@domandigital/craft 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @domandigital/craft
 
+## 0.11.0
+
+### Minor Changes
+
+- e2ea0e8: Phase I: craft in CI.
+
+  - `craft.config.json`: `ignore` globs, `copyPaths` (where `craft copy` looks when given no path), and `severity` changes per tell. Every severity change needs a `because` of at least a sentence; `off` is applied as an exception, so the report still lists what it silenced. `--config <file>` points elsewhere.
+  - `.claude`, `.agents` and `.cursor` are never walked (a path named on the command line is still read).
+  - `--baseline <file>` reports only findings the baseline does not hold; `--update-baseline` writes it. Findings are keyed on tell, path and excerpt, not line, and counted.
+  - `--sarif <file>` writes SARIF 2.1.0 for GitHub code scanning.
+  - Every `--json` output carries `schemaVersion: 1`. The audit JSON adds `pages` and `failed`.
+  - `craft audit --pages <sitemap.xml | urls.txt>` and `--viewport 390,768,1440`. A page that will not load is listed as not measured and fails `--strict`.
+  - **Behaviour change:** a page that answers with an HTTP error (404, 500) is no longer snapshotted as if it were the page. `snapshotUrls` reports it as an error and `snapshotUrl` throws `HTTP <status>`. Before, a missing page was measured, and reported clean.
+  - New exports: `createBaseline`, `applyBaseline`, `parseBaseline`, `findingKey`, `parseCraftConfig`, `applySeverity`, `severityExceptions`, `globToRegExp`, `ignoreMatcher`, `DEFAULT_IGNORE`, `toSarif`, `toJson`, `JSON_SCHEMA_VERSION`.
+
+- 3eb1560: CommonJS consumers now get the CommonJS type declarations. The `exports` map put a top-level `types` (the ESM `.d.ts`) ahead of `require`, so TypeScript resolving a `require` under `node16` stopped at the ESM file ("Masquerading as ESM" in @arethetypeswrong/cli). `types` now sits inside `import` and `require` separately. Runtime behaviour is unchanged.
+
+  Requires Node 22.12 or later (`engines.node`). Node 20 reached end of life on 2026-04-30. Also declares `sideEffects` so bundlers can tree-shake (craft keeps its CSS).
+
+## 0.10.0
+
+### Minor Changes
+
+- cd13c94: `craft copy claims <paths>` lists every sentence holding a price, figure, date or named source, marked sourced or UNSOURCED, for a person to check against the primary source. `findClaims` and `formatClaims` do the same in code. No tell can tell a true figure from a false one; this makes the checking a list instead of a hunt.
+- cd13c94: Catalogue 2026.09.8, from reading all 144 review findings on the live DD site. New tell `prompt-context` (review): the model naming its own inputs, "the attached Perplexity research file", 24 real hits in five live articles. Tuned: `inline-label-list` leaves reference and data lists alone (0 of 11 hits were real), `staccato-triplet` no longer crosses a paragraph break, `ing-tail` passes a list of tasks, `repeated-sentence` ignores footnotes repeating a source title.
+
 ## 0.9.0
 
 ### Minor Changes

package/CHARACTER.md

@@ -534,7 +534,7 @@ Generated from the package. Run `pnpm --filter @domandigital/craft run docs`
 after changing an entry; a test fails until you do.
 
 <!-- craft:catalogue:start -->
-Catalogue version `2026.09.7`, 54 tells.
+Catalogue version `2026.09.8`, 55 tells.
 
 | Id | Gen | Surface | Severity | Tell | Why it is a default |
 | --- | --- | --- | --- | --- | --- |
@@ -578,6 +578,7 @@ Catalogue version `2026.09.7`, 54 tells.
 | `staccato-triplet` | 2 | copy | warn | Staccato triplet | Three fragments in a row ('Fast. Friendly. Local.' or 'No fuss. No jargon. Just results.') is the second wave's favourite rhythm. |
 | `where-x-meets-y` | 2 | copy | warn | 'Where X meets Y' | 'Where luxury meets comfort' is a tagline shape that fits every business and so describes none. |
 | `chatbot-residue` | 1 | copy | warn | Chatbot residue | 'Certainly! Here's a revised version', 'as an AI language model', a citeturn0search0 token, a link tracked utm_source=chatgpt.com: text that exists only because a chat reply was pasted whole. This is evidence, not style. |
+| `prompt-context` | 1 | copy | warn | Prompt context | 'This article uses the attached Perplexity research file as the primary source', 'the attached research is right to say': the model talking about what it was given. A reader of a web page has no attachment. Found 38 times across five live DD articles in 2026-09, none caught by any other tell. |
 | `placeholder` | 1 | copy | warn | Unfilled placeholder | '[Insert testimonial]', '[Your Name]', lorem ipsum, TODO_PLACEHOLDER: scaffolding a reader must never see, and the clearest sign a page shipped before anyone read it. |
 | `question-reveal` | 2 | copy | warn | Staged reveal | 'The result? Faster growth.', 'What does this mean for you? It means...': the writer asks the reader's question for them and answers it. An infomercial hook, and a favourite of generated copy. |
 | `inline-label-list` | 2 | copy | warn | Bold-label bullets | '**Speed:** Faster pages' three times in a row: a short label restated in a few words, the list shape generated copy defaults to. A definition list, with a real explanation after each label, is not this. |

package/COPY.md

@@ -100,6 +100,7 @@ person reading decides which instance earns its place.
 | `vague-word` | innovative, scalable, end-to-end, streamline, solutions. Reported only when a file is named outright |
 | `question-reveal` | "The result? Twice the bookings.", "What does this mean for you? It means...": a staged reveal |
 | `inline-label-list` | three or more bullets in a row opening "**Label:**", where the label repeats the line |
+| `prompt-context` | "This article uses the attached Perplexity research file as the primary source", "the attached research is right to say", "the attached brief asks": the model naming what it was given. A web page has no attachment. **Zero in anything published** |
 | `placeholder` | "[Insert client name]", lorem ipsum, `TODO_PLACEHOLDER`. Fine in a draft commit; **zero in anything delivered** |
 
 ### Style is not evidence
@@ -212,6 +213,11 @@ Hyphenated compounds count as one word. Not automated.
   `TODO_PLACEHOLDER: <the exact field needed>` and say so. Never fill it.
 - A quotation under a named person must be theirs. Copy drafted for someone,
   in quote marks with their job title beneath it, is a fabricated attribution.
+- **Every price, figure, date and named source is checked against its primary
+  source before it ships.** `craft copy claims <paths>` lists them, each marked
+  sourced or UNSOURCED. A claim is sourced, corrected or cut, never re-cited
+  from memory. The copy check cannot do this part: a false figure in clean
+  prose passes every tell.
 
 ## CTA rule
 

package/README.md

@@ -94,6 +94,41 @@ reason, in `art-direction.json`:
 { "exceptions": [{ "tell": "ai-violet", "because": "Violet is on the van, the cards and the fascia." }] }
 ```
 
+### In CI
+
+```bash
+npx craft scan --baseline craft-baseline.json --update-baseline   # once: adopt today's findings
+npx craft scan --baseline craft-baseline.json --strict --sarif craft.sarif
+npx craft audit --pages https://example.com/sitemap.xml --viewport 390,1440
+```
+
+- `--baseline` reports only findings the baseline does not already hold. A
+  finding is keyed on its tell, path and excerpt, never its line, so an edit
+  above a known finding does not make it new. The output says how many known
+  findings it left out.
+- `--sarif <file>` writes SARIF 2.1.0 for GitHub code scanning. Findings on a
+  rendered page carry the URL, not a file, so code scanning does not show them.
+- `--json` output always carries `schemaVersion` (currently 1).
+- `--pages` audits every URL in a sitemap (or a sitemap index, one level deep)
+  or a file of URLs; `--viewport` audits each at those widths. A page that
+  will not load is listed as not measured, and fails `--strict`.
+
+`craft.config.json` in the repo root holds what craft should know about the
+repo. `.claude`, `.agents` and `.cursor` are never walked, config or not.
+
+```json
+{
+  "ignore": ["docs/archive/**", "*.stories.tsx"],
+  "copyPaths": ["content", "src/app"],
+  "severity": {
+    "em-dash": { "level": "block", "because": "This client's style guide bans them outright." }
+  }
+}
+```
+
+A severity change needs a `because`, like an exception. `off` is applied as an
+exception, so the report lists what it silenced.
+
 ### Copy
 
 [COPY.md](./COPY.md) is the house copy standard: the blocking tier, the review
@@ -104,8 +139,14 @@ run. A test fails if a phrase the standard blocks does not block.
 ```bash
 npx craft copy --gate content   # the house gate: exit 1 on the blocking tier
 npx craft copy compare draft.md rewrite.md   # facts a rewrite lost or added
+npx craft copy claims content   # every price, figure, date and named source, to check
 ```
 
+No tell can say whether a figure is true. `craft copy claims` lists each
+sentence a reader would take as a checkable fact, marked `sourced` (a source is
+named) or `UNSOURCED`, for a person to check against the primary source. It
+always exits 0: a checklist, not a verdict.
+
 The same checks run in code:
 
 ```ts

package/dist/{audit-5P65UMFL.js → audit-QIPXL7E4.js}

@@ -6,9 +6,9 @@ import {
   snapshotPage,
   snapshotUrl,
   snapshotUrls
-} from "./chunk-BYY32NIN.js";
-import "./chunk-EHNEGKFR.js";
-import "./chunk-ZT3WLN7R.js";
+} from "./chunk-JP75P2DU.js";
+import "./chunk-QMYERCBB.js";
+import "./chunk-3NGWXZZE.js";
 export {
   audit,
   collectInPage,

package/dist/audit.cjs

@@ -564,10 +564,14 @@ var COPY_TELLS = [
     surface: "copy",
     why: "Three fragments in a row ('Fast. Friendly. Local.' or 'No fuss. No jargon. Just results.') is the second wave's favourite rhythm.",
     fix: "Write one sentence that says which of the three is true, and how you know.",
-    detect: phrases([/(?:\b[A-Z][\w'’-]*(?:\s+[\w'’-]+){0,2}[.!]\s+){2}[A-Z][\w'’-]*(?:\s+[\w'’-]+){0,2}[.!](?=\s|$)/], quoted),
+    // The fragments share one paragraph: "You don't. Again.", a blank line, then "It's frustrating." is two beats, not three.
+    detect: phrases([/(?:\b[A-Z][\w'’-]*(?:[ \t]+[\w'’-]+){0,2}[.!](?:[ \t]+|[ \t]*\n(?![ \t]*\n)[ \t]*)){2}[A-Z][\w'’-]*(?:[ \t]+[\w'’-]+){0,2}[.!](?=\s|$)/], quoted),
     fixtures: {
-      flag: [f("content/home.md", "No fuss. No jargon. Just results.")],
-      pass: [f("content/home.md", "We fix boilers the same day, and we tell you the price before we start.")]
+      flag: [f("content/home.md", "No fuss. No jargon. Just results."), f("content/home.md", "No fuss.\nNo jargon.\nJust results.")],
+      pass: [
+        f("content/home.md", "We fix boilers the same day, and we tell you the price before we start."),
+        f("content/guide.md", "Your competitor appears in the top three. You don't. Again.\n\nIt's frustrating.")
+      ]
     }
   },
   {
@@ -586,6 +590,14 @@ var COPY_TELLS = [
   }
 ];
 var ING_TAIL = /,\s+(?:ensuring|highlighting|underscoring|showcasing|reflecting|demonstrating|emphasi[sz]ing|fostering|cementing|solidifying|reinforcing|symboli[sz]ing|signalling|signaling)\b[^.!?\n]{0,80}/i;
+var PROMPT_CONTEXT = [
+  /\b(?:the|this|that)\s+(?:attached|uploaded|provided)\s+(?:(?:Perplexity|ChatGPT|Claude|Gemini|Copilot)\s+)?(?:research|research file|research pack|source file|sources)\b/i,
+  /\b(?:attached|uploaded)\s+(?:Perplexity|ChatGPT|Claude|Gemini|Copilot)\b/i,
+  /\bthe\s+(?:attached|uploaded|provided)\s+brief\s+(?:asks|says|wants|requests|suggests|mentions)\b/i
+];
+function gerundList(block, _match, index) {
+  return /(?:^|[(,;:]\s*)\w+ing\b[^,.;()!?]{0,40}$/.test(block.text.slice(Math.max(0, index - 60), index));
+}
 var VAGUE_ATTRIBUTION = [
   /\b(?:studies|research|experts|scientists|surveys|statistics|the data)\s+(?:show|shows|suggest|suggests|agree|say|says|confirm|confirms|prove|proves|indicate|indicates)\b/i,
   /\b(?:many|most)\s+(?:experts|people|customers|professionals|homeowners)\s+(?:agree|say|believe)\b/i,
@@ -671,8 +683,10 @@ function inlineLabelHits(ctx) {
       run = [];
     };
     for (const line of lines) {
-      const m = /^\s*(?:[-*+]|\d+\.)\s+\*\*[^*]{1,40}:?\*\*:?\s+(\S.*)$/.exec(line);
-      if (m && m[1].trim().split(/\s+/).length <= 6) run.push(offset);
+      const m = /^\s*[-*+]\s+\*\*([^*]{1,40}?):?\*\*:?\s+(\S.*)$/.exec(line);
+      const data = m && /[\d£$€%`]|https?:|^\*\*/.test(m[2]);
+      const named = m && /\S[A-Z]|[./]/.test(m[1]);
+      if (m && !data && !named && m[2].trim().split(/\s+/).length <= 6) run.push(offset);
       else flush();
       offset += line.length + 1;
     }
@@ -710,6 +724,29 @@ var RESEARCH_TELLS = [
       ]
     }
   },
+  {
+    id: "prompt-context",
+    name: "Prompt context",
+    generation: 1,
+    severity: "warn",
+    surface: "copy",
+    why: "'This article uses the attached Perplexity research file as the primary source', 'the attached research is right to say': the model talking about what it was given. A reader of a web page has no attachment. Found 38 times across five live DD articles in 2026-09, none caught by any other tell.",
+    fix: "Delete the reference to the research or brief. Where it carried a claim, name the real source or cut the claim.",
+    detect: phrases(PROMPT_CONTEXT, quoted),
+    fixtures: {
+      flag: [
+        f("content/guide.md", "This article uses the attached Perplexity research file as the primary source."),
+        f("content/guide.md", "The attached research is right to say these platforms suit early-stage businesses."),
+        f("content/guide.md", "That is exactly how the uploaded research frames the category."),
+        f("content/guide.md", "The attached brief asks for the point that most tradespeople miss.")
+      ],
+      pass: [
+        f("content/guide.md", "We research every quote before we send it."),
+        f("app/email.tsx", `export const Invoice = () => <p>Your invoice is attached.</p>;`),
+        f("content/guide.md", "BrightLocal's research shows that reviews drive 20% of local ranking.")
+      ]
+    }
+  },
   {
     id: "placeholder",
     name: "Unfilled placeholder",
@@ -762,7 +799,11 @@ var RESEARCH_TELLS = [
       pass: [
         f("content/home.md", "- Pages load in under a second\n- Card details never touch our server\n- Support by phone until 8pm\n"),
         f("content/home.md", "- **Speed:** Faster pages\n- **Security:** Safer data\n"),
-        f("content/guide.md", "- **GDC**: The statutory regulator for all dental professionals.\n- **GCC**: The statutory regulator for chiropractors in the UK.\n- **CQC**: The independent regulator of health and social care in England.\n")
+        f("content/guide.md", "- **GDC**: The statutory regulator for all dental professionals.\n- **GCC**: The statutory regulator for chiropractors in the UK.\n- **CQC**: The independent regulator of health and social care in England.\n"),
+        f("content/guide.md", "- **Per page**: \xA3100-\xA3200 per page\n- **Hourly**: \xA350-\xA375/hour\n- **Day rate**: \xA3350-\xA3500\n"),
+        f("content/guide.md", "- **Law Society Find a Solicitor:** For solicitors\n- **AccountingWEB / ICAEW directories:** For accountants\n- **NHS.uk:** For NHS services\n"),
+        f("content/guide.md", "1. **Visit PageSpeed Insights** and paste the address\n2. **Enter their URL** and run it\n3. **Note their scores** for later\n"),
+        f("content/guide.md", "- **Structural problems:** **REBUILD.**\n- **Messaging issues:** **REFRESH.**\n- **Neither:** **LEAVE IT.**\n")
       ]
     }
   },
@@ -774,7 +815,7 @@ var RESEARCH_TELLS = [
     surface: "copy",
     why: "'..., ensuring peace of mind', '..., highlighting our commitment': a participle tacked on the end that claims significance and names no mechanism. One of the most common shapes in the Wikipedia guide to AI writing.",
     fix: "Cut the tail, or replace it with the mechanism: 'so you can drop the car off before work'.",
-    detect: phrases([ING_TAIL], (m) => quoted(m.replace(/^,\s*/, ""))),
+    detect: phrases([ING_TAIL], (m) => quoted(m.replace(/^,\s*/, "")), void 0, gerundList),
     fixtures: {
       flag: [
         f("content/home.md", "Every engineer is Gas Safe registered, ensuring complete peace of mind."),
@@ -782,7 +823,8 @@ var RESEARCH_TELLS = [
       ],
       pass: [
         f("content/home.md", "We open at 7am, so you can drop the car off before work."),
-        f("content/home.md", "Engineers arrive by 9, carrying the parts for most boilers.")
+        f("content/home.md", "Engineers arrive by 9, carrying the parts for most boilers."),
+        f("content/guide.md", "Many items (claiming your GBP, ensuring NAP consistency, writing title tags) are straightforward.")
       ]
     }
   },
@@ -1032,6 +1074,7 @@ function repeatHits(ctx) {
     for (const s of sentences(doc2)) {
       const words = normal(s.text);
       if (words.length < RUN || !/[.!?]["'’”)]*$/.test(s.text)) continue;
+      if (/^\s*\[\^[\w-]+\]:/.test(s.text)) continue;
       const key = words.join(" ");
       const earlier = whole.get(key);
       if (earlier) {
@@ -1229,7 +1272,15 @@ var DENSITY_TELLS = [
         f2("content/proposal.md", doc("We check every valve before the engineer leaves the house.\n\nMore here.\n\nWe check every valve before the engineer leaves the house.")),
         f2("content/proposal.md", doc("We check every valve before the engineer leaves the house.\n\nBy then we check every valve before the engineer leaves the site."))
       ],
-      pass: [f2("content/proposal.md", doc("We check every valve before the engineer leaves the house.\n\nThe engineer leaves once the customer has signed the sheet."))]
+      pass: [
+        f2("content/proposal.md", doc("We check every valve before the engineer leaves the house.\n\nThe engineer leaves once the customer has signed the sheet.")),
+        f2(
+          "content/guide.md",
+          doc(
+            "The Independent Healthcare Providers Network Private Patient Insight Report 2024 found that private demand rose.[^1]\n\n[^1]: Independent Healthcare Providers Network, Private Patient Insight Report 2024, published online."
+          )
+        )
+      ]
     }
   },
   {
@@ -2309,6 +2360,9 @@ var HOUSE = {
   "closing-summary": { tier: "review", label: "closing summary" },
   "false-range": { tier: "review", label: "false range" },
   "placeholder": { tier: "review", label: "unfilled placeholder" },
+  // Every estate hit so far is real (38 in five DD articles, 2026-09-24), but
+  // a proposal can honestly say "the attached research". Review until measured there.
+  "prompt-context": { tier: "review", label: "prompt context: the model naming its own inputs" },
   "question-reveal": { tier: "review", label: "staged reveal" },
   "inline-label-list": { tier: "review", label: "bold-label bullets" },
   "phrase-density": { tier: "review", label: "density" },
@@ -2675,7 +2729,7 @@ var RENDERED_PATHS = {
 };
 
 // src/character/check.ts
-var CATALOGUE_VERSION = "2026.09.7";
+var CATALOGUE_VERSION = "2026.09.8";
 var CATALOGUE = [...SOURCE_TELLS, ...COPY_TELLS, ...RESEARCH_TELLS, ...DENSITY_TELLS].map(
   (t) => RENDERED_PATHS[t.id] ? { ...t, rendered: RENDERED_PATHS[t.id] } : t
 );
@@ -3216,7 +3270,9 @@ async function snapshotUrls(urls, options = {}) {
     for (const url of urls) {
       const page = await browser.newPage({ viewport: options.viewport ?? { width: 1440, height: 900 } });
       try {
-        await page.goto(url, { waitUntil: "domcontentloaded", timeout: options.timeoutMs ?? 45e3 });
+        const response = await page.goto(url, { waitUntil: "domcontentloaded", timeout: options.timeoutMs ?? 45e3 });
+        const status = typeof response?.status === "function" ? response.status() : 200;
+        if (status >= 400) throw new Error(`HTTP ${status}`);
         out.push({ url, snapshot: await snapshotPage(page, url, options) });
       } catch (error) {
         out.push({ url, error: error.message });

package/dist/audit.js

@@ -532,10 +532,14 @@ var COPY_TELLS = [
     surface: "copy",
     why: "Three fragments in a row ('Fast. Friendly. Local.' or 'No fuss. No jargon. Just results.') is the second wave's favourite rhythm.",
     fix: "Write one sentence that says which of the three is true, and how you know.",
-    detect: phrases([/(?:\b[A-Z][\w'’-]*(?:\s+[\w'’-]+){0,2}[.!]\s+){2}[A-Z][\w'’-]*(?:\s+[\w'’-]+){0,2}[.!](?=\s|$)/], quoted),
+    // The fragments share one paragraph: "You don't. Again.", a blank line, then "It's frustrating." is two beats, not three.
+    detect: phrases([/(?:\b[A-Z][\w'’-]*(?:[ \t]+[\w'’-]+){0,2}[.!](?:[ \t]+|[ \t]*\n(?![ \t]*\n)[ \t]*)){2}[A-Z][\w'’-]*(?:[ \t]+[\w'’-]+){0,2}[.!](?=\s|$)/], quoted),
     fixtures: {
-      flag: [f("content/home.md", "No fuss. No jargon. Just results.")],
-      pass: [f("content/home.md", "We fix boilers the same day, and we tell you the price before we start.")]
+      flag: [f("content/home.md", "No fuss. No jargon. Just results."), f("content/home.md", "No fuss.\nNo jargon.\nJust results.")],
+      pass: [
+        f("content/home.md", "We fix boilers the same day, and we tell you the price before we start."),
+        f("content/guide.md", "Your competitor appears in the top three. You don't. Again.\n\nIt's frustrating.")
+      ]
     }
   },
   {
@@ -554,6 +558,14 @@ var COPY_TELLS = [
   }
 ];
 var ING_TAIL = /,\s+(?:ensuring|highlighting|underscoring|showcasing|reflecting|demonstrating|emphasi[sz]ing|fostering|cementing|solidifying|reinforcing|symboli[sz]ing|signalling|signaling)\b[^.!?\n]{0,80}/i;
+var PROMPT_CONTEXT = [
+  /\b(?:the|this|that)\s+(?:attached|uploaded|provided)\s+(?:(?:Perplexity|ChatGPT|Claude|Gemini|Copilot)\s+)?(?:research|research file|research pack|source file|sources)\b/i,
+  /\b(?:attached|uploaded)\s+(?:Perplexity|ChatGPT|Claude|Gemini|Copilot)\b/i,
+  /\bthe\s+(?:attached|uploaded|provided)\s+brief\s+(?:asks|says|wants|requests|suggests|mentions)\b/i
+];
+function gerundList(block, _match, index) {
+  return /(?:^|[(,;:]\s*)\w+ing\b[^,.;()!?]{0,40}$/.test(block.text.slice(Math.max(0, index - 60), index));
+}
 var VAGUE_ATTRIBUTION = [
   /\b(?:studies|research|experts|scientists|surveys|statistics|the data)\s+(?:show|shows|suggest|suggests|agree|say|says|confirm|confirms|prove|proves|indicate|indicates)\b/i,
   /\b(?:many|most)\s+(?:experts|people|customers|professionals|homeowners)\s+(?:agree|say|believe)\b/i,
@@ -639,8 +651,10 @@ function inlineLabelHits(ctx) {
       run = [];
     };
     for (const line of lines) {
-      const m = /^\s*(?:[-*+]|\d+\.)\s+\*\*[^*]{1,40}:?\*\*:?\s+(\S.*)$/.exec(line);
-      if (m && m[1].trim().split(/\s+/).length <= 6) run.push(offset);
+      const m = /^\s*[-*+]\s+\*\*([^*]{1,40}?):?\*\*:?\s+(\S.*)$/.exec(line);
+      const data = m && /[\d£$€%`]|https?:|^\*\*/.test(m[2]);
+      const named = m && /\S[A-Z]|[./]/.test(m[1]);
+      if (m && !data && !named && m[2].trim().split(/\s+/).length <= 6) run.push(offset);
       else flush();
       offset += line.length + 1;
     }
@@ -678,6 +692,29 @@ var RESEARCH_TELLS = [
       ]
     }
   },
+  {
+    id: "prompt-context",
+    name: "Prompt context",
+    generation: 1,
+    severity: "warn",
+    surface: "copy",
+    why: "'This article uses the attached Perplexity research file as the primary source', 'the attached research is right to say': the model talking about what it was given. A reader of a web page has no attachment. Found 38 times across five live DD articles in 2026-09, none caught by any other tell.",
+    fix: "Delete the reference to the research or brief. Where it carried a claim, name the real source or cut the claim.",
+    detect: phrases(PROMPT_CONTEXT, quoted),
+    fixtures: {
+      flag: [
+        f("content/guide.md", "This article uses the attached Perplexity research file as the primary source."),
+        f("content/guide.md", "The attached research is right to say these platforms suit early-stage businesses."),
+        f("content/guide.md", "That is exactly how the uploaded research frames the category."),
+        f("content/guide.md", "The attached brief asks for the point that most tradespeople miss.")
+      ],
+      pass: [
+        f("content/guide.md", "We research every quote before we send it."),
+        f("app/email.tsx", `export const Invoice = () => <p>Your invoice is attached.</p>;`),
+        f("content/guide.md", "BrightLocal's research shows that reviews drive 20% of local ranking.")
+      ]
+    }
+  },
   {
     id: "placeholder",
     name: "Unfilled placeholder",
@@ -730,7 +767,11 @@ var RESEARCH_TELLS = [
       pass: [
         f("content/home.md", "- Pages load in under a second\n- Card details never touch our server\n- Support by phone until 8pm\n"),
         f("content/home.md", "- **Speed:** Faster pages\n- **Security:** Safer data\n"),
-        f("content/guide.md", "- **GDC**: The statutory regulator for all dental professionals.\n- **GCC**: The statutory regulator for chiropractors in the UK.\n- **CQC**: The independent regulator of health and social care in England.\n")
+        f("content/guide.md", "- **GDC**: The statutory regulator for all dental professionals.\n- **GCC**: The statutory regulator for chiropractors in the UK.\n- **CQC**: The independent regulator of health and social care in England.\n"),
+        f("content/guide.md", "- **Per page**: \xA3100-\xA3200 per page\n- **Hourly**: \xA350-\xA375/hour\n- **Day rate**: \xA3350-\xA3500\n"),
+        f("content/guide.md", "- **Law Society Find a Solicitor:** For solicitors\n- **AccountingWEB / ICAEW directories:** For accountants\n- **NHS.uk:** For NHS services\n"),
+        f("content/guide.md", "1. **Visit PageSpeed Insights** and paste the address\n2. **Enter their URL** and run it\n3. **Note their scores** for later\n"),
+        f("content/guide.md", "- **Structural problems:** **REBUILD.**\n- **Messaging issues:** **REFRESH.**\n- **Neither:** **LEAVE IT.**\n")
       ]
     }
   },
@@ -742,7 +783,7 @@ var RESEARCH_TELLS = [
     surface: "copy",
     why: "'..., ensuring peace of mind', '..., highlighting our commitment': a participle tacked on the end that claims significance and names no mechanism. One of the most common shapes in the Wikipedia guide to AI writing.",
     fix: "Cut the tail, or replace it with the mechanism: 'so you can drop the car off before work'.",
-    detect: phrases([ING_TAIL], (m) => quoted(m.replace(/^,\s*/, ""))),
+    detect: phrases([ING_TAIL], (m) => quoted(m.replace(/^,\s*/, "")), void 0, gerundList),
     fixtures: {
       flag: [
         f("content/home.md", "Every engineer is Gas Safe registered, ensuring complete peace of mind."),
@@ -750,7 +791,8 @@ var RESEARCH_TELLS = [
       ],
       pass: [
         f("content/home.md", "We open at 7am, so you can drop the car off before work."),
-        f("content/home.md", "Engineers arrive by 9, carrying the parts for most boilers.")
+        f("content/home.md", "Engineers arrive by 9, carrying the parts for most boilers."),
+        f("content/guide.md", "Many items (claiming your GBP, ensuring NAP consistency, writing title tags) are straightforward.")
       ]
     }
   },
@@ -1000,6 +1042,7 @@ function repeatHits(ctx) {
     for (const s of sentences(doc2)) {
       const words = normal(s.text);
       if (words.length < RUN || !/[.!?]["'’”)]*$/.test(s.text)) continue;
+      if (/^\s*\[\^[\w-]+\]:/.test(s.text)) continue;
       const key = words.join(" ");
       const earlier = whole.get(key);
       if (earlier) {
@@ -1197,7 +1240,15 @@ var DENSITY_TELLS = [
         f2("content/proposal.md", doc("We check every valve before the engineer leaves the house.\n\nMore here.\n\nWe check every valve before the engineer leaves the house.")),
         f2("content/proposal.md", doc("We check every valve before the engineer leaves the house.\n\nBy then we check every valve before the engineer leaves the site."))
       ],
-      pass: [f2("content/proposal.md", doc("We check every valve before the engineer leaves the house.\n\nThe engineer leaves once the customer has signed the sheet."))]
+      pass: [
+        f2("content/proposal.md", doc("We check every valve before the engineer leaves the house.\n\nThe engineer leaves once the customer has signed the sheet.")),
+        f2(
+          "content/guide.md",
+          doc(
+            "The Independent Healthcare Providers Network Private Patient Insight Report 2024 found that private demand rose.[^1]\n\n[^1]: Independent Healthcare Providers Network, Private Patient Insight Report 2024, published online."
+          )
+        )
+      ]
     }
   },
   {
@@ -2277,6 +2328,9 @@ var HOUSE = {
   "closing-summary": { tier: "review", label: "closing summary" },
   "false-range": { tier: "review", label: "false range" },
   "placeholder": { tier: "review", label: "unfilled placeholder" },
+  // Every estate hit so far is real (38 in five DD articles, 2026-09-24), but
+  // a proposal can honestly say "the attached research". Review until measured there.
+  "prompt-context": { tier: "review", label: "prompt context: the model naming its own inputs" },
   "question-reveal": { tier: "review", label: "staged reveal" },
   "inline-label-list": { tier: "review", label: "bold-label bullets" },
   "phrase-density": { tier: "review", label: "density" },
@@ -2643,7 +2697,7 @@ var RENDERED_PATHS = {
 };
 
 // src/character/check.ts
-var CATALOGUE_VERSION = "2026.09.7";
+var CATALOGUE_VERSION = "2026.09.8";
 var CATALOGUE = [...SOURCE_TELLS, ...COPY_TELLS, ...RESEARCH_TELLS, ...DENSITY_TELLS].map(
   (t) => RENDERED_PATHS[t.id] ? { ...t, rendered: RENDERED_PATHS[t.id] } : t
 );
@@ -3184,7 +3238,9 @@ async function snapshotUrls(urls, options = {}) {
     for (const url of urls) {
       const page = await browser.newPage({ viewport: options.viewport ?? { width: 1440, height: 900 } });
       try {
-        await page.goto(url, { waitUntil: "domcontentloaded", timeout: options.timeoutMs ?? 45e3 });
+        const response = await page.goto(url, { waitUntil: "domcontentloaded", timeout: options.timeoutMs ?? 45e3 });
+        const status = typeof response?.status === "function" ? response.status() : 200;
+        if (status >= 400) throw new Error(`HTTP ${status}`);
         out.push({ url, snapshot: await snapshotPage(page, url, options) });
       } catch (error) {
         out.push({ url, error: error.message });