ccqa 1.40.2 → 1.40.4

package/dist/bin/ccqa.mjs

@@ -18,10 +18,11 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { promisify } from "node:util";
 import { createInterface } from "node:readline/promises";
 import { createServer } from "node:http";
+import { connect, createServer as createServer$1 } from "node:net";
+import { connect as connect$1 } from "node:tls";
 import { gunzipSync, gzipSync } from "node:zlib";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createInterface as createInterface$1 } from "node:readline";
-import { createServer as createServer$1 } from "node:net";
 //#region src/run/report-constants.ts
 /**
 * Pure report/run constants with no runtime dependencies. Kept separate from
@@ -6559,16 +6560,370 @@ function message$2(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
+//#region src/coverage/browser/ws.ts
+/**
+* Minimal RFC 6455 client for the CDP transport, dependency-free on purpose.
+*
+* Not a general WebSocket: it exists because the runtime's global `WebSocket`
+* (undici) unconditionally offers `permessage-deflate`, Chromium's DevTools
+* server accepts it with context takeover, and a single hiccup in that
+* stateful inflate stream kills the connection from the client side — the
+* browser and the spec keep running while the measurement silently dies.
+* Every CDP client that ships (Playwright, puppeteer) disables the extension;
+* this transport never offers it, so there is no compressed state to corrupt.
+*
+* Deliberately lenient where the payload is concerned — text arrives through
+* `Buffer.toString("utf8")`, so an invalid byte becomes U+FFFD instead of a
+* dead transport — and strict only about frame structure, where a violation
+* means the stream can no longer be trusted at all.
+*/
+const HANDSHAKE_TIMEOUT_MS = 1e4;
+const HANDSHAKE_HEADER_CAP = 64 * 1024;
+/** One assembled message; CDP takes and `IO.read` chunks reach megabytes, not this. */
+const MESSAGE_CAP = 256 * 1024 * 1024;
+const WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+const OP_CONTINUATION = 0;
+const OP_TEXT = 1;
+const OP_BINARY = 2;
+const OP_CLOSE = 8;
+const OP_PING = 9;
+const OP_PONG = 10;
+var WsError = class extends Error {};
+/** Why a 101 response head is unacceptable, or `undefined` when it is fine. */
+function handshakeFailure(head, expectedAccept, host) {
+	const [statusLine = "", ...headerLines] = head.split("\r\n");
+	if (!/^HTTP\/1\.1 101 /i.test(statusLine)) return `handshake with ${host} answered "${statusLine.slice(0, 80)}"`;
+	const headers = /* @__PURE__ */ new Map();
+	for (const line of headerLines) {
+		const colon = line.indexOf(":");
+		if (colon === -1) continue;
+		headers.set(line.slice(0, colon).trim().toLowerCase(), line.slice(colon + 1).trim());
+	}
+	if (headers.get("sec-websocket-accept") !== expectedAccept) return `handshake with ${host} returned a wrong Sec-WebSocket-Accept`;
+	const extensions = headers.get("sec-websocket-extensions");
+	if (extensions !== void 0 && extensions !== "") return `server negotiated unrequested extension "${extensions}"`;
+}
+var RawWebSocket = class RawWebSocket {
+	socket;
+	handlers;
+	buffer = Buffer.alloc(0);
+	/**
+	* Arrived-but-unparsed chunks. Left as a list until a parse attempt can
+	* make progress: a multi-megabyte take answered in one frame would
+	* otherwise re-copy everything buffered so far on every TCP chunk.
+	*/
+	pendingChunks = [];
+	pendingBytes = 0;
+	/** Bytes `buffer` must reach before another parse attempt can complete a frame. */
+	needed = 0;
+	fragments = [];
+	fragmentedBytes = 0;
+	fragmentedOpcode;
+	closeSent = false;
+	finished = false;
+	finishDetail;
+	peerCloseDetail;
+	/** Bytes that arrived with the 101, held until attach() wires the handlers. */
+	pendingLeftover;
+	isOpen = true;
+	constructor(socket) {
+		this.socket = socket;
+	}
+	get open() {
+		return this.isOpen;
+	}
+	/**
+	* Opens the socket and completes the upgrade. No `Sec-WebSocket-Extensions`
+	* is offered — that omission is this class's reason to exist — and a server
+	* that answers with one anyway is refused: it would speak a framing this
+	* side does not.
+	*/
+	static async connect(wsUrl) {
+		let url;
+		try {
+			url = new URL(wsUrl);
+		} catch {
+			throw new WsError(`not a ws URL: "${wsUrl}"`);
+		}
+		if (url.protocol !== "ws:" && url.protocol !== "wss:") throw new WsError(`not a ws URL: "${wsUrl}"`);
+		const secure = url.protocol === "wss:";
+		const port = url.port !== "" ? Number(url.port) : secure ? 443 : 80;
+		const host = url.hostname;
+		const socket = secure ? connect$1({
+			host,
+			port,
+			servername: host
+		}) : connect({
+			host,
+			port
+		});
+		socket.setNoDelay(true);
+		const key = randomBytes(16).toString("base64");
+		const expectedAccept = createHash("sha1").update(`${key}${WS_GUID}`).digest("base64");
+		const request = `GET ${`${url.pathname || "/"}${url.search}`} HTTP/1.1\r\nHost: ${url.host}\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ${key}\r\nSec-WebSocket-Version: 13\r\n\r\n`;
+		const leftover = await new Promise((resolve, reject) => {
+			let response = Buffer.alloc(0);
+			const timer = setTimeout(() => {
+				fail(new WsError(`handshake with ${url.host} timed out`));
+			}, HANDSHAKE_TIMEOUT_MS);
+			timer.unref?.();
+			const fail = (error) => {
+				cleanup();
+				socket.destroy();
+				reject(error);
+			};
+			const onData = (chunk) => {
+				response = Buffer.concat([response, chunk]);
+				const headerEnd = response.indexOf("\r\n\r\n");
+				if (headerEnd === -1) {
+					if (response.length > HANDSHAKE_HEADER_CAP) fail(new WsError(`handshake response from ${url.host} exceeded ${HANDSHAKE_HEADER_CAP} bytes`));
+					return;
+				}
+				const failure = handshakeFailure(response.subarray(0, headerEnd).toString("latin1"), expectedAccept, url.host);
+				if (failure !== void 0) {
+					fail(new WsError(failure));
+					return;
+				}
+				cleanup();
+				resolve(response.subarray(headerEnd + 4));
+			};
+			const onError = (error) => {
+				fail(new WsError(`could not connect to ${url.host} (${error.message})`));
+			};
+			const onEnd = () => {
+				fail(new WsError(`${url.host} closed the connection during the handshake`));
+			};
+			const cleanup = () => {
+				clearTimeout(timer);
+				socket.off("data", onData);
+				socket.off("error", onError);
+				socket.off("close", onEnd);
+			};
+			socket.on("data", onData);
+			socket.on("error", onError);
+			socket.on("close", onEnd);
+			socket.on("connect", () => socket.write(request));
+		});
+		const ws = new RawWebSocket(socket);
+		socket.on("data", (chunk) => ws.ingest(chunk));
+		socket.on("error", (error) => ws.finish(`socket error: ${error.message}`));
+		socket.on("close", () => ws.finish(ws.peerCloseDetail ?? "connection closed abruptly"));
+		socket.pause();
+		if (leftover.length > 0) ws.pendingLeftover = leftover;
+		return ws;
+	}
+	attach(handlers) {
+		this.handlers = handlers;
+		if (this.finished) {
+			handlers.onClose(this.finishDetail ?? "connection closed");
+			return;
+		}
+		const leftover = this.pendingLeftover;
+		this.pendingLeftover = void 0;
+		if (leftover !== void 0) this.ingest(leftover);
+		if (!this.finished) this.socket.resume();
+	}
+	/** Sends one text message. Throws `WsError` when the connection is gone. */
+	send(text) {
+		if (!this.isOpen) throw new WsError("connection closed");
+		this.sendFrame(OP_TEXT, Buffer.from(text, "utf8"));
+	}
+	/** Starts an orderly close; `onClose` fires when the socket is down. */
+	close() {
+		if (!this.isOpen) return;
+		this.isOpen = false;
+		this.peerCloseDetail ??= "connection closed";
+		try {
+			if (!this.closeSent) {
+				this.closeSent = true;
+				this.sendFrameRaw(OP_CLOSE, Buffer.from([3, 232]));
+			}
+			this.socket.end();
+		} catch {
+			this.socket.destroy();
+		}
+	}
+	ingest(chunk) {
+		if (this.finished) return;
+		this.pendingChunks.push(chunk);
+		this.pendingBytes += chunk.length;
+		if (this.buffer.length + this.pendingBytes < this.needed) return;
+		this.buffer = Buffer.concat([this.buffer, ...this.pendingChunks]);
+		this.pendingChunks = [];
+		this.pendingBytes = 0;
+		this.needed = 0;
+		for (;;) {
+			const frame = this.parseFrame();
+			if (frame === void 0 || this.finished) return;
+			this.handleFrame(frame.fin, frame.opcode, frame.payload);
+		}
+	}
+	parseFrame() {
+		const buf = this.buffer;
+		if (buf.length < 2) return void 0;
+		const first = buf[0] ?? 0;
+		const second = buf[1] ?? 0;
+		if ((first & 112) !== 0) {
+			this.fail(`frame with RSV bits set (0x${first.toString(16)}) though no extension was negotiated`);
+			return;
+		}
+		const fin = (first & 128) !== 0;
+		const opcode = first & 15;
+		const masked = (second & 128) !== 0;
+		let length = second & 127;
+		let offset = 2;
+		if (length === 126) {
+			if (buf.length < offset + 2) return void 0;
+			length = buf.readUInt16BE(offset);
+			offset += 2;
+		} else if (length === 127) {
+			if (buf.length < offset + 8) return void 0;
+			const big = buf.readBigUInt64BE(offset);
+			if (big > BigInt(MESSAGE_CAP)) {
+				this.fail(`frame of ${big} bytes exceeds the ${MESSAGE_CAP}-byte cap`);
+				return;
+			}
+			length = Number(big);
+			offset += 8;
+		}
+		let mask;
+		if (masked) {
+			if (buf.length < offset + 4) return void 0;
+			mask = buf.subarray(offset, offset + 4);
+			offset += 4;
+		}
+		if (buf.length < offset + length) {
+			this.needed = offset + length;
+			return;
+		}
+		const payload = Buffer.from(buf.subarray(offset, offset + length));
+		if (mask !== void 0) for (let i = 0; i < payload.length; i++) payload[i] = (payload[i] ?? 0) ^ (mask[i % 4] ?? 0);
+		this.buffer = buf.subarray(offset + length);
+		return {
+			fin,
+			opcode,
+			payload
+		};
+	}
+	handleFrame(fin, opcode, payload) {
+		switch (opcode) {
+			case OP_TEXT:
+			case OP_BINARY:
+				if (this.fragmentedOpcode !== void 0) {
+					this.fail("new data frame started inside a fragmented message");
+					return;
+				}
+				if (fin) {
+					this.deliver(payload);
+					return;
+				}
+				this.fragmentedOpcode = opcode;
+				this.fragments = [payload];
+				this.fragmentedBytes = payload.length;
+				return;
+			case OP_CONTINUATION:
+				if (this.fragmentedOpcode === void 0) {
+					this.fail("continuation frame outside a fragmented message");
+					return;
+				}
+				this.fragments.push(payload);
+				this.fragmentedBytes += payload.length;
+				if (this.fragmentedBytes > MESSAGE_CAP) {
+					this.fail(`fragmented message exceeds the ${MESSAGE_CAP}-byte cap`);
+					return;
+				}
+				if (fin) {
+					const whole = Buffer.concat(this.fragments);
+					this.fragments = [];
+					this.fragmentedBytes = 0;
+					this.fragmentedOpcode = void 0;
+					this.deliver(whole);
+				}
+				return;
+			case OP_PING:
+				try {
+					this.sendFrameRaw(OP_PONG, payload);
+				} catch {}
+				return;
+			case OP_PONG: return;
+			case OP_CLOSE: {
+				const code = payload.length >= 2 ? payload.readUInt16BE(0) : void 0;
+				const reason = payload.length > 2 ? payload.subarray(2).toString("utf8") : "";
+				this.peerCloseDetail = code === void 0 ? "connection closed" : `connection closed (code ${code}${reason ? `: ${reason}` : ""})`;
+				if (!this.closeSent) {
+					this.closeSent = true;
+					try {
+						this.sendFrameRaw(OP_CLOSE, payload.subarray(0, 2));
+					} catch {}
+				}
+				this.socket.end();
+				return;
+			}
+			default: this.fail(`unknown frame opcode 0x${opcode.toString(16)}`);
+		}
+	}
+	deliver(payload) {
+		this.handlers?.onMessage(payload.toString("utf8"));
+	}
+	sendFrame(opcode, payload) {
+		try {
+			this.sendFrameRaw(opcode, payload);
+		} catch (error) {
+			throw new WsError(`send failed: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+	sendFrameRaw(opcode, payload) {
+		const mask = randomBytes(4);
+		let header;
+		if (payload.length < 126) header = Buffer.from([128 | opcode, 128 | payload.length]);
+		else if (payload.length < 65536) {
+			header = Buffer.alloc(4);
+			header[0] = 128 | opcode;
+			header[1] = 254;
+			header.writeUInt16BE(payload.length, 2);
+		} else {
+			header = Buffer.alloc(10);
+			header[0] = 128 | opcode;
+			header[1] = 255;
+			header.writeBigUInt64BE(BigInt(payload.length), 2);
+		}
+		const masked = Buffer.from(payload);
+		for (let i = 0; i < masked.length; i++) masked[i] = (masked[i] ?? 0) ^ (mask[i % 4] ?? 0);
+		this.socket.write(Buffer.concat([
+			header,
+			mask,
+			masked
+		]));
+	}
+	fail(reason) {
+		this.socket.destroy();
+		this.finish(reason);
+	}
+	finish(detail) {
+		if (this.finished) return;
+		this.finished = true;
+		this.finishDetail = detail;
+		this.isOpen = false;
+		this.buffer = Buffer.alloc(0);
+		this.pendingChunks = [];
+		this.pendingBytes = 0;
+		this.fragments = [];
+		this.fragmentedBytes = 0;
+		this.handlers?.onClose(detail);
+	}
+};
+//#endregion
 //#region src/coverage/browser/cdp.ts
 /**
 * Minimal Chrome DevTools Protocol client, dependency-free on purpose.
 *
 * Coverage acquisition speaks a handful of domains over one transport, which
 * is not enough to justify a protocol library in a published CLI. The
-* transport is the `WebSocket` global — stable since Node 22 — so availability
-* is gated with an explicit error instead of a package.json engines bump:
-* everything else in ccqa still runs on 20, and only `--coverage`'s browser
-* half needs more.
+* transport is `./ws.ts`'s own RFC 6455 client, not the `WebSocket` global:
+* the global (undici) unconditionally negotiates `permessage-deflate` with
+* Chromium's DevTools server, and one hiccup in that stateful inflate stream
+* kills the connection from the client side while the browser and the spec
+* keep running (observed in CI as every measurement dying mid-spec).
 */
 var CdpError = class extends Error {};
 /**
@@ -6590,10 +6945,6 @@ function trace(direction, text) {
 		appendFileSync(TRACE_FILE, line);
 	} catch {}
 }
-/** Throws with the actual requirement when the runtime cannot open the socket. */
-function requireWebSocket() {
-	if (typeof WebSocket === "undefined") throw new CdpError(`browser coverage needs the WebSocket global (node 22+); this is node ${process.version}`);
-}
 /**
 * Resolves whatever a target hands us — `host:port`, an `http://` endpoint, or
 * a ws URL — to the **browser-level** ws endpoint. A page-level ws URL is not
@@ -6626,21 +6977,18 @@ var CdpClient = class CdpClient {
 	closeHandlers = /* @__PURE__ */ new Set();
 	constructor(ws) {
 		this.ws = ws;
-		ws.addEventListener("message", (event) => this.receive(String(event.data)));
-		ws.addEventListener("close", () => this.drop("connection closed"));
-		ws.addEventListener("error", () => this.drop("connection error"));
+		ws.attach({
+			onMessage: (text) => this.receive(text),
+			onClose: (detail) => this.drop(detail)
+		});
 	}
 	static async connect(wsUrl) {
-		requireWebSocket();
-		const ws = new WebSocket(wsUrl);
-		await new Promise((resolve, reject) => {
-			ws.addEventListener("open", () => resolve(), { once: true });
-			ws.addEventListener("error", () => reject(new CdpError(`could not connect to ${wsUrl}`)), { once: true });
-		});
-		return new CdpClient(ws);
+		return new CdpClient(await RawWebSocket.connect(wsUrl).catch((error) => {
+			throw new CdpError(`could not connect to ${wsUrl} (${message$1(error)})`);
+		}));
 	}
 	send(method, params, sessionId) {
-		if (this.ws.readyState !== WebSocket.OPEN) return Promise.reject(new CdpError(`${method}: connection closed`));
+		if (!this.ws.open) return Promise.reject(new CdpError(`${method}: connection closed`));
 		const id = this.nextId++;
 		const promise = new Promise((resolve, reject) => {
 			this.pending.set(id, {
@@ -6650,12 +6998,17 @@ var CdpClient = class CdpClient {
 			});
 		});
 		trace("->", `#${id} ${method} sid:${shortId(sessionId)}`);
-		this.ws.send(JSON.stringify({
-			id,
-			method,
-			params: params ?? {},
-			sessionId
-		}));
+		try {
+			this.ws.send(JSON.stringify({
+				id,
+				method,
+				params: params ?? {},
+				sessionId
+			}));
+		} catch (error) {
+			this.pending.delete(id);
+			return Promise.reject(new CdpError(`${method}: ${message$1(error)}`));
+		}
 		return promise;
 	}
 	on(method, handler) {
@@ -6705,10 +7058,11 @@ var CdpClient = class CdpClient {
 		}
 	}
 	drop(reason) {
+		trace("!!", `dropped: ${reason}`);
 		for (const waiting of this.pending.values()) waiting.reject(new CdpError(`${waiting.method}: ${reason}`));
 		this.pending.clear();
 		for (const handler of this.closeHandlers) try {
-			handler();
+			handler(reason);
 		} catch {}
 		this.closeHandlers.clear();
 	}
@@ -6733,14 +7087,25 @@ const TAKE_INTERVAL_MS = 400;
 const NAVIGATION_GUARD_MS = 5e3;
 /** How long `stop()` waits for the final take before declaring the tail lost. */
 const STOP_TAKE_TIMEOUT_MS = 2e3;
+/**
+* Dropped-transport reconnects per engine (= per spec). Bounded because a
+* deterministic failure — a proxy mangling frames, a peer that keeps
+* violating the framing — would otherwise loop for the whole spec; four
+* doubling delays cover a browser that was merely busy.
+*/
+const MAX_RECONNECTS = 4;
+const RECONNECT_BASE_MS = 200;
 /** The browser's own chrome. Nothing there is the application under test. */
 const INTERNAL_URL = /^(chrome|chrome-untrusted|chrome-extension|devtools):/;
 async function startBrowserCoverage(opts) {
-	const client = await (opts.connect ?? ((wsUrl) => CdpClient.connect(wsUrl)))(await browserWebSocketUrl(opts.cdpUrl));
-	const engine = new Engine(client, opts);
+	const connect = opts.connect ?? ((wsUrl) => CdpClient.connect(wsUrl));
+	const wsUrl = await browserWebSocketUrl(opts.cdpUrl);
+	const client = await connect(wsUrl);
+	const engine = new Engine(client, opts, connect, wsUrl);
 	try {
 		await engine.arm();
 	} catch (error) {
+		engine.abandon();
 		client.close();
 		throw error;
 	}
@@ -6748,6 +7113,10 @@ async function startBrowserCoverage(opts) {
 }
 var Engine = class {
 	client;
+	connectFn;
+	wsUrl;
+	reconnects = 0;
+	reconnectInFlight = false;
 	opts;
 	resolution;
 	pages = /* @__PURE__ */ new Map();
@@ -6760,11 +7129,15 @@ var Engine = class {
 	armedTargets = /* @__PURE__ */ new Set();
 	/** Sessions whose take failure was already said; see enqueueTake. */
 	warnedTakeSessions = /* @__PURE__ */ new Set();
+	/** Same, for the cookie warning: one per session, not one per 400ms tick. */
+	warnedCookieSessions = /* @__PURE__ */ new Set();
 	cookies;
 	timer;
 	stopped = false;
-	constructor(client, opts) {
+	constructor(client, opts, connectFn, wsUrl) {
 		this.client = client;
+		this.connectFn = connectFn;
+		this.wsUrl = wsUrl;
 		this.opts = opts;
 		this.cookies = opts.origins.map((url) => ({
 			name: COVERAGE_COOKIE,
@@ -6812,10 +7185,14 @@ var Engine = class {
 			if (page === void 0 || !this.isMainFrame(page, params.frameId)) return;
 			page.navigatingSince = void 0;
 		});
-		this.client.onClose(() => {
+		this.client.onClose((reason) => {
 			if (!this.stopped && this.pages.size > 0) this.resolution.markStopped();
 			this.pages.clear();
-			if (this.timer !== void 0) clearInterval(this.timer);
+			this.armedTargets.clear();
+			this.warnedTakeSessions.clear();
+			this.warnedCookieSessions.clear();
+			this.clearTimer();
+			if (!this.stopped) this.reconnect(reason);
 		});
 		await this.client.send("Target.setAutoAttach", {
 			autoAttach: true,
@@ -6824,13 +7201,10 @@ var Engine = class {
 			filter: [{ type: "tab" }, { exclude: true }]
 		});
 		const existing = await this.client.send("Target.getTargets", { filter: [{ type: "tab" }] });
-		for (const info of existing.targetInfos) {
-			if (this.armedTargets.has(info.targetId)) continue;
-			await this.client.send("Target.attachToTarget", {
-				targetId: info.targetId,
-				flatten: true
-			}).catch(() => void 0);
-		}
+		await Promise.all(existing.targetInfos.filter((info) => !this.armedTargets.has(info.targetId)).map((info) => this.client.send("Target.attachToTarget", {
+			targetId: info.targetId,
+			flatten: true
+		}).catch(() => void 0)));
 		this.timer = setInterval(() => {
 			for (const page of this.pages.values()) {
 				this.enqueueTake(page.sessionId);
@@ -6839,9 +7213,71 @@ var Engine = class {
 		}, TAKE_INTERVAL_MS);
 		this.timer.unref?.();
 	}
+	/**
+	* A dropped transport is re-opened and re-armed, bounded by
+	* `MAX_RECONNECTS`. Sound to retry: `startPreciseCoverage` restarts the
+	* counters from zero and `absorbEntries` takes the union of covered
+	* ranges, so a re-measured page adds to the result instead of doubling it.
+	* What ran while disconnected is gone either way — `markStopped` was
+	* already recorded when the transport dropped, so the hole stays visible
+	* in the result even after a successful reconnect.
+	*/
+	clearTimer() {
+		if (this.timer !== void 0) clearInterval(this.timer);
+		this.timer = void 0;
+	}
+	/** Stops a never-armed engine: no takes ran, so there is nothing to flush. */
+	abandon() {
+		this.stopped = true;
+		this.clearTimer();
+	}
+	async reconnect(initialReason) {
+		if (this.reconnectInFlight) return;
+		this.reconnectInFlight = true;
+		try {
+			let reason = initialReason;
+			while (!this.stopped) {
+				if (this.reconnects >= MAX_RECONNECTS) {
+					this.opts.warn(`browser coverage transport dropped (${reason}); giving up after ${MAX_RECONNECTS} reconnects — the rest of the spec goes unmeasured`);
+					return;
+				}
+				this.reconnects += 1;
+				const delay = RECONNECT_BASE_MS * 2 ** (this.reconnects - 1);
+				this.opts.warn(`browser coverage transport dropped (${reason}); reconnecting in ${delay}ms (${this.reconnects}/${MAX_RECONNECTS})`);
+				await new Promise((resolve) => setTimeout(resolve, delay));
+				if (this.stopped) return;
+				let fresh;
+				try {
+					fresh = await this.connectFn(this.wsUrl);
+				} catch (error) {
+					reason = `reconnect failed: ${message(error)}`;
+					continue;
+				}
+				if (this.stopped) {
+					fresh.close();
+					return;
+				}
+				this.client = fresh;
+				try {
+					await this.arm();
+				} catch (error) {
+					fresh.close();
+					reason = `reconnect failed: ${message(error)}`;
+					continue;
+				}
+				if (this.stopped) {
+					this.clearTimer();
+					fresh.close();
+				}
+				return;
+			}
+		} finally {
+			this.reconnectInFlight = false;
+		}
+	}
 	async stop() {
 		this.stopped = true;
-		if (this.timer !== void 0) clearInterval(this.timer);
+		this.clearTimer();
 		let sawEverything = ![...this.pages.values()].some((page) => !page.armed);
 		for (const page of this.pages.values()) page.navigatingSince = void 0;
 		const takes = Promise.all([...this.pages.keys()].map((sessionId) => this.enqueueTake(sessionId)));
@@ -6906,6 +7342,9 @@ var Engine = class {
 	setCookies(page) {
 		if (this.cookies.length === 0) return Promise.resolve();
 		return this.client.send("Network.setCookies", { cookies: this.cookies }, page.sessionId).catch((error) => {
+			if (this.stopped || !this.pages.has(page.sessionId)) return;
+			if (this.warnedCookieSessions.has(page.sessionId)) return;
+			this.warnedCookieSessions.add(page.sessionId);
 			this.opts.warn(`could not attach the spec cookie (${message(error)})`);
 		});
 	}
@@ -7140,6 +7579,10 @@ var CoverageSession = class CoverageSession {
 	get sinkUrl() {
 		return this.sink?.url ?? "";
 	}
+	/** The id this run's events carry in the stream — what a hub resolve is asked for. */
+	get streamRunId() {
+		return this.runId;
+	}
 	/**
 	* True in hub mode: the facts leave as a stream, rows carry no coverage,
 	* and the run-side health read-outs below answer empty. The one mode flag
@@ -11443,6 +11886,189 @@ function foldTouchIndex(current, entry, selection) {
 	}
 	return out;
 }
+z.object({
+	runId: z.string(),
+	hubRunId: z.string().optional(),
+	asOf: z.number(),
+	lastSeq: z.number(),
+	universe: z.object({
+		include: z.array(z.string()),
+		files: z.array(z.string())
+	}).optional(),
+	specs: z.array(z.object({
+		specId: z.string(),
+		files: z.array(z.string()),
+		actorEvents: z.record(z.string(), z.number())
+	})),
+	boot: z.array(z.string()),
+	health: z.object({
+		heardFromApplication: z.boolean(),
+		pushesDuringRun: z.number(),
+		attributedSpecs: z.number(),
+		rejectedPushes: z.number(),
+		uninstrumentedFiles: z.number(),
+		uninstrumentedProcesses: z.number(),
+		droppedPushes: z.number(),
+		unmappedActorEvents: z.number(),
+		outsideWindowEvents: z.record(z.string(), z.number()),
+		specsMeasured: z.number()
+	})
+});
+/**
+* One read-out line for a resolved spec — shared by the run-end summary and
+* `ccqa hub coverage`, so the two never drift on how a measurement reads.
+*/
+function formatResolvedSpec(spec) {
+	const actors = Object.entries(spec.actorEvents).map(([key, count]) => `${key}: ${count} event(s)`).join(", ");
+	return `${spec.specId}: ${spec.files.length} file(s)${actors ? ` (${actors})` : ""}`;
+}
+/**
+* Interprets `runId`'s view of the stream.
+*
+* Two passes, because the resolver needs its context up front: the first
+* collects what the run's own markers establish — which ids it issued, which
+* identity tags were its to hand out, its universe, and when its first and
+* last marker arrived. The second replays the stream through the shared
+* resolver: this run's window markers as they came, and every application
+* push — as-is when its stamp falls inside the span the run's sink would
+* have been listening (first marker to last marker plus `GRACE_MS`),
+* stripped of its spec and actor attribution when it does not. A push
+* outside the span was another run's audience, so its attribution is not
+* this run's to claim — but the collector never re-sends what an earlier
+* run acked, so on an always-on hub the boot set and each process's health
+* figures arrived long before this run began, and only survive here.
+*/
+function resolveStream(events, runId) {
+	const issued = /* @__PURE__ */ new Set();
+	const specOrder = [];
+	const tagToKey = /* @__PURE__ */ new Map();
+	const browserFiles = /* @__PURE__ */ new Map();
+	let universe;
+	let hubRunId;
+	let firstMarkerAt;
+	let lastMarkerAt = 0;
+	for (const event of events) {
+		const body = event.body;
+		if (!("kind" in body) || body.runId !== runId) continue;
+		if (firstMarkerAt === void 0) firstMarkerAt = event.at;
+		lastMarkerAt = event.at;
+		switch (body.kind) {
+			case "spec-open":
+				if (!issued.has(body.specId)) {
+					issued.add(body.specId);
+					specOrder.push(body.specId);
+				}
+				break;
+			case "window-open":
+				tagToKey.set(body.tag, body.key);
+				break;
+			case "universe":
+				universe = {
+					include: body.include,
+					files: body.files
+				};
+				break;
+			case "run-link":
+				hubRunId = body.hubRunId;
+				break;
+			case "browser": {
+				const files = browserFiles.get(body.specId) ?? /* @__PURE__ */ new Set();
+				for (const file of body.files) files.add(file);
+				browserFiles.set(body.specId, files);
+				break;
+			}
+		}
+	}
+	const resolver = new CoverageResolver(issued, tagToKey);
+	let asOf = 0;
+	let lastSeq = 0;
+	let pushesDuringRun = 0;
+	for (const event of events) {
+		if (event.seq > lastSeq) lastSeq = event.seq;
+		const body = event.body;
+		if ("kind" in body) {
+			if (body.runId !== runId) continue;
+			asOf = event.at;
+			if (body.kind === "window-open") resolver.apply({
+				kind: "window-open",
+				at: event.at,
+				tag: body.tag,
+				key: body.key,
+				specId: body.specId
+			});
+			else if (body.kind === "window-close") resolver.apply({
+				kind: "window-close",
+				at: event.at,
+				tag: body.tag
+			});
+			continue;
+		}
+		if (firstMarkerAt === void 0 || event.at < firstMarkerAt || event.at > lastMarkerAt + 3e4) {
+			resolver.apply({
+				kind: "push",
+				at: event.at,
+				push: {
+					...body,
+					specs: {},
+					actors: []
+				}
+			});
+			continue;
+		}
+		asOf = event.at;
+		pushesDuringRun++;
+		resolver.apply({
+			kind: "push",
+			at: event.at,
+			push: body
+		});
+	}
+	const specs = specOrder.map((specId) => {
+		const actorEvents = {};
+		for (const [key, count] of resolver.actorEventsFor(specId)) actorEvents[key] = count;
+		return {
+			specId,
+			files: [...new Set([...resolver.filesFor(specId) ?? [], ...browserFiles.get(specId) ?? []])].sort(),
+			actorEvents
+		};
+	});
+	const outsideWindowEvents = {};
+	for (const [key, count] of resolver.outsideWindowEvents()) outsideWindowEvents[key] = count;
+	return {
+		runId,
+		...hubRunId !== void 0 ? { hubRunId } : {},
+		asOf,
+		lastSeq,
+		...universe !== void 0 ? { universe } : {},
+		specs,
+		boot: [...resolver.boot()].sort(),
+		health: {
+			heardFromApplication: resolver.heardFromApplication(),
+			pushesDuringRun,
+			attributedSpecs: resolver.attributedSpecs(),
+			rejectedPushes: resolver.rejectedPushes(),
+			uninstrumentedFiles: resolver.uninstrumentedFiles(),
+			uninstrumentedProcesses: resolver.uninstrumentedProcesses(),
+			droppedPushes: resolver.droppedPushes(),
+			unmappedActorEvents: resolver.unmappedActorEvents(),
+			outsideWindowEvents,
+			specsMeasured: specs.length
+		}
+	};
+}
+/**
+* Every run that opened a spec in this stream, most recently heard-from
+* first — recency by the arrival position of each run's latest spec-open,
+* the one order the hub's stamps establish.
+*/
+function listRunIds(events) {
+	const lastOpenIndex = /* @__PURE__ */ new Map();
+	events.forEach((event, index) => {
+		const body = event.body;
+		if ("kind" in body && body.kind === "spec-open") lastOpenIndex.set(body.runId, index);
+	});
+	return [...lastOpenIndex.entries()].sort((a, b) => b[1] - a[1]).map(([id]) => id);
+}
 //#endregion
 //#region src/cli/session.ts
 const AB = resolveAgentBrowserBin$1();
@@ -11566,7 +12192,7 @@ function resolveBaseUrl(opts) {
 	return baseUrl.replace(/\/+$/, "");
 }
 /** Resolve the hub client from flags / env, or exit 2 with a clear message. */
-function connect(opts) {
+function connect$2(opts) {
 	const client = resolveHubClient(opts);
 	if (client) return client;
 	resolveBaseUrl(opts);
@@ -11615,7 +12241,7 @@ const sessionPush = new Command("push").description("Upload a locally-saved brow
 		hint(`create it first with:  ccqa hub session capture ${name}${opts.profile ? ` --profile ${opts.profile}` : ""}`);
 		process.exit(2);
 	}
-	await connect(opts).putSession(project, profile, name, state);
+	await connect$2(opts).putSession(project, profile, name, state);
 	header("hub session push", name);
 	meta("project", project);
 	meta("profile", profile);
@@ -11624,7 +12250,7 @@ const sessionPush = new Command("push").description("Upload a locally-saved brow
 const sessionLs = new Command("ls").description("List sessions stored on the hub for a project/profile (names + last-updated times). `ls` shows metadata only.").option(...hubUrlOption).option(...hubTokenOption).option(...projectOption).option(...profileOption).option(...cwdOption).action(withHubErrors(async (opts) => {
 	const project = resolveProject(opts);
 	const profile = opts.profile ?? "default";
-	const sessions = await connect(opts).listSessions(project, profile);
+	const sessions = await connect$2(opts).listSessions(project, profile);
 	header("hub sessions", `${project}/${profile}`);
 	if (sessions.length === 0) {
 		info("no sessions stored on the hub for this project/profile");
@@ -11636,7 +12262,7 @@ const sessionRm = new Command("rm").description("Delete a session from the hub."
 	const name = validateSessionName(rawName);
 	const project = resolveProject(opts);
 	const profile = opts.profile ?? "default";
-	await connect(opts).deleteSession(project, profile, name);
+	await connect$2(opts).deleteSession(project, profile, name);
 	header("hub session rm", name);
 	info(`deleted session "${name}" from the hub`);
 }));
@@ -11649,7 +12275,7 @@ const varSet = new Command("set").description("Store an environment variable on
 		error("no value provided (pass --value <value> or pipe it on stdin)");
 		process.exit(2);
 	}
-	await connect(opts).putVariable(project, profile, name, {
+	await connect$2(opts).putVariable(project, profile, name, {
 		value,
 		sensitive: opts.sensitive ?? false
 	});
@@ -11662,7 +12288,7 @@ const varSet = new Command("set").description("Store an environment variable on
 const varLs = new Command("ls").description("List variables stored on the hub for a project/profile. Non-sensitive values are shown inline; sensitive ones are hidden here but still fetched at run time by `ccqa run` / `ccqa record`.").option(...hubUrlOption).option(...hubTokenOption).option(...projectOption).option(...profileOption).option(...cwdOption).action(withHubErrors(async (opts) => {
 	const project = resolveProject(opts);
 	const profile = opts.profile ?? "default";
-	const variables = await connect(opts).listVariables(project, profile);
+	const variables = await connect$2(opts).listVariables(project, profile);
 	header("hub variables", `${project}/${profile}`);
 	if (variables.length === 0) {
 		info("no variables stored on the hub for this project/profile");
@@ -11676,7 +12302,7 @@ const varLs = new Command("ls").description("List variables stored on the hub fo
 const varRm = new Command("rm").description("Delete a variable from the hub.").argument("<name>", "Variable name to delete").option(...hubUrlOption).option(...hubTokenOption).option(...projectOption).option(...profileOption).option(...cwdOption).action(withHubErrors(async (name, opts) => {
 	const project = resolveProject(opts);
 	const profile = opts.profile ?? "default";
-	await connect(opts).deleteVariable(project, profile, name);
+	await connect$2(opts).deleteVariable(project, profile, name);
 	header("hub var rm", name);
 	info(`deleted variable "${name}" from the hub`);
 }));
@@ -11707,14 +12333,14 @@ const promptPush = new Command("push").description("Upload a locally-generated p
 		hint("nothing to push; generate it first (e.g. ccqa run --learn-hub-live-prompt)");
 		process.exit(2);
 	}
-	await connect(opts).putPrompt(project, name, body);
+	await connect$2(opts).putPrompt(project, name, body);
 	header("hub prompt push", name);
 	meta("project", project);
 	info(`uploaded prompt "${name}" to the hub`);
 }));
 const promptLs = new Command("ls").description("List prompts stored on the hub for a project (name, kind, last-updated). Prompts are project-wide (not per-profile). `ls` shows metadata only.").option(...hubUrlOption).option(...hubTokenOption).option(...projectOption).option(...cwdOption).action(withHubErrors(async (opts) => {
 	const project = resolveProject(opts);
-	const prompts = await connect(opts).listPrompts(project);
+	const prompts = await connect$2(opts).listPrompts(project);
 	header("hub prompts", project);
 	if (prompts.length === 0) {
 		info("no prompts stored on the hub for this project");
@@ -11725,7 +12351,7 @@ const promptLs = new Command("ls").description("List prompts stored on the hub f
 const promptRm = new Command("rm").description("Delete a prompt from the hub.").argument("<name>", "Prompt name to delete").option(...hubUrlOption).option(...hubTokenOption).option(...projectOption).option(...cwdOption).action(withHubErrors(async (rawName, opts) => {
 	const name = validatePromptName(rawName);
 	const project = resolveProject(opts);
-	await connect(opts).deletePrompt(project, name);
+	await connect$2(opts).deletePrompt(project, name);
 	header("hub prompt rm", name);
 	info(`deleted prompt "${name}" from the hub`);
 }));
@@ -11736,7 +12362,7 @@ const deployRecord = new Command("record").description("Tell the hub what a depl
 async function runDeployRecord(opts) {
 	const cwd = resolveCwd(opts.cwd);
 	const project = resolveProject(opts);
-	const hub = connect(opts);
+	const hub = connect$2(opts);
 	const previous = opts.previous ?? await deployHeadSha(hub, project, opts.profile);
 	const runUrl = githubRunUrl();
 	const diff = previous === null ? null : await diffOrNull(previous, opts.sha, cwd);
@@ -11830,7 +12456,7 @@ async function runCostPush(opts) {
 		process.exit(2);
 	}
 	const project = resolveProject(opts);
-	const hub = connect(opts);
+	const hub = connect$2(opts);
 	header("hub cost push", opts.label);
 	meta("project", project);
 	const total = await readCostFileTotal(path);
@@ -11872,7 +12498,7 @@ const pushCommand = new Command("push").description("Upload the report directory
 	const deployedSha = parsed.data.deployedSha;
 	const branch = opts.branch ?? await detectBranch(cwd);
 	const archive = await packDirToTarGz(reportDir);
-	const run = await connect(opts).pushRun(archive, {
+	const run = await connect$2(opts).pushRun(archive, {
 		project,
 		...branch ? { branch } : {},
 		...opts.profile ? { profile: opts.profile } : {},
@@ -11888,7 +12514,7 @@ const pushCommand = new Command("push").description("Upload the report directory
 }));
 const attestCommand = new Command("attest").argument("<feature/spec>", "Spec id, e.g. checkout/happy-path").description("Record that a person checked a spec's behaviour by hand against the deployed environment. The verdict answers manuallyVerified instead of asking a person for what a person already did — the drift ledger is untouched, so the repair loop keeps its reason to fix the test. The attestation lapses on its own when a deploy reaches the spec or the spec is edited.").requiredOption("--profile <name>", "Environment that was checked (e.g. 'stg'). The attestation is anchored to its current deploy head.").option("--by <name>", "Who checked. Required unless --revoke.").option("--note <text>", "What was checked and how — the reader deciding whether to trust it sees this.").option("--revoke", "Withdraw the spec's attestation instead of recording one.").option(...hubUrlOption).option(...hubTokenOption).option("--project <name>", "Hub project. Defaults to the current directory's name.").option("--cwd <path>", "Directory the default --project name is resolved against.").action(withHubErrors(async (rawSpecId, opts) => {
 	const project = resolveProject(opts);
-	const hub = connect(opts);
+	const hub = connect$2(opts);
 	const specId = requireSpecId(rawSpecId);
 	if (opts.revoke) {
 		await hub.deleteAttestation(project, { profile: opts.profile }, specId);
@@ -11911,7 +12537,7 @@ const attestCommand = new Command("attest").argument("<feature/spec>", "Spec id,
 }));
 const dismissCommand = new Command("dismiss").argument("<feature/spec>", "Spec id, e.g. checkout/happy-path").description("Record that a person judged the spec's current audit finding wrong: the spec describes the code fine. This settles the audit axis rather than the verdict — the spec goes back to being run like any other, and the next run says whether the person was right. The dismissal is pinned to the audit run that raised the finding, so a later audit can raise it again. No --profile: a finding is about the repository, not an environment.").option("--by <name>", "Who judged it wrong. Required unless --revoke.").option("--reason <text>", "Why the finding is wrong. Required unless --revoke — this is what a mis-firing audit learns from.").option("--revoke", "Withdraw the dismissal, putting the finding back in force.").option(...hubUrlOption).option(...hubTokenOption).option("--project <name>", "Hub project. Defaults to the current directory's name.").option("--cwd <path>", "Directory the default --project name is resolved against.").action(withHubErrors(async (rawSpecId, opts) => {
 	const project = resolveProject(opts);
-	const hub = connect(opts);
+	const hub = connect$2(opts);
 	const specId = requireSpecId(rawSpecId);
 	if (opts.revoke) {
 		await hub.deleteAuditDismissal(project, specId);
@@ -11932,7 +12558,44 @@ const dismissCommand = new Command("dismiss").argument("<feature/spec>", "Spec i
 	meta("dismissed", `${res.dismissal.label} — ${res.dismissal.headline || "(no headline)"}`);
 	info("this finding no longer holds the spec back; a later audit can raise one of its own");
 }));
-const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(deployCommand).addCommand(costCommand).addCommand(sessionCommand).addCommand(varCommand).addCommand(promptCommand).addCommand(attestCommand).addCommand(dismissCommand);
+const coverageCommand = new Command("coverage").description("Print what the hub's coverage stream resolved for a run: per-spec measured file counts and the stream's health counters. This is the read-out measured spec selection consumes — use it to see why a spec's reach is empty before blaming the selection.").option("--run-id <id>", "Stream run id to resolve. Defaults to the most recently measured run.").option("--files", "List each spec's measured files, not just their count.").option("--json", "Print the raw resolved answer as JSON (everything, including file lists).").option("--project <name>", "Project whose stream is read. Defaults to the current directory's name.").option(...cwdOption).option(...hubUrlOption).option(...hubTokenOption).action(withHubErrors(runCoverageInspect));
+async function runCoverageInspect(opts) {
+	const project = resolveProject(opts);
+	const answer = await connect$2(opts).getCoverage(project, opts.runId ? { runId: opts.runId } : {});
+	if (opts.json === true) {
+		process.stdout.write(`${JSON.stringify(answer, null, 2)}\n`);
+		return;
+	}
+	header("hub coverage", project);
+	if (answer.runIds.length === 0) {
+		warn("the stream holds no measured runs for this project");
+		return;
+	}
+	meta("measured runs", `${answer.runIds.length} (newest first): ${answer.runIds.join(", ")}`);
+	const resolved = answer.resolved;
+	if (resolved == null) {
+		warn("nothing resolved — pass --run-id with one of the runs above");
+		return;
+	}
+	if (resolved.asOf === 0 && resolved.specs.length === 0) {
+		warn(`the stream holds no events for run ${resolved.runId} — check it against the runs above`);
+		return;
+	}
+	meta("run", resolved.runId + (resolved.hubRunId ? ` (hub run ${resolved.hubRunId})` : ""));
+	meta("as of", new Date(resolved.asOf).toISOString());
+	if (resolved.universe) meta("universe", `${resolved.universe.files.length} file(s) (include: ${resolved.universe.include.join(", ")})`);
+	meta("boot", `${resolved.boot.length} file(s) reached only at module load`);
+	meta("specs", `${resolved.specs.filter((spec) => spec.files.length > 0).length}/${resolved.specs.length} measured files`);
+	for (const spec of resolved.specs) {
+		info(`  ${formatResolvedSpec(spec)}`);
+		if (opts.files === true) for (const file of spec.files) info(`    ${file}`);
+	}
+	const h = resolved.health;
+	meta("health", `heard-from-application=${h.heardFromApplication} pushes-during-run=${h.pushesDuringRun} attributed-specs=${h.attributedSpecs} specs-measured=${h.specsMeasured} rejected=${h.rejectedPushes} dropped=${h.droppedPushes} uninstrumented-files=${h.uninstrumentedFiles} uninstrumented-processes=${h.uninstrumentedProcesses} unmapped-actor-events=${h.unmappedActorEvents}`);
+	const outside = Object.entries(h.outsideWindowEvents);
+	if (outside.length > 0) warn(`outside-window events (identity was driven while unclaimed): ${outside.map(([key, count]) => `${key}: ${count}`).join(", ")}`);
+}
+const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(deployCommand).addCommand(costCommand).addCommand(coverageCommand).addCommand(sessionCommand).addCommand(varCommand).addCommand(promptCommand).addCommand(attestCommand).addCommand(dismissCommand);
 /** Loose check that a fetched session is agent-browser storage-state, mirroring loadStorageState. */
 function isStorageStateShape(state) {
 	return typeof state === "object" && state !== null && Array.isArray(state.cookies) && Array.isArray(state.origins);
@@ -16113,6 +16776,7 @@ async function executeRun(targets, opts) {
 	};
 	const live = await runLiveSpecs(liveSpecs, liveOpts);
 	if (coverage && !coverage.streamsToHub) reportCoverageHealth(coverage, [...externalRows, ...live.reportResults]);
+	else if (coverage && hubCtx != null) await reportStreamedCoverageHealth(coverage, hubCtx);
 	let overallExitCode = det.exitCode !== 0 ? 1 : 0;
 	if (live.failedCount > 0) overallExitCode = 1;
 	if (externalRows.some((r) => r.status === "failed")) overallExitCode = 1;
@@ -16242,6 +16906,44 @@ function explainMissingCoverage(row) {
 		coverageUnavailable: row.status === "skipped" ? "the spec did not execute" : "this target is not measured by --coverage yet"
 	};
 }
+/**
+* The hub-inbox counterpart of `reportCoverageHealth`: ask the hub to resolve
+* this run's slice of the stream and read the answer out into the run log.
+* Best-effort — the measurement already left as events, so a failed read-out
+* loses visibility, never data. Application pushes may still land for
+* `GRACE_MS` after the last window closed, so the counts here are a floor.
+*/
+async function reportStreamedCoverageHealth(coverage, hubCtx) {
+	await new Promise((resolve) => setTimeout(resolve, 3e3));
+	let resolved;
+	try {
+		resolved = (await hubCtx.hub.getCoverage(hubCtx.project, { runId: coverage.streamRunId })).resolved;
+	} catch (error) {
+		warn(`coverage: could not read this run's resolve from the hub (${errMessage(error)})`);
+		return;
+	}
+	if (resolved == null) {
+		warn("coverage: the hub resolved nothing for this run — its events never reached the stream, so every spec's measured reach is absent");
+		return;
+	}
+	const measured = resolved.specs.filter((spec) => spec.files.length > 0);
+	const empty = resolved.specs.filter((spec) => spec.files.length === 0);
+	meta("coverage", `stream resolve: ${measured.length}/${resolved.specs.length} spec(s) measured files` + (resolved.boot.length > 0 ? `; ${resolved.boot.length} file(s) reached only at boot` : ""));
+	for (const spec of measured) meta("coverage", `  ${formatResolvedSpec(spec)}`);
+	if (empty.length > 0) warn(`coverage: ${empty.length} spec(s) had measured no files at read-out time — unless a late push still lands (\`ccqa hub coverage\` shows the settled answer), their reach stays unknown to selection: ${empty.map((spec) => spec.specId).join(", ")}`);
+	const h = resolved.health;
+	if (!h.heardFromApplication) warn("coverage: no instrumented application process pushed to the stream — only the browser half was measured. The server needs ccqa-tools and CCQA_COVERAGE_ENDPOINT pointed at the hub's inbox");
+	else if (h.pushesDuringRun === 0) warn("coverage: the stream holds application pushes, but none arrived while this run was measuring — check CCQA_COVERAGE_ENDPOINT on the application");
+	else if (h.attributedSpecs === 0) warn(`coverage: ${h.pushesDuringRun} application push(es) arrived during the run, but none was attributed to a spec — the spec cookie is not reaching the application, so every spec's server-side reach is zero for that reason rather than because the server ran nothing`);
+	const trouble = [];
+	if (h.rejectedPushes > 0) trouble.push(`rejected=${h.rejectedPushes}`);
+	if (h.droppedPushes > 0) trouble.push(`dropped=${h.droppedPushes}`);
+	if (h.unmappedActorEvents > 0) trouble.push(`unmapped-actor-events=${h.unmappedActorEvents}`);
+	if (h.uninstrumentedProcesses > 0) trouble.push(`uninstrumented-processes=${h.uninstrumentedProcesses}`);
+	const outside = Object.entries(h.outsideWindowEvents);
+	if (outside.length > 0) trouble.push(`outside-window=${outside.map(([key, count]) => `${key}:${count}`).join(",")}`);
+	if (trouble.length > 0) warn(`coverage: stream health flags — ${trouble.join(" ")}`);
+}
 /** Everything the measurement could not place; silence here reads as "never reached". */
 function reportCoverageHealth(coverage, rows) {
 	if (!coverage.heardFromApplication()) warn("no instrumented application process reported — only the browser half was measured. The server needs ccqa-tools and CCQA_COVERAGE_ENDPOINT pointed at this run's sink");
@@ -22140,181 +22842,6 @@ z.object({
 	at: z.number(),
 	body: InboxBodySchema
 });
-z.object({
-	runId: z.string(),
-	hubRunId: z.string().optional(),
-	asOf: z.number(),
-	lastSeq: z.number(),
-	universe: z.object({
-		include: z.array(z.string()),
-		files: z.array(z.string())
-	}).optional(),
-	specs: z.array(z.object({
-		specId: z.string(),
-		files: z.array(z.string()),
-		actorEvents: z.record(z.string(), z.number())
-	})),
-	boot: z.array(z.string()),
-	health: z.object({
-		heardFromApplication: z.boolean(),
-		pushesDuringRun: z.number(),
-		attributedSpecs: z.number(),
-		rejectedPushes: z.number(),
-		uninstrumentedFiles: z.number(),
-		uninstrumentedProcesses: z.number(),
-		droppedPushes: z.number(),
-		unmappedActorEvents: z.number(),
-		outsideWindowEvents: z.record(z.string(), z.number()),
-		specsMeasured: z.number()
-	})
-});
-/**
-* Interprets `runId`'s view of the stream.
-*
-* Two passes, because the resolver needs its context up front: the first
-* collects what the run's own markers establish — which ids it issued, which
-* identity tags were its to hand out, its universe, and when its first and
-* last marker arrived. The second replays the stream through the shared
-* resolver: this run's window markers as they came, and every application
-* push — as-is when its stamp falls inside the span the run's sink would
-* have been listening (first marker to last marker plus `GRACE_MS`),
-* stripped of its spec and actor attribution when it does not. A push
-* outside the span was another run's audience, so its attribution is not
-* this run's to claim — but the collector never re-sends what an earlier
-* run acked, so on an always-on hub the boot set and each process's health
-* figures arrived long before this run began, and only survive here.
-*/
-function resolveStream(events, runId) {
-	const issued = /* @__PURE__ */ new Set();
-	const specOrder = [];
-	const tagToKey = /* @__PURE__ */ new Map();
-	const browserFiles = /* @__PURE__ */ new Map();
-	let universe;
-	let hubRunId;
-	let firstMarkerAt;
-	let lastMarkerAt = 0;
-	for (const event of events) {
-		const body = event.body;
-		if (!("kind" in body) || body.runId !== runId) continue;
-		if (firstMarkerAt === void 0) firstMarkerAt = event.at;
-		lastMarkerAt = event.at;
-		switch (body.kind) {
-			case "spec-open":
-				if (!issued.has(body.specId)) {
-					issued.add(body.specId);
-					specOrder.push(body.specId);
-				}
-				break;
-			case "window-open":
-				tagToKey.set(body.tag, body.key);
-				break;
-			case "universe":
-				universe = {
-					include: body.include,
-					files: body.files
-				};
-				break;
-			case "run-link":
-				hubRunId = body.hubRunId;
-				break;
-			case "browser": {
-				const files = browserFiles.get(body.specId) ?? /* @__PURE__ */ new Set();
-				for (const file of body.files) files.add(file);
-				browserFiles.set(body.specId, files);
-				break;
-			}
-		}
-	}
-	const resolver = new CoverageResolver(issued, tagToKey);
-	let asOf = 0;
-	let lastSeq = 0;
-	let pushesDuringRun = 0;
-	for (const event of events) {
-		if (event.seq > lastSeq) lastSeq = event.seq;
-		const body = event.body;
-		if ("kind" in body) {
-			if (body.runId !== runId) continue;
-			asOf = event.at;
-			if (body.kind === "window-open") resolver.apply({
-				kind: "window-open",
-				at: event.at,
-				tag: body.tag,
-				key: body.key,
-				specId: body.specId
-			});
-			else if (body.kind === "window-close") resolver.apply({
-				kind: "window-close",
-				at: event.at,
-				tag: body.tag
-			});
-			continue;
-		}
-		if (firstMarkerAt === void 0 || event.at < firstMarkerAt || event.at > lastMarkerAt + 3e4) {
-			resolver.apply({
-				kind: "push",
-				at: event.at,
-				push: {
-					...body,
-					specs: {},
-					actors: []
-				}
-			});
-			continue;
-		}
-		asOf = event.at;
-		pushesDuringRun++;
-		resolver.apply({
-			kind: "push",
-			at: event.at,
-			push: body
-		});
-	}
-	const specs = specOrder.map((specId) => {
-		const actorEvents = {};
-		for (const [key, count] of resolver.actorEventsFor(specId)) actorEvents[key] = count;
-		return {
-			specId,
-			files: [...new Set([...resolver.filesFor(specId) ?? [], ...browserFiles.get(specId) ?? []])].sort(),
-			actorEvents
-		};
-	});
-	const outsideWindowEvents = {};
-	for (const [key, count] of resolver.outsideWindowEvents()) outsideWindowEvents[key] = count;
-	return {
-		runId,
-		...hubRunId !== void 0 ? { hubRunId } : {},
-		asOf,
-		lastSeq,
-		...universe !== void 0 ? { universe } : {},
-		specs,
-		boot: [...resolver.boot()].sort(),
-		health: {
-			heardFromApplication: resolver.heardFromApplication(),
-			pushesDuringRun,
-			attributedSpecs: resolver.attributedSpecs(),
-			rejectedPushes: resolver.rejectedPushes(),
-			uninstrumentedFiles: resolver.uninstrumentedFiles(),
-			uninstrumentedProcesses: resolver.uninstrumentedProcesses(),
-			droppedPushes: resolver.droppedPushes(),
-			unmappedActorEvents: resolver.unmappedActorEvents(),
-			outsideWindowEvents,
-			specsMeasured: specs.length
-		}
-	};
-}
-/**
-* Every run that opened a spec in this stream, most recently heard-from
-* first — recency by the arrival position of each run's latest spec-open,
-* the one order the hub's stamps establish.
-*/
-function listRunIds(events) {
-	const lastOpenIndex = /* @__PURE__ */ new Map();
-	events.forEach((event, index) => {
-		const body = event.body;
-		if ("kind" in body && body.kind === "spec-open") lastOpenIndex.set(body.runId, index);
-	});
-	return [...lastOpenIndex.entries()].sort((a, b) => b[1] - a[1]).map(([id]) => id);
-}
 //#endregion
 //#region src/hub/api/auth.ts
 /**

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.40.2",
+  "version": "1.40.4",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/dist/runtime/vitest.config.d.mts

@@ -3,14 +3,14 @@ import * as fs from "node:fs";
 import { URL as URL$1 } from "node:url";
 import * as http from "node:http";
 import { Agent, ClientRequest, ClientRequestArgs, OutgoingHttpHeaders } from "node:http";
-import { ZlibOptions } from "node:zlib";
 import * as net from "node:net";
+import { SecureContextOptions } from "node:tls";
+import { ZlibOptions } from "node:zlib";
 import { Http2SecureServer } from "node:http2";
 import { EventEmitter } from "node:events";
 import { Server as Server$1, ServerOptions as ServerOptions$1 } from "node:https";
 import { Duplex, DuplexOptions, Stream } from "node:stream";
 import esbuild from "esbuild";
-import { SecureContextOptions } from "node:tls";
 import DartSass from "sass";
 import SassEmbedded from "sass-embedded";
 import Less from "less";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.40.2",
+  "version": "1.40.4",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {