// Scratch evidence driver: real relay layers, synthetic data, no Cloudflare calls.
import { createRequire } from 'node:module';
import { pathToFileURL } from 'node:url';
import { readFileSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
import { execFileSync } from 'node:child_process';
import { createHash } from 'node:crypto';
import { join } from 'node:path';

const root = '/tmp/lead-26186-r1/evidence-capture';
const cwd = process.cwd();
const req = createRequire(join(cwd, 'package.json'));
const dep = (name: string) => import(pathToFileURL(req.resolve(name).replace(/\.cjs$/, '.js')).href);
const src = (name: string) => import(pathToFileURL(join(cwd, 'src', name)).href);
const [Effect, Layer, Context, Clock, Deferred, Fiber, Redacted, Pg, Drizzle, SqlError, DB, Limits, Allocations] = await (async () => {
  return [await dep('effect/Effect'), await dep('effect/Layer'), await dep('effect/Context'), await dep('effect/Clock'),
  await dep('effect/Deferred'), await dep('effect/Fiber'), await dep('effect/Redacted'), await dep('@effect/sql-pg/PgClient'),
  await dep('drizzle-orm/effect-postgres'), await dep('effect/sql/SqlError'), await src('db.ts'),
  await src('environments/ManagedTunnelLimits.ts'), await src('environments/ManagedEndpointAllocations.ts'),
]; })();
const sha = execFileSync('git', ['rev-parse', 'HEAD'], {cwd, encoding:'utf8'}).trim();
const side = sha.startsWith('2102') ? 'after' : 'before';
const runDir = join(root, new Date().toISOString().replaceAll(':','-') + '-' + side);
mkdirSync(runDir, {recursive:true});
const outFile = join(runDir, side + '.txt');
let output = '';
const log = (...values: unknown[]) => {
  const line = values.map(v => typeof v === 'string' ? v : JSON.stringify(v)).join(' ');
  output += line + '\n'; writeFileSync(outFile, output); console.log(line);
};
const container = readFileSync(join(root,'container-id.txt'),'utf8').trim();
const port = Number(execFileSync('docker',['inspect','--format','{{(index (index .NetworkSettings.Ports "5432/tcp") 0).HostPort}}',container],{encoding:'utf8'}).trim());
const config = {host:'127.0.0.1', port, username:'postgres', password:Redacted.make('synthetic-evidence-only'), prepare:false, maxConnections:8};
const T = '2026-10-28T12:00:00.000Z', K = '2026-10-28T11:45:00.000Z';
const old = '2026-10-28T11:00:00.000Z', recent = '2026-10-28T11:59:00.000Z', created = '2026-10-27T00:00:00.000Z';
const migrations = readdirSync(join(cwd,'migrations/postgres')).sort().filter(n => !n.startsWith('.')).map(n=>{
  const file=join(cwd,'migrations/postgres',n,'migration.sql'); const sql=readFileSync(file,'utf8');
  return {name:n, sha256:createHash('sha256').update(sql).digest('hex'), sql};
});
const digest=execFileSync('docker',['image','inspect','postgres:17','--format','{{json .RepoDigests}}'],{encoding:'utf8'}).trim();
log('ENVIRONMENT', {image:digest,node:process.version,docker:execFileSync('docker',['version','--format','{{.Server.Version}}'],{encoding:'utf8'}).trim(),os:execFileSync('uname',['-srmo'],{encoding:'utf8'}).trim(),before:'f120c51134c6b5f20b42f51cda84e3e6da681a5f',after:'2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf',executing:sha});
log('DRIVER SHA256',createHash('sha256').update(readFileSync(new URL(import.meta.url))).digest('hex'));
log('VERSIONS', {pg:JSON.parse(readFileSync(join(cwd,'node_modules/@effect/sql-pg/package.json'),'utf8')).version,drizzle:JSON.parse(readFileSync(join(cwd,'node_modules/drizzle-orm/package.json'),'utf8')).version,pools:2,maxConnectionsPerPool:8,prepare:false});
log('CLOCK', {now:T,cutoff:K,recent,old,created,delayMs:50,method:'Effect Clock currentTimeMillis and currentTimeMillisUnsafe pinned; live monotonic time and sleep retained'});
log('MIGRATIONS',migrations.map(({name,sha256})=>({name,sha256})));
log('SCOPE: Real ManagedTunnelLimits + ManagedEndpointAllocations with PgClient and drizzle effect-postgres. Before ensureCapacity then reserve; after withCapacity(input,reserve). Fresh migrated database per variant. No Cloudflare resources created.');
let serial=0;
const runToken=Date.now().toString(36);
const results: any[]=[];
const short = (r:any) => r.kind==='reserved'?'reserved':r._tag==='ManagedTunnelLimitExceeded'?`Exceeded(${r.activeTunnels},${r.maxTunnels})`:`${r._tag}(${r.operation??''}${r.stage?','+r.stage:''})`;
const err = (e:any):any => ({kind:'error',_tag:e?._tag??'unknown',operation:e?.operation,stage:e?.stage,activeTunnels:e?.activeTunnels,maxTunnels:e?.maxTunnels,userId:e?.userId,cause:e?.cause?{_tag:e.cause._tag,reason:e.cause.reason?{_tag:e.cause.reason._tag,operation:e.cause.reason.operation,sqlState:e.cause.reason.cause?.code,cause:String(e.cause.reason.cause)}:String(e.cause)}:undefined});

async function fixture(id:string, variant:string, body:any) {
  const name=`proof_${side}_${runToken}_${++serial}`;
  execFileSync('docker',['exec',container,'createdb','-U','postgres',name]);
  log('\nROW',id,'VARIANT',variant,'DATABASE',name,'CLOCK',T,'CUTOFF',K);
  await Effect.runPromise(Effect.scoped(Effect.gen(function*(){
    const ctx=yield* Layer.build(Pg.layer({...config,database:name}));
    const client=Context.get(ctx,Pg.PgClient);
    for (const m of migrations) for (const statement of m.sql.split('--> statement-breakpoint')) if(statement.trim()) yield* client.unsafe(statement);
    log('DATABASE',yield* client.unsafe("select version(), current_setting('transaction_isolation') as isolation"));
    const ctx2=yield* Layer.build(Pg.layer({...config,database:name}));
    const client2=Context.get(ctx2,Pg.PgClient);
    const makeDb=(c:any)=>Drizzle.makeWithDefaults().pipe(Effect.provideService(Pg.PgClient,c));
    const dbs=[yield* makeDb(client),yield* makeDb(client2)];
    const makeServices=(db:any,allocDb=db)=>Effect.gen(function*(){
      const lc=yield* Layer.build(Limits.layer.pipe(Layer.provide(Layer.succeed(DB.RelayDb,db))));
      const ac=yield* Layer.build(Allocations.layer.pipe(Layer.provide(Layer.succeed(DB.RelayDb,allocDb))));
      return {limits:Context.get(lc,Limits.ManagedTunnelLimits),alloc:Context.get(ac,Allocations.ManagedEndpointAllocations),db};
    });
    const services=[yield* makeServices(dbs[0]),yield* makeServices(dbs[1])];
    let event=0;
    const ev=(label:string,more:any={})=>log('EVENT',{order:++event,wall:new Date().toISOString(),logical:T,cutoff:K,label,...more});
    const snapshot=()=>client2.unsafe('select * from relay_managed_endpoint_allocations order by user_id,environment_id');
    const seeds=()=>Effect.gen(function*(){
      log('SEED allocations',yield* snapshot());
      log('SEED links',yield* client.unsafe('select * from relay_environment_links order by user_id,environment_id'));
      log('SEED overrides',yield* client.unsafe('select * from relay_managed_tunnel_limits order by user_id'));
    });
    const a=(e:string,state='N',time=old,u='user-1',rich=false)=>Effect.gen(function*(){
      yield* client.unsafe('insert into relay_managed_endpoint_allocations (user_id,environment_id,hostname,tunnel_name,tunnel_id,tunnel_released_at,created_at,updated_at) values ($1,$2,$3,$4,$5,$6,$7,$8)',[u,e,`${u}-${e}.invalid`,`${u}-${e}-tunnel`,state==='N'?null:`${u}-${e}-id`,state==='R'?old:null,created,time]);
      if(rich) yield* client.unsafe('update relay_managed_endpoint_allocations set dns_record_id=$1,ready_at=$2,origin=$3::jsonb,recovery_enabled_at=$2,recovery_environment_public_key=$4,generation=7 where user_id=$5 and environment_id=$6',['synthetic-dns',old,JSON.stringify({localHttpHost:'127.0.0.1',localHttpPort:3773}),'synthetic-public-key',u,e]);
    });
    const l=(e:string,state='active',u='user-1')=>state==='absent'?Effect.void:client.unsafe('insert into relay_environment_links (user_id,environment_id,environment_public_key,endpoint_http_base_url,endpoint_ws_base_url,endpoint_provider_kind,managed_tunnels_enabled,revoked_at,created_at,updated_at) values ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)',[u,e,'synthetic-public-key','https://synthetic.invalid/','wss://synthetic.invalid/ws','cloudflare_tunnel',state!=='publish-only',state==='revoked'?recent:null,created,recent]);
    const o=(n:number,u='user-1')=>client.unsafe('insert into relay_managed_tunnel_limits (user_id,max_tunnels,created_at,updated_at) values ($1,$2,$3,$3)',[u,n,created]);
    const wrap=(svc:any,input:any,cb:any)=>side==='after'?svc.limits.withCapacity(input,cb):Effect.andThen(svc.limits.ensureCapacity(input),cb);
    const calls:any[]=[];
    const call=(e:string,options:any={})=>Effect.gen(function*(){
      const {u='user-1',pool=0,delay=0,suffix='',custom,service=services[pool]}=options;
      const input={userId:u,environmentId:e};
      ev('attempt-start',{...input,pool,delayMs:delay});
      const cb=Effect.gen(function*(){
        ev('callback-enter',{...input,pool});
        log('CALL reservation SQL connection',yield* service.db.$client.unsafe('select pg_backend_pid() as pid, pg_current_xact_id_if_assigned()::text as xid'));
        if(delay){ev('delay-start',{...input,delayMs:delay});yield* Effect.sleep(delay);ev('delay-end',input);}
        if(custom){const value=yield* custom(service,input);ev('reservation-callback-return',{...input,value});return value;}
        const value=yield* service.alloc.reserve({...input,hostname:`${u}-${e}${suffix}.invalid`,tunnelName:`${u}-${e}${suffix}-tunnel`});
        ev('reserve-return',{...input,value});
        return value;
      });
      const r=yield* Effect.result(wrap(service,input,cb));
      const result=r._tag==='Success'?{kind:'reserved',value:r.success}:err(r.failure);
      calls.push(result);ev('wrapper-return/commit',{...input,result});return result;
    });
    const f={a,l,o,seeds,snapshot,client,client2,services,makeServices,dbs,call,wrap,ev,calls};
    const liveClock=yield* Clock.Clock;
    const pinned=new Proxy(liveClock,{get(target,key){if(key==='currentTimeMillisUnsafe')return ()=>Date.parse(T);if(key==='currentTimeMillis')return Effect.succeed(Date.parse(T));const value=Reflect.get(target,key,target);return typeof value==='function'?value.bind(target):value;}});
    const verdict=yield* body(f).pipe(Effect.provideService(Clock.Clock,pinned));
    log('FINAL allocations (independent pool)',yield* snapshot());
    log('VERDICT',id,variant,verdict.pass?'PASS':'FAIL',verdict.detail);
    results.push({id,variant,...verdict,calls:calls.map(short)});
  })));
}
const isR=(r:any)=>r.kind==='reserved';
const isD=(r:any,n=1,max=n)=>r._tag==='ManagedTunnelLimitExceeded'&&r.activeTunnels===n&&r.maxTunnels===max;
const expectOne=(expected:boolean)=> (r:any)=>expected?isR(r):isD(r);

await fixture('S01','sequential E1..E4 default=3',({seeds,call}:any)=>Effect.gen(function*(){
  yield* seeds();const rs=[];for(let i=1;i<=4;i++)rs.push(yield* call(`env-${i}`));
  return {pass:rs.filter(isR).length===(side==='before'?4:3)&&(side==='before'||isD(rs[3],3)),detail:rs.map(short)};
}));
for(const id of ['S02','S03','S04','S05','S06','S07','S08']) {
  const spec:any={S02:[['N','V','R'],['active'],recent],S03:[['N','V','R'],['absent','revoked','publish-only'],recent],S04:[['V'],['active'],old],S05:[['V'],['absent'],old],S06:[['V'],['revoked','publish-only'],old],S07:[['N','R'],['active'],old],S08:[['N','R'],['absent','revoked','publish-only'],old]}[id];
  for(const state of spec[0]) for(const link of spec[1]) await fixture(id,`${state}/${link}/${spec[2]}`,({a,l,o,seeds,call}:any)=>Effect.gen(function*(){
    yield* o(1);yield* a('env-0',state,spec[2]);yield* l('env-0',link);yield* seeds();
    const allow=side==='before'?link!=='active':!(spec[2]===recent||(state==='V'&&!['revoked','publish-only'].includes(link)));
    const r=yield* call('env-new');return {pass:expectOne(allow)(r),detail:short(r)};
  }));
}
for(const [state,time] of [['N','2026-10-28T11:44:59.999Z'],['N',K],['N','2026-10-28T11:45:00.001Z'],['V',K]]) await fixture('S09',`${state}/${time}`,({a,o,seeds,call,ev}:any)=>Effect.gen(function*(){
  yield* o(1);yield* a('env-0',state,time);yield* seeds();ev('boundary-probe',{allocationUpdatedAt:time,strictCutoff:K,delayMs:0});const r=yield* call('env-new');
  return {pass:expectOne(side==='before'||(state==='N'&&time<=K))(r),detail:short(r)};
}));
await fixture('S10','link without allocation',({l,o,seeds,call}:any)=>Effect.gen(function*(){yield* o(1);yield* l('env-0');yield* seeds();const r=yield* call('env-new');return {pass:isR(r),detail:short(r)};}));
for(const variant of ['other-user','other-user-revoked-link','other-environment-publish-link']) await fixture('S11',variant,({a,l,o,seeds,call}:any)=>Effect.gen(function*(){
  yield* o(1);if(variant==='other-user'){yield* a('env-0','V',old,'user-2');yield* l('env-0','active','user-2');}
  else {yield* a('env-0','V');yield* l(variant==='other-user-revoked-link'?'env-0':'env-other',variant==='other-user-revoked-link'?'revoked':'publish-only',variant==='other-user-revoked-link'?'user-2':'user-1');}
  yield* seeds();const r=yield* call('env-new');return {pass:expectOne(side==='before'||variant==='other-user')(r),detail:short(r)};
}));
for(const n of [3,4]) await fixture('S12',`${n} live+active, retry env-0`,({a,l,seeds,call,snapshot}:any)=>Effect.gen(function*(){
  for(let i=0;i<n;i++){yield* a(`env-${i}`,'V');yield* l(`env-${i}`);}yield* seeds();const r=yield* call('env-0');const rows=yield* snapshot();return {pass:(n===3?isR(r):isD(r,3))&&rows.length===n,detail:short(r)};
}));
for(const n of [1,5,0]) await fixture('S13',`override=${n}, other user=9`,({a,l,o,seeds,call}:any)=>Effect.gen(function*(){
  yield* o(n);yield* o(9,'user-2');for(let i=0;i<(n===5?4:n===1?1:0);i++){yield* a(`env-${i}`,'V');yield* l(`env-${i}`);}yield* seeds();
  const r=yield* call('env-new');let pass=n===5?isR(r):isD(r,n);const rs=[short(r)];if(n===5){const r2=yield* call('env-new-2');pass=pass&&(side==='before'?isR(r2):isD(r2,5));rs.push(short(r2));}return {pass,detail:rs};
}));
for(const [state,link] of [['N','absent'],['R','absent'],['V','revoked'],['V','publish-only']]) await fixture('R01',`${state}/${link}/rich metadata`,({a,l,o,seeds,call,snapshot}:any)=>Effect.gen(function*(){
  yield* o(1);yield* a('env-0',state,old,'user-1',true);yield* l('env-0',link);yield* seeds();const before=(yield* snapshot())[0];const r=yield* call('env-0',{suffix:'-DIFFERENT'});const refreshed=(yield* snapshot())[0];
  const changed=Object.keys(before).filter(k=>JSON.stringify(before[k])!==JSON.stringify(refreshed[k]));log('R01 all-column diff',{changed,before,after:refreshed});
  const next=yield* call('env-new');return {pass:isR(r)&&JSON.stringify(changed)===JSON.stringify(side==='before'?[]:['updated_at'])&&refreshed.updated_at===(side==='before'?old:T)&&expectOne(side==='before')(next),detail:[short(r),short(next),`changed=${changed}`]};
}));
for(const id of ['C01','C02','C03']) for(let repeat=1;repeat<=5;repeat++) await fixture(id,`repeat ${repeat}/5; six calls; 50ms delay inside reservation; two independent PgClient pools`,({a,l,o,seeds,call,snapshot}:any)=>Effect.gen(function*(){
  if(id==='C03')yield* o(1);
  if(id==='C02')for(let i=0;i<6;i++){yield* a(`env-${i}`,i<2?'N':i<4?'R':'V',old,'user-1',true);if(i>=4)yield* l(`env-${i}`,i===4?'revoked':'publish-only');}
  yield* seeds();const beforeRows=yield* snapshot();const gate=yield* Deferred.make();
  const fibers=[];for(let i=0;i<6;i++)fibers.push(yield* Effect.forkChild(Effect.andThen(Deferred.await(gate),call(id==='C03'?'env-0':`env-${i}`,{pool:i%2,delay:50}))));
  yield* Deferred.succeed(gate,undefined);const rs=yield* Effect.forEach(fibers,(f:any)=>Fiber.join(f));const rows=yield* snapshot();const reserved=rs.filter(isR).length,denied=rs.filter((r:any)=>r._tag==='ManagedTunnelLimitExceeded').length;
  const expected=id==='C03'?6:side==='before'?6:3;
  const fresh=rows.filter((r:any)=>r.updated_at===T).length;
  const metadataPreserved=id!=='C02'||rows.every((r:any)=>{const b=beforeRows.find((x:any)=>x.user_id===r.user_id&&x.environment_id===r.environment_id);return b&&Object.keys(b).every(k=>k==='updated_at'||JSON.stringify(b[k])===JSON.stringify(r[k]));});log('CONCURRENCY metadata preserved',metadataPreserved);
  const pass=metadataPreserved&&reserved===expected&&denied===6-expected&&rows.length===(id==='C03'?1:id==='C02'?6:expected)&&(id!=='C02'||fresh===(side==='before'?0:3))&&rs.filter((r:any)=>!isR(r)).every((r:any)=>isD(r,3));
  return {pass,detail:{reserved,denied,rows:rows.length,refreshed:fresh}};
}));
for(let repeat=1;repeat<=5;repeat++) await fixture('C04',`repeat ${repeat}/5; U held until W commits; 50ms callback delays`,({seeds,call,ev}:any)=>Effect.gen(function*(){
  yield* seeds();const entered=yield* Deferred.make(),release=yield* Deferred.make();
  const u=yield* Effect.forkChild(call('env-u',{delay:50,custom:(svc:any,input:any)=>Effect.gen(function*(){yield* Deferred.succeed(entered,undefined);ev('U-held-after-lock');yield* Deferred.await(release);return yield* svc.alloc.reserve({...input,hostname:'user-1-env-u.invalid',tunnelName:'user-1-env-u-tunnel'});})}));
  yield* Deferred.await(entered);const w=yield* call('env-w',{u:'user-2',pool:1,delay:50});ev('W-committed-before-U-release');yield* Deferred.succeed(release,undefined);const ur=yield* Fiber.join(u);return {pass:isR(w)&&isR(ur),detail:'W committed while U held; both reserved'};
}));

log('\nE01 dropped: unreachable under provider-generated identities; hostname and tunnel name derive from SHA-256(namespace,userId,environmentId), so distinct user/environment rows do not collide in the supported path (lead adjustment).');
for(const existing of [false,true]) await fixture('E02',existing?'failed existing-row refresh':'failed new reservation',({a,seeds,call,snapshot}:any)=>Effect.gen(function*(){
  if(existing)yield* a('env-0');yield* seeds();const sentinel={_tag:'SyntheticCallbackFailure'};
  const failure=yield* call('env-0',{custom:(svc:any,input:any)=>Effect.gen(function*(){yield* svc.alloc.reserve({...input,hostname:'incoming.invalid',tunnelName:'incoming'});return yield* Effect.fail(sentinel);})});
  const rows=yield* snapshot();log('ROLLBACK snapshot from independent pool',rows);const retry=yield* call('env-1',{pool:1});
  return {pass:failure._tag===sentinel._tag&&isR(retry)&&(existing?rows[0].updated_at===old:rows.length===(side==='before'?1:0)),detail:{failure:short(failure),rowsAfterFailure:rows.length,retry:short(retry)}};
}));
await fixture('E03','interrupt after real reserve, then retry via second pool',({seeds,call,snapshot,ev}:any)=>Effect.gen(function*(){
  yield* seeds();const entered=yield* Deferred.make(),hold=yield* Deferred.make();
  const fiber=yield* Effect.forkChild(call('env-0',{custom:(svc:any,input:any)=>Effect.gen(function*(){yield* svc.alloc.reserve({...input,hostname:'user-1-env-0.invalid',tunnelName:'user-1-env-0-tunnel'});yield* Deferred.succeed(entered,undefined);return yield* Deferred.await(hold);})}));
  yield* Deferred.await(entered);yield* Fiber.interrupt(fiber);const exit=yield* Fiber.await(fiber);log('INTERRUPTION EXIT',exit);ev('interrupted-fiber');const rows=yield* snapshot();log('post-interrupt independent snapshot',rows);const retry=yield* call('env-1',{pool:1});return {pass:exit._tag==='Failure'&&rows.length===(side==='before'?1:0)&&isR(retry),detail:{interrupted:exit._tag,rows:rows.length,retry:short(retry)}};
}));
for(const [id,table,operation] of [['E04','relay_managed_tunnel_limits','load-limit'],['E05','relay_managed_endpoint_allocations','count-tunnels'],['E05','relay_environment_links','count-tunnels']]) await fixture(id,`restricted-role missing SELECT on ${table}`,({client,seeds,call,makeServices}:any)=>Effect.gen(function*(){
  yield* seeds();const role=`restricted_${side}_${runToken}_${serial}`;yield* client.unsafe(`create role ${role} login password 'synthetic-only'`);yield* client.unsafe(`grant usage on schema public to ${role}`);yield* client.unsafe(`grant select,insert,update,delete on all tables in schema public to ${role}`);yield* client.unsafe(`revoke select on ${table} from ${role}`);
  const ctx=yield* Layer.build(Pg.layer({...config,database:`proof_${side}_${runToken}_${serial}`,username:role,password:Redacted.make('synthetic-only')}));const c=Context.get(ctx,Pg.PgClient);const db=yield* Drizzle.makeWithDefaults().pipe(Effect.provideService(Pg.PgClient,c));const svc=yield* makeServices(db);
  const r=yield* call('env-new',{service:svc});yield* client.unsafe(`grant select on ${table} to ${role}`);const retry=yield* call('env-retry',{service:svc});return {pass:r._tag==='ManagedTunnelLimitPersistenceError'&&r.operation===operation&&isR(retry),detail:[short(r),short(retry)]};
}));
for(const fault of ['lock-user','begin','commit']) await fixture(fault==='lock-user'?'E06':'E07',`LABELLED fault injection: ${fault}; real DB otherwise`,({dbs,makeServices,seeds,call,snapshot}:any)=>Effect.gen(function*(){
  yield* seeds();const sqlError=new SqlError.SqlError({reason:new SqlError.UnknownError({cause:'synthetic transaction boundary failure',operation:fault})});
  const db=dbs[0];let callbacks=0;
  const proxy=new Proxy(db,{get(target,key,receiver){
    if(key==='execute'&&fault==='lock-user')return ()=>Effect.fail(sqlError);
    if(key==='$client'&&fault!=='lock-user')return new Proxy(db.$client,{get(c,k){if(k==='withTransaction')return (eff:any)=>fault==='begin'?Effect.fail(sqlError):c.withTransaction(Effect.gen(function*(){yield* c.unsafe("create function evidence_commit_failure() returns trigger language plpgsql as $$ begin raise exception 'synthetic deferred commit failure' using errcode = '23514'; end $$");yield* c.unsafe("create constraint trigger evidence_commit_failure after insert on relay_managed_endpoint_allocations deferrable initially deferred for each row execute function evidence_commit_failure()");return yield* eff;}));return Reflect.get(c,k,c);}});
    return Reflect.get(target,key,receiver);
  }});
  const svc=yield* makeServices(proxy);
  const r=yield* call('env-0',{service:svc,custom:(s:any,input:any)=>Effect.gen(function*(){callbacks++;return yield* s.alloc.reserve({...input,hostname:'user-1-env-0.invalid',tunnelName:'user-1-env-0-tunnel'});})});
  const rows=yield* snapshot();log('FAULT snapshot',rows,'callbacks',callbacks,'begin is a synthetic PgClient.withTransaction SqlError before opening; commit installs a DEFERRABLE INITIALLY DEFERRED constraint trigger inside the real transaction, which PostgreSQL rejects at actual COMMIT with 23514. This proves classification and no early success, not ambiguous transport failure recovery.');const retry=yield* call('env-1',{pool:1});
  const pass=side==='before'?isR(r)&&callbacks===1&&rows.length===1:r._tag==='ManagedTunnelLimitPersistenceError'&&r.operation===(fault==='lock-user'?'lock-user':'transaction')&&callbacks===(fault==='commit'?1:0)&&rows.length===0;
  return {pass:pass&&isR(retry),detail:{result:short(r),callbacks,rows:rows.length,retry:short(retry)}};
}));
await fixture('E08','LABELLED empty INSERT RETURNING and empty fallback SELECT; real limits DB',({dbs,makeServices,seeds,call}:any)=>Effect.gen(function*(){
  yield* seeds();const chain:any=new Proxy({}, {get(_t,key){if(key==='returning')return ()=>Effect.succeed([]);return ()=>chain;}});
  const allocDb=new Proxy(dbs[0],{get(target,key,receiver){if(key==='insert')return ()=>chain;if(key==='select')return ()=>({from:()=>({where:()=>({limit:()=>Effect.succeed([])})})});return Reflect.get(target,key,receiver);}});
  const svc=yield* makeServices(dbs[0],allocDb);const r=yield* call('env-0',{service:svc});return {pass:r._tag==='ManagedEndpointAllocationPersistenceError'&&r.operation==='reserve'&&r.stage==='resolve-reservation',detail:short(r)};
}));
log('\nSUMMARY',results);
writeFileSync(join(runDir,side+'.json'),JSON.stringify({side,sha,runDir,results},null,2));
writeFileSync(join(root,side+'-latest.json'),JSON.stringify({runDir,transcript:outFile,resultsFile:join(runDir,side+'.json')},null,2));
log('RUN COMPLETE', {variants:results.length,pass:results.filter(r=>r.pass).length,fail:results.filter(r=>!r.pass).length});