orbit-agent-runtime 0.8.0

package/dist/test/replay_compat.test.js

@@ -0,0 +1,1122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const core_hub_1 = require("@orbit/core-hub");
+const core_hub_2 = require("@orbit/core-hub");
+const core_hub_3 = require("@orbit/core-hub");
+const core_hub_4 = require("@orbit/core-hub");
+const core_hub_5 = require("@orbit/core-hub");
+const core_hub_6 = require("@orbit/core-hub");
+const core_hub_7 = require("@orbit/core-hub");
+const core_hub_8 = require("@orbit/core-hub");
+const core_hub_9 = require("@orbit/core-hub");
+const pae_engine_1 = require("@orbit/pae-engine");
+const pae_engine_2 = require("@orbit/pae-engine");
+const pae_engine_3 = require("@orbit/pae-engine");
+const pae_engine_4 = require("@orbit/pae-engine");
+const pae_engine_5 = require("@orbit/pae-engine");
+const pae_engine_6 = require("@orbit/pae-engine");
+const pae_engine_7 = require("@orbit/pae-engine");
+const pae_engine_8 = require("@orbit/pae-engine");
+const pae_engine_9 = require("@orbit/pae-engine");
+const pae_engine_10 = require("@orbit/pae-engine");
+const pae_engine_11 = require("@orbit/pae-engine");
+const sandbox_runtime_1 = require("@orbit/sandbox-runtime");
+const sandbox_runtime_2 = require("@orbit/sandbox-runtime");
+const sandbox_runtime_3 = require("@orbit/sandbox-runtime");
+const sandbox_runtime_4 = require("@orbit/sandbox-runtime");
+const sandbox_runtime_5 = require("@orbit/sandbox-runtime");
+const orbitRuntimeHost_1 = require("../src/core/orbitRuntimeHost");
+const infra_common_1 = require("@orbit/infra-common");
+const infra_common_2 = require("@orbit/infra-common");
+/**
+ * W2 gate: the replay-compatibility suite. Every new channel mechanism MUST
+ * pass "record → replay, byte-identical, zero side effects, zero external
+ * calls" before it is allowed into the kernel (kernel charter, axiom A1).
+ * CI treats this file as a merge gate.
+ *
+ * Every script is executed twice: once with replayMode "record" (real
+ * channels, outputs journaled) and once with "replay" (journal injection,
+ * channels never run). Byte-identity and reconciliation are then asserted.
+ */
+const NODE = process.execPath;
+function makeCtx(mode, overrides = {}) {
+    return { traceMarkId: "t-compat", maxWaitMs: 30_000, replayMode: mode, ...overrides };
+}
+/**
+ * Run one script twice against the same hub: first in record mode (real
+ * channels), then in replay mode (journal injection). Returns both outputs
+ * plus the reconciliation report over the two journals.
+ */
+async function recordThenReplay(hub, script) {
+    const recordJournal = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(recordJournal);
+    const live = await script("record");
+    const replayJournal = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(replayJournal);
+    hub.attachReplayEngine(new core_hub_6.ReplayEngine(recordJournal));
+    const replayed = await script("replay");
+    const report = new core_hub_6.ReplayEngine(recordJournal).reconcile(recordJournal.snapshot(), replayJournal.snapshot());
+    return { live, replayed, recordJournal, reconcileDigestChain: report.digestChainConsistent };
+}
+// ---------------------------------------------------------------------------
+// FileChannel
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat FileChannel: record → delete disk → replay is byte-identical with zero IO", async () => {
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-file-"));
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: root }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const script = async (mode) => {
+        const bytes = await hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "writeTextFile", "data/a.txt", "orbit replay proof");
+        const content = await hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "readTextFile", "data/a.txt");
+        const listing = await hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "listDir", "data");
+        const stat = await hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "statPath", "data/a.txt");
+        return { bytes, content, listing, stat };
+    };
+    const { live, replayed, recordJournal, reconcileDigestChain } = await recordThenReplay(hub, script);
+    strict_1.default.equal(live.content, "orbit replay proof");
+    strict_1.default.deepEqual(replayed, live);
+    strict_1.default.equal(reconcileDigestChain, true);
+    // The proof of "zero IO on replay": wipe the directory, replay again, and
+    // the outputs still come back identical from the journal alone.
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    const replayJournal2 = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(replayJournal2);
+    hub.attachReplayEngine(new core_hub_6.ReplayEngine(recordJournal)); // start a new replay session
+    const replayed2 = await script("replay");
+    strict_1.default.deepEqual(replayed2, live);
+    strict_1.default.equal(new core_hub_6.ReplayEngine(recordJournal).reconcile(recordJournal.snapshot(), replayJournal2.snapshot()).digestChainConsistent, true);
+    await hub.teardown();
+});
+(0, node_test_1.test)("replay_compat FileChannel: a read of a missing file records null and replays null", async () => {
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-miss-"));
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: root }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const { live, replayed, reconcileDigestChain } = await recordThenReplay(hub, (mode) => hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "readTextFile", "ghost.txt"));
+    strict_1.default.equal(live, null);
+    strict_1.default.equal(replayed, null);
+    strict_1.default.equal(reconcileDigestChain, true);
+    await hub.teardown();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+// ---------------------------------------------------------------------------
+// ShellChannel
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat ShellChannel: replay reproduces the result without executing anything", async () => {
+    const workDir = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-shell-"));
+    const sideEffect = path.join(workDir, "side-effect.txt");
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.SHELL_EXEC, new core_hub_3.ShellChannel({ allowedCommands: [NODE], workDir, timeoutMs: 15_000 }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    // The command has an observable side effect: it writes a file.
+    const script = async (mode) => {
+        return hub.fireChannelCall(infra_common_2.ChannelKind.SHELL_EXEC, makeCtx(mode), "execCommand", NODE, ["-e", `require("fs").writeFileSync(${JSON.stringify(sideEffect)}, "executed"); process.stdout.write("cmd-output-42")`]);
+    };
+    const { live, replayed, recordJournal, reconcileDigestChain } = await recordThenReplay(hub, script);
+    strict_1.default.equal(live.stdout, "cmd-output-42");
+    strict_1.default.equal(live.exitCode, 0);
+    strict_1.default.deepEqual(replayed, live);
+    strict_1.default.equal(reconcileDigestChain, true);
+    // Zero-execution proof: delete the side-effect file, replay again — the
+    // result is still served from the journal and the file is NOT recreated.
+    await node_fs_1.promises.rm(sideEffect, { force: true });
+    const replayJournal2 = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(replayJournal2);
+    hub.attachReplayEngine(new core_hub_6.ReplayEngine(recordJournal)); // new replay session
+    const replayed2 = await script("replay");
+    strict_1.default.deepEqual(replayed2, live);
+    strict_1.default.equal(await node_fs_1.promises.stat(sideEffect).then(() => true, () => false), false, "replay must not re-execute commands");
+    await hub.teardown();
+    await node_fs_1.promises.rm(workDir, { recursive: true, force: true });
+});
+(0, node_test_1.test)("replay_compat ShellChannel: whitelist denials are deterministic pre-execution failures", async () => {
+    const workDir = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-deny-"));
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.SHELL_EXEC, new core_hub_3.ShellChannel({ allowedCommands: [NODE], workDir }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    await strict_1.default.rejects(hub.fireChannelCall(infra_common_2.ChannelKind.SHELL_EXEC, makeCtx("record"), "execCommand", "rm", ["-rf", "/"]), /not whitelisted/);
+    await hub.teardown();
+    await node_fs_1.promises.rm(workDir, { recursive: true, force: true });
+});
+// ---------------------------------------------------------------------------
+// OpenAICompatChannel
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat OpenAICompat: replay makes zero HTTP calls", async () => {
+    let fetchCalls = 0;
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.LLM_ACCESS, new core_hub_4.OpenAICompatChannel({
+        apiKey: "sk-test",
+        baseUrl: "https://replay.test",
+        fetchImpl: (async () => {
+            fetchCalls += 1;
+            return {
+                ok: true,
+                status: 200,
+                statusText: "OK",
+                json: async () => ({ choices: [{ message: { role: "assistant", content: "the recorded answer" } }] })
+            };
+        })
+    }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const { live, replayed, reconcileDigestChain } = await recordThenReplay(hub, (mode) => hub.fireChannelCall(infra_common_2.ChannelKind.LLM_ACCESS, makeCtx(mode), "chatRound", "what is determinism?"));
+    strict_1.default.equal(live, "the recorded answer");
+    strict_1.default.equal(replayed, live);
+    strict_1.default.equal(reconcileDigestChain, true);
+    strict_1.default.equal(fetchCalls, 1, "replay must not touch the network");
+    await hub.teardown();
+});
+(0, node_test_1.test)("replay_compat OpenAICompat: retry-then-success records only the final output", async () => {
+    let attempt = 0;
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.LLM_ACCESS, new core_hub_4.OpenAICompatChannel({
+        apiKey: "sk-test",
+        baseUrl: "https://retry.test",
+        maxRetries: 2,
+        initialRetryDelayMs: 1,
+        fetchImpl: (async () => {
+            attempt += 1;
+            if (attempt <= 2) {
+                return {
+                    ok: false,
+                    status: 429,
+                    statusText: "Too Many Requests",
+                    json: async () => ({ error: { message: "slow down" } })
+                };
+            }
+            return {
+                ok: true,
+                status: 200,
+                statusText: "OK",
+                json: async () => ({ choices: [{ message: { role: "assistant", content: "after retries" } }] })
+            };
+        })
+    }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const { live, replayed, recordJournal, reconcileDigestChain } = await recordThenReplay(hub, (mode) => hub.fireChannelCall(infra_common_2.ChannelKind.LLM_ACCESS, makeCtx(mode), "chatRound", "hi"));
+    strict_1.default.equal(live, "after retries");
+    strict_1.default.equal(replayed, live);
+    strict_1.default.equal(recordJournal.size(), 1, "internal retries must not leak into the journal");
+    strict_1.default.equal(attempt, 3, "3 HTTP attempts happened during record (2 failures + 1 success)");
+    strict_1.default.equal(reconcileDigestChain, true);
+    await hub.teardown();
+});
+// ---------------------------------------------------------------------------
+// Cross-channel interleaving + persistence
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat multi-channel: interleaved LLM/File/Shell calls replay in order", async () => {
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-multi-"));
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: root }));
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.SHELL_EXEC, new core_hub_3.ShellChannel({ allowedCommands: [NODE], workDir: root }));
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.LLM_ACCESS, new core_hub_4.OpenAICompatChannel({
+        apiKey: "sk-test",
+        baseUrl: "https://multi.test",
+        fetchImpl: (async () => ({
+            ok: true,
+            status: 200,
+            statusText: "OK",
+            json: async () => ({ choices: [{ message: { role: "assistant", content: "llm says 7" } }] })
+        }))
+    }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const script = async (mode) => {
+        await hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "writeTextFile", "in.txt", "3+4=");
+        const llm = await hub.fireChannelCall(infra_common_2.ChannelKind.LLM_ACCESS, makeCtx(mode), "chatRound", "3+4=?");
+        const calc = await hub.fireChannelCall(infra_common_2.ChannelKind.SHELL_EXEC, makeCtx(mode), "execCommand", NODE, ["-e", "process.stdout.write(String(3+4))"]);
+        await hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "writeTextFile", "out.txt", `${llm} ${calc.stdout}`);
+        return hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "readTextFile", "out.txt");
+    };
+    const { live, replayed, recordJournal, reconcileDigestChain } = await recordThenReplay(hub, script);
+    strict_1.default.equal(live, "llm says 7 7");
+    strict_1.default.equal(replayed, live);
+    strict_1.default.equal(recordJournal.size(), 5);
+    // Channel kinds interleave in the exact recorded order.
+    strict_1.default.deepEqual(recordJournal.snapshot().map((r) => r.channelKind), [infra_common_2.ChannelKind.FILE_SYSTEM, infra_common_2.ChannelKind.LLM_ACCESS, infra_common_2.ChannelKind.SHELL_EXEC, infra_common_2.ChannelKind.FILE_SYSTEM, infra_common_2.ChannelKind.FILE_SYSTEM]);
+    strict_1.default.equal(reconcileDigestChain, true);
+    await hub.teardown();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+(0, node_test_1.test)("replay_compat persistence: save → load → replay across engine instances", async () => {
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-persist-"));
+    const traceFile = path.join(root, "trace.jsonl");
+    // "Process 1": record and persist.
+    const hub1 = new core_hub_1.ChannelHub();
+    hub1.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: path.join(root, "fs") }));
+    await hub1.setupAllBuiltInChannels(makeCtx("record"));
+    const recordJournal = new core_hub_5.RecordJournal();
+    hub1.attachRecordJournal(recordJournal);
+    const live = await hub1.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("record"), "writeTextFile", "a.txt", "persisted");
+    const liveRead = await hub1.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("record"), "readTextFile", "a.txt");
+    await (0, core_hub_7.saveRecordJournal)(recordJournal, traceFile);
+    await hub1.teardown();
+    // "Process 2": fresh hub, no FileChannel registered at all; pure replay.
+    const loaded = await (0, core_hub_7.loadRecordJournal)(traceFile);
+    const hub2 = new core_hub_1.ChannelHub();
+    const replayJournal = new core_hub_5.RecordJournal();
+    hub2.attachRecordJournal(replayJournal);
+    hub2.attachReplayEngine(new core_hub_6.ReplayEngine(loaded));
+    const replayedWrite = await hub2.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("replay"), "writeTextFile", "a.txt", "persisted");
+    const replayedRead = await hub2.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("replay"), "readTextFile", "a.txt");
+    strict_1.default.equal(replayedWrite, live);
+    strict_1.default.equal(replayedRead, liveRead);
+    const report = new core_hub_6.ReplayEngine(loaded).reconcile(recordJournal.snapshot(), replayJournal.snapshot());
+    strict_1.default.equal(report.digestChainConsistent, true);
+    await hub2.teardown();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+// ---------------------------------------------------------------------------
+// PAE adaptation surface (W15) — merge gate for foreign runtimes
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat PAE: replay serves foreign tool output without entering the adapter", async () => {
+    let foreignCalls = 0;
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    registry.register(new pae_engine_3.JsPaeAdapter({
+        adapterId: "compat-tools",
+        sourceEdition: "1.0.0",
+        tools: [
+            {
+                name: "renderCard",
+                capability: "channel:read",
+                handler: (args) => {
+                    foreignCalls += 1;
+                    return { title: String(args[0]), items: [1, 2, 3] };
+                }
+            }
+        ]
+    }));
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, new pae_engine_2.PaeChannel(registry));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const { live, replayed, reconcileDigestChain } = await recordThenReplay(hub, async (mode) => hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx(mode), "renderCard", "orbit"));
+    strict_1.default.deepEqual(replayed, live);
+    strict_1.default.equal(JSON.stringify(replayed), JSON.stringify(live), "byte-identical");
+    strict_1.default.equal(foreignCalls, 1, "the foreign runtime runs exactly once, during recording");
+    strict_1.default.ok(reconcileDigestChain);
+    await hub.teardown();
+});
+(0, node_test_1.test)("replay_compat PAE: an unregistered adapter is not needed to replay its trace", async () => {
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    registry.register(new pae_engine_3.JsPaeAdapter({
+        adapterId: "ephemeral",
+        tools: [{ name: "onceOnly", handler: () => "recorded-value" }]
+    }));
+    const channel = new pae_engine_2.PaeChannel(registry);
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, channel);
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const recordJournal = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(recordJournal);
+    const live = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("record"), "onceOnly");
+    strict_1.default.equal(live, "recorded-value");
+    // The adapter goes away entirely — as it would on a machine that lacks the
+    // foreign runtime, its credentials, or the network to reach it.
+    registry.unregister("ephemeral");
+    channel.syncTools();
+    strict_1.default.deepEqual(channel.installedTools(), []);
+    hub.attachReplayEngine(new core_hub_6.ReplayEngine(recordJournal));
+    const replayed = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("replay"), "onceOnly");
+    strict_1.default.equal(replayed, live, "replay depends on the journal, never on the foreign runtime");
+    await hub.teardown();
+});
+(0, node_test_1.test)("replay_compat PAE: adapters run with Math.random poisoned", async () => {
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    registry.register(new pae_engine_3.JsPaeAdapter({
+        adapterId: "seeded-tools",
+        tools: [
+            {
+                name: "seededPick",
+                // Determinism arrives through the injected context; an adapter that
+                // minted its own randomness would break replay, so the charter test
+                // poisons the global source while the call runs.
+                handler: (_args, ctx) => Math.floor((ctx.rng?.next() ?? 0) * 100)
+            }
+        ]
+    }));
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, new pae_engine_2.PaeChannel(registry));
+    await hub.setupAllBuiltInChannels(makeCtx("record", { rng: new core_hub_9.SeededRng(7) }));
+    const originalRandom = Math.random;
+    Math.random = () => {
+        throw new Error("bare Math.random inside a pae adapter (charter violation)");
+    };
+    try {
+        const first = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("record"), "seededPick");
+        strict_1.default.equal(typeof first, "number");
+    }
+    finally {
+        Math.random = originalRandom;
+    }
+    await hub.teardown();
+});
+// ---------------------------------------------------------------------------
+// Charter guard: no bare randomness anywhere in the new channel paths
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat charter: channels run with Math.random poisoned (no bare randomness)", async () => {
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-random-"));
+    let poisonedAttempts = 0;
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: root }));
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.SHELL_EXEC, new core_hub_3.ShellChannel({ allowedCommands: [NODE], workDir: root }));
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.LLM_ACCESS, new core_hub_4.OpenAICompatChannel({
+        apiKey: "sk-test",
+        baseUrl: "https://random.test",
+        maxRetries: 1,
+        initialRetryDelayMs: 1,
+        fetchImpl: (async () => {
+            // Alternate failures so the retry path also runs under the poison.
+            poisonedAttempts += 1;
+            if (poisonedAttempts % 2 === 1) {
+                return { ok: false, status: 503, statusText: "Service Unavailable", json: async () => ({ error: { message: "transient" } }) };
+            }
+            return {
+                ok: true,
+                status: 200,
+                statusText: "OK",
+                json: async () => ({ choices: [{ message: { role: "assistant", content: "poison-safe" } }] })
+            };
+        })
+    }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const originalRandom = Math.random;
+    Math.random = () => {
+        throw new Error("bare Math.random inside a channel (charter violation)");
+    };
+    try {
+        const file = await hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("record"), "readTextFile", "missing.txt");
+        strict_1.default.equal(file, null);
+        const shell = await hub.fireChannelCall(infra_common_2.ChannelKind.SHELL_EXEC, makeCtx("record"), "execCommand", NODE, ["-e", "process.stdout.write('ok')"]);
+        strict_1.default.equal(shell.exitCode, 0);
+        const llm = await hub.fireChannelCall(infra_common_2.ChannelKind.LLM_ACCESS, makeCtx("record"), "chatRound", "hi");
+        strict_1.default.equal(llm, "poison-safe");
+    }
+    finally {
+        Math.random = originalRandom;
+    }
+    await hub.teardown();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+// ---------------------------------------------------------------------------
+// Fault-classification interplay with record mode
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat: a recorded LLM fault is not swallowed by record mode", async () => {
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.LLM_ACCESS, new core_hub_4.OpenAICompatChannel({
+        apiKey: "sk-test",
+        baseUrl: "https://fault.test",
+        maxRetries: 0,
+        fetchImpl: (async () => ({
+            ok: false,
+            status: 401,
+            statusText: "Unauthorized",
+            json: async () => ({ error: { message: "bad key" } })
+        }))
+    }));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const recordJournal = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(recordJournal);
+    await strict_1.default.rejects(hub.fireChannelCall(infra_common_2.ChannelKind.LLM_ACCESS, makeCtx("record"), "chatRound", "hi"), (err) => {
+        strict_1.default.ok(err instanceof core_hub_4.LlmChannelFaultError);
+        strict_1.default.equal(err.faultKind, "auth");
+        return true;
+    });
+    strict_1.default.equal(recordJournal.size(), 0, "failed calls are never journaled");
+    await hub.teardown();
+});
+(0, node_test_1.test)("replay_compat: digest of identical inputs matches across channels and runs", () => {
+    const a = (0, infra_common_1.digestInputs)("x", 1, { k: "v" });
+    const b = (0, infra_common_1.digestInputs)("x", 1, { k: "v" });
+    const c = (0, infra_common_1.digestInputs)("x", 2, { k: "v" });
+    strict_1.default.equal(a, b);
+    strict_1.default.notEqual(a, c);
+});
+// ---------------------------------------------------------------------------
+// MCP adaptation surface (W16) — merge gate for cross-process foreign runtimes
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat MCP: replay serves the peer's output without re-entering the process", async () => {
+    let peerCalls = 0;
+    const transport = new pae_engine_5.InMemoryMcpTransport((method, params) => {
+        if (method === "initialize") {
+            return { protocolVersion: pae_engine_6.MCP_PROTOCOL_VERSION, serverInfo: { name: "compat-mcp", version: "1.0.0" } };
+        }
+        if (method === "notifications/initialized")
+            return {};
+        if (method === "tools/list")
+            return { tools: [{ name: "renderCard", description: "render a card" }] };
+        if (method === "tools/call") {
+            peerCalls += 1;
+            const p = params;
+            return { content: [{ type: "text", text: `card:${String(p.arguments.title)}` }] };
+        }
+        throw new Error(`unexpected method ${method}`);
+    });
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    const adapter = new pae_engine_4.McpPaeAdapter({
+        adapterId: "mcp-compat",
+        sourceEdition: "1.0.0",
+        transport
+    });
+    await adapter.setup(makeCtx("record"));
+    registry.register(adapter);
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, new pae_engine_2.PaeChannel(registry));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const { live, replayed, reconcileDigestChain } = await recordThenReplay(hub, async (mode) => hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx(mode), "renderCard", { title: "orbit" }));
+    strict_1.default.equal(live, "card:orbit");
+    strict_1.default.equal(replayed, live);
+    strict_1.default.equal(JSON.stringify(replayed), JSON.stringify(live), "byte-identical across a process boundary");
+    strict_1.default.equal(peerCalls, 1, "the peer is entered exactly once, during recording");
+    strict_1.default.ok(reconcileDigestChain);
+    await hub.teardown();
+});
+(0, node_test_1.test)("replay_compat MCP: a trace replays after its peer is gone", async () => {
+    const transport = new pae_engine_5.InMemoryMcpTransport((method) => {
+        if (method === "initialize") {
+            return { protocolVersion: pae_engine_6.MCP_PROTOCOL_VERSION, serverInfo: { name: "mcp", version: "1.0.0" } };
+        }
+        if (method === "notifications/initialized")
+            return {};
+        if (method === "tools/list")
+            return { tools: [{ name: "remoteLookup" }] };
+        return { content: [{ type: "text", text: "remote-value" }] };
+    });
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    const adapter = new pae_engine_4.McpPaeAdapter({
+        adapterId: "mcp-ephemeral",
+        sourceEdition: "1.0.0",
+        transport
+    });
+    await adapter.setup(makeCtx("record"));
+    registry.register(adapter);
+    const channel = new pae_engine_2.PaeChannel(registry);
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, channel);
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const recordJournal = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(recordJournal);
+    const live = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("record"), "remoteLookup", {});
+    strict_1.default.equal(live, "remote-value");
+    /*
+     * The MCP server is shut down and its adapter removed — as it would be on a
+     * machine that lacks the peer, its credentials, or the network to reach it.
+     * Replaying must depend on the journal alone.
+     */
+    registry.unregister("mcp-ephemeral");
+    channel.syncTools();
+    await registry.drainReleases();
+    strict_1.default.equal(transport.closed, true, "the peer is released when its adapter goes away");
+    hub.attachReplayEngine(new core_hub_6.ReplayEngine(recordJournal));
+    const replayed = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("replay"), "remoteLookup", {});
+    strict_1.default.equal(replayed, live, "replay needs the journal, never the foreign process");
+    await hub.teardown();
+});
+// ---------------------------------------------------------------------------
+// OpenAPI adaptation surface (W17) — merge gate for foreign REST runtimes
+// ---------------------------------------------------------------------------
+const OPENAPI_DOC = {
+    openapi: "3.0.1",
+    info: { title: "Compat Pet", version: "2.0.0" },
+    servers: [{ url: "https://api.petstore.test/v1" }],
+    paths: {
+        "/echo": {
+            get: {
+                operationId: "echoTool",
+                parameters: [{ name: "msg", in: "query", required: true }]
+            }
+        }
+    }
+};
+(0, node_test_1.test)("replay_compat OpenAPI: replay serves the server's output without re-entering the network", async () => {
+    let peerCalls = 0;
+    const transport = new pae_engine_8.InMemoryHttpTransport((req) => {
+        peerCalls += 1;
+        return { status: 200, body: JSON.stringify({ url: req.url }) };
+    });
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    const adapter = new pae_engine_7.OpenApiPaeAdapter({
+        adapterId: "openapi-compat",
+        document: OPENAPI_DOC,
+        transport
+    });
+    await adapter.setup(makeCtx("record"));
+    registry.register(adapter);
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, new pae_engine_2.PaeChannel(registry));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const { live, replayed, reconcileDigestChain } = await recordThenReplay(hub, async (mode) => hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx(mode), "echoTool", { msg: "orbit" }));
+    strict_1.default.deepEqual(live, { url: "https://api.petstore.test/v1/echo?msg=orbit" });
+    strict_1.default.deepEqual(replayed, live);
+    strict_1.default.equal(peerCalls, 1, "the server is entered exactly once, during recording");
+    strict_1.default.ok(reconcileDigestChain);
+    await hub.teardown();
+});
+(0, node_test_1.test)("replay_compat OpenAPI: a trace replays after the server is gone", async () => {
+    const transport = new pae_engine_8.InMemoryHttpTransport(() => ({
+        status: 200,
+        body: JSON.stringify({ url: "https://api.petstore.test/v1/echo?msg=gone" })
+    }));
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    const adapter = new pae_engine_7.OpenApiPaeAdapter({
+        adapterId: "openapi-ephemeral",
+        document: OPENAPI_DOC,
+        transport
+    });
+    await adapter.setup(makeCtx("record"));
+    registry.register(adapter);
+    const channel = new pae_engine_2.PaeChannel(registry);
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, channel);
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const recordJournal = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(recordJournal);
+    const live = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("record"), "echoTool", { msg: "gone" });
+    strict_1.default.deepEqual(live, { url: "https://api.petstore.test/v1/echo?msg=gone" });
+    /*
+     * The API server is shut down and its adapter removed — as it would be on a
+     * machine that lacks the endpoint, its credentials, or the network to reach
+     * it. Replaying must depend on the journal alone.
+     */
+    registry.unregister("openapi-ephemeral");
+    channel.syncTools();
+    hub.attachReplayEngine(new core_hub_6.ReplayEngine(recordJournal));
+    const replayed = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("replay"), "echoTool", { msg: "gone" });
+    strict_1.default.deepEqual(replayed, live, "replay needs the journal, never the foreign server");
+    await hub.teardown();
+});
+// ---------------------------------------------------------------------------
+// Cordis adaptation surface (W18) — merge gate for isolated plugin hosts
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat Cordis: replay serves the host's output without re-entering the process", async () => {
+    let hostCalls = 0;
+    const transport = new pae_engine_10.InMemoryCordisTransport((method, params) => {
+        if (method === "initialize") {
+            return { protocolVersion: pae_engine_11.CORDIS_PROTOCOL_VERSION, hostInfo: { name: "compat-cordis", version: "1.0.0" } };
+        }
+        if (method === "tools/list")
+            return { tools: [{ name: "renderCard", description: "render a card" }] };
+        if (method === "tools/call") {
+            hostCalls += 1;
+            const p = params;
+            return { card: `card:${String(p.arguments.title)}` };
+        }
+        throw new Error(`unexpected method ${method}`);
+    });
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    const adapter = new pae_engine_9.CordisPaeAdapter({
+        adapterId: "cordis-compat",
+        sourceEdition: "1.0.0",
+        transport
+    });
+    await adapter.setup(makeCtx("record"));
+    registry.register(adapter);
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, new pae_engine_2.PaeChannel(registry));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const { live, replayed, reconcileDigestChain } = await recordThenReplay(hub, async (mode) => hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx(mode), "renderCard", { title: "orbit" }));
+    strict_1.default.deepEqual(live, { card: "card:orbit" });
+    strict_1.default.deepEqual(replayed, live);
+    strict_1.default.equal(JSON.stringify(replayed), JSON.stringify(live), "byte-identical across a process boundary");
+    strict_1.default.equal(hostCalls, 1, "the host is entered exactly once, during recording");
+    strict_1.default.ok(reconcileDigestChain);
+    await hub.teardown();
+});
+(0, node_test_1.test)("replay_compat Cordis: a trace replays after its host is gone", async () => {
+    const transport = new pae_engine_10.InMemoryCordisTransport((method) => {
+        if (method === "initialize") {
+            return { protocolVersion: pae_engine_11.CORDIS_PROTOCOL_VERSION, hostInfo: { name: "cordis", version: "1.0.0" } };
+        }
+        if (method === "tools/list")
+            return { tools: [{ name: "hostLookup" }] };
+        return { value: "host-value" };
+    });
+    const registry = new pae_engine_1.PaeAdapterRegistry();
+    const adapter = new pae_engine_9.CordisPaeAdapter({
+        adapterId: "cordis-ephemeral",
+        sourceEdition: "1.0.0",
+        transport
+    });
+    await adapter.setup(makeCtx("record"));
+    registry.register(adapter);
+    const channel = new pae_engine_2.PaeChannel(registry);
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.PAE_TOOL, channel);
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const recordJournal = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(recordJournal);
+    const live = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("record"), "hostLookup", {});
+    strict_1.default.deepEqual(live, { value: "host-value" });
+    /*
+     * The Cordis host is shut down and its adapter removed — as it would be on a
+     * machine without the plugin instance, its credentials, or its runtime.
+     * Replaying must depend on the journal alone.
+     */
+    registry.unregister("cordis-ephemeral");
+    channel.syncTools();
+    hub.attachReplayEngine(new core_hub_6.ReplayEngine(recordJournal));
+    const replayed = await hub.fireChannelCall(infra_common_2.ChannelKind.PAE_TOOL, makeCtx("replay"), "hostLookup", {});
+    strict_1.default.deepEqual(replayed, live, "replay needs the journal, never the foreign host");
+    await hub.teardown();
+});
+// ---------------------------------------------------------------------------
+// Isolation domain surface (W19) — merge gate for graph-driven L2 domains
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat domain: replay serves the host's output without re-entering the process", async () => {
+    let hostCalls = 0;
+    const graph = new sandbox_runtime_5.ImpactDomainGraph();
+    graph.addNode("echo");
+    const manager = new sandbox_runtime_2.IsolationDomainManager({
+        transportFactory: () => new sandbox_runtime_3.InMemoryDomainTransport((method, params) => {
+            if (method === "initialize") {
+                return { protocolVersion: sandbox_runtime_4.DOMAIN_PROTOCOL_VERSION, hostInfo: { name: "compat-domain", version: "1.0.0" } };
+            }
+            if (method === "units/list") {
+                return { units: [{ id: "echo", tools: [{ name: "sum" }] }] };
+            }
+            if (method === "units/call") {
+                hostCalls += 1;
+                const p = params;
+                return p.arguments.numbers.reduce((a, b) => a + b, 0);
+            }
+            throw new Error(`unexpected method ${method}`);
+        }),
+        defaultTimeoutMs: 10_000
+    });
+    await manager.syncDomains(graph, makeCtx("record"));
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.DOMAIN_TOOL, new sandbox_runtime_1.DomainChannel(manager));
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const { live, replayed, reconcileDigestChain } = await recordThenReplay(hub, async (mode) => hub.fireChannelCall(infra_common_2.ChannelKind.DOMAIN_TOOL, makeCtx(mode), "echo:sum", { numbers: [1, 2, 3] }));
+    strict_1.default.equal(live, 6);
+    strict_1.default.equal(replayed, live);
+    strict_1.default.equal(JSON.stringify(replayed), JSON.stringify(live), "byte-identical across a process boundary");
+    strict_1.default.equal(hostCalls, 1, "the host is entered exactly once, during recording");
+    strict_1.default.ok(reconcileDigestChain);
+    await hub.teardown();
+    await manager.teardownAll();
+});
+(0, node_test_1.test)("replay_compat domain: a trace replays after the domain is gone", async () => {
+    const graph = new sandbox_runtime_5.ImpactDomainGraph();
+    graph.addNode("echo");
+    const manager = new sandbox_runtime_2.IsolationDomainManager({
+        transportFactory: () => new sandbox_runtime_3.InMemoryDomainTransport((method) => {
+            if (method === "initialize") {
+                return { protocolVersion: sandbox_runtime_4.DOMAIN_PROTOCOL_VERSION, hostInfo: { name: "domain", version: "1.0.0" } };
+            }
+            if (method === "units/list") {
+                return { units: [{ id: "echo", tools: [{ name: "sum" }] }] };
+            }
+            return 42;
+        }),
+        defaultTimeoutMs: 10_000
+    });
+    await manager.syncDomains(graph, makeCtx("record"));
+    const channel = new sandbox_runtime_1.DomainChannel(manager);
+    const hub = new core_hub_1.ChannelHub();
+    hub.registerBuiltInChannel(infra_common_2.ChannelKind.DOMAIN_TOOL, channel);
+    await hub.setupAllBuiltInChannels(makeCtx("record"));
+    const recordJournal = new core_hub_5.RecordJournal();
+    hub.attachRecordJournal(recordJournal);
+    const live = await hub.fireChannelCall(infra_common_2.ChannelKind.DOMAIN_TOOL, makeCtx("record"), "echo:sum", { numbers: [1, 2] });
+    strict_1.default.equal(live, 42);
+    /*
+     * The domain host is shut down and every domain torn down — as it would be on
+     * a machine without the process. Replaying must depend on the journal alone.
+     */
+    await manager.teardownAll();
+    channel.syncTools();
+    hub.attachReplayEngine(new core_hub_6.ReplayEngine(recordJournal));
+    const replayed = await hub.fireChannelCall(infra_common_2.ChannelKind.DOMAIN_TOOL, makeCtx("replay"), "echo:sum", { numbers: [1, 2] });
+    strict_1.default.equal(replayed, live, "replay needs the journal, never the domain host");
+    await hub.teardown();
+});
+// ---------------------------------------------------------------------------
+// Domain transactions (W20) — a cross-domain hop as a gateway transaction
+// ---------------------------------------------------------------------------
+/** A host with one plugin unit whose domain host answers `ping` with its args. */
+async function hostWithDomainUnit() {
+    const host = new orbitRuntimeHost_1.OrbitRuntimeHost();
+    await host.bootHost();
+    host.registerPlugin({
+        id: "p.txn",
+        displayName: "p.txn",
+        edition: "1.0.0",
+        requireHostMinEdition: "0.2.0",
+        allowCapabilities: ["channel:read", "channel:write"],
+        declareChannelDeps: [infra_common_2.ChannelKind.LLM_ACCESS]
+    });
+    await host.allocateIsolationDomains({
+        transportFactory: () => new sandbox_runtime_3.InMemoryDomainTransport((method, params) => {
+            if (method === "initialize") {
+                return { protocolVersion: sandbox_runtime_4.DOMAIN_PROTOCOL_VERSION, hostInfo: { name: "txn-host", version: "1.0.0" } };
+            }
+            if (method === "units/list") {
+                return { units: [{ id: "p.txn", tools: [{ name: "ping" }] }] };
+            }
+            const p = params;
+            return { pong: p.arguments };
+        }),
+        maxImpactClosure: 1
+    });
+    return host;
+}
+(0, node_test_1.test)("replay_compat domain txn: a cross-domain hop records and replays byte-identically", async () => {
+    const host = await hostWithDomainUnit();
+    try {
+        const recordJournal = host.beginRecording();
+        const live = await host.invokeDomainUnit("p.txn", "ping", [{ hello: "world" }], { pluginUnitId: "p.txn" });
+        strict_1.default.deepEqual(live.pong, { hello: "world" });
+        // One transaction, settled — the ledger balances before replay even starts.
+        const ledger = host.domainLedger();
+        strict_1.default.equal(ledger.length, 1);
+        strict_1.default.equal(ledger[0].state, "settled");
+        strict_1.default.equal(host.reconcileDomainTransactions().balanced, true);
+        host.attachReplayEngine(recordJournal);
+        const replayed = await host.invokeDomainUnit("p.txn", "ping", [{ hello: "world" }], { pluginUnitId: "p.txn", mode: "replay" });
+        strict_1.default.deepEqual(replayed, live);
+        strict_1.default.equal(JSON.stringify(replayed), JSON.stringify(live), "byte-identical across the domain boundary");
+        /*
+         * Replay never re-enters the domain: the frozen output is injected at the
+         * gateway, so the physical layer is not touched and no new transaction is
+         * opened. That is axiom A1 expressed on the ledger.
+         */
+        strict_1.default.equal(host.domainLedger().length, 1, "replay injects the output, it does not re-enter the domain");
+        strict_1.default.equal(host.reconcileDomainTransactions().balanced, true);
+        /*
+         * Replay is not a free pass. A fresh replay session (attaching the engine
+         * resets the cursor) replaying a *different* input must surface as call
+         * drift, not silently serve the frozen output.
+         */
+        host.attachReplayEngine(recordJournal);
+        await strict_1.default.rejects(() => host.invokeDomainUnit("p.txn", "ping", [{ hello: "changed" }], {
+            pluginUnitId: "p.txn",
+            mode: "replay"
+        }), /signature mismatch/, "a changed input is call drift, not a replay hit");
+    }
+    finally {
+        await host.shutdownHost();
+    }
+});
+(0, node_test_1.test)("replay_compat domain txn: a trace replays after every domain is released", async () => {
+    const host = await hostWithDomainUnit();
+    const recordJournal = host.beginRecording();
+    const live = await host.invokeDomainUnit("p.txn", "ping", [{ n: 1 }], { pluginUnitId: "p.txn" });
+    strict_1.default.deepEqual(live.pong, { n: 1 });
+    /*
+     * Release the physical layer entirely — every domain host is torn down, as it
+     * would be on a machine that never had the child processes. Replaying must
+     * depend on the journal alone.
+     */
+    await host.releaseIsolationDomains();
+    strict_1.default.deepEqual(host.domains(), []);
+    host.attachReplayEngine(recordJournal);
+    const replayed = await host.invokeDomainUnit("p.txn", "ping", [{ n: 1 }], { pluginUnitId: "p.txn", mode: "replay" });
+    strict_1.default.deepEqual(replayed, live, "replay needs the journal, never the domain host");
+    await host.shutdownHost();
+});
+// ---------------------------------------------------------------------------
+// Journal durability (W27) — merge gate for the write-ahead log
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat wal: a run mirrored to the WAL replays byte-identically in a fresh process", async () => {
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-wal-"));
+    const walFile = path.join(root, "record.wal.jsonl");
+    // "Process 1": record live, mirroring every call to the WAL as it happens.
+    const hub1 = new core_hub_1.ChannelHub();
+    hub1.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: path.join(root, "fs") }));
+    await hub1.setupAllBuiltInChannels(makeCtx("record"));
+    const durable = new core_hub_8.PersistedRecordJournal(walFile, { truncate: true });
+    hub1.attachRecordJournal(durable);
+    const liveWrite = await hub1.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("record"), "writeTextFile", "a.txt", "wal-durable");
+    const liveRead = await hub1.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("record"), "readTextFile", "a.txt");
+    await durable.flush();
+    await hub1.teardown();
+    // "Process 2": recover from the WAL alone. No FileChannel is registered, so
+    // a replay hit is the only way the calls can resolve.
+    const recovered = await core_hub_8.PersistedRecordJournal.recover(walFile);
+    strict_1.default.deepEqual(recovered.snapshot(), durable.snapshot(), "WAL recovery is byte-identical");
+    const hub2 = new core_hub_1.ChannelHub();
+    const replayJournal = new core_hub_5.RecordJournal();
+    hub2.attachRecordJournal(replayJournal);
+    hub2.attachReplayEngine(new core_hub_6.ReplayEngine(recovered));
+    const replayedWrite = await hub2.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("replay"), "writeTextFile", "a.txt", "wal-durable");
+    const replayedRead = await hub2.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("replay"), "readTextFile", "a.txt");
+    strict_1.default.equal(replayedWrite, liveWrite);
+    strict_1.default.equal(replayedRead, liveRead);
+    const report = new core_hub_6.ReplayEngine(recovered).reconcile(durable.snapshot(), replayJournal.snapshot());
+    strict_1.default.equal(report.digestChainConsistent, true);
+    await hub2.teardown();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+(0, node_test_1.test)("replay_compat wal: a crash-truncated WAL replays its surviving prefix byte-identically", async () => {
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-wal-crash-"));
+    const walFile = path.join(root, "record.wal.jsonl");
+    const hub1 = new core_hub_1.ChannelHub();
+    hub1.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: path.join(root, "fs") }));
+    await hub1.setupAllBuiltInChannels(makeCtx("record"));
+    const durable = new core_hub_8.PersistedRecordJournal(walFile, { truncate: true });
+    hub1.attachRecordJournal(durable);
+    const liveWrite = await hub1.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("record"), "writeTextFile", "a.txt", "prefix");
+    await durable.flush();
+    await hub1.teardown();
+    // A crash lands a partial line at the tail; recovery must drop exactly that.
+    await node_fs_1.promises.appendFile(walFile, '{"entryUid":"partial","orderIndex":1,"chan', "utf8");
+    const recovered = await core_hub_8.PersistedRecordJournal.recover(walFile);
+    strict_1.default.equal(recovered.size(), 1);
+    strict_1.default.deepEqual(recovered.snapshot(), durable.snapshot());
+    const hub2 = new core_hub_1.ChannelHub();
+    hub2.attachReplayEngine(new core_hub_6.ReplayEngine(recovered));
+    const replayedWrite = await hub2.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx("replay"), "writeTextFile", "a.txt", "prefix");
+    strict_1.default.equal(replayedWrite, liveWrite, "the surviving prefix still replays verbatim");
+    await hub2.teardown();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+(0, node_test_1.test)("replay_compat wal: durability does not perturb the recorded bytes", async () => {
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-wal-parity-"));
+    const walFile = path.join(root, "record.wal.jsonl");
+    const script = async (hub, mode) => {
+        await hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "writeTextFile", "p.txt", "parity");
+        return hub.fireChannelCall(infra_common_2.ChannelKind.FILE_SYSTEM, makeCtx(mode), "readTextFile", "p.txt");
+    };
+    // In-memory journal (the historical path).
+    const plainHub = new core_hub_1.ChannelHub();
+    plainHub.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: path.join(root, "plain") }));
+    await plainHub.setupAllBuiltInChannels(makeCtx("record"));
+    const plain = new core_hub_5.RecordJournal();
+    plainHub.attachRecordJournal(plain);
+    await script(plainHub, "record");
+    await plainHub.teardown();
+    // Durable journal over the same script.
+    const durableHub = new core_hub_1.ChannelHub();
+    durableHub.registerBuiltInChannel(infra_common_2.ChannelKind.FILE_SYSTEM, new core_hub_2.FileChannel({ rootDir: path.join(root, "durable") }));
+    await durableHub.setupAllBuiltInChannels(makeCtx("record"));
+    const durable = new core_hub_8.PersistedRecordJournal(walFile, { truncate: true });
+    durableHub.attachRecordJournal(durable);
+    await script(durableHub, "record");
+    await durable.flush();
+    await durableHub.teardown();
+    // Everything except the per-entry uid must be identical: durability is a
+    // mirror, never a mutation of what gets recorded.
+    const strip = (journal) => journal.snapshot().map(({ entryUid: _uid, durationMs: _ms, ...rest }) => rest);
+    strict_1.default.deepEqual(strip(durable), strip(plain));
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+// ---------------------------------------------------------------------------
+// Governance tiers (W29) — merge gate for the four-tier model
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat governance: a sandbox-tier recording refuses to replay as standard (config drift)", async () => {
+    const { OrbitRuntimeHost, PersistedRecordJournal, ChannelKind } = await Promise.resolve().then(() => __importStar(require("../src/index")));
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-gov-"));
+    const walFile = path.join(root, "record.wal.jsonl");
+    const tracePath = path.join(root, "trace.wal.jsonl");
+    // "Process 1": record one governed call under the sandbox tier.
+    const sandboxHost = new OrbitRuntimeHost({
+        governanceProfile: "sandbox",
+        recordJournalPath: walFile,
+        traceJournalPath: tracePath
+    });
+    await sandboxHost.bootHost();
+    sandboxHost.registerPlugin({
+        id: "gov.compat",
+        displayName: "Gov",
+        edition: "1.0.0",
+        requireHostMinEdition: "1.0.0",
+        allowCapabilities: ["channel:read"]
+    });
+    const ctx = { traceMarkId: "t-gov", maxWaitMs: 5000, pluginUnitId: "gov.compat" };
+    await sandboxHost.capabilityInvoke({
+        kind: ChannelKind.MEM_KV_STORE,
+        pluginId: "gov.compat",
+        funcName: "readEntry",
+        args: ["k"],
+        mode: "record",
+        ctx
+    });
+    await sandboxHost.shutdownHost();
+    const recorded = await PersistedRecordJournal.recover(walFile);
+    strict_1.default.ok(recorded.get(0).runFingerprint.governanceProfileHash, "sandbox-tier recordings carry the tier hash");
+    // "Process 2": a standard-tier host tries to replay the same window.
+    const standardHost = new OrbitRuntimeHost({
+        recordJournalPath: walFile,
+        traceJournalPath: path.join(root, "trace2.wal.jsonl")
+    });
+    await standardHost.bootHost();
+    standardHost.registerPlugin({
+        id: "gov.compat",
+        displayName: "Gov",
+        edition: "1.0.0",
+        requireHostMinEdition: "1.0.0",
+        allowCapabilities: ["channel:read"]
+    });
+    const resumed = await PersistedRecordJournal.recover(walFile);
+    standardHost.attachReplayEngine(resumed);
+    await strict_1.default.rejects(standardHost.capabilityInvoke({
+        kind: ChannelKind.MEM_KV_STORE,
+        pluginId: "gov.compat",
+        funcName: "readEntry",
+        args: ["k"],
+        mode: "replay",
+        ctx
+    }), (err) => {
+        strict_1.default.equal(err.errorToken, "RUN_FINGERPRINT_DRIFT", "cross-tier replay must surface as config drift, not digest drift");
+        return true;
+    });
+    await standardHost.shutdownHost();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+(0, node_test_1.test)("replay_compat governance: same-tier replay stays byte-identical across hosts", async () => {
+    const { OrbitRuntimeHost, PersistedRecordJournal, ChannelKind } = await Promise.resolve().then(() => __importStar(require("../src/index")));
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-gov-ok-"));
+    const walFile = path.join(root, "record.wal.jsonl");
+    const run = async (mode) => {
+        const host = new OrbitRuntimeHost({
+            governanceProfile: "strict",
+            auditSigningKey: "compat-gov-key",
+            recordJournalPath: walFile,
+            traceJournalPath: path.join(root, `trace-${mode}.wal.jsonl`)
+        });
+        await host.bootHost();
+        host.registerPlugin({
+            id: "gov.ok",
+            displayName: "Gov",
+            edition: "1.0.0",
+            requireHostMinEdition: "1.0.0",
+            allowCapabilities: ["channel:read"],
+            schema: { type: "object", properties: {} }
+        });
+        const ctx = { traceMarkId: `t-${mode}`, maxWaitMs: 5000, pluginUnitId: "gov.ok" };
+        if (mode === "record") {
+            const journal = host.beginRecording();
+            await host.capabilityInvoke({
+                kind: ChannelKind.MEM_KV_STORE,
+                pluginId: "gov.ok",
+                funcName: "readEntry",
+                args: ["k"],
+                mode: "record",
+                ctx
+            });
+            await journal.flush();
+            return { host, journal };
+        }
+        const resumed = await PersistedRecordJournal.recover(walFile);
+        // The gateway replays from ITS attached journal: attach the recovered
+        // snapshot through beginRecording, then switch the injection source.
+        const replayed = host.beginRecording();
+        replayed.restoreSnapshot(resumed.snapshot());
+        host.attachReplayEngine(replayed);
+        const out = await host.capabilityInvoke({
+            kind: ChannelKind.MEM_KV_STORE,
+            pluginId: "gov.ok",
+            funcName: "readEntry",
+            args: ["k"],
+            mode: "replay",
+            ctx
+        });
+        return { host, out };
+    };
+    const recordPhase = await run("record");
+    const replayPhase = await run("replay");
+    strict_1.default.equal(replayPhase.out, recordPhase.journal.get(0).outputSnapshot);
+    await recordPhase.host.shutdownHost();
+    await replayPhase.host.shutdownHost();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+// ---------------------------------------------------------------------------
+// Audit hash chain (W30) — merge gate: signing must not perturb replay
+// ---------------------------------------------------------------------------
+(0, node_test_1.test)("replay_compat audit: a signing-key host records and replays byte-identically", async () => {
+    const { OrbitRuntimeHost, PersistedRecordJournal, ChannelKind } = await Promise.resolve().then(() => __importStar(require("../src/index")));
+    const root = await node_fs_1.promises.mkdtemp(path.join(os.tmpdir(), "orbit-compat-audit-"));
+    const walFile = path.join(root, "record.wal.jsonl");
+    const tracePath = path.join(root, "trace.wal.jsonl");
+    // "Process 1": record one governed call under a signing-key host. The audit
+    // chain lives on the OBSERVATION layer; the recorded decision values must be
+    // untouched by it.
+    const host = new OrbitRuntimeHost({ auditSigningKey: "compat-key", recordJournalPath: walFile, traceJournalPath: tracePath });
+    await host.bootHost();
+    host.registerPlugin({
+        id: "audit.compat",
+        displayName: "Audit",
+        edition: "1.0.0",
+        requireHostMinEdition: "1.0.0",
+        allowCapabilities: ["channel:read"]
+    });
+    const ctx = { traceMarkId: "t-audit", maxWaitMs: 5000, pluginUnitId: "audit.compat" };
+    const live = await host.capabilityInvoke({
+        kind: ChannelKind.MEM_KV_STORE,
+        pluginId: "audit.compat",
+        funcName: "readEntry",
+        args: ["k"],
+        mode: "record",
+        ctx
+    });
+    await host.shutdownHost();
+    // "Process 2": replay the same window with the same signing key — the
+    // injected output must equal the live one, and the audit chain verifies.
+    const host2 = new OrbitRuntimeHost({ auditSigningKey: "compat-key", recordJournalPath: walFile, traceJournalPath: tracePath });
+    await host2.bootHost();
+    host2.registerPlugin({
+        id: "audit.compat",
+        displayName: "Audit",
+        edition: "1.0.0",
+        requireHostMinEdition: "1.0.0",
+        allowCapabilities: ["channel:read"]
+    });
+    const recovered = await PersistedRecordJournal.recover(walFile);
+    const replayJournal = host2.beginRecording();
+    replayJournal.restoreSnapshot(recovered.snapshot());
+    host2.attachReplayEngine(replayJournal);
+    const replayed = await host2.capabilityInvoke({
+        kind: ChannelKind.MEM_KV_STORE,
+        pluginId: "audit.compat",
+        funcName: "readEntry",
+        args: ["k"],
+        mode: "replay",
+        ctx
+    });
+    strict_1.default.equal(replayed, live, "signing the audit trail does not perturb recorded decisions");
+    const chain = host2.verifyAuditChain();
+    strict_1.default.equal(chain.consistent, true, "the audit chain stays provable across the replay");
+    await host2.shutdownHost();
+    await node_fs_1.promises.rm(root, { recursive: true, force: true });
+});
+//# sourceMappingURL=replay_compat.test.js.map