@reticlehq/server 2.8.0 → 2.9.0

package/dist/events/predicate.js

@@ -5,7 +5,8 @@ import { selectPath, capDepth } from '../session/state-select.js';
 import { describeTestidMiss } from './testid-near-miss.js';
 import { predicateToExpectedLinks } from '../capsule/predicate-to-links.js';
 import { isAmbient, ambientKeyOf } from '../journal/ambient.js';
-import { PredicateSchema, matchValue, evalNet, evalRoute, evalConsole, evalAnimation, evalSignal, evalSettled, residualQueryChecks, satisfiesResiduals, describeResidual, } from './predicate-eval.js';
+import { evalRoute } from './predicate-route.js';
+import { PredicateSchema, matchValue, evalNet, evalConsole, evalAnimation, evalSignal, evalSettled, residualQueryChecks, satisfiesResiduals, describeResidual, } from './predicate-eval.js';
 export { PredicateSchema, PredicateKind };
 /**
  * A composite result that carries a child's "nobody could evaluate this" up to the verdict rule.
@@ -189,8 +190,107 @@ function asSelection(result) {
         ? { found: record.found, value: record.value }
         : undefined;
 }
+/**
+ * A NAMED store needs no whole-store read. `reticle_state`'s scoped mode selects the path out of the
+ * RAW store IN-PAGE and returns only it, so the assertion resolves in one round trip against a payload
+ * the size of the value — not the store. The unnamed case below still needs the wide read, because
+ * that is how it discovers WHICH store carries the path; only the named branch changes.
+ *
+ * A scoped read answers `found: false` for both "no such store" and "no such path", so the two are
+ * kept distinct here using the `storeNames` list the reply always carries — otherwise the payload gets
+ * cheaper while the message gets worse.
+ */
+async function evalStateNamed(session, p, storeName) {
+    const scoped = await session.command(ReticleCommand.STATE_READ, {
+        store: storeName,
+        path: p.path,
+    });
+    if (!scoped.ok) {
+        return {
+            pass: false,
+            failureReason: 'state read failed',
+            observed: 'the store could not be read',
+            expected: 'a readable registered store',
+            assertion: 'state.unreadable',
+        };
+    }
+    const reply = (scoped.result ?? {});
+    const names = Array.isArray(reply.storeNames) ? reply.storeNames : [];
+    // Resolve the value. A CURRENT SDK honours the scoped read and answers `{ found, value }` selected
+    // in-page — the whole point of this path. An OLDER SDK (version skew) or any transport that ignores
+    // `path` answers the whole-store shape `{ stores }`; walk the path server-side there so the verdict
+    // stays correct across SDK versions. The scoped win is simply unavailable on the old ones.
+    const scopedSel = asSelection(scoped.result);
+    const wholeStores = reply.stores;
+    const scopedKeys = Array.isArray(reply.availableKeys)
+        ? reply.availableKeys
+        : undefined;
+    let selection;
+    if (scopedSel !== undefined) {
+        selection =
+            scopedKeys === undefined
+                ? { found: scopedSel.found, value: scopedSel.value }
+                : { found: scopedSel.found, value: scopedSel.value, availableKeys: scopedKeys };
+    }
+    else if (wholeStores !== undefined) {
+        selection = selectPath(wholeStores[storeName], p.path);
+    }
+    else {
+        selection = { found: false };
+    }
+    // "no store named X" and "X has no such path" both surface as found:false; keep them distinct using
+    // the store list the reply carries, or the message regresses while the payload improves.
+    const storeAbsent = wholeStores !== undefined
+        ? !(storeName in wholeStores)
+        : names.length > 0 && !names.includes(storeName);
+    if (!selection.found && storeAbsent) {
+        return {
+            pass: false,
+            failureReason: `no store named '${storeName}' is registered (${names.join(', ')})`,
+            observed: `store '${storeName}' is not registered`,
+            expected: `a registered store named '${storeName}'`,
+            assertion: 'state.store-missing',
+            evidence: { searchedStores: names },
+        };
+    }
+    // A scoped sub-tree can itself be too big for the caps; a comparison against a value known to be
+    // incomplete is an unanswered question, not a failure. Same rule the whole-store path applies.
+    if (truncationOf(scoped.result) !== undefined) {
+        const reason = `state '${p.path}' could not be read intact — the transport caps truncated it, so the ` +
+            'value was never compared. Assert a narrower path, or a smaller field inside it';
+        return { pass: false, failureReason: reason, inconclusive: reason };
+    }
+    if (!selection.found) {
+        return {
+            pass: false,
+            failureReason: `state path '${p.path}' not found in store '${storeName}'`,
+            observed: `no path '${p.path}' in store '${storeName}'`,
+            expected: `store '${storeName}' to expose '${p.path}'`,
+            assertion: 'state.path-missing',
+            evidence: { availableKeys: selection.availableKeys },
+        };
+    }
+    const want = p.equals === undefined ? '*' : p.equals;
+    if (matchValue(selection.value, want)) {
+        return {
+            pass: true,
+            evidence: { store: storeName, path: p.path, value: capDepth(selection.value, 1) },
+        };
+    }
+    return {
+        pass: false,
+        failureReason: `state '${p.path}' is ${JSON.stringify(capDepth(selection.value, 0))}, expected ${JSON.stringify(want)}`,
+        observed: `${p.path} = ${JSON.stringify(capDepth(selection.value, 0))}`,
+        expected: `${p.path} = ${JSON.stringify(want)}`,
+        assertion: 'state.equals',
+        evidence: { store: storeName, path: p.path, value: capDepth(selection.value, 1) },
+    };
+}
 async function evalState(session, p) {
-    const res = await session.command(ReticleCommand.STATE_READ, p.store !== undefined ? { store: p.store } : {});
+    // Named store: one scoped read, no whole-store payload (issue #336).
+    if (p.store !== undefined)
+        return await evalStateNamed(session, p, p.store);
+    const res = await session.command(ReticleCommand.STATE_READ, {});
     if (!res.ok) {
         return {
             pass: false,
@@ -316,11 +416,16 @@ diagnose = true) {
         case PredicateKind.ELEMENT:
             return evalElement(session, predicate.query, predicate.state, predicate.absent ?? false, diagnose);
         case PredicateKind.TEXT:
-            return evalElement(session, { text: predicate.contains }, true === predicate.visible ? ElementState.VISIBLE : undefined, predicate.absent ?? false, diagnose);
+            return evalElement(session, 
+            // `scope` passes straight through: the text predicate has always been an element query
+            // with only `text` filled in, so scoping it needs the field, not a second code path.
+            undefined === predicate.scope
+                ? { text: predicate.contains }
+                : { text: predicate.contains, scope: predicate.scope }, true === predicate.visible ? ElementState.VISIBLE : undefined, predicate.absent ?? false, diagnose);
         case PredicateKind.NET:
             return evalNet(events, predicate);
         case PredicateKind.ROUTE:
-            return evalRoute(events, predicate);
+            return evalRoute(events, predicate, session.url);
         case PredicateKind.CONSOLE:
             return evalConsole(events, predicate);
         case PredicateKind.ANIMATION:
@@ -348,6 +453,10 @@ diagnose = true) {
                 return {
                     pass: false,
                     failureReason: failed.failureReason ?? 'a sub-predicate of allOf failed',
+                    // A conjunction is decided as soon as ONE clause is: nothing the others do later can
+                    // rescue it. This is what makes the early exit reach real calls, since an exact count is
+                    // usually asserted alongside the UI change it is meant to accompany.
+                    ...(true === failed.decided ? { decided: true } : {}),
                     evidence: results,
                 };
             }
@@ -376,9 +485,14 @@ diagnose = true) {
             // You cannot negate an answer nobody had.
             if (inner.inconclusive !== undefined)
                 return unreadableComposite(inner, inner);
+            // A green negation used to return a bare `{ pass: true }`, so the payload fell back to
+            // whatever the caller had — every element matching the OUTER locator. Three clauses negating
+            // three different names then produced byte-identical responses, which reads as a checker that
+            // dropped the name rather than one that correctly found all three absent. The evidence is the
+            // whole answer here: what was looked for, and that it was not there.
             return inner.pass
                 ? { pass: false, failureReason: 'negated predicate unexpectedly held', evidence: inner }
-                : { pass: true };
+                : { pass: true, evidence: { negated: predicate.predicate, held: false, saw: inner } };
         }
         default:
             return { pass: false, failureReason: 'unknown predicate' };
@@ -494,6 +608,14 @@ export function waitForPredicate(session, predicate, timeoutMs, since = 0) {
             void evaluatePredicate(session, predicate, since, false)
                 .then((r) => {
                 if (!r.pass) {
+                    // Final already: stop rather than spend a budget that cannot change the answer. Only
+                    // where the evaluator could PROVE it (see EvalResult.decided) — an ordinary miss keeps
+                    // waiting, because "it has not happened yet" and "it will not happen" are the same
+                    // reading until the budget ends.
+                    if (true === r.decided) {
+                        finish(r);
+                        return;
+                    }
                     // A time-based failure knows when it could stop being one — re-check THEN rather than on
                     // the next blind tick. Without this, every `settled` wait paid up to a full poll interval
                     // of dead time after the quiet window had already closed: measured at 566–627ms across

package/dist/flows/annotate-tools.js

@@ -118,6 +118,9 @@ export const ANNOTATE_TOOLS = [
             recovery: z.string().optional(),
             target: z.string().optional(),
             compiled: z.string().optional(),
+            // Set when the compiled annotation would overstate what a replay can check — e.g. a
+            // success-state that flow_save will grade assertion-free (#395).
+            note: z.string().optional(),
             code: z.string().optional(),
         },
         handler: (deps, args) => {

package/dist/flows/annotate.js

@@ -1,4 +1,4 @@
-import { AnnotationErrorCode, AnnotationKind, AnnotationTarget, COMPILED_PREDICATE_PREFIX, } from '@reticlehq/core';
+import { AnnotationErrorCode, AnnotationKind, AnnotationTarget, COMPILED_PREDICATE_PREFIX, flowExpectHasConsequence, flowExpectIsPresenceOnly, } from '@reticlehq/core';
 /**
  * The PURE compiler at the heart of the annotation facet. A structured annotation +
  * the current captured-step count → an AnnotateOutcome (a result envelope + the patch to apply to
@@ -96,11 +96,25 @@ function stepPatch(a, stepCount, stepExpect) {
         patch: { stepIndex: stepCount - 1, stepExpect },
     };
 }
+// A success end-condition that is not an observable CONSEQUENCE (signal / net / state) cannot lift
+// the flow above the grade flow_save will give it. Saying "will succeed when ..." without that
+// caveat is the #395 contradiction: annotate promises a check that flow_save then grades
+// assertion-free, so a flow that only checks the console replays green through any regression. Name
+// the grade here, using the same consequence/presence classification every grader shares.
+const SUCCESS_ASSERTION_FREE_NOTE = 'This success-state is not an observable consequence, so flow_save will grade the flow assertion-free — it passes even when the feature is broken. Use a signal / net / state success-state to give the flow something that can fail.';
+const SUCCESS_PRESENCE_ONLY_NOTE = 'This success-state only checks element presence, so flow_save will grade the flow presence-only — a locator healed to the wrong element still passes it. Use a signal / net / state success-state to assert an observable consequence.';
 function flowSuccess(a, success) {
-    return {
-        result: { ok: true, target: AnnotationTarget.FLOW, compiled: describeCompiled(a) },
-        patch: { success },
+    const result = {
+        ok: true,
+        target: AnnotationTarget.FLOW,
+        compiled: describeCompiled(a),
     };
+    if (!flowExpectHasConsequence(success)) {
+        result.note = flowExpectIsPresenceOnly(success)
+            ? SUCCESS_PRESENCE_ONLY_NOTE
+            : SUCCESS_ASSERTION_FREE_NOTE;
+    }
+    return { result, patch: { success } };
 }
 /**
  * Human-readable confirmation text for the recorder strip / tool result,

package/dist/flows/coverage.d.ts

@@ -9,11 +9,18 @@ interface DeclaredSurface {
     signals: readonly string[];
     flows: readonly string[];
 }
-interface CoverageDimension {
+export interface CoverageDimension {
     total: number;
     covered: number;
-    /** Percent covered, rounded; 100 when nothing is declared (vacuously complete). */
-    pct: number;
+    /**
+     * Percent covered, rounded. PRESENT ONLY WHEN IT WAS MEASURED — absent when nothing is declared,
+     * same rule as the honesty layer's `{ pct?: number; partial: boolean }`.
+     *
+     * This used to report 100 for an empty surface ("vacuously complete"), which made
+     * `covered: 0, total: 0, pct: 100` — a contradiction the caller had to notice unaided, in output an
+     * agent reads to decide whether its change is covered.
+     */
+    pct?: number;
     /** Declared-but-never-exercised members — what "everything" is silently missing. */
     uncovered: string[];
 }
@@ -21,8 +28,34 @@ export interface Coverage {
     testids: CoverageDimension;
     signals: CoverageDimension;
     flows: CoverageDimension;
-    /** Overall percent across all three dimensions combined. */
-    overallPct: number;
+    /** Overall percent across all three dimensions combined; absent when nothing is declared. */
+    overallPct?: number;
 }
+/** The gate's outcome when the project has recorded no flows at all — not a pass, and not a failure. */
+export declare const NO_FLOWS = "no_flows";
+/**
+ * What to do about it, since the empty state is otherwise indistinguishable from success.
+ *
+ * Names the TOOLS, not a `reticle record` CLI verb: this CLI does not dispatch one, and a suggestion
+ * that errors is a second dead end on top of the first (see suggested-commands-exist.test.ts). Same
+ * wording as the empty-suite verdict, which is the same situation reached from `reticle verify`.
+ */
+export declare const NO_FLOWS_NOTE = "no flows recorded \u2014 nothing was checked. Record one with reticle_record { action: \"start\" }, then reticle_flow_save.";
+/** The gate's flow-coverage line. `pct` and `outcome` are mutually exclusive by construction. */
+export interface FlowCoverageReport {
+    covered: number;
+    total: number;
+    pct?: number;
+    outcome?: typeof NO_FLOWS;
+    note?: string;
+}
+/**
+ * Report flow coverage so that an EMPTY suite cannot be read as a passing one.
+ *
+ * Same rule `buildSuiteVerdict` already applies to `reticle verify`, where zero flows reports
+ * `unverifiable` rather than "all 0 flows pass": a green that cannot go red is not a pass. Callers
+ * must treat a present `outcome` as not-passing.
+ */
+export declare function flowCoverageReport(flows: CoverageDimension): FlowCoverageReport;
 export declare function computeCoverage(declared: DeclaredSurface, exercised: DeclaredSurface): Coverage;
 export {};

package/dist/flows/coverage.js

@@ -4,11 +4,36 @@
  * (contract testids/signals/flows) actually touched by passing verification, so "everything" is honest
  * about what everything means. Pure set math; the deviation report + gate carry the number.
  */
+/** The gate's outcome when the project has recorded no flows at all — not a pass, and not a failure. */
+export const NO_FLOWS = 'no_flows';
+/**
+ * What to do about it, since the empty state is otherwise indistinguishable from success.
+ *
+ * Names the TOOLS, not a `reticle record` CLI verb: this CLI does not dispatch one, and a suggestion
+ * that errors is a second dead end on top of the first (see suggested-commands-exist.test.ts). Same
+ * wording as the empty-suite verdict, which is the same situation reached from `reticle verify`.
+ */
+export const NO_FLOWS_NOTE = 'no flows recorded — nothing was checked. Record one with reticle_record { action: "start" }, then reticle_flow_save.';
+/**
+ * Report flow coverage so that an EMPTY suite cannot be read as a passing one.
+ *
+ * Same rule `buildSuiteVerdict` already applies to `reticle verify`, where zero flows reports
+ * `unverifiable` rather than "all 0 flows pass": a green that cannot go red is not a pass. Callers
+ * must treat a present `outcome` as not-passing.
+ */
+export function flowCoverageReport(flows) {
+    const { covered, total } = flows;
+    if (0 === total)
+        return { covered, total, outcome: NO_FLOWS, note: NO_FLOWS_NOTE };
+    return { covered, total, ...(flows.pct === undefined ? {} : { pct: flows.pct }) };
+}
 function dimension(declared, exercised) {
     const uncovered = declared.filter((d) => !exercised.has(d));
     const covered = declared.length - uncovered.length;
-    const pct = 0 === declared.length ? 100 : Math.round((covered / declared.length) * 100);
-    return { total: declared.length, covered, pct, uncovered };
+    const base = { total: declared.length, covered, uncovered };
+    if (0 === declared.length)
+        return base;
+    return { ...base, pct: Math.round((covered / declared.length) * 100) };
 }
 export function computeCoverage(declared, exercised) {
     const testids = dimension(declared.testids, new Set(exercised.testids));
@@ -16,6 +41,7 @@ export function computeCoverage(declared, exercised) {
     const flows = dimension(declared.flows, new Set(exercised.flows));
     const total = testids.total + signals.total + flows.total;
     const covered = testids.covered + signals.covered + flows.covered;
-    const overallPct = 0 === total ? 100 : Math.round((covered / total) * 100);
-    return { testids, signals, flows, overallPct };
+    if (0 === total)
+        return { testids, signals, flows };
+    return { testids, signals, flows, overallPct: Math.round((covered / total) * 100) };
 }

package/dist/flows/decision.d.ts

@@ -1,5 +1,20 @@
 import { type FlowFile, type FlowReplayResult, type ReplayDecision, type SuiteVerdict } from '@reticlehq/core';
 export declare function buildDecision(result: FlowReplayResult, flow?: FlowFile): ReplayDecision;
+/**
+ * Aggregate per-flow replays into one suite verdict — the autonomous loop's consolidated answer
+ * after a build: did anything break, and what's the prioritized fix list. Pure: pass the already
+ * decision-annotated replay results + their flows. Passing flows are counted; only failures carry
+ * detail (token-cheap), each with the actionable decision so the agent fixes without re-querying.
+ */
+/**
+ * Why a green replay still verified nothing, or undefined when it genuinely did.
+ *
+ * A flow with no steps, or one that asserts no observable consequence, replays green no matter what
+ * the app does — the grader already knows this at save time and says so. Counting it as `passed`
+ * turned that warning into "all 1 flow pass", which is a false green in the exact feature sold as
+ * the regression suite. Classified only when the flow file is available; never guessed.
+ */
+export declare function unverifiableReason(flow: FlowFile | undefined): string | undefined;
 export declare function buildSuiteVerdict(runs: ReadonlyArray<{
     replay: FlowReplayResult;
     flow?: FlowFile;

package/dist/flows/decision.js

@@ -100,7 +100,7 @@ function suiteVerdictOf(status) {
  * turned that warning into "all 1 flow pass", which is a false green in the exact feature sold as
  * the regression suite. Classified only when the flow file is available; never guessed.
  */
-function unverifiableReason(flow) {
+export function unverifiableReason(flow) {
     if (flow === undefined)
         return undefined;
     if (0 === flow.steps.length) {

package/dist/flows/flow-replay-run.js

@@ -2,7 +2,7 @@ import { EventType, FLOW_SIGNAL_TIMEOUT_MS, FlowErrorCode, RecordedFlowSchema, R
 import { asString } from '../tools/tools-helpers.js';
 import { replayFlow } from './flow-replay.js';
 import { assertSuccess, dynamicTestids, successLabel, SUCCESS_STEP_TOOL } from './flow-success.js';
-import { buildDecision } from './decision.js';
+import { buildDecision, unverifiableReason } from './decision.js';
 import { waitForPredicate } from '../events/predicate.js';
 import { computeSegments } from '../journal/rollups.js';
 import { AssertionTiersStore } from './assertion-tiers-store.js';
@@ -174,6 +174,13 @@ export async function replayNamedFlow(deps, args) {
         return errored;
     }
     const result = { name, status, steps };
+    // A green that cannot go red is not a pass. `reticle_flow_verify` already refuses to count these,
+    // via this same function -- a single-flow caller saw a bare `ok` and had no way to learn the flow
+    // asserts nothing. Derived from the same helper on purpose: two copies of this judgement would
+    // drift, and the sibling tools would then disagree about the same flow.
+    const cannotFail = status === ReplayStatus.OK ? unverifiableReason(loaded.value) : undefined;
+    if (cannotFail !== undefined)
+        result.unverifiable = { reason: cannotFail };
     if (status !== ReplayStatus.OK)
         result.decision = buildDecision(result, loaded.value);
     applyStartPathHint(result, startPathHint);

package/dist/flows/flow-tools.js

@@ -255,7 +255,9 @@ export const FLOW_TOOLS = [
             'stale ref. On an anchor MISS returns legible DRIFT { step, anchor, drift:{ reasonKind, reason, ' +
             'nearest } } (the closest surviving testid) and stops — the "whose fault is it" contract. ' +
             'Returns { name, status: ok|drift|error, steps:[...] }; missing/malformed files and action ' +
-            'failures are status:error with a structured code (distinct from contract-changed drift).',
+            'failures are status:error with a structured code (distinct from contract-changed drift). ' +
+            'An ok replay of a flow that asserts no consequence also carries unverifiable:{reason} — it ' +
+            'would read ok even if the feature were broken, so do NOT treat that ok as proof.',
         inputSchema: {
             flow: z
                 .string()
@@ -285,6 +287,12 @@ export const FLOW_TOOLS = [
                 .optional()
                 .describe('Push-default deviation report over the replay segments: ranked deviations vs the learned envelope + a nominal count, or a fall-back note below 3 runs.'),
             error: z.object({ code: z.string(), message: z.string() }).optional(),
+            // Declared here or a validating profile strips it -- the same way `name` was stripped once.
+            // A field the handler sets and the schema omits arrives as nothing, silently.
+            unverifiable: z
+                .object({ reason: z.string() })
+                .optional()
+                .describe('Set on an ok replay that cannot fail: the flow asserts no observable consequence, so it passes even when the feature is broken. Same reason reticle_flow_verify reports.'),
             decision: z
                 .object({
                 verdict: z.string(),

package/dist/flows/replay.js

@@ -247,6 +247,9 @@ export async function replayProgram(session, program, confirmDangerous = false)
                 session.beginAction(ReticleTool.REPLAY, { steps: liveSteps.length });
                 let r;
                 try {
+                    // DIVERGENCE: replay sends one batched ACT_SEQUENCE command to the browser;
+                    // live (tools/act-tools.ts) sends N individual ACT commands for per-step timeout +
+                    // progress. A bug in either is invisible from the other.
                     r = await session.command(ReticleCommand.ACT_SEQUENCE, { steps: liveSteps });
                 }
                 finally {

package/dist/honesty/accepted-write.d.ts

@@ -10,5 +10,8 @@ import { type ReticleEvent } from '@reticlehq/core';
  * optimistically rendered "dispatched", the page settled, every channel agreed — and the server
  * REVERTED it to `held` 1.2 s later. The verdict was not wrong about what it observed. It was early,
  * and nothing in the response said so except the status code nobody was reading.
+ *
+ * The DEV TOOLCHAIN's own traffic is excluded, on the same rule every other check applies: a verdict
+ * about the app must not be decided by a request the app did not make.
  */
 export declare function hasAcceptedWrite(events: readonly ReticleEvent[]): boolean;

package/dist/honesty/accepted-write.js

@@ -1,5 +1,5 @@
-import { EventType, HTTP_ACCEPTED } from '@reticlehq/core';
-import { asNumber } from '../tools/tools-helpers.js';
+import { EventType, HTTP_ACCEPTED, isDevToolingUrl } from '@reticlehq/core';
+import { asNumber, asString } from '../tools/tools-helpers.js';
 /**
  * Did a write in this window answer `202 Accepted`?
  *
@@ -11,7 +11,12 @@ import { asNumber } from '../tools/tools-helpers.js';
  * optimistically rendered "dispatched", the page settled, every channel agreed — and the server
  * REVERTED it to `held` 1.2 s later. The verdict was not wrong about what it observed. It was early,
  * and nothing in the response said so except the status code nobody was reading.
+ *
+ * The DEV TOOLCHAIN's own traffic is excluded, on the same rule every other check applies: a verdict
+ * about the app must not be decided by a request the app did not make.
  */
 export function hasAcceptedWrite(events) {
-    return events.some((e) => e.type === EventType.NET_REQUEST && asNumber(e.data['status']) === HTTP_ACCEPTED);
+    return events.some((e) => e.type === EventType.NET_REQUEST &&
+        asNumber(e.data['status']) === HTTP_ACCEPTED &&
+        !isDevToolingUrl(asString(e.data['url'])));
 }

package/dist/honesty/already-true.js

@@ -17,8 +17,23 @@
 import { PredicateKind } from '@reticlehq/core';
 export function readsDomState(predicate) {
     switch (predicate.kind) {
+        // ROUTE is here, and it did not used to be. It was purely event-based — satisfiable only by a
+        // navigation inside the act's window, and therefore unable to be answered by the past — so it
+        // sat with the floored kinds below.
+        //
+        // It gained a fallback to the CURRENT route for the case where the window holds no route change,
+        // which is what makes "did the session survive a reload?" answerable at all. Without a
+        // before-check that fallback is a guaranteed green: the app is already on /login, the click's
+        // handler is broken, nothing navigates, and an assertion that the action reached /login passes
+        // on the strength of it having been there all along. A bare `{ kind: 'route' }` becomes
+        // unconditionally true, because there is always a current route.
+        //
+        // One extra query on the act path buys `already_true`, reported as UNKNOWN with the reason
+        // rather than as a pass. The fallback removed a false red; this is what stops it becoming a
+        // false green, and that is the trade this codebase never makes.
         case PredicateKind.ELEMENT:
         case PredicateKind.TEXT:
+        case PredicateKind.ROUTE:
             return true;
         case PredicateKind.ALL_OF:
         case PredicateKind.ANY_OF:

package/dist/honesty/blind-spots.js

@@ -40,6 +40,10 @@ const LABEL = {
     // nothing here was missed, there was simply never a verdict to observe, and no amount of extra
     // instrumentation would produce one.
     [BlindSpotKind.VERDICTLESS_SEND]: (n) => `${String(n)} one-way IPC send${1 === n ? '' : 's'} dispatched with NO verdict — the renderer never learns whether the main process handled ${1 === n ? 'it' : 'them'}, so this cannot be confirmed from the page`,
+    // Not a tally — a fact about the app's wiring, phrased as what the EMPTY state channel means. An
+    // agent reading `stateDiffs: []` otherwise reads "the app changed no state", which is a claim
+    // nothing here can support. Names the one-line fix, because the reader is the one who can apply it.
+    [BlindSpotKind.UNWATCHED_STATE]: () => 'no subscribable store is registered, so NO state change is observed — an empty stateDiffs here means unwatched, not unchanged (register the store itself in your reticle-dev module: registerStore(name, store), not a getter)',
     [BlindSpotKind.WRAPPED_NETWORK]: () => 'fetch was already wrapped before Reticle, so recorded requests may differ from what was sent',
     // A fact about the app's wiring, not a tally. Says what the empty network view MEANS, because an
     // empty one here is indistinguishable from "this app made no backend calls" — and that reading is

package/dist/honesty/honesty.d.ts

@@ -33,6 +33,15 @@ interface HonestyInputs {
      * knows whether a blind-spot note came from the browser transport or from a boundary in the page.
      */
     losses?: readonly CaptureLoss[];
+    /**
+     * Did the page go quiet inside the action's window? Omitted when nothing measured it.
+     *
+     * Settlement stopped being a veto over a declared consequence that held (see `verified.ts`), and a
+     * fact that no longer decides the verdict must not therefore disappear: a page that never goes
+     * idle is worth knowing about, and a caller who cares can still gate on it. Reported here rather
+     * than beside `verified`, where the answer belongs to the rule and not to its inputs.
+     */
+    settled?: boolean;
 }
 export interface HonestyBlock {
     grade: HonestyGrade;
@@ -52,6 +61,8 @@ export interface HonestyBlock {
         issues: string[];
         losses?: CaptureLoss[];
     };
+    /** Whether the page went quiet in this window — present only when it was measured. */
+    settled?: boolean;
 }
 export declare function buildHonestyBlock(inputs: HonestyInputs): HonestyBlock;
 interface HonestyBar {

package/dist/honesty/honesty.js

@@ -46,6 +46,7 @@ export function buildHonestyBlock(inputs) {
             ? {}
             : { envelope: { samples, sufficient: samples >= MIN_ENVELOPE_SAMPLES } }),
         coverage: { ...(pct === undefined ? {} : { pct }), partial },
+        ...(inputs.settled === undefined ? {} : { settled: inputs.settled }),
         integrity: {
             clean: 0 === issues.length,
             issues,

package/dist/honesty/uncaptured-bodies.d.ts

@@ -8,12 +8,14 @@
  * every other field in the record agrees is a clean 200.
  *
  * So an omission is declared rather than left to inference, with the one line that fixes it. Present
- * only when a body-bearing call was returned AND none of them carried a body, so an app that already
- * captures bodies pays nothing and the field's PRESENCE is the warning.
+ * only when a body-bearing call was returned AND no body — request or response — was recorded
+ * anywhere in the result, so an app that already captures bodies pays nothing and the field's
+ * PRESENCE is the warning.
  */
 export declare function bodiesNotCaptured(calls: {
     method?: string;
     requestBody?: string;
+    responseBody?: string;
 }[]): {
     bodiesNotCaptured?: string;
 };

package/dist/honesty/uncaptured-bodies.js

@@ -10,13 +10,20 @@ const BODY_BEARING_METHODS = new Set(['POST', 'PUT', 'PATCH']);
  * every other field in the record agrees is a clean 200.
  *
  * So an omission is declared rather than left to inference, with the one line that fixes it. Present
- * only when a body-bearing call was returned AND none of them carried a body, so an app that already
- * captures bodies pays nothing and the field's PRESENCE is the warning.
+ * only when a body-bearing call was returned AND no body — request or response — was recorded
+ * anywhere in the result, so an app that already captures bodies pays nothing and the field's
+ * PRESENCE is the warning.
  */
 export function bodiesNotCaptured(calls) {
     const bodyBearing = calls.filter((c) => BODY_BEARING_METHODS.has((c.method ?? '').toUpperCase()));
     if (0 === bodyBearing.length)
         return {};
+    // A recorded response body anywhere in the result proves capture is ON. An absent request body
+    // then means this payload was not stringified (a multipart upload, a body the SDK skipped), not
+    // that recording is off — and firing the note would contradict the body sitting in the same
+    // result, exactly on the question the note exists to answer. (#394)
+    if (calls.some((c) => c.responseBody !== undefined))
+        return {};
     if (bodyBearing.some((c) => c.requestBody !== undefined))
         return {};
     return {

package/dist/honesty/unread-outcome.d.ts

@@ -1,2 +1,10 @@
 import { type ReticleEvent } from '@reticlehq/core';
+/**
+ * The writes whose outcome went unread, as "METHOD url".
+ *
+ * Named rather than counted, because a caveat an agent cannot locate is a caveat it learns to skip.
+ * The sentence used to say "a write returned 2xx with a response body that was never recorded" and
+ * name no write, which is unactionable on any page that makes more than one call.
+ */
+export declare function unreadWriteLabels(events: readonly ReticleEvent[]): string[];
 export declare function hasUnreadWriteOutcome(events: readonly ReticleEvent[]): boolean;