@enricai/barnacle 1.12.49 → 1.12.50

package/dist/scripts/recon-generate.js

@@ -43,6 +43,7 @@ exports.resolveManifestActionSequence = resolveManifestActionSequence;
 exports.extractActionSequence = extractActionSequence;
 exports.extractGraphQLActionSequence = extractGraphQLActionSequence;
 exports.dedupRedundantSameOperationCaptures = dedupRedundantSameOperationCaptures;
+exports.isRedundantSameEndpointGroup = isRedundantSameEndpointGroup;
 exports.detectFormSchemaFieldNames = detectFormSchemaFieldNames;
 exports.indexEnumEnumNamesSchemas = indexEnumEnumNamesSchemas;
 exports.indexLabelValueOptionCodes = indexLabelValueOptionCodes;
@@ -1504,6 +1505,13 @@ function resolveManifestActionSequence(runRoot, captures) {
  * a capture whose host fails {@link isAllowedFixtureHost} is dropped too —
  * `isNoiseUrl` alone lets a third-party telemetry/beacon POST masquerade as
  * a submission step, since it can look identical in shape to a real one.
+ * A capture that recurs elsewhere with a byte-identical method/URL/body is
+ * dropped too ({@link isZeroVarianceRepeatCapture}) — a same-host beacon
+ * whose extension and host both look legitimate (e.g. a `.html` sensor
+ * endpoint) still gives itself away by never varying across calls, which
+ * `isNoiseUrl`'s substring/extension checks can't see and which the
+ * structural-isolation pass below can even be fooled by (N identical copies
+ * of the same path "vouch" for each other's tokens).
  *
  * When the flow declares submit patterns, only POSTs matching them survive —
  * this isolates the submission from same-origin page chrome (bootstrap, chatbot,
@@ -1552,6 +1560,8 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
             return false;
         if ((0, capture_filters_1.isNoiseUrl)(capture.url))
             return false;
+        if ((0, capture_filters_1.isZeroVarianceRepeatCapture)(capture, captures))
+            return false;
         if (!matchesSubmit(capture))
             return false;
         if (hasHostProvenance &&
@@ -1573,11 +1583,28 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
     // but a 1-2 capture pool has no "everything else" to be isolated from, so
     // skip it there rather than risk flagging a single-endpoint site's own
     // hyphenated path.
+    //
+    // A candidate's own same-pathname repeats only count as evidence against
+    // itself (not for it) when its path carries a densely name-spaced,
+    // marketing/tracking-shaped signal — more than one compound segment's
+    // worth of tokens (e.g. `/site-banner/promotions-widget`, 4 tokens across
+    // two compound segments) — OR when the repeats themselves carry no
+    // business-relevant response state ({@link hasNoBusinessRelevantResponseState}):
+    // a real own-backend endpoint (a polled toggles feed, a paged listing) is
+    // often named with at most one compound segment, so path shape alone can't
+    // tell it apart from a same-shaped, same-host, zero-business-value poll
+    // (an availability/feature-flag ping that answers every call with nothing
+    // a caller could not already know) — both are "one compound segment,
+    // repeats identically." Response content is what actually distinguishes
+    // them, so a candidate whose own repeats carry no business-relevant state
+    // loses the self-vouching exemption regardless of its token count, while a
+    // genuinely data-bearing single-compound-segment endpoint keeps it.
     const structurallyGated = hasHostProvenance && hostGated.length > 2
         ? hostGated.filter(({ capture }, i) => {
             const path = safeUrlPathname(capture.url);
+            const denselyNameSpaced = (0, capture_filters_1.pathStructuralTokens)(path).size > 2 || (0, capture_filters_1.hasNoBusinessRelevantResponseState)(capture);
             const otherPaths = hostGated
-                .filter((_, j) => j !== i)
+                .filter((h, j) => denselyNameSpaced ? safeUrlPathname(h.capture.url) !== path : j !== i)
                 .map((h) => safeUrlPathname(h.capture.url));
             return !(0, capture_filters_1.isStructurallyIsolatedCapture)(path, otherPaths);
         })
@@ -1638,6 +1665,24 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
  * Exported for tests: this predicate decides what a generated GraphQL plugin
  * will send at a live site.
  */
+/** REST HTTP methods that write/mutate server state rather than merely
+ * reading it — a capture using one of these is never a re-readable
+ * poll/listing, regardless of how flat its response body looks. */
+const MUTATING_HTTP_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+/** A mutation capture: either GraphQL (identified by its parsed operation
+ * query string starting with `mutation`) or REST (identified by a
+ * non-idempotent HTTP method). Its response is a single mutated object
+ * rather than a re-readable list/flag, so it must never be folded in with
+ * genuinely idempotent reads by {@link isRedundantSameEndpointGroup} — a
+ * flat-response REST POST (e.g. a wizard section save) is exactly as
+ * non-poll-able as a GraphQL mutation, but `capture.query` is always null
+ * for REST, so the GraphQL-only check alone would misclassify it as a
+ * collapsible poll. */
+function isMutationCapture(capture) {
+    if (capture.query !== null)
+        return /^\s*mutation\b/.test(capture.query);
+    return MUTATING_HTTP_METHODS.has(capture.method.toUpperCase());
+}
 function extractGraphQLActionSequence(captures, submitPatterns = null, foldReturnSpec = null, ownBackendHostnames = [], fallbackDomain = null) {
     const matchesSubmit = compileSubmitMatcher(submitPatterns);
     const matchesFoldReturn = compileFoldReturnEndpointMatcher(foldReturnSpec);
@@ -1648,7 +1693,7 @@ function extractGraphQLActionSequence(captures, submitPatterns = null, foldRetur
     // only applies once the caller has actually resolved a notion of "own
     // backend" to check against.
     const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
-    const isMutation = (capture) => capture.query !== null && /^\s*mutation\b/.test(capture.query);
+    const isMutation = isMutationCapture;
     const admitted = captures
         .map((capture, index) => ({ capture, index }))
         .filter(({ capture }) => {
@@ -1656,6 +1701,8 @@ function extractGraphQLActionSequence(captures, submitPatterns = null, foldRetur
             return false;
         if ((0, capture_filters_1.isNoiseUrl)(capture.url))
             return false;
+        if ((0, capture_filters_1.isZeroVarianceRepeatCapture)(capture, captures))
+            return false;
         if (!matchesSubmit(capture))
             return false;
         if (hasHostProvenance &&
@@ -1688,7 +1735,7 @@ function responseShapeKey(capture) {
     const arrayField = findObjectArrayField(capture.responseBody);
     if (!arrayField)
         return null;
-    return `${endpointKey(capture.url)}${arrayField.path.join(".")}`;
+    return `${endpointKey(capture.url)} ${arrayField.path.join(".")}`;
 }
 /**
  * Drops redundant re-issues of the primary GraphQL read operation from a
@@ -1750,9 +1797,28 @@ function collapseRedundantPatches(actions) {
  * counter, unpaired with an explicit page-size key) since that is the common
  * REST shape, unlike GraphQL's paired variables convention. */
 const PAGINATION_FIELD_NAME_PATTERN = /^(page|pagenum|pagenumber|pageindex|pageno|offset|skip|start|cursor)$/i;
+/** Request-field key names that name known client-generated scaffolding
+ * (a monotonic sequence counter, a correlation/trace id, an idempotency
+ * nonce) rather than genuine payload data. Gates {@link
+ * isFieldValueThreadedElsewhere} on a FLAT (non-array) response's
+ * BODY-carried varying field -- unlike an array-shaped listing/facet
+ * re-query, a mutation's request-body field could just as easily be real
+ * user-entered payload (an address line, a card's last4) that happens
+ * never to be echoed back downstream, so that field additionally requires
+ * its key name to look like scaffolding before trusting the "never echoed"
+ * proof. A varying field that lives ONLY in the URL query string (never in
+ * the body) skips this name requirement instead -- see {@link
+ * isQueryStringOnlyKey}. */
+const SCAFFOLDING_FIELD_NAME_PATTERN = /^(req|request|correlation|trace|session|idempotency)?[-_]?(seq|id|key|nonce)$/i;
 /** Every query-string and (when JSON-object-shaped) request-body field on a
  * capture, merged into one comparable map -- REST pagination/facet state can
- * live in either depending on the endpoint's own convention. */
+ * live in either depending on the endpoint's own convention. Body fields are
+ * flattened to their full leaf path (`paging.page`, not just `paging`) via
+ * {@link walkAllPrimitiveLeaves} so a nested pagination/facet/scaffolding
+ * object (`{"paging":{"page":1}}`) surfaces as its own comparable leaf
+ * instead of collapsing into one opaque, always-varying JSON-stringified
+ * key -- see {@link fieldKeyLeafName} for how callers recover the bare leaf
+ * name a nested path's own key-name pattern match must test against. */
 function captureRequestFields(capture) {
     const fields = {};
     try {
@@ -1767,7 +1833,9 @@ function captureRequestFields(capture) {
         try {
             const parsed = JSON.parse(capture.requestPostData);
             if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
-                Object.assign(fields, parsed);
+                for (const { value, path } of walkAllPrimitiveLeaves(parsed)) {
+                    fields[path.join(".")] = value;
+                }
             }
         }
         catch {
@@ -1776,28 +1844,223 @@ function captureRequestFields(capture) {
     }
     return fields;
 }
+/** Recovers the bare field/leaf name (`page`) from a {@link
+ * captureRequestFields} key that may be a dotted nested path (`paging.page`)
+ * -- a flat top-level key is its own leaf name, so this is a no-op for the
+ * pre-existing flat case. Used wherever a key is tested against a NAME
+ * pattern ({@link PAGINATION_FIELD_NAME_PATTERN}, {@link
+ * SCAFFOLDING_FIELD_NAME_PATTERN}) or looked up in {@link
+ * requestAndResponseValuesByKey}'s index, both of which key by bare leaf
+ * name, not by the nested path that disambiguates it during varying-key
+ * detection. */
+function fieldKeyLeafName(key) {
+    const segments = key.split(".");
+    return segments[segments.length - 1] ?? key;
+}
+/** True when `key` is carried ONLY by the URL query string across every
+ * capture in `group` -- never by a JSON request body. Used to widen the
+ * flat-response scaffolding gate past its closed name allowlist for the
+ * common case of a REST poll's tracking param, without extending that same
+ * trust to a mutation's body-carried payload field (see the comment at its
+ * call site in {@link isRedundantSameEndpointGroup}). */
+function isQueryStringOnlyKey(key, group) {
+    return group.every((a) => {
+        let inQuery = false;
+        try {
+            inQuery = new URL(a.capture.url).searchParams.has(key);
+        }
+        catch {
+            return false;
+        }
+        if (!inQuery)
+            return false;
+        if (!a.capture.requestPostData)
+            return true;
+        try {
+            const parsed = JSON.parse(a.capture.requestPostData);
+            return (parsed === null ||
+                typeof parsed !== "object" ||
+                Array.isArray(parsed) ||
+                !(key in parsed));
+        }
+        catch {
+            return true;
+        }
+    });
+}
+/** Per-capture memoization cache for {@link requestAndResponseValuesByKey} --
+ * without it, {@link isFieldValueThreadedElsewhere} re-parses the same
+ * capture's JSON body and re-walks the same response-body leaves once per
+ * (group, varying-key, group-member) combination it's compared against,
+ * which is O(groups * keys * members * allActions) recomputations of
+ * identical work instead of O(allActions). */
+const requestAndResponseValuesCache = new WeakMap();
+function requestAndResponseValuesByKey(capture) {
+    const cached = requestAndResponseValuesCache.get(capture);
+    if (cached)
+        return cached;
+    const byKey = new Map();
+    const pathSegments = new Set();
+    const add = (key, value) => {
+        const values = byKey.get(key) ?? new Set();
+        values.add(value);
+        byKey.set(key, values);
+    };
+    try {
+        const url = new URL(capture.url);
+        for (const segment of url.pathname.split("/").filter(Boolean))
+            pathSegments.add(segment);
+        for (const [key, value] of url.searchParams)
+            add(key, value);
+    }
+    catch {
+        // Relative/invalid URLs carry no path/query signal to contribute.
+    }
+    if (capture.requestPostData) {
+        try {
+            const parsed = JSON.parse(capture.requestPostData);
+            for (const { value, path } of walkAllPrimitiveLeaves(parsed)) {
+                if (value !== null && path.length > 0)
+                    add(path[path.length - 1], String(value));
+            }
+        }
+        catch {
+            // A non-JSON body carries no leaf values to contribute.
+        }
+    }
+    for (const { value, path } of walkAllPrimitiveLeaves(capture.responseBody)) {
+        if (value !== null && path.length > 0)
+            add(path[path.length - 1], String(value));
+    }
+    const result = { byKey, pathSegments };
+    requestAndResponseValuesCache.set(capture, result);
+    return result;
+}
+const fieldValueIndexCache = new WeakMap();
+function fieldValueIndex(allActions) {
+    const cached = fieldValueIndexCache.get(allActions);
+    if (cached)
+        return cached;
+    const byKeyValue = new Map();
+    const byPathSegment = new Map();
+    for (const { capture } of allActions) {
+        const { byKey, pathSegments } = requestAndResponseValuesByKey(capture);
+        for (const [key, values] of byKey) {
+            const valueMap = byKeyValue.get(key) ?? new Map();
+            byKeyValue.set(key, valueMap);
+            for (const value of values) {
+                const captures = valueMap.get(value) ?? new Set();
+                captures.add(capture);
+                valueMap.set(value, captures);
+            }
+        }
+        for (const segment of pathSegments) {
+            const captures = byPathSegment.get(segment) ?? new Set();
+            captures.add(capture);
+            byPathSegment.set(segment, captures);
+        }
+    }
+    const index = { byKeyValue, byPathSegment };
+    fieldValueIndexCache.set(allActions, index);
+    return index;
+}
+/** True when `value` -- one member's own value for `fieldKey`, the sole
+ * varying request field of a same-endpoint group -- shows up under that
+ * SAME field/leaf name in some capture OUTSIDE the group itself (any OTHER,
+ * DIFFERENT-endpoint capture's query/body/response), proving some later
+ * step reads or threads it. False means the value is either scaffolding the
+ * client generated and nothing downstream ever consumes, OR a cursor the
+ * group's OWN members hand to each other -- e.g. page 1's response minting
+ * the exact cursor value page 2's request carries -- which is chained
+ * pagination state, not distinct data a different step depends on, so an
+ * echo confined to sibling occurrences of this SAME same-endpoint group
+ * must not block collapsing it, OR a short scalar (a low-cardinality page
+ * counter) that merely string-equals some unrelated field elsewhere by
+ * coincidence -- requiring the match to occur under the SAME field name is
+ * what tells genuine cross-step threading (an id echoed back under its own
+ * name) apart from that coincidence, since an unrelated field publishing
+ * the same short digit string under a DIFFERENT name proves nothing. This
+ * is the structural signal {@link isRedundantSameEndpointGroup} uses to
+ * widen collapsing past the literal {@link CACHE_BUSTER_QUERY_KEYS}/{@link
+ * PAGINATION_FIELD_NAME_PATTERN} allowlists without hand-enumerating more
+ * key-name shapes. A non-primitive or empty value can't be structurally
+ * proven dead, so it's treated as load-bearing by default. */
+function isFieldValueThreadedElsewhere(fieldKey, value, groupCaptures, allActions) {
+    if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
+        return true;
+    }
+    const stringValue = String(value);
+    if (stringValue.length === 0)
+        return true;
+    const { byKeyValue, byPathSegment } = fieldValueIndex(allActions);
+    const isOutsideGroup = (captures) => captures !== undefined && [...captures].some((capture) => !groupCaptures.has(capture));
+    return (isOutsideGroup(byKeyValue.get(fieldKey)?.get(stringValue)) ||
+        isOutsideGroup(byPathSegment.get(stringValue)));
+}
 /**
  * A same-endpoint capture group qualifies for collapsing when every capture
- * resolves to the same {@link responseShapeKey} (ruling out a mutation POST,
- * whose response is a single mutated object rather than an array, and any
- * group whose members diverge in response shape) AND its request fields vary
- * in at most one field once known non-semantic noise keys ({@link
- * CACHE_BUSTER_QUERY_KEYS}) are excluded from consideration, and that
- * remaining field is pagination-shaped -- a paged listing/facet re-query --
- * or vary in no field at all -- a polled toggles/feature-flag endpoint
- * re-fired with an identical request. A group
- * whose members vary in a non-pagination field (e.g. a per-item drill's
- * item-id body field) is left untouched: that variance carries the distinct
- * per-item state the existing fold-chain mechanism (`target.chain` in
+ * resolves to the same {@link responseShapeKey}, OR (when the response has no
+ * array field anywhere, e.g. a flat poll/flag-style object) every capture is
+ * either a non-mutation, or a mutation whose response body is byte-identical
+ * across every occurrence in the group, whose response independently
+ * resolves via {@link findObjectArrayFieldOrWholeObject}'s whole-object
+ * fallback -- this rules out a mutation POST with a genuinely varying
+ * response (e.g. a wizard section save), whose flat response is a single
+ * mutated object rather than a re-readable poll result, while still
+ * admitting a flat zero-variance re-poll fired via a mutating method (e.g. a
+ * feature-flag/heartbeat check fired via POST) -- AND EVERY request field
+ * that varies once known non-semantic
+ * noise keys ({@link CACHE_BUSTER_QUERY_KEYS}) are excluded from
+ * consideration is EITHER pagination-shaped -- a paged listing/facet re-query
+ * -- OR (when `allActions`, the full capture sequence, is supplied)
+ * independently proven via {@link isFieldValueThreadedElsewhere} to never be
+ * read by any capture OUTSIDE this same-endpoint group -- a cache-buster/
+ * nonce/request-id shape the literal allowlists don't happen to name, OR a
+ * cursor the group's own members hand to each other (page 1's response
+ * minting the exact value page 2's request carries) -- or the group varies
+ * in no field at all -- a polled toggles/feature-flag endpoint re-fired with
+ * an identical request. A group can have any number of varying keys; each
+ * one must clear its own pagination-or-dead check independently, so a page
+ * cursor alongside an unrelated dead cache-buster key still collapses.
+ * Without `allActions` (unit tests exercising this predicate in isolation,
+ * with no flow context to check against) a non-pagination varying key can't
+ * be structurally proven dead, so the group is left untouched -- the same
+ * conservative outcome as before this widening. A group with any varying
+ * field proven read by a DIFFERENT step outside the group (e.g. a per-item
+ * drill's item-id, later echoed into that item's detail request) is
+ * likewise left untouched: that variance carries the distinct per-item
+ * state the existing fold-chain mechanism (`target.chain` in
  * `emitMultiStepExecuteHttp`) already hoists correctly once resolved, and
  * collapsing it here would erase the very state that hoisting depends on.
  */
-function isRedundantSameEndpointGroup(group) {
+function isRedundantSameEndpointGroup(group, allActions) {
     const shapeKey = responseShapeKey(group[0].capture);
-    if (shapeKey === null)
-        return false;
-    if (!group.every((a) => responseShapeKey(a.capture) === shapeKey))
-        return false;
+    if (shapeKey !== null) {
+        if (!group.every((a) => responseShapeKey(a.capture) === shapeKey))
+            return false;
+    }
+    else {
+        // A flat (non-array) response never resolves a `responseShapeKey`, but a
+        // zero-variance re-poll of a flag/toggle endpoint still needs a shape to
+        // key on -- fall back to the whole-object candidate every group member
+        // must independently resolve to. A GraphQL mutation (detected via the
+        // parsed operation query) is always excluded, since its response is by
+        // definition the result of a state change. A REST capture excluded only
+        // because of its HTTP method (POST/PUT/PATCH/DELETE) is admitted anyway
+        // when every occurrence's response body is byte-identical -- that is
+        // proof the call carries no distinct mutated state at all (a
+        // feature-flag/heartbeat check fired via POST), the same zero-variance
+        // signal {@link isZeroVarianceRepeatCapture} already uses for noise
+        // exclusion, generalized here for the collapse decision.
+        const isGraphQLMutation = (capture) => capture.query !== null && /^\s*mutation\b/.test(capture.query);
+        const responsesByteIdentical = group.every((a) => JSON.stringify(a.capture.responseBody) === JSON.stringify(group[0].capture.responseBody));
+        const isFlatObject = (capture) => !isGraphQLMutation(capture) &&
+            (!isMutationCapture(capture) || responsesByteIdentical) &&
+            responseShapeKey(capture) === null &&
+            findObjectArrayFieldOrWholeObject(capture.responseBody) !== null;
+        if (!group.every((a) => isFlatObject(a.capture)))
+            return false;
+    }
     const fieldSets = group.map((a) => captureRequestFields(a.capture));
     const allKeys = new Set();
     for (const fields of fieldSets) {
@@ -1812,7 +2075,30 @@ function isRedundantSameEndpointGroup(group) {
     });
     if (varyingKeys.length === 0)
         return true;
-    return varyingKeys.length === 1 && PAGINATION_FIELD_NAME_PATTERN.test(varyingKeys[0]);
+    const groupCaptures = new Set(group.map((a) => a.capture));
+    return varyingKeys.every((key) => {
+        const leafName = fieldKeyLeafName(key);
+        if (PAGINATION_FIELD_NAME_PATTERN.test(leafName))
+            return true;
+        // A flat response's varying field name must still look like scaffolding
+        // UNLESS it lives only in the URL query string (never the JSON body) --
+        // a query-string param is the conventional home for ephemeral
+        // client-generated metadata (cache-busters, correlation ids, poll
+        // ticks) regardless of what the site happens to call it, whereas a
+        // JSON body field is where a mutation's genuine submitted payload (an
+        // address line, a card's last4) lives, and that ambiguity is exactly
+        // why the name-pattern requirement stays for body fields: an unnamed
+        // body field being "never echoed elsewhere" is no proof it's dead, only
+        // that nothing downstream happened to read it back.
+        if (shapeKey === null &&
+            !SCAFFOLDING_FIELD_NAME_PATTERN.test(leafName) &&
+            !isQueryStringOnlyKey(key, group)) {
+            return false;
+        }
+        if (!allActions)
+            return false;
+        return fieldSets.every((fields) => !isFieldValueThreadedElsewhere(leafName, fields[key], groupCaptures, allActions));
+    });
 }
 /**
  * REST counterpart of {@link dedupRedundantSameOperationCaptures}: collapses
@@ -1827,6 +2113,16 @@ function isRedundantSameEndpointGroup(group) {
  * whichever page's response survives — page 1 is what a browsing/drill flow
  * actually saw and drilled into first, so it is the occurrence downstream
  * join values are captured against, not the endpoint's final paged state.
+ *
+ * A real per-item drill can join against ANY page's item, though, not just
+ * page 1's — so before the rest of the group is dropped, every OTHER
+ * occurrence's own array-field items (at the same {@link responseShapeKey}
+ * path proven identical across the group) are concatenated onto the kept
+ * representative's response body. Without this, {@link
+ * detectDrillDownFoldPlan}'s structural scan only ever sees page 1's items
+ * (every later page having just been deleted), so a drill keyed off a
+ * later page's item can never resolve a join match and falls through to a
+ * hardcoded per-capture `httpClient` call instead of folding into the loop.
  */
 function collapseRedundantSameEndpointCaptures(actions) {
     const positionsByGroup = new Map();
@@ -1836,17 +2132,82 @@ function collapseRedundantSameEndpointCaptures(actions) {
         positions.push(i);
         positionsByGroup.set(key, positions);
     });
+    const mergedRepresentativeByPosition = new Map();
     const drop = new Set();
     for (const positions of positionsByGroup.values()) {
         if (positions.length < 2)
             continue;
         const group = positions.map((i) => actions[i]);
-        if (!isRedundantSameEndpointGroup(group))
+        if (!isRedundantSameEndpointGroup(group, actions))
             continue;
+        const merged = mergeCollapsedGroupItemsIntoRepresentative(group);
+        if (merged !== null)
+            mergedRepresentativeByPosition.set(positions[0], merged);
         for (const position of positions.slice(1))
             drop.add(position);
     }
-    return actions.filter((_, i) => !drop.has(i));
+    return actions
+        .map((a, i) => mergedRepresentativeByPosition.get(i) ?? a)
+        .filter((_, i) => !drop.has(i));
+}
+/**
+ * Builds a REPLACEMENT for the kept representative's (`group[0]`) own
+ * {@link ActionCapture} whose response body concatenates every OTHER group
+ * member's array-field items at their shared {@link responseShapeKey} path
+ * onto the representative's own items — see {@link
+ * collapseRedundantSameEndpointCaptures}'s docstring for why. Returns `null`
+ * (no replacement needed) when the group's shape key is `null` (the
+ * flat/zero-variance-poll branch of {@link isRedundantSameEndpointGroup}, with
+ * no array-field path to merge items at) or when no other member actually
+ * contributes an item at that path.
+ *
+ * A NEW response body/capture/action is built rather than mutating the
+ * representative's own objects in place, deliberately: {@link
+ * findAllObjectArrayFields}'s `objectArrayFieldsCache` is keyed on response-body
+ * object IDENTITY under the explicit invariant that a response body is never
+ * mutated after it's produced — mutating `representative.capture.responseBody`
+ * in place would poison that cache with whatever shape happened to be computed
+ * (and cached) from it before this runs, silently discarding the merge for
+ * every caller downstream that hits the stale cache entry instead of the
+ * mutated array.
+ */
+function mergeCollapsedGroupItemsIntoRepresentative(group) {
+    const representative = group[0];
+    const arrayField = findObjectArrayField(representative.capture.responseBody);
+    if (!arrayField)
+        return null;
+    const mergedItems = arrayField.items.slice();
+    let contributed = false;
+    for (const other of group.slice(1)) {
+        const otherArrayField = findObjectArrayField(other.capture.responseBody);
+        if (!otherArrayField || otherArrayField.path.join(".") !== arrayField.path.join("."))
+            continue;
+        mergedItems.push(...otherArrayField.items);
+        contributed = true;
+    }
+    if (!contributed)
+        return null;
+    const mergedBody = setValueAtPath(representative.capture.responseBody, arrayField.path, mergedItems);
+    return { ...representative, capture: { ...representative.capture, responseBody: mergedBody } };
+}
+/**
+ * Returns a shallow-cloned-along-the-path copy of `body` with the value at
+ * `path` replaced by `newValue` — the immutable counterpart to mutating a
+ * response body in place, used by {@link
+ * mergeCollapsedGroupItemsIntoRepresentative} so the object-identity-keyed
+ * {@link objectArrayFieldsCache} never sees the same object with two different
+ * shapes. Only plain-object segments are supported (every real caller's
+ * `arrayField.path` is a DFS-discovered chain of object keys, never an array
+ * index), so an unresolvable segment returns `body` unchanged.
+ */
+function setValueAtPath(body, path, newValue) {
+    if (path.length === 0)
+        return newValue;
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return body;
+    const [head, ...rest] = path;
+    const record = body;
+    return { ...record, [head]: setValueAtPath(record[head], rest, newValue) };
 }
 /**
  * Recursively walks a JSON value and yields every string leaf, paired with its
@@ -3002,7 +3363,7 @@ function* walkSetCookiePairs(rawSetCookie) {
  */
 /** Exported for unit testing — lets tests exercise the produces[] walk (body
  * AND header/cookie origins) directly against synthetic Capture sequences. */
-function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndices = new Set(), forceIncludeValues = new Set()) {
+function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndices = new Set(), forceIncludeValues = new Map()) {
     const index = new Map();
     // Computed structurally off the SAME captures being indexed (no
     // foldReturnSpec available at this layer) — a spec-declared fold's own
@@ -3011,6 +3372,18 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
     // call), so this indexes a chain-produced value regardless of whether the
     // fold plan that confirmed it is structural or spec-declared.
     const chainForceIncludeValues = collectDependentDrillDownChainValues(captures.map((capture) => ({ capture })), null);
+    // The set of captures a short/force-included value is actually eligible to
+    // be spliced into — the union of whatever `chainForceIncludeValues` and the
+    // caller-supplied `forceIncludeValues` proved for that value. `undefined`
+    // when the value isn't exemption-derived, meaning the eligibility
+    // restriction doesn't apply (see `StateValue.eligibleConsumers`).
+    const eligibleConsumersFor = (value) => {
+        const chainConsumers = chainForceIncludeValues.get(value);
+        const forceConsumers = forceIncludeValues.get(value);
+        if (!chainConsumers && !forceConsumers)
+            return undefined;
+        return new Set([...(chainConsumers ?? []), ...(forceConsumers ?? [])]);
+    };
     // First pass: identify the earliest origin among ACTION captures for each
     // value. Action-only earliest-origin tracking is what compileActionSteps'
     // produces[] check needs — it ignores non-action captures (telemetry GETs,
@@ -3033,9 +3406,8 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                 // floor below: a cookie-sourced value the fold-chain detector already
                 // confirmed is threaded into a later hop's request is exactly as
                 // legitimate as a long one, so it must not be dropped for being short.
-                if (value.length < MIN_STATE_VALUE_LENGTH &&
-                    !chainForceIncludeValues.has(value) &&
-                    !forceIncludeValues.has(value))
+                const isShort = value.length < MIN_STATE_VALUE_LENGTH;
+                if (isShort && !chainForceIncludeValues.has(value) && !forceIncludeValues.has(value))
                     continue;
                 if (value.length > MAX_COOKIE_STATE_VALUE_LENGTH)
                     continue;
@@ -3047,6 +3419,7 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                         originIndex: i,
                         path: [],
                         headerOrigin: { sourceHeader: "set-cookie", cookieName: name },
+                        eligibleConsumers: isShort ? eligibleConsumersFor(value) : undefined,
                     });
                 }
             }
@@ -3073,6 +3446,9 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                     originIndex: i,
                     path: [],
                     headerOrigin: { sourceHeader: headerName },
+                    eligibleConsumers: headerValue.length < MIN_STATE_VALUE_LENGTH
+                        ? eligibleConsumersFor(headerValue)
+                        : undefined,
                 });
             }
         }
@@ -3090,9 +3466,8 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
             if (rawValue === null)
                 continue;
             const value = String(rawValue);
-            if (value.length < MIN_STATE_VALUE_LENGTH &&
-                !chainForceIncludeValues.has(value) &&
-                !forceIncludeValues.has(value))
+            const isShort = value.length < MIN_STATE_VALUE_LENGTH;
+            if (isShort && !chainForceIncludeValues.has(value) && !forceIncludeValues.has(value))
                 continue;
             if (value.length > MAX_STATE_VALUE_LENGTH)
                 continue;
@@ -3117,7 +3492,12 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                 !forceIncludeValues.has(value))
                 continue;
             if (!index.has(value)) {
-                index.set(value, { value, originIndex: i, path });
+                index.set(value, {
+                    value,
+                    originIndex: i,
+                    path,
+                    eligibleConsumers: isShort ? eligibleConsumersFor(value) : undefined,
+                });
             }
         }
     }
@@ -3320,6 +3700,13 @@ function compileActionSteps(actions, stateIndex) {
     for (const { capture } of actions) {
         const bodyLeafValues = jsonBodyLeafValues(capture.requestPostData);
         for (const sv of stateIndex.values()) {
+            // A short value indexed only via the chain/force-include exemption
+            // (see `StateValue.eligibleConsumers`) is a real dependency ONLY for
+            // the specific capture(s) the chain detector proved it threads into —
+            // everywhere else, a coincidental substring match (a digit inside an
+            // unrelated opaque path segment) is not reuse and must not splice.
+            if (sv.eligibleConsumers && !sv.eligibleConsumers.has(capture))
+                continue;
             if (capture.url.includes(sv.value)) {
                 usedValues.add(sv.value);
                 continue;
@@ -3346,6 +3733,8 @@ function compileActionSteps(actions, stateIndex) {
         }
         for (const [headerName, headerValue] of Object.entries(capture.requestHeaders)) {
             for (const sv of stateIndex.values()) {
+                if (sv.eligibleConsumers && !sv.eligibleConsumers.has(capture))
+                    continue;
                 if (!headerValue.includes(sv.value))
                     continue;
                 usedValues.add(sv.value);
@@ -3447,7 +3836,7 @@ function compileActionSteps(actions, stateIndex) {
                     name = `${pathToVarName(path)}${suffix}`;
                 }
                 seenNames.add(name);
-                produces.push({ kind: "body", name, path });
+                produces.push({ kind: "body", name, path, eligibleConsumers: sv.eligibleConsumers });
             }
         }
         const ct = Object.entries(capture.requestHeaders).find(([k]) => k.toLowerCase() === "content-type");
@@ -3522,37 +3911,138 @@ function resolveResponsePathValue(responseBody, path) {
         ? String(cursor)
         : null;
 }
+/** Builds the shared word-boundary-guarded, longest-value-first alternation
+ * pattern used by both {@link interpolateStateValues} and
+ * {@link substituteThreadedValues}: a value can never win a match at a position
+ * a longer value also matches, and a value flanked by an alphanumeric — or by a
+ * `-`/`.` itself flanked by an alphanumeric — never matches inside an unrelated
+ * opaque token (e.g. splicing a "12" into a hyphen-joined "SKU-12-9F3Z"
+ * segment) while a standalone occurrence (e.g. "/items/42/") still matches. */
+function buildValueAlternationPattern(sortedValues) {
+    return new RegExp(`(?<![A-Za-z0-9][-.])\\b(?:${sortedValues.map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b(?![-.][A-Za-z0-9])`, "g");
+}
+/**
+ * Finds every `${...}` span in `text` by brace-depth counting rather than a
+ * non-nesting regex, so an ALREADY-nested placeholder (e.g. one produced by an
+ * earlier, buggier pass, or in principle any `${a${b}c}` shape) is reported as
+ * ONE span covering the outer `${` through its true matching `}` — never as
+ * just the innermost `${b}` — because a regex excluding `{`/`}` from its body
+ * (`/\$\{[^{}]*\}/`) cannot see past the first inner brace and would otherwise
+ * leave the outer span's `a`/`c` text unprotected for a later pass to splice
+ * into, compounding the corruption instead of guarding against it.
+ */
+function findBalancedPlaceholderSpans(text) {
+    const spans = [];
+    let searchFrom = 0;
+    while (searchFrom < text.length) {
+        const start = text.indexOf("${", searchFrom);
+        if (start === -1)
+            break;
+        let depth = 1;
+        let cursor = start + 2;
+        while (cursor < text.length && depth > 0) {
+            if (text[cursor] === "{")
+                depth++;
+            else if (text[cursor] === "}")
+                depth--;
+            cursor++;
+        }
+        spans.push([start, cursor]);
+        searchFrom = cursor;
+    }
+    return spans;
+}
+/**
+ * Runs `pattern` over `text`, replacing each match via `bindingByValue`,
+ * EXCEPT a match that overlaps a `${...}` placeholder already present in
+ * `text`. A single call's own matches never overlap each other (`replace`/
+ * `matchAll` scan left-to-right without revisiting consumed text), so within
+ * one call this only matters when `text` is the OUTPUT of an earlier call on
+ * this same mechanism — e.g. a fold's per-item pass re-running over Pass 1's
+ * already-interpolated URL/header/body text with a different (per-item)
+ * binding table. Without this guard, that second pass's value-equality match
+ * has no way to know a span it's about to touch is actually the FIRST pass's
+ * `${varName}` placeholder for an entirely different producer/consumer
+ * relationship — it just sees literal characters that happen to equal one of
+ * its own bound values (e.g. the digits inside `${warehouseSlot47}`,
+ * coincidentally also this fold item's own field value) and splices its
+ * replacement in anyway, producing an invalidly-nested `${a${b}c}` literal
+ * that resolves to neither value at runtime. Skipping any match that overlaps
+ * an existing placeholder keeps every substitution scoped to the pass that
+ * actually owns that span, which is the producer/consumer relationship this
+ * mechanism is supposed to encode — and guarantees the output can never open
+ * a `${` before a prior `${...}` closes.
+ */
+function replaceGuardedAgainstExistingPlaceholders(text, pattern, bindingByValue) {
+    const protectedSpans = findBalancedPlaceholderSpans(text);
+    let result = "";
+    let cursor = 0;
+    for (const match of text.matchAll(pattern)) {
+        const start = match.index;
+        const end = start + match[0].length;
+        if (protectedSpans.some(([spanStart, spanEnd]) => start < spanEnd && end > spanStart))
+            continue;
+        result += text.slice(cursor, start) + (bindingByValue.get(match[0]) ?? match[0]);
+        cursor = end;
+    }
+    return result + text.slice(cursor);
+}
 /**
  * Replaces occurrences of state values in `template` with `${varName}`
  * interpolations. Returns a JS template-literal string fragment (no backticks).
  *
  * Algorithm: walk the producing steps' response bodies in order, harvest each
- * produced value's concrete string, and map it to the produces[].name. Then
- * scan the template for those strings and replace with ${varName}. Length-
- * descending order avoids prefix conflicts (e.g. an 8-char prefix of a
- * 36-char UUID).
- */
-function interpolateStateValues(template, priorSteps, payloadAccessorByValue = new Map()) {
-    const varNameByValue = deriveStateVarByValue(priorSteps);
-    let result = template;
-    // Pass 1: substitute state values (length-descending to avoid prefix
-    // conflicts). `\$` is a literal dollar sign (NOT an interpolation);
-    // `${varName}` interpolates the binding name at code-generation time so
-    // the resulting string contains a template-literal placeholder like
-    // `${candidateId}`.
-    const sortedState = [...varNameByValue.entries()].sort((a, b) => b[0].length - a[0].length);
-    for (const [value, varName] of sortedState) {
-        result = result.split(value).join(`\${${varName}}`);
-    }
-    // Pass 2: substitute payload values that survived the state pass. Same
-    // length-descending order. The payload pass only fires on remaining
-    // literal occurrences, so state substitutions win on collisions
-    // (e.g., when an Auth.UserName response value contains the user's email).
-    const sortedPayload = [...payloadAccessorByValue.entries()].sort((a, b) => b[0].length - a[0].length);
-    for (const [value, accessor] of sortedPayload) {
-        result = result.split(value).join(`\${${accessor}}`);
+ * produced value's concrete string, and map it to the produces[].name, then
+ * merge in the payload accessors (state wins on collision — e.g. when an
+ * Auth.UserName response value equals the user's submitted email). A single
+ * word-boundary-anchored regex alternation (longest value first, so an 8-char
+ * prefix never shadows the 36-char UUID it's a prefix of) is matched over the
+ * ORIGINAL template text exactly once — see {@link buildValueAlternationPattern}
+ * for the anchoring guarantee and {@link replaceGuardedAgainstExistingPlaceholders}
+ * for why a match overlapping an already-emitted `${...}` is skipped rather
+ * than spliced into.
+ */
+function interpolateStateValues(template, priorSteps, targetCapture, payloadAccessorByValue = new Map()) {
+    const varNameByValue = deriveStateVarByValue(priorSteps, targetCapture);
+    const bindingByValue = new Map();
+    for (const [value, accessor] of payloadAccessorByValue) {
+        bindingByValue.set(value, `\${${accessor}}`);
+    }
+    for (const [value, varName] of varNameByValue) {
+        bindingByValue.set(value, `\${${varName}}`);
+    }
+    if (bindingByValue.size === 0)
+        return template;
+    const sortedValues = [...bindingByValue.keys()].sort((a, b) => b.length - a.length);
+    const pattern = buildValueAlternationPattern(sortedValues);
+    return replaceGuardedAgainstExistingPlaceholders(template, pattern, bindingByValue);
+}
+/**
+ * Rewrites every occurrence of a set of literal values to their accessor
+ * expressions in ONE pass over `text`, matching {@link interpolateStateValues}'s
+ * guarded shape — see {@link buildValueAlternationPattern} for the anchoring
+ * guarantee. A per-value sequential `.replace()` loop would re-scan the
+ * PROGRESSIVELY MUTATED result on every iteration, letting one field's inserted
+ * `${...}` replacement text land inside a position a later field's regex still
+ * matches — producing a nested `${...${...}}` placeholder. Doing it once over
+ * the original text closes that class of bug within this call; when `text` is
+ * itself the already-interpolated output of an EARLIER call on this mechanism
+ * (a fold's per-item pass over Pass 1's rendered URL/header/body), {@link
+ * replaceGuardedAgainstExistingPlaceholders} closes the same class of bug
+ * across calls by refusing to match inside a placeholder that call already
+ * emitted.
+ */
+function substituteThreadedValues(text, bindings) {
+    if (bindings.length === 0)
+        return text;
+    const bindingByValue = new Map();
+    for (const { value, replacement } of bindings) {
+        if (!bindingByValue.has(value))
+            bindingByValue.set(value, replacement);
     }
-    return result;
+    const sortedValues = [...bindingByValue.keys()].sort((a, b) => b.length - a.length);
+    const pattern = buildValueAlternationPattern(sortedValues);
+    return replaceGuardedAgainstExistingPlaceholders(text, pattern, bindingByValue);
 }
 /**
  * Finds the request-body coordinates a PRODUCING step must source from the
@@ -3729,13 +4219,22 @@ const MAX_URL_PARAM_DECODE_DEPTH = 3;
  * Header/cookie-origin produces are skipped: they have no body path and their
  * value never appears as a literal in a URL/body template (http-client's `bind`
  * forwards it directly as a request header), so there is nothing to interpolate.
- */
-function deriveStateVarByValue(priorSteps) {
+ *
+ * `targetCapture` is the capture the returned bindings are about to be spliced
+ * INTO. A produce whose value is chain/force-include-exempt (see
+ * `BodyProduce.eligibleConsumers`) is a real dependency only for the specific
+ * capture(s) the chain detector proved it threads into — everywhere else, a
+ * coincidental substring match must not bind, or `interpolateStateValues`
+ * splices it into an unrelated capture's URL/body/headers.
+ */
+function deriveStateVarByValue(priorSteps, targetCapture) {
     const varNameByValue = new Map();
     for (const step of priorSteps) {
         for (const p of step.produces) {
             if (p.kind === "header")
                 continue;
+            if (p.eligibleConsumers && !p.eligibleConsumers.has(targetCapture))
+                continue;
             const value = resolveResponsePathValue(step.capture.responseBody, p.path);
             if (value !== null)
                 varNameByValue.set(value, p.name);
@@ -4368,7 +4867,17 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         const step = actions[i];
         const cap = step.capture;
         const prior = actions.slice(0, i);
-        const url = interpolateStateValues(cap.url, prior, payloadAccessorByValue);
+        // A capture proven request-invariant ({@link isZeroVarianceRepeatCapture})
+        // must never be treated as an interpolation target at all: its URL is
+        // provably fixed across every occurrence, so any state-value splice into
+        // it can only be a coincidental match, never a real dependency — the same
+        // failure shape already fixed for GET responses (see `indexStateValues`'s
+        // isGet UUID-only floor) and for the fold/drill per-item pass. Rendering
+        // its exact literal URL makes this hold even when a value's own
+        // length/chain-eligibility scoping doesn't happen to catch the coincidence.
+        const url = (0, capture_filters_1.isZeroVarianceRepeatCapture)(cap, actions.map((a) => a.capture))
+            ? cap.url
+            : interpolateStateValues(cap.url, prior, cap, payloadAccessorByValue);
         // Form-schema substitution runs first on the raw recon body so its
         // field-id-anchored matches see the original JSON. State-threading and
         // payload key-value passes then run on top. Option-id substitution runs
@@ -4404,7 +4913,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         // must stay reachable for state threading, not get frozen as caller data.
         const rawBodyWithStructuredSubs = parsedBody !== null
             ? applyStructuredValuePayloadSubstitutions(rawBodyWithFormSubs, parsedBody, outStructuredKeys, new Set([
-                ...deriveStateVarByValue(prior).keys(),
+                ...deriveStateVarByValue(prior, cap).keys(),
                 ...(joinFieldValuesByStep.get(i) ?? []),
             ]))
             : rawBodyWithFormSubs;
@@ -4431,14 +4940,14 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             if (binding.producerIndex === i)
                 urlParamBindings.set(value, binding.accessor);
         }
-        for (const [value, varName] of deriveStateVarByValue(prior)) {
+        for (const [value, varName] of deriveStateVarByValue(prior, cap)) {
             urlParamBindings.set(value, varName);
         }
         const rawBodyWithUrlParams = parsedBody !== null
             ? applyUrlParamPayloadSubstitutions(rawBodyWithProducerBoundary, parsedBody, urlParamBindings)
             : rawBodyWithProducerBoundary;
         const bodyAfterStateAndKv = rawBodyWithUrlParams
-            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, payloadAccessorByValue), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
+            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, cap, payloadAccessorByValue), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
             : "";
         // Mechanism A — generic (plain-JSON, wire-key-anchored) dropdown label→code
         // rewrite. Runs AFTER interpolateStateValues + the payload-KV pass, not
@@ -4467,7 +4976,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         for (const [k, v] of Object.entries(cap.requestHeaders)) {
             const lower = k.toLowerCase();
             if (lower === "api-token" || lower === "authorization" || joinCarryingHeaderNames?.has(k)) {
-                perCallHeaders[k] = interpolateStateValues(v, prior, payloadAccessorByValue);
+                perCallHeaders[k] = interpolateStateValues(v, prior, cap, payloadAccessorByValue);
             }
         }
         // G1: emit baseUrl-derived headers (Origin, Referer) per-call from
@@ -4569,7 +5078,15 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
     // block-scoped to that loop and never escape to the rest of the function,
     // so none of them may run through the outer `declaredNames`/produceLines
     // bookkeeping below (that bookkeeping assumes function-scope declarations).
-    const foldChainIndices = new Set(foldPlans.flatMap((plan) => plan.targets.flatMap((target) => target.chain)));
+    // Absorbed indices (see FoldPlan.absorbedIndices) are repeat raw captures
+    // of a target's own endpoint, threaded from a DIFFERENT primary item — the
+    // single representative target already re-issues that endpoint once per
+    // fold-loop iteration, so these must be dropped from normal per-step
+    // emission too, exactly like the chain indices they're folded in with.
+    const foldChainIndices = new Set(foldPlans.flatMap((plan) => [
+        ...plan.targets.flatMap((target) => target.chain),
+        ...plan.absorbedIndices,
+    ]));
     for (let i = 0; i < actions.length; i++) {
         const step = actions[i];
         const cap = step.capture;
@@ -4663,12 +5180,32 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                 const suffix = foldPlan.targets.length > 1 ? `${planSuffix}${targetIndex}` : planSuffix;
                 const scopedAccessor = (varName, field) => `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
                 const joinAccessor = (field) => scopedAccessor(itemVar, field);
-                // Word-boundary anchored: a plain `.split(value).join(...)` would also
-                // rewrite unrelated substrings that happen to contain the join value
-                // (e.g. a "p1" product id colliding with a "/v1/" path segment or a
-                // "p10" sibling id), corrupting parts of the request the join field
-                // never touched.
-                const replaceWholeValue = (haystack, value, replacement) => haystack.replace(new RegExp(`\\b${value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "g"), replacement);
+                // Computed once per fold target instead of once per `parameterize`
+                // call: `actions` never changes across the url/headers/body calls a
+                // single chain step makes (or across chain steps), so re-deriving
+                // this array inside the closure was O(actions.length) work repeated
+                // 3x per chain hop for no reason.
+                const allCaptures = actions.map((a) => a.capture);
+                // `isZeroVarianceRepeatCapture`'s verdict is a pure function of
+                // `chainCapture` (and the now-hoisted `allCaptures`, which is fixed
+                // for the whole target) — memoized here so the 3 `parameterize`
+                // calls a single chain step makes (url, headers, body) each share
+                // the one verdict computed for that step's `chainCapture` instead of
+                // re-scanning `allCaptures` from scratch every time.
+                const isProvenInvariantMemo = new Map();
+                const isProvenInvariantFor = (chainCapture) => {
+                    const cached = isProvenInvariantMemo.get(chainCapture);
+                    if (cached !== undefined)
+                        return cached;
+                    const computed = (0, capture_filters_1.isZeroVarianceRepeatCapture)(chainCapture, allCaptures);
+                    isProvenInvariantMemo.set(chainCapture, computed);
+                    return computed;
+                };
+                // Whole-value substitution runs via substituteThreadedValues: a single
+                // guarded regex-alternation pass over the original text, not a
+                // per-field sequential `.replace()` loop — see that function's doc for
+                // why the sequential shape corrupts opaque path segments and can nest
+                // `${...}` placeholders.
                 const parameterize = (text, chainCapture) => {
                     // A join field can reach the render either as the raw captured
                     // literal (URL query params) or as an already-generic
@@ -4685,7 +5222,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                     // invisible and gets frozen as a literal.
                     const rawThreadedFields = dedupeThreadedFields([
                         ...target.joinFields.map((field) => ({ varName: itemVar, field })),
-                        ...findThreadedJoinFields(threadingScopes, chainCapture, actions.map((a) => a.capture)),
+                        ...findThreadedJoinFields(threadingScopes, chainCapture, allCaptures),
                     ]);
                     // A proven ancestor-scoped drill (see isAncestorScoped above) still
                     // rebinds fields findThreadedJoinFields left on itemVar purely
@@ -4713,7 +5250,14 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                                 : tf,
                         }))
                         : rawThreadedFields.map((tf) => ({ valueField: tf, accessorField: tf }));
-                    const result = threadedFieldPairs.reduce((acc, { valueField, accessorField }) => {
+                    // Accessor swap first: rewrites an already-templated `${payload.X}`
+                    // reference (from applyPayloadKeyValueSubstitutions) to this field's
+                    // real accessor. Each target (`${payload.X}`) is a unique, fully
+                    // delimited string that the swap's own output (`${accessorField...}`,
+                    // never re-shaped into `${payload.X}` form) can't re-match, so a
+                    // sequential pass here carries none of the reentrancy risk the
+                    // literal-value pass below has.
+                    const swapped = threadedFieldPairs.reduce((acc, { valueField, accessorField }) => {
                         const replacement = `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`;
                         // applyPayloadKeyValueSubstitutions only ever names a payload
                         // accessor after the DRILL REQUEST's own top-level JSON key
@@ -4726,11 +5270,18 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                         // reference behind once the literal value itself has already
                         // been replaced by the payload-key-value pass.
                         const lastSegment = valueField.field.split(".").pop();
-                        const withAccessorSwapped = acc
+                        return acc
                             .split(`\${payload.${valueField.field}}`)
                             .join(replacement)
                             .split(`\${payload.${lastSegment}}`)
                             .join(replacement);
+                    }, text);
+                    // Literal-value substitution: ONE guarded regex-alternation pass over
+                    // `swapped` for every threaded field's value, longest first — see
+                    // substituteThreadedValues's doc for why a per-field sequential pass
+                    // here (the bug this replaces) can nest `${...}` placeholders.
+                    const valueBindings = threadedFieldPairs
+                        .map(({ valueField, accessorField }) => {
                         const scopeObj = valueField.varName === itemVar
                             ? firstItem
                             : ancestorObjByVar.get(valueField.varName);
@@ -4740,12 +5291,36 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                             : typeof value === "number" || typeof value === "boolean"
                                 ? String(value)
                                 : null;
-                        return stringValue !== null
-                            ? replaceWholeValue(withAccessorSwapped, stringValue, replacement)
-                            : withAccessorSwapped;
-                    }, text);
+                        return stringValue === null
+                            ? null
+                            : {
+                                value: stringValue,
+                                replacement: `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`,
+                            };
+                    })
+                        .filter((b) => b !== null);
+                    // A capture proven request-invariant ({@link isZeroVarianceRepeatCapture})
+                    // must never have a COINCIDENTAL threaded value spliced into it —
+                    // but the invariance verdict is per-capture, not per-field: a
+                    // capture can be fixed on one key (a repeated `qty`) while still
+                    // genuinely varying on another (`itemId`), so only the fields that
+                    // {@link isGenuineVaryingQueryValue} can't prove are real per-request
+                    // dependencies get excluded, never the whole substitution pass.
+                    const isProvenInvariant = isProvenInvariantFor(chainCapture);
+                    const filteredValueBindings = isProvenInvariant
+                        ? valueBindings.filter((b) => isGenuineVaryingQueryValue(b.value, chainCapture, allCaptures))
+                        : valueBindings;
+                    const result = substituteThreadedValues(swapped, filteredValueBindings);
                     const withDrillParamBindings = applyDrillParamBindings(foldReturnSpec, chainCapture, result);
-                    assertNoFrozenVaryingDrillParams("emitMultiStepExecuteHttp", chainCapture, withDrillParamBindings, actions.map((a) => a.capture));
+                    // The frozen-varying-param safety net exists to catch a
+                    // misconfigured drill (a param that genuinely needs joinFields/an
+                    // ancestor binding but has neither) — it does not apply once the
+                    // capture is already proven request-invariant: freezing an
+                    // undeclared, business-irrelevant varying key (a beacon nonce)
+                    // there is the INTENDED behavior, not a misconfiguration.
+                    if (!isProvenInvariant) {
+                        assertNoFrozenVaryingDrillParams("emitMultiStepExecuteHttp", chainCapture, withDrillParamBindings, allCaptures);
+                    }
                     return withDrillParamBindings;
                 };
                 // Every chain step's response and produces are block-scoped to this
@@ -4771,6 +5346,9 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                 for (const chainIndex of target.chain) {
                     const chainStep = actions[chainIndex];
                     const chainRendered = rendered[chainIndex];
+                    // The zero-variance guard lives inside `parameterize` itself (see
+                    // above) so it can skip only the threaded-value splice while still
+                    // letting a spec-declared drillParamBindings substitution apply.
                     const paramUrl = parameterize(chainRendered.url, chainStep.capture);
                     const paramHeaders = parameterize(chainRendered.headersExpr, chainStep.capture);
                     const paramBody = parameterize(chainRendered.bodyArg, chainStep.capture);
@@ -4862,7 +5440,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             for (const [k, v] of Object.entries(cap.requestHeaders)) {
                 const lower = k.toLowerCase();
                 if (lower === "api-token" || lower === "authorization") {
-                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`${interpolateStateValues(v, actions.slice(0, i), payloadAccessorByValue)}\``);
+                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`${interpolateStateValues(v, actions.slice(0, i), cap, payloadAccessorByValue)}\``);
                 }
             }
             // G1+G2: include tenant-derived headers in the multipart fetch too.
@@ -5518,6 +6096,40 @@ function applyDrillParamBindings(spec, capture, text) {
         return acc.replace(paramRx, (_full, prefix) => `${prefix}${accessor}`);
     }, text);
 }
+/** True when `value` is a QUERY PARAM value in `capture.url` whose key
+ * genuinely differs on at least one other same-endpoint occurrence in
+ * `allCaptures` — i.e. a real per-request dependency (an item id, a page
+ * cursor), not a coincidental byte match against an opaque path segment or a
+ * key that happens to hold the same value on every occurrence. Used to
+ * decide, field by field, whether a threaded-value splice into a capture
+ * proven request-invariant ({@link isZeroVarianceRepeatCapture}) is a
+ * legitimate substitution or the exact coincidence that guard exists to
+ * catch — a capture can be "invariant" on one key (a fixed `qty`) while
+ * still genuinely varying on another (`itemId`), so the invariance verdict
+ * alone can't gate substitution at the whole-capture level. */
+function isGenuineVaryingQueryValue(value, capture, allCaptures) {
+    let url;
+    try {
+        url = new URL(capture.url);
+    }
+    catch {
+        return false;
+    }
+    const key = [...url.searchParams.entries()].find(([, v]) => v === value)?.[0];
+    if (key === undefined)
+        return false;
+    const endpoint = endpointKey(capture.url);
+    return allCaptures.some((c) => {
+        if (c === capture || endpointKey(c.url) !== endpoint)
+            return false;
+        try {
+            return new URL(c.url).searchParams.get(key) !== value;
+        }
+        catch {
+            return false;
+        }
+    });
+}
 /** Throws when {@link findFrozenVaryingDrillParams} finds any frozen-but-
  * varying literal — shared by {@link parameterizeUrl} (below) and
  * `emitMultiStepExecuteHttp`'s own `parameterize` so the two emitters can't
@@ -5967,6 +6579,11 @@ function scanPrimaryCandidateGroups(actions, primaryIndex, globallyConsumedIndic
     const consumedIndices = new Set();
     for (const primaryArray of primaryCandidates) {
         const targets = [];
+        // See FoldPlan.absorbedIndices — a candidate hitting the SAME endpoint
+        // as a target already resolved for this array is a repeat raw capture
+        // of that one per-item drill (threaded from a DIFFERENT primary item),
+        // not an independent target, so it lands here instead of `targets`.
+        const absorbedIndices = [];
         // Pruned to the (typically tiny) set of later action indices whose
         // request could possibly thread one of this array's own item values —
         // see buildRequestStringValueIndex's docstring — instead of every
@@ -5987,6 +6604,24 @@ function scanPrimaryCandidateGroups(actions, primaryIndex, globallyConsumedIndic
             if (primaryMatchedItemIndex === -1)
                 continue;
             const joinFields = findThreadedJoinFields([{ varName: "item", obj: primaryArray.items[primaryMatchedItemIndex] }], drill.capture).map((f) => f.field);
+            // A genuinely per-item-varying repeated endpoint (the SAME drill
+            // called once per primary item, each occurrence threading a
+            // DIFFERENT item's own join value) is one logical target, not N — the
+            // fold loop already re-issues the representative target's request
+            // once per item via its own `item.<field>` accessor. Recognizing a
+            // later candidate as a repeat of an ALREADY-RESOLVED target's
+            // endpoint (rather than letting it become its own independent
+            // target) is exactly the widening this structural heuristic needed:
+            // previously every threading candidate became its own FoldTarget,
+            // so N per-item captures of one endpoint fanned out into N separate
+            // httpClient calls inside the loop instead of collapsing to one.
+            const drillEndpointKey = endpointKey(drill.capture.url);
+            const alreadyTargetedSameEndpoint = targets.some((t) => endpointKey(actions[t.drillStepIndex].capture.url) === drillEndpointKey);
+            if (alreadyTargetedSameEndpoint) {
+                absorbedIndices.push(drillIndex);
+                consumedIndices.add(drillIndex);
+                continue;
+            }
             // Widened to a flat (non-array) object response when the drill step has
             // no object-array field of its own — see
             // findAllObjectArrayFieldsOrWholeObject. A detail-by-id response (e.g.
@@ -6049,8 +6684,9 @@ function scanPrimaryCandidateGroups(actions, primaryIndex, globallyConsumedIndic
             for (const chainIndex of chain)
                 consumedIndices.add(chainIndex);
         }
-        if (targets.length > 0)
-            groups.push({ primaryArrayPath: primaryArray.path, targets });
+        if (targets.length > 0) {
+            groups.push({ primaryArrayPath: primaryArray.path, targets, absorbedIndices });
+        }
     }
     return groups;
 }
@@ -6151,6 +6787,7 @@ function detectDrillDownFoldPlan(actions) {
                 primaryStepIndex: freshestIndex,
                 primaryArrayPath: freshestGroup.primaryArrayPath,
                 targets: freshestGroup.targets,
+                absorbedIndices: freshestGroup.absorbedIndices,
             });
             // A step already folded into this plan's chains — the drill step(s)
             // and everything threaded onward from them — was already merged
@@ -6165,6 +6802,12 @@ function detectDrillDownFoldPlan(actions) {
                 for (const chainIndex of target.chain)
                     addConsumed(chainIndex);
             }
+            // Absorbed repeat occurrences (see FoldPlan.absorbedIndices) were never
+            // part of any target's chain, so they must be consumed here too, or
+            // they would surface as leftover raw indices and get emitted a second
+            // time as their own single hardcoded calls.
+            for (const absorbedIndex of freshestGroup.absorbedIndices)
+                addConsumed(absorbedIndex);
         }
     }
     return plans;
@@ -6685,6 +7328,7 @@ function buildFoldPlanFromSpec(actions, spec) {
                         chainTerminalIndex,
                     },
                 ],
+                absorbedIndices: [],
             };
             break;
         }
@@ -6895,12 +7539,21 @@ function mergeSpecPlanOntoSamePrimary(structuralPlans, actions, foldReturnSpec)
  * Runs directly off raw actions (not `resolveFoldPlan`, which needs
  * `isMultipart` — unavailable before `compileActionSteps` has run) since
  * fold-plan DETECTION depends only on each action's `capture`.
+ *
+ * Returns a value -> proven-consumer-captures map rather than a flat set: a
+ * value's chain-proven threading relationship holds ONLY between the
+ * specific chain hops that produced and consumed it, never globally across
+ * every capture in the flow. Callers that bypass `MIN_STATE_VALUE_LENGTH`
+ * for one of these values (see `indexStateValues`) must scope that bypass to
+ * the returned consumer set, or a short value legitimately threaded between
+ * two unrelated steps can coincidentally match inside a totally unrelated
+ * capture's own URL/body and get spliced into it.
  */
 function collectDependentDrillDownChainValues(actions, foldReturnSpec) {
     const structuralPlans = detectDrillDownFoldPlan(actions);
     const specPlan = foldReturnSpec === null ? null : buildFoldPlanFromSpec(actions, foldReturnSpec);
     const plans = structuralPlans.length > 0 ? structuralPlans : specPlan === null ? [] : [specPlan];
-    const values = new Set();
+    const consumersByValue = new Map();
     for (const plan of plans) {
         for (const target of plan.targets) {
             for (let j = 0; j < target.chain.length; j++) {
@@ -6916,14 +7569,17 @@ function collectDependentDrillDownChainValues(actions, foldReturnSpec) {
                         continue;
                     const laterRequestValues = collectRequestValuesIncludingHeaders(laterCapture);
                     for (const v of responseValues) {
-                        if (!echoedValues.has(v) && laterRequestValues.has(v))
-                            values.add(v);
+                        if (echoedValues.has(v) || !laterRequestValues.has(v))
+                            continue;
+                        const consumers = consumersByValue.get(v) ?? new Set();
+                        consumers.add(laterCapture);
+                        consumersByValue.set(v, consumers);
                     }
                 }
             }
         }
     }
-    return values;
+    return consumersByValue;
 }
 function resolveFoldPlan(actions, foldReturnSpec = null) {
     const structuralPlans = detectDrillDownFoldPlan(actions);
@@ -7013,17 +7669,59 @@ function replaceByReference(value, target, replacement) {
  * `throw` at the analogous point, minus the throw, since shape inference
  * degrading gracefully is preferable to failing a generate run over it.
  */
+/** Folds one drill-down response's matching item onto `body`'s primary
+ * array — the single-occurrence step {@link foldResponseBodyForShapeInference}
+ * runs once for a target's own representative drill and again for each of
+ * its {@link FoldPlan.absorbedIndices} siblings, so both call sites resolve
+ * the merge identically. `matchedItem` must already be resolved by the
+ * caller: the representative occurrence knows it via `primaryMatchedItemIndex`,
+ * while an absorbed occurrence resolves it by re-threading its OWN request
+ * against every primary item (see the call site) — a drill-down's RESPONSE
+ * commonly never echoes the join field it was looked up by, so matching by
+ * response content alone (as the representative branch's own `drillMatch`
+ * fallback does when the response doesn't echo it) can't identify WHICH item
+ * an absorbed occurrence belongs to in the first place. */
+function foldOneDrillOccurrence(body, primaryArrayPath, joinFields, drillItems, matchedItem) {
+    const primaryItems = objectItemsAtPath(body, primaryArrayPath);
+    if (!primaryItems)
+        return body;
+    const drillMatch = drillItems.find((d) => joinFields.every((f) => String(readValueAtPath(d, f.split("."))) ===
+        String(readValueAtPath(matchedItem, f.split("."))))) ?? drillItems[0];
+    if (!drillMatch)
+        return body;
+    return replaceByReference(body, matchedItem, { ...drillMatch, ...matchedItem });
+}
 function foldResponseBodyForShapeInference(actionSteps, foldPlan, initialBody = actionSteps[foldPlan.primaryStepIndex].capture.responseBody) {
     return foldPlan.targets.reduce((body, target) => {
         const drillBody = actionSteps[target.chainTerminalIndex].capture.responseBody;
         const primaryItems = objectItemsAtPath(body, foldPlan.primaryArrayPath);
         const drillItems = objectItemsAtPath(drillBody, target.chainArrayPath);
         const matchedItem = primaryItems?.[target.primaryMatchedItemIndex];
-        const drillMatch = drillItems?.find((d) => target.joinFields.every((f) => String(readValueAtPath(d, f.split("."))) ===
-            String(readValueAtPath(matchedItem, f.split("."))))) ?? drillItems?.[0];
-        if (!primaryItems || !matchedItem || !drillMatch)
-            return body;
-        return replaceByReference(body, matchedItem, { ...drillMatch, ...matchedItem });
+        const bodyAfterOwnDrill = !drillItems || !matchedItem
+            ? body
+            : foldOneDrillOccurrence(body, foldPlan.primaryArrayPath, target.joinFields, drillItems, matchedItem);
+        // Every absorbed occurrence of this SAME endpoint (a repeat raw capture
+        // threaded from a DIFFERENT primary item — see FoldPlan.absorbedIndices)
+        // is folded in too, so schema inference sees every sampled per-item
+        // field, not just the single representative occurrence's — see the
+        // `"merges by join key, not position"` regression this restores. Which
+        // primary item an absorbed occurrence belongs to is re-derived from its
+        // own REQUEST (mirroring the original structural scan's own matching),
+        // not its response, since a drill response commonly never echoes the
+        // join field back.
+        const targetEndpointKey = endpointKey(actionSteps[target.drillStepIndex].capture.url);
+        return foldPlan.absorbedIndices.reduce((innerBody, absorbedIndex) => {
+            const absorbedCapture = actionSteps[absorbedIndex]?.capture;
+            if (!absorbedCapture || endpointKey(absorbedCapture.url) !== targetEndpointKey) {
+                return innerBody;
+            }
+            const absorbedDrillItems = objectItemsAtPath(absorbedCapture.responseBody, target.chainArrayPath);
+            const innerPrimaryItems = objectItemsAtPath(innerBody, foldPlan.primaryArrayPath);
+            const absorbedMatchedItem = innerPrimaryItems?.find((item) => findThreadedJoinFields([{ varName: "item", obj: item }], absorbedCapture).length > 0);
+            if (!absorbedDrillItems || !absorbedMatchedItem)
+                return innerBody;
+            return foldOneDrillOccurrence(innerBody, foldPlan.primaryArrayPath, target.joinFields, absorbedDrillItems, absorbedMatchedItem);
+        }, bodyAfterOwnDrill);
     }, initialBody);
 }
 /**
@@ -7738,6 +8436,13 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                 const suffix = foldPlan.targets.length > 1 ? `${planSuffix}${targetIndex}` : planSuffix;
                 const scopedAccessor = (varName, field) => `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
                 const joinAccessor = (field) => scopedAccessor(itemVar, field);
+                // Computed once per fold target instead of once per `parameterizeUrl`
+                // call: `actionSteps` never changes across the calls this target's
+                // chain steps make, so re-deriving this array on every one of
+                // findThreadedJoinFields/isZeroVarianceRepeatCapture/
+                // isGenuineVaryingQueryValue/assertNoFrozenVaryingDrillParams's own
+                // calls below was O(actionSteps.length) work repeated 4x per call.
+                const allCaptures = actionSteps.map((s) => s.capture);
                 // Same word-boundary-anchored swap emitMultiStepExecuteHttp's own
                 // `parameterize` performs — a plain split/join would also rewrite
                 // unrelated substrings that happen to contain the join value.
@@ -7762,7 +8467,7 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                         : rawUrl;
                     const rawThreadedFields = dedupeThreadedFields([
                         ...target.joinFields.map((field) => ({ varName: itemVar, field })),
-                        ...findThreadedJoinFields(threadingScopes, chainCapture, actionSteps.map((s) => s.capture)),
+                        ...findThreadedJoinFields(threadingScopes, chainCapture, allCaptures),
                     ]);
                     // Mirrors emitMultiStepExecuteHttp's identical rebind (see
                     // isAncestorScoped above): a proven ancestor-scoped drill still
@@ -7787,7 +8492,13 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                                 : tf,
                         }))
                         : rawThreadedFields.map((tf) => ({ valueField: tf, accessorField: tf }));
-                    const result = threadedFieldPairs.reduce((acc, { valueField, accessorField }) => {
+                    // ONE guarded regex-alternation pass over `withBase` for every
+                    // threaded field's value, longest first — see substituteThreadedValues's
+                    // doc for why a per-field sequential `.replace()` loop here (the bug
+                    // this replaces) can splice an unrelated value into an opaque URL
+                    // segment or nest a `${...}` placeholder.
+                    const valueBindings = threadedFieldPairs
+                        .map(({ valueField, accessorField }) => {
                         const scopeObj = valueField.varName === itemVar
                             ? firstItem
                             : ancestorObjByVar.get(valueField.varName);
@@ -7797,12 +8508,31 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                             : typeof value === "number" || typeof value === "boolean"
                                 ? String(value)
                                 : null;
-                        if (stringValue === null)
-                            return acc;
-                        return acc.replace(new RegExp(`\\b${stringValue.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "g"), `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`);
-                    }, withBase);
+                        return stringValue === null
+                            ? null
+                            : {
+                                value: stringValue,
+                                replacement: `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`,
+                            };
+                    })
+                        .filter((b) => b !== null);
+                    // A capture proven request-invariant ({@link isZeroVarianceRepeatCapture})
+                    // must never have a COINCIDENTAL threaded value spliced into it —
+                    // see emitMultiStepExecuteHttp's identical `parameterize` guard
+                    // ({@link isGenuineVaryingQueryValue}) for why this is decided
+                    // field by field rather than for the whole capture at once.
+                    const isProvenInvariant = (0, capture_filters_1.isZeroVarianceRepeatCapture)(chainCapture, allCaptures);
+                    const filteredValueBindings = isProvenInvariant
+                        ? valueBindings.filter((b) => isGenuineVaryingQueryValue(b.value, chainCapture, allCaptures))
+                        : valueBindings;
+                    const result = substituteThreadedValues(withBase, filteredValueBindings);
                     const withDrillParamBindings = applyDrillParamBindings(foldReturnSpec, chainCapture, result);
-                    assertNoFrozenVaryingDrillParams("emitContractTs", chainCapture, withDrillParamBindings, actionSteps.map((s) => s.capture));
+                    // See emitMultiStepExecuteHttp's identical guard: the frozen-
+                    // varying-param safety net does not apply once the capture is
+                    // already proven request-invariant.
+                    if (!isProvenInvariant) {
+                        assertNoFrozenVaryingDrillParams("emitContractTs", chainCapture, withDrillParamBindings, allCaptures);
+                    }
                     return withDrillParamBindings;
                 };
                 const chainLines = [];
@@ -7819,6 +8549,10 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                     const chainStep = actionSteps[chainIndex];
                     if (!chainStep)
                         continue;
+                    // The zero-variance guard lives inside `parameterizeUrl` itself
+                    // (see above) so it can skip only the threaded-value splice while
+                    // still letting a spec-declared drillParamBindings substitution
+                    // apply.
                     const url = parameterizeUrl(chainStep.capture.url, chainStep.capture);
                     if (itemVarRefPattern.test(url))
                         referencesItemVar = true;
@@ -9060,7 +9794,7 @@ async function main() {
         // producible state (see collectDependentDrillDownChainValues).
         const dependentDrillDownChainValues = actionCaptures.length > 1
             ? collectDependentDrillDownChainValues(actionCaptures, foldReturnSpec)
-            : new Set();
+            : new Map();
         const stateIndex = actionCaptures.length > 1
             ? indexStateValues(activeCaptures, shieldedUuids, actionCaptureIndices, dependentDrillDownChainValues)
             : new Map();