"], \"unresolvedConstraints\": [], \"nextAction\": \"review\"}]}",
+	"Use the Tool results verbatim; activity results may legitimately be an empty array.",
+	"This is read-only planning. Require review before any mutation."
+].join("\n")) }));
+const DeterministicIdGeneratorLayer = Layer.effect(IdGenerator, Effect.gen(function* () {
+	const conversation = yield* Ref.make(0);
+	const run = yield* Ref.make(0);
+	const turn = yield* Ref.make(0);
+	return IdGenerator.of({
+		nextConversationId: Ref.updateAndGet(conversation, (n) => n + 1).pipe(Effect.map((n) => Schema.decodeSync(ConversationId)(`conversation-${n}`))),
+		nextRunId: Ref.updateAndGet(run, (n) => n + 1).pipe(Effect.map((n) => Schema.decodeSync(RunId)(`run-${n}`))),
+		nextTurnId: Ref.updateAndGet(turn, (n) => n + 1).pipe(Effect.map((n) => Schema.decodeSync(TurnId)(`turn-${n}`)))
+	});
+}));
+const TravelPlannerRuntimeLayer = Layer.mergeAll(TravelPlannerToolkitLayer, FlightCatalogLayer, LodgingCatalogLayer, ActivityCatalogLayer, TravelGuidanceLayer, DeterministicIdGeneratorLayer).pipe(Layer.provide(CatalogLifecycle.layerNoDeps));
+//#endregion
+//#region src/fixtures/docs-researcher/mcp.ts
+/** Framework-side hard bounds one docs-researcher assembly requests. */
+const docsMcpRequest = McpConnectionRequest.make({
+	serverId: "docs-content-mcp",
+	maxToolCount: 4,
+	maxToolDescriptionBytes: 256,
+	maxDiscoveryBytes: 16384,
+	connectTimeoutMillis: 1e3
+});
+const docsMcpIdentity = McpServerIdentity.make({
+	serverId: docsMcpRequest.serverId,
+	implementation: McpSchema.Implementation.make({
+		name: "docs-researcher-content-fixture",
+		version: "1.0.0"
+	})
+});
+const discoveredFetchDocument = McpSchema.Tool.make({
+	name: FetchDocument.name,
+	description: "Fetch one bounded research document by its identifier.",
+	inputSchema: Tool.getJsonSchema(FetchDocument)
+});
+const scriptedConnector = (tools) => Layer.succeed(McpConnector)({ connect: () => Effect.acquireRelease(Effect.succeed({
+	identity: docsMcpIdentity,
+	capabilities: McpSchema.ServerCapabilities.make({}),
+	tools,
+	toolkit: DocContentToolkit
+}), () => Effect.void) });
+/** The well-behaved scripted content server. */
+const docsMcpConnectorLayer = scriptedConnector([discoveredFetchDocument]);
+/** Serves a tool description exceeding `maxToolDescriptionBytes` (SEC-013 bound). */
+const docsMcpOversizedConnectorLayer = scriptedConnector([McpSchema.Tool.make({
+	name: discoveredFetchDocument.name,
+	description: "x".repeat(1024),
+	inputSchema: discoveredFetchDocument.inputSchema
+})]);
+/** Serves a discovery schema that disagrees with the authored toolkit (drift fails closed). */
+const docsMcpMismatchedConnectorLayer = scriptedConnector([McpSchema.Tool.make({
+	name: discoveredFetchDocument.name,
+	description: discoveredFetchDocument.description,
+	inputSchema: {
+		type: "object",
+		properties: { url: { type: "string" } }
+	}
+})]);
+const isJsonEqual = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+/**
+* Bind DISCOVERY to AUTHORING: `validateMcpDiscovery` (inside `connectMcp`)
+* already proved the served discovery matches the connection's own Toolkit;
+* this check additionally proves that Toolkit is the exact toolkit the
+* doc-summarizer was AUTHORED against — same tool names, same derived JSON
+* schemas — so a connector cannot substitute a look-alike toolkit. The
+* docs-researcher harness runs it before any worker Binding registration and
+* fails closed on any drift.
+*/
+const assertDiscoveryMatchesAuthoredToolkit = Effect.fn("DocsResearcher.assertDiscoveryMatchesAuthoredToolkit")(function* (connection) {
+	const authored = Object.values(DocContentToolkit.tools).map((tool) => ({
+		name: tool.name,
+		inputSchema: Tool.getJsonSchema(tool)
+	})).sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+	const discovered = Object.values(connection.toolkit.tools).map((tool) => ({
+		name: tool.name,
+		inputSchema: Tool.getJsonSchema(tool)
+	})).sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+	if (!(authored.length === discovered.length && authored.every((tool, index) => tool.name === discovered[index]?.name && isJsonEqual(tool.inputSchema, discovered[index]?.inputSchema)))) return yield* McpToolkitMismatch.make({
+		serverId: connection.discovery.identity.serverId,
+		message: "The MCP-discovered toolkit does not match the doc-summarizer's authored content toolkit"
+	});
+});
+/** Round-trip guard for encoded discovery values persisted as fixture evidence. */
+const DocsMcpDiscoveryEvidence = Schema.Struct({
+	serverId: Schema.NonEmptyString,
+	toolCount: Schema.Natural,
+	encodedBytes: Schema.Natural,
+	toolkitSchemaDigest: Schema.String
+});
+//#endregion
+//#region src/fixtures/docs-researcher/harness.ts
+const docsResearcherDeploymentId = Schema.decodeSync(DeploymentId)("docs-researcher-p7-deployment");
+const docsResearcherProducerId = Schema.decodeSync(ProducerId)("docs-researcher-p7-producer");
+const docsResearcherPrincipal = Schema.decodeSync(Principal)("docs-researcher-p7-principal");
+const digestOf$2 = (pair) => Schema.decodeSync(Digest)(pair.repeat(32));
+/** Redacted, deterministic coordinator definition digests for this fixture version. */
+const docsCoordinatorDigests = DefinitionDigests.make({
+	agent: digestOf$2("40"),
+	model: digestOf$2("41"),
+	tools: digestOf$2("42")
+});
+/** The child registration digests — byte-equal to `docsSummarizerDigestStrings` (SUB-023). */
+const docsSummarizerDigests = DefinitionDigests.make({
+	agent: digestOf$2("50"),
+	model: digestOf$2("51"),
+	tools: digestOf$2("52")
+});
+/** Durable admission options for one docs-researcher Submission on one mission lane. */
+const docsResearcherSubmitOptions = (conversationId, idempotencyKey) => ({
+	conversationId,
+	principal: docsResearcherPrincipal,
+	idempotencyKey,
+	definitions: docsCoordinatorDigests
+});
+/** The structural submit slice of the coordinator Binding (`DurableAgentRuntime.submit`). */
+const docsResearcherSubmitAgent = { definition: {
+	id: DocsResearcher.id,
+	input: DocsResearcher.input
+} };
+/** The deterministic delegation Tool Call identity for one document. */
+const summarizeCallId = (documentId) => `summarize-${documentId}`;
+/** The child's own scripted fetch Tool Call identity for one document. */
+const fetchCallId = (documentId) => `fetch-${documentId}`;
+const scriptedUsage$3 = {
+	inputTokens: { total: 96 },
+	outputTokens: { total: 64 }
+};
+const summaryDelegationParts = (documentIds) => [...documentIds.map((documentId) => ({
+	type: "tool-call",
+	id: summarizeCallId(documentId),
+	name: "delegate_document_summary",
+	params: { documentId },
+	providerExecuted: false
+})), {
+	type: "finish",
+	reason: "tool-calls",
+	usage: scriptedUsage$3
+}];
+const digestParts = (documentIds) => [
+	{
+		type: "text-start",
+		id: "digest"
+	},
+	{
+		type: "text-delta",
+		id: "digest",
+		delta: JSON.stringify(Schema.encodeSync(ResearchDigest)(expectedResearchDigest(documentIds)))
+	},
+	{
+		type: "text-end",
+		id: "digest"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage$3
+	}
+];
+const fetchParts = (documentId) => [{
+	type: "tool-call",
+	id: fetchCallId(documentId),
+	name: "fetch_document",
+	params: { documentId },
+	providerExecuted: false
+}, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: scriptedUsage$3
+}];
+const summaryParts = (documentId) => [
+	{
+		type: "text-start",
+		id: "document-summary"
+	},
+	{
+		type: "text-delta",
+		id: "document-summary",
+		delta: encodedDocumentSummary(documentId)
+	},
+	{
+		type: "text-end",
+		id: "document-summary"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage$3
+	}
+];
+/**
+* One prompt-aware scripted model with externally observable counters. A DN
+* Attempt may resume on a fresh Layer build, so responses derive from the
+* committed history in the prompt — never from an in-Layer turn counter.
+*/
+const makeCountingModel = (name, decide) => Effect.gen(function* () {
+	const calls = yield* Ref.make(0);
+	const prompts = yield* Ref.make([]);
+	return {
+		model: Model.make("scripted", name, Layer.effect(LanguageModel.LanguageModel, LanguageModel.make({
+			generateText: () => Effect.succeed([]),
+			streamText: (request) => Stream.unwrap(Effect.gen(function* () {
+				yield* Ref.update(calls, (value) => value + 1);
+				const promptJson = JSON.stringify(request.prompt);
+				yield* Ref.update(prompts, (previous) => [...previous, promptJson]);
+				return Stream.fromIterable(yield* decide(promptJson));
+			}))
+		}))),
+		calls: Ref.get(calls),
+		prompts: Ref.get(prompts)
+	};
+});
+/**
+* Build the docs-researcher harness. Order matters and is the point: the
+* child's content toolkit is only registered as a worker Binding AFTER the
+* MCP connector's bounded discovery validated the authored toolkit
+* byte-for-byte (`connectMcp` + `assertDiscoveryMatchesAuthoredToolkit`), so
+* "the tools the summarizer runs are the tools discovery served" is enforced
+* at assembly, not assumed. Content-tool execution then flows through the
+* counting `DocumentLibrary` — the scripted MCP server's content store.
+*/
+const makeDocsResearcherHarness = (options) => Effect.gen(function* () {
+	const documentIds = options?.documentIds ?? researchCorpusDocumentIds;
+	const discovery = yield* Effect.scoped(Effect.gen(function* () {
+		const connection = yield* connectMcp(docsMcpRequest);
+		yield* assertDiscoveryMatchesAuthoredToolkit(connection);
+		return connection.discovery;
+	})).pipe(Effect.provide(docsMcpConnectorLayer));
+	const fetchCounts = yield* Ref.make(/* @__PURE__ */ new Map());
+	const libraryLayer = Layer.succeed(DocumentLibrary, DocumentLibrary.of({ fetch: (query) => Ref.update(fetchCounts, (current) => new Map(current).set(query.documentId, (current.get(query.documentId) ?? 0) + 1)).pipe(Effect.andThen(researchDocumentLookup(query))) }));
+	const childToolkitLayer = docContentToolkitLayer.pipe(Layer.provideMerge(libraryLayer));
+	const childModel = yield* makeCountingModel("doc-summarizer-p7", (promptJson) => Effect.suspend(() => {
+		const documentId = documentIds.find((candidate) => promptJson.includes(candidate));
+		if (documentId === void 0) return Effect.die(/* @__PURE__ */ new Error("The summarizer prompt names no corpus document"));
+		return Effect.succeed(promptJson.includes(fetchCallId(documentId)) ? summaryParts(documentId) : fetchParts(documentId));
+	}));
+	const childBinding = Agent.withModel(DocSummarizer, childModel.model);
+	const firstCallId = summarizeCallId(documentIds[0] ?? "durability-notes");
+	const parentModel = yield* makeCountingModel("docs-researcher-p7", (promptJson) => Effect.succeed(promptJson.includes(firstCallId) ? digestParts(documentIds) : summaryDelegationParts(documentIds)));
+	const parentBinding = Agent.withModel(DocsResearcher, parentModel.model);
+	const delegationLayer = docsSummaryHandlersLayer(childBinding).pipe(Layer.provide(Layer.mergeAll(childToolkitLayer, SubagentReservationsMemoryLive, DeterministicIdGeneratorLayer)));
+	return {
+		bindings: [yield* DurableWorkerBinding.make(parentBinding, docsCoordinatorDigests).pipe(Effect.provide(delegationLayer)), yield* DurableWorkerBinding.make(childBinding, docsSummarizerDigests).pipe(Effect.provide(childToolkitLayer))],
+		discovery,
+		parentModelCalls: parentModel.calls,
+		parentPrompts: parentModel.prompts,
+		childModelCalls: childModel.calls,
+		childPrompts: childModel.prompts,
+		fetchInvocations: (documentId) => Ref.get(fetchCounts).pipe(Effect.map((current) => current.get(documentId) ?? 0))
+	};
+});
+const encodeResearchDocument = Schema.encodeEffect(ResearchDocument);
+/**
+* The audit-surface preview of one fetched document: the raw document —
+* secret marker and all — passes through the configured structural `Redactor`
+* before anything may quote it outside the child Conversation (SEC-008,
+* CAP-013). Tests assert the preview keeps shape but no scalar content.
+*/
+const redactedDocumentPreview = Effect.fn("DocsResearcher.redactedDocumentPreview")(function* (documentId) {
+	const redactor = yield* Redactor;
+	const encoded = yield* encodeResearchDocument(researchDocumentFor(documentId)).pipe(Effect.orDie);
+	return yield* redactor.redact(encoded);
+});
+//#endregion
+//#region src/fixtures/travel-planner/phase2.ts
+var ItineraryHoldRequest = class extends Schema.Class("@effect-agent/testing/travel-planner/ItineraryHoldRequest")({
+	quoteId: QuoteId,
+	expiresInMinutes: Schema.Int.check(Schema.isGreaterThan(0), Schema.isLessThanOrEqualTo(60))
+}) {};
+var ItineraryHold = class extends Schema.Class("@effect-agent/testing/travel-planner/ItineraryHold")({
+	holdId: Schema.NonEmptyString,
+	quoteId: QuoteId,
+	status: Schema.Literal("held")
+}) {};
+var ItineraryHoldUnavailable = class extends Schema.TaggedErrorClass()("ItineraryHoldUnavailable", {
+	quoteId: QuoteId,
+	message: Schema.String
+}) {};
+var ItineraryHoldGateway = class extends Context.Service()("@effect-agent/testing/travel-planner/ItineraryHoldGateway") {};
+/**
+* The first mutating Travel Planner Tool. Effect AI marks it as approval-gated
+* so the engine must settle approval before acquiring a handler permit.
+*/
+const HoldItinerary = Tool.make("hold_itinerary", {
+	parameters: ItineraryHoldRequest,
+	success: ItineraryHold,
+	failure: ItineraryHoldUnavailable,
+	failureMode: "error",
+	dependencies: [ItineraryHoldGateway],
+	needsApproval: true
+});
+const TravelPlannerPhase2Toolkit = Toolkit.make(SearchFlights, SearchLodging, SearchActivities, HoldItinerary);
+const TravelPlannerPhase2ToolkitLayer = TravelPlannerPhase2Toolkit.toLayer({
+	search_flights: (query) => Effect.flatMap(FlightCatalog, (catalog) => catalog.search(query)),
+	search_lodging: (query) => Effect.flatMap(LodgingCatalog, (catalog) => catalog.search(query)),
+	search_activities: (query) => Effect.flatMap(ActivityCatalog, (catalog) => catalog.search(query)),
+	hold_itinerary: (request) => Effect.flatMap(ItineraryHoldGateway, (gateway) => gateway.hold(request))
+});
+const TravelPlannerPhase2 = Agent.define("travel-planner-phase-2", {
+	input: TripRequest,
+	output: TravelPlan,
+	instructions: (input) => Effect.flatMap(TravelGuidance, (guidance) => guidance.instructions(input)),
+	toolkit: TravelPlannerPhase2Toolkit,
+	policy: AgentPolicy.make({
+		maxTurns: 3,
+		maxToolCalls: 4,
+		maxDuration: "30 seconds",
+		toolConcurrency: 3,
+		tokenBudget: 2048
+	}),
+	description: "Build a review-only itinerary and require approval before creating a temporary hold.",
+	metadata: {
+		deploymentClass: "E",
+		phase: "P2"
+	}
+});
+//#endregion
+//#region src/fixtures/travel-planner/scenarios.ts
+const usage = {
+	inputTokens: { total: 128 },
+	outputTokens: { total: 96 }
+};
+const phase1Trip = Schema.decodeSync(TripRequest)({
+	request: "Plan a review-only London trip using the deterministic flight, lodging, and activity searches.",
+	origin: "SFO",
+	destination: "LHR",
+	departOn: "2026-09-14",
+	nights: 4,
+	travelers: 2,
+	budgetCents: 35e4,
+	currency: "USD"
+});
+/** Backward-compatible fixture alias while consumers transition to the P1 name. */
+const phase0Trip = phase1Trip;
+const expectedTravelPlan = Schema.decodeSync(TravelPlan)({ itineraries: [{
+	title: "Westward light, eastbound overnight",
+	route: "San Francisco → London",
+	dates: "14–19 September 2026",
+	flight: "EA 218 · nonstop · SFO 18:40 → LHR 13:05+1",
+	lodging: "Bloomsbury House · refundable studio · 4 nights",
+	activities: ["British Museum timed entry", "Thames evening walk"],
+	estimatedTotalCents: 284e3,
+	currency: "USD",
+	quoteId: "quote-sfo-lhr-001",
+	assumptions: ["Two travelers sharing one studio", "Quote is read-only availability, not a reservation"],
+	unresolvedConstraints: ["Traveler names and accessibility requests are intentionally omitted"],
+	nextAction: "review"
+}] });
+const phase1HappyPathTurns = [{
+	_tag: "Stream",
+	parts: [
+		{
+			type: "tool-call",
+			id: "flight-call-1",
+			name: "search_flights",
+			params: {
+				origin: "SFO",
+				destination: "LHR",
+				departOn: "2026-09-14",
+				travelers: 2
+			}
+		},
+		{
+			type: "tool-call",
+			id: "lodging-call-1",
+			name: "search_lodging",
+			params: {
+				destination: "LHR",
+				departOn: "2026-09-14",
+				nights: 4,
+				travelers: 2
+			}
+		},
+		{
+			type: "tool-call",
+			id: "activity-call-1",
+			name: "search_activities",
+			params: {
+				destination: "LHR",
+				departOn: "2026-09-14",
+				nights: 4,
+				travelers: 2
+			}
+		},
+		{
+			type: "finish",
+			reason: "tool-calls",
+			usage
+		}
+	],
+	termination: { _tag: "Complete" }
+}, {
+	_tag: "Stream",
+	parts: [
+		{
+			type: "text-start",
+			id: "itinerary-json"
+		},
+		{
+			type: "text-delta",
+			id: "itinerary-json",
+			delta: JSON.stringify(Schema.encodeSync(TravelPlan)(expectedTravelPlan))
+		},
+		{
+			type: "text-end",
+			id: "itinerary-json"
+		},
+		{
+			type: "finish",
+			reason: "stop",
+			usage
+		}
+	],
+	termination: { _tag: "Complete" }
+}];
+const phase0HappyPathTurns = phase1HappyPathTurns;
+//#endregion
+//#region src/fixtures/travel-planner/phase3.ts
+/**
+* The Phase 3 profile persists Conversation history but deliberately does not
+* claim durable admission or recovery of accepted work.
+*/
+var TravelPlannerPersistenceProfile = class extends Schema.Class("@effect-agent/testing/travel-planner/TravelPlannerPersistenceProfile")({
+	deploymentClass: Schema.Literal("P"),
+	durableAcceptedWork: Schema.Literal(false),
+	canonicalSchemaVersion: Schema.Literal(1)
+}) {};
+const phase3TravelPlannerProfile = TravelPlannerPersistenceProfile.make({
+	deploymentClass: "P",
+	durableAcceptedWork: false,
+	canonicalSchemaVersion: 1
+});
+const phase3TravelPlannerConversationId = Schema.decodeSync(ConversationId)("travel-planner-p3-conversation");
+const phase3TravelPlannerProducerId = Schema.decodeSync(ProducerId)("travel-planner-p3-producer");
+const phase3TravelPlannerRunId = Schema.decodeSync(RunId)("travel-planner-p3-run");
+const deploymentId = Schema.decodeSync(DeploymentId)("travel-planner-p3-scripted");
+const agentId = Schema.decodeSync(AgentId)("travel-planner");
+const submissionId = Schema.decodeSync(SubmissionId)("travel-planner-p3-submission");
+const digest$2 = (character) => Schema.decodeSync(Digest)(character.repeat(64));
+/** Redacted, deterministic definition identities for the current fixture version. */
+const phase3TravelPlannerDefinitionDigests = DefinitionDigests.make({
+	agent: digest$2("a"),
+	model: digest$2("b"),
+	tools: digest$2("c")
+});
+const tripInput = Schema.encodeSync(TripRequest)(phase1Trip);
+const travelPlanOutput = Schema.encodeSync(TravelPlan)(expectedTravelPlan);
+const record = (recordId, createdAt, payload) => Schema.decodeUnknownSync(RecordEnvelope)({
+	recordId: Schema.decodeSync(RecordId)(recordId),
+	family: "conversation",
+	schemaVersion: 1,
+	createdAt,
+	deploymentId,
+	payload
+});
+/**
+* The first atomic append establishes the Conversation and records its input.
+* Its encoded value is the redacted current-version persistence fixture.
+*/
+const phase3TravelPlannerInitialBatch = CanonicalBatch.make({
+	batchId: Schema.decodeSync(BatchId)("travel-planner-p3-initial"),
+	producerId: phase3TravelPlannerProducerId,
+	records: [record("travel-planner-p3-created", "2026-09-01T00:00:00.000Z", {
+		_tag: "ConversationCreated",
+		agentId,
+		definitions: phase3TravelPlannerDefinitionDigests
+	}), record("travel-planner-p3-input", "2026-09-01T00:00:01.000Z", {
+		_tag: "UserInputRecorded",
+		submissionId,
+		kind: "user",
+		runId: phase3TravelPlannerRunId,
+		input: tripInput
+	})]
+});
+/** The second append records the Schema-decoded itinerary and terminal Run result. */
+const phase3TravelPlannerCompletionBatch = CanonicalBatch.make({
+	batchId: Schema.decodeSync(BatchId)("travel-planner-p3-completion"),
+	producerId: phase3TravelPlannerProducerId,
+	records: [record("travel-planner-p3-model", "2026-09-01T00:00:02.000Z", {
+		_tag: "ModelCompleted",
+		runId: phase3TravelPlannerRunId,
+		output: travelPlanOutput
+	}), record("travel-planner-p3-completed", "2026-09-01T00:00:03.000Z", {
+		_tag: "RunCompleted",
+		runId: phase3TravelPlannerRunId,
+		output: travelPlanOutput
+	})]
+});
+const phase3TravelPlannerBatches = [phase3TravelPlannerInitialBatch, phase3TravelPlannerCompletionBatch];
+/** Portable current-version fixture; it contains no passenger identity or credentials. */
+const phase3TravelPlannerEncodedFixture = Schema.encodeSync(Schema.Array(CanonicalBatch))(phase3TravelPlannerBatches);
+var TravelPlannerProjectionError = class extends Schema.TaggedErrorClass()("TravelPlannerProjectionError", { message: Schema.String }) {};
+/** Decode the itinerary projection rebuilt from canonical model-completion records. */
+const travelPlanFromProjection = (projection) => {
+	const output = projection.modelOutputs.at(-1);
+	if (output === void 0) return Effect.fail(TravelPlannerProjectionError.make({ message: "The canonical projection has no completed Travel Planner model output." }));
+	return Schema.decodeUnknownEffect(TravelPlan)(output).pipe(Effect.mapError((error) => TravelPlannerProjectionError.make({ message: error.message })));
+};
+/** Build a disposable checkpoint bound to a validated canonical prefix. */
+const makePhase3TravelPlannerCheckpoint = (projection) => Schema.decodeSync(ConversationCheckpoint)({
+	schemaVersion: 1,
+	conversationId: projection.conversationId,
+	throughSequence: projection.throughSequence,
+	tailDigest: projection.tailDigest,
+	engineVersion: "phase-3-test-runtime",
+	agentDefinitionDigest: phase3TravelPlannerDefinitionDigests.agent,
+	modelDigest: phase3TravelPlannerDefinitionDigests.model,
+	toolDigest: phase3TravelPlannerDefinitionDigests.tools,
+	state: Schema.encodeSync(ConversationProjection)(projection),
+	createdAt: "2026-09-01T00:00:04.000Z"
+});
+//#endregion
+//#region src/scripted-model.ts
+const ScriptedPartMetadata = Schema.Record(Schema.String, Schema.NullOr(Schema.Json));
+const ScriptedPartBase = { metadata: Schema.optionalKey(ScriptedPartMetadata) };
+const ScriptedToolCallPart = Schema.Struct({
+	...ScriptedPartBase,
+	type: Schema.Literal("tool-call"),
+	id: Schema.String,
+	name: Schema.String,
+	params: Schema.Unknown,
+	providerExecuted: Schema.optionalKey(Schema.Boolean)
+});
+const ScriptedToolResultPart = Schema.Struct({
+	...ScriptedPartBase,
+	type: Schema.Literal("tool-result"),
+	id: Schema.String,
+	name: Schema.String,
+	result: Schema.Unknown,
+	isFailure: Schema.Boolean,
+	providerExecuted: Schema.optionalKey(Schema.Boolean),
+	preliminary: Schema.optionalKey(Schema.Boolean)
+});
+/**
+* Schema for encoded, non-streaming Effect AI response parts.
+*
+* Generic Tool payloads remain explicitly unknown here. `LanguageModel.make`
+* performs the toolkit-specific decode when the scripted response is consumed.
+*/
+const ScriptedGeneratePart = Schema.Union([
+	Schema.toEncoded(Response.TextPart),
+	Schema.toEncoded(Response.ReasoningPart),
+	Schema.toEncoded(Response.ReasoningDeltaPart),
+	Schema.toEncoded(Response.ReasoningEndPart),
+	ScriptedToolCallPart,
+	ScriptedToolResultPart,
+	Schema.toEncoded(Response.ToolApprovalRequestPart),
+	Schema.toEncoded(Response.FilePart),
+	Schema.toEncoded(Response.DocumentSourcePart),
+	Schema.toEncoded(Response.UrlSourcePart),
+	Schema.toEncoded(Response.ResponseMetadataPart),
+	Schema.toEncoded(Response.FinishPart)
+]).annotate({ identifier: "ScriptedGeneratePart" });
+/**
+* Schema for encoded Effect AI streaming response parts.
+*/
+const ScriptedStreamPart = Schema.Union([
+	Schema.toEncoded(Response.TextStartPart),
+	Schema.toEncoded(Response.TextDeltaPart),
+	Schema.toEncoded(Response.TextEndPart),
+	Schema.toEncoded(Response.ReasoningStartPart),
+	Schema.toEncoded(Response.ReasoningDeltaPart),
+	Schema.toEncoded(Response.ReasoningEndPart),
+	Schema.toEncoded(Response.ToolParamsStartPart),
+	Schema.toEncoded(Response.ToolParamsDeltaPart),
+	Schema.toEncoded(Response.ToolParamsEndPart),
+	ScriptedToolCallPart,
+	ScriptedToolResultPart,
+	Schema.toEncoded(Response.ToolApprovalRequestPart),
+	Schema.toEncoded(Response.FilePart),
+	Schema.toEncoded(Response.DocumentSourcePart),
+	Schema.toEncoded(Response.UrlSourcePart),
+	Schema.toEncoded(Response.ResponseMetadataPart),
+	Schema.toEncoded(Response.FinishPart),
+	Schema.toEncoded(Response.ErrorPart)
+]).annotate({ identifier: "ScriptedStreamPart" });
+/** Controls whether a scripted stream completes, fails, or waits for interruption. */
+const ScriptedStreamTermination = Schema.Union([
+	Schema.TaggedStruct("Complete", {}),
+	Schema.TaggedStruct("Fail", { description: Schema.String }),
+	Schema.TaggedStruct("Hang", {})
+]);
+/** One non-streaming invocation and the encoded response parts it returns. */
+const ScriptedGenerateTurn = Schema.TaggedStruct("Generate", { parts: Schema.Array(ScriptedGeneratePart) });
+/** One streaming invocation with its encoded parts and terminal behavior. */
+const ScriptedStreamTurn = Schema.TaggedStruct("Stream", {
+	parts: Schema.Array(ScriptedStreamPart),
+	termination: ScriptedStreamTermination
+});
+/**
+* Serializable grammar for one finite scripted provider invocation.
+*/
+const ScriptedTurn = Schema.Union([ScriptedGenerateTurn, ScriptedStreamTurn]);
+const scriptedError = (method, description) => AiError.AiError.make({
+	module: "@effect-agent/testing/ScriptedModel",
+	method,
+	reason: AiError.UnknownError.make({ description })
+});
+const runAssertion = Effect.fn("ScriptedModel.runAssertion")((assertion, request) => {
+	if (assertion === void 0) return Effect.void;
+	return Effect.suspend(() => {
+		const result = assertion(request);
+		return Effect.isEffect(result) ? result : Effect.void;
+	});
+});
+const takeTurn = Effect.fn("ScriptedModel.takeTurn")((state, kind, options) => Ref.modify(state, (current) => {
+	const turn = current.remaining[0];
+	if (turn === void 0) return [void 0, {
+		...current,
+		requests: [...current.requests, {
+			kind,
+			options
+		}]
+	}];
+	return [turn, {
+		remaining: current.remaining.slice(1),
+		requests: [...current.requests, {
+			kind,
+			options
+		}]
+	}];
+}).pipe(Effect.flatMap((turn) => turn === void 0 ? Effect.fail(scriptedError(kind, `Script exhausted before the ${kind} request`)) : Effect.succeed(turn))));
+const requireGenerateTurn = (turn) => turn._tag === "Generate" ? Effect.succeed(turn) : Effect.fail(scriptedError("generate", `Expected a Generate turn but found ${turn._tag}`));
+const requireStreamTurn = (turn) => turn._tag === "Stream" ? Effect.succeed(turn) : Effect.fail(scriptedError("stream", `Expected a Stream turn but found ${turn._tag}`));
+const streamForTurn = (turn) => {
+	let stream = Stream.fromIterable(turn.parts);
+	switch (turn.termination._tag) {
+		case "Complete": break;
+		case "Fail":
+			stream = stream.pipe(Stream.concat(Stream.fail(scriptedError("stream", turn.termination.description))));
+			break;
+		case "Hang":
+			stream = stream.pipe(Stream.concat(Stream.never));
+			break;
+	}
+	if (turn.onStreamStart !== void 0) stream = Stream.fromEffectDrain(turn.onStreamStart).pipe(Stream.concat(stream));
+	if (turn.onStreamFinalize !== void 0) stream = stream.pipe(Stream.ensuring(turn.onStreamFinalize));
+	return stream;
+};
+/** Inspection service for a deterministic LanguageModel backed by finite scripted turns. */
+var ScriptedModel = class ScriptedModel extends Context.Service()("@effect-agent/testing/ScriptedModel") {
+	/**
+	* Provides the native Effect AI `LanguageModel` and this inspection service.
+	* Supplying the extra inspection service does not add it to model-call
+	* requirements. Each model invocation consumes one turn before assertion and
+	* turn-kind validation.
+	*/
+	static layer(turns) {
+		return Layer.effectContext(Effect.gen(function* () {
+			const state = yield* Ref.make({
+				remaining: [...turns],
+				requests: []
+			});
+			const languageModel = yield* LanguageModel.make({
+				generateText: (options) => Effect.gen(function* () {
+					const turn = yield* takeTurn(state, "generate", options);
+					yield* runAssertion(turn.assertRequest, options);
+					return [...(yield* requireGenerateTurn(turn)).parts];
+				}),
+				streamText: (options) => Stream.unwrap(Effect.gen(function* () {
+					const turn = yield* takeTurn(state, "stream", options);
+					yield* runAssertion(turn.assertRequest, options);
+					const streamTurn = yield* requireStreamTurn(turn);
+					return streamForTurn(streamTurn);
+				}))
+			});
+			const inspection = ScriptedModel.of({
+				requests: Ref.get(state).pipe(Effect.map((current) => current.requests)),
+				remaining: Ref.get(state).pipe(Effect.map((current) => current.remaining.length)),
+				assertExhausted: Ref.get(state).pipe(Effect.flatMap((current) => current.remaining.length === 0 ? Effect.void : Effect.fail(scriptedError("assertExhausted", `${current.remaining.length} scripted turn(s) remain`))))
+			});
+			return Context.make(LanguageModel.LanguageModel, languageModel).pipe(Context.add(ScriptedModel, inspection));
+		}));
+	}
+};
+//#endregion
+//#region src/fixtures/travel-planner/phase4.ts
+/**
+* The Phase 4 profile claims durable accepted work on the Node/SQLite runtime (deployment class
+* DN): once `submit` returns a Receipt, the Submission settles exactly once even across process
+* loss. The claim is limited to safe-to-repeat toolkits (D6): supplier booking is explicitly NOT
+* claimed safely replayable — replay-safe external mutation is P5 (Durable Tools) scope.
+*/
+var TravelPlannerDurabilityProfile = class extends Schema.Class("@effect-agent/testing/travel-planner/TravelPlannerDurabilityProfile")({
+	deploymentClass: Schema.Literal("DN"),
+	durableAcceptedWork: Schema.Literal(true),
+	canonicalSchemaVersion: Schema.Literal(1),
+	/** Supplier booking replay safety is P5 (Durable Tools) scope; DN does not claim it. */
+	supplierBookingReplaySafe: Schema.Literal(false)
+}) {};
+const phase4TravelPlannerProfile = TravelPlannerDurabilityProfile.make({
+	deploymentClass: "DN",
+	durableAcceptedWork: true,
+	canonicalSchemaVersion: 1,
+	supplierBookingReplaySafe: false
+});
+const phase4TravelPlannerDeploymentId = Schema.decodeSync(DeploymentId)("travel-planner-p4-deployment");
+const phase4TravelPlannerProducerId = Schema.decodeSync(ProducerId)("travel-planner-p4-producer");
+const phase4TravelPlannerPrincipal = Schema.decodeSync(Principal)("travel-planner-p4-principal");
+const digest$1 = (character) => Schema.decodeSync(Digest)(character.repeat(64));
+/** Redacted, deterministic definition identities for the current fixture version. */
+const phase4TravelPlannerDefinitionDigests = DefinitionDigests.make({
+	agent: digest$1("d"),
+	model: digest$1("e"),
+	tools: digest$1("f")
+});
+/** Durable admission options for one Travel Planner Submission on one trip lane. */
+const phase4TravelPlannerSubmitOptions = (conversationId, idempotencyKey) => ({
+	conversationId,
+	principal: phase4TravelPlannerPrincipal,
+	idempotencyKey,
+	definitions: phase4TravelPlannerDefinitionDigests
+});
+/**
+* The P4 read-only search Tools, calling the same deterministic catalogs as the P1 toolkit.
+*
+* The plain-Struct parameter shape is a historical remnant of the P4 carry-in workaround: since
+* the P5 engine fix, official history carries Schema-ENCODED Tool-call parameters, so class-typed
+* parameter codecs persist canonically too — the Structs simply need no change here. The
+* `ToolExecutionClass` `readonly` annotation is the deliberate P5 migration (plan §4.3): these
+* Tools perform no external mutation, so a crash between start and settlement is a free re-run
+* and they never enter the prepared/settled uncertainty protocol — keeping the P4 canonical
+* history byte-stable (an unannotated Tool fails closed to `uncertain`).
+*/
+const DurableSearchFlights = Tool.make("search_flights", {
+	parameters: Schema.Struct(FlightQuery.fields),
+	success: FlightOption,
+	failure: FlightUnavailable,
+	failureMode: "error",
+	dependencies: [FlightCatalog]
+}).annotate(ToolExecutionClass, "readonly");
+const DurableSearchLodging = Tool.make("search_lodging", {
+	parameters: Schema.Struct(LodgingQuery.fields),
+	success: LodgingOption,
+	failure: LodgingUnavailable,
+	failureMode: "error",
+	dependencies: [LodgingCatalog]
+}).annotate(ToolExecutionClass, "readonly");
+const DurableSearchActivities = Tool.make("search_activities", {
+	parameters: Schema.Struct(ActivityQuery.fields),
+	success: ActivitySearchResult,
+	failure: ActivityUnavailable,
+	failureMode: "error",
+	dependencies: [ActivityCatalog]
+}).annotate(ToolExecutionClass, "readonly");
+const TravelPlannerPhase4Toolkit = Toolkit.make(DurableSearchFlights, DurableSearchLodging, DurableSearchActivities);
+const TravelPlannerPhase4ToolkitLayer = TravelPlannerPhase4Toolkit.toLayer({
+	search_flights: (query) => Effect.flatMap(FlightCatalog, (catalog) => catalog.search(FlightQuery.make(query))),
+	search_lodging: (query) => Effect.flatMap(LodgingCatalog, (catalog) => catalog.search(LodgingQuery.make(query))),
+	search_activities: (query) => Effect.flatMap(ActivityCatalog, (catalog) => catalog.search(ActivityQuery.make(query)))
+});
+/**
+* The cumulative Travel Planner, Phase 4: the P1 planning behavior on the durable Node/SQLite
+* runtime. The searches are read-only and safe to repeat across Attempts (D6); supplier booking
+* is deliberately absent because DN does NOT claim replay-safe external mutation (P5 scope).
+*/
+const TravelPlannerPhase4 = Agent.define("travel-planner-phase-4", {
+	input: TripRequest,
+	output: TravelPlan,
+	instructions: (input) => Effect.flatMap(TravelGuidance, (guidance) => guidance.instructions(input)),
+	toolkit: TravelPlannerPhase4Toolkit,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 3,
+		maxDuration: "30 seconds",
+		toolConcurrency: 3
+	}),
+	description: "Durably plan one review-only itinerary from safe-to-repeat deterministic searches; supplier booking is not claimed safely replayable.",
+	metadata: {
+		deploymentClass: "DN",
+		phase: "P4"
+	}
+});
+/**
+* The P4 Agent Binding: the durable Travel Planner definition bound to a finite scripted model.
+* The scripted Layer is rebuilt per Run, so every Run of one Binding replays the same
+* deterministic script.
+*/
+const makePhase4TravelPlannerAgent = (turns = phase1HappyPathTurns) => Agent.withModel(TravelPlannerPhase4, Model.make("scripted", "travel-planner-phase-4", ScriptedModel.layer(turns)));
+/**
+* Everything a durable worker needs beyond the runtime stack, reusing the deterministic P1
+* travel-service Layers. The durable coordinator supplies its own deterministic `IdGenerator`,
+* so this Layer deliberately provides none.
+*/
+const phase4TravelPlannerWorkerLayer = Layer.mergeAll(TravelPlannerPhase4ToolkitLayer, FlightCatalogLayer, LodgingCatalogLayer, ActivityCatalogLayer, TravelGuidanceLayer).pipe(Layer.provide(CatalogLifecycle.layerNoDeps));
+var TravelPlannerDurableEvidenceError = class extends Schema.TaggedErrorClass()("TravelPlannerDurableEvidenceError", { message: Schema.String }) {};
+/**
+* Decode the completed itinerary from the canonical `SubmissionSettled` record. Canonical history
+* is the outcome authority (DUR-015): the settled result — not any ledger cache — must decode
+* through the trip output schema.
+*/
+const travelPlanFromDurableSettlement = Effect.fn("TravelPlannerPhase4.travelPlanFromDurableSettlement")(function* (records) {
+	const settled = records.flatMap((envelope) => envelope.record.payload._tag === "SubmissionSettled" ? [envelope.record.payload] : []).at(0);
+	if (settled === void 0) return yield* TravelPlannerDurableEvidenceError.make({ message: "The canonical Conversation Log has no SubmissionSettled record." });
+	if (settled.outcome !== "completed" || settled.result === void 0) return yield* TravelPlannerDurableEvidenceError.make({ message: `The Submission settled ${settled.outcome} without a completed itinerary result.` });
+	return yield* Schema.decodeUnknownEffect(TravelPlan)(settled.result).pipe(Effect.mapError((error) => TravelPlannerDurableEvidenceError.make({ message: `The settled result does not decode through the TravelPlan schema: ${error.message}` })));
+});
+const encodeEvidence = Schema.encodeEffect(Schema.Array(CanonicalRecordEnvelope));
+const decodeComparableJson$1 = Schema.decodeUnknownEffect(Schema.Json);
+/**
+* Project canonical evidence into a Submission-identity-independent comparable form: batch
+* identity, canonical sequence, and the full encoded record, with the ledger-minted
+* `submissionId`/`receiptId` (and every identity derived from them: run, turn, batch, record,
+* and settlement ids) replaced by stable placeholders. Two Conversations whose normalized
+* evidence is equal took byte-equivalent canonical histories, so restart-equivalence can compare
+* a recovered run against an uninterrupted control run on a separate database.
+*/
+const normalizeDurableTravelPlannerEvidence = Effect.fn("TravelPlannerPhase4.normalizeDurableTravelPlannerEvidence")(function* (records, receipt) {
+	const comparable = (yield* encodeEvidence(records).pipe(Effect.mapError((error) => TravelPlannerDurableEvidenceError.make({ message: `Canonical evidence failed to encode: ${error.message}` })))).map((envelope) => ({
+		batchId: envelope.batchId,
+		sequence: envelope.sequence,
+		record: envelope.record
+	}));
+	const substituted = JSON.parse(JSON.stringify(comparable).replaceAll(receipt.submissionId, "{submissionId}").replaceAll(receipt.receiptId, "{receiptId}"));
+	return yield* decodeComparableJson$1(substituted).pipe(Effect.mapError((error) => TravelPlannerDurableEvidenceError.make({ message: `Normalized evidence is not comparable JSON: ${error.message}` })));
+});
+//#endregion
+//#region src/fixtures/travel-planner/phase5.ts
+/**
+* The Phase 5 profile extends the P4 `DN` claim to consequential supplier mutation: booking
+* Tools enter the prepared/settled uncertainty protocol, unresolved external effects stop at
+* Unknown Outcomes instead of replaying, Durable Steps replay recorded results, and queued
+* traveler input joins the active Run. Exactly-once EXTERNAL execution is still — deliberately —
+* not claimed (DUR-003): the supplier's own idempotency keys are what dedupe repeats.
+*/
+var TravelPlannerBookingProfile = class extends Schema.Class("@effect-agent/testing/travel-planner/TravelPlannerBookingProfile")({
+	deploymentClass: Schema.Literal("DN"),
+	durableAcceptedWork: Schema.Literal(true),
+	canonicalSchemaVersion: Schema.Literal(1),
+	/** P5: supplier mutations get prepared/settled records, Unknown Outcomes, and reconciliation. */
+	supplierBookingUncertaintyProtocol: Schema.Literal(true),
+	/** P5: Durable Steps are exactly-once-RECORDED; their side effects stay at-least-once. */
+	durableStepsRecorded: Schema.Literal(true),
+	/** Never claimed at any phase (DUR-003). */
+	exactlyOnceExternalEffects: Schema.Literal(false)
+}) {};
+const phase5TravelPlannerProfile = TravelPlannerBookingProfile.make({
+	deploymentClass: "DN",
+	durableAcceptedWork: true,
+	canonicalSchemaVersion: 1,
+	supplierBookingUncertaintyProtocol: true,
+	durableStepsRecorded: true,
+	exactlyOnceExternalEffects: false
+});
+const phase5TravelPlannerDeploymentId = Schema.decodeSync(DeploymentId)("travel-planner-p5-deployment");
+const phase5TravelPlannerProducerId = Schema.decodeSync(ProducerId)("travel-planner-p5-producer");
+const phase5TravelPlannerPrincipal = Schema.decodeSync(Principal)("travel-planner-p5-principal");
+const digest = (character) => Schema.decodeSync(Digest)(character.repeat(64));
+/** Redacted, deterministic definition identities for the current fixture version. */
+const phase5TravelPlannerDefinitionDigests = DefinitionDigests.make({
+	agent: digest("1"),
+	model: digest("2"),
+	tools: digest("3")
+});
+/** Durable admission options for one Travel Planner Submission on one trip lane. */
+const phase5TravelPlannerSubmitOptions = (conversationId, idempotencyKey) => ({
+	conversationId,
+	principal: phase5TravelPlannerPrincipal,
+	idempotencyKey,
+	definitions: phase5TravelPlannerDefinitionDigests
+});
+const TravelerRef = Schema.NonEmptyString.pipe(Schema.brand("@effect-agent/testing/travel-planner/TravelerRef"));
+/**
+* Class-shaped booking parameters with branded fields: since the P5 engine fix, official history
+* carries Schema-ENCODED Tool-call parameters, so class-typed parameter codecs persist
+* canonically end-to-end (the P4 Struct workaround is gone for new Tools).
+*/
+var FlightBookingRequest = class extends Schema.Class("FlightBookingRequest")({
+	quoteId: QuoteId,
+	travelerRef: TravelerRef,
+	departOn: Schema.String
+}) {};
+var SupplierBookingConfirmation = class extends Schema.Class("SupplierBookingConfirmation")({
+	bookingRef: BookingRef,
+	status: Schema.Literal("confirmed"),
+	detail: Schema.String
+}) {};
+var CancelBookingRequest = class extends Schema.Class("CancelBookingRequest")({
+	bookingRef: BookingRef,
+	travelerRef: TravelerRef
+}) {};
+var CancellationConfirmation = class extends Schema.Class("CancellationConfirmation")({
+	bookingRef: BookingRef,
+	status: Schema.Literal("cancelled")
+}) {};
+var ItineraryBookingRequest = class extends Schema.Class("ItineraryBookingRequest")({
+	quoteId: QuoteId,
+	destination: AirportCode,
+	nights: Schema.Int.check(Schema.isGreaterThan(0)),
+	travelerRef: TravelerRef
+}) {};
+var ItineraryConfirmation = class extends Schema.Class("ItineraryConfirmation")({
+	flightBookingRef: BookingRef,
+	lodgingBookingRef: BookingRef,
+	confirmationCode: Schema.String
+}) {};
+/** The P5 Run output: a booked (or explicitly not-booked) trip report. */
+var TravelBookingReport = class extends Schema.Class("TravelBookingReport")({
+	summary: Schema.String,
+	bookingRefs: Schema.Array(BookingRef)
+}) {};
+/**
+* Supplier idempotency-key derivations. The handler owns key derivation (the `idempotent` and
+* `uncertain` execution classes carry no key), and the reconciler MUST use the same derivations
+* to query external truth — both sides are exported so they cannot drift.
+*/
+const bookFlightIdempotencyKey = (toolCallId) => `book-flight:${toolCallId}`;
+const itineraryStepIdempotencyKey = (toolCallId, stepName) => `${toolCallId}:${stepName}`;
+/**
+* Approval-gated supplier booking, explicitly `uncertain`: a crash after the call may have
+* mutated supplier state without a recorded outcome, so recovery must reconcile or stop at an
+* Unknown Outcome — never replay automatically (DUR-009, ADR-0004).
+*/
+const BookFlight = Tool.make("book_flight", {
+	parameters: FlightBookingRequest,
+	success: SupplierBookingConfirmation,
+	failure: SupplierUnavailable,
+	failureMode: "error",
+	needsApproval: true,
+	dependencies: [SupplierBookingDesk]
+}).annotate(ToolExecutionClass, "uncertain");
+/**
+* Approval-gated cancellation, annotated `idempotent`: the DECLARED external contract is that
+* cancellation is idempotent by `bookingRef` (the supplier desk enforces it), so recovery may
+* re-execute a prepared-but-unsettled cancel without reconciliation proof. Repeats stay
+* observable in the supplier call counters — the annotation never claims exactly-once execution.
+*/
+const CancelBooking = Tool.make("cancel_booking", {
+	parameters: CancelBookingRequest,
+	success: CancellationConfirmation,
+	failure: SupplierUnavailable,
+	failureMode: "error",
+	needsApproval: true,
+	dependencies: [SupplierBookingDesk]
+}).annotate(ToolExecutionClass, "idempotent");
+/**
+* The Durable Tool: declaring `DurableStep` in `dependencies` is what makes it durable
+* (CONTEXT.md). Its handler divides supplier mutation into three named Steps — `reserve-flight`,
+* `reserve-lodging`, `issue-confirmation` — each deriving its supplier idempotency key from
+* `(toolCallId, stepName)`, so re-entry after interruption replays recorded Step results and the
+* supplier dedupes any honestly-repeated call. The Tool itself carries no execution-class
+* annotation: it stays fail-closed `uncertain`, and `TravelSupplierReconcilerLayer` proves
+* re-entry safe from the keyed-Step construction instead.
+*/
+const BookItinerary = Tool.make("book_itinerary", {
+	parameters: ItineraryBookingRequest,
+	success: ItineraryConfirmation,
+	failure: Schema.Union([SupplierUnavailable, DurableStepError]),
+	failureMode: "error",
+	dependencies: [DurableStep, SupplierBookingDesk]
+});
+const TravelPlannerPhase5Toolkit = Toolkit.make(DurableSearchFlights, DurableSearchLodging, DurableSearchActivities, BookFlight, CancelBooking, BookItinerary);
+const requireToolCallId = (toolName, toolCallId) => toolCallId === void 0 ? Effect.fail(SupplierUnavailable.make({ message: `${toolName} needs its stable Tool Call ID to derive the supplier idempotency key.` })) : Effect.succeed(toolCallId);
+const TravelPlannerPhase5ToolkitLayer = TravelPlannerPhase5Toolkit.toLayer({
+	search_flights: (query) => Effect.flatMap(FlightCatalog, (catalog) => catalog.search(FlightQuery.make(query))),
+	search_lodging: (query) => Effect.flatMap(LodgingCatalog, (catalog) => catalog.search(LodgingQuery.make(query))),
+	search_activities: (query) => Effect.flatMap(ActivityCatalog, (catalog) => catalog.search(ActivityQuery.make(query))),
+	book_flight: (request, context) => Effect.gen(function* () {
+		const desk = yield* SupplierBookingDesk;
+		const toolCallId = yield* requireToolCallId("book_flight", context.toolCallId);
+		const record = yield* desk.book({
+			operation: "book-flight",
+			idempotencyKey: bookFlightIdempotencyKey(toolCallId),
+			detail: `flight ${request.quoteId} for ${request.travelerRef} on ${request.departOn}`
+		});
+		return SupplierBookingConfirmation.make({
+			bookingRef: record.bookingRef,
+			status: "confirmed",
+			detail: record.detail
+		});
+	}),
+	cancel_booking: (request) => Effect.gen(function* () {
+		const record = yield* (yield* SupplierBookingDesk).cancel(request.bookingRef);
+		return CancellationConfirmation.make({
+			bookingRef: record.bookingRef,
+			status: "cancelled"
+		});
+	}),
+	book_itinerary: (request, context) => Effect.gen(function* () {
+		const desk = yield* SupplierBookingDesk;
+		const step = yield* DurableStep;
+		const toolCallId = yield* requireToolCallId("book_itinerary", context.toolCallId);
+		const bookStep = (stepName, detail) => step.do(stepName, SupplierBookingRecord, desk.book({
+			operation: stepName,
+			idempotencyKey: itineraryStepIdempotencyKey(toolCallId, stepName),
+			detail
+		}));
+		const flight = yield* bookStep("reserve-flight", `flight ${request.quoteId} for ${request.travelerRef}`);
+		const lodging = yield* bookStep("reserve-lodging", `lodging ${request.destination} for ${request.nights} nights (${request.travelerRef})`);
+		const confirmation = yield* bookStep("issue-confirmation", `itinerary confirmation for ${request.travelerRef}`);
+		return ItineraryConfirmation.make({
+			flightBookingRef: flight.bookingRef,
+			lodgingBookingRef: lodging.bookingRef,
+			confirmationCode: confirmation.bookingRef
+		});
+	})
+});
+const decodePersistedJson = Schema.decodeUnknownEffect(PersistedJson);
+const encodeConfirmation = Schema.encodeEffect(SupplierBookingConfirmation);
+/**
+* The application reconciliation policy (durability §10): a claim about EXTERNAL truth, queried
+* from the supplier desk by the same idempotency-key derivations the handlers use.
+*
+* - `book_flight`: a confirmed booking under `book-flight:{toolCallId}` is recovered supplier
+*   truth — `CompletedWithResult` settles it canonically without executing anything. Absence is
+*   NOT proof the call never started (a real supplier write could be in flight), so the desk
+*   answer stays fail-closed `Uncertain`.
+* - `book_itinerary`: every external mutation inside is a named Step whose supplier idempotency
+*   key derives from `(toolCallId, stepName)`, so re-entry is provably safe by construction —
+*   `SafeToRetry`. Committed Steps replay from their records; repeated calls dedupe at the desk.
+* - `cancel_booking`: declared `idempotent`, so the coordinator re-executes without consulting
+*   this policy; if ever asked, the bookingRef contract makes `SafeToRetry` honest.
+* - anything else: fail-closed `Uncertain` (AGENTS rule 11).
+*/
+const TravelSupplierReconcilerLayer = Layer.effect(ToolReconciler, Effect.gen(function* () {
+	const desk = yield* SupplierBookingDesk;
+	return ToolReconciler.of({ reconcile: (evidence) => Effect.gen(function* () {
+		switch (evidence.toolName) {
+			case "book_flight": {
+				const key = bookFlightIdempotencyKey(evidence.toolCallId);
+				const booking = yield* desk.lookup(key);
+				if (Option.isSome(booking) && booking.value.status === "confirmed") {
+					const confirmation = yield* encodeConfirmation(SupplierBookingConfirmation.make({
+						bookingRef: booking.value.bookingRef,
+						status: "confirmed",
+						detail: booking.value.detail
+					})).pipe(Effect.flatMap(decodePersistedJson));
+					return ReconciliationCompleted.make({
+						result: confirmation,
+						isFailure: false
+					});
+				}
+				return ReconciliationUncertain.make({ reason: `The supplier desk shows no confirmed booking under ${key}; a write may still be in flight.` });
+			}
+			case "book_itinerary": return ReconciliationSafeToRetry.make();
+			case "cancel_booking": return ReconciliationSafeToRetry.make();
+			default: return ReconciliationUncertain.make({ reason: `No supplier reconciliation exists for ${evidence.toolName}.` });
+		}
+	}).pipe(Effect.mapError((error) => ToolReconcilerError.make({
+		toolCallId: evidence.toolCallId,
+		message: `Supplier reconciliation failed: ${error.message}`
+	}))) });
+}));
+/**
+* The cumulative Travel Planner, Phase 5: the durable planner now performs consequential
+* supplier mutation under the full uncertainty protocol — approval-gated uncertain booking,
+* idempotent-by-contract cancellation, and one Durable Tool whose Steps carry supplier
+* idempotency keys.
+*/
+const TravelPlannerPhase5 = Agent.define("travel-planner-phase-5", {
+	input: TripRequest,
+	output: TravelBookingReport,
+	instructions: [
+		"You are the Effect Agent Travel Planner P5 booking fixture.",
+		"Search with the read-only tools, then book with book_flight, book_itinerary, or",
+		"cancel_booking exactly as scripted. Every consequential mutation is approval-gated",
+		"or Step-structured. Return only a JSON object with summary and bookingRefs."
+	].join(" "),
+	toolkit: TravelPlannerPhase5Toolkit,
+	policy: AgentPolicy.make({
+		maxTurns: 4,
+		maxToolCalls: 6,
+		maxDuration: "30 seconds",
+		toolConcurrency: 2
+	}),
+	description: "Durably book one itinerary with prepared/settled supplier records, Unknown Outcomes, named Steps, and joined traveler input.",
+	metadata: {
+		deploymentClass: "DN",
+		phase: "P5"
+	}
+});
+var TravelPlannerBookingEvidenceError = class extends Schema.TaggedErrorClass()("TravelPlannerBookingEvidenceError", { message: Schema.String }) {};
+const bookingResultRefs = (result) => {
+	if (typeof result !== "object" || result === null) return [];
+	const refs = [];
+	for (const [field, value] of Object.entries(result)) if (typeof value === "string" && (field === "bookingRef" || field === "flightBookingRef" || field === "lodgingBookingRef" || field === "confirmationCode")) refs.push(value);
+	return refs;
+};
+const bookingToolNames = /* @__PURE__ */ new Set([
+	"book_flight",
+	"cancel_booking",
+	"book_itinerary"
+]);
+/**
+* Never-fabricate assertion (ROADMAP P5 exit gate): every successfully settled booking result in
+* canonical history must reference a booking that actually exists in the supplier store. A
+* `ToolCallSettled` whose bookingRef the supplier cannot produce would be a fabricated result —
+* the exact lie the uncertainty protocol exists to prevent.
+*/
+const assertSettledBookingsExistAtSupplier = Effect.fn("TravelPlannerPhase5.assertSettledBookingsExistAtSupplier")(function* (records) {
+	const bookings = yield* (yield* SupplierBookingDesk).bookings;
+	const knownRefs = new Set(bookings.map((booking) => booking.bookingRef));
+	for (const envelope of records) {
+		const payload = envelope.record.payload;
+		if (payload._tag !== "ToolCallSettled" || payload.isFailure || !bookingToolNames.has(payload.toolName)) continue;
+		for (const ref of bookingResultRefs(payload.result)) if (!knownRefs.has(ref)) return yield* TravelPlannerBookingEvidenceError.make({ message: `Canonical record ${envelope.record.recordId} settled bookingRef ${ref}, which the supplier store cannot produce — a fabricated result.` });
+	}
+});
+/**
+* Everything a durable P5 worker needs beyond the runtime stack and the supplier desk: the
+* booking toolkit plus the deterministic P1 travel-service Layers. `SupplierBookingDesk` is
+* deliberately NOT provided here — tests own the desk's lifetime so its counters, bookings, and
+* crash windows survive Tool-Layer rebuilds across Attempts.
+*/
+const phase5TravelPlannerWorkerLayer = Layer.mergeAll(TravelPlannerPhase5ToolkitLayer, FlightCatalogLayer, LodgingCatalogLayer, ActivityCatalogLayer).pipe(Layer.provide(CatalogLifecycle.layerNoDeps));
+//#endregion
+//#region src/fixtures/travel-planner/subagents.ts
+var DestinationQuery = class extends Schema.Class("DestinationQuery")({ destination: AirportCode }) {};
+var DestinationFacts = class extends Schema.Class("DestinationFacts")({
+	destination: AirportCode,
+	highlights: Schema.Array(Schema.String),
+	advisory: Schema.NonEmptyString
+}) {};
+var DestinationGuideUnavailable = class extends Schema.TaggedErrorClass()("DestinationGuideUnavailable", {
+	destination: AirportCode,
+	message: Schema.String
+}) {};
+var DestinationGuide = class extends Context.Service()("@effect-agent/testing/travel-planner/DestinationGuide") {};
+const LookupDestination = Tool.make("lookup_destination", {
+	parameters: DestinationQuery,
+	success: DestinationFacts,
+	failure: DestinationGuideUnavailable,
+	failureMode: "error",
+	dependencies: [DestinationGuide]
+});
+const DestinationResearcherToolkit = Toolkit.make(LookupDestination);
+const DestinationResearcherToolkitLayer = DestinationResearcherToolkit.toLayer({ lookup_destination: (query) => Effect.flatMap(DestinationGuide, (guide) => guide.lookup(query)) });
+var DestinationBrief = class extends Schema.Class("DestinationBrief")({
+	destination: AirportCode,
+	focus: Schema.NonEmptyString
+}) {};
+var DestinationReport = class extends Schema.Class("DestinationReport")({
+	destination: AirportCode,
+	highlights: Schema.Array(Schema.String),
+	advisory: Schema.NonEmptyString
+}) {};
+const DestinationResearcher = Agent.define("destination-researcher", {
+	input: DestinationBrief,
+	output: DestinationReport,
+	instructions: "Consult lookup_destination exactly once for the briefed airport, then return only a JSON destination report.",
+	toolkit: DestinationResearcherToolkit,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 1,
+		maxDuration: "30 seconds",
+		toolConcurrency: 1
+	}),
+	description: "Research one candidate destination with the deterministic travel guide.",
+	metadata: {
+		deploymentClass: "E",
+		phase: "S1"
+	}
+});
+const decodeAirportCode = Schema.decodeSync(AirportCode);
+const guideFacts = /* @__PURE__ */ new Map([["LHR", DestinationFacts.make({
+	destination: decodeAirportCode("LHR"),
+	highlights: ["Barbican brutalism walk", "Kew glasshouse survey"],
+	advisory: "London favors museum mornings and riverside evenings."
+})], ["CDG", DestinationFacts.make({
+	destination: decodeAirportCode("CDG"),
+	highlights: ["Marais passage crawl", "Seine bookstall loop"],
+	advisory: "Paris rewards early galleries and late cafes."
+})]]);
+/** Deterministic guide lookup shared by the default and test-local guide Layers. */
+const destinationLookup = (query) => {
+	const facts = guideFacts.get(query.destination);
+	return facts === void 0 ? Effect.fail(DestinationGuideUnavailable.make({
+		destination: query.destination,
+		message: "No deterministic guide entry exists for this destination."
+	})) : Effect.succeed(facts);
+};
+const requireDestinationFacts = (destination) => {
+	const facts = guideFacts.get(destination);
+	if (facts === void 0) throw new Error(`No deterministic guide entry exists for destination ${destination}`);
+	return facts;
+};
+/** The report the scripted researcher writes after consulting the guide. */
+const destinationReportFor = (destination) => {
+	const facts = requireDestinationFacts(destination);
+	return DestinationReport.make({
+		destination: facts.destination,
+		highlights: facts.highlights,
+		advisory: facts.advisory
+	});
+};
+const encodedDestinationReport = (destination) => JSON.stringify(Schema.encodeSync(DestinationReport)(destinationReportFor(destination)));
+const DestinationGuideLayer = Layer.effect(DestinationGuide, Effect.gen(function* () {
+	const lifecycle = yield* CatalogLifecycle;
+	yield* Effect.acquireRelease(lifecycle.markAcquired, () => lifecycle.markFinalized);
+	return DestinationGuide.of({ lookup: destinationLookup });
+}));
+/** Child-side construction requirements of the delegation handler Layer. */
+const DestinationResearchSupportLayer = Layer.mergeAll(DestinationResearcherToolkitLayer, DestinationGuideLayer);
+var DestinationResearchRequest = class extends Schema.Class("DestinationResearchRequest")({
+	destination: AirportCode,
+	focus: Schema.NonEmptyString
+}) {};
+var DestinationResearchFindings = class extends Schema.Class("DestinationResearchFindings")({
+	destination: AirportCode,
+	summary: Schema.NonEmptyString
+}) {};
+var DestinationResearchFailed = class extends Schema.TaggedErrorClass()("DestinationResearchFailed", { childErrorTag: Schema.NonEmptyString }) {};
+/**
+* Deterministic delegation-admission choreography seam. `prepareInput` awaits
+* this gate before the handler reserves budget or spawns, so tests can order
+* concurrent delegation preflights without sleeps. It also keeps the
+* projection's construction requirements honestly visible in the handler
+* Layer's `R` (spec/subagents.md §4.1). The open Layer never waits.
+*/
+var ResearchDispatchGate = class ResearchDispatchGate extends Context.Service()("@effect-agent/testing/travel-planner/ResearchDispatchGate") {
+	static layerOpen = Layer.succeed(this, ResearchDispatchGate.of({ awaitDispatch: () => Effect.void }));
+};
+/**
+* Finite per-invocation bounds (SUB-009): each child may use two Turns and
+* one Tool Call; the parent Run may establish at most two children with at
+* most two running concurrently.
+*/
+const destinationResearchPolicy = SubagentPolicy.make({
+	maxChildren: 2,
+	maxConcurrency: 2,
+	maxTurns: 2,
+	maxToolCalls: 1,
+	maxDuration: "10 seconds"
+});
+const destinationResearchDelegation = Subagent.define("delegate_destination_research", {
+	description: "Research one candidate destination with the deterministic travel guide and return a bounded finding.",
+	target: DestinationResearcher,
+	parameters: DestinationResearchRequest,
+	success: DestinationResearchFindings,
+	failure: DestinationResearchFailed,
+	prepareInput: (request) => Effect.gen(function* () {
+		yield* (yield* ResearchDispatchGate).awaitDispatch(request.destination);
+		return DestinationBrief.make({
+			destination: request.destination,
+			focus: `research:${request.focus}`
+		});
+	}),
+	projectResult: (report) => Effect.succeed(DestinationResearchFindings.make({
+		destination: report.destination,
+		summary: report.advisory
+	})),
+	policy: destinationResearchPolicy
+});
+/** Total mapping from every expected child Run failure to the declared Tool failure (SUB-028). */
+const mapResearchChildFailure = (failure) => DestinationResearchFailed.make({ childErrorTag: failure._tag });
+/** Runtime wiring: pair the immutable delegation with one explicit child Binding. */
+const destinationResearchHandlersLayer = (childBinding) => SubagentRuntime.layer(destinationResearchDelegation, childBinding, { mapChildFailure: mapResearchChildFailure });
+var ResearchMission = class extends Schema.Class("ResearchMission")({
+	request: Schema.NonEmptyString,
+	candidates: Schema.Array(AirportCode).check(Schema.isMinLength(1))
+}) {};
+var DestinationRecommendation = class extends Schema.Class("DestinationRecommendation")({
+	destination: AirportCode,
+	summary: Schema.NonEmptyString
+}) {};
+var DestinationShortlist = class extends Schema.Class("DestinationShortlist")({
+	recommendations: Schema.Array(DestinationRecommendation),
+	nextAction: Schema.Literal("review")
+}) {};
+/** Parent-only transcript markers used to prove child context isolation (SUB-006/015). */
+const coordinatorConfidentialMarker = "coordinator-vault-7q42";
+const missionConfidentialMarker = "traveler-dossier-19f";
+const TravelCoordinatorToolkit = Toolkit.make(destinationResearchDelegation.tool);
+const TravelCoordinator = Agent.define("travel-coordinator", {
+	input: ResearchMission,
+	output: DestinationShortlist,
+	instructions: [
+		"You are the Effect Agent Travel Planner S1 delegation coordinator.",
+		`Coordinator-only context: ${coordinatorConfidentialMarker}.`,
+		"Call delegate_destination_research once per candidate in one Tool batch.",
+		"Return only a JSON shortlist built from the delegated findings. This is read-only planning."
+	].join("\n"),
+	toolkit: TravelCoordinatorToolkit,
+	policy: AgentPolicy.make({
+		maxTurns: 2,
+		maxToolCalls: 3,
+		maxDuration: "30 seconds",
+		toolConcurrency: 3
+	}),
+	description: "Coordinate bounded destination research through one declared attached delegation Tool.",
+	metadata: {
+		deploymentClass: "E",
+		phase: "S1"
+	}
+});
+const researchMission = Schema.decodeSync(ResearchMission)({
+	request: `Shortlist one September culture city; keep ${missionConfidentialMarker} inside the coordinator conversation.`,
+	candidates: ["LHR", "CDG"]
+});
+const expectedDestinationShortlist = DestinationShortlist.make({
+	recommendations: researchMission.candidates.map((destination) => DestinationRecommendation.make({
+		destination,
+		summary: requireDestinationFacts(destination).advisory
+	})),
+	nextAction: "review"
+});
+const scriptedUsage$2 = {
+	inputTokens: { total: 96 },
+	outputTokens: { total: 64 }
+};
+/** One coordinator Turn that declares the given delegation Tool Calls in order. */
+const coordinatorResearchTurn = (calls) => ({
+	_tag: "Stream",
+	parts: [...calls.map((call) => ({
+		type: "tool-call",
+		id: call.id,
+		name: "delegate_destination_research",
+		params: {
+			destination: call.destination,
+			focus: call.focus
+		}
+	})), {
+		type: "finish",
+		reason: "tool-calls",
+		usage: scriptedUsage$2
+	}],
+	termination: { _tag: "Complete" }
+});
+/** The coordinator's final structured-output Turn. */
+const coordinatorShortlistTurn = (shortlist) => ({
+	_tag: "Stream",
+	parts: [
+		{
+			type: "text-start",
+			id: "shortlist"
+		},
+		{
+			type: "text-delta",
+			id: "shortlist",
+			delta: JSON.stringify(Schema.encodeSync(DestinationShortlist)(shortlist))
+		},
+		{
+			type: "text-end",
+			id: "shortlist"
+		},
+		{
+			type: "finish",
+			reason: "stop",
+			usage: scriptedUsage$2
+		}
+	],
+	termination: { _tag: "Complete" }
+});
+/** Static researcher script for single-child tests: one guide lookup, then the report. */
+const researcherHappyPathTurns = (destination) => [{
+	_tag: "Stream",
+	parts: [{
+		type: "tool-call",
+		id: `lookup-${destination}`,
+		name: "lookup_destination",
+		params: { destination }
+	}, {
+		type: "finish",
+		reason: "tool-calls",
+		usage: scriptedUsage$2
+	}],
+	termination: { _tag: "Complete" }
+}, {
+	_tag: "Stream",
+	parts: [
+		{
+			type: "text-start",
+			id: "destination-report"
+		},
+		{
+			type: "text-delta",
+			id: "destination-report",
+			delta: encodedDestinationReport(destination)
+		},
+		{
+			type: "text-end",
+			id: "destination-report"
+		},
+		{
+			type: "finish",
+			reason: "stop",
+			usage: scriptedUsage$2
+		}
+	],
+	termination: { _tag: "Complete" }
+}];
+const researcherLookupParts$2 = (destination) => [{
+	type: "tool-call",
+	id: `lookup-${destination}`,
+	name: "lookup_destination",
+	params: { destination },
+	providerExecuted: false
+}, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: scriptedUsage$2
+}];
+const researcherReportParts$2 = (destination) => [
+	{
+		type: "text-start",
+		id: "destination-report"
+	},
+	{
+		type: "text-delta",
+		id: "destination-report",
+		delta: encodedDestinationReport(destination)
+	},
+	{
+		type: "text-end",
+		id: "destination-report"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage$2
+	}
+];
+/**
+* Build a deterministic researcher Model whose per-child behavior is keyed by
+* the destination named in the child's own prompt: Turn one records the
+* prompt, signals `started`, and calls the guide Tool; Turn two waits for the
+* caller's `release` before writing the report. Each child Run builds the
+* Model Layer inside its own scope, so one `CatalogLifecycle` acquisition and
+* finalization is observed per child — the same acquire/release counting the
+* catalog Layers use to prove interruption reaches every finalizer.
+*/
+const makeDestinationResearcherModel = (destinations) => Effect.gen(function* () {
+	const lifecycle = yield* CatalogLifecycle;
+	const prompts = yield* Ref.make([]);
+	const gates = /* @__PURE__ */ new Map();
+	for (const destination of destinations) gates.set(destination, {
+		started: yield* Deferred.make(),
+		release: yield* Deferred.make()
+	});
+	const gatesFor = (destination) => Effect.suspend(() => {
+		const entry = gates.get(destination);
+		return entry === void 0 ? Effect.die(/* @__PURE__ */ new Error(`No researcher gates exist for destination ${destination}`)) : Effect.succeed(entry);
+	});
+	return {
+		controls: {
+			awaitStarted: (destination) => gatesFor(destination).pipe(Effect.flatMap((entry) => Deferred.await(entry.started))),
+			release: (destination) => gatesFor(destination).pipe(Effect.flatMap((entry) => Deferred.succeed(entry.release, void 0)), Effect.asVoid),
+			prompts: Ref.get(prompts)
+		},
+		model: Model.make("scripted", "destination-researcher-scripted", Layer.effect(LanguageModel.LanguageModel, Effect.gen(function* () {
+			yield* Effect.acquireRelease(lifecycle.markAcquired, () => lifecycle.markFinalized);
+			const turn = yield* Ref.make(0);
+			return yield* LanguageModel.make({
+				generateText: () => Effect.succeed([]),
+				streamText: (options) => Stream.unwrap(Effect.gen(function* () {
+					const promptJson = JSON.stringify(options.prompt.content);
+					const destination = destinations.find((candidate) => promptJson.includes(candidate));
+					if (destination === void 0) return yield* Effect.die(/* @__PURE__ */ new Error("The researcher prompt names no scripted destination"));
+					const entry = yield* gatesFor(destination);
+					if ((yield* Ref.getAndUpdate(turn, (value) => value + 1)) === 0) {
+						yield* Ref.update(prompts, (previous) => [...previous, promptJson]);
+						yield* Deferred.succeed(entry.started, void 0);
+						return Stream.fromIterable(researcherLookupParts$2(destination));
+					}
+					yield* Deferred.await(entry.release);
+					return Stream.fromIterable(researcherReportParts$2(destination));
+				}))
+			});
+		})))
+	};
+});
+//#endregion
+//#region src/fixtures/travel-planner/subagents-durable.ts
+var TravelPlannerSubagentDurabilityProfile = class extends Schema.Class("@effect-agent/testing/travel-planner/TravelPlannerSubagentDurabilityProfile")({
+	deploymentClass: Schema.Literal("DN"),
+	durableAttachedSubagents: Schema.Literal(true),
+	canonicalSchemaVersion: Schema.Literal(1),
+	/** Establishment/join replay converges on one child Receipt, Conversation, and join batch. */
+	subagentReplaySafe: Schema.Literal(true),
+	/** Never claimed (rule 8): child ordinary Tools stop at Unknown Outcomes, they do not replay. */
+	childExternalEffectsExactlyOnce: Schema.Literal(false),
+	/** The same conformance suite under DO eviction/alarms is P6 scope (spec §17 `DC`). */
+	cloudflareEquivalence: Schema.Literal(false)
+}) {};
+const s2TravelPlannerProfile = TravelPlannerSubagentDurabilityProfile.make({
+	deploymentClass: "DN",
+	durableAttachedSubagents: true,
+	canonicalSchemaVersion: 1,
+	subagentReplaySafe: true,
+	childExternalEffectsExactlyOnce: false,
+	cloudflareEquivalence: false
+});
+const s2TravelPlannerDeploymentId = Schema.decodeSync(DeploymentId)("travel-planner-s2-deployment");
+const s2TravelPlannerProducerId = Schema.decodeSync(ProducerId)("travel-planner-s2-producer");
+const s2TravelPlannerPrincipal = Schema.decodeSync(Principal)("travel-planner-s2-principal");
+const digestOf$1 = (character) => Schema.decodeSync(Digest)(character.repeat(64));
+/** Redacted, deterministic parent (coordinator) definition digests for this fixture version. */
+const s2CoordinatorDigests = DefinitionDigests.make({
+	agent: digestOf$1("a"),
+	model: digestOf$1("b"),
+	tools: digestOf$1("c")
+});
+/**
+* The exact child Binding digest strings the application declares on
+* `SubagentRuntimeOptions.durable.targetDigests` AND the host registers with
+* the `AgentBindingResolver` for the researcher Binding. The coordinator
+* stores and verifies them byte-for-byte (SUB-023); a host registration under
+* different strings is a `ChildCompatibilityFailure`, never a substitution.
+*/
+const s2ResearcherDigestStrings = {
+	agent: "d".repeat(64),
+	model: "e".repeat(64),
+	tools: "f".repeat(64)
+};
+const s2ResearcherDigests = DefinitionDigests.make({
+	agent: Schema.decodeSync(Digest)(s2ResearcherDigestStrings.agent),
+	model: Schema.decodeSync(Digest)(s2ResearcherDigestStrings.model),
+	tools: Schema.decodeSync(Digest)(s2ResearcherDigestStrings.tools)
+});
+/** Durable admission options for one coordinator Submission on one mission lane. */
+const s2TravelPlannerSubmitOptions = (conversationId, idempotencyKey) => ({
+	conversationId,
+	principal: s2TravelPlannerPrincipal,
+	idempotencyKey,
+	definitions: s2CoordinatorDigests
+});
+/** The structural submit slice of the coordinator Binding (`DurableAgentRuntime.submit`). */
+const s2CoordinatorSubmitAgent = { definition: {
+	id: TravelCoordinator.id,
+	input: TravelCoordinator.input
+} };
+/**
+* The per-invocation reservation the durable handler computes from the S1
+* delegation policy (`delegationAllocationFromPolicy`): the conservation
+* evidence in the S2 tests checks the ledger reservation rows and the
+* canonical `SubagentJoined.finalAccounting` against exactly this value.
+*/
+const durableResearchAllocation = delegationAllocationFromPolicy(destinationResearchPolicy);
+/** The one scripted delegation Tool Call id of the durable coordinator Run. */
+const durableResearchCallId = "research-lhr-1";
+/** The child's own scripted guide-lookup Tool Call id. */
+const durableChildLookupCallId = (destination) => `lookup-${destination}`;
+/** The projected finding the parent joins (only the advisory crosses, SUB-015). */
+const durableResearchFinding = (destination) => ({
+	destination: destinationReportFor(destination).destination,
+	summary: destinationReportFor(destination).advisory
+});
+/** The coordinator's expected final shortlist for one researched destination. */
+const durableResearchShortlist = (destination) => DestinationShortlist.make({
+	recommendations: [DestinationRecommendation.make({
+		destination: destinationReportFor(destination).destination,
+		summary: destinationReportFor(destination).advisory
+	})],
+	nextAction: "review"
+});
+/**
+* The deterministic guide facts in encoded (wire) form: the "supplier truth"
+* an authorized operator records through `resolveUnknown` when a child guide
+* lookup stopped at an Unknown Outcome (DUR-017 — the framework never guesses
+* or replays it).
+*/
+const encodedDestinationFacts = (destination) => {
+	const report = destinationReportFor(destination);
+	return Schema.encodeSync(DestinationFacts)(DestinationFacts.make({
+		destination: report.destination,
+		highlights: report.highlights,
+		advisory: report.advisory
+	}));
+};
+const scriptedUsage$1 = {
+	inputTokens: { total: 96 },
+	outputTokens: { total: 64 }
+};
+/** One scripted model whose behavior is keyed by the global invocation index. */
+const makeInvocationCountingModel = (name, script) => Effect.gen(function* () {
+	const calls = yield* Ref.make(0);
+	const prompts = yield* Ref.make([]);
+	return {
+		model: Model.make("scripted", name, Layer.effect(LanguageModel.LanguageModel, LanguageModel.make({
+			generateText: () => Effect.succeed([]),
+			streamText: (request) => Stream.unwrap(Effect.gen(function* () {
+				const call = yield* Ref.getAndUpdate(calls, (value) => value + 1);
+				yield* Ref.update(prompts, (previous) => [...previous, JSON.stringify(request.prompt.content)]);
+				return Stream.fromIterable(script(call));
+			}))
+		}))),
+		calls: Ref.get(calls),
+		prompts: Ref.get(prompts)
+	};
+});
+const delegationTurnParts = (toolCallId, destination, focus) => [{
+	type: "tool-call",
+	id: toolCallId,
+	name: "delegate_destination_research",
+	params: {
+		destination,
+		focus
+	},
+	providerExecuted: false
+}, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: scriptedUsage$1
+}];
+const shortlistParts = (shortlist) => [
+	{
+		type: "text-start",
+		id: "shortlist"
+	},
+	{
+		type: "text-delta",
+		id: "shortlist",
+		delta: JSON.stringify(Schema.encodeSync(DestinationShortlist)(shortlist))
+	},
+	{
+		type: "text-end",
+		id: "shortlist"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage$1
+	}
+];
+const researcherLookupParts$1 = (destination) => [{
+	type: "tool-call",
+	id: durableChildLookupCallId(destination),
+	name: "lookup_destination",
+	params: { destination },
+	providerExecuted: false
+}, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: scriptedUsage$1
+}];
+const researcherReportParts$1 = (destination) => [
+	{
+		type: "text-start",
+		id: "destination-report"
+	},
+	{
+		type: "text-delta",
+		id: "destination-report",
+		delta: encodedDestinationReport(destination)
+	},
+	{
+		type: "text-end",
+		id: "destination-report"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage$1
+	}
+];
+/** Runtime wiring for the durable slice: the S1 delegation plus the S2 digest declaration. */
+const durableDestinationResearchHandlersLayer = (childBinding) => SubagentRuntime.layer(destinationResearchDelegation, childBinding, {
+	mapChildFailure: mapResearchChildFailure,
+	durable: { targetDigests: s2ResearcherDigestStrings }
+});
+/**
+* Build the S2 Travel Planner harness: an invocation-counting scripted
+* coordinator (Turn 1 declares the one delegation call, Turn 2 writes the
+* shortlist), an invocation-counting scripted researcher (Turn 1 consults the
+* guide, Turn 2 writes the report), and both worker Bindings captured with
+* their requirement Contexts via `DurableWorkerBinding.make` under the exact
+* fixture digests. The returned `bindings` are plain values: they can be
+* registered with several `NodeDurableRuntime` stacks over the same SQLite
+* file while the counters keep counting across all of them.
+*/
+const makeDurableResearchHarness = (options) => Effect.gen(function* () {
+	const destination = options?.destination ?? "LHR";
+	const focus = options?.focus ?? "museums";
+	const guideInvocations = yield* Ref.make(0);
+	const guideLayer = Layer.succeed(DestinationGuide, DestinationGuide.of({ lookup: (query) => Ref.update(guideInvocations, (count) => count + 1).pipe(Effect.andThen(destinationLookup(query))) }));
+	const childToolkitLayer = DestinationResearcherToolkitLayer.pipe(Layer.provideMerge(guideLayer));
+	const childModel = yield* makeInvocationCountingModel("destination-researcher-s2", (call) => call === 0 ? researcherLookupParts$1(destination) : researcherReportParts$1(destination));
+	const childBinding = Agent.withModel(DestinationResearcher, childModel.model);
+	const parentModel = yield* makeInvocationCountingModel("travel-coordinator-s2", (call) => call === 0 ? delegationTurnParts(durableResearchCallId, destination, focus) : shortlistParts(durableResearchShortlist(destination)));
+	const parentBinding = Agent.withModel(TravelCoordinator, parentModel.model);
+	const delegationLayer = durableDestinationResearchHandlersLayer(childBinding).pipe(Layer.provide(Layer.mergeAll(childToolkitLayer, SubagentReservationsMemoryLive, DeterministicIdGeneratorLayer, ResearchDispatchGate.layerOpen)));
+	return {
+		bindings: [yield* DurableWorkerBinding.make(parentBinding, s2CoordinatorDigests).pipe(Effect.provide(delegationLayer)), yield* DurableWorkerBinding.make(childBinding, options?.childRegistrationDigests ?? s2ResearcherDigests).pipe(Effect.provide(childToolkitLayer))],
+		parentModelCalls: parentModel.calls,
+		parentPrompts: parentModel.prompts,
+		childModelCalls: childModel.calls,
+		childPrompts: childModel.prompts,
+		guideInvocations: Ref.get(guideInvocations)
+	};
+});
+//#endregion
+//#region src/fixtures/travel-planner/phase6.ts
+/**
+* The Phase 6 profile: the P4/P5/S2 Travel Planner claims re-earned on the Cloudflare Durable
+* Object runtime (deployment class `DC`), where eviction and alarm redelivery replace process
+* kill and restart as the exercised recovery path. `cloudflareEquivalence` is the claim the S2
+* fixture explicitly deferred to P6 (`TravelPlannerSubagentDurabilityProfile` pins it `false`
+* for `DN`): it flips to `true` here ONLY because the phase-6 suites assert byte-equal
+* cross-platform normalized canonical evidence against one committed golden. Exactly-once
+* EXTERNAL effects remain — deliberately — unclaimed on every platform (DUR-003).
+*/
+var TravelPlannerCloudflareProfile = class extends Schema.Class("@effect-agent/testing/travel-planner/TravelPlannerCloudflareProfile")({
+	deploymentClass: Schema.Literal("DC"),
+	durableAcceptedWork: Schema.Literal(true),
+	canonicalSchemaVersion: Schema.Literal(1),
+	/** P5 semantics under DC recovery: prepared/settled records, Unknown Outcomes, approvals. */
+	supplierBookingUncertaintyProtocol: Schema.Literal(true),
+	/** S2 semantics under DC recovery: cross-Object establishment/join, completed child never re-runs. */
+	durableAttachedSubagents: Schema.Literal(true),
+	/** DN and DC produce byte-equal cross-platform normalized canonical evidence (one golden). */
+	cloudflareEquivalence: Schema.Literal(true),
+	/** Never claimed at any phase on any platform (DUR-003). */
+	exactlyOnceExternalEffects: Schema.Literal(false)
+}) {};
+const phase6TravelPlannerProfile = TravelPlannerCloudflareProfile.make({
+	deploymentClass: "DC",
+	durableAcceptedWork: true,
+	canonicalSchemaVersion: 1,
+	supplierBookingUncertaintyProtocol: true,
+	durableAttachedSubagents: true,
+	cloudflareEquivalence: true,
+	exactlyOnceExternalEffects: false
+});
+const phase6TravelPlannerDeploymentId = Schema.decodeSync(DeploymentId)("travel-planner-p6-deployment");
+/** Producer prefix of the DC host; each Object mints `{prefix}:{conversationId}`. */
+const phase6TravelPlannerProducerPrefix = "travel-planner-p6-producer";
+/** The full producer identity one DC Conversation Object mints for itself. */
+const phase6TravelPlannerProducerId = (conversationId) => Schema.decodeSync(ProducerId)(`${phase6TravelPlannerProducerPrefix}:${conversationId}`);
+const digestOf = (character) => Schema.decodeSync(Digest)(character.repeat(64));
+/**
+* Registration digests of the GATED planner Binding: the same `TravelPlannerPhase4` definition
+* bound to a model whose first response waits on a test gate, addressable separately so the
+* admission-limits rows can hold a lane busy deterministically without touching the ordinary
+* planner registration.
+*/
+const phase6GatedPlannerDefinitionDigests = DefinitionDigests.make({
+	agent: digestOf("9"),
+	model: digestOf("8"),
+	tools: digestOf("7")
+});
+const decodeComparableJson = Schema.decodeUnknownEffect(Schema.Json);
+/** The base normal form's element shape, re-decoded so sequences can be renumbered. */
+const ComparableEnvelope = Schema.Struct({
+	batchId: Schema.String,
+	sequence: Schema.Number,
+	record: Schema.Json
+});
+const decodeComparableEnvelopes = Schema.decodeUnknownEffect(Schema.Array(ComparableEnvelope));
+/**
+* The CROSS-PLATFORM extension of `normalizeDurableTravelPlannerEvidence` (D-P6-6): after the
+* base normalization replaces the two ledger-minted identities (which also normalizes the
+* DC-format routable `{uuidv7}:{conversationId}` Submission identities and everything derived
+* from them), this form additionally scrubs everything that legitimately differs between a DN
+* process and a DC Durable Object over the same scenario:
+*
+* - `RepairAnnotated` audit records are dropped BEFORE normalization and the canonical
+*   sequence is renumbered to the surviving order: repairs are DUR-013 evidence of recovery
+*   itself, legally present in a recovered run and legally absent from an uninterrupted
+*   control (on DC even a CLEAN run carries one, because every pass reconciles before it
+*   claims, so the ready lane's input is applied through the recovery path). Canonical ORDER
+*   is the durability §5 claim; sequence contiguity is a platform artifact of who appended;
+* - the Conversation identity (DC lanes mint unique names per test run);
+* - the deployment and producer identities (host configuration, not canonical semantics);
+* - `createdAt` commit timestamps (wall clock);
+* - 64-hex digests (they hash RAW content that legally embeds run-specific identity, so they
+*   can never be byte-equal across runs; chain integrity is asserted separately by the
+*   adapters and the convergence helpers).
+*
+* Two runs whose cross-platform normalized evidence is byte-equal took canonically equivalent
+* histories — the exact sense in which durability §5 permits storage differences while
+* requiring the same observable ordering. Both the DN and DC suites assert equality against
+* the one committed `phase6TravelPlannerGoldenEvidence`, so DN ≡ DC transitively.
+*/
+const normalizeCrossPlatformTravelPlannerEvidence = Effect.fn("TravelPlannerPhase6.normalizeCrossPlatformTravelPlannerEvidence")(function* (records, receipt, identity) {
+	const base = yield* normalizeDurableTravelPlannerEvidence(records.filter((envelope) => envelope.record.payload._tag !== "RepairAnnotated"), receipt);
+	const scrubbed = JSON.parse(JSON.stringify(base).replaceAll(identity.producerId, "{producerId}").replaceAll(identity.deploymentId, "{deploymentId}").replaceAll(identity.conversationId, "{conversationId}").replaceAll(/\d{4}-\d{2}-\d{2}T[0-9:.]+Z/g, "{timestamp}").replaceAll(/"[0-9a-f]{64}"/g, "\"{digest}\""));
+	const renumbered = (yield* decodeComparableEnvelopes(scrubbed).pipe(Effect.mapError((error) => TravelPlannerDurableEvidenceError.make({ message: `Cross-platform normalized evidence lost the comparable shape: ${error.message}` })))).map((entry, index) => ({
+		batchId: entry.batchId,
+		sequence: index + 1,
+		record: entry.record
+	}));
+	return yield* decodeComparableJson(renumbered).pipe(Effect.mapError((error) => TravelPlannerDurableEvidenceError.make({ message: `Cross-platform normalized evidence is not comparable JSON: ${error.message}` })));
+});
+const scriptedUsage = {
+	inputTokens: { total: 128 },
+	outputTokens: { total: 96 }
+};
+const promptAwareModel = (name, decide) => Model.make("scripted", name, Layer.effect(LanguageModel.LanguageModel, LanguageModel.make({
+	generateText: () => Effect.succeed([]),
+	streamText: (options) => Stream.unwrap(Effect.sync(() => decide(JSON.stringify(options.prompt))))
+})));
+/** The P1/P4 happy-path Tool Call identities (scenarios.ts, byte-stable since P1). */
+const phase6FlightCallId = "flight-call-1";
+const phase6LodgingCallId = "lodging-call-1";
+const phase6ActivityCallId = "activity-call-1";
+/** Turn 1 of the planner: the SAME three search declarations as `phase1HappyPathTurns`. */
+const plannerSearchTurnParts = [
+	{
+		type: "tool-call",
+		id: phase6FlightCallId,
+		name: "search_flights",
+		params: {
+			origin: "SFO",
+			destination: "LHR",
+			departOn: "2026-09-14",
+			travelers: 2
+		}
+	},
+	{
+		type: "tool-call",
+		id: phase6LodgingCallId,
+		name: "search_lodging",
+		params: {
+			destination: "LHR",
+			departOn: "2026-09-14",
+			nights: 4,
+			travelers: 2
+		}
+	},
+	{
+		type: "tool-call",
+		id: phase6ActivityCallId,
+		name: "search_activities",
+		params: {
+			destination: "LHR",
+			departOn: "2026-09-14",
+			nights: 4,
+			travelers: 2
+		}
+	},
+	{
+		type: "finish",
+		reason: "tool-calls",
+		usage: scriptedUsage
+	}
+];
+/** Turn 2 of the planner: the SAME itinerary text as `phase1HappyPathTurns`. */
+const plannerPlanTurnParts = [
+	{
+		type: "text-start",
+		id: "itinerary-json"
+	},
+	{
+		type: "text-delta",
+		id: "itinerary-json",
+		delta: JSON.stringify(Schema.encodeSync(TravelPlan)(expectedTravelPlan))
+	},
+	{
+		type: "text-end",
+		id: "itinerary-json"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage
+	}
+];
+const plannerDecide = (promptJson) => promptJson.includes("flight-call-1") ? Stream.fromIterable(plannerPlanTurnParts) : Stream.fromIterable(plannerSearchTurnParts);
+/**
+* The P4 planner script (`phase1HappyPathTurns`) as a prompt-aware model: once the search
+* batch is committed history, every later request gets the plan — identical parts, so the DC
+* canonical evidence is byte-equivalent to the DN ScriptedModel run after normalization.
+*/
+const phase6PlannerModel = promptAwareModel("travel-planner-phase-4", plannerDecide);
+const releasedPlannerGates = /* @__PURE__ */ new Set();
+/** Release the gated planner model for one `[gate:...]` marker. */
+const releasePhase6PlannerGate = (marker) => {
+	releasedPlannerGates.add(marker);
+};
+/** Re-close one gate marker (fresh suites reuse markers safely). */
+const resetPhase6PlannerGate = (marker) => {
+	releasedPlannerGates.delete(marker);
+};
+const awaitPlannerGate = (marker) => Effect.gen(function* () {
+	while (!releasedPlannerGates.has(marker)) yield* Effect.sleep(Duration.millis(10));
+});
+const gateMarkerFromPrompt = (promptJson) => /\[gate:([^\]]+)\]/.exec(promptJson)?.[1] ?? "unknown-gate";
+/** A trip whose request text carries the gate marker the gated model waits on. */
+const phase6GatedTrip = (marker) => Schema.decodeUnknownSync(TripRequest)({
+	request: `Plan a review-only London trip, but wait for the concierge. [gate:${marker}]`,
+	origin: "SFO",
+	destination: "LHR",
+	departOn: "2026-09-14",
+	nights: 4,
+	travelers: 2,
+	budgetCents: 35e4,
+	currency: "USD"
+});
+/**
+* The SAME planner behavior with a hanging first response: the model waits on the released
+* gate before answering, keeping its lane durably busy so queue-depth admission limits can be
+* exercised deterministically.
+*/
+const phase6GatedPlannerModel = Model.make("scripted", "travel-planner-phase-4-gated", Layer.effect(LanguageModel.LanguageModel, LanguageModel.make({
+	generateText: () => Effect.succeed([]),
+	streamText: (options) => Stream.unwrap(Effect.sync(() => {
+		const promptJson = JSON.stringify(options.prompt);
+		return promptJson.includes("flight-call-1") ? plannerDecide(promptJson) : Stream.fromEffectDrain(awaitPlannerGate(gateMarkerFromPrompt(promptJson))).pipe(Stream.concat(plannerDecide(promptJson)));
+	}))
+})));
+const sharedSupplierDesk = Effect.runSync(Effect.flatMap(SupplierBookingDesk, Effect.succeed).pipe(Effect.provide(SupplierBookingDesk.layer)));
+/** The shared external supplier desk instance (module-level external truth). */
+const phase6SupplierDesk = sharedSupplierDesk;
+/** Layer handing the shared desk to Bindings, reconcilers, and assertions. */
+const phase6SupplierDeskLayer = Layer.succeed(SupplierBookingDesk, sharedSupplierDesk);
+/**
+* The REAL P5 supplier reconciliation policy over the shared desk, closed to no requirements
+* so a Conversation Object can install it directly: `book_flight` recovers only from supplier
+* truth (absence stays fail-closed `Uncertain` → durable Unknown Outcome), keyed Steps are
+* provably re-enterable.
+*/
+const phase6SupplierReconcilerLayer = TravelSupplierReconcilerLayer.pipe(Layer.provide(phase6SupplierDeskLayer));
+const bookingMarkerFromPrompt = (promptJson) => /\[case:([^\]]+)\]/.exec(promptJson)?.[1] ?? "unknown-case";
+/** The deterministic booking Tool Call identity for one `[case:...]` marker. */
+const phase6BookingToolCallId = (marker) => `book-${marker}`;
+/** The bookingRef the supplier desk mints for one marker's approved booking. */
+const phase6BookingRef = (marker) => supplierBookingRefFor(bookFlightIdempotencyKey(phase6BookingToolCallId(marker)));
+/** A trip whose request text carries the per-lane booking case marker. */
+const phase6BookingTrip = (marker) => Schema.decodeUnknownSync(TripRequest)({
+	request: `Book the approved London flight for the traveler. [case:${marker}]`,
+	origin: "SFO",
+	destination: "LHR",
+	departOn: "2026-09-14",
+	nights: 4,
+	travelers: 2,
+	budgetCents: 35e4,
+	currency: "USD"
+});
+const bookingCallParts = (marker) => [{
+	type: "tool-call",
+	id: phase6BookingToolCallId(marker),
+	name: "book_flight",
+	params: {
+		quoteId: "quote-sfo-lhr-001",
+		travelerRef: `traveler-${marker}`,
+		departOn: "2026-09-14"
+	},
+	providerExecuted: false
+}, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: scriptedUsage
+}];
+const bookingReportParts = (marker) => [
+	{
+		type: "text-start",
+		id: "booking-report"
+	},
+	{
+		type: "text-delta",
+		id: "booking-report",
+		delta: JSON.stringify({
+			summary: "trip booked",
+			bookingRefs: [phase6BookingRef(marker)]
+		})
+	},
+	{
+		type: "text-end",
+		id: "booking-report"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage
+	}
+];
+/**
+* The P5 booking script as a prompt-aware model: request 1 declares the approval-gated
+* `book_flight` call (identity derived from the lane's `[case:...]` marker so supplier
+* idempotency keys never collide across lanes); once that call is committed history, the model
+* writes the booking report.
+*/
+const phase6BookingModel = promptAwareModel("travel-planner-phase-5", (promptJson) => {
+	const marker = bookingMarkerFromPrompt(promptJson);
+	return promptJson.includes(phase6BookingToolCallId(marker)) ? Stream.fromIterable(bookingReportParts(marker)) : Stream.fromIterable(bookingCallParts(marker));
+});
+let guideInvocations = 0;
+/** Deterministic guide-lookup handler executions across every incarnation. */
+const phase6GuideInvocationCount = () => guideInvocations;
+const countingGuideLayer = Layer.succeed(DestinationGuide, DestinationGuide.of({ lookup: (query) => Effect.suspend(() => {
+	guideInvocations += 1;
+	return destinationLookup(query);
+}) }));
+/** The one-candidate research mission of the DC delegation slice. */
+const phase6ResearchMission = Schema.decodeUnknownSync(ResearchMission)({
+	request: "Shortlist one September culture city for the DC delegation slice.",
+	candidates: ["LHR"]
+});
+const phase6ResearchDestination = "LHR";
+/** The child's scripted guide-lookup Tool Call identity. */
+const phase6ChildLookupCallId = `lookup-LHR`;
+const coordinatorDelegationParts = [{
+	type: "tool-call",
+	id: durableResearchCallId,
+	name: "delegate_destination_research",
+	params: {
+		destination: "LHR",
+		focus: "museums"
+	},
+	providerExecuted: false
+}, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: scriptedUsage
+}];
+const coordinatorShortlistParts = [
+	{
+		type: "text-start",
+		id: "shortlist"
+	},
+	{
+		type: "text-delta",
+		id: "shortlist",
+		delta: JSON.stringify(Schema.encodeSync(DestinationShortlist)(durableResearchShortlist("LHR")))
+	},
+	{
+		type: "text-end",
+		id: "shortlist"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage
+	}
+];
+const researcherLookupParts = [{
+	type: "tool-call",
+	id: phase6ChildLookupCallId,
+	name: "lookup_destination",
+	params: { destination: "LHR" },
+	providerExecuted: false
+}, {
+	type: "finish",
+	reason: "tool-calls",
+	usage: scriptedUsage
+}];
+const researcherReportParts = [
+	{
+		type: "text-start",
+		id: "destination-report"
+	},
+	{
+		type: "text-delta",
+		id: "destination-report",
+		delta: encodedDestinationReport("LHR")
+	},
+	{
+		type: "text-end",
+		id: "destination-report"
+	},
+	{
+		type: "finish",
+		reason: "stop",
+		usage: scriptedUsage
+	}
+];
+/** Prompt-aware S2 coordinator: delegation call first, shortlist once it is history. */
+const phase6CoordinatorModel = promptAwareModel("travel-coordinator-p6", (promptJson) => promptJson.includes("research-lhr-1") ? Stream.fromIterable(coordinatorShortlistParts) : Stream.fromIterable(coordinatorDelegationParts));
+let researcherGateReleased = false;
+/** Allow the researcher's FIRST model response to proceed (sticky across incarnations). */
+const releasePhase6ResearcherGate = () => {
+	researcherGateReleased = true;
+};
+/** Re-close the researcher gate (each delegation scenario starts gated). */
+const resetPhase6ResearcherGate = () => {
+	researcherGateReleased = false;
+};
+const awaitResearcherGate = Effect.gen(function* () {
+	while (!researcherGateReleased) yield* Effect.sleep(Duration.millis(10));
+});
+/**
+* Prompt-aware S2 researcher: guide lookup first, report once it is history. The FIRST
+* response waits on the researcher gate — a stand-in for real model latency. The child's own
+* Object may legally start its Attempt the moment its routed admission commits, while the
+* parent is still appending the lineage record into the child's log; a child whose first
+* batch commits during that window races the parent's append on one tail. Real models answer
+* in seconds, so establishment always wins that race in production; the gate reproduces that
+* timing deterministically instead of relying on scheduler luck.
+*/
+const phase6ResearcherModel = promptAwareModel("destination-researcher-p6", (promptJson) => promptJson.includes(phase6ChildLookupCallId) ? Stream.fromIterable(researcherReportParts) : Stream.fromEffectDrain(awaitResearcherGate).pipe(Stream.concat(Stream.fromIterable(researcherLookupParts))));
+/**
+* Every phase-6 Travel Planner worker Binding, captured with its requirement Contexts
+* (spec/subagents.md §11): the P4 planner and its gated twin, the P5 booking agent over the
+* shared supplier desk, and the S2 coordinator/researcher pair wired through the durable
+* delegation Layer. A Conversation Object registers these via its `bindings` option; the
+* capture runs once per incarnation, and everything stateful the assertions rely on (desk,
+* guide counter, gates) lives at module level so it survives incarnation loss.
+*/
+const makePhase6TravelPlannerBindings = Effect.gen(function* () {
+	const planner = yield* DurableWorkerBinding.make(Agent.withModel(TravelPlannerPhase4, phase6PlannerModel), phase4TravelPlannerDefinitionDigests).pipe(Effect.provide(phase4TravelPlannerWorkerLayer));
+	const gatedPlanner = yield* DurableWorkerBinding.make(Agent.withModel(TravelPlannerPhase4, phase6GatedPlannerModel), phase6GatedPlannerDefinitionDigests).pipe(Effect.provide(phase4TravelPlannerWorkerLayer));
+	const booking = yield* DurableWorkerBinding.make(Agent.withModel(TravelPlannerPhase5, phase6BookingModel), phase5TravelPlannerDefinitionDigests).pipe(Effect.provide(phase5TravelPlannerWorkerLayer.pipe(Layer.provideMerge(phase6SupplierDeskLayer))));
+	const researcherBinding = Agent.withModel(DestinationResearcher, phase6ResearcherModel);
+	const childToolkitLayer = DestinationResearcherToolkitLayer.pipe(Layer.provideMerge(countingGuideLayer));
+	return [
+		planner,
+		gatedPlanner,
+		booking,
+		yield* DurableWorkerBinding.make(Agent.withModel(TravelCoordinator, phase6CoordinatorModel), s2CoordinatorDigests).pipe(Effect.provide(durableDestinationResearchHandlersLayer(researcherBinding).pipe(Layer.provide(Layer.mergeAll(childToolkitLayer, SubagentReservationsMemoryLive, DeterministicIdGeneratorLayer, ResearchDispatchGate.layerOpen))))),
+		yield* DurableWorkerBinding.make(researcherBinding, s2ResearcherDigests).pipe(Effect.provide(childToolkitLayer))
+	];
+});
+/**
+* The committed cross-platform normalized canonical evidence of ONE uninterrupted Travel
+* Planner planning Submission (the P1/P4 happy path: canonical input, the search Turn, three
+* Tool settlements, the plan Turn, one Settlement). `travel-planner-phase6.test.ts` asserts
+* the DN run equals this value and `travel-planner-dc.test.ts` asserts the DC run equals this
+* value, so the two platforms' canonical outcomes are byte-equivalent transitively — the P6
+* exit gate "Travel Planner produces equivalent canonical outcomes under DN and DC".
+*
+* Regenerate ONLY when the Travel Planner scenario itself changes, by printing either suite's
+* normalized value; both suites must then agree on the new golden.
+*/
+const phase6TravelPlannerGoldenEvidence = [
+	{
+		batchId: "conversation-created:{conversationId}",
+		sequence: 1,
+		record: {
+			recordId: "conversation-created:{conversationId}",
+			family: "conversation",
+			schemaVersion: 1,
+			createdAt: "{timestamp}",
+			deploymentId: "{deploymentId}",
+			payload: {
+				_tag: "ConversationCreated",
+				agentId: "travel-planner-phase-4",
+				definitions: {
+					agent: "{digest}",
+					model: "{digest}",
+					tools: "{digest}"
+				}
+			}
+		}
+	},
+	{
+		batchId: "submission-input:{submissionId}",
+		sequence: 2,
+		record: {
+			recordId: "input:{submissionId}",
+			family: "conversation",
+			schemaVersion: 1,
+			createdAt: "{timestamp}",
+			deploymentId: "{deploymentId}",
+			payload: {
+				_tag: "UserInputRecorded",
+				submissionId: "{submissionId}",
+				kind: "user",
+				runId: "run:{submissionId}",
+				input: {
+					request: "Plan a review-only London trip using the deterministic flight, lodging, and activity searches.",
+					origin: "SFO",
+					destination: "LHR",
+					departOn: "2026-09-14",
+					nights: 4,
+					travelers: 2,
+					budgetCents: 35e4,
+					currency: "USD"
+				}
+			}
+		}
+	},
+	{
+		batchId: "turn-response:run:{submissionId}:1",
+		sequence: 3,
+		record: {
+			recordId: "model-response:run:{submissionId}:1",
+			family: "conversation",
+			schemaVersion: 1,
+			createdAt: "{timestamp}",
+			deploymentId: "{deploymentId}",
+			payload: {
+				_tag: "ModelResponseRecorded",
+				runId: "run:{submissionId}",
+				turnId: "turn:run:{submissionId}:1",
+				turn: 1,
+				messages: { content: [
+					{
+						options: {},
+						role: "system",
+						content: "You are the Effect Agent Travel Planner P1 interpreter fixture.\nThe user asked: Plan a review-only London trip using the deterministic flight, lodging, and activity searches.\nCall search_flights, search_lodging, and search_activities exactly once in one Tool batch.\nThen return only a JSON object of exactly this shape, no prose:\n{\"itineraries\": [{\"title\": \"<short itinerary name>\", \"route\": \"<origin-destination>\", \"dates\": \"<date range>\", \"flight\": \"<flight description from the Tool result>\", \"lodging\": \"<lodging description from the Tool result>\", \"activities\": [\"<activity>\", \"...\"], \"estimatedTotalCents\": <positive integer total in cents>, \"currency\": \"USD\", \"quoteId\": \"<quoteId from the flight Tool result>\", \"assumptions\": [\"<assumption>\", \"...\"], \"unresolvedConstraints\": [], \"nextAction\": \"review\"}]}\nUse the Tool results verbatim; activity results may legitimately be an empty array.\nThis is read-only planning. Require review before any mutation."
+					},
+					{
+						options: {},
+						role: "user",
+						content: "{\"request\":\"Plan a review-only London trip using the deterministic flight, lodging, and activity searches.\",\"origin\":\"SFO\",\"destination\":\"LHR\",\"departOn\":\"2026-09-14\",\"nights\":4,\"travelers\":2,\"budgetCents\":350000,\"currency\":\"USD\"}"
+					},
+					{
+						options: {},
+						role: "assistant",
+						content: [
+							{
+								options: {},
+								type: "tool-call",
+								id: "flight-call-1",
+								name: "search_flights",
+								params: {
+									origin: "SFO",
+									destination: "LHR",
+									departOn: "2026-09-14",
+									travelers: 2
+								},
+								providerExecuted: false
+							},
+							{
+								options: {},
+								type: "tool-call",
+								id: "lodging-call-1",
+								name: "search_lodging",
+								params: {
+									destination: "LHR",
+									departOn: "2026-09-14",
+									nights: 4,
+									travelers: 2
+								},
+								providerExecuted: false
+							},
+							{
+								options: {},
+								type: "tool-call",
+								id: "activity-call-1",
+								name: "search_activities",
+								params: {
+									destination: "LHR",
+									departOn: "2026-09-14",
+									nights: 4,
+									travelers: 2
+								},
+								providerExecuted: false
+							}
+						]
+					}
+				] },
+				messagesDigest: "{digest}"
+			}
+		}
+	},
+	{
+		batchId: "turn-results:run:{submissionId}:1",
+		sequence: 4,
+		record: {
+			recordId: "tool-settled:run:{submissionId}:1:flight-call-1",
+			family: "conversation",
+			schemaVersion: 1,
+			createdAt: "{timestamp}",
+			deploymentId: "{deploymentId}",
+			payload: {
+				_tag: "ToolCallSettled",
+				runId: "run:{submissionId}",
+				toolCallId: "flight-call-1",
+				toolName: "search_flights",
+				result: {
+					quoteId: "quote-sfo-lhr-001",
+					flight: "EA 218 · nonstop · SFO 18:40 → LHR 13:05+1",
+					estimatedCents: 18e4,
+					currency: "USD"
+				},
+				isFailure: false
+			}
+		}
+	},
+	{
+		batchId: "turn-results:run:{submissionId}:1",
+		sequence: 5,
+		record: {
+			recordId: "tool-settled:run:{submissionId}:1:lodging-call-1",
+			family: "conversation",
+			schemaVersion: 1,
+			createdAt: "{timestamp}",
+			deploymentId: "{deploymentId}",
+			payload: {
+				_tag: "ToolCallSettled",
+				runId: "run:{submissionId}",
+				toolCallId: "lodging-call-1",
+				toolName: "search_lodging",
+				result: {
+					lodging: "Bloomsbury House · refundable studio · 4 nights",
+					estimatedCents: 104e3,
+					currency: "USD"
+				},
+				isFailure: false
+			}
+		}
+	},
+	{
+		batchId: "turn-results:run:{submissionId}:1",
+		sequence: 6,
+		record: {
+			recordId: "tool-settled:run:{submissionId}:1:activity-call-1",
+			family: "conversation",
+			schemaVersion: 1,
+			createdAt: "{timestamp}",
+			deploymentId: "{deploymentId}",
+			payload: {
+				_tag: "ToolCallSettled",
+				runId: "run:{submissionId}",
+				toolCallId: "activity-call-1",
+				toolName: "search_activities",
+				result: { activities: ["British Museum timed entry", "Thames evening walk"] },
+				isFailure: false
+			}
+		}
+	},
+	{
+		batchId: "turn:run:{submissionId}:2",
+		sequence: 7,
+		record: {
+			recordId: "model-response:run:{submissionId}:2",
+			family: "conversation",
+			schemaVersion: 1,
+			createdAt: "{timestamp}",
+			deploymentId: "{deploymentId}",
+			payload: {
+				_tag: "ModelResponseRecorded",
+				runId: "run:{submissionId}",
+				turnId: "turn:run:{submissionId}:2",
+				turn: 2,
+				messages: { content: [{
+					options: {},
+					role: "assistant",
+					content: "{\"itineraries\":[{\"title\":\"Westward light, eastbound overnight\",\"route\":\"San Francisco → London\",\"dates\":\"14–19 September 2026\",\"flight\":\"EA 218 · nonstop · SFO 18:40 → LHR 13:05+1\",\"lodging\":\"Bloomsbury House · refundable studio · 4 nights\",\"activities\":[\"British Museum timed entry\",\"Thames evening walk\"],\"estimatedTotalCents\":284000,\"currency\":\"USD\",\"quoteId\":\"quote-sfo-lhr-001\",\"assumptions\":[\"Two travelers sharing one studio\",\"Quote is read-only availability, not a reservation\"],\"unresolvedConstraints\":[\"Traveler names and accessibility requests are intentionally omitted\"],\"nextAction\":\"review\"}]}"
+				}] },
+				messagesDigest: "{digest}"
+			}
+		}
+	},
+	{
+		batchId: "submission-settlement:{submissionId}",
+		sequence: 8,
+		record: {
+			recordId: "settlement:{submissionId}",
+			family: "conversation",
+			schemaVersion: 1,
+			createdAt: "{timestamp}",
+			deploymentId: "{deploymentId}",
+			payload: {
+				_tag: "SubmissionSettled",
+				submissionId: "{submissionId}",
+				settlementId: "settlement:{submissionId}",
+				receiptId: "{receiptId}",
+				outcome: "completed",
+				runId: "run:{submissionId}",
+				result: { itineraries: [{
+					title: "Westward light, eastbound overnight",
+					route: "San Francisco → London",
+					dates: "14–19 September 2026",
+					flight: "EA 218 · nonstop · SFO 18:40 → LHR 13:05+1",
+					lodging: "Bloomsbury House · refundable studio · 4 nights",
+					activities: ["British Museum timed entry", "Thames evening walk"],
+					estimatedTotalCents: 284e3,
+					currency: "USD",
+					quoteId: "quote-sfo-lhr-001",
+					assumptions: ["Two travelers sharing one studio", "Quote is read-only availability, not a reservation"],
+					unresolvedConstraints: ["Traveler names and accessibility requests are intentionally omitted"],
+					nextAction: "review"
+				}] }
+			}
+		}
+	}
+];
+//#endregion
+//#region src/fixtures/travel-planner/phase7.ts
+/**
+* The P7 dual-profile claim, schema-first so the exact scope of "live
+* integration profiles" is a committed, decodable value:
+*
+* - `offlineConformanceDeterministic` / `offlineRequiresCredentials`: the
+*   cumulative conformance suites stay deterministic and credential-free.
+* - `liveProfileOptIn`: live suites are excluded from ordinary gates by the
+*   environment predicate (`phase7LiveProfileEnabled`), never by test-runner
+*   configuration that could silently drift.
+* - `liveModelLayers` / `liveSupplierLayers`: live profiles exercise real
+*   model Layers over the SAME deterministic supplier desk — no claim of a
+*   live supplier integration is made anywhere (decision 9).
+* - `structurallyRedactedTranscripts`: transcript evidence a live profile
+*   emits passes through the structural `Redactor` first (SEC-008,
+*   testing.md §12: "live model and supplier profiles are opt-in smoke or
+*   release tests, rate-limited and structurally redacted").
+* - `exactlyOnceExternalEffects`: never claimed at any phase (DUR-003).
+*/
+var TravelPlannerPhase7Profile = class extends Schema.Class("@effect-agent/testing/travel-planner/TravelPlannerPhase7Profile")({
+	phase: Schema.Literal("P7"),
+	offlineConformanceDeterministic: Schema.Literal(true),
+	offlineRequiresCredentials: Schema.Literal(false),
+	liveProfileOptIn: Schema.Literal(true),
+	liveModelLayers: Schema.Literal(true),
+	liveSupplierLayers: Schema.Literal(false),
+	structurallyRedactedTranscripts: Schema.Literal(true),
+	exactlyOnceExternalEffects: Schema.Literal(false)
+}) {};
+const phase7TravelPlannerProfile = TravelPlannerPhase7Profile.make({
+	phase: "P7",
+	offlineConformanceDeterministic: true,
+	offlineRequiresCredentials: false,
+	liveProfileOptIn: true,
+	liveModelLayers: true,
+	liveSupplierLayers: false,
+	structurallyRedactedTranscripts: true,
+	exactlyOnceExternalEffects: false
+});
+/**
+* The one opt-in switch for EVERY live profile in this repository. `"1"` is
+* the only enabling value: an unset, empty, or differently-truthy value keeps
+* the suite skipped, so CI and ordinary developer runs stay offline.
+*/
+const PHASE7_LIVE_GATE_ENV = "EFFECT_AGENT_LIVE";
+/** The credential a Travel Planner live-model profile additionally requires. */
+const PHASE7_LIVE_CREDENTIAL_ENV = "OPENAI_API_KEY";
+/**
+* The test-side live gate (P7 plan §6: no test-side live-gating pattern
+* existed before this — the demo gates at serve time via
+* `Config.redacted("OPENAI_API_KEY")`). Suites use it as
+* `describe.skipIf(!phase7LiveProfileEnabled(process.env))`, which keeps the
+* live block out of ordinary gates while the SAME file's ungated tests keep
+* pinning the profile schema on every run.
+*/
+const phase7LiveProfileEnabled = (env) => env["EFFECT_AGENT_LIVE"] === "1" && (env["OPENAI_API_KEY"] ?? "") !== "";
+//#endregion
+export { ActivityCatalog, ActivityCatalogLayer, ActivityQuery, ActivitySearchResult, ActivityUnavailable, AirportCode, BookFlight, BookItinerary, BookingRef, BoundedSummary, CERTIFICATION_SCENARIOS, CancelBooking, CancelBookingRequest, CancellationConfirmation, CatalogLifecycle, CatalogLifecycleCounts, ChaosApprovalDecision, ChaosConvergenceFailure, ChaosLaneReport, ChaosPlan, ChaosPlanReport, ChaosResolutionKind, ChaosScenarioKind, ChaosSubmissionSpec, DEFAULT_CHAOS_SEED, DestinationBrief, DestinationFacts, DestinationGuide, DestinationGuideLayer, DestinationGuideUnavailable, DestinationQuery, DestinationRecommendation, DestinationReport, DestinationResearchFailed, DestinationResearchFindings, DestinationResearchRequest, DestinationResearchSupportLayer, DestinationResearcher, DestinationResearcherToolkit, DestinationResearcherToolkitLayer, DestinationShortlist, DeterministicIdGeneratorLayer, DocContentToolkit, DocSummarizer, DocsMcpDiscoveryEvidence, DocsResearcher, DocsResearcherToolkit, DocumentLibrary, DocumentQuery, DocumentSummary, DocumentSummaryFailed, DocumentUnavailable, DurableSearchActivities, DurableSearchFlights, DurableSearchLodging, FetchDocument, FlightBookingRequest, FlightCatalog, FlightCatalogLayer, FlightOption, FlightQuery, FlightUnavailable, GuidanceFailure, HoldItinerary, Itinerary, ItineraryBookingRequest, ItineraryConfirmation, ItineraryHold, ItineraryHoldGateway, ItineraryHoldRequest, ItineraryHoldUnavailable, LodgingCatalog, LodgingCatalogLayer, LodgingOption, LodgingQuery, LodgingUnavailable, LookupDestination, PHASE7_LIVE_CREDENTIAL_ENV, PHASE7_LIVE_GATE_ENV, QuoteId, ResearchDigest, ResearchDispatchGate, ResearchDocument, ResearchDocumentId, ResearchMission, ResearchRequest, ReverseCompletionToolkitLayer, ScriptedGeneratePart, ScriptedGenerateTurn, ScriptedModel, ScriptedStreamPart, ScriptedStreamTermination, ScriptedStreamTurn, ScriptedTurn, SearchActivities, SearchFlights, SearchLodging, SummaryBrief, SummaryFinding, SummaryRequest, SupplierBookingConfirmation, SupplierBookingDesk, SupplierBookingRecord, SupplierOperation, SupplierUnavailable, TIER2_UNREACHED_LOCATIONS, TravelBookingReport, TravelCoordinator, TravelCoordinatorToolkit, TravelGuidance, TravelGuidanceLayer, TravelPlan, TravelPlanner, TravelPlannerBookingEvidenceError, TravelPlannerBookingProfile, TravelPlannerCloudflareProfile, TravelPlannerDurabilityProfile, TravelPlannerDurableEvidenceError, TravelPlannerPersistenceProfile, TravelPlannerPhase2, TravelPlannerPhase2Toolkit, TravelPlannerPhase2ToolkitLayer, TravelPlannerPhase4, TravelPlannerPhase4Toolkit, TravelPlannerPhase4ToolkitLayer, TravelPlannerPhase5, TravelPlannerPhase5Toolkit, TravelPlannerPhase5ToolkitLayer, TravelPlannerPhase7Profile, TravelPlannerProjectionError, TravelPlannerRuntimeLayer, TravelPlannerSubagentDurabilityProfile, TravelPlannerToolkit, TravelPlannerToolkitLayer, TravelSupplierReconcilerLayer, TravelerRef, TripRequest, assertDiscoveryMatchesAuthoredToolkit, assertSettledBookingsExistAtSupplier, bookFlightIdempotencyKey, cancelBookingIdempotencyKey, certifyDurableAdapters, chaosSeedFromEnv, coordinatorConfidentialMarker, coordinatorResearchTurn, coordinatorShortlistTurn, delegateDocumentSummary, destinationLookup, destinationReportFor, destinationResearchDelegation, destinationResearchHandlersLayer, destinationResearchPolicy, docContentToolkitLayer, docsCoordinatorConfidentialMarker, docsCoordinatorDigests, docsDocumentBodySecret, docsMcpConnectorLayer, docsMcpIdentity, docsMcpMismatchedConnectorLayer, docsMcpOversizedConnectorLayer, docsMcpRequest, docsMissionConfidentialMarker, docsResearcherDeploymentId, docsResearcherPrincipal, docsResearcherProducerId, docsResearcherSubmitAgent, docsResearcherSubmitOptions, docsSummarizerDigestStrings, docsSummarizerDigests, docsSummaryHandlersLayer, documentBodyPhrase, documentSummaryFor, documentSummaryPolicy, durableChildLookupCallId, durableDestinationResearchHandlersLayer, durableResearchAllocation, durableResearchCallId, durableResearchFinding, durableResearchShortlist, encodedDestinationFacts, encodedDestinationReport, encodedDocumentSummary, expectedDestinationShortlist, expectedResearchDigest, expectedTravelPlan, fetchCallId, generateChaosPlans, itineraryStepIdempotencyKey, makeDestinationResearcherModel, makeDocsResearcherHarness, makeDurableResearchHarness, makeInvocationCountingModel, makePhase3TravelPlannerCheckpoint, makePhase4TravelPlannerAgent, makePhase6TravelPlannerBindings, mapResearchChildFailure, mapSummaryChildFailure, missionConfidentialMarker, normalizeCrossPlatformTravelPlannerEvidence, normalizeDurableTravelPlannerEvidence, phase0HappyPathTurns, phase0Trip, phase1HappyPathTurns, phase1Trip, phase3TravelPlannerBatches, phase3TravelPlannerCompletionBatch, phase3TravelPlannerConversationId, phase3TravelPlannerDefinitionDigests, phase3TravelPlannerEncodedFixture, phase3TravelPlannerInitialBatch, phase3TravelPlannerProducerId, phase3TravelPlannerProfile, phase3TravelPlannerRunId, phase4TravelPlannerDefinitionDigests, phase4TravelPlannerDeploymentId, phase4TravelPlannerPrincipal, phase4TravelPlannerProducerId, phase4TravelPlannerProfile, phase4TravelPlannerSubmitOptions, phase4TravelPlannerWorkerLayer, phase5TravelPlannerDefinitionDigests, phase5TravelPlannerDeploymentId, phase5TravelPlannerPrincipal, phase5TravelPlannerProducerId, phase5TravelPlannerProfile, phase5TravelPlannerSubmitOptions, phase5TravelPlannerWorkerLayer, phase6ActivityCallId, phase6BookingModel, phase6BookingRef, phase6BookingToolCallId, phase6BookingTrip, phase6ChildLookupCallId, phase6CoordinatorModel, phase6FlightCallId, phase6GatedPlannerDefinitionDigests, phase6GatedPlannerModel, phase6GatedTrip, phase6GuideInvocationCount, phase6LodgingCallId, phase6PlannerModel, phase6ResearchDestination, phase6ResearchMission, phase6ResearcherModel, phase6SupplierDesk, phase6SupplierDeskLayer, phase6SupplierReconcilerLayer, phase6TravelPlannerDeploymentId, phase6TravelPlannerGoldenEvidence, phase6TravelPlannerProducerId, phase6TravelPlannerProducerPrefix, phase6TravelPlannerProfile, phase7LiveProfileEnabled, phase7TravelPlannerProfile, redactedDocumentPreview, releasePhase6PlannerGate, releasePhase6ResearcherGate, researchCorpusDocumentIds, researchDocumentFor, researchDocumentLookup, researchMission, researchMissionRequest, researcherHappyPathTurns, resetPhase6PlannerGate, resetPhase6ResearcherGate, resolveTierThree, runChaosPlan, s2CoordinatorDigests, s2CoordinatorSubmitAgent, s2ResearcherDigestStrings, s2ResearcherDigests, s2TravelPlannerDeploymentId, s2TravelPlannerPrincipal, s2TravelPlannerProducerId, s2TravelPlannerProfile, s2TravelPlannerSubmitOptions, summarizeCallId, supplierBookingRefFor, tier2NeverFiredLocations, travelPlanFromDurableSettlement, travelPlanFromProjection };
+
+//# sourceMappingURL=index.mjs.map