@reticlehq/server 3.9.0 → 3.10.0

package/dist/language/flows/suite/sequential-run.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The sequential half of `reticle_verify { action: "flows" | "change" }`.
+ *
+ * Flows replay one after the other against one live tab, with no limit on the total time. When the
+ * browser session was lost part-way through, every remaining flow waited for a page that never came,
+ * and the MCP client gave up (about 300 s) with no result at all - including for the flows that had
+ * already run. So the loop now stops at two points, and says so:
+ *
+ * - the total time budget is spent: no further flow is started;
+ * - the session is gone after a flow: the rest cannot run, so they are not attempted.
+ *
+ * Kept free of IO (the clock, the liveness probe and the replay are injected) so both stops are
+ * tested with a fake clock.
+ */
+import { z } from 'zod';
+import { SuiteStopReason, SuiteVerdictStatus } from '@reticlehq/core';
+/** Below the roughly 300 s at which common MCP clients stop waiting, so a result can still be returned. */
+export declare const DEFAULT_SUITE_BUDGET_MS = 240000;
+/** An hour: more than that is not a budget, and a client will have given up long before. */
+export declare const MAX_SUITE_BUDGET_MS = 3600000;
+export interface SuiteStop {
+    reason: SuiteStopReason;
+    /** For SESSION_LOST: the flow that was running when the session went. */
+    flow?: string;
+    budgetMs?: number;
+    nextAction: string;
+}
+export interface SequentialRun<R> {
+    results: R[];
+    /** Selected flows that were never started, in order. */
+    notRun: string[];
+    stopped?: SuiteStop;
+}
+export interface SequentialRunOptions<R> {
+    now: () => number;
+    budgetMs: number;
+    /** True while the session the flows drive is still there. Probed after each flow. */
+    sessionAlive: () => boolean;
+    run: (name: string) => Promise<R>;
+}
+export declare function runSequentially<R>(names: readonly string[], options: SequentialRunOptions<R>): Promise<SequentialRun<R>>;
+/**
+ * Mark a verdict `partial` when the suite stopped early. The ran flows keep their counts and
+ * failures; the summary leads with what did not run, because a green count over half a suite must
+ * not read as a pass.
+ */
+export declare function withStop<V extends {
+    status: SuiteVerdictStatus;
+    summary: string;
+}>(verdict: V, notRun: readonly string[], stopped: SuiteStop | undefined): V & {
+    notRun?: string[];
+    stopped?: SuiteStop;
+};
+/** The `budgetMs` input of the suite tools. */
+export declare const BUDGET_MS_ARG: z.ZodOptional<z.ZodNumber>;
+/** The two output fields a "partial" suite adds. */
+export declare const PARTIAL_OUTPUT: {
+    notRun: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    stopped: z.ZodOptional<z.ZodObject<{
+        reason: z.ZodEnum<{
+            time_budget: "time_budget";
+            session_lost: "session_lost";
+        }>;
+        flow: z.ZodOptional<z.ZodString>;
+        budgetMs: z.ZodOptional<z.ZodNumber>;
+        nextAction: z.ZodString;
+    }, z.core.$strip>>;
+};

package/dist/language/flows/suite/sequential-run.js

@@ -0,0 +1,96 @@
+/**
+ * The sequential half of `reticle_verify { action: "flows" | "change" }`.
+ *
+ * Flows replay one after the other against one live tab, with no limit on the total time. When the
+ * browser session was lost part-way through, every remaining flow waited for a page that never came,
+ * and the MCP client gave up (about 300 s) with no result at all - including for the flows that had
+ * already run. So the loop now stops at two points, and says so:
+ *
+ * - the total time budget is spent: no further flow is started;
+ * - the session is gone after a flow: the rest cannot run, so they are not attempted.
+ *
+ * Kept free of IO (the clock, the liveness probe and the replay are injected) so both stops are
+ * tested with a fake clock.
+ */
+import { z } from 'zod';
+import { SuiteStopReason, SuiteVerdictStatus } from '@reticlehq/core';
+/** Below the roughly 300 s at which common MCP clients stop waiting, so a result can still be returned. */
+export const DEFAULT_SUITE_BUDGET_MS = 240_000;
+/** An hour: more than that is not a budget, and a client will have given up long before. */
+export const MAX_SUITE_BUDGET_MS = 3_600_000;
+export async function runSequentially(names, options) {
+    const deadline = options.now() + options.budgetMs;
+    const results = [];
+    for (const [index, name] of names.entries()) {
+        // The first flow always starts: a budget that stops a suite before anything ran proves nothing.
+        if (index > 0 && options.now() >= deadline) {
+            return {
+                results,
+                notRun: names.slice(index),
+                stopped: {
+                    reason: SuiteStopReason.TIME_BUDGET,
+                    budgetMs: options.budgetMs,
+                    nextAction: 'run the flows listed in notRun in a new call (pass `names`), or raise `budgetMs` if your client waits longer',
+                },
+            };
+        }
+        results.push(await options.run(name));
+        if (index < names.length - 1 && !options.sessionAlive()) {
+            return {
+                results,
+                notRun: names.slice(index + 1),
+                stopped: {
+                    reason: SuiteStopReason.SESSION_LOST,
+                    flow: name,
+                    nextAction: 'reconnect the app (open it in a tab, or call reticle_sessions to find the live one), then run the flows listed in notRun with `names`',
+                },
+            };
+        }
+    }
+    return { results, notRun: [] };
+}
+/**
+ * Mark a verdict `partial` when the suite stopped early. The ran flows keep their counts and
+ * failures; the summary leads with what did not run, because a green count over half a suite must
+ * not read as a pass.
+ */
+export function withStop(verdict, notRun, stopped) {
+    if (stopped === undefined) {
+        return verdict;
+    }
+    const why = stopped.reason === SuiteStopReason.TIME_BUDGET
+        ? `the ${String(Math.round((stopped.budgetMs ?? 0) / 1000))} s total budget ran out`
+        : `the browser session was lost while "${stopped.flow ?? ''}" was running`;
+    return {
+        ...verdict,
+        status: SuiteVerdictStatus.PARTIAL,
+        summary: `PARTIAL - ${why}; ${String(notRun.length)} flow(s) did not run (${notRun.join(', ')}). Of those that ran: ${verdict.summary}`,
+        notRun: [...notRun],
+        stopped,
+    };
+}
+/** The `budgetMs` input of the suite tools. */
+export const BUDGET_MS_ARG = z
+    .number()
+    .finite()
+    .int()
+    .positive()
+    .max(MAX_SUITE_BUDGET_MS)
+    .optional()
+    .describe(`Total time budget for the sequential run, in milliseconds (default ${String(DEFAULT_SUITE_BUDGET_MS)}, below the ~300 s at which common MCP clients stop waiting). When it is spent no further flow is started: the call returns status "partial" with the finished results and the flows in notRun.`);
+/** The two output fields a "partial" suite adds. */
+export const PARTIAL_OUTPUT = {
+    notRun: z
+        .array(z.string())
+        .optional()
+        .describe('Present on a "partial" suite: the selected flows that were never started because the time budget ran out or the session was lost.'),
+    stopped: z
+        .object({
+        reason: z.enum([SuiteStopReason.TIME_BUDGET, SuiteStopReason.SESSION_LOST]),
+        flow: z.string().optional(),
+        budgetMs: z.number().optional(),
+        nextAction: z.string(),
+    })
+        .optional()
+        .describe('Present on a "partial" suite: why it ended early (time_budget | session_lost), the flow that lost the session, and one next action.'),
+};

package/dist/language/flows/verify-change-tools.js

@@ -1,19 +1,21 @@
 import { z } from 'zod';
-import { sessionRoot, sessionProjectId } from '../../memory/project/session-root.js';
+import { sessionRoot } from '../../memory/project/session-root.js';
 import { verdictForSuite } from '../../judgement/outcome/verify-change-verdict.js';
 import { attributedFailures } from '../../judgement/outcome/attributed-failure.js';
 import { Verified, isAdvisory } from '@reticlehq/core';
 import { ReticleTool } from '@reticlehq/core';
 import { asNumber, asRecord, asString } from '@reticlehq/core';
 import { workerCountSchema } from '../../surface/tools/args/numeric-bounds.js';
-import { loadNamedFlows, resolveChangedFiles } from '../../command/cli/cli-flow-commands.js';
-import { projectDirFor } from '../../memory/project/session-root.js';
+import { resolveChangedFiles } from '../../command/cli/cli-flow-commands.js';
+import { namedFlowsForSession } from './flow-store-for-session.js';
 import { affectedSavedFlows } from './change/flow-sources.js';
 import { FLOW_TOOLS } from './flow-tools.js';
 import { RESULT_FIELD, changeResult } from '../../surface/tools/reticle-result.js';
 import { findContradictions } from '@reticlehq/engine/disagreement/contradictions.js';
+import { isOneActionOnly } from './flow-cross-step.js';
 import { parseControls } from '../../surface/tools/coverage-tools.js';
 import { ReticleCommand, SnapshotMode } from '@reticlehq/core';
+import { BUDGET_MS_ARG } from './suite/sequential-run.js';
 const VERIFY_CHANGE = {
     name: ReticleTool.VERIFY_CHANGE,
     description: 'Did my change break anything? Give it the files you edited (or `since` for a git ref) and it works out which saved flows cover them, replays exactly those, and answers with one `verified` (yes|no|unknown) plus `because`. `unknown` when NO saved flow covers the change — that is the honest answer, never a green: nothing ran, so nothing was proved. Returns { verified, because, changedFiles, flowsRun, suite, unknownProvenance }.',
@@ -30,6 +32,11 @@ const VERIFY_CHANGE = {
         parallel: workerCountSchema
             .optional()
             .describe('Replay this many affected flows at once (needs the browser pool).'),
+        ignoreHTTPSErrors: z
+            .boolean()
+            .optional()
+            .describe('Accept a self-signed or local-CA certificate for parallel flow leases. Omit to inherit the source lease setting; otherwise certificate checks stay on.'),
+        budgetMs: BUDGET_MS_ARG,
         sessionId: z
             .string()
             .optional()
@@ -68,16 +75,14 @@ const VERIFY_CHANGE = {
         // used to say it was: `deps.reticleRoot` is the daemon's `.reticle` SUBDIRECTORY, and the
         // daemon's cwd is wherever the MCP host started it — `/` or `$HOME` for a globally-registered
         // server. Both answer about the wrong repository while reporting a clean "nothing changed",
-        // which reads as a pass. `projectDirFor` is the directory holding the resolved root.
-        const changed = await resolveChangedFiles(files, since, projectDirFor(deps, asString(args['sessionId'])));
+        // which reads as a pass. `projectDir` is the directory holding the resolved root.
+        //
+        // The flows come from the store `flows` replays from, and flow_save writes to. A read that
+        // resolved differently would report "no flows covered this change" over flows that exist,
+        // which reads as a clean result rather than an error (#1996).
+        const { flows, projectDir } = await namedFlowsForSession(deps, asString(args['sessionId']));
+        const changed = await resolveChangedFiles(files, since, projectDir);
         const changedFiles = changed.files;
-        // Same root flow_save wrote to. A read that resolved differently would report "no flows
-        // covered this change" over flows that exist, which reads as a clean result rather than
-        // an error, so the disagreement would be invisible.
-        // Both halves of the address from one place. The root was already resolved from the session;
-        // the id used to come from the daemon's cwd, so they named different projects.
-        const sid = asString(args['sessionId']);
-        const flows = await loadNamedFlows(deps.fs, sessionRoot(deps, sid), sessionProjectId(deps, sid));
         const { affected, unknownProvenance } = affectedSavedFlows(flows, changedFiles);
         if (0 === changedFiles.length) {
             return {
@@ -126,11 +131,16 @@ const VERIFY_CHANGE = {
         // flows produced, and never events from whatever the agent did before calling this.
         const cursor = cursorBeforeReplay(deps, args);
         const verify = FLOW_TOOLS.find((tool) => tool.name === ReticleTool.FLOW_VERIFY);
-        if (verify === undefined)
+        if (verify === undefined) {
             throw new Error('the whole-suite replay tool is not registered');
+        }
         const suite = asRecord(await verify.handler(deps, {
             names: affected,
             ...(asNumber(args['parallel']) === undefined ? {} : { parallel: args['parallel'] }),
+            ...(asNumber(args['budgetMs']) === undefined ? {} : { budgetMs: args['budgetMs'] }),
+            ...('boolean' === typeof args['ignoreHTTPSErrors']
+                ? { ignoreHTTPSErrors: args['ignoreHTTPSErrors'] }
+                : {}),
             ...(asString(args['sessionId']) === undefined ? {} : { sessionId: args['sessionId'] }),
         }));
         const failed = suite.failed ?? 0;
@@ -254,9 +264,10 @@ async function inspectAfterReplay(deps, args, cursor) {
             appOrigin: session.url,
             background: session.background,
             namedNetUrls: [],
-            // The replay is the action, and the cursor is where it started.
+            // The cursor is where the replay started. The replay is many user actions, not one, so a
+            // finding that only means something inside one action's window is left to the steps (#2013).
             actionSince: cursor,
-        });
+        }).filter((found) => !isOneActionOnly(found));
         const snapshot = await session.command(ReticleCommand.SNAPSHOT, {
             mode: SnapshotMode.INTERACTIVE,
         });

package/dist/memory/cloud/background-sync.d.ts

@@ -15,6 +15,19 @@ export interface BackgroundSyncGate {
     /** Who is sending, when it is ON: a new value after a new sign-in or a new key. */
     credential?: string;
 }
+/**
+ * The switch a person set to stop sending without being asked, or undefined when nobody set it.
+ *
+ * Every send that nobody asked for reads it, the daemon's and the one `start()` runs on close. The
+ * close cycle read nothing, so a person who switched it off still sent this project and every
+ * other linked one when `reticle drive` or a self-booting `verify` closed.
+ */
+export declare function backgroundSyncOptOut(reticleRoot: string, env: NodeJS.ProcessEnv): BackgroundSyncGate | undefined;
+/**
+ * The gate of the one cycle `start()` sends on close, with nobody signed in. CI's key in the
+ * environment still sends there, as the docs promise. A switch that a person set still stops it.
+ */
+export declare function closeCycleGate(reticleRoot: string, env: NodeJS.ProcessEnv): BackgroundSyncGate;
 /** May the daemon send this root's work now? Reads the disk, never the network. */
 export declare function backgroundSyncGate(input: {
     reticleRoot: string;

package/dist/memory/cloud/background-sync.js

@@ -29,9 +29,14 @@ export const BackgroundSyncState = {
 };
 const OFF_VALUES = new Set(['0', 'false', 'off', 'no']);
 const BACKGROUND_SYNC_SETTING = 'backgroundSync';
-/** May the daemon send this root's work now? Reads the disk, never the network. */
-export function backgroundSyncGate(input) {
-    const { reticleRoot, cloud, env, signedIn } = input;
+/**
+ * The switch a person set to stop sending without being asked, or undefined when nobody set it.
+ *
+ * Every send that nobody asked for reads it, the daemon's and the one `start()` runs on close. The
+ * close cycle read nothing, so a person who switched it off still sent this project and every
+ * other linked one when `reticle drive` or a self-booting `verify` closed.
+ */
+export function backgroundSyncOptOut(reticleRoot, env) {
     if (OFF_VALUES.has((env[ReticleEnv.BACKGROUND_SYNC] ?? '').toLowerCase())) {
         return {
             state: BackgroundSyncState.OPTED_OUT,
@@ -44,6 +49,22 @@ export function backgroundSyncGate(input) {
             why: `off in this project ("${BACKGROUND_SYNC_SETTING}": false in .reticle.json)`,
         };
     }
+    return undefined;
+}
+/**
+ * The gate of the one cycle `start()` sends on close, with nobody signed in. CI's key in the
+ * environment still sends there, as the docs promise. A switch that a person set still stops it.
+ */
+export function closeCycleGate(reticleRoot, env) {
+    return (backgroundSyncOptOut(reticleRoot, env) ?? { state: BackgroundSyncState.ON, why: 'on close' });
+}
+/** May the daemon send this root's work now? Reads the disk, never the network. */
+export function backgroundSyncGate(input) {
+    const { reticleRoot, cloud, env, signedIn } = input;
+    const optedOut = backgroundSyncOptOut(reticleRoot, env);
+    if (optedOut !== undefined) {
+        return optedOut;
+    }
     // `link` is set only from the project's own link file; an environment key leaves it unset.
     if (cloud.link === undefined) {
         return {

package/dist/memory/cloud/sync-daemon.js

@@ -41,7 +41,7 @@ import { describeSync } from './sync-describe.js';
 import { diskSink, diskSource, policyScreenshots, readCloudState } from './sync-disk.js';
 import { resolveProjectCloud } from './cloud-config.js';
 import { watch } from 'node:fs';
-import { BackgroundSyncState, backgroundSyncGate, } from './background-sync.js';
+import { BackgroundSyncState, backgroundSyncGate, closeCycleGate, } from './background-sync.js';
 import { unmatchedRoots, unsyncedRoots } from './unsynced-roots.js';
 /**
  * The backstop: how often the daemon cycles when nothing under `.reticle` has changed. Long, because
@@ -186,38 +186,39 @@ export function startSyncDaemon(deps) {
     let wasLinked;
     /** The project the last cycle synced to: a re-link to another one is announced too. */
     let wasProject;
-    /** The last count logged per root: a root is announced when its count changes, never per tick. */
-    const announced = new Map();
+    /** The aggregate last logged: unlinked roots are announced as one line per change, never per tick. */
+    let announcedUnsynced;
     let unsynced = [];
     /** Which roots pushed this cycle, and whether each is linked by its own link file. */
     let rootsLinked = new Map();
     /** The linked roots that send flows: a link with `sync.flows` off keeps every flow local. */
     let rootsSendFlows = new Set();
-    /**
-     * Count what every root still owes, and say once per change where runs sit that nothing sends.
-     * Linked roots are listed too (the platform report and `doctor` read them), but only an unlinked
-     * one earns a log line: a linked root's pending runs are the next cycle's job.
-     */
+    /** Count what every root owes; unlinked roots are one aggregate line per change, never per tick. */
     const refreshUnsynced = async () => {
         const linked = rootsLinked;
         const sendsFlows = rootsSendFlows;
         unsynced = await unsyncedRoots(
         // With what no project claimed, which no cycle pushes: the dashboard's unsent list left it out.
         [...linked.keys(), ...unmatchedRoots(homedir())], (r) => Promise.resolve(true === linked.get(r)), (r) => Promise.resolve(sendsFlows.has(r)));
-        for (const entry of unsynced) {
-            const held = entry.runs + entry.flows;
-            if (entry.linked || announced.get(entry.root) === held) {
-                continue;
-            }
-            announced.set(entry.root, held);
-            log('reticle_cloud_unsynced_root', {
-                root: entry.root,
-                runs: entry.runs,
-                flows: entry.flows,
-                linked: entry.linked,
-                fix: "run `reticle connect` in that folder's project: this work is on this machine only",
-            });
+        const unlinked = unsynced.filter((entry) => !entry.linked);
+        const runs = unlinked.reduce((total, entry) => total + entry.runs, 0);
+        const flows = unlinked.reduce((total, entry) => total + entry.flows, 0);
+        const signature = JSON.stringify([unlinked.map((e) => [e.root, e.runs, e.flows]), runs, flows]);
+        if (0 === unlinked.length) {
+            announcedUnsynced = undefined;
+            return;
+        }
+        if (announcedUnsynced === signature) {
+            return;
         }
+        announcedUnsynced = signature;
+        log('reticle_cloud_unsynced_root', {
+            count: unlinked.length,
+            runs,
+            flows,
+            examples: unlinked.slice(0, 3).map((entry) => entry.root),
+            fix: 'run `reticle connect` in each project that owns these folders: this work is on this machine only',
+        });
     };
     /**
      * The cloud as this tick may use it: unchanged when the gate lets the root send, else with no
@@ -778,12 +779,10 @@ export function attachCloudSync(deps) {
         // and on the backstop timer.
         // Watching them too means one recursive watcher per linked repo — add it if siblings lag.
         watch: (onChange) => watchReticleRoot(deps.reticleRoot, onChange),
-        // Sent only while somebody is signed in, to a linked project that did not switch it off.
-        ...(signedIn === undefined
-            ? {}
-            : {
-                gate: (root, cloud) => backgroundSyncGate({ reticleRoot: root, cloud, env: deps.env, signedIn }),
-            }),
+        // Sent only to a linked project that did not switch it off; see `closeCycleGate` for no sign-in.
+        gate: (root, cloud) => signedIn === undefined
+            ? closeCycleGate(root, deps.env)
+            : backgroundSyncGate({ reticleRoot: root, cloud, env: deps.env, signedIn }),
         ...(deps.request === undefined ? {} : { request: deps.request }),
         ...(deps.intervalMs === undefined ? {} : { intervalMs: deps.intervalMs }),
     });

package/dist/memory/journal/attach-journal.js

@@ -19,7 +19,8 @@ export function makeJournalAttach(deps) {
             log('journal_skipped_unsafe_session_id', { sessionId: session.id });
             return;
         }
-        const journal = new SessionJournal(deps.fs, session.artifactRoot ?? deps.reticleRoot, session.id);
+        // The session's clock stamps each record's `t`, so it also bounds a cut that left nothing to parse.
+        const journal = new SessionJournal(deps.fs, session.artifactRoot ?? deps.reticleRoot, session.id, { now: () => session.elapsed() });
         // Same SessionJournal is both the write sink and the read fall-through for queries after eviction.
         session.setJournal(new JournalRecorder(journal, { now: () => session.elapsed() }), journal);
     };

package/dist/memory/journal/drive-flow.d.ts

@@ -44,6 +44,13 @@ export interface DriveProgram {
  *
  * So it is not a tool and not a rule. It runs at teardown, in code, on every session.
  */
+/**
+ * The claims one tape step carries: its own `expect`, and the `expect` of each of its sub-steps.
+ *
+ * A `reticle_act { steps }` journey is one tape step, and each claim is on its sub-step. When only
+ * the step's own `expect` was read, a journey with four held claims was "unproven" and was not saved.
+ */
+export declare function claimsOf(step: TapeStep): Predicate[];
 /** The one condition on saving, and the reason the whole thing is safe. */
 export declare function carriesAnAssertion(steps: readonly TapeStep[]): boolean;
 /** Every auto-saved flow's name starts here, which is what lets a merge tell them from hand-named ones. */

package/dist/memory/journal/drive-flow.js

@@ -1,4 +1,4 @@
-import { ActionType, QueryBy, REPLAY_PROGRAM_VERSION, asFlowName, defaultIsSensitiveKey, } from '@reticlehq/core';
+import { ActionType, FlowPredicateSchema, QueryBy, REPLAY_PROGRAM_VERSION, asFlowName, asRecord, isCredentialFieldName, } from '@reticlehq/core';
 import { journeySentence } from '@reticlehq/core';
 /**
  * What a session drove, saved as a replayable flow — without anybody asking for it.
@@ -11,9 +11,23 @@ import { journeySentence } from '@reticlehq/core';
  *
  * So it is not a tool and not a rule. It runs at teardown, in code, on every session.
  */
+/**
+ * The claims one tape step carries: its own `expect`, and the `expect` of each of its sub-steps.
+ *
+ * A `reticle_act { steps }` journey is one tape step, and each claim is on its sub-step. When only
+ * the step's own `expect` was read, a journey with four held claims was "unproven" and was not saved.
+ */
+export function claimsOf(step) {
+    const subs = Array.isArray(step.args['steps']) ? step.args['steps'] : [];
+    const subClaims = subs.flatMap((sub) => {
+        const parsed = FlowPredicateSchema.safeParse(asRecord(sub)['expect']);
+        return parsed.success ? [parsed.data] : [];
+    });
+    return step.expect === undefined ? subClaims : [step.expect, ...subClaims];
+}
 /** The one condition on saving, and the reason the whole thing is safe. */
 export function carriesAnAssertion(steps) {
-    return steps.some((step) => step.expect !== undefined);
+    return steps.some((step) => 0 < claimsOf(step).length);
 }
 /** Squeeze any string into one safe, lower-case filename segment. */
 const segment = (value, max) => value
@@ -28,10 +42,12 @@ const segment = (value, max) => value
  * said nothing about what it was for.
  */
 function provedSentence(steps) {
-    return journeySentence(steps.flatMap((step) => (step.expect === undefined ? [] : [step.expect])));
+    return journeySentence(steps.flatMap(claimsOf));
 }
 /** Every auto-saved flow's name starts here, which is what lets a merge tell them from hand-named ones. */
 export const DRIVE_FLOW_PREFIX = 'drive-';
+/** The most characters one segment of core's FLOW_NAME_PATTERN holds. */
+const FLOW_NAME_MAX_LENGTH = 64;
 /**
  * A readable name for a journey, led by WHY it was driven.
  *
@@ -52,7 +68,10 @@ export function driveFlowName(route, steps = []) {
     // Minted here: every character has just been forced through `segment`, so this IS the validated
     // boundary the brand is meant to be created at.
     const parts = [lead, ...('' !== why || 0 === leg.length ? [] : [leg])].filter((p) => '' !== p);
-    return asFlowName(`${DRIVE_FLOW_PREFIX}${0 === parts.length ? 'journey' : parts.join('-')}`);
+    // Cut to the flow-name limit: a sentence and a route together went over it, the save refused
+    // the name, and session end dropped the flow with nothing said.
+    const body = segment(parts.join('-'), FLOW_NAME_MAX_LENGTH - DRIVE_FLOW_PREFIX.length);
+    return asFlowName(`${DRIVE_FLOW_PREFIX}${'' === body ? 'journey' : body}`);
 }
 /** Why session end saved no flow, as reported on the `flow_recorded` step. */
 export const DriveFlowSkipReason = {
@@ -106,16 +125,25 @@ function segmentsByRoute(steps) {
     return out;
 }
 /**
- * A fill into a field the network channel would redact — the sign-in a journey must not carry.
+ * A fill into a field whose name says it holds a credential — the sign-in a journey must not carry.
  * Read off the recorder's anchor args: a testid names the field by `value`, a role by `name`.
  */
 function typesASecret(step) {
-    const action = step.args['action'];
-    if (ActionType.FILL !== action && ActionType.TYPE !== action)
+    // A sign-in sent as one reticle_act sequence carries its fills as sub-steps.
+    const subs = step.args['steps'];
+    if (Array.isArray(subs)) {
+        return subs.some((sub) => fillsASecret(asRecord(sub)));
+    }
+    return fillsASecret(step.args);
+}
+function fillsASecret(args) {
+    const action = args['action'];
+    if (ActionType.FILL !== action && ActionType.TYPE !== action) {
         return false;
-    const by = step.args['by'];
-    const field = QueryBy.TESTID === by ? step.args['value'] : step.args['name'];
-    return 'string' === typeof field && defaultIsSensitiveKey(field);
+    }
+    const by = args['by'];
+    const field = QueryBy.TESTID === by ? args['value'] : args['name'];
+    return 'string' === typeof field && isCredentialFieldName(field);
 }
 /**
  * The tape without the attempts an agent made again. An action that declared nothing, followed at
@@ -126,11 +154,13 @@ function typesASecret(step) {
 function withoutRetries(steps) {
     return steps.filter((step, i) => {
         const next = steps[i + 1];
-        if (next === undefined || step.expect !== undefined || next.expect === undefined)
+        if (next === undefined || step.expect !== undefined || next.expect === undefined) {
             return true;
+        }
         // Tried again where it was tried: a page later it is a step of the journey, not a retry.
-        if (step.route !== next.route || step.page !== next.page || step.mocked !== next.mocked)
+        if (step.route !== next.route || step.page !== next.page || step.mocked !== next.mocked) {
             return true;
+        }
         const { expect: _declared, ...again } = next.args;
         const { expect: _none, ...first } = step.args;
         return step.tool !== next.tool || JSON.stringify(first) !== JSON.stringify(again);
@@ -138,8 +168,9 @@ function withoutRetries(steps) {
 }
 /** A flow per journey, so two journeys in one session are two regression tests rather than one. */
 export function driveFlowsFrom(tape) {
-    if (tape === undefined || 0 === tape.steps.length)
+    if (tape === undefined || 0 === tape.steps.length) {
         return { programs: [], outcome: {} };
+    }
     const programs = [];
     let unproven = 0;
     let mocked = 0;

package/dist/memory/journal/journal-recorder.d.ts

@@ -30,8 +30,10 @@ export interface JournalReadLoss {
     /** Parsed records evicted from the retained set. Exact, unlike `droppedBytes`. */
     droppedEvents: number;
     /**
-     * Latest timestamp of parsed cache evictions, inclusive. Omitted after a byte cut skips
-     * unparsed records: their time range is unknown even when newer bytes survive.
+     * Latest `t` the loss can reach, inclusive: a parsed record that was evicted, or the bound of a
+     * byte cut. Omitted while a cut has no bound, which means every window is lost. A cut has no
+     * bound until a record after it is parsed, and none at all when the clock can have started
+     * again across it.
      */
     lostThroughT?: number;
     /** Human-and-agent readable summary. Present so a consumer never has to compose one. */

package/dist/memory/journal/session-journal.d.ts

@@ -42,6 +42,13 @@ export interface SessionJournalOptions {
     maxReadBytes?: number;
     maxRetainedBytes?: number;
     maxRetainedEvents?: number;
+    /**
+     * The session's elapsed-ms clock, the same clock that stamps each record's `t`. It bounds a cut
+     * that left no readable record: every skipped byte was on disk at the read, so its `t` is at or
+     * before the time of the read. Without it, such a cut stays unbounded until a later read parses
+     * a record.
+     */
+    now?: () => number;
 }
 /**
  * Default byte budget for one serialized writer's event ledger (#986).