@enricai/barnacle 1.12.43 → 1.12.45

package/dist/scripts/recon-generate.js

@@ -38,6 +38,7 @@ exports.gatherResponseBodySamples = gatherResponseBodySamples;
 exports.selectPrimaryGraphQLOperation = selectPrimaryGraphQLOperation;
 exports.firstEndpointCapture = firstEndpointCapture;
 exports.firstEndpointPath = firstEndpointPath;
+exports.truncateActionSequenceAtSubmitPattern = truncateActionSequenceAtSubmitPattern;
 exports.resolveManifestActionSequence = resolveManifestActionSequence;
 exports.extractActionSequence = extractActionSequence;
 exports.extractGraphQLActionSequence = extractGraphQLActionSequence;
@@ -1102,12 +1103,31 @@ function isGraphQL(captures) {
  * `selectPrimaryGraphQLOperation` winner) resolves its query, endpoint, and
  * operationName from — all three MUST trace back to this same capture, not
  * three independent array scans that could each land on a different one.
- */
-function firstGraphQLCapture(captures, ownBackendHostnames = [], fallbackDomain = null) {
+ *
+ * `submitPatterns` (declared after this function so the types can appear
+ * before the interface they use) restricts the search to non-mutation
+ * (query) captures matching the pattern when the flow declares one AND at
+ * least one own-backend query capture matches it — mirroring
+ * {@link truncateActionSequenceAtSubmitPattern}'s never-hard-fail fallback
+ * to the unfiltered pool. The restriction only ever narrows within the
+ * query captures, never promotes a mutation over them: this fallback exists
+ * specifically for the read op a bypassed {@link selectPrimaryGraphQLOperation}
+ * would have picked, and a declared pattern that happens to match the
+ * flow's own mutation capture (its real submission step, resolved
+ * elsewhere) must not hijack this read-op resolution.
+ */
+function firstGraphQLCapture(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null) {
     const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
-    return (captures.find((c) => c.query &&
+    const ownBackendCandidates = captures.filter((c) => c.query &&
         (!hasHostProvenance ||
-            (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain))) ?? null);
+            (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain)));
+    if (submitPatterns === null ||
+        (submitPatterns.endpoint === null && submitPatterns.body === null)) {
+        return ownBackendCandidates[0] ?? null;
+    }
+    const nonMutationCandidates = ownBackendCandidates.filter((c) => !/^\s*mutation\b/.test(c.query ?? ""));
+    const pool = nonMutationCandidates.length > 0 ? nonMutationCandidates : ownBackendCandidates;
+    return restrictToSubmitPattern(pool, submitPatterns)[0] ?? null;
 }
 /**
  * Strips leading blank lines and `#`-comment lines (GraphQL comments run
@@ -1216,19 +1236,24 @@ function isPopulatedVariableValue(value) {
  * Select answer (e.g. a device-type dropdown) never contributes a spurious
  * facet match to the ranking.
  */
-function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, env = process.env, ownBackendHostnames = [], fallbackDomain = null) {
+function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, env = process.env, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null) {
     // Callers with no host-provenance data (the exported function's unit
     // tests) pass neither ownBackendHostnames nor fallbackDomain — in that
     // case isAllowedFixtureHost would reject every candidate, so the gate
     // only applies once the caller has actually resolved a notion of "own
     // backend" to check against.
     const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
-    const candidates = captures.filter((c) => c.status >= 200 &&
+    const ownBackendCandidates = captures.filter((c) => c.status >= 200 &&
         c.status < 300 &&
         c.query !== null &&
         !/^\s*mutation\b/.test(c.query) &&
         (!hasHostProvenance ||
             (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain)));
+    // A declared submitEndpointPattern is authoritative for single-endpoint
+    // primary selection too: it must not be silently ignored just because
+    // this scoring path (not the multi-step submission path) is the one that
+    // ends up resolving the flow's single action.
+    const candidates = restrictToSubmitPattern(ownBackendCandidates, submitPatterns);
     if (candidates.length === 0)
         return null;
     const knownFieldValues = buildKnownFieldValues(flowSteps, vocabulary, env);
@@ -1322,7 +1347,7 @@ function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, env = pr
  * derives a path string from, so non-GraphQL flows can also read that
  * capture's own `.responseBody` instead of an array-order-first replay.
  */
-function firstEndpointCapture(captures, ownBackendHostnames = [], fallbackDomain = null) {
+function firstEndpointCapture(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null) {
     // Callers with no host-provenance data (unit tests exercising the
     // chronological-first fallback in isolation) pass neither argument -- in
     // that case isAllowedFixtureHost would reject every candidate, so the
@@ -1331,7 +1356,7 @@ function firstEndpointCapture(captures, ownBackendHostnames = [], fallbackDomain
     const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
     const allowed = (c) => !hasHostProvenance ||
         (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain);
-    const nonGetCaptures = captures.filter((c) => c.method !== "GET" && allowed(c));
+    const nonGetCaptures = restrictToSubmitPattern(captures.filter((c) => c.method !== "GET" && allowed(c)), submitPatterns);
     for (const c of nonGetCaptures) {
         try {
             new URL(c.url);
@@ -1341,7 +1366,7 @@ function firstEndpointCapture(captures, ownBackendHostnames = [], fallbackDomain
             // skip
         }
     }
-    for (const c of captures.filter(allowed)) {
+    for (const c of restrictToSubmitPattern(captures.filter(allowed), submitPatterns)) {
         try {
             new URL(c.url);
             return c;
@@ -1360,9 +1385,9 @@ function safeUrlPathname(url) {
         return "/api/search";
     }
 }
-function firstEndpointPath(captures, ownBackendHostnames = [], fallbackDomain = null) {
+function firstEndpointPath(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null) {
     try {
-        const capture = firstEndpointCapture(captures, ownBackendHostnames, fallbackDomain);
+        const capture = firstEndpointCapture(captures, ownBackendHostnames, fallbackDomain, submitPatterns);
         return capture ? new URL(capture.url).pathname : "/api/search";
     }
     catch {
@@ -1390,6 +1415,39 @@ function compileSubmitMatcher(patterns) {
         return true;
     };
 }
+/**
+ * Restricts a single-endpoint primary-capture candidate pool to captures
+ * matching the flow's declared submit pattern, when one is declared AND at
+ * least one candidate in the pool matches it. A pattern that matches nothing
+ * among the candidates falls back to the unfiltered pool — mirroring
+ * {@link truncateActionSequenceAtSubmitPattern}'s never-hard-fail philosophy
+ * — so `firstEndpointCapture`/`firstEndpointPath`/`firstGraphQLCapture`/
+ * `selectPrimaryGraphQLOperation` never lose a winner over a pattern that
+ * simply doesn't apply to this candidate pool.
+ */
+function restrictToSubmitPattern(pool, submitPatterns) {
+    const matchesSubmit = compileSubmitMatcher(submitPatterns);
+    const matching = pool.filter((c) => matchesSubmit(c));
+    return matching.length > 0 ? matching : pool;
+}
+/**
+ * Truncates a host-gated action sequence at the LAST capture matching the
+ * flow's declared submit pattern, keeping every capture up to and including
+ * it. A pattern that names only the wizard's final step must not collapse a
+ * multi-step chain (auth mint, paged listing, terminal submit) down to the
+ * bare matching capture(s) — a hard filter would drop the earlier steps the
+ * fold plan and state-threading depend on. When nothing matches, the result
+ * is empty, matching what a hard filter would have produced.
+ */
+function truncateActionSequenceAtSubmitPattern(sequence, submitPatterns) {
+    const matchesSubmit = compileSubmitMatcher(submitPatterns);
+    let lastMatchIndex = -1;
+    for (let i = 0; i < sequence.length; i++) {
+        if (matchesSubmit(sequence[i].capture))
+            lastMatchIndex = i;
+    }
+    return sequence.slice(0, lastMatchIndex + 1);
+}
 /**
  * Reads `submit-manifest.json` (written by recon-browser) and resolves it to the
  * authoritative submission action sequence. This is the deepest submit-selection
@@ -7020,19 +7078,46 @@ function emitContractTs(opts) {
     //
     // The captured request body (inputBody) is the SITE's internal request
     // shape (a vendor's ddoKey/formData, a GraphQL worklet's variables, …) — not
-    // what the real caller sends. The plugin's buildBarnacleFormData posts
-    // the standard candidate payload (ApplicantContactSchema's identity/
-    // address/resume fields + Email + job-targeting + a JSON Answers block) to
-    // every plugin's /run, so that — not a structural inference over
-    // inputBody — is the public contract every submission-flow plugin must
-    // declare, unconditionally (see recon-generate-payload-schema-mismatch.md
-    // fix option (a)). inputBody remains available to the plugin author as the
-    // internal request shape the site's own call needs to be built from; it no
-    // longer drives the public schema. A missing inputBody means this is a
-    // non-submission (query-type) flow, which keeps its own contract untouched.
-    const basePayloadSchemaExpr = inputBody
+    // necessarily the real caller's shape. ApplicantContactSchema (the job-
+    // application template: identity/address/resume fields + Email + a JSON
+    // Answers block) only belongs on flows that are actually job/benefits
+    // applications — selecting it purely because SOME body was captured picks
+    // it for unrelated submission flows too. usesApplicantContactSchema is the
+    // real-evidence gate: it requires the captured inputBody to itself carry
+    // one of ApplicantContactSchema's own field names (case-insensitively,
+    // checked at any depth via walkAllPrimitiveLeaves) before the template
+    // applies (see recon-generate-payload-schema-mismatch.md).
+    const applicantContactFieldNames = new Set([
+        "FirstName",
+        "LastName",
+        "Phone",
+        "AddressLine",
+        "City",
+        "State",
+        "PostalCode",
+        "Country",
+        "County",
+        "Resume",
+        "ResumeContentType",
+        "ResumeFilename",
+        "ResumeBase64",
+    ]);
+    const baseContractFieldNames = new Set(["Email", "ClickUrl", "Answers"]);
+    const applicantContactEvidenceFieldNamesLower = new Set([...applicantContactFieldNames, ...baseContractFieldNames].map((name) => name.toLowerCase()));
+    const usesApplicantContactSchema = inputBody != null &&
+        [...walkAllPrimitiveLeaves(inputBody)].some(({ path }) => path.some((segment) => applicantContactEvidenceFieldNamesLower.has(segment.toLowerCase())));
+    const isReservedByApplicantContactSchema = (name) => usesApplicantContactSchema && applicantContactFieldNames.has(name);
+    // A missing inputBody, or one with no ApplicantContactSchema evidence,
+    // means this is not a job-application submission flow. The former keeps
+    // its own read-flow `{ query }` contract untouched; the latter (a body WAS
+    // captured, it just isn't an application) gets a plain empty base instead
+    // — extend() below still layers on every genuinely-discovered field from
+    // the other sources unchanged.
+    const basePayloadSchemaExpr = usesApplicantContactSchema
         ? `ApplicantContactSchema`
-        : `z.object({\n  query: z.string().min(1),\n})`;
+        : inputBody
+            ? `z.object({})`
+            : `z.object({\n  query: z.string().min(1),\n})`;
     // Only the single-endpoint GraphQL read path (a real primary operation, no
     // multi-step flow) is a candidate for a paging signal — multiStepBody
     // already owns its own per-call semantics.
@@ -7095,34 +7180,12 @@ function emitContractTs(opts) {
     if (paginationSignal) {
         addExtendField("maxPages", "  maxPages: z.number().int().positive().optional(),");
     }
-    // The base extend's own keys — submission flows only.
-    if (inputBody) {
+    // The base extend's own keys — job-application submission flows only.
+    if (usesApplicantContactSchema) {
         addExtendField("Email", "  Email: z.email(),");
         addExtendField("ClickUrl", "  ClickUrl: z.string().min(1),");
         addExtendField("Answers", "  Answers: multipartJsonObject(z.record(z.string(), z.unknown())),");
     }
-    // ApplicantContactSchema's own merged identity/address/resume field names
-    // (see src/lib/application-identity.ts, application-address.ts,
-    // application-resume.ts, applicant-payload.ts) — reserved so no discovered/
-    // spliced source can redeclare (and silently shadow) a field the base
-    // ApplicantContactSchema already supplies. Only relevant for submission
-    // flows, where basePayloadSchemaExpr actually is ApplicantContactSchema.
-    const applicantContactFieldNames = new Set([
-        "FirstName",
-        "LastName",
-        "Phone",
-        "AddressLine",
-        "City",
-        "State",
-        "PostalCode",
-        "Country",
-        "County",
-        "Resume",
-        "ResumeContentType",
-        "ResumeFilename",
-        "ResumeBase64",
-    ]);
-    const isReservedByApplicantContactSchema = (name) => Boolean(inputBody) && applicantContactFieldNames.has(name);
     // A declared foldReturn.drillParamBindings names drill query params that
     // are caller-driven instead of frozen literals (see
     // recon-generate-foldreturn-cannot-bind-drill-query-param-to-caller-payload.md)
@@ -7143,9 +7206,10 @@ function emitContractTs(opts) {
         addExtendField(binding.payloadField, `  ${binding.payloadField}: ${zod},`);
     }
     // Multi-step flows that include a multipart upload need the binary asset
-    // on the payload. A query-type flow (no ApplicantContactSchema base) still
-    // needs these fields spelled out explicitly.
-    if (hasMultipartStep && !inputBody) {
+    // on the payload. A non-applicant flow (no ApplicantContactSchema base,
+    // whether or not a body was captured) still needs these fields spelled
+    // out explicitly.
+    if (hasMultipartStep && !usesApplicantContactSchema) {
         addExtendField("Resume", "  Resume: z.instanceof(Buffer),");
         addExtendField("ResumeContentType", "  ResumeContentType: z.string(),");
         addExtendField("ResumeFilename", "  ResumeFilename: z.string(),");
@@ -7287,9 +7351,8 @@ function emitContractTs(opts) {
     // comment above) — a GraphQL mutation that happens to declare an
     // unpopulated variable with a matching name (e.g. `$email`) must not
     // downgrade that required base field.
-    const baseContractFieldNames = new Set(["Email", "ClickUrl", "Answers"]);
     for (const [fieldName, line] of extendFields) {
-        if (inputBody && baseContractFieldNames.has(fieldName))
+        if (usesApplicantContactSchema && baseContractFieldNames.has(fieldName))
             continue;
         if (unpopulatedDeclaredVariables.some((name) => name.toLowerCase() === fieldName.toLowerCase())) {
             extendFields.set(fieldName, line.replace(/,\s*$/, ".optional(),"));
@@ -7298,23 +7361,25 @@ function emitContractTs(opts) {
     const mergedExtension = extendFields.size > 0 ? `.extend({\n${[...extendFields.values()].join("\n")}\n})` : "";
     const payloadSchemaExpr = `${basePayloadSchemaExpr}${mergedExtension}`;
     // basePayloadSchemaExpr's own Answers field always wraps in
-    // multipartJsonObject() for submission flows (inputBody set);
-    // multipartBoolean() is only imported when a boolean field was actually
-    // wrapped in it above (an additional-body-key or an inputBody field under
-    // multipartCoerce) — payloadNeedsMultipart alone doesn't imply that.
+    // multipartJsonObject() for job-application submission flows
+    // (usesApplicantContactSchema); multipartBoolean() is only imported when a
+    // boolean field was actually wrapped in it above (an additional-body-key
+    // or an inputBody field under multipartCoerce) — payloadNeedsMultipart
+    // alone doesn't imply that.
     // Named imports from the same module are combined into one import statement.
     const zodMultipartNamedImports = [
         ...(usesMultipartBoolean ? ["multipartBoolean"] : []),
-        ...(inputBody || (payloadNeedsMultipart && sortedStructuredEntries.length > 0)
+        ...(usesApplicantContactSchema || (payloadNeedsMultipart && sortedStructuredEntries.length > 0)
             ? ["multipartJsonObject"]
             : []),
     ];
     const multipartBoolImport = zodMultipartNamedImports.length > 0
         ? `import { ${zodMultipartNamedImports.join(", ")} } from "${ENGINE_PKG}/lib/zod-multipart";\n`
         : "";
-    // ApplicantContactSchema backs the default submission-flow payload schema
-    // (see basePayloadSchemaExpr above); only referenced when inputBody is set.
-    const applicantContactImport = inputBody
+    // ApplicantContactSchema backs the job-application submission-flow payload
+    // schema (see basePayloadSchemaExpr above); only referenced when
+    // usesApplicantContactSchema is true.
+    const applicantContactImport = usesApplicantContactSchema
         ? `import { ApplicantContactSchema } from "${ENGINE_PKG}/lib/applicant-payload";\n`
         : "";
     // Content-Type must be absent from multipart fetch calls so FormData can inject the boundary.
@@ -7715,17 +7780,17 @@ export const ${camel}Plugin: SitePlugin<${pascal}Payload, ${pascal}Response> = {
     bodySchema: ${pascal}PayloadSchema,
     responseSchema: ${pascal}ResponseSchema,
     defaultBaseUrl: ${JSON.stringify(baseUrl)},
-    ${payloadNeedsMultipart || inputBody
+    ${payloadNeedsMultipart || usesApplicantContactSchema || hasMultipartStep
         ? `// multipart is required whenever the flow itself uploads a file
-    // (hasMultipartStep), OR this is a submission flow (inputBody set) since
-    // basePayloadSchemaExpr always requires a real Resume Buffer via
-    // ApplicantContactSchema regardless of whether the recorded browser flow
-    // contained an upload step, OR the payload has a non-scalar
-    // discoveredStructuredKeys field (payloadNeedsMultipart), since the
-    // multipart wire format is what makes that field's JSON-stringified
-    // encoding parseable.
+    // (hasMultipartStep), OR this is a job-application submission flow
+    // (usesApplicantContactSchema) since basePayloadSchemaExpr requires a
+    // real Resume Buffer via ApplicantContactSchema regardless of whether
+    // the recorded browser flow contained an upload step, OR the payload
+    // has a non-scalar discoveredStructuredKeys field (payloadNeedsMultipart),
+    // since the multipart wire format is what makes that field's
+    // JSON-stringified encoding parseable.
     `
-        : ""}apiVersion: ${JSON.stringify(plugin_api_version_1.PLUGIN_API_VERSION)},${payloadNeedsMultipart || inputBody ? "\n    multipart: true," : ""}
+        : ""}apiVersion: ${JSON.stringify(plugin_api_version_1.PLUGIN_API_VERSION)},${payloadNeedsMultipart || usesApplicantContactSchema || hasMultipartStep ? "\n    multipart: true," : ""}
   },
 ${executeHttpMethodBlock}
   /** Browser fallback: Stagehand + Steel — invoked only when hot path fails. */
@@ -7734,7 +7799,7 @@ ${executeHttpMethodBlock}
     session: BrowserSession,
     context: SitePluginContext
   ): Promise<SitePluginResult<${pascal}Response>> {
-    const raw = await run${pascal}BrowserFlow(session.stagehand, ${inputBody ? "payload.ClickUrl" : "context.baseUrl"}, payload);
+    const raw = await run${pascal}BrowserFlow(session.stagehand, ${usesApplicantContactSchema ? "payload.ClickUrl" : "context.baseUrl"}, payload, session.sessionProxy ?? null);
     return { data: raw as ${pascal}Response };
   },
 };
@@ -8120,6 +8185,7 @@ import { getLogger } from "${ENGINE_PKG}/lib/logging";${usesThrowawayPassword ?
 import { type HealingFlowStep, runHealingFlow } from "${ENGINE_PKG}/scraper/flow-runner";
 import { waitForSpaReady } from "${ENGINE_PKG}/scraper/spa-readiness";
 import { guardedExtract } from "${ENGINE_PKG}/scraper/stagehand-guard";${usesEmailStep ? `\nimport { testmailInboxFromAddress } from "${ENGINE_PKG}/testmail/client";` : ""}
+import type { SessionProxyTuple } from "${ENGINE_PKG}/types/session-proxy";
 import ${isSubmissionFlow
         ? `type { ${pascal}Payload, ${pascal}Response }`
         : `{ type ${pascal}Payload, type ${pascal}Response, ${pascal}ResponseSchema }`} from "@/sites/${siteId}/contract";
@@ -8142,7 +8208,8 @@ const ${pascal}BrowserSchema = z.object({
 export async function run${pascal}BrowserFlow(
   stagehand: Stagehand,
   ${isSubmissionFlow ? "entryUrl" : "baseUrl"}: string,
-  payload: ${pascal}Payload
+  payload: ${pascal}Payload,
+  sessionProxy: SessionProxyTuple | null
 ): Promise<${pascal}Response> {
   const page = await stagehand.context.awaitActivePage();
 
@@ -8167,6 +8234,7 @@ ${flowStepsBlock}
     anthropic: buildAnthropicClient(),
     rephraseModel: buildRephraseModel(),
     uploadFixture: ${uploadFixtureExpr},${frameSelector !== undefined ? `\n    frameSelector: ${JSON.stringify(frameSelector)},` : ""}${usesEmailStep ? "\n    allocatedInbox: allocatedInbox," : ""}
+    sessionProxy,
   });
 
   // Schema-enforced extract via guardedExtract: Stagehand 3.4.0 accepts
@@ -8464,9 +8532,11 @@ async function main() {
     const gql = isGraphQL(captures);
     // Hoisted so both the primary-operation gate below and rawActionCaptures
     // (further down) read the same computed sequence instead of calling the
-    // extractor twice.
+    // extractor twice. Computed unfiltered (submitPatterns: null) — a
+    // flow-declared submit pattern must truncate this sequence, not filter
+    // it, so every gate reading it sees the full host-gated chain.
     const graphqlActionSequence = gql
-        ? extractGraphQLActionSequence(captures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain)
+        ? extractGraphQLActionSequence(captures, null, foldReturnSpec, ownBackendHostnames, fallbackDomain)
         : [];
     // A foldReturn-admitted read/drill capture (see extractGraphQLActionSequence's
     // doc comment) can put 2+ entries in graphqlActionSequence with none of them
@@ -8476,7 +8546,7 @@ async function main() {
     // out primaryGraphQLOperation below or flip isSubmissionFlow further down.
     const graphqlActionSequenceHasMutation = graphqlActionSequence.some((a) => a.capture.query !== null && /^\s*mutation\b/.test(a.capture.query));
     const primaryGraphQLOperation = gql && !graphqlActionSequenceHasMutation
-        ? selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, process.env, ownBackendHostnames, fallbackDomain)
+        ? selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, process.env, ownBackendHostnames, fallbackDomain, submitPatterns)
         : null;
     if (primaryGraphQLOperation && primaryGraphQLOperation.unpopulatedDeclaredVariables.length > 0) {
         const operationLabel = primaryGraphQLOperation.capture.operationName ?? "(anonymous)";
@@ -8489,20 +8559,20 @@ async function main() {
     // capture could otherwise win the endpoint/body fallback while an
     // unrelated capture supplies the query text.
     const fallbackGraphQLCapture = gql
-        ? firstGraphQLCapture(captures, ownBackendHostnames, fallbackDomain)
+        ? firstGraphQLCapture(captures, ownBackendHostnames, fallbackDomain, submitPatterns)
         : null;
     const gqlQuery = primaryGraphQLOperation?.capture.query ?? fallbackGraphQLCapture?.query ?? null;
     const endpointPath = primaryGraphQLOperation?.endpointPath ??
         (fallbackGraphQLCapture
             ? safeUrlPathname(fallbackGraphQLCapture.url)
-            : firstEndpointPath(captures, ownBackendHostnames, fallbackDomain));
+            : firstEndpointPath(captures, ownBackendHostnames, fallbackDomain, submitPatterns));
     // Derived from the primary operation's own Phase-1 capture, never from
     // replay array order -- a replay's body reflects whichever endpoint fired
     // first, not necessarily the primary operation, and only exists once
     // recon:http has run.
     const winningCapture = primaryGraphQLOperation?.capture ??
         fallbackGraphQLCapture ??
-        firstEndpointCapture(captures, ownBackendHostnames, fallbackDomain);
+        firstEndpointCapture(captures, ownBackendHostnames, fallbackDomain, submitPatterns);
     const responseBody = winningCapture?.responseBody ?? null;
     // Every 2xx capture sharing the winning capture's operation identity, not
     // just the one that happened to win selection -- a paginated/re-filtered
@@ -8523,20 +8593,20 @@ async function main() {
     // a wizard whose every section saves independently, so it is only trusted
     // when it isn't a strict undercount of what the same captures' own
     // heuristic extraction finds.
-    const patternedHeuristicActionCaptures = gql
+    const unfilteredHeuristicActionCaptures = gql
         ? dedupRedundantSameOperationCaptures(graphqlActionSequence, primaryGraphQLOperation)
-        : collapseRedundantPatches(extractActionSequence(captures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain));
+        : collapseRedundantPatches(extractActionSequence(captures, null, foldReturnSpec, ownBackendHostnames, fallbackDomain));
     // A flow-declared submitEndpointPattern is authoritative: it may match only
-    // one section's URL (the natural way to describe "the button that finishes
-    // the wizard") even though the same captures, read without the pattern,
-    // show every section saving independently. That gap is logged below for
-    // visibility, but the declared pattern is never overridden by the richer
-    // unfiltered sequence.
-    const unfilteredHeuristicActionCaptures = submitPatterns.endpoint === null && submitPatterns.body === null
-        ? patternedHeuristicActionCaptures
-        : gql
-            ? dedupRedundantSameOperationCaptures(extractGraphQLActionSequence(captures, null, foldReturnSpec, ownBackendHostnames, fallbackDomain), primaryGraphQLOperation)
-            : collapseRedundantPatches(extractActionSequence(captures, null, foldReturnSpec, ownBackendHostnames, fallbackDomain));
+    // the final step's URL (the natural way to describe "the button that
+    // finishes the wizard") even though the earlier steps of the same chain
+    // (auth mint, paged listing, ...) are what state-threading depends on.
+    // Truncating at the last match — instead of filtering to matches only —
+    // keeps that whole chain; the gap between this and the unfiltered
+    // sequence is logged below for visibility, but the declared pattern is
+    // never overridden by the richer unfiltered sequence.
+    const patternedHeuristicActionCaptures = submitPatterns.endpoint === null && submitPatterns.body === null
+        ? unfilteredHeuristicActionCaptures
+        : truncateActionSequenceAtSubmitPattern(unfilteredHeuristicActionCaptures, submitPatterns);
     const patternUndercounts = patternedHeuristicActionCaptures.length < unfilteredHeuristicActionCaptures.length;
     if (patternUndercounts && requireSubmitEndpointMatch) {
         // Distinct wording from the non-required case below: this pattern is never