@enricai/barnacle 1.12.71 → 1.12.73

package/dist/scripts/recon-generate.js

@@ -33,8 +33,10 @@ exports.detectAggregateUnitBasisFindings = detectAggregateUnitBasisFindings;
 exports.selectPayloadAction = selectPayloadAction;
 exports.selectReturnAction = selectReturnAction;
 exports.selectEffectiveResponseBody = selectEffectiveResponseBody;
+exports.deriveBaseUrl = deriveBaseUrl;
 exports.extractEntryUrlParams = extractEntryUrlParams;
 exports.deriveRequestHeaders = deriveRequestHeaders;
+exports.isGraphQL = isGraphQL;
 exports.gatherResponseBodySamples = gatherResponseBodySamples;
 exports.selectPrimaryGraphQLOperation = selectPrimaryGraphQLOperation;
 exports.firstEndpointCapture = firstEndpointCapture;
@@ -827,6 +829,26 @@ function endpointKey(url) {
         return url;
     }
 }
+const RESOURCE_ID_SEGMENT = /^(\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9a-f]{24,})$/i;
+/**
+ * {@link endpointKey} with numeric/UUID/long-hex path segments collapsed, so
+ * `PATCH /orders/17` and `PATCH /orders/18` count as one recurring REST
+ * endpoint rather than two one-off paths.
+ */
+function endpointTemplateKey(url) {
+    const key = endpointKey(url);
+    try {
+        const u = new URL(key);
+        const pathname = u.pathname
+            .split("/")
+            .map((segment) => (RESOURCE_ID_SEGMENT.test(segment) ? ":id" : segment))
+            .join("/");
+        return `${u.origin}${pathname}`;
+    }
+    catch {
+        return key;
+    }
+}
 /** Empty or absent response bodies carry no evidence of an endpoint's purpose. */
 function isVoidResponse(body) {
     if (body === null || body === undefined || body === "")
@@ -992,22 +1014,182 @@ function capturePathname(url) {
         return "";
     }
 }
+/**
+ * A page-navigation response (an HTML document, not JSON/API traffic) is
+ * never itself the flow's backend -- it is where the flow's real API calls
+ * happen to start from. Array order routinely puts the landing navigation
+ * first, so leaving it in the "first non-noise capture" candidate pool lets
+ * an incidental cross-host landing page win `baseUrl`/`primaryHost` over the
+ * flow's genuine, JSON-responding backend traffic.
+ */
+function isHtmlNavigationCapture(capture) {
+    const contentType = Object.entries(capture.responseHeaders).find(([k]) => k.toLowerCase() === "content-type")?.[1];
+    return typeof contentType === "string" && contentType.toLowerCase().includes("text/html");
+}
+/**
+ * Vocabulary for a host label DEDICATED to authentication/identity, generic
+ * across sites (no vendor names) -- e.g. `login.example.com`, `sso.example.net`.
+ * A path segment like `/api/login` on the real backend does not match, since
+ * this only inspects the host's first label, not the path.
+ */
+const AUTH_HOST_LABEL = /^(login|signin|sign-in|logon|auth|oauth|sso|idp|id|account|accounts)$/i;
+/**
+ * Vocabulary for a host label DEDICATED to marketing/landing/redirect
+ * bounces, generic across sites (no vendor names) -- e.g. `www.example.com`,
+ * `landing.example.net`, `go.example.org`. Same structural role as
+ * {@link AUTH_HOST_LABEL}: a same-company host whose label names it as a
+ * marketing/redirect surface rather than an API backend, never itself the
+ * flow's own backend even when it is not also auth/login-labeled.
+ */
+const MARKETING_HOST_LABEL = /^(www|home|landing|marketing|promo|redirect|link|go)$/i;
+/**
+ * A same-company redirect -- an authentication/identity bounce (see
+ * {@link AUTH_HOST_LABEL}) OR a marketing/landing bounce (see
+ * {@link MARKETING_HOST_LABEL}) -- is never itself the flow's own backend,
+ * even though it routinely lands on a different registrable domain than the
+ * flow's real traffic and can complete first due to async timing (e.g. a
+ * mid-session re-auth bounce, or a same-company marketing redirect, that
+ * resolves before the in-flight primary request does). Left in the "first
+ * non-noise capture" candidate pool, such a capture anchors
+ * `baseUrl`/`primaryHost` on the wrong eTLD+1 -- and because
+ * {@link deriveBaseUrl}'s same-domain GraphQL-dominance vote is scoped to
+ * THAT anchor's own registrable domain, nothing downstream ever gets a
+ * chance to correct onto the real backend. Matched on the host's first label
+ * only (see {@link AUTH_HOST_LABEL} and {@link MARKETING_HOST_LABEL}), the
+ * same structural, content-based precedent as {@link isHtmlNavigationCapture}
+ * rather than a count/percentage threshold tuned to any one archive.
+ *
+ * A host label alone can't tell a one-off bounce apart from a genuine
+ * own-backend host that happens to be named `login.`/`www.` (real APIs are
+ * named that too). So this only flags the capture as a redirect when its
+ * host is NOT the pool's most-represented host -- a real backend, named
+ * `login.`/`www.` or not, always racks up the most captures; a bounce that
+ * merely sorts first never does.
+ */
+function isSameCompanyRedirectCapture(capture, pool) {
+    const host = captureHostname(capture.url);
+    const firstLabel = host.split(".")[0] ?? "";
+    if (!AUTH_HOST_LABEL.test(firstLabel) && !MARKETING_HOST_LABEL.test(firstLabel))
+        return false;
+    const hostCounts = new Map();
+    for (const c of pool) {
+        const h = captureHostname(c.url);
+        hostCounts.set(h, (hostCounts.get(h) ?? 0) + 1);
+    }
+    const maxCount = Math.max(...hostCounts.values());
+    return hostCounts.get(host) !== maxCount;
+}
+/**
+ * Groups captures by exact host and returns the origin of the group with the
+ * most captures, so a minority host's capture landing earlier in array order
+ * (e.g. a redirect completing before the dominant host's traffic due to async
+ * ordering) can never win over the group that genuinely dominates by count.
+ * Ties keep the first-encountered group's order to stay deterministic.
+ */
+function dominantHostOrigin(candidates) {
+    const groups = new Map();
+    const groupOrder = [];
+    for (const c of candidates) {
+        const host = captureHostname(c.url);
+        if (!groups.has(host)) {
+            groups.set(host, []);
+            groupOrder.push(host);
+        }
+        groups.get(host).push(c);
+    }
+    const dominantHost = groupOrder.reduce((best, host) => {
+        if (best === null)
+            return host;
+        return groups.get(host).length > groups.get(best).length ? host : best;
+    }, null);
+    const dominantGroup = dominantHost !== null ? groups.get(dominantHost) : [];
+    return firstCaptureOrigin(dominantGroup);
+}
 /**
  * `baseUrl` itself is what {@link registrableDomain}'s fallback would be
  * derived FROM, so at this point in generation the registrable-domain gate
  * doesn't exist yet: when the flow declares no `ownBackendHostnames`, the
  * best available signal is {@link isNoiseUrl}'s conservative exclusion of
  * known third-party asset/tracking hosts (the same fallback
- * `selectAuxFixtureCandidates` uses regardless of host-provenance data).
- */
-function deriveBaseUrl(captures, ownBackendHostnames) {
-    const candidates = captures.filter((c) => {
-        if (ownBackendHostnames.length > 0) {
-            return (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, null);
+ * `selectAuxFixtureCandidates` uses regardless of host-provenance data), plus
+ * excluding HTML page-navigation responses (see {@link isHtmlNavigationCapture}).
+ * Same-company auth/identity and marketing/landing redirects (see
+ * {@link isSameCompanyRedirectCapture}) are excluded from the ANCHOR pick
+ * specifically -- such a redirect is never itself the flow's own backend, no
+ * matter which registrable domain it lands on or how many captures it racks
+ * up completing an SSO or marketing bounce -- but they stay in the wider
+ * `pool` once a real anchor domain is chosen, so a genuine own-backend host
+ * whose label happens to match {@link AUTH_HOST_LABEL} or
+ * {@link MARKETING_HOST_LABEL} (e.g. an `accounts.` or `www.` subdomain that
+ * is itself the real API, not a bounce) can still win the same-domain
+ * dominance vote below.
+ * `baseUrl` doubles as `primaryHost`'s source once resolved, so an
+ * array-order artifact (e.g. a genuine minority-subdomain GraphQL capture
+ * sorting before the flow's dominant GraphQL backend traffic, on a sibling
+ * subdomain of the same registrable domain) would starve every downstream
+ * `primaryHost` narrowing of its real target if the first non-noise capture
+ * always won outright. But capture count alone can't distinguish an
+ * own-backend host from a chatty unrelated one -- #bugfix-005 pins
+ * first-non-noise-capture-wins for the general case, since a same-domain
+ * trailing noise batch (e.g. session-refresh redirects, or a third-party
+ * GraphQL telemetry beacon on an unrelated domain) can vastly outnumber a
+ * real, already-complete primary flow. The dominance vote therefore only
+ * ever runs when the first non-noise capture's OWN registrable-domain group
+ * itself contains GraphQL-shaped traffic (a capture whose `query` parses as
+ * a GraphQL operation) --
+ * exactly the #493 scenario, a genuine own-domain GraphQL host split across
+ * subdomains -- and even then the vote counts every same-domain capture
+ * (GraphQL and REST alike), not just the GraphQL-shaped ones, so it can't be
+ * hijacked by an unrelated cross-domain GraphQL noise source that happens to
+ * outnumber the real flow. Absent same-domain GraphQL traffic OR a declared
+ * submit pattern (see below), the first non-noise, non-navigation capture
+ * wins exactly as before.
+ *
+ * A flow's own declared `submitEndpointPattern`/`submitBodyPattern` is a
+ * second, independent trigger for the same cross-host dominance vote: when
+ * the anchor's own registrable-domain group contains no capture matching the
+ * declared pattern, but a DIFFERENT registrable domain in the pool does, that
+ * other domain is the flow's real backend -- the flow author declared this
+ * pattern specifically to name its own submission traffic, so a match
+ * elsewhere in the pool outranks whichever host merely happened to capture
+ * first. This is strictly narrower than a raw capture-count vote (the kind
+ * #bugfix-005 deliberately rejected as a general rule -- see
+ * "does not let a chatty host outvote the first non-noise capture" in
+ * recon-generate.test.ts, where NO pattern is declared and the first capture
+ * must still win over a larger, unrelated cross-domain group): it only ever
+ * fires when the flow explicitly named the traffic shape it's after, and even
+ * then only switches domain, never host -- {@link dominantHostOrigin} still
+ * picks the exact host by count within that now-confirmed domain.
+ */
+function deriveBaseUrl(captures, ownBackendHostnames, submitPatterns = null) {
+    if (ownBackendHostnames.length === 0) {
+        const nonNoise = captures.filter((c) => !(0, capture_filters_1.isNoiseUrl)(c.url) && !isHtmlNavigationCapture(c));
+        const pool = nonNoise.length > 0 ? nonNoise : captures.filter((c) => !(0, capture_filters_1.isNoiseUrl)(c.url));
+        const anchorPool = pool.filter((c) => !isSameCompanyRedirectCapture(c, pool));
+        const anchorSource = anchorPool.length > 0 ? anchorPool : pool;
+        const anchorHost = captureHostname(firstCaptureOrigin(anchorSource));
+        const anchorDomain = (0, capture_filters_1.registrableDomain)(anchorHost);
+        const sameDomainCandidates = pool.filter((c) => (0, capture_filters_1.registrableDomain)(captureHostname(c.url)) === anchorDomain);
+        const hasDeclaredSubmitPattern = submitPatterns !== null && (submitPatterns.endpoint !== null || submitPatterns.body !== null);
+        const matchesSubmit = compileSubmitMatcher(submitPatterns);
+        const crossDomainSubmitMatch = hasDeclaredSubmitPattern && !sameDomainCandidates.some(matchesSubmit)
+            ? pool.find(matchesSubmit)
+            : undefined;
+        if (crossDomainSubmitMatch !== undefined) {
+            const submitDomain = (0, capture_filters_1.registrableDomain)(captureHostname(crossDomainSubmitMatch.url));
+            const submitDomainCandidates = pool.filter((c) => (0, capture_filters_1.registrableDomain)(captureHostname(c.url)) === submitDomain);
+            return dominantHostOrigin(submitDomainCandidates);
         }
-        return !(0, capture_filters_1.isNoiseUrl)(c.url);
-    });
-    for (const c of candidates) {
+        const sameDomainHasGraphql = sameDomainCandidates.some((c) => (0, capture_filters_1.parsedOperationName)(c.query ?? "") !== null);
+        if (!sameDomainHasGraphql)
+            return firstCaptureOrigin(anchorSource);
+        return dominantHostOrigin(sameDomainCandidates);
+    }
+    const candidates = captures.filter((c) => (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, null));
+    return dominantHostOrigin(candidates);
+}
+function firstCaptureOrigin(captures) {
+    for (const c of captures) {
         try {
             const u = new URL(c.url);
             return `${u.protocol}//${u.host}`;
@@ -1096,7 +1278,13 @@ function isVolatileHeaderName(headerName) {
  * per-session id the site mints once and resends, not a stable constant.
  * `emitMultiStepExecuteHttp` re-mints it at call time instead.
  */
-function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null, ownBackendHostnames = [], fallbackDomain = null) {
+function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null, ownBackendHostnames = [], fallbackDomain = null, 
+// Threaded into extractActionSequence below so its action-capture header
+// source is narrowed to the flow's dominant own-backend host the same way
+// every other extractActionSequence caller already is — otherwise the
+// header baseline could be derived from a minority-host capture's headers
+// instead of the primary host's.
+primaryHost = null) {
     const successfulUrls = new Set(replays.filter((r) => r.success).map((r) => endpointKey(r.url)));
     // Prefer ACTION captures (non-GET 2xx, non-noise) as the authoritative
     // header source. Replay-matched static-asset GETs lack the API-specific
@@ -1105,7 +1293,7 @@ function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null,
     // (multi-step submission flows), use them. For sites where the flow is a
     // single REST call (no detectable action sequence), fall back to the
     // replay-matched captures.
-    const actionCaptures = extractActionSequence(captures, submitPatterns, null, ownBackendHostnames, fallbackDomain).map((a) => a.capture);
+    const actionCaptures = extractActionSequence(captures, submitPatterns, null, ownBackendHostnames, fallbackDomain, true, primaryHost).map((a) => a.capture);
     const replayMatchedCaptures = captures.filter((c) => successfulUrls.has(endpointKey(c.url)));
     const relevantCaptures = actionCaptures.length > 0 ? actionCaptures : replayMatchedCaptures;
     const counts = new Map();
@@ -1146,12 +1334,139 @@ function deriveRequestHeaders(captures, replays, baseUrl, submitPatterns = null,
  * Classifies the flow as GraphQL only from own-backend-host traffic, so a
  * third-party host (chat widget, analytics SDK) making real GraphQL calls
  * never flips a plain REST/JSON backend's classification.
- */
-function isGraphQL(captures, ownBackendHostnames = [], fallbackDomain = null) {
+ *
+ * Founding evidence must be an actual query/mutation document — a REST/JSON
+ * backend can plausibly send its own unrelated body field literally named
+ * `operationName` (or a `query` field holding a plain search string), and a
+ * bare `operationName` with no GraphQL-shaped `query` is exactly what an
+ * Automatic-Persisted-Query re-issue looks like too, so it's evidence of
+ * nothing on its own. It only counts once a genuine document has already
+ * established the classification from elsewhere in the same host-scoped set.
+ *
+ * Evidence is further narrowed to `primaryHost` — the same host
+ * {@link deriveBaseUrl} already resolved the generated client's base URL
+ * from — so a thin trickle of genuine GraphQL traffic against a minority
+ * own-backend host can never flip a REST-majority flow's classification.
+ *
+ * Existence of a single parseable document isn't enough either: a REST body
+ * field literally named `query` can coincidentally satisfy
+ * {@link parsedOperationName}'s regex once out of many unrelated REST
+ * captures sharing that same field name. The parsed-document count must be
+ * at least half of the host-scoped voting pool — mirroring
+ * {@link dominantHostOrigin}'s count-based idiom — so one coincidental match
+ * can never outvote a REST-majority flow. The voting pool is no longer just
+ * the query-bearing subset: a genuine own-backend REST anti-vote — a
+ * request keyed by its URL, not a body, carrying neither `query` nor
+ * `operationName` — now joins the pool too, so one recurring endpoint whose
+ * body coincidentally (or even genuinely) uses a `query`-shaped field can no
+ * longer become a trivial majority of a tiny query-only subset while
+ * remaining a small minority of the site's real own-backend REST traffic.
+ * Anti-vote eligibility spans every HTTP method, not just GET: a catalog/
+ * order site's real own-backend evidence is often POST/PUT/PATCH submissions
+ * (an order-status update, a cart PATCH) with no parsed GraphQL document and
+ * no `operationName`, and restricting the pool to GET alone would make that
+ * evidence invisible no matter how many such captures exist. `captures`
+ * here is the raw, pre-noise-filter capture set, so {@link isNoiseUrl} gates
+ * eligibility directly: a same-origin POST body (an analytics beacon, a
+ * heartbeat ping) is exactly the shape isNoiseUrl excludes as noise, not
+ * real REST traffic — admitting it to the vote would let sheer beacon
+ * volume dilute a genuinely GraphQL-dominant flow. isNoiseUrl only knows
+ * vendor/host-shaped noise, though, so a non-GET candidate must also look
+ * like a real submission: it carries a request body and its method+endpoint
+ * recurs (resource-ID segments collapsed). A bodiless POST ping and a spray of one-off opaque beacon paths
+ * (`/eP8-00`, `/eP8-01`, …) fail that shape and stay out of the vote, while
+ * a recurring order-status PATCH still counts. A same-origin capture
+ * {@link isZeroVarianceRepeatCapture} proves is a request-invariant repeat
+ * is reduced to at most one representative per
+ * endpoint rather than counted for every occurrence — repeat volume alone
+ * must never inflate the anti-vote, the same reason a chatty query-bearing
+ * client isn't allowed to inflate the pro-vote — but that representative is
+ * only dropped from the pool entirely when
+ * {@link hasNoBusinessRelevantResponseState} shows the repeat carries no
+ * data of its own (a beacon/heartbeat). A REST endpoint whose real response
+ * is simply the same value every time it's called (a static category list,
+ * a site-config fetch) is still genuine own-backend evidence and must not be
+ * erased down to zero just because it happens not to vary — that would let
+ * a host whose only queryable traffic is a handful of genuinely-parsed
+ * GraphQL documents win by default the moment its REST traffic is
+ * repetitive, independent of the REST traffic's actual share of the flow.
+ * Bare-`operationName`/APQ-reissue-shaped captures (`operationName` set,
+ * `query` falsy) are excluded from the pool regardless of method: per the
+ * corroboration rule above they carry no signal of their own, so diluting
+ * the pool with a chatty APQ client's re-issue traffic would swamp its own
+ * genuine originating document out of the majority.
+ *
+ * The half-or-more threshold (rather than a strict majority) matters for the
+ * single-primary + single-drill-down shape every foldReturn flow produces:
+ * one genuine GraphQL document paired with exactly one GET REST drill-down
+ * capture is a 1-to-1 pool, and that drill-down capture is real corroborated
+ * REST evidence, not a coincidental parse — it must not by itself veto a
+ * flow that has no other own-backend traffic at all.
+ */
+function isGraphQL(captures, ownBackendHostnames = [], fallbackDomain = null, primaryHost = null) {
     const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
-    return captures.some((c) => (!hasHostProvenance ||
-        (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain)) &&
-        (c.operationName !== null || (0, capture_filters_1.parsedOperationName)(c.query ?? "") !== null));
+    const scoped = captures.filter((c) => {
+        if (hasHostProvenance &&
+            !(0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain, primaryHost))
+            return false;
+        return true;
+    });
+    const nonGetEndpointCounts = scoped.reduce((counts, c) => {
+        if (c.method.toUpperCase() === "GET")
+            return counts;
+        const key = `${c.method.toUpperCase()} ${endpointTemplateKey(c.url)}`;
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+        return counts;
+    }, new Map());
+    const isSubmissionShapedNonGet = (c) => c.requestPostData !== null &&
+        c.requestPostData !== "" &&
+        (nonGetEndpointCounts.get(`${c.method.toUpperCase()} ${endpointTemplateKey(c.url)}`) ?? 0) >= 2;
+    const restAntiVoteCandidates = scoped.filter((c) => !c.query &&
+        c.operationName === null &&
+        !(0, capture_filters_1.isNoiseUrl)(c.url) &&
+        (c.method.toUpperCase() === "GET" || isSubmissionShapedNonGet(c)));
+    const rescuedInvariantEndpoints = new Set();
+    const restAntiVotes = restAntiVoteCandidates.filter((c) => {
+        if (!(0, capture_filters_1.isZeroVarianceRepeatCapture)(c, scoped))
+            return true;
+        if ((0, capture_filters_1.hasNoBusinessRelevantResponseState)(c))
+            return false;
+        const key = endpointKey(c.url);
+        if (rescuedInvariantEndpoints.has(key))
+            return false;
+        rescuedInvariantEndpoints.add(key);
+        return true;
+    });
+    // Mirrors the restAntiVotes rescue above: a query-bearing endpoint called
+    // thousands of times is reduced to at most one representative per
+    // isZeroVarianceRepeatCapture-collapsed endpoint, the same way REST's
+    // anti-vote side already is. Without this, a REST archive's dominant,
+    // repetitive own-backend traffic collapses to a handful of anti-votes
+    // while a smaller set of genuinely-varying query-bearing captures on the
+    // same endpoint keeps full per-capture weight, letting raw operation
+    // count — not real traffic share — decide the classification. Unlike the
+    // REST side, a rescued representative is never dropped entirely via
+    // {@link hasNoBusinessRelevantResponseState}: that check exists to tell a
+    // beacon/heartbeat (no self-declared identity) apart from real REST
+    // evidence, but a query-bearing capture already carries an intentional,
+    // structured document — it is evidence of a GraphQL-shaped endpoint
+    // existing even when its response happens to echo back only values the
+    // request itself supplied.
+    const rescuedInvariantQueryEndpoints = new Set();
+    const proVotes = scoped
+        .filter((c) => c.query)
+        .filter((c) => {
+        if (!(0, capture_filters_1.isZeroVarianceRepeatCapture)(c, scoped))
+            return true;
+        const key = endpointKey(c.url);
+        if (rescuedInvariantQueryEndpoints.has(key))
+            return false;
+        rescuedInvariantQueryEndpoints.add(key);
+        return true;
+    });
+    const votingPool = [...proVotes, ...restAntiVotes];
+    const parsedCount = votingPool.reduce((count, c) => ((0, capture_filters_1.parsedOperationName)(c.query ?? "") !== null ? count + 1 : count), 0);
+    return parsedCount > 0 && parsedCount * 2 >= votingPool.length;
 }
 /**
  * The single own-backend capture the raw GraphQL fallback (no
@@ -1171,11 +1486,11 @@ function isGraphQL(captures, ownBackendHostnames = [], fallbackDomain = null) {
  * flow's own mutation capture (its real submission step, resolved
  * elsewhere) must not hijack this read-op resolution.
  */
-function firstGraphQLCapture(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null) {
+function firstGraphQLCapture(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null, primaryHost = null) {
     const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
     const ownBackendCandidates = captures.filter((c) => c.query &&
         (!hasHostProvenance ||
-            (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain)));
+            (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain, primaryHost)));
     if (submitPatterns === null ||
         (submitPatterns.endpoint === null && submitPatterns.body === null)) {
         return ownBackendCandidates[0] ?? null;
@@ -1300,8 +1615,12 @@ function isPopulatedVariableValue(value) {
  * {@link buildKnownFieldValues}'s known-value guard applied, so an operational
  * Select answer (e.g. a device-type dropdown) never contributes a spurious
  * facet match to the ranking.
+ *
+ * `primaryHost`, when given, further narrows candidates to the flow's
+ * dominant own-backend host — see {@link isAllowedFixtureHost} — so a
+ * minority own-backend host's query can never outrank the primary host's.
  */
-function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, env = process.env, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null) {
+function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, env = process.env, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null, primaryHost = null) {
     // Callers with no host-provenance data (the exported function's unit
     // tests) pass neither ownBackendHostnames nor fallbackDomain — in that
     // case isAllowedFixtureHost would reject every candidate, so the gate
@@ -1313,7 +1632,7 @@ function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, env = pr
         c.query !== null &&
         !/^\s*mutation\b/.test(c.query) &&
         (!hasHostProvenance ||
-            (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain)));
+            (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain, primaryHost)));
     // A declared submitEndpointPattern is authoritative for single-endpoint
     // primary selection too: it must not be silently ignored just because
     // this scoring path (not the multi-step submission path) is the one that
@@ -1411,16 +1730,26 @@ function selectPrimaryGraphQLOperation(captures, flowSteps, vocabulary, env = pr
  * Resolves the same primary-endpoint capture that {@link firstEndpointPath}
  * derives a path string from, so non-GraphQL flows can also read that
  * capture's own `.responseBody` instead of an array-order-first replay.
+ *
+ * `primaryHost` narrows the pool the same way {@link isGraphQL} narrows its
+ * own evidence: a minority own-backend host's capture (a redirect target
+ * with its own, unrelated POST) must never win the REST hot path's endpoint
+ * over the primary host's own GET/POST traffic just because it happens to
+ * be the only non-GET capture in the archive.
  */
-function firstEndpointCapture(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null) {
+function firstEndpointCapture(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null, primaryHost = null) {
     // Callers with no host-provenance data (unit tests exercising the
     // chronological-first fallback in isolation) pass neither argument -- in
     // that case isAllowedFixtureHost would reject every candidate, so the
     // gate only applies once the caller has actually resolved a notion of
     // "own backend" to check against. Mirrors selectPrimaryGraphQLOperation.
     const hasHostProvenance = ownBackendHostnames.length > 0 || fallbackDomain !== null;
-    const allowed = (c) => !hasHostProvenance ||
-        (0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain);
+    const allowed = (c) => {
+        if (hasHostProvenance &&
+            !(0, capture_filters_1.isAllowedFixtureHost)(captureHostname(c.url), ownBackendHostnames, fallbackDomain, primaryHost))
+            return false;
+        return true;
+    };
     const nonGetCaptures = restrictToSubmitPattern(captures.filter((c) => c.method !== "GET" && allowed(c)), submitPatterns);
     for (const c of nonGetCaptures) {
         try {
@@ -1450,9 +1779,9 @@ function safeUrlPathname(url) {
         return "/api/search";
     }
 }
-function firstEndpointPath(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null) {
+function firstEndpointPath(captures, ownBackendHostnames = [], fallbackDomain = null, submitPatterns = null, primaryHost = null) {
     try {
-        const capture = firstEndpointCapture(captures, ownBackendHostnames, fallbackDomain, submitPatterns);
+        const capture = firstEndpointCapture(captures, ownBackendHostnames, fallbackDomain, submitPatterns, primaryHost);
         return capture ? new URL(capture.url).pathname : "/api/search";
     }
     catch {
@@ -1614,7 +1943,14 @@ function extractActionSequence(captures, submitPatterns = null, foldReturnSpec =
 // that immediately truncates this result opts out with `false` to keep
 // earlier chain steps intact while still getting the structural-isolation
 // exemption above.
-applyFinalAnchorNarrowing = true) {
+applyFinalAnchorNarrowing = true, 
+// Threaded straight into isAllowedFixtureHost the same way isGraphQL and
+// deriveBaseUrl already narrow to the flow's dominant own-backend host —
+// without it, a minority-host capture that happens to match the declared
+// submitEndpointPattern can survive host-gating alongside the primary
+// host's genuine matches and starve out the submission this sequence is
+// meant to isolate.
+primaryHost = null) {
     const matchesFoldReturn = compileFoldReturnEndpointMatcher(foldReturnSpec);
     // Callers with no host-provenance data (the exported function's unit
     // tests) pass neither ownBackendHostnames nor fallbackDomain — in that
@@ -1641,13 +1977,25 @@ applyFinalAnchorNarrowing = true) {
     // same way a declared foldReturn endpointPattern already is — both are
     // author-declared, both are authoritative by construction, so the isolation
     // pass (which exists to catch INCIDENTAL same-host noise the flow never
-    // named) must not treat one differently from the other.
+    // named) must not treat one differently from the other. A declared
+    // submitBodyPattern is exempted the same way when there is no declared
+    // submitEndpointPattern to already cover it: a flow that only declares a
+    // body pattern (no endpoint pattern) is just as author-declared and
+    // authoritative, so its genuine matches must not be dropped as
+    // "structurally isolated" once same-host noise outnumbers them.
     const declaredSubmitEndpointRx = submitPatterns?.endpoint != null ? new RegExp(submitPatterns.endpoint) : null;
     const matchesDeclaredSubmitEndpoint = (capture) => declaredSubmitEndpointRx?.test(capture.url) ?? false;
+    const declaredSubmitBodyRx = submitPatterns?.endpoint == null && submitPatterns?.body != null
+        ? new RegExp(submitPatterns.body)
+        : null;
+    const matchesDeclaredSubmitBody = (capture) => declaredSubmitBodyRx?.test(capture.requestPostData ?? "") ?? false;
     const hostGated = captures
         .map((capture, index) => ({ capture, index }))
         .filter(({ capture }) => {
-        if (capture.method === "GET" && !matchesFoldReturn(capture))
+        if (capture.method === "GET" &&
+            !matchesFoldReturn(capture) &&
+            !matchesDeclaredSubmitEndpoint(capture) &&
+            !matchesDeclaredSubmitBody(capture))
             return false;
         if (capture.status < 200 || capture.status >= 300)
             return false;
@@ -1658,7 +2006,7 @@ applyFinalAnchorNarrowing = true) {
         if (!matchesSubmit(capture))
             return false;
         if (hasHostProvenance &&
-            !(0, capture_filters_1.isAllowedFixtureHost)(captureHostname(capture.url), ownBackendHostnames, fallbackDomain))
+            !(0, capture_filters_1.isAllowedFixtureHost)(captureHostname(capture.url), ownBackendHostnames, fallbackDomain, primaryHost))
             return false;
         return true;
     });
@@ -1712,6 +2060,7 @@ applyFinalAnchorNarrowing = true) {
             // INCIDENTAL same-host captures the flow never declared.
             return (matchesFoldReturn(capture) ||
                 matchesDeclaredSubmitEndpoint(capture) ||
+                matchesDeclaredSubmitBody(capture) ||
                 !(0, capture_filters_1.isStructurallyIsolatedCapture)(path, otherPaths));
         })
         : hostGated;
@@ -1797,7 +2146,11 @@ function isMutationCapture(capture) {
 function isGraphQLMutationCapture(capture) {
     return capture.query !== null && /^\s*mutation\b/.test(capture.query);
 }
-function extractGraphQLActionSequence(captures, submitPatterns = null, foldReturnSpec = null, ownBackendHostnames = [], fallbackDomain = null) {
+function extractGraphQLActionSequence(captures, submitPatterns = null, foldReturnSpec = null, ownBackendHostnames = [], fallbackDomain = null, 
+// See extractActionSequence's matching param: narrows host-gating to the
+// flow's dominant own-backend host so a minority-host capture can never
+// pass alongside it.
+primaryHost = null) {
     const matchesSubmit = compileSubmitMatcher(submitPatterns);
     const matchesFoldReturn = compileFoldReturnEndpointMatcher(foldReturnSpec);
     const matchesFoldReturnResults = compileFoldReturnResultsMatcher(foldReturnSpec);
@@ -1820,7 +2173,7 @@ function extractGraphQLActionSequence(captures, submitPatterns = null, foldRetur
         if (!matchesSubmit(capture))
             return false;
         if (hasHostProvenance &&
-            !(0, capture_filters_1.isAllowedFixtureHost)(captureHostname(capture.url), ownBackendHostnames, fallbackDomain))
+            !(0, capture_filters_1.isAllowedFixtureHost)(captureHostname(capture.url), ownBackendHostnames, fallbackDomain, primaryHost))
             return false;
         if (isMutation(capture))
             return true;
@@ -5249,7 +5602,7 @@ responseBodiesForCapacitySignal = []) {
     // A scalar facet field's captured value doesn't only ever surface as its
     // OWN exact `"<field>":<value>` pair (handled above) — the same value can
     // be packed inside an UNRELATED key's delimited facet string (e.g. a
-    // `filters`/`variables` blob shaped `ship:disney-wish|theme:merry`). This
+    // `filters`/`variables` blob shaped `color:midnight-blue|size:large`). This
     // consults the SAME field↔captured-value correlation table just built
     // (the scalar string entries of `merged`) via the identical case-
     // insensitive splice {@link renderGqlVariablesExpr} already applies to the
@@ -5861,6 +6214,11 @@ flowSteps = [], vocabulary = undefined) {
     }
     // Pass 1: render every step's emitted strings; collect referenced var names.
     const rendered = [];
+    // Computed once for the whole loop instead of once per iteration: `actions`
+    // never changes across iterations, so re-deriving this array inside the
+    // loop defeats isZeroVarianceRepeatCapture's reference-keyed cache (see the
+    // identical hoist and rationale at lines 7216 and 12427).
+    const allCaptures = actions.map((a) => a.capture);
     for (let i = 0; i < actions.length; i++) {
         const step = actions[i];
         const cap = step.capture;
@@ -5873,7 +6231,7 @@ flowSteps = [], vocabulary = undefined) {
         // isGet UUID-only floor) and for the fold/drill per-item pass. Rendering
         // its exact literal URL makes this hold even when a value's own
         // length/chain-eligibility scoping doesn't happen to catch the coincidence.
-        const url = (0, capture_filters_1.isZeroVarianceRepeatCapture)(cap, actions.map((a) => a.capture))
+        const url = (0, capture_filters_1.isZeroVarianceRepeatCapture)(cap, allCaptures)
             ? cap.url
             : interpolateStateValues(cap.url, prior, cap, payloadAccessorByValue, false, producerBoundaryBindings, i, new Set(), joinFieldValuesByStep.get(i) ?? new Set());
         // Form-schema substitution runs first on the raw recon body so its
@@ -6180,7 +6538,17 @@ flowSteps = [], vocabulary = undefined) {
             // intermediate array's binding stays addressable inside the innermost
             // loop body — see pathToFoldLoopLines's docstring.
             const { ancestorOpenLines, itemOpenLines, itemCloseLines, ancestorCloseLines, ancestorVars } = pathToFoldLoopLines(`(${primaryStep.varName} as ${primaryArrType})`, foldPlan.primaryArrayPath, itemVar, "    ", planSuffix);
-            lines.push(...ancestorOpenLines);
+            // A target whose chain starts at the primary step itself is a
+            // self-fold (resultsPath nests entirely inside the primary's own
+            // response — see the `allowSelfFold` branch above): its "chain fetch"
+            // below is the primary's OWN `const ${primaryStep.varName} = await
+            // httpClient(...)` call, which `ancestorOpenLines` already reads via
+            // `primaryStep.varName` in its very loop expression. That fetch must
+            // run BEFORE `ancestorOpenLines` is pushed below, not spliced inside
+            // it the way a genuine ancestor-scoped drill fetch (a DIFFERENT, later
+            // endpoint) is — otherwise the emitted loop reads `primaryStep.varName`
+            // before its own declaration.
+            const selfFoldFetchLines = [];
             // Chain fetches for targets whose params + joinFields never reference
             // itemVar are spliced here, above the item loop but inside the
             // ancestor loop(s) — fetched once per ancestor tuple and reused by
@@ -6501,12 +6869,16 @@ flowSteps = [], vocabulary = undefined) {
                     if (chainUsesHeaderThreading)
                         hasItemScopedHeaderThreading = true;
                 }
+                else if (target.chain[0] === foldPlan.primaryStepIndex) {
+                    selfFoldFetchLines.push(...chainLines);
+                    itemScopedLines.push(...matchLines);
+                }
                 else {
                     hoistedChainLines.push(...chainLines);
                     itemScopedLines.push(...matchLines);
                 }
             }
-            lines.push(...hoistedChainLines, ...emitItemLoopLines(itemOpenLines, itemScopedLines, itemCloseLines, itemVar, hasItemScopedFetch && !hasItemScopedHeaderThreading), ...ancestorCloseLines, "");
+            lines.push(...selfFoldFetchLines, ...ancestorOpenLines, ...hoistedChainLines, ...emitItemLoopLines(itemOpenLines, itemScopedLines, itemCloseLines, itemVar, hasItemScopedFetch && !hasItemScopedHeaderThreading), ...ancestorCloseLines, "");
             continue;
         }
         // Every other chain step (already fully emitted, inline, by the fold
@@ -7234,6 +7606,54 @@ function collectRequestStringValues(capture, allCaptures) {
     }
     return values;
 }
+/**
+ * True when a varying body leaf's apparent ambiguity is actually explained
+ * by another field in the same request bodies: some sibling leaf path's
+ * value determines the target field's value as a true function (each
+ * distinct sibling value maps to exactly one distinct field value) across
+ * `capture` plus every same-endpoint capture. A page-size field that always
+ * reads 25 when `tier` is `"standard"` and 100 when `tier` is `"premium"`
+ * is not an unexplained ambiguity — `tier` explains it.
+ */
+function isExplainedByCorrelatedSiblingField(path, parsedBody, otherBodies, siblingPaths) {
+    const allBodies = [parsedBody, ...otherBodies];
+    for (const siblingPath of siblingPaths) {
+        const pathSegments = siblingPath.split(".");
+        const pairs = [];
+        let sawUnexplainableField = false;
+        for (const body of allBodies) {
+            const fieldRaw = readValueAtPath(body, path);
+            if (fieldRaw === undefined)
+                continue;
+            const siblingRaw = readValueAtPath(body, pathSegments);
+            if (siblingRaw === undefined) {
+                // This body has a value for the field we're trying to explain but no
+                // value for the candidate sibling — the sibling can't vouch for it,
+                // so don't let a function fitted over the OTHER bodies paper over it.
+                sawUnexplainableField = true;
+                break;
+            }
+            pairs.push({ siblingValue: String(siblingRaw), fieldValue: String(fieldRaw) });
+        }
+        if (sawUnexplainableField)
+            continue;
+        const distinctSiblingValues = new Set(pairs.map((p) => p.siblingValue));
+        if (distinctSiblingValues.size < 2)
+            continue;
+        const siblingToField = new Map();
+        const isFunction = pairs.every(({ siblingValue, fieldValue }) => {
+            const existing = siblingToField.get(siblingValue);
+            if (existing === undefined) {
+                siblingToField.set(siblingValue, fieldValue);
+                return true;
+            }
+            return existing === fieldValue;
+        });
+        if (isFunction && siblingToField.size === distinctSiblingValues.size)
+            return true;
+    }
+    return false;
+}
 /**
  * Finds every query param or JSON body leaf on `capture`'s own request that
  * (a) was left as a literal in `renderedText` — never swapped for a
@@ -7295,6 +7715,19 @@ function findFrozenVaryingDrillParams(capture, renderedText, allCaptures) {
         }
     })();
     if (parsedBody !== undefined) {
+        const otherBodies = sameEndpointCaptures
+            .map((c) => {
+            try {
+                return typeof c.requestPostData === "string" && c.requestPostData.length > 0
+                    ? JSON.parse(c.requestPostData)
+                    : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })
+            .filter((b) => b !== undefined);
+        const allPaths = Array.from(walkAllPrimitiveLeaves(parsedBody)).map(({ path }) => path.join("."));
         for (const { path, value } of walkAllPrimitiveLeaves(parsedBody)) {
             if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
                 continue;
@@ -7302,20 +7735,11 @@ function findFrozenVaryingDrillParams(capture, renderedText, allCaptures) {
             if (!isFrozenLiteral(stringValue))
                 continue;
             const fieldPath = path.join(".");
-            const differing = sameEndpointCaptures
-                .map((c) => {
-                try {
-                    const otherBody = typeof c.requestPostData === "string" && c.requestPostData.length > 0
-                        ? JSON.parse(c.requestPostData)
-                        : undefined;
-                    return otherBody === undefined ? undefined : readValueAtPath(otherBody, path);
-                }
-                catch {
-                    return undefined;
-                }
-            })
+            const differing = otherBodies
+                .map((otherBody) => readValueAtPath(otherBody, path))
                 .find((v) => v !== undefined && String(v) !== stringValue);
-            if (differing !== undefined) {
+            if (differing !== undefined &&
+                !isExplainedByCorrelatedSiblingField(path, parsedBody, otherBodies, new Set(allPaths.filter((p) => p !== fieldPath)))) {
                 frozen.push({
                     location: "body field",
                     key: fieldPath,
@@ -8727,7 +9151,20 @@ exactPrimaryStepIndex = null,
 // joinFields override independently for EACH structural target, keyed by
 // its own drill endpoint, instead of only the one this function's
 // freshest-first scan happens to land on first.
-restrictToDrillEndpointKey = null) {
+restrictToDrillEndpointKey = null, 
+// When true, a capture that is BOTH the primary (resultsPath resolves on
+// its own response) AND its own endpointPattern match is accepted as a
+// self-fold — no separate later drill-down call exists at all, the
+// flow's whole per-item collection already lives in one response. Only
+// ever set by resolveFoldPlan's bare (no-structural-competition) call:
+// mergeSpecPlanOntoSamePrimary's calls deliberately leave this `false`,
+// since there a structurally-detected plan ALREADY anchors a different,
+// real primary/drill pair — allowing self-fold there would let an
+// unrelated capture that merely echoes `resultsPath`'s key name on its
+// OWN response (e.g. a per-item drill-down's "details" array, matched
+// purely by coincidental naming) hijack or append onto that plan instead
+// of being correctly left unmerged.
+allowSelfFold = false) {
     const rawPrimaryArrayPath = spec.resultsPath.split(".");
     const matchesFoldReturnEndpoint = compileFoldReturnEndpointMatcher(spec);
     // Built once and shared across every primaryStepIndex — see
@@ -8772,7 +9209,15 @@ restrictToDrillEndpointKey = null) {
         // carries one of this primary's join values (see
         // {@link collectDrillStepIndicesWorthTrying}), because testing every
         // primary/drill pair is quadratic in the capture count.
-        const firstDrillOffset = firstIndexGreaterThan(allMatchingDrillStepIndices, primaryStepIndex);
+        //
+        // `primaryStepIndex - 1` (not `primaryStepIndex`) when `allowSelfFold`,
+        // so a capture that is BOTH the primary and its own endpointPattern
+        // match is still admitted — a self-fold, where `resultsPath` nests
+        // entirely inside the SAME capture's response and there is no separate
+        // later drill-down call at all. `firstIndexGreaterThan` finds the first
+        // index strictly greater than its argument, so subtracting 1 widens the
+        // admitted range to include `primaryStepIndex` itself.
+        const firstDrillOffset = firstIndexGreaterThan(allMatchingDrillStepIndices, allowSelfFold ? primaryStepIndex - 1 : primaryStepIndex);
         if (candidateEntryIndicesDescending.length === 0 &&
             firstDrillOffset === allMatchingDrillStepIndices.length) {
             continue;
@@ -8830,7 +9275,18 @@ restrictToDrillEndpointKey = null) {
                         null);
                 }
                 if (spec.drillResultsPath === undefined) {
-                    return findObjectArrayFieldOrWholeObject(drill.capture.responseBody)?.path ?? null;
+                    // Self-fold: the matched "drill" IS the primary capture itself
+                    // (entryIndex === drillStepIndex === primaryStepIndex), so the
+                    // array to fold is the already-resolved `primaryArrayPath` —
+                    // reusing it is the only way to land on the author's declared
+                    // (possibly multi-wildcard-level) nested array; re-deriving it via
+                    // `findObjectArrayFieldOrWholeObject`'s first-DFS-match would
+                    // instead land on whichever object-array field happens to come
+                    // first in key order (e.g. a shallower ancestor array), silently
+                    // discarding the declared `resultsPath`'s own nesting depth.
+                    return drillStepIndex === primaryStepIndex
+                        ? primaryArrayPath
+                        : (findObjectArrayFieldOrWholeObject(drill.capture.responseBody)?.path ?? null);
                 }
                 const path = resolveDeclaredArrayPath(spec.drillResultsPath.split("."), drill.capture.responseBody);
                 return objectItemsAtPath(drill.capture.responseBody, path) ? path : null;
@@ -9404,7 +9860,13 @@ primaryIdentityAnchor = null) {
         : (() => {
             if (foldReturnSpec === null)
                 return [];
-            const specPlan = buildFoldPlanFromSpec(actions, foldReturnSpec, primaryIdentityAnchor);
+            // No structural plan exists anywhere in the action sequence to
+            // compete with, so a capture that is both its own endpointPattern
+            // match AND the resolved resultsPath primary is unambiguously a
+            // self-fold — allowed only here, never from
+            // mergeSpecPlanOntoSamePrimary (see buildFoldPlanFromSpec's
+            // `allowSelfFold` docstring).
+            const specPlan = buildFoldPlanFromSpec(actions, foldReturnSpec, primaryIdentityAnchor, null, null, true);
             return specPlan === null ? [] : [specPlan];
         })();
     return plans.flatMap((plan) => {
@@ -9741,8 +10203,12 @@ ${foldMergeLines.length > 0 ? `${foldMergeLines.join("\n")}\n` : ""}    const tr
  * can never drift out of sync.
  */
 function buildContractChecklist(opts) {
-    const { pascal, gql, omitExecuteHttp, multiStepBody } = opts;
-    const queryChecklistLine = !omitExecuteHttp && gql
+    const { pascal, gql, gqlQuery, omitExecuteHttp, multiStepBody } = opts;
+    // Same isGqlEmission decision emitContractTs treats as the single source of
+    // truth for every GraphQL-emission decision — `gql` alone can be true with
+    // a null `gqlQuery`, which must not produce a QUERY checklist line either.
+    const isGqlEmission = gql && gqlQuery !== null;
+    const queryChecklistLine = !omitExecuteHttp && isGqlEmission
         ? `Trim UI-only fields from ${pascal.toUpperCase()}_QUERY (keep only fields you need)`
         : "";
     // Multi-step flows validate each call against its own per-call inferred
@@ -9923,7 +10389,7 @@ function emitContractTs(opts) {
     // A GraphQL primary with a resolved drill-down fold has no other REST
     // client to issue the drill request(s) with — getGql only ever speaks
     // GraphQL to the primary endpoint.
-    const needsFoldHttpClient = gql && singlePrimaryFoldPlans.length > 0;
+    const needsFoldHttpClient = isGqlEmission && singlePrimaryFoldPlans.length > 0;
     // Every field source below (the base extend's own keys, form-schema
     // discovery, browser-flow splicing, option/raw-option enums, additional
     // body keys, and structured keys) is merged into a SINGLE `.extend({...})`
@@ -10243,7 +10709,7 @@ function emitContractTs(opts) {
             ? `import { createGraphqlClient } from "${ENGINE_PKG}/scraper/graphql-client";${needsFoldHttpClient ? `\nimport { createHttpClient } from "${ENGINE_PKG}/scraper/http-client";` : ""}`
             : `import { createHttpClient } from "${ENGINE_PKG}/scraper/http-client";`;
     const queryConst = !omitExecuteHttp && isGqlEmission
-        ? `\n// Lifted verbatim from recon capture. The adjacent response schema is drift-tolerant by construction (dropped __typename, .loose() objects), so this query text is not hand-trimmed.\nconst ${pascal.toUpperCase()}_QUERY = \`${gqlQuery.trim()}\`;\n`
+        ? `\n// Lifted verbatim from recon capture. The adjacent response schema is drift-tolerant by construction (dropped __typename, .loose() objects), so this query text is not hand-trimmed.\nconst ${pascal.toUpperCase()}_QUERY = \`${escapeForTemplateLiteral(gqlQuery.trim())}\`;\n`
         : "";
     const gqlCacheBlock = omitExecuteHttp
         ? ""
@@ -11658,7 +12124,7 @@ async function main() {
      * already written its output and there is nothing left for main() to do.
      */
     function generateFromCaptures(activeCaptures) {
-        const baseUrl = deriveBaseUrl(activeCaptures, ownBackendHostnames);
+        const baseUrl = deriveBaseUrl(activeCaptures, ownBackendHostnames, submitPatterns);
         // Gate on the flow's declared own-backend hosts (or the registrable-domain
         // fallback of baseUrl) via the same predicate recon-http.ts applies at
         // write time, so a stale aux/ directory from before that filter existed
@@ -11667,9 +12133,10 @@ async function main() {
         // manifest entry is unverifiable provenance, not proven safe, so it is
         // excluded rather than assumed to have passed the write-time filter.
         const fallbackDomain = baseUrl.length > 0 ? (0, capture_filters_1.registrableDomain)(new URL(baseUrl).hostname) : null;
+        const primaryHost = baseUrl.length > 0 ? new URL(baseUrl).hostname : null;
         const auxFiles = auxManifest
             .filter((entry) => {
-            const allowed = (0, capture_filters_1.isAllowedFixtureHost)(entry.hostname, ownBackendHostnames, fallbackDomain);
+            const allowed = (0, capture_filters_1.isAllowedFixtureHost)(entry.hostname, ownBackendHostnames, fallbackDomain, primaryHost);
             if (!allowed) {
                 logger.warn(`excluding aux fixture '${entry.filename}' — host '${entry.hostname}' is not an own-backend host`);
             }
@@ -11692,18 +12159,18 @@ async function main() {
         for (const f of unmanifestedFiles) {
             logger.warn(`excluding aux fixture '${f}' — no aux-manifest.json entry, provenance unverifiable`);
         }
-        const baseHeaders = deriveRequestHeaders(activeCaptures, replays, baseUrl, submitPatterns, ownBackendHostnames, fallbackDomain);
+        const baseHeaders = deriveRequestHeaders(activeCaptures, replays, baseUrl, submitPatterns, ownBackendHostnames, fallbackDomain, primaryHost);
         const minTime = deriveMinTime(rateLimits);
         const hasRateLimitProbeData = rateLimits.some((f) => f.safeRps !== null);
         const safeRps = rateLimits.find((f) => f.safeRps !== null)?.safeRps ?? Math.floor(1000 / minTime);
-        const gql = isGraphQL(activeCaptures, ownBackendHostnames, fallbackDomain);
+        const gql = isGraphQL(activeCaptures, ownBackendHostnames, fallbackDomain, primaryHost);
         // Hoisted so both the primary-operation gate below and rawActionCaptures
         // (further down) read the same computed sequence instead of calling the
         // extractor twice. Computed unfiltered (submitPatterns: null) — a
         // flow-declared submit pattern must truncate this sequence, not filter
         // it, so every gate reading it sees the full host-gated chain.
         const graphqlActionSequence = gql
-            ? extractGraphQLActionSequence(activeCaptures, null, foldReturnSpec, ownBackendHostnames, fallbackDomain)
+            ? extractGraphQLActionSequence(activeCaptures, null, foldReturnSpec, ownBackendHostnames, fallbackDomain, primaryHost)
             : [];
         // A foldReturn-admitted read/drill capture (see extractGraphQLActionSequence's
         // doc comment) can put 2+ entries in graphqlActionSequence with none of them
@@ -11713,7 +12180,7 @@ async function main() {
         // out primaryGraphQLOperation below or flip isSubmissionFlow further down.
         const graphqlActionSequenceHasMutation = graphqlActionSequence.some((a) => a.capture.query !== null && /^\s*mutation\b/.test(a.capture.query));
         const primaryGraphQLOperation = gql && !graphqlActionSequenceHasMutation
-            ? selectPrimaryGraphQLOperation(activeCaptures, flowSteps, vocabulary, process.env, ownBackendHostnames, fallbackDomain, submitPatterns)
+            ? selectPrimaryGraphQLOperation(activeCaptures, flowSteps, vocabulary, process.env, ownBackendHostnames, fallbackDomain, submitPatterns, primaryHost)
             : null;
         if (primaryGraphQLOperation &&
             primaryGraphQLOperation.unpopulatedDeclaredVariables.length > 0) {
@@ -11727,20 +12194,20 @@ async function main() {
         // capture could otherwise win the endpoint/body fallback while an
         // unrelated capture supplies the query text.
         const fallbackGraphQLCapture = gql
-            ? firstGraphQLCapture(activeCaptures, ownBackendHostnames, fallbackDomain, submitPatterns)
+            ? firstGraphQLCapture(activeCaptures, ownBackendHostnames, fallbackDomain, submitPatterns, primaryHost)
             : null;
         const gqlQuery = primaryGraphQLOperation?.capture.query ?? fallbackGraphQLCapture?.query ?? null;
         const endpointPath = primaryGraphQLOperation?.endpointPath ??
             (fallbackGraphQLCapture
                 ? safeUrlPathname(fallbackGraphQLCapture.url)
-                : firstEndpointPath(activeCaptures, ownBackendHostnames, fallbackDomain, submitPatterns));
+                : firstEndpointPath(activeCaptures, ownBackendHostnames, fallbackDomain, submitPatterns, primaryHost));
         // Derived from the primary operation's own Phase-1 capture, never from
         // replay array order -- a replay's body reflects whichever endpoint fired
         // first, not necessarily the primary operation, and only exists once
         // recon:http has run.
         const winningCapture = primaryGraphQLOperation?.capture ??
             fallbackGraphQLCapture ??
-            firstEndpointCapture(activeCaptures, ownBackendHostnames, fallbackDomain, submitPatterns);
+            firstEndpointCapture(activeCaptures, ownBackendHostnames, fallbackDomain, submitPatterns, primaryHost);
         const responseBody = winningCapture?.responseBody ?? null;
         // Every 2xx capture sharing the winning capture's operation identity, not
         // just the one that happened to win selection -- a paginated/re-filtered
@@ -11765,7 +12232,7 @@ async function main() {
         // drill-down the heuristic sequence found past the submit step.
         const unfilteredHeuristicActionCaptures = gql
             ? dedupRedundantSameOperationCaptures(graphqlActionSequence, primaryGraphQLOperation)
-            : collapseRedundantSameEndpointCaptures(collapseRedundantPatches(extractActionSequence(activeCaptures, null, foldReturnSpec, ownBackendHostnames, fallbackDomain)));
+            : collapseRedundantSameEndpointCaptures(collapseRedundantPatches(extractActionSequence(activeCaptures, null, foldReturnSpec, ownBackendHostnames, fallbackDomain, true, primaryHost)));
         // A flow-declared submitEndpointPattern is authoritative: it may match only
         // the final step's URL (the natural way to describe "the button that
         // finishes the wizard") even though the earlier steps of the same chain
@@ -11788,8 +12255,8 @@ async function main() {
         // narrowing (REST) / per-capture submit match (GraphQL) keep the
         // genuine captures amid that noise, so truncation has them to find.
         const patternedExtractedActionCaptures = gql
-            ? dedupRedundantSameOperationCaptures(extractGraphQLActionSequence(activeCaptures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain), primaryGraphQLOperation)
-            : collapseRedundantSameEndpointCaptures(collapseRedundantPatches(extractActionSequence(activeCaptures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain, false)));
+            ? dedupRedundantSameOperationCaptures(extractGraphQLActionSequence(activeCaptures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain, primaryHost), primaryGraphQLOperation)
+            : collapseRedundantSameEndpointCaptures(collapseRedundantPatches(extractActionSequence(activeCaptures, submitPatterns, foldReturnSpec, ownBackendHostnames, fallbackDomain, false, primaryHost)));
         const patternedHeuristicActionCaptures = submitPatterns.endpoint === null && submitPatterns.body === null
             ? unfilteredHeuristicActionCaptures
             : truncateActionSequenceAtSubmitPattern(patternedExtractedActionCaptures, submitPatterns, foldReturnSpec);
@@ -12036,22 +12503,32 @@ async function main() {
         // diagnostic must consult the SAME resolution each path actually applies,
         // or it falsely reports "no fold plan resolved" for every multi-step flow
         // with a working foldReturn.
-        const effectiveFoldPlanCount = multiStepBody
-            ? resolveFoldPlan(actionSteps, foldReturnSpec).length
-            : resolveApplicableFoldPlans(actionSteps, foldReturnSpec, multiStepBody, emittedPrimaryAnchor)
-                .length;
+        const effectiveFoldPlans = multiStepBody
+            ? resolveFoldPlan(actionSteps, foldReturnSpec)
+            : resolveApplicableFoldPlans(actionSteps, foldReturnSpec, multiStepBody, emittedPrimaryAnchor);
+        const effectiveFoldPlanCount = effectiveFoldPlans.length;
         if (foldReturnSpec !== null && effectiveFoldPlanCount === 0) {
             logger.warn(`flow declares foldReturn (endpointPattern: ${foldReturnSpec.endpointPattern}, resultsPath: ${foldReturnSpec.resultsPath}, joinFields: ${foldReturnSpec.joinFields.join(", ")}) but no fold plan resolved — no later capture matched the endpoint pattern, resultsPath resolved to no object array, or the matched drill-down is multipart; the drill-down's response will not be folded`);
         }
         // The quieter failure: structural plans resolved (so the count above is
-        // non-zero) but the DECLARED spec itself resolved nothing, so its
-        // joinFields never reached any emitted target and only heuristic join
-        // guesses were emitted. Without this the two cases are indistinguishable
-        // in the output. Anchored exactly as the emitted resolution above is, so
-        // the diagnostic never disagrees with what actually went into the file.
-        if (foldReturnSpec !== null &&
-            effectiveFoldPlanCount > 0 &&
-            buildFoldPlanFromSpec(actionSteps, foldReturnSpec, multiStepBody ? null : emittedPrimaryAnchor) === null) {
+        // non-zero) but none of their targets ended up carrying the DECLARED
+        // joinFields, so only heuristic join guesses were emitted. Read straight
+        // off `effectiveFoldPlans` — the exact plans/targets that actually made
+        // it into the emitted output — rather than re-deriving success via a
+        // second, independent, unrestricted `buildFoldPlanFromSpec` call: that
+        // call re-scans every primary/drill occurrence from scratch with none of
+        // `mergeSpecPlanOntoSamePrimary`'s per-occurrence, per-target override
+        // robustness (see its own docstring), so under a noisy archive with
+        // several occurrences of the same re-issued/paginated primary it can
+        // legitimately resolve to `null` even while the declared joinFields WERE
+        // already applied onto the actual emitted target via that per-occurrence
+        // override — producing this exact false "declared spec resolved no fold
+        // plan" warning despite the declared field being the one genuinely
+        // emitted. Comparing against what was actually resolved can never
+        // disagree with what went into the file, by construction.
+        const declaredJoinFieldsApplied = foldReturnSpec !== null &&
+            effectiveFoldPlans.some((plan) => plan.targets.some((target) => JSON.stringify(target.joinFields) === JSON.stringify(foldReturnSpec.joinFields)));
+        if (foldReturnSpec !== null && effectiveFoldPlanCount > 0 && !declaredJoinFieldsApplied) {
             logger.warn(`flow declares foldReturn (endpointPattern: ${foldReturnSpec.endpointPattern}, resultsPath: ${foldReturnSpec.resultsPath}, joinFields: ${foldReturnSpec.joinFields.join(", ")}) but the declared spec resolved no fold plan — only structurally-detected fold plans (with their own guessed join fields) were emitted, so the declared joinFields were not applied; check that the endpointPattern names a capture in the action sequence and resultsPath resolves on the primary response`);
         }
         logger.info(`generating plugin for ${siteId} (${gql ? "GraphQL" : browserFlowOnly ? `submission flow, ${actionSteps.length} steps, browser-flow-only (cross-domain hop detected)` : isSubmissionFlow ? `submission flow, ${actionSteps.length} steps` : "single-endpoint REST"}, baseUrl: ${baseUrl})`);