@reticlehq/server 3.2.0 → 3.3.0

package/dist/language/flows/flow-success.js

@@ -12,7 +12,7 @@
  * tool and the `@reticlehq/test` spec runner share one implementation — no divergent oracle.
  * Pure: no IO, no clock.
  */
-import { AnchorKind, PredicateKind } from '@reticlehq/core';
+import { AnchorKind, PredicateKind, clauseOfKind, flowExpectToPredicate, withoutClauses, } from '@reticlehq/core';
 /** The dynamic (LLM-output) testids whose presence is never asserted — same rule replay uses. */
 export function dynamicTestids(flow) {
     return new Set((flow.dynamic ?? [])
@@ -23,145 +23,59 @@ export function dynamicTestids(flow) {
 export const SUCCESS_STEP_TOOL = 'success';
 /** A short human label for the success end-condition, for result rows. */
 export function successLabel(success) {
-    if (success.signal !== undefined)
-        return success.signal;
-    if (success.net !== undefined)
-        return success.net.urlContains ?? success.net.method ?? 'net';
-    if (success.console !== undefined) {
-        return `console:${true === success.console.absent ? 'clean' : (success.console.level ?? 'error')}`;
+    /*
+     * NOT `expectLabel`, and the difference is the reader.
+     *
+     * That one names a clause for a drift row, where `signal:` tells you which channel failed. This
+     * one is `mustHold` in the domain model an agent reads BEFORE testing — a list of what each flow
+     * guarantees — and there the prefix is noise on the commonest case. A signal's own name is the
+     * sentence: "order:placed" is what must hold.
+     */
+    const signal = clauseOfKind(success, PredicateKind.SIGNAL);
+    if (signal?.name !== undefined)
+        return signal.name;
+    const net = clauseOfKind(success, PredicateKind.NET);
+    if (net !== undefined)
+        return net.urlContains ?? net.method ?? 'net';
+    const console_ = clauseOfKind(success, PredicateKind.CONSOLE);
+    if (console_ !== undefined) {
+        return `console:${true === console_.absent ? 'clean' : (console_.level ?? 'error')}`;
     }
-    if (success.state !== undefined)
-        return `state:${success.state.path}`;
-    if (success.text !== undefined)
-        return `text:${success.text.contains}`;
-    return success.element?.testid ?? success.element?.name ?? success.element?.role ?? 'success';
+    const state = clauseOfKind(success, PredicateKind.STATE);
+    if (state !== undefined)
+        return `state:${state.path}`;
+    const text = clauseOfKind(success, PredicateKind.TEXT);
+    if (text?.contains !== undefined)
+        return `text:${text.contains}`;
+    const element = clauseOfKind(success, PredicateKind.ELEMENT);
+    const q = element?.query;
+    return q?.testid ?? q?.name ?? q?.role ?? 'success';
 }
-/** Compile a success FlowExpect into a predicate. undefined → nothing assertable (vacuously met). */
+/**
+ * What a flow's success oracle actually asserts, once the file has been read and the dynamic
+ * (LLM-output) testids have been taken out of it.
+ *
+ * Most of what this function used to do is gone, and that is the migration working as intended: it
+ * compiled a flat `FlowExpect` into a `Predicate`, and a step's `expect` IS a predicate now, lifted
+ * by the schema when the file is read. It keeps the name and the signature because it is on
+ * `@reticlehq/test`'s published surface, and it still accepts the flat shape for the same reason a
+ * v1 file still loads — a spec written against the old spelling is not wrong, it is old.
+ *
+ * What remains is the DYNAMIC SKIP, and it is not cosmetic. A testid whose content a model writes is
+ * asserted for PRESENCE by the step layer and never for content; a success oracle bound to one would
+ * assert exactly what the flow has already declared unassertable. Dropping every such clause can
+ * leave nothing at all, and `undefined` is the honest answer — vacuously met, the same as declaring
+ * no success, because nothing here was checkable.
+ */
 export function successToPredicate(success, dynamic) {
-    const parts = [];
-    if (success.signal !== undefined) {
-        const signal = {
-            kind: PredicateKind.SIGNAL,
-            name: success.signal,
-        };
-        if (success.signalData !== undefined)
-            signal.dataMatches = success.signalData;
-        if (success.signalCount !== undefined) {
-            signal.count = success.signalCount;
-            // Same post-settle reasoning as net.count: the success waiter is wait-until-true, so an exact
-            // count is transiently satisfied the instant the FIRST matching signal fires — before a
-            // double-fire's duplicate arrives. Gating on `settled` forces the count to be read only after
-            // the app goes quiet, by which point the duplicate IS counted and the over-count fails.
-            parts.push({ kind: PredicateKind.SETTLED });
-        }
-        parts.push(signal);
-    }
-    if (success.route !== undefined) {
-        // The mirror of `predicateToExpect`'s ROUTE case. Replay evaluates predicates, so carrying the
-        // route back here is the whole of what makes a recorded navigation able to fail.
-        const route = {
-            kind: PredicateKind.ROUTE,
-        };
-        if (success.route.pathname !== undefined)
-            route.pathname = success.route.pathname;
-        if (success.route.contains !== undefined)
-            route.contains = success.route.contains;
-        return route;
-    }
-    if (success.net !== undefined) {
-        const net = { kind: PredicateKind.NET };
-        if (success.net.method !== undefined)
-            net.method = success.net.method;
-        if (success.net.urlContains !== undefined)
-            net.urlContains = success.net.urlContains;
-        if (success.net.status !== undefined)
-            net.status = success.net.status;
-        if (success.net.count !== undefined) {
-            net.count = success.net.count;
-            // A cardinality assertion is inherently POST-SETTLE. The success waiter is wait-until-true, so an
-            // exact count (e.g. 1) is transiently satisfied the instant the FIRST matching request lands —
-            // before a double-submit's duplicate arrives. Gating on `settled` forces the count to be read
-            // only after the network has gone quiet, so the duplicate IS counted and the over-count fails.
-            parts.push({ kind: PredicateKind.SETTLED });
-        }
-        parts.push(net);
-    }
-    if (success.console !== undefined) {
-        const con = {
-            kind: PredicateKind.CONSOLE,
-        };
-        if (success.console.level !== undefined)
-            con.level = success.console.level;
-        if (success.console.absent !== undefined) {
-            con.absent = success.console.absent;
-            // An `absent` assertion is post-settle, same as net.count: a wait-until-true waiter sees "no
-            // error yet" at the first poll and passes BEFORE the action's error fires. Gate on `settled` so
-            // the console is read only after the page quiets, by which point any error is in the buffer.
-            if (success.console.absent)
-                parts.push({ kind: PredicateKind.SETTLED });
-        }
-        parts.push(con);
-    }
-    const state = success.state;
-    if (state !== undefined) {
-        const part = {
-            kind: PredicateKind.STATE,
-            path: state.path,
-        };
-        if (state.store !== undefined)
-            part.store = state.store;
-        if (state.equals !== undefined)
-            part.equals = state.equals;
-        // `hold` = an INVARIANT ("this state must still hold after the action settles"), vs the default
-        // wait-for-change. A wait-until-true waiter would pass the instant the path already equals the
-        // value — which, for "an unrelated path stayed put", is true BEFORE a side-effect leak fires. Gate
-        // on `settled` so the read happens after the page quiets, by which point the leak has landed.
-        if (true === state.hold)
-            parts.push({ kind: PredicateKind.SETTLED });
-        parts.push(part);
-    }
-    const element = success.element;
-    if (element !== undefined) {
-        const testid = element.testid;
-        // A dynamic-marked testid is NOT asserted as a success condition (presence-only).
-        if (testid === undefined || !dynamic.has(testid)) {
-            const query = {};
-            if (testid !== undefined)
-                query['testid'] = testid;
-            if (element.role !== undefined)
-                query['role'] = element.role;
-            if (element.name !== undefined)
-                query['name'] = element.name;
-            if (Object.keys(query).length > 0)
-                parts.push({ kind: PredicateKind.ELEMENT, query });
-        }
-    }
-    const text = success.text;
-    if (text !== undefined) {
-        const part = {
-            kind: PredicateKind.TEXT,
-            contains: text.contains,
-        };
-        if (text.scope !== undefined)
-            part.scope = text.scope;
-        if (text.visible !== undefined)
-            part.visible = text.visible;
-        if (true === text.absent) {
-            part.absent = true;
-            // Same post-settle reasoning as `console.absent` and `state.hold`: a wait-until-true waiter
-            // reads "not there yet" on the first poll and passes BEFORE the text it is meant to see
-            // disappear has even been rendered. Gate on `settled` so the read happens after the page
-            // quiets, by which point a text that was going to appear has.
-            parts.push({ kind: PredicateKind.SETTLED });
-        }
-        parts.push(part);
-    }
-    const [first] = parts;
-    if (0 === parts.length)
+    if (success === undefined)
         return undefined;
-    if (1 === parts.length && first !== undefined)
-        return first;
-    return { kind: PredicateKind.ALL_OF, predicates: parts };
+    const predicate = 'kind' in success ? success : flowExpectToPredicate(success);
+    if (predicate === undefined)
+        return undefined;
+    return withoutClauses(predicate, (clause) => PredicateKind.ELEMENT === clause.kind &&
+        clause.query.testid !== undefined &&
+        dynamic.has(clause.query.testid));
 }
 /**
  * Assert a flow's success end-condition after replay. Delegates to the injected waitForSignal (the
@@ -170,8 +84,6 @@ export function successToPredicate(success, dynamic) {
  * the injected timeout. Never reads the wall clock.
  */
 export async function assertSuccess(session, success, dynamic, waitForSignal, timeoutMs, since = 0) {
-    if (success === undefined)
-        return { pass: true };
     const predicate = successToPredicate(success, dynamic);
     if (predicate === undefined)
         return { pass: true };

package/dist/language/flows/flows.d.ts

@@ -1,8 +1,8 @@
-import { type ProjectId } from '@reticlehq/core';
+import { type Predicate, type ProjectId } from '@reticlehq/core';
 export { REDACTED_FILL } from './fields/flow-secret-field.js';
 import { type FlowResult } from './flow-result.js';
 export type { FlowResult } from './flow-result.js';
-import type { FlowAnchor, FlowExpect, FlowFile, FlowStep, HealChange, InstrumentationGap } from '@reticlehq/core';
+import type { FlowAnchor, FlowFile, FlowStep, HealChange, InstrumentationGap } from '@reticlehq/core';
 import type { CompiledProgram, RecordedStep } from './recording/tape/recordings.js';
 import type { FileSystemPort } from '../../memory/project/fs/fs-port.js';
 import type { Clock } from '../../machine/clock.js';
@@ -49,9 +49,9 @@ interface SaveSummary {
  * the same bytes as before.
  */
 export interface FlowAnnotations {
-    stepExpect: Map<number, FlowExpect>;
+    stepExpect: Map<number, Predicate>;
     dynamic: string[];
-    success?: FlowExpect;
+    success?: Predicate;
     /** The flow's declared business goal (intent annotation). */
     intent?: string;
 }
@@ -75,6 +75,10 @@ export declare class FlowStore {
     recordLearned(name: string, learned: NonNullable<FlowFile['learned']>, projectId?: ProjectId): Promise<FlowResult<{
         name: string;
     }>>;
+    /** Give sourceless steps the files a clean replay resolved them to, merged onto the file as it is now. */
+    recordSources(name: string, sources: ReadonlyMap<string, NonNullable<FlowStep['source']>>, projectId?: ProjectId): Promise<FlowResult<{
+        name: string;
+    }>>;
     /**
      * Apply confident testid rebinds to an on-disk flow (the `reticle_flow_heal` apply path),
      * rewriting ONLY the named steps' anchors and preserving every other field. Loading, the name

package/dist/language/flows/flows.js

@@ -1,4 +1,4 @@
-import { asFlowName, asProjectId } from '@reticlehq/core';
+import { asFlowName, asProjectId, } from '@reticlehq/core';
 import { REDACTED_FILL } from './fields/flow-secret-field.js';
 export { REDACTED_FILL } from './fields/flow-secret-field.js';
 import { safeProjectId } from './flow-result.js';
@@ -7,6 +7,7 @@ import { AnchorKind, DEGRADED_ANCHOR_ROLE, FLOW_FILE_VERSION, FlowErrorCode, Flo
 import { ReticleTool } from '@reticlehq/core';
 import { asRecord, asString } from '@reticlehq/core';
 import { applyHealChanges } from './heal.js';
+import { withLearnedSources } from './learned-sources.js';
 import { flowIntentGap, linkFlowIntent } from './flow-intent.js';
 import { IntentStore } from '../../memory/intent/intent-store.js';
 import { flowDir, flowParentDir, flowPath, reticleDirPaths, isValidFlowName, } from '../../memory/project/dir/reticle-dir.js';
@@ -351,6 +352,13 @@ export class FlowStore {
             value: { name },
         }));
     }
+    /** Give sourceless steps the files a clean replay resolved them to, merged onto the file as it is now. */
+    async recordSources(name, sources, projectId) {
+        return await this.#changeInPlace(name, projectId, (flow) => ({
+            next: withLearnedSources(flow, sources) ?? flow,
+            value: { name },
+        }));
+    }
     /**
      * Apply confident testid rebinds to an on-disk flow (the `reticle_flow_heal` apply path),
      * rewriting ONLY the named steps' anchors and preserving every other field. Loading, the name
@@ -362,7 +370,8 @@ export class FlowStore {
      */
     async heal(name, changes, projectId) {
         return await this.#changeInPlace(name, projectId, (flow) => {
-            const { flow: next, applied } = applyHealChanges(flow, changes);
+            // The store's injected clock, so a written flow records when the rebind actually happened.
+            const { flow: next, applied } = applyHealChanges(flow, changes, () => this.#clock.now());
             return { next, value: { name, changed: applied } };
         });
     }

package/dist/language/flows/heal.d.ts

@@ -25,7 +25,15 @@ export declare function confidenceFor(from: string, to: string): number;
  * skipped (idempotent / defensive), never throwing. Shared by the on-disk writer (FlowStore.heal)
  * and the in-memory pre-write verification in reticle_flow_heal, so both rewrite identically.
  */
-export declare function applyHealChanges(flow: FlowFile, changes: HealChange[]): {
+export declare function applyHealChanges(flow: FlowFile, changes: HealChange[], 
+/**
+ * When the rebind happened. Injected rather than read here, because this function is pure and a
+ * clock inside it would make the flow it returns depend on when a test ran.
+ *
+ * Optional so every existing caller keeps working; without it the step still records WHICH anchor
+ * was replaced, which is the half a reader actually acts on.
+ */
+now?: () => number): {
     flow: FlowFile;
     applied: HealChange[];
 };

package/dist/language/flows/heal.js

@@ -38,7 +38,15 @@ export function confidenceFor(from, to) {
  * skipped (idempotent / defensive), never throwing. Shared by the on-disk writer (FlowStore.heal)
  * and the in-memory pre-write verification in reticle_flow_heal, so both rewrite identically.
  */
-export function applyHealChanges(flow, changes) {
+export function applyHealChanges(flow, changes, 
+/**
+ * When the rebind happened. Injected rather than read here, because this function is pure and a
+ * clock inside it would make the flow it returns depend on when a test ran.
+ *
+ * Optional so every existing caller keeps working; without it the step still records WHICH anchor
+ * was replaced, which is the half a reader actually acts on.
+ */
+now) {
     const byStep = new Map();
     for (const change of changes)
         byStep.set(change.step, change);
@@ -51,7 +59,21 @@ export function applyHealChanges(flow, changes) {
             return step;
         }
         applied.push(change);
-        return { ...step, anchor: { kind: AnchorKind.TESTID, value: change.to } };
+        return {
+            ...step,
+            anchor: { kind: AnchorKind.TESTID, value: change.to },
+            /*
+             * `from` is the ORIGINAL recorded anchor, kept across later heals.
+             *
+             * A step healed twice has an intermediate name nobody ever chose, so overwriting with the
+             * newest would throw away the only anchor a reader wants — the one that was recorded by
+             * driving. The timestamp is the LATEST heal, because that is when this anchor arrived.
+             */
+            healed: {
+                from: step.healed?.from ?? change.from,
+                at: now?.() ?? step.healed?.at ?? 0,
+            },
+        };
     });
     return { flow: { ...flow, steps }, applied };
 }

package/dist/language/flows/learned-sources.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Learn a flow step's source file from the element its anchor resolved to on a replay.
+ *
+ * A step recorded before the build stamped the app names no file, so a scoped re-verify cannot say
+ * which edits it covers. Every replay already asks the page for each anchor's element, and that
+ * element carries its stamp now: this records the answer at the one place every resolution passes
+ * through (the session's QUERY), rather than threading it through each step runner.
+ */
+import { type FlowFile, type FlowStep } from '@reticlehq/core';
+import type { FlowReplaySession } from './flow-replay-types.js';
+type StepSource = NonNullable<FlowStep['source']>;
+/** `src/Pay.tsx:12:4` or `src/Pay.tsx:12` → `{file, line}`; anything else is not a location. */
+export declare function parseCompactSource(value: string): StepSource | undefined;
+/** Wrap a replay session so every anchor QUERY that resolves to one stamped element is remembered. */
+export declare function recordingSources(inner: FlowReplaySession): {
+    session: FlowReplaySession;
+    sources: ReadonlyMap<string, StepSource>;
+};
+/** The flow with every sourceless step given the file its anchor resolved to; undefined if none was. */
+export declare function withLearnedSources(flow: FlowFile, sources: ReadonlyMap<string, StepSource>): FlowFile | undefined;
+export {};

package/dist/language/flows/learned-sources.js

@@ -0,0 +1,84 @@
+/**
+ * Learn a flow step's source file from the element its anchor resolved to on a replay.
+ *
+ * A step recorded before the build stamped the app names no file, so a scoped re-verify cannot say
+ * which edits it covers. Every replay already asks the page for each anchor's element, and that
+ * element carries its stamp now: this records the answer at the one place every resolution passes
+ * through (the session's QUERY), rather than threading it through each step runner.
+ */
+import { ReticleCommand, asRecord, asString } from '@reticlehq/core';
+import { anchorQueryArgs } from './flow-step-runners.js';
+/** `src/Pay.tsx:12:4` or `src/Pay.tsx:12` → `{file, line}`; anything else is not a location. */
+export function parseCompactSource(value) {
+    const match = /^(.+?):(\d+)(?::\d+)?$/.exec(value);
+    const file = match?.[1];
+    const line = match?.[2];
+    if (file === undefined || line === undefined)
+        return undefined;
+    return { file, line: Number(line) };
+}
+function keyOf(args) {
+    if (args === undefined)
+        return undefined;
+    const by = asString(args['by']);
+    const value = asString(args['value']);
+    if (by === undefined || value === undefined)
+        return undefined;
+    return JSON.stringify([by, value, asString(args['name']) ?? null]);
+}
+/** The one element a query found, when exactly one was found and it carries a stamp. */
+function soleSource(result) {
+    const elements = asRecord(result)?.['elements'];
+    if (!Array.isArray(elements) || elements.length !== 1)
+        return undefined;
+    const source = asString(asRecord(elements[0])?.['source']);
+    return source === undefined ? undefined : parseCompactSource(source);
+}
+/** Wrap a replay session so every anchor QUERY that resolves to one stamped element is remembered. */
+export function recordingSources(inner) {
+    const sources = new Map();
+    const session = new Proxy(inner, {
+        // Bound to the target, never the proxy: a real Session keeps `#private` state, and a method
+        // called with the proxy as `this` throws reading it.
+        get(target, prop) {
+            if (prop !== 'command') {
+                const value = Reflect.get(target, prop, target);
+                return 'function' === typeof value ? value.bind(target) : value;
+            }
+            return async (name, args) => {
+                const result = await target.command(name, args);
+                const key = name === ReticleCommand.QUERY ? keyOf(args) : undefined;
+                const source = result.ok ? soleSource(result.result) : undefined;
+                if (key !== undefined && source !== undefined)
+                    sources.set(key, source);
+                return result;
+            };
+        },
+    });
+    return { session, sources };
+}
+function learnSteps(steps, sources) {
+    let changed = false;
+    const next = steps.map((step) => {
+        const nested = step.steps === undefined ? undefined : learnSteps(step.steps, sources);
+        const learned = step.source === undefined
+            ? sources.get(keyOf(anchorQueryArgs(step.anchor) ?? undefined) ?? '')
+            : undefined;
+        if (learned === undefined && nested?.changed !== true)
+            return step;
+        changed = true;
+        return {
+            ...step,
+            ...(learned === undefined ? {} : { source: learned }),
+            ...(nested === undefined ? {} : { steps: nested.steps }),
+        };
+    });
+    return { steps: next, changed };
+}
+/** The flow with every sourceless step given the file its anchor resolved to; undefined if none was. */
+export function withLearnedSources(flow, sources) {
+    if (0 === sources.size)
+        return undefined;
+    const { steps, changed } = learnSteps(flow.steps, sources);
+    return changed ? { ...flow, steps } : undefined;
+}

package/dist/language/flows/recording/recording-backtrack.d.ts

@@ -7,13 +7,6 @@
  * stop/save can warn instead of writing a flow that fails on the next click.
  */
 import { type ReticleEvent } from '@reticlehq/core';
-/**
- * The page a recording step sat on, comparable across path routers and hash routers.
- *
- * A startPath is stored as pathname+hash (`/#/search`); a ROUTE_CHANGE carries them separately.
- * Without this, every hash-router page compares as `/` and a backtrack is invisible.
- */
-export declare function recordingRouteOf(pathname: string, hash?: string): string;
 /**
  * Warn when the journey left a page and came back. Linear A→B→C is silent: that still cannot
  * replay either if a later click needs a previous page, but the reported failure is specifically

package/dist/language/flows/recording/recording-backtrack.js

@@ -17,7 +17,7 @@ function asString(value) {
  * A startPath is stored as pathname+hash (`/#/search`); a ROUTE_CHANGE carries them separately.
  * Without this, every hash-router page compares as `/` and a backtrack is invisible.
  */
-export function recordingRouteOf(pathname, hash = '') {
+function recordingRouteOf(pathname, hash = '') {
     const hashIdx = pathname.indexOf('#/');
     if (hashIdx >= 0) {
         return routePathOf(pathname.slice(0, hashIdx) || '/', pathname.slice(hashIdx));

package/dist/language/flows/recording/replay-halt.d.ts

@@ -12,7 +12,7 @@
  */
 import type { FlowStepResult } from '@reticlehq/core';
 /** Set on a replay that stopped early; omitted entirely otherwise, so a clean pass stays flat. */
-export interface ReplayHalt {
+interface ReplayHalt {
     /** Index of the step that stopped the run. */
     atStep: number;
     /** How many of the flow's steps were never attempted because of it. */
@@ -24,3 +24,4 @@ export interface ReplayHalt {
  * defect restated as its own fix.
  */
 export declare function haltedFrom(results: readonly FlowStepResult[], total: number): ReplayHalt | undefined;
+export {};

package/dist/language/flows/recording/tape/recordings.d.ts

@@ -1,4 +1,4 @@
-import { type FlowExpect } from '@reticlehq/core';
+import { type Predicate } from '@reticlehq/core';
 /** One captured agent action, normalized for replay. */
 export interface RecordedStep {
     /** ReticleTool.ACT | ReticleTool.ACT_SEQUENCE */
@@ -8,7 +8,7 @@ export interface RecordedStep {
     /** false if any ref could not be normalized to a testid (replay only valid in-session). */
     stable: boolean;
     /** Optional post-condition annotation carried into the on-disk flow's expect. */
-    expect?: FlowExpect;
+    expect?: Predicate;
     /**
      * The route this step ran on. RECORDER-INTERNAL: it never reaches the on-disk flow.
      *

package/dist/language/flows/replay.js

@@ -1,9 +1,8 @@
 import { REDACTED_FILL, secretEnvKey } from './fields/flow-secret-field.js';
+import { FlowPredicateSchema } from '@reticlehq/core';
 import { DANGEROUS_ACTION_CONFIRM_ARG, ReticleCommand, QueryBy, } from '@reticlehq/core';
 import { ReticleTool } from '@reticlehq/core';
 import { formatStepAddress } from 'open-verification';
-import { predicateToExpect, enforcedOnReplay } from '../../judgement/outcome/predicate-to-expect.js';
-import { PredicateSchema } from '@reticlehq/engine/question/predicate/predicate.js';
 import { asRecord, asString } from '@reticlehq/core';
 /**
  * The note attached when a testid resolves to multiple live elements (the first match is used).
@@ -105,16 +104,21 @@ route) {
 /**
  * A declared predicate, as a recorded expectation — or nothing.
  *
- * The ONE place this conversion happens, because it is the rule that decides whether a saved flow
- * proves anything, and two copies of it would drift. Only kinds a replay actually CHECKS survive:
- * recording an unenforced assertion grades the flow "asserted" while nothing verifies it, which is a
- * false green inside the feature built to prevent them. See enforcedOnReplay.
+ * It is now the SAME OBJECT. A step's `expect` is a `Predicate`, so what the agent declared in
+ * `until` is what the flow file stores, and there is no conversion left to lose anything in.
+ *
+ * What was here before was a lossy round trip through a flat struct with one slot per kind. An
+ * `allOf[netA, netB]` saved as one of the two with nothing said; anything the struct could not
+ * express was dropped, and a filter then removed the kinds replay would not have checked anyway.
+ * Every one of those was a claim the agent made and the file did not keep.
  */
 function enforceableExpect(raw) {
     if (raw === undefined)
         return undefined;
-    const parsed = PredicateSchema.safeParse(raw);
-    return parsed.success ? enforcedOnReplay(predicateToExpect(parsed.data)) : undefined;
+    // The flow file's own schema, so capture keeps exactly what a load would accept — a predicate
+    // holding a session ref is refused by both, rather than recorded here and rejected on read.
+    const parsed = FlowPredicateSchema.safeParse(raw);
+    return parsed.success ? parsed.data : undefined;
 }
 /**
  * Compile a single reticle_act invocation into a normalized RecordedStep using the action result. Anchor

package/dist/language/flows/stores/annotation-store.d.ts

@@ -1,22 +1,22 @@
-import type { FlowExpect } from '@reticlehq/core';
+import type { Predicate } from '@reticlehq/core';
 export declare class AnnotationStore {
     #private;
     /** Testids whose CONTENT must not be asserted at replay (mark-dynamic). Copy, never the live array. */
     dynamic(name: string): string[];
     /** The flow's golden end-condition (success-state), or undefined. */
-    success(name: string): FlowExpect | undefined;
+    success(name: string): Predicate | undefined;
     /** The flow's declared business goal (intent annotation), or undefined. */
     intent(name: string): string | undefined;
     /** Per-step expect predicates compiled from assert-* annotations, keyed by step index. */
-    stepExpect(name: string): Map<number, FlowExpect>;
+    stepExpect(name: string): Map<number, Predicate>;
     /** Append a dynamic testid (mark-dynamic). De-duped so repeated marks stay idempotent. */
     addDynamic(name: string, testid: string): void;
     /** Set the flow's success expectation (success-state); a later set overwrites. */
-    setSuccess(name: string, expect: FlowExpect): void;
+    setSuccess(name: string, expect: Predicate): void;
     /** Set the flow's declared business goal (intent); a later set overwrites. */
     setIntent(name: string, text: string): void;
     /** Set one step's expect (assert-signal / assert-visible); a later set on the same index wins. */
-    setStepExpect(name: string, index: number, expect: FlowExpect): void;
+    setStepExpect(name: string, index: number, expect: Predicate): void;
     /** Drop a recording's annotations (called after reticle_flow_save folds them onto disk). */
     clear(name: string): void;
 }

package/dist/language/flows/stores/assertion-tiers-store.js

@@ -1,4 +1,5 @@
 import { dirname } from 'node:path';
+import { writeFileAtomic } from '../../../memory/project/fs/write-atomic.js';
 import { z } from 'zod';
 import { reticleDirPaths } from '../../../memory/project/dir/reticle-dir.js';
 import { withFileLock } from '../../../memory/project/file-lock.js';
@@ -77,9 +78,7 @@ export class AssertionTiersStore {
     async save(tiers) {
         await this.#fs.mkdir(dirname(this.#path));
         const body = `${JSON.stringify({ version: ASSERTION_TIERS_VERSION, flows: tiers }, null, 2)}\n`;
-        const tmp = `${this.#path}.tmp`;
-        await this.#fs.writeFile(tmp, body);
-        await this.#fs.rename(tmp, this.#path);
+        await writeFileAtomic(this.#fs, this.#path, body);
     }
     /** Record one flow's assertion shape + covered sources after it PASSED. Never breaks a replay. */
     async recordPassing(name, steps, sources = []) {

package/dist/language/flows/stores/flake-store.js

@@ -1,4 +1,5 @@
 import { dirname } from 'node:path';
+import { writeFileAtomic } from '../../../memory/project/fs/write-atomic.js';
 import { reticleDirPaths } from '../../../memory/project/dir/reticle-dir.js';
 import { FlakeFileSchema, emptyRecord, isFlaky, recordOutcome, } from '../recording/flake.js';
 const FLAKE_FILE_VERSION = 1;
@@ -38,9 +39,7 @@ export class FlakeStore {
     async save(ledger) {
         await this.#fs.mkdir(dirname(this.#path));
         const body = `${JSON.stringify({ version: FLAKE_FILE_VERSION, flows: ledger }, null, 2)}\n`;
-        const tmp = `${this.#path}.tmp`;
-        await this.#fs.writeFile(tmp, body);
-        await this.#fs.rename(tmp, this.#path);
+        await writeFileAtomic(this.#fs, this.#path, body);
     }
     /** Accrue one unchanged-code replay outcome for a flow and persist. */
     async record(flow, passed) {

package/dist/language/flows/suite/coverage.d.ts

@@ -24,7 +24,7 @@ interface CoverageDimension {
     /** Declared-but-never-exercised members — what "everything" is silently missing. */
     uncovered: string[];
 }
-export interface Coverage {
+interface Coverage {
     testids: CoverageDimension;
     signals: CoverageDimension;
     flows: CoverageDimension;

package/dist/language/flows/suite/parallel-suite.d.ts

@@ -9,7 +9,7 @@
  * - one flow throwing never sinks the run — it is captured as that item's outcome, because a suite that
  * aborts on the first crash tells you nothing about the other 199 flows.
  */
-export interface Outcome<T> {
+interface Outcome<T> {
     ok: boolean;
     value?: T;
     error?: string;
@@ -24,3 +24,4 @@ export declare function mapWithConcurrency<I, T>(items: readonly I[], limit: num
  * and never below 1. Explicit `requested` (the tool's `parallel` arg) wins when it is a sane number.
  */
 export declare function resolveConcurrency(flowCount: number, poolCapacity: number, requested?: number): number;
+export {};