@reticlehq/server 2.12.0 → 2.13.1

package/dist/flows/recordings.d.ts

@@ -13,12 +13,15 @@ export interface RecordedStep {
 interface ActiveRecording {
     cursor: number;
     steps: RecordedStep[];
+    /** The route the journey began on. See CompiledProgram.startPath. */
+    startPath?: string;
 }
 /** A finished, replayable program compiled from a recording. */
 export interface CompiledProgram {
     name: string;
     version: number;
     steps: RecordedStep[];
+    startPath?: string;
 }
 /**
  * Tracks in-flight recordings (name -> { buffer cursor at record_start, captured steps })
@@ -26,7 +29,7 @@ export interface CompiledProgram {
  */
 export declare class RecordingStore {
     #private;
-    start(name: string, cursor: number): void;
+    start(name: string, cursor: number, startPath?: string): void;
     isRecording(name: string): boolean;
     /**
      * Number of steps captured so far in the named ACTIVE recording (0 if it
@@ -41,5 +44,14 @@ export declare class RecordingStore {
     saveCompiled(program: CompiledProgram): void;
     getCompiled(name: string): CompiledProgram | undefined;
     active(): string[];
+    /**
+     * Names of recordings that have been STOPPED and compiled.
+     *
+     * The mirror of `active()`, and needed for the same defaulting: after `reticle_record stop` a
+     * recording is no longer active, so resolving "the obvious one" from `active()` finds nothing.
+     * Saving it then demanded the exact name back from the caller, which is a thing to remember for
+     * no reason when exactly one recording exists.
+     */
+    compiled(): string[];
 }
 export {};

package/dist/flows/recordings.js

@@ -5,8 +5,12 @@
 export class RecordingStore {
     #active = new Map();
     #compiled = new Map();
-    start(name, cursor) {
-        this.#active.set(name, { cursor, steps: [] });
+    start(name, cursor, startPath) {
+        this.#active.set(name, {
+            cursor,
+            steps: [],
+            ...(startPath === undefined ? {} : { startPath }),
+        });
     }
     isRecording(name) {
         return this.#active.has(name);
@@ -39,4 +43,15 @@ export class RecordingStore {
     active() {
         return [...this.#active.keys()];
     }
+    /**
+     * Names of recordings that have been STOPPED and compiled.
+     *
+     * The mirror of `active()`, and needed for the same defaulting: after `reticle_record stop` a
+     * recording is no longer active, so resolving "the obvious one" from `active()` finds nothing.
+     * Saving it then demanded the exact name back from the caller, which is a thing to remember for
+     * no reason when exactly one recording exists.
+     */
+    compiled() {
+        return [...this.#compiled.keys()];
+    }
 }

package/dist/flows/replay.d.ts

@@ -13,8 +13,28 @@ export declare function ambiguousTestidNote(value: string): string;
  * resolution — can't drift between them.
  */
 export declare function queryRefs(result: CommandResult): string[];
-/** A destructive-action confirmation is one-shot and must never persist into a recording. */
-export declare function replayActionArgs(value: unknown, confirmDangerous?: boolean): Record<string, unknown>;
+/**
+ * The environment variable that supplies one redacted field.
+ *
+ * Named after the field so it is guessable from the flow alone: `auth-password` is read from
+ * `RETICLE_SECRET_AUTH_PASSWORD`. A scheme requiring a lookup table would mean the flow says a
+ * value is missing and cannot say what to set.
+ */
+export declare const secretEnvKey: (field: string) => string;
+/**
+ * A destructive-action confirmation is one-shot and must never persist into a recording.
+ *
+ * This is also where a REDACTED fill is supplied back. Stripping credentials out of a git-checked
+ * flow is only half a fix: sign-in still has to replay, and a flow that drifts at step two forever
+ * because its own password was removed is a flow nobody keeps — along with everything behind the
+ * login it guards. The value comes from the environment, the one place a secret can live that is
+ * neither the customer's repository nor our database.
+ *
+ * Left as the PLACEHOLDER when nothing supplies it, rather than blanked. The replay then fails at
+ * the login form with `<redacted: supply at replay>` visible in the field, which names its own fix;
+ * an empty box fails identically and tells the reader nothing.
+ */
+export declare function replayActionArgs(value: unknown, confirmDangerous?: boolean, field?: string): Record<string, unknown>;
 /**
  * Capture an act into every in-flight recording, or do nothing when none is running.
  *

package/dist/flows/replay.js

@@ -1,3 +1,4 @@
+import { REDACTED_FILL } from './flows.js';
 import { DANGEROUS_ACTION_CONFIRM_ARG, ReticleCommand, QueryBy, } from '@reticlehq/core';
 import { ReticleTool } from '../tools/tool-names.js';
 import { predicateToExpect, enforcedOnReplay } from './predicate-to-expect.js';
@@ -23,12 +24,37 @@ export function queryRefs(result) {
     const elements = Array.isArray(payload['elements']) ? payload['elements'] : [];
     return elements.map((e) => asString(asRecord(e)['ref']) ?? '').filter((r) => r.length > 0);
 }
-/** A destructive-action confirmation is one-shot and must never persist into a recording. */
-export function replayActionArgs(value, confirmDangerous = false) {
+/**
+ * The environment variable that supplies one redacted field.
+ *
+ * Named after the field so it is guessable from the flow alone: `auth-password` is read from
+ * `RETICLE_SECRET_AUTH_PASSWORD`. A scheme requiring a lookup table would mean the flow says a
+ * value is missing and cannot say what to set.
+ */
+export const secretEnvKey = (field) => `RETICLE_SECRET_${field.replace(/[^a-zA-Z0-9]+/g, '_').toUpperCase()}`;
+/**
+ * A destructive-action confirmation is one-shot and must never persist into a recording.
+ *
+ * This is also where a REDACTED fill is supplied back. Stripping credentials out of a git-checked
+ * flow is only half a fix: sign-in still has to replay, and a flow that drifts at step two forever
+ * because its own password was removed is a flow nobody keeps — along with everything behind the
+ * login it guards. The value comes from the environment, the one place a secret can live that is
+ * neither the customer's repository nor our database.
+ *
+ * Left as the PLACEHOLDER when nothing supplies it, rather than blanked. The replay then fails at
+ * the login form with `<redacted: supply at replay>` visible in the field, which names its own fix;
+ * an empty box fails identically and tells the reader nothing.
+ */
+export function replayActionArgs(value, confirmDangerous = false, field) {
     const args = { ...asRecord(value) };
     delete args[DANGEROUS_ACTION_CONFIRM_ARG];
     if (confirmDangerous)
         args[DANGEROUS_ACTION_CONFIRM_ARG] = true;
+    if (REDACTED_FILL === args['value'] && field !== undefined) {
+        const supplied = process.env[secretEnvKey(field)];
+        if (supplied !== undefined && supplied.length > 0)
+            args['value'] = supplied;
+    }
     return args;
 }
 /** The element's source location from an action result, when the framework stamped one. */

package/dist/flows/verify-change-tools.js

@@ -5,6 +5,7 @@ import { attributedFailures } from './attributed-failure.js';
 import { Verified } from '@reticlehq/core';
 import { ReticleTool } from '../tools/tool-names.js';
 import { asNumber, asRecord, asString } from '../tools/tools-helpers.js';
+import { workerCountSchema } from '../tools/numeric-bounds.js';
 import { loadNamedFlows, resolveChangedFiles } from '../cli/cli-flow-commands.js';
 import { affectedSavedFlows } from './flow-sources.js';
 import { FLOW_TOOLS } from './flow-tools.js';
@@ -25,8 +26,7 @@ export const VERIFY_CHANGE_TOOLS = [
                 .string()
                 .optional()
                 .describe('Git ref to diff against (e.g. "HEAD~1", "main"). Unioned with `files`.'),
-            parallel: z
-                .number()
+            parallel: workerCountSchema
                 .optional()
                 .describe('Replay this many affected flows at once (needs the browser pool).'),
             sessionId: z
@@ -200,6 +200,9 @@ async function inspectAfterReplay(deps, args, cursor) {
         const contradictions = findContradictions(session.eventsSince(cursor), {
             currentDocumentId: session.currentDocumentId,
             currentEditEpoch: session.currentEditEpoch,
+            appOrigin: session.url,
+            // The replay is the action, and the cursor is where it started.
+            actionSince: cursor,
         });
         const snapshot = await session.command(ReticleCommand.SNAPSHOT, {
             mode: SnapshotMode.INTERACTIVE,

package/dist/honesty/blind-spots.d.ts

@@ -6,7 +6,7 @@
  */
 export { BlindSpotKind } from '@reticlehq/core';
 import { BlindSpotKind, type ReticleEvent } from '@reticlehq/core';
-interface BlindSpot {
+export interface BlindSpot {
     kind: BlindSpotKind;
     count: number;
 }
@@ -55,6 +55,15 @@ export declare function buildCoverageStatement(spots: readonly BlindSpot[]): Cov
  * from what the SDK observed during the action, with no extra round-trip.
  */
 export declare function blindSpotsFromEvents(events: readonly ReticleEvent[]): BlindSpot[];
+/**
+ * Drop Electron-only coverage rows unless this session is actually an Electron renderer.
+ *
+ * The kinds live in the same vocabulary as "no store registered", so listing whatever is present
+ * reported a Vite + React tab as an un-instrumented Electron renderer. The session already knows
+ * the runtime (PAGE_HEALTH). Unknown runtime (older SDK) keeps the rows — dropping them would hide
+ * a real missing-preload warning.
+ */
+export declare function spotsForRuntime(spots: readonly BlindSpot[], runtime: string | undefined): BlindSpot[];
 /**
  * Blind spots from the session's remembered LEVEL state rather than from a window of events.
  *
@@ -63,8 +72,35 @@ export declare function blindSpotsFromEvents(events: readonly ReticleEvent[]): B
  * reports "full" for a page a third of which is unobservable — and the act tool's own description
  * tells harnesses to gate on that block. Ask the session what is true now instead of inferring it
  * from what happened to be said recently.
+ *
+ * `runtime` gates Electron-only kinds (see `spotsForRuntime`) so a web session cannot inherit them
+ * from the coverage vocabulary.
  */
-export declare function blindSpotsFromState(state: Readonly<Record<string, number>>): BlindSpot[];
+export declare function blindSpotsFromState(state: Readonly<Record<string, number>>, runtime?: string): BlindSpot[];
+/**
+ * The narrow slice of a predicate the absence-blind-spot check needs.
+ *
+ * Kept minimal to avoid pulling the full Predicate type (and its transitive deps) into the
+ * honesty module. Anything that quacks like this works.
+ */
+interface AbsencePredicate {
+    kind: string;
+    absent?: boolean;
+    query?: {
+        scope?: unknown;
+    };
+}
+/**
+ * When an absence assertion targets a page with regions Reticle cannot observe, "the element is
+ * absent" means only "it is absent in what I CAN see". Returns a note when that distinction
+ * matters, undefined otherwise.
+ *
+ * Fires on three blind-spot kinds:
+ *   - CROSS_ORIGIN_IFRAME (only when the predicate is scoped to a frame region)
+ *   - VIRTUALIZED_UNMOUNTED — a row that was never rendered could hold the element
+ *   - CLOSED_SHADOW_ROOT — a subtree Reticle cannot see into
+ */
+export declare function absenceBlindSpotNote(predicate: AbsencePredicate, spots: readonly BlindSpot[]): string | undefined;
 /** The impeaching note for a transport gap, or undefined when the window was intact. */
 export declare function transportGapNote(events: readonly ReticleEvent[]): string | undefined;
 /**
@@ -76,3 +112,20 @@ export declare function transportGapNote(events: readonly ReticleEvent[]): strin
  * predicate would eventually disagree with the first about what "unwatched" means.
  */
 export declare function isStateUnwatched(spots: readonly BlindSpot[]): boolean;
+/**
+ * Does a passing verdict on this predicate REST on the window being complete?
+ *
+ * Only an absence claim does. A positive assertion that passed found its evidence, and events aged
+ * out elsewhere in the buffer do not unmake it. An absence claim concluded "nothing is there" — and
+ * the thing the buffer dropped is precisely the disproof, so "absent" degrades to "absent in what I
+ * still hold".
+ *
+ * The distinction is not optional. Scarce-loss is recorded for AGE eviction too, so `lostSince(0)`
+ * is true on any session older than the 60s cutoff; impeaching every verdict over a caller-chosen
+ * window would make `unknown` the answer to everything, which this repo has already paid for once.
+ */
+export declare function restsOnCompleteWindow(predicate: {
+    kind: string;
+    absent?: boolean;
+    predicate?: unknown;
+}): boolean;

package/dist/honesty/blind-spots.js

@@ -7,7 +7,7 @@
 // The kind enum lives in core (it crosses the wire in a BLIND_SPOT event); re-exported here so existing
 // honesty-side imports keep working.
 export { BlindSpotKind } from '@reticlehq/core';
-import { BlindSpotKind, EventType, ReticleEnv, TRANSPORT_LIMITS, } from '@reticlehq/core';
+import { AppRuntime, BlindSpotKind, EventType, PredicateKind, ReticleEnv, TRANSPORT_LIMITS, isDesktopBlindSpot, } from '@reticlehq/core';
 /**
  * Whether the observation window saw everything it was asked about.
  *
@@ -107,6 +107,19 @@ export function blindSpotsFromEvents(events) {
     }
     return [...latest].map(([kind, count]) => ({ kind, count }));
 }
+/**
+ * Drop Electron-only coverage rows unless this session is actually an Electron renderer.
+ *
+ * The kinds live in the same vocabulary as "no store registered", so listing whatever is present
+ * reported a Vite + React tab as an un-instrumented Electron renderer. The session already knows
+ * the runtime (PAGE_HEALTH). Unknown runtime (older SDK) keeps the rows — dropping them would hide
+ * a real missing-preload warning.
+ */
+export function spotsForRuntime(spots, runtime) {
+    if (runtime === undefined || AppRuntime.ELECTRON === runtime)
+        return [...spots];
+    return spots.filter((spot) => !isDesktopBlindSpot(spot.kind));
+}
 /**
  * Blind spots from the session's remembered LEVEL state rather than from a window of events.
  *
@@ -115,9 +128,16 @@ export function blindSpotsFromEvents(events) {
  * reports "full" for a page a third of which is unobservable — and the act tool's own description
  * tells harnesses to gate on that block. Ask the session what is true now instead of inferring it
  * from what happened to be said recently.
+ *
+ * `runtime` gates Electron-only kinds (see `spotsForRuntime`) so a web session cannot inherit them
+ * from the coverage vocabulary.
  */
-export function blindSpotsFromState(state) {
-    return Object.entries(state).map(([kind, count]) => ({ kind: kind, count }));
+export function blindSpotsFromState(state, runtime) {
+    const spots = Object.entries(state).map(([kind, count]) => ({
+        kind: kind,
+        count,
+    }));
+    return spotsForRuntime(spots, runtime);
 }
 /**
  * Events the BROWSER's own transport queue threw away inside this window, or 0.
@@ -145,6 +165,29 @@ function droppedByTransport(events) {
     }
     return dropped;
 }
+/**
+ * When an absence assertion targets a page with regions Reticle cannot observe, "the element is
+ * absent" means only "it is absent in what I CAN see". Returns a note when that distinction
+ * matters, undefined otherwise.
+ *
+ * Fires on three blind-spot kinds:
+ *   - CROSS_ORIGIN_IFRAME (only when the predicate is scoped to a frame region)
+ *   - VIRTUALIZED_UNMOUNTED — a row that was never rendered could hold the element
+ *   - CLOSED_SHADOW_ROOT — a subtree Reticle cannot see into
+ */
+export function absenceBlindSpotNote(predicate, spots) {
+    if ('element' !== predicate.kind || true !== predicate.absent)
+        return undefined;
+    const relevant = spots.filter((spot) => spot.count > 0 &&
+        (spot.kind === BlindSpotKind.CROSS_ORIGIN_IFRAME
+            ? undefined !== predicate.query?.scope
+            : spot.kind === BlindSpotKind.VIRTUALIZED_UNMOUNTED ||
+                spot.kind === BlindSpotKind.CLOSED_SHADOW_ROOT));
+    if (0 === relevant.length)
+        return undefined;
+    const statement = buildCoverageStatement(relevant);
+    return `the absence assertion targeted a region Reticle could not observe (${statement.note ?? 'partial coverage'}), so a passing DOM check cannot prove absence`;
+}
 /** The impeaching note for a transport gap, or undefined when the window was intact. */
 export function transportGapNote(events) {
     const dropped = droppedByTransport(events);
@@ -163,3 +206,20 @@ export function transportGapNote(events) {
 export function isStateUnwatched(spots) {
     return spots.some((spot) => spot.kind === BlindSpotKind.UNWATCHED_STATE && spot.count > 0);
 }
+/**
+ * Does a passing verdict on this predicate REST on the window being complete?
+ *
+ * Only an absence claim does. A positive assertion that passed found its evidence, and events aged
+ * out elsewhere in the buffer do not unmake it. An absence claim concluded "nothing is there" — and
+ * the thing the buffer dropped is precisely the disproof, so "absent" degrades to "absent in what I
+ * still hold".
+ *
+ * The distinction is not optional. Scarce-loss is recorded for AGE eviction too, so `lostSince(0)`
+ * is true on any session older than the 60s cutoff; impeaching every verdict over a caller-chosen
+ * window would make `unknown` the answer to everything, which this repo has already paid for once.
+ */
+export function restsOnCompleteWindow(predicate) {
+    if (PredicateKind.NOT === predicate.kind)
+        return true;
+    return true === predicate.absent;
+}

package/dist/honesty/honesty.d.ts

@@ -22,6 +22,15 @@ interface HonestyInputs {
     envelopeSamples?: number;
     coveragePct?: number;
     coveragePartial?: boolean;
+    /**
+     * The sentence naming WHAT went unobserved, from `buildCoverageStatement`.
+     *
+     * Separate from `blindSpots`, which carries only the IMPEACHING notes — the ones that downgrade a
+     * verdict. A bounding spot does not impeach anything, so it never entered that list, and the flag
+     * that survived (`partial: true`) is unanswerable on its own: the verdict prose tells the reader
+     * to see `coverage` for what went unobserved, and there was nothing there to see.
+     */
+    coverageNote?: string;
     truncated?: boolean;
     blindSpots?: readonly string[];
     /**
@@ -55,6 +64,7 @@ export interface HonestyBlock {
     coverage: {
         pct?: number;
         partial: boolean;
+        note?: string;
     };
     integrity: {
         clean: boolean;
@@ -76,4 +86,18 @@ export declare function meetsHonestyBar(block: HonestyBlock, bar?: HonestyBar):
     ok: boolean;
     reasons: string[];
 };
+/**
+ * The coverage sentence, kept only on a verdict that points at it.
+ *
+ * Exactly one branch of `decideVerified` promises it — the YES branch says "coverage was PARTIAL —
+ * see `coverage` for what went unobserved". UNKNOWN keeps it too, because "I could not tell" is a
+ * statement about what went unseen and the note is the answer. A NO has already named a concrete
+ * counter-example, nothing directs the reader to `coverage`, and `partial` plus the spot kinds still
+ * travel — so the prose there is cost with no question behind it.
+ *
+ * Measured: emitting it on every verdict regressed the benchmark's verification efficiency by 4.1%,
+ * one note per observation. Accuracy outranks tokens, but this buys no accuracy — the promise is
+ * kept wherever it is made.
+ */
+export declare function honestyForVerdict(verified: string, honesty: HonestyBlock): HonestyBlock;
 export {};

package/dist/honesty/honesty.js

@@ -5,6 +5,7 @@
  * block. Harnesses gate on it (e.g. "grade ≥ net AND integrity clean"). This is pure composition +
  * assessment — all five components already exist individually; wiring it onto results is a later step.
  */
+import { Verified } from '@reticlehq/core';
 /** Assertion grade, strongest first — the tier the verdict actually proved. */
 export const HonestyGrade = {
     SIGNAL: 'signal',
@@ -45,7 +46,11 @@ export function buildHonestyBlock(inputs) {
         ...(samples === undefined
             ? {}
             : { envelope: { samples, sufficient: samples >= MIN_ENVELOPE_SAMPLES } }),
-        coverage: { ...(pct === undefined ? {} : { pct }), partial },
+        coverage: {
+            ...(pct === undefined ? {} : { pct }),
+            partial,
+            ...(partial && inputs.coverageNote !== undefined ? { note: inputs.coverageNote } : {}),
+        },
         ...(inputs.settled === undefined ? {} : { settled: inputs.settled }),
         integrity: {
             clean: 0 === issues.length,
@@ -69,3 +74,22 @@ export function meetsHonestyBar(block, bar = {}) {
     }
     return { ok: 0 === reasons.length, reasons };
 }
+/**
+ * The coverage sentence, kept only on a verdict that points at it.
+ *
+ * Exactly one branch of `decideVerified` promises it — the YES branch says "coverage was PARTIAL —
+ * see `coverage` for what went unobserved". UNKNOWN keeps it too, because "I could not tell" is a
+ * statement about what went unseen and the note is the answer. A NO has already named a concrete
+ * counter-example, nothing directs the reader to `coverage`, and `partial` plus the spot kinds still
+ * travel — so the prose there is cost with no question behind it.
+ *
+ * Measured: emitting it on every verdict regressed the benchmark's verification efficiency by 4.1%,
+ * one note per observation. Accuracy outranks tokens, but this buys no accuracy — the promise is
+ * kept wherever it is made.
+ */
+export function honestyForVerdict(verified, honesty) {
+    if (Verified.NO !== verified || honesty.coverage.note === undefined)
+        return honesty;
+    const { note: _dropped, ...coverage } = honesty.coverage;
+    return { ...honesty, coverage };
+}

package/dist/honesty/instrumentation-gaps.d.ts

@@ -75,5 +75,14 @@ export interface ActionInstrumentationFacts {
      * finished, and a bare flag makes them read the same.
      */
     openIntentCount?: number;
+    /**
+     * How long the OLDEST open intent has been owed, in ms.
+     *
+     * A count alone cannot tell "you declared this a minute ago and have not proved it yet" from
+     * "this project has owed eighteen things since last week". Only the first is actionable on the
+     * result being read, and a number that is always large is a number people learn to skip — which
+     * is exactly how an honest gap gets filtered out along with the noise.
+     */
+    oldestOpenIntentAgeMs?: number;
 }
 export declare function gapsForAction(facts: ActionInstrumentationFacts): InstrumentationGap[];

package/dist/honesty/instrumentation-gaps.js

@@ -20,7 +20,19 @@ export function gapsForAction(facts) {
     //
     // Reported as the same kind, because it is the same missing thing seen from the other side, and
     // guarded so the two conditions cannot report it twice.
-    if (false === facts.hasCapabilities || (facts.stateAsked && facts.stateUnwatched)) {
+    //
+    // BOTH arms require `stateUnwatched`, which is the store registry. Keying the first on
+    // `hasCapabilities` alone made this fire on apps whose store IS registered and readable: an app
+    // that calls `registerStore()` without `registerCapabilities()` has no declaration and a perfectly
+    // good store, and got a gap saying "no state can be read from it" in the same response that
+    // carried `reticle_state { found: true }`, a populated `stateDiffs`, and `statePathsChanged`
+    // naming the store (#700). A gap contradicted by its own response tells the agent to redo work it
+    // has already done, and teaches it to distrust the whole block.
+    //
+    // The kind is NO_STORE_REGISTERED and every sentence it carries is about stores, so the store
+    // registry is what it must be keyed on. An undeclared-capabilities app with a working store is a
+    // different observation, and if it is worth reporting it needs its own kind and its own words.
+    if (facts.stateUnwatched && (false === facts.hasCapabilities || facts.stateAsked)) {
         // Same missing thing, two ways of meeting it — and the sentence has to say which. Describing an
         // assertion about state to an agent that made no such assertion is a false explanation, and a
         // gap nobody can act on is worse than no gap: it costs the trip and teaches the wrong lesson.
@@ -55,6 +67,21 @@ export function gapsForAction(facts) {
     if (true === facts.changeUndeclared) {
         gaps.push(instrumentationGap(InstrumentationGapKind.UNDECLARED_CHANGE, 'code changed since the last verdict and no intent says what the change was for', 'this verdict can only check the app against itself, so a green here means "nothing visibly broke" rather than "the change did what it was meant to"'));
     }
+    /**
+     * Say how old the debt is, when it is old enough to change what the reader should do.
+     *
+     * The ledger is a PROJECT's, deliberately — "what does this still owe" outlives one session. But an
+     * intent declared minutes ago and one abandoned last week produce the same sentence, and the second
+     * one is not about the work in front of you. Naming the age separates them without weakening the
+     * gap, and without pretending a stale backlog is this verdict's fault.
+     */
+    const DAY_MS = 86_400_000;
+    function describeIntentAge(ageMs) {
+        if (ageMs === undefined || ageMs < DAY_MS)
+            return '';
+        const days = Math.floor(ageMs / DAY_MS);
+        return ` (the oldest for ${String(days)} day${1 === days ? '' : 's'} — a backlog this old is probably not what this run is about; retire them or prove them)`;
+    }
     // A green that does not settle what the run OWES.
     //
     // The mirror of `changeUndeclared` above, and the more expensive half: that fires when nothing was
@@ -71,7 +98,7 @@ export function gapsForAction(facts) {
     // to a result whose own `because` says it is not verification.
     const owed = facts.openIntentCount ?? 0;
     if (facts.pass && true === facts.proved && 0 < owed) {
-        gaps.push(instrumentationGap(InstrumentationGapKind.INTENT_UNDISCHARGED, `this verdict passed, and ${String(owed)} declared intent(s) are still unproved`, 'a green settles what it asserted, not what the run set out to do — reporting done here rests on the change looking right rather than on anything having checked it'));
+        gaps.push(instrumentationGap(InstrumentationGapKind.INTENT_UNDISCHARGED, `this verdict passed, and ${String(owed)} declared intent(s) are still unproved${describeIntentAge(facts.oldestOpenIntentAgeMs)}`, 'a green settles what it asserted, not what the run set out to do — reporting done here rests on the change looking right rather than on anything having checked it'));
     }
     return dedupeGaps(gaps);
 }

package/dist/honesty/verified.d.ts

@@ -78,7 +78,8 @@ interface VerifiedInputs {
     outcomeUnread?: readonly string[];
     /**
      * The declared consequence that held does not depend on the response body — an exact string
-     * rendered, a store path, a signal. See `declaresBodyIndependentChannel`.
+     * rendered, a store path, a signal, a route, or an element located by role / name / testid. See
+     * `declaresBodyIndependentChannel`.
      *
      * The unread-body clause exists for the case where the body is the ONLY channel that could have
      * contradicted the screen (a 200 with batch/GraphQL errors inside). When a body-independent

package/dist/honesty/verified.js

@@ -152,9 +152,24 @@ export function decideVerified(inputs) {
     // with routeChanges 0, because the text was the nav link already on screen — the real navigation
     // landed 1.8s later. UNKNOWN rather than NO on purpose: the app may well be fine, and reporting a
     // failure we did not observe would be its own false claim.
+    //
+    // `no-fault` rather than `unknown`, once the window settled — the same distinction
+    // `nothing_declared` already draws, gated the same way.
+    //
+    // The two words ask for opposite things. `unknown` means LOOK AGAIN WITH BETTER COVERAGE, so an
+    // agent reading it reasonably concludes the engine could not see, and spends its remaining turns
+    // enabling capture, widening timeouts and re-driving — none of which can help, because the engine
+    // saw the whole window and there was nothing wrong with the evidence. The fault is in the
+    // ASSERTION: it named something that was true before the action, so it cannot tell success from a
+    // no-op. `no-fault` says exactly that, and `because` already carried the remedy that `unknown`
+    // was burying.
+    //
+    // Gated on `true === settled` for the same reason `nothing_declared` is: no-fault claims the whole
+    // window was seen, and a call that returned before the app stopped moving has not earned that.
+    // Unsettled stays `unknown`, which is then the honest word for it.
     if (true === inputs.alreadyTrue) {
         return {
-            verified: Verified.UNKNOWN,
+            verified: true === settled ? Verified.NO_FAULT : Verified.UNKNOWN,
             verifiedReason: VerifiedReason.ALREADY_TRUE,
             because: 'the declared consequence was already true before this action, so it proves nothing about it — assert something the action CHANGES (a signal, a request, a route, or store state)',
         };

package/dist/http-server.js

@@ -6,6 +6,7 @@ import { noteAgentPeer, PEER_VERSION_PARAM, PEER_CONTRACT_PARAM } from './versio
 import { log } from './log.js';
 import { reportMcpConnected } from './telemetry/mcp-connection.js';
 import { isLoopbackHost, isLocalWebOrigin, isLoopbackPeer, requestToken, tokensMatch, } from './bridge/token-auth.js';
+import { LOOPBACK_IDLE_MS } from './loopback-agent.js';
 /**
  * Creates a shared HTTP server that handles both the WebSocket bridge (browser SDK) and the
  * SSE MCP transport (Claude/agent). Does NOT call listen — caller controls that.
@@ -258,6 +259,17 @@ export function createSharedServer(options = {}) {
             });
         });
     }
+    /**
+     * The daemon's half of the keep-alive pact with `loopbackAgent`.
+     *
+     * Node's default is 5 seconds, and the proxy's POST leg is one request per JSON-RPC message. An
+     * agent thinks for longer than 5s between tool calls essentially always, so with the default every
+     * tool call had to open a fresh socket however the client was configured — which on Windows ends
+     * in `ENOBUFS`. This has to stay ABOVE `LOOPBACK_IDLE_MS` so the CLIENT is always the side that
+     * retires an idle socket: if the server closed first, the proxy would keep picking up sockets that
+     * were already gone. It also has to stay below Node's 60s default `headersTimeout`.
+     */
+    httpServer.keepAliveTimeout = LOOPBACK_IDLE_MS + 10_000;
     return {
         httpServer,
         attachMcp,

package/dist/impact/impact-recorder.d.ts

@@ -1,18 +1,30 @@
-import { type ImpactCounts, type ImpactSnapshot } from '@reticlehq/core';
+import { type ImpactCounts, type ImpactDefect, type ImpactSnapshot } from '@reticlehq/core';
 import { ImpactStore, type ImpactFoldMeta } from './impact-store.js';
-/** Wire the recorder to a project. Idempotent; the first root wins for the daemon's lifetime. */
+/**
+ * Wire the DEFAULT root — the daemon's own. Idempotent; the first one wins.
+ *
+ * Still idempotent, and still first-wins, because the daemon's own root genuinely does not change
+ * while it runs. What changed is that this is no longer the ONLY root: a call that knows its
+ * project passes one, and this is the fallback for calls that do not.
+ */
 export declare function initImpact(opts: {
     reticleRoot: string | undefined;
     projectName?: string;
     now?: () => number;
 }): ImpactStore | undefined;
-/** The live store, if one has been initialised. */
-export declare function impactStore(): ImpactStore | undefined;
-/** Test seam: drop the singleton so a suite can start from a clean record. */
+/** The live store for a root (default when omitted), if one has been initialised. */
+export declare function impactStore(root?: string): ImpactStore | undefined;
+/** Test seam: drop the stores so a suite can start from a clean record. */
 export declare function resetImpactForTest(): void;
-/** Record one delta, if the recorder is live. Never throws: stats must not break a tool call. */
-export declare function recordImpact(delta: Partial<ImpactCounts>, meta?: ImpactFoldMeta): void;
-export declare function impactSnapshot(): ImpactSnapshot | undefined;
+/**
+ * Record one delta against a project's ledger. Never throws: stats must not break a tool call.
+ *
+ * `root` is the `.reticle` directory this call's evidence belongs to. Omitted means "could not tell
+ * which project", which falls back to the daemon's own root — the old behaviour, kept for the paths
+ * that genuinely have no session to ask.
+ */
+export declare function recordImpact(delta: Partial<ImpactCounts>, meta?: ImpactFoldMeta, root?: string): void;
+export declare function impactSnapshot(root?: string): ImpactSnapshot | undefined;
 /**
  * What one tool call did, as counters.
  *
@@ -21,3 +33,14 @@ export declare function impactSnapshot(): ImpactSnapshot | undefined;
  * the same rule the product states to agents - everything else moves or reads the app.
  */
 export declare function deltaForToolResult(raw: unknown, durationMs: number, refused: boolean): Partial<ImpactCounts>;
+/**
+ * What one FAILED verdict was, in a line.
+ *
+ * Only a verified:"no" produces one. That is the same rule the counters follow and the same rule
+ * the product states to agents: an "unknown" is not a defect, it is Reticle admitting it could not
+ * tell — recording those here would fill the user's short list with the tool's own blind spots.
+ *
+ * Everything is read from the result the tool already returned, so this costs nothing extra and
+ * cannot disagree with the verdict it describes.
+ */
+export declare function defectForToolResult(raw: unknown, at: number): ImpactDefect | undefined;