@enricai/barnacle 1.12.50 → 1.12.52

package/dist/scripts/recon-generate.js

@@ -44,6 +44,7 @@ exports.extractActionSequence = extractActionSequence;
 exports.extractGraphQLActionSequence = extractGraphQLActionSequence;
 exports.dedupRedundantSameOperationCaptures = dedupRedundantSameOperationCaptures;
 exports.isRedundantSameEndpointGroup = isRedundantSameEndpointGroup;
+exports.assertBodyFieldSourceNameCorrelates = assertBodyFieldSourceNameCorrelates;
 exports.detectFormSchemaFieldNames = detectFormSchemaFieldNames;
 exports.indexEnumEnumNamesSchemas = indexEnumEnumNamesSchemas;
 exports.indexLabelValueOptionCodes = indexLabelValueOptionCodes;
@@ -2261,6 +2262,199 @@ function jsonBodyLeafValues(requestPostData) {
     }
     return values;
 }
+/**
+ * Same JSON body walk as {@link jsonBodyLeafValues}, but grouped by the JSON
+ * key/array-index that carries each leaf value — the by-name correlation
+ * `compileActionSteps`' consumption pre-scan needs so a produced value is
+ * only treated as reused when the SOURCE field's name correlates with the
+ * TARGET field it's found in (mirrors {@link
+ * collectDependentDrillDownChainValues}'s sameNameMatch/arrayIndexMatch,
+ * applied here as the general eligibility gate rather than only the
+ * short-value length-floor exemption). Returns null under the same
+ * conditions as `jsonBodyLeafValues`, for the same non-JSON fallback.
+ */
+function jsonBodyLeafValuesByKey(requestPostData) {
+    if (typeof requestPostData !== "string" || requestPostData.length === 0)
+        return null;
+    const parsed = (() => {
+        try {
+            return JSON.parse(requestPostData);
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (parsed === undefined)
+        return null;
+    const byKey = new Map();
+    for (const { value, path } of walkAllPrimitiveLeaves(parsed)) {
+        if (value === null || path.length === 0)
+            continue;
+        // An array ELEMENT carries no field name of its own (its last path
+        // segment is a bare numeric index) — the array's own key, one or more
+        // segments up, is the nearest name to correlate against (e.g.
+        // `{"tokens":[12345678]}"` correlates on "tokens", not "0"). A leaf at
+        // the top of an unnamed array (no non-numeric ancestor at all) has
+        // truly no name; it keeps its numeric key so callers can still detect
+        // it as name-free via {@link ARRAY_INDEX_KEY_PATTERN}.
+        const namedSegment = [...path]
+            .reverse()
+            .find((segment) => !ARRAY_INDEX_KEY_PATTERN.test(segment));
+        const key = namedSegment ?? path[path.length - 1];
+        const values = byKey.get(key) ?? new Set();
+        values.add(String(value));
+        byKey.set(key, values);
+    }
+    return byKey;
+}
+/** Splits a `camelCase`/`snake_case`/`kebab-case` field name into its
+ * constituent lowercase words, dropping words shorter than 3 characters (an
+ * "id"/"no"/"ok"-shaped word is too generic on its own to prove two field
+ * names name the same concept). Used by {@link keyNamesCorrelate}. */
+function keyNameWords(key) {
+    return key
+        .split(/(?=[A-Z])|[_\-\s]+/)
+        .map((word) => word.toLowerCase())
+        .filter((word) => word.length >= 3);
+}
+/** Words common enough as a naming SUFFIX/PREFIX that sharing one proves
+ * nothing on its own — `startDate`/`endDate` and `firstName`/`lastName` each
+ * share a word under this set's length-≥3 threshold while naming opposite
+ * concepts. Used by {@link keyNamesCorrelate} to require a more specific
+ * word overlap whenever both keys also carry a non-generic word to compare. */
+const GENERIC_KEY_WORDS = new Set([
+    "name",
+    "date",
+    "type",
+    "code",
+    "email",
+    "phone",
+    "address",
+    "flag",
+    "count",
+    "number",
+    "value",
+    "status",
+    "key",
+    "time",
+]);
+/**
+ * True when a SOURCE field name and a TARGET field name plausibly name the
+ * same concept — an exact match, or a shared word (one a substring of the
+ * other, so a plural/prefix variant like `token`/`tokens` or a compound like
+ * `jobId`/`jobSeqNo` or `draftId`/`applicationDraftId` still correlates)
+ * once both are split into their constituent camelCase words. This is the
+ * general-purpose sibling of {@link collectDependentDrillDownChainValues}'s
+ * stricter exact-key `sameNameMatch`, used by `compileActionSteps`' body-
+ * value consumption gate where the source/target key casing and compounding
+ * legitimately differ across endpoints.
+ *
+ * A shared {@link GENERIC_KEY_WORDS} word is insufficient PROOF when both
+ * keys also carry a more specific, non-generic word — `startDate` and
+ * `endDate` both reduce to `["start"]`/`["end"]` once `date` is set aside,
+ * and those don't overlap, so the pair must NOT correlate despite sharing
+ * `date`. A generic word is only trusted when one side has no non-generic
+ * word to fall back on (e.g. `statusToken` vs. the bare `tokens` key).
+ */
+function keyNamesCorrelate(sourceKey, targetKey) {
+    if (sourceKey === targetKey)
+        return true;
+    const sourceWords = keyNameWords(sourceKey);
+    const targetWords = keyNameWords(targetKey);
+    const wordsMatch = (a, b) => a.includes(b) || b.includes(a);
+    const sourceSpecific = sourceWords.filter((w) => !GENERIC_KEY_WORDS.has(w));
+    const targetSpecific = targetWords.filter((w) => !GENERIC_KEY_WORDS.has(w));
+    if (sourceSpecific.length > 0 && targetSpecific.length > 0) {
+        return sourceSpecific.some((sw) => targetSpecific.some((tw) => wordsMatch(sw, tw)));
+    }
+    return sourceWords.some((sw) => targetWords.some((tw) => wordsMatch(sw, tw)));
+}
+/** A spliced `${...}` accessor/varName whose own derived name is
+ * legitimately name-free — it can never be required to correlate with the
+ * JSON key it lands under. A `payload.<field>` accessor matches its target
+ * BY DEFINITION (the schema field IS the body key), and a bare loop
+ * index/counter (`i`, `i0`, `idx0`) names a position, not a concept. Used by
+ * {@link deriveSplicedSourceName}. */
+const NAME_FREE_ACCESSOR_PATTERN = /^payload\./;
+const ARRAY_INDEX_VAR_PATTERN = /^(?:i|idx)\d*$/;
+/** {@link deriveSplicedSourceName} only derives a correlatable name for an
+ * accessor rooted at one of this file's own fold/drill per-item or
+ * ancestor-scope bindings — `item`/`item0`/... (see {@link
+ * pathToFoldLoopLines}'s `itemVar`) or `g0`/`g1`/... (its `groupVar`). These
+ * are exactly the bindings {@link findThreadedJoinFields} and {@link
+ * applyDrillParamBindings} thread a per-item/per-ancestor FIELD (as opposed
+ * to a whole produced value) into, which is the specific "picks the wrong
+ * source field for a given key" bug class this net closes. A top-level
+ * chain-produced var (`r0`, `token`, a response-derived `const label = ...`)
+ * is threaded by exact VALUE identity across steps, a different, already
+ * value-gated mechanism this net intentionally leaves alone — genuinely
+ * different names on either side of that kind of splice (a rotated `token`
+ * landing under an `auth` key, a `label` re-sent as a `ref`) are expected,
+ * not a bug. */
+const FOLD_SCOPED_ROOT_PATTERN = /^(?:item\d*|g\d+)\./;
+/**
+ * Derives the "own name" a spliced `${...}` accessor carries for {@link
+ * assertBodyFieldSourceNameCorrelates} to correlate against its enclosing
+ * JSON key — the last dot-separated path segment (e.g. `g0.identifiers.sku`
+ * -> `sku`, matching {@link keyNamesCorrelate}'s own source-key convention
+ * elsewhere in this file). Returns `null` for anything not rooted at a
+ * fold/drill per-item or ancestor binding (see {@link
+ * FOLD_SCOPED_ROOT_PATTERN}'s docstring for why only those are in scope) or
+ * that is otherwise legitimately name-free (see {@link
+ * NAME_FREE_ACCESSOR_PATTERN} / {@link ARRAY_INDEX_VAR_PATTERN}).
+ */
+function deriveSplicedSourceName(accessor) {
+    const trimmed = accessor.trim();
+    if (NAME_FREE_ACCESSOR_PATTERN.test(trimmed) || ARRAY_INDEX_VAR_PATTERN.test(trimmed)) {
+        return null;
+    }
+    if (!FOLD_SCOPED_ROOT_PATTERN.test(trimmed))
+        return null;
+    // A non-identifier expression (a template literal, a ternary, a function
+    // call) carries no single derivable name to correlate — only a bare
+    // dotted-path accessor is in scope for this check.
+    if (!/^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)*$/.test(trimmed))
+        return null;
+    const segments = trimmed.split(".");
+    return segments[segments.length - 1] ?? null;
+}
+/**
+ * Mechanism-agnostic, generation-time safety net closing the door on ANY
+ * fold/drill body-field/source-name correlation bug, regardless of which of
+ * this file's several independent per-item/ancestor threading passes
+ * (fold-item join fields, ancestor-scope rebinding, drill-param binding,
+ * ...) produced the offending splice — architecturally the same kind of
+ * final structural gate as {@link assertNoFrozenVaryingDrillParams}, not a
+ * fix specific to one mechanism. Walks the fully-assembled `renderedBody`
+ * for every `"<key>":${<accessor>}` pair whose accessor is rooted at a
+ * fold/drill binding (see {@link deriveSplicedSourceName}) and requires its
+ * own derived field name to plausibly name the same concept as the
+ * enclosing JSON key ({@link keyNamesCorrelate}) it was spliced under.
+ * Throws a site-agnostic description naming only the key/accessor pair
+ * (never a specific site or plugin) so a SEVENTH recurrence of this bug
+ * class, in a mechanism not yet built, fails generation loudly instead of
+ * silently shipping a body field assigned from an unrelated per-item/
+ * ancestor source field.
+ *
+ * Exported for unit testing — see `applyDrillParamBindings`/
+ * `compileActionSteps` for this file's existing precedent of exporting an
+ * otherwise-internal structural gate so it can be probed directly with a
+ * synthetic `renderedBody` string, independent of the fold-plan-detection
+ * machinery that decides which mechanism produces a given splice.
+ */
+function assertBodyFieldSourceNameCorrelates(emitterName, renderedBody) {
+    const pattern = /"([^"\\]+)"\s*:\s*"?\$\{([^{}]+)\}/g;
+    for (const match of renderedBody.matchAll(pattern)) {
+        const key = match[1];
+        const accessor = match[2];
+        const sourceName = deriveSplicedSourceName(accessor);
+        if (sourceName === null)
+            continue;
+        if (keyNamesCorrelate(sourceName, key))
+            continue;
+        throw new Error(`${emitterName}: body field "${key}" is spliced from "\${${accessor}}", whose own inferred name ("${sourceName}") doesn't correlate with "${key}" — a field must be assigned from a source whose own name plausibly names the same concept as the key it lands under, not from a value that only coincidentally matches`);
+    }
+}
 /**
  * Yields every primitive leaf (string, number, boolean, null) in the JSON
  * value with its path. Used by the body-literal substitution pass to find
@@ -3509,6 +3703,51 @@ function indexStateValues(captures, shieldedUuids = new Set(), actionCaptureIndi
 function isValidJsIdentifier(s) {
     return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(s);
 }
+/**
+ * Collapses a JSON path (e.g. `["formData", "firstName"]`) into a single flat
+ * payload field name (`formDataFirstName`). The payload schema `emitContractTs`
+ * builds is always a flat, single-level `z.object({...})` — no pass anywhere
+ * in this file constructs a nested Zod shape — so a `payload.<field>` accessor
+ * must always resolve a single top-level identifier, never a dotted/bracketed
+ * chain. This is the single place that turns a (possibly multi-segment)
+ * request-body path into that field name, so the accessor text emitted into a
+ * template and the field registered in the schema can never diverge: both
+ * always derive from this same flat name. A non-identifier segment (an array
+ * index, a key with punctuation) is sanitized via {@link fieldNameToPascalCase}
+ * rather than dropped, so every path still yields a usable field name.
+ */
+function pathToPayloadFieldName(path) {
+    return path
+        .map((segment, index) => {
+        const clean = isValidJsIdentifier(segment)
+            ? segment
+            : (fieldNameToPascalCase(segment, null) ?? `Field${index}`);
+        return index === 0 ? clean : clean.charAt(0).toUpperCase() + clean.slice(1);
+    })
+        .join("");
+}
+/**
+ * Builds the `payload.<...>` accessor and the field name to register for a
+ * request-body leaf path. Array-index segments (`["sorts", "0"]`) are NOT
+ * flattened: the array itself (`sorts`) is registered as a single field
+ * elsewhere as a whole, and the element access stays a bracket-indexed
+ * `pathToAccessor` suffix into that same field — flattening it (`sorts0`)
+ * would target a field the schema never declares. Only the object-key
+ * segments before the first array index are collapsed via
+ * {@link pathToPayloadFieldName}; segments from the first array index onward
+ * are rendered with {@link pathToAccessor} against that flat prefix.
+ */
+function payloadAccessorForPath(path) {
+    const arrayIndexPos = path.findIndex((segment) => /^\d+$/.test(segment));
+    if (arrayIndexPos === -1) {
+        const field = pathToPayloadFieldName(path);
+        return { accessor: `payload.${field}`, field };
+    }
+    const objectPath = path.slice(0, arrayIndexPos);
+    const field = objectPath.length > 0 ? pathToPayloadFieldName(objectPath) : (path[0] ?? "");
+    const suffix = pathToAccessor(path.slice(arrayIndexPos), { assertNonNull: true });
+    return { accessor: `payload.${field}${suffix}`, field };
+}
 /** Derives a valid camelCase identifier from a fixture filename (e.g.
  * "10219132.json" -> "fixture10219132", "acme-metrics.config.json" ->
  * "acmeMetricsConfig") for use in generated `loadFixture` const lines. */
@@ -3542,21 +3781,42 @@ function pathToAccessor(path, opts = { assertNonNull: true }) {
         .map((p) => isValidJsIdentifier(p) ? `.${p}` : `[${JSON.stringify(p)}]${opts.assertNonNull ? "!" : ""}`)
         .join("");
 }
+/**
+ * Builds a JS access expression reading `path` off `varName`, where `varName`
+ * is a runtime value typed `Record<string, unknown>` (an itemVar, ancestor
+ * loop var, or fold-match candidate) — NOT the real Zod-inferred payload type
+ * {@link pathToAccessor} targets. A single-segment path is a plain `.prop` /
+ * `["prop"]` access, typed `unknown` by the index signature, which compiles
+ * fine wherever the caller only interpolates or `String()`s it. But chaining
+ * a SECOND segment off that same access (`item.identifiers.sku`) fails to
+ * typecheck (TS18046 "is of type 'unknown'") because the index signature's
+ * `unknown` return doesn't itself support further property access — so every
+ * intermediate hop (all but the last segment) is re-asserted back to
+ * `Record<string, unknown>` before the next access.
+ */
+function unknownValueAccessor(varName, path) {
+    return path.reduce((expr, segment, index) => {
+        const accessor = isValidJsIdentifier(segment) ? `.${segment}` : `[${JSON.stringify(segment)}]`;
+        const isLast = index === path.length - 1;
+        return isLast ? `${expr}${accessor}` : `(${expr}${accessor} as Record<string, unknown>)`;
+    }, varName);
+}
 /**
  * Builds a nested TypeScript assertion type matching a JSON path. e.g.
- *   ["Auth","Token"] -> `{ Auth: { Token: string } }`
- *   ["Sections","SectionIds","0"] -> `{ Sections: { SectionIds: { "0": string } } }`
- * The leaf is always `string` because produces[] entries are only emitted for
- * string leaves (see compileActionSteps + walkStringLeaves). Used to keep
- * emitted code free of `any` casts while still letting nested-path access
- * compile against `Record<string, unknown>`-typed response variables.
- */
-function pathToAssertionType(path) {
+ *   ["Auth","Token"], "string" -> `{ Auth: { Token: string } }`
+ *   ["Sections","Complete","0"], "boolean" -> `{ Sections: { Complete: { "0": boolean } } }`
+ * The leaf type is the produce's actual captured {@link BodyProduce.leafType}
+ * (string/number/boolean), so this always agrees with the same field's
+ * schema-inferred Zod type from {@link inferZodSchemaFromSamples}. Used to
+ * keep emitted code free of `any` casts while still letting nested-path
+ * access compile against `Record<string, unknown>`-typed response variables.
+ */
+function pathToAssertionType(path, leafType) {
     if (path.length === 0)
-        return "string";
+        return leafType;
     const segment = path[0];
     const key = isValidJsIdentifier(segment) ? segment : JSON.stringify(segment);
-    return `{ ${key}: ${pathToAssertionType(path.slice(1))} }`;
+    return `{ ${key}: ${pathToAssertionType(path.slice(1), leafType)} }`;
 }
 /**
  * Same nesting as {@link pathToAssertionType} but the leaf types as
@@ -3699,6 +3959,7 @@ function compileActionSteps(actions, stateIndex) {
     // so we only "produce" the values that are actually consumed downstream.
     for (const { capture } of actions) {
         const bodyLeafValues = jsonBodyLeafValues(capture.requestPostData);
+        const bodyLeafValuesByKey = jsonBodyLeafValuesByKey(capture.requestPostData);
         for (const sv of stateIndex.values()) {
             // A short value indexed only via the chain/force-include exemption
             // (see `StateValue.eligibleConsumers`) is a real dependency ONLY for
@@ -3726,10 +3987,26 @@ function compileActionSteps(actions, stateIndex) {
             if (bodyLeafValues === null) {
                 if (capture.requestPostData?.includes(sv.value))
                     usedValues.add(sv.value);
+                continue;
             }
-            else if (bodyLeafValues.some((leaf) => leaf.includes(sv.value))) {
+            // A produced value's SOURCE key name (the last segment of its response
+            // JSON path) must correlate with the TARGET field it's found under —
+            // same discipline `collectDependentDrillDownChainValues` already
+            // applies to the short-value length-floor exemption (sameNameMatch),
+            // now the universal gate rather than only that narrower one. A
+            // name-free source (a bare array index, or a header/cookie origin with
+            // no body accessor at all) is exempted, exactly as arrayIndexMatch
+            // exempts a name-free source there — there's no name to correlate.
+            const sourceKeyName = sv.headerOrigin ? undefined : sv.path.at(-1);
+            const sourceIsNameFree = sv.headerOrigin !== undefined ||
+                sourceKeyName === undefined ||
+                ARRAY_INDEX_KEY_PATTERN.test(sourceKeyName);
+            const matches = sourceIsNameFree
+                ? bodyLeafValues.some((leaf) => leaf.includes(sv.value))
+                : [...(bodyLeafValuesByKey?.entries() ?? [])].some(([targetKey, leaves]) => keyNamesCorrelate(sourceKeyName, targetKey) &&
+                    [...leaves].some((leaf) => leaf.includes(sv.value)));
+            if (matches)
                 usedValues.add(sv.value);
-            }
         }
         for (const [headerName, headerValue] of Object.entries(capture.requestHeaders)) {
             for (const sv of stateIndex.values()) {
@@ -3836,7 +4113,18 @@ function compileActionSteps(actions, stateIndex) {
                     name = `${pathToVarName(path)}${suffix}`;
                 }
                 seenNames.add(name);
-                produces.push({ kind: "body", name, path, eligibleConsumers: sv.eligibleConsumers });
+                const leafType = typeof rawValue === "number"
+                    ? "number"
+                    : typeof rawValue === "boolean"
+                        ? "boolean"
+                        : "string";
+                produces.push({
+                    kind: "body",
+                    name,
+                    path,
+                    leafType,
+                    eligibleConsumers: sv.eligibleConsumers,
+                });
             }
         }
         const ct = Object.entries(capture.requestHeaders).find(([k]) => k.toLowerCase() === "content-type");
@@ -3921,6 +4209,60 @@ function resolveResponsePathValue(responseBody, path) {
 function buildValueAlternationPattern(sortedValues) {
     return new RegExp(`(?<![A-Za-z0-9][-.])\\b(?:${sortedValues.map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b(?![-.][A-Za-z0-9])`, "g");
 }
+/** Normalizes a JSON key or a produced var name to a bare comparable token —
+ * lowercased, non-alphanumeric stripped, trailing disambiguation digits
+ * (the `seenNames`-collision suffix `compileActionSteps` appends, e.g.
+ * `displayOrder2`) dropped — so `sortOrder` and `SortOrder`/`sort_order`/
+ * `sortOrder2` all normalize to the same token for {@link keysCorrelate}. */
+function normalizeCorrelationToken(raw) {
+    return raw
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, "")
+        .replace(/\d+$/, "");
+}
+/**
+ * True when `sourceName` (a produced state var's own field name, e.g. the
+ * `p.name` a produce was declared under) plausibly names the same coordinate
+ * as `targetKey` (the JSON key a candidate splice would land under). Used to
+ * gate {@link interpolateStateValues}'s substitution of a value that was only
+ * indexed via the chain/force-include short-value exemption (see
+ * `StateValue.eligibleConsumers`) — such a value cleared the ELIGIBILITY gate
+ * via a name-free signal (a bare array index, a URL path segment), which says
+ * nothing about whether the specific body key it's about to be spliced into
+ * has anything to do with its own origin field. Requiring exact-token or
+ * meaningful-substring correlation here is the second, independent check the
+ * report calls for: an eligible value must still name/shape-correlate with
+ * its actual splice target, not just have cleared chain detection for SOME
+ * key in the target capture.
+ */
+function keysCorrelate(sourceName, targetKey) {
+    const a = normalizeCorrelationToken(sourceName);
+    const b = normalizeCorrelationToken(targetKey);
+    if (a.length === 0 || b.length === 0)
+        return false;
+    if (a === b)
+        return true;
+    const [shorter, longer] = a.length <= b.length ? [a, b] : [b, a];
+    return shorter.length >= 3 && longer.includes(shorter);
+}
+/** Finds the JSON key immediately governing the value at `matchStart` in a
+ * (possibly partially-rewritten) JSON body template — the nearest preceding
+ * `"key":` slot opener. Textual, not AST-based (matching this file's existing
+ * `.split(target).join(replacement)` discipline elsewhere), which is
+ * sufficient here: it only needs to identify the enclosing leaf's own key for
+ * {@link keysCorrelate}'s name check, not to fully parse the document. */
+function findEnclosingJsonKey(text, matchStart) {
+    const keyPattern = /"([^"\\]+)"\s*:\s*"?/g;
+    let lastKey = null;
+    let lastValueStart = -1;
+    for (const m of text.matchAll(keyPattern)) {
+        if (m.index === undefined || m.index >= matchStart)
+            break;
+        lastKey = m[1] ?? null;
+        lastValueStart = m.index + m[0].length;
+    }
+    return lastValueStart <= matchStart ? lastKey : null;
+}
 /**
  * Finds every `${...}` span in `text` by brace-depth counting rather than a
  * non-nesting regex, so an ALREADY-nested placeholder (e.g. one produced by an
@@ -3972,17 +4314,55 @@ function findBalancedPlaceholderSpans(text) {
  * actually owns that span, which is the producer/consumer relationship this
  * mechanism is supposed to encode — and guarantees the output can never open
  * a `${` before a prior `${...}` closes.
- */
-function replaceGuardedAgainstExistingPlaceholders(text, pattern, bindingByValue) {
+ *
+ * `keyCorrelationGuard`, when supplied, additionally requires a JSON-key
+ * name/shape correlation before splicing a value flagged `restrictedValues`
+ * — see {@link keysCorrelate}'s docstring for why: such a value cleared
+ * ELIGIBILITY via a name-free chain signal (a bare array index, a URL path
+ * segment) that says nothing about the specific key it's about to land
+ * under. A match on a value not in `restrictedValues` (an unrestricted
+ * payload accessor or a normally-length-qualified state value) is spliced
+ * exactly as before — this guard only closes the coincidence-threading gap
+ * for values that needed the short-value exemption to be indexed at all.
+ */
+function replaceGuardedAgainstExistingPlaceholders(text, pattern, bindingByValue, keyCorrelationGuard) {
     const protectedSpans = findBalancedPlaceholderSpans(text);
+    const matches = [...text.matchAll(pattern)].filter((match) => !protectedSpans.some(([spanStart, spanEnd]) => match.index < spanEnd && match.index + match[0].length > spanStart));
+    const hasCorrelatedTargetByValue = new Map();
+    if (keyCorrelationGuard) {
+        for (const match of matches) {
+            const value = match[0];
+            if (!keyCorrelationGuard.restrictedValues.has(value))
+                continue;
+            if (keyCorrelationGuard.unconditionalValues.has(value))
+                continue;
+            if (hasCorrelatedTargetByValue.get(value))
+                continue;
+            const sourceName = keyCorrelationGuard.sourceNameByValue.get(value);
+            const targetKey = findEnclosingJsonKey(text, match.index);
+            if (sourceName !== undefined && targetKey !== null && keysCorrelate(sourceName, targetKey)) {
+                hasCorrelatedTargetByValue.set(value, true);
+            }
+        }
+    }
     let result = "";
     let cursor = 0;
-    for (const match of text.matchAll(pattern)) {
+    for (const match of matches) {
         const start = match.index;
         const end = start + match[0].length;
-        if (protectedSpans.some(([spanStart, spanEnd]) => start < spanEnd && end > spanStart))
-            continue;
-        result += text.slice(cursor, start) + (bindingByValue.get(match[0]) ?? match[0]);
+        const value = match[0];
+        const isGated = keyCorrelationGuard?.restrictedValues.has(value) &&
+            (keyCorrelationGuard.unconditionalValues.has(value) || hasCorrelatedTargetByValue.get(value));
+        if (isGated) {
+            const sourceName = keyCorrelationGuard?.sourceNameByValue.get(value);
+            const targetKey = findEnclosingJsonKey(text, start);
+            if (sourceName === undefined || targetKey === null || !keysCorrelate(sourceName, targetKey)) {
+                result += text.slice(cursor, end);
+                cursor = end;
+                continue;
+            }
+        }
+        result += text.slice(cursor, start) + (bindingByValue.get(value) ?? value);
         cursor = end;
     }
     return result + text.slice(cursor);
@@ -4001,21 +4381,74 @@ function replaceGuardedAgainstExistingPlaceholders(text, pattern, bindingByValue
  * for the anchoring guarantee and {@link replaceGuardedAgainstExistingPlaceholders}
  * for why a match overlapping an already-emitted `${...}` is skipped rather
  * than spliced into.
- */
-function interpolateStateValues(template, priorSteps, targetCapture, payloadAccessorByValue = new Map()) {
-    const varNameByValue = deriveStateVarByValue(priorSteps, targetCapture);
+ *
+ * `isJsonBody` gates the additional {@link keysCorrelate} check
+ * `replaceGuardedAgainstExistingPlaceholders` applies to `restricted` state
+ * bindings (see {@link StateVarBinding}) — a value indexed only via the
+ * chain/force-include short-value exemption must also name/shape-correlate
+ * with the JSON key it's about to be spliced into, not merely have cleared
+ * eligibility for SOME key in this capture. Only a JSON request body has
+ * "keys" to correlate against; a URL or a raw header value has none, and a
+ * bare-value splice into either is exactly the name-free URL-path-segment
+ * threading the eligibility gate already intends to allow, so callers
+ * rendering those pass `false` (the default).
+ *
+ * A value already bound to a `payload.<field>` accessor keeps that accessor
+ * on EVERY call EXCEPT the value's own producing step, where
+ * {@link deriveProducerBoundaryBindings} has deliberately scoped a binding to
+ * THAT step (`producerIndex === stepIndex`, threaded in as `stepIndex` below):
+ * the producer cannot thread its own not-yet-existent response, so its own
+ * request body needs the ordinary produced-value handling elsewhere (see
+ * {@link applyWholeValuePayloadSubstitutions}'s docstring) rather than a second,
+ * redundant payload bind here. Every OTHER step — including every step AFTER
+ * the producer that re-sends the same coordinate — keeps payload precedence:
+ * a value legitimately sourced from `payload.<field>` on one call must resolve
+ * to that same accessor on every call that re-sends it, never fall back to the
+ * coincidentally-equal scraped `${var}` just because the value also happens to
+ * qualify as a producer-boundary coordinate. A value with no producer-boundary
+ * binding at all is a coincidental echo — never re-sent by the step whose
+ * response produced it — so payload precedence is unconditional for it.
+ *
+ * `topLevelPayloadKvValues` extends that same precedence to values too SHORT
+ * to ever enter `payloadAccessorByValue` (which only registers inputBody
+ * string leaves >= MIN_STATE_VALUE_LENGTH): a short top-level scalar
+ * (`{"currency":"usd"}`) is still unconditionally payload-ified by the later
+ * `applyPayloadKeyValueSubstitutions` key/value pass, but only if its literal
+ * survives THIS pass untouched. Without this set, a short value that also
+ * clears the chain/force-include exemption as a coincidentally-equal
+ * response-produced state var on an intervening call gets spliced here
+ * first, and the literal is gone by the time the KV pass runs — masking
+ * payload precedence on every call after the one that scraped it.
+ */
+function interpolateStateValues(template, priorSteps, targetCapture, payloadAccessorByValue = new Map(), isJsonBody = false, producerBoundaryBindings = new Map(), stepIndex = -1, topLevelPayloadKvValues = new Set()) {
+    const stateBindings = deriveStateVarByValue(priorSteps, targetCapture);
     const bindingByValue = new Map();
     for (const [value, accessor] of payloadAccessorByValue) {
         bindingByValue.set(value, `\${${accessor}}`);
     }
-    for (const [value, varName] of varNameByValue) {
-        bindingByValue.set(value, `\${${varName}}`);
+    const restrictedValues = new Set();
+    const unconditionalValues = new Set();
+    const sourceNameByValue = new Map();
+    for (const [value, binding] of stateBindings) {
+        const isProducerStep = producerBoundaryBindings.get(value)?.producerIndex === stepIndex;
+        if (payloadAccessorByValue.has(value) && !isProducerStep)
+            continue;
+        if (topLevelPayloadKvValues.has(value) && !isProducerStep)
+            continue;
+        bindingByValue.set(value, `\${${binding.varName}}`);
+        sourceNameByValue.set(value, binding.sourceName);
+        if (binding.restricted)
+            restrictedValues.add(value);
+        if (binding.unconditional)
+            unconditionalValues.add(value);
     }
     if (bindingByValue.size === 0)
         return template;
     const sortedValues = [...bindingByValue.keys()].sort((a, b) => b.length - a.length);
     const pattern = buildValueAlternationPattern(sortedValues);
-    return replaceGuardedAgainstExistingPlaceholders(template, pattern, bindingByValue);
+    return replaceGuardedAgainstExistingPlaceholders(template, pattern, bindingByValue, isJsonBody && restrictedValues.size > 0
+        ? { restrictedValues, sourceNameByValue, unconditionalValues }
+        : undefined);
 }
 /**
  * Rewrites every occurrence of a set of literal values to their accessor
@@ -4180,11 +4613,14 @@ function deriveProducerBoundaryBindings(actions, alreadyBound) {
  * the exact `"<key>":` slot, so it only fires on a value's own JSON slot.
  *
  * `producerScoped` bindings fire only on their producing step
- * (`producerIndex === stepIndex`): a later step re-sending the same coordinate
- * threads the produced state var, the established behavior; only the producer,
- * which cannot thread its own not-yet-existent response, needs the payload bind.
- * `entryUrlBindings` (a caller coordinate lifted from the entry URL) fire on
- * EVERY step — they are the caller's data on every request, never a produced var.
+ * (`producerIndex === stepIndex`): only the producer, which cannot thread its
+ * own not-yet-existent response, needs this whole-value bind. A later step
+ * re-sending the same coordinate still resolves to `payload.<field>` — via
+ * {@link interpolateStateValues}'s own producer-scoped exemption, which lets
+ * the produced state var win ONLY on the producing step itself — never via a
+ * second whole-value bind here. `entryUrlBindings` (a caller coordinate lifted
+ * from the entry URL) fire on EVERY step — they are the caller's data on every
+ * request, never a produced var.
  */
 function applyWholeValuePayloadSubstitutions(template, parsedBody, producerScoped, entryUrlBindings, stepIndex) {
     if (producerScoped.size === 0 && entryUrlBindings.size === 0)
@@ -4210,23 +4646,6 @@ function applyWholeValuePayloadSubstitutions(template, parsedBody, producerScope
  * before giving up. Real captures observed a doubly-encoded value (`%2520`); the
  * extra headroom costs one cheap `decodeURIComponent` per level and stops runaway. */
 const MAX_URL_PARAM_DECODE_DEPTH = 3;
-/**
- * Maps each response-produced value to the `${var}` name later steps thread it as.
- * Shared by {@link interpolateStateValues} (the body/URL substitution) and the
- * URL-param pass, so a threaded coordinate (e.g. a jobId a prior step produced)
- * resolves to the same var in both — one source of truth, they can never diverge.
- *
- * Header/cookie-origin produces are skipped: they have no body path and their
- * value never appears as a literal in a URL/body template (http-client's `bind`
- * forwards it directly as a request header), so there is nothing to interpolate.
- *
- * `targetCapture` is the capture the returned bindings are about to be spliced
- * INTO. A produce whose value is chain/force-include-exempt (see
- * `BodyProduce.eligibleConsumers`) is a real dependency only for the specific
- * capture(s) the chain detector proved it threads into — everywhere else, a
- * coincidental substring match must not bind, or `interpolateStateValues`
- * splices it into an unrelated capture's URL/body/headers.
- */
 function deriveStateVarByValue(priorSteps, targetCapture) {
     const varNameByValue = new Map();
     for (const step of priorSteps) {
@@ -4236,8 +4655,34 @@ function deriveStateVarByValue(priorSteps, targetCapture) {
             if (p.eligibleConsumers && !p.eligibleConsumers.has(targetCapture))
                 continue;
             const value = resolveResponsePathValue(step.capture.responseBody, p.path);
-            if (value !== null)
-                varNameByValue.set(value, p.name);
+            if (value !== null) {
+                // A source path with NO identifier segment anywhere (every segment a
+                // bare array index — e.g. a top-level array response `[42]`, path
+                // `["0"]`) has no name of its own to correlate against at all; that's
+                // the genuinely name-free case `collectDependentDrillDownChainValues`'s
+                // arrayIndexMatch exists for (see its docstring), not a named field
+                // that merely sits inside an array. Only a source WITH a real
+                // ancestor name (e.g. `flags` in `["flags","0"]`) must correlate —
+                // its name existing at all is exactly the signal a target key
+                // coincidence has to match to be a genuine splice, not a bare
+                // array-index/path-segment eligibility coincidence.
+                const sourceHasName = p.path.some((segment) => isValidJsIdentifier(segment));
+                varNameByValue.set(value, {
+                    varName: p.name,
+                    sourceName: p.name,
+                    // Requiring name/shape correlation at the splice site is not just
+                    // for the chain/force-include short-value exemption — a
+                    // naturally-length-qualified value that legitimately correlates
+                    // with ONE downstream key (which is what got it produced at all,
+                    // see `compileActionSteps`' `keyNamesCorrelate` pre-scan) must not
+                    // also splice into an unrelated, differently-named key that merely
+                    // coincides in value. `sourceHasName` gates this the same way it
+                    // gates the chain-derived case: a name-free source (a bare array
+                    // index) has nothing to correlate, so it stays unrestricted.
+                    restricted: sourceHasName,
+                    unconditional: p.eligibleConsumers !== undefined && sourceHasName,
+                });
+            }
         }
     }
     return varNameByValue;
@@ -4360,21 +4805,22 @@ function applyUrlParamPayloadSubstitutions(template, parsedBody, bindings) {
  * top-level keys also become caller-supplied payload fields. Used in Phase F
  * to parameterize fields like SourceCode that appear in r1's body but not
  * r0's (inputBody).
+ *
+ * Registration is keyed per (key, value) pair, not per key alone: a field
+ * name reused across two-plus steps with a DIFFERENT literal value on each
+ * occurrence must have EVERY one of its own occurrences registered and
+ * substituted, not just whichever occurrence this function's own body-array
+ * walk reaches first. A first-seen-value-wins table would only ever match
+ * (and thus only ever register) the ONE step whose literal happens to equal
+ * that first-seen value — every other step's own `"key":<its own value>`
+ * text would silently never become a `${payload.key}` reference at all here,
+ * even though the field genuinely IS one this step's own request sends as
+ * caller-supplied data.
  */
 function applyPayloadKeyValueSubstitutions(template, inputBody, additionalBodies = [], outAdditionalKeys = new Map()) {
     const merged = [];
-    const seenKeys = new Set();
-    // Track keys from inputBody (r0) separately so we know which ones are NEW.
-    // Only NEW keys need to be added to discovered-form-fields — inputBody's
-    // own keys stay internal to the site request template, not the public
-    // payload schema (see basePayloadSchemaExpr in emitContractTs).
-    if (inputBody !== null && typeof inputBody === "object" && !Array.isArray(inputBody)) {
-        for (const { path } of walkAllPrimitiveLeaves(inputBody)) {
-            if (path.length === 1)
-                seenKeys.add(path[0]);
-        }
-    }
-    const inputBodyKeys = new Set(seenKeys);
+    const seenPairs = new Set();
+    const seenValueByKey = new Map();
     const allBodies = [inputBody, ...additionalBodies];
     for (const body of allBodies) {
         if (body === undefined || body === null || typeof body !== "object" || Array.isArray(body)) {
@@ -4386,26 +4832,45 @@ function applyPayloadKeyValueSubstitutions(template, inputBody, additionalBodies
             const key = path[0];
             if (!isValidJsIdentifier(key))
                 continue;
-            if (seenKeys.has(key) && body !== inputBody)
+            if (value === null)
                 continue;
-            // For inputBody first pass: don't dedupe (we need all values).
-            if (body === inputBody && !inputBodyKeys.has(key))
+            // Dedupe identical (key, value) pairs only — a repeated occurrence of
+            // the SAME literal value for a key across bodies needs no second
+            // substitution pass, but a DIFFERENT value under the same key is its
+            // own distinct step's own occurrence and must still get one. EXCEPT a
+            // pagination-cursor-shaped key ({@link PAGINATION_FIELD_NAME_PATTERN},
+            // e.g. `page`/`offset`/`cursor`) whose value differs from the
+            // first-seen one: that shape is a same-endpoint re-query bump (see
+            // {@link isRedundantSameEndpointGroup}'s pagination-vs-payload
+            // distinction), not a genuinely different step's own caller data —
+            // aliasing both occurrences to the SAME `payload.<key>` accessor would
+            // make the generated re-query call replay the FIRST page's request
+            // instead of advancing to the next one, so the later occurrence stays
+            // an unsubstituted literal, matching this key's pre-fix behavior.
+            const priorValue = seenValueByKey.get(key);
+            if (priorValue !== undefined &&
+                priorValue !== value &&
+                PAGINATION_FIELD_NAME_PATTERN.test(key)) {
                 continue;
-            seenKeys.add(key);
-            if (value === null)
+            }
+            seenValueByKey.set(key, value);
+            const pairKey = `${key} ${typeof value} ${value}`;
+            if (seenPairs.has(pairKey))
                 continue;
+            seenPairs.add(pairKey);
             merged.push([key, value]);
-            // Record only the NEW keys (not in inputBody) so the contract emitter
-            // can add them to the payload schema — inputBody's own keys stay
-            // internal to the site request template (see basePayloadSchemaExpr).
-            if (!inputBodyKeys.has(key)) {
-                if (typeof value === "string")
-                    outAdditionalKeys.set(key, "string");
-                else if (typeof value === "number")
-                    outAdditionalKeys.set(key, "number");
-                else if (typeof value === "boolean")
-                    outAdditionalKeys.set(key, "boolean");
-            }
+            // Record every substituted key, including inputBody's own, so the
+            // contract emitter can add it to the payload schema. inputBody keys
+            // that ARE covered by basePayloadSchemaExpr (the ApplicantContactSchema
+            // case) are filtered back out at the emitContractTs merge point via
+            // isReservedByApplicantContactSchema — this function has no visibility
+            // into that flag, so it must not special-case inputBody's own keys.
+            if (typeof value === "string")
+                outAdditionalKeys.set(key, "string");
+            else if (typeof value === "number")
+                outAdditionalKeys.set(key, "number");
+            else if (typeof value === "boolean")
+                outAdditionalKeys.set(key, "boolean");
         }
     }
     let result = template;
@@ -4601,11 +5066,17 @@ function emitFoldMatchAndMergeLines(terminalStep, target, itemVar, suffix, joinA
         // then fall back to the bare last segment.
         const lastSegment = segments[segments.length - 1];
         const bracket = (segment) => optionalRoot ? `?.[${JSON.stringify(segment)}]` : `[${JSON.stringify(segment)}]`;
-        const optionalBracketAccessor = segments
-            .map((segment) => `?.[${JSON.stringify(segment)}]`)
-            .join("");
+        // Every intermediate hop off the (unknown-typed) candidate needs
+        // re-asserting back to `Record<string, unknown>` before the next bracket
+        // access — see {@link unknownValueAccessor}'s doc for why a bare chain of
+        // `?.[...]` accessors fails to typecheck past the first segment.
+        const nestedAccessor = segments.reduce((expr, segment, index) => {
+            const isLast = index === segments.length - 1;
+            const accessor = index === 0 ? bracket(segment) : `?.[${JSON.stringify(segment)}]`;
+            return isLast ? `${expr}${accessor}` : `(${expr}${accessor} as Record<string, unknown>)`;
+        }, varName);
         return segments.length > 1
-            ? `(${varName}${optionalBracketAccessor} ?? ${varName}${bracket(lastSegment)})`
+            ? `(${nestedAccessor} ?? ${varName}${bracket(lastSegment)})`
             : `${varName}${bracket(lastSegment)}`;
     };
     const joinCondition = target.joinFields
@@ -4628,7 +5099,18 @@ function emitFoldMatchAndMergeLines(terminalStep, target, itemVar, suffix, joinA
 }
 /** Exported for unit testing — lets tests drive the multipart-upload code path directly
  * without going through the full emitContractTs pipeline. */
-function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap, outDiscoveredFields, fieldOptionsMap, outDiscoveredOptionFields, outDiscoveredRawOptionFields, outDiscoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema = null, personaBindings = new Map(), entryUrlParams = new Map(), shieldedUuids = new Set(), selectResolutions = [], outStructuredKeys = new Map(), rawCodeFields = new Map(), foldReturnSpec = null) {
+function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap, outDiscoveredFields, fieldOptionsMap, outDiscoveredOptionFields, outDiscoveredRawOptionFields, outDiscoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema = null, personaBindings = new Map(), entryUrlParams = new Map(), shieldedUuids = new Set(), selectResolutions = [], outStructuredKeys = new Map(), rawCodeFields = new Map(), foldReturnSpec = null, 
+/**
+ * PascalCase plugin name used to cast the final `return { data: ... }`
+ * back to `${pascalName}Response` — every intermediate `httpClient` call
+ * this function emits is bound `as Record<string, unknown>` so per-item
+ * fold/merge code can probe arbitrary fields, but that cast otherwise
+ * widens the returned primary var past the richer response type the
+ * caller's own schema inference already promised, which fails to
+ * typecheck. `null` (the test-facing default) skips the cast, preserving
+ * prior output for callers that don't exercise the full pipeline.
+ */
+pascalName = null) {
     // Walk the first action's request body to map each leaf string value to its
     // `payload.<accessor>` expression. The emit's second interpolation pass uses
     // this to substitute literal occurrences (e.g. "Reginald") with their
@@ -4646,8 +5128,10 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         for (const { value, path } of walkStringLeaves(inputBody)) {
             if (value.length < MIN_STATE_VALUE_LENGTH)
                 continue;
-            const accessor = `payload${pathToAccessor(path)}`;
+            const { accessor, field: accessorField } = payloadAccessorForPath(path);
             payloadAccessorByValue.set(value, accessor);
+            if (isValidJsIdentifier(accessorField))
+                outDiscoveredFields.add(accessorField);
             // Phase F: register a lowercase variant for UUID-shaped values so case-
             // variant URL path segments (e.g. r9 echoes the requisition UUID in
             // lowercase even though r0's body had it uppercase) still get
@@ -4770,6 +5254,32 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             // skip non-JSON bodies (e.g. multipart raw bytes)
         }
     }
+    // Every value `applyPayloadKeyValueSubstitutions` will unconditionally
+    // payload-ify from the ENTRY payload's own top-level key/value pairs,
+    // gathered here so {@link interpolateStateValues} can give it payload
+    // precedence too, regardless of MIN_STATE_VALUE_LENGTH — see
+    // {@link interpolateStateValues}'s `topLevelPayloadKvValues` docstring for
+    // why this must run BEFORE that later pass, not just alongside it.
+    // `inputBody` only, deliberately NOT `additionalBodies`: a later call's own
+    // top-level field is exactly as likely to be a genuinely re-sent
+    // response-produced state value (draftId minted by an earlier call and
+    // resent as that later call's own `applicationDraftId`) as a caller-
+    // supplied literal, so extending precedence to it would wrongly freeze
+    // real cross-step state threading. Only the caller's OWN entry payload is
+    // an unambiguous non-state origin.
+    const topLevelPayloadKvValues = new Set();
+    if (inputBody !== undefined && inputBody !== null && !Array.isArray(inputBody)) {
+        for (const { value, path } of walkAllPrimitiveLeaves(inputBody)) {
+            if (path.length !== 1)
+                continue;
+            const key = path[0];
+            if (!isValidJsIdentifier(key))
+                continue;
+            if (value === null)
+                continue;
+            topLevelPayloadKvValues.add(String(value));
+        }
+    }
     // Detect the flow's THREADED transaction id: a single UUID the site mints
     // once (on page load) and reuses across every submit body to correlate the
     // multi-step wizard — observed on real ATS flows where one such id spans
@@ -4877,7 +5387,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         // length/chain-eligibility scoping doesn't happen to catch the coincidence.
         const url = (0, capture_filters_1.isZeroVarianceRepeatCapture)(cap, actions.map((a) => a.capture))
             ? cap.url
-            : interpolateStateValues(cap.url, prior, cap, payloadAccessorByValue);
+            : interpolateStateValues(cap.url, prior, cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
         // Form-schema substitution runs first on the raw recon body so its
         // field-id-anchored matches see the original JSON. State-threading and
         // payload key-value passes then run on top. Option-id substitution runs
@@ -4940,14 +5450,14 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             if (binding.producerIndex === i)
                 urlParamBindings.set(value, binding.accessor);
         }
-        for (const [value, varName] of deriveStateVarByValue(prior, cap)) {
-            urlParamBindings.set(value, varName);
+        for (const [value, binding] of deriveStateVarByValue(prior, cap)) {
+            urlParamBindings.set(value, binding.varName);
         }
         const rawBodyWithUrlParams = parsedBody !== null
             ? applyUrlParamPayloadSubstitutions(rawBodyWithProducerBoundary, parsedBody, urlParamBindings)
             : rawBodyWithProducerBoundary;
         const bodyAfterStateAndKv = rawBodyWithUrlParams
-            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, cap, payloadAccessorByValue), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
+            ? applyPayloadKeyValueSubstitutions(interpolateStateValues(rawBodyWithUrlParams, prior, cap, payloadAccessorByValue, true, producerBoundaryBindings, i, topLevelPayloadKvValues), inputBody, additionalBodies, outDiscoveredAdditionalBodyKeys)
             : "";
         // Mechanism A — generic (plain-JSON, wire-key-anchored) dropdown label→code
         // rewrite. Runs AFTER interpolateStateValues + the payload-KV pass, not
@@ -4975,8 +5485,22 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         const perCallHeaders = {};
         for (const [k, v] of Object.entries(cap.requestHeaders)) {
             const lower = k.toLowerCase();
-            if (lower === "api-token" || lower === "authorization" || joinCarryingHeaderNames?.has(k)) {
-                perCallHeaders[k] = interpolateStateValues(v, prior, cap, payloadAccessorByValue);
+            const interpolated = interpolateStateValues(v, prior, cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
+            // Authorization/Api-Token and a structurally-detected join-carrying
+            // header are always emitted per-call (even when interpolation finds
+            // nothing to thread, matching this gate's prior behavior exactly).
+            // Any OTHER header name also gets a per-call entry once interpolation
+            // actually recognizes its value as a prior step's produced state var
+            // — interpolateStateValues itself is the source of truth for whether
+            // a value is genuinely threadable; restricting that recognition to a
+            // closed set of header names left every other header name frozen as
+            // a literal BASE_HEADERS entry (or dropped per-call) even when its
+            // captured value was a real, already-produced response field.
+            if (lower === "api-token" ||
+                lower === "authorization" ||
+                joinCarryingHeaderNames?.has(k) ||
+                interpolated !== v) {
+                perCallHeaders[k] = interpolated;
             }
         }
         // G1: emit baseUrl-derived headers (Origin, Referer) per-call from
@@ -5178,7 +5702,14 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                 // colliding on `foldMatches`/`foldMatch`. The overwhelmingly common
                 // single-target case keeps the original unsuffixed names.
                 const suffix = foldPlan.targets.length > 1 ? `${planSuffix}${targetIndex}` : planSuffix;
-                const scopedAccessor = (varName, field) => `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
+                // Only `itemVar` (and fold-match candidates) are `Record<string,
+                // unknown>`-typed — ancestor loop vars keep the real response-derived
+                // type, so re-asserting THEIR intermediate hops would be both
+                // unnecessary and, worse, would replace a real property access with
+                // an opaque cast in the emitted URL/body text.
+                const scopedAccessor = (varName, field) => varName === itemVar
+                    ? unknownValueAccessor(varName, field.split("."))
+                    : `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
                 const joinAccessor = (field) => scopedAccessor(itemVar, field);
                 // Computed once per fold target instead of once per `parameterize`
                 // call: `actions` never changes across the url/headers/body calls a
@@ -5370,7 +5901,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
                         if (!referencedNames.has(p.name))
                             continue;
                         chainDeclared.add(p.name);
-                        const assertion = pathToAssertionType(p.path);
+                        const assertion = pathToAssertionType(p.path, p.leafType);
                         chainLines.push(`      const ${p.name} = (${chainStep.varName} as ${assertion})${pathToAccessor(p.path, { assertNonNull: false })};`);
                     }
                 }
@@ -5412,7 +5943,7 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             if (!referencedNames.has(p.name))
                 continue;
             declaredNames.add(p.name);
-            const assertion = pathToAssertionType(p.path);
+            const assertion = pathToAssertionType(p.path, p.leafType);
             produceLines.push(`    const ${p.name} = (${step.varName} as ${assertion})${pathToAccessor(p.path, { assertNonNull: false })};`);
         }
         const bindResponse = referencedNames.has(step.varName) || produceLines.length > 0;
@@ -5439,8 +5970,14 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
             const perCallHeaderEntries = [];
             for (const [k, v] of Object.entries(cap.requestHeaders)) {
                 const lower = k.toLowerCase();
-                if (lower === "api-token" || lower === "authorization") {
-                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`${interpolateStateValues(v, actions.slice(0, i), cap, payloadAccessorByValue)}\``);
+                const interpolated = interpolateStateValues(v, actions.slice(0, i), cap, payloadAccessorByValue, false, producerBoundaryBindings, i);
+                // Mirrors the non-multipart per-call header builder above: any
+                // header name (not just Authorization/Api-Token) that interpolation
+                // recognizes as a prior step's produced state var must thread
+                // per-call too, or its custom name freezes into an invariant
+                // BASE_HEADERS-equivalent literal.
+                if (lower === "api-token" || lower === "authorization" || interpolated !== v) {
+                    perCallHeaderEntries.push(`${JSON.stringify(k)}: \`${interpolated}\``);
                 }
             }
             // G1+G2: include tenant-derived headers in the multipart fetch too.
@@ -5527,16 +6064,27 @@ function emitMultiStepExecuteHttp(actions, inputBody, errorSignals, fieldNameMap
         ...new Set(foldPlans.map((plan) => actions[plan.primaryStepIndex].varName)),
     ];
     const everyPrimaryIsPlainObject = foldPlans.every((plan) => isPlainObject(actions[plan.primaryStepIndex].capture.responseBody));
+    // Every intermediate `httpClient` call above is bound `as Record<string,
+    // unknown>` regardless of its own `schema:`, so per-item fold/merge code
+    // can probe arbitrary fields without a per-step assertion type. That
+    // widened intermediate type doesn't match `${pascalName}Response` — the
+    // richer type schema inference already promised for THIS returned value —
+    // so the return itself needs its own assertion back to that promised
+    // type; `Record<string, unknown>` and the real inferred object type share
+    // no ancestry TS can see, so a plain `as` needs the `as unknown as` detour.
+    const castToResponseType = (expr) => pascalName ? `${expr} as unknown as ${pascalName}Response` : expr;
     if (uniquePrimaryVarNames.length > 1 && everyPrimaryIsPlainObject) {
-        lines.push(`    return { data: mergeFoldedPrimaryBodies(${uniquePrimaryVarNames.join(", ")}) };`);
+        lines.push(`    return { data: ${castToResponseType(`mergeFoldedPrimaryBodies(${uniquePrimaryVarNames.join(", ")})`)} };`);
     }
     else {
         const returnVar = lastFoldPlan
             ? actions[lastFoldPlan.primaryStepIndex].varName
             : (returnAction?.varName ?? "undefined");
-        lines.push(`    return { data: ${returnVar} };`);
+        lines.push(`    return { data: ${castToResponseType(returnVar)} };`);
     }
-    return lines.join("\n");
+    const renderedMultiStepBody = lines.join("\n");
+    assertBodyFieldSourceNameCorrelates("emitMultiStepExecuteHttp", renderedMultiStepBody);
+    return renderedMultiStepBody;
 }
 function summariseResponseShape(value) {
     if (value === null || typeof value !== "object")
@@ -5897,13 +6445,96 @@ function findObjectArrayFieldOrWholeObject(value, path = []) {
  * other capture of this endpoint exists in `allCaptures`, variance can't be
  * observed either way, so every value is kept (unfiltered, matching the
  * behavior when `allCaptures` is omitted). */
-function collectRequestStringValues(capture, allCaptures) {
-    const sameEndpointCaptures = allCaptures
-        ? allCaptures.filter((c) => c !== capture && endpointKey(c.url) === endpointKey(capture.url))
-        : [];
-    const varies = (own, others) => !allCaptures || sameEndpointCaptures.length === 0
+/** Per-`allCaptures`-array grouping of captures by {@link endpointKey}, built
+ * once per distinct `allCaptures` identity rather than re-filtering the
+ * whole array on every {@link sameEndpointCapturesFor} call — the O(n)
+ * per-call filter otherwise makes every caller that invokes it once per
+ * capture (e.g. {@link findThreadedJoinFields}) O(n^2) overall. */
+const endpointGroupsCache = new WeakMap();
+function endpointGroupsFor(allCaptures) {
+    const cached = endpointGroupsCache.get(allCaptures);
+    if (cached)
+        return cached;
+    const groups = new Map();
+    for (const c of allCaptures) {
+        const key = endpointKey(c.url);
+        const group = groups.get(key) ?? [];
+        group.push(c);
+        groups.set(key, group);
+    }
+    endpointGroupsCache.set(allCaptures, groups);
+    return groups;
+}
+function sameEndpointCapturesFor(capture, allCaptures) {
+    if (!allCaptures)
+        return [];
+    const group = endpointGroupsFor(allCaptures).get(endpointKey(capture.url)) ?? [];
+    return group.filter((c) => c !== capture);
+}
+/** True when `own` differs from at least one same-endpoint sibling's value at
+ * the same location — the cross-capture variance test {@link
+ * collectRequestStringValues} and {@link collectRequestBodyValuesByKey} both
+ * apply to their respective candidate values. When no sibling capture exists
+ * (or `allCaptures` was omitted), variance can't be observed either way, so
+ * every value passes (matching the unfiltered behavior when `allCaptures` is
+ * omitted). */
+function requestValueVaries(own, others, sameEndpointCapturesLength) {
+    return sameEndpointCapturesLength === 0
         ? true
         : others.some((other) => other !== undefined && other !== own);
+}
+/** Memoizes `JSON.parse(capture.requestPostData)` per capture — the same
+ * capture is re-parsed once per SIBLING lookup by every same-endpoint
+ * caller in {@link collectRequestBodyValuesByKey}'s leaf loop, so without
+ * this cache a group of N same-endpoint captures re-parses each sibling's
+ * body N times over (once per outer capture in the group). `undefined`
+ * means "not a parseable JSON body", the same non-JSON signal the
+ * unmemoized inline parse used to produce. */
+const parsedRequestBodyCache = new WeakMap();
+const PARSE_FAILED = Symbol("parse-failed");
+function parsedRequestBodyFor(capture) {
+    if (parsedRequestBodyCache.has(capture)) {
+        const cached = parsedRequestBodyCache.get(capture);
+        return cached === PARSE_FAILED ? undefined : cached;
+    }
+    const parsed = (() => {
+        if (typeof capture.requestPostData !== "string" || capture.requestPostData.length === 0) {
+            return PARSE_FAILED;
+        }
+        try {
+            return JSON.parse(capture.requestPostData);
+        }
+        catch {
+            return PARSE_FAILED;
+        }
+    })();
+    parsedRequestBodyCache.set(capture, parsed);
+    return parsed === PARSE_FAILED ? undefined : parsed;
+}
+/** Per-(capture, allCaptures-identity) memoization for {@link
+ * collectRequestUrlValues} and {@link collectRequestBodyValuesByKey} —
+ * {@link findThreadedJoinFields} calls both fresh on every invocation and is
+ * itself invoked once per fold/drill-loop item across several call sites, so
+ * without caching the same capture's URL/body values are recomputed (and,
+ * for the body, re-walked and every sibling re-parsed) once per call. */
+const requestUrlValuesCache = new WeakMap();
+const requestBodyValuesByKeyCache = new WeakMap();
+const NO_ALL_CAPTURES = Object.freeze([]);
+/** The path-segment and query-parameter values present in `capture`'s own
+ * URL — the name-free half of {@link collectRequestStringValues}'s candidate
+ * set. Kept separate from the JSON body's leaf values so callers needing a
+ * by-key correlation gate on the body (e.g. {@link findThreadedJoinFields})
+ * can still treat URL/query matches as the name-free signal they've always
+ * been — a REST-style `/orders/{id}` path segment or query param carries no
+ * JSON key to correlate against in the first place. */
+function collectRequestUrlValues(capture, allCaptures) {
+    const cacheKey = allCaptures ?? NO_ALL_CAPTURES;
+    const perCaptureCache = requestUrlValuesCache.get(capture) ?? new WeakMap();
+    requestUrlValuesCache.set(capture, perCaptureCache);
+    const cached = perCaptureCache.get(cacheKey);
+    if (cached)
+        return cached;
+    const sameEndpointCaptures = sameEndpointCapturesFor(capture, allCaptures);
     const values = new Set();
     try {
         const url = new URL(capture.url);
@@ -5918,45 +6549,82 @@ function collectRequestStringValues(capture, allCaptures) {
                     return undefined;
                 }
             });
-            if (varies(value, otherValues))
+            if (requestValueVaries(value, otherValues, sameEndpointCaptures.length))
                 values.add(value);
         }
     }
     catch {
         // Relative or malformed URL — no query params or path segments to contribute.
     }
-    const parsedBody = (() => {
-        try {
-            return typeof capture.requestPostData === "string" && capture.requestPostData.length > 0
-                ? JSON.parse(capture.requestPostData)
-                : undefined;
-        }
-        catch {
-            return undefined;
-        }
-    })();
-    if (parsedBody !== undefined) {
-        for (const { path, value } of walkAllPrimitiveLeaves(parsedBody)) {
-            if (value === null)
-                continue;
-            const stringValue = String(value);
-            const otherValues = sameEndpointCaptures.map((c) => {
-                try {
-                    const otherBody = typeof c.requestPostData === "string" && c.requestPostData.length > 0
-                        ? JSON.parse(c.requestPostData)
-                        : undefined;
-                    if (otherBody === undefined)
-                        return undefined;
-                    const otherValue = readValueAtPath(otherBody, path);
-                    return otherValue === undefined ? undefined : String(otherValue);
-                }
-                catch {
+    perCaptureCache.set(cacheKey, values);
+    return values;
+}
+/** Same JSON-body walk and cross-capture variance gate as {@link
+ * collectRequestStringValues}'s body block, but grouped by the JSON
+ * key/array-index that carries each leaf value (see {@link
+ * jsonBodyLeafValuesByKey}'s same grouping) — the by-key candidate set
+ * {@link findThreadedJoinFields} correlates a threaded field's own name
+ * against, so a value that only coincidentally equals something in an
+ * UNRELATED body field can't be threaded onto it. Returns `null` when
+ * `capture.requestPostData` isn't parseable JSON, the same non-JSON signal
+ * {@link jsonBodyLeafValuesByKey} returns. */
+function collectRequestBodyValuesByKey(capture, allCaptures) {
+    if (typeof capture.requestPostData !== "string" || capture.requestPostData.length === 0) {
+        return null;
+    }
+    const cacheKey = allCaptures ?? NO_ALL_CAPTURES;
+    const perCaptureCache = requestBodyValuesByKeyCache.get(capture) ?? new WeakMap();
+    requestBodyValuesByKeyCache.set(capture, perCaptureCache);
+    if (perCaptureCache.has(cacheKey))
+        return perCaptureCache.get(cacheKey);
+    const parsedBody = parsedRequestBodyFor(capture);
+    if (parsedBody === undefined) {
+        perCaptureCache.set(cacheKey, null);
+        return null;
+    }
+    const sameEndpointCaptures = sameEndpointCapturesFor(capture, allCaptures);
+    const byKey = new Map();
+    for (const { path, value } of walkAllPrimitiveLeaves(parsedBody)) {
+        if (value === null || path.length === 0)
+            continue;
+        const stringValue = String(value);
+        const otherValues = sameEndpointCaptures.map((c) => {
+            try {
+                const otherBody = parsedRequestBodyFor(c);
+                if (otherBody === undefined)
                     return undefined;
-                }
-            });
-            if (varies(stringValue, otherValues))
-                values.add(stringValue);
-        }
+                const otherValue = readValueAtPath(otherBody, path);
+                return otherValue === undefined ? undefined : String(otherValue);
+            }
+            catch {
+                return undefined;
+            }
+        });
+        if (!requestValueVaries(stringValue, otherValues, sameEndpointCaptures.length))
+            continue;
+        const namedSegment = [...path]
+            .reverse()
+            .find((segment) => !ARRAY_INDEX_KEY_PATTERN.test(segment));
+        const key = namedSegment ?? path[path.length - 1];
+        const values = byKey.get(key) ?? new Set();
+        values.add(stringValue);
+        byKey.set(key, values);
+    }
+    perCaptureCache.set(cacheKey, byKey);
+    return byKey;
+}
+function collectRequestStringValues(capture, allCaptures) {
+    // Copied rather than mutated in place: collectRequestUrlValues now returns
+    // a cached Set shared across every caller of this exact (capture,
+    // allCaptures) pair, so merging body values directly into it would leak
+    // them into every OTHER caller relying on collectRequestUrlValues' own
+    // URL-only contract (e.g. findThreadedJoinFields's separate URL/body
+    // gating).
+    const values = new Set(collectRequestUrlValues(capture, allCaptures));
+    const bodyValuesByKey = collectRequestBodyValuesByKey(capture, allCaptures);
+    for (const leafValues of bodyValuesByKey?.values() ?? []) {
+        for (const value of leafValues)
+            values.add(value);
     }
     return values;
 }
@@ -6270,13 +6938,36 @@ function dedupeThreadedFields(fields) {
  * where narrowing by variance is a different concern than the URL/body
  * over-threading this gate exists to prevent. */
 function findThreadedJoinFields(scopes, drillCapture, allCaptures) {
-    const requestValues = collectRequestStringValues(drillCapture, allCaptures);
-    if (requestValues.size === 0)
+    const urlValues = collectRequestUrlValues(drillCapture, allCaptures);
+    const bodyValuesByKey = collectRequestBodyValuesByKey(drillCapture, allCaptures);
+    if (urlValues.size === 0 && (bodyValuesByKey === null || bodyValuesByKey.size === 0))
         return [];
+    // A candidate field's value must EITHER surface name-free in the drill
+    // request's own URL/query (a path segment or query param carries no JSON
+    // key to correlate against, matching interpolateStateValues' isJsonBody
+    // distinction — see its docstring) OR surface in the JSON body under a
+    // key that plausibly names the same concept as the field's own last path
+    // segment (via keyNamesCorrelate, the same discipline compileActionSteps'
+    // pre-scan already applies to body-value reuse). A value that ONLY
+    // coincidentally equals an unrelated body field's value — no URL match,
+    // no name correlation to the body key it landed under — is not threading;
+    // it's the value-coincidence bug this gate exists to close.
     return scopes.flatMap(({ varName, obj }) => [...walkItemFieldPaths(obj)]
-        .filter(({ value: v }) => (typeof v === "string" && v.length > 0 && requestValues.has(v)) ||
-        (typeof v === "number" && requestValues.has(String(v))) ||
-        (typeof v === "boolean" && requestValues.has(String(v))))
+        .filter(({ path, value: v }) => {
+        const stringValue = typeof v === "string" && v.length > 0
+            ? v
+            : typeof v === "number" || typeof v === "boolean"
+                ? String(v)
+                : null;
+        if (stringValue === null)
+            return false;
+        if (urlValues.has(stringValue))
+            return true;
+        if (bodyValuesByKey === null)
+            return false;
+        const sourceKeyName = path.at(-1);
+        return [...bodyValuesByKey.entries()].some(([targetKey, leaves]) => leaves.has(stringValue) && keyNamesCorrelate(sourceKeyName, targetKey));
+    })
         .map(({ path }) => ({ varName, field: path.join(".") })));
 }
 /** True when `target`'s own drill/chain-terminal response resolves onto MORE
@@ -7536,6 +8227,21 @@ function mergeSpecPlanOntoSamePrimary(structuralPlans, actions, foldReturnSpec)
  * in one response — keeps this exact to the shape state-threading is
  * actually needed for.
  *
+ * A later hop's request is only counted as threading a prior hop's response
+ * value when the two agree on the field/header NAME that carries it (or the
+ * value shows up as a bare, name-free URL PATH segment on the later
+ * request) — the same discipline {@link requestAndResponseValuesByKey}/
+ * {@link isFieldValueThreadedElsewhere} already enforce for the identical
+ * hazard elsewhere in this file. Bare cross-capture value equality alone
+ * (what this used before) lets a deeply-nested, unrelated response scalar —
+ * a UI sort-order integer, an unrelated feature-flag boolean — that merely
+ * happens to numerically coincide with some later request field's true
+ * value get proven "threaded" and then, via `indexStateValues`'
+ * `MIN_STATE_VALUE_LENGTH` exemption below, spliced into that unrelated
+ * field. Requiring the SAME name on both sides is what tells a value a
+ * later step genuinely re-reads under its own name apart from that
+ * coincidence.
+ *
  * Runs directly off raw actions (not `resolveFoldPlan`, which needs
  * `isMultipart` — unavailable before `compileActionSteps` has run) since
  * fold-plan DETECTION depends only on each action's `capture`.
@@ -7549,6 +8255,98 @@ function mergeSpecPlanOntoSamePrimary(structuralPlans, actions, foldReturnSpec)
  * two unrelated steps can coincidentally match inside a totally unrelated
  * capture's own URL/body and get spliced into it.
  */
+/** Per-capture memoized: every response BODY leaf, grouped by the field NAME
+ * that carries it — gives {@link collectDependentDrillDownChainValues} the
+ * same name-correlation signal {@link requestAndResponseValuesByKey} already
+ * provides elsewhere in this file, instead of the bare, name-blind value set
+ * {@link collectResponseLeafValues} supplies. Deliberately BODY-only, unlike
+ * {@link collectResponseLeafValues}: a response HEADER (and especially a
+ * `Set-Cookie` token mint) is already a strong structural signal on its own
+ * — issuing a header/cookie at all is a deliberate server action, unlike an
+ * arbitrary deeply-nested body scalar that merely happens to be present — so
+ * header-sourced values keep the pre-existing bare-value match further down
+ * in {@link collectDependentDrillDownChainValues} rather than being held to
+ * a body-field's name correlation. */
+const responseBodyValuesByKeyCache = new WeakMap();
+function responseBodyValuesByKey(capture) {
+    const cached = responseBodyValuesByKeyCache.get(capture);
+    if (cached)
+        return cached;
+    const byKey = new Map();
+    const add = (key, value) => {
+        const values = byKey.get(key) ?? new Set();
+        values.add(value);
+        byKey.set(key, values);
+    };
+    for (const { value, path } of walkAllPrimitiveLeaves(capture.responseBody)) {
+        if (value !== null && path.length > 0)
+            add(path[path.length - 1], String(value));
+    }
+    responseBodyValuesByKeyCache.set(capture, byKey);
+    return byKey;
+}
+/** Per-capture memoized request-side twin of {@link responseBodyValuesByKey}:
+ * every URL query param, JSON body leaf, and request header value, grouped
+ * by field/param/header NAME (header names lower-cased, since HTTP header
+ * names are case-insensitive and a capture's minted header casing need not
+ * match the later request's own casing of the same header), plus bare URL
+ * PATH segments kept name-free in {@link
+ * RequestAndResponseValues.pathSegments} — a REST-style detail fetch threads
+ * an id through its URL PATH, not a named field, so requiring a name match
+ * there too would blind chain-value correlation to that shape of genuine
+ * threading. Headers are included here (unlike {@link
+ * responseBodyValuesByKey}) so a body-sourced response value that a later
+ * hop re-sends as a request HEADER under the matching name still
+ * correlates. */
+const requestValuesByKeyCache = new WeakMap();
+function requestValuesByKeyIncludingHeaders(capture) {
+    const cached = requestValuesByKeyCache.get(capture);
+    if (cached)
+        return cached;
+    const byKey = new Map();
+    const pathSegments = new Set();
+    const add = (key, value) => {
+        const values = byKey.get(key) ?? new Set();
+        values.add(value);
+        byKey.set(key, values);
+    };
+    try {
+        const url = new URL(capture.url);
+        for (const segment of url.pathname.split("/").filter(Boolean))
+            pathSegments.add(segment);
+        for (const [key, value] of url.searchParams)
+            add(key, value);
+    }
+    catch {
+        // Relative/invalid URLs carry no path/query signal to contribute.
+    }
+    if (capture.requestPostData) {
+        try {
+            const parsed = JSON.parse(capture.requestPostData);
+            for (const { value, path } of walkAllPrimitiveLeaves(parsed)) {
+                if (value !== null && path.length > 0)
+                    add(path[path.length - 1], String(value));
+            }
+        }
+        catch {
+            // A non-JSON body carries no leaf values to contribute.
+        }
+    }
+    for (const [headerName, headerValue] of Object.entries(capture.requestHeaders)) {
+        add(headerName.toLowerCase(), headerValue);
+    }
+    const result = { byKey, pathSegments };
+    requestValuesByKeyCache.set(capture, result);
+    return result;
+}
+/** Matches a JSON path segment that's a bare array INDEX ("0", "12", ...)
+ * rather than an object field/header NAME. An array index carries no
+ * semantic meaning of its own — a top-level array response (`[42]`) or a
+ * value nested inside a request array (`{"tokens":[42]}`) has no field name
+ * to correlate on either side — so {@link collectDependentDrillDownChainValues}
+ * treats a leaf keyed by one as name-free, the same way it already treats a
+ * bare URL path segment, instead of requiring an impossible name match. */
+const ARRAY_INDEX_KEY_PATTERN = /^\d+$/;
 function collectDependentDrillDownChainValues(actions, foldReturnSpec) {
     const structuralPlans = detectDrillDownFoldPlan(actions);
     const specPlan = foldReturnSpec === null ? null : buildFoldPlanFromSpec(actions, foldReturnSpec);
@@ -7561,19 +8359,61 @@ function collectDependentDrillDownChainValues(actions, foldReturnSpec) {
                 const priorCapture = actions[priorIndex]?.capture;
                 if (!priorCapture)
                     continue;
-                const responseValues = collectResponseLeafValues(priorCapture);
+                const priorResponseBodyByKey = responseBodyValuesByKey(priorCapture);
+                // Header/cookie-origin response values are matched by bare value
+                // further down, not by name — see {@link responseBodyValuesByKey}'s
+                // docstring for why a header/cookie mint doesn't need that
+                // correlation to already be a trustworthy threading signal.
+                const priorHeaderValues = new Set(Object.values(priorCapture.responseHeaders));
                 const echoedValues = collectRequestValuesIncludingHeaders(priorCapture);
                 for (let k = j + 1; k < target.chain.length; k++) {
                     const laterCapture = actions[target.chain[k]]?.capture;
                     if (!laterCapture)
                         continue;
+                    const { byKey: laterRequestByKey, pathSegments: laterPathSegments } = requestValuesByKeyIncludingHeaders(laterCapture);
                     const laterRequestValues = collectRequestValuesIncludingHeaders(laterCapture);
-                    for (const v of responseValues) {
-                        if (echoedValues.has(v) || !laterRequestValues.has(v))
-                            continue;
+                    // Reverse index (value -> every later-side key it appears under),
+                    // built once per (priorCapture, laterCapture) pair rather than
+                    // once per value, so the array-index name-free fallback below
+                    // doesn't re-walk laterRequestByKey per value.
+                    const laterKeysByValue = new Map();
+                    for (const [k2, vs] of laterRequestByKey) {
+                        for (const v of vs) {
+                            const keys = laterKeysByValue.get(v) ?? new Set();
+                            keys.add(k2);
+                            laterKeysByValue.set(v, keys);
+                        }
+                    }
+                    const addConsumer = (v) => {
                         const consumers = consumersByValue.get(v) ?? new Set();
                         consumers.add(laterCapture);
                         consumersByValue.set(v, consumers);
+                    };
+                    for (const [key, values] of priorResponseBodyByKey) {
+                        const priorKeyIsArrayIndex = ARRAY_INDEX_KEY_PATTERN.test(key);
+                        for (const v of values) {
+                            if (echoedValues.has(v))
+                                continue;
+                            const laterKeysForValue = laterKeysByValue.get(v);
+                            const sameNameMatch = laterKeysForValue?.has(key) ?? false;
+                            const pathSegmentMatch = laterPathSegments.has(v);
+                            // Only the SOURCE side being name-free (an array element with
+                            // no field name of its own) exempts this from name matching —
+                            // a genuinely NAMED source field must still correlate by name
+                            // even if it happens to land inside a later array element,
+                            // otherwise a named `sortOrder` could dodge correlation just
+                            // by coincidentally equaling a value inside an unrelated
+                            // later-side array (`{"tokens":[7]}`).
+                            const arrayIndexMatch = priorKeyIsArrayIndex && laterKeysForValue !== undefined;
+                            if (!sameNameMatch && !pathSegmentMatch && !arrayIndexMatch)
+                                continue;
+                            addConsumer(v);
+                        }
+                    }
+                    for (const v of priorHeaderValues) {
+                        if (echoedValues.has(v) || !laterRequestValues.has(v))
+                            continue;
+                        addConsumer(v);
                     }
                 }
             }
@@ -8212,6 +9052,33 @@ function emitContractTs(opts) {
         const value = payloadNeedsMultipart ? `multipartJsonObject(${schema})` : schema;
         addExtendField(name, `  ${key}: ${value},`);
     }
+    // Closing-the-loop safety net: every discovered-field source above tracks
+    // its own registration as it splices a `payload.<field>` accessor into the
+    // emitted body/url/headers text, but that tracking is scattered across N
+    // independent passes (form-schema discovery, option mappings, additional
+    // body keys, structured keys, drill-param bindings, and — inside
+    // emitMultiStepExecuteHttp's fold-loop `parameterize` closure — threaded
+    // join-field rebinding), any one of which can add an accessor to the
+    // rendered text without remembering to register it in the matching map
+    // above. Rather than trust each source to stay perfectly in sync with the
+    // text it emits, derive completeness from the actual rendered output: scan
+    // `multiStepBody` (already fully assembled at this point — every chain
+    // step's url/headers/body substitutions are done) for every
+    // `payload.<field>` reference and union in any name the sources above
+    // missed, with a conservative `z.string()` default. This closes the gap at
+    // its structural root regardless of which upstream pass forgot to record a
+    // field, instead of adding a fifth registration site that could itself be
+    // forgotten by a future pass.
+    if (multiStepBody) {
+        const bodyReferencedFields = new Set([...multiStepBody.matchAll(/\bpayload\.([A-Za-z_$][A-Za-z0-9_$]*)/g)].map((m) => m[1]));
+        for (const name of [...bodyReferencedFields].sort()) {
+            if (extendFields.has(name))
+                continue;
+            if (isReservedByApplicantContactSchema(name))
+                continue;
+            addExtendField(name, `  ${name}: z.string(),`);
+        }
+    }
     // The structural walk over the captured request body that used to BE the
     // public payload schema (see basePayloadSchemaExpr above) is still the
     // right starting point for the plugin author's internal builder — it's
@@ -8434,7 +9301,14 @@ const httpClient = createHttpClient({ schema: ${pascal}ResponseSchema, bottlenec
                 // referencesItemVar (below) never has a chance to hoist it.
                 const isAncestorScoped = isFoldTargetAncestorScoped(target, actionSteps.map((s) => ({ capture: s.capture })), primaryItemsWithAncestors, fullAncestors);
                 const suffix = foldPlan.targets.length > 1 ? `${planSuffix}${targetIndex}` : planSuffix;
-                const scopedAccessor = (varName, field) => `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
+                // Only `itemVar` (and fold-match candidates) are `Record<string,
+                // unknown>`-typed — ancestor loop vars keep the real response-derived
+                // type, so re-asserting THEIR intermediate hops would be both
+                // unnecessary and, worse, would replace a real property access with
+                // an opaque cast in the emitted URL/body text.
+                const scopedAccessor = (varName, field) => varName === itemVar
+                    ? unknownValueAccessor(varName, field.split("."))
+                    : `${varName}${pathToAccessor(field.split("."), { assertNonNull: false })}`;
                 const joinAccessor = (field) => scopedAccessor(itemVar, field);
                 // Computed once per fold target instead of once per `parameterizeUrl`
                 // call: `actionSteps` never changes across the calls this target's
@@ -9823,6 +10697,16 @@ async function main() {
             : undefined;
         const errorSignals = detectErrorSignals(actionSteps);
         const discoveredFormFields = new Set();
+        // emitMultiStepExecuteHttp's outDiscoveredFields parameter is a generic
+        // payload-accessor accumulator — BaseUrl substitution, persona/producer-
+        // boundary bindings, entryUrlParams, tenant-subdomain headers, and
+        // walkStringLeaves-derived accessors all write into it, independent of
+        // form-schema discovery. It gets its own Set (rather than aliasing
+        // discoveredFormFields positionally) so the two concerns stay separately
+        // named; the explicit merge below is what actually wires its fields into
+        // emitContractTs's schema — never an incidental byproduct of sharing one
+        // reference across unrelated call sites.
+        const discoveredPayloadAccessorFields = new Set();
         const discoveredOptionFields = new Set();
         // Phase E: maps label-derived raw-option payload field name (e.g.
         // "AreYouOverTheAgeOf18OptionId") → recon-observed option-id UUID. Used to
@@ -9895,8 +10779,15 @@ async function main() {
         const multiStepBody = browserFlowOnly
             ? undefined
             : isSubmissionFlow
-                ? emitMultiStepExecuteHttp(actionSteps, inputBody, errorSignals, fieldNameMap, discoveredFormFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema, personaBindings, entryUrlParams, shieldedUuids, selectResolutions, discoveredStructuredKeys, rawCodeFields, foldReturnSpec)
+                ? emitMultiStepExecuteHttp(actionSteps, inputBody, errorSignals, fieldNameMap, discoveredPayloadAccessorFields, fieldOptionsMap, discoveredOptionFields, discoveredRawOptionFields, discoveredAdditionalBodyKeys, baseUrl, baseUrlDerivedHeaders, tenantSubdomainHeaders, formSchema, personaBindings, entryUrlParams, shieldedUuids, selectResolutions, discoveredStructuredKeys, rawCodeFields, foldReturnSpec, pascal)
                 : undefined;
+        // Explicit merge — every field emitMultiStepExecuteHttp registered as a
+        // `payload.<field>` accessor (BaseUrl, persona, entryUrlParams, tenant-
+        // subdomain headers, walkStringLeaves) flows into the same discovered-
+        // fields set emitContractTs's schema `.extend()` reads from below.
+        for (const field of discoveredPayloadAccessorFields) {
+            discoveredFormFields.add(field);
+        }
         const hasMultipartStep = actionSteps.some((s) => s.isMultipart);
         const headerBindings = collectHeaderBindings(actionSteps);
         // Shape inference targets the SAME call executeHttp returns — see