@trusty-squire/mcp 1.1.6 → 1.1.7

package/dist/bot/provision-session.js

@@ -16,6 +16,7 @@
 //  - no credential is ever read back to the agent except via the explicit
 //    `finish`/extract path; the vault stays write-only.
 import { createHash, randomInt, randomUUID } from "node:crypto";
+import { Buffer } from "node:buffer";
 import { chmodSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -26,9 +27,9 @@ import { pickVerificationLink } from "./email-verification.js";
 import { detectActiveProviderSessions, ensureOAuthSession } from "./google-login.js";
 import { loggedInEmail } from "./login-state.js";
 import { loginSessionGuidance } from "./skill-hint.js";
-import { checkSuccessSignal, isSingleUseUrl, writeRecipe, } from "./operator-recipe.js";
+import { checkSuccessSignal, bindKnownEmailTemplate, bindRecipePostcondition, bindRecipeTarget, bindRecipeValue, cssEscapeRecipeValue, fillTemplate, hasRecipeTargetCandidate, isSingleUseUrl, knownRecipeInputValue, operatorRecipeDomain, resolveRecipeFieldTarget, resolveRecipeRepairTarget, resolveRecipeTarget, verifyFilledFieldValues, writeRecipe, } from "./operator-recipe.js";
 import { captureOnboardingRound, currentRunId, resetCaptureChain, resolveCaptureDir, } from "./onboarding-capture.js";
-import { promoteToSkill } from "./promote-to-skill.js";
+import { promoteToSkill, pickRowDisambiguator, pickStableDomHint, pickHrefHint, } from "./promote-to-skill.js";
 import { serviceSlugFromHost } from "@trusty-squire/skill-schema";
 import { looksLikeCodeIdentifier, looksLikeCredentialValue, isCredentialNoise, findCredentialTokens, keyFamilyPrefix, pickRelaxedNearCopyCredential, } from "./credential-shape.js";
 import { initialExtractionState, accumulateCandidate, hasFullHit, resolveExtraction, } from "./extraction.js";
@@ -54,6 +55,119 @@ function egressSeedHosts(session) {
     return session.allowedHosts.filter((e) => e.source !== "mid_session").map((e) => e.host);
 }
 const sessions = new Map();
+function positiveEnvNumber(name, fallback) {
+    const value = Number(process.env[name]);
+    return Number.isFinite(value) && value > 0 ? value : fallback;
+}
+const WARM_BROWSER_IDLE_TTL_MS = positiveEnvNumber("BOT_WARM_BROWSER_IDLE_TTL_MS", 6 * 60 * 60 * 1_000);
+const WARM_BROWSER_MAX_REUSES = positiveEnvNumber("BOT_WARM_BROWSER_MAX_REUSES", 50);
+const WARM_BROWSER_MAX_AGE_MS = positiveEnvNumber("BOT_WARM_BROWSER_MAX_AGE_MS", 24 * 60 * 60 * 1_000);
+let warmBrowser = null;
+let warmBrowserIdleTimer = null;
+// Sequential single-page model: one start may be booting OR one task may hold
+// the browser. This is also the lifecycle/payment safety lease — every reaper
+// checks it before closing shared Chrome.
+let starting = false;
+let inFlight = false;
+function clearWarmBrowserIdleTimer() {
+    if (warmBrowserIdleTimer === null)
+        return;
+    clearTimeout(warmBrowserIdleTimer);
+    warmBrowserIdleTimer = null;
+}
+async function closeWarmBrowserIfIdle(reason) {
+    if (warmBrowser === null)
+        return false;
+    if (starting || inFlight) {
+        armWarmBrowserIdleTimer();
+        return false;
+    }
+    const browser = warmBrowser.controller;
+    warmBrowser = null;
+    clearWarmBrowserIdleTimer();
+    console.error(`[operator] recycling warm browser reason=${reason}`);
+    await browser.close().catch(() => undefined);
+    return true;
+}
+function armWarmBrowserIdleTimer() {
+    clearWarmBrowserIdleTimer();
+    if (warmBrowser === null)
+        return;
+    warmBrowserIdleTimer = setTimeout(() => {
+        warmBrowserIdleTimer = null;
+        void closeWarmBrowserIfIdle("idle_ttl");
+    }, WARM_BROWSER_IDLE_TTL_MS);
+    warmBrowserIdleTimer.unref();
+}
+// Every operate call reaches this module through start or a session lookup.
+// Resetting the one unref'd timer here measures genuine operator quiet.
+function touchWarmBrowser() {
+    armWarmBrowserIdleTimer();
+}
+function warmBrowserExpired(slot) {
+    if (slot.reuseCount >= WARM_BROWSER_MAX_REUSES)
+        return "max_reuses";
+    if (Date.now() - slot.createdAt >= WARM_BROWSER_MAX_AGE_MS)
+        return "max_age";
+    return null;
+}
+async function acquireWarmBrowser(opts, sessionId) {
+    const slot = warmBrowser;
+    if (slot !== null) {
+        const expired = warmBrowserExpired(slot);
+        const eligible = slot.controller.matchesLaunchOptions(opts);
+        const healthy = slot.controller.isConnected();
+        if (expired !== null || !eligible || !healthy) {
+            warmBrowser = null;
+            clearWarmBrowserIdleTimer();
+            await slot.controller.close().catch(() => undefined);
+            audit(sessionId, "browser_recycle", {
+                reason: expired ?? (!eligible ? "launch_config_mismatch" : "disconnected"),
+            });
+        }
+        else {
+            try {
+                await slot.controller.resetPageForReuse();
+                slot.reuseCount += 1;
+                touchWarmBrowser();
+                audit(sessionId, "browser_reuse", { reuse_count: slot.reuseCount });
+                return slot.controller;
+            }
+            catch {
+                warmBrowser = null;
+                clearWarmBrowserIdleTimer();
+                await slot.controller.close().catch(() => undefined);
+                audit(sessionId, "browser_recycle", { reason: "page_reset_failed" });
+            }
+        }
+    }
+    const controller = new BrowserController({
+        ...(opts.profileDir !== undefined ? { profileDir: opts.profileDir } : {}),
+        ...(opts.proxyUrl !== undefined ? { proxyUrl: opts.proxyUrl } : {}),
+    });
+    await startBrowserBounded(controller, sessionId);
+    warmBrowser = { controller, createdAt: Date.now(), reuseCount: 0 };
+    touchWarmBrowser();
+    return controller;
+}
+async function releaseWarmBrowserPage(browser) {
+    if (warmBrowser?.controller !== browser) {
+        await browser.close().catch(() => undefined);
+        return;
+    }
+    try {
+        await browser.resetPageForReuse();
+    }
+    catch {
+        warmBrowser = null;
+        clearWarmBrowserIdleTimer();
+        await browser.close().catch(() => undefined);
+    }
+}
+function sessionForCall(sessionId) {
+    touchWarmBrowser();
+    return sessions.get(sessionId);
+}
 const settle = (ms) => new Promise((r) => setTimeout(r, ms));
 // Audit trail (security posture): every session action emits one structured
 // stderr line the host's MCP log captures. The `provision-audit` marker makes
@@ -948,38 +1062,70 @@ export function googleSessionGate(liveProviders) {
         },
     };
 }
-async function ensureProvisionPrimaryProviderSession(profileDir) {
-    const initial = await detectActiveProviderSessions(profileDir).catch(() => []);
+async function ensureProvisionPrimaryProviderSession(opts, sessionId) {
+    const slot = warmBrowser;
+    if (slot !== null) {
+        const expired = warmBrowserExpired(slot);
+        const eligible = slot.controller.matchesLaunchOptions(opts);
+        const healthy = slot.controller.isConnected();
+        if (expired === null && eligible && healthy) {
+            const warmProviders = await slot.controller.detectSessionProviders();
+            if (warmProviders.includes("google")) {
+                touchWarmBrowser();
+                return warmProviders;
+            }
+        }
+        warmBrowser = null;
+        clearWarmBrowserIdleTimer();
+        await slot.controller.close().catch(() => undefined);
+        audit(sessionId, "browser_recycle", {
+            reason: expired ??
+                (!eligible
+                    ? "launch_config_mismatch"
+                    : !healthy
+                        ? "disconnected"
+                        : "identity_probe_requires_cold_boot"),
+        });
+    }
+    const initial = await detectActiveProviderSessions(opts.profileDir).catch(() => []);
     if (initial.includes("google"))
         return initial;
     const result = await ensureOAuthSession({
         provider: "google",
-        ...(profileDir !== undefined ? { profileDir } : {}),
+        ...(opts.profileDir !== undefined ? { profileDir: opts.profileDir } : {}),
     });
     if (result.status !== "already_valid" && result.status !== "logged_in") {
         return initial;
     }
-    const after = await detectActiveProviderSessions(profileDir).catch(() => []);
+    const after = await detectActiveProviderSessions(opts.profileDir).catch(() => []);
     return after.includes("google") ? after : ["google", ...after];
 }
 export async function startProvisionSession(opts) {
     const id = randomUUID();
-    const liveProviders = await ensureProvisionPrimaryProviderSession(opts.profileDir);
-    // Change 5 — fail-closed identity gate BEFORE driving. If an operate task
-    // needs to act as the user and there's no live Google session, hand back now;
-    // do not start the browser or the task. No autonomous login is attempted.
-    if (opts.requireLiveIdentity === true) {
-        const gate = googleSessionGate(liveProviders);
-        if (!gate.ok) {
-            audit(id, "connect_gate", { ok: false, wall: "google_session" });
-            return { session_id: id, url: "", text: "", elements: [], needs_user: gate.needs_user };
-        }
-    }
-    const browser = new BrowserController({
-        ...(opts.profileDir !== undefined ? { profileDir: opts.profileDir } : {}),
-        ...(opts.proxyUrl !== undefined ? { proxyUrl: opts.proxyUrl } : {}),
-    });
-    await startBrowserBounded(browser, id);
+    touchWarmBrowser();
+    if (starting || inFlight) {
+        throw new Error("operate_start refused: another operator session is already in flight");
+    }
+    starting = true;
+    let browser;
+    let liveProviders;
+    try {
+        liveProviders = await ensureProvisionPrimaryProviderSession(opts, id);
+        // Change 5 — fail-closed identity gate BEFORE driving. If an operate task
+        // needs to act as the user and there's no live Google session, hand back now;
+        // do not start the browser or the task. No autonomous login is attempted.
+        if (opts.requireLiveIdentity === true) {
+            const gate = googleSessionGate(liveProviders);
+            if (!gate.ok) {
+                audit(id, "connect_gate", { ok: false, wall: "google_session" });
+                return { session_id: id, url: "", text: "", elements: [], needs_user: gate.needs_user };
+            }
+        }
+        browser = await acquireWarmBrowser(opts, id);
+    }
+    finally {
+        starting = false;
+    }
     const targetHost = registrableHost(opts.serviceUrl);
     const seedHosts = [
         ...(targetHost !== null ? [targetHost] : []),
@@ -1002,8 +1148,12 @@ export async function startProvisionSession(opts) {
         prevObserve: null,
         observeSnapshotFile: null,
         actionTrace: [],
+        recordedValues: [],
+        committedSelectValues: new Map(),
         captureRounds: [],
         usedLocatorFallback: false,
+        recipeRejectionReason: null,
+        replayState: null,
         startedAt: Date.now(),
         hintServed: opts.hint !== undefined,
         startUrl: opts.serviceUrl,
@@ -1012,45 +1162,55 @@ export async function startProvisionSession(opts) {
         ...(opts.api !== undefined ? { api: opts.api } : {}),
     };
     sessions.set(id, session);
-    audit(id, "start", {
-        service_url: opts.serviceUrl,
-        allowed_hosts: hostStrings(session),
-        has_hint: opts.hint !== undefined,
-    });
-    await browser.goto(opts.serviceUrl);
-    // A cookie/consent overlay (Usercentrics/OneTrust/…) renders after load and its
-    // backdrop occludes the ENTIRE form — the agent then sees every element
-    // occluded_by a div and gives up, or falls back to the only thing that looks
-    // clickable (e.g. a "Connect wallet" CTA on the Robinhood faucet). Dismiss it
-    // BEFORE the first observation so the real actionable form is operable.
-    // dismissConsentBanner() existed but had NO call sites (dead code); it only
-    // clicks banner-specific CTAs (accept/reject all), so a false click is unlikely.
-    // Best-effort + one retry, since the widget lazy-loads a beat after the goto.
-    for (let attempt = 0; attempt < 2; attempt++) {
-        const cta = await browser.dismissConsentBanner().catch(() => null);
-        if (cta !== null) {
-            audit(id, "consent_dismissed", { cta });
-            break;
+    inFlight = true;
+    try {
+        audit(id, "start", {
+            service_url: opts.serviceUrl,
+            allowed_hosts: hostStrings(session),
+            has_hint: opts.hint !== undefined,
+        });
+        await browser.goto(opts.serviceUrl);
+        // A cookie/consent overlay (Usercentrics/OneTrust/…) renders after load and its
+        // backdrop occludes the ENTIRE form — the agent then sees every element
+        // occluded_by a div and gives up, or falls back to the only thing that looks
+        // clickable (e.g. a "Connect wallet" CTA on the Robinhood faucet). Dismiss it
+        // BEFORE the first observation so the real actionable form is operable.
+        // dismissConsentBanner() existed but had NO call sites (dead code); it only
+        // clicks banner-specific CTAs (accept/reject all), so a false click is unlikely.
+        // Best-effort + one retry, since the widget lazy-loads a beat after the goto.
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const cta = await browser.dismissConsentBanner().catch(() => null);
+            if (cta !== null) {
+                audit(id, "consent_dismissed", { cta });
+                break;
+            }
+            if (attempt === 0)
+                await browser.waitForCaptchaChallengeToSettle(800, 0).catch(() => false);
         }
-        if (attempt === 0)
-            await browser.waitForCaptchaChallengeToSettle(800, 0).catch(() => false);
+        const observation = await observeSession(session);
+        // Tell the agent which provider the user actually has a live session for
+        // (Google-preferred) — the bot knows from the profile cookies, so the agent
+        // doesn't have to guess. Composed with the skill route hint (if any).
+        const hintParts = [
+            loginSessionGuidance(liveProviders),
+            ...(opts.hint !== undefined ? [opts.hint] : []),
+        ];
+        return {
+            ...observation,
+            hint: hintParts.join("\n"),
+            ...(session.userEmail !== null ? { user_email: session.userEmail } : {}),
+        };
+    }
+    catch (err) {
+        sessions.delete(id);
+        await releaseWarmBrowserPage(browser);
+        inFlight = false;
+        touchWarmBrowser();
+        throw err;
     }
-    const observation = await observeSession(session);
-    // Tell the agent which provider the user actually has a live session for
-    // (Google-preferred) — the bot knows from the profile cookies, so the agent
-    // doesn't have to guess. Composed with the skill route hint (if any).
-    const hintParts = [
-        loginSessionGuidance(liveProviders),
-        ...(opts.hint !== undefined ? [opts.hint] : []),
-    ];
-    return {
-        ...observation,
-        hint: hintParts.join("\n"),
-        ...(session.userEmail !== null ? { user_email: session.userEmail } : {}),
-    };
 }
 export async function observe(sessionId, detail = "compact") {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     return await observeSession(session, detail);
@@ -1059,7 +1219,7 @@ export async function observe(sessionId, detail = "compact") {
 // session: start + auto_widen, NEVER mid_session task scope (a wide multi-app
 // operate scope must not silently over-grant a key's egress allow-list).
 export function observedHostsForSession(sessionId) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     widenAllowedHostsFromCurrentUrl(session);
@@ -1080,7 +1240,7 @@ export function maskSecretValue(value) {
 // host — a later type_secret enters it into another site's form. Extends the
 // write-only-vault moat to in-session credential transfer.
 export function stashSecretSlot(sessionId, slot, value) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     session.secretSlots.set(slot, value);
@@ -1094,7 +1254,7 @@ export function stashSecretSlot(sessionId, slot, value) {
 // signup password to the vault after the service account is created. Never
 // expose this value in a tool response or recipe trace.
 export function readSecretSlotValue(sessionId, slot) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const value = session.secretSlots.get(slot);
@@ -1103,7 +1263,7 @@ export function readSecretSlotValue(sessionId, slot) {
     return value;
 }
 export function currentProvisionUrl(sessionId) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     return session.browser.currentUrl();
@@ -1111,19 +1271,60 @@ export function currentProvisionUrl(sessionId) {
 // operate_pay has a deliberately small input contract with no session id: it
 // acts on the one live operator checkout. Fail closed rather than guessing if
 // zero or multiple browser sessions exist.
-export function activeProvisionBrowser() {
+function activeProvisionSession() {
+    touchWarmBrowser();
     if (sessions.size !== 1) {
         throw new Error(sessions.size === 0
             ? "operate_pay requires one active operate_start browser session"
             : "operate_pay refused: multiple active browser sessions");
     }
-    return sessions.values().next().value.browser;
+    const session = sessions.values().next().value;
+    if (session.replayState?.moneyPath === true && session.replayState.paymentGuard !== "verified") {
+        throw new Error("operate_pay refused: replay address/contact/quantity verification is not satisfied");
+    }
+    return session;
+}
+export function activeProvisionBrowser() {
+    return activeProvisionSession().browser;
+}
+export async function activeProvisionBrowserForPayment() {
+    const session = activeProvisionSession();
+    const state = session.replayState;
+    if (state?.moneyPath !== true)
+        return session.browser;
+    const fresh = await session.browser.extractInteractiveElements();
+    session.lastElements = fresh;
+    for (const expected of state.expectedFields.values()) {
+        if (!state.verifiedFields.has(expected.stepIndex))
+            continue;
+        if (!(await isReplayFieldMounted(session, expected, fresh))) {
+            markReplayFailure(session, "field_missing", expected.hole);
+            throw new Error("operate_pay refused: replay address/contact/quantity verification is not satisfied");
+        }
+        const guard = await verifyReplayFieldWithElements(session, expected, fresh);
+        if (!guard.ok) {
+            markReplayFailure(session, guard.reason, expected.hole);
+            throw new Error("operate_pay refused: replay address/contact/quantity verification is not satisfied");
+        }
+    }
+    return session.browser;
+}
+export function recordActivePaymentProvenance(cardRef) {
+    if (sessions.size !== 1)
+        return;
+    const session = sessions.values().next().value;
+    const last = session.actionTrace.at(-1)?.action;
+    if (last?.kind === "operate_pay")
+        return;
+    const traceIndex = session.actionTrace.length;
+    session.actionTrace.push({ action: { kind: "operate_pay", value: { hole: "card" } } });
+    session.recordedValues.push({ traceIndex, hole: "card", literal: cardRef });
 }
 // PR3c — the user's own email captured at login (the authoritative signup
 // address), or null when none was captured. The tool layer reads this to fill
 // username/password signups so the account is user-owned.
 export function getSessionUserEmail(sessionId) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     return session.userEmail;
@@ -1649,10 +1850,17 @@ async function observeSession(session, detail = "compact") {
     };
 }
 export async function act(sessionId, action, detail = "compact") {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
+    if (action.kind === "type_secret" &&
+        action.provenance !== undefined &&
+        action.provenance.hole !== `credential.${action.slot}`) {
+        throw new Error(`type_secret provenance must match the authoritative slot credential.${action.slot}`);
+    }
     const { browser } = session;
+    let completedAction = action;
+    let sensitiveSource;
     const auditTarget = "target" in action && parseLocatorTarget(action.target) !== null
         ? "<mode>=<redacted>"
         : "target" in action
@@ -1687,6 +1895,7 @@ export async function act(sessionId, action, detail = "compact") {
                 `The operator may not act on the Trusty Squire vault/app — navigate away with goto.`);
         }
     }
+    const recordingTransitionFields = await attestRecordedFieldsBeforeTransition(session, action);
     // Captured for the operator-recipe trace: the element a target action
     // resolved to, so we record the VISIBLE text it acted on (not the ref).
     let resolvedEl = null;
@@ -1730,6 +1939,11 @@ export async function act(sessionId, action, detail = "compact") {
                     `operate_extract { into_slot: "${action.slot}" }. Known slots: ` +
                     `[${[...session.secretSlots.keys()].join(", ")}]`);
             }
+            sensitiveSource = {
+                traceIndex: -1,
+                hole: `credential.${action.slot}`,
+                literal: value,
+            };
             const fresh = await browser.extractInteractiveElements();
             session.lastElements = fresh;
             // resolveTarget recomputes identities (incl. volatile positional-group
@@ -1769,7 +1983,9 @@ export async function act(sessionId, action, detail = "compact") {
                         .join(", "));
             }
             resolvedEl = el;
-            await browser.selectOption(el.selector, action.text);
+            const committedText = await browser.selectOption(el.selector, action.text);
+            session.committedSelectValues.set(el.selector, committedText);
+            completedAction = { ...action, text: committedText };
             await settleAfterStateChange(browser);
             break;
         }
@@ -1862,8 +2078,10 @@ export async function act(sessionId, action, detail = "compact") {
                 await browser.click(el.selector);
             else if (action.kind === "js_click")
                 await browser.clickViaJs(el.selector);
-            else if (action.kind === "type")
+            else if (action.kind === "type") {
+                session.committedSelectValues.delete(el.selector);
                 await browser.type(el.selector, action.text);
+            }
             else if (action.kind === "upload") {
                 await browser.uploadFile(el.selector, action.path);
                 audit(sessionId, "upload", {
@@ -1879,12 +2097,15 @@ export async function act(sessionId, action, detail = "compact") {
             break;
         }
     }
+    await verifyRecordedFieldsAfterTransition(session, action, recordingTransitionFields);
+    await captureReplayRepairVerification(session, completedAction, resolvedEl);
+    await refreshReplayVerificationAfterAction(session, completedAction, resolvedEl);
     // Don't fold inbox-provider steps into the replayable recipe (see
     // INBOX_READ_HOSTS): replay re-reads the code via awaitVerification, and a
     // recorded inbox click would bake the email's subject into a shared recipe.
     if (!isInboxReadHost(browser.currentUrl())) {
-        recordTrace(session, action, resolvedEl);
-        recordCaptureRound(session, action, resolvedEl, urlBeforeAction);
+        recordTrace(session, completedAction, resolvedEl, sensitiveSource);
+        recordCaptureRound(session, completedAction, resolvedEl, urlBeforeAction);
     }
     // `detail:"none"` returns a minimal ack (the action ran; no perception emitted)
     // so multi-field fills don't each echo the page. The host must call
@@ -1909,6 +2130,71 @@ export async function act(sessionId, action, detail = "compact") {
 // name keeps its legacy form for corpus compatibility (validateReplayGraph and
 // published skills key off it); it now means "the email to fill", not a Squire alias.
 const EMAIL_SLOT_TEMPLATE = "${EMAIL_ALIAS}";
+function regexEscape(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function nestedPercentByte(byte) {
+    return `%(?:25)*${byte.toString(16).padStart(2, "0")}`;
+}
+function encodedCharacterPattern(char) {
+    const raw = regexEscape(char);
+    const percent = [...Buffer.from(char)].map(nestedPercentByte).join("");
+    const encoded = `(?:${raw}|${percent})`;
+    const slash = `(?:\\\\|${nestedPercentByte(0x5c)})`;
+    const cssSimple = /[a-zA-Z0-9_-]/.test(char) ? null : `${slash}${encoded}`;
+    const cssHex = `${slash}${[...char.codePointAt(0).toString(16)]
+        .map((digit) => `(?:${digit}|${nestedPercentByte(digit.charCodeAt(0))})`)
+        .join("")}(?:(?:\\s|${nestedPercentByte(0x20)}))?`;
+    return `(?:${[encoded, cssSimple, cssHex].filter(Boolean).join("|")})`;
+}
+function decodeUriLayer(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function decodeCssLayer(value) {
+    return value.replace(/\\([0-9a-f]{1,6})(?:\r\n|[\t\n\f\r ])?|\\([^\r\n\f])/gi, (_match, hex, escaped) => hex === undefined ? (escaped ?? "") : String.fromCodePoint(Number.parseInt(hex, 16)));
+}
+function applyEmailEncoding(value, operations) {
+    return operations.reduce((encoded, operation) => operation === "URI" ? encodeURIComponent(encoded) : cssEscapeRecipeValue(encoded), value);
+}
+function emailTemplateForRepresentation(representation, email) {
+    const queue = [
+        { value: representation, inverse: [] },
+    ];
+    const seen = new Set();
+    let fallback = null;
+    while (queue.length > 0 && seen.size <= 4096) {
+        const current = queue.shift();
+        const key = `${current.value}\0${current.inverse.join("_")}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (current.value.toLowerCase() === email.toLowerCase()) {
+            const operations = [...current.inverse].reverse();
+            if (applyEmailEncoding(email, operations).toLowerCase() === representation.toLowerCase()) {
+                return `\${EMAIL_ALIAS${operations.map((operation) => `_${operation}`).join("")}}`;
+            }
+            fallback ??= operations;
+            continue;
+        }
+        const uriDecoded = decodeUriLayer(current.value);
+        if (uriDecoded !== current.value) {
+            queue.push({ value: uriDecoded, inverse: [...current.inverse, "URI"] });
+        }
+        const cssDecoded = decodeCssLayer(current.value);
+        if (cssDecoded !== current.value) {
+            queue.push({ value: cssDecoded, inverse: [...current.inverse, "CSS"] });
+        }
+    }
+    return fallback === null
+        ? null
+        : `\${EMAIL_ALIAS${fallback.map((operation) => `_${operation}`).join("")}}`;
+}
+const REPLAY_VERIFIED_HOLE = /^(?:address|contact)(?:\.|$)|^quantity$/;
 function looksLikeEmailValue(v) {
     return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v.trim());
 }
@@ -1925,12 +2211,25 @@ export function redactEmailForTrace(value) {
 // NOT a vector here — that path belonged to the retired autonomous bot and is
 // not wired into operate_*.) Exported for unit tests.
 export function scrubKnownEmail(s, userEmail) {
-    if (userEmail === null || userEmail.length === 0 || !s.includes(userEmail))
+    if (userEmail === null || userEmail.length === 0)
         return s;
-    return s.split(userEmail).join(EMAIL_SLOT_TEMPLATE);
+    const pattern = [...userEmail].map(encodedCharacterPattern).join("");
+    return s.replace(new RegExp(pattern, "gi"), (matched) => {
+        const template = emailTemplateForRepresentation(matched, userEmail);
+        if (template === null) {
+            throw new Error("known email encoding could not be provenance-templated");
+        }
+        return template;
+    });
 }
-// Append a TEXT-targeted entry to the session's operator-recipe trace. Stores
-// the visible text the action hit (never a ref/coordinate) + non-secret params.
+function assertRecipeEmailScrubbed(recipe, userEmail) {
+    const serialized = JSON.stringify(recipe);
+    if (scrubKnownEmail(serialized, userEmail) !== serialized) {
+        throw new Error("operate_remember refused: known email remains in serialized recipe data");
+    }
+}
+// Append a stable-attribute-targeted entry to the session's operator-recipe
+// trace. Stores no ref/coordinate; visible text remains a unique-only fallback.
 // `extract` (the seal) is recorded separately in stashSecretSlot.
 function traceTextFor(el) {
     if (el === null)
@@ -1939,7 +2238,71 @@ function traceTextFor(el) {
     const first = keys[0];
     return typeof first === "string" && first.length > 0 ? first.slice(0, 120) : undefined;
 }
-function recordTrace(session, action, el) {
+// Stable attributes already present in the inventory and consumed by the
+// skill synthesizer. Keep all of them; replay chooses in a fixed order.
+export function recipeTargetFor(el, inventory = [], userEmail = null) {
+    if (el === null)
+        return undefined;
+    const role = el.role ??
+        (el.tag === "button"
+            ? "button"
+            : el.tag === "a"
+                ? "link"
+                : el.tag === "input" || el.tag === "textarea"
+                    ? "textbox"
+                    : undefined);
+    const accessibleName = el.ariaLabel ??
+        el.labelText ??
+        el.visibleText ??
+        el.iconLabel ??
+        el.placeholder ??
+        el.title ??
+        el.name ??
+        undefined;
+    const siblings = inventory.filter((candidate) => {
+        if (candidate === el || candidate.selector === el.selector)
+            return false;
+        const candidateName = candidate.ariaLabel ??
+            candidate.labelText ??
+            candidate.visibleText ??
+            candidate.iconLabel ??
+            candidate.placeholder ??
+            candidate.title ??
+            candidate.name ??
+            undefined;
+        return ((el.testId !== null && el.testId !== undefined && candidate.testId === el.testId) ||
+            (el.id !== null && candidate.id === el.id) ||
+            (el.name !== null && candidate.name === el.name) ||
+            (accessibleName !== undefined && candidateName === accessibleName) ||
+            (el.href !== null && el.href !== undefined && candidate.href === el.href));
+    });
+    const nearText = siblings.length > 0 ? pickRowDisambiguator(el, siblings, inventory) : null;
+    const domHint = pickStableDomHint(el);
+    const hrefHint = pickHrefHint(el);
+    const scrub = (value) => scrubKnownEmail(value, userEmail);
+    return {
+        ...(domHint !== undefined
+            ? {
+                dom_hint: {
+                    ...(domHint.testid !== undefined ? { testid: scrub(domHint.testid) } : {}),
+                    ...(domHint.id !== undefined ? { id: scrub(domHint.id) } : {}),
+                    ...(domHint.name !== undefined ? { name: scrub(domHint.name) } : {}),
+                },
+            }
+            : {}),
+        ...(role !== undefined && role.length > 0 ? { role_hint: scrub(role) } : {}),
+        ...(accessibleName !== undefined && accessibleName.length > 0
+            ? { accessible_name: scrub(accessibleName) }
+            : {}),
+        ...(nearText !== null ? { near_text_hint: scrub(nearText) } : {}),
+        ...(hrefHint !== null && !isSingleUseUrl(el.href ?? "") ? { href_hint: scrub(hrefHint) } : {}),
+        ...(el.selector.length > 0 ? { css: scrub(el.selector) } : {}),
+        ...(el.visibleText !== null && el.visibleText.length > 0
+            ? { visible_text: scrub(el.visibleText) }
+            : {}),
+    };
+}
+function recordTrace(session, action, el, sensitiveSource) {
     // Never freeze a single-use link (email-verify / magic / reset token) into
     // the recipe — it's dead on the next replay. The host agent re-plans the
     // verification step live (operate_await_verification fetches a FRESH link)
@@ -1960,24 +2323,24 @@ function recordTrace(session, action, el) {
     // shared recipe. Skip it here (the action is still in the audit trail).
     if (action.kind === "upload")
         return;
-    // A native/custom-select pick isn't yet in the portable recipe vocabulary
-    // (TraceAction has no `select` kind). Skip it from the trace like upload — the
-    // action still runs and is audited. Selects were never traceable before this
-    // kind existed, so nothing regresses; wiring select into the replay engine is
-    // a follow-up for when a signup flow needs a replayable dropdown.
-    if (action.kind === "select")
-        return;
-    // set_phone_country has no portable TraceAction kind either — the country is
-    // host-replannable per run, not baked into a shared recipe. Skip like select.
-    if (action.kind === "set_phone_country")
-        return;
+    const knownEmailHole = action.kind === "type" &&
+        action.provenance === undefined &&
+        session.userEmail !== null &&
+        action.text === session.userEmail
+        ? "contact.email"
+        : undefined;
+    const actionHole = action.kind === "type" || action.kind === "select" || action.kind === "set_phone_country"
+        ? (action.provenance?.hole ?? knownEmailHole)
+        : undefined;
     const rawText = traceTextFor(el);
     const text = rawText !== undefined ? scrubKnownEmail(rawText, session.userEmail) : undefined;
     const withText = text !== undefined ? { text_match: text } : {};
+    const target = recipeTargetFor(el, session.lastElements, session.userEmail);
+    const withTarget = target !== undefined ? { target } : {};
     let a;
     switch (action.kind) {
         case "goto":
-            a = { kind: "goto", url_template: action.url };
+            a = { kind: "goto", url_template: scrubKnownEmail(action.url, session.userEmail) };
             break;
         case "allow_host":
             a = { kind: "allow_host", host: action.host };
@@ -1998,23 +2361,58 @@ function recordTrace(session, action, el) {
             a = {
                 kind: "type",
                 ...withText,
+                ...withTarget,
                 value: scrubKnownEmail(redactEmailForTrace(action.text), session.userEmail),
             };
             break;
         case "type_secret":
-            a = { kind: "type_secret", slot: action.slot, ...withText };
+            a = {
+                kind: "type_secret",
+                slot: action.slot,
+                value: { hole: `credential.${action.slot}` },
+                ...withText,
+                ...withTarget,
+            };
+            break;
+        case "select":
+            a = {
+                kind: "select",
+                value: action.text,
+                ...withText,
+                ...withTarget,
+            };
+            break;
+        case "set_phone_country":
+            a = {
+                kind: "set_phone_country",
+                value: action.country,
+            };
             break;
         case "click":
-            a = { kind: "click", ...withText };
+            a = { kind: "click", ...withText, ...withTarget };
             break;
         case "js_click":
-            a = { kind: "js_click", ...withText };
+            a = { kind: "js_click", ...withText, ...withTarget };
             break;
         case "oauth_click":
-            a = { kind: "oauth_click", ...withText };
+            a = { kind: "oauth_click", ...withText, ...withTarget };
             break;
     }
+    const traceIndex = session.actionTrace.length;
     session.actionTrace.push({ action: a });
+    if (action.kind === "type" || action.kind === "select" || action.kind === "set_phone_country") {
+        session.recordedValues.push({
+            traceIndex,
+            ...(actionHole !== undefined ? { hole: actionHole } : {}),
+            literal: action.kind === "set_phone_country" ? action.country : action.text,
+        });
+    }
+    else if (action.kind === "type_secret") {
+        if (sensitiveSource === undefined) {
+            throw new Error(`type_secret ${action.slot} lacks an action-time source attestation`);
+        }
+        session.recordedValues.push({ ...sensitiveSource, traceIndex });
+    }
 }
 // ── Medium capture → skill (docs/DESIGN-operator-hints.md) ──────────────────
 // The service SLUG for the capture. It MUST be produced the same way
@@ -2104,7 +2502,7 @@ async function recordExtractRound(session) {
 // Best-effort: any failure returns a skip and never disrupts the parent
 // provision. The caller publishes the returned skill.
 export async function captureAndPromoteSession(sessionId) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         return { kind: "skipped", reason: "unknown_session" };
     // A run that used the text=/css= locator click fallback hit a control with no
@@ -2154,7 +2552,7 @@ export function buildProvisionMeasurement(args) {
 // stderr JSON so it aggregates like the other provision-audit lines. This is the
 // raw signal deliverable #1 buckets into success-rate + time by hint_present.
 export function emitProvisionMeasurement(sessionId, outcome) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         return null;
     const m = buildProvisionMeasurement({
@@ -2179,30 +2577,157 @@ async function settleAfterStateChange(browser) {
     }
 }
 // ── operator-recipe: remember a successful run, verify a postcondition ──
-// Persist the session's action trace as a named, replayable operator-recipe.
+// Persist the session's action trace as a keyed, replayable operator-recipe.
 // Sealed secrets become SLOT references (stored:false) — never values. The
 // recipe's scope = start + auto_widen hosts (mid_session crossings replay via
 // the trace's own allow_host steps).
+function verifiedEmailSources(session, inputs) {
+    return session.recordedValues.filter((source) => source.hole !== undefined &&
+        session.userEmail !== null &&
+        source.literal === session.userEmail &&
+        looksLikeEmailValue(source.literal) &&
+        knownRecipeInputValue(inputs, source.hole) === source.literal);
+}
+function traceWithVerifiedProvenance(session, inputs) {
+    const trace = session.actionTrace.map((entry) => ({
+        ...entry,
+        action: { ...entry.action },
+    }));
+    const recordedIndexes = new Set();
+    for (const source of session.recordedValues) {
+        if (recordedIndexes.has(source.traceIndex)) {
+            throw new Error(`duplicate value source for trace step ${source.traceIndex}`);
+        }
+        recordedIndexes.add(source.traceIndex);
+        if (source.hole === undefined) {
+            throw new Error(`value at trace step ${source.traceIndex} lacks explicit provenance`);
+        }
+        const authoritative = knownRecipeInputValue(inputs, source.hole);
+        if (authoritative === undefined) {
+            throw new Error(`provenance ${source.hole} has no authoritative operate_remember input`);
+        }
+        if (authoritative !== source.literal) {
+            throw new Error(`provenance ${source.hole} does not match the injected value`);
+        }
+        const entry = trace[source.traceIndex];
+        if (entry === undefined) {
+            throw new Error(`provenance ${source.hole} is not bound to a recorded value action`);
+        }
+        if ((entry.action.kind === "type" ||
+            entry.action.kind === "select" ||
+            entry.action.kind === "set_phone_country") &&
+            typeof entry.action.value === "string") {
+            entry.action.value = { hole: source.hole };
+            continue;
+        }
+        if ((entry.action.kind === "type_secret" || entry.action.kind === "operate_pay") &&
+            typeof entry.action.value !== "string" &&
+            entry.action.value?.hole === source.hole) {
+            continue;
+        }
+        throw new Error(`provenance ${source.hole} is not bound to a recorded value action`);
+    }
+    const emailSources = verifiedEmailSources(session, inputs);
+    const emailHoles = new Set(emailSources.map((source) => source.hole));
+    for (const [traceIndex, entry] of trace.entries()) {
+        const targetText = JSON.stringify({
+            text_match: entry.action.text_match,
+            target: entry.action.target,
+            url_template: entry.action.url_template,
+        });
+        if (!targetText.includes("${EMAIL_ALIAS"))
+            continue;
+        const directEmailHole = emailSources.find((source) => source.traceIndex === traceIndex)?.hole;
+        if (directEmailHole === undefined && emailHoles.size !== 1) {
+            throw new Error("known-email target lacks one unambiguous action-time source hole");
+        }
+        const emailHole = directEmailHole ?? [...emailHoles][0];
+        entry.action.email_hole = emailHole;
+    }
+    for (const [traceIndex, entry] of trace.entries()) {
+        const value = entry.action.value;
+        if (value === undefined || typeof value === "string" || recordedIndexes.has(traceIndex)) {
+            continue;
+        }
+        throw new Error(`provenance ${value.hole} lacks an action-time source attestation`);
+    }
+    return trace;
+}
+function scrubRecipePostcondition(session, postcondition, inputs) {
+    const probeUrl = postcondition.probe_url === undefined
+        ? undefined
+        : scrubKnownEmail(postcondition.probe_url, session.userEmail);
+    const signal = postcondition.success_signal;
+    const successSignal = "url_contains" in signal
+        ? { url_contains: scrubKnownEmail(signal.url_contains, session.userEmail) }
+        : signal;
+    const hasTemplate = probeUrl?.includes("${EMAIL_ALIAS") === true ||
+        ("url_contains" in successSignal && successSignal.url_contains.includes("${EMAIL_ALIAS"));
+    const base = { kind: postcondition.kind, describe: postcondition.describe };
+    if (!hasTemplate) {
+        return {
+            ...base,
+            ...(probeUrl !== undefined ? { probe_url: probeUrl } : {}),
+            success_signal: successSignal,
+        };
+    }
+    const holes = [...new Set(verifiedEmailSources(session, inputs).map((source) => source.hole))];
+    if (holes.length !== 1) {
+        throw new Error("known-email postcondition lacks one unambiguous action-time source hole");
+    }
+    return {
+        ...base,
+        ...(probeUrl !== undefined ? { probe_url: probeUrl } : {}),
+        success_signal: successSignal,
+        email_hole: holes[0],
+    };
+}
 export async function rememberRecipe(sessionId, opts) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     if (session.usedLocatorFallback) {
         throw new Error("operate_remember refused: this session used a text=/css= locator fallback that operator recipes cannot represent");
     }
+    if (session.recipeRejectionReason !== null) {
+        throw new Error(`operate_remember refused: ${session.recipeRejectionReason}`);
+    }
+    if (opts.inputs === undefined) {
+        throw new Error("operate_remember refused: complete provenance inputs are required");
+    }
+    // Record only through the existing machine-checkable success gate. Previously
+    // operate_remember wrote first and operate_finish_task verified later, leaving
+    // an unverified recipe on disk when the postcondition failed.
+    const verified = await verifyPostcondition(sessionId, opts.postcondition);
+    if (!verified.confirmed) {
+        throw new Error(`operate_remember refused: postcondition not confirmed (${verified.reason})`);
+    }
     const secrets = [...session.secretSlots.keys()].map((slot) => ({ slot, stored: false }));
+    const scrubbedStartUrl = scrubKnownEmail(session.startUrl, session.userEmail);
+    const trace = traceWithVerifiedProvenance(session, opts.inputs);
+    const postcondition = scrubRecipePostcondition(session, opts.postcondition, opts.inputs);
     const recipe = {
         name: opts.name,
         schema_version: 1,
         goal: opts.goal,
+        ...(opts.verb !== undefined
+            ? { verb: opts.verb, domain: operatorRecipeDomain(session.startUrl) }
+            : {}),
         // Canonical, stable replay entry — the page the session started at, never a
         // mid-flow single-use link inferred from the trace.
-        entry_url: session.startUrl,
+        ...(isSingleUseUrl(session.startUrl) || scrubbedStartUrl !== session.startUrl
+            ? { entry_mode: "runtime_service_url" }
+            : { entry_url: session.startUrl }),
         allowed_hosts: [...new Set(egressSeedHosts(session))],
-        trace: session.actionTrace,
+        trace,
         secrets,
-        postcondition: opts.postcondition,
+        postcondition,
     };
+    assertRecipeEmailScrubbed(recipe, session.userEmail);
+    const unprovenancedMoneyField = findUnprovenancedMoneyField(recipe);
+    if (unprovenancedMoneyField !== null) {
+        throw new Error(`operate_remember refused: money field lacks provenance (${unprovenancedMoneyField})`);
+    }
     const file = await writeRecipe(recipe);
     audit(sessionId, "remember_recipe", {
         name: opts.name,
@@ -2210,7 +2735,13 @@ export async function rememberRecipe(sessionId, opts) {
         secrets: secrets.length,
         file,
     });
-    return { file, name: opts.name, steps: recipe.trace.length, secrets: secrets.map((s) => s.slot) };
+    return {
+        file,
+        name: opts.name,
+        steps: recipe.trace.length,
+        secrets: secrets.map((s) => s.slot),
+        verified,
+    };
 }
 // Read a single page snapshot for postcondition checking. Field VALUES are
 // reduced to lengths here so a token/secret success-signal can't leak.
@@ -2230,7 +2761,7 @@ async function snapshotForPostcondition(session) {
 // green gate for replay. execute_capability checks the current end-state;
 // observe_artifact navigates to the probe surface first (Phase B paces this).
 export async function verifyPostcondition(sessionId, postcondition) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     if (postcondition.kind === "observe_artifact" && postcondition.probe_url !== undefined) {
@@ -2250,6 +2781,660 @@ export async function verifyPostcondition(sessionId, postcondition) {
     });
     return result;
 }
+export async function verifySavedRecipePostcondition(sessionId, recipe) {
+    const session = sessions.get(sessionId);
+    if (session === undefined)
+        throw new Error(`unknown provision session ${sessionId}`);
+    const state = session.replayState;
+    if (state !== null && state.recipeHash === replayDigest(recipe)) {
+        return await verifyPostcondition(sessionId, state.boundPostcondition);
+    }
+    let postcondition;
+    try {
+        postcondition = bindRecipePostcondition(recipe.postcondition, {});
+    }
+    catch {
+        throw new Error("saved recipe postcondition requires bindings from its active replay");
+    }
+    return await verifyPostcondition(sessionId, postcondition);
+}
+export async function verifyActiveRecipePostcondition(sessionId, recipeName) {
+    const session = sessions.get(sessionId);
+    if (session === undefined)
+        throw new Error(`unknown provision session ${sessionId}`);
+    const state = session.replayState;
+    if (state === null)
+        return null;
+    if (state.recipeName !== recipeName) {
+        throw new Error(`verify_recipe ${recipeName} does not match active replay ${state.recipeName}`);
+    }
+    return await verifyPostcondition(sessionId, state.boundPostcondition);
+}
+const MONEY_REPLAY_VERBS = new Set([
+    "purchase",
+    "subscribe",
+    "checkout",
+    "renew",
+    "upgrade",
+    "book",
+    "reserve",
+]);
+function replayTarget(action) {
+    return action.target !== undefined
+        ? action.target
+        : action.text_match !== undefined
+            ? { visible_text: action.text_match }
+            : null;
+}
+function boundReplayTarget(action, bindings) {
+    const target = action.target !== undefined
+        ? action.target
+        : action.text_match !== undefined
+            ? { visible_text: action.text_match }
+            : null;
+    return target === null ? null : bindRecipeTarget(target, bindings, action.email_hole);
+}
+const MONEY_FIELD_TARGET = /(?:^|[\s._-])(?:address|street|line\s*[12]|city|state|province|postal|zip|country|e-?mail|phone|first\s*name|last\s*name|full\s*name|quantity|qty)(?:$|[\s._-])/i;
+function moneyFieldName(action) {
+    if (action.kind === "set_phone_country")
+        return "phone_country";
+    if (action.kind !== "type" && action.kind !== "select")
+        return null;
+    const target = replayTarget(action);
+    if (target === null)
+        return null;
+    const label = [
+        target.dom_hint?.testid,
+        target.dom_hint?.id,
+        target.dom_hint?.name,
+        target.accessible_name,
+        target.visible_text,
+    ]
+        .filter((value) => value !== undefined)
+        .join(" ")
+        .replace(/([a-z])([A-Z])/g, "$1 $2");
+    return MONEY_FIELD_TARGET.test(label) ? label || "field" : null;
+}
+function findUnprovenancedMoneyField(recipe) {
+    if (recipe.verb === undefined || !MONEY_REPLAY_VERBS.has(recipe.verb))
+        return null;
+    for (const { action } of recipe.trace) {
+        const field = moneyFieldName(action);
+        if (field !== null && typeof action.value === "string")
+            return field;
+    }
+    return null;
+}
+function replayDigest(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function bindingDigest(bindings) {
+    return replayDigest(Object.entries(bindings)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, value]) => [key, value]));
+}
+function expectedReplayFields(recipe, bindings) {
+    const fields = new Map();
+    for (let stepIndex = 0; stepIndex < recipe.trace.length; stepIndex += 1) {
+        const action = recipe.trace[stepIndex].action;
+        const unprovenanced = moneyFieldName(action);
+        if (unprovenanced !== null && typeof action.value === "string") {
+            return { fields, missing: unprovenanced };
+        }
+        if ((action.kind !== "type" && action.kind !== "select" && action.kind !== "set_phone_country") ||
+            action.value === undefined ||
+            typeof action.value === "string" ||
+            !REPLAY_VERIFIED_HOLE.test(action.value.hole)) {
+            continue;
+        }
+        const expected = bindings[action.value.hole];
+        if (expected === undefined)
+            return { fields, missing: action.value.hole };
+        let target;
+        try {
+            target = boundReplayTarget(action, bindings);
+        }
+        catch {
+            return { fields, missing: action.email_hole ?? "email_target" };
+        }
+        fields.set(stepIndex, {
+            stepIndex,
+            hole: action.value.hole,
+            expected,
+            target,
+            kind: action.kind,
+        });
+    }
+    return { fields, missing: null };
+}
+function markReplayFailure(session, reason, field) {
+    rejectRecipeRecording(session, `replay transition failed (${field}: ${reason})`);
+    if (session.replayState === null)
+        return;
+    session.replayState.paymentGuard = "failed";
+    session.replayState.failure = { reason, field };
+    audit(session.id, "replay_field_value_guard", { ok: false, reason, field });
+}
+function verifyReplayFieldInElements(session, expected, elements, allowCommittedSelect = false) {
+    if (expected.kind === "set_phone_country" || expected.target === null) {
+        return { ok: false, reason: "field_missing" };
+    }
+    const resolution = resolveRecipeFieldTarget(elements, expected.target);
+    if (resolution === null)
+        return { ok: false, reason: "field_missing" };
+    const guard = verifyFilledFieldValues(elements, [
+        {
+            target: expected.target,
+            expected: expected.expected,
+            hole: expected.hole,
+            kind: expected.kind === "select" ? "select" : "type",
+        },
+    ]);
+    if (guard.ok) {
+        if (expected.kind === "select") {
+            session.committedSelectValues.delete(resolution.element.selector);
+        }
+        return { ok: true };
+    }
+    if (allowCommittedSelect &&
+        expected.kind === "select" &&
+        session.committedSelectValues.get(resolution.element.selector) === expected.expected) {
+        session.committedSelectValues.delete(resolution.element.selector);
+        return { ok: true };
+    }
+    if (expected.kind === "select") {
+        session.committedSelectValues.delete(resolution.element.selector);
+    }
+    return { ok: false, reason: guard.reason };
+}
+async function verifyReplayField(session, expected, allowCommittedSelect = false) {
+    if (expected.kind === "set_phone_country") {
+        return (await session.browser.verifyPhoneCountry(expected.expected))
+            ? { ok: true }
+            : { ok: false, reason: "field_value_mismatch" };
+    }
+    const target = expected.target;
+    if (target === null)
+        return { ok: false, reason: "field_missing" };
+    const fresh = await session.browser.extractInteractiveElements();
+    session.lastElements = fresh;
+    return verifyReplayFieldInElements(session, expected, fresh, allowCommittedSelect);
+}
+async function verifyReplayFieldWithElements(session, expected, elements, allowCommittedSelect = false) {
+    if (expected.kind === "set_phone_country") {
+        return (await session.browser.verifyPhoneCountry(expected.expected))
+            ? { ok: true }
+            : { ok: false, reason: "field_value_mismatch" };
+    }
+    return verifyReplayFieldInElements(session, expected, elements, allowCommittedSelect);
+}
+async function isReplayFieldMounted(session, expected, elements) {
+    if (expected.kind === "set_phone_country") {
+        return await session.browser.hasPhoneCountryControl();
+    }
+    return expected.target !== null && hasRecipeTargetCandidate(elements, expected.target);
+}
+async function captureReplayRepairVerification(session, action, resolvedEl) {
+    const state = session.replayState;
+    if (state === null || state.nextIndex === null || !state.moneyPath)
+        return;
+    const stepIndex = state.nextIndex - 1;
+    const expected = state.expectedFields.get(stepIndex);
+    if (expected === undefined)
+        return;
+    if (action.kind !== "type" && action.kind !== "select" && action.kind !== "set_phone_country") {
+        return;
+    }
+    if (action.replayRepair === undefined ||
+        action.replayRepair.stepIndex !== stepIndex ||
+        action.replayRepair.hole !== expected.hole) {
+        throw new Error(`replay repair must bind to step ${stepIndex} and ${expected.hole}`);
+    }
+    const supplied = action.kind === "type" || action.kind === "select"
+        ? action.text
+        : action.kind === "set_phone_country"
+            ? action.country
+            : null;
+    if (supplied === null)
+        return;
+    if (supplied !== expected.expected) {
+        markReplayFailure(session, "field_value_mismatch", expected.hole);
+        throw new Error(`replay repair value mismatch for ${expected.hole}`);
+    }
+    if (action.kind === "set_phone_country") {
+        const guard = await verifyReplayField(session, expected);
+        if (!guard.ok) {
+            markReplayFailure(session, guard.reason, expected.hole);
+            throw new Error(`replay repair verification failed for ${expected.hole}: ${guard.reason}`);
+        }
+        state.verifiedFields.add(stepIndex);
+        return;
+    }
+    const recordedResolution = expected.target === null
+        ? null
+        : resolveRecipeFieldTarget(session.lastElements, expected.target);
+    if (resolvedEl === null) {
+        throw new Error(`replay repair target mismatch for ${expected.hole}`);
+    }
+    const recordedTargetMatches = recordedResolution?.element.selector === resolvedEl.selector;
+    const semanticResolution = expected.target === null
+        ? null
+        : resolveRecipeRepairTarget(session.lastElements, expected.target);
+    const replacementSemanticsMatch = semanticResolution?.selector === resolvedEl.selector;
+    if (!recordedTargetMatches && !replacementSemanticsMatch) {
+        throw new Error(`replay repair target mismatch for ${expected.hole}`);
+    }
+    const replacementTarget = recipeTargetFor(resolvedEl, session.lastElements, session.userEmail);
+    if (replacementTarget === undefined) {
+        throw new Error(`replay repair target could not be attested for ${expected.hole}`);
+    }
+    expected.target = replacementTarget;
+    const guard = await verifyReplayField(session, expected, action.kind === "select");
+    if (!guard.ok) {
+        markReplayFailure(session, guard.reason, expected.hole);
+        throw new Error(`replay repair verification failed for ${expected.hole}: ${guard.reason}`);
+    }
+    state.verifiedFields.add(stepIndex);
+}
+async function refreshReplayVerificationAfterAction(session, action, resolvedEl) {
+    const state = session.replayState;
+    if (state === null ||
+        !state.moneyPath ||
+        state.nextIndex !== null ||
+        state.paymentGuard !== "verified" ||
+        (action.kind !== "type" && action.kind !== "select" && action.kind !== "set_phone_country")) {
+        return;
+    }
+    const affected = [...state.expectedFields.values()].filter((expected) => {
+        if (action.kind === "set_phone_country")
+            return expected.kind === "set_phone_country";
+        if (expected.target === null || resolvedEl === null)
+            return false;
+        return (resolveRecipeFieldTarget(session.lastElements, expected.target)?.element.selector ===
+            resolvedEl.selector);
+    });
+    for (const expected of affected) {
+        state.verifiedFields.delete(expected.stepIndex);
+        state.paymentGuard = "pending";
+        const supplied = action.kind === "set_phone_country" ? action.country : action.text;
+        if (supplied !== expected.expected) {
+            markReplayFailure(session, "field_value_mismatch", expected.hole);
+            throw new Error(`replay field value mismatch for ${expected.hole}`);
+        }
+        const guard = await verifyReplayField(session, expected, action.kind === "select");
+        if (!guard.ok) {
+            markReplayFailure(session, guard.reason, expected.hole);
+            throw new Error(`replay field verification failed for ${expected.hole}: ${guard.reason}`);
+        }
+        state.verifiedFields.add(expected.stepIndex);
+    }
+    if (state.verifiedFields.size === state.expectedFields.size)
+        state.paymentGuard = "verified";
+}
+function isReplayTransitionAction(action) {
+    return (action.kind !== "type" &&
+        action.kind !== "select" &&
+        action.kind !== "set_phone_country" &&
+        action.kind !== "allow_host");
+}
+function rejectRecipeRecording(session, reason) {
+    session.recipeRejectionReason ??= reason;
+}
+function recordedMoneyFields(session) {
+    const fields = [];
+    for (const source of session.recordedValues) {
+        if (source.hole === undefined || !REPLAY_VERIFIED_HOLE.test(source.hole))
+            continue;
+        const action = session.actionTrace[source.traceIndex]?.action;
+        if (action === undefined ||
+            (action.kind !== "type" && action.kind !== "select" && action.kind !== "set_phone_country")) {
+            continue;
+        }
+        let target = null;
+        if (action.kind !== "set_phone_country") {
+            try {
+                target = boundReplayTarget({ ...action, email_hole: source.hole }, { [source.hole]: source.literal });
+            }
+            catch {
+                target = null;
+            }
+        }
+        fields.push({
+            stepIndex: source.traceIndex,
+            hole: source.hole,
+            expected: source.literal,
+            target,
+            kind: action.kind,
+        });
+    }
+    return fields;
+}
+async function attestRecordedFieldsBeforeTransition(session, action) {
+    if (session.replayState !== null || !isReplayTransitionAction(action))
+        return [];
+    const fields = recordedMoneyFields(session);
+    if (fields.length === 0)
+        return fields;
+    const fresh = await session.browser.extractInteractiveElements();
+    session.lastElements = fresh;
+    for (const expected of fields) {
+        const guard = await verifyReplayFieldWithElements(session, expected, fresh);
+        if (!guard.ok) {
+            rejectRecipeRecording(session, `checkout transition could not be attested (${expected.hole}: ${guard.reason})`);
+            return [];
+        }
+    }
+    return fields;
+}
+async function verifyRecordedFieldsAfterTransition(session, action, fields) {
+    if (session.replayState !== null || !isReplayTransitionAction(action) || fields.length === 0) {
+        return;
+    }
+    const fresh = await session.browser.extractInteractiveElements();
+    session.lastElements = fresh;
+    for (const expected of fields) {
+        if (!(await isReplayFieldMounted(session, expected, fresh))) {
+            rejectRecipeRecording(session, `checkout transition could not be attested (${expected.hole}: field_missing)`);
+            return;
+        }
+        const guard = await verifyReplayFieldWithElements(session, expected, fresh);
+        if (!guard.ok) {
+            rejectRecipeRecording(session, `checkout transition could not be attested (${expected.hole}: ${guard.reason})`);
+            return;
+        }
+    }
+}
+async function attestReplayFieldsBeforeTransition(session, action) {
+    const state = session.replayState;
+    const fields = new Set();
+    if (state === null || !state.moneyPath || !isReplayTransitionAction(action)) {
+        return { ok: true, fields };
+    }
+    const fresh = await session.browser.extractInteractiveElements();
+    session.lastElements = fresh;
+    for (const expected of state.expectedFields.values()) {
+        if (!state.verifiedFields.has(expected.stepIndex) ||
+            (expected.target === null && expected.kind !== "set_phone_country")) {
+            continue;
+        }
+        const guard = await verifyReplayFieldWithElements(session, expected, fresh);
+        if (!guard.ok) {
+            return { ok: false, reason: guard.reason, field: expected.hole };
+        }
+        fields.add(expected.stepIndex);
+    }
+    return { ok: true, fields };
+}
+async function verifyReplayFieldsAfterTransition(session, action, attestedFields) {
+    const state = session.replayState;
+    if (state === null || !state.moneyPath || !isReplayTransitionAction(action)) {
+        return { ok: true };
+    }
+    const fresh = await session.browser.extractInteractiveElements();
+    session.lastElements = fresh;
+    for (const stepIndex of attestedFields) {
+        const expected = state.expectedFields.get(stepIndex);
+        if (expected === undefined)
+            continue;
+        if (!(await isReplayFieldMounted(session, expected, fresh))) {
+            return { ok: false, reason: "field_missing", field: expected.hole };
+        }
+        const guard = await verifyReplayFieldWithElements(session, expected, fresh);
+        if (!guard.ok) {
+            return { ok: false, reason: guard.reason, field: expected.hole };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Execute deterministic recipe steps until completion or one local miss.
+ * A miss is returned to the host with a continuation index; after the host
+ * repairs that one step, calling again with `fromIndex=next_index` continues.
+ */
+export async function replayOperatorRecipe(sessionId, recipe, bindings, fromIndex = 0) {
+    const session = sessions.get(sessionId);
+    if (session === undefined)
+        throw new Error(`unknown provision session ${sessionId}`);
+    const recipeHash = replayDigest(recipe);
+    const bindingsHash = bindingDigest(bindings);
+    const boundPostcondition = bindRecipePostcondition(recipe.postcondition, bindings);
+    if (recipe.verb === undefined || recipe.domain === undefined) {
+        throw new Error("legacy named recipes are hint-only and cannot replay deterministically");
+    }
+    const isMoneyPath = MONEY_REPLAY_VERBS.has(recipe.verb);
+    let state;
+    const humanRequired = async (reason, field) => {
+        markReplayFailure(session, reason, field);
+        return { status: "human_required", observation: await observe(sessionId), reason, field };
+    };
+    if (fromIndex === 0) {
+        if (session.replayState !== null) {
+            throw new Error("replay already started in this session; use the issued continuation");
+        }
+        const expected = expectedReplayFields(recipe, bindings);
+        state = {
+            recipeName: recipe.name,
+            recipeHash,
+            bindingsHash,
+            boundPostcondition,
+            moneyPath: isMoneyPath,
+            nextIndex: null,
+            expectedFields: expected.fields,
+            verifiedFields: new Set(),
+            paymentGuard: isMoneyPath ? "pending" : "verified",
+        };
+        session.replayState = state;
+        if (expected.missing !== null)
+            return await humanRequired("field_missing", expected.missing);
+    }
+    else {
+        state = session.replayState;
+        if (state === null ||
+            state.recipeHash !== recipeHash ||
+            state.bindingsHash !== bindingsHash ||
+            state.nextIndex !== fromIndex) {
+            throw new Error("invalid replay continuation: resume_from was not issued for this session");
+        }
+        if (state.failure !== undefined) {
+            return await humanRequired(state.failure.reason, state.failure.field);
+        }
+        const repairedField = state.expectedFields.get(fromIndex - 1);
+        if (repairedField !== undefined && !state.verifiedFields.has(fromIndex - 1)) {
+            const guard = await verifyReplayField(session, repairedField);
+            if (!guard.ok)
+                return await humanRequired(guard.reason, repairedField.hole);
+            state.verifiedFields.add(fromIndex - 1);
+        }
+        state.nextIndex = null;
+    }
+    let replayed = 0;
+    const fallback = async (step, stepIndex, reason) => {
+        state.nextIndex = stepIndex + 1;
+        if (step.action.kind === "operate_pay" &&
+            state.verifiedFields.size === state.expectedFields.size) {
+            state.paymentGuard = "verified";
+        }
+        return {
+            status: "fallback_required",
+            observation: await observe(sessionId),
+            step_index: stepIndex,
+            next_index: stepIndex + 1,
+            step,
+            reason,
+        };
+    };
+    for (let i = fromIndex; i < recipe.trace.length; i += 1) {
+        const step = recipe.trace[i];
+        const recorded = step.action;
+        let action;
+        if (recorded.kind === "extract") {
+            return await fallback(step, i, "credential extraction requires host planning on the live page");
+        }
+        if (recorded.kind === "operate_pay") {
+            return await fallback(step, i, "payment requires the existing operate_pay approval flow");
+        }
+        if (recorded.kind === "goto") {
+            if (recorded.url_template === undefined) {
+                return await fallback(step, i, "goto step has no URL");
+            }
+            let urlTemplate;
+            try {
+                urlTemplate = bindKnownEmailTemplate(recorded.url_template, bindings, recorded.email_hole);
+            }
+            catch (error) {
+                return await fallback(step, i, error instanceof Error ? error.message : String(error));
+            }
+            const filled = fillTemplate(urlTemplate, bindings);
+            if (filled.missing.length > 0) {
+                return await fallback(step, i, `missing bindings: ${filled.missing.join(", ")}`);
+            }
+            action = { kind: "goto", url: filled.url };
+        }
+        else if (recorded.kind === "allow_host") {
+            if (recorded.host === undefined) {
+                return await fallback(step, i, "allow_host step has no host");
+            }
+            action = { kind: "allow_host", host: recorded.host };
+        }
+        else if (recorded.kind === "press") {
+            if (recorded.key === undefined) {
+                return await fallback(step, i, "press step has no key");
+            }
+            action = { kind: "press", key: recorded.key };
+        }
+        else if (recorded.kind === "oauth_settle") {
+            action = { kind: "oauth_settle" };
+        }
+        else if (recorded.kind === "scroll") {
+            action = {
+                kind: "scroll",
+                ...(recorded.direction !== undefined ? { direction: recorded.direction } : {}),
+            };
+        }
+        else if (recorded.kind === "set_phone_country") {
+            if (recorded.value === undefined) {
+                return await fallback(step, i, "set_phone_country step has no value");
+            }
+            try {
+                action = {
+                    kind: "set_phone_country",
+                    country: bindRecipeValue(recorded.value, bindings),
+                    ...(typeof recorded.value === "string" ? {} : { provenance: recorded.value }),
+                };
+            }
+            catch (error) {
+                return await fallback(step, i, error instanceof Error ? error.message : String(error));
+            }
+        }
+        else {
+            let target;
+            try {
+                target = boundReplayTarget(recorded, bindings);
+            }
+            catch (error) {
+                return await fallback(step, i, error instanceof Error ? error.message : String(error));
+            }
+            if (target === null) {
+                return await fallback(step, i, "step has no replay target");
+            }
+            // Structural pre-check: resolve against the live inventory before every
+            // deterministic act. This is especially load-bearing on money paths.
+            const fresh = await session.browser.extractInteractiveElements();
+            session.lastElements = fresh;
+            const expectedForStep = state.expectedFields.get(i);
+            const resolution = expectedForStep === undefined
+                ? resolveRecipeTarget(fresh, target)
+                : resolveRecipeFieldTarget(fresh, target);
+            if (resolution === null) {
+                return await fallback(step, i, "ordered target resolver missed");
+            }
+            const ref = provisionElementRefs(fresh).get(resolution.element);
+            if (ref === undefined) {
+                return await fallback(step, i, "resolved target has no live ref");
+            }
+            if (recorded.kind === "type" || recorded.kind === "select") {
+                if (recorded.value === undefined) {
+                    return await fallback(step, i, `${recorded.kind} step has no value`);
+                }
+                let text;
+                try {
+                    text = bindRecipeValue(recorded.value, bindings);
+                }
+                catch (error) {
+                    return await fallback(step, i, error instanceof Error ? error.message : String(error));
+                }
+                action =
+                    recorded.kind === "type"
+                        ? {
+                            kind: "type",
+                            target: ref,
+                            text,
+                            ...(typeof recorded.value === "string" ? {} : { provenance: recorded.value }),
+                        }
+                        : {
+                            kind: "select",
+                            target: ref,
+                            text,
+                            ...(typeof recorded.value === "string" ? {} : { provenance: recorded.value }),
+                        };
+            }
+            else if (recorded.kind === "type_secret") {
+                if (recorded.slot === undefined) {
+                    return await fallback(step, i, "type_secret step has no slot");
+                }
+                action = { kind: "type_secret", target: ref, slot: recorded.slot };
+            }
+            else if (recorded.kind === "click") {
+                action = { kind: "click", target: ref };
+            }
+            else if (recorded.kind === "js_click") {
+                action = { kind: "js_click", target: ref };
+            }
+            else {
+                action = { kind: "oauth_click", target: ref };
+            }
+        }
+        try {
+            const transitionAttestation = await attestReplayFieldsBeforeTransition(session, action);
+            if (!transitionAttestation.ok) {
+                return await humanRequired(transitionAttestation.reason, transitionAttestation.field);
+            }
+            await act(sessionId, action, "none");
+            replayed += 1;
+            const expected = state.expectedFields.get(i);
+            if (expected !== undefined) {
+                const guard = await verifyReplayField(session, expected, expected.kind === "select");
+                if (!guard.ok)
+                    return await humanRequired(guard.reason, expected.hole);
+                state.verifiedFields.add(i);
+            }
+            const transitionGuard = await verifyReplayFieldsAfterTransition(session, action, transitionAttestation.fields);
+            if (!transitionGuard.ok) {
+                return await humanRequired(transitionGuard.reason, transitionGuard.field);
+            }
+        }
+        catch (error) {
+            return await fallback(step, i, error instanceof Error ? error.message : String(error));
+        }
+    }
+    if (isMoneyPath) {
+        const unverified = [...state.expectedFields.values()].find((expected) => !state.verifiedFields.has(expected.stepIndex));
+        if (unverified !== undefined) {
+            return await humanRequired("field_missing", unverified.hole);
+        }
+        state.paymentGuard = "verified";
+        audit(sessionId, "replay_field_value_guard", {
+            ok: true,
+            fields: state.expectedFields.size,
+        });
+    }
+    return {
+        status: "complete",
+        observation: await observe(sessionId),
+        replayed_steps: replayed,
+        field_values_verified: isMoneyPath,
+    };
+}
 const normLabelKey = (label) => label
     .replace(/\s+/g, "_")
     .replace(/[^a-z0-9_]/gi, "")
@@ -2352,7 +3537,7 @@ export function classifyVouchflowCredentials(text) {
 // isTruncatedCapture + extraction.ts accumulation). Reuses the substrate —
 // no new credential regexes.
 export async function extractCredentials(sessionId) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const { browser } = session;
@@ -2605,7 +3790,7 @@ async function solveCaptchaWithTokenSolver(solver, browser, variant) {
 // response token is the success signal; challenge disappearance alone is not
 // enough because a reCAPTCHA v2 checkbox can be idle with an empty token.
 export async function captchaGate(sessionId) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const det = await session.browser.detectCaptchaVariant();
@@ -2780,7 +3965,7 @@ export function buildVerificationSearchQuery(sender) {
         .join(" ");
 }
 export async function awaitVerification(sessionId, opts = {}) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const { browser } = session;
@@ -2866,13 +4051,23 @@ export async function awaitVerification(sessionId, opts = {}) {
     return buildVerificationResult(sessionId, code, link, sourceFrom);
 }
 export async function finishProvisionSession(sessionId) {
-    const session = sessions.get(sessionId);
+    const session = sessionForCall(sessionId);
     if (session === undefined)
         throw new Error(`unknown provision session ${sessionId}`);
     const url = session.browser.currentUrl();
     audit(sessionId, "finish", { url });
-    await session.browser.close();
     sessions.delete(sessionId);
+    try {
+        await releaseWarmBrowserPage(session.browser);
+    }
+    finally {
+        inFlight = false;
+    }
+    const expired = warmBrowser !== null ? warmBrowserExpired(warmBrowser) : null;
+    if (expired !== null)
+        await closeWarmBrowserIfIdle(expired);
+    else
+        touchWarmBrowser();
     return { session_id: sessionId, url, closed: true };
 }
 // Test/teardown helper — close every live session (used by the dev shim on exit).
@@ -2885,6 +4080,7 @@ export async function closeAllProvisionSessions() {
             /* best-effort */
         }
     }
+    await closeWarmBrowserIfIdle("shutdown");
 }
 export function activeSessionCount() {
     return sessions.size;