@jevitate/cli 0.28.1 → 0.29.0

package/dist/journey-verify.js

@@ -1,6 +1,6 @@
 /**
  * #402 — `journey verify --mutate`: a built-in negative proof that each of a Journey's assertions
- * FAILS when its outcome is absent. The Journey is replayed once as recorded (it must pass), then
+ * FAILS when its outcome is absent. The Journey is replayed as recorded (it must pass), then
  * once per mutation (`planJourneyMutations`: skip a write step, abort its writes, type an empty or
  * stale value into a checked fill, or — #565 — swap or truncate a checked non-secret parameter); each assertion is sensitive only when its paired mutation broke it, at
  * that assertion, with nothing failing before the mutated step.
@@ -9,14 +9,731 @@
  * environment as `journey run`. Mutations never send, fabricate or answer a request: they leave a
  * step's action out, ABORT the app's own writes in one step's window, or type `""`.
  */
-import { FsJourneyStore, JourneyRegistry, assertionSiteKey, classifyMutation, declaredTargetedProofFor, journeyAssertions, judgeAssertions, mutationProofVerdict, mutationReplay, needsRelaxedReplay, planJourneyMutations, relaxedMutationReplay, runDeclaredTargetedProof, runTargetedProof, suggestTargetedProofPlan, } from "@jevitate/journey";
-import { describeCheck } from "@jevitate/explore";
+import { FsJourneyStore, JourneyRegistry, assertionSiteKey, classifyMutation, classifyReplay, controlCanChangeVerdict, declaredTargetedProofFor, flatJourneySteps, heldSites, journeyAssertions, ParamValidationError, journeyEndState, journeyParamSchema, journeyWriteSteps, judgeAssertions, mutationErrored, mutationProofVerdict, mutationReplay, needsRelaxedReplay, paceBeforeMutationMs, paceEndStateFloorMs, paceFloorMs, paceMarginBoundMs, paceMarginOf, paceTailMs, pacedReplay, planJourneyMutations, relaxedMutationReplay, runDeclaredTargetedProof, runTargetedProof, siblingDisagreements, sitesReachedEarly, sitesUnmatchedBy, suggestTargetedProofPlan, targetedMutationReplay, thinSites, validateParams, } from "@jevitate/journey";
+import { DEFAULT_STEP_RESPONSE_TIMEOUT_MS, describeCheck, evaluateNetworkCheckAwaiting, monitorFor } from "@jevitate/explore";
 import { clock } from "@jevitate/domain";
+import { checkAssertion, waitForOutcome } from "@jevitate/interpreter";
+import { AssertionRefError, assertionRefs, resolveAssertionRefs } from "@jevitate/recording";
+import { BrowseTheWebToken } from "@jevitate/screenplay";
+import { DEFAULT_ADMISSION_TIMEOUT_MS, DEFAULT_CLOSE_TIMEOUT_MS, DEFAULT_OPEN_TIMEOUT_MS, PlaywrightBrowserPort, pageUnresponsiveMsFromEnv, sharedResourceGovernor, } from "@jevitate/playwright";
 import { journeyContentHash } from "./journey-annotate-api.js";
 import { journeyReviewHash } from "./journey-review.js";
 import { preflightVerifyRecord, writePreflightedVerifyRecord } from "./journey-review-store.js";
-import { UnknownJourneyError, redactSecretParams, runJourneyProgrammatically } from "./journey-api.js";
+import { UnknownJourneyError, effectiveAllowedOrigins, redactSecretParams, runJourneyProgrammatically } from "./journey-api.js";
 import { journeyProofContext, journeyProofHashForContext } from "./journey-proof-context.js";
+import { JourneyVerifyResumeRefusedError, RETRY_REASON_NOT_KEPT, checkpointPairOf, checkpointReplayOf, isRepairableIsolation, openProofCheckpoint, resumeRefusalAgainstBase, reusedProofFields, } from "./journey-verify-checkpoint.js";
+import { composeObservers } from "./run-screenshots.js";
+/** Hands a proof's bound the Journey it is sized from. */
+export async function loadJourneyToVerify(dir, id) {
+    const journey = await new JourneyRegistry(new FsJourneyStore(dir)).get(id);
+    if (!journey)
+        throw new UnknownJourneyError(`unknown journey '${id}'`);
+    return journey;
+}
+// What one replay can legally wait for, by the bounds of the code it runs.
+const ACTION_BOUND_MS = 30_000; // `page.goto` and default actions (Playwright's default).
+const RELOAD_BOUND_MS = 15_000; // `outcome-wait.ts`, `act.ts`.
+const SITE_GATE_WAIT_MS = 5_000; // `site-gate.ts`.
+/** A hook's default limit, before and after a replay. A spec that sets longer limits leans on the rest of the budget. */
+const FIXTURE_ALLOWANCE_MS = 120_000;
+/** The least a replay is given, however short its Journey. */
+const REPLAY_FLOOR_MS = 360_000;
+const MAX_TIMER_MS = 2_147_483_647;
+/** How long after the inactivity limit the in-process bound fires, so a CLI's terminal layer ends the run first. */
+const STALL_MARGIN_MS = 30_000;
+/** How long a stalled replay's session close and its own unwinding (fixture restore) may take. */
+const STALL_TEARDOWN_MS = 90_000;
+function admissionBoundMs(env = process.env) {
+    const set = Number(env["JEVITATE_ADMISSION_TIMEOUT_MS"]);
+    return Number.isInteger(set) && set > 0 ? set : DEFAULT_ADMISSION_TIMEOUT_MS;
+}
+/**
+ * The longest a proof can legally go between two replays' progress: a machine-slot admission wait,
+ * then the longest legal single replay of THIS Journey, each step at its worst. A sum of worst cases,
+ * so it is far above a typical replay. It limits silence and never the whole run: a proof whose
+ * replays keep starting is never ended, however long it takes (#778).
+ */
+export function proofInactivityMs(journey, opts = {}) {
+    const responseDefault = opts.stepResponseTimeoutMs ?? DEFAULT_STEP_RESPONSE_TIMEOUT_MS;
+    let replay = DEFAULT_OPEN_TIMEOUT_MS + pageUnresponsiveMsFromEnv() + DEFAULT_CLOSE_TIMEOUT_MS + FIXTURE_ALLOWANCE_MS;
+    let longestStepMs = 0;
+    for (const { recorded } of flatJourneySteps(journey)) {
+        const wait = "waitFor" in recorded.step ? recorded.step.waitFor : undefined;
+        // A relaxed site's kept response wait (`RelaxedSiteWait`) runs per request check, one after another.
+        let stepMs = ACTION_BOUND_MS + SITE_GATE_WAIT_MS + RELOAD_BOUND_MS + (recorded.responseTimeoutMs ?? responseDefault) * Math.max(1, recorded.expectRequests?.length ?? 0);
+        // A wait's last poll can start just before `maxMs` and still reload.
+        if (wait !== undefined)
+            stepMs += wait.maxMs + ACTION_BOUND_MS;
+        replay += stepMs;
+        longestStepMs = Math.max(longestStepMs, stepMs);
+    }
+    // Only a Journey with steps is paced: its floors' margin, and waiting for open writes before its end state and its close.
+    if (longestStepMs > 0)
+        replay += paceMarginBoundMs(longestStepMs) + 2 * (Math.max(responseDefault, longestStepMs) + ABORTED_WRITE_GRACE_MS);
+    replay += journeyEndState(journey).length * (ACTION_BOUND_MS + RELOAD_BOUND_MS);
+    return Math.min(admissionBoundMs() + Math.max(REPLAY_FLOOR_MS, replay), MAX_TIMER_MS - STALL_MARGIN_MS);
+}
+/**
+ * A replay went past the proof's inactivity limit: the proof ended with no verdict and no receipt.
+ * A CLI run normally ends at the terminal layer's own limit first, so this is what an MCP call (where
+ * that layer stays out) and `journey readiness` get. Its text carries names only, never a value.
+ */
+export class JourneyVerifyStalledError extends Error {
+    where;
+    inactivityMs;
+    sessionsClosed;
+    code = "E_TERMINAL_WATCHDOG";
+    constructor(where, inactivityMs, 
+    /** Every session this replay opened has closed. False: its close was still pending when the teardown bound ran out. */
+    sessionsClosed) {
+        const at = where.mutation === undefined ? `replay ${where.replay}` : `replay ${where.replay}, mutation ${where.mutation}`;
+        super(`journey verify: no progress for the ${inactivityMs}ms inactivity limit at ${at}; no verdict, and any earlier receipt stands${sessionsClosed ? "" : ". Its browser session did not close in time"}`);
+        this.where = where;
+        this.inactivityMs = inactivityMs;
+        this.sessionsClosed = sessionsClosed;
+        this.name = "JourneyVerifyStalledError";
+    }
+}
+/**
+ * The sessions one replay opens, so a stalled replay can be ended from outside: `runJourneyProgrammatically`
+ * takes no cancel signal, but closing its session makes every page call it is waiting on reject, and
+ * it then unwinds by its own paths, fixture restore included. An open still pending at the stall is
+ * closed the moment it lands.
+ */
+function trackedPortFactory(factory, onOpened) {
+    const pending = new Set();
+    const opened = new Set();
+    let abandoned = false;
+    const closeOf = (session) => session.close().catch(() => undefined);
+    const openOn = async (port, o) => {
+        const session = await port.open(o);
+        if (abandoned) {
+            await closeOf(session);
+            throw new Error("the replay was abandoned while its browser session opened");
+        }
+        opened.add(session);
+        onOpened();
+        return session;
+    };
+    return {
+        factory: () => {
+            const port = factory();
+            return {
+                open: (o) => {
+                    const opening = openOn(port, o);
+                    const done = () => void pending.delete(opening);
+                    pending.add(opening);
+                    opening.then(done, done);
+                    return opening;
+                },
+            };
+        },
+        abandon: async () => {
+            abandoned = true;
+            await Promise.allSettled([...[...opened].map(closeOf), ...pending]);
+        },
+    };
+}
+/** `start` under the limit. Past it: close what the replay opened, give it a bounded time to unwind, and throw. */
+async function replayWithinBound(start, portFactory, where, inactivityMs, onSessionOpened) {
+    const tracked = trackedPortFactory(portFactory, onSessionOpened);
+    const running = start(tracked.factory);
+    let timer;
+    const stalled = new Promise((resolve) => {
+        // Ref'd: a replay with nothing else left to hold the process open still reaches this bound.
+        timer = clock.setTimeout(() => resolve({ stalled: true }), inactivityMs + STALL_MARGIN_MS);
+    });
+    try {
+        const first = await Promise.race([running.then((value) => ({ stalled: false, value })), stalled]);
+        if (!first.stalled)
+            return first.value;
+    }
+    finally {
+        clock.clearTimeout(timer);
+    }
+    let sessionsClosed = false;
+    let teardownTimer;
+    const closing = tracked.abandon().then(() => {
+        sessionsClosed = true;
+    });
+    await Promise.race([
+        Promise.allSettled([closing, running]),
+        new Promise((resolve) => {
+            teardownTimer = clock.setTimeout(resolve, STALL_TEARDOWN_MS);
+        }),
+    ]);
+    clock.clearTimeout(teardownTimer);
+    throw new JourneyVerifyStalledError(where, inactivityMs, sessionsClosed);
+}
+const siteKeyOf = (f) => f.where === "step" ? `step:${f.step}` : f.where === "step-request" ? `step-request:${f.step}:${f.checkIndex}` : f.where === "end-state" ? `end-state:${f.index}` : "unevaluable";
+/**
+ * #785: runs the waits a replay's relaxed sites keep (`RelaxedSiteWait`), as each step ends. Each is
+ * bounded, and how it ended is only recorded: an observer never changes the replay's verdict.
+ */
+function relaxedWaitObserver(waits, params, responseTimeoutMs, record) {
+    const captures = new Map();
+    const stopCapture = (actor, index) => {
+        const capture = captures.get(index);
+        if (capture === undefined)
+            return;
+        monitorFor(actor.ability(BrowseTheWebToken).session.page).stopCapture(capture);
+        captures.delete(index);
+    };
+    const ownWaits = (index) => waits().filter((w) => w.step === index + 1);
+    const pageWait = async (actor, w, step) => {
+        let assertion = w.assertion;
+        if (assertionRefs(assertion).length > 0) {
+            try {
+                assertion = resolveAssertionRefs(assertion, (name) => (Object.hasOwn(params, name) ? { value: params[name], secret: false } : undefined));
+            }
+            catch (err) {
+                if (err instanceof AssertionRefError)
+                    return "unresolved";
+                throw err;
+            }
+        }
+        if (w.wait !== undefined)
+            return (await waitForOutcome(actor, assertion, w.wait, step)).ending;
+        return (await checkAssertion(actor, assertion)) ? "held" : "timeout";
+    };
+    return {
+        beforeStep: async ({ actor, index }) => {
+            if (!ownWaits(index).some((w) => w.kind === "response"))
+                return;
+            await monitorFor(actor.ability(BrowseTheWebToken).session.page).instrument();
+            stopCapture(actor, index);
+            captures.set(index, monitorFor(actor.ability(BrowseTheWebToken).session.page).startCapture());
+        },
+        afterStep: async ({ actor, index, outcome }) => {
+            try {
+                if (outcome !== "done")
+                    return;
+                for (const w of ownWaits(index)) {
+                    const startedAt = clock.monotonicMs();
+                    let ending = "not-run";
+                    try {
+                        if (w.kind === "page")
+                            ending = await pageWait(actor, w, index + 1);
+                        else {
+                            const capture = captures.get(index);
+                            if (capture !== undefined) {
+                                const { result } = await evaluateNetworkCheckAwaiting(w.check, () => ({ requests: capture.sent(), truncated: capture.truncated }), w.responseTimeoutMs ?? responseTimeoutMs);
+                                ending = result.passed ? "held" : "timeout";
+                            }
+                        }
+                    }
+                    catch {
+                        // A closed or broken page ends the wait. The replay's own next action reports it.
+                    }
+                    record({ site: w.site, ending, waitedMs: Math.round(clock.monotonicMs() - startedAt) });
+                }
+            }
+            finally {
+                stopCapture(actor, index);
+            }
+        },
+    };
+}
+const READ_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/** How long a replay stays open after a write the browser gave up on: the server may still be working, and nothing will say when it stops. */
+const ABORTED_WRITE_GRACE_MS = 2_000;
+/**
+ * How long a replay stays open once a `no-store` response's body has been reported and the browser has not said it ended.
+ * Chromium never says so for such a body the page does not read, but one the page reads, clones or beacons reports its
+ * bytes as they come, so this can be a body still streaming.
+ */
+const RESPONDED_BODY_GRACE_MS = 2_000;
+/** How long a replay waits to watch a page's bodies. It takes milliseconds, so past this the browser is wedged: no body is seen, and the replay carries on. */
+const BODY_WATCH_BOUND_MS = 2_000;
+/** How often a replay waiting for its open writes looks again. */
+const OPEN_WRITE_POLL_MS = 50;
+/** How long the replay that follows a failed independence replay waits: past most of what the failed one started. */
+const QUIET_GAP_MIN_MS = 5_000;
+/** How long a diagnostic read of the page may take: a frozen renderer must not hold up a replay's close. */
+const STORAGE_READ_BOUND_MS = 1_000;
+/** A page can redefine what these read, so anything but a real count is no reading: page text never reaches a report. */
+const isCount = (n) => typeof n === "number" && Number.isSafeInteger(n) && n >= 0;
+/** Key and cookie counts of the page, never a value. Null when the page cannot say in time, or says anything but a count. */
+async function readStorageCounts(page) {
+    let timer;
+    const read = async () => {
+        const [sessionStorageKeys, localStorageKeys, cookies] = await Promise.all([
+            page.evaluate("sessionStorage.length"),
+            page.evaluate("localStorage.length"),
+            page.context().cookies(),
+        ]);
+        return isCount(sessionStorageKeys) && isCount(localStorageKeys) ? { sessionStorageKeys, localStorageKeys, cookies: cookies.length } : null;
+    };
+    try {
+        return await Promise.race([
+            read(),
+            new Promise((resolve) => {
+                timer = clock.setTimeout(() => resolve(null), STORAGE_READ_BOUND_MS);
+            }),
+        ]);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clock.clearTimeout(timer);
+    }
+}
+const lineOfRequest = (method, url) => `${method.toUpperCase()} ${pathOf(url)}`;
+/**
+ * Which writes can land in a later replay and are worth waiting for: to the Journey's own origins, or
+ * on a line it recorded. A line it did not record that repeats within a replay, or was seen repeating
+ * in the base, is the page's background (a keepalive, telemetry), and so is one that stayed open
+ * through both the base and the replay after it (a long-lived connection): those are not waited for.
+ */
+class WriteScope {
+    #origins;
+    #recorded;
+    #background = new Set();
+    constructor(allowedOrigins, recordedLines) {
+        this.#origins = new Set(allowedOrigins.flatMap((o) => {
+            try {
+                return [new URL(o).origin];
+            }
+            catch {
+                return [];
+            }
+        }));
+        this.#recorded = new Set(recordedLines.flatMap((l) => {
+            const m = REQUEST_LINE.exec(l.trim());
+            return m === null ? [] : [lineOfRequest(m[1], m[2])];
+        }));
+    }
+    counts(line, url) {
+        if (this.#recorded.has(line))
+            return true;
+        try {
+            return this.#origins.has(new URL(url).origin);
+        }
+        catch {
+            return false;
+        }
+    }
+    isBackground(line, sentThisReplay) {
+        return !this.#recorded.has(line) && (sentThisReplay >= 2 || this.#background.has(line));
+    }
+    isRecorded(line) {
+        return this.#recorded.has(line);
+    }
+    addBackground(lines) {
+        for (const line of lines)
+            this.#background.add(line);
+    }
+}
+/**
+ * #785: watches one replay for the counts a failed control's diagnostics compare with the base
+ * replay's, and for the writes it still has open. Observation only: it adds listeners and reads
+ * counts, and never acts on the page. It watches the context, so a popup's requests count too.
+ */
+class ReplayProbe {
+    #stepsCompleted = 0;
+    #sessionsOpened = 0;
+    #pageReplaced = false;
+    #writesSent = 0;
+    #writesAnswered = 0;
+    #writesAborted = 0;
+    #before = null;
+    #after = null;
+    #openedPage;
+    #openOptions;
+    #stepsTotal;
+    #relaxedWaits = [];
+    #beforeClose;
+    #scope;
+    #open = new Map();
+    /** Writes in scope the browser has not said ended, by its own request id: the document that sent it, whether the response is `no-store`, and when its body was reported. */
+    #bodies = new Map();
+    /** The opened page's top frame and its latest document, as the browser names them. */
+    #topFrame;
+    #topLoader;
+    #responded = new WeakSet();
+    #requestSeq = 0;
+    #navigationSeq = 0;
+    #sent = new Map();
+    #lastAbortAt;
+    #openAtClose = [];
+    constructor(stepsTotal, beforeClose, scope) {
+        this.#stepsTotal = stepsTotal;
+        this.#beforeClose = beforeClose;
+        this.#scope = scope;
+    }
+    /** The replay opened a browser. */
+    get opened() {
+        return this.#sessionsOpened > 0;
+    }
+    /** Writes in scope the replay still had open as its session closed: each may yet land in the next replay. */
+    get writesInFlightAtClose() {
+        return this.#openAtClose.length;
+    }
+    /** The lines of those writes (`METHOD /path`). */
+    get openLinesAtClose() {
+        return this.#openAtClose;
+    }
+    /** Lines this replay sent more than once and never recorded: the page's own background. */
+    get repeatedLines() {
+        return [...this.#sent].filter(([line, n]) => n >= 2 && this.#scope?.isRecorded(line) !== true).map(([line]) => line);
+    }
+    #openInScope() {
+        // A response with no reported body is a server still working. Playwright's requests can't be matched to the browser's ids, so
+        // this counts by line: as many answered writes as the line has reported bodies that have not ended. It is worked out each time,
+        // so a body that ends stops counting for whichever write was read as answered by it.
+        const bodies = new Map();
+        for (const b of this.#bodies.values())
+            if (b.arrivedAt !== undefined)
+                bodies.set(b.line, (bodies.get(b.line) ?? 0) + 1);
+        const open = [...this.#open.values()].filter((o) => {
+            const left = bodies.get(o.line) ?? 0;
+            if (o.responded !== true || left === 0)
+                return true;
+            bodies.set(o.line, left - 1);
+            return false;
+        });
+        return open.map((o) => o.line).filter((line) => this.#scope?.isBackground(line, this.#sent.get(line) ?? 0) !== true);
+    }
+    /**
+     * Waits for the writes in scope to be answered, new ones they lead to included, up to `boundMs`,
+     * then a moment more after one the browser gave up on: a browser-side abort does not mean the server stopped.
+     * A reported `no-store` body gets a moment too. Past that it reads as answered: Chromium never reports the end of
+     * such a body the page does not read. Any other response keeps the write open until it finishes, so a server that
+     * answers and keeps working is waited for, up to the bound. See "What a proof assumes" in docs/outcomes.md for what is left.
+     */
+    async settleOpenWrites(boundMs) {
+        const startedAt = clock.monotonicMs();
+        while (clock.monotonicMs() - startedAt < boundMs) {
+            const graceUntil = Math.max(this.#lastAbortAt === undefined ? 0 : this.#lastAbortAt + ABORTED_WRITE_GRACE_MS, ...[...this.#bodies.values()].map((b) => (b.arrivedAt === undefined ? 0 : b.arrivedAt + RESPONDED_BODY_GRACE_MS)));
+            const graceLeft = graceUntil - clock.monotonicMs();
+            if (this.#openInScope().length === 0 && graceLeft <= 0)
+                return;
+            await clock.sleep(Math.max(0, Math.min(OPEN_WRITE_POLL_MS, boundMs - (clock.monotonicMs() - startedAt))));
+        }
+    }
+    get openOptions() {
+        return this.#openOptions;
+    }
+    recordWait(ended) {
+        this.#relaxedWaits.push(ended);
+    }
+    /**
+     * Listens for `Network.dataReceived`, the one thing that tells a complete unread `no-store` body from one the server has
+     * not finished: Chromium reports such a body's bytes only when it ends. Any other body reports bytes as they come, and
+     * reaches `requestfinished`, so only `no-store` counts. Observation only: it reads no body. With no CDP, or if this fails
+     * or takes too long, no body is ever seen and the write stays open, which reads `inconclusive` rather than a verdict nothing supports.
+     */
+    async #watchBodies(page) {
+        const context = typeof page?.context === "function" ? page.context() : undefined;
+        if (typeof context?.newCDPSession !== "function")
+            return;
+        const attach = async (target) => {
+            const cdp = await context.newCDPSession(target);
+            cdp.on("Network.requestWillBeSent", ({ requestId, request, loaderId, frameId, type }) => {
+                if (target === page && type === "Document" && requestId === loaderId && (this.#topFrame ?? frameId) === frameId) {
+                    this.#topFrame = frameId;
+                    this.#topLoader = loaderId;
+                }
+                const line = lineOfRequest(request.method, request.url);
+                // A redirect keeps its id, and may have turned the write into a read.
+                if (READ_METHODS.has(request.method.toUpperCase()) || this.#scope?.counts(line, request.url) !== true)
+                    this.#bodies.delete(requestId);
+                else
+                    this.#bodies.set(requestId, { line, loaderId, noStore: false });
+            });
+            cdp.on("Network.responseReceived", ({ requestId, response }) => {
+                const body = this.#bodies.get(requestId);
+                const cacheControl = Object.entries(response.headers).find(([name]) => name.toLowerCase() === "cache-control")?.[1] ?? "";
+                if (body !== undefined)
+                    body.noStore = /(?:^|[\s,])no-store(?:$|[\s,;])/i.test(cacheControl);
+            });
+            cdp.on("Network.dataReceived", ({ requestId }) => {
+                const body = this.#bodies.get(requestId);
+                if (body !== undefined && body.noStore && body.arrivedAt === undefined)
+                    body.arrivedAt = clock.monotonicMs();
+            });
+            cdp.on("Network.loadingFinished", ({ requestId }) => void this.#bodies.delete(requestId));
+            cdp.on("Network.loadingFailed", ({ requestId }) => void this.#bodies.delete(requestId));
+            await cdp.send("Network.enable");
+        };
+        const attaching = async (target) => {
+            let timer;
+            try {
+                await Promise.race([attach(target), new Promise((resolve) => (timer = clock.setTimeout(resolve, BODY_WATCH_BOUND_MS)))]);
+            }
+            catch {
+                // A page that closed first has nothing to watch. Observation never stops a replay.
+            }
+            finally {
+                clock.clearTimeout(timer);
+            }
+        };
+        context.on("page", (popup) => void attaching(popup));
+        await attaching(page);
+    }
+    #watch(session) {
+        const page = session.page;
+        this.#openedPage = page;
+        const context = typeof page?.context === "function" ? page.context() : undefined;
+        const source = (typeof context?.on === "function" ? context : page);
+        if (typeof source?.on !== "function")
+            return;
+        const isWrite = (r) => !READ_METHODS.has(r.method().toUpperCase());
+        // Only the opened page's top frame replaces the document that sent a write. A frame or a popup starting to load does not,
+        // and Playwright throws for a popup's first request. Anything it can't say keeps the write open.
+        const startsNewDocument = (r) => {
+            try {
+                const top = page?.mainFrame?.();
+                return top !== undefined && r.isNavigationRequest?.() === true && r.frame?.() === top;
+            }
+            catch {
+                return false;
+            }
+        };
+        source.on("request", (r) => {
+            this.#requestSeq += 1;
+            if (startsNewDocument(r))
+                this.#navigationSeq = this.#requestSeq;
+            if (!isWrite(r))
+                return;
+            this.#writesSent += 1;
+            const line = lineOfRequest(r.method(), r.url());
+            this.#sent.set(line, (this.#sent.get(line) ?? 0) + 1);
+            if (this.#scope?.counts(line, r.url()) === true)
+                this.#open.set(r, { line, seq: this.#requestSeq });
+        });
+        // A new document drops what the old one had open, and the browser may report nothing: that is an abort too.
+        if (typeof page?.on === "function") {
+            page.on("domcontentloaded", () => {
+                for (const [r, o] of this.#open) {
+                    if (o.seq >= this.#navigationSeq)
+                        continue;
+                    this.#open.delete(r);
+                    this.#lastAbortAt = clock.monotonicMs();
+                }
+                // A body an older document had reported may never say it ended. The new document's own writes keep theirs, and with no way to tell whose it is, it goes, which reads as open.
+                for (const [id, b] of this.#bodies)
+                    if (b.arrivedAt !== undefined && (b.loaderId === undefined || b.loaderId !== this.#topLoader))
+                        this.#bodies.delete(id);
+            });
+        }
+        source.on("response", (res) => {
+            const r = res.request();
+            if (!isWrite(r))
+                return;
+            this.#writesAnswered += 1;
+            this.#responded.add(r);
+            const open = this.#open.get(r);
+            if (open !== undefined)
+                open.responded = true;
+        });
+        source.on("requestfinished", (r) => {
+            if (!isWrite(r))
+                return;
+            if (!this.#responded.has(r))
+                this.#writesAnswered += 1;
+            this.#open.delete(r);
+        });
+        source.on("requestfailed", (r) => {
+            if (!isWrite(r))
+                return;
+            // Answered, then the page stopped reading: it was no dropped write, but the server may still be working.
+            if (this.#responded.has(r)) {
+                if (this.#open.delete(r))
+                    this.#lastAbortAt = clock.monotonicMs();
+                return;
+            }
+            this.#writesAborted += 1;
+            // A block of ours never left the browser. Any other abort may have reached the server, which goes on working.
+            if (this.#open.delete(r) && r.failure?.()?.errorText.includes("BLOCKED_BY_CLIENT") !== true)
+                this.#lastAbortAt = clock.monotonicMs();
+        });
+    }
+    /** The port factory with this probe on every session it opens, reading the final page before it closes. */
+    wrap(factory) {
+        return () => {
+            const port = factory();
+            return {
+                open: async (o) => {
+                    this.#sessionsOpened += 1;
+                    try {
+                        this.#openOptions = JSON.stringify(o);
+                    }
+                    catch {
+                        // Options that cannot be compared stay unknown: observation never stops a replay.
+                    }
+                    const session = await port.open(o);
+                    this.#watch(session);
+                    await this.#watchBodies(session.page);
+                    return new Proxy(session, {
+                        get: (target, prop) => {
+                            const value = Reflect.get(target, prop, target);
+                            if (prop === "close") {
+                                return async () => {
+                                    await this.#beforeClose?.(this.#writesSent);
+                                    this.#openAtClose = this.#openInScope();
+                                    if (typeof target.page?.evaluate === "function")
+                                        this.#after = await readStorageCounts(target.page);
+                                    return target.close();
+                                };
+                            }
+                            return typeof value === "function" ? value.bind(target) : value;
+                        },
+                    });
+                },
+            };
+        };
+    }
+    observer() {
+        return {
+            afterStep: async ({ actor, index, outcome }) => {
+                if (outcome !== "done")
+                    return;
+                this.#stepsCompleted += 1;
+                const page = actor.ability(BrowseTheWebToken).session.page;
+                if (this.#openedPage !== undefined && page !== this.#openedPage)
+                    this.#pageReplaced = true;
+                if (index === this.#stepsTotal - 1 && typeof page?.evaluate === "function")
+                    this.#before = await readStorageCounts(page);
+            },
+        };
+    }
+    read() {
+        if (this.#sessionsOpened === 0)
+            return undefined;
+        return {
+            stepsTotal: this.#stepsTotal,
+            stepsCompleted: this.#stepsCompleted,
+            sessionsOpened: this.#sessionsOpened,
+            pageReplaced: this.#pageReplaced,
+            writesSent: this.#writesSent,
+            writesAnswered: this.#writesAnswered,
+            writesAborted: this.#writesAborted,
+            writesUnfinished: Math.max(0, this.#writesSent - this.#writesAnswered - this.#writesAborted),
+            storageBeforeEndState: this.#before,
+            storageAfterEndState: this.#after,
+            relaxedWaits: [...this.#relaxedWaits],
+        };
+    }
+}
+/**
+ * One replay's time against the base's (`ReplayPace`), from `originIndex`'s start. As each step ends it
+ * holds the replay to `floor`, then notes how long it had taken. Observation and waiting only: it never
+ * acts on the page or changes how a step ended.
+ */
+class ReplayPacer {
+    originIndex;
+    floor;
+    beforeOriginMs;
+    notHeld;
+    /** Ms from the origin to each step's end. */
+    reachedMs = [];
+    /** Ms from the origin to each step's start: when the replay got to that site. */
+    arrivedMs = [];
+    /** How long this replay had been held for when it got to each step. */
+    heldMs = [];
+    /** Ms from the origin to the moment each step's own claim had held. */
+    claimHeldMs = [];
+    endStateReachedMs;
+    endStateHeldMs;
+    #heldSoFar = 0;
+    #firstStepAt;
+    #originAt;
+    constructor(originIndex, floor, 
+    /** How long the base took to reach the origin: what a replay that stopped before it is measured against. */
+    beforeOriginMs = 0, 
+    /** A step nothing reads the time after: it is not held, and counts as if it had been. */
+    notHeld = () => false) {
+        this.originIndex = originIndex;
+        this.floor = floor;
+        this.beforeOriginMs = beforeOriginMs;
+        this.notHeld = notHeld;
+    }
+    /** Ms since this replay's first step began. */
+    elapsedMs() {
+        return this.#firstStepAt === undefined ? 0 : clock.monotonicMs() - this.#firstStepAt;
+    }
+    /** Holds until `untilMs` from the origin. A replay that stopped before the origin counts from its first step, as far as the base's origin. */
+    async hold(untilMs) {
+        if (untilMs === undefined)
+            return;
+        const left = this.#originAt !== undefined ? untilMs - (clock.monotonicMs() - this.#originAt) : this.#firstStepAt === undefined ? 0 : untilMs + this.beforeOriginMs - this.elapsedMs();
+        if (left <= 0)
+            return;
+        await clock.sleep(left);
+        this.#heldSoFar += left;
+    }
+    /** Time the replay spent waiting for something it would not otherwise have waited for, counted as held. */
+    async holding(wait) {
+        const startedAt = clock.monotonicMs();
+        await wait();
+        this.#heldSoFar += clock.monotonicMs() - startedAt;
+    }
+    /** Notes how long the replay had taken to get to its end state. */
+    noteEndState() {
+        if (this.#originAt === undefined)
+            return;
+        this.endStateReachedMs = clock.monotonicMs() - this.#originAt;
+        this.endStateHeldMs = this.#heldSoFar;
+    }
+    /** First among a replay's observers, so it sees a step's claim hold before anything else that step waits for. */
+    claimObserver() {
+        return {
+            afterStep: async ({ index, outcome }) => {
+                if (this.#originAt !== undefined && outcome === "done")
+                    this.claimHeldMs[index] = clock.monotonicMs() - this.#originAt;
+            },
+        };
+    }
+    observer() {
+        return {
+            beforeStep: async ({ index }) => {
+                this.#firstStepAt ??= clock.monotonicMs();
+                if (index === this.originIndex)
+                    this.#originAt = clock.monotonicMs();
+                if (this.#originAt !== undefined) {
+                    this.arrivedMs[index] = clock.monotonicMs() - this.#originAt;
+                    this.heldMs[index] = this.#heldSoFar;
+                }
+            },
+            afterStep: async ({ index, outcome }) => {
+                if (this.#originAt === undefined)
+                    return;
+                const floor = this.floor(index);
+                if (outcome === "done" && !this.notHeld(index))
+                    await this.hold(floor);
+                const reached = clock.monotonicMs() - this.#originAt;
+                this.reachedMs[index] = outcome === "done" && this.notHeld(index) ? Math.max(reached, floor ?? 0) : reached;
+            },
+        };
+    }
+}
+/**
+ * What a proof that reaches a verdict runs when nothing needs more: the base, the independence replay,
+ * one per mutation, and the closing replay, which only a verdict that can still change gets. Relaxed and
+ * targeted replays, controls and re-runs add to it. A proof that fails or is tainted partway stops sooner.
+ */
+function minimumReplaysOf(plan) {
+    if (plan.mutations.length === 0)
+        return 1;
+    return plan.mutations.length + (plan.pairs.length === 0 ? 2 : 3);
+}
+/**
+ * How many of those replays can send a real write: all but a mutation that removes the Journey's only
+ * write step. Replays that stop at an earlier failure send less, so this is what they can send, not what they will.
+ */
+function writeReplaysOf(plan, writeSteps) {
+    if (writeSteps.length === 0)
+        return 0;
+    const removesEveryWrite = (m) => (m.kind === "skip" || m.kind === "block-write") && writeSteps.every((w) => w.step === m.step);
+    return minimumReplaysOf(plan) - plan.mutations.filter(removesEveryWrite).length;
+}
+/** The one line a proof with no reset hook or fixture prints, in `--plan` and in its report. */
+export function verifyNoResetLine(summary) {
+    const more = summary.writeReplays === 0 ? "" : " (relaxed replays, controls and re-runs can add more)";
+    return `no reset hook or fixture: nothing undoes what a replay writes, and ${summary.writeReplays} of the ${summary.minimumReplays} planned replays can send real writes${more}`;
+}
 /**
  * Static preview of `journey verify --mutate`: no browser, fixtures, hooks, target, session or
  * credential is opened. Values of params are used only to derive the plan and are never returned.
@@ -47,7 +764,8 @@ export async function planJourneyVerification(opts) {
             pairs: pairs.length,
             assertions: assertions.length,
             unpaired: assertions.filter((assertion) => assertion.mutations.length === 0).length,
-            minimumReplays: plan.mutations.length + 1,
+            minimumReplays: minimumReplaysOf(plan),
+            writeReplays: writeReplaysOf(plan, journeyWriteSteps(journey, opts.readRequests === undefined ? {} : { readRequests: opts.readRequests })),
         },
     };
 }
@@ -84,115 +802,420 @@ function failedSitesOf(result, failures) {
 /**
  * Runs the proof for one Journey by id. Usage errors (unknown id, bad params, an environment that
  * refuses a step, a site-gate refusal) throw exactly as `journey run`'s do, before any mutation.
+ * The proof keeps its machine slot between replays unless another process waits for it (#766), so
+ * one admission wait cannot cost a proof that took 100 minutes to get there.
  */
 export async function verifyJourneyMutations(opts, run = runJourneyProgrammatically) {
-    const journey = await new JourneyRegistry(new FsJourneyStore(opts.dir)).get(opts.id);
-    if (!journey)
-        throw new UnknownJourneyError(`unknown journey '${opts.id}'`);
-    // #711: receipt authority is proven before the first baseline/mutation replay spends a browser.
-    const receiptDestination = await preflightVerifyRecord(opts.dir, journey.metadata.id);
-    const { readRequests, ...runOpts } = opts;
-    const lintOpts = readRequests === undefined ? {} : { readRequests };
-    const journeyHash = journeyContentHash(journey);
-    const base = await run(runOpts, { structuredFailures: true });
-    const baseFields = { outcome: base.outcome, ...(base.outcome === "quarantined" ? { reason: base.reason } : {}) };
-    const sites = journeyAssertions(journey);
-    const checkOf = new Map(sites.map((s) => [assertionSiteKey(s), describeCheck(s.check)]));
-    const plan = planJourneyMutations(journey, { ...lintOpts, params: opts.params });
-    const mutations = [];
-    // #616: automatic targeted proofs stopped at their relaxation bound, each a reviewable start.
-    const suggested = [];
-    const seenSuggestions = new Set();
-    if (base.outcome === "ok") {
-        // #565: a param mutation's replay runs with altered params (never a secret's), so it needs them.
-        const replayOpts = { ...lintOpts, params: opts.params };
-        // The replay is DESCRIBED, not fixed: `mutateJourney` re-describes it on the Journey the run moved
-        // onto the environment (#247), so a mutated copy never drops `--env`/`--base-url`.
-        const runReplay = async (m, describe) => {
-            try {
-                const how = describe(journey);
-                const r = await run(how.params === undefined ? runOpts : { ...runOpts, params: { ...how.params } }, {
-                    structuredFailures: true,
-                    ...(how.relaxedStepRequests === undefined ? {} : { relaxedStepRequests: how.relaxedStepRequests }),
-                    ...(how.journey === journey ? {} : { mutateJourney: (j) => describe(j).journey }),
-                    ...(how.skipIndex === undefined ? {} : { skipStep: (i) => i === how.skipIndex }),
-                    ...(how.swapSelectAtStep === undefined ? {} : { selectAlternativeAtStep: how.swapSelectAtStep }),
-                    ...(how.blockIndex === undefined ? {} : { blockWritesAtStep: how.blockIndex }),
-                });
-                const blocked = r.blockedWrites ?? [];
-                const blockedFields = how.blockIndex === undefined ? {} : { blockedWrites: blocked.map((b) => `${b.method} ${b.path}`) };
-                // #579: a select mutation found no other enabled live option — not applied, never proof.
-                if (r.outcome === "quarantined" && /no-alternative/.test(r.reason)) {
-                    return { outcome: "not-applied", failedSites: [], ...blockedFields, reason: r.reason };
-                }
-                if (how.blockIndex !== undefined && !blockedOwnWrite(how.blockRequests ?? [], blocked)) {
-                    return {
-                        outcome: "not-applied",
-                        failedSites: [],
-                        ...blockedFields,
-                        reason: `step ${m.step}'s own write was not blocked${(how.blockRequests ?? []).length === 0 ? "" : ` (recorded: ${(how.blockRequests ?? []).join(", ")})`}`,
-                    };
-                }
-                return {
-                    outcome: r.outcome === "quarantined" ? "failed" : "passed",
-                    failedSites: failedSitesOf(r, r.outcomeFailures ?? []),
-                    ...blockedFields,
-                    ...(r.outcome === "quarantined" ? { reason: r.reason } : {}),
-                };
-            }
-            catch (err) {
-                return { outcome: "error", failedSites: [], reason: err instanceof Error ? err.message : String(err) };
-            }
+    const endHold = (opts.slotGovernor ?? sharedResourceGovernor()).holdSlotBetweenSessions();
+    const owned = {};
+    try {
+        return await proveJourneyMutations(opts, run, owned);
+    }
+    catch (err) {
+        // In an MCP server the process outlives the proof, so its pid no longer says the proof is running.
+        owned.session?.interrupted();
+        throw err;
+    }
+    finally {
+        endHold();
+    }
+}
+function paramsAccepted(journey, params) {
+    try {
+        validateParams(journeyParamSchema(journey), params);
+        return true;
+    }
+    catch (err) {
+        if (err instanceof ParamValidationError)
+            return false;
+        throw err;
+    }
+}
+const CROSSED = "so state from one replay may cross into the next (a job it started, by any route, still running); isolate the replays or let the job end, and run the proof again";
+/** Why a replay may have decided another, from names alone, so an interrupted proof can give the same reason. */
+export function isolationReason(note, by, openLines = []) {
+    const open = `closed with a write still unanswered${openLines.length === 0 ? "" : ` (${openLines.join(", ")})`}, which may land inside a later replay; the proof cannot say which replay it decided`;
+    if (note === "write-open")
+        return `a replay of ${by ?? "a mutation"} ${open}`;
+    if (note === "independence-write-open")
+        return `the independence replay (the Journey as recorded, straight after the base) ${open}`;
+    if (note === "control-write-open")
+        return `the control for ${by ?? "a mutation"} (the Journey as recorded, no mutation applied) ${open}`;
+    if (note === "base-write-open")
+        return `the base replay ${open}`;
+    if (note === "state-crossed")
+        return `the Journey as recorded failed straight after the base replay and passed after a quiet gap, ${CROSSED}`;
+    if (note === "state-stuck")
+        return `the Journey as recorded no longer passes after the base replay, ${CROSSED}`;
+    if (note === "independence-errored")
+        return "the replay as recorded after the base errored, so the proof cannot say the replays are independent; retry it (--resume keeps what finished and runs this replay again)";
+    return "sibling mutations disagree on a site, and a control and a re-run could not settle it; run the proof again";
+}
+/** A pair's result from its checkpoint, in the report's shape. */
+function reusedMutation(pair) {
+    return {
+        kind: pair.kind,
+        step: pair.step,
+        id: pair.id,
+        ...(pair.param === undefined ? {} : { param: pair.param }),
+        ...(pair.source === undefined ? {} : { source: pair.source }),
+        ...reusedProofFields(pair),
+        ...(pair.retries === 0 ? {} : { retries: Array.from({ length: pair.retries }, () => ({ reason: RETRY_REASON_NOT_KEPT })) }),
+        reused: true,
+    };
+}
+const isUnmutated = (kind) => kind === "control" || kind === "targeted-control" || kind === "independence";
+const labelOf = (m, kind) => {
+    if (kind === "control" || kind === "targeted-control")
+        return `control for step ${m.step}`;
+    if (kind === "independence")
+        return "independence replay, as recorded";
+    if (kind === "rerun")
+        return `${m.id} (re-run)`;
+    if (kind === "at-base-time")
+        return `${m.id} (at the base's time)`;
+    return m.id;
+};
+/** Which replay left a write open, as the taint records it: an unmutated replay applied no mutation, so none is blamed. */
+const openWriteOwner = (m, kind) => kind === "independence" ? ["independence-write-open", null] : kind === "control" || kind === "targeted-control" ? ["control-write-open", m.id] : ["write-open", m.id];
+const resultOfEntry = (m) => ({
+    outcome: m.outcome,
+    failedSites: m.failedSites,
+    ...(m.waitsCut === undefined ? {} : { waitsCut: m.waitsCut }),
+    ...(m.relaxed === undefined ? {} : { relaxed: m.relaxed }),
+    ...(m.targeted === undefined ? {} : { targeted: m.targeted }),
+    ...(m.atBaseTime === undefined ? {} : { atBaseTime: m.atBaseTime }),
+});
+/**
+ * A paced replay waits as long as the proof says, not as long as the Journey does, so a wait that ran out
+ * says both. For the reader only: nothing reads `reason` for a verdict but `failedSitesOf`, which is given the run's own.
+ */
+function withStatedWaitLimit(reason, at, journey) {
+    const step = at === undefined ? undefined : flatJourneySteps(journey)[at]?.recorded.step;
+    const stated = step !== undefined && "waitFor" in step ? step.waitFor?.maxMs : undefined;
+    return reason.replace(/\(waitFor maxMs (\d+)\); it never held/, (whole, limit) => Number(limit) === stated ? whole : `(this replay's waitFor maxMs ${limit}; the Journey's ${stated === undefined ? "sets none" : `is ${stated}`}); it never held`);
+}
+const reported = ({ reachedMs: _reachedMs, arrivedMs: _arrivedMs, heldMs: _heldMs, endStateReachedMs: _end, endStateHeldMs: _endHeld, marginMs: _margin, ...result }) => result;
+// The replay is DESCRIBED, not fixed: `mutateJourney` re-describes it on the Journey the run moved
+// onto the environment (#247), so a mutated copy never drops `--env`/`--base-url`.
+async function attemptReplay(c, m, describe, retry, kind, matchTo) {
+    const { opts, runOpts, journey, pace, stepsTotal, settleBoundMs, writeScope, writeSteps, baseProbe, boundedRun, taint } = c;
+    const lastIndex = stepsTotal - 1;
+    const baseOpenLines = baseProbe.openLinesAtClose;
+    const noEndState = journeyEndState(journey).length === 0;
+    let opened;
+    // What a replay left open may land in the next one, however the replay ended.
+    const checkWritesLeftOpen = (p) => {
+        c.noteWritesInFlight(p.writesInFlightAtClose);
+        if (kind === "independence")
+            c.noteIndependenceOpen(p.openLinesAtClose);
+        const excused = kind === "independence" && p.openLinesAtClose.every((line) => baseOpenLines.includes(line));
+        if (p.writesInFlightAtClose > 0 && !excused) {
+            const [note, by] = openWriteOwner(m, kind);
+            taint(note, by, isolationReason(note, by, p.openLinesAtClose));
+        }
+    };
+    try {
+        const paced = (j) => pacedReplay(j, describe(j), m, pace);
+        const how = paced(journey);
+        const withMargin = kind !== "at-base-time";
+        // Nothing reads the time after a last step with no end state, so holding it would only cost.
+        // A control also gets to each site no sooner than the mutated replay it answers for did, dead waits included.
+        const atLeast = (floor, arrival) => (floor === undefined || arrival === undefined ? (floor ?? arrival) : Math.max(floor, arrival));
+        const pacer = new ReplayPacer(m.step - 1, (index) => atLeast(paceFloorMs(pace, m, index, withMargin), matchTo?.arrivedMs?.[index + 1]), paceBeforeMutationMs(pace, m), (index) => index === lastIndex && noEndState);
+        // #785: a control's counts say, on failure, what it did against the base replay. Any replay that
+        // sent a write stays open as long as the base did, then until its writes have settled, so what it
+        // started lands before its restore.
+        const probe = new ReplayProbe(stepsTotal, async (writesSent) => {
+            if (writesSent > 0)
+                await pacer.hold(paceTailMs(pace, m));
+            await probe.settleOpenWrites(settleBoundMs);
+        }, writeScope);
+        opened = probe;
+        // Described on the Journey the run moved onto the environment, as the mutated copy is.
+        let waits = how.relaxedSiteWaits ?? [];
+        const params = how.params ?? opts.params;
+        const observer = composeObservers(waits.length === 0 ? undefined : relaxedWaitObserver(() => waits, params, opts.stepResponseTimeoutMs ?? DEFAULT_STEP_RESPONSE_TIMEOUT_MS, (ended) => probe.recordWait(ended)), isUnmutated(kind) ? probe.observer() : undefined, pacer.observer());
+        // The step's own lines stay blocked for the rest of the replay. A later step that records the same line sends its own.
+        const blockLines = how.blockRequests ?? [];
+        const lineOfRecorded = (line) => {
+            const parsed = REQUEST_LINE.exec(line.trim());
+            return parsed === null ? undefined : lineOfRequest(parsed[1], parsed[2]);
         };
-        // #402: a named mutation lowers to its `MutationReplay`; #609's targeted proof passes one directly.
-        const replay = (m, describe) => runReplay(m, (j) => describe(j, m, replayOpts));
-        const siteByKey = new Map(sites.map((s) => [assertionSiteKey(s), s]));
-        for (const m of plan.mutations) {
-            const first = await replay(m, mutationReplay);
-            // #554: a first failure at the mutated step's own postcondition hides the LATER paired sites
-            // behind it; one relaxed replay (same action, the step's own expect/waitFor left out) judges them.
-            const relaxed = needsRelaxedReplay(plan, m, first) ? await replay(m, relaxedMutationReplay) : undefined;
-            const initial = { outcome: first.outcome, failedSites: first.failedSites, ...(relaxed === undefined ? {} : { relaxed }) };
-            // #609: a later assertion still a `cascade` is only hidden by an earlier postcondition; a
-            // targeted proof relaxes them one at a time (in a clone) to reach the target itself.
-            const targeted = [];
-            for (const pair of plan.pairs) {
-                if (pair.mutation !== m.id)
-                    continue;
-                const site = siteByKey.get(pair.site);
-                if (site === undefined || classifyMutation(site, m, initial) !== "cascade")
-                    continue;
-                // #616: a declared plan (reviewed earlier relaxations) replaces the automatic bound search.
-                const declared = declaredTargetedProofFor(journey, m, pair.site);
-                targeted.push(declared === undefined
-                    ? await runTargetedProof(journey, plan, m, site, initial, (describe) => runReplay(m, describe), replayOpts)
-                    : await runDeclaredTargetedProof(journey, plan, m, site, declared, (describe) => runReplay(m, describe), replayOpts));
-                // #616: a proof the automatic bound stopped names the plan a human could declare instead.
-                const suggestion = suggestTargetedProofPlan(targeted[targeted.length - 1], m);
-                if (suggestion !== null) {
-                    const key = `${suggestion.check}\u0000${suggestion.mustFailWhen}\u0000${suggestion.relax.join(",")}`;
-                    if (!seenSuggestions.has(key)) {
-                        seenSuggestions.add(key);
-                        suggested.push(suggestion);
-                    }
-                }
+        const heldLines = blockLines.flatMap((l) => lineOfRecorded(l) ?? []);
+        const r = await boundedRun({ ...runOpts, ...(how.params === undefined ? {} : { params: { ...how.params } }), observer }, {
+            structuredFailures: true,
+            beforeEndState: async () => {
+                await pacer.hold(atLeast(paceEndStateFloorMs(pace, m, withMargin), matchTo?.endStateReachedMs));
+                // A claim is judged with what the app was already doing finished, as far as the Journey allows.
+                await pacer.holding(() => probe.settleOpenWrites(settleBoundMs));
+                pacer.noteEndState();
+            },
+            ...(how.relaxedStepRequests === undefined ? {} : { relaxedStepRequests: how.relaxedStepRequests }),
+            ...(how.journey === journey
+                ? {}
+                : {
+                    mutateJourney: (j) => {
+                        const onEnvironment = paced(j);
+                        waits = onEnvironment.relaxedSiteWaits ?? [];
+                        return onEnvironment.journey;
+                    },
+                }),
+            ...(how.skipIndex === undefined ? {} : { skipStep: (i) => i === how.skipIndex }),
+            ...(how.swapSelectAtStep === undefined ? {} : { selectAlternativeAtStep: how.swapSelectAtStep }),
+            ...(how.blockIndex === undefined
+                ? {}
+                : {
+                    blockWritesAtStep: how.blockIndex,
+                    blockAfterWindow: {
+                        requests: heldLines,
+                        exemptSteps: writeSteps.filter((w) => w.step - 1 !== how.blockIndex && w.requests.some((l) => { const line = lineOfRecorded(l); return line !== undefined && heldLines.includes(line); })).map((w) => w.step - 1),
+                    },
+                }),
+        }, { id: labelOf(m, kind) }, retry, probe);
+        checkWritesLeftOpen(probe);
+        const blocked = r.blockedWrites ?? [];
+        const blockedFields = how.blockIndex === undefined ? {} : { blockedWrites: blocked.map((b) => `${b.method} ${b.path}`) };
+        // #579: a select mutation found no other enabled live option — not applied, never proof.
+        if (r.outcome === "quarantined" && /no-alternative/.test(r.reason)) {
+            return { outcome: "not-applied", failedSites: [], ...blockedFields, reason: r.reason };
+        }
+        if (how.blockIndex !== undefined && !blockedOwnWrite(how.blockRequests ?? [], blocked)) {
+            return {
+                outcome: "not-applied",
+                failedSites: [],
+                ...blockedFields,
+                reason: `step ${m.step}'s own write was not blocked${(how.blockRequests ?? []).length === 0 ? "" : ` (recorded: ${(how.blockRequests ?? []).join(", ")})`}`,
+            };
+        }
+        // The block did not hold: a server answered the step's own write after its window.
+        if (how.blockIndex !== undefined && (r.blockEscaped?.length ?? 0) > 0) {
+            return { outcome: "not-applied", failedSites: [], ...blockedFields, reason: `step ${m.step}'s own write was answered after it was blocked (${r.blockEscaped.join(", ")}), so the mutation did not hold` };
+        }
+        const failedSites = failedSitesOf(r, r.outcomeFailures ?? []);
+        const early = isUnmutated(kind) ? [] : sitesReachedEarly(failedSites, m, pace, pacer.reachedMs, pacer.endStateReachedMs);
+        const control = r.outcome === "quarantined" && isUnmutated(kind) ? probe.read() : undefined;
+        const baseDiagnostics = baseProbe.read();
+        const contextOptionsMatchBase = baseProbe.openOptions === undefined || probe.openOptions === undefined ? undefined : baseProbe.openOptions === probe.openOptions;
+        return {
+            outcome: r.outcome === "quarantined" ? "failed" : "passed",
+            failedSites,
+            ...blockedFields,
+            ...(r.outcome === "quarantined" ? { reason: withStatedWaitLimit(r.reason, r.at, journey) } : {}),
+            ...(early.length === 0 ? {} : { waitsCut: early }),
+            reachedMs: pacer.reachedMs,
+            arrivedMs: pacer.arrivedMs,
+            heldMs: pacer.heldMs,
+            marginMs: paceMarginOf(pace, m),
+            ...(pacer.endStateReachedMs === undefined ? {} : { endStateReachedMs: pacer.endStateReachedMs }),
+            ...(pacer.endStateHeldMs === undefined ? {} : { endStateHeldMs: pacer.endStateHeldMs }),
+            ...(control === undefined
+                ? {}
+                : {
+                    diagnostics: {
+                        failedSites: failedSites.map(siteKeyOf),
+                        control,
+                        ...(baseDiagnostics === undefined ? {} : { base: baseDiagnostics }),
+                        ...(contextOptionsMatchBase === undefined ? {} : { contextOptionsMatchBase }),
+                    },
+                }),
+        };
+    }
+    catch (err) {
+        // A stall ends the proof: it never reads as one mutation's error, which could still end `proven`.
+        if (err instanceof JourneyVerifyStalledError) {
+            // A stall leaves a resumable checkpoint, so what the replay left open has to be on it. A replay whose close
+            // never finished (a frozen renderer, a hold) can't say what was open: that counts as open.
+            if (opened !== undefined && err.sessionsClosed)
+                checkWritesLeftOpen(opened);
+            else if (opened !== undefined && opened.opened)
+                taint(...openWriteOwner(m, kind));
+            throw err;
+        }
+        if (opened !== undefined)
+            checkWritesLeftOpen(opened);
+        return { outcome: "error", failedSites: [], reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+/** One planned mutation with all its replays: first, relaxed, control, at the base's time, targeted. */
+async function runPair(c, m) {
+    const { journey, plan, pace, siteByKey, replayOpts, mutations, checkpoint, tainted, replay, runReplay, controlFor, resultsSoFar, noteSuggestion, retriesOf, pairReplays } = c;
+    checkpoint?.startPair(m.id);
+    pairReplays.length = 0;
+    const firstRun = await replay(m, mutationReplay, "first");
+    // #554: a first failure at the mutated step's own postcondition hides the LATER paired sites
+    // behind it; one relaxed replay (same action, the step's own expect/waitFor left out) judges them.
+    const relaxedRun = !tainted() && needsRelaxedReplay(plan, m, firstRun) ? await replay(m, relaxedMutationReplay, "relaxed") : undefined;
+    const resultOf = (f, r) => ({ outcome: f.outcome, failedSites: f.failedSites, ...(f.waitsCut === undefined ? {} : { waitsCut: f.waitsCut }), ...(r === undefined ? {} : { relaxed: r }) });
+    // The sites this mutation reads sensitive that a matched control must vouch for: thin, or held.
+    const provisional = resultOf(firstRun, relaxedRun);
+    const wouldCount = new Set(plan.pairs.filter((p) => p.mutation === m.id).map((p) => p.site).filter((key) => {
+        const site = siteByKey.get(key);
+        return site !== undefined && classifyMutation(site, m, provisional) === "sensitive";
+    }));
+    const needing = (r) => [...new Set([...thinSites(r.failedSites, m, pace, r.reachedMs ?? [], r.endStateReachedMs), ...heldSites(r.failedSites, r)])].filter((key) => wouldCount.has(key));
+    const atStake = [...new Set([...needing(firstRun), ...(relaxedRun === undefined ? [] : needing(relaxedRun))])];
+    const wanted = atStake.length > 0;
+    const canChange = (keys) => !tainted() && controlCanChangeVerdict(journey, plan, resultsSoFar([m.id, provisional]), keys);
+    const fresh = wanted && canChange(atStake) ? await controlFor(m, relaxedRun === undefined ? [firstRun] : [firstRun, relaxedRun], atStake) : undefined;
+    const checked = async (r, describe) => {
+        if (fresh === undefined)
+            return r;
+        const keys = needing(r);
+        if (keys.length === 0)
+            return r;
+        const held = r.failedSites.filter((f) => keys.includes(siteKeyOf(f)));
+        const cut = fresh.outcome === "passed" ? sitesUnmatchedBy(held, r, fresh, paceMarginOf(pace, m)) : keys;
+        if (cut.length === 0)
+            return r;
+        const withCut = { ...r, waitsCut: [...new Set([...(r.waitsCut ?? []), ...cut])] };
+        // The unmutated replay failed at this very site on these floors, so the hold may be what broke it. Only
+        // the mutation at the base's own time can say the claim holds without it.
+        const controlFailedHere = fresh.outcome === "failed" && cut.some((key) => fresh.failedSites.some((f) => siteKeyOf(f) === key));
+        if (!controlFailedHere || !canChange(cut))
+            return withCut;
+        const timed = await replay(m, describe, "at-base-time");
+        return { ...withCut, atBaseTime: { outcome: timed.outcome, failedSites: timed.failedSites } };
+    };
+    const first = reported(await checked(firstRun, mutationReplay));
+    const relaxed = relaxedRun === undefined ? undefined : reported(await checked(relaxedRun, relaxedMutationReplay));
+    const controlFields = fresh === undefined ? {} : { control: fresh.outcome, ...(fresh.diagnostics === undefined ? {} : { controlDiagnostics: fresh.diagnostics }) };
+    const initial = { ...resultOf(first, relaxed), ...(first.atBaseTime === undefined ? {} : { atBaseTime: first.atBaseTime }), ...controlFields };
+    // #609: a later assertion still a `cascade` is only hidden by an earlier postcondition; a
+    // targeted proof relaxes them one at a time (in a clone) to reach the target itself.
+    const targeted = [];
+    // One replay per set of relaxations: sites of this mutation that relax the same ones share it, and its control.
+    const targetedRuns = new Map();
+    const targetedReplay = (describe, kind, key) => {
+        const memoKey = `${kind}\u0000${key ?? ""}`;
+        const known = targetedRuns.get(memoKey);
+        if (known !== undefined)
+            return known;
+        // The proof is already over: a targeted proof's next replay is not run, and whatever it reads, the verdict is decided.
+        if (tainted())
+            return Promise.resolve({ outcome: "error", failedSites: [], reason: "not run: the proof had already ended" });
+        // A control runs after the targeted replay it answers for, and gets to each site no sooner than it did.
+        const running = kind === "control" ? (targetedRuns.get(`targeted\u0000${key ?? ""}`) ?? Promise.resolve(undefined)).then((run) => runReplay(m, describe, "targeted-control", run)) : runReplay(m, describe, "targeted");
+        targetedRuns.set(memoKey, running);
+        return running;
+    };
+    for (const pair of plan.pairs) {
+        if (tainted())
+            break;
+        if (pair.mutation !== m.id)
+            continue;
+        const site = siteByKey.get(pair.site);
+        if (site === undefined || classifyMutation(site, m, initial) !== "cascade")
+            continue;
+        // #616: a declared plan (reviewed earlier relaxations) replaces the automatic bound search.
+        const declared = declaredTargetedProofFor(journey, m, pair.site);
+        targeted.push(declared === undefined
+            ? await runTargetedProof(journey, plan, m, site, initial, targetedReplay, replayOpts)
+            : await runDeclaredTargetedProof(journey, plan, m, site, declared, targetedReplay, replayOpts));
+        noteSuggestion(targeted[targeted.length - 1], m);
+    }
+    const finished = {
+        kind: m.kind,
+        step: m.step,
+        id: m.id,
+        ...(m.param === undefined ? {} : { param: m.param }),
+        ...(m.source === undefined ? {} : { source: m.source }),
+        ...first,
+        ...(relaxed === undefined ? {} : { relaxed }),
+        ...controlFields,
+        ...(wanted && fresh === undefined && !tainted() ? { controlSkipped: true } : {}),
+        ...(targeted.length === 0 ? {} : { targeted }),
+        ...(retriesOf.has(m.id) ? { retries: retriesOf.get(m.id) } : {}),
+    };
+    mutations.push(finished);
+    // A tainted proof ends here, and a pair cut short by the taint is not a result a resume could stand on.
+    if (!tainted())
+        checkpoint?.finishPair(checkpointPairOf(finished, pairReplays));
+}
+/**
+ * Point 3 of the experiment: one sibling failed a site another passed. The reading stands only if a
+ * matched control passes and the failure reproduces on one re-run. If it does not reproduce, the
+ * failure is struck and the site falls to the sibling's pass: `insensitive`, since a replay that
+ * passed with the mutation applied saw the claim hold without it, twice over. If the two cannot be
+ * told apart (the re-run stopped short, the control did not match), neither reading is trusted and
+ * the proof is `inconclusive`: a false `insensitive` is as wrong as a false `proven`.
+ */
+async function settleDisagreements(c) {
+    const { journey, plan, pace, siteByKey, replayOpts, mutations, checkpoint, tainted, taint, runReplay, controlFor, resultsSoFar } = c;
+    // A resume runs these again: only a finished pair is kept, and a re-run answers for the proof it is part of.
+    if (plan.mutations.length > 0)
+        checkpoint?.phase("disagreements");
+    const settled = new Set();
+    for (;;) {
+        if (tainted())
+            break;
+        const next = siblingDisagreements(journey, plan, resultsSoFar()).find((d) => !settled.has(`${d.site}\u0000${d.sensitive}`));
+        if (next === undefined)
+            break;
+        settled.add(`${next.site}\u0000${next.sensitive}`);
+        const index = mutations.findIndex((e) => e.id === next.sensitive);
+        const entry = mutations[index];
+        const m = plan.mutations.find((x) => x.id === entry.id);
+        const site = siteByKey.get(next.site);
+        // Which replay made this reading, so it is the one run again.
+        const proof = entry.targeted?.find((t) => t.site === next.site && t.refused === undefined);
+        const fromRelaxed = entry.relaxed !== undefined && !(site.where === "step" && site.step === m.step) && entry.failedSites.some((f) => f.where === "step" && f.step === m.step && f.postcondition);
+        const describe = proof !== undefined ? (j) => targetedMutationReplay(j, m, next.site, proof.relaxedSites, replayOpts) : (j) => (fromRelaxed ? relaxedMutationReplay : mutationReplay)(j, m, replayOpts);
+        const rerun = await runReplay(m, describe, "rerun");
+        if (tainted()) {
+            mutations[index] = { ...entry, rerun: rerun.outcome };
+            break;
+        }
+        const control = await controlFor(m, [rerun], [next.site]);
+        const undecided = `sibling mutations disagree on ${next.site} (${next.sensitive} failed it, ${next.passed} passed it), and a control and a re-run could not settle it; run the proof again`;
+        const controlFields = { control: control.outcome, ...(control.diagnostics === undefined ? {} : { controlDiagnostics: control.diagnostics }) };
+        if (rerun.outcome === "error" || control.outcome === "error") {
+            mutations[index] = { ...entry, ...controlFields, rerun: rerun.outcome };
+            continue;
+        }
+        const reread = classifyReplay(site, m, rerun);
+        const strike = (e) => {
+            const cut = (r) => ({ waitsCut: [...new Set([...(r.waitsCut ?? []), next.site])] });
+            if (proof !== undefined) {
+                return { ...e, targeted: e.targeted.map((t) => (t === proof ? { ...t, refused: `${next.sensitive} failed ${next.site} once and did not reproduce, while ${next.passed} passed it` } : t)) };
             }
-            mutations.push({
-                kind: m.kind,
-                step: m.step,
-                id: m.id,
-                ...(m.param === undefined ? {} : { param: m.param }),
-                ...(m.source === undefined ? {} : { source: m.source }),
-                ...first,
-                ...(relaxed === undefined ? {} : { relaxed }),
-                ...(targeted.length === 0 ? {} : { targeted }),
-            });
+            return fromRelaxed ? { ...e, relaxed: { ...e.relaxed, ...cut(e.relaxed) } } : { ...e, ...cut(e) };
+        };
+        const firstReading = fromRelaxed ? entry.relaxed : entry;
+        const matched = control.outcome === "passed" && sitesUnmatchedBy(firstReading.failedSites.filter((f) => siteKeyOf(f) === next.site), rerun, control, paceMarginOf(pace, m)).length === 0;
+        if (reread === "insensitive")
+            mutations[index] = { ...strike(entry), ...controlFields, rerun: rerun.outcome };
+        else if (reread === "sensitive" && matched)
+            mutations[index] = { ...entry, ...controlFields, rerun: rerun.outcome };
+        else if (control.outcome === "failed" && reread === "sensitive")
+            mutations[index] = { ...strike(entry), ...controlFields, rerun: rerun.outcome };
+        else {
+            mutations[index] = { ...entry, ...controlFields, rerun: rerun.outcome };
+            taint("siblings-undecided", null, undecided);
         }
     }
-    const results = new Map(mutations.map((m) => [
-        m.id,
-        { outcome: m.outcome, failedSites: m.failedSites, ...(m.relaxed === undefined ? {} : { relaxed: m.relaxed }), ...(m.targeted === undefined ? {} : { targeted: m.targeted }) },
-    ]));
+}
+/**
+ * A proof with no pairs says what to add, in the Journey's own terms. A check's method does not make its
+ * request a write (read RPCs are POSTs too), so the words leave that to whoever knows: this adds no pair.
+ */
+function withWhatToAdd(reason, journey) {
+    const deltaWith = (line) => `"delta":${JSON.stringify({ verdict: "relevant-change", why: "sends this write", changes: [], requests: [`${line} → 200`], overheadMs: 0 })}`;
+    const lineFor = (method, pathGlob) => `${method.toUpperCase()} ${pathGlob}`;
+    const named = journeyAssertions(journey).flatMap((s) => (s.where === "end-state" && (s.check.kind === "responseStatus" || s.check.kind === "requestMade") && !READ_METHODS.has(s.check.method.toUpperCase()) ? [{ site: assertionSiteKey(s), line: lineFor(s.check.method, s.check.pathGlob) }] : []));
+    if (named.length === 0)
+        return `${reason}; if a step sends a write, add it to that step's delta.requests (a step with no delta: ${deltaWith("POST /path")}), which gives the step skip and block-write mutations, or pair a check yourself in metadata.mutationPairs`;
+    return [
+        reason,
+        ...named.map((n) => `${n.site} names ${n.line}, and no step records it as a write: a check names a request, not the step that sends it. If this request is the step's write, add it to that step's delta.requests, with the path it sends (a step with no delta: ${deltaWith(n.line)}), which gives the step skip and block-write mutations, or add {"check":"${n.site}","mustFailWhen":"skip:<step>"} to metadata.mutationPairs. If it is a read, there is no write here to prove`),
+    ].join("; ");
+}
+/** The last replay as recorded, the verdict, the report and its receipt. */
+async function concludeProof(c) {
+    const { opts, runOpts, journey, journeyHash, plan, sites, checkOf, base, baseFields, pace, mutations, suggested, receiptDestination, boundedRun, checkpoint, resuming, restoreFailed } = c;
+    let notIsolated = c.notIsolated;
+    const tainted = () => restoreFailed() || notIsolated !== undefined;
+    const results = new Map(mutations.map((m) => [m.id, resultOfEntry(m)]));
     // Base failed: nothing ran, so every paired assertion is an `error` (no proof either way).
     const judged = judgeAssertions(journey, plan, results);
     const assertions = judged.map((a) => ({
@@ -207,7 +1230,25 @@ export async function verifyJourneyMutations(opts, run = runJourneyProgrammatica
     }));
     const order = new Map(journeyAssertions(journey).map((s, i) => [assertionSiteKey(s), i]));
     const siteOrder = (key) => order.get(key) ?? Number.MAX_SAFE_INTEGER;
-    const { verdict, reason } = mutationProofVerdict({ basePassed: base.outcome === "ok", mutations, assertions: judged });
+    const verdictInput = { basePassed: base.outcome === "ok", mutations, assertions: judged };
+    // A last replay as recorded, where its result can still change the verdict: a replay's slow job has no
+    // request to watch, so a late landing that stuck is only seen here. It cannot see one a restore then cleared.
+    // #787: a resume always runs it: nothing from before the interruption can vouch for how the proof ended.
+    if (!tainted() && (resuming !== undefined || (pace.stepEndMs.length > 0 && mutationProofVerdict({ ...verdictInput, restoreFailed: restoreFailed(), ...(notIsolated === undefined ? {} : { notIsolated }) }).verdict !== "inconclusive"))) {
+        checkpoint?.phase("closing");
+        try {
+            const closing = await boundedRun({ ...runOpts }, { structuredFailures: true }, { id: "closing replay, as recorded" });
+            if (closing.outcome !== "ok")
+                notIsolated = "the Journey as recorded no longer passes after the mutated replays, so state one left behind may have decided another; isolate the replays (a fixture restore, or a longer job's end) and run the proof again";
+        }
+        catch (err) {
+            if (err instanceof JourneyVerifyStalledError)
+                throw err;
+            notIsolated = "the closing replay as recorded errored, so the proof cannot say the replays stayed isolated; retry it";
+        }
+    }
+    const { verdict, reason: judgedReason } = mutationProofVerdict({ ...verdictInput, restoreFailed: restoreFailed(), ...(notIsolated === undefined ? {} : { notIsolated }) });
+    const reason = plan.pairs.length === 0 && judgedReason?.startsWith("no assertion is paired") === true ? withWhatToAdd(judgedReason, journey) : judgedReason;
     const count = (v) => assertions.filter((a) => a.verdict === v).length;
     const report = {
         journeyId: journey.metadata.id,
@@ -229,10 +1270,11 @@ export async function verifyJourneyMutations(opts, run = runJourneyProgrammatica
         },
         // #616: in assertion order, so the first suggestion is the one for the refusal the verdict quotes.
         ...(suggested.length === 0 ? {} : { suggestedTargetedProofs: [...suggested].sort((a, b) => siteOrder(a.check) - siteOrder(b.check)) }),
+        reusedPairs: resuming?.pairs.size ?? 0,
     };
     // Reasons and check texts can quote what the page showed: a secret parameter never comes back.
     const redacted = redactSecretParams(report, journey, opts.params);
-    const proofContext = journeyProofContext(opts.browser, opts.emulation);
+    const proofContext = journeyProofContext(opts.browser, opts.emulation, opts.readRequests);
     // #432: the verdict is kept beside the Journey (bound to its review hash) for `journey review`.
     await writePreflightedVerifyRecord(receiptDestination, {
         journeyId: journey.metadata.id,
@@ -243,10 +1285,245 @@ export async function verifyJourneyMutations(opts, run = runJourneyProgrammatica
         ...(redacted.reason === undefined ? {} : { reason: redacted.reason }),
         summary: { ...redacted.summary },
         ...(redacted.suggestedTargetedProofs === undefined ? {} : { suggestedTargetedProofs: redacted.suggestedTargetedProofs }),
+        ...(redacted.reusedPairs === 0 ? {} : { reusedPairs: redacted.reusedPairs }),
         at: clock.nowIso(),
     });
+    const errorGap = checkpoint !== undefined && isRepairableIsolation(checkpoint.body.taint) ? true : !tainted() && mutations.some(mutationErrored);
+    checkpoint?.finish(redacted.verdict, errorGap);
     return redacted;
 }
+async function proveJourneyMutations(opts, run, owned) {
+    const journey = await loadJourneyToVerify(opts.dir, opts.id);
+    // #711: receipt authority is proven before the first baseline/mutation replay spends a browser.
+    const receiptDestination = await preflightVerifyRecord(opts.dir, journey.metadata.id);
+    const { readRequests, onProgress, slotGovernor: _slotGovernor, checkpoint: checkpointRequest, ...runOpts } = opts;
+    const inactivityMs = proofInactivityMs(journey, opts);
+    const portFactory = opts.browserPortFactory ?? (() => new PlaywrightBrowserPort());
+    let replays = 0;
+    // Every replay of the proof goes through here: it is reported, and it is bounded.
+    let sessionsOpened = 0;
+    // A replay's restore may fail whether it passes, fails or throws, so the run reports it as it happens.
+    let restoreFailed = false;
+    const lintOpts = readRequests === undefined ? {} : { readRequests };
+    const journeyHash = journeyContentHash(journey);
+    const sites = journeyAssertions(journey);
+    const plan = planJourneyMutations(journey, { ...lintOpts, params: opts.params });
+    // #787: claimed before the first replay: a refused resume spends no browser and runs no hook.
+    // Params the replay will refuse keep no progress, so a mistyped command cannot replace a checkpoint. The replay raises its own refusal.
+    const opened = checkpointRequest === undefined || (!checkpointRequest.resume && !paramsAccepted(journey, opts.params)) ? {} : await openProofCheckpoint(checkpointRequest, { journey, journeyHash, plan, params: opts.params, sites });
+    const checkpoint = opened.session;
+    if (checkpoint !== undefined)
+        owned.session = checkpoint;
+    const resuming = opened.resume;
+    // A taint belongs to the whole proof: an earlier run's stands, or a resume could read `proven` where the uninterrupted proof could not.
+    if (resuming?.restoreFailed === true)
+        restoreFailed = true;
+    const boundedRun = (options, mutation, m, retry = false, probe) => {
+        replays += 1;
+        checkpoint?.replayStarted(replays);
+        const where = { replay: replays, ...(m === undefined ? {} : { mutation: m.id }), ...(retry ? { retry: true } : {}) };
+        onProgress?.(retry && m !== undefined ? { ...where, mutation: `${m.id} (retry after error)` } : where);
+        return replayWithinBound((browserPortFactory) => run({ ...options, browserPortFactory }, { ...mutation, onFixtureRestoreFailed: () => {
+                restoreFailed = true;
+                checkpoint?.taint({ restoreFailed: true });
+            } }), probe === undefined ? portFactory : probe.wrap(portFactory), where, inactivityMs, () => void (sessionsOpened += 1));
+    };
+    const stepsTotal = flatJourneySteps(journey).length;
+    const writeSteps = journeyWriteSteps(journey, lintOpts);
+    const writeScope = new WriteScope(effectiveAllowedOrigins(journey, opts.environment, opts.allow), writeSteps.flatMap((w) => w.requests));
+    const longestResponseMs = Math.max(opts.stepResponseTimeoutMs ?? DEFAULT_STEP_RESPONSE_TIMEOUT_MS, ...flatJourneySteps(journey).map(({ recorded }) => recorded.responseTimeoutMs ?? 0));
+    const basePacer = new ReplayPacer(0, () => undefined);
+    // The base stays open until its writes have settled: what it started must not land in the next replay.
+    const baseProbe = new ReplayProbe(stepsTotal, () => baseProbe.settleOpenWrites(Math.max(longestResponseMs, basePacer.elapsedMs())), writeScope);
+    const base = await boundedRun({ ...runOpts, observer: composeObservers(baseProbe.observer(), basePacer.observer()) }, { structuredFailures: true, earliestObserver: basePacer.claimObserver(), afterEndState: () => basePacer.noteEndState() }, undefined, false, baseProbe);
+    // Every other replay waits as this one did, so this one is their control (`pacedReplay`).
+    const pace = { stepEndMs: basePacer.reachedMs.filter((ms) => ms !== undefined), ...(basePacer.endStateReachedMs === undefined ? {} : { endStateMs: basePacer.endStateReachedMs }), claimHeldMs: [...basePacer.claimHeldMs] };
+    const baseMs = basePacer.elapsedMs();
+    const settleBoundMs = Math.max(longestResponseMs, baseMs);
+    writeScope.addBackground(baseProbe.repeatedLines);
+    // Why a replay may have decided another (a write still open at a close, state crossing replays).
+    const resumedNote = resuming === undefined ? null : (resuming.isolation ?? (resuming.notIsolatedBy === null ? null : "write-open"));
+    let notIsolated = resumedNote === null ? undefined : isolationReason(resumedNote, resuming?.notIsolatedBy ?? null);
+    // Once set it stays, and an interrupted proof keeps it: a resume could otherwise read `proven` where the uninterrupted proof could not.
+    const taint = (note, by = null, detail) => {
+        if (notIsolated !== undefined)
+            return;
+        notIsolated = detail ?? isolationReason(note, by);
+        checkpoint?.taint({ isolation: note, notIsolatedBy: by });
+    };
+    // Once a replay may have decided another, the proof is `inconclusive` whatever is left: nothing else is run.
+    const tainted = () => restoreFailed || notIsolated !== undefined;
+    const baseFields = { outcome: base.outcome, ...(base.outcome === "quarantined" ? { reason: base.reason } : {}) };
+    const checkOf = new Map(sites.map((s) => [assertionSiteKey(s), describeCheck(s.check)]));
+    if (resuming !== undefined) {
+        // Nothing is reused against an app whose as-recorded flow no longer passes, or a base it was not paced for.
+        if (base.outcome !== "ok") {
+            const why = base.outcome === "quarantined" ? redactSecretParams({ reason: base.reason }, journey, opts.params).reason : base.outcome;
+            throw new JourneyVerifyResumeRefusedError("base-failed", `the Journey as recorded did not pass the re-run of the base replay (${why})`);
+        }
+        const refused = resumeRefusalAgainstBase(resuming, plan, sites, pace, baseProbe.writesInFlightAtClose);
+        if (refused !== undefined)
+            throw refused;
+    }
+    const mutations = [];
+    // #616: automatic targeted proofs stopped at their relaxation bound, each a reviewable start.
+    const suggested = [];
+    const seenSuggestions = new Set();
+    // #787: this pair's replays as records, by kind, for a later base to be held against.
+    const pairReplays = [];
+    let replayWritesInFlight = 0;
+    if (base.outcome === "ok") {
+        // #565: a param mutation's replay runs with altered params (never a secret's), so it needs them.
+        const replayOpts = { ...lintOpts, params: opts.params };
+        const baseOpenLines = baseProbe.openLinesAtClose;
+        let independenceOpen = [];
+        const replayContext = {
+            opts, runOpts, journey, pace, stepsTotal, settleBoundMs, writeScope, writeSteps, baseProbe, boundedRun, taint,
+            noteWritesInFlight: (n) => void (replayWritesInFlight = Math.max(replayWritesInFlight, n)),
+            noteIndependenceOpen: (lines) => void (independenceOpen = lines),
+        };
+        const retriesOf = new Map();
+        // #778: one infrastructure error must not cost the proof, so a replay that errored before opening a
+        // browser, as on an admission timeout, runs once more. One that opened a browser may have changed the
+        // app, and a retry failing on that leftover state would read as proof, so it stays an error. A
+        // `failed` replay is a result and a stall ends the proof: neither gets here. A replay that never
+        // started (`describe` refused it, as a targeted proof's bad relaxation) would only be refused again.
+        const attemptWithRetry = async (m, describe, kind, matchTo) => {
+            const before = replays;
+            const sessionsBefore = sessionsOpened;
+            const first = await attemptReplay(replayContext, m, describe, false, kind, matchTo);
+            if (first.outcome !== "error" || replays === before || sessionsOpened !== sessionsBefore)
+                return first;
+            retriesOf.set(m.id, [...(retriesOf.get(m.id) ?? []), { reason: first.reason ?? "unknown error" }]);
+            return attemptReplay(replayContext, m, describe, true, kind, matchTo);
+        };
+        // #787: the one place a replay of a pair runs, so each is kept as a record of its kind. A new kind is a new name here and in `REPLAY_RECORD_KINDS`.
+        const runReplay = async (m, describe, kind, matchTo) => {
+            replayWritesInFlight = 0;
+            const ran = await attemptWithRetry(m, describe, kind, matchTo);
+            pairReplays.push(checkpointReplayOf(kind, ran, replayWritesInFlight));
+            return ran;
+        };
+        // #402: a named mutation lowers to its `MutationReplay`; #609's targeted proof passes one directly.
+        const replay = (m, describe, kind) => runReplay(m, (j) => describe(j, m, replayOpts), kind);
+        const siteByKey = new Map(sites.map((s) => [assertionSiteKey(s), s]));
+        // #616: a proof the automatic bound stopped names the plan a human could declare instead.
+        const noteSuggestion = (proof, m) => {
+            const suggestion = suggestTargetedProofPlan(proof, m);
+            if (suggestion === null)
+                return;
+            const key = `${suggestion.check}\u0000${suggestion.mustFailWhen}\u0000${suggestion.relax.join(",")}`;
+            if (seenSuggestions.has(key))
+                return;
+            seenSuggestions.add(key);
+            suggested.push(suggestion);
+        };
+        const asRecorded = (j) => ({ journey: j });
+        // Sibling mutations of a step have the same floors, so they share a matched control while it reached their sites together with them.
+        const stepControls = new Map();
+        const controlFor = async (m, runs, sitesAtStake) => {
+            const known = (stepControls.get(m.step) ?? []).find((c) => runs.every((r) => sitesUnmatchedBy(r.failedSites.filter((f) => sitesAtStake.includes(siteKeyOf(f))), r, c, paceMarginOf(pace, m)).length === 0));
+            if (known !== undefined) {
+                // Each pair keeps a record of the control it read, whoever ran it: one that left a write open ended the proof.
+                pairReplays.push(checkpointReplayOf("control", known, 0));
+                return known;
+            }
+            const latest = (of) => {
+                const known = runs.map(of).filter((ms) => ms !== undefined);
+                return known.length === 0 ? undefined : Math.max(...known);
+            };
+            const longest = Math.max(0, ...runs.map((r) => r.arrivedMs?.length ?? 0));
+            const end = latest((r) => r.endStateReachedMs);
+            const matchTo = { arrivedMs: Array.from({ length: longest }, (_, i) => latest((r) => r.arrivedMs?.[i])), ...(end === undefined ? {} : { endStateReachedMs: end }) };
+            const ran = await runReplay(m, asRecorded, "control", matchTo);
+            stepControls.set(m.step, [...(stepControls.get(m.step) ?? []), ran]);
+            return ran;
+        };
+        const resultsSoFar = (extra) => new Map([...mutations.map((e) => [e.id, resultOfEntry(e)]), ...(extra === undefined ? [] : [extra])]);
+        /**
+         * A replay straight after the base, floored as the first mutated replay will be. What the base left
+         * running, however it started (a GET, a socket, a popup), meets it where it would meet that replay.
+         * A failure alone cannot say whether state crossed over or the floor itself breaks a claim that only
+         * lasts so long, so it is run again after a quiet gap: a pass means state crossed. A second failure
+         * is the floor if the Journey still passes unheld, and state that stuck if it does not.
+         */
+        const proveIndependence = async (first) => {
+            const floored = await runReplay(first, asRecorded, "independence");
+            // A write still open at the bound in the base and the next replay is a long-lived connection. Open only in the base, it was a real one.
+            if (baseOpenLines.some((line) => !independenceOpen.includes(line))) {
+                taint("base-write-open", null, isolationReason("base-write-open", null, baseOpenLines));
+                return;
+            }
+            writeScope.addBackground(baseOpenLines);
+            if (floored.outcome === "error") {
+                taint("independence-errored");
+                return;
+            }
+            if (floored.outcome === "passed") {
+                stepControls.set(first.step, [floored]);
+                checkpoint?.independence("passed");
+                return;
+            }
+            if (tainted())
+                return;
+            await clock.sleep(Math.max(QUIET_GAP_MIN_MS, 2 * baseMs));
+            const again = await runReplay(first, asRecorded, "independence");
+            if (again.outcome === "passed") {
+                taint("state-crossed");
+                return;
+            }
+            if (again.outcome === "error") {
+                taint("independence-errored");
+                return;
+            }
+            if (tainted())
+                return;
+            const unheldProbe = new ReplayProbe(stepsTotal, () => unheldProbe.settleOpenWrites(settleBoundMs), writeScope);
+            try {
+                const unheld = await boundedRun({ ...runOpts, observer: unheldProbe.observer() }, { structuredFailures: true }, { id: "independence replay, unheld" }, false, unheldProbe);
+                if (unheld.outcome !== "ok")
+                    taint("state-stuck");
+            }
+            catch (err) {
+                if (err instanceof JourneyVerifyStalledError)
+                    throw err;
+                taint("independence-errored");
+                return;
+            }
+            if (tainted())
+                return;
+            stepControls.set(first.step, [again]);
+            checkpoint?.independence("hold-breaks-claim");
+        };
+        const pairContext = { journey, plan, pace, siteByKey, replayOpts, mutations, checkpoint, tainted, taint, replay, runReplay, controlFor, resultsSoFar, noteSuggestion, retriesOf, pairReplays };
+        const firstMutation = plan.mutations[0];
+        // On a resume too: it answers for the base just measured, so a checkpoint never stands in for it.
+        if (firstMutation !== undefined && pace.stepEndMs.length > 0 && !tainted()) {
+            checkpoint?.phase("independence");
+            if (baseOpenLines.some((line) => writeScope.isRecorded(line))) {
+                taint("base-write-open", null, isolationReason("base-write-open", null, baseOpenLines));
+            }
+            else {
+                await proveIndependence(firstMutation);
+            }
+        }
+        for (const m of plan.mutations) {
+            if (tainted())
+                break;
+            // #787: a finished pair is not run again. It reaches the same judging below as a pair just run.
+            const kept = resuming?.pairs.get(m.id);
+            if (kept !== undefined) {
+                mutations.push(reusedMutation(kept));
+                for (const proof of reusedProofFields(kept).targeted ?? [])
+                    noteSuggestion(proof, m);
+                continue;
+            }
+            await runPair(pairContext, m);
+        }
+        await settleDisagreements(pairContext);
+    }
+    return concludeProof({ opts, runOpts, journey, journeyHash, plan, sites, checkOf, base, baseFields, pace, mutations, suggested, receiptDestination, boundedRun, checkpoint, resuming, restoreFailed: () => restoreFailed, notIsolated });
+}
 /** One human line per assertion — verdict, site, check, and the mutation that proved it. */
 export function verifyAssertionLine(a) {
     // #609: a sensitive verdict reached by a targeted proof names the earlier postconditions it relaxed.