feat(recapture): record the Transaction Record and Bound TLS Details#1999

• X
• Mastodon
• Reddit
• LinkedIn

Reviewed commit: 54e5fcf65ffead2dec0aecab5c578fe2fa9de0c3 (base feat/1928-scroll-and-screenshot-record at 7d309557). Head re-read at the end of the review: unchanged.

Scope: the diff against a scratch merge of the base with origin/feat/1906-warc-writer (b4e11287) and origin/docs/1983-transaction-record-charset-spike (33ed5a01), built with git merge-tree (no worktree merge, so no rerere state). The plan conflicted in that merge; the head keeps every plan line the three branches added except the seven #1979 lines this step rewrote on purpose (the marker text).

Failure scenario for 1: a page runs while (true) await Promise.all(Array(50).fill().map(() => fetch('/x?' + Math.random()))). Measured with a standalone Electron 44.9.1 script that held events as the recorder does: about 14,500 requests and 87,692 to 89,173 Network events in 10 s, mean 2,216 bytes of JSON per event, heap +58 to 100 MB. The load, idle and scroll phases can run 85 s, then the collector builds an exchange per request and the writer serializes two records each, all in the app's main process, which also runs every Case and sync. A remote server with HTTP/2 can go faster than this loopback run.

Failure scenario for 2: a page posts a 9,000,000-byte body twenty times in sequence. Measured with the recorder's fetch-then-check logic: 180 MB delivered into the main process, 45 MB kept, 135 MB fetched past the cap and dropped, peak RSS +93 MB. With sixty concurrent posts Chromium itself held only five bodies per session (45 MB delivered, RSS +158 MB), but each frame and worker session has its own store. Fix: stop sending the command once the cap is reached, and reserve before sending where a length is known.

Item 1, the test certificate allowance. Holds. testCertificateAllowance() (src/main/services/testCertificateAllowance.ts:31-37) returns null unless app.isPackaged === false and BIRDBRAIN_E2E_TRUST_CERT_SHA256 is set, the same gate as CE-2's switch (src/main/services/localAddressPolicy.ts:14). isPackaged is false only under Electron's own executable; package.json sets no executableName override, so the packaged binary is birdbrain. Nothing in src/ writes process.env (searched for assignments), and the only caller is the render (backgroundRenderer.ts:621-622), so no setting or IPC reaches it. When installed it sits on the render's fresh in-memory partition (recapture-<uuid>, backgroundRenderer.ts:526), accepts only the leaf whose DER SHA-256 equals the pin, and returns -3 (Chromium's own verdict) for every other certificate, so even a development build with the switch set checks every other certificate normally. Tests: tests/main/services/testCertificateAllowance.test.ts:36-53, tests/main/services/backgroundRenderer.test.ts:1294-1314, and the e2e refusal without the switch (spec:629, passed here).

Item 2, credential values. Holds. The writer replaces every line of the four names, case-insensitively, in whichever header map it writes (ExtraInfo or plain) for requests, responses and redirect hops (src/packages/transaction-record/lib/write.ts:59-70, :137, :165; redirect hops take their response from collect.ts:167). The collector copies only headers from ExtraInfo events (collect.ts:277, :280-281), so associatedCookies, blockedCookies and exemptedCookies never reach an exchange; raw events stay in memory and are never serialized, and the log gets only the error. All sessions share that path. The stored e2e record holds 19 Cookie: [value replaced by Birdbrain] lines, one set-cookie line, and no COOKIE-SECRET-1929. The fixture's cookie is for 127.0.0.1, so the frame session (localhost) carried none; page, page worker and service worker sessions did.

Item 3, the spike rulings. Page: Network.enable, then Network.configureDurableMessages, then Target.setAutoAttach, each awaited up to 5 s (transactionRecorder.ts:268-283), as Recommendation 1 and D17 item 1 ask. Frame or dedicated worker: the three sent together, resumed once all answer or 2 s pass (:153-173). Service worker: the three, then the resume at once (:166). Recorded only when all answered (:169-170, :277-282). A text body is kept only if the session that reported loadingFinished answered the durable command; a base64 body from any session (collect.ts:145-154). Per-resource limit: no fetch when the summed dataLength exceeds 10,000,000 (:180), and a returned body over it is dropped (:192). The marker and its warcinfo sentence are gone (write.ts; absent from the stored record). Can a session whose command failed still contribute a re-encoded text body? Not on any measured path: its text bodies become body-omitted, and its base64 bodies are the served bytes (spike, Question 1). Two corners measurement has not excluded: finding 8, and a service worker resumed together with its commands, which counts durable if the command answered even if an early body predated it; the spike's service worker fetches of Shift_JIS and windows-1252 bodies returned the served bytes.

Item 4, facts for the maintainer.

(a) inFlight widened. collect.ts:99 now makes a request in-flight when loadingFinished arrived with no responseReceived. D4 (plan, The inventory) defines inFlight as neither loadingFinished nor loadingFailed arrived by the time collection stopped; the plan now notes the widening as awaiting a ruling. Seen once on the fixture: the service worker's own main script on its own session. Before the change the collector called it body-omitted, the writer threw for want of a response, and the whole record was failed. Consequences: the record holds a request record and no response for a script the server sent in full, so the worker's code is not in the record while its own fetches are; the signed count no longer separates "still loading when the capture was taken" from "finished but reported no response"; and the rule applies to any request reported that way, not only service worker scripts. The schema's closed set has no other state for it, so a separate count is a schema step. The validation record also notes the fixture's install fetch was changed to read its body, because a fetch that reports data and no loadingFinished counts inFlight too.

(b) The extra history entry. backgroundRenderer.ts:647 loads about:blank before the target because Network.enable gets no answer on a window that has not navigated. The page then reads history.length 2 where a direct visit reads 1 (probe run here: off 1, on 2, exit 0). Every background Capture from this build on differs from earlier builds in this page-visible fact, and nothing in the signed entry records it beyond toolVersion; a page that branches on history length can render differently, and the stored files show that state. features.mdx, the validation record and the probe's expected output state it. The renderer spike (Rulings this asks for, item 2) lists three choices: location.replace from the blank page (target reads 1, but the main document request carries Sec-Fetch-Site: cross-site instead of none); wc.navigationHistory.clear() after commit (keeps none, but the page reads 2 at parse, DOMContentLoaded and load); or keep wc.loadURL and record the limitation, which this build does.

(c) The reserve. The 120 s timeout (recapture.ts:75) is unchanged; the end reserve is 20 s artifacts + 5 s body fetches + 10 s writer = 35 s (backgroundRenderer.ts:37-47), so load, idle waits and Scroll-to-load share at most 85 s, down from 100 s, less the new page setup, which can take up to 15 s when the page's three setup commands do not answer. Scroll-to-load keeps its own 75 s cap, so a slow page reaches the time limit up to 15 s sooner; its signed Scroll-to-load record says how the phase ended, so the entry stays true, but the files can hold less lazy-loaded content. The two phase bounds are fixed: if the screenshot and MHTML take more than their 20 s share, a slow record phase carries the render past 120 s and nothing is stored, rather than storing with the record failed. Measured headroom (validation record): the writer took 1,397 ms at the 50 MB cap. The plan's Time item authorises raising the reserve; finding 6 says no test pins it.

Item 5. Strict schema: the stored e2e entries verify (verified for the main and TLS pages here), and the captureLifecycle tests parse; finding 5 is the gap. Ruling E: page Network.enable failing or silent gives an absent failed record and not-recorded (backgroundRenderer.ts:716-733, transactionRecordFields in recapture.ts); a body fetch that never settles fails the 5 s collect bound (transactionRecorder.ts:289) and a writer that throws or runs past 10 s (:366-370) both return failed (:382-384), and the Capture stores. A body fetch that rejects leaves that body omitted and the record present, as D17 item 6 has it. D17's counts are true on every path traced (page, frame, dedicated worker, service worker, other types, attaches after the stop); a child whose answers land after collection counts unrecorded, the safe direction, which the validation record states. The widened inFlight (4a) is the one count that departs from D4's text.

Item 6, Duplicates. Confirmed. D11: "It writes no boundTls and no boundTlsAbsent". The Duplicate's entry re-anchors inventory, scrollToLoad, transactionRecordHash and pdfHash with no Bound TLS fields (captureLifecycle.ts:1694-1703), its row mirrors transactionRecordHash only (:1747-1749), and the copied record is re-checked against the source hash first (:1638-1643).

Item 7, memory. Response bodies are bounded: four thirds of the summed dataLength, rounded up to four, is reserved before each Network.getResponseBody, and no fetch is sent past 50,000,000 (transactionRecorder.ts:178-206). In my runs dataLength equalled the served length for http, blob:, data: and cached loads, so the estimate held. Request bodies and events are not bounded (findings 1 and 2), so yes, a page can push the main process past the cap.

Item 8, warcio check. warcio 1.8.1 through uv, on the main fixture record the e2e stored (33,458 bytes, 30 requests, 24 responses, one warcinfo):

The TLS, proxy and child-stub records each gave no output and exit 0 too.

Diff coverage. node scripts/diff-coverage.mjs --base origin/feat/1928-scroll-and-screenshot-record: 307 of 315 changed lines (97.46%), pass. Split against the scratch merge: 179 lines are this step's own, 177 covered (98.9%; misses transactionRecorder.ts:217, :327); 136 (43%) are #1979's, 130 covered, all six misses in lib/warcReader.ts (28-30, 36, 62, 116), #1979's test reader, which this step moved from the package's tests into lib/, where it is scored for the first time. Against origin/main: 531 of 539 (98.52%), as the PR body says.

CI at head. Green: lint, typecheck, build, test, e2e, docs-build, Test reliability and the rest. merge-gate fails with "evidence-affecting with no sign-off at head", which is the maintainer's step. Test reliability: 40 of 266 mutation sites probed, 5 survived (backgroundRenderer.ts:47; transactionRecorder.ts:192, :213, :327; lib/warcReader.ts:30); 10 touched tests pass with the source reverted (nine collector tests, one recapture test), each an earlier test given the new inputs, none claiming this step's behaviour.

Evidence gate. evidence-affecting is on the PR and on #1929. Evidence impact is substantive. The known-answer test is extended: the writer pins sha256:f92b1f90c50a0068a6c9dfce9c853e9333a8337b6475fab8a4393f1b1fccd319, which I recomputed as the SHA-256 of the windows-1252 bytes 3c703e636166e93c2f703e, and the collector tests exercise the durable rule. No verifier, schema or package-layout code changes against the scratch merge; the full suite (frozen digests included) passed.

Completion controls. Attribution: the body ends with the maintainer's byline, which the PR body check accepts (exit 0). No Co-authored-by on any of the 22 commits. Auto-merge: null.

Commands run (exit codes).

• pnpm build:test-sharp 0, pnpm lint 0, pnpm typecheck 0, pnpm build 0
• BIRDBRAIN_TEST_SYSTEM_SHARP=1 BIRDBRAIN_REQUIRE_OPENSSL=1 BIRDBRAIN_REQUIRE_JQ=1 pnpm test:coverage 0: 482 files passed, 2 skipped; 8,119 tests passed, 24 skipped
• node scripts/diff-coverage.mjs --base origin/feat/1928-scroll-and-screenshot-record 0; pnpm coverage:diff 0
• xvfb-run -a npx playwright test e2e/recapture-transaction-record.spec.ts e2e/recapture.spec.ts e2e/recapture-consent.spec.ts 0 (11 passed), then the first spec again 0 (6 passed), keeping each stored record
• xvfb-run --auto-servernum node scripts/capture-probe/run.mjs 0, output as the header expects
• uvx --from warcio warcio check 0 on four records
• .claude/skills/post-pr-body/scripts/check.sh on the PR body 0
• Five standalone Electron 44.9.1 scripts under xvfb-run, outside the repository: event volume, post data (concurrent and sequential), non-UTF-8 request bodies, dataLength for blob, data and cached loads, and a stapled SCT; each exit 0

Not checked. Windows and macOS; HTTP/2, HTTP/3 or a remote server; the SCT path with a publicly trusted certificate; Vale, format and package boundaries locally (CI's docs-build and lint passed).

Ruling 1: #1978 at 083dba1b (schema, plan D4 and D8, glossary); this pull request's fix round writes it. Rulings 2 and 3: this pull request's fix round. The run log is docs/plans/2026-10-26-capture-engine-programme-run.md.

e72fe128 (findings 1, 2, 5, 8 and 10), 3b23deec (findings 1, 9 and 11), baeaad78, 7c06ca3f, c1c50096 and 50f9a359 (findings 3, 8 and 11), 74d1558c (findings 4 and 6), 8abac6bf (finding 7)

Reviewed commit: 11fcd9c2d2647dfd36f28f894757d60158cc0226 (delta from 54e5fcf65ffead2dec0aecab5c578fe2fa9de0c3; base feat/1928-scroll-and-screenshot-record, at 8c61fd85 when read). Head re-read at the end of the review: unchanged.

Scope of this round: the seven own commits baeaad78, e72fe128, 74d1558c, 8abac6bf, c1c50096, 3b23deec and 50f9a359, plus the conflict resolutions of the merges 7c06ca3f and 11fcd9c2 (git show --remerge-diff). Both resolutions keep the step 9 text and take #1978's finishedWithoutResponse definitions; nothing was dropped.

Corrected wording.

• 1: replace "a finished request with no response counts as in flight" with "a request the browser reported finished with no response gets its own finishedWithoutResponse count, which the entry signs".
• 2: either run the step's e2e on Electron 45.0.0 and record it, or add to the body's Summary and the plan's step 9 "Text bodies" item: "The charset spike ran on Electron 44.9.1, and this branch's base still pins it, so the re-check of Network.configureDurableMessages on Electron 45.0.0 that the ruling asks for is left to the point this stack takes main; this step's e2e known answers for windows-1252 and Shift_JIS bodies are where a change would fail."
• 3: in the validation record's step 9 limitation, write "A page that makes more requests than the event bound holds, such as one fetching in a loop, or that uploads about 11 MB in one body while it loads (the browser puts each upload in its event twice), gets no Transaction Record at all". Make the same change in features.mdx ("because the page made more requests, or larger uploads, than the record holds") and in the Evidence impact bullet ("more network events, or larger uploads, than the bound"). Sending maxPostDataSize with Network.enable is the alternative: with maxPostDataSize: 1 the event carried neither copy in my run. That changes what the collector's multipart path reads, though, so it needs its own tests.

Rulings of #1988 on main, against this branch.

The body states three of these (text bodies, per-file limit, marker) and does not claim the other three. Nothing in the body or plan contradicts a ruling. A trial merge with main conflicts in CONTEXT.md, the plan and the spike page, all docs.

My Electron 45 check (the cached official electron-v45.0.0-linux-x64.zip, Chromium 156.0.8078.48, standalone script under xvfb-run). The page loaded about:blank, then received Network.enable with the recorder's limits, then the target, which fetched windows-1252, Shift_JIS and UTF-8 bodies and framed a windows-1252 document. Without durable messages the windows-1252 fetch, the Shift_JIS fetch and the frame came back as UTF-8 text that did not match the served bytes. With durable messages answered, all four returned the served bytes (the three non-UTF-8 ones as base64). Electron 44.9.1 gave the same. This is narrower than the spike's 23 responses and is not the e2e run.

Earlier blockers, each fix mutated (unit tests of the touched file).

Round-1 items 7 (probe), 9 (test title), 10 (coverage) and 11 (limitations) are applied as the dispositions say. The probe's on pass now sends the three commands and its run here printed "No difference beyond the about:blank history entry." For the e2e request bodies, warcio check was not re-run this round.

Evidence gate. evidence-affecting is on the PR and on #1929. The delta touches blocking-tier paths (backgroundRenderer.ts, recapture.ts, transactionRecorder.ts, src/packages/transaction-record/**, db/captureRepo.ts). The Evidence impact section is substantive, apart from finding 3's understatement. Known-answer coverage of c1c50096: the recorder test pins the full inventory part including finishedWithoutResponse: 0 and a case signing 1. The e2e pins finishedWithoutResponse: 1 and inFlight: 1 in the stored entry, which then verifies. Backward verification: against the base there is no change to src/shared/schemas.ts, src/shared/verify/** or manifest.ts. The field and its schema tests come from #1978 through the base, and the schema-6 tests pass here (39 and 5). Schema 6 is unreleased, so no stored entry is reinterpreted.

CI at head (gh pr checks 1999). Green: lint, typecheck, build, test, e2e, docs-build, Test reliability (probe), adr-numbers, hunks, label, security jobs. merge-gate fails for the missing sign-off, as expected. agent/pre-pass is pending (this review). Diff coverage in the test job: 357 of 363 changed lines (98.35%) against the base. The six misses are lib/warcReader.ts 28-30, 36, 62, 116, unchanged from round 1. Test reliability: 4 of 40 sites survived. :135 is an equivalent mutant (a falsy return in answered). :202 is finding 6. collect.ts:311 predates this delta. warcReader.ts:30 also predates it. 42 touched tests pass with the source reverted, all older collector tests or negative recapture cases; my placement mutant shows the latter catch a misplaced notice.

Completion controls. Body ends with the maintainer's byline, .claude/skills/post-pr-body/scripts/check.sh exit 0. No Co-authored-by in the 31 commits ahead of the base. Auto-merge null.

Commands run (exit codes). Scratch worktree at head, Node 20 via mise, BIRDBRAIN_TEST_SYSTEM_SHARP=1.

• scripts/setup-worktree.sh 0; env -u PKG_CONFIG_PATH pnpm build:test-sharp 0; pnpm build 0
• pnpm test per file, each 0: transactionRecorder (50), recapture (40), backgroundRenderer (65), collector (62), writer (38), manifestSchema6 (39), manifestSchema6TooOld (5), captureLifecycle (121)
• 18 mutants (the table, plus a second run of the collector-check mutant against the recorder tests), each reverted with git checkout
• xvfb-run -a npx playwright test e2e/recapture-transaction-record.spec.ts: 6 passed; the known-answers test failed once in fixture setup (the app's first window did not open within 30 s, before any test code) and passed on rerun alone, 0
• xvfb-run --auto-servernum node scripts/capture-probe/run.mjs 0
• git merge-tree --write-tree with the base: 1 conflict; with main at a0d938b1: 3 doc conflicts
• Standalone Electron scripts outside the repo, 44.9.1 and 45.0.0, each 0: upload event shapes (9 MB and 11 MB, bytes, string, Blob, FormData; with and without maxPostDataSize), durable bodies, service-worker page copies

Not checked. The full suite with coverage locally; I used CI's test job. The e2e spec on Electron 45, which needs the app rebuilt against it. warcio check this round. Windows and macOS. HTTP/2 or a remote server.

Reviewed commit: 11fcd9c2d2647dfd36f28f894757d60158cc0226

Scope: the reviewer reviewed the PR's own changes over its stack, git diff f7a6b98f 11fcd9c2, where f7a6b98f is in #1996's head f56233be, and the writer against #1979's head 93b5e0e5. CI at this sha has no failing or pending check.

Failure scenario for 1: the reviewer ran Electron 44.9.1 under xvfb-run. Page /a loads, then sets location.href to /nocontent (204) or /dl (sent as an attachment). The window stays on /a with title A. The second request reports a response and then loadingFailed with net::ERR_ABORTED, canceled: true. Fed through collectExchanges and boundTlsOf in a temporary test, since deleted, mainDocument was the cancelled request. With https URLs and per-host securityDetails, the signed result was boundTls.subjectName: other.example for a capture of shown.example. collector.test.ts:972-1014 covers only a last document that committed. One possible fix is to pick the committed document, or to exclude cancelled, failed and in-flight, and pin both with tests.

Evidence gate: the PR and #1929 both carry evidence-affecting. Blocking-tier paths touched are backgroundRenderer.ts, recapture.ts, captureLifecycle.ts, db/captureRepo.ts, src/packages/transaction-record/**, and the two new tier rows. The Evidence impact section is substantive, but finding 1 makes its Bound TLS description inaccurate. The known-answer tests cover the body path; none covers which response the Bound TLS Details come from. The PR's own changes leave schemas.ts, src/shared/verify/**, manifest.ts and the layout package untouched, and the verify tests pass (472 passed, 21 skipped).

Verify loop (Ubuntu runner, Node 20.20.2, scratch worktree at the sha): pnpm lint, pnpm typecheck, pnpm build, pnpm test:coverage (8149 passed, 24 skipped), pnpm coverage:diff (98.98%, 583 of 589 changed lines) and pnpm lint:boundaries all exit 0.

Completion controls: no Co-authored-by trailer in the 76 commits; the body passes check.sh --any-author; auto-merge is off.

Not checked: the e2e specs locally and on Electron 45, whether a response can finish without Network.dataReceived (which would skip the body reservation), warcio check, and Vale on the changed lines.

• 1 and 2: 217de821 (replacedThePage in src/packages/transaction-record/lib/collect.ts; tests in collector.test.ts, tests/main/services/transactionRecorder.test.ts and e2e/recapture-transaction-record.spec.ts; CONTEXT.md, features.mdx and the validation record's step 9 Deviations table). The e2e test failed on a build of the earlier collect.ts (entry.boundTls undefined) and passed on the fixed build.
• 4: f75d9c92 merges origin/feat/1928-scroll-and-screenshot-record at c2d35f66, which holds origin/main at 2d5f1594 with electron ^45.0.0; merging origin/main afterwards was already up to date. Re-check: cfb36527, Electron 45.0.0, Chromium 156.0.8078.48, e2e/recapture-transaction-record.spec.ts 8 passed under xvfb-run.
• 5: 5c24394b. Measured on Electron 45.0.0 with the recorder's Network.enable limits: an 11,000,000-byte upload made a 25,667,678-character event, a 6,000,000-byte one 14,001,007.
• Reviewed commit 11fcd9c2; new head a46cd9b6.
• 3, 6 and 9: the PR body at a46cd9b6.
• 7: withinMs in src/main/services/transactionRecorder.ts races the work against a timer and never cancels it.
• 8: release() clears responseBodies, and collect() throws on overflow before reading it; answered()'s callers use its result only in if conditions.

• Reviewed commit 11fcd9c2; new head a46cd9b6.
• 1 and 8: the PR body at a46cd9b6.
• 2: cfb36527 (plan, charset spike and validation record).
• 3: 5c24394b.
• 4: f75d9c92.
• 5: 604e086d (keys each response body by its session, so a body that returns later replaces none in tests/main/services/transactionRecorder.test.ts; it fails with bodyKey returning the request id alone).
• 9: a46cd9b6 (scripts/capture-probe/run.mjs).

Reviewed commit: a46cd9b63068e6c43c033cf11298a8e8d2efc2a2

Head re-read at the end: unchanged; auto-merge null. Previous agent review: 11fcd9c2. The delta has executable changes (217de821 in collect.ts, and the merge f75d9c92), so this is a full round. Scope read: git diff origin/main...a46cd9b6 (37 files, which includes the unmerged #1996 at c2d35f66), with attention on git diff c2d35f66 a46cd9b6 (this PR's own 33 files) and git show --remerge-diff f75d9c92.

Failure scenario for 1 and 2, measured with a standalone Electron 45.0.0 script under xvfb-run (in /tmp, deleted afterwards). The script mirrors the render: it loads about:blank, sends Network.enable, then loads http://127.0.0.1:<port>/target, which calls history.back() 300 ms after load. After 3 s wc.getURL() was about:blank, the title about:blank and history length 2. The only Document events were the target's requestWillBeSent and responseReceived. A target that sets location.href = 'about:blank' gave the same result (no Network event, window on about:blank). An A to B to history.back() sequence does send a request (served from cache), so it is not affected.

From there, by code trace (the app was not run end to end): replacedThePage picks the target, and boundTlsOf signs its securityDetails. recapture.ts:206 does not refuse about:blank, because localAddress.ts:88 returns false for a non-http protocol. recapture.ts:232-235 stores the Capture with url: 'about:blank' and the target's Bound TLS Details beside a blank screenshot and MHTML.

The history.back() path exists only because this PR loads about:blank first. Before it, the call had no entry to go back to. One possible fix is to compare the chosen document with the URL the window committed (did-navigate, or Page.frameNavigated's loaderId) and record boundTlsAbsent on a mismatch, with a collector or recorder test for each case.

Verified fixed from the last round:

• Cancelled, never-answered and superseded navigations are excluded. I ran mutants on collect.ts: dropping state !== 'cancelled' fails 2 tests, dropping || failure !== undefined fails 1, and && to || on the frame test fails 5.
• Body keys by session are pinned (604e086d).
• The 11 MB upload is now named in the validation record and the features page.
• The Electron 45 re-check is recorded. The e2e spec has 8 tests (spec lines 408-780), and the KAT asserts recordedTargets: 5 (line 455).
• The merge f75d9c92 resolutions keep this branch's writer (marker removed) and both sides of the validation record. Nothing was dropped.

Evidence gate:

• PR labels are evidence-affecting, agent-authored, review:stale and size:XXL. #1929 carries evidence-affecting.
• Blocking-tier paths touched: backgroundRenderer.ts, recapture.ts, captureLifecycle.ts, db/captureRepo.ts, reportHtml.ts, src/packages/transaction-record/**, and the two new rows (transactionRecorder.ts, testCertificateAllowance.ts).
• Advisory tier, src/shared/types.ts: the diff adds two log codes. Not evidentiary.
• Advisory tier, src/shared/constants.ts: the diff adds the Transaction Record budget constants. These reach the signed inventory.transactionRecord.budget, which the label already covers.
• The Evidence impact section is substantive. Its Bound TLS sentence is inaccurate for finding 1.
• KATs cover body bytes and digests, and the shown page after an empty-answer navigation (e2e line 717). None covers a non-network final navigation.
• Backward verification: git diff --name-only c2d35f66 a46cd9b6 names no verifier, schema, manifest or layout file, and the full suite (frozen digests included) passes.
• merge-gate fails only on "evidence-affecting with no sign-off at head", which is expected.

Verify loop: Linux runner, Node 20.20.2, scratch worktree at the sha (closed with teardown.sh close).

• pnpm lint, pnpm typecheck and pnpm build: exit 0.
• BIRDBRAIN_REQUIRE_OPENSSL=1 BIRDBRAIN_REQUIRE_JQ=1 pnpm test:coverage: exit 0, 8477 passed and 25 skipped, matching the PR body.
• pnpm coverage:diff: exit 0, 98.25% (336 of 342 lines). The uncovered lines are in the test-only warcReader.ts (28-30, 36, 62, 116).
• CI: every required check is green at the sha. The probe job (Test reliability) succeeded.

Completion controls:

• No Co-authored-by in git log origin/main..a46cd9b6.
• The body ends with the maintainer's Created with byline. Both check.sh --any-author and check.sh exit 0.
• auto_merge is null.

Not checked:

• Vale on the changed lines, because Vale is not installed on this runner. Preflight and CI docs-build report a pass.
• The e2e specs locally. CI e2e is green.
• warcio check was not run.
• Finding 4's race.
• Shell semantics: none needed. The tool shell here is bash, and the setup and teardown scripts ran under bash.

• Answers issue comment 6512333121 (verdict at a46cd9b6, items 1 to 5 above) and 6515710817 (maintainer rulings: ruling 1 is item 1, ruling 2 is item 3).
• New head: 4e18f025. 41650c09 merges origin/main at a6e392f2 with no conflicts.
• 1, 2 and 4: 4e18f025. boundTlsOf in src/main/services/transactionRecorder.ts compares the main document's URL, without the fragment, with the URL of the window's last did-navigate, which backgroundRenderer.ts passes as committedUrl; a mismatch gives boundTlsAbsent: 'not-reported', an existing value, so the schema is unchanged.
• Measured on Electron 45.0.0 under xvfb-run, in a standalone script outside the repository: history.back() to the blank first page and location.href = 'about:blank' each sent no Network event and reported did-navigate with about:blank; a page loaded as /normal#frag reported did-navigate with the fragment while the debugger's URL had none; history.pushState reported only did-navigate-in-page; a 204 and an attachment reported no did-navigate and ended loadingFailed canceled true.
• Tests: in tests/main/services/transactionRecorder.test.ts, the two blank-page cases, the open download and a boundTlsOf case fail with the comparison removed, and the kept-details case fails when the fragment is kept; the renderer test states the details absent when the page ends on the blank page it went back to fails with the comparison removed; the two e2e tests in e2e/recapture-transaction-record.spec.ts (/then-back, /then-blank) failed on a build without the comparison, with boundTls signed beside url: about:blank, and pass on the fixed build.
• 5, rechecked at a46cd9b6: transactionRecorder.ts:368 drops overflow from the listener's guard, after which hold() still refuses every held event and collect() throws on the overflow; :205 is held = 0 in release(), read only by fetch accounting after the overflow; warcReader.ts:30 is in the reader whose entry point says only tests import it, which grep confirms (the package tests and the e2e spec); backgroundRenderer.ts:362 blames to 6d0cc9c1, which is in #1996 at c2d35f66 and not in main.

Reviewed commit: 4e18f02521cb44ef57489126d5500bfb42149cc1 (round 3; previous review at a46cd9b6, verdict 6512333121).

Head re-read at the end: 4e18f02521cb44ef57489126d5500bfb42149cc1, unchanged. Auto-merge null.

Scope read: git diff a46cd9b6..4e18f025 less the main merge. The merge 41650c09 brings in exactly the 9 files git diff 2d5f1594 a6e392f2 names (command palette and sharing label), none of which the branch touches, and each is byte-identical to a6e392f2 at 41650c09. The fix commit 4e18f025 changes 9 files: transactionRecorder.ts, backgroundRenderer.ts, collect.ts (comment only), two unit test files, the e2e spec, CONTEXT.md, features.mdx and the validation record.

Failure scenario for 1: the e2e case /then-back (spec lines 753-772). The https target loads over the test certificate, so the browser reports securityDetails on its response, then the page calls history.back(). The entry is stored under about:blank with boundTlsAbsent: 'not-reported', and the report for that Capture (reportHtml.ts:1849) prints "The manifest entry records no Bound TLS Details: the browser reported no security details on the response for the main document." Before this round the same page signed those details (last round's finding 1), so the browser did report them. The same text appears for the download whose cancel arrives after collection stops (transactionRecorder.test.ts, "states the details absent, not the later answer..."), where the page shown had its own reported details. CONTEXT.md:106 lists "when the browser reported none" and "when the window ends on a page no recorded request produced" as separate reasons, but both map to one value, and the plan (docs/plans/2026-10-10-capture-engine-first-slice.md:450) defines not-reported as the first only.

Corrected wording for 1, which keeps the signed schema and the released verifier's accepted values unchanged: 'not-reported': 'the browser reported no security details on the response for the main document, or the window ended on a page that response did not load', with tests/main/services/reportCaptureEngine.test.ts:347 updated to match. A new absence value would separate the two causes in the signed entry, but z.enum(BOUND_TLS_ABSENCES) at src/shared/schemas.ts:674 is strict, so an earlier verifier would reject it; that choice is the maintainer's.

Summary (the squash commit body): no sentence is false at this head. The sentence "The capture's signed record gains the archive's hash, counts of what the archive lacks, and the browser's summary of the secure connection of the page the capture shows, or the reason it has none" stays correct once finding 1's report text is fixed; no wording change is needed. The Evidence impact section's Bound TLS sentence ("only when that document's URL, without the fragment, is the URL the window last committed; otherwise boundTlsAbsent is not-reported") matches transactionRecorder.ts:450-464. The claim of five Bound TLS e2e tests matches spec lines 640-780.

Last round's blocking finding, verified fixed by mutation (Node 20.20.2, BIRDBRAIN_TEST_SYSTEM_SHARP=1):

• At head: transactionRecorder.test.ts 57 passed, backgroundRenderer.test.ts 78 passed, both exit 0.
• Comparison removed (|| url.href !== committed.href deleted): 4 recorder tests fail (both blank-page cases, the open download, the boundTlsOf mismatch case) and the renderer test "states the details absent when the page ends on the blank page it went back to" fails.
• Fragment kept (parsed.hash = '' removed): "signs the details of a page the window stays on, whatever fragment it committed with" fails.
• Renderer passes the target URL instead of the did-navigate URL: the renderer blank-page test fails.
• The e2e tests /then-back and /then-blank were not run locally; CI e2e covers them.

Checks the brief asked for:

• Fragment stripping: documentUrl (transactionRecorder.ts:433-441) parses with WHATWG URL and clears hash on both sides, so #frag and a bare # both compare equal to the CDP URL, which carries no fragment.
• Same-document navigation: did-navigate (backgroundRenderer.ts:641) is the only writer of committedUrl. Electron does not emit it for in-page navigations (the implementer's Electron 45.0.0 measurement agrees), so pushState keeps the details. Finding 2 is the missing pin.
• Redirect: the collector's main document is the last hop of the chain (collect.ts:316-326), whose response URL is the final URL, the same URL did-navigate reports. A fragment carried across the redirect is stripped. By code trace, not run.
• Normalisation: both strings are Chromium canonical URLs and both pass through WHATWG URL before comparing. A Node 20 check gave equal results for https://Example.COM:443 against https://example.com/, bücher.example against xn--bcher-kva.example, and x# against x. A trailing slash on a non-root path compares unequal, which is correct, since the server treats it as a different resource and a redirect between them makes the final URL the one compared.
• Reuse of not-reported: finding 1.

Maintainer rulings (comment 6515710817):

• Ruling 1 is applied as written. The mismatch records the details absent, about:blank still loads first (backgroundRenderer.ts:658), and each case has a recorder test and an e2e test, plus a renderer test for going back.
• Ruling 2 is applied as written. git diff a46cd9b6 4e18f025 -- src/main/services/transactionRecorder.ts touches only documentUrl, boundTlsOf and the committedUrl option, and withinMs is unchanged.

Bot findings: CodeRabbit's only comment (6430027103) says the draft was not reviewed. There are no reviews and no inline comments (--paginate over pulls/1999/reviews and pulls/1999/comments returned 0 each).

Evidence gate:

• PR labels: evidence-affecting, agent-authored, review:changes, size:XXL. #1929 carries evidence-affecting.
• This round touches the blocking-tier backgroundRenderer.ts, transactionRecorder.ts and src/packages/transaction-record/**, all covered by the label.
• The Evidence impact section is updated for this round and is substantive.
• Known answer: the e2e spec pins both blank-page cases against a generated certificate.
• Backward verification: git diff --name-only c2d35f66 4e18f025 names no verifier, schema or manifest file, and the absence enum is unchanged, so older entries read as before.

Verification:

• CI at 4e18f025: test (7m36s), lint, typecheck, build, docs-build, changes, hunks, adr-numbers, the secret scan and the dependency audit pass. e2e (9m38s) and probe (Test reliability, 10m51s) pass. merge-gate fails only on "evidence-affecting with no sign-off at head", which is expected.
• The probe's 4 surviving mutants are not on this round's lines. transactionRecorder.ts:219 (return false to true after the event bound is hit, from e72fe128) leaves the record failed either way, because release() has set overflow and cleared the events; the other three are in the test-only warcReader.ts. The 45 revert survivors are the collector, lifecycle, recapture and report tests listed last round, edited for fixture shape.
• Locally I ran only the two touched unit test files and the mutations above. The full coverage suite, the build and preflight were left to CI at this sha.
• Trial merge of 4e18f025 with origin/main at 32cf7983 (the 1.0.1-beta.24 release bump): clean, and only package.json changes.

Completion controls:

• No Co-authored-by in git log origin/main..4e18f025.
• The body ends with the Created with byline, and post-pr-body/scripts/check.sh exits 0.
• auto_merge is null.

Not checked:

• The e2e spec locally.
• Back-forward cache restores in the hidden window.
• A target URL with embedded credentials, where the two URL sources might differ.
• Vale on this round's doc changes, because CI docs-build and the PR's preflight cover it.

• Finding 1, applied in 3987f069: BOUND_TLS_ABSENCE_TEXT['not-reported'] and its test in tests/main/services/reportCaptureEngine.test.ts (41 passed). pnpm preflight at 3987f069: exit 0, 8490 passed, 25 skipped, diff coverage 98.30% of 352 lines.
• Findings 2 and 3: advisory, not applied, for the reasons above.

Reviewed commit: 3987f069bbe8de48459450842cb53e8783ab9915

Reviewed commit: 3987f069bbe8de48459450842cb53e8783ab9915 (PR #1999, feat/1929-record-transaction-record). I re-read the head at the end and it is still 3987f069, so it did not move.

What I reviewed against. The PR is stacked on #1996, which is still open (its head is c2d35f66). Diffing against origin/main therefore pulls in #1996's own changes too (18 files). I reviewed this PR's own change as c2d35f66..3987f069, which is the #1996 head plus the main merge at a6e392f2. I only skimmed #1996's content; its own review covers it. Current origin/main (db87600c) merges cleanly with the head (git merge-tree exit 0).

Findings

Correctness traces (no defect found)

• Bound TLS rule. boundTlsOf (transactionRecorder.ts:448-464) signs details only when the main document's URL, without its fragment, equals the URL from the window's last did-navigate (backgroundRenderer.ts:640-644). Every mismatch I traced gives not-reported, never another page's details: back-forward cache, prerender, a cancelled navigation still open at stop, and going back to about:blank. I removed the comparison and four recorder tests failed, so the PR's claim holds.
• Main document choice. collect.ts:313-329 ignores cancelled navigations and navigations with neither a response nor a failure.
• Body keys and text bodies. Bodies are keyed by session in both the recorder (:169, :400-403) and the collector (collect.ts:148-163), and they agree. A text body is kept only from a session whose durable-messages command answered.
• Overflow. On overflow everything held is released (:199-207), every later event returns early, later targets are resumed, and collect() throws, so the record is failed.
• Ingest. It writes {id}.warc.gz inside the store callback, and the existing deleteArtifacts on the failure path covers that file. Only recapture.ts:243 passes captureId, and it is a fresh randomUUID(). The other ingest callers build their parameters explicitly.
• Duplicate. It copies and hash-checks the record (captureLifecycle.ts:1638-1644), so the CONTEXT.md claim "copies its Transaction Record" is true. Export includes the record when its hash is signed (export.ts:1591-1596).
• Test certificate switch. testCertificateAllowance returns null unless app.isPackaged === false and the switch is set. It is installed on the per-render partition only (backgroundRenderer.ts:533).
• Documentation claims. I checked the claims in CONTEXT.md, features.mdx, the validation record and reportHtml.ts against the code: the 10 MB and 11 MB limits, collection stopping before the screenshot, the reasons Bound TLS is absent, the TLS fields, and the hash list. I found no overclaim.

Evidence gate

• Labels: the PR has evidence-affecting, agent-authored, review:requested and size:XXL. Issue #1929 has evidence-affecting.
• Blocking-tier paths touched: backgroundRenderer.ts, recapture.ts, captureLifecycle.ts, db/captureRepo.ts, src/packages/transaction-record/**, and the two rows this PR adds (transactionRecorder.ts, testCertificateAllowance.ts). The PR carries the label, so the backstop passes.
• Evidence impact section: substantive. It names what acquisition and the signed entry gain, states what verification proves and does not prove, and lists the limits.
• Known-answer tests: the writer KAT is updated to the served windows-1252 bytes and digest, and a new byte-order-mark test is added. The charset known answers that come from the browser live in the e2e spec, and that spec passed in CI.
• Backward verification: between c2d35f66 and the head, no file under schemas, verify or manifest changes. The full suite, frozen digests included, passes.
• Auto-merge is null.

Verification (run on 3987f069, Node v20.20.2, Ubuntu 24.04; commands run in the bash tool shell)

• pnpm lint: exit 0, with 0 errors and 49 warnings, none in changed files.
• pnpm typecheck: exit 0.
• pnpm build: exit 0. pnpm build:extension was not needed because extension/ is unchanged.
• BIRDBRAIN_REQUIRE_OPENSSL=1 BIRDBRAIN_REQUIRE_JQ=1 pnpm test:coverage (under xvfb-run): exit 0, with 8490 passed and 25 skipped (8515), thresholds met.
• pnpm coverage:diff: exit 0, with 346/352 changed lines covered (98.30%). The 6 uncovered lines are in the test-only warcReader.ts.
• Capture probe (D15): exit 0, "No difference beyond the about:blank history entry."
• Live checks (gh pr checks 1999): all green except two.
  • merge-gate is failing, and its log reads "evidence-affecting with no sign-off at head". That is the expected sign-off gate, not a defect.
  • agent/pre-pass is pending.
• Test reliability check: 47 of 233 touched tests still pass with the source reverted. All of them are pre-existing tests edited for the new count, or tests checking that something does not happen, which pass trivially on the old code. 4 mutants survived: finding 4, plus 3 in the test-only warcReader.ts.

Completion controls

• Commit trailers: git log origin/main..3987f069 --format=%B | grep -i co-authored found nothing (grep exit 1).
• Attribution: the body ends with the Created with ... in Claude Code (T3 Code) byline. The linter accepts it (check.sh exit 0 both with and without --any-author).
• Auto-merge: null.

Not checked

• warcio check on records from this head's e2e run. The PR says it was last run at 11fcd9c2. The writer has not changed since then; the collector has changed only its main-document choice.
• I did not run the e2e suite locally. CI's e2e passed at this commit.
• I did not review #1996's own content in depth.
• I wrote no comment file and did not run the post-comment check.sh, because nothing is posted this run.

Friction notes

• re-derived, agent file "Review passes" (diff command): for a stacked PR, git diff origin/main...<head> also includes the parent PR's changes, and nothing says to diff from the parent's head instead. Cost: I had to look up #1996's state and rebuild the delta as c2d35f66..head. Fix: add one line saying a stacked PR is reviewed against its parent's head, with main as the fallback.
• confusing, dispatcher context "CI at this sha is green: every check passed": gh pr checks showed merge-gate as failing. Cost: I read its log to confirm it was the expected sign-off gate. Fix: in the scheduled-review context, list merge-gate as expected red on an evidence-affecting PR that has no sign-off yet.

Reviewed commit: 3987f069bbe8de48459450842cb53e8783ab9915 (round 4; previous review at 4e18f025, verdict 6516179381).

Head re-read at the end: 3987f069bbe8de48459450842cb53e8783ab9915, unchanged. auto_merge is null.

Delta: git diff 4e18f025 3987f069 changes 2 files, 3 lines added and 2 removed. BOUND_TLS_ABSENCE_TEXT['not-reported'] at src/main/services/reportHtml.ts:1826-1827 and the matching row at tests/main/services/reportCaptureEngine.test.ts:345-348. The string feeds rendered report text only (reportHtml.ts:1850) and no branch reads it, but I ran the touched test anyway because the brief asked for the mutation check.

Finding 3: each sentence and the corrected wording, to apply in #2000, not here.

• reportHtml.ts:1827 (#2000 has not taken 3987f069 yet; its branch still carries the old string). Current: "the browser reported no security details on the response for the main document, or the window ended on a page that response did not load". Corrected: "the browser reported no security details on the response for the main document, or the page the capture saved was not the page that response loaded". With #2000, a page that leaves before the save and returns after it records not-reported (#2000's Evidence impact says so). If the return restores the same document, the window ended on the page that response loaded, so the current sentence is false. The matching test row moves with it.
• Validation record, Known limitations, step 9, lines 298-299 on this branch (lines 438-439 on #2000). Current: "a Capture that ends there is stored under about:blank with no Bound TLS Details". Corrected: "a Capture whose page is there when it is saved is stored under about:blank with no Bound TLS Details". With #2000, a page that goes back after the save keeps the saved page's address and details.
• transactionRecorder.ts:444-447 comment, which #2000 does not touch. Current: "committedUrl is the URL of the window's last cross-document navigation ... its details are signed only when that page is the one the window ends on". Corrected: "committedUrl is the URL of the window's last cross-document navigation at the save ... its details are signed only when that page is the one the window held when the page was saved".

Statements that stay true once #2000 lands, so no change is needed:

• CONTEXT.md:106 ("when the window ends on a page no recorded request produced"): #2000 already rewrites it to "when the page the Capture saved is one no recorded request produced".
• website/content/docs/features.mdx:55-57 ("When the page then moves to a page that no request loads"): #2000 already rewrites it to "When the page has moved, by the time it is saved, to a page that no request loads".
• The validation record's third-review note (line 228, "the URL of the window's last cross-document navigation, as Electron's did-navigate reports it") records round 3 as history. #2000 adds its own note at its line 346 for the save-time read.
• The PR body's Evidence impact ("only when that document's URL, without the fragment, is the URL the window last committed") and the Summary's "records that summary as absent when the page then moves to a page no request loads" are true for this commit. The squash body records this commit, and #2000's Evidence impact states the save-time change.

Summary (the squash commit body): no sentence is false at this head. The first sentence's "stacked on #1996, which merges first" depends on merge order (finding 4). The Bound TLS sentences need no change.

Wording fix verified by mutation (Node 20.20.2, BIRDBRAIN_TEST_SYSTEM_SHARP=1, bash):

• At head, pnpm test tests/main/services/reportCaptureEngine.test.ts exits 0 with 41 passed.
• With the string reverted to the old text, it exits 1, and "states the Bound TLS absence not-reported" fails (1 failed, 40 passed). The test asserts the full sentence with toContain, so dropping either clause fails it.

Old wording elsewhere: git grep -n -i "no security details\|not-reported\|boundTlsAbsent\|security details" over the source, CONTEXT.md, website/, the validation record, every tracked *.sh and src/shared/verify/ finds no other surface that states the not-reported meaning in the old words. The only user-facing rendering is reportHtml.ts:1850. The verifier (src/shared/verify/manifestChain.ts:454-469) passes the value through without text, and no tracked verify*.sh names Bound TLS. The one remaining narrow definition is the plan (finding 5).

Review surface (--paginate over pulls/1999/reviews, pulls/1999/comments, issues/1999/comments): 0 reviews, 0 inline comments, 13 issue comments. Only one is new since 6516179381:

• 6516984759, the reply. Item 1 is applied and verified above. Item 2 (no same-document navigation test) is advisory and accepted as left. Item 3 relies on last round's claim, which finding 2 corrects. The cited preflight result (8490 passed, diff coverage 98.30%) was not re-run here. CI's test job at this sha agrees.
• CodeRabbit's 6430027103 is unchanged since 2026-10-26.

Evidence gate:

• PR labels: evidence-affecting, agent-authored, review:requested, size:XXL. #1929 carries evidence-affecting.
• This round touches the report renderer and its test only. The Evidence impact section names the report wording (2026-10-30 ruling).
• The signed value and z.enum(BOUND_TLS_ABSENCES) are unchanged, so earlier entries read as before.

Verification:

• CI at 3987f069: test (7m43s), e2e (9m20s), lint, typecheck, build, docs-build, changes, hunks, adr-numbers, review, label, seed, the secret scan, dependency audit, font licence check, registry publish guard and probe (10m49s) pass.
• merge-gate fails with "evidence-affecting with no sign-off at head", which is expected. agent/pre-pass is pending this verdict.
• Probe: 47 of 233 touched tests still pass with the source reverted, and 4 of 40 mutants survived, against 45 and 4 last round. The two new revert survivors were not itemised. This round adds no recorder or renderer lines, and the report test does fail on revert (above).
• Locally I ran only the touched test file and its mutation. The full suite with coverage, the build and preflight were left to CI at this sha.
• Trial merge of 3987f069 with origin/main at db87600c: clean, changing only package.json and src/renderer/routes/__root.tsx.

Completion controls:

• git log origin/main..3987f069 --format=%B contains no Co-authored-by.
• The body ends with the Created with byline, and post-pr-body/scripts/check.sh exits 0.
• auto_merge is null.

Not checked:

• The e2e spec locally.
• Finding 2 by a run; it is a code trace.
• Whether a back-forward cache restore after the save happens in the hidden window, which decides whether the #2000-era report sentence is false or only imprecise.