agentfootprint 10.3.0 → 10.3.1

package/dist/esm/time-travel/servedView.js

@@ -0,0 +1,1088 @@
+/**
+ * servedView — the request an epoch was SERVED, rebuilt from what was
+ * committed, plus an honest list of what the log cannot rebuild.
+ *
+ * Role:  Fold. `servedAt` reads a finished run's commit log and returns the
+ *        model-facing request that epoch's call assembled; `receiptAt` reads
+ *        the fingerprint that call left behind. Neither executes anything,
+ *        records anything, or stores anything beside the log.
+ * Reads: a recording, through `epochs.ts` (which log, which index) and
+ *        footprintjs's `commitValueAt`.
+ * Emits: N/A.
+ *
+ * ── THE LAW ────────────────────────────────────────────────────────────────
+ *
+ *     hash(servedAt(k)) === receiptAt(k).hash
+ *
+ * The receipt is minted at the stop, from the values about to go out. The
+ * served view is rebuilt afterwards, from the values that were committed. When
+ * the two agree, the record is complete: everything the model read is derivable
+ * from the trace. When they disagree, something reached the model that the run
+ * never wrote down — and that is a defect in the RECORD, not in the check.
+ * `test/time-travel/receipt-conformance.test.ts` is where the law is
+ * enforced; five real divergences were found by running it and each one was
+ * closed by committing a fact or declaring a gap, never by loosening it.
+ *
+ * ── WHY THE REBUILD DOES NOT RE-IMPLEMENT THE ASSEMBLY ─────────────────────
+ * The joined system string is a local inside the calling stage; it is never
+ * committed, only its pieces are. So the rebuild has to apply the identical
+ * join to the identical records — which is why the join is one exported
+ * function, `composeRequest.ts` · `joinSystemPrompt`, called by the stage on
+ * the way out and by this file on the way back. Same for the framework-field
+ * strip and the staged-refs nudge. A second implementation of any of them would
+ * make this file agree with itself and disagree with the wire.
+ *
+ * ── WHAT A GAP IS ──────────────────────────────────────────────────────────
+ * A `ServedGap` is a fact this view cannot PROVE — because the log cannot
+ * rebuild it, because the recording travelled without the base it folds
+ * against, or because the fact lives past the boundary a receipt is minted at.
+ * It is on the view rather than left implicit because a rebuild that quietly
+ * omits a piece looks exactly like a rebuild that proved the piece was absent.
+ * Naming the gap is what keeps the two apart.
+ *
+ * ── A GAP, NOT AN `undefined` ──────────────────────────────────────────────
+ * When the rebuild cannot recover the conversation at all — a chart that
+ * commits neither `history` nor `messagesInjections`, or a recording whose
+ * fold base did not travel — `servedAt` still returns a view, carrying a gap,
+ * rather than `undefined`.
+ *
+ * The alternative was tried and it is worse. Returning `undefined` withholds
+ * the system prompt, the tool list and the request-only lines, all of which
+ * this recording CAN prove, in order to avoid overstating one field it cannot.
+ * A Lens may omit; it may not deny — and dropping four proved facts to hide
+ * one hole omits more than the hole does. The gap says exactly which field is
+ * unproved, in wording a renderer prints verbatim, and leaves the rest
+ * standing.
+ *
+ * ── EVERY CHART THAT SERVES A MODEL MINTS, EXCEPT WHERE IT CANNOT SALT ─────
+ * Until 9.91.0 `buildReceipt` was called from exactly one place — the agent
+ * charts' `call-llm` stage (`stages/callLLM.ts`) — and the three other charts
+ * that hand a model a request (`LLMCall.ts` · `callLLM`,
+ * `buildMessageApiChart`, `buildAgentMessageApiChart`) left
+ * `no-receipt-on-chart` on every view they produced. Two reasons were recorded
+ * for that at the time. NEITHER survived.
+ *
+ * The first was the cache verdict: `Receipt.cache.transform` was said to have
+ * no honest value on a chart that runs no cache strategy, because
+ * `'unchanged'` would claim a strategy returned what it was given when none
+ * ran. But an `Agent` running a pass-through strategy records exactly that
+ * today — `buildReceipt` compares the request it was handed against itself —
+ * and `receipt-conformance.test.ts` asserts it and calls it correct. No fourth
+ * enum value was needed, and none was added.
+ *
+ * The second was the SALT, and it survives on exactly two of the three charts
+ * and not for the reason first written down. `LLMCall` owns its executor and
+ * mints a run id per run exactly as `Agent` does (a paragraph here said
+ * otherwise until 9.88.0, in a sentence a renderer printed verbatim), so it
+ * mints. The message-API charts are exported chart BUILDERS handed to an
+ * executor the CALLER owns, and nothing in a stage's scope carries that
+ * executor's run id — so their deps take one (`getRunId`), and they mint when
+ * they are given one. Given none they mint NOTHING rather than salting every
+ * hash with an empty string, because the salt is what makes shipping
+ * fingerprints in a recording safe (`core/agent/receipt/receipt.ts`, the third law).
+ *
+ * So a receipt-less view is still a shape this library produces — a chart
+ * builder run without a run id, a run that declined with `recordReceipt:
+ * false`, a consumer's own `call-llm` stage, a recording made before 9.88.0 —
+ * and the absence is DECLARED: `no-receipt-on-chart` names the fields only a
+ * receipt carries and says what follows for them. The rebuild never needed the
+ * receipt to work; what it loses is the WITNESS.
+ *
+ * ── AND THE CAUSE IS A VALUE, NOT A LIST INSIDE A SENTENCE ────────────────
+ * That gap's sentence used to end with the causes that produce it. That is
+ * PROSE DOING DATA'S JOB: a frozen constant cannot know what happened at the
+ * site it is printed beside, so it listed the causes somebody could think of —
+ * and a path it had never accounted for, the shape refusal in `readReceipt`
+ * below, made the count AND the verdict false with nobody editing the string.
+ * The discriminating fact moved to the one place that holds it: `readReceipt`
+ * reports whether the receipt key held nothing or held something it refused,
+ * and {@link ServedGap.cause} carries that answer out.
+ *
+ * ── AND THEN THE MECHANISM WENT TOO (9.88.0, sixth round) ─────────────────
+ * Five rounds tried to write TRUE mechanism sentences, and the rate of new
+ * falsehoods did not fall. The sixth round applied one question to all ten
+ * printed sentences — COULD THIS BECOME FALSE WITHOUT ANYONE EDITING IT? —
+ * and nine could, two of them being false the day they shipped. Exactly one
+ * could not, and it is the one that makes no claim about code at all:
+ * `UNGAPPED_FIELDS.gaps`, which says what its field MEANS inside the account.
+ * Nothing outside that sentence can falsify it.
+ *
+ * So the conclusion was not to write mechanism sentences better. It was to
+ * STOP WRITING THEM. A printed gap sentence may now say only: which fields it
+ * covers; what they mean on this view for the person reading (unproven,
+ * possibly short, absent-means-unknown, unchecked against what went out); and
+ * what to do differently. It may not name a module, a function, a key, a
+ * version, a chart, a strategy, an option, or any mechanism at all. If a
+ * sentence needs one of those words to be understood, it is explaining WHY the
+ * gap exists, which is not the printed sentence's job.
+ *
+ * NONE OF IT IS LOST. The mechanism is in the comment above each catalogue
+ * entry, where a maintainer reads it and review catches its rot, with the
+ * `file · symbol` pointers that are correct there and banned in printed prose.
+ * The cause is already data. The docs may explain the mechanism at length,
+ * because a doc is versioned with the code and its reader can open the file.
+ * The rule is enforced by `test/helpers/gapProseClaims.ts`, which on the
+ * printed surface admits no code-shaped token and no mechanism verb — close to
+ * a whitelist, and a whitelist has no synonyms.
+ *
+ * ── AND THE SEVENTH ROUND MEASURED WHAT THE SIXTH HAD CLAIMED ─────────────
+ * The sixth round said the reduction ENDED the class: a sentence with no code
+ * claim in it cannot go false when the code changes. That was checked, sentence
+ * by sentence, by driving a real run for each one — and it is not true. TEN of
+ * the eleven reduced sentences still make a claim a code edit falsifies. The
+ * one that does not is `UNGAPPED_FIELDS.gaps`, and it survives because it is
+ * SELF-REFERENTIAL: it says what its field is inside the account, not anything
+ * about the request. That is not a shape the other ten can copy. "May be
+ * SHORT", "absent means unknown", "the list is complete and the schemas are one
+ * short" are all claims about how the rebuild behaves, and the rebuild is code.
+ * The reduction changed the VOCABULARY of the claims, not their CLASS.
+ *
+ * The same round proved what does close it, by finding a BRAND-NEW false
+ * sentence in the round written to end false sentences: `no-run-log` shipped
+ * "The fields below could not be fully recovered here", and on the ordinary
+ * view that raises it nothing is lost at all. No rule caught that. A run
+ * caught it.
+ *
+ * SO THE POSITION IS: a gap sentence MAY make a code claim, because a sentence
+ * that makes none cannot inform. Every claim it makes is ASSERTED against a
+ * real view in `test/time-travel/gap-sentences.test.ts`, which drives one
+ * run per entry and checks the claim rather than the firing. The prose rule
+ * STAYS — it keeps the sentences short and readable and stops the enumerations
+ * coming back — but it is not what makes them true. The assertion is, and its
+ * blind spot is honest and small: a claim nobody wrote an assertion for.
+ */
+import { contributingPieces, joinSystemPrompt, messagesFromInjections, stripFrameworkFields, } from '../core/agent/composeRequest.js';
+import { findStagedRefs, stagedRefsNudgeLine } from '../core/agent/stagedRefs.js';
+import { evidenceConclusionLine, evidenceRecoveryPiece } from '../core/agent/evidence/recovery.js';
+import { collapseJudged, findingsLedgerPiece, servedToolCallIds, } from '../core/agent/findings/serve.js';
+import { ontologyPiece } from '../ontology/serve.js';
+import { epochAt, epochLocations, readAfterCall, readAtCall as foldAtCall, readRunConstant as foldRunConstant, recordingOf, } from './epochs.js';
+import { servedUnderPolicy } from '../redaction/marker.js';
+/**
+ * The commit log's redaction placeholder (footprintjs writes it where a run's
+ * policy selected a key — `Agent.create({ redact })`). To this rebuild it is NO
+ * value: never a system piece, a tool list or a tool name the view could print
+ * as if the request had carried it. Read as absent, which is what the record
+ * can show. The view states the cost through the gap a redacted snapshot always
+ * carries: it travels without its fold base (footprintjs omits `initialState`
+ * from the served view), so `no-fold-base` — "unproven and may be SHORT … reads
+ * as empty rather than as unknown" — is on every view of it.
+ *
+ * Read so only when the record says a policy covered the run — the snapshot's
+ * marker (`redaction/marker.ts` · `servedUnderPolicy`), asked once per call of
+ * `servedAt` / `servedViews` — so a value that merely spells the word (a tool
+ * NAMED `REDACTED`) is a value on a run no policy covered, as the answer
+ * account and `assessAnswer` read it.
+ */
+const LOG_PLACEHOLDER = 'REDACTED';
+/** {@link foldAtCall}, with the placeholder read as absent on a `served` record. */
+function readAtCall(location, key, served) {
+    const value = foldAtCall(location, key);
+    return served && value === LOG_PLACEHOLDER ? undefined : value;
+}
+/** {@link foldRunConstant}, with the placeholder read as absent on a `served` record. */
+function readRunConstant(location, key, served) {
+    const value = foldRunConstant(location, key);
+    return served && value === LOG_PLACEHOLDER ? undefined : value;
+}
+import { FORCED_OUTPUT_TOOL_KEY, RECEIPT_BOUNDARY, } from '../core/agent/receipt/receipt.js';
+import { RECEIPT_KEY } from '../lib/conventions.js';
+/**
+ * The gap catalogue. Exported because a reader that renders a served view
+ * renders its gaps beside it, and a renderer should print the library's own
+ * sentence rather than invent one.
+ */
+export const SERVED_GAPS = Object.freeze({
+    'thinking-replay': Object.freeze({
+        // The leaf reports preparation, not successful transport. Port hashes
+        // remain valid; they must not be presented as the downstream wire body.
+        fields: Object.freeze(['messages.entries', 'requestMeasurement']),
+        why: 'Saved thinking was omitted after the request shown here was prepared. The messages and size shown are before that omission, not proof of what was sent or accepted.',
+    }),
+    'cache-transform': Object.freeze({
+        // MECHANISM (not printed — see the header's rule). A `CacheStrategy`'s
+        // `prepareRequest` is handed the whole composed request after assembly and
+        // hands one back; `buildReceipt` fingerprints the one it was GIVEN. So the
+        // field list is everything a rewrite could have touched, not only the
+        // `cache.*` fields that DESCRIBE the rewrite — listing those alone named
+        // the report and excused nothing it reports on.
+        //
+        // THE RULE FOR THIS LIST is the request the strategy holds: `systemPrompt`
+        // (→ `system.*`), `messages` (→ `messages.*`), `tools` and `toolChoice`
+        // (→ every `tools.*` field). `tools.forced` and `tools.withheld` were
+        // missing until 9.93.0 (`recorded-not-built.md`, entry 7): `callLLM.ts`
+        // writes both from assembly's own decision — `deps.schemaTool?.name`,
+        // `scope.wrapUpAsked` — and never from `preparedRequest`, so a strategy
+        // that dropped the answer tool from `request.tools` or emptied the list
+        // would leave a receipt whose `forced`/`withheld` describe a request the
+        // port was not handed. `params` is the one field deliberately NOT here:
+        // it is read off `preparedRequest`, past the strategy.
+        //
+        // RAISED WHERE A STRATEGY COULD HAVE REWRITTEN (9.93.0, entry 8). Until
+        // this release `viewOf` pushed it unconditionally — including on charts
+        // that run no strategy at all — because `cache.transform: 'unchanged'`
+        // could not tell "a strategy returned what it was given" from "there was
+        // no strategy", and inferring the second from any other committed key is
+        // the absence-of-evidence reading this whole file refuses. The receipt
+        // now carries the fact (`cache.strategy`, `null` when none ran), so the
+        // condition is: raised when the receipt names a strategy, OR when there is
+        // no receipt to say — a pre-9.93.0 receipt, a receipt-less chart, a
+        // refused shape. Absent only where the record SAYS nothing stood between
+        // assembly and the port.
+        //
+        // THE DAY-ONE FALSEHOOD THIS ENTRY SHIPPED WITH, killed in 9.88.0's sixth
+        // round: the printed sentence said "only its INPUTS are on the record".
+        // Three of its own fields are OUTPUTS and are on the record —
+        // `cache.transform` (the verdict of comparing given against returned),
+        // `cache.transformHash` (the digest of what came back when it differed)
+        // and `cache.markersApplied` (the breakpoints the strategy actually
+        // applied, as against the candidates in `scope.cacheMarkers`, which are
+        // the inputs). A sentence describing the mechanism went false about the
+        // mechanism; the sentence below describes only what the fields MEAN.
+        //
+        // This entry is the weakest claim on the list wherever it appears: it says
+        // the rebuild stops before whatever the request met next, never that the
+        // rebuild got that far. Whether it did is what the other gaps on the same
+        // view say — see the qualifier on `ServedGap.fields`.
+        //
+        // AND BEING RAISED ON RECEIPT-LESS VIEWS IS WHY IT DOES NOT QUOTE
+        // `RECEIPT_BOUNDARY` (9.88.0, seventh round). That sentence opens "A
+        // receipt describes the request as this library last saw it" — and this
+        // entry is still printed on views that have no receipt at all. Measured: a
+        // message-API chart run with no run id carries exactly
+        // `['no-receipt-on-chart', 'cache-transform']`, so the reader was told what
+        // a receipt describes beside a view that has none. The boundary CLAIM is
+        // not lost — the first sentence below is that claim in the vocabulary of a
+        // view, and it is true whether or not a receipt exists. The quote stays on
+        // `provider-defaults`, which fires only where a receipt was read.
+        fields: Object.freeze([
+            'cache.transform',
+            'cache.transformHash',
+            'cache.markersApplied',
+            'cache.strategy',
+            'system.hash',
+            'system.chars',
+            'system.pieces',
+            'messages.count',
+            'messages.entries',
+            'messages.requestOnly',
+            'tools.names',
+            'tools.schemaHashes',
+            'tools.forced',
+            'tools.withheld',
+        ]),
+        why: 'What reached the provider may differ from the fields below, and nothing on this view ' +
+            'would show it. Where another gap on this view covers one of them, that gap is the ' +
+            'stronger claim.',
+    }),
+    'forced-tool-schema': Object.freeze({
+        // MECHANISM (not printed). Under a `'tool-forced'` output strategy the
+        // synthetic answer tool is added at assembly from a build-time schema that
+        // no stage commits, so `tools.schemaHashes` on the receipt carries a row
+        // the rebuild has no counterpart for. The tool's NAME is a run constant
+        // (`FORCED_OUTPUT_TOOL_KEY`, written by `stages/seed.ts`), which is why
+        // `tools.names` and `tools.forced` rebuild and the schema body does not.
+        fields: Object.freeze(['tools.schemaHashes']),
+        why: 'The schema body behind the forced answer tool is not on this view. Its name is, so the ' +
+            'tool list is complete and the schemas beside it are one short.',
+    }),
+    'provider-defaults': Object.freeze({
+        // MECHANISM (not printed). `buildReceipt` reads `params` off the PREPARED
+        // request — the object `LLMProvider.complete` is handed, after any cache
+        // strategy has had it. Like `requestMeasurement`, it is read past the
+        // strategy, and `cache-transform` deliberately does not name it. What is
+        // still past the record is the vendor: an adapter or SDK can resolve a
+        // final value the port never saw. `params` is also VALUE-CONDITIONAL —
+        // `buildReceipt` writes no key for a dial nobody set — which is the whole
+        // reason the printed sentence has to say what an absent key means.
+        //
+        // THE ONE ENTRY THAT QUOTES `RECEIPT_BOUNDARY`, and it is the only one that
+        // honestly can: it is pushed inside `if (receipt !== undefined)`, so a view
+        // carrying it always has a receipt for that sentence to be about.
+        // `cache-transform` quoted it too until 9.88.0's seventh round, and
+        // `cache-transform` is raised on the receipt-less views — where the reader
+        // was told what a receipt describes beside a view that has none. Measured:
+        // a message-API chart run with no run id carries `no-receipt-on-chart` and
+        // `cache-transform`, and never this entry.
+        fields: Object.freeze(['params']),
+        why: 'A dial absent below was not recorded; that is not the same as the model running ' +
+            'without one. ' +
+            RECEIPT_BOUNDARY,
+    }),
+    'no-fold-base': Object.freeze({
+        // MECHANISM (not printed). Raised when `location.basis` or
+        // `location.runBasis` is `'log-only'` — the recording travelled without the
+        // `initialState` the fold folds against (`getSnapshot({ redact: true })`
+        // hands back exactly that shape: the log travels, the base does not), so
+        // every read can see only what the log itself wrote. A rebuild that
+        // recovered one turn of three reports one; a system prompt it could not
+        // read at all is 0 characters rather than unknown; and `EpochLocation.epoch`
+        // falls back to POSITION when it cannot read the run's committed
+        // `iteration`, which is how a view can call the second turn the first while
+        // that turn's own receipt still says 2.
+        //
+        // TWO bases, so every field the rebuild reads through a fold. The epoch's
+        // own log rebuilds the system prompt, the conversation, the tool schemas
+        // and the wrap-up flag; the RUN's log holds the run constants the forced
+        // tool name and the staged-refs nudge are composed from. Under
+        // 'dynamic-grouped' those are different logs with different bases, and a
+        // gap raised off only the first denied the second.
+        //
+        // THE RULE FOR THIS LIST is mechanical, so it does not go short again: a
+        // field belongs here when the rebuild derives it from `readAtCall` or
+        // `readRunConstant` — both fold over values the log itself may never have
+        // written, so both read absent when the base did not travel. `readAfterCall`
+        // is the THIRD reader and is deliberately NOT on the rule: the only thing
+        // read through it is the receipt, which the call's own bundle commits, so it
+        // is there whatever the base. Naming it made the rule read wider than the
+        // mechanism and put the receipt's own fields inside a gap that cannot touch
+        // them. `system.chars` and `messages.count` were missed on the first two
+        // passes because they are COUNTS of things the list already named, and a
+        // short rebuild makes a count wrong exactly as it makes the thing wrong.
+        //
+        // `epoch` — THE VIEW'S OWN NUMBER — is here for a fourth reason, in
+        // `EpochLocation.epoch`'s own words: a fold that cannot read `iteration`
+        // numbers the epoch by its POSITION instead. Measured on a resumed run with
+        // its base and its `iteration` writes gone, the rebuild called the second
+        // turn epoch 1 while that turn's own receipt still said 2. The RECEIPT's
+        // `basis.epoch` is NOT here and used to be: it is minted live and rides in
+        // the call's bundle, so no missing base can move it. That inversion — the
+        // list naming the number a missing base cannot touch, while the number it
+        // fabricates was excused as ungappable — is what 9.88.0's fourth review
+        // round found.
+        //
+        // THE PRINTED CLAUSE STOPPED NAMING THE RECEIPT (seventh round). It read
+        // "may differ from the one the receipt for this turn carries", and this
+        // gap is raised on views that have no receipt to carry anything — a
+        // base-less recording of a chart that minted none gets both gaps at once. The fact a reader
+        // needs is about the NUMBER, not about the witness: it may be the turn's
+        // place in run order rather than the count the run kept. Measured on a
+        // resumed run with its base and its `iteration` writes gone, the view calls
+        // the second turn the first while that turn's own receipt still says 2.
+        fields: Object.freeze([
+            'system.hash',
+            'system.chars',
+            'system.pieces',
+            'messages.count',
+            'messages.entries',
+            'messages.requestOnly',
+            'tools.schemaHashes',
+            'tools.names',
+            'tools.forced',
+            'tools.withheld',
+            'epoch',
+        ]),
+        why: 'The fields below are unproven and may be SHORT: a count can be lower than what really ' +
+            'went out, and a value that could not be recovered reads as empty rather than as ' +
+            "unknown. The turn number below may be this turn's place in run order rather than the " +
+            'number the run itself gave it.',
+    }),
+    'no-conversation-on-record': Object.freeze({
+        // MECHANISM (not printed). `viewOf` reads the conversation from `history`
+        // (the agent charts) or, failing that, from `messagesInjections` (`LLMCall`
+        // and the message-API charts, which have no history at all). Neither
+        // committed ⇒ `conversation` is `undefined` and `asSent` is `[]`, which is
+        // indistinguishable from a call that really sent nothing — hence the gap.
+        //
+        // `messages.requestOnly` is on the list for a second reason: the
+        // staged-refs nudge is recomposed FROM the conversation by `findStagedRefs`,
+        // so a rebuild with no conversation finds no refs and reports no nudge,
+        // which looks exactly like a call that had none.
+        fields: Object.freeze(['messages.count', 'messages.entries', 'messages.requestOnly']),
+        why: 'The turns that went out are unknown, not empty: an empty list here is the absence of a ' +
+            'record, never a record of absence. The request-only lines are unproved with them.',
+    }),
+    'no-receipt-on-chart': Object.freeze({
+        // Exactly the fields ONLY a receipt carries — the ones no rebuild produces,
+        // so with no receipt they are absent rather than short. Everything else on
+        // the view is folded from committed pieces as usual; what it loses is not
+        // the value but the WITNESS, and the sentence below says so, because a
+        // field list cannot.
+        //
+        // MECHANISM (not printed). Raised when `readReceipt` returns no receipt —
+        // either nothing was committed under `RECEIPT_KEY` (a recording made before
+        // the receipt existed, a run with `recordReceipt: false`, a message-API
+        // chart handed no run id to salt with, or a consumer's own `call-llm`
+        // stage, which this library does not mint for) or something WAS committed
+        // there and was refused for carrying no basis. Every chart in this library
+        // that CAN salt its hashes mints since 9.91.0.
+        // Which of the two is {@link ServedGap.cause}, computed at that read.
+        // Everything else on the view is still folded from committed pieces; what
+        // it loses is the WITNESS, not the value.
+        //
+        // THE DAY-ONE FALSEHOOD THIS ENTRY SHIPPED WITH, killed in 9.88.0's sixth
+        // round: the printed sentence opened "No receipt was found for this epoch"
+        // and closed "absent here means unrecorded". Both are false under
+        // `'receipt-shape-rejected'`, where a value WAS found and WAS recorded and
+        // the read refused it. The sentence asserted a cause; the cause is a field.
+        // The sentence below says only what the fields mean, which is the same
+        // under either cause.
+        //
+        // TWO CHANGES in 9.88.0's fourth review round, both of them the same test:
+        // does this gap's MECHANISM cause this field's absence?
+        //   • `basis.epoch` JOINED the list. It is a receipt-only field like the
+        //     other three on `basis`, and with no receipt it is gone with them. It
+        //     used to be named by `no-fold-base` alone, which cannot touch it.
+        //   • `omittedForAttention` LEFT it. It was absent on EVERY view, receipt
+        //     or not — no chart IN THIS LIBRARY supplied it — so a gap about the
+        //     missing receipt was explaining an absence it does not cause, and on a
+        //     view that HAS a receipt nothing explained it at all. It went to
+        //     `UNGAPPED_FIELDS` with the reason that was true of it then.
+        //   • …AND CAME BACK in 9.93.0, because the measurement behind that reason
+        //     was incomplete: the agent chart's WINDOW STAGE drops turns for budget
+        //     on every run whose strategy engages, and since 9.93.0 it hands them
+        //     to the mint (`window/evictedTurns.ts`). The field is value-
+        //     conditional — absent when nothing was dropped before the call — and
+        //     the one thing that can lose a recorded drop is losing the receipt,
+        //     which is this gap. `cache.strategy` joined for the same reason: a
+        //     receipt-only fact, gone with the receipt.
+        // `requestMeasurement` is also receipt-only: its counts describe the
+        // initial PREPARED request, not the composition rebuilt by this view.
+        // Losing the whole receipt loses that witness. An older receipt may
+        // itself omit the optional field, and an attempted measurement may say
+        // `unavailable`; receiptAt preserves those states, never zero counts.
+        // Neither state means the receipt is missing or changes this gap's cause.
+        // The same applies to replayPreparations: downstream preparation was
+        // observed only when the enabled receipt carries its annotation.
+        //
+        // AND THE SEVENTH ROUND SCOPED THE PRINTED CLAIM TO THE LEVEL IT HOLDS AT.
+        // It said the absence of these fields is "a gap in the record, never a call
+        // made without them". True of each field AS A WHOLE — a receipt always
+        // carries `params` and always carries a `cache.transform` verdict, so those
+        // containers go missing only with the receipt. FALSE one level down, and
+        // that is the level a reader reads at: measured on an agent that set no
+        // dials, `receipt.params` is `{}` — an absence inside the container that IS
+        // "a call made without one", and `provider-defaults` says so on the very
+        // views that have a receipt. The sentence below claims nothing about what
+        // is inside a field it cannot see.
+        fields: Object.freeze([
+            'basis.model',
+            'basis.provider',
+            'basis.runId',
+            'basis.epoch',
+            'params',
+            'cache.transform',
+            'cache.transformHash',
+            'cache.markersApplied',
+            'cache.strategy',
+            'omittedForAttention',
+            'requestMeasurement',
+            'replayPreparations',
+        ]),
+        why: 'Nothing on this view has been checked against what went out. Every field below is ' +
+            'missing as a whole, and an absence among them says nothing about the call — not even ' +
+            'that a dial was left unset.',
+    }),
+    'no-run-log': Object.freeze({
+        // MECHANISM (not printed). Raised on `!location.hasRunLog` — a SUBTREE
+        // handed in on its own, with no run log to read. `readRunConstant` is the
+        // only reader that touches that log, and everything it fetches is a
+        // build-time fact `stages/seed.ts` wrote once: the forced output tool's
+        // NAME (`FORCED_OUTPUT_TOOL_KEY`), `toolWantsByName`, which
+        // `findStagedRefs` composes the nudge from, and — 9.101.0 — the findings
+        // ledger's serve mode (`findingsServe`), which `collapseJudged` folds
+        // judged tool results under. Losing that last one costs nothing on the
+        // default mode (`servedModeOf` falls back to it); under the bench-gated
+        // `'ledger-only'` the rebuilt `messages.entries` would carry fact results
+        // verbatim where the receipt hashed tickets — a subtree without its run
+        // log, on a mode no default reaches, recorded here rather than widened
+        // into `fields`.
+        //
+        // `tools.schemaHashes` is on the list because the forced tool's NAME is the
+        // run constant: losing it also loses the row the receipt hashes under that
+        // name. The fix a reader has is to pass the whole recording rather than the
+        // subtree, which is what the printed sentence says without naming any of
+        // this.
+        //
+        // THE MEASURED-FALSE SENTENCE, killed in 9.88.0's seventh round. It said
+        // "The fields below could not be fully recovered here" — a claim that the
+        // recovery DID fail. Driven on the ordinary view that raises this gap (a
+        // 'dynamic-grouped' agent with one plain tool, run log emptied), the
+        // damaged rebuild is byte-identical to the intact one: same `tools.names`,
+        // same `tools.schemas`, same absent `tools.forced`, same empty
+        // `messages.requestOnly`. The gap fires and costs NOTHING, and the sentence
+        // told the reader otherwise.
+        //
+        // THE REPAIR IS THE SENTENCE, NOT THE CONDITION, and the reason is that the
+        // condition cannot be narrowed by anything this file can read. What the
+        // missing log would have held is a forced tool's name and a `wants`
+        // declaration; whether the run had either is recorded IN THAT LOG. To fire
+        // the gap only where it costs something, the read would have to consult the
+        // record whose absence raises it. So the gap stays unconditional — it is
+        // the "you cannot tell" declaration, which is what this file is for — and
+        // the sentence became the conditional it always was: the fields MAY be
+        // short. Both directions are measured beside it in
+        // `gap-sentences.test.ts`: emptying the run log on a forced-output run
+        // takes the tool list from one name to none, on a staged-refs run it takes
+        // away the request-only line, and on the plain run it takes nothing.
+        fields: Object.freeze([
+            'tools.names',
+            'tools.forced',
+            'tools.schemaHashes',
+            'messages.requestOnly',
+        ]),
+        why: 'The fields below may be SHORT: a name can be missing from the tool list, and a line ' +
+            'that went out with the request can be missing too. An absence below is not evidence ' +
+            'that there was nothing there — read the whole recording rather than a piece of it.',
+    }),
+});
+/**
+ * The fields no gap names, and the reason each one needs none — the OTHER half
+ * of the account.
+ *
+ * WHY IT EXISTS. `SERVED_GAPS` was hand-checked against the two shapes three
+ * times in one release and came up short every time, because "is every field
+ * named by a gap?" was a question a person answered by reading. It is now a
+ * question a walk answers: `test/time-travel/gap-catalogue-walk.test.ts`
+ * enumerates every field a real `Receipt` and a real `ServedView` carry and
+ * requires each one to be named by a gap OR to be a key here. A field in
+ * neither fails, by name.
+ *
+ * So this is not an exemption list. It is the place a field goes when NO GAP'S
+ * MECHANISM EXPLAINS IT, and the value is the reason in one sentence, for the
+ * next person who asks why the field has no gap. Adding a key here is as
+ * reviewable as adding one to a gap, and that is the point: both are a claim
+ * somebody wrote down.
+ *
+ * TWO reasons qualified when this list was written, and one of them has since
+ * emptied out:
+ *
+ *   • NO FOLD CAN FAIL TO PRODUCE IT — the field is read straight off the
+ *     located epoch, never through a fold. `callRuntimeStageId` is this kind.
+ *   • ITS ABSENCE IS UNIVERSAL AND HAS NOTHING TO DO WITH THIS RECORDING — no
+ *     chart IN THIS LIBRARY supplies it, on any run, so no gap about a limit of
+ *     the rebuild describes it. `omittedForAttention` WAS this kind from
+ *     9.88.0's fourth review round to 9.93.0, and is not any more: the
+ *     measurement it rested on ("no chart drops for attention") had missed the
+ *     agent chart's window stage, which evicts turns for budget on every run
+ *     whose strategy engages and now files them on the receipt. A recorded
+ *     drop can be lost in exactly one way — with the receipt — so the field is
+ *     named by `no-receipt-on-chart` and is not here. The kind is kept on this
+ *     list because the next universally-absent field will need it, and because
+ *     a reason that was true for five releases and then measured false is
+ *     worth a sentence where the next person looks.
+ *
+ * A field a gap DOES name never belongs here, whatever else is also true of it.
+ * `epoch` was a key here through three rounds, on the true-but-irrelevant
+ * ground that `servedAt(k)` hands `k` back; what a base-less fold changes is
+ * what that number MEANS, `servedViews()` returns the fold's number outright,
+ * and `no-fold-base` names it now.
+ *
+ * Paths are spelled as they are on the shape that HAS the field — both keys
+ * here are `ServedView` fields. Gap `fields` are spelled as `Receipt` paths —
+ * see {@link ServedGap.fields} for the places the two shapes differ.
+ *
+ * @example
+ * ```ts
+ * import { SERVED_GAPS, UNGAPPED_FIELDS } from 'agentfootprint';
+ *
+ * // Why does nothing explain `callRuntimeStageId`? Because nothing has to.
+ * UNGAPPED_FIELDS['callRuntimeStageId'];
+ * Object.keys(SERVED_GAPS).length; // 7 gap kinds
+ * ```
+ */
+export const UNGAPPED_FIELDS = Object.freeze({
+    // MECHANISM (not printed). Read straight off `EpochLocation.callRuntimeStageId`,
+    // which `epochAt` takes from the call's own commit bundle — never through
+    // `keyedFold`, so no missing base and no missing run log can touch it. An
+    // epoch with no bundle is not located at all, so there is no view to carry it.
+    callRuntimeStageId: 'Never absent here, so there is nothing about it for a gap to excuse.',
+    // THE SENTENCE THE RULE IS MODELLED ON. It makes no claim about code at all:
+    // it says what the field MEANS inside the account, and nothing outside the
+    // sentence can falsify it. Every other entry in this file was reduced to
+    // this shape in 9.88.0's sixth round.
+    gaps: 'The account itself rather than a fact about the request: a gap naming this list would be ' +
+        'the account excusing its own absence.',
+});
+/** A gap record, assembled from the catalogue — plus, where the site that
+ *  raises it established one, the cause it read. */
+function gapOf(kind, cause) {
+    return { gap: kind, ...SERVED_GAPS[kind], ...(cause !== undefined && { cause }) };
+}
+/**
+ * The receipt this epoch's call committed, or WHY there is none. Shared by
+ * `receiptAt` and by the rebuild, which reads exactly TWO things off a receipt
+ * — the model/provider/runId basis, and whether a cache strategy stood between
+ * assembly and the port — and nothing else.
+ *
+ * THE ONE PLACE THAT KNOWS. This function is where the difference between
+ * "nothing was committed" and "something was committed and it is not a
+ * receipt" exists at all: everywhere else the two are one `undefined`. It used
+ * to be spent here, and the gap's printed sentence tried to make it up
+ * afterwards from a list of causes — which is how a shape refusal added in this
+ * release became a cause that sentence had already ruled out. So the answer
+ * carries the reason out, and {@link ServedGap.cause} is where it lands.
+ *
+ * THE ONE PLACE THAT NARROWS, too — and what it admits is what it says it
+ * admits. The check is the basis and nothing past it, so the value it hands
+ * back is a {@link StoredReceipt}: every container past the basis is what the
+ * MINTING release wrote, and a reader behind this narrowing reads them as
+ * optional, because the type says so and the compiler holds it to that.
+ * 9.93.0 read `receipt.cache.strategy` off a `Receipt` here — the minted
+ * shape, which promises `cache` — and a stored receipt with a basis and no
+ * `cache` made `servedAt` throw where 9.92 built a view. A reader reads the
+ * receipt it is handed; a missing container is a fact about the vintage,
+ * never a throw. It is also never repaired: nothing here fabricates a
+ * `cache: {}` or writes to the record.
+ */
+function readReceipt(location) {
+    const value = readAfterCall(location, RECEIPT_KEY);
+    // Nothing under the key: the run never minted one here. The record does not
+    // say which of the ways that happens applied, and neither does this.
+    if (value === undefined)
+        return { cause: 'no-receipt-committed' };
+    // Something IS under the key. A value without a basis is not a receipt —
+    // refuse it rather than hand back a half-shape a caller would read
+    // `.basis.runId` off — and REPORT the refusal, because a log that holds a
+    // non-receipt under the receipt key is damaged, which is a different fact
+    // about the recording from a run that never minted.
+    const candidate = value;
+    if (value === null || typeof value !== 'object' || typeof candidate.basis?.epoch !== 'number') {
+        return { cause: 'receipt-shape-rejected' };
+    }
+    return { receipt: value };
+}
+/** A committed tool list, or `undefined` when the key held no array — which is
+ *  what makes it a FALLBACK CHAIN and not a merge: the first key that holds a
+ *  list is the list this call served, and an empty array is an answer. */
+function toolListOf(value) {
+    return Array.isArray(value) ? value : undefined;
+}
+/** `toolWantsByName` back as the map `findStagedRefs` takes. It is committed
+ *  as a plain record because a `Map` does not survive the scope's write path
+ *  (an object write is JSON-round-tripped, and a `Map` round-trips to `{}`). */
+/**
+ * The serve mode `seed` put on the record (`findingsServe`), narrowed the way
+ * every run constant is: only the one non-default literal changes anything,
+ * and an absent or unrecognised value is the default the wire itself falls
+ * back to (`callLLM.ts · buildCallLLMStage`, `deps.findingsServe ?? …`) — so
+ * an unarmed run, which never wrote the key, collapses nothing.
+ */
+function servedModeOf(value) {
+    return value === 'ledger-only' ? 'ledger-only' : 'ledger-and-facts';
+}
+/**
+ * The answer-turn ask `seed` put on the record (`findingsAnswerAsk`, 9.103.0),
+ * narrowed the same way: only the one literal the wire ever writes appends
+ * the ask, and an absent key is the default the stage itself falls back to
+ * (`deps.findingsAnswerAsk ?? 'none'`) — so an armed run on the default,
+ * which never wrote the key, rebuilds the piece it served.
+ */
+function answerAskOf(value) {
+    return value === 'quote-facts' ? 'quote-facts' : 'none';
+}
+/**
+ * The declared ontology `seed` put on the record (`ontology`, 9.106.0),
+ * narrowed the way every run constant is: only a record carrying a `spec`
+ * with `nodes` and `sources` records composes a piece, and an absent key —
+ * every agent without `.ontology()` — composes nothing, which is what the
+ * wire did (`callLLM.ts · buildCallLLMStage`, under `deps.ontology`).
+ */
+function ontologyOf(value) {
+    if (value === null || typeof value !== 'object')
+        return undefined;
+    const { spec, tools } = value;
+    if (spec === null || typeof spec !== 'object')
+        return undefined;
+    const { nodes, sources } = spec;
+    if (nodes === null ||
+        typeof nodes !== 'object' ||
+        sources === null ||
+        typeof sources !== 'object') {
+        return undefined;
+    }
+    // The tool → skills join (9.108.0), taken as the record holds it — a
+    // record without the key (9.106.0, or a map naming only static tools)
+    // composes the bytes it always did.
+    const join = toolsJoinOf(tools);
+    return { spec: spec, ...(join !== undefined && { tools: join }) };
+}
+/** `tools` narrowed by shape: string → string[]; anything else is no join. */
+function toolsJoinOf(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const out = {};
+    for (const [name, ids] of Object.entries(value)) {
+        if (Array.isArray(ids) && ids.every((id) => typeof id === 'string'))
+            out[name] = ids;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function wantsMapOf(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const map = new Map();
+    for (const [name, kinds] of Object.entries(value)) {
+        if (Array.isArray(kinds) && kinds.every((k) => typeof k === 'string')) {
+            map.set(name, kinds);
+        }
+    }
+    return map.size > 0 ? map : undefined;
+}
+/**
+ * The BOUNDARY half of the fold law: a container that leaves this file is this
+ * file's own.
+ *
+ * `keyedFold` deep-freezes its answers, so nothing a consumer does to a view
+ * can reach a later epoch. This is the second, cheaper guarantee on top of it:
+ * the two arrays a view would otherwise ALIAS straight out of the fold — the
+ * conversation and the tool schemas — are copied, so `ServedView` is a value in
+ * its own right and not a window onto the fold's cache. Elements are the fold's
+ * frozen objects; the container is ours.
+ *
+ * Every other array on a view is built in `viewOf` from scratch and aliases
+ * nothing, so it needs the COPY half of this and not the freeze — but it is
+ * frozen anyway, by {@link frozenView}, because the type says `readonly`
+ * throughout and a claim that is true of two containers out of six is a claim
+ * a reader cannot use.
+ */
+function detachedList(items) {
+    return Object.freeze([...items]);
+}
+/**
+ * A `ServedView` is a VALUE — all of it, not the two containers that happened
+ * to need copying.
+ *
+ * Freezing the whole view costs a handful of `Object.freeze` calls per epoch
+ * over containers that are already the right size to hand a person: a few
+ * system pieces, at most one request-only line, a tool list, the gaps. It buys
+ * one sentence a reader can rely on instead of a rule about which two arrays
+ * are safe. `messages.asSent` and `tools.schemas` are already frozen by
+ * {@link detachedList} — their ELEMENTS are the fold's own frozen objects and
+ * this function does not walk into them, because they are not ours to freeze
+ * twice.
+ *
+ * What this is NOT: protection against a shared reference. Nothing on a view
+ * except those two arrays is shared with anything — every other container is
+ * built here per call. The freeze makes the type's promise exact; the copy in
+ * `detachedList` is what makes the fold safe.
+ */
+function frozenView(view) {
+    for (const piece of view.system.pieces)
+        Object.freeze(piece);
+    Object.freeze(view.system.pieces);
+    for (const line of view.messages.requestOnly)
+        Object.freeze(line);
+    Object.freeze(view.messages.requestOnly);
+    Object.freeze(view.tools.names);
+    for (const gap of view.gaps)
+        Object.freeze(gap);
+    Object.freeze(view.gaps);
+    if (view.basis !== undefined)
+        Object.freeze(view.basis);
+    Object.freeze(view.system);
+    Object.freeze(view.messages);
+    Object.freeze(view.tools);
+    return Object.freeze(view);
+}
+/** Rebuild one epoch's view from a located epoch. */
+function viewOf(location, served) {
+    // The receipt is read for exactly two things — WHICH model saw this, through
+    // WHICH provider, salted with WHICH run id; and whether a cache strategy
+    // stood between assembly and the port. Every other field below is rebuilt
+    // from committed pieces and never from the record it is checked against; a
+    // rebuild that read its own answer sheet would prove nothing. Both reads go
+    // through `readReceipt`'s narrowing and its type: a stored receipt carries
+    // what its vintage wrote, and nothing below dereferences a container the
+    // narrowing did not check.
+    const read = readReceipt(location);
+    const receipt = read.receipt;
+    // ── the system prompt ──────────────────────────────────────────────────
+    // The pieces are committed; the joined string never is. Same function the
+    // stage used, over the records as the stage read them.
+    const injections = (readAtCall(location, 'systemPromptInjections', served) ??
+        []);
+    const iteration = readAtCall(location, 'iteration', served);
+    const recovery = evidenceRecoveryPiece(readAtCall(location, 'evidenceRecovery', served), readAtCall(location, 'evidenceRecoveryUsed', served), iteration);
+    // ── the conversation ───────────────────────────────────────────────────
+    // Read BEFORE the call's own bundle: the call appends the assistant turn to
+    // `history`, so the committed value at the call already includes the answer.
+    //
+    // TWO committed sources, because there are two kinds of chart and they do
+    // not agree on where the conversation lives. The agent charts keep it in
+    // `history` and treat `messagesInjections` as an observability projection.
+    // `LLMCall` and the message-API charts have NO history at all: the messages
+    // slot IS the conversation, composed by `messagesFromInjections` — the same
+    // function called here. Reading only `history` on those charts found nothing
+    // and reported an empty conversation the provider never sent.
+    //
+    // Neither present ⇒ the turns are UNKNOWN, and the gap below says so rather
+    // than letting `[]` pass for a proof.
+    const committedHistory = readAtCall(location, 'history', served);
+    const committedInjections = readAtCall(location, 'messagesInjections', served);
+    const conversation = Array.isArray(committedHistory)
+        ? committedHistory
+        : Array.isArray(committedInjections)
+            ? [...messagesFromInjections(committedInjections)]
+            : undefined;
+    const committed = conversation ?? [];
+    const history = stripFrameworkFields(committed);
+    // ── the findings ledger, served (9.101.0, step 3) ──────────────────────
+    // The SAME two pure functions the stage used, over the SAME committed
+    // inputs, in the SAME order (`callLLM.ts · buildCallLLMStage`): the piece
+    // from the ledger at the call and the wire's tool ids (nothing else — no
+    // call number, so a re-ask rebuilds the same bytes it served) — derived
+    // here as the stage derived them, from the COMMITTED conversation BEFORE
+    // the collapse and the strip (an id is never rewritten, so either side
+    // agrees; the batch settlement's marker, 9.113.0, is still on it — a
+    // settled message is no result, `findings/offer.ts` · `isResultMessage`);
+    // the collapse under the mode `seed` put on the record as the run constant
+    // `findingsServe` (the `forcedOutputToolName` precedent — a build-time fact
+    // read from the RECORD, never from the receipt this view is checked
+    // against), stripped after it, and the answer-turn ask under the run
+    // constant `findingsAnswerAsk` (9.103.0), written only when the ask went
+    // out. No `.findings()` ⇒ no key ⇒ all three are no-ops and the rebuild is
+    // the bytes it always was; no new gap kind, `withheld` untouched.
+    const ledger = readAtCall(location, 'findingsLedger', served);
+    const findings = findingsLedgerPiece(ledger, servedToolCallIds(committed), answerAskOf(readRunConstant(location, 'findingsAnswerAsk', served)));
+    const collapsed = collapseJudged(committed, ledger, servedModeOf(readRunConstant(location, 'findingsServe', served)));
+    const asSent = collapsed === committed ? history : stripFrameworkFields(collapsed);
+    // ── the declared ontology, served (9.106.0) ────────────────────────────
+    // The SAME pure function the stage used, over the run constant `seed`
+    // wrote (the `findingsServe` precedent — a build-time fact read from the
+    // RECORD, never from the receipt this view is checked against). No
+    // `.ontology()` ⇒ no key ⇒ no piece, and the rebuild is the bytes it
+    // always was.
+    const ontologyRecord = ontologyOf(readRunConstant(location, 'ontology', served));
+    // The hidden skill ids the call was composed under (9.108.0) — a per-epoch
+    // key the tools slot publishes, read at the call as the stage read it.
+    const hiddenAtCall = readAtCall(location, 'hiddenSkillIds', served);
+    const ontology = ontologyRecord === undefined
+        ? undefined
+        : ontologyPiece(ontologyRecord.spec, {
+            ...(ontologyRecord.tools !== undefined && { tools: ontologyRecord.tools }),
+            ...(hiddenAtCall !== undefined && { hiddenSkillIds: hiddenAtCall }),
+        });
+    // ── the system prompt, joined ──────────────────────────────────────────
+    // Injections, then the recovery piece, then the ontology piece, then the
+    // findings piece — the fixed order the stage joins in. Every request-only
+    // piece is joined, never committed as an injection.
+    const composedPieces = recovery === undefined && ontology === undefined && findings === undefined
+        ? injections
+        : [
+            ...injections,
+            ...(recovery === undefined ? [] : [recovery]),
+            ...(ontology === undefined ? [] : [ontology]),
+            ...(findings === undefined ? [] : [findings]),
+        ];
+    const pieces = contributingPieces(composedPieces).map((record) => ({
+        text: record.rawContent,
+        slot: record.slot,
+        source: record.source,
+    }));
+    // ── the tools ──────────────────────────────────────────────────────────
+    // `dynamicToolSchemas` is the PRE-assembly list. Two rules run after it and
+    // both are on the record: the wrap-up call withholds every tool, and a
+    // 'tool-forced' strategy adds one.
+    //
+    // TWO committed sources, for the same reason the conversation above has two
+    // and with the same ordering rule (9.91.0). The agent charts map the tools
+    // slot's output onto `dynamicToolSchemas` at the mount boundary; the
+    // message-API charts carry it out under the slot's own name. Reading only
+    // the first reported an EMPTY tool list on a chart that served three — a
+    // Lens DENYING, about a fact the log holds perfectly well. The agent key is
+    // read first and the fallback is reached only when it holds no array, so no
+    // agent recording changes.
+    const withheld = readAtCall(location, 'wrapUpAsked', served) === true;
+    const dynamic = toolListOf(readAtCall(location, 'dynamicToolSchemas', served)) ??
+        toolListOf(readAtCall(location, 'toolSchemas', served)) ??
+        [];
+    const registered = withheld ? [] : dynamic;
+    const forcedRaw = readRunConstant(location, FORCED_OUTPUT_TOOL_KEY, served);
+    const forced = typeof forcedRaw === 'string' && forcedRaw.length > 0 ? forcedRaw : undefined;
+    // ── the request-only lines ─────────────────────────────────────────────
+    // The staged-refs nudge is a pure function of committed state: the
+    // conversation, the tools really served this call, and the `wants`
+    // declarations `seed` put on the record for exactly this reason.
+    const requestOnly = [];
+    const wants = wantsMapOf(readRunConstant(location, 'toolWantsByName', served));
+    if (wants !== undefined) {
+        const match = findStagedRefs(asSent, wants, new Set(registered.map((t) => t.name)));
+        if (match !== undefined) {
+            requestOnly.push({
+                role: 'user',
+                text: stagedRefsNudgeLine(match),
+                reason: 'staged-refs-nudge',
+            });
+        }
+    }
+    // The time line (step T6b) — the tools slot's committed composition, served only on the
+    // iteration that composed it and never on the wrap-up call (`callLLM` · the same three tests).
+    const timeLine = readAtCall(location, 'timeLine', served);
+    if (!withheld &&
+        typeof timeLine?.text === 'string' &&
+        timeLine.text.length > 0 &&
+        timeLine.iteration === readAtCall(location, 'iteration', served)) {
+        requestOnly.push({ role: 'user', text: timeLine.text, reason: 'time-window-line' });
+    }
+    // The evidence conclusion (the figures dial) — the committed carrier's late
+    // line, on the iteration its instruction is served (`callLLM` · the same test).
+    const conclusion = evidenceConclusionLine(readAtCall(location, 'evidenceRecovery', served), readAtCall(location, 'evidenceRecoveryUsed', served), iteration);
+    if (conclusion !== undefined) {
+        requestOnly.push({ role: 'user', text: conclusion, reason: 'evidence-conclusion' });
+    }
+    // ── what this view cannot prove ────────────────────────────────────────
+    // Order is deliberate: the two that make the WHOLE view suspect come first,
+    // so a renderer that shows one gap shows the one that matters most.
+    const gaps = [];
+    // BOTH bases, because there are two folds above and either can be baseless.
+    // Under 'dynamic-grouped' the epoch's pieces come from the turn's own inner
+    // log (`location.basis`) and every run constant — the forced tool's name, the
+    // `wants` the nudge is composed from — comes from the RUN log
+    // (`location.runBasis`). Raising the gap off the first alone let a grouped
+    // recording that travelled without its RUN base read every constant as absent
+    // and declare NOTHING: a Lens denying rather than omitting, which is the law
+    // this whole file is built on.
+    if (location.basis === 'log-only' || location.runBasis === 'log-only') {
+        gaps.push(gapOf('no-fold-base'));
+    }
+    if (conversation === undefined)
+        gaps.push(gapOf('no-conversation-on-record'));
+    if (!location.hasRunLog)
+        gaps.push(gapOf('no-run-log'));
+    // No receipt ⇒ nothing checks the rebuild, and the receipt-only fields are
+    // absent. Mutually exclusive with `provider-defaults` below, which is the
+    // caveat that applies when a receipt DID record the dials.
+    //
+    // The CAUSE rides along, from the one read that can tell "nothing was
+    // committed" from "something was, and it is not a receipt". The gap's
+    // sentence says neither — see {@link ServedGap.cause}.
+    if (read.receipt === undefined)
+        gaps.push(gapOf('no-receipt-on-chart', read.cause));
+    // A rewrite is possible only where a strategy stood between assembly and
+    // the port. The receipt says whether one did (`cache.strategy`, 9.93.0);
+    // with no receipt, or a receipt minted before the field — or the whole
+    // `cache` container — existed, the record cannot rule one out and the gap
+    // stays — the "you cannot tell" declaration, never an inference from
+    // absence. Only a receipt that SAYS `null` lifts it. The optional chain is
+    // the vintage law, not defensiveness: `StoredReceipt` declares both
+    // containers optional, so this is the one spelling that compiles.
+    if (receipt?.cache?.strategy !== null) {
+        gaps.push(gapOf('cache-transform'));
+    }
+    if (receipt !== undefined)
+        gaps.push(gapOf('provider-defaults'));
+    if (receipt?.replayPreparations !== undefined)
+        gaps.push(gapOf('thinking-replay'));
+    if (forced !== undefined)
+        gaps.push(gapOf('forced-tool-schema'));
+    return frozenView({
+        epoch: location.epoch,
+        callRuntimeStageId: location.callRuntimeStageId,
+        ...(receipt !== undefined && {
+            basis: {
+                model: receipt.basis.model,
+                provider: receipt.basis.provider,
+                runId: receipt.basis.runId,
+            },
+        }),
+        system: { text: joinSystemPrompt(composedPieces), pieces },
+        messages: { asSent: detachedList(asSent), requestOnly },
+        tools: {
+            names: [...registered.map((t) => t.name), ...(forced !== undefined ? [forced] : [])],
+            schemas: detachedList(registered),
+            ...(forced !== undefined && { forced }),
+            ...(withheld && { withheld: 'wrap-up' }),
+        },
+        gaps,
+    });
+}
+/**
+ * Rebuild what the model was SERVED on epoch `k`, from the run's committed
+ * pieces alone.
+ *
+ * Works on a live snapshot and on a recording read back from JSON, in both
+ * chart shapes, on a run whose conversation lives in `messagesInjections`
+ * rather than `history` (`LLMCall`, the message-API charts), on a resumed run
+ * (every read folds from the checkpoint the run was seeded with), on a
+ * redacted run (the pieces are read exactly as the run committed them — a
+ * redacted piece rebuilds to its redacted bytes, which is what the record says
+ * a reader is allowed to see) and on a recording made before the receipt
+ * existed.
+ *
+ * It returns `undefined` for ONE reason only: the run has no such epoch.
+ * Anything it cannot prove about an epoch that DOES exist comes back as a
+ * named entry in `gaps`, never as a missing view and never as a confident
+ * empty one.
+ *
+ * @param source a runner (`Agent`, `LLMCall`) or a snapshot. Where no receipt
+ *   was minted — a message-API chart handed no run id, a run that declined with
+ *   `recordReceipt: false`, a chart of the caller's own — the rebuild is
+ *   complete but UNCHECKED: `basis` is absent and `gaps` carries
+ *   `no-receipt-on-chart` saying so.
+ * @param epoch  the iteration number, 1-based — the run's own count.
+ *
+ * @example
+ * ```ts
+ * import { receiptAt, receiptHash, servedAt } from 'agentfootprint';
+ *
+ * const snapshot = agent.getSnapshot()!;
+ * const view = servedAt(snapshot, 1)!;
+ * const receipt = receiptAt(snapshot, 1)!;
+ * receiptHash(receipt.basis.runId, view.system.text) === receipt.system.hash; // true
+ * ```
+ */
+export function servedAt(source, epoch) {
+    const recording = recordingOf(source);
+    const location = epochAt(recording, epoch);
+    return location === undefined ? undefined : viewOf(location, servedUnderPolicy(recording));
+}
+/**
+ * Every epoch's served view, in run order — `servedAt` for a whole run, with
+ * one pass over the recording instead of one per epoch.
+ *
+ * @example
+ * ```ts
+ * servedViews(agent.getSnapshot()!).map((v) => v.tools.names.length); // [3, 3, 0]
+ * ```
+ */
+export function servedViews(source) {
+    const recording = recordingOf(source);
+    const served = servedUnderPolicy(recording);
+    return epochLocations(recording).map((location) => viewOf(location, served));
+}
+/**
+ * The receipt epoch `k`'s call left behind, or `undefined`.
+ *
+ * What comes back is a {@link StoredReceipt}: the receipt AS STORED, written
+ * by the release that minted it. A recording is older than the reader that
+ * opens it, so a container a later release added (`cache.strategy`, 9.93.0)
+ * may be absent — and it is handed back absent, not repaired, because the
+ * narrowing checks the basis and promises nothing past it. A reader reads the
+ * receipt it is handed; a missing container is a fact about the vintage,
+ * never a throw.
+ *
+ * `undefined` means one of two things on the record, and the same epoch's
+ * `servedAt(...)` view carries which: its `no-receipt-on-chart` gap has a
+ * {@link ServedGapCause}. Either nothing was committed under the receipt key —
+ * a recording made before the receipt existed, a chart whose LLM stage mints
+ * none, a run with `recordReceipt: false`, all of which leave that same record
+ * — or something WAS committed there and `readReceipt` refused it, because it
+ * is not a non-null object with a number at `basis.epoch`, and handing back a
+ * half-object a caller reads `.basis.runId` off is worse than saying no.
+ *
+ * It also returns `undefined` when the run has no epoch `k` at all, which is
+ * the answer `epochAt` gives and is not a fact about receipts; ask
+ * `servedAt(source, k)` if you need to tell a missing epoch from a missing
+ * receipt, because that one returns `undefined` for the missing epoch only.
+ *
+ * `servedAt` still rebuilds the view of an epoch that exists in every one of
+ * these cases, which is what makes an old recording readable instead of
+ * unreadable.
+ *
+ * The receipt comes back DEEP-FROZEN and is the same object every caller gets
+ * for this epoch: it is a value folded out of the log, and a fold's answers are
+ * detached (`keyedFold.ts` · `freezeDeep`). Copy it if you need to edit one.
+ *
+ * @example
+ * ```ts
+ * import { receiptAt } from 'agentfootprint';
+ *
+ * receiptAt(agent.getSnapshot()!, 3)?.tools.withheld; // 'wrap-up' on a wrap-up call
+ * ```
+ */
+export function receiptAt(source, epoch) {
+    const location = epochAt(source, epoch);
+    return location === undefined ? undefined : readReceipt(location).receipt;
+}
+//# sourceMappingURL=servedView.js.map