gflow-cli 0.60.0__tar.gz → 0.61.0__tar.gz

{gflow_cli-0.60.0 → gflow_cli-0.61.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.60.0 → gflow_cli-0.61.0}/CHANGELOG.md

@@ -7,6 +7,98 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.0] — 2026-08-27
+
+### Fixed
+
+- **A requested image model that cannot be selected no longer generates silently
+  on a different one ([#586](https://github.com/ffroliva/gflow-cli/issues/586)).**
+  `_select_image_model` swallowed every failure, logged a warning, and let the
+  generation proceed on whatever the project's picker already held. Observed
+  live: `--model imagen4` produced an image on `NARWHAL` and exited **0** —
+  confirmed three ways (log, catalog, and `imageModelName` in a HAR). Flow has
+  removed `Imagen 4` from its picker, and `has-text('Nano Banana 2')` had become
+  ambiguous with the newly-offered `Nano Banana 2 Lite`, so `.first` resolved by
+  DOM order. A missing or ambiguous selector now raises `UiSelectorDriftError`
+  (exit 23) naming what Flow actually offered, before anything is submitted.
+
+- **A requested video model that cannot be selected no longer generates on a
+  different one — and charges for it
+  ([#539](https://github.com/ffroliva/gflow-cli/issues/539)).** `_select_video_model`
+  refused only on i2v-with-frames; a plain `t2v`/`r2v` miss logged "Flow default
+  model applies" and returned, so the run generated on whatever the picker already
+  held and spent that tier's credits — veo-quality costs 100 against veo-lite's 10.
+  Read live, Flow's picker offers exactly `Omni Flash` / `Veo 3.1 - Lite` / `Fast` /
+  `Quality`, so `--model veo-lite-lp` matched nothing and was a reachable,
+  credit-spending wrong-model path. Every miss is now fatal (exit 18) naming what
+  Flow offered, and an **ambiguous** selector is refused rather than resolved with
+  `.first`, which picks by DOM order across tiers that differ 10x in cost. Unlike
+  the image arm, refusing is unambiguous here: `--model` defaults to `None` on
+  every video command, so reaching the picker means a model was explicitly asked
+  for. Verified with a zero-credit A/B against live Flow — the pre-fix code
+  returned success for a model Flow does not offer; the new code refuses.
+
+- **Four more navigations settle before acting on the page
+  ([#584](https://github.com/ffroliva/gflow-cli/issues/584)).** #580 settled the
+  three sites it touched; an audit of every `page.goto` found four more with the
+  same defect. The worst is `evaluate_fetch.refresh_auth`, which re-navigates to
+  refresh page-context tokens and reported success while the page was still
+  moving. Two more (`evaluate_fetch` setup, `sapisidhash` fingerprint capture)
+  run `page.evaluate` immediately after navigating, where a mid-flight redirect
+  raises "Execution context was destroyed" rather than failing quietly. The
+  fourth (`_enter_editor`'s gallery return) ran `_bypass_onboarding` — real
+  button clicks — on a page about to navigate away. A new AST-based test pins
+  every `goto` to a following settle, so the audit does not have to be redone
+  by hand.
+
+- **The nightly canary now runs the version of itself that it just pulled
+  ([#582](https://github.com/ffroliva/gflow-cli/issues/582)).** `run_canary.py
+  --pull` fast-forwards the checkout and then keeps executing the copy Python
+  loaded at startup, so every runner change was silently one night late. This was
+  not theoretical: #572 added `-o junit_logging=all` so a preserved RED would
+  carry the structlog line that decides #561, and the next run pulled it and
+  still produced a RED with zero log output — three REDs untriageable, and the
+  failure reads as "the fix did not work". The runner now re-runs itself once
+  when a successful pull changed its own source, guarded by both an env var and
+  a content digest (either alone prevents a loop), via `subprocess.run` rather
+  than `os.execv` so Task Scheduler still sees one process and the real exit code.
+
+- **Editor navigation no longer races a locale redirect on non-`en` accounts
+  ([#580](https://github.com/ffroliva/gflow-cli/issues/580)).** `_enter_editor`
+  built its URL from a hardcoded `locale="en-US"` that no caller ever overrode,
+  so every account was sent to `/fx/en/...`. On a pt-BR account Flow redirects
+  that to `/fx/pt/...` **after `page.goto` has already returned** — leaving
+  overlay dismissal and prompt submission running against a page about to be
+  navigated away. That is how [#395](https://github.com/ffroliva/gflow-cli/issues/395)'s
+  "character-route bounce" presented. The client now learns the account's real
+  locale from where Flow itself lands (the only trustworthy source: `auth/session`
+  carries no locale, and `navigator.language` reports the value gflow sets when
+  launching the context), hands it to the transport through the typed
+  `TransportSetup` seam, and an independent settle-wait tolerates any redirect we
+  did not predict. An unresolved locale omits the segment rather than guessing.
+  `gflow character create --locale` now defaults to the account's locale instead
+  of `en-US`; the previous hardcoded default meant the character editor — the
+  surface #395 was reported against — was still routed to `/fx/en/...` on every
+  account, and the character route never waited for a settle at all.
+
+  Live-verified on a pt-BR account with a control arm: the fix navigates
+  race-free while the pre-fix path still redirects. Accounts Flow does not
+  redirect (e.g. `en`) skip the wait entirely after a single bounded probe, so
+  they pay no per-navigation cost.
+
+### Added
+
+- **Server-side model attribution
+  ([#586](https://github.com/ffroliva/gflow-cli/issues/586)).**
+  `parse_media_attribution` reads `modelNameType` / `seed` / `aspectRatio` from
+  the `flow.projectInitialData` listing gflow already fetches — the same payload
+  the sync path walks for `name` and discards the rest of. This matters most on
+  the **agentic** arm, where those fields were previously synthesised from our
+  own request because they live in a Web-Worker SSE stream Playwright cannot
+  observe; "not visible to the page" was never the same as "unknowable". Verified
+  live: an agentic run that requested `GEM_PIX_2` was attributed `NARWHAL` by the
+  server, with a real seed where the catalog held `0`.
+
 ## [0.60.0] — 2026-08-25
 
 ### Added
@@ -3155,7 +3247,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.60.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.61.0...HEAD
+[0.61.0]: https://github.com/ffroliva/gflow-cli/compare/v0.60.0...v0.61.0
 [0.60.0]: https://github.com/ffroliva/gflow-cli/compare/v0.59.0...v0.60.0
 [0.59.0]: https://github.com/ffroliva/gflow-cli/compare/v0.58.0...v0.59.0
 [0.58.0]: https://github.com/ffroliva/gflow-cli/compare/v0.57.1...v0.58.0

{gflow_cli-0.60.0 → gflow_cli-0.61.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.60.0
+Version: 0.61.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.60.0 → gflow_cli-0.61.0}/docs/INDEX.md

@@ -150,7 +150,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"A command failed — where is the incident bundle and what's in it?"** → [DEBUGGING § Automatic incident bundles](DEBUGGING.md#automatic-incident-bundles) (layout, triggers, review-before-sharing); privacy boundaries: [SECURITY § Automatic incident bundles](SECURITY.md#automatic-incident-bundles-gflow_cli_incident_capture-default-on); disable via [CONFIGURATION § GFLOW_CLI_INCIDENT_CAPTURE](CONFIGURATION.md#gflow_cli_incident_capture)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md) (**#528 content-policy 400 classification + #578 labs-lane headers, verified 2026-08-25 on profile `denon82`, ZERO Veo credits** — the 400→`ContentPolicyError` path was proven end-to-end by **fault injection through the real transport** [real browser, real editor, real submit; the 400 fulfilled at the network boundary], passing for BOTH body shapes including the **bare 400 with no `reason` field** — the load-bearing case, since reason-only matching would fall straight back to `WireFormatError`, which is the bug; the new `ui_automation.batch_400_body` discovery log fired live and is what will capture Flow's real 400 shape next time. The **natural** trigger could NOT be reproduced and this is recorded, not omitted: two face-bearing `--ref` images PLUS an age-explicit descriptor [both documented triggers stacked] returned **200** — noting the issue specified character *entities*, a different wire shape from `--ref`, and that Flow's enforcement has shifted before. #578 is the rare case where live verification proved a change **unnecessary** rather than necessary: an interleaved A/B against real `project.createProject` returned 200 on BOTH arms [origin-less control and origin+referer treatment], falsifying the 401 premise it was cherry-picked for; a header-echo cross-check confirmed Playwright adds no Origin of its own, so the control arm was genuinely bare. Incident-bundle `generation_requests[]` is **partial** — the request-summary logger was observed live but no bundle was written [a classified `ContentPolicyError` is handled, so nothing triggers capture]; unit-covered instead. Selector probe exits **2 [infrastructure]** locally without CI credentials, which is its documented contract — an absent credential must never be published as drift); previously: [LIVE_VERIFICATION_v0.59.0](LIVE_VERIFICATION_v0.59.0.md) (**#542 doctor + #543 data sync + #546 refresh-on-miss, verified 2026-08-16 on profile `denon82`, ~4 Imagen credits** — doctor offline-verified (byte-identical never-writes proof); sync live-verified by a zero-credit e2e AND a real 117-project backfill (398 nameless rows → 338 named / 57 tombstoned / 0 failures); refresh-on-miss live-healed a deliberately-corrupted catalog name mid-generation via picker attach with `sync.source=refresh`); previously: [LIVE_VERIFICATION_v0.58.0](LIVE_VERIFICATION_v0.58.0.md) (**#529 catalog-UUID→displayName picker contract + r2v named-reference fixes, verified 2026-08-15/16 on profile `denon82` (pt-BR) via four committed e2e tests, ~7 Imagen + 1 veo-lite generation** — same-project exact-UUID tile attach, cross-project verified upload fallback, loud abort on unresolvable UUIDs, and a real r2v video generated from a catalog name; the r2v e2e caught and fixed two live UI drifts: the picker exposes no accessible tree so tiles are now text-matched, and a tile click attaches directly with the include button demoted to legacy fallback); previously: [LIVE_VERIFICATION_v0.57.1](LIVE_VERIFICATION_v0.57.1.md) (**#493 and #451/#288 root-caused and fixed from live evidence, verified 2026-08-14 on profile `denon82` (pt-BR — the #493 reporter's locale), ZERO credits** — #493 was NOT an unrecognized "third editor variant": "Inicial"/"Final" are the Frames sub-mode's Start/End slots and the "Agente" pill is the ordinary Agent button, both stock classic features. The real trigger is Flow's **expanded chat sidebar**, which removes the classic composer entirely [`crop_* = 0` AND `Agent pill = 0` simultaneously] — one state producing both reported symptoms, and the reason the failure was exit 23 rather than the retryable 25 [no agentic indicator on screen, so the cohort detector matched nothing]. Recovery hinged on a close button scoped to the sidebar's `edit_square` affordance, a single point of failure for any cohort lacking that ligature; an unscoped fallback now fires only from the demonstrably stuck state, **A/B-proven three ways** [scoped broken + fallback present → rescued; both broken → NOT recovered, which is what proves the fallback rescues rather than the surrounding loop]. #451/#288 were never selector drift either — Flow's settings popover is **model-conditional**, only `omni-flash` renders a duration row, so `--duration` on a Veo model hunted a control that is never drawn [verified on 2 accounts × 2 locales]; it now exits 2 before any browser work. Two #493 hypotheses were tested and **refuted** first and are committed so they are not re-derived [a `crop_free` sub-mode trigger — the trigger reflects the *aspect*, not the sub-mode; and a hydration race — a wait was written, A/B-neutered, and cold loads passed 3/3 BOTH ways, so it was reverted rather than shipped]. Recorded not-verified: the `veo_3_1_lite_lower_priority` picker miss is **inconclusive** [the capture came after the menu closed] so that selector was deliberately left untouched, and `chain.py`'s per-link duration aborts mid-run after billing — deferred with the finding recorded). Prior: [LIVE_VERIFICATION_v0.57.0](LIVE_VERIFICATION_v0.57.0.md) (**#299 video UI-mode policy + the #496/#497/#498/#501 MCP wave live-verified 2026-08-14 on profile `ffroliva`, ZERO credits** — three real video-editor loads bound the classic driver through `get_ui_driver` [`ui_driver.bound mode=classic`, 1.2–1.7 s, aborted pre-submit], `--ui-mode agentic` is refused with **exit 2 before any browser launch** [deliberately not exit 28, whose "retry may land it" hint would mislead for a driver that does not exist], and a real-editor classic→agent→classic round-trip proved `ensure_agent_mode`'s aria-verified real click [`{"agent_acted":true,"after_agent":"agent","after_media":"media"}`]; the MCP surfaces were driven over the **real stdio JSON-RPC wire** [subprocess `gflow mcp run`, so registration *and* stream routing are covered]: `--no-spend` cut `tools/list` from 11 tools to 9 with both generate tools genuinely unregistered rather than refused, zero-arg `gflow_auth_status` returned `authenticated` off a live `GET /fx/api/auth/session` **200**, `gflow_list_projects` returned **different project IDs** on offset 0 vs offset 2 [proving the offset is honored — catalogs larger than `limit` were previously unreachable] with `limit=0`→1 and `offset=-5`→0 clamps holding, and the known-issues resource served a **7,543-byte index** against a ~70 KB source file with a **111-byte** capped unknown-slug reply. The #498 rate-limited problem-details envelope is recorded **not live-verified with reason** — exhausting the token bucket needs ≥9 accepted generate calls, so the error path cannot be reached credit-free; it is unit-pinned for both tools instead). Prior: [LIVE_VERIFICATION_v0.56.0](LIVE_VERIFICATION_v0.56.0.md) (**#477 downgrade guard, #478 bounded lease wait, and the #493 mode-switch path live-verified 2026-08-13 on profile `denon82`, images only** — a fresh-project 16:9 `t2i` exercised the #493-touched mode-switch path end-to-end [valid `ff d8` JPEG 1376×768, `image_mode_entered` → `batch_response_captured`]; the #477 guard refused a scratch profile claiming Chromium 999 with **exit 11 pre-auth, pre-credits** at the generation-client call site; #478 was proven with three concurrent runs — `WAIT=0` control failed fast with `ProfileLockedError` exit 11 while the holder held, and the `WAIT=180` waiter polled ~11 s past the holder's natural release then generated successfully; the #493 drift branch itself is a named skip [only an affected account's new-editor cohort can reach it — the fix's message text is unit-pinned], and #479's update notice is deferred-with-reason to a post-release check [it needs a published newer version on PyPI and skips editable installs by design]; an expired denon82 session 401'd the first two attempts [external state, re-login fixed it, recorded not omitted]). Prior: [LIVE_VERIFICATION_v0.55.0](LIVE_VERIFICATION_v0.55.0.md) (**Tier-1 quick wins #471–#476 verified 2026-08-13 on profile `ffroliva`, ZERO credits** — `gflow auth status` probed the real Flow session endpoint live [`Flow session verified as ffroliva@gmail.com.`, exit 0, fail-closed contract pinned]; `gflow mcp setup` ran end-to-end with the real CLI against a scratch copy of the real Claude Desktop config [correct merged entry, pristine original]; the Windows profile-DACL two-step `icacls` idiom was derived empirically [the naive `/t` form broke file access] and is pinned by a real-icacls round-trip test on every Windows host; the incident bug-report template, MCP error funnel [all 11 tools guarded, raw exception text masked], and SecretStr settings are suite-verified with no live-Flow surface — reasons recorded, not omitted). Prior: [LIVE_VERIFICATION_v0.54.0](LIVE_VERIFICATION_v0.54.0.md) (**close-browser guidance #470, character-composer focus fix, overlay/jitter hardening, and SonarCloud-S2245 RNG swap live-verified 2026-08-12 on profile `ffroliva`, ZERO credits** — the new #470 login wording printed verbatim and the manual-close → `auth_flow_session_verified` round-trip worked end-to-end; a Classic-UI `t2i` produced a real 1024×1024 JPEG [`ff d8 ff e0`] exercising overlay dismissal + jitter + image-composer submit + mode controller, and a credit-free `character create` [entity `da3cd647…`, face 1376×768 JPEG] exercised the character-composer path directly [`entering_character_editor` → `prompt_submitted` → `entity_patched` → `completed`]; the first `t2i` hit the known agentic-cohort video-for-image condition [correctly refused via `WireFormatError`, tracked by #299, not a regression] and Classic UI worked around it. First mainline release after the orphaned v0.53.0/v0.53.1 tags — CHANGELOG restores honest 0.53.x sections). Prior: [LIVE_VERIFICATION_v0.52.0](LIVE_VERIFICATION_v0.52.0.md) (**batch DAG references #317, character entity provenance recording #402, and video duration selector cascade fix #451 live-verified 2026-08-05** — 3/3 live E2E tests in `tests/e2e/test_entity_provenance_e2e.py` passed clean on profile `ffroliva`, 5-layer evidence ledger verified). Prior: [v0.51.0](LIVE_VERIFICATION_v0.51.0.md) (**dependency/security/test-correctness release verified 2026-08-05, 1 Imagen credit + 1 Veo attempt** — the only change needing live evidence was the `playwright` bound raise `>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0`, and the 2026-08-03 regression does NOT reproduce on 1.61.0: a live i2v drove `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live i2i local-ref attach passed outright [96.7s]. **1.62.0 stays excluded**, never root-caused. `-m e2e_auth` 16/16, daemon e2e 1 passed [MCP over Streamable HTTP — the first live coverage that test has ever had, it was structurally incapable of passing before], MCP Tasks 5/5 layers, 2923 offline tests, `pip-audit --all-extras` clean. **No finished mp4 is claimed** — Flow's own generation returned `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT`, server-side. Defect found and recorded not omitted: Flow dropped the duration-tab UI so **`--duration` is currently broken for i2v**, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0 — [#451](https://github.com/ffroliva/gflow-cli/issues/451)). Prior: [v0.50.0](LIVE_VERIFICATION_v0.50.0.md) (**MCP Tasks extension SEP-2663, non-blocking task handle responses, CLI/MCP output path hardening -o/--output, and Telegram PR triage alert resilience verified 2026-08-04** — 5-layer evidence ledger note generated at `tmp/live-verify/mcp-tasks.md` confirming instant task handle return, working status queries, and cancelled status DB state transitions; full 118-test suite green). Prior: [v0.49.0](LIVE_VERIFICATION_v0.49.0.md) (**#125 `omni-flash` start-frame I2V video generation, Playwright dependency upper-bound pin `>=1.59.0,<1.60.0`, submission stage watchdog timeout, and #404 count-tab fail-closed logic verified 2026-08-03** — 0-credit wire intercept captured `batchAsyncGenerateVideoStartImage` with `startImage` bound; live costed generation on `omni-flash` I2V produced a 1.2MB valid mp4 video asset on `ffroliva`; full 2902-test release suite green). Prior: [v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
+**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)

gflow_cli-0.61.0/docs/LIVE_VERIFICATION_v0.61.0.md

@@ -0,0 +1,164 @@
+# Live verification — v0.61.0
+
+Every claim below was **observed**. Claims that could not be observed are stated
+as such in §6, not omitted.
+
+## Environment
+
+| | |
+|---|---|
+| Date | 2026-08-26 / 2026-08-27 |
+| Profile | `denon82` (account locale **pt**, `html_lang=pt`) |
+| Project | `2ddc3a33-97db-41a0-a0d3-7f9488b0d5a9` |
+| UI arm | classic (cohort flaps per page load — see §6) |
+| CLI | 0.60.0 tree + the five fixes in this release |
+| Credits spent | **one** t2v generation (`omni-flash`). Everything else was credit-free. |
+
+## Summary
+
+| # | change | verified live | how |
+|---|---|---|---|
+| 1 | Video model refusal (#539) | ✅ | zero-credit A/B + two CLI runs |
+| 2 | Image model refusal (#586) | ✅ | CLI, exit 23, 0 files written |
+| 3 | Server-side attribution (#586) | ✅ | real agentic mis-attribution detected |
+| 4 | Locale navigation (#581) | ✅ | pt account + control arm |
+| 5 | Navigation settle audit (#584) | ⚠️ partial | 1 of 4 sites exercised — see §5 |
+| 6 | Canary re-exec (#582) | ⚠️ not yet | unit-tested; first real exercise is tonight |
+
+---
+
+## 1. Video model refusal (#539) — the headline change
+
+Flow's video picker, read **while the menu was open**:
+
+```
+volume_up Omni Flash
+volume_up Veo 3.1 - Lite
+volume_up Veo 3.1 - Fast
+volume_up Veo 3.1 - Quality
+```
+
+`Veo 3.1 - Lite [Lower Priority]` is **not offered to this account at this
+moment**. That makes `--model veo-lite-lp` a real MISS to test, not a synthetic one.
+
+### 1a. Zero-credit A/B against the pre-fix code
+
+Model selection happens in the settings panel entirely **before** submit, so both
+arms cost nothing. The "old code" column is a real run of the stashed pre-fix
+source against live Flow — not a reading of the diff.
+
+| case | old code | new code |
+|---|---|---|
+| `omni_flash` | SELECTED | **SELECTED** |
+| `veo_3_1_lite` | SELECTED | **SELECTED** |
+| `veo_3_1_fast` | SELECTED | **SELECTED** |
+| `veo_3_1_quality` | SELECTED | **SELECTED** |
+| `veo-lite-lp` (not offered) | **SELECTED** — returned success | **REFUSED** |
+| ambiguous selector, 3 matches | **SELECTED** — `.first` guess | **REFUSED** |
+
+Harness: `scripts/dev/live_verify_video_model_select.py` (6/6 as expected).
+
+The ambiguous case was produced by injecting `has-text('Veo 3.1')`, which matches
+Lite + Fast + Quality. The refusal message reported **3 entries match**, i.e. the
+real live count, not a fixture's.
+
+### 1b. CLI, end to end
+
+```
+gflow video t2v ... --model veo-lite-lp   → EXIT 18, nothing submitted
+```
+
+The RFC 9457 detail names all four models Flow offers and states
+`No credits were spent.`
+
+```
+gflow video t2v ... --model omni-flash    → EXIT 0
+```
+
+- `ui_automation_video.model_selected` with `"model": "omni_flash"`
+- `poll_terminal` → `MEDIA_GENERATION_STATUS_SUCCESSFUL`
+- `f41810ea-d2e3-40fe-b834-3eaaaa351a1f.mp4`, **2 250 862 bytes**
+- catalog row records `model: "omni_flash"`
+
+The guard does not break the working path.
+
+---
+
+## 2. Image model refusal (#586)
+
+`--model imagen4` (an entry Flow has removed) → **EXIT 23**, **0 jpgs written**,
+message naming what Flow does offer. An ambiguous selector → **EXIT 23**,
+`AMBIGUOUS — 2 entries match`. A disambiguated `NARWHAL` selects and generates.
+
+Batch containment: with prompt 0 refused and prompt 1 valid, the run reported
+`1/2 succeeded` and **EXIT 0** — one drifted selector does not abort a batch.
+
+## 3. Server-side attribution (#586)
+
+An agentic run that requested `GEM_PIX_2` was attributed **`NARWHAL`** by
+`flow.projectInitialData`, with a real seed where the catalog held the `0`
+sentinel. `scripts/dev/verify_model_attribution.py` exits **1** on that real
+mismatch. Free, cookie-authenticated, arm-agnostic.
+
+## 4. Locale navigation (#581)
+
+Today's runs resolved `client.account_locale_resolved locale=pt` and navigated
+`https://labs.google/fx/pt/tools/flow/project/...`. `url_stable_after_goto`
+reported `settle_skipped=false` on the redirecting account and `true` on a
+non-redirecting one, so `en` accounts pay no per-navigation wait.
+
+Previously verified across **pt / de / ja / fr / ru** with a control arm showing
+the pre-fix path still racing.
+
+## 5. Navigation settle audit (#584) — partial, stated deliberately
+
+Four `page.goto` sites gained a settle. Live runs this cycle exercised
+**`_enter_editor`** only (`ui_automation.url_stable_after_goto`, repeatedly).
+
+**Not exercised live this cycle:** `evaluate_fetch.refresh_auth`,
+`evaluate_fetch` setup, and the `sapisidhash` fingerprint capture — none of the
+runs above needed a bearer refresh. They are covered by unit tests and by the
+AST ratchet that pins every `goto` to a following settle, which is a weaker
+guarantee than observation and is recorded here as such.
+
+## 6. Canary re-exec (#582) — not yet observed
+
+The runner re-runs itself once when a successful `--pull` changed its own source.
+Covered by `tests/scripts/test_canary_reexec.py`. Its first **real** exercise is
+the nightly run from the dedicated canary clone; nothing in this cycle triggered
+a self-changing pull, so the behaviour is **unverified in production** and is
+called out rather than assumed.
+
+---
+
+## Also observed: the cohort race is real
+
+Two byte-identical `--ui-mode classic` invocations produced different arms
+seconds apart — one bound classic and refused correctly (exit 23), the other
+failed earlier at `mode_control.ensure_media_incomplete` with **exit 31**
+(`FlowAppError`) before model selection ran. This bounds what any pre-submit
+guard can promise and is recorded so it is not mistaken for a regression.
+
+## Falsified this cycle
+
+The note carried in #539 that *"the video picker uses a different trigger"* is
+**wrong**: `MODEL_PICKER_TRIGGER` and `IMAGE_MODEL_PICKER_TRIGGER` are
+byte-identical strings. The repeated empty menu captures were caused by the
+**capture** — `_switch_to_video_mode` leaves the settings menu open by contract,
+and calling `_open_gen_settings_panel` after it re-clicks the same button and
+toggles the panel shut. A DOM dump settled it in one run:
+`id='radix-:r1q:-trigger-VIDEO'` was present and visible throughout.
+
+## 5-layer ledger (the paid video generation)
+
+| layer | evidence |
+|---|---|
+| file count | 1 mp4 written |
+| magic bytes | `00 00 00 20 66 74 79 70 69 73 6f 6d` — `ftypisom`, real ISO-BMFF |
+| size | 2 250 862 bytes (not a truncated error page) |
+| structlog invariants | `model_selected model=omni_flash` → `generate_captured status=200` → `poll_terminal SUCCESSFUL` → `video_saved` |
+| user-confirmable artifact | `tmp/f41810ea-d2e3-40fe-b834-3eaaaa351a1f.mp4` |
+
+## Cleanup owed
+
+- Ad-hoc media in project `2ddc3a33` from the runs above (1 video, several images).

gflow_cli-0.61.0/docs/superpowers/specs/2026-08-26-model-attribution-provenance.md

@@ -0,0 +1,168 @@
+# Spec — Model attribution provenance (observed vs assumed)
+
+**Status:** draft for council review. 2026-08-26.
+
+**One-line problem:** the catalog's `model` column means *ground truth* on one
+code path and *our own intent* on another, and nothing distinguishes them.
+
+---
+
+## 1. Evidence gathered today (all live, zero credits)
+
+Every claim below was observed. Claims I could not observe are in §3.
+
+### 1.1 The trigger — a silent wrong-model generation
+
+| observation | evidence |
+|---|---|
+| Requested `imagen4` (`IMAGEN_3_5`) | CLI invocation |
+| Model was not applied | log `image_model_not_set model=IMAGEN_3_5` |
+| Generation ran and reported success | **exit 0**, 1 image written |
+| Wire carried a different model | **HAR: `requests[0].imageModelName = 'NARWHAL'`** |
+| Catalog recorded `NARWHAL` | `gflow data list images` |
+| New code refuses instead | **exit 23**, 0 images written |
+
+Three independent layers (log, catalog, raw wire) agree.
+
+### 1.2 Why it happened — no fallback logic exists
+
+`IMAGEN_3_5` appears in exactly four places: the enum, its CLI aliases, its
+reference cap, and its picker selector. **Nothing maps it to `NARWHAL`.**
+
+`NARWHAL` is only the CLI default for an *omitted* `--model`; an explicit model
+was passed, so that default never applied.
+
+The model came from **residual browser UI state**. Catalog timeline, same project:
+
+```
+11:55:16  model=NARWHAL  proj=2ddc3a33  'a harbour at dawn'    <- ran --model nano2
+14:08:07  model=NARWHAL  proj=2ddc3a33  'old behaviour check'  <- ran --model imagen4
+```
+
+The earlier command set the picker; the later one failed to change it and
+inherited the selection **two hours later**.
+
+So this is not a fallback path — it is an *absence of enforcement*. There is no
+code to review, no constant to grep, no default to point at. The effective model
+is a function of what was run before in that project.
+
+### 1.3 Flow's picker no longer matches our registry
+
+Read live, menu open:
+
+```
+🍌 Nano Banana Pro  /  🍌 Nano Banana 2  /  🍌 Nano Banana 2 Lite
+```
+
+- `IMAGEN_3_5` → `has-text('Imagen 4')` — **MISS**, entry no longer exists
+- `NARWHAL` → `has-text('Nano Banana 2')` — **AMBIGUOUS**, also matches `2 Lite`
+- `Nano Banana 2 Lite` — a tier we do not model at all
+
+`gflow models` still advertises `IMAGEN_3_5 (image4, imagen4)` to users.
+
+### 1.4 The deeper defect — provenance
+
+| path | `model_name_type` source | meaning |
+|---|---|---|
+| classic | `dto.py:183` ← response `generated["modelNameType"]` | **observed** — Flow's own attribution |
+| agentic | `agentic.py:914` ← `pending_model` (the request) | **assumed** — our intent |
+
+`recorder.py:503` writes both into the same catalog column.
+
+The agentic driver documents why (`agentic.py:862-871`): the real wire values
+"live in the Web-Worker-delegated streamChat SSE stream which Playwright's
+page-level instrumentation cannot observe", so they are "scrape-synthesised
+sentinels".
+
+**Consequence:** `gflow data list images` returns truth for classic rows and
+intent for agentic rows, indistinguishably. Any audit, any governance guard, and
+any user query inherits that ambiguity.
+
+It also means §1.1's catalog evidence held **only because that run was classic**.
+On the agentic arm the catalog would have recorded `IMAGEN_3_5` — my own
+intent — and the wrong-model generation would have been invisible in the data.
+
+### 1.5 Cost currencies are not what I first claimed
+
+I asserted a wrong-model generation "billed" the user. **Retracted.**
+
+- Image → **0 Flow credits**, metered by a **per-model daily quota**
+  (`tests/e2e/test_classic_count_setter_e2e.py:7`; live cost line read `0`)
+- Video → Flow **credits** (live popover: omni-flash 7–15, veo-lite 10,
+  veo-fast 20, veo-quality 100)
+
+Quota exhaustion surfaces as HTTP 429 naming the model
+(`"You have reached the daily limit for Nano Banana Pro."` →
+`RateLimitError`, exit 4). The real harm of a wrong-model generation is
+consuming **another model's daily allowance** and receiving different output.
+
+---
+
+## 2. Oracles available, per arm
+
+| oracle | classic | agentic | cost |
+|---|---|---|---|
+| UI picker state | readable | **does not exist** — model is a natural-language directive; the driver explicitly does not drive the tune popover for model | medium |
+| Request `imageModelName` | on the wire; interception already exists (`_attach_batch_request_logger`) | unverified | ~free |
+| Response `modelNameType` | **already parsed** | **not observable** (SSE inside a Web Worker) | free |
+
+**There is no single oracle across both arms.** Classic can be made
+deterministic today for free. Agentic cannot, until the SSE stream is reachable.
+
+Precedent for the pattern: `_assert_image_entities_attached` already verifies at
+the wire that a UI attach actually took effect, because a click that silently
+did not apply is this same bug class.
+
+---
+
+## 3. Explicitly NOT established — do not design on these
+
+- Whether the agentic arm's submitted `imageModelName` matches the directive.
+  **Never observed.** The natural-language directive may or may not be honoured.
+- Numeric daily limits for any image model. Observable only on exhaustion.
+- Whether the daily quota is per-model or per-account.
+- Cost/quota of `Nano Banana 2 Lite`.
+- ~~Whether `veo_3_1_lite_lower_priority` exists in the live picker (#539)~~ —
+  **answered 2026-08-26.** The picker rendered exactly `Omni Flash` /
+  `Veo 3.1 - Lite` / `Veo 3.1 - Fast` / `Veo 3.1 - Quality` for profile denon82.
+  The `[Lower Priority]` tier was **not offered to that account at that moment**,
+  which is not proof it does not exist — it may be cohort- or region-gated.
+  Recorded as a dated observation in `tests/fixtures/flow_model_inventory.json`.
+
+  The earlier "the video picker uses a different trigger" note is **FALSIFIED**:
+  `MODEL_PICKER_TRIGGER` and `IMAGE_MODEL_PICKER_TRIGGER` are byte-identical
+  strings. The empty captures were caused by the CAPTURE, not the product —
+  `_switch_to_video_mode` leaves the settings menu open by contract, and calling
+  `_open_gen_settings_panel` after it re-clicks the SAME button and toggles the
+  panel shut. Two prior captures blamed Flow for an instrument error.
+
+---
+
+## 4. Proposed direction (for the council to attack)
+
+1. **Provenance flag first.** The catalog must record whether a value was
+   OBSERVED or ASSUMED. Everything downstream inherits this; a guard built on an
+   ambiguous column produces confident wrong answers.
+2. **Classic wire check.** Compare response `modelNameType` against
+   `request.model`; refuse on mismatch. Free, uses data already parsed.
+3. **Pre-submit refusal** (already implemented on this branch): a model that
+   cannot be selected raises before spending.
+4. **Governance guard** (already implemented and mutation-proven): offline CI
+   test grading our selectors against a recorded live inventory.
+5. **Agentic observability** — separate investigation; without it the agentic arm
+   cannot be verified at all.
+
+---
+
+## 5. Questions for the council
+
+1. Is the provenance flag the right first move, or does it over-engineer a
+   two-value distinction that a boolean `verified` column would cover?
+2. Is a post-hoc wire check worth it when the quota is already spent, or should
+   effort go to pre-submit enforcement only?
+3. Does the agentic arm's unobservability make the catalog's `model` column
+   fundamentally untrustworthy — i.e. should it be nullable rather than assumed?
+4. What breaks this design under: multi-account, concurrent runs, a Flow A/B that
+   changes picker ordering, or a model renamed rather than removed?
+5. Is there an oracle for the agentic arm we have not considered (CDP, the
+   worker's own network events, tRPC polling, the project's server-side state)?