@jevitate/cli 0.19.0 → 0.21.0

package/dist/bin.js

@@ -39690,15 +39690,23 @@ var INSTRUMENT = `(() => {
 })();`;
 var MAX_CAPTURED = 2e4;
 var RequestCapture = class {
+  /**
+   * #617: every request that finished during the capture (its whole completion history), each
+   * tagged with whether THIS capture saw it begin. A request already in flight when the capture
+   * started still finishes into it, but was not sent by the run the capture covers.
+   */
   #requests = [];
   /** #283: requests sent since the capture started that have not finished (keyed by the request). */
   #inflight = /* @__PURE__ */ new Map();
   /** #283: requests sent that never reported an end (their document went away first). */
   #unfinished = [];
   #truncated = false;
-  /** @internal — fed by the page's monitor. */
-  add(r) {
-    this.#requests.push(r);
+  /**
+   * @internal — fed by the page's monitor. `sent` is false for a completion the capture never saw
+   * begin (#617); it stays in the completion history but is not counted as sent by the capture.
+   */
+  add(r, sent = true) {
+    this.#requests.push({ r, sent });
     if (this.#requests.length > MAX_CAPTURED) {
       this.#requests.shift();
       this.#truncated = true;
@@ -39716,22 +39724,27 @@ var RequestCapture = class {
     const sent = this.#inflight.get(key2);
     this.#inflight.delete(key2);
     if (finished !== null)
-      this.add(finished);
+      this.add(finished, sent !== void 0);
     else if (sent !== void 0 && this.#unfinished.length < MAX_CAPTURED)
       this.#unfinished.push(sent);
   }
-  /** The requests captured so far, in the order they finished. */
+  /** The requests captured so far, in the order they finished, including ones the capture never saw begin. */
   requests() {
-    return [...this.#requests];
+    return this.#requests.map((e) => e.r);
   }
   /**
-   * Every request SENT since the capture started (#283): the finished ones (`requests()`), then the
-   * ones still in flight or abandoned without an end event (`pending: true`, `status: null`). A
-   * `requestMade` check is judged over these — a request counts once it was sent, whether or not
-   * its response has arrived.
+   * Every request SENT since the capture started (#283): the finished ones this capture saw begin,
+   * then the ones still in flight or abandoned without an end event (`pending: true`, `status: null`).
+   * A `requestMade` check is judged over these — a request counts once it was sent, whether or not
+   * its response has arrived. A request that began before the capture started is never among them
+   * (#617): only its completion shows up, in `requests()`.
    */
   sent() {
-    return [...this.#requests, ...this.#unfinished, ...this.#inflight.values()];
+    return [
+      ...this.#requests.filter((e) => e.sent).map((e) => e.r),
+      ...this.#unfinished,
+      ...this.#inflight.values()
+    ];
   }
   /** True when more requests finished than the capture keeps (the oldest were dropped). */
   get truncated() {
@@ -53640,6 +53653,72 @@ function mutationPairIssues(journey) {
   });
   return out;
 }
+function targetedProofPlanIssues(journey) {
+  const plans = journey.metadata.targetedProofs ?? [];
+  if (plans.length === 0)
+    return [];
+  const sites = new Set(journeyAssertions(journey).map(assertionSiteKey));
+  const steps = flat(journey);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  plans.forEach((plan2, index) => {
+    const key2 = `${plan2.check}\0${plan2.mustFailWhen}`;
+    if (seen.has(key2))
+      out.push({ index, field: "check", message: `targetedProofs: duplicate plan for ${plan2.check} and ${plan2.mustFailWhen}` });
+    seen.add(key2);
+    if (!SITE_RE.test(plan2.check)) {
+      out.push({ index, field: "check", message: `targetedProofs: ${JSON.stringify(plan2.check)} is not an assertion site \u2014 expected step:<n>, step-request:<n>:<i> or end-state:<i>` });
+    } else if (!sites.has(plan2.check)) {
+      out.push({ index, field: "check", message: `targetedProofs: the Journey has no assertion at ${plan2.check}` });
+    }
+    let mutated;
+    try {
+      mutated = resolveMutationRef(journey, plan2.mustFailWhen);
+    } catch (err) {
+      out.push({ index, field: "mustFailWhen", message: `targetedProofs: ${err instanceof Error ? err.message : String(err)}` });
+    }
+    const check3 = /^step:([1-9][0-9]*)$/.exec(plan2.check);
+    const targetStep = check3 === null ? null : Number(check3[1]);
+    const relaxed2 = /* @__PURE__ */ new Set();
+    for (const entry of plan2.relax) {
+      if (!/^step:[1-9][0-9]*$/.test(entry)) {
+        out.push({ index, field: "relax", message: `targetedProofs: ${JSON.stringify(entry)} is not a step assertion site \u2014 expected step:<n>` });
+        continue;
+      }
+      if (relaxed2.has(entry)) {
+        out.push({ index, field: "relax", message: `targetedProofs: ${entry} is relaxed twice` });
+        continue;
+      }
+      relaxed2.add(entry);
+      const n3 = Number(entry.slice("step:".length));
+      const recorded = steps[n3 - 1];
+      if (recorded === void 0) {
+        out.push({ index, field: "relax", message: `targetedProofs: the Journey has no step ${n3}` });
+        continue;
+      }
+      if (targetStep === n3) {
+        out.push({ index, field: "relax", message: `targetedProofs: ${entry} is the target assertion \u2014 a declared proof never relaxes it` });
+        continue;
+      }
+      if (targetStep !== null && n3 > targetStep) {
+        out.push({ index, field: "relax", message: `targetedProofs: ${entry} is not before the target step:${targetStep}` });
+        continue;
+      }
+      if (recorded.step.kind === "handback") {
+        out.push({ index, field: "relax", message: `targetedProofs: ${entry} is a resume assertion \u2014 a declared proof never relaxes it` });
+        continue;
+      }
+      if (recorded.step.kind !== "assert" && !("expect" in recorded.step)) {
+        out.push({ index, field: "relax", message: `targetedProofs: ${entry} has no page postcondition to relax` });
+        continue;
+      }
+      if (mutated !== void 0 && n3 < mutated.step) {
+        out.push({ index, field: "relax", message: `targetedProofs: ${entry} is before the mutated step ${mutated.step} (${plan2.mustFailWhen})` });
+      }
+    }
+  });
+  return out;
+}
 function expectedText(a) {
   if (a.kind === "valueEquals")
     return typeof a.value === "string" ? { kind: a.kind, text: a.value } : null;
@@ -53868,6 +53947,7 @@ function relaxedMutationReplay(journey, m, opts = {}) {
   return { journey: copy };
 }
 var MAX_TARGETED_RELAXATIONS = 4;
+var MAX_DECLARED_RELAXATIONS = 8;
 function failedSiteKey(f2) {
   if (f2.where === "step")
     return `step:${f2.step}`;
@@ -53980,6 +54060,60 @@ async function runTargetedProof(journey, plan2, m, target, initial, replay, opts
   }
   return { site, relaxedSites, outcome: run.outcome, failedSites: run.failedSites };
 }
+async function runDeclaredTargetedProof(journey, plan2, m, target, declared, replay, opts = {}) {
+  const site = assertionSiteKey(target);
+  const relax = declared.relax;
+  const unpaired = relax.find((key2) => !plan2.pairs.some((p) => p.site === key2 && p.mutation === m.id));
+  if (unpaired !== void 0) {
+    return { site, relaxedSites: relax, outcome: "error", failedSites: [], declared: true, refused: `${unpaired} is not paired with ${m.id}` };
+  }
+  const relaxedNow = [...relax];
+  const run = await replay((j) => targetedMutationReplay(j, m, site, relaxedNow, opts), "targeted");
+  const first = run.failedSites[0];
+  if (first !== void 0 && first.where === "step" && first.postcondition && !relax.includes(`step:${first.step}`) && (target.where !== "step" || first.step < target.step)) {
+    const key2 = `step:${first.step}`;
+    return { site, relaxedSites: relax, outcome: run.outcome, failedSites: run.failedSites, declared: true, refused: `${key2} blocked the declared proof (not in relax)` };
+  }
+  if (classifyMutationPlain(target, m, run) === "sensitive") {
+    const control = await replay((j) => targetedControlReplay(j, m, relaxedNow), "control");
+    if (control.outcome !== "passed") {
+      return {
+        site,
+        relaxedSites: relax,
+        outcome: run.outcome,
+        failedSites: run.failedSites,
+        declared: true,
+        control: control.outcome,
+        refused: `the unmutated control replay with ${relax.join(", ")} relaxed did not pass (${control.outcome})`
+      };
+    }
+    return { site, relaxedSites: relax, outcome: run.outcome, failedSites: run.failedSites, declared: true, control: control.outcome };
+  }
+  return { site, relaxedSites: relax, outcome: run.outcome, failedSites: run.failedSites, declared: true };
+}
+function suggestTargetedProofPlan(proof, m) {
+  if (proof.refused !== `relaxation bound ${MAX_TARGETED_RELAXATIONS} reached`)
+    return null;
+  const first = proof.failedSites[0];
+  if (first === void 0 || first.where !== "step")
+    return null;
+  const relax = [...proof.relaxedSites, `step:${first.step}`];
+  if (relax.length > MAX_DECLARED_RELAXATIONS)
+    return null;
+  return { check: proof.site, mustFailWhen: m.id, relax };
+}
+function declaredTargetedProofFor(journey, m, siteKey) {
+  for (const plan2 of journey.metadata.targetedProofs ?? []) {
+    if (plan2.check !== siteKey)
+      continue;
+    try {
+      if (resolveMutationRef(journey, plan2.mustFailWhen).id === m.id)
+        return plan2;
+    } catch {
+    }
+  }
+  return void 0;
+}
 function needsRelaxedReplay(plan2, m, result) {
   if (result.outcome !== "failed")
     return false;
@@ -54025,6 +54159,19 @@ function classifyMutationPlain(site, m, result) {
   return fs.some((f2) => f2.where === "end-state" && f2.index === site.index) ? "sensitive" : "cascade";
 }
 var PRECEDENCE = ["sensitive", "insensitive", "cascade", "not-applied", "error"];
+function provenSensitive(journey, m, results, key2, visiting) {
+  if (visiting.has(key2))
+    return false;
+  const site = journeyAssertions(journey).find((s3) => assertionSiteKey(s3) === key2);
+  const result = results.get(m.id) ?? { outcome: "error", failedSites: [] };
+  if (site === void 0 || classifyMutation(site, m, result) !== "sensitive")
+    return false;
+  const proof = result.targeted?.find((t) => t.site === key2);
+  if (proof === void 0 || proof.refused !== void 0)
+    return true;
+  const next = /* @__PURE__ */ new Set([...visiting, key2]);
+  return proof.relaxedSites.every((relaxed2) => provenSensitive(journey, m, results, relaxed2, next));
+}
 function judgeAssertions(journey, plan2, results) {
   const proofFor = (m, key2) => results.get(m.id)?.targeted?.find((t) => t.site === key2);
   return journeyAssertions(journey).map((site) => {
@@ -54033,14 +54180,25 @@ function judgeAssertions(journey, plan2, results) {
     if (paired.length === 0)
       return { site: key2, verdict: "unpaired" };
     const verdicts = paired.map((m) => ({ m, v: classifyMutation(site, m, results.get(m.id) ?? { outcome: "error", failedSites: [] }) }));
+    let unsound;
     for (const v of PRECEDENCE) {
       const first = verdicts.find((x) => x.v === v);
-      if (first === void 0)
+      if (first === void 0 && !(v === "cascade" && unsound !== void 0))
         continue;
       if (v === "sensitive") {
-        const proof = proofFor(first.m, key2);
-        return proof !== void 0 && proof.refused === void 0 ? { site: key2, verdict: v, provedBy: first.m.id, relaxedSites: proof.relaxedSites } : { site: key2, verdict: v, provedBy: first.m.id };
+        for (const { m } of verdicts.filter((x) => x.v === "sensitive")) {
+          const proof = proofFor(m, key2);
+          if (proof === void 0 || proof.refused !== void 0)
+            return { site: key2, verdict: v, provedBy: m.id };
+          const bad = proof.relaxedSites.find((relaxed2) => !provenSensitive(journey, m, results, relaxed2, /* @__PURE__ */ new Set([key2])));
+          if (bad === void 0)
+            return { site: key2, verdict: v, provedBy: m.id, relaxedSites: proof.relaxedSites };
+          unsound ??= `relaxed site ${bad} is not itself proven sensitive to ${m.id}`;
+        }
+        continue;
       }
+      if (v === "cascade" && unsound !== void 0)
+        return { site: key2, verdict: v, targetedRefusal: unsound };
       if (v === "cascade") {
         const refusal = paired.map((m) => proofFor(m, key2)).find((t) => t !== void 0 && t.refused !== void 0);
         if (refusal !== void 0)
@@ -54283,7 +54441,8 @@ var HANDOFF_FIELD_TYPES = ["id", "text", "path", "url", "timestamp"];
 var HANDOFF_CONTRACT_RE = /^[a-z0-9][a-z0-9.-]{0,63}@[1-9][0-9]{0,3}$/;
 var HandoffFieldSchema = external_exports.object({
   type: external_exports.enum(HANDOFF_FIELD_TYPES, { message: `E_HANDOFF_SCHEMA: a field type is one of ${HANDOFF_FIELD_TYPES.join("|")}` }),
-  required: external_exports.boolean().optional()
+  required: external_exports.boolean().optional(),
+  origins: external_exports.array(external_exports.string()).optional()
 }).strict();
 var HandoffFieldsSchema = external_exports.record(external_exports.string().min(1), HandoffFieldSchema);
 var JourneyOutputsSchema = external_exports.object({
@@ -54391,7 +54550,8 @@ function fieldErrors(fields, bag, ctx) {
         errors.push({ field: name, code: "missing" });
       continue;
     }
-    const err = validateFieldValue(decl.type, value, ctx);
+    const fieldCtx = decl.type === "url" && decl.origins !== void 0 ? { allowedOrigins: decl.origins } : ctx;
+    const err = validateFieldValue(decl.type, value, fieldCtx);
     if (err !== null)
       errors.push({ field: name, code: err.code });
   }
@@ -54496,6 +54656,39 @@ function forEachNames(journey) {
         names.add(step.as);
   return names;
 }
+var LOOPBACK_ORIGIN_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function originEntryError(entry) {
+  let url2;
+  try {
+    url2 = new URL(entry);
+  } catch {
+    return "is not an origin";
+  }
+  if (url2.origin !== entry || url2.hostname.includes("*"))
+    return "is not an exact origin";
+  if (url2.protocol === "https:")
+    return null;
+  if (url2.protocol === "http:" && LOOPBACK_ORIGIN_HOSTS.has(url2.hostname))
+    return null;
+  return "must be https, or http only for a loopback host";
+}
+function originsFieldIssues(path2, fields) {
+  const issues = [];
+  for (const [name, decl] of Object.entries(fields)) {
+    if (decl.origins === void 0)
+      continue;
+    if (decl.type !== "url") {
+      issues.push({ path: [...path2, name], message: `E_HANDOFF_SCHEMA: origins is only allowed on url fields ("${name}" is ${decl.type})` });
+      continue;
+    }
+    decl.origins.forEach((entry, i) => {
+      const reason = originEntryError(entry);
+      if (reason !== null)
+        issues.push({ path: [...path2, name, i], message: `E_HANDOFF_SCHEMA: origins entry "${entry}" ${reason}` });
+    });
+  }
+  return issues;
+}
 function handoffSchemaIssues(journey) {
   const issues = [];
   const outputs = journey.metadata.outputs;
@@ -54508,6 +54701,7 @@ function handoffSchemaIssues(journey) {
     if (outputs.collection !== void 0 && !forEachNames(journey).has(outputs.collection)) {
       issues.push({ path: ["metadata", "outputs", "collection"], message: `E_HANDOFF_SCHEMA: outputs.collection "${outputs.collection}" names no forEach as` });
     }
+    issues.push(...originsFieldIssues(["metadata", "outputs", "fields"], outputs.fields));
     if (outputs.key !== void 0) {
       if (new Set(outputs.key).size !== outputs.key.length)
         issues.push({ path: ["metadata", "outputs", "key"], message: "E_HANDOFF_SCHEMA: outputs.key: duplicate field" });
@@ -54546,6 +54740,7 @@ function handoffSchemaIssues(journey) {
       if (!(param in inputs.bindings))
         issues.push({ path: ["metadata", "inputs", "bindings"], message: `E_HANDOFF_SCHEMA: required param "${param}" has no binding` });
     }
+    issues.push(...originsFieldIssues(["metadata", "inputs", "request", "fields"], inputs.request.fields));
     inputs.request.key.forEach((field3, i) => {
       const decl = inputs.request.fields[field3];
       if (decl === void 0)
@@ -54634,6 +54829,12 @@ var JourneySchema = external_exports.object({
     endState: external_exports.array(OutcomeCheckSchema).max(50).optional(),
     acceptedWeak: external_exports.object({ reason: external_exports.string().min(1), rules: external_exports.array(external_exports.string()) }).strict().optional(),
     mutationPairs: external_exports.array(external_exports.object({ check: external_exports.string().min(1).max(100), mustFailWhen: external_exports.string().min(1).max(200) }).strict()).max(100).optional(),
+    // #616: a declared targeted-proof plan; the relax list is bounded tighter than the automatic proof.
+    targetedProofs: external_exports.array(external_exports.object({
+      check: external_exports.string().min(1).max(100),
+      mustFailWhen: external_exports.string().min(1).max(200),
+      relax: external_exports.array(external_exports.string().min(1).max(60)).min(1).max(MAX_DECLARED_RELAXATIONS)
+    }).strict()).max(20).optional(),
     approval: external_exports.object({
       contentHash: external_exports.string().regex(/^[0-9a-f]{64}$/, "approval.contentHash: a sha256 hex digest"),
       at: external_exports.string().min(1),
@@ -54659,6 +54860,9 @@ var JourneySchema = external_exports.object({
   for (const issue3 of mutationPairIssues(j)) {
     ctx.addIssue({ code: "custom", path: ["metadata", "mutationPairs", issue3.index, issue3.field], message: issue3.message });
   }
+  for (const issue3 of targetedProofPlanIssues(j)) {
+    ctx.addIssue({ code: "custom", path: ["metadata", "targetedProofs", issue3.index, issue3.field], message: issue3.message });
+  }
   const declared = /* @__PURE__ */ new Set([...j.metadata.params, ...(j.metadata.parameters ?? []).map((p) => p.name)]);
   j.recording.pages.forEach((page, pi) => page.steps.forEach((rs, si) => {
     if (rs.step.kind !== "navigate")
@@ -55498,7 +55702,9 @@ var ReviewVerifySchema = external_exports.discriminatedUnion("status", [
     /** True when the Journey changed after this proof ran (the verdict is for other content). */
     stale: external_exports.boolean(),
     reason: external_exports.string().optional(),
-    summary: external_exports.record(external_exports.string(), external_exports.number())
+    summary: external_exports.record(external_exports.string(), external_exports.number()),
+    /** #616: a reviewable declared targeted-proof plan the automatic bound refused (names only). */
+    suggestedTargetedProofs: external_exports.array(external_exports.object({ check: external_exports.string(), mustFailWhen: external_exports.string(), relax: external_exports.array(external_exports.string()) }).strict()).optional()
   }).strict()
 ]);
 var DiffSchema = external_exports.object({ added: external_exports.array(external_exports.string()), removed: external_exports.array(external_exports.string()) }).strict();
@@ -55518,7 +55724,9 @@ var ReviewChangeSchema = external_exports.discriminatedUnion("kind", [
     stepIdOnly: external_exports.boolean().optional(),
     steps: DiffSchema,
     assertions: DiffSchema,
-    sideEffects: DiffSchema
+    sideEffects: DiffSchema,
+    /** #616: proof-plan changes (`metadata.mutationPairs` / `metadata.targetedProofs`); omitted when neither side declares any. */
+    proofPlans: DiffSchema.optional()
   }).strict()
 ]);
 var ReviewAttentionSchema = external_exports.object({
@@ -55563,6 +55771,8 @@ var JourneyReviewSchema = external_exports.object({
     endStateText: external_exports.array(external_exports.string()).optional(),
     lint: external_exports.object({ errors: external_exports.number().int(), warnings: external_exports.number().int(), findings: external_exports.array(ReviewLintFindingSchema) }).strict(),
     acceptedWeak: external_exports.object({ reason: external_exports.string(), rules: external_exports.array(external_exports.string()) }).strict().optional(),
+    /** #616: the declared targeted-proof plans (`metadata.targetedProofs`) a reviewer approves with the Journey. Additive. */
+    targetedProofs: external_exports.array(external_exports.object({ check: external_exports.string(), mustFailWhen: external_exports.string(), relax: external_exports.array(external_exports.string()) }).strict()).optional(),
     verify: ReviewVerifySchema
   }).strict(),
   changeSinceApproval: ReviewChangeSchema,
@@ -62534,9 +62744,9 @@ function hostStarvedFailure(failure3, health) {
 }
 
 // src/build-info.generated.ts
-var GENERATED_COMMIT = "0a3d2f5";
-var GENERATED_TREE = "963f59f";
-var GENERATED_BUILT_AT = "2026-10-19T17:41:04.191Z";
+var GENERATED_COMMIT = "f37c33b";
+var GENERATED_TREE = "cd26ad0";
+var GENERATED_BUILT_AT = "2026-10-22T22:17:55.712Z";
 
 // src/version.ts
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -62558,13 +62768,13 @@ function readCliVersion() {
 
 // src/engine.ts
 function bundledCommit() {
-  return true ? "0a3d2f5" : void 0;
+  return true ? "f37c33b" : void 0;
 }
 function bundledBuiltAt() {
-  return true ? "2026-10-19T17:41:04.191Z" : void 0;
+  return true ? "2026-10-22T22:17:55.712Z" : void 0;
 }
 function bundledTree() {
-  return true ? "963f59f" : void 0;
+  return true ? "cd26ad0" : void 0;
 }
 function currentBuildTree() {
   return bundledTree() ?? GENERATED_TREE;
@@ -79986,9 +80196,11 @@ function renderSteps(r, w, opts) {
 function renderProvesAtTheEnd(r, w, opts) {
   void opts;
   const endState = r.proof.endStateText ?? r.proof.endState;
-  if (endState.length > 0) {
+  const plans = r.proof.targetedProofs ?? [];
+  if (endState.length > 0 || plans.length > 0) {
     w.head("PROVES AT THE END", "Proves at the end");
     for (const e of endState) w.put(`${w.bullet}\u2713 `, e, w.bullet.length + 2);
+    for (const p of plans) w.put(`${w.bullet}\u21BA `, `declared targeted proof: ${p.check} against ${p.mustFailWhen} may relax ${p.relax.join(", ")}`, w.bullet.length + 2);
     w.gap();
   }
 }
@@ -80079,7 +80291,13 @@ function renderFullDetail(r, w, opts) {
     w.put(w.bullet, `Approved${c.approvedAt === void 0 ? "" : ` ${humanTime(c.approvedAt)}`} as ${nb(w.code(c.approvedHash))}${c.kind === "snapshot-missing" ? "; its snapshot is missing" : ""} \u2014 ${c.changed ? "CHANGED since" : "unchanged since"}`);
     if (c.stepIdOnly === true) w.put(w.bullet, STEP_ID_ONLY_LABEL);
     if (c.kind === "diff") {
-      for (const [label2, d] of [["Steps", c.steps], ["Assertions", c.assertions], ["Side effects", c.sideEffects]]) {
+      const blocks = [
+        ["Steps", c.steps],
+        ["Assertions", c.assertions],
+        ["Side effects", c.sideEffects]
+      ];
+      if (c.proofPlans !== void 0) blocks.push(["Proof plans", c.proofPlans]);
+      for (const [label2, d] of blocks) {
         if (d.added.length === 0 && d.removed.length === 0) continue;
         w.put(w.bullet, `${label2}:`);
         for (const l2 of d.removed) w.put(`${w.bullet}  `, `\u2212 ${l2}`, w.bullet.length + 4);
@@ -80360,6 +80578,8 @@ function buildChange(journey, hash3, snapshot2, stepIdOnly) {
   }
   const approvedHash = journeyReviewHash(snapshot2);
   const approvedAt = approval?.at ?? snapshot2.metadata.approval?.at;
+  const beforePlans = proofPlanLines(snapshot2);
+  const afterPlans = proofPlanLines(journey);
   return {
     kind: "diff",
     approvedHash,
@@ -80368,7 +80588,9 @@ function buildChange(journey, hash3, snapshot2, stepIdOnly) {
     ...idOnly,
     steps: multisetDiff(stepLines(snapshot2), stepLines(journey)),
     assertions: multisetDiff(assertionLines(snapshot2), assertionLines(journey)),
-    sideEffects: multisetDiff(sideEffectLines(snapshot2), sideEffectLines(journey))
+    sideEffects: multisetDiff(sideEffectLines(snapshot2), sideEffectLines(journey)),
+    // #616: only present when a side declares a proof plan, so an unrelated diff stays as before.
+    ...beforePlans.length === 0 && afterPlans.length === 0 ? {} : { proofPlans: multisetDiff(beforePlans, afterPlans) }
   };
 }
 function stepLines(j) {
@@ -80380,6 +80602,12 @@ function assertionLines(j) {
     ...journeyAssertions(j).filter((s3) => s3.where === "step-request").map((s3) => `step request: ${describeCheck(s3.check)}`)
   ];
 }
+function proofPlanLines(j) {
+  return [
+    ...(j.metadata.mutationPairs ?? []).map((p) => `mutation pair: ${p.check} must fail when ${p.mustFailWhen}`),
+    ...(j.metadata.targetedProofs ?? []).map((p) => `targeted proof: ${p.check} against ${p.mustFailWhen} may relax ${p.relax.join(", ")}`)
+  ];
+}
 function sideEffectLines(j) {
   return [
     ...[...new Set(buildWriteRequests(j).map((w) => `write ${w.method} ${w.endpoint}`))],
@@ -80417,7 +80645,8 @@ function buildVerify(journey, hash3, rec) {
     // #523: an executable-content change stales the proof; an old record without it compares the full hash.
     stale: rec.proofHash === void 0 ? rec.contentHash !== hash3 : rec.proofHash !== journeyProofHash(journey),
     ...rec.reason === void 0 ? {} : { reason: rec.reason },
-    summary: { ...rec.summary }
+    summary: { ...rec.summary },
+    ...rec.suggestedTargetedProofs === void 0 ? {} : { suggestedTargetedProofs: rec.suggestedTargetedProofs.map((p) => ({ ...p, relax: [...p.relax] })) }
   };
 }
 function buildJourneyReview(journey, ctx = {}) {
@@ -80495,6 +80724,8 @@ function buildJourneyReview(journey, ctx = {}) {
         findings: findings.map((f2) => ({ rule: f2.rule, level: f2.level, ...f2.step === void 0 ? {} : { step: f2.step }, message: f2.message }))
       },
       ...m.acceptedWeak === void 0 ? {} : { acceptedWeak: { reason: m.acceptedWeak.reason, rules: [...m.acceptedWeak.rules] } },
+      // #616: the declared targeted-proof plans, copied out of the metadata for review.
+      ...m.targetedProofs === void 0 || m.targetedProofs.length === 0 ? {} : { targetedProofs: m.targetedProofs.map((p) => ({ check: p.check, mustFailWhen: p.mustFailWhen, relax: [...p.relax] })) },
       verify: buildVerify(journey, hash3, ctx.lastVerify)
     },
     changeSinceApproval: buildChange(journey, hash3, ctx.approvedSnapshot, ctx.stepIdOnly === true),
@@ -94738,6 +94969,7 @@ var JourneyOutcomeChecks = class {
   async #judge(s3, fallback) {
     const window2 = s3.capture ?? fallback;
     if (window2 === void 0) return [];
+    const ownCapture = s3.capture !== void 0;
     const since = s3.startedAt;
     const until = s3.until;
     const out = [];
@@ -94746,7 +94978,7 @@ var JourneyOutcomeChecks = class {
         await evaluateNetworkCheckAwaiting(
           c,
           () => ({
-            requests: window2.sent().filter((q) => (since === void 0 || q.startedAt !== void 0 && q.startedAt >= since) && (until === void 0 || q.startedAt !== void 0 && q.startedAt <= until)),
+            requests: window2.sent().filter((q) => (ownCapture || since === void 0 || q.startedAt !== void 0 && q.startedAt >= since) && (until === void 0 || q.startedAt !== void 0 && q.startedAt <= until)),
             truncated: window2.truncated
           }),
           s3.responseTimeoutMs ?? this.#responseTimeoutMs
@@ -108612,7 +108844,7 @@ function redactProducerParams(reason, params) {
   return params === void 0 ? reason : redactReason(reason, params, Object.keys(params));
 }
 function chainSucceeded(result) {
-  return result.unmatched.length === 0 && result.runs.every((run) => run.outcome === "ok");
+  return result.unmatched.length === 0 && (result.rejected?.length ?? 0) === 0 && result.runs.every((run) => run.outcome === "ok");
 }
 function sharedRunOptions(opts) {
   return {
@@ -108707,7 +108939,8 @@ async function runHandoffChain(inputs, outputs, fromJourney, fromOutput, request
       runs.push({ ...identity, outcome: "error", ...stamp, reason: redactProducerParams(redactReason(err instanceof Error ? err.message : String(err), params, redactors), opts.params) });
     }
   }
-  return { from: { journey: opts.from, outcome: "ok", records: records.length }, runs, unmatched, rejected };
+  const total = requestValidation.valid.length + requestValidation.rejected.length;
+  return { from: { journey: opts.from, outcome: "ok", records: records.length }, runs, unmatched, requests: { total, ran: runs.length }, rejected };
 }
 async function runJourneyChain(opts, deps = {}) {
   const runner = deps.runJourney ?? runJourneyProgrammatically;
@@ -108758,6 +108991,7 @@ async function runJourneyChain(opts, deps = {}) {
   }
   const runs = [];
   const unmatched = [];
+  let ran = 0;
   for (const request of requests ?? []) {
     const record2 = byKey.get(recordKey2(request.commentId, request.account));
     if (record2 === void 0) {
@@ -108769,6 +109003,7 @@ async function runJourneyChain(opts, deps = {}) {
       runs.push({ commentId: request.commentId, account: request.account, outcome: E_CHAIN_FIELD, reason: mapped.detail });
       continue;
     }
+    ran += 1;
     try {
       const result = await runner({ ...shared3, id: opts.to, params: mapped.params });
       runs.push({
@@ -108781,7 +109016,7 @@ async function runJourneyChain(opts, deps = {}) {
       runs.push({ commentId: request.commentId, account: request.account, outcome: "error", reason: redactProducerParams(redactReason(err instanceof Error ? err.message : String(err), mapped.params), opts.params) });
     }
   }
-  return { from: { journey: opts.from, outcome: "ok", records: count }, runs, unmatched };
+  return { from: { journey: opts.from, outcome: "ok", records: count }, runs, unmatched, requests: { total: (requests ?? []).length, ran } };
 }
 
 // src/journey-cli/chain.ts
@@ -109237,6 +109472,8 @@ async function verifyJourneyMutations(opts, run = runJourneyProgrammatically) {
   const checkOf = new Map(sites.map((s3) => [assertionSiteKey(s3), describeCheck(s3.check)]));
   const plan2 = planJourneyMutations(journey, { ...lintOpts, params: opts.params });
   const mutations = [];
+  const suggested = [];
+  const seenSuggestions = /* @__PURE__ */ new Set();
   if (base.outcome === "ok") {
     const replayOpts2 = { ...lintOpts, params: opts.params };
     const runReplay = async (m, describe6) => {
@@ -109283,7 +109520,18 @@ async function verifyJourneyMutations(opts, run = runJourneyProgrammatically) {
         if (pair.mutation !== m.id) continue;
         const site = siteByKey.get(pair.site);
         if (site === void 0 || classifyMutation(site, m, initial) !== "cascade") continue;
-        targeted.push(await runTargetedProof(journey, plan2, m, site, initial, (describe6) => runReplay(m, describe6), replayOpts2));
+        const declared = declaredTargetedProofFor(journey, m, pair.site);
+        targeted.push(
+          declared === void 0 ? await runTargetedProof(journey, plan2, m, site, initial, (describe6) => runReplay(m, describe6), replayOpts2) : await runDeclaredTargetedProof(journey, plan2, m, site, declared, (describe6) => runReplay(m, describe6), replayOpts2)
+        );
+        const suggestion = suggestTargetedProofPlan(targeted[targeted.length - 1], m);
+        if (suggestion !== null) {
+          const key2 = `${suggestion.check}\0${suggestion.mustFailWhen}\0${suggestion.relax.join(",")}`;
+          if (!seenSuggestions.has(key2)) {
+            seenSuggestions.add(key2);
+            suggested.push(suggestion);
+          }
+        }
       }
       mutations.push({
         kind: m.kind,
@@ -109310,8 +109558,12 @@ async function verifyJourneyMutations(opts, run = runJourneyProgrammatically) {
     verdict: a.verdict,
     ...a.provedBy === void 0 ? {} : { provedBy: a.provedBy },
     ...a.relaxedSites === void 0 ? {} : { relaxedSites: a.relaxedSites },
-    ...a.targetedRefusal === void 0 ? {} : { targetedRefusal: a.targetedRefusal }
+    ...a.targetedRefusal === void 0 ? {} : { targetedRefusal: a.targetedRefusal },
+    // #616: the proving proof was a declared plan, not the automatic relaxation search.
+    ...a.provedBy !== void 0 && results.get(a.provedBy)?.targeted?.some((t) => t.site === a.site && t.declared === true) === true ? { declaredProof: true } : {}
   }));
+  const order = new Map(journeyAssertions(journey).map((s3, i) => [assertionSiteKey(s3), i]));
+  const siteOrder = (key2) => order.get(key2) ?? Number.MAX_SAFE_INTEGER;
   const { verdict, reason } = mutationProofVerdict({ basePassed: base.outcome === "ok", mutations, assertions: judged });
   const count = (v) => assertions.filter((a) => a.verdict === v).length;
   const report2 = {
@@ -109331,7 +109583,9 @@ async function verifyJourneyMutations(opts, run = runJourneyProgrammatically) {
       unpaired: count("unpaired"),
       // #609: assertions proven sensitive through a targeted proof that relaxed earlier sites.
       targeted: assertions.filter((a) => (a.relaxedSites?.length ?? 0) > 0).length
-    }
+    },
+    // #616: in assertion order, so the first suggestion is the one for the refusal the verdict quotes.
+    ...suggested.length === 0 ? {} : { suggestedTargetedProofs: [...suggested].sort((a, b2) => siteOrder(a.check) - siteOrder(b2.check)) }
   };
   const redacted = redactSecretParams(report2, journey, opts.params);
   await writeVerifyRecord(opts.dir, {
@@ -109341,12 +109595,13 @@ async function verifyJourneyMutations(opts, run = runJourneyProgrammatically) {
     verdict: redacted.verdict,
     ...redacted.reason === void 0 ? {} : { reason: redacted.reason },
     summary: { ...redacted.summary },
+    ...redacted.suggestedTargetedProofs === void 0 ? {} : { suggestedTargetedProofs: redacted.suggestedTargetedProofs },
     at: clock.nowIso()
   });
   return redacted;
 }
 function verifyAssertionLine(a) {
-  const relaxed2 = a.relaxedSites === void 0 || a.relaxedSites.length === 0 ? "" : `, relaxed ${a.relaxedSites.join(", ")}`;
+  const relaxed2 = a.relaxedSites === void 0 || a.relaxedSites.length === 0 ? "" : a.declaredProof === true ? `, declared plan relaxed ${a.relaxedSites.join(", ")}` : `, relaxed ${a.relaxedSites.join(", ")}`;
   const proved = a.provedBy === void 0 ? "" : `  (proved by ${a.provedBy}${relaxed2})`;
   const refused = a.targetedRefusal === void 0 ? "" : `  (targeted proof refused: ${a.targetedRefusal})`;
   return `${a.verdict.padEnd(11)}  ${a.site.padEnd(18)}  ${a.check}${proved}${refused}`;
@@ -109507,13 +109762,14 @@ function proofCheck(ctx, journeysDir, cwd) {
   if (nothingToMutate(ctx.journey, verify2.summary)) {
     return { check: { check: "proof", journey: ctx.id, state: "pass", detail: "read-only with no inputs: nothing a mutation could break", evidence } };
   }
+  const suggested = verify2.status === "recorded" ? verify2.suggestedTargetedProofs : void 0;
   return {
     check: { check: "proof", journey: ctx.id, state: "inconclusive", detail: verify2.reason ?? `proof verdict ${verify2.verdict}`, evidence },
-    blocker: { check: "proof", journey: ctx.id, why: inconclusiveProofGuidance(verify2.reason ?? ""), next: `jevitate journey verify ${ctx.id} --mutate` }
+    blocker: { check: "proof", journey: ctx.id, why: inconclusiveProofGuidance(verify2.reason ?? "", suggested), next: `jevitate journey verify ${ctx.id} --mutate` }
   };
 }
 var TARGETED_REFUSAL_MARKER = "a targeted proof was refused: ";
-function inconclusiveProofGuidance(reason) {
+function inconclusiveProofGuidance(reason, suggested) {
   const at3 = reason.indexOf(TARGETED_REFUSAL_MARKER);
   if (at3 < 0) return "inspect the cascade assertions in the verify report";
   const refusal = reason.slice(at3 + TARGETED_REFUSAL_MARKER.length).trim();
@@ -109522,7 +109778,15 @@ function inconclusiveProofGuidance(reason) {
     return `declare the earlier check ${unpaired[1]} as a defense of ${unpaired[2]} with a metadata.mutationPairs entry {check:'${unpaired[1]}', mustFailWhen:'${unpaired[2]}'}, then re-run verify`;
   }
   const bound2 = /relaxation bound (\d+)/.exec(refusal);
-  if (bound2 !== null) return `reduce the layered checks between the mutation and the target (relaxation bound ${bound2[1]})`;
+  if (bound2 !== null) {
+    const first = suggested?.[0];
+    const plan2 = first === void 0 ? `declare a metadata.targetedProofs plan (at most ${MAX_DECLARED_RELAXATIONS} earlier postconditions)` : `declare exactly this metadata.targetedProofs entry: ${JSON.stringify(first)} \u2014 a human reviews it like any other proof change (the review hash changes, so the Journey needs re-approval)`;
+    return `${plan2}, then re-run verify (relaxation bound ${bound2[1]})`;
+  }
+  const blocked = /^(\S+) blocked the declared proof \(not in relax\)$/.exec(refusal);
+  if (blocked !== null) return `add ${blocked[1]} to that plan's relax list (metadata.targetedProofs), then re-run verify`;
+  const unsound = /^relaxed site (\S+) is not itself proven sensitive to (\S+)$/.exec(refusal);
+  if (unsound !== null) return `pair ${unsound[1]} with ${unsound[2]} (metadata.mutationPairs) or make it a real defense, then re-run verify`;
   if (refusal.includes("action failed")) return "the mutated value makes an earlier action impossible, so that target cannot be proven independently \u2014 keep the check; it stays inconclusive by design";
   return "inspect the cascade assertions in the verify report";
 }
@@ -109570,10 +109834,18 @@ function oneJourneyReplay(result) {
   if (result.outcome === "inconclusive") return { state: "inconclusive", detail: result.reason ?? "the replay had no verdict" };
   return { state: "fail", detail: `the replay ended ${result.outcome}` };
 }
+function firstRejection(result) {
+  const rejection = result.rejected?.[0];
+  if (rejection === void 0) return void 0;
+  const error62 = rejection.errors[0];
+  return error62 === void 0 ? rejection.key : `${rejection.key}: ${error62.field} ${error62.code}`;
+}
 function pairReplay(result) {
   if (chainSucceeded(result)) return { state: "pass", detail: "the chain held for every request" };
   if (result.runs.some((r) => r.outcome === "inconclusive")) return { state: "inconclusive", detail: "a chained run had no verdict" };
-  return { state: "fail", detail: `${result.unmatched.length} unmatched request(s), ${result.runs.filter((r) => r.outcome !== "ok").length} failed run(s)` };
+  const counts2 = `${result.unmatched.length} unmatched request(s), ${result.rejected?.length ?? 0} rejected, ${result.runs.filter((r) => r.outcome !== "ok").length} failed run(s)`;
+  const first = firstRejection(result);
+  return { state: "fail", detail: first === void 0 ? counts2 : `${counts2}; first rejection ${first}` };
 }
 function verdictOf2(checks, mode) {
   if (checks.some((c) => c.state === "fail")) return "blocked";
@@ -109614,13 +109886,14 @@ async function runJourneyReadiness(opts, deps = {}) {
   let environment;
   let replay;
   let boundConsumerParams;
+  let chained;
   if (mode !== "report") {
     const producerSchema = journeyParamSchema(contexts[0].journey).required;
     environment = resolveTarget2(opts, deps, requiredParams(contexts[0].journey, pair, opts.requests !== void 0), producerSchema);
     const params = { ...opts.params ?? {} };
     try {
       if (pair) {
-        const chained = await chain(
+        chained = await chain(
           {
             from: opts.id,
             to: opts.with,
@@ -109666,11 +109939,13 @@ async function runJourneyReadiness(opts, deps = {}) {
       for (const ctx of contexts) {
         const consumer = pair && ctx.id === opts.with;
         if (consumer && boundConsumerParams === void 0) {
+          const rejection = chained === void 0 ? void 0 : firstRejection(chained);
+          const hint2 = rejection === void 0 ? `the chain bound no request for '${ctx.id}' \u2014 supply a --requests line that matches a discovered record` : `the chain rejected the consumer's matching record (${rejection})`;
           ctx.review = {
             ...ctx.review,
             proof: {
               ...ctx.review.proof,
-              verify: { status: "not-verified", hint: `the chain bound no request for '${ctx.id}' \u2014 supply a --requests line that matches a discovered record` }
+              verify: { status: "not-verified", hint: hint2 }
             }
           };
           continue;