@molecule/api-ai-tools 1.10.5 → 1.10.6

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-10-19T06:38:37.559Z
+Generated: 2026-10-19T13:08:52.848Z
 -->
 
 # @molecule/api-ai-tools
@@ -584,6 +584,13 @@ selector. xr-molecule-flash-m169 (+13:09) spent its fix rounds on the wrong comp
 markup detail while `GET /api/tags` was returning the missing "trending" and `PopularTags`
 sliced the response to its first 20 entries (the m99 top-N class, in the frontend).
 
+The text must be a value the response held, never a substring of one: a whole JSON string or
+number value, or a word bounded by non-alphanumerics. A text of 2 characters or fewer, or one
+made of digits only, must be a whole JSON value. xr-molecule-flash-m208's pagination assertion
+waited for "2" and the raw substring hit `pag1792394785820` in a tags response, so the note led
+with a response that had nothing to do with the failure; when no response holds the text that
+way, the field is absent and the note leads with its next finding.
+
 ```typescript
 interface TraceMissingText {
   /** The text the assertion waited for (`trending`). */
@@ -765,6 +772,15 @@ interface TraceArtifact {
    * leaving the run to probe computed styles (xr-molecule-flash-m197).
    */
   hiddenBox?: TraceHiddenBox
+  /**
+   * The method+path groups this test's page sent {@link TRACE_NOTE_LOOP_REPEATS} times or more,
+   * most-repeated first — a render loop the note leads with (xr-molecule-flash-m215: 2,106
+   * `GET /api/articles/<slug>` in one test, printed as four identical `→ 200` lines). Counted over
+   * every network entry of the failing page, not the capped {@link TraceArtifact.requests} list.
+   *
+   * Absent when no group reached the threshold, and on traces read before this field existed.
+   */
+  repeated?: TraceRequestRepeat[]
 }
 ```
 
@@ -819,6 +835,13 @@ interface TraceRunReport {
    * Empty when the caller could not read the app's config.
    */
   authEndpoints?: readonly string[]
+  /**
+   * The app source files whose code sends a repeated request, read by the caller from the
+   * project (`app/src/**`) before this note is written. A loop's sentence names the component to
+   * read instead of leaving the run to search for it (xr-molecule-flash-m215's `Editor.tsx`).
+   * Empty when the caller could not read the app or no file states the path.
+   */
+  callSites?: readonly { method: string; path: string; file: string }[]
 }
 ```
 
@@ -4112,6 +4135,21 @@ How many requests the note names per test.
 const MAX_TRACE_NOTE_REQUESTS: 4
 ```
 
+#### `TRACE_NOTE_LOOP_REPEATS`
+
+How many times ONE test may send the same method+path before the note calls it a render loop.
+
+xr-molecule-flash-m215 (+27:27 → +29:42): an Editor effect with `[seeded, slug, t]` in its
+dependency list re-fetched `GET /api/articles/<slug>` 2,106 times in one test. The trace reader
+caps and de-duplicates its request list, so the note printed four identical `→ 200` lines and
+the run patched the component's seeding, rebuilt and re-ran before unzipping the trace by hand.
+Twenty is far above the retries a correct page makes (a few on a flaky call) and far below any
+render loop.
+
+```typescript
+const TRACE_NOTE_LOOP_REPEATS: 20
+```
+
 #### `TRACE_NOTE_URL_CHARS`
 
 How long a URL the note prints, before the middle is cut.

package/dist/trace-artifacts.d.ts

@@ -181,6 +181,13 @@ export interface TraceContextEvidence {
  * selector. xr-molecule-flash-m169 (+13:09) spent its fix rounds on the wrong component and on a
  * markup detail while `GET /api/tags` was returning the missing "trending" and `PopularTags`
  * sliced the response to its first 20 entries (the m99 top-N class, in the frontend).
+ *
+ * The text must be a value the response held, never a substring of one: a whole JSON string or
+ * number value, or a word bounded by non-alphanumerics. A text of 2 characters or fewer, or one
+ * made of digits only, must be a whole JSON value. xr-molecule-flash-m208's pagination assertion
+ * waited for "2" and the raw substring hit `pag1792394785820` in a tags response, so the note led
+ * with a response that had nothing to do with the failure; when no response holds the text that
+ * way, the field is absent and the note leads with its next finding.
  */
 export interface TraceMissingText {
     /** The text the assertion waited for (`trending`). */
@@ -256,6 +263,27 @@ export interface TraceHiddenBox {
     /** True when the element has no text and no element children at all. */
     empty?: true;
 }
+/**
+ * One method+path a test's page sent many times — the trace of a render loop.
+ *
+ * Counted over EVERY network entry the failing page recorded, before the trace reader's per-trace
+ * cap and its method+path+status dedupe, because those two bounds are exactly what hid m215's
+ * 2,106-request loop: the note could only ever see four of them.
+ */
+interface TraceRequestRepeat {
+    /** The HTTP method (`GET`). */
+    method: string;
+    /** The path, query and fragment dropped (`/api/articles/test-article-1`). */
+    path: string;
+    /** How many times the page sent it in this test. */
+    count: number;
+    /** The last response status recorded. */
+    status?: number;
+    /** The browser's resource type (`fetch`, `xhr`, `document`). */
+    type?: string;
+    /** How long the repeated requests spanned, on the trace's own clock (ms). */
+    ms?: number;
+}
 /** What one trace says: the test it belongs to, the requests it made, and its console lines. */
 export interface TraceArtifact {
     /** The failure's spec file, relative to the run's directory, when the trace names one. */
@@ -348,6 +376,15 @@ export interface TraceArtifact {
      * leaving the run to probe computed styles (xr-molecule-flash-m197).
      */
     hiddenBox?: TraceHiddenBox;
+    /**
+     * The method+path groups this test's page sent {@link TRACE_NOTE_LOOP_REPEATS} times or more,
+     * most-repeated first — a render loop the note leads with (xr-molecule-flash-m215: 2,106
+     * `GET /api/articles/<slug>` in one test, printed as four identical `→ 200` lines). Counted over
+     * every network entry of the failing page, not the capped {@link TraceArtifact.requests} list.
+     *
+     * Absent when no group reached the threshold, and on traces read before this field existed.
+     */
+    repeated?: TraceRequestRepeat[];
 }
 /** How many traces one read reports, newest first. */
 export declare const MAX_TRACE_ARTIFACTS = 12;
@@ -366,6 +403,17 @@ export declare const MAX_TRACED_BODY_CHARS = 300;
 export declare const MAX_TRACE_NOTE_TESTS = 5;
 /** How many requests the note names per test. */
 export declare const MAX_TRACE_NOTE_REQUESTS = 4;
+/**
+ * How many times ONE test may send the same method+path before the note calls it a render loop.
+ *
+ * xr-molecule-flash-m215 (+27:27 → +29:42): an Editor effect with `[seeded, slug, t]` in its
+ * dependency list re-fetched `GET /api/articles/<slug>` 2,106 times in one test. The trace reader
+ * caps and de-duplicates its request list, so the note printed four identical `→ 200` lines and
+ * the run patched the component's seeding, rebuilt and re-ran before unzipping the trace by hand.
+ * Twenty is far above the retries a correct page makes (a few on a flaky call) and far below any
+ * render loop.
+ */
+export declare const TRACE_NOTE_LOOP_REPEATS = 20;
 /** How long a URL the note prints, before the middle is cut. */
 export declare const TRACE_NOTE_URL_CHARS = 96;
 /** How much of the sent body the note prints — enough to see a `{"data":…}` wrapper. */
@@ -511,6 +559,17 @@ export interface TraceRunReport {
      * Empty when the caller could not read the app's config.
      */
     authEndpoints?: readonly string[];
+    /**
+     * The app source files whose code sends a repeated request, read by the caller from the
+     * project (`app/src/**`) before this note is written. A loop's sentence names the component to
+     * read instead of leaving the run to search for it (xr-molecule-flash-m215's `Editor.tsx`).
+     * Empty when the caller could not read the app or no file states the path.
+     */
+    callSites?: readonly {
+        method: string;
+        path: string;
+        file: string;
+    }[];
 }
 /**
  * Whether a request PATH asks the app to mint a credential — a login, a registration, a token
@@ -624,12 +683,16 @@ export declare function hiddenBoxNote(items: readonly TraceArtifact[]): string |
  * config names; the traces add what their own requests show) and never assumed to be `/api`.
  *
  * A 401/403 on the app's own origin is answered from the request's own credential record instead
- * ({@link authRefusalSentence}): no `Authorization` header means the CLIENT never attached the
- * token (the shared HTTP client's `setAuthToken` is what the auth bond mirrors it into), while a
- * header the API then refused moves the answer to the server. The handler sentence is kept for
- * the rest — 404/422/500 — and dropped when every failure was a credential refusal, because a
- * trace that proves the header was never sent cannot be explained by the handler.
- * xr-molecule-flash-m148 (+29:18) hit this exactly: six local walks read
+ * ({@link authRefusalSentence}): a header the API then refused moves the answer to the server. No
+ * header is read together with the trace's session evidence — the failing test's identity, a
+ * credential exchange it answered 2xx, a request the client already attached a token to — and only
+ * positive evidence may prescribe the client's token wiring; otherwise the sentence is
+ * observational and, for a navigation failure, names the URL transition and the route guard
+ * (xr-molecule-flash-m221: a signed-out redirect test's `GET /api/articles/feed → 401` sent the
+ * model into replacing a working HTTP client, which lost the session token for ~28 minutes). The
+ * handler sentence is kept for the rest — 404/422/500 — and dropped when every failure was a
+ * credential refusal, because a trace that proves the header was never sent cannot be explained by
+ * the handler. xr-molecule-flash-m148 (+29:18) hit this exactly: six local walks read
  * `POST …/favorite → 401 {"errors":{"token":["is missing"]}}` as a handler bug.
  *
  * A credential EXCHANGE (a login/registration/token endpoint, read from the app's auth config, the
@@ -703,4 +766,5 @@ export declare function diagnosisTraceCommand(args: {
     cwd: string;
     readFile: (path: string) => Promise<string>;
 }): Promise<DiagnosisTraceRewrite>;
+export {};
 //# sourceMappingURL=trace-artifacts.d.ts.map

package/dist/trace-artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trace-artifacts.d.ts","sourceRoot":"","sources":["../src/trace-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAA;IACX,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB;;;;OAIG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAA;CACzB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,IAAI,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,4CAA4C;IAC5C,UAAU,EAAE,OAAO,CAAA;IACnB,iDAAiD;IACjD,SAAS,EAAE,OAAO,CAAA;IAClB,kEAAkE;IAClE,KAAK,EAAE,YAAY,CAAA;IACnB,kEAAkE;IAClE,IAAI,EAAE,YAAY,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAA;IACX,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,6BAA6B;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,8BAA8B;QAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,0BAA0B;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,mBAAmB;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,sBAAsB;QACtB,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;IACD,wEAAwE;IACxE,KAAK,CAAC,EAAE,IAAI,CAAA;CACb;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAA;IACZ,6FAA6F;IAC7F,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B;;;;;OAKG;IACH,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAA;IACtC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,CAAA;IAC1C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAErC,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAA;AAEnC,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,KAAK,CAAA;AAEpC,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAUxC,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,IAAI,CAAA;AAErC,iDAAiD;AACjD,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAExC,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAK5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,oBAAoB,QAAO,MAuoCvC,CAAA;AAmID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CA0DnE;AA2KD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAKnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAG5D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAGhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAMzE;AAkDD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,4FAA4F;IAC5F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACrC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAgTD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,SAAS,MAAM,EAAO,GACpC,OAAO,CAcT;AAyqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,GAAG,IAAI,CA4C5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,MAAM,EAAE,MAAM,EACd,eAAe,GAAE,SAAS,MAAM,EAAO,EACvC,WAAW,GAAE,SAAS,MAAM,EAAO,EACnC,MAAM,GAAE,cAAmB,GAC1B,MAAM,GAAG,IAAI,CAodf;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,8BAA8B,CAAA;AAwG/D,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC5C,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0BjC"}
+{"version":3,"file":"trace-artifacts.d.ts","sourceRoot":"","sources":["../src/trace-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAA;IACX,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB;;;;OAIG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,IAAI,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,4CAA4C;IAC5C,UAAU,EAAE,OAAO,CAAA;IACnB,iDAAiD;IACjD,SAAS,EAAE,OAAO,CAAA;IAClB,kEAAkE;IAClE,KAAK,EAAE,YAAY,CAAA;IACnB,kEAAkE;IAClE,IAAI,EAAE,YAAY,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAA;IACX,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,6BAA6B;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,8BAA8B;QAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,0BAA0B;QAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,mBAAmB;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,sBAAsB;QACtB,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;IACD,wEAAwE;IACxE,KAAK,CAAC,EAAE,IAAI,CAAA;CACb;AAED;;;;;;GAMG;AACH,UAAU,kBAAkB;IAC1B,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAA;IACZ,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAA;IACb,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAA;IACZ,6FAA6F;IAC7F,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B;;;;;OAKG;IACH,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAA;IACtC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,CAAA;IAC1C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAA;CAChC;AAED,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAErC,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAEpC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAA;AAEnC,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,KAAK,CAAA;AAEpC,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAUxC,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,IAAI,CAAA;AAErC,iDAAiD;AACjD,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,MAAM,CAAA;AAExC,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,MAAM,CAAA;AAEvC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAK5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,oBAAoB,QAAO,MAwvCvC,CAAA;AAgKD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CA4DnE;AA6SD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAKnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAG5D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAGhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAMzE;AAkDD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,4FAA4F;IAC5F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACrC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACtE;AA6aD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,SAAS,MAAM,EAAO,GACpC,OAAO,CAcT;AAk4BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,GAAG,IAAI,CA4C5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoHG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,MAAM,EAAE,MAAM,EACd,eAAe,GAAE,SAAS,MAAM,EAAO,EACvC,WAAW,GAAE,SAAS,MAAM,EAAO,EACnC,MAAM,GAAE,cAAmB,GAC1B,MAAM,GAAG,IAAI,CAigBf;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,8BAA8B,CAAA;AAwG/D,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC5C,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0BjC"}

package/dist/trace-artifacts.js

@@ -52,6 +52,17 @@ const MAX_TRACED_WEBSOCKET_CHARS = 600;
 export const MAX_TRACE_NOTE_TESTS = 5;
 /** How many requests the note names per test. */
 export const MAX_TRACE_NOTE_REQUESTS = 4;
+/**
+ * How many times ONE test may send the same method+path before the note calls it a render loop.
+ *
+ * xr-molecule-flash-m215 (+27:27 → +29:42): an Editor effect with `[seeded, slug, t]` in its
+ * dependency list re-fetched `GET /api/articles/<slug>` 2,106 times in one test. The trace reader
+ * caps and de-duplicates its request list, so the note printed four identical `→ 200` lines and
+ * the run patched the component's seeding, rebuilt and re-ran before unzipping the trace by hand.
+ * Twenty is far above the retries a correct page makes (a few on a flaky call) and far below any
+ * render loop.
+ */
+export const TRACE_NOTE_LOOP_REPEATS = 20;
 /** How long a URL the note prints, before the middle is cut. */
 export const TRACE_NOTE_URL_CHARS = 96;
 /** How much of the sent body the note prints — enough to see a `{"data":…}` wrapper. */
@@ -111,6 +122,7 @@ const MAX_CONSOLE = ${MAX_TRACED_CONSOLE}
 const MAX_ACTIONS = ${MAX_TRACED_ACTIONS}
 const MAX_BODY = ${MAX_TRACED_BODY_CHARS}
 const MAX_WS = ${MAX_TRACED_WEBSOCKET_CHARS}
+const LOOP_REPEATS = ${TRACE_NOTE_LOOP_REPEATS}
 const MAX_URL = 200
 // A console line that is not an error but still has to reach the note (m148): one a molecule
 // package wrote — it names the package, the \`[molecule/…]\` prefix, or the \`[scope]\` prefix
@@ -236,6 +248,51 @@ function waitedTextOf(message) {
   return quoted(/Expected(?: string)?:\\s*(["'])((?:(?!\\1).)*)\\1/)
 }
 
+// Whether a response body CARRIES an awaited text as a value of its own rather than as a substring.
+// m208's pagination assertion waited for the page-link text "2", and that one character occurs
+// inside every tag name the tags response returned (\`pag1792394785820\`): the note led with
+// "The response GET /api/tags contained \\"2\\".", a fact with no lead in it, and the trace row that
+// did explain the failure (a page size of 20 where the suite paginates 10) came after it. A
+// response counts only when the text is a whole JSON string (or number) value it returned, or a
+// word with a non-alphanumeric on both sides. A text of 2 characters or fewer, or one made of
+// digits only, is not a word — it must be a whole JSON value, or no response is named at all and
+// the note leads with its next finding.
+function responseCarriesText(body, text) {
+  if (!body || !text) return false
+  if (jsonValueEquals(body, text)) return true
+  if (text.length <= 2 || /^[0-9]+$/.test(text)) return false
+  const alnum = function (ch) { return ch !== '' && /[A-Za-z0-9]/.test(ch) }
+  let at = body.indexOf(text)
+  while (at !== -1) {
+    const before = at === 0 ? '' : body[at - 1]
+    const after = at + text.length >= body.length ? '' : body[at + text.length]
+    if (!alnum(before) && !alnum(after)) return true
+    at = body.indexOf(text, at + 1)
+  }
+  return false
+}
+
+// Whether the body is JSON that holds \`text\` as a whole string value, or as a number whose written
+// form is \`text\` (\`{"page":2}\` carries "2"). A body the trace read cut short does not parse and so
+// proves nothing: only the word-bounded reading above is left, and a short text gets no match.
+function jsonValueEquals(body, text) {
+  let parsed
+  try { parsed = JSON.parse(body) } catch (e) { return false }
+  const walk = function (value, depth) {
+    if (depth > 8 || value === null || value === undefined) return false
+    if (typeof value === 'string') return value === text
+    if (typeof value === 'number') return String(value) === text
+    if (Array.isArray(value)) {
+      for (let i = 0; i < value.length; i++) if (walk(value[i], depth + 1)) return true
+      return false
+    }
+    if (typeof value !== 'object') return false
+    for (const key of Object.keys(value)) if (walk(value[key], depth + 1)) return true
+    return false
+  }
+  return walk(parsed, 0)
+}
+
 // The attributes of one serialized element's opening tag (\`class="a b" id="c"\`). The trace's
 // snapshots carry them as an object already; the ASSERTION's error prints the tag as text.
 function attrsOf(source) {
@@ -811,6 +868,64 @@ for (const one of found.slice(0, MAX_TRACES)) {
       /^\\/icons\\//.test(p) ||
       /^\\/(?:apple-touch-icon|og-image|splash)[^/]*(?:[?#]|$)/.test(p)
   }
+  // The request's identity for the loop count and the action's own list: the path without its
+  // query, so 2,106 GETs of the same article are ONE group.
+  function requestPathOf(r) {
+    return String(r.path).split(/[?#]/)[0]
+  }
+  // Method+path repeated at least LOOP_REPEATS times by ONE page: a render loop, not a retry
+  // (m215). Counted over every network entry of the failing page, BEFORE the per-trace cap and
+  // dedupe, so the note can name the real number instead of the four copies the cap kept.
+  function repeatedOf(list) {
+    const groups = {}
+    const order = []
+    for (const r of list) {
+      if (shellRequest(r)) continue
+      const p = requestPathOf(r)
+      const key = r.method + ' ' + p
+      let group = groups[key]
+      if (group === undefined) {
+        group = { method: r.method, path: p, count: 0, status: r.status, type: r.type || undefined, first: undefined, last: undefined }
+        groups[key] = group
+        order.push(key)
+      }
+      group.count += 1
+      group.status = r.status
+      if (typeof r.startedAt === 'number') {
+        if (group.first === undefined || r.startedAt < group.first) group.first = r.startedAt
+        if (group.last === undefined || r.startedAt > group.last) group.last = r.startedAt
+      }
+    }
+    const out = []
+    for (const key of order) {
+      const group = groups[key]
+      if (group.count < LOOP_REPEATS) continue
+      out.push({
+        method: group.method,
+        path: group.path,
+        count: group.count,
+        ...(group.status > 0 ? { status: group.status } : {}),
+        ...(group.type ? { type: group.type } : {}),
+        ...(group.first !== undefined && group.last !== undefined
+          ? { ms: Math.max(0, Math.round(group.last - group.first)) }
+          : {}),
+      })
+    }
+    out.sort(function (a, b) { return b.count - a.count })
+    return out.slice(0, 3)
+  }
+  // One entry per method+path, in recording order: a loop's four copies are one line in the row.
+  function dedupeByPath(list) {
+    const seen = {}
+    const out = []
+    for (const r of list) {
+      const key = r.method + ' ' + requestPathOf(r)
+      if (seen[key] === true) continue
+      seen[key] = true
+      out.push(r)
+    }
+    return out
+  }
   // A failed request: a 4xx/5xx, or no response at all WITH Playwright's error text (a refused
   // connection). No response and no text is an aborted/pending request, not a failure. A 404 on
   // the page shell is excepted, for the reason above.
@@ -964,6 +1079,12 @@ for (const one of found.slice(0, MAX_TRACES)) {
   // carries tag names in its \`tagList\`, while the tags response is the collection whose membership
   // the assertion tests.
   //
+  // The text must be a VALUE the response held, not a substring of one (m208): a one-character
+  // awaited text ("2", the page link the pagination assertion waits for) occurs inside every
+  // \`pag…\` tag name, and the note led with "The response GET /api/tags contained \\"2\\"." while the
+  // row that explained the failure said the page size was 20. {@link responseCarriesText} decides,
+  // and when no response holds it that way no response is named.
+  //
   // The "page drops it before rendering" claim is made only when the trace PROVES it: a successful
   // GET of the collection that STARTED AFTER the last navigation, and the awaited text absent from
   // the page's own failure snapshot. A creation POST says nothing about what a collection render
@@ -984,7 +1105,7 @@ for (const one of found.slice(0, MAX_TRACES)) {
       if (r.type !== 'fetch' && r.type !== 'xhr') continue
       if (r.status < 200 || r.status >= 400) continue
       const got = gotText(buf, entries, r)
-      if (!got || got.indexOf(waitedText) === -1) continue
+      if (!got || !responseCarriesText(got, waitedText)) continue
       if (best === null || got.length < best.got.length) best = { request: r, got: got }
       // The collection read the claim may rest on: a GET that started after the last navigation
       // (a request that started before it belongs to the page load, not to the failure).
@@ -1043,7 +1164,7 @@ for (const one of found.slice(0, MAX_TRACES)) {
       api: lastAction.api,
       start: lastAction.start,
       end: lastAction.end,
-      requests: actionIndexes.slice(0, MAX_NOTE).map(function (i) { return wire(requests[i]) }),
+      requests: dedupeByPath(actionIndexes.map(function (i) { return requests[i] })).slice(0, MAX_NOTE).map(function (r) { return wire(r) }),
       ...(pageBefore === undefined ? {} : { pageBefore: pageBefore }),
       ...(pageAfter === undefined ? {} : { pageAfter: pageAfter }),
     }
@@ -1238,6 +1359,8 @@ for (const one of found.slice(0, MAX_TRACES)) {
     hiddenBox === null
   )
     continue
+  // Counted over the page's EVERY network entry, before the cap and dedupe above (m215).
+  const repeated = repeatedOf(requests)
   process.stdout.write('TRACE ' + JSON.stringify({
     dir: path.relative(ROOT, path.dirname(one.file)),
     spec: spec,
@@ -1248,6 +1371,7 @@ for (const one of found.slice(0, MAX_TRACES)) {
     // tail here dropped every failed request as soon as a page made more than MAX_REQUESTS of them
     // plus the answered ones (xr-molecule-flash-m112's note listed only -1s and 200s).
     requests: chosen.slice(0, MAX_REQUESTS),
+    ...(repeated.length === 0 ? {} : { repeated: repeated }),
     ...(missingText === null ? {} : { missingText: missingText }),
     ...(readContradiction === null ? {} : { readContradiction: readContradiction }),
     ...(hiddenBox === null ? {} : { hiddenBox: hiddenBox }),
@@ -1396,6 +1520,38 @@ function parseLastAction(value) {
         ...(typeof raw.pageAfter === 'string' ? { pageAfter: raw.pageAfter } : {}),
     };
 }
+/**
+ * The repeated method+path groups out of a `TRACE` line's json.
+ *
+ * @param value - The line's `repeated`.
+ * @returns The groups, most-repeated first, as the reader printed them.
+ */
+function parseRepeated(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    for (const entry of value) {
+        if (typeof entry !== 'object' || entry === null)
+            continue;
+        const raw = entry;
+        if (typeof raw.method !== 'string' || typeof raw.path !== 'string')
+            continue;
+        const count = Number(raw.count);
+        if (!Number.isFinite(count) || count < 2)
+            continue;
+        out.push({
+            method: raw.method,
+            path: raw.path,
+            count,
+            ...(Number.isFinite(Number(raw.status)) && Number(raw.status) > 0
+                ? { status: Number(raw.status) }
+                : {}),
+            ...(typeof raw.type === 'string' && raw.type ? { type: raw.type } : {}),
+            ...(Number.isFinite(Number(raw.ms)) && Number(raw.ms) >= 0 ? { ms: Number(raw.ms) } : {}),
+        });
+    }
+    return out;
+}
 /**
  * The traces {@link traceArtifactsScript} printed, parsed.
  *
@@ -1420,6 +1576,7 @@ export function parseTraceArtifacts(stdout) {
             const missingText = parseMissingText(raw.missingText);
             const readContradiction = parseReadContradiction(raw.readContradiction);
             const hiddenBox = parseHiddenBox(raw.hiddenBox);
+            const repeated = parseRepeated(raw.repeated);
             const otherContexts = Array.isArray(raw.otherContexts)
                 ? raw.otherContexts
                     .filter((c) => typeof c === 'object' && c !== null)
@@ -1458,6 +1615,7 @@ export function parseTraceArtifacts(stdout) {
                 ...(missingText === null ? {} : { missingText }),
                 ...(readContradiction === null ? {} : { readContradiction }),
                 ...(hiddenBox === null ? {} : { hiddenBox }),
+                ...(repeated.length === 0 ? {} : { repeated }),
             });
         }
         catch (_error) {
@@ -1529,6 +1687,109 @@ function requestWithBody(request, gotChars) {
     const got = request.got ? ` got ${bodyLine(redactSecrets(request.got), gotChars)}` : '';
     return `${requestLabel(request)} → ${status}${sent}${got}`;
 }
+/**
+ * Whether two request paths name the same route: equal, or a `:param` segment on either side
+ * matching the other's value (the app's code writes `/articles/:slug`, the trace records
+ * `/articles/test-article-1`).
+ *
+ * @param a - One path.
+ * @param b - The other.
+ * @returns True when they name the same route.
+ */
+function sameTracePath(a, b) {
+    const A = a.split('/').filter(Boolean);
+    const B = b.split('/').filter(Boolean);
+    return (A.length === B.length &&
+        A.every((segment, i) => segment === B[i] || segment.startsWith(':') || B[i].startsWith(':')));
+}
+/**
+ * The requests of one trace, one entry per method+path, with the trace's own repeat count.
+ *
+ * A loop is why this exists: the reader keeps at most four copies of a method+path, so the row
+ * must print ONE line with the real number (m215's `×2106`) rather than four identical lines.
+ *
+ * @param requests - The requests to print, in the note's own order.
+ * @param repeated - The trace's repeated groups ({@link TraceArtifact.repeated}).
+ * @returns One entry per method+path, first occurrence first.
+ */
+function collapseRequests(requests, repeated) {
+    const counts = new Map();
+    for (const group of repeated ?? [])
+        counts.set(`${group.method} ${group.path}`, {
+            count: group.count,
+            ...(group.ms === undefined ? {} : { ms: group.ms }),
+        });
+    const out = [];
+    const seen = new Map();
+    for (const request of requests) {
+        const key = `${request.method} ${request.path}`;
+        const existing = seen.get(key);
+        if (existing !== undefined) {
+            // The trace's own count already includes every copy; only a group the reader did not count
+            // is counted here from the copies it kept.
+            if (!counts.has(key))
+                existing.count += 1;
+            continue;
+        }
+        const traced = counts.get(key);
+        const entry = {
+            request,
+            count: Math.max(traced?.count ?? 1, 1),
+            ...(traced?.ms === undefined ? {} : { ms: traced.ms }),
+        };
+        seen.set(key, entry);
+        out.push(entry);
+    }
+    return out;
+}
+/**
+ * One collapsed request as the note writes it: `GET /api/articles/x → 200 ×2106 (in 4.1 s)`.
+ *
+ * The count is printed only when the page sent the request more than once, so an ordinary row
+ * reads exactly as before.
+ *
+ * @param shown - The request and its count.
+ * @param gotChars - How much of the response body to print, when the body matters.
+ * @returns The request's clause.
+ */
+function shownRequest(shown, gotChars) {
+    const line = gotChars === undefined ? requestLine(shown.request) : requestWithBody(shown.request, gotChars);
+    if (shown.count <= 1)
+        return line;
+    return `${line} ×${shown.count}${shown.ms === undefined ? '' : ` (in ${(shown.ms / 1000).toFixed(1)} s)`}`;
+}
+/**
+ * The sentence a render loop leads the note with.
+ *
+ * The loop is not a flaky API: an effect whose dependency list holds a value that is new on every
+ * render re-fetches forever, and the fix is that dependency list, never the test or the handler.
+ * m215's model found this only by unzipping a trace by hand after a wasted fix and a re-run.
+ *
+ * @param group - The repeated group.
+ * @param file - The app source file whose code sends it, when the caller read one.
+ * @returns The sentence.
+ */
+function requestLoopSentence(group, file) {
+    return (`\`${group.method} ${group.path}\` was sent ${group.count.toLocaleString('en-US')} times ` +
+        `in this test — a render loop: an effect whose dependency changes on every render (an ` +
+        `object/array/function created in render, or state the effect itself sets) re-fetches ` +
+        `forever; read ${file === null ? 'the component that fetches it.' : `\`${file}\`.`}`);
+}
+/**
+ * The app file the caller read for a repeated request, exact path first then a parameter match.
+ *
+ * @param group - The repeated group.
+ * @param callSites - What the caller read from the app's source.
+ * @returns The file, or null when no call stated the path.
+ */
+function callSiteOf(group, callSites) {
+    const sites = callSites ?? [];
+    const exact = sites.find((site) => site.method === group.method && site.path === group.path);
+    if (exact !== undefined)
+        return exact.file;
+    const matched = sites.find((site) => site.method === group.method && sameTracePath(site.path, group.path));
+    return matched?.file ?? null;
+}
 /**
  * The failing step's own request as the note writes it first: `the failing step sent DELETE
  * /api/profiles/x/follow → 200 got {"profile":{…}}`.
@@ -1968,6 +2229,107 @@ function sameOriginPath(request) {
         return null;
     return raw.replace(/\/+$/, '');
 }
+/** The API prefix a no-response request is judged by when the caller read none from the app. */
+const DEFAULT_API_PREFIX = '/api';
+/**
+ * Whether a same-origin path is on the app's own API.
+ *
+ * The caller reads the app's client config (`['/api']`); a trace with no such config is judged by
+ * the conventional `/api` mount. The boundary is explicit so `/apiary` is not a child of `/api`.
+ *
+ * @param path - A same-origin path, without a query or trailing slash.
+ * @param prefixes - The API prefixes the caller read, or empty.
+ * @returns True when the path is under one of them.
+ */
+function isApiPath(path, prefixes) {
+    const list = prefixes.length === 0 ? [DEFAULT_API_PREFIX] : prefixes;
+    return list.some((prefix) => {
+        const base = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;
+        return path === base || path.startsWith(`${base}/`);
+    });
+}
+/**
+ * The API requests a failing run's traces recorded with NO response, one entry per method+path.
+ *
+ * A request still in flight is not a server failure on its own ({@link unansweredRequest}), and
+ * the note says so. Several API paths left unanswered in one walk is a different fact: the server
+ * stopped answering while the tests ran, and the closing "the cause is in the page" reading is
+ * then false (xr-molecule-flash-m215 +36:28: three API paths got no response and two `page.goto`
+ * calls timed out across a platform restart, and the note sent the run at avatar components and
+ * token signing).
+ *
+ * @param items - The traces the note is about.
+ * @param apiPrefixes - The API prefixes the caller read, or empty.
+ * @returns One entry per distinct method+path, in the order the traces recorded them.
+ */
+function unansweredApiRequests(items, apiPrefixes) {
+    const groups = new Map();
+    for (const item of items) {
+        // The step's own requests are also in `item.requests` on a modern trace, but an older reader
+        // put them only on the action: count each method+path once per trace, not once per list.
+        const seen = new Set();
+        for (const request of [...item.requests, ...(item.lastAction?.requests ?? [])]) {
+            if (!unansweredRequest(request))
+                continue;
+            const path = sameOriginPath(request);
+            if (path === null || !isApiPath(path, apiPrefixes))
+                continue;
+            const key = `${request.method} ${path}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const known = groups.get(key);
+            if (known === undefined)
+                groups.set(key, { method: request.method, path, count: 1 });
+            else
+                known.count += 1;
+        }
+    }
+    return [...groups.values()];
+}
+/**
+ * Whether the runner reported this traced test's failure as a navigation that ran out of budget.
+ *
+ * The runner's own error names the call (`page.goto`, `page.reload`), and that report is the only
+ * signal used: m153 showed a `Frame.goto` that never finished on a trace whose failure was a 15 s
+ * `page.waitForSelector` timeout (the test was cut off mid-navigation), so an unfinished frame
+ * action alone would call a selector failure a page-load failure.
+ *
+ * @param item - One traced failure.
+ * @param failures - The runner's report, one entry per failing test.
+ * @returns True when this failure is a navigation that never finished.
+ */
+function navigationTimedOut(item, failures) {
+    const failure = runFailureOf(item, failures);
+    return failure !== undefined && navigationMethod(failure.operation) !== null;
+}
+/**
+ * The reading a run gets when the server stopped answering: the API requests with no response and
+ * the page loads that never finished, named once so both the lead and the closing sentence carry
+ * the same fact.
+ *
+ * @param requests - The API requests the traces recorded with no response.
+ * @param navigations - How many traced failures were a navigation that never finished.
+ * @param capital - True to start a sentence, false to continue one.
+ * @returns The sentence, without a trailing period run or a next step.
+ */
+function serverSilentReading(requests, navigations, capital) {
+    const shown = requests
+        .slice(0, 3)
+        .map((request) => `${request.method} ${request.path}${request.count > 1 ? ` ×${request.count}` : ''}`);
+    const more = requests.length > shown.length ? ` and ${requests.length - shown.length} more` : '';
+    const asked = requests.length === 0
+        ? ''
+        : `${requests.length} API ${requests.length === 1 ? 'request' : 'requests'} got no response` +
+            (shown.length === 0 ? '' : ` (${shown.join(', ')}${more})`);
+    const loads = navigations === 0
+        ? ''
+        : `${navigations} page ${navigations === 1 ? 'load' : 'loads'} never finished`;
+    const what = [asked, loads].filter((part) => part !== '').join(' and ');
+    return (`${capital ? 'The' : 'the'} server did not answer: ${what}. That is the app — a restart, a ` +
+        'cold start, or a request the server never finishes — being unavailable while these tests ' +
+        'ran, not page state.');
+}
 /**
  * The path segments a request ASKS FOR a credential through — a login, a registration, a token
  * endpoint — as opposed to a protected resource that presents one.
@@ -2049,15 +2411,109 @@ function isCredentialExchange(request, authEndpoints) {
         return true;
     return credentialExchangeBody(request.sent);
 }
+/** Whether two request records from one trace are the same entry (the action's copy and its own). */
+function sameRequestRecord(left, right) {
+    return (left.method === right.method &&
+        left.path === right.path &&
+        left.status === right.status &&
+        left.startedAt === right.startedAt);
+}
+/**
+ * The positive sign-in evidence a trace holds for THIS refused request's browser context, or null.
+ *
+ * Two readings, strongest first in the sentence but either is proof a token existed: a credential
+ * exchange the trace answered 2xx (the test's own registration/login), or any request the client
+ * attached an `Authorization` header to. A request from another browser context is not evidence
+ * about this one (m160), and a candidate with a clock is only prior when it started before the
+ * refusal. On a trace without clocks (an older Playwright, a synthetic fixture) the trace-level
+ * fact still stands, and the sentence says what the trace recorded rather than "before".
+ *
+ * @param item - The failing test's trace.
+ * @param request - The refused request.
+ * @param authEndpoints - The endpoints the app's auth config names.
+ * @returns The evidence, or null when the trace proves nothing about a session.
+ */
+function signInEvidenceFor(item, request, authEndpoints) {
+    // The action's own request list and the artifact's list overlap; dedupe by record identity.
+    const candidates = [...(item.lastAction?.requests ?? []), ...item.requests];
+    for (const candidate of candidates) {
+        if (sameRequestRecord(candidate, request))
+            continue;
+        if (request.context !== undefined &&
+            candidate.context !== undefined &&
+            candidate.context !== request.context)
+            continue;
+        if (typeof candidate.startedAt === 'number' && typeof request.startedAt === 'number') {
+            if (candidate.startedAt >= request.startedAt)
+                continue;
+            if (candidate.sentAuthorization === true)
+                return { request: candidate, kind: 'authorization', prior: true };
+            if (candidate.status >= 200 &&
+                candidate.status < 300 &&
+                isCredentialExchange(candidate, authEndpoints))
+                return { request: candidate, kind: 'exchange', prior: true };
+            continue;
+        }
+        // No clock to order by: the trace still proves the context had a session, never that it was
+        // before this request.
+        if (candidate.sentAuthorization === true)
+            return { request: candidate, kind: 'authorization', prior: false };
+        if (candidate.status >= 200 &&
+            candidate.status < 300 &&
+            isCredentialExchange(candidate, authEndpoints))
+            return { request: candidate, kind: 'exchange', prior: false };
+    }
+    return null;
+}
+/**
+ * How the signed-in sentence names its evidence: what the trace sent and got, and what that proves.
+ *
+ * @param evidence - The evidence {@link signInEvidenceFor} found.
+ * @returns The clause the sentence embeds.
+ */
+function signInEvidenceLine(evidence) {
+    const status = evidence.request.status > 0 ? ` → ${evidence.request.status}` : '';
+    const when = evidence.prior ? ' before this request' : '';
+    return evidence.kind === 'exchange'
+        ? `\`${requestLabel(evidence.request)}${status}\` is a sign-in this browser context completed${when}`
+        : `the client attached an \`Authorization\` header to \`${requestLabel(evidence.request)}\` in this browser context${when}`;
+}
+/**
+ * The route-guard reading for a refused request with no session evidence behind it.
+ *
+ * xr-molecule-flash-m221's whole detour: the test navigates to a protected URL while signed out and
+ * asserts the redirect its route owes. Nothing about the client is wrong; the trace already shows
+ * the URL transition, so the sentence names it and the guard the test's assertion measures.
+ *
+ * @param context - Where the refused request sits ({@link AuthRefusalContext}).
+ * @returns The clause, or '' when the last action was not a navigation.
+ */
+function routeGuardSentence(context) {
+    if (context.pageAfter === undefined)
+        return '';
+    if (context.lastAction === undefined)
+        return '';
+    if (!/\.(?:goto|reload|goBack|goForward)$/.test(context.lastAction))
+        return '';
+    const where = context.where === null ? ' The test’s last action' : ` In \`${context.where}\` the last action`;
+    const moved = context.pageBefore !== undefined && context.pageBefore !== context.pageAfter
+        ? `moved from ${context.pageBefore} to ${context.pageAfter}`
+        : `stayed at ${context.pageAfter}`;
+    return (`${where} was \`${context.lastAction}\` and the page ${moved}. If the assertion waits for a ` +
+        'redirect (a `toHaveURL` after visiting a protected route), the missing step is that route’s ' +
+        'guard: read where the page or router redirects a visitor with no stored session for that ' +
+        'path, not the HTTP client.');
+}
 /**
  * The sentence a 401/403 on the app's own API gets: which half of the wire refused the request.
  *
  * A fixed "read the handler this route reaches" line is the wrong half for a credential refusal.
  * The request's own `Authorization` header — recorded by the trace reader as its scheme WORD, never
- * its value — decides: absent means the CLIENT never attached the token (a session store that the
- * HTTP client does not read, a bare `fetch`, an auth bond the app replaced), while present means
- * the SERVER refused a token it was sent (scheme or issuer). A 403 is a permission answer, not a
- * credential one, and says so.
+ * its value — decides half of it: present means the SERVER refused a token it was sent (scheme or
+ * issuer). Absent means no token reached the server, and the CAUSE is read from the trace's
+ * session evidence ({@link signInEvidenceFor}): only a context that had signed in can have lost a
+ * token on the client, and only then may the note prescribe HTTP-client rewiring. A 403 is a
+ * permission answer, not a credential one, and says so.
  *
  * xr-molecule-flash-m148 (+29:18): `POST /api/articles/…/favorite → 401 {"errors":{"token":["is
  * missing"]}}` was answered with the handler sentence for six local walks, while the trace proved
@@ -2079,6 +2535,17 @@ function isCredentialExchange(request, authEndpoints) {
  * categorical handler sentence is gone from the no-header branch too, because a route that
  * requires a token where the app allows anonymous access is the handler's own mistake.
  *
+ * xr-molecule-flash-m221 (+20:13): `url-navigation.spec.ts` navigates to `/?feed=following` while
+ * SIGNED OUT and asserts the `/login` redirect. Its `GET /api/articles/feed → 401` carried no
+ * header because the test never signed in, and the old categorical sentence — "the client did not
+ * attach the token" — sent the model into replacing a working HTTP client; the replacement lost the
+ * session token for ~28 minutes. So the no-header sentence is OBSERVATIONAL unless the trace holds
+ * positive evidence that this context had a session ({@link signInEvidenceFor}); only then may it
+ * prescribe the client wiring, and it names that evidence and the failing test. Without evidence it
+ * says the refusal is expected for a signed-out test, and for a navigation failure names the URL
+ * transition the trace recorded and the route guard the assertion measures
+ * ({@link routeGuardSentence}).
+ *
  * The trace cannot name the file that made the call: a real HAR entry carries the request, response,
  * `_resourceType`, `_monotonicTime` and a frame ref, but no initiator stack. So the sentence names
  * the shared client and the auth bond instead of guessing a file.
@@ -2088,10 +2555,14 @@ function isCredentialExchange(request, authEndpoints) {
  *   request that carried no `Authorization` header.
  * @param authEndpoints - The endpoints the app's auth config names, so a credential exchange is
  *   recognised even under a path the segment list does not.
+ * @param context - The failing test's identity, the positive session evidence the trace holds, and
+ *   where its last action left the page ({@link AuthRefusalContext}).
  * @returns The sentence the note appends.
  */
-function authRefusalSentence(request, unbondedClient = false, authEndpoints = []) {
+function authRefusalSentence(request, unbondedClient = false, authEndpoints = [], context = { where: null, signIn: null }) {
     const label = requestLabel(request);
+    const where = context.where === null ? '' : `In \`${context.where}\`, `;
+    const evidence = context.signIn;
     // The header's scheme, when it parsed; presence alone is still the server's half of the wire.
     const carried = request.authorization !== undefined
         ? `with \`Authorization: ${request.authorization} …\``
@@ -2120,16 +2591,25 @@ function authRefusalSentence(request, unbondedClient = false, authEndpoints = []
             'and read the client per request instead of capturing it at setup.'
         : '';
     if (request.status === 403) {
-        return request.sentAuthorization === true
-            ? `The browser sent \`${label}\` ${carried} and the API answered 403 — the token was ` +
+        if (request.sentAuthorization === true)
+            return (`The browser sent \`${label}\` ${carried} and the API answered 403 — the token was ` +
                 'accepted but this user may not do it: read the route’s role/permission check in your ' +
-                'own source, and the account the session belongs to.'
-            : `The browser sent \`${label}\` and the API answered 403 — the request carried no ` +
-                '`Authorization` header, so either the client did not attach the token (check that the ' +
-                'request goes through the app’s HTTP client that the auth bond configures, and that the ' +
-                'token is stored where the client reads it) or the route refuses this user: read the ' +
-                'route’s role/permission check in your own source.' +
-                unbonded;
+                'own source, and the account the session belongs to.');
+        if (evidence !== null)
+            return (`${where}the browser sent \`${label}\` with no \`Authorization\` header and this context ` +
+                `had already signed in — ${signInEvidenceLine(evidence)} — so a token existed and this ` +
+                'request did not carry it: check that the request goes through the app’s HTTP client ' +
+                'that the auth bond configures, and that the token is stored where the client reads it. ' +
+                'If the request did carry one, the route refuses this user: read the route’s ' +
+                'role/permission check in your own source.' +
+                unbonded);
+        return (`${where}the browser sent \`${label}\` and the API answered 403 — the request carried no ` +
+            '`Authorization` header, so the route refused it without a viewer. If this test is signed ' +
+            "out, that refusal is expected: inspect the page's redirect/guard instead. Diagnose token " +
+            'attachment only if this same page/context had completed sign-in or held a restored session ' +
+            'before this request; otherwise read the route’s role/permission check in your own source.' +
+            routeGuardSentence(context) +
+            unbonded);
     }
     if (request.sentAuthorization === true) {
         return (`The browser sent \`${label}\` ${carried} and the API refused it: the token was sent and ` +
@@ -2137,14 +2617,34 @@ function authRefusalSentence(request, unbondedClient = false, authEndpoints = []
             'token’s issuer differs from what the server verifies; read the verify middleware this ' +
             'route reaches.');
     }
-    return (`The browser sent \`${label}\` with NO \`Authorization\` header — the client did not attach ` +
-        'the token: check that the request goes through the app’s HTTP client that the auth bond ' +
-        'configures (not a bare `fetch`), and that the token is stored where the client reads it. ' +
-        'The shared client carries it through `setAuthToken` — the auth bond ' +
-        '(`createDefaultAuthClientWithHttpSync` in `@molecule/app-bonds-default-react`) mirrors the ' +
-        'auth client’s token there, and a session store of your own has to call it too. ' +
+    // The trace holds positive proof this context had a session: the token exists, this request
+    // did not carry it, and the fix is the client's connection to the app's own token source. The
+    // wording names the API the run needs (m221 +56:20: registering `setAuthTokenSource` is what
+    // finally made the induced regression's tests pass).
+    if (evidence !== null) {
+        return (`${where}the browser sent \`${label}\` with no \`Authorization\` header, and this context ` +
+            `had already signed in — ${signInEvidenceLine(evidence)} — so the token exists and this ` +
+            'request did not carry it. In the HTTP bond, register ' +
+            '`setAuthTokenSource(() => <your existing synchronous in-memory token getter>)` before ' +
+            'requests run, and update that same source on sign-in, session restore and sign-out. Do ' +
+            'not initialize a second auth client to obtain another token: the getter must return the ' +
+            'real token synchronously (`null` when signed out), with the stored session restored before ' +
+            'protected requests.' +
+            (request.sentCookie
+                ? ' The request did carry a `Cookie` header, so if this app signs in with a session cookie ' +
+                    'that is the credential the server did not accept. '
+                : '') +
+            unbonded);
+    }
+    // No session evidence: the refusal may be exactly what the test set up. Observational, and the
+    // route guard is the next read when the failing action was a navigation (m221's whole detour).
+    return (`This request carried no \`Authorization\` header and the API answered ${request.status}. ` +
+        "If this test is signed out, that refusal is expected: inspect the page's redirect/guard " +
+        'instead. Diagnose token attachment only if this same page/context had completed sign-in or ' +
+        'held a restored session before this request.' +
+        routeGuardSentence(context) +
         (request.sentCookie
-            ? 'The request did carry a `Cookie` header, so if this app signs in with a session cookie ' +
+            ? ' The request did carry a `Cookie` header, so if this app signs in with a session cookie ' +
                 'that is the credential the server did not accept. '
             : '') +
         unbonded);
@@ -2152,18 +2652,21 @@ function authRefusalSentence(request, unbondedClient = false, authEndpoints = []
 /**
  * The note's credential-refusal advice, one sentence per distinct shape — at most two.
  *
- * The shapes are `(status, Authorization scheme, cookie present, credential exchange)`: m148's ten
- * walks repeated one shape (`401`, no header) on every failing test, and repeating its sentence per
- * row would bury the fact rather than state it. A login and a protected request that both carry no
- * header are DIFFERENT shapes — one is the credentials being checked, the other is a token that was
- * never attached (m165).
+ * The shapes are `(status, Authorization scheme, cookie present, credential exchange, session
+ * evidence)`: m148's ten walks repeated one shape (`401`, no header) on every failing test, and
+ * repeating its sentence per row would bury the fact rather than state it. A login and a protected
+ * request that both carry no header are DIFFERENT shapes — one is the credentials being checked,
+ * the other is a request that presented no token (m165). A protected request WITH session evidence
+ * and one without are different shapes too: only the first can say a token was lost on the client
+ * (m221), and collapsing them would prescribe the HTTP-client rewiring for a signed-out route test.
  *
  * @param items - The traces the note is about.
  * @param authEndpoints - The endpoints the app's auth config names.
+ * @param failures - The runner's report, so the sentence names the failing test it is about.
  * @returns The sentences to append (each led by a space), or '' when no same-origin 401/403 was
  *   traced.
  */
-function authRefusalAdvice(items, authEndpoints = []) {
+function authRefusalAdvice(items, authEndpoints = [], failures = []) {
     const sentences = [];
     const seen = new Set();
     // A page that logged `no client is bonded` explains every request it sent without a
@@ -2181,11 +2684,22 @@ function authRefusalAdvice(items, authEndpoints = []) {
             if (isLogoutRequest(request))
                 continue;
             const exchange = isCredentialExchange(request, authEndpoints);
-            const key = `${request.status} ${exchange ? 'exchange' : request.sentAuthorization ? (request.authorization ?? 'header') : 'none'} ${request.sentCookie ? 'cookie' : ''}`;
+            const signIn = exchange
+                ? null
+                : request.sentAuthorization === true
+                    ? null
+                    : signInEvidenceFor(item, request, authEndpoints);
+            const key = `${request.status} ${exchange ? 'exchange' : request.sentAuthorization ? (request.authorization ?? 'header') : 'none'} ${request.sentCookie ? 'cookie' : ''} ${signIn === null ? 'unverified' : `signed-in:${signIn.kind}`}`;
             if (seen.has(key))
                 continue;
             seen.add(key);
-            sentences.push(authRefusalSentence(request, unbondedClient, authEndpoints));
+            sentences.push(authRefusalSentence(request, unbondedClient, authEndpoints, {
+                where: item.spec === null ? null : failureWhereOf(item, failures),
+                signIn,
+                pageBefore: item.lastAction?.pageBefore,
+                pageAfter: item.lastAction?.pageAfter,
+                lastAction: item.lastAction?.api,
+            }));
             if (sentences.length === 2)
                 return ` ${sentences.join(' ')}`;
         }
@@ -2773,12 +3287,16 @@ export function hiddenBoxNote(items) {
  * config names; the traces add what their own requests show) and never assumed to be `/api`.
  *
  * A 401/403 on the app's own origin is answered from the request's own credential record instead
- * ({@link authRefusalSentence}): no `Authorization` header means the CLIENT never attached the
- * token (the shared HTTP client's `setAuthToken` is what the auth bond mirrors it into), while a
- * header the API then refused moves the answer to the server. The handler sentence is kept for
- * the rest — 404/422/500 — and dropped when every failure was a credential refusal, because a
- * trace that proves the header was never sent cannot be explained by the handler.
- * xr-molecule-flash-m148 (+29:18) hit this exactly: six local walks read
+ * ({@link authRefusalSentence}): a header the API then refused moves the answer to the server. No
+ * header is read together with the trace's session evidence — the failing test's identity, a
+ * credential exchange it answered 2xx, a request the client already attached a token to — and only
+ * positive evidence may prescribe the client's token wiring; otherwise the sentence is
+ * observational and, for a navigation failure, names the URL transition and the route guard
+ * (xr-molecule-flash-m221: a signed-out redirect test's `GET /api/articles/feed → 401` sent the
+ * model into replacing a working HTTP client, which lost the session token for ~28 minutes). The
+ * handler sentence is kept for the rest — 404/422/500 — and dropped when every failure was a
+ * credential refusal, because a trace that proves the header was never sent cannot be explained by
+ * the handler. xr-molecule-flash-m148 (+29:18) hit this exactly: six local walks read
  * `POST …/favorite → 401 {"errors":{"token":["is missing"]}}` as a handler bug.
  *
  * A credential EXCHANGE (a login/registration/token endpoint, read from the app's auth config, the
@@ -2859,7 +3377,7 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
     // Every recorded failure is the logout endpoint answering 4xx: the row's own sentence explains
     // it, and neither the handler lead nor the credential reading applies (m156 +24:02).
     const onlyLogoutFailures = failedRequests.length > 0 && failedRequests.every((request) => isLogoutRequest(request));
-    const authAdvice = authRefusalAdvice(traced, report.authEndpoints ?? []);
+    const authAdvice = authRefusalAdvice(traced, report.authEndpoints ?? [], failures);
     // Set-up traffic the trace shows going to an origin other than the app's (m165): the rows it
     // creates are not in this app's database, so the note says it before any app-side reading.
     const foreignOrigins = foreignOriginApiRequests(traced, apiPrefixes);
@@ -2879,6 +3397,18 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
         ...new Set(stalls.flatMap((stall) => (stall === null ? [] : [stall.reported]))),
     ];
     const anyStalled = stalls.some((stall) => stall !== null);
+    // The server stopped answering while the tests ran (m215): several API requests with no
+    // response, or a navigation that never finished. A single request still in flight is not this
+    // (m112), and the note must never close with "the cause is in the page" beside it — the run
+    // then rewrites the page while the API was the thing that never answered.
+    const silentApiRequests = unansweredApiRequests(traced, apiPrefixes);
+    const silentNavigations = traced.filter((item) => navigationTimedOut(item, failures)).length;
+    const serverSilent = silentApiRequests.length >= 2 || silentNavigations > 0;
+    // A single unanswered request stays what it always was (m112). Two or more distinct API paths
+    // are a fact about the server, and it leads the note before any row.
+    const serverSilentLead = silentApiRequests.length < 2
+        ? ''
+        : `${serverSilentReading(silentApiRequests, silentNavigations, true)}\n\n`;
     const rows = [];
     // Rows whose failing action sent nothing and left the page on a new route: the page is still
     // showing the previous route's data. Counted so the note can say it once for the whole run.
@@ -2943,11 +3473,12 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
                 parts.push(`${head}, and it sent no request`);
             }
             else {
-                const shown = stepRequests.slice(0, room);
+                const shown = collapseRequests(stepRequests, item.repeated).slice(0, room);
                 room -= shown.length;
                 // The response body is the point (m148: the register `POST /api/users` answered 201 and
-                // the page rendered signed-out anyway) — printed whatever the status.
-                parts.push(`${head}, and it sent ${shown.map((request) => requestWithBody(request, TRACE_NOTE_LEAD_GOT_CHARS)).join('; ')}`);
+                // the page rendered signed-out anyway) — printed whatever the status. A method+path the
+                // page sent many times prints ONCE with its count (m215's four identical `→ 200` lines).
+                parts.push(`${head}, and it sent ${shown.map((entry) => shownRequest(entry, TRACE_NOTE_LEAD_GOT_CHARS)).join('; ')}`);
             }
             // What the page did next: a navigation shows in the main frame's URL even when the app moved
             // client-side and the network log recorded no document request.
@@ -2971,13 +3502,16 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
                 parts.push(logoutIgnoredSentence(stepLast, step.pageAfter));
         }
         else if (lead !== undefined) {
-            parts.push(leadRequestLine(lead));
+            const [leadShown] = collapseRequests([lead], item.repeated);
+            parts.push(leadShown === undefined
+                ? leadRequestLine(lead)
+                : `the failing step sent ${shownRequest(leadShown, TRACE_NOTE_LEAD_GOT_CHARS)}`);
             room -= 1;
         }
         if (failed.length > 0) {
-            const shown = failed.slice(0, room);
+            const shown = collapseRequests(failed, item.repeated).slice(0, room);
             room -= shown.length;
-            parts.push(`failed: ${shown.map(requestLine).join('; ')}`);
+            parts.push(`failed: ${shown.map((entry) => shownRequest(entry)).join('; ')}`);
         }
         if (stalled.length > 0 && room > 0) {
             const shown = stalled.slice(0, room);
@@ -3004,7 +3538,10 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
             const label = step !== undefined && !stalledNav && stepRequests.length === 0
                 ? 'also answered (started before the action)'
                 : 'answered';
-            parts.push(`${label}: ${answered.slice(0, room).map(requestLine).join('; ')}`);
+            parts.push(`${label}: ${collapseRequests(answered, item.repeated)
+                .slice(0, room)
+                .map((entry) => shownRequest(entry))
+                .join('; ')}`);
         }
         if (item.console.length > 0)
             parts.push(`console: ${item.console
@@ -3145,7 +3682,20 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
             .map((reset) => [`${reset.request.method} ${reset.request.path}\u0000${reset.field}`, reset])).values(),
     ];
     const formResetLead = formResets.length === 0 ? '' : `${formResets.slice(0, 2).map(formResetSentence).join(' ')}\n\n`;
-    return (readContradictionLead +
+    // One method+path the page sent twenty times or more in a single test is a render loop, not a
+    // flaky API, and it LEADS the note (m215: 2,106 GETs printed as four identical `→ 200` lines
+    // sent the run at the wrong component; it found the loop only by unzipping the trace by hand).
+    // The most-repeated group wins when a run has more than one.
+    const loopGroup = traced
+        .flatMap((item) => item.repeated ?? [])
+        .filter((group) => group.count >= TRACE_NOTE_LOOP_REPEATS)
+        .sort((left, right) => right.count - left.count)[0];
+    const loopLead = loopGroup === undefined
+        ? ''
+        : `${requestLoopSentence(loopGroup, callSiteOf(loopGroup, report.callSites))}\n\n`;
+    return (serverSilentLead +
+        loopLead +
+        readContradictionLead +
         formResetLead +
         missingTextLead +
         transportLead +
@@ -3204,13 +3754,20 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
                             ? // The trace's own snapshot explains why the element Playwright resolved has no box:
                                 // a fact about the element, so it replaces the "look at the page" advice (m197).
                                 hiddenBox
-                            : 'No listed request failed — none got a 4xx/5xx or a network error — so the cause is in the ' +
-                                "page, not the API. Start with what the test's last action sent (the first line of each " +
-                                'row) and what the page did next: a request that answered (2xx included) while the page ' +
-                                'still did not show the state the assertion waited on is the fact to read — its status ' +
-                                'and response body, not the selector. If the request is not the one the test meant — an ' +
-                                'unfollow sent where the test clicked follow — the state the action read was stale ' +
-                                'before it.') +
+                            : serverSilent
+                                ? // The server did not answer (m215): a page-state reading would send the run at
+                                    // the markup while nothing answered it. Same fact as the lead, and the one action.
+                                    'No listed request failed — none got a 4xx/5xx or a network error — but ' +
+                                        `${serverSilentReading(silentApiRequests, silentNavigations, false)} ` +
+                                        `Re-run only these tests against ${target} (\`--last-failed\`) before changing ` +
+                                        'any code; change the app only if they fail again with requests that answered.'
+                                : 'No listed request failed — none got a 4xx/5xx or a network error — so the cause is in the ' +
+                                    "page, not the API. Start with what the test's last action sent (the first line of each " +
+                                    'row) and what the page did next: a request that answered (2xx included) while the page ' +
+                                    'still did not show the state the assertion waited on is the fact to read — its status ' +
+                                    'and response body, not the selector. If the request is not the one the test meant — an ' +
+                                    'unfollow sent where the test clicked follow — the state the action read was stale ' +
+                                    'before it.') +
         prefixAdvice +
         (wrapped
             ? ' The API received a body wrapped in `data`: app-http’s `post(url, data, config)` / ' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-ai-tools",
-  "version": "1.10.5",
+  "version": "1.10.6",
   "description": "Shared AI agent tools with backend abstraction for sandbox and local execution",
   "type": "module",
   "main": "dist/index.js",