cowork-harness 2.2.0 → 2.3.0

package/dist/run/cassette.js

@@ -2718,8 +2718,10 @@ export function hostInventoryPreflight(scenario, plannedCassettePath, allowed) {
     const blocked = HOSTLOOP_ONLY_KEYS.filter((k) => (scenario.assert ?? []).some((a) => a[k] !== undefined));
     const fix = blocked.length
         ? `  Fix: this scenario asserts ${blocked.join(", ")}, which only evaluate at hostloop — 'container' is not ` +
-            `available to it. Audit the session (personal MCP servers, plugins, account metadata) and re-run with ` +
-            `--allow-host-inventory-fixture once you're satisfied the recording carries none.\n`
+            `available to it. Re-run with --allow-host-inventory-fixture to get past THIS check — you do not have ` +
+            `to audit the session by hand: the finished recording is still scanned, and a real finding still ` +
+            `refuses the write and quarantines it (--allow-host-inventory-findings is the separate consent to ` +
+            `write a flagged one).\n`
         : `  Fix: record at 'container' fidelity (sealed, HOME=/tmp) — it inherits nothing from this machine, so the ` +
             `cassette stays committable AND verifiable.\n`;
     return {
@@ -2731,7 +2733,10 @@ export function hostInventoryPreflight(scenario, plannedCassettePath, allowed) {
             `relative to its own directory, so one written outside the tree can never resolve them again — ` +
             `verify-cassettes reports it 'unverifiable' for staleness (can't verify ⇒ not green) and only a ` +
             `re-record recovers.\n` +
-            `  Override with --allow-host-inventory-fixture if this session has no personal MCP servers or plugins.`,
+            `  Override with --allow-host-inventory-fixture to proceed to the recording. That is a bypass of THIS ` +
+            `check only: the finished cassette is still scanned for real host-inventory findings before it is ` +
+            `written, and a finding still refuses the write and quarantines the recording. You do not have to ` +
+            `audit the session by hand to pass this flag — the scan is the actual gate.`,
     };
 }
 export function redactionPreflightMessage(items) {
@@ -2847,6 +2852,7 @@ export const RECORD_BOOLEAN_FLAGS = [
     "--dry-run",
     "--decider-llm",
     "--allow-host-inventory-fixture",
+    "--allow-host-inventory-findings",
 ];
 export const RECORD_VALUE_FLAGS = [
     "--out",
@@ -2885,8 +2891,10 @@ export const RECORD_ALLOWLIST = [
 // `replay` and `verify-cassettes` are unified onto (a) below, replacing the two independently-drifted
 // copies each one had (cli.ts's was already a superset for `replay`; `verify-cassettes`' two copies had
 // textually diverged --margins prose — the cli.ts wording is kept as the single source).
-export const RECORD_USAGE = "usage: record <scenario.yaml | dir/> [--out <file>] [--output-format text|json] [--rerecord-stale] [--from-embedded] [--force] [--no-redact] [--allow-failing] [--max-artifact-bytes <n>] [--dry-run] [--concurrency <N>] [--max-budget-usd <x>] [--allow-host-inventory-fixture]\n" +
-    "       --allow-host-inventory-fixture: proceed when recording at protocol/hostloop into a repo-visible path. Those tiers inherit the host env, so the cassette would freeze THIS machine's MCP servers/agents/account into a committed fixture; the record is refused by default. Use only when the session has no personal MCP servers or plugins.\n" +
+export const RECORD_USAGE = "usage: record <scenario.yaml | dir/> [--out <file>] [--output-format text|json] [--rerecord-stale] [--from-embedded] [--force] [--no-redact] [--allow-failing] [--max-artifact-bytes <n>] [--dry-run] [--concurrency <N>] [--max-budget-usd <x>] [--allow-host-inventory-fixture] [--allow-host-inventory-findings]\n" +
+    "       --allow-host-inventory-fixture: proceed PAST THE PRE-FLIGHT when recording at protocol/hostloop into a repo-visible path. Those tiers inherit the host env, so the cassette could freeze THIS machine's MCP servers/agents/account into a committed fixture; the record is refused by default. This bypasses that pre-flight only — the finished recording is still scanned, and a real finding still refuses the write and quarantines it.\n" +
+    "       --dry-run: resolve and CHECK without recording. A single scenario file runs every pre-spend refusal the real record runs (prompt policy, assert contradictions, host-inventory, slug collision) and refuses identically — same --out, same flags, so the verdict is binding. A DIRECTORY reports the path-dependent ones as advisory 'would-refuse'/'would-warn' notes instead, labelled by verdict kind (a dir target takes no --out, so the destination is a guess), and gates only on the path-independent ones.\n" +
+    "       --allow-host-inventory-findings: write a recording the scan DID flag. The separate, louder decision; needed only when the captured inventory is genuinely part of the fixture.\n" +
     "       --concurrency <N>: record a dir/ batch (or --rerecord-stale) N at a time (default 1, max 8). Runs are fully isolated; the bound is for Docker address pool + API rate limits.\n" +
     "       --max-budget-usd <x>: refuse before spending if prior-run history says this scenario (or, on a batch, the whole batch) has cost more than x.\n" +
     "                             At --concurrency 1 a running total also stops the batch once x is reached; above that it is a pre-flight estimate only.\n" +
@@ -2929,6 +2937,7 @@ export async function cmdRecord(args) {
     }
     const noRedact = p.flags["--no-redact"] ?? false;
     const allowHostInventoryFixture = p.flags["--allow-host-inventory-fixture"] ?? false;
+    const allowHostInventoryFindings = p.flags["--allow-host-inventory-findings"] ?? false;
     if (noRedact)
         log("record: --no-redact — content redaction is OFF; the cassette is written verbatim, so ensure inputs are synthetic.");
     const allowFailing = p.flags["--allow-failing"] ?? false;
@@ -3048,6 +3057,15 @@ export async function cmdRecord(args) {
             // one scenario-level refusal but not its sibling.
             const parsedNames = [];
             const refusals = [];
+            // Path-dependent verdicts are ADVISORY on this arm, never refusals. Measured on a real consumer:
+            // running the host-inventory pre-flight here against `defaultCassettePath(sc.name)` refused 26 of 27
+            // scenarios that the real record accepts — because their CI dry-runs the directory from the repo root
+            // while the real record writes elsewhere with `--out`, and decides the override PER SCENARIO from the
+            // filesystem (`[ -f cassettes/$n… ] || --allow-host-inventory-fixture`). This arm knows neither the
+            // `--out` path (dir targets reject it) nor the per-item flags, so its verdict is a GUESS — and a guess
+            // must not gate. A preview that refuses what the real path allows is worse than one that stays quiet:
+            // it teaches operators to stop trusting the preview.
+            const notes = [];
             for (const f of disc.scenarios) {
                 let sc;
                 try {
@@ -3057,10 +3075,32 @@ export async function cmdRecord(args) {
                     continue; // already classified as `broken` by discoverScenarios
                 }
                 parsedNames.push(sc.name);
+                // Path-INDEPENDENT: these are the real verdicts on any path, so they still refuse.
                 const why = promptPolicyRejection(sc) ?? assertContradiction(sc);
                 if (why)
                     refusals.push({ file: f, message: why });
+                // Path-dependent: reported, never gating. `preSpendVerdicts` re-runs promptPolicyRejection, which is
+                // already covered above — drop that one here rather than reporting it twice.
+                for (const v of preSpendVerdicts(sc, defaultCassettePath(sc.name), {
+                    allowHostInventoryFixture,
+                    scenarioSourceFile: f,
+                })) {
+                    if (v.message === why)
+                        continue;
+                    // Carry the VERDICT KIND, not just the message. Labelling every note "would-refuse" was a false
+                    // claim on the one arm whose design principle is "do not assert what you cannot know":
+                    // `cassettePortabilityPreflight` never returns `refuse` at all (only `ok`/`warn`), and
+                    // `hostInventoryPreflight` returns `warn` whenever the target cassette already exists — which is
+                    // every re-record corpus sitting at the default path. Those were announced as refusals the real
+                    // record would make, and it would not.
+                    notes.push({ file: f, message: v.message, kind: v.kind });
+                }
             }
+            // The real dir-batch refuses this before its first spawn (see duplicateCassetteTargets). It is
+            // path-independent on both arms — a dir target rejects `--out` — so the preview refuses too rather
+            // than merely noting it.
+            for (const d of duplicateCassetteTargets(disc.scenarios))
+                refusals.push({ file: d.split(" ↔ ")[0], message: `two scenarios share a cassette output path: ${d}` });
             // Free by construction (a run-history lookup), so it is reported whether or not a cap was passed.
             const estimate = estimateBatchCost(parsedNames);
             if (asJson) {
@@ -3071,6 +3111,9 @@ export async function cmdRecord(args) {
                     skipped: disc.skipped,
                     broken: disc.broken,
                     refusals,
+                    // Advisory; deliberately a separate key from `refusals` so automation cannot mistake a guess
+                    // for a verdict, and does not gate on it.
+                    notes,
                     estimatedCostUsd: estimate.known,
                     unpricedScenarios: estimate.unpriced,
                     // The basis for `estimatedCostUsd`, so automation need not treat it as a bound. It is
@@ -3089,6 +3132,22 @@ export async function cmdRecord(args) {
                 // loud on failure" and must survive it, exactly as `broken:` does.
                 for (const r of refusals)
                     log(`✗ refused: ${r.file}: ${r.message}`);
+                // Advisory only, and SUPPRESSED BY --quiet: unlike a refusal, a note is part of the preview, and a
+                // batch of 26 would otherwise bury a real refusal in a CI log that asked for quiet. (Measured on a
+                // real consumer: their `--dry-run --quiet` CI step produces exactly that many.)
+                //
+                // The underlying messages are written for the REAL path, so they say "refusing". Prefixed here to
+                // say what this arm actually knows — otherwise the reader sees "refusing" beside exit 0 and cannot
+                // tell which one is true.
+                if (!quiet) {
+                    for (const n of notes)
+                        log(`⚠ would-${n.kind === "warn" ? "warn" : "refuse"} (advisory): ${n.file}: ${n.message}`);
+                    if (notes.length)
+                        log(`  ↑ ADVISORY, not this run's verdict: computed against the DEFAULT cassette path because a ` +
+                            `directory target takes no --out. A real record's --out/--force/--allow-host-inventory-fixture ` +
+                            `may change every one of them, so they do NOT affect this exit code. Dry-run a single scenario ` +
+                            `file with the real flags to get a binding answer.`);
+                }
             }
             if (disc.scenarios.length === 0) {
                 if (disc.broken.length === 0) {
@@ -3131,17 +3190,36 @@ export async function cmdRecord(args) {
         catch (e) {
             return fail("record", "usage", `record --dry-run: cannot parse scenario: ${e.message}`, undefined, asJson);
         }
-        const promptReject = promptPolicyRejection(scenario);
-        if (promptReject)
-            return fail("record", "usage", promptReject, undefined, asJson);
-        // Same rule as promptPolicyRejection directly above, and as the budget gate below: a refusal the
-        // real `record` would raise has to raise here too, or this preview is false. Pure and spend-free.
+        // `assertContradiction` is NOT in preSpendVerdicts: on the real path it fires from inside
+        // `executeScenario` (execute.ts), which every lane funnels through — including library callers that
+        // never touch this file. Checked here explicitly so the preview matches.
         const contradiction = assertContradiction(scenario);
         if (contradiction)
             return fail("record", "usage", contradiction, undefined, asJson);
         // mirror the EXACT default cassette path recordScenarioObject uses (slugForPath via the shared
         // defaultCassettePath helper) so a name with spaces/separators reports the same path it writes.
         const cassettePath = p.options["--out"] ?? defaultCassettePath(scenario.name);
+        // THE SHARED BLOCK, on the arm that can preview it faithfully. This arm knows the exact `--out` path
+        // and the exact flags the real record will get, so its verdicts ARE the real ones — it refuses.
+        // (The BATCH arm cannot; see the advisory note there.) `target` IS the scenario source here, so the
+        // portability reference root resolves exactly as it will on the real record.
+        //
+        // Computed BEFORE the payload envelope below: emitting `ok: true` and then a refusal would put two
+        // envelopes on stdout with the first one green — a false green for any JSON consumer that reads the
+        // first line. (Caught by writing it the other way round first.)
+        const verdicts = preSpendVerdicts(scenario, cassettePath, {
+            force,
+            explicitOutPath: p.options["--out"] !== undefined,
+            allowHostInventoryFixture,
+            scenarioSourceFile: target,
+        });
+        const dryRefusal = verdicts.find((v) => v.kind === "refuse");
+        // Warnings ride along with the preview in both modes; a refusal replaces it.
+        if (!dryRefusal)
+            for (const v of verdicts)
+                warn(v.message);
+        if (dryRefusal)
+            return fail("record", "usage", dryRefusal.message, undefined, asJson);
         if (asJson) {
             out(jsonPayloadEnvelope("record", true, {
                 dryRun: true,
@@ -3163,12 +3241,6 @@ export async function cmdRecord(args) {
             log(tokenLine);
             log(agentLine);
         }
-        // Part of the preview for the same reason the budget gate is: a rehearsal whose whole job is "tell me
-        // what this would do before I spend" must surface the thing that cannot be undone afterwards. `target`
-        // IS the scenario source here, so the reference root resolves exactly as it will on the real record.
-        const dryPort = cassettePortabilityPreflight(scenario, cassettePath, target);
-        if (dryPort.kind === "warn")
-            warn(dryPort.message);
         // See the dir branch above: the budget gate is part of the preview, not skipped by it.
         if (maxBudgetUsd !== undefined)
             preflightBudget("record", scenario.name, maxBudgetUsd, asJson);
@@ -3264,6 +3336,7 @@ export async function cmdRecord(args) {
                         maxArtifactBytes,
                         skipRedactionPreflight: true,
                         allowHostInventoryFixture,
+                        allowHostInventoryFindings,
                     });
                 }
                 else if (!fromEmbedded) {
@@ -3279,7 +3352,15 @@ export async function cmdRecord(args) {
                     // --from-embedded: explicitly re-record from the embedded snapshot (edits to the YAML won't apply).
                     log(`  ⚠ ${tag} --from-embedded: re-recording "${cassette.scenario.name}" from the embedded snapshot (YAML edits won't apply)`);
                     const sessionRef = cassette.scenario.session === "(inline)" ? "(inline)" : join(dirname(cp), cassette.scenario.session);
-                    r = await recordScenarioObject({ ...cassette.scenario, session: sessionRef }, { noRedact, allowFailing, cassettePath: cp, maxArtifactBytes, skipRedactionPreflight: true, allowHostInventoryFixture });
+                    r = await recordScenarioObject({ ...cassette.scenario, session: sessionRef }, {
+                        noRedact,
+                        allowFailing,
+                        cassettePath: cp,
+                        maxArtifactBytes,
+                        skipRedactionPreflight: true,
+                        allowHostInventoryFixture,
+                        allowHostInventoryFindings,
+                    });
                 }
                 staleBudget.add(budgetFields(r.result).costUsd);
                 log(`  ✓ ${tag} ${cp} (${r.result.result})`);
@@ -3310,22 +3391,7 @@ export async function cmdRecord(args) {
         // (last-wins sequentially; a write RACE under --concurrency). Detect up front and fail loud — applies at
         // any concurrency since the sequential clobber is itself a latent bug. (`--out` is dir-rejected above, so
         // every item uses its default path.)
-        const targets = new Map();
-        const dupes = [];
-        for (const f of disc.scenarios) {
-            let cp;
-            try {
-                cp = defaultCassettePath(parseScenarioFile(f).name);
-            }
-            catch {
-                continue; // unparseable here would have been classified `broken`; let the record path report it
-            }
-            const prev = targets.get(cp);
-            if (prev)
-                dupes.push(`${f} ↔ ${prev} → ${cp}`);
-            else
-                targets.set(cp, f);
-        }
+        const dupes = duplicateCassetteTargets(disc.scenarios);
         if (dupes.length) {
             return fail("record", "usage", `record: ${dupes.length} scenario(s) share a cassette output path (their \`name:\` slugifies identically) — would clobber/race; give them distinct \`name:\`:\n` +
                 dupes.map((d) => `  ✗ ${d}`).join("\n"), undefined, asJson);
@@ -3385,6 +3451,7 @@ export async function cmdRecord(args) {
                     maxArtifactBytes,
                     skipRedactionPreflight: true,
                     allowHostInventoryFixture,
+                    allowHostInventoryFindings,
                     ...liveDecider,
                 });
                 batchBudget.add(budgetFields(r.result).costUsd);
@@ -3432,6 +3499,7 @@ export async function cmdRecord(args) {
             cassettePath,
             maxArtifactBytes,
             allowHostInventoryFixture,
+            allowHostInventoryFindings,
             externalChannel: channel,
             ...liveDecider,
         });
@@ -3478,6 +3546,85 @@ export function nullOutScrubbedPreRunHashes(preRunHashes, scrubbedPaths) {
 /** The live-record TAIL shared by the file (batch/single) and in-memory (re-record) paths: run live, refuse
  *  a failing run unless opted in, snapshot + secret-scrub bodies, opt-in redact + verdict-preserve,
  *  then write. `extraPolicyDirs` adds the scenario-file dir to the .cowork-redact.json search. */
+/** Scenario files in a batch whose `name:` slugifies to the SAME default cassette path — they would clobber
+ *  each other (last-wins sequentially, a write RACE under `--concurrency`).
+ *
+ *  Shared by the real dir-batch and its `--dry-run` preview. Path-INDEPENDENT in the sense that matters: a
+ *  dir target rejects `--out`, so every item genuinely uses its default path on both arms — which is why
+ *  this one REFUSES in the preview while the host-inventory/portability notes only advise. */
+function duplicateCassetteTargets(files) {
+    const targets = new Map();
+    const dupes = [];
+    for (const f of files) {
+        let cp;
+        try {
+            cp = defaultCassettePath(parseScenarioFile(f).name);
+        }
+        catch {
+            continue; // unparseable here would have been classified `broken`; let the record path report it
+        }
+        const prev = targets.get(cp);
+        if (prev)
+            dupes.push(`${f} ↔ ${prev} → ${cp}`);
+        else
+            targets.set(cp, f);
+    }
+    return dupes;
+}
+/** Every pre-spend check `record` applies to ONE scenario, in one place, returning verdicts instead of
+ *  acting on them.
+ *
+ *  WHY THIS EXISTS. `record --dry-run` is the token-free rehearsal, and it used to re-implement this list
+ *  by hand — so it drifted. `hostInventoryPreflight` shipped 2026-08-04; `bbd5bf5` (2026-08-07), whose
+ *  commit title is literally "make --dry-run refuse what the real record refuses", swept in the two checks
+ *  that returned `string | undefined` and missed the one returning a `{kind}` verdict, which was already
+ *  wired into `recordScenarioObject`. It stayed missing for 19 days.
+ *
+ *  A registry of check objects was designed and rejected: it guarantees every REGISTERED check runs
+ *  everywhere, but nothing stops the next check being called inline and never registered — which is
+ *  exactly how the gap happened. One function that both the real path and the preview call cannot have
+ *  that failure mode, and `test/pre-spend-parity.test.ts` scans this file to keep it the only site.
+ *
+ *  ORDER IS PRESERVED from the historical inline sequence, because the FIRST refusal is the one the
+ *  operator sees and changing which one that is changes the error they get.
+ *
+ *  NOT here, deliberately — these are whole-BATCH checks, and forcing them per-scenario would emit N
+ *  warnings where the real path emits one: `redactionPreflightMessage` (batch-shaped, and gated on
+ *  `!skipRedactionPreflight && !noRedact`), `preflightBatchBudget`, and the duplicate-slug batch guard. */
+export function preSpendVerdicts(scenario, cassettePath, opts) {
+    const out = [];
+    const promptReject = promptPolicyRejection(scenario);
+    if (promptReject)
+        out.push({ kind: "refuse", message: promptReject });
+    // A host-inheriting tier freezes the recording machine's own inventory into the transcript, so writing
+    // that to a repo-tracked path publishes the operator's tool stack (this has happened).
+    const inv = hostInventoryPreflight(scenario, cassettePath, opts.allowHostInventoryFixture === true);
+    if (inv.kind !== "ok")
+        out.push(inv);
+    // Warn-only: after the run the tokens are gone and the only remedy is to spend them again at the right path.
+    const port = cassettePortabilityPreflight(scenario, cassettePath, opts.scenarioSourceFile);
+    if (port.kind === "warn")
+        out.push(port);
+    // Slug collision. Two DIFFERENT scenario names can slugify to the same default path and silently clobber
+    // each other. `--out`/`--force` opt out — a preview that ignored either would refuse what the real path
+    // allows, which is worse than not previewing at all.
+    if (!opts.explicitOutPath && !opts.force && existsSync(cassettePath)) {
+        try {
+            const existing = JSON.parse(readFileSync(cassettePath, "utf8"));
+            const existingName = existing.scenario?.name;
+            if (existingName && existingName !== scenario.name)
+                out.push({
+                    kind: "refuse",
+                    message: `refusing to overwrite ${cassettePath}: it belongs to scenario "${existingName}", but this record is "${scenario.name}" ` +
+                        `(their names slugify to the same default path — pass --out <file> to disambiguate, or --force to overwrite).`,
+                });
+        }
+        catch {
+            /* an unreadable/malformed existing cassette is not a collision signal — let the write proceed */
+        }
+    }
+    return out;
+}
 /** `on_unanswered: prompt` blocks on a TTY. `run` rejects it outright (it breaks determinism), and
  *  `record`'s own `--on-unanswered` enum excludes `prompt` for the same reason — but the SCENARIO field
  *  outranks the flag (`scenario.on_unanswered ?? opts.onUnanswered` in executeScenario), so the enum
@@ -3489,15 +3636,31 @@ export function promptPolicyRejection(scenario) {
         : undefined;
 }
 async function recordScenarioObject(scenario, opts, extraPolicyDirs = []) {
-    // Same guard as the --dry-run path, on the funnel every real record passes through (dir batches and
-    // --rerecord-stale never touch the dry-run branch).
-    const promptReject = promptPolicyRejection(scenario);
-    if (promptReject)
-        throw new Error(promptReject);
+    // ONE pre-spend block, shared with `record --dry-run` via `preSpendVerdicts` — see its doc comment for
+    // why the preview must not re-implement this list.
+    //
+    // Every refusal THROWS. It used to be split: `promptPolicyRejection` threw while `hostInventoryPreflight`
+    // called `fail()`, which `process.exit`s. The dir-batch loop catches a throw per item and continues, so
+    // the exiting one abandoned concurrent runs already paid for, mid-batch, uncatchably. Throwing uniformly
+    // keeps "report every offender" true for the whole set.
+    {
+        const plannedCassettePath = opts.cassettePath ?? defaultCassettePath(scenario.name);
+        for (const v of preSpendVerdicts(scenario, plannedCassettePath, {
+            force: opts.force,
+            explicitOutPath: opts.cassettePath !== undefined,
+            allowHostInventoryFixture: opts.allowHostInventoryFixture,
+            scenarioSourceFile: opts.scenarioSourceFile,
+        })) {
+            if (v.kind === "refuse")
+                throw new Error(v.message);
+            warn(v.message);
+        }
+    }
     // Redaction preflight — MUST fire BEFORE the (paid) agent spawn below; the historical policy-load
     // point after the live run is exactly the after-the-fact discovery this exists to prevent. Same search
     // set as the post-run load. `--no-redact` skips it (explicit known-synthetic opt-out); the batch paths
-    // skip it here because they preflight once for the whole batch (skipRedactionPreflight).
+    // skip it here because they preflight once for the whole batch (skipRedactionPreflight). BATCH-shaped,
+    // so it stays out of preSpendVerdicts — see that function's doc comment.
     if (!opts.skipRedactionPreflight && !opts.noRedact) {
         const plannedCassettePath = opts.cassettePath ?? defaultCassettePath(scenario.name);
         const preflight = redactionPreflightMessage([
@@ -3506,23 +3669,6 @@ async function recordScenarioObject(scenario, opts, extraPolicyDirs = []) {
         if (preflight)
             warn(preflight);
     }
-    // Host-inventory preflight — ALSO before the paid spawn. A host-inheriting tier freezes the recording
-    // machine's own inventory into the transcript, so writing that to a repo-tracked path publishes the
-    // operator's tool stack (this has happened). Refusing after the run would be strictly worse: the tokens
-    // are already spent and the tempting fix is to commit it anyway.
-    {
-        const plannedCassettePath = opts.cassettePath ?? defaultCassettePath(scenario.name);
-        const verdict = hostInventoryPreflight(scenario, plannedCassettePath, opts.allowHostInventoryFixture === true);
-        if (verdict.kind === "refuse")
-            return fail("record", "usage", verdict.message, undefined, isJsonOutput(process.argv));
-        if (verdict.kind === "warn")
-            warn(verdict.message);
-        // Portability — also pre-spend, and for the same reason: after the run the tokens are gone and the
-        // only remedy is to spend them again at the right path.
-        const port = cassettePortabilityPreflight(scenario, plannedCassettePath, opts.scenarioSourceFile);
-        if (port.kind === "warn")
-            warn(port.message);
-    }
     // Thread the live-decider opts. All undefined for a plain `record` → identical to the
     // previous opt-less call (executeScenario defaults onUnanswered to scenario.on_unanswered ?? "fail").
     const result = await executeScenario(scenario, {
@@ -3743,24 +3889,11 @@ async function recordScenarioObject(scenario, opts, extraPolicyDirs = []) {
         await assertRedactionVerdictPreserved(base, redacted, dirname(cassettePath));
         cassette = redacted;
     }
-    // Slug-collision guard (findings 19/20): a DEFAULT path is derived from `slugForPath(scenario.name)`, so
-    // two DIFFERENT scenario names that slugify identically would silently clobber the same cassette. Refuse to
-    // overwrite when the existing cassette on the default path was recorded for a DIFFERENT scenario name (a
-    // routine same-scenario re-record — or a moved scenario, same name — is unaffected). `--out`/`--force` opt out.
-    if (!opts.cassettePath && !opts.force && existsSync(cassettePath)) {
-        try {
-            const existing = JSON.parse(readFileSync(cassettePath, "utf8"));
-            const existingName = existing.scenario?.name;
-            if (existingName && existingName !== scenario.name)
-                throw new Error(`refusing to overwrite ${cassettePath}: it belongs to scenario "${existingName}", but this record is "${scenario.name}" ` +
-                    `(their names slugify to the same default path — pass --out <file> to disambiguate, or --force to overwrite).`);
-        }
-        catch (e) {
-            if (e instanceof Error && e.message.startsWith("refusing to overwrite"))
-                throw e;
-            /* an unreadable/malformed existing cassette is not a collision signal — let the write proceed */
-        }
-    }
+    // The slug-collision refusal used to live HERE, after the paid run. It moved into `preSpendVerdicts`
+    // (pre-spawn) — it is a pure function of (path, --force, the existing cassette's scenario name), so
+    // paying for a run and only then refusing to write it was the exact failure `hostInventoryPreflight`'s
+    // own comment argues against. Nothing re-checks it here: a second process writing a colliding cassette
+    // mid-run is not a case this ever detected (the old check read the file before the write too).
     // Behaviour delta vs the cassette this one REPLACES. Re-recording is the only moment where "did my edit
     // change what the agent does?" is observable at all — replay re-checks a frozen transcript and is
     // structurally blind to it. Without this the answer is discarded every time: you pay for a re-record and
@@ -3775,10 +3908,12 @@ async function recordScenarioObject(scenario, opts, extraPolicyDirs = []) {
     // RECORD-TIME PRIVACY SCAN. Scanned AFTER redaction, deliberately: redaction is the mechanism that is
     // supposed to remove this, so scanning the pre-redaction bytes would quarantine recordings that are clean.
     // The policy itself lives in `classifyRecordLeak` so it is testable without a paid run.
-    const leak = classifyRecordLeak(cassette, cassettePath, opts.allowHostInventoryFixture === true);
+    // The WRITE-TIME override only. `allowHostInventoryFixture` bypasses the pre-flight (a precondition the
+    // operator cannot check); it must NOT also wave through a measured finding.
+    const leak = classifyRecordLeak(cassette, cassettePath, opts.allowHostInventoryFindings === true);
     if (leak.kind === "override") {
         warn(`::warning:: [record] host inventory PRESENT in the recording, written anyway because ` +
-            `--allow-host-inventory-fixture was passed:\n${leak.detail}`);
+            `--allow-host-inventory-findings was passed:\n${leak.detail}`);
     }
     else if (leak.kind === "outside-repo") {
         warn(`::warning:: [record] this recording carries THIS MACHINE's inventory. Its path is not repo-visible, ` +
@@ -3795,7 +3930,8 @@ async function recordScenarioObject(scenario, opts, extraPolicyDirs = []) {
                 : "") +
             `Fix it by re-recording at a SEALED tier (--fidelity container), or from an environment without your ` +
             `personal MCP servers/agents configured. If this inventory is genuinely part of the fixture, re-run ` +
-            `with --allow-host-inventory-fixture.`);
+            `with --allow-host-inventory-findings (NOT --allow-host-inventory-fixture, which only bypasses the ` +
+            `pre-flight and deliberately leaves this scan in force).`);
     }
     writeFileAtomic(cassettePath, JSON.stringify(cassette, null, 2)); // atomic — no partial cassette on a mid-write crash
     const delta = priorSummary ? describeBehaviourDelta(priorSummary, behaviourSummary(cassette)) : undefined;
@@ -5645,10 +5781,52 @@ export const ALWAYS_CONTENT_KEYS = [
     // VERDICT_MODIFIER_KEYS list (types.ts) — a newly-added modifier lands here automatically.
     ...VERDICT_MODIFIER_KEYS,
 ];
+/** Keys whose evidence CANNOT SEE A `tool_use`.
+ *
+ *  They read `ctx.transcript`, which `run.ts` builds from top-level `assistant_text` events only — every
+ *  `tool_use` and `tool_result` is a different event `case` and contributes nothing. So a phrase the agent
+ *  only ever emitted inside a tool call (an `AskUserQuestion` gate, a `computer://` link in a tool result)
+ *  can never match, at any phrasing, no matter what the agent did.
+ *
+ *  This cost a consumer a paid recording: a `transcript_matches` was written against text that lives in a
+ *  gate question, and it could not have matched. `semantic_matches` carried the ⚠️ in its docs row from the
+ *  start; the transcript and computer-link keys did not, and nothing enforced the asymmetry.
+ *
+ *  Membership is by BLINDNESS, not by corpus. `semantic_matches` grades a strict superset (final message +
+ *  transcript + optional sub-agent text + authored files) and still belongs: the shared, guarded property is
+ *  that no member can see a tool call. `transcript_no_host_path` is deliberately ABSENT — it reads
+ *  `ctx.hostPathLeaked`, a post-run scan, not the transcript string.
+ *
+ *  Consumed by `test/caveat-docs-sync.test.ts`, which requires every member's docs row, zod `.describe()` and
+ *  packaged skill-reference row to carry the exclusion sentence. That guard is satisfiable by pasting the
+ *  sentence onto a row — which is exactly the
+ *  intended action. The rot mode it exists to catch is a NEW blind key added with no caveat at all, and an
+ *  enumerable set catches that. */
+export const TOOL_USE_BLIND_KEYS = [
+    "transcript_contains",
+    "transcript_not_contains",
+    "transcript_matches",
+    "transcript_not_matches",
+    "computer_links_resolve",
+    "computer_links_resolve_if_present",
+    "semantic_matches",
+];
+/** Keys that match text the MODEL composed, and which therefore red on rewording alone.
+ *
+ *  Gate question text and option labels/descriptions are written by the model per run. Measured across three
+ *  live runs of one scenario, the same producer-supplied sentence arrived verbatim in the question, reworded
+ *  inside it, and relocated into an option's `description` — three reds, one behaviour. The advice is to pin
+ *  producer-authored constants rather than model prose, and to prefer `question_context` when the placement
+ *  may move.
+ *
+ *  The `choose:`/answers side of this already carried the caveat (stable leading anchor, 1-based index); the
+ *  ASSERT side carried it nowhere. Consumed by `test/caveat-docs-sync.test.ts`. */
+export const MODEL_AUTHORED_TEXT_KEYS = ["question_asked", "question_options", "question_context"];
 /** Assertion keys evaluated on replay only when `controlOut` (full-fidelity) is present. */
 export const QUESTION_GATE_KEYS = [
     "question_asked",
     "question_options",
+    "question_context",
     "questions_count_max",
     "gate_answers_delivered",
     "gate_answer_count_min",

package/dist/run/execute.js

@@ -191,6 +191,8 @@ const CONTRADICTION_GROUPS = [
             // Same reasoning as question_asked: asserting WHICH options a gate offered requires a gate to have
             // fired, which contradicts requiring zero sub-questions.
             { label: "`question_options`", test: (a) => a.question_options !== undefined },
+            // Same again: matching text a gate SHOWED requires a gate to have fired.
+            { label: "`question_context`", test: (a) => a.question_context !== undefined },
             // `: false` asserts a CONFIRMED delivery failure, which needs a gate to have fired — a presence
             // requirement in disguise. `: true` is NOT one: it passes vacuously at zero gates, so it is merely
             // inert alongside the declaration (lint says so; not worth refusing a run over).
@@ -1541,6 +1543,53 @@ export function parseScenarioFile(path) {
     validateScenarioRegexes(scenario, path);
     return scenario;
 }
+/** Every nested `{ …: <regex> }` leaf in the Assertion schema, derived from zod rather than enumerated.
+ *
+ *  A leaf qualifies when it is a string field of a nested object whose own `.describe()` says "regex" — the
+ *  same declaration the docs and JSON schema are generated from, so a new nested regex field is covered the
+ *  moment it is declared. `test/nested-regex-leaves.test.ts` pins the derivation against the evaluator: every
+ *  leaf `assert.ts` compiles with `compileUserRegex` must appear here, so a load-time gap cannot reopen.
+ *
+ *  Computed once — walking the schema per assertion per run would be pointless work on a hot path. */
+/** Every nested `{ …: <regex> }` leaf in the Assertion schema.
+ *
+ *  It is an explicit table on purpose, after a derivation from zod internals was tried and rejected: the
+ *  `.describe()` text is not reachable the same way across the src and dist builds, so the walk silently
+ *  returned ZERO leaves under one of them — validation that looks present and checks nothing, which is
+ *  strictly worse than the hand list it replaced.
+ *
+ *  What makes the table safe is not how it was written but `test/nested-regex-leaves.test.ts`, which reads
+ *  `assert.ts` and fails if the evaluator compiles a nested leaf this table does not carry. The previous
+ *  version of this code was a hand list of THREE under a comment claiming to cover them all, with no guard —
+ *  the list was not the defect; the missing guard was.
+ *
+ *  A bad regex in any of these used to surface inside the evaluator, i.e. after the paid spawn. */
+const NESTED_REGEX_LEAVES = [
+    ["artifact_text", "matches"],
+    ["artifact_text", "not_matches"],
+    ["path_denied", "path_matches"],
+    ["question_context", "matches"],
+    ["question_context", "when_question"],
+    ["question_options", "when_question"],
+    ["skill_tool_used", "skill"],
+    ["skill_tool_used", "tool"],
+    ["subagent_dispatch_healthy", "type"],
+    ["subagent_output_contains", "match"],
+    ["task_status", "match"],
+];
+/** The `[label, pattern]` pairs to validate for one authored assertion. Exported for the coverage test. */
+export function nestedRegexLeaves(a) {
+    const out = [];
+    for (const [parent, child] of NESTED_REGEX_LEAVES) {
+        const holder = a[parent];
+        if (holder === undefined || holder === null || typeof holder !== "object")
+            continue;
+        const v = holder[child];
+        if (typeof v === "string")
+            out.push([`${parent}.${child}`, v]);
+    }
+    return out;
+}
 /** Validate all user-supplied regex patterns in a scenario at load time. Throws on the first bad pattern. */
 function validateScenarioRegexes(scenario, scenarioPath) {
     const context = `scenario "${scenario.name ?? scenarioPath}"`;
@@ -1589,6 +1638,16 @@ function validateScenarioRegexes(scenario, scenarioPath) {
                     throw new Error(`bad regex in ${key} in ${context}: ${c.error}`);
             }
         }
+        // Nested regex leaves — DERIVED from the schema, never hand-listed. The flat `a[key]` loop above
+        // reaches only top-level string keys, so every regex that lives one level down (`artifact_text.matches`,
+        // `path_denied.path_matches`, `question_context.matches`, …) was compiled for the first time inside the
+        // evaluator, i.e. AFTER the paid spawn. A hand list is how the previous version of this got it wrong: it
+        // covered 3 of the 11 leaves while its comment claimed to cover them all.
+        for (const [label, pattern] of nestedRegexLeaves(a)) {
+            const c = compileUserRegex(pattern);
+            if ("error" in c)
+                throw new Error(`bad regex in ${label} in ${context}: ${c.error}`);
+        }
         // (Empty / regex-ish / brace-expansion tool globs are rejected by the `toolGlob` schema in types.ts —
         // enforced on EVERY parse path including a recorded cassette's frozen asserts, not just here. )
     }