@enricai/barnacle 1.12.11 → 1.12.13

package/dist/scripts/recon-generate.js

@@ -22,15 +22,18 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveStepPayloadField = resolveStepPayloadField;
+exports.buildKnownFieldValues = buildKnownFieldValues;
 exports.extractStepPersonaValue = extractStepPersonaValue;
 exports.deriveFillLabelField = deriveFillLabelField;
 exports.harvestPersonaBindings = harvestPersonaBindings;
+exports.resolveCompositePersonaFields = resolveCompositePersonaFields;
 exports.inferZodSchemaFromSamples = inferZodSchemaFromSamples;
 exports.selectPayloadAction = selectPayloadAction;
 exports.selectReturnAction = selectReturnAction;
 exports.selectEffectiveResponseBody = selectEffectiveResponseBody;
 exports.extractEntryUrlParams = extractEntryUrlParams;
 exports.selectPrimaryGraphQLOperation = selectPrimaryGraphQLOperation;
+exports.firstEndpointCapture = firstEndpointCapture;
 exports.firstEndpointPath = firstEndpointPath;
 exports.resolveManifestActionSequence = resolveManifestActionSequence;
 exports.extractActionSequence = extractActionSequence;
@@ -41,16 +44,20 @@ exports.indexLabelValueOptionCodes = indexLabelValueOptionCodes;
 exports.buildSelectOptionResolutions = buildSelectOptionResolutions;
 exports.walkSetCookiePairs = walkSetCookiePairs;
 exports.indexStateValues = indexStateValues;
+exports.sanitizeFixtureIdentifier = sanitizeFixtureIdentifier;
 exports.compileActionSteps = compileActionSteps;
 exports.collectHeaderBindings = collectHeaderBindings;
 exports.deriveProducerBoundaryBindings = deriveProducerBoundaryBindings;
 exports.emitMultiStepExecuteHttp = emitMultiStepExecuteHttp;
+exports.buildContractChecklist = buildContractChecklist;
 exports.emitContractTs = emitContractTs;
+exports.assertRequiredUrlFieldsReferenced = assertRequiredUrlFieldsReferenced;
 exports.emitConfigManifest = emitConfigManifest;
 exports.emitBrowserFlowTs = emitBrowserFlowTs;
 exports.emitIndexTs = emitIndexTs;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const ats_field_vocabulary_1 = require("../lib/ats-field-vocabulary");
 const errors_1 = require("../lib/errors");
 const logging_1 = require("../lib/logging");
 const plugin_api_version_1 = require("../plugins/plugin-api-version");
@@ -149,6 +156,35 @@ function locateSpliceSite(instruction) {
         after: instruction.slice(span.index + span.length),
     };
 }
+/**
+ * A quoted span immediately followed by "button"/"link"/"tab" NAMES a control,
+ * not a fill/select VALUE — `click the 'Sign in with email' button` carries no
+ * applicant datum even though the quoted text happens to contain a field-label
+ * word ("email"). Checked ahead of vocabulary matching so a control's own name
+ * can never be mistaken for the data it merely mentions.
+ */
+function namesAControl(instruction) {
+    return findQuoteSpans(instruction).some((span) => /^\s*(button|link|tab)\b/i.test(instruction.slice(span.index + span.length)));
+}
+/** The quoted VALUE a Select/Choose/Fill step carries, per {@link pickValueSpan}'s
+ * grammar rule — used to validate a vocabulary match's ANSWER, not just its label. */
+function pickedQuotedValue(instruction) {
+    const spans = findQuoteSpans(instruction);
+    if (spans.length === 0)
+        return null;
+    const value = pickValueSpan(instruction, spans).value;
+    return value.length > 0 ? value : null;
+}
+/**
+ * Closed-enum answers (Yes/No, decline-to-answer, ...) a Select/Choose step
+ * commonly carries. None of these is ever an applicant's own datum — they are
+ * the RESPONSE to a screening question, not the fact a name/state/phone field
+ * asks for — so a vocabulary label match must never bind one to a payload field.
+ * Generic English grammar, not a domain vocabulary concern, so it belongs here
+ * rather than in any consumer's `--vocabulary`.
+ */
+const OPERATIONAL_ANSWER = /^(yes|no|true|false|n\/a|none|decline(?:\s+to\s+(?:answer|self-identify))?|prefer not to (?:answer|say))$/i;
+const EMPTY_KNOWN_FIELD_VALUES = new Map();
 function toPascalCase(siteId) {
     return siteId
         .split(/[-_]/)
@@ -169,13 +205,23 @@ function toPascalCase(siteId) {
  * @param forceNone when true, force a literal step (the `payloadFieldNone` opt-out)
  * @param vocabulary the consumer's domain vocabulary; defaults to {@link EMPTY_VOCABULARY}
  *   (no splicing) when the caller passes none
+ * @param knownFieldValues field→value pairs the flow already established
+ *   unambiguously via a Fill/Enter/Type step ({@link buildKnownFieldValues}). A
+ *   Select/Choose step's ANSWER must equal the known value for the field a
+ *   label match names, or it is not that field's datum (e.g. a device-type
+ *   dropdown's `'Mobile'` looks like a phone-number field by label alone, but
+ *   is nothing like the number the Fill step already bound).
  * @returns the PascalCase payload field name to splice, or null to keep literal
  */
-function resolveStepPayloadField(instruction, explicit, forceNone, vocabulary = vocabulary_1.EMPTY_VOCABULARY) {
+function resolveStepPayloadField(instruction, explicit, forceNone, vocabulary = vocabulary_1.EMPTY_VOCABULARY, knownFieldValues = EMPTY_KNOWN_FIELD_VALUES) {
     if (forceNone)
         return null;
     if (explicit)
         return explicit;
+    // A control's own name (a button/link/tab label) is never a fill/select VALUE,
+    // even when it happens to contain a word a vocabulary row also matches.
+    if (namesAControl(instruction))
+        return null;
     // A quoted literal or a reserved ${RECON_*} env token IS the recon constant
     // this step would replace, so it is spliceable on its own.
     const hasQuotedConstant = /'[^']*'/.test(instruction) || RESERVED_ENV_TOKEN.test(instruction);
@@ -189,12 +235,53 @@ function resolveStepPayloadField(instruction, explicit, forceNone, vocabulary =
         return null;
     if (vocabulary.exclusions.some((rx) => rx.test(instruction)))
         return null;
+    // A Select/Choose/Pick step names an ANSWER, not a Fill step's self-evident
+    // value — a label match alone can't tell the applicant's own datum from an
+    // operational choice the widget merely offers, so the answer itself is
+    // validated below.
+    const isSelectStep = /\b(select|choose|pick)\b/i.test(instruction);
     for (const [rx, field] of vocabulary.table) {
-        if (rx.test(instruction))
+        if (!rx.test(instruction))
+            continue;
+        if (!isSelectStep)
             return field;
+        const answer = pickedQuotedValue(instruction);
+        if (answer !== null && OPERATIONAL_ANSWER.test(answer.trim()))
+            return null;
+        const known = knownFieldValues.get(field);
+        if (known !== undefined && answer !== known)
+            return null;
+        return field;
     }
     return null;
 }
+/**
+ * Field→value pairs the flow establishes unambiguously via a Fill/Enter/Type
+ * step — the applicant's own datum, per {@link deriveFillLabelField}'s same
+ * self-describing grammar. {@link resolveStepPayloadField} uses this to verify
+ * a Select/Choose step's ANSWER is that SAME datum before binding it to the
+ * field a label match names, catching the mismatch a label alone cannot see
+ * (a field whose label mentions "phone" but whose select answer is a device
+ * type, not a number).
+ */
+function buildKnownFieldValues(flowSteps, vocabulary, env) {
+    const known = new Map();
+    for (const step of flowSteps) {
+        const isObj = typeof step !== "string";
+        const instruction = isObj ? step.step : step;
+        if (!/^\s*(?:fill(?:\s+in)?|enter|type)\b/i.test(instruction))
+            continue;
+        const field = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary) ?? deriveFillLabelField(instruction);
+        if (field === null)
+            continue;
+        const value = extractStepPersonaValue(instruction, env);
+        if (value === null)
+            continue;
+        if (!known.has(field))
+            known.set(field, value);
+    }
+    return known;
+}
 /**
  * Extracts the concrete persona VALUE a flow step fills — the recon-supplied
  * constant that appears verbatim in the captured request body — so the body
@@ -267,7 +354,7 @@ function deriveFillLabelField(instruction) {
     const label = /\b(?:fill(?:\s+in)?|enter|type)\s+(?:in\s+)?the\s+(.+?)\s+field\b/i.exec(instruction)?.[1];
     if (label === undefined)
         return null;
-    return fieldNameToPascalCase(label, null);
+    return (0, ats_field_vocabulary_1.resolveCanonicalAtsFieldName)(label) ?? fieldNameToPascalCase(label, null);
 }
 /**
  * Builds the map from a recon persona VALUE (as it appears in the captured
@@ -284,10 +371,11 @@ function deriveFillLabelField(instruction) {
  */
 function harvestPersonaBindings(flowSteps, vocabulary, env) {
     const bindings = new Map();
+    const knownFieldValues = buildKnownFieldValues(flowSteps, vocabulary, env);
     for (const step of flowSteps) {
         const isObj = typeof step !== "string";
         const instruction = isObj ? step.step : step;
-        const vocabField = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary);
+        const vocabField = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary, knownFieldValues);
         // Vocabulary wins outright. Only on a miss do we fall back to deriving the
         // field from the instruction's own label — and never when the author opted
         // the step out (`payloadFieldNone`) or the vocabulary explicitly excluded it.
@@ -307,6 +395,71 @@ function harvestPersonaBindings(flowSteps, vocabulary, env) {
     }
     return bindings;
 }
+/**
+ * Detects a flow step whose quoted VALUE is the space-joined concatenation of
+ * two already-known field values (either order), e.g. a signature step whose
+ * label the vocabulary doesn't recognize but whose value is `${FirstName}
+ * ${LastName}`. {@link resolveStepPayloadField} only ever resolves a SINGLE
+ * field per step, so a composite value like this falls through its label
+ * match entirely and the persona literal would otherwise survive emission.
+ *
+ * @returns the two known fields (in the order they appear in the value), or
+ *   null when the step's value is not such a concatenation
+ */
+function resolveCompositePersonaFields(instruction, knownFieldValues) {
+    const spans = findQuoteSpans(instruction);
+    if (spans.length === 0)
+        return null;
+    const value = pickValueSpan(instruction, spans).value;
+    if (value.length === 0)
+        return null;
+    for (const [fieldA, valueA] of knownFieldValues) {
+        for (const [fieldB, valueB] of knownFieldValues) {
+            if (fieldA === fieldB)
+                continue;
+            if (value === `${valueA} ${valueB}`)
+                return { fieldA, fieldB };
+        }
+    }
+    return null;
+}
+/**
+ * Every persona literal a generated flow could leak: each single known field
+ * value, plus both concatenation orders of every distinct pair — the same
+ * composite shape {@link resolveCompositePersonaFields} splices. Feeds
+ * {@link assertNoLeakedPersonaConstant}'s final safety-net scan so a splice
+ * miss (single OR composite) is caught regardless of which matching path
+ * should have handled it.
+ */
+function allPersonaLiterals(knownFieldValues) {
+    const entries = [...knownFieldValues.entries()];
+    const literals = entries.map(([, value]) => value);
+    for (const [fieldA, valueA] of entries) {
+        for (const [fieldB, valueB] of entries) {
+            if (fieldA === fieldB)
+                continue;
+            literals.push(`${valueA} ${valueB}`);
+        }
+    }
+    return literals.filter((value) => value.length > 0);
+}
+/**
+ * Final safety net: throws if any known persona constant — single field or
+ * composite concatenation — still appears verbatim as a quoted literal in the
+ * fully-built flow code. Every splice path above (vocabulary match, derived
+ * label, composite match) is a heuristic; this is the loud failure that
+ * catches whatever heuristic missed rather than shipping the recon identity's
+ * own data as a frozen literal in every caller's submission.
+ *
+ * @throws when a persona literal survives emission
+ */
+function assertNoLeakedPersonaConstant(code, knownFieldValues) {
+    for (const value of allPersonaLiterals(knownFieldValues)) {
+        if (code.includes(`'${value}'`)) {
+            throw new Error(`recon-generate: persona constant '${value}' survived emission — a flow step failed to splice its known field value to payload.<field>`);
+        }
+    }
+}
 /**
  * How deep to infer before collapsing to z.unknown(). Deep enough to reach the
  * fields that carry meaning on real inventory APIs — a listing's price
@@ -621,9 +774,6 @@ function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null)
 function isGraphQL(captures) {
     return captures.some((c) => c.operationName !== null);
 }
-function firstSuccessfulReplayBody(replays) {
-    return replays.find((r) => r.success)?.replayBody ?? null;
-}
 function firstGraphQLQuery(captures) {
     return captures.find((c) => c.query)?.query ?? null;
 }
@@ -639,16 +789,22 @@ function firstGraphQLQuery(captures) {
  * flow's own `payloadField` facets appearing in the candidate's query/variables,
  * a non-landing capture phase, and how often the same operation re-fires are
  * combined into one composite score.
+ *
+ * The `payloadField` facets are drawn from {@link resolveStepPayloadField} with
+ * {@link buildKnownFieldValues}'s known-value guard applied, so an operational
+ * Select answer (e.g. a device-type dropdown) never contributes a spurious
+ * facet match to the ranking.
  */
-function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary) {
+function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, env = process.env) {
     const candidates = captures.filter((c) => c.status >= 200 && c.status < 300 && c.query !== null && !/^\s*mutation\b/.test(c.query));
     if (candidates.length === 0)
         return null;
+    const knownFieldValues = buildKnownFieldValues(flowSteps, vocabulary, env);
     const payloadFields = new Set();
     for (const step of flowSteps) {
         const isObj = typeof step !== "string";
         const instruction = isObj ? step.step : step;
-        const field = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary);
+        const field = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary, knownFieldValues);
         if (field !== null)
             payloadFields.add(field);
     }
@@ -701,11 +857,17 @@ function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary) {
     })();
     return { capture: winner.capture, endpointPath };
 }
-function firstEndpointPath(captures) {
+/**
+ * Resolves the same primary-endpoint capture that {@link firstEndpointPath}
+ * derives a path string from, so non-GraphQL flows can also read that
+ * capture's own `.responseBody` instead of an array-order-first replay.
+ */
+function firstEndpointCapture(captures) {
     const nonGetCaptures = captures.filter((c) => c.method !== "GET");
     for (const c of nonGetCaptures) {
         try {
-            return new URL(c.url).pathname;
+            new URL(c.url);
+            return c;
         }
         catch {
             // skip
@@ -713,13 +875,23 @@ function firstEndpointPath(captures) {
     }
     for (const c of captures) {
         try {
-            return new URL(c.url).pathname;
+            new URL(c.url);
+            return c;
         }
         catch {
             // skip
         }
     }
-    return "/api/search";
+    return null;
+}
+function firstEndpointPath(captures) {
+    try {
+        const capture = firstEndpointCapture(captures);
+        return capture ? new URL(capture.url).pathname : "/api/search";
+    }
+    catch {
+        return "/api/search";
+    }
 }
 /**
  * Builds the compiled submit-pattern predicate. A flow-declared regex that
@@ -1256,6 +1428,12 @@ function looksLikeSectionFieldsArray(arr, formSchema) {
 }
 function assignFieldNamesFromArray(arr, fieldNameMap, fieldOptionsMap, formSchema) {
     let currentPrefix = null;
+    // Repeated/indexed headings (e.g. "Reference #1") must keep suppressing
+    // canonicalization to avoid colliding a nested entity's field with the
+    // applicant's own top-level field. Plain grouping headings with no
+    // repetition marker (e.g. "CONTACT INFORMATION") still describe the
+    // applicant, so canonicalization must still apply under them.
+    let currentPrefixIsRepeated = false;
     const usedNames = new Set([...fieldNameMap.values()]);
     // First field-name key is the machine code (preferred, PascalCased directly);
     // any later key is a human label (subject to the section-heading heuristic).
@@ -1270,8 +1448,9 @@ function assignFieldNamesFromArray(arr, fieldNameMap, fieldOptionsMap, formSchem
         const name = labelKey !== undefined ? obj[labelKey] : obj[codeKey ?? ""];
         let semantic = null;
         if (typeof sourceCode === "string" && sourceCode.trim().length > 0) {
-            semantic = sourceCodeToPascalCase(sourceCode);
+            semantic = (0, ats_field_vocabulary_1.resolveCanonicalAtsFieldName)(sourceCode) ?? sourceCodeToPascalCase(sourceCode);
             currentPrefix = null;
+            currentPrefixIsRepeated = false;
         }
         else if (typeof name === "string" && name.trim().length > 0 && name.length < 250) {
             const hasNoSourceCode = typeof sourceCode !== "string" || sourceCode.trim().length === 0;
@@ -1287,10 +1466,23 @@ function assignFieldNamesFromArray(arr, fieldNameMap, fieldOptionsMap, formSchem
                 const headingPrefix = fieldNameToPascalCase(name, null);
                 if (headingPrefix !== null) {
                     currentPrefix = headingPrefix;
+                    // Only a repeated/indexed heading (e.g. "Reference #1", "Employer 2")
+                    // marks a nested sub-entity whose fields must stay prefixed to avoid
+                    // colliding with the applicant's own top-level field name. A trailing
+                    // 1-2 digit index, standing on its own word boundary, is a repetition
+                    // marker; a longer digit run (e.g. a year in "EMPLOYMENT HISTORY
+                    // 2024") is not, and must still canonicalize underneath it.
+                    currentPrefixIsRepeated = /\b\d{1,2}\s*$/.test(name) || name.includes("#");
                 }
                 continue;
             }
             semantic = fieldNameToPascalCase(name, currentPrefix);
+            if (!currentPrefixIsRepeated) {
+                const canonical = (0, ats_field_vocabulary_1.resolveCanonicalAtsFieldName)(name);
+                if (canonical !== null) {
+                    semantic = canonical;
+                }
+            }
         }
         if (semantic !== null && !fieldNameMap.has(fieldId)) {
             let unique = semantic;
@@ -1617,6 +1809,7 @@ function buildSelectOptionResolutions(flowSteps, captures, vocabulary, env) {
     const resolutions = [];
     const rawCodeFields = new Map();
     const seenWireKeys = new Set();
+    const knownFieldValues = buildKnownFieldValues(flowSteps, vocabulary, env);
     for (const step of flowSteps) {
         const instruction = typeof step === "string" ? step : step.step;
         if (!/^\s*(select|choose|pick)\b/i.test(instruction) && !/\bselect\b/i.test(instruction)) {
@@ -1674,7 +1867,7 @@ function buildSelectOptionResolutions(flowSteps, captures, vocabulary, env) {
         }
         // Fallback: no id= — resolve the wire key from the vocabulary persona field
         // (lowercased) and the code from the global {label,value} map by label.
-        const field = resolveStepPayloadField(instruction, typeof step === "string" ? undefined : step.payloadField, typeof step === "string" ? undefined : step.payloadFieldNone, vocabulary);
+        const field = resolveStepPayloadField(instruction, typeof step === "string" ? undefined : step.payloadField, typeof step === "string" ? undefined : step.payloadFieldNone, vocabulary, knownFieldValues);
         if (field === null)
             continue;
         const code = labelValue.get(label);
@@ -2035,6 +2228,19 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
 function isValidJsIdentifier(s) {
     return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(s);
 }
+/** Derives a valid camelCase identifier from a fixture filename (e.g.
+ * "10219132.json" -> "fixture10219132", "acme-metrics.config.json" ->
+ * "acmeMetricsConfig") for use in generated `loadFixture` const lines. */
+function sanitizeFixtureIdentifier(filename) {
+    const camelCased = filename
+        .replace(/\.json$/, "")
+        .split(/[^A-Za-z0-9_$]+/)
+        .filter(Boolean)
+        .map((part, i) => (i === 0 ? part : `${part.charAt(0).toUpperCase()}${part.slice(1)}`))
+        .join("");
+    const stripped = camelCased.replace(/[^A-Za-z0-9_$]/g, "");
+    return isValidJsIdentifier(stripped) ? stripped : `fixture${stripped}`;
+}
 /**
  * Converts a path like ["Auth","Token"] to a JS access expression ".Auth.Token".
  * Identifier segments use dot access; numeric / non-identifier segments use
@@ -3313,12 +3519,54 @@ function bindOptionLiteral(headerBindings) {
 // ── code emitters ─────────────────────────────────────────────────────────────
 /** Generates a complete contract.ts source string for a plugin — exported so
  * unit tests can drive the emitter directly without spawning the CLI. */
+/**
+ * Splices payload fields into a string variable that packs filter facets as
+ * delimited `key:value` segments (e.g. a product-catalog `filters` variable
+ * shaped like `category:widgets|priceRange:10~50`) — the shape GraphQL search
+ * endpoints commonly use instead of exposing each facet as its own top-level
+ * variable, which is otherwise invisible to the key-name-equality strategy in
+ * {@link renderGqlVariablesExpr}. Every facet segment whose key correlates
+ * (case-insensitively) with one of `fields` gets its value slot spliced with
+ * `payload.<Field>`; segments that don't correlate are left as their literal
+ * `key:value` piece. Returns `null` for non-string values, strings with no
+ * delimiter-separated `key:value` segment, and strings whose facet keys
+ * correlate with none of `fields`, so opaque tokens, JSON blobs, and plain
+ * literals fall through to the existing JSON.stringify path unchanged.
+ */
+function spliceFacetsIntoStringVariable(value, fields) {
+    if (typeof value !== "string")
+        return null;
+    const segments = value.split(/([|,;])/);
+    const hasFacetShape = segments.some((segment, index) => index % 2 === 0 && segment.includes(":"));
+    if (!hasFacetShape)
+        return null;
+    let hasMatch = false;
+    const body = segments
+        .map((segment, index) => {
+        if (index % 2 !== 0 || !segment.includes(":"))
+            return escapeForTemplateLiteral(segment);
+        const colonIndex = segment.indexOf(":");
+        const facetKey = segment.slice(0, colonIndex);
+        const matchedField = fields.find((field) => field.toLowerCase() === facetKey.toLowerCase());
+        if (!matchedField)
+            return escapeForTemplateLiteral(segment);
+        hasMatch = true;
+        return `${escapeForTemplateLiteral(`${facetKey}:`)}\${payload.${matchedField}}`;
+    })
+        .join("");
+    if (!hasMatch)
+        return null;
+    return `\`${body}\``;
+}
 /**
  * Renders the variables literal for the primary-operation getGql() call —
  * each key from the selected capture's own recorded variables is bound to
  * `payload.<Field>` when it correlates (case-insensitively) with one of the
- * flow's payloadFieldNames, otherwise the captured literal value is emitted
- * verbatim via JSON.stringify.
+ * flow's payloadFieldNames. When no top-level key correlates and the value is
+ * a string packing facets in a delimited `key:value` grammar (see
+ * {@link spliceFacetsIntoStringVariable}), a correlated facet's value slot is
+ * spliced with `payload.<Field>` instead of freezing the whole string; any
+ * other value is emitted verbatim via JSON.stringify.
  */
 function renderGqlVariablesExpr(variables, payloadFieldNames) {
     if (variables === null || typeof variables !== "object" || Array.isArray(variables))
@@ -3326,13 +3574,54 @@ function renderGqlVariablesExpr(variables, payloadFieldNames) {
     const fields = payloadFieldNames ? [...payloadFieldNames] : [];
     const entries = Object.entries(variables).map(([key, value]) => {
         const matchedField = fields.find((field) => field.toLowerCase() === key.toLowerCase());
-        const valueExpr = matchedField ? `payload.${matchedField}` : JSON.stringify(value);
+        const facetSpliceExpr = matchedField ? null : spliceFacetsIntoStringVariable(value, fields);
+        const valueExpr = matchedField
+            ? `payload.${matchedField}`
+            : (facetSpliceExpr ?? JSON.stringify(value));
         return `${key}: ${valueExpr}`;
     });
     return entries.length > 0 ? `{ ${entries.join(", ")} }` : "{}";
 }
+/**
+ * Same review-checklist items the pre-move contract.ts header used to embed,
+ * now surfaced on recon-generate's own stdout instead of the shipped file —
+ * call with the exact same opts passed to {@link emitContractTs} so the two
+ * can never drift out of sync.
+ */
+function buildContractChecklist(opts) {
+    const { pascal, gql, omitExecuteHttp, multiStepBody } = opts;
+    const queryChecklistLine = !omitExecuteHttp && gql
+        ? `Trim UI-only fields from ${pascal.toUpperCase()}_QUERY (keep only fields you need)`
+        : "";
+    // Multi-step flows validate each call against its own per-call inferred
+    // schema (emitMultiStepExecuteHttp) — narrowing ResponseSchema only changes
+    // what executeHttp promises ITS OWN caller, never a per-call validator, so
+    // the checklist item must say that explicitly. Single-endpoint plugins have
+    // exactly one call, so the client schema and that call's validator are the
+    // same schema and the shorter wording stays accurate. Browser-flow-only
+    // plugins have no executeHttp at all, so ResponseSchema is only ever the
+    // browser flow's own return-value contract.
+    const narrowSchemaChecklistLine = omitExecuteHttp
+        ? `Narrow ${pascal}ResponseSchema to match what the browser flow should promise ITS CALLER — this flow could not synthesize a trustworthy executeHttp (a required value from the captured sequence never resolved), so it ships browser-only`
+        : multiStepBody
+            ? `Narrow ${pascal}ResponseSchema to match what executeHttp should promise ITS CALLER — this is the plugin's own return-value contract, not a per-call validator (each call in the flow is already checked against its own inferred schema)`
+            : `Narrow ${pascal}ResponseSchema to match the real response shape`;
+    const baseHeadersChecklistLine = omitExecuteHttp
+        ? ""
+        : "Verify BASE_HEADERS — remove any that aren't load-bearing";
+    const outOfTreeChecklistLine = omitExecuteHttp
+        ? "Out-of-tree: `pnpm add zod` — this file imports it directly, and a strict node_modules layout (pnpm) won't resolve it as a transitive dep of @enricai/barnacle alone"
+        : "Out-of-tree: `pnpm add bottleneck zod` — this file imports both directly, and a strict node_modules layout (pnpm) won't resolve them as transitive deps of @enricai/barnacle alone";
+    return [
+        queryChecklistLine,
+        narrowSchemaChecklistLine,
+        `Adjust ${pascal}PayloadSchema to your actual request parameters`,
+        baseHeadersChecklistLine,
+        outOfTreeChecklistLine,
+    ].filter((line) => line !== "");
+}
 function emitContractTs(opts) {
-    const { siteId, pascal, baseUrl, baseHeaders, minTime, safeRps, responseBody, gql, gqlQuery, endpointPath, gqlOperationName, gqlVariables, auxFiles, multiStepBody, omitExecuteHttp = false, inputBody, hasMultipartStep = false, discoveredFormFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, discoveredStructuredKeys, payloadFieldNames, headerBindings = [], } = opts;
+    const { siteId, pascal, baseUrl, baseHeaders, minTime, safeRps, hasRateLimitProbeData = false, responseBody, gql, gqlQuery, endpointPath, gqlOperationName, gqlVariables, auxFiles, multiStepBody, omitExecuteHttp = false, isSubmissionFlow = false, inputBody, hasMultipartStep = false, discoveredFormFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, discoveredStructuredKeys, payloadFieldNames, headerBindings = [], } = opts;
     // This is the CLIENT-level schema — createHttpClient's default, and the
     // plugin's caller-facing contract (what executeHttp's return value promises
     // its own caller). It does NOT validate any individual call in a multi-step
@@ -3351,8 +3640,16 @@ function emitContractTs(opts) {
     // Single-endpoint plugins keep the same inferred-schema treatment, since
     // there both roles (client default and sole call) coincide.
     // Browser-flow-only plugins have no HTTP call to infer a shape from —
-    // z.unknown() there is the honest gap, not a narrowing shortcut.
-    const responseSchemaExpr = omitExecuteHttp ? `z.unknown()` : inferZodSchema(responseBody);
+    // z.unknown() there is the honest gap, not a narrowing shortcut. A
+    // submission flow is the exception: runHealingFlow's submitStep
+    // verification already throws StepVerificationError on failure, so a
+    // successful return IS a real signal — z.unknown() would be dishonest
+    // in the other direction, hiding a field the flow can actually promise.
+    const responseSchemaExpr = omitExecuteHttp && isSubmissionFlow
+        ? `z.object({ verified: z.boolean() })`
+        : omitExecuteHttp
+            ? `z.unknown()`
+            : inferZodSchema(responseBody);
     // Multi-step flows that include a multipart upload need the binary asset
     // on the payload. ApplicantContactSchema (via ApplicantResumeSchema) already
     // declares Resume/ResumeContentType/ResumeFilename, so submission flows
@@ -3498,6 +3795,7 @@ function emitContractTs(opts) {
     const sortedAdditionalKeys = discoveredAdditionalBodyKeys
         ? [...discoveredAdditionalBodyKeys.entries()].sort(([a], [b]) => a.localeCompare(b))
         : [];
+    let usesMultipartBoolean = false;
     for (const [name, kind] of sortedAdditionalKeys) {
         if (isReservedByApplicantContactSchema(name))
             continue;
@@ -3513,6 +3811,8 @@ function emitContractTs(opts) {
                 : payloadNeedsMultipart
                     ? "multipartBoolean()"
                     : "z.boolean()";
+        if (zod === "multipartBoolean()")
+            usesMultipartBoolean = true;
         addExtendField(name, `  ${name}: ${zod},`);
     }
     // Mechanism B: nested caller structures become payload fields carrying their
@@ -3541,6 +3841,9 @@ function emitContractTs(opts) {
     const internalRequestReferenceExpr = inputBody
         ? inferZodSchema(inputBody, 0, "", { multipartCoerce: hasMultipartStep })
         : null;
+    if (internalRequestReferenceExpr?.includes("multipartBoolean(")) {
+        usesMultipartBoolean = true;
+    }
     // All field sources above are merged into a SINGLE `.extend({...})` object
     // literal, keyed by field name — a name that recurs across sources (or
     // that collides with the base extend's own Email/ClickUrl/Answers) collapses
@@ -3550,12 +3853,12 @@ function emitContractTs(opts) {
     const payloadSchemaExpr = `${basePayloadSchemaExpr}${mergedExtension}`;
     // basePayloadSchemaExpr's own Answers field always wraps in
     // multipartJsonObject() for submission flows (inputBody set);
-    // multipartBoolean() and the structured-keys wrapping above are needed
-    // whenever payloadNeedsMultipart is true (an upload step OR a non-scalar
-    // discoveredStructuredKeys field).
+    // multipartBoolean() is only imported when a boolean field was actually
+    // wrapped in it above (an additional-body-key or an inputBody field under
+    // multipartCoerce) — payloadNeedsMultipart alone doesn't imply that.
     // Named imports from the same module are combined into one import statement.
     const zodMultipartNamedImports = [
-        ...(payloadNeedsMultipart ? ["multipartBoolean"] : []),
+        ...(usesMultipartBoolean ? ["multipartBoolean"] : []),
         ...(inputBody || (payloadNeedsMultipart && sortedStructuredEntries.length > 0)
             ? ["multipartJsonObject"]
             : []),
@@ -3569,7 +3872,7 @@ function emitContractTs(opts) {
         ? `import { ApplicantContactSchema } from "${ENGINE_PKG}/lib/applicant-payload";\n`
         : "";
     // Content-Type must be absent from multipart fetch calls so FormData can inject the boundary.
-    const caseInsensitiveHeadersImport = hasMultipartStep
+    const caseInsensitiveHeadersImport = hasMultipartStep && !omitExecuteHttp
         ? `import { omitHeaderCaseInsensitive } from "${ENGINE_PKG}/lib/case-insensitive-headers";\n`
         : "";
     // Emit identifier-shaped keys unquoted so Biome's formatter doesn't rewrite
@@ -3634,7 +3937,7 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
     const fixtureComments = auxFiles.length > 0
         ? `\n// Fixtures downloaded by recon — commit to src/sites/${siteId}/fixtures/ and uncomment:\n` +
             auxFiles
-                .map((f) => `// const ${f.replace(".json", "")} = loadFixture(${JSON.stringify(siteId)}, ${JSON.stringify(f)}, z.unknown());`)
+                .map((f) => `// const ${sanitizeFixtureIdentifier(f)} = loadFixture(${JSON.stringify(siteId)}, ${JSON.stringify(f)}, z.unknown());`)
                 .join("\n") +
             "\n"
         : "";
@@ -3657,22 +3960,6 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
 export const ${pascal}InternalRequestReference = ${internalRequestReferenceExpr};
 `
         : "";
-    const queryChecklistLine = !omitExecuteHttp && gql
-        ? `\n *   [ ] Trim UI-only fields from ${pascal.toUpperCase()}_QUERY (keep only fields you need)`
-        : "";
-    // Multi-step flows validate each call against its own per-call inferred
-    // schema (emitMultiStepExecuteHttp) — narrowing ResponseSchema only changes
-    // what executeHttp promises ITS OWN caller, never a per-call validator, so
-    // the checklist item must say that explicitly. Single-endpoint plugins have
-    // exactly one call, so the client schema and that call's validator are the
-    // same schema and the shorter wording stays accurate. Browser-flow-only
-    // plugins have no executeHttp at all, so ResponseSchema is only ever the
-    // browser flow's own return-value contract.
-    const narrowSchemaChecklistLine = omitExecuteHttp
-        ? `\n *   [ ] Narrow ${pascal}ResponseSchema to match what the browser flow should promise ITS CALLER — this flow could not synthesize a trustworthy executeHttp (a required value from the captured sequence never resolved), so it ships browser-only`
-        : multiStepBody
-            ? `\n *   [ ] Narrow ${pascal}ResponseSchema to match what executeHttp should promise ITS CALLER — this is the plugin's own return-value contract, not a per-call validator (each call in the flow is already checked against its own inferred schema)`
-            : `\n *   [ ] Narrow ${pascal}ResponseSchema to match the real response shape`;
     const camel = siteId.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
     // Browser-flow-only plugins need neither Bottleneck (no rate-limited HTTP
     // client) nor BASE_HEADERS (no per-call headers to bake in) — both would
@@ -3685,10 +3972,13 @@ const BASE_HEADERS: Record<string, string> = {
 ${headersLiteral},
 };
 `;
+    const rateLimitComment = hasRateLimitProbeData
+        ? `// Safe ceiling: ${safeRps} rps — from recon rate-limit probe.`
+        : `// Safe ceiling: ${safeRps} rps — DEFAULT (no rate-limit probe data; run recon:http).`;
     const limiterBlock = omitExecuteHttp
         ? ""
         : `
-// Safe ceiling: ${safeRps} rps — from recon rate-limit probe.
+${rateLimitComment}
 const limiter = new Bottleneck({ minTime: ${minTime} });
 `;
     const executeHttpMethodBlock = omitExecuteHttp
@@ -3696,7 +3986,7 @@ const limiter = new Bottleneck({ minTime: ${minTime} });
         : `
   /** Hot path: direct HTTP — no browser, no LLM tokens. */
   async executeHttp(
-    payload: ${pascal}Payload,
+    ${executeHttpBody.includes("payload.") ? "payload" : "_payload"}: ${pascal}Payload,
     ${executeHttpBody.includes("context.") ? "context" : "_context"}: SitePluginContext
   ): Promise<SitePluginResult<${pascal}Response>> {
 ${executeHttpBody}
@@ -3706,23 +3996,15 @@ ${executeHttpBody}
         ? `/**
  * Plugin for ${siteId}. Browser-flow-only: the captured multi-step submission
  * sequence could not be synthesized into a trustworthy direct-HTTP hot path
- * (see the checklist above), so this always runs via Stagehand.
+ * (see recon-generate's review checklist, logged to stdout at generation
+ * time), so this always runs via Stagehand.
  */`
         : `/**
  * Plugin for ${siteId}. Tries the direct-HTTP hot path first; falls back to
  * Stagehand automatically on schema drift or bot challenge.
  */`;
-    const baseHeadersChecklistLine = omitExecuteHttp
-        ? ""
-        : `\n *   [ ] Verify BASE_HEADERS — remove any that aren't load-bearing`;
-    const outOfTreeChecklistLine = omitExecuteHttp
-        ? `\n *   [ ] Out-of-tree: \`pnpm add zod\` — this file imports it directly, and a\n *       strict node_modules layout (pnpm) won't resolve it as a transitive\n *       dep of @enricai/barnacle alone`
-        : `\n *   [ ] Out-of-tree: \`pnpm add bottleneck zod\` — this file imports both\n *       directly, and a strict node_modules layout (pnpm) won't resolve\n *       them as transitive deps of @enricai/barnacle alone`;
     return `/**
  * Generated by recon-generate.ts — review before shipping.
- *
- * Checklist:${queryChecklistLine}${narrowSchemaChecklistLine}
- *   [ ] Adjust ${pascal}PayloadSchema to your actual request parameters${baseHeadersChecklistLine}${outOfTreeChecklistLine}
  */
 
 ${bottleneckImport}import { z } from "zod/v4";
@@ -3746,11 +4028,11 @@ ${pluginDocComment}
 export const ${camel}Plugin: SitePlugin<${pascal}Payload, ${pascal}Response> = {
   meta: {
     siteId: ${JSON.stringify(siteId)},
-    displayName: ${JSON.stringify(pascal.replace(/([A-Z])/g, " $1").trim())},
     bodySchema: ${pascal}PayloadSchema,
     responseSchema: ${pascal}ResponseSchema,
     defaultBaseUrl: ${JSON.stringify(baseUrl)},
-    // multipart is required whenever the flow itself uploads a file
+    ${payloadNeedsMultipart || inputBody
+        ? `// multipart is required whenever the flow itself uploads a file
     // (hasMultipartStep), OR this is a submission flow (inputBody set) since
     // basePayloadSchemaExpr always requires a real Resume Buffer via
     // ApplicantContactSchema regardless of whether the recorded browser flow
@@ -3758,7 +4040,8 @@ export const ${camel}Plugin: SitePlugin<${pascal}Payload, ${pascal}Response> = {
     // discoveredStructuredKeys field (payloadNeedsMultipart), since the
     // multipart wire format is what makes that field's JSON-stringified
     // encoding parseable.
-    apiVersion: ${JSON.stringify(plugin_api_version_1.PLUGIN_API_VERSION)},${payloadNeedsMultipart || inputBody ? "\n    multipart: true," : ""}
+    `
+        : ""}apiVersion: ${JSON.stringify(plugin_api_version_1.PLUGIN_API_VERSION)},${payloadNeedsMultipart || inputBody ? "\n    multipart: true," : ""}
   },
 ${executeHttpMethodBlock}
   /** Browser fallback: Stagehand + Steel — invoked only when hot path fails. */
@@ -3767,7 +4050,7 @@ ${executeHttpMethodBlock}
     session: BrowserSession,
     context: SitePluginContext
   ): Promise<SitePluginResult<${pascal}Response>> {
-    const raw = await run${pascal}BrowserFlow(session.stagehand, context.baseUrl, payload);
+    const raw = await run${pascal}BrowserFlow(session.stagehand, ${inputBody ? "payload.ClickUrl" : "context.baseUrl"}, payload);
     return { data: raw as ${pascal}Response };
   },
 };
@@ -3778,6 +4061,29 @@ ${executeHttpMethodBlock}
 export { ${camel}Plugin as plugin };
 `;
 }
+/**
+ * Fails generation loudly when the payload schema `emitContractTs` just wrote
+ * declares a required `*Url` field (e.g. `ClickUrl`) that neither the
+ * contract's own `execute()` call site nor the emitted browser flow ever
+ * reads as `payload.<Field>`. A required URL field nothing dereferences means
+ * the flow enters on the wrong page (see
+ * docs/recon-generate-browser-flow-entry-url-pii-and-unverified-submit.md
+ * defect 1) — this generalizes the check past ClickUrl so any future
+ * required URL field regresses loudly instead of silently.
+ */
+function assertRequiredUrlFieldsReferenced(contractCode, browserFlowCode) {
+    const urlFieldLinePattern = /^\s*(\w*Url\w*):\s*z\.\w+\(.*$/gm;
+    const emittedCode = `${contractCode}\n${browserFlowCode}`;
+    const unreferenced = [...contractCode.matchAll(urlFieldLinePattern)]
+        .filter((match) => !match[0].includes(".optional("))
+        .map((match) => match[1])
+        .filter((name) => name !== undefined)
+        .filter((name) => !emittedCode.includes(`payload.${name}`));
+    if (unreferenced.length === 0)
+        return;
+    throw new Error(`recon-generate: required URL field(s) ${unreferenced.join(", ")} declared on the payload schema ` +
+        `but never referenced by the emitted contract or browser flow — the flow would enter on the wrong page`);
+}
 /**
  * Escape a literal string segment so it is safe INSIDE a JS backtick template
  * literal — backslashes, backticks, and `${` interpolation starts must all be
@@ -3805,6 +4111,19 @@ function buildStepInstructionExpr(instruction, field) {
         return JSON.stringify(instruction);
     return `\`${escapeForTemplateLiteral(site.before)}\${payload.${field}}${escapeForTemplateLiteral(site.after)}\``;
 }
+/**
+ * Build the emitted instruction expression for a step whose value is the
+ * concatenation of two known fields ({@link resolveCompositePersonaFields}):
+ * a backtick template literal with the whole quoted value replaced by
+ * `${payload.<fieldA>} ${payload.<fieldB>}`, preserving the single space the
+ * concatenation was built with.
+ */
+function buildCompositeStepInstructionExpr(instruction, fieldA, fieldB) {
+    const site = locateSpliceSite(instruction);
+    if (site === null)
+        return JSON.stringify(instruction);
+    return `\`${escapeForTemplateLiteral(site.before)}\${payload.${fieldA}} \${payload.${fieldB}}${escapeForTemplateLiteral(site.after)}\``;
+}
 /**
  * Build the emitted instruction expression for a step whose splice site is the
  * reserved `${RECON_PASSWORD}` token: a backtick template literal with the
@@ -3876,8 +4195,9 @@ function jsonSchemaTypeOf(value) {
  * browser `flow` is the only execution path, and the field is omitted.
  */
 function emitConfigManifest(opts) {
-    const { siteId, displayName, baseUrl, flowSteps, vocabulary, inputBody, recoveredFields, httpModulePath, } = opts;
+    const { siteId, displayName, baseUrl, flowSteps, vocabulary, inputBody, recoveredFields, httpModulePath, isSubmissionFlow = false, env = process.env, } = opts;
     const payloadFieldNames = new Set();
+    const knownFieldValues = buildKnownFieldValues(flowSteps, vocabulary ?? vocabulary_1.EMPTY_VOCABULARY, env);
     const steps = flowSteps.map((step) => {
         const isObj = typeof step !== "string";
         const instruction = isObj ? step.step : step;
@@ -3896,7 +4216,7 @@ function emitConfigManifest(opts) {
                 return rewritten;
             return { step: rewritten, optional, upload, submitStep };
         }
-        const field = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary);
+        const field = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary, knownFieldValues);
         if (field !== null)
             payloadFieldNames.add(field);
         const rewritten = buildManifestInstruction(instruction, field);
@@ -3907,6 +4227,23 @@ function emitConfigManifest(opts) {
             return rewritten;
         return { step: rewritten, optional, upload, submitStep };
     });
+    // The last step of a submission flow is structurally the submit — force
+    // submitStep:true even when the source recon-flow.json step never declared
+    // it, mirroring emitBrowserFlowTs's forcing (see there) so a config-plugin
+    // load of this manifest also gates on runHealingFlow's submitStep verification.
+    const lastStepIndex = steps.length - 1;
+    const lastStep = steps[lastStepIndex];
+    if (isSubmissionFlow && lastStep !== undefined) {
+        steps[lastStepIndex] =
+            typeof lastStep === "string"
+                ? { step: lastStep, optional: false, upload: false, submitStep: true }
+                : {
+                    step: lastStep.step,
+                    optional: lastStep.optional,
+                    upload: lastStep.upload,
+                    submitStep: true,
+                };
+    }
     // The request surface, widest wins: a flow splice, a recovered form field, or
     // a key from the first POST body all name something a caller controls. Splices
     // and recovered fields are strings (the browser flow fills them as text); a
@@ -3927,7 +4264,7 @@ function emitConfigManifest(opts) {
     const manifest = {
         apiVersion: plugin_manifest_envelope_1.CONFIG_PLUGIN_API_VERSION,
         kind: plugin_manifest_envelope_1.CONFIG_PLUGIN_KIND,
-        metadata: { siteId, displayName },
+        metadata: { siteId, ...(displayName !== undefined && { displayName }) },
         spec: {
             defaultBaseUrl: baseUrl,
             ...(httpModulePath ? { httpModule: httpModulePath } : {}),
@@ -3957,9 +4294,10 @@ function emitConfigManifest(opts) {
  * payload schema (both are driven by this same set).
  */
 function emitBrowserFlowTs(opts) {
-    const { siteId, pascal, flowSteps, isSubmissionFlow, hasMultipartStep = false, vocabulary, frameSelector, } = opts;
+    const { siteId, pascal, flowSteps, isSubmissionFlow, hasMultipartStep = false, vocabulary, frameSelector, env = process.env, } = opts;
     const payloadFieldNames = new Set();
     const hasUploadStep = flowSteps.some((s) => typeof s !== "string" && s.upload === true);
+    const knownFieldValues = buildKnownFieldValues(flowSteps, vocabulary ?? vocabulary_1.EMPTY_VOCABULARY, env);
     let usesThrowawayPassword = false;
     const stepLiterals = flowSteps.map((step) => {
         const isObj = typeof step !== "string";
@@ -3977,15 +4315,31 @@ function emitBrowserFlowTs(opts) {
             const submitStep = isObj ? step.submitStep === true : false;
             return `  { instruction: ${instructionExpr}, optional: ${optional}, upload: ${upload}, submitStep: ${submitStep} },`;
         }
-        const field = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary);
+        const field = resolveStepPayloadField(instruction, isObj ? step.payloadField : undefined, isObj ? step.payloadFieldNone : undefined, vocabulary, knownFieldValues);
+        const composite = field === null && !(isObj && step.payloadFieldNone)
+            ? resolveCompositePersonaFields(instruction, knownFieldValues)
+            : null;
         if (field !== null)
             payloadFieldNames.add(field);
-        const instructionExpr = buildStepInstructionExpr(instruction, field);
+        if (composite !== null) {
+            payloadFieldNames.add(composite.fieldA);
+            payloadFieldNames.add(composite.fieldB);
+        }
+        const instructionExpr = composite !== null
+            ? buildCompositeStepInstructionExpr(instruction, composite.fieldA, composite.fieldB)
+            : buildStepInstructionExpr(instruction, field);
         const optional = isObj ? step.optional === true : false;
         const upload = isObj ? step.upload === true : false;
         const submitStep = isObj ? step.submitStep === true : false;
         return `  { instruction: ${instructionExpr}, optional: ${optional}, upload: ${upload}, submitStep: ${submitStep} },`;
     });
+    // The last step of a submission flow is structurally the submit — force
+    // submitStep:true even when the source recon-flow.json step never declared
+    // it, so the engine's pre-submit probe/StepVerificationError actually gates it.
+    const lastStepLiteral = stepLiterals.at(-1);
+    if (isSubmissionFlow && lastStepLiteral !== undefined) {
+        stepLiterals[stepLiterals.length - 1] = lastStepLiteral.replace(/submitStep: (true|false)(?= \},)/, "submitStep: true");
+    }
     const flowStepsBlock = stepLiterals.length > 0
         ? stepLiterals.join("\n")
         : "  // TODO: no flow steps were parsed. Re-run recon-browser with a --flow\n" +
@@ -4012,8 +4366,8 @@ function emitBrowserFlowTs(opts) {
  * Core invokes this automatically when executeHttp throws HttpSchemaError or
  * HttpBotChallengeError. Update the flow steps and extract schema as needed.
  *
- * Steps whose instruction named a candidate PII label have their recon
- * constant spliced to \`payload.<field>\` so the caller's real applicant reaches
+ * Steps whose instruction named a labeled payload field have their recon
+ * constant spliced to \`payload.<field>\` so the caller's real value reaches
  * the page; operational-default steps stay literal. The steps run through the
  * self-heal cascade via runHealingFlow — the same engine the recon CLI uses,
  * minus its disk-dump/replan layer.
@@ -4030,9 +4384,13 @@ import type { ${pascal}Payload, ${pascal}Response } from "@/sites/${siteId}/cont
 
 const logger = getLogger({ name: "${siteId}-browser-flow" });
 
-const ${pascal}BrowserSchema = z.object({
-  // TODO: define the fields you need — align with ${pascal}Response
-  extraction: z.string(),
+const ${pascal}BrowserSchema = z.object({${isSubmissionFlow
+        ? `
+  // runHealingFlow throws StepVerificationError on a failed submitStep, so
+  // reaching this point already proves the submission verified.
+  verified: z.boolean(),`
+        : `
+  extraction: z.string(),`}
 });
 
 /**
@@ -4042,13 +4400,13 @@ const ${pascal}BrowserSchema = z.object({
  */
 export async function run${pascal}BrowserFlow(
   stagehand: Stagehand,
-  baseUrl: string,
+  ${isSubmissionFlow ? "entryUrl" : "baseUrl"}: string,
   payload: ${pascal}Payload
 ): Promise<${pascal}Response> {
   const page = await stagehand.context.awaitActivePage();
 
-  await page.goto(baseUrl, { waitUntil: "networkidle" });
-  // networkidle can resolve before a Cloudflare-fronted SPA hydrates; wait for
+  await page.goto(${isSubmissionFlow ? "entryUrl" : "baseUrl"}, { waitUntil: "networkidle" });
+  // networkidle can resolve before a bot-managed/CDN-fronted SPA hydrates; wait for
   // the real DOM so the first steps don't probe an empty shell page and skip.
   await waitForSpaReady(page, logger);
 ${usesThrowawayPassword ? "\n  // Minted once per run — the flow needs a credential to authenticate, but\n  // there is no caller-supplied Password field on the payload to splice.\n  const throwawayPassword = generateThrowawayPassword();\n" : ""}
@@ -4074,16 +4432,37 @@ ${flowStepsBlock}
   // both Zod v3 and v4 schemas natively (StagehandZodSchema union since
   // 2.4.3 / PR #944), and the caller-side safeParse defends against SDK
   // contract drift. Widen ${pascal}BrowserSchema as needed to match the
-  // fields the recon flow actually surfaces.
+  // fields the recon flow actually surfaces.${isSubmissionFlow
+        ? `
+  // runHealingFlow above already verified the submit (submitStep:true), so the
+  // application is already committed at the ATS. A schema-validation or
+  // watchdog-timeout throw from this trailing confirmation extract must not
+  // propagate and trigger a duplicate re-dispatch — catch it, log it, and
+  // degrade to a not-confirmed result instead.
+  try {
+    const result = await guardedExtract(
+      stagehand,
+      "is a submission confirmation shown, and what is its reference number?",
+      ${pascal}BrowserSchema
+    );
+    return { ...result, verified: true } as unknown as ${pascal}Response;
+  } catch (error) {
+    logger.error(\`GuardedExtractError: post-submit confirmation extract failed on an already-verified submit, degrading to not-confirmed: \${error}\`);
+    return { verified: false } as unknown as ${pascal}Response;
+  }
+}
+`
+        : `
   const result = await guardedExtract(
     stagehand,
-    ${isSubmissionFlow ? `\`drove the ${siteId} submission flow for payload \${JSON.stringify(payload)}\`` : `\`extract results matching query: \${payload.query}\``},
+    \`extract results matching query: \${payload.query}\`,
     ${pascal}BrowserSchema
   );
 
   return result as unknown as ${pascal}Response;
 }
-`;
+`}`;
+    assertNoLeakedPersonaConstant(code, knownFieldValues);
     return { code, payloadFieldNames };
 }
 /** Generates the site's index.ts barrel — exported so the out-of-tree e2e
@@ -4199,6 +4578,9 @@ async function main() {
         "rate-limit.json",
         "introspection-schema.json",
     ]);
+    if (replays.length === 0) {
+        logger.warn(`recon-generate: run dir ${runRoot} has an empty replays/ directory — recon:http (rate-limit probe) and replay validation were skipped, so this contract's timing and shape are unvalidated`);
+    }
     const rateLimits = (() => {
         try {
             return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(replaysDir, "rate-limit.json"), "utf8"));
@@ -4274,8 +4656,8 @@ async function main() {
     const baseUrl = deriveBaseUrl(captures);
     const baseHeaders = deriveRequestHeaders(captures, replays, baseUrl, submitPatterns);
     const minTime = deriveMinTime(rateLimits);
+    const hasRateLimitProbeData = rateLimits.some((f) => f.safeRps !== null);
     const safeRps = rateLimits.find((f) => f.safeRps !== null)?.safeRps ?? Math.floor(1000 / minTime);
-    const responseBody = firstSuccessfulReplayBody(replays);
     const gql = isGraphQL(captures);
     // Hoisted so both the primary-operation gate below and rawActionCaptures
     // (further down) read the same computed sequence instead of calling the
@@ -4287,6 +4669,11 @@ async function main() {
         : null;
     const gqlQuery = primaryGraphQLOperation?.capture.query ?? firstGraphQLQuery(captures);
     const endpointPath = primaryGraphQLOperation?.endpointPath ?? firstEndpointPath(captures);
+    // Derived from the primary operation's own Phase-1 capture, never from
+    // replay array order -- a replay's body reflects whichever endpoint fired
+    // first, not necessarily the primary operation, and only exists once
+    // recon:http has run.
+    const responseBody = (primaryGraphQLOperation?.capture ?? firstEndpointCapture(captures))?.responseBody ?? null;
     // Detect a multi-step submission flow (transactional sites like apply forms,
     // checkout, etc.). When the action sequence has 2+ POSTs, switch the
     // contract template to emit a state-threaded executeHttp.
@@ -4520,12 +4907,12 @@ async function main() {
         (0, node_fs_1.mkdirSync)(outDir, { recursive: true });
         (0, node_fs_1.writeFileSync)(manifestPath, emitConfigManifest({
             siteId,
-            displayName: pascal,
             baseUrl,
             flowSteps,
             vocabulary,
             inputBody,
             recoveredFields: [...discoveredFormFields, ...discoveredOptionFields],
+            isSubmissionFlow,
             // A submission flow is the case where the `.ts` emit carries an
             // executeHttp hot path; point the manifest at where the operator drops
             // the compiled module rather than silently dropping the direct path.
@@ -4551,7 +4938,7 @@ async function main() {
         vocabulary,
         frameSelector,
     });
-    (0, node_fs_1.writeFileSync)(`${outDir}/contract.ts`, emitContractTs({
+    const contractOpts = {
         siteId,
         pascal,
         baseUrl,
@@ -4560,6 +4947,7 @@ async function main() {
         baseHeaders: isSubmissionFlow ? staticBaseHeaders : baseHeaders,
         minTime,
         safeRps,
+        hasRateLimitProbeData,
         responseBody: effectiveResponseBody,
         gql,
         gqlQuery,
@@ -4569,6 +4957,7 @@ async function main() {
         auxFiles,
         multiStepBody,
         omitExecuteHttp: browserFlowOnly,
+        isSubmissionFlow,
         inputBody,
         hasMultipartStep,
         discoveredFormFields,
@@ -4579,8 +4968,17 @@ async function main() {
         discoveredStructuredKeys,
         payloadFieldNames: browserFlow.payloadFieldNames,
         headerBindings,
-    }));
+    };
+    const contractCode = emitContractTs(contractOpts);
+    // Fails loudly rather than shipping a flow that requires a URL field it
+    // never reads (see assertRequiredUrlFieldsReferenced doc comment).
+    assertRequiredUrlFieldsReferenced(contractCode, browserFlow.code);
+    (0, node_fs_1.writeFileSync)(`${outDir}/contract.ts`, contractCode);
     logger.info(`wrote ${outDir}/contract.ts`);
+    // Same opts fed to emitContractTs above, so this can never drift from what
+    // the header used to embed.
+    const checklist = buildContractChecklist(contractOpts);
+    logger.info(`review checklist for ${outDir}/contract.ts:\n${checklist.map((item) => `  [ ] ${item}`).join("\n")}`);
     (0, node_fs_1.writeFileSync)(`${outDir}/flows/browser-flow.ts`, browserFlow.code);
     logger.info(`wrote ${outDir}/flows/browser-flow.ts`);
     (0, node_fs_1.writeFileSync)(`${outDir}/index.ts`, emitIndexTs({ siteId, pascal }));