@reticlehq/server 2.10.0 → 2.12.0

package/dist/session/session.js

@@ -1,5 +1,7 @@
 import { recordImpact } from '../impact/impact-recorder.js';
 import { LastAct } from './last-act.js';
+import { GapLedger } from '../honesty/gap-ledger.js';
+import { CaptureLedger } from '../honesty/feature-capture.js';
 import { commandTimeoutMessage } from './command-timeout.js';
 import { readHealthEvent } from './session-health.js';
 /** The HUD does not need 200 frames to watch a counter climb; the last state always lands. */
@@ -106,6 +108,30 @@ export class Session {
     #journalReader;
     /** What this session has learned by watching its own stream: ambient churn + blind-spot levels. */
     #observed = new ObservedState();
+    /**
+     * Which document is on screen right now — the one the most recent stamped event was observed under.
+     *
+     * DERIVED, never announced. The SDK mints a document id once per real document and stamps it on
+     * every event, so the stream already carries the answer; asking the page for it separately would be
+     * a second source of truth that can disagree with the evidence it is supposed to scope. A full
+     * navigation or a reload builds a new document, mints a new id, and the first event carrying it
+     * moves this forward — which is exactly the moment the previous document's evidence stops being
+     * about the world. An SPA route change keeps the same document and so keeps the same id, which is
+     * correct rather than a limitation: same JavaScript context, same in-flight requests, same evidence.
+     *
+     * An UNSTAMPED event never clears this. An SDK older than the field stamps nothing, and letting one
+     * such event blank the current document would make every later comparison vacuous.
+     */
+    #documentId;
+    /**
+     * The edit epoch of the most recent stamped event. DERIVED for the same reason `#documentId` is:
+     * the stream already carries it, and asking the page separately would be a second source of truth.
+     *
+     * A hot update advances it INSIDE the same document, which is the case `#documentId` structurally
+     * cannot see — no navigation, same page, replaced code. An unstamped event never clears it: most
+     * pages have no hot-update channel at all, so absence is "unknown", never "back to no edits".
+     */
+    #editEpoch;
     constructor(hello, socket, clock) {
         this.id = hello.sessionId;
         this.projectId = hello.projectId;
@@ -200,8 +226,20 @@ export class Session {
     staleMs() {
         return this.#clock() - this.#startedAt;
     }
+    /** The document the most recent stamped event was observed under. See `#documentId`. */
+    get currentDocumentId() {
+        return this.#documentId;
+    }
+    /** The edit epoch the most recent stamped event was observed under. See `#editEpoch`. */
+    get currentEditEpoch() {
+        return this.#editEpoch;
+    }
     /** Re-stamp an incoming event with server-relative time, buffer it, and fan out. */
     pushEvent(event, byteSize) {
+        if (event.documentId !== undefined)
+            this.#documentId = event.documentId;
+        if (event.editEpoch !== undefined)
+            this.#editEpoch = event.editEpoch;
         if (event.type === EventType.PAGE_HEALTH) {
             const r = readHealthEvent(event.data);
             this.applyHealth(r.hidden ?? this.#hidden, r.focused ?? this.#focused, r.runtime, r.engine, r.brand);
@@ -343,19 +381,50 @@ export class Session {
      * action id. Ids are minted independently of command correlation ids so the journal is self-contained.
      */
     beginAction(tool, args) {
-        this.#actionSeq += 1;
-        const actionId = `${ACTION_ID_PREFIX}${String(this.#actionSeq)}`;
+        const actionId = this.#mintActionId();
         // Held here, not only in the journal: with the journal off every event was unattributed, and
         // pushEvent reads that as ambient churn the settle oracle then ignores. See action-attribution test.
         this.#activeActionId = actionId;
         this.#journal?.beginAction(actionId, tool, args);
         return actionId;
     }
+    /**
+     * Record one action WITHOUT opening an attribution window — for a tool that returns a verdict but
+     * drives nothing, so no event it observes was caused by it. See `JournalRecorder.recordAction`.
+     */
+    recordAction(tool, args, effect) {
+        const actionId = this.#mintActionId();
+        this.#journal?.recordAction(actionId, tool, args, effect);
+        return actionId;
+    }
+    #mintActionId() {
+        this.#actionSeq += 1;
+        return `${ACTION_ID_PREFIX}${String(this.#actionSeq)}`;
+    }
+    /**
+     * How many actions this session has dispatched.
+     *
+     * The counter that mints journal action ids, not a second one — so it equals the journal's own
+     * length, and `reticle_context`'s `step`, whenever this session journals at all.
+     */
+    get actionCount() {
+        return this.#actionSeq;
+    }
     /** Close the active action window, persisting its action record with the settle outcome. */
     finishAction(effect, settled, settledInMs) {
         this.#activeActionId = undefined;
         this.#journal?.finishAction(effect, settled, settledInMs);
     }
+    /**
+     * The durable action ledger for this session — the ledger the run context is folded out of.
+     *
+     * `[]` when nothing journals this session (journaling disabled, or an id that is not a safe path
+     * segment). An absent ledger reads as an empty run, never as a missing one: the fold simply has
+     * nothing to say, which is the honest answer.
+     */
+    async readJournalActions() {
+        return (await this.#journalReader?.readActions?.()) ?? [];
+    }
     /** Flush any buffered journal events to disk (call on session end). */
     async flushJournal() {
         await this.#journal?.flush();
@@ -370,6 +439,19 @@ export class Session {
      * from it, and the split between those two tool calls is the whole reason it exists.
      */
     lastAct = new LastAct();
+    /**
+     * What this app still cannot tell Reticle, as of the most recent verdict.
+     *
+     * Lives on the session because that is the scope the question belongs to: "am I done with this
+     * app" is a session question, and a gap closed halfway through must not follow the agent to the
+     * end of it.
+     */
+    gaps = new GapLedger();
+    /**
+     * The read-only calls the journal does not keep, so "was `reticle_context` ever called" has
+     * something to fold. See honesty/feature-capture.ts — it is the only state that instrument adds.
+     */
+    capture = new CaptureLedger();
     // ── Server-authoritative liveness (immune to browser-tab throttling) ──────────────
     /**
      * Stamp the wall-clock of the latest AGENT command (called whenever a tool resolves this session).

package/dist/session/stall-clock.d.ts

@@ -0,0 +1,18 @@
+/**
+ * When a run with nothing connected is worth mentioning to a human.
+ *
+ * Ten minutes sits well past setup latency — reading a doc, restarting a dev server, opening a tab —
+ * and short enough that the warning still arrives while somebody is at the keyboard.
+ */
+export declare const STALL_AFTER_MS: number;
+/** Start the clock, from the same place the instrumentation clock is marked. */
+export declare function markStallClock(now: number): void;
+/**
+ * How long this daemon has waited with no app, or undefined if the question is moot.
+ *
+ * Moot means the clock was never started, or an app already connected. A run that starts slowly and
+ * then works has nothing to report, which is why this returns undefined rather than a duration.
+ */
+export declare function stallUptime(now: number): number | undefined;
+/** Tests only. */
+export declare function resetStallClock(): void;

package/dist/session/stall-clock.js

@@ -0,0 +1,48 @@
+/**
+ * How long this daemon has waited with no app connected.
+ *
+ * This is what survived `instrumentation_stalled`. The EVENT was removed: it claimed to separate
+ * "never wired" from "died before reporting" and did not, because it only fired on a flush tick or a
+ * graceful shutdown, so a killed daemon was invisible to it exactly as before. Everything it carried
+ * is derivable from `daemon_started` minus `app_instrumented`, joined on `sessionId` — and that set
+ * difference is strictly MORE complete, because it does catch the killed daemons. A second way to
+ * compute the same number that disagrees with the first is worse than not having it.
+ *
+ * The CLOCK is a different thing and stays. Two live features read it, neither of them a metric: the
+ * no-session diagnosis tells an agent how long this daemon has been waiting, and the daemon warns on
+ * stderr when a run passes the threshold with nothing connected. Both are help for somebody stuck
+ * mid-install, which is the moment they are least able to work it out themselves.
+ *
+ * It lives under `session/` rather than `telemetry/` now, beside the two files that read it. The old
+ * home is why the removal looked like it would take the diagnosis with it.
+ */
+import { appEverConnected } from '../telemetry/app-instrumented.js';
+/**
+ * When a run with nothing connected is worth mentioning to a human.
+ *
+ * Ten minutes sits well past setup latency — reading a doc, restarting a dev server, opening a tab —
+ * and short enough that the warning still arrives while somebody is at the keyboard.
+ */
+export const STALL_AFTER_MS = 10 * 60 * 1000;
+let daemonStartedAt;
+/** Start the clock, from the same place the instrumentation clock is marked. */
+export function markStallClock(now) {
+    daemonStartedAt = now;
+}
+/**
+ * How long this daemon has waited with no app, or undefined if the question is moot.
+ *
+ * Moot means the clock was never started, or an app already connected. A run that starts slowly and
+ * then works has nothing to report, which is why this returns undefined rather than a duration.
+ */
+export function stallUptime(now) {
+    if (daemonStartedAt === undefined)
+        return undefined;
+    if (appEverConnected())
+        return undefined;
+    return now - daemonStartedAt;
+}
+/** Tests only. */
+export function resetStallClock() {
+    daemonStartedAt = undefined;
+}

package/dist/telemetry/automation-hint.d.ts

@@ -1,5 +1,5 @@
 import { AutomationHint } from '@reticlehq/core';
-export interface AutomationInput {
+interface AutomationInput {
     env: NodeJS.ProcessEnv;
     fileExists: (path: string) => boolean;
     hasTty: boolean;
@@ -15,3 +15,4 @@ export interface AutomationInput {
 export declare function resolveAutomationHint(input: AutomationInput): AutomationHint | undefined;
 /** The real reading, taken once per process. */
 export declare function currentAutomationHint(env: NodeJS.ProcessEnv): AutomationHint | undefined;
+export {};

package/dist/telemetry/daemon-telemetry.js

@@ -13,8 +13,7 @@ import { profileProject } from './project-profile.js';
 import { startUpdateCheck } from '../update/update-nudge.js';
 import { markDaemonStart } from './mcp-connection.js';
 import { markInstrumentationClock } from './app-instrumented.js';
-import { markStallClock, reportInstrumentationStall, STALL_AFTER_MS, } from './instrumentation-stall.js';
-import { readProjectId } from '../cli/cli-port.js';
+import { markStallClock, STALL_AFTER_MS, stallUptime } from '../session/stall-clock.js';
 /** Let the daemon finish coming up before walking the source tree for a profile. */
 const PROJECT_PROFILE_DELAY_MS = 5_000;
 /**
@@ -74,19 +73,18 @@ export function installDaemonTelemetry(cwd, now = () => Date.now()) {
             /* a profile is a nice-to-have; it must never touch the daemon */
         }
     }, PROJECT_PROFILE_DELAY_MS).unref();
+    // Once per daemon run: a warning repeated every ten minutes at somebody already stuck is noise.
+    let stallWarned = false;
     const flushWindow = () => {
-        // BEFORE the idle return, and that ordering is the whole point: a stalled install produces an
-        // empty window by definition — no app, so no tool calls, so nothing to roll up. Checking it
-        // after the early return would make the one case this event exists for the one case it never
-        // sees. It is self-limiting (once per run, never after an app connects), so running it on every
-        // tick costs a comparison.
-        const stalled = reportInstrumentationStall({
-            // Same test `app_instrumented` uses for the same field, so the success and failure events
-            // stay directly comparable: a stamped projectId means `init` has run here.
-            initialized: readProjectId(cwd) !== undefined,
-            agentAttached: metrics.agentEverAttached,
-        }, now);
-        if (stalled) {
+        // BEFORE the idle return, and that ordering still matters for the reason the removed event
+        // documented: a stalled install produces an empty window by definition — no app, so no tool
+        // calls, so nothing to roll up — so checking after the early return would never fire on the one
+        // case worth warning about. What is left here is the WARNING, for a human watching the log; the
+        // metric that used to ride alongside it was removed as a second, less complete way to compute
+        // `daemon_started` minus `app_instrumented`.
+        const waited = stallUptime(now());
+        if (!stallWarned && waited !== undefined && waited >= STALL_AFTER_MS) {
+            stallWarned = true;
             const minutes = Math.round(STALL_AFTER_MS / 60_000);
             process.stderr.write(`[reticle] no app has connected after ${String(minutes)} minutes — ` +
                 'the install may be incomplete. Restart the dev server if you added the Reticle plugin.\n');
@@ -113,15 +111,6 @@ export function installDaemonTelemetry(cwd, now = () => Date.now()) {
             stopped ??= (async () => {
                 clearInterval(flush);
                 clearTimeout(firstFlush);
-                // Last chance to say that no app ever arrived. The periodic path cannot report an
-                // UNATTENDED stall at all — that daemon idle-exits at five minutes and the periodic
-                // threshold is ten — so without this the event only ever describes daemons with an agent
-                // attached, which is not the population it was built to measure. Self-limiting: if the
-                // interval already reported, this returns false and emits nothing.
-                reportInstrumentationStall({
-                    initialized: readProjectId(cwd) !== undefined,
-                    agentAttached: metrics.agentEverAttached,
-                }, now, { atShutdown: true });
                 // The rich one: the whole session in a single event — duration, the tool histogram, error
                 // shapes, verifications, browser launches. This is what replaced the per-tool-call event.
                 await getTelemetry().emit(TelemetryEventKind.DAEMON_STOPPED, {

package/dist/telemetry/feedback-outbox.d.ts

@@ -1,5 +1,5 @@
 /** One queued report: the payload, plus what is needed to find and remove it again. */
-export interface OutboxEntry {
+interface OutboxEntry {
     id: string;
     t: string;
     payload: unknown;
@@ -20,3 +20,4 @@ export declare function readOutbox(home?: string): OutboxEntry[];
  * Volume is a handful of lines a week, so the cost is irrelevant.
  */
 export declare function markDelivered(id: string | null, home?: string): void;
+export {};

package/dist/telemetry/project-profile.d.ts

@@ -13,9 +13,6 @@ export declare const FeatureFamily: {
     readonly BUG_CAPSULES: "bug_capsules";
     readonly CROSS_RUN_HISTORY: "cross_run_history";
 };
-export type FeatureFamily = (typeof FeatureFamily)[keyof typeof FeatureFamily];
-/** Count source files, stopping at the cap (the cap itself lands in the largest bucket, correctly). */
-export declare function countSourceFiles(root: string, readDir?: DirReader): number;
 export declare function sizeBucket(sourceFiles: number): ProjectSize;
 /**
  * Project age in whole WEEKS, from the repo's first commit.
@@ -30,11 +27,6 @@ export declare function sizeBucket(sourceFiles: number): ProjectSize;
 export declare function projectAgeWeeks(root: string, now: number, read?: FileReader): number | undefined;
 /** True when package.json declares workspaces — monorepos exercise very different code paths. */
 export declare function isMonorepo(root: string, read?: FileReader): boolean;
-interface DirEntry {
-    name: string;
-    isDirectory: boolean;
-}
-type DirReader = (dir: string) => DirEntry[];
 type FileReader = (path: string) => string;
 /**
  * Build the full profile. Best-effort throughout: an unreadable project yields a profile of zeroes

package/dist/telemetry/project-profile.js

@@ -45,7 +45,7 @@ const MAX_FILES_SCANNED = 6000;
 const MAX_WALK_DEPTH = 8;
 const MS_PER_WEEK = 7 * 24 * 60 * 60 * 1000;
 /** Count source files, stopping at the cap (the cap itself lands in the largest bucket, correctly). */
-export function countSourceFiles(root, readDir = defaultReadDir) {
+function countSourceFiles(root, readDir = defaultReadDir) {
     let count = 0;
     const walk = (dir, depth) => {
         if (depth > MAX_WALK_DEPTH || count >= MAX_FILES_SCANNED)

package/dist/telemetry/run-telemetry.d.ts

@@ -11,8 +11,6 @@
  * how a replay works.
  */
 import { type ReticleVerificationRun } from '@reticlehq/core';
-/** The tool name reported for this path, so CI runs are distinguishable from agent-driven ones. */
-export declare const VERIFY_SURFACE = "reticle_verify";
 /**
  * Report one completed verification run: the verdict, and one bug per failing flow.
  *

package/dist/telemetry/run-telemetry.js

@@ -14,7 +14,7 @@ import { BugAttribution, BugSource, RunFlowStatus, TelemetryActor, TelemetryEven
 import { getSessionMetrics } from './session-metrics.js';
 import { getTelemetry } from './telemetry.js';
 /** The tool name reported for this path, so CI runs are distinguishable from agent-driven ones. */
-export const VERIFY_SURFACE = 'reticle_verify';
+const VERIFY_SURFACE = 'reticle_verify';
 /**
  * Report one completed verification run: the verdict, and one bug per failing flow.
  *

package/dist/telemetry/session-metrics.d.ts

@@ -133,7 +133,7 @@ export declare class SessionMetrics {
     /**
      * Has an agent ever attached to this daemon?
      *
-     * Read by the instrumentation-stall check, which needs to tell two very different silences apart:
+     * Read by the stall clock, which needs to tell two very different silences apart:
      * a daemon nobody is using, and a daemon with an agent sitting on it that has no app to drive.
      * The second is the funnel's failure case and the first is not a problem at all.
      */

package/dist/telemetry/session-metrics.js

@@ -575,7 +575,7 @@ export class SessionMetrics {
     /**
      * Has an agent ever attached to this daemon?
      *
-     * Read by the instrumentation-stall check, which needs to tell two very different silences apart:
+     * Read by the stall clock, which needs to tell two very different silences apart:
      * a daemon nobody is using, and a daemon with an agent sitting on it that has no app to drive.
      * The second is the funnel's failure case and the first is not a problem at all.
      */

package/dist/telemetry/telemetry.d.ts

@@ -1,4 +1,15 @@
-import { TelemetryEventKind, ProjectIdSource, type Crash, type Feedback, type Identity, type BugFound, type InitOutcome, type InstallSource, type McpConnection, type McpOutage, type ToolRefusal, type AppInstrumentation, type InstrumentationStall, type ProjectProfile, type SessionSummary, type TelemetryActor, type Verification, type VersionChange } from '@reticlehq/core';
+import { TelemetryEventKind, ProjectIdSource, type Crash, type Feedback, type Identity, type BugFound, type InitOutcome, type InstallSource, type McpConnection, type McpOutage, type ToolRefusal, type AppInstrumentation, type ProjectProfile, type SessionSummary, type TelemetryActor, type Verification, type VersionChange } from '@reticlehq/core';
+/**
+ * PostHog's group type for a licensed customer. Sent as `$groups` so PostHog can aggregate a whole
+ * organisation natively: per-company retention, "which orgs went quiet", one row per customer rather
+ * than one per machine.
+ *
+ * The KEY is the licence id and nothing else. The organisation's NAME is never sent from a customer's
+ * machine, here or anywhere; the name reaches PostHog only if we push it ourselves from the issuance
+ * ledger, which is the one place that mapping lives. So an event still carries no identity, and the
+ * analytics side learns a customer list only when we deliberately upload one.
+ */
+export declare const POSTHOG_GROUP_ORGANIZATION = "organization";
 /**
  * Feedback gets its own, much larger budget — and a retry.
  *
@@ -78,8 +89,6 @@ export interface TelemetryExtra {
     outage?: McpOutage;
     /** `app_instrumented`: an app carrying the SDK reached this daemon for the first time. */
     instrumentation?: AppInstrumentation;
-    /** `instrumentation_stalled`: the daemon waited and no app ever arrived. */
-    stall?: InstrumentationStall;
     /** `reticle_installed` / `init_completed`: which published route brought this install in. */
     installSource?: InstallSource;
 }

package/dist/telemetry/telemetry.js

@@ -42,6 +42,17 @@ const POSTHOG_KEY = 'phc_q4yCxKMXHfWQ43VAz4HxJXZFLqFi4nBbg5v3avemggYo';
  * still key on distinct_id.
  */
 const POSTHOG_PERSONLESS = { $process_person_profile: false };
+/**
+ * PostHog's group type for a licensed customer. Sent as `$groups` so PostHog can aggregate a whole
+ * organisation natively: per-company retention, "which orgs went quiet", one row per customer rather
+ * than one per machine.
+ *
+ * The KEY is the licence id and nothing else. The organisation's NAME is never sent from a customer's
+ * machine, here or anywhere; the name reaches PostHog only if we push it ourselves from the issuance
+ * ledger, which is the one place that mapping lives. So an event still carries no identity, and the
+ * analytics side learns a customer list only when we deliberately upload one.
+ */
+export const POSTHOG_GROUP_ORGANIZATION = 'organization';
 const SEND_TIMEOUT_MS = 2000;
 /**
  * Feedback gets its own, much larger budget — and a retry.
@@ -337,7 +348,6 @@ export const createTelemetry = (opts) => {
             ...(extra?.refusal !== undefined ? { refusal: extra.refusal } : {}),
             ...(extra?.outage !== undefined ? { outage: extra.outage } : {}),
             ...(extra?.instrumentation !== undefined ? { instrumentation: extra.instrumentation } : {}),
-            ...(extra?.stall !== undefined ? { stall: extra.stall } : {}),
             // A SCALAR, so it needs the event build and the wire schema but no entry in `blocks` below —
             // there is nothing to flatten. It still needs both of those, which is the trap `outage` fell
             // into: a field declared on TelemetryExtra and missing from either one is dropped in silence.
@@ -348,14 +358,17 @@ export const createTelemetry = (opts) => {
             // `blocks` entry. Resolved per event off the event's own clock rather than once at startup — an
             // eleven-hour session must not report the status it booted with. All three are absent unless a
             // release has an issuer key baked, so an OSS payload is byte-identical to before.
-            ...licenseFacts(eventTs),
+            // The RESOLVED env, not process.env: createTelemetry takes an env for injection, and reading
+            // the ambient one here would silently ignore it. Identical in production, wrong everywhere the
+            // seam is actually used.
+            ...licenseFacts(eventTs, env),
         };
         // Map the core contract onto PostHog's capture shape: id/name/time move up, the rest are properties.
         // The feedback body is FLATTENED into `feedback_*` properties rather than sent as a nested object:
         // PostHog filters and breakdowns operate on top-level properties, so a nested `feedback.stack`
         // would be invisible to the exact "which stacks report the most bugs" question this exists to
         // answer. One prefix keeps them grouped in the UI without a nested path.
-        const { anonymousId: distinctId, event: name, ts, sessionId: eventSessionId, feedback, session, project, verification, versionChange, crash, identity, connection, init, bug, refusal, outage, instrumentation, stall, ...rest } = event;
+        const { anonymousId: distinctId, event: name, ts, sessionId: eventSessionId, feedback, session, project, verification, versionChange, crash, identity, connection, init, bug, refusal, outage, instrumentation, ...rest } = event;
         // `$session_id` is PostHog's OWN session property, so sending ours under that name lights up
         // its built-in session views and funnels for free rather than requiring custom HogQL everywhere.
         // `sessionId` rides only on events that happened inside a daemon run. A one-shot CLI command
@@ -386,7 +399,6 @@ export const createTelemetry = (opts) => {
             refusal,
             outage,
             instrumentation,
-            stall,
         };
         for (const [prefix, block] of Object.entries(blocks)) {
             for (const [key, value] of Object.entries(block ?? {})) {
@@ -397,7 +409,15 @@ export const createTelemetry = (opts) => {
             event: name,
             distinct_id: distinctId,
             timestamp: new Date(ts).toISOString(),
-            properties: { ...properties, ...POSTHOG_PERSONLESS },
+            properties: {
+                ...properties,
+                ...POSTHOG_PERSONLESS,
+                // Only on a licensed build. An unlicensed event has no organisation to belong to, and an
+                // empty group key would mint a phantom "no org" bucket that every OSS install falls into.
+                ...(event.licenseId !== undefined
+                    ? { $groups: { [POSTHOG_GROUP_ORGANIZATION]: event.licenseId } }
+                    : {}),
+            },
         };
         const body = JSON.stringify({ api_key: apiKey, batch: [capture] });
         const filePath = env[Env.FILE];

package/dist/telemetry/verification-of.js

@@ -13,7 +13,7 @@
  * be readable and testable on its own rather than inferred from a ternary inside a dispatcher.
  */
 import { CaptureLoss, VerifiedReason } from '@reticlehq/core';
-import { VERIFICATION_TOOLS } from '../tools/feedback-tools.js';
+import { VERDICT_TOOLS } from '../tools/feedback-tools.js';
 import { getBrowserMode } from './browser-mode.js';
 /**
  * The deciding clause, read off the result `decideVerified` wrote it onto.
@@ -92,7 +92,7 @@ function passedOf(result, status) {
  * it verified. That is the product's thesis reduced to a boolean.
  */
 export function verificationOf(toolName, result, durationMs, brand) {
-    if (!VERIFICATION_TOOLS.has(toolName))
+    if (!VERDICT_TOOLS.has(toolName))
         return undefined;
     // A paused session REFUSES the call — nothing driven, nothing asserted. The refusal carries a
     // verdict field so the agent never reads undefined off it, and that field must not be mistaken