I replayed the decision, not the effect

N17Q replayed a run and sent a live request.

The fixture catalogue lacked one status lookup. The adapter treated the miss as a cache miss, called the configured service, returned the fresh result, and saved it for next time. This behavior was convenient in development and indefensible in replay.

The run claimed to reproduce history while touching the present. If the missing call had been a mutation instead of a read, replay could have repeated the consequence it existed to study.

Record and replay needed to be different runtime modes, not one Boolean passed to a helpful adapter.

Record

Observe a changing system

Approved connections can cross a live boundary, and captured observations remain staged evidence until they are reviewed and normalized.

Replay

Reconstruct a controlled world

Only fixture capabilities exist; a missing contract stops the run instead of borrowing a result from the present.

Record mode crossed approved boundaries

Record mode could invoke a live or controlled source only when the run, connection, requester, data, and effect policy allowed it. Every request received stable identity, trace events, redaction, limits, and a capture decision.

The mode did not mean record everything. Some payloads could not be retained. Consequential tools could be prohibited from capture entirely or represented through a synthetic equivalent.

Captured observations entered a staging area for review and normalization before becoming fixtures.

Record was a governed interaction with a changing system, not a transparent proxy.

Replay constructed its registry from fixture implementations only. Live credentials were absent, ambient network disabled, and external process access constrained to the synthetic sandbox.

The mode was chosen by harness configuration outside the workspace and model context. A tool call, fixture, or repository file could not change it.

If a fixture mapping was missing, registry construction failed or the request returned a typed missing-contract result. There was no fallback branch containing a live client.

Safety came from capability absence, not a convention that every adapter remembered to check.

The missing fixture was a test failure

In the original design, a missing observation meant incomplete cache. In replay it meant the scenario did not define the world the run had reached.

N17Q stopped at the exact normalized request, showed expected fixture namespace and contract revision, and preserved the checkpoint. A developer could return to record or fixture-authoring mode deliberately.

The harness never generated a plausible result or reused a loosely similar request. That would make the trajectory look complete while changing its evidence.

Failure exposed missing test coverage instead of hiding it behind connectivity.

Fixture identity included world state

Matching only tool name and arguments failed for stateful scenarios. The same status query could return pending before a scheduled transition and completed afterward.

The fixture key included scenario version, tool contract revision, normalized request identity, relevant simulated-world revision, and call occurrence where behavior intentionally depended on sequence.

The matcher explained why a request matched or missed. Ambiguous matches failed rather than choosing the first recording.

Replay reproduced observations inside one controlled world, not a bag of canned responses.

Recorded external mutations were never replayed as static success strings alone. A fixture operation updated the scenario's simulated resource state and wrote its own world event.

Status queries observed that state. Duplicate requests could converge under idempotency rules or create a hard failure. Lost acknowledgement could hide an effect from the agent while the world retained it.

The evaluator asserted final resources independently of the agent trace.

This let replay preserve consequence semantics without crossing into a real external system.

Pure tools were explicitly pure

Some local transformations were deterministic for given bytes and configuration. Their contract could permit execution in replay rather than store every output fixture.

Purity was reviewed and tested. The tool received no time, random, network, hidden filesystem, or mutable external input. Its implementation revision and environment joined the cache key. Output digest was verified against expectations where recorded.

Calling a tool read-only was not enough. A live search or file read could observe a changed world.

Replay executed only functions whose full input boundary the harness controlled.

Agents schedule retries, compare deadlines, and interpret freshness. Using the machine clock during replay changed behavior every time.

N17Q supplied scenario time through a controlled clock. Events advanced it explicitly or through fixture rules. Rate-limit responses and approval expiry referred to that clock.

Wall-clock time still measured how long the replay process took and stayed separate in diagnostics. The semantic world time remained deterministic.

A model could ask for current scenario time through an offered tool. It could not read the host clock indirectly through unrestricted commands.

Randomness received stable sources

Fixture IDs, shuffled results, retry jitter, and synthetic content used seeded generators tied to scenario and branch. The seed was configuration evidence, not a claim that model output would become deterministic.

Provider sampling could still vary. Counterfactual runs recorded model configuration and responses separately. The surrounding world remained repeatable enough to compare trajectories.

When randomness affected a consequence, the generated value entered the trace and world event.

Controlled randomness prevented test flakiness from masquerading as agent creativity.

Every repository scenario started from a content-addressed base plus an initial overlay containing deliberate local changes. The replay sandbox mounted a fresh writable overlay.

Commands and file tools operated only there. The final tree digest, diff, test output, and command trace became artifacts. Resetting a replay discarded the overlay and never touched the source repository.

Host home directories, credentials, and unrelated workspace files were absent. Symlink and path resolution stayed within the sandbox root.

Replaying file work meant rebuilding a controlled workspace, not pointing the agent at yesterday's directory.

Network denial was structural

Replay processes had no ambient outbound network. Approved HTTP-style tools were fixture adapters that returned recorded observations. Package managers and repository scripts could not create side channels.

Tests used a known blocked endpoint and attempted DNS, direct addresses, redirects, and subprocess access according to environment capability. A violation stopped the harness.

The model prompt still explained that network was unavailable so it could plan well. Enforcement did not depend on compliance.

Mode integrity was a runtime property.

Fixtures occasionally needed to exercise authorization, redaction, or missing-credential behavior. N17Q supplied scoped synthetic values whose format could trigger the same code paths without granting access.

Record capture removed or replaced real credentials before fixture review. Secret scanners and schema-aware redaction checked stored request and response artifacts.

A fixture containing an unredacted sensitive value failed promotion. Historical records could retain a digest and tombstone without copying the value.

Replay did not require the secrets used when the original connection ran.

Capture was not automatic truth

A recorded response could be malformed, stale, incomplete, or produced under the wrong account scope. Saving it did not certify it as a good fixture.

Promotion reviewed connection identity, request normalization, response classification, sensitive fields, effect state, timestamps, and expected world update. The fixture manifest documented assumptions and unsupported behavior.

For public sources, capture retained permitted excerpts and provenance. For external effects, I preferred hand-authored synthetic fixtures over recording real mutations.

The fixture was controlled evidence about one behavior, not universal provider truth.

Tool schemas and effect semantics changed. A fixture captured under one normalization or error mapping could become misleading under another.

The manifest pinned adapter and contract revisions, normalized request digest, fixture schema, and relevant protocol metadata. Incompatible changes made replay fail with migration required.

A migration could transform safe structural fields, regenerate a pure output, or demand a new reviewed capture. It never silently treated an old success as proof of new behavior.

Version friction protected the meaning of the scenario.

Output truncation was reproduced

The original agent might have seen a bounded excerpt while the capture store held a larger raw response. Replaying the full payload would give it information the historical run lacked.

Fixtures distinguished raw retained observation, adapter-normalized result, and model-visible projection. Replay delivered the projection produced by the pinned adapter and limits.

If retention removed the raw payload, the normalized fixture could remain usable with that limitation documented. Evaluators saw what the agent saw.

Faithful replay preserved information boundaries as well as values.

Some behavior depended on partial delivery, cancellation, or a dropped connection. One final response object could not reproduce it.

N17Q fixtures represented ordered adapter events with controlled scenario time and injection points. They could emit a tool request, delay, return partial usage, commit a simulated effect, and lose the terminal acknowledgement.

The harness checked duplicate and gap handling. Semantic events committed only when their input became valid.

Replay reconstructed uncertainty instead of smoothing it into a completed result.

Approval replay did not reuse human authority

Historical approval records were evidence about the original run. A counterfactual replay could not treat them as live consent for a different branch.

Normal replay could reproduce the recorded decision as a fixture event inside the simulated world. A branch changing arguments, policy, checkpoint, or reviewer decision required a configured simulated approval outcome or paused for current review under a new run identity.

No receipt crossed into real execution because replay had no live adapter.

Consent was replayed as history, not resurrected as power.

Raw response and conversation IDs could help correlate the original run. Replay did not call the provider to continue them.

The checkpoint compiled bounded context from semantic events and artifacts. A new counterfactual model call, when explicitly enabled in evaluation mode, created a child run segment under separate provider policy. It still received only fixture tools.

This allowed model comparison without mixing live tools into replay.

Provider continuity and world replay were separate choices.

Changing prompt, model, policy, tool description, failure timing, or approval created a child run at a checkpoint. The original trace remained immutable.

The branch copied or referenced the same base world snapshot and then received its own simulated events. Its manifest named the controlled difference. Effects in one branch did not appear in another.

Comparisons aligned semantic actions and highlighted the first consequential divergence.

A counterfactual showed what happened in another controlled experiment, not what secretly happened in the original.

Partial replay had hard boundaries

Replaying only one adapter call was useful for debugging parsing. Replaying a full trajectory was necessary for evaluation. I named the modes contract replay, segment replay, and scenario replay.

Each declared which state it reconstructed and which conclusions it could support. A contract replay could verify error mapping and could not grade agent recovery. A segment replay could test compaction from one checkpoint and could not claim end-to-end success.

The UI displayed the replay scope beside results.

Smaller tests stayed valuable without borrowing confidence from the full word replay.

Sometimes I wanted to run the same task against today's provider and current web. N17Q called that a fresh comparison run.

It used new run identity, current configuration, record policy, and a new world manifest. The interface could align it with the old run but did not label changed observations as reproduced.

This prevented an appealing demo from corrupting the archive's meaning. Live systems are useful precisely because they change; replay is useful because controlled parts do not.

Naming the modes protected both experiments.

The run header, trace export, logs, fixture manifest, and policy decisions named record, replay, or fresh comparison. Visual labels were not the enforcement mechanism, but they reduced operator mistakes.

Record mode showed connection and capture consequences. Replay showed fixture coverage and prohibited live access. Switching required ending or branching the run, not toggling a control mid-trajectory.

Artifacts and receipts carried the mode so detached evidence remained interpretable.

An unmistakable boundary helped humans notice when configuration disagreed with intention.

Tests searched for fallthrough

I added a deliberately missing fixture and instrumented every live client constructor. Replay had to fail before any constructor, DNS lookup, credential resolution, or network attempt.

Other cases used unknown tool names, schema revisions, indirect subprocesses, redirects, and provider session IDs. The final simulated world and host-side effect log had to remain clean.

Static inspection checked that replay registries could not import live adapter modules through a generic fallback. Runtime policy provided the stronger evidence.

The dangerous branch was removed, not merely covered by another if.

A percentage of recorded calls looked reassuring and hid which missing cases mattered. N17Q showed coverage by scenario state, tool contract, effect class, error category, and recovery path.

Missing a cosmetic read variant differed from missing the only status query after an unknown external effect. The latter blocked promotion of the scenario as a recovery benchmark.

Each fixture linked to the events and world transitions it could produce. Orphaned recordings and unreachable branches were visible. Coverage described the controlled world available to the run, not lines of fixture code.

Sensitive recordings could be regenerated

When capture included material that should not remain, deleting the raw payload did not require abandoning the whole scenario. A reviewer could replace it with a synthetic observation preserving shape, timing, and relevant semantic properties.

The manifest recorded that substitution and removed claims of byte-level fidelity. Evaluators relying on exact content were disabled or updated. Digests and tombstones preserved why the fixture changed without retaining prohibited data.

This made privacy correction possible without silently rewriting historical evidence.

A recorded fixture could remain internally valid while the live provider changed schema or behavior. N17Q tracked the age and source contract of recordings and scheduled explicit conformance checks in record-capable test environments.

Drift did not mutate existing replay results. It created a new contract observation and, when appropriate, a new scenario version. Comparisons could show whether the agent's trajectory changed under the newer behavior.

Historical reproducibility and current relevance were separate dimensions. One should not be sacrificed to pretend the other stayed fixed.

Replay output was still untrusted

Deterministic tools did not make a model's response correct. The agent could ignore an observation, hallucinate a receipt, violate a constraint in prose, or choose a wasteful path.

N17Q evaluated trace, simulated world, artifacts, budgets, and final account after every replay. A fixture success was evidence about the environment, not a passing grade for the run.

This distinction prevented controlled surroundings from becoming predetermined conclusions.

The scenario, base snapshot, fixture registry, tool contracts, policy, semantic trace, and safe artifacts could export as a versioned package. Another compatible harness could verify digests and reconstruct the simulated world without original provider access.

The package excluded live credentials and made omitted sensitive artifacts explicit. Its README named required runtimes, unsupported behavior, and expected hard invariants.

Portability exposed accidental dependencies on local caches, machine clocks, and hidden services. A replay that worked only on my laptop was still an integration test with undocumented inputs.

After the redesign, the missing status fixture stopped the run with fixture.missing. The checkpoint named the unresolved effect and exact request. No client existed to satisfy it live.

I could deliberately enter fixture-authoring mode, create or review the missing synthetic observation, version the scenario, and replay again. That was slower than an automatic fetch and far more honest.

The run either reproduced its controlled world or admitted that the world definition was incomplete.

Replay earned its name

Record and replay share schemas, adapters concepts, and semantic events. They should not share ambient authority.

Record observes an approved changing world and carefully captures evidence. Replay constructs a controlled world from reviewed fixtures, immutable snapshots, synthetic time, bounded randomness, and absent live capability. Counterfactual evaluation branches from that world under a new identity.

This design does not make model behavior deterministic or fixtures universally realistic. It makes the experiment's boundary inspectable.

A missing recording is inconvenient. A test that silently contacts the present is invalid.

N17Q chose the visible missing contract every time.