@reticlehq/server 3.1.0 → 3.3.0

package/dist/surface/mcp/proxy/proxy-log.d.ts

@@ -27,18 +27,12 @@ export declare function accountProxyLogWrite(bytesSinceCheck: number, written: n
 /**
  * Reclaim a proxy log that a previous process already let run away. Returns the bytes reclaimed.
  *
- * An uncapped proxy log has filled a disk and broken unrelated builds, Docker and ordinary shell
- * commands with ENOSPC. Nothing in Reticle degrades first, so the failure surfaces as the operating
- * system refusing to write files. Such files already exist on machines that ran an older build, and
- * the cap alone does not help them: nobody should have to find one with `du`.
+ * Path-shaped wrapper over `recoverOversizedLog`, which is where the rule, the in-place truncation
+ * and the ENOSPC incident behind them are written down. Both of Reticle's logs are capped by that
+ * one function; this keeps the name and the `fileSize`/`truncateFile` deps its callers already pass.
  *
- * TRUNCATED IN PLACE, never renamed or unlinked. A rename moves the bytes without reclaiming a byte,
- * and a file that a running process still holds open keeps its blocks allocated after an unlink
- * until that handle closes — which is why `: > ~/.reticle/proxy-4400.log` is the operation to copy
- * here.
- *
- * Best-effort, in the same spirit as `rotateDaemonLog`: refusing to start the MCP server over
- * housekeeping is strictly worse than a large file.
+ * Such files already exist on machines that ran an older build, and the cap alone does not help
+ * them: nobody should have to find one with `du`.
  */
 export declare function recoverOversizedProxyLog(path: string, deps: {
     fileSize(p: string): number;

package/dist/surface/mcp/proxy/proxy-log.js

@@ -10,7 +10,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { ReticleDir } from '@reticlehq/core';
 import { log } from '../../../log.js';
-import { MAX_DAEMON_LOG_BYTES, rotateDaemonLog } from '../../../command/daemon/daemon.js';
+import { MAX_DAEMON_LOG_BYTES, recoverOversizedLog, rotateDaemonLog, } from '../../../command/daemon/daemon.js';
 /**
  * Which port this proxy serves, for the log file name. Set once at startup.
  *
@@ -46,30 +46,15 @@ export function accountProxyLogWrite(bytesSinceCheck, written, path, deps) {
 /**
  * Reclaim a proxy log that a previous process already let run away. Returns the bytes reclaimed.
  *
- * An uncapped proxy log has filled a disk and broken unrelated builds, Docker and ordinary shell
- * commands with ENOSPC. Nothing in Reticle degrades first, so the failure surfaces as the operating
- * system refusing to write files. Such files already exist on machines that ran an older build, and
- * the cap alone does not help them: nobody should have to find one with `du`.
+ * Path-shaped wrapper over `recoverOversizedLog`, which is where the rule, the in-place truncation
+ * and the ENOSPC incident behind them are written down. Both of Reticle's logs are capped by that
+ * one function; this keeps the name and the `fileSize`/`truncateFile` deps its callers already pass.
  *
- * TRUNCATED IN PLACE, never renamed or unlinked. A rename moves the bytes without reclaiming a byte,
- * and a file that a running process still holds open keeps its blocks allocated after an unlink
- * until that handle closes — which is why `: > ~/.reticle/proxy-4400.log` is the operation to copy
- * here.
- *
- * Best-effort, in the same spirit as `rotateDaemonLog`: refusing to start the MCP server over
- * housekeeping is strictly worse than a large file.
+ * Such files already exist on machines that ran an older build, and the cap alone does not help
+ * them: nobody should have to find one with `du`.
  */
 export function recoverOversizedProxyLog(path, deps, max = MAX_DAEMON_LOG_BYTES) {
-    try {
-        const size = deps.fileSize(path);
-        if (max >= size)
-            return 0;
-        deps.truncateFile(path);
-        return size;
-    }
-    catch {
-        return 0;
-    }
+    return recoverOversizedLog({ size: () => deps.fileSize(path), truncate: () => deps.truncateFile(path) }, max);
 }
 /** The real filesystem behind the two rotation helpers. */
 const proxyLogFileOps = {

package/dist/surface/mcp/proxy-idle-exit.d.ts

@@ -10,7 +10,7 @@
 export declare const PROXY_IDLE_EXIT_MS: number;
 /** The local diagnostic emitted before an abandoned proxy exits. */
 export declare const PROXY_IDLE_EXIT_EVENT = "reticle_mcp_proxy_idle_exit";
-export interface ProxyIdleExitOptions {
+interface ProxyIdleExitOptions {
     /** Called once after the client link has stayed quiet for the whole grace. */
     onExit: (idleMs: number) => void;
     /** True while a request or queued message still needs an answer. */
@@ -43,3 +43,4 @@ export declare class ProxyIdleExit {
  * zero as the explicit opt-out. Invalid values retain the conservative one-day default.
  */
 export declare function resolveProxyIdleExitMs(raw: string | undefined): number;
+export {};

package/dist/surface/mcp/server-instructions.js

@@ -31,7 +31,18 @@ import { surfaceVocabulary, listOf } from './surface-vocabulary.js';
  * measured reason. A briefing that names a tool the agent was not given does not merely confuse it;
  * it makes the agent stop using the product altogether.
  */
-const verdictDiscipline = (v) => `Reticle verifies a running web app from the inside: go (${v.navigate}), look (${listOf(v.look, v.find)}), act and prove in one hop (${v.actAndWait}), observe (${listOf(v.observe, v.state, v.network, v.console)}), assert (${v.assert}). Verify a user-facing change against the real app before you call it done, and never weaken a check to make it pass.
+/*
+ * `reticle gate` is FOLDED INTO the done sentence rather than given a paragraph, and that is the
+ * budget rule working rather than a stylistic choice.
+ *
+ * The instruction block has a hard byte cap whose own note says a raise must be paid for with a
+ * measurement, and that if one cannot be shown the right answer is to cut an older sentence. There
+ * is no measurement for `gate`: it is built, it has anti-reward-hacking, and it appeared in no
+ * surface an agent reads, which is an argument and not a number. Cutting a measured sentence to
+ * make room for an unmeasured one would be strictly worse. So it costs about a hundred characters
+ * inside the sentence that already names the exact moment it applies to, and the cap did not move.
+ */
+const verdictDiscipline = (v) => `Reticle verifies a running web app from the inside: go (${v.navigate}), look (${listOf(v.look, v.find)}), act and prove in one hop (${v.actAndWait}), observe (${listOf(v.observe, v.state, v.network, v.console)}), assert (${v.assert}). Verify a user-facing change against the real app before you call it done — \`npx @reticlehq/server gate --since <ref>\` fails unless a passing artifact covers every flow your edits affect — and never weaken a check to make it pass.
 
 Only ${v.actAndWait} and ${v.assert} produce a verdict. ${v.act.length > 0 ? `${v.act} and e` : 'E'}verything else moves or reads the app and proves nothing, so a drive that ends without one of those two has no result however many tools it used. Prefer ${v.actAndWait}({ ref, action, until }) — it names the expected consequence BEFORE the action, which is the difference between a check and a rationalisation. Only verified:"yes" is a pass — "unknown" means Reticle could not tell what happened, "no-fault" means nothing was declared to prove. Report either as not proved.
 

package/dist/surface/tools/act/act-preflight.js

@@ -14,7 +14,7 @@ import { PredicateSchema } from '@reticlehq/engine/question/predicate/predicate-
 import { isGlobalPressCall } from '@reticlehq/core';
 import { SessionReplacedError } from '../../../portal/session/page-commands/pending-commands.js';
 import { assertNativeInputSupported } from './act-danger.js';
-import { unevaluablePredicateReason } from '@reticlehq/engine/question/predicate/predicate-precheck.js';
+import { unevaluablePredicateReason, vacuousPredicateReason, } from '@reticlehq/engine/question/predicate/predicate-precheck.js';
 /**
  * Refuse a sequence whose steps cannot be addressed.
  *
@@ -137,6 +137,11 @@ export function preflightAct(actArgs, until) {
     const unevaluable = unevaluablePredicateReason(until);
     if (unevaluable !== undefined)
         throw new Error(unevaluable);
+    // A predicate that was already true when it was written answered `no-fault` / `already_true` —
+    // verdict-shaped, and carrying no proof of anything the action did. See vacuousPredicateReason.
+    const vacuous = vacuousPredicateReason(until);
+    if (vacuous !== undefined)
+        throw new Error(vacuous);
 }
 /**
  * Dispatch a write, or report that its outcome went unobserved.

package/dist/surface/tools/act/already-true.d.ts

@@ -0,0 +1,40 @@
+import type { Predicate } from '@reticlehq/engine/question/predicate/predicate-schema.js';
+import type { PredicateSession } from '@reticlehq/engine/question/predicate/predicate-session.js';
+import type { Baselines } from '@reticlehq/engine/question/predicate/predicate.js';
+/** Everything the pre-action check learned, which is three facts about one reading. */
+export interface AlreadyTrueReading {
+    /** The consequence held BEFORE the action, so the action proved nothing about it. */
+    alreadyTrue: boolean;
+    /** That pre-existing match was against something hidden — a stronger reason to doubt the claim. */
+    alreadyTrueHiddenMatch: boolean;
+    /**
+     * WHAT was already true, kept rather than discarded.
+     *
+     * `already_true` tells an agent its assertion held before it acted; the next question is always
+     * "true how?" and it was unanswerable, because the reading decided the bit and was then thrown
+     * away. Afterwards the action has run and the state may have moved, so the one moment that
+     * mattered is gone. Present only when the answer is yes: a verdict that was genuinely caused
+     * carries its own evidence and needs no baseline beside it.
+     */
+    alreadyTrueEvidence?: unknown;
+    /**
+     * What each comparing leaf was reading BEFORE the action — the predicate language's past tense.
+     *
+     * Taken here because this is already the one place that looks at the app before it is touched,
+     * and a second pre-action pass would be a second round trip for a reading we are standing next
+     * to. Empty unless the caller actually asked for a comparison, so nothing pays for it.
+     */
+    baselines: Baselines;
+}
+/**
+ * Ask whether the declared consequence was already true, once, before the action.
+ *
+ * Only for predicates that read live DOM state. Event-based ones are floored at this act's cursor
+ * and cannot be satisfied by the past, so they need no pre-check and pay nothing. One extra query,
+ * on the path where a green is otherwise unfalsifiable.
+ *
+ * Gathered here rather than as three locals at the call site because they are three readings OF ONE
+ * THING, and `act-tools.ts` sits on the 1000-line cohesion cap: the rule says split before adding,
+ * and this is the unit that wanted splitting.
+ */
+export declare function readAlreadyTrue(session: PredicateSession, until: Predicate | undefined, since: number): Promise<AlreadyTrueReading>;

package/dist/surface/tools/act/already-true.js

@@ -0,0 +1,36 @@
+import { evaluatePredicate } from '@reticlehq/engine/question/predicate/predicate.js';
+import { readsDomState } from '@reticlehq/engine/evidence/already-true.js';
+import { alreadyTrueHiddenMatch as alreadyTrueHiddenMatchOf } from '@reticlehq/engine/evidence/already-true.js';
+import { captureBaselines } from '@reticlehq/engine/evidence/baseline.js';
+/**
+ * Ask whether the declared consequence was already true, once, before the action.
+ *
+ * Only for predicates that read live DOM state. Event-based ones are floored at this act's cursor
+ * and cannot be satisfied by the past, so they need no pre-check and pay nothing. One extra query,
+ * on the path where a green is otherwise unfalsifiable.
+ *
+ * Gathered here rather than as three locals at the call site because they are three readings OF ONE
+ * THING, and `act-tools.ts` sits on the 1000-line cohesion cap: the rule says split before adding,
+ * and this is the unit that wanted splitting.
+ */
+export async function readAlreadyTrue(session, until, since) {
+    // Before the pre-check, because the pre-check EVALUATES the predicate and a relative leaf with no
+    // baseline yet would report `inconclusive` — reading the app twice to answer a question we had
+    // not taken the reading for.
+    const baselines = await captureBaselines(session, until);
+    const precheck = until !== undefined && readsDomState(until)
+        ? await evaluatePredicate(session, until, since, false, baselines)
+        : undefined;
+    const alreadyTrue = precheck?.pass ?? false;
+    if (!alreadyTrue || until === undefined) {
+        return { alreadyTrue: false, alreadyTrueHiddenMatch: false, baselines };
+    }
+    return {
+        alreadyTrue: true,
+        baselines,
+        // The pre-check evidence is already in hand, so asking whether the match was against something
+        // hidden costs nothing and lets the message name it (#889).
+        alreadyTrueHiddenMatch: alreadyTrueHiddenMatchOf(until, precheck?.evidence),
+        ...(precheck?.evidence === undefined ? {} : { alreadyTrueEvidence: precheck.evidence }),
+    };
+}

package/dist/surface/tools/act/navigation/navigate-arrival.d.ts

@@ -24,6 +24,12 @@ import type { NavigateArrival } from './navigate-result.js';
  * and the SDK to dial back; short enough to not hang. A caller who knows the app is slower says so.
  */
 export declare const ARRIVAL_TIMEOUT_MS = 5000;
+/**
+ * The navigation target as an absolute URL, resolved against the tab being navigated — the same
+ * resolution the browser applies. An agent passes a path (`/orders?id=4`) as often as a full URL,
+ * and `samePage` cannot parse a path, so without this a relative navigation could never confirm.
+ */
+export declare function absoluteTarget(target: string, base: string): string;
 /**
  * Which session an arrival may be attributed to.
  *

package/dist/surface/tools/act/navigation/navigate-arrival.js

@@ -41,6 +41,19 @@ function samePage(a, b) {
         return false;
     }
 }
+/**
+ * The navigation target as an absolute URL, resolved against the tab being navigated — the same
+ * resolution the browser applies. An agent passes a path (`/orders?id=4`) as often as a full URL,
+ * and `samePage` cannot parse a path, so without this a relative navigation could never confirm.
+ */
+export function absoluteTarget(target, base) {
+    try {
+        return new URL(target, base).href;
+    }
+    catch {
+        return target;
+    }
+}
 /**
  * The sessions already on `target` — the set `ArrivalScope.priorIds` is built from, sampled before
  * the navigation is dispatched.

package/dist/surface/tools/act/sequence-grade.js

@@ -39,6 +39,19 @@ export function gradeSequence(steps, plan = { planned: steps.length, dispatched:
             because: `a declared consequence did not hold — observed ${observed}`,
         };
     }
+    /*
+     * `unknown` rather than `no-fault`, and the distinction is load-bearing.
+     *
+     * "Nothing was declared" is what `no-fault` means for a single action -- but the engine only says
+     * it over a SETTLED window, because no-fault claims the whole window was observed. Nothing on
+     * this path observes settledness: the caller tracks dispatch and stalls, never settle. Saying
+     * `no-fault` here would claim evidence nobody collected, in the one place this product cannot
+     * afford to overclaim.
+     *
+     * So the enum stays conservative and the SENTENCE carries the whole answer: it names declaring a
+     * consequence as the next move, which is what an agent reading `no-fault` would have done.
+     * Upgrading means plumbing `settled` from the act results through `SequencePlan`.
+     */
     if (0 === declared) {
         return {
             verified: Verified.UNKNOWN,

package/dist/surface/tools/act/settle-in-flight.d.ts

@@ -34,6 +34,10 @@ export interface SettleSource {
         data: Record<string, unknown>;
     }[];
     elapsed(): number;
+    /** The page under test — what makes a request third-party. Absent: nothing is foreign. */
+    url?: string;
+    /** Same-origin endpoints the project declared as background. Absent: nothing is excluded. */
+    background?: readonly string[];
 }
 interface WaitOpts {
     /** Injected so the wait is testable without real time passing (rule: never call the clock inline). */
@@ -49,7 +53,7 @@ interface WaitOpts {
 export declare function inFlightRequestIds(events: readonly {
     type: string;
     data: Record<string, unknown>;
-}[]): string[];
+}[], appOrigin?: string, background?: readonly string[]): string[];
 /**
  * The same outstanding requests, as "METHOD url" — what an unsettled verdict has to be able to name.
  *
@@ -61,7 +65,7 @@ export declare function inFlightRequestIds(events: readonly {
 export declare function inFlightRequestLabels(events: readonly {
     type: string;
     data: Record<string, unknown>;
-}[]): string[];
+}[], appOrigin?: string, background?: readonly string[]): string[];
 /**
  * Endpoints called MORE THAN ONCE in this window, busiest first, as "METHOD url ×N".
  *

package/dist/surface/tools/act/settle-in-flight.js

@@ -27,7 +27,7 @@
  *   - still in flight when the budget genuinely runs out → `unsettled`, as before, but now an honest
  *     limit instead of an early exit.
  */
-import { EventType, NetInitiator, isDevToolingUrl } from '@reticlehq/core';
+import { EventType, NetInitiator, isDevToolingUrl, isForeignTraffic } from '@reticlehq/core';
 /**
  * The dev toolchain talking about ITSELF is not the app finishing its work.
  *
@@ -37,6 +37,25 @@ import { EventType, NetInitiator, isDevToolingUrl } from '@reticlehq/core';
  * was graded on the strength of a Next webpack hot-update the same payload printed as ignored.
  */
 const isDevTooling = (data) => isDevToolingUrl('string' === typeof data['url'] ? data['url'] : undefined);
+/**
+ * Somebody else's host is not the app finishing its work.
+ *
+ * The comment above makes this argument for dev tooling and it holds identically here:
+ * `splitForeignTraffic` drops dev tooling AND third-party traffic, and this file dropped only the
+ * first — so the exclusion stayed cosmetic exactly where it decides a verdict, for the other half.
+ *
+ * Reported from the field repeatedly: an app embedding a wallet SDK that continuously POSTs
+ * telemetry to its vendor host never settles, so EVERY assertion on that app returns
+ * `unknown / outcome_pending` whatever the feature under test was. A third-party beacon cannot
+ * answer "has the app finished?", and nothing makes it stop, so waiting for it is waiting forever.
+ *
+ * Fails OPEN: with no known app origin nothing is foreign, because suppressing a request we cannot
+ * classify is how a verdict starts resting on evidence it discarded.
+ *
+ * SAME-ORIGIN background traffic is never guessed: nothing in a URL separates the app's telemetry
+ * from the app's work. It is excluded only when the project DECLARED it (`background`).
+ */
+const isForeign = (data, appOrigin, background) => isForeignTraffic('string' === typeof data['url'] ? data['url'] : undefined, appOrigin, background);
 /**
  * A departure records where the browser was SENT, not a request whose result we will see — the
  * response is delivered to a document this session does not live into. It can never be matched by a
@@ -54,7 +73,7 @@ const idOf = (data) => 'string' === typeof data['id'] ? data['id'] : undefined;
  * the act cursor, so a response belonging to an earlier action can land inside it, and counting that
  * as progress would let unrelated traffic close the window early.
  */
-export function inFlightRequestIds(events) {
+export function inFlightRequestIds(events, appOrigin, background = []) {
     const settled = new Set();
     for (const e of events) {
         if (e.type !== EventType.NET_REQUEST)
@@ -67,6 +86,8 @@ export function inFlightRequestIds(events) {
     for (const e of events) {
         if (e.type !== EventType.NET_PENDING || isDevTooling(e.data) || isDeparture(e.data))
             continue;
+        if (isForeign(e.data, appOrigin, background))
+            continue;
         const id = idOf(e.data);
         if (id !== undefined && !settled.has(id) && !open.includes(id))
             open.push(id);
@@ -81,8 +102,8 @@ export function inFlightRequestIds(events) {
  * directly. Read off the NET_PENDING the window already holds, so this costs one pass over events
  * that are in hand.
  */
-export function inFlightRequestLabels(events) {
-    const open = new Set(inFlightRequestIds(events));
+export function inFlightRequestLabels(events, appOrigin, background = []) {
+    const open = new Set(inFlightRequestIds(events, appOrigin, background));
     const labels = [];
     for (const e of events) {
         if (e.type !== EventType.NET_PENDING)
@@ -136,7 +157,9 @@ export function repeatedRequestLabels(events) {
  * timeout reaching the predicate, and a negative deadline must mean "stop", never "loop forever".
  */
 export async function waitForInFlight(session, since, budgetMs, opts) {
-    let open = inFlightRequestIds(session.eventsSince(since));
+    // The verdict's own scope: waiting on a request the verdict will not count is latency for nothing.
+    const outstanding = () => inFlightRequestIds(session.eventsSince(since), session.url, session.background);
+    let open = outstanding();
     if (0 === open.length)
         return { settled: true, stillInFlight: [] };
     if (budgetMs <= 0)
@@ -145,7 +168,7 @@ export async function waitForInFlight(session, since, budgetMs, opts) {
     while (session.elapsed() < deadline) {
         // Never overshoot the budget: the last sleep is trimmed to whatever is actually left.
         await opts.sleep(Math.min(POLL_MS, deadline - session.elapsed()));
-        open = inFlightRequestIds(session.eventsSince(since));
+        open = outstanding();
         if (0 === open.length)
             return { settled: true, stillInFlight: [] };
     }

package/dist/surface/tools/act-capsule.js

@@ -10,7 +10,7 @@
  * must never fail the run that found it.
  */
 import { ActionType, AnchorKind } from '@reticlehq/core';
-import { CapsuleStore, capsuleId, CAPSULE_VERSION } from '../../judgement/capsule/capsule-store.js';
+import { CapsuleStore, capsuleFingerprint, capsuleId, CAPSULE_VERSION, } from '../../judgement/capsule/capsule-store.js';
 import { ReticleTool } from '@reticlehq/core';
 import { asRecord, asString } from '@reticlehq/core';
 import { sessionRoot } from '../../memory/project/session-root.js';
@@ -19,7 +19,6 @@ export async function saveFailedAssertCapsule(inputs) {
     const { deps, verdict, capsule, links, args, actResult, actedSource, root: given } = inputs;
     if (verdict.pass || capsule === undefined)
         return undefined;
-    const id = capsuleId(deps.now(), asString(args['ref']) ?? 'assert');
     const expectedText = links
         .map((l) => ('name' in l ? `${l.kind} ${String(l.name)}` : l.kind))
         .join(' AND ');
@@ -27,11 +26,26 @@ export async function saveFailedAssertCapsule(inputs) {
     // Same rule and same resolver as every other artifact: a capsule written into a sibling repo is
     // evidence filed against a codebase that did not produce it, and it outlives the turn.
     // The caller's answer wins; the resolver is the fallback for callers that have no session.
-    const root = given ?? sessionRoot(deps, asString(args['sessionId']));
-    const saved = await new CapsuleStore(deps.fs, root).save({
+    const root = given ?? bestEffortRoot(deps, asString(args['sessionId']));
+    // No directory this capsule could honestly belong to, so it is not filed. The two things this
+    // must not do are write it somewhere arbitrary and throw: the assertion has already failed, the
+    // verdict is already built, and losing the capsule must never also lose the verdict.
+    if (root === undefined)
+        return undefined;
+    // Built BEFORE the id, because the id carries the fingerprint of this body — that is what lets a
+    // retry of the same broken step fold into the capsule already on disk instead of adding a file.
+    /*
+     * What this capsule is ABOUT, for its filename and its anchor.
+     *
+     * The testid is the element said in a name a human chose; `args.ref` is a volatile handle minted
+     * per session, meaningless an hour later and anywhere else. The anchor may still fall back to the
+     * ref, because the anchor has to address the element and the ref is what addressed it. The NAME
+     * must not: a capsule is durable, meant to be committed, and read by somebody who was not there.
+     */
+    const testid = asString(asRecord(actResult.result)['testid']);
+    const action = asString(args['action']) ?? ActionType.CLICK;
+    const body = {
         version: CAPSULE_VERSION,
-        id,
-        createdAt: deps.now(),
         origin: 'failed-assert',
         expected: expectedText.length > 0 ? expectedText : 'declared consequence',
         observed: capsule.firstDivergence?.observed ?? verdict.failureReason ?? 'not observed',
@@ -40,14 +54,41 @@ export async function saveFailedAssertCapsule(inputs) {
                 tool: ReticleTool.ACT,
                 anchor: {
                     kind: AnchorKind.TESTID,
-                    value: asString(asRecord(actResult.result)['testid']) ?? asString(args['ref']) ?? '',
+                    value: testid ?? asString(args['ref']) ?? '',
                     // Carried so the saved capsule — which outlives this turn and becomes a regression flow
                     // when it goes green — still knows which file the failure came from.
                     ...(actedSource === undefined ? {} : { source: actedSource }),
                 },
-                action: (asString(args['action']) ?? ActionType.CLICK),
+                action: action,
             },
         ],
+    };
+    const id = capsuleId(deps.now(), testid ?? action, capsuleFingerprint(body));
+    const saved = await new CapsuleStore(deps.fs, root).save({
+        ...body,
+        id,
+        createdAt: deps.now(),
     });
     return saved ? id : undefined;
 }
+/**
+ * Where this capsule goes, or nothing — never a throw and never somebody else's checkout.
+ *
+ * `sessionRoot` refuses a `sessionId` that names no session, because for a tool the agent CALLED
+ * the alternative is silently writing into the daemon's own project. Here the caller is not a tool
+ * the agent called: it is the evidence capture hanging off a verdict that has already been decided,
+ * and on this path a refusal would convert a red assertion into a tool error. Both of the answers
+ * that refusal exists to prevent are still prevented — nothing is written, and nothing is written
+ * to the wrong root — by declining to file the capsule at all.
+ *
+ * Reachable only when the act's own session AND its navigation successor are gone by the time the
+ * verdict lands, since `act_and_wait` passes the root of the session it actually drove.
+ */
+function bestEffortRoot(deps, sessionId) {
+    try {
+        return sessionRoot(deps, sessionId);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/surface/tools/act-tools.js

@@ -42,7 +42,6 @@ import { waitForReaction } from './act/react-grace.js';
 import { decideVerified } from '@reticlehq/engine/evidence/verified.js';
 import { honestyForVerdict } from '@reticlehq/engine/evidence/honesty.js';
 import { declaredExpectations, declaresBodyIndependentChannel, } from '@reticlehq/engine/question/declared.js';
-import { readsDomState, alreadyTrueHiddenMatch as alreadyTrueHiddenMatchOf, } from '@reticlehq/engine/evidence/already-true.js';
 import { describeWaitTarget, namedNetIsInFlight } from '@reticlehq/engine/evidence/unsettled.js';
 import { saveFailedAssertCapsule } from './act-capsule.js';
 import { blastRadius, buildDivergenceCapsule, wireCapsule } from '../../judgement/capsule/capsule.js';
@@ -52,7 +51,8 @@ import { absenceBlindSpotNote, buildCoverageStatement, blindSpotsFromState, tran
 import { acceptedWriteLabels } from '@reticlehq/engine/evidence/accepted-write.js';
 import { unreadWriteLabels } from '@reticlehq/engine/evidence/unread-outcome.js';
 import { evaluatePredicate, waitForPredicate, provenExpectedLinks, PredicateSchema, } from '@reticlehq/engine/question/predicate/predicate.js';
-import { healthEnvelope, refuseIfThrottled } from '../../portal/session/session-health.js';
+import { sessionVerdictFacts } from '../../portal/session/session-verdict-facts.js';
+import { currentOf, healthEnvelope, refuseIfThrottled } from '../../portal/session/session-health.js';
 import { pausedShortCircuit, pausedOutputShape, withControl, PAUSED_NO_VERDICT, } from '../../portal/session/control-envelope.js';
 import { asNumber, asRecord, asString } from '@reticlehq/core';
 import { sourceOf } from './tools-helpers.js';
@@ -64,6 +64,7 @@ import { asActionType, gradeOf } from './act/act-helpers.js';
 import { resolveActTarget } from './act/act-target.js';
 import { tryRealInput, rewriteUploadArgs, HOVER_NEEDS_POINTER_MSG } from './real-input-attempt.js';
 import { gradeOfPredicate } from './assert/assert-grade.js';
+import { readAlreadyTrue } from './act/already-true.js';
 /**
  * Narrow the wire's `action` to a real ActionType, or undefined.
  *
@@ -428,22 +429,10 @@ export const ACT_TOOLS = [
             // A verdict that lives only in the response lives only in the agent's context window, which is
             // exactly the copy a compaction destroys — see runs/run-context.ts.
             let verdictEffect;
-            // Was the declared consequence ALREADY TRUE? Only asked for predicates that read live DOM
-            // state — event-based ones are floored at this act's cursor and cannot be satisfied by the
-            // past, so they need no pre-check and pay nothing. One extra query, on the path where a green
-            // is otherwise unfalsifiable. See engine/src/evidence/already-true.ts.
-            const alreadyTruePrecheck = until !== undefined && readsDomState(until)
-                ? await evaluatePredicate(session, until, since, false)
-                : undefined;
-            const alreadyTrue = alreadyTruePrecheck?.pass ?? false;
+            // Was the consequence ALREADY TRUE, and what did that reading say? See act/already-true.ts.
+            const { alreadyTrue, alreadyTrueHiddenMatch, alreadyTrueEvidence, baselines } = await readAlreadyTrue(session, until, since);
             // Same as the ACT handler: the route this step RAN on, before the action can move the app.
             const routeBeforeWait = pathOf(session.url);
-            // #889: the pre-check evidence is already in hand — cheap to also ask whether that match was
-            // against something hidden, so the already_true message can name it instead of leaving the
-            // agent to re-derive "was this actually showing?" from nothing.
-            const alreadyTrueHiddenMatch = alreadyTrue && until !== undefined
-                ? alreadyTrueHiddenMatchOf(until, alreadyTruePrecheck?.evidence)
-                : false;
             try {
                 // actCommand is the single interception point for upload+path rewrite.
                 //
@@ -472,8 +461,8 @@ export const ACT_TOOLS = [
                 let verdict = null === actResult
                     ? { pass: false, observationLost: true }
                     : timeout > 0
-                        ? await waitForPredicate(session, until, timeout, since)
-                        : await evaluatePredicate(session, until, since);
+                        ? await waitForPredicate(session, until, timeout, since, baselines)
+                        : await evaluatePredicate(session, until, since, true, baselines);
                 // The SDK may have gone away mid-act — see act-observation.ts.
                 const followed = await followLostObservation({
                     sessions: deps.sessions,
@@ -481,7 +470,7 @@ export const ACT_TOOLS = [
                     verdict,
                     timeout,
                     predicateStarted,
-                    reevaluate: (next, budget) => waitForPredicate(next, until, budget, 0),
+                    reevaluate: (next, budget) => waitForPredicate(next, until, budget, 0, baselines),
                 });
                 if (followed.followed)
                     since = 0;
@@ -654,17 +643,17 @@ export const ACT_TOOLS = [
                     currentDocumentId: session.currentDocumentId,
                     currentEditEpoch: session.currentEditEpoch,
                     appOrigin: session.url,
+                    background: session.background,
                 });
                 // The single field an agent reads. Everything below it is the evidence it was derived from;
                 // this is the only one that has to be interpreted, and now it interprets itself.
                 const outcomePending = acceptedWriteLabels(windowEvents);
                 const outcomeUnread = unreadWriteLabels(windowEvents);
-                const stillInFlight = inFlightRequestLabels(windowEvents);
+                const stillInFlight = inFlightRequestLabels(windowEvents, session.url, session.background);
                 const decision = decideVerified({
                     pass: verdict.pass,
-                    // So the unread-body remedy can check it applies to THIS page. Threaded rather than
-                    // looked up inside decideVerified, which is pure and has no session.
-                    ...(session.sdkVersion === undefined ? {} : { sdkVersion: session.sdkVersion }),
+                    // Threaded rather than looked up: decideVerified is pure and has no session.
+                    ...sessionVerdictFacts(session),
                     // The caller NAMED the consequence rather than defaulting to "wait for idle". A
                     // declaration made before the action is what this tool sells, and idle-settlement was
                     // overriding it — see `declaredConsequence`. An explicit `{ kind: "settled" }` is not a
@@ -770,6 +759,16 @@ export const ACT_TOOLS = [
                     // which is why the two are recorded apart rather than assumed alike.
                     declaredBeforeActing: true,
                     grade: gradeOfPredicate(until),
+                    // What the declared consequence READ. The run fold has only the journal, so a kind absent
+                    // here was being invented there as `element`. Same field, same reason, on the assert path.
+                    kind: until.kind,
+                    // The deciding clause, kept — and it was NOT, on this path, the commonest one. `unknown`
+                    // alone cannot tell an outcome that has not arrived from a capture that could not be
+                    // read, so a fold over the journal saw a verdict it could not attribute, and the
+                    // attribution is the only part of an `unknown` a reader can act on. The comment above
+                    // says "same field, same reason, on the assert path" and was half true. Found by the
+                    // session gap summary, whose `undecidedBy` was empty for every unknown this tool made.
+                    reason: decision.verifiedReason,
                 };
                 // Recorded on the session, so a later "am I done?" can answer with what is STILL missing
                 // rather than with everything that was ever missing. An empty list closes a gap, which is
@@ -777,6 +776,8 @@ export const ACT_TOOLS = [
                 noteSessionGaps(session, gaps);
                 return withControl(session, {
                     ...decision,
+                    // WHAT was already true, not only that something was (4.1) — see act/already-true.ts.
+                    ...(alreadyTrueEvidence === undefined ? {} : { alreadyTrueEvidence }),
                     // An unobserved act has no effect to report, and inventing an empty one would read as
                     // "the page did nothing" — a claim about the app, from a call that never saw it.
                     ...(null === actResult ? {} : { effect: leanActResult(actResult.result) }),
@@ -823,7 +824,7 @@ export const ACT_TOOLS = [
                     ...(0 === greenRadius.length ? {} : { blastRadius: greenRadius }),
                     since,
                     ...(session.id === actedSessionId ? {} : { sessionId: session.id }),
-                    ...healthEnvelope(session),
+                    ...healthEnvelope(currentOf(deps.sessions, session)),
                 });
             }
             finally {

package/dist/surface/tools/args/numeric-bounds.d.ts

@@ -31,8 +31,6 @@ export declare const MAX_BLOCKING_WAIT_MS: number;
  * in the name of bounding one that never worked.
  */
 export declare const MAX_STATE_DEPTH = 256;
-/** Scroll-to-find steps. Default is 20; hundreds is searching, thousands is a hang. */
-export declare const MAX_SCROLLS = 200;
 /** Viewport CSS px — matches the clamp the handler already applied, now as a refusal. */
 export declare const MIN_VIEWPORT_PX = 64;
 export declare const MAX_VIEWPORT_PX = 10000;
@@ -45,6 +43,21 @@ export declare const cursorSchema: z.ZodNumber;
  * A wait budget in ms. 0 means evaluate now (documented on assert). Negative cannot be honoured.
  */
 export declare const timeoutMsSchema: z.ZodNumber;
+/**
+ * `reticle_wait_for`'s budget, which may exceed one call: it waits at most MAX_BLOCKING_WAIT_MS per
+ * call and hands back `resume_ms` for the rest (#601, from #635).
+ */
+export declare const waitForTimeoutMsSchema: z.ZodNumber;
+/**
+ * What is left of a wait that stopped at the per-call limit, or undefined when there is nothing to
+ * resume: the predicate held, the whole budget fit in this call, or the wait ended for a reason
+ * waiting longer cannot change (the page went away, or the read could not be made).
+ */
+export declare function resumeAfter(requestedMs: number, perCallMs: number, verdict: {
+    pass: boolean;
+    observationLost?: boolean;
+    inconclusive?: string;
+}): number | undefined;
 /**
  * A count / cap. 0 means "return none", which is a real request. Negative is not.
  * Capped at the ring-buffer size so a `limit: 1e9` cannot pretend the buffer is larger than it is.