@analitikisler/ai-tag-debugger 0.20.0 → 0.20.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.20.1 (2026-11-03)
+
+- Runs can report fewer findings than 0.20.0 on the same site: GA4's own events are no longer unplanned, and a reject that keeps essential storage granted is no longer a re-grant. A baseline written with 0.20.0 can then list those entries as stale; `--update-baseline` rewrites it.
+- Fixed: a reject that left `functionality_storage`, `security_storage` or `personalization_storage` granted was reported as "the reject button does not stick". Only `ad_storage`, `analytics_storage`, `ad_user_data` and `ad_personalization` granted after a reject count as a re-grant now; consent platforms keep the others granted on "reject all".
+- GA4's automatic events (`first_visit`, `session_start`, `user_engagement`) and enhanced measurement events (`page_view`, `scroll`, `click`, `view_search_results`, `video_start`, `video_progress`, `video_complete`, `file_download`, `form_start`, `form_submit`) are never listed as unplanned, in the findings or in Plan vs. site. When a plan lists an enhanced measurement event that never fired, the finding says which setting under Admin > Data streams > Enhanced measurement sends it. A planned `first_visit` or `session_start` counts as sent when a GA4 hit carries its flag (`_fv`, `_ss`), since GA4 never sends them by name, and a planned automatic event that wasn't seen is an info note instead of a missing event.
+- A step waits until the tags have gone quiet: after the page loads and the network is idle, it waits until no tag, consent or tracking request and no dataLayer push came for 1.2 seconds, at most 3 seconds more, and once more for a page a delayed link only now started loading. A page_view gtag held for a consent update lands on the click that opened its page. Steps with recent tag activity take up to that much longer.
+- A page_view that still arrives during a later wait or scroll, for a page an earlier step loaded and with none of its own yet, is put on that earlier step and marked late: the report shows "arrived 3.2 s late" on the hit and links to the request in the step it was sent in, and the MCP step result says where it went. A second page_view for the same page stays on its own step.
+- MCP: `browser_action` and `start_audit` results no longer cut what the agent needs to read. Consent Mode commands are shown in full as `key=value`, `page_location` and `page_referrer` are never cut, in hits or inside dataLayer pushes, and a value that is cut ends in `…`. Calls to analytics and ad endpoints that carry no event the tool reads, such as Google's `ccm/collect` Consent Mode pings, are listed per step with their `gcs`, `gcd`, `dma` and `npa`, instead of only being counted in `finish_audit`.
+
 ## 0.20.0 (2026-10-25)
 
 - Node 22 or newer is required. Node 20 reached its end of life on 30 April 2026, and the OpenAI SDK the tool installs already needed 22. `aitd doctor` and `npm run setup` say so on an older Node, and CI tests on Node 22 and 24.

package/README.md

@@ -47,7 +47,7 @@ Manual tag QA catches this, but it's tedious, so it rarely happens after every r
 | Duplicates | `add_to_cart` sent twice by one click |
 | Consent | Meta `PageView` fired before the visitor accepted cookies, Consent Mode default missing or set too late, Consent Mode v2 signals (`ad_user_data`, `ad_personalization`) missing, tracking cookies set before consent, tags or cookies still active after the `decline_cookies` journey rejects the banner, a reject button that does nothing |
 | Personal data | An email address sent to an ad platform in plain text |
-| Unplanned events | Events firing that aren't in your measurement plan |
+| Unplanned events | Events firing that aren't in your measurement plan. GA4's automatic events (`first_visit`, `session_start`, `user_engagement`) and enhanced measurement events (`page_view`, `scroll`, `click`, `view_search_results`, `video_*`, `file_download`, `form_start`, `form_submit`) never count, since no tag sends them. When one of them is planned and missing, the finding names the enhanced measurement setting that sends it; `first_visit` and `session_start` are read from the flags GA4 puts on its other hits. |
 | Plan coverage | Each planned event sorted into implemented, missing, missing parameters, wrong values or not checked (see [Plan vs. site](#plan-vs-site)) |
 | Campaign parameters | `utm_campaign` or `gclid` on the landing address dropped by a redirect, or missing from the page address the hits report. The visit would be credited to direct traffic |
 | Server-side tracking | One event ID used for two different events, or a Meta event ID that doesn't match the `event_id` on the GA4 hit a server container turns into a Conversions API event |
@@ -292,7 +292,7 @@ When a run uses `--against`, the report has a **Plan vs. site** section: at the
 | Missing | Planned for a journey the run walked, but never fired |
 | Missing params | Fired, but a required parameter is absent |
 | Wrong values | Fired with a value problem, from the same checks as purchase value, currency and items |
-| Unplanned | Fired, but isn't in the plan |
+| Unplanned | Fired, but isn't in the plan (GA4's automatic and enhanced measurement events never are) |
 | Not checked | Planned, but its journey or platform wasn't part of this run |
 
 The coverage score is implemented divided by the planned events that were checkable (all except not checked), shown overall and per platform, for example `Coverage 7 of 11 (64%), 2 events not checked`. The same entries are in `plan-check.json`, one per planned event with its bucket. Exit codes don't change: `--fail-on` still looks at finding severity. Without `--against`, the report is exactly as before.
@@ -625,7 +625,7 @@ Tools the server offers:
 | `make_plan` | Drafts a tracking plan for a site (what should be tracked), the same as `aitd plan --site`. Pass `topic` (`custom-events`, `ecommerce`, `forms`, `consent`) to limit it to one kind of event. The plan is saved and its ID can be given as `against` to `finish_audit`. It uses the AI provider configured on the computer that runs the server and takes a few minutes. |
 | `what_changed` | Returns only the "since last run" diff for a site: the problems fixed and the new ones in its newest saved run (`aitd run`) compared with the run before. No browser and no AI. Pass `language` for a Turkish answer. |
 | `start_audit` | Opens a fresh browser on a URL and starts recording all tracking. Pass a ready-made journey (`purchase`, `sign_up`, …) to get its goal and expected events, and `providers` to choose the platforms to check. The assistant asks you which platforms to check first. |
-| `browser_action` | One click, fill, select, goto, scroll or wait. Returns the page and the tracking hits that step sent. |
+| `browser_action` | One click, fill, select, goto, scroll or wait. Returns the page and the tracking hits that step sent, its dataLayer pushes (Consent Mode commands in full as `key=value`, page addresses never cut) and the calls it read no event from, such as Consent Mode pings with their `gcs` and `gcd`. A page_view that arrives during a later wait or scroll is listed on the step that loaded its page, marked late. |
 | `get_page` | Shows the current page. |
 | `finish_audit` | Checks everything against your measurement plan (JSON), a saved one given as `against` (`latest`, `first`, a plan ID, or on a local server a path), or the ready-made journey's events, optionally only the `events` you name, and writes the full HTML report with the timeline. The site comes from the audit. |
 | `run_audit` | Runs a config file end to end. With `against`, it checks the run against a saved plan and, when the config has no journeys, walks the journeys derived from that plan. `concurrency` runs that many journeys at once, each in its own browser (default 1), and `baseline` names a file of accepted findings written with `--update-baseline` (default: the config's `baseline`; see [Accept known findings](#accept-known-findings)). Local only for file paths. |

package/README.tr.md

@@ -47,7 +47,7 @@ Manuel etiket kontrolü bunu yakalar, ama zahmetlidir; bu yüzden her sürümden
 | Tekrarlar | Tek bir tıklamayla iki kez gönderilen `add_to_cart` |
 | Çerez onayı | Ziyaretçi çerezleri kabul etmeden fire olan Meta `PageView`, eksik ya da çok geç ayarlanmış Consent Mode varsayılanı, eksik Consent Mode v2 sinyalleri (`ad_user_data`, `ad_personalization`), onaydan önce ayarlanan takip çerezleri, `decline_cookies` yolculuğu reddettikten sonra hâlâ aktif olan etiket ya da çerezler, hiçbir şey yapmayan bir reddetme düğmesi |
 | Kişisel veri | Bir reklam platformuna düz metin olarak gönderilen e-posta adresi |
-| Planda olmayan event'ler | Ölçümleme planınızda bulunmayan, yine de fire olan event'ler |
+| Planda olmayan event'ler | Ölçümleme planınızda bulunmayan, yine de fire olan event'ler. GA4'ün otomatik event'leri (`first_visit`, `session_start`, `user_engagement`) ve geliştirilmiş ölçüm event'leri (`page_view`, `scroll`, `click`, `view_search_results`, `video_*`, `file_download`, `form_start`, `form_submit`) hiçbir etiket göndermediği için sayılmaz. Bunlardan biri planda olup gelmediğinde bulgu, onu gönderen geliştirilmiş ölçüm ayarının adını verir; `first_visit` ve `session_start`, GA4'ün diğer isteklerine koyduğu işaretlerden okunur. |
 | Plan kapsamı | Planlanan her event'in uygulandı, eksik, parametresi eksik, değeri hatalı ya da kontrol edilmedi olarak sınıflandırılması (bkz. [Plan ve site](#plan-ve-site)) |
 | Kampanya parametreleri | Açılış adresindeki `utm_campaign` ya da `gclid`'in bir yönlendirmede düşmesi, ya da isteklerin bildirdiği sayfa adresinde eksik olması. Ziyaret doğrudan trafiğe yazılır |
 | Sunucu tarafı takip | Aynı event kimliğinin iki farklı event'te kullanılması, ya da Meta event kimliğinin sunucu konteynerinin Conversions API olayına dönüştürdüğü GA4 isteğindeki `event_id` ile eşleşmemesi |
@@ -292,7 +292,7 @@ Bir çalıştırma `--against` kullandığında raporda bir **Plan ve site** bö
 | Eksik | Çalıştırmanın gezdiği bir yolculuk için planlandı, ama hiç fire olmadı |
 | Parametre eksik | Fire oldu, ama gerekli bir parametre yok |
 | Hatalı değer | Fire oldu, değer sorunu var; satın alma değeri, para birimi ve ürün kontrollerinin aynısından |
-| Planda yok | Fire oldu, ama planda değil |
+| Planda yok | Fire oldu, ama planda değil (GA4'ün otomatik ve geliştirilmiş ölçüm event'leri hiçbir zaman bu gruba girmez) |
 | Kontrol edilmedi | Planlandı, ama yolculuğu ya da platformu bu çalıştırmanın parçası değildi |
 
 Kapsam puanı, uygulanmış olanların kontrol edilebilir planlanmış event'lere (kontrol edilmedi hariç hepsi) bölünmesiyle bulunur; genel ve platform başına gösterilir, örneğin `Kapsam 11 olaydan 7 (%64), 2 olay kontrol edilmedi`. Aynı kayıtlar `plan-check.json` dosyasında da bulunur: planlanan her event için kovasıyla birlikte bir kayıt. Çıkış kodları değişmez: `--fail-on` yine bulgu önemine bakar. `--against` olmadan rapor tam olarak eskisi gibidir.
@@ -625,7 +625,7 @@ Sunucunun sunduğu araçlar:
 | `make_plan` | Bir site için takip planı çıkarır (neyin takip edilmesi gerektiği), `aitd plan --site` ile aynıdır. Yalnızca bir tür event için sınırlamak üzere `topic` verin (`custom-events`, `ecommerce`, `forms`, `consent`). Plan kaydedilir ve kimliği `finish_audit` için `against` olarak verilebilir. Sunucuyu çalıştıran bilgisayarda ayarlı yapay zekâ sağlayıcısını kullanır ve birkaç dakika sürer. |
 | `what_changed` | Bir site için yalnızca "son çalıştırmadan bu yana" farkını döndürür: kayıtlı son çalıştırmanın (`aitd run`) bir öncekine göre düzelen ve yeni sorunları. Tarayıcı ve yapay zekâ kullanmaz. Türkçe yanıt için `language` verin. |
 | `start_audit` | Bir URL'de yeni bir tarayıcı açar ve tüm takibi kaydetmeye başlar. Hedefini ve beklenen event'lerini almak için hazır bir yolculuk (`purchase`, `sign_up`, …) verin; kontrol edilecek platformları seçmek için `providers` verin. Asistan önce hangi platformların kontrol edileceğini size sorar. |
-| `browser_action` | Tek bir tıklama, doldurma, seçme, gitme, kaydırma ya da bekleme. Sayfayı ve o adımın gönderdiği takip isteklerini döndürür. |
+| `browser_action` | Tek bir tıklama, doldurma, seçme, gitme, kaydırma ya da bekleme. Sayfayı, o adımın gönderdiği takip isteklerini, dataLayer push'larını (Consent Mode komutları `anahtar=değer` olarak eksiksiz, sayfa adresleri hiç kesilmeden) ve event olarak okunmayan çağrıları (ör. `gcs` ve `gcd` değerleriyle Consent Mode ping'leri) döndürür. Sonraki bir bekleme ya da kaydırma sırasında gelen page_view, sayfasını yükleyen adımda gecikmeli olarak işaretlenip gösterilir. |
 | `get_page` | Geçerli sayfayı gösterir. |
 | `finish_audit` | Her şeyi ölçümleme planınıza (JSON) ya da `against` olarak verilen kayıtlı bir plana (`latest`, `first`, bir plan kimliği ya da yerel bir sunucuda bir yol) ya da hazır yolculuğun event'lerine karşı kontrol eder; isterseniz yalnızca adını verdiğiniz `events` için, ve zaman akışıyla birlikte tam HTML raporunu yazar. Site denetimden alınır. |
 | `run_audit` | Bir ayar dosyasını baştan sona çalıştırır. `against` ile çalıştırmayı kayıtlı bir plana karşı kontrol eder; ayar dosyasında yolculuk yoksa, plandan türetilen yolculukları gezer. `concurrency` o kadar yolculuğu aynı anda, her birini kendi tarayıcısında çalıştırır (varsayılan 1); `baseline`, `--update-baseline` ile yazılmış kabul edilen bulgular dosyasını adlandırır (varsayılan: ayar dosyasındaki `baseline`; bkz. [Bilinen bulguları kabul edin](#bilinen-bulguları-kabul-edin)). Dosya yolları yalnızca yerelde çalışır. |

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
   "mcpName": "io.github.analitikisler/ai-tag-debugger",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/browser.js

@@ -419,6 +419,7 @@ export class AuditSession {
     this.errorPageShown = false; // whether Chromium's error page committed in the main frame since navigate() began
     this.bodyBytes = 0;
     this.bodyBudgetStep = null; // the step at which POST bodies stopped being stored
+    this.lastTrackingAt = 0; // when a tag, consent or tracking request or a dataLayer push last happened, for settle()
     this.startedAt = Date.now();
   }
 
@@ -448,6 +449,7 @@ export class AuditSession {
     const record = this.opts.recordHar ? { recordHar: { path: this.opts.recordHar, mode: "minimal" } } : {};
     this.context = await this.browser.newContext({ ...device, locale: "en-US", ...record });
     await this.context.exposeBinding("__atdRecord", (_source, entry) => {
+      this.lastTrackingAt = Date.now();
       this.record("dataLayerLog", { ...this.redactEntry(entry), step: this.currentStep, t: Date.now() });
     });
     await this.context.addInitScript(INIT_SCRIPT);
@@ -476,6 +478,8 @@ export class AuditSession {
       for (const hit of hits) {
         if (!this.checks(hit.platform)) continue;
         const entry = { ...this.redactHit(hit), step: this.stepForHit(hit), pageUrl: this.page.url(), t: Date.now() };
+        const late = this.lateFor(hit, entry);
+        if (late) Object.assign(entry, late);
         if (this.record("hits", entry)) recorded.push(entry);
       }
       if (recorded.length) hitsOf.set(request, recorded);
@@ -493,6 +497,7 @@ export class AuditSession {
     this.context.on("request", (request) => {
       const provider = providerOf(request.url());
       if (!provider) return;
+      this.lastTrackingAt = Date.now();
       if (!provider.always && !this.checks(provider.key)) {
         const counts = (this.skipped[this.currentStep] ??= {});
         counts[provider.label] = (counts[provider.label] ?? 0) + 1;
@@ -603,6 +608,25 @@ export class AuditSession {
     return loaded !== undefined && loaded < this.currentStep ? loaded : this.currentStep;
   }
 
+  /**
+   * A page_view that arrives during a wait or a scroll for the page an earlier step loaded, when that step
+   * got none: gtag can hold it for a consent update or a slow tag until after the step was reported. It goes
+   * to the step that loaded the page, marked late, so the report doesn't read as "this click sent nothing".
+   * Returns { step, late: { during, ms } } or null.
+   */
+  lateFor(hit, entry) {
+    if (hit.name !== "page_view" || !hit.params?.page_location || entry.step !== this.currentStep) return null;
+    const now = this.steps[this.currentStep];
+    if (!["wait", "scroll"].includes(now?.action)) return null;
+    const page = pageKey(hit.params.page_location);
+    const loaded = this.loadedIn.get(page);
+    if (loaded === undefined || loaded >= this.currentStep || page !== pageKey(this.page.url())) return null;
+    // A second page_view for the same page (a virtual one, a resend) is the step's own.
+    if (this.hits.some((h) => h.name === "page_view" && h.step >= loaded && h.params?.page_location && pageKey(h.params.page_location) === page)) return null;
+    const since = this.steps[loaded].endedAt ?? this.steps[loaded].t;
+    return { step: loaded, late: { during: this.currentStep, ms: Math.max(0, entry.t - since) } };
+  }
+
   /** The hit with user data for ad matching redacted, and userData: { fields, plain } when there was any. */
   /** Whether requests of this provider are recorded; with detection on, a known provider seen for the first time joins the list. */
   checks(key) {
@@ -739,9 +763,24 @@ export class AuditSession {
   }
 
   async settle() {
-    await this.page.waitForLoadState("load", { timeout: 15000 }).catch(() => {});
-    await this.page.waitForLoadState("networkidle", { timeout: 4000 }).catch(() => {});
-    await this.page.waitForTimeout(400);
+    for (let round = 0; round < 2; round++) {
+      await this.page.waitForLoadState("load", { timeout: 15000 }).catch(() => {});
+      await this.page.waitForLoadState("networkidle", { timeout: 4000 }).catch(() => {});
+      await this.page.waitForTimeout(400);
+      // The network can go quiet before the tags are done: gtag holds a page_view until the consent
+      // platform answers (wait_for_update), and a consent platform loads its own scripts first. So the
+      // step ends once no tag, consent or tracking request and no dataLayer push came for quietMs.
+      const quiet = this.opts.quietMs ?? 1200;
+      const until = Date.now() + (this.opts.quietCapMs ?? 3000);
+      while (Date.now() < until) {
+        const wait = this.lastTrackingAt + quiet - Date.now();
+        if (wait <= 0) break;
+        await this.page.waitForTimeout(Math.min(wait, until - Date.now()));
+      }
+      // A click whose page starts loading only now (a link delayed for its tags) is waited for once more.
+      if (!this.leaving) break;
+      await this.page.waitForEvent("framenavigated", { predicate: (f) => f === this.page.mainFrame(), timeout: 5000 }).catch(() => {});
+    }
   }
 
   async snapshot() {
@@ -905,6 +944,7 @@ export class AuditSession {
     // A scripted replay of this step may fail the same way, which must not end the journey there.
     if (error) this.steps[this.currentStep].error = error;
     this.steps[this.currentStep].pagePath = pagePath(this.page.url());
+    this.steps[this.currentStep].endedAt = Date.now(); // when the step was reported, so a late hit can say how late
     return error;
   }
 

package/src/checks.js

@@ -15,6 +15,9 @@ const sentBefore = (a, b) => a.step < b.step || (a.step === b.step && a.t != nul
 const EMAIL = /[A-Z0-9._%+-]+(@|%40)[A-Z0-9.-]+\.[A-Z]{2,}/gi;
 // Consent Mode v2 added two signals to ad_storage and analytics_storage. Google requires them for EEA/UK traffic.
 const V2_SIGNALS = ["ad_user_data", "ad_personalization"];
+// The signals a "reject all" must keep denied. functionality_storage and security_storage cover what
+// the site needs to work, and personalization_storage its own features, so CMPs grant them on reject too.
+const TRACKING_SIGNALS = ["ad_storage", "analytics_storage", ...V2_SIGNALS];
 const TRACKING_COOKIE = /^(_ga(_.+)?|_gid|_gat(_.+)?|_gcl_.+|_fbp|_fbc|_ttp|_tt_.+|_uet(sid|vid)|_clck|_clsk|_hj.+|_pin_unauth|_scid|IDE|test_cookie|fr|li_.+|_dc_gtm_.+)$/;
 const SEVERITY_ORDER = { broken: 0, risk: 1, warning: 2, info: 3, ok: 4 };
 
@@ -63,6 +66,28 @@ export function canonicalEvent(name) {
   return CANONICAL.get(n) ?? n;
 }
 
+// GA4 makes these itself: first_visit and session_start from flags on its other hits, user_engagement
+// when the page is hidden or left. No tag sends them, so they are never unplanned, and a run can end
+// before user_engagement goes out. Keyed by canonicalEvent, like every comparison of event names here.
+const GA4_AUTOMATIC = new Set(["first_visit", "session_start", "user_engagement"].map(canonicalEvent));
+// Enhanced measurement events, which GA4 sends with no tag when the web stream's setting is on.
+// The value names the setting that sends it.
+const GA4_ENHANCED = new Map(Object.entries({
+  page_view: "pageViews", scroll: "scrolls", click: "outboundClicks", view_search_results: "siteSearch",
+  video_start: "videoEngagement", video_progress: "videoEngagement", video_complete: "videoEngagement",
+  file_download: "fileDownloads", form_start: "formInteractions", form_submit: "formInteractions",
+}).map(([name, setting]) => [canonicalEvent(name), setting]));
+const isGa4Automatic = (platform, name) => platform === "ga4" && GA4_AUTOMATIC.has(canonicalEvent(name));
+/** Whether GA4 sends this event by itself, so a plan need not list it. */
+const isGa4Builtin = (platform, name) => isGa4Automatic(platform, name) || (platform === "ga4" && GA4_ENHANCED.has(canonicalEvent(name)));
+
+/** Whether a planned event was sent on a run: by name, or for GA4's first_visit and session_start, as a flag on another hit. */
+function eventFired(ev, hits) {
+  if (hits.some((h) => hitMatchesEvent(ev, h))) return true;
+  const name = canonicalEvent(ev.name);
+  return ev.platform === "ga4" && hits.some((h) => h.platform === "ga4" && (h.autoEvents ?? []).some((a) => canonicalEvent(a) === name));
+}
+
 /** Whether a captured hit is the planned event, by its exact name, an alias or a common variant. */
 export function hitMatchesEvent(ev, hit) {
   if (hit.platform !== ev.platform) return false;
@@ -169,17 +194,22 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   // Expected events that never fired.
   for (const ev of plan.events) {
     if (!expectedIn(ev, run.journeyId)) continue;
-    const fired = run.hits.some((h) => hitMatchesEvent(ev, h));
-    if (!fired) {
-      findings.push({
-        ...base,
-        severity: run.completed ? "broken" : "info",
-        check: "missing_event",
-        platform: ev.platform,
-        event: ev.name,
-        detail: run.completed ? d.missingEvent(ev.platform, ev.name) : d.missingEventEarly(ev.name),
-      });
+    if (eventFired(ev, run.hits)) continue;
+    if (isGa4Automatic(ev.platform, ev.name)) {
+      findings.push({ ...base, severity: "info", check: "ga4_automatic_event", platform: ev.platform, event: ev.name, detail: d.missingAutomatic(ev.name) });
+      continue;
     }
+    // page_view is enhanced measurement too, but a missing one means the GA4 tag itself did not send.
+    const name = canonicalEvent(ev.name);
+    const setting = ev.platform === "ga4" && name !== canonicalEvent("page_view") ? GA4_ENHANCED.get(name) : undefined;
+    findings.push({
+      ...base,
+      severity: run.completed ? "broken" : "info",
+      check: "missing_event",
+      platform: ev.platform,
+      event: ev.name,
+      detail: !run.completed ? d.missingEventEarly(ev.name) : setting ? d.missingEnhanced(ev.name, setting) : d.missingEvent(ev.platform, ev.name),
+    });
   }
 
   // Required parameters missing on events that did fire (reported once per event).
@@ -410,7 +440,7 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   if (rejectStep !== null) {
     const reject = run.steps.find((s) => s.index === rejectStep);
     const regranted = run.dataLayerLog.find(
-      (e) => e.step >= rejectStep && isConsentCommand(e, "update") && Object.values(e.value[2] ?? {}).includes("granted"),
+      (e) => e.step >= rejectStep && isConsentCommand(e, "update") && TRACKING_SIGNALS.some((k) => e.value[2]?.[k] === "granted"),
     );
     if (regranted) findings.push({ ...base, severity: "broken", check: "reject_ignored", step: stepLabel(regranted.step), detail: d.rejectIgnored() });
     else if (reject?.bannerOpenAfter) findings.push({ ...base, severity: "broken", check: "reject_button_failed", step: stepLabel(rejectStep), detail: d.rejectButtonFailed() });
@@ -495,7 +525,7 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   }
 
   // Events that are not in the plan. Without a plan every event would be listed, which says nothing.
-  const unplanned = [...new Set(run.hits.filter((h) => !planEventFor(h)).map((h) => key(h.platform, h.name)))];
+  const unplanned = [...new Set(run.hits.filter((h) => !planEventFor(h) && !isGa4Builtin(h.platform, h.name)).map((h) => key(h.platform, h.name)))];
   if (hasPlan && unplanned.length) {
     findings.push({ ...base, severity: "info", check: "unplanned_events", detail: d.unplanned(unplanned) });
   }
@@ -557,10 +587,12 @@ export function planCheck(plan, runs, findings) {
       const own = findings.filter((f) => f.event && walked.some((r) => r.journeyId === f.journey && r.viewport === f.viewport) && hitMatchesEvent(ev, { platform: f.platform, name: f.event }));
       const params = own.filter((f) => f.check === "missing_params");
       const values = own.filter((f) => WRONG_VALUE_CHECKS.has(f.check));
-      const fired = walked.some((r) => r.hits.some((h) => hitMatchesEvent(ev, h)));
+      const fired = walked.some((r) => eventFired(ev, r.hits));
       if (params.length) entry.bucket = "missing_params";
       else if (values.length) entry.bucket = "wrong_values";
-      else entry.bucket = fired ? "implemented" : "missing";
+      else if (fired) entry.bucket = "implemented";
+      // GA4 makes these without a tag, so not seeing one says nothing about the site's setup.
+      else entry.bucket = isGa4Automatic(ev.platform, ev.name) ? "not_checked" : "missing";
       const details = [...new Set([...params, ...values].map((f) => f.detail))];
       if (details.length) entry.details = details;
     }
@@ -571,7 +603,7 @@ export function planCheck(plan, runs, findings) {
   for (const r of runs) {
     if (!findings.some((f) => f.check === "unplanned_events" && f.journey === r.journeyId && f.viewport === r.viewport)) continue;
     for (const h of r.hits) {
-      if (events.some((e) => hitMatchesEvent(e, h)) || seen.has(key(h.platform, h.name))) continue;
+      if (events.some((e) => hitMatchesEvent(e, h)) || isGa4Builtin(h.platform, h.name) || seen.has(key(h.platform, h.name))) continue;
       seen.add(key(h.platform, h.name));
       entries.push({ platform: h.platform, event: h.name, bucket: "unplanned", journeys: [r.journeyId] });
     }

package/src/html/journeys.js

@@ -65,8 +65,10 @@ function pushesForHit(run, hit) {
 
 /** The network request that carried the hit. Identical hits (duplicates) are paired with identical requests in order. */
 function callsForHit(run, hit) {
-  const calls = (run.network ?? []).filter((c) => c.step === hit.step && c.url === hit.url);
-  const twins = run.hits.filter((h) => h.step === hit.step && h.url === hit.url);
+  // A late hit was sent during a later step, so its request is recorded there.
+  const sentIn = hit.late?.during ?? hit.step;
+  const calls = (run.network ?? []).filter((c) => c.step === sentIn && c.url === hit.url);
+  const twins = run.hits.filter((h) => (h.late?.during ?? h.step) === sentIn && h.url === hit.url);
   return twins.length > 1 && calls.length === twins.length ? [calls[twins.indexOf(hit)]] : calls;
 }
 
@@ -216,7 +218,7 @@ function runState(ctx, rows, run) {
 /* ---------- step pane: hits ---------- */
 
 /** The 1–3 parameters a practitioner scans first: missing required ones, value, items, the order id; a page title when there is nothing else. */
-function keyBits(ctx, t, hit, flag) {
+function keyBits(ctx, t, hit, flag, run) {
   const { m } = ctx;
   const p = hit.params ?? {};
   const out = [];
@@ -228,6 +230,7 @@ function keyBits(ctx, t, hit, flag) {
   if (p.transaction_id) out.push(kv("transaction_id", p.transaction_id));
   if (hit.delivery === "server") out.push(`<span class="chip plain">${esc(m.ui.serverSideTag)}</span>`);
   if (!out.length && p.page_title) out.push(kv("", p.page_title));
+  if (hit.late) out.unshift(`<span class="chip plain" title="${esc(m.ui.lateHitTip((run?.steps ?? []).find((s) => s.index === hit.late.during)?.label ?? hit.late.during))}">${esc(m.ui.lateHit(hit.late.ms))}</span>`);
   if (!out.length) return `<span class="muted">${esc(m.ui.noParameters)}</span>`;
   return out.slice(0, 3).join("");
 }
@@ -261,10 +264,10 @@ function hitCard(ctx, t, rows, run, ri, step, hit, k) {
   const label = PROVIDERS[safeKey(hit.platform)] ?? platformLabel(hit.platform);
   const calls = callsForHit(run, hit);
   const reqLine = calls.length
-    ? calls.map((c) => `<a class="mono" href="#${requestId(ri, step.index, stepCalls.indexOf(c))}">${esc(c.method ?? "")} ${esc(hostPath(c.url))} ${esc(c.status ?? "")}</a>${c.blocked ? `<span class="muted">${esc(m.html.blockedBy(label))}</span>` : ""}`).join("")
+    ? calls.map((c) => `<a class="mono" href="#${requestId(ri, c.step, (c.step === step.index ? stepCalls : requestsOf(run, c.step)).indexOf(c))}">${esc(c.method ?? "")} ${esc(hostPath(c.url))} ${esc(c.status ?? "")}</a>${c.blocked ? `<span class="muted">${esc(m.html.blockedBy(label))}</span>` : ""}`).join("")
     : `<span class="mono">${esc(hostPath(hit.url))}</span>`;
   const card = flag ? ids.get(flag) : null;
-  return `<details class="card jr-hit${sev ? ` sev-${sev}` : ""}" id="${id}"${sev ? ` data-flagged="${sev}" data-print-open` : ""}><summary><span class="jr-c-p">${platChip(hit.platform)}</span><code class="jr-ev">${esc(hit.name)}</code><span class="jr-c-k">${keyBits(ctx, t, hit, flag)}</span><span class="jr-c-c">${hitConsent(t, hit.consent)}</span><span class="jr-c-s">${sev ? badge(sev, m.severity[sev]) : ""}</span><span class="jr-tm">${esc(secs(run, hit.t))}</span></summary>
+  return `<details class="card jr-hit${sev ? ` sev-${sev}` : ""}" id="${id}"${sev ? ` data-flagged="${sev}" data-print-open` : ""}><summary><span class="jr-c-p">${platChip(hit.platform)}</span><code class="jr-ev">${esc(hit.name)}</code><span class="jr-c-k">${keyBits(ctx, t, hit, flag, run)}</span><span class="jr-c-c">${hitConsent(t, hit.consent)}</span><span class="jr-c-s">${sev ? badge(sev, m.severity[sev]) : ""}</span><span class="jr-tm">${esc(secs(run, hit.t))}</span></summary>
 <div class="body">${flag ? `<p class="jr-flag sev-${sev}">${use(`sev-${sev}`, 14)}<span>${detailHtml(flag.detail)}</span>${card ? `<a href="#${card}">${esc(m.html.findingLink)}</a>` : ""}</p>` : ""}
 <div class="jr-hb"><div><h4 class="jr-h">${esc(m.ui.parameters)}${n(event.length + missing.length)}</h4>${batch ? `<p class="muted xs jr-batch">${esc(m.ui.inBatch(batch[0], batch[1]))}</p>` : ""}${paramTable}${ctxTable}</div>
 ${items.length ? `<div><h4 class="jr-h">${esc(m.ui.items)}${n(items.length)}</h4>${itemsTable(m, t, items)}</div>` : ""}

package/src/i18n.js

@@ -24,6 +24,8 @@ const journeysOf = (v) => v?.journeys ?? {};
 
 const en = {
   name: "English",
+  // The enhanced measurement settings as GA4's web stream page names them.
+  ga4Settings: { pageViews: "Page views", scrolls: "Scrolls", outboundClicks: "Outbound clicks", siteSearch: "Site search", videoEngagement: "Video engagement", fileDownloads: "File downloads", formInteractions: "Form interactions" },
   severity: { broken: "Broken", risk: "Risk", warning: "Warning", info: "Info", ok: "OK" },
   ui: {
     title: (host) => `ai tag debugger report: ${host}`,
@@ -78,6 +80,8 @@ const en = {
     customItemParams: "Custom item parameters",
     noItems: "no items",
     serverSideTag: "server-side",
+    lateHit: (ms) => `arrived ${(ms / 1000).toFixed(1)} s late`,
+    lateHitTip: (step) => `Sent after this step was over, during "${step}". It belongs to this step's page.`,
     source: "Source",
     request: "Request",
     noPushes: "No dataLayer pushes in this step.",
@@ -246,6 +250,8 @@ const en = {
     journeyIncomplete: (note) => `The journey did not reach its goal${note ? `: ${note}` : "."} Events after that point could not be checked.`,
     missingEvent: (platform, name) => `${label(platform)} ${q(name)} was not sent on this journey, although the journey reached its goal. ${label(platform)} recorded nothing for it.`,
     missingEventEarly: (name) => `${q(name)} was not seen, but the journey stopped early, so it is unverified rather than missing.`,
+    missingEnhanced: (name, setting) => `GA4 ${q(name)} was not sent on this journey, although the journey reached its goal. GA4 sends it by itself, with no tag, when enhanced measurement is on: in GA4, Admin > Data streams > the web stream > Enhanced measurement, switch on "${en.ga4Settings[setting]}". A tag that sends it instead works too.`,
+    missingAutomatic: (name) => `GA4 ${q(name)} was not seen. GA4 makes it by itself, with no tag (first_visit and session_start from flags on its other hits, user_engagement when the page is hidden or left), so it needs no setup and is not counted as missing.`,
     missingParams: (name, params) => `${q(name)} was sent without ${andList(sortParams(params).map(q), "and")}.`,
     duplicate: (name, n) => `${q(name)} was sent ${n} times by one action. Every real one is counted ${n} times.`,
     purchaseValueZero: (platform, name, v) => `${label(platform)} ${q(name)} was sent with value ${q(v)}. A purchase worth 0 or less adds no revenue, so ad platforms cannot optimise bids on it.`,
@@ -333,6 +339,7 @@ const en = {
     pii_datalayer: "The dataLayer holds unhashed personal data, so every script on the page can read it, not only the tag that needs it.",
     journey_incomplete: "The browser could not finish this journey, so every event after that point, including any conversion, is unverified.",
     unplanned_events: "Events fire that are not in the plan: either the plan is out of date or tags send things nobody asked for.",
+    ga4_automatic_event: "Nothing is lost: GA4 makes this event itself, and a short test visit can end before it does.",
     planned_out_of_scope: "Some planned events are on platforms this run did not check, so their status is unknown.",
     matches_plan: "These planned events fired with everything the plan requires.",
   },
@@ -369,6 +376,7 @@ const en = {
     pii_datalayer: "Push user data to the dataLayer already hashed, or restrict it to the tag that needs it and clear it afterwards.",
     journey_incomplete: "Read the note for why the browser stopped (a blocked click, a missing element, an error), fix the page or the step, and re-run the journey.",
     unplanned_events: "Add the events to the measurement plan if they are wanted, or remove the tags that send them.",
+    ga4_automatic_event: "No fix is needed. Keep the event in the plan for reference, or remove it, since no tag has to send it.",
     planned_out_of_scope: "Include their platforms in the next run's providers so they are checked.",
     matches_plan: "Nothing to fix.",
   },
@@ -405,6 +413,7 @@ const en = {
     pii_datalayer: "legal",
     journey_incomplete: "hygiene",
     unplanned_events: "hygiene",
+    ga4_automatic_event: "hygiene",
     planned_out_of_scope: "hygiene",
     matches_plan: "hygiene",
   },
@@ -720,6 +729,7 @@ const en = {
 
 const tr = {
   name: "Turkish",
+  ga4Settings: { pageViews: "Sayfa görüntülemeleri", scrolls: "Kaydırmalar", outboundClicks: "Giden tıklamalar", siteSearch: "Site araması", videoEngagement: "Video etkileşimi", fileDownloads: "Dosya indirmeleri", formInteractions: "Form etkileşimleri" },
   severity: { broken: "Bozuk", risk: "Risk", warning: "Uyarı", info: "Bilgi", ok: "Sorunsuz" },
   ui: {
     title: (host) => `ai tag debugger raporu: ${host}`,
@@ -774,6 +784,8 @@ const tr = {
     customItemParams: "Özel ürün parametreleri",
     noItems: "ürün yok",
     serverSideTag: "sunucu tarafı",
+    lateHit: (ms) => `${(ms / 1000).toFixed(1).replace(".", ",")} sn gecikmeli geldi`,
+    lateHitTip: (step) => `Bu adım bittikten sonra, "${step}" sırasında gönderildi. Bu adımın sayfasına ait.`,
     source: "Kaynak",
     request: "İstek",
     noPushes: "Bu adımda dataLayer gönderimi yok.",
@@ -938,6 +950,8 @@ const tr = {
     journeyIncomplete: (note) => `Yolculuk hedefine ulaşmadı${note ? `: ${note}` : "."} Bu noktadan sonraki olaylar kontrol edilemedi.`,
     missingEvent: (platform, name) => `${label(platform)} ${q(name)} bu yolculukta gönderilmedi; oysa yolculuk hedefine ulaştı. ${label(platform)} bu olay için hiçbir veri almadı.`,
     missingEventEarly: (name) => `${q(name)} görülmedi; ancak yolculuk erken durduğu için bu olay eksik değil, doğrulanmamış sayılır.`,
+    missingEnhanced: (name, setting) => `GA4 ${q(name)} bu yolculukta gönderilmedi; oysa yolculuk hedefine ulaştı. GA4 bu olayı geliştirilmiş ölçüm açıkken etiket gerekmeden kendisi gönderir: GA4'te Yönetici > Veri akışları > web akışı > Geliştirilmiş ölçüm altında "${tr.ga4Settings[setting]}" ayarını açın. Olayı gönderen bir etiket de aynı işi görür.`,
+    missingAutomatic: (name) => `GA4 ${q(name)} görülmedi. GA4 bu olayı etiket gerekmeden kendisi oluşturur (first_visit ve session_start diğer isteklerindeki işaretlerden, user_engagement sayfa gizlendiğinde ya da kapatıldığında), bu yüzden kurulum gerektirmez ve eksik sayılmaz.`,
     missingParams: (name, params) => `${q(name)} olayı ${andList(sortParams(params).map(q), "ve")} ${params.length > 1 ? "parametreleri" : "parametresi"} olmadan gönderildi.`,
     duplicate: (name, n) => `${q(name)} tek bir işlemde ${n} kez gönderildi. Her gerçek olay ${n} kez sayılıyor.`,
     purchaseValueZero: (platform, name, v) => `${label(platform)} ${q(name)} ${q(v)} değeriyle gönderildi. 0 veya daha düşük değerli bir satın alma gelire eklenmez; reklam platformları teklifleri buna göre optimize edemez.`,
@@ -1024,6 +1038,7 @@ const tr = {
     pii_datalayer: "dataLayer karma yapılmamış kişisel veri tutuyor; sayfadaki her betik bunu okuyabilir, yalnızca ihtiyaç duyan etiket değil.",
     journey_incomplete: "Tarayıcı bu yolculuğu bitiremedi; o noktadan sonraki her olay, dönüşüm dâhil, doğrulanmamış durumda.",
     unplanned_events: "Planda olmayan olaylar gönderiliyor: ya plan güncel değil ya da etiketler kimsenin istemediği şeyler gönderiyor.",
+    ga4_automatic_event: "Kayıp yok: GA4 bu olayı kendisi oluşturur ve kısa bir test ziyareti o olay gönderilmeden bitebilir.",
     planned_out_of_scope: "Plandaki bazı olaylar bu çalıştırmanın kontrol etmediği platformlarda; durumları bilinmiyor.",
     matches_plan: "Plandaki bu olaylar, planın istediği her şeyle birlikte gönderildi.",
   },
@@ -1058,6 +1073,7 @@ const tr = {
     pii_datalayer: "Kullanıcı verisini dataLayer'a karma yapılmış olarak gönderin ya da yalnızca ihtiyaç duyan etiketle sınırlayıp ardından temizleyin.",
     journey_incomplete: "Tarayıcının neden durduğunu nottan okuyun (engellenen bir tıklama, bulunamayan bir öğe, bir hata), sayfayı ya da adımı düzeltin ve yolculuğu yeniden çalıştırın.",
     unplanned_events: "İstenen olayları ölçüm planına ekleyin ya da onları gönderen etiketleri kaldırın.",
+    ga4_automatic_event: "Düzeltme gerekmez. Olayı başvuru için planda tutabilir ya da kaldırabilirsiniz; hiçbir etiketin göndermesi gerekmez.",
     planned_out_of_scope: "Kontrol edilmeleri için platformlarını bir sonraki çalıştırmanın sağlayıcılarına ekleyin.",
     matches_plan: "Düzeltilecek bir şey yok.",
   },
@@ -1093,6 +1109,7 @@ const tr = {
     pii_datalayer: "legal",
     journey_incomplete: "hygiene",
     unplanned_events: "hygiene",
+    ga4_automatic_event: "hygiene",
     planned_out_of_scope: "hygiene",
     matches_plan: "hygiene",
   },

package/src/mcp.js

@@ -17,7 +17,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { AuditSession } from "./browser.js";
 import { navigationError, privateHostChecker } from "./guard.js";
 import { collect, pageView, SYSTEM_PROMPT } from "./agent.js";
-import { checkRun, groupFindings, summarize } from "./checks.js";
+import { checkRun, groupFindings, isConsentCommand, summarize } from "./checks.js";
 import { LANGUAGES, messages } from "./i18n.js";
 import { loadConfig, readJson, runAudit, writeReports } from "./audit.js";
 import { validatePlan } from "./schema.js";
@@ -29,7 +29,7 @@ import { checkTopic, discoverPlan, TOPICS } from "./discover.js";
 import { createProvider } from "./providers.js";
 import { savePlan } from "./plan.js";
 import { changesLines, sinceLastRun } from "./changes.js";
-import { DEFAULT_PROVIDERS, PROVIDERS as TRACKING_PROVIDERS } from "./parsers.js";
+import { DEFAULT_PROVIDERS, isCollectionEndpoint, parseTrackingRequest, PROVIDERS as TRACKING_PROVIDERS } from "./parsers.js";
 import { expectEvents, filterFindings, JOURNEY_PRESETS, onlyEvents, presetFor, withPresetEvents } from "./journeys.js";
 
 const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
@@ -64,20 +64,68 @@ const audits = new Map();
 const text = (t) => ({ content: [{ type: "text", text: t }] });
 const fail = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 
-function describeHit(h) {
-  const params = Object.entries(h.params ?? {})
-    .filter(([k]) => !["v", "tid", "gtm", "_p", "cid", "sid", "_s", "sct", "seg", "dl", "dr", "dt", "ul", "sr", "_et", "en"].includes(k))
-    .slice(0, 12)
-    .map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`.slice(0, 120))
-    .join(", ");
-  return `- ${h.platform} ${h.name}${h.consent ? ` [consent ${Object.entries(h.consent).map(([k, v]) => `${k}=${v}`).join(" ")}]` : ""}${params ? `: ${params}` : ""}`;
+// Kept whole in the step result, wherever they appear: the end of a page address is where a UTM
+// parameter or a gclid gets lost, so cutting it hides exactly what a campaign check needs.
+const WHOLE_FIELDS = new Set(["page_location", "page_referrer"]);
+const VALUE_LIMIT = 120;
+const PUSH_LIMIT = 200;
+const cut = (s, n) => (s.length > n ? `${s.slice(0, n)}…` : s);
+const show = (v) => (typeof v === "string" ? v : JSON.stringify(v));
+
+/** The page address fields anywhere in a pushed object, a few levels deep, as [name, value]. */
+function wholeFieldsIn(value, depth = 0, out = []) {
+  if (!value || typeof value !== "object" || depth > 3) return out;
+  for (const [k, v] of Object.entries(value)) {
+    if (WHOLE_FIELDS.has(k) && typeof v === "string") out.push([k, v]);
+    else wholeFieldsIn(v, depth + 1, out);
+  }
+  return out;
+}
+
+function describeHit(h, steps) {
+  const entries = Object.entries(h.params ?? {}).filter(([k]) => !["v", "tid", "gtm", "_p", "cid", "sid", "_s", "sct", "seg", "dl", "dr", "dt", "ul", "sr", "_et", "en"].includes(k));
+  const params = [
+    ...entries.filter(([k]) => !WHOLE_FIELDS.has(k)).slice(0, 12).map(([k, v]) => cut(`${k}=${show(v)}`, VALUE_LIMIT)),
+    ...entries.filter(([k]) => WHOLE_FIELDS.has(k)).map(([k, v]) => `${k}=${show(v)}`),
+  ].join(", ");
+  const late = h.late ? ` (arrived ${(h.late.ms / 1000).toFixed(1)} s late, after the step that loaded its page: "${steps[h.step]?.label ?? `step ${h.step}`}")` : "";
+  return `- ${h.platform} ${h.name}${h.consent ? ` [consent ${Object.entries(h.consent).map(([k, v]) => `${k}=${v}`).join(" ")}]` : ""}${params ? `: ${params}` : ""}${late}`;
+}
+
+/** A consent command in full, as key=value; any other push as JSON, cut, with its page address fields whole. */
+function describePush(p) {
+  if (isConsentCommand(p, "default") || isConsentCommand(p, "update")) {
+    const signals = p.value[2] && typeof p.value[2] === "object" ? Object.entries(p.value[2]).map(([k, v]) => `${k}=${show(v)}`).join(" ") : show(p.value[2]);
+    return `- consent ${p.value[1]}: ${signals}`;
+  }
+  const json = JSON.stringify(p.value) ?? String(p.value);
+  const whole = json.length > PUSH_LIMIT ? wholeFieldsIn(p.value) : [];
+  return `- ${cut(json, PUSH_LIMIT)}${whole.length ? ` (${whole.map(([k, v]) => `${k}=${v}`).join(", ")})` : ""}`;
+}
+
+/** A call to a tracking endpoint that carries no event the tool reads, such as a Consent Mode ping, with its consent parameters. */
+function describeCall(c) {
+  let u;
+  try {
+    u = new URL(c.url);
+  } catch {
+    return `- ${c.vendor ?? c.provider} ${cut(c.url, VALUE_LIMIT)}`;
+  }
+  const signals = ["gcs", "gcd", "dma", "npa"].filter((k) => u.searchParams.has(k)).map((k) => `${k}=${u.searchParams.get(k)}`).join(" ");
+  return `- ${c.vendor ?? c.provider}: ${u.hostname}${u.pathname}${signals ? ` [${signals}]` : ""}`;
 }
 
-function stepCapture(audit, step) {
-  const hits = audit.session.hits.filter((h) => h.step === step);
-  const pushes = audit.session.dataLayerLog.filter((e) => e.step === step);
-  const lines = [`Tracking hits sent by this step: ${hits.length}`, ...hits.map(describeHit)];
-  if (pushes.length) lines.push(`dataLayer pushes: ${pushes.map((p) => JSON.stringify(p.value).slice(0, 160)).join(" | ")}`);
+export function stepCapture(audit, step) {
+  const { session } = audit;
+  const hits = session.hits.filter((h) => h.step === step);
+  const pushes = session.dataLayerLog.filter((e) => e.step === step);
+  // Hits that arrived during this step for a page an earlier step loaded are listed there, and noted here.
+  const lateHere = session.hits.filter((h) => h.late?.during === step);
+  const pings = session.network.filter((c) => c.step === step && isCollectionEndpoint(c.url) && !parseTrackingRequest(c.url, c.postData ?? null));
+  const lines = [`Tracking hits sent by this step: ${hits.length}`, ...hits.map((h) => describeHit(h, session.steps))];
+  if (lateHere.length) lines.push(`Arrived during this step but belong to the step that loaded their page: ${lateHere.map((h) => `${h.platform} ${h.name} (step "${session.steps[h.step]?.label ?? h.step}")`).join(", ")}`);
+  if (pings.length) lines.push("Other calls to analytics and ad endpoints, not read as events (Consent Mode pings, resends, remarketing):", ...pings.map(describeCall));
+  if (pushes.length) lines.push("dataLayer pushes:", ...pushes.map(describePush));
   return lines.join("\n");
 }
 

package/src/parsers.js

@@ -64,6 +64,8 @@ export function parseGa4(url, postData) {
     for (const [k, v] of new URLSearchParams(line)) merged.set(k, v);
     const items = [...merged].filter(([k]) => /^pr\d+$/.test(k)).map(([, v]) => v);
     const user = [...merged].filter(([k]) => isUserDataKey(k));
+    // GA4 makes first_visit and session_start from these flags on another hit; they are never sent by name.
+    const autoEvents = [["_fv", "first_visit"], ["_ss", "session_start"]].filter(([flag]) => merged.has(flag)).map(([, name]) => name);
     return {
       platform: "ga4",
       delivery: ga4Delivery(u),
@@ -72,6 +74,7 @@ export function parseGa4(url, postData) {
       params: ga4ParamsFrom(merged),
       consent: ga4Consent(merged),
       ...(items.length ? { items } : {}),
+      ...(autoEvents.length ? { autoEvents } : {}),
       ...(user.length ? { userFields: Object.fromEntries(user) } : {}),
       url,
     };

package/src/verify.js

@@ -14,6 +14,7 @@ const OWNER_BY_CHECK = {
   server_side: "developer",
   unplanned_events: "marketing",
   planned_out_of_scope: "marketing",
+  ga4_automatic_event: "marketing",
 };
 
 /** Who most likely fixes this finding: the site's developer, whoever runs Tag Manager, or marketing (the plan itself). Tag and consent setup is the default. */