ccqa 1.43.0 → 1.45.0

package/dist/bin/ccqa.mjs

@@ -4,7 +4,7 @@ import { t as EVIDENCE_DIR_ENV } from "../evidence-constants-C425F7ZG.mjs";
 import { a as formatAgentBrowserUnavailableMessage, i as assertAgentBrowserAvailable, n as spawnAB, o as pathWithAgentBrowserShim, r as AgentBrowserUnavailableError, s as resolveAgentBrowserBin$1, t as sleepSync } from "../spawn-ab-Bm34WBui.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
-import { accessSync, appendFileSync, createWriteStream, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { accessSync, appendFileSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { access, appendFile, chmod, cp, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
@@ -11986,6 +11986,14 @@ async function resolveCoverageRoots(changed, cwd) {
 */
 const MAX_REPORT_RUNS = 20;
 /**
+* How many reads one source keeps in flight. The two sources run together, so
+* the hub sees twice this. All at once is what it cannot take: it serves one
+* process, a resolve walks the whole event stream, and a report carries its
+* screenshots inline — forty of those together is what took it down, rather
+* than any single one of them.
+*/
+const HUB_READ_CONCURRENCY = 4;
+/**
 * Read every spec's most recent measured reach from the hub. Never throws: a
 * source that cannot be read warns, and `degraded` flips when the failure
 * leaves absence ambiguous (the ledger itself, or the legacy sources while
@@ -12053,8 +12061,14 @@ async function collectStreamEdges(input, merge) {
 	const { hub, project } = input;
 	const latest = await hub.getCoverage(project);
 	ingestResolved(latest.resolved, merge);
-	const older = latest.runIds.filter((runId) => runId !== latest.resolved?.runId);
-	return (await Promise.allSettled(older.map(async (runId) => ingestResolved((await hub.getCoverage(project, { runId })).resolved, merge)))).filter((r) => r.status === "rejected").length;
+	return (await runPool(latest.runIds.filter((runId) => runId !== latest.resolved?.runId), HUB_READ_CONCURRENCY, async (runId) => {
+		try {
+			ingestResolved((await hub.getCoverage(project, { runId })).resolved, merge);
+			return true;
+		} catch {
+			return false;
+		}
+	})).filter((ok) => !ok).length;
 }
 function ingestResolved(resolved, merge) {
 	if (!resolved) return;
@@ -12086,7 +12100,7 @@ const ReportCoverageRowsSchema = z.object({ results: z.array(z.object({
 */
 async function collectReportEdges(input, merge) {
 	const { hub, project } = input;
-	const eligible = (await hub.listRuns({
+	return (await runPool((await hub.listRuns({
 		project,
 		kind: "run",
 		limit: MAX_REPORT_RUNS
@@ -12098,18 +12112,22 @@ async function collectReportEdges(input, merge) {
 			id: run.id,
 			measuredAt
 		}];
-	});
-	return (await Promise.allSettled(eligible.map(async ({ id, measuredAt }) => {
-		const parsed = ReportCoverageRowsSchema.safeParse(await hub.getReport(id));
-		if (!parsed.success) return;
-		for (const row of parsed.data.results) {
-			if (!row.coverage || row.coverage.files.length === 0) continue;
-			merge(`${row.feature}/${row.spec}`, {
-				files: row.coverage.files,
-				measuredAt
-			});
+	}), HUB_READ_CONCURRENCY, async ({ id, measuredAt }) => {
+		try {
+			const parsed = ReportCoverageRowsSchema.safeParse(await hub.getReport(id));
+			if (!parsed.success) return true;
+			for (const row of parsed.data.results) {
+				if (!row.coverage || row.coverage.files.length === 0) continue;
+				merge(`${row.feature}/${row.spec}`, {
+					files: row.coverage.files,
+					measuredAt
+				});
+			}
+			return true;
+		} catch {
+			return false;
 		}
-	}))).filter((r) => r.status === "rejected").length;
+	})).filter((ok) => !ok).length;
 }
 //#endregion
 //#region src/select/inventory.ts
@@ -12224,6 +12242,27 @@ function foldTouchIndex(current, entry, selection) {
 	}
 	return out;
 }
+//#endregion
+//#region src/coverage/resolve-stream.ts
+/**
+* One run's answer out of a project's stored event stream (ADR-0022).
+*
+* The stream interleaves many runs and two producers; this is the single
+* shared interpretation over it — the same gate, join and loss accounting the
+* run-local sink applies, executed at read time by whichever host asks (the
+* hub's API, or the CLI). Everything here is a pure fold over the stamps the
+* events carry: no clock is ever read, so the same stream resolves to the
+* same answer on any host, at any time.
+*/
+/**
+* How far past a run's last marker an application push still counts as its
+* audience (ms). The run-local sink keeps listening while a spec settles, so
+* the work a spec's last action triggered still lands; a stored stream has no
+* listener to wait, so the resolve re-creates that patience as a fixed bound.
+* Pushes past it were heard by nobody bound to this run — most likely they
+* belong to whatever run came next.
+*/
+const GRACE_MS = 3e4;
 z.object({
 	runId: z.string(),
 	hubRunId: z.string().optional(),
@@ -12261,88 +12300,109 @@ function formatResolvedSpec(spec) {
 	return `${spec.specId}: ${spec.files.length} file(s)${actors ? ` (${actors})` : ""}`;
 }
 /**
-* Interprets `runId`'s view of the stream.
+* `runId`'s view of the stream, built one event at a time.
 *
-* Two passes, because the resolver needs its context up front: the first
+* Two passes, because the resolver needs its context up front. The first
 * collects what the run's own markers establish — which ids it issued, which
 * identity tags were its to hand out, its universe, and when its first and
-* last marker arrived. The second replays the stream through the shared
-* resolver: this run's window markers as they came, and every application
-* push — as-is when its stamp falls inside the span the run's sink would
-* have been listening (first marker to last marker plus `GRACE_MS`),
-* stripped of its spec and actor attribution when it does not. A push
-* outside the span was another run's audience, so its attribution is not
-* this run's to claim — but the collector never re-sends what an earlier
-* run acked, so on an always-on hub the boot set and each process's health
-* figures arrived long before this run began, and only survive here.
-*/
-function resolveStream(events, runId) {
-	const issued = /* @__PURE__ */ new Set();
-	const specOrder = [];
-	const tagToKey = /* @__PURE__ */ new Map();
-	const browserFiles = /* @__PURE__ */ new Map();
-	let universe;
-	let hubRunId;
-	let firstMarkerAt;
-	let lastMarkerAt = 0;
-	for (const event of events) {
-		const body = event.body;
-		if (!("kind" in body) || body.runId !== runId) continue;
-		if (firstMarkerAt === void 0) firstMarkerAt = event.at;
-		lastMarkerAt = event.at;
-		switch (body.kind) {
-			case "spec-open":
-				if (!issued.has(body.specId)) {
-					issued.add(body.specId);
-					specOrder.push(body.specId);
+* last marker arrived; markers are a small part of a stream, so a caller can
+* hold them. The second replays the stream through the shared resolver: this
+* run's window markers as they came, and every application push — as-is when
+* its stamp falls inside the span the run's sink would have been listening
+* (first marker to last marker plus `GRACE_MS`), stripped of its spec and
+* actor attribution when it does not. A push outside the span was another
+* run's audience, so its attribution is not this run's to claim — but the
+* collector never re-sends what an earlier run acked, so on an always-on hub
+* the boot set and each process's health figures arrived long before this run
+* began, and only survive here.
+*
+* The constructor takes the markers and `accept` takes one event at a time, so
+* the second pass can be fed from a stream: it keeps nothing per push, which
+* is what lets a resolve outlive the point where the stream stops fitting in
+* memory.
+*/
+var StreamResolution = class {
+	runId;
+	resolver;
+	/** The ids this run opened, in that order — a `Set` iterates by insertion. */
+	specIds;
+	browserFiles = /* @__PURE__ */ new Map();
+	/**
+	* The stamps in which the run's sink would have been listening. Undefined
+	* when the markers held no event of this run — then no push is ever inside.
+	*/
+	span;
+	universe;
+	hubRunId;
+	asOf = 0;
+	lastSeq = 0;
+	pushesDuringRun = 0;
+	/** `markers` needs to hold every marker `runId` issued; other runs' markers and pushes are ignored. */
+	constructor(markers, runId) {
+		this.runId = runId;
+		const specIds = /* @__PURE__ */ new Set();
+		const tagToKey = /* @__PURE__ */ new Map();
+		let firstAt;
+		let lastAt = 0;
+		for (const event of markers) {
+			const body = event.body;
+			if (!("kind" in body) || body.runId !== runId) continue;
+			if (firstAt === void 0) firstAt = event.at;
+			lastAt = event.at;
+			switch (body.kind) {
+				case "spec-open":
+					specIds.add(body.specId);
+					break;
+				case "window-open":
+					tagToKey.set(body.tag, body.key);
+					break;
+				case "universe":
+					this.universe = {
+						include: body.include,
+						files: body.files
+					};
+					break;
+				case "run-link":
+					this.hubRunId = body.hubRunId;
+					break;
+				case "browser": {
+					const files = this.browserFiles.get(body.specId) ?? /* @__PURE__ */ new Set();
+					for (const file of body.files) files.add(file);
+					this.browserFiles.set(body.specId, files);
+					break;
 				}
-				break;
-			case "window-open":
-				tagToKey.set(body.tag, body.key);
-				break;
-			case "universe":
-				universe = {
-					include: body.include,
-					files: body.files
-				};
-				break;
-			case "run-link":
-				hubRunId = body.hubRunId;
-				break;
-			case "browser": {
-				const files = browserFiles.get(body.specId) ?? /* @__PURE__ */ new Set();
-				for (const file of body.files) files.add(file);
-				browserFiles.set(body.specId, files);
-				break;
 			}
 		}
+		this.specIds = specIds;
+		this.span = firstAt === void 0 ? void 0 : {
+			from: firstAt,
+			until: lastAt + GRACE_MS
+		};
+		this.resolver = new CoverageResolver(specIds, tagToKey);
 	}
-	const resolver = new CoverageResolver(issued, tagToKey);
-	let asOf = 0;
-	let lastSeq = 0;
-	let pushesDuringRun = 0;
-	for (const event of events) {
-		if (event.seq > lastSeq) lastSeq = event.seq;
+	/** One event of the second pass. Every event of the stream, in stamp order. */
+	accept(event) {
+		if (event.seq > this.lastSeq) this.lastSeq = event.seq;
 		const body = event.body;
 		if ("kind" in body) {
-			if (body.runId !== runId) continue;
-			asOf = event.at;
-			if (body.kind === "window-open") resolver.apply({
+			if (body.runId !== this.runId) return;
+			this.asOf = event.at;
+			if (body.kind === "window-open") this.resolver.apply({
 				kind: "window-open",
 				at: event.at,
 				tag: body.tag,
 				key: body.key,
 				specId: body.specId
 			});
-			else if (body.kind === "window-close") resolver.apply({
+			else if (body.kind === "window-close") this.resolver.apply({
 				kind: "window-close",
 				at: event.at,
 				tag: body.tag
 			});
-			continue;
+			return;
 		}
-		if (firstMarkerAt === void 0 || event.at < firstMarkerAt || event.at > lastMarkerAt + 3e4) {
-			resolver.apply({
+		if (this.span === void 0 || event.at < this.span.from || event.at > this.span.until) {
+			this.resolver.apply({
 				kind: "push",
 				at: event.at,
 				push: {
@@ -12351,62 +12411,71 @@ function resolveStream(events, runId) {
 					actors: []
 				}
 			});
-			continue;
+			return;
 		}
-		asOf = event.at;
-		pushesDuringRun++;
-		resolver.apply({
+		this.asOf = event.at;
+		this.pushesDuringRun++;
+		this.resolver.apply({
 			kind: "push",
 			at: event.at,
 			push: body
 		});
 	}
-	const specs = specOrder.map((specId) => {
-		const actorEvents = {};
-		for (const [key, count] of resolver.actorEventsFor(specId)) actorEvents[key] = count;
+	/** The answer as of every event accepted so far. */
+	finish() {
+		const specs = [...this.specIds].map((specId) => {
+			const actorEvents = {};
+			for (const [key, count] of this.resolver.actorEventsFor(specId)) actorEvents[key] = count;
+			return {
+				specId,
+				files: [...new Set([...this.resolver.filesFor(specId) ?? [], ...this.browserFiles.get(specId) ?? []])].sort(),
+				actorEvents
+			};
+		});
+		const outsideWindowEvents = {};
+		for (const [key, count] of this.resolver.outsideWindowEvents()) outsideWindowEvents[key] = count;
 		return {
-			specId,
-			files: [...new Set([...resolver.filesFor(specId) ?? [], ...browserFiles.get(specId) ?? []])].sort(),
-			actorEvents
+			runId: this.runId,
+			...this.hubRunId !== void 0 ? { hubRunId: this.hubRunId } : {},
+			asOf: this.asOf,
+			lastSeq: this.lastSeq,
+			...this.universe !== void 0 ? { universe: this.universe } : {},
+			specs,
+			boot: [...this.resolver.boot()].sort(),
+			health: {
+				heardFromApplication: this.resolver.heardFromApplication(),
+				pushesDuringRun: this.pushesDuringRun,
+				attributedSpecs: this.resolver.attributedSpecs(),
+				rejectedPushes: this.resolver.rejectedPushes(),
+				uninstrumentedFiles: this.resolver.uninstrumentedFiles(),
+				uninstrumentedProcesses: this.resolver.uninstrumentedProcesses(),
+				droppedPushes: this.resolver.droppedPushes(),
+				unmappedActorEvents: this.resolver.unmappedActorEvents(),
+				outsideWindowEvents,
+				specsMeasured: specs.length
+			}
 		};
-	});
-	const outsideWindowEvents = {};
-	for (const [key, count] of resolver.outsideWindowEvents()) outsideWindowEvents[key] = count;
-	return {
-		runId,
-		...hubRunId !== void 0 ? { hubRunId } : {},
-		asOf,
-		lastSeq,
-		...universe !== void 0 ? { universe } : {},
-		specs,
-		boot: [...resolver.boot()].sort(),
-		health: {
-			heardFromApplication: resolver.heardFromApplication(),
-			pushesDuringRun,
-			attributedSpecs: resolver.attributedSpecs(),
-			rejectedPushes: resolver.rejectedPushes(),
-			uninstrumentedFiles: resolver.uninstrumentedFiles(),
-			uninstrumentedProcesses: resolver.uninstrumentedProcesses(),
-			droppedPushes: resolver.droppedPushes(),
-			unmappedActorEvents: resolver.unmappedActorEvents(),
-			outsideWindowEvents,
-			specsMeasured: specs.length
-		}
-	};
-}
+	}
+};
 /**
 * Every run that opened a spec in this stream, most recently heard-from
 * first — recency by the arrival position of each run's latest spec-open,
-* the one order the hub's stamps establish.
+* the one order the hub's stamps establish. Fed one event at a time, so the
+* question can be asked of a stream too large to hold.
 */
-function listRunIds(events) {
-	const lastOpenIndex = /* @__PURE__ */ new Map();
-	events.forEach((event, index) => {
+var RunIdIndex = class {
+	/** Re-inserted on every `spec-open`, so insertion order is order of latest open. */
+	opened = /* @__PURE__ */ new Set();
+	accept(event) {
 		const body = event.body;
-		if ("kind" in body && body.kind === "spec-open") lastOpenIndex.set(body.runId, index);
-	});
-	return [...lastOpenIndex.entries()].sort((a, b) => b[1] - a[1]).map(([id]) => id);
-}
+		if (!("kind" in body) || body.kind !== "spec-open") return;
+		this.opened.delete(body.runId);
+		this.opened.add(body.runId);
+	}
+	newestFirst() {
+		return [...this.opened].reverse();
+	}
+};
 //#endregion
 //#region src/cli/session.ts
 const AB = resolveAgentBrowserBin$1();
@@ -17065,7 +17134,8 @@ async function executeRun(targets, opts) {
 	const liveSpecs = withMode.filter((s) => s.mode === "live");
 	meta("modes", `${detSpecs.length} deterministic / ${liveSpecs.length} live`);
 	if (dispatch.external.length > 0) meta("external", dispatch.external.map((g) => `${g.targetId} ${g.specs.length}`).join(" / "));
-	const coverage = opts.coverage && forExecution ? await startCoverage(cwd, projectConfig.coverage, actors, dispatch, opts.teardown, coverageInbox, storedSourceMapReader(hubCtx, deployedSha), hubCtx !== null) : void 0;
+	const storedMaps = hubCtx !== null && deployedSha !== null ? createStoredSourceMaps(hubCtx, deployedSha) : void 0;
+	const coverage = opts.coverage && forExecution ? await startCoverage(cwd, projectConfig.coverage, actors, dispatch, opts.teardown, coverageInbox, storedMaps?.read, hubCtx !== null) : void 0;
 	if (liveSpecs.length === 0) {
 		const why = "it only applies to agent-browser 'mode: live' specs, and this run has none";
 		if (typeof opts.liveStepRetry === "number" && opts.liveStepRetry > 0) warn(`--live-step-retry is ignored: ${why}`);
@@ -17178,8 +17248,11 @@ async function executeRun(targets, opts) {
 	};
 	const live = await runLiveSpecs(liveSpecs, liveOpts);
 	let streamedEdges = {};
-	if (coverage && !coverage.streamsToHub) reportCoverageHealth(coverage, [...externalRows, ...live.reportResults]);
-	else if (coverage && hubCtx != null) streamedEdges = await reportStreamedCoverageHealth(coverage, hubCtx);
+	if (coverage && !coverage.streamsToHub) reportCoverageHealth(coverage, [...externalRows, ...live.reportResults], storedMaps);
+	else if (coverage && hubCtx != null) {
+		streamedEdges = await reportStreamedCoverageHealth(coverage, hubCtx);
+		storedMaps?.warnIfNothingAnswered();
+	}
 	let overallExitCode = det.exitCode !== 0 ? 1 : 0;
 	if (live.failedCount > 0) overallExitCode = 1;
 	if (externalRows.some((r) => r.status === "failed")) overallExitCode = 1;
@@ -17273,6 +17346,12 @@ async function executeRun(targets, opts) {
 		reportDir
 	};
 }
+/**
+* Starts the run's coverage measurement before any spec runs: the sink has to
+* be listening before the first request reaches the application, and the set
+* of spec ids it will accept is only known once dispatch has resolved. With
+* an `inbox`, nothing binds — the run streams its events to the hub instead.
+*/
 async function startCoverage(cwd, config, actors, dispatch, teardown, inbox, fetchStoredSourceMap, hubConfigured) {
 	if (config === void 0) throw new RunUsageError("--coverage needs a `coverage:` block in .ccqa/config.yaml whose `instrumentedOrigins` names the origins the spec cookie may be attached to");
 	let session;
@@ -17298,25 +17377,25 @@ async function startCoverage(cwd, config, actors, dispatch, teardown, inbox, fet
 	return session;
 }
 /**
-* Starts the run's coverage measurement before any spec runs: the sink has to
-* be listening before the first request reaches the application, and the set
-* of spec ids it will accept is only known once dispatch has resolved. With
-* an `inbox`, nothing binds — the run streams its events to the hub instead.
-*/
-/**
-* Needs both a hub and the commit under test: without either there is nothing
-* to address a stored map by, and reading some other commit's maps would name
-* the wrong files. See `SourceMapStore`.
+* The maps a deploy pushed for one commit. One answer per asset for the run:
+* the commit is fixed, so a miss stays a miss, and every spec would otherwise
+* re-ask for the same scripts.
 */
-function storedSourceMapReader(hubCtx, deployedSha) {
-	if (hubCtx === null || deployedSha === null) return void 0;
+function createStoredSourceMaps(hubCtx, deployedSha) {
 	const seen = /* @__PURE__ */ new Map();
-	return async (assetPath) => {
-		const cached = seen.get(assetPath);
-		if (cached !== void 0 || seen.has(assetPath)) return cached;
-		const map = await hubCtx.hub.getSourceMap(hubCtx.project, deployedSha, assetPath) ?? void 0;
-		seen.set(assetPath, map);
-		return map;
+	return {
+		read: async (assetPath) => {
+			const cached = seen.get(assetPath);
+			if (cached !== void 0 || seen.has(assetPath)) return cached;
+			const map = await hubCtx.hub.getSourceMap(hubCtx.project, deployedSha, assetPath) ?? void 0;
+			seen.set(assetPath, map);
+			return map;
+		},
+		warnIfNothingAnswered() {
+			const answered = [...seen.values()].some((map) => map !== void 0);
+			if (seen.size === 0 || answered) return;
+			warn(`coverage: no stored source map answered for any of the ${seen.size} script(s) this run asked about, under commit ${deployedSha.slice(0, 12)}. Either that deploy pushed none, or the hub's deploy log names a commit the environment is no longer serving`);
+		}
 	};
 }
 /**
@@ -17397,8 +17476,17 @@ async function upsertMeasuredEdges(hubCtx, specs) {
 		warn(`coverage: could not record measured edges on the hub (${errMessage(error)})`);
 	}
 }
+/**
+* Whether the browser half came back with nothing anywhere. `every` rather
+* than `some`: a run that resolved some chunks from the copies the server
+* served has no gap the stored maps were needed for, and warning there would
+* fire on every build that strips maps from a few chunks and not the rest.
+*/
+function noFrontendResolved(rows) {
+	return rows.every((row) => (row.coverage?.frontendFiles ?? 0) === 0);
+}
 /** Everything the measurement could not place; silence here reads as "never reached". */
-function reportCoverageHealth(coverage, rows) {
+function reportCoverageHealth(coverage, rows, storedMaps) {
 	if (!coverage.heardFromApplication()) warn("no instrumented application process reported — only the browser half was measured. The server needs ccqa-tools and CCQA_COVERAGE_ENDPOINT pointed at this run's sink");
 	if (rows.filter((row) => row.coverage !== void 0).length > 0 && coverage.heardFromApplication() && coverage.attributedSpecs() === 0) warn("instrumented application processes reported, but no spec was attributed to them — the spec cookie is not reaching the application, so every spec's server-side reach is zero for that reason rather than because the server ran nothing. Check coverage.instrumentedOrigins covers every origin the spec's requests go to, and that a server which is not node:http-based installs the middleware itself");
 	const boot = coverage.boot();
@@ -17412,6 +17500,7 @@ function reportCoverageHealth(coverage, rows) {
 	if (rejected > 0) warn(`${rejected} coverage push(es) named a spec id this run never issued — dropped`);
 	const malformed = coverage.malformedPushes();
 	if (malformed > 0) warn(`${malformed} coverage push(es) could not be read — the application's ccqa-tools and this CLI disagree on the wire format`);
+	if (noFrontendResolved(rows)) storedMaps?.warnIfNothingAnswered();
 }
 function buildLiveRunSummary(results) {
 	const sections = [];
@@ -23432,7 +23521,9 @@ function createAppendCoverageEventHandler(config) {
 }
 /**
 * GET /api/v1/coverage/events?project=&sinceSeq= — the stream after `sinceSeq`
-* (exclusive, so a consumer passes back the `lastSeq` it saw), decrypted.
+* (exclusive), decrypted, at most `MAX_EVENTS_PER_READ` of them. A consumer
+* passes back the `seq` of the last event it received; `lastSeq` is the
+* stream's head, which `truncated` says the body stopped short of.
 * Hub bearer token only (the server's central check): what the append-only
 * credential wrote, it must not be able to read back.
 */
@@ -23441,33 +23532,51 @@ function createGetCoverageEventsHandler(config) {
 		const key = requireKey(config);
 		const project = requireProjectParam(ctx);
 		const sinceSeq = requireSinceSeqParam(ctx.url);
-		sendJson(ctx.res, 200, await readStream(config, key, project, sinceSeq));
+		const events = [];
+		let truncated = false;
+		const { lastSeq, skipped } = await scanStream(config, key, project, sinceSeq, (event) => {
+			if (events.length < MAX_EVENTS_PER_READ) events.push(event);
+			else truncated = true;
+		});
+		sendJson(ctx.res, 200, {
+			events,
+			lastSeq,
+			skipped,
+			truncated
+		});
 	};
 }
-/** The stored stream after `sinceSeq` (exclusive), decrypted and parsed. */
-async function readStream(config, key, project, sinceSeq) {
-	const { entries, lastSeq, skipped } = await config.store.read(project, sinceSeq);
-	const events = [];
+/**
+* Hand each event after `sinceSeq` (exclusive) to `visit`, decrypted and
+* parsed. Nothing is retained here: what a caller keeps is its own choice,
+* which is what lets a whole-stream read stay bounded.
+*/
+async function scanStream(config, key, project, sinceSeq, visit) {
 	let unreadable = 0;
-	for (const entry of entries) try {
-		const plain = decrypt(decodeEncryptedBlob(entry.payload), key);
-		const body = InboxBodySchema.parse(JSON.parse(new TextDecoder().decode(plain)));
-		events.push({
-			seq: entry.seq,
-			at: entry.at,
-			body
-		});
-	} catch {
-		unreadable += 1;
-	}
+	const { lastSeq, skipped } = await config.store.scan(project, sinceSeq, (entry) => {
+		let event;
+		try {
+			const plain = decrypt(decodeEncryptedBlob(entry.payload), key);
+			event = {
+				seq: entry.seq,
+				at: entry.at,
+				body: InboxBodySchema.parse(JSON.parse(new TextDecoder().decode(plain)))
+			};
+		} catch {
+			unreadable += 1;
+			return;
+		}
+		visit(event);
+	});
 	return {
-		events,
 		lastSeq,
 		skipped: skipped + unreadable
 	};
 }
 /** Newest runs the resolve read offers; past twenty the answer is history nobody pages through. */
 const RUN_IDS_LIMIT = 20;
+/** How many events one `GET /events` body carries; past it the answer is `truncated`. */
+const MAX_EVENTS_PER_READ = 5e3;
 /** Resolved answers kept per handler; one page polls one key, so a handful covers the readers. */
 const RESOLVE_CACHE_LIMIT = 8;
 /**
@@ -23504,6 +23613,36 @@ function createResolveMemo(limit) {
 	};
 }
 /**
+* `runId`'s answer, in two more scans: one keeping its markers, one replaying
+* the stream through the resolver they seed. Both stop at `head`, where the
+* scan that chose the run stopped — the resolver's markers are frozen there,
+* so a later push would credit a spec it was never told had opened and count
+* as rejected: a fault in the read, reading as a fault in the run.
+*/
+/** A marker `runId` issued — what `StreamResolution` needs before it is fed the stream. */
+function isMarkerOf(event, runId) {
+	const body = event.body;
+	return "kind" in body && body.runId === runId;
+}
+async function resolveRun(config, key, project, runId, head, collected) {
+	async function scanToHead(visit) {
+		await scanStream(config, key, project, 0, (event) => {
+			if (event.seq <= head) visit(event);
+		});
+	}
+	let markers = collected;
+	if (markers === null) {
+		const found = [];
+		await scanToHead((event) => {
+			if (isMarkerOf(event, runId)) found.push(event);
+		});
+		markers = found;
+	}
+	const resolution = new StreamResolution(markers, runId);
+	await scanToHead((event) => resolution.accept(event));
+	return resolution.finish();
+}
+/**
 * GET /api/v1/coverage?project=[&runId=] — the stream, interpreted for one
 * run by the shared resolver (resolve-stream.ts); this handler only reads,
 * memoizes and serves. `runId` omitted means the run the stream most
@@ -23524,14 +23663,21 @@ function createResolveCoverageHandler(config) {
 			sendJson(ctx.res, 200, hit);
 			return;
 		}
-		const { events, lastSeq } = await readStream(config, key, project, 0);
-		const runIds = listRunIds(events).slice(0, RUN_IDS_LIMIT);
+		const runIndex = new RunIdIndex();
+		const named = runKey !== "" ? [] : null;
+		let seen = 0;
+		const first = await scanStream(config, key, project, 0, (event) => {
+			seen += 1;
+			runIndex.accept(event);
+			if (named !== null && isMarkerOf(event, runKey)) named.push(event);
+		});
+		const runIds = runIndex.newestFirst().slice(0, RUN_IDS_LIMIT);
 		const runId = runKey !== "" ? runKey : runIds[0];
 		const answer = {
-			resolved: runId === void 0 || events.length === 0 ? null : resolveStream(events, runId),
+			resolved: runId !== void 0 && seen > 0 ? await resolveRun(config, key, project, runId, first.lastSeq, named) : null,
 			runIds
 		};
-		memo.put(project, runKey, lastSeq, answer);
+		memo.put(project, runKey, first.lastSeq, answer);
 		sendJson(ctx.res, 200, answer);
 	};
 }
@@ -31168,7 +31314,7 @@ function createFileCoverageEventStore(root, caps) {
 			oldestAt: null,
 			endsWithNewline: raw === "" || raw.endsWith("\n")
 		};
-		for (const rawLine of nonEmptyLines(raw)) {
+		for (const rawLine of raw.split("\n")) {
 			const line = parseLine(rawLine);
 			if (line === null) continue;
 			if (line.seq >= state.nextSeq) state.nextSeq = line.seq + 1;
@@ -31224,19 +31370,17 @@ function createFileCoverageEventStore(root, caps) {
 				return stamp;
 			});
 		},
-		async read(project, sinceSeq) {
+		async scan(project, sinceSeq, visit) {
 			assertSafeName(project, "project");
 			const path = coverageEventsPath(root, project);
 			const now = Date.now();
 			await serialize(path, async () => {
 				await pruneIfDue(project, path, await loadState(project, path), now);
 			});
-			const raw = await readRaw(path);
 			const cutoff = now - retentionMs;
-			const entries = [];
 			let lastSeq = 0;
 			let skipped = 0;
-			for (const rawLine of nonEmptyLines(raw)) {
+			for await (const rawLine of streamLines(path)) {
 				const line = parseLine(rawLine);
 				if (line === null) {
 					skipped += 1;
@@ -31245,15 +31389,13 @@ function createFileCoverageEventStore(root, caps) {
 				if (line.seq > lastSeq) lastSeq = line.seq;
 				if (line.seq <= sinceSeq) continue;
 				if (line.at < cutoff) continue;
-				entries.push({
+				visit({
 					seq: line.seq,
 					at: line.at,
 					payload: new Uint8Array(Buffer.from(line.payload, "base64"))
 				});
 			}
-			entries.sort((a, b) => a.seq - b.seq);
 			return {
-				entries,
 				lastSeq,
 				skipped
 			};
@@ -31284,13 +31426,31 @@ async function readRaw(path) {
 		throw err;
 	}
 }
-function nonEmptyLines(raw) {
-	return raw.split("\n").filter((l) => l !== "");
+/**
+* The stream's non-empty lines, one at a time. Streamed rather than read as one
+* string because a project's stream is capped in the hundreds of megabytes, far
+* past what a reader can hold. Order is the file's, which is append order,
+* which is seq order — the prune rewrites a suffix and never reorders.
+*/
+async function* streamLines(path) {
+	const input = createReadStream(path, { encoding: "utf8" });
+	const lines = createInterface$1({
+		input,
+		crlfDelay: Infinity
+	});
+	try {
+		for await (const line of lines) if (line !== "") yield line;
+	} catch (err) {
+		if (!(err instanceof Error && "code" in err && err.code === "ENOENT")) throw err;
+	} finally {
+		lines.close();
+		input.destroy();
+	}
 }
 /** Every parseable line of the log; partial or corrupt lines are silently omitted (the read side counts them). */
 async function readLines(path) {
 	const lines = [];
-	for (const rawLine of nonEmptyLines(await readRaw(path))) {
+	for await (const rawLine of streamLines(path)) {
 		const line = parseLine(rawLine);
 		if (line !== null) lines.push(line);
 	}

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {