fix(evals): keep repeated run observations out of browser trace

tests/runner-e2e/api.test.ts

@@ -5,7 +5,7 @@ const response = (status: number, data: unknown = {}): APIResponse => ({
   ok: () => status >= 200 && status < 300, status: () => status,
   json: async () => data, text: async () => JSON.stringify(data), url: () => "http://fixture.invalid/instructions",
 }) as APIResponse;
-afterEach(() => vi.unstubAllEnvs());
+afterEach(() => { vi.unstubAllEnvs(); vi.unstubAllGlobals(); });
 describe("fixture instruction revision fence", () => {
   function api(current: APIResponse, saved = response(200)) {
     vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "3100");
@@ -67,3 +67,39 @@ it("keeps existing polling retries when the strict error policy is absent", asyn
     load, accept: Boolean, intervalMs: 1 })).resolves.toBe(true);
   expect(load).toHaveBeenCalledTimes(2);
 });
+
+it("observes identical native poll results with the actual actor and no traced request", async () => {
+  vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "3100");
+  const get = vi.fn(() => { throw new Error("Poll must not enter the Playwright API recorder"); });
+  const api = new RunnerApi({ get } as unknown as APIRequestContext);
+  api.setBrowserSession("synthetic-cookie");
+  const rows = [{ id: "11111111-1111-4111-8111-111111111111", status: "running" }];
+  const fetcher = vi.fn(async (_input: RequestInfo | URL, _init?: RequestInit) => new Response(JSON.stringify(rows), { status: 200 }));
+  vi.stubGlobal("fetch", fetcher);
+  const endpoint = "/api/companies/22222222-2222-4222-8222-222222222222/heartbeat-runs?limit=100";
+  await expect(api.getRunObservation(endpoint, { timeout: 1234 })).resolves.toEqual(rows);
+  expect(get).not.toHaveBeenCalled(); expect(fetcher).toHaveBeenCalledTimes(1);
+  expect(String(fetcher.mock.calls[0]![0])).toBe(`http://127.0.0.1:3100${endpoint}`);
+  expect(fetcher.mock.calls[0]![1]).toMatchObject({ method: "GET", redirect: "error", headers: { Cookie: "synthetic-cookie", Origin: "http://127.0.0.1:3100" } });
+  expect((fetcher.mock.calls[0]![1] as RequestInit).signal).toBeInstanceOf(AbortSignal);
+});
+it("keeps local-trusted run observations cookie-free and preserves typed HTTP failure without retry", async () => {
+  vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "3100");
+  const api = new RunnerApi({} as APIRequestContext);
+  const fetcher = vi.fn(async (_input: RequestInfo | URL, _init?: RequestInit) => new Response("private failure body", { status: 403 })); vi.stubGlobal("fetch", fetcher);
+  await expect(api.getRunObservation("/api/heartbeat-runs/11111111-1111-4111-8111-111111111111/events?afterSeq=0&limit=1000")).rejects.toMatchObject({ name: "RunnerApiHttpError", status: 403 });
+  expect(fetcher).toHaveBeenCalledTimes(1);
+  expect(fetcher.mock.calls[0]![1]).toMatchObject({ headers: { "content-type": "application/json" } });
+  expect((fetcher.mock.calls[0]![1] as RequestInit).headers).not.toHaveProperty("Cookie");
+});
+it.each([
+  "https://foreign.invalid/api/heartbeat-runs/11111111-1111-4111-8111-111111111111",
+  "/api/companies/22222222-2222-4222-8222-222222222222/agents",
+  "/api/heartbeat-runs/11111111-1111-4111-8111-111111111111?token=anything",
+  "/api/heartbeat-runs/11111111-1111-4111-8111-111111111111/events?afterSeq=0&limit=10&extra=1",
+])("rejects non-observation transport target %s before dispatch", async endpoint => {
+  vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "3100");
+  const fetcher = vi.fn(); vi.stubGlobal("fetch", fetcher);
+  await expect(new RunnerApi({} as APIRequestContext).getRunObservation(endpoint)).rejects.toThrow("allowlisted same-origin GET");
+  expect(fetcher).not.toHaveBeenCalled();
+});

tests/runner-e2e/api.ts

@@ -47,6 +47,20 @@ export class RunnerApi {
     return response.json() as Promise<T>;
   }
 
+  /** Repeated native observation reads retain explicit snapshots, without duplicating full DTO bodies in the browser trace. */
+  async getRunObservation<T>(path: string, options?: { timeout: number }): Promise<T> {
+    const url = new URL(path, this.baseURL);
+    const uuid = "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}";
+    const companyRuns = new RegExp(`^/api/companies/${uuid}/heartbeat-runs$`, "i").test(url.pathname)
+      && [...url.searchParams.keys()].every(key => key === "limit") && url.searchParams.get("limit") === "100";
+    const run = new RegExp(`^/api/heartbeat-runs/${uuid}$`, "i").test(url.pathname) && !url.search;
+    const events = new RegExp(`^/api/heartbeat-runs/${uuid}/events$`, "i").test(url.pathname)
+      && [...url.searchParams.keys()].every(key => ["afterSeq", "limit"].includes(key))
+      && /^\d+$/.test(url.searchParams.get("afterSeq") ?? "") && /^[1-9]\d*$/.test(url.searchParams.get("limit") ?? "");
+    if (url.origin !== this.baseURL || url.username || url.password || url.hash || !(companyRuns || run || events)) throw new Error("Run observation requires an allowlisted same-origin GET endpoint");
+    return this.authenticatedJson<T>("GET", path, undefined, options);
+  }
+
   /** Fetch owned attachment bytes with the same authenticated actor as JSON reads. */
   async getAttachmentContent(attachmentId: string): Promise<Buffer> {
     if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(attachmentId)) throw new Error("Invalid fixture attachment identity");

tests/runner-e2e/chat-flow.test.ts

@@ -267,7 +267,7 @@ If you only have the club name, audience, and tone, that is enough to begin; I c
   it("retains reset events without requesting a provider log, and does not hide missing real logs", async () => {
     const get = vi.fn().mockResolvedValue([{ seq: 1, type: "session_reset" }]);
     const reset = { ...run, resultJson: { conversationReset: true } };
-    await expect(collectChatRunEvidence({ get }, reset)).resolves.toEqual({
+    await expect(collectChatRunEvidence({ get, getRunObservation: get }, reset)).resolves.toEqual({
       runId: run.id,
       log: null,
       events: [{ seq: 1, type: "session_reset" }],
@@ -276,7 +276,7 @@ If you only have the club name, audience, and tone, that is enough to begin; I c
       [`/api/heartbeat-runs/${run.id}/events?afterSeq=0&limit=1000`],
     ]);
     get.mockRejectedValue(new Error("Run log not found"));
-    await expect(collectChatRunEvidence({ get }, run)).rejects.toThrow(
+    await expect(collectChatRunEvidence({ get, getRunObservation: get }, run)).rejects.toThrow(
       "Run log not found",
     );
   });
@@ -285,7 +285,7 @@ If you only have the club name, audience, and tone, that is enough to begin; I c
     const tail = { seq: 1001, eventType: "run.terminal" };
     const get = vi.fn().mockResolvedValueOnce({ content: "fixture log" })
       .mockResolvedValueOnce(firstPage).mockResolvedValueOnce([tail]);
-    const evidence = await collectChatRunEvidence({ get }, run);
+    const evidence = await collectChatRunEvidence({ get, getRunObservation: get }, run);
     expect(evidence.events).toEqual([...firstPage, tail]);
     expect(get.mock.calls).toEqual([
       [`/api/heartbeat-runs/${run.id}/log?limitBytes=1048576`],
@@ -297,22 +297,22 @@ If you only have the club name, audience, and tone, that is enough to begin; I c
     const stopped = { ...run, status: "interrupted", runtimeMode: "legacy", runtimeModeResolvedAt: null, logStore: null, logRef: null,
       resultJson: { executionRecovery: { kind: "bootstrap", providerWorkStarted: false } } };
     const get = vi.fn().mockResolvedValue([]);
-    expect(await collectChatRunEvidence({ get }, stopped)).toMatchObject({ log: null, logOmissionReason: "provider_not_started", events: [] });
+    expect(await collectChatRunEvidence({ get, getRunObservation: get }, stopped)).toMatchObject({ log: null, logOmissionReason: "provider_not_started", events: [] });
     expect(get).toHaveBeenCalledTimes(1);
     get.mockRejectedValue(new Error("Run log not found"));
     for (const change of [{ resultJson: {} }, { runtimeMode: "native" }, { logRef: "recorded-log" }, { logStore: undefined },
       { runtimeModeResolvedAt: "2026-09-28T00:00:00Z" }, { resultJson: { executionRecovery: { kind: "bootstrap", providerWorkStarted: true } } }]) {
-      await expect(collectChatRunEvidence({ get }, { ...stopped, ...change })).rejects.toThrow("Run log not found");
+      await expect(collectChatRunEvidence({ get, getRunObservation: get }, { ...stopped, ...change })).rejects.toThrow("Run log not found");
     }
   });
   it("retains events for an unstarted dependency-blocked wake without asking for a nonexistent log", async () => {
     const get = vi.fn().mockResolvedValue([]);
     const suppressed = { ...run, status: "cancelled", errorCode: "issue_dependencies_blocked", startedAt: null };
-    expect((await collectChatRunEvidence({ get }, suppressed)).log).toBeNull();
+    expect((await collectChatRunEvidence({ get, getRunObservation: get }, suppressed)).log).toBeNull();
     expect(get).toHaveBeenCalledTimes(1);
     get.mockRejectedValue(new Error("Run log not found"));
-    await expect(collectChatRunEvidence({ get }, { ...suppressed, startedAt: "2026-09-18T00:00:00Z" })).rejects.toThrow("Run log not found");
-    await expect(collectChatRunEvidence({ get }, { ...suppressed, errorCode: "provider_transport_failed" })).rejects.toThrow("Run log not found");
+    await expect(collectChatRunEvidence({ get, getRunObservation: get }, { ...suppressed, startedAt: "2026-09-18T00:00:00Z" })).rejects.toThrow("Run log not found");
+    await expect(collectChatRunEvidence({ get, getRunObservation: get }, { ...suppressed, errorCode: "provider_transport_failed" })).rejects.toThrow("Run log not found");
   });
   it("waits for a newly running provider's log file without swallowing server failures", async () => {
     const get = vi.fn().mockResolvedValue({ status: () => 404 });

tests/runner-e2e/chat-flow.ts

@@ -295,7 +295,7 @@ export async function readRunningChatLog(
 /** Reset/blocked runs and proven pre-provider failures may have no provider log.
  * Preserve their durable events; missing logs for real provider work still fail. */
 export async function collectChatRunEvidence(
-  api: Pick<RunnerApi, "get">,
+  api: Pick<RunnerApi, "get" | "getRunObservation">,
   run: ChatRun,
 ) {
   const recovery = run.resultJson?.executionRecovery as Record<string, unknown> | undefined;
@@ -309,7 +309,7 @@ export async function collectChatRunEvidence(
       ? null
       : await api.get(`/api/heartbeat-runs/${run.id}/log?limitBytes=1048576`),
     events: await collectRunEvents((afterSeq, limit) =>
-      api.get(`/api/heartbeat-runs/${run.id}/events?afterSeq=${afterSeq}&limit=${limit}`),
+      api.getRunObservation(`/api/heartbeat-runs/${run.id}/events?afterSeq=${afterSeq}&limit=${limit}`),
     ),
   };
 }
@@ -397,11 +397,11 @@ export async function runChatFlow(input: ChatFlowInput) {
     "/api/instance/settings/experimental",
   );
   const allRuns = async () => {
-    const rows = await api.get<ChatRun[]>(
+    const rows = await api.getRunObservation<ChatRun[]>(
       `/api/companies/${f.company.id}/heartbeat-runs?limit=100`,
     );
     return Promise.all(
-      rows.map((row) => api.get<ChatRun>(`/api/heartbeat-runs/${row.id}`)),
+      rows.map((row) => api.getRunObservation<ChatRun>(`/api/heartbeat-runs/${row.id}`)),
     );
   };
   if (catalogDescriptor?.journeyKind === "native-slack-thread") {