{
  "side": "after",
  "sha": "2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf",
  "runDir": "/tmp/lead-26186-r1/evidence-capture-2/2026-10-28T04-20-00.676Z-after",
  "results": [
    {
      "id": "P01",
      "variant": "ordinary managed linking E1..E4, committed reservation and released user lock before every Cloudflare call",
      "pass": true,
      "detail": {
        "results": [
          {
            "kind": "success",
            "value": {
              "environmentId": "env-1",
              "endpoint": {
                "httpBaseUrl": "https://provider-proof-d9361277abf12511.evidence.invalid/",
                "wsBaseUrl": "wss://provider-proof-d9361277abf12511.evidence.invalid/ws",
                "providerKind": "cloudflare_tunnel"
              },
              "endpointRuntime": {
                "providerKind": "cloudflare_tunnel",
                "connectorToken": "synthetic-connector-token",
                "tunnelId": "cf-env-1-id",
                "tunnelName": "t3coderelay-managedendpoint-provider-proof-d9361277abf12511"
              },
              "environmentCredential": "[synthetic credential redacted]"
            }
          },
          {
            "kind": "success",
            "value": {
              "environmentId": "env-2",
              "endpoint": {
                "httpBaseUrl": "https://provider-proof-ff8fba37c25558f1.evidence.invalid/",
                "wsBaseUrl": "wss://provider-proof-ff8fba37c25558f1.evidence.invalid/ws",
                "providerKind": "cloudflare_tunnel"
              },
              "endpointRuntime": {
                "providerKind": "cloudflare_tunnel",
                "connectorToken": "synthetic-connector-token",
                "tunnelId": "cf-env-2-id",
                "tunnelName": "t3coderelay-managedendpoint-provider-proof-ff8fba37c25558f1"
              },
              "environmentCredential": "[synthetic credential redacted]"
            }
          },
          {
            "kind": "success",
            "value": {
              "environmentId": "env-3",
              "endpoint": {
                "httpBaseUrl": "https://provider-proof-82ea6dbd50ce11f6.evidence.invalid/",
                "wsBaseUrl": "wss://provider-proof-82ea6dbd50ce11f6.evidence.invalid/ws",
                "providerKind": "cloudflare_tunnel"
              },
              "endpointRuntime": {
                "providerKind": "cloudflare_tunnel",
                "connectorToken": "synthetic-connector-token",
                "tunnelId": "cf-env-3-id",
                "tunnelName": "t3coderelay-managedendpoint-provider-proof-82ea6dbd50ce11f6"
              },
              "environmentCredential": "[synthetic credential redacted]"
            }
          },
          {
            "kind": "error",
            "_tag": "ManagedTunnelLimitExceeded",
            "userId": "user-1",
            "environmentId": "env-4",
            "activeTunnels": 3,
            "maxTunnels": 3,
            "message": "Managed tunnel limit reached for user 'user-1': 3 of 3 tunnels in use"
          }
        ],
        "firstCloudflareCalls": [
          {
            "operation": "tunnel.list",
            "e": "env-1",
            "row": {
              "user_id": "user-1",
              "environment_id": "env-1",
              "hostname": "provider-proof-d9361277abf12511.evidence.invalid",
              "tunnel_id": null,
              "tunnel_name": "t3coderelay-managedendpoint-provider-proof-d9361277abf12511",
              "dns_record_id": null,
              "ready_at": null,
              "created_at": "2026-10-28T12:00:00.000Z",
              "updated_at": "2026-10-28T12:00:00.000Z",
              "recovery_enabled_at": null,
              "recovery_environment_public_key": null,
              "origin": null,
              "generation": 0,
              "tunnel_released_at": null
            },
            "lockFree": true
          },
          {
            "operation": "tunnel.list",
            "e": "env-2",
            "row": {
              "user_id": "user-1",
              "environment_id": "env-2",
              "hostname": "provider-proof-ff8fba37c25558f1.evidence.invalid",
              "tunnel_id": null,
              "tunnel_name": "t3coderelay-managedendpoint-provider-proof-ff8fba37c25558f1",
              "dns_record_id": null,
              "ready_at": null,
              "created_at": "2026-10-28T12:00:00.000Z",
              "updated_at": "2026-10-28T12:00:00.000Z",
              "recovery_enabled_at": null,
              "recovery_environment_public_key": null,
              "origin": null,
              "generation": 0,
              "tunnel_released_at": null
            },
            "lockFree": true
          },
          {
            "operation": "tunnel.list",
            "e": "env-3",
            "row": {
              "user_id": "user-1",
              "environment_id": "env-3",
              "hostname": "provider-proof-82ea6dbd50ce11f6.evidence.invalid",
              "tunnel_id": null,
              "tunnel_name": "t3coderelay-managedendpoint-provider-proof-82ea6dbd50ce11f6",
              "dns_record_id": null,
              "ready_at": null,
              "created_at": "2026-10-28T12:00:00.000Z",
              "updated_at": "2026-10-28T12:00:00.000Z",
              "recovery_enabled_at": null,
              "recovery_environment_public_key": null,
              "origin": null,
              "generation": 0,
              "tunnel_released_at": null
            },
            "lockFree": true
          }
        ],
        "allCallsSawCommittedReservationAndFreeLock": true
      },
      "cfCalls": 18
    },
    {
      "id": "P02",
      "variant": "real recovery HTTP handler: ready",
      "pass": true,
      "detail": {
        "response": {
          "status": 200,
          "body": {
            "endpoint": {
              "httpBaseUrl": "https://provider-proof-005bab84f8e27ded.evidence.invalid/",
              "wsBaseUrl": "wss://provider-proof-005bab84f8e27ded.evidence.invalid/ws",
              "providerKind": "cloudflare_tunnel"
            },
            "endpointRuntime": {
              "providerKind": "cloudflare_tunnel",
              "connectorToken": "synthetic-connector-token",
              "tunnelId": "seed-env-0-id",
              "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded"
            }
          }
        },
        "operations": [
          "tunnel.get",
          "tunnel.getToken"
        ],
        "expectedOps": [
          "tunnel.get",
          "tunnel.getToken"
        ],
        "reservationTimestampAtFirstCF": "2026-10-28T12:00:00.000Z"
      },
      "cfCalls": 2
    },
    {
      "id": "P02",
      "variant": "real recovery HTTP handler: released-ready",
      "pass": true,
      "detail": {
        "response": {
          "status": 200,
          "body": {
            "endpoint": {
              "httpBaseUrl": "https://provider-proof-005bab84f8e27ded.evidence.invalid/",
              "wsBaseUrl": "wss://provider-proof-005bab84f8e27ded.evidence.invalid/ws",
              "providerKind": "cloudflare_tunnel"
            },
            "endpointRuntime": {
              "providerKind": "cloudflare_tunnel",
              "connectorToken": "synthetic-connector-token",
              "tunnelId": "cf-env-0-id",
              "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded"
            }
          }
        },
        "operations": [
          "tunnel.list",
          "tunnel.create",
          "tunnel.putConfiguration",
          "dns.updateRecord",
          "tunnel.getToken"
        ],
        "expectedOps": [
          "tunnel.list",
          "tunnel.create",
          "tunnel.putConfiguration",
          "dns.updateRecord",
          "tunnel.getToken"
        ],
        "reservationTimestampAtFirstCF": "2026-10-28T12:00:00.000Z"
      },
      "cfCalls": 5
    },
    {
      "id": "P02",
      "variant": "real recovery HTTP handler: wrong-origin",
      "pass": true,
      "detail": {
        "response": {
          "status": 200,
          "body": {
            "endpoint": {
              "httpBaseUrl": "https://provider-proof-005bab84f8e27ded.evidence.invalid/",
              "wsBaseUrl": "wss://provider-proof-005bab84f8e27ded.evidence.invalid/ws",
              "providerKind": "cloudflare_tunnel"
            },
            "endpointRuntime": {
              "providerKind": "cloudflare_tunnel",
              "connectorToken": "synthetic-connector-token",
              "tunnelId": "cf-env-0-id",
              "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded"
            }
          }
        },
        "operations": [
          "tunnel.list",
          "tunnel.create",
          "tunnel.putConfiguration",
          "dns.updateRecord",
          "tunnel.getToken"
        ],
        "expectedOps": [
          "tunnel.list",
          "tunnel.create",
          "tunnel.putConfiguration",
          "dns.updateRecord",
          "tunnel.getToken"
        ],
        "reservationTimestampAtFirstCF": "2026-10-28T12:00:00.000Z"
      },
      "cfCalls": 5
    },
    {
      "id": "P02",
      "variant": "real recovery HTTP handler: missing-tunnel",
      "pass": true,
      "detail": {
        "response": {
          "status": 200,
          "body": {
            "endpoint": {
              "httpBaseUrl": "https://provider-proof-005bab84f8e27ded.evidence.invalid/",
              "wsBaseUrl": "wss://provider-proof-005bab84f8e27ded.evidence.invalid/ws",
              "providerKind": "cloudflare_tunnel"
            },
            "endpointRuntime": {
              "providerKind": "cloudflare_tunnel",
              "connectorToken": "synthetic-connector-token",
              "tunnelId": "cf-env-0-id",
              "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded"
            }
          }
        },
        "operations": [
          "tunnel.get",
          "tunnel.list",
          "tunnel.create",
          "tunnel.putConfiguration",
          "dns.updateRecord",
          "tunnel.getToken"
        ],
        "expectedOps": [
          "tunnel.get",
          "tunnel.list",
          "tunnel.create",
          "tunnel.putConfiguration",
          "dns.updateRecord",
          "tunnel.getToken"
        ],
        "reservationTimestampAtFirstCF": "2026-10-28T12:00:00.000Z"
      },
      "cfCalls": 6
    },
    {
      "id": "P02",
      "variant": "real recovery HTTP handler: over-quota",
      "pass": true,
      "detail": {
        "response": {
          "status": 500,
          "body": {
            "_tag": "RelayInternalError",
            "code": "internal_error",
            "reason": "upstream_unavailable",
            "traceId": "dbcf6e4aaa484e66a82304b45ba4bdc3"
          }
        },
        "operations": [],
        "expectedOps": []
      },
      "cfCalls": 0
    },
    {
      "id": "P03",
      "variant": "provider-over-quota",
      "pass": true,
      "detail": {
        "result": {
          "kind": "error",
          "_tag": "ManagedTunnelLimitExceeded",
          "userId": "user-1",
          "environmentId": "env-0",
          "activeTunnels": 3,
          "maxTunnels": 3,
          "message": "Managed tunnel limit reached for user 'user-1': 3 of 3 tunnels in use"
        },
        "reserveCalls": 0,
        "cloudflareCalls": 0
      },
      "cfCalls": 0
    },
    {
      "id": "P03",
      "variant": "link-http-over-quota",
      "pass": true,
      "detail": {
        "result": {
          "status": 403,
          "body": {
            "_tag": "RelayEnvironmentLinkLimitExceededError",
            "code": "environment_link_limit_exceeded",
            "maxTunnels": 3,
            "traceId": "311d6c20cb5cea9ec9a500e2ff4c2bfe"
          }
        },
        "reserveCalls": 0,
        "cloudflareCalls": 0
      },
      "cfCalls": 0
    },
    {
      "id": "P03",
      "variant": "recovery-service-over-quota",
      "pass": true,
      "detail": {
        "result": {
          "kind": "error",
          "_tag": "ManagedTunnelLimitExceeded",
          "userId": "user-1",
          "environmentId": "env-0",
          "activeTunnels": 3,
          "maxTunnels": 3,
          "message": "Managed tunnel limit reached for user 'user-1': 3 of 3 tunnels in use"
        },
        "reserveCalls": 0,
        "cloudflareCalls": 0
      },
      "cfCalls": 0
    },
    {
      "id": "P03",
      "variant": "recovery-http-over-quota",
      "pass": true,
      "detail": {
        "result": {
          "status": 500,
          "body": {
            "_tag": "RelayInternalError",
            "code": "internal_error",
            "reason": "upstream_unavailable",
            "traceId": "14350649bbb9cf4d53842b585530cbd3"
          }
        },
        "reserveCalls": 0,
        "cloudflareCalls": 0
      },
      "cfCalls": 0
    },
    {
      "id": "P03",
      "variant": "S01 provider fourth request after three committed pending failures; no links",
      "pass": true,
      "detail": {
        "threeCommittedProviderFailures": [
          "ensure-tunnel",
          "ensure-tunnel",
          "ensure-tunnel"
        ],
        "fourthResult": {
          "kind": "error",
          "_tag": "ManagedTunnelLimitExceeded",
          "userId": "user-1",
          "environmentId": "env-4",
          "activeTunnels": 3,
          "maxTunnels": 3,
          "message": "Managed tunnel limit reached for user 'user-1': 3 of 3 tunnels in use"
        },
        "fourthCloudflareCalls": 0,
        "fourthReserveExecutions": 0,
        "rows": 3
      },
      "cfCalls": 3
    },
    {
      "id": "P04",
      "variant": "real restricted role: override-select",
      "pass": true,
      "detail": {
        "failure": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "check-tunnel-limit",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'check-tunnel-limit' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedTunnelLimitPersistenceError",
            "operation": "load-limit",
            "userId": "user-1",
            "message": "Managed tunnel limit 'load-limit' failed for user 'user-1'",
            "cause": {
              "_tag": "EffectDrizzleQueryError",
              "message": "Failed query: select \"max_tunnels\" from \"relay_managed_tunnel_limits\" where \"relay_managed_tunnel_limits\".\"user_id\" = $1 limit $2\nparams: user-1,1",
              "cause": "Cause([Fail(effect/sql/SqlError: PgConnection: Query failed (cause: effect/sql/SqlError/AuthorizationError: PgConnection: Query failed (cause: Error: permission denied for table relay_managed_tunnel_limits)))])"
            }
          }
        },
        "rowsAfterFailure": [],
        "cloudflareCallsAtFailure": 0,
        "retry": "success"
      },
      "cfCalls": 6
    },
    {
      "id": "P04",
      "variant": "real restricted role: allocation-select",
      "pass": true,
      "detail": {
        "failure": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "check-tunnel-limit",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'check-tunnel-limit' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedTunnelLimitPersistenceError",
            "operation": "count-tunnels",
            "userId": "user-1",
            "message": "Managed tunnel limit 'count-tunnels' failed for user 'user-1'",
            "cause": {
              "_tag": "EffectDrizzleQueryError",
              "message": "Failed query: select count(*) from \"relay_managed_endpoint_allocations\" where ((\"relay_managed_endpoint_allocations\".\"user_id\" = $1) and (\"relay_managed_endpoint_allocations\".\"environment_id\" <> $2) and (((\"relay_managed_endpoint_allocations\".\"updated_at\" > $3) or ((((\"relay_managed_endpoint_allocations\".\"tunnel_id\" is not null)) and ((\"relay_managed_endpoint_allocations\".\"tunnel_released_at\" is null)) and (not exists (select \"user_id\" from \"relay_environment_links\" where ((\"relay_environment_links\".\"user_id\" = \"relay_managed_endpoint_allocations\".\"user_id\") and (\"relay_environment_links\".\"environment_id\" = \"relay_managed_endpoint_allocations\".\"environment_id\") and ((((\"relay_environment_links\".\"revoked_at\" is not null)) or (\"relay_environment_links\".\"managed_tunnels_enabled\" = $4)))))))))))\nparams: user-1,env-0,2026-10-28T11:45:00.000Z,false",
              "cause": "Cause([Fail(effect/sql/SqlError: PgConnection: Query failed (cause: effect/sql/SqlError/AuthorizationError: PgConnection: Query failed (cause: Error: permission denied for table relay_managed_endpoint_allocations)))])"
            }
          }
        },
        "rowsAfterFailure": [],
        "cloudflareCallsAtFailure": 0,
        "retry": "success"
      },
      "cfCalls": 6
    },
    {
      "id": "P04",
      "variant": "real restricted role: link-select",
      "pass": true,
      "detail": {
        "failure": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "check-tunnel-limit",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'check-tunnel-limit' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedTunnelLimitPersistenceError",
            "operation": "count-tunnels",
            "userId": "user-1",
            "message": "Managed tunnel limit 'count-tunnels' failed for user 'user-1'",
            "cause": {
              "_tag": "EffectDrizzleQueryError",
              "message": "Failed query: select count(*) from \"relay_managed_endpoint_allocations\" where ((\"relay_managed_endpoint_allocations\".\"user_id\" = $1) and (\"relay_managed_endpoint_allocations\".\"environment_id\" <> $2) and (((\"relay_managed_endpoint_allocations\".\"updated_at\" > $3) or ((((\"relay_managed_endpoint_allocations\".\"tunnel_id\" is not null)) and ((\"relay_managed_endpoint_allocations\".\"tunnel_released_at\" is null)) and (not exists (select \"user_id\" from \"relay_environment_links\" where ((\"relay_environment_links\".\"user_id\" = \"relay_managed_endpoint_allocations\".\"user_id\") and (\"relay_environment_links\".\"environment_id\" = \"relay_managed_endpoint_allocations\".\"environment_id\") and ((((\"relay_environment_links\".\"revoked_at\" is not null)) or (\"relay_environment_links\".\"managed_tunnels_enabled\" = $4)))))))))))\nparams: user-1,env-0,2026-10-28T11:45:00.000Z,false",
              "cause": "Cause([Fail(effect/sql/SqlError: PgConnection: Query failed (cause: effect/sql/SqlError/AuthorizationError: PgConnection: Query failed (cause: Error: permission denied for table relay_environment_links)))])"
            }
          }
        },
        "rowsAfterFailure": [],
        "cloudflareCallsAtFailure": 0,
        "retry": "success"
      },
      "cfCalls": 6
    },
    {
      "id": "P05",
      "variant": "real restricted role: reserve-insert",
      "pass": true,
      "detail": {
        "failure": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "reserve-allocation",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'reserve-allocation' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedEndpointAllocationPersistenceError",
            "stage": "database-request",
            "operation": "reserve",
            "userId": "user-1",
            "environmentId": "env-0",
            "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
            "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
            "message": "Managed endpoint allocation 'reserve' failed during 'database-request' for user 'user-1', environment 'env-0'",
            "cause": {
              "_tag": "EffectDrizzleQueryError",
              "message": "Failed query: insert into \"relay_managed_endpoint_allocations\" (\"user_id\", \"environment_id\", \"hostname\", \"tunnel_id\", \"tunnel_name\", \"dns_record_id\", \"ready_at\", \"recovery_enabled_at\", \"recovery_environment_public_key\", \"tunnel_released_at\", \"origin\", \"generation\", \"created_at\", \"updated_at\") values ($1, $2, $3, default, $4, default, default, default, default, default, default, default, $5, $6) on conflict (\"user_id\",\"environment_id\") do update set \"updated_at\" = $7 returning \"user_id\", \"environment_id\", \"hostname\", \"tunnel_id\", \"tunnel_name\", \"dns_record_id\", \"ready_at\", \"origin\", \"updated_at\", \"generation\", \"tunnel_released_at\"\nparams: user-1,env-0,provider-proof-005bab84f8e27ded.evidence.invalid,t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded,2026-10-28T12:00:00.000Z,2026-10-28T12:00:00.000Z,2026-10-28T12:00:00.000Z",
              "cause": "Cause([Fail(effect/sql/SqlError: PgConnection: Query failed (cause: effect/sql/SqlError/AuthorizationError: PgConnection: Query failed (cause: Error: permission denied for table relay_managed_endpoint_allocations)))])"
            }
          }
        },
        "rowsAfterFailure": [],
        "cloudflareCallsAtFailure": 0,
        "retry": "success"
      },
      "cfCalls": 6
    },
    {
      "id": "P04",
      "variant": "LABELLED database boundary fault: lock-user",
      "pass": true,
      "detail": {
        "result": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "check-tunnel-limit",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'check-tunnel-limit' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedTunnelLimitPersistenceError",
            "operation": "lock-user",
            "userId": "user-1",
            "message": "Managed tunnel limit 'lock-user' failed for user 'user-1'",
            "cause": {
              "_tag": "SqlError",
              "reason": {
                "_tag": "UnknownError",
                "operation": "lock-user",
                "message": "",
                "cause": {
                  "_tag": "SyntheticSqlFault"
                }
              },
              "message": "UnknownError",
              "cause": {
                "_tag": "UnknownError",
                "operation": "lock-user",
                "message": "",
                "cause": {
                  "_tag": "SyntheticSqlFault"
                }
              }
            }
          }
        },
        "cloudflareCallsBeforeRetry": 0,
        "rowsAfterFailure": [],
        "retry": "success",
        "label": "lock-user and BEGIN are labelled SqlError injection; COMMIT is real deferred-trigger SQLSTATE 23514 rejection inside real transaction; before has no corresponding boundary"
      },
      "cfCalls": 6
    },
    {
      "id": "P04",
      "variant": "LABELLED database boundary fault: begin",
      "pass": true,
      "detail": {
        "result": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "check-tunnel-limit",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'check-tunnel-limit' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedTunnelLimitPersistenceError",
            "operation": "transaction",
            "userId": "user-1",
            "message": "Managed tunnel limit 'transaction' failed for user 'user-1'",
            "cause": {
              "_tag": "SqlError",
              "reason": {
                "_tag": "UnknownError",
                "operation": "begin",
                "message": "",
                "cause": {
                  "_tag": "SyntheticSqlFault"
                }
              },
              "message": "UnknownError",
              "cause": {
                "_tag": "UnknownError",
                "operation": "begin",
                "message": "",
                "cause": {
                  "_tag": "SyntheticSqlFault"
                }
              }
            }
          }
        },
        "cloudflareCallsBeforeRetry": 0,
        "rowsAfterFailure": [],
        "retry": "success",
        "label": "lock-user and BEGIN are labelled SqlError injection; COMMIT is real deferred-trigger SQLSTATE 23514 rejection inside real transaction; before has no corresponding boundary"
      },
      "cfCalls": 6
    },
    {
      "id": "P04",
      "variant": "LABELLED database boundary fault: commit",
      "pass": true,
      "detail": {
        "result": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "check-tunnel-limit",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'check-tunnel-limit' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedTunnelLimitPersistenceError",
            "operation": "transaction",
            "userId": "user-1",
            "message": "Managed tunnel limit 'transaction' failed for user 'user-1'",
            "cause": {
              "_tag": "SqlError",
              "reason": {
                "_tag": "ConstraintError",
                "operation": "query",
                "message": "PgConnection: Query failed",
                "cause": {
                  "code": "23514",
                  "message": "provider evidence deferred commit failure"
                }
              },
              "message": "PgConnection: Query failed",
              "cause": {
                "_tag": "ConstraintError",
                "operation": "query",
                "message": "PgConnection: Query failed",
                "cause": {
                  "code": "23514",
                  "message": "provider evidence deferred commit failure"
                }
              }
            }
          }
        },
        "cloudflareCallsBeforeRetry": 0,
        "rowsAfterFailure": [],
        "retry": "success",
        "label": "lock-user and BEGIN are labelled SqlError injection; COMMIT is real deferred-trigger SQLSTATE 23514 rejection inside real transaction; before has no corresponding boundary"
      },
      "cfCalls": 6
    },
    {
      "id": "P07",
      "variant": "Cloudflare failure after committed reservation: tunnel-less; no link; pinned aging",
      "pass": true,
      "detail": {
        "failure": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "ensure-tunnel",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'ensure-tunnel' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedEndpointTunnelClientError",
            "operation": "list",
            "message": "Managed endpoint tunnel provider 'list' request failed",
            "cause": {
              "_tag": "SyntheticCloudflareFailure"
            }
          }
        },
        "persisted": [
          {
            "user_id": "user-1",
            "environment_id": "env-0",
            "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
            "tunnel_id": null,
            "tunnel_name": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
            "dns_record_id": null,
            "ready_at": null,
            "created_at": "2026-10-28T12:00:00.000Z",
            "updated_at": "2026-10-28T12:00:00.000Z",
            "recovery_enabled_at": null,
            "recovery_environment_public_key": null,
            "origin": null,
            "generation": 0,
            "tunnel_released_at": null
          }
        ],
        "recent": {
          "kind": "error",
          "_tag": "ManagedTunnelLimitExceeded",
          "userId": "user-1",
          "environmentId": "env-probe",
          "activeTunnels": 1,
          "maxTunnels": 1,
          "message": "Managed tunnel limit reached for user 'user-1': 1 of 1 tunnels in use"
        },
        "atExact15Minutes": {
          "kind": "success",
          "value": "capacity-available"
        },
        "after15Minutes": {
          "kind": "success",
          "value": "capacity-available"
        },
        "rowsAreRetainedNotDeleted": true
      },
      "cfCalls": 1
    },
    {
      "id": "P07",
      "variant": "Cloudflare failure after committed reservation: recorded-tunnel; no link; pinned aging",
      "pass": true,
      "detail": {
        "failure": {
          "kind": "error",
          "_tag": "ManagedEndpointProvisioningFailed",
          "stage": "configure-tunnel",
          "userId": "user-1",
          "environmentId": "env-0",
          "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
          "tunnelName": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
          "message": "Managed endpoint provisioning failed during 'configure-tunnel' for user 'user-1', environment 'env-0'",
          "cause": {
            "_tag": "ManagedEndpointTunnelClientError",
            "operation": "put-configuration",
            "message": "Managed endpoint tunnel provider 'put-configuration' request failed",
            "cause": {
              "_tag": "SyntheticCloudflareFailure"
            }
          }
        },
        "persisted": [
          {
            "user_id": "user-1",
            "environment_id": "env-0",
            "hostname": "provider-proof-005bab84f8e27ded.evidence.invalid",
            "tunnel_id": "cf-env-0-id",
            "tunnel_name": "t3coderelay-managedendpoint-provider-proof-005bab84f8e27ded",
            "dns_record_id": null,
            "ready_at": null,
            "created_at": "2026-10-28T12:00:00.000Z",
            "updated_at": "2026-10-28T12:00:00.000Z",
            "recovery_enabled_at": null,
            "recovery_environment_public_key": null,
            "origin": null,
            "generation": 1,
            "tunnel_released_at": null
          }
        ],
        "recent": {
          "kind": "error",
          "_tag": "ManagedTunnelLimitExceeded",
          "userId": "user-1",
          "environmentId": "env-probe",
          "activeTunnels": 1,
          "maxTunnels": 1,
          "message": "Managed tunnel limit reached for user 'user-1': 1 of 1 tunnels in use"
        },
        "atExact15Minutes": {
          "kind": "error",
          "_tag": "ManagedTunnelLimitExceeded",
          "userId": "user-1",
          "environmentId": "env-probe",
          "activeTunnels": 1,
          "maxTunnels": 1,
          "message": "Managed tunnel limit reached for user 'user-1': 1 of 1 tunnels in use"
        },
        "after15Minutes": {
          "kind": "error",
          "_tag": "ManagedTunnelLimitExceeded",
          "userId": "user-1",
          "environmentId": "env-probe",
          "activeTunnels": 1,
          "maxTunnels": 1,
          "message": "Managed tunnel limit reached for user 'user-1': 1 of 1 tunnels in use"
        },
        "rowsAreRetainedNotDeleted": true
      },
      "cfCalls": 3
    },
    {
      "id": "P06",
      "variant": "optional control non-loopback",
      "pass": true,
      "detail": {
        "kind": "error",
        "_tag": "ManagedEndpointOriginNotAllowed",
        "userId": "user-1",
        "environmentId": "env-0",
        "message": "Managed endpoint origin '192.0.2.1:3773' is not allowed for user 'user-1', environment 'env-0'"
      },
      "cfCalls": 0
    },
    {
      "id": "P06",
      "variant": "optional control missing-config",
      "pass": true,
      "detail": {
        "kind": "error",
        "_tag": "ManagedEndpointProvisioningNotConfigured",
        "userId": "user-1",
        "environmentId": "env-0",
        "message": "Managed endpoint provisioning is not configured for user 'user-1', environment 'env-0': missing managedEndpointBaseDomain, managedEndpointNamespace"
      },
      "cfCalls": 0
    },
    {
      "id": "P06",
      "variant": "optional control publish-only",
      "pass": true,
      "detail": {
        "result": {
          "kind": "success",
          "value": {
            "environmentId": "env-0",
            "endpoint": {
              "httpBaseUrl": "https://manual.invalid/",
              "wsBaseUrl": "wss://manual.invalid/ws",
              "providerKind": "manual"
            },
            "endpointRuntime": null,
            "environmentCredential": "[synthetic credential redacted]"
          }
        },
        "optionalDigestFailure": "UNVERIFIED; not injected"
      },
      "cfCalls": 0
    }
  ]
}