@specific.dev/spectest 0.53.0 → 0.54.1

package/dist/daemon.js

@@ -1305,6 +1305,44 @@ const INGRESS_HTTP_SERVERS = new Map();
 /** Running HTTPS servers per port (currently always {INGRESS_HTTPS_PORT}). */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const INGRESS_HTTPS_SERVERS = new Map();
+/**
+ * Servers replaced by a rebind and now draining. On Bun 1.3.14 a request
+ * arriving on a kept-alive connection of a `stop(false)`-drained server
+ * dispatches into freed per-server state and can SEGFAULT the process
+ * (use-after-free class fixed upstream by oven-sh/bun#36790, first in Bun
+ * 1.4.0; observed here as `panic: Segmentation fault at address 0xA` in
+ * `server.zig onRequestFor` on ~2-3 % of runtime-TLS rebinds). Until the
+ * Bun bump lands, shrink the number of requests a drained server can ever
+ * see: every response it still serves carries `Connection: close` (one
+ * more request per surviving connection, not unlimited), and a grace timer
+ * force-closes whatever is left ({@link REBIND_DRAIN_GRACE_MS}).
+ */
+const DRAINING_INGRESS = new WeakSet();
+/** How long a drained listener may keep serving in-flight work before its
+ *  remaining connections are force-closed. Long enough for a slow proxied
+ *  response to finish, short enough to bound the 1.3.14 UAF window. */
+const REBIND_DRAIN_GRACE_MS = 15_000;
+/** Stamp `Connection: close` on a response served by a draining listener so
+ *  the kept-alive connection retires instead of lingering as a UAF trigger.
+ *  Proxied responses can carry immutable headers; rewrap when needed. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function withDrainClose(server, res) {
+    if (!DRAINING_INGRESS.has(server))
+        return res;
+    try {
+        res.headers.set("connection", "close");
+        return res;
+    }
+    catch {
+        const headers = new Headers(res.headers);
+        headers.set("connection", "close");
+        return new Response(res.body, {
+            status: res.status,
+            statusText: res.statusText,
+            headers,
+        });
+    }
+}
 /**
  * The live ingress tables — per-port routes and the :443 SNI cert table.
  *
@@ -1627,6 +1665,23 @@ function rebindHttpsListener(Bun) {
             // upload through ingress must not be collateral damage of another
             // service being provisioned.
             old.stop(false);
+            // Bun 1.3.14 landmine: a request arriving later on one of the old
+            // server's kept-alive connections dispatches into freed state and can
+            // segfault the daemon (see {@link DRAINING_INGRESS}). Mark it so any
+            // response it still serves closes its connection, and force-close the
+            // stragglers once in-flight work has had a fair window to finish.
+            DRAINING_INGRESS.add(old);
+            const graceTimer = setTimeout(() => {
+                try {
+                    old.stop(true);
+                }
+                catch {
+                    /* already fully stopped */
+                }
+            }, REBIND_DRAIN_GRACE_MS);
+            // Don't let the grace timer keep the process alive on shutdown.
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            graceTimer.unref?.();
         }
         catch (err) {
             // eslint-disable-next-line no-console
@@ -1766,7 +1821,7 @@ Bun, port, byHost, listenerLabel, tlsEntries) {
         // short-lived, leaked-connection risk is bounded by the fork.
         idleTimeout: 0,
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        fetch: (req, server) => dispatchIngress(req, server, byHost, listenerLabel, proto),
+        fetch: (req, server) => dispatchIngress(req, server, byHost, listenerLabel, proto).then((res) => withDrainClose(server, res)),
         websocket: {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
             async open(ws) {
@@ -3308,6 +3363,26 @@ function describeRequestBody(input, init) {
     }
     return { body: `[non-text body: ${body.constructor?.name ?? typeof body}]` };
 }
+/**
+ * Marks an error thrown by the instrumented fetch as *transport-level* —
+ * the connection itself failed (refused, unresolvable, reset) before any
+ * HTTP reply existed. `fetch` never rejects for an HTTP status, so every
+ * rejection short of an abort is transport. `Symbol.for` so a duplicated
+ * SDK module instance (the bun hardlink landmine) still recognises it.
+ *
+ * Why it exists: `ctx.poll` waits for convergence, and right after a fork
+ * restore the guest can serve a ~10 s window where a connect or a DNS
+ * lookup fails once and then heals (measured 2026-08-21: a poll's first
+ * fetch hung 12 s in resolution, threw, and killed a 60 s poll on attempt
+ * 1 while attempt 2 would have passed). During a poll, a dead connection
+ * is just "not ready yet"; outside one it stays a hard error.
+ */
+const TRANSPORT_ERROR = Symbol.for("spectest.transportError");
+function isTransportError(err) {
+    return (typeof err === "object" &&
+        err !== null &&
+        err[TRANSPORT_ERROR] === true);
+}
 /**
  * Install a fetch wrapper on `globalThis` that emits HTTP events into the
  * active recorder. Returns a restore function. Calls outside of a running
@@ -3378,6 +3453,20 @@ function installFetchWrapper() {
                 durationMs: Date.now() - start,
                 error: e?.message ?? String(err),
             }, resv);
+            // Tag transport failures for ctx.poll (see TRANSPORT_ERROR). An abort
+            // is the caller's own signal (their AbortController or their
+            // AbortSignal.timeout) — their semantics, never retried for them.
+            if (typeof err === "object" &&
+                err !== null &&
+                e?.name !== "AbortError" &&
+                e?.name !== "TimeoutError") {
+                try {
+                    err[TRANSPORT_ERROR] = true;
+                }
+                catch {
+                    /* frozen error object — stays a hard error */
+                }
+            }
             throw err;
         }
     };
@@ -3589,6 +3678,7 @@ async function pollCall(description, fn, opts) {
     let value;
     let success = false;
     let predicateError;
+    let lastTransportError;
     // Record all iterations normally, but keep only the newest one: a new
     // attempt drops the events the previous attempt emitted, so the timeline
     // never fills with polling noise. Whichever attempt is last when the loop
@@ -3618,8 +3708,19 @@ async function pollCall(description, fn, opts) {
             }
         }
         catch (err) {
-            predicateError = err;
-            break;
+            // A transport-level fetch failure (connection refused, DNS miss —
+            // see TRANSPORT_ERROR) is "not ready yet", not a verdict: polls wait
+            // for convergence, and services legitimately refuse connections
+            // while they come up. Keep polling; the kept last attempt's http
+            // event carries the error for the timeline. Anything else — an
+            // assertion, a TypeError, a user abort — stays fatal on attempt 1.
+            if (isTransportError(err)) {
+                lastTransportError = err;
+            }
+            else {
+                predicateError = err;
+                break;
+            }
         }
         if (Date.now() - start + intervalMs > timeoutMs)
             break;
@@ -3629,7 +3730,9 @@ async function pollCall(description, fn, opts) {
         ? (predicateError?.message ?? String(predicateError))
         : success
             ? undefined
-            : `timed out after ${timeoutMs}ms`;
+            : lastTransportError !== undefined
+                ? `timed out after ${timeoutMs}ms (last attempt: ${lastTransportError?.message ?? String(lastTransportError)})`
+                : `timed out after ${timeoutMs}ms`;
     const seq = recordWait({
         description,
         attempts,
@@ -3648,7 +3751,10 @@ async function pollCall(description, fn, opts) {
     if (success) {
         return wrap(value, seq);
     }
-    throw new Error(`poll ${JSON.stringify(description)} timed out after ${timeoutMs}ms (${attempts} attempts)`);
+    const lastAttempt = lastTransportError !== undefined
+        ? `; last attempt: ${lastTransportError?.message ?? String(lastTransportError)}`
+        : "";
+    throw new Error(`poll ${JSON.stringify(description)} timed out after ${timeoutMs}ms (${attempts} attempts${lastAttempt})`);
 }
 function captureConsole(chunks) {
     const methods = ["log", "info", "warn", "error", "debug"];
@@ -3822,6 +3928,7 @@ async function runOne(testCase) {
             rows: term.rows,
             outputPreview: preview.value,
             outputTruncated: preview.truncated,
+            interactive: true,
         });
         return term;
     };

package/dist/recorder.d.ts

@@ -481,6 +481,14 @@ export interface TerminalEvent extends BaseEvent {
     outputTruncated: boolean;
     /** Set if spawning the PTY itself failed. */
     error?: string;
+    /**
+     * Set on the open marker of an interactive session (`ctx.terminal.open`).
+     * A one-shot `ctx.terminal(...)` event covers a whole command run, so the
+     * UI seeks its replay to the end; the open marker is the state at open,
+     * so the UI seeks to 0 instead. Older recordings lack this flag — the UI
+     * falls back to the marker's sentinel shape (exitCode -1, durationMs 0).
+     */
+    interactive?: boolean;
 }
 /** Action taken on an open interactive terminal session. */
 export type TerminalStepAction = "send" | "sendLine" | "press" | "waitFor" | "exit" | "close";

package/dist/terminal.js

@@ -128,8 +128,23 @@ export async function openTerminal(args) {
     // sendLine / press so the recorded `castTimeSec` lands on the echo's
     // frame instead of microseconds before it.
     const frameWaiters = [];
+    // Time of the most recently ingested frame. Two jobs: (1) frame
+    // timestamps are forced strictly increasing (Date.now() has ms
+    // resolution, so a fast PTY can land two frames — or two *ops* —
+    // in the same millisecond), and (2) it is what `recordOpEvent`
+    // stamps as the step's `castTimeSec`. Together they make the
+    // player's `seek(castTimeSec)` (which applies frames `<= target`)
+    // land on exactly the frames this op had seen: the step's own last
+    // frame is included, and the next op's first frame can never share
+    // the stamp. Before this, a `waitFor` that matched in the same
+    // millisecond as the following `sendLine`'s echo showed that echo
+    // — the replay ran one step ahead of the step list.
+    let lastFrameT = 0;
     const ingest = (chunk) => {
-        const t = (Date.now() - start) / 1000;
+        let t = (Date.now() - start) / 1000;
+        if (t <= lastFrameT)
+            t = lastFrameT + 0.001;
+        lastFrameT = t;
         sink.pushFrame(t, chunk);
         emu.write(chunk);
         if (output.length < OUTPUT_CAP_BYTES) {
@@ -223,8 +238,8 @@ export async function openTerminal(args) {
         }
         // Record cast time AFTER drain, so the `exit` step we record below
         // points the player at the very last frame (the program's final
-        // output before EOF).
-        exitCastTimeSec = (Date.now() - start) / 1000;
+        // output before EOF). Same between-frames stamp as `recordOpEvent`.
+        exitCastTimeSec = lastFrameT + 0.0005;
         sink.markClosed();
         resolveExit(code);
     })();
@@ -265,10 +280,17 @@ export async function openTerminal(args) {
         if (!args.recordEvents)
             return undefined;
         const preview = truncateUtf8(renderScreen());
-        // Use the SAME clock the asciicast frames use (offset from `start`,
-        // which is captured at Bun.spawn). That way the UI seeks the player
-        // directly to this value with no frame arithmetic.
-        const castTimeSec = (Date.now() - start) / 1000;
+        // Stamp the step half a millisecond past its last ingested frame:
+        // frame times are strictly increasing in 1ms steps (see `ingest`),
+        // so the stamp sits strictly BETWEEN the op's own last frame and
+        // any later op's first frame. That makes the boundary unambiguous
+        // in both directions — an inclusive seek (`<= stamp`) shows the
+        // op's own frame and can never pull in the next op's, and the
+        // viewer's exclusive `waitFor` seek (stamp − 0.0004, which
+        // disambiguates legacy wall-clock stamps that tied with the next
+        // op's echo) still lands past the op's own frame. Same clock as
+        // the frames (offset from `start`), so the UI seeks directly.
+        const castTimeSec = lastFrameT + 0.0005;
         // Return the event seq so callers can `wrap()` their result value
         // against it — e.g. `expect(await term.waitFor(...))` then links its
         // assertion to this step (sourceSeq) and the UI nests it here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.53.0",
+  "version": "0.54.1",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/daemon.ts

@@ -1677,6 +1677,43 @@ const INGRESS_HTTP_SERVERS = new Map<number, any>();
 /** Running HTTPS servers per port (currently always {INGRESS_HTTPS_PORT}). */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const INGRESS_HTTPS_SERVERS = new Map<number, any>();
+/**
+ * Servers replaced by a rebind and now draining. On Bun 1.3.14 a request
+ * arriving on a kept-alive connection of a `stop(false)`-drained server
+ * dispatches into freed per-server state and can SEGFAULT the process
+ * (use-after-free class fixed upstream by oven-sh/bun#36790, first in Bun
+ * 1.4.0; observed here as `panic: Segmentation fault at address 0xA` in
+ * `server.zig onRequestFor` on ~2-3 % of runtime-TLS rebinds). Until the
+ * Bun bump lands, shrink the number of requests a drained server can ever
+ * see: every response it still serves carries `Connection: close` (one
+ * more request per surviving connection, not unlimited), and a grace timer
+ * force-closes whatever is left ({@link REBIND_DRAIN_GRACE_MS}).
+ */
+const DRAINING_INGRESS = new WeakSet<object>();
+/** How long a drained listener may keep serving in-flight work before its
+ *  remaining connections are force-closed. Long enough for a slow proxied
+ *  response to finish, short enough to bound the 1.3.14 UAF window. */
+const REBIND_DRAIN_GRACE_MS = 15_000;
+
+/** Stamp `Connection: close` on a response served by a draining listener so
+ *  the kept-alive connection retires instead of lingering as a UAF trigger.
+ *  Proxied responses can carry immutable headers; rewrap when needed. */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function withDrainClose(server: any, res: Response): Response {
+  if (!DRAINING_INGRESS.has(server)) return res;
+  try {
+    res.headers.set("connection", "close");
+    return res;
+  } catch {
+    const headers = new Headers(res.headers);
+    headers.set("connection", "close");
+    return new Response(res.body, {
+      status: res.status,
+      statusText: res.statusText,
+      headers,
+    });
+  }
+}
 /**
  * The live ingress tables — per-port routes and the :443 SNI cert table.
  *
@@ -2033,6 +2070,22 @@ function rebindHttpsListener(Bun: any): void {
       // upload through ingress must not be collateral damage of another
       // service being provisioned.
       old.stop(false);
+      // Bun 1.3.14 landmine: a request arriving later on one of the old
+      // server's kept-alive connections dispatches into freed state and can
+      // segfault the daemon (see {@link DRAINING_INGRESS}). Mark it so any
+      // response it still serves closes its connection, and force-close the
+      // stragglers once in-flight work has had a fair window to finish.
+      DRAINING_INGRESS.add(old);
+      const graceTimer = setTimeout(() => {
+        try {
+          old.stop(true);
+        } catch {
+          /* already fully stopped */
+        }
+      }, REBIND_DRAIN_GRACE_MS);
+      // Don't let the grace timer keep the process alive on shutdown.
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (graceTimer as any).unref?.();
     } catch (err) {
       // eslint-disable-next-line no-console
       console.warn("[ingress] failed to drain the previous https listener:", err);
@@ -2191,7 +2244,9 @@ function bindIngressServer(
     idleTimeout: 0,
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     fetch: (req: Request, server: any): Response | Promise<Response> =>
-      dispatchIngress(req, server, byHost, listenerLabel, proto),
+      dispatchIngress(req, server, byHost, listenerLabel, proto).then((res) =>
+        withDrainClose(server, res),
+      ),
     websocket: {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       async open(ws: any) {
@@ -4090,6 +4145,30 @@ function describeRequestBody(
   return { body: `[non-text body: ${body.constructor?.name ?? typeof body}]` };
 }
 
+/**
+ * Marks an error thrown by the instrumented fetch as *transport-level* —
+ * the connection itself failed (refused, unresolvable, reset) before any
+ * HTTP reply existed. `fetch` never rejects for an HTTP status, so every
+ * rejection short of an abort is transport. `Symbol.for` so a duplicated
+ * SDK module instance (the bun hardlink landmine) still recognises it.
+ *
+ * Why it exists: `ctx.poll` waits for convergence, and right after a fork
+ * restore the guest can serve a ~10 s window where a connect or a DNS
+ * lookup fails once and then heals (measured 2026-08-21: a poll's first
+ * fetch hung 12 s in resolution, threw, and killed a 60 s poll on attempt
+ * 1 while attempt 2 would have passed). During a poll, a dead connection
+ * is just "not ready yet"; outside one it stays a hard error.
+ */
+const TRANSPORT_ERROR = Symbol.for("spectest.transportError");
+
+function isTransportError(err: unknown): boolean {
+  return (
+    typeof err === "object" &&
+    err !== null &&
+    (err as Record<symbol, unknown>)[TRANSPORT_ERROR] === true
+  );
+}
+
 /**
  * Install a fetch wrapper on `globalThis` that emits HTTP events into the
  * active recorder. Returns a restore function. Calls outside of a running
@@ -4159,6 +4238,21 @@ function installFetchWrapper(): () => void {
         durationMs: Date.now() - start,
         error: e?.message ?? String(err),
       }, resv);
+      // Tag transport failures for ctx.poll (see TRANSPORT_ERROR). An abort
+      // is the caller's own signal (their AbortController or their
+      // AbortSignal.timeout) — their semantics, never retried for them.
+      if (
+        typeof err === "object" &&
+        err !== null &&
+        e?.name !== "AbortError" &&
+        e?.name !== "TimeoutError"
+      ) {
+        try {
+          (err as Record<symbol, unknown>)[TRANSPORT_ERROR] = true;
+        } catch {
+          /* frozen error object — stays a hard error */
+        }
+      }
       throw err;
     }
   };
@@ -4410,6 +4504,7 @@ async function pollCall<T>(
   let value: T | undefined;
   let success = false;
   let predicateError: unknown;
+  let lastTransportError: unknown;
 
   // Record all iterations normally, but keep only the newest one: a new
   // attempt drops the events the previous attempt emitted, so the timeline
@@ -4440,8 +4535,18 @@ async function pollCall<T>(
         break;
       }
     } catch (err) {
-      predicateError = err;
-      break;
+      // A transport-level fetch failure (connection refused, DNS miss —
+      // see TRANSPORT_ERROR) is "not ready yet", not a verdict: polls wait
+      // for convergence, and services legitimately refuse connections
+      // while they come up. Keep polling; the kept last attempt's http
+      // event carries the error for the timeline. Anything else — an
+      // assertion, a TypeError, a user abort — stays fatal on attempt 1.
+      if (isTransportError(err)) {
+        lastTransportError = err;
+      } else {
+        predicateError = err;
+        break;
+      }
     }
     if (Date.now() - start + intervalMs > timeoutMs) break;
     await new Promise((r) => setTimeout(r, intervalMs));
@@ -4452,7 +4557,11 @@ async function pollCall<T>(
       ? ((predicateError as Error)?.message ?? String(predicateError))
       : success
         ? undefined
-        : `timed out after ${timeoutMs}ms`;
+        : lastTransportError !== undefined
+          ? `timed out after ${timeoutMs}ms (last attempt: ${
+              (lastTransportError as Error)?.message ?? String(lastTransportError)
+            })`
+          : `timed out after ${timeoutMs}ms`;
   const seq = recordWait({
     description,
     attempts,
@@ -4472,8 +4581,12 @@ async function pollCall<T>(
   if (success) {
     return wrap(value as T, seq) as T;
   }
+  const lastAttempt =
+    lastTransportError !== undefined
+      ? `; last attempt: ${(lastTransportError as Error)?.message ?? String(lastTransportError)}`
+      : "";
   throw new Error(
-    `poll ${JSON.stringify(description)} timed out after ${timeoutMs}ms (${attempts} attempts)`,
+    `poll ${JSON.stringify(description)} timed out after ${timeoutMs}ms (${attempts} attempts${lastAttempt})`,
   );
 }
 
@@ -4702,6 +4815,7 @@ async function runOne(testCase: TestCase<unknown>): Promise<RunResult> {
       rows: term.rows,
       outputPreview: preview.value,
       outputTruncated: preview.truncated,
+      interactive: true,
     });
     return term;
   };

package/src/recorder.ts

@@ -537,6 +537,14 @@ export interface TerminalEvent extends BaseEvent {
   outputTruncated: boolean;
   /** Set if spawning the PTY itself failed. */
   error?: string;
+  /**
+   * Set on the open marker of an interactive session (`ctx.terminal.open`).
+   * A one-shot `ctx.terminal(...)` event covers a whole command run, so the
+   * UI seeks its replay to the end; the open marker is the state at open,
+   * so the UI seeks to 0 instead. Older recordings lack this flag — the UI
+   * falls back to the marker's sentinel shape (exitCode -1, durationMs 0).
+   */
+  interactive?: boolean;
 }
 
 /** Action taken on an open interactive terminal session. */

package/src/terminal.ts

@@ -305,8 +305,22 @@ export async function openTerminal(args: OpenTerminalArgs): Promise<InternalTerm
   // sendLine / press so the recorded `castTimeSec` lands on the echo's
   // frame instead of microseconds before it.
   const frameWaiters: Array<() => void> = [];
+  // Time of the most recently ingested frame. Two jobs: (1) frame
+  // timestamps are forced strictly increasing (Date.now() has ms
+  // resolution, so a fast PTY can land two frames — or two *ops* —
+  // in the same millisecond), and (2) it is what `recordOpEvent`
+  // stamps as the step's `castTimeSec`. Together they make the
+  // player's `seek(castTimeSec)` (which applies frames `<= target`)
+  // land on exactly the frames this op had seen: the step's own last
+  // frame is included, and the next op's first frame can never share
+  // the stamp. Before this, a `waitFor` that matched in the same
+  // millisecond as the following `sendLine`'s echo showed that echo
+  // — the replay ran one step ahead of the step list.
+  let lastFrameT = 0;
   const ingest = (chunk: string): void => {
-    const t = (Date.now() - start) / 1000;
+    let t = (Date.now() - start) / 1000;
+    if (t <= lastFrameT) t = lastFrameT + 0.001;
+    lastFrameT = t;
     sink.pushFrame(t, chunk);
     emu.write(chunk);
     if (output.length < OUTPUT_CAP_BYTES) {
@@ -397,8 +411,8 @@ export async function openTerminal(args: OpenTerminalArgs): Promise<InternalTerm
     }
     // Record cast time AFTER drain, so the `exit` step we record below
     // points the player at the very last frame (the program's final
-    // output before EOF).
-    exitCastTimeSec = (Date.now() - start) / 1000;
+    // output before EOF). Same between-frames stamp as `recordOpEvent`.
+    exitCastTimeSec = lastFrameT + 0.0005;
     sink.markClosed();
     resolveExit(code);
   })();
@@ -444,10 +458,17 @@ export async function openTerminal(args: OpenTerminalArgs): Promise<InternalTerm
   ): number | undefined => {
     if (!args.recordEvents) return undefined;
     const preview = truncateUtf8(renderScreen());
-    // Use the SAME clock the asciicast frames use (offset from `start`,
-    // which is captured at Bun.spawn). That way the UI seeks the player
-    // directly to this value with no frame arithmetic.
-    const castTimeSec = (Date.now() - start) / 1000;
+    // Stamp the step half a millisecond past its last ingested frame:
+    // frame times are strictly increasing in 1ms steps (see `ingest`),
+    // so the stamp sits strictly BETWEEN the op's own last frame and
+    // any later op's first frame. That makes the boundary unambiguous
+    // in both directions — an inclusive seek (`<= stamp`) shows the
+    // op's own frame and can never pull in the next op's, and the
+    // viewer's exclusive `waitFor` seek (stamp − 0.0004, which
+    // disambiguates legacy wall-clock stamps that tied with the next
+    // op's echo) still lands past the op's own frame. Same clock as
+    // the frames (offset from `start`), so the UI seeks directly.
+    const castTimeSec = lastFrameT + 0.0005;
     // Return the event seq so callers can `wrap()` their result value
     // against it — e.g. `expect(await term.waitFor(...))` then links its
     // assertion to this step (sourceSeq) and the UI nests it here.