gflow-cli 0.57.1__tar.gz → 0.58.0__tar.gz

{gflow_cli-0.57.1 → gflow_cli-0.58.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.57.1",
+  "version": "0.58.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.57.1 → gflow_cli-0.58.0}/CHANGELOG.md

@@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.58.0] — 2026-08-16
+
+### Fixed
+
+- **R2V named remote references (`ref_names`) work again after Flow's picker
+  redesign — live-verified end to end (#529 follow-up).** Two UI drifts had
+  silently broken the name-attach path on every locale: the picker dialog no
+  longer exposes an accessible tree, so the old ARIA role+name tile match could
+  never find a result (the tile is now matched by its text, anchored so a
+  substring name still cannot attach the wrong asset, tolerating the localized
+  media-type badge the tile text appends, e.g. `…Imagem` on a pt profile); and
+  clicking a result tile now attaches directly and closes the picker — the
+  legacy include-button flow runs only if the dialog stays open. Proven by a
+  new live e2e that seeds a t2i image, reads its recorded `displayName` back
+  from the catalog by UUID, and generates a real R2V video with it
+  (`tests/e2e/test_video_r2v_uuid_name_e2e.py`), alongside a new same-project
+  image-picker e2e pinning the #529 exact-UUID-tile happy path.
+
+### Changed
+
+- **Catalog image UUIDs now resolve through Flow display names instead of
+  scrolling or UUID/prompt searches (#529).** A headed-Chrome spike against a
+  populated Compiled Growth story project proved the picker contract:
+  catalog UUID → `workflows[].metadata.displayName` → browser name search →
+  exact UUID-in-thumbnail tile. A duplicate-name search surfaced two distinct
+  UUIDs and the exact matcher selected the requested identity, with zero scroll
+  calls or generation requests. The UI response collector now preserves the
+  sibling workflow name so new generated-image catalog rows retain the picker
+  search key when prompt history is stored (`history_prompts=redacted` omits the
+  potentially prompt-derived caption); image `--ref <uuid>` and I2V frame UUIDs
+  are enriched with that name before browser work. UUID, UUID-stem, prompt-hint,
+  and unfiltered-grid scroll fallbacks are removed from this path. Image refs
+  retain their recorded local-file upload fallback; CLI and MCP I2V frames keep
+  the UUID, name, and fallback together for both slots. Local fallbacks are used
+  only when their recorded byte count/SHA-256 still matches. A missing/stale
+  name or unavailable search input falls through to that verified upload or a
+  typed failure—never an unfiltered viewport click, grid scan, or implicit
+  Playwright scroll. UUID-backed I2V requests now also activate the post-submit
+  route guard that rejects a credit-spent T2V response.
+  This supersedes #287's prompt-hint and UUID-grid-scroll guidance; the sanitized
+  evidence is recorded in the [#529 picker spike](docs/superpowers/spikes/2026-08-15-picker-tile-alt-text.md),
+  and [#541](https://github.com/ffroliva/gflow-cli/issues/541) records the refuted
+  prompt-hint hypothesis.
+
 ## [0.57.1] — 2026-08-14
 
 ### Fixed
@@ -2977,7 +3021,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.57.1...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.58.0...HEAD
+[0.58.0]: https://github.com/ffroliva/gflow-cli/compare/v0.57.1...v0.58.0
 [0.57.1]: https://github.com/ffroliva/gflow-cli/compare/v0.57.0...v0.57.1
 [0.57.0]: https://github.com/ffroliva/gflow-cli/compare/v0.56.0...v0.57.0
 [0.56.0]: https://github.com/ffroliva/gflow-cli/compare/v0.55.0...v0.56.0

{gflow_cli-0.57.1 → gflow_cli-0.58.0}/KNOWN_ISSUES.md

@@ -133,6 +133,28 @@ upload). Negative check: a foreign UUID exits 9 pre-generation with a
 project must be entered via `--project`, and projects that open in the
 full-page media-library UI (#174) can fail earlier at `mode_switch_trigger`.
 
+> **Superseded (v0.58.0, [#529](https://github.com/ffroliva/gflow-cli/issues/529)):**
+> the scroll-tier/UUID-search picker mechanics described above are gone. Frame
+> and image UUIDs now resolve through the catalog's recorded Flow
+> `display_name` (name search → exact UUID-in-thumbnail tile), with an
+> integrity-verified local-file upload as the only fallback. This entry is
+> retained as the historical record of the #287-era behavior.
+
+### Fresh generations may record without a `display_name` (async Flow caption)
+
+- **Status:** Open — tracked in [#543](https://github.com/ffroliva/gflow-cli/issues/543) (backfill command)
+- **Affected:** UUID `--ref` / frame references to *just-generated* assets (v0.58.0+)
+
+Flow computes an asset's caption (`displayName`) asynchronously server-side, so
+a generation's response occasionally lacks it and the recorder correctly
+stores no name (observed live 2026-08-16 during the r2v e2e). Such rows skip
+the picker-selection path and use the integrity-verified local-file upload
+fallback instead — correct but a duplicate upload. Also by design, rows
+recorded before v0.58.0 and all rows under
+`GFLOW_CLI_HISTORY_PROMPTS=redacted` have no stored name. #543 proposes a
+credit-free, privacy-gated `gflow data backfill-names` command; #542's
+`gflow doctor` will surface the affected-row count.
+
 ### Video duration tab probe misses on the current Frames-submode DOM
 
 - **Status:** Open ([#288](https://github.com/ffroliva/gflow-cli/issues/288))

{gflow_cli-0.57.1 → gflow_cli-0.58.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.57.1
+Version: 0.58.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.57.1/website → gflow_cli-0.58.0}/docs/CONFIGURATION.md

@@ -312,6 +312,14 @@ mode also records the submitted `expanded_prompt` and a full `metadata_json.tool
 `redacted` withholds the expanded prompt and reduces the descriptor to
 `{name, version, params_hash, config_hash}`. See [PROMPT_EXPANSION.md](PROMPT_EXPANSION.md).
 
+**Reference-resolution trade-off (v0.58.0, #529):** `redacted` also withholds the
+catalog `display_name` Flow assigns to generated images (the caption can closely
+paraphrase the prompt). Since UUID `--ref`/frame references resolve through that
+name in the media picker, redacted-mode catalog rows skip the picker-selection
+path and fall back to the integrity-verified local-file upload — or a typed
+failure when no verified file exists. This is deliberate: the privacy boundary
+outranks picker convenience.
+
 ```bash
 GFLOW_CLI_HISTORY_PROMPTS=redacted gflow image t2i "confidential brief"
 ```

{gflow_cli-0.57.1 → gflow_cli-0.58.0}/docs/INDEX.md

@@ -140,7 +140,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"A command failed — where is the incident bundle and what's in it?"** → [DEBUGGING § Automatic incident bundles](DEBUGGING.md#automatic-incident-bundles) (layout, triggers, review-before-sharing); privacy boundaries: [SECURITY § Automatic incident bundles](SECURITY.md#automatic-incident-bundles-gflow_cli_incident_capture-default-on); disable via [CONFIGURATION § GFLOW_CLI_INCIDENT_CAPTURE](CONFIGURATION.md#gflow_cli_incident_capture)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.57.1](LIVE_VERIFICATION_v0.57.1.md) (**#493 and #451/#288 root-caused and fixed from live evidence, verified 2026-08-14 on profile `denon82` (pt-BR — the #493 reporter's locale), ZERO credits** — #493 was NOT an unrecognized "third editor variant": "Inicial"/"Final" are the Frames sub-mode's Start/End slots and the "Agente" pill is the ordinary Agent button, both stock classic features. The real trigger is Flow's **expanded chat sidebar**, which removes the classic composer entirely [`crop_* = 0` AND `Agent pill = 0` simultaneously] — one state producing both reported symptoms, and the reason the failure was exit 23 rather than the retryable 25 [no agentic indicator on screen, so the cohort detector matched nothing]. Recovery hinged on a close button scoped to the sidebar's `edit_square` affordance, a single point of failure for any cohort lacking that ligature; an unscoped fallback now fires only from the demonstrably stuck state, **A/B-proven three ways** [scoped broken + fallback present → rescued; both broken → NOT recovered, which is what proves the fallback rescues rather than the surrounding loop]. #451/#288 were never selector drift either — Flow's settings popover is **model-conditional**, only `omni-flash` renders a duration row, so `--duration` on a Veo model hunted a control that is never drawn [verified on 2 accounts × 2 locales]; it now exits 2 before any browser work. Two #493 hypotheses were tested and **refuted** first and are committed so they are not re-derived [a `crop_free` sub-mode trigger — the trigger reflects the *aspect*, not the sub-mode; and a hydration race — a wait was written, A/B-neutered, and cold loads passed 3/3 BOTH ways, so it was reverted rather than shipped]. Recorded not-verified: the `veo_3_1_lite_lower_priority` picker miss is **inconclusive** [the capture came after the menu closed] so that selector was deliberately left untouched, and `chain.py`'s per-link duration aborts mid-run after billing — deferred with the finding recorded). Prior: [LIVE_VERIFICATION_v0.57.0](LIVE_VERIFICATION_v0.57.0.md) (**#299 video UI-mode policy + the #496/#497/#498/#501 MCP wave live-verified 2026-08-14 on profile `ffroliva`, ZERO credits** — three real video-editor loads bound the classic driver through `get_ui_driver` [`ui_driver.bound mode=classic`, 1.2–1.7 s, aborted pre-submit], `--ui-mode agentic` is refused with **exit 2 before any browser launch** [deliberately not exit 28, whose "retry may land it" hint would mislead for a driver that does not exist], and a real-editor classic→agent→classic round-trip proved `ensure_agent_mode`'s aria-verified real click [`{"agent_acted":true,"after_agent":"agent","after_media":"media"}`]; the MCP surfaces were driven over the **real stdio JSON-RPC wire** [subprocess `gflow mcp run`, so registration *and* stream routing are covered]: `--no-spend` cut `tools/list` from 11 tools to 9 with both generate tools genuinely unregistered rather than refused, zero-arg `gflow_auth_status` returned `authenticated` off a live `GET /fx/api/auth/session` **200**, `gflow_list_projects` returned **different project IDs** on offset 0 vs offset 2 [proving the offset is honored — catalogs larger than `limit` were previously unreachable] with `limit=0`→1 and `offset=-5`→0 clamps holding, and the known-issues resource served a **7,543-byte index** against a ~70 KB source file with a **111-byte** capped unknown-slug reply. The #498 rate-limited problem-details envelope is recorded **not live-verified with reason** — exhausting the token bucket needs ≥9 accepted generate calls, so the error path cannot be reached credit-free; it is unit-pinned for both tools instead). Prior: [LIVE_VERIFICATION_v0.56.0](LIVE_VERIFICATION_v0.56.0.md) (**#477 downgrade guard, #478 bounded lease wait, and the #493 mode-switch path live-verified 2026-08-13 on profile `denon82`, images only** — a fresh-project 16:9 `t2i` exercised the #493-touched mode-switch path end-to-end [valid `ff d8` JPEG 1376×768, `image_mode_entered` → `batch_response_captured`]; the #477 guard refused a scratch profile claiming Chromium 999 with **exit 11 pre-auth, pre-credits** at the generation-client call site; #478 was proven with three concurrent runs — `WAIT=0` control failed fast with `ProfileLockedError` exit 11 while the holder held, and the `WAIT=180` waiter polled ~11 s past the holder's natural release then generated successfully; the #493 drift branch itself is a named skip [only an affected account's new-editor cohort can reach it — the fix's message text is unit-pinned], and #479's update notice is deferred-with-reason to a post-release check [it needs a published newer version on PyPI and skips editable installs by design]; an expired denon82 session 401'd the first two attempts [external state, re-login fixed it, recorded not omitted]). Prior: [LIVE_VERIFICATION_v0.55.0](LIVE_VERIFICATION_v0.55.0.md) (**Tier-1 quick wins #471–#476 verified 2026-08-13 on profile `ffroliva`, ZERO credits** — `gflow auth status` probed the real Flow session endpoint live [`Flow session verified as ffroliva@gmail.com.`, exit 0, fail-closed contract pinned]; `gflow mcp setup` ran end-to-end with the real CLI against a scratch copy of the real Claude Desktop config [correct merged entry, pristine original]; the Windows profile-DACL two-step `icacls` idiom was derived empirically [the naive `/t` form broke file access] and is pinned by a real-icacls round-trip test on every Windows host; the incident bug-report template, MCP error funnel [all 11 tools guarded, raw exception text masked], and SecretStr settings are suite-verified with no live-Flow surface — reasons recorded, not omitted). Prior: [LIVE_VERIFICATION_v0.54.0](LIVE_VERIFICATION_v0.54.0.md) (**close-browser guidance #470, character-composer focus fix, overlay/jitter hardening, and SonarCloud-S2245 RNG swap live-verified 2026-08-12 on profile `ffroliva`, ZERO credits** — the new #470 login wording printed verbatim and the manual-close → `auth_flow_session_verified` round-trip worked end-to-end; a Classic-UI `t2i` produced a real 1024×1024 JPEG [`ff d8 ff e0`] exercising overlay dismissal + jitter + image-composer submit + mode controller, and a credit-free `character create` [entity `da3cd647…`, face 1376×768 JPEG] exercised the character-composer path directly [`entering_character_editor` → `prompt_submitted` → `entity_patched` → `completed`]; the first `t2i` hit the known agentic-cohort video-for-image condition [correctly refused via `WireFormatError`, tracked by #299, not a regression] and Classic UI worked around it. First mainline release after the orphaned v0.53.0/v0.53.1 tags — CHANGELOG restores honest 0.53.x sections). Prior: [LIVE_VERIFICATION_v0.52.0](LIVE_VERIFICATION_v0.52.0.md) (**batch DAG references #317, character entity provenance recording #402, and video duration selector cascade fix #451 live-verified 2026-08-05** — 3/3 live E2E tests in `tests/e2e/test_entity_provenance_e2e.py` passed clean on profile `ffroliva`, 5-layer evidence ledger verified). Prior: [v0.51.0](LIVE_VERIFICATION_v0.51.0.md) (**dependency/security/test-correctness release verified 2026-08-05, 1 Imagen credit + 1 Veo attempt** — the only change needing live evidence was the `playwright` bound raise `>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0`, and the 2026-08-03 regression does NOT reproduce on 1.61.0: a live i2v drove `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live i2i local-ref attach passed outright [96.7s]. **1.62.0 stays excluded**, never root-caused. `-m e2e_auth` 16/16, daemon e2e 1 passed [MCP over Streamable HTTP — the first live coverage that test has ever had, it was structurally incapable of passing before], MCP Tasks 5/5 layers, 2923 offline tests, `pip-audit --all-extras` clean. **No finished mp4 is claimed** — Flow's own generation returned `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT`, server-side. Defect found and recorded not omitted: Flow dropped the duration-tab UI so **`--duration` is currently broken for i2v**, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0 — [#451](https://github.com/ffroliva/gflow-cli/issues/451)). Prior: [v0.50.0](LIVE_VERIFICATION_v0.50.0.md) (**MCP Tasks extension SEP-2663, non-blocking task handle responses, CLI/MCP output path hardening -o/--output, and Telegram PR triage alert resilience verified 2026-08-04** — 5-layer evidence ledger note generated at `tmp/live-verify/mcp-tasks.md` confirming instant task handle return, working status queries, and cancelled status DB state transitions; full 118-test suite green). Prior: [v0.49.0](LIVE_VERIFICATION_v0.49.0.md) (**#125 `omni-flash` start-frame I2V video generation, Playwright dependency upper-bound pin `>=1.59.0,<1.60.0`, submission stage watchdog timeout, and #404 count-tab fail-closed logic verified 2026-08-03** — 0-credit wire intercept captured `batchAsyncGenerateVideoStartImage` with `startImage` bound; live costed generation on `omni-flash` I2V produced a 1.2MB valid mp4 video asset on `ffroliva`; full 2902-test release suite green). Prior: [v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
+**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.58.0](LIVE_VERIFICATION_v0.58.0.md) (**#529 catalog-UUID→displayName picker contract + r2v named-reference fixes, verified 2026-08-15/16 on profile `denon82` (pt-BR) via four committed e2e tests, ~7 Imagen + 1 veo-lite generation** — same-project exact-UUID tile attach, cross-project verified upload fallback, loud abort on unresolvable UUIDs, and a real r2v video generated from a catalog name; the r2v e2e caught and fixed two live UI drifts: the picker exposes no accessible tree so tiles are now text-matched, and a tile click attaches directly with the include button demoted to legacy fallback); previously: [LIVE_VERIFICATION_v0.57.1](LIVE_VERIFICATION_v0.57.1.md) (**#493 and #451/#288 root-caused and fixed from live evidence, verified 2026-08-14 on profile `denon82` (pt-BR — the #493 reporter's locale), ZERO credits** — #493 was NOT an unrecognized "third editor variant": "Inicial"/"Final" are the Frames sub-mode's Start/End slots and the "Agente" pill is the ordinary Agent button, both stock classic features. The real trigger is Flow's **expanded chat sidebar**, which removes the classic composer entirely [`crop_* = 0` AND `Agent pill = 0` simultaneously] — one state producing both reported symptoms, and the reason the failure was exit 23 rather than the retryable 25 [no agentic indicator on screen, so the cohort detector matched nothing]. Recovery hinged on a close button scoped to the sidebar's `edit_square` affordance, a single point of failure for any cohort lacking that ligature; an unscoped fallback now fires only from the demonstrably stuck state, **A/B-proven three ways** [scoped broken + fallback present → rescued; both broken → NOT recovered, which is what proves the fallback rescues rather than the surrounding loop]. #451/#288 were never selector drift either — Flow's settings popover is **model-conditional**, only `omni-flash` renders a duration row, so `--duration` on a Veo model hunted a control that is never drawn [verified on 2 accounts × 2 locales]; it now exits 2 before any browser work. Two #493 hypotheses were tested and **refuted** first and are committed so they are not re-derived [a `crop_free` sub-mode trigger — the trigger reflects the *aspect*, not the sub-mode; and a hydration race — a wait was written, A/B-neutered, and cold loads passed 3/3 BOTH ways, so it was reverted rather than shipped]. Recorded not-verified: the `veo_3_1_lite_lower_priority` picker miss is **inconclusive** [the capture came after the menu closed] so that selector was deliberately left untouched, and `chain.py`'s per-link duration aborts mid-run after billing — deferred with the finding recorded). Prior: [LIVE_VERIFICATION_v0.57.0](LIVE_VERIFICATION_v0.57.0.md) (**#299 video UI-mode policy + the #496/#497/#498/#501 MCP wave live-verified 2026-08-14 on profile `ffroliva`, ZERO credits** — three real video-editor loads bound the classic driver through `get_ui_driver` [`ui_driver.bound mode=classic`, 1.2–1.7 s, aborted pre-submit], `--ui-mode agentic` is refused with **exit 2 before any browser launch** [deliberately not exit 28, whose "retry may land it" hint would mislead for a driver that does not exist], and a real-editor classic→agent→classic round-trip proved `ensure_agent_mode`'s aria-verified real click [`{"agent_acted":true,"after_agent":"agent","after_media":"media"}`]; the MCP surfaces were driven over the **real stdio JSON-RPC wire** [subprocess `gflow mcp run`, so registration *and* stream routing are covered]: `--no-spend` cut `tools/list` from 11 tools to 9 with both generate tools genuinely unregistered rather than refused, zero-arg `gflow_auth_status` returned `authenticated` off a live `GET /fx/api/auth/session` **200**, `gflow_list_projects` returned **different project IDs** on offset 0 vs offset 2 [proving the offset is honored — catalogs larger than `limit` were previously unreachable] with `limit=0`→1 and `offset=-5`→0 clamps holding, and the known-issues resource served a **7,543-byte index** against a ~70 KB source file with a **111-byte** capped unknown-slug reply. The #498 rate-limited problem-details envelope is recorded **not live-verified with reason** — exhausting the token bucket needs ≥9 accepted generate calls, so the error path cannot be reached credit-free; it is unit-pinned for both tools instead). Prior: [LIVE_VERIFICATION_v0.56.0](LIVE_VERIFICATION_v0.56.0.md) (**#477 downgrade guard, #478 bounded lease wait, and the #493 mode-switch path live-verified 2026-08-13 on profile `denon82`, images only** — a fresh-project 16:9 `t2i` exercised the #493-touched mode-switch path end-to-end [valid `ff d8` JPEG 1376×768, `image_mode_entered` → `batch_response_captured`]; the #477 guard refused a scratch profile claiming Chromium 999 with **exit 11 pre-auth, pre-credits** at the generation-client call site; #478 was proven with three concurrent runs — `WAIT=0` control failed fast with `ProfileLockedError` exit 11 while the holder held, and the `WAIT=180` waiter polled ~11 s past the holder's natural release then generated successfully; the #493 drift branch itself is a named skip [only an affected account's new-editor cohort can reach it — the fix's message text is unit-pinned], and #479's update notice is deferred-with-reason to a post-release check [it needs a published newer version on PyPI and skips editable installs by design]; an expired denon82 session 401'd the first two attempts [external state, re-login fixed it, recorded not omitted]). Prior: [LIVE_VERIFICATION_v0.55.0](LIVE_VERIFICATION_v0.55.0.md) (**Tier-1 quick wins #471–#476 verified 2026-08-13 on profile `ffroliva`, ZERO credits** — `gflow auth status` probed the real Flow session endpoint live [`Flow session verified as ffroliva@gmail.com.`, exit 0, fail-closed contract pinned]; `gflow mcp setup` ran end-to-end with the real CLI against a scratch copy of the real Claude Desktop config [correct merged entry, pristine original]; the Windows profile-DACL two-step `icacls` idiom was derived empirically [the naive `/t` form broke file access] and is pinned by a real-icacls round-trip test on every Windows host; the incident bug-report template, MCP error funnel [all 11 tools guarded, raw exception text masked], and SecretStr settings are suite-verified with no live-Flow surface — reasons recorded, not omitted). Prior: [LIVE_VERIFICATION_v0.54.0](LIVE_VERIFICATION_v0.54.0.md) (**close-browser guidance #470, character-composer focus fix, overlay/jitter hardening, and SonarCloud-S2245 RNG swap live-verified 2026-08-12 on profile `ffroliva`, ZERO credits** — the new #470 login wording printed verbatim and the manual-close → `auth_flow_session_verified` round-trip worked end-to-end; a Classic-UI `t2i` produced a real 1024×1024 JPEG [`ff d8 ff e0`] exercising overlay dismissal + jitter + image-composer submit + mode controller, and a credit-free `character create` [entity `da3cd647…`, face 1376×768 JPEG] exercised the character-composer path directly [`entering_character_editor` → `prompt_submitted` → `entity_patched` → `completed`]; the first `t2i` hit the known agentic-cohort video-for-image condition [correctly refused via `WireFormatError`, tracked by #299, not a regression] and Classic UI worked around it. First mainline release after the orphaned v0.53.0/v0.53.1 tags — CHANGELOG restores honest 0.53.x sections). Prior: [LIVE_VERIFICATION_v0.52.0](LIVE_VERIFICATION_v0.52.0.md) (**batch DAG references #317, character entity provenance recording #402, and video duration selector cascade fix #451 live-verified 2026-08-05** — 3/3 live E2E tests in `tests/e2e/test_entity_provenance_e2e.py` passed clean on profile `ffroliva`, 5-layer evidence ledger verified). Prior: [v0.51.0](LIVE_VERIFICATION_v0.51.0.md) (**dependency/security/test-correctness release verified 2026-08-05, 1 Imagen credit + 1 Veo attempt** — the only change needing live evidence was the `playwright` bound raise `>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0`, and the 2026-08-03 regression does NOT reproduce on 1.61.0: a live i2v drove `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live i2i local-ref attach passed outright [96.7s]. **1.62.0 stays excluded**, never root-caused. `-m e2e_auth` 16/16, daemon e2e 1 passed [MCP over Streamable HTTP — the first live coverage that test has ever had, it was structurally incapable of passing before], MCP Tasks 5/5 layers, 2923 offline tests, `pip-audit --all-extras` clean. **No finished mp4 is claimed** — Flow's own generation returned `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT`, server-side. Defect found and recorded not omitted: Flow dropped the duration-tab UI so **`--duration` is currently broken for i2v**, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0 — [#451](https://github.com/ffroliva/gflow-cli/issues/451)). Prior: [v0.50.0](LIVE_VERIFICATION_v0.50.0.md) (**MCP Tasks extension SEP-2663, non-blocking task handle responses, CLI/MCP output path hardening -o/--output, and Telegram PR triage alert resilience verified 2026-08-04** — 5-layer evidence ledger note generated at `tmp/live-verify/mcp-tasks.md` confirming instant task handle return, working status queries, and cancelled status DB state transitions; full 118-test suite green). Prior: [v0.49.0](LIVE_VERIFICATION_v0.49.0.md) (**#125 `omni-flash` start-frame I2V video generation, Playwright dependency upper-bound pin `>=1.59.0,<1.60.0`, submission stage watchdog timeout, and #404 count-tab fail-closed logic verified 2026-08-03** — 0-credit wire intercept captured `batchAsyncGenerateVideoStartImage` with `startImage` bound; live costed generation on `omni-flash` I2V produced a 1.2MB valid mp4 video asset on `ffroliva`; full 2902-test release suite green). Prior: [v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)

gflow_cli-0.58.0/docs/LIVE_VERIFICATION_v0.58.0.md

@@ -0,0 +1,93 @@
+# Live verification — v0.58.0
+
+> Hand-run against real Flow on Windows 11, profile `denon82` (chrome strategy,
+> **pt-BR**), 2026-08-15/16. This release's features are the #529 picker
+> contract and the r2v named-reference fixes discovered while live-verifying
+> it — every claim below is backed by a committed, re-runnable e2e test.
+> Credits spent: ~7 Imagen (seed/i2i generations across runs) + 1 veo-lite
+> video generation (standing e2e credit grant).
+
+## Environment
+
+| | |
+|---|---|
+| Branch | `develop` @ `8411b27` (merge of PR #540) |
+| Local version | `0.57.1` editable (pre-bump tree) |
+| Profile | `denon82` (pt-BR, natively agentic) |
+| Date | 2026-08-15 → 2026-08-16 |
+| OS | Windows 11 |
+| Credits spent | ~7 Imagen + 1 veo-lite generation |
+
+## Pre-tag gates
+
+- Scoped offline suites on the release tree: **2058 passed / 3 skipped**
+  (`tests/api tests/cli tests/data tests/features tests/mcp tests/worker`);
+  full matrix green in CI on the same tree (PR #540, 3.11/3.12/3.13).
+- `pyright src`: **0 errors**. ruff check + `ruff format --check` (368 files),
+  hygiene (764), doc links, website PII, mirror sync — all green.
+- SonarCloud quality gate: **GREEN** (zero new issues) on both #540 pushes.
+- `/gflow:pr-council-review`: consensus green (run during the #529 cycle).
+- `/gflow:doc-review` council: GREEN / GREEN / YELLOW across the 3 auditors;
+  0 Tier 1 findings; 7 Tier 2 findings all fixed in the release-prep commit
+  (USAGE/MCP superseded #287 semantics, CONFIGURATION redacted-mode
+  display_name trade-off, KNOWN_ISSUES superseded note + async-caption entry,
+  INDEX credits figure, `_remote_option_tile` docstring). Council reports at
+  `tmp/council/0{1,2,3}-*.md` (local-only).
+
+## Matrix
+
+All four live paths are committed as opt-in e2e tests and passed against real
+Flow (events asserted from structlog JSON, artifacts verified on disk):
+
+| # | Feature | Test | Result |
+|---|---|---|---|
+| 1 | #529 same-project UUID ref → displayName search → exact-UUID tile attach, no duplicate upload | `tests/e2e/test_image_uuid_ref_e2e.py::test_e2e_same_project_uuid_ref_selected_in_picker` | ✅ `image_ref_selected_existing` (resolved_by=display_name); `image_ref_upload_fallback` absent; `ref_count == 1` |
+| 2 | #393 cross-project UUID ref → verified local-file upload fallback | `...::test_e2e_cross_project_uuid_ref_falls_back_to_upload` | ✅ `image_ref_upload_fallback` fired; exit 0; `ref_count == 1` |
+| 3 | Unresolvable UUID ref → loud typed abort, zero generation | `...::test_e2e_unresolvable_uuid_ref_fails_loud` | ✅ non-zero exit, typed no-fallback error, no generated media on disk (assertion updated to the #529 no-UUID-search contract) |
+| 4 | r2v named remote reference from a catalog UUID's recorded displayName → real video | `tests/e2e/test_video_r2v_uuid_name_e2e.py` | ✅ seed t2i → catalog `display_name` read back by UUID → `remote_reference_attached` → SUCCEEDED VideoResult, mp4 on disk (`ftyp` magic bytes), 110 s |
+
+## 5-layer ledger (r2v path, the deepest chain)
+
+1. **File count** — exactly one downloaded `.mp4` in the pytest out dir.
+2. **Magic bytes** — `ftyp` present in the first 32 bytes (asserted).
+3. **Shape** — terminal `VideoStatus.succeeded` with non-empty `media_id`.
+4. **Structlog invariants** — `remote_reference_attached` fired with the exact
+   catalog `display_name`; the recorder had persisted that name from the seed
+   generation's UI response (the #529 fix under test).
+5. **User-confirmable artifact** — the generated video is in the Flow project
+   library of the `denon82` account (project auto-created by the seed run).
+
+## Live findings fixed during verification (shipped in this release)
+
+The r2v e2e was not a rubber stamp — it caught two real UI drifts that had
+silently broken `ref_names` on every locale, both root-caused with a
+credit-free spike (`aria_snapshot`, DOM walks incl. shadow roots, screenshots):
+
+1. **Picker exposes no accessible tree** (`aria_snapshot` = bare `- dialog:`),
+   so the historical ARIA role+name tile match could never succeed. Fixed:
+   `_remote_option_tile` matches the option's text with an anchored regex that
+   tolerates only the localized media-type badge (`…mapImagem` on pt), keeping
+   the PR #245 guarantee that a substring name cannot attach the wrong asset.
+2. **Single-click attach** — clicking a result tile now attaches directly and
+   closes the picker; the `Incluir no comando` include button exists only in
+   the hover-preview pane. Fixed: `_pick_option_and_include` treats a closed
+   dialog as success and keeps the legacy include-button flow as fallback.
+
+Operational facts recorded for future e2e (memory + test hardening): the
+agentic account can answer a t2i with a video (`WireFormatError` — seeds now
+run with `GFLOW_CLI_PREFER_CLASSIC=1` and bounded retry), and Flow computes
+the caption asynchronously, so a fresh generation may record without a
+`display_name` (seed retry handles it; backfill tracked in #543).
+
+## Not verified this cycle
+
+- Non-pt locales for the badge-suffix regex (the regex is locale-agnostic by
+  construction — anchored name + single capitalized suffix word — but only
+  `Imagem` was observed live). Watch post-release.
+- MCP-layer r2v UUID→local-upload merge (`_resolve_ref_local_path`): covered
+  by unit tests; the transport upload path it feeds is #393-verified (row 2).
+
+## Post-tag evidence
+
+_To be filled after the v0.58.0 tag publishes: release workflow run link, PyPI
+listing, and `pipx install gflow-cli==0.58.0` smoke check._

{gflow_cli-0.57.1/website → gflow_cli-0.58.0}/docs/MCP.md

@@ -83,7 +83,7 @@ The server registers three protocol surfaces:
 
 ### Tools (Executable actions)
 * `gflow_generate_image(prompt, model, aspect, count, seed, reference_images, tools, profile, project, project_name, instructions, ui_mode, output, wait)`: Triggers text-to-image / image-to-image (Imagen / Nano Banana). `instructions` is an optional list of ephemeral agent-instruction strings (agentic cohort only). `reference_images` switches to i2i and accepts **either a local file path or a generated image's Flow media UUID**. A UUID reference is attached by **selecting the already-existing asset in Flow's reference picker — no duplicate copy is uploaded** (locating the tile by the media id in its thumbnail URL, and searching the recorded display name to surface it when needed); gflow falls back to uploading the asset's on-disk local file only when it can't be located in place (e.g. it lives in a different project's picker). `project` generates into an existing Flow project id (mirrors CLI `--project`) — pass the reference's project to keep it selectable in place. `ui_mode` selects the Flow UI arm (`auto`/`classic`/`agentic`, mirroring CLI `--ui-mode`, matched case-insensitively); passing `instructions` forces `agentic` automatically, so `ui_mode="classic"` + `instructions` is a hard conflict rather than a silent drop. An unknown value returns a 400 problem-details envelope. See [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode).
-* `gflow_generate_video(prompt, mode, aspect, initial_frame, end_frame, reference_images, model, duration, count, tools, profile, project, project_name, ui_mode, output, wait)`: Triggers vertical or landscape video generation (Veo). `mode` is `t2v`/`i2v`/`r2v`; `model` (`veo_lite`/`veo_fast`/`veo_quality`/`omni_flash`, aliases accepted), `duration` (seconds), and `count` mirror the CLI `gflow video` flags — an omitted `model` lets the transport apply its i2v veo-lite default (issue #125), and `omni_flash` is rejected for i2v-with-frames; `i2v` requires `initial_frame`, `r2v` requires `reference_images`; `project` generates into an existing Flow project id (mirrors CLI `--project`). `initial_frame`, `end_frame`, and `reference_images` each accept **either a local file path or the Flow image UUID of a generated asset** — pass a generated image's id straight in to chain image→video, and gflow attaches it for you (the UUID is resolved to the asset's already-on-disk local file and uploaded as the frame; no manual download/re-upload step). A UUID that isn't in your local asset catalog is rejected up front with a clear "Reference Not Found" error; a catalogued asset whose local file is no longer on disk gives a "Reference Not On Disk" error (re-generate it or pass a local path). Note the CLI's semantics diverge here (#287): `gflow video i2v --initial-frame <UUID>` selects the asset **in the project's media picker with no upload** and needs no local catalog entry — so the same UUID input can succeed on one surface and fail on the other. `ui_mode` selects the Flow UI arm (#299 PR-A, mirroring CLI `--ui-mode`) and **applies to every mode of this tool, including `r2v`** — unlike the CLI, where `video r2v`/`chain` have no flag and follow the env-only path. Video generation has **only a classic driver**, so `auto` ≡ `classic`: both verify the classic editor pre-submit and abort before spending credits if it is unreachable. `ui_mode="agentic"` is rejected with a 400 problem-details envelope, because no agentic video driver exists yet. Values are matched case-insensitively. (MCP tools return envelopes, never process exit codes — the CLI equivalents of these aborts are exit 28 and exit 2 respectively.) See [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode).
+* `gflow_generate_video(prompt, mode, aspect, initial_frame, end_frame, reference_images, model, duration, count, tools, profile, project, project_name, ui_mode, output, wait)`: Triggers vertical or landscape video generation (Veo). `mode` is `t2v`/`i2v`/`r2v`; `model` (`veo_lite`/`veo_fast`/`veo_quality`/`omni_flash`, aliases accepted), `duration` (seconds), and `count` mirror the CLI `gflow video` flags — an omitted `model` lets the transport apply its i2v veo-lite default (issue #125), and `omni_flash` is rejected for i2v-with-frames; `i2v` requires `initial_frame`, `r2v` requires `reference_images`; `project` generates into an existing Flow project id (mirrors CLI `--project`). `initial_frame`, `end_frame`, and `reference_images` each accept **either a local file path or the Flow image UUID of a generated asset** — pass a generated image's id straight in to chain image→video, and gflow attaches it for you. Since v0.58.0 (#529) the CLI and MCP surfaces are unified for i2v frames: the UUID keeps its identity and is enriched with the catalog's recorded display name plus an integrity-verified local fallback, so the transport prefers **selecting the exact asset in the project's media picker** (no duplicate upload) and re-uploads the recorded local file only when the tile is unreachable — and only if its byte count/SHA-256 still match. A UUID that isn't in your local asset catalog is rejected up front with a clear "Reference Not Found" error; a catalogued asset with neither a display name nor a verified local file gives a "Reference Not Usable" error (re-generate it or pass a local path). `r2v` UUID refs are resolved to the recorded local file for upload. `ui_mode` selects the Flow UI arm (#299 PR-A, mirroring CLI `--ui-mode`) and **applies to every mode of this tool, including `r2v`** — unlike the CLI, where `video r2v`/`chain` have no flag and follow the env-only path. Video generation has **only a classic driver**, so `auto` ≡ `classic`: both verify the classic editor pre-submit and abort before spending credits if it is unreachable. `ui_mode="agentic"` is rejected with a 400 problem-details envelope, because no agentic video driver exists yet. Values are matched case-insensitively. (MCP tools return envelopes, never process exit codes — the CLI equivalents of these aborts are exit 28 and exit 2 respectively.) See [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode).
 * `gflow_auth_status(profile)`: Credit-free, non-interactive Flow session probe (#497) — wraps the same fail-closed `verify_flow_profile` check as `gflow auth status`. Returns `{"status": "authenticated", "profile", "user_email"}` or a problem-details error with a `remediation_hint`; a `verification_error` outcome means a network/endpoint problem, which re-login does not fix. Call it before a generation tool to fail fast on dead auth (the queue is async — without it, an auth failure surfaces only later from the daemon). Login/logout remain CLI-only (genuinely interactive).
 * `gflow_list_projects(profile, limit, offset)`: Queries the SQLite catalog for recent generation folders, paginated — the response carries `count` (rows in this page), `offset`, `has_more`, and `next_offset` (pass it back as `offset` for the next page; `null` on the last page).
 * `gflow_list_tools()`: Lists the prompt tools (name/title/description/category) accepted by the generate tools' `tools` param.

{gflow_cli-0.57.1 → gflow_cli-0.58.0}/docs/PROJECT_STATUS.md

@@ -4,6 +4,23 @@
 
 ## Current release
 
+**v0.58.0 — alpha.** **Catalog UUIDs resolve through Flow display names (#529) + r2v named references un-broken after Flow's picker redesign.** The picker
+contract is now `catalog UUID → workflows[].metadata.displayName → picker name
+search → exact UUID-in-thumbnail tile`: the UI response collector preserves the
+sibling workflow name so generated-image catalog rows retain the search key
+(store-mode history only), image `--ref <uuid>` and I2V frame UUIDs are enriched
+with it, and UUID/UUID-stem/prompt-hint/grid-scroll fallbacks are gone from that
+path — a missing name falls through to the SHA-verified local-file upload or a
+typed error, never an unfiltered click. Live-verifying the r2v surface caught
+two silent UI drifts and fixed them: the picker dialog exposes no accessible
+tree (tiles are now text-matched with an anchored, locale-badge-tolerant
+regex), and clicking a result now attaches directly (include button demoted to
+legacy fallback). Four committed e2e tests pin all of it against real Flow,
+including a real r2v video generated from a catalog name. See
+[LIVE_VERIFICATION_v0.58.0.md](LIVE_VERIFICATION_v0.58.0.md).
+
+<details><summary>v0.57.1 — two long-open UI bugs root-caused from live evidence (#493, #451/#288)</summary>
+
 **v0.57.1 — alpha.** **Two long-open UI bugs root-caused from live evidence (#493, #451/#288).**
 #493 was reported as an unrecognized "third editor variant"; it is not. Flow's
 **expanded chat sidebar** removes the classic composer entirely — no `crop_*`
@@ -23,13 +40,15 @@ Playwright timeout, and `gflow models` stops advertising a duration users cannot
 set. Everything verified at **zero credits**. See
 [LIVE_VERIFICATION_v0.57.1.md](LIVE_VERIFICATION_v0.57.1.md).
 
+</details>
+
 <details><summary>v0.57.0 — video joins the UI-mode policy + MCP truthfulness wave</summary>
 
 **v0.57.0 — alpha.** **Video joins the UI-mode policy (#299) + an MCP truthfulness wave (#496–#501).** `gflow video t2v`/`i2v` and MCP `gflow_generate_video` now take `--ui-mode`/`ui_mode` and bind their driver through `get_ui_driver` after editor mount instead of a hardcoded classic bind; video has only a classic driver, so `auto` ≡ `classic`, an env-sourced `agentic` degrades with a warning, and an explicit `--ui-mode agentic` is refused with exit 2 before any browser work. When Flow serves the agentic editor and classic cannot be recovered, video now fails fast pre-submit (`UiModeUnavailableError`, exit 28, zero credits) instead of burning 30–40 s of doomed selector timeouts. The agentic direction was hardened to match the classic one: `mode_control.ensure_agent_mode` replaces `_force_agent_mode` (deleted) with real-click-first + `aria-pressed` verification, no `tune`-ligature check, unknown editor variants no-op with a warning, and the sanctioned reload carries an explicit 15 s timeout. On the MCP side: `gflow mcp run --no-spend` (#496) unregisters both generate tools so an agent cannot even see them; `gflow_auth_status` (#497) gives agents a credit-free pre-flight session probe; `gflow_list_projects` paginates honestly with `offset`/`has_more`/`next_offset` (#498); the stub `gflow_list_characters` — which always answered "no characters", an active lie — is gone (#499); and `gflow://docs/known-issues` is bounded to a small index plus a per-issue templated read (#501) instead of injecting ~70 KB on every read. On the supply-chain side the release finishes the Scorecard hardening tail: every workflow now runs with a least-privilege token and every `uses:` action is pinned to a full commit SHA, the remaining in-workflow package installs are hash- or digest-pinned (`website/requirements.txt`, `Dockerfile.triage`, `pip-audit`), CI enforces a test-count floor so "a green build that ran nothing" cannot pass, `check_repo_hygiene.py` fails on version disagreement between `pyproject.toml`/`__init__.py`/`plugin.json`, and a self-run OpenSSF Scorecard workflow publishes the score as a README/website badge with a [SECURITY.md](SECURITY.md) section explaining it. Everything in this release was verified at **zero credits**. See [LIVE_VERIFICATION_v0.57.0.md](LIVE_VERIFICATION_v0.57.0.md).
 
 </details>
 
-**Develop (unreleased, post-v0.57.1):** post-release doc-review fixes only — see `CHANGELOG.md` `[Unreleased]` for the authoritative list. `develop` is the staging branch for the next release; this line is not a substitute for the changelog.
+**Develop (unreleased, post-v0.58.0):** nothing queued yet — see `CHANGELOG.md` `[Unreleased]` for the authoritative list. `develop` is the staging branch for the next release; this line is not a substitute for the changelog.
 
 <details><summary>v0.56.0 — ops-hardening batch + honest mode-switch evidence (#477/#478/#479, #493)</summary>
 

{gflow_cli-0.57.1 → gflow_cli-0.58.0}/docs/REFERENCE_STRATEGIES.md

@@ -14,7 +14,7 @@ transports.
    - A **saved, named asset** in the project — a `gflow character` entity, or a generated/uploaded
      media asset with a `display_name` → reference it *by identity*: `@Name` or `--reference-entity`.
    - An **arbitrary / one-off image** (a local file, or a look/style you don't intend to reuse) →
-     `--ref` (local path or in-project media UUID).
+     `--ref` (local path; image `i2i` also accepts an in-project media UUID).
 
 2. **HOW you author it** (only matters once you've chosen "by identity")
    - Inline, readable, agent-friendly → `@Name` in the prompt.
@@ -28,7 +28,7 @@ transports.
 | Reference a **saved Character** by name, inline | `@Name` in the prompt | Resolves to `referenceEntities`; the model anchors on that entity. Works on every generation path. |
 | Reference a Character by **explicit id** in a script | `--reference-entity <entityId>` (`t2i`/`i2i`/`t2v`/`r2v`) | Same wire as `@Name`, no name-resolution ambiguity. **Not available on `i2v`** (its DTO rejects reference entities). |
 | Reference a **saved media asset** (generated/uploaded) by name | `@Name` in the prompt | Resolves to the asset's UUID → `referenceImages`, zero re-upload. |
-| Reference a **one-off / arbitrary image** or a look | `--ref <path-or-uuid>` (`i2i`, `r2v`) | Stages `referenceImages` directly; no saved identity needed. |
+| Reference a **one-off / arbitrary image** or a look | `--ref <path>` (`i2i`, `r2v`) or `--ref <uuid>` (`i2i` only) | Stages `referenceImages` directly; no saved identity needed. |
 | Reuse the **same subject** across many generations | `gflow character` once → then `@Name` everywhere | A Character is the durable, name-addressable identity. See [CHARACTER.md](CHARACTER.md). |
 | Anchor an **identity *and* a look** in one shot | Both — a Character mention **and** a `--ref` | They complement (entity + image), and identical references dedupe, within the model's reference cap. |
 
@@ -43,6 +43,19 @@ reference caps are enforced before submit.
 `--ref` is the odd one out: it always stages `referenceImages` (an image), never `referenceEntities`
 (a saved identity). That's the whole distinction — *identity* vs *image*.
 
+For a catalog-backed `--ref <uuid>`, gflow resolves the UUID to Flow's recorded
+`display_name`, searches that name in the browser picker, and then verifies the
+exact UUID in the surfaced tile. The name is discovery; the UUID remains identity,
+so duplicate names cannot select the wrong asset. This path does not scan the
+unfiltered picker grid. If the named tile is unavailable, `image i2i` can still
+use the catalog's recorded local file as its upload fallback. I2V start/end
+frames carry the same fallback even when they have a name, so a picker miss can
+upload the exact recorded bytes without scanning. The fallback is discarded if
+its catalog byte count or SHA-256 no longer matches the file on disk. A stale
+name or missing picker search never enables an unfiltered tile click. Redacted
+prompt history deliberately does not persist Flow captions because they may
+paraphrase the prompt.
+
 ## Per-generation-path support matrix
 
 Which reference methods each path accepts (design spec §2, verified against `cli_image.py` /
@@ -53,6 +66,7 @@ Which reference methods each path accepts (design spec §2, verified against `cl
 | `image t2i` | `@Name` · `--reference-entity <id>` | `@Name` (in-project UUID → `referenceImages`) |
 | `image i2i` | `@Name` · `--reference-entity <id>` | `@Name` · `--ref <path-or-uuid>` |
 | `video t2v` | `@Name` · `--reference-entity <id>` | ❌ — media mentions on the video path are Phase 3 |
+| `video i2v` | ❌ — start/end frames replace ingredients | local path or catalog UUID via `IMAGE` / `--initial-frame` · optional `--end-frame` |
 | `video r2v` | `@Name` · `--reference-entity <id>` | `--ref <path>` (local ingredients); `@media` is Phase 3 |
 
 Notes:
@@ -99,9 +113,10 @@ Pick with one rule:
 
 - **Referencing a saved, named Character or asset?** Put `@Name` in the prompt. On `t2i`/`i2i` you may
   instead pass `--reference-entity <entityId>` when you have the id and want no name ambiguity — it's
-  the **same wire** and dedupes. There is **no** `--reference-entity` flag on `t2v`/`r2v`; use `@Name`.
-- **Referencing a one-off image or a look/style you won't reuse?** Use `--ref <path-or-uuid>`
-  (`i2i`, `r2v`).
+  the **same wire** and dedupes. The explicit entity flag is also available on `t2v`/`r2v`; it is
+  deliberately absent from `i2v`, whose inputs are start/end frames.
+- **Referencing a one-off image or a look/style you won't reuse?** Use `--ref <path>` on `i2i` or
+  `r2v`; a media UUID is accepted by image `i2i` only.
 - **Need the subject reused across many generations?** Create it once with `gflow character`, then
   `@Name` it everywhere.
 - **Prerequisite:** a Character must have a reference image before `@Name` will resolve — an

{gflow_cli-0.57.1 → gflow_cli-0.58.0}/docs/USAGE.md

@@ -74,7 +74,7 @@ See [AUTHENTICATION § Commands](AUTHENTICATION.md#commands).
 
 ## `gflow image upload`
 
-Upload a local PNG/JPEG/WebP/GIF into a fresh Flow project and print the asset UUID + dimensions Flow inferred. The UUID is what later subcommands (`gflow image i2i --ref UUID`, `video i2v`) accept as an initial frame. Note for `video i2v`: the UUID is selected from the generation project's media picker, and `upload` puts the asset in a *fresh scratch project* — so pass `--project <id>` of the project that holds the asset, or the picker lookup fails with exit 9 (#287).
+Upload a local PNG/JPEG/WebP/GIF into a fresh Flow project and print the asset UUID + dimensions Flow inferred. The UUID is what later subcommands (`gflow image i2i --ref UUID`, `video i2v`) accept as an initial frame. Note for `video i2v`: the UUID is preferentially selected from the generation project's media picker, and `upload` puts the asset in a *fresh scratch project* — pass `--project <id>` of the project that holds the asset to select it in place. Since v0.58.0 (#529) a picker miss falls back to re-uploading the catalog's recorded local file (integrity-verified); exit 9 now only occurs when neither the tile nor a verified local file is available.
 
 ```text
 gflow image upload PATH [OPTIONS]
@@ -316,7 +316,7 @@ Options:
 
 **Path-or-UUID semantics.** Each `--ref` value is classified at the CLI boundary:
 
-- **Looks like a Flow asset UUID** (case-insensitive 8-4-4-4-12 hex, e.g. `ddb6ef97-262d-49f4-8269-4a28c0fae6a2`) → passed through verbatim. No upload, no extra round-trip.
+- **Looks like a Flow asset UUID** (case-insensitive 8-4-4-4-12 hex, e.g. `ddb6ef97-262d-49f4-8269-4a28c0fae6a2`) → resolved through the local catalog (v0.58.0, #529): the asset's recorded Flow display name is searched in the project's reference picker and the **exact UUID tile** is selected — no duplicate upload, no grid scrolling, no UUID/prompt-text searches. When the tile can't be reached (different project, missing/stale name), the catalog's recorded local file is uploaded instead — only after its byte count and SHA-256 still match the recording; otherwise the run aborts with a typed error rather than attaching the wrong bytes.
 - **Anything else** → treated as a local path. The CLI canonicalises it (resolving symlinks once at validation time, closing the symlink-laundering vector where `./hero.png -> ~/.ssh/id_rsa` could exfiltrate secrets), then attaches it — **deduplicated by filename since v0.38.0 (#314):** if the target project's library already holds an asset with the exact same filename, that existing tile is selected in the picker instead of re-uploading, so repeating a ref across runs no longer piles up duplicate library entries. On a picker miss the file is uploaded as before. Caveat: the match is by exact filename only — a *different* image that happens to share the name of one already in the project will be reused, not uploaded; rename the file if you need a fresh upload. (Video `r2v` refs keep upload-only behavior.)
 
 Mix and match in a single call. UUIDs and paths can co-exist on the same command line; order is preserved so `imageInputs[]` matches the order you typed.
@@ -591,7 +591,8 @@ Options:
 ```bash
 gflow video i2v --initial-frame ./hero.png "Slow camera arc, soft golden light"
 gflow video i2v --initial-frame ./first.png --end-frame ./last.png "morph between scenes" --model veo-quality
-# Reference an existing in-project asset by media UUID (no re-upload, #287):
+# Reference an existing in-project asset by media UUID (picker-selected via its
+# catalog display name + exact-UUID tile since v0.58.0/#529; no re-upload):
 gflow video i2v --initial-frame d6f1927a-3eae-4626-bc90-9a6ea7637bab "pan left" --project f6caf027-...
 # Back-compat positional form:
 gflow video i2v ./hero.png "Slow camera arc, soft golden light"
@@ -601,7 +602,10 @@ Exit codes specific to this surface: **27** — Flow's upload endpoint rejected
 local frame file (`MediaUploadRejectedError`; try re-encoding, e.g.
 `ffmpeg -i in.jpg -q:v 2 -map_metadata -1 out.jpg`, or reference the asset by
 UUID instead); **9** — a frame UUID could not be located in the project's media
-picker (`TransportTimeoutError`; wrong `--project` or foreign UUID).
+picker **and** had no integrity-verified local fallback to upload
+(`TransportTimeoutError`; wrong `--project`, foreign UUID, or the recorded
+local file is missing/changed — since v0.58.0 a reachable verified local file
+rescues a picker miss instead of failing).
 
 ## `gflow video r2v`