@reticlehq/server 3.4.0 → 3.5.0

package/dist/command/version/version-nudge.d.ts

@@ -11,7 +11,7 @@
  * result, then goes quiet until the skew CHANGES. Told, not nagged: a banner on every call is one an
  * agent learns to skip, and it would cost those tokens on every call for the rest of the session.
  */
-import type { SkewPair } from './version-skew.js';
+import { SkewPair } from './version-skew.js';
 interface VersionSkewNudge {
     pair: SkewPair;
     action: string;
@@ -21,8 +21,20 @@ interface VersionSkewNudge {
  * a second tab on a third version is news; the same tab reconnecting is not.
  */
 export declare function noteVersionSkew(pair: SkewPair, action: string): void;
-/** The next undelivered skew, once. */
-export declare function takeVersionSkew(): VersionSkewNudge | undefined;
+/**
+ * A daemon skew bound to the one MCP connection whose server announced it, told once (#1136).
+ *
+ * The page pair stays in the daemon-wide queue: it is a fact about a tab, true for whoever asks.
+ * This pair is a fact about the CALLER, and telling it to a different caller is advice to restart
+ * a server that is fine, or to run `reticle stop` and cut every agent on the daemon.
+ */
+export declare function connectionSkew(action: string): {
+    take(): string | undefined;
+};
+/** The next undelivered skew, once: this connection's own first, then the daemon-wide queue. */
+export declare function takeVersionSkew(connection?: {
+    take(): string | undefined;
+}): VersionSkewNudge | undefined;
 /**
  * Splice pending skew onto a tool-error payload.
  *
@@ -36,6 +48,8 @@ export declare function takeVersionSkewOnto(payload: {
     error: string;
     recovery?: string;
     feedback?: string;
+}, connection?: {
+    take(): string | undefined;
 }): Record<string, unknown>;
 /** Tests only — drop the module state so each case starts clean. */
 export declare function resetVersionSkew(): void;

package/dist/command/version/version-nudge.js

@@ -12,6 +12,7 @@
  * agent learns to skip, and it would cost those tokens on every call for the rest of the session.
  */
 import { EnvelopeKey } from '../../surface/tools/tool-kit.js';
+import { SkewPair } from './version-skew.js';
 /** Pending per pair — the SDK and the daemon are different upgrades and each is worth saying once. */
 const pending = new Map();
 /** The last message delivered for each pair, so the same skew is never repeated. */
@@ -25,8 +26,28 @@ export function noteVersionSkew(pair, action) {
         return;
     pending.set(pair, action);
 }
-/** The next undelivered skew, once. */
-export function takeVersionSkew() {
+/**
+ * A daemon skew bound to the one MCP connection whose server announced it, told once (#1136).
+ *
+ * The page pair stays in the daemon-wide queue: it is a fact about a tab, true for whoever asks.
+ * This pair is a fact about the CALLER, and telling it to a different caller is advice to restart
+ * a server that is fine, or to run `reticle stop` and cut every agent on the daemon.
+ */
+export function connectionSkew(action) {
+    let pendingAction = action;
+    return {
+        take: () => {
+            const taken = pendingAction;
+            pendingAction = undefined;
+            return taken;
+        },
+    };
+}
+/** The next undelivered skew, once: this connection's own first, then the daemon-wide queue. */
+export function takeVersionSkew(connection) {
+    const own = connection?.take();
+    if (own !== undefined)
+        return { pair: SkewPair.DAEMON, action: own };
     for (const [pair, action] of pending) {
         pending.delete(pair);
         delivered.set(pair, action);
@@ -43,8 +64,8 @@ export function takeVersionSkew() {
  * feedback ask is replaced: the skew IS the next move, and inviting a bug report about it is
  * backwards. A recognized recovery is kept; the envelope still rides along.
  */
-export function takeVersionSkewOnto(payload) {
-    const skew = takeVersionSkew();
+export function takeVersionSkewOnto(payload, connection) {
+    const skew = takeVersionSkew(connection);
     if (skew === undefined)
         return payload;
     const { feedback, ...rest } = payload;

package/dist/features/harness/fill-values.d.ts

@@ -31,6 +31,7 @@
  * wrong verdict. Nothing here touches what is judged.
  */
 import { type HarnessDriverOptions } from './driver.js';
+import { type OpenAiDriverOptions } from './openai-driver.js';
 /** What the caller must be able to do for values to survive past this drive. */
 export interface FillCache {
     get(label: string): string | undefined;
@@ -61,6 +62,9 @@ export declare function needsGeneration(label: string): boolean;
  */
 export declare function fillValues(deps: {
     cache?: FillCache;
+    /** GPT, the generator a Jev drive pairs with. Asked ahead of `generator` when both are set. */
+    openai?: OpenAiDriverOptions;
+    /** Anthropic, for a machine that holds only that key. */
     generator?: HarnessDriverOptions;
     /** One line about where the drive is, so a value suits the page it is typed on. */
     context?: () => string;

package/dist/features/harness/fill-values.js

@@ -31,6 +31,7 @@
  * wrong verdict. Nothing here touches what is judged.
  */
 import { DEFAULT_HARNESS_BASE_URL, } from './driver.js';
+import { DEFAULT_OPENAI_MODEL, OPENAI_REASONING_EFFORT, openAiCompletionsUrl, } from './openai-driver.js';
 /** Deliberately small. A field value is a phrase; anything longer is the model misunderstanding. */
 const MAX_TOKENS = 64;
 const ANTHROPIC_VERSION = '2023-06-01';
@@ -87,6 +88,40 @@ const PROMPT = (label, context) => `A test harness is filling in a form field on
     `Reply with ONLY the value to type. No quotes, no explanation, no markdown. It must be something a ` +
     `real user would plausibly enter, and short. If the field wants an identifier or a code, invent a ` +
     `well-formed one.`;
+/**
+ * A model's one-line answer as a field value, or nothing. A model asked for one value occasionally
+ * answers with a sentence about the value; anything long enough to be prose is not a field value,
+ * and typing prose proves nothing about the app.
+ */
+function asValue(raw) {
+    const text = raw?.trim().split('\n')[0];
+    if (text === undefined || 0 === text.length)
+        return undefined;
+    return 80 < text.length ? undefined : text.replace(/^["']|["']$/g, '');
+}
+/** One string from GPT over Chat Completions — directly, or through the platform with its key. */
+async function generateWithOpenAi(options, label, context) {
+    const call = options.fetch ?? ((url, init) => fetch(url, init));
+    try {
+        const res = await call(openAiCompletionsUrl(options), {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${options.apiKey}` },
+            body: JSON.stringify({
+                model: options.model ?? DEFAULT_OPENAI_MODEL,
+                max_completion_tokens: MAX_TOKENS,
+                reasoning_effort: OPENAI_REASONING_EFFORT,
+                messages: [{ role: 'user', content: PROMPT(label, context) }],
+            }),
+        });
+        if (!res.ok)
+            return undefined;
+        const parsed = JSON.parse(await res.text());
+        return asValue(parsed.choices?.[0]?.message?.content ?? undefined);
+    }
+    catch {
+        return undefined;
+    }
+}
 /** One string from a generating model, or nothing. Never throws: a drive must not fail over a field. */
 async function generateOne(options, label, context) {
     const call = options.fetch ?? ((url, init) => fetch(url, init));
@@ -109,17 +144,10 @@ async function generateOne(options, label, context) {
             return undefined;
         const parsed = JSON.parse(await res.text());
         const content = parsed.content ?? [];
-        const text = content
+        return asValue(content
             .filter((block) => 'text' === block.type)
             .map((block) => block.text ?? '')
-            .join('')
-            .trim()
-            .split('\n')[0];
-        if (text === undefined || 0 === text.length)
-            return undefined;
-        // A model asked for one value occasionally answers with a sentence about the value. Anything
-        // long enough to be prose is not a field value, and typing prose proves nothing about the app.
-        return 80 < text.length ? undefined : text.replace(/^["']|["']$/g, '');
+            .join(''));
     }
     catch {
         // Offline, refused, rate-limited, malformed. All the same answer: use the heuristic.
@@ -142,10 +170,18 @@ export function fillValues(deps) {
         if (cached !== undefined)
             return cached;
         const fallback = heuristicFillValue(label);
-        if (deps.generator === undefined || !needsGeneration(label) || MAX_PER_DRIVE <= spent)
+        const { openai, generator } = deps;
+        if ((openai === undefined && generator === undefined) ||
+            !needsGeneration(label) ||
+            MAX_PER_DRIVE <= spent)
             return fallback;
         spent += 1;
-        const generated = await generateOne(deps.generator, label, deps.context?.() ?? '');
+        const context = deps.context?.() ?? '';
+        const generated = openai !== undefined
+            ? await generateWithOpenAi(openai, label, context)
+            : generator !== undefined
+                ? await generateOne(generator, label, context)
+                : undefined;
         if (generated === undefined)
             return fallback;
         // Cached under the LABEL, not the ref: refs expire with the page, labels are what the next drive

package/dist/features/harness/openai-driver.d.ts

@@ -42,5 +42,17 @@ export interface OpenAiDriverOptions {
  * OpenAI key, which is the entire point of the proxy.
  */
 export declare function openAiOptionsFromEnv(env: Record<string, string | undefined>): OpenAiDriverOptions | undefined;
+/**
+ * Where a Chat Completions call goes. The platform does not expose `/v1/chat/completions`; it
+ * exposes its own path and forwards. A base URL that is not OpenAI's is the platform's, which is
+ * the only other thing this talks to.
+ */
+export declare function openAiCompletionsUrl(options: Pick<OpenAiDriverOptions, 'baseUrl'>): string;
+/**
+ * The small GPT models refuse function tools on Chat Completions while reasoning is on: measured,
+ * `gpt-5.6-luna` answers 400 to the first request that carries tools. A driving turn is a choice,
+ * not a plan, so no hidden reasoning is also the right depth and the cheapest one.
+ */
+export declare const OPENAI_REASONING_EFFORT = "none";
 /** Build a driver backed by Chat Completions. */
 export declare function openAiDriver(options: OpenAiDriverOptions): ModelDriver;

package/dist/features/harness/openai-driver.js

@@ -139,17 +139,28 @@ function parseArgs(raw) {
         return {};
     }
 }
+/**
+ * Where a Chat Completions call goes. The platform does not expose `/v1/chat/completions`; it
+ * exposes its own path and forwards. A base URL that is not OpenAI's is the platform's, which is
+ * the only other thing this talks to.
+ */
+export function openAiCompletionsUrl(options) {
+    const baseUrl = options.baseUrl ?? DEFAULT_OPENAI_BASE_URL;
+    return `${baseUrl}${DEFAULT_OPENAI_BASE_URL === baseUrl ? OPENAI_PATH : PLATFORM_PATH}`;
+}
+/**
+ * The small GPT models refuse function tools on Chat Completions while reasoning is on: measured,
+ * `gpt-5.6-luna` answers 400 to the first request that carries tools. A driving turn is a choice,
+ * not a plan, so no hidden reasoning is also the right depth and the cheapest one.
+ */
+export const OPENAI_REASONING_EFFORT = 'none';
 /** Build a driver backed by Chat Completions. */
 export function openAiDriver(options) {
     const model = options.model ?? DEFAULT_OPENAI_MODEL;
-    const baseUrl = options.baseUrl ?? DEFAULT_OPENAI_BASE_URL;
     const doFetch = options.fetch ?? ((url, init) => fetch(url, init));
-    // The platform does not expose `/v1/chat/completions`; it exposes its own path and forwards. A
-    // base URL that is not OpenAI's is the platform's, which is the only other thing this talks to.
-    const path = DEFAULT_OPENAI_BASE_URL === baseUrl ? OPENAI_PATH : PLATFORM_PATH;
     return {
         async turn(input) {
-            const response = await doFetch(`${baseUrl}${path}`, {
+            const response = await doFetch(openAiCompletionsUrl(options), {
                 method: 'POST',
                 headers: {
                     'content-type': 'application/json',
@@ -158,6 +169,7 @@ export function openAiDriver(options) {
                 body: JSON.stringify({
                     model,
                     max_completion_tokens: MAX_TOKENS,
+                    reasoning_effort: OPENAI_REASONING_EFFORT,
                     tools: input.tools.map(toWireTool),
                     messages: [{ role: 'system', content: input.system }, ...toWireMessages(input.history)],
                 }),

package/dist/features/license/license.d.ts

@@ -39,14 +39,14 @@ declare const LicensePayloadSchema: z.ZodObject<{
     exp: z.ZodNumber;
     features: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
-    lid: string;
     org: string;
+    lid: string;
     plan: string;
     exp: number;
     features?: string[] | undefined;
 }, {
-    lid: string;
     org: string;
+    lid: string;
     plan: string;
     exp: number;
     features?: string[] | undefined;

package/dist/index.js

@@ -9,7 +9,7 @@ import { attachCloudSync } from './memory/cloud/sync-daemon.js';
 import { wireHooks } from './hooks/hook-commands.js';
 import { PROJECT_REGISTRY_FILE, parseProjectRegistry, projectCandidates, } from '@reticlehq/core/artifacts';
 import { discoverProjectConfigs } from './command/cli/config/config-discovery.js';
-import { artifactRootResolver } from './memory/project/artifact-root-resolver.js';
+import { artifactRootResolver, projectDirectoryFor, } from './memory/project/artifact-root-resolver.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { AGENT_STOPPED_NOTICE, RETICLE_DEFAULT_PORT, bridgeWsUrl, ReticleCommand, ReticleDir, ReticleEnv, LOOPBACK_HOST, ReplayStatus, EventType, } from '@reticlehq/core';
 import { originOf } from './portal/session/session-manager.js';
@@ -21,6 +21,7 @@ import { reportAppInstrumented } from './telemetry/app-instrumented.js';
 import { resolveBridgeSecurityWithAutoToken } from './portal/bridge/bridge-security.js';
 import { Bridge } from './portal/bridge/bridge.js';
 import { sdkFixForDirectory } from './command/version/sdk-fix.js';
+import { connectionSkew } from './command/version/version-nudge.js';
 import { SERVER_VERSION } from './command/version/identity/server-version.js';
 import { BaselineStore } from './memory/project/baselines.js';
 import { RecordingStore } from './language/flows/recording/tape/recordings.js';
@@ -225,12 +226,12 @@ async function resolveRealInput(options, onNavigateError, onNetworkDetail) {
 }
 /** Start the Reticle bridge (browser WS endpoint) and, by default, the MCP stdio server. */
 /**
- * The SDK-upgrade sentence for THIS project's package.json, evaluated at each HELLO so a
- * just-edited manifest is what we name. Falls back to the framework-neutral sensor when cwd is
- * not an app.
+ * The SDK-upgrade sentence for the package.json of the project the page announced, evaluated at
+ * each HELLO so a just-edited manifest is what we name. The daemon's cwd only when that project's
+ * directory is unknown, and the framework-neutral sensor when that is not an app either (#1135).
  */
-function sdkFixForCwd() {
-    return sdkFixForDirectory(SERVER_VERSION, process.cwd());
+function sdkFixForProject(projectId) {
+    return sdkFixForDirectory(SERVER_VERSION, projectDirectoryFor(projectId) ?? process.cwd());
 }
 /**
  * Resolve a session's artifact root, from everything this machine knows about where projects live.
@@ -289,7 +290,7 @@ export async function start(options = {}) {
     });
     const uninstallHooks = wireHooks(options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT), readProjectId(process.cwd()));
     const security = await resolveBridgeSecurityWithAutoToken(options);
-    const bridge = new Bridge({ port, sdkFix: sdkFixForCwd, ...security });
+    const bridge = new Bridge({ port, sdkFix: sdkFixForProject, ...security });
     // Server-authoritative liveness: a Node-side reaper (immune to browser throttling) ends sessions
     // whose agent has gone idle, so a forgotten/crashed agent never leaves the HUD "running" forever.
     const reaper = new SessionReaper(bridge.sessions);
@@ -428,7 +429,12 @@ export async function startDaemon(options = {}) {
     });
     const security = await resolveBridgeSecurityWithAutoToken(options);
     const shared = createSharedServer(security.token === undefined ? {} : { token: security.token });
-    const bridge = new Bridge({ port, server: shared.httpServer, sdkFix: sdkFixForCwd, ...security });
+    const bridge = new Bridge({
+        port,
+        server: shared.httpServer,
+        sdkFix: sdkFixForProject,
+        ...security,
+    });
     // The daemon owns listen (below), so the real bind error is reported there; absorb bridge.ready's
     // mirror rejection so a port collision can't surface as an unhandled promise rejection.
     void bridge.ready.catch(() => undefined);
@@ -567,7 +573,9 @@ export async function startDaemon(options = {}) {
     const effectiveDeps = realInput !== undefined ? { ...deps, realInput } : deps;
     // Read per attach, not once: a project that gets wired while this daemon is alive should stop
     // being told to wire itself on the next agent that connects.
-    shared.attachMcp(() => createMcpServer(effectiveDeps, profile, 
+    shared.attachMcp((peerSkew) => createMcpServer(peerSkew === undefined
+        ? effectiveDeps
+        : { ...effectiveDeps, peerSkew: connectionSkew(peerSkew) }, profile, 
     // See the sibling call in `start`: a live session outweighs empty/stale durable memory (#1138).
     bridge.sessions.count() > 0 ||
         hasAnyProjectConnectedBefore(reticleStateHome(), port, projectIdsAt(process.cwd()))));

package/dist/judgement/capsule/capsule-store.d.ts

@@ -42,10 +42,10 @@ declare const CapsuleSchema: z.ZodObject<{
     seen: z.ZodOptional<z.ZodNumber>;
     lastSeenAt: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    expected: string;
-    origin: string;
     version: 1;
     id: string;
+    origin: string;
+    expected: string;
     steps: FlowStep[];
     createdAt: number;
     observed: string;
@@ -53,10 +53,10 @@ declare const CapsuleSchema: z.ZodObject<{
     seen?: number | undefined;
     lastSeenAt?: number | undefined;
 }, {
-    expected: string;
-    origin: string;
     version: 1;
     id: string;
+    origin: string;
+    expected: string;
     steps: FlowStep[];
     createdAt: number;
     observed: string;

package/dist/memory/cloud/sync-cycle.d.ts

@@ -75,6 +75,15 @@ export interface CloudSyncState {
      * fills the gap the server declared and never overrides the server on a question it answered.
      */
     sentRunIds?: string[];
+    /**
+     * The content hash of each run as the server last ACCEPTED it, for the runs still held locally.
+     *
+     * A run is not immutable: a session's live drive run is rewritten after every verdict under the
+     * same id. Sending by id alone delivered its first version and never the rest, so the server held
+     * a tab's first few verdicts and none after. The server upserts a run by id, so a changed run is
+     * simply sent again; this is how the machine tells a changed run from one it already delivered.
+     */
+    sentRunHashes?: Record<string, string>;
     /**
      * Runs the server refused, by run id: its reason, and the two things that could change the answer
      * (a hash of the run file, and of what the platform said it reads). A refused run is not offered

package/dist/memory/cloud/sync-cycle.js

@@ -92,6 +92,16 @@ function partResult(body, part) {
  * Split runs into requests bounded by count and by serialized size. A run bigger than the byte
  * bound on its own still goes, alone: it cannot be split, and holding it back would hide it.
  */
+/** The delivery record, kept only for the runs still on disk — the same bound as `sentRunIds`. */
+function heldHashes(runs, recorded) {
+    const out = {};
+    for (const { runId } of runs) {
+        const hash = recorded[runId];
+        if (hash !== undefined)
+            out[runId] = hash;
+    }
+    return out;
+}
 function batchRuns(runs) {
     const batches = [];
     let current = [];
@@ -194,8 +204,21 @@ export async function runSyncCycle(deps) {
         const priorRefusals = isRecord(deps.state.refusedRuns) ? deps.state.refusedRuns : {};
         const refusedRuns = {};
         const notRetried = [];
+        // Same rule as every record read from disk: only a string can equal a hash we computed.
+        const recorded = {};
+        if (isRecord(deps.state.sentRunHashes))
+            for (const [id, hash] of Object.entries(deps.state.sentRunHashes))
+                if ('string' === typeof hash)
+                    recorded[id] = hash;
+        /*
+         * Changed means no record, or a record that differs. No record has to count: a machine upgraded
+         * onto this can hold runs the server has only in an older version, and a tab that has closed
+         * never changes again to earn a re-send. So each such run is
+         * sent once and recorded, a one-time cost bounded by what retention keeps.
+         */
+        const delivered = (run) => known.has(run.runId) && recorded[run.runId] === hashPayload(run.payload);
         const unsent = allRuns.filter((run) => {
-            if (known.has(run.runId))
+            if (delivered(run))
                 return false;
             const prior = priorRefusals[run.runId];
             const unchanged = prior !== undefined &&
@@ -305,8 +328,10 @@ export async function runSyncCycle(deps) {
             const refusedHere = new Map(runs.rejected.map((r) => [r.index, r.reason]));
             batch.forEach((run, index) => {
                 const reason = refusedHere.get(index);
-                if (reason === undefined)
+                if (reason === undefined) {
                     known.add(run.runId);
+                    recorded[run.runId] = hashPayload(run.payload);
+                }
                 else
                     refusedRuns[run.runId] = { reason, payloadHash: hashPayload(run.payload), acceptsHash };
             });
@@ -369,6 +394,7 @@ export async function runSyncCycle(deps) {
         nextState.refusedSets = refusedSets;
         if (pushError !== undefined) {
             nextState.sentRunIds = allRuns.map((r) => r.runId).filter((id) => known.has(id));
+            nextState.sentRunHashes = heldHashes(allRuns, recorded);
             deps.sink.writeState({ ...nextState, lastError: pushError });
             return {
                 ...empty,
@@ -389,6 +415,7 @@ export async function runSyncCycle(deps) {
          * will never be attempted — so the record follows the artifacts and needs no number of its own.
          */
         nextState.sentRunIds = allRuns.map((r) => r.runId).filter((id) => known.has(id));
+        nextState.sentRunHashes = heldHashes(allRuns, recorded);
         // 3. COLLECT — always, even when there was nothing to send.
         const query = nextState.cursor === undefined ? '' : `?since=${encodeURIComponent(nextState.cursor)}`;
         const pull = await call(`${SYNC_PULL_PATH}${query}`);

package/dist/memory/intent/intent-tools.js

@@ -70,6 +70,8 @@ export const INTENT_TOOLS = [
                 })
                     .optional(),
             }))
+                // Non-empty in the schema too, so the advertised contract says what `declare` enforces.
+                .min(1)
                 .optional()
                 .describe('declare only. Batchable — declare every intent for a feature in one call.'),
             id: z.string().optional().describe('bind only: which intent the predicate proves.'),
@@ -153,9 +155,12 @@ export const INTENT_TOOLS = [
                 return { intents: await store.open() };
             }
             const raw = args['intents'];
-            const entries = Array.isArray(raw)
-                ? raw
-                : [];
+            // Refused, not read as an empty list: `declare` with nothing to declare stored nothing and
+            // answered `{ intents: [] }`, which an agent reads as a declaration that worked (#1118).
+            if (!Array.isArray(raw) || 0 === raw.length) {
+                throw new Error(`${ReticleTool.INTENT} declare: \`intents\` must be a non-empty array of { id, statement }, got ${raw === undefined ? 'nothing' : JSON.stringify(raw)} — nothing was stored`);
+            }
+            const entries = raw;
             const declared = await store.declare(entries);
             // Said, not swallowed: an agent that declared something and finds nothing stored would
             // otherwise conclude the ledger lost it.

package/dist/memory/journal/envelope.d.ts

@@ -101,13 +101,13 @@ export declare const RouteEnvelopeSchema: z.ZodObject<{
             max: number;
         }>;
     }, "strip", z.ZodTypeAny, {
-        durationMs: {
+        net: {
             count: number;
             mean: number;
             m2: number;
             max: number;
         };
-        net: {
+        durationMs: {
             count: number;
             mean: number;
             m2: number;
@@ -126,13 +126,13 @@ export declare const RouteEnvelopeSchema: z.ZodObject<{
             max: number;
         };
     }, {
-        durationMs: {
+        net: {
             count: number;
             mean: number;
             m2: number;
             max: number;
         };
-        net: {
+        durationMs: {
             count: number;
             mean: number;
             m2: number;
@@ -155,13 +155,13 @@ export declare const RouteEnvelopeSchema: z.ZodObject<{
     route: string;
     samples: number;
     stats: {
-        durationMs: {
+        net: {
             count: number;
             mean: number;
             m2: number;
             max: number;
         };
-        net: {
+        durationMs: {
             count: number;
             mean: number;
             m2: number;
@@ -184,13 +184,13 @@ export declare const RouteEnvelopeSchema: z.ZodObject<{
     route: string;
     samples: number;
     stats: {
-        durationMs: {
+        net: {
             count: number;
             mean: number;
             m2: number;
             max: number;
         };
-        net: {
+        durationMs: {
             count: number;
             mean: number;
             m2: number;

package/dist/memory/journal/journal-query.d.ts

@@ -62,5 +62,19 @@ export declare function readQueryEvents(reader: JournalReader | undefined, buffe
  * "nothing was lost" — see `JournalReader.readWriteLoss`.
  */
 export declare function readJournalWriteLoss(reader: JournalReader | undefined, buffer: QueryBuffer): Promise<JournalWriteLoss | undefined>;
+/** The slice of the ring buffer `windowLost` reads. `RingBuffer` satisfies it structurally. */
+export interface LossBuffer {
+    lostSince(cursor: number): boolean;
+}
+/**
+ * Did the EVENT STORE lose scarce evidence from a window opened at `cursor`? The input to whether a
+ * verdict's capture was clean — see `RingBuffer.lostSince`, and never the raw drop counter, which
+ * moves for the age and churn evictions that every live page produces continuously. The journal is
+ * the other half of that store, so a durable read that could not reach back to `cursor` lost
+ * exactly what an eviction would have. Both boundaries are INCLUSIVE (`t` is a millisecond many
+ * records share) and an absent `lostThroughT` impeaches every window rather than none — the
+ * conservative direction, both times.
+ */
+export declare function windowLost(reader: JournalReader | undefined, buffer: LossBuffer, cursor: number): boolean;
 /** Apply since/until/actionId bounds to an event list. */
 export declare function filterEvents(events: readonly ReticleEvent[], options: EventQueryOptions): ReticleEvent[];

package/dist/memory/journal/journal-query.js

@@ -90,6 +90,21 @@ export async function readJournalWriteLoss(reader, buffer) {
         return undefined;
     return (await reader?.readWriteLoss?.()) ?? undefined;
 }
+/**
+ * Did the EVENT STORE lose scarce evidence from a window opened at `cursor`? The input to whether a
+ * verdict's capture was clean — see `RingBuffer.lostSince`, and never the raw drop counter, which
+ * moves for the age and churn evictions that every live page produces continuously. The journal is
+ * the other half of that store, so a durable read that could not reach back to `cursor` lost
+ * exactly what an eviction would have. Both boundaries are INCLUSIVE (`t` is a millisecond many
+ * records share) and an absent `lostThroughT` impeaches every window rather than none — the
+ * conservative direction, both times.
+ */
+export function windowLost(reader, buffer, cursor) {
+    if (buffer.lostSince(cursor))
+        return true;
+    const lost = reader?.readLoss?.();
+    return lost !== undefined && (lost.lostThroughT === undefined || lost.lostThroughT >= cursor);
+}
 /** Apply since/until/actionId bounds to an event list. */
 export function filterEvents(events, options) {
     return events.filter((event) => (options.since === undefined || event.t >= options.since) &&

package/dist/memory/project/artifact-root-resolver.d.ts

@@ -1,3 +1,13 @@
 import { type ProjectId } from '@reticlehq/core';
 import { type ArtifactRoot } from './artifact-root.js';
+/**
+ * The directory of the project a page announced, or undefined when this machine does not know it.
+ *
+ * A daemon is shared: started from `$HOME`, a monorepo root, or another project's MCP client, its
+ * cwd is often not the app that sent the HELLO. The version-skew remedy read `package.json` from
+ * cwd anyway, so it fell back to the generic sensor package and told a Next.js project to install
+ * `@reticlehq/browser` (#1135). This is the same lookup the artifact root uses, keyed by the page's
+ * own project id.
+ */
+export declare function projectDirectoryFor(projectId: string | undefined): string | undefined;
 export declare function artifactRootResolver(daemonRoot: string): (projectId: ProjectId | undefined, origin?: string) => ArtifactRoot;