rea-agents 4.1.0 → 6.0.0

package/dist/domain/browserObservationSchemas.js

@@ -3,7 +3,8 @@ import { browserCompletenessSchema } from "./browserCompleteness.js";
 import { webTextArtifactSchema } from "./webContentArtifact.js";
 import { jsonShapeSchema } from "./jsonShape.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
-const browserVersionSchema = z.object({
+/** Shared CDP/browser version identity carried on observation Evidence. */
+export const browserVersionSchema = z.object({
     product: z.string(),
     protocol_version: z.string(),
     revision: z.string(),
@@ -105,6 +106,19 @@ const browserNetworkRequestSchema = z.object({
     status: z.number().nullable(),
     mime_type: z.string().nullable(),
     encoded_data_length: z.number().min(0).nullable(),
+    redirects: z
+        .array(z.object({
+        url: z.string(),
+        response_url: z.string(),
+        method: z.string(),
+        resource_type: z.string().nullable(),
+        status: z.number().nullable(),
+        mime_type: z.string().nullable(),
+        encoded_data_length: z.number().min(0).nullable(),
+        request_timestamp: z.number().nullable(),
+        redirect_event_timestamp: z.number().nullable(),
+    }))
+        .optional(),
     initiator: z.object({
         type: z.string(),
         url: z.string().nullable(),

package/dist/domain/browserScenarioCapture.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { browserNetworkContentSelectionValuesSchema } from "./browserNetworkEvidence.js";
 import { browserScenarioCompletenessSchema, browserScenarioEventSchema, browserScenarioStepSchema, } from "./browserScenarioCaptureValues.js";
 export { classifyBrowserScenarioCompleteness, browserScenarioEventSchema, browserScenarioStepSchema, browserStepArtifactsSchema, } from "./browserScenarioCaptureValues.js";
 /** Step-indexed browser scenario observation. */
@@ -15,6 +16,7 @@ export const browserScenarioCaptureSchema = z
         start_origin: z.string().min(1),
         action_count: z.number().int().min(1),
         secret_references: z.array(z.string().min(1)),
+        network_content: browserNetworkContentSelectionValuesSchema.optional(),
     }),
     duration_ms: z.number().int().min(0),
     steps: z.array(browserScenarioStepSchema).min(1),
@@ -27,6 +29,26 @@ export const browserScenarioCaptureSchema = z
     limitations: z.array(z.string().min(1)),
 })
     .superRefine((capture, context) => {
+    const bySequence = new Map(capture.events.items.map((event) => [event.sequence, event]));
+    if (bySequence.size !== capture.events.items.length)
+        context.addIssue({
+            code: "custom",
+            path: ["events", "items"],
+            message: "Event sequence numbers must be unique",
+        });
+    for (const [index, event] of capture.events.items.entries()) {
+        if (event.kind !== "network-content")
+            continue;
+        const source = bySequence.get(event.source_event_sequence);
+        if (source?.kind !== event.phase ||
+            source.transaction_id !== event.transaction_id ||
+            source.sequence >= event.sequence)
+            context.addIssue({
+                code: "custom",
+                path: ["events", "items", index, "source_event_sequence"],
+                message: "Network content must reference an earlier matching transaction phase",
+            });
+    }
     if (capture.events.retained !== capture.events.items.length)
         context.addIssue({
             code: "custom",

package/dist/domain/browserScenarioCaptureValues.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
 import { emptyArraySchema } from "./emptyArraySchema.js";
+import { browserNetworkBodySchema, browserNetworkHeadersSchema, } from "./browserNetworkEvidence.js";
 import { sanitizedBrowserUrlSchema } from "./browserObservation.js";
 import { webScreenshotArtifactSchema } from "./webScreenshot.js";
 import { digestSchema } from "./../domain/digests.js";
@@ -102,6 +103,8 @@ const eventBase = {
 const eventUrl = sanitizedBrowserUrlSchema.nullable();
 const networkEventShape = {
     ...eventBase,
+    transaction_id: z.string().min(1).optional(),
+    redirected_from_transaction_id: z.string().min(1).nullable().optional(),
     method: z.string().min(1),
     url: sanitizedBrowserUrlSchema,
     resource_type: z.string().min(1),
@@ -146,6 +149,28 @@ export const browserScenarioEventSchema = z.union([
         status: z.null(),
         failure: z.string().min(1),
     }),
+    z.strictObject({
+        ...networkEventShape,
+        kind: z.literal("request-finished"),
+        status: z.null(),
+        failure: z.null(),
+    }),
+    z.strictObject({
+        ...networkEventShape,
+        kind: z.literal("request-unfinished"),
+        status: z.null(),
+        failure: z.null(),
+        reason: z.enum(["capture-ended", "cancelled"]),
+    }),
+    z.strictObject({
+        ...eventBase,
+        kind: z.literal("network-content"),
+        transaction_id: z.string().min(1),
+        source_event_sequence: z.number().int().min(1),
+        phase: z.enum(["request", "response"]),
+        headers: browserNetworkHeadersSchema,
+        body: browserNetworkBodySchema,
+    }),
     z.strictObject({
         ...eventBase,
         kind: z.enum(["websocket-opened", "websocket-closed"]),

package/dist/domain/browserScenarioDiff.js

@@ -1,5 +1,5 @@
 import {} from "./browserScenarioCapture.js";
-import { actionState, artifactEvidenceState, captured, eventEvidenceState, eventsFor, screenshotProjection, } from "./browserScenarioDiffEvidence.js";
+import { actionState, artifactEvidenceState, captured, eventEvidenceState, eventsFor, networkContentCoverageReason, screenshotProjection, } from "./browserScenarioDiffEvidence.js";
 import { browserScenarioDiffSchema, } from "./browserScenarioDiffValues.js";
 import { commitBrowserScenarioNormalization, digestNormalizedScenarioValue, } from "./browserScenarioNormalization.js";
 export { browserScenarioDiffSchema, compareBrowserScenariosInputSchema, } from "./browserScenarioDiffValues.js";
@@ -213,6 +213,7 @@ const compareStepArtifacts = (input) => {
             after: captured(eventsFor(input.afterCapture, input.afterStep.step_index)),
             beforeState: eventEvidenceState(input.beforeCapture, input.beforeStep),
             afterState: eventEvidenceState(input.afterCapture, input.afterStep),
+            incomparableReason: networkContentCoverageReason(input.beforeCapture, input.afterCapture),
         }),
     ];
 };
@@ -231,7 +232,8 @@ const compareCapturedValues = (input) => {
     if (beforeState !== "captured" ||
         afterState !== "captured" ||
         before.state !== "captured" ||
-        after.state !== "captured")
+        after.state !== "captured" ||
+        input.incomparableReason !== undefined)
         return {
             artifact,
             status: "unknown",
@@ -242,7 +244,8 @@ const compareCapturedValues = (input) => {
                 after_state: afterState,
                 before_sha256: beforeSha256,
                 after_sha256: afterSha256,
-                reason: `Artifact coverage is not comparable (${beforeState} before, ${afterState} after).`,
+                reason: input.incomparableReason ??
+                    `Artifact coverage is not comparable (${beforeState} before, ${afterState} after).`,
             },
         };
     if (beforeSha256 === null || afterSha256 === null)

package/dist/domain/browserScenarioDiffEvidence.js

@@ -37,7 +37,41 @@ export const actionState = (step) => ({
     error: step.error,
 });
 /** Select events attributed to one scenario step without sequence metadata. */
-export const eventsFor = (capture, stepIndex) => capture.events.items.flatMap(({ sequence: _sequence, step_index: eventStepIndex, ...event }) => eventStepIndex === stepIndex ? [event] : []);
+export const eventsFor = (capture, stepIndex) => {
+    const sourceSteps = new Map(capture.events.items.map(({ sequence, step_index }) => [
+        sequence,
+        step_index,
+    ]));
+    return capture.events.items.flatMap(({ sequence: _sequence, step_index: eventStepIndex, ...event }) => {
+        if (event.kind === "network-content") {
+            const { source_event_sequence: sourceSequence, ...content } = event;
+            return sourceSteps.get(sourceSequence) === stepIndex ? [content] : [];
+        }
+        return eventStepIndex === stepIndex ? [event] : [];
+    });
+};
+/** Different content selection is missing comparability, not an observed website change. */
+export const networkContentCoverageReason = (before, after) => {
+    const left = before.scenario.network_content;
+    const right = after.scenario.network_content;
+    if (left === undefined || right === undefined) {
+        const events = [...before.events.items, ...after.events.items];
+        if (events.some((event) => event.kind === "network-content") ||
+            ((left === undefined) !== (right === undefined) &&
+                events.some((event) => event.kind === "request" ||
+                    event.kind === "response" ||
+                    event.kind === "request-failed" ||
+                    event.kind === "request-finished" ||
+                    event.kind === "request-unfinished")))
+            return "Network content selection is unknown in a legacy capture; capture both sides with matching content selection.";
+        return undefined;
+    }
+    return left.request_body !== right.request_body ||
+        left.response_body !== right.response_body ||
+        left.header_values !== right.header_values
+        ? "Network content selections differ; capture both sides with matching content selection before comparing network evidence."
+        : undefined;
+};
 /** Wrap one value as captured comparison evidence. */
 export const captured = (value) => ({
     state: "captured",

package/dist/domain/browserScenarioValues.js

@@ -1,9 +1,17 @@
 import { z } from "zod";
+import { isAbsoluteLocalPath } from "./localPath.js";
+import { browserNetworkContentSelectionSchema } from "./browserNetworkEvidence.js";
 import { browserEndpointSchema, browserOriginSchema, } from "./browserObservation.js";
 export const scenarioIdentifierSchema = z
     .string()
     .regex(/^[A-Za-z][A-Za-z0-9._-]*$/u);
-const browserExecutablePathSchema = z.string().trim().min(1);
+const browserExecutablePathSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .refine(isAbsoluteLocalPath, {
+    message: "executable_path must be an absolute local filesystem path (for example /opt/chromium/chrome or C:\\chromium\\chrome.exe)",
+});
 const browserScenarioBaseUrlSchema = z
     .string()
     .min(1)
@@ -51,7 +59,7 @@ export const browserScenarioUrlSchema = z.strictObject({
 export const browserScenarioBrowserSchema = z.discriminatedUnion("mode", [
     z.strictObject({
         mode: z.literal("launch"),
-        executable_path: browserExecutablePathSchema,
+        executable_path: browserExecutablePathSchema.describe("Absolute local filesystem path for the browser executable; relative paths are rejected."),
         headless: z
             .boolean()
             .default(true)
@@ -249,6 +257,16 @@ export const browserScenarioCaptureSchema = z
         "downloads",
     ]))
         .default([]),
+    network: browserNetworkContentSelectionSchema,
+})
+    .default({
+    after_each_step: [],
+    at_end: ["url"],
+    events: [],
+    network: {
+        request_body: false,
+        response_body: false,
+        header_values: false,
+    },
 })
-    .default({ after_each_step: [], at_end: ["url"], events: [] })
     .describe("Optional retained artifacts and event families. Defaults to only a final sanitized URL; request screenshots, DOM, accessibility, history, storage, and event capture explicitly.");

package/dist/domain/browserSession.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { browserAllowedOriginsSchema, browserEndpointSchema, } from "./browserObservation.js";
 import { browserCompletenessSchema } from "./browserCompleteness.js";
+import { browserVersionSchema } from "./browserObservationSchemas.js";
 /** Input for a navigation-aware browser observation window. */
 export const observeWebSessionInputSchema = z.strictObject({
     cdp_endpoint: browserEndpointSchema,
@@ -32,13 +33,7 @@ const timelineEventSchema = z.object({
 });
 /** Navigation-aware session result for external user actions. */
 export const webObservationSessionSchema = z.object({
-    browser: z.object({
-        product: z.string(),
-        protocol_version: z.string(),
-        revision: z.string(),
-        user_agent: z.string(),
-        js_version: z.string(),
-    }),
+    browser: browserVersionSchema,
     target: z.object({
         target_id: z.string(),
         initial_url: z.string(),

package/dist/domain/bundleComparison.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { parseEvidenceBundle, serializeEvidenceBundle, } from "./evidenceBundle.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
+import { comparisonStatusSchema } from "./comparisonStatus.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const classificationSchema = z.enum([
     "added",
@@ -40,7 +41,7 @@ const bundleChangeSchema = z.object({
 });
 /** Deterministic classified delta between two canonical Evidence bundles. */
 export const bundleComparisonResultSchema = z.object({
-    status: z.enum(["unchanged", "changed", "unknown"]),
+    status: comparisonStatusSchema,
     left_bundle_sha256: digestSchema,
     right_bundle_sha256: digestSchema,
     summary: z.object({

package/dist/domain/callPath.js

@@ -4,14 +4,18 @@ export { callPathInputSchema, callPathResultSchema };
 /** Minimal directed caller-to-callee adjacency for call-path search. */
 class CallGraph {
     successors = new Map();
+    predecessors = new Map();
     mergeNode(node) {
         if (!this.successors.has(node))
             this.successors.set(node, new Set());
+        if (!this.predecessors.has(node))
+            this.predecessors.set(node, new Set());
     }
     mergeDirectedEdge(source, target) {
         this.mergeNode(source);
         this.mergeNode(target);
         this.successors.get(source)?.add(target);
+        this.predecessors.get(target)?.add(source);
     }
     hasNode(node) {
         return this.successors.has(node);
@@ -22,26 +26,27 @@ class CallGraph {
     outNeighbors(node) {
         return [...(this.successors.get(node) ?? [])];
     }
+    inNeighbors(node) {
+        return [...(this.predecessors.get(node) ?? [])];
+    }
 }
-/** Breadth-first shortest depth from start to goal, or null when unreachable. */
-const shortestPathDepth = (graph, start, goal) => {
-    if (start === goal)
-        return 0;
-    const depth = new Map([[start, 0]]);
-    const queue = [start];
+/** Shortest remaining distance for every node that can reach the goal. */
+const distancesToGoal = (graph, goal) => {
+    if (!graph.hasNode(goal))
+        return new Map();
+    const depth = new Map([[goal, 0]]);
+    const queue = [goal];
     for (let index = 0; index < queue.length; index += 1) {
         const node = queue[index] ?? "";
         const next = (depth.get(node) ?? 0) + 1;
-        for (const neighbor of graph.outNeighbors(node)) {
-            if (neighbor === goal)
-                return next;
+        for (const neighbor of graph.inNeighbors(node)) {
             if (!depth.has(neighbor)) {
                 depth.set(neighbor, next);
                 queue.push(neighbor);
             }
         }
     }
-    return null;
+    return depth;
 };
 /** Reconstruct direct-callee paths from explicit analyze_function Evidence. */
 export const buildCallPath = (input) => {
@@ -53,16 +58,15 @@ export const buildCallPath = (input) => {
         start: parsed.start.address,
         goal: parsed.goal.address,
     });
-    const shortestDepth = graph.hasNode(parsed.start.address) && graph.hasNode(parsed.goal.address)
-        ? shortestPathDepth(graph, parsed.start.address, parsed.goal.address)
-        : null;
+    const goalDistances = distancesToGoal(graph, parsed.goal.address);
+    const shortestDepth = goalDistances.get(parsed.start.address) ?? null;
     const paths = shortestDepth === null
         ? []
         : enumeratePaths({
             graph,
             start: parsed.start.address,
             goal: parsed.goal.address,
-            shortestDepth,
+            goalDistances,
         }).paths.map((path) => citePath(path, snapshots));
     const shortestHops = paths[0]?.hops;
     const found = shortestHops !== undefined;
@@ -95,7 +99,7 @@ export const buildCallPath = (input) => {
 const summarizeSearch = (graph, reached) => ({
     nodes: reached.size,
     edges: [...reached.keys()].reduce((count, node) => count + (graph.hasNode(node) ? graph.outDegree(node) : 0), 0),
-    depth_reached: Math.max(0, ...reached.values()),
+    depth_reached: [...reached.values()].reduce((maximum, depth) => Math.max(maximum, depth), 0),
 });
 const prepareCallGraph = (input) => {
     const snapshots = parseSnapshots(input.functions);
@@ -188,41 +192,45 @@ const inspectSearch = ({ graph, snapshots, start, goal, }) => {
         limitations,
     };
 };
-const enumeratePaths = ({ graph, start, goal, shortestDepth, }) => {
+const enumeratePaths = ({ graph, start, goal, goalDistances, }) => {
     const output = [];
-    const state = {
-        graph,
-        goal,
-        path: [start],
-        visited: new Set([start]),
-        output,
+    const path = [start];
+    const neighbors = new Map();
+    const frame = (node) => {
+        let candidates = neighbors.get(node);
+        if (candidates === undefined) {
+            const distance = goalDistances.get(node);
+            candidates = graph
+                .outNeighbors(node)
+                .filter((neighbor) => distance !== undefined &&
+                goalDistances.get(neighbor) === distance - 1)
+                .sort((left, right) => left.localeCompare(right));
+            neighbors.set(node, candidates);
+        }
+        return { neighbors: candidates, nextIndex: 0 };
     };
-    enumerateAtDepth(state, shortestDepth);
-    return { paths: output };
-};
-const enumerateAtDepth = (state, remaining) => {
-    const { graph, goal, path, visited, output } = state;
-    const current = path.at(-1);
-    if (current === undefined)
-        return;
-    if (remaining === 0) {
-        if (current === goal)
+    const pending = [frame(start)];
+    while (pending.length > 0) {
+        const current = pending.at(-1);
+        if (current === undefined)
+            break;
+        if (path.at(-1) === goal) {
             output.push([...path]);
-        return;
-    }
-    if (current === goal)
-        return;
-    for (const neighbor of graph
-        .outNeighbors(current)
-        .sort((left, right) => left.localeCompare(right))) {
-        if (visited.has(neighbor))
+            pending.pop();
+            path.pop();
             continue;
-        visited.add(neighbor);
+        }
+        const neighbor = current.neighbors[current.nextIndex];
+        if (neighbor === undefined) {
+            pending.pop();
+            path.pop();
+            continue;
+        }
+        current.nextIndex += 1;
         path.push(neighbor);
-        enumerateAtDepth(state, remaining - 1);
-        path.pop();
-        visited.delete(neighbor);
+        pending.push(frame(neighbor));
     }
+    return { paths: output };
 };
 const citePath = (addresses, snapshots) => {
     const edges = addresses.slice(0, -1).map((source, index) => {

package/dist/domain/callPathSchemas.js

@@ -19,7 +19,7 @@ const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Normalize a hexadecimal offset while preserving its optional address space. */
 export const parseCallPathAddress = (input) => inputAddressSchema.parse(input);
 /** Strict input for explicit call-path reconstruction from complete dossiers. */
-export const callPathInputSchema = z.object({
+export const callPathInputSchema = z.strictObject({
     functions: z.array(evidenceSchema).min(1),
     start: z.object({ address: inputAddressSchema }).strict(),
     goal: z.object({ address: inputAddressSchema }).strict(),

package/dist/domain/canonicalDigest.js

@@ -2,9 +2,21 @@ import { createHash } from "node:crypto";
 /** Hash canonicalize-compatible JSON without assembling an aggregate string. */
 export const digestCanonicalValue = (value, context = "Comparison") => {
     const hash = createHash("sha256");
-    const encoded = emitCanonical(value, (part) => hash.update(part), new Set());
+    // Batch small emitted parts to cut hash.update crossings.
+    // Flush cuts only at part boundaries, so the hashed byte stream is unchanged.
+    let buffered = "";
+    const emit = (part) => {
+        buffered += part;
+        if (buffered.length >= 8192) {
+            hash.update(buffered);
+            buffered = "";
+        }
+    };
+    const encoded = emitCanonical(value, emit, new Set());
     if (!encoded)
         throw new TypeError(`${context} could not canonicalize data`);
+    if (buffered)
+        hash.update(buffered);
     return hash.digest("hex");
 };
 const emitCanonical = (value, emit, ancestors) => {

package/dist/domain/changedBehavior.js

@@ -3,12 +3,12 @@ import { artifactComparisonResultSchema } from "./artifactComparison.js";
 import { uniqueSorted } from "./canonicalOrdering.js";
 import { evidenceSchema, parseEvidence } from "./evidence.js";
 import { functionComparisonResultSchema } from "./functionComparison.js";
-import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./processEvidenceProvider.js";
-import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./processCapture.js";
+import { PROCESS_PROVIDER, isProcessEvidenceProvider, } from "./process/processEvidenceProvider.js";
+import { comparisonStatusSchema, deriveProcessComparisonStatus, PROCESS_COMPARISON_DIMENSIONS, processCaptureComparisonSchema, } from "./process/processCapture.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Input for aggregating existing comparison Evidence. */
-export const changedBehaviorInputSchema = z.object({
+export const changedBehaviorInputSchema = z.strictObject({
     comparisons: z.array(evidenceSchema).default([]),
 });
 const findingSchema = z.object({

package/dist/domain/comparisonStatus.js

@@ -0,0 +1,11 @@
+import { z } from "zod";
+/**
+ * Canonical top-level comparison outcome shared by every comparison
+ * pipeline. Pipeline-native detail enums keep their wire schemas, while
+ * shared result contracts use this canonical triple.
+ */
+export const comparisonStatusSchema = z.enum([
+    "unchanged",
+    "changed",
+    "unknown",
+]);

package/dist/domain/conformanceTrustGate.js

@@ -38,18 +38,6 @@ const VOLATILE_DIMENSIONS = new Set([
     "created_at",
     "updated_at",
 ]);
-/** Dimension that carries semantic content. */
-const SEMANTIC_DIMENSIONS = new Set([
-    "exit_code",
-    "stdout",
-    "stderr",
-    "filesystem",
-    "process",
-    "process_tree",
-    "shim_events",
-    "protocol_events",
-    "event_journal",
-]);
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const uniqueStrings = (values) => [
     ...new Set(values.filter((value) => value.length > 0)),
@@ -172,10 +160,6 @@ const comparisonIncompleteStatus = (expected, actual, options) => {
 export function isVolatileDimension(name) {
     return VOLATILE_DIMENSIONS.has(name);
 }
-/** Check if a dimension name carries semantic content. */
-export function isSemanticDimension(name) {
-    return SEMANTIC_DIMENSIONS.has(name);
-}
 /**
  * Compare two values for a dimension, classifying semantic diffs
  * from timing/normalization noise.

package/dist/domain/evidence.js

@@ -155,7 +155,7 @@ export const createEvidence = (target, provider, observation) => {
     const subject = target === undefined
         ? null
         : {
-            name: target.path.split("/").at(-1) ?? target.path,
+            name: target.path.split("/").at(-1) || "artifact",
             digest: { sha256: target.sha256 },
             format: target.format,
             architecture: target.architecture ?? null,
@@ -187,20 +187,32 @@ export const createEvidence = (target, provider, observation) => {
         environment: observation.environment ?? null,
         limitations: [
             ...(target === undefined
-                ? ["Artifact identity is unavailable for this observation."]
+                ? [
+                    observation.subjectUnavailableReason ??
+                        "Artifact identity is unavailable for this observation.",
+                ]
                 : []),
             ...(observation.limitations ?? []),
         ],
         locations: [...(observation.locations ?? [])],
         evidence_links: [...(observation.evidenceLinks ?? [])],
     };
-    const normalized = evidenceRecordSchema.parse({
+    // Select the known envelope before parsing. A union otherwise traverses and
+    // clones a legacy result for the profiled branch before rejecting its absent
+    // profile and trying the legacy branch.
+    const schema = observation.analysisProfile === undefined
+        ? evidenceBaseSchema
+        : profiledEvidenceSchema;
+    const normalized = schema.parse({
         ...semantic,
         evidence_id: `ev_${"0".repeat(64)}`,
         subject,
     });
-    return parseEvidence({
+    // The envelope has already been parsed into an independent snapshot. Only
+    // its derived identifier changes here; parsing again clones the full payload
+    // and recomputes the same digest while the previous snapshot is still live.
+    return {
         ...normalized,
         evidence_id: computeEvidenceId(normalized),
-    });
+    };
 };