cortad 0.3.8 → 0.3.9

package/lib/auto-reach.mjs

@@ -19,15 +19,53 @@ const keyOf = (m) => `${m.method} ${m.path}`;
 // `asked()`: true once the agent's ask waits, so a round stops between two sends to take it.
 // `report(answers)`: what each test request met, for the server (POST /local/:box/reached). Each round
 // opens with an empty list, which says this command sends them, so status stops asking the agent to;
-// the caller posts it once per connection.
-export function makeAutoReach({ status, runner, waiting, origin, signIn, stampOf, asked = () => false, report = async () => {}, say, fetchImpl = fetch }) {
+// the caller posts it once per connection. Each answer is reported as it lands: reported only when
+// its round ended, one endpoint that took 55 seconds held every faster one's answer back with it.
+// `report` answering false, or failing, leaves its answers kept here and said again later: the server
+// hears them late, and the app is never asked again for the sake of a report that did not arrive.
+// What is kept is each endpoint's latest answer, so it is never more than the endpoints the app has
+// and nothing is dropped to make room. One report is out at a time; the first that fails stops the
+// rest, and the next is tried RETRY_MS later, twice as long after each failure up to RETRY_MAX_MS:
+// 250 answers behind a server that was not answering were 250 reports of 15 seconds each, one after
+// the other, and the fifty oldest were thrown away with their endpoints already marked as tested.
+// `roundMs`: past it a round starts no further request; the rows left are sent in the next round. It
+// bounds what a round starts, not a request already out (REACH_MS each) nor the connection as a whole.
+export const ROUND_MS = 90_000;
+const RETRY_MS = 5_000;
+const RETRY_MAX_MS = 60_000;
+const BATCH = 100;
+export function makeAutoReach({ status, runner, waiting, origin, signIn, stampOf, asked = () => false, report = async () => {}, say, fetchImpl = fetch, roundMs = ROUND_MS, now = Date.now }) {
   const sent = new Map();
   let n = 0;
   const next = () => ++n;
+  const kept = new Map();
+  let draining = null, retryAt = 0, backoff = 0;
+  const drain = async () => {
+    while (kept.size && now() >= retryAt) {
+      const batch = [...kept.values()].slice(0, BATCH);
+      const ok = await Promise.resolve().then(() => report(batch)).then((r) => r !== false, () => false);
+      if (!ok) {
+        // Said once per outage, so a card that is not moving has its reason in the terminal.
+        if (!backoff) say(`Cortad did not take what ${kept.size === 1 ? "1 test request" : `${kept.size} test requests`} met. They are kept here and sent again; your app is not asked again.`);
+        backoff = Math.min(backoff ? backoff * 2 : RETRY_MS, RETRY_MAX_MS);
+        retryAt = now() + backoff;
+        return;
+      }
+      backoff = 0;
+      // An endpoint answered again while its last answer was out keeps the newer one.
+      for (const a of batch) if (kept.get(a.door) === a) kept.delete(a.door);
+    }
+  };
+  const tell = (met = []) => {
+    for (const a of met) kept.set(a.door, a);
+    draining ??= drain().finally(() => { draining = null; });
+    return draining;
+  };
   // `ask`: the agent's call, { paths }: sent whatever was sent before, and answered with each line.
   // `wait`: when to look again: soon while the code is still being read, rarely once it is.
   return async function round(ask = null) {
-    await report([]).catch(() => {});
+    await Promise.resolve().then(() => report([])).catch(() => {});
+    await tell();
     const here = runner();
     const down = notUp(here);
     if (down) return { text: `${down} Nothing was sent.\nnext: status`, wait: 5_000 };
@@ -37,14 +75,22 @@ export function makeAutoReach({ status, runner, waiting, origin, signIn, stampOf
     if (!d) return { text: "Cortad did not answer with the list of endpoints. Nothing was sent.\nnext: status", wait: 30_000 };
     const pick = picked(d.contact, here.receipts, ask?.paths);
     const due = pick.sent.filter((m) => !m.excluded && (ask || sent.get(keyOf(m)) !== stampOf(m)));
-    const answers = due.length ? await sendOurs(due, { runner: here, origin: origin(), signIn, next, stop: () => !ask && asked(), fetchImpl }) : [];
-    // An app restarting under a request is no answer of the endpoint's: it is sent again next round.
+    const until = now() + roundMs;
+    let cut = false;
+    const answers = due.length ? await sendOurs(due, {
+      runner: here, origin: origin(), signIn, next, stop: () => (!ask && asked()) || (cut = now() >= until), fetchImpl,
+      onAnswer: (a, i) => { const met = outcomes([due[i]], [a]); if (met.length) void tell(met); },
+    }) : [];
+    await tell();
+    // A request that never reached the app (refused, or a GET cut off) is sent again next round. One
+    // that may have reached it, a POST reset or timed out, is not: sending it twice could do twice
+    // whatever it does. The agent's `reach` or an edit to its file sends it again.
     answers.forEach((a, i) => { if (!a.down) sent.set(keyOf(due[i]), stampOf(due[i])); });
-    const met = outcomes(due, answers);
-    for (let i = 0; i < met.length; i += 100) await report(met.slice(i, i + 100)).catch(() => {});
     const line = testedLine(answers);
     if (line) say(line);
-    return { text: reachText({ ...pick, sent: due.slice(0, answers.length) }, answers, `${here.port}, one at a time`), wait: d.read?.complete === true ? 60_000 : 5_000 };
+    // Rows the round's time left unsent are due in seconds, never a minute on. An ask of the agent's
+    // that stopped the round is taken within a second whatever this says.
+    return { text: reachText({ ...pick, sent: due.slice(0, answers.length) }, answers, `${here.port}, up to four at a time`), wait: !cut && !kept.size && d.read?.complete === true ? 60_000 : 5_000 };
   };
 }
 

package/lib/calls.mjs

@@ -1,23 +1,35 @@
 // What Cortad counts about its own tools: which one an agent called, from which client, how long it
 // took, how much text came back and, when it failed, under which code. The arguments and the answer
-// stay on this machine. Sent with the machine's own key, and a count that is lost is never retried:
-// it must not cost the tool call it describes.
+// stay on this machine. Sent with the machine's own key. A count that is lost is not sent again: it
+// must not cost the tool call it describes. One kind of call is: the agent's own test request
+// (`reach`), which Cortad counts as a try at fixing whatever holds Run. Lost, that try would go
+// uncounted, so its report is sent again, a few times and no more, always under the call's own id
+// (`callId`, made when the call arrived): the server takes an id once however often it arrives.
 import { randomUUID } from "node:crypto";
 
 const text = (v, max) => (typeof v === "string" && v ? v.slice(0, max) : undefined);
 
-export function makeReport({ api, token, version, fetchImpl = fetch, sessionId = randomUUID() }) {
-  return async ({ tool, durationMs, outputChars, errorCode, error, clientName, clientVersion }) => {
+const RETRIES = 3;
+const RETRY_MS = 400;
+
+export function makeReport({ api, token, version, fetchImpl = fetch, sessionId = randomUUID(), wait = (ms) => new Promise((r) => setTimeout(r, ms)) }) {
+  return async ({ tool, callId, durationMs, outputChars, errorCode, error, clientName, clientVersion }) => {
     const key = token();
     if (!key) return;
-    const call = { tool, durationMs, outputChars, errorCode, error: text(error?.split("\n")[0], 512), clientName: text(clientName, 80), clientVersion: text(clientVersion, 40), serverVersion: version, sessionId };
-    try {
-      await fetchImpl(`${api}/mcp/calls`, {
-        method: "POST",
-        headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
-        body: JSON.stringify([call]),
-        signal: AbortSignal.timeout(3000),
-      });
-    } catch { /* lost */ }
+    const call = { tool, ...(callId ? { callId } : {}), durationMs, outputChars, errorCode, error: text(error?.split("\n")[0], 512), clientName: text(clientName, 80), clientVersion: text(clientVersion, 40), serverVersion: version, sessionId };
+    const tries = tool === "reach" && callId ? RETRIES : 1;
+    for (let n = 1; n <= tries; n++) {
+      try {
+        const res = await fetchImpl(`${api}/mcp/calls`, {
+          method: "POST",
+          headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+          body: JSON.stringify([call]),
+          signal: AbortSignal.timeout(3000),
+        });
+        // Taken, or refused for good: either way it is not sent again.
+        if (!res || res.ok || (res.status >= 400 && res.status < 500 && res.status !== 429)) return;
+      } catch { /* lost */ }
+      if (n < tries) await wait(n * RETRY_MS);
+    }
   };
 }

package/lib/contact-text.mjs

@@ -130,9 +130,11 @@ function readyLine(r) {
 
 // The endpoints no request has reached, as status lists them and reach sends them. `receipts`: doors
 // the App section says answered at once with their answer out of Cortad's sight, so not said here.
-export const unreached = (c, receipts = []) => {
+// `retests`: the doors whose test failed, listed again to be sent once more: reach takes them, the
+// list of endpoints no request reached does not.
+export const unreached = (c, receipts = [], { retests = false } = {}) => {
   const answered = new Set(receipts.map((x) => x.door));
-  return (c?.notCalled ?? []).filter((m) => !answered.has(`${m.method} ${m.path}`));
+  return (c?.notCalled ?? []).filter((m) => !answered.has(`${m.method} ${m.path}`) && (retests || !m.retest));
 };
 
 // One the server has no request for, or one listed on a field's name alone, is the agent's to send.
@@ -155,8 +157,12 @@ export function contactLines(c, data = [], receipts = []) {
   const said = data.map((s) => `Data: ${s}`);
   if (!c) return said;
   const proven = c.proven ?? [];
-  // No request yet is said by the App line and by the next step, not a third time here.
-  const lines = proven.length ? [`Endpoints that answered (${num(proven.length)}):`, ...proven.flatMap(doorLines)] : [];
+  // No request yet is said by the App line and by the next step, not a third time here. Endpoints
+  // that all answered only Cortad's own test request say so once, over the list: sixteen of them
+  // each said it under their own line, and the agent asked for a status it could read.
+  const alike = proven.length > 1 && proven.every((v) => v.standing === "fallback") && new Set(proven.map((v) => v.why)).size === 1;
+  const head = alike ? `Endpoints that answered (${num(proven.length)}), each only Cortad's own test request so far: ${proven[0].why}` : `Endpoints that answered (${num(proven.length)}):`;
+  const lines = proven.length ? [head, ...proven.flatMap((v) => doorLines(alike ? { ...v, standing: null } : v))] : [];
   const missing = unreached(c, receipts);
   if (missing.length) lines.push(`Endpoints found in your code that have not answered yet (${num(missing.length)}):`, ...missing.map(unreachedLine), ...[reachLine(missing)].filter(Boolean));
   const ready = readyLine(c.ready);

package/lib/keeping.mjs

@@ -38,7 +38,7 @@ function blockedRows(blocked) {
 // that command gives the app: a legal research API typed ENV=staging and was started on copies of
 // the test databases its default settings file names, where its library is empty.
 const AS_TYPED = "Your app is started with your own command as it is, on the databases that command gives it. Nothing is copied: a run writes into them once you say yes to each on the card.";
-export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, launch, connections, hold = () => {}, typed = false }) {
+export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, launch, connections, copies = () => [], hold = () => {}, typed = false }) {
   let pending = null;
   let now = null;
   let backing = null;
@@ -50,7 +50,9 @@ export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, lau
   async function keepAll(started) {
     if (typed) {
       const none = async () => ({ env: {}, risks: [], copies: [], blocked: [], pass: [] });
-      now = { env: {}, risks: [], notes: [AS_TYPED], blocked: [], pass: [], stores: [], keeper: { keep: none, drop: async () => {} }, values: {}, started };
+      // The app's own command may still reach a Qdrant: the copies the hook makes there are dropped too.
+      const keeper = storeKeeper({ ledgerFile, values: {}, dirs: [] });
+      now = { env: {}, risks: [], notes: [AS_TYPED], blocked: [], pass: [], stores: [], keeper: { keep: none, drop: async () => {}, dropCopies: (c, s) => keeper.dropCopies(c, s) }, values: {}, started };
       tell(now.notes);
       return now;
     }
@@ -157,12 +159,15 @@ export function makeKeeping({ root, work, ledgerFile, onPath, say, settings, lau
       const k = await pending;
       pending = null;
       now = null;
+      await k?.keeper.dropCopies(copies(), k.stores).catch(() => {});
       await k?.keeper.drop();
     },
     // Once the app has stopped: a copy is dropped when nothing holds it open, and a store is stopped
     // only after its copy is gone.
     async close() {
-      await (await pending?.catch(() => null))?.keeper.drop().catch(() => {});
+      const k = await pending?.catch(() => null);
+      await k?.keeper.dropCopies(copies(), k.stores).catch(() => {});
+      await k?.keeper.drop().catch(() => {});
       await backing?.stop().catch(() => {});
     },
   };

package/lib/mcp.mjs

@@ -2,6 +2,7 @@
 // dependency. stdout carries protocol messages and nothing else; everything a person might read
 // goes to stderr. The tools are lib/verbs.mjs, one to one.
 
+import { randomUUID } from "node:crypto";
 import { SHOW } from "./read-text.mjs";
 
 export const PROTOCOL = "2025-06-18";
@@ -10,7 +11,7 @@ export const PROTOCOL = "2025-06-18";
 // every server, so the first paragraph stands alone and the whole stays under 1,500 characters.
 export const instructions = (spec = "cortad") => [
   "Cortad tests the AI in this repository: simulated users written from the app's code talk to the app running on this machine, and every reply is checked. Cortad sends each AI endpoint a test request itself. status shows the app's port, what the reviews of the prompts and of the code around the model found, which endpoints answered and which failed at what file and line, and what a run would play and cost. The first run starts by itself; later runs when the person presses Run or asks.",
-  `Tell the person what status found in a few plain lines. Before you stop, start \`npx -y ${spec} wait\` as a background command: it returns when the next run ends, with what it found. After a run, call findings and fix the worst problem, then verify it; the person asked for these fixes when they connected Cortad. findings has each failure whole and findings numbers every rate. verify replays the failing conversations and says whether the failure is gone. field_connect gives the steps to connect production. dispute records a check that reads this app wrong.`,
+  `Tell the person what status found in a few plain lines. Before you stop, start \`npx -y ${spec} wait\` as a background command: it returns when the next run or verify ends, with what it found. After a run, call findings and tell the person what it found and what you would change, worst first; the person then says which fix to make, and nothing is edited before their go. On their go, one fix at a time: verify replays the failing conversations and says whether the failure is gone, and a further round plays only when verify is called again. findings has each failure whole and findings numbers every rate. field_connect gives the steps to connect production. dispute records a check that reads this app wrong.`,
 ].join("\n\n");
 export const INSTRUCTIONS = instructions();
 
@@ -69,8 +70,9 @@ export function serveMcp({ verbs, version, spec, input = process.stdin, output =
   return new Promise((resolve) => {
     let client = {};
     const sending = new Set();
-    const count = (tool, began, text, failure) => {
-      const sent = Promise.resolve(report({ tool, durationMs: Date.now() - began, outputChars: text.length, ...failure, ...client })).catch(() => {}).finally(() => sending.delete(sent));
+    // `callId`: this call's own name, made when it arrives and sent with every report of it (lib/calls.mjs).
+    const count = (tool, began, text, failure, callId) => {
+      const sent = Promise.resolve(report({ tool, callId, durationMs: Date.now() - began, outputChars: text.length, ...failure, ...client })).catch(() => {}).finally(() => sending.delete(sent));
       sending.add(sent);
     };
     let closed = false;
@@ -97,6 +99,7 @@ export function serveMcp({ verbs, version, spec, input = process.stdin, output =
       const { id, method, params } = msg;
       const notification = id === undefined || id === null;
       const began = Date.now();
+      const callId = randomUUID();
       try {
         switch (method) {
           case "initialize":
@@ -113,11 +116,11 @@ export function serveMcp({ verbs, version, spec, input = process.stdin, output =
             const name = params?.name;
             const verb = NAMES.has(name) && Object.hasOwn(verbs, name) ? verbs[name] : null;
             if (!verb) {
-              count("unknown", began, "", { errorCode: "unknown_tool" });
+              count("unknown", began, "", { errorCode: "unknown_tool" }, callId);
               return send(result(id, { content: [{ type: "text", text: `No tool ${String(name)}.` }], isError: true }));
             }
             const out = await verb(params?.arguments ?? {});
-            count(name, began, out.text, out.isError ? { errorCode: out.code ?? "refused", error: out.why } : {});
+            count(name, began, out.text, out.isError ? { errorCode: out.code ?? "refused", error: out.why } : {}, callId);
             const structured = out.structured && typeof out.structured === "object" && !Array.isArray(out.structured) ? { structuredContent: out.structured } : {};
             return send(result(id, { content: [{ type: "text", text: out.text }], ...structured, ...(out.isError ? { isError: true } : {}) }));
           }
@@ -126,7 +129,7 @@ export function serveMcp({ verbs, version, spec, input = process.stdin, output =
         }
       } catch (err) {
         log(`mcp ${method}: ${err?.stack ?? err}`);
-        if (method === "tools/call") count(NAMES.has(params?.name) ? params.name : "unknown", began, "", { errorCode: "internal" });
+        if (method === "tools/call") count(NAMES.has(params?.name) ? params.name : "unknown", began, "", { errorCode: "internal" }, callId);
         if (!notification) send(result(id, { content: [{ type: "text", text: `Cortad could not answer: ${String(err?.message ?? err)}` }], isError: true }));
       }
     }

package/lib/pyhook/sitecustomize.py

@@ -118,7 +118,7 @@ def _install():
     import re
     import sys
     import time
-    from urllib.parse import urlsplit
+    from urllib.parse import quote, unquote, urlsplit, urlunsplit
 
     ctx = contextvars.ContextVar("cortad_request", default=None)
     limit = 65536
@@ -882,6 +882,31 @@ def _install():
             return False
         return bool(retrieval_host.search(parts.hostname or "")) or bool(retrieval_path.search(parts.path or ""))
 
+    # A call to one Qdrant collection, by Qdrant's own REST shape (lib/wire.cjs qdrantCall): every
+    # PUT, PATCH and DELETE writes, and a POST does unless it is one of Qdrant's reads spelled as a
+    # POST. /collections/aliases names no collection: a write of the server itself.
+    qdrant_collection = re.compile(r"^/collections/([^/]+)(/.*)?$")
+    qdrant_read_post = re.compile(r"^/points(?:/(?:search|query|recommend|discover)(?:/(?:batch|groups))?|/scroll|/count|/facet|/search/matrix/(?:pairs|offsets))?$")
+    qdrant_points = re.compile(r"^/points(?:/(?:delete|payload|payload/delete|payload/clear|vectors|vectors/delete|batch))?$")
+
+    def qdrant_call(url, method):
+        try:
+            parts = urlsplit(str(url))
+        except ValueError:
+            return None
+        if parts.scheme not in ("http", "https"):
+            return None
+        m = qdrant_collection.match(parts.path or "")
+        if not m:
+            return None
+        name, rest = m.group(1), m.group(2) or ""
+        verb = str(method or "GET").upper()
+        write = verb in ("PUT", "PATCH", "DELETE") or (verb == "POST" and not qdrant_read_post.match(rest))
+        # "points" changes what the collection holds and a copy stands in for it; "create" makes it;
+        # "schema" (an index, an alias, a snapshot, its settings or its deletion) is held, never copied.
+        kind = None if not write else "create" if rest == "" and verb == "PUT" else "points" if qdrant_points.match(rest) and verb != "DELETE" else "schema"
+        return {"collection": None if name == "aliases" else unquote(name), "rest": rest, "write": write, "kind": kind, "parts": parts}
+
     def passages_from(raw):
         out, nodes = [], [0]
 
@@ -1344,6 +1369,11 @@ def _install():
                 return False
         elif run_seen["at"] is None or time.monotonic() - run_seen["at"] > run_live_s:
             return False
+        # A read of a Qdrant collection, however its server is named, and any call to a copy this
+        # hook made (copy_of below), go out.
+        q = qdrant_call(url, method)
+        if q and (not q["write"] or (q["collection"] and our_copy.search(q["collection"]))):
+            return False
         try:
             parts = urlsplit(str(url))
             host = (parts.hostname or "").lower()
@@ -1353,6 +1383,150 @@ def _install():
         except Exception:
             return True
 
+    # A write to a Qdrant collection made inside a run goes to a copy of that collection on the same
+    # server, made at the first such write: the collection is read page by page and written under
+    # `<name>_cortad_<pid>`, and from then on every call a run makes to that collection, reads too,
+    # goes to the copy, so the app finds what it wrote. The original is never written. A copy that
+    # cannot be made (over the size a run copies, a server that refused) leaves the write held like
+    # any other. Each copy is reported as a `copy` row and the command deletes them when it ends.
+    # The person's own calls, outside a run, go where they were sent (lib/trace.cjs does the same).
+    import threading
+    our_copy = re.compile(r"_cortad_\d+$")
+    copies = {}
+    copies_lock = threading.Lock()
+    qdrant_cap = 200000
+    # What one process copies at most: collections, and points across them; past it a write is held.
+    copies_max = 8
+    points_max = 300000
+    copied = {"collections": 0, "points": 0}
+    copy_said = set()
+
+    def copy_say(host, collection, why):
+        if (host, collection) in copy_said:
+            return
+        copy_said.add((host, collection))
+        try:
+            sys.stderr.write("cortad: a request Cortad sent made this app write into the Qdrant collection %s at %s. Cortad could not copy that collection on its server (%s), so the write was kept on this machine and answered with a stand-in success.\n" % (collection, host, why))
+        except Exception:
+            pass
+
+    def in_run():
+        req = ctx.get()
+        if req:
+            return bool(req.get("turn"))
+        return run_seen["at"] is not None and time.monotonic() - run_seen["at"] <= run_live_s
+
+    # None to leave the call alone; hold for a write of the server itself; else the collection's
+    # copy when there is one, or none yet for a write, which makes it.
+    def guarded(url, method):
+        call = qdrant_call(url, method)
+        if not call:
+            return None
+        if not call["collection"]:
+            return {"hold": True} if call["write"] and in_run() else None
+        if our_copy.search(call["collection"]) or not in_run():
+            return None
+        key = "%s|%s" % (call["parts"].netloc, call["collection"])
+        copy = copies.get(key)
+        if copy:
+            return {"key": key, "call": call, "copy": copy}
+        if not call["write"]:
+            return None
+        if call["kind"] == "schema":
+            return {"hold": True}
+        if copied["collections"] >= copies_max or copied["points"] >= points_max:
+            copy_say(call["parts"].netloc, call["collection"], "this run already copied %d collections, %d points" % (copied["collections"], copied["points"]))
+            return {"hold": True}
+        return {"key": key, "call": call, "copy": None}
+
+    # Qdrant's own API over urllib, which this file leaves unpatched: never through the app's clients.
+    def qdrant_http(base, key, method, path, body=None):
+        import urllib.error
+        import urllib.request
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"content-type": "application/json"}
+        if key:
+            headers["api-key"] = key
+        req = urllib.request.Request(base + path, data=data, method=method, headers=headers)
+        try:
+            with urllib.request.urlopen(req, timeout=30) as r:
+                return json.loads(r.read().decode("utf-8", "replace") or "null"), r.status
+        except urllib.error.HTTPError as e:
+            return None, e.code
+
+    # The copy made: "empty" when the server holds no such collection yet (the app makes it, under
+    # the copy's name), "points" once every point is across, None when none could be made.
+    def clone_qdrant(base, key, source, clone):
+        at = lambda name: "/collections/" + quote(name, safe="")
+        info, status = qdrant_http(base, key, "GET", at(source))
+        if status == 404:
+            return ("empty", 0)
+        result = (info or {}).get("result") if status == 200 else None
+        if not result:
+            return None
+        if (result.get("points_count") or 0) > qdrant_cap:
+            return None
+        params = (result.get("config") or {}).get("params") or {}
+        made = {"vectors": params.get("vectors")}
+        if params.get("sparse_vectors"):
+            made["sparse_vectors"] = params["sparse_vectors"]
+        if "on_disk_payload" in params:
+            made["on_disk_payload"] = params["on_disk_payload"]
+        if qdrant_http(base, key, "PUT", at(clone), made)[1] != 200:
+            return None
+        try:
+            for field, schema in (result.get("payload_schema") or {}).items():
+                qdrant_http(base, key, "PUT", at(clone) + "/index?wait=true", {"field_name": field, "field_schema": schema.get("params") or schema.get("data_type")})
+            offset = None
+            while True:
+                page, status = qdrant_http(base, key, "POST", at(source) + "/points/scroll", {"limit": 256, "with_payload": True, "with_vector": True, **({"offset": offset} if offset is not None else {})})
+                if status != 200:
+                    raise RuntimeError(status)
+                got = (page or {}).get("result") or {}
+                points = got.get("points") or []
+                if points and qdrant_http(base, key, "PUT", at(clone) + "/points?wait=true", {"points": [{"id": p.get("id"), "vector": p.get("vector"), "payload": p.get("payload")} for p in points]})[1] != 200:
+                    raise RuntimeError("upsert")
+                offset = got.get("next_page_offset")
+                if offset is None:
+                    return ("points", result.get("points_count") or 0)
+        except Exception:
+            qdrant_http(base, key, "DELETE", at(clone))
+            return None
+
+    # The copy's name, made now when none exists; None when none could be made. The key the app
+    # sent is the key the copy is made with, and never leaves this process.
+    def copy_of(g, header_of):
+        with copies_lock:
+            have = copies.get(g["key"])
+            if have:
+                return have
+            parts = g["call"]["parts"]
+            base = "%s://%s" % (parts.scheme, parts.netloc)
+            auth = str(header_of("authorization") or "")
+            bearer = re.match(r"^Bearer\s+(\S+)", auth, re.I)
+            key = str(header_of("api-key") or "") or (bearer.group(1) if bearer else "")
+            clone = "%s_cortad_%d" % (g["call"]["collection"][:40], os.getpid())
+            made = clone_qdrant(base, key, g["call"]["collection"], clone)
+            if not made:
+                copy_say(parts.netloc, g["call"]["collection"], "the copy did not go through")
+                return None
+            copied["collections"] += 1
+            copied["points"] += made[1]
+            copies[g["key"]] = clone
+            write({"copy": {"host": parts.hostname or "", "base": base, "collection": g["call"]["collection"], "clone": clone}})
+            return clone
+
+    def to_copy(url, clone, call):
+        parts = call["parts"]
+        return urlunsplit((parts.scheme, parts.netloc, "/collections/" + quote(clone, safe="") + call["rest"], parts.query, parts.fragment))
+
+    # The copy a call goes to, waited for off the event loop: None to hold the call instead.
+    async def copy_for(g, header_of):
+        import asyncio
+        if g.get("hold"):
+            return None
+        return g["copy"] or await asyncio.get_running_loop().run_in_executor(None, copy_of, g, header_of)
+
     # A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (SQL over HTTP,
     # where a SELECT can write through a function) is held.
     # ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
@@ -2468,19 +2642,34 @@ def _install():
                 dep(request.url, response.status_code, req=req, caller=caller)
             return response
 
+        def held_answer(request, sent):
+            kind = request.headers.get("content-type", "")
+            held_row(request.url, request.method, sent, kind, ctx.get())
+            return module.Response(200, headers={"content-type": "application/json"}, content=held_reply(sent, kind), request=request)
+
         # A held call that cannot be answered fails in the app; it is never sent instead.
         def held_httpx(request, sent):
             if not held_here(request.url, request.method, lambda: keys_in(request.headers)) or reads_only(sent, request.url, request.headers.get):
                 return None
-            kind = request.headers.get("content-type", "")
-            held_row(request.url, request.method, sent, kind, ctx.get())
-            return module.Response(200, headers={"content-type": "application/json"}, content=held_reply(sent, kind), request=request)
+            return held_answer(request, sent)
+
+        # A call to a Qdrant collection goes to the run's copy of it, `clone`; with none, it is held.
+        def routed_httpx(request, g, clone, sent):
+            if clone is None:
+                return held_answer(request, sent)
+            request.url = module.URL(to_copy(request.url, clone, g["call"]))
+            return None
 
         for cls in (module.Client, module.AsyncClient):
             send = cls.send
             if cls is module.Client:
                 def sync_send(self, request, *a, _send=send, **k):
                     sent = sent_of(request)
+                    g = guarded(request.url, request.method)
+                    if g is not None:
+                        answered = routed_httpx(request, g, None if g.get("hold") else (g["copy"] or copy_of(g, request.headers.get)), sent)
+                        if answered is not None:
+                            return answered
                     held = held_httpx(request, sent)
                     if held is not None:
                         return held
@@ -2504,6 +2693,11 @@ def _install():
             else:
                 async def async_send(self, request, *a, _send=send, **k):
                     sent = sent_of(request)
+                    g = guarded(request.url, request.method)
+                    if g is not None:
+                        answered = routed_httpx(request, g, await copy_for(g, request.headers.get), sent)
+                        if answered is not None:
+                            return answered
                     held = held_httpx(request, sent)
                     if held is not None:
                         return held
@@ -2535,6 +2729,9 @@ def _install():
             raw = text(request.body, reply_max)
             if reads_only(raw, request.url, request.headers.get):
                 return None
+            return held_answer(request, raw)
+
+        def held_answer(request, raw):
             import datetime
             models, structures = sys.modules["requests.models"], sys.modules["requests.structures"]
             kind = request.headers.get("content-type", "")
@@ -2546,6 +2743,12 @@ def _install():
             return response
 
         def sent(self, request, *a, **k):
+            g = guarded(request.url, request.method)
+            if g is not None:
+                clone = None if g.get("hold") else (g["copy"] or copy_of(g, request.headers.get))
+                if clone is None:
+                    return held_answer(request, text(request.body, reply_max))
+                request.url = to_copy(request.url, clone, g["call"])
             answered = held(request)
             if answered is not None:
                 return answered
@@ -2601,7 +2804,18 @@ def _install():
         async def requested(self, method, str_or_url, *a, **k):
             body = k.get("json") if k.get("json") is not None else k.get("data")
             url = whole(self, str_or_url)
-            if held_here(url, method, lambda: keys_of(self, k)) and not reads_only(text(body, reply_max), url, lambda name: header_of(self, k, name)):
+            g = guarded(url, method)
+            hold = False
+            if g is not None:
+                clone = await copy_for(g, lambda name: header_of(self, k, name))
+                if clone is None:
+                    hold = True
+                else:
+                    parts = g["call"]["parts"]
+                    url = to_copy(url, clone, g["call"])
+                    # A session with a base address takes the path alone.
+                    str_or_url = url if getattr(self, "_base_url", None) is None else url[len("%s://%s" % (parts.scheme, parts.netloc)):]
+            if hold or (held_here(url, method, lambda: keys_of(self, k)) and not reads_only(text(body, reply_max), url, lambda name: header_of(self, k, name))):
                 port = held_port()
                 if port is None:
                     raise module.ClientConnectionError("this write was kept from leaving and could not be answered")

package/lib/qdrant.mjs

@@ -5,8 +5,9 @@ export const QDRANT_CAP = 200_000;
 const BATCH = 256;
 const at = (name) => `/collections/${encodeURIComponent(name)}`;
 
+// `conn.fetch`: the fetch to use, when the caller's global one is wrapped (the hook in the app).
 async function call(conn, method, path, body) {
-  const res = await fetch(`${conn.base}${path}`, {
+  const res = await (conn.fetch ?? fetch)(`${conn.base}${path}`, {
     method,
     headers: { "content-type": "application/json", ...(conn.apiKey ? { "api-key": conn.apiKey } : {}) },
     body: body === undefined ? undefined : JSON.stringify(body),
@@ -34,7 +35,7 @@ export async function cloneQdrant(conn, source, clone) {
       const page = await call(conn, "POST", `${at(source)}/points/scroll`, { limit: BATCH, with_payload: true, with_vector: true, ...(offset === undefined ? {} : { offset }) });
       if (page.points.length) await call(conn, "PUT", `${at(clone)}/points?wait=true`, { points: page.points.map(({ id, vector, payload }) => ({ id, vector, payload })) });
       offset = page.next_page_offset;
-      if (offset === null || offset === undefined) return { how: "points" };
+      if (offset === null || offset === undefined) return { how: "points", points: info.points_count ?? 0 };
     }
   } catch (e) {
     if (made) await dropQdrant(conn, clone);

package/lib/reach.mjs

@@ -4,7 +4,7 @@ import { plural, upper } from "./words.mjs";
 
 // One request to each endpoint status lists as not reached, from this machine to the app on its port.
 // Each body is the one Cortad read that endpoint's client sending (the server's `request`).
-// The connect command sends these by itself, one at a time, each tagged x-cortad-turn: reach:auto:<n>
+// The connect command sends these by itself, up to four at a time, each tagged x-cortad-turn: reach:auto:<n>
 // (sendOurs), signed in only as a test account this machine made. Headers are never the agent's: they
 // go from here to the app on this machine and nowhere else, and only their names are printed. These
 // are real requests with real effects.
@@ -31,7 +31,7 @@ export function notUp(runner) {
 // The rows a call sends and the ones it leaves: the named paths, else every row with a ready request
 // that is not marked by hand.
 export function picked(contact, receipts, paths = []) {
-  const rows = unreached(contact, receipts);
+  const rows = unreached(contact, receipts, { retests: true });
   const named = new Set(Array.isArray(paths) ? paths : []);
   const chosen = named.size ? rows.filter((m) => named.has(m.path) || named.has(keyOf(m))) : rows.filter((m) => !m.unsure);
   const sent = chosen.filter((m) => m.request);
@@ -72,15 +72,15 @@ export function reachText({ rows, sent, left, unknown }, answers, how) {
   ].filter(Boolean).join("\n");
 }
 
-// Cortad's own test requests, sent by the connect command: one at a time, so what the app prints
-// belongs to one of them, each with the app's own origin where one is known. An endpoint that answers
+// Cortad's own test requests, sent by the connect command, each with the app's own origin where one is known. An endpoint that answers
 // 401 or 403 is asked once more as the test account this machine signed in, when there is one
 // (`signIn(row)` gives { name, value } or null); the token never leaves this machine.
 // `stop()`: true when the rest should wait, for the agent's ask; the answers so far come back.
 // Four at a time: one each in turn left a 22-endpoint app waiting nearly two minutes behind its two
 // slowest replies (ulaim, 2026-10-06). Answers keep the rows' order; a row is not sent once stop() says so.
+// `onAnswer(answer, i)`: called as each row's answer lands, so one slow endpoint holds back no other's.
 const AT_ONCE = 4;
-export async function sendOurs(rows, { runner, origin, signIn = async () => null, next, stop = () => false, fetchImpl = fetch, atOnce = AT_ONCE }) {
+export async function sendOurs(rows, { runner, origin, signIn = async () => null, next, stop = () => false, onAnswer = () => {}, fetchImpl = fetch, atOnce = AT_ONCE }) {
   const app = appUrl(runner);
   const base = () => ({ ...(origin ? { origin, referer: `${origin}/` } : {}), [RUN_TURN]: `reach:auto:${next()}` });
   const answers = [];
@@ -101,6 +101,7 @@ export async function sendOurs(rows, { runner, origin, signIn = async () => null
       if (stopped || stop()) { stopped = true; return; }
       const i = at++;
       answers[i] = await one(rows[i]);
+      try { onAnswer(answers[i], i); } catch { /* the answer stands whatever its listener did */ }
     }
   };
   await Promise.all(Array.from({ length: Math.min(atOnce, rows.length) }, lane));
@@ -179,7 +180,13 @@ export async function sendOne(m, app, headers, fetchImpl, secrets = []) {
     res = await fetchImpl(url, { method, headers: json && !typed ? { "content-type": "application/json", ...headers } : headers,
       ...(json ? { body: JSON.stringify(body) } : {}), redirect: "manual", signal: AbortSignal.timeout(REACH_MS) });
   } catch (err) {
-    return { line: `${label}: ${failedSaid(err, app.port || 80)}`, ok: false, status: 0, down: /^(?:ECONNREFUSED|ECONNRESET)$/.test(err?.cause?.code ?? err?.code ?? "") };
+    const code = err?.cause?.code ?? err?.code ?? "";
+    // Refused, nothing reached the app, and a GET cut off changes nothing: both are sent again
+    // (`down`). A POST whose connection was reset may have been taken by the app before it went, so
+    // it is an answer nobody saw (`unknown`) and is never sent again by itself.
+    const unknown = code === "ECONNRESET" && method !== "GET";
+    return { line: `${label}: ${failedSaid(err, app.port || 80)}${unknown ? " It may have reached your app, so Cortad does not send it again by itself." : ""}`, ok: false, status: 0,
+      down: !unknown && /^(?:ECONNREFUSED|ECONNRESET)$/.test(code), ...(unknown ? { unknown: true } : {}) };
   }
   let text;
   try { text = await res.text(); } catch { return { line: `${label}: ${res.status}, and the answer had not finished after ${REACH_MS / 1000} seconds.`, ok: false, status: res.status }; }

package/lib/replay.mjs

@@ -37,6 +37,8 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
   let newestTable = null;
   // Each server a hooked process opened a connection to, by host and port.
   const conns = new Map();
+  // The Qdrant collections the hook copied for a run's writes, by server and name (lib/stores.mjs drops them).
+  const copies = new Map();
   // The model's last words and status for each of a run's turns on an endpoint the app answers
   // later, by turn (lib/wire.cjs answeredLater).
   const answers = new Map();
@@ -48,7 +50,7 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
   // requires, to one without.
   const bunHook = /\s/.test(HOOK) ? (() => {
     const dir = mkdtempSync(join(tmpdir(), "cortad-"));
-    for (const name of ["trace.cjs", "wire.cjs", "tied.cjs"]) copyFileSync(join(HERE, name), join(dir, name));
+    for (const name of ["trace.cjs", "wire.cjs", "tied.cjs", "qdrant.mjs"]) copyFileSync(join(HERE, name), join(dir, name));
     return join(dir, "trace.cjs");
   })() : HOOK;
   // The hooks are handed to whatever is started: a Node app loads the first, a Bun app the same file
@@ -96,6 +98,7 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
       if (Number.isInteger(row.listen)) { ports.add(row.listen); continue; }
       if (row.routes) { const t = routeTable(row.routes); if (t) { tables.set(t.port, t); newestTable = t; } continue; }
       if (row.conn) { const { host, port } = row.conn; if (typeof host === "string" && Number.isInteger(port)) conns.set(`${host}:${port}`, { host, port }); continue; }
+      if (row.copy) { const { base, collection, clone } = row.copy; if ([base, collection, clone].every((v) => typeof v === "string" && v)) copies.set(`${base}|${collection}`, { base, collection, clone }); continue; }
       if (row.answer) {
         const { turn, status, reply } = row.answer;
         if (TURN.test(turn ?? "")) answers.set(turn, { status: Number.isInteger(status) ? status : 0, reply: typeof reply === "string" ? reply : "" });
@@ -158,6 +161,8 @@ export function makeCapture({ work, keepSecret, onProof = () => {}, writes = nul
     registry: (port) => { poll(); return tables.get(port) ?? newestTable ?? {}; },
     // The servers the app has connected to so far (lib/stores.mjs names the ones no setting does).
     connections: () => { poll(); return [...conns.values()]; },
+    // The collections the hook copied on a Qdrant server for a run's writes, to be deleted at the end.
+    copies: () => { poll(); return [...copies.values()]; },
     // The model's last words for a run's turn on an endpoint the app answers later, once the hook
     // has written them; null at `until`, or once `signal` aborts. `forget` drops a turn sent again.
     answered: async (turn, until, signal) => {

package/lib/spec.mjs

@@ -11,10 +11,20 @@ export const VERSION = JSON.parse(readFileSync(new URL("../package.json", import
 export const SPEC = "(?:cortad(?:@[A-Za-z0-9._-]+)?|/[A-Za-z0-9._/-]+)";
 const SAFE = new RegExp(`^${SPEC}$`);
 
+// A pin older than this very version loses to it: a connect run as cortad@0.3.8 wrote a skill and an
+// MCP server pinned to 0.3.7, and the agent asked whether the two were meant to mix.
 export function cliSpec({ env = process.env, version = VERSION } = {}) {
-  if (env.CORTAD_CLI_SPEC && SAFE.test(env.CORTAD_CLI_SPEC)) return env.CORTAD_CLI_SPEC;
-  return `cortad@${version}`;
+  const pinned = env.CORTAD_CLI_SPEC && SAFE.test(env.CORTAD_CLI_SPEC) ? env.CORTAD_CLI_SPEC : null;
+  if (!pinned) return `cortad@${version}`;
+  const released = /^cortad@(\d+\.\d+\.\d+)$/.exec(pinned)?.[1];
+  return released && newer(version, released) ? `cortad@${version}` : pinned;
 }
+const newer = (a, b) => {
+  if (!/^\d+\.\d+\.\d+$/.test(a)) return false;
+  const [x, y] = [a, b].map((v) => v.split(".").map(Number));
+  for (let i = 0; i < 3; i += 1) if (x[i] !== y[i]) return x[i] > y[i];
+  return false;
+};
 
 // npx needs -y to fetch a package without asking; a local folder is not fetched.
 export const npxArgs = (spec) => (isAbsolute(spec) ? [spec] : ["-y", spec]);

package/lib/stores.mjs

@@ -249,6 +249,12 @@ const heldWhy = (s, why, tool) => {
   const [reason, fix] = (HELD[why] ?? HELD.other)(s, tool);
   return `${listed(s.names)} ${s.names.length === 1 ? "points" : "point"} at ${s.engine === "redis" || s.db ? "the" : "a"} ${whatOf(s)} off this machine, and ${reason}, so the run would write into it as it is. ${fix}, then run the connect command again.`;
 };
+// A Qdrant server the app writes into is kept by the hook in the app instead of by a copy made here:
+// the first write a run makes into a collection copies that collection on the same server and the
+// app's later calls go to the copy (lib/trace.cjs, lib/pyhook/sitecustomize.py). So a hosted Qdrant
+// holds nothing, and a local one whose collection no setting names is not a risk either.
+export const GUARDED_ENGINES = new Set(["qdrant"]);
+const guardedKept = (s) => `Your app's ${ENGINE[s.engine]} collections at ${listed(s.names)} are not written into by a run: the first time a run writes into one, that collection is copied on the same server and the app's calls go to the copy, which is deleted when this command ends.`;
 const hostedKept = (s, got) => (got.how === "neon"
   ? `Your app runs against a Neon branch of its ${whatOf(s)}, made for this session through ${listed(s.names)}; the original is not touched, and the branch is deleted when this command ends and made again from the original at the next connect.`
   : got.how === "supabase"
@@ -259,7 +265,7 @@ export const storeId = (s) => createHash("sha256").update(s.key).digest("hex").s
 // A store off this machine the app was pointed at a copy of and reached anyway (dotenv's override):
 // trials write into the original, so it holds Run. `blocked`: the rows already holding it.
 export const bypassedOf = (connections, stores, blocked) => stores
-  .filter((s) => !onThisMachine(s.host) && !blocked.some((b) => b.id === storeId(s)) && connections.some((c) => hostKey(c.host) === hostKey(s.host)))
+  .filter((s) => !onThisMachine(s.host) && !GUARDED_ENGINES.has(s.engine) && !blocked.some((b) => b.id === storeId(s)) && connections.some((c) => hostKey(c.host) === hostKey(s.host)))
   .map((s) => ({ id: storeId(s), names: s.names, why: heldWhy(s, "bypassed") }));
 
 // A copy that throws is one that did not go through, said as such; it never stops the app starting.
@@ -292,6 +298,12 @@ export function storeKeeper({ ledgerFile, values = {}, dirs = [], fetchFn, local
       const pass = [];
       for (const s of stores) {
         if (done.has(s.key)) continue;
+        if (GUARDED_ENGINES.has(s.engine) && (!onThisMachine(s.host) || !s.points.length || !s.db)) {
+          if (await down(s)) continue;
+          done.add(s.key);
+          copies.push(guardedKept(s));
+          continue;
+        }
         if (!onThisMachine(s.host)) {
           done.add(s.key);
           const got = started ? await hosted.keep(s).catch(() => ({ why: ["other"] })) : { why: ["started"] };
@@ -329,6 +341,21 @@ export function storeKeeper({ ledgerFile, values = {}, dirs = [], fetchFn, local
       for (const { s, row } of made.splice(0)) if (await drop(s, row.made, row.marker)) book.remove(row);
       await hosted.drop();
     },
+    // The collections the hook in the app copied for a run's writes (lib/trace.cjs copyOf), deleted
+    // with the key the settings hold for that server. Each is in the ledger from the moment it is
+    // seen, so one a killed session left is deleted by the next.
+    // ponytail: a server no setting names a key for is asked without one; a copy that refuses stays
+    // under its _cortad_ name for the person to see. The key the app sent never leaves the app.
+    async dropCopies(copies, stores) {
+      const rows = copies.map((c) => ({ kind: "qdrant-copy", key: c.base, made: c.clone }));
+      for (const row of rows) book.add(row);
+      const hostOf = (base) => { try { return new URL(base).hostname; } catch { return base; } };
+      for (const row of [...rows, ...book.orphans("qdrant-copy")]) {
+        // The hook names the server with its port and QDRANT_URL may not: the key is the host's.
+        const conn = { base: row.key, apiKey: stores.find((s) => s.engine === "qdrant" && s.conn?.base && hostOf(s.conn.base) === hostOf(row.key))?.conn.apiKey };
+        if (await dropQdrant(conn, row.made)) book.remove(row);
+      }
+    },
   };
 }
 
@@ -341,7 +368,7 @@ export function unnamedHeld(connections, stores, blocked) {
   for (const { host, port } of connections) {
     const local = onThisMachine(host);
     const engine = local ? ENGINE_AT[port] : HOSTED.find(([, re]) => re.test(String(host).toLowerCase()))?.[0] ?? ENGINE_AT[port];
-    if (!engine || stores.some((s) => (local ? `${hostKey(s.host)}:${s.port}` === `localhost:${port}` : s.engine === engine && !onThisMachine(s.host)))) continue;
+    if (!engine || GUARDED_ENGINES.has(engine) || stores.some((s) => (local ? `${hostKey(s.host)}:${s.port}` === `localhost:${port}` : s.engine === engine && !onThisMachine(s.host)))) continue;
     const id = createHash("sha256").update(`${engine}|${local ? "localhost" : String(host).toLowerCase()}|${port}`).digest("hex").slice(0, 16);
     if ([...blocked, ...rows].some((b) => b.id === id)) continue;
     // Named by its engine where a setting's name would stand: the API takes a name, never an address.

package/lib/text.mjs

@@ -100,8 +100,16 @@ const runsSaid = (left, allowed) => (left > 0 ? `${num(left)} of ${plural(allowe
 // After the findings: what was measured of the app's own promises, in its own words, then the checks
 // measured and why the rest were not, then how many trials kept every promise. Counts, never a score.
 // The replies that did not count sit before the count: a clean count beside 62 error replies read as a clean bill.
+// Their own eval files, as the run played them: one line for all, one per file.
+function evalLines(evals) {
+  const t = evals?.total;
+  if (!t || !t.played) return [];
+  const said = (x) => `${num(x.passed)} of ${plural(x.played, "case")} passed${x.failed ? `, ${num(x.failed)} failed` : ""}${x.unclear ? `, ${num(x.unclear)} not settled` : ""}${x.cases > x.played ? `, ${num(x.cases - x.played)} not played` : ""}`;
+  return [`Your own eval files: ${said(t)}.`, ...(evals.files ?? []).slice(0, 12).map((f) => `  ${f.file}: ${said(f)}.`)];
+}
+
 function measuredLines(d) {
-  const lines = [...promiseLines(d.promises), ...failedLines(d.failedReplies)];
+  const lines = [...promiseLines(d.promises), ...evalLines(d.evals), ...failedLines(d.failedReplies)];
   const of = has(d.questionsAsked) && has(d.questionsOf) && d.questionsOf > 0;
   if (of) lines.push(`${num(d.questionsAsked)} of ${plural(d.questionsOf, "check")} measured.`);
   // The dissection says what was not measured in its own line.
@@ -392,7 +400,14 @@ function findingsTail(d) {
 function findingsPages(d, budget = PAGE_CHARS - 60) {
   // Unrecorded is not unused (dissection-text.mjs): no tool is said never to have run.
   const unseen = (d.tools ?? d.dissection?.tools)?.recorded === false;
-  const blocks = [...(d.findings ?? []).map((f) => findingBlock(f, unseen)), findingsTail(d)].filter(Boolean);
+  // The findings from their own eval files are headed as theirs, once, where the first one stands.
+  let headed = false;
+  const blocks = [...(d.findings ?? []).map((f) => {
+    const block = findingBlock(f, unseen);
+    if (f.group !== "eval" || headed) return block;
+    headed = true;
+    return `From your own eval files:\n${block}`;
+  }), findingsTail(d)].filter(Boolean);
   const pages = [];
   let page = findingsHead(d);
   let filled = false;

package/lib/trace.cjs

@@ -17,7 +17,7 @@ if (FILE) {
     const http = require("node:http");
     const https = require("node:https");
     const als = new AsyncLocalStorage();
-    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
+    const { MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, toolText, scrubbed, list, clipped, argsText, turnOf, isModelCall, isRetrieval, qdrantCall, passagesFrom, decoded, cookieNames, makeRecorder, asChat, GATEWAY_MODEL } = require("./wire.cjs");
     const row = (value) => { try { fs.appendFileSync(FILE, JSON.stringify(scrubbed(value)) + "\n", { mode: 0o600 }); } catch { /* the command is gone */ } };
     // What the app writes into its own folder while a run is on: each file copied once before its
     // first write, so the command puts every one back when the run ends (lib/writes.mjs). Trials
@@ -798,15 +798,87 @@ if (FILE) {
     // ponytail: while a run is live, a person's own queued write is held too; per-ask pinning of
     // background writes is the upgrade when that matters.
     const RUN_LIVE_MS = 10 * 60_000;
+    // The copies this hook makes of Qdrant collections carry this suffix (copyOf below).
+    const OUR_COPY = /_cortad_\d+$/;
     const heldHere = (u, method, headerOf) => {
       const ctx = als.getStore();
       if (!WRITES.test(method) || (ctx ? !ctx.turn : Date.now() - lastTurnAt > RUN_LIVE_MS)) return false;
+      // A read of a Qdrant collection, however its server is named (a bare address holds no word
+      // like qdrant), and any call to a copy this hook made, go out.
+      const q = qdrantCall(u, method);
+      if (q && (!q.write || (q.collection && OUR_COPY.test(q.collection)))) return false;
       try {
         const host = targetOf(u, headerOf);
         if (THIS_MACHINE.test(host) || SANDBOX_HOST.test(host) || isModelCall(u.host, u.pathname) || isRetrieval(u) || TOKEN_PATH.test(u.pathname) || readsByName(method, u.pathname) || KEY_HEADERS.some((name) => testKey(authText(headerOf(name))))) return false;
         return !passNow().some((p) => host === p || host.endsWith("." + p));
       } catch { return true; }
     };
+    // A write to a Qdrant collection made inside a run goes to a copy of that collection on the same
+    // server, made at the first such write: the collection is read page by page and written under
+    // `<name>_cortad_<pid>`, and from then on every call to that collection, reads too, goes to the
+    // copy, so the app finds what it wrote. The original is never written. A copy that cannot be
+    // made (a collection over the size a run copies, a server that refused) leaves the write held
+    // like any other. Each copy is reported as a `copy` row, and the command deletes them when it
+    // ends. A copy of ours is never copied again. ulaim's hosted Qdrant held Run for the person's
+    // yes for seventeen minutes; this is what the yes stood in for.
+    const copies = new Map();
+    // What one process copies at most: collections, and points across them. Past it a write is held
+    // like any other, and the app's output says so once. A run is a few conversations' writes, never
+    // a cluster's.
+    const COPIES_MAX = 8;
+    const POINTS_MAX = 300_000;
+    let copied = 0, pointsCopied = 0;
+    const nativeFetch = typeof globalThis.fetch === "function" ? globalThis.fetch : null;
+    let qdrantLib = null;
+    const qdrantMod = () => (qdrantLib ??= import(require("node:url").pathToFileURL(require("node:path").join(__dirname, "qdrant.mjs")).href));
+    const inRun = () => { const ctx = als.getStore(); return ctx ? Boolean(ctx.turn) : Date.now() - lastTurnAt <= RUN_LIVE_MS; };
+    // What to do with a call: null to leave it alone; `hold` for a write of the server itself
+    // (/collections/aliases); else the collection's copy when there is one, or none yet for a write
+    // in a run, which makes it.
+    const guarded = (u, method) => {
+      if (!/^https?:$/.test(u.protocol)) return null;
+      const call = qdrantCall(u, method);
+      if (!call) return null;
+      if (!call.collection) return call.write && inRun() ? { hold: true } : null;
+      // The person's own calls, outside a run, go where they were sent: their writes are theirs to keep.
+      if (OUR_COPY.test(call.collection) || !inRun()) return null;
+      const key = `${u.host}|${call.collection}`;
+      const copy = copies.get(key);
+      if (copy) return { key, call, copy };
+      if (!call.write) return null;
+      // A change to the collection's shape, or a write past this process's copy budget, is held.
+      if (call.kind === "schema") return { hold: true };
+      if (copied >= COPIES_MAX || pointsCopied >= POINTS_MAX) { copySay(u.host, call.collection, `this run already copied ${copied} collections, ${pointsCopied} points`); return { hold: true }; }
+      return { key, call, copy: null };
+    };
+    // Said once per collection in the app's own output when no copy could be made and the write was
+    // kept on this machine instead, with the reason the server gave.
+    const copySaid = new Set();
+    const copySay = (host, collection, why) => {
+      if (copySaid.has(`${host}|${collection}`)) return;
+      copySaid.add(`${host}|${collection}`);
+      try { process.stderr.write(`cortad: a request Cortad sent made this app write into the Qdrant collection ${collection} at ${host}. Cortad could not copy that collection on its server (${why}), so the write was kept on this machine and answered with a stand-in success.\n`); } catch { /* no stderr */ }
+    };
+    const toCopy = (u, clone, call) => { const t = new URL(u.href); t.pathname = `/collections/${encodeURIComponent(clone)}${call.rest}`; return t; };
+    // The copy's name, made now when none exists; null when none could be made. The key the app sent
+    // is the key the copy is made with, and never leaves this process.
+    const copyOf = (u, headerOf, g) => {
+      const have = copies.get(g.key);
+      if (have) return Promise.resolve(have);
+      if (!nativeFetch) return Promise.resolve(null);
+      const clone = `${g.call.collection.slice(0, 40)}_cortad_${process.pid}`;
+      const bearer = /^Bearer\s+(\S+)/i.exec(headerOf("authorization") || "");
+      const conn = { base: `${u.protocol}//${u.host}`, apiKey: headerOf("api-key") || (bearer ? bearer[1] : ""), fetch: nativeFetch };
+      const made = qdrantMod().then(({ cloneQdrant }) => cloneQdrant(conn, g.call.collection, clone)).then((got) => {
+        if (!got || got.why) { copies.delete(g.key); copySay(u.host, g.call.collection, got ? got.why : "nothing"); return null; }
+        copied += 1; pointsCopied += got.points ?? 0;
+        copies.set(g.key, clone);
+        row({ copy: { host: u.hostname, base: conn.base, collection: g.call.collection, clone } });
+        return clone;
+      }, (e) => { copies.delete(g.key); copySay(u.host, g.call.collection, e && e.message ? e.message : "error"); return null; });
+      copies.set(g.key, made);
+      return made;
+    };
     // A GraphQL query reads; a mutation writes. A `query` in JSON that is not GraphQL (Neon's SQL, where
     // a SELECT can write through a function) is held.
     // ClickHouse, Trino and Presto take every query as a POST of its text, a SELECT too, and a SELECT
@@ -878,23 +950,31 @@ if (FILE) {
             heldWaiting.delete(id);
             const sent = Buffer.concat(parts);
             const text = sent.toString("utf8").slice(0, MAX);
-            // A body that only reads, known now that it is here, goes on to where it was sent, as it was
-            // sent, and its answer comes back through this server.
-            if (w && parts.length < 256 && readsOnly(text, w.u, (name) => String(req.headers[name] || ""), w.port)) {
+            const headerOf = (name) => String(req.headers[name] || "");
+            // The call goes on to where it was sent, as it was sent, or to `to` instead, and its
+            // answer comes back through this server.
+            const forward = (to) => {
               const { "x-cortad-held": _held, host: _host, connection: _connection, ...headers } = req.headers;
               const given = typeof w.args[0] === "string" || w.args[0] instanceof URL;
-              const options = { ...((given ? w.args[1] : w.args[0]) || {}), headers, signal: undefined, [PASSED]: true };
+              const options = { ...((given ? w.args[1] : w.args[0]) || {}), headers, signal: undefined, [PASSED]: true, ...(to && !given ? { path: to.pathname + to.search } : {}) };
               // Sent inside the request that asked, so the call is recorded behind that reply.
-              const send = () => (w.secure ? https : http).request(...(given ? [w.args[0], options] : [options]));
+              const send = () => (w.secure ? https : http).request(...(given ? [to ? to.href : w.args[0], options] : [options]));
               const up = w.ctx ? als.run(w.ctx, send) : send();
               up.on("response", (got) => { res.writeHead(got.statusCode || 502, got.headers); got.pipe(res); });
               up.on("error", () => { if (!res.headersSent) res.writeHead(502); res.end(); });
               res.on("close", () => up.destroy());
               return up.end(sent);
-            }
-            if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
-            res.writeHead(200, { "content-type": "application/json" });
-            res.end(heldReply(text, req.headers["content-type"]));
+            };
+            const answer = () => {
+              if (w) heldRow(w.u, w.method, text, req.headers["content-type"], w.ctx);
+              res.writeHead(200, { "content-type": "application/json" });
+              res.end(heldReply(text, req.headers["content-type"]));
+            };
+            // A body that only reads, known now that it is here, goes on as it was sent.
+            if (w && parts.length < 256 && readsOnly(text, w.u, headerOf, w.port)) return forward(null);
+            // A call to a Qdrant collection goes to the run's copy of it, made now when this is its first write.
+            if (w && w.copy) return copyOf(w.u, headerOf, w.copy).then((clone) => (clone ? forward(toCopy(w.u, clone, w.copy.call)) : answer()), answer);
+            answer();
           });
         });
         server[HELD] = true;
@@ -917,12 +997,19 @@ if (FILE) {
       const method = String(o.method || "GET").toUpperCase();
       const u = new URL(`${secure ? "https" : "http"}://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}${path.startsWith("/") ? path : "/" + path}`);
       const headerOf = (name) => headerIn(o.headers, name) || (name === "authorization" && o.auth ? `Basic ${Buffer.from(String(o.auth)).toString("base64")}` : "");
-      return heldHere(u, method, headerOf) ? { u, method, o, args: args.filter((a) => typeof a !== "function"), port: o.port || (given && given.port) || "", cb: args.find((a) => typeof a === "function") } : null;
+      const port = o.port || (given && given.port) || "";
+      // The server's address whole, port included, names a collection's copy; the hold is decided on
+      // the host alone, as before.
+      const at = new URL(u.href);
+      if (port) at.port = String(port);
+      const g = guarded(at, method);
+      if (!g && !heldHere(u, method, headerOf)) return null;
+      return { u: at, method, o, args: args.filter((a) => typeof a !== "function"), port, cb: args.find((a) => typeof a === "function"), ...(g && !g.hold ? { copy: g } : {}) };
     };
     const httpRequest = http.request;
-    const sendHeld = ({ u, method, o, cb, args, port }, secure) => {
+    const sendHeld = ({ u, method, o, cb, args, port, copy }, secure) => {
       const id = String(++heldSent);
-      heldWaiting.set(id, { u, method, ctx: als.getStore(), args, port, secure });
+      heldWaiting.set(id, { u, method, ctx: als.getStore(), args, port, secure, copy });
       const headers = { ...(o.headers && typeof o.headers === "object" && !Array.isArray(o.headers) ? o.headers : {}), "x-cortad-held": id };
       // Port 1 answers nothing: a write held before the server listens fails instead of leaving.
       const req = httpRequest({ host: "127.0.0.1", port: heldPort || 1, method, path: u.pathname + u.search, headers, ...(o.timeout ? { timeout: o.timeout } : {}), ...(o.signal ? { signal: o.signal } : {}) }, cb);
@@ -943,15 +1030,31 @@ if (FILE) {
     const bodyText = (body) => (typeof body === "string" ? body : Buffer.isBuffer(body) ? body.toString("utf8") : body instanceof Uint8Array ? Buffer.from(body).toString("utf8") : "");
     if (typeof globalThis.fetch === "function") {
       const realFetch = globalThis.fetch;
+      // A call to a Qdrant collection, sent again through this same wrapper at the copy's address, so
+      // it is recorded like any retrieval; held when no copy could be made.
+      const guardedFetch = async (self, wrapped, input, init, u, method, g) => {
+        if (g.hold) return heldFetch(realFetch, input, init);
+        const req = new Request(input, init);
+        const clone = await (typeof g.copy === "string" ? g.copy : copyOf(u, (name) => req.headers.get(name) || "", g));
+        if (!clone) return heldFetch(realFetch, input, init);
+        const body = method === "GET" || method === "HEAD" ? undefined : await req.arrayBuffer();
+        return wrapped.call(self, toCopy(u, clone, g.call).href, { method, headers: req.headers, body, signal: req.signal });
+      };
       globalThis.fetch = function (input, init) {
         let url = null;
         let hold = false;
+        let guard = null;
+        let at = null;
+        let method = "GET";
         try {
           const u = new URL(typeof input === "string" ? input : input && input.url ? input.url : String(input));
+          at = u;
           if (isModelCall(u.host, u.pathname)) url = u;
-          const method = String((init && init.method) || (input && input.method) || "GET").toUpperCase();
-          hold = !url && heldHere(u, method, (name) => new Headers((init && init.headers) || (input && input.headers) || undefined).get(name));
+          method = String((init && init.method) || (input && input.method) || "GET").toUpperCase();
+          guard = !url ? guarded(u, method) : null;
+          hold = !url && !guard && heldHere(u, method, (name) => new Headers((init && init.headers) || (input && input.headers) || undefined).get(name));
         } catch { /* not a URL we can read */ }
+        if (guard) return guardedFetch(this, globalThis.fetch, input, init, at, method, guard);
         if (hold) return heldFetch(realFetch, input, init);
         if (!url) {
           // Every outbound host, named by the setting that points at it when one does, and by the

package/lib/verbs.mjs

@@ -193,8 +193,8 @@ export function makeVerbs({ api, token, runner = () => null, fetchImpl = fetch,
     return [logSaid(appFailed(d)), back].filter(Boolean).reduce(withBack, runText(withTested(d, id)));
   };
 
-  // `npx cortad wait`: returns when the next run ends, started from the browser or by the agent, with
-  // what it found. A coding agent starts it in the background and is woken when it exits; it is a shell
+  // `npx cortad wait`: returns when the next run or verify ends, started from the browser or by the
+  // agent, with what it found. A coding agent starts it in the background and is woken when it exits; it is a shell
   // verb alone, since an MCP call is cut at about 60 seconds. A run playing when it starts is that run,
   // and so is a finished one the agent has not read: a first run can end before the agent starts this.
   const wait = async () => {
@@ -211,10 +211,13 @@ export function makeVerbs({ api, token, runner = () => null, fetchImpl = fetch,
       if ([401, 403, 404].includes(res.status)) return failed(res);
       if (res.ok && id && finished(res.data)) {
         const text = shown(res.data, id).replace(/\nnext: [^\n]*$/, "");
-        return { text: `${text}\nnext: findings ${res.data.jobId ?? id}`, data: res.data };
+        // A verify's verdict is read by run_status; a run's problems by findings.
+        return { text: `${text}\nnext: ${res.data.verify ? `run_status ${id}` : `findings ${res.data.jobId ?? id}`}`, data: res.data };
       }
       const r = res.ok && !id ? res.data?.run : null;
-      if (r?.jobId && r.kind !== "verify" && (!finished(r) || !wasRead(r.jobId))) { id = r.jobId; continue; }
+      // A verify is followed like a run: the agent that started it is woken at its end instead of
+      // polling run_status twelve times a round.
+      if (r?.jobId && (!finished(r) || !wasRead(r.jobId))) { id = r.jobId; continue; }
       // A run being followed holds on the server; a failed call, or no run yet, is asked again later.
       if (!id || !res.ok) await sleep(WAIT_POLL_MS);
     }

package/lib/wire.cjs

@@ -481,6 +481,30 @@ const passagesIn = (sent) => {
 const RETRIEVAL_HOST = /pinecone\.io|qdrant|weaviate|chroma|zilliz|milvus|turbopuffer|upstash\.io|algolia|typesense|meilisearch|elastic|opensearch|vespa|tavily\.com|exa\.ai|serper\.dev|serpapi\.com|search\.brave\.com|bing\.microsoft\.com|jina\.ai/i;
 const RETRIEVAL_PATH = /\/(?:query|search|_search|retrieve|similarity_search|rerank|hybrid)(?:\/|$)|\/points\/(?:search|query)|\/rpc\/match\w*/i;
 const isRetrieval = (u) => RETRIEVAL_HOST.test(u.hostname) || RETRIEVAL_PATH.test(u.pathname);
+// A call to one Qdrant collection, by Qdrant's own REST shape: /collections/{name}[/...]. `write`:
+// the call changes the collection. Every PUT, PATCH and DELETE does; a POST does unless it is one
+// of Qdrant's reads spelled as a POST (search, query, scroll, recommend, discover, count, facet, a
+// retrieve of points by id at /points itself). A path under /collections that names no collection
+// (/collections/aliases) is a write of the server, not of one collection: `collection` is null.
+// `kind`, on a write: "points" changes what the collection holds (an upsert, a delete, a payload or
+// vector change, a batch) and is what a copy stands in for; "create" makes the collection; anything
+// else ("schema": a payload index, an alias, a snapshot, a shard, the collection's own settings or
+// its deletion) changes the collection's shape and is held, never copied. ulaim creates a payload
+// index on every one of its 300 collections at its first request, and copying each of them for
+// that filled its cluster with copies and its searches with 503s.
+const QDRANT_COLLECTION = /^\/collections\/([^/]+)(\/.*)?$/;
+const QDRANT_READ_POST = /^\/points(?:\/(?:search|query|recommend|discover)(?:\/(?:batch|groups))?|\/scroll|\/count|\/facet|\/search\/matrix\/(?:pairs|offsets))?$/;
+const QDRANT_POINTS = /^\/points(?:\/(?:delete|payload|payload\/delete|payload\/clear|vectors|vectors\/delete|batch))?(?:\?.*)?$/;
+const qdrantCall = (u, method) => {
+  const m = QDRANT_COLLECTION.exec(u.pathname);
+  if (!m) return null;
+  const [, name, rest = ""] = m;
+  const collection = name === "aliases" ? null : decodeURIComponent(name);
+  const verb = String(method || "GET").toUpperCase();
+  const write = verb === "PUT" || verb === "PATCH" || verb === "DELETE" || (verb === "POST" && !QDRANT_READ_POST.test(rest));
+  const kind = !write ? null : rest === "" && verb === "PUT" ? "create" : QDRANT_POINTS.test(rest) && verb !== "DELETE" ? "points" : "schema";
+  return { collection, rest, write, kind };
+};
 const PASSAGE_KEY = /^(?:text|content|page_?content|pageContent|chunk|snippet|passage|body|document|documents|description|answer|raw_content|highlights?|excerpt)$/i;
 const passagesFrom = (raw) => {
   const out = [];
@@ -880,6 +904,6 @@ function makeRecorder({ row, rulesFile, onTurn = () => {}, onEnded = () => {} })
 
 module.exports = {
   MAX, REPLY_MAX, EMBEDDING, TOOL_TEXT, MODEL_HOST,
-  scrubbed, list, clipped, argsText, turnOf, toolText, isModelCall, isRetrieval, passagesFrom, decoded, cookieNames,
+  scrubbed, list, clipped, argsText, turnOf, toolText, isModelCall, isRetrieval, qdrantCall, passagesFrom, decoded, cookieNames,
   fitted, makeRecorder, asChat, GATEWAY_MODEL,
 };

package/local.mjs

@@ -134,10 +134,11 @@ async function holdProject() {
 // A verb waits on this record from the moment it starts this process, so it is taken first.
 if (viaToken) await holdProject();
 
-// ---- what leaves the machine: the source git would commit, and nothing git is told to ignore
+// ---- what leaves the machine
 const SKIP_DIR = /^(node_modules|\.git|dist|build|out|coverage|vendor|venv|\.venv|env|target|tmp|\.next|\.nuxt|\.turbo|\.cache|__pycache__|\.terraform|\.wrangler|\.svelte-kit|\.output|\.parcel-cache|\.idea|\.vscode|secrets?|\.secrets?)$/i;
 // Env files by any name (scripts/books.env is one), keys, credentials, media and compiled output.
 const SKIP_FILE = /^\.env(\..*)?$|^\.envrc$|\.env$|\.(pem|key|p12|pfx|jks|keystore|sqlite|sqlite3|db|log|lock|map|zip|tar|gz|tgz|7z|rar|png|jpe?g|gif|webp|ico|svg|mp3|mp4|wav|mov|pdf|woff2?|ttf|otf|eot|bin|exe|dll|so|dylib|wasm|onnx|pt|pth|safetensors|numbers|DS_Store)$/i;
+const EVALS = /(?:^|\/)(?:evals?|evaluations?|benchmarks?|gold(?:ens?)?|red[-_]?team)\/|(?:^|[\/._-])(?:evals?|evaluations?|gold(?:en)?|benchmarks?|fidelity|red[-_]?team|cases)(?:[._-][^\/]*)?$/i;
 const MAX_FILE = 25_000_000;
 const MAX_TOTAL = 256_000_000;
 const ENV_FILE = /^\.env(\.(local|staging|stage|development|dev|test|example|sample))?$/;
@@ -178,7 +179,7 @@ function gitListed() {
 function shareable(rel, askGit = true) {
   const parts = rel.split(sep);
   if (parts.slice(0, -1).some((d) => SKIP_DIR.test(d)) || SKIP_FILE.test(parts.at(-1))) return false;
-  if (listed === null || listed.has(rel)) return true;
+  if (listed === null || listed.has(rel) || EVALS.test(parts.join("/"))) return true;
   // Off the list git gave a moment ago: ignored, or inside a nested checkout. The walk takes git's
   // word for it; asking per file was one process each, two minutes on a repository with a worktree
   // inside it. A read asked later, of a file made after the list was taken (an agent edit), asks.
@@ -947,6 +948,7 @@ const keeping = makeKeeping({
   root, work, ledgerFile: join(homeOf(project), "made.json"), onPath, say, hold, typed: Boolean(flag("--start")),
   launch: (plan) => sidecar(plan.cmd, plan.cwd),
   connections: () => capture?.connections() ?? [],
+  copies: () => capture?.copies() ?? [],
   settings: () => {
     const from = {};
     for (const file of envFiles.filter((f) => !/\.(example|sample)$/.test(f))) {
@@ -1262,7 +1264,8 @@ const firstStart = startApp();
 firstStart.catch(() => { /* appLife reads the failure */ });
 const archive = join(work, "tree.tgz");
 step("connecting");
-await exec("tar", ["-czf", archive, "-C", root, "-T", list]);
+// COPYFILE_DISABLE: a Mac's tar adds no "._name" entries.
+await exec("tar", ["-czf", archive, "-C", root, "-T", list], { env: { ...process.env, COPYFILE_DISABLE: "1" } });
 const bytes = readFileSync(archive);
 const PART = 1_500_000;
 let resumed = false;
@@ -1516,9 +1519,12 @@ const autoReach = makeAutoReach({
   stampOf: (m) => { try { return m.file ? String(statSync(join(root, m.file)).mtimeMs) : ""; } catch { return ""; } },
   asked: () => existsSync(join(homeOf(project), ASK)),
   report: async (answers) => {
-    if (!answers.length && reachedBox === box) return;
+    if (!answers.length && reachedBox === box) return true;
     const to = box;
-    if ((await call("POST", `/local/${to}/reached`, { answers }, { timeoutMs: 15_000 })).ok) reachedBox = to;
+    // False where the server did not take it: the answers are kept and said again (lib/auto-reach.mjs).
+    const ok = Boolean((await call("POST", `/local/${to}/reached`, { answers }, { timeoutMs: 15_000 }).catch(() => null))?.ok);
+    if (ok) reachedBox = to;
+    return ok;
   },
   say,
   fetchImpl: countedFetch,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortad",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Connects the AI app on your machine to Cortad for test conversations, and gives your coding agent the MCP and skill to run them. No dependencies.",
   "bin": {
     "cortad": "local.mjs"

package/skill/SKILL.md

@@ -34,22 +34,23 @@ The connect command prints "Go back to the browser" once it is connected. Cortad
    - each `For the person:` line, as printed.
 2. When `status` lists an endpoint as `Needs a signed-in user`, Cortad could not make a sign-in for it on this machine. Tell the person; when they ask for it, sign in a test account through the app's own sign-in on this machine, send that endpoint one request in that session, then call `status` again. That is the only sign-in this needs, and only for the endpoints listed that way.
 3. A failure on the app's side that every conversation would repeat, such as a model provider refusing, a retrieval with no answer or a tool returning an error: say what you would change, change it when the person agrees, then call `reach` to send Cortad's test request to that endpoint again.
-4. The first run starts by itself once every endpoint has answered or failed; the person can also press Run on the card, or ask you, and then you call `run`. Before you stop, start `npx -y {{cortad}} wait` as a background command (in Claude Code: Bash with run_in_background). It returns when the next run ends, with what it found, and its ending wakes you. Then follow "After a run".
+4. The first run starts when the person presses Run on the card, or asks you, and then you call `run`. Before you stop, start `npx -y {{cortad}} wait` as a background command (in Claude Code: Bash with run_in_background). It returns when the next run or verify ends, with what it found, and its ending wakes you. Then follow "After a run".
 
 `status` with `show` lists one section in full: `rules`, `standards`, `journeys`, `endpoints`, `trials`, `records` or `reviews` (in a shell, `npx {{cortad}} status rules`). `status` with show `machine` says what Cortad does on this machine; hand the person its `For the person:` lines when they ask.
 
 ## After a run
 
-The person asked for this when they connected Cortad: fix what a run found and check each fix.
+The run is Cortad's; the code is the person's. You report first, and you change nothing until they say so.
 
-1. Tell the person in three lines: how many conversations played; the run's "All N conversations" line as printed, how many completed their request fully or partly with its rate and range; the two worst problems at their file and line.
-2. Call `findings` and fix the worst problem: one change, in the file and near the line it names. Then `verify <findingId>` and follow it with `run_status` until it decides.
-3. Go on to the next problem until each one is fixed or needs a decision only the person can make; tell them that decision in one line.
-4. After the last verify, tell the person what each verify decided, then start `npx -y {{cortad}} wait` in the background again.
+1. Call `findings`. Tell the person, in plain lines: how many conversations played and how many completed their request, with the rate and range as printed; each problem worth their time, worst first, with its file and line and what you would change there in one line; which findings read their app wrong (see "A check that reads wrong"); and which problems need a decision only they can make.
+2. Then stop, and let them answer. Until their go, nothing is edited, no verify starts and no run starts. They choose which problems to fix, in what order, and whether the change you propose fits their product.
+3. On their go, one problem at a time: one change, in the file and near the line the finding names, then `verify <findingId>`. Its first line says how many conversations the round replays and what that counts against this month; start `npx -y {{cortad}} wait` in the background, and it wakes you when the verify ends, so `run_status` is called once at most.
+4. Tell them what the verify decided, in its own words; the next change comes after their next go. A verify that cannot tell offers another round in its last line; it plays only when you call `verify` again, and only when the person wants it.
+5. When they stop, say what changed, what each verify decided, and what is still open, then start `npx -y {{cortad}} wait` in the background again.
 
 ## Following a run
 
-`run` answers within a second; when the app is still starting it says so, and `run_status` holds until the run has an id. `run_status` follows the run this machine started last, or the latest run. Each call holds up to 45 seconds, returns as soon as the count moves, and ends with the next call; call it again rather than a shell loop. Hand the person its `For the person:` line at most once every two minutes. When the plan is spent, `run` says so and nothing runs.
+`run` answers within a second; when the app is still starting it says so, and `run_status` holds until the run has an id. `run_status` follows the run this machine started last, or the latest run. Each call holds up to 45 seconds, returns as soon as the count moves, and ends with the next call; `npx -y {{cortad}} wait` in the background does the following for you and wakes you at the end of a run or a verify. Hand the person its `For the person:` line at most once every two minutes. When the plan is spent, `run` says so and nothing runs.
 
 ## The first run: the baseline
 
@@ -65,8 +66,8 @@ The first finished run on a repository prints, in order: what ran; the simulated
 
 ## Fixing one finding
 
-1. One change, in the file and near the line the finding names.
-2. `verify <findingId>` replays the conversations the finding failed on, word for word, against the saved edit; Cortad starts the app again first when its code changed. Undecided after a round, it plays another by itself, and `run_status` follows every round under the same id. A `crash:N` finding replays the requests that were out when the app stopped.
+1. One change, in the file and near the line the finding names, after the person's go.
+2. `verify <findingId>` replays the conversations the finding failed on, word for word, against the saved edit; Cortad starts the app again first when its code changed. Its first line says how many conversations the round replays and what they count against. Undecided after a round, it says what another round would play; that round starts only when `verify` is called again. A `crash:N` finding replays the requests that were out when the app stopped.
 3. Read the verdict. Replies the app refused or failed on the replay come first.
    - Worse on the conversations saved to test the fix: undo the change, and aim the next one at the behavior the question asks about.
    - Gone on the saved conversations while its own still fail: keep the fix; a reply that changed is another problem to fix next.

package/skill/references/results.md

@@ -98,7 +98,7 @@ Rules in the code: 16, in 5 files.
 Sends Cortad's test request again, from the connect command on this machine, after a fix:
 
 ```
-Sent 1 request to your app on port 3100, one at a time:
+Sent 1 request to your app on port 3100, up to four at a time:
   POST /api/homework/explain: 200 in 2.4 seconds.
 status shows which of them reached your model.
 next: status