The provider transform was refactored (rolling-tail/head cache breakpoints)
after this test was written, so the expected Anthropic payload was stale:
the ephemeral cache_control marker now sits on the last assistant tool_use
and last user tool_result, not on the first user text block. Align the
expectation with the current behavior.

A subtask that failed before the actor signaled onReady (e.g. the actor
service is unavailable or the model is unresolvable) lost its metadata on
the resulting error tool state, because metadata was only reported from
onReady. Seed sessionId/model onto the tool part up-front so it survives a
failure at any point during spawn.

Servers imported from .claude.json carry mcp_origins[name].type === 'claude'
and are meant to connect lazily, but MCP init eagerly connected every
configured server — so a Claude config auto-spawned every local MCP server
on startup and the lifecycle test (expecting 'pending' until an explicit
connect()) failed. Honor the origin marker: leave Claude servers pending.

…nRef

tryStartCheckpointWriter read the Actor service only via the late-bound
global spawnRef, which goes stale when a memoized Actor layer is torn down
by instance disposal elsewhere in the process (observed as cross-test
pollution: the writer skipped with 'Actor service unavailable' depending on
test order). Prefer the Actor service from the live Effect context via
Effect.serviceOption — always present under AppRuntime and robust to the
global going stale — falling back to spawnRef. serviceOption does not add
Actor to requirements, so the layer cycle that motivated spawnRef is intact.

…red DB

The backfill suite inspects ALL FTS rows and only cleared the global DB in
afterEach, so rows left by earlier files in the same shard leaked into its
assertions (saw 11 stray part_ids). Clear the DB in beforeEach too.

Cancelling a workflow run with more agents than the concurrency ceiling
(globalSem = config.workflow.maxConcurrentAgents ?? min(16, 2x cores)) could
spawn orphans and intermittently hang. Two causes, two fixes:

1. Orphan spawns (runtime.ts): the promise-based agent semaphore fires queued
   callbacks as permits free. While reclaim cancels the started agents and frees
   their permits, queued siblings would acquire them and spawn NEW actors that
   escape the cancel sweep. Mark entry.cancelling before reclaim and bail at
   both spawn sites so a late-acquiring agent never starts.

2. Cancel hang (spawn.ts): Actor.cancel awaited each agent's runner cancel,
   which Fiber.interrupts the work fiber and awaits its full unwind. A fiber
   blocked on a hung LLM response stream never finishes unwinding, hanging the
   whole sweep (and runtime.cancel) indefinitely. Bound that interrupt with a
   grace period — the signal is still delivered and the registry status still
   records the cancellation (cancel's contract); we just stop awaiting a stuck
   unwind.

The regression test now pins the ceiling BELOW the fan-out so some agents are
always queued (deterministic on any host), exercising both paths. Verified
20/20 with forced queuing and green across all 4 CI shards.