@reticlehq/server 3.1.0 → 3.2.0

package/dist/judgement/domain/domain-tools.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { projectForRoot } from '../../memory/project/project-for-root.js';
 import { sessionRoot } from '../../memory/project/session-root.js';
 import { asNumber, asString } from '@reticlehq/core';
 import { ReticleTool } from '@reticlehq/core';
@@ -75,8 +76,9 @@ export const DOMAIN_TOOLS = [
                 if (loaded.ok)
                     flows.push(loaded.value);
             }
-            const contract = await readContract(deps.fs, sessionRoot(deps, asString(args['sessionId'])));
-            const project = await deps.project.read();
+            const root = sessionRoot(deps, asString(args['sessionId']));
+            const contract = await readContract(deps.fs, root);
+            const project = await projectForRoot(deps, root).read();
             const runs = project.ok ? project.file.runs : [];
             const model = buildDomainModel(flows, contract.ok ? contract.capabilities : null, runs);
             // Self-instrumentation: turn located gaps (unasserted flows with a source stamp) into apply-ready diffs.

package/dist/judgement/runs/verification-sync.d.ts

@@ -1,4 +1,4 @@
-import { type FlowReplayResult } from '@reticlehq/core';
+import { type ProjectId, type FlowReplayResult } from '@reticlehq/core';
 import type { ToolDeps } from '../../surface/tools/tool-kit.js';
 /** A replay plus the wall-clock time it took — the shape the verify handler already collects. */
 export interface TimedReplay {
@@ -10,4 +10,4 @@ export interface TimedReplay {
  * tool — a disk or network failure is logged and swallowed so the verdict the agent asked for is
  * unaffected. Returns the runId (for logging/tests); undefined if nothing was produced (empty suite).
  */
-export declare function persistAndSyncVerificationRun(deps: ToolDeps, timed: TimedReplay[], projectId: string | undefined): Promise<string | undefined>;
+export declare function persistAndSyncVerificationRun(deps: ToolDeps, timed: TimedReplay[], projectId: ProjectId | undefined): Promise<string | undefined>;

package/dist/judgement/runs/verification-sync.js

@@ -18,6 +18,7 @@ import { RunStore } from './artifact/run-store.js';
 import { cloudFetch, syncRunToCloud, SyncOutcome } from '../../memory/cloud/cloud-sync.js';
 import { resolveProjectCloud } from '../../memory/cloud/cloud-config.js';
 import { log } from '../../log.js';
+import { rootForProjectId } from '../../memory/project/session-root.js';
 /** The author of record when no MCP peer introduced itself — a CLI run, or a client that skipped the handshake. */
 const RETICLE_MCP_AGENT_ID = 'reticle-mcp';
 /** Assemble the ReticleVerificationRun artifact for a verify suite (pure — no IO). */
@@ -60,9 +61,15 @@ export async function persistAndSyncVerificationRun(deps, timed, projectId) {
     if (0 === timed.length)
         return undefined;
     let run;
+    // The project the suite ran for, not the directory the daemon was started in. Both halves below
+    // take it: the artifact `reticle_run` reads back through `sessionRoot`, and the cloud link that
+    // decides WHICH DASHBOARD this run is pushed to. The daemon's own directory has no link file, so
+    // a misrouted read silently meant "not attached" — and where it DID have one, the run was pushed
+    // to a dashboard belonging to whoever that checkout was linked to.
+    const root = rootForProjectId(deps, projectId);
     try {
         run = assembleRun(deps, timed, projectId);
-        await new RunStore(deps.fs, deps.reticleRoot).write(run);
+        await new RunStore(deps.fs, root).write(run);
     }
     catch (error) {
         log('verification-run-persist-failed', {
@@ -71,7 +78,7 @@ export async function persistAndSyncVerificationRun(deps, timed, projectId) {
         return undefined;
     }
     // Per-project cloud: only push when THIS project has cloud attached AND its policy allows runs.
-    const cloud = await resolveProjectCloud(deps.fs, deps.reticleRoot, homedir(), process.env);
+    const cloud = await resolveProjectCloud(deps.fs, root, homedir(), process.env);
     if (null === cloud.config || !cloud.policy.runs)
         return run.runId; // not attached / runs disabled → local only
     const result = await syncRunToCloud(run, cloud.config, cloudFetch);

package/dist/language/flows/affected-tools.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { ReticleTool } from '@reticlehq/core';
 import { loadNamedFlows, resolveChangedFiles } from '../../command/cli/cli-flow-commands.js';
+import { projectDirFor } from '../../memory/project/session-root.js';
 import { sessionRoot, sessionProjectId } from '../../memory/project/session-root.js';
 import { affectedSavedFlows } from './change/flow-sources.js';
 /**
@@ -44,9 +45,11 @@ export const AFFECTED_TOOLS = [
                 ? args['files'].filter((f) => 'string' === typeof f)
                 : [];
             const since = 'string' === typeof args['since'] ? args['since'] : undefined;
-            // Same address as verify_change, resolved the same way: `deps.reticleRoot` is the configured
-            // project directory (the daemon's cwd is not), and the session names which project's flows.
-            const changed = await resolveChangedFiles(files, since, deps.reticleRoot);
+            // Same address as verify_change, resolved the same way. `deps.reticleRoot` is NOT the project
+            // directory this line used to claim it was — it is the daemon's `.reticle` subdirectory, in
+            // whichever tree the MCP host was started in. `undefined` here resolves the single connected
+            // session, which is the same rule the flow lookup below already follows.
+            const changed = await resolveChangedFiles(files, since, projectDirFor(deps, undefined));
             const changedFiles = changed.files;
             // No `sessionId` on this tool's surface, and it does not need one: passing `undefined`
             // resolves the single connected session, and falls back exactly as before when it cannot.

package/dist/language/flows/flow-replay-run.d.ts

@@ -2,6 +2,7 @@ import { FlowErrorCode, type CommandResult, type FlowFile, type FlowReplayResult
 import type { ArrivalClock } from '../../surface/tools/act/navigation/navigate-arrival.js';
 import type { SessionManager } from '../../portal/session/session-manager.js';
 import type { Session } from '../../portal/session/session.js';
+import { DocumentLostDuringReplay } from './flow-replay.js';
 import type { ToolDeps } from '../../surface/tools/tool-kit.js';
 export declare function latestRecordedFlow(events: ReticleEvent[]): {
     name: string;
@@ -57,12 +58,34 @@ export declare function navigateAndAwait(sessions: SessionManager, session: {
     url?: string;
     command(name: string, args?: Record<string, unknown>): Promise<CommandResult>;
 }, destination: string, expectedPath: string, timeoutMs?: number, clock?: ArrivalClock): Promise<Session | undefined>;
+/**
+ * The honest answer when the document replay was driving went away mid-run.
+ *
+ * Not a pass: nothing graded the journey, and the steps in hand are only the ones the departed
+ * document answered. Not a failure either — the app was never observed doing anything wrong, and
+ * reporting one would be the false red that sends a reader into product code that is fine. So it
+ * lands in the bucket this engine already has for "nothing was proved", the same one an unmet
+ * precondition uses, with the steps that DID answer attached and no row invented for the one that
+ * did not.
+ *
+ * Why replay reports rather than follows: the successor cannot be identified at the moment the
+ * socket closes. `SessionManager.remove` runs from the close handler, writes the tombstone a
+ * successor is later matched against, and has nothing to match yet — so the rejection is a plain
+ * transport failure by design, and a step in the middle of a journey has no budget to sit and poll
+ * with. `navigateAndAwait` CAN wait, because it knows it asked for the navigation, and it does.
+ */
+export declare function lostDocumentResult(name: string, lost: DocumentLostDuringReplay): FlowReplayResult;
 export declare function replayNamedFlow(deps: ToolDeps, args: Record<string, unknown>): Promise<FlowReplayResult>;
 export declare function crossStepOnly(whole: readonly Contradiction[], steps: readonly FlowStepResult[]): Contradiction[];
 /**
  * The connecting session's project, or undefined when no browser is attached. Flow tools use it to
  * scope storage to the current app on a shared daemon; resolving must NOT throw here (list/load are
  * documented to work headless), so a missing/unknown session degrades to the global/legacy store.
+ *
+ * Re-exported, not re-implemented. This file carried a BYTE-IDENTICAL second copy, and the two
+ * drifted the moment `ProjectId` was threaded: `session-root`'s copy returned the brand while this
+ * one returned `string`, so every flow tool importing from here was handed a widened value and lost
+ * the brand one line after it was minted. Exactly the weak-annotation failure the brand's own doc
+ * records against `RunStore.list()`.
  */
-export declare function sessionProjectId(deps: ToolDeps, sessionId: string | undefined): string | undefined;
-export {};
+export { sessionProjectId } from '../../memory/project/session-root.js';

package/dist/language/flows/flow-replay-run.js

@@ -11,7 +11,8 @@ import { queryRefs } from './replay.js';
 import { assertSuccess, dynamicTestids, successLabel, SUCCESS_STEP_TOOL } from './flow-success.js';
 import { buildDecision, unverifiableReason } from './decision.js';
 import { unsuppliedSecrets } from './fields/flow-secret-field.js';
-import { assertStepExpect } from './flow-replay.js';
+import { assertStepExpect, DocumentLostDuringReplay, } from './flow-replay.js';
+import { isDocumentGoneError } from '../../portal/session/facts/session-replaced.js';
 import { classifyFlowAssertions, flattenSteps } from './flow-classify.js';
 import { dischargeFlowIntent, flowIntentStatement, flowReplayVerdictId } from './flow-intent.js';
 import { IntentStore } from '../../memory/intent/intent-store.js';
@@ -29,6 +30,7 @@ import { resolveProjectCloud } from '../../memory/cloud/cloud-config.js';
 import { consultSubjectFor, selectConsulted } from './flow-memory-consult.js';
 import { log } from '../../log.js';
 import { flowsForSession } from './flow-store-for-session.js';
+import { projectForRoot } from '../../memory/project/project-for-root.js';
 import { FlowParseNote } from './flow-expect-grammar.js';
 export function latestRecordedFlow(events) {
     for (let i = events.length - 1; i >= 0; i--) {
@@ -76,7 +78,7 @@ async function recordReplayRun(deps, name, status, driftSteps, durationMs, proje
 /** The APP's `.reticle`, resolved from the session — never the daemon's own. */
 recordRoot) {
     const runStatus = replayToRunStatus(status);
-    await deps.project.recordRun({
+    await projectForRoot(deps, recordRoot).recordRun({
         kind: RunKind.FLOW_REPLAY,
         name,
         status: runStatus,
@@ -291,8 +293,13 @@ export async function navigateAndAwait(sessions, session, destination, expectedP
         if (!outcome.ok || true !== asRecord(outcome.result)['ok'])
             return undefined;
     }
-    catch {
-        return undefined;
+    catch (error) {
+        // A navigation that unloads the page rejects the very command that asked for it — the transport
+        // dies with the document. Reading that as "the navigate failed" skipped the arrival poll below
+        // and left replay driving a handle that could never answer again, which is how a flow with a
+        // startPath died at step 1 on an app that had loaded perfectly. Anything else is a real refusal.
+        if (!isDocumentGoneError(error))
+            return undefined;
     }
     const deadline = clock.now() + timeoutMs;
     for (;;) {
@@ -361,6 +368,36 @@ async function firstUnmetPrecondition(session, flow, since) {
     }
     return undefined;
 }
+/**
+ * The honest answer when the document replay was driving went away mid-run.
+ *
+ * Not a pass: nothing graded the journey, and the steps in hand are only the ones the departed
+ * document answered. Not a failure either — the app was never observed doing anything wrong, and
+ * reporting one would be the false red that sends a reader into product code that is fine. So it
+ * lands in the bucket this engine already has for "nothing was proved", the same one an unmet
+ * precondition uses, with the steps that DID answer attached and no row invented for the one that
+ * did not.
+ *
+ * Why replay reports rather than follows: the successor cannot be identified at the moment the
+ * socket closes. `SessionManager.remove` runs from the close handler, writes the tombstone a
+ * successor is later matched against, and has nothing to match yet — so the rejection is a plain
+ * transport failure by design, and a step in the middle of a journey has no budget to sit and poll
+ * with. `navigateAndAwait` CAN wait, because it knows it asked for the navigation, and it does.
+ */
+export function lostDocumentResult(name, lost) {
+    return {
+        name,
+        status: ReplayStatus.OK,
+        steps: lost.steps,
+        unverifiable: {
+            reason: `the page loaded a new document while step ${String(lost.atStep)} was running, so the run ` +
+                `could not be graded — the steps before it are reported and nothing after it was observed. ` +
+                `Nothing here says the app failed. If that navigation is part of the journey, record the ` +
+                `step's consequence with \`expect\` and replay again; if it was not, the flow started ` +
+                `somewhere it no longer belongs.`,
+        },
+    };
+}
 export async function replayNamedFlow(deps, args) {
     const startedAt = deps.now();
     const name = asString(args['flowName']) ?? '';
@@ -467,17 +504,25 @@ export async function replayNamedFlow(deps, args) {
             unverifiable: { reason: unmet },
         };
     }
-    const steps = await replayFlow(session, replayable, waitForPredicate, FLOW_SIGNAL_TIMEOUT_MS, true === args['confirmDangerous'], undefined, {
-        // How an `invoke` step finds the flow it runs. Scoped to the same project as the flow being
-        // replayed, so a composite cannot reach into another app's store for a same-named sub-journey.
-        resolveFlow: async (invoked) => {
-            const sub = await flowsForSession(deps, projectId).flows.load(invoked, projectId);
-            return sub.ok ? await resolveFlowUploads(deps, sub.value) : undefined;
-        },
-        // Bug-sweep mode: keep going past a step whose action ran and whose consequence merely did
-        // not hold, so one flow reports one verdict per step instead of stopping at the first defect.
-        sweep: true === args['sweep'],
-    });
+    let steps;
+    try {
+        steps = await replayFlow(session, replayable, waitForPredicate, FLOW_SIGNAL_TIMEOUT_MS, true === args['confirmDangerous'], undefined, {
+            // How an `invoke` step finds the flow it runs. Scoped to the same project as the flow being
+            // replayed, so a composite cannot reach into another app's store for a same-named sub-journey.
+            resolveFlow: async (invoked) => {
+                const sub = await flowsForSession(deps, projectId).flows.load(invoked, projectId);
+                return sub.ok ? await resolveFlowUploads(deps, sub.value) : undefined;
+            },
+            // Bug-sweep mode: keep going past a step whose action ran and whose consequence merely did
+            // not hold, so one flow reports one verdict per step instead of stopping at the first defect.
+            sweep: true === args['sweep'],
+        });
+    }
+    catch (error) {
+        if (!(error instanceof DocumentLostDuringReplay))
+            throw error;
+        return lostDocumentResult(name, error);
+    }
     // Computed HERE, before the synthetic success row is appended below: once that row is pushed,
     // `steps.length` no longer counts only the flow's own steps and the arithmetic is wrong.
     const halted = haltedFrom(steps, loaded.value.steps.length);
@@ -522,7 +567,7 @@ export async function replayNamedFlow(deps, args) {
     // Anti-reward-hacking baseline: record what this flow asserted ONLY when it passed clean. A
     // failing run must never become the baseline a later weakening is measured against.
     if (status === ReplayStatus.OK) {
-        await new AssertionTiersStore(deps.fs, deps.reticleRoot).recordPassing(name, loaded.value.steps.map((s, i) => ({
+        await new AssertionTiersStore(deps.fs, replayRoot).recordPassing(name, loaded.value.steps.map((s, i) => ({
             step: i,
             ...(s.expect === undefined ? {} : { expect: s.expect }),
         })), 
@@ -542,7 +587,7 @@ export async function replayNamedFlow(deps, args) {
         }
     }
     // Push-default: the deviation report over this drive's segments, learned across runs. Best-effort.
-    const deviation = await computeReplayDeviation(deps, session, replayFloor);
+    const deviation = await computeReplayDeviation(deps, session, replayFloor, replayRoot);
     /*
      * What the team already knows about this flow, fetched on the agent's behalf.
      *
@@ -669,12 +714,14 @@ export function crossStepOnly(whole, steps) {
  * The deviation report over a replay's route segments — compared against the learned envelope, which is
  * then updated. Best-effort: any failure (disk, empty window) yields undefined, never breaking the replay.
  */
-async function computeReplayDeviation(deps, session, floor) {
+async function computeReplayDeviation(deps, session, floor, 
+/** The APP's root — the same one the replay resolved eleven lines above the old call. */
+root) {
     try {
         const segments = computeSegments(session.eventsSince(floor));
         if (0 === segments.length)
             return undefined;
-        return await reportAndAccumulate(new EnvelopeStore(deps.fs, deps.reticleRoot), segments);
+        return await reportAndAccumulate(new EnvelopeStore(deps.fs, root), segments);
     }
     catch {
         return undefined;
@@ -691,12 +738,11 @@ function applyStartPathHint(result, hint) {
  * The connecting session's project, or undefined when no browser is attached. Flow tools use it to
  * scope storage to the current app on a shared daemon; resolving must NOT throw here (list/load are
  * documented to work headless), so a missing/unknown session degrades to the global/legacy store.
+ *
+ * Re-exported, not re-implemented. This file carried a BYTE-IDENTICAL second copy, and the two
+ * drifted the moment `ProjectId` was threaded: `session-root`'s copy returned the brand while this
+ * one returned `string`, so every flow tool importing from here was handed a widened value and lost
+ * the brand one line after it was minted. Exactly the weak-annotation failure the brand's own doc
+ * records against `RunStore.list()`.
  */
-export function sessionProjectId(deps, sessionId) {
-    try {
-        return deps.sessions.resolve(sessionId).projectId;
-    }
-    catch {
-        return undefined;
-    }
-}
+export { sessionProjectId } from '../../memory/project/session-root.js';

package/dist/language/flows/flow-replay.d.ts

@@ -3,6 +3,23 @@ export { anchorLabel, componentLabel, componentQueryArgs, editDistance, expectEl
 import type { FlowReplaySession, WaitForSignal, Sleep } from './flow-replay-types.js';
 export type { FlowReplaySession, WaitForSignal, Sleep } from './flow-replay-types.js';
 import { type Drift, type FlowFile, type FlowStep, type FlowStepResult } from '@reticlehq/core';
+/**
+ * The document this replay was driving went away mid-run.
+ *
+ * Almost always because the replay itself navigated it — a `startPath` goto, or a step that clicks a
+ * link. The steps already in hand are real answers from the document that WAS there, so they travel
+ * with the error; the step that was in flight has no answer at all and is deliberately absent.
+ * Synthesising one would be a verdict about a page nobody observed, which is the one thing worse
+ * than returning no verdict.
+ *
+ * Typed rather than a message, because the caller has to tell it from a step that genuinely failed:
+ * one says the app is wrong, the other says we stopped watching.
+ */
+export declare class DocumentLostDuringReplay extends Error {
+    readonly steps: FlowStepResult[];
+    readonly atStep: number;
+    constructor(steps: FlowStepResult[], atStep: number, lostTo?: unknown);
+}
 /**
  * After a step's anchor resolves and its action runs, its `expect` is EVALUATED — every kind of it.
  *

package/dist/language/flows/flow-replay.js

@@ -11,7 +11,36 @@ import { replayActionArgs, ambiguousTestidNote } from './replay.js';
 import { anchorFieldName } from './fields/flow-secret-field.js';
 import { degradedStepResult, isDegradedAnchor, runComponentStep, runRoleStep, runSequenceStep, } from './flow-step-runners.js';
 import { successToPredicate } from './flow-success.js';
+import { inFlightRequestLabels } from '../../surface/tools/act/settle-in-flight.js';
+import { namedNetIsInFlight } from '@reticlehq/engine/evidence/unsettled.js';
+/** What a still-open named request means, in the drift's own words. */
+const IN_FLIGHT_AT_BUDGET_END = 'the request this step declared had not come back when the budget ended — it is still in flight, ' +
+    'so nothing here says the app failed. Raise the step timeout, or look at the endpoint';
 import { ReticleTool } from '@reticlehq/core';
+import { isDocumentGoneError } from '../../portal/session/facts/session-replaced.js';
+/**
+ * The document this replay was driving went away mid-run.
+ *
+ * Almost always because the replay itself navigated it — a `startPath` goto, or a step that clicks a
+ * link. The steps already in hand are real answers from the document that WAS there, so they travel
+ * with the error; the step that was in flight has no answer at all and is deliberately absent.
+ * Synthesising one would be a verdict about a page nobody observed, which is the one thing worse
+ * than returning no verdict.
+ *
+ * Typed rather than a message, because the caller has to tell it from a step that genuinely failed:
+ * one says the app is wrong, the other says we stopped watching.
+ */
+export class DocumentLostDuringReplay extends Error {
+    steps;
+    atStep;
+    constructor(steps, atStep, lostTo) {
+        super(`the document was replaced while step ${String(atStep)} was running`, {
+            cause: lostTo,
+        });
+        this.steps = steps;
+        this.atStep = atStep;
+    }
+}
 const realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
  * The route (pathname) currently in effect — the page a step runs on. Reads the latest ROUTE_CHANGE
@@ -170,11 +199,23 @@ export async function assertStepExpect(session, expect, dynamic, waitForSignal,
     const verdict = await waitForSignal(session, predicate, timeoutMs, since);
     if (verdict.pass)
         return undefined;
+    // A request the step NAMED that had not come back yet is a blind spot, not an assertion the app
+    // failed. The live verdict path already draws this line (namedNetIsInFlight); replay read the
+    // same window and never asked, so a slow endpoint was reported as a consequence that never fired.
+    // An unrelated open request does not pardon a named URL that never started — matching decides it.
+    const openRequests = expect.state === undefined ? inFlightRequestLabels(session.eventsSince(since)) : [];
+    const namedInFlight = namedNetIsInFlight(predicate, openRequests);
     return {
         // The store case keeps its own kind because heal and the run report branch on it; everything
         // else is a consequence that did not hold, and the reason carries observed-vs-expected.
-        reasonKind: expect.state !== undefined ? DriftReason.STATE_MISMATCH : DriftReason.SIGNAL_NOT_OBSERVED,
-        reason: verdict.failureReason ?? "the step's declared consequence did not hold",
+        reasonKind: expect.state !== undefined
+            ? DriftReason.STATE_MISMATCH
+            : namedInFlight
+                ? DriftReason.NET_STILL_IN_FLIGHT
+                : DriftReason.SIGNAL_NOT_OBSERVED,
+        reason: namedInFlight
+            ? `${IN_FLIGHT_AT_BUDGET_END} (${openRequests.join(', ')})`
+            : (verdict.failureReason ?? "the step's declared consequence did not hold"),
         anchor: expectLabel(expect),
         nearest: null,
     };
@@ -332,108 +373,115 @@ export async function replayFlow(session, flow, waitForSignal, signalTimeoutMs,
     // wait for the slowest step would trade a false red for a slow suite. See FlowStep.timeoutMs.
     const waitFor = (step) => step.timeoutMs ?? flow.signalTimeoutMs ?? signalTimeoutMs;
     let index = 0;
-    for (const step of flow.steps) {
-        if (step.invoke !== undefined) {
-            results.push(await runInvokeStep(session, flow, step, index, waitForSignal, signalTimeoutMs, confirmDangerous, sleep, options));
-            const last = results[results.length - 1];
-            if (last !== undefined && false === last.ok)
-                break;
-            index += 1;
-            continue;
-        }
-        const label = anchorLabel(step.anchor);
-        // The page this step runs on (the journey's "which page") — captured before the action.
-        const page = currentRoute(session);
-        // Event-time floor so the consequence reflects only THIS step's aftermath, not prior steps'.
-        const cursorBefore = session.elapsed();
-        const subSteps = step.steps;
-        // Traced per step, so a slow replay says WHICH step and which anchor kind spent the time. The
-        // per-step `durationMs` below is what the agent gets back; this is what a developer profiling
-        // the replay engine gets, nested under the tool call with the browser round-trips beneath it.
-        const result = await span('flow.step', { index, anchor: step.anchor.kind, label }, async () => {
-            if (isDegradedAnchor(step.anchor)) {
-                // Never QUERY the sentinel — it marks "no anchor was determined", not an element to find.
-                return degradedStepResult(step, index, label);
-            }
-            if (subSteps !== undefined && subSteps.length > 0) {
-                return runSequenceStep(session, step, index, subSteps, confirmDangerous, sleep, dynamic);
-            }
-            if (step.anchor.kind === AnchorKind.SIGNAL) {
-                return runSignalStep(session, step, index, label, waitForSignal, waitFor(step), replayFloor);
-            }
-            if (step.anchor.kind === AnchorKind.COMPONENT) {
-                return runComponentStep(session, step, index, step.anchor, confirmDangerous, sleep);
+    try {
+        for (const step of flow.steps) {
+            if (step.invoke !== undefined) {
+                results.push(await runInvokeStep(session, flow, step, index, waitForSignal, signalTimeoutMs, confirmDangerous, sleep, options));
+                const last = results[results.length - 1];
+                if (last !== undefined && false === last.ok)
+                    break;
+                index += 1;
+                continue;
             }
-            if (step.anchor.kind === AnchorKind.ROLE && step.anchor.name !== undefined) {
-                // A NAMED role anchor addresses one element. The nameless one is the degraded placeholder
-                // and keeps its old path, where it fails legibly rather than querying a role as a testid.
-                return runRoleStep(session, step, index, step.anchor, confirmDangerous, sleep);
+            const label = anchorLabel(step.anchor);
+            // The page this step runs on (the journey's "which page") — captured before the action.
+            const page = currentRoute(session);
+            // Event-time floor so the consequence reflects only THIS step's aftermath, not prior steps'.
+            const cursorBefore = session.elapsed();
+            const subSteps = step.steps;
+            // Traced per step, so a slow replay says WHICH step and which anchor kind spent the time. The
+            // per-step `durationMs` below is what the agent gets back; this is what a developer profiling
+            // the replay engine gets, nested under the tool call with the browser round-trips beneath it.
+            const result = await span('flow.step', { index, anchor: step.anchor.kind, label }, async () => {
+                if (isDegradedAnchor(step.anchor)) {
+                    // Never QUERY the sentinel — it marks "no anchor was determined", not an element to find.
+                    return degradedStepResult(step, index, label);
+                }
+                if (subSteps !== undefined && subSteps.length > 0) {
+                    return runSequenceStep(session, step, index, subSteps, confirmDangerous, sleep, dynamic);
+                }
+                if (step.anchor.kind === AnchorKind.SIGNAL) {
+                    return runSignalStep(session, step, index, label, waitForSignal, waitFor(step), replayFloor);
+                }
+                if (step.anchor.kind === AnchorKind.COMPONENT) {
+                    return runComponentStep(session, step, index, step.anchor, confirmDangerous, sleep);
+                }
+                if (step.anchor.kind === AnchorKind.ROLE && step.anchor.name !== undefined) {
+                    // A NAMED role anchor addresses one element. The nameless one is the degraded placeholder
+                    // and keeps its old path, where it fails legibly rather than querying a role as a testid.
+                    return runRoleStep(session, step, index, step.anchor, confirmDangerous, sleep);
+                }
+                return runTestidStep(session, step, index, label, dynamic, confirmDangerous, sleep);
+            });
+            // Once the anchor resolved and the action ran, the step's own expect is evaluated — signal, net,
+            // console and store truth alike — deterministically, in the same cheap replay loop, with no LLM.
+            /*
+             * The step's own expect, and then every sub-step's.
+             *
+             * `classifyFlowAssertions` already walks act_sequence sub-steps and counts an expect on either
+             * level, and states the invariant plainly: this and what replay enforces must move together, or
+             * "the difference is a false green or a lost verification". Enforcing only the top level was
+             * that difference -- a sequence whose sub-step declared a consequence was GRADED asserted and
+             * checked by nothing, so it could not go red while wearing the grade that says it could.
+             *
+             * WEAKER THAN THE LIVE PATH, and deliberately so rather than silently. A recorded sequence is
+             * dispatched as ONE batched command, so there are no per-sub-step cursors to open a window with
+             * -- every sub-step expect is evaluated against the window the whole sequence opened, which
+             * means sub-step three's claim can be satisfied by sub-step one's consequence. The live
+             * `act_sequence` path takes a cursor before each dispatch and does not have this. Narrowing it
+             * here means dispatching sub-steps individually on replay, which is a behaviour change to the
+             * replay path and belongs in its own commit.
+             */
+            const declared = [step.expect, ...(step.steps ?? []).map((sub) => sub.expect)].filter((expectation) => expectation !== undefined);
+            for (const expectation of declared) {
+                if (!result.ok || result.drift !== undefined)
+                    break;
+                const expectDrift = await assertStepExpect(session, expectation, dynamic, waitForSignal, waitFor(step), cursorBefore);
+                if (expectDrift !== undefined) {
+                    result.ok = false;
+                    result.drift = expectDrift;
+                }
             }
-            return runTestidStep(session, step, index, label, dynamic, confirmDangerous, sleep);
-        });
-        // Once the anchor resolved and the action ran, the step's own expect is evaluated — signal, net,
-        // console and store truth alike — deterministically, in the same cheap replay loop, with no LLM.
-        /*
-         * The step's own expect, and then every sub-step's.
-         *
-         * `classifyFlowAssertions` already walks act_sequence sub-steps and counts an expect on either
-         * level, and states the invariant plainly: this and what replay enforces must move together, or
-         * "the difference is a false green or a lost verification". Enforcing only the top level was
-         * that difference -- a sequence whose sub-step declared a consequence was GRADED asserted and
-         * checked by nothing, so it could not go red while wearing the grade that says it could.
-         *
-         * WEAKER THAN THE LIVE PATH, and deliberately so rather than silently. A recorded sequence is
-         * dispatched as ONE batched command, so there are no per-sub-step cursors to open a window with
-         * -- every sub-step expect is evaluated against the window the whole sequence opened, which
-         * means sub-step three's claim can be satisfied by sub-step one's consequence. The live
-         * `act_sequence` path takes a cursor before each dispatch and does not have this. Narrowing it
-         * here means dispatching sub-steps individually on replay, which is a behaviour change to the
-         * replay path and belongs in its own commit.
-         */
-        const declared = [step.expect, ...(step.steps ?? []).map((sub) => sub.expect)].filter((expectation) => expectation !== undefined);
-        for (const expectation of declared) {
-            if (!result.ok || result.drift !== undefined)
+            if (page !== undefined)
+                result.page = page;
+            const windowEvents = session.eventsSince(cursorBefore).filter((e) => e.t >= cursorBefore);
+            const consequence = summarizeConsequence(windowEvents);
+            if (consequence !== undefined)
+                result.consequence = consequence;
+            // Per-step wall time is NOT shipped: it is `window.until - window.since`, computed from two numbers
+            // the next line already puts in the same object, under the same emission condition. A step used to
+            // carry the subtraction AND both operands, on every step of every replay.
+            const cursorAfter = session.elapsed();
+            // ONE builder, shared with the live act path, so a driven step and a replayed one describe what
+            // happened in identical words rather than in two vocabularies that agree by coincidence.
+            Object.assign(result, stepEffect(windowEvents, { since: cursorBefore, until: cursorAfter }));
+            /*
+             * A prefix step is setup and is not reported -- UNLESS it failed.
+             *
+             * A failure there means the resume never reached the step it was asked to resume from, and the
+             * run did not start where the caller will read it as having started. Swallowing it would turn
+             * "I could not get there" into "I got there and it was fine".
+             */
+            // `tool` is dropped HERE rather than at the ten places that set it, so a new step runner cannot
+            // forget the rule and quietly re-introduce the cost. Spelled out only when it is NOT the default.
+            if (FlowStepTool.ACT === result.tool)
+                delete result.tool;
+            if (index >= from || !result.ok || result.drift !== undefined)
+                results.push(result);
+            // Under `sweep`, a failure whose action still RAN does not stop the run — the page is where the
+            // step left it, so the next step is as meaningful as it was going to be. Anything else halts.
+            const sweepPast = true === options.sweep &&
+                result.drift !== undefined &&
+                isConsequenceDrift(result.drift.reasonKind);
+            if (!sweepPast && (result.drift !== undefined || !result.ok))
                 break;
-            const expectDrift = await assertStepExpect(session, expectation, dynamic, waitForSignal, waitFor(step), cursorBefore);
-            if (expectDrift !== undefined) {
-                result.ok = false;
-                result.drift = expectDrift;
-            }
+            index += 1;
         }
-        if (page !== undefined)
-            result.page = page;
-        const windowEvents = session.eventsSince(cursorBefore).filter((e) => e.t >= cursorBefore);
-        const consequence = summarizeConsequence(windowEvents);
-        if (consequence !== undefined)
-            result.consequence = consequence;
-        // Per-step wall time is NOT shipped: it is `window.until - window.since`, computed from two numbers
-        // the next line already puts in the same object, under the same emission condition. A step used to
-        // carry the subtraction AND both operands, on every step of every replay.
-        const cursorAfter = session.elapsed();
-        // ONE builder, shared with the live act path, so a driven step and a replayed one describe what
-        // happened in identical words rather than in two vocabularies that agree by coincidence.
-        Object.assign(result, stepEffect(windowEvents, { since: cursorBefore, until: cursorAfter }));
-        /*
-         * A prefix step is setup and is not reported -- UNLESS it failed.
-         *
-         * A failure there means the resume never reached the step it was asked to resume from, and the
-         * run did not start where the caller will read it as having started. Swallowing it would turn
-         * "I could not get there" into "I got there and it was fine".
-         */
-        // `tool` is dropped HERE rather than at the ten places that set it, so a new step runner cannot
-        // forget the rule and quietly re-introduce the cost. Spelled out only when it is NOT the default.
-        if (FlowStepTool.ACT === result.tool)
-            delete result.tool;
-        if (index >= from || !result.ok || result.drift !== undefined)
-            results.push(result);
-        // Under `sweep`, a failure whose action still RAN does not stop the run — the page is where the
-        // step left it, so the next step is as meaningful as it was going to be. Anything else halts.
-        const sweepPast = true === options.sweep &&
-            result.drift !== undefined &&
-            isConsequenceDrift(result.drift.reasonKind);
-        if (!sweepPast && (result.drift !== undefined || !result.ok))
-            break;
-        index += 1;
+    }
+    catch (error) {
+        if (!isDocumentGoneError(error))
+            throw error;
+        throw new DocumentLostDuringReplay(results, index, error);
     }
     return results;
 }