cortad 0.3.1-rc.9 → 0.3.2

package/lib/pyhook/sitecustomize.py

@@ -1,8 +1,9 @@
 # Loaded into your Python app by the command that started it (through PYTHONPATH), and only then.
-# The same job as trace.cjs does for Node: it watches for a request to your app during which your
-# app called a model. That request is your AI's door, with the exact body it takes and the sign-in
-# it carried. What it sees is written to a file only you can read, in the command's own folder on
-# this machine. Nothing here talks to a network, and nothing here may ever stop your app starting.
+# The same job as trace.cjs does for Node: it watches for requests to your app during which your app
+# called a model. Each is an exchange: the exact body, the sign-in it carried, what your app answered
+# and the model calls it made, so the door is proven by a message rather than guessed. What it sees
+# is written to a file only you can read, in the command's own folder on this machine. Nothing here
+# talks to a network, and nothing here may ever stop your app starting.
 # ponytail: shadows a sitecustomize of the project's own, which is rare; chain to it if one shows up.
 import os
 
@@ -10,6 +11,9 @@ _FILE = os.environ.get("CORTAD_TRACE_FILE")
 _RULES = os.environ.get("CORTAD_RULES_FILE")
 _WRITES = os.environ.get("CORTAD_WRITES_DIR")
 _APP_ROOT = os.environ.get("CORTAD_APP_ROOT")
+_OUTBOUND = os.environ.get("CORTAD_OUTBOUND_FILE")
+# The port this hook answers held writes on: its own server, never a store the app reached.
+_held_ports = []
 
 
 # What the app writes into its own folder while a run is on: each file copied once before its first
@@ -24,7 +28,7 @@ def _install_writes():
     import shutil
 
     roots = {os.path.realpath(_APP_ROOT), os.path.abspath(_APP_ROOT)}
-    not_data = re.compile(r"(?:^|/)(?:node_modules|\.git|\.next|\.cache|\.venv|venv|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|dist|build|coverage|\.cortad)(?:/|$)|\.(?:log|pyc|tmp|swp)$")
+    not_data = re.compile(r"(?:^|/)(?:node_modules|\.git|\.next|\.cache|\.venv|venv|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|dist|build|coverage|\.cortad|logs?)(?:/|$)|\.log(?:\.[\w-]+)?$|\.(?:pyc|tmp|swp)$")
     state = {"run": None, "at": -1, "seen": set()}
     real_open = builtins.open
     real_os_open = os.open
@@ -108,6 +112,7 @@ def _install_writes():
 def _install():
     import contextvars
     import importlib.abc
+    import itertools
     import importlib.util
     import json
     import re
@@ -117,17 +122,20 @@ def _install():
 
     ctx = contextvars.ContextVar("cortad_request", default=None)
     limit = 65536
-    said = set()
     model_host = re.compile(r"(?:^|\.)(?:openai\.com|anthropic\.com|fireworks\.ai|openrouter\.ai|groq\.com|mistral\.ai|together\.xyz|together\.ai|deepseek\.com|cohere\.ai|cohere\.com|perplexity\.ai|x\.ai|openai\.azure\.com|cognitiveservices\.azure\.com|replicate\.com|huggingface\.co|cerebras\.ai|deepinfra\.com|novita\.ai|moonshot\.cn|dashscope\.aliyuncs\.com|bigmodel\.cn|ai-gateway\.vercel\.sh|gateway\.ai\.cloudflare\.com|helicone\.ai|portkey\.ai)$", re.I)
-    model_path = re.compile(r"/(?:chat/completions|completions|responses|messages|embeddings)$|:(?:generateContent|streamGenerateContent)|/invoke(?:-with-response-stream)?$|/api/(?:chat|generate)$", re.I)
+    model_path = re.compile(r"/(?:chat/completions|completions|responses|messages|embeddings|language-model|embedding-model)$|:(?:generateContent|streamGenerateContent)|/invoke(?:-with-response-stream)?$|/api/(?:chat|generate)$", re.I)
+    # wire.cjs MESSAGING_HOST: senders whose own path is the one a model API answers on.
+    messaging_host = re.compile(r"(?:^|\.)(?:nexmo\.com|vonage\.com|telnyx\.com|twilio\.com|mailgun\.net|sinch\.com|messagebird\.com|bird\.com)$", re.I)
 
     # The turn a message came in under, when the run tagged it (one opaque id per request), so a
     # model call and its prompt can be pinned to the reply they produced while turns overlap.
     turn_ok = re.compile(r"^[A-Za-z0-9:_.-]{1,80}$")
 
-    def turn_now():
-        req = ctx.get()
-        return req.get("turn") if req else None
+    # The request a row was made inside: its exchange id, and the run's turn tag when it has one.
+    def inside_of(req):
+        if not req:
+            return {}
+        return {"ex": req["id"], **({"turn": req["turn"]} if req.get("turn") else {})}
 
     # The customer's own rule sentences, written beside the trace by the run, so each model call can
     # say which of them its prompt carried. Absent file, nothing is claimed. Reloaded on change.
@@ -165,7 +173,14 @@ def _install():
     # What the app's tools answered, as the prompt of the next model call carries them (chat tool
     # messages, responses function outputs, Anthropic tool_result blocks, Gemini functionResponse
     # parts): the material a reply's facts rest on. Bounded per call.
-    tool_text, tools_max = 3000, 12
+    # A tool's answer is kept to the cap the reader takes, and one longer says it was cut (wire.cjs toolText).
+    tool_text, tools_max = 12000, 12
+
+    def tool_text_row(name, full, **extra):
+        out = {"name": str(name or "")[:80], "text": full[:tool_text], **extra}
+        if len(full) > tool_text:
+            out["cut"] = True
+        return out
 
     def text_of(v):
         if isinstance(v, str):
@@ -208,9 +223,10 @@ def _install():
         out, names = [], {}
 
         def add(name, text):
-            t = text_of(text)[:tool_text]
+            full = text_of(text)
+            t = full[:tool_text]
             if t.strip() and len(out) < tools_max and all(o["text"] != t for o in out):
-                out.append({"name": str(name or "")[:80], "text": t})
+                out.append(tool_text_row(name, full))
 
         messages = items(body.get("messages"))
         for m in messages:
@@ -269,7 +285,54 @@ def _install():
                 v = raw
         return json.dumps(clipped({} if v is None else v), ensure_ascii=False, separators=(",", ":"))[:args_max]
 
-    def calls_of(events):
+    # Each function tool the request declares, in every provider's shape: its name, what its
+    # description says it does, and its JSON schema (None where it declares none).
+    def tool_defs(body):
+        out = []
+
+        def add(name, does, schema):
+            if isinstance(name, str) and name:
+                out.append({"name": name, "does": does if isinstance(does, str) else "", "schema": schema if isinstance(schema, dict) else None})
+
+        config = body.get("toolConfig") if isinstance(body.get("toolConfig"), dict) else {}
+        for t in items(body.get("tools")) + items(config.get("tools")):
+            if isinstance(t.get("function"), dict):
+                f = t["function"]
+                add(f.get("name"), f.get("description"), f.get("parameters"))
+            elif isinstance(t.get("toolSpec"), dict):
+                spec = t["toolSpec"]
+                add(spec.get("name"), spec.get("description"), spec["inputSchema"].get("json") if isinstance(spec.get("inputSchema"), dict) else None)
+            else:
+                add(t.get("name"), t.get("description"), t.get("parameters") or t.get("input_schema") or t.get("inputSchema"))
+            for d in items(t.get("functionDeclarations") or t.get("function_declarations")):
+                add(d.get("name"), d.get("description"), d.get("parameters"))
+        for f in items(body.get("functions")):
+            add(f.get("name"), f.get("description"), f.get("parameters"))
+        return out
+
+    def schemas_of(body):
+        return {d["name"]: d["schema"] for d in tool_defs(body) if d["schema"]}
+
+    # What a tool's declared schema refuses in the arguments the model sent, said plainly, or None.
+    # Read before any value is clipped: a clipped value is ours, never the model's.
+    def refused_by(schema, raw):
+        args = {} if raw is None else raw
+        if isinstance(args, str):
+            if not args.strip():
+                args = {}
+            else:
+                try:
+                    args = json.loads(args)
+                except ValueError:
+                    return "the arguments are not valid JSON"
+        if not isinstance(args, dict):
+            return "the arguments are not a JSON object"
+        required = schema.get("required") if isinstance(schema.get("required"), list) else []
+        missing = next((k for k in required if isinstance(k, str) and k not in args), None)
+        return 'the required input "%s" is missing' % missing if missing else None
+
+    # `schemas`: the request's declared tools, so each call the reply makes is checked against its own.
+    def calls_of(events, schemas=None):
         whole, parts, n = {}, {}, [0]
 
         def put(key, name, args):
@@ -332,7 +395,13 @@ def _install():
                     if isinstance(p.get("functionCall"), dict):
                         put(None, p["functionCall"].get("name"), p["functionCall"].get("args"))
         found = list(whole.values()) + [tuple(p) for p in parts.values()]
-        return [{"name": str(name)[:80], "arguments": args_text(args)} for name, args in found if name]
+        out = []
+        for name, args in found:
+            if not name:
+                continue
+            refused = refused_by(schemas[name], args) if schemas and name in schemas else None
+            out.append(dict({"name": str(name)[:80], "arguments": args_text(args)}, **({"refused": refused} if refused else {})))
+        return out
 
     # This turn's earlier calls, as the prompt resends them after the person's latest message.
     def called_before(body):
@@ -372,19 +441,8 @@ def _install():
             if tool_name.fullmatch(v) and not final.fullmatch(v):
                 out.add(v)
 
-        def get(d, k):
-            return d.get(k) if isinstance(d, dict) else None
-
-        for t in items(body.get("tools")):
-            add(t.get("name"))
-            add(get(t.get("function"), "name"))
-            add(get(t.get("toolSpec"), "name"))
-            for d in items(t.get("functionDeclarations") or t.get("function_declarations")):
-                add(d.get("name"))
-        for f in items(body.get("functions")):
-            add(f.get("name"))
-        for t in items(get(body.get("toolConfig"), "tools")):
-            add(get(t.get("toolSpec"), "name"))
+        for d in tool_defs(body):
+            add(d["name"])
         text = prompt_text(body)[:200000]
         for m in re.finditer(r"^[ \t]*Tool Name:[ \t]*([^\n]+)", text, re.I | re.M):
             add(m.group(1))
@@ -502,9 +560,11 @@ def _install():
                     out.append((before[-1][1], (m.group(1) if m.group(1) is not None else m.group(3)).strip()))
         return out
 
-    # The model's own words: the text it answered, whole or streamed, in every provider's shape.
+    # The model's own words: the text it answered, whole or streamed, in every provider's shape. A
+    # responses stream sends its words as deltas and then whole again in its closing event: the
+    # closing copy counts only where no delta came.
     def reply_text(events):
-        s = []
+        s, closing, streamed = [], [], False
         for e in events:
             if not isinstance(e, dict):
                 continue
@@ -517,10 +577,14 @@ def _install():
                     s.append(c["text"])
             if e.get("type") == "response.output_text.delta" and isinstance(e.get("delta"), str):
                 s.append(e["delta"])
+                streamed = True
             resp = e.get("response") if isinstance(e.get("response"), dict) else {}
-            for it in items(e.get("output")) + items(resp.get("output")):
+            for it in items(e.get("output")):
                 if it.get("type") == "message":
                     s.extend(p["text"] for p in items(it.get("content")) if isinstance(p.get("text"), str))
+            for it in items(resp.get("output")):
+                if it.get("type") == "message":
+                    closing.extend(p["text"] for p in items(it.get("content")) if isinstance(p.get("text"), str))
             delta = e.get("delta") if isinstance(e.get("delta"), dict) else {}
             if e.get("type") == "content_block_delta" and isinstance(delta.get("text"), str):
                 s.append(delta["text"])
@@ -537,7 +601,7 @@ def _install():
                         s.append(p["text"])
             if isinstance(e.get("response"), str):
                 s.append(e["response"])
-        return "".join(s)
+        return "".join(s if streamed else s + closing)
 
     # This turn as the prompt carries it: the model's earlier words after the person's latest
     # message, and everything from that message on, where a single-prompt agent keeps its scratchpad.
@@ -564,27 +628,96 @@ def _install():
             out += [body.get("prompt") if isinstance(body.get("prompt"), str) else "", inp if isinstance(inp, str) else ""]
         return "\x00\n".join(out)
 
-    def called_in(sent, events):
+    def called_in(sent, events, provided=()):
         body = parsed(sent) if isinstance(sent, str) else None
         out = []
         declared = declared_in(body) if isinstance(body, dict) else set()
         written = [{"name": n, "arguments": args_text(a)} for _, n, a in written_calls(turn_texts(body, False, declared) if isinstance(body, dict) else "", declared) + written_calls(reply_text(events), declared)]
-        for c in (called_before(body) if isinstance(body, dict) else []) + calls_of(events) + written:
+        for c in (called_before(body) if isinstance(body, dict) else []) + calls_of(events, schemas_of(body) if isinstance(body, dict) else None) + list(provided) + written:
             if len(out) < calls_max and not any(o["name"] == c["name"] and o["arguments"] == c["arguments"] for o in out):
                 out.append(c)
         return out or None
 
-    # The passages the prompt carried as retrieved context: a block the app itself labels as
-    # context, documents, knowledge, sources or search results, in its system prompt or from the
-    # person's latest message on, and Anthropic document and search_result blocks. The app's own
-    # instructions are not passages: only what sits under such a label is.
+    # Tools the model's provider runs for the app (a web search, a file search, a code interpreter, a
+    # remote MCP server): the calls come back in the model's own reply, and so does what each answered
+    # where the provider says it. A call it marks failed, or an error it hands back, is the tool failing
+    # there, in the provider's own words. Answers pair with calls in the order the reply lists them.
+    provider_call = re.compile(r"^(web_search|file_search|code_interpreter|image_generation|mcp)_call$")
+    provider_result = re.compile(r"^\w+_tool_result$")
+
+    def provider_in(sent, events):
+        body = parsed(sent) if isinstance(sent, str) else None
+        offered = [t["type"] for t in items(body.get("tools") if isinstance(body, dict) else None) if isinstance(t.get("type"), str) and t["type"] not in ("function", "custom")]
+
+        def named(kind):
+            return next((t for t in offered if t.startswith(kind)), kind)
+
+        calls, names, answers = {}, {}, []
+
+        def answer(name, said):
+            full = text_of(said)
+            t = full[:tool_text]
+            if name and t.strip() and len(answers) < tools_max and not any(a["name"] == name and a["text"] == t for a in answers):
+                answers.append(tool_text_row(name, full, provider=True))
+
+        for e in events:
+            if not isinstance(e, dict):
+                continue
+            order = []
+            resp = e.get("response") if isinstance(e.get("response"), dict) else {}
+            for it in items(e.get("output")) + items([e.get("item")]) + items(resp.get("output")):
+                m = provider_call.match(str(it.get("type") or ""))
+                if m:
+                    name = str(it.get("name") or "mcp") if m.group(1) == "mcp" else named(m.group(1))
+                    order.append(name)
+                    if it.get("id"):
+                        given = it.get("action") if it.get("action") is not None else it.get("arguments")
+                        calls[it["id"]] = {"name": name[:80], "arguments": args_text({} if given is None else given)}
+                    if it.get("status") == "failed" or it.get("error"):
+                        answer(name, it.get("error") or "%s %s" % (it.get("type"), it.get("status")))
+                elif it.get("type") == "tool_output":
+                    answer(order.pop(0) if order else (offered[0] if len(offered) == 1 else ""), it.get("output"))
+            msg = e.get("message") if isinstance(e.get("message"), dict) else {}
+            for b in items(e.get("content")) + items(msg.get("content")) + items([e.get("content_block")]):
+                if b.get("type") in ("server_tool_use", "mcp_tool_use") and b.get("id"):
+                    names[b["id"]] = b.get("name")
+                    calls[b["id"]] = {"name": str(b.get("name"))[:80], "arguments": args_text({} if b.get("input") is None else b.get("input"))}
+                c = b.get("content")
+                if provider_result.match(str(b.get("type") or "")) and (b.get("is_error") is True or (isinstance(c, dict) and str(c.get("type") or "").endswith("_error"))):
+                    answer(names.get(b.get("tool_use_id")) or re.sub(r"_tool_result$", "", b["type"]), c)
+        return list(calls.values()), answers
+
+    # What the prompt was handed besides its instructions, of two kinds. What the app retrieved: a
+    # block it labels as context, documents, knowledge, sources or search results. And its own
+    # record of the person, passed beside the ask: a profile, a résumé, an account, orders, a JSON
+    # or key: value block of their data, under any heading or none ("data"). A reply's fact taken
+    # from either was given, not made up: resumeforge put the saved profile into every prompt, and
+    # its replies' facts from it were read as invention. In the system prompt or from the person's
+    # latest message on, and Anthropic document and search_result blocks.
     passage_text, passages_max = 3000, 6
     material = re.compile(r"\b(?:retriev\w*|context|knowledge|documents?|sources?|search[ _-]?results?|references?|passages?|excerpts?|snippets?|chunks?|background|faq|relevant)\b|检索|知识|参考资料|资料|上下文|文档|背景|相关", re.I)
+    record = re.compile(r"\b(?:profiles?|r[eé]sum[eé]s?|cv|(?<!into )accounts?|orders|purchases|records|(?:user|customer|member|patient|student|client|candidate)[ _]?(?:info\w*|data|details?|facts)|(?:order|purchase|account|medical|payment|employment|transaction|work) history)\b|个人资料|用户资料|个人信息|用户信息|简历|档案|订单|账户|账号|会员", re.I)
+    def name_of(label):
+        return re.sub(r"(?:开始|\s+(?:start|begin))$", "", re.sub(r"[#:：\[\]=]", "", label).strip(), flags=re.I).strip()
+
+    # A record is named by a label that ends in its word ("User profile", "[已选个人资料开始]"): a
+    # heading of the instructions that only mentions one ("关于简历通本身与使用平台") is not it.
+    record_end = re.compile(r"(?:" + record.pattern + r")$", re.I)
+
+    def is_record(label):
+        return bool(record_end.search(name_of(label)))
+
+    def is_label(label):
+        return bool(material.search(label)) or is_record(label)
+
+    def kind_of(label):
+        return "data" if is_record(label) else None
+
     heading = re.compile(r"^\s*(?:#{1,6}\s+[^\n]{1,80}|[^\n]{1,80}[:：]\s*(?:\([^\n)]*\))?|\[[^\n\]]{1,80}\]|={2,}\s*[^\n]{1,80}?\s*={2,})\s*$")
-    # An inline label is a noun phrase that ends in the material word ("context:", "background:",
-    # "retrieved passages:"): "4. Knowledge:" in a numbered instruction and a JSON key are not.
-    inline = re.compile(r"^\s*(?:[-*]\s+)?([A-Za-z\u4e00-\u9fff][A-Za-z\u4e00-\u9fff '’_-]{0,29})[:：]\s*\S")
-    named = re.compile(r"(?:" + material.pattern + r")\s*$", re.I)
+    # An inline label is a noun phrase that ends in the label word ("context:", "background:",
+    # "user profile:"): "4. Knowledge:" in a numbered instruction and a JSON key are not.
+    inline = re.compile(r"^\s*(?:[-*]\s+)?([A-Za-z一-鿿][A-Za-z一-鿿 '’_-]{0,29})[:：]\s*\S")
+    named = re.compile(r"(?:" + material.pattern + "|" + record.pattern + r")\s*$", re.I)
     tagged = re.compile(r"<([A-Za-z][\w-]*)[^>]*>([\s\S]*?)</\1>")
 
     # A label's block runs on to the next heading of its own kind: "资料：" over retrieved chunks
@@ -592,7 +725,7 @@ def _install():
     # one chunk of five and the reader called the knowledge base's own 1% fee made up. A markdown
     # label holds deeper headings. A closing paragraph that opens on a label of its own ("问题：...",
     # "Question: ...") is the prompt's ask, not material. A long block is several passages, cut
-    # between its paragraphs.
+    # between its paragraphs, then its lines.
     markdown = re.compile(r"^\s*(#{1,6})\s")
 
     def ends_block(label, line):
@@ -606,21 +739,65 @@ def _install():
         return bool(m and not named.search(m.group(1)))
 
     # A heading inside a fenced block is the material's own text: a README chunk's "## Features".
-    fence = re.compile(r"^\s*(?:```|~~~)", re.M)
+    fence = re.compile(r"^\s*(?:```|~~~)")
+
+    def fences(para):
+        return sum(1 for l in para.split("\n") if fence.match(l))
 
-    def add_block(add, name, paras):
+    def pieces(p):
+        if len(p) <= passage_text:
+            return [p]
+        return [l[i:i + passage_text] for l in p.split("\n") for i in range(0, len(l), passage_text)]
+
+    def add_block(add, name, paras, kind=None):
         text = ""
-        for p in paras:
-            if text and len(text) + len(p) + 2 > passage_text:
-                add(name, text)
-                text = ""
-            text += ("\n\n" if text else "") + p
-        add(name, text)
+        for para in paras:
+            for j, p in enumerate(pieces(para)):
+                if text and len(text) + len(p) + 2 > passage_text:
+                    add(name, text, kind)
+                    text = ""
+                text += (("\n" if j else "\n\n") if text else "") + p
+        add(name, text, kind)
+
+    # The person's data with no label word: a JSON object, or key: value lines (YAML too) under a
+    # heading. A transcript pasted as "User: ... / Assistant: ..." is the conversation; a tool's
+    # schema, an agent's Thought/Action scaffold and an answer's shape are instructions.
+    kv_line = re.compile(r"^\s*(?:[-*]\s+)?[\"']?([^\W\d][\w .'’()/-]{0,39})[\"']?\s*[:：]\s*(\S.*)?$")
+    role = re.compile(r"^(?:user|assistant|human|ai|system|bot|model|agent|customer|用户|助手|客服|顾客|系统)$", re.I)
+    scaffold = re.compile(r"^(?:tool\b.*|action(?: input)?|thought|observation|final answer|question|answer|input|output)$", re.I)
+    shape = re.compile(r"format|schema|example|output|respon|return|reply|格式|示例|输出|返回", re.I)
+    tool_schema = re.compile(r"\"(?:parameters|input_schema|inputSchema)\"\s*:")
+    # "[已选岗位结束]": the closing marker an app puts after a record is not part of it.
+    closer = re.compile(r"^\s*\[[^\]\n]{1,80}\]\s*$")
+
+    def data_in(para, before):
+        lines = para.split("\n")
+        head = lines[0] if heading.match(lines[0]) else None
+        body = [l for l in (lines[1:] if head else lines) if l.strip() and not fence.match(l)]
+        if len(body) > 1 and closer.match(body[-1]):
+            body.pop()
+        name = head or (before if before and "\n" not in before and heading.match(before) else "")
+        text = "\n".join(body)
+        if shape.search(name):
+            return None
+        if re.match(r"^\s*[{\[]", text):
+            try:
+                v = json.loads(text)
+            except ValueError:
+                return None
+            return (name_of(name) or "data", text) if isinstance(v, (dict, list)) and v and not tool_schema.search(text) else None
+        kv = [kv_line.match(l) for l in body]
+        valued = [m.group(1).strip() for m in kv if m and m.group(2)]
+        shaped = bool(name) and all(m or re.match(r"^\s+\S|^\s*-\s", l) for m, l in zip(kv, body))
+        if shaped and len(valued) >= 2 and sum(1 for k in valued if role.match(k)) < 2 and not any(scaffold.match(k) for k in valued):
+            return (name_of(name), text)
+        return None
 
     def labelled(text, add):
         def lift(m):
-            if material.search(m.group(1).replace("_", " ")):
-                add(m.group(1), m.group(2))
+            label = m.group(1).replace("_", " ")
+            if is_label(label):
+                add(m.group(1), m.group(2), kind_of(label))
                 return ""
             return m.group(0)
         paras = re.split(r"\n\s*\n", tagged.sub(lift, str(text or "")))
@@ -628,19 +805,26 @@ def _install():
         while i < len(paras):
             lines = paras[i].split("\n")
             head = lines[0]
-            if heading.match(head) and material.search(head):
+            if heading.match(head) and is_label(head):
                 block = ["\n".join(lines[1:])]
-                fenced = len(fence.findall(block[0])) % 2 == 1
+                fenced = fences(block[0]) % 2 == 1
                 while i + 1 < len(paras) and (fenced or (not ends_block(head, paras[i + 1].split("\n")[0]) and not (i + 2 == len(paras) and asks(paras[i + 1])))):
                     i += 1
                     block.append(paras[i])
-                    if len(fence.findall(paras[i])) % 2 == 1:
+                    if fences(paras[i]) % 2 == 1:
                         fenced = not fenced
-                add_block(add, re.sub(r"[#:：\[\]=]", "", head).strip(), block)
+                # A block that opens on a record's own label ("[已选个人资料开始]" under "参考资料：") is that record.
+                inner = block[0].lstrip().split("\n")[0]
+                label = inner if heading.match(inner) and is_record(inner) else head
+                add_block(add, name_of(label), block, kind_of(label))
             else:
-                label = next((m for m in (inline.match(l) for l in lines) if m and named.search(m.group(1))), None)
-                if label:
-                    add(label.group(1).strip(), paras[i])
+                found = next((m for m in (inline.match(l) for l in lines) if m and named.search(m.group(1))), None)
+                if found:
+                    add(found.group(1).strip(), paras[i], kind_of(found.group(1)))
+                else:
+                    data = data_in(paras[i], paras[i - 1] if i else None)
+                    if data:
+                        add_block(add, data[0], [data[1]], "data")
             i += 1
 
     def passages_in(sent):
@@ -649,10 +833,10 @@ def _install():
             return None
         out = []
 
-        def add(name, text):
+        def add(name, text, kind=None):
             t = str(text or "").strip()[:passage_text]
             if len(t) >= 20 and len(out) < passages_max and all(o["text"] != t for o in out):
-                out.append({"name": str(name or "")[:80], "text": t})
+                out.append({"name": str(name or "")[:80], "text": t, **({"kind": kind} if kind else {})})
 
         def scan(content):
             if isinstance(content, str):
@@ -720,11 +904,154 @@ def _install():
 
     def rules_in(sent):
         found = rules_now()
-        if found is None:
+        # An empty list claims nothing either way: "carried none" needs rules to carry.
+        if not found:
             return None
         body = norm(sent)
         return [rid for rid, parts in found if all(p in body for p in parts)]
 
+    # What the person said to the app: every text value requests carried in their bodies and
+    # addresses, long enough to tell apart, the newest kept. A model call's prompt is told apart from
+    # them whichever side keeps the conversation. Kept by value, not by request: with trials side by
+    # side a trial's opening message sat up to 282 requests back, and a window of the last 32 would
+    # have told it as the app's own words on 114 of 132 later turns.
+    # Bounded by characters as well as count: a raw body is one value, and 2000 of them at 64 KB would
+    # hold about 128 MB inside the app.
+    heard_kept, heard_chars, heard_max, said_ascii, said_other = 2000, 2_000_000, 200, 8, 4
+    heard = {}
+    held = [0]
+    letter = re.compile(r"[^\W\d_]")
+    form = re.compile(r"^[^=&\s]+=[^&]*(?:&[^=&\s]+=[^&]*)*$")
+
+    def heard_in(req):
+        from urllib.parse import parse_qsl
+        out = set()
+
+        def add(s):
+            t = s.strip() if isinstance(s, str) else ""
+            if len(out) < heard_max and len(t) >= (said_ascii if t.isascii() else said_other) and letter.search(t):
+                out.add(t)
+
+        def walk(v, depth):
+            if isinstance(v, str):
+                add(v)
+            elif isinstance(v, (dict, list)) and depth < 12:
+                for x in v.values() if isinstance(v, dict) else v:
+                    walk(x, depth + 1)
+
+        raw = body_of(req)
+        body = parsed(raw)
+        if isinstance(body, (dict, list)):
+            walk(body, 0)
+        elif form.match(raw):
+            for _, v in parse_qsl(raw):
+                add(v)
+        else:
+            add(raw)
+        for _, v in parse_qsl(req["path"].partition("?")[2]):
+            add(v)
+        return out
+
+    def hear(req):
+        try:
+            for w in heard_in(req):
+                if heard.pop(w, None):
+                    held[0] -= len(w)
+                heard[w] = True
+                held[0] += len(w)
+            while heard and (len(heard) > heard_kept or held[0] > heard_chars):
+                w = next(iter(heard))
+                del heard[w]
+                held[0] -= len(w)
+        except Exception:
+            pass
+
+    # What the app told the model on this call: its system prompt and every block it or its framework
+    # put among the messages (a reminder, injected context, a prompt template), in prompt order. Never
+    # the person's words: what a request carried is taken out of the person's side, and a message
+    # that held only that is not told. Never the model's own words or a tool's answer. A reply is
+    # read against this, and a block of it the reply repeats is a leak code decides.
+    instructions_max, told_min = 12000, 12
+    word_char = re.compile(r"[^\W_]")
+    # The fields read below, in the shapes they are read in. A body with none of them is a shape
+    # this hook cannot read: its instructions stay unrecorded, so the run keeps the read's copy of
+    # the prompt, and "" always means the call really carried none.
+    told_fields = {"system": (str, list, dict), "instructions": (str, list, dict), "systemInstruction": dict,
+                   "messages": list, "input": (str, list), "contents": list, "prompt": str}
+
+    def instructions_in(body, words):
+        if not any(isinstance(body.get(k), shape) for k, shape in told_fields.items()):
+            return None
+        # Longest first, so a short phrase the person repeated never splits a longer message of theirs.
+        said = sorted(words, key=len, reverse=True)
+        told = []
+
+        def own(content):
+            t = text_of(content).strip()
+            if t:
+                told.append(t)
+
+        def added(left):
+            for w in said:
+                if w in left:
+                    left = left.replace(w, " ")
+            if len(word_char.findall(left)) >= told_min:
+                told.append(left.strip())
+
+        def texts(content):
+            return [content] if isinstance(content, str) else [p["text"] for p in items(content) if isinstance(p.get("text"), str)]
+
+        own(body.get("system"))
+        own(body.get("instructions"))
+        if isinstance(body.get("systemInstruction"), dict):
+            own(body["systemInstruction"].get("parts"))
+        for m in items(body.get("messages")):
+            if m.get("role") in ("system", "developer"):
+                own(m.get("content"))
+            elif m.get("role") == "user" and not handed_back.match(text_of(m.get("content"))):
+                for t in texts(m.get("content")):
+                    added(t)
+        inp = body.get("input")
+        for it in [{"role": "user", "content": inp}] if isinstance(inp, str) else items(inp):
+            if it.get("role") in ("system", "developer"):
+                own(it.get("content"))
+            elif it.get("role") == "user":
+                for t in texts(it.get("content")):
+                    added(t)
+        for c in items(body.get("contents")):
+            if c.get("role") != "model":
+                for t in texts(c.get("parts")):
+                    added(t)
+        if isinstance(body.get("prompt"), str):
+            added(body["prompt"])
+        return "\n\n".join(told)[:instructions_max]
+
+    # The tools the call offered its model: each by name, a provider's own tool by its type, and the
+    # declared ones as their schemas say: what each does and the inputs it requires.
+    tools_offered, does_max, inputs_max = 60, 300, 12
+
+    def told_of(body, req):
+        words = heard.keys() | heard_in(req) if req else heard.keys()
+        provider = [t["type"] for t in items(body.get("tools")) if not t.get("name") and not t.get("function") and isinstance(t.get("type"), str) and t["type"] not in ("function", "custom")]
+        offered = list(dict.fromkeys(sorted(declared_in(body)) + provider))[:tools_offered]
+        declared = []
+        for d in list({d["name"]: d for d in tool_defs(body) if d["schema"]}.values())[:tools_offered]:
+            required = d["schema"].get("required")
+            entry = {"name": d["name"][:80]}
+            if d["does"].strip():
+                entry["does"] = d["does"].strip()[:does_max]
+            entry["requires"] = [k for k in required if isinstance(k, str)][:inputs_max] if isinstance(required, list) else []
+            declared.append(entry)
+        out = {}
+        instructions = instructions_in(body, words)
+        if instructions is not None:
+            out["instructions"] = instructions
+        if offered:
+            out["offered"] = offered
+        if declared:
+            out["declared"] = declared
+        return out
+
     # Every value this file writes passes one mask, whichever path wrote it: a key inside a value
     # ("sk-...", a bearer token, a JWT) and what anyone wrote after "password is" or "token:". The
     # door row's sign-in headers are kept on purpose: the command replays them from this machine.
@@ -753,12 +1080,30 @@ def _install():
         b = parsed(raw)
         return json.dumps(scrub(b), ensure_ascii=False) if isinstance(b, (dict, list)) else mask_text(raw)
 
+    # A reply is JSON, or a stream of JSON events: masked the same way, event by event, so a stream
+    # whose events say {"token": "..."} keeps its words.
+    def reply_scrubbed(raw):
+        whole = parsed(raw)
+        if isinstance(whole, (dict, list)):
+            return json.dumps(scrub(whole), ensure_ascii=False)
+        out = []
+        for line in raw.split("\n"):
+            m = re.match(r"^(data:\s?)?([{\[].*)$", line)
+            out.append((m.group(1) or "") + body_scrubbed(m.group(2)) if m else mask_text(line))
+        return "\n".join(out)
+
     def write(row):
         try:
             if not (row.get("hello") or row.get("listen") or row.get("routes")):
                 out = scrub(row)
                 if isinstance(row.get("body"), str):
                     out["body"] = body_scrubbed(row["body"])
+                if isinstance(row.get("reply"), str):
+                    out["reply"] = reply_scrubbed(row["reply"])
+                if isinstance(row.get("sent"), list):
+                    out["sent"] = [body_scrubbed(x) for x in row["sent"] if isinstance(x, str)]
+                if isinstance(row.get("after"), list):
+                    out["after"] = [{**s, "body": body_scrubbed(raw["body"]), "reply": reply_scrubbed(raw["reply"])} for s, raw in zip(out["after"], row["after"])]
                 row = out
             fd = os.open(_FILE, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
             with os.fdopen(fd, "a", encoding="utf-8") as f:
@@ -769,13 +1114,15 @@ def _install():
     # Every other outbound call: the host and what it answered, never a byte of it. A search
     # provider over its limit for a whole run was invisible until this row existed.
     # A store on this machine (a local Qdrant or Chroma) is said too when it answered with passages.
-    def dep(url, status, code=None, passages=None, turn=None):
+    # A retrieval says so, with the app's line that asked, so one that came back empty has an address.
+    def dep(url, status, code=None, passages=None, req=None, caller=None):
         try:
             host = (urlsplit(str(url)).hostname or "").lower()
-            if not host or (host in ("localhost", "127.0.0.1", "::1") and not passages):
+            retrieval = is_retrieval(url)
+            if not host or (host in ("localhost", "127.0.0.1", "::1") and not passages and not retrieval):
                 return
-            turn = turn or turn_now()
-            write({"dep": {"at": int(time.time() * 1000), "host": host[:253], "status": int(status or 0), **({"code": str(code)[:40]} if code else {}), **({"turn": turn} if turn else {}), **({"passages": passages} if passages else {})}})
+            write({"dep": {"at": int(time.time() * 1000), "host": host[:253], "status": int(status or 0), **({"code": str(code)[:40]} if code else {}), **inside_of(req or ctx.get()),
+                           **({"retrieval": True} if retrieval else {}), **({"caller": caller} if retrieval and caller else {}), **({"passages": passages} if passages else {})}})
         except Exception:
             pass
     def is_model_call(url):
@@ -789,31 +1136,421 @@ def _install():
             return bool(re.search(r"generativelanguage|aiplatform", host)) and bool(model_path.search(path))
         if host.endswith("amazonaws.com"):
             return host.startswith("bedrock")
-        return bool(model_host.search(host)) or (bool(model_path.search(path)) and bool(re.search(r"/v\d|/api/", path)))
-
-    def text(body):
+        # The OpenAI shape's own paths name a model call wherever they are served: LiteLLM's proxy is
+        # called at plain /chat/completions (wire.cjs OPENAI_PATH).
+        if model_host.search(host) or re.search(r"/(?:chat/completions|completions|embeddings)$", path, re.I):
+            return True
+        # /messages and /responses only as the two APIs spell them (wire.cjs AS_SPELLED).
+        if re.search(r"/(?:messages|responses)$", path, re.I):
+            return bool(re.search(r"/v1/(?:messages|responses)$", path, re.I)) and not messaging_host.search(host)
+        return bool(model_path.search(path)) and bool(re.search(r"/v\d|/api/", path))
+
+    # `most`: what is read of a body. The door's row keeps 64 KB; a model call's prompt is read whole
+    # up to the reply's bound, since a prompt cut at 64 KB is not JSON and every passage, tool answer
+    # and call in it was lost (resumeforge's tool list alone pushed its prompt past the cut).
+    def text(body, most=limit):
         if body is None:
             return ""
         if isinstance(body, (bytes, bytearray)):
-            return bytes(body[:limit]).decode("utf-8", "replace")
+            return bytes(body[:most]).decode("utf-8", "replace")
         if isinstance(body, str):
-            return body[:limit]
+            return body[:most]
         try:
-            return json.dumps(body)[:limit]
+            return json.dumps(body)[:most]
         except (TypeError, ValueError):
             return ""
 
+    # A model request kept whole when it fits; a longer one keeps its shape and every value short
+    # enough to be a turn, its longest texts cut in their middle (lib/wire.cjs fitted).
+    def fitted(body):
+        whole = text(body, reply_max)
+        if len(whole) <= limit:
+            return whole
+        try:
+            parsed = json.loads(whole)
+        except ValueError:
+            parsed = None
+        cap = limit // 2
+        while isinstance(parsed, (dict, list)) and cap >= 256:
+            def cut(v):
+                if isinstance(v, str):
+                    return v if len(v) <= cap else v[:cap // 2] + " [...] " + v[-(cap // 2):]
+                if isinstance(v, list):
+                    return [cut(x) for x in v]
+                return {k: cut(x) for k, x in v.items()} if isinstance(v, dict) else v
+            out = json.dumps(cut(parsed), ensure_ascii=False)
+            if len(out) <= limit:
+                return out
+            cap //= 2
+        return whole[:limit]
+
+    # An exchange is kept when the request makes its first model call, for the first few requests per
+    # route, and written once the app has answered. Model calls and tool rows carry the request's id
+    # whether kept or not; the command joins them to the exchange it has.
+    exchanges_per_route, canary_per_route, routes_kept, sent_max, model_words = 4, 30, 1000, 4, 4000
+    per_route = {}
+
+    # The person's requests, ours (a run's turns, a knock) and the canary's each have their own count,
+    # so a run that knocked first never takes the places of the requests that prove a door. Every one
+    # of the person's is kept: their newest is the sign-in and the proof a run takes, and the command
+    # keeps only the newest few per door.
+    def slot_of(turn):
+        if not turn:
+            return "", float("inf")
+        return ("canary ", canary_per_route) if turn.startswith("canary:") else ("ours ", exchanges_per_route)
+    id_segment = re.compile(r"^\d+$|^(?=.{8,}$).*\d")
+
+    # One route whatever id its path carries: a conversation in the path is a new path every trial.
+    def route_key(method, path):
+        return method + " " + "/".join("{id}" if id_segment.match(s) else s for s in path.split("?")[0].split("/"))
+
+    # The request a model call is pinned to, returned so the call's row carries it: the one it was
+    # made inside, else the request that asked for it (cortad_tied).
     def note(url, body):
         req = ctx.get()
-        if not req or req["noted"] or not is_model_call(url):
+        if not is_model_call(url):
+            return req
+        if tied:
+            tied.sent(text(body))
+        if not req and tied:
+            try:
+                req = tied.pinned(text(body, reply_max))
+            except Exception:
+                req = None
+        elif req and tied:
+            try:
+                req = tied.inside(req, text(body, reply_max))
+            except Exception:
+                pass
+        if not req:
+            return None
+        if not req["noted"]:
+            req["noted"] = True
+            cls, most = slot_of(req["turn"])
+            key = cls + route_key(req["method"], req["path"])
+            n = per_route.get(key, 0)
+            if n < most and (n or len(per_route) < routes_kept):
+                per_route[key] = n + 1
+                req["kept"] = True
+        if req["kept"] and len(req["sent"]) < sent_max:
+            req["sent"].append(fitted(body))
+        return req
+
+    def noted(url, sent):
+        try:
+            return note(url, sent)
+        except Exception:
+            return ctx.get()
+
+    # A model call made for `req` got its response, as it arrives (cortad_tied `replied`).
+    def answered_call(url, req):
+        if req and is_model_call(url):
+            req["heard"] = True
+
+    # Outbound writes a trial makes are held in the app, never sent: a trial that books, charges,
+    # emails or deletes would otherwise do it for real. Held: a call made inside a request the run
+    # tagged, with a writing method, to a host that is not a model, a retrieval, this machine, a copy
+    # of ours or a host the person said yes to. A call carrying a provider's test key goes to that
+    # provider's own sandbox as sent. The app is answered with a success shaped like what it sent,
+    # and the run is told by a dep row with `held` and the clipped call (lib/trace.cjs does the same).
+    import base64
+    from urllib.parse import parse_qsl
+
+    passed = {"at": -1, "hosts": []}
+    # When the run last sent a request: a write made outside every request (a queue's worker, a
+    # thread) is held while a run is live, since it may be carrying out a trial's ask.
+    # ponytail: while a run is live, a person's own queued write is held too; per-ask pinning of
+    # background writes is the upgrade when that matters.
+    run_seen = {"at": None}
+    run_live_s = 600
+    this_machine = re.compile(r"^(?:localhost|127(?:\.\d+){3}|::1|0\.0\.0\.0)$", re.I)
+    # ponytail: a sign-in's token refresh is a POST that changes nothing, told apart by its path only.
+    token_path = re.compile(r"/(?:oauth2?/)?token(?:[/?]|$)", re.I)
+    # A provider's own sandbox, named so in the host: api.sandbox.paypal.com, sandbox-api.polar.sh.
+    sandbox_host = re.compile(r"(?:^|[.-])(?:sandbox|sbox)[.-]", re.I)
+    test_setting = re.compile(r"(?:^|_)TEST(?:_|$)", re.I)
+    # An API where every call is a POST names what a call does in its last segment, as
+    # resource.verb_words (customers.get, billing.preview_attach) or as a gRPC or Connect method
+    # (acme.v1.UserService/GetUser). A POST so named that starts with a reading word, and holds no word
+    # that makes the read a write (get_or_create, check_in, GetLease), goes out.
+    # ponytail: decided on the name alone, so a POST named as a read whose body writes goes out: a
+    # check that also records usage, or a file created under a name such as allow.list.
+    dot_call = re.compile(r"[A-Za-z][\w-]*\.[a-z][a-z_]*", re.A)
+    dot_read = {"get", "list", "check", "search", "query", "find", "lookup", "retrieve", "describe", "count", "preview"}
+    # A preview commits nothing whatever it previews; any other reading word reads only while no word
+    # after it writes: credits.check_deduct and usage.count_increment went out as reads.
+    write_word = set("create|update|delete|remove|set|add|put|insert|upsert|write|save|store|record|track|log|send|deduct|increment|decrement|consume|use|spend|charge|pay|refund|cancel|reserve|lock|unlock|commit|apply|attach|detach|start|stop|run|trigger|reset|rotate|revoke|grant|issue|mint|transfer|move|merge|sync|import|export|upload|publish|enqueue|push|pop|ack|touch|mark|close|approve|reject|submit|confirm|redeem|claim".split("|"))
+    dot_not = {"or", "and", "in", "out", "next"} | write_word
+    rpc_call = re.compile(r"(?:[A-Z][a-z0-9]*)+")
+    rpc_read = {"Get", "List", "Search", "Query", "Find", "Lookup", "Describe"}
+    rpc_not = {"or", "and", "next", "lease"} | write_word
+    service_name = re.compile(r"\.[A-Z]\w*\Z", re.A)
+
+    def reads_by_name(method, path):
+        if str(method or "").upper() != "POST":
+            return False
+        parts = [p for p in (path or "").split("/") if p]
+        last = parts[-1] if parts else ""
+        before = parts[-2] if len(parts) > 1 else ""
+        if dot_call.fullmatch(last):
+            words = last.split(".")[1].split("_")
+            return words[0] in dot_read and (words[0] == "preview" or not any(w in dot_not for w in words[1:]))
+        if service_name.search(before) and rpc_call.fullmatch(last):
+            words = re.findall(r"[A-Z][a-z0-9]*", last)
+            return words[0] in rpc_read and not any(w.lower() in rpc_not for w in words[1:])
+        return False
+
+    def pass_now():
+        try:
+            at = os.stat(_OUTBOUND).st_mtime_ns
+            if at != passed["at"]:
+                passed["at"] = at
+                with open(_OUTBOUND, encoding="utf-8") as f:
+                    got = json.load(f).get("pass")
+                passed["hosts"] = [h for h in got if isinstance(h, str) and h] if isinstance(got, list) else []
+        except Exception:
+            pass
+        return passed["hosts"]
+
+    # A provider's test-mode key, named so in the key itself whatever comes before it (Stripe's
+    # sk_test_, am_sk_test_, pdl_sdbx_), or a value of a setting the app keeps as a test one.
+    def test_key(auth):
+        # `requests` takes a header value as bytes, and str() of one is "b'...'", which no key matches.
+        a = auth.decode("utf-8", "replace") if isinstance(auth, (bytes, bytearray)) else str(auth or "")
+        m = re.match(r"^Basic\s+(\S+)$", a, re.I)
+        if m:
+            try:
+                a = base64.b64decode(m.group(1)).decode("utf-8", "replace")
+            except Exception:
+                pass
+        # In the prefix of the key itself, set off by underscores: a Basic user named test-admin and a
+        # live key holding "-Test-" are not test keys.
+        return bool(a) and (any(re.fullmatch(r"(?:[a-z0-9]{2,8}_){0,3}(?:test|sandbox|sbox|sdbx)_[\w-]{4,}", piece, re.I | re.A) for piece in re.split(r"[\s:]+", a)) or any(v and len(v) >= 8 and v in a for k, v in os.environ.items() if test_setting.search(k)))
+
+    # The headers a key travels in.
+    key_headers = ("authorization", "x-api-key", "api-key", "apikey", "x-auth-token")
+
+    def keys_in(headers):
+        return [headers.get(n) for n in key_headers]
+
+    # `keys_of()`: the values of the headers a key travels in, read only for a call that is otherwise
+    # held. Once a tagged write is being decided, a failure to decide holds it.
+    def held_here(url, method, keys_of):
+        req = ctx.get()
+        if str(method or "").upper() not in ("POST", "PUT", "PATCH", "DELETE"):
+            return False
+        if req:
+            if not req.get("turn"):
+                return False
+        elif run_seen["at"] is None or time.monotonic() - run_seen["at"] > run_live_s:
+            return False
+        try:
+            parts = urlsplit(str(url))
+            host = (parts.hostname or "").lower()
+            if this_machine.match(host) or sandbox_host.search(host) or is_model_call(url) or is_retrieval(url) or token_path.search(parts.path or "") or reads_by_name(method, parts.path) or any(test_key(k) for k in keys_of()):
+                return False
+            return not any(host == p or host.endswith("." + p) for p in pass_now())
+        except Exception:
+            return True
+
+    # A GraphQL query reads; a mutation writes. A `query` that is not GraphQL (SQL over HTTP) is held.
+    def reads_only(raw):
+        b = parsed(raw) if raw else None
+        q = b.get("query") if isinstance(b, dict) else None
+        return isinstance(q, str) and bool(re.match(r"^\s*(?:\{|query\b|fragment\b)", q)) and not re.search(r"\bmutation\b", q)
+
+    held_count = itertools.count(1)
+
+    def fields_of(raw, kind):
+        try:
+            b = dict(parse_qsl(raw)) if "form" in (kind or "") else json.loads(raw)
+        except Exception:
+            return {}
+        return b if isinstance(b, dict) else {}
+
+    def held_reply(raw, kind):
+        return json.dumps({**fields_of(raw, kind), "id": "cortad-held-%d" % next(held_count), "status": "ok"}).encode("utf-8")
+
+    # Said once per method and host in the app's own output, where the error that follows is read:
+    # a stand-in an SDK cannot parse otherwise reads as a bug in the app. It holds no word that marks
+    # an error, so it is never quoted back as the app's own.
+    held_said = set()
+
+    def held_say(method, host):
+        if (method, host) in held_said:
             return
-        req["noted"] = True
-        key = req["method"] + " " + req["path"].split("?")[0]
-        if key in said:
+        held_said.add((method, host))
+        try:
+            sys.stderr.write("cortad: a request Cortad sent made this app send %s to %s. Cortad kept that call on this machine and answered it with a stand-in success, since it could change something real. A failure right after this line comes from that stand-in, not from your code. With that service's test key the call goes out as sent.\n" % (method, host))
+        except Exception:
+            pass
+
+    # Named by method and host only: a webhook's path is its credential.
+    def held_row(url, method, raw, kind, req):
+        try:
+            parts = urlsplit(str(url))
+            held_say(str(method).upper(), (parts.hostname or "")[:253])
+            write({"dep": {"at": int(time.time() * 1000), "host": (parts.hostname or "")[:253], "status": 200, "held": True, **inside_of(req),
+                           "called": [{"name": ("%s %s" % (str(method).upper(), parts.hostname))[:80], "arguments": args_text(fields_of(raw, kind))}]}})
+        except Exception:
+            pass
+
+    # aiohttp builds its own response from a connection, so a held call is sent to a server of this
+    # hook's own on this machine, which answers it.
+    held_server = {"port": None}
+    held_waiting = {}
+    held_sent = itertools.count(1)
+
+    def held_port():
+        if held_server["port"] is None:
+            try:
+                import threading
+                from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+                class Answer(BaseHTTPRequestHandler):
+                    def answer(self):
+                        size = int(self.headers.get("content-length") or 0)
+                        raw = self.rfile.read(min(size, limit)).decode("utf-8", "replace") if size else ""
+                        kind = self.headers.get("content-type", "")
+                        waiting = held_waiting.pop(self.headers.get("x-cortad-held", ""), None)
+                        if waiting:
+                            held_row(waiting[0], waiting[1], raw, kind, waiting[2])
+                        out = held_reply(raw, kind)
+                        self.send_response(200)
+                        self.send_header("content-type", "application/json")
+                        self.send_header("content-length", str(len(out)))
+                        self.end_headers()
+                        self.wfile.write(out)
+
+                    do_POST = do_PUT = do_PATCH = do_DELETE = answer
+
+                    def log_message(self, *a):
+                        pass
+
+                server = ThreadingHTTPServer(("127.0.0.1", 0), Answer)
+                server.daemon_threads = True
+                _held_ports.append(server.server_address[1])
+                threading.Thread(target=server.serve_forever, daemon=True).start()
+                held_server["port"] = server.server_address[1]
+            except Exception:
+                return None
+        return held_server["port"]
+
+    def said_of(req, name):
+        return [v for k, v in req.get("reply_headers") or [] if k == name]
+
+    def body_of(req):
+        return b"".join(req["chunks"]).decode("utf-8", "replace")[:limit]
+
+    def reply_of(req):
+        return unpacked(b"".join(req["reply"]), (said_of(req, "content-encoding") or [""])[0])[:limit]
+
+    def row_of(req):
+        row = {"at": req["at"], "ms": (req.get("ended") or int(time.time() * 1000)) - req["at"], "method": req["method"], "path": req["path"],
+               "body": body_of(req), "status": int(req.get("status") or 0), "type": (said_of(req, "content-type") or [""])[0], "writes": req["writes"],
+               "reply": reply_of(req)}
+        cookies = [c.split(";")[0].split("=")[0].strip() for c in said_of(req, "set-cookie")][:20]
+        if cookies:
+            row["cookies"] = cookies
+        # The app began its reply and it never finished, so the row holds part of it. Either side may
+        # have closed it (a client that stopped reading, an app that broke off mid-stream), so nothing
+        # downstream says which.
+        if req.get("status") and not req.get("finished"):
+            row["cut"] = True
+        return row
+
+    # An answer that came on a second request is written as that request's row under the id of the
+    # request that asked, with the requests of its turn in `after` (the one that asked last) and the
+    # headers they were sent with: one line, so a reader never sees half a turn.
+    def answered(req, steps=()):
+        asker = steps[-1] if steps else req
+        if not asker.get("kept") or asker.get("written"):
             return
-        said.add(key)
-        write({"at": int(time.time() * 1000), "method": req["method"], "path": req["path"], "headers": req["headers"],
-               "body": b"".join(req["chunks"]).decode("utf-8", "replace")[:limit], "sent": text(body)})
+        asker["written"] = True
+        headers = {}
+        for step in steps:
+            headers.update(step["headers"])
+        row = {"ex": asker["id"], **row_of(req), "headers": {**headers, **req["headers"]}, "sent": asker["sent"]}
+        if steps:
+            row["after"] = [row_of(step) for step in steps]
+        turn = req.get("turn") or asker.get("turn")
+        if turn:
+            row["turn"] = turn
+        write(row)
+
+    # A request answered later by its model is written once its calls have gone quiet, marked
+    # `later`, in the time its model took to answer it; a run's turn also gets the model's last words,
+    # the answer the command hands the run. Only an answer settles it: a call that came back 2xx with
+    # no words (a model asking for a tool) is a step, and the next call is waited for (lib/trace.cjs).
+    # ponytail: a fixed settle; after a step that answers in words, more than this of the app's own
+    # work before the next call cuts the answer at that step. A call whose words match only a request
+    # already settled is the evidence: a settle measured per door when one is seen.
+    settle_s = 5.0
+
+    # The turn's answer is written once the calls are quiet even while a read the hook took for a fetch
+    # of it is open (the person's page polling the sender): the answer is the model's words either way.
+    # The exchange is written as answered later only when no fetch came to complete it (tied.settled).
+    def answered_later(req):
+        status, words, at = req["said"]
+        if req.get("turn") and not req.get("turn_answered"):
+            req["turn_answered"] = True
+            write({"answer": {"ex": req["id"], "turn": req["turn"], "status": status, "reply": words}})
+        if tied.settled(req) and req.get("kept"):
+            row = {"ex": req["id"], **row_of(req), "ms": at - req["at"], "later": True, "headers": req["headers"], "sent": req["sent"]}
+            if req.get("turn"):
+                row["turn"] = req["turn"]
+            write(row)
+
+    def settle(req):
+        import threading
+
+        def quiet():
+            try:
+                if not req.get("calls_open") and not req.get("waiting"):
+                    answered_later(req)
+            except Exception:
+                pass
+        was = req.get("settling")
+        if was:
+            was.cancel()
+        said = req.get("said")
+        if not said or (not said[1] and 200 <= said[0] < 300):
+            return
+        req["settling"] = threading.Timer(settle_s, quiet)
+        req["settling"].daemon = True
+        req["settling"].start()
+
+    # Where the app's own code wrote the parts of this reply, under the id its exchange is written by.
+    def written_at(req, steps):
+        asker = steps[-1] if steps else req
+        turn = req.get("turn") or asker.get("turn")
+        if req.get("sites") and (asker.get("kept") or turn):
+            write({"sites": {"ex": asker["id"], **({"turn": turn} if turn else {}), "list": req["sites"]}})
+
+    def ended(req):
+        req["ended"] = int(time.time() * 1000)
+        hear(req)
+        steps = tied.closed(req) if tied else None
+        written_at(req, steps)
+        if steps:
+            answered(req, steps)
+        elif req.get("late"):
+            settle(req)
+        elif not req.get("calls_open"):
+            answered(req)
+        # A message taken and answered at once with no model call inside it (lib/wire.cjs `receipt`).
+        status = int(req.get("status") or 0)
+        if not req.get("noted") and not steps and req["method"] != "GET" and 200 <= status < 300 and tied and tied.sentences(req):
+            receipt = {"ex": req["id"], "at": req["at"], "ms": req["ended"] - req["at"], "method": req["method"], "path": req["path"], "status": status}
+            if req.get("turn"):
+                receipt["turn"] = req["turn"]
+            write({"receipt": receipt})
+
+    try:
+        from cortad_tied import Tied
+        tied = Tied(norm, body_of, reply_of)
+    except Exception:
+        tied = None
 
     # The meter: one row per model call your app makes, with the provider's own token counts and
     # never the reply's text.
@@ -863,7 +1600,31 @@ def _install():
             if isinstance(part, dict):
                 usage.update(part)
             model = e.get("model") or msg.get("model") or resp.get("model") or e.get("modelVersion") or model
-        return tokens_of(usage or None), model, events
+        return tokens_of(usage or None), model, events, usage
+
+    # The model stopped because it reached the output cap its request set, in each provider's words: its
+    # answer is cut short or, for a reasoning model, may never have been written.
+    def stopped_at_limit(e):
+        if not isinstance(e, dict):
+            return False
+        r = e["response"] if isinstance(e.get("response"), dict) else e
+        delta = e["delta"] if isinstance(e.get("delta"), dict) else {}
+        choices = e["choices"] if isinstance(e.get("choices"), list) else []
+        candidates = e["candidates"] if isinstance(e.get("candidates"), list) else []
+        return (any(isinstance(c, dict) and c.get("finish_reason") == "length" for c in choices)
+                or (r.get("status") == "incomplete" and (r.get("incomplete_details") or {}).get("reason") == "max_output_tokens")
+                or "max_tokens" in (e.get("stop_reason"), delta.get("stop_reason"), e.get("stopReason"))
+                or any(isinstance(c, dict) and c.get("finishReason") == "MAX_TOKENS" for c in candidates))
+
+    def reasoning_of(u):
+        return number((u.get("output_tokens_details") or {}).get("reasoning_tokens") or (u.get("completion_tokens_details") or {}).get("reasoning_tokens") or u.get("thoughtsTokenCount"))
+
+    # The output cap the app's request set, in each provider's field.
+    def cap_of(b):
+        if not isinstance(b, dict):
+            return None
+        return (number(b.get("max_tokens")) or number(b.get("max_completion_tokens")) or number(b.get("max_output_tokens"))
+                or number((b.get("generationConfig") or {}).get("maxOutputTokens")) or number((b.get("inferenceConfig") or {}).get("maxTokens")) or None)
 
     def asked_for(url, sent):
         body = parsed(sent) if isinstance(sent, str) else None
@@ -890,16 +1651,29 @@ def _install():
     # ran by it, where the read could only name the door. Its frames on this stack outside installed
     # packages, then, when the call runs in a task another task awaits (LangChain runs each step of a
     # chain as its own task), the awaiting task's. Relative to the folder the app was started in.
+    # Five lines: a provider class's stream, post and retry can be three lines of one file, and the
+    # line that says which path ran is past them.
     root = os.getcwd().replace(os.sep, "/").rstrip("/") + "/"
+    callers_max = 5
     installed = re.compile(r"/(?:site-packages|dist-packages|\.venv|venv|__pypackages__)/|/lib/python\d")
 
-    def ours(frame, out):
+    def own_at(frame):
         f = frame.f_code.co_filename.replace(os.sep, "/")
         if f.startswith(root) and not installed.search(f[len(root) - 1:]):
-            at = "%s:%d" % (f[len(root):], frame.f_lineno)
-            if at not in out:
-                out.append(at)
-        return len(out) >= 3
+            return "%s:%d" % (f[len(root):], frame.f_lineno)
+        return None
+
+    def ours(frame, out):
+        at = own_at(frame)
+        if at and at not in out:
+            out.append(at)
+        return len(out) >= callers_max
+
+    try:
+        from cortad_sites import Sites
+        sites = Sites(own_at)
+    except Exception:
+        sites = None
 
     # The task that waits on this one: its wake-up is among this one's callbacks, directly, or behind
     # the future an asyncio.gather callback closes over.
@@ -920,7 +1694,7 @@ def _install():
         return None
 
     # An embedding call answers nobody, so where it was made names no path a reply came down.
-    embedding = re.compile(r"/embeddings$", re.I)
+    embedding = re.compile(r"/(?:embeddings|embedding-model)$", re.I)
 
     def callers_now(url):
         if embedding.search(urlsplit(str(url)).path or ""):
@@ -955,24 +1729,39 @@ def _install():
             pass
         return out or None
 
-    def meter(url, sent, status, kind, raw, turn=None, caller=None):
+    def meter(url, sent, status, kind, raw, req=None, caller=None, t0=None):
         try:
-            tokens, model, events = read_reply(kind, (raw or "")[:reply_max])
+            tokens, model, events, usage = read_reply(kind, (raw or "")[:reply_max])
             parts = urlsplit(str(url))
-            row = {"at": int(time.time() * 1000), "host": parts.netloc.replace(":443", ""), "model": str(asked_for(url, sent) or model or "")[:160],
+            now = int(time.time() * 1000)
+            row = {"at": now, "ms": now - int(t0 * 1000) if t0 else 0, "host": parts.netloc.replace(":443", ""), "model": str(asked_for(url, sent) or model or "")[:160],
                    "status": int(status or 0), "usage": tokens is not None}
+            # The model that answered, when a gateway or proxy answered with another than the one asked
+            # for (a dated version of the same model is the same model).
+            asked_model = str(asked_for(url, sent) or "")
+            if model and asked_model and str(model) not in asked_model and asked_model not in str(model):
+                row["answered"] = str(model)[:160]
             row.update(tokens or {"promptTokens": 0, "cachedTokens": 0, "completionTokens": 0})
-            turn = turn or turn_now()
-            if turn:
-                row["turn"] = turn
+            if embedding.search(parts.path or ""):
+                row["embedding"] = True
+            if tied:
+                tied.done(req)
+                if req and req.get("late"):
+                    if not row.get("embedding"):
+                        req["said"] = (row["status"], reply_text(events)[:model_words], now)
+                    settle(req)
+            row.update(inside_of(req))
+            if req and (req.get("kept") or req.get("turn")):
+                row["reply"] = reply_text(events)[:model_words]
             as_text = sent if isinstance(sent, str) else text(sent)
             found = rules_in(as_text)
             if found is not None:
                 row["rules"] = found
-            tools = tools_in(as_text)
+            provided_calls, provided = provider_in(as_text, events)
+            tools = (tools_in(as_text) or []) + provided
             if tools:
                 row["tools"] = tools
-            called = called_in(as_text, events)
+            called = called_in(as_text, events, provided_calls)
             if called:
                 row["called"] = called
             passages = passages_in(as_text)
@@ -980,6 +1769,11 @@ def _install():
                 row["passages"] = passages
             if caller:
                 row["caller"] = caller
+            asked = parsed(as_text)
+            if any(stopped_at_limit(e) for e in events):
+                row["limit"] = {"cap": cap_of(asked), "reasoning": reasoning_of(usage)}
+            if isinstance(asked, dict) and not row.get("embedding"):
+                row.update(told_of(asked, req))
             write({"call": row})
         except Exception:
             pass
@@ -1030,7 +1824,7 @@ def _install():
         kind = "list of %d" % len(v) if isinstance(v, (list, tuple)) else "object" if isinstance(v, dict) or hasattr(v, "model_dump") else "value"
         return "%s: %s" % (kind, json.dumps(clipped(plain_of(v), 0, tool_text), ensure_ascii=False, separators=(",", ":")))
 
-    def tool_row(name, sig, a, k, value, error, turn):
+    def tool_row(name, sig, a, k, value, error, req):
         try:
             try:
                 named = dict(sig.bind_partial(*a, **k).arguments) if sig else None
@@ -1041,9 +1835,8 @@ def _install():
             text = "raised %s: %s" % (type(error).__name__, error) if error is not None else returned(value)
             row = {"at": int(time.time() * 1000), "host": "in-app", "status": 200,
                    "called": [{"name": name, "arguments": args_text(plain_of(named))}],
-                   "tools": [{"name": name, "text": str(text)[:tool_text]}]}
-            if turn:
-                row["turn"] = turn
+                   "tools": [tool_text_row(name, str(text))]}
+            row.update(inside_of(req))
             write({"dep": row})
         except Exception:
             pass
@@ -1057,23 +1850,23 @@ def _install():
             sig = None
         if inspect.iscoroutinefunction(fn):
             async def wrapped(*a, **k):
-                turn = turn_now()
+                req = ctx.get()
                 try:
                     out = await fn(*a, **k)
                 except Exception as e:
-                    tool_row(name, sig, a, k, None, e, turn)
+                    tool_row(name, sig, a, k, None, e, req)
                     raise
-                tool_row(name, sig, a, k, out, None, turn)
+                tool_row(name, sig, a, k, out, None, req)
                 return out
         else:
             def wrapped(*a, **k):
-                turn = turn_now()
+                req = ctx.get()
                 try:
                     out = fn(*a, **k)
                 except Exception as e:
-                    tool_row(name, sig, a, k, None, e, turn)
+                    tool_row(name, sig, a, k, None, e, req)
                     raise
-                tool_row(name, sig, a, k, out, None, turn)
+                tool_row(name, sig, a, k, out, None, req)
                 return out
         functools.update_wrapper(wrapped, fn)
         wrapped.__cortad_tool__ = fn
@@ -1158,27 +1951,44 @@ def _install():
                         if hit is not None and hit[0] is vv:
                             v[kk] = hit[1]
 
+    serial = itertools.count(1)
+
     def started(method, path, headers):
         try:
             sweep_tools()
         except Exception:
             pass
         turn = headers.pop("x-cortad-turn", None)
-        return {"method": method, "path": path, "headers": headers, "chunks": [], "size": 0, "noted": False,
-                "turn": turn if isinstance(turn, str) and turn_ok.match(turn) else None}
+        req = {"id": "%d.%d" % (os.getpid(), next(serial)), "at": int(time.time() * 1000), "method": method, "path": path, "headers": headers,
+               "chunks": [], "size": 0, "noted": False, "kept": False, "sent": [], "reply": [], "reply_size": 0, "writes": 0,
+               "turn": turn if isinstance(turn, str) and turn_ok.match(turn) else None}
+        if req["turn"]:
+            run_seen["at"] = time.monotonic()
+        if tied:
+            tied.opened(req)
+        return req
 
     def keep(req, chunk):
         if chunk and req["size"] < limit:
             req["chunks"].append(bytes(chunk))
             req["size"] += len(chunk)
 
-    # Inbound, ASGI: FastAPI, Starlette, Django under uvicorn, Quart, Litestar.
+    # What the app sends back, as it sends it.
+    def replied(req, chunk):
+        if chunk:
+            req["writes"] += 1
+            if req["reply_size"] < limit:
+                req["reply"].append(bytes(chunk))
+                req["reply_size"] += len(chunk)
+
+    # Inbound, ASGI: FastAPI, Starlette, Django under uvicorn, Quart, Litestar. A GET is watched but
+    # never made the context a model call is pinned by: it can only be the step an answer comes on.
     class Asgi:
         def __init__(self, app):
             self.app = app
 
         async def __call__(self, scope, receive, send):
-            if scope.get("type") != "http" or scope.get("method") in ("GET", "HEAD", "OPTIONS"):
+            if scope.get("type") != "http" or scope.get("method") in ("HEAD", "OPTIONS"):
                 return await self.app(scope, receive, send)
             query = scope.get("query_string") or b""
             req = started(scope["method"], scope.get("path", "/") + ("?" + query.decode("latin-1") if query else ""),
@@ -1190,11 +2000,30 @@ def _install():
                     keep(req, message.get("body") or b"")
                 return message
 
-            token = ctx.set(req)
+            async def sending(message):
+                try:
+                    if message.get("type") == "http.response.start":
+                        req["status"] = message.get("status") or 0
+                        req["reply_headers"] = [(k.decode("latin-1").lower(), v.decode("latin-1")) for k, v in message.get("headers") or []]
+                    elif message.get("type") == "http.response.body":
+                        replied(req, message.get("body") or b"")
+                        req["finished"] = not message.get("more_body")
+                        if req["finished"] and tied:
+                            tied.replied(req, req.get("status"), lambda: reply_of(req))
+                        if sites and not req.get("placed"):
+                            sites.sent(req, message, sys._getframe(1), Asgi.__call__.__code__)
+                except Exception:
+                    pass
+                return await send(message)
+
+            asks = scope["method"] != "GET"
+            token = ctx.set(req) if asks else None
             try:
-                return await self.app(scope, seen, send)
+                return await self.app(scope, seen if asks else receive, sending)
             finally:
-                ctx.reset(token)
+                if token is not None:
+                    ctx.reset(token)
+                ended(req)
 
     # Inbound, WSGI: Flask, Django's runserver, anything under werkzeug.
     class Tee:
@@ -1211,6 +2040,20 @@ def _install():
             keep(self.req, chunk)
             return chunk
 
+        # Werkzeug 3 reads the body into its own buffer when the stream can: without this the read went
+        # past the tee, and every Flask request was written down with an empty body.
+        def readinto(self, b):
+            n = self.stream.readinto(b)
+            if n:
+                keep(self.req, bytes(memoryview(b)[:n]))
+            return n
+
+        def readlines(self, *a):
+            lines = self.stream.readlines(*a)
+            for line in lines:
+                keep(self.req, line)
+            return lines
+
         def __iter__(self):
             for chunk in self.stream:
                 keep(self.req, chunk)
@@ -1219,23 +2062,34 @@ def _install():
         def __getattr__(self, name):
             return getattr(self.stream, name)
 
-    def inside(req, iterable):
+    def inside(req, iterable, asks):
         # A streamed reply is produced after the handler returns: the model call happens here.
         it = iter(iterable)
         try:
             while True:
-                token = ctx.set(req)
+                token = ctx.set(req) if asks else None
                 try:
                     item = next(it)
                 except StopIteration:
+                    req["finished"] = True
+                    if tied:
+                        tied.replied(req, req.get("status"), lambda: reply_of(req))
                     return
                 finally:
-                    ctx.reset(token)
+                    if token is not None:
+                        ctx.reset(token)
+                replied(req, item)
+                if sites:
+                    try:
+                        sites.iterated(req, iterable, item)
+                    except Exception:
+                        pass
                 yield item
         finally:
             close = getattr(iterable, "close", None)
             if close:
                 close()
+            ended(req)
 
     def wsgi(app):
         if getattr(app, "_brainsless", False):
@@ -1243,7 +2097,7 @@ def _install():
 
         def wrapped(environ, start_response):
             method = environ.get("REQUEST_METHOD", "GET")
-            if method in ("GET", "HEAD", "OPTIONS"):
+            if method in ("HEAD", "OPTIONS"):
                 return app(environ, start_response)
             headers = {k[5:].replace("_", "-").lower(): v for k, v in environ.items() if k.startswith("HTTP_")}
             if environ.get("CONTENT_TYPE"):
@@ -1252,11 +2106,26 @@ def _install():
             req = started(method, (environ.get("SCRIPT_NAME", "") + environ.get("PATH_INFO", "/")) + ("?" + query if query else ""), headers)
             if environ.get("wsgi.input") is not None:
                 environ["wsgi.input"] = Tee(environ["wsgi.input"], req)
-            token = ctx.set(req)
+
+            def starting(status, response_headers, *a):
+                try:
+                    req["status"] = int(str(status).split(" ", 1)[0])
+                    req["reply_headers"] = [(str(k).lower(), str(v)) for k, v in response_headers]
+                except Exception:
+                    pass
+                return start_response(status, response_headers, *a)
+
+            asks = method != "GET"
+            token = ctx.set(req) if asks else None
             try:
-                return inside(req, app(environ, start_response))
+                out = app(environ, starting)
+            except BaseException:
+                ended(req)
+                raise
             finally:
-                ctx.reset(token)
+                if token is not None:
+                    ctx.reset(token)
+            return inside(req, out, asks)
 
         wrapped._brainsless = True
         return wrapped
@@ -1482,7 +2351,7 @@ def _install():
 
     def sent_of(request):
         try:
-            return text(request.content)
+            return text(request.content, reply_max)
         except Exception:
             return ""
 
@@ -1527,7 +2396,7 @@ def _install():
                 finally:
                     self.finish()
 
-        def watch(request, response, sent, caller):
+        def watch(request, response, sent, caller, t0, req):
             model = is_model_call(request.url)
             if not model and not is_retrieval(request.url):
                 dep(request.url, response.status_code)
@@ -1535,67 +2404,78 @@ def _install():
             kind = response.headers.get("content-type", "")
             if getattr(response, "_content", None) is not None:
                 if model:
-                    meter(request.url, sent, response.status_code, kind, response.content.decode("utf-8", "replace"), caller=caller)
+                    meter(request.url, sent, response.status_code, kind, response.content.decode("utf-8", "replace"), req, caller, t0)
                 else:
-                    dep(request.url, response.status_code, passages=passages_from(response.content.decode("utf-8", "replace")))
+                    dep(request.url, response.status_code, passages=passages_from(response.content.decode("utf-8", "replace")), caller=caller)
                 return response
-            turn = turn_now()
             if model:
-                done = lambda raw: meter(request.url, sent, response.status_code, kind, unpacked(raw, response.headers.get("content-encoding")), turn, caller)
+                done = lambda raw: meter(request.url, sent, response.status_code, kind, unpacked(raw, response.headers.get("content-encoding")), req, caller, t0)
             else:
-                done = lambda raw: dep(request.url, response.status_code, passages=passages_from(unpacked(raw, response.headers.get("content-encoding"))), turn=turn)
+                done = lambda raw: dep(request.url, response.status_code, passages=passages_from(unpacked(raw, response.headers.get("content-encoding"))), req=req, caller=caller)
             stream = response.stream
             if hasattr(stream, "__aiter__") and hasattr(stream, "aclose"):
                 response.stream = AsyncKept(stream, done)
             elif hasattr(stream, "__iter__"):
                 response.stream = SyncKept(stream, done)
             elif model:
-                meter(request.url, sent, response.status_code, kind, "", caller=caller)
+                meter(request.url, sent, response.status_code, kind, "", req, caller, t0)
             else:
-                dep(request.url, response.status_code)
+                dep(request.url, response.status_code, req=req, caller=caller)
             return response
 
+        # A held call that cannot be answered fails in the app; it is never sent instead.
+        def held_httpx(request, sent):
+            if not held_here(request.url, request.method, lambda: keys_in(request.headers)) or reads_only(sent):
+                return None
+            kind = request.headers.get("content-type", "")
+            held_row(request.url, request.method, sent, kind, ctx.get())
+            return module.Response(200, headers={"content-type": "application/json"}, content=held_reply(sent, kind), request=request)
+
         for cls in (module.Client, module.AsyncClient):
             send = cls.send
             if cls is module.Client:
                 def sync_send(self, request, *a, _send=send, **k):
                     sent = sent_of(request)
-                    caller = callers_now(request.url) if is_model_call(request.url) else None
-                    try:
-                        note(request.url, sent)
-                    except Exception:
-                        pass
+                    held = held_httpx(request, sent)
+                    if held is not None:
+                        return held
+                    caller = callers_now(request.url) if is_model_call(request.url) or is_retrieval(request.url) else None
+                    t0 = time.time()
+                    req = noted(request.url, sent)
                     try:
                         response = _send(self, request, *a, **k)
+                        answered_call(request.url, req)
                     except Exception as err:
                         if is_model_call(request.url):
-                            meter(request.url, sent, 0, "", "", caller=caller)
+                            meter(request.url, sent, 0, "", "", req, caller, t0)
                         else:
-                            dep(request.url, 0, type(err).__name__)
+                            dep(request.url, 0, type(err).__name__, caller=caller)
                         raise
                     try:
-                        return watch(request, response, sent, caller)
+                        return watch(request, response, sent, caller, t0, req)
                     except Exception:
                         return response
                 cls.send = sync_send
             else:
                 async def async_send(self, request, *a, _send=send, **k):
                     sent = sent_of(request)
-                    caller = callers_now(request.url) if is_model_call(request.url) else None
-                    try:
-                        note(request.url, sent)
-                    except Exception:
-                        pass
+                    held = held_httpx(request, sent)
+                    if held is not None:
+                        return held
+                    caller = callers_now(request.url) if is_model_call(request.url) or is_retrieval(request.url) else None
+                    t0 = time.time()
+                    req = noted(request.url, sent)
                     try:
                         response = await _send(self, request, *a, **k)
+                        answered_call(request.url, req)
                     except Exception as err:
                         if is_model_call(request.url):
-                            meter(request.url, sent, 0, "", "", caller=caller)
+                            meter(request.url, sent, 0, "", "", req, caller, t0)
                         else:
-                            dep(request.url, 0, type(err).__name__)
+                            dep(request.url, 0, type(err).__name__, caller=caller)
                         raise
                     try:
-                        return watch(request, response, sent, caller)
+                        return watch(request, response, sent, caller, t0, req)
                     except Exception:
                         return response
                 cls.send = async_send
@@ -1603,26 +2483,47 @@ def _install():
     def patch_requests(module):
         send = module.Session.send
 
+        # A held call that cannot be answered fails in the app; it is never sent instead.
+        def held(request):
+            if not held_here(request.url, request.method, lambda: keys_in(request.headers)):
+                return None
+            raw = text(request.body, reply_max)
+            if reads_only(raw):
+                return None
+            import datetime
+            models, structures = sys.modules["requests.models"], sys.modules["requests.structures"]
+            kind = request.headers.get("content-type", "")
+            held_row(request.url, request.method, raw, kind, ctx.get())
+            response = models.Response()
+            response.status_code, response.reason, response.url, response.request, response.encoding = 200, "OK", request.url, request, "utf-8"
+            response.headers = structures.CaseInsensitiveDict({"content-type": "application/json"})
+            response._content, response._content_consumed, response.elapsed = held_reply(raw, kind), True, datetime.timedelta(0)
+            return response
+
         def sent(self, request, *a, **k):
-            caller = callers_now(request.url) if is_model_call(request.url) else None
-            try:
-                note(request.url, request.body)
-            except Exception:
-                pass
+            answered = held(request)
+            if answered is not None:
+                return answered
+            caller = callers_now(request.url) if is_model_call(request.url) or is_retrieval(request.url) else None
+            t0 = time.time()
+            req = noted(request.url, request.body)
             try:
                 response = send(self, request, *a, **k)
+                answered_call(request.url, req)
             except Exception as err:
-                if not is_model_call(request.url):
-                    dep(request.url, 0, type(err).__name__)
+                if is_model_call(request.url):
+                    meter(request.url, text(request.body, reply_max), 0, "", "", req, caller, t0)
+                else:
+                    dep(request.url, 0, type(err).__name__, caller=caller)
                 raise
             try:
                 if not is_model_call(request.url):
                     read = is_retrieval(request.url) and not k.get("stream")
-                    dep(request.url, response.status_code, passages=passages_from(response.content.decode("utf-8", "replace")) if read else None)
+                    dep(request.url, response.status_code, passages=passages_from(response.content.decode("utf-8", "replace")) if read else None, caller=caller)
                 if is_model_call(request.url):
                     # A streamed reply is counted as a call whose counts were not read.
                     raw = response.content.decode("utf-8", "replace") if getattr(response, "_content_consumed", False) else ""
-                    meter(request.url, text(request.body), response.status_code, response.headers.get("content-type", ""), raw, caller=caller)
+                    meter(request.url, text(request.body, reply_max), response.status_code, response.headers.get("content-type", ""), raw, req, caller, t0)
             except Exception:
                 pass
             return response
@@ -1632,22 +2533,55 @@ def _install():
     def patch_aiohttp(module):
         request = module.ClientSession._request
 
-        async def requested(self, method, str_or_url, *a, **k):
-            body = k.get("json") if k.get("json") is not None else k.get("data")
+        def keys_of(self, k):
+            given = {str(n).lower(): v for n, v in dict(k.get("headers") or {}).items()}
+            defaults = {str(n).lower(): v for n, v in dict(getattr(self, "_default_headers", None) or {}).items()}
+            basic = k.get("auth") or getattr(self, "_default_auth", None)
+            return [given.get(n) or defaults.get(n) for n in key_headers] + [basic.encode() if basic else None]
+
+        # A path relative to the session's base address is decided on the whole address.
+        def whole(self, str_or_url):
             try:
-                note(str_or_url, body)
+                return str(self._build_url(str_or_url))
             except Exception:
-                pass
+                return str(str_or_url)
+
+        async def requested(self, method, str_or_url, *a, **k):
+            body = k.get("json") if k.get("json") is not None else k.get("data")
+            url = whole(self, str_or_url)
+            if held_here(url, method, lambda: keys_of(self, k)) and not reads_only(text(body, reply_max)):
+                port = held_port()
+                if port is None:
+                    raise module.ClientConnectionError("this write was kept from leaving and could not be answered")
+                parts = urlsplit(url)
+                n = str(next(held_sent))
+                held_waiting[n] = (url, method, ctx.get())
+                k = {**k, "headers": {**dict(k.get("headers") or {}), "x-cortad-held": n}}
+                target = "http://127.0.0.1:%d%s%s" % (port, parts.path or "/", "?" + parts.query if parts.query else "")
+                if getattr(self, "_base_url", None) is None:
+                    return await request(self, method, target, *a, **k)
+                # A session with a base address refuses a whole one on older aiohttp: the held call is
+                # answered through a session of its own, read before that session closes.
+                async with module.ClientSession() as own:
+                    answered = await request(own, method, target, *a, **k)
+                    await answered.read()
+                return answered
+            caller = callers_now(str_or_url) if is_model_call(str_or_url) or is_retrieval(str_or_url) else None
+            t0 = time.time()
+            req = noted(str_or_url, body)
             try:
                 response = await request(self, method, str_or_url, *a, **k)
+                answered_call(str_or_url, req)
             except Exception as err:
-                if not is_model_call(str_or_url):
-                    dep(str_or_url, 0, type(err).__name__)
+                if is_model_call(str_or_url):
+                    meter(str_or_url, text(body, reply_max), 0, "", "", req, caller, t0)
+                else:
+                    dep(str_or_url, 0, type(err).__name__, caller=caller)
                 raise
             if is_model_call(str_or_url):
-                response._cortad = (str_or_url, text(body), turn_now(), callers_now(str_or_url))
+                response._cortad = (str_or_url, text(body, reply_max), req, caller, t0)
             elif is_retrieval(str_or_url):
-                response._cortad_dep = (str_or_url, turn_now())
+                response._cortad_dep = (str_or_url, ctx.get(), caller)
             else:
                 dep(str_or_url, response.status)
             return response
@@ -1660,29 +2594,53 @@ def _install():
             store = getattr(self, "_cortad_dep", None)
             if store:
                 self._cortad_dep = None
-                dep(store[0], self.status, passages=passages_from((raw or b"").decode("utf-8", "replace")), turn=store[1])
+                dep(store[0], self.status, passages=passages_from((raw or b"").decode("utf-8", "replace")), req=store[1], caller=store[2])
             call = getattr(self, "_cortad", None)
             if call:
                 self._cortad = None
-                meter(call[0], call[1], self.status, self.headers.get("content-type", ""), (raw or b"").decode("utf-8", "replace"), call[2], call[3])
+                meter(call[0], call[1], self.status, self.headers.get("content-type", ""), (raw or b"").decode("utf-8", "replace"), *call[2:])
             return raw
 
         def release_kept(self, *a, **k):
             store = getattr(self, "_cortad_dep", None)
             if store:
                 self._cortad_dep = None
-                dep(store[0], self.status, turn=store[1])
+                dep(store[0], self.status, req=store[1], caller=store[2])
             call = getattr(self, "_cortad", None)
             if call:
                 self._cortad = None
-                meter(call[0], call[1], self.status, self.headers.get("content-type", ""), "", call[2], call[3])
+                meter(call[0], call[1], self.status, self.headers.get("content-type", ""), "", *call[2:])
             return release(self, *a, **k)
 
         module.ClientSession._request = requested
         module.ClientResponse.read = read_kept
         module.ClientResponse.release = release_kept
 
-    exact = {"uvicorn.config": patch_uvicorn, "werkzeug.serving": patch_werkzeug, "django.core.handlers.wsgi": patch_django,
+    # Starlette's streamed response, placed as it sends: behind an HTTP middleware the reply reaches the
+    # server's send on a task of its own, read off a stream this response writes into, by which time
+    # the app's generator has moved on to the next chunk.
+    def patch_starlette_responses(module):
+        call = module.StreamingResponse.__call__
+
+        async def called(self, scope, receive, send):
+            req = ctx.get()
+            if not (sites and req):
+                return await call(self, scope, receive, send)
+            req["placed"] = True
+
+            async def sending(message):
+                if message.get("type") == "http.response.body":
+                    try:
+                        sites.made(req, self.body_iterator, message.get("body") or b"")
+                    except Exception:
+                        pass
+                return await send(message)
+
+            return await call(self, scope, receive, sending)
+
+        module.StreamingResponse.__call__ = called
+
+    exact = {"uvicorn.config": patch_uvicorn, "starlette.responses": patch_starlette_responses, "werkzeug.serving": patch_werkzeug, "django.core.handlers.wsgi": patch_django,
              "django.core.servers.basehttp": patch_django_server, "gunicorn.workers.base": patch_gunicorn,
              "hypercorn.asyncio.run": patch_hypercorn, "hypercorn.trio.run": patch_hypercorn, "aiohttp.web": patch_aiohttp_web,
              "requests.sessions": patch_requests, "aiohttp.client": patch_aiohttp}
@@ -1733,11 +2691,62 @@ def _install():
     write({"hello": "python", "pid": os.getpid()})
 
 
+# Every server the app opens a connection to, once each, by host and port only: a database named in
+# a config file rather than in the environment is seen the first time the app reaches it. A socket
+# connects to an address, so the name a client asked for is read where it is resolved. A driver
+# written in C (psycopg, mysqlclient) opens its own sockets and is not seen here.
+def _install_connects():
+    import json
+    import socket
+
+    seen = set()
+    real_connect, real_connect_ex = socket.socket.connect, socket.socket.connect_ex
+    real_getaddrinfo = socket.getaddrinfo
+
+    def note(address):
+        try:
+            if not isinstance(address, tuple) or len(address) < 2 or len(seen) >= 64:
+                return
+            host, port = str(address[0]).lower()[:253], int(address[1])
+            if (host, port) in seen or port in _held_ports:
+                return
+            seen.add((host, port))
+            fd = os.open(_FILE, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
+            with os.fdopen(fd, "a", encoding="utf-8") as f:
+                f.write(json.dumps({"conn": {"host": host, "port": port}}) + "\n")
+        except Exception:
+            pass
+
+    def connect(self, address):
+        note(address)
+        return real_connect(self, address)
+
+    def connect_ex(self, address):
+        note(address)
+        return real_connect_ex(self, address)
+
+    def getaddrinfo(host, port, *args, **kwargs):
+        if isinstance(host, (str, bytes)) and port is not None:
+            try:
+                note((host.decode() if isinstance(host, bytes) else host, int(port)))
+            except (TypeError, ValueError):
+                pass
+        return real_getaddrinfo(host, port, *args, **kwargs)
+
+    socket.socket.connect = connect
+    socket.socket.connect_ex = connect_ex
+    socket.getaddrinfo = getaddrinfo
+
+
 if _FILE:
     try:
         _install()
     except Exception:
         pass
+    try:
+        _install_connects()
+    except Exception:
+        pass
     if _WRITES and _APP_ROOT:
         try:
             _install_writes()