@validate.qa/runner 1.0.101 → 1.0.103

package/dist/cli.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import {
+  init_public_address,
+  public_address_exports,
   require_ai_queue,
   require_api_auth_headers,
   require_api_call_redaction,
@@ -31,22 +33,23 @@ import {
   require_resource_governor,
   require_result_api_call_bodies,
   require_result_shed
-} from "./chunk-4SZC5ZX3.mjs";
+} from "./chunk-CG75I3ZZ.mjs";
 import {
   require_tar_isolated
 } from "./chunk-AAUHXGDS.mjs";
 import "./chunk-EXRFHATN.mjs";
 import {
-  require_browser_config
-} from "./chunk-TPU42VH2.mjs";
-import "./chunk-M3VZGHZQ.mjs";
-import "./chunk-XZUUBMP3.mjs";
-import "./chunk-FQUH2PU2.mjs";
-import "./chunk-CYWHPXNZ.mjs";
-import "./chunk-CO5KHIVX.mjs";
-import "./chunk-2OKZY3WN.mjs";
-import "./chunk-BBTK6OX6.mjs";
-import "./chunk-SN3PN4G4.mjs";
+  require_browser_config,
+  require_cloud_runner
+} from "./chunk-CMM4DOXC.mjs";
+import "./chunk-NNJYKR3O.mjs";
+import "./chunk-YIM746WO.mjs";
+import "./chunk-WVLBQDFP.mjs";
+import "./chunk-7SH3COMQ.mjs";
+import "./chunk-TK5KEGNW.mjs";
+import "./chunk-YI3ZC2XI.mjs";
+import "./chunk-BECCGMU4.mjs";
+import "./chunk-36AWDKPL.mjs";
 import {
   LIVE_FRAME_IDLE_PUSH_INTERVAL_MS,
   MOBILE_COLD_BOOT_SETTLE_MS,
@@ -81,18 +84,175 @@ import {
   stepAppliesToPlatform,
   stepsMissingPlatformLocators,
   stepsNeedingReviewForPlatform
-} from "./chunk-IGXGSDE3.mjs";
+} from "./chunk-OTKJZIOD.mjs";
 import {
   __commonJS,
+  __require,
+  __toCommonJS,
   __toESM
 } from "./chunk-WQXBGQU4.mjs";
 
+// ../runner-core/dist/utils/playwright-signal-handlers.js
+var require_playwright_signal_handlers = __commonJS({
+  "../runner-core/dist/utils/playwright-signal-handlers.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.patchBrowserTypeSignalDefaults = patchBrowserTypeSignalDefaults;
+    exports.disablePlaywrightSignalHandlers = disablePlaywrightSignalHandlers2;
+    var playwright_1 = __require("playwright");
+    var PATCHED = /* @__PURE__ */ Symbol.for("validateqa.playwrightSignalDefaults");
+    var LAUNCH_METHODS = { launch: 0, launchPersistentContext: 1 };
+    function patchBrowserTypeSignalDefaults(browserType) {
+      const target = browserType;
+      if (target[PATCHED])
+        return;
+      for (const [method, optionsIndex] of Object.entries(LAUNCH_METHODS)) {
+        const original = target[method];
+        if (typeof original !== "function")
+          continue;
+        target[method] = function(...args) {
+          const given = args[optionsIndex];
+          args[optionsIndex] = { handleSIGINT: false, handleSIGTERM: false, ...given && typeof given === "object" ? given : {} };
+          return original.apply(this, args);
+        };
+      }
+      target[PATCHED] = true;
+    }
+    function disablePlaywrightSignalHandlers2() {
+      patchBrowserTypeSignalDefaults(Object.getPrototypeOf(playwright_1.chromium));
+    }
+  }
+});
+
+// ../runner-core/dist/utils/tls-cert-probe.js
+var require_tls_cert_probe = __commonJS({
+  "../runner-core/dist/utils/tls-cert-probe.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.RUN_NOTE_WAIT_MS = void 0;
+    exports.probeTargetCertificate = probeTargetCertificate;
+    exports.tlsCertFindingLine = tlsCertFindingLine;
+    exports.targetCertificateNote = targetCertificateNote2;
+    exports.noteWithinCap = noteWithinCap2;
+    exports.withRunNote = withRunNote2;
+    var node_dns_1 = __require("dns");
+    var node_net_1 = __importDefault(__require("net"));
+    var node_tls_1 = __importDefault(__require("tls"));
+    var public_address_1 = (init_public_address(), __toCommonJS(public_address_exports));
+    var cloud_runner_js_1 = require_cloud_runner();
+    var PROBE_TIMEOUT_MS = 5e3;
+    var CERT_ERROR_CODES = /* @__PURE__ */ new Set([
+      "CERT_HAS_EXPIRED",
+      "CERT_NOT_YET_VALID",
+      "CERT_REVOKED",
+      "CERT_REJECTED",
+      "CERT_UNTRUSTED",
+      "CERT_SIGNATURE_FAILURE",
+      "CERT_CHAIN_TOO_LONG",
+      "DEPTH_ZERO_SELF_SIGNED_CERT",
+      "SELF_SIGNED_CERT_IN_CHAIN",
+      "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+      "UNABLE_TO_GET_ISSUER_CERT",
+      "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+      "UNABLE_TO_DECRYPT_CERT_SIGNATURE",
+      "UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY",
+      "ERROR_IN_CERT_NOT_BEFORE_FIELD",
+      "ERROR_IN_CERT_NOT_AFTER_FIELD",
+      "INVALID_CA",
+      "INVALID_PURPOSE",
+      "PATH_LENGTH_EXCEEDED",
+      "HOSTNAME_MISMATCH",
+      "ERR_TLS_CERT_ALTNAME_INVALID"
+    ]);
+    async function probeTargetCertificate(baseUrl, opts = {}) {
+      let url;
+      try {
+        url = new URL(baseUrl);
+      } catch {
+        return null;
+      }
+      if (url.protocol !== "https:" || !url.hostname)
+        return null;
+      const hostname = url.hostname.replace(/^\[|\]$/g, "");
+      const port = url.port ? Number(url.port) : 443;
+      const shared = opts.shared ?? (0, cloud_runner_js_1.isSharedCloudRunner)();
+      const ipLiteral = node_net_1.default.isIP(hostname) !== 0;
+      if (shared && ipLiteral && (0, public_address_1.isPrivateOrLocalIpAddress)(hostname))
+        return null;
+      return new Promise((resolve3) => {
+        let settled = false;
+        let socket = null;
+        const finish = (finding) => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimeout(timer);
+          socket?.destroy();
+          resolve3(finding);
+        };
+        const timer = setTimeout(() => finish(null), opts.timeoutMs ?? PROBE_TIMEOUT_MS);
+        try {
+          socket = node_tls_1.default.connect({
+            host: hostname,
+            port,
+            ...ipLiteral ? {} : { servername: hostname },
+            rejectUnauthorized: true,
+            ...opts.ca ? { ca: opts.ca } : {},
+            ...shared ? { lookup: (0, public_address_1.createPublicOnlyLookup)((name, o, cb) => (0, node_dns_1.lookup)(name, o, cb)) } : {},
+            ALPNProtocols: ["http/1.1"]
+          });
+        } catch {
+          finish(null);
+          return;
+        }
+        socket.once("secureConnect", () => finish(null));
+        socket.once("error", (err) => {
+          const code = typeof err.code === "string" ? err.code : "";
+          finish(CERT_ERROR_CODES.has(code) ? { host: url.host, code, detail: err.message.replace(/\s+/g, " ").trim().slice(0, 300) } : null);
+        });
+      });
+    }
+    function tlsCertFindingLine(finding) {
+      return `\u26A0\uFE0F TLS certificate: ${finding.host} presented a certificate that strict TLS rejects (${finding.code}: ${finding.detail}). The run went ahead because test browsers ignore HTTPS errors, so this is not a failure. A visitor's browser may show a certificate warning: this check does not fetch a missing intermediate certificate and does not use the operating system's trust store (a private CA the visitor's machine trusts), so a browser can accept a certificate it rejects.`;
+    }
+    async function targetCertificateNote2(baseUrl, opts = {}) {
+      try {
+        const finding = await probeTargetCertificate(baseUrl, opts);
+        return finding ? tlsCertFindingLine(finding) : null;
+      } catch {
+        return null;
+      }
+    }
+    exports.RUN_NOTE_WAIT_MS = 250;
+    async function noteWithinCap2(note, capMs = exports.RUN_NOTE_WAIT_MS) {
+      let timer;
+      const cap = new Promise((resolve3) => {
+        timer = setTimeout(() => resolve3(null), capMs);
+      });
+      try {
+        return await Promise.race([note.catch(() => null), cap]);
+      } finally {
+        clearTimeout(timer);
+      }
+    }
+    function withRunNote2(result, note) {
+      if (!note)
+        return result;
+      return { ...result, logs: result.logs ? `${note}
+${result.logs}` : note };
+    }
+  }
+});
+
 // package.json
 var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.101",
+      version: "1.0.103",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -100,7 +260,8 @@ var require_package = __commonJS({
       scripts: {
         build: "tsup",
         dev: "tsx src/cli.ts",
-        test: "node --import tsx --test src/supervisor-child-argv.test.ts src/audit-scrub.test.ts src/retry-on-429.test.ts src/version-check.test.ts src/poll-interval.test.ts src/node-version-notice.test.ts src/services/auth-state.test.ts src/run-no-longer-active.test.ts src/mode-abort-no-verdict.test.ts src/discovery-render-type.test.ts src/batch-heal-no-start.test.ts src/heartbeat-active-runs.test.ts src/result-post-structure-413.test.ts src/result-shed-routes-413.test.ts src/result-post-retry.test.ts src/result-media-stale-epoch.test.ts src/run-write-guard-bundle.test.ts src/spec-driver-bundle.test.ts src/mcp-servers-bundle.test.ts src/codex-files-mcp-server-bundle.test.ts src/claim-nonce-not-logged.test.ts src/sign-in-capture.test.ts src/run-status-verdicts.test.ts src/sign-in-failure.test.ts src/mobile-ui-path-succeeded.test.ts src/supervisor-policy.test.ts src/login-check.test.ts src/heal-post-lost-ack.test.ts src/heal-log-stream-chunks.test.ts src/shutdown-claim-window.test.ts",
+        lint: "eslint .",
+        test: "node --import tsx --test src/supervisor-child-argv.test.ts src/audit-scrub.test.ts src/retry-on-429.test.ts src/version-check.test.ts src/poll-interval.test.ts src/node-version-notice.test.ts src/services/auth-state.test.ts src/run-no-longer-active.test.ts src/mode-abort-no-verdict.test.ts src/discovery-render-type.test.ts src/batch-heal-no-start.test.ts src/heartbeat-active-runs.test.ts src/result-post-structure-413.test.ts src/result-shed-routes-413.test.ts src/result-post-retry.test.ts src/result-media-stale-epoch.test.ts src/run-write-guard-bundle.test.ts src/run-write-guard-bundle-skip.test.ts src/spec-driver-bundle.test.ts src/mcp-servers-bundle.test.ts src/codex-files-mcp-server-bundle.test.ts src/claim-nonce-not-logged.test.ts src/sign-in-capture.test.ts src/run-status-verdicts.test.ts src/sign-in-failure.test.ts src/mobile-ui-path-succeeded.test.ts src/supervisor-policy.test.ts src/login-check.test.ts src/heal-post-lost-ack.test.ts src/ui-heal-result-video.test.ts src/heal-log-stream-chunks.test.ts src/shutdown-claim-window.test.ts src/result-post-redeploy-budget.test.ts src/shutdown-signals.test.ts",
         "test:mobile": "node --import tsx --test --test-concurrency=2 src/runner.mobile-ai-env.test.ts src/runner.mobile-heal-audit-wiring.test.ts src/mobile-device-queue.test.ts src/device-lease.test.ts src/runner-watchdog.test.ts src/result-payload-budget.test.ts src/result-media-upload.test.ts src/services/appium-*.test.ts src/services/*mobile*.test.ts src/services/mobile/*.test.ts",
         "smoke:installed": "node scripts/installed-run-smoke.mjs",
         "check:packed-mcp": "node scripts/packed-install-check.mjs",
@@ -320,6 +481,7 @@ var import_grok_repo_enrichment_runner = __toESM(require_grok_repo_enrichment_ru
 var import_repo_brief_execution = __toESM(require_repo_brief_execution());
 var import_repo_read_log = __toESM(require_repo_read_log());
 var import_cli_session_failure = __toESM(require_cli_session_failure());
+var import_playwright_signal_handlers = __toESM(require_playwright_signal_handlers());
 var import_cli_limit = __toESM(require_cli_limit());
 var import_fetch_cli_subscription = __toESM(require_fetch_cli_subscription());
 var import_codex_cli = __toESM(require_codex_cli());
@@ -381,6 +543,7 @@ var EXIT_TERMINAL = 64;
 var SUPERVISOR_WINDOW_MS = 36e5;
 var SUPERVISOR_HEALTHY_MS = 10 * 6e4;
 function nextSupervisorAction(input, state2, limits) {
+  if (input.signalled) return { action: "stop", exitCode: 0, reason: "clean" };
   if (input.code === 0) return { action: "stop", exitCode: 0, reason: "clean" };
   if (input.code === EXIT_TERMINAL) return { action: "stop", exitCode: EXIT_TERMINAL, reason: "terminal" };
   const restartTimes = [...state2.restartTimes.filter((t) => input.now - t < SUPERVISOR_WINDOW_MS), input.now];
@@ -532,6 +695,24 @@ function upgradeAction(activeRuns) {
   return activeRuns > 0 ? "drain" : "exit";
 }
 
+// src/shutdown-signals.ts
+var REPEAT_SIGNAL_WINDOW_MS = 1e3;
+function installShutdownSignals(target, onShutdown, opts) {
+  const now = opts.now ?? Date.now;
+  const windowMs = opts.repeatWindowMs ?? REPEAT_SIGNAL_WINDOW_MS;
+  let firstAt = null;
+  const handle = () => {
+    if (firstAt === null) {
+      firstAt = now();
+      onShutdown();
+      return;
+    }
+    if (now() - firstAt > windowMs) opts.forceExit();
+  };
+  target.on("SIGINT", handle);
+  target.on("SIGTERM", handle);
+}
+
 // src/runner.ts
 init_dist();
 
@@ -1627,7 +1808,8 @@ async function clearField(sessionPath, bounds) {
   } catch (err) {
     if (isAppiumDriverDeadError(err)) throw err;
     throw new Error(
-      `No focused element available for CLEAR. Tap an input field first.${err instanceof Error ? ` (${err.message})` : ""}`
+      `No focused element available for CLEAR. Tap an input field first.${err instanceof Error ? ` (${err.message})` : ""}`,
+      { cause: err }
     );
   }
 }
@@ -3857,7 +4039,7 @@ async function getWindowSize2(sessionId, retries = 3) {
     } catch (err) {
       if (attempt === retries - 1) {
         if (isTransportError(err)) throw err;
-        throw new Error(`Failed to get window size after ${retries} attempts: ${err instanceof Error ? err.message : String(err)}`);
+        throw new Error(`Failed to get window size after ${retries} attempts: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
       }
       await new Promise((resolve3) => setTimeout(resolve3, Math.pow(2, attempt) * 100));
     }
@@ -5224,7 +5406,7 @@ async function executeSwipe(sessionId, step) {
     screenH = windowSize.height;
   } catch (err) {
     if (isTransportError(err)) throw err;
-    throw new Error(`Swipe action failed: could not determine screen dimensions. ${err instanceof Error ? err.message : String(err)}`);
+    throw new Error(`Swipe action failed: could not determine screen dimensions. ${err instanceof Error ? err.message : String(err)}`, { cause: err });
   }
   const { startX, startY, endX, endY } = computeMobileSwipePointers(screenW, screenH, direction, distance);
   await wdRequest(`/session/${sessionId}/actions`, {
@@ -5543,12 +5725,12 @@ async function executeMobileTest(options) {
       const base = err instanceof Error ? err.message : String(err);
       if (selectedDevice.isPhysical) {
         const guidance = platformFilter === "IOS" ? `Real iOS devices require a signed WebDriverAgent (configure signing in Xcode, or pass appium:xcodeOrgId / appium:xcodeSigningId) and the app (${options.target.appId}) must be installed and trusted on the device.` : `Ensure ${selectedDevice.name} is authorized for USB debugging and ${options.target.appId} is installed.`;
-        throw new Error(`${base} \u2014 could not start an Appium session on the physical device ${selectedDevice.name}. ${guidance}`);
+        throw new Error(`${base} \u2014 could not start an Appium session on the physical device ${selectedDevice.name}. ${guidance}`, { cause: err });
       }
       const appListUnknown = !selectedDevice.installedApps || selectedDevice.installedApps.length === 0;
       if (appListUnknown) {
         const installHint = platformFilter === "IOS" ? `xcrun simctl install ${selectedDevice.id} <app-path>` : `adb -s ${selectedDevice.id} install <apk-path>`;
-        throw new Error(`${base} \u2014 could not confirm ${options.target.appId} is installed on ${selectedDevice.name}; if it is missing, install it first: ${installHint}`);
+        throw new Error(`${base} \u2014 could not confirm ${options.target.appId} is installed on ${selectedDevice.name}; if it is missing, install it first: ${installHint}`, { cause: err });
       }
       throw err;
     }
@@ -5588,7 +5770,7 @@ async function executeMobileTest(options) {
             detail,
             recordedFromClearedState
           );
-          if (requirementError) throw new Error(requirementError);
+          if (requirementError) throw new Error(requirementError, { cause: err });
           log2(`App-data clear failed (AUTO continues with plain fresh launch): ${detail}`);
         }
       } else {
@@ -5623,7 +5805,8 @@ async function executeMobileTest(options) {
         await openDeepLink(sessionId, options.target.platform, options.target.deeplink, options.target.appId);
       } catch (err) {
         throw new Error(
-          `Deep-link launch failed; refusing to replay from the wrong entry screen: ${err instanceof Error ? err.message : String(err)}`
+          `Deep-link launch failed; refusing to replay from the wrong entry screen: ${err instanceof Error ? err.message : String(err)}`,
+          { cause: err }
         );
       }
     }
@@ -5904,7 +6087,8 @@ async function createMobileDiscoverySession(target, options) {
       });
       releaseControlPortSlot(discoveryPortSlotDeviceId);
       throw new Error(
-        `Deep-link launch failed for mobile discovery: ${err instanceof Error ? err.message : String(err)}`
+        `Deep-link launch failed for mobile discovery: ${err instanceof Error ? err.message : String(err)}`,
+        { cause: err }
       );
     }
   }
@@ -6960,7 +7144,8 @@ async function startSession(validated, res) {
       } catch (err) {
         const detail = err instanceof Error ? err.message : String(err);
         throw new Error(
-          `Failed to open the configured deep link before recording (${detail}). The Appium session was closed; verify the URL and app deep-link configuration, then try again.`
+          `Failed to open the configured deep link before recording (${detail}). The Appium session was closed; verify the URL and app deep-link configuration, then try again.`,
+          { cause: err }
         );
       }
     }
@@ -8888,23 +9073,42 @@ function withMediaReferences(result, refs) {
 // src/result-post-retry.ts
 var RESULT_POST_MAX_ATTEMPTS = 3;
 var RESULT_POST_BACKOFF_BASE_MS = 1e3;
+var RESULT_POST_BACKOFF_CAP_MS = 15e3;
+var RESULT_POST_RETRY_BUDGET_DEFAULT_MS = 15e4;
+function resultPostRetryBudgetMs(env = process.env) {
+  return Math.max(1e4, Number.parseInt(env.RUNNER_RESULT_RETRY_BUDGET_MS ?? "", 10) || RESULT_POST_RETRY_BUDGET_DEFAULT_MS);
+}
+function defaultResultPostBudgetMs(backoffBaseMs) {
+  return backoffBaseMs > 0 ? resultPostRetryBudgetMs() : 0;
+}
+function nextResultPostDelay(attempt, opts) {
+  const delay = Math.min(RESULT_POST_BACKOFF_CAP_MS, Math.pow(2, attempt) * opts.backoffBaseMs);
+  if (attempt < opts.maxAttempts) return delay;
+  const left = opts.startedAt + opts.budgetMs - (opts.now ?? Date.now());
+  if (left <= 0) return null;
+  return Math.min(delay, left);
+}
 function isTransientResultPostStatus(status) {
   return status === 408 || status === 429 || status >= 500;
 }
-async function postRetryingTransient(send, label, backoffBaseMs = RESULT_POST_BACKOFF_BASE_MS) {
+async function postRetryingTransient(send, label, backoffBaseMs = RESULT_POST_BACKOFF_BASE_MS, budgetMs = defaultResultPostBudgetMs(backoffBaseMs)) {
+  const startedAt = Date.now();
   for (let attempt = 1; ; attempt++) {
     let failure;
+    let delay;
     try {
       const res = await send();
-      if (!isTransientResultPostStatus(res.status) || attempt >= RESULT_POST_MAX_ATTEMPTS) return res;
+      if (!isTransientResultPostStatus(res.status)) return res;
+      delay = nextResultPostDelay(attempt, { maxAttempts: RESULT_POST_MAX_ATTEMPTS, startedAt, budgetMs, backoffBaseMs });
+      if (delay === null) return res;
       await res.body?.cancel().catch(() => {
       });
       failure = `HTTP ${res.status}`;
     } catch (err) {
-      if (attempt >= RESULT_POST_MAX_ATTEMPTS) throw err;
+      delay = nextResultPostDelay(attempt, { maxAttempts: RESULT_POST_MAX_ATTEMPTS, startedAt, budgetMs, backoffBaseMs });
+      if (delay === null) throw err;
       failure = err instanceof Error ? err.message : String(err);
     }
-    const delay = Math.pow(2, attempt) * backoffBaseMs;
     console.warn(`[runner] ${label} post attempt ${attempt} failed (${failure}), retrying in ${delay}ms...`);
     await new Promise((resolve3) => setTimeout(resolve3, delay));
   }
@@ -8937,6 +9141,7 @@ function clampPollInterval(value) {
 init_dist();
 var import_ai_queue = __toESM(require_ai_queue());
 var import_base_url_check = __toESM(require_base_url_check());
+var import_tls_cert_probe = __toESM(require_tls_cert_probe());
 var import_rate_limit_detector = __toESM(require_rate_limit_detector());
 var import_resource_governor = __toESM(require_resource_governor());
 var import_process_inventory = __toESM(require_process_inventory());
@@ -9151,7 +9356,7 @@ async function claimRun(serverUrl, headers, runId) {
   if (typeof body.claimNonce === "string" && body.claimNonce) claimNonces.set(runId, body.claimNonce);
   return body.claimEpoch;
 }
-async function postResult(serverUrl, headers, runId, result, claimEpoch, maxAttemptsArg = 3, backoffBaseMs = 1e3) {
+async function postResult(serverUrl, headers, runId, result, claimEpoch, maxAttemptsArg = 3, backoffBaseMs = 1e3, budgetMs = defaultResultPostBudgetMs(backoffBaseMs)) {
   let maxAttempts = maxAttemptsArg;
   let verdictOnlyApplied = false;
   let lastError;
@@ -9170,8 +9375,10 @@ async function postResult(serverUrl, headers, runId, result, claimEpoch, maxAtte
   }
   let payload = budgeted.payload;
   let apiCallBodiesStripped = false;
+  const startedAt = Date.now();
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     attemptsMade = attempt;
+    let transient = false;
     try {
       const res = await fetchRetrying429(`${serverUrl}/api/runner/runs/${runId}/result`, () => ({
         method: "POST",
@@ -9223,15 +9430,17 @@ async function postResult(serverUrl, headers, runId, result, claimEpoch, maxAtte
         throw new RunNoLongerActiveError(`Run ${runId} is no longer active on the server (HTTP ${res.status})`);
       }
       lastError = new Error(`HTTP ${res.status}`);
+      transient = isTransientResultPostStatus(res.status);
     } catch (err) {
       if (err instanceof RunNoLongerActiveError) throw err;
       lastError = err instanceof Error ? err : new Error(String(err));
+      transient = true;
     }
-    if (attempt < maxAttempts) {
-      const delay = Math.pow(2, attempt) * backoffBaseMs;
-      console.warn(`[runner] postResult attempt ${attempt} failed (${lastError.message}), retrying in ${delay}ms...`);
-      await new Promise((resolve3) => setTimeout(resolve3, delay));
-    }
+    const delay = nextResultPostDelay(attempt, { maxAttempts, startedAt, budgetMs: transient ? budgetMs : 0, backoffBaseMs });
+    if (delay === null) break;
+    if (attempt >= maxAttempts) maxAttempts++;
+    console.warn(`[runner] postResult attempt ${attempt} failed (${lastError.message}), retrying in ${delay}ms...`);
+    await new Promise((resolve3) => setTimeout(resolve3, delay));
   }
   throw new Error(`Failed to post result after ${attemptsMade} attempts: ${lastError?.message}`);
 }
@@ -9288,12 +9497,13 @@ async function postMobileHealResult(serverUrl, headers, runId, body, claimEpoch)
 function narrowMobileLaunchMode(mode) {
   return mode === "LAUNCH_APP" || mode === "DEEP_LINK" || mode === "RESUME" ? mode : void 0;
 }
-async function postBatchHealResult(serverUrl, headers, runId, body, backoffBaseMs = RESULT_POST_BACKOFF_BASE_MS) {
+async function postBatchHealResult(serverUrl, headers, runId, body, backoffBaseMs = RESULT_POST_BACKOFF_BASE_MS, claimEpoch) {
   const progress = { body, fromRung: 0 };
   const res = await postRetryingTransient(() => postShedOn413((payload) => fetchRetrying429(`${serverUrl}/api/runner/runs/${runId}/batch-heal-result`, () => ({
     method: "POST",
     headers,
-    body: JSON.stringify(payload),
+    // At send time, not in the body: the verdict-only rung keeps a fixed list of fields and would drop it.
+    body: JSON.stringify(withClaimEpoch(payload, claimEpoch)),
     signal: AbortSignal.timeout(12e4)
   })), progress.body, "batch heal result", import_result_shed.BATCH_HEAL_SHED_LADDER, progress), "batch heal result", backoffBaseMs);
   throwUnlessResultLanded(res, runId, "batch heal result");
@@ -9305,11 +9515,11 @@ function throwUnlessResultLanded(res, runId, label) {
   }
   throw new Error(`Failed to post ${label}: ${res.status}`);
 }
-async function postBatchHealPartial(serverUrl, headers, runId, result) {
+async function postBatchHealPartial(serverUrl, headers, runId, result, claimEpoch) {
   const res = await postShedOn413((payload) => fetchRetrying429(`${serverUrl}/api/runner/runs/${runId}/batch-heal-partial`, () => ({
     method: "POST",
     headers,
-    body: JSON.stringify(payload),
+    body: JSON.stringify(withClaimEpoch(payload, claimEpoch)),
     // Fires per verdict: a slow server must not hold up the next test.
     signal: AbortSignal.timeout(3e4)
   })), { result }, "batch heal partial", import_result_shed.BATCH_HEAL_PARTIAL_SHED_LADDER);
@@ -9330,11 +9540,11 @@ async function fetchBatchHealAppliedIds(serverUrl, headers, runId, projectId) {
     return /* @__PURE__ */ new Set();
   }
 }
-function batchHealPartialHooks(serverUrl, headers, runId, projectId, warn = (msg) => log.warn(msg)) {
+function batchHealPartialHooks(serverUrl, headers, runId, projectId, warn = (msg) => log.warn(msg), claimEpoch) {
   return {
     onPartialResult: async (result) => {
       try {
-        await postBatchHealPartial(serverUrl, headers, runId, result);
+        await postBatchHealPartial(serverUrl, headers, runId, result, claimEpoch);
       } catch (err) {
         warn(`batch-heal partial post failed for ${result.testCaseId}: ${err instanceof Error ? err.message : String(err)}`);
       }
@@ -9430,18 +9640,25 @@ function createHealLogStreamer(serverUrl, headers, runId) {
   };
   return { onLog, flushNow };
 }
-async function postShedOn413(send, body, label, ladder = import_result_shed.CAPTURE_SHED_LADDER, progress) {
+async function postShedOn413(send, body, label, ladder = import_result_shed.CAPTURE_SHED_LADDER, progress, onPlain413) {
   let current = progress?.body ?? body;
   let fromRung = progress?.fromRung ?? 0;
   let res = await send(current);
-  while (res.status === 413 && await (0, import_result_api_call_bodies2.isResultStructureTooCostlyResponse)(res)) {
-    const next = (0, import_result_shed.nextShedPayload)(current, ladder, fromRung);
-    if (!next) break;
-    console.warn(
-      `[runner] Server refused ${label} as too costly to parse (413 ${import_result_api_call_bodies2.RESULT_STRUCTURE_TOO_COSTLY}); retrying a lighter form (shed level ${next.level}, ${next.shed} item${next.shed === 1 ? "" : "s"} removed).`
-    );
-    current = next.payload;
-    fromRung = next.nextRung;
+  while (res.status === 413) {
+    if (await (0, import_result_api_call_bodies2.isResultStructureTooCostlyResponse)(res)) {
+      const next = (0, import_result_shed.nextShedPayload)(current, ladder, fromRung);
+      if (!next) break;
+      console.warn(
+        `[runner] Server refused ${label} as too costly to parse (413 ${import_result_api_call_bodies2.RESULT_STRUCTURE_TOO_COSTLY}); retrying a lighter form (shed level ${next.level}, ${next.shed} item${next.shed === 1 ? "" : "s"} removed).`
+      );
+      current = next.payload;
+      fromRung = next.nextRung;
+    } else {
+      const lighter = onPlain413?.(current) ?? null;
+      if (!lighter) break;
+      console.warn(`[runner] Server refused ${label} as too large (413); retrying it without its media.`);
+      current = lighter;
+    }
     if (progress) {
       progress.body = current;
       progress.fromRung = fromRung;
@@ -9460,22 +9677,24 @@ async function postCaptureResult(serverUrl, headers, runId, result, backoffBaseM
   })), progress.body, "capture result", import_result_shed.CAPTURE_SHED_LADDER, progress), "capture result", backoffBaseMs);
   throwUnlessResultLanded(res, runId, "capture result");
 }
-async function postRegressionResult(serverUrl, headers, runId, body, backoffBaseMs = RESULT_POST_BACKOFF_BASE_MS) {
-  const progress = { body: withBrowsersPathHint(body), fromRung: 0 };
+async function postRegressionResult(serverUrl, headers, runId, body, backoffBaseMs = RESULT_POST_BACKOFF_BASE_MS, claimEpoch) {
+  const fit = (0, import_result_shed.fitRegressionScreenshots)(withBrowsersPathHint(body));
+  if (fit.dropped > 0) console.warn(`[runner] Regression result over the route's body limit: ${fit.dropped} failing spec(s)' screenshot left out.`);
+  const progress = { body: fit.payload, fromRung: 0 };
   const res = await postRetryingTransient(() => postShedOn413((payload) => fetchRetrying429(`${serverUrl}/api/runner/runs/${runId}/regression-result`, () => ({
     method: "POST",
     headers,
-    body: JSON.stringify(payload),
+    body: JSON.stringify(withClaimEpoch(payload, claimEpoch)),
     signal: AbortSignal.timeout(6e4)
-  })), progress.body, "regression result", import_result_shed.REGRESSION_SHED_LADDER, progress), "regression result", backoffBaseMs);
+  })), progress.body, "regression result", import_result_shed.REGRESSION_SHED_LADDER, progress, import_result_shed.withoutRegressionScreenshots), "regression result", backoffBaseMs);
   throwUnlessResultLanded(res, runId, "regression result");
 }
-function postLiveSuiteResult(serverUrl, headers, runId, body, backoffBaseMs = RESULT_POST_BACKOFF_BASE_MS) {
+function postLiveSuiteResult(serverUrl, headers, runId, body, backoffBaseMs = RESULT_POST_BACKOFF_BASE_MS, claimEpoch) {
   const progress = { body, fromRung: 0 };
   return postRetryingTransient(() => postShedOn413((payload) => fetchRetrying429(`${serverUrl}/api/runner/runs/${runId}/live-suite-result`, () => ({
     method: "POST",
     headers,
-    body: JSON.stringify(payload),
+    body: JSON.stringify(withClaimEpoch(payload, claimEpoch)),
     signal: AbortSignal.timeout(6e4)
   })), progress.body, "live suite result", import_result_shed.LIVE_SUITE_SHED_LADDER, progress), "live suite result", backoffBaseMs);
 }
@@ -9881,7 +10100,8 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
   const runLabel = run2.testCaseId ?? run2.testName ?? (runMode === "run" ? "auth-setup" : runMode);
   const modeLabel = runMode === "run" ? RUNNER_MODE : runMode;
   log.info(`Running test: ${runLabel} (run ${run2.runId}) [mode: ${modeLabel}]`);
-  const postRunResult = (result) => postResult(opts.serverUrl, headers, run2.runId, result, run2.claimEpoch);
+  let tlsCertNote = Promise.resolve(null);
+  const postRunResult = async (result) => postResult(opts.serverUrl, headers, run2.runId, (0, import_tls_cert_probe.withRunNote)(result, await (0, import_tls_cert_probe.noteWithinCap)(tlsCertNote)), run2.claimEpoch);
   const browserlessRepositoryRead = (0, import_live_browser_registry.isBrowserlessRepositoryRead)(run2.discoveryContext?.frameworkImport?.kind);
   const liveBrowserHandle = browserlessRepositoryRead ? import_live_browser_registry.NO_LIVE_BROWSER : import_live_browser_registry.liveBrowserRegistry.register({
     sessionId: `${run2.runId}`,
@@ -9929,6 +10149,8 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
     authStandingMode: authPlan.standingHeadersMode,
     storageStatePath: wrapperStorageStatePath,
     apiBaseUrl: run2.apiBaseUrl,
+    // The run's own @api tag: an imported API spec's code may not say so (see executeNativeOnce's apiTest).
+    apiTest: Array.isArray(run2.tags) && run2.tags.includes("@api"),
     ...nativeOptions,
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat,
@@ -10003,6 +10225,10 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
       } else if (preflight.note) {
         log.info(preflight.note);
       }
+      tlsCertNote = (0, import_tls_cert_probe.targetCertificateNote)(run2.baseUrl);
+      void tlsCertNote.then((note) => {
+        if (note) log.warn(note);
+      });
     }
     if (runMode === "auth-setup") {
       if (!run2.playwrightCode) {
@@ -10083,7 +10309,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
       log.info(`Heal engine: GROK BATCH (${tests.length} tests, healerModel=${run2.healerModel ?? "null"})`);
       const noStart = batchHealNoStart(tests, run2.baseUrl);
       if (noStart) {
-        await postBatchHealResult(opts.serverUrl, headers, run2.runId, noStart.body);
+        await postBatchHealResult(opts.serverUrl, headers, run2.runId, noStart.body, RESULT_POST_BACKOFF_BASE_MS, run2.claimEpoch);
         log[noStart.level](noStart.logLine);
         return;
       }
@@ -10120,7 +10346,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         // Returns HEAL_TIMEOUT: for the tests not reached instead of dying at the runner's batch-heal deadline.
         deadlineAt: (0, import_runner_core7.batchHealDeadlineAt)(startTime),
         onLog: healLogStream.onLog,
-        ...batchHealPartialHooks(opts.serverUrl, headers, run2.runId, run2.projectId || void 0)
+        ...batchHealPartialHooks(opts.serverUrl, headers, run2.runId, run2.projectId || void 0, void 0, run2.claimEpoch)
       });
       await healLogStream.flushNow();
       try {
@@ -10135,7 +10361,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
           systemicDiagnosis: batchResult.systemicDiagnosis,
           logs: batchResult.logs,
           durationMs: batchResult.totalDurationMs
-        });
+        }, RESULT_POST_BACKOFF_BASE_MS, run2.claimEpoch);
         log.ok((0, import_runner_core9.batchHealCompleteLine)(batchResult.perTest, tests.length, batchResult.totalDurationMs));
       } catch (err) {
         log.fail(`Failed to post batch heal result: ${err instanceof Error ? err.message : String(err)}`);
@@ -10289,7 +10515,7 @@ ${finalVerifyResult.logs ?? ""}`;
             const legacyCold = (0, import_runner_core8.apiHealColdSessionRelabel)("legacy", {
               tags: run2.tags ?? [],
               authStateExpected: apiHealAuthPlan.needsCookieState,
-              authStateInjected: !!apiHealStorageStatePath,
+              authStateInjected: (0, import_runner_core8.storageStateDelivered)(apiHealStorageStatePath, finalVerifyResult),
               needsStandingHeaders: apiHealAuthPlan.needsStandingHeaders,
               standingHeadersInjected: !!finalVerifyResult?.authDelivery?.standingHeadersInjected,
               error: result3.bugDescription ?? null,
@@ -10312,14 +10538,15 @@ ${finalVerifyResult.logs ?? ""}`;
           }
           if (result3.verdict === "unfixable") {
             log.fail(`  Unfixable: ${result3.reason}`);
-            finalUnfixableReason = result3.reason;
+            finalUnfixableReason = result3.reason ?? "AI could not fix the test";
             break;
           }
           lastHealedCode = result3.playwrightCode ?? result3.healedCode;
           lastChangeDescription = result3.changeDescription;
           if (!lastHealedCode) {
-            log.fail("  AI returned fix verdict but no code");
-            break;
+            log.warn(`  Attempt ${attempt}: AI returned fix verdict but no code \u2014 retrying with prompt`);
+            currentError = `Attempt ${attempt} failed: You described a fix but did not include the \`playwrightCode\` field. Please provide the complete updated test file as \`playwrightCode\`.`;
+            continue;
           }
           finalVerifyResult = await runNativeWithLiveBrowser({
             playwrightCode: lastHealedCode,
@@ -10361,10 +10588,14 @@ ${finalVerifyResult.logs ?? ""}`;
         const allAppBug = stepCount > 0 && enrichedSteps.every((s) => s.verdict === "app_bug");
         const hasFixFailed = enrichedSteps.some((s) => s.verdict === "fix_failed");
         const hasPass = enrichedSteps.some((s) => s.verdict === "pass");
-        const passed = stepCount > 0 ? finalVerifyResult?.passed === true && hasPass && !hasFixFailed && !allAppBug : finalVerifyResult?.passed === true;
+        const verifyPassed = stepCount > 0 ? finalVerifyResult?.passed === true && hasPass && !hasFixFailed && !allAppBug : finalVerifyResult?.passed === true;
+        const partialSkipError = verifyPassed ? (0, import_runner_core7.apiHealPartialSkipError)(enrichedSteps) : void 0;
+        const passed = verifyPassed && partialSkipError === void 0;
         let composedError;
         if (!passed) {
-          if (finalUnfixableReason) {
+          if (partialSkipError !== void 0) {
+            composedError = partialSkipError;
+          } else if (finalUnfixableReason) {
             composedError = `Unfixable after ${attemptsUsed} attempt(s): ${finalUnfixableReason}`;
           } else if (allAppBug || enrichedSteps.some((s) => s.verdict === "app_bug") && !hasFixFailed) {
             const bugs = enrichedSteps.filter((s) => s.verdict === "app_bug");
@@ -10376,7 +10607,7 @@ ${finalVerifyResult.logs ?? ""}`;
         let apiHealStatus = passed ? "PASSED" : "FAILED";
         let apiHealError = composedError;
         if (!passed) {
-          if (finalUnfixableReason?.startsWith(import_runner_core7.HEAL_AI_NO_ANSWER_ERROR_PREFIX)) {
+          if (finalUnfixableReason?.startsWith(import_runner_core7.HEAL_AI_NO_ANSWER_ERROR_PREFIX) || (0, import_runner_core7.isHealAiQuotaError)(finalUnfixableReason)) {
             apiHealStatus = "ERROR";
             apiHealError = finalUnfixableReason;
           } else if (isConfigLikeReason(classifyErrorMessage(composedError ?? null))) {
@@ -10417,7 +10648,7 @@ ${finalVerifyResult.logs ?? ""}`;
           const cold = (0, import_runner_core8.apiHealColdSessionRelabel)("verified", {
             tags: run2.tags ?? [],
             authStateExpected: apiHealAuthPlan.needsCookieState,
-            authStateInjected: !!apiHealStorageStatePath,
+            authStateInjected: (0, import_runner_core8.storageStateDelivered)(apiHealStorageStatePath, finalVerifyResult),
             needsStandingHeaders: apiHealAuthPlan.needsStandingHeaders,
             standingHeadersInjected: !!finalVerifyResult?.authDelivery?.standingHeadersInjected,
             error: apiHealError ?? finalVerifyResult?.error,
@@ -10563,23 +10794,24 @@ ${finalVerifyResult.logs ?? ""}`;
 [audit] ${drainErr instanceof Error ? drainErr.message : String(drainErr)}`;
         console.warn(`[runner]${auditDrainError}`);
       }
+      const relabelSteps = result2.relabelEvidenceSteps ?? result2.stepResults;
       const isConfigIssue = !result2.passed && isConfigLikeReason(classifyErrorMessage(result2.error ?? null));
       let healStatus = (0, import_runner_core7.healRunStatus)({ passed: result2.passed, error: result2.error, isConfigIssue });
       let healError = result2.error;
-      if (!result2.passed && !isConfigIssue && !(0, import_runner_core7.isHealAiQuotaError)(result2.error)) {
-        const rlDetection = (0, import_rate_limit_detector.detectRateLimitBlock)({
-          testName: run2.testName ?? run2.testCaseId ?? void 0,
-          tags: run2.tags ?? [],
-          error: result2.error,
-          logs: result2.logs,
-          stepResults: result2.stepResults,
-          apiCalls: result2.apiCalls
-        });
-        if (rlDetection.detected) {
-          healStatus = "ERROR";
-          healError = `RATE_LIMIT_BLOCKED: Heal-mode rate-limit detected (overriding AI verdict). Retry after ${rlDetection.retryAfterSeconds}s. Evidence: ${rlDetection.evidence.join("; ")}`;
-          log.warn(`\u26A0 Heal rate-limit override \u2014 was ${result2.error?.slice(0, 60)}\u2026, now ERROR/RATE_LIMIT_BLOCKED`);
-        }
+      const rateLimitRelabel = (0, import_runner_core8.uiHealRateLimitRelabel)({
+        passed: result2.passed,
+        isConfigIssue,
+        testName: run2.testName ?? run2.testCaseId ?? void 0,
+        tags: run2.tags ?? [],
+        error: result2.error,
+        logs: result2.logs,
+        stepResults: relabelSteps,
+        apiCalls: result2.apiCalls
+      });
+      if (rateLimitRelabel) {
+        healStatus = rateLimitRelabel.status;
+        healError = rateLimitRelabel.error;
+        log.warn(rateLimitRelabel.logLine);
       }
       const loginRelabel = (0, import_runner_core8.uiHealLoginRelabel)({
         status: healStatus,
@@ -10587,7 +10819,7 @@ ${finalVerifyResult.logs ?? ""}`;
         tags: run2.tags ?? [],
         error: healError,
         logs: result2.logs,
-        stepResults: result2.stepResults
+        stepResults: relabelSteps
       });
       if (loginRelabel) {
         healStatus = loginRelabel.status;
@@ -10599,6 +10831,7 @@ ${finalVerifyResult.logs ?? ""}`;
           status: healStatus,
           stepResults: result2.stepResults,
           screenshots: result2.screenshots,
+          video: result2.video,
           apiCalls: result2.apiCalls,
           logs: (result2.logs ?? "") + auditDrainError,
           error: healError,
@@ -10663,7 +10896,7 @@ ${finalVerifyResult.logs ?? ""}`;
         error: result2.error,
         testResults: result2.testResults,
         skippedSpecs: result2.skippedSpecs
-      });
+      }, RESULT_POST_BACKOFF_BASE_MS, run2.claimEpoch);
       log[result2.passed ? "ok" : "fail"](
         `Regression ${result2.passed ? "PASSED" : "FAILED"} (${result2.duration}ms) - ${result2.testResults.length} specs`
       );
@@ -10699,8 +10932,18 @@ ${finalVerifyResult.logs ?? ""}`;
               body: JSON.stringify({ error: String(failedTest.error ?? "").slice(0, 5e5), testCaseId: failedTest.testCaseId }),
               signal: AbortSignal.timeout(6e4)
             });
-            if (healRes.ok) {
-              const { healedCode } = await healRes.json();
+            const healBody = healRes.ok ? await healRes.json() : null;
+            if (healBody?.verdict === "unfixable" && (0, import_runner_core7.isHealAiQuotaError)(healBody.reason)) {
+              results.push({
+                testCaseId: failedTest.testCaseId,
+                status: "unfixable",
+                error: healBody.reason,
+                diagnosis: healBody.reason,
+                duration: Date.now() - testStart
+              });
+              log.warn(`    Not healed (AI provider quota): ${failedTest.name}`);
+            } else if (healBody) {
+              const { healedCode } = healBody;
               const failedTestPlan = authPlanFor(failedTest.tags, healedCode);
               const verifyResult = await runNativeWithLiveBrowser({
                 playwrightCode: healedCode,
@@ -10710,15 +10953,16 @@ ${finalVerifyResult.logs ?? ""}`;
                 authStandingMode: failedTestPlan.standingHeadersMode,
                 validateContext: callbackContext
               });
+              const verdict = (0, import_runner_core7.apiHealVerifyVerdict)(verifyResult);
               results.push({
                 testCaseId: failedTest.testCaseId,
-                status: verifyResult.passed ? "fixed" : "unfixable",
-                error: verifyResult.error,
+                status: verdict.fixed ? "fixed" : "unfixable",
+                error: verdict.error,
                 diagnosis: "API test healed via server-side AI",
-                healedCode: verifyResult.passed ? healedCode : void 0,
+                healedCode: verdict.fixed ? healedCode : void 0,
                 duration: Date.now() - testStart
               });
-              if (verifyResult.passed) {
+              if (verdict.fixed) {
                 log.ok(`    Fixed: ${failedTest.name}`);
               } else {
                 log.fail(`    Could not fix: ${failedTest.name}`);
@@ -10828,10 +11072,11 @@ ${finalVerifyResult.logs ?? ""}`;
               log.ok(`    Fixed: ${failedTest.name}`);
             } else {
               const quotaStopped = (0, import_runner_core7.isHealAiQuotaError)(healResult.error);
-              const isAppBug = !quotaStopped && (0, import_runner_core7.isAppBugHealError)(healResult.error);
+              const timeoutStopped = (0, import_runner_core7.isHealTimeoutError)(healResult.error);
+              const isAppBug = !quotaStopped && !timeoutStopped && (0, import_runner_core7.isAppBugHealError)(healResult.error);
               const isConfigIssue = isConfigLikeReason(classifyErrorMessage(healResult.error ?? null));
               const status = isAppBug ? "app-bug" : isConfigIssue ? "config-issue" : "unfixable";
-              const diagnosisMsg = isAppBug ? "Application error detected" : isConfigIssue ? "Configuration issue detected" : quotaStopped && healResult.error ? healResult.error : "Could not heal after AI attempts";
+              const diagnosisMsg = isAppBug ? "Application error detected" : isConfigIssue ? "Configuration issue detected" : (quotaStopped || timeoutStopped) && healResult.error ? healResult.error : "Could not heal after AI attempts";
               results.push({
                 testCaseId: failedTest.testCaseId,
                 status,
@@ -10839,7 +11084,7 @@ ${finalVerifyResult.logs ?? ""}`;
                 diagnosis: diagnosisMsg,
                 duration: Date.now() - testStart
               });
-              log[isAppBug || isConfigIssue || quotaStopped ? "warn" : "fail"](`    ${isAppBug ? "App bug" : isConfigIssue ? "Config issue" : quotaStopped ? "Not healed (AI provider quota)" : "Could not fix"}: ${failedTest.name}`);
+              log[isAppBug || isConfigIssue || quotaStopped || timeoutStopped ? "warn" : "fail"](`    ${isAppBug ? "App bug" : isConfigIssue ? "Config issue" : quotaStopped ? "Not healed (AI provider quota)" : timeoutStopped ? "Not healed (heal time budget)" : "Could not fix"}: ${failedTest.name}`);
             }
           } catch (err) {
             results.push({
@@ -10890,7 +11135,7 @@ ${finalVerifyResult.logs ?? ""}`;
           `Live suite heal: ${fixedCount} fixed, ${appBugCount} app bugs, ${configIssueCount} config issues, ${unfixableCount} unfixable`,
           auditDrainWarning
         ].filter(Boolean).join("\n")
-      });
+      }, RESULT_POST_BACKOFF_BASE_MS, run2.claimEpoch);
       if (!liveRes.ok) {
         log.warn(`Failed to post live-suite result: ${liveRes.status}`);
       }
@@ -11847,7 +12092,7 @@ ${line}`)
           log.warn("[runner] discovery-har POST failed - final /discovery-result will carry HAR fallback");
         }
         const finalBody = buildFinalBody(discoveryResult, void 0, discoveryAuditWarning || void 0, auditDroppedCount);
-        const postOk = await postDiscoveryFinalResult(opts.serverUrl, headers, run2.runId, finalBody);
+        const postOk = await postDiscoveryFinalResult(opts.serverUrl, headers, run2.runId, withClaimEpoch(finalBody, run2.claimEpoch));
         if (!postOk) throw new Error("Failed to post discovery result (3 attempts, or refused with 413)");
         const discoveryError = discoveryResult.error ?? (discoveryResult.summary?.startsWith("Fatal error:") ? discoveryResult.summary : void 0);
         if (discoveryError) {
@@ -11894,7 +12139,7 @@ ${line}`)
           headers: { ...headers, "Content-Type": "application/json" },
           body: JSON.stringify(body),
           signal: AbortSignal.timeout(12e4)
-        })), errorBody, "discovery error result", import_result_shed.DISCOVERY_SHED_LADDER).catch(() => {
+        })), withClaimEpoch(errorBody, run2.claimEpoch), "discovery error result", import_result_shed.DISCOVERY_SHED_LADDER).catch(() => {
         });
       } finally {
         if (poolBrowser) browserPool.release(poolBrowser);
@@ -12027,7 +12272,7 @@ ${line}`)
       if (mobileSteps.length === 0) {
         await postRunResult({
           status: "ERROR",
-          error: "No mobile test steps found."
+          error: "CONFIG_ISSUE: No mobile test steps found."
         });
         log.fail("ERROR - No mobile steps");
         return;
@@ -12555,7 +12800,7 @@ ${result2.logs}`);
       stepResults: result.stepResults,
       apiCalls: result.apiCalls,
       authStateExpected,
-      authStateInjected: !!storageStatePath,
+      authStateInjected: (0, import_runner_core8.storageStateDelivered)(storageStatePath, result),
       needsStandingHeaders: normalRunAuthPlan.needsStandingHeaders,
       standingHeadersInjected: !!result.authDelivery?.standingHeadersInjected
     });
@@ -12627,6 +12872,7 @@ ${result2.logs}`);
   }
 }
 async function startRunner(opts) {
+  (0, import_playwright_signal_handlers.disablePlaywrightSignalHandlers)();
   const { serverUrl, authToken, projectId, enableMobile = false, enableMobileTunnel = false } = opts;
   const pollIntervalMs = clampPollInterval(opts.pollIntervalMs);
   process.env.SERVER_URL = serverUrl;
@@ -13151,11 +13397,13 @@ async function startRunner(opts) {
     log.info("Runner stopped.");
     process.exit(0);
   };
-  process.once("SIGINT", () => {
-    void cleanup();
-  });
-  process.once("SIGTERM", () => {
+  installShutdownSignals(process, () => {
     void cleanup();
+  }, {
+    forceExit: () => {
+      console.error("Second interrupt \u2014 forcing exit");
+      process.exit(0);
+    }
   });
   const PIDS_WATCHDOG_INTERVAL_MS = Math.max(5e3, envInt("RUNNER_PIDS_WATCHDOG_INTERVAL_MS", 3e4));
   const PIDS_SOFT_WARN_PCT = Math.max(0, Math.min(100, envInt("RUNNER_PIDS_SOFT_WARN_PCT", 70)));
@@ -13266,6 +13514,10 @@ async function startRunner(opts) {
           for (const run2 of pending) {
             if (shuttingDown) break;
             if (activeRuns >= MAX_CONCURRENT) break;
+            if (activeWebRuns.has(run2.runId)) {
+              logDeferredOnce(run2.runId, `  Deferred ${run2.runId} (an earlier claim of it is still settling on this runner)`);
+              continue;
+            }
             const runMode = run2.mode ?? "run";
             const isMobileOp = enableMobile && isMobileDeviceOp(run2);
             const discoveryKind = isMobileOp ? discoveryKindOf(run2.discoveryContext) : null;
@@ -13854,7 +14106,9 @@ async function superviseRunnerStart(argv, authTokenForChild) {
       stdio: "inherit",
       env: childEnv
     });
+    let signalled = false;
     const onSignal = (sig) => {
+      signalled = true;
       try {
         child.kill(sig);
       } catch {
@@ -13866,19 +14120,19 @@ async function superviseRunnerStart(argv, authTokenForChild) {
       process.removeListener("SIGINT", onSignal);
       process.removeListener("SIGTERM", onSignal);
       if (signal === "SIGINT" || signal === "SIGTERM") {
-        resolve3(0);
+        resolve3({ code: 0, signalled: true });
         return;
       }
-      resolve3(code ?? 1);
+      resolve3({ code: code ?? 1, signalled });
     });
   });
   console.log("\u{1F6E1}  Runner supervisor enabled \u2014 will auto-restart on crash/stuck exit");
   console.log("   (disable with --no-supervise or VALIDATE_RUNNER_SUPERVISE=0)");
   for (; ; ) {
     const startedAt = Date.now();
-    const code = await runOnce();
+    const { code, signalled } = await runOnce();
     const next = nextSupervisorAction(
-      { code, ranMs: Date.now() - startedAt, now: Date.now() },
+      { code, ranMs: Date.now() - startedAt, now: Date.now(), signalled },
       state2,
       { maxRestartsPerHour, minBackoffMs, maxBackoffMs }
     );
@@ -13959,7 +14213,7 @@ program.command("start").description("Start the local test runner").option("--to
     console.warn("\u26A0  --tunnel has no effect without --mobile (the mobile bridge it exposes only starts with --mobile). Ignoring --tunnel.");
   }
   {
-    const { hasLocalGoogleLogin, GOOGLE_LOGIN_COMMAND } = await import("./dist-VTPBY2C4.mjs");
+    const { hasLocalGoogleLogin, GOOGLE_LOGIN_COMMAND } = await import("./dist-2G7YTNH5.mjs");
     if (process.stdout.isTTY && !await hasLocalGoogleLogin()) {
       console.log(`Tip: for apps with "Continue with Google", sign in to Google once on this machine: ${GOOGLE_LOGIN_COMMAND}`);
     }
@@ -13989,7 +14243,7 @@ async function askLine(question) {
   }
 }
 program.command("google-login").description('Sign in to a TEST Google account once on this machine, for tests of apps with "Continue with Google"').option("--site <url...>", "The app address(es) this sign-in may be used for, e.g. https://app.example.com").option("--allow-file-storage", "Keep the sign-in in a plain file (only you can read it) when the system keychain is not available").option("--yes", "Confirm without asking that this is a dedicated test Google account").action(async (opts) => {
-  const { signInLocalGoogle, LOCAL_GOOGLE_WARNING, grantedSite, defaultStoreKind } = await import("./dist-VTPBY2C4.mjs");
+  const { signInLocalGoogle, LOCAL_GOOGLE_WARNING, grantedSite, defaultStoreKind } = await import("./dist-2G7YTNH5.mjs");
   console.log(LOCAL_GOOGLE_WARNING);
   if (!opts.yes) {
     const answer = await askLine('Is this a dedicated test Google account? Type "yes" to continue: ');
@@ -14024,7 +14278,7 @@ program.command("google-login").description('Sign in to a TEST Google account on
   }
 });
 program.command("google-allow-site <url>").description("Let the Google sign-in on this machine be used for one more app address").action(async (url) => {
-  const { allowLocalGoogleSites, grantedSite } = await import("./dist-VTPBY2C4.mjs");
+  const { allowLocalGoogleSites, grantedSite } = await import("./dist-2G7YTNH5.mjs");
   const site = grantedSite(url);
   if (!site) {
     console.error("\u2717  Not a web address: give it like https://app.example.com");
@@ -14038,7 +14292,7 @@ program.command("google-allow-site <url>").description("Let the Google sign-in o
   console.log(`\u2713  Tests on this machine may now use the Google sign-in for: ${sites.join(", ")}`);
 });
 program.command("google-logout").description("Forget the Google sign-in saved on this machine").action(async () => {
-  const { deleteLocalGoogleLogin } = await import("./dist-VTPBY2C4.mjs");
+  const { deleteLocalGoogleLogin } = await import("./dist-2G7YTNH5.mjs");
   await deleteLocalGoogleLogin();
   console.log("\u2713  Google sign-in removed from this machine");
 });