Web UI Runs pages

## Leaves

- web-runs-list (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 3d44c0cc-3091-4f65-83ce-01a1ae5c0611: pass (said done)
  - attempt 1 verifier, session 080b4504-3ad2-4036-81d6-01a1ae5f64b2: pass (Evidence written by the verifier)
- web-run-detail (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session edd5eba5-301a-4ffb-8eff-01a1ae5fadc9: pass (said done)
  - attempt 1 verifier, session d80121d9-42f2-460f-af21-01a1ae6288c3: pass (Evidence written by the verifier)
- web-run-log-tail (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session 0f3a03c2-5a7f-4312-b65c-01a1ae62c0b3: pass (said done)
  - attempt 1 verifier, session b98edd62-5671-4a7d-8b2e-01a1ae664de7: pass (Evidence written by the verifier)
- web-runs-list (step review/review): open
  - attempt 2 fixer in cycle 2, session fb514966-2671-4f6d-a765-01a1ae7d08b8: pass (said done)
  - attempt 2 verifier in cycle 2, session 804a1831-870a-4fce-b6e4-01a1ae80a8b8: pass (Evidence written by the verifier)
- web-run-detail (step review/review): open
  - attempt 2 fixer in cycle 2, session 851cfa1f-43d9-47fb-bc09-01a1ae80eaf8: pass (said done)
  - attempt 2 verifier in cycle 2, session ebae0403-e79c-4101-ae80-01a1ae85190a: pass (Evidence written by the verifier)
- web-run-log-tail (step review/review): open
  - attempt 2 fixer in cycle 2, session 2b1280bc-df48-4c80-b80e-01a1ae856411: pass (said done)
  - attempt 2 verifier in cycle 2, session db656a66-2736-4052-bc69-01a1ae874d22: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 65efbde6-8c1f-439c-a06d-01a1ae71db9d pass (said done)
  - round 1 (cycle 1): 2 findings, 0 confirmed
    - f1 minor at internal/web/runs_test.go:11 on web-runs-list: The acceptance says the test renders /runs 'over fixture journals'; the committed test renders over a canned run.ls JSON body, so the recent group's newest-first order is only the fixture's order (run.ls sorts it, not the page). Order, fields, links and the run-events section are asserted; the verifier's run over real journals was a scratch test, not committed.
    - f2 nit at internal/web/runs.go:89 on web-runs-list: The leaf statement lists a short ID per row; the page shows none, rightly under owner-surfaces-no-ids. The leaf statement could be reworded to match.
- quality (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 067848e4-c214-422b-bc33-01a1ae722ec4 pass (said done), critic session 9147db9a-548f-4caf-9e3a-01a1ae7a7e9d pass (said done)
  - cycle 2: passed, check session fc0fb1b7-0d4f-4d89-9861-01a1ae9e5c1c pass (said done)
  - round 1 (cycle 1): 6 findings, 1 confirmed
    - f1 major at internal/web/rundetail.go:318 on web-run-detail: The session token struct has no json tags: api.SessionTokens encodes cache_creation and cache_read, which do not decode into CacheCreation/CacheRead (encoding/json matches names case-insensitively but not across underscores). The page's 'finished · N tokens' therefore counts input+output only, which for agent sessions (mostly cache reads) is a large undercount of what the owner sees. The fixture has no cache fields, so the test cannot catch it. Tag the fields (json:"input", "output", "cache_creation", "cache_read") and add cache values to fixturePlanRun. — confirmed: internal/web/rundetail.go:45 decodes tokens.session into an untagged struct{ Input, Output, CacheCreation, CacheRead int64 }; api.SessionTokens (internal/api/session.go:194-195) encodes cache_creation and cache_read, which encoding/json's case-insensitive name match does not map onto CacheCreation/CacheRead, so the sum at rundetail.go:120 silently drops cache tokens. The fixture carries no cache fields, so the test does not catch it.
    - f2 minor at internal/web/rundetail.go:381 on web-run-detail: Sessions are matched to steps by name only (RunSession.step is the step a session first appeared under), so a step visited more than once (RunStep.visit > 1, e.g. a review's checks step across cycles, or a current step revisiting a done one) lists every session of that name under each visit, duplicated in the timeline.
    - f3 minor at internal/web/rundetail.go:479 on web-run-log-tail: When run.status fails with a non-404 error, servRun skips runLogData but then sets LogFrag, so the Log section renders a zero Term (an empty unlabelled terminal block with no lines) instead of the log or an Empty state until a log event re-renders it.
    - f4 minor at internal/api/run_tail.go:163 on web-run-log-tail: The 256 KiB window path (dropping the partial first line, and a last line longer than the window yielding no lines) has no test; run-tail.txtar and the web tests only write a few short lines.
    - f5 nit at internal/api/run_tail.go:138 on web-run-log-tail: Run resolution and log-path lookup are copied from runRunLog; a shared helper would keep run.log and run.tail from drifting (they already differ: run.log answers Usagef for no log, run.tail NotFoundf).
    - f6 nit at internal/web/rundetail.go:389 on web-run-detail: Each session links (Href) to the run page it is already on, so the session links go nowhere new.
  - round 2 (cycle 2): 3 findings, 0 confirmed
    - f1 minor at internal/web/rundetail.go:115 on web-run-detail: Still open from cycle 1: sessions are matched to steps by name only, so a step visited more than once (e.g. a review's checks step across cycles) lists every session of that name under each visit.
    - f2 minor at internal/web/rundetail.go:214 on web-run-log-tail: Still open from cycle 1: when run.status fails with a non-404 error, servRun skips runLogData but then sets LogFrag, so the Log section renders an empty zero Term until a log event re-renders it.
    - f3 minor at internal/api/run_tail.go:1 on web-run-log-tail: Still open from cycle 1: the 256 KiB window path (dropped partial first line, an over-long last line) has no test.
- qa (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 1544fbc8-a2cc-4616-af05-01a1ae728703 pass (said done), critic session 578b5e8b-2555-44fa-97f2-01a1ae7aea28 pass (said done)
  - cycle 2: passed, check session ec8909b8-b93d-4a09-87ee-01a1ae9ea07c pass (said done)
  - round 1 (cycle 1): 3 findings, 2 confirmed
    - f1 blocker at internal/api/run.go:55 on web-run-detail: run.status is not marked ReadOnly, so the daemon's ReadOnlyHandler answers /api/run.status with 404 "no read-only operation", and runDetail (internal/web/rundetail.go:186) turns that into a page 404. With the built binary's real daemon web UI over real run journals, GET /runs/<id> answers 404 for every run and /fragments/run-detail renders No such run. The rundetail tests pass only because they serve run.status from a fake handler; mark run.status ReadOnly (if it writes nothing), add it to TestReadOnlyMarker, and cover the page through ReadOnlyHandler. — confirmed: internal/api/run.go:56 registers run.status without ReadOnly: true; ReadOnlyHandler (internal/api/web_api.go:27) answers 404 for any op without the marker, and runDetail (internal/web/rundetail.go:183) maps that 404 to a page 404 / 'No such run'. run.status is also absent from TestReadOnlyMarker's uses list, so the daemon's web UI can never show a run page.
    - f2 blocker at internal/web/rundetail.go:207 on web-run-log-tail: The log tail renders only on the run page, and servRun 404s before building it because run.status is refused (see the run.status finding). The run-log fragment and the log event work with the built binary, but no run page shows the tail. — confirmed: servRun (internal/web/rundetail.go:200) returns http.NotFound when runDetail reports 404, before runLogData builds the tail, so with the real ReadOnlyHandler no run page ever shows the log tail; same root cause as f1.
    - f3 minor at internal/web/rundetail.go:45 on web-run-detail: The session token struct has no json tags, so cache_creation and cache_read never decode and "finished · N tokens" sums input+output only.
  - round 2 (cycle 2): 1 finding, 0 confirmed
    - f1 minor at internal/web/runlog.go on web-run-log-tail: The log tail shows the driver log's raw lines, which carry run, session and question IDs (e.g. 'arbiter session b0d15f9d-... on question 01M6Q5C2...', 'Run 01M6Q58R...: each of the plan's...'). owner-surfaces-no-ids says the web UI shows no run or node ID; the leaf asks for the raw tail, so this is a tension to settle in the model (exempt the log tail, or filter it), not a defect in this build.
- scope (step review/review): passed after 1 cycle
  - cycle 1: passed, check session 42abb608-b685-4e60-ab5d-01a1ae72dd7d pass (said done)
  - round 1 (cycle 1): 2 findings, 0 confirmed
    - f1 minor at internal/api/run_tail.go:18 on web-run-log-tail: The leaf asks for a log tail on the web run page; the build also adds a public operation run.tail, which the generic CLI frame exposes as a new `rhiza run tail` command (with its own testscript cmd/rhiza/testdata/script/run-tail.txtar and a describe-golden entry). The web page reads data only through the read-only API, so some read-only op is a reasonable means. But no leaf or Decision names a new CLI command, and the model does not record it. Better options: record it as a Decision or leaf, or have the web read the log through the existing run.log.
    - f2 minor at internal/web/runs.go:72 on web-run-detail: Outside this check's scope, noted in passing: apiError.Error() includes the request target, such as GET /api/run.status?run=<id>. The run page, the run-log tail and the Runs page show that text in their 'unavailable' empty states, so an owner-facing page can show a run ID. That goes against owner-surfaces-no-ids.
- model (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 28f4f841-648b-4fbc-9c39-01a1ae732726 pass (said done), critic session 4337a422-2db5-4e2d-b2ee-01a1ae7b68fd pass (said done)
  - cycle 2: passed, check session fb08eba2-26ff-4bb9-911a-01a1ae9eea51 pass (said done)
  - round 1 (cycle 1): 2 findings, 1 confirmed
    - f1 major at internal/web/runs.go:89 on web-runs-list: The leaf's statement says each run row shows 'its short ID', but runRow deliberately shows no ID (only in the /runs/<id> link), as constraint owner-surfaces-no-ids requires and the verifier's evidence notes. The model contradicts both the code and a constraint; amend the leaf statement to drop the short ID (rows named by change set title). — confirmed: web-runs-list's statement requires each row to show 'its short ID', but runRow (internal/web/runs.go:91-105) sets Href, Title, Sub, Pill, Step and Time only and its doc says it shows no ID, as constraint owner-surfaces-no-ids (web UI shows no run ID) requires. The leaf contradicts both the code and a constraint in this slice, so the model must be amended to drop the short ID.
    - f2 minor at internal/api/run_tail.go:18 on web-run-log-tail: The change adds a new API op and CLI command, run.tail (rhiza run tail [run] --limit, exits 2 with no log), with its own testscript, but no capability in the model states it: run-log covers only paged rhiza run log, and web-run-log-tail names only the web page. Record it as its own leaf (or widen run-log) so the CLI surface is modelled.
  - round 2 (cycle 2): 1 finding, 0 confirmed
    - f1 minor at internal/api/run_tail.go:18 on web-run-log-tail: Still open from cycle 1: the change adds a CLI command and API op, run.tail (rhiza run tail [run] --limit, exits 2 with no log), with its own testscript, but no capability states it: run-log covers only paged rhiza run log, and web-run-log-tail names only the web page. Record it as its own leaf or widen run-log. The cycle-1 major (short ID in web-runs-list's statement) is fixed, and run.status's new ReadOnly marker fits web-api-read-only, since runRunStatus only reads the run, session and ship stores.

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Sessions

- build/build, session 3d44c0cc-3091-4f65-83ce-01a1ae5c0611: tokens input 30, output 9743, cache creation 62910, cache read 1068591; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 080b4504-3ad2-4036-81d6-01a1ae5f64b2: tokens input 30, output 6163, cache creation 46549, cache read 917592; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session edd5eba5-301a-4ffb-8eff-01a1ae5fadc9: tokens input 24, output 10305, cache creation 66037, cache read 845371; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session d80121d9-42f2-460f-af21-01a1ae6288c3: tokens input 22, output 2909, cache creation 43724, cache read 666665; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 0f3a03c2-5a7f-4312-b65c-01a1ae62c0b3: tokens input 52, output 12019, cache creation 66184, cache read 2005830; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session b98edd62-5671-4a7d-8b2e-01a1ae664de7: tokens input 22, output 3716, cache creation 35655, cache read 622288; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 65efbde6-8c1f-439c-a06d-01a1ae71db9d: tokens input 16, output 3056, cache creation 44372, cache read 472265; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 067848e4-c214-422b-bc33-01a1ae722ec4: tokens input 26, output 5397, cache creation 63868, cache read 937162; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 1544fbc8-a2cc-4616-af05-01a1ae728703: tokens input 68, output 15843, cache creation 64672, cache read 2605100; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 42abb608-b685-4e60-ab5d-01a1ae72dd7d: tokens input 14, output 2947, cache creation 43320, cache read 392610; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 28f4f841-648b-4fbc-9c39-01a1ae732726: tokens input 20, output 2893, cache creation 42312, cache read 596472; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 9147db9a-548f-4caf-9e3a-01a1ae7a7e9d: tokens input 14, output 1518, cache creation 27288, cache read 343867; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 578b5e8b-2555-44fa-97f2-01a1ae7aea28: tokens input 14, output 2062, cache creation 26645, cache read 339941; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 4337a422-2db5-4e2d-b2ee-01a1ae7b68fd: tokens input 12, output 1290, cache creation 26426, cache read 290653; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session fb514966-2671-4f6d-a765-01a1ae7d08b8: tokens input 14, output 1748, cache creation 24404, cache read 333789; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 804a1831-870a-4fce-b6e4-01a1ae80a8b8: tokens input 18, output 2703, cache creation 33666, cache read 482388; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 851cfa1f-43d9-47fb-bc09-01a1ae80eaf8: tokens input 20, output 3250, cache creation 34064, cache read 541787; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session ebae0403-e79c-4101-ae80-01a1ae85190a: tokens input 26, output 4604, cache creation 34625, cache read 722745; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 2b1280bc-df48-4c80-b80e-01a1ae856411: tokens input 14, output 2082, cache creation 27314, cache read 344890; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session db656a66-2736-4052-bc69-01a1ae874d22: tokens input 44, output 5565, cache creation 40370, cache read 1181101; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session fc0fb1b7-0d4f-4d89-9861-01a1ae9e5c1c: tokens input 26, output 3779, cache creation 44045, cache read 824486; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session ec8909b8-b93d-4a09-87ee-01a1ae9ea07c: tokens input 68, output 14831, cache creation 55770, cache read 2296935; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session fb08eba2-26ff-4bb9-911a-01a1ae9eea51: tokens input 24, output 2870, cache creation 38624, cache read 701314; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 618, output 121293, cache creation 992844, cache read 19533842; helper tokens input 0, output 0, cache creation 0, cache read 0