gflow-cli 0.66.0__tar.gz → 0.66.2__tar.gz

{gflow_cli-0.66.0 → gflow_cli-0.66.2}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.66.0",
+  "version": "0.66.2",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.66.0 → gflow_cli-0.66.2}/CHANGELOG.md

@@ -7,6 +7,85 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.66.2] — 2026-09-03
+
+### Fixed
+
+- **v0.66.1's migrated-origin fast-fail never fired on a real run
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** The guard read `page.url` once,
+  at `get_ui_driver` entry — but `routes.project_editor_url` only ever builds a `labs.google`
+  URL and the hop to `flow.google.com` is a *post-`goto`* redirect that neither settle path
+  waits for (no locale → `_settle_if_redirecting` returns immediately; a known locale →
+  `await_url_settled` short-circuits because the labs URL already matches the localised shape).
+  So the guard classified a pre-redirect URL, declined, and the run paid ~54 s before failing
+  anyway through the slow selector-probe path. Measured by the reporter on three consecutive
+  v0.66.1 runs: **57.0 / 57.1 / 58.3 s**, with `ui_driver.migrated_host_bail` absent from the
+  timeline entirely. The host check is now a shared `raise_if_migrated` helper called at the
+  three points the run is *about to spend time* — `get_ui_driver` entry, each `detect_ui_mode`
+  poll tick, and `_exit_agent_mode` once the media panel is found absent — so it adds no wait
+  and no navigation to the old host, and aborts as soon as the redirect is observable. The
+  event now names its call site, so the fast path is visible in a field timeline instead of
+  inferred. Two blanket `except Exception` handlers that would have demoted the abort to a
+  warning now re-raise it.
+
+- **A `NOT_REDIRECTED` locale cache was an absorbing state, which made the #643 `<html lang>`
+  recovery unreachable on exactly the profiles that needed it
+  ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).** `_bootstrap_and_resolve_locale`
+  returned *before* `_resolve_account_locale` — the only site of that recovery and the only
+  caller of `next_locale_state` — so nothing could ever move a latched profile off the state.
+  Every profile that saw two migrated loads on ≤0.66.0 latched this way. `NOT_REDIRECTED` now
+  skips the settle only, and still reads the locale: measured 56/56 on a latched profile whose
+  page declares `lang="en"` on every load. The 4 s settle stays skipped — deleting the early
+  return outright was rejected, because on that account the cached "not redirected" is a true
+  observation.
+
+- **A `<html lang>` locale was treated as evidence that Flow redirects the account, which
+  switched the URL settle back on permanently ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).**
+  Shipped in v0.66.1 and present on `develop`: #643's `<html lang>` fallback returns a segment for
+  an account Flow serves **bare** and never redirects, and `next_locale_state` recorded it as the
+  cached state. Every later bootstrap then saw `cached != NOT_REDIRECTED`, settled, and burned the
+  full 4 s `URL_SETTLE_TIMEOUT_MS` waiting for a redirect that never comes — the exact cost #587
+  exists to remove, on any non-redirecting account with a `lang` attribute. Only a **URL-derived**
+  segment is now folded into that cache; the lang-derived one is used in-process to build URLs and
+  never persisted. Measured on a real profile: warm bootstrap **7.41 s → 2.66 s**, with the locale
+  still recovered.
+
+- **`docs/MCP.md`'s retryable-class list was incomplete**, which would have told an MCP agent not
+  to auto-retry failures the envelope marks `retryable: true`. It omitted `FlowHostMigratedError`,
+  `UiModeUnavailableError` and `SyncPartialError`; it now matches `errors.RETRYABLE_ERRORS`.
+
+## [0.66.1] — 2026-09-03
+
+### Fixed
+
+- **A migrated-origin run spent ~36 s discovering a failure knowable in microseconds
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639)).** `flow.google.com` renders none
+  of the controls gflow drives, so every DOM probe is doomed before it starts — yet the run
+  still burned the full `detect_ui_mode` poll window (~8 s, both arms missing), the crop
+  selector cascade (~24 s) and the URL settle (4 s) before raising `FlowHostMigratedError`.
+  Because the rollout flaps per page load and callers retry on exit 36, that cost was paid on
+  **every attempt** of a retry loop. `get_ui_driver` now checks the host first and fails fast
+  with the same retryable exit 36. The old host is untouched and still gets full DOM detection;
+  a page whose URL cannot be read still probes rather than bailing, so a transient is never
+  mistaken for a migrated origin.
+
+- **Locale resolution was blind on `flow.google.com`, and silently discarded a locale it had
+  already learned ([#643](https://github.com/ffroliva/gflow-cli/issues/643)).** The migrated
+  origin serves `/project/<id>` with no `/fx/<locale>/tools/flow` segment, so
+  `locale_segment_from_url` could never match there. The locale had not disappeared — it moved
+  into `<html lang>`, which stays correct on the migrated host. Two measured consequences:
+  `next_locale_state("pt", None)` returned PROVISIONAL, **demoting** an already-learned locale
+  on every migrated load (so a fully-migrated account could never learn it again, undoing
+  [#587](https://github.com/ffroliva/gflow-cli/issues/587)); and `await_url_settled` burned the
+  full 4 s timeout per navigation waiting for a shape that can no longer exist. gflow now falls
+  back to `<html lang>` when the URL carries no segment, and skips the settle wait entirely on
+  the migrated origin.
+
+  The fallback is evidence-backed, not assumed: measured on two accounts (`en` and `pt-BR`),
+  `<html lang>` **agreed with the URL segment wherever both existed**. Unlike
+  `navigator.language` — which reports the value gflow itself sets — it is server-rendered by
+  Flow. Where Flow does state the locale in the URL, that stays authoritative.
+
 ## [0.66.0] — 2026-09-03
 
 ### Fixed
@@ -3705,7 +3784,9 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.66.2...HEAD
+[0.66.2]: https://github.com/ffroliva/gflow-cli/compare/v0.66.1...v0.66.2
+[0.66.1]: https://github.com/ffroliva/gflow-cli/compare/v0.66.0...v0.66.1
 [0.66.0]: https://github.com/ffroliva/gflow-cli/compare/v0.65.0...v0.66.0
 [0.65.0]: https://github.com/ffroliva/gflow-cli/compare/v0.64.0...v0.65.0
 [0.64.0]: https://github.com/ffroliva/gflow-cli/compare/v0.63.0...v0.64.0

{gflow_cli-0.66.0 → gflow_cli-0.66.2}/KNOWN_ISSUES.md

@@ -50,7 +50,7 @@ callers get this for free: the failure is `FlowHostMigratedError` (exit 36) with
 `retryable: true`, so retry loops driven by the `--json` / MCP / worker error
 envelope will keep trying.
 
-**What gflow does today (v0.66.0):** recognises the migrated origin and fails
+**What gflow does today (v0.66.2):** recognises the migrated origin and fails
 with the distinct, retryable exit 36 instead of the misleading
 `UiSelectorDriftError` (exit 23, "file a selector bug"). `_check_logged_in` also
 accepts the migrated host, so a migrated load is no longer misread as a
@@ -58,6 +58,18 @@ logged-out session. **Support for driving the new frontend is separate work and
 is not implemented** — once the rollout completes for an account, no retry will
 help until then.
 
+> **v0.66.1's fast-fail did not fire in the field, and v0.66.2 is the correction.**
+> The guard read `page.url` once, at `get_ui_driver` entry — before the hop to
+> `flow.google.com` had landed, because `project_editor_url` only builds
+> `labs.google` URLs and the redirect arrives *after* `page.goto` returns.
+> Measured by the reporter on three consecutive v0.66.1 runs: exit 36 at **57.0 /
+> 57.1 / 58.3 s**, through the slow selector-probe path. v0.66.2 re-checks the host
+> at the points the run already blocks, so the abort costs the old host nothing and
+> lands as soon as the redirect is observable. The same release stops a
+> `NOT_REDIRECTED` locale cache from disabling the `<html lang>` recovery (#643),
+> which had made that state unrecoverable on exactly the profiles it was written
+> for.
+
 ---
 
 ### A Veo extend segment is 7 seconds, not the 8 Flow advertises — so concat pads a frozen second

{gflow_cli-0.66.0 → gflow_cli-0.66.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.66.0
+Version: 0.66.2
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.66.0 → gflow_cli-0.66.2}/docs/INDEX.md

@@ -158,8 +158,12 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.64.0](LIVE_VERIFICATION_v0.64.0.md) (**#626 `--model omni-flash --end-frame` — first+last interpolation on Omni 1.1 Flash, verified 2026-09-02.** The guard this release removes was evidence-gated, so it was retired on evidence: a route-aborted submit capture on **two distinct Google accounts** (`ffroliva`, `denon82`) fired `video:batchAsyncGenerateVideoStartAndEndImage` with `startImage` AND `endImage` non-null at **zero credits**, ruling out a single-account artifact. The decisive layer is semantic, not structural: the paid 4s generation's **last frame IS the supplied end image** and its first frame is the start image — two visibly different subjects — which is the only check that distinguishes "Flow bound the end frame" from "Flow accepted and ignored it", and which layers 1–4 would pass either way. Render: 4.01s / 720×1280 / h264+aac / 2.4 MB, `MEDIA_GENERATION_STATUS_SUCCESSFUL`. The static capability table is **deleted**, not corrected — it went stale silently once and would again; a post-submit route check (`_assert_i2v_route`) now fails a run whose end frame Flow dropped back to the `StartImage` route, catching a rollback on any account without anyone re-reading a support page. One item is recorded as NOT verified rather than omitted: `--duration 10` + end frame is **submit-verified only** (`duration_set seconds=10` on the correct route with both images bound), because the status poll returned HTTP 401 mid-run and a retry 401'd at `project.create` before submitting — [#561](https://github.com/ffroliva/gflow-cli/issues/561), pre-existing, so verification was stopped rather than spending further credits on an environmental fault.) · previous: [LIVE_VERIFICATION_v0.63.0](LIVE_VERIFICATION_v0.63.0.md) (**`gflow video extend` — continuing a clip past Flow's 8s ceiling, verified 2026-09-01 on profile `ffroliva`, 20 Veo credits.** The decisive observation is that segment 2's `source_media_id` **is** segment 1's `media_id` (`0c9364f3…` seeded from `b9458021…`, then `648f9291…` seeded from `0c9364f3…`) — tail-only chaining, which no mock can establish; had it re-seeded from the source, the output would have been two divergent continuations of the same moment instead of one continuous shot. `extend_model_resolved` logged `candidate_count=99` against `SERVICE_TIER_INTERMEDIATE`, proving the key came from the live capability listing rather than a constant, and plan cost matched actual spend (`20 credits total, balance 875` → `Extended — 2/2 segment(s), 20 credits`). Render: 23.02s / 1280×720 / 24fps / h264+aac. **The run found a defect the offline suite is structurally incapable of seeing:** an extend segment carries **7.000000s** of content, not the 8 Flow advertises and bills, so server-side concat pads every internal seam with a frozen frame and digital silence (15s at −75.1 dB against −29 neighbours, reproduced on a second independent render) — filed in KNOWN_ISSUES with the three questions that must be answered before any clamp, and the reason `--extend N` on t2v/i2v was deliberately NOT shipped. Seven items are recorded as NOT verified rather than omitted: portrait `9:16`, `--aspect` against a mismatched source, chains longer than 2 segments, `--resume-from` against a live partial scene, the insufficient-credits refusal, a live Ctrl+C, and `OperationKind.EXTEND` rows.) · previous: [LIVE_VERIFICATION_v0.62.1](LIVE_VERIFICATION_v0.62.1.md) (**#604 `--model omni-flash` selects again after Flow's `Omni Flash` → `Omni 1.1 Flash` rename, verified 2026-08-30 on profile `ffroliva` at ZERO Veo credits.** The production `_select_video_model` was driven against the real picker: the shipped selector resolves verbatim — `model_selected model=omni_flash via="[role='menuitem']:has-text('Omni'):has-text('Flash'):not(:has-text('[Lower Priority]'))"` — and all six cases came back as expected: the four offered tiers SELECT, a tier Flow does not offer REFUSES, and a deliberately ambiguous selector REFUSES rather than resolving `.first`. Selection happens before submit, so the whole matrix is free. The transport's own refusal diagnostic read the live menu back as `Omni 1.1 Flash / Veo 3.1 - Lite / Fast / Quality`, independently corroborating the fixture. Four items are recorded as NOT verified rather than omitted: the rename *direction* [the `Omni Flash` baseline is a different account, locale and date], an actual `Omni ... [Lower Priority]` entry [Flow has never offered one], a full credit-spending generation on omni-flash, and #539's absence question, which stays open.) · previous: [LIVE_VERIFICATION_v0.62.0](LIVE_VERIFICATION_v0.62.0.md) (**#595 `auto` ≡ `classic` for images, verified 2026-08-28 on profile `ci-probe` — an account Flow had moved to the agentic cohort the day before — at ZERO Veo credits.** With no flags and no env vars the run logged `ui_driver.ui_mode.attempt_exit_agent` → `ui_driver.bound mode=classic ui_mode=classic` and generated a real 768x1376 JPEG (exit 0); the day before, the identical command on the same account bound `auto`→`agentic` and failed. The same log independently closed **#183**: `mode_switch_trigger` and `image_mode_tab`, the selectors it reported as unfindable, both matched. #591 was proven against the real 500-row catalog — **0** occurrences of the string `"None"`, 31 proper JSON `null`s, over a catalog holding 119 NULL-bearing rows. #592 shows exactly one `client.account_locale_cached` per command. Three items are recorded as NOT verified rather than omitted: the exit-28 abort on a *pinned* agentic account, the #597 batch inter-prompt guard, and any fresh announcement modal — the last two because all three accounts have already acked the current changelog, so no modal can be raised until Google ships the next one.) · previous: [LIVE_VERIFICATION_v0.61.0](LIVE_VERIFICATION_v0.61.0.md) (**#539 video-model refusal + #586 image-model refusal and server-side attribution, verified 2026-08-26/27 on profile `denon82`, ONE Veo generation total** — the video fix was proven by a **zero-credit A/B against the stashed pre-fix source running on live Flow**: the old code returned SELECTED for `veo-lite-lp`, a model Flow does not offer to this account, and for a deliberately ambiguous selector matching 3 entries; the new code refuses both with exit 18 naming what Flow offered. Model selection happens before submit, so refusals cost nothing and the A/B was free. The happy path still generates: `--model omni-flash` → exit 0, a real 2.2 MB `ftypisom` mp4, catalog recording `omni_flash`. Two items are recorded as NOT verified rather than omitted: three of #584's four navigation-settle sites were never exercised [no bearer refresh occurred in these runs], and #582's canary self-re-exec has its first real exercise tonight. Also falsified: #539's recorded note that the video picker uses a different trigger — the two constants are byte-identical strings, and the repeated empty menu captures were the capture's own fault.) · previous: [LIVE_VERIFICATION_v0.60.0](LIVE_VERIFICATION_v0.60.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
+**"What was live-verified for v0.66.1?"** → [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md) — **the two migrated-origin fixes, verified 2026-09-03 on profile `ffroliva` at ZERO credits, on BOTH sides of the still-flapping rollout.** On a real `flow.google.com` load `get_ui_driver` raised `FlowHostMigratedError` in **0 ms** (was ~36 s: ~8 s detect window + ~24 s crop cascade + 4 s URL settle), exit 36, `retryable: true`, `ui_driver.migrated_host_bail` logged; `await_url_settled` returned `null` in **0 ms** (measured 4018 ms before); and the locale was recovered as `en` from `html lang=en-GB` where the URL gave `null`. The no-regression half is the stronger evidence: minutes later the same command landed on the OLD host and completed **exit 0** with a real 768x1376 JPEG in 42.2 s, proving the host guard is scoped and does not short-circuit the working path. Three items recorded as NOT verified rather than omitted: driving the migrated frontend (still impossible, #639 stays open), the pt-BR recovery live (measured `html lang=pt` on `denon82` but exercised live only on `en-GB`), and the `en-GB`→`en` region reduction against a locale where region is load-bearing (`zh-Hans`/`zh-Hant`) — only two locales observed.
+
 **"What was live-verified for v0.66.0?"** → [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — **#639 Flow's `flow.google.com` migration, verified 2026-09-03 on profile `ffroliva` at ZERO credits.** The maintainer's own account turned out to be inside the rollout, so the fix was proven against the real migrated frontend rather than a reconstructed DOM: a read-only probe of `flow.google.com/project/<id>` measured `i_total: 0` (independently reproducing the reporter's central measurement) and drove the production functions against the live page — `flow_host_kind: "migrated"`, `_check_logged_in: true` (it was `false` before the fix, i.e. a valid session read as logged-out), and `_mode_switch_error` returning `FlowHostMigratedError` / exit 36 / `retryable: true`. The flap is confirmed on ONE account: a credit-free `image t2i` minutes earlier landed on the OLD host and completed exit 0 with a real 768x1376 JPEG (`ffd8ffe0`, 401,939 bytes, Pillow dims matching the API claim), proving the rewritten host gate does not regress the old path. Also recorded: the migrated URL **drops `/fx/tools/flow` entirely** — it is `/project/<id>` — which is why a substring gate on `labs.google` could never match it; and the migrated composer is not control-less but exposes **no `data-testid`, zero ligature `<i>`, and 13 `button[aria-label]`** (`Settings trigger`, `Start generation`, …), recorded as recon for the follow-up WITH the caveat that `aria-label` is translated and therefore Tier-2 at best under the locale-invariance rule. One item is recorded as NOT verified rather than omitted: gflow **driving** the migrated frontend, which is out of scope and keeps #639 open. Verification also hit pre-existing [#561](https://github.com/ffroliva/gflow-cli/issues/561) (401 on `project.createProject`), A/B'd against unmodified `develop` to prove it was not this change, then routed around with an existing `--project`.
 
+**"What was live-verified for v0.66.2?"** → [LIVE_VERIFICATION_v0.66.2](LIVE_VERIFICATION_v0.66.2.md) — the old host proven live at zero credits (**exit 0**, real 768x1376 JPEG, twice), the locale cache measured **7.41 s → 2.66 s**, and the migrated path recorded as **NOT verified** because the rollout flapped back (72/72 navigations landed on `labs.google`). No time-to-exit-36 is claimed — this release exists because v0.66.1 reported one from the wrong entrypoint, so see also the correction block atop [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md).
+
 **"What was live-verified for v0.65.0?"** → [LIVE_VERIFICATION_v0.65.0](LIVE_VERIFICATION_v0.65.0.md) — the guard A/B (three runs, zero credits, control included); the `chain`/`movie` duration guards are validation that refuses **before** any transport call, so they are covered by a red state that reproduces the mid-spend crash in a test plus negative controls, and the reason they were not live-run is recorded rather than omitted.
 
 **"Does the `referenceEntity` guard actually run, and is it a Web Worker or a Service Worker?"** → [LIVE_VERIFICATION_reference_entity_guard](LIVE_VERIFICATION_reference_entity_guard.md) — **A/B-proven live on denon82 2026-09-02, zero credits.** Control (without #618): the guard never fired and the test failed; with #618: it fired and passed. Same account, same prompt, one variable. Settles the question that held #618 — it is a **dedicated Web Worker**, so `context.route` suffices and no `service_workers="block"` is needed. Also confirms `route.continue_(post_data=...)` does not corrupt the body (both runs produced a real image). The **video** glob was equally dead, which #615 never mentions. Residual: direct-wire routes still bypass structurally (#619).

gflow_cli-0.66.2/docs/LIVE_VERIFICATION_v0.66.1.md

@@ -0,0 +1,100 @@
+# Live Verification — v0.66.1 (migrated-origin fixes for #639/#643)
+
+**Date:** 2026-09-03 · **Account:** ffroliva@gmail.com · **Platform:** Windows 11, Chrome strategy
+**Credits spent:** **0** — one Imagen image (images are credit-free) plus read-only probes.
+
+> ## ⚠️ Correction (2026-09-03, same day) — Layer 1's latency numbers are not user-visible
+>
+> **Layer 1 below measured `get_ui_driver` in isolation, on a page already sitting on
+> `flow.google.com`.** That precondition never holds on a real run: `project_editor_url`
+> only ever builds a `labs.google` URL and the hop to the migrated origin is a
+> *post-`goto`* redirect that neither settle path waits for, so on the CLI route the guard
+> read a pre-redirect URL and declined.
+>
+> The reporter of #639 measured the real path on three consecutive v0.66.1 runs: **57.0 /
+> 57.1 / 58.3 s**, terminating through `ui_automation_video.selector_probe_failed` — the
+> slow path — with `ui_driver.migrated_host_bail` **absent from the timeline entirely**.
+>
+> So of the rows below: `"get_ui_driver": {"ms": 0}` and **`time to exit 36 — 0 ms` are
+> true of the isolated probe and false of every CLI run.** The claim
+> *"`ui_driver.migrated_host_bail` is logged, so the fast path is observable rather than
+> inferred"* is the one the field timeline falsified — the event was never emitted, and
+> nothing here noticed because the isolated probe emitted it.
+>
+> The same gap hid the locale fix: `client.py` returned before `_resolve_account_locale`
+> on a `NOT_REDIRECTED` cache, so the `<html lang>` recovery Layer 1 exercised **directly**
+> is unreachable through the client on exactly the profiles that need it. `profile_ffroliva`
+> is latched that way today.
+>
+> Both are fixed for v0.66.2 — see [LIVE_VERIFICATION_v0.66.2](LIVE_VERIFICATION_v0.66.2.md).
+> **Layer 2 (no regression on the old host) stands unchanged and is still the load-bearing
+> result here.** The lesson is recorded rather than the numbers quietly edited: a function
+> measured in isolation is not a verification of the path users take.
+
+## What had to be proven
+
+Two fixes, both on the migrated-origin path, and both verifiable live because the account is
+inside Google's rollout:
+
+1. `get_ui_driver` fails fast on `flow.google.com` instead of probing a DOM that cannot answer.
+2. The account locale is recovered from `<html lang>` when the migrated URL carries no segment.
+
+Plus the property that matters more than either: **the old host still works.**
+
+## Layer 1 — the migrated path, measured on a real migrated load
+
+```json
+{
+  "final_url": "https://flow.google.com/project/c5550ed7-...",
+  "host_kind": "migrated",
+  "get_ui_driver": { "raised": "FlowHostMigratedError", "ms": 0,
+                     "exit_code": 36, "retryable": true, "names_host": true },
+  "await_url_settled": { "result": null, "ms": 0 },
+  "locale_recovery": { "html_lang": "en-GB", "from_url": null, "from_lang_attr": "en" }
+}
+```
+
+| | before | after (measured) |
+|---|---|---|
+| `detect_ui_mode` poll window | ~8 s | skipped |
+| crop selector cascade | ~24 s | skipped |
+| `await_url_settled` | 4018 ms | **0 ms** |
+| **time to exit 36** (isolated probe) | ~36 s | **0 ms** |
+| **time to exit 36** (real CLI run) | ~57 s | **~57 s — UNCHANGED, see the correction above** |
+| locale on migrated origin | `null` (and demoted a learned locale) | **`en`** recovered from `<html lang>` |
+
+~~`ui_driver.migrated_host_bail` is logged, so the fast path is observable rather than inferred.~~
+**Retracted.** It is logged by the isolated probe and by nothing on the CLI route — the field
+timeline has no such event. Observability of a path you did not exercise is not observability.
+
+## Layer 2 — no regression on the old host (full generation, exit 0)
+
+The rollout still flaps on this account, and a `gflow image t2i --project <existing>` run landed
+on the **old** host during verification:
+
+```
+EXIT=0   ELAPSED_MS=42168
+status: ok | model: NARWHAL
+dims: 768x1376 | tmp/lv661/images/2026-09-03/0add6af6-...-_1.jpg
+```
+
+Real image generated and written. The host guard is scoped to the migrated origin and does not
+short-circuit the path that works.
+
+## Layer 3 — offline
+
+- 5 + 8 tests written **red first** across the two fixes.
+- **A/B controls:** neutering the early bail fails exactly 3; neutering the locale fix fails
+  exactly 8 — one per claimed behaviour, no test passing vacuously. No-regression tests pass in
+  **both** directions.
+- `1614 passed / 3 skipped`; ruff clean; pyright 78 = `develop` baseline.
+
+## Recorded as NOT verified rather than omitted
+
+- **Driving the migrated frontend.** Still impossible; #639 stays open. These fixes make the
+  failure fast and honest, not survivable.
+- **A non-English migrated locale end to end.** `html lang=pt` was measured on `denon82`'s
+  migrated load, but the recovery path was exercised live only on `en-GB` → `en`. The `pt` case
+  is unit-tested, not live-run.
+- **The `en-GB` → `en` region reduction against a locale where region is load-bearing**
+  (`zh-Hans`/`zh-Hant`). Only two locales observed; flagged in the docstring.

gflow_cli-0.66.2/docs/LIVE_VERIFICATION_v0.66.2.md

@@ -0,0 +1,170 @@
+# Live Verification — v0.66.2 (the migrated-host gate actually fires; the locale cache stops lying)
+
+**Date:** 2026-09-03 · **Account:** ffroliva@gmail.com · **Platform:** Windows 11, Chrome strategy
+**Credits spent:** **0** — two Imagen images (images are credit-free) plus 72 read-only navigations.
+
+## What had to be proven, and the honest constraint
+
+This release fixes defects that v0.66.1's *own* verification missed, so the bar for it is higher
+than usual: **v0.66.1 measured `get_ui_driver` in isolation on an already-migrated page and
+reported `0 ms`, which was true of the probe and false of every CLI run.** See the correction at
+the top of [LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md).
+
+**The constraint this time is the inverse of last time.** Google's rollout flapped *back* on both
+maintainer accounts during this work:
+
+| profile | navigations | landed migrated | landed old host |
+|---|---|---|---|
+| `ffroliva` | 60 | **0** | 60 |
+| `denon82` | 12 | **0** | 12 |
+
+Measured with `scripts/dev/measure_migrated_host_flip.py` across three sweeps on `ffroliva` and
+one on `denon82`, over ~2 hours (the raw per-navigation record is in the `scripts/dev/_spike_out/` JSON the
+instrument writes; the planning artifacts were consolidated at release per the repo's
+spec-to-memory convention).
+
+So **the migrated path was not reachable from this machine and is NOT live-verified here.** It is
+unit-tested and A/B-controlled only. That is stated in the NOT-verified section below rather than
+folded into the green column — which is precisely the mistake being corrected.
+
+What *is* live-verifiable is the property that matters most today: **the old host, which 100% of
+real loads currently take, is unaffected** — and the locale behaviour, which is fully exercisable.
+
+## Layer 1 — the locale cache stops conflating two different questions
+
+`profile_ffroliva/.gflow_locale` was **empty** — `NOT_REDIRECTED` — before the run. Under v0.66.1
+that state returned before `_resolve_account_locale`, so the `<html lang>` recovery #643 shipped
+could never run on it.
+
+```
+cache before:  ''                                                    (NOT_REDIRECTED)
+client.account_locale_resolved   locale=en  source=html_lang
+client.account_locale_cached     locale=en  settle_skipped=true
+cache after:   ''                                                    (NOT_REDIRECTED — unchanged)
+```
+
+Three things at once, all measured:
+
+1. **The locale is recovered from the document**, not the URL — `source=html_lang`. The latch no
+   longer blocks it.
+2. **The settle stays skipped** (`settle_skipped=true`). The #587 win is intact — which is why
+   deleting the early return outright was rejected: on this account "not redirected" is a *true*
+   observation, confirmed 60/60.
+3. **The cached state is unchanged.** This is the correction the council forced (see below): the
+   cache answers *"does Flow redirect this account?"*, and a `<html lang>` attribute is no
+   evidence of a redirect — every account has one.
+
+### The regression the council caught, and the measurement that proved it
+
+The first cut of this fix folded the recovered locale into the cache. Two independent reviewers
+(D1 correctness, D4 tests) flagged it; `scripts/dev/measure_locale_probe.py` then reproduced it
+without being asked:
+
+```
+BEFORE:  ffroliva  warm  7.41s   cached 'en'    !! warm arm slower than cold — investigate
+                                 transport.url_settle_gave_up  timeout_ms=4000.0   (x2)
+
+AFTER:   ffroliva  cold  6.99s   cached '?'
+         ffroliva  warm  2.66s   cached ''      settle off, locale still 'en'
+```
+
+Writing the locale in flipped `cached != NOT_REDIRECTED`, which turned the settle back on
+permanently and cost the full 4 s `URL_SETTLE_TIMEOUT_MS` on every future bootstrap — the exact
+cost #587 exists to remove.
+
+**Tracing it found a live defect in v0.66.1 itself, present on `develop` today.** #643's
+`<html lang>` fallback returns a segment for an account Flow serves *bare* and never redirects, and
+`next_locale_state` recorded that as evidence of a redirect. So **any** non-redirecting account
+with a `lang` attribute has been paying 4 s per bootstrap since v0.66.1 — no latch required. The
+fix folds only the **URL-derived** segment into the state; the lang-derived one is used in-process
+for URL building and never persisted.
+
+## Layer 2 — the risk this fix introduces, exercised rather than assumed
+
+Recovering the locale changes what gflow navigates to: this profile previously built the **bare**
+`labs.google/fx/tools/flow/project/<id>` and now builds `/fx/en/tools/flow/project/<id>`. If `en`
+were the wrong segment, every navigation would bounce.
+
+```
+ui_automation.entering_existing_project  url=https://labs.google/fx/en/tools/flow/project/c5550ed7-…
+ui_automation.url_stable_after_goto      same URL, +549 ms, settle_skipped=false
+ui_driver.ui_mode.attempt_exit_agent     +507 ms
+ui_driver.bound                          mode=classic
+```
+
+`url_stable_after_goto`, **not** `url_redirected_after_goto`: Flow accepted the segment and did
+not bounce it. Confirmed on both live runs.
+
+## Layer 3 — no regression on the old host: full generation, exit 0, twice
+
+```
+run 1 (pre-council-fix build)   EXIT=0   768×1376 JPEG · 427.8 KB · ff d8 ff
+run 2 (final build)             EXIT=0   768×1376 JPEG · 413.5 KB · ff d8 ff
+```
+
+Real images generated and written; `ui_driver.bound  mode=classic` on both; no
+`ui_driver.migrated_host_bail` event on either — correct, the host is `labs.google`.
+
+**On wall-clock:** run 1 took 36.6 s and run 2 took 86 s, and **neither number is evidence about
+this diff.** Run 2's extra time is Flow's own generation latency plus a 34.4 s
+`browser_teardown.context_close_error` — a bounded Chrome-close timeout at `api/_engine.py:159`
+that fires *after* all generation work, is already handled (warning → force close → exit 0), and
+is untouched by this branch. A single-run timing delta sits well inside that variance, so the
+"adds no wait" claim rests on the A/B control and on code shape (`page.url` is a cached property;
+`flow_host_kind` is one `urlsplit` plus a dict lookup; `_media_panel_present` uses `.count()` and
+does not wait) — **not** on the totals. Claiming "faster" from these runs would repeat exactly the
+error this release corrects.
+
+## Layer 4 — offline
+
+- Tests written **red first**: 4 red for the locale latch, 4 red for the host gate, before any
+  production change.
+- **A/B controls**, re-derived independently by a council reviewer with its own harness:
+  neutering `raise_if_migrated` fails **exactly 7** and **no** old-host test; restoring the
+  pre-#639 early return fails **exactly 5**. Nothing passes vacuously in either direction.
+- The council's must-fix added two more tests that would have caught the regression it found:
+  a two-bootstrap cycle (one bootstrap cannot observe a cache flipping the settle back on), and
+  a lang-only-locale case pinning that a `lang` attribute is not evidence of a redirect.
+- `ruff check` / `ruff format --check` clean on `src tests`; `pyright src` at the `develop`
+  baseline; repo hygiene, doc links, website-docs PII, and the `website/docs` mirror all green.
+
+## Layer 5 — the MCP surface
+
+No CLI leaf, option, or request-DTO field changed, so `tests/mcp/test_cli_parity.py` needs no new
+mapping and `worker/codec.py` no new payload key — the fix is in the transport both surfaces
+share (independently traced by the parity reviewer: `worker/daemon.py` and `mcp/tools.py` both
+construct the same `FlowApiClient`). What *is* MCP-specific is the queue envelope, different code
+from the CLI's `--json` path, carrying the flag the reporter's orchestrator actually reads:
+
+```
+queue error record:  exit_code = 36,  retryable = True
+```
+
+Pinned by `tests/worker/test_daemon.py::test_migrated_host_error_crosses_the_queued_path`. Noted
+honestly: that test pins the write side; the `wait=True` read-back in `mcp/tools.py` is generic
+code exercised by its neighbours, so the round trip is pinned end-to-end only by construction.
+
+`docs/MCP.md` listed the retryable classes by name and omitted three of them
+(`FlowHostMigratedError`, `UiModeUnavailableError`, `SyncPartialError`); the list now matches
+`errors.RETRYABLE_ERRORS` exactly, mirror regenerated.
+
+Side effect: `mcp/tools.py` builds project editor links from `account_locale_for()`, which reads
+the *cached* state. Because the lang-derived locale is deliberately not persisted, those links are
+unchanged by this branch — the earlier claim that they become "account-correct" was wrong and is
+retracted here rather than shipped.
+
+## Recorded as NOT verified rather than omitted
+
+- **The migrated path firing fast.** 72/72 navigations landed on the old host, so no migrated load
+  was available to time. The gate is proven by unit tests and A/B control, **not** by a live run.
+  The instrument is committed; the honest next step is a later flap or a run from the reporter's
+  permanently-migrated account.
+- **The achieved time-to-exit-36 on a real migrated run.** Unmeasured, and deliberately not
+  estimated. The design does not depend on it — the guard sits where the run already blocks.
+- **Driving the migrated frontend.** Still impossible. #639 stays open; this PR says `Refs`.
+- **A non-English profile recovering live.** `denon82` is cached `"pt"` (it genuinely redirects),
+  so the lang-recovery path was exercised live only on `en`. The `pt` case is unit-tested.
+- **The `en-GB` → `en` region reduction where region is load-bearing** (`zh-Hans`/`zh-Hant`).
+  Unchanged from v0.66.1, still only two locales observed.
+- **Full-suite coverage %.** The targeted suites ran without `--cov` (an unscoped `pytest --cov`
+  OOMs this machine); the 80% floor is enforced by CI.

{gflow_cli-0.66.0/website → gflow_cli-0.66.2}/docs/MCP.md

@@ -127,7 +127,13 @@ marks a transient failure a scheduler can re-run without operator intervention
 WAF/reCAPTCHA bounce (`WafRejectionError`), rate-limit (`RateLimitError`),
 transport timeout (`TransportTimeoutError`), network blip (`NetworkError`), a
 dropped browser session (`BrowserSessionClosedError`), a Flow web-app crash
-(`FlowAppError`), and an agentic-cohort flap (`FlowAgentUiError`). Everything
+(`FlowAppError`), an agentic-cohort flap (`FlowAgentUiError`), a page load served
+by the migrated `flow.google.com` frontend (`FlowHostMigratedError`,
+[#639](https://github.com/ffroliva/gflow-cli/issues/639) — the rollout flaps per
+page load, so a retry often lands the frontend gflow can drive), an unreachable
+UI arm (`UiModeUnavailableError`), and a partially-completed sync
+(`SyncPartialError`). That list is the whole of `errors.RETRYABLE_ERRORS`.
+Everything
 else (auth, content-policy, configuration, security) is terminal
 (`retryable: false`): retrying the identical request fails the same way. This
 flag is the **same shared classification** the CLI `--json` payload and the

{gflow_cli-0.66.0 → gflow_cli-0.66.2}/docs/PROJECT_STATUS.md

@@ -4,6 +4,70 @@
 
 ## Current release
 
+**v0.66.2 — alpha.** **The fast-fail v0.66.1 announced had never once fired, and the locale
+cache was answering a question nobody asked it.**
+
+v0.66.1 claimed exit 36 arrived in 0 ms on Google's migrated `flow.google.com` frontend
+([#639](https://github.com/ffroliva/gflow-cli/issues/639)). It did not. That number came from
+calling `get_ui_driver` **in isolation on a page already sitting on the migrated origin** — a
+state no real run ever reaches, because `project_editor_url` only ever builds a `labs.google`
+URL and the hop to the new origin is a *post-`goto`* redirect that neither settle path waits
+for. The guard read a pre-redirect URL and declined. The reporter measured the truth on three
+consecutive runs: **57.0 / 57.1 / 58.3 s**, through the slow selector-probe path, with the bail
+event absent from the timeline entirely.
+
+**Check the host where the run already blocks.** A shared `raise_if_migrated()` now runs at
+`get_ui_driver` entry, on every `detect_ui_mode` poll tick, in `_exit_agent_mode` once the media
+panel is found absent, and inside `mode_control`'s 8 s composer poll — the last of which was
+found by review after the first fix shipped, and covers both `--ui-mode agentic` and a redirect
+landing mid-`ensure_media_mode`. None of these adds a wait: `page.url` is a cached property and
+`flow_host_kind` is one parse plus a dict lookup. Three blanket `except Exception` handlers that
+would have demoted the abort to a warning now re-raise it.
+
+**Stop letting a `lang` attribute mean "this account redirects".** Two locale defects, both
+shipped in v0.66.1. `NOT_REDIRECTED` was an *absorbing* state: it returned before the only site
+of the `<html lang>` recovery, so the profiles #643 was written for could never use it. And the
+recovered locale was then recorded as evidence of a redirect — which it is not, since every
+account declares one — switching the URL settle back on permanently and costing the full 4 s
+`URL_SETTLE_TIMEOUT_MS` on every bootstrap of any non-redirecting account. Measured on a real
+profile: **7.41 s → 2.66 s**, locale still recovered
+([#643](https://github.com/ffroliva/gflow-cli/issues/643)).
+
+Two designs were rejected **by measurement**, not preference: a bounded settle (72/72
+navigations across two accounts showed no post-`goto` URL change at all, so the bound would be
+pure dead time), and caching "this profile is migrated" to navigate straight to
+`flow.google.com` (it would have locked both maintainer accounts out of a working frontend the
+day it shipped).
+
+Still not drivable — #639 stays open for that.
+
+Verification: [LIVE_VERIFICATION_v0.66.2](LIVE_VERIFICATION_v0.66.2.md). The old host is proven
+live at zero credits (**exit 0**, real 768x1376 JPEG, twice). **The migrated path is recorded as
+NOT verified**: the rollout flapped back mid-work and 72/72 navigations landed on `labs.google`,
+so the gate rests on unit tests and A/B controls, and **no time-to-exit-36 is claimed anywhere**.
+Given this release exists because a number was reported from the wrong entrypoint, inventing a
+replacement would have repeated the error.
+
+<details><summary>v0.66.1 — a fast-fail that never fired (superseded by v0.66.2)</summary>
+
+**v0.66.1 — alpha.** Intended to make the migrated-origin failure instant and to stop discarding
+a learned locale. **Both fixes were real but neither reached the path users take**, and this
+entry is kept to record that rather than to claim it.
+
+The `0 ms` exit 36 reported here was measured on `get_ui_driver` in isolation, on an
+already-migrated page; the CLI route was unchanged at ~57 s. The `<html lang>` locale recovery
+was likewise exercised directly, while the client returned before it on any profile cached
+`NOT_REDIRECTED`. v0.66.2 fixes both, and additionally a settle regression this release
+introduced. See the correction block at the top of
+[LIVE_VERIFICATION_v0.66.1](LIVE_VERIFICATION_v0.66.1.md).
+
+What did hold: `_check_logged_in` accepting the migrated host, and the old-host no-regression
+result (exit 0 with a real JPEG), which was the load-bearing evidence in that release.
+
+</details>
+
+<details><summary>v0.66.0 — naming Flow's flow.google.com migration</summary>
+
 **v0.66.0 — alpha.** **Google started moving Flow to a new domain, and gflow blamed its own
 selectors for it.**
 
@@ -42,6 +106,8 @@ Verification: [LIVE_VERIFICATION_v0.66.0](LIVE_VERIFICATION_v0.66.0.md) — prov
 `check_logged_in: true`, exit 36, `retryable: true`), with a credit-free `image t2i` on the
 old host minutes earlier completing exit 0 to prove no regression.
 
+</details>
+
 <details><summary>v0.65.0 — the referenceEntity guard that had never fired</summary>
 
 **v0.65.0 — alpha.** **A safety net that had never once fired, and two crashes that spent
@@ -485,6 +551,7 @@ reporter-verified e2e on macOS).
 
 | Milestone | Status |
 |---|---|
+| Migrated-origin runs fail instantly (0 ms) and keep their learned locale | ✅ done (v0.66.1) |
 | Flow `flow.google.com` migration named as its own retryable failure (exit 36) | ✅ done (v0.66.0) |
 | Repo scaffold, CI, license, README, disclaimer | ✅ done |
 | Auth login flow (one-time browser capture) | ✅ done |

{gflow_cli-0.66.0 → gflow_cli-0.66.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gflow-cli"
-version = "0.66.0"
+version = "0.66.2"
 description = "Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal."
 readme = "README.md"
 license = { file = "LICENSE" }