@enricai/barnacle 1.12.49 → 1.12.51

package/dist/scripts/recon-generate.js

@@ -43,6 +43,8 @@ exports.resolveManifestActionSequence = resolveManifestActionSequence;
 exports.extractActionSequence = extractActionSequence;
 exports.extractGraphQLActionSequence = extractGraphQLActionSequence;
 exports.dedupRedundantSameOperationCaptures = dedupRedundantSameOperationCaptures;
+exports.isRedundantSameEndpointGroup = isRedundantSameEndpointGroup;
+exports.assertBodyFieldSourceNameCorrelates = assertBodyFieldSourceNameCorrelates;
 exports.detectFormSchemaFieldNames = detectFormSchemaFieldNames;
 exports.indexEnumEnumNamesSchemas = indexEnumEnumNamesSchemas;
 exports.indexLabelValueOptionCodes = indexLabelValueOptionCodes;
@@ -1504,6 +1506,13 @@ function resolveManifestActionSequence(runRoot, captures) {
  * a capture whose host fails {@link isAllowedFixtureHost} is dropped too —
  * `isNoiseUrl` alone lets a third-party telemetry/beacon POST masquerade as
  * a submission step, since it can look identical in shape to a real one.
+ * A capture that recurs elsewhere with a byte-identical method/URL/body is
+ * dropped too ({@link isZeroVarianceRepeatCapture}) — a same-host beacon
+ * whose extension and host both look legitimate (e.g. a `.html` sensor
+ * endpoint) still gives itself away by never varying across calls, which
+ * `isNoiseUrl`'s substring/extension checks can't see and which the
+ * structural-isolation pass below can even be fooled by (N identical copies
+ * of the same path "vouch" for each other's tokens).
  *
  * When the flow declares submit patterns, only POSTs matching them survive —
  * this isolates the submission from same-origin page chrome (bootstrap, chatbot,
@@ -1552,6 +1561,8 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
             return false;
         if ((0, capture_filters_1.isNoiseUrl)(capture.url))
             return false;
+        if ((0, capture_filters_1.isZeroVarianceRepeatCapture)(capture, captures))
+            return false;
         if (!matchesSubmit(capture))
             return false;
         if (hasHostProvenance &&
@@ -1573,11 +1584,28 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
     // but a 1-2 capture pool has no "everything else" to be isolated from, so
     // skip it there rather than risk flagging a single-endpoint site's own
     // hyphenated path.
+    //
+    // A candidate's own same-pathname repeats only count as evidence against
+    // itself (not for it) when its path carries a densely name-spaced,
+    // marketing/tracking-shaped signal — more than one compound segment's
+    // worth of tokens (e.g. `/site-banner/promotions-widget`, 4 tokens across
+    // two compound segments) — OR when the repeats themselves carry no
+    // business-relevant response state ({@link hasNoBusinessRelevantResponseState}):
+    // a real own-backend endpoint (a polled toggles feed, a paged listing) is
+    // often named with at most one compound segment, so path shape alone can't
+    // tell it apart from a same-shaped, same-host, zero-business-value poll
+    // (an availability/feature-flag ping that answers every call with nothing
+    // a caller could not already know) — both are "one compound segment,
+    // repeats identically." Response content is what actually distinguishes
+    // them, so a candidate whose own repeats carry no business-relevant state
+    // loses the self-vouching exemption regardless of its token count, while a
+    // genuinely data-bearing single-compound-segment endpoint keeps it.
     const structurallyGated = hasHostProvenance && hostGated.length > 2
         ? hostGated.filter(({ capture }, i) => {
             const path = safeUrlPathname(capture.url);
+            const denselyNameSpaced = (0, capture_filters_1.pathStructuralTokens)(path).size > 2 || (0, capture_filters_1.hasNoBusinessRelevantResponseState)(capture);
             const otherPaths = hostGated
-                .filter((_, j) => j !== i)
+                .filter((h, j) => denselyNameSpaced ? safeUrlPathname(h.capture.url) !== path : j !== i)
                 .map((h) => safeUrlPathname(h.capture.url));
             return !(0, capture_filters_1.isStructurallyIsolatedCapture)(path, otherPaths);
         })
@@ -1638,6 +1666,24 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
  * Exported for tests: this predicate decides what a generated GraphQL plugin
  * will send at a live site.
  */
+/** REST HTTP methods that write/mutate server state rather than merely
+ * reading it — a capture using one of these is never a re-readable
+ * poll/listing, regardless of how flat its response body looks. */
+const MUTATING_HTTP_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+/** A mutation capture: either GraphQL (identified by its parsed operation
+ * query string starting with `mutation`) or REST (identified by a
+ * non-idempotent HTTP method). Its response is a single mutated object
+ * rather than a re-readable list/flag, so it must never be folded in with
+ * genuinely idempotent reads by {@link isRedundantSameEndpointGroup} — a
+ * flat-response REST POST (e.g. a wizard section save) is exactly as
+ * non-poll-able as a GraphQL mutation, but `capture.query` is always null
+ * for REST, so the GraphQL-only check alone would misclassify it as a
+ * collapsible poll. */
+function isMutationCapture(capture) {
+    if (capture.query !== null)
+        return /^\s*mutation\b/.test(capture.query);
+    return MUTATING_HTTP_METHODS.has(capture.method.toUpperCase());
+}
 function extractGraphQLActionSequence(captures, submitPatterns = null, foldReturnSpec = null, ownBackendHostnames = [], fallbackDomain = null) {
     const matchesSubmit = compileSubmitMatcher(submitPatterns);
     const matchesFoldReturn = compileFoldReturnEndpointMatcher(foldReturnSpec);
@@ -1648,7 +1694,7 @@ function extractGraphQLActionSequence(captures, submitPatterns = null, foldRetur
     // only applies once the caller has actually resolved a notion of "own
     // backend" to check against.
     const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
-    const isMutation = (capture) => capture.query !== null && /^\s*mutation\b/.test(capture.query);
+    const isMutation = isMutationCapture;
     const admitted = captures
         .map((capture, index) => ({ capture, index }))
         .filter(({ capture }) => {
@@ -1656,6 +1702,8 @@ function extractGraphQLActionSequence(captures, submitPatterns = null, foldRetur
             return false;
         if ((0, capture_filters_1.isNoiseUrl)(capture.url))
             return false;
+        if ((0, capture_filters_1.isZeroVarianceRepeatCapture)(capture, captures))
+            return false;
         if (!matchesSubmit(capture))
             return false;
         if (hasHostProvenance &&
@@ -1688,7 +1736,7 @@ function responseShapeKey(capture) {
     const arrayField = findObjectArrayField(capture.responseBody);
     if (!arrayField)
         return null;
-    return `${endpointKey(capture.url)}${arrayField.path.join(".")}`;
+    return `${endpointKey(capture.url)} ${arrayField.path.join(".")}`;
 }
 /**
  * Drops redundant re-issues of the primary GraphQL read operation from a
@@ -1750,9 +1798,28 @@ function collapseRedundantPatches(actions) {
  * counter, unpaired with an explicit page-size key) since that is the common
  * REST shape, unlike GraphQL's paired variables convention. */
 const PAGINATION_FIELD_NAME_PATTERN = /^(page|pagenum|pagenumber|pageindex|pageno|offset|skip|start|cursor)$/i;
+/** Request-field key names that name known client-generated scaffolding
+ * (a monotonic sequence counter, a correlation/trace id, an idempotency
+ * nonce) rather than genuine payload data. Gates {@link
+ * isFieldValueThreadedElsewhere} on a FLAT (non-array) response's
+ * BODY-carried varying field -- unlike an array-shaped listing/facet
+ * re-query, a mutation's request-body field could just as easily be real
+ * user-entered payload (an address line, a card's last4) that happens
+ * never to be echoed back downstream, so that field additionally requires
+ * its key name to look like scaffolding before trusting the "never echoed"
+ * proof. A varying field that lives ONLY in the URL query string (never in
+ * the body) skips this name requirement instead -- see {@link
+ * isQueryStringOnlyKey}. */
+const SCAFFOLDING_FIELD_NAME_PATTERN = /^(req|request|correlation|trace|session|idempotency)?[-_]?(seq|id|key|nonce)$/i;
 /** Every query-string and (when JSON-object-shaped) request-body field on a
  * capture, merged into one comparable map -- REST pagination/facet state can
- * live in either depending on the endpoint's own convention. */
+ * live in either depending on the endpoint's own convention. Body fields are
+ * flattened to their full leaf path (`paging.page`, not just `paging`) via
+ * {@link walkAllPrimitiveLeaves} so a nested pagination/facet/scaffolding
+ * object (`{"paging":{"page":1}}`) surfaces as its own comparable leaf
+ * instead of collapsing into one opaque, always-varying JSON-stringified
+ * key -- see {@link fieldKeyLeafName} for how callers recover the bare leaf
+ * name a nested path's own key-name pattern match must test against. */
 function captureRequestFields(capture) {
     const fields = {};
     try {
@@ -1767,7 +1834,9 @@ function captureRequestFields(capture) {
         try {
             const parsed = JSON.parse(capture.requestPostData);
             if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
-                Object.assign(fields, parsed);
+                for (const { value, path } of walkAllPrimitiveLeaves(parsed)) {
+                    fields[path.join(".")] = value;
+                }
             }
         }
         catch {
@@ -1776,28 +1845,223 @@ function captureRequestFields(capture) {
     }
     return fields;
 }
+/** Recovers the bare field/leaf name (`page`) from a {@link
+ * captureRequestFields} key that may be a dotted nested path (`paging.page`)
+ * -- a flat top-level key is its own leaf name, so this is a no-op for the
+ * pre-existing flat case. Used wherever a key is tested against a NAME
+ * pattern ({@link PAGINATION_FIELD_NAME_PATTERN}, {@link
+ * SCAFFOLDING_FIELD_NAME_PATTERN}) or looked up in {@link
+ * requestAndResponseValuesByKey}'s index, both of which key by bare leaf
+ * name, not by the nested path that disambiguates it during varying-key
+ * detection. */
+function fieldKeyLeafName(key) {
+    const segments = key.split(".");
+    return segments[segments.length - 1] ?? key;
+}
+/** True when `key` is carried ONLY by the URL query string across every
+ * capture in `group` -- never by a JSON request body. Used to widen the
+ * flat-response scaffolding gate past its closed name allowlist for the
+ * common case of a REST poll's tracking param, without extending that same
+ * trust to a mutation's body-carried payload field (see the comment at its
+ * call site in {@link isRedundantSameEndpointGroup}). */
+function isQueryStringOnlyKey(key, group) {
+    return group.every((a) => {
+        let inQuery = false;
+        try {
+            inQuery = new URL(a.capture.url).searchParams.has(key);
+        }
+        catch {
+            return false;
+        }
+        if (!inQuery)
+            return false;
+        if (!a.capture.requestPostData)
+            return true;
+        try {
+            const parsed = JSON.parse(a.capture.requestPostData);
+            return (parsed === null ||
+                typeof parsed !== "object" ||
+                Array.isArray(parsed) ||
+                !(key in parsed));
+        }
+        catch {
+            return true;
+        }
+    });
+}
+/** Per-capture memoization cache for {@link requestAndResponseValuesByKey} --
+ * without it, {@link isFieldValueThreadedElsewhere} re-parses the same
+ * capture's JSON body and re-walks the same response-body leaves once per
+ * (group, varying-key, group-member) combination it's compared against,
+ * which is O(groups * keys * members * allActions) recomputations of
+ * identical work instead of O(allActions). */
+const requestAndResponseValuesCache = new WeakMap();
+function requestAndResponseValuesByKey(capture) {
+    const cached = requestAndResponseValuesCache.get(capture);
+    if (cached)
+        return cached;
+    const byKey = new Map();
+    const pathSegments = new Set();
+    const add = (key, value) => {
+        const values = byKey.get(key) ?? new Set();
+        values.add(value);
+        byKey.set(key, values);
+    };
+    try {
+        const url = new URL(capture.url);
+        for (const segment of url.pathname.split("/").filter(Boolean))
+            pathSegments.add(segment);
+        for (const [key, value] of url.searchParams)
+            add(key, value);
+    }
+    catch {
+        // Relative/invalid URLs carry no path/query signal to contribute.
+    }
+    if (capture.requestPostData) {
+        try {
+            const parsed = JSON.parse(capture.requestPostData);
+            for (const { value, path } of walkAllPrimitiveLeaves(parsed)) {
+                if (value !== null && path.length > 0)
+                    add(path[path.length - 1], String(value));
+            }
+        }
+        catch {
+            // A non-JSON body carries no leaf values to contribute.
+        }
+    }
+    for (const { value, path } of walkAllPrimitiveLeaves(capture.responseBody)) {
+        if (value !== null && path.length > 0)
+            add(path[path.length - 1], String(value));
+    }
+    const result = { byKey, pathSegments };
+    requestAndResponseValuesCache.set(capture, result);
+    return result;
+}
+const fieldValueIndexCache = new WeakMap();
+function fieldValueIndex(allActions) {
+    const cached = fieldValueIndexCache.get(allActions);
+    if (cached)
+        return cached;
+    const byKeyValue = new Map();
+    const byPathSegment = new Map();
+    for (const { capture } of allActions) {
+        const { byKey, pathSegments } = requestAndResponseValuesByKey(capture);
+        for (const [key, values] of byKey) {
+            const valueMap = byKeyValue.get(key) ?? new Map();
+            byKeyValue.set(key, valueMap);
+            for (const value of values) {
+                const captures = valueMap.get(value) ?? new Set();
+                captures.add(capture);
+                valueMap.set(value, captures);
+            }
+        }
+        for (const segment of pathSegments) {
+            const captures = byPathSegment.get(segment) ?? new Set();
+            captures.add(capture);
+            byPathSegment.set(segment, captures);
+        }
+    }
+    const index = { byKeyValue, byPathSegment };
+    fieldValueIndexCache.set(allActions, index);
+    return index;
+}
+/** True when `value` -- one member's own value for `fieldKey`, the sole
+ * varying request field of a same-endpoint group -- shows up under that
+ * SAME field/leaf name in some capture OUTSIDE the group itself (any OTHER,
+ * DIFFERENT-endpoint capture's query/body/response), proving some later
+ * step reads or threads it. False means the value is either scaffolding the
+ * client generated and nothing downstream ever consumes, OR a cursor the
+ * group's OWN members hand to each other -- e.g. page 1's response minting
+ * the exact cursor value page 2's request carries -- which is chained
+ * pagination state, not distinct data a different step depends on, so an
+ * echo confined to sibling occurrences of this SAME same-endpoint group
+ * must not block collapsing it, OR a short scalar (a low-cardinality page
+ * counter) that merely string-equals some unrelated field elsewhere by
+ * coincidence -- requiring the match to occur under the SAME field name is
+ * what tells genuine cross-step threading (an id echoed back under its own
+ * name) apart from that coincidence, since an unrelated field publishing
+ * the same short digit string under a DIFFERENT name proves nothing. This
+ * is the structural signal {@link isRedundantSameEndpointGroup} uses to
+ * widen collapsing past the literal {@link CACHE_BUSTER_QUERY_KEYS}/{@link
+ * PAGINATION_FIELD_NAME_PATTERN} allowlists without hand-enumerating more
+ * key-name shapes. A non-primitive or empty value can't be structurally
+ * proven dead, so it's treated as load-bearing by default. */
+function isFieldValueThreadedElsewhere(fieldKey, value, groupCaptures, allActions) {
+    if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
+        return true;
+    }
+    const stringValue = String(value);
+    if (stringValue.length === 0)
+        return true;
+    const { byKeyValue, byPathSegment } = fieldValueIndex(allActions);
+    const isOutsideGroup = (captures) => captures !== undefined && [...captures].some((capture) => !groupCaptures.has(capture));
+    return (isOutsideGroup(byKeyValue.get(fieldKey)?.get(stringValue)) ||
+        isOutsideGroup(byPathSegment.get(stringValue)));
+}
 /**
  * A same-endpoint capture group qualifies for collapsing when every capture
- * resolves to the same {@link responseShapeKey} (ruling out a mutation POST,
- * whose response is a single mutated object rather than an array, and any
- * group whose members diverge in response shape) AND its request fields vary
- * in at most one field once known non-semantic noise keys ({@link
- * CACHE_BUSTER_QUERY_KEYS}) are excluded from consideration, and that
- * remaining field is pagination-shaped -- a paged listing/facet re-query --
- * or vary in no field at all -- a polled toggles/feature-flag endpoint
- * re-fired with an identical request. A group
- * whose members vary in a non-pagination field (e.g. a per-item drill's
- * item-id body field) is left untouched: that variance carries the distinct
- * per-item state the existing fold-chain mechanism (`target.chain` in
+ * resolves to the same {@link responseShapeKey}, OR (when the response has no
+ * array field anywhere, e.g. a flat poll/flag-style object) every capture is
+ * either a non-mutation, or a mutation whose response body is byte-identical
+ * across every occurrence in the group, whose response independently
+ * resolves via {@link findObjectArrayFieldOrWholeObject}'s whole-object
+ * fallback -- this rules out a mutation POST with a genuinely varying
+ * response (e.g. a wizard section save), whose flat response is a single
+ * mutated object rather than a re-readable poll result, while still
+ * admitting a flat zero-variance re-poll fired via a mutating method (e.g. a
+ * feature-flag/heartbeat check fired via POST) -- AND EVERY request field
+ * that varies once known non-semantic
+ * noise keys ({@link CACHE_BUSTER_QUERY_KEYS}) are excluded from
+ * consideration is EITHER pagination-shaped -- a paged listing/facet re-query
+ * -- OR (when `allActions`, the full capture sequence, is supplied)
+ * independently proven via {@link isFieldValueThreadedElsewhere} to never be
+ * read by any capture OUTSIDE this same-endpoint group -- a cache-buster/
+ * nonce/request-id shape the literal allowlists don't happen to name, OR a
+ * cursor the group's own members hand to each other (page 1's response
+ * minting the exact value page 2's request carries) -- or the group varies
+ * in no field at all -- a polled toggles/feature-flag endpoint re-fired with
+ * an identical request. A group can have any number of varying keys; each
+ * one must clear its own pagination-or-dead check independently, so a page
+ * cursor alongside an unrelated dead cache-buster key still collapses.
+ * Without `allActions` (unit tests exercising this predicate in isolation,
+ * with no flow context to check against) a non-pagination varying key can't
+ * be structurally proven dead, so the group is left untouched -- the same
+ * conservative outcome as before this widening. A group with any varying
+ * field proven read by a DIFFERENT step outside the group (e.g. a per-item
+ * drill's item-id, later echoed into that item's detail request) is
+ * likewise left untouched: that variance carries the distinct per-item
+ * state the existing fold-chain mechanism (`target.chain` in
  * `emitMultiStepExecuteHttp`) already hoists correctly once resolved, and
  * collapsing it here would erase the very state that hoisting depends on.
  */
-function isRedundantSameEndpointGroup(group) {
+function isRedundantSameEndpointGroup(group, allActions) {
     const shapeKey = responseShapeKey(group[0].capture);
-    if (shapeKey === null)
-        return false;
-    if (!group.every((a) => responseShapeKey(a.capture) === shapeKey))
-        return false;
+    if (shapeKey !== null) {
+        if (!group.every((a) => responseShapeKey(a.capture) === shapeKey))
+            return false;
+    }
+    else {
+        // A flat (non-array) response never resolves a `responseShapeKey`, but a
+        // zero-variance re-poll of a flag/toggle endpoint still needs a shape to
+        // key on -- fall back to the whole-object candidate every group member
+        // must independently resolve to. A GraphQL mutation (detected via the
+        // parsed operation query) is always excluded, since its response is by
+        // definition the result of a state change. A REST capture excluded only
+        // because of its HTTP method (POST/PUT/PATCH/DELETE) is admitted anyway
+        // when every occurrence's response body is byte-identical -- that is
+        // proof the call carries no distinct mutated state at all (a
+        // feature-flag/heartbeat check fired via POST), the same zero-variance
+        // signal {@link isZeroVarianceRepeatCapture} already uses for noise
+        // exclusion, generalized here for the collapse decision.
+        const isGraphQLMutation = (capture) => capture.query !== null && /^\s*mutation\b/.test(capture.query);
+        const responsesByteIdentical = group.every((a) => JSON.stringify(a.capture.responseBody) === JSON.stringify(group[0].capture.responseBody));
+        const isFlatObject = (capture) => !isGraphQLMutation(capture) &&
+            (!isMutationCapture(capture) || responsesByteIdentical) &&
+            responseShapeKey(capture) === null &&
+            findObjectArrayFieldOrWholeObject(capture.responseBody) !== null;
+        if (!group.every((a) => isFlatObject(a.capture)))
+            return false;
+    }
     const fieldSets = group.map((a) => captureRequestFields(a.capture));
     const allKeys = new Set();
     for (const fields of fieldSets) {
@@ -1812,7 +2076,30 @@ function isRedundantSameEndpointGroup(group) {
     });
     if (varyingKeys.length === 0)
         return true;
-    return varyingKeys.length === 1 && PAGINATION_FIELD_NAME_PATTERN.test(varyingKeys[0]);
+    const groupCaptures = new Set(group.map((a) => a.capture));
+    return varyingKeys.every((key) => {
+        const leafName = fieldKeyLeafName(key);
+        if (PAGINATION_FIELD_NAME_PATTERN.test(leafName))
+            return true;
+        // A flat response's varying field name must still look like scaffolding
+        // UNLESS it lives only in the URL query string (never the JSON body) --
+        // a query-string param is the conventional home for ephemeral
+        // client-generated metadata (cache-busters, correlation ids, poll
+        // ticks) regardless of what the site happens to call it, whereas a
+        // JSON body field is where a mutation's genuine submitted payload (an
+        // address line, a card's last4) lives, and that ambiguity is exactly
+        // why the name-pattern requirement stays for body fields: an unnamed
+        // body field being "never echoed elsewhere" is no proof it's dead, only
+        // that nothing downstream happened to read it back.
+        if (shapeKey === null &&
+            !SCAFFOLDING_FIELD_NAME_PATTERN.test(leafName) &&
+            !isQueryStringOnlyKey(key, group)) {
+            return false;
+        }
+        if (!allActions)
+            return false;
+        return fieldSets.every((fields) => !isFieldValueThreadedElsewhere(leafName, fields[key], groupCaptures, allActions));
+    });
 }
 /**
  * REST counterpart of {@link dedupRedundantSameOperationCaptures}: collapses
@@ -1827,6 +2114,16 @@ function isRedundantSameEndpointGroup(group) {
  * whichever page's response survives — page 1 is what a browsing/drill flow
  * actually saw and drilled into first, so it is the occurrence downstream
  * join values are captured against, not the endpoint's final paged state.
+ *
+ * A real per-item drill can join against ANY page's item, though, not just
+ * page 1's — so before the rest of the group is dropped, every OTHER
+ * occurrence's own array-field items (at the same {@link responseShapeKey}
+ * path proven identical across the group) are concatenated onto the kept
+ * representative's response body. Without this, {@link
+ * detectDrillDownFoldPlan}'s structural scan only ever sees page 1's items
+ * (every later page having just been deleted), so a drill keyed off a
+ * later page's item can never resolve a join match and falls through to a
+ * hardcoded per-capture `httpClient` call instead of folding into the loop.
  */
 function collapseRedundantSameEndpointCaptures(actions) {
     const positionsByGroup = new Map();
@@ -1836,17 +2133,82 @@ function collapseRedundantSameEndpointCaptures(actions) {
         positions.push(i);
         positionsByGroup.set(key, positions);
     });
+    const mergedRepresentativeByPosition = new Map();
     const drop = new Set();
     for (const positions of positionsByGroup.values()) {
         if (positions.length < 2)
             continue;
         const group = positions.map((i) => actions[i]);
-        if (!isRedundantSameEndpointGroup(group))
+        if (!isRedundantSameEndpointGroup(group, actions))
             continue;
+        const merged = mergeCollapsedGroupItemsIntoRepresentative(group);
+        if (merged !== null)
+            mergedRepresentativeByPosition.set(positions[0], merged);
         for (const position of positions.slice(1))
             drop.add(position);
     }
-    return actions.filter((_, i) => !drop.has(i));
+    return actions
+        .map((a, i) => mergedRepresentativeByPosition.get(i) ?? a)
+        .filter((_, i) => !drop.has(i));
+}
+/**
+ * Builds a REPLACEMENT for the kept representative's (`group[0]`) own
+ * {@link ActionCapture} whose response body concatenates every OTHER group
+ * member's array-field items at their shared {@link responseShapeKey} path
+ * onto the representative's own items — see {@link
+ * collapseRedundantSameEndpointCaptures}'s docstring for why. Returns `null`
+ * (no replacement needed) when the group's shape key is `null` (the
+ * flat/zero-variance-poll branch of {@link isRedundantSameEndpointGroup}, with
+ * no array-field path to merge items at) or when no other member actually
+ * contributes an item at that path.
+ *
+ * A NEW response body/capture/action is built rather than mutating the
+ * representative's own objects in place, deliberately: {@link
+ * findAllObjectArrayFields}'s `objectArrayFieldsCache` is keyed on response-body
+ * object IDENTITY under the explicit invariant that a response body is never
+ * mutated after it's produced — mutating `representative.capture.responseBody`
+ * in place would poison that cache with whatever shape happened to be computed
+ * (and cached) from it before this runs, silently discarding the merge for
+ * every caller downstream that hits the stale cache entry instead of the
+ * mutated array.
+ */
+function mergeCollapsedGroupItemsIntoRepresentative(group) {
+    const representative = group[0];
+    const arrayField = findObjectArrayField(representative.capture.responseBody);
+    if (!arrayField)
+        return null;
+    const mergedItems = arrayField.items.slice();
+    let contributed = false;
+    for (const other of group.slice(1)) {
+        const otherArrayField = findObjectArrayField(other.capture.responseBody);
+        if (!otherArrayField || otherArrayField.path.join(".") !== arrayField.path.join("."))
+            continue;
+        mergedItems.push(...otherArrayField.items);
+        contributed = true;
+    }
+    if (!contributed)
+        return null;
+    const mergedBody = setValueAtPath(representative.capture.responseBody, arrayField.path, mergedItems);
+    return { ...representative, capture: { ...representative.capture, responseBody: mergedBody } };
+}
+/**
+ * Returns a shallow-cloned-along-the-path copy of `body` with the value at
+ * `path` replaced by `newValue` — the immutable counterpart to mutating a
+ * response body in place, used by {@link
+ * mergeCollapsedGroupItemsIntoRepresentative} so the object-identity-keyed
+ * {@link objectArrayFieldsCache} never sees the same object with two different
+ * shapes. Only plain-object segments are supported (every real caller's
+ * `arrayField.path` is a DFS-discovered chain of object keys, never an array
+ * index), so an unresolvable segment returns `body` unchanged.
+ */
+function setValueAtPath(body, path, newValue) {
+    if (path.length === 0)
+        return newValue;
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return body;
+    const [head, ...rest] = path;
+    const record = body;
+    return { ...record, [head]: setValueAtPath(record[head], rest, newValue) };
 }
 /**
  * Recursively walks a JSON value and yields every string leaf, paired with its
@@ -1900,6 +2262,199 @@ function jsonBodyLeafValues(requestPostData) {
     }
     return values;
 }
+/**
+ * Same JSON body walk as {@link jsonBodyLeafValues}, but grouped by the JSON
+ * key/array-index that carries each leaf value — the by-name correlation
+ * `compileActionSteps`' consumption pre-scan needs so a produced value is
+ * only treated as reused when the SOURCE field's name correlates with the
+ * TARGET field it's found in (mirrors {@link
+ * collectDependentDrillDownChainValues}'s sameNameMatch/arrayIndexMatch,
+ * applied here as the general eligibility gate rather than only the
+ * short-value length-floor exemption). Returns null under the same
+ * conditions as `jsonBodyLeafValues`, for the same non-JSON fallback.
+ */
+function jsonBodyLeafValuesByKey(requestPostData) {
+    if (typeof requestPostData !== "string" || requestPostData.length === 0)
+        return null;
+    const parsed = (() => {
+        try {
+            return JSON.parse(requestPostData);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (parsed === undefined)
+        return null;
+    const byKey = new Map();
+    for (const { value, path } of walkAllPrimitiveLeaves(parsed)) {
+        if (value === null || path.length === 0)
+            continue;
+        // An array ELEMENT carries no field name of its own (its last path
+        // segment is a bare numeric index) — the array's own key, one or more
+        // segments up, is the nearest name to correlate against (e.g.
+        // `{"tokens":[12345678]}"` correlates on "tokens", not "0"). A leaf at
+        // the top of an unnamed array (no non-numeric ancestor at all) has
+        // truly no name; it keeps its numeric key so callers can still detect
+        // it as name-free via {@link ARRAY_INDEX_KEY_PATTERN}.
+        const namedSegment = [...path]
+            .reverse()
+            .find((segment) => !ARRAY_INDEX_KEY_PATTERN.test(segment));
+        const key = namedSegment ?? path[path.length - 1];
+        const values = byKey.get(key) ?? new Set();
+        values.add(String(value));
+        byKey.set(key, values);
+    }
+    return byKey;
+}
+/** Splits a `camelCase`/`snake_case`/`kebab-case` field name into its
+ * constituent lowercase words, dropping words shorter than 3 characters (an
+ * "id"/"no"/"ok"-shaped word is too generic on its own to prove two field
+ * names name the same concept). Used by {@link keyNamesCorrelate}. */
+function keyNameWords(key) {
+    return key
+        .split(/(?=[A-Z])|[_\-\s]+/)
+        .map((word) => word.toLowerCase())
+        .filter((word) => word.length >= 3);
+}
+/** Words common enough as a naming SUFFIX/PREFIX that sharing one proves
+ * nothing on its own — `startDate`/`endDate` and `firstName`/`lastName` each
+ * share a word under this set's length-≥3 threshold while naming opposite
+ * concepts. Used by {@link keyNamesCorrelate} to require a more specific
+ * word overlap whenever both keys also carry a non-generic word to compare. */
+const GENERIC_KEY_WORDS = new Set([
+    "name",
+    "date",
+    "type",
+    "code",
+    "email",
+    "phone",
+    "address",
+    "flag",
+    "count",
+    "number",
+    "value",
+    "status",
+    "key",
+    "time",
+]);
+/**
+ * True when a SOURCE field name and a TARGET field name plausibly name the
+ * same concept — an exact match, or a shared word (one a substring of the
+ * other, so a plural/prefix variant like `token`/`tokens` or a compound like
+ * `jobId`/`jobSeqNo` or `draftId`/`applicationDraftId` still correlates)
+ * once both are split into their constituent camelCase words. This is the
+ * general-purpose sibling of {@link collectDependentDrillDownChainValues}'s
+ * stricter exact-key `sameNameMatch`, used by `compileActionSteps`' body-
+ * value consumption gate where the source/target key casing and compounding
+ * legitimately differ across endpoints.
+ *
+ * A shared {@link GENERIC_KEY_WORDS} word is insufficient PROOF when both
+ * keys also carry a more specific, non-generic word — `startDate` and
+ * `endDate` both reduce to `["start"]`/`["end"]` once `date` is set aside,
+ * and those don't overlap, so the pair must NOT correlate despite sharing
+ * `date`. A generic word is only trusted when one side has no non-generic
+ * word to fall back on (e.g. `statusToken` vs. the bare `tokens` key).
+ */
+function keyNamesCorrelate(sourceKey, targetKey) {
+    if (sourceKey === targetKey)
+        return true;
+    const sourceWords = keyNameWords(sourceKey);
+    const targetWords = keyNameWords(targetKey);
+    const wordsMatch = (a, b) => a.includes(b) || b.includes(a);
+    const sourceSpecific = sourceWords.filter((w) => !GENERIC_KEY_WORDS.has(w));
+    const targetSpecific = targetWords.filter((w) => !GENERIC_KEY_WORDS.has(w));
+    if (sourceSpecific.length > 0 && targetSpecific.length > 0) {
+        return sourceSpecific.some((sw) => targetSpecific.some((tw) => wordsMatch(sw, tw)));
+    }
+    return sourceWords.some((sw) => targetWords.some((tw) => wordsMatch(sw, tw)));
+}
+/** A spliced `${...}` accessor/varName whose own derived name is
+ * legitimately name-free — it can never be required to correlate with the
+ * JSON key it lands under. A `payload.<field>` accessor matches its target
+ * BY DEFINITION (the schema field IS the body key), and a bare loop
+ * index/counter (`i`, `i0`, `idx0`) names a position, not a concept. Used by
+ * {@link deriveSplicedSourceName}. */
+const NAME_FREE_ACCESSOR_PATTERN = /^payload\./;
+const ARRAY_INDEX_VAR_PATTERN = /^(?:i|idx)\d*$/;
+/** {@link deriveSplicedSourceName} only derives a correlatable name for an
+ * accessor rooted at one of this file's own fold/drill per-item or
+ * ancestor-scope bindings — `item`/`item0`/... (see {@link
+ * pathToFoldLoopLines}'s `itemVar`) or `g0`/`g1`/... (its `groupVar`). These
+ * are exactly the bindings {@link findThreadedJoinFields} and {@link
+ * applyDrillParamBindings} thread a per-item/per-ancestor FIELD (as opposed
+ * to a whole produced value) into, which is the specific "picks the wrong
+ * source field for a given key" bug class this net closes. A top-level
+ * chain-produced var (`r0`, `token`, a response-derived `const label = ...`)
+ * is threaded by exact VALUE identity across steps, a different, already
+ * value-gated mechanism this net intentionally leaves alone — genuinely
+ * different names on either side of that kind of splice (a rotated `token`
+ * landing under an `auth` key, a `label` re-sent as a `ref`) are expected,
+ * not a bug. */
+const FOLD_SCOPED_ROOT_PATTERN = /^(?:item\d*|g\d+)\./;
+/**
+ * Derives the "own name" a spliced `${...}` accessor carries for {@link
+ * assertBodyFieldSourceNameCorrelates} to correlate against its enclosing
+ * JSON key — the last dot-separated path segment (e.g. `g0.identifiers.sku`
+ * -> `sku`, matching {@link keyNamesCorrelate}'s own source-key convention
+ * elsewhere in this file). Returns `null` for anything not rooted at a
+ * fold/drill per-item or ancestor binding (see {@link
+ * FOLD_SCOPED_ROOT_PATTERN}'s docstring for why only those are in scope) or
+ * that is otherwise legitimately name-free (see {@link
+ * NAME_FREE_ACCESSOR_PATTERN} / {@link ARRAY_INDEX_VAR_PATTERN}).
+ */
+function deriveSplicedSourceName(accessor) {
+    const trimmed = accessor.trim();
+    if (NAME_FREE_ACCESSOR_PATTERN.test(trimmed) || ARRAY_INDEX_VAR_PATTERN.test(trimmed)) {
+        return null;
+    }
+    if (!FOLD_SCOPED_ROOT_PATTERN.test(trimmed))
+        return null;
+    // A non-identifier expression (a template literal, a ternary, a function
+    // call) carries no single derivable name to correlate — only a bare
+    // dotted-path accessor is in scope for this check.
+    if (!/^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*$/.test(trimmed))
+        return null;
+    const segments = trimmed.split(".");
+    return segments[segments.length - 1] ?? null;
+}
+/**
+ * Mechanism-agnostic, generation-time safety net closing the door on ANY
+ * fold/drill body-field/source-name correlation bug, regardless of which of
+ * this file's several independent per-item/ancestor threading passes
+ * (fold-item join fields, ancestor-scope rebinding, drill-param binding,
+ * ...) produced the offending splice — architecturally the same kind of
+ * final structural gate as {@link assertNoFrozenVaryingDrillParams}, not a
+ * fix specific to one mechanism. Walks the fully-assembled `renderedBody`
+ * for every `"<key>":${<accessor>}` pair whose accessor is rooted at a
+ * fold/drill binding (see {@link deriveSplicedSourceName}) and requires its
+ * own derived field name to plausibly name the same concept as the
+ * enclosing JSON key ({@link keyNamesCorrelate}) it was spliced under.
+ * Throws a site-agnostic description naming only the key/accessor pair
+ * (never a specific site or plugin) so a SEVENTH recurrence of this bug
+ * class, in a mechanism not yet built, fails generation loudly instead of
+ * silently shipping a body field assigned from an unrelated per-item/
+ * ancestor source field.
+ *
+ * Exported for unit testing — see `applyDrillParamBindings`/
+ * `compileActionSteps` for this file's existing precedent of exporting an
+ * otherwise-internal structural gate so it can be probed directly with a
+ * synthetic `renderedBody` string, independent of the fold-plan-detection
+ * machinery that decides which mechanism produces a given splice.
+ */
+function assertBodyFieldSourceNameCorrelates(emitterName, renderedBody) {
+    const pattern = /"([^"\\]+)"\s*:\s*"?\$\{([^{}]+)\}/g;
+    for (const match of renderedBody.matchAll(pattern)) {
+        const key = match[1];
+        const accessor = match[2];
+        const sourceName = deriveSplicedSourceName(accessor);
+        if (sourceName === null)
+            continue;
+        if (keyNamesCorrelate(sourceName, key))
+            continue;
+        throw new Error(`${emitterName}: body field "${key}" is spliced from "\${${accessor}}", whose own inferred name ("${sourceName}") doesn't correlate with "${key}" — a field must be assigned from a source whose own name plausibly names the same concept as the key it lands under, not from a value that only coincidentally matches`);
+    }
+}
 /**
  * Yields every primitive leaf (string, number, boolean, null) in the JSON
  * value with its path. Used by the body-literal substitution pass to find
@@ -3002,7 +3557,7 @@ function* walkSetCookiePairs(rawSetCookie) {
  */
 /** Exported for unit testing — lets tests exercise the produces[] walk (body
  * AND header/cookie origins) directly against synthetic Capture sequences. */
-function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndices = new Set(), forceIncludeValues = new Set()) {
+function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndices = new Set(), forceIncludeValues = new Map()) {
     const index = new Map();
     // Computed structurally off the SAME captures being indexed (no
     // foldReturnSpec available at this layer) — a spec-declared fold's own
@@ -3011,6 +3566,18 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
     // call), so this indexes a chain-produced value regardless of whether the
     // fold plan that confirmed it is structural or spec-declared.
     const chainForceIncludeValues = collectDependentDrillDownChainValues(captures.map((capture) => ({ capture })), null);
+    // The set of captures a short/force-included value is actually eligible to
+    // be spliced into — the union of whatever `chainForceIncludeValues` and the
+    // caller-supplied `forceIncludeValues` proved for that value. `undefined`
+    // when the value isn't exemption-derived, meaning the eligibility
+    // restriction doesn't apply (see `StateValue.eligibleConsumers`).
+    const eligibleConsumersFor = (value) => {
+        const chainConsumers = chainForceIncludeValues.get(value);
+        const forceConsumers = forceIncludeValues.get(value);
+        if (!chainConsumers && !forceConsumers)
+            return undefined;
+        return new Set([...(chainConsumers ?? []), ...(forceConsumers ?? [])]);
+    };
     // First pass: identify the earliest origin among ACTION captures for each
     // value. Action-only earliest-origin tracking is what compileActionSteps'
     // produces[] check needs — it ignores non-action captures (telemetry GETs,
@@ -3033,9 +3600,8 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                 // floor below: a cookie-sourced value the fold-chain detector already
                 // confirmed is threaded into a later hop's request is exactly as
                 // legitimate as a long one, so it must not be dropped for being short.
-                if (value.length < MIN_STATE_VALUE_LENGTH &&
-                    !chainForceIncludeValues.has(value) &&
-                    !forceIncludeValues.has(value))
+                const isShort = value.length < MIN_STATE_VALUE_LENGTH;
+                if (isShort && !chainForceIncludeValues.has(value) && !forceIncludeValues.has(value))
                     continue;
                 if (value.length > MAX_COOKIE_STATE_VALUE_LENGTH)
                     continue;
@@ -3047,6 +3613,7 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                         originIndex: i,
                         path: [],
                         headerOrigin: { sourceHeader: "set-cookie", cookieName: name },
+                        eligibleConsumers: isShort ? eligibleConsumersFor(value) : undefined,
                     });
                 }
             }
@@ -3073,6 +3640,9 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                     originIndex: i,
                     path: [],
                     headerOrigin: { sourceHeader: headerName },
+                    eligibleConsumers: headerValue.length < MIN_STATE_VALUE_LENGTH
+                        ? eligibleConsumersFor(headerValue)
+                        : undefined,
                 });
             }
         }
@@ -3090,9 +3660,8 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
             if (rawValue === null)
                 continue;
             const value = String(rawValue);
-            if (value.length < MIN_STATE_VALUE_LENGTH &&
-                !chainForceIncludeValues.has(value) &&
-                !forceIncludeValues.has(value))
+            const isShort = value.length < MIN_STATE_VALUE_LENGTH;
+            if (isShort && !chainForceIncludeValues.has(value) && !forceIncludeValues.has(value))
                 continue;
             if (value.length > MAX_STATE_VALUE_LENGTH)
                 continue;
@@ -3117,7 +3686,12 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
                 !forceIncludeValues.has(value))
                 continue;
             if (!index.has(value)) {
-                index.set(value, { value, originIndex: i, path });
+                index.set(value, {
+                    value,
+                    originIndex: i,
+                    path,
+                    eligibleConsumers: isShort ? eligibleConsumersFor(value) : undefined,
+                });
             }
         }
     }
@@ -3129,6 +3703,51 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
 function isValidJsIdentifier(s) {
     return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(s);
 }
+/**
+ * Collapses a JSON path (e.g. `["formData", "firstName"]`) into a single flat
+ * payload field name (`formDataFirstName`). The payload schema `emitContractTs`
+ * builds is always a flat, single-level `z.object({...})` — no pass anywhere
+ * in this file constructs a nested Zod shape — so a `payload.<field>` accessor
+ * must always resolve a single top-level identifier, never a dotted/bracketed
+ * chain. This is the single place that turns a (possibly multi-segment)
+ * request-body path into that field name, so the accessor text emitted into a
+ * template and the field registered in the schema can never diverge: both
+ * always derive from this same flat name. A non-identifier segment (an array
+ * index, a key with punctuation) is sanitized via {@link fieldNameToPascalCase}
+ * rather than dropped, so every path still yields a usable field name.
+ */
+function pathToPayloadFieldName(path) {
+    return path
+        .map((segment, index) => {
+        const clean = isValidJsIdentifier(segment)
+            ? segment
+            : (fieldNameToPascalCase(segment, null) ?? `Field${index}`);
+        return index === 0 ? clean : clean.charAt(0).toUpperCase() + clean.slice(1);
+    })
+        .join("");
+}
+/**
+ * Builds the `payload.<...>` accessor and the field name to register for a
+ * request-body leaf path. Array-index segments (`["sorts", "0"]`) are NOT
+ * flattened: the array itself (`sorts`) is registered as a single field
+ * elsewhere as a whole, and the element access stays a bracket-indexed
+ * `pathToAccessor` suffix into that same field — flattening it (`sorts0`)
+ * would target a field the schema never declares. Only the object-key
+ * segments before the first array index are collapsed via
+ * {@link pathToPayloadFieldName}; segments from the first array index onward
+ * are rendered with {@link pathToAccessor} against that flat prefix.
+ */
+function payloadAccessorForPath(path) {
+    const arrayIndexPos = path.findIndex((segment) => /^\d+$/.test(segment));
+    if (arrayIndexPos === -1) {
+        const field = pathToPayloadFieldName(path);
+        return { accessor: `payload.${field}`, field };
+    }
+    const objectPath = path.slice(0, arrayIndexPos);
+    const field = objectPath.length > 0 ? pathToPayloadFieldName(objectPath) : (path[0] ?? "");
+    const suffix = pathToAccessor(path.slice(arrayIndexPos), { assertNonNull: true });
+    return { accessor: `payload.${field}${suffix}`, field };
+}
 /** Derives a valid camelCase identifier from a fixture filename (e.g.
  * "10219132.json" -> "fixture10219132", "acme-metrics.config.json" ->
  * "acmeMetricsConfig") for use in generated `loadFixture` const lines. */
@@ -3162,6 +3781,26 @@ function pathToAccessor(path, opts = { assertNonNull: true }) {
         .map((p) => isValidJsIdentifier(p) ? `.${p}` : `[${JSON.stringify(p)}]${opts.assertNonNull ? "!" : ""}`)
         .join("");
 }
+/**
+ * Builds a JS access expression reading `path` off `varName`, where `varName`
+ * is a runtime value typed `Record<string, unknown>` (an itemVar, ancestor
+ * loop var, or fold-match candidate) — NOT the real Zod-inferred payload type
+ * {@link pathToAccessor} targets. A single-segment path is a plain `.prop` /
+ * `["prop"]` access, typed `unknown` by the index signature, which compiles
+ * fine wherever the caller only interpolates or `String()`s it. But chaining
+ * a SECOND segment off that same access (`item.identifiers.sku`) fails to
+ * typecheck (TS18046 "is of type 'unknown'") because the index signature's
+ * `unknown` return doesn't itself support further property access — so every
+ * intermediate hop (all but the last segment) is re-asserted back to
+ * `Record<string, unknown>` before the next access.
+ */
+function unknownValueAccessor(varName, path) {
+    return path.reduce((expr, segment, index) => {
+        const accessor = isValidJsIdentifier(segment) ? `.${segment}` : `[${JSON.stringify(segment)}]`;
+        const isLast = index === path.length - 1;
+        return isLast ? `${expr}${accessor}` : `(${expr}${accessor} as Record<string, unknown>)`;
+    }, varName);
+}
 /**
  * Builds a nested TypeScript assertion type matching a JSON path. e.g.
  *   ["Auth","Token"] -> `{ Auth: { Token: string } }`
@@ -3319,7 +3958,15 @@ function compileActionSteps(actions, stateIndex) {
     // so we only "produce" the values that are actually consumed downstream.
     for (const { capture } of actions) {
         const bodyLeafValues = jsonBodyLeafValues(capture.requestPostData);
+        const bodyLeafValuesByKey = jsonBodyLeafValuesByKey(capture.requestPostData);
         for (const sv of stateIndex.values()) {
+            // A short value indexed only via the chain/force-include exemption
+            // (see `StateValue.eligibleConsumers`) is a real dependency ONLY for
+            // the specific capture(s) the chain detector proved it threads into —
+            // everywhere else, a coincidental substring match (a digit inside an
+            // unrelated opaque path segment) is not reuse and must not splice.
+            if (sv.eligibleConsumers && !sv.eligibleConsumers.has(capture))
+                continue;
             if (capture.url.includes(sv.value)) {
                 usedValues.add(sv.value);
                 continue;
@@ -3339,13 +3986,31 @@ function compileActionSteps(actions, stateIndex) {
             if (bodyLeafValues === null) {
                 if (capture.requestPostData?.includes(sv.value))
                     usedValues.add(sv.value);
+                continue;
             }
-            else if (bodyLeafValues.some((leaf) => leaf.includes(sv.value))) {
+            // A produced value's SOURCE key name (the last segment of its response
+            // JSON path) must correlate with the TARGET field it's found under —
+            // same discipline `collectDependentDrillDownChainValues` already
+            // applies to the short-value length-floor exemption (sameNameMatch),
+            // now the universal gate rather than only that narrower one. A
+            // name-free source (a bare array index, or a header/cookie origin with
+            // no body accessor at all) is exempted, exactly as arrayIndexMatch
+            // exempts a name-free source there — there's no name to correlate.
+            const sourceKeyName = sv.headerOrigin ? undefined : sv.path.at(-1);
+            const sourceIsNameFree = sv.headerOrigin !== undefined ||
+                sourceKeyName === undefined ||
+                ARRAY_INDEX_KEY_PATTERN.test(sourceKeyName);
+            const matches = sourceIsNameFree
+                ? bodyLeafValues.some((leaf) => leaf.includes(sv.value))
+                : [...(bodyLeafValuesByKey?.entries() ?? [])].some(([targetKey, leaves]) => keyNamesCorrelate(sourceKeyName, targetKey) &&
+                    [...leaves].some((leaf) => leaf.includes(sv.value)));
+            if (matches)
                 usedValues.add(sv.value);
-            }
         }
         for (const [headerName, headerValue] of Object.entries(capture.requestHeaders)) {
             for (const sv of stateIndex.values()) {
+                if (sv.eligibleConsumers && !sv.eligibleConsumers.has(capture))
+                    continue;
                 if (!headerValue.includes(sv.value))
                     continue;
                 usedValues.add(sv.value);
@@ -3447,7 +4112,7 @@ function compileActionSteps(actions, stateIndex) {
                     name = `${pathToVarName(path)}${suffix}`;
                 }
                 seenNames.add(name);
-                produces.push({ kind: "body", name, path });
+                produces.push({ kind: "body", name, path, eligibleConsumers: sv.eligibleConsumers });
             }
         }
         const ct = Object.entries(capture.requestHeaders).find(([k]) => k.toLowerCase() === "content-type");
@@ -3522,37 +4187,251 @@ function resolveResponsePathValue(responseBody, path) {
         ? String(cursor)
         : null;
 }
+/** Builds the shared word-boundary-guarded, longest-value-first alternation
+ * pattern used by both {@link interpolateStateValues} and
+ * {@link substituteThreadedValues}: a value can never win a match at a position
+ * a longer value also matches, and a value flanked by an alphanumeric — or by a
+ * `-`/`.` itself flanked by an alphanumeric — never matches inside an unrelated
+ * opaque token (e.g. splicing a "12" into a hyphen-joined "SKU-12-9F3Z"
+ * segment) while a standalone occurrence (e.g. "/items/42/") still matches. */
+function buildValueAlternationPattern(sortedValues) {
+    return new RegExp(`(?<![A-Za-z0-9][-.])\\b(?:${sortedValues.map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b(?![-.][A-Za-z0-9])`, "g");
+}
+/** Normalizes a JSON key or a produced var name to a bare comparable token —
+ * lowercased, non-alphanumeric stripped, trailing disambiguation digits
+ * (the `seenNames`-collision suffix `compileActionSteps` appends, e.g.
+ * `displayOrder2`) dropped — so `sortOrder` and `SortOrder`/`sort_order`/
+ * `sortOrder2` all normalize to the same token for {@link keysCorrelate}. */
+function normalizeCorrelationToken(raw) {
+    return raw
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, "")
+        .replace(/\d+$/, "");
+}
+/**
+ * True when `sourceName` (a produced state var's own field name, e.g. the
+ * `p.name` a produce was declared under) plausibly names the same coordinate
+ * as `targetKey` (the JSON key a candidate splice would land under). Used to
+ * gate {@link interpolateStateValues}'s substitution of a value that was only
+ * indexed via the chain/force-include short-value exemption (see
+ * `StateValue.eligibleConsumers`) — such a value cleared the ELIGIBILITY gate
+ * via a name-free signal (a bare array index, a URL path segment), which says
+ * nothing about whether the specific body key it's about to be spliced into
+ * has anything to do with its own origin field. Requiring exact-token or
+ * meaningful-substring correlation here is the second, independent check the
+ * report calls for: an eligible value must still name/shape-correlate with
+ * its actual splice target, not just have cleared chain detection for SOME
+ * key in the target capture.
+ */
+function keysCorrelate(sourceName, targetKey) {
+    const a = normalizeCorrelationToken(sourceName);
+    const b = normalizeCorrelationToken(targetKey);
+    if (a.length === 0 || b.length === 0)
+        return false;
+    if (a === b)
+        return true;
+    const [shorter, longer] = a.length <= b.length ? [a, b] : [b, a];
+    return shorter.length >= 3 && longer.includes(shorter);
+}
+/** Finds the JSON key immediately governing the value at `matchStart` in a
+ * (possibly partially-rewritten) JSON body template — the nearest preceding
+ * `"key":` slot opener. Textual, not AST-based (matching this file's existing
+ * `.split(target).join(replacement)` discipline elsewhere), which is
+ * sufficient here: it only needs to identify the enclosing leaf's own key for
+ * {@link keysCorrelate}'s name check, not to fully parse the document. */
+function findEnclosingJsonKey(text, matchStart) {
+    const keyPattern = /"([^"\\]+)"\s*:\s*"?/g;
+    let lastKey = null;
+    let lastValueStart = -1;
+    for (const m of text.matchAll(keyPattern)) {
+        if (m.index === undefined || m.index >= matchStart)
+            break;
+        lastKey = m[1] ?? null;
+        lastValueStart = m.index + m[0].length;
+    }
+    return lastValueStart <= matchStart ? lastKey : null;
+}
+/**
+ * Finds every `${...}` span in `text` by brace-depth counting rather than a
+ * non-nesting regex, so an ALREADY-nested placeholder (e.g. one produced by an
+ * earlier, buggier pass, or in principle any `${a${b}c}` shape) is reported as
+ * ONE span covering the outer `${` through its true matching `}` — never as
+ * just the innermost `${b}` — because a regex excluding `{`/`}` from its body
+ * (`/\$\{[^{}]*\}/`) cannot see past the first inner brace and would otherwise
+ * leave the outer span's `a`/`c` text unprotected for a later pass to splice
+ * into, compounding the corruption instead of guarding against it.
+ */
+function findBalancedPlaceholderSpans(text) {
+    const spans = [];
+    let searchFrom = 0;
+    while (searchFrom < text.length) {
+        const start = text.indexOf("${", searchFrom);
+        if (start === -1)
+            break;
+        let depth = 1;
+        let cursor = start + 2;
+        while (cursor < text.length && depth > 0) {
+            if (text[cursor] === "{")
+                depth++;
+            else if (text[cursor] === "}")
+                depth--;
+            cursor++;
+        }
+        spans.push([start, cursor]);
+        searchFrom = cursor;
+    }
+    return spans;
+}
+/**
+ * Runs `pattern` over `text`, replacing each match via `bindingByValue`,
+ * EXCEPT a match that overlaps a `${...}` placeholder already present in
+ * `text`. A single call's own matches never overlap each other (`replace`/
+ * `matchAll` scan left-to-right without revisiting consumed text), so within
+ * one call this only matters when `text` is the OUTPUT of an earlier call on
+ * this same mechanism — e.g. a fold's per-item pass re-running over Pass 1's
+ * already-interpolated URL/header/body text with a different (per-item)
+ * binding table. Without this guard, that second pass's value-equality match
+ * has no way to know a span it's about to touch is actually the FIRST pass's
+ * `${varName}` placeholder for an entirely different producer/consumer
+ * relationship — it just sees literal characters that happen to equal one of
+ * its own bound values (e.g. the digits inside `${warehouseSlot47}`,
+ * coincidentally also this fold item's own field value) and splices its
+ * replacement in anyway, producing an invalidly-nested `${a${b}c}` literal
+ * that resolves to neither value at runtime. Skipping any match that overlaps
+ * an existing placeholder keeps every substitution scoped to the pass that
+ * actually owns that span, which is the producer/consumer relationship this
+ * mechanism is supposed to encode — and guarantees the output can never open
+ * a `${` before a prior `${...}` closes.
+ *
+ * `keyCorrelationGuard`, when supplied, additionally requires a JSON-key
+ * name/shape correlation before splicing a value flagged `restrictedValues`
+ * — see {@link keysCorrelate}'s docstring for why: such a value cleared
+ * ELIGIBILITY via a name-free chain signal (a bare array index, a URL path
+ * segment) that says nothing about the specific key it's about to land
+ * under. A match on a value not in `restrictedValues` (an unrestricted
+ * payload accessor or a normally-length-qualified state value) is spliced
+ * exactly as before — this guard only closes the coincidence-threading gap
+ * for values that needed the short-value exemption to be indexed at all.
+ */
+function replaceGuardedAgainstExistingPlaceholders(text, pattern, bindingByValue, keyCorrelationGuard) {
+    const protectedSpans = findBalancedPlaceholderSpans(text);
+    const matches = [...text.matchAll(pattern)].filter((match) => !protectedSpans.some(([spanStart, spanEnd]) => match.index < spanEnd && match.index + match[0].length > spanStart));
+    const hasCorrelatedTargetByValue = new Map();
+    if (keyCorrelationGuard) {
+        for (const match of matches) {
+            const value = match[0];
+            if (!keyCorrelationGuard.restrictedValues.has(value))
+                continue;
+            if (keyCorrelationGuard.unconditionalValues.has(value))
+                continue;
+            if (hasCorrelatedTargetByValue.get(value))
+                continue;
+            const sourceName = keyCorrelationGuard.sourceNameByValue.get(value);
+            const targetKey = findEnclosingJsonKey(text, match.index);
+            if (sourceName !== undefined && targetKey !== null && keysCorrelate(sourceName, targetKey)) {
+                hasCorrelatedTargetByValue.set(value, true);
+            }
+        }
+    }
+    let result = "";
+    let cursor = 0;
+    for (const match of matches) {
+        const start = match.index;
+        const end = start + match[0].length;
+        const value = match[0];
+        const isGated = keyCorrelationGuard?.restrictedValues.has(value) &&
+            (keyCorrelationGuard.unconditionalValues.has(value) || hasCorrelatedTargetByValue.get(value));
+        if (isGated) {
+            const sourceName = keyCorrelationGuard?.sourceNameByValue.get(value);
+            const targetKey = findEnclosingJsonKey(text, start);
+            if (sourceName === undefined || targetKey === null || !keysCorrelate(sourceName, targetKey)) {
+                result += text.slice(cursor, end);
+                cursor = end;
+                continue;
+            }
+        }
+        result += text.slice(cursor, start) + (bindingByValue.get(value) ?? value);
+        cursor = end;
+    }
+    return result + text.slice(cursor);
+}
 /**
  * Replaces occurrences of state values in `template` with `${varName}`
  * interpolations. Returns a JS template-literal string fragment (no backticks).
  *
  * Algorithm: walk the producing steps' response bodies in order, harvest each
- * produced value's concrete string, and map it to the produces[].name. Then
- * scan the template for those strings and replace with ${varName}. Length-
- * descending order avoids prefix conflicts (e.g. an 8-char prefix of a
- * 36-char UUID).
- */
-function interpolateStateValues(template, priorSteps, payloadAccessorByValue = new Map()) {
-    const varNameByValue = deriveStateVarByValue(priorSteps);
-    let result = template;
-    // Pass 1: substitute state values (length-descending to avoid prefix
-    // conflicts). `\$` is a literal dollar sign (NOT an interpolation);
-    // `${varName}` interpolates the binding name at code-generation time so
-    // the resulting string contains a template-literal placeholder like
-    // `${candidateId}`.
-    const sortedState = [...varNameByValue.entries()].sort((a, b) => b[0].length - a[0].length);
-    for (const [value, varName] of sortedState) {
-        result = result.split(value).join(`\${${varName}}`);
-    }
-    // Pass 2: substitute payload values that survived the state pass. Same
-    // length-descending order. The payload pass only fires on remaining
-    // literal occurrences, so state substitutions win on collisions
-    // (e.g., when an Auth.UserName response value contains the user's email).
-    const sortedPayload = [...payloadAccessorByValue.entries()].sort((a, b) => b[0].length - a[0].length);
-    for (const [value, accessor] of sortedPayload) {
-        result = result.split(value).join(`\${${accessor}}`);
+ * produced value's concrete string, and map it to the produces[].name, then
+ * merge in the payload accessors (state wins on collision — e.g. when an
+ * Auth.UserName response value equals the user's submitted email). A single
+ * word-boundary-anchored regex alternation (longest value first, so an 8-char
+ * prefix never shadows the 36-char UUID it's a prefix of) is matched over the
+ * ORIGINAL template text exactly once — see {@link buildValueAlternationPattern}
+ * for the anchoring guarantee and {@link replaceGuardedAgainstExistingPlaceholders}
+ * for why a match overlapping an already-emitted `${...}` is skipped rather
+ * than spliced into.
+ *
+ * `isJsonBody` gates the additional {@link keysCorrelate} check
+ * `replaceGuardedAgainstExistingPlaceholders` applies to `restricted` state
+ * bindings (see {@link StateVarBinding}) — a value indexed only via the
+ * chain/force-include short-value exemption must also name/shape-correlate
+ * with the JSON key it's about to be spliced into, not merely have cleared
+ * eligibility for SOME key in this capture. Only a JSON request body has
+ * "keys" to correlate against; a URL or a raw header value has none, and a
+ * bare-value splice into either is exactly the name-free URL-path-segment
+ * threading the eligibility gate already intends to allow, so callers
+ * rendering those pass `false` (the default).
+ */
+function interpolateStateValues(template, priorSteps, targetCapture, payloadAccessorByValue = new Map(), isJsonBody = false) {
+    const stateBindings = deriveStateVarByValue(priorSteps, targetCapture);
+    const bindingByValue = new Map();
+    for (const [value, accessor] of payloadAccessorByValue) {
+        bindingByValue.set(value, `\${${accessor}}`);
+    }
+    const restrictedValues = new Set();
+    const unconditionalValues = new Set();
+    const sourceNameByValue = new Map();
+    for (const [value, binding] of stateBindings) {
+        bindingByValue.set(value, `\${${binding.varName}}`);
+        sourceNameByValue.set(value, binding.sourceName);
+        if (binding.restricted)
+            restrictedValues.add(value);
+        if (binding.unconditional)
+            unconditionalValues.add(value);
+    }
+    if (bindingByValue.size === 0)
+        return template;
+    const sortedValues = [...bindingByValue.keys()].sort((a, b) => b.length - a.length);
+    const pattern = buildValueAlternationPattern(sortedValues);
+    return replaceGuardedAgainstExistingPlaceholders(template, pattern, bindingByValue, isJsonBody && restrictedValues.size > 0
+        ? { restrictedValues, sourceNameByValue, unconditionalValues }
+        : undefined);
+}
+/**
+ * Rewrites every occurrence of a set of literal values to their accessor
+ * expressions in ONE pass over `text`, matching {@link interpolateStateValues}'s
+ * guarded shape — see {@link buildValueAlternationPattern} for the anchoring
+ * guarantee. A per-value sequential `.replace()` loop would re-scan the
+ * PROGRESSIVELY MUTATED result on every iteration, letting one field's inserted
+ * `${...}` replacement text land inside a position a later field's regex still
+ * matches — producing a nested `${...${...}}` placeholder. Doing it once over
+ * the original text closes that class of bug within this call; when `text` is
+ * itself the already-interpolated output of an EARLIER call on this mechanism
+ * (a fold's per-item pass over Pass 1's rendered URL/header/body), {@link
+ * replaceGuardedAgainstExistingPlaceholders} closes the same class of bug
+ * across calls by refusing to match inside a placeholder that call already
+ * emitted.
+ */
+function substituteThreadedValues(text, bindings) {
+    if (bindings.length === 0)
+        return text;
+    const bindingByValue = new Map();
+    for (const { value, replacement } of bindings) {
+        if (!bindingByValue.has(value))
+            bindingByValue.set(value, replacement);
     }
-    return result;
+    const sortedValues = [...bindingByValue.keys()].sort((a, b) => b.length - a.length);
+    const pattern = buildValueAlternationPattern(sortedValues);
+    return replaceGuardedAgainstExistingPlaceholders(text, pattern, bindingByValue);
 }
 /**
  * Finds the request-body coordinates a PRODUCING step must source from the
@@ -3720,25 +4599,43 @@ function applyWholeValuePayloadSubstitutions(template, parsedBody, producerScope
  * before giving up. Real captures observed a doubly-encoded value (`%2520`); the
  * extra headroom costs one cheap `decodeURIComponent` per level and stops runaway. */
 const MAX_URL_PARAM_DECODE_DEPTH = 3;
-/**
- * Maps each response-produced value to the `${var}` name later steps thread it as.
- * Shared by {@link interpolateStateValues} (the body/URL substitution) and the
- * URL-param pass, so a threaded coordinate (e.g. a jobId a prior step produced)
- * resolves to the same var in both — one source of truth, they can never diverge.
- *
- * Header/cookie-origin produces are skipped: they have no body path and their
- * value never appears as a literal in a URL/body template (http-client's `bind`
- * forwards it directly as a request header), so there is nothing to interpolate.
- */
-function deriveStateVarByValue(priorSteps) {
+function deriveStateVarByValue(priorSteps, targetCapture) {
     const varNameByValue = new Map();
     for (const step of priorSteps) {
         for (const p of step.produces) {
             if (p.kind === "header")
                 continue;
+            if (p.eligibleConsumers && !p.eligibleConsumers.has(targetCapture))
+                continue;
             const value = resolveResponsePathValue(step.capture.responseBody, p.path);
-            if (value !== null)
-                varNameByValue.set(value, p.name);
+            if (value !== null) {
+                // A source path with NO identifier segment anywhere (every segment a
+                // bare array index — e.g. a top-level array response `[42]`, path
+                // `["0"]`) has no name of its own to correlate against at all; that's
+                // the genuinely name-free case `collectDependentDrillDownChainValues`'s
+                // arrayIndexMatch exists for (see its docstring), not a named field
+                // that merely sits inside an array. Only a source WITH a real
+                // ancestor name (e.g. `flags` in `["flags","0"]`) must correlate —
+                // its name existing at all is exactly the signal a target key
+                // coincidence has to match to be a genuine splice, not a bare
+                // array-index/path-segment eligibility coincidence.
+                const sourceHasName = p.path.some((segment) => isValidJsIdentifier(segment));
+                varNameByValue.set(value, {
+                    varName: p.name,
+                    sourceName: p.name,
+                    // Requiring name/shape correlation at the splice site is not just
+                    // for the chain/force-include short-value exemption — a
+                    // naturally-length-qualified value that legitimately correlates
+                    // with ONE downstream key (which is what got it produced at all,
+                    // see `compileActionSteps`' `keyNamesCorrelate` pre-scan) must not
+                    // also splice into an unrelated, differently-named key that merely
+                    // coincides in value. `sourceHasName` gates this the same way it
+                    // gates the chain-derived case: a name-free source (a bare array
+                    // index) has nothing to correlate, so it stays unrestricted.
+                    restricted: sourceHasName,
+                    unconditional: p.eligibleConsumers !== undefined && sourceHasName,
+                });
+            }
         }
     }
     return varNameByValue;
@@ -3861,21 +4758,22 @@ function applyUrlParamPayloadSubstitutions(template, parsedBody, bindings) {
  * top-level keys also become caller-supplied payload fields. Used in Phase F
  * to parameterize fields like SourceCode that appear in r1's body but not
  * r0's (inputBody).
+ *
+ * Registration is keyed per (key, value) pair, not per key alone: a field
+ * name reused across two-plus steps with a DIFFERENT literal value on each
+ * occurrence must have EVERY one of its own occurrences registered and
+ * substituted, not just whichever occurrence this function's own body-array
+ * walk reaches first. A first-seen-value-wins table would only ever match
+ * (and thus only ever register) the ONE step whose literal happens to equal
+ * that first-seen value — every other step's own `"key":<its own value>`
+ * text would silently never become a `${payload.key}` reference at all here,
+ * even though the field genuinely IS one this step's own request sends as
+ * caller-supplied data.
  */
 function applyPayloadKeyValueSubstitutions(template, inputBody, additionalBodies = [], outAdditionalKeys = new Map()) {
     const merged = [];
-    const seenKeys = new Set();
-    // Track keys from inputBody (r0) separately so we know which ones are NEW.
-    // Only NEW keys need to be added to discovered-form-fields — inputBody's
-    // own keys stay internal to the site request template, not the public
-    // payload schema (see basePayloadSchemaExpr in emitContractTs).
-    if (inputBody !== null && typeof inputBody === "object" && !Array.isArray(inputBody)) {
-        for (const { path } of walkAllPrimitiveLeaves(inputBody)) {
-            if (path.length === 1)
-                seenKeys.add(path[0]);
-        }
-    }
-    const inputBodyKeys = new Set(seenKeys);
+    const seenPairs = new Set();
+    const seenValueByKey = new Map();
     const allBodies = [inputBody, ...additionalBodies];
     for (const body of allBodies) {
         if (body === undefined || body === null || typeof body !== "object" || Array.isArray(body)) {
@@ -3887,26 +4785,45 @@ function applyPayloadKeyValueSubstitutions(template, inputBody, additionalBodies
             const key = path[0];
             if (!isValidJsIdentifier(key))
                 continue;
-            if (seenKeys.has(key) && body !== inputBody)
+            if (value === null)
                 continue;
-            // For inputBody first pass: don't dedupe (we need all values).
-            if (body === inputBody && !inputBodyKeys.has(key))
+            // Dedupe identical (key, value) pairs only — a repeated occurrence of
+            // the SAME literal value for a key across bodies needs no second
+            // substitution pass, but a DIFFERENT value under the same key is its
+            // own distinct step's own occurrence and must still get one. EXCEPT a
+            // pagination-cursor-shaped key ({@link PAGINATION_FIELD_NAME_PATTERN},
+            // e.g. `page`/`offset`/`cursor`) whose value differs from the
+            // first-seen one: that shape is a same-endpoint re-query bump (see
+            // {@link isRedundantSameEndpointGroup}'s pagination-vs-payload
+            // distinction), not a genuinely different step's own caller data —
+            // aliasing both occurrences to the SAME `payload.<key>` accessor would
+            // make the generated re-query call replay the FIRST page's request
+            // instead of advancing to the next one, so the later occurrence stays
+            // an unsubstituted literal, matching this key's pre-fix behavior.
+            const priorValue = seenValueByKey.get(key);
+            if (priorValue !== undefined &&
+                priorValue !== value &&
+                PAGINATION_FIELD_NAME_PATTERN.test(key)) {
                 continue;
-            seenKeys.add(key);
-            if (value === null)
+            }
+            seenValueByKey.set(key, value);
+            const pairKey = `${key} ${typeof value} ${value}`;
+            if (seenPairs.has(pairKey))
                 continue;
+            seenPairs.add(pairKey);
             merged.push([key, value]);
-            // Record only the NEW keys (not in inputBody) so the contract emitter
-            // can add them to the payload schema — inputBody's own keys stay
-            // internal to the site request template (see basePayloadSchemaExpr).
-            if (!inputBodyKeys.has(key)) {
-                if (typeof value === "string")
-                    outAdditionalKeys.set(key, "string");
-                else if (typeof value === "number")
-                    outAdditionalKeys.set(key, "number");
-                else if (typeof value === "boolean")
-                    outAdditionalKeys.set(key, "boolean");
-            }
+            // Record every substituted key, including inputBody's own, so the
+            // contract emitter can add it to the payload schema. inputBody keys
+            // that ARE covered by basePayloadSchemaExpr (the ApplicantContactSchema
+            // case) are filtered back out at the emitContractTs merge point via
+            // isReservedByApplicantContactSchema — this function has no visibility
+            // into that flag, so it must not special-case inputBody's own keys.
+            if (typeof value === "string")
+                outAdditionalKeys.set(key, "string");
+            else if (typeof value === "number")
+                outAdditionalKeys.set(key, "number");
+            else if (typeof value === "boolean")
+                outAdditionalKeys.set(key, "boolean");
         }
     }
     let result = template;
@@ -4102,11 +5019,17 @@ function emitFoldMatchAndMergeLines(terminalStep, target, itemVar, suffix, joinA
         // then fall back to the bare last segment.
         const lastSegment = segments[segments.length - 1];
         const bracket = (segment) => optionalRoot ? `?.[${JSON.stringify(segment)}]` : `[${JSON.stringify(segment)}]`;
-        const optionalBracketAccessor = segments
-            .map((segment) => `?.[${JSON.stringify(segment)}]`)
-            .join("");
+        // Every intermediate hop off the (unknown-typed) candidate needs
+        // re-asserting back to `Record<string, unknown>` before the next bracket
+        // access — see {@link unknownValueAccessor}'s doc for why a bare chain of
+        // `?.[...]` accessors fails to typecheck past the first segment.
+        const nestedAccessor = segments.reduce((expr, segment, index) => {
+            const isLast = index === segments.length - 1;
+            const accessor = index === 0 ? bracket(segment) : `?.[${JSON.stringify(segment)}]`;
+            return isLast ? `${expr}${accessor}` : `(${expr}${accessor} as Record<string, unknown>)`;
+        }, varName);
         return segments.length > 1
-            ? `(${varName}${optionalBracketAccessor} ?? ${varName}${bracket(lastSegment)})`
+            ? `(${nestedAccessor} ?? ${varName}${bracket(lastSegment)})`
             : `${varName}${bracket(lastSegment)}`;
     };
     const joinCondition = target.joinFields
@@ -4129,7 +5052,18 @@ function emitFoldMatchAndMergeLines(terminalStep, target, itemVar, suffix, joinA
 }
 /** Exported for unit testing — lets tests drive the multipart-upload code path directly
  * without going through the full emitContractTs pipeline. */
-function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap, outDiscoveredFields, fieldOptionsMap, outDiscoveredOptionFields, outDiscoveredRawOptionFields, outDiscoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema = null, personaBindings = new Map(), entryUrlParams = new Map(), shieldedUuids = new Set(), selectResolutions = [], outStructuredKeys = new Map(), rawCodeFields = new Map(), foldReturnSpec = null) {
+function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap, outDiscoveredFields, fieldOptionsMap, outDiscoveredOptionFields, outDiscoveredRawOptionFields, outDiscoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema = null, personaBindings = new Map(), entryUrlParams = new Map(), shieldedUuids = new Set(), selectResolutions = [], outStructuredKeys = new Map(), rawCodeFields = new Map(), foldReturnSpec = null, 
+/**
+ * PascalCase plugin name used to cast the final `return { data: ... }`
+ * back to `${pascalName}Response` — every intermediate `httpClient` call
+ * this function emits is bound `as Record<string, unknown>` so per-item
+ * fold/merge code can probe arbitrary fields, but that cast otherwise
+ * widens the returned primary var past the richer response type the
+ * caller's own schema inference already promised, which fails to
+ * typecheck. `null` (the test-facing default) skips the cast, preserving
+ * prior output for callers that don't exercise the full pipeline.
+ */
+pascalName = null) {
     // Walk the first action's request body to map each leaf string value to its
     // `payload.<accessor>` expression. The emit's second interpolation pass uses
     // this to substitute literal occurrences (e.g. "Reginald") with their
@@ -4147,8 +5081,10 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         for (const { value, path } of walkStringLeaves(inputBody)) {
             if (value.length < MIN_STATE_VALUE_LENGTH)
                 continue;
-            const accessor = `payload${pathToAccessor(path)}`;
+            const { accessor, field: accessorField } = payloadAccessorForPath(path);
             payloadAccessorByValue.set(value, accessor);
+            if (isValidJsIdentifier(accessorField))
+                outDiscoveredFields.add(accessorField);
             // Phase F: register a lowercase variant for UUID-shaped values so case-
             // variant URL path segments (e.g. r9 echoes the requisition UUID in
             // lowercase even though r0's body had it uppercase) still get
@@ -4368,7 +5304,17 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         const step = actions[i];
         const cap = step.capture;
         const prior = actions.slice(0, i);
-        const url = interpolateStateValues(cap.url, prior, payloadAccessorByValue);
+        // A capture proven request-invariant ({@link isZeroVarianceRepeatCapture})
+        // must never be treated as an interpolation target at all: its URL is
+        // provably fixed across every occurrence, so any state-value splice into
+        // it can only be a coincidental match, never a real dependency — the same
+        // failure shape already fixed for GET responses (see `indexStateValues`'s
+        // isGet UUID-only floor) and for the fold/drill per-item pass. Rendering
+        // its exact literal URL makes this hold even when a value's own
+        // length/chain-eligibility scoping doesn't happen to catch the coincidence.
+        const url = (0, capture_filters_1.isZeroVarianceRepeatCapture)(cap, actions.map((a) => a.capture))
+            ? cap.url
+            : interpolateStateValues(cap.url, prior, cap, payloadAccessorByValue);
         // Form-schema substitution runs first on the raw recon body so its
         // field-id-anchored matches see the original JSON. State-threading and
         // payload key-value passes then run on top. Option-id substitution runs
@@ -4404,7 +5350,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         // must stay reachable for state threading, not get frozen as caller data.
         const rawBodyWithStructuredSubs = parsedBody !== null
             ? applyStructuredValuePayloadSubstitutions(rawBodyWithFormSubs, parsedBody, outStructuredKeys, new Set([
-                ...deriveStateVarByValue(prior).keys(),
+                ...deriveStateVarByValue(prior, cap).keys(),
                 ...(joinFieldValuesByStep.get(i) ?? []),
             ]))
             : rawBodyWithFormSubs;
@@ -4431,14 +5377,14 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             if (binding.producerIndex === i)
                 urlParamBindings.set(value, binding.accessor);
         }
-        for (const [value, varName] of deriveStateVarByValue(prior)) {
-            urlParamBindings.set(value, varName);
+        for (const [value, binding] of deriveStateVarByValue(prior, cap)) {
+            urlParamBindings.set(value, binding.varName);
         }
         const rawBodyWithUrlParams = parsedBody !== null
             ? applyUrlParamPayloadSubstitutions(rawBodyWithProducerBoundary, parsedBody, urlParamBindings)
             : rawBodyWithProducerBoundary;
         const bodyAfterStateAndKv = rawBodyWithUrlParams
-            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, payloadAccessorByValue), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
+            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, cap, payloadAccessorByValue, true), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
             : "";
         // Mechanism A — generic (plain-JSON, wire-key-anchored) dropdown label→code
         // rewrite. Runs AFTER interpolateStateValues + the payload-KV pass, not
@@ -4467,7 +5413,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         for (const [k, v] of Object.entries(cap.requestHeaders)) {
             const lower = k.toLowerCase();
             if (lower === "api-token" || lower === "authorization" || joinCarryingHeaderNames?.has(k)) {
-                perCallHeaders[k] = interpolateStateValues(v, prior, payloadAccessorByValue);
+                perCallHeaders[k] = interpolateStateValues(v, prior, cap, payloadAccessorByValue);
             }
         }
         // G1: emit baseUrl-derived headers (Origin, Referer) per-call from
@@ -4569,7 +5515,15 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
     // block-scoped to that loop and never escape to the rest of the function,
     // so none of them may run through the outer `declaredNames`/produceLines
     // bookkeeping below (that bookkeeping assumes function-scope declarations).
-    const foldChainIndices = new Set(foldPlans.flatMap((plan) => plan.targets.flatMap((target) => target.chain)));
+    // Absorbed indices (see FoldPlan.absorbedIndices) are repeat raw captures
+    // of a target's own endpoint, threaded from a DIFFERENT primary item — the
+    // single representative target already re-issues that endpoint once per
+    // fold-loop iteration, so these must be dropped from normal per-step
+    // emission too, exactly like the chain indices they're folded in with.
+    const foldChainIndices = new Set(foldPlans.flatMap((plan) => [
+        ...plan.targets.flatMap((target) => target.chain),
+        ...plan.absorbedIndices,
+    ]));
     for (let i = 0; i < actions.length; i++) {
         const step = actions[i];
         const cap = step.capture;
@@ -4661,14 +5615,41 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                 // colliding on `foldMatches`/`foldMatch`. The overwhelmingly common
                 // single-target case keeps the original unsuffixed names.
                 const suffix = foldPlan.targets.length > 1 ? `${planSuffix}${targetIndex}` : planSuffix;
-                const scopedAccessor = (varName, field) => `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
+                // Only `itemVar` (and fold-match candidates) are `Record<string,
+                // unknown>`-typed — ancestor loop vars keep the real response-derived
+                // type, so re-asserting THEIR intermediate hops would be both
+                // unnecessary and, worse, would replace a real property access with
+                // an opaque cast in the emitted URL/body text.
+                const scopedAccessor = (varName, field) => varName === itemVar
+                    ? unknownValueAccessor(varName, field.split("."))
+                    : `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
                 const joinAccessor = (field) => scopedAccessor(itemVar, field);
-                // Word-boundary anchored: a plain `.split(value).join(...)` would also
-                // rewrite unrelated substrings that happen to contain the join value
-                // (e.g. a "p1" product id colliding with a "/v1/" path segment or a
-                // "p10" sibling id), corrupting parts of the request the join field
-                // never touched.
-                const replaceWholeValue = (haystack, value, replacement) => haystack.replace(new RegExp(`\\b${value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "g"), replacement);
+                // Computed once per fold target instead of once per `parameterize`
+                // call: `actions` never changes across the url/headers/body calls a
+                // single chain step makes (or across chain steps), so re-deriving
+                // this array inside the closure was O(actions.length) work repeated
+                // 3x per chain hop for no reason.
+                const allCaptures = actions.map((a) => a.capture);
+                // `isZeroVarianceRepeatCapture`'s verdict is a pure function of
+                // `chainCapture` (and the now-hoisted `allCaptures`, which is fixed
+                // for the whole target) — memoized here so the 3 `parameterize`
+                // calls a single chain step makes (url, headers, body) each share
+                // the one verdict computed for that step's `chainCapture` instead of
+                // re-scanning `allCaptures` from scratch every time.
+                const isProvenInvariantMemo = new Map();
+                const isProvenInvariantFor = (chainCapture) => {
+                    const cached = isProvenInvariantMemo.get(chainCapture);
+                    if (cached !== undefined)
+                        return cached;
+                    const computed = (0, capture_filters_1.isZeroVarianceRepeatCapture)(chainCapture, allCaptures);
+                    isProvenInvariantMemo.set(chainCapture, computed);
+                    return computed;
+                };
+                // Whole-value substitution runs via substituteThreadedValues: a single
+                // guarded regex-alternation pass over the original text, not a
+                // per-field sequential `.replace()` loop — see that function's doc for
+                // why the sequential shape corrupts opaque path segments and can nest
+                // `${...}` placeholders.
                 const parameterize = (text, chainCapture) => {
                     // A join field can reach the render either as the raw captured
                     // literal (URL query params) or as an already-generic
@@ -4685,7 +5666,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                     // invisible and gets frozen as a literal.
                     const rawThreadedFields = dedupeThreadedFields([
                         ...target.joinFields.map((field) => ({ varName: itemVar, field })),
-                        ...findThreadedJoinFields(threadingScopes, chainCapture, actions.map((a) => a.capture)),
+                        ...findThreadedJoinFields(threadingScopes, chainCapture, allCaptures),
                     ]);
                     // A proven ancestor-scoped drill (see isAncestorScoped above) still
                     // rebinds fields findThreadedJoinFields left on itemVar purely
@@ -4713,7 +5694,14 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                                 : tf,
                         }))
                         : rawThreadedFields.map((tf) => ({ valueField: tf, accessorField: tf }));
-                    const result = threadedFieldPairs.reduce((acc, { valueField, accessorField }) => {
+                    // Accessor swap first: rewrites an already-templated `${payload.X}`
+                    // reference (from applyPayloadKeyValueSubstitutions) to this field's
+                    // real accessor. Each target (`${payload.X}`) is a unique, fully
+                    // delimited string that the swap's own output (`${accessorField...}`,
+                    // never re-shaped into `${payload.X}` form) can't re-match, so a
+                    // sequential pass here carries none of the reentrancy risk the
+                    // literal-value pass below has.
+                    const swapped = threadedFieldPairs.reduce((acc, { valueField, accessorField }) => {
                         const replacement = `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`;
                         // applyPayloadKeyValueSubstitutions only ever names a payload
                         // accessor after the DRILL REQUEST's own top-level JSON key
@@ -4726,11 +5714,18 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                         // reference behind once the literal value itself has already
                         // been replaced by the payload-key-value pass.
                         const lastSegment = valueField.field.split(".").pop();
-                        const withAccessorSwapped = acc
+                        return acc
                             .split(`\${payload.${valueField.field}}`)
                             .join(replacement)
                             .split(`\${payload.${lastSegment}}`)
                             .join(replacement);
+                    }, text);
+                    // Literal-value substitution: ONE guarded regex-alternation pass over
+                    // `swapped` for every threaded field's value, longest first — see
+                    // substituteThreadedValues's doc for why a per-field sequential pass
+                    // here (the bug this replaces) can nest `${...}` placeholders.
+                    const valueBindings = threadedFieldPairs
+                        .map(({ valueField, accessorField }) => {
                         const scopeObj = valueField.varName === itemVar
                             ? firstItem
                             : ancestorObjByVar.get(valueField.varName);
@@ -4740,12 +5735,36 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                             : typeof value === "number" || typeof value === "boolean"
                                 ? String(value)
                                 : null;
-                        return stringValue !== null
-                            ? replaceWholeValue(withAccessorSwapped, stringValue, replacement)
-                            : withAccessorSwapped;
-                    }, text);
+                        return stringValue === null
+                            ? null
+                            : {
+                                value: stringValue,
+                                replacement: `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`,
+                            };
+                    })
+                        .filter((b) => b !== null);
+                    // A capture proven request-invariant ({@link isZeroVarianceRepeatCapture})
+                    // must never have a COINCIDENTAL threaded value spliced into it —
+                    // but the invariance verdict is per-capture, not per-field: a
+                    // capture can be fixed on one key (a repeated `qty`) while still
+                    // genuinely varying on another (`itemId`), so only the fields that
+                    // {@link isGenuineVaryingQueryValue} can't prove are real per-request
+                    // dependencies get excluded, never the whole substitution pass.
+                    const isProvenInvariant = isProvenInvariantFor(chainCapture);
+                    const filteredValueBindings = isProvenInvariant
+                        ? valueBindings.filter((b) => isGenuineVaryingQueryValue(b.value, chainCapture, allCaptures))
+                        : valueBindings;
+                    const result = substituteThreadedValues(swapped, filteredValueBindings);
                     const withDrillParamBindings = applyDrillParamBindings(foldReturnSpec, chainCapture, result);
-                    assertNoFrozenVaryingDrillParams("emitMultiStepExecuteHttp", chainCapture, withDrillParamBindings, actions.map((a) => a.capture));
+                    // The frozen-varying-param safety net exists to catch a
+                    // misconfigured drill (a param that genuinely needs joinFields/an
+                    // ancestor binding but has neither) — it does not apply once the
+                    // capture is already proven request-invariant: freezing an
+                    // undeclared, business-irrelevant varying key (a beacon nonce)
+                    // there is the INTENDED behavior, not a misconfiguration.
+                    if (!isProvenInvariant) {
+                        assertNoFrozenVaryingDrillParams("emitMultiStepExecuteHttp", chainCapture, withDrillParamBindings, allCaptures);
+                    }
                     return withDrillParamBindings;
                 };
                 // Every chain step's response and produces are block-scoped to this
@@ -4771,6 +5790,9 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                 for (const chainIndex of target.chain) {
                     const chainStep = actions[chainIndex];
                     const chainRendered = rendered[chainIndex];
+                    // The zero-variance guard lives inside `parameterize` itself (see
+                    // above) so it can skip only the threaded-value splice while still
+                    // letting a spec-declared drillParamBindings substitution apply.
                     const paramUrl = parameterize(chainRendered.url, chainStep.capture);
                     const paramHeaders = parameterize(chainRendered.headersExpr, chainStep.capture);
                     const paramBody = parameterize(chainRendered.bodyArg, chainStep.capture);
@@ -4862,7 +5884,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             for (const [k, v] of Object.entries(cap.requestHeaders)) {
                 const lower = k.toLowerCase();
                 if (lower === "api-token" || lower === "authorization") {
-                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`${interpolateStateValues(v, actions.slice(0, i), payloadAccessorByValue)}\``);
+                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`${interpolateStateValues(v, actions.slice(0, i), cap, payloadAccessorByValue)}\``);
                 }
             }
             // G1+G2: include tenant-derived headers in the multipart fetch too.
@@ -4949,16 +5971,27 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         ...new Set(foldPlans.map((plan) => actions[plan.primaryStepIndex].varName)),
     ];
     const everyPrimaryIsPlainObject = foldPlans.every((plan) => isPlainObject(actions[plan.primaryStepIndex].capture.responseBody));
+    // Every intermediate `httpClient` call above is bound `as Record<string,
+    // unknown>` regardless of its own `schema:`, so per-item fold/merge code
+    // can probe arbitrary fields without a per-step assertion type. That
+    // widened intermediate type doesn't match `${pascalName}Response` — the
+    // richer type schema inference already promised for THIS returned value —
+    // so the return itself needs its own assertion back to that promised
+    // type; `Record<string, unknown>` and the real inferred object type share
+    // no ancestry TS can see, so a plain `as` needs the `as unknown as` detour.
+    const castToResponseType = (expr) => pascalName ? `${expr} as unknown as ${pascalName}Response` : expr;
     if (uniquePrimaryVarNames.length > 1 && everyPrimaryIsPlainObject) {
-        lines.push(`    return { data: mergeFoldedPrimaryBodies(${uniquePrimaryVarNames.join(", ")}) };`);
+        lines.push(`    return { data: ${castToResponseType(`mergeFoldedPrimaryBodies(${uniquePrimaryVarNames.join(", ")})`)} };`);
     }
     else {
         const returnVar = lastFoldPlan
             ? actions[lastFoldPlan.primaryStepIndex].varName
             : (returnAction?.varName ?? "undefined");
-        lines.push(`    return { data: ${returnVar} };`);
+        lines.push(`    return { data: ${castToResponseType(returnVar)} };`);
     }
-    return lines.join("\n");
+    const renderedMultiStepBody = lines.join("\n");
+    assertBodyFieldSourceNameCorrelates("emitMultiStepExecuteHttp", renderedMultiStepBody);
+    return renderedMultiStepBody;
 }
 function summariseResponseShape(value) {
     if (value === null || typeof value !== "object")
@@ -5319,13 +6352,96 @@ function findObjectArrayFieldOrWholeObject(value, path = []) {
  * other capture of this endpoint exists in `allCaptures`, variance can't be
  * observed either way, so every value is kept (unfiltered, matching the
  * behavior when `allCaptures` is omitted). */
-function collectRequestStringValues(capture, allCaptures) {
-    const sameEndpointCaptures = allCaptures
-        ? allCaptures.filter((c) => c !== capture && endpointKey(c.url) === endpointKey(capture.url))
-        : [];
-    const varies = (own, others) => !allCaptures || sameEndpointCaptures.length === 0
+/** Per-`allCaptures`-array grouping of captures by {@link endpointKey}, built
+ * once per distinct `allCaptures` identity rather than re-filtering the
+ * whole array on every {@link sameEndpointCapturesFor} call — the O(n)
+ * per-call filter otherwise makes every caller that invokes it once per
+ * capture (e.g. {@link findThreadedJoinFields}) O(n^2) overall. */
+const endpointGroupsCache = new WeakMap();
+function endpointGroupsFor(allCaptures) {
+    const cached = endpointGroupsCache.get(allCaptures);
+    if (cached)
+        return cached;
+    const groups = new Map();
+    for (const c of allCaptures) {
+        const key = endpointKey(c.url);
+        const group = groups.get(key) ?? [];
+        group.push(c);
+        groups.set(key, group);
+    }
+    endpointGroupsCache.set(allCaptures, groups);
+    return groups;
+}
+function sameEndpointCapturesFor(capture, allCaptures) {
+    if (!allCaptures)
+        return [];
+    const group = endpointGroupsFor(allCaptures).get(endpointKey(capture.url)) ?? [];
+    return group.filter((c) => c !== capture);
+}
+/** True when `own` differs from at least one same-endpoint sibling's value at
+ * the same location — the cross-capture variance test {@link
+ * collectRequestStringValues} and {@link collectRequestBodyValuesByKey} both
+ * apply to their respective candidate values. When no sibling capture exists
+ * (or `allCaptures` was omitted), variance can't be observed either way, so
+ * every value passes (matching the unfiltered behavior when `allCaptures` is
+ * omitted). */
+function requestValueVaries(own, others, sameEndpointCapturesLength) {
+    return sameEndpointCapturesLength === 0
         ? true
         : others.some((other) => other !== undefined && other !== own);
+}
+/** Memoizes `JSON.parse(capture.requestPostData)` per capture — the same
+ * capture is re-parsed once per SIBLING lookup by every same-endpoint
+ * caller in {@link collectRequestBodyValuesByKey}'s leaf loop, so without
+ * this cache a group of N same-endpoint captures re-parses each sibling's
+ * body N times over (once per outer capture in the group). `undefined`
+ * means "not a parseable JSON body", the same non-JSON signal the
+ * unmemoized inline parse used to produce. */
+const parsedRequestBodyCache = new WeakMap();
+const PARSE_FAILED = Symbol("parse-failed");
+function parsedRequestBodyFor(capture) {
+    if (parsedRequestBodyCache.has(capture)) {
+        const cached = parsedRequestBodyCache.get(capture);
+        return cached === PARSE_FAILED ? undefined : cached;
+    }
+    const parsed = (() => {
+        if (typeof capture.requestPostData !== "string" || capture.requestPostData.length === 0) {
+            return PARSE_FAILED;
+        }
+        try {
+            return JSON.parse(capture.requestPostData);
+        }
+        catch {
+            return PARSE_FAILED;
+        }
+    })();
+    parsedRequestBodyCache.set(capture, parsed);
+    return parsed === PARSE_FAILED ? undefined : parsed;
+}
+/** Per-(capture, allCaptures-identity) memoization for {@link
+ * collectRequestUrlValues} and {@link collectRequestBodyValuesByKey} —
+ * {@link findThreadedJoinFields} calls both fresh on every invocation and is
+ * itself invoked once per fold/drill-loop item across several call sites, so
+ * without caching the same capture's URL/body values are recomputed (and,
+ * for the body, re-walked and every sibling re-parsed) once per call. */
+const requestUrlValuesCache = new WeakMap();
+const requestBodyValuesByKeyCache = new WeakMap();
+const NO_ALL_CAPTURES = Object.freeze([]);
+/** The path-segment and query-parameter values present in `capture`'s own
+ * URL — the name-free half of {@link collectRequestStringValues}'s candidate
+ * set. Kept separate from the JSON body's leaf values so callers needing a
+ * by-key correlation gate on the body (e.g. {@link findThreadedJoinFields})
+ * can still treat URL/query matches as the name-free signal they've always
+ * been — a REST-style `/orders/{id}` path segment or query param carries no
+ * JSON key to correlate against in the first place. */
+function collectRequestUrlValues(capture, allCaptures) {
+    const cacheKey = allCaptures ?? NO_ALL_CAPTURES;
+    const perCaptureCache = requestUrlValuesCache.get(capture) ?? new WeakMap();
+    requestUrlValuesCache.set(capture, perCaptureCache);
+    const cached = perCaptureCache.get(cacheKey);
+    if (cached)
+        return cached;
+    const sameEndpointCaptures = sameEndpointCapturesFor(capture, allCaptures);
     const values = new Set();
     try {
         const url = new URL(capture.url);
@@ -5340,45 +6456,82 @@ function collectRequestStringValues(capture, allCaptures) {
                     return undefined;
                 }
             });
-            if (varies(value, otherValues))
+            if (requestValueVaries(value, otherValues, sameEndpointCaptures.length))
                 values.add(value);
         }
     }
     catch {
         // Relative or malformed URL — no query params or path segments to contribute.
     }
-    const parsedBody = (() => {
-        try {
-            return typeof capture.requestPostData === "string" && capture.requestPostData.length > 0
-                ? JSON.parse(capture.requestPostData)
-                : undefined;
-        }
-        catch {
-            return undefined;
-        }
-    })();
-    if (parsedBody !== undefined) {
-        for (const { path, value } of walkAllPrimitiveLeaves(parsedBody)) {
-            if (value === null)
-                continue;
-            const stringValue = String(value);
-            const otherValues = sameEndpointCaptures.map((c) => {
-                try {
-                    const otherBody = typeof c.requestPostData === "string" && c.requestPostData.length > 0
-                        ? JSON.parse(c.requestPostData)
-                        : undefined;
-                    if (otherBody === undefined)
-                        return undefined;
-                    const otherValue = readValueAtPath(otherBody, path);
-                    return otherValue === undefined ? undefined : String(otherValue);
-                }
-                catch {
+    perCaptureCache.set(cacheKey, values);
+    return values;
+}
+/** Same JSON-body walk and cross-capture variance gate as {@link
+ * collectRequestStringValues}'s body block, but grouped by the JSON
+ * key/array-index that carries each leaf value (see {@link
+ * jsonBodyLeafValuesByKey}'s same grouping) — the by-key candidate set
+ * {@link findThreadedJoinFields} correlates a threaded field's own name
+ * against, so a value that only coincidentally equals something in an
+ * UNRELATED body field can't be threaded onto it. Returns `null` when
+ * `capture.requestPostData` isn't parseable JSON, the same non-JSON signal
+ * {@link jsonBodyLeafValuesByKey} returns. */
+function collectRequestBodyValuesByKey(capture, allCaptures) {
+    if (typeof capture.requestPostData !== "string" || capture.requestPostData.length === 0) {
+        return null;
+    }
+    const cacheKey = allCaptures ?? NO_ALL_CAPTURES;
+    const perCaptureCache = requestBodyValuesByKeyCache.get(capture) ?? new WeakMap();
+    requestBodyValuesByKeyCache.set(capture, perCaptureCache);
+    if (perCaptureCache.has(cacheKey))
+        return perCaptureCache.get(cacheKey);
+    const parsedBody = parsedRequestBodyFor(capture);
+    if (parsedBody === undefined) {
+        perCaptureCache.set(cacheKey, null);
+        return null;
+    }
+    const sameEndpointCaptures = sameEndpointCapturesFor(capture, allCaptures);
+    const byKey = new Map();
+    for (const { path, value } of walkAllPrimitiveLeaves(parsedBody)) {
+        if (value === null || path.length === 0)
+            continue;
+        const stringValue = String(value);
+        const otherValues = sameEndpointCaptures.map((c) => {
+            try {
+                const otherBody = parsedRequestBodyFor(c);
+                if (otherBody === undefined)
                     return undefined;
-                }
-            });
-            if (varies(stringValue, otherValues))
-                values.add(stringValue);
-        }
+                const otherValue = readValueAtPath(otherBody, path);
+                return otherValue === undefined ? undefined : String(otherValue);
+            }
+            catch {
+                return undefined;
+            }
+        });
+        if (!requestValueVaries(stringValue, otherValues, sameEndpointCaptures.length))
+            continue;
+        const namedSegment = [...path]
+            .reverse()
+            .find((segment) => !ARRAY_INDEX_KEY_PATTERN.test(segment));
+        const key = namedSegment ?? path[path.length - 1];
+        const values = byKey.get(key) ?? new Set();
+        values.add(stringValue);
+        byKey.set(key, values);
+    }
+    perCaptureCache.set(cacheKey, byKey);
+    return byKey;
+}
+function collectRequestStringValues(capture, allCaptures) {
+    // Copied rather than mutated in place: collectRequestUrlValues now returns
+    // a cached Set shared across every caller of this exact (capture,
+    // allCaptures) pair, so merging body values directly into it would leak
+    // them into every OTHER caller relying on collectRequestUrlValues' own
+    // URL-only contract (e.g. findThreadedJoinFields's separate URL/body
+    // gating).
+    const values = new Set(collectRequestUrlValues(capture, allCaptures));
+    const bodyValuesByKey = collectRequestBodyValuesByKey(capture, allCaptures);
+    for (const leafValues of bodyValuesByKey?.values() ?? []) {
+        for (const value of leafValues)
+            values.add(value);
     }
     return values;
 }
@@ -5518,6 +6671,40 @@ function applyDrillParamBindings(spec, capture, text) {
         return acc.replace(paramRx, (_full, prefix) => `${prefix}${accessor}`);
     }, text);
 }
+/** True when `value` is a QUERY PARAM value in `capture.url` whose key
+ * genuinely differs on at least one other same-endpoint occurrence in
+ * `allCaptures` — i.e. a real per-request dependency (an item id, a page
+ * cursor), not a coincidental byte match against an opaque path segment or a
+ * key that happens to hold the same value on every occurrence. Used to
+ * decide, field by field, whether a threaded-value splice into a capture
+ * proven request-invariant ({@link isZeroVarianceRepeatCapture}) is a
+ * legitimate substitution or the exact coincidence that guard exists to
+ * catch — a capture can be "invariant" on one key (a fixed `qty`) while
+ * still genuinely varying on another (`itemId`), so the invariance verdict
+ * alone can't gate substitution at the whole-capture level. */
+function isGenuineVaryingQueryValue(value, capture, allCaptures) {
+    let url;
+    try {
+        url = new URL(capture.url);
+    }
+    catch {
+        return false;
+    }
+    const key = [...url.searchParams.entries()].find(([, v]) => v === value)?.[0];
+    if (key === undefined)
+        return false;
+    const endpoint = endpointKey(capture.url);
+    return allCaptures.some((c) => {
+        if (c === capture || endpointKey(c.url) !== endpoint)
+            return false;
+        try {
+            return new URL(c.url).searchParams.get(key) !== value;
+        }
+        catch {
+            return false;
+        }
+    });
+}
 /** Throws when {@link findFrozenVaryingDrillParams} finds any frozen-but-
  * varying literal — shared by {@link parameterizeUrl} (below) and
  * `emitMultiStepExecuteHttp`'s own `parameterize` so the two emitters can't
@@ -5658,13 +6845,36 @@ function dedupeThreadedFields(fields) {
  * where narrowing by variance is a different concern than the URL/body
  * over-threading this gate exists to prevent. */
 function findThreadedJoinFields(scopes, drillCapture, allCaptures) {
-    const requestValues = collectRequestStringValues(drillCapture, allCaptures);
-    if (requestValues.size === 0)
+    const urlValues = collectRequestUrlValues(drillCapture, allCaptures);
+    const bodyValuesByKey = collectRequestBodyValuesByKey(drillCapture, allCaptures);
+    if (urlValues.size === 0 && (bodyValuesByKey === null || bodyValuesByKey.size === 0))
         return [];
+    // A candidate field's value must EITHER surface name-free in the drill
+    // request's own URL/query (a path segment or query param carries no JSON
+    // key to correlate against, matching interpolateStateValues' isJsonBody
+    // distinction — see its docstring) OR surface in the JSON body under a
+    // key that plausibly names the same concept as the field's own last path
+    // segment (via keyNamesCorrelate, the same discipline compileActionSteps'
+    // pre-scan already applies to body-value reuse). A value that ONLY
+    // coincidentally equals an unrelated body field's value — no URL match,
+    // no name correlation to the body key it landed under — is not threading;
+    // it's the value-coincidence bug this gate exists to close.
     return scopes.flatMap(({ varName, obj }) => [...walkItemFieldPaths(obj)]
-        .filter(({ value: v }) => (typeof v === "string" && v.length > 0 && requestValues.has(v)) ||
-        (typeof v === "number" && requestValues.has(String(v))) ||
-        (typeof v === "boolean" && requestValues.has(String(v))))
+        .filter(({ path, value: v }) => {
+        const stringValue = typeof v === "string" && v.length > 0
+            ? v
+            : typeof v === "number" || typeof v === "boolean"
+                ? String(v)
+                : null;
+        if (stringValue === null)
+            return false;
+        if (urlValues.has(stringValue))
+            return true;
+        if (bodyValuesByKey === null)
+            return false;
+        const sourceKeyName = path.at(-1);
+        return [...bodyValuesByKey.entries()].some(([targetKey, leaves]) => leaves.has(stringValue) && keyNamesCorrelate(sourceKeyName, targetKey));
+    })
         .map(({ path }) => ({ varName, field: path.join(".") })));
 }
 /** True when `target`'s own drill/chain-terminal response resolves onto MORE
@@ -5967,6 +7177,11 @@ function scanPrimaryCandidateGroups(actions, primaryIndex, globallyConsumedIndic
     const consumedIndices = new Set();
     for (const primaryArray of primaryCandidates) {
         const targets = [];
+        // See FoldPlan.absorbedIndices — a candidate hitting the SAME endpoint
+        // as a target already resolved for this array is a repeat raw capture
+        // of that one per-item drill (threaded from a DIFFERENT primary item),
+        // not an independent target, so it lands here instead of `targets`.
+        const absorbedIndices = [];
         // Pruned to the (typically tiny) set of later action indices whose
         // request could possibly thread one of this array's own item values —
         // see buildRequestStringValueIndex's docstring — instead of every
@@ -5987,6 +7202,24 @@ function scanPrimaryCandidateGroups(actions, primaryIndex, globallyConsumedIndic
             if (primaryMatchedItemIndex === -1)
                 continue;
             const joinFields = findThreadedJoinFields([{ varName: "item", obj: primaryArray.items[primaryMatchedItemIndex] }], drill.capture).map((f) => f.field);
+            // A genuinely per-item-varying repeated endpoint (the SAME drill
+            // called once per primary item, each occurrence threading a
+            // DIFFERENT item's own join value) is one logical target, not N — the
+            // fold loop already re-issues the representative target's request
+            // once per item via its own `item.<field>` accessor. Recognizing a
+            // later candidate as a repeat of an ALREADY-RESOLVED target's
+            // endpoint (rather than letting it become its own independent
+            // target) is exactly the widening this structural heuristic needed:
+            // previously every threading candidate became its own FoldTarget,
+            // so N per-item captures of one endpoint fanned out into N separate
+            // httpClient calls inside the loop instead of collapsing to one.
+            const drillEndpointKey = endpointKey(drill.capture.url);
+            const alreadyTargetedSameEndpoint = targets.some((t) => endpointKey(actions[t.drillStepIndex].capture.url) === drillEndpointKey);
+            if (alreadyTargetedSameEndpoint) {
+                absorbedIndices.push(drillIndex);
+                consumedIndices.add(drillIndex);
+                continue;
+            }
             // Widened to a flat (non-array) object response when the drill step has
             // no object-array field of its own — see
             // findAllObjectArrayFieldsOrWholeObject. A detail-by-id response (e.g.
@@ -6049,8 +7282,9 @@ function scanPrimaryCandidateGroups(actions, primaryIndex, globallyConsumedIndic
             for (const chainIndex of chain)
                 consumedIndices.add(chainIndex);
         }
-        if (targets.length > 0)
-            groups.push({ primaryArrayPath: primaryArray.path, targets });
+        if (targets.length > 0) {
+            groups.push({ primaryArrayPath: primaryArray.path, targets, absorbedIndices });
+        }
     }
     return groups;
 }
@@ -6151,6 +7385,7 @@ function detectDrillDownFoldPlan(actions) {
                 primaryStepIndex: freshestIndex,
                 primaryArrayPath: freshestGroup.primaryArrayPath,
                 targets: freshestGroup.targets,
+                absorbedIndices: freshestGroup.absorbedIndices,
             });
             // A step already folded into this plan's chains — the drill step(s)
             // and everything threaded onward from them — was already merged
@@ -6165,6 +7400,12 @@ function detectDrillDownFoldPlan(actions) {
                 for (const chainIndex of target.chain)
                     addConsumed(chainIndex);
             }
+            // Absorbed repeat occurrences (see FoldPlan.absorbedIndices) were never
+            // part of any target's chain, so they must be consumed here too, or
+            // they would surface as leftover raw indices and get emitted a second
+            // time as their own single hardcoded calls.
+            for (const absorbedIndex of freshestGroup.absorbedIndices)
+                addConsumed(absorbedIndex);
         }
     }
     return plans;
@@ -6685,6 +7926,7 @@ function buildFoldPlanFromSpec(actions, spec) {
                         chainTerminalIndex,
                     },
                 ],
+                absorbedIndices: [],
             };
             break;
         }
@@ -6892,15 +8134,131 @@ function mergeSpecPlanOntoSamePrimary(structuralPlans, actions, foldReturnSpec)
  * in one response — keeps this exact to the shape state-threading is
  * actually needed for.
  *
+ * A later hop's request is only counted as threading a prior hop's response
+ * value when the two agree on the field/header NAME that carries it (or the
+ * value shows up as a bare, name-free URL PATH segment on the later
+ * request) — the same discipline {@link requestAndResponseValuesByKey}/
+ * {@link isFieldValueThreadedElsewhere} already enforce for the identical
+ * hazard elsewhere in this file. Bare cross-capture value equality alone
+ * (what this used before) lets a deeply-nested, unrelated response scalar —
+ * a UI sort-order integer, an unrelated feature-flag boolean — that merely
+ * happens to numerically coincide with some later request field's true
+ * value get proven "threaded" and then, via `indexStateValues`'
+ * `MIN_STATE_VALUE_LENGTH` exemption below, spliced into that unrelated
+ * field. Requiring the SAME name on both sides is what tells a value a
+ * later step genuinely re-reads under its own name apart from that
+ * coincidence.
+ *
  * Runs directly off raw actions (not `resolveFoldPlan`, which needs
  * `isMultipart` — unavailable before `compileActionSteps` has run) since
  * fold-plan DETECTION depends only on each action's `capture`.
- */
+ *
+ * Returns a value -> proven-consumer-captures map rather than a flat set: a
+ * value's chain-proven threading relationship holds ONLY between the
+ * specific chain hops that produced and consumed it, never globally across
+ * every capture in the flow. Callers that bypass `MIN_STATE_VALUE_LENGTH`
+ * for one of these values (see `indexStateValues`) must scope that bypass to
+ * the returned consumer set, or a short value legitimately threaded between
+ * two unrelated steps can coincidentally match inside a totally unrelated
+ * capture's own URL/body and get spliced into it.
+ */
+/** Per-capture memoized: every response BODY leaf, grouped by the field NAME
+ * that carries it — gives {@link collectDependentDrillDownChainValues} the
+ * same name-correlation signal {@link requestAndResponseValuesByKey} already
+ * provides elsewhere in this file, instead of the bare, name-blind value set
+ * {@link collectResponseLeafValues} supplies. Deliberately BODY-only, unlike
+ * {@link collectResponseLeafValues}: a response HEADER (and especially a
+ * `Set-Cookie` token mint) is already a strong structural signal on its own
+ * — issuing a header/cookie at all is a deliberate server action, unlike an
+ * arbitrary deeply-nested body scalar that merely happens to be present — so
+ * header-sourced values keep the pre-existing bare-value match further down
+ * in {@link collectDependentDrillDownChainValues} rather than being held to
+ * a body-field's name correlation. */
+const responseBodyValuesByKeyCache = new WeakMap();
+function responseBodyValuesByKey(capture) {
+    const cached = responseBodyValuesByKeyCache.get(capture);
+    if (cached)
+        return cached;
+    const byKey = new Map();
+    const add = (key, value) => {
+        const values = byKey.get(key) ?? new Set();
+        values.add(value);
+        byKey.set(key, values);
+    };
+    for (const { value, path } of walkAllPrimitiveLeaves(capture.responseBody)) {
+        if (value !== null && path.length > 0)
+            add(path[path.length - 1], String(value));
+    }
+    responseBodyValuesByKeyCache.set(capture, byKey);
+    return byKey;
+}
+/** Per-capture memoized request-side twin of {@link responseBodyValuesByKey}:
+ * every URL query param, JSON body leaf, and request header value, grouped
+ * by field/param/header NAME (header names lower-cased, since HTTP header
+ * names are case-insensitive and a capture's minted header casing need not
+ * match the later request's own casing of the same header), plus bare URL
+ * PATH segments kept name-free in {@link
+ * RequestAndResponseValues.pathSegments} — a REST-style detail fetch threads
+ * an id through its URL PATH, not a named field, so requiring a name match
+ * there too would blind chain-value correlation to that shape of genuine
+ * threading. Headers are included here (unlike {@link
+ * responseBodyValuesByKey}) so a body-sourced response value that a later
+ * hop re-sends as a request HEADER under the matching name still
+ * correlates. */
+const requestValuesByKeyCache = new WeakMap();
+function requestValuesByKeyIncludingHeaders(capture) {
+    const cached = requestValuesByKeyCache.get(capture);
+    if (cached)
+        return cached;
+    const byKey = new Map();
+    const pathSegments = new Set();
+    const add = (key, value) => {
+        const values = byKey.get(key) ?? new Set();
+        values.add(value);
+        byKey.set(key, values);
+    };
+    try {
+        const url = new URL(capture.url);
+        for (const segment of url.pathname.split("/").filter(Boolean))
+            pathSegments.add(segment);
+        for (const [key, value] of url.searchParams)
+            add(key, value);
+    }
+    catch {
+        // Relative/invalid URLs carry no path/query signal to contribute.
+    }
+    if (capture.requestPostData) {
+        try {
+            const parsed = JSON.parse(capture.requestPostData);
+            for (const { value, path } of walkAllPrimitiveLeaves(parsed)) {
+                if (value !== null && path.length > 0)
+                    add(path[path.length - 1], String(value));
+            }
+        }
+        catch {
+            // A non-JSON body carries no leaf values to contribute.
+        }
+    }
+    for (const [headerName, headerValue] of Object.entries(capture.requestHeaders)) {
+        add(headerName.toLowerCase(), headerValue);
+    }
+    const result = { byKey, pathSegments };
+    requestValuesByKeyCache.set(capture, result);
+    return result;
+}
+/** Matches a JSON path segment that's a bare array INDEX ("0", "12", ...)
+ * rather than an object field/header NAME. An array index carries no
+ * semantic meaning of its own — a top-level array response (`[42]`) or a
+ * value nested inside a request array (`{"tokens":[42]}`) has no field name
+ * to correlate on either side — so {@link collectDependentDrillDownChainValues}
+ * treats a leaf keyed by one as name-free, the same way it already treats a
+ * bare URL path segment, instead of requiring an impossible name match. */
+const ARRAY_INDEX_KEY_PATTERN = /^\d+$/;
 function collectDependentDrillDownChainValues(actions, foldReturnSpec) {
     const structuralPlans = detectDrillDownFoldPlan(actions);
     const specPlan = foldReturnSpec === null ? null : buildFoldPlanFromSpec(actions, foldReturnSpec);
     const plans = structuralPlans.length > 0 ? structuralPlans : specPlan === null ? [] : [specPlan];
-    const values = new Set();
+    const consumersByValue = new Map();
     for (const plan of plans) {
         for (const target of plan.targets) {
             for (let j = 0; j < target.chain.length; j++) {
@@ -6908,22 +8266,67 @@ function collectDependentDrillDownChainValues(actions, foldReturnSpec) {
                 const priorCapture = actions[priorIndex]?.capture;
                 if (!priorCapture)
                     continue;
-                const responseValues = collectResponseLeafValues(priorCapture);
+                const priorResponseBodyByKey = responseBodyValuesByKey(priorCapture);
+                // Header/cookie-origin response values are matched by bare value
+                // further down, not by name — see {@link responseBodyValuesByKey}'s
+                // docstring for why a header/cookie mint doesn't need that
+                // correlation to already be a trustworthy threading signal.
+                const priorHeaderValues = new Set(Object.values(priorCapture.responseHeaders));
                 const echoedValues = collectRequestValuesIncludingHeaders(priorCapture);
                 for (let k = j + 1; k < target.chain.length; k++) {
                     const laterCapture = actions[target.chain[k]]?.capture;
                     if (!laterCapture)
                         continue;
+                    const { byKey: laterRequestByKey, pathSegments: laterPathSegments } = requestValuesByKeyIncludingHeaders(laterCapture);
                     const laterRequestValues = collectRequestValuesIncludingHeaders(laterCapture);
-                    for (const v of responseValues) {
-                        if (!echoedValues.has(v) && laterRequestValues.has(v))
-                            values.add(v);
+                    // Reverse index (value -> every later-side key it appears under),
+                    // built once per (priorCapture, laterCapture) pair rather than
+                    // once per value, so the array-index name-free fallback below
+                    // doesn't re-walk laterRequestByKey per value.
+                    const laterKeysByValue = new Map();
+                    for (const [k2, vs] of laterRequestByKey) {
+                        for (const v of vs) {
+                            const keys = laterKeysByValue.get(v) ?? new Set();
+                            keys.add(k2);
+                            laterKeysByValue.set(v, keys);
+                        }
+                    }
+                    const addConsumer = (v) => {
+                        const consumers = consumersByValue.get(v) ?? new Set();
+                        consumers.add(laterCapture);
+                        consumersByValue.set(v, consumers);
+                    };
+                    for (const [key, values] of priorResponseBodyByKey) {
+                        const priorKeyIsArrayIndex = ARRAY_INDEX_KEY_PATTERN.test(key);
+                        for (const v of values) {
+                            if (echoedValues.has(v))
+                                continue;
+                            const laterKeysForValue = laterKeysByValue.get(v);
+                            const sameNameMatch = laterKeysForValue?.has(key) ?? false;
+                            const pathSegmentMatch = laterPathSegments.has(v);
+                            // Only the SOURCE side being name-free (an array element with
+                            // no field name of its own) exempts this from name matching —
+                            // a genuinely NAMED source field must still correlate by name
+                            // even if it happens to land inside a later array element,
+                            // otherwise a named `sortOrder` could dodge correlation just
+                            // by coincidentally equaling a value inside an unrelated
+                            // later-side array (`{"tokens":[7]}`).
+                            const arrayIndexMatch = priorKeyIsArrayIndex && laterKeysForValue !== undefined;
+                            if (!sameNameMatch && !pathSegmentMatch && !arrayIndexMatch)
+                                continue;
+                            addConsumer(v);
+                        }
+                    }
+                    for (const v of priorHeaderValues) {
+                        if (echoedValues.has(v) || !laterRequestValues.has(v))
+                            continue;
+                        addConsumer(v);
                     }
                 }
             }
         }
     }
-    return values;
+    return consumersByValue;
 }
 function resolveFoldPlan(actions, foldReturnSpec = null) {
     const structuralPlans = detectDrillDownFoldPlan(actions);
@@ -7013,17 +8416,59 @@ function replaceByReference(value, target, replacement) {
  * `throw` at the analogous point, minus the throw, since shape inference
  * degrading gracefully is preferable to failing a generate run over it.
  */
+/** Folds one drill-down response's matching item onto `body`'s primary
+ * array — the single-occurrence step {@link foldResponseBodyForShapeInference}
+ * runs once for a target's own representative drill and again for each of
+ * its {@link FoldPlan.absorbedIndices} siblings, so both call sites resolve
+ * the merge identically. `matchedItem` must already be resolved by the
+ * caller: the representative occurrence knows it via `primaryMatchedItemIndex`,
+ * while an absorbed occurrence resolves it by re-threading its OWN request
+ * against every primary item (see the call site) — a drill-down's RESPONSE
+ * commonly never echoes the join field it was looked up by, so matching by
+ * response content alone (as the representative branch's own `drillMatch`
+ * fallback does when the response doesn't echo it) can't identify WHICH item
+ * an absorbed occurrence belongs to in the first place. */
+function foldOneDrillOccurrence(body, primaryArrayPath, joinFields, drillItems, matchedItem) {
+    const primaryItems = objectItemsAtPath(body, primaryArrayPath);
+    if (!primaryItems)
+        return body;
+    const drillMatch = drillItems.find((d) => joinFields.every((f) => String(readValueAtPath(d, f.split("."))) ===
+        String(readValueAtPath(matchedItem, f.split("."))))) ?? drillItems[0];
+    if (!drillMatch)
+        return body;
+    return replaceByReference(body, matchedItem, { ...drillMatch, ...matchedItem });
+}
 function foldResponseBodyForShapeInference(actionSteps, foldPlan, initialBody = actionSteps[foldPlan.primaryStepIndex].capture.responseBody) {
     return foldPlan.targets.reduce((body, target) => {
         const drillBody = actionSteps[target.chainTerminalIndex].capture.responseBody;
         const primaryItems = objectItemsAtPath(body, foldPlan.primaryArrayPath);
         const drillItems = objectItemsAtPath(drillBody, target.chainArrayPath);
         const matchedItem = primaryItems?.[target.primaryMatchedItemIndex];
-        const drillMatch = drillItems?.find((d) => target.joinFields.every((f) => String(readValueAtPath(d, f.split("."))) ===
-            String(readValueAtPath(matchedItem, f.split("."))))) ?? drillItems?.[0];
-        if (!primaryItems || !matchedItem || !drillMatch)
-            return body;
-        return replaceByReference(body, matchedItem, { ...drillMatch, ...matchedItem });
+        const bodyAfterOwnDrill = !drillItems || !matchedItem
+            ? body
+            : foldOneDrillOccurrence(body, foldPlan.primaryArrayPath, target.joinFields, drillItems, matchedItem);
+        // Every absorbed occurrence of this SAME endpoint (a repeat raw capture
+        // threaded from a DIFFERENT primary item — see FoldPlan.absorbedIndices)
+        // is folded in too, so schema inference sees every sampled per-item
+        // field, not just the single representative occurrence's — see the
+        // `"merges by join key, not position"` regression this restores. Which
+        // primary item an absorbed occurrence belongs to is re-derived from its
+        // own REQUEST (mirroring the original structural scan's own matching),
+        // not its response, since a drill response commonly never echoes the
+        // join field back.
+        const targetEndpointKey = endpointKey(actionSteps[target.drillStepIndex].capture.url);
+        return foldPlan.absorbedIndices.reduce((innerBody, absorbedIndex) => {
+            const absorbedCapture = actionSteps[absorbedIndex]?.capture;
+            if (!absorbedCapture || endpointKey(absorbedCapture.url) !== targetEndpointKey) {
+                return innerBody;
+            }
+            const absorbedDrillItems = objectItemsAtPath(absorbedCapture.responseBody, target.chainArrayPath);
+            const innerPrimaryItems = objectItemsAtPath(innerBody, foldPlan.primaryArrayPath);
+            const absorbedMatchedItem = innerPrimaryItems?.find((item) => findThreadedJoinFields([{ varName: "item", obj: item }], absorbedCapture).length > 0);
+            if (!absorbedDrillItems || !absorbedMatchedItem)
+                return innerBody;
+            return foldOneDrillOccurrence(innerBody, foldPlan.primaryArrayPath, target.joinFields, absorbedDrillItems, absorbedMatchedItem);
+        }, bodyAfterOwnDrill);
     }, initialBody);
 }
 /**
@@ -7514,6 +8959,33 @@ function emitContractTs(opts) {
         const value = payloadNeedsMultipart ? `multipartJsonObject(${schema})` : schema;
         addExtendField(name, `  ${key}: ${value},`);
     }
+    // Closing-the-loop safety net: every discovered-field source above tracks
+    // its own registration as it splices a `payload.<field>` accessor into the
+    // emitted body/url/headers text, but that tracking is scattered across N
+    // independent passes (form-schema discovery, option mappings, additional
+    // body keys, structured keys, drill-param bindings, and — inside
+    // emitMultiStepExecuteHttp's fold-loop `parameterize` closure — threaded
+    // join-field rebinding), any one of which can add an accessor to the
+    // rendered text without remembering to register it in the matching map
+    // above. Rather than trust each source to stay perfectly in sync with the
+    // text it emits, derive completeness from the actual rendered output: scan
+    // `multiStepBody` (already fully assembled at this point — every chain
+    // step's url/headers/body substitutions are done) for every
+    // `payload.<field>` reference and union in any name the sources above
+    // missed, with a conservative `z.string()` default. This closes the gap at
+    // its structural root regardless of which upstream pass forgot to record a
+    // field, instead of adding a fifth registration site that could itself be
+    // forgotten by a future pass.
+    if (multiStepBody) {
+        const bodyReferencedFields = new Set([...multiStepBody.matchAll(/\bpayload\.([A-Za-z_$][A-Za-z0-9_$]*)/g)].map((m) => m[1]));
+        for (const name of [...bodyReferencedFields].sort()) {
+            if (extendFields.has(name))
+                continue;
+            if (isReservedByApplicantContactSchema(name))
+                continue;
+            addExtendField(name, `  ${name}: z.string(),`);
+        }
+    }
     // The structural walk over the captured request body that used to BE the
     // public payload schema (see basePayloadSchemaExpr above) is still the
     // right starting point for the plugin author's internal builder — it's
@@ -7736,8 +9208,22 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                 // referencesItemVar (below) never has a chance to hoist it.
                 const isAncestorScoped = isFoldTargetAncestorScoped(target, actionSteps.map((s) => ({ capture: s.capture })), primaryItemsWithAncestors, fullAncestors);
                 const suffix = foldPlan.targets.length > 1 ? `${planSuffix}${targetIndex}` : planSuffix;
-                const scopedAccessor = (varName, field) => `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
+                // Only `itemVar` (and fold-match candidates) are `Record<string,
+                // unknown>`-typed — ancestor loop vars keep the real response-derived
+                // type, so re-asserting THEIR intermediate hops would be both
+                // unnecessary and, worse, would replace a real property access with
+                // an opaque cast in the emitted URL/body text.
+                const scopedAccessor = (varName, field) => varName === itemVar
+                    ? unknownValueAccessor(varName, field.split("."))
+                    : `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
                 const joinAccessor = (field) => scopedAccessor(itemVar, field);
+                // Computed once per fold target instead of once per `parameterizeUrl`
+                // call: `actionSteps` never changes across the calls this target's
+                // chain steps make, so re-deriving this array on every one of
+                // findThreadedJoinFields/isZeroVarianceRepeatCapture/
+                // isGenuineVaryingQueryValue/assertNoFrozenVaryingDrillParams's own
+                // calls below was O(actionSteps.length) work repeated 4x per call.
+                const allCaptures = actionSteps.map((s) => s.capture);
                 // Same word-boundary-anchored swap emitMultiStepExecuteHttp's own
                 // `parameterize` performs — a plain split/join would also rewrite
                 // unrelated substrings that happen to contain the join value.
@@ -7762,7 +9248,7 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                         : rawUrl;
                     const rawThreadedFields = dedupeThreadedFields([
                         ...target.joinFields.map((field) => ({ varName: itemVar, field })),
-                        ...findThreadedJoinFields(threadingScopes, chainCapture, actionSteps.map((s) => s.capture)),
+                        ...findThreadedJoinFields(threadingScopes, chainCapture, allCaptures),
                     ]);
                     // Mirrors emitMultiStepExecuteHttp's identical rebind (see
                     // isAncestorScoped above): a proven ancestor-scoped drill still
@@ -7787,7 +9273,13 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                                 : tf,
                         }))
                         : rawThreadedFields.map((tf) => ({ valueField: tf, accessorField: tf }));
-                    const result = threadedFieldPairs.reduce((acc, { valueField, accessorField }) => {
+                    // ONE guarded regex-alternation pass over `withBase` for every
+                    // threaded field's value, longest first — see substituteThreadedValues's
+                    // doc for why a per-field sequential `.replace()` loop here (the bug
+                    // this replaces) can splice an unrelated value into an opaque URL
+                    // segment or nest a `${...}` placeholder.
+                    const valueBindings = threadedFieldPairs
+                        .map(({ valueField, accessorField }) => {
                         const scopeObj = valueField.varName === itemVar
                             ? firstItem
                             : ancestorObjByVar.get(valueField.varName);
@@ -7797,12 +9289,31 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                             : typeof value === "number" || typeof value === "boolean"
                                 ? String(value)
                                 : null;
-                        if (stringValue === null)
-                            return acc;
-                        return acc.replace(new RegExp(`\\b${stringValue.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "g"), `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`);
-                    }, withBase);
+                        return stringValue === null
+                            ? null
+                            : {
+                                value: stringValue,
+                                replacement: `\${${scopedAccessor(accessorField.varName, accessorField.field)}}`,
+                            };
+                    })
+                        .filter((b) => b !== null);
+                    // A capture proven request-invariant ({@link isZeroVarianceRepeatCapture})
+                    // must never have a COINCIDENTAL threaded value spliced into it —
+                    // see emitMultiStepExecuteHttp's identical `parameterize` guard
+                    // ({@link isGenuineVaryingQueryValue}) for why this is decided
+                    // field by field rather than for the whole capture at once.
+                    const isProvenInvariant = (0, capture_filters_1.isZeroVarianceRepeatCapture)(chainCapture, allCaptures);
+                    const filteredValueBindings = isProvenInvariant
+                        ? valueBindings.filter((b) => isGenuineVaryingQueryValue(b.value, chainCapture, allCaptures))
+                        : valueBindings;
+                    const result = substituteThreadedValues(withBase, filteredValueBindings);
                     const withDrillParamBindings = applyDrillParamBindings(foldReturnSpec, chainCapture, result);
-                    assertNoFrozenVaryingDrillParams("emitContractTs", chainCapture, withDrillParamBindings, actionSteps.map((s) => s.capture));
+                    // See emitMultiStepExecuteHttp's identical guard: the frozen-
+                    // varying-param safety net does not apply once the capture is
+                    // already proven request-invariant.
+                    if (!isProvenInvariant) {
+                        assertNoFrozenVaryingDrillParams("emitContractTs", chainCapture, withDrillParamBindings, allCaptures);
+                    }
                     return withDrillParamBindings;
                 };
                 const chainLines = [];
@@ -7819,6 +9330,10 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                     const chainStep = actionSteps[chainIndex];
                     if (!chainStep)
                         continue;
+                    // The zero-variance guard lives inside `parameterizeUrl` itself
+                    // (see above) so it can skip only the threaded-value splice while
+                    // still letting a spec-declared drillParamBindings substitution
+                    // apply.
                     const url = parameterizeUrl(chainStep.capture.url, chainStep.capture);
                     if (itemVarRefPattern.test(url))
                         referencesItemVar = true;
@@ -9060,7 +10575,7 @@ async function main() {
         // producible state (see collectDependentDrillDownChainValues).
         const dependentDrillDownChainValues = actionCaptures.length > 1
             ? collectDependentDrillDownChainValues(actionCaptures, foldReturnSpec)
-            : new Set();
+            : new Map();
         const stateIndex = actionCaptures.length > 1
             ? indexStateValues(activeCaptures, shieldedUuids, actionCaptureIndices, dependentDrillDownChainValues)
             : new Map();
@@ -9089,6 +10604,16 @@ async function main() {
             : undefined;
         const errorSignals = detectErrorSignals(actionSteps);
         const discoveredFormFields = new Set();
+        // emitMultiStepExecuteHttp's outDiscoveredFields parameter is a generic
+        // payload-accessor accumulator — BaseUrl substitution, persona/producer-
+        // boundary bindings, entryUrlParams, tenant-subdomain headers, and
+        // walkStringLeaves-derived accessors all write into it, independent of
+        // form-schema discovery. It gets its own Set (rather than aliasing
+        // discoveredFormFields positionally) so the two concerns stay separately
+        // named; the explicit merge below is what actually wires its fields into
+        // emitContractTs's schema — never an incidental byproduct of sharing one
+        // reference across unrelated call sites.
+        const discoveredPayloadAccessorFields = new Set();
         const discoveredOptionFields = new Set();
         // Phase E: maps label-derived raw-option payload field name (e.g.
         // "AreYouOverTheAgeOf18OptionId") → recon-observed option-id UUID. Used to
@@ -9161,8 +10686,15 @@ async function main() {
         const multiStepBody = browserFlowOnly
             ? undefined
             : isSubmissionFlow
-                ? emitMultiStepExecuteHttp(actionSteps, inputBody, errorSignals, fieldNameMap, discoveredFormFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema, personaBindings, entryUrlParams, shieldedUuids, selectResolutions, discoveredStructuredKeys, rawCodeFields, foldReturnSpec)
+                ? emitMultiStepExecuteHttp(actionSteps, inputBody, errorSignals, fieldNameMap, discoveredPayloadAccessorFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema, personaBindings, entryUrlParams, shieldedUuids, selectResolutions, discoveredStructuredKeys, rawCodeFields, foldReturnSpec, pascal)
                 : undefined;
+        // Explicit merge — every field emitMultiStepExecuteHttp registered as a
+        // `payload.<field>` accessor (BaseUrl, persona, entryUrlParams, tenant-
+        // subdomain headers, walkStringLeaves) flows into the same discovered-
+        // fields set emitContractTs's schema `.extend()` reads from below.
+        for (const field of discoveredPayloadAccessorFields) {
+            discoveredFormFields.add(field);
+        }
         const hasMultipartStep = actionSteps.some((s) => s.isMultipart);
         const headerBindings = collectHeaderBindings(actionSteps);
         // Shape inference targets the SAME call executeHttp returns — see