PaperClipAI/tests/runner-e2e/runner.spec.ts

import { isRollingWebDeployment, validControllerRollingDeploymentReceipt } from "./controller-rolling-deployment.js";
import type { ControllerReplacementReceipt } from "./controller-replacement.js";
import { withSdkCanaryPreFixture, captureSdkCanaryPreFixture } from "./sdk-canary-prefixture.js";
import { withholdPrivateScreenshots } from "./screenshot-privacy.js";
import { ordinaryChatCapture } from "./chat-screenshot-capture.js";
import { boundaryStandardSnapshots, emptyBoundaryResourceTrail, recordBoundaryResources } from "./chat-boundary-standard-evidence.js";
import { checkSetupHealthCredential } from "./chat-setup-credential.js";
import { SetupHealthAbort, runChatSetupHealth, captureSetupHealthProfile } from "./chat-setup-health.js";
import { bindInvitationEnrollmentPrerequisite } from "./chat-catalog-domains/identity-invite-prerequisite.js";
import { verifyInvitationSourceProof } from "./chat-catalog-domains/identity-invite-source-proof.js";
import { readChatPrivateInputs, chatPrivateSetupBlockers, chatPrivateInputRequirements } from "./chat-private-inputs.js";
import { isProductDeliveredSecret, trackedPrivateSecrets } from "./private-diagnostics.js";
import { findChatCatalogCase } from "./chat-catalog-registry.js";
import { runChatBoundaryFlow } from "./chat-boundary-flow.js";
import { chatCatalogScenarios } from "./chat-catalog-inventory.js";
import { kimiCandidateAdmissionForExecution } from "./server-restart-request.js";
import { runPlanRevisionAcceptance, isPendingPlanConfirmation, normalizePlanMarkdown, expectPlanStageVisible } from "./plan-revision-flow.js";
import { createWorkerTiming } from "./worker-timing.js";
import { captureTaskChat, type TaskChatEvidence } from "./task-chat.js";
import { FEEDBACK_PERSISTENCE_SUITE, gradeFeedbackPersistence } from "./feedback-persistence.js";
import { EvalAttemptTrace, evalBraintrustConfig, EVAL_OBSERVABILITY_SECRET_NAMES } from "./braintrust.js";
import { captureFollowupStopFailureApiState } from "./followup-stop-evidence.js";
import { controllerOutageForExecution, validControllerOutageReceipt, type ControllerOutage, type ControllerOutageReceipt } from "./controller-outage.js";
import { runFollowupStopResumeFlow } from "./followup-stop-resume-flow.js";
import { runFinalizationRecoveryFlow } from "./finalization-recovery-flow.js";
import type { FinalizationCrashBinding } from "./finalization-crash-boundary.js";
import { runCaseHandoffsFlow } from "./case-handoffs-flow.js";
import { runCaseReceiptFlow } from "./case-receipt-flow.js";
import { runTaskWorkspacesFlow } from "./task-workspaces-flow.js";
import { runRepositoryVerificationFlow } from "./repository-verification-flow.js";
import { runAutomaticRepositoryFlow } from "./automatic-repository-flow.js";
import { runNativeActiveStopFlow as runCopilotActiveStopFlow } from "./copilot-active-stop-flow.js";
import { nativeActiveStopTasks as copilotActiveStopTasks } from "./copilot-active-stop-tasks.js";
import type { RestartRunnerIdentity } from "./process-tree-owner.js";
import { runNativeActiveStopFlow } from "./native-active-stop-flow.js";
import { runCursorCloudStopFlow } from "./cursor-cloud-stop-flow.js";
import { CursorCloudOwnedObserver, cursorCloudIdentityProof } from "./cursor-cloud-observer.js";
import { assertCursorCloudCallbackIngress } from "./cursor-cloud-callback-proxy.js";
import { runKimiLifecycleFlow } from "./kimi-lifecycle.js";
import { runPiControlsFlow } from "./pi-controls-flow.js";
import { runCursorNativeFlow } from "./cursor-native-flow.js";
import { createRemoteNativeBootstrap, createRemoteFixtureClient } from "./remote-native-bootstrap.js";
import { runCopilotProtectionFlow } from "./copilot-protection-flow.js";
import { runPiNativeFlow } from "./pi-native-flow.js";
import { seedPiFile, collectPiFileEvidence } from "./pi-file-evidence.js";
import { runPlanTaskFlow } from "./plan-task-flow.js";
import { assertNativeCompletionSelection, NATIVE_COMPLETION_PREFLIGHT_ENV, verifyNativeCompletionPreflight } from "./native-completion-admission.js";
import { assertNativeInstructionSelection, verifyNativeInstructionPreflight, NATIVE_INSTRUCTION_PREFLIGHT_ENV, NATIVE_INSTRUCTION_SUITE, NATIVE_INSTRUCTION_DEFAULT_SHA256 } from "./native-instruction-consolidation.js";
import { captureNativeDefault, gradeNativeDefault, nativeCompletionWorkspaceDigest } from "./native-completion-defaults.js";
import { gradeNativeCompletion, gradeNativeCompletionFinalAnswer } from "./native-completion-scoring.js";
import { assertNativeBlockerReply } from "./native-blocker-visible.js";
import { warmManagedFileEvidence } from "./warm-managed-files.js";
import { summarizeStartupReuse } from "../../packages/adapter-utils/src/startup-reuse.js";
import { gitFinalizationEvidence, gitStreamingEvidence, setupGitStreamingWorkspace } from "./daytona-git-streaming.js";
import { runsCompletionUpdateProbe, completionQualityControls, completionQualityStatus, judgeCompletionQuality, reserveCompletionQuality, type CompletionQualityRecord } from "./completion-quality.js";
import { runNativeProviderLossFlow } from "./native-provider-loss-flow.js";
import { ownedActiveCleanupRunIds, mayAllocateRemoteResources, runCleanupWithObservers, verifyCleanupAssertions, type CleanupAssertion } from "./cleanup-verification.js";
import { completionDelivery, type CompletionObservation } from "./completion-updates.js";
import { runInstructionPersistenceFlow } from "./instruction-persistence.js";
import { gradeApiResponsePaging, readResponseProof, responseEvidenceDescription } from "./api-response-reading.js";
import { CODEX_PLANNING_READ_ONLY_SUITE, gradePlanningWriteRefusal } from "./codex-planning-read-only.js";
import { artifactTransferDescription, gradeApiArtifactTransfer, readArtifactTransferSource, usesApiResponseProof } from "./api-artifact-transfer.js";
import { runBlockerFlow } from "./blocker-flow.js";
import { largeJournalEvidence } from "./journal-evidence.js";
import { observeBrowserBootstrap } from "./browser-bootstrap-diagnostics.js";
import { runAccountingFlow } from "./accounting-flow.js";
import type { Issue } from "../../packages/shared/src/types/issue.js";
import { lifecycleLiveCase, gradeLifecycleRepair } from "./lifecycle-live-cases.js";
import { runContinuationFlow } from "./continuation-flow.js";
import { runEverydayFlow } from "./everyday-flow.js";
import { gradeTaskTitle } from "./task-titles.js";
import { runContextIntegrityFlow } from "./context-integrity-flow.js";
import { runRepositorySkillsFlow } from "./repository-skills.js";
import { captureStockHarness, gradeStockHarness, gradeStockHire } from "./stock-harness.js";
import { verifyStockHarnessPreflight, STOCK_PREFLIGHT_ENV } from "./stock-harness-admission.js";
import { createTaskThroughUi, submitTaskReply } from "./user-actions.js";
import { armResponseTiming } from "./response-timing.js";

import { projectFirstTaskResult, runFirstTaskFlow, setupFirstTaskFixtures } from "./first-task-flow.js";
import { runChatFlow } from "./chat-flow.js";
import { gotoAfterServerRestart, restartChatServer } from "./chat-restart.js";
import { matchesRunCount, minimumRunCount } from "./run-count.js";
import { createHash, randomBytes } from "node:crypto";
import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
import path from "node:path";
import { expect, test, type Page } from "@playwright/test";
import { RunnerApi, pollUntil } from "./api.js";
import { buildRuntimeUsage, summarizeExecutionBilling } from "./billing.js";
import { collectAttemptFeedback, emptyFeedbackSummary } from "./feedback.js";
import { createKimiLifecycleTiming, finishBudgetedEvalSetup, waitForEvalAgentReady } from "./budgeted-setup.js";
import { establishPublicMcpSession, runPublicMcpFlow } from "./public-mcp-flow.js";
import { assistantUsage } from "./public-mcp-model.js";
import { runnerExecutionById } from "./catalog.js";
import { classifyFailure } from "./failure-classifier.js";
import { runnerE2EServerControlPaths } from "./harness-env.js";
import { setupConnectionReview } from "./connection-reviews.js";
import { setupLiveFixtures, selectFixtureRuntimeLeases, fixtureRuntimeCostCoverage, waitForFixtureDaytonaProvider, type LiveFixtureValues } from "./live-fixtures.js";
import { evaluateMatcher, persistedFinalRunMessage, type MatcherResult } from "./matchers.js";
import { readRegisteredArtifacts } from "./registered-artifact.js";
import {
  acceptedPlanSessionResetFailures,
  collectRunEvents,
  hasTerminalMalformedPlanConfirmation,
  isControlPlaneGovernedResponseWait,
  isNonExecutingReviewFenceRun,
  isOpenRouterDeepSeekHelloTerminalVariance,
  numberedPlanStepCount,
  providerSessionContinuityFailures,
  reasoningProjectionFailures,
} from "./run-observations.js";
import { resolveRunnerE2ESource } from "./source.js";
import { isValidNativePrpEnvelope } from "./native-event-envelope.js";
import {
  isPublicRunnerScreenshotRoute,
  isConferenceRoomOffBoundaryScreenshotRoute,
  PUBLIC_RUNNER_SCREENSHOT_MARKER,
} from "./screenshot-policy.js";
import {
  assertSecretFree,
  findSecretLeakInJsonValues,
  normalizedSecrets,
  sanitizeJson,
  browserDiagnosticUrl,
} from "./redaction.js";
import {
  CREDENTIAL_NAMES,
  type CredentialName,
  type FailureClass,
  type RunnerE2EResult,
} from "./types.js";
import { assertRunnerE2EPrerequisites } from "./prerequisites.js";

interface IssueRecord {
  id: string;
  identifier?: string | null;
  companyId: string;
  title: string;
  status: string;
  statusVersion?: number;
  workMode?: string;
  assigneeAgentId?: string | null;
  projectId?: string | null;
  projectWorkspaceId?: string | null;
  executionWorkspaceId?: string | null;
  executionRunId?: string | null;
  checkoutRunId?: string | null;
  scheduledRetry?: unknown;
  monitorNextCheckAt?: string | null;
}

interface CommentRecord {
  id: string;
  body?: string | null;
  authorType?: string | null;
  authorAgentId?: string | null;
  authorUserId?: string | null;
  createdByRunId?: string | null;
  createdAt?: string;
}

interface RunRecord {
  id: string;
  companyId: string;
  agentId: string;
  status: string;
  runtimeMode?: string;
  nativeIssueId?: string | null;
  continuationAttempt?: number;
  retryOfRunId?: string | null;
  runnerInstanceId?: string | null;
  nativeSessionId?: string | null;
  processPid?: number | null;
  processStartedAt?: string | null;
  contextSnapshot?: Record<string, unknown> | null;
  runnerProfileJson?: Record<string, unknown> | null;
  usageJson?: Record<string, unknown> | null;
  resultJson?: Record<string, unknown> | null;
  sessionIdBefore?: string | null;
  sessionIdAfter?: string | null;
  error?: string | null;
  errorCode?: string | null;
  startedAt?: string | null;
  finishedAt?: string | null;
}

interface EnvironmentLeaseRecord {
  id: string;
  status?: string;
  cleanupStatus?: string | null;
  leasePolicy?: string;
  providerLeaseId?: string | null;
  executionWorkspaceId?: string | null;
  metadata?: Record<string, unknown> | null;
  issueId?: string | null;
  heartbeatRunId?: string | null;
  provider?: string | null;
  acquiredAt?: string | null;
  releasedAt?: string | null;
  updatedAt?: string | null;
}

interface InteractionRecord {
  id: string;
  status: string;
  kind?: string;
  sourceRunId?: string | null;
  continuationPolicy?: string;
  payload?: {
    version?: number;
    acceptLabel?: string;
    rejectLabel?: string;
    target?: {
      type?: string;
      key?: string;
      revisionId?: string;
      revisionNumber?: number;
    };
    questions?: Array<{
      id: string;
      prompt: string;
      selectionMode: "single" | "multi";
      required?: boolean;
      options: Array<{ id: string; label: string }>;
    }>;
  };
  result?: {
    version?: number;
    answers?: Array<{
      questionId?: string;
      optionIds?: string[];
      otherText?: string;
    }>;
  } | null;
}
interface IssueDocumentRecord {
  id: string;
  key: string;
  body?: string | null;
  latestRevisionId?: string | null;
  latestRevisionNumber?: number;
}
interface RunEventRecord {
  seq?: number;
  eventType?: string;
  payload?: Record<string, unknown> | null;
  sourceInstanceId?: string | null;
  sourceEventId?: string | null;
  sourceSeq?: number | null;
  protocolSchemaVersion?: number | null;
}
const TERMINAL_RUN_STATUSES = new Set([
  "succeeded",
  "interrupted",
  "failed",
  "cancelled",
  "timed_out",
]);
const DEFINITIVE_FAILURE_RUN_STATUSES = new Set([
  "failed",
  "cancelled",
  "timed_out",
]);

function definitiveRunFailure(runs: readonly RunRecord[]) {
  const failed = runs.find((run) =>
    DEFINITIVE_FAILURE_RUN_STATUSES.has(run.status),
  );
  if (!failed) return undefined;
  return `heartbeat run ${failed.id} ended ${failed.status}${failed.errorCode ? ` (${failed.errorCode})` : ""}${failed.error ? `: ${failed.error}` : ""}`;
}

function chronologicalRunTime(run: RunRecord): number {
  const value = run.startedAt ?? run.finishedAt;
  if (!value) return 0;
  const parsed = Date.parse(value);
  return Number.isNaN(parsed) ? 0 : parsed;
}

function sortRunsChronologically(runs: readonly RunRecord[]): RunRecord[] {
  return [...runs].sort(
    (left, right) =>
      chronologicalRunTime(left) - chronologicalRunTime(right) ||
      left.id.localeCompare(right.id),
  );
}

async function restartIsolatedPaperclipServer(input: {
  api: RunnerApi;
  requestId: string;
  kimiCandidateAdmission?: import("../../packages/paperclip-runner/src/drivers/acpx/candidate-admission.js").AcpxCandidateAdmission;
  deadlineAt: number;
  preserveRunner?: RestartRunnerIdentity;
  discardControllerCache?: boolean;
  crashAfterResult?: FinalizationCrashBinding;
  controllerDowntimeMs?: number;
  controllerOutage?: ControllerOutage;
  rollingDeployment?: true;
  recoveryBinding?: import("./controller-recovery-observer.js").RecoveryBinding;
  onControllerOutage?: (receipt: ControllerReplacementReceipt) => Promise<void>;
}): Promise<void> {
  const {
    controlDirectory,
    restartRequestPath: requestPath,
    restartAcknowledgementPath: acknowledgementPath,
  } = runnerE2EServerControlPaths(temporaryRoot!);
  await mkdir(controlDirectory, { recursive: true });
  const temporaryRequestPath = `${requestPath}.${process.pid}.${input.requestId}.tmp`;
  await writeFile(
    temporaryRequestPath,
    JSON.stringify({ requestId: input.requestId, ...(input.kimiCandidateAdmission ? { kimiCandidateAdmission: input.kimiCandidateAdmission } : {}), ...(input.controllerDowntimeMs !== undefined && !input.controllerOutage ? { controllerDowntimeMs: input.controllerDowntimeMs } : {}), discardControllerCache: input.discardControllerCache === true,
      ...(input.controllerOutage ? { controllerOutage: input.controllerOutage } : {}),
      ...(input.rollingDeployment ? { rollingDeployment: true } : {}),
      ...(input.recoveryBinding ? { recoveryBinding: input.recoveryBinding } : {}),
      ...(input.preserveRunner ? { preserveRunner: input.preserveRunner } : {}),
      ...(input.crashAfterResult ? { crashAfterResult: input.crashAfterResult } : {}) }),
    { encoding: "utf8", mode: 0o600 },
  );
  await rename(temporaryRequestPath, requestPath);

  const acknowledgement = await pollUntil({
    label: `isolated server restart ${input.requestId}`,
    timeoutFailureClass: "transient_infrastructure",
    deadlineAt: input.deadlineAt,
    intervalMs: 250,
    load: async () => {
      try {
        return JSON.parse(
          await readFile(acknowledgementPath, "utf8"),
        ) as Record<string, unknown>;
      } catch {
        return {};
      }
    },
    accept: (acknowledgement) =>
      acknowledgement.requestId === input.requestId &&
      acknowledgement.status === "ready" &&
      (!input.discardControllerCache || acknowledgement.controllerCacheDiscarded === true) &&
      (!input.rollingDeployment || validControllerRollingDeploymentReceipt(acknowledgement.rollingDeployment, input.requestId)) &&
      (!input.controllerOutage || validControllerOutageReceipt(acknowledgement.controllerOutage, input.controllerOutage, input.requestId)),
    reject: (acknowledgement) =>
      acknowledgement.requestId === input.requestId &&
      acknowledgement.status === "failed"
        ? String(acknowledgement.message ?? "replacement server failed")
        : undefined,
  });
  await pollUntil({
    label: `replacement server health ${input.requestId}`,
    timeoutFailureClass: "transient_infrastructure",
    deadlineAt: input.deadlineAt,
    intervalMs: 250,
    load: () => input.api.get<Record<string, unknown>>("/api/health"),
    accept: (health) => Boolean(health),
  });
  if (input.controllerOutage || input.rollingDeployment) await input.onControllerOutage?.((input.rollingDeployment ? acknowledgement.rollingDeployment : acknowledgement.controllerOutage) as ControllerReplacementReceipt);
}

const executionIds = (() => {
  const encoded = process.env.PAPERCLIP_RUNNER_E2E_EXECUTION_IDS;
  if (encoded) {
    const parsed = JSON.parse(encoded) as unknown;
    if (
      !Array.isArray(parsed) ||
      parsed.length === 0 ||
      parsed.some((value) => typeof value !== "string")
    ) {
      throw new Error(
        "PAPERCLIP_RUNNER_E2E_EXECUTION_IDS must be a non-empty JSON string array",
      );
    }
    return parsed;
  }
  const single = process.env.PAPERCLIP_RUNNER_E2E_EXECUTION_ID;
  if (!single)
    throw new Error("PAPERCLIP_RUNNER_E2E_EXECUTION_IDS is required");
  return [single];
})();
const executions = executionIds.map(runnerExecutionById);
// Direct Playwright invocation must enforce the same admission boundary as
// launch.ts before reading any provider credential from the environment.
assertRunnerE2EPrerequisites(executions);
const attempt = Number(process.env.PAPERCLIP_RUNNER_E2E_ATTEMPT ?? "1");
const temporaryRoot = process.env.PAPERCLIP_RUNNER_E2E_TEMP_ROOT;
const privateRoot = process.env.PAPERCLIP_RUNNER_E2E_PRIVATE_DIR;
const workspacePath = process.env.PAPERCLIP_RUNNER_E2E_WORKSPACE;
if (!temporaryRoot || !privateRoot || !workspacePath)
  throw new Error("Runner E2E temporary/private/workspace paths are required");

function record(value: unknown): Record<string, unknown> {
  return value && typeof value === "object" && !Array.isArray(value)
    ? (value as Record<string, unknown>)
    : {};
}

function credentialValues(): Partial<Record<CredentialName, string>> {
  return Object.fromEntries(
    CREDENTIAL_NAMES.flatMap((name) => {
      const value = process.env[name]?.trim();
      return value ? [[name, value]] : [];
    }),
  );
}

async function writeSanitizedJson(
  directory: string,
  name: string,
  value: unknown,
  secrets: readonly string[],
  signal?: AbortSignal,
) {
  signal?.throwIfAborted();
  const raw = `${JSON.stringify(value)}\n`;
  // Public API payloads may contain harmless provider-shaped fixtures or
  // opaque generated tokens. Reject exact campaign credentials before writing,
  // then sanitize all known shapes and assert the published JSON is clean.
  // A product-delivered credential (the join link the agent hands the person)
  // is expected in product payloads. It is redacted below and the published
  // JSON is still checked against every secret, including it.
  assertSecretFree(raw, secrets.filter(secret => !isProductDeliveredSecret(secret)), name, { includeShapes: false });
  const safe = `${JSON.stringify(sanitizeJson(value, secrets), null, 2)}\n`;
  const leak = findSecretLeakInJsonValues(JSON.parse(safe), secrets);
  if (leak) throw new Error(`Secret leak in ${name}: ${leak}`);
  signal?.throwIfAborted();
  await mkdir(directory, { recursive: true });
  await writeFile(path.join(directory, name), safe, { encoding: "utf8", signal });
}

async function submitTaskRevision(page: Page, body: string): Promise<number> {
  const revise = page
    .getByRole("button", { name: "Continue work", exact: true })
    .last();
  await expect(revise).toBeVisible({ timeout: 30_000 });
  await revise.click();
  const reason = page.getByPlaceholder("Add a short note").last();
  await expect(reason).toBeVisible({ timeout: 30_000 });
  await reason.fill(body);
  const submittedAtMs = Date.now();
  await page
    .getByRole("button", { name: "Continue work", exact: true })
    .last()
    .click();
  return submittedAtMs;
}

function matchingRuns(runs: RunRecord[], issue: IssueRecord) {
  const explicit = new Set(
    [issue.executionRunId, issue.checkoutRunId].filter(Boolean),
  );
  return runs.filter((run) => {
    if (isNonExecutingReviewFenceRun(run)) return false;
    const context = record(run.contextSnapshot);
    return (
      context.issueId === issue.id ||
      context.taskId === issue.id ||
      explicit.has(run.id)
    );
  });
}

function isPendingQuestion(interaction: InteractionRecord) {
  return (
    interaction.kind === "ask_user_questions" &&
    interaction.status === "pending" &&
    Boolean(interaction.payload?.questions?.length)
  );
}

function isPendingWarmConfirmation(interaction: InteractionRecord) {
  return (
    interaction.kind === "request_confirmation" &&
    interaction.status === "pending" &&
    interaction.continuationPolicy === "wake_assignee" &&
    interaction.payload?.target?.type === "custom"
  );
}

function nativeRunEventIntegrityFailures(
  run: RunRecord,
  events: readonly RunEventRecord[],
): string[] {
  const failures: string[] = [];
  let lastOuterSeq = 0;
  const lastSourceSeq = new Map<string, number>();
  const sourceEventIds = new Set<string>();
  const runnerEventTypes: string[] = [];
  const runTerminalSources: unknown[] = [];
  const resultAcceptedSources: unknown[] = [];

  for (const event of events) {
    if (typeof event.seq !== "number" || event.seq <= lastOuterSeq) {
      failures.push(
        `run ${run.id} event sequence is not strictly monotonic at ${String(event.seq)}`,
      );
    } else {
      lastOuterSeq = event.seq;
    }
    const envelope = record(event.payload?.prpEvent);
    if (Object.keys(envelope).length === 0) continue;
    if (!isValidNativePrpEnvelope(envelope, event.protocolSchemaVersion)) {
      failures.push(
        `run ${run.id} exposed a malformed PRP envelope (schema=${String(envelope.schema)}, version=${String(envelope.schemaVersion)})`,
      );
    }
    if (envelope.runId !== run.id) {
      failures.push(
        `run ${run.id} exposed an event bound to ${String(envelope.runId)}`,
      );
    }
    if (envelope.eventType !== event.eventType) {
      failures.push(
        `run ${run.id} event discriminator changed from ${String(event.eventType)} to ${String(envelope.eventType)}`,
      );
    }
    if (
      envelope.sourceInstanceId !== event.sourceInstanceId ||
      envelope.sourceEventId !== event.sourceEventId ||
      envelope.sourceSeq !== event.sourceSeq
    ) {
      failures.push(
        `run ${run.id} event source identity changed during persistence/redaction`,
      );
    }
    if (typeof event.sourceEventId === "string") {
      if (sourceEventIds.has(event.sourceEventId)) {
        failures.push(
          `run ${run.id} duplicated source event ${event.sourceEventId}`,
        );
      }
      sourceEventIds.add(event.sourceEventId);
    }
    if (
      typeof event.sourceInstanceId === "string" &&
      typeof event.sourceSeq === "number"
    ) {
      const previous = lastSourceSeq.get(event.sourceInstanceId) ?? 0;
      if (event.sourceSeq <= previous) {
        failures.push(
          `run ${run.id} source ${event.sourceInstanceId} sequence regressed from ${previous} to ${event.sourceSeq}`,
        );
      }
      lastSourceSeq.set(event.sourceInstanceId, event.sourceSeq);
    }
    if (
      envelope.sourceKind === "runner" &&
      typeof event.eventType === "string"
    ) {
      runnerEventTypes.push(event.eventType);
    }
    if (event.eventType === "run.terminal") {
      runTerminalSources.push(envelope.sourceKind);
    }
    if (event.eventType === "run.result.accepted") {
      resultAcceptedSources.push(envelope.sourceKind);
    }
  }

  const runnerResultCount = runnerEventTypes.filter(
    (value) => value === "run.result.proposed",
  ).length;
  if (
    runnerResultCount !== 1 &&
    !(runnerResultCount === 0 && isControlPlaneGovernedResponseWait(events))
  ) {
    failures.push(
      `run ${run.id} must persist exactly one runner semantic result`,
    );
  }
  if (resultAcceptedSources.length !== 1) {
    failures.push(
      `run ${run.id} must persist exactly one accepted semantic result`,
    );
  } else if (resultAcceptedSources[0] !== "control_plane") {
    failures.push(
      `run ${run.id} accepted semantic result must be control-plane authoritative`,
    );
  }
  if (runTerminalSources.length !== 1) {
    failures.push(`run ${run.id} must persist exactly one terminal event`);
  } else if (runTerminalSources[0] !== "control_plane") {
    failures.push(
      `run ${run.id} terminal event must be control-plane authoritative`,
    );
  }
  return failures;
}

for (const execution of executions) {
  test.describe(execution.id, () => {
  const browserTimezone = execution.suite.id === "chat-features" ? findChatCatalogCase(execution.task.id)?.browserTimezone : undefined;
  if (browserTimezone) test.use({ timezoneId: browserTimezone });
  const controllerOutage = controllerOutageForExecution(execution, process.env);
  const privateDir = path.join(privateRoot, "cases", execution.task.id);
  const resultPath = path.join(privateDir, "result.json");
  const snapshotsDir = path.join(privateDir, "snapshots");
  const deadlineMs = execution.task.attemptTimeoutMs[execution.environment.id];

  test(`${execution.id} completes through the browser and public APIs`, async ({
    page,
    request,
  }, testInfo) => {
    test.skip(execution.suite.id === "first-task" && execution.profile.id === "runner-acpx-claude"
      && (process.platform !== "darwin" || process.arch !== "arm64"),
    "Ordinary native Claude onboarding is qualified on Apple Silicon only in this delivery.");
    const kimiLifecycleTiming = execution.task.flow === "kimi_native_lifecycle"
      ? createKimiLifecycleTiming({ startedAt: Date.now(), deadlineMs }) : undefined;
    test.setTimeout(
      kimiLifecycleTiming?.playwrightTimeoutMs ?? (execution.task.flow === "warm_three_turn"
        ? deadlineMs
        : deadlineMs + 90_000),
    );
    // Remote allocation uncertainty survives a worker crash before publication.
    if (mayAllocateRemoteResources(execution.environment.id)) {
      await writeFile(path.join(privateRoot, "resource-admission-started"), "started\n", { mode: 0o600 });
    }
    const startedAtMs = Date.now();
    const startedAt = new Date(startedAtMs).toISOString();
    const workerTiming = await createWorkerTiming(path.join(snapshotsDir, "worker-timing.json"), { executionId: execution.id, attempt }, startedAtMs);
    const nonce = `${randomBytes(6).toString("hex")}-${attempt}`;
    const marker = execution.task.buildVisibleMarker(nonce);
    const title = execution.task.buildTitle(nonce);
    let prompt = execution.task.buildPrompt(nonce);
    let apiResponseSourceId: string | undefined;
    let titleCreation: { issue: unknown; submitted: unknown } | undefined;
    let lifecycleBlockerId: string | null = null;
    if (execution.suite.id === "native-completion") {
      assertNativeCompletionSelection([execution]);
      verifyNativeCompletionPreflight(process.env[NATIVE_COMPLETION_PREFLIGHT_ENV]);
    }
    if (execution.suite.id === NATIVE_INSTRUCTION_SUITE) {
      assertNativeInstructionSelection([execution]);
      verifyNativeInstructionPreflight(process.env[NATIVE_INSTRUCTION_PREFLIGHT_ENV]);
    }
    const credentials = credentialValues();
    const secrets = trackedPrivateSecrets(normalizedSecrets([...Object.values(credentials), ...EVAL_OBSERVABILITY_SECRET_NAMES.map(name => process.env[name]), process.env.PAPERCLIP_E2E_GATEWAY_TOKEN]), execution.id);
    const privateInputs = execution.suite.id === "chat-features" ? readChatPrivateInputs(execution.id, secrets) : undefined;
    const traceConfig = evalBraintrustConfig(process.env);
    const trace = traceConfig ? new EvalAttemptTrace(traceConfig, {
      campaignId: process.env.PAPERCLIP_E2E_ACCOUNTING_CAMPAIGN_ID ?? "",
      attemptId: process.env.PAPERCLIP_E2E_ACCOUNTING_ATTEMPT_ID ?? "",
      executionId: execution.id, provider: execution.profile.provider, model: execution.profile.model, environment: execution.environment.id,
    }, {
      suiteId: execution.suite.id, suiteDefinitionHash: execution.suiteDefinitionHash,
      profileId: execution.profile.id, caseId: execution.task.id, sourceRevision: resolveRunnerE2ESource().sha,
    }) : undefined;
    const saveTrace = async () => { if (trace) await writeSanitizedJson(snapshotsDir, "braintrust-trace.json", trace.snapshot(), secrets); };
    const onCompanyCreated = async (id: string) => {
      const admission = kimiCandidateAdmissionForExecution(execution, id);
      if (admission) {
        await restartIsolatedPaperclipServer({ api, requestId: `kimi-startup-${nonce}`,
          kimiCandidateAdmission: admission, deadlineAt: startedAtMs + deadlineMs });
        if (execution.environment.id === "daytona") {
          await waitForFixtureDaytonaProvider(api, { companyId: id, deadlineAt: startedAtMs + deadlineMs });
        }
      }
      if (trace) { try { await trace.configureCompany(api, id); } finally { await saveTrace(); } }
    };
    const api = new RunnerApi(request);
    const companyRunFlow = execution.suite.id === "task-titles" || execution.task.flow === "cursor_cloud_stop" || ["plan_task_guidance", "blocker_guidance", "continuation_accounting", "continuation", "context_integrity", "repository_skills", "agent_chat", "everyday_workflow", "first_task", "instruction_persistence", "pi_native", "pi_controls", "copilot_protection", "cursor_native", "native_active_stop", "native_provider_loss", "kimi_native_lifecycle", "public_mcp", "case_handoff"].includes(execution.task.flow);
    const publicMcpUsage = execution.task.flow === "public_mcp" ? assistantUsage(execution.profile.provider === "claude" ? "anthropic" : "openai", execution.profile.model) : undefined;
    let publicMcpUserId = "";
    const consoleDiagnostics: Array<Record<string, unknown>> = [];
    const networkDiagnostics: Array<Record<string, unknown>> = [];
    const pageLifecycleDiagnostics: Array<Record<string, unknown>> = [];
    const browserBootstrap = observeBrowserBootstrap(page);
    let nativeInitial: { issueIds: string[]; agentIds: string[]; workspaceDigest: string | null } | undefined;
    const nativeWorkspaceDigest = () => execution.task.id === "native-blocked-report"
      ? nativeCompletionWorkspaceDigest(workspacePath!) : Promise.resolve(null);
    let boundaryScreenshotResources: { companyId?: string; agentId?: string } = {};
    let fixtures: LiveFixtureValues | undefined;
    let reviewProvider: Awaited<ReturnType<typeof setupConnectionReview>> | undefined;
    let issue: IssueRecord | undefined;
    let taskChat: TaskChatEvidence | undefined;
    let workflowCase: { id: string; identifier?: string } | undefined;
    let selectedRuns: RunRecord[] = [];
    let feedback = emptyFeedbackSummary();
    let runtimeLeases: EnvironmentLeaseRecord[] = [];
    let matcherResults: MatcherResult[] = [];
    let downloadedResponseProof: Awaited<ReturnType<typeof readResponseProof>> | undefined;
    let piFileSeed: Awaited<ReturnType<typeof seedPiFile>> | undefined;
    const completionQuality: CompletionQualityRecord[] = [];
    const completionEvidence = async (name: string, data: unknown) => {
      await writeSanitizedJson(snapshotsDir, name, data, secrets);
      if (!["completion-updates", "confirmation-replies"].includes(execution.suite.id) || !name.endsWith("completion-update.json")) return;
      const probe = data as { observation?: CompletionObservation };
      if (!probe.observation || !completionDelivery(probe.observation).checks.every(c => c.passed)) return;
      if (!credentials.OPENAI_API_KEY) {
        await writeSanitizedJson(snapshotsDir, "completion-quality-unqualified.json", { reason: "Judge credential unavailable in this provider-scoped job; run the separate judge against retained evidence." }, secrets);
        return;
      }
      const samples = [{ name, purpose: "product" as const, expectedPass: true, observation: probe.observation },
        ...(execution.profile.id === "runner-codex" && execution.task.id === "handoff-completion-idle" ? completionQualityControls(probe.observation).map(c => ({ ...c, purpose: "calibration" as const, name: `${name}-${c.name}` })) : [])];
      for (const sample of samples) {
        const pending = { ...reserveCompletionQuality(sample.observation, 0.50, secrets), name: sample.name, purpose: sample.purpose, expectedPass: sample.expectedPass };
        completionQuality.push(pending);
        // Persist reservation and exact input before the one paid request. A crash
        // leaves usage unknown, never zero, and the next campaign is a new attempt.
        await writeSanitizedJson(snapshotsDir, `${sample.name}.quality-input.json`, sample, secrets);
        await writeSanitizedJson(snapshotsDir, "completion-quality-ledger.json", completionQuality, secrets);
        const result = await judgeCompletionQuality(sample.observation, pending, credentials.OPENAI_API_KEY ?? "", undefined, { approvedFixture: true, secrets });
        completionQuality[completionQuality.length - 1] = { ...result, name: sample.name, purpose: sample.purpose, expectedPass: sample.expectedPass };
        await writeSanitizedJson(snapshotsDir, "completion-quality-ledger.json", completionQuality, secrets);
      }
    };
    let firstTaskEvidence: RunnerE2EResult["firstTask"];
    let turnTimings: NonNullable<RunnerE2EResult["turnTimings"]> | undefined;
    let responseTiming: ReturnType<typeof armResponseTiming> | undefined;
    let startupReuse: RunnerE2EResult["startupReuse"];
    const turnSubmissionTimesMs: number[] = [];
    const screenshots: NonNullable<RunnerE2EResult["screenshots"]> = [];
    let cursorCloudObserver: CursorCloudOwnedObserver | undefined;
    let primaryError: unknown;
    let failureClassOverride: FailureClass | undefined;
    let innerSecretFinding = false;
    let cleanup: RunnerE2EResult["cleanup"] = "not_started";
    const cleanupAssertions: CleanupAssertion[] = [];
    const beforeEnvironmentTeardownAssertions: CleanupAssertion[] = [];
    const registerCleanupAssertion = (assertion: CleanupAssertion) => {
      if (cleanupAssertions.length >= 8) throw new Error("Cleanup assertion bound exceeded");
      cleanupAssertions.push(assertion);
    };
    const registerBeforeEnvironmentTeardownAssertion = (assertion: CleanupAssertion) => {
      if (beforeEnvironmentTeardownAssertions.length >= 8) throw new Error("Remote cleanup assertion bound exceeded");
      beforeEnvironmentTeardownAssertions.push(assertion);
    };

    const capturePrivateScreenshot = async (id: string, file: string) => {
      const screenshotPath = path.join(privateDir, file);
      await page.screenshot({ path: screenshotPath, fullPage: true });
      await testInfo.attach(id, {
        path: screenshotPath,
        contentType: "image/png",
      });
    };

    const isReviewedFixtureScreenshotRoute = () =>
      isPublicRunnerScreenshotRoute(page.url(), {
        chatAgentId: execution.task.flow === "agent_chat" ? fixtures?.agent.id : undefined,
        issuePrefix: fixtures?.company.issuePrefix,
        issueId: issue?.id,
        issueIdentifier: issue?.identifier,
        caseId: execution.task.flow === "case_handoff" ? workflowCase?.id : undefined,
        caseIdentifier: execution.task.flow === "case_handoff" ? workflowCase?.identifier : undefined,
      });

    const captureScreenshot = async (
      id: string,
      label: string,
      file: string,
    ) => {
      let reviewedBoundary = false;
      if (execution.suite.id === "chat-features" && execution.task.id === "agent-chat.chat-disabled"
        && boundaryScreenshotResources.companyId && boundaryScreenshotResources.agentId
        && findChatCatalogCase(execution.task.id)?.journeyKind === "browser-boundary") {
        const [company, agent, session, settings] = await Promise.all([
          api.get<{ id: string; issuePrefix: string }>(`/api/companies/${boundaryScreenshotResources.companyId}`),
          api.get<{ id: string; companyId: string }>(`/api/agents/${boundaryScreenshotResources.agentId}`),
          api.get<{ user: { id: string } }>("/api/auth/get-session"),
          api.get<{ enableConferenceRoomChat: boolean }>("/api/instance/settings/experimental"),
        ]);
        reviewedBoundary = company.id === boundaryScreenshotResources.companyId && agent.id === boundaryScreenshotResources.agentId
          && isConferenceRoomOffBoundaryScreenshotRoute(page.url(), { scenarioId: execution.task.id, origin: api.baseURL,
            companyId: company.id, agentCompanyId: agent.companyId, issuePrefix: company.issuePrefix,
            agentId: agent.id, authenticatedPersonId: session.user.id, conferenceRoomEnabled: settings.enableConferenceRoomChat });
      }
      if (!isReviewedFixtureScreenshotRoute() && !reviewedBoundary) {
        throw new Error(
          `Public runner screenshot blocked on non-task route ${page.url()}`,
        );
      }
      await capturePrivateScreenshot(id, file);
      screenshots.push({
        id,
        label,
        file,
        publication: PUBLIC_RUNNER_SCREENSHOT_MARKER,
        sha256: createHash("sha256")
          .update(await readFile(path.join(privateDir, file)))
          .digest("hex"),
      });
    };

    const captureRuntimeLeases = async () => {
      if (!fixtures || execution.environment.id !== "daytona") return;
      const listed = await api.get<EnvironmentLeaseRecord[]>(
        `/api/environments/${fixtures.environment.id}/leases`,
      );
      runtimeLeases = selectFixtureRuntimeLeases({ leases: listed,
        runIds: selectedRuns.map(run => run.id), issueId: issue?.id,
        setupProbeLeaseId: fixtures.setupProbe?.leaseId, setupLeaseIds: fixtures.setupLeases?.map(lease => lease.leaseId) });
    };

    const cancelActiveRunsForCleanup = async (budgetMs?: number) => {
      if (!issue && !(companyRunFlow && fixtures)) return;
      const cleanupIssueId = issue?.id;
      const cleanupDeadline = budgetMs === undefined ? undefined : Date.now() + budgetMs;
      const cleanupRequestOptions = () => cleanupDeadline === undefined ? undefined : { timeout: Math.max(1, cleanupDeadline - Date.now()) };
      const runs = await api.get<RunRecord[]>(
        companyRunFlow && fixtures ? `/api/companies/${fixtures.company.id}/heartbeat-runs?limit=100` : `/api/issues/${cleanupIssueId}/runs`, cleanupRequestOptions(),
      );
      const activeRunIds = companyRunFlow && fixtures
        ? ownedActiveCleanupRunIds(runs, fixtures.company.id, TERMINAL_RUN_STATUSES)
        : [
        ...new Set(
          runs
            .filter((run) => !TERMINAL_RUN_STATUSES.has(run.status))
            .map((run) => run.id)
            .filter(
              (runId): runId is string =>
                typeof runId === "string" && runId.length > 0,
            ),
        ),
      ];
      for (const runId of activeRunIds) {
        await api.post(`/api/heartbeat-runs/${runId}/cancel`, undefined, cleanupRequestOptions());
      }
      if (activeRunIds.length === 0) return;
      const activeIds = new Set(activeRunIds);
      await pollUntil({
        label: `cleanup cancellation for issue ${cleanupIssueId}`,
        deadlineAt: cleanupDeadline ?? Date.now() + 45_000,
        load: () => api.get<RunRecord[]>(companyRunFlow && fixtures ? `/api/companies/${fixtures.company.id}/heartbeat-runs?limit=100` : `/api/issues/${cleanupIssueId}/runs`, cleanupRequestOptions()),
        accept: (currentRuns) =>
          currentRuns
            .filter((run) => activeIds.has(run.id))
            .every((run) => TERMINAL_RUN_STATUSES.has(run.status)),
        intervalMs: 500,
      });
    };

    let catalogFailureCaptureAttempted = false;
    const captureApiState = async (capturePhase: "failure" | "final" = "failure") => {
      if (!fixtures || capturePhase === "failure" && catalogFailureCaptureAttempted) return;
      if (execution.task.flow === "followup_stop_resume") {
        const captured = await captureFollowupStopFailureApiState({ api, companyId: fixtures.company.id,
          agentId: fixtures.agent.id, issueId: issue?.id,
          evidence: (name, value) => writeSanitizedJson(snapshotsDir, name, value, secrets) });
        if (captured) { issue = captured.issue as IssueRecord; selectedRuns = captured.runs as RunRecord[]; }
        return;
      }
      if (companyRunFlow && !issue) {
        const companyRuns = await api.get<RunRecord[]>(`/api/companies/${fixtures.company.id}/heartbeat-runs?limit=100`);
        selectedRuns = await Promise.all(companyRuns.map(run => api.get<RunRecord>(`/api/heartbeat-runs/${run.id}`)));
        // Settings are already restored on failure, so chat resolution may be
        // gated. Direct task access still permits evidence and usage capture.
        const sourceId = selectedRuns.map(run => record(run.contextSnapshot).issueId).find(id => typeof id === "string");
        if (typeof sourceId === "string") issue = await api.get<IssueRecord>(`/api/issues/${sourceId}`);
      }
      if (!issue) return;
      const capture = async <T>(operation: () => Promise<T>) =>
        operation().catch((error) => ({
          evidenceCaptureError:
            error instanceof Error ? error.message : String(error),
        }));
      const [currentIssue, listedRuns, comments, interactions] =
        await Promise.all([
          capture(() => api.get<IssueRecord>(`/api/issues/${issue!.id}`)),
          capture(() =>
            api.get<RunRecord[]>(
              companyRunFlow
                ? `/api/companies/${fixtures!.company.id}/heartbeat-runs?limit=100`
                : `/api/companies/${fixtures!.company.id}/heartbeat-runs?agentId=${fixtures!.agent.id}&limit=20`,
            ),
          ),
          capture(() =>
            api.get<CommentRecord[]>(
              `/api/issues/${issue!.id}/comments?order=asc`,
            ),
          ),
          capture(() =>
            api.get<InteractionRecord[]>(
              `/api/issues/${issue!.id}/interactions`,
            ),
          ),
        ]);
      const taskRuns = Array.isArray(listedRuns)
        ? companyRunFlow ? listedRuns : matchingRuns(listedRuns, "id" in currentIssue ? currentIssue : issue)
        : [];
      const detailedRuns = await Promise.all(
        taskRuns.map((candidate) =>
          capture(() =>
            api.get<RunRecord>(`/api/heartbeat-runs/${candidate.id}`),
          ).then((value) => ("id" in value ? value : candidate)),
        ),
      );
      if (detailedRuns.length > 0) selectedRuns = detailedRuns;
      const runEvidence = await Promise.all(
        detailedRuns.map(async (candidate) => ({
          runId: candidate.id,
          workspaceOperations: await capture(() =>
            api.get<unknown>(`/api/heartbeat-runs/${candidate.id}/workspace-operations`),
          ),
          log: await capture(() =>
            api.get<unknown>(
              `/api/heartbeat-runs/${candidate.id}/log?limitBytes=1048576`,
            ),
          ),
          events: await capture(() =>
            collectRunEvents<RunEventRecord>((afterSeq, limit) =>
              api.get(`/api/heartbeat-runs/${candidate.id}/events?afterSeq=${afterSeq}&limit=${limit}`),
            ),
          ),
        })),
      );
      await writeSanitizedJson(
        snapshotsDir,
        "api-state.json",
        {
          capturePhase,
          issue: currentIssue,
          runs: detailedRuns,
          comments,
          interactions,
          runEvidence,
        },
        secrets,
      );
    };

    page.on("console", (message) => {
      if (["error", "warning"].includes(message.type())) {
        consoleDiagnostics.push({
          type: message.type(),
          text: message.text(),
          location: { ...message.location(), url: browserDiagnosticUrl(message.location().url) },
        });
      }
    });
    page.on("pageerror", (error) => {
      pageLifecycleDiagnostics.push({
        type: "pageerror",
        message: error.message,
        stack: error.stack ?? null,
        url: browserDiagnosticUrl(page.url()),
      });
    });
    page.on("framenavigated", (frame) => {
      if (frame === page.mainFrame())
        pageLifecycleDiagnostics.push({
          type: "navigation",
          url: browserDiagnosticUrl(frame.url()),
          at: new Date().toISOString(),
        });
    });
    page.on("requestfailed", (requestEvent) => {
      networkDiagnostics.push({
        method: requestEvent.method(),
        url: browserDiagnosticUrl(requestEvent.url()),
        failure: requestEvent.failure()?.errorText ?? null,
      });
    });
    page.on("response", (response) => {
      if (response.status() >= 400) {
        networkDiagnostics.push({
          method: response.request().method(),
          url: browserDiagnosticUrl(response.url()),
          status: response.status(),
          statusText: response.statusText(),
        });
      }
    });

    try {
      trace?.phase("setup");
      await saveTrace();
      if (execution.profile.provider === "cursor_cloud") await assertCursorCloudCallbackIngress(process.env.PAPERCLIP_PUBLIC_URL!);
      const catalogDescriptor = execution.suite.id === "chat-features" ? findChatCatalogCase(execution.task.id) : undefined;
      if (catalogDescriptor) {
        bindInvitationEnrollmentPrerequisite(api, {
          verifyRuntime: () => verifyInvitationSourceProof({ temporaryRoot, sourceRoot: path.resolve(import.meta.dirname, "../.."),
            apiOrigin: api.baseURL, attemptId: process.env.PAPERCLIP_E2E_ACCOUNTING_ATTEMPT_ID ?? "", executionId: execution.id,
            health: () => api.get("/api/health") }),
          evidence: completionEvidence,
        });
        const blockers = chatPrivateSetupBlockers(privateInputs, catalogDescriptor);
        if (blockers.length) {
          failureClassOverride = "permanent_infrastructure";
          await writeSanitizedJson(snapshotsDir, "chat-catalog-input-prerequisite.json", { scenarioId: execution.task.id, phase: "reserved-setup", querySent: false, modelAdmissions: 0,
            requirements: chatPrivateInputRequirements(catalogDescriptor), blockers, inputCleanup: "owned by launcher finally" }, secrets);
          throw new Error(`Selected case setup prerequisite unavailable: ${blockers.join(", ")}`);
        }
      }
      if (catalogDescriptor?.journeyKind === "browser-boundary") {
        const scenario = chatCatalogScenarios.find(row => row.id === execution.task.id);
        if (!scenario || !catalogDescriptor.boundaryTarget) throw new Error("Boundary scenario or target identity missing");
        await workerTiming.enter("execution"); trace?.phase("execution");
        const boundaryTrail = emptyBoundaryResourceTrail(); let boundaryObservation: unknown;
        const checks = await runChatBoundaryFlow({ journeyKind: "browser-boundary", boundaryTarget: catalogDescriptor.boundaryTarget,
          scenario, page, api, execution, nonce, credentials: { ...credentials, ...privateInputs?.credentials }, privateSecrets: secrets, privateDir, deadlineAt: startedAtMs + deadlineMs,
          capture: captureScreenshot,
          async captureFinalState(boundaryPage) {
            const screenshotPath = path.join(privateDir, "final-state.png");
            await boundaryPage.screenshot({ path: screenshotPath, fullPage: true });
            await testInfo.attach("final-state", { path: screenshotPath, contentType: "image/png" });
          },
          evidence: async (name, value) => {
            await writeSanitizedJson(snapshotsDir, name, value, secrets);
            if (name === "chat-boundary-observation.json") boundaryObservation = value;
            if (name === "chat-boundary-cleanup.json") cleanup = (value as { cleanup?: string }).cleanup === "complete" ? "passed" : "failed";
          },
          observeResources(value) {
            recordBoundaryResources(boundaryTrail, value);
            if (execution.task.id === "agent-chat.chat-disabled") boundaryScreenshotResources = { companyId: value.companyId, agentId: value.agentId };
            // Boundaries independently collect their real resources. They do not
            // manufacture LiveFixtureValues or a source issue for result fields.
            if (value.runIds.length) matcherResults.push({ matcher: { kind: "json_path", path: "boundary.actual-agent-dispatch", expected: true },
              passed: false, detail: "This pre-chat boundary observed an unexpected real provider admission." });
          },
        }, catalogDescriptor);
        // The passing boundary retains the standard pass evidence from what it really observed.
        const boundarySnapshots = boundaryStandardSnapshots({ scenarioId: execution.task.id, trail: boundaryTrail, boundaryObservation });
        await writeSanitizedJson(snapshotsDir, "fixtures.json", boundarySnapshots.fixtures, secrets);
        await writeSanitizedJson(snapshotsDir, "api-state.json", boundarySnapshots.apiState, secrets);
        matcherResults.push(...checks.map(check => ({ matcher: { kind: "json_path" as const, path: `boundary.${check.id}`, expected: true }, passed: check.passed, detail: check.detail })));
      } else {
      if (execution.task.flow === "public_mcp" || execution.suite.id === "chat-features" && findChatCatalogCase(execution.task.id)?.authentication === "human-session") publicMcpUserId = await establishPublicMcpSession(api, page, secrets);
      if (execution.suite.id === "stock-harness") {
        const receipt = verifyStockHarnessPreflight(process.env[STOCK_PREFLIGHT_ENV]);
        await writeSanitizedJson(snapshotsDir, "stock-harness-preflight.json", receipt, secrets);
      }
      if (execution.task.flow === "setup_health") {
        const credential = await checkSetupHealthCredential({ executionId: execution.id, provider: execution.profile.provider,
          model: execution.profile.model, credential: credentials.OPENROUTER_API_KEY, env: process.env, secrets });
        await writeSanitizedJson(snapshotsDir, "chat-setup-credential.json", credential, secrets);
        if (!credential.recognized) throw new Error(`Setup-health credential prerequisite failed: ${credential.code}`);
      }
      const nativeRolloutEnabled = execution.profile.provider !== "codex";
      const experimental = await api.patch<{
        enableNativeRunner: boolean;
      }>("/api/instance/settings/experimental", {
        enableNativeRunner: nativeRolloutEnabled,
        ...(["warm_three_turn", "everyday_workflow"].includes(execution.task.flow)
          ? { enableIsolatedWorkspaces: true }
          : {}),
        ...(execution.profile.generation === "native" &&
        execution.environment.id === "daytona"
          ? { enableRunnerPreviewIngress: true }
          : {}),
      });
      expect(experimental.enableNativeRunner).toBe(nativeRolloutEnabled);

      if (execution.suite.id === "extended-harnesses" && execution.profile.qualificationCandidate === "pi" && execution.task.id === "file-edit-validate") {
        piFileSeed = await seedPiFile(workspacePath, nonce);
        await writeSanitizedJson(snapshotsDir, "pi-file-seed.json", piFileSeed, secrets);
      }

      if (execution.suite.id === "daytona-git-streaming") {
        await setupGitStreamingWorkspace(workspacePath);
      }
      fixtures = await withSdkCanaryPreFixture({ execution, sourceRevision: resolveRunnerE2ESource().sha,
        capture: () => captureSdkCanaryPreFixture({ execution, repositoryRoot: path.resolve(import.meta.dirname, "../.."), temporaryRoot,
          sourceRevision: resolveRunnerE2ESource().sha, secrets }),
        retain: proof => writeSanitizedJson(snapshotsDir, "sdk-canary-pre-fixture.json", proof, secrets),
        fixtures: async () => execution.task.flow === "first_task"
        ? await setupFirstTaskFixtures({ page, api, execution, nonce, credentials, daytonaImage: process.env.PAPERCLIP_E2E_DAYTONA_IMAGE, deadlineAt: startedAtMs + deadlineMs, observe: value => { fixtures = value; }, onCompanyCreated })
        : await setupLiveFixtures({
        api,
        execution,
        executionNonce: nonce,
        workspacePath,
        credentials,
        daytonaImage: process.env.PAPERCLIP_E2E_DAYTONA_IMAGE,
        cleanupDeadlineAt: kimiLifecycleTiming?.cleanupDeadlineAt,
        onCompanyCreated,
      }) });
      if (execution.profile.provider === "cursor_cloud") {
        cursorCloudObserver = new CursorCloudOwnedObserver(api, fixtures.company.id, fixtures.agent.id, credentials.CURSOR_API_KEY!);
        registerBeforeEnvironmentTeardownAssertion(() => cursorCloudObserver!.cleanup());
      }
      await finishBudgetedEvalSetup({ executionId: execution.id, environmentId: execution.environment.id, agentId: fixtures.agent.id,
        companyId: fixtures.company.id, deadlineAt: startedAtMs + deadlineMs, api,
        observe: observations => writeSanitizedJson(snapshotsDir, "budgeted-setup.json", { observations }, secrets) });
      const kimiWorkDeadlineAt = kimiLifecycleTiming ? await (async () => {
        await waitForEvalAgentReady({ environmentId: execution.environment.id, agentId: fixtures.agent.id, companyId: fixtures.company.id,
          deadlineAt: kimiLifecycleTiming.setupDeadlineAt, api,
          observe: observations => writeSanitizedJson(snapshotsDir, "kimi-lifecycle-setup.json", { observations }, secrets) });
        const readyAt = Date.now(), workDeadlineAt = kimiLifecycleTiming.beginWork(readyAt);
        await writeSanitizedJson(snapshotsDir, "kimi-lifecycle-timing.json", { setupDeadlineAt: kimiLifecycleTiming.setupDeadlineAt,
          readyAt, workDeadlineAt, setupBudgetMs: deadlineMs, workBudgetMs: deadlineMs, playwrightTimeoutMs: kimiLifecycleTiming.playwrightTimeoutMs }, secrets);
        return workDeadlineAt;
      })() : undefined;
      await workerTiming.enter("execution");
      trace?.phase("execution");

      if (["native-completion", NATIVE_INSTRUCTION_SUITE].includes(execution.suite.id)) {
        const receipt = await captureNativeDefault({ api, agentId: fixtures.agent.id, companyId: fixtures.company.id });
        const grade = gradeNativeDefault(receipt, execution.suite.id === NATIVE_INSTRUCTION_SUITE ? NATIVE_INSTRUCTION_DEFAULT_SHA256 : undefined);
        await writeSanitizedJson(snapshotsDir, "native-default-before-execution.json", { receipt, grade }, secrets);
        if (!grade.passed) throw new Error("Native production-default hire admission failed before execution");
        const [issues, agents, workspaceDigest] = await Promise.all([
          api.get<Array<{ id: string }>>(`/api/companies/${fixtures.company.id}/issues?limit=100`),
          api.get<Array<{ id: string }>>(`/api/companies/${fixtures.company.id}/agents`), nativeWorkspaceDigest(),
        ]);
        nativeInitial = { issueIds: issues.map(value => value.id), agentIds: agents.map(value => value.id), workspaceDigest };
      }
      const remoteBootstrap = execution.environment.id === "daytona"
        && ["pi_native", "pi_controls", "copilot_protection", "cursor_native", "native_active_stop", "native_provider_loss", "kimi_native_lifecycle"].includes(execution.task.flow)
        ? createRemoteNativeBootstrap({
          api, daytona: await createRemoteFixtureClient(credentials.DAYTONA_API_KEY ?? ""),
          companyId: fixtures.company.id, environmentId: fixtures.environment.id, agentId: fixtures.agent.id,
          image: process.env.PAPERCLIP_E2E_DAYTONA_IMAGE ?? "",
          nodeSha256: process.env.PAPERCLIP_E2E_DAYTONA_NODE_SHA256 ?? "",
          runnerdSha256: process.env.PAPERCLIP_E2E_DAYTONA_RUNNERD_SHA256 ?? "",
          deadlineAt: kimiWorkDeadlineAt ?? startedAtMs + deadlineMs,
          requireCopilotTaskContext: execution.profile.qualificationCandidate === "copilot",
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        }) : undefined;

      if (execution.suite.id === "stock-harness") {
        const hire = await captureStockHarness({ api, companyId: fixtures.company.id,
          agentId: fixtures.agent.id, generation: execution.profile.generation, runIds: [] });
        const checks = gradeStockHire(hire);
        await writeSanitizedJson(snapshotsDir, "stock-harness-hire.json", {
          capturePhase: "before-provider", ...hire, checks,
        }, secrets);
        const failed = checks.filter(check => !check.passed);
        if (failed.length) throw new Error(`Stock hire matcher failures: ${failed.map(check => check.id).join(", ")}`);

      }

      if (usesApiResponseProof(execution.suite.id)) {
        const source = await api.post<{ id: string }>(`/api/companies/${fixtures.company.id}/issues`, {
          title: `Synthetic diagnostic evidence ${nonce}`,
          description: execution.suite.id === "api-artifact-transfer" ? artifactTransferDescription(nonce) : responseEvidenceDescription(nonce), status: "backlog",
        });
        apiResponseSourceId = source.id;
        prompt = prompt.replaceAll("{{API_RESPONSE_SOURCE_ID}}", source.id);
      }

      if (execution.suite.id === "lifecycle-baseline" && lifecycleLiveCase(execution.task.id)?.family === "blocker") {
        const prerequisite = await api.post<{ id: string }>(`/api/companies/${fixtures.company.id}/issues`, {
          title: `Supply dataset ${nonce}`,
          description: "Fixture operator prerequisite: dataset has not been supplied.",
          status: "backlog",
        });
        lifecycleBlockerId = prerequisite.id;
        prompt = prompt.replaceAll("{{LIFECYCLE_BLOCKER_ID}}", prerequisite.id);
      }

      await writeSanitizedJson(
        snapshotsDir,
        "fixtures.json",
        {
          executionId: execution.id,
          lifecycleBlockerId,
          companyId: fixtures.company.id,
          environmentId: fixtures.environment.id,
          agentId: fixtures.agent.id,
          ...(execution.suite.id === "cursor-cloud" && fixtures.qualificationBudget ? { qualificationBudget: fixtures.qualificationBudget } : {}),
          ...(fixtures.setupProbe ? { setupProbe: { durationMs: fixtures.setupProbe.durationMs,
            ...(fixtures.setupProbe.defaultRunner ? { defaultRunner: fixtures.setupProbe.defaultRunner } : {}) } } : {}),
          secretIds: Object.fromEntries(
            Object.entries(fixtures.secretRefs).map(([name, ref]) => [
              name,
              ref?.secretId,
            ]),
          ),
          persistedAgent: await api.get<unknown>(
            `/api/agents/${fixtures.agent.id}`,
          ),
          persistedEnvironment: await api.get<unknown>(
            `/api/environments/${fixtures.environment.id}`,
          ),
        },
        secrets,
      );

      if (execution.task.flow === "case_handoff") {
        const receiptSmoke = execution.task.id === "receipt-smoke";
        const runFlow = receiptSmoke ? runCaseReceiptFlow : runCaseHandoffsFlow;
        const journey = await runFlow({ page, api, fixtures, execution, nonce, workspacePath,
          deadlineAt: startedAtMs + deadlineMs - 30_000,
          observe: (currentIssue, currentRuns, checks, currentCase) => {
            issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[];
            workflowCase = { id: currentCase.id, identifier: currentCase.identifier };
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const,
              path: `${receiptSmoke ? "caseReceipt" : "caseHandoffs"}.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          }, capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = journey.issue as IssueRecord; selectedRuns = journey.runs as RunRecord[];
        await writeSanitizedJson(snapshotsDir, "api-state.json", {
          capturePhase: "completed",
          issue: { id: issue.id, identifier: issue.identifier, status: issue.status,
            assigneeAgentId: issue.assigneeAgentId, statusVersion: issue.statusVersion },
          workflowCase,
          runs: selectedRuns.map(candidate => ({ id: candidate.id, companyId: candidate.companyId,
            agentId: candidate.agentId, status: candidate.status, runtimeMode: candidate.runtimeMode,
            nativeIssueId: candidate.nativeIssueId, startedAt: candidate.startedAt,
            finishedAt: candidate.finishedAt, errorCode: candidate.errorCode })),
          matcherResults,
        }, secrets);
        await captureScreenshot("final-state", "Final visible task state", "final-state.png");
      } else if (execution.task.flow === "followup_stop_resume") {
        const journey = await runFollowupStopResumeFlow({ page, api, fixtures, execution, nonce, workspacePath: workspacePath!, temporaryRoot,
          deadlineAt: startedAtMs + deadlineMs - 30_000,
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[];
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `followupStopResume.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          }, capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = journey.issue as IssueRecord; selectedRuns = journey.runs as RunRecord[];
      } else if (execution.task.flow === "finalization_recovery") {
        const journey = await runFinalizationRecoveryFlow({ page, api, fixtures, execution, nonce, temporaryRoot,
          deadlineAt: startedAtMs + deadlineMs - 30_000,
          restart: binding => restartIsolatedPaperclipServer({ api, requestId: `finalization-${nonce}`, deadlineAt: startedAtMs + deadlineMs, crashAfterResult: binding }),
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[];
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `finalizationRecovery.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          }, capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = journey.issue as IssueRecord; selectedRuns = journey.runs as RunRecord[];
      } else if (execution.task.flow === "repository_verification") {
        const journey = await runRepositoryVerificationFlow({ page, api, fixtures, execution, nonce, workspacePath: workspacePath!, temporaryRoot,
          deadlineAt: startedAtMs + deadlineMs - 30_000,
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[];
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `repositoryVerification.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          }, capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = journey.issue as IssueRecord; selectedRuns = journey.runs as RunRecord[];
      } else if (execution.task.flow === "automatic_repository") {
        const journey = await runAutomaticRepositoryFlow({ page, api, fixtures, execution, nonce, temporaryRoot,
          deadlineAt: startedAtMs + deadlineMs - 30_000,
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[];
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `automaticRepository.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          }, capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = journey.issue as IssueRecord; selectedRuns = journey.runs as RunRecord[];
      } else if (execution.task.flow === "task_workspaces") {
        const journey = await runTaskWorkspacesFlow({ page, api, fixtures, execution, nonce, temporaryRoot,
          deadlineAt: startedAtMs + deadlineMs - 30_000,
          restart: () => restartIsolatedPaperclipServer({ api, requestId: `task-workspaces-${nonce}`, deadlineAt: startedAtMs + deadlineMs }),
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[];
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `taskWorkspaces.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          }, capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = journey.issue as IssueRecord; selectedRuns = journey.runs as RunRecord[];
      } else if (execution.task.flow === "public_mcp") {
        const journey = await runPublicMcpFlow({
          page, api, fixtures, execution, nonce, secrets, userId: publicMcpUserId,
          credential: credentials[execution.profile.credential]!, usage: publicMcpUsage!, deadlineAt: startedAtMs + deadlineMs,
          observe: (currentIssue, runs) => { issue = currentIssue; selectedRuns = runs; },
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = journey.issue; selectedRuns = journey.runs;
        matcherResults = journey.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `publicMcp.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "plan_task_guidance") {
        const planning = await runPlanTaskFlow({ page, api, fixtures, execution, nonce, workspacePath,
          deadlineAt: startedAtMs + deadlineMs - 30_000,
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[];
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `planning.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          }, capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = planning.issue as IssueRecord; selectedRuns = planning.runs as RunRecord[];
      } else if (execution.task.flow === "blocker_guidance") {
        const blocker = await runBlockerFlow({ page, api, fixtures, execution, nonce, workspacePath,
          deadlineAt: startedAtMs + deadlineMs - 30_000,
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue; selectedRuns = currentRuns;
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `blocker.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          },
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = blocker.issue as IssueRecord; selectedRuns = blocker.runs as RunRecord[];
      } else if (execution.task.flow === "continuation_accounting") {
        const accounting = await runAccountingFlow({
          page, api, fixtures, execution, nonce, deadlineAt: startedAtMs + deadlineMs - 60_000,
          restart: () => restartIsolatedPaperclipServer({ api, requestId: `accounting-${nonce}`, deadlineAt: startedAtMs + deadlineMs }),
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue; selectedRuns = currentRuns;
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `accounting.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          },
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = accounting.issue as IssueRecord; selectedRuns = accounting.runs as RunRecord[];
      } else if (execution.task.flow === "pi_controls") {
        const story = await runPiControlsFlow({
          page, api, fixtures, execution, nonce, workspacePath, deadlineAt: startedAtMs + deadlineMs,
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          remoteBootstrap, registerCleanupAssertion, registerBeforeEnvironmentTeardownAssertion,
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `piControls.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "kimi_native_lifecycle") {
        const story = await runKimiLifecycleFlow({
          page, api, fixtures, execution, nonce, workspacePath, deadlineAt: kimiWorkDeadlineAt!,
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          remoteBootstrap, registerCleanupAssertion, registerBeforeEnvironmentTeardownAssertion,
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `kimiNativeLifecycle.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "native_provider_loss") {
        const story = await runNativeProviderLossFlow({
          page, api, fixtures, execution, nonce, workspacePath, deadlineAt: startedAtMs + deadlineMs,
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          remoteBootstrap, registerCleanupAssertion, registerBeforeEnvironmentTeardownAssertion,
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `nativeProviderLoss.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "cursor_cloud_stop") {
        const story = await runCursorCloudStopFlow({ page, api, fixtures, execution, nonce, observer: cursorCloudObserver!, deadlineAt: startedAtMs + deadlineMs,
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `cursorCloud.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
        await captureApiState("final");
        await captureScreenshot("final-state", "Final visible task state", "final-state.png");
      } else if (execution.task.flow === "native_active_stop") {
        const story = await (execution.profile.qualificationCandidate === "copilot" ? runCopilotActiveStopFlow : runNativeActiveStopFlow)({
          page, api, fixtures, execution: execution.profile.qualificationCandidate === "copilot" && execution.task.id === "pending-permission-stop" ? { ...execution, task: copilotActiveStopTasks[0]! } : execution, nonce, workspacePath, deadlineAt: startedAtMs + deadlineMs,
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          remoteBootstrap, registerCleanupAssertion, registerBeforeEnvironmentTeardownAssertion,
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `nativeActiveStop.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "copilot_protection") {
        const story = await runCopilotProtectionFlow({
          page, api, fixtures, execution, nonce, workspacePath, deadlineAt: startedAtMs + deadlineMs,
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot, evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          remoteBootstrap, registerBeforeEnvironmentTeardownAssertion,
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `copilotProtection.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "cursor_native") {
        const story = await runCursorNativeFlow({
          page, api, fixtures, execution, nonce, workspacePath, deadlineAt: startedAtMs + deadlineMs,
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          remoteBootstrap, registerCleanupAssertion, registerBeforeEnvironmentTeardownAssertion,
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `cursorNative.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "pi_native") {
        const story = await runPiNativeFlow({
          page, api, fixtures, execution, nonce, workspacePath, deadlineAt: startedAtMs + deadlineMs,
          restart: preserveRunner => restartIsolatedPaperclipServer({ api, requestId: `pi-native-${nonce}`, deadlineAt: startedAtMs + deadlineMs, preserveRunner }),
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          remoteBootstrap, registerCleanupAssertion: remoteBootstrap ? registerBeforeEnvironmentTeardownAssertion : registerCleanupAssertion,
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `piNative.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "instruction_persistence") {
        const story = await runInstructionPersistenceFlow({
          page, api, fixtures, execution, nonce, secrets, deadlineAt: startedAtMs + deadlineMs,
          restart: () => restartIsolatedPaperclipServer({ api, requestId: `instructions-${nonce}`, deadlineAt: startedAtMs + deadlineMs }),
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `instructions.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "continuation") {
        const continuation = await runContinuationFlow({
          page, api, fixtures, execution, nonce, secrets, workspacePath, deadlineAt: startedAtMs + deadlineMs - 60_000,
          restart: () => restartChatServer(page, () => restartIsolatedPaperclipServer({ api, requestId: `continuation-${nonce}`, deadlineAt: startedAtMs + deadlineMs })),
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue; selectedRuns = currentRuns;
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `continuation.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          },
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = continuation.issue as IssueRecord; selectedRuns = continuation.runs as RunRecord[];
      } else if (execution.task.flow === "everyday_workflow") {
        const { readUpgradeArtifacts, upgradeArtifactKey } = await import("./upgrade-artifacts.js");
        const upgradeManifest = controllerOutage ? await readUpgradeArtifacts(process.env[upgradeArtifactKey]) : null;
        let restartIndex = 0;
        const story = await runEverydayFlow({
          page, api, fixtures, execution, nonce, workspacePath, privateDir,
          deadlineAt: startedAtMs + deadlineMs,
          restartCount: upgradeManifest ? upgradeManifest.sequence.length -
            (execution.suite.definitionMetadata?.retainedControllerContinuation === true ? 2 : 1) : 1,
          restart: async (recoveryBinding, controllerDowntimeMs) => {
            let receipt: ControllerReplacementReceipt | undefined;
            restartIndex += 1;
            await restartIsolatedPaperclipServer({ api, requestId: `story-${nonce}-${restartIndex}`, deadlineAt: startedAtMs + deadlineMs,
              discardControllerCache: controllerOutage !== undefined || isRollingWebDeployment(execution),
              ...(isRollingWebDeployment(execution) ? { rollingDeployment: true as const } : {}),
              controllerOutage: controllerOutage && !recoveryBinding ? { ...controllerOutage, holdMs: 1000 } : controllerOutage,
              ...(!isRollingWebDeployment(execution) ? { controllerDowntimeMs } : {}),
              ...((controllerOutage || isRollingWebDeployment(execution)) ? { recoveryBinding } : {}),
              onControllerOutage: async value => {
                receipt = value;
                await writeSanitizedJson(snapshotsDir, `controller-outage-${restartIndex}.json`, value, secrets);
              } });
            return receipt;
          },
          observe: (storyIssue, storyRuns) => { issue = storyIssue; selectedRuns = storyRuns; },
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
        });
        issue = story.issue; selectedRuns = story.runs;
        matcherResults = story.evidence.checks.map(check => ({ matcher: { kind: "json_path" as const, path: check.id, expected: true }, passed: check.passed, detail: check.detail }));
      } else if (execution.task.flow === "repository_skills") {
        const story = await runRepositorySkillsFlow({ page, api, fixtures, execution, nonce, credentials, secrets,
          deadlineAt: startedAtMs + deadlineMs, capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          observe: (currentIssue, currentRuns) => { issue = currentIssue as IssueRecord; selectedRuns = currentRuns as RunRecord[]; },
        });
        issue = story.issue as IssueRecord; selectedRuns = story.runs as RunRecord[];
        matcherResults = story.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `repositorySkills.${check.id}`, expected: true }, passed: check.passed, detail: check.id }));
      } else if (execution.task.flow === "context_integrity") {
        const contextIntegrity = await runContextIntegrityFlow({
          page, api, fixtures, execution, nonce, deadlineAt: startedAtMs + deadlineMs,
          capture: captureScreenshot,
          evidence: (name, data) => writeSanitizedJson(snapshotsDir, name, data, secrets),
          observe: (currentIssue, currentRuns, checks) => {
            issue = currentIssue as unknown as IssueRecord;
            selectedRuns = currentRuns as unknown as RunRecord[];
            matcherResults = checks.map(check => ({ matcher: { kind: "json_path" as const, path: `contextIntegrity.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          },
        });
        issue = contextIntegrity.issue as unknown as IssueRecord;
        selectedRuns = contextIntegrity.runs as unknown as RunRecord[];
      } else if (execution.task.flow === "setup_health") {
        await runChatSetupHealth({ api, fixtures, temporaryRoot: temporaryRoot!, evidence: completionEvidence });
        await captureSetupHealthProfile({ executionId: execution.id, api, page,
          companyId: fixtures.company.id, agentId: fixtures.agent.id, capturePrivate: capturePrivateScreenshot });
        matcherResults = [{ matcher: { kind: "json_path", path: "setupHealth.closed-checks", expected: true }, passed: true,
          detail: "One genuine ordinary setup hello, exact saved configuration, zero chat/task work." }];
      } else if (execution.task.flow === "agent_chat") {
        const chat = await runChatFlow({
          privateSecrets: secrets, privateInputs,
          page, api, fixtures, execution, nonce, workspacePath,
          deadlineAt: startedAtMs + deadlineMs,
          restart: () => restartChatServer(page, () => restartIsolatedPaperclipServer({ api, requestId: `chat-${nonce}`, deadlineAt: startedAtMs + deadlineMs })),
          retireFailedAttempt: async error => {
            catalogFailureCaptureAttempted = true;
            primaryError ??= error;
            try { await writeSanitizedJson(snapshotsDir, "failed-attempt-checkpoint.json", {
              schema: "paperclip.runner-e2e.failed-attempt-checkpoint/v1", executionId: execution.id,
              qualification: "unqualified", featureOutcome: "unknown", phase: "before_owned_retirement",
            }, secrets); } finally { await cancelActiveRunsForCleanup(20_000); }
          },
          observe: (chatIssue, chatRuns) => { issue = chatIssue; selectedRuns = chatRuns; },
          capture: ordinaryChatCapture(execution.suite.id, capturePrivateScreenshot, captureScreenshot),
          evidence: completionEvidence,
          check: (id, passed, detail) => matcherResults.push({ matcher: { kind: "json_path", path: `chat.${id}`, expected: true }, passed, detail }),
        });
        if (chat) { issue = chat.issue; selectedRuns = chat.runs; }
        if (matcherResults.length === 0) matcherResults = [{ matcher: { kind: "issue_status", expected: "in_review" }, passed: true, detail: "Chat workflow and durable handoff/session assertions passed" }];
      } else if (execution.task.flow === "first_task") {
        const firstTask = await runFirstTaskFlow({
          page, api, fixtures, execution, nonce, deadlineAt: startedAtMs + deadlineMs, secrets,
          observe: (currentIssue, runs, evidence) => {
            issue = currentIssue; selectedRuns = runs; firstTaskEvidence = evidence;
            matcherResults = evidence.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `firstTask.checks.${check.id}`, expected: true }, passed: check.passed, detail: check.detail }));
          },
          createOrdinary: async (taskTitle, taskPrompt) => {
            const createdTask = await createTaskThroughUi({ page, issuePrefix: fixtures!.company.issuePrefix!, agentName: fixtures!.agent.name, title: taskTitle, prompt: taskPrompt, workMode: "standard" });
            const created = await pollUntil({ label: "ordinary UI-created task", deadlineAt: startedAtMs + deadlineMs,
              load: async () => (await api.get<IssueRecord[]>(`/api/companies/${fixtures!.company.id}/issues?limit=100`)).find(row => row.id === createdTask.issueId), accept: row => Boolean(row) });
            if (!created) throw new Error("Missing ordinary task");
            return created;
          },
          capture: captureScreenshot,
          evidence: completionEvidence,
        });
        issue = firstTask.issue as IssueRecord; selectedRuns = firstTask.runs as RunRecord[];
      } else {
      const issuePrefix = fixtures.company.issuePrefix;
      if (!issuePrefix)
        throw new Error(
          "Created fixture company did not return an issue prefix",
        );
      if (execution.task.flow === "governed_tool_review") {
        reviewProvider = await setupConnectionReview({ page, api, prefix: issuePrefix, companyId: fixtures.company.id, agentId: fixtures.agent.id, marker });
      }
      // Capture the actual creation response: a generated title can change before
      // a later list query, and the initial provisional state is part of the oracle.
      const titleCreationResponse = execution.suite.id === "task-titles"
        ? page.waitForResponse(response => response.request().method() === "POST"
          && new URL(response.url()).pathname === `/api/companies/${fixtures!.company.id}/issues`,
          { timeout: Math.max(1, startedAtMs + deadlineMs - Date.now()) })
          .catch((cause: unknown) => new Error("Could not capture task creation response", { cause }))
        : null;
      const createdTask = await createTaskThroughUi({
          page,
          issuePrefix,
          agentName: fixtures.agent.name,
          title,
          prompt,
          workMode: execution.task.workMode,
          projectName: fixtures.project?.name,
          requireExplicitTitle: execution.suite.id === "task-titles" && Boolean(title),
          beforeDispatch: execution.suite.id === "codie-latency-diagnostic"
            ? () => { responseTiming = armResponseTiming({ page }); } : undefined,
        });
      turnSubmissionTimesMs.push(createdTask.submittedAtMs);

      const deadlineAt = startedAtMs + deadlineMs;
      if (titleCreationResponse) {
        const response = await titleCreationResponse;
        if (response instanceof Error) throw response;
        expect(response.status()).toBe(201);
        issue = await response.json() as IssueRecord;
        titleCreation = { issue, submitted: response.request().postDataJSON() };
        await writeSanitizedJson(snapshotsDir, "task-title-creation.json", titleCreation, secrets);
      } else issue = await pollUntil({
        label: `UI-created issue ${title}`,
        deadlineAt,
        load: async () => {
          const issues = await api.get<IssueRecord[]>(
            `/api/companies/${fixtures!.company.id}/issues?limit=50`,
          );
          return issues.find((candidate) => candidate.id === createdTask.issueId);
        },
        accept: (candidate): candidate is IssueRecord => Boolean(candidate),
      });
      if (!issue) throw new Error(`Issue ${title} disappeared after creation`);
      if (
        issue.companyId !== fixtures.company.id ||
        issue.assigneeAgentId !== fixtures.agent.id
      ) {
        throw new Error(
          "UI-created issue does not belong to the fixture company and agent",
        );
      }
      if (issue.workMode !== execution.task.workMode) {
        throw new Error(
          `UI-created issue work mode was ${String(issue.workMode)}; expected ${execution.task.workMode}`,
        );
      }
      if (fixtures.project) {
        if (
          issue.projectId !== fixtures.project.id ||
          issue.projectWorkspaceId !== fixtures.project.primaryWorkspace?.id
        ) {
          throw new Error(
            `Warm task did not retain its project/workspace scope: ${JSON.stringify({ projectId: issue.projectId, projectWorkspaceId: issue.projectWorkspaceId })}`,
          );
        }
      }

      await page.goto(
        `/${encodeURIComponent(issuePrefix)}/issues/${encodeURIComponent(issue.identifier ?? issue.id)}`,
      );

      const loadTaskState = async () => {
        const observeSettlement = responseTiming?.beginSettlement();
        const [currentIssue, runs, comments, interactions] = await Promise.all([
          api.get<IssueRecord>(`/api/issues/${issue!.id}`),
          api.get<RunRecord[]>(
            companyRunFlow
                ? `/api/companies/${fixtures!.company.id}/heartbeat-runs?limit=100`
                : `/api/companies/${fixtures!.company.id}/heartbeat-runs?agentId=${fixtures!.agent.id}&limit=20`,
          ),
          api.get<CommentRecord[]>(
            `/api/issues/${issue!.id}/comments?order=asc`,
          ),
          api.get<InteractionRecord[]>(`/api/issues/${issue!.id}/interactions`),
        ]);
        observeSettlement?.({ present: currentIssue.status === execution.task.expectedTerminalState.issue
          && matchingRuns(runs, currentIssue).length >= minimumRunCount(execution.task)
          && matchingRuns(runs, currentIssue).every(run => TERMINAL_RUN_STATUSES.has(run.status)) });
        return {
          currentIssue,
          taskRuns: matchingRuns(runs, currentIssue),
          comments,
          interactions,
        };
      };

      const rejectPlanConfirmationPoll = (input: {
        taskRuns: RunRecord[];
        interactions: InteractionRecord[];
        minimumRunCount: number;
      }) => {
        const runFailure = definitiveRunFailure(input.taskRuns);
        if (runFailure) return runFailure;
        if (
          !hasTerminalMalformedPlanConfirmation({
            runs: input.taskRuns,
            interactions: input.interactions,
            minimumRunCount: input.minimumRunCount,
          })
        ) {
          return undefined;
        }
        failureClassOverride = "provider_variance";
        return "succeeded heartbeat run created a pending request_confirmation without a revision-bound Plan target";
      };

      let planLifecycleEvidence: Record<string, unknown> | null = null;
      let questionLifecycleEvidence: Record<string, unknown> | null = null;
      let warmLifecycleEvidence: Record<string, unknown> | null = null;
      let expectedQuestionResolution: {
        interactionId: string;
        optionId: string;
      } | null = null;
      if (execution.task.flow === "governed_tool_review") {
        await expect(page.getByRole("button", { name: "Approve & run", exact: true })).toBeVisible({ timeout: Math.max(1, deadlineAt - Date.now()) });
        expect(reviewProvider!.invocationCount()).toBe(0);
        await pollUntil({ label: "governed waiting turn", deadlineAt, load: loadTaskState, accept: state => state.taskRuns.length === 1 && state.taskRuns.every(run => TERMINAL_RUN_STATUSES.has(run.status)) });
        await captureScreenshot("tool-review-pending", "Connection review awaiting a human", "tool-review-pending.png");
        await page.getByRole("button", { name: "Dismiss Approve tool action" }).click();
        if (execution.task.toolReviewDecision === "restart") {
          await restartIsolatedPaperclipServer({ api, requestId: `tool-review-${nonce}`, deadlineAt });
          await page.reload();
        }
        // Open the review card on the document that will act on it: an
        // expanded card does not survive the post-restart reload.
        await page.getByRole("button", { name: "Review request", exact: true }).click();
        if (execution.task.toolReviewDecision === "always") {
          await page.getByRole("button", { name: "Approval options", exact: true }).click();
          await page.getByRole("menuitem", { name: "Always allow", exact: true }).click();
        } else {
          await page.getByRole("button", { name: execution.task.toolReviewDecision === "decline" ? "Decline" : "Approve & run", exact: true }).click();
        }
      } else if (execution.task.flow === "plan_revision_acceptance") {
        const planMarkers = execution.task.buildPlanMarkers?.(nonce);
        const revisionRequest = execution.task.buildRevisionRequest?.(nonce);
        if (!planMarkers || !revisionRequest) throw new Error(`Plan fixture ${execution.task.id} is missing lifecycle factories`);
        planLifecycleEvidence = await runPlanRevisionAcceptance({ page, api, origin: api.baseURL,
          issue, issuePrefix, native: execution.profile.expectedRuntimeMode === "native", planMarkers, revisionRequest,
          deadlineAt, load: loadTaskState, reject: rejectPlanConfirmationPoll, capture: captureScreenshot });
      } else if (execution.task.flow === "question_resume_completion") {
        const expectedAnswer = execution.task.buildQuestionAnswer?.(nonce);
        if (!expectedAnswer) {
          throw new Error(
            `Question fixture ${execution.task.id} is missing its answer factory`,
          );
        }
        const pendingState = await pollUntil({
          label: `pending user question for issue ${issue.id}`,
          deadlineAt,
          load: loadTaskState,
          accept: ({ taskRuns, interactions }) =>
            taskRuns.length >= 1 &&
            taskRuns.every((run) => TERMINAL_RUN_STATUSES.has(run.status)) &&
            interactions.some(isPendingQuestion),
          reject: ({ taskRuns }) => definitiveRunFailure(taskRuns),
        });
        const questionInteractions = pendingState.interactions.filter(
          (interaction) => interaction.kind === "ask_user_questions",
        );
        if (
          questionInteractions.length !== 1 ||
          !isPendingQuestion(questionInteractions[0]!)
        ) {
          throw new Error(
            `Expected exactly one pending question interaction; observed ${JSON.stringify(questionInteractions)}`,
          );
        }
        const questionInteraction = questionInteractions[0]!;
        const questions = questionInteraction.payload?.questions ?? [];
        if (questionInteraction.payload?.version !== 1) {
          throw new Error("Question interaction omitted payload version 1");
        }
        if (questions.length !== 1) {
          throw new Error(
            `Expected exactly one question; observed ${questions.length}`,
          );
        }
        const question = questions[0]!;
        if (
          question.id !== "verification-word" ||
          question.prompt !== "Choose the verification word." ||
          question.selectionMode !== "single" ||
          question.required !== true ||
          JSON.stringify(question.options) !==
            JSON.stringify([
              { id: "cobalt", label: "Cobalt" },
              { id: "amber", label: "Amber" },
            ])
        ) {
          throw new Error(
            `Question interaction did not preserve the exact verification contract: ${JSON.stringify(question)}`,
          );
        }
        const selectedOption = question.options.find(
          (option) => option.label === expectedAnswer.optionLabel,
        );
        if (!selectedOption) {
          throw new Error(
            `Question interaction omitted ${expectedAnswer.optionLabel}`,
          );
        }
        expectedQuestionResolution = {
          interactionId: questionInteraction.id,
          optionId: selectedOption.id,
        };
        await page.goto(
          `/${encodeURIComponent(issuePrefix)}/issues/${encodeURIComponent(issue.identifier ?? issue.id)}`,
          { waitUntil: "domcontentloaded" },
        );
        await expect(
          page
            .getByRole("radio", {
              name: expectedAnswer.optionLabel,
              exact: true,
            })
            .last(),
        ).toBeVisible({ timeout: 30_000 });
        await captureScreenshot(
          "question-pending",
          "Structured question awaiting an answer",
          "question-pending.png",
        );
        if (execution.task.restartServerBeforeQuestionAnswer) {
          const restartRequestId = `question-wait-${nonce}`;
          await restartIsolatedPaperclipServer({
            api,
            requestId: restartRequestId,
            deadlineAt,
          });
          const documentSentinel = `__paperclip_runner_restart_${nonce.replaceAll("-", "_")}`;
          await page.evaluate(
            (key) => Reflect.set(window, key, true),
            documentSentinel,
          );
          // The replacement Vite server can commit and render a fresh document
          // while its navigation lifecycle remains unsettled, and the old
          // document's Vite client can reload and abort this navigation. The
          // sentinel and explicit assertions below prove the new document and
          // durable state either way.
          await gotoAfterServerRestart(
            page,
            `/${encodeURIComponent(issuePrefix)}/issues/${encodeURIComponent(issue.identifier ?? issue.id)}`,
            { deadlineAt },
          );
          await expect(
            page
              .getByRole("radio", {
                name: expectedAnswer.optionLabel,
                exact: true,
              })
              .last(),
          ).toBeVisible({ timeout: 30_000 });
          expect(
            await page.evaluate(
              (key) => Reflect.get(window, key) === true,
              documentSentinel,
            ),
          ).toBe(false);
          const reloadedInteractions = await api.get<InteractionRecord[]>(
            `/api/issues/${issue.id}/interactions`,
          );
          const reloadedQuestions = reloadedInteractions.filter(
            (interaction) => interaction.kind === "ask_user_questions",
          );
          if (
            reloadedQuestions.length !== 1 ||
            reloadedQuestions[0]?.id !== questionInteraction.id ||
            !isPendingQuestion(reloadedQuestions[0])
          ) {
            throw new Error(
              `Server restart did not preserve the exact pending interaction ${questionInteraction.id}: ${JSON.stringify(reloadedQuestions)}`,
            );
          }
          await captureScreenshot(
            "question-pending-after-server-restart",
            "Structured question preserved across server restart",
            "question-pending-after-server-restart.png",
          );
        }
        await page
          .getByRole("radio", {
            name: expectedAnswer.optionLabel,
            exact: true,
          })
          .last()
          .check();
        // The one-question form is on its last page, so selecting the radio
        // records the answer and the existing form button submits it.
        await page
          .getByRole("button", { name: "Submit answers", exact: true })
          .last()
          .click();
        questionLifecycleEvidence = {
          interaction: questionInteraction,
          answer: expectedAnswer.optionLabel,
          expectedMarker: expectedAnswer.expectedMarker,
          serverRestartedBeforeAnswer:
            execution.task.restartServerBeforeQuestionAnswer ?? false,
        };
      } else if (execution.task.flow === "plan_approval_completion") {
        const planMarkers = execution.task.buildPlanMarkers?.(nonce);
        if (!planMarkers) {
          throw new Error(
            `Plan fixture ${execution.task.id} is missing its marker factory`,
          );
        }
        const pendingState = await pollUntil({
          label: `pending plan approval for issue ${issue.id}`,
          deadlineAt,
          load: loadTaskState,
          accept: ({ taskRuns, interactions }) =>
            taskRuns.length >= 1 &&
            taskRuns.every((run) => TERMINAL_RUN_STATUSES.has(run.status)) &&
            interactions.some(isPendingPlanConfirmation),
          reject: ({ taskRuns, interactions }) =>
            rejectPlanConfirmationPoll({
              taskRuns,
              interactions,
              minimumRunCount: 1,
            }),
        });
        const interaction = pendingState.interactions.find(
          isPendingPlanConfirmation,
        )!;
        const plan = await api.get<IssueDocumentRecord>(
          `/api/issues/${issue.id}/documents/plan`,
        );
        if (!normalizePlanMarkdown(plan.body).includes(planMarkers.draft)) {
          throw new Error(`Plan document did not contain ${planMarkers.draft}`);
        }
        if (execution.suite.id === CODEX_PLANNING_READ_ONLY_SUITE) {
          const planningEvents = (await Promise.all(pendingState.taskRuns.map(candidate =>
            collectRunEvents<RunEventRecord>((afterSeq, limit) =>
              api.get(`/api/heartbeat-runs/${candidate.id}/events?afterSeq=${afterSeq}&limit=${limit}`))))).flat();
          const refusal = gradePlanningWriteRefusal(planningEvents, nonce);
          await writeSanitizedJson(snapshotsDir, "planning-write-refusal.json", refusal, secrets);
          if (!refusal.passed) throw new Error(`Planning write refusal was not proven: ${refusal.failure}`);
        }
        if (numberedPlanStepCount(plan.body) !== 2) {
          throw new Error("Plan must contain exactly two numbered steps");
        }
        if (interaction.payload?.target?.revisionId !== plan.latestRevisionId) {
          throw new Error(
            "Plan confirmation did not target the latest Plan revision",
          );
        }
        await page.goto(
          `/${encodeURIComponent(issuePrefix)}/issues/${encodeURIComponent(issue.identifier ?? issue.id)}`,
          { waitUntil: "domcontentloaded" },
        );
        await expectPlanStageVisible(page, {
          native: execution.profile.expectedRuntimeMode === "native",
          revision: plan.latestRevisionNumber ?? null,
        });
        await captureScreenshot(
          "plan-pending",
          "Plan awaiting approval",
          "plan-pending.png",
        );
        await page
          .getByRole("button", {
            name: interaction.payload?.acceptLabel ?? "Approve",
            exact: true,
          })
          .last()
          .click();
        planLifecycleEvidence = { interaction, plan };
      } else if (execution.task.flow === "warm_three_turn") {
        const followups = execution.task.buildFollowupMessages?.(nonce);
        if (!followups || !fixtures.project?.primaryWorkspace?.id) {
          throw new Error(
            `Warm fixture ${execution.task.id} is missing its project or follow-up messages`,
          );
        }
        const workspaceFile = path.join(
          workspacePath,
          `daytona-warm-${nonce}.txt`,
        );
        const turnEvidence: Array<Record<string, unknown>> = [];
        for (const completedTurn of [1, 2] as const) {
          const turnDeadlineAt = Math.min(
            deadlineAt,
            turnSubmissionTimesMs[completedTurn - 1]! +
              (execution.task.turnTimeoutMs ?? 10 * 60_000),
          );
          const waitingState = await pollUntil({
            label: `warm ${execution.environment.id} turn ${completedTurn} review state for issue ${issue.id}`,
            deadlineAt: turnDeadlineAt,
            load: loadTaskState,
            accept: ({ currentIssue, taskRuns, interactions }) => {
              const latestRun = sortRunsChronologically(taskRuns).at(-1);
              const pendingConfirmations = interactions.filter(
                isPendingWarmConfirmation,
              );
              return (
                currentIssue.status === "in_review" &&
                taskRuns.length === completedTurn &&
                taskRuns.every((run) => run.status === "succeeded") &&
                pendingConfirmations.length === 1 &&
                pendingConfirmations[0]?.sourceRunId === latestRun?.id
              );
            },
            reject: ({ taskRuns }) =>
              definitiveRunFailure(taskRuns) ??
              (taskRuns.length > completedTurn
                ? `warm turn ${completedTurn} dispatched duplicate runs`
                : undefined),
          });
          if (execution.suite.id === "daytona-git-streaming") {
            await writeSanitizedJson(snapshotsDir, `git-copyback-turn-${completedTurn}.json`, await gitStreamingEvidence(workspacePath, completedTurn), secrets);
            const finalization = await gitFinalizationEvidence(api, issue.id, waitingState.taskRuns.map(run => run.id));
            await writeSanitizedJson(snapshotsDir, `git-finalization-turn-${completedTurn}.json`, finalization, secrets);
            expect(finalization.passed, finalization.failures.join("; ")).toBe(true);
          }
          if (execution.suite.id === "daytona-warm-continuity") {
            const evidence = await warmManagedFileEvidence(api, fixtures.agent.id, sortRunsChronologically(waitingState.taskRuns).at(-1)!.id, completedTurn, nonce, execution.profile.generation === "native");
            await writeSanitizedJson(snapshotsDir, `managed-warm-turn-${completedTurn}.json`, evidence, secrets);
            expect(evidence.passed, JSON.stringify(evidence.checks)).toBe(true);
          }
          const expectedPrefix = `${Array.from(
            { length: completedTurn },
            (_, index) => `T${index + 1}-${nonce}`,
          ).join("\n")}\n`;
          const hostContent = await readFile(workspaceFile, "utf8");
          if (hostContent !== expectedPrefix) {
            throw new Error(
              `Host workspace was not finalized after warm turn ${completedTurn}: expected ${JSON.stringify(expectedPrefix)}, observed ${JSON.stringify(hostContent)}`,
            );
          }
          if (
            waitingState.currentIssue.projectId !== fixtures.project.id ||
            waitingState.currentIssue.projectWorkspaceId !==
              fixtures.project.primaryWorkspace.id ||
            !waitingState.currentIssue.executionWorkspaceId
          ) {
            throw new Error(
              `Warm turn ${completedTurn} lost its project execution-workspace scope`,
            );
          }
          const chronologicalRuns = sortRunsChronologically(
            waitingState.taskRuns,
          );
          const completedRunIds = new Set(
            chronologicalRuns.map((candidate) => candidate.id),
          );
          let completedLeases: EnvironmentLeaseRecord[] = [];
          if (execution.environment.id === "daytona") {
            const retainedTurnLeases = await pollUntil({
              label: `retained Daytona leases after warm turn ${completedTurn}`,
              deadlineAt: Math.min(turnDeadlineAt, Date.now() + 30_000),
              intervalMs: 500,
              load: () =>
                api.get<EnvironmentLeaseRecord[]>(
                  `/api/environments/${fixtures!.environment.id}/leases`,
                ),
              accept: (leases) => {
                const runOrder = new Map(
                  chronologicalRuns.map((candidate, index) => [
                    candidate.id,
                    index,
                  ]),
                );
                const completed = leases
                  .filter(
                    (lease) =>
                      lease.heartbeatRunId &&
                      completedRunIds.has(lease.heartbeatRunId),
                  )
                  .sort(
                    (left, right) =>
                      (runOrder.get(left.heartbeatRunId ?? "") ?? 0) -
                      (runOrder.get(right.heartbeatRunId ?? "") ?? 0),
                  );
                return (
                  completed.length === completedTurn &&
                  completed
                    .slice(0, -1)
                    .every(
                      (lease) =>
                        lease.status === "expired" &&
                        lease.cleanupStatus === "success",
                    ) &&
                  completed.at(-1)?.status === "retained" &&
                  completed.every(
                    (lease) =>
                      lease.leasePolicy === "reuse_by_environment" &&
                      typeof lease.providerLeaseId === "string" &&
                      record(lease.metadata).sandboxState === "started",
                  ) &&
                  completed
                    .slice(1)
                    .every(
                      (lease) =>
                        record(lease.metadata).resumedFromState === "started",
                    )
                );
              },
            });
            const turnRunOrder = new Map(
              chronologicalRuns.map((candidate, index) => [candidate.id, index]),
            );
            completedLeases = retainedTurnLeases
              .filter(
                (lease) =>
                  lease.heartbeatRunId &&
                  completedRunIds.has(lease.heartbeatRunId),
              )
              .sort(
                (left, right) =>
                  (turnRunOrder.get(left.heartbeatRunId ?? "") ?? 0) -
                  (turnRunOrder.get(right.heartbeatRunId ?? "") ?? 0),
              );
            if (
              new Set(completedLeases.map((lease) => lease.providerLeaseId))
                .size !== 1
            ) {
              throw new Error(
                `Warm turn ${completedTurn} replaced its Daytona sandbox`,
              );
            }
          }
          const journalEvidence = execution.suite.id === "daytona-journal-continuity" && completedTurn === 1
            ? await largeJournalEvidence({
                stateRoot: path.join(process.env.PAPERCLIP_HOME!, "instances", process.env.PAPERCLIP_INSTANCE_ID!, "runtime", "paperclip-runner", "durable-sessions"),
                runId: chronologicalRuns.at(-1)!.id,
                minimumBytes: 2 * 1024 * 1024,
                minimumCompletedStimulusCalls: 240,
              })
            : undefined;
          if (journalEvidence) {
            await writeSanitizedJson(snapshotsDir, "large-journal-boundary.json", journalEvidence, secrets);
          }
          turnEvidence.push({
            ...(journalEvidence ? { journalEvidence } : {}),
            turn: completedTurn,
            issue: waitingState.currentIssue,
            run: chronologicalRuns.at(-1),
            hostContent,
            leases: completedLeases,
          });
          await page.goto(
            `/${encodeURIComponent(issuePrefix)}/issues/${encodeURIComponent(issue.identifier ?? issue.id)}`,
            { waitUntil: "domcontentloaded" },
          );
          // Navigation commits before React has loaded the task. Bind the
          // screenshot to this turn's visible reply and exact pending review,
          // rather than capturing a spinner after DOMContentLoaded.
          const reviewUiTimeout = () => {
            const remaining = turnDeadlineAt - Date.now();
            if (remaining <= 0) throw new Error(`Warm turn ${completedTurn} UI deadline elapsed`);
            return Math.min(30_000, remaining);
          };
          await expect(page.getByTestId("issue-detail-header").getByRole("button", {
            name: "Change status (current: In Review)", exact: true,
          })).toBeVisible({ timeout: reviewUiTimeout() });
          const turnReply = page.getByTestId("task-chat-thread")
            .getByTestId("task-chat-agent-bubble")
            .filter({ hasText: `PAPERCLIP_E2E_WARM_T${completedTurn}_${nonce}` }).last();
          await expect(turnReply).toBeVisible({ timeout: reviewUiTimeout() });
          const pendingReview = waitingState.interactions.find(isPendingWarmConfirmation)!;
          const reviewCard = page.getByTestId("task-chat-interaction")
            .and(page.locator(`[id=${JSON.stringify(`interaction-${pendingReview.id}`)}]`));
          await expect(reviewCard).toBeVisible({ timeout: reviewUiTimeout() });
          await expect(reviewCard.getByRole("button", { name: "Continue work", exact: true }))
            .toBeEnabled({ timeout: reviewUiTimeout() });
          await expect(page.getByTestId("task-chat-history-loading"))
            .toHaveCount(0, { timeout: reviewUiTimeout() });
          await captureScreenshot(
            `warm-turn-${completedTurn}`,
            `Warm ${execution.environment.id} turn ${completedTurn} awaiting review`,
            `warm-turn-${completedTurn}.png`,
          );
          turnSubmissionTimesMs.push(
            await submitTaskRevision(page, followups[completedTurn - 1]),
          );
        }
        warmLifecycleEvidence = { turns: turnEvidence };
      }

      const taskMatchers = execution.task.buildMatchers(nonce, execution);
      const terminalDeadlineAt =
        execution.task.flow === "warm_three_turn"
          ? Math.min(
              deadlineAt,
              turnSubmissionTimesMs.at(-1)! +
                (execution.task.turnTimeoutMs ?? 10 * 60_000),
            )
          : deadlineAt;
      let terminal = await pollUntil({
        label: `issue ${issue.id} and heartbeat run terminal state`,
        deadlineAt: terminalDeadlineAt,
        load: loadTaskState,
        accept: ({ currentIssue, taskRuns }) =>
          currentIssue.status === execution.task.expectedTerminalState.issue &&
          taskRuns.length >= minimumRunCount(execution.task) &&
          taskRuns.every((run) => TERMINAL_RUN_STATUSES.has(run.status)),
        reject: ({ taskRuns }) => definitiveRunFailure(taskRuns),
      });

      // Finalization commits the issue/run decision before the derived agent
      // comment is guaranteed to be visible through the comments endpoint.
      // Give that projection a short consistency window so a successful
      // terminal response is not misclassified as an empty provider reply.
      // If no comment arrives, retain the original terminal observation and
      // let the ordinary message matcher report the product failure.
      if (taskMatchers.some((matcher) => matcher.kind.startsWith("message_"))) {
        terminal = await pollUntil({
          label: `final agent comment for issue ${issue.id}`,
          deadlineAt: Math.min(deadlineAt, Date.now() + 30_000),
          load: async () => {
            const state = await loadTaskState();
            const finalRun = sortRunsChronologically(state.taskRuns).at(-1);
            if (!finalRun) return state;
            // The compact run list omits the native presentation receipt.
            // Poll its public detail together with comments so an earlier
            // deliverable-preparation comment cannot settle this wait.
            const detailed = await api.get<RunRecord>(`/api/heartbeat-runs/${finalRun.id}`);
            return { ...state, taskRuns: state.taskRuns.map(run => run.id === detailed.id ? detailed : run) };
          },
          accept: ({ taskRuns, comments }) => {
            if (!matchesRunCount(execution.task, taskRuns.length)) {
              return false;
            }
            const finalRun = sortRunsChronologically(taskRuns).at(-1);
            return Boolean(finalRun && persistedFinalRunMessage(
              comments.filter(comment => comment.authorAgentId === fixtures!.agent.id), finalRun,
            ).trim());
          },
          reject: ({ taskRuns }) => definitiveRunFailure(taskRuns),
        }).catch(() => terminal);
      }

      issue = terminal.currentIssue;
      selectedRuns = terminal.taskRuns;
      if (lifecycleBlockerId && execution.profile.expectedRuntimeMode === "legacy") {
        const blockedIssue = await api.get<Pick<Issue, "blockedBy">>(`/api/issues/${issue.id}`);
        expect(blockedIssue.blockedBy?.map((blocker) => blocker.id)).toEqual([lifecycleBlockerId]);
        expect((await api.get<{ status: string }>(`/api/issues/${lifecycleBlockerId}`)).status).toBe("backlog");
      }
      if (reviewProvider) {
        expect(reviewProvider.invocationCount()).toBe(execution.task.toolReviewDecision === "decline" ? 0 : execution.task.toolReviewDecision === "always" ? 2 : 1);
        const pending = await api.get<{ actionRequests: unknown[] }>(`/api/companies/${fixtures.company.id}/tools/action-requests?status=pending`);
        expect(pending.actionRequests).toHaveLength(0);
        await writeSanitizedJson(snapshotsDir, "connection-review.json", { source: "local MCP fixture", connectionId: reviewProvider.connectionId, providerCalls: reviewProvider.invocationCount(), decision: execution.task.toolReviewDecision, issueId: issue.id }, secrets);
      }
      if (!matchesRunCount(execution.task, selectedRuns.length)) {
        const runLogs = await Promise.all(
          selectedRuns.map(async (candidate) => ({
            runId: candidate.id,
            log: await api
              .get<unknown>(
                `/api/heartbeat-runs/${candidate.id}/log?limitBytes=1048576`,
              )
              .catch((error) => ({
                evidenceCaptureError:
                  error instanceof Error ? error.message : String(error),
              })),
          })),
        );
        await writeSanitizedJson(
          snapshotsDir,
          "api-state.json",
          { issue, runs: selectedRuns, runLogs, ...terminal },
          secrets,
        );
        throw new Error(
          `Expected ${minimumRunCount(execution.task)}..${execution.task.expectedRunCount} task heartbeat run(s); observed ${selectedRuns.length}`,
        );
      }
      // The company run-list endpoint intentionally returns only a compact,
      // allowlisted context summary. Hydrate each selected run through the
      // public detail endpoint before asserting environment/lease metadata.
      selectedRuns = await Promise.all(
        selectedRuns.map((candidate) =>
          api.get<RunRecord>(`/api/heartbeat-runs/${candidate.id}`),
        ),
      );
      selectedRuns = sortRunsChronologically(selectedRuns);
      if (execution.suite.id === "daytona-git-streaming") {
        await writeSanitizedJson(snapshotsDir, "git-copyback-turn-3.json", await gitStreamingEvidence(workspacePath, 3), secrets);
        const finalization = await gitFinalizationEvidence(api, issue.id, selectedRuns.map(run => run.id));
        await writeSanitizedJson(snapshotsDir, "git-finalization-turn-3.json", finalization, secrets);
        expect(finalization.passed, finalization.failures.join("; ")).toBe(true);
      }
      const lifecycleProbe = execution.suite.id === "lifecycle-baseline" ? lifecycleLiveCase(execution.task.id) : undefined;
      if (lifecycleProbe?.family === "repair") {
        const grade = gradeLifecycleRepair({ runs: selectedRuns, comments: terminal.comments,
          agentId: fixtures.agent.id, narrative: lifecycleProbe.narrative });
        await writeSanitizedJson(snapshotsDir, "lifecycle-repair.json", { grade, runs: selectedRuns, comments: terminal.comments }, secrets);
        expect(grade.passed, grade.detail).toBe(true);
        expect(terminal.currentIssue.scheduledRetry).toBeNull();
        expect(terminal.currentIssue.monitorNextCheckAt).toBeNull();
        expect(terminal.interactions.filter(i => i.status === "pending")).toHaveLength(0);
      }

      if (execution.task.flow === "warm_three_turn") {
        turnTimings = selectedRuns.map((candidate, index) => {
          const submittedAtMs = turnSubmissionTimesMs[index]!;
          const runStartedAtMs = candidate.startedAt
            ? Date.parse(candidate.startedAt)
            : Number.NaN;
          const runFinishedAtMs = candidate.finishedAt
            ? Date.parse(candidate.finishedAt)
            : Number.NaN;
          const acquisition = record(
            record(candidate.contextSnapshot).paperclipEnvironment,
          ).sandboxLeaseAcquisition;
          const acquisitionOutcome = record(acquisition).outcome;
          return {
            turn: index + 1,
            submittedAt: new Date(submittedAtMs).toISOString(),
            runStartedAt: candidate.startedAt ?? null,
            runFinishedAt: candidate.finishedAt ?? null,
            schedulerLatencyMs: Number.isFinite(runStartedAtMs)
              ? Math.max(0, runStartedAtMs - submittedAtMs)
              : null,
            runDurationMs:
              Number.isFinite(runStartedAtMs) &&
              Number.isFinite(runFinishedAtMs)
                ? Math.max(0, runFinishedAtMs - runStartedAtMs)
                : null,
            responseLatencyMs: Number.isFinite(runFinishedAtMs)
              ? Math.max(0, runFinishedAtMs - submittedAtMs)
              : null,
            runId: candidate.id,
            leaseAcquisitionOutcome:
              acquisitionOutcome === "created" ||
              acquisitionOutcome === "resumed" ||
              acquisitionOutcome === "replacement"
                ? acquisitionOutcome
                : "unknown",
          };
        });
      }
      if (execution.suite.id === "daytona-warm-continuity") {
        const evidence = await warmManagedFileEvidence(api, fixtures.agent.id, selectedRuns.at(-1)!.id, 3, nonce, execution.profile.generation === "native");
        await writeSanitizedJson(snapshotsDir, "managed-warm-turn-3.json", evidence, secrets);
        expect(evidence.passed, JSON.stringify(evidence.checks)).toBe(true);
      }
      const finalRun = selectedRuns.at(-1)!;
      const run =
        selectedRuns.find(
          (candidate) => candidate.id === issue!.executionRunId,
        ) ?? selectedRuns[0];
      const [
        persistedAgentValue,
        persistedEnvironmentValue,
        runLogs,
        runEventsByRun,
      ] = await Promise.all([
        api.get<unknown>(`/api/agents/${fixtures.agent.id}`),
        api.get<unknown>(`/api/environments/${fixtures.environment.id}`),
        Promise.all(
          selectedRuns.map(async (candidate) => ({
            runId: candidate.id,
            log: await api
              .get<unknown>(
                `/api/heartbeat-runs/${candidate.id}/log?limitBytes=1048576`,
              )
              .catch((error) => ({
                evidenceCaptureError:
                  error instanceof Error ? error.message : String(error),
              })),
          })),
        ),
        Promise.all(
          selectedRuns.map(async (candidate) => {
            try {
              return {
                runId: candidate.id,
                events: await collectRunEvents<RunEventRecord>((afterSeq, limit) =>
                  api.get(`/api/heartbeat-runs/${candidate.id}/events?afterSeq=${afterSeq}&limit=${limit}`),
                ),
                error: null,
              };
            } catch (error) {
              return {
                runId: candidate.id,
                events: [] as RunEventRecord[],
                error: error instanceof Error ? error.message : String(error),
              };
            }
          }),
        ),
      ]);
      const runLog =
        runLogs.find((candidate) => candidate.runId === run.id)?.log ?? {};
      const persistedAgent = record(persistedAgentValue);
      const persistedEnvironment = record(persistedEnvironmentValue);
      const agentComments = terminal.comments.filter(
        (comment) =>
          comment.authorAgentId === fixtures!.agent.id ||
          selectedRuns.some(
            (candidate) => comment.createdByRunId === candidate.id,
          ),
      );
      // Message matchers intentionally use persisted agent comments only.
      // A semantic finish summary can differ from the actual user-facing text;
      // accepting it here would let backend metadata mask a truncated UI
      // response. The browser assertion below remains the visible source of
      // truth after the comment projection has settled.
      const message = agentComments
        .map((comment) => comment.body ?? "")
        .join("\n");
      const finalRunMessage = persistedFinalRunMessage(agentComments, finalRun);
      const pendingInteractions = terminal.interactions.filter(
        (interaction) => interaction.status === "pending",
      );
      const invariantFailures: string[] = reasoningProjectionFailures(
        runEventsByRun.flatMap((entry) => entry.events),
      );
      if (pendingInteractions.length > 0)
        invariantFailures.push(
          `expected no unresolved interaction; observed ${pendingInteractions.length}`,
        );
      if (expectedQuestionResolution) {
        const questionInteractions = terminal.interactions.filter(
          (interaction) => interaction.kind === "ask_user_questions",
        );
        if (
          questionInteractions.length !== 1 ||
          questionInteractions[0]?.id !==
            expectedQuestionResolution.interactionId
        ) {
          invariantFailures.push(
            `expected exactly one stable question interaction ${expectedQuestionResolution.interactionId}; observed ${JSON.stringify(questionInteractions)}`,
          );
        }
        const resolvedQuestion = questionInteractions.find(
          (interaction) =>
            interaction.id === expectedQuestionResolution.interactionId,
        );
        const answers = resolvedQuestion?.result?.answers ?? [];
        if (
          resolvedQuestion?.status !== "answered" ||
          resolvedQuestion.result?.version !== 1 ||
          answers.length !== 1 ||
          answers[0]?.questionId !== "verification-word" ||
          JSON.stringify(answers[0]?.optionIds) !==
            JSON.stringify([expectedQuestionResolution.optionId]) ||
          answers[0]?.otherText !== undefined
        ) {
          invariantFailures.push(
            `expected interaction ${expectedQuestionResolution.interactionId} to resolve with exactly ${expectedQuestionResolution.optionId}; observed ${JSON.stringify(resolvedQuestion)}`,
          );
        }
        const continuationRun = selectedRuns.at(-1);
        const continuationContext = record(continuationRun?.contextSnapshot);
        if (
          !continuationRun ||
          continuationContext.interactionId !==
            expectedQuestionResolution.interactionId
        ) {
          invariantFailures.push(
            `expected the continuation run to consume interaction ${expectedQuestionResolution.interactionId}; observed ${String(continuationContext.interactionId)}`,
          );
        }
        if (execution.profile.generation === "native" && continuationRun) {
          const runnerProfile = record(continuationRun.runnerProfileJson);
          const nativeExecutionInput = record(
            runnerProfile.nativeExecutionInput,
          );
          const interactionResponses = Array.isArray(
            nativeExecutionInput.interactionResponses,
          )
            ? nativeExecutionInput.interactionResponses.map(record)
            : [];
          const matchingResponses = interactionResponses.filter(
            (candidate) =>
              candidate.interactionId ===
              expectedQuestionResolution.interactionId,
          );
          const responseEnvelope = matchingResponses[0];
          const response = record(responseEnvelope?.response);
          const responseResult = record(response.result);
          const responseAnswers = Array.isArray(responseResult.answers)
            ? responseResult.answers.map(record)
            : [];
          if (
            matchingResponses.length !== 1 ||
            responseEnvelope?.kind !== "ask_user_questions" ||
            response.status !== "answered" ||
            responseResult.version !== 1 ||
            responseAnswers.length !== 1 ||
            responseAnswers[0]?.questionId !== "verification-word" ||
            JSON.stringify(responseAnswers[0]?.optionIds) !==
              JSON.stringify([expectedQuestionResolution.optionId])
          ) {
            invariantFailures.push(
              `expected native continuation input to carry exactly one answered interaction ${expectedQuestionResolution.interactionId}; observed ${JSON.stringify(matchingResponses)}`,
            );
          }
        }
        questionLifecycleEvidence = {
          ...(questionLifecycleEvidence ?? {}),
          resolvedInteraction: resolvedQuestion ?? null,
          continuationRunId: continuationRun?.id ?? null,
        };
      }
      for (const candidate of selectedRuns) {
        if (
          (candidate.continuationAttempt ?? 0) !== 0 ||
          candidate.retryOfRunId
        )
          invariantFailures.push(
            `expected run ${candidate.id} without a recovery continuation`,
          );
      }
      for (const captured of runEventsByRun) {
        if (captured.error) {
          invariantFailures.push(
            `run ${captured.runId} events query failed: ${captured.error}`,
          );
        }
      }

      if (execution.suite.id === CODEX_PLANNING_READ_ONLY_SUITE) {
        const refusal = gradePlanningWriteRefusal(runEventsByRun.flatMap(captured => captured.events), nonce);
        if (refusal.attempts.some(attempt => attempt.succeeded)) invariantFailures.push(`Planning write refusal was not proven: ${refusal.failure}`);
      }
      if (execution.suite.id === "api-response-reading") {
        const paging = gradeApiResponsePaging(runEventsByRun.flatMap(captured => captured.events), apiResponseSourceId ?? "");
        await writeSanitizedJson(snapshotsDir, "api-response-pagination.json", paging, secrets);
        if (!paging.passed) invariantFailures.push(`Bounded response paging was not proven: ${paging.failure}`);
      }
      if (piFileSeed) {
        const proof = await collectPiFileEvidence({ page, api, nonce, companyId: fixtures.company.id,
          issueId: issue.id, agentId: fixtures.agent.id, run: finalRun,
          events: runEventsByRun.find(entry => entry.runId === finalRun.id)?.events ?? [],
          seed: piFileSeed, workspace: workspacePath,
          environment: execution.environment.id === "daytona" ? "daytona" : "local", environmentId: fixtures.environment.id,
          evidence: data => writeSanitizedJson(snapshotsDir, "pi-file-observation.json", data, secrets) });
        await writeSanitizedJson(snapshotsDir, "pi-file-evidence.json", proof, secrets);
      }
      if (execution.suite.id === "task-titles") {
        const titleEvidence = gradeTaskTitle({
          initial: titleCreation?.issue, submitted: titleCreation?.submitted,
          final: issue, prompt, explicitTitle: title, agentId: fixtures.agent.id,
          runId: selectedRuns[0]!.id,
          events: runEventsByRun.find(captured => captured.runId === selectedRuns[0]!.id)?.events ?? [],
          activity: await api.get<unknown[]>(`/api/issues/${issue.id}/activity`),
        });
        await writeSanitizedJson(snapshotsDir, "task-title.json", titleEvidence, secrets);
        invariantFailures.push(...titleEvidence.checks.filter(check => !check.passed).map(check => `${check.id}: ${check.detail}`));
      }

      const context = record(run.contextSnapshot);
      const environmentContext = record(context.paperclipEnvironment);
      const workspaceContext = record(context.paperclipWorkspace);
      const environmentDriver =
        environmentContext.driver ?? persistedEnvironment.driver;
      const observedEnvironment =
        environmentDriver === "sandbox" ? "daytona" : environmentDriver;
      const observedRuntimeMode =
        run.runtimeMode ??
        (persistedAgent.adapterType === "paperclip_runner"
          ? "native"
          : "legacy");
      const matcherObservation = {
        message,
        issueStatus: issue.status,
        runStatus: selectedRuns.every(
          (candidate) =>
            candidate.status === execution.task.expectedTerminalState.run,
        )
          ? execution.task.expectedTerminalState.run
          : selectedRuns.map((candidate) => candidate.status).join(","),
        runtimeMode: observedRuntimeMode,
        environment:
          typeof observedEnvironment === "string"
            ? observedEnvironment
            : undefined,
        json: {
          issue,
          run,
          comments: terminal.comments,
          interactions: terminal.interactions,
        },
      };
      const fileObservations = Object.fromEntries(
        await Promise.all(
          taskMatchers
            .filter(
              (matcher) =>
                matcher.kind === "file_exists" ||
                matcher.kind === "file_exact" ||
                matcher.kind === "file_contains",
            )
            .map(async (matcher) => [
              matcher.path,
              await readFile(
                path.isAbsolute(matcher.path)
                  ? matcher.path
                  : path.join(workspacePath, matcher.path),
                "utf8",
              ).catch(() => undefined),
            ]),
        ),
      );
      if (usesApiResponseProof(execution.suite.id)) {
        downloadedResponseProof = await readResponseProof(api, issue.id, run.id);
        fileObservations["api-response-proof.txt"] = downloadedResponseProof.content;
        if (execution.suite.id === "api-artifact-transfer") {
          const transferIdentity = { companyId: fixtures.company.id, runId: run.id, agentId: fixtures.agent.id };
          const transfer = gradeApiArtifactTransfer(runEventsByRun.flatMap(captured => captured.events),
            apiResponseSourceId ?? "", downloadedResponseProof, artifactTransferDescription(nonce),
            await readArtifactTransferSource(api, runEventsByRun.flatMap(captured => captured.events), transferIdentity), transferIdentity);
          await writeSanitizedJson(snapshotsDir, "api-artifact-transfer.json", transfer, secrets);
          if (!transfer.passed) invariantFailures.push(`Verified artifact transfer was not proven: ${transfer.failure}`);
          await writeSanitizedJson(snapshotsDir, "downloaded-response-proof.json", {
            attachmentId: downloadedResponseProof.attachmentId, sha256: downloadedResponseProof.sha256,
            byteSize: Buffer.byteLength(downloadedResponseProof.content),
          }, secrets);
        } else {
          await writeSanitizedJson(snapshotsDir, "downloaded-response-proof.json", downloadedResponseProof, secrets);
        }
      }
      if (cursorCloudObserver) {
        const revisedInteraction = record(planLifecycleEvidence?.revisedInteraction);
        const checks = execution.task.flow === "plan_revision_acceptance"
          ? await cursorCloudObserver.assertPlanTransitions(selectedRuns.map(run => run.id), typeof revisedInteraction.id === "string" ? revisedInteraction.id : null)
          : await cursorCloudObserver.assertContinuity(execution.task.expectedRunCount);
        await writeSanitizedJson(snapshotsDir, "cursor-cloud-provider-continuity.json", { identities: [...cursorCloudObserver.identities.values()].map(cursorCloudIdentityProof), checks }, secrets);
        matcherResults.push(...checks.map(check => ({ matcher: { kind: "json_path" as const, path: `cursorCloud.${check.id}`, expected: true }, passed: check.passed, detail: check.detail })));
      }
      const registeredArtifacts = await readRegisteredArtifacts(api, issue.id, run.id,
        taskMatchers.filter(matcher => matcher.kind === "artifact_exact").map(matcher => matcher.name));
      if (registeredArtifacts.length > 0) {
        await writeSanitizedJson(snapshotsDir, "downloaded-registered-artifacts.json", registeredArtifacts, secrets);
      }
      matcherResults.push(...await Promise.all(
        taskMatchers.map((matcher) =>
          evaluateMatcher(matcher, {
            ...matcherObservation,
            files: fileObservations,
            artifacts: registeredArtifacts,
            // Multi-run tasks intentionally retain earlier waiting/revision
            // replies. Exact completion text belongs to the chronological
            // final run, while occurrence checks still span every agent
            // comment so duplicate terminal markers cannot be hidden.
            message:
              matcher.kind === "message_exact" ? finalRunMessage : message,
          }),
        ),
      ));
      const failedMatchers = matcherResults.filter((result) => !result.passed);
      const exactMessageMatcher = taskMatchers.find(
        (matcher) => matcher.kind === "message_exact",
      );
      if (
        execution.profile.id === "runner-opencode" &&
        execution.task.id === "structured-question-restart-resume" &&
        exactMessageMatcher?.kind === "message_exact" &&
        finalRunMessage === exactMessageMatcher.expected.replace(/-\d+$/, "") &&
        record(finalRun.resultJson).summary === exactMessageMatcher.expected
      ) {
        // OpenCode can occasionally copy the complete marker into the
        // accepted semantic result while dropping only the synthetic attempt
        // suffix from its visible answer. Keep exact matching strict, but let
        // the campaign retry this narrowly proven provider variance once in a
        // fresh harness. A repeated near miss remains a failed cell.
        failureClassOverride = "provider_variance";
      }
      const retryInteractiveTerminalProviderVariance =
        (execution.suite.id === "openrouter-model-breadth" &&
          (execution.task.id === "question-resume-complete" ||
            execution.task.id === "plan-approve-complete")) ||
        (execution.suite.id === "core-compatibility" &&
          execution.profile.generation === "native" &&
          execution.task.id === "plan-revise-accept");
      if (
        retryInteractiveTerminalProviderVariance &&
        exactMessageMatcher?.kind === "message_exact" &&
        selectedRuns.every((candidate) => candidate.status === "succeeded") &&
        issue.status === "done" &&
        finalRunMessage !== exactMessageMatcher.expected &&
        record(finalRun.resultJson).summary === exactMessageMatcher.expected
      ) {
        // An interactive breadth model can occasionally satisfy the durable
        // terminal contract while paraphrasing the visible final response.
        // Preserve the exact persisted-message and DOM assertions, but
        // classify this narrowly proven provider variance for one
        // fresh-harness retry.
        failureClassOverride = "provider_variance";
      }
      const observedEnvironmentId =
        environmentContext.id ??
        (execution.environment.id === "local"
          ? persistedAgent.defaultEnvironmentId
          : undefined);
      if (observedEnvironmentId !== fixtures.environment.id) {
        invariantFailures.push(
          `Expected environment ${fixtures.environment.id}; observed ${String(observedEnvironmentId)}`,
        );
      }
      if (
        execution.environment.id === "daytona" &&
        typeof environmentContext.leaseId !== "string"
      ) {
        invariantFailures.push(
          "expected a Daytona sandbox lease on the run context",
        );
      }
      if (execution.task.flow === "warm_three_turn") {
        const runEnvironmentContexts = selectedRuns.map((candidate) =>
          record(record(candidate.contextSnapshot).paperclipEnvironment),
        );
        const leaseIds = runEnvironmentContexts.map((entry) => entry.leaseId);
        const acquisitionOutcomes = runEnvironmentContexts.map(
          (entry) => record(entry.sandboxLeaseAcquisition).outcome,
        );
        const projectWorkspaceIds = selectedRuns.map(
          (candidate) =>
            record(record(candidate.contextSnapshot).paperclipWorkspace)
              .workspaceId,
        );
        const executionWorkspaceIds = selectedRuns.map(
          (candidate) => record(candidate.contextSnapshot).executionWorkspaceId,
        );
        if (execution.environment.id === "daytona") {
          if (
            leaseIds.some(
              (leaseId) => typeof leaseId !== "string" || leaseId.length === 0,
            )
          ) {
            invariantFailures.push(
              `expected a persisted Daytona lease row for every warm turn; observed ${JSON.stringify(leaseIds)}`,
            );
          }
          if (
            JSON.stringify(acquisitionOutcomes) !==
            JSON.stringify(["created", "resumed", "resumed"])
          ) {
            invariantFailures.push(
              `expected warm lease outcomes created,resumed,resumed; observed ${JSON.stringify(acquisitionOutcomes)}`,
            );
          }
        }
        if (
          !fixtures.project?.primaryWorkspace?.id ||
          projectWorkspaceIds.some(
            (workspaceId) =>
              workspaceId !== fixtures!.project!.primaryWorkspace!.id,
          ) ||
          new Set(executionWorkspaceIds).size !== 1 ||
          executionWorkspaceIds[0] !== issue.executionWorkspaceId ||
          issue.projectId !== fixtures.project.id ||
          issue.projectWorkspaceId !== fixtures.project.primaryWorkspace.id ||
          !issue.executionWorkspaceId
        ) {
          invariantFailures.push(
            `warm task did not preserve project, project-workspace, and execution-workspace identity: ${JSON.stringify({ projectWorkspaceIds, executionWorkspaceIds, projectId: issue.projectId, projectWorkspaceId: issue.projectWorkspaceId, executionWorkspaceId: issue.executionWorkspaceId })}`,
          );
        }
        if (execution.profile.generation === "native") {
          const stableIdentityFields: Array<{
            label: string;
            values: unknown[];
          }> = [
            {
              label: "native session",
              values: selectedRuns.map(
                (candidate) => candidate.nativeSessionId,
              ),
            },
            {
              label: "runner instance",
              values: selectedRuns.map(
                (candidate) => candidate.runnerInstanceId,
              ),
            },
            {
              label: "provider session",
              values: selectedRuns.map((candidate) => candidate.sessionIdAfter),
            },
            {
              label: "runner pid",
              values: selectedRuns.map((candidate) => candidate.processPid),
            },
            {
              label: "runner process fingerprint",
              values: selectedRuns.map(
                (candidate) => candidate.processStartedAt,
              ),
            },
          ];
          for (const { label, values } of stableIdentityFields) {
            if (
              values.some(
                (value) =>
                  value === null ||
                  value === undefined ||
                  String(value).length === 0,
              ) ||
              new Set(values).size !== 1
            ) {
              invariantFailures.push(
                `expected one stable ${label} across native warm turns; observed ${JSON.stringify(values)}`,
              );
            }
          }
        }
        if (
          turnTimings?.length !== 3 ||
          turnTimings.some(
            (timing) =>
              timing.runStartedAt === null ||
              timing.runFinishedAt === null ||
              timing.schedulerLatencyMs === null ||
              timing.runDurationMs === null ||
              timing.responseLatencyMs === null ||
              timing.responseLatencyMs >
                (execution.task.turnTimeoutMs ?? 10 * 60_000),
          )
        ) {
          invariantFailures.push(
            `warm turn timing data was incomplete or exceeded its structural deadline: ${JSON.stringify(turnTimings)}`,
          );
        }
        let warmLeases: EnvironmentLeaseRecord[] = [];
        let providerLeaseIds: Array<string | null | undefined> = [];
        let resumedFromStates: unknown[] = [];
        if (execution.environment.id === "daytona") {
          const retainedLeases = await pollUntil({
            label: `terminal warm Daytona lease history for issue ${issue.id}`,
            deadlineAt: Math.min(deadlineAt, Date.now() + 30_000),
            intervalMs: 500,
            load: () =>
              api.get<EnvironmentLeaseRecord[]>(
                `/api/environments/${fixtures!.environment.id}/leases`,
              ),
            accept: (leases) => {
              const warmLeases = leases.filter(
                (lease) =>
                  lease.issueId === issue!.id &&
                  selectedRuns.some(
                    (candidate) => candidate.id === lease.heartbeatRunId,
                  ),
              );
              return (
                warmLeases.length === 3 &&
                warmLeases.every((lease) => {
                  const runIndex = selectedRuns.findIndex(
                    (candidate) => candidate.id === lease.heartbeatRunId,
                  );
                  return (
                    lease.status ===
                      (runIndex === selectedRuns.length - 1
                        ? "retained"
                        : "expired") &&
                    lease.cleanupStatus === "success" &&
                    lease.leasePolicy === "reuse_by_environment" &&
                    typeof lease.providerLeaseId === "string" &&
                    record(lease.metadata).sandboxState === "started"
                  );
                })
              );
            },
          });
          const selectedRunOrder = new Map(
            selectedRuns.map((candidate, index) => [candidate.id, index]),
          );
          warmLeases = retainedLeases
            .filter(
              (lease) =>
                lease.issueId === issue!.id &&
                selectedRunOrder.has(lease.heartbeatRunId ?? ""),
            )
            .sort(
              (left, right) =>
                (selectedRunOrder.get(left.heartbeatRunId ?? "") ?? 0) -
                (selectedRunOrder.get(right.heartbeatRunId ?? "") ?? 0),
            );
          providerLeaseIds = warmLeases.map(
            (lease) => lease.providerLeaseId,
          );
          resumedFromStates = warmLeases
            .slice(1)
            .map((lease) => record(lease.metadata).resumedFromState);
          if (
            new Set(providerLeaseIds).size !== 1 ||
            typeof providerLeaseIds[0] !== "string" ||
            JSON.stringify(resumedFromStates) !==
              JSON.stringify(["started", "started"])
          ) {
            invariantFailures.push(
              `expected one continuously-started Daytona sandbox; observed ${JSON.stringify({ providerLeaseIds, resumedFromStates })}`,
            );
          }
        }
        warmLifecycleEvidence = {
          ...(warmLifecycleEvidence ?? {}),
          leaseIds,
          acquisitionOutcomes,
          projectWorkspaceIds,
          executionWorkspaceIds,
          providerLeaseIds,
          resumedFromStates,
          retainedLeases: warmLeases,
          turnTimings,
        };
      }
      if (execution.environment.id === "local") {
        const runLogContent = String(record(runLog).content ?? "");
        // The log endpoint returns NDJSON, so quotes inside each `chunk` are
        // escaped. Accept both that wire representation and a decoded chunk.
        const fallbackWorkspace =
          /Using fallback workspace \\\"([^"\\]+)\\\"/.exec(
            runLogContent,
          )?.[1] ??
          /Using fallback workspace "([^"]+)"/.exec(runLogContent)?.[1];
        const cwd = String(workspaceContext.cwd ?? fallbackWorkspace ?? "");
        if (!cwd.startsWith(`${temporaryRoot}/`)) {
          invariantFailures.push(
            `local run workspace escaped the isolated root: ${cwd}`,
          );
        }
      }
      const runEvents =
        runEventsByRun.find((candidate) => candidate.runId === run.id)
          ?.events ?? [];
      if (execution.profile.generation === "native") {
        for (const candidate of selectedRuns) {
          const candidateEvents =
            runEventsByRun.find((captured) => captured.runId === candidate.id)
              ?.events ?? [];
          const runnerInstanceObserved =
            Boolean(candidate.runnerInstanceId) ||
            candidateEvents.some(
              (event) =>
                typeof event.sourceInstanceId === "string" &&
                event.sourceInstanceId.length > 0 &&
                !event.sourceInstanceId.endsWith(":control"),
            );
          if (!runnerInstanceObserved) {
            invariantFailures.push(
              `expected native run ${candidate.id} events from a runner instance`,
            );
          }
          invariantFailures.push(
            ...nativeRunEventIntegrityFailures(candidate, candidateEvents),
          );
        }
        if (
          (execution.profile.provider === "codex" ||
            execution.profile.provider === "opencode") &&
          selectedRuns.length > 1
        ) {
          invariantFailures.push(
            ...providerSessionContinuityFailures(
              execution.profile.provider,
              selectedRuns,
            ),
          );
        } else if (
          execution.profile.provider === "acpx" &&
          selectedRuns.length > 1
        ) {
          for (let index = 1; index < selectedRuns.length; index += 1) {
            const previousSessionId = selectedRuns[index - 1]?.sessionIdAfter;
            const current = selectedRuns[index]!;
            const currentSessionId = current.sessionIdAfter;
            if (!previousSessionId || !currentSessionId) {
              invariantFailures.push(
                "expected ACPX to record provider session identity across all heartbeat runs",
              );
              continue;
            }
            const acceptedPlanResetFailures = acceptedPlanSessionResetFailures(
              "acpx",
              previousSessionId,
              current,
            );
            if (acceptedPlanResetFailures) {
              invariantFailures.push(...acceptedPlanResetFailures);
              continue;
            }
            if (previousSessionId === currentSessionId) continue;
            const currentEvents =
              runEventsByRun.find((captured) => captured.runId === current.id)
                ?.events ?? [];
            const recordedContinuityBreak = currentEvents.some((event) => {
              const payload = record(event.payload);
              return (
                event.eventType === "run.performance.span" &&
                payload.span === "provider.session.continuity_break" &&
                payload.previousProviderSessionId === previousSessionId &&
                payload.replacementProviderSessionId === currentSessionId
              );
            });
            if (!recordedContinuityBreak) {
              invariantFailures.push(
                `ACPX provider session changed from ${previousSessionId} to ${currentSessionId} without a matching continuity event`,
              );
            }
          }
        }
        const spanPayloads = runEvents
          .filter((event) => event.eventType === "run.performance.span")
          .map((event) => record(event.payload));
        const selectedTransport = spanPayloads.find(
          (payload) => payload.span === "runner.transport.selected",
        );
        const expectedTransport =
          execution.environment.id === "daytona"
            ? "provider_ingress"
            : "local_loopback";
        if (selectedTransport?.mode !== expectedTransport) {
          invariantFailures.push(
            `Expected native runner transport ${expectedTransport}; observed ${String(selectedTransport?.mode)}`,
          );
        }
        if (execution.environment.id === "daytona") {
          const authenticated = spanPayloads.some(
            (event) =>
              event.span === "runner.prp.authenticate" &&
              event.outcome === "ok",
          );
          if (!authenticated) {
            invariantFailures.push(
              "expected authenticated native Daytona runner preview ingress",
            );
          }
        }
      } else {
        for (const candidate of selectedRuns) {
          const candidateEvents =
            runEventsByRun.find((captured) => captured.runId === candidate.id)
              ?.events ?? [];
          if (
            candidate.runtimeMode !== "legacy" ||
            candidate.runnerInstanceId ||
            candidateEvents.some(
              (event) =>
                Object.keys(record(event.payload?.prpEvent)).length > 0,
            )
          ) {
            invariantFailures.push(
              `legacy run ${candidate.id} crossed into native runner persistence`,
            );
          }
        }
      }

      startupReuse = runEventsByRun.map(captured => ({ runId: captured.runId,
        ...summarizeStartupReuse(captured.error ? [] : captured.events) }));
      await writeSanitizedJson(snapshotsDir, "startup-reuse.json", startupReuse, secrets);
      await writeSanitizedJson(
        snapshotsDir,
        "api-state.json",
        {
          issue,
          run,
          runs: selectedRuns,
          comments: terminal.comments,
          interactions: terminal.interactions,
          planLifecycleEvidence,
          questionLifecycleEvidence,
          warmLifecycleEvidence,
          matcherResults,
          invariantFailures,
          runEvents,
          runEventsByRun,
          runLogs,
        },
        secrets,
      );

      if (
        exactMessageMatcher?.kind === "message_exact" &&
        isOpenRouterDeepSeekHelloTerminalVariance({
          suiteId: execution.suite.id,
          profileId: execution.profile.id,
          taskId: execution.task.id,
          expectedMarker: exactMessageMatcher.expected,
          finalRunMessage,
          allAgentMessages: message,
          semanticSummary: record(finalRun.resultJson).summary,
          issueStatus: issue.status,
          runStatuses: selectedRuns.map((candidate) => candidate.status),
          matcherResults,
          invariantFailures,
        })
      ) {
        // DeepSeek can occasionally complete the semantic finish correctly but
        // expose its pre-tool acknowledgement as the visible final answer. Keep
        // exact persisted-message, global occurrence, and DOM checks strict,
        // while allowing one fresh-harness retry only for the zero-marker form.
        failureClassOverride = "provider_variance";
      }

      // The backend polling above can observe a terminal transition before a
      // websocket invalidation reaches the already-open task page. Reload the
      // canonical task route so the screenshot and UI assertions prove the
      // persisted final state, not a stale client cache.
      await page.goto(
        `/${encodeURIComponent(issuePrefix)}/issues/${encodeURIComponent(issue.identifier ?? issue.id)}`,
        { waitUntil: "domcontentloaded" },
      );
      const visibleAgentReplies = page
        .getByTestId("task-chat-thread")
        .getByTestId("task-chat-agent-bubble");
      if (execution.suite.id === "task-titles") {
        await expect(page.getByRole("heading", { name: issue.title.trim(), exact: true })).toBeVisible();
      }
      if (usesApiResponseProof(execution.suite.id)) {
        // File delivery renders a card instead of an exact summary bubble.
        // Prove the visible link points to the same independently checked bytes.
        const proofLink = page.getByRole("link", { name: "Open api-response-proof.txt", exact: true }).first();
        await expect(proofLink).toBeVisible({ timeout: 30_000 });
        await expect(proofLink).toHaveAttribute("href", `/api/attachments/${downloadedResponseProof!.attachmentId}/content`);
      } else if (execution.suite.id === "task-titles") {
        await expect(visibleAgentReplies.filter({ hasText: marker }).last()).toBeVisible({ timeout: 30_000 });
      } else if (["native-completion", NATIVE_INSTRUCTION_SUITE].includes(execution.suite.id) && execution.task.id === "native-blocked-report") {
        await assertNativeBlockerReply(visibleAgentReplies, marker);
      } else if (execution.task.flow === "warm_three_turn") {
        // Prove the persisted user-facing response is visible, independently
        // of the byte-for-byte workspace checks and lease continuity checks.
        expect(finalRunMessage.trim()).not.toBe("");
        await expect(visibleAgentReplies.filter({ hasText: finalRunMessage }).last())
          .toBeVisible({ timeout: 30_000 });
      } else {
        const escapedMarker = marker.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
        const terminalAgentReplies = visibleAgentReplies.filter({
          hasText: new RegExp(`^\\s*${escapedMarker}\\s*$`),
        });
        await expect(terminalAgentReplies).toHaveCount(1, { timeout: 30_000 });
        await expect(terminalAgentReplies.first()).toBeVisible();
        // A string-valued toHaveText assertion compares the complete rendered
        // text while normalizing ordinary DOM whitespace. This keeps Markdown
        // layout differences harmless without allowing prefixed, suffixed, or
        // substituted provider prose to masquerade as the requested response.
        await expect(terminalAgentReplies.first()).toHaveText(marker, {
          useInnerText: true,
        });
      }
      // The fixture owns the expected disposition; blocked workflows must prove
      // their Blocked UI rather than inheriting the completion-only Done check.
      const expectedStatus = execution.task.expectedTerminalState.issue;
      const expectedStatusLabel = expectedStatus.replace(/_/g, " ").replace(/\b\w/g, (letter) => letter.toUpperCase());
      await expect(
        page.getByTestId("issue-detail-header").getByRole("button", {
          // Blocked includes the live blocker-attention explanation in its
          // accessible name. The exact persisted status is asserted separately.
          name: `Change status (current: ${expectedStatusLabel}${expectedStatus === "blocked" ? "" : ")"}`,
          exact: expectedStatus !== "blocked",
        }),
      ).toBeVisible({ timeout: 30_000 });
      if (execution.task.flow === "warm_three_turn") {
        const continuedReceipts = page
          .getByTestId("task-chat-interaction-receipt")
          .filter({ hasText: "Selected “Continue work”" });
        await expect(continuedReceipts).toHaveCount(2, { timeout: 30_000 });
        await expect(
          page.getByText("Declined request", { exact: true }),
        ).toHaveCount(0);
      }
      await captureScreenshot(
        "final-state",
        "Final visible task state",
        "final-state.png",
      );

      if (failedMatchers.length > 0) {
        throw new Error(
          `Matcher failure: ${failedMatchers.map((result) => result.detail).join("; ")}; run error: ${run.errorCode ?? "none"} ${run.error ?? "none"}`,
        );
      }
      if (invariantFailures.length > 0) {
        throw new Error(
          `Runtime invariant failure: ${invariantFailures.join("; ")}`,
        );
      }
      }
      if (["native-completion", NATIVE_INSTRUCTION_SUITE].includes(execution.suite.id)) {
        if (!issue || !nativeInitial) throw new Error("Missing native qualification issue or pre-execution receipt");
        const [currentIssue, companyRuns, issues, agents, comments, documents, interactions, workspaceDigest] = await Promise.all([
          api.get<IssueRecord>(`/api/issues/${issue.id}`),
          api.get<RunRecord[]>(`/api/companies/${fixtures.company.id}/heartbeat-runs?limit=100`),
          api.get<Array<{ id: string }>>(`/api/companies/${fixtures.company.id}/issues?limit=100`),
          api.get<Array<{ id: string }>>(`/api/companies/${fixtures.company.id}/agents`),
          api.get<CommentRecord[]>(`/api/issues/${issue.id}/comments`),
          api.get<IssueDocumentRecord[]>(`/api/issues/${issue.id}/documents`),
          api.get<InteractionRecord[]>(`/api/issues/${issue.id}/interactions`), nativeWorkspaceDigest(),
        ]);
        const detailedRuns = await Promise.all(companyRuns.map(candidate => api.get<RunRecord>(`/api/heartbeat-runs/${candidate.id}`)));
        selectedRuns = detailedRuns; issue = currentIssue;
        const events = detailedRuns.length === 1 ? await collectRunEvents<RunEventRecord>((afterSeq, limit) => api.get(`/api/heartbeat-runs/${detailedRuns[0]!.id}/events?afterSeq=${afterSeq}&limit=${limit}`)) : [];
        const observation = { caseId: execution.task.id as "assigned-skill-explicit-invocation" | "native-blocked-report",
          companyId: fixtures.company.id, agentId: fixtures.agent.id, issue: currentIssue as unknown as Record<string, unknown>,
          runs: detailedRuns as unknown as Record<string, unknown>[], comments: comments as unknown as Record<string, unknown>[], events: events as unknown as Record<string, unknown>[],
          initial: nativeInitial, state: { issueIds: issues.map(value => value.id), agentIds: agents.map(value => value.id), documentCount: documents.length, interactionCount: interactions.length },
          workspaceChanged: workspaceDigest !== nativeInitial.workspaceDigest, marker,
          documentLinkContext: { appOrigin: new URL(page.url()).origin, issuePrefix: fixtures.company.issuePrefix ?? "",
            issueIdentifier: currentIssue.identifier ?? "", documents } };
        const grade = execution.suite.id === NATIVE_INSTRUCTION_SUITE
          ? gradeNativeCompletionFinalAnswer(observation) : gradeNativeCompletion(observation);
        const integrity = detailedRuns.flatMap(candidate => nativeRunEventIntegrityFailures(candidate, events));
        await writeSanitizedJson(snapshotsDir, "native-completion.json", { observation, grade, integrity }, secrets);
        matcherResults.push(...grade.checks.map(check => ({ matcher: { kind: "json_path" as const, path: `nativeCompletion.${check.id}`, expected: true }, passed: check.passed, detail: check.detail })));
        if (!grade.passed || integrity.length) throw new Error(`Native completion matcher failure: ${[...grade.checks.filter(check => !check.passed).map(check => check.id), ...integrity].join("; ")}`);
        if (execution.suite.id === NATIVE_INSTRUCTION_SUITE && execution.task.id === "assigned-skill-explicit-invocation") {
          const document = documents[0]!;
          const href = `/${encodeURIComponent(fixtures.company.issuePrefix!)}/issues/${encodeURIComponent(currentIssue.identifier!)}#document-${encodeURIComponent(document.key)}`;
          let opened = false;
          try {
            const link = page.getByTestId("task-chat-agent-bubble").locator(`a[href=${JSON.stringify(href)}]`).last();
            await expect(link).toBeVisible({ timeout: 30_000 });
            await link.click();
            await expect(page).toHaveURL(new URL(href, observation.documentLinkContext.appOrigin).href);
            const target = page.locator([
              `[id=${JSON.stringify(`document-${document.key}`)}]:visible`,
              `[id=${JSON.stringify(`side-panel-content-document:${document.key}`)}]:visible`,
            ].join(", "));
            await expect(target).toHaveCount(1);
            await expect(target).toBeVisible();
            await expect(target).toContainText(marker);
            opened = true;
            await captureScreenshot("document-final-link", "Final reply link opens the saved document", "document-final-link.png");
          } finally {
            matcherResults.push({ matcher: { kind: "json_path", path: "nativeCompletion.visible-document-navigation", expected: true }, passed: opened,
              detail: "The rendered final reply link opens this task's saved document and shows its original content marker." });
            await writeSanitizedJson(snapshotsDir, "native-document-navigation.json", { href, documentKey: document.key, revisionId: document.latestRevisionId, opened }, secrets);
          }
        }
      }
      if (runsCompletionUpdateProbe(execution) && credentials.OPENAI_API_KEY) {
        const qualification = completionQualityStatus(completionQuality);
        if (qualification === "unqualified") {
          failureClassOverride = "permanent_infrastructure";
          throw new Error("Completion accuracy is unqualified: missing, invalid, or miscalibrated judge evidence");
        }
        expect(qualification, "completion reply accuracy").toBe("passed");
      }
      }
    } catch (error) {
      primaryError = error;
      innerSecretFinding ||= classifyFailure(error) === "secret_leak";
      if (execution.task.flow === "first_task" && !firstTaskEvidence && classifyFailure(error) === "candidate_failure") {
        failureClassOverride = "permanent_infrastructure";
      }
      try {
        if (!(error instanceof SetupHealthAbort)) await captureApiState();
      } catch (captureError) {
        const failureClass = classifyFailure(captureError);
        if (failureClass === "secret_leak") {
          innerSecretFinding = true;
          failureClassOverride = "secret_leak";
          primaryError = new AggregateError(
            [primaryError, captureError],
            `Failure evidence contained unsafe data: ${captureError instanceof Error ? captureError.message : String(captureError)}`,
          );
        } else {
          networkDiagnostics.push({
            evidenceCaptureError:
              captureError instanceof Error
                ? captureError.message
                : String(captureError),
          });
        }
      }
      if (!(error instanceof SetupHealthAbort) && !page.isClosed()) {
        if (isReviewedFixtureScreenshotRoute()) {
          await captureScreenshot(
            "failure",
            "Task state at failure",
            "failure.png",
          ).catch(() => undefined);
        } else {
          await capturePrivateScreenshot("failure", "failure.png").catch(
            () => undefined,
          );
        }
      }
    } finally {
      const healthAbort = primaryError instanceof SetupHealthAbort;
      await workerTiming.enter("cleanup");
      trace?.phase("cleanup", Boolean(primaryError));
      await responseTiming?.stop();
      await reviewProvider?.close();
      try {
        await writeSanitizedJson(
          snapshotsDir,
          "browser-diagnostics.json",
          {
            console: consoleDiagnostics,
            network: networkDiagnostics,
            lifecycle: pageLifecycleDiagnostics,
            bootstrap: await browserBootstrap.snapshot(),
          },
          secrets,
        );
      } catch (error) {
        primaryError = new AggregateError(
          [primaryError, error].filter(Boolean),
          `Browser diagnostics contained unsafe data: ${error instanceof Error ? error.message : String(error)}`,
        );
        failureClassOverride = "secret_leak";
        innerSecretFinding = true;
      }
      browserBootstrap.dispose();
      if (healthAbort) { cleanup = "failed"; failureClassOverride = "cleanup_failure"; }
      if (fixtures && !healthAbort) {
        await captureRuntimeLeases().catch((error) => {
          networkDiagnostics.push({
            runtimeBillingCaptureError:
              error instanceof Error ? error.message : String(error),
          });
        });
        try {
          const verification = await runCleanupWithObservers({
            retireRuns: async () => {
              await cancelActiveRunsForCleanup();
              if (companyRunFlow) {
                const companyRuns = await api.get<RunRecord[]>(`/api/companies/${fixtures!.company.id}/heartbeat-runs?limit=100`);
                selectedRuns = await Promise.all(companyRuns.map(run => api.get<RunRecord>(`/api/heartbeat-runs/${run.id}`)));
                await writeSanitizedJson(snapshotsDir, execution.task.flow === "first_task" ? "first-task-final-run-ledger.json" : "chat-final-run-ledger.json", selectedRuns, secrets);
              }
              if (execution.suite.id === "stock-harness") {
                try {
                  const stock = await captureStockHarness({ api, companyId: fixtures!.company.id,
                    agentId: fixtures!.agent.id, generation: execution.profile.generation,
                    runIds: selectedRuns.map(run => run.id) });
                  const checks = gradeStockHarness(stock);
                  matcherResults.push(...checks.map(check => ({ matcher: { kind: "json_path" as const,
                    path: `stockHarness.${check.id}`, expected: true }, passed: check.passed, detail: check.detail })));
                  await writeSanitizedJson(snapshotsDir, "stock-harness.json", { ...stock, checks }, secrets);
                  const failures = checks.filter(check => !check.passed);
                  if (failures.length && !primaryError) primaryError = new Error(`Stock harness matcher failures: ${failures.map(check => check.id).join(", ")}`);
                } catch (error) {
                  await writeSanitizedJson(snapshotsDir, "stock-harness-evidence-error.json", {
                    error: error instanceof Error ? error.message : String(error),
                  }, secrets);
                  if (!primaryError) primaryError = error;
                }
              }
            },
            assertions: beforeEnvironmentTeardownAssertions,
            teardown: async () => {
              try {
                taskChat = await captureTaskChat({ get: route => api.get(route, { timeout: 5_000 }), companyId: fixtures!.company.id,
                  issueIds: [...new Set([issue?.id, ...selectedRuns.flatMap(run => [run.nativeIssueId,
                    run.contextSnapshot?.issueId as string | undefined])].filter((id): id is string => Boolean(id)))], secrets });
              } catch {
                // Supplemental evidence must never prevent owned fixture cleanup.
                taskChat = { schema: "paperclip.runner-e2e.task-chat/v1", capturedAt: new Date().toISOString(),
                  status: "unavailable", threads: [], missing: ["capture"] };
              }
              await workerTiming.enter("feedback");
              trace?.phase("feedback");
              try {
                feedback = await collectAttemptFeedback({ api, companyId: fixtures!.company.id,
                  onCheckpoint: summary => { feedback = summary; },
                  persist: async (evidence, signal) => {
                    await writeSanitizedJson(snapshotsDir, "agent-feedback.pending.json", evidence, secrets, signal);
                    signal.throwIfAborted();
                    await rename(path.join(snapshotsDir, "agent-feedback.pending.json"), path.join(snapshotsDir, "agent-feedback.json"));
                    signal.throwIfAborted();
                  },
                });
              } catch {
                feedback.collection = feedback.bodiesCollected ? "partial" : "unavailable";
                feedback.invocationCollection = "unavailable";
                networkDiagnostics.push({ feedbackCaptureError: "feedback_evidence_write_failed" });
              } finally {
                await workerTiming.enter("cleanup");
                trace?.phase("cleanup", !["complete", "not_started"].includes(feedback.collection));
                await fixtures!.teardown();
              }
            },
          });
          matcherResults.push(...verification.checks.map(check => ({
            matcher: { kind: "json_path" as const, path: `remoteCleanup.${check.id}`, expected: true }, passed: check.passed, detail: check.detail,
          })));
          if (verification.errors.length) throw new AggregateError(verification.errors, "Cleanup or remote retirement verification failed");
          cleanup = "passed";
        } catch (error) {
          cleanup = "failed";
          const priorFailureClass = primaryError
            ? classifyFailure(primaryError)
            : undefined;
          const cleanupFailureClass = classifyFailure(error);
          innerSecretFinding ||= priorFailureClass === "secret_leak" || cleanupFailureClass === "secret_leak";
          failureClassOverride =
            priorFailureClass === "secret_leak"
              ? priorFailureClass
              : cleanupFailureClass === "cleanup_failure"
                ? cleanupFailureClass
                : (priorFailureClass ?? cleanupFailureClass);
          primaryError = new AggregateError(
            [primaryError, error].filter(Boolean),
            primaryError
              ? `${primaryError instanceof Error ? primaryError.message : String(primaryError)}; Cleanup also failed: ${error instanceof Error ? error.message : String(error)}`
              : `Cleanup failed after test execution: ${error instanceof Error ? error.message : String(error)}`,
          );
        }
        if (runtimeLeases.length > 0) {
          runtimeLeases = await Promise.all(
            runtimeLeases.map((lease) =>
              api
                .get<EnvironmentLeaseRecord>(
                  `/api/environment-leases/${lease.id}`,
                )
                .catch(() => lease),
            ),
          );
        }
      } else {
        cleanup =
          primaryError &&
          /(?:cleanup|teardown) failed/i.test(
            primaryError instanceof Error
              ? primaryError.message
              : String(primaryError),
          )
            ? "failed"
            : "passed";
      }

      // Local fixture teardown does not retire the API server. These assertions
      // independently prove the recorded provider processes retired, while the
      // workspace still exists, before final grading. The outer supervisor
      // remains responsible for complete server/database cleanup.
      if (cleanupAssertions.length > 0) {
        const verification = await verifyCleanupAssertions(cleanupAssertions);
        matcherResults.push(...verification.checks.map(check => ({
          matcher: { kind: "json_path" as const, path: `cleanup.${check.id}`, expected: true },
          passed: check.passed, detail: check.detail,
        })));
        if (verification.errors.length > 0) {
          cleanup = "failed";
          primaryError = new AggregateError([primaryError, ...verification.errors].filter(Boolean), "Cleanup verification failed after provider settlement");
          if (failureClassOverride !== "secret_leak") failureClassOverride = "cleanup_failure";
        }
      }

      await workerTiming.enter("finalization");
      if (execution.suite.id === FEEDBACK_PERSISTENCE_SUITE) {
        let evidence: unknown;
        try { evidence = JSON.parse(await readFile(path.join(snapshotsDir, "agent-feedback.json"), "utf8")); } catch { evidence = undefined; }
        const checks = gradeFeedbackPersistence({ evidence, nonce, companyId: fixtures?.company.id,
          agentId: fixtures?.agent.id, taskId: issue?.id, runIds: selectedRuns.map(run => run.id) });
        matcherResults.push(...checks.map(check => ({ matcher: { kind: "json_path" as const,
          path: `feedbackPersistence.${check.id}`, expected: true }, passed: check.passed, detail: check.detail })));
        if (checks.some(check => !check.passed)) primaryError ??= new Error("Feedback persistence matcher failed");
      }

      let traceReceipt: Awaited<ReturnType<NonNullable<typeof trace>["export"]>> | undefined;
      try {
        traceReceipt = await trace?.export({ failed: Boolean(primaryError), runIds: selectedRuns.map(run => run.id),
          cleanup, complaints: feedback.complaints, suggestions: feedback.suggestions });
        await saveTrace();
      } catch (error) { primaryError ??= error; }
      const finishedAtMs = Date.now();
      const runtimeUsage = fixtureRuntimeCostCoverage(buildRuntimeUsage({
        environmentId: execution.environment.id,
        runs: selectedRuns,
        leases: runtimeLeases,
        fallbackFinishedAt: new Date(finishedAtMs),
      }), fixtures ?? {});
      const resultWithoutBilling: RunnerE2EResult = {
        schema: "paperclip.runner-e2e.result/v2",
        ...(process.env.PAPERCLIP_E2E_ACCOUNTING_CAMPAIGN_ID && process.env.PAPERCLIP_E2E_ACCOUNTING_ATTEMPT_ID ? {
          accountingIdentity: {
            campaignId: process.env.PAPERCLIP_E2E_ACCOUNTING_CAMPAIGN_ID,
            attemptId: process.env.PAPERCLIP_E2E_ACCOUNTING_ATTEMPT_ID,
          },
        } : {}),
        executionId: execution.id,
        suiteId: execution.suite.id,
        suiteDefinitionHash: execution.suiteDefinitionHash,
        source: resolveRunnerE2ESource(firstTaskEvidence?.source ? { ...firstTaskEvidence.source, workflowRunUrl: null } : undefined),
        ...(execution.profile.ranking
          ? { rankingSnapshot: execution.profile.ranking }
          : {}),
        attempt,
        status: primaryError ? "failed" : "passed",
        ...(primaryError
          ? {
              failureClass:
                failureClassOverride ?? classifyFailure(primaryError),
              error:
                primaryError instanceof Error
                  ? primaryError.message
                  : String(primaryError),
            }
          : {}),
        profileId: execution.profile.id,
        environmentId: execution.environment.id,
        caseId: execution.task.id,
        provider: execution.profile.provider,
        model: firstTaskEvidence ? firstTaskEvidence.observedModels[0] ?? firstTaskEvidence.configuredModel ?? "provider-default (unreported)" : execution.profile.model,
        ...(firstTaskEvidence ? { firstTask: firstTaskEvidence } : {}),
        ...(taskChat ? { taskChat } : {}),
        ...(completionQuality.length ? { completionQuality } : {}),
        ...(publicMcpUsage ? { publicMcp: publicMcpUsage } : {}),
        runtimeMode: execution.profile.expectedRuntimeMode,
        targetUrl: testInfo.project.use.baseURL,
        issueId: issue?.id,
        issueIdentifier: issue?.identifier ?? null,
        runIds: selectedRuns.map((run) => run.id),
        ...(turnTimings ? { turnTimings } : {}),
        ...(responseTiming ? { latencyProbes: responseTiming.results() } : {}),
        ...(startupReuse ? { startupReuse } : {}),
        startedAt,
        finishedAt: new Date(finishedAtMs).toISOString(),
        durationMs: finishedAtMs - startedAtMs,
        workerTiming: await workerTiming.finish(finishedAtMs),
        usage:
          selectedRuns.length === 1
            ? (selectedRuns[0]?.usageJson ?? null)
            : {
                runs: selectedRuns.map((candidate) => ({
                  runId: candidate.id,
                  usage: candidate.usageJson ?? null,
                })),
              },
        runtimeUsage,
        feedback,
        ...(traceReceipt ? { tracing: traceReceipt } : {}),
        matcherResults,
        screenshots,
        cleanup,
      };
      const result: RunnerE2EResult = withholdPrivateScreenshots({
        ...resultWithoutBilling,
        billing: summarizeExecutionBilling(resultWithoutBilling),
      }, { innerSecretFinding });
      if (firstTaskEvidence) {
        await writeSanitizedJson(snapshotsDir, "first-task-result-private.json", result, secrets);
      }
      await mkdir(privateDir, { recursive: true });
      await writeFile(
        resultPath,
        `${JSON.stringify(sanitizeJson(projectFirstTaskResult(result), secrets), null, 2)}\n`,
        "utf8",
      );
      await testInfo.attach("runner-e2e-result", {
        path: resultPath,
        contentType: "application/json",
      });
    }

    if (primaryError) throw primaryError;
  });
  });
}