simframe 0.8.0 → 0.9.0

package/scripts/bench-hpi.mjs

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+// The agent half of the Human Parity Index.
+//
+// Runs every flow in the suite N times, exactly as an agent would run it, and
+// reduces the flow records to an HPI report. The human half is recorded once
+// by a person (`simframe baseline record`) and committed; this side is
+// re-measured on every run, which is what makes HPI a trend rather than a
+// claim.
+//
+// Two rules this file follows, both learned in this repo:
+//
+//   - Nothing is verified through a pipe. `node script.mjs | tail -3` exits
+//     with tail's status, and this project has already shipped a check that
+//     could not fail because of it. Every gate here is an exit code.
+//   - A missing human baseline is reported, never defaulted. HPI_time with no
+//     denominator is null; it is not 1.0, and it is not "parity".
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { runScript } from '../src/actions.js';
+import * as api from '../src/index.js';
+import * as baseline from '../src/baseline.js';
+import * as metrics from '../src/metrics.js';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const arg = (name, fallback = null) => {
+  const hit = process.argv.find((a) => a.startsWith(`--${name}=`));
+  return hit ? hit.slice(name.length + 3) : fallback;
+};
+const has = (name) => process.argv.includes(`--${name}`);
+
+const device = arg('device');
+const runs = Math.max(1, Number(arg('runs', '3')));
+const only = arg('flow');
+const out = arg('out');
+const baselineFile = arg('baseline', path.join(ROOT, 'docs', 'research', 'hpi-baseline.json'));
+const gate = has('gate');
+/**
+ * How many times to measure the whole suite.
+ *
+ * Three when gating, because one measurement is mostly noise: identical code
+ * measured three times the same afternoon gave HPI_time 0.475, 0.413 and
+ * 0.371. The gate reads the median of the passes, which is what lets the time
+ * band stay as tight as 25% instead of being widened to cover a single run's
+ * spread.
+ */
+const passes = Math.max(1, Number(arg('passes', gate ? '3' : '1')));
+/**
+ * A pause between runs, and it is not superstition.
+ *
+ * Measured on one 8-run loop: 15.2 s, 15.2 s, then 6.9 s failing, then 25.7 s,
+ * 25.7 s, then the display wedged — and it wedged again within a couple of
+ * minutes of the same load after a device restart. Relaunching an app as fast
+ * as a script can is not what this suite is trying to measure, and a simulator
+ * asked to do it degrades and then stops rendering. The suite paces itself so
+ * the numbers describe simframe rather than the simulator's tolerance for
+ * being hammered.
+ */
+const cooldownMs = Math.max(0, Number(arg('cooldown', '1500')));
+
+const suite = baseline.loadSuite(arg('suite', baseline.SUITE_FILE)).filter((f) => !only || f.name === only);
+if (!suite.length) {
+  console.error(`no flows to run${only ? ` matching "${only}"` : ''}`);
+  process.exit(2);
+}
+
+const { device: dev } = await api.ensureDaemon(device);
+console.log(`device: ${dev.name} (${dev.udid})`);
+console.log(`suite: ${suite.map((f) => f.name).join(', ')} × ${runs} run(s) × ${passes} pass(es)\n`);
+
+const ids = new Set();
+let hardFailures = 0;
+/**
+ * A wedged capture loop is not a slow flow, and every run after it is doomed.
+ *
+ * Measured four times in one session: the display surface stops being readable
+ * mid-suite, the daemon re-resolves the display port and still gets nothing,
+ * and only restarting the device cures it. Grinding through the remaining runs
+ * produced three identical "could not run at all" lines and an HPI computed
+ * from whatever happened to finish first — a number with a hole in it, which
+ * is worse than no number.
+ */
+const WEDGED = /display surface could not be read|did not produce a frame/;
+/**
+ * The host could not do the thing, as distinct from simframe doing it slowly.
+ *
+ * A hosted runner takes 47-55 s to fail `simctl launch com.apple.Preferences`
+ * and then fails it again, three runs in a row — the same class of fault this
+ * repo already records for `simctl openurl`, which returns "Operation timed
+ * out" on a loaded runner. Six of those is nine minutes of CI spent measuring
+ * the runner's patience, and the resulting HPI describes nothing.
+ */
+const ENVIRONMENT = /could not launch|Command failed: xcrun simctl (launch|terminate)|Operation timed out|timed out/i;
+/** Two environmental failures of the same flow is the environment, not a flake. */
+const ENV_GIVE_UP = 2;
+let abort = null;
+const envFailures = new Map();
+
+const passSets = [];
+outer: for (let pass = 1; pass <= passes; pass += 1) {
+  const thisPass = new Set();
+  passSets.push(thisPass);
+  if (passes > 1) console.log(`pass ${pass}/${passes}`);
+  for (const flow of suite) {
+    for (let run = 1; run <= runs; run += 1) {
+    // The same start state the human baseline was recorded from: app not
+    // running, on the home screen. Not part of the timed flow, and
+    // deliberately not expressed as flow steps — see baseline.resetFor.
+    // The reset and its settle live inside the same guard as the run.
+    //
+    // They did not, and a device whose display had failed threw out of
+    // `waitFor` — outside the try — killing the process with a stack trace
+    // instead of the one classification this script exists to make. An
+    // environmental failure has to be classified wherever it happens, not
+    // only where it was convenient to catch.
+    let res;
+    try {
+      const reset = await baseline.resetFor(dev.udid, flow);
+      if (reset.failures.length) console.log(`  (reset: ${reset.failures.join('; ')})`);
+      await api.waitFor(dev.udid, { mode: 'stable', stableMs: 400, timeoutMs: 4000 });
+      res = await runScript(dev.udid, {
+        steps: flow.steps,
+        flowName: flow.name,
+        minSteps: flow.minSteps ?? null,
+      });
+    } catch (err) {
+      // A flow that could not start at all is not a slow flow. It has no
+      // record, so it cannot be averaged into anything; it is reported and
+      // counted.
+      hardFailures += 1;
+      console.log(`FAIL ${flow.name} run ${run}: ${err.message}`);
+      if (WEDGED.test(err.message)) {
+        abort = { kind: 'capture is wedged', message: err.message };
+        break outer;
+      }
+      if (ENVIRONMENT.test(err.message)) {
+        const n = (envFailures.get(flow.name) ?? 0) + 1;
+        envFailures.set(flow.name, n);
+        if (n >= ENV_GIVE_UP) {
+          abort = { kind: `the host cannot run "${flow.name}"`, message: err.message.split('\n')[0] };
+          break outer;
+        }
+      }
+      continue;
+    }
+    ids.add(res.flowId);
+    thisPass.add(res.flowId);
+    const verdicts = res.results.map((r) => r.verification?.verdict).filter(Boolean);
+    console.log(
+      `${res.ok ? 'ok  ' : 'FAIL'} ${flow.name.padEnd(24)} run ${run}/${runs}  ` +
+        `${String(res.totalMs).padStart(6)}ms  ${res.ranSteps}/${res.totalSteps} steps  ` +
+        `${verdicts.filter((v) => v !== 'ok').length ? `verdicts: ${verdicts.join(',')}` : 'all ok'}`,
+    );
+    if (!res.ok) console.log(`     ${res.results.filter((r) => !r.ok).map((r) => r.error).join('; ')}`);
+    if (cooldownMs) await new Promise((r) => setTimeout(r, cooldownMs));
+    }
+  }
+}
+
+// This process's runs only. The log is append-only and holds every earlier
+// measurement, which is what makes it a trend — but a CI number computed over
+// somebody's local runs from last week is not this commit's number.
+const flows = metrics.readFlows(dev.udid).filter((f) => ids.has(f.flow_id));
+const humans = baseline.readBaselines();
+// Each pass measured on its own, so the gate can take a median over them
+// rather than trusting one. Accuracy is pooled over every run instead: one
+// wrong action in thirty is a wrong action, and a median would hide it.
+const allFlows = metrics.readFlows(dev.udid);
+const passReports = passSets
+  .map((set) => metrics.hpi({ flows: allFlows.filter((f) => set.has(f.flow_id)), baselines: humans }))
+  .filter((r) => r.overall.runs > 0);
+const passTimes = passReports.map((r) => r.overall.hpi_time).filter((t) => Number.isFinite(t));
+
+const report = {
+  ...metrics.hpi({ flows, baselines: humans }),
+  measured_at: new Date().toISOString(),
+  device: { udid: dev.udid, name: dev.name, runtime: dev.runtime },
+  runs_per_flow: runs,
+  passes,
+  pass_hpi_time: passTimes,
+  hard_failures: hardFailures,
+  human_baselines: Object.fromEntries(
+    Object.entries(humans).map(([k, v]) => [k, { runs: v.runs, p50: v.wall_time_ms?.p50 ?? null }]),
+  ),
+};
+
+console.log('\nflow                      runs  agent p50   human p50   HPI_time  step_ratio');
+for (const f of report.flows) {
+  console.log(
+    `${f.flow.padEnd(24)} ${String(f.runs).padStart(5)}  ${`${f.agent_ms.p50}ms`.padStart(9)}   ` +
+      `${(f.human_median_ms ? `${f.human_median_ms}ms` : '—').padStart(9)}   ` +
+      `${String(f.hpi_time ?? '—').padStart(8)}  ${String(f.step_ratio ?? '—').padStart(10)}`,
+  );
+}
+report.overall.hpi_time_median_of_passes = passTimes.length ? Number(metrics.median(passTimes).toFixed(3)) : null;
+const o = report.overall;
+console.log(`\nHPI_accuracy ${o.hpi_accuracy}   HPI_time ${o.hpi_time ?? '—'}   HPI ${o.hpi ?? '—'}   step_ratio ${o.step_ratio ?? '—'}`);
+if (passTimes.length > 1) {
+  console.log(`HPI_time per pass: ${passTimes.join(', ')} — median ${o.hpi_time_median_of_passes} (what the gate reads)`);
+}
+if (o.hpi_time == null) {
+  console.log(`no human baseline for any measured flow — HPI_time and HPI are null, not 1.0.`);
+  console.log(`record one: simframe baseline record <flow> --device=${dev.udid} --runs=5`);
+}
+
+if (out) {
+  fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+  console.log(`wrote ${out}`);
+}
+
+const escalations = metrics.breakdown(metrics.readEscalations(dev.udid));
+console.log(`\nescalations in this device's log: ${escalations.total} (${Object.entries(escalations.by_reason).filter(([, n]) => n).map(([r, n]) => `${r} ${n}`).join(', ') || 'none'})`);
+
+if (abort) {
+  console.error(`\n${abort.kind}: ${abort.message}`);
+  console.error('No comparable HPI was measured — what is above is a partial suite and');
+  console.error('must not be adopted as a baseline or read as a regression.');
+  if (/wedged/.test(abort.kind)) {
+    console.error('Only restarting the device is known to cure a wedge:');
+    console.error(`  xcrun simctl shutdown ${dev.udid} && xcrun simctl boot ${dev.udid}`);
+  }
+  // 2, not 1. "I could not measure" and "it got worse" are different answers,
+  // and a job that reports them with the same exit code teaches people to
+  // ignore both. The workflow treats 2 as a loud warning and 1 as a failure.
+  process.exit(2);
+}
+
+if (hardFailures) {
+  console.error(`\n${hardFailures} flow run(s) could not run at all.`);
+  process.exit(1);
+}
+
+if (!gate) process.exit(0);
+
+// ------------------------------------------------------------------ the gate
+const committed = fs.existsSync(baselineFile) ? JSON.parse(fs.readFileSync(baselineFile, 'utf8')) : null;
+if (!committed) {
+  // Loudly inactive rather than quietly passing. A gate with nothing to
+  // compare against cannot detect a regression, and saying "ok" here is how a
+  // CI job comes to mean nothing.
+  console.log(`\nGATE INACTIVE — no committed baseline at ${path.relative(ROOT, baselineFile)}.`);
+  console.log('Commit this run as the baseline to arm it.');
+  process.exit(0);
+}
+
+const base = committed.overall ?? {};
+const failures = metrics.gateAgainst(committed, report);
+
+console.log(`\ngate vs ${path.relative(ROOT, baselineFile)} (measured ${committed.measured_at ?? '?'})`);
+console.log(`  HPI_accuracy ${base.hpi_accuracy ?? '—'} -> ${o.hpi_accuracy ?? '—'}`);
+console.log(`  HPI_time     ${metrics.gateTime(base) ?? '—'} -> ${metrics.gateTime(o) ?? '—'}`);
+console.log(`  band         ${metrics.TIME_REGRESSION * 100}% (median of ${passTimes.length || 1} pass(es))`);
+for (const f of failures) console.log(`FAIL ${f}`);
+process.exit(failures.length ? 1 : 0);

package/scripts/check-package.mjs

@@ -75,6 +75,13 @@ function requiredFiles() {
     throw new Error('no skill found under skills/ — has the layout moved? This check would silently pass.');
   }
 
+  // The flow suite. `simframe baseline` and `simframe hpi` read it at
+  // runtime, so an absent one is a command that only fails once installed.
+  for (const f of walk(path.join(ROOT, 'flows'), (p) => p.endsWith('.json'))) required.add(rel(f));
+  if (!walk(path.join(ROOT, 'flows'), (p) => p.endsWith('.json')).length) {
+    throw new Error('no flow suite found under flows/ — has the layout moved? This check would silently pass.');
+  }
+
   // Anything package.json points at to run.
   const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
   for (const target of Object.values(pkg.bin ?? {})) required.add(target.replace(/^\.\//, ''));

package/src/actions.js

@@ -6,6 +6,8 @@ import * as api from './index.js';
 import * as graph from './graph.js';
 import * as input from './input.js';
 import * as intent from './intent.js';
+import * as metrics from './metrics.js';
+import * as screenmap from './screenmap.js';
 import { launchApp, openUrl, setPermission, terminateApp } from './platform/index.js';
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -112,6 +114,12 @@ export async function runScript(
     // Rebuild the HID session and retry once when a hardware button provably
     // did nothing. Off only for a caller deliberately testing that path.
     recoverInput = true,
+    // What this run is called and how few steps it could take, for the flow
+    // record. A bare `sim_do` has neither and says so with nulls rather than
+    // inventing a name — an unnamed run still gets timed, it just cannot be
+    // compared against a human baseline.
+    flowName = null,
+    minSteps = null,
     options,
   } = {},
 ) {
@@ -119,6 +127,24 @@ export async function runScript(
   const { device } = await api.ensureDaemon(deviceQuery, options);
   const udid = device.udid;
   const startedAt = Date.now();
+  // Measurement only. Nothing below reads these, and a failure to write one
+  // can never change what a step does — see `note`.
+  const flowId = metrics.newFlowId();
+  const escalations = [];
+  const verdicts = [];
+  // Named noteEscalation, not note: the step loop below declares its own
+  // `note` string for the no-visible-change suffix, which shadowed this and
+  // turned every escalating verdict into a failed step reading "note is not a
+  // function". The try/catch inside here could not help — the throw was at the
+  // call site, one scope out. Instrumentation that can fail a flow is worse
+  // than no instrumentation.
+  const noteEscalation = (record) => {
+    try {
+      escalations.push(metrics.recordEscalation(udid, { flowId, ...record }));
+    } catch {
+      /* instrumentation must not be able to fail a flow it is only watching */
+    }
+  };
 
   const needsInput = steps.some((s) => ACTION_STEPS.has(normalizeStep(s).action));
   if (needsInput) {
@@ -165,13 +191,58 @@ export async function runScript(
     const prediction = verify && beforeScreen?.hash ? graph.predict(udid, beforeScreen, step) : null;
     try {
       let detail = await runStep(deviceQuery, udid, step, { screen, options, frames });
+      // How long this transition has cost before, on this screen, for this
+      // action. A cold edge gets the old fixed default and says so; a measured
+      // one gets p95 plus a margin. Research §7.
+      const learned = verify && beforeScreen?.hash ? graph.timingFor(udid, beforeScreen, step) : null;
+      // How long this screen must hold still before it counts as settled.
+      //
+      // 500 ms was a constant paid by every step of every flow, and it is the
+      // reducible half of a settle: the rest is the transition genuinely
+      // taking time. An edge whose transition has never paused mid-flight
+      // needs 150 ms of quiet, not 500. Capped at the caller's own value, so
+      // this can only ever shorten a wait.
+      // NOT YET USED TO DECIDE ANYTHING, and the reason is worth the space.
+      //
+      // `graph.stillnessFor` computes a shorter window from the longest pause
+      // ever observed inside this transition, and measured live it made the
+      // Settings flow 8.0 s instead of 11.5 s — and wrong. Eight runs in a row
+      // failed at step 2 with the screen still showing Settings root, because
+      // step 1's settle returned mid-push, `screenIdentity` then read the
+      // screen we had not left yet, and the graph learned root -> root as a
+      // verified edge and started predicting it.
+      //
+      // The flaw is in the estimator, not the idea: the gap statistic is
+      // gathered only from what a wait itself observed, so a wait that ends
+      // early never sees the pauses that come later, the gaps look like zero,
+      // the window ratchets down, and the next wait ends earlier still. A
+      // self-reinforcing bias with a wrong graph at the end of it.
+      //
+      // The unbiased estimator is available and is a separate piece of work:
+      // the frame history holds every frame's timestamp and diff, so the true
+      // motion profile of a transition can be computed *after* it is over
+      // rather than from inside the wait that cut it short. Until then the
+      // gaps are recorded and not acted on — measuring is safe, and this is
+      // Phase 11's own rule that a learned number may only ever shorten a
+      // wait, applied to itself.
+      const stillness = step.stableMs ?? stableMs;
+      const stillnessPlan = learned ? graph.stillnessFor(learned, stillness) : { cold: true };
+      // A settle is not satisfied until the screen has held still for
+      // `stillness`, so a budget below that can never be met — and the learned
+      // p95 is measured from waits that include the stillness window, which
+      // makes it self-consistent but not self-evidently so. A tab switch with
+      // a p95 of 90ms would get a 240ms budget and then time out at 240ms
+      // waiting for 500ms of quiet, turning every fast edge into a failure.
+      const floorMs = stillness + 250;
+      const budgetMs = step.timeoutMs
+        ?? (learned && !learned.cold ? Math.max(learned.timeoutMs, floorMs) : timeoutMs);
       const settleFor = async () => {
         if (!autoSettle || !ACTION_STEPS.has(step.action)) return null;
         const w = await api.waitFor(deviceQuery, {
           mode: 'settle',
           since: before,
-          stableMs: step.stableMs ?? stableMs,
-          timeoutMs: step.timeoutMs ?? timeoutMs,
+          stableMs: stillness,
+          timeoutMs: budgetMs,
           options,
         });
         return {
@@ -180,9 +251,55 @@ export async function runScript(
           sawChange: w.sawChange,
           stalled: Boolean(w.stalled),
           noVisibleChange: Boolean(w.noVisibleChange),
+          // What this wait was allowed, and where the number came from. A
+          // timeout nobody can explain is how a fixed sleep comes back as a
+          // constant with a comment.
+          budgetMs,
+          stillnessMs: stillness,
+          quietGapMs: w.quietGapMs,
+          timing: learned
+            ? {
+              p50: learned.p50,
+              p95: learned.p95,
+              samples: learned.samples,
+              cold: learned.cold,
+              gapP95: learned.gapP95,
+              gapSamples: learned.gapSamples,
+              // What it *would* have been, for the eval that has to happen
+              // before this is trusted with a wait.
+              stillnessWouldBe: stillnessPlan.stillnessMs ?? null,
+            }
+            : null,
         };
       };
       let settled = await settleFor();
+      // A screen that is still working earns more time; a screen doing nothing
+      // visible has already answered. Research §7: keep waiting past p95 only
+      // while the transition classifier says something is loading, and never
+      // past Nielsen's 10 s — at which point it escalates with the timing
+      // attached rather than waiting longer.
+      if (settled && !settled.ok && !settled.noVisibleChange && learned && !learned.cold) {
+        const kind = (await api.getState(deviceQuery, { options })).state.transition?.kind;
+        const verdict = graph.slowerThanUsual({
+          elapsedMs: settled.waitedMs, p95: learned.p95, settled: false, kind,
+        });
+        if (verdict.keepWaiting) {
+          const remaining = graph.HARD_CAP_MS - settled.waitedMs;
+          const more = await api.waitFor(deviceQuery, {
+            mode: 'settle', since: before, stableMs: stillness, timeoutMs: remaining, options,
+          });
+          settled = {
+            ...settled,
+            ok: more.satisfied,
+            waitedMs: settled.waitedMs + more.waitedMs,
+            sawChange: settled.sawChange || more.sawChange,
+            quietGapMs: Math.max(settled.quietGapMs ?? 0, more.quietGapMs ?? 0),
+            slowerThanUsual: verdict.note,
+          };
+        } else if (verdict.slower) {
+          settled = { ...settled, slowerThanUsual: verdict.note };
+        }
+      }
 
       // A hardware button that moved nothing did not arrive.
       //
@@ -227,7 +344,19 @@ export async function runScript(
         // nothing at all.
         endScreen = afterScreen;
         if (afterScreen.confirmed && afterScreen.hash) {
-          graph.record(udid, { from: beforeScreen, action: step, to: afterScreen, kind });
+          // The observed cost of this transition, which is what makes the next
+          // one adaptive. Only from a settle that was actually satisfied: a
+          // timeout is not a measurement of how long the screen takes, it is a
+          // measurement of how long we were prepared to wait.
+          graph.record(udid, {
+            from: beforeScreen, action: step, to: afterScreen, kind,
+            settleMs: settled?.ok ? settled.waitedMs : undefined,
+            // The pause statistic is worth having from any settle that saw the
+            // screen move, satisfied or not: a transition that paused for
+            // 400ms and then timed out is exactly the case a 150ms stillness
+            // window would have got wrong.
+            quietGapMs: settled?.sawChange ? settled.quietGapMs : undefined,
+          });
           carriedScreen = afterScreen;
         }
       }
@@ -244,6 +373,25 @@ export async function runScript(
         settled,
       });
       const halt = haltDecision({ verification, stopOnUnexpected, continueOnError });
+      if (verification?.verdict) verdicts.push(verification.verdict);
+      if (metrics.ESCALATING_VERDICTS.has(verification?.verdict)) {
+        noteEscalation({
+          stepIndex: i,
+          fingerprint: beforeScreen?.hash ?? null,
+          reason: 'verification_failed',
+          candidates: [],
+          // A halted run is a decision simframe made and stopped on; a step
+          // that moved nothing carries on and leaves the judgement to whoever
+          // reads the result.
+          outcome: halt.halt ? 'failed' : 'escalated_to_model',
+          wallMs: Date.now() - stepStart,
+          detail: `${verification.verdict}: ${verification.detail}`
+            + (settled?.slowerThanUsual ? ` [${settled.slowerThanUsual}]` : '')
+            + (settled?.timing && !settled.timing.cold
+              ? ` [waited ${settled.waitedMs}ms of a ${settled.budgetMs}ms budget; p95 ${settled.timing.p95}ms]`
+              : ''),
+        });
+      }
       if (halt.halt) {
         results[results.length - 1].ok = false;
         results[results.length - 1].error = halt.error;
@@ -252,20 +400,52 @@ export async function runScript(
       }
     } catch (err) {
       results.push({ index: i, action: step.action, ok: false, ms: Date.now() - stepStart, error: err.message });
+      const why = metrics.reasonForStepError(step, err);
+      noteEscalation({
+        stepIndex: i,
+        fingerprint: beforeScreen?.hash ?? metrics.fingerprintNow(udid, screenmap),
+        reason: why.reason,
+        candidates: why.candidates,
+        tried: why.tried,
+        outcome: 'failed',
+        wallMs: Date.now() - stepStart,
+        detail: err.message,
+      });
       failed = true;
       if (!continueOnError) break;
     }
   }
 
+  const wallMs = Date.now() - startedAt;
+  try {
+    metrics.recordFlow(udid, metrics.flowRecordFrom({
+      flowId,
+      flowName,
+      udid,
+      startedAt,
+      wallMs,
+      stepsTaken: results.length,
+      totalSteps: steps.length,
+      minSteps,
+      imagesSent: frames.length,
+      escalations,
+      verdicts,
+      completed: !failed && results.length === steps.length,
+    }));
+  } catch {
+    /* as above: a flow that ran is not a flow that failed because of a log */
+  }
+
   return {
     device,
     // Returned so a run that verified end to end can be handed straight to
     // navigate.saveFlow without the caller reassembling what it just ran.
     steps,
+    flowId,
     endScreen,
     results,
     ok: !failed,
-    totalMs: Date.now() - startedAt,
+    totalMs: wallMs,
     ranSteps: results.length,
     totalSteps: steps.length,
     frames,