improvement(provenance): fold the incomplete-envelope predicate and pin dual-site reporting

Review pass over the previous commit: one helper instead of three copies
of the incomplete-envelope check, the staged TSDoc generalized to cover
both of its uses, and the block-outputs entry point's two-site reporting
of one run envelope documented and pinned rather than left implicit.

Author: icecrasher321

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -880,9 +880,10 @@ export class ResolvedSecretTraceRegistry {
   private readonly scope?: ResolvedSecretTraceScopeV1
   private readonly completeProvenanceEnvelopeBytes: number
   /**
-   * A staged registry filters one value and is then discarded. Its caller re-reports whatever
-   * fault it hits against the real input path, so its own summary lines would restate that with
-   * strictly less context. Entry-level detail still logs — the caller cannot reconstruct it.
+   * A staged registry filters values for one operation and is then discarded. Its caller owns the
+   * reporting and says it with strictly more context — the real input path for a value filter, the
+   * execution for a display read — so the registry's own summary lines would only restate it.
+   * Entry-level detail still logs — the caller cannot reconstruct it.
    */
   private readonly staged: boolean
 

apps/sim/lib/logs/execution/trace-store.test.ts

@@ -643,6 +643,33 @@ describe('stored provenance display reporting', () => {
     expect(mockLogger.error).not.toHaveBeenCalled()
   })
 
+  /** The block entry point runs both display functions; each names its own site for the envelope. */
+  it('attributes an incomplete run envelope under both sites on a block-outputs read', async () => {
+    await materializeExecutionDataForDisplayWithBlockOutputs(
+      {
+        finalOutput: { result: 'value' },
+        executionState: {
+          resolvedSecretTraceProvenance: { version: 1, complete: false, entries: [] },
+          blockStates: {
+            'block-1': { output: { value: 1 } },
+          },
+        },
+      },
+      CONTEXT,
+      ['block-1']
+    )
+
+    expect(registrySummaryLines()).toHaveLength(0)
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      'Stored execution provenance cannot vouch for display content',
+      expect.objectContaining({ site: 'traceStore.displayProjection', parts: ['traceSpans'] })
+    )
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      'Stored execution provenance cannot vouch for display content',
+      expect.objectContaining({ site: 'traceStore.blockOutputs', parts: ['run'] })
+    )
+  })
+
   it('reports incomplete block-output envelopes once for the whole block read', async () => {
     const result = await materializeExecutionDataForDisplayWithBlockOutputs(
       {

apps/sim/lib/logs/execution/trace-store.ts

@@ -307,7 +307,7 @@ export async function materializeExecutionDataForDisplayWithBlockOutputs(
     'traceStore.blockOutputRunProvenance'
   )
   const provenanceFaults = new Map<string, StoredDisplayProvenanceFault>()
-  if (isResolvedSecretTraceProvenanceV1(runProvenance) && !runProvenance.complete) {
+  if (isIncompleteStoredEnvelope(runProvenance)) {
     provenanceFaults.set('run', 'incomplete')
   }
   const blockOutputs = new Map<string, unknown>()
@@ -318,11 +318,11 @@ export async function materializeExecutionDataForDisplayWithBlockOutputs(
     if (!blockState || blockState.output === undefined) continue
 
     const hasExactProvenance = Object.hasOwn(blockState, RESOLVED_SECRET_PROVENANCE_KEY)
-    if (hasExactProvenance) {
-      const blockProvenance = blockState[RESOLVED_SECRET_PROVENANCE_KEY]
-      if (isResolvedSecretTraceProvenanceV1(blockProvenance) && !blockProvenance.complete) {
-        provenanceFaults.set(`blockOutput:${blockId}`, 'incomplete')
-      }
+    if (
+      hasExactProvenance &&
+      isIncompleteStoredEnvelope(blockState[RESOLVED_SECRET_PROVENANCE_KEY])
+    ) {
+      provenanceFaults.set(`blockOutput:${blockId}`, 'incomplete')
     }
     const registry = hasExactProvenance
       ? await importResolvedSecretTraceRegistry(
@@ -377,17 +377,27 @@ async function importResolvedSecretTraceRegistry(
 
 type StoredDisplayProvenanceFault = 'incomplete' | 'malformed'
 
+/** True for a stored envelope that parses but cannot vouch for the value it accompanies. */
+function isIncompleteStoredEnvelope(value: unknown): boolean {
+  return isResolvedSecretTraceProvenanceV1(value) && !value.complete
+}
+
 const MAX_REPORTED_PROVENANCE_FAULT_PARTS = 20
 
 /**
- * One attributed line per display materialization, in place of one registry summary per envelope
- * per view.
+ * One attributed line per display function per materialization, in place of one registry summary
+ * per envelope per view.
  *
  * The registry summaries these replace carried counts and a workspace but no execution id, so a
  * reader repeatedly materializing the same stored rows produced an unattributable stream — the
  * lines could not say which executions to go look at. Incomplete stays at warn (a stored state
  * being re-read); malformed stays at error (a stored envelope that cannot be parsed is a fault
  * wherever it is met, matching the level its registry reason carries elsewhere).
+ *
+ * A block-outputs read runs the display projection first, so an incomplete run envelope appears
+ * once under each site — `traceSpans` guarding the span projection, `run` as the block fallback.
+ * Two sites reading the same envelope are two facts about the view; collapsing them would couple
+ * the display functions to share reporting state for one line less.
  */
 function reportStoredDisplayProvenanceFaults(
   site: string,
@@ -489,7 +499,7 @@ export async function projectExecutionDataForDisplay(
   const projectionStore = createReadOnlyProjectionStore(context)
 
   const provenanceFaults = new Map<string, StoredDisplayProvenanceFault>()
-  if (isResolvedSecretTraceProvenanceV1(provenance) && !provenance.complete) {
+  if (isIncompleteStoredEnvelope(provenance)) {
     provenanceFaults.set('traceSpans', 'incomplete')
   }