@feltdb/core 0.13.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/tests/agent_transition_contract_conformance.rs

@@ -1,2884 +0,0 @@
-//! Conformance, determinism and mutation proofs for the
-//! `feltdb.agent.transition` deterministic contract.
-//!
-//! ```text
-//!     Contract semantics are authoritative.
-//!     Runtime implementation is replaceable.
-//!
-//!     NativeTransition(input) == WasmTransition(input) == committed expectation
-//! ```
-//!
-//! The corpus in `tests/fixtures/agent_transition_corpus.json` is committed, not
-//! generated at test time. It has two parts:
-//!
-//! * **cases** -- one decision each, including malformed and raw encodings;
-//! * **sequences** -- ordered steps against a small state model. A step's
-//!   `records` are *derived* from the model by the harness, the decision is
-//!   checked against the committed bytes, and a committed decision is then
-//!   applied to the model. This validates decisions and state evolution:
-//!   that the second of two competing claims is refused *because the first
-//!   changed the state it read*.
-//!
-//! **A sequence is not a concurrency proof.** Nothing here runs two writers at
-//! once, and the WASM module cannot say anything about storage atomicity. The
-//! guarded commit's behaviour under real contention is tested against the real
-//! transaction mechanism in `agent_state_native.rs`.
-//!
-//! Three comparisons run over everything: native == expectation; WASM ==
-//! expectation (needs `wasm32-unknown-unknown`); native == WASM, byte for byte.
-//!
-//! To change the corpus, edit the builder at the bottom of this file and run
-//!
-//! ```text
-//! FELTDB_AGENT_TRANSITION_BLESS=1 cargo test -p feltdb \
-//!     --test agent_transition_contract_conformance -- bless --ignored
-//! ```
-//!
-//! Blessing refuses to record anything unless the WASM implementation is
-//! available and already agrees, so an expectation is never recorded from one
-//! implementation alone.
-
-use feltdb::agent_transition_contract::{
-    evaluate_canonical, AGENT_TRANSITION_CONTRACT_ID, AGENT_TRANSITION_CONTRACT_VERSION,
-};
-use serde_json::{json, Map, Value};
-use std::collections::BTreeMap;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-use std::sync::OnceLock;
-
-// ---------------------------------------------------------------------------
-// Corpus files
-// ---------------------------------------------------------------------------
-
-fn corpus_path() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/agent_transition_corpus.json")
-}
-
-fn corpus() -> &'static Value {
-    static CORPUS: OnceLock<Value> = OnceLock::new();
-    CORPUS.get_or_init(|| {
-        let bytes = std::fs::read(corpus_path()).expect("the corpus is committed");
-        serde_json::from_slice(&bytes).expect("the corpus is well formed")
-    })
-}
-
-fn cases() -> &'static Vec<Value> {
-    corpus()["cases"].as_array().expect("cases")
-}
-
-fn sequences() -> &'static Vec<Value> {
-    corpus()["sequences"].as_array().expect("sequences")
-}
-
-fn text<'a>(value: &'a Value, key: &str) -> &'a str {
-    value[key]
-        .as_str()
-        .unwrap_or_else(|| panic!("missing {key} in {value}"))
-}
-
-/// The exact bytes a case presents to an implementation.
-fn case_bytes(case: &Value) -> Vec<u8> {
-    match (case.get("input"), case.get("raw_input")) {
-        (Some(input), None) => serde_json::to_vec(input).unwrap(),
-        (None, Some(raw)) => raw.as_str().unwrap().as_bytes().to_vec(),
-        _ => panic!(
-            "case {} needs exactly one of input/raw_input",
-            text(case, "name")
-        ),
-    }
-}
-
-// ---------------------------------------------------------------------------
-// The sequential state model
-// ---------------------------------------------------------------------------
-
-/// What the authority holds, as far as the contract can see: records with
-/// versions. `apply` is a *model* of the guarded commit used to evolve state
-/// between sequential steps. It is not the commit mechanism.
-#[derive(Default, Clone)]
-struct World {
-    records: BTreeMap<(String, String), (u64, Value)>,
-}
-
-impl World {
-    fn get(&self, collection: &str, id: &str) -> Option<&(u64, Value)> {
-        self.records.get(&(collection.to_string(), id.to_string()))
-    }
-
-    /// An external record, as a tool would have written it: created at version
-    /// 1, or bumped by one if it already exists.
-    fn seed(&mut self, collection: &str, id: &str) {
-        let key = (collection.to_string(), id.to_string());
-        let next = self.records.get(&key).map_or(1, |(v, _)| v + 1);
-        self.records.insert(key, (next, json!({"seeded": true})));
-    }
-
-    fn stored(&self, collection: &str, id: &str) -> Option<Value> {
-        self.get(collection, id)
-            .map(|(version, value)| json!({"value": value, "version": version}))
-    }
-
-    /// The `records` an operation is decided against, derived the way FeltDB's
-    /// production layer derives them: by reading, never by being told.
-    fn records_for(&self, operation: &Value) -> Value {
-        let op = text(operation, "op");
-        let mut records = Map::new();
-        let mut put = |name: &str, value: Option<Value>| {
-            if let Some(value) = value {
-                records.insert(name.to_string(), value);
-            }
-        };
-        let task_id = match operation.get("task_id").and_then(Value::as_str) {
-            Some(id) => Some(id.to_string()),
-            None => operation
-                .get("handoff_id")
-                .and_then(Value::as_str)
-                .and_then(|h| {
-                    self.get("_feltdb.AgentHandoff", h)
-                        .and_then(|(_, v)| v["task_id"].as_str().map(str::to_string))
-                }),
-        };
-        if let Some(id) = &task_id {
-            put("task", self.stored("_feltdb.AgentTask", id));
-        }
-        if let Some(handoff) = operation.get("handoff_id").and_then(Value::as_str) {
-            put("handoff", self.stored("_feltdb.AgentHandoff", handoff));
-        }
-        if let (Some(task), Some(key)) = (
-            &task_id,
-            operation.get("idempotency_key").and_then(Value::as_str),
-        ) {
-            put(
-                "intent",
-                self.stored("_feltdb.AgentIntent", &format!("{task}~{key}")),
-            );
-        }
-        if matches!(op, "checkpoint" | "record_outcome" | "reconcile") {
-            let seen: Vec<Value> = operation["evidence"]
-                .as_array()
-                .unwrap()
-                .iter()
-                .filter(|r| r["kind"] == "record")
-                .filter_map(|r| {
-                    let (c, i) = (text(r, "collection"), text(r, "id"));
-                    self.get(c, i)
-                        .map(|(v, _)| json!({"collection": c, "id": i, "version": v}))
-                })
-                .collect();
-            records.insert("evidence".into(), Value::Array(seen));
-        }
-        Value::Object(records)
-    }
-
-    /// Applies a committed decision, first checking that every precondition it
-    /// attached holds in the state it was decided against. A contract that
-    /// emitted an unsatisfiable precondition would fail here.
-    fn apply(&mut self, now: u64, output: &Value) -> Result<(), String> {
-        let outcome = &output["outcome"];
-        if outcome["kind"] != "commit" {
-            return Ok(());
-        }
-        let holds =
-            |world: &World, collection: &str, id: &str, version: u64, lease: Option<&str>| {
-                let Some((v, value)) = world.get(collection, id) else {
-                    return false;
-                };
-                *v == version
-                    && lease.is_none_or(|l| {
-                        value["lease"]["leaseId"] == l
-                            && value["lease"]["expiresAt"].as_u64().unwrap() > now
-                    })
-            };
-        for write in outcome["writes"].as_array().unwrap() {
-            let (c, i) = (text(write, "collection"), text(write, "id"));
-            let expect = &write["expect"];
-            if expect["absent"] == true {
-                if self.get(c, i).is_some() {
-                    return Err(format!("{c}/{i} was expected absent"));
-                }
-            } else if !holds(
-                self,
-                c,
-                i,
-                expect["version"].as_u64().unwrap(),
-                expect["lease_id"].as_str(),
-            ) {
-                return Err(format!(
-                    "the contract attached a precondition its own input does not satisfy: {write}"
-                ));
-            }
-        }
-        for guard in outcome["guards"].as_array().unwrap() {
-            let (c, i) = (text(guard, "collection"), text(guard, "id"));
-            if !holds(
-                self,
-                c,
-                i,
-                guard["version"].as_u64().unwrap(),
-                guard["lease_id"].as_str(),
-            ) {
-                return Err(format!("unsatisfied guard {guard}"));
-            }
-        }
-        for write in outcome["writes"].as_array().unwrap() {
-            let key = (
-                text(write, "collection").to_string(),
-                text(write, "id").to_string(),
-            );
-            let next = self.records.get(&key).map_or(1, |(v, _)| v + 1);
-            self.records.insert(key, (next, write["value"].clone()));
-        }
-        Ok(())
-    }
-}
-
-fn step_input(world: &World, step: &Value) -> Value {
-    json!({
-        "contract": AGENT_TRANSITION_CONTRACT_ID,
-        "now_ms": step["now_ms"],
-        "operation": step["operation"],
-        "records": world.records_for(&step["operation"]),
-        "version": AGENT_TRANSITION_CONTRACT_VERSION,
-    })
-}
-
-/// Runs every sequence with `decide`, handing each step's derived input and
-/// decision to `check`. The first divergence from the committed expectation, or
-/// from the state model, is returned rather than panicked, so a mutation test
-/// can ask "was it caught?" without a caught panic.
-fn run_sequences(
-    mut decide: impl FnMut(&[u8]) -> Vec<u8>,
-    mut check: impl FnMut(&str, &str, &str, &str),
-) -> Result<(), String> {
-    for sequence in sequences() {
-        let mut world = World::default();
-        for step in sequence["steps"].as_array().unwrap() {
-            let label = format!("{}/{}", text(sequence, "name"), text(step, "label"));
-            for seed in step["seed"].as_array().into_iter().flatten() {
-                world.seed(text(seed, "collection"), text(seed, "id"));
-            }
-            let input = serde_json::to_vec(&step_input(&world, step)).unwrap();
-            let produced = String::from_utf8(decide(&input)).unwrap();
-            check(
-                &label,
-                text(step, "canonical_input"),
-                std::str::from_utf8(&input).unwrap(),
-                &produced,
-            );
-            if produced != text(step, "expected_output") {
-                return Err(format!(
-                    "{label}\n  expected: {}\n  got:      {produced}",
-                    text(step, "expected_output")
-                ));
-            }
-            let decision: Value = serde_json::from_str(&produced).unwrap();
-            world
-                .apply(step["now_ms"].as_u64().unwrap(), &decision)
-                .map_err(|e| format!("{label}: {e}"))?;
-        }
-    }
-    Ok(())
-}
-
-// ---------------------------------------------------------------------------
-// WASM
-// ---------------------------------------------------------------------------
-
-const WASM_CRATE: &str = "crates/feltdb-agent-transition-contract-wasm";
-const WASM_ARTIFACT: &str =
-    "target/wasm32-unknown-unknown/release/feltdb_agent_transition_contract_wasm.wasm";
-
-fn repository_root() -> &'static Path {
-    Path::new(env!("CARGO_MANIFEST_DIR"))
-        .parent()
-        .and_then(Path::parent)
-        .expect("<root>/crates/feltdb")
-}
-
-/// Whether this machine can compile to WebAssembly. The libdir's existence is
-/// the fact worth having: `rustc` reports every known target as installed.
-fn wasm_target_installed() -> bool {
-    Command::new("rustc")
-        .args([
-            "--print",
-            "target-libdir",
-            "--target",
-            "wasm32-unknown-unknown",
-        ])
-        .output()
-        .ok()
-        .filter(|o| o.status.success())
-        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
-        .is_some_and(|libdir| Path::new(&libdir).is_dir())
-}
-
-fn build_module(manifest_dir: &Path, target_dir: Option<&Path>) -> Vec<u8> {
-    let mut command = Command::new(std::env::var("CARGO").unwrap_or_else(|_| "cargo".into()));
-    command
-        .args(["build", "--release", "--target", "wasm32-unknown-unknown"])
-        .current_dir(manifest_dir)
-        .env_remove("CARGO_TARGET_DIR")
-        .env_remove("RUSTFLAGS");
-    if let Some(dir) = target_dir {
-        command.env("CARGO_TARGET_DIR", dir);
-    }
-    let output = command.output().expect("cargo is runnable");
-    assert!(
-        output.status.success(),
-        "building the WASM contract at {} failed:\n{}",
-        manifest_dir.display(),
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let built = match target_dir {
-        Some(dir) => {
-            dir.join("wasm32-unknown-unknown/release/feltdb_agent_transition_contract_wasm.wasm")
-        }
-        None => manifest_dir.join(WASM_ARTIFACT),
-    };
-    std::fs::read(built).expect("the build emits one module")
-}
-
-fn contract_module() -> Option<&'static [u8]> {
-    static MODULE: OnceLock<Option<Vec<u8>>> = OnceLock::new();
-    MODULE
-        .get_or_init(|| {
-            if let Ok(path) = std::env::var("FELTDB_AGENT_TRANSITION_CONTRACT_WASM") {
-                return Some(
-                    std::fs::read(path).expect("FELTDB_AGENT_TRANSITION_CONTRACT_WASM is readable"),
-                );
-            }
-            wasm_target_installed().then(|| build_module(&repository_root().join(WASM_CRATE), None))
-        })
-        .as_deref()
-}
-
-fn skipped(test: &str) {
-    eprintln!(
-        "SKIPPED {test}: the wasm32-unknown-unknown target is not installed, so the WASM contract \
-         could not be built. Native conformance against the committed expectations still ran."
-    );
-}
-
-struct WasmContract {
-    store: wasmi::Store<()>,
-    memory: wasmi::Memory,
-    alloc: wasmi::TypedFunc<u32, u32>,
-    evaluate: wasmi::TypedFunc<(u32, u32), u64>,
-    free: wasmi::TypedFunc<(u32, u32), ()>,
-}
-
-impl WasmContract {
-    fn instantiate(bytes: &[u8]) -> Self {
-        let engine = wasmi::Engine::default();
-        let module = wasmi::Module::new(&engine, bytes).expect("the module validates");
-        let mut store = wasmi::Store::new(&engine, ());
-        let instance = wasmi::Linker::<()>::new(&engine)
-            .instantiate_and_start(&mut store, &module)
-            .expect("an empty linker satisfies a module with no imports");
-        Self {
-            memory: instance.get_memory(&store, "memory").expect("memory"),
-            alloc: instance
-                .get_typed_func(&store, "contract_alloc")
-                .expect("contract_alloc"),
-            evaluate: instance
-                .get_typed_func(&store, "contract_evaluate")
-                .expect("contract_evaluate"),
-            free: instance
-                .get_typed_func(&store, "contract_free")
-                .expect("contract_free"),
-            store,
-        }
-    }
-
-    fn evaluate(&mut self, input: &[u8]) -> Vec<u8> {
-        let len = input.len() as u32;
-        let ptr = self.alloc.call(&mut self.store, len).expect("allocation");
-        self.memory
-            .write(&mut self.store, ptr as usize, input)
-            .expect("input fits");
-        let packed = self
-            .evaluate
-            .call(&mut self.store, (ptr, len))
-            .expect("the contract never traps");
-        let (out_ptr, out_len) = ((packed >> 32) as usize, (packed & 0xffff_ffff) as usize);
-        let mut output = vec![0u8; out_len];
-        self.memory
-            .read(&self.store, out_ptr, &mut output)
-            .expect("output in memory");
-        self.free.call(&mut self.store, (ptr, len)).expect("free");
-        self.free
-            .call(&mut self.store, (out_ptr as u32, out_len as u32))
-            .expect("free");
-        output
-    }
-}
-
-fn wasm_or_skip(test: &str) -> Option<WasmContract> {
-    match contract_module() {
-        Some(bytes) => Some(WasmContract::instantiate(bytes)),
-        None => {
-            skipped(test);
-            None
-        }
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Conformance
-// ---------------------------------------------------------------------------
-
-#[test]
-fn corpus_addresses_this_contract_at_this_version() {
-    let corpus = corpus();
-    assert_eq!(corpus["corpus_version"], 1);
-    assert_eq!(corpus["contract"], AGENT_TRANSITION_CONTRACT_ID);
-    assert_eq!(
-        corpus["contract_version"],
-        AGENT_TRANSITION_CONTRACT_VERSION
-    );
-    assert!(
-        cases().len() >= 300,
-        "the corpus is the proof; it should not shrink silently"
-    );
-    assert!(sequences().len() >= 12);
-    let mut names: Vec<&str> = cases().iter().map(|c| text(c, "name")).collect();
-    names.sort_unstable();
-    let total = names.len();
-    names.dedup();
-    assert_eq!(total, names.len(), "case names identify cases");
-}
-
-#[test]
-fn native_matches_the_committed_expectations() {
-    let mut divergent = Vec::new();
-    for case in cases() {
-        let produced = String::from_utf8(evaluate_canonical(&case_bytes(case))).unwrap();
-        if produced != text(case, "expected_output") {
-            divergent.push(format!(
-                "{}\n  expected: {}\n  native:   {}",
-                text(case, "name"),
-                text(case, "expected_output"),
-                produced
-            ));
-        }
-    }
-    assert!(
-        divergent.is_empty(),
-        "{} divergent:\n{}",
-        divergent.len(),
-        divergent.join("\n")
-    );
-}
-
-#[test]
-fn native_sequences_match_the_committed_expectations() {
-    run_sequences(
-        evaluate_canonical,
-        |step, committed_input, derived_input, _| {
-            assert_eq!(
-                derived_input, committed_input,
-                "{step}: the harness derived different records than were committed"
-            );
-        },
-    )
-    .unwrap();
-}
-
-#[test]
-fn wasm_matches_the_committed_expectations() {
-    let Some(mut wasm) = wasm_or_skip("wasm_matches_the_committed_expectations") else {
-        return;
-    };
-    let mut divergent = Vec::new();
-    for case in cases() {
-        let produced = String::from_utf8(wasm.evaluate(&case_bytes(case))).unwrap();
-        if produced != text(case, "expected_output") {
-            divergent.push(format!(
-                "{}\n  expected: {}\n  wasm:     {}",
-                text(case, "name"),
-                text(case, "expected_output"),
-                produced
-            ));
-        }
-    }
-    assert!(
-        divergent.is_empty(),
-        "{} divergent:\n{}",
-        divergent.len(),
-        divergent.join("\n")
-    );
-    run_sequences(|input| wasm.evaluate(input), |_, _, _, _| {}).unwrap();
-}
-
-#[test]
-fn native_and_wasm_agree_byte_for_byte() {
-    let Some(mut wasm) = wasm_or_skip("native_and_wasm_agree_byte_for_byte") else {
-        return;
-    };
-    for case in cases() {
-        let bytes = case_bytes(case);
-        assert_eq!(
-            evaluate_canonical(&bytes),
-            wasm.evaluate(&bytes),
-            "{}",
-            text(case, "name")
-        );
-    }
-}
-
-/// Every output is canonical: parsing it and writing it back changes nothing.
-#[test]
-fn every_committed_output_is_canonical() {
-    let mut all: Vec<&str> = cases().iter().map(|c| text(c, "expected_output")).collect();
-    for sequence in sequences() {
-        all.extend(
-            sequence["steps"]
-                .as_array()
-                .unwrap()
-                .iter()
-                .map(|s| text(s, "expected_output")),
-        );
-    }
-    for output in all {
-        let value: Value = serde_json::from_str(output).unwrap();
-        assert_eq!(serde_json::to_string(&value).unwrap(), output);
-        assert_eq!(value["contract"], AGENT_TRANSITION_CONTRACT_ID);
-        assert_eq!(value["version"], AGENT_TRANSITION_CONTRACT_VERSION);
-        assert!(
-            value.get("error").is_some() != value.get("outcome").is_some(),
-            "exactly one of error/outcome"
-        );
-    }
-}
-
-/// The corpus exercises every operation and every refusal code. A guard against
-/// the corpus losing a dimension, not a substitute for reading it.
-#[test]
-fn corpus_covers_every_operation_and_every_error_code() {
-    let mut codes = std::collections::BTreeSet::new();
-    let mut committed_ops = std::collections::BTreeSet::new();
-    let mut outputs: Vec<(Option<String>, String)> = Vec::new();
-    for case in cases() {
-        let op = case
-            .get("input")
-            .and_then(|i| i["operation"]["op"].as_str())
-            .map(str::to_string);
-        outputs.push((op, text(case, "expected_output").to_string()));
-    }
-    for sequence in sequences() {
-        for step in sequence["steps"].as_array().unwrap() {
-            outputs.push((
-                Some(text(&step["operation"], "op").to_string()),
-                text(step, "expected_output").to_string(),
-            ));
-        }
-    }
-    for (op, output) in outputs {
-        let value: Value = serde_json::from_str(&output).unwrap();
-        if let Some(code) = value["error"]["code"].as_str() {
-            codes.insert(code.to_string());
-        } else if value["outcome"]["kind"] == "commit" {
-            committed_ops.extend(op);
-        }
-    }
-    for code in [
-        "CONTRACT_INPUT_INVALID",
-        "CONTRACT_ID_MISMATCH",
-        "CONTRACT_VERSION_UNSUPPORTED",
-        "NOT_FOUND",
-        "ALREADY_EXISTS",
-        "INVALID_TRANSITION",
-        "TERMINAL",
-        "FENCE_STALE",
-        "OWNERSHIP_CONFLICT",
-        "LEASE_MISMATCH",
-        "LEASE_EXPIRED",
-        "LEASE_HELD",
-        "VERSION_CONFLICT",
-        "EVIDENCE_INVALID",
-        "EVIDENCE_REQUIRED",
-        "OUTCOME_UNCERTAIN",
-        "INTENT_UNKNOWN",
-        "INTENT_RESOLVED",
-        "HANDOFF_CLAIMED",
-        "HANDOFF_STALE",
-    ] {
-        assert!(codes.contains(code), "no corpus entry produces {code}");
-    }
-    for op in [
-        "create_task",
-        "acquire",
-        "renew",
-        "checkpoint",
-        "record_intent",
-        "record_outcome",
-        "reconcile",
-        "create_handoff",
-        "claim_handoff",
-        "accept_handoff",
-    ] {
-        assert!(committed_ops.contains(op), "no corpus entry commits {op}");
-    }
-}
-
-/// Properties that must hold of every decision in the corpus, whatever the
-/// individual expectation says. These are the contract's invariants, stated
-/// independently of any one case.
-#[test]
-fn invariants_hold_for_every_decision() {
-    let mut outputs: Vec<(Value, Value)> = Vec::new();
-    for case in cases() {
-        if let Some(input) = case.get("input") {
-            outputs.push((
-                input.clone(),
-                serde_json::from_str(text(case, "expected_output")).unwrap(),
-            ));
-        }
-    }
-    run_sequences(evaluate_canonical, |_, _, derived, produced| {
-        outputs.push((
-            serde_json::from_str(derived).unwrap(),
-            serde_json::from_str(produced).unwrap(),
-        ));
-    })
-    .unwrap();
-    for (input, output) in outputs {
-        let outcome = &output["outcome"];
-        if outcome["kind"] != "commit" {
-            continue;
-        }
-        let op = text(&input["operation"], "op");
-        let now = input["now_ms"].as_u64().unwrap();
-        let writes = outcome["writes"].as_array().unwrap();
-        for write in writes {
-            // Every write is conditional: there is no blind overwrite.
-            assert!(
-                write["expect"].is_object() && !write["expect"].as_object().unwrap().is_empty()
-            );
-            // A stored citation is `verified` only if it names the version FeltDB observed.
-            let value = &write["value"];
-            for citation in value["evidence"].as_array().into_iter().flatten() {
-                if citation["verified"] == true {
-                    assert_eq!(citation["kind"], "record");
-                    assert!(
-                        citation["version"].as_u64().is_some(),
-                        "a verified citation pins a version"
-                    );
-                    assert!(
-                        outcome["guards"]
-                            .as_array()
-                            .unwrap()
-                            .iter()
-                            .any(|g| g["collection"] == citation["collection"]
-                                && g["id"] == citation["id"]
-                                && g["version"] == citation["version"]),
-                        "a verified citation must be guarded: {citation}"
-                    );
-                } else {
-                    assert_eq!(
-                        citation["kind"], "external",
-                        "only external citations are unverified"
-                    );
-                }
-            }
-            // A lease written by a commit is live at the moment of the decision, and a
-            // newly granted or renewed one is at most the cap long.
-            if let Some(expires) = value["lease"]["expiresAt"].as_u64() {
-                assert!(
-                    expires > now,
-                    "a commit never writes an already-expired lease"
-                );
-                if matches!(op, "create_task" | "acquire" | "renew" | "claim_handoff") {
-                    assert!(expires - now <= 86_400_000);
-                }
-            }
-        }
-        // A completion cites at least one verified record, and no unresolved action remains.
-        let completing = writes.iter().find(|w| {
-            w["collection"] == "_feltdb.AgentTask" && w["value"]["status"] == "completed"
-        });
-        if let Some(task) = completing {
-            assert_eq!(op, "checkpoint");
-            assert_eq!(
-                task["value"]["unresolved_intents"], 0,
-                "completed with an unresolved action"
-            );
-            assert!(
-                task["value"]["lease"].is_null(),
-                "a terminal task holds no lease"
-            );
-            let checkpoint = writes
-                .iter()
-                .find(|w| w["collection"] == "_feltdb.AgentCheckpoint")
-                .unwrap();
-            assert!(
-                checkpoint["value"]["evidence"]
-                    .as_array()
-                    .unwrap()
-                    .iter()
-                    .any(|c| c["kind"] == "record" && c["verified"] == true),
-                "a completion without a verified record citation"
-            );
-        }
-        // Owner-bearing writes fence on the lease they relied on.
-        if matches!(
-            op,
-            "renew" | "checkpoint" | "record_intent" | "record_outcome" | "reconcile"
-        ) {
-            let task = writes
-                .iter()
-                .find(|w| w["collection"] == "_feltdb.AgentTask")
-                .unwrap();
-            assert!(
-                task["expect"]["lease_id"].is_string(),
-                "{op} must fence on the lease"
-            );
-            assert!(task["expect"]["version"].is_u64());
-        }
-        // A takeover changes the fence by exactly one.
-        if matches!(op, "acquire" | "claim_handoff") {
-            let before = input["records"]["task"]["value"]["fence"].as_u64().unwrap();
-            let task = writes
-                .iter()
-                .find(|w| w["collection"] == "_feltdb.AgentTask")
-                .unwrap();
-            assert_eq!(task["value"]["fence"].as_u64().unwrap(), before + 1);
-        }
-    }
-}
-
-#[test]
-fn evaluation_is_deterministic_across_repeats() {
-    for case in cases().iter().step_by(7) {
-        let bytes = case_bytes(case);
-        let first = evaluate_canonical(&bytes);
-        for _ in 0..8 {
-            assert_eq!(evaluate_canonical(&bytes), first);
-        }
-    }
-}
-
-#[test]
-fn wasm_is_deterministic_across_fresh_instances() {
-    let Some(bytes) = contract_module() else {
-        return skipped("wasm_is_deterministic_across_fresh_instances");
-    };
-    let mut a = WasmContract::instantiate(bytes);
-    for case in cases().iter().step_by(11) {
-        let input = case_bytes(case);
-        let first = a.evaluate(&input);
-        assert_eq!(
-            WasmContract::instantiate(bytes).evaluate(&input),
-            first,
-            "{}",
-            text(case, "name")
-        );
-        assert_eq!(a.evaluate(&input), first);
-    }
-}
-
-/// Member order and whitespace in the input are not semantics.
-#[test]
-fn canonical_and_pretty_encodings_decide_identically() {
-    for case in cases()
-        .iter()
-        .filter(|c| c.get("input").is_some())
-        .step_by(5)
-    {
-        let input = &case["input"];
-        let pretty = serde_json::to_vec_pretty(input).unwrap();
-        assert_eq!(
-            evaluate_canonical(&pretty),
-            evaluate_canonical(&case_bytes(case)),
-            "{}",
-            text(case, "name")
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// The WASM module's capabilities
-// ---------------------------------------------------------------------------
-
-#[test]
-fn wasm_module_declares_no_imports_and_exports_only_the_abi() {
-    let Some(bytes) = contract_module() else {
-        return skipped("wasm_module_declares_no_imports");
-    };
-    let engine = wasmi::Engine::default();
-    let module = wasmi::Module::new(&engine, bytes).unwrap();
-    let imports: Vec<String> = module
-        .imports()
-        .map(|i| format!("{}::{}", i.module(), i.name()))
-        .collect();
-    assert!(
-        imports.is_empty(),
-        "the module must not import anything: {imports:?}"
-    );
-    // Older toolchains (CI builds with 1.96) make the linker export two address globals, the end of
-    // static data and the start of the heap. They are numbers, not behavior; newer toolchains omit
-    // them. Tolerate exactly those two names, and only as globals: anything else, or either of them
-    // as a function, is a new capability and fails.
-    const LINKER_ADDRESS_GLOBALS: [&str; 2] = ["__data_end", "__heap_base"];
-    let mut exports: Vec<String> = Vec::new();
-    for export in module.exports() {
-        let name = export.name();
-        if LINKER_ADDRESS_GLOBALS.contains(&name) {
-            assert!(
-                export.ty().global().is_some(),
-                "{name} may only be exported as a global"
-            );
-            continue;
-        }
-        exports.push(name.to_string());
-    }
-    exports.sort();
-    assert_eq!(
-        exports,
-        [
-            "contract_alloc",
-            "contract_evaluate",
-            "contract_free",
-            "contract_version",
-            "memory"
-        ]
-    );
-    let mut store = wasmi::Store::new(&engine, ());
-    let instance = wasmi::Linker::<()>::new(&engine)
-        .instantiate_and_start(&mut store, &module)
-        .unwrap();
-    let version = instance
-        .get_typed_func::<(), u32>(&store, "contract_version")
-        .unwrap()
-        .call(&mut store, ())
-        .unwrap();
-    assert_eq!(version, AGENT_TRANSITION_CONTRACT_VERSION);
-    for forbidden in [
-        "clock_time_get",
-        "random_get",
-        "fd_read",
-        "fd_write",
-        "sock_recv",
-        "path_open",
-        "wasi_snapshot",
-    ] {
-        assert!(
-            !bytes
-                .windows(forbidden.len())
-                .any(|w| w == forbidden.as_bytes()),
-            "WASI symbol {forbidden}"
-        );
-    }
-}
-
-#[test]
-fn wasm_never_traps_on_hostile_input() {
-    let Some(mut wasm) = wasm_or_skip("wasm_never_traps_on_hostile_input") else {
-        return;
-    };
-    let deep = format!("{}{}", "[".repeat(5000), "]".repeat(5000));
-    let long_string = format!("{{\"contract\":\"{}\"}}", "x".repeat(200_000));
-    let hostile: Vec<Vec<u8>> = vec![
-        vec![],
-        b"\xff\xfe".to_vec(),
-        b"{".to_vec(),
-        deep.into_bytes(),
-        long_string.into_bytes(),
-        b"{\"contract\":\"\\ud800\"}".to_vec(),
-        vec![0u8; 4096],
-    ];
-    for input in hostile {
-        let out = wasm.evaluate(&input);
-        assert_eq!(
-            String::from_utf8(out).unwrap(),
-            String::from_utf8(evaluate_canonical(&input)).unwrap()
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Mutation: a corpus that has never failed proves nothing
-// ---------------------------------------------------------------------------
-
-/// Seeded defects in a copy of the real WASM source. Each must be caught by at
-/// least one committed expectation. The anchors must occur exactly once, so a
-/// refactor that moves them fails here instead of silently disarming the test.
-const MUTATIONS: &[(&str, &str, &str)] = &[
-    ("lease expiry boundary is exclusive of now == expiresAt", "if now >= lease.expires_at {", "if now > lease.expires_at {"),
-    ("an unexpired lease may be taken at its last millisecond", "if now < held.expires_at {\n        return Err(Code::LeaseHeld);", "if now + 1 < held.expires_at {\n        return Err(Code::LeaseHeld);"),
-    ("the fence is not checked", "if fence != t.fence {", "if false {"),
-    ("ownership is not checked", "if actor != t.owner {", "if false {"),
-    ("completion needs no evidence", "if status == \"completed\" {\n        if c.verified == 0 {", "if status == \"completed\" {\n        if false {"),
-    ("completion ignores unresolved actions", "if t.unresolved > 0 {", "if false {"),
-    ("reconciliation needs no evidence", "        if c.verified == 0 {\n            return Err(Code::EvidenceRequired);\n        }\n        n.conclusion", "        n.conclusion"),
-    ("an unverified outcome resolves the action", "resolves = c.verified > 0;", "resolves = true;"),
-    ("an agent record may be cited as evidence", "if c.starts_with(AGENT_PREFIX) {", "if false {"),
-    ("a recorded intent may be recorded again", "if let Some(existing) = &rec.intent {", "if let (Some(existing), true) = (&rec.intent, false) {"),
-    ("ready may complete directly", "(\"ready\", \"cancelled\")", "(\"ready\", \"completed\") | (\"ready\", \"cancelled\")"),
-    ("a retried claim must match the lease", "&& held.id == new_id;", "&& true;"),
-    ("cited evidence is not guarded", "guards.push((c, i, s.version));", "guards.push((c, i, s.version)); guards.clear();"),
-    ("a terminal task keeps its lease", "if is_terminal(&status) {\n        n.lease = None;", "if false {\n        n.lease = None;"),
-    ("a stale handoff is claimable", "} else if t.owner != h.from", "} else if false && t.owner != h.from"),
-];
-
-#[test]
-fn every_seeded_defect_is_caught_by_the_corpus() {
-    if !wasm_target_installed() {
-        return skipped("every_seeded_defect_is_caught_by_the_corpus");
-    }
-    let source = repository_root().join(WASM_CRATE);
-    let decide = std::fs::read_to_string(source.join("src/decide.rs")).unwrap();
-    let scratch =
-        std::env::temp_dir().join(format!("agent-transition-mutants-{}", std::process::id()));
-    let _ = std::fs::remove_dir_all(&scratch);
-    // Anchors are text in a formatted file. Check them all before building any,
-    // so a reformat that moves several is reported once, not one build at a time.
-    let unanchored: Vec<&str> = MUTATIONS
-        .iter()
-        .filter(|(_, anchor, _)| decide.matches(anchor).count() != 1)
-        .map(|(name, _, _)| *name)
-        .collect();
-    assert!(
-        unanchored.is_empty(),
-        "mutation anchors that no longer occur exactly once: {unanchored:?}"
-    );
-    let mut missed = Vec::new();
-    let mut report = Vec::new();
-    for (index, (name, anchor, replacement)) in MUTATIONS.iter().enumerate() {
-        let dir = scratch.join(format!("m{index}"));
-        std::fs::create_dir_all(dir.join("src")).unwrap();
-        for file in ["Cargo.toml", "src/lib.rs", "src/json.rs"] {
-            std::fs::copy(source.join(file), dir.join(file)).unwrap();
-        }
-        std::fs::write(
-            dir.join("src/decide.rs"),
-            decide.replacen(anchor, replacement, 1),
-        )
-        .unwrap();
-        let module = build_module(&dir, Some(&scratch.join("target")));
-        let mut wasm = WasmContract::instantiate(&module);
-        let mut caught = 0;
-        for case in cases() {
-            if String::from_utf8(wasm.evaluate(&case_bytes(case))).unwrap()
-                != text(case, "expected_output")
-            {
-                caught += 1;
-            }
-        }
-        let sequence_caught = run_sequences(|input| wasm.evaluate(input), |_, _, _, _| {}).is_err();
-        if caught == 0 && !sequence_caught {
-            missed.push(*name);
-        }
-        report.push(format!(
-            "{caught:>4} cases{} | {name}",
-            if sequence_caught { " + a sequence" } else { "" }
-        ));
-    }
-    let _ = std::fs::remove_dir_all(&scratch);
-    eprintln!("mutation results:\n{}", report.join("\n"));
-    assert!(
-        missed.is_empty(),
-        "defects the corpus did not catch: {missed:?}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Blessing
-// ---------------------------------------------------------------------------
-
-#[test]
-#[ignore = "re-records the committed corpus; run deliberately"]
-fn bless() {
-    assert_eq!(
-        std::env::var("FELTDB_AGENT_TRANSITION_BLESS").as_deref(),
-        Ok("1"),
-        "set FELTDB_AGENT_TRANSITION_BLESS=1"
-    );
-    let module = contract_module().expect(
-        "blessing needs the WASM implementation: refusing to record from one implementation alone",
-    );
-    let mut wasm = WasmContract::instantiate(module);
-    let mut recorded_cases = Vec::new();
-    for mut case in build::cases() {
-        let bytes = case_bytes(&case);
-        let native = evaluate_canonical(&bytes);
-        assert_eq!(
-            native,
-            wasm.evaluate(&bytes),
-            "implementations disagree on {}",
-            text(&case, "name")
-        );
-        // Typed cases carry their canonical bytes, so a consumer that cannot
-        // reproduce them (JavaScript has no u64) presents exactly the same input.
-        if case.get("input").is_some() {
-            case["canonical_input"] = Value::String(String::from_utf8(bytes).unwrap());
-        }
-        case["expected_output"] = Value::String(String::from_utf8(native).unwrap());
-        recorded_cases.push(case);
-    }
-    let mut recorded_sequences = Vec::new();
-    for mut sequence in build::sequences() {
-        let mut world = World::default();
-        for step in sequence["steps"].as_array_mut().unwrap() {
-            for seed in step["seed"].as_array().into_iter().flatten() {
-                world.seed(text(seed, "collection"), text(seed, "id"));
-            }
-            let input = serde_json::to_vec(&step_input(&world, step)).unwrap();
-            let native = evaluate_canonical(&input);
-            assert_eq!(
-                native,
-                wasm.evaluate(&input),
-                "implementations disagree on {}",
-                text(step, "label")
-            );
-            step["canonical_input"] = Value::String(String::from_utf8(input).unwrap());
-            step["expected_output"] = Value::String(String::from_utf8(native.clone()).unwrap());
-            world
-                .apply(
-                    step["now_ms"].as_u64().unwrap(),
-                    &serde_json::from_slice(&native).unwrap(),
-                )
-                .unwrap();
-        }
-        recorded_sequences.push(sequence);
-    }
-    let corpus = json!({
-        "corpus_version": 1,
-        "contract": AGENT_TRANSITION_CONTRACT_ID,
-        "contract_version": AGENT_TRANSITION_CONTRACT_VERSION,
-        "about": "Committed conformance corpus for feltdb.agent.transition v1. Cases are single decisions; \
-                  sequences are ordered steps whose records the harness derives from a state model. \
-                  Regenerate only with the bless test in agent_transition_contract_conformance.rs.",
-        "cases": recorded_cases,
-        "sequences": recorded_sequences,
-    });
-    let mut text = serde_json::to_string_pretty(&corpus).unwrap();
-    text.push('\n');
-    std::fs::write(corpus_path(), text).unwrap();
-}
-
-/// The corpus builder. Used only by `bless`; the committed JSON is the artifact.
-mod build {
-    use super::*;
-
-    pub fn input(now: u64, operation: Value, records: Value) -> Value {
-        json!({
-            "contract": AGENT_TRANSITION_CONTRACT_ID, "now_ms": now, "operation": operation,
-            "records": records, "version": AGENT_TRANSITION_CONTRACT_VERSION,
-        })
-    }
-
-    fn stored(value: Value, version: u64) -> Value {
-        json!({"value": value, "version": version})
-    }
-
-    pub fn task(f: impl FnOnce(&mut Value)) -> Value {
-        let mut value = json!({
-            "checkpoint_version": 3, "created_at_ms": 1000, "fence": 2,
-            "lease": {"expiresAt": 10000, "leaseId": "L2"}, "objective": "Ship it",
-            "owner": "agent-a", "status": "running", "task_id": "t1",
-            "unresolved_intents": 0, "updated_at_ms": 2000,
-        });
-        f(&mut value);
-        stored(value, 7)
-    }
-
-    fn terminal_task(status: &str) -> Value {
-        task(|t| {
-            t["status"] = json!(status);
-            t["lease"] = Value::Null;
-        })
-    }
-
-    fn handoff(f: impl FnOnce(&mut Value)) -> Value {
-        let mut value = json!({
-            "checkpoint_version": 3, "from": "agent-a", "from_fence": 2,
-            "handoff_id": "h1", "status": "open", "task_id": "t1", "to": "agent-b",
-        });
-        f(&mut value);
-        stored(value, 4)
-    }
-
-    fn claimed_handoff(claimant: &str, fence: u64) -> Value {
-        handoff(|h| {
-            h["status"] = json!("claimed");
-            h["claimant"] = json!(claimant);
-            h["claimed_fence"] = json!(fence);
-        })
-    }
-
-    fn intent(state: &str) -> Value {
-        let mut value = json!({
-            "action": "send-email", "evidence": [], "intended_at_ms": 3000, "intended_fence": 2,
-            "key": "k1", "state": state, "task_id": "t1", "verified": false,
-        });
-        if state != "intended" {
-            value["result"] = json!("succeeded");
-        }
-        if state == "resolved" {
-            value["verified"] = json!(true);
-            value["evidence"] = json!([{"collection": "receipts", "id": "r0", "kind": "record", "verified": true, "version": 1}]);
-        }
-        stored(value, 3)
-    }
-
-    fn with_unresolved(n: u64) -> Value {
-        task(|t| t["unresolved_intents"] = json!(n))
-    }
-
-    fn rec(collection: &str, id: &str) -> Value {
-        json!({"collection": collection, "id": id, "kind": "record"})
-    }
-
-    fn ext(uri: &str) -> Value {
-        json!({"kind": "external", "uri": uri})
-    }
-
-    fn seen(collection: &str, id: &str, version: u64) -> Value {
-        json!({"collection": collection, "id": id, "version": version})
-    }
-
-    fn base_op(op: &str) -> Value {
-        match op {
-            "create_task" => {
-                json!({"op": "create_task", "task_id": "t1", "actor": "agent-a", "objective": "Ship it", "lease_id": "L1", "lease_ms": 60000})
-            }
-            "acquire" => {
-                json!({"op": "acquire", "task_id": "t1", "actor": "agent-b", "lease_id": "L3", "lease_ms": 60000})
-            }
-            "renew" => {
-                json!({"op": "renew", "task_id": "t1", "actor": "agent-a", "fence": 2, "lease_id": "L2", "lease_ms": 60000})
-            }
-            "checkpoint" => {
-                json!({"op": "checkpoint", "task_id": "t1", "actor": "agent-a", "fence": 2, "lease_id": "L2", "expected_version": 3, "summary": "Halfway.", "evidence": []})
-            }
-            "record_intent" => {
-                json!({"op": "record_intent", "task_id": "t1", "actor": "agent-a", "fence": 2, "lease_id": "L2", "idempotency_key": "k1", "action": "send-email"})
-            }
-            "record_outcome" => {
-                json!({"op": "record_outcome", "task_id": "t1", "actor": "agent-a", "fence": 2, "lease_id": "L2", "idempotency_key": "k1", "result": "succeeded", "evidence": [rec("receipts", "r1")]})
-            }
-            "reconcile" => {
-                json!({"op": "reconcile", "task_id": "t1", "actor": "agent-a", "fence": 2, "lease_id": "L2", "idempotency_key": "k1", "conclusion": "executed", "evidence": [rec("receipts", "r1")]})
-            }
-            "create_handoff" => {
-                json!({"op": "create_handoff", "task_id": "t1", "handoff_id": "h1", "actor": "agent-a", "fence": 2, "lease_id": "L2", "to": "agent-b"})
-            }
-            "claim_handoff" => {
-                json!({"op": "claim_handoff", "handoff_id": "h1", "claimant": "agent-b", "lease_id": "L3", "lease_ms": 60000})
-            }
-            "accept_handoff" => {
-                json!({"op": "accept_handoff", "handoff_id": "h1", "claimant": "agent-b", "fence": 3, "lease_id": "L3"})
-            }
-            other => panic!("{other}"),
-        }
-    }
-
-    fn with(mut op: Value, changes: Value) -> Value {
-        for (key, value) in changes.as_object().unwrap() {
-            if value.is_null() {
-                op.as_object_mut().unwrap().remove(key);
-            } else {
-                op[key] = value.clone();
-            }
-        }
-        op
-    }
-
-    /// The valid base input for each operation, with the records it needs.
-    fn base(op: &str) -> (u64, Value, Value) {
-        let operation = base_op(op);
-        let receipts = json!([seen("receipts", "r1", 1)]);
-        let (now, records) = match op {
-            "create_task" => (5000, json!({})),
-            "acquire" => (12000, json!({"task": task(|_| {})})),
-            "renew" => (5000, json!({"task": task(|_| {})})),
-            "checkpoint" => (5000, json!({"task": task(|_| {}), "evidence": []})),
-            "record_intent" => (5000, json!({"task": task(|_| {})})),
-            "record_outcome" | "reconcile" => (
-                5000,
-                json!({"task": with_unresolved(1), "intent": intent("intended"), "evidence": receipts}),
-            ),
-            "create_handoff" => (5000, json!({"task": task(|_| {})})),
-            "claim_handoff" => (
-                5000,
-                json!({"task": task(|_| {}), "handoff": handoff(|_| {})}),
-            ),
-            "accept_handoff" => (
-                5000,
-                json!({
-                    "task": task(|t| { t["fence"] = json!(3); t["owner"] = json!("agent-b"); t["lease"] = json!({"expiresAt": 65000, "leaseId": "L3"}); }),
-                    "handoff": claimed_handoff("agent-b", 3),
-                }),
-            ),
-            other => panic!("{other}"),
-        };
-        (now, operation, records)
-    }
-
-    const OPS: [&str; 10] = [
-        "create_task",
-        "acquire",
-        "renew",
-        "checkpoint",
-        "record_intent",
-        "record_outcome",
-        "reconcile",
-        "create_handoff",
-        "claim_handoff",
-        "accept_handoff",
-    ];
-
-    pub fn cases() -> Vec<Value> {
-        let mut out: Vec<Value> = Vec::new();
-        let mut add = |name: String, why: &str, input: Value| {
-            out.push(json!({"name": name, "why": why, "input": input}));
-        };
-
-        // Every operation's valid base input.
-        for op in OPS {
-            let (now, operation, records) = base(op);
-            add(
-                format!("{op}/valid"),
-                "the base input of the operation commits",
-                input(now, operation, records),
-            );
-        }
-
-        // Structural mutations of every base input: the shape is part of the contract.
-        for op in OPS {
-            let (now, operation, records) = base(op);
-            let members: Vec<String> = operation.as_object().unwrap().keys().cloned().collect();
-            for member in members.iter().filter(|m| *m != "op") {
-                for (variant, replacement) in [
-                    ("removed", None),
-                    ("null", Some(Value::Null)),
-                    ("array", Some(json!([]))),
-                    ("number_float", Some(json!(1.5))),
-                ] {
-                    let mut mutated = operation.clone();
-                    match replacement {
-                        None => {
-                            mutated.as_object_mut().unwrap().remove(member);
-                        }
-                        Some(v) => mutated[member] = v,
-                    }
-                    add(
-                        format!("{op}/member/{member}/{variant}"),
-                        "an operation carries exactly its defined members, typed",
-                        input(now, mutated, records.clone()),
-                    );
-                }
-            }
-            let mut extra = operation.clone();
-            extra["unexpected"] = json!(true);
-            add(
-                format!("{op}/member/unexpected/added"),
-                "an unknown member is refused",
-                input(now, extra, records.clone()),
-            );
-            for key in records.as_object().unwrap().keys() {
-                let mut nulled = records.clone();
-                nulled[key] = Value::Null;
-                add(
-                    format!("{op}/records/{key}/null"),
-                    "a record key is present iff the record exists, never null",
-                    input(now, operation.clone(), nulled),
-                );
-            }
-            let mut stray = records.clone();
-            stray["stray"] = json!({});
-            add(
-                format!("{op}/records/stray"),
-                "an unknown records member is refused",
-                input(now, operation.clone(), stray),
-            );
-            for field in ["contract", "now_ms", "operation", "records", "version"] {
-                let mut full = input(now, operation.clone(), records.clone());
-                full.as_object_mut().unwrap().remove(field);
-                add(
-                    format!("{op}/envelope/{field}/removed"),
-                    "the envelope has exactly five members",
-                    full,
-                );
-            }
-        }
-
-        // Identity and version.
-        for (name, contract, version) in [
-            ("wrong_contract", json!("feltdb.trigger.match"), json!(1)),
-            ("version_two", json!("feltdb.agent.transition"), json!(2)),
-            ("version_zero", json!("feltdb.agent.transition"), json!(0)),
-            (
-                "wrong_contract_and_version",
-                json!("feltdb.trigger.match"),
-                json!(9),
-            ),
-        ] {
-            let (now, operation, records) = base("checkpoint");
-            let mut full = input(now, operation, records);
-            full["contract"] = contract;
-            full["version"] = version;
-            add(
-                format!("identity/{name}"),
-                "identity and version are checked after shape",
-                full,
-            );
-        }
-        let (now, operation, records) = base("checkpoint");
-        let mut malformed_and_misaddressed =
-            input(now, with(operation, json!({"summary": null})), records);
-        malformed_and_misaddressed["contract"] = json!("other");
-        add(
-            "identity/malformed_beats_misaddressed".into(),
-            "shape errors win over identity errors on every implementation",
-            malformed_and_misaddressed,
-        );
-
-        // create_task
-        let (now, op, _) = base("create_task");
-        let existing = json!({"task": task(|_| {})});
-        add(
-            "create_task/replay_is_a_noop".into(),
-            "the same creation repeated changes nothing",
-            input(now, op.clone(), existing.clone()),
-        );
-        add(
-            "create_task/other_objective_exists".into(),
-            "an existing task with another objective is not recreated",
-            input(
-                now,
-                with(op.clone(), json!({"objective": "Something else"})),
-                existing.clone(),
-            ),
-        );
-        add(
-            "create_task/other_actor_exists".into(),
-            "an existing task owned by another actor is not recreated",
-            input(
-                now,
-                with(op.clone(), json!({"actor": "agent-z"})),
-                existing.clone(),
-            ),
-        );
-        add(
-            "create_task/lease_cap_ok".into(),
-            "86,400,000 ms is the largest lease",
-            input(
-                now,
-                with(op.clone(), json!({"lease_ms": 86_400_000})),
-                json!({}),
-            ),
-        );
-        add(
-            "create_task/lease_over_cap".into(),
-            "one millisecond over the cap is invalid",
-            input(
-                now,
-                with(op.clone(), json!({"lease_ms": 86_400_001})),
-                json!({}),
-            ),
-        );
-        add(
-            "create_task/lease_zero".into(),
-            "a zero-length lease is invalid",
-            input(now, with(op.clone(), json!({"lease_ms": 0})), json!({})),
-        );
-        add(
-            "create_task/lease_overflow".into(),
-            "now + lease_ms must not overflow",
-            input(u64::MAX, op.clone(), json!({})),
-        );
-        add(
-            "create_task/now_max_is_fine_without_a_lease_sum".into(),
-            "now at u64::MAX alone is representable",
-            input(u64::MAX - 60000, op.clone(), json!({})),
-        );
-        let long = "x".repeat(1024);
-        add(
-            "create_task/objective_1024_bytes".into(),
-            "1,024 bytes is the limit",
-            input(now, with(op.clone(), json!({"objective": long})), json!({})),
-        );
-        add(
-            "create_task/objective_1025_bytes".into(),
-            "1,025 bytes is over",
-            input(
-                now,
-                with(op.clone(), json!({"objective": "x".repeat(1025)})),
-                json!({}),
-            ),
-        );
-        add(
-            "create_task/objective_multibyte_in_limit".into(),
-            "the limit is bytes: 341 three-byte characters is 1,023",
-            input(
-                now,
-                with(op.clone(), json!({"objective": "€".repeat(341)})),
-                json!({}),
-            ),
-        );
-        add(
-            "create_task/objective_multibyte_over".into(),
-            "342 three-byte characters is 1,026 bytes",
-            input(
-                now,
-                with(op.clone(), json!({"objective": "€".repeat(342)})),
-                json!({}),
-            ),
-        );
-        add(
-            "create_task/objective_empty".into(),
-            "empty text is invalid",
-            input(now, with(op.clone(), json!({"objective": ""})), json!({})),
-        );
-        for (name, id) in [
-            ("id_128", "a".repeat(128)),
-            ("id_129", "a".repeat(129)),
-            ("id_slash", "a/b".to_string()),
-            ("id_tilde", "a~b".to_string()),
-            ("id_space", "a b".to_string()),
-            ("id_empty", String::new()),
-            ("id_allowed_punctuation", "A_b.c:d@e-f".to_string()),
-            ("id_unicode", "tâche".to_string()),
-        ] {
-            add(
-                format!("create_task/{name}"),
-                "identifiers are 1..=128 bytes of [A-Za-z0-9_.:@-]",
-                input(now, with(op.clone(), json!({"task_id": id})), json!({})),
-            );
-        }
-
-        // acquire
-        let (_, op, _) = base("acquire");
-        let expired = json!({"task": task(|_| {})});
-        add(
-            "acquire/at_exact_expiry".into(),
-            "a lease is expired when now >= expiresAt",
-            input(10000, op.clone(), expired.clone()),
-        );
-        add(
-            "acquire/one_ms_before_expiry".into(),
-            "one millisecond before expiry the lease is still held",
-            input(9999, op.clone(), expired.clone()),
-        );
-        add(
-            "acquire/same_actor_after_expiry".into(),
-            "the previous owner may re-acquire, with a new fence",
-            input(
-                10000,
-                with(op.clone(), json!({"actor": "agent-a"})),
-                expired.clone(),
-            ),
-        );
-        add(
-            "acquire/reusing_the_lease_id".into(),
-            "a new lease needs a new id",
-            input(
-                10000,
-                with(op.clone(), json!({"lease_id": "L2"})),
-                expired.clone(),
-            ),
-        );
-        add(
-            "acquire/terminal_completed".into(),
-            "a completed task is never acquired",
-            input(
-                10000,
-                op.clone(),
-                json!({"task": terminal_task("completed")}),
-            ),
-        );
-        add(
-            "acquire/terminal_cancelled".into(),
-            "a cancelled task is never acquired",
-            input(
-                10000,
-                op.clone(),
-                json!({"task": terminal_task("cancelled")}),
-            ),
-        );
-        add(
-            "acquire/missing_task".into(),
-            "no such task",
-            input(10000, op.clone(), json!({})),
-        );
-        add(
-            "acquire/fence_overflow".into(),
-            "the fence cannot wrap",
-            input(
-                10000,
-                op.clone(),
-                json!({"task": task(|t| t["fence"] = json!(u64::MAX))}),
-            ),
-        );
-        add(
-            "acquire/blocked_task".into(),
-            "a blocked task can be acquired",
-            input(
-                10000,
-                op.clone(),
-                json!({"task": task(|t| t["status"] = json!("blocked"))}),
-            ),
-        );
-
-        // renew and the shared ownership order
-        let (_, op, _) = base("renew");
-        let owned = json!({"task": task(|_| {})});
-        add(
-            "renew/one_ms_before_expiry".into(),
-            "still held one millisecond before expiry",
-            input(9999, op.clone(), owned.clone()),
-        );
-        add(
-            "renew/at_exact_expiry".into(),
-            "expired at now == expiresAt",
-            input(10000, op.clone(), owned.clone()),
-        );
-        add(
-            "renew/stale_fence_lower".into(),
-            "an older fence is stale",
-            input(5000, with(op.clone(), json!({"fence": 1})), owned.clone()),
-        );
-        add(
-            "renew/stale_fence_higher".into(),
-            "a fence that is not the current one is stale in either direction",
-            input(5000, with(op.clone(), json!({"fence": 3})), owned.clone()),
-        );
-        add(
-            "renew/wrong_actor".into(),
-            "another actor does not own the task",
-            input(
-                5000,
-                with(op.clone(), json!({"actor": "agent-z"})),
-                owned.clone(),
-            ),
-        );
-        add(
-            "renew/wrong_lease".into(),
-            "another lease id does not match",
-            input(
-                5000,
-                with(op.clone(), json!({"lease_id": "L9"})),
-                owned.clone(),
-            ),
-        );
-        add(
-            "renew/order_fence_before_actor_and_lease".into(),
-            "stale fence, wrong actor and wrong lease report the fence",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"fence": 1, "actor": "agent-z", "lease_id": "L9"}),
-                ),
-                owned.clone(),
-            ),
-        );
-        add(
-            "renew/order_actor_before_lease".into(),
-            "wrong actor and wrong lease report the actor",
-            input(
-                5000,
-                with(op.clone(), json!({"actor": "agent-z", "lease_id": "L9"})),
-                owned.clone(),
-            ),
-        );
-        add(
-            "renew/order_lease_before_expiry".into(),
-            "wrong lease on an expired lease reports the mismatch",
-            input(
-                10000,
-                with(op.clone(), json!({"lease_id": "L9"})),
-                owned.clone(),
-            ),
-        );
-        add(
-            "renew/terminal_before_fence".into(),
-            "a terminal task reports TERMINAL before anything else",
-            input(
-                5000,
-                with(op.clone(), json!({"fence": 9, "actor": "agent-z"})),
-                json!({"task": terminal_task("completed")}),
-            ),
-        );
-        add(
-            "renew/missing_task".into(),
-            "no such task",
-            input(5000, op.clone(), json!({})),
-        );
-        add(
-            "renew/extends_from_now_not_from_expiry".into(),
-            "the new expiry is now + lease_ms",
-            input(
-                9000,
-                with(op.clone(), json!({"lease_ms": 1})),
-                owned.clone(),
-            ),
-        );
-
-        // checkpoint
-        let (_, op, _) = base("checkpoint");
-        let running = |evidence: Value| json!({"task": task(|_| {}), "evidence": evidence});
-        let status =
-            |from: &str| json!({"task": task(|t| t["status"] = json!(from)), "evidence": []});
-        add(
-            "checkpoint/same_status".into(),
-            "no status change is allowed while non-terminal",
-            input(5000, op.clone(), running(json!([]))),
-        );
-        for (from, to) in [
-            ("ready", "running"),
-            ("ready", "cancelled"),
-            ("ready", "completed"),
-            ("ready", "blocked"),
-            ("running", "ready"),
-            ("running", "blocked"),
-            ("running", "cancelled"),
-            ("blocked", "running"),
-            ("blocked", "cancelled"),
-            ("blocked", "completed"),
-            ("blocked", "ready"),
-        ] {
-            let evidence = if to == "completed" {
-                json!([rec("receipts", "r1")])
-            } else {
-                json!([])
-            };
-            let seen_list = if to == "completed" {
-                json!([seen("receipts", "r1", 1)])
-            } else {
-                json!([])
-            };
-            add(
-                format!("checkpoint/transition/{from}_to_{to}"),
-                "the lifecycle is an explicit table",
-                input(
-                    5000,
-                    with(op.clone(), json!({"status": to, "evidence": evidence})),
-                    json!({"task": task(|t| t["status"] = json!(from)), "evidence": seen_list}),
-                ),
-            );
-        }
-        for to in ["ready", "running", "blocked", "completed", "cancelled"] {
-            for from in ["completed", "cancelled"] {
-                add(
-                    format!("checkpoint/terminal/{from}_to_{to}"),
-                    "a terminal task takes no further checkpoints",
-                    input(
-                        5000,
-                        with(op.clone(), json!({"status": to})),
-                        json!({"task": terminal_task(from), "evidence": []}),
-                    ),
-                );
-            }
-        }
-        let _ = status;
-        add(
-            "checkpoint/version_conflict_lower".into(),
-            "expected_version must be the current checkpoint version",
-            input(
-                5000,
-                with(op.clone(), json!({"expected_version": 2})),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/version_conflict_higher".into(),
-            "...in either direction",
-            input(
-                5000,
-                with(op.clone(), json!({"expected_version": 4})),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/replay_of_applied_checkpoint".into(),
-            "a checkpoint replayed after it landed is a version conflict, not applied twice",
-            input(
-                5000,
-                with(op.clone(), json!({"expected_version": 2})),
-                json!({"task": task(|_| {}), "evidence": []}),
-            ),
-        );
-        add(
-            "checkpoint/stale_fence".into(),
-            "an old owner cannot checkpoint",
-            input(
-                5000,
-                with(op.clone(), json!({"fence": 1})),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/expired_lease".into(),
-            "an owner whose lease expired cannot checkpoint",
-            input(10000, op.clone(), running(json!([]))),
-        );
-        add(
-            "checkpoint/summary_1024".into(),
-            "summary limit in bytes",
-            input(
-                5000,
-                with(op.clone(), json!({"summary": "s".repeat(1024)})),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/summary_1025".into(),
-            "over the limit",
-            input(
-                5000,
-                with(op.clone(), json!({"summary": "s".repeat(1025)})),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/unknown_status".into(),
-            "status must be a lifecycle state",
-            input(
-                5000,
-                with(op.clone(), json!({"status": "done"})),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/missing_task".into(),
-            "no such task",
-            input(5000, op.clone(), json!({"evidence": []})),
-        );
-        // evidence
-        let complete = with(op.clone(), json!({"status": "completed"}));
-        let cites = |refs: Value| with(complete.clone(), json!({"evidence": refs}));
-        add(
-            "checkpoint/complete_with_verified_record".into(),
-            "a completion cites a record FeltDB observed",
-            input(
-                5000,
-                cites(json!([rec("receipts", "r1")])),
-                running(json!([seen("receipts", "r1", 4)])),
-            ),
-        );
-        add(
-            "checkpoint/complete_without_evidence".into(),
-            "INTENTIONAL BREAK: a completion with no evidence is refused",
-            input(5000, cites(json!([])), running(json!([]))),
-        );
-        add(
-            "checkpoint/complete_with_only_external_evidence".into(),
-            "an external URI is kept but is never verified, so it cannot back a completion",
-            input(5000, cites(json!([ext("git:abc123")])), running(json!([]))),
-        );
-        add(
-            "checkpoint/complete_with_unobserved_record".into(),
-            "a cited record FeltDB did not find cannot be cited",
-            input(
-                5000,
-                cites(json!([rec("receipts", "r1")])),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/complete_citing_agent_record".into(),
-            "an agent's own record is not evidence for the agent",
-            input(
-                5000,
-                cites(json!([rec("_feltdb.AgentCheckpoint", "t1~v3")])),
-                running(json!([seen("_feltdb.AgentCheckpoint", "t1~v3", 1)])),
-            ),
-        );
-        add(
-            "checkpoint/complete_with_unresolved_action".into(),
-            "an action that may or may not have run blocks completion",
-            input(
-                5000,
-                cites(json!([rec("receipts", "r1")])),
-                json!({"task": with_unresolved(1), "evidence": [seen("receipts", "r1", 1)]}),
-            ),
-        );
-        add(
-            "checkpoint/complete_mixed_evidence".into(),
-            "one verified record among external citations is enough; the external stays unverified",
-            input(
-                5000,
-                cites(json!([ext("git:abc123"), rec("receipts", "r1")])),
-                running(json!([seen("receipts", "r1", 2)])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_duplicate".into(),
-            "the same citation twice is refused",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": [rec("receipts", "r1"), rec("receipts", "r1")]}),
-                ),
-                running(json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_extra_observation".into(),
-            "an observation nobody cited is a malformed input",
-            input(
-                5000,
-                op.clone(),
-                running(json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_duplicate_observation".into(),
-            "two observations of one record is a malformed input",
-            input(
-                5000,
-                with(op.clone(), json!({"evidence": [rec("receipts", "r1")]})),
-                running(json!([
-                    seen("receipts", "r1", 1),
-                    seen("receipts", "r1", 2)
-                ])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_16".into(),
-            "sixteen citations is the limit",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": (0..16).map(|i| ext(&format!("u:{i}"))).collect::<Vec<_>>()}),
-                ),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_17".into(),
-            "seventeen is over",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": (0..17).map(|i| ext(&format!("u:{i}"))).collect::<Vec<_>>()}),
-                ),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_record_with_uri".into(),
-            "a record citation carries no uri",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": [{"kind": "record", "collection": "a", "id": "b", "uri": "x"}]}),
-                ),
-                running(json!([seen("a", "b", 1)])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_external_with_id".into(),
-            "an external citation carries only a uri",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": [{"kind": "external", "uri": "x", "id": "b"}]}),
-                ),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_verified_flag_is_not_an_input".into(),
-            "a caller cannot say a citation is verified",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": [{"kind": "record", "collection": "a", "id": "b", "verified": true}]}),
-                ),
-                running(json!([seen("a", "b", 1)])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_unknown_kind".into(),
-            "citation kinds are record and external",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": [{"kind": "claim", "uri": "x"}]}),
-                ),
-                running(json!([])),
-            ),
-        );
-        add(
-            "checkpoint/evidence_guards_are_sorted".into(),
-            "guards are ordered by collection then id",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": [rec("zeta", "a"), rec("alpha", "z"), rec("alpha", "b")]}),
-                ),
-                running(json!([
-                    seen("zeta", "a", 1),
-                    seen("alpha", "z", 2),
-                    seen("alpha", "b", 3)
-                ])),
-            ),
-        );
-        add(
-            "checkpoint/cancel_with_unresolved_action".into(),
-            "cancelling is allowed with an unresolved action; the uncertainty stays recorded",
-            input(
-                5000,
-                with(op.clone(), json!({"status": "cancelled"})),
-                json!({"task": with_unresolved(2), "evidence": []}),
-            ),
-        );
-
-        // record_intent
-        let (_, op, _) = base("record_intent");
-        add(
-            "record_intent/recorded_again_while_intended".into(),
-            "an unresolved key is never a fresh start",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": with_unresolved(1), "intent": intent("intended")}),
-            ),
-        );
-        add(
-            "record_intent/recorded_again_while_reported".into(),
-            "a reported but unverified outcome is still uncertain",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": with_unresolved(1), "intent": intent("reported")}),
-            ),
-        );
-        add(
-            "record_intent/recorded_again_when_resolved".into(),
-            "a resolved key is not reused",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|_| {}), "intent": intent("resolved")}),
-            ),
-        );
-        add(
-            "record_intent/task_blocked".into(),
-            "actions are started only while running",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|t| t["status"] = json!("blocked"))}),
-            ),
-        );
-        add(
-            "record_intent/task_ready".into(),
-            "...not while ready",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|t| t["status"] = json!("ready"))}),
-            ),
-        );
-        add(
-            "record_intent/stale_fence".into(),
-            "an old owner cannot begin an action",
-            input(
-                5000,
-                with(op.clone(), json!({"fence": 1})),
-                json!({"task": task(|_| {})}),
-            ),
-        );
-        add(
-            "record_intent/expired_lease".into(),
-            "an expired owner cannot begin an action",
-            input(10000, op.clone(), json!({"task": task(|_| {})})),
-        );
-        add(
-            "record_intent/counter_overflow".into(),
-            "the unresolved count cannot wrap",
-            input(5000, op.clone(), json!({"task": with_unresolved(u64::MAX)})),
-        );
-        add(
-            "record_intent/missing_task".into(),
-            "no such task",
-            input(5000, op.clone(), json!({})),
-        );
-        add(
-            "record_intent/key_with_tilde".into(),
-            "~ separates composite ids, so it cannot appear in a key",
-            input(
-                5000,
-                with(op.clone(), json!({"idempotency_key": "a~b"})),
-                json!({"task": task(|_| {})}),
-            ),
-        );
-
-        // record_outcome
-        let (_, op, _) = base("record_outcome");
-        let waiting = |intent_state: &str, evidence: Value| json!({"task": with_unresolved(1), "intent": intent(intent_state), "evidence": evidence});
-        add(
-            "record_outcome/verified_resolves".into(),
-            "an outcome FeltDB saw evidence for resolves the action",
-            input(
-                5000,
-                op.clone(),
-                waiting("intended", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "record_outcome/failed_with_evidence".into(),
-            "a failure with evidence resolves it too",
-            input(
-                5000,
-                with(op.clone(), json!({"result": "failed"})),
-                waiting("intended", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "record_outcome/unverified_stays_uncertain".into(),
-            "an outcome with no evidence is only reported",
-            input(
-                5000,
-                with(op.clone(), json!({"evidence": []})),
-                waiting("intended", json!([])),
-            ),
-        );
-        add(
-            "record_outcome/external_only_stays_uncertain".into(),
-            "external evidence does not verify an outcome",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": [ext("https://shop/orders/9")]}),
-                ),
-                waiting("intended", json!([])),
-            ),
-        );
-        add(
-            "record_outcome/unobserved_record".into(),
-            "a record FeltDB did not find cannot verify an outcome",
-            input(5000, op.clone(), waiting("intended", json!([]))),
-        );
-        add(
-            "record_outcome/unknown_intent".into(),
-            "no intent was recorded",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": with_unresolved(1), "evidence": [seen("receipts", "r1", 1)]}),
-            ),
-        );
-        add(
-            "record_outcome/already_reported".into(),
-            "an outcome is recorded once; reconciliation settles the rest",
-            input(
-                5000,
-                op.clone(),
-                waiting("reported", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "record_outcome/already_resolved".into(),
-            "a resolved action is not changed",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|_| {}), "intent": intent("resolved"), "evidence": [seen("receipts", "r1", 1)]}),
-            ),
-        );
-        add(
-            "record_outcome/counter_underflow".into(),
-            "an intended action with no counted intent is corrupt state",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": with_unresolved(0), "intent": intent("intended"), "evidence": [seen("receipts", "r1", 1)]}),
-            ),
-        );
-        add(
-            "record_outcome/bad_result".into(),
-            "a result is succeeded or failed",
-            input(
-                5000,
-                with(op.clone(), json!({"result": "unknown"})),
-                waiting("intended", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "record_outcome/stale_fence".into(),
-            "an old owner cannot record an outcome",
-            input(
-                5000,
-                with(op.clone(), json!({"fence": 1})),
-                waiting("intended", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-
-        // reconcile
-        let (_, op, _) = base("reconcile");
-        add(
-            "reconcile/executed_from_intended".into(),
-            "evidence that it ran settles it",
-            input(
-                5000,
-                op.clone(),
-                waiting("intended", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "reconcile/not_executed_with_evidence".into(),
-            "evidence that it did not run settles it, and may permit a new attempt under a new key",
-            input(
-                5000,
-                with(op.clone(), json!({"conclusion": "not_executed"})),
-                waiting("intended", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "reconcile/from_reported".into(),
-            "a reported outcome is settled by evidence, which accumulates",
-            input(
-                5000,
-                op.clone(),
-                waiting("reported", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-        add(
-            "reconcile/not_executed_without_evidence".into(),
-            "the absence of an outcome record does not show it did not run",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"conclusion": "not_executed", "evidence": []}),
-                ),
-                waiting("intended", json!([])),
-            ),
-        );
-        add(
-            "reconcile/executed_without_evidence".into(),
-            "...nor that it did",
-            input(
-                5000,
-                with(op.clone(), json!({"evidence": []})),
-                waiting("intended", json!([])),
-            ),
-        );
-        add(
-            "reconcile/external_only".into(),
-            "external citations cannot settle an uncertain action",
-            input(
-                5000,
-                with(
-                    op.clone(),
-                    json!({"evidence": [ext("https://shop/orders/9")]}),
-                ),
-                waiting("intended", json!([])),
-            ),
-        );
-        add(
-            "reconcile/already_resolved".into(),
-            "a resolved action is not reopened",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|_| {}), "intent": intent("resolved"), "evidence": [seen("receipts", "r1", 1)]}),
-            ),
-        );
-        add(
-            "reconcile/unknown_intent".into(),
-            "no intent was recorded",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": with_unresolved(1), "evidence": [seen("receipts", "r1", 1)]}),
-            ),
-        );
-        add(
-            "reconcile/expired_lease".into(),
-            "only a current owner reconciles",
-            input(
-                10000,
-                op.clone(),
-                waiting("intended", json!([seen("receipts", "r1", 1)])),
-            ),
-        );
-
-        // create_handoff
-        let (_, op, _) = base("create_handoff");
-        add(
-            "create_handoff/open_to_anyone".into(),
-            "to is optional",
-            input(
-                5000,
-                with(op.clone(), json!({"to": null})),
-                json!({"task": task(|_| {})}),
-            ),
-        );
-        add(
-            "create_handoff/already_exists".into(),
-            "a handoff id is used once",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|_| {}), "handoff": handoff(|_| {})}),
-            ),
-        );
-        add(
-            "create_handoff/stale_fence".into(),
-            "only the current owner offers a handoff",
-            input(
-                5000,
-                with(op.clone(), json!({"fence": 1})),
-                json!({"task": task(|_| {})}),
-            ),
-        );
-        add(
-            "create_handoff/expired_lease".into(),
-            "...holding an unexpired lease",
-            input(10000, op.clone(), json!({"task": task(|_| {})})),
-        );
-        add(
-            "create_handoff/terminal".into(),
-            "a terminal task is not handed off",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": terminal_task("completed")}),
-            ),
-        );
-
-        // claim_handoff
-        let (_, op, _) = base("claim_handoff");
-        let open = json!({"task": task(|_| {}), "handoff": handoff(|_| {})});
-        add(
-            "claim_handoff/addressed_to_another".into(),
-            "a handoff addressed to B is not claimable by C",
-            input(
-                5000,
-                with(op.clone(), json!({"claimant": "agent-c"})),
-                open.clone(),
-            ),
-        );
-        add(
-            "claim_handoff/open_to_anyone".into(),
-            "an unaddressed handoff is claimable by anyone",
-            input(
-                5000,
-                with(op.clone(), json!({"claimant": "agent-c"})),
-                json!({"task": task(|_| {}), "handoff": handoff(|h| { h["to"] = Value::Null; h.as_object_mut().unwrap().remove("to"); })}),
-            ),
-        );
-        add(
-            "claim_handoff/stale_checkpoint_moved".into(),
-            "the task moved past the checkpoint the handoff names",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|t| t["checkpoint_version"] = json!(4)), "handoff": handoff(|_| {})}),
-            ),
-        );
-        add(
-            "claim_handoff/stale_fence_moved".into(),
-            "the task was taken over since the handoff was offered",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|t| t["fence"] = json!(3)), "handoff": handoff(|_| {})}),
-            ),
-        );
-        add(
-            "claim_handoff/stale_owner_moved".into(),
-            "the task's owner is no longer the offerer",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|t| t["owner"] = json!("agent-z")), "handoff": handoff(|_| {})}),
-            ),
-        );
-        add(
-            "claim_handoff/claimed_and_live".into(),
-            "a live claim by another is respected",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|t| { t["owner"] = json!("agent-c"); t["fence"] = json!(3); t["lease"] = json!({"expiresAt": 65000, "leaseId": "L4"}); }), "handoff": claimed_handoff("agent-c", 3)}),
-            ),
-        );
-        let held_by_b = json!({"task": task(|t| { t["owner"] = json!("agent-b"); t["fence"] = json!(3); t["lease"] = json!({"expiresAt": 65000, "leaseId": "L3"}); }), "handoff": claimed_handoff("agent-b", 3)});
-        add(
-            "claim_handoff/holder_retry_is_a_noop".into(),
-            "the holder retrying with the same lease id after an uncertain outcome changes nothing",
-            input(5000, op.clone(), held_by_b.clone()),
-        );
-        add(
-            "claim_handoff/holder_retry_other_lease".into(),
-            "...but not with another lease id",
-            input(
-                5000,
-                with(op.clone(), json!({"lease_id": "L7"})),
-                held_by_b.clone(),
-            ),
-        );
-        add(
-            "claim_handoff/reclaim_after_expiry".into(),
-            "an abandoned claim can be taken after its lease expires",
-            input(
-                65000,
-                with(op.clone(), json!({"claimant": "agent-c", "lease_id": "L8"})),
-                json!({"task": held_by_b["task"].clone(), "handoff": handoff_unaddressed_claimed("agent-b", 3)}),
-            ),
-        );
-        add(
-            "claim_handoff/reclaim_one_ms_early".into(),
-            "...not one millisecond before",
-            input(
-                64999,
-                with(op.clone(), json!({"claimant": "agent-c", "lease_id": "L8"})),
-                json!({"task": held_by_b["task"].clone(), "handoff": handoff_unaddressed_claimed("agent-b", 3)}),
-            ),
-        );
-        add("claim_handoff/reclaim_after_owner_changed".into(), "an expired claim is recoverable only while the task is with the claimant that abandoned it", input(65000, with(op.clone(), json!({"claimant": "agent-c", "lease_id": "L8"})), json!({"task": task(|t| { t["owner"] = json!("agent-z"); t["fence"] = json!(4); t["lease"] = json!({"expiresAt": 1000, "leaseId": "L5"}); }), "handoff": handoff_unaddressed_claimed("agent-b", 3)})));
-        add(
-            "claim_handoff/accepted".into(),
-            "an accepted handoff is final",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|_| {}), "handoff": handoff(|h| { h["status"] = json!("accepted"); h["claimant"] = json!("agent-b"); h["claimed_fence"] = json!(3); })}),
-            ),
-        );
-        add(
-            "claim_handoff/terminal_task".into(),
-            "a terminal task is not claimed",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": terminal_task("cancelled"), "handoff": handoff(|_| {})}),
-            ),
-        );
-        add(
-            "claim_handoff/reusing_the_lease_id".into(),
-            "the new lease needs a new id",
-            input(
-                5000,
-                with(op.clone(), json!({"lease_id": "L2"})),
-                open.clone(),
-            ),
-        );
-        add(
-            "claim_handoff/missing_handoff".into(),
-            "no such handoff",
-            input(5000, op.clone(), json!({"task": task(|_| {})})),
-        );
-        add(
-            "claim_handoff/missing_task".into(),
-            "the handoff's task is gone",
-            input(5000, op.clone(), json!({"handoff": handoff(|_| {})})),
-        );
-        add(
-            "claim_handoff/task_mismatch".into(),
-            "the supplied task must be the handoff's task",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|t| t["task_id"] = json!("t9")), "handoff": handoff(|_| {})}),
-            ),
-        );
-        add(
-            "claim_handoff/open_with_claimant".into(),
-            "an open handoff names no claimant: corrupt state",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|_| {}), "handoff": handoff(|h| h["claimant"] = json!("agent-b"))}),
-            ),
-        );
-        add(
-            "claim_handoff/claimed_without_claimant".into(),
-            "a claimed handoff names its claimant: corrupt state",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|_| {}), "handoff": handoff(|h| h["status"] = json!("claimed"))}),
-            ),
-        );
-
-        // accept_handoff
-        let (_, op, accept_records) = base("accept_handoff");
-        let _ = accept_records;
-        let mine = json!({"task": task(|t| { t["fence"] = json!(3); t["owner"] = json!("agent-b"); t["lease"] = json!({"expiresAt": 65000, "leaseId": "L3"}); }), "handoff": claimed_handoff("agent-b", 3)});
-        add(
-            "accept_handoff/one_ms_before_expiry".into(),
-            "accepting in time",
-            input(64999, op.clone(), mine.clone()),
-        );
-        add(
-            "accept_handoff/at_exact_expiry".into(),
-            "the lease expired at now == expiresAt",
-            input(65000, op.clone(), mine.clone()),
-        );
-        add(
-            "accept_handoff/already_accepted_same_claimant".into(),
-            "accepting again changes nothing",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": mine["task"].clone(), "handoff": handoff(|h| { h["status"] = json!("accepted"); h["claimant"] = json!("agent-b"); h["claimed_fence"] = json!(3); })}),
-            ),
-        );
-        add(
-            "accept_handoff/already_accepted_by_another".into(),
-            "...but not by someone else",
-            input(
-                5000,
-                with(op.clone(), json!({"claimant": "agent-c"})),
-                json!({"task": mine["task"].clone(), "handoff": handoff(|h| { h["status"] = json!("accepted"); h["claimant"] = json!("agent-b"); h["claimed_fence"] = json!(3); })}),
-            ),
-        );
-        add(
-            "accept_handoff/still_open".into(),
-            "an unclaimed handoff cannot be accepted",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": mine["task"].clone(), "handoff": handoff(|_| {})}),
-            ),
-        );
-        add(
-            "accept_handoff/not_the_claimant".into(),
-            "only the claimant accepts",
-            input(
-                5000,
-                with(op.clone(), json!({"claimant": "agent-c"})),
-                mine.clone(),
-            ),
-        );
-        add(
-            "accept_handoff/stale_fence".into(),
-            "the claimant's fence must be current",
-            input(5000, with(op.clone(), json!({"fence": 2})), mine.clone()),
-        );
-        add(
-            "accept_handoff/claim_superseded".into(),
-            "the task was taken over after the claim: the claim is stale",
-            input(
-                5000,
-                op.clone(),
-                json!({"task": task(|t| { t["fence"] = json!(4); t["owner"] = json!("agent-b"); t["lease"] = json!({"expiresAt": 65000, "leaseId": "L3"}); }), "handoff": claimed_handoff("agent-b", 3)}),
-            ),
-        );
-        add(
-            "accept_handoff/wrong_lease".into(),
-            "the lease id must be the task's",
-            input(
-                5000,
-                with(op.clone(), json!({"lease_id": "L9"})),
-                mine.clone(),
-            ),
-        );
-        add(
-            "accept_handoff/missing_handoff".into(),
-            "no such handoff",
-            input(5000, op.clone(), json!({"task": mine["task"].clone()})),
-        );
-
-        // Raw encodings.
-        let valid = serde_json::to_string(&input(
-            5000,
-            base_op("renew"),
-            json!({"task": task(|_| {})}),
-        ))
-        .unwrap();
-        let mut raw_cases: Vec<(&str, &str, String)> = vec![
-            ("raw/empty", "no input at all", String::new()),
-            ("raw/not_json", "not JSON", "this is not json".into()),
-            ("raw/null", "the JSON null", "null".into()),
-            ("raw/array", "the JSON array", "[]".into()),
-            (
-                "raw/empty_object",
-                "an empty object has no envelope members",
-                "{}".into(),
-            ),
-            (
-                "raw/truncated",
-                "a truncated document",
-                valid[..valid.len() / 2].to_string(),
-            ),
-            (
-                "raw/trailing_garbage",
-                "content after the document",
-                format!("{valid} x"),
-            ),
-            (
-                "raw/two_documents",
-                "two documents",
-                format!("{valid}{valid}"),
-            ),
-            (
-                "raw/pretty_printed_valid",
-                "whitespace is not semantics",
-                serde_json::to_string_pretty(&serde_json::from_str::<Value>(&valid).unwrap())
-                    .unwrap(),
-            ),
-            (
-                "raw/leading_bom",
-                "a BOM is not JSON",
-                format!("\u{feff}{valid}"),
-            ),
-            (
-                "raw/duplicate_envelope_member",
-                "a repeated member is refused",
-                valid.replacen("\"now_ms\":5000", "\"now_ms\":5000,\"now_ms\":5000", 1),
-            ),
-            (
-                "raw/duplicate_operation_member",
-                "...inside the operation",
-                valid.replacen("\"op\":\"renew\"", "\"op\":\"renew\",\"op\":\"renew\"", 1),
-            ),
-            (
-                "raw/duplicate_records_member",
-                "...inside records",
-                valid.replacen("\"records\":{", "\"records\":{\"task\":null,", 1),
-            ),
-            (
-                "raw/duplicate_lease_member",
-                "...inside a stored lease",
-                valid.replacen(
-                    "\"expiresAt\":10000",
-                    "\"expiresAt\":10000,\"expiresAt\":1",
-                    1,
-                ),
-            ),
-            (
-                "raw/float_for_integer",
-                "1.0 is not an integer",
-                valid.replacen("\"now_ms\":5000", "\"now_ms\":5000.0", 1),
-            ),
-            (
-                "raw/exponent_for_integer",
-                "5e3 is not an integer",
-                valid.replacen("\"now_ms\":5000", "\"now_ms\":5e3", 1),
-            ),
-            (
-                "raw/negative_zero",
-                "-0 is not a non-negative integer",
-                valid.replacen("\"now_ms\":5000", "\"now_ms\":-0", 1),
-            ),
-            (
-                "raw/negative",
-                "negative integers are refused",
-                valid.replacen("\"now_ms\":5000", "\"now_ms\":-5", 1),
-            ),
-            (
-                "raw/leading_zero",
-                "leading zeros are not JSON",
-                valid.replacen("\"now_ms\":5000", "\"now_ms\":05000", 1),
-            ),
-            (
-                "raw/u64_max",
-                "u64::MAX is representable",
-                valid.replacen("\"now_ms\":5000", "\"now_ms\":18446744073709551615", 1),
-            ),
-            (
-                "raw/u64_max_plus_one",
-                "one more is not",
-                valid.replacen("\"now_ms\":5000", "\"now_ms\":18446744073709551616", 1),
-            ),
-            (
-                "raw/escaped_identifier_ok",
-                "escapes decode before validation",
-                valid.replacen("\"agent-a\"", "\"agent\\u002da\"", 1),
-            ),
-            (
-                "raw/escaped_identifier_invalid_char",
-                "...so an escaped space is still a space",
-                valid.replacen("\"agent-a\"", "\"agent\\u0020a\"", 1),
-            ),
-            (
-                "raw/lone_high_surrogate",
-                "a lone surrogate is not text",
-                valid.replacen("\"agent-a\"", "\"\\ud800\"", 1),
-            ),
-            (
-                "raw/lone_low_surrogate",
-                "...nor a lone trailing one",
-                valid.replacen("\"agent-a\"", "\"\\udc00\"", 1),
-            ),
-            (
-                "raw/raw_control_character",
-                "an unescaped control character in a string",
-                valid.replacen("\"agent-a\"", "\"agent\u{1}a\"", 1),
-            ),
-            (
-                "raw/depth_bomb",
-                "excessive nesting is an input error, not a crash",
-                format!("{}{}", "[".repeat(300), "]".repeat(300)),
-            ),
-            (
-                "raw/summary_with_escapes_and_astral",
-                "text with escapes and an astral character is counted in UTF-8 bytes",
-                String::new(),
-            ),
-        ];
-        let checkpoint = serde_json::to_string(&{
-            let (now, operation, records) = base("checkpoint");
-            input(
-                now,
-                with(
-                    operation,
-                    json!({"summary": "line\nbreak \"quoted\" \\ tab\t \u{1} 😀 é"}),
-                ),
-                records,
-            )
-        })
-        .unwrap();
-        raw_cases.last_mut().unwrap().2 = checkpoint;
-        raw_cases.push(("raw/output_escapes_control_and_unicode_in_text", "the writer escapes exactly as a canonical encoder does", serde_json::to_string(&{
-            let (now, operation, records) = base("create_task");
-            input(now, with(operation, json!({"objective": "q\"uote \\ slash \u{7f} del \u{8}\u{c}\n\r\t \u{1f} €😀"})), records)
-        }).unwrap()));
-        raw_cases.push(("raw/permuted_member_order", "member order is not semantics", {
-            let (now, operation, records) = base("renew");
-            format!(
-                "{{\"version\":1,\"records\":{},\"operation\":{},\"now_ms\":{now},\"contract\":\"feltdb.agent.transition\"}}",
-                serde_json::to_string(&records).unwrap(),
-                serde_json::to_string(&operation).unwrap()
-            )
-        }));
-        for (name, why, text) in raw_cases {
-            out.push(json!({"name": name, "why": why, "raw_input": text}));
-        }
-        out
-    }
-
-    fn handoff_unaddressed_claimed(claimant: &str, fence: u64) -> Value {
-        handoff(|h| {
-            h.as_object_mut().unwrap().remove("to");
-            h["status"] = json!("claimed");
-            h["claimant"] = json!(claimant);
-            h["claimed_fence"] = json!(fence);
-        })
-    }
-
-    // -- sequences -----------------------------------------------------------
-
-    struct Step(&'static str, u64, Value, Vec<(&'static str, &'static str)>);
-
-    fn step(label: &'static str, now: u64, operation: Value) -> Step {
-        Step(label, now, operation, vec![])
-    }
-
-    fn seeded(mut s: Step, seeds: &[(&'static str, &'static str)]) -> Step {
-        s.3 = seeds.to_vec();
-        s
-    }
-
-    fn sequence(name: &str, why: &str, steps: Vec<Step>) -> Value {
-        let steps: Vec<Value> = steps
-            .into_iter()
-            .map(|Step(label, now, operation, seeds)| {
-                json!({
-                    "label": label, "now_ms": now, "operation": operation,
-                    "seed": seeds.iter().map(|(c, i)| json!({"collection": c, "id": i})).collect::<Vec<_>>(),
-                })
-            })
-            .collect();
-        json!({"name": name, "why": why, "steps": steps})
-    }
-
-    fn create(actor: &str, lease: &str) -> Value {
-        json!({"op": "create_task", "task_id": "t1", "actor": actor, "objective": "Ship it", "lease_id": lease, "lease_ms": 1000})
-    }
-    fn ck(
-        actor: &str,
-        fence: u64,
-        lease: &str,
-        version: u64,
-        status: Option<&str>,
-        evidence: Value,
-    ) -> Value {
-        let mut op = json!({"op": "checkpoint", "task_id": "t1", "actor": actor, "fence": fence, "lease_id": lease, "expected_version": version, "summary": "progress", "evidence": evidence});
-        if let Some(s) = status {
-            op["status"] = json!(s);
-        }
-        op
-    }
-    fn intent_op(actor: &str, fence: u64, lease: &str, key: &str) -> Value {
-        json!({"op": "record_intent", "task_id": "t1", "actor": actor, "fence": fence, "lease_id": lease, "idempotency_key": key, "action": "charge-card"})
-    }
-    fn outcome_op(actor: &str, fence: u64, lease: &str, key: &str, evidence: Value) -> Value {
-        json!({"op": "record_outcome", "task_id": "t1", "actor": actor, "fence": fence, "lease_id": lease, "idempotency_key": key, "result": "succeeded", "evidence": evidence})
-    }
-    fn reconcile_op(
-        actor: &str,
-        fence: u64,
-        lease: &str,
-        key: &str,
-        conclusion: &str,
-        evidence: Value,
-    ) -> Value {
-        json!({"op": "reconcile", "task_id": "t1", "actor": actor, "fence": fence, "lease_id": lease, "idempotency_key": key, "conclusion": conclusion, "evidence": evidence})
-    }
-    fn acquire_op(actor: &str, lease: &str) -> Value {
-        json!({"op": "acquire", "task_id": "t1", "actor": actor, "lease_id": lease, "lease_ms": 1000})
-    }
-    fn renew_op(actor: &str, fence: u64, lease: &str) -> Value {
-        json!({"op": "renew", "task_id": "t1", "actor": actor, "fence": fence, "lease_id": lease, "lease_ms": 1000})
-    }
-    fn offer(actor: &str, fence: u64, lease: &str, to: Option<&str>) -> Value {
-        let mut op = json!({"op": "create_handoff", "task_id": "t1", "handoff_id": "h1", "actor": actor, "fence": fence, "lease_id": lease});
-        if let Some(to) = to {
-            op["to"] = json!(to);
-        }
-        op
-    }
-    fn claim(who: &str, lease: &str) -> Value {
-        json!({"op": "claim_handoff", "handoff_id": "h1", "claimant": who, "lease_id": lease, "lease_ms": 1000})
-    }
-    fn accept(who: &str, fence: u64, lease: &str) -> Value {
-        json!({"op": "accept_handoff", "handoff_id": "h1", "claimant": who, "fence": fence, "lease_id": lease})
-    }
-
-    pub fn sequences() -> Vec<Value> {
-        let receipt = || json!([rec("receipts", "r1")]);
-        vec![
-            sequence("lifecycle_happy_path", "create, start, act, verify the outcome, complete with evidence, and nothing more", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("intend", 200, intent_op("agent-a", 1, "L1", "charge-1")),
-                seeded(step("outcome_verified", 300, outcome_op("agent-a", 1, "L1", "charge-1", receipt())), &[("receipts", "r1")]),
-                step("complete", 400, ck("agent-a", 1, "L1", 2, Some("completed"), receipt())),
-                step("terminal_checkpoint_refused", 500, ck("agent-a", 1, "L1", 3, None, json!([]))),
-                step("terminal_renew_refused", 500, renew_op("agent-a", 1, "L1")),
-                step("terminal_acquire_refused", 5000, acquire_op("agent-b", "L2")),
-            ]),
-            sequence("completion_requires_verified_evidence", "a completion is a claim until FeltDB has seen a record that backs it", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("no_evidence", 200, ck("agent-a", 1, "L1", 2, Some("completed"), json!([]))),
-                step("external_only", 210, ck("agent-a", 1, "L1", 2, Some("completed"), json!([ext("git:abc123")]))),
-                step("record_not_there_yet", 220, ck("agent-a", 1, "L1", 2, Some("completed"), receipt())),
-                step("own_checkpoint_as_evidence", 230, ck("agent-a", 1, "L1", 2, Some("completed"), json!([rec("_feltdb.AgentCheckpoint", "t1~v2")]))),
-                seeded(step("verified_record", 240, ck("agent-a", 1, "L1", 2, Some("completed"), receipt())), &[("receipts", "r1")]),
-            ]),
-            sequence("evidence_is_pinned_to_the_observed_version", "a citation records the version FeltDB saw; a later change to the record is a later version", vec![
-                step("create", 0, create("agent-a", "L1")),
-                seeded(step("cite_version_1", 100, ck("agent-a", 1, "L1", 1, Some("running"), receipt())), &[("receipts", "r1")]),
-                seeded(step("cite_version_2_after_change", 200, ck("agent-a", 1, "L1", 2, None, receipt())), &[("receipts", "r1")]),
-            ]),
-            sequence("crash_after_side_effect_before_outcome", "the action ran, the process died before recording it, and the successor must not assume either way", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("intend", 200, intent_op("agent-a", 1, "L1", "charge-1")),
-                step("owner_is_lost", 1500, ck("agent-a", 1, "L1", 2, None, json!([]))),
-                step("successor_acquires", 1600, acquire_op("agent-b", "L2")),
-                step("replaying_the_action_is_refused", 1700, intent_op("agent-b", 2, "L2", "charge-1")),
-                seeded(step("completing_is_refused", 1710, ck("agent-b", 2, "L2", 2, Some("completed"), json!([rec("audit", "x")]))), &[("audit", "x")]),
-                step("reconcile_needs_evidence", 1720, reconcile_op("agent-b", 2, "L2", "charge-1", "executed", json!([]))),
-                seeded(step("reconcile_with_the_receipt", 1730, reconcile_op("agent-b", 2, "L2", "charge-1", "executed", receipt())), &[("receipts", "r1")]),
-                step("the_key_is_spent", 1740, intent_op("agent-b", 2, "L2", "charge-1")),
-                step("complete", 1750, ck("agent-b", 2, "L2", 2, Some("completed"), receipt())),
-            ]),
-            sequence("confirmed_non_execution_permits_a_new_attempt", "only evidence of non-execution releases the uncertainty, and the retry is a new action under a new key", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("intend", 200, intent_op("agent-a", 1, "L1", "charge-1")),
-                step("absence_is_not_evidence", 300, reconcile_op("agent-a", 1, "L1", "charge-1", "not_executed", json!([]))),
-                seeded(step("gateway_has_no_charge", 310, reconcile_op("agent-a", 1, "L1", "charge-1", "not_executed", json!([rec("gateway_audit", "a1")]))), &[("gateway_audit", "a1")]),
-                step("same_key_is_not_reused", 320, intent_op("agent-a", 1, "L1", "charge-1")),
-                step("new_attempt", 330, intent_op("agent-a", 1, "L1", "charge-2")),
-                seeded(step("new_attempt_verified", 340, outcome_op("agent-a", 1, "L1", "charge-2", receipt())), &[("receipts", "r1")]),
-                step("complete", 350, ck("agent-a", 1, "L1", 2, Some("completed"), receipt())),
-            ]),
-            sequence("an_unverified_outcome_stays_uncertain", "an outcome somebody reported is not an outcome FeltDB observed", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("intend", 200, intent_op("agent-a", 1, "L1", "charge-1")),
-                step("reported_without_evidence", 300, outcome_op("agent-a", 1, "L1", "charge-1", json!([]))),
-                step("reported_outcome_cannot_be_recorded_twice", 310, outcome_op("agent-a", 1, "L1", "charge-1", json!([]))),
-                seeded(step("completion_refused", 320, ck("agent-a", 1, "L1", 2, Some("completed"), json!([rec("audit", "x")]))), &[("audit", "x")]),
-                seeded(step("reconcile_with_evidence", 330, reconcile_op("agent-a", 1, "L1", "charge-1", "executed", receipt())), &[("receipts", "r1")]),
-                step("complete", 340, ck("agent-a", 1, "L1", 2, Some("completed"), receipt())),
-            ]),
-            sequence("a_stale_owner_cannot_act_after_takeover", "once another owner holds the task, the old owner's fence is dead for every operation", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("acquire_too_early", 999, acquire_op("agent-b", "L2")),
-                step("acquire_at_expiry", 1100, acquire_op("agent-b", "L2")),
-                step("old_owner_checkpoint", 1200, ck("agent-a", 1, "L1", 2, None, json!([]))),
-                step("old_owner_renew", 1200, renew_op("agent-a", 1, "L1")),
-                step("old_owner_intent", 1200, intent_op("agent-a", 1, "L1", "k")),
-                step("old_owner_handoff", 1200, offer("agent-a", 1, "L1", None)),
-                step("old_owner_with_new_fence", 1200, ck("agent-a", 2, "L2", 2, None, json!([]))),
-                step("new_owner_checkpoint", 1300, ck("agent-b", 2, "L2", 2, None, json!([]))),
-            ]),
-            sequence("lease_boundaries", "a lease is live strictly before expiresAt and expired at it, for renewal and for work", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("renew_one_ms_before_expiry", 999, renew_op("agent-a", 1, "L1")),
-                step("work_one_ms_before_new_expiry", 1998, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("work_at_exact_expiry", 1999, ck("agent-a", 1, "L1", 2, None, json!([]))),
-                step("renew_at_exact_expiry", 1999, renew_op("agent-a", 1, "L1")),
-                step("acquire_one_ms_early", 1998, acquire_op("agent-b", "L2")),
-                step("acquire_at_expiry", 1999, acquire_op("agent-b", "L2")),
-            ]),
-            sequence("handoff_claim_and_accept", "offer, a wrong claimant is refused, the right one claims, the offerer is fenced out, and acceptance is final", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("offer", 200, offer("agent-a", 1, "L1", Some("agent-b"))),
-                step("offer_again", 210, offer("agent-a", 1, "L1", Some("agent-b"))),
-                step("wrong_claimant", 300, claim("agent-c", "L9")),
-                step("claim", 400, claim("agent-b", "L2")),
-                step("claim_again_by_another", 410, claim("agent-c", "L3")),
-                step("offerer_is_fenced_out", 420, ck("agent-a", 1, "L1", 2, None, json!([]))),
-                step("accept", 500, accept("agent-b", 2, "L2")),
-                step("accept_again", 510, accept("agent-b", 2, "L2")),
-                step("claim_after_accept", 520, claim("agent-b", "L5")),
-            ]),
-            sequence("handoff_abandoned_claim_is_recoverable_once", "an abandoned claim can be taken after expiry, and the first claimant is then fenced out", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("offer_to_anyone", 200, offer("agent-a", 1, "L1", None)),
-                step("b_claims", 300, claim("agent-b", "L2")),
-                step("c_cannot_claim_while_live", 400, claim("agent-c", "L3")),
-                step("c_claims_after_expiry", 1300, claim("agent-c", "L3")),
-                step("b_cannot_accept", 1400, accept("agent-b", 2, "L2")),
-                step("c_accepts", 1500, accept("agent-c", 3, "L3")),
-            ]),
-            sequence("handoff_goes_stale_when_the_task_moves_on", "a handoff names a checkpoint; progress past it makes the offer stale", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("offer", 200, offer("agent-a", 1, "L1", None)),
-                step("owner_moves_on", 300, ck("agent-a", 1, "L1", 2, None, json!([]))),
-                step("claim_is_stale", 400, claim("agent-b", "L2")),
-            ]),
-            sequence("repeated_operations", "which repeats are no-ops, which are refused, and which would be a different action", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("create_again_is_a_noop", 10, create("agent-a", "L1")),
-                step("create_with_another_objective", 20, json!({"op": "create_task", "task_id": "t1", "actor": "agent-a", "objective": "Other", "lease_id": "L1", "lease_ms": 1000})),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("the_same_checkpoint_again_conflicts", 110, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("intend", 200, intent_op("agent-a", 1, "L1", "k")),
-                step("intend_again_is_uncertain", 210, intent_op("agent-a", 1, "L1", "k")),
-                step("offer", 300, offer("agent-a", 1, "L1", Some("agent-b"))),
-                step("claim", 400, claim("agent-b", "L2")),
-                step("claim_retry_by_holder_is_a_noop", 410, claim("agent-b", "L2")),
-                step("accept", 500, accept("agent-b", 2, "L2")),
-                step("accept_retry_is_a_noop", 510, accept("agent-b", 2, "L2")),
-            ]),
-            sequence("cancel_keeps_uncertainty_visible", "cancelling is allowed with an unresolved action and the count stays on the terminal task", vec![
-                step("create", 0, create("agent-a", "L1")),
-                step("start", 100, ck("agent-a", 1, "L1", 1, Some("running"), json!([]))),
-                step("intend", 200, intent_op("agent-a", 1, "L1", "k")),
-                step("cancel", 300, ck("agent-a", 1, "L1", 2, Some("cancelled"), json!([]))),
-                step("no_late_reconcile_in_v1", 310, reconcile_op("agent-a", 1, "L1", "k", "executed", json!([]))),
-            ]),
-        ]
-    }
-}