@effect-agent/testing 0.1.0-beta.10 → 0.1.0-beta.100

package/src/{certification.ts → Certification.ts}

@@ -1,80 +1,83 @@
+import type { Crypto } from "effect";
 import {
-  Subagent,
-  SubagentPolicy,
-  SubagentReservationsMemoryLive,
-  SubagentRuntime,
-} from "@effect-agent/capabilities";
+  Cause,
+  Clock,
+  DateTime,
+  Duration,
+  Effect,
+  Exit,
+  Layer,
+  Option,
+  Ref,
+  Schema,
+  Stream,
+} from "effect";
+import * as Agent from "effect-agent/agent";
+import { AgentPolicy } from "effect-agent/agent-policy";
+import { DurableWorkerBinding, type ResolvedBinding } from "effect-agent/agent-registration";
 import {
-  Agent,
-  AgentPolicy,
-  ConversationId,
-  IdGenerator,
+  DurableAgentRuntime,
+  DurableRuntimeConfig,
+  type DurableSubmitFailure,
+  type DurableSubmitOptions,
+  type Receipt,
+} from "effect-agent/durable-agent-runtime";
+import {
+  DurableRuntimeFailpointError,
+  DurableRuntimeFailpointLocation,
+} from "effect-agent/durable-failpoint";
+import { DurableStep, DurableStepError } from "effect-agent/durable-step";
+import { IdGenerator } from "effect-agent/id-generator";
+import {
+  ThreadId,
   RunId,
   ToolCallId,
   TurnId,
   type AgentId,
   type SubmissionId,
-} from "@effect-agent/core";
-import { DurableStep, DurableStepError } from "@effect-agent/engine";
+} from "effect-agent/identifiers";
 import {
-  AgentBindingResolver,
-  ApprovalDecisionCommand,
-  CertificationCaseResult,
-  CertificationReport,
-  CertificationSweepResult,
-  CertificationTierThreeReport,
-  CertifiedAdapterIdentity,
-  ConversationExportRequest,
-  ConversationStore,
   DefinitionDigests,
   DeploymentId,
   Digest,
-  DurableAgentRuntime,
-  DurableRuntimeConfig,
-  DurableRuntimeFailpoint,
-  DurableRuntimeFailpointError,
-  DurableRuntimeFailpointLocation,
-  DurableRuntimeFailpointTestControl,
-  DurableWorkerBinding,
+  ProducerId,
+  type BatchId,
+} from "effect-agent/records";
+import { childThreadIdFor } from "effect-agent/run-journal";
+import { RunToolAuthorization } from "effect-agent/run-options";
+import * as Subagent from "effect-agent/subagent";
+import { SubagentPolicy } from "effect-agent/subagent";
+import { SubagentReservationsMemoryLive } from "effect-agent/subagent-reservations";
+import {
+  ApprovalDecisionCommand,
   IdempotencyKey,
-  LoadCheckpointRequest,
   Principal,
-  ProducerId,
   ResolutionSafeToRetry,
   SubmissionLedger,
   SubmissionLookupById,
-  ToolReconciler,
   UnknownResolutionCommand,
-  WakeScheduler,
   DEFAULT_OWNERSHIP_LEASE_DURATION,
-  certifyPorts,
-  childConversationIdFor,
-  verifyConversationInvariants,
-  type BatchId,
-  type CertificationScenario,
-  type DurableSubmitFailure,
-  type DurableSubmitOptions,
-  type Receipt,
-  type ResolvedBinding,
   type SubmissionSnapshot,
-} from "@effect-agent/session";
+} from "effect-agent/submission-ledger";
 import {
-  Cause,
-  Clock,
-  Crypto,
-  DateTime,
-  Duration,
-  Effect,
-  Exit,
-  Layer,
-  Option,
-  Ref,
-  Schema,
-  Stream,
-} from "effect";
+  type CertificationCaseResult,
+  type CertificationReport,
+  CertificationSweepResult,
+  CertificationTierThreeReport,
+  CertifiedAdapterIdentity,
+  certifyPorts,
+  type CertificationScenario,
+} from "effect-agent/testing/certification";
+import { DurableRuntimeFailpointTestControl } from "effect-agent/testing/durable-failpoint-test-control";
+import { verifyThreadInvariants } from "effect-agent/thread-invariants";
+import { ThreadExportRequest, ThreadStore, LoadCheckpointRequest } from "effect-agent/thread-store";
+import { ToolReconciler } from "effect-agent/tool-reconciler";
+import { WakeScheduler } from "effect-agent/wake-scheduler";
 import { TestClock } from "effect/testing";
 import { LanguageModel, Model, Tool, Toolkit, type Response } from "effect/unstable/ai";
 
+import { makeCertificationReport } from "./internal/certification-report.ts";
+
 /**
  * P7 WP2 — `certifyDurableAdapters` (plan §1): the one certification entry point a durable
  * adapter pair runs to earn a Schema-encoded certificate.
@@ -83,12 +86,13 @@ import { LanguageModel, Model, Tool, Toolkit, type Response } from "effect/unsta
  *   `certifyPorts` (TEST-004/STORE-010).
  * - **Tier 2 — coordinator protocol + failpoint convergence**: the durable coordinator is
  *   assembled over the CANDIDATE Layer pair with a scripted deterministic model; every
- *   `DurableRuntimeFailpointLocation` is armed one-shot across the six scenario shapes
- *   (plain / uncertain-tool / durable-steps / approval / join / delegation). After the injected
- *   fault the runner asserts the state stays CLASSIFIABLE (recovery + the public unblocking
- *   operations `resolveUnknown`/`resolveApproval` are the only levers used) and that the
- *   re-drive CONVERGES to `verifyConversationInvariants` with `requireAllSettled` — including a
- *   fully discharged digest-chain check, because the runner captures per-batch producer
+ *   reached `DurableRuntimeFailpointLocation` is armed one-shot across the six scenario shapes
+ *   (plain / uncertain-tool / durable-steps / approval / join / delegation). Unreached locations
+ *   share a verified clean run per shape; new unaccounted-for locations get a full sweep.
+ *   After the injected fault the runner asserts the state stays CLASSIFIABLE (recovery +
+ *   the public unblocking operations `resolveUnknown`/`resolveApproval` are the only levers
+ *   used) and that the re-drive CONVERGES to `verifyThreadInvariants` with `requireAllSettled`,
+ *   including a fully discharged digest-chain check, because the runner captures per-batch producer
  *   identity at append time.
  * - **Tier 3 — real loss lever**: recorded honestly. A durable adapter either supplies a
  *   `CertificationCrashLever` executed in this run, cites its committed real-loss evidence
@@ -126,7 +130,7 @@ export interface CertifyDurableAdaptersOptions<LedgerE = never, StoreE = never>
    * does); the certification's own environment supplies nothing else.
    */
   readonly submissionLedger: Layer.Layer<SubmissionLedger, LedgerE, Crypto.Crypto>;
-  readonly conversationStore: Layer.Layer<ConversationStore, StoreE, Crypto.Crypto>;
+  readonly threadStore: Layer.Layer<ThreadStore, StoreE, Crypto.Crypto>;
   /** Defaults to `WakeScheduler.layerNoop`; the runner re-drives lanes explicitly. */
   readonly wakeScheduler?: Layer.Layer<WakeScheduler> | undefined;
   /** Executes Tier 3 in this run; takes precedence over `tierThreeEvidence`. */
@@ -156,23 +160,67 @@ export const CERTIFICATION_SCENARIOS: ReadonlyArray<CertificationScenario> = [
 
 /**
  * Coordinator failpoint locations that none of the six scenario shapes can reach, recorded
- * honestly instead of silently claimed: all three sit on operator/abort paths the shapes do
- * not take. They are pinned in-process by the P5/S2 suites
- * (`packages/testing/test/durable-tools.test.ts` "resolveUnknown is idempotent across the
+ * honestly instead of silently claimed. These require operator, compaction, reservation,
+ * background-worker, or Agent-update paths the shapes do not take. They are pinned in-process
+ * by the P5/S2 suites (`packages/testing/test/durable-tools.test.ts` "resolveUnknown is idempotent across the
  * intent failpoint", `durable-runtime.test.ts` abort rows,
  * `durable-subagents.test.ts` abort propagation) and by the process-kill/eviction crash
  * matrices. Runner tests assert the observed never-fired set equals EXACTLY this list, so a
  * protocol change that silently stops exercising a location fails the certification.
  */
 export const TIER2_UNREACHED_LOCATIONS: ReadonlyArray<DurableRuntimeFailpointLocation> = [
+  // Active timeout recording is covered before/after append by durable-runtime.test.ts.
+  "run:before-duration-append",
+  "run:after-duration-append",
+  // Tier 2 has no native compaction; dedicated checkpoint process-loss tests cover these.
+  "checkpoint:before-save",
+  "checkpoint:after-save",
   "abort:after-intent",
   // Compaction requires a `contextTokenLimit` policy plus prior-Run history
   // none of the six scenario shapes carries; pinned in-process by the
   // RUN-026 rows in `packages/testing/test/durable-runtime.test.ts`
   // (compaction failpoint idempotence across re-drive).
+  "compaction:before-canonical-append",
   "compaction:after-canonical-append",
+  // These shapes use neither programmatic Tools nor grace finalization. Their reservations
+  // are exercised before/after append in the public durable-runtime regression suite.
+  "policy:before-reservation-append",
+  "policy:after-reservation-append",
   "resolve:after-intent",
+  // All six shapes retain their original Tool contracts, so none retires an unavailable
+  // operation. The deployment continuity matrix in durable-runtime.test.ts exercises the
+  // actual before/after-unavailable append boundaries, asserting absent/present canonical
+  // ToolUnavailable results at the crash and one original-call settlement after re-drive.
+  "tools:before-unavailable-append",
+  "tools:after-unavailable-append",
   "subagent:after-child-abort-intent",
+  // Background workers use retained delivery, source capacity, and child-origin paths absent
+  // from these six attached/ordinary scenarios. The before/after creation and completion
+  // boundaries are exercised by packages/effect-agent/test/durable/worker-host.test.ts.
+  "worker:before-source-append",
+  "worker:after-source-append",
+  "worker:before-origin-append",
+  "worker:after-origin-append",
+  "worker:before-completion-append",
+  "worker:after-completion-append",
+  // Root attached declarations keep their independent pool; nested shared subtree mutations
+  // are covered by the same focused worker-host failpoint suite.
+  "worker:before-subtree-append",
+  "worker:after-subtree-append",
+  // Automatic report decisions and retained delivery insertion have dedicated worker crash tests.
+  "worker:before-report-append",
+  "worker:after-report-append",
+  "worker:before-report-delivery",
+  "worker:after-report-delivery",
+  // None of the six shapes emits Agent updates. All four boundaries are exercised separately
+  // by packages/effect-agent/test/durable/worker-host.test.ts ("repairs an accepted parent update after ...").
+  // Node restart/lost-ack coverage is in packages/platform-node/test/worker-updates.test.ts;
+  // Cloudflare eviction/alarm recovery is in packages/platform-cloudflare/test/background-workers.test.ts.
+  // These suites are not executed by this certification runner; its update rows remain not-triggered.
+  "update:before-canonical-append",
+  "update:after-canonical-append",
+  "update:before-delivery-insert",
+  "update:after-delivery-insert",
 ];
 
 /** Locations of `tier2` rows whose armed fault never fired in ANY scenario, sorted. */
@@ -180,9 +228,11 @@ export const tier2NeverFiredLocations = (
   tier2: ReadonlyArray<CertificationSweepResult>,
 ): ReadonlyArray<DurableRuntimeFailpointLocation> => {
   const fired = new Set<DurableRuntimeFailpointLocation>();
+
   for (const row of tier2) {
     if (row.failpointFired) fired.add(row.location);
   }
+
   return DurableRuntimeFailpointLocation.literals.filter((location) => !fired.has(location)).sort();
 };
 
@@ -192,18 +242,21 @@ export const tier2NeverFiredLocations = (
 
 const SHA_A = Schema.decodeSync(Digest)("a".repeat(64));
 const DIGESTS = DefinitionDigests.make({ agent: SHA_A, model: SHA_A, tools: SHA_A });
+
 const CHILD_DIGEST_STRINGS = {
   agent: "b".repeat(64),
   model: "c".repeat(64),
   tools: "d".repeat(64),
 } as const;
+
 const CHILD_DIGESTS = DefinitionDigests.make({
   agent: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.agent),
   model: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.model),
   tools: Schema.decodeSync(Digest)(CHILD_DIGEST_STRINGS.tools),
 });
+
 const PRINCIPAL = Schema.decodeSync(Principal)("principal-certification");
-const decodeConversationId = Schema.decodeSync(ConversationId);
+const decodeThreadId = Schema.decodeSync(ThreadId);
 const decodeIdempotencyKey = Schema.decodeSync(IdempotencyKey);
 const decodeToolCallId = Schema.decodeSync(ToolCallId);
 
@@ -253,18 +306,26 @@ const promptShapeModel = (
         generateText: () => Effect.succeed([]),
         streamText: (request) => {
           const hasToolResult = request.prompt.content.some((message) => message.role === "tool");
+
           const parts =
             toolParts === undefined || hasToolResult ? finalParts(finalText) : toolParts;
+
           return Stream.fromIterable(parts);
         },
       }),
     ),
   );
 
+// Tier-2 intentionally advances virtual time past a 30-second ownership lease on every
+// re-drive round. Keep its business-policy duration above the full eight-round sweep so this
+// fixture certifies crash convergence rather than accidentally relying on a fresh duration
+// allowance per replacement Attempt. RUN-030 owns the dedicated duration-expiry coverage.
+const CERTIFICATION_MAX_DURATION = "10 minutes" as const;
+
 const policy = AgentPolicy.make({
   maxTurns: 4,
   maxToolCalls: 4,
-  maxDuration: "30 seconds",
+  maxDuration: CERTIFICATION_MAX_DURATION,
   toolConcurrency: 2,
 });
 
@@ -272,7 +333,7 @@ const QuestionInput = Schema.Struct({ question: Schema.String });
 const AnswerOutput = Schema.Struct({ answer: Schema.String });
 
 /** plain / join: no tools — the pure Turn/submission/join seams. */
-const plainDefinition = Agent.define("certify-plain", {
+const plainDefinition = Agent.make("certify-plain", {
   input: QuestionInput,
   output: AnswerOutput,
   instructions: "Answer as JSON.",
@@ -285,8 +346,10 @@ const Book = Tool.make("book", {
   parameters: Schema.Struct({ ref: Schema.String }),
   success: Schema.Struct({ confirmation: Schema.String }),
 });
+
 const bookToolkit = Toolkit.make(Book);
-const uncertainDefinition = Agent.define("certify-uncertain", {
+
+const uncertainDefinition = Agent.make("certify-uncertain", {
   input: QuestionInput,
   output: AnswerOutput,
   instructions: "Book it.",
@@ -301,8 +364,10 @@ const Itinerary = Tool.make("itinerary", {
   failure: DurableStepError,
   dependencies: [DurableStep],
 });
+
 const itineraryToolkit = Toolkit.make(Itinerary);
-const stepsDefinition = Agent.define("certify-steps", {
+
+const stepsDefinition = Agent.make("certify-steps", {
   input: QuestionInput,
   output: AnswerOutput,
   instructions: "Reserve the itinerary.",
@@ -316,8 +381,10 @@ const BookApproval = Tool.make("book", {
   success: Schema.Struct({ confirmation: Schema.String }),
   needsApproval: true,
 });
+
 const approvalToolkit = Toolkit.make(BookApproval);
-const approvalDefinition = Agent.define("certify-approval", {
+
+const approvalDefinition = Agent.make("certify-approval", {
   input: QuestionInput,
   output: AnswerOutput,
   instructions: "Book after approval.",
@@ -326,7 +393,7 @@ const approvalDefinition = Agent.define("certify-approval", {
 });
 
 /** delegation: durable attached child plus an ordinary uncertain sibling in ONE batch. */
-const childDefinition = Agent.define("certify-child", {
+const childDefinition = Agent.make("certify-child", {
   input: QuestionInput,
   output: AnswerOutput,
   instructions: "Answer as JSON.",
@@ -334,7 +401,7 @@ const childDefinition = Agent.define("certify-child", {
   policy: AgentPolicy.make({
     maxTurns: 2,
     maxToolCalls: 1,
-    maxDuration: "30 seconds",
+    maxDuration: CERTIFICATION_MAX_DURATION,
     toolConcurrency: 1,
   }),
 });
@@ -357,7 +424,7 @@ const researchDelegation = Subagent.define("delegate_research", {
     maxConcurrency: 2,
     maxTurns: 4,
     maxToolCalls: 4,
-    maxDuration: "10 seconds",
+    maxDuration: CERTIFICATION_MAX_DURATION,
   }),
 });
 
@@ -366,7 +433,7 @@ const Lookup = Tool.make("lookup", {
   success: Schema.Struct({ value: Schema.String }),
 });
 
-const coordinatorDefinition = Agent.define("certify-coordinator", {
+const coordinatorDefinition = Agent.make("certify-coordinator", {
   input: Schema.Struct({ mission: Schema.String }),
   output: Schema.Struct({ report: Schema.String }),
   instructions: "Delegate and look up, then answer as JSON.",
@@ -374,7 +441,7 @@ const coordinatorDefinition = Agent.define("certify-coordinator", {
   policy: AgentPolicy.make({
     maxTurns: 4,
     maxToolCalls: 3,
-    maxDuration: "30 seconds",
+    maxDuration: CERTIFICATION_MAX_DURATION,
     toolConcurrency: 2,
   }),
 });
@@ -389,12 +456,14 @@ const identifiers = Layer.effect(
   IdGenerator,
   Effect.gen(function* () {
     const counter = yield* Ref.make(0);
+
     const next = <A>(decode: (value: string) => A, prefix: string) =>
       Ref.getAndUpdate(counter, (value) => value + 1).pipe(
         Effect.map((value) => decode(`${prefix}-${value}`)),
       );
+
     return {
-      nextConversationId: next(decodeConversationId, "certify-fixture-conversation"),
+      nextThreadId: next(decodeThreadId, "certify-fixture-thread"),
       nextRunId: next(Schema.decodeSync(RunId), "certify-fixture-run"),
       nextTurnId: next(Schema.decodeSync(TurnId), "certify-fixture-turn"),
     };
@@ -408,15 +477,15 @@ const delegationSupport = Layer.mergeAll(SubagentReservationsMemoryLive, identif
 // ---------------------------------------------------------------------------
 
 interface CertificationCell {
-  readonly resolver: (typeof AgentBindingResolver)["Service"];
+  readonly bindings: ReadonlyArray<ResolvedBinding>;
   /** Idempotent submission batch — safe to replay verbatim after a submit-boundary fault. */
   readonly submit: Effect.Effect<ReadonlyArray<Receipt>, DurableSubmitFailure, DurableAgentRuntime>;
   /** All lanes of the cell in drive order, computed from the (possibly replayed) receipts. */
-  readonly lanes: (receipts: ReadonlyArray<Receipt>) => ReadonlyArray<ConversationId>;
+  readonly lanes: (receipts: ReadonlyArray<Receipt>) => ReadonlyArray<ThreadId>;
 }
 
-const submitOptionsFor = (slug: string, conversationId: ConversationId): DurableSubmitOptions => ({
-  conversationId,
+const submitOptionsFor = (slug: string, threadId: ThreadId): DurableSubmitOptions => ({
+  threadId,
   principal: PRINCIPAL,
   idempotencyKey: decodeIdempotencyKey(`certify-key-${slug}`),
   definitions: DIGESTS,
@@ -428,20 +497,24 @@ const makeSingleAgentCell = (
   resolved: ResolvedBinding,
   slug: string,
 ): CertificationCell => {
-  const conversationId = decodeConversationId(`certify-${slug}`);
+  const threadId = decodeThreadId(`certify-${slug}`);
+
   const submit = Effect.gen(function* () {
     const runtime = yield* DurableAgentRuntime;
+
     const receipt = yield* runtime.submit(
       { definition: { id: definition.id, input: definition.input } },
       { question: `certify ${slug}` },
-      submitOptionsFor(slug, conversationId),
+      submitOptionsFor(slug, threadId),
     );
+
     return [receipt];
   });
+
   return {
-    resolver: AgentBindingResolver.fromBindings([resolved]),
+    bindings: [resolved],
     submit,
-    lanes: () => [conversationId],
+    lanes: () => [threadId],
   };
 };
 
@@ -455,7 +528,9 @@ const makeCell = Effect.fn("Certification.makeCell")(function* (
         plainDefinition,
         promptShapeModel("certify-plain", '{"answer":"done"}'),
       );
+
       const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS);
+
       return makeSingleAgentCell(plainDefinition, resolved, slug);
     }
     case "uncertain-tool": {
@@ -467,12 +542,15 @@ const makeCell = Effect.fn("Certification.makeCell")(function* (
           toolTurn(toolCallPart("book-1", "book", { ref: `r-${slug}` })),
         ),
       );
+
       const toolLayer = bookToolkit.toLayer({
         book: ({ ref }) => Effect.succeed({ confirmation: `confirmed-${ref}` }),
       });
+
       const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(
         Effect.provide(toolLayer),
       );
+
       return makeSingleAgentCell(uncertainDefinition, resolved, slug);
     }
     case "durable-steps": {
@@ -484,26 +562,32 @@ const makeCell = Effect.fn("Certification.makeCell")(function* (
           toolTurn(toolCallPart("itinerary-1", "itinerary", { ref: `trip-${slug}` })),
         ),
       );
+
       const toolLayer = itineraryToolkit.toLayer({
         itinerary: ({ ref }) =>
           Effect.gen(function* () {
             const step = yield* DurableStep;
+
             const flight = yield* step.do(
               "reserve-flight",
               Schema.String,
               Effect.succeed(`flight-${ref}`),
             );
+
             const lodging = yield* step.do(
               "reserve-lodging",
               Schema.String,
               Effect.succeed(`lodging-${ref}`),
             );
+
             return { state: `${flight}+${lodging}` };
           }),
       });
+
       const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(
         Effect.provide(toolLayer),
       );
+
       return makeSingleAgentCell(stepsDefinition, resolved, slug);
     }
     case "approval": {
@@ -515,12 +599,15 @@ const makeCell = Effect.fn("Certification.makeCell")(function* (
           toolTurn(toolCallPart("book-1", "book", { ref: `r-${slug}` })),
         ),
       );
+
       const toolLayer = approvalToolkit.toLayer({
         book: ({ ref }) => Effect.succeed({ confirmation: `confirmed-${ref}` }),
       });
+
       const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS).pipe(
         Effect.provide(toolLayer),
       );
+
       return makeSingleAgentCell(approvalDefinition, resolved, slug);
     }
     case "join": {
@@ -528,31 +615,39 @@ const makeCell = Effect.fn("Certification.makeCell")(function* (
         plainDefinition,
         promptShapeModel("certify-join", '{"answer":"host answer"}'),
       );
+
       const resolved = yield* DurableWorkerBinding.make(binding, DIGESTS);
-      const conversationId = decodeConversationId(`certify-${slug}`);
-      const submitOne = (key: string, question: string) =>
-        Effect.gen(function* () {
-          const runtime = yield* DurableAgentRuntime;
-          return yield* runtime.submit(
-            { definition: { id: plainDefinition.id, input: plainDefinition.input } },
-            { question },
-            {
-              conversationId,
-              principal: PRINCIPAL,
-              idempotencyKey: decodeIdempotencyKey(key),
-              definitions: DIGESTS,
-            },
-          );
-        });
+      const threadId = decodeThreadId(`certify-${slug}`);
+
+      const submitOne = Effect.fn("Certification.submitOne")(function* (
+        key: string,
+        question: string,
+      ) {
+        const runtime = yield* DurableAgentRuntime;
+
+        return yield* runtime.submit(
+          { definition: { id: plainDefinition.id, input: plainDefinition.input } },
+          { question },
+          {
+            threadId,
+            principal: PRINCIPAL,
+            idempotencyKey: decodeIdempotencyKey(key),
+            definitions: DIGESTS,
+          },
+        );
+      });
+
       const cell: CertificationCell = {
-        resolver: AgentBindingResolver.fromBindings([resolved]),
+        bindings: [resolved],
         submit: Effect.gen(function* () {
           const host = yield* submitOne(`certify-key-${slug}-host`, "host question");
           const queued = yield* submitOne(`certify-key-${slug}-queued`, "queued question");
+
           return [host, queued];
         }),
-        lanes: () => [conversationId],
+        lanes: () => [threadId],
       };
+
       return cell;
     }
     case "delegation": {
@@ -560,6 +655,7 @@ const makeCell = Effect.fn("Certification.makeCell")(function* (
         childDefinition,
         promptShapeModel("certify-child", '{"answer":"child-answer"}'),
       );
+
       const parentBinding = Agent.withModel(
         coordinatorDefinition,
         promptShapeModel(
@@ -571,36 +667,45 @@ const makeCell = Effect.fn("Certification.makeCell")(function* (
           ),
         ),
       );
-      const delegationLayer = SubagentRuntime.layer(researchDelegation, childBinding, {
+
+      const delegationLayer = Subagent.layer(researchDelegation, childBinding, {
         mapChildFailure,
         durable: { targetDigests: CHILD_DIGEST_STRINGS },
       }).pipe(Layer.provide(delegationSupport));
+
       const lookupLayer = Toolkit.make(Lookup).toLayer({
         lookup: ({ key }) => Effect.succeed({ value: `found-${key}` }),
       });
+
       const parentResolved = yield* DurableWorkerBinding.make(parentBinding, DIGESTS).pipe(
         Effect.provide(Layer.mergeAll(delegationLayer, lookupLayer)),
       );
+
       const childResolved = yield* DurableWorkerBinding.make(childBinding, CHILD_DIGESTS);
-      const conversationId = decodeConversationId(`certify-${slug}`);
+      const threadId = decodeThreadId(`certify-${slug}`);
+
       const cell: CertificationCell = {
-        resolver: AgentBindingResolver.fromBindings([parentResolved, childResolved]),
+        bindings: [parentResolved, childResolved],
         submit: Effect.gen(function* () {
           const runtime = yield* DurableAgentRuntime;
+
           const receipt = yield* runtime.submit(
             { definition: { id: coordinatorDefinition.id, input: coordinatorDefinition.input } },
             { mission: "plan" },
-            submitOptionsFor(slug, conversationId),
+            submitOptionsFor(slug, threadId),
           );
+
           return [receipt];
         }),
         lanes: (receipts) => {
           const parent = receipts.at(0);
+
           return parent === undefined
-            ? [conversationId]
-            : [conversationId, childConversationIdFor(parent.submissionId, DELEGATE_CALL)];
+            ? [threadId]
+            : [threadId, childThreadIdFor(parent.submissionId, DELEGATE_CALL)];
         },
       };
+
       return cell;
     }
   }
@@ -616,107 +721,139 @@ const MAX_REDRIVE_ROUNDS = 8;
  * the digest chain is fully recomputed instead of skipped.
  */
 const verifyLane = Effect.fn("Certification.verifyLane")(function* (
-  lane: ConversationId,
+  lane: ThreadId,
   batchProducers: ReadonlyMap<BatchId, ProducerId>,
 ) {
-  const store = yield* ConversationStore;
+  const store = yield* ThreadStore;
   const ledger = yield* SubmissionLedger;
-  const exported = yield* store.export(ConversationExportRequest.make({ conversationId: lane }));
+  const exported = yield* store.export(ThreadExportRequest.make({ threadId: lane }));
   const rows = new Map<SubmissionId, SubmissionSnapshot>();
   const nonterminal = yield* Stream.runCollect(ledger.scanNonterminal);
+
   for (const submission of nonterminal) {
-    if (submission.conversationId === lane) rows.set(submission.submissionId, submission);
+    if (submission.threadId === lane) rows.set(submission.submissionId, submission);
   }
   const named = new Set<SubmissionId>();
+
   for (const envelope of exported.records) {
     const payload = envelope.record.payload;
+
     if (
       payload._tag === "UserInputRecorded" ||
       payload._tag === "SubmissionSettled" ||
       payload._tag === "AbortRequested"
     ) {
-      named.add(payload.submissionId);
+      if (payload.submissionId !== undefined) named.add(payload.submissionId);
     }
   }
   for (const submissionId of named) {
     if (rows.has(submissionId)) continue;
     const found = yield* ledger.lookup(SubmissionLookupById.make({ submissionId }));
-    if (Option.isSome(found) && found.value.conversationId === lane) {
+
+    if (Option.isSome(found) && found.value.threadId === lane) {
       rows.set(submissionId, found.value);
     }
   }
-  const checkpoint = yield* store.loadCheckpoint(
-    LoadCheckpointRequest.make({ conversationId: lane }),
-  );
-  return yield* verifyConversationInvariants({
+
+  const checkpoint =
+    store.checkpoints === undefined
+      ? Option.none()
+      : yield* store.checkpoints.load(LoadCheckpointRequest.make({ threadId: lane }));
+
+  return yield* verifyThreadInvariants({
     export: exported,
     submissions: [...rows.values()],
     batchProducers,
     checkpoint: Option.getOrUndefined(checkpoint),
+    checkpointsSupported: store.checkpoints !== undefined,
     requireAllSettled: true,
   });
 });
 
 const failureTagOf = <E>(cause: Cause.Cause<E>): string => {
   const failure = Cause.findErrorOption(cause);
+
   if (Option.isSome(failure)) {
     const error: unknown = failure.value;
+
     if (typeof error === "object" && error !== null && "_tag" in error) {
-      return String((error as { _tag: unknown })._tag);
+      return String(error._tag);
     }
+
     return String(error).slice(0, 256);
   }
+
   return "defect";
 };
 
-/** One Tier-2 sweep cell: arm `location` one-shot, drive `scenario`, converge, verify. */
+type SweepOutcome = Pick<
+  CertificationSweepResult,
+  "failpointFired" | "status" | "digestChainVerified" | "detail"
+>;
+
+/** Discover a clean path, or arm one location; both drives converge and verify real storage. */
 const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (
   scenario: CertificationScenario,
-  location: DurableRuntimeFailpointLocation,
+  location: DurableRuntimeFailpointLocation | undefined,
   batchProducers: ReadonlyMap<BatchId, ProducerId>,
   leaseAdvance: Duration.Duration,
+  reached: Set<DurableRuntimeFailpointLocation>,
 ) {
-  const runtime = yield* DurableAgentRuntime;
   const ledger = yield* SubmissionLedger;
   const control = yield* DurableRuntimeFailpointTestControl;
-  const slug = `${scenario}-${location.replaceAll(":", "-")}`;
-
-  const failed = (detail: string, fired: boolean): CertificationSweepResult =>
-    CertificationSweepResult.make({
-      scenario,
-      location,
-      failpointFired: fired,
-      status: "failed",
-      digestChainVerified: false,
-      detail: detail.slice(0, 4_096),
-    });
+  const slug = `${scenario}-${location?.replaceAll(":", "-") ?? "discovery"}`;
+
+  const failed = (detail: string, fired: boolean): SweepOutcome => ({
+    failpointFired: fired,
+    status: "failed",
+    digestChainVerified: false,
+    detail: detail.slice(0, 4_096),
+  });
 
   const cell = yield* makeCell(scenario, slug);
 
+  const runtime = yield* DurableAgentRuntime.pipe(
+    Effect.provide(
+      DurableAgentRuntime.layerWithBindings(cell.bindings).pipe(
+        Layer.provide(RunToolAuthorization.allowAll),
+      ),
+    ),
+  );
+
+  const submit = cell.submit.pipe(Effect.provideService(DurableAgentRuntime, runtime));
+
   // One-shot arm: the fault fires at most once anywhere in the cell (initial drive OR a
   // re-drive round's public unblocking operation), modelling one crash at this boundary.
   const fired = yield* Ref.make(false);
+
   yield* control.setHandler((hit) =>
-    hit !== location
-      ? Effect.void
-      : Ref.getAndSet(fired, true).pipe(
-          Effect.flatMap((already) =>
-            already
-              ? Effect.void
-              : Effect.fail(DurableRuntimeFailpointError.make({ location: hit })),
-          ),
-        ),
+    Effect.suspend(() => {
+      reached.add(hit);
+
+      return hit !== location
+        ? Effect.void
+        : Ref.getAndSet(fired, true).pipe(
+            Effect.flatMap((already) =>
+              already
+                ? Effect.void
+                : Effect.fail(DurableRuntimeFailpointError.make({ location: hit })),
+            ),
+          );
+    }),
   );
 
   // Submissions are idempotent (DUR-001): one replay recovers a submit-boundary fault.
   let receipts: ReadonlyArray<Receipt>;
-  const firstSubmit = yield* Effect.exit(cell.submit);
+  const firstSubmit = yield* Effect.exit(submit);
+
   if (Exit.isSuccess(firstSubmit)) {
     receipts = firstSubmit.value;
   } else {
-    const secondSubmit = yield* Effect.exit(cell.submit);
+    const secondSubmit = yield* Effect.exit(submit);
+
     if (Exit.isFailure(secondSubmit)) {
       yield* control.clear;
+
       return failed(
         `submission replay did not recover: ${failureTagOf(secondSubmit.cause)}`,
         yield* Ref.get(fired),
@@ -726,24 +863,24 @@ const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (
   }
   const lanes = cell.lanes(receipts);
 
-  const driveLane = (lane: ConversationId) =>
-    runtime
-      .processConversationResolved(lane)
-      .pipe(Effect.provideService(AgentBindingResolver, cell.resolver));
+  const driveLane = (lane: ThreadId) => runtime.processThreadResolved(lane);
 
   const allSettled = Effect.gen(function* () {
     for (const receipt of receipts) {
       const snapshot = yield* ledger.lookup(
         SubmissionLookupById.make({ submissionId: receipt.submissionId }),
       );
+
       if (Option.isNone(snapshot) || snapshot.value.state !== "settled") return false;
     }
+
     return true;
   });
 
   // Re-drive to convergence using ONLY public operations: worker drives, recovery passes,
-  // and the authorized DUR-017/approval unblocking paths chosen from `explainConversation`.
+  // and the authorized DUR-017/approval unblocking paths chosen from `explainThread`.
   let converged = false;
+
   for (let round = 0; round < MAX_REDRIVE_ROUNDS && !converged; round++) {
     // Expire any lease a faulted Attempt left behind (D5): virtual time is the
     // adapter-neutral reclaim lever — a live lease may block every new claim.
@@ -753,7 +890,8 @@ const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (
       yield* Effect.exit(driveLane(lane));
     }
     for (const lane of lanes) {
-      const explains = yield* Effect.exit(runtime.explainConversation(lane));
+      const explains = yield* Effect.exit(runtime.explainThread(lane));
+
       if (Exit.isFailure(explains)) continue;
       for (const explanation of explains.value) {
         for (const unknown of explanation.evidence.unknownCalls) {
@@ -774,6 +912,7 @@ const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (
           const decided = explanation.evidence.approvalDecisions.some(
             (decision) => decision.toolCallId === pending.toolCallId,
           );
+
           if (decided) continue;
           yield* Effect.exit(
             runtime.resolveApproval(
@@ -790,6 +929,7 @@ const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (
       }
     }
     const settled = yield* Effect.exit(allSettled);
+
     converged = Exit.isSuccess(settled) && settled.value;
   }
   yield* control.clear;
@@ -802,8 +942,10 @@ const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (
   // Every lane of the cell must verify in convergence mode with a recomputed digest chain.
   let digestChainVerified = true;
   const failedChecks: Array<string> = [];
+
   for (const lane of lanes) {
     const verdict = yield* Effect.exit(verifyLane(lane, batchProducers));
+
     if (Exit.isFailure(verdict)) {
       return failed(`lane ${lane} could not be verified: ${failureTagOf(verdict.cause)}`, wasFired);
     }
@@ -827,13 +969,11 @@ const runSweepCell = Effect.fn("Certification.runSweepCell")(function* (
     );
   }
 
-  return CertificationSweepResult.make({
-    scenario,
-    location,
+  return {
     failpointFired: wasFired,
     status: wasFired ? "converged" : "not-triggered",
     digestChainVerified,
-  });
+  } satisfies SweepOutcome;
 });
 
 // ---------------------------------------------------------------------------
@@ -864,10 +1004,14 @@ export const resolveTierThree = Effect.fn("Certification.resolveTierThree")(func
   }
   if (options.crashLever !== undefined) {
     const cases = yield* options.crashLever;
+
     return CertificationTierThreeReport.make({
-      status: "exercised",
+      status: cases.length === 0 ? "not-exercised" : "exercised",
       evidence: options.tierThreeEvidence ?? [],
       cases,
+      ...(cases.length === 0
+        ? { detail: "the supplied crash lever executed no real-loss cases" }
+        : {}),
     });
   }
   if (options.tierThreeEvidence !== undefined && options.tierThreeEvidence.length > 0) {
@@ -877,6 +1021,7 @@ export const resolveTierThree = Effect.fn("Certification.resolveTierThree")(func
       cases: [],
     });
   }
+
   return CertificationTierThreeReport.make({
     status: "not-exercised",
     evidence: [],
@@ -905,13 +1050,15 @@ export const certifyDurableAdapters = <LedgerE = never, StoreE = never>(
   options: CertifyDurableAdaptersOptions<LedgerE, StoreE>,
 ): Effect.Effect<CertificationReport, LedgerE | StoreE, Crypto.Crypto> => {
   const batchProducers = new Map<BatchId, ProducerId>();
+
   // Interpose the candidate store with an append-time capture of each batch's producer
-  // identity — the one value the ConversationStore port deliberately does not export — so
+  // identity — the one value the ThreadStore port deliberately does not export — so
   // Tier 2's invariant verification recomputes the FULL digest chain instead of skipping it.
-  const capturingStore = Layer.effect(ConversationStore)(
+  const capturingStore = Layer.effect(ThreadStore)(
     Effect.gen(function* () {
-      const inner = yield* ConversationStore;
-      return ConversationStore.of({
+      const inner = yield* ThreadStore;
+
+      return ThreadStore.of({
         ...inner,
         append: (request) =>
           Effect.sync(() => {
@@ -919,13 +1066,15 @@ export const certifyDurableAdapters = <LedgerE = never, StoreE = never>(
           }).pipe(Effect.andThen(inner.append(request))),
       });
     }),
-  ).pipe(Layer.provide(options.conversationStore));
+  ).pipe(Layer.provide(options.threadStore));
 
-  const support = Layer.mergeAll(
+  // RUN-036: certification uses the default-none Tool failure observer. Trusted application
+  // reporting adds no durable transition and is verified separately from adapter certification.
+  const environment = Layer.mergeAll(
     options.submissionLedger,
     capturingStore,
     options.wakeScheduler ?? WakeScheduler.layerNoop,
-    DurableRuntimeFailpoint.layerTest,
+    DurableRuntimeFailpointTestControl.layer,
     ToolReconciler.uncertain,
     DurableRuntimeConfig.layer({
       deploymentId: Schema.decodeSync(DeploymentId)("deployment-certification"),
@@ -935,7 +1084,6 @@ export const certifyDurableAdapters = <LedgerE = never, StoreE = never>(
       abortPollInterval: Duration.millis(50),
     }),
   );
-  const environment = DurableAgentRuntime.layer.pipe(Layer.provideMerge(support));
 
   const leaseAdvance = Duration.millis(
     Duration.toMillis(options.ownershipLeaseDuration ?? DEFAULT_OWNERSHIP_LEASE_DURATION) + 1_000,
@@ -944,11 +1092,73 @@ export const certifyDurableAdapters = <LedgerE = never, StoreE = never>(
   const program = Effect.gen(function* () {
     const ledger = yield* SubmissionLedger;
 
-    // Tier 2 — coordinator failpoint convergence sweep.
+    // Tier 2 — discover each deterministic shape without a fault. Unreached locations
+    // would all repeat this same clean drive, including its full digest verification.
     const tier2: Array<CertificationSweepResult> = [];
+
+    const discoveries: Array<{
+      readonly scenario: CertificationScenario;
+      readonly outcome: SweepOutcome;
+      readonly reached: Set<DurableRuntimeFailpointLocation>;
+    }> = [];
+
     for (const scenario of CERTIFICATION_SCENARIOS) {
+      const reached = new Set<DurableRuntimeFailpointLocation>();
+
+      const outcome = yield* runSweepCell(
+        scenario,
+        undefined,
+        batchProducers,
+        leaseAdvance,
+        reached,
+      );
+
+      discoveries.push({ scenario, outcome, reached });
+    }
+    const observed = new Set(discoveries.flatMap(({ reached }) => [...reached]));
+
+    // Never silently omit a new location: if neither discovery nor the documented
+    // never-fired set accounts for it, arm it in EVERY shape. Tests pin the fired paths
+    // per shape and the never-fired set, so new or lost routes require explicit review.
+    const unaccounted = new Set(
+      DurableRuntimeFailpointLocation.literals.filter(
+        (location) => !observed.has(location) && !TIER2_UNREACHED_LOCATIONS.includes(location),
+      ),
+    );
+
+    for (const discovery of discoveries) {
+      const { scenario, reached } = discovery;
+      const outcomes = new Map<DurableRuntimeFailpointLocation, SweepOutcome>();
+
+      if (discovery.outcome.status !== "failed") {
+        while (true) {
+          // Recovery may expose another route. Discover those too, without re-running a
+          // cell already checked. Schema order bounds this to one drive per location.
+          const location = DurableRuntimeFailpointLocation.literals.find(
+            (candidate) =>
+              !outcomes.has(candidate) && (reached.has(candidate) || unaccounted.has(candidate)),
+          );
+
+          if (location === undefined) break;
+          outcomes.set(
+            location,
+            yield* runSweepCell(scenario, location, batchProducers, leaseAdvance, reached),
+          );
+        }
+      }
       for (const location of DurableRuntimeFailpointLocation.literals) {
-        tier2.push(yield* runSweepCell(scenario, location, batchProducers, leaseAdvance));
+        const outcome = outcomes.get(location) ?? discovery.outcome;
+
+        tier2.push(
+          CertificationSweepResult.make({
+            scenario,
+            location,
+            ...outcome,
+            ...(outcomes.has(location) || outcome.status === "failed"
+              ? {}
+              : { detail: "verified clean scenario did not reach this location" }),
+          }),
+        );
       }
     }
 
@@ -960,13 +1170,8 @@ export const certifyDurableAdapters = <LedgerE = never, StoreE = never>(
     const tier3 = yield* resolveTierThree(capabilities.durability, options);
 
     const generatedAt = yield* nowUtc;
-    const ok =
-      tier1.every((result) => result.status === "passed") &&
-      tier2.every((result) => result.status !== "failed") &&
-      tier3.cases.every((result) => result.status === "passed");
 
-    return CertificationReport.make({
-      format: "effect-agent/certification@1",
+    return makeCertificationReport({
       adapter: CertifiedAdapterIdentity.make({
         name: options.adapter.name,
         ...(options.adapter.version === undefined ? {} : { version: options.adapter.version }),
@@ -976,7 +1181,6 @@ export const certifyDurableAdapters = <LedgerE = never, StoreE = never>(
       tier1,
       tier2,
       tier3,
-      ok,
     });
   });