@reticlehq/server 3.9.0 → 3.10.0

package/dist/language/flows/flow-step-runners.js

@@ -9,25 +9,17 @@
 import { expectedElementTestid } from '@reticlehq/core';
 import { AnchorKind, DEGRADED_ANCHOR_ROLE, DOCUMENT_ANCHOR_ROLE, DriftReason, PredicateKind, QueryBy, ReplayStatus, ReticleCommand, } from '@reticlehq/core';
 import { ReticleTool, isGlobalPressCall } from '@reticlehq/core';
-import { replayActionArgs } from './replay.js';
-import { isStaleRefError } from '../../surface/tools/act/act-sequence-retry.js';
+import { namelessRefs, replayActionArgs } from './replay.js';
+import { burstGap, holdGap, isStaleRefError, pacedArgs, } from '../../surface/tools/act/act-sequence-retry.js';
 import { waitForReaction } from '../../surface/tools/act/react-grace.js';
-import { unreachableTargetNote } from '../../surface/tools/act/act-observation.js';
+import { unreachableSubStepDrift, unreachableTargetNote, } from '../../surface/tools/act/act-observation.js';
 import { anchorFieldName } from './flows.js';
-import { ambiguityDrift, refFor, anchorLabel, componentLabel, componentQueryArgs, expectElementDrift, queryOnce, reresolved, resolveQuery, testidDrift, } from './flow-anchor.js';
+import { ambiguityDrift, refFor, anchorLabel, componentLabel, componentQueryArgs, expectElementDrift, queryOnce, reresolved, resolveRoleAnchor, roleQueryArgs, resolveQuery, roleAnchorLabel, testidDrift, } from './flow-anchor.js';
 import { nearestRoleName } from './role-anchor-nearest.js';
 import { roleDriftReason } from '../../judgement/outcome/role-drift-reason.js';
+import { captureBaselines } from '@reticlehq/engine/evidence/baseline.js';
 /** The live act_sequence tool gives each step this transport budget when none was supplied. */
 export const DEFAULT_SEQUENCE_STEP_TIMEOUT_MS = 8_000;
-/** Query args for a NAMED role anchor — the handle that identifies an instance, not a JSX site. */
-function roleQueryArgs(anchor) {
-    return {
-        by: QueryBy.ROLE,
-        value: anchor.role,
-        ...(anchor.name === undefined ? {} : { name: anchor.name }),
-    };
-}
-/** Run one role+name-anchored step: re-resolve via QUERY by:'role', ACT on the live ref, else drift. */
 /**
  * The controls actually on the page, as role + name, for the nearest-match scan.
  *
@@ -36,8 +28,9 @@ function roleQueryArgs(anchor) {
  */
 async function nearestRoleNameOnPage(session, anchor) {
     const wanted = 'string' === typeof anchor.name ? anchor.name : undefined;
-    if (wanted === undefined)
+    if (wanted === undefined) {
         return null;
+    }
     try {
         // Straight off the QUERY result: resolveQuery reduces to refs, and the NAMES are what this needs.
         const result = await session.command(ReticleCommand.QUERY, {
@@ -48,8 +41,9 @@ async function nearestRoleNameOnPage(session, anchor) {
         const elements = 'object' === typeof payload && payload !== null
             ? payload.elements
             : undefined;
-        if (!Array.isArray(elements))
+        if (!Array.isArray(elements)) {
             return null;
+        }
         const candidates = elements
             .map((element) => 'object' === typeof element && element !== null
             ? element.name
@@ -64,27 +58,33 @@ async function nearestRoleNameOnPage(session, anchor) {
     }
 }
 export async function runRoleStep(session, step, index, anchor, confirmDangerous, sleep) {
-    const label = `${anchor.role} "${String(anchor.name)}"`;
-    const { refs } = await resolveQuery(session, roleQueryArgs(anchor), sleep);
+    const label = roleAnchorLabel(anchor);
+    const { refs } = await resolveRoleAnchor(session, anchor, sleep);
     /*
-     * More than one match is DRIFT, not a guess. This path took `refs[0]`, dispatched, and returned
-     * `ok: true`, so a flow recorded against "View result" on row 3 of a table replayed by clicking row
-     * 1 and PASSED whenever every row shared the consequence (the same GET returning 200). The verdict
-     * reads `drift` and `ok` and nothing else, so a green here is indistinguishable from a replay that
-     * did what it did before.
-     *
-     * A role+name anchor is MORE likely to land here than a testid is: `button "View result"` is
-     * user-visible text, and a table repeats it by nature, so several matches is the expected shape of
-     * a recorded row action rather than an accident.
-     *
-     * The check itself lives in `ambiguityDrift`, shared with the testid and component runners: written
-     * per-runner, this rule got applied to two anchor kinds and forgotten for the third.
+     * More than one match is DRIFT, not a guess: taking `refs[0]` replayed a recorded row action on
+     * row 1 and passed whenever every row shared the consequence. `ambiguityDrift` holds the rule,
+     * shared with the testid and component runners.
      */
     const ambiguous = ambiguityDrift(anchor, refs);
     if (ambiguous !== null) {
         return { step: index, tool: step.tool, anchor: label, ok: false, drift: ambiguous };
     }
     const ref = refFor(anchor, refs);
+    if (ref === undefined && anchor.name === undefined) {
+        // There is no name to suggest a nearest match from; say what was looked for and what was found.
+        return {
+            step: index,
+            tool: step.tool,
+            anchor: label,
+            ok: false,
+            drift: {
+                reasonKind: DriftReason.COMPONENT_NOT_FOUND,
+                reason: `no ${anchor.role} with no accessible name was found at the recorded position (${label}); the page has ${String(refs.length)} such control(s). Give the control an accessible name or a test id, or re-record the step`,
+                anchor: label,
+                nearest: null,
+            },
+        };
+    }
     if (ref === undefined) {
         // `nearest` used to be the literal null, so heal answered "no nearest match cleared the
         // confidence floor" for EVERY role-anchored drift — a structural limit reported as a judgement
@@ -115,7 +115,7 @@ export async function runRoleStep(session, step, index, anchor, confirmDangerous
      * re-make the guess the check above exists to refuse — one layer deeper, where the caller cannot
      * see it. `reresolved` is the same rule as that check, so the two cannot disagree.
      */
-    async () => reresolved(anchor, (await resolveQuery(session, roleQueryArgs(anchor), sleep)).refs));
+    async () => reresolved(anchor, (await resolveRoleAnchor(session, anchor, sleep)).refs));
 }
 /**
  * `assertActionAllowed`'s refusal — "potentially destructive action blocked; retry with
@@ -132,8 +132,9 @@ export async function runRoleStep(session, step, index, anchor, confirmDangerous
  */
 const DESTRUCTIVE_ACTION_PATTERN = /potentially destructive (?:\w+ )*(?:action|tool) blocked/i;
 function replayDestructiveActionHint(rawError) {
-    if (!DESTRUCTIVE_ACTION_PATTERN.test(rawError))
+    if (!DESTRUCTIVE_ACTION_PATTERN.test(rawError)) {
         return rawError;
+    }
     return (`${rawError} — this is a flow REPLAY: a step's own args.confirmDangerous is stripped before ` +
         'dispatch and never persists, so editing the flow file does nothing. Pass it at the call level ' +
         `instead: ${ReticleTool.FLOW_REPLAY} { confirmDangerous: true } acknowledges every flagged step ` +
@@ -211,15 +212,17 @@ reresolve) {
         if (fresh !== undefined && 'drift' in fresh) {
             return { step: index, tool: step.tool, anchor: label, ok: false, drift: fresh.drift };
         }
-        if (fresh !== undefined)
+        if (fresh !== undefined) {
             act = await dispatch(fresh.ref);
+        }
     }
     const result = { step: index, tool: step.tool, anchor: label, ok: act.ok };
-    if (!act.ok)
+    if (!act.ok) {
         result.error = replayDestructiveActionHint(act.error ?? 'command failed');
+    }
     // A click no person could have made decides nothing, on replay as on a live act.
     const unreachable = act.ok ? unreachableTargetNote(act.result) : undefined;
-    if (unreachable !== undefined)
+    if (unreachable !== undefined) {
         return {
             ...result,
             ok: false,
@@ -230,6 +233,7 @@ reresolve) {
                 nearest: null,
             },
         };
+    }
     return result;
 }
 /** How long to let the app finish re-rendering before the one retry. Matches the sequence path. */
@@ -266,7 +270,9 @@ export async function runComponentStep(session, step, index, anchor, confirmDang
     if (ambiguous !== null) {
         return { step: index, tool: step.tool, anchor: label, ok: false, drift: ambiguous };
     }
-    const ref = refs[0] ?? '';
+    // The only match, or the recorded position (`ambiguityDrift` has cleared every other case). It took
+    // `refs[0]`, so a recorded position that passed the check still acted on the first match.
+    const ref = refFor(anchor, refs) ?? '';
     // Shared with the role path so both get the same action window AND the same stale-ref retry —
     // this used to dispatch inline, which is how one anchor kind could gain a fix the other lacked.
     return await actOnResolvedRef(session, step, index, label, ref, confirmDangerous, anchorFieldName(anchor), 
@@ -340,10 +346,12 @@ export function degradedStepResult(step, index, label) {
  * the step runner's own resolution asking the same thing of the same anchor.
  */
 export function anchorQueryArgs(anchor) {
-    if (anchor.kind === AnchorKind.TESTID)
+    if (anchor.kind === AnchorKind.TESTID) {
         return { by: QueryBy.TESTID, value: anchor.value };
-    if (anchor.kind === AnchorKind.COMPONENT)
+    }
+    if (anchor.kind === AnchorKind.COMPONENT) {
         return componentQueryArgs(anchor);
+    }
     if (anchor.kind === AnchorKind.ROLE && !isDegradedAnchor(anchor) && !isDocumentAnchor(anchor)) {
         return roleQueryArgs(anchor);
     }
@@ -388,8 +396,9 @@ const staleTargetReason = (step) => `step ${String(step)} could not be acted on:
  */
 function staleSubStep(error, live, from, to) {
     const named = /ref '([^']*)'/.exec(error)?.[1];
-    if (named === undefined)
+    if (named === undefined) {
         return undefined;
+    }
     const sharing = live.flatMap((one, at) => at >= from && at < to && one.ref === named ? [at] : []);
     const [only] = sharing;
     return 1 === sharing.length ? only : undefined;
@@ -407,17 +416,27 @@ function staleSubStep(error, live, from, to) {
  * Left alone, so the ordinary verdict stands, when anything else is in the run: a drifted anchor is
  * drift whatever else happened, and a failure that is not staleness is a failure.
  */
-export function staleTargetResult(name, steps) {
+export function staleTargetResult(name, steps, 
+/**
+ * `startControlRequired`: replay loaded the start page itself, with no redirect, and the caller
+ * asked that a missing step 1 control fail. Then the miss means the app does not offer the control
+ * the journey starts with (#2061), so it stays drift. Without it, the miss is not proved.
+ */
+options = {}) {
     // A target no person could reach is the same kind of answer: nothing about the app was decided.
-    const unreachable = unreachableTargetResult(name, steps) ?? unreachedStepResult(name, steps);
-    if (unreachable !== undefined)
+    const unreached = true === options.startControlRequired ? undefined : unreachedStepResult(name, steps);
+    const unreachable = unreachableTargetResult(name, steps) ?? unreached;
+    if (unreachable !== undefined) {
         return unreachable;
-    if (steps.some((step) => step.drift !== undefined))
+    }
+    if (steps.some((step) => step.drift !== undefined)) {
         return undefined;
+    }
     const failed = steps.filter((step) => !step.ok);
     const [only] = failed;
-    if (failed.length !== 1 || only === undefined || !isStaleRefError(only.error))
+    if (failed.length !== 1 || only === undefined || !isStaleRefError(only.error)) {
         return undefined;
+    }
     return {
         name,
         status: ReplayStatus.UNVERIFIABLE,
@@ -433,8 +452,9 @@ export function staleTargetResult(name, steps) {
  */
 export function unreachableTargetResult(name, steps) {
     const step = steps.find((s) => DriftReason.TARGET_UNREACHABLE === s.drift?.reasonKind);
-    if (step?.drift === undefined)
+    if (step?.drift === undefined) {
         return undefined;
+    }
     return {
         name,
         status: ReplayStatus.UNVERIFIABLE,
@@ -456,7 +476,8 @@ const ANCHOR_MISSES = new Set([
  * FAIL, and the dashboard showed a failure for a journey that was never tested.
  *
  * Only when no earlier step ran. A control that is missing after earlier steps acted is on a page
- * those steps made, so it stays drift, and heal reads it. A step that acted and whose expectation
+ * those steps made, so it stays drift, and heal reads it. An ambiguous control is the exception: it
+ * is on the page, and the replay cannot choose, so it is not proved after any number of steps. A step that acted and whose expectation
  * did not hold is a consequence drift and stays a failure. The failing step keeps its index and
  * its `drift.reasonKind`, which the synced run carries in `stepResults`.
  */
@@ -464,14 +485,31 @@ function unreachedStepResult(name, steps) {
     const at = steps.findIndex((s) => !s.ok);
     const step = steps[at];
     const drift = step?.drift;
-    if (step === undefined || drift === undefined || !ANCHOR_MISSES.has(drift.reasonKind))
+    if (step === undefined || drift === undefined || !ANCHOR_MISSES.has(drift.reasonKind)) {
         return undefined;
-    if (steps.slice(0, at).some((s) => s.ok))
+    }
+    const acted = steps.slice(0, at).some((s) => s.ok);
+    // An anchor that several live elements match is on the page, so the earlier steps did not lose it.
+    // The replay cannot choose one, so nothing about the app was decided, whatever ran before.
+    if (DriftReason.ANCHOR_AMBIGUOUS === drift.reasonKind && acted) {
+        return {
+            name,
+            status: ReplayStatus.UNVERIFIABLE,
+            steps: [...steps],
+            unverifiable: {
+                reason: `step ${String(step.step + 1)}: ${drift.reason}. The replay stopped there, so this run ` +
+                    `proved nothing about the app. Narrow the anchor on this step.`,
+            },
+        };
+    }
+    if (acted) {
         return undefined;
+    }
     // ponytail: one close, unambiguous survivor reads as a rename (heal's case), so it stays drift. A
     // page with exactly one sibling of the missing control (`toggle-1` for `toggle-3`) reads the same.
-    if (drift.nearest !== null && true !== drift.ambiguous)
+    if (drift.nearest !== null && true !== drift.ambiguous) {
         return undefined;
+    }
     return {
         name,
         status: ReplayStatus.UNVERIFIABLE,
@@ -485,35 +523,40 @@ function unreachedStepResult(name, steps) {
 }
 /**
  * Run an act_sequence step: resolve every sub-step's OWN anchor, then dispatch the whole thing as one
- * ACT_SEQUENCE — the same shape `replayProgram` already uses, so a recorded sequence and a saved one
- * execute identically.
- *
- * `replayFlow` had no sequence branch at all. It dispatches on `anchor.kind`, so a saved sequence fell
- * to the testid runner and ran ONE act with `action: ''` (a saved sequence carries no top-level
- * action) — sub-steps 2..n never executed. Fixing the anchor without this would have turned a visible
- * drift into a silent partial replay reporting ok.
+ * ACT_SEQUENCE, the shape `replayProgram` uses, so a recorded sequence and a saved one run the same.
  */
 export async function runSequenceStep(session, step, index, subs, confirmDangerous, sleep, 
 /** Testids whose presence is deliberately NOT asserted — the LLM-output case. */
 dynamic = new Set(), 
-/**
- * Judge one sub-step's `expect` over the window from `since`, which opens just before that
- * sub-step's dispatch. Omitted for a setup step, whose consequences are not checked.
- */
+/** Judge a sub-step's `expect` from `since`, just before its dispatch, against the `before`
+ *  reading; omitted for a setup step, whose consequences are not checked. */
 judge) {
+    const gap = burstGap(step.burstMs);
+    let lastSent;
     /**
      * Find one sub-step's element as the page is NOW. Either the live step to dispatch, or the step
      * result that ends the run: a degraded anchor, or one that is no longer on the page.
      *
-     * `afterRerender` is the second look, taken because the page re-rendered under a sub-step. An anchor
-     * that now matches several elements is drift there, as it is for a single step's retry: the first of
-     * the new matches may be an element the recording did not mean, and acting on it would report a pass
-     * for a click nobody can attribute. The first look keeps taking the first match.
+     * An anchor that matches several elements is drift, on the first look and on the look after a
+     * re-render alike, as it is for a single step: the first match may be an element the recording did
+     * not mean, and acting on it reports a result for a click nobody can attribute.
      *
      * `ahead` is a look at a sub-step before its turn. It is one query with no settle. An anchor that is
      * not on the page yet is `pending`, not drift, because an earlier sub-step can render it.
      */
-    const resolveSub = async (sub, subIndex, afterRerender = false, ahead = false) => {
+    const lookUpSub = async (anchor, queryArgs, ahead) => {
+        const nameless = AnchorKind.ROLE === anchor.kind && anchor.name === undefined;
+        if (ahead) {
+            return nameless
+                ? { refs: namelessRefs(await session.command(ReticleCommand.QUERY, queryArgs)) }
+                : await queryOnce(session, queryArgs);
+        }
+        if (AnchorKind.ROLE === anchor.kind) {
+            return await resolveRoleAnchor(session, anchor, sleep);
+        }
+        return await resolveQuery(session, queryArgs, sleep);
+    };
+    const resolveSub = async (sub, subIndex, ahead = false) => {
         const label = `${anchorLabel(sub.anchor)} (sub-step ${String(subIndex)})`;
         if (isDocumentPressStep(sub)) {
             // Dispatched as it ran live, at the document with no ref (#1559).
@@ -521,24 +564,31 @@ judge) {
                 live: {
                     ref: '',
                     action: sub.action ?? '',
-                    args: replayActionArgs(sub.args, confirmDangerous, undefined),
+                    args: pacedArgs(replayActionArgs(sub.args, confirmDangerous, undefined), gap),
                 },
             };
         }
         const queryArgs = anchorQueryArgs(sub.anchor);
-        if (null === queryArgs)
+        if (null === queryArgs) {
             return { stop: degradedStepResult(step, index, label) };
-        const { refs, hint } = ahead
-            ? await queryOnce(session, queryArgs)
-            : await resolveQuery(session, queryArgs, sleep);
-        const ambiguous = afterRerender ? ambiguityDrift(sub.anchor, refs) : null;
+        }
+        // A role anchor is found as a single step finds it, a nameless one among the nameless controls
+        // of its role (#2084: querying every control sent a file upload to the first named button).
+        const { refs, hint } = await lookUpSub(sub.anchor, queryArgs, ahead);
+        // Several matches with no usable recorded position is drift on every look, as in the single-step
+        // runners. The first look used to take `refs[0]`: a click recorded on one item of a list (every
+        // item from one JSX line) replayed on another item and failed a correct app. A look ahead is not
+        // a verdict, and an earlier sub-step can still change what is on the page.
+        const ambiguous = ahead ? null : ambiguityDrift(sub.anchor, refs);
         if (ambiguous !== null) {
             return { stop: { step: index, tool: step.tool, anchor: label, ok: false, drift: ambiguous } };
         }
-        const ref = afterRerender ? refFor(sub.anchor, refs) : refs[0];
+        // The only match, or the recorded position while the page has exactly as many namesakes.
+        const ref = refFor(sub.anchor, refs);
         if (ref === undefined) {
-            if (ahead)
+            if (ahead) {
                 return { pending: true };
+            }
             return {
                 stop: {
                     step: index,
@@ -560,9 +610,8 @@ judge) {
             live: {
                 ref,
                 action: sub.action ?? '',
-                // Each sub-step carries its OWN anchor, so each gets its own field name. A sequence that ends
-                // in a login is the shape this was reported on, and the sub-step is where the fill lives.
-                args: replayActionArgs(sub.args, confirmDangerous, anchorFieldName(sub.anchor)),
+                // Each sub-step carries its OWN anchor, so each gets its own field name (a login's fill).
+                args: pacedArgs(replayActionArgs(sub.args, confirmDangerous, anchorFieldName(sub.anchor)), gap),
             },
         };
     };
@@ -580,13 +629,16 @@ judge) {
     const resolveFrom = async (from) => {
         for (let at = from; at < subs.length; at += 1) {
             const sub = subs[at];
-            if (sub === undefined)
+            if (sub === undefined) {
                 continue;
-            const resolved = await resolveSub(sub, at, false, at > from);
-            if ('pending' in resolved)
+            }
+            const resolved = await resolveSub(sub, at, at > from);
+            if ('pending' in resolved) {
                 return { end: at };
-            if ('stop' in resolved)
+            }
+            if ('stop' in resolved) {
                 return resolved;
+            }
             live[at] = resolved.live;
         }
         return { end: subs.length };
@@ -623,18 +675,20 @@ judge) {
      *
      * The page names the ref it could not find, which says WHICH sub-step failed and so which ones
      * already ran, as long as no other sub-step holds the same ref. Only the rest is resolved again and
-     * sent, so nothing acts twice: starting over is what turns one click into two. A stale ref is the
-     * only failure retried, and the retry goes on only while it gets further. A sub-step that is stale
-     * again at the same point is a target that does not hold still, and the run says so, with how far
-     * it got.
+     * sent, so nothing acts twice. Only a stale ref is retried, and only while the retry gets further:
+     * stale again at the same point is a target that does not hold still, and the run says so.
      */
     const dispatchFrom = async (from, to) => {
         let start = from;
         let staleBefore = -1;
         for (;;) {
             const act = await send(live.slice(start, to));
-            if (act.ok)
-                return true;
+            if (act.ok) {
+                // A sub-step no person could have clicked decides nothing (#2113).
+                const drift = unreachableSubStepDrift(act.result, (at) => `${anchorLabel(subs[start + at]?.anchor ?? step.anchor)} (sub-step ${String(start + at)})`);
+                Object.assign(result, drift === undefined ? {} : { ok: false, anchor: drift.anchor, drift });
+                return drift === undefined;
+            }
             const error = act.error ?? 'command failed';
             if (!isStaleRefError(error)) {
                 result.ok = false;
@@ -656,19 +710,22 @@ judge) {
             await waitForReaction(session, 0, STALE_REF_GRACE_MS, { sleep });
             for (let at = staleAt; at < to; at += 1) {
                 const sub = subs[at];
-                if (sub === undefined)
+                if (sub === undefined) {
                     continue;
-                const resolved = await resolveSub(sub, at, true);
+                }
+                const resolved = await resolveSub(sub, at);
                 if ('stop' in resolved) {
                     result.ok = false;
                     result.anchor = resolved.stop.anchor;
-                    if (resolved.stop.drift !== undefined)
+                    if (resolved.stop.drift !== undefined) {
                         result.drift = resolved.stop.drift;
+                    }
                     return false;
                 }
                 // A second look settles, so it is never `pending`.
-                if ('live' in resolved)
+                if ('live' in resolved) {
                     live[at] = resolved.live;
+                }
             }
             start = staleAt;
         }
@@ -687,8 +744,9 @@ judge) {
      */
     const assertDeclared = async (testid) => {
         const found = await resolveQuery(session, { by: QueryBy.TESTID, value: testid }, sleep);
-        if (0 < found.refs.length)
+        if (0 < found.refs.length) {
             return true;
+        }
         result.ok = false;
         result.drift = expectElementDrift(testid, found.hint);
         return false;
@@ -697,48 +755,65 @@ judge) {
      * A sequence that declares nothing goes as ONE batch — the cheap path, and the common one.
      *
      * When a sub-step DOES declare, the sub-steps are walked and each expectation is checked right
-     * after its own action. Checking them all at the end, which is what replay used to do, let "click
-     * Pay, and the receipt appears" pass because a LATER sub-step produced the receipt: true by the
-     * time anybody looked, and no longer a claim about this action. The live act path never had that
-     * hole, because it asserts before moving on; this is replay catching up to it.
-     *
-     * The walk costs a round trip per sub-step, so only a flow that declared something pays for it.
+     * after its own action, as live: checked at the end, "click Pay, and the receipt appears" passed
+     * because a LATER sub-step produced the receipt. A sequence driven with `burst` is walked too, one
+     * gap between actions, as live: at the default settle a timing-sensitive page answered differently
+     * (#2130). The walk costs a round trip per sub-step, so only these sequences pay for it.
      */
     const judged = (sub) => judge !== undefined && sub.expect !== undefined;
-    const declaring = subs.some((sub) => declaredBy(sub) !== undefined || judged(sub));
+    const declaring = gap !== undefined || subs.some((sub) => declaredBy(sub) !== undefined || judged(sub));
+    // Sub-steps completed with their checks held, for the score; a failed batch leaves its own unknown.
+    let completed = 0;
+    const finish = (r) => ({
+        ...r,
+        subSteps: {
+            passed: r.ok && r.drift === undefined ? subs.length : completed,
+            total: subs.length,
+        },
+    });
     for (let next = 0; next < subs.length;) {
         const stretch = await resolveFrom(next);
-        if ('stop' in stretch)
-            return stretch.stop;
+        if ('stop' in stretch) {
+            return finish(stretch.stop);
+        }
         const { end } = stretch;
         if (!declaring) {
-            if (!(await dispatchFrom(next, end)))
-                return result;
+            if (!(await dispatchFrom(next, end))) {
+                return finish(result);
+            }
+            completed = end;
         }
         else {
             for (let at = next; at < end; at += 1) {
                 const sub = subs[at];
-                if (sub === undefined)
+                if (sub === undefined) {
                     continue;
+                }
+                await holdGap(() => session.elapsed(), lastSent, gap, sleep);
+                const before = judged(sub) ? await captureBaselines(session, sub.expect) : undefined;
                 const since = session.elapsed();
-                if (!(await dispatchFrom(at, at + 1)))
-                    return result;
+                lastSent = since;
+                if (!(await dispatchFrom(at, at + 1))) {
+                    return finish(result);
+                }
                 const testid = declaredBy(sub);
-                if (testid !== undefined && !(await assertDeclared(testid)))
-                    return result;
+                if (testid !== undefined && !(await assertDeclared(testid))) {
+                    return finish(result);
+                }
                 // The claim is about THIS sub-step: a later one has not run, and an earlier one is before
                 // `since`. Judged at the end, a middle route expect failed and a late claim passed early.
                 const drift = judge !== undefined && sub.expect !== undefined
-                    ? await judge(sub.expect, since)
+                    ? await judge(sub.expect, since, before)
                     : undefined;
                 if (drift !== undefined) {
                     result.ok = false;
                     result.drift = drift;
-                    return result;
+                    return finish(result);
                 }
+                completed = at + 1;
             }
         }
         next = end;
     }
-    return result;
+    return finish(result);
 }

package/dist/language/flows/flow-store-for-session.d.ts

@@ -1,29 +1,5 @@
-/**
- * The flow store a SESSION's flows belong in.
- *
- * `deps.flows` is bound to the daemon's own root at construction, which is right only when the
- * daemon happens to have been started in the project it is driving. A user-scoped MCP registration
- * is the common case and the editor starts it wherever it likes, so "where the daemon was launched"
- * and "which app is being verified" are usually different directories.
- *
- * This used to live inside flow-tools and was applied at exactly ONE of ten call sites. The result
- * is the half-applied state `sessionRoot` warns about in its own comment, reached in practice:
- *
- *   - the HUD listed the daemon repo's flows while driving somebody else's app — Electron and Tauri
- *     flows shown over a React dashboard, none of which existed in the checkout being verified
- *   - `flow_replay` answered `flow_not_found` for a flow sitting on disk, because it looked in the
- *     daemon's root while `reticle verify` (which roots itself at cwd) replayed the same flow fine
- *   - and the two save paths disagreed with each other, so where a flow landed depended on which
- *     tool wrote it
- *
- * Reported as "running the daemon from here but taking the directory from there", which is exactly
- * what it was.
- *
- * Rebinding is cheap — a FlowStore is a filesystem port, a root and a clock — and the common case
- * allocates nothing: when no resolver is wired, or it names the root already in use, `deps.flows` is
- * returned unchanged.
- */
 import { FlowStore } from './flows.js';
+import type { NamedFlow } from './change/flow-sources.js';
 import { type ProjectTarget } from '../../memory/project/session-root.js';
 import type { ProjectId } from '@reticlehq/core';
 import type { ToolDeps } from '../../surface/tools/tool-kit.js';
@@ -37,3 +13,28 @@ export declare function flowsForSessionId(deps: ToolDeps, sessionId: string | un
     root: string;
     projectId: ProjectId | undefined;
 };
+/** The {name, steps} of every flow in `store` that `projectId` can see. Unreadable flows are left out. */
+export declare function namedFlowsIn(store: FlowStore, projectId: ProjectId | undefined): Promise<NamedFlow[]>;
+/**
+ * The saved flows of a session, from the store `flowsForSessionId` resolves, and the project
+ * directory that holds that store.
+ *
+ * `affected` and `change` read flows through here, and `flows` replays from the same store. They
+ * used to build their own store from `sessionRoot`, which skips the root a lease claimed when no
+ * resolver is wired and no session is named. Then `affected` named a flow that `flows` could not
+ * find (#1996). The directory is returned too, so `git diff` runs in the tree the flows belong to.
+ *
+ * `sessionTarget` declines when several projects are connected and none is named, because a caller
+ * that needs no session must still work. These callers answer about ONE project, and that fallback
+ * is the daemon's own, so its flows read as the driven tab's (#1550). Here the refusal stands:
+ * `resolve` names the connected projects and asks for a `sessionId`. It throws nothing for several
+ * tabs of one project, or for no session at all.
+ *
+ * `unmatchedRoot` is set when the project has no folder: the root is an evidence bucket, not a
+ * tree, so there is no `git` to ask and no flows to find.
+ */
+export declare function namedFlowsForSession(deps: ToolDeps, sessionId: string | undefined): Promise<{
+    flows: NamedFlow[];
+    projectDir: string;
+    unmatchedRoot?: string;
+}>;