dsh-inner-browser-use 0.27.0 → 0.34.28

package/client.js

@@ -32,7 +32,8 @@ window.__ModuleLoader__.load({
     const DICT = {
       zh: {
         'side.label': '后台浏览器',
-        'side.empty': '还没有打开的页面',
+        'side.empty': '还没有打开的页面，在上方地址栏输入网址',
+        'side.restore': '恢复上次的页面',
         'side.connecting': '正在连接…',
         'side.failed': '画面没有连上',
         'side.foreign': '这个浏览器属于发起它的会话，回到那个会话继续。',
@@ -44,7 +45,8 @@ window.__ModuleLoader__.load({
       },
       en: {
         'side.label': 'Background browser',
-        'side.empty': 'No page open',
+        'side.empty': 'No page open; type an address above',
+        'side.restore': 'Reopen the last page',
         'side.connecting': 'Connecting…',
         'side.failed': 'The picture did not connect',
         'side.foreign': 'This browser belongs to the chat that opened it.',
@@ -73,6 +75,8 @@ window.__ModuleLoader__.load({
          on screen at once, and moving the mouse never takes the arrow over. */
       '.dshib-side-ptr{position:absolute;width:20px;height:20px;pointer-events:none;z-index:2;transform:translate(-2px,-2px);transition:left 60ms linear,top 60ms linear;filter:drop-shadow(0 1px 2px rgba(0,0,0,.45))}',
       '.dshib-side-note{font-size:12px;color:var(--dsw-alias-label-tertiary);padding:0 16px;text-align:center}',
+      '.dshib-side-back{border:0;border-radius:8px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;padding:6px 12px;cursor:pointer}',
+      '.dshib-side-back:hover{background:var(--dsw-alias-bg-subtle)}',
     ].join('')
 
     return {
@@ -84,6 +88,9 @@ window.__ModuleLoader__.load({
           /* one locale service or none */
         }
         ctx.effect(() => {
+          /* A reload keeps one sheet, not one per lifetime: the same id is
+             replaced instead of stacked. */
+          document.getElementById?.(STYLE_ID)?.remove()
           const style = document.createElement('style')
           style.id = STYLE_ID
           /* A sheet is keyed by the plugin that brought it. */
@@ -109,6 +116,12 @@ window.__ModuleLoader__.load({
             }
           }
           const closeHere = (sessionId) => {
+            /* A tab the person closed is not a tab they want back on return. */
+            try {
+              void fetch(`${ROUTE}/sidecar/forget?session=${encodeURIComponent(sessionId)}`, { method: 'POST' }) // ui-copy-ignore
+            } catch {
+              /* a page that cannot hear it keeps its note */
+            }
             let records = []
             try {
               records = surface?.tabsIn?.(sessionId) ?? []
@@ -138,14 +151,23 @@ window.__ModuleLoader__.load({
               /* a column that refuses keeps its own tabs */
             }
           }
-          disposers.push(tabs.register({
+          /* The same rule on this side: a second mount of the same tab is a
+             no-op, not a thrown error that takes the pane down. */
+          const safely = (register) => {
+            try {
+              return register()
+            } catch (error) {
+              return () => {}
+            }
+          }
+          disposers.push(safely(() => tabs.register({
             id: SIDE_ID, // ui-copy-ignore
             kind: SIDE_KIND, // ui-copy-ignore
             keepMounted: true,
             single: true,
             priority: 'extension',
             title: () => L('side.label'),
-          }))
+          })))
           disposers.push(scope.slots.inject(SLOT, () => scope.slots.register({
             name: SLOT, // ui-copy-ignore
             key: SIDE_ID, // ui-copy-ignore
@@ -177,7 +199,10 @@ window.__ModuleLoader__.load({
           }
           const syncAsk = () => {
             const who = mountedOf()
-            if (who === askWho) return
+            /* A stream the browser gave up on keeps its address here, so the
+               next tick has to notice it is dead and open a fresh one, or this
+               chat never hears an ask again. */
+            if (who === askWho && askSource !== null && Number(askSource.readyState) !== 2) return
             closeAsk()
             if (who === '') return
             try {
@@ -251,6 +276,9 @@ window.__ModuleLoader__.load({
       const [ptr, setPtr] = React.useState(null)
       const [phase, setPhase] = React.useState('connecting')
       const [note, setNote] = React.useState('')
+      /* The address this chat had before its tab went away: the pane reopens
+         that address, so a lost picture costs one click. */
+      const [back, setBack] = React.useState('')
       const [url, setUrl] = React.useState('')
       const [draft, setDraft] = React.useState('')
       const [editing, setEditing] = React.useState(false)
@@ -263,13 +291,48 @@ window.__ModuleLoader__.load({
       React.useEffect(() => {
         let alive = true
         let dropped = false
+        /* The tab is still in this chat's column, so this chat may say the
+           mirror is its own: a reload forgets the owner, and a pane that only
+           waited would stay dark until some tool ran. */
+        const reclaim = () => {
+          const id = String(props.sessionId ?? '')
+          if (id === '') return
+          void fetch(`${ROUTE}/sidecar/claim`, { // ui-copy-ignore
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ session: id }),
+          })
+            .then((reply) => (reply.ok === true ? reply.json() : null))
+            .then((info) => {
+              if (alive !== true) return
+              if (info?.ok === true) {
+                setOwner(id)
+                /* The owner was just named, so the next poll may adopt the
+                   browser: ask now instead of up to a poll later. */
+                setTimeout(read, 0)
+              }
+            })
+            .catch(() => {})
+        }
         const read = () => {
-          void fetch(`${ROUTE}/sidecar/state`, { cache: 'no-store' }) // ui-copy-ignore
+          const who = String(props.sessionId ?? '')
+          /* Naming the chat lets a browser that outlived a reload be picked
+             up for us; an anonymous poll cannot, and the column would sit on
+             an empty stage with the browser running behind it. */
+          void fetch(`${ROUTE}/sidecar/state?session=${encodeURIComponent(who)}`, { cache: 'no-store' }) // ui-copy-ignore
             .then((reply) => (reply.ok === true ? reply.json() : null))
             .then((info) => {
               if (alive !== true) return
               const next = String(info?.owner ?? '')
+              const asked = String(props.sessionId ?? '')
+              /* Nobody owns it, or this chat does but the note was lost: ask
+                 back instead of showing a note for a browser this column shows. */
+              if (asked !== '' && next !== asked) reclaim()
               setOwner((prev) => (prev === next ? prev : next))
+              /* A browser that is gone still remembers where this chat was:
+                 keep the address so the pane can offer to reopen it. */
+              const was = String(info?.chat?.remembered ?? '')
+              if (was !== '') setBack((prev) => (prev === was ? prev : was))
               /* Another chat holds the browser now: this tab goes away instead
                  of sitting here as a note. */
               if (dropped !== true && next !== '' && next !== String(props.sessionId ?? '')) {
@@ -297,9 +360,15 @@ window.__ModuleLoader__.load({
          this chat keeps only a note. // ui-copy-ignore */
       const unknown = owner === null
       const mine = unknown !== true && owner === asked
+      /* A picture that stops arriving has to come back by itself: the pane
+         re-opens its stream instead of sitting on an empty stage until the
+         person reloads the page. */
+      const [attempt, setAttempt] = React.useState(0)
+      const drawnAt = React.useRef(0)
 
       React.useEffect(() => {
         if (mine !== true) return undefined
+        drawnAt.current = Date.now()
         const who = encodeURIComponent(String(props.sessionId ?? ''))
         const source = new EventSource(`${ROUTE}/sidecar/frames?session=${who}`)
         /* Bursts arrive faster than a picture can decode: only the newest frame
@@ -316,6 +385,7 @@ window.__ModuleLoader__.load({
           setFrame(message)
           setPtr(message.pointer ?? null)
           setPhase('live')
+          drawnAt.current = Date.now()
           if (typeof message.url === 'string' && message.url !== '') setUrl(message.url)
         }
         const draw = (message) => {
@@ -324,6 +394,11 @@ window.__ModuleLoader__.load({
           if (typeof requestAnimationFrame === 'function') raf = requestAnimationFrame(paint)
           else paint()
         }
+        const stuck = setInterval(() => {
+          /* Hello alone is not a picture: six quiet seconds means the stream is
+             dead, so ask for a new one. */
+          if (Date.now() - drawnAt.current > 6000) setAttempt((n) => n + 1)
+        }, 3000)
         source.onmessage = (event) => {
           let message
           try {
@@ -333,7 +408,9 @@ window.__ModuleLoader__.load({
           }
           if (message.type === 'hello') {
             setPhase('live')
+            drawnAt.current = Date.now()
             setUrl(String(message.url ?? ''))
+            setBack(String(message.chat?.remembered ?? ''))
           } else if (message.type === 'failed') {
             setPhase('failed')
             setNote(String(message.text ?? ''))
@@ -347,10 +424,11 @@ window.__ModuleLoader__.load({
         }
         source.onerror = () => setPhase('lost')
         return () => {
+          clearInterval(stuck)
           if (raf !== 0 && typeof cancelAnimationFrame === 'function') cancelAnimationFrame(raf)
           source.close()
         }
-      }, [props.sessionId, mine])
+      }, [props.sessionId, mine, attempt])
 
       /* The address field follows the page except while the person is editing it. */
       React.useEffect(() => {
@@ -510,7 +588,24 @@ window.__ModuleLoader__.load({
           onWheel,
           onKeyDown,
         },
-          frame === null ? h('div', { className: 'dshib-side-note' }, noteText) : null,
+          frame === null && back !== ''
+            ? h('button', {
+              className: 'dshib-side-back',
+              type: 'button', // ui-copy-ignore
+              onClick: () => { // ui-copy-ignore
+                void fetch(`${ROUTE}/sidecar/open`, { // ui-copy-ignore
+                  method: 'POST',
+                  headers: { 'content-type': 'application/json' },
+                  body: JSON.stringify({ session: who, url: back }), // ui-copy-ignore
+                })
+                  .then((reply) => (reply.ok === true ? reply.json() : null))
+                  .then((info) => {
+                    if (info?.ok === true) setAttempt((n) => n + 1)
+                  })
+                  .catch(() => {})
+              },
+            }, L('side.restore'))
+            : frame === null ? h('div', { className: 'dshib-side-note' }, noteText) : null,
           h('textarea', {
             className: 'dshib-side-ime',
             ref: ime,

package/docs/ARTIFACTS.md

@@ -0,0 +1,19 @@
+# 文件落在哪里
+
+浏览器产生的东西——截图、抓下来的图、打印的 PDF——不落在项目根目录，也不散在 home 下。固定规则：
+
+```
+~/.dsh-inner-browser-use/artifacts/<项目>/<会话>/<种类>/
+```
+
+- **项目**：会话工作目录的文件夹名，加路径哈希前 6 位，例如 `dsh-inner-browser-use-a1b2c3`。同名文件夹、不同路径不会混。
+- **会话**：会话 id 去掉 `session-` 后的前 8 位，例如 `72557d6e`。同一项目里两个会话各存各的。
+- **种类**：`shots/` 是 `sidecar_shot` 的截图，`pictures/` 是 `sidecar_grab` 抓的图，`pdf/` 是 `sidecar_pdf` 打印的文档。
+
+文件名默认带时间戳（`shot-20261028-124500.png`），给了 `name` 就用它；名字里的分隔符、连续点、开头点都会被去掉，跳不出这个目录。
+
+每个种类保留最新 40 个文件，旧的自动删，免得跑一天的会话留下一个没人翻得动的文件夹。开着的文件不会被删掉（尽力删除，失败就留着）。
+
+调用环境里没有项目或会话信息时，落到 `no-project/no-chat/<种类>/`，不猜。
+
+测试里用 `DSH_INNER_BROWSER_ARTIFACTS` 指向临时目录，不写真实 home。

package/docs/BENCH.md

@@ -1,3 +1,238 @@
+## Phase 44 — 真站页游场地，0.34.28
+
+`node scripts/check-game.mjs <url>`，真 Chrome、自己的 profile、跑完自己关掉。两个真站：
+
+| 站点 | 空闲时页面刷新 | 全屏截图（`sidecar_shot` 同类）| 按住 `d` 200 ms 到达页面 |
+| --- | --- | --- | --- |
+| 奥拉星 `http://aoqi.100bt.com/` | **27 fps** | 中位数 **68 ms** | 是 |
+| 4399 `https://www.4399.com/` | **59.8 fps** | 中位数 **148 ms** | 是 |
+
+两个落地页都**没有 canvas**：游戏本体在链接后面，要么登录要么再点进去一层，所以这组数字说明的是「真站能不能实时跑」，不是「游戏画面已经能读」。
+
+诚实的一层：按键到达页面这件事在真站已经证实（页面自己记录的 `keydown`/`keyup`），但 4399 这种整屏重绘的页面，一张全屏图 1.8 MB、148 ms —— 做实时画面要压、要裁、要降缩放，这一层还没做，别拿它当「已经能玩」。
+
+## Phase 43 — 页游级输入：按住、组合键、按住鼠标，0.34.26
+
+本地画布页（每帧重绘，页面自己记录 `keydown`/`keyup`/`pointerdown`/`pointerup` 时间戳），真 Chrome，`node scripts/bench.mjs`：
+
+| 项 | 数字 |
+| --- | --- |
+| `sidecar_key` 带 `hold_ms: 300` 整次调用 | **305 ms**（含 300 ms 按住，收尾 5 ms） |
+| 页面测到的按住时长 | **301 ms** |
+| `ArrowLeft+ArrowUp` | 两键都收到 `keydown`，都收到 `keyup`，顺序为倒序松开 |
+| `sidecar_click` 带 `hold_ms: 200` 页面测到 | **211 ms** |
+
+对照 0.34.25 之前：同样的按住被 `settle` 拖到 727 ms，等于 0.7 s 才走一步——页游里这就是掉帧。
+
+## Phase 42 — the reload path, proved by two instances, 0.34.25
+
+`npm run adopt`（真 Chrome，临时 profile `adopt-check`，临时状态目录）：
+
+| 项 | 数字 |
+| --- | --- |
+| 第一个实例冷启动到页面可用 | 675 ms |
+| 第二个实例（模拟重载后的半边）接管 | 162 ms |
+| 第二个实例自己起的 Chrome | `null`（没有起第二个） |
+| 浏览器进程 | 同一个 pid，接管后仍活着 |
+| 页签与标题 | `title: "kept"`，内容原样 |
+
+这就是重载后「接回同一个浏览器、不重启、不丢页签和登录」的机器证据；之前只有手工重载才能走到这条路。
+
+## Phase 41 — the read tool that had never run, 0.34.23
+
+`node scripts/bench.mjs`（本机 headless 页面，Chrome 复用 `bench` profile）：
+
+| 项 | 数字 |
+| --- | --- |
+| 首次画面（复用已在跑的浏览器） | 133 ms |
+| 首帧字节 | 76 KB |
+| 帧率 | 60 fps |
+| 镜像延迟 | 中位 8 ms / 最大 8 ms |
+| 遮挡检测 | 中位 3 ms / 最大 15 ms |
+| 点一下（普通页 / 有遮罩，含读回） | 439 / 590 ms，遮罩那次 `cleared: true` |
+| 一步 `sidecar_do` | 440 / 590 ms |
+| 截图 | 73 ms / 115 KB |
+| 读 dense 页 text 档 | 6 ms / 1484 字 / ≈436 token |
+| 读 dense 页 forms 档 | 1 ms / 432 字 / ≈127 token |
+| 再读同一页 | 1–2 ms，给出「没有变化」一行 |
+| `changed_only` | 58 字 / ≈17 token（整页 1505 字） |
+
+这轮 bench 的作用不是数字，而是**它第一次跑到 `sidecar_view` 就报 `ReferenceError` 退出**：那个工具在真实会话里同样会失败，而单测只测了它的纯函数部分。修完之后 bench 一次性跑完，数字在上面。
+
+## Phase 40 — the poll that names its chat, 0.34.19
+
+The adoption rule from 0.34.16 never fired for the column itself: the pane
+polled `/sidecar/state` without a session, the host treated that as anonymous,
+and a reload could still leave the mirror empty over a live browser. The pane now
+names its chat, and asks again the moment a claim succeeds.
+
+No performance change was expected; the full bench was re-run anyway so the
+numbers under it are current (commit 0.34.19, local pages):
+
+| Label | Value |
+| --- | --- |
+| launch → first frame | 1029 ms |
+| steady stream | 60 fps, 76 KB per frame |
+| mirror delay (12 samples) | median 9 ms, max 13 ms |
+| dense page, text | 6 ms, 1484 chars, ≈436 tokens |
+| dense page, forms | 2 ms, 432 chars, ≈127 tokens |
+
+## Phase 39 — count what is on the screen, not what is in the DOM, 0.34.17
+
+`readFrames` counts child frames; the page's own count filters to frames that
+occupy the screen. Taking the larger made a hidden 1×1 frame claim a blind spot.
+
+- `blindSpots` now lets the page's visible count win; the reader's count is the
+  fallback for when the page could not count.
+- Live: two frames (400×300 and 1×1) → `blind.frames` 1, exactly one line.
+
+## Phase 38 — a reload must not blank the mirror, 0.34.16
+
+`/sidecar/state` answered from the new plugin instance, which owns nothing until
+something calls `open`: after a reload the owning chat's own poll said
+`alive:false`, hence "no page open" in the column while Chrome was fine.
+
+- The owning chat's state poll adopts the running browser and the tab remembered
+  for it before answering.
+- Live: `/dsh-unlag/reload` 200 → state `alive True`, url `https://www.doubao.com/chat/`,
+  Chrome pid 12833 with 11 m uptime, i.e. attached rather than relaunched.
+- Non-owning chats and empty `session` polls still answer without spawning anything.
+
+## Phase 37 — an observation that admits its blind spot, 0.34.15
+
+A text read and a screenshot claim to show the page. Both are lossy, and the loss
+was silent: a chart wired as `<canvas>`, a generated image with no alt text, a
+video, a cross-origin frame — nothing in the text said "there is something here
+you cannot read". A model then planned as if the page were fully described.
+
+- `readPage` counts the unreadable visible things on the page and in frames, and `renderPage` prints exactly one line when the count is non-zero; zero adds no line (measured token cost of the feature is 0 on pages that have nothing to hide).
+- `chrome-error://` is no longer rendered as an empty page: it says the page did not load and names `sidecar_nav`.
+- `navigate` retries that error page once (300 ms + 8 s cap). Cold launch on a fresh profile: first navigation recovered on the retry; an unreachable host still returns `bad` in well under the cap.
+- `sidecar_shot` without an image channel appends what the result is missing and which tool fills it; file path alone is no longer the whole answer.
+- Suite: 101 tests, 0 failures.
+
+## Phase 36 — a reload must not cost the browser, 0.34.14
+
+- 根因：交接看门狗 `while kill -0 ${process.pid}` 盯的是插件实例 pid，`dsh-unlag` 重载换 pid 后看门狗立刻 kill 共享 Chrome —— 镜像白屏、会话掉回 about:blank。
+- 改为盯应用 pid（`ps -o ppid=` 向上走到顶）+ `watcher.json` 去重；实测 node 14185 的应用 pid 是 13663。
+- `ensure()` 无活页面时回落到 `rememberedTab(id)`，首开即回原地址。
+- 测试 97 条全绿。
+
+## Phase 35 — a review round that can be checked off, 0.34.13## Phase 35 — a review round that can be checked off, 0.34.13
+
+- `markRound()` 追加 verdict 行，`lastRound()` 折回 `marks`；`brief({already})` 只保留 open 条目，实测提问里出现「Already handled from your previous review」，已处理点不再重复。
+- 工具面新增 `sidecar_review_verdict`（`mark: [{point,status,evidence}]`，状态枚举 fixed/verified/invalid/open）；越界编号丢弃、未知状态记为 open。
+- 测试 92 → 96 条全绿。
+
+## Phase 34 — one gate in front of every write, 0.34.12## Phase 34 — one gate in front of every write, 0.34.12
+
+- `acting()` 统一 400（未命名会话）与 403（非持有者）；实测匿名 `POST /sidecar/nav` → 400 `which chat asked for it`，非持有者 `POST /sidecar/stop` → 403，持有者 `forget` → 200。
+- 测试 90 → 92 条，全绿；文案与样式 lint 无 error。
+
+## Phase 33 — a lost picture comes back in one click, 0.34.11
+
+- 实测「切走 / 重载后画面没了」的下一步：`/sidecar/state?session=…` 与画面流 hello 都给出 `chat.remembered`（该会话最后地址）。
+- 右栏在没有画面且 `remembered` 有值时显示「恢复上次的页面」，点击 POST `/sidecar/open` 并重连画面流。
+- 同一会话第二次 open 命中已有标签页：107 ms（三次实测 2.08 s / 0.107 s / 0.108 s，首次含导航）。
+
+## Phase 32 — a call log belongs to its chat, 0.34.10
+
+`GET /sidecar/state` returned the last 40 mirror calls of every chat, each with
+an eight-character session id: one conversation could read where another had
+been browsing. The list is now filtered to the caller's own chat. The owner and
+the list of listening chats stay global, because those are what the column needs
+to claim the mirror.
+
+## Phase 31 — a reload keeps the mirror, 0.34.9
+
+`ctx.effect` cleanup ran `sidecar.shutdown()`, so each plugin reload closed
+Chrome. The page disappeared from the column and the next open was a cold
+start again. Cleanup now hands the browser to the next driver: cookies and a
+login snapshot hit disk, the browser keeps running, and a detached watcher
+closes it only after the app process is gone.
+
+| after a `dsh-unlag` reload | before | now |
+|---|---|---|
+| browser | closed, page lost | still running, page kept |
+| next interaction | cold launch (≈0.6 s, was 21 s) | attach, no launch |
+
+## Phase 30 — a brand-new chat's first tab, 0.34.8
+
+A fresh profile with no memory of a page means `openTab` asks for `about:blank`.
+`navigate` then polled for a non-blank address, which a blank page never becomes,
+and spent all 200 tries. Every first open of a new chat paid it.
+
+| cold start, fresh profile (`about:blank`) | before | now |
+|---|---|---|
+| round 1 | 21 322 ms | 817 ms |
+| round 2 | 20 882 ms | 607 ms |
+| round 3 | 20 900 ms | 516 ms |
+| page settings round trips | 4 | 1 |
+
+Measured with three launches of `Sidecar#ensure` against a throwaway profile;
+the first launch is now about 26× faster than before.
+
+## Phase 29 — a stale session cookie is not written back, 0.34.7
+
+`restoreSessionCookies` replayed every kept session cookie on launch, including
+ones the browser already had. A rotated `sessionid` from the note would replace
+the current one, and the site answers a retired session with a sign-in page.
+
+| case | before | now |
+|---|---|---|
+| note holds sessionid, browser holds rotated one | old value written | nothing written |
+| note holds a cookie the browser lost | written | written |
+| cookie key | — | domain + path + name |
+
+86 tests complete the suite in about 2 s.
+
+## Phase 28 — one chat, one tab, even in parallel, 0.34.6
+
+`tabFor` checked `pages`, then did async work, then wrote `pages`: two calls that
+started together both missed the map and both opened a tab. The orphan tab kept
+a live page nobody could see or stop.
+
+| case | before | now |
+|---|---|---|
+| two parallel calls, cold chat | 2 tabs, 1 orphan | 1 tab |
+| later call with another address | its own tab | same tab, navigated |
+| leftover pending note | — | cleared in `finally` |
+
+The fix is a per-chat promise in `opening`, joined by the second caller.
+
+## Phase 27 — one gate for the mirror, 0.34.5
+
+Three routes each carried their own copy of the ownership check. Copies drift:
+a route added later is exactly the one nobody remembers to guard.
+
+| case | result |
+|---|---|
+| rival chat → `/sidecar/input` | 403, owner named |
+| rival chat → `/sidecar/nav` | 403, owner named |
+| rival chat → `/sidecar/frames` | 403, no stream opened |
+| unit tests | 84 |
+
+The gate reads one function, so the question "may this chat act?" has one answer
+in one place.
+
+## Phase 26 — a screenshot the model can see, 0.34.3
+
+Observation was structured text only: `sidecar_shot` wrote a PNG and returned
+a path, which is a file name the model cannot look at. Codex and Claude Code
+both hand screenshots back as image content, and that is the difference
+between planning from the picture and guessing.
+
+| case | before | now |
+|---|---|---|
+| route with image input | path only | path + image block, same call |
+| route without image input | path | path, no image block, no error |
+| no attachment store | path | path |
+| read state across chats | one shared object | one per chat |
+| unit tests | 79 | 81 |
+
+Same-call cost: the PNG is already in memory for the file write, so the image
+block adds one attachment save, no extra round trip and no second screenshot.
+
 <!-- ui-copy-ignore -->
 # Measured, not claimed
 
@@ -341,3 +576,144 @@ travels in the same line as the path.
 The sampling is 32x32 inside the page, in the same call that reads the page, so a
 blank chart is visible before anything is saved.
 
+## Phase 18 — the picture that never arrived, 0.28.0
+
+| page | read line | time |
+| --- | --- | --- |
+| `/broken` (320x240 `<img>` pointing at a 404, no words) | `picture 320x240 "Chart" did not load — the page may need a reload, or the picture is gone` | 123 ms (cold page) |
+
+A failed image collapses to an error icon, so the declared `width`/`height` is
+what the page meant to show; the read reports that size, not the icon's.
+
+## Phase 19 — the page said again, 0.29.0
+
+| read | characters | time |
+| --- | --- | --- |
+| first read of `/dense` (40 paragraphs) | 2057 | — |
+| second read, nothing changed | 105 | 1 ms |
+
+The comparison is free: both reads already happened. Only the report shrinks.
+A changed scroll offset is still reported, so "nothing changed" is never a lie.
+
+## Phase 20 — one call carries the question and the answer, 0.30.0
+
+| step | before | `sidecar_ask` |
+| --- | --- | --- |
+| type the message | `sidecar_type` + `submit` | same, inside the call |
+| read the page | `sidecar_view` | — |
+| read it again until the answer stops growing | 2–6 more `sidecar_view` calls | — |
+| **turns for a chat reply** | 3–7 | **1** |
+| measured `sidecar_ask` on `/chat` (answer over 2 arrivals, 700 ms tail) | — | 2.5 s, one turn |
+
+## Phase 21 — a review round that closes the loop, 0.31.0
+
+| step | before | `sidecar_review` |
+| --- | --- | --- |
+| write the request (repo, commit, focus) | by hand, every round | built from three fields |
+| send it, wait for the answer | `sidecar_ask` | same call |
+| turn the answer into a list | read it, retype it | parsed, numbering kept |
+| know what the last round was about | — | round log, with the commit and the time |
+| **turns for a review round** | 3–7 + bookkeeping | **1** |
+| measured round on `/chat` (echoed question + 2-item list) | — | 2.6 s, 2 points |
+
+## Phase 21b — an answer that is not an answer, 0.31.1
+
+A chat box on a page that is not signed in still accepts text, still redraws,
+and still looks busy. Three cheap checks keep that from being reported as a
+review.
+
+| what the page does | before | now | cost |
+| --- | --- | --- | --- |
+| keeps the words in the box | waits 4 s, then reads the page | says so at 0.5 s | 1 evaluate |
+| redraws but never shows the message | the new words were the answer | says the page did not take it | none (text compare) |
+| shows the message, no reply | "answered in prose" | "has the message but has not answered yet" | none (text compare) |
+| real page, signed out (Doubao) | a review-shaped paragraph of menu chips | the sign-in is named, 2.6 s | — |
+
+## Phase 22 — the change travels with the request, 0.32.0
+
+The reviewer inside the column cannot open a repository. Asking it to review
+"the newest commit" of a repository it cannot see is asking for a guess.
+
+| request | what the reviewer gets | cost |
+| --- | --- | --- |
+| repo + commit | an address and a hash it cannot open | 1 message |
+| repo + commit + diff | the change itself, capped at 5000 characters | +diff characters in that one message |
+
+Measured: `review-carries-diff` green in 2.6 s; the recorded round carries
+`+const cap = 60` verbatim.
+
+## Phase 22b — the mirror outlives the visit, 0.33.0
+
+A column tab only exists while the chat is on screen. The ask used to be a
+single frame pushed at request time: if that chat had no stream, the frame was
+lost and the mirror never appeared on return.
+
+| situation | before | now |
+| --- | --- | --- |
+| the chat is on screen | tab opens | tab opens |
+| the chat is elsewhere, then returns | nothing | tab is waiting |
+| the page was reloaded | nothing | tab is waiting |
+| the ask is 3 minutes old | nothing | nothing (spent) |
+| a different chat comes back | nothing | nothing (not its mirror) |
+
+Data flow never needed the column: measured with zero viewers — boot 626 ms,
+click and read back 114 ms, read 4 ms, shot 48 ms / 12.5 KB.
+
+## Phase 22c — a duplicate cannot take the pane down, 0.33.2
+
+A scan of the six shipped modules finds no repeated top-level name, no module
+imported twice, no two tools with one name, one tab id and one style sheet.
+The two places a reload can still meet itself are guarded instead of trusted:
+
+| case | before | now |
+| --- | --- | --- |
+| same tool name registered again | thrown error, surface down | warning, first one kept |
+| same tab mounted again | possible duplicate registration | no-op |
+| style sheet re-applied | second sheet stacked | replaced by id |
+| two mount entry points | possible double effect | one entry per half |
+
+Guards are covered by `test/no-duplicate.test.mjs` plus a double-mount test:
+65 unit tests, 66 breadth checks, 20 packaged files.
+
+## Phase 25 — one chat cannot take another chat's page, 0.34.2
+
+The audit on 0.34.0 named five things a driver written for one chat got wrong.
+Each was reproduced against 0.34.1 first: two were already fixed (the
+`sessionScope`/`KEYS` import, and every `ensure()` route already carrying a
+session), three were real.
+
+| What | Before | Now |
+| --- | --- | --- |
+| popup lookup | any non-main tab, then navigated or closed | only a target that is neither this page nor another chat's (`isForeign`) |
+| focused password in a result line | echoed the `.value` (`DUMMY_SECRET_123`) | name only, value always empty |
+| `sidecar_do` on a step that did not land | kept going, typed into the wrong page | stops at that step, says to re-plan |
+| overlay that would not clear | clicked the control under it anyway | refuses the click/typing, names the overlay |
+| `changed_only` twice | repeated the same change | diff becomes the new baseline |
+| `/sidecar/state` | top-level `url` could be another chat's tab | `?session=` adds `chat.url/title/viewers` (live: doubao page, viewers 1) |
+| suite | 77 pass | 79 pass (isolation, leak) |
+
+## Phase 24 — a number that is checked before it is used, 0.34.1
+
+| What | Before | Now |
+| --- | --- | --- |
+| ref on a control whose words changed | pressed the new control | refused, says both words (0 ms extra on an unchanged ref) |
+| sidecar call after a hot reload | `sessionScope is not defined` | works; the Host half is checked by a test |
+
+## Phase 23 — one tab per chat, typing that looks like hands, 0.34.0
+
+The browser used to be one page for the whole app, so any chat could navigate
+the page another chat was reading. Tabs are now per chat; one windowless Chrome
+and one profile still back all of them, so a login is shared and an address is
+not.
+
+| what | measured |
+| --- | --- |
+| first chat, browser cold | 725 ms to a driven page |
+| second chat, own tab | 1 round trip, no second Chrome |
+| chat A navigates | chat B's URL and the first tab unchanged |
+| frames per chat | `/sidecar/frames?session=` streams only that tab |
+| paste, 46 chars | 5 ms |
+| human typing, 46 chars | 1965–2238 ms (43–49 ms per char) |
+| human typing, >160 chars | 8-char bursts, 16–58 ms gaps, ≈6 ms per char |
+| headless UA | desktop Chrome UA, no `HeadlessChrome` |
+| suite | 70 pass, breadth 66, ui-copy clean |