@analitikisler/ai-tag-debugger 0.22.3 → 0.22.5

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.22.5 (2026-11-04)
+
+- Runs can report findings 0.22.4 did not on the same site (`container_not_run`, `container_held`). A baseline written with 0.22.4 can then list new entries; `--update-baseline` rewrites it.
+- After every step the tool reads Google's own registry of the containers that ran (`google_tag_manager`), so the Google containers card, `report.md` and MCP say when a container never ran, however its script got into the page.
+- New check `container_not_run` (warning): a GTM container was downloaded or asked for but never ran on any page of the run, so none of its tags fired. When a consent platform held it back and the run never consented, `container_held` (info) says so instead.
+- Fixed: a container the page only preloaded (`<link rel="preload">`, as Next.js does before its own code adds the script) or that ran without the tool seeing it added (as when a consent platform's auto-blocking replaces the browser's own functions) was missing from the containers card. It now has a row saying which.
+- Found on a live Next.js site: GTM was only preloaded and never ran, because the site's own scripts were served as HTML and its app crashed on start. `page_crashed` reported the crash; the containers card now also shows that GTM never ran.
+
+## 0.22.4 (2026-11-04)
+
+- Runs can report a finding 0.22.3 did not on the same site (`iframe_message_unhandled`). A baseline written with 0.22.3 can then list new entries; `--update-baseline` rewrites it.
+- New **Messages from iframes** card under the inventory and a table in `report.md`: each event an iframe posted to the page with `postMessage` (a form or checkout saying it is done), and what the page did next: pushed or sent the same event, did something else within 3 seconds (perhaps the same event under another name), or nothing. Only the message's name and field names are recorded, never values. Housekeeping messages (resizing, ready and heartbeat pings) are left out. `capture.json` keeps them under `frameMessages`.
+- New check `iframe_message_unhandled` (info): an iframe posted an event to the page, but the page pushed nothing to its dataLayer and sent no hit right after, so a conversion completed in the iframe can go untracked.
+- MCP: step results list the messages iframes posted at that step, `finish_audit` and `run_audit` end with them and what the page did, the JSON timeline lists them per step under `iframe_messages`, and `get_report` returns them with `part: "messages"`.
+- New guide, [Google containers, embedded widgets and iframes](docs/guides/containers-and-widgets.md), in English and Turkish: what the containers, widgets and messages cards show, what each of their findings usually means and how to fix it, with a page listener that relays an iframe's event to the dataLayer.
+
 ## 0.22.3 (2026-11-04)
 
 - Runs can report a finding 0.22.2 did not on the same site (`widget_events_unshared`). A baseline written with 0.22.2 can then list new entries; `--update-baseline` rewrites it.

package/README.md

@@ -327,7 +327,7 @@ Under the inventory, **Google containers** lists every GTM container (`gtm.js`)
 
 Each row also gives the container's published version (the number its `gtm.js` or `gtag/js` data opens with, as in GTM's Versions tab), the script's size and how long it took to load, the dataLayer the container reads (`l=`), whether it came from Google or from the site's own domain (the Google tag gateway or a server container), the GTM environment when the snippet names one, and the pages it loaded on. A container reading a dataLayer of another name has its pushes recorded too, marked with that name. `report.md` has the same table. Over MCP, step results and `get_step` list the containers each step loaded, `get_containers` lists them all while the audit is open, `finish_audit` and `run_audit` end with them, `get_report` returns them with `part: "containers"` and the JSON timeline carries them per step. `capture.json` keeps the loads under `containerLoads`. The environment token (`gtm_auth`) and the page's query string are never kept.
 
-Five checks read it: `container_failed` (warning) for a container script that failed to load or was answered with an error, so none of its tags ran, `container_duplicate` (warning) for a container loaded more than once into one page, `container_environment` (warning) for a GTM environment (`gtm_preview`, `gtm_auth`) loaded instead of Live, `datalayer_split` (info) for containers on one page reading different dataLayers, and `container_send_to_only` (info) for a destination that only an event's `send_to` loaded, with no `gtag('config')` for it.
+[The guide](docs/guides/containers-and-widgets.md) explains each finding below with what to do. After every step the tool also reads Google's own registry of the containers that ran (`google_tag_manager`), so a container that downloaded but never ran is reported, and a container the page only preloaded (`<link rel="preload">`), or that ran without the tool seeing it added, still gets a row. Seven checks read it: `container_not_run` (warning) for a GTM container that was downloaded or asked for but never ran, so none of its tags fired, or `container_held` (info) instead when a consent platform held it back and the run never consented; `container_failed` (warning) for a container script that failed to load or was answered with an error, so none of its tags ran, `container_duplicate` (warning) for a container loaded more than once into one page, `container_environment` (warning) for a GTM environment (`gtm_preview`, `gtm_auth`) loaded instead of Live, `datalayer_split` (info) for containers on one page reading different dataLayers, and `container_send_to_only` (info) for a destination that only an event's `send_to` loaded, with no `gtag('config')` for it.
 
 ### Embedded widgets and iframes
 
@@ -337,6 +337,8 @@ A widget's own hits are left out of everything that judges the site's tracking:
 
 Each widget also gets a line in the **Embedded widgets** card under the inventory and a table in `report.md`: the pages it was embedded in, the containers it loaded itself, the tracking it sent to its own accounts and to the site's, and the events and consent commands in its own dataLayer. The page's tags can't read a widget's dataLayer, so an event the widget pushed there (a `booking_complete`, say) reaches the site's accounts only if the widget sends it to them. The events no hit to the site's accounts carried are listed as not sent, and reported as `widget_events_unshared` (info): a booking or payment completed in the widget can be missing from the site's analytics and ad accounts.
 
+When an iframe posts an event to the page with `postMessage` (a form or checkout saying it is done), the **Messages from iframes** card lists it with what the page did next: pushed or sent the same event, did something else within 3 seconds (perhaps the same event under another name), or nothing, which is reported as `iframe_message_unhandled` (info). Only the message's name and field names are recorded, never values; housekeeping messages (resizing, ready and heartbeat pings) are left out. `capture.json` keeps them under `frameMessages`. The guide [Google containers, embedded widgets and iframes](docs/guides/containers-and-widgets.md) explains every finding here with what to do, including a page listener that relays an iframe's event to the dataLayer.
+
 `capture.json` keeps the widget's hits under `widgetHits` and its pushes under `widgetDataLayerLog`, and every iframe entry has a `frame`. The Google containers card says which ran in an iframe. Over MCP, step results mark each hit from an iframe and whether the plan checks will count it, pushes from an iframe are prefixed with it, and the JSON timeline lists a widget's hits per step under `widget_hits`. Captures from older versions have no frames, so all of their hits stay the site's.
 
 ### Folder layout and plan IDs
@@ -669,7 +671,7 @@ Tools the server offers:
 | `consent_matrix` | Opens a site's start page like an ad click once per consent choice (no choice and on to the next page, accept all, reject all, analytics only), each in a fresh browser, and returns which tags sent after each choice and the [consent matrix](#consent-scenarios). `campaign` takes the campaign parameters to check (as in `start_audit`), `concurrency` how many choices run at once (default 2, at most 4). About half a minute. |
 | `get_containers` | Lists every GTM container and Google tag the open audit's pages loaded so far, with how each reached the page (see [Google containers](#google-containers)), its dataLayer, host, GTM environment and the step it loaded at, as text and JSON. |
 | `get_widgets` | Lists every embedded third-party widget the open audit's pages had so far (see [Embedded widgets and iframes](#embedded-widgets-and-iframes)): where it was embedded, its containers, the tracking it sent to its own accounts and to the site's, its own dataLayer events, and the events that never reached the site's accounts, as text and JSON. |
-| `get_report` | Reads a report this server wrote, by the name `finish_audit` or `run_audit` gave: `part` `markdown` (default, `report.md`), `summary` (`summary.json`), `timeline` (the JSON timeline of every journey, with the containers each step loaded) `containers` (every Google container with how it reached the page, as JSON) or `widgets` (every embedded widget with its tracking and dataLayer events, as JSON). Only this server's own reports, over HTTP too. |
+| `get_report` | Reads a report this server wrote, by the name `finish_audit` or `run_audit` gave: `part` `markdown` (default, `report.md`), `summary` (`summary.json`), `timeline` (the JSON timeline of every journey, with the containers each step loaded) `containers` (every Google container with how it reached the page, as JSON) `widgets` (every embedded widget with its tracking and dataLayer events, as JSON) or `messages` (every event an iframe posted to the page, with what the page did next, as JSON). Only this server's own reports, over HTTP too. |
 | `run_audit` | Runs a config file end to end. With `against`, it checks the run against a saved plan and, when the config has no journeys, walks the journeys derived from that plan. `concurrency` runs that many journeys at once, each in its own browser (default 1), and `baseline` names a file of accepted findings written with `--update-baseline` (default: the config's `baseline`; see [Accept known findings](#accept-known-findings)). Local only for file paths. |
 
 `against` takes the same values as the CLI's `--against`. Over HTTP it takes only `latest`, `first` or a plan ID, never a path. Plans are the ones saved by `aitd plan --site <url>` or by `make_plan`. Ask for a plan when you want to know what to track, and for an audit when you want to know what the site sends.

package/README.tr.md

@@ -327,7 +327,7 @@ Envanterin altında **Google container'ları**, sayfaların yüklediği her GTM
 
 Her satır ayrıca container'ın yayımlanmış sürümünü (`gtm.js` ya da `gtag/js` verisinin başladığı numara; GTM'deki Sürümler sekmesindekiyle aynı), betiğin boyutunu ve ne kadar sürede yüklendiğini, container'ın okuduğu dataLayer'ı (`l=`), Google'dan mı yoksa sitenin kendi alan adından mı (Google etiket ağ geçidi ya da bir sunucu container'ı) geldiğini, snippet bir GTM ortamı adlandırıyorsa onu ve yüklendiği sayfaları verir. Başka adlı bir dataLayer okuyan container'ın push'ları da o adla işaretlenerek kaydedilir. `report.md` aynı tabloyu içerir. MCP'de adım sonuçları ve `get_step` her adımın yüklediği container'ları listeler, `get_containers` denetim açıkken hepsini listeler, `finish_audit` ve `run_audit` sonuçları onlarla biter, `get_report` onları `part: "containers"` ile döndürür ve JSON zaman akışı onları adım adım taşır. `capture.json` yüklemeleri `containerLoads` altında saklar. Ortam belirteci (`gtm_auth`) ve sayfanın sorgu dizesi asla saklanmaz.
 
-Beş kontrol bunu okur: yüklenemeyen ya da hatayla yanıtlanan, bu yüzden etiketlerinin hiçbiri çalışmayan bir container betiği için `container_failed` (uyarı), aynı sayfaya birden fazla kez yüklenen bir container için `container_duplicate` (uyarı), Live yerine yüklenen bir GTM ortamı (`gtm_preview`, `gtm_auth`) için `container_environment` (uyarı), aynı sayfada farklı dataLayer'ları okuyan container'lar için `datalayer_split` (bilgi) ve kendisi için `gtag('config')` olmadan yalnızca bir olayın `send_to` değeriyle yüklenen bir hedef için `container_send_to_only` (bilgi).
+[Rehber](docs/guides/containers-and-widgets.tr.md) aşağıdaki her bulguyu ne yapılacağıyla anlatır. Araç her adımdan sonra Google'ın çalışan container'lar kaydını (`google_tag_manager`) da okur; böylece indirilip hiç çalışmayan bir container bildirilir, sayfanın yalnızca ön yüklediği (`<link rel="preload">`) ya da eklendiği görülmeden çalışan bir container da yine bir satır alır. Yedi kontrol bunu okur: indirilen ya da istenen ama hiç çalışmayan, bu yüzden etiketlerinin hiçbiri çalışmayan bir GTM container'ı için `container_not_run` (uyarı), bir onay platformu onu beklettiyse ve çalıştırmada onay verilmediyse bunun yerine `container_held` (bilgi); yüklenemeyen ya da hatayla yanıtlanan, bu yüzden etiketlerinin hiçbiri çalışmayan bir container betiği için `container_failed` (uyarı), aynı sayfaya birden fazla kez yüklenen bir container için `container_duplicate` (uyarı), Live yerine yüklenen bir GTM ortamı (`gtm_preview`, `gtm_auth`) için `container_environment` (uyarı), aynı sayfada farklı dataLayer'ları okuyan container'lar için `datalayer_split` (bilgi) ve kendisi için `gtag('config')` olmadan yalnızca bir olayın `send_to` değeriyle yüklenen bir hedef için `container_send_to_only` (bilgi).
 
 ### Gömülü widget'lar ve iframe'ler
 
@@ -337,6 +337,8 @@ Bir widget'ın kendi istekleri, sitenin izlemesini değerlendiren her şeyin dı
 
 Her widget ayrıca envanterin altındaki **Gömülü widget'lar** kartında bir satır, `report.md` içinde de bir tablo alır: gömülü olduğu sayfalar, kendi yüklediği container'lar, kendi hesaplarına ve sitenin hesaplarına gönderdiği izleme ve kendi dataLayer'ındaki olaylar ve onay komutları. Sayfanın etiketleri bir widget'ın dataLayer'ını okuyamaz; bu yüzden widget'ın oraya gönderdiği bir olay (örneğin `booking_complete`) sitenin hesaplarına ancak widget onu oraya gönderirse ulaşır. Sitenin hesaplarına giden hiçbir isteğin taşımadığı olaylar gönderilmemiş olarak listelenir ve `widget_events_unshared` (bilgi) olarak bildirilir: widget içinde tamamlanan bir rezervasyon ya da ödeme sitenin analitik ve reklam hesaplarında eksik kalabilir.
 
+Bir iframe sayfaya `postMessage` ile bir olay gönderdiğinde (bir formun ya da ödemenin bittiğini söylemesi), **iframe'lerden gelen mesajlar** kartı onu sayfanın ardından ne yaptığıyla listeler: aynı olayı dataLayer'a gönderdi ya da iletti, 3 saniye içinde başka bir şey yaptı (belki aynı olayı başka bir adla) ya da hiçbir şey yapmadı; sonuncusu `iframe_message_unhandled` (bilgi) olarak bildirilir. Mesajın yalnızca adı ve alan adları kaydedilir, değerleri asla; düzenleme mesajları (boyutlandırma, hazır ve canlılık sinyalleri) dışarıda bırakılır. `capture.json` bunları `frameMessages` altında saklar. [Google container'ları, gömülü widget'lar ve iframe'ler](docs/guides/containers-and-widgets.tr.md) rehberi buradaki her bulguyu ne yapılacağıyla anlatır; bir iframe'in olayını dataLayer'a ileten bir sayfa dinleyicisi de içerir.
+
 `capture.json` widget'ın isteklerini `widgetHits`, push'larını `widgetDataLayerLog` altında saklar ve her iframe kaydında bir `frame` bulunur. Google container'ları kartı hangilerinin bir iframe'de çalıştığını söyler. MCP'de adım sonuçları iframe'den gelen her isteği ve plan kontrollerinin onu sayıp saymayacağını işaretler, iframe'den gelen push'ların başına iframe yazılır ve JSON zaman akışı bir widget'ın isteklerini adım adım `widget_hits` altında listeler. Eski sürümlerin kayıtlarında frame bilgisi yoktur, bu yüzden tüm istekleri sitenin olarak kalır.
 
 ### Klasör yapısı ve plan kimlikleri
@@ -669,7 +671,7 @@ Sunucunun sunduğu araçlar:
 | `consent_matrix` | Bir sitenin başlangıç sayfasını her onay seçimi için (seçim yapmadan sonraki sayfa, tümünü kabul, tümünü reddet, yalnızca analitik) bir reklam tıklaması gibi, her seferinde yeni bir tarayıcıda açar; her seçimden sonra hangi etiketlerin gönderdiğini ve [onay matrisini](#onay-senaryoları) döndürür. `campaign` kontrol edilecek kampanya parametrelerini (`start_audit`'teki gibi), `concurrency` aynı anda kaç seçimin çalışacağını alır (varsayılan 2, en fazla 4). Yaklaşık yarım dakika sürer. |
 | `get_containers` | Açık denetimin sayfalarının şimdiye kadar yüklediği her GTM container'ını ve Google etiketini, her birinin sayfaya nasıl geldiğiyle ([Google container'ları](#google-containerları)), dataLayer'ı, sunucusu, GTM ortamı ve yüklendiği adımla birlikte metin ve JSON olarak listeler. |
 | `get_widgets` | Açık denetimin sayfalarında şimdiye kadar bulunan her gömülü üçüncü taraf widget'ı ([Gömülü widget'lar ve iframe'ler](#gömülü-widgetlar-ve-iframeler)) listeler: gömülü olduğu yer, container'ları, kendi hesaplarına ve sitenin hesaplarına gönderdiği izleme, kendi dataLayer olayları ve sitenin hesaplarına hiç ulaşmayan olaylar; metin ve JSON olarak. |
-| `get_report` | Bu sunucunun yazdığı bir raporu, `finish_audit` ya da `run_audit`'in verdiği adla okur: `part` `markdown` (varsayılan, `report.md`), `summary` (`summary.json`), `timeline` (her yolculuğun JSON zaman akışı; her adımın yüklediği container'larla) `containers` (sayfaya nasıl geldiğiyle her Google container'ı, JSON olarak) ya da `widgets` (izlemesi ve dataLayer olaylarıyla her gömülü widget, JSON olarak). Yalnızca bu sunucunun kendi raporları, HTTP üzerinden de. |
+| `get_report` | Bu sunucunun yazdığı bir raporu, `finish_audit` ya da `run_audit`'in verdiği adla okur: `part` `markdown` (varsayılan, `report.md`), `summary` (`summary.json`), `timeline` (her yolculuğun JSON zaman akışı; her adımın yüklediği container'larla) `containers` (sayfaya nasıl geldiğiyle her Google container'ı, JSON olarak) `widgets` (izlemesi ve dataLayer olaylarıyla her gömülü widget, JSON olarak) ya da `messages` (bir iframe'in sayfaya gönderdiği her olay, sayfanın ardından ne yaptığıyla, JSON olarak). Yalnızca bu sunucunun kendi raporları, HTTP üzerinden de. |
 | `run_audit` | Bir ayar dosyasını baştan sona çalıştırır. `against` ile çalıştırmayı kayıtlı bir plana karşı kontrol eder; ayar dosyasında yolculuk yoksa, plandan türetilen yolculukları gezer. `concurrency` o kadar yolculuğu aynı anda, her birini kendi tarayıcısında çalıştırır (varsayılan 1); `baseline`, `--update-baseline` ile yazılmış kabul edilen bulgular dosyasını adlandırır (varsayılan: ayar dosyasındaki `baseline`; bkz. [Bilinen bulguları kabul edin](#bilinen-bulguları-kabul-edin)). Dosya yolları yalnızca yerelde çalışır. |
 
 `against`, CLI'deki `--against` ile aynı değerleri alır. HTTP üzerinden yalnızca `latest`, `first` ya da bir plan kimliği kabul edilir, asla bir yol değil. Planlar, `aitd plan --site <url>` ya da `make_plan` ile kaydedilmiş olanlardır. Neyin takip edileceğini öğrenmek için plan, sitenin ne gönderdiğini öğrenmek için denetim isteyin.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
   "mcpName": "io.github.analitikisler/ai-tag-debugger",
-  "version": "0.22.3",
+  "version": "0.22.5",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -238,7 +238,7 @@ export const journeyError = (err) => `The journey stopped with an error: ${err?.
 export function failedRun(journey, viewport, err, providers) {
   return {
     journeyId: journey.id, viewport, completed: false, note: journeyError(err), hits: [], steps: [], consentStep: null, rejectStep: null,
-    cookieLog: [], cookieChanges: [], dataLayerLog: [], containerLoads: [], network: [], widgetHits: [], widgetDataLayerLog: [], containerScripts: [], providers, skipped: {}, bodyBudgetStep: null, startedAt: Date.now(), pageErrors: [],
+    cookieLog: [], cookieChanges: [], dataLayerLog: [], containerLoads: [], network: [], widgetHits: [], widgetDataLayerLog: [], containerScripts: [], containersRunning: [], containerPreloads: [], frameMessages: [], providers, skipped: {}, bodyBudgetStep: null, startedAt: Date.now(), pageErrors: [],
   };
 }
 
@@ -259,6 +259,9 @@ export function collect(session, journey, viewport) {
     ...(session.opts.blockHits === false ? { live: true } : {}),
     containerLoads: session.containerLoads,
     containerScripts: session.containerScripts,
+    containersRunning: [...session.containersRunning].map(([id, step]) => ({ id, step })),
+    containerPreloads: [...session.containerPreloads.values()],
+    frameMessages: session.frameMessages,
     network: session.network,
     providers: session.providers,
     skipped: session.skipped,

package/src/browser.js

@@ -5,12 +5,12 @@ import { readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { chromium, devices } from "playwright";
 import { parseTrackingRequest, isCollectionEndpoint, providerOf, vendorOf, resolveProviders, PROVIDERS } from "./parsers.js";
-import { redactBody, redactParams, redactPush, redactUrl } from "./redact.js";
+import { redactBody, redactParams, redactPush, redactUrl, siteOf } from "./redact.js";
 import { hostScope, isPrivateAddress, navigationError, privateHostChecker } from "./guard.js";
 import { startEgressProxy } from "./egress.js";
 import { campaignParamsIn } from "./campaign.js";
 import { detectCmpInPage } from "./cmp.js";
-import { callersOf, containerOf, containerVersion } from "./containers.js";
+import { callersOf, containerOf, containerVersion, isContainerId } from "./containers.js";
 import { frameInfo } from "./frames.js";
 
 // Consent banners of the common consent platforms (CMPs), by their container. A cover that matches
@@ -36,7 +36,7 @@ export const CMP_BANNER_SELECTORS = `#onetrust-banner-sdk, #onetrust-consent-sdk
 // Efilli draws its banner inside the open shadow root of <efilli-layout-dynamic>, so the checks below also look inside open shadow roots.
 
 // Caps on what one audit records, so a looping page can't grow memory without limit.
-const LOG_LIMITS = { hits: 5000, dataLayerLog: 5000, network: 10000, containerLoads: 500, containerScripts: 500 };
+const LOG_LIMITS = { hits: 5000, dataLayerLog: 5000, network: 10000, containerLoads: 500, containerScripts: 500, frameMessages: 1000 };
 
 // Secrets the browser process has no use for. It gets the rest of the environment
 // (PATH, HOME, DISPLAY...) so Chromium still starts normally.
@@ -106,11 +106,41 @@ const CONTAINER_HOOK = `
     new MutationObserver((list) => {
       for (const m of list) for (const n of m.addedNodes) {
         if (n instanceof HTMLScriptElement && n.src && !seen.has(n)) { seen.add(n); report(n, n.src, "parser"); }
+        // A preload hint downloads a container without running it; caught as it is added, since a page's own code
+        // can rewrite <head> and take it out again.
+        else if (n instanceof HTMLLinkElement && /(^|\\s)(preload|modulepreload|prefetch)(\\s|$)/i.test(n.rel) && n.href && !seen.has(n)) { seen.add(n); report(n, n.href, "preload"); }
       }
     }).observe(document, { childList: true, subtree: true });
   } catch {}
 `;
 
+// Runs inside INIT_SCRIPT, in the page itself only: records each message an iframe posts to the page, through
+// window.__atdMessage. Only a name and the field names are kept, never the values, since a form iframe's message
+// can carry what the visitor typed. A message with nothing that reads as a name is not reported.
+const MESSAGE_HOOK = `
+  if (window === window.top) {
+    const nameKeys = ["event", "eventName", "event_name", "type", "action", "name", "message"];
+    const summarize = (data) => {
+      let d = data;
+      if (typeof d === "string") {
+        try { d = JSON.parse(d); } catch {
+          return d.length <= 80 && /^[\\w.:\\- ]+$/.test(d) ? { name: d, keys: [] } : null;
+        }
+      }
+      if (!d || typeof d !== "object" || Array.isArray(d)) return null;
+      const key = nameKeys.find((k) => typeof d[k] === "string" && d[k] && d[k].length <= 80);
+      return key ? { name: d[key], nameKey: key, keys: Object.keys(d).slice(0, 20) } : null;
+    };
+    addEventListener("message", (e) => {
+      try {
+        if (e.source === window || !window.__atdMessage) return;
+        const info = summarize(e.data);
+        if (info) window.__atdMessage({ origin: String(e.origin), ...info });
+      } catch {}
+    }, true);
+  }
+`;
+
 const INIT_SCRIPT = `(() => {
   const record = (entry, layer = "dataLayer") => {
     let value = entry;
@@ -172,6 +202,7 @@ const INIT_SCRIPT = `(() => {
   };
   watch("dataLayer");
 ${CONTAINER_HOOK}
+${MESSAGE_HOOK}
 })();`;
 
 // Labels the interactive elements of one frame with numeric refs, starting at
@@ -488,6 +519,17 @@ export function googleConsentStateInPage() {
   return { entries, usedDefault: Boolean(ics.usedDefault), usedUpdate: Boolean(ics.usedUpdate), wasSetLate: Boolean(ics.wasSetLate), waitPeriodTimedOut: Boolean(ics.waitPeriodTimedOut) };
 }
 
+/**
+ * Runs in the page: the IDs Google's own registry (window.google_tag_manager) holds, which are the containers and
+ * Google tags that actually ran, however their script got in; and the addresses the page only preloads
+ * (<link rel="preload">, "modulepreload", "prefetch"), which download a script without running it.
+ */
+export function containersInPage() {
+  const registry = window.google_tag_manager && typeof window.google_tag_manager === "object" ? Object.keys(window.google_tag_manager) : [];
+  const preloads = [...document.querySelectorAll('link[rel~="preload"], link[rel~="modulepreload"], link[rel~="prefetch"]')].map((l) => l.href).filter(Boolean);
+  return { registry: registry.slice(0, 200), preloads: preloads.slice(0, 200) };
+}
+
 /**
  * Runs in the page: whether it is something other than the site, so what a step captured there says nothing about
  * the site's tracking. A bot challenge in its place (Cloudflare, DataDome, HUMAN, Akamai), or a page that crashed in
@@ -549,6 +591,12 @@ export class AuditSession {
     this.dataLayerLog = [];
     this.containerLoads = []; // each Google container script the page added, with how (see src/containers.js)
     this.containerScripts = []; // each container script's answer: status, version, size and load time
+    this.containersRunning = new Map(); // container ID -> the step it was first seen running at (google_tag_manager)
+    this.containerPreloads = new Map(); // "id|host" -> { id, host, step } for containers the page only preloaded
+    this.frameMessages = []; // each named message an iframe posted to the page: origin, name and field names, never values
+    // The order hits, dataLayer pushes and iframe messages were recorded in. Several often share a millisecond, and
+    // telling which came first matters: a page's push answers the message just before it (see messageOutcomes).
+    this.seq = 0;
     this.network = [];
     this.providers = resolveProviders(this.opts.providers);
     this.landing = null; // the first page: { step, requested, chain, final }
@@ -593,8 +641,9 @@ export class AuditSession {
       const frame = frameInfo(source?.frame);
       if (frame) entry = { ...entry, frame };
       this.lastTrackingAt = Date.now();
-      this.record("dataLayerLog", { ...this.redactEntry(entry), step: this.currentStep, t: Date.now() });
+      this.record("dataLayerLog", { ...this.redactEntry(entry), step: this.currentStep, t: Date.now(), seq: ++this.seq });
     });
+    await this.context.exposeBinding("__atdMessage", (source, m) => this.recordMessage(m, source?.frame));
     await this.context.exposeBinding("__atdLoad", (source, entry) => this.recordLoad(entry, frameInfo(source?.frame)));
     await this.context.addInitScript(INIT_SCRIPT);
     this.page = await this.context.newPage();
@@ -626,7 +675,7 @@ export class AuditSession {
       const frame = this.frameOf(request);
       for (const hit of hits) {
         if (!this.checks(hit.platform)) continue;
-        const entry = { ...this.redactHit(hit), step: this.stepForHit(hit), pageUrl: this.page.url(), t: Date.now(), ...(frame ? { frame } : {}) };
+        const entry = { ...this.redactHit(hit), step: this.stepForHit(hit), pageUrl: this.page.url(), t: Date.now(), seq: ++this.seq, ...(frame ? { frame } : {}) };
         const late = this.lateFor(hit, entry);
         if (late) Object.assign(entry, late);
         if (this.record("hits", entry)) recorded.push(entry);
@@ -837,6 +886,12 @@ export class AuditSession {
   recordLoad(entry, frame = null) {
     const container = containerOf(entry?.src);
     if (!container) return;
+    // A preload hint is not a load: it downloads the script without running it (see unseenContainers).
+    if (entry.how === "preload") {
+      const k = `${container.id}|${container.host}`;
+      if (!frame && !this.containerPreloads.has(k)) this.containerPreloads.set(k, { id: container.id, host: container.host, step: this.currentStep, page: pagePath(entry.page) });
+      return;
+    }
     this.record("containerLoads", {
       ...container,
       how: entry.how === "parser" ? "parser" : "script",
@@ -874,6 +929,28 @@ export class AuditSession {
     });
   }
 
+  /**
+   * A message an iframe posted to the page: the iframe's origin, whether it is on the site's own site, the name the
+   * message carries and the names of its fields. The page's main frame reports it; values never leave the page.
+   */
+  recordMessage(m, frame) {
+    if (!m || (frame && frame !== this.page?.mainFrame())) return;
+    let party = "third";
+    try {
+      party = siteOf(new URL(m.origin).hostname) === siteOf(new URL(this.page.url()).hostname) ? "site" : "third";
+    } catch { /* an opaque origin ("null"): a sandboxed iframe, someone else's */ }
+    this.record("frameMessages", {
+      origin: String(m.origin).slice(0, 200),
+      party,
+      name: String(m.name ?? "").slice(0, 80),
+      ...(m.nameKey ? { nameKey: String(m.nameKey).slice(0, 20) } : {}),
+      keys: (Array.isArray(m.keys) ? m.keys : []).slice(0, 20).map((k) => String(k).slice(0, 40)),
+      step: this.currentStep,
+      t: Date.now(),
+      seq: ++this.seq,
+    });
+  }
+
   /** The iframe a request came from, as frameInfo gives it; null for the page itself or a worker. */
   frameOf(request) {
     try {
@@ -1185,6 +1262,15 @@ export class AuditSession {
     const tagConsent = await this.evaluateWithin(googleConsentStateInPage);
     const before = this.steps.slice(0, this.currentStep).map((st) => st.tagConsent).filter(Boolean).at(-1);
     if (tagConsent && JSON.stringify(tagConsent) !== JSON.stringify(before)) this.steps[this.currentStep].tagConsent = tagConsent;
+    // Which containers ran, and which the page only preloaded: a container can download and never run.
+    const found = await this.evaluateWithin(containersInPage);
+    for (const id of (found?.registry ?? []).map((k) => String(k).toUpperCase()).filter(isContainerId)) {
+      if (!this.containersRunning.has(id)) this.containersRunning.set(id, this.currentStep);
+    }
+    for (const c of (found?.preloads ?? []).map(containerOf).filter(Boolean)) {
+      const k = `${c.id}|${c.host}`;
+      if (!this.containerPreloads.has(k)) this.containerPreloads.set(k, { id: c.id, host: c.host, step: this.currentStep, page: pagePath(this.page.url()) });
+    }
   }
 
   async perform(a) {

package/src/checks.js

@@ -5,8 +5,8 @@ import { messages } from "./i18n.js";
 import { isOwnAddress } from "./redact.js";
 import { campaignParamsIn } from "./campaign.js";
 import { CONSENT_SIGNALS } from "./parsers.js";
-import { duplicateLoads, loadSources, scriptFailed, splitLayers } from "./containers.js";
-import { widgetSummaries, widgetsOf } from "./frames.js";
+import { containersNotRun, duplicateLoads, loadSources, scriptFailed, splitLayers } from "./containers.js";
+import { messageOutcomes, widgetSummaries, widgetsOf } from "./frames.js";
 
 const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
@@ -394,6 +394,15 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     findings.push({ ...base, severity: "warning", check: "container_failed", step: stepLabel(sc.step), detail: d.containerFailed(sc.id, sc.host, String(sc.status)) });
   }
 
+  // A GTM container downloaded or asked for that never ran. Expected while a consent platform holds it back and the
+  // run never consented; otherwise none of its tags fired.
+  const consented = consentGrantedStep(run) !== null;
+  for (const c of containersNotRun(run)) {
+    findings.push(run.cmp?.vendor && !consented
+      ? { ...base, severity: "info", check: "container_held", step: stepLabel(c.step), detail: d.containerHeld(c.id, run.cmp.vendor) }
+      : { ...base, severity: "warning", check: "container_not_run", step: stepLabel(c.step), detail: d.containerNotRun(c.id, c.kind) });
+  }
+
   // Widgets that tracked on their own, left out of the plan checks: said once per widget, so nothing goes missing silently.
   for (const w of widgetsOf(run.widgetHits ?? [])) {
     const first = (run.widgetHits ?? []).find((h) => h.frame.origin === w.origin);
@@ -403,6 +412,14 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   for (const w of widgetSummaries([run], (a, b) => canonicalEvent(a) === canonicalEvent(b)).filter((x) => x.unshared.length)) {
     findings.push({ ...base, severity: "info", check: "widget_events_unshared", step: stepLabel(w.step), detail: d.widgetEventsUnshared(w.origin, w.unshared.slice(0, 10)) });
   }
+  // An event an iframe posted to the page that the page never acted on: no push, no hit, not even under another name.
+  const unhandled = new Set();
+  for (const msg of messageOutcomes(run, (a, b) => canonicalEvent(a) === canonicalEvent(b)).filter((x) => x.outcome === "nothing")) {
+    const k = `${msg.origin}|${canonicalEvent(msg.name)}`;
+    if (unhandled.has(k)) continue;
+    unhandled.add(k);
+    findings.push({ ...base, severity: "info", check: "iframe_message_unhandled", event: msg.name, step: stepLabel(msg.step), detail: d.iframeMessageUnhandled(msg.origin, msg.name, msg.party) });
+  }
   // A container in a same-site iframe beside one in the page: two documents, two dataLayers.
   const iframeLoad = loads.find((l) => l.frame?.party === "site" && loads.some((t) => !t.frame && t.step <= l.step));
   if (iframeLoad) findings.push({ ...base, severity: "info", check: "iframe_container", step: stepLabel(iframeLoad.step), detail: d.iframeContainer(iframeLoad.id, iframeLoad.frame.origin, iframeLoad.frame.parent) });

package/src/containers.js

@@ -7,6 +7,9 @@
 // Container and destination IDs gtm.js and gtag/js are loaded with.
 const CONTAINER_ID = /^(GTM|G|GT|AW|DC|MC|HA)-[A-Z0-9]+$/;
 
+/** Whether a string is a container or Google tag ID: GTM-…, G-…, GT-…, AW-…, DC-… and the like. */
+export const isContainerId = (id) => CONTAINER_ID.test(String(id));
+
 /**
  * The container a script URL loads, or null: its ID, gtm or gtag, the dataLayer it reads (`l`), the host it
  * came from (Google's, or the site's own through the Google tag gateway or a server container) and the GTM
@@ -148,13 +151,16 @@ export function loadSources(run) {
 
 /**
  * One row per container and source across runs, in the order first seen: { id, script, layer, served, host,
- * environment?, kind, by?, frame?, version?, bytes?, transferBytes?, ms?, failed?, pages, journeys }. frame is the
- * iframe it loaded in; version to failed are its script's answer (see scriptFacts), from the first load in the row.
+ * environment?, kind, by?, frame?, version?, bytes?, transferBytes?, ms?, failed?, ran?, pages, journeys }. frame is
+ * the iframe it loaded in; version to failed are its script's answer (see scriptFacts), from the first load in the
+ * row; ran says whether Google's registry held it on some step (left out for captures that didn't record it).
+ * Containers the page asked for without the tool seeing a script added are rows too (see unseenContainers).
  */
 export function containerRows(runs) {
   const rows = new Map();
   for (const run of runs) {
-    for (const l of loadSources(run)) {
+    const ran = Array.isArray(run.containersRunning) ? new Set(run.containersRunning.map((c) => c.id)) : null;
+    for (const l of [...loadSources(run), ...unseenContainers(run)]) {
       const k = [l.id, l.kind, l.by ?? "", l.host, l.layer, l.environment ?? "", l.frame?.origin ?? ""].join("|");
       const row = rows.get(k) ?? {
         id: l.id, script: l.script, layer: l.layer, served: l.served, host: l.host,
@@ -165,12 +171,63 @@ export function containerRows(runs) {
       };
       if (l.page) row.pages.add(l.page);
       row.journeys.add(`${run.journeyId} (${run.viewport})`);
+      // Whether it ran (Google's registry held it) in any run that recorded the registry; unknown for older captures.
+      if (ran) row.ran = Boolean(row.ran) || ran.has(l.id);
       rows.set(k, row);
     }
   }
   return [...rows.values()].map((r) => ({ ...r, pages: [...r.pages].sort(), journeys: [...r.journeys] }));
 }
 
+/**
+ * Containers a run met without seeing a script added for them: a script the page requested or preloaded, or an ID
+ * that ran (Google's registry held it), with no load recorded. kind "preload": only a <link rel="preload"> asked for
+ * it, which downloads a script without running it; "unseen": something added it in a way the tool couldn't follow,
+ * as when a consent platform's auto-blocking replaces the browser's own functions. One per container and host.
+ */
+export function unseenContainers(run) {
+  const loads = run.containerLoads ?? [];
+  const loaded = (id, host) => loads.some((l) => l.id === id && (!host || l.host === host));
+  const preloads = run.containerPreloads ?? [];
+  const out = new Map();
+  // The page a step was on: the preload's own, else the step's (see pagePath in browser.js).
+  const pageAt = (step, page) => page ?? run.steps?.[step]?.pagePath ?? undefined;
+  const add = (id, host, kind, step, facts = {}, page) => {
+    const k = `${id}|${host ?? ""}`;
+    if (out.has(k) || loaded(id, host)) return;
+    const at = pageAt(step, page);
+    out.set(k, {
+      id, script: id.startsWith("GTM-") ? "gtm" : "gtag", layer: null,
+      ...(host ? { host, served: /(^|\.)googletagmanager\.com$/.test(host) ? "google" : "site" } : {}),
+      kind, step, ...(at ? { page: at } : {}), ...facts,
+    });
+  };
+  for (const sc of run.containerScripts ?? []) {
+    const pre = preloads.find((p) => p.id === sc.id && p.host === sc.host);
+    add(sc.id, sc.host, pre ? "preload" : "unseen", pre?.step ?? sc.step, scriptFacts(sc), pre?.page);
+  }
+  for (const p of preloads) add(p.id, p.host, "preload", p.step, {}, p.page);
+  for (const c of run.containersRunning ?? []) {
+    if (!loaded(c.id) && ![...out.values()].some((x) => x.id === c.id)) add(c.id, null, "unseen", c.step);
+  }
+  return [...out.values()];
+}
+
+/**
+ * GTM containers a run downloaded or asked for that never ran: Google's registry never held them on any step. Only
+ * GTM containers, whose registry entry is certain; [] for captures that didn't record the registry.
+ */
+export function containersNotRun(run) {
+  if (!Array.isArray(run.containersRunning)) return [];
+  const ran = new Set(run.containersRunning.map((c) => c.id));
+  const seen = new Map();
+  for (const l of [...loadSources(run), ...unseenContainers(run)]) {
+    if (!l.id.startsWith("GTM-") || ran.has(l.id) || l.failed || l.frame?.party === "third" || seen.has(l.id)) continue;
+    seen.set(l.id, { id: l.id, kind: l.kind, step: l.step ?? 0 });
+  }
+  return [...seen.values()];
+}
+
 /** The containers loaded more than once into one page, as [{ id, loads }] with the loads in order. */
 export function duplicateLoads(run) {
   const byDoc = new Map();

package/src/frames.js

@@ -154,3 +154,66 @@ export function widgetSummaries(runs, same = (a, b) => plainName(a) === plainNam
     };
   });
 }
+
+// A message counts as an event when it is dataLayer-shaped ({ event: ... }) or its name reads like one; frame
+// housekeeping (resizing, ready and heartbeat pings, scroll and focus) never does.
+const EVENT_KEYS = new Set(["event", "eventName", "event_name"]);
+const EVENT_WORDS = /(submit|complete|success|confirm|purchase|order|lead|book|reserv|sign.?up|register|checkout|payment|paid|conversion|subscribe|contact|quote|enquir|inquir|apply|download|add.?to.?cart)/i;
+const HOUSEKEEPING = /^(resize|height|setheight|size|ready|loaded|load|init|initialized|heartbeat|ping|pong|scroll|focus|blur|close|open|visible|hidden|iframeresizer.*|.*resize.*)$/i;
+
+/** Whether an iframe's message reads as an event the page might need to track. */
+export function isEventMessage(m) {
+  const name = String(m.name ?? "");
+  if (!name || HOUSEKEEPING.test(name.replace(/[^a-z0-9]/gi, ""))) return false;
+  return EVENT_KEYS.has(m.nameKey) || EVENT_WORDS.test(name);
+}
+
+// How long after a message the page has to react for the reaction to count as its relay under another name.
+export const RELAY_WINDOW_MS = 3000;
+
+/**
+ * What the page did after each event message an iframe posted to it, one per iframe, name and step:
+ * { origin, party, name, keys, step, t, outcome, relay? }. outcome "relayed": the page pushed or sent the same event
+ * (relay: { kind: "push"|"hit", name, ms }); "followed": within RELAY_WINDOW_MS it pushed another event or sent a hit,
+ * maybe the same event under another name; "nothing": neither. Only the page's own pushes and the site's own hits
+ * count (not an iframe's). same(a, b) compares event names, as in widgetSummaries.
+ *
+ * Each reaction of the page answers one message at most, so one iframe's relayed event never makes another's look
+ * handled. A reaction carrying a message's own name belongs to that message. Any other belongs to the latest message
+ * before it, since a page's listener reacts as the message arrives; when that message already has its answer, the
+ * reaction is a second effect of it (the hit after a push) and answers nothing else.
+ */
+export function messageOutcomes(run, same = (a, b) => plainName(a) === plainName(b)) {
+  // In recording order: seq where both have one (several often share a millisecond), else the time.
+  const order = (a, b) => (a.seq != null && b.seq != null ? a.seq - b.seq : (a.t ?? 0) - (b.t ?? 0));
+  const pushes = (run.dataLayerLog ?? []).filter((e) => !e.frame && pushedEvent(e.value)).map((e) => ({ kind: "push", name: pushedEvent(e.value), t: e.t ?? 0, seq: e.seq }));
+  const hits = (run.hits ?? []).filter((h) => !h.frame).map((h) => ({ kind: "hit", name: h.name, t: h.t ?? 0, seq: h.seq }));
+  const reactions = [...pushes, ...hits].sort(order);
+  const seen = new Set();
+  const messages = [];
+  for (const m of [...(run.frameMessages ?? [])].sort(order)) {
+    if (!isEventMessage(m)) continue;
+    const k = `${m.origin}|${m.name}|${m.step}`;
+    if (seen.has(k)) continue;
+    seen.add(k);
+    messages.push({ m, relay: null, outcome: "nothing" });
+  }
+  const used = new Set();
+  for (const msg of messages) {
+    const r = reactions.find((x) => !used.has(x) && order(x, msg.m) >= 0 && same(x.name, msg.m.name));
+    if (!r) continue;
+    Object.assign(msg, { relay: r, outcome: "relayed" });
+    used.add(r);
+  }
+  for (const r of reactions) {
+    if (used.has(r)) continue;
+    const latest = messages.filter((x) => order(x.m, r) <= 0).at(-1);
+    if (!latest || latest.relay || r.t - latest.m.t > RELAY_WINDOW_MS) continue;
+    Object.assign(latest, { relay: r, outcome: "followed" });
+    used.add(r);
+  }
+  return messages.map(({ m, relay, outcome }) => ({
+    origin: m.origin, party: m.party, name: m.name, keys: m.keys ?? [], step: m.step, t: m.t, outcome,
+    ...(relay ? { relay: { kind: relay.kind, name: relay.name, ms: Math.max(0, relay.t - m.t) } } : {}),
+  }));
+}

package/src/html/scope.js

@@ -4,7 +4,7 @@
 // vendors, the trend) is the 0.17 renderer's, so the numbers match the Markdown report and the CLI.
 import { buildInventory } from "../inventory.js";
 import { containerRows } from "../containers.js";
-import { widgetSummaries } from "../frames.js";
+import { messageOutcomes, widgetSummaries } from "../frames.js";
 import { canonicalEvent } from "../checks.js";
 import { providerOf } from "../parsers.js";
 import { siteOf } from "../redact.js";
@@ -202,7 +202,7 @@ function containersCard(ctx) {
   const rows = containerRows(runs);
   if (!rows.length) return null;
   const c = m.ui.containers;
-  const items = rows.map((r) => `<li>${code(r.id)}${plain(esc(c.script[r.script]))}<span>${esc(c.kinds[r.kind](r.by))}</span>${plain(`${esc(m.ui.layerCol)} ${code(r.layer)}`)}${plain(esc(r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`))}${r.version ? plain(esc(c.version(r.version)), "mono") : ""}${r.bytes ? plain(esc(c.size(r.bytes)), "mono") : ""}${r.ms != null ? plain(esc(c.loadTime(r.ms))) : ""}${r.failed ? badge("broken", c.failed(r.failed)) : ""}${r.frame ? plain(esc(c.iframe(r.frame.origin, r.frame.party))) : ""}${r.environment ? badge("warning", c.environment(r.environment)) : ""}<span class="inv-n">${m.html.scope.pages(r.pages.length, bold(r.pages.length))}</span></li>`).join("");
+  const items = rows.map((r) => `<li>${code(r.id)}${plain(esc(c.script[r.script]))}<span>${esc(c.kinds[r.kind](r.by))}</span>${r.ran === false ? badge("broken", c.neverRan) : ""}${r.layer ? plain(`${esc(m.ui.layerCol)} ${code(r.layer)}`) : ""}${r.served ? plain(esc(r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`)) : ""}${r.version ? plain(esc(c.version(r.version)), "mono") : ""}${r.bytes ? plain(esc(c.size(r.bytes)), "mono") : ""}${r.ms != null ? plain(esc(c.loadTime(r.ms))) : ""}${r.failed ? badge("broken", c.failed(r.failed)) : ""}${r.frame ? plain(esc(c.iframe(r.frame.origin, r.frame.party))) : ""}${r.environment ? badge("warning", c.environment(r.environment)) : ""}<span class="inv-n">${m.html.scope.pages(r.pages.length, bold(r.pages.length))}</span></li>`).join("");
   const ids = uniq(rows.map((r) => r.id));
   return `<li><details class="card inv" id="inv-containers"><summary><span class="t">${esc(m.ui.containersTitle)}</span>${plain(n(ids.length))}<span class="inv-m">${esc(ids.slice(0, 3).join(", "))}${ids.length > 3 ? " …" : ""}</span></summary><div class="body"><p class="xs muted">${esc(m.ui.containersIntro)}</p><ul class="inv-list">${items}</ul></div></details></li>`;
 }
@@ -228,6 +228,19 @@ ${x.unshared.length ? line(w.unshared, x.unshared.map(code).join(" ")) : ""}</ul
   return `<li><details class="card inv" id="inv-widgets"><summary><span class="t">${esc(m.ui.widgetsTitle)}</span>${plain(n(widgets.length))}<span class="inv-m">${esc(widgets.slice(0, 3).map((x) => x.origin.replace(/^https?:\/\//, "")).join(", "))}${widgets.length > 3 ? " …" : ""}</span></summary><div class="body"><p class="xs muted">${esc(m.ui.widgetsIntro)}</p><ul class="inv-rows">${items}</ul></div></details></li>`;
 }
 
+/** The events iframes posted to the page and what the page did next, one line each. Null when there were none. */
+function messagesCard(ctx) {
+  const { m, runs } = ctx;
+  const same = (a, b) => canonicalEvent(a) === canonicalEvent(b);
+  const list = runs.flatMap((r) => messageOutcomes(r, same).map((x) => ({ ...x, run: r })));
+  if (!list.length) return null;
+  const t = m.ui.messages;
+  const word = (x) => (x.outcome === "nothing" ? t.nothing : t[x.outcome](x.relay.kind, x.relay.name, x.relay.ms));
+  const items = list.map((x) => `<li>${code(x.name)}<span class="inv-n">${esc(x.origin)}</span>${plain(esc(m.ui.party[x.party === "site" ? "first" : "third"]))}${x.outcome === "nothing" ? badge("info", word(x)) : plain(esc(word(x)))}<span class="inv-n">${esc(`${x.run.journeyId} · ${x.run.steps?.[x.step]?.label ?? x.step}`)}</span></li>`).join("");
+  const silent = list.filter((x) => x.outcome === "nothing").length;
+  return `<li><details class="card inv" id="inv-messages"><summary><span class="t">${esc(m.ui.messagesTitle)}</span>${plain(n(list.length))}${silent ? badge("info", `${t.nothing.split(":")[0]}: ${silent}`) : ""}</summary><div class="body"><p class="xs muted">${esc(m.ui.messagesIntro)}</p><ul class="inv-list">${items}</ul></div></details></li>`;
+}
+
 function inventorySection(ctx) {
   const { m, runs } = ctx;
   const t = m.html.scope;
@@ -235,7 +248,8 @@ function inventorySection(ctx) {
   const skipped = skippedTotals(runs);
   const containers = containersCard(ctx);
   const widgets = widgetsCard(ctx);
-  if (!lines.length && !skipped.length && !containers && !widgets) return sectionBlock("inventory", esc(m.html.shell.sections.inventory), `<p class="muted">${esc(m.ui.noInventory)}</p>`);
+  const messages = messagesCard(ctx);
+  if (!lines.length && !skipped.length && !containers && !widgets && !messages) return sectionBlock("inventory", esc(m.html.shell.sections.inventory), `<p class="muted">${esc(m.ui.noInventory)}</p>`);
   const counts = (x) => `<span class="inv-m">${t.requests(x.requests, bold(x.requests))}</span><span class="inv-m">${t.pages(x.pages.size, bold(x.pages.size))}</span><span class="inv-m${x.cookies.length ? "" : " zero"}">${t.cookies(x.cookies.length, bold(x.cookies.length))}</span>`;
   const out = lines.map((x) => {
     const id = `inv-${safeKey(x.p)}`;
@@ -251,6 +265,7 @@ function inventorySection(ctx) {
 <div role="tabpanel" id="${tid("pages")}" data-label="${esc(m.ui.pagesCol)}">${pages ? `<ul class="inv-list">${pages}</ul>` : none}</div>
 <div role="tabpanel" id="${tid("cookies")}" data-label="${esc(m.ui.cookiesCol)}">${x.cookies.length ? `<ul class="inv-list">${x.cookies.map((ck) => `<li>${code(ck)}</li>`).join("")}</ul>` : none}</div></div></div></details></li>`;
   });
+  if (messages) out.unshift(messages);
   if (widgets) out.unshift(widgets);
   if (containers) out.unshift(containers);
   const skippedN = skipped.reduce((a, [, k]) => a + k, 0);

package/src/i18n.js

@@ -217,6 +217,16 @@ const en = {
     ownCol: "Own tracking",
     sharedCol: "To the site's accounts",
     pushesCol: "dataLayer events",
+    messagesTitle: "Messages from iframes",
+    messagesIntro: "Events iframes posted to the page with postMessage, such as a form or checkout telling the page it is done, and what the page did next: pushed or sent the same event, did something else within 3 seconds (perhaps the same event under another name), or nothing.",
+    messageCol: "Message",
+    fromCol: "From",
+    outcomeCol: "What the page did",
+    messages: {
+      relayed: (kind, name, ms) => `${kind === "push" ? "pushed" : "sent"} ${name} ${ms} ms later`,
+      followed: (kind, name, ms) => `${kind === "push" ? "pushed" : "sent"} ${name} ${ms} ms later (another name)`,
+      nothing: "nothing: no dataLayer push or hit followed",
+    },
     widgets: {
       containers: "Containers",
       unshared: "Not sent to the site's accounts",
@@ -234,6 +244,7 @@ const en = {
       size: (bytes) => `${(bytes / 1024).toFixed(1)} KB`,
       loadTime: (ms) => `loaded in ${ms} ms`,
       failed: (status) => (status === "failed" ? "failed to load" : `failed to load (HTTP ${status})`),
+      neverRan: "never ran",
       kinds: {
         html: () => "A script tag in the page's HTML",
         inline: () => "Inline code in the page (the snippet)",
@@ -244,6 +255,8 @@ const en = {
         config: (by) => `A gtag('config') command, loaded by ${by}`,
         send_to: (by) => `An event's send_to with no config, loaded by ${by}`,
         destination: (by) => `A destination of the Google tag ${by}`,
+        preload: () => "Only a preload hint in the page (<link rel=\"preload\">): downloaded, never added as a script",
+        unseen: () => "Not seen being added: a script on the page may have replaced the browser's own functions, as consent platforms that block scripts do",
       },
     },
     provider: "Provider",
@@ -375,7 +388,10 @@ const en = {
     widgetTracking: (origin, platforms) => `An embedded widget from ${origin} sent its own tracking: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. It goes to accounts the site's own tags don't use, so it was left out of the plan, coverage and duplicate checks; the consent and personal data checks still include it.`,
     iframeContainer: (id, origin, parent) => `${id} runs in an iframe from ${origin} embedded in ${parent}. The iframe has its own dataLayer: events and consent commands pushed in the page never reach it, so it needs its own.`,
     containerFailed: (id, host, status) => `The ${id} script from ${host} ${status === "failed" ? "failed to load" : `was answered with HTTP ${status}`}, so none of its tags ran on that page.`,
+    containerNotRun: (id, kind) => `${id} ${kind === "preload" ? "was downloaded because of a preload hint in the page, but nothing added it as a script, and it" : "was loaded but"} never ran on any page of this run: Google's own registry never held it, so none of its tags fired.`,
+    containerHeld: (id, vendor) => `${id} never ran, which is expected while ${vendor} holds it back until the visitor consents. This run never consented, so its tags weren't checked.`,
     widgetEventsUnshared: (origin, names) => `An embedded widget from ${origin} pushed ${names.map(q).join(", ")} to its own dataLayer, but none of its hits to the site's accounts carried ${names.length === 1 ? "it" : "them"}. The page's tags can't read a widget's dataLayer, so ${names.length === 1 ? "this event reaches" : "these events reach"} only the widget's own tracking.`,
+    iframeMessageUnhandled: (origin, name, party) => `${party === "site" ? "An iframe on the site" : "An embedded widget"} from ${origin} posted ${q(name)} to the page, but the page pushed nothing to its dataLayer and sent no hit in the 3 seconds after, nor ${q(name)} later. If it is a conversion, the page isn't relaying it to its tags.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     consentDefaultNotApplied: () => "The page pushed a Consent Mode default, but the Google tag never applied it, so its tags ran without one. Tag Assistant shows Consent Mode as not configured.",
@@ -438,7 +454,10 @@ const en = {
     widget_tracking: "Nothing is wrong with the site's tracking: the widget's own hits were kept out of the plan checks so they can't pass for the site's.",
     iframe_container: "Tags in the iframe miss what the page pushes, so conversions completed in it can go untracked or be sent without the visitor's consent.",
     container_failed: "None of the container's tags ran: page views, conversions and consent signals it sends were all lost on that page.",
+    container_not_run: "None of the container's tags fired: page views, conversions and remarketing were all lost wherever it never ran.",
+    container_held: "The container's tags weren't checked on this run, since it waited for a consent the run never gave.",
     widget_events_unshared: "Conversions completed in the widget, such as a booking, a payment or a form, can be missing from the site's analytics and ad accounts.",
+    iframe_message_unhandled: "A conversion completed in the iframe, such as a form sent or a booking made, can go untracked although the iframe told the page about it.",
     campaign_params: "Campaign parameters survived the landing redirect and reached the hits, so paid clicks are credited to their campaigns.",
     event_id_reused: "Two different events share one event ID, so the platform keeps the first and silently drops the other: a real event is lost.",
     event_id_mismatch: "The browser and server copies of this event carry different IDs, so Meta cannot pair them and counts the conversion twice.",
@@ -488,7 +507,10 @@ const en = {
     widget_tracking: "Nothing to fix for the plan. If the widget sets cookies or sends data before consent, the consent findings name it; ask its vendor how to hold it back.",
     iframe_container: "Push the events and the consent state inside the iframe as well (or pass them in with postMessage), or track the iframe's steps from the page.",
     container_failed: "Check the container ID and the address in the snippet; for a server container or the Google tag gateway, check that it serves gtm.js and gtag/js.",
+    container_not_run: "Check that something actually adds the container's script, the snippet or the framework component that loads it (a preload alone runs nothing); look for script errors that stop the page's own code, and for a consent platform that never releases it.",
+    container_held: "Run the journey with consent accepted, or the consent scenarios, to check the container's tags.",
     widget_events_unshared: "If the site needs these events, have the widget send them to the site's accounts (most booking and form widgets take a GA4 or GTM ID), or pass them to the page with postMessage and push them to the page's dataLayer.",
+    iframe_message_unhandled: "Add a message listener on the page that checks event.origin and pushes the event to the dataLayer, so a GTM trigger can fire on it; or have the iframe send the event to the site's accounts itself.",
     campaign_params: "Nothing to fix. Check the redirects again when the landing pages change.",
     event_id_reused: "Generate a new event ID for every event, not once per page load.",
     event_id_mismatch: "Use one event ID for the pixel event and the server copy: pass the same value to both tags.",
@@ -538,7 +560,10 @@ const en = {
     widget_tracking: "hygiene",
     iframe_container: "hygiene",
     container_failed: "money",
+    container_not_run: "money",
+    container_held: "hygiene",
     widget_events_unshared: "money",
+    iframe_message_unhandled: "money",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",
@@ -1072,6 +1097,16 @@ const tr = {
     ownCol: "Kendi izlemesi",
     sharedCol: "Sitenin hesaplarına",
     pushesCol: "dataLayer olayları",
+    messagesTitle: "iframe'lerden gelen mesajlar",
+    messagesIntro: "iframe'lerin postMessage ile sayfaya gönderdiği olaylar (örneğin bir formun ya da ödemenin sayfaya bittiğini söylemesi) ve sayfanın ardından ne yaptığı: aynı olayı dataLayer'a gönderdi ya da iletti, 3 saniye içinde başka bir şey yaptı (belki aynı olayı başka bir adla) ya da hiçbir şey yapmadı.",
+    messageCol: "Mesaj",
+    fromCol: "Gönderen",
+    outcomeCol: "Sayfanın yaptığı",
+    messages: {
+      relayed: (kind, name, ms) => `${ms} ms sonra ${name} ${kind === "push" ? "dataLayer'a gönderdi" : "isteğini gönderdi"}`,
+      followed: (kind, name, ms) => `${ms} ms sonra ${name} ${kind === "push" ? "dataLayer'a gönderdi" : "isteğini gönderdi"} (başka bir ad)`,
+      nothing: "hiçbir şey: ardından ne dataLayer push'u ne de istek geldi",
+    },
     widgets: {
       containers: "Container'lar",
       unshared: "Sitenin hesaplarına gönderilmeyen",
@@ -1089,6 +1124,7 @@ const tr = {
       size: (bytes) => `${(bytes / 1024).toFixed(1).replace(".", ",")} KB`,
       loadTime: (ms) => `${ms} ms'de yüklendi`,
       failed: (status) => (status === "failed" ? "yüklenemedi" : `yüklenemedi (HTTP ${status})`),
+      neverRan: "hiç çalışmadı",
       kinds: {
         html: () => "Sayfanın HTML'indeki bir script etiketi",
         inline: () => "Sayfadaki satır içi kod (snippet)",
@@ -1099,6 +1135,8 @@ const tr = {
         config: (by) => `Bir gtag('config') komutu, ${by} yükledi`,
         send_to: (by) => `config olmadan bir olayın send_to değeri, ${by} yükledi`,
         destination: (by) => `${by} Google etiketinin bir hedefi`,
+        preload: () => "Sayfada yalnızca bir ön yükleme ipucu (<link rel=\"preload\">): indirildi, hiç betik olarak eklenmedi",
+        unseen: () => "Eklendiği görülmedi: sayfadaki bir betik tarayıcının kendi işlevlerini değiştirmiş olabilir; betikleri engelleyen onay platformlarının yaptığı gibi",
       },
     },
     provider: "Sağlayıcı",
@@ -1226,7 +1264,10 @@ const tr = {
     widgetTracking: (origin, platforms) => `${origin} kaynaklı gömülü bir widget kendi izlemesini gönderdi: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. Bunlar sitenin kendi etiketlerinin kullanmadığı hesaplara gidiyor; bu yüzden plan, kapsam ve tekrar kontrollerinin dışında tutuldu, onay ve kişisel veri kontrolleri ise onları yine içeriyor.`,
     iframeContainer: (id, origin, parent) => `${id}, ${parent} içine gömülü ${origin} kaynaklı bir iframe içinde çalışıyor. iframe'in kendi dataLayer'ı var: sayfada gönderilen olaylar ve onay komutları ona hiç ulaşmaz, bu yüzden kendi olaylarına ve onayına ihtiyacı var.`,
     containerFailed: (id, host, status) => `${host} adresinden gelen ${id} betiği ${status === "failed" ? "yüklenemedi" : `HTTP ${status} ile yanıtlandı`}; bu yüzden o sayfada etiketlerinin hiçbiri çalışmadı.`,
+    containerNotRun: (id, kind) => `${id} ${kind === "preload" ? "sayfadaki bir ön yükleme ipucu yüzünden indirildi, ama hiçbir şey onu betik olarak eklemedi ve" : "yüklendi ama"} bu çalıştırmanın hiçbir sayfasında çalışmadı: Google'ın kendi kaydı onu hiç tutmadı, bu yüzden etiketlerinin hiçbiri çalışmadı.`,
+    containerHeld: (id, vendor) => `${id} hiç çalışmadı; ${vendor} onu ziyaretçi onay verene kadar beklettiği sürece bu beklenen bir durum. Bu çalıştırmada onay hiç verilmedi, bu yüzden etiketleri kontrol edilmedi.`,
     widgetEventsUnshared: (origin, names) => `${origin} kaynaklı gömülü bir widget kendi dataLayer'ına ${names.map(q).join(", ")} gönderdi, ancak sitenin hesaplarına giden isteklerinin hiçbiri ${names.length === 1 ? "onu" : "onları"} taşımadı. Sayfanın etiketleri bir widget'ın dataLayer'ını okuyamaz; bu yüzden ${names.length === 1 ? "bu olay" : "bu olaylar"} yalnızca widget'ın kendi izlemesine ulaşıyor.`,
+    iframeMessageUnhandled: (origin, name, party) => `${origin} kaynaklı ${party === "site" ? "sitedeki bir iframe" : "gömülü bir widget"} sayfaya ${q(name)} gönderdi, ancak sayfa ardından 3 saniye içinde dataLayer'a hiçbir şey göndermedi ve istek yollamadı, sonradan ${q(name)} da göndermedi. Bu bir dönüşümse sayfa onu etiketlerine iletmiyor.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     consentDefaultNotApplied: () => "Sayfa bir Consent Mode varsayılanı gönderdi, ancak Google etiketi onu hiç uygulamadı; etiketleri varsayılan olmadan çalıştı. Tag Assistant, Consent Mode'u yapılandırılmamış gösterir.",
@@ -1288,7 +1329,10 @@ const tr = {
     widget_tracking: "Sitenin izlemesinde bir sorun yok: widget'ın kendi istekleri sitenin isteklerinin yerine geçmesin diye plan kontrollerinin dışında tutuldu.",
     iframe_container: "iframe içindeki etiketler sayfanın gönderdiklerini görmez; içinde tamamlanan dönüşümler izlenmeyebilir ya da ziyaretçinin onayı olmadan gönderilebilir.",
     container_failed: "Container'ın etiketlerinin hiçbiri çalışmadı: gönderdiği sayfa görüntülemeleri, dönüşümler ve onay sinyalleri o sayfada kayboldu.",
+    container_not_run: "Container'ın etiketlerinin hiçbiri çalışmadı: hiç çalışmadığı her yerde sayfa görüntülemeleri, dönüşümler ve yeniden pazarlama kayboldu.",
+    container_held: "Container onay beklediği ve bu çalıştırma onay vermediği için etiketleri kontrol edilmedi.",
     widget_events_unshared: "Widget içinde tamamlanan dönüşümler, örneğin bir rezervasyon, ödeme ya da form, sitenin analitik ve reklam hesaplarında eksik kalabilir.",
+    iframe_message_unhandled: "iframe içinde tamamlanan bir dönüşüm (gönderilen bir form, yapılan bir rezervasyon), iframe sayfaya bildirdiği hâlde izlenmeyebilir.",
     campaign_params: "Kampanya parametreleri açılış yönlendirmesinden geçip isteklere ulaştı; ücretli tıklamalar kendi kampanyalarına yazılıyor.",
     event_id_reused: "İki farklı olay tek bir olay kimliğini paylaşıyor; platform ilkini tutup diğerini sessizce atıyor, gerçek bir olay kayboluyor.",
     event_id_mismatch: "Bu olayın tarayıcı ve sunucu kopyaları farklı kimlik taşıyor; Meta ikisini eşleştiremiyor ve dönüşümü iki kez sayıyor.",
@@ -1336,7 +1380,10 @@ const tr = {
     widget_tracking: "Plan için düzeltilecek bir şey yok. Widget onaydan önce çerez yazıyor ya da veri gönderiyorsa onay bulguları onu adlandırır; nasıl durdurulacağını sağlayıcısına sorun.",
     iframe_container: "Olayları ve onay durumunu iframe içinde de gönderin (ya da postMessage ile iletin) veya iframe'deki adımları sayfadan izleyin.",
     container_failed: "Snippet'teki container kimliğini ve adresi kontrol edin; sunucu container'ı ya da Google etiket ağ geçidi için gtm.js ve gtag/js sunduğunu kontrol edin.",
+    container_not_run: "Container betiğini gerçekten bir şeyin eklediğini kontrol edin: snippet ya da onu yükleyen çatı bileşeni (yalnızca ön yükleme hiçbir şeyi çalıştırmaz); sayfanın kendi kodunu durduran betik hatalarına ve onu hiç serbest bırakmayan bir onay platformuna bakın.",
+    container_held: "Container'ın etiketlerini kontrol etmek için yolculuğu onay kabul edilmiş olarak ya da onay senaryolarıyla çalıştırın.",
     widget_events_unshared: "Site bu olaylara ihtiyaç duyuyorsa widget'ın onları sitenin hesaplarına göndermesini sağlayın (çoğu rezervasyon ve form widget'ı bir GA4 ya da GTM kimliği kabul eder) ya da onları postMessage ile sayfaya iletip sayfanın dataLayer'ına gönderin.",
+    iframe_message_unhandled: "Sayfaya event.origin'i kontrol eden ve olayı dataLayer'a gönderen bir message dinleyicisi ekleyin, böylece bir GTM tetikleyicisi onunla çalışabilir; ya da iframe'in olayı sitenin hesaplarına kendisi göndermesini sağlayın.",
     campaign_params: "Düzeltilecek bir şey yok. Açılış sayfaları değiştiğinde yönlendirmeleri yeniden kontrol edin.",
     event_id_reused: "Her olay için yeni bir olay kimliği üretin; sayfa yüklemesi başına bir kez değil.",
     event_id_mismatch: "Piksel olayı ve sunucu kopyası için tek bir olay kimliği kullanın: aynı değeri iki etikete de verin.",
@@ -1385,7 +1432,10 @@ const tr = {
     widget_tracking: "hygiene",
     iframe_container: "hygiene",
     container_failed: "money",
+    container_not_run: "money",
+    container_held: "hygiene",
     widget_events_unshared: "money",
+    iframe_message_unhandled: "money",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",

package/src/mcp.js

@@ -33,8 +33,8 @@ import { decodeGcd, DEFAULT_PROVIDERS, googleConsent, isCollectionEndpoint, pars
 import { hitParams } from "./hit-params.js";
 import { CAMPAIGN_PARAMS, campaignParamsIn, withCampaignParams } from "./campaign.js";
 import { cmpFacts } from "./cmp.js";
-import { containerRows, loadSources } from "./containers.js";
-import { isWidgetHit, pushedEvent, siteIds, splitRun, widgetSummaries } from "./frames.js";
+import { containerRows, containersNotRun, loadSources, unseenContainers } from "./containers.js";
+import { isEventMessage, isWidgetHit, messageOutcomes, pushedEvent, siteIds, splitRun, widgetSummaries } from "./frames.js";
 import { consentMatrixMarkdown, consentTable, runConsentScenarios } from "./consent.js";
 import { expectEvents, filterFindings, JOURNEY_PRESETS, onlyEvents, presetFor, withPresetEvents } from "./journeys.js";
 
@@ -192,6 +192,8 @@ export function stepCapture(audit, step) {
   if (pushes.length) lines.push("dataLayer pushes:", ...pushes.map(describePush));
   const loads = loadSources({ containerLoads: (session.containerLoads ?? []).filter((l) => l.step === step), containerScripts: session.containerScripts, dataLayerLog: session.dataLayerLog });
   if (loads.length) lines.push("Google containers loaded:", ...loads.map(describeLoad));
+  const posted = (session.frameMessages ?? []).filter((x) => x.step === step);
+  if (posted.length) lines.push("Messages iframes posted to the page (name and field names only):", ...posted.map((x) => `  ${x.name} from ${x.origin} (${x.party === "site" ? "same site" : "third party"})${x.keys?.length ? `, fields ${x.keys.join(", ")}` : ""}${isEventMessage(x) ? "" : "; housekeeping, not checked"}`));
   lines.push(...cookieLines(session, step));
   const tag = session.steps[step]?.tagConsent;
   if (tag) {
@@ -242,7 +244,7 @@ export function hitDetail(audit, step, index) {
 function containerJson(l) {
   return {
     id: l.id, source: l.kind, ...(l.by ? { by: l.by } : {}),
-    ...(l.layer !== "dataLayer" ? { data_layer: l.layer } : {}),
+    ...(l.layer && l.layer !== "dataLayer" ? { data_layer: l.layer } : {}),
     ...(l.served === "site" ? { served_from: l.host } : {}),
     ...(l.environment ? { gtm_environment: l.environment } : {}),
     ...(l.frame ? { iframe: { origin: l.frame.origin, party: l.frame.party } } : {}),
@@ -251,6 +253,7 @@ function containerJson(l) {
     ...(l.transferBytes ? { transfer_bytes: l.transferBytes } : {}),
     ...(l.ms != null ? { load_ms: l.ms } : {}),
     ...(l.failed ? { failed: l.failed } : {}),
+    ...(typeof l.ran === "boolean" ? { ran: l.ran } : {}),
     ...(l.pages ? { pages: l.pages } : {}),
   };
 }
@@ -263,7 +266,7 @@ export function containerLines(runs) {
   return [
     "Google containers (how each reached the page):",
     ...rows.map((r) => {
-      const extra = [scriptCell(c, r), r.layer !== "dataLayer" && `dataLayer ${r.layer}`, r.served === "site" && `served from ${r.host}`, r.environment && c.environment(r.environment), r.frame && c.iframe(r.frame.origin, r.frame.party), `${r.pages.length} ${r.pages.length === 1 ? "page" : "pages"}`].filter(Boolean);
+      const extra = [scriptCell(c, r), r.layer && r.layer !== "dataLayer" && `dataLayer ${r.layer}`, r.served === "site" && `served from ${r.host}`, r.environment && c.environment(r.environment), r.frame && c.iframe(r.frame.origin, r.frame.party), `${r.pages.length} ${r.pages.length === 1 ? "page" : "pages"}`].filter(Boolean);
       return `  ${r.id} (${c.script[r.script]}): ${c.kinds[r.kind](r.by)}; ${extra.join(", ")}`;
     }),
   ];
@@ -272,6 +275,17 @@ export function containerLines(runs) {
 /** The embedded widgets of the runs as summaries (see widgetSummaries), compared by canonical event name. */
 const widgetsIn = (runs) => widgetSummaries(runs, (a, b) => canonicalEvent(a) === canonicalEvent(b));
 
+/** The events iframes posted to the page, with what the page did next, as lines for a tool result; [] when none. */
+export function messageLines(runs) {
+  const t = messages("en").ui.messages;
+  const list = runs.flatMap((r) => messageOutcomes(r, (a, b) => canonicalEvent(a) === canonicalEvent(b)));
+  if (!list.length) return [];
+  return [
+    "Messages from iframes (events posted to the page with postMessage, and what the page did next):",
+    ...list.map((x) => `  ${x.name} from ${x.origin} (${x.party === "site" ? "same site" : "third party"}), step ${x.step}: ${x.outcome === "nothing" ? t.nothing : t[x.outcome](x.relay.kind, x.relay.name, x.relay.ms)}`),
+  ];
+}
+
 /** The embedded widgets as lines for a tool result; [] when there were none. */
 export function widgetLines(runs) {
   const widgets = widgetsIn(runs);
@@ -303,6 +317,8 @@ export function timelineOf(run) {
     if (hits.length) entry.hits = hits.map((h) => ({ platform: h.platform, event: h.name, ...(h.consent ? { consent: h.consent } : {}), ...(h.late ? { late_ms: h.late.ms } : {}), ...(h.frame ? { iframe: h.frame.origin } : {}) }));
     // An embedded widget's own hits, kept apart from the site's (see src/frames.js).
     const widget = (run.widgetHits ?? []).filter((h) => h.step === st.index);
+    const posted = messageOutcomes({ ...run, frameMessages: (run.frameMessages ?? []).filter((x) => x.step === st.index) }, (a, b) => canonicalEvent(a) === canonicalEvent(b));
+    if (posted.length) entry.iframe_messages = posted.map((x) => ({ from: x.origin, name: x.name, outcome: x.outcome, ...(x.relay ? { relay: x.relay } : {}) }));
     const widgetPushes = (run.widgetDataLayerLog ?? []).filter((e) => e.step === st.index && e.frame && pushedEvent(e.value));
     if (widgetPushes.length) entry.widget_pushes = widgetPushes.map((e) => ({ widget: e.frame.origin, event: pushedEvent(e.value) }));
     if (widget.length) entry.widget_hits = widget.map((h) => ({ widget: h.frame.origin, platform: h.platform, event: h.name, ...(h.id ? { id: h.id } : {}), ...(h.consent ? { consent: h.consent } : {}) }));
@@ -560,10 +576,20 @@ export function buildServer(opts) {
     },
     async ({ audit_id }) => {
       const { session } = getAudit(audit_id);
-      const loads = loadSources({ containerLoads: session.containerLoads ?? [], containerScripts: session.containerScripts, dataLayerLog: session.dataLayerLog });
-      if (!loads.length) return text("No GTM container or Google tag script has loaded on this audit's pages yet.");
+      const run = {
+        containerLoads: session.containerLoads ?? [], containerScripts: session.containerScripts, dataLayerLog: session.dataLayerLog,
+        containerPreloads: [...(session.containerPreloads?.values() ?? [])],
+        containersRunning: [...(session.containersRunning ?? [])].map(([id, step]) => ({ id, step })),
+      };
+      const loads = loadSources(run);
+      const unseen = unseenContainers(run);
+      const notRun = containersNotRun(run);
+      if (!loads.length && !unseen.length) return text("No GTM container or Google tag script has loaded on this audit's pages yet.");
+      const c = messages("en").ui.containers;
       const lines = loads.map((l) => `Step ${l.step} ("${session.steps[l.step]?.label ?? ""}"), ${l.page ?? "?"}:\n${describeLoad(l)}`);
-      return text(`${loads.length} container ${loads.length === 1 ? "load" : "loads"}:\n${lines.join("\n")}\n\nAs JSON: ${JSON.stringify(loads.map((l) => ({ step: l.step, page: l.page, ...containerJson(l) })))}`);
+      if (unseen.length) lines.push("Asked for without a script being seen added:", ...unseen.map((u) => `  ${u.id} (${c.script[u.script]}), step ${u.step}: ${c.kinds[u.kind]()}`));
+      if (notRun.length) lines.push(`Never ran so far (Google's registry never held ${notRun.length === 1 ? "it" : "them"}): ${notRun.map((x) => x.id).join(", ")}. If a consent platform holds GTM back, accept consent to see it run.`);
+      return text(`${loads.length} container ${loads.length === 1 ? "load" : "loads"}:\n${lines.join("\n")}\n\nAs JSON: ${JSON.stringify([...loads, ...unseen].map((l) => ({ step: l.step, page: l.page, ...containerJson(l), ...(l.id.startsWith("GTM-") ? { ran: run.containersRunning.some((r) => r.id === l.id) } : {}) })))}`);
     },
   );
 
@@ -590,10 +616,10 @@ export function buildServer(opts) {
     {
       title: "Read a report this server wrote",
       description:
-        "Returns a report finish_audit or run_audit wrote, so it can be read without access to the computer running this server. part markdown (default): report.md, the verdict, findings, consent and journeys in about 120 lines. summary: summary.json, the counts, journeys and findings as JSON. timeline: one JSON entry per step of each journey (hits with their consent, consent commands, the Google tag's consent, cookies and ids, the Google containers loaded). containers: every GTM container and Google tag the journeys loaded as JSON, with how each reached the page (source html, inline, script, custom_html, google_tag, nested, config, send_to or destination, and by: the container or script that loaded it), its dataLayer, host, GTM environment, version, size, load time and pages. widgets: every embedded third-party widget as JSON: where it was embedded, the containers it loaded, the tracking it sent to its own accounts and to the site's, its own dataLayer events, and the events it pushed that never reached the site's accounts (unshared).",
+        "Returns a report finish_audit or run_audit wrote, so it can be read without access to the computer running this server. part markdown (default): report.md, the verdict, findings, consent and journeys in about 120 lines. summary: summary.json, the counts, journeys and findings as JSON. timeline: one JSON entry per step of each journey (hits with their consent, consent commands, the Google tag's consent, cookies and ids, the Google containers loaded). containers: every GTM container and Google tag the journeys loaded as JSON, with how each reached the page (source html, inline, script, custom_html, google_tag, nested, config, send_to or destination, and by: the container or script that loaded it), its dataLayer, host, GTM environment, version, size, load time and pages. widgets: every embedded third-party widget as JSON: where it was embedded, the containers it loaded, the tracking it sent to its own accounts and to the site's, its own dataLayer events, and the events it pushed that never reached the site's accounts (unshared). messages: every event an iframe posted to the page with postMessage as JSON, with what the page did next (outcome relayed, followed or nothing, and relay: the push or hit that followed).",
       inputSchema: {
         report: z.string().describe("The report name finish_audit or run_audit gave."),
-        part: z.enum(["markdown", "summary", "timeline", "containers", "widgets"]).optional().describe("Default markdown."),
+        part: z.enum(["markdown", "summary", "timeline", "containers", "widgets", "messages"]).optional().describe("Default markdown."),
       },
       annotations: { readOnlyHint: true },
     },
@@ -606,6 +632,7 @@ export function buildServer(opts) {
         const capture = JSON.parse(await readFile(path.join(dir, "capture.json"), "utf8"));
         if (part === "containers") return text(JSON.stringify(containerRows(capture.runs ?? []).map(containerJson)));
         if (part === "widgets") return text(JSON.stringify(widgetsIn(capture.runs ?? [])));
+        if (part === "messages") return text(JSON.stringify((capture.runs ?? []).flatMap((r) => messageOutcomes(r, (a, b) => canonicalEvent(a) === canonicalEvent(b)).map((x) => ({ journey: r.journeyId, viewport: r.viewport, ...x })))));
         return text(JSON.stringify((capture.runs ?? []).map((r) => ({ journey: r.journeyId, viewport: r.viewport, steps: timelineOf(r) }))));
       } catch (err) {
         return fail(`Could not read the report: ${err.message}`);
@@ -717,13 +744,14 @@ export function buildServer(opts) {
         ...((platform) => (platform ? [`Consent platform: ${platform.vendor}. ${platform.facts.join(" ")}`] : []))(cmpFacts(messages("en"), [run])),
         ...containerLines([run]),
         ...widgetLines([run]),
+        ...messageLines([run]),
         opts.allowFiles
           ? `Full report with the event timeline: ${reportPath}`
           : opts.reportsUrl
             ? `Full report with the event timeline: ${opts.reportsUrl}/${path.basename(outDir)}/report.html`
             : "",
         "",
-        `To read the report here: get_report with report "${path.basename(outDir)}" (markdown, summary, timeline, containers or widgets).`,
+        `To read the report here: get_report with report "${path.basename(outDir)}" (markdown, summary, timeline, containers, widgets or messages).`,
         "Explain each problem to the user with its likely cause and fix.",
       ];
       return {
@@ -871,8 +899,9 @@ export function buildServer(opts) {
             ...grouped.map((f) => `- ${m.severity[f.severity]}${f.accepted ? ` (${m.ui.accepted})` : ""}: ${f.detail}`),
             ...containerLines(result.runs),
             ...widgetLines(result.runs),
+            ...messageLines(result.runs),
             `Report: ${result.reportPath}`,
-            `To read the report here: get_report with report "${path.basename(result.outDir)}" (markdown, summary, timeline, containers or widgets).`,
+            `To read the report here: get_report with report "${path.basename(result.outDir)}" (markdown, summary, timeline, containers, widgets or messages).`,
           ].join("\n"),
         );
       },

package/src/report.js

@@ -6,7 +6,7 @@ import { canonicalEvent, groupFindings, summarize } from "./checks.js";
 import { messages } from "./i18n.js";
 import { buildInventory } from "./inventory.js";
 import { containerRows } from "./containers.js";
-import { widgetSummaries } from "./frames.js";
+import { messageOutcomes, widgetSummaries } from "./frames.js";
 import { computeMetrics } from "./metrics.js";
 import { historySummaryLines, sparkline } from "./history.js";
 import { cardIds } from "./html/lib.js";
@@ -398,10 +398,26 @@ function mdInventory(m, runs) {
   return lines;
 }
 
-/** A container row's version, size and load time, or that it failed to load, in a few words. */
+/** A container row's version, size and load time, or that it failed to load, and whether it never ran, in a few words. */
 export function scriptCell(c, r) {
   if (r.failed) return c.failed(r.failed);
-  return [r.version && c.version(r.version), r.bytes && c.size(r.bytes), r.ms != null && c.loadTime(r.ms)].filter(Boolean).join(", ");
+  return [r.version && c.version(r.version), r.bytes && c.size(r.bytes), r.ms != null && c.loadTime(r.ms), r.ran === false && c.neverRan].filter(Boolean).join(", ");
+}
+
+/** The events iframes posted to the page and what the page did next, one row each. Omitted when there were none. */
+function mdMessages(m, runs) {
+  const same = (a, b) => canonicalEvent(a) === canonicalEvent(b);
+  const list = runs.flatMap((r) => messageOutcomes(r, same));
+  if (!list.length) return [];
+  const t = m.ui.messages;
+  const lines = [`## ${m.ui.messagesTitle}`, "", `| ${m.ui.messageCol} | ${m.ui.fromCol} | ${m.ui.outcomeCol} |`, "|---|---|---|"];
+  for (const x of list.slice(0, MD_INVENTORY_ROWS)) {
+    const what = x.outcome === "nothing" ? t.nothing : t[x.outcome](x.relay.kind, x.relay.name, x.relay.ms);
+    lines.push(`| ${mdText(x.name)} | ${mdText(x.origin)} (${m.ui.party[x.party === "site" ? "first" : "third"]}) | ${mdText(what)} |`);
+  }
+  if (list.length > MD_INVENTORY_ROWS) lines.push("", m.ui.md.moreIn(list.length - MD_INVENTORY_ROWS, "report.html"));
+  lines.push("");
+  return lines;
 }
 
 /** The embedded widgets, one row each: where they were embedded, their tracking and their own dataLayer events. Omitted when none. */
@@ -428,8 +444,8 @@ function mdContainers(m, runs) {
   const c = m.ui.containers;
   const lines = [`## ${m.ui.containersTitle}`, "", `| ${m.ui.containerCol} | ${m.ui.sourceCol} | ${m.ui.layerCol} | ${m.ui.servedCol} | ${m.ui.scriptCol} | ${m.ui.pagesCol} |`, "|---|---|---|---|---|---|"];
   for (const r of rows.slice(0, MD_INVENTORY_ROWS)) {
-    const served = r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`;
-    lines.push(`| ${mdText(r.id)} (${c.script[r.script]}) | ${mdText(c.kinds[r.kind](r.by))}${r.frame ? `, ${mdText(c.iframe(r.frame.origin, r.frame.party))}` : ""}${r.environment ? `, ${mdText(c.environment(r.environment))}` : ""} | ${mdText(r.layer)} | ${mdText(served)} | ${mdText(scriptCell(c, r)) || "–"} | ${r.pages.length} |`);
+    const served = !r.served ? "–" : r.served === "google" ? c.served.google : `${c.served.site} (${r.host})`;
+    lines.push(`| ${mdText(r.id)} (${c.script[r.script]}) | ${mdText(c.kinds[r.kind](r.by))}${r.frame ? `, ${mdText(c.iframe(r.frame.origin, r.frame.party))}` : ""}${r.environment ? `, ${mdText(c.environment(r.environment))}` : ""} | ${r.layer ? mdText(r.layer) : "–"} | ${mdText(served)} | ${mdText(scriptCell(c, r)) || "–"} | ${r.pages.length} |`);
   }
   if (rows.length > MD_INVENTORY_ROWS) lines.push("", m.ui.md.moreIn(rows.length - MD_INVENTORY_ROWS, "report.html"));
   lines.push("");
@@ -489,6 +505,7 @@ export function renderMarkdown({ title, site = null, generatedAt, findings, expl
   lines.push(...mdInventory(m, runs));
   lines.push(...mdContainers(m, runs));
   lines.push(...mdWidgets(m, runs));
+  lines.push(...mdMessages(m, runs));
   // A report with its own name or logo carries no Analitik İşler credit; the ai tag debugger one stays.
   if (brand?.name || brand?.logo) lines.push("---", "", `_${brand.name ? `${brand.name} · ` : ""}${m.ui.generatedBy}_`, "");
   else if (branding) lines.push("---", "", `_${m.ui.generatedBy} · [analitikisler.com](https://analitikisler.com)_`, "");