fix(provenance): name every incompleteness guard inside the registry

- recordResolved reported 'unspecified' for the same catalog mismatch
  recordResolvedAtInputPath already names 'unverified-resolved-entry'
- wire restored-checkpoint-unavailable at the requireRestoredProvenance guard
- drop filter-capacity-exceeded (that site returns a result, never marks
  incomplete; its warn already names itself) and add reasons for the real
  unnamed sites: provenance capacity, fork inheritance, tool-call scope
  mismatch, constructed-incomplete

Author: waleedlatif1

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -29,8 +29,12 @@ type ResolvedSecretIncompletenessReason =
   | 'unverified-resolved-entry'
   | 'projection-mismatch'
   | 'unresolved-placeholder'
-  | 'filter-capacity-exceeded'
+  | 'provenance-capacity-exceeded'
   | 'restored-checkpoint-unavailable'
+  | 'constructed-incomplete'
+  | 'inherited-incomplete-source'
+  | 'inherited-incomplete-input-path'
+  | 'tool-call-scope-mismatch'
   | 'value-provenance-untrusted'
   | 'value-provenance-import-failed'
   | 'value-provenance-filter-incomplete'
@@ -578,7 +582,7 @@ export class ResolvedSecretTraceRegistry {
     this.scope = scope ? cloneProvenanceScope(scope) : undefined
     this.completeProvenanceEnvelopeBytes = serializedProvenanceEnvelopeByteSize(true, this.scope)
     if (this.completeProvenanceEnvelopeBytes > MAX_SERIALIZED_PROVENANCE_BYTES) {
-      this.markIncomplete()
+      this.markIncomplete('provenance-capacity-exceeded')
     }
     let catalogEntriesSeen = 0
     for (const entry of catalogEntries) {
@@ -606,7 +610,7 @@ export class ResolvedSecretTraceRegistry {
     }
     this.copyResolvedInputPathsTo(fork)
     this.copyIncompleteInputPathsTo(fork)
-    if (!this.complete) fork.markIncomplete()
+    if (!this.complete) fork.markIncomplete('inherited-incomplete-source')
     return fork
   }
 
@@ -617,12 +621,12 @@ export class ResolvedSecretTraceRegistry {
   ): ResolvedSecretTraceRegistry {
     const fork = new ResolvedSecretTraceRegistry(this.catalog.values(), this.scope)
     if (!this.complete) {
-      fork.markIncomplete()
+      fork.markIncomplete('inherited-incomplete-source')
       return fork
     }
 
     if (this.hasIncompleteInputPathOverlapping(paths)) {
-      fork.markIncomplete()
+      fork.markIncomplete('inherited-incomplete-input-path')
       return fork
     }
 
@@ -646,14 +650,14 @@ export class ResolvedSecretTraceRegistry {
         fork.addActiveEntry({ ...entry }, { propagated: true })
       }
     }
-    if (this.isPermanentlyIncomplete()) fork.markIncomplete()
+    if (this.isPermanentlyIncomplete()) fork.markIncomplete('inherited-incomplete-source')
     return fork
   }
 
   /** Merges one settled tool-call registry into the turn-scoped registry. */
   mergeToolCallRegistry(child: ResolvedSecretTraceRegistry): void {
     if (!scopesMatch(this.scope, child.scope) || !child.isComplete()) {
-      this.markIncomplete()
+      this.markIncomplete('tool-call-scope-mismatch')
       return
     }
 
@@ -675,7 +679,7 @@ export class ResolvedSecretTraceRegistry {
     if (resolvedValue.length === 0) return false
     const entry = this.getVerifiedResolvedEntry(name, resolvedValue)
     if (!entry) {
-      this.markIncomplete()
+      this.markIncomplete('unverified-resolved-entry')
       return false
     }
 
@@ -1722,7 +1726,7 @@ export class ResolvedSecretTraceRegistry {
         entryBytes >
         MAX_SERIALIZED_PROVENANCE_BYTES
     ) {
-      this.markIncomplete()
+      this.markIncomplete('provenance-capacity-exceeded')
       return
     }
     this.activeEntries.set(key, entry)
@@ -1783,7 +1787,7 @@ export async function createResolvedSecretTraceRegistry(
     options.restoreTrusted === true &&
     options.restoredCheckpointVersion !== undefined
   ) {
-    registry.markIncomplete()
+    registry.markIncomplete('restored-checkpoint-unavailable')
   }
 
   return registry
@@ -1794,6 +1798,6 @@ export function createIncompleteResolvedSecretTraceRegistry(
   scope?: ResolvedSecretTraceScopeV1
 ): ResolvedSecretTraceRegistry {
   const registry = new ResolvedSecretTraceRegistry([], scope)
-  registry.markIncomplete()
+  registry.markIncomplete('constructed-incomplete')
   return registry
 }