@reticlehq/server 3.6.0 → 3.7.0

package/dist/index.d.ts

@@ -75,6 +75,7 @@ export interface RunningServer {
     close: () => Promise<void>;
 }
 export { resolveBridgeSecurity } from './portal/bridge/bridge-security.js';
+/** Start the Reticle bridge (browser WS endpoint) and, by default, the MCP stdio server. */
 export declare function start(options?: StartOptions): Promise<RunningServer>;
 /**
  * Start the Reticle bridge in daemon mode: a single HTTP server handles both the WebSocket

package/dist/index.js

@@ -1,29 +1,25 @@
 import { applyHarnessSwitch, harnessConfigsByRoot } from './memory/cloud/harness-config.js';
 import { coveragePercents } from './features/exhaust/ledger.js';
-import { firstRunWiring } from './portal/session/first-run-wiring.js';
-import { fetchPlatformConfig } from './features/harness/platform-config.js';
-import { watchAccountFiles } from './memory/impact/account-watch.js';
+import { agentWiring } from './portal/session/zero-install-first-call.js';
+import { pushIfMoved, watchAccountFiles } from './memory/impact/account-watch.js';
 import { SESSION_FILE } from './command/cli/cloud-kit.js';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { linkedCloudPort, platformEnvPort, sessionCloudPort } from './memory/cloud/cloud-config.js';
+import { linkedCloudPort, sessionCloudPort } from './memory/cloud/cloud-config.js';
 import { sessionRoot } from './memory/project/session-root.js';
 import { attachCloudSync } from './memory/cloud/sync-daemon.js';
 import { wireHooks } from './hooks/hook-commands.js';
 import { currentDrivenBy } from './hooks/driven-by.js';
-import { artifactRootResolver, knownProjectCandidates, projectDirectoryFor, } from './memory/project/artifact-root-resolver.js';
+import { artifactRootResolver } from './memory/project/artifact-root-resolver.js';
 import { servingDirectoryOf } from './portal/session/serving-directory.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { AGENT_STOPPED_NOTICE, RETICLE_DEFAULT_PORT, bridgeWsUrl, ReticleCommand, ReticleDir, ReticleEnv, LOOPBACK_HOST, EventType, } from '@reticlehq/core';
-import { originOf } from './portal/session/session-manager.js';
-import { setBrowserMode, BrowserMode } from './telemetry/browser-mode.js';
+import { AGENT_STOPPED_NOTICE, RETICLE_DEFAULT_PORT, ReticleCommand, ReticleDir, ReticleEnv, LOOPBACK_HOST, } from '@reticlehq/core';
 import { replayFromHud } from './language/flows/replay-from-hud.js';
 import { createSharedServer } from './surface/http-server.js';
 import { openLoopbackAlias } from './command/daemon/binding/loopback-alias.js';
 import { reportAppInstrumented } from './telemetry/app-instrumented.js';
 import { resolveBridgeSecurityWithAutoToken } from './portal/bridge/bridge-security.js';
 import { Bridge } from './portal/bridge/bridge.js';
-import { sdkFixForDirectory } from './command/version/sdk-fix.js';
 import { connectionSkew } from './command/version/version-nudge.js';
 import { SERVER_VERSION } from './command/version/identity/server-version.js';
 import { BaselineStore } from './memory/project/baselines.js';
@@ -45,27 +41,22 @@ import { startVerifyServer } from './judgement/runs/verify-server.js';
 import { createMcpServer } from './surface/mcp/mcp.js';
 import { instructionStateAt } from './surface/mcp/mcp-proxy.js';
 import { LEASE_ACQUIRE_TOOL } from './surface/tools/lease-tools.js';
-import { startChatDrives } from './surface/tools/chat-drives.js';
+import { attachHudHarness, projectLinkOnly, startChatDrives } from './surface/tools/chat-drives.js';
 import { runTool } from './surface/tools/invoke-tool.js';
 import { SessionReaper, endAllSessions, MCP_DISCONNECT_SUMMARY, } from './portal/session/session-reaper.js';
 import { wireSessionScope } from './portal/session/no-session-watch.js';
 import { buildIdlePredicate, noteSetupHold } from './command/daemon/lifetime/daemon-usefulness.js';
 import { resolveToolSurface } from './surface/tools/tool-surface.js';
 import { statusPayload } from './status-payload.js';
-import { CdpRealInputProvider, LaunchedRealInputProvider } from './portal/input/real-input.js';
-import { cpus } from 'node:os';
-import { BrowserPool } from './portal/pool/browser-pool.js';
 import { AGENT_ALREADY_DRIVING_ELSEWHERE, shouldGreetWithLeaseNotice, } from './portal/session/lease-visibility.js';
-import { playwrightLauncher, resolveMaxContexts } from './portal/pool/playwright-launcher.js';
 import { LeaseReaper } from './portal/pool/lease-reaper.js';
 import { findProjectConfig, readJournalEnabled, readProjectId, } from './command/cli/ports/resolve/cli-port.js';
 import { probeLaunchableChromium } from './launch-chromium.js';
 import { attachJournal } from './wire-journal.js';
 import { reportOnboardingStep } from './telemetry/onboarding-funnel.js';
-import { AMBIENT_RECORDING } from './language/flows/recording/tape/recordings.js';
 import { readRetainPolicy } from './memory/journal/on-disk/retain-policy.js';
 import { log } from './log.js';
-import { readReaderBundle, zeroInstallScript as zeroInstallScriptFor, } from './portal/pool/zero-install.js';
+import { createBrowserPool, knownProjectRoots, loadHarnessConfig, makeNetworkDetailRouter, platformEnvFor, readerConnect, resolveRealInput, sdkFixForProject, } from './start-wiring.js';
 export { replayVerdictLine } from './language/flows/replay-from-hud.js';
 // Re-exported from the contract, where the names now live: a consumer importing the server should
 // not have to know that the vocabulary moved.
@@ -108,153 +99,7 @@ export { findContradictions } from '@reticlehq/engine/disagreement/contradiction
 /** Default localhost port for the verify HTTP endpoint (see docs/platform-integration.md). */
 export const RETICLE_VERIFY_DEFAULT_PORT = 7331;
 export { resolveBridgeSecurity } from './portal/bridge/bridge-security.js';
-/**
- * Build the shared browser pool (one headless Chromium, N capped isolated leased contexts). Lazy —
- * no Chromium launches until the first lease — so creating it is free even when never used.
- */
-/** Where the zero-install reader connects: this daemon's own bridge, with its pairing token. */
-function readerConnect(port, token) {
-    return { url: bridgeWsUrl(port), ...(token === undefined ? {} : { token }) };
-}
-function createBrowserPool(headless, reader) {
-    const maxContexts = resolveMaxContexts(process.env[ReticleEnv.MAX_CONTEXTS], cpus().length);
-    const genSessionId = () => `lease-${'function' === typeof globalThis.crypto?.randomUUID
-        ? globalThis.crypto.randomUUID()
-        : String(Date.now())}`;
-    // Built on first use and kept: the page that needs it is one whose app never connected.
-    let script;
-    const zeroInstallScript = () => {
-        if (script === undefined) {
-            const bundle = readReaderBundle();
-            script = bundle === undefined ? null : zeroInstallScriptFor(bundle, reader);
-        }
-        return script ?? undefined;
-    };
-    return new BrowserPool(playwrightLauncher({ headless }), {
-        maxContexts,
-        genSessionId,
-        zeroInstallScript,
-        launchHeaded: playwrightLauncher({ headless: false }),
-    });
-}
-/**
- * Route CDP-authoritative network detail onto the driven session's journal.
- *
- * The page and the SDK session share an origin, so a NET_DETAIL is pushed to the matching connected
- * session. Shared by both entry points: `startDaemon` previously omitted it entirely, so on the path
- * users actually take, CDP network detail was collected and then dropped on the floor.
- */
-function makeNetworkDetailRouter(bridge, driveUrl) {
-    const driveOrigin = originOf(driveUrl ?? '');
-    return (detail) => {
-        // Route by the DOCUMENT that issued the request, not by the request's own origin.
-        //
-        // Matching the request's origin only works for same-origin calls. An app on one origin calling an
-        // API on another — most API calls — produced a detail matching no session, and it was dropped
-        // without a trace. The drive-URL fallback papered over it on the launched path and did nothing on
-        // the CDP-attach path, where driveUrl is undefined and the fallback compares against ''.
-        const pageOrigin = originOf(detail.pageUrl ?? '');
-        const requestOrigin = originOf(detail.url);
-        for (const session of bridge.sessions.all()) {
-            const origin = originOf(session.url);
-            // originOf returns `string | undefined`, NEVER '' — so the old `!== ''` guards were dead, and a
-            // bare `origin === requestOrigin` matched `undefined === undefined` when BOTH the session URL and
-            // the detail URL were unparseable. That routed a NET_DETAIL (with its response headers, incl.
-            // set-cookie) onto an unrelated session. Require a DEFINED origin; undefined operands then simply
-            // fail to match any of the three candidates.
-            const matches = origin !== undefined &&
-                (origin === pageOrigin || origin === requestOrigin || origin === driveOrigin);
-            if (matches) {
-                session.pushEvent({
-                    t: 0,
-                    type: EventType.NET_DETAIL,
-                    sessionId: session.id,
-                    data: { ...detail },
-                });
-            }
-        }
-    };
-}
-/**
- * Resolve the drive/real-input provider from options — shared by start and startDaemon so the
- * precedence (driveUrl launch+own → CDP attach → none) and the storageState/injectConnect plumbing
- * live in ONE place. `onNavigateError` is the entrypoint's own cleanup (close the bridge/shared server)
- * so a failed launch never leaks a WS port. A past divergence between the two paths let daemon mode
- * run with a different setup — this removes that risk.
- */
-async function resolveRealInput(options, onNavigateError, onNetworkDetail) {
-    const driveUrl = options.driveUrl;
-    if (driveUrl !== undefined && driveUrl.length > 0) {
-        const headless = options.headless ?? true;
-        // The one place that knows. Everything downstream reads it rather than re-deriving it, and a
-        // daemon that launches nothing keeps the default (ATTACHED) rather than guessing.
-        setBrowserMode(headless ? BrowserMode.HEADLESS : BrowserMode.HEADED);
-        const injectConnect = options.injectConnect;
-        const storageState = options.storageState;
-        const factory = options.realInputFactory ??
-            ((opts) => new LaunchedRealInputProvider({
-                driveUrl: opts.driveUrl,
-                headless: opts.headless,
-                ...(injectConnect !== undefined ? { injectConnect } : {}),
-                ...(storageState !== undefined ? { storageState } : {}),
-                ...(onNetworkDetail !== undefined ? { onNetworkDetail } : {}),
-            }));
-        const launched = factory({ driveUrl, headless });
-        try {
-            await launched.navigate();
-        }
-        catch (error) {
-            await onNavigateError(); // no leaked WS port on a failed start
-            throw error;
-        }
-        return { realInput: launched, owned: launched };
-    }
-    const cdpUrl = options.cdpUrl ?? process.env[ReticleEnv.CDP_URL];
-    if (cdpUrl !== undefined && cdpUrl.length > 0) {
-        // Same network sink as the launched path. Whether Reticle opened the browser or attached to one
-        // someone else opened has no bearing on whether it can read that browser's network.
-        const cdp = new CdpRealInputProvider({
-            cdpUrl,
-            ...(onNetworkDetail !== undefined ? { onNetworkDetail } : {}),
-        });
-        return { realInput: cdp, owned: cdp };
-    }
-    return {};
-}
 /** Start the Reticle bridge (browser WS endpoint) and, by default, the MCP stdio server. */
-/**
- * The SDK-upgrade sentence for the package.json of the project the page announced, evaluated at
- * each HELLO so a just-edited manifest is what we name. The daemon's cwd only when that project's
- * directory is unknown, and the framework-neutral sensor when that is not an app either (#1135).
- */
-function sdkFixForProject(projectId) {
-    return sdkFixForDirectory(SERVER_VERSION, projectDirectoryFor(projectId) ?? process.cwd());
-}
-/**
- * Resolve a session's artifact root, from everything this machine knows about where projects live.
- *
- * Built once per daemon and closed over by every tool call. The two sources are read lazily and
- * cheaply on each call rather than snapshotted at startup: `init` can run in another terminal while
- * this daemon is up, and a resolution that used a startup snapshot would keep answering with a map
- * from before the project the agent is now driving existed.
- */
-/**
- * Every `.reticle` root on this machine that sync should consider, from the same two sources the
- * artifact resolver uses.
- *
- * Read on every call rather than snapshotted, for the same reason: `reticle link` can run in
- * another terminal while this daemon is up, and a startup snapshot would keep that repo silent
- * until somebody restarted a process they have no reason to suspect.
- *
- * Returns directories that MIGHT be linked; the caller resolves each and skips the ones that are
- * not. Deciding that here would mean reading every cloud.json on every tick.
- */
-function knownProjectRoots() {
-    return [...new Set(knownProjectCandidates().map((c) => join(c.directory, ReticleDir.ROOT)))];
-}
-/** This project's platform credential (stored, else the env key), as the env the platform readers take. */
-const platformEnvFor = (root) => platformEnvPort(createNodeFileSystem(), root ?? join(process.cwd(), ReticleDir.ROOT), homedir(), process.env);
-const loadHarnessConfig = async (root) => fetchPlatformConfig(await platformEnvFor(root)());
 export async function start(options = {}) {
     const port = options.port ?? RETICLE_DEFAULT_PORT;
     const configForRoot = harnessConfigsByRoot(loadHarnessConfig);
@@ -309,7 +154,7 @@ export async function start(options = {}) {
             enabled: journalEnabled,
             retain,
             // Bound HERE, where the recorder is already in hand: teardown gets the tape, not the recorder.
-            takeAmbientTape: () => recordings.stop(AMBIENT_RECORDING),
+            takeAmbientTape: (sessionId) => recordings.takeAmbient(sessionId),
             reportStep: reportOnboardingStep,
             flows,
             author: flowAuthor,
@@ -423,11 +268,11 @@ export async function startDaemon(options = {}) {
         sdkFix: sdkFixForProject,
         ...security,
     });
-    const repaint = (only) => {
+    const repaint = (only, ifChanged = false) => {
         for (const session of bridge.sessions.all()) {
             const root = session.artifactRoot ?? options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT);
-            if (only === undefined || only === root)
-                session.pushImpact(() => impactSnapshot(root), true);
+            if ((only ?? root) === root)
+                pushIfMoved(session, () => impactSnapshot(root), ifChanged);
         }
     };
     pushHarnessConfig = repaint;
@@ -446,7 +291,7 @@ export async function startDaemon(options = {}) {
         // `init` holds the daemon it is waiting on, so the idle rule cannot shut it down mid-wait.
         if (held)
             noteSetupHold(Date.now());
-        return statusPayload(bridge.sessions.count(), bridge.sessions.list(), bridge.sessions.noSessionHint(), verifyHttp?.port, bridge.sessions.noSessionLead());
+        return statusPayload(bridge.sessions.count(), bridge.sessions.list(), bridge.sessions.noSessionHint(), verifyHttp?.port, bridge.sessions.noSessionLead(), bridge.sessions.all());
     });
     // Agent-independent presence: the daemon outlives any single agent, so when the LAST agent's MCP
     // connection drops (it stopped, or is waiting on the human), end every session and push a clear
@@ -469,7 +314,8 @@ export async function startDaemon(options = {}) {
     const retain = readRetainPolicy(findProjectConfig(process.cwd()));
     // See the sibling path: `retain.sessions: 0` stops the capture too, not only the sweep.
     const journalEnabled = readJournalEnabled(process.cwd(), process.env[ReticleEnv.JOURNAL]) && 0 < retain.sessions;
-    const flows = new FlowStore(fs, reticleRoot, { now });
+    // A saved flow wakes sync like a landed run: see FlowStore's `onWrote`.
+    const flows = new FlowStore(fs, reticleRoot, { now }, { onWrote: () => syncNudge.run?.() });
     // Built here rather than inside `deps` below, so teardown can save what a drive recorded. Both
     // paths pass the same pair — `daemon-parity.test.ts` is what keeps them from drifting apart.
     const recordings = new RecordingStore(() => currentDrivenBy() !== undefined);
@@ -481,12 +327,12 @@ export async function startDaemon(options = {}) {
      * setup ahead of session capture for the sake of one callback.
      */
     const syncNudge = {};
-    attachJournal(bridge, {
+    const endLiveSessions = attachJournal(bridge, {
         fs,
         reticleRoot,
         enabled: journalEnabled,
         retain,
-        takeAmbientTape: () => recordings.stop(AMBIENT_RECORDING),
+        takeAmbientTape: (sessionId) => recordings.takeAmbient(sessionId),
         reportStep: reportOnboardingStep,
         flows,
         author: flowAuthor,
@@ -522,20 +368,15 @@ export async function startDaemon(options = {}) {
         otherRoots: knownProjectRoots,
     });
     syncNudge.run = () => cloudSync.nudge();
-    // `syncNow`, not `nudge`: a nudge schedules a cycle soon, which is right for "a run landed" and
-    // wrong for a button somebody is watching. Never awaited.
+    // `syncNow`, not `nudge` (a cycle soon): somebody is watching the button. Never awaited.
     bridge.attachSyncRequest(() => void cloudSync.syncNow());
-    // The panel's harness switch, written through to the platform so console and panel cannot disagree.
     if (options.hudSignIn !== undefined)
-        bridge.attachSigninRequest(options.hudSignIn(() => repaint()));
-    // logout and link run in another process: repaint when their files change. See account-watch.ts.
-    const accountFiles = watchAccountFiles(() => repaint());
+        bridge.attachSigninRequest(options.hudSignIn(repaint, projectLinkOnly(options.hudLink)));
+    // Logout and link run in another process: repaint when their files change, the rest on a timer.
+    const accountFiles = watchAccountFiles(repaint, undefined, () => repaint(undefined, true));
     accountFiles.watch(join(homedir(), ReticleDir.ROOT, SESSION_FILE));
     bridge.attachSessionReady((s) => accountFiles.watch(join(s.artifactRoot ?? reticleRoot, ReticleDir.CLOUD_LINK_FILE)));
-    bridge.attachHarnessRequest((on, s) => {
-        const root = s.artifactRoot ?? reticleRoot;
-        applyHarnessSwitch(configForRoot, root, on, platformEnvFor(root));
-    });
+    attachHudHarness(bridge, { deps: () => deps, root: reticleRoot, repaint: () => repaint() }, (r, on) => applyHarnessSwitch(configForRoot, r, on, platformEnvFor(r)), options.hudLink);
     // Scope auto-selection to the active project (from .reticle.json) so a stray tab from another app is
     // never picked when the agent omits a sessionId. Explicit per-call scope/sessionId still overrides.
     // Scope + the no-session diagnosis: "no browser session connected" is the error that ends most
@@ -544,6 +385,7 @@ export async function startDaemon(options = {}) {
     // server for a wired project (see no-session-watch.ts), and it opens it through the pool — the same
     // path reticle_lease takes, in this process, binding nothing.
     wireSessionScope(bridge.sessions, readProjectId(process.cwd()), port, (sessionId) => pool.wasReapedLease(sessionId), (url) => pool.acquire(url));
+    const leaseUrl = (url) => runTool(LEASE_ACQUIRE_TOOL, effectiveDeps, { url });
     const deps = {
         sessions: bridge.sessions,
         pool,
@@ -568,7 +410,7 @@ export async function startDaemon(options = {}) {
         now,
         bridgePort: port,
         browserProbe: probeLaunchableChromium,
-        firstRun: firstRunWiring({ port, cliPath: process.argv[1] ?? '' }),
+        ...agentWiring(port, bridge.sessions, leaseUrl),
         // A finished verification should not sit behind a one-minute timer — see ToolDeps.onRunPersisted.
         onRunPersisted: () => cloudSync.nudge(),
         syncNow: () => cloudSync.syncNow(),
@@ -580,12 +422,12 @@ export async function startDaemon(options = {}) {
     shared.attachMcp((peerSkew) => createMcpServer(peerSkew === undefined
         ? effectiveDeps
         : { ...effectiveDeps, peerSkew: connectionSkew(peerSkew) }, profile, instructionStateAt(port, bridge.sessions.count())));
-    // `reticle drive <url>` against this daemon's port, through runTool. See cli/drive/drive-attach.ts.
-    shared.attachDrive((url) => runTool(LEASE_ACQUIRE_TOOL, effectiveDeps, { url }));
+    shared.attachDrive(leaseUrl); // `reticle drive <url>` — see cli/drive/drive-attach.ts.
     // The platform chat's apps and drives, run here. See chat-drives.ts.
     const chatDrives = startChatDrives(effectiveDeps, bridge.sessions, fs, {
         sessionCloud: sessionCloudPort(fs, homedir(), process.env, (id) => sessionRoot(effectiveDeps, id)),
         version: SERVER_VERSION,
+        unsynced: () => cloudSync.unsyncedRoots(),
     }, log);
     // Optional OEM/CI verify endpoint: a host platform POSTs to /verify and gets an ReticleVerificationRun,
     // driving the same flow-replay machinery the agent uses — no MCP stdio, no human. Each verdict is
@@ -678,6 +520,7 @@ export async function startDaemon(options = {}) {
             leaseReaper.stop();
             chatDrives.stop();
             accountFiles.close();
+            await endLiveSessions(); // first: an open tab's teardown writes the flow this flush sends
             await cloudSync.flush(); // not stop(): the last run written is the one nobody has yet
             await loopbackAlias.close?.();
             await pool.shutdown();

package/dist/judgement/capsule/capsule-store.d.ts

@@ -45,9 +45,9 @@ declare const CapsuleSchema: z.ZodObject<{
     version: 1;
     id: string;
     origin: string;
+    createdAt: number;
     expected: string;
     steps: FlowStep[];
-    createdAt: number;
     observed: string;
     flow?: string | undefined;
     seen?: number | undefined;
@@ -56,9 +56,9 @@ declare const CapsuleSchema: z.ZodObject<{
     version: 1;
     id: string;
     origin: string;
+    createdAt: number;
     expected: string;
     steps: FlowStep[];
-    createdAt: number;
     observed: string;
     flow?: string | undefined;
     seen?: number | undefined;

package/dist/judgement/capsule/causal-summary.d.ts

@@ -40,10 +40,24 @@ export interface CausalSummary {
         headline?: string;
     };
     consoleErrors: number;
+    /** The first console error's text, capped — so a count is never the only thing an agent can read. */
+    firstConsoleError?: string;
+    /**
+     * The app's requests in this window as `METHOD /path STATUS` (`pending` when unanswered), capped.
+     * Origin and query string are left out: the line is for recognising the call, and the full record is
+     * one `reticle_observe { since }` away. Present only when there were any.
+     */
+    requests?: string[];
     statePathsChanged: string[];
     storageKeysChanged: string[];
     /** Before→after for each changed store path — the diffs, not just the names. Values capped. */
     stateDiffs: StateDiff[];
+    /**
+     * How many store diffs were left out of `stateDiffs` because they moved only a cache's own
+     * bookkeeping (fetchStatus, isStale, dataUpdatedAt — see engine's state-bookkeeping rule). Present
+     * only when there were any: a trim is never silent. Predicates still see every transition.
+     */
+    ignoredBookkeeping?: number;
     /**
      * How long the store took to stop moving: last state change − first, in ms. Present only when more
      * than one path changed, because with a single change there is no interval to describe.
@@ -126,6 +140,6 @@ interface SummaryContext {
  */
 export declare const MAX_SUMMARY_ENTRIES = 20;
 /** The lists that are capped, named so `elided` can say which one lost entries. */
-type CappedList = 'statePathsChanged' | 'storageKeysChanged' | 'stateDiffs' | 'storageDiffs' | 'signals' | 'fieldsChanged';
+type CappedList = 'requests' | 'statePathsChanged' | 'storageKeysChanged' | 'stateDiffs' | 'storageDiffs' | 'signals' | 'fieldsChanged';
 export declare function causalSummary(events: readonly ReticleEvent[], context?: SummaryContext): CausalSummary;
 export {};

package/dist/judgement/capsule/causal-summary.js

@@ -1,5 +1,6 @@
 import { EventType, PerfMetric, isDevToolingUrl } from '@reticlehq/core';
 import { routeOfEvent } from '@reticlehq/engine/question/predicate/predicate-route.js';
+import { isCacheBookkeepingDiff } from '@reticlehq/engine/evidence/state-bookkeeping.js';
 /**
  * THE INVARIANT: every field of this summary has a bounded size that does not depend on how much the
  * app did. A verdict travels in the same payload as its evidence, so an unbounded evidence field is
@@ -57,12 +58,34 @@ function stateSettle(diffs) {
     const spread = Math.max(...times) - Math.min(...times);
     return spread > 0 ? { stateSettleMs: spread } : {};
 }
+/** `METHOD /path STATUS` — what an agent recognises a call by. */
+function requestLine(data) {
+    const raw = 'string' === typeof data['url'] ? data['url'] : '';
+    let path;
+    try {
+        path = new URL(raw, 'http://local.invalid').pathname;
+    }
+    catch {
+        path = raw.split('?')[0] ?? raw;
+    }
+    const method = 'string' === typeof data['method'] ? data['method'].toUpperCase() : 'GET';
+    const status = 'number' === typeof data['status'] ? String(data['status']) : 'pending';
+    return `${method} ${path} ${status}`;
+}
+/** The first line of a console error, capped. */
+function firstLine(data) {
+    const text = ['message', 'text', 'error'].map((k) => data[k]).find((v) => 'string' === typeof v);
+    const line = ('string' === typeof text ? text : 'console error').split('\n')[0] ?? '';
+    return truncate(line);
+}
 export function causalSummary(events, context = {}) {
     let netTotal = 0;
     let netErrors = 0;
     let ignoredDevTooling = 0;
     let headline;
     let consoleErrors = 0;
+    let firstConsoleError;
+    const requests = [];
     const statePathsChanged = [];
     const storageKeysChanged = [];
     const stateDiffs = [];
@@ -72,6 +95,7 @@ export function causalSummary(events, context = {}) {
     const fieldsChanged = [];
     let layoutShift;
     let longTasks = 0;
+    let ignoredBookkeeping = 0;
     for (const event of events) {
         const data = event.data;
         switch (event.type) {
@@ -82,6 +106,7 @@ export function causalSummary(events, context = {}) {
                 }
                 netTotal += 1;
                 const status = data['status'];
+                requests.push(requestLine(data));
                 const failed = false === data['ok'] || ('number' === typeof status && status >= 400);
                 if (failed) {
                     netErrors += 1;
@@ -93,6 +118,7 @@ export function causalSummary(events, context = {}) {
             case EventType.CONSOLE_ERROR:
             case EventType.ERROR_UNCAUGHT:
                 consoleErrors += 1;
+                firstConsoleError ??= firstLine(data);
                 break;
             case EventType.STATE_CHANGE: {
                 pushUnique(statePathsChanged, data['name']);
@@ -103,6 +129,10 @@ export function causalSummary(events, context = {}) {
                 const hasAfter = 'value' in data || 'new' in data;
                 if ('string' === typeof path && path.length > 0 && ('old' in data || hasAfter)) {
                     const after = 'value' in data ? data['value'] : data['new'];
+                    if (isCacheBookkeepingDiff(data['old'], after)) {
+                        ignoredBookkeeping += 1;
+                        break;
+                    }
                     stateDiffs.push({
                         path,
                         from: capValue(data['old']),
@@ -160,9 +190,12 @@ export function causalSummary(events, context = {}) {
             ...(headline === undefined ? {} : { headline }),
         },
         consoleErrors,
+        ...(firstConsoleError === undefined ? {} : { firstConsoleError }),
+        ...(0 === requests.length ? {} : { requests: cap(requests, 'requests', elided) }),
         statePathsChanged: cap(statePathsChanged, 'statePathsChanged', elided),
         storageKeysChanged: cap(storageKeysChanged, 'storageKeysChanged', elided),
         stateDiffs: cap(stateDiffs, 'stateDiffs', elided),
+        ...(0 === ignoredBookkeeping ? {} : { ignoredBookkeeping }),
         ...settle,
         storageDiffs: cap(storageDiffs, 'storageDiffs', elided),
         ...(route === undefined ? {} : { route }),

package/dist/judgement/runs/artifact/build-verification-run.d.ts

@@ -25,7 +25,7 @@ export type VerificationRunInput = Omit<ReticleVerificationRun, 'schemaVersion'
  * reason those two values now survive into the artifact instead of being dropped at its door.
  * Confidence: nothing ran → LOW; an oracle-backed flow or any check ran → HIGH; only smoke → MEDIUM.
  */
-export declare function computeVerdict(input: VerificationRunInput): RunVerdict;
+export declare function computeVerdict(raw: VerificationRunInput): RunVerdict;
 /**
  * Assemble the final, schema-valid ReticleVerificationRun. Stamps schemaVersion + createdAt (injected
  * clock) and computes the verdict; the result is parsed through the protocol schema so a malformed

package/dist/judgement/runs/artifact/build-verification-run.js

@@ -8,6 +8,7 @@
  */
 import { ReticleVerificationRunSchema, RUN_FILE_VERSION, Verified, RunConfidence, RunFlowStatus, VerdictStatus, } from '@reticlehq/core';
 import { redactForProfile } from './profile-redact.js';
+import { supersededChecks } from '@reticlehq/engine/evidence/superseded-checks.js';
 /**
  * Compute the verdict deterministically from the run's flows, checks, and risks.
  * Rules (in order): a gated risk blocks → FAIL; mixed pass+fail → PARTIAL; any fail → FAIL;
@@ -18,12 +19,23 @@ import { redactForProfile } from './profile-redact.js';
  * reason those two values now survive into the artifact instead of being dropped at its door.
  * Confidence: nothing ran → LOW; an oracle-backed flow or any check ran → HIGH; only smoke → MEDIUM.
  */
-export function computeVerdict(input) {
+export function computeVerdict(raw) {
+    // A passive check that read too early is superseded by the same claim holding later: the one
+    // rule every fold applies (superseded-checks.ts).
+    const superseded = supersededChecks(raw.checks.map((c) => ({
+        key: c.predicate,
+        passive: false === c.declaredBeforeActing,
+        held: Verified.YES === c.status,
+        failed: Verified.NO === c.status,
+    })));
+    const input = { ...raw, checks: raw.checks.filter((_, at) => !superseded.has(at)) };
     const passes = input.flows.filter((f) => f.status === RunFlowStatus.PASS || f.status === RunFlowStatus.HEALED)
         .length + input.checks.filter((c) => c.status === Verified.YES).length;
     const fails = input.flows.filter((f) => f.status === RunFlowStatus.FAIL).length +
         input.checks.filter((c) => c.status === Verified.NO).length;
     const skippedFlows = input.flows.filter((f) => f.status === RunFlowStatus.SKIPPED).length;
+    // Ran and decided nothing, as the agent's own result block counts them: never part of a pass.
+    const undecidedChecks = input.checks.filter((c) => c.status !== Verified.YES && c.status !== Verified.NO).length;
     const blockingRisks = input.risks.filter((r) => r.gated).length;
     const reasons = [];
     for (const f of input.flows) {
@@ -47,12 +59,16 @@ export function computeVerdict(input) {
     let status;
     if (blockingRisks > 0)
         status = VerdictStatus.FAIL;
-    else if (fails > 0 && passes > 0)
-        status = VerdictStatus.PARTIAL;
+    // A failure beside things that passed is a fail, not a partial: the result block, the CLI and the
+    // platform's grade all call it that, and a "partial" beside "Reticle result: failed" was one run
+    // with two verdicts. A partial is only ever a pass with something skipped or undecided beside it.
     else if (fails > 0)
         status = VerdictStatus.FAIL;
-    else if (skippedFlows > 0 && passes > 0)
+    else if ((skippedFlows > 0 || undecidedChecks > 0) && passes > 0) {
         status = VerdictStatus.PARTIAL;
+        if (0 < undecidedChecks)
+            reasons.push(`${String(undecidedChecks)} check(s) undecided`);
+    }
     else if (0 === passes) {
         // Nothing passed and nothing failed, so nothing was proved -- an empty run, or one whose every
         // flow was skipped. Reporting that as PASS is the false green this whole file exists to prevent:

package/dist/judgement/runs/artifact/gap-summary.d.ts

@@ -1,21 +1,3 @@
-/**
- * The gap, as a number the person who ran the session can see.
- *
- * Reticle's whole claim is that it measures the distance between what an agent believed happened
- * and what did. It measures that on every verdict, writes the answer into the journal, and shows it
- * to nobody: the counts exist, the reasons exist, the contradictions exist, and no surface anywhere
- * says "you made 14 claims, 9 held, 2 were false, 3 could not be decided, and here is who owns each
- * of those three". The value of the product is the one thing it never reports.
- *
- * A FOLD over the journal, never a second store — the rule `run-context.ts` next door states, for
- * the same reason: two ways to compute one number is worse than one way, because the day they
- * disagree the disagreement lands inside a verdict and a user finds it before we do.
- *
- * Nothing here sends anything anywhere, and that is deliberate rather than incidental. This is the
- * LOCAL half. Whether a fleet-wide version of the same number is worth collecting is a separate
- * decision with a separate owner, and building the local one first is what makes that decision
- * answerable from something other than a guess.
- */
 import { VerifiedReason, VerdictAttribution, type JournalAction } from '@reticlehq/core';
 /** One claim that did not hold, in the words it was made and the engine's reason for refusing it. */
 export interface GapFailure {

package/dist/judgement/runs/artifact/gap-summary.js

@@ -16,6 +16,7 @@
  * decision with a separate owner, and building the local one first is what makes that decision
  * answerable from something other than a guess.
  */
+import { supersededChecks } from '@reticlehq/engine/evidence/superseded-checks.js';
 import { JournalVerdictEffectSchema, Verified, VerifiedReason, VerdictAttribution, verdictAttributionOf, } from '@reticlehq/core';
 /**
  * The reason, as the engine's own enum, or undefined.
@@ -48,9 +49,17 @@ export function gapSummary(actions) {
         falseGreensCaught: 0,
         failures: [],
     };
-    for (const action of actions) {
-        const verdict = verdictOf(action);
-        if (verdict === undefined)
+    const verdicts = actions.map(verdictOf).filter((v) => v !== undefined);
+    // A passive check that read too early is not counted: the one rule every fold applies
+    // (superseded-checks.ts), so this block and the run's verdict cannot disagree.
+    const superseded = supersededChecks(verdicts.map((v) => ({
+        key: v.claim,
+        passive: false === v.declaredBeforeActing,
+        held: Verified.YES === v.verified,
+        failed: Verified.NO === v.verified,
+    })));
+    for (const [at, verdict] of verdicts.entries()) {
+        if (superseded.has(at))
             continue;
         summary.claims += 1;
         switch (verdict.verified) {