gflow-cli 0.60.0__tar.gz → 0.62.0__tar.gz

{gflow_cli-0.60.0 → gflow_cli-0.62.0}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.60.0 → gflow_cli-0.62.0}/.env.template

@@ -173,7 +173,8 @@
 # `patchright install chromium`. Unset to revert to the default playwright engine.
 # GFLOW_CLI_BROWSER_ENGINE=playwright
 
-# Which Flow UI arm a command needs: auto (bind whatever renders) | classic
+# Which Flow UI arm a command needs: auto (default — no arm asked for, so it
+# resolves to classic, the arm that can satisfy a generation request) | classic
 # (require the hard aspect controls) | agentic (require the chat surface; needed
 # for -i instructions). gflow switches to the required arm, verifies via re-probe,
 # and aborts with exit 28 (retryable — the cohort flaps per load) if it can't be

{gflow_cli-0.60.0 → gflow_cli-0.62.0}/.github/workflows/ci.yml

@@ -205,6 +205,16 @@ jobs:
       - name: Type check
         run: uv run pyright src
 
+      # The overlay-precondition tests (#593) drive the captured changelog markup in
+      # a real headless Chromium — a mock cannot tell you whether
+      # `[role='dialog']:has(a[href*='changelog']) button` resolves against Flow's
+      # actual DOM, only a real CSS engine can. They skip cleanly when the browser is
+      # absent, which would make them silently decorative in CI, so one job in the
+      # matrix installs it. No account, no network, no credits.
+      - name: Install Chromium (real-DOM fixture tests)
+        if: matrix.python-version == '3.13'
+        run: uv run playwright install chromium --with-deps
+
       - name: Test (smoke only) + coverage
         # e2e/live tests require a logged-in Chromium profile and may spend
         # Flow credits. pyproject.toml excludes both markers by default; CI

{gflow_cli-0.60.0 → gflow_cli-0.62.0}/.gitignore

@@ -66,6 +66,11 @@ test_assets/debug_*/
 # Phase-2 live-spike capture outputs — NEVER commit (may contain real API payloads)
 scripts/dev/_spike_out/
 
+# HAR captures (GFLOW_CLI_HAR_PATH) — full request/response bodies, headers and
+# auth cookies. The _spike_out rule only covers the default location; a HAR
+# written anywhere else must not be committable either.
+*.har
+
 # Agent session marker — machine/session-local handoff state, regenerated per run
 .continue-here.md
 

{gflow_cli-0.60.0 → gflow_cli-0.62.0}/CHANGELOG.md

@@ -7,6 +7,253 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.62.0] — 2026-08-28
+
+### Changed
+
+- **`--ui-mode auto` (the default) now requires the *classic* Flow arm for image
+  generation ([#595](https://github.com/ffroliva/gflow-cli/issues/595)).** `auto`
+  used to bind whatever the composer rendered, so an account that Flow moved into
+  its **agentic** cohort — observed live on two accounts on 2026-08-27 — took a
+  path that cannot satisfy an image request and failed with either
+  `image_mode_tab` selector drift (exit 23) or a `WireFormatError` about video
+  bytes. Neither error named the cause, and the workaround
+  (`GFLOW_CLI_PREFER_CLASSIC=1`) had to be discovered from an error message.
+  `auto` now means "no arm was asked for" and resolves to `classic`, matching the
+  rule video has followed since [#299](https://github.com/ffroliva/gflow-cli/issues/299).
+  The bind still attempts classic recovery first and the cohort flaps per page
+  load, so a run only aborts (`UiModeUnavailableError`, **exit 28**, pre-submit,
+  zero credits) when the arm is genuinely pinned — and that abort is retryable.
+  The agentic arm stays reachable, but only when asked for by name
+  (`--ui-mode agentic` / `GFLOW_CLI_UI_MODE=agentic`) or by need (`-i` agent
+  instructions, which are agentic-only and still force it). The image **batch**
+  path carried its own inline mode resolution and so kept binding `auto`; it now
+  routes through the same policy as the single-prompt path.
+
+### Fixed
+
+- **An announcement modal that mounts *during* a batch generation no longer
+  silently changes the next prompt's settings**
+  ([#593](https://github.com/ffroliva/gflow-cli/issues/593) follow-up). #593 left a
+  stated gap: call sites that neither route through `_probe_selector_cascade` nor
+  sit behind a navigation gate were still unguarded, and the set had not been
+  enumerated. Auditing all 73 click/fill/press sites in the UI transports found
+  exactly one that survives the "can a modal actually land here?" test — the image
+  **batch** loop's per-prompt boundary. A batch dismisses overlays once, during
+  setup; from prompt 2 on, the settings clicks are the first act after a
+  multi-second generation wait on a page that never navigates. This one is worse
+  than a timeout: `_open_gen_settings_panel` returns `False` when no selector
+  matches and the caller falls back to Flow's current defaults, so a modal that
+  mounted during prompt 1 did not fail prompt 2 — it generated it at the wrong
+  aspect/count. The boundary now runs the same `_require_unblocked` check the
+  navigation epochs use (one probe on the happy path), so the run aborts with
+  exit 23 and a screenshot instead of producing a quietly wrong image.
+
+- **A Flow announcement modal no longer wedges a run with an unexplained timeout
+  ([#593](https://github.com/ffroliva/gflow-cli/issues/593)).** When Google ships a
+  feature, Flow puts a full changelog dialog over the editor and sets
+  `body { pointer-events: none }` while leaving the app neither `aria-hidden` nor
+  `inert` — so every control reads visible and enabled yet never receives a click,
+  and Playwright's actionability wait runs to timeout with no message. Measured live
+  on two accounts (2026-08-27, pt and en), which is also how the four failure paths
+  below were found:
+  - The gallery "+ New project" sweep ran with **no overlay check at all** — the one
+    navigation epoch that had none. A modal there cost 18 selectors x Playwright's
+    30 s default click timeout and then reported `Could not find 'New project' CTA`,
+    which is the wrong error about the wrong thing. It now dismisses first and the
+    click carries an explicit 5 s timeout.
+  - Dismissal **verifies itself**. It previously returned success the moment a click
+    landed, so a dismissal that changed nothing still logged `overlay_dismissed` and
+    the run timed out somewhere unrelated — the success event lied. It now re-probes
+    and reports honestly, with a new `ui_automation.overlay_postmortem` warning.
+  - A persistent block now **aborts pre-submit at $0** with exit 23 and a screenshot
+    (probe `overlay_close_button`) instead of hanging. A transient is not enough to
+    trigger it: Flow's own menus set the same property while open, so the guard
+    re-probes after a settle.
+  - **The modal can mount *after* the navigation gate**, which is how it kept winning.
+    Flow hydrates on its own schedule, well past `domcontentloaded`, so dismissal at
+    the navigation boundary can run before the dialog exists — then the dialog appears
+    and covers a control that is present and enabled, and the selector cascade reports
+    drift for an element that is perfectly fine. A failed probe now checks the overlay
+    state before believing itself, and dismisses and re-probes once. The guard lives in
+    the one cascade every probe routes through, so all ten call sites are covered.
+    Verified live on a third account (2026-08-27): before the fix, `image_mode_tab`
+    raised `UiSelectorDriftError` with the announcement on screen and **no
+    `overlay_detected` in the log at all**; after it, the same command on the same
+    account cleared the modal (`setLastAcknowledgedChangeLogId` → 200, 23 s in, i.e.
+    from the probe guard rather than the navigation gate) and left the editor
+    reachable.
+  - The destructive Escape fallback is now **gated on the page actually being
+    blocked**, which retires the [#395](https://github.com/ffroliva/gflow-cli/issues/395)
+    hazard structurally rather than by comment. That regression pressed Escape on the
+    character composer and sent a generation out without `entityContext` — billed,
+    silently wrong. A page we can positively see is clickable is never touched.
+
+  Two raw-`goto` e2e tests (`test_sidebar_recovery_e2e`, `e2e_auth` — the nightly
+  canary's default tier — and `test_agentic_count_enforcement_e2e`) bypass every
+  transport boundary and were unprotected; both now dismiss explicitly, and both stop
+  hardcoding `"en"` in favour of the account's own locale (#587).
+
+  **One deliberate behaviour change.** The close-button cascade is now split: the
+  changelog-scoped anchor (`[role='dialog']:has(a[href*='changelog']) button`) runs on
+  any page because it cannot match one of Flow's own surfaces, while the generic
+  selectors (`button:has(i:text('close'))` and friends) and the Escape fallback run
+  only once the body is known to be blocked. The cost is that a non-modal banner —
+  one that covers a control without blocking the body — is no longer auto-closed by
+  the generic selectors. That is the right side of the trade: those same generic
+  selectors match the character composer's own close button, #395 spent real credits
+  through exactly that door, and `KNOWN_ISSUES` rates the banner case Low and
+  transient.
+
+### Added
+
+- **`gflow project list` / `project show` and the MCP `gflow_list_projects` tool now
+  emit an account-correct editor URL
+  ([#587](https://github.com/ffroliva/gflow-cli/issues/587)).** They previously
+  emitted no URL at all: they are network-free catalog reads, so they had no way to
+  resolve a locale and correctly declined to guess one. With the locale now cached
+  per profile the link is readable offline. An unknown locale still yields the bare
+  URL — never a guessed `/fx/en/...`, which is the shape that started this thread by
+  being handed to a pt-BR account owner. In the terminal the project id renders as a
+  hyperlink, costing no column width.
+
+### Changed
+
+- **The account-locale probe no longer costs ~4 s on every command
+  ([#587](https://github.com/ffroliva/gflow-cli/issues/587)).** The probe added in
+  v0.61.0 settles the bootstrap navigation to learn where Flow lands. On an account
+  Flow does *not* redirect there is nothing to settle, so `wait_for_url` ran to the
+  full `URL_SETTLE_TIMEOUT_MS` every single invocation. Measured live 2026-08-27,
+  best-of-N per arm: **~6.2 s -> ~2.0 s** setup on the non-redirecting account,
+  against an unchanged ~2.8 s -> ~2.9 s on a redirecting one (the control, which
+  shows the cold-then-warm ordering is worth nothing on its own). Run-to-run
+  variance is over a second, so read the delta as "the 4 s settle timeout", not to
+  two decimals.
+  The outcome is cached in the profile dir (`.gflow_locale`, a sibling of the
+  existing `.gflow_account`). The same guard covers all four `await_url_settled`
+  call sites **in the UI transport**; guarding only the editor entry left three
+  navigations still paying the timeout. (The three sites in the experimental REST
+  transports have no resolved locale to gate on and are unchanged.)
+
+  The cache decides only *whether to wait*, never *where to navigate*. Sending the
+  browser to a cached `/fx/{seg}/...` was built, measured, and rejected: Flow
+  serves whatever segment it is asked for, so a pt-BR account handed `/fx/de/`
+  stayed there and rendered `html lang=de` with no redirect — no correction signal,
+  and a wrong-language UI for as long as the stale value lived. That is #580's
+  defect in a new hat. The navigation therefore stays bare, which is what lets Flow
+  state the account's own answer. Reproducer: `scripts/dev/spike_locale_poison.py`.
+
+  The cache holds **four** states, and the fourth is what keeps it honest.
+  `await_url_settled` returns `None` for both "Flow does not redirect this account"
+  and "the settle timed out this once", so one slow network could otherwise commit
+  to "not redirected" permanently and silently restore #580's post-`goto` race. A
+  no-redirect observation is therefore **provisional** until a second run agrees;
+  a transient timeout costs one extra probe instead of a lasting defect.
+
+### Fixed
+
+- **A NULL `model` / `aspect` / `project_id` no longer reads back as the string
+  `"None"` in `gflow data list images|videos`.** All three columns are nullable in
+  the schema (`assets.model`, `assets.aspect_ratio`, `assets.flow_project_id`), but
+  both listing constructors wrapped them in a bare `str(...)`, so a NULL became the
+  four-character string `"None"` — emitted verbatim into `--json` and
+  indistinguishable from a real value. `_row_to_operation_error` in the same module
+  already guarded `model` correctly; the two listing paths never got the same
+  treatment. `ImageRow` / `VideoRow` now type these fields `str | None` and the JSON
+  output carries `null`.
+
+## [0.61.0] — 2026-08-27
+
+### Fixed
+
+- **A requested image model that cannot be selected no longer generates silently
+  on a different one ([#586](https://github.com/ffroliva/gflow-cli/issues/586)).**
+  `_select_image_model` swallowed every failure, logged a warning, and let the
+  generation proceed on whatever the project's picker already held. Observed
+  live: `--model imagen4` produced an image on `NARWHAL` and exited **0** —
+  confirmed three ways (log, catalog, and `imageModelName` in a HAR). Flow has
+  removed `Imagen 4` from its picker, and `has-text('Nano Banana 2')` had become
+  ambiguous with the newly-offered `Nano Banana 2 Lite`, so `.first` resolved by
+  DOM order. A missing or ambiguous selector now raises `UiSelectorDriftError`
+  (exit 23) naming what Flow actually offered, before anything is submitted.
+
+- **A requested video model that cannot be selected no longer generates on a
+  different one — and charges for it
+  ([#539](https://github.com/ffroliva/gflow-cli/issues/539)).** `_select_video_model`
+  refused only on i2v-with-frames; a plain `t2v`/`r2v` miss logged "Flow default
+  model applies" and returned, so the run generated on whatever the picker already
+  held and spent that tier's credits — veo-quality costs 100 against veo-lite's 10.
+  Read live, Flow's picker offers exactly `Omni Flash` / `Veo 3.1 - Lite` / `Fast` /
+  `Quality`, so `--model veo-lite-lp` matched nothing and was a reachable,
+  credit-spending wrong-model path. Every miss is now fatal (exit 18) naming what
+  Flow offered, and an **ambiguous** selector is refused rather than resolved with
+  `.first`, which picks by DOM order across tiers that differ 10x in cost. Unlike
+  the image arm, refusing is unambiguous here: `--model` defaults to `None` on
+  every video command, so reaching the picker means a model was explicitly asked
+  for. Verified with a zero-credit A/B against live Flow — the pre-fix code
+  returned success for a model Flow does not offer; the new code refuses.
+
+- **Four more navigations settle before acting on the page
+  ([#584](https://github.com/ffroliva/gflow-cli/issues/584)).** #580 settled the
+  three sites it touched; an audit of every `page.goto` found four more with the
+  same defect. The worst is `evaluate_fetch.refresh_auth`, which re-navigates to
+  refresh page-context tokens and reported success while the page was still
+  moving. Two more (`evaluate_fetch` setup, `sapisidhash` fingerprint capture)
+  run `page.evaluate` immediately after navigating, where a mid-flight redirect
+  raises "Execution context was destroyed" rather than failing quietly. The
+  fourth (`_enter_editor`'s gallery return) ran `_bypass_onboarding` — real
+  button clicks — on a page about to navigate away. A new AST-based test pins
+  every `goto` to a following settle, so the audit does not have to be redone
+  by hand.
+
+- **The nightly canary now runs the version of itself that it just pulled
+  ([#582](https://github.com/ffroliva/gflow-cli/issues/582)).** `run_canary.py
+  --pull` fast-forwards the checkout and then keeps executing the copy Python
+  loaded at startup, so every runner change was silently one night late. This was
+  not theoretical: #572 added `-o junit_logging=all` so a preserved RED would
+  carry the structlog line that decides #561, and the next run pulled it and
+  still produced a RED with zero log output — three REDs untriageable, and the
+  failure reads as "the fix did not work". The runner now re-runs itself once
+  when a successful pull changed its own source, guarded by both an env var and
+  a content digest (either alone prevents a loop), via `subprocess.run` rather
+  than `os.execv` so Task Scheduler still sees one process and the real exit code.
+
+- **Editor navigation no longer races a locale redirect on non-`en` accounts
+  ([#580](https://github.com/ffroliva/gflow-cli/issues/580)).** `_enter_editor`
+  built its URL from a hardcoded `locale="en-US"` that no caller ever overrode,
+  so every account was sent to `/fx/en/...`. On a pt-BR account Flow redirects
+  that to `/fx/pt/...` **after `page.goto` has already returned** — leaving
+  overlay dismissal and prompt submission running against a page about to be
+  navigated away. That is how [#395](https://github.com/ffroliva/gflow-cli/issues/395)'s
+  "character-route bounce" presented. The client now learns the account's real
+  locale from where Flow itself lands (the only trustworthy source: `auth/session`
+  carries no locale, and `navigator.language` reports the value gflow sets when
+  launching the context), hands it to the transport through the typed
+  `TransportSetup` seam, and an independent settle-wait tolerates any redirect we
+  did not predict. An unresolved locale omits the segment rather than guessing.
+  `gflow character create --locale` now defaults to the account's locale instead
+  of `en-US`; the previous hardcoded default meant the character editor — the
+  surface #395 was reported against — was still routed to `/fx/en/...` on every
+  account, and the character route never waited for a settle at all.
+
+  Live-verified on a pt-BR account with a control arm: the fix navigates
+  race-free while the pre-fix path still redirects. Accounts Flow does not
+  redirect (e.g. `en`) skip the wait entirely after a single bounded probe, so
+  they pay no per-navigation cost.
+
+### Added
+
+- **Server-side model attribution
+  ([#586](https://github.com/ffroliva/gflow-cli/issues/586)).**
+  `parse_media_attribution` reads `modelNameType` / `seed` / `aspectRatio` from
+  the `flow.projectInitialData` listing gflow already fetches — the same payload
+  the sync path walks for `name` and discards the rest of. This matters most on
+  the **agentic** arm, where those fields were previously synthesised from our
+  own request because they live in a Web-Worker SSE stream Playwright cannot
+  observe; "not visible to the page" was never the same as "unknowable". Verified
+  live: an agentic run that requested `GEM_PIX_2` was attributed `NARWHAL` by the
+  server, with a real seed where the catalog held `0`.
+
 ## [0.60.0] — 2026-08-25
 
 ### Added
@@ -3155,7 +3402,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.60.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.62.0...HEAD
+[0.62.0]: https://github.com/ffroliva/gflow-cli/compare/v0.61.0...v0.62.0
+[0.61.0]: https://github.com/ffroliva/gflow-cli/compare/v0.60.0...v0.61.0
 [0.60.0]: https://github.com/ffroliva/gflow-cli/compare/v0.59.0...v0.60.0
 [0.59.0]: https://github.com/ffroliva/gflow-cli/compare/v0.58.0...v0.59.0
 [0.58.0]: https://github.com/ffroliva/gflow-cli/compare/v0.57.1...v0.58.0

{gflow_cli-0.60.0 → gflow_cli-0.62.0}/KNOWN_ISSUES.md

@@ -503,6 +503,16 @@ playwright._impl._errors.TimeoutError: Locator.click: Timeout 30000ms exceeded.
 
 **Legacy workaround (no longer required):** open Flow in Chrome with the same profile once, click the `X` on the "What's new" popup, then close Chrome cleanly.
 
+**Update 2026-08-27 ([#593](https://github.com/ffroliva/gflow-cli/issues/593)) — the modal wedges more than the first run.** Captured live on two accounts (pt and en): the announcement sets `body { pointer-events: none }` while leaving the app neither `aria-hidden` nor `inert`, so controls read visible **and enabled** yet never receive a click. That is why the symptom is a bare `TimeoutError` naming nothing rather than the "intercepts pointer events" message above. Three gaps were closed:
+
+- The gallery "+ New project" sweep had no overlay check at all, so a modal there burned 18 selectors x Playwright's 30 s default click timeout before reporting the wrong error.
+- Dismissal reported success on click without verifying anything cleared — `overlay_dismissed` was logged on runs that then timed out elsewhere.
+- The Escape fallback is now gated on the page being provably blocked, which retires the [#395](https://github.com/ffroliva/gflow-cli/issues/395) hazard structurally.
+
+A block that survives dismissal now aborts pre-submit with exit 23 (probe `overlay_close_button`) and a screenshot, at zero credits, instead of hanging. Dismissal persists server-side — Flow records it as `videoFx.setLastAcknowledgedChangeLogId`, so one dismissal per announcement per account is the whole cost.
+
+**Follow-up 2026-08-28 — the one remaining epoch, found by audit.** #593 left a stated gap: call sites that neither route through `_probe_selector_cascade` nor sit behind a navigation gate. All 73 click/fill/press sites in the UI transports were then enumerated and classified, and exactly one survives the "can a modal actually land here?" test: the **image batch** loop's per-prompt boundary. A batch dismisses overlays once during setup, so from prompt 2 on the settings clicks are the first act after a multi-second generation wait on a page that never navigates. That one failed *silently* rather than loudly — `_open_gen_settings_panel` returns `False` when nothing matches and the caller falls back to Flow's current defaults, so a modal that mounted during prompt 1 generated prompt 2 at the wrong aspect/count. It now runs the same `_require_unblocked` check the navigation epochs use. Every other unguarded site fails loudly (exit 23 with a probe name and a screenshot, or an `overlay_postmortem` warning), which is why they are deliberately left unguarded rather than pre-guarded on a hunch.
+
 ---
 
 ### No in-CLI quota visibility
@@ -901,6 +911,15 @@ names the pinning case. Retrying *immediately* during a pin is futile — wait a
 while or switch `--profile`. Recorded as the #299 PR-B predict-gate evidence:
 retry loops must never key off the pinned signature.
 
+**Update 2026-08-28 ([#595](https://github.com/ffroliva/gflow-cli/issues/595)) — images
+now reach this fail-fast by default.** Two accounts flipped agentic on 2026-08-27 and a
+plain `gflow image t2i` failed on both, because `auto` bound whatever rendered and the
+agentic driver cannot satisfy an image request (either `image_mode_tab` selector drift or
+a `WireFormatError` about video bytes — neither naming the cause). `auto` now resolves to
+`classic` for images too, so a pinned account gets the exit-28 abort described above
+instead of a mid-run failure, and `GFLOW_CLI_PREFER_CLASSIC=1` is no longer the
+workaround anyone needs to discover.
+
 ### Auth verification depends on Google's NextAuth session endpoint
 
 - **Status:** Mitigated · **Severity:** Low (degrades fail-closed) · **Affects:** issue #15 fix onward · **Tracked:** issue #15

{gflow_cli-0.60.0 → gflow_cli-0.62.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.60.0
+Version: 0.62.0
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.60.0/website → gflow_cli-0.62.0}/docs/CONFIGURATION.md

@@ -345,7 +345,7 @@ GFLOW_CLI_HISTORY_PROMPTS=redacted gflow image t2i "confidential brief"
 
 **What:** Which Flow UI arm to use for generation. Flow serves a **classic** composer (hard crop/aspect controls) or an **agentic** chat cohort, server-assigned and flapping per page load ([#299](https://github.com/ffroliva/gflow-cli/issues/299)).
 **Values:**
-- `auto` (default) — bind whatever the composer renders.
+- `auto` (default) — no arm was asked for, so gflow **requires `classic`** ([#595](https://github.com/ffroliva/gflow-cli/issues/595)): classic is the arm that can satisfy a generation request, and it is recovered first, so this only aborts when the arm is genuinely pinned. Before v0.62.0 `auto` bound whatever rendered, which put an account in Flow's agentic cohort on a driver that cannot produce an image — failing mid-run as `image_mode_tab` selector drift or a `WireFormatError` about video bytes. Agentic is still reachable, but only by name (`--ui-mode agentic`) or by need (`-i`).
 - `classic` — require the classic composer (hard aspect controls). gflow switches to it, re-probes to verify, and if the arm is still agentic **aborts before submitting** with `UiModeUnavailableError` (**exit 28**) — no credits spent.
 - `agentic` — require the agentic chat surface (needed for `-i` agent instructions). gflow switches to it, verifies, and aborts (exit 28) if it can't be reached.
 **Default:** `auto`

{gflow_cli-0.60.0 → gflow_cli-0.62.0}/docs/INDEX.md

@@ -145,12 +145,12 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"Two gflow runs on the same profile — can the second one wait instead of failing (exit 11)?"** → [CONFIGURATION § GFLOW_CLI_LEASE_WAIT_SECONDS](CONFIGURATION.md#gflow_cli_lease_wait_seconds) (v0.56.0 opt-in bounded wait)
 **"How do I silence the 'newer version on PyPI' stderr notice?"** → [CONFIGURATION § GFLOW_CLI_UPDATE_CHECK](CONFIGURATION.md#gflow_cli_update_check) (`0` disables; auto-skipped in CI and for editable installs)
 **"How do I run the MCP server so an agent can't spend credits?"** → [CONFIGURATION § GFLOW_MCP_NO_SPEND](CONFIGURATION.md#gflow_mcp_no_spend) + [MCP § Option A2](MCP.md#option-a2-read-only-server) (`gflow mcp run --no-spend` / `GFLOW_MCP_NO_SPEND=1`; v0.57.0 — both generate tools go unregistered, not merely refused)
-**"Which Flow UI arm does a video run require, and why did it exit 2 or 28?"** → [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode) (v0.57.0 — video is classic-only: `auto` ≡ `classic`, explicit `agentic` exits 2, unreachable classic aborts pre-submit with exit 28, $0)
+**"Which Flow UI arm does a run require, and why did it exit 2 or 28?"** → [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode) (`auto` ≡ `classic` for **both** images and video — video since v0.57.0/#299, images since #595; unreachable classic aborts pre-submit with exit 28, $0; explicit `agentic` on video exits 2)
 **"A gflow command hangs / fails — where do I start?"** → [DEBUGGING § Quick reference](DEBUGGING.md#quick-reference)
 **"A command failed — where is the incident bundle and what's in it?"** → [DEBUGGING § Automatic incident bundles](DEBUGGING.md#automatic-incident-bundles) (layout, triggers, review-before-sharing); privacy boundaries: [SECURITY § Automatic incident bundles](SECURITY.md#automatic-incident-bundles-gflow_cli_incident_capture-default-on); disable via [CONFIGURATION § GFLOW_CLI_INCIDENT_CAPTURE](CONFIGURATION.md#gflow_cli_incident_capture)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md) (**#528 content-policy 400 classification + #578 labs-lane headers, verified 2026-08-25 on profile `denon82`, ZERO Veo credits** — the 400→`ContentPolicyError` path was proven end-to-end by **fault injection through the real transport** [real browser, real editor, real submit; the 400 fulfilled at the network boundary], passing for BOTH body shapes including the **bare 400 with no `reason` field** — the load-bearing case, since reason-only matching would fall straight back to `WireFormatError`, which is the bug; the new `ui_automation.batch_400_body` discovery log fired live and is what will capture Flow's real 400 shape next time. The **natural** trigger could NOT be reproduced and this is recorded, not omitted: two face-bearing `--ref` images PLUS an age-explicit descriptor [both documented triggers stacked] returned **200** — noting the issue specified character *entities*, a different wire shape from `--ref`, and that Flow's enforcement has shifted before. #578 is the rare case where live verification proved a change **unnecessary** rather than necessary: an interleaved A/B against real `project.createProject` returned 200 on BOTH arms [origin-less control and origin+referer treatment], falsifying the 401 premise it was cherry-picked for; a header-echo cross-check confirmed Playwright adds no Origin of its own, so the control arm was genuinely bare. Incident-bundle `generation_requests[]` is **partial** — the request-summary logger was observed live but no bundle was written [a classified `ContentPolicyError` is handled, so nothing triggers capture]; unit-covered instead. Selector probe exits **2 [infrastructure]** locally without CI credentials, which is its documented contract — an absent credential must never be published as drift); previously: [LIVE_VERIFICATION_v0.59.0](LIVE_VERIFICATION_v0.59.0.md) (**#542 doctor + #543 data sync + #546 refresh-on-miss, verified 2026-08-16 on profile `denon82`, ~4 Imagen credits** — doctor offline-verified (byte-identical never-writes proof); sync live-verified by a zero-credit e2e AND a real 117-project backfill (398 nameless rows → 338 named / 57 tombstoned / 0 failures); refresh-on-miss live-healed a deliberately-corrupted catalog name mid-generation via picker attach with `sync.source=refresh`); previously: [LIVE_VERIFICATION_v0.58.0](LIVE_VERIFICATION_v0.58.0.md) (**#529 catalog-UUID→displayName picker contract + r2v named-reference fixes, verified 2026-08-15/16 on profile `denon82` (pt-BR) via four committed e2e tests, ~7 Imagen + 1 veo-lite generation** — same-project exact-UUID tile attach, cross-project verified upload fallback, loud abort on unresolvable UUIDs, and a real r2v video generated from a catalog name; the r2v e2e caught and fixed two live UI drifts: the picker exposes no accessible tree so tiles are now text-matched, and a tile click attaches directly with the include button demoted to legacy fallback); previously: [LIVE_VERIFICATION_v0.57.1](LIVE_VERIFICATION_v0.57.1.md) (**#493 and #451/#288 root-caused and fixed from live evidence, verified 2026-08-14 on profile `denon82` (pt-BR — the #493 reporter's locale), ZERO credits** — #493 was NOT an unrecognized "third editor variant": "Inicial"/"Final" are the Frames sub-mode's Start/End slots and the "Agente" pill is the ordinary Agent button, both stock classic features. The real trigger is Flow's **expanded chat sidebar**, which removes the classic composer entirely [`crop_* = 0` AND `Agent pill = 0` simultaneously] — one state producing both reported symptoms, and the reason the failure was exit 23 rather than the retryable 25 [no agentic indicator on screen, so the cohort detector matched nothing]. Recovery hinged on a close button scoped to the sidebar's `edit_square` affordance, a single point of failure for any cohort lacking that ligature; an unscoped fallback now fires only from the demonstrably stuck state, **A/B-proven three ways** [scoped broken + fallback present → rescued; both broken → NOT recovered, which is what proves the fallback rescues rather than the surrounding loop]. #451/#288 were never selector drift either — Flow's settings popover is **model-conditional**, only `omni-flash` renders a duration row, so `--duration` on a Veo model hunted a control that is never drawn [verified on 2 accounts × 2 locales]; it now exits 2 before any browser work. Two #493 hypotheses were tested and **refuted** first and are committed so they are not re-derived [a `crop_free` sub-mode trigger — the trigger reflects the *aspect*, not the sub-mode; and a hydration race — a wait was written, A/B-neutered, and cold loads passed 3/3 BOTH ways, so it was reverted rather than shipped]. Recorded not-verified: the `veo_3_1_lite_lower_priority` picker miss is **inconclusive** [the capture came after the menu closed] so that selector was deliberately left untouched, and `chain.py`'s per-link duration aborts mid-run after billing — deferred with the finding recorded). Prior: [LIVE_VERIFICATION_v0.57.0](LIVE_VERIFICATION_v0.57.0.md) (**#299 video UI-mode policy + the #496/#497/#498/#501 MCP wave live-verified 2026-08-14 on profile `ffroliva`, ZERO credits** — three real video-editor loads bound the classic driver through `get_ui_driver` [`ui_driver.bound mode=classic`, 1.2–1.7 s, aborted pre-submit], `--ui-mode agentic` is refused with **exit 2 before any browser launch** [deliberately not exit 28, whose "retry may land it" hint would mislead for a driver that does not exist], and a real-editor classic→agent→classic round-trip proved `ensure_agent_mode`'s aria-verified real click [`{"agent_acted":true,"after_agent":"agent","after_media":"media"}`]; the MCP surfaces were driven over the **real stdio JSON-RPC wire** [subprocess `gflow mcp run`, so registration *and* stream routing are covered]: `--no-spend` cut `tools/list` from 11 tools to 9 with both generate tools genuinely unregistered rather than refused, zero-arg `gflow_auth_status` returned `authenticated` off a live `GET /fx/api/auth/session` **200**, `gflow_list_projects` returned **different project IDs** on offset 0 vs offset 2 [proving the offset is honored — catalogs larger than `limit` were previously unreachable] with `limit=0`→1 and `offset=-5`→0 clamps holding, and the known-issues resource served a **7,543-byte index** against a ~70 KB source file with a **111-byte** capped unknown-slug reply. The #498 rate-limited problem-details envelope is recorded **not live-verified with reason** — exhausting the token bucket needs ≥9 accepted generate calls, so the error path cannot be reached credit-free; it is unit-pinned for both tools instead). Prior: [LIVE_VERIFICATION_v0.56.0](LIVE_VERIFICATION_v0.56.0.md) (**#477 downgrade guard, #478 bounded lease wait, and the #493 mode-switch path live-verified 2026-08-13 on profile `denon82`, images only** — a fresh-project 16:9 `t2i` exercised the #493-touched mode-switch path end-to-end [valid `ff d8` JPEG 1376×768, `image_mode_entered` → `batch_response_captured`]; the #477 guard refused a scratch profile claiming Chromium 999 with **exit 11 pre-auth, pre-credits** at the generation-client call site; #478 was proven with three concurrent runs — `WAIT=0` control failed fast with `ProfileLockedError` exit 11 while the holder held, and the `WAIT=180` waiter polled ~11 s past the holder's natural release then generated successfully; the #493 drift branch itself is a named skip [only an affected account's new-editor cohort can reach it — the fix's message text is unit-pinned], and #479's update notice is deferred-with-reason to a post-release check [it needs a published newer version on PyPI and skips editable installs by design]; an expired denon82 session 401'd the first two attempts [external state, re-login fixed it, recorded not omitted]). Prior: [LIVE_VERIFICATION_v0.55.0](LIVE_VERIFICATION_v0.55.0.md) (**Tier-1 quick wins #471–#476 verified 2026-08-13 on profile `ffroliva`, ZERO credits** — `gflow auth status` probed the real Flow session endpoint live [`Flow session verified as ffroliva@gmail.com.`, exit 0, fail-closed contract pinned]; `gflow mcp setup` ran end-to-end with the real CLI against a scratch copy of the real Claude Desktop config [correct merged entry, pristine original]; the Windows profile-DACL two-step `icacls` idiom was derived empirically [the naive `/t` form broke file access] and is pinned by a real-icacls round-trip test on every Windows host; the incident bug-report template, MCP error funnel [all 11 tools guarded, raw exception text masked], and SecretStr settings are suite-verified with no live-Flow surface — reasons recorded, not omitted). Prior: [LIVE_VERIFICATION_v0.54.0](LIVE_VERIFICATION_v0.54.0.md) (**close-browser guidance #470, character-composer focus fix, overlay/jitter hardening, and SonarCloud-S2245 RNG swap live-verified 2026-08-12 on profile `ffroliva`, ZERO credits** — the new #470 login wording printed verbatim and the manual-close → `auth_flow_session_verified` round-trip worked end-to-end; a Classic-UI `t2i` produced a real 1024×1024 JPEG [`ff d8 ff e0`] exercising overlay dismissal + jitter + image-composer submit + mode controller, and a credit-free `character create` [entity `da3cd647…`, face 1376×768 JPEG] exercised the character-composer path directly [`entering_character_editor` → `prompt_submitted` → `entity_patched` → `completed`]; the first `t2i` hit the known agentic-cohort video-for-image condition [correctly refused via `WireFormatError`, tracked by #299, not a regression] and Classic UI worked around it. First mainline release after the orphaned v0.53.0/v0.53.1 tags — CHANGELOG restores honest 0.53.x sections). Prior: [LIVE_VERIFICATION_v0.52.0](LIVE_VERIFICATION_v0.52.0.md) (**batch DAG references #317, character entity provenance recording #402, and video duration selector cascade fix #451 live-verified 2026-08-05** — 3/3 live E2E tests in `tests/e2e/test_entity_provenance_e2e.py` passed clean on profile `ffroliva`, 5-layer evidence ledger verified). Prior: [v0.51.0](LIVE_VERIFICATION_v0.51.0.md) (**dependency/security/test-correctness release verified 2026-08-05, 1 Imagen credit + 1 Veo attempt** — the only change needing live evidence was the `playwright` bound raise `>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0`, and the 2026-08-03 regression does NOT reproduce on 1.61.0: a live i2v drove `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live i2i local-ref attach passed outright [96.7s]. **1.62.0 stays excluded**, never root-caused. `-m e2e_auth` 16/16, daemon e2e 1 passed [MCP over Streamable HTTP — the first live coverage that test has ever had, it was structurally incapable of passing before], MCP Tasks 5/5 layers, 2923 offline tests, `pip-audit --all-extras` clean. **No finished mp4 is claimed** — Flow's own generation returned `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT`, server-side. Defect found and recorded not omitted: Flow dropped the duration-tab UI so **`--duration` is currently broken for i2v**, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0 — [#451](https://github.com/ffroliva/gflow-cli/issues/451)). Prior: [v0.50.0](LIVE_VERIFICATION_v0.50.0.md) (**MCP Tasks extension SEP-2663, non-blocking task handle responses, CLI/MCP output path hardening -o/--output, and Telegram PR triage alert resilience verified 2026-08-04** — 5-layer evidence ledger note generated at `tmp/live-verify/mcp-tasks.md` confirming instant task handle return, working status queries, and cancelled status DB state transitions; full 118-test suite green). Prior: [v0.49.0](LIVE_VERIFICATION_v0.49.0.md) (**#125 `omni-flash` start-frame I2V video generation, Playwright dependency upper-bound pin `>=1.59.0,<1.60.0`, submission stage watchdog timeout, and #404 count-tab fail-closed logic verified 2026-08-03** — 0-credit wire intercept captured `batchAsyncGenerateVideoStartImage` with `startImage` bound; live costed generation on `omni-flash` I2V produced a 1.2MB valid mp4 video asset on `ffroliva`; full 2902-test release suite green). Prior: [v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
+**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)

gflow_cli-0.62.0/docs/LIVE_VERIFICATION_v0.61.0.md

@@ -0,0 +1,164 @@
+# Live verification — v0.61.0
+
+Every claim below was **observed**. Claims that could not be observed are stated
+as such in §6, not omitted.
+
+## Environment
+
+| | |
+|---|---|
+| Date | 2026-08-26 / 2026-08-27 |
+| Profile | `denon82` (account locale **pt**, `html_lang=pt`) |
+| Project | `2ddc3a33-97db-41a0-a0d3-7f9488b0d5a9` |
+| UI arm | classic (cohort flaps per page load — see §6) |
+| CLI | 0.60.0 tree + the five fixes in this release |
+| Credits spent | **one** t2v generation (`omni-flash`). Everything else was credit-free. |
+
+## Summary
+
+| # | change | verified live | how |
+|---|---|---|---|
+| 1 | Video model refusal (#539) | ✅ | zero-credit A/B + two CLI runs |
+| 2 | Image model refusal (#586) | ✅ | CLI, exit 23, 0 files written |
+| 3 | Server-side attribution (#586) | ✅ | real agentic mis-attribution detected |
+| 4 | Locale navigation (#581) | ✅ | pt account + control arm |
+| 5 | Navigation settle audit (#584) | ⚠️ partial | 1 of 4 sites exercised — see §5 |
+| 6 | Canary re-exec (#582) | ⚠️ not yet | unit-tested; first real exercise is tonight |
+
+---
+
+## 1. Video model refusal (#539) — the headline change
+
+Flow's video picker, read **while the menu was open**:
+
+```
+volume_up Omni Flash
+volume_up Veo 3.1 - Lite
+volume_up Veo 3.1 - Fast
+volume_up Veo 3.1 - Quality
+```
+
+`Veo 3.1 - Lite [Lower Priority]` is **not offered to this account at this
+moment**. That makes `--model veo-lite-lp` a real MISS to test, not a synthetic one.
+
+### 1a. Zero-credit A/B against the pre-fix code
+
+Model selection happens in the settings panel entirely **before** submit, so both
+arms cost nothing. The "old code" column is a real run of the stashed pre-fix
+source against live Flow — not a reading of the diff.
+
+| case | old code | new code |
+|---|---|---|
+| `omni_flash` | SELECTED | **SELECTED** |
+| `veo_3_1_lite` | SELECTED | **SELECTED** |
+| `veo_3_1_fast` | SELECTED | **SELECTED** |
+| `veo_3_1_quality` | SELECTED | **SELECTED** |
+| `veo-lite-lp` (not offered) | **SELECTED** — returned success | **REFUSED** |
+| ambiguous selector, 3 matches | **SELECTED** — `.first` guess | **REFUSED** |
+
+Harness: `scripts/dev/live_verify_video_model_select.py` (6/6 as expected).
+
+The ambiguous case was produced by injecting `has-text('Veo 3.1')`, which matches
+Lite + Fast + Quality. The refusal message reported **3 entries match**, i.e. the
+real live count, not a fixture's.
+
+### 1b. CLI, end to end
+
+```
+gflow video t2v ... --model veo-lite-lp   → EXIT 18, nothing submitted
+```
+
+The RFC 9457 detail names all four models Flow offers and states
+`No credits were spent.`
+
+```
+gflow video t2v ... --model omni-flash    → EXIT 0
+```
+
+- `ui_automation_video.model_selected` with `"model": "omni_flash"`
+- `poll_terminal` → `MEDIA_GENERATION_STATUS_SUCCESSFUL`
+- `f41810ea-d2e3-40fe-b834-3eaaaa351a1f.mp4`, **2 250 862 bytes**
+- catalog row records `model: "omni_flash"`
+
+The guard does not break the working path.
+
+---
+
+## 2. Image model refusal (#586)
+
+`--model imagen4` (an entry Flow has removed) → **EXIT 23**, **0 jpgs written**,
+message naming what Flow does offer. An ambiguous selector → **EXIT 23**,
+`AMBIGUOUS — 2 entries match`. A disambiguated `NARWHAL` selects and generates.
+
+Batch containment: with prompt 0 refused and prompt 1 valid, the run reported
+`1/2 succeeded` and **EXIT 0** — one drifted selector does not abort a batch.
+
+## 3. Server-side attribution (#586)
+
+An agentic run that requested `GEM_PIX_2` was attributed **`NARWHAL`** by
+`flow.projectInitialData`, with a real seed where the catalog held the `0`
+sentinel. `scripts/dev/verify_model_attribution.py` exits **1** on that real
+mismatch. Free, cookie-authenticated, arm-agnostic.
+
+## 4. Locale navigation (#581)
+
+Today's runs resolved `client.account_locale_resolved locale=pt` and navigated
+`https://labs.google/fx/pt/tools/flow/project/...`. `url_stable_after_goto`
+reported `settle_skipped=false` on the redirecting account and `true` on a
+non-redirecting one, so `en` accounts pay no per-navigation wait.
+
+Previously verified across **pt / de / ja / fr / ru** with a control arm showing
+the pre-fix path still racing.
+
+## 5. Navigation settle audit (#584) — partial, stated deliberately
+
+Four `page.goto` sites gained a settle. Live runs this cycle exercised
+**`_enter_editor`** only (`ui_automation.url_stable_after_goto`, repeatedly).
+
+**Not exercised live this cycle:** `evaluate_fetch.refresh_auth`,
+`evaluate_fetch` setup, and the `sapisidhash` fingerprint capture — none of the
+runs above needed a bearer refresh. They are covered by unit tests and by the
+AST ratchet that pins every `goto` to a following settle, which is a weaker
+guarantee than observation and is recorded here as such.
+
+## 6. Canary re-exec (#582) — not yet observed
+
+The runner re-runs itself once when a successful `--pull` changed its own source.
+Covered by `tests/scripts/test_canary_reexec.py`. Its first **real** exercise is
+the nightly run from the dedicated canary clone; nothing in this cycle triggered
+a self-changing pull, so the behaviour is **unverified in production** and is
+called out rather than assumed.
+
+---
+
+## Also observed: the cohort race is real
+
+Two byte-identical `--ui-mode classic` invocations produced different arms
+seconds apart — one bound classic and refused correctly (exit 23), the other
+failed earlier at `mode_control.ensure_media_incomplete` with **exit 31**
+(`FlowAppError`) before model selection ran. This bounds what any pre-submit
+guard can promise and is recorded so it is not mistaken for a regression.
+
+## Falsified this cycle
+
+The note carried in #539 that *"the video picker uses a different trigger"* is
+**wrong**: `MODEL_PICKER_TRIGGER` and `IMAGE_MODEL_PICKER_TRIGGER` are
+byte-identical strings. The repeated empty menu captures were caused by the
+**capture** — `_switch_to_video_mode` leaves the settings menu open by contract,
+and calling `_open_gen_settings_panel` after it re-clicks the same button and
+toggles the panel shut. A DOM dump settled it in one run:
+`id='radix-:r1q:-trigger-VIDEO'` was present and visible throughout.
+
+## 5-layer ledger (the paid video generation)
+
+| layer | evidence |
+|---|---|
+| file count | 1 mp4 written |
+| magic bytes | `00 00 00 20 66 74 79 70 69 73 6f 6d` — `ftypisom`, real ISO-BMFF |
+| size | 2 250 862 bytes (not a truncated error page) |
+| structlog invariants | `model_selected model=omni_flash` → `generate_captured status=200` → `poll_terminal SUCCESSFUL` → `video_saved` |
+| user-confirmable artifact | `tmp/f41810ea-d2e3-40fe-b834-3eaaaa351a1f.mp4` |
+
+## Cleanup owed
+
+- Ad-hoc media in project `2ddc3a33` from the runs above (1 video, several images).