@dreamdata_io/verify-tracking 0.1.0

package/dist/analysis/deployment.js

@@ -0,0 +1,2658 @@
+import { COOKIELESS_GLOBAL_KEY, DD_COOKIE_NAMES, describesFailure, isDreamdataUrl, mentionsDreamdata, SEGMENT_COMPAT_GLOBAL_KEY, } from "../evidence/constants.js";
+import { extractLibraries, extractMessageId, formatLibraryBuild } from "../evidence/network.js";
+import { judgeConsentModeV2, sawGoogleTag } from "./consent-mode.js";
+import { diagnose } from "./diagnosis/diagnose.js";
+function storedIdentityNames(storage) {
+    // Older evidence (collected before per-value capture existed) has no
+    // `values`/`ajsValues` at all — treat that the same as "nothing stored"
+    // rather than crashing replay of that evidence.
+    const dd = Object.entries(storage.values ?? {});
+    const ajs = Object.entries(storage.ajsValues ?? {});
+    return [...dd, ...ajs].filter(([, value]) => value !== null && value !== "").map(([name]) => name);
+}
+/**
+ * The stored identity names, each said once, with where it lives.
+ *
+ * An SDK writes its anonymous id to BOTH a cookie and localStorage, so
+ * concatenating the two lists printed "dd_anonymous_id, dd_anonymous_id" —
+ * which reads as a bug in the report rather than as one entry in two places,
+ * and told the reader nothing about which store to go and clear.
+ */
+function describeIdentityStores(cookies, localStorage) {
+    const stores = new Map();
+    for (const name of cookies)
+        stores.set(name, [...(stores.get(name) ?? []), "cookie"]);
+    for (const name of localStorage)
+        stores.set(name, [...(stores.get(name) ?? []), "localStorage"]);
+    return [...stores].map(([name, where]) => `${name} (${where.join(" + ")})`).join(", ");
+}
+function identityCookiesSet(phase) {
+    return storedIdentityNames(phase.cookies);
+}
+/**
+ * True when a second page was actually reached. `attempted` alone is not
+ * enough: a click that changed nothing leaves a phase with no second page to
+ * judge, and treating that as observed would turn "we could not look" into a
+ * failure.
+ */
+function secondPageObserved(second) {
+    return second !== null && second.attempted && second.urlChanged;
+}
+function summarizeSecondPage(second) {
+    if (second === null)
+        return null;
+    return {
+        kind: second.kind,
+        observed: secondPageObserved(second),
+        toUrl: second.toUrl,
+        skippedReason: second.skippedReason,
+        normalRequests: second.network.normalRequestCount,
+        cookielessRequests: second.network.cookielessRequestCount,
+        identityCookiesSet: storedIdentityNames(second.cookies),
+    };
+}
+function summarizePhase(phase) {
+    return {
+        phase: phase.phase,
+        consentDriven: phase.consentAcceptance.attempted && phase.consentAcceptance.succeeded,
+        consentDriveDetail: phase.consentAcceptance.detail,
+        consentUndrivenReason: phase.consentAcceptance.undrivenReason,
+        consentSignalConfirmed: phase.consentAcceptance.consentSignalConfirmed,
+        cmpDetected: phase.consent.cmpDetected,
+        bannerReveal: phase.consent.bannerReveal,
+        normalRequests: phase.network.normalRequestCount,
+        cookielessRequests: phase.network.cookielessRequestCount,
+        identityCookiesSet: identityCookiesSet(phase),
+        analyticsStorage: phase.consent.analyticsStorageState ?? "unreadable",
+        analyticsStorageSource: phase.consent.analyticsStorageSource ?? "none",
+        cmpHasResponse: phase.consent.cmpHasResponse,
+        normalBundleInDom: phase.script.normalSnippet,
+        cookielessBundleInDom: phase.script.cookielessSnippet,
+        secondPage: summarizeSecondPage(phase.secondPage),
+    };
+}
+const NOT_RUN = (id, title, phase) => ({
+    id,
+    title,
+    status: "inconclusive",
+    detail: `The ${phase} phase was not run, so this could not be checked.`,
+    evidence: `phases collected: none named "${phase}"`,
+    phases: [phase],
+});
+/**
+ * How to describe a phase whose consent drive was not certified.
+ *
+ * The three ways a drive falls short are not the same finding, and reporting
+ * them all as "could not be driven" misreads two of them. Only
+ * "not-submitted" and "did-not-survive-reload" mean the numbers under the
+ * phase's label were measured on a page with the banner still unanswered.
+ * "not-persisted" means the answer WAS submitted and the page WAS reloaded
+ * afterwards — the numbers describe the answered page; what is missing is
+ * only our evidence that the CMP filed the answer away, which some CMPs
+ * simply do not expose. Telling an operator their refusal was never driven,
+ * when the refusal demonstrably moved Consent Mode, sends them to debug the
+ * wrong thing.
+ */
+function undrivenDetail(acceptance) {
+    const label = acceptance.direction === "deny" ? "refusal" : "grant";
+    const asked = acceptance.direction === "deny" ? "told no" : "asked to turn tracking on";
+    const trace = acceptance.detail ? ` (${acceptance.detail})` : "";
+    switch (acceptance.undrivenReason) {
+        case "not-persisted":
+            return (`The ${label} was submitted${trace} and the page was reloaded afterwards, so the values below were measured after the decision — ` +
+                `but the CMP was never seen to record it, so this pass cannot be certified as a real ${label}.` +
+                (acceptance.consentSignalConfirmed === true
+                    ? " Consent Mode did move to the expected value, which is independent evidence the decision landed; the gap is in what this harness can read back from the CMP, not necessarily in the site."
+                    : ""));
+        case "did-not-survive-reload":
+            return (`The ${label} was submitted${trace} but the reloaded page reported the banner unanswered again, ` +
+                `so the values below describe a visit with the banner still open, under a ${label} label.`);
+        default:
+            return (`The ${label} could not be driven${trace}, so the site was never actually ${asked} — ` +
+                `the values below describe a visit with the banner still unanswered.`);
+    }
+}
+/**
+ * Is the missing cookieless bundle a configuration choice this run can SEE,
+ * rather than an absence it merely failed to observe?
+ *
+ * The difference is the published tag-manager container. It is the
+ * deployment's own manifest — every tag, whatever its trigger, including the
+ * ones no crawl would ever make fire — so a container that was read in full
+ * and ships the standard bundle's tag and no cookieless one is the install
+ * stating what it is: consent-gated, standard-only, unconsented visitors
+ * deliberately unrecorded. beckman.com is exactly that shape, and reporting
+ * it as a failure told a customer whose GTM container does precisely what
+ * they built it to do that their install is broken.
+ *
+ * A snippet install offers nothing equivalent: "no cookieless tag in the DOM"
+ * is an observation about the pages this run happened to load, so the absence
+ * stays a finding there. Requiring `errors` to be empty matters for the same
+ * reason — a container that half-parsed could be hiding the tag in the part
+ * that did not.
+ */
+function cookielessAbsentByDesign(phases) {
+    const scan = phases
+        .map((p) => p.script.tagManager)
+        .find((tm) => tm.scanned && tm.errors.length === 0 && tm.normalBundleTagFound && !tm.cookielessBundleTagFound);
+    if (!scan)
+        return null;
+    const containers = scan.containerIds.length > 0 ? `container ${scan.containerIds.join(", ")}` : "the container";
+    return {
+        containers,
+        evidence: `script.tagManager: scanned, containerIds [${scan.containerIds.join(", ")}], normalBundleTagFound: true, cookielessBundleTagFound: false, errors: []`,
+    };
+}
+/**
+ * The checks that only exist across phases. Each one is a comparison — "did
+ * behaviour change when the answer changed?" — which is precisely what a
+ * single-state run can never answer, because a correctly gated bundle and a
+ * broken one both look like silence.
+ */
+function buildChecks(byPhase, facts) {
+    const checks = [];
+    const clean = byPhase.get("clean");
+    const grant = byPhase.get("grant");
+    const reject = byPhase.get("reject");
+    // Read here rather than threaded through `facts`, which is deliberately a
+    // Pick of three fields: the container scan does not change between phases,
+    // so the longest read is the one whose fetch completed.
+    const cookielessGateContainers = [...byPhase.values()]
+        .map((p) => p.script.tagManager.containers ?? [])
+        .reduce((best, current) => (current.length > best.length ? current : best), []);
+    // 1. Nothing identified may fire before the visitor has answered.
+    if (!clean) {
+        checks.push(NOT_RUN("clean-before-consent", "No identified tracking before consent", "clean"));
+    }
+    else if (!clean.consent.cmpDetected || clean.consent.cmpHasResponse === true) {
+        checks.push({
+            id: "clean-before-consent",
+            title: "No identified tracking before consent",
+            status: "not_applicable",
+            detail: clean.consent.cmpDetected
+                ? "The banner was already answered on first load (an auto-accept or a carried-over decision), so this load is not a pre-consent one."
+                : "No consent platform was detected, so there is no gate for tracking to precede.",
+            evidence: `clean.consent.cmpDetected: ${clean.consent.cmpDetected}, clean.consent.cmpHasResponse: ${clean.consent.cmpHasResponse}`,
+            phases: ["clean"],
+        });
+    }
+    else {
+        const cookies = identityCookiesSet(clean);
+        const bad = clean.network.normalRequestCount > 0 || cookies.length > 0;
+        checks.push({
+            id: "clean-before-consent",
+            title: "No identified tracking before consent",
+            status: bad ? "fail" : "pass",
+            detail: bad
+                ? `The banner was unanswered, but identified tracking already ran: ${clean.network.normalRequestCount} normal request(s)${cookies.length > 0 ? ` and identity cookies ${cookies.join(", ")}` : ""}.`
+                : "With the banner unanswered, no normal-bundle request fired and no identity cookie was written.",
+            evidence: `clean.network.normalRequestCount: ${clean.network.normalRequestCount}, clean identity cookies: [${cookies.join(", ")}]`,
+            phases: ["clean"],
+        });
+    }
+    // 1b. Before any decision, Consent Mode has to default to denied. Unlike
+    //     the driven grant/reject phases, there is no choice for the clean
+    //     phase to "carry" — nothing has been declared yet, so
+    //     analyticsStorageSource reading implicit-default here is the expected,
+    //     correct shape of a working install, not a coincidence to be
+    //     suspicious of.
+    //
+    //     A default of granted is a pass, not a finding, when the run can show
+    //     something ELSE held the line: abcam declares analytics_storage
+    //     granted before the banner is answered, and the normal bundle still
+    //     never fires, because its GTM tag carries a blocking trigger on a
+    //     OneTrust group. The observed behaviour is correct in all three
+    //     phases, and this reader only reports what a run actually did — that
+    //     the surviving layer is a single point of failure is a future
+    //     configuration risk, not a defect in this install, so it is stated in
+    //     the detail and costs the check nothing.
+    if (!clean) {
+        checks.push(NOT_RUN("clean-consent-mode-default", "Consent Mode defaults to denied before consent", "clean"));
+    }
+    else if (!clean.consent.cmpDetected) {
+        checks.push({
+            id: "clean-consent-mode-default",
+            title: "Consent Mode defaults to denied before consent",
+            status: "not_applicable",
+            detail: "No consent platform was detected, so there is no Consent Mode default to check.",
+            evidence: "clean.consent.cmpDetected: false",
+            phases: ["clean"],
+        });
+    }
+    else if (clean.consent.analyticsStorageState === null) {
+        checks.push({
+            id: "clean-consent-mode-default",
+            title: "Consent Mode defaults to denied before consent",
+            status: "not_applicable",
+            detail: "The page exposes no Google Consent Mode state at all (no gtag.js), so it cannot be held to a default.",
+            evidence: "clean.consent.analyticsStorageState: null",
+            phases: ["clean"],
+        });
+    }
+    else {
+        const denied = clean.consent.analyticsStorageState === "denied";
+        const blockingTriggers = clean.script.tagManager.normalBundleBlockingTriggers ?? [];
+        // "Nothing identified ran" is checked here rather than taken from
+        // check 1a, so the pass rests on this phase's own evidence.
+        const cleanPhaseHeldUp = clean.network.normalRequestCount === 0 && identityCookiesSet(clean).length === 0;
+        const heldBySomethingElse = !denied && blockingTriggers.length > 0 && cleanPhaseHeldUp;
+        const gateList = blockingTriggers.join("; or ");
+        checks.push({
+            id: "clean-consent-mode-default",
+            title: "Consent Mode defaults to denied before consent",
+            status: denied || heldBySomethingElse ? "pass" : "fail",
+            detail: denied
+                ? `Before the banner was answered, analytics_storage already read denied (${clean.consent.analyticsStorageSource ?? "no source"}) — this is expected even when the source is gtag.js's own implicit default, since nothing has been declared yet.`
+                : heldBySomethingElse
+                    ? `Before the banner was answered, analytics_storage already read ${clean.consent.analyticsStorageState} (${clean.consent.analyticsStorageSource ?? "no source"}), so Consent Mode is not what keeps identified tracking off an unanswered page here. What keeps it off is a blocking trigger on the normal bundle's own tag manager tag: it is blocked whenever ${gateList}. That held in this run — the clean phase sent no normal request and wrote no identity cookie — so nothing identified ran before the visitor answered.`
+                    : `Before the banner was answered, analytics_storage already read ${clean.consent.analyticsStorageState} (${clean.consent.analyticsStorageSource ?? "no source"}) — tracking is not actually gated on the decision.`,
+            evidence: `clean.consent.analyticsStorageState: ${clean.consent.analyticsStorageState}, clean.consent.analyticsStorageSource: ${clean.consent.analyticsStorageSource ?? "none"}` +
+                (heldBySomethingElse
+                    ? `, clean.script.tagManager.normalBundleBlockingTriggers: ${gateList}, clean.network.normalRequestCount: 0`
+                    : ""),
+            phases: ["clean"],
+        });
+    }
+    // 2. Granting consent has to actually turn identified tracking on.
+    if (!grant) {
+        checks.push(NOT_RUN("grant-enables-normal", "Granting consent enables the normal bundle", "grant"));
+    }
+    else if (!facts.normalBundleConfigured) {
+        checks.push({
+            id: "grant-enables-normal",
+            title: "Granting consent enables the normal bundle",
+            status: "not_applicable",
+            detail: "No normal bundle is part of this deployment, so there is nothing for a grant to enable.",
+            evidence: "script.normalBundleSignals: []",
+            phases: ["grant"],
+        });
+    }
+    else if (!grant.consentAcceptance.succeeded && !grant.consent.cmpDetected) {
+        checks.push({
+            id: "grant-enables-normal",
+            title: "Granting consent enables the normal bundle",
+            status: "not_applicable",
+            detail: "No consent platform was detected, so there is no gate for a grant to enable — whatever the normal bundle does here is not evidence of a working consent gate.",
+            evidence: "grant.consent.cmpDetected: false",
+            phases: ["grant"],
+        });
+    }
+    else if (!grant.consentAcceptance.succeeded) {
+        checks.push({
+            id: "grant-enables-normal",
+            title: "Granting consent enables the normal bundle",
+            status: "inconclusive",
+            detail: undrivenDetail(grant.consentAcceptance),
+            evidence: `grant.consentAcceptance.succeeded: false, undrivenReason: ${grant.consentAcceptance.undrivenReason ?? "none"}`,
+            phases: ["grant"],
+        });
+    }
+    else if (grant.network.normalRequestCount > 0) {
+        checks.push({
+            id: "grant-enables-normal",
+            title: "Granting consent enables the normal bundle",
+            status: "pass",
+            detail: `After the grant, the normal bundle sent ${grant.network.normalRequestCount} request(s).`,
+            evidence: `grant.network.normalRequestCount: ${grant.network.normalRequestCount}`,
+            phases: ["grant"],
+        });
+    }
+    else {
+        // No signal proves a tag ever reached the page: everything we know comes
+        // from a container, a loader's reference to its companion, or a queue. A
+        // tag manager has firing triggers of its own on top of the consent gate,
+        // so the operator needs to check those too before blaming the bundle.
+        const neverSeenInPage = !facts.normalBundleSignals.some((s) => s.source === "dom-script" ||
+            s.source === "cmp-blocked-script" ||
+            s.source === "request" ||
+            s.source === "beacon");
+        checks.push({
+            id: "grant-enables-normal",
+            title: "Granting consent enables the normal bundle",
+            status: "fail",
+            detail: `Consent was granted and reloaded, but no normal-bundle request ever fired — the visitor agreed to identified tracking and did not get it. ` +
+                (grant.consentAcceptance.consentSignalConfirmed === false
+                    ? "The CMP recorded the choice but never emitted a Consent Mode update, which is the most likely cause. "
+                    : grant.consent.analyticsStorageState !== null && grant.consent.analyticsStorageState !== "granted"
+                        ? `After the post-consent reload analytics_storage reads ${grant.consent.analyticsStorageState} (${grant.consent.analyticsStorageSource ?? "no source"}) despite the grant, which is the most likely cause: anything gated on Consent Mode is still blocked on the very page the visitor lands on. `
+                        : "") +
+                (neverSeenInPage
+                    ? "No normal-bundle tag was seen on the page in any phase — it is known only from the tag manager container and the cookieless loader's companion check — so also confirm the tag's own firing trigger covers this page."
+                    : ""),
+            evidence: `grant.network.normalRequestCount: 0, grant.consentAcceptance.succeeded: true, script.normalBundleSignals: ${facts.normalBundleSignals
+                .map((s) => s.source)
+                .join(", ")}`,
+            phases: ["grant"],
+        });
+    }
+    // 3. Refusing consent has to actually keep identified tracking off.
+    if (!reject) {
+        checks.push(NOT_RUN("reject-blocks-normal", "Refusing consent blocks the normal bundle", "reject"));
+    }
+    else if (!reject.consentAcceptance.succeeded && !reject.consent.cmpDetected) {
+        checks.push({
+            id: "reject-blocks-normal",
+            title: "Refusing consent blocks the normal bundle",
+            status: "not_applicable",
+            detail: "No consent platform was detected, so there is no gate for a refusal to block — whatever the normal bundle does here is not evidence of a working consent gate.",
+            evidence: "reject.consent.cmpDetected: false",
+            phases: ["reject"],
+        });
+    }
+    else if (!reject.consentAcceptance.succeeded) {
+        checks.push({
+            id: "reject-blocks-normal",
+            title: "Refusing consent blocks the normal bundle",
+            status: "inconclusive",
+            detail: undrivenDetail(reject.consentAcceptance),
+            evidence: `reject.consentAcceptance.succeeded: false, undrivenReason: ${reject.consentAcceptance.undrivenReason ?? "none"}`,
+            phases: ["reject"],
+        });
+    }
+    else {
+        const fired = reject.network.normalRequestCount > 0;
+        checks.push({
+            id: "reject-blocks-normal",
+            title: "Refusing consent blocks the normal bundle",
+            status: fired ? "fail" : "pass",
+            detail: fired
+                ? `Consent was explicitly refused, and the normal bundle still sent ${reject.network.normalRequestCount} request(s).`
+                : "After an explicit refusal, no normal-bundle request fired.",
+            evidence: `reject.network.normalRequestCount: ${reject.network.normalRequestCount}`,
+            phases: ["reject"],
+        });
+    }
+    // 4. The cookieless bundle exists to cover exactly the states above — but
+    //    only where the normal bundle is not already running. The loader stands
+    //    down on purpose when it finds an unblocked #dreamdata-analytics, so a
+    //    silent cookieless bundle next to a live normal one is correct
+    //    behaviour, and whether normal SHOULD be live there is the
+    //    clean-before-consent check's question, not this one.
+    // A reject phase whose refusal was never confirmed to survive its own
+    // reload (see collect.ts) measured an indeterminate page, not a refusal —
+    // its silence would otherwise read as "cookieless doesn't cover a refusal"
+    // when it may only mean "the refusal itself never took".
+    const unreliableReject = reject !== undefined && !reject.consentAcceptance.succeeded && reject.consentAcceptance.attempted;
+    const unconsented = [clean, unreliableReject ? undefined : reject].filter((p) => p !== undefined);
+    const unconsentedNames = unconsented.map((p) => p.phase);
+    const uncovered = unconsented.filter((p) => p.network.normalRequestCount === 0);
+    if (!facts.cookielessBundleConfigured) {
+        // No cookieless bundle at all is a legitimate architecture choice when
+        // there is no consent gate to cover. When a CMP IS present, an
+        // unconsented visitor records nothing, and that is only waved through
+        // where the deployment says in its own published container that this is
+        // what it is — see cookielessAbsentByDesign. Absent that, silence where
+        // a fallback belongs stays a finding.
+        const uncoveredNoCmp = uncovered.filter((p) => p.consent.cmpDetected);
+        const byDesign = cookielessAbsentByDesign([...byPhase.values()]);
+        if (uncoveredNoCmp.length > 0 && byDesign !== null) {
+            checks.push({
+                id: "cookieless-covers-unconsented",
+                title: "Cookieless tracking covers the unconsented states",
+                status: "not_applicable",
+                detail: `No cookieless bundle is part of this deployment, and the published tag-manager container says so on purpose: ` +
+                    `${byDesign.containers} ships the standard bundle's tag and no cookieless one. This deployment is configured to ` +
+                    `track only visitors who have agreed, so the ${uncoveredNoCmp.map((p) => p.phase).join(" and ")} phase(s) ` +
+                    `recording nothing is the install behaving as built, not a fault in it. Those visits do go unrecorded: adding ` +
+                    `Cookieless Account Analytics is how to change that, but it is a decision about coverage, not a defect to fix.`,
+                evidence: `${byDesign.evidence}; ${uncoveredNoCmp.map((p) => `${p.phase}.network.normalRequestCount: 0`).join(", ")}`,
+                phases: unconsentedNames,
+            });
+        }
+        else if (uncoveredNoCmp.length > 0) {
+            checks.push({
+                id: "cookieless-covers-unconsented",
+                title: "Cookieless tracking covers the unconsented states",
+                status: "fail",
+                detail: `A consent banner is present, but no cookieless bundle is part of this deployment, so the ${uncoveredNoCmp
+                    .map((p) => p.phase)
+                    .join(" and ")} phase(s) recorded nothing at all while consent was withheld or unanswered — those visits went untracked entirely instead of falling back to cookieless tracking.`,
+                evidence: uncoveredNoCmp.map((p) => `${p.phase}.network.normalRequestCount: 0`).join(", "),
+                phases: uncoveredNoCmp.map((p) => p.phase),
+            });
+        }
+        else {
+            checks.push({
+                id: "cookieless-covers-unconsented",
+                title: "Cookieless tracking covers the unconsented states",
+                status: "not_applicable",
+                detail: "No cookieless bundle is part of this deployment.",
+                evidence: "no cookieless snippet, request or global in any phase",
+                phases: unconsentedNames,
+            });
+        }
+    }
+    else if (unconsented.length === 0) {
+        checks.push(unreliableReject
+            ? {
+                id: "cookieless-covers-unconsented",
+                title: "Cookieless tracking covers the unconsented states",
+                status: "inconclusive",
+                detail: `The clean phase did not run, and the reject phase's refusal was not certified: ${undrivenDetail(reject.consentAcceptance)} So no unconsented state was reliably observed.`,
+                evidence: `clean: not run; reject.consentAcceptance.succeeded: false, undrivenReason: ${reject.consentAcceptance.undrivenReason ?? "none"}`,
+                phases: ["reject"],
+            }
+            : NOT_RUN("cookieless-covers-unconsented", "Cookieless tracking covers the unconsented states", "clean"));
+    }
+    else if (uncovered.length === 0) {
+        checks.push({
+            id: "cookieless-covers-unconsented",
+            title: "Cookieless tracking covers the unconsented states",
+            status: "not_applicable",
+            detail: "The normal bundle ran in every unconsented state, so the cookieless bundle correctly stood down — nothing was left uncovered." +
+                (unreliableReject
+                    ? ` (The reject phase's refusal was not certified — ${reject.consentAcceptance.undrivenReason ?? "unknown reason"} — so it was left out of this check.)`
+                    : ""),
+            evidence: unconsented
+                .map((p) => `${p.phase}.network.normalRequestCount: ${p.network.normalRequestCount}`)
+                .join(", "),
+            phases: unconsentedNames,
+        });
+    }
+    else {
+        const silent = uncovered.filter((p) => p.network.cookielessRequestCount === 0);
+        checks.push({
+            id: "cookieless-covers-unconsented",
+            title: "Cookieless tracking covers the unconsented states",
+            status: silent.length === 0 ? "pass" : "fail",
+            detail: silent.length === 0
+                ? `The cookieless bundle fired in every unconsented state where nothing else was tracking (${uncovered
+                    .map((p) => p.phase)
+                    .join(", ")}).`
+                : `A cookieless bundle is installed but the ${silent
+                    .map((p) => p.phase)
+                    .join(" and ")} phase(s) recorded nothing at all — neither bundle sent an event, so those visits went untracked entirely.` +
+                    (unreliableReject
+                        ? ` (The reject phase's refusal was not certified — ${reject.consentAcceptance.undrivenReason ?? "unknown reason"} — so it was left out of this check.)`
+                        : ""),
+            // The container's own account of the cookieless tag's gate, when it has
+            // one, appended to the behavioural counts. Silence in the unconsented
+            // phases is the symptom; a consent requirement on the cookieless tag is
+            // the reason, and until it was read the fix rested on inference from
+            // request counts alone. checkproof.com is the case: tag 96 (standard)
+            // and tag 97 (cookieless) both require analytics_storage.
+            evidence: [
+                uncovered
+                    .map((p) => `${p.phase}.network.cookielessRequestCount: ${p.network.cookielessRequestCount} (normal: ${p.network.normalRequestCount})`)
+                    .join(", "),
+                ...cookielessTagGates(cookielessGateContainers).map(({ containerId, tag }) => `${containerId} tag ${tag.tagIndex} (cookieless) consent: ${tag.consent === null ? "none" : `[${tag.consent.join(", ")}]`}${tag.blockedWhen.length > 0 ? `, blocked when ${tag.blockedWhen.join("; or ")}` : ""}`),
+            ]
+                .filter((part) => part.length > 0)
+                .join("; "),
+            // A failure belongs to the phases that actually went untracked, not to
+            // every unconsented phase the check looked at.
+            phases: (silent.length === 0 ? uncovered : silent).map((p) => p.phase),
+        });
+    }
+    // 5/6. Identity storage has to follow the answer, in both directions.
+    if (!grant) {
+        checks.push(NOT_RUN("grant-sets-identity-cookies", "Identity cookies are written after a grant", "grant"));
+    }
+    else if (!grant.consentAcceptance.succeeded && !grant.consent.cmpDetected) {
+        // Storage seen here is the ungated default, not the effect of a grant.
+        // Calling it a pass would credit consent handling to a site that has no
+        // consent gate at all — the reader would then trust a grant path that was
+        // never exercised.
+        checks.push({
+            id: "grant-sets-identity-cookies",
+            title: "Identity cookies are written after a grant",
+            status: "not_applicable",
+            detail: "No consent platform was detected, so there is no grant for identity storage to follow.",
+            evidence: "grant.consent.cmpDetected: false",
+            phases: ["grant"],
+        });
+    }
+    else if (!grant.consentAcceptance.succeeded) {
+        checks.push({
+            id: "grant-sets-identity-cookies",
+            title: "Identity cookies are written after a grant",
+            status: "inconclusive",
+            detail: `${undrivenDetail(grant.consentAcceptance)} Any storage seen here is not attributable to a grant.`,
+            evidence: `grant.consentAcceptance.succeeded: false, undrivenReason: ${grant.consentAcceptance.undrivenReason ?? "none"}`,
+            phases: ["grant"],
+        });
+    }
+    else if (grant.network.normalRequestCount === 0) {
+        checks.push({
+            id: "grant-sets-identity-cookies",
+            title: "Identity cookies are written after a grant",
+            status: "not_applicable",
+            detail: "The normal bundle never ran in the grant phase, so there was nothing to write cookies.",
+            evidence: "grant.network.normalRequestCount: 0",
+            phases: ["grant"],
+        });
+    }
+    else {
+        const cookies = identityCookiesSet(grant);
+        const hasAnonymous = cookies.some((name) => name.endsWith("anonymous_id"));
+        checks.push({
+            id: "grant-sets-identity-cookies",
+            title: "Identity cookies are written after a grant",
+            status: hasAnonymous ? "pass" : "fail",
+            detail: hasAnonymous
+                ? `An anonymous id was stored after the grant (${cookies.join(", ")}).`
+                : "The normal bundle ran after the grant but stored no anonymous id, so visitors cannot be stitched across events.",
+            evidence: `grant identity cookies: [${cookies.join(", ")}]`,
+            phases: ["grant"],
+        });
+    }
+    if (!reject) {
+        checks.push(NOT_RUN("reject-writes-no-identity", "No identity storage after a refusal", "reject"));
+    }
+    else if (!reject.consentAcceptance.succeeded && !reject.consent.cmpDetected) {
+        checks.push({
+            id: "reject-writes-no-identity",
+            title: "No identity storage after a refusal",
+            status: "not_applicable",
+            detail: "No consent platform was detected, so there is no refusal for identity storage to follow.",
+            evidence: "reject.consent.cmpDetected: false",
+            phases: ["reject"],
+        });
+    }
+    else if (!reject.consentAcceptance.succeeded) {
+        checks.push({
+            id: "reject-writes-no-identity",
+            title: "No identity storage after a refusal",
+            status: "inconclusive",
+            detail: `${undrivenDetail(reject.consentAcceptance)} Any storage seen here is not attributable to a refusal.`,
+            evidence: `reject.consentAcceptance.succeeded: false, undrivenReason: ${reject.consentAcceptance.undrivenReason ?? "none"}`,
+            phases: ["reject"],
+        });
+    }
+    else {
+        const cookies = identityCookiesSet(reject);
+        const stored = Object.entries(reject.cookies.localStorageValues)
+            .filter(([, v]) => v !== null)
+            .map(([k]) => k);
+        const bad = cookies.length > 0 || stored.length > 0;
+        checks.push({
+            id: "reject-writes-no-identity",
+            title: "No identity storage after a refusal",
+            status: bad ? "fail" : "pass",
+            detail: bad
+                ? `Consent was refused, but identity was still stored: ${describeIdentityStores(cookies, stored)}.`
+                : `No ${DD_COOKIE_NAMES[0]}-style cookie or localStorage entry survived the refusal.`,
+            evidence: `reject identity cookies: [${cookies.join(", ")}], localStorage: [${stored.join(", ")}]`,
+            phases: ["reject"],
+        });
+    }
+    // 7. Consent Mode v2 has to carry the decision, not just the CMP's own store.
+    const driven = [grant, reject].filter((p) => p?.consentAcceptance.succeeded === true);
+    if (driven.length === 0) {
+        const anyCmpDetected = [grant, reject].some((p) => p?.consent.cmpDetected);
+        checks.push({
+            id: "consent-mode-signal",
+            title: "Google Consent Mode v2 reflects the decision",
+            status: anyCmpDetected ? "inconclusive" : "not_applicable",
+            detail: anyCmpDetected
+                ? "No consent choice was successfully driven, so no Consent Mode transition could be observed."
+                : "No consent platform was detected, so there is no decision for Consent Mode to reflect.",
+            evidence: anyCmpDetected
+                ? "no phase with consentAcceptance.succeeded: true"
+                : "consent.cmpDetected: false in grant and reject",
+            phases: [grant, reject].filter((p) => p !== undefined).map((p) => p.phase),
+        });
+    }
+    else if (driven.every((p) => p.consentAcceptance.consentSignalConfirmed === null && p.consent.analyticsStorageState === null)) {
+        checks.push({
+            id: "consent-mode-signal",
+            title: "Google Consent Mode v2 reflects the decision",
+            status: "not_applicable",
+            detail: "The page exposes no Google Consent Mode state at all (no gtag.js), so it cannot be held to one.",
+            evidence: "consentAcceptance.consentSignalConfirmed: null and analytics_storage unreadable in every driven phase",
+            phases: driven.map((p) => p.phase),
+        });
+    }
+    else {
+        const verdicts = driven.map(consentModeVerdict);
+        const broken = verdicts.filter((v) => v.verdict === "broken");
+        const unconfirmed = verdicts.filter((v) => v.verdict === "unconfirmed");
+        const status = broken.length > 0 ? "fail" : unconfirmed.length > 0 ? "inconclusive" : "pass";
+        const relevant = broken.length > 0 ? broken : unconfirmed.length > 0 ? unconfirmed : verdicts;
+        checks.push({
+            id: "consent-mode-signal",
+            title: "Google Consent Mode v2 reflects the decision",
+            status,
+            detail: status === "pass"
+                ? `analytics_storage followed every choice this run drove (${verdicts.map((v) => v.phase).join(", ")}), and the value was still there after the post-consent reload.`
+                : relevant.map((v) => v.why).join(" "),
+            evidence: verdicts.map((v) => v.evidence).join("; "),
+            phases: relevant.map((v) => v.phase),
+        });
+    }
+    // 8. And the mechanism itself has to be installed, complete and in the
+    //    right order — which is a different question from either of the two
+    //    above and, until now, one no check asked.
+    //
+    //    clean-consent-mode-default asks whether the default denies.
+    //    consent-mode-signal asks whether a driven decision is carried. Both
+    //    read analytics_storage, and both are satisfiable by a page that never
+    //    called gtag('consent', …) in its life: gtag/GTM creates the entries
+    //    itself as soon as a container loads, so `denied` on an unanswered
+    //    page can equally be a declared default or gtag.js's own fallback on a
+    //    site with no Consent Mode at all. ics.active is what separates them.
+    //
+    //    SCOPE BOUNDARY, and it matters for how a reader takes a pass here:
+    //    this says nothing about whether an unanswered visitor is COVERED.
+    //    A site can pass this check while every unconsented visit goes
+    //    untracked, because the standard bundle's loader correctly declines to
+    //    initialise and no cookieless bundle was installed behind it. That is
+    //    cookieless-covers-unconsented's question, and the two must not be
+    //    read as one.
+    const observedPhases = [...byPhase.values()];
+    checks.push(consentModeV2Check(observedPhases, judgeConsentModeV2(observedPhases)));
+    return checks;
+}
+const CONSENT_MODE_V2_TITLE = "Google Consent Mode v2 is correctly enabled";
+/** Turns the run-level Consent Mode v2 verdict into the customer-facing check. */
+function consentModeV2Check(phases, verdict) {
+    const observed = verdict.perPhase.map((entry) => entry.phase);
+    const check = (status, detail) => ({
+        id: "consent-mode-v2-enabled",
+        title: CONSENT_MODE_V2_TITLE,
+        status,
+        detail,
+        evidence: verdict.evidence,
+        phases: observed,
+    });
+    if (verdict.outcome === "unreadable") {
+        // A page with no gtag.js has nothing to be held to. A page that HAS one
+        // and still exposed no readable state is a gap in what this run could
+        // see, which is a different thing and must not read as a pass.
+        return sawGoogleTag(phases)
+            ? check("inconclusive", "A Google tag is on the page, but it exposed no readable Consent Mode state, so whether Consent Mode v2 is enabled could not be established.")
+            : check("not_applicable", "The page carries no Google tag, so there is no Google Consent Mode to enable. Consent still has to be honoured — the checks above are what say whether it is.");
+    }
+    if (verdict.outcome === "not-installed") {
+        return check("fail", "Google Consent Mode v2 is not enabled. A Google tag is on the page and it created the consent signal entries itself, which is why analytics_storage looks readable, but nothing ever called gtag('consent', …) — so no consent decision reaches any tag gated on it, and a tag waiting for one waits forever.");
+    }
+    if (verdict.outcome === "misconfigured") {
+        // v1 and a late-setting CMP are faults in what the site DECLARES and in
+        // what order — the mechanism is incomplete or arrives too late to gate
+        // anything — so they fail.
+        //
+        // A shadowed default or a closed wait window is a fault in what the
+        // declared state can be READ as. Google resolved both correctly, so
+        // anything gated on analytics_storage got the right answer and neither
+        // can, by construction, be what let a tag through. Deliberately NOT
+        // upgraded to a fail when this run also leaked: on workflex.com the leak
+        // is a tag manager tag that declares no consent requirement at all, which
+        // clean-before-consent already fails on, and blaming it on the shadowed
+        // default would both double-count it and tell a customer their Consent
+        // Mode is broken when it is the one part that works.
+        const structural = verdict.causes.includes("v1-only") || verdict.causes.includes("set-late");
+        return check(structural ? "fail" : "warn", describeMisconfigured(verdict));
+    }
+    if (verdict.outcome === "enabled-not-yet-answered") {
+        return check("pass", "Google Consent Mode v2 is enabled: both signals v2 added are declared and gtag('consent', …) is in use. No consent update applied during this run, which is the correct and normal state for a visitor who has not answered the banner — it is not evidence of a fault.");
+    }
+    return check("pass", "Google Consent Mode v2 is enabled and carrying decisions: both signals v2 added are declared, gtag('consent', …) is in use, and a consent update was applied for the choice this run drove.");
+}
+/** One sentence per cause, in the verdict's own fixed order. */
+function describeMisconfigured(verdict) {
+    const sentences = [];
+    if (verdict.causes.includes("v1-only")) {
+        sentences.push("Consent Mode is running v1, not v2: ad_user_data and ad_personalization are not among the declared signals.");
+    }
+    if (verdict.causes.includes("set-late")) {
+        sentences.push("Consent was set after tags had already run (ics.wasSetLate), so the consent platform loads too late to gate them — the tags that fire before it see no consent state at all.");
+    }
+    if (verdict.causes.includes("region-shadowed-default")) {
+        sentences.push("The consent platform declares a permissive global default for analytics_storage and then overrides it for specific regions. Google resolves that correctly, so the end state is right, but anything reading the dataLayer consent commands directly sees the global 'granted' and takes it for a decision.");
+    }
+    if (verdict.causes.includes("wait-period-timed-out")) {
+        sentences.push("A wait_for_update window closed with no consent update in it, so tags fell back to the declared defaults rather than the visitor's answer.");
+    }
+    return sentences.join(" ");
+}
+/**
+ * What Consent Mode actually did with one driven decision.
+ *
+ * The transient confirmation is not enough on its own. `consentSignalConfirmed`
+ * is read on the answered page, before the post-consent reload, so a CMP that
+ * emits the update and then fails to restore it on the next load looks
+ * identical to one that works — and every gated tag on every subsequent page
+ * stays frozen. The phase's own end state is therefore judged too, and only a
+ * value whose source is an explicit `update` is taken as agreement. A site
+ * that declares analytics_storage denied by default, or one running on
+ * gtag.js's own fallback because nothing declared covers this visitor, reads
+ * "denied" on every reject phase whether or not the refusal was ever carried
+ * — a match by coincidence is not evidence.
+ */
+function consentModeVerdict(phase) {
+    const expected = phase.phase === "grant" ? "granted" : "denied";
+    const observed = phase.consent.analyticsStorageState;
+    const source = phase.consent.analyticsStorageSource;
+    const confirmed = phase.consentAcceptance.consentSignalConfirmed;
+    const evidence = `${phase.phase}: analytics_storage ${observed ?? "unreadable"} (${source ?? "no source"}), expected ${expected}, signalConfirmed ${confirmed}`;
+    const of = (verdict, why) => ({
+        phase: phase.phase,
+        verdict,
+        why,
+        evidence,
+    });
+    if (confirmed === false) {
+        return of("broken", `The CMP recorded the ${phase.phase === "grant" ? "grant" : "refusal"} but analytics_storage never moved to ${expected} at all, so nothing gated on Consent Mode could react.`);
+    }
+    if (observed === null) {
+        return of("unconfirmed", `The ${phase.phase} phase saw analytics_storage reach ${expected} while the banner was being answered, but the reloaded page exposes no Consent Mode state to check it against.`);
+    }
+    if (observed !== expected) {
+        return of("broken", `The ${phase.phase} phase drove the banner and analytics_storage read ${expected} while it was being answered, but after the post-consent reload it reads ${observed} (${source ?? "no source"}) — the decision does not survive a page load, so on the page the visitor actually browses every tag gated on Consent Mode stays ${observed}.`);
+    }
+    if (source !== "update") {
+        return of("unconfirmed", `The ${phase.phase} phase ends with analytics_storage ${observed}, which is what was wanted, but ` +
+            (source === "default"
+                ? "it comes from a default the site itself declares rather than from a consent update"
+                : "its source is gtag.js's own implicit default — nothing declared by the site or CMP applies to this visitor") +
+            `, so the value matches by coincidence and is not evidence the choice was carried into Consent Mode.`);
+    }
+    return of("confirmed", `The ${phase.phase} phase ends with analytics_storage ${observed} (${source}).`);
+}
+/**
+ * Whether tracking survived the walk to the second page, for one phase.
+ *
+ * Two asymmetries are deliberate. A normal bundle that stops is always a
+ * failure — the visitor consented and stopped being counted. A cookieless
+ * bundle that stops is only a failure when nothing replaced it, because the
+ * loader stands down on purpose when it finds the normal bundle live, exactly
+ * as `cookieless-covers-unconsented` allows on the first page. And a mode
+ * APPEARING on the second page is never this check's business: that is a
+ * consent question, and second-page-honours-consent asks it.
+ */
+function judgeContinuity({ phase, second }) {
+    // A page the install was never put on cannot show tracking stopping.
+    // whereby.com serves /blog/ from a separate Gatsby build with no tag
+    // manager, no script and no global; judged as continuity it says "tracking
+    // stopped after the first page view" about a site whose every other page
+    // tracks. The walk now steps past such pages (see SECOND_PAGE_MAX_RETRIES);
+    // this is what happens when every candidate it could reach was one.
+    // Optional-chained rather than compared to null: evidence collected before
+    // the second-page install probe existed has no such field at all, and
+    // replaying the stored corpus must not crash on it.
+    if (second.install?.present === false) {
+        return { phase: phase.phase, judged: false, outsideInstall: true, failures: [] };
+    }
+    const firstNormal = phase.network.normalRequestCount;
+    const firstCookieless = phase.network.cookielessRequestCount;
+    const nextNormal = second.network.normalRequestCount;
+    const nextCookieless = second.network.cookielessRequestCount;
+    const failures = [];
+    if (firstNormal > 0 && nextNormal === 0) {
+        failures.push(`in the ${phase.phase} phase the normal bundle sent ${firstNormal} request(s) on the first page and none on ${second.toUrl}` +
+            (nextCookieless > 0
+                ? ", where only the cookieless bundle fired — a visitor whose consent state allows identified tracking is tracked anonymously from the second page onwards, and their two page views cannot be stitched together"
+                : ""));
+    }
+    if (firstCookieless > 0 && nextCookieless === 0 && nextNormal === 0) {
+        failures.push(`in the ${phase.phase} phase the cookieless bundle covered the first page and nothing at all tracked ${second.toUrl}`);
+    }
+    return {
+        phase: phase.phase,
+        judged: firstNormal > 0 || firstCookieless > 0,
+        outsideInstall: false,
+        failures,
+    };
+}
+/**
+ * Pages the walk stepped past, as one clause.
+ *
+ * They are a finding in their own right and must not vanish into the evidence
+ * JSON: a section of the site that ships no bundle at all — whereby.com's blog
+ * before a consent decision is recorded — is worth a reader's attention even
+ * though the check itself went on to judge somewhere else.
+ */
+function walkedPastNote(walked) {
+    const skipped = [
+        ...new Set(walked.flatMap((w) => w.second.rejectedCandidates.map((c) => c.url))),
+    ];
+    return skipped.length === 0
+        ? ""
+        : ` The walk stepped past ${skipped.join(", ")} first: no Dreamdata script, global or tag manager was on ${skipped.length > 1 ? "those pages" : "that page"}, so nothing there could be judged either way — worth checking by hand if that section is meant to be tracked.`;
+}
+function continuityEvidence(walked) {
+    return walked
+        .map(({ phase, second }) => `${phase.phase}: first page ${phase.network.normalRequestCount}n/${phase.network.cookielessRequestCount}c → second page ${second.network.normalRequestCount}n/${second.network.cookielessRequestCount}c (${second.kind}${second.install?.present === false ? ", no install on that page" : ""})`)
+        .join("; ");
+}
+/**
+ * The continuity checks, split by how the site navigates.
+ *
+ * One question — "does tracking survive a page change?" — but the two answers
+ * are fixed in different places and by different people, so they are reported
+ * as two checks rather than one. A document load that stops tracking is a
+ * deployment problem: the bundle or its tag-manager trigger is not on the
+ * second page. A same-document route change that stops tracking is a code
+ * problem: the bundle is right there and nobody calls page() when the route
+ * changes. Every phase falls into exactly one of them, so nothing is counted
+ * twice.
+ */
+function buildContinuityCheck(kind, phases, walkedByKind) {
+    const id = kind === "hard" ? "second-page-keeps-tracking" : "soft-nav-keeps-tracking";
+    const title = kind === "hard" ? "Tracking survives a page change" : "Tracking survives an in-app route change";
+    if (phases.every((p) => p.secondPage === null)) {
+        return {
+            id,
+            title,
+            status: "inconclusive",
+            detail: "No second page was visited this run (--no-second-page), so nothing beyond the first page view was observed.",
+            evidence: "secondPage: null in every phase",
+            phases: phases.map((p) => p.phase),
+        };
+    }
+    if (walkedByKind.length === 0) {
+        const walkedOther = phases.filter((p) => secondPageObserved(p.secondPage));
+        if (walkedOther.length > 0) {
+            return {
+                id,
+                title,
+                status: "not_applicable",
+                detail: kind === "hard"
+                    ? "Every navigation this run followed was handled inside the same document by the site's own router, so there was no second document load to judge — soft-nav-keeps-tracking covers those."
+                    : "Every navigation this run followed loaded a new document, so the site does not navigate in-app on the paths tested — second-page-keeps-tracking covers those.",
+                evidence: walkedOther
+                    .map((p) => `${p.phase}.secondPage.kind: ${p.secondPage?.kind}`)
+                    .join(", "),
+                // Every one of those phases is the other check's to judge, so this one
+                // claims none of them.
+                phases: [],
+            };
+        }
+        const reasons = phases
+            .filter((p) => p.secondPage !== null)
+            .map((p) => `${p.phase}: ${p.secondPage?.skippedReason ?? "no navigation observed"}`);
+        return {
+            id,
+            title,
+            status: "inconclusive",
+            detail: `No second page could be reached, so whether tracking continues past the first page view is unknown. ${reasons.join("; ")}`,
+            evidence: reasons.join("; "),
+            phases: phases.filter((p) => p.secondPage !== null).map((p) => p.phase),
+        };
+    }
+    const verdicts = walkedByKind.map(judgeContinuity);
+    const judged = verdicts.filter((v) => v.judged);
+    if (judged.length === 0) {
+        const outside = verdicts.filter((v) => v.outsideInstall);
+        const landings = walkedByKind
+            .filter((w) => w.second.install?.present === false)
+            .map((w) => `${w.phase.phase}: ${w.second.toUrl}`);
+        return {
+            id,
+            title,
+            status: "not_applicable",
+            detail: outside.length === verdicts.length
+                ? `Every page the walk could reach is outside this install — no Dreamdata script, global or tag manager is on any of them (${landings.join("; ")}), which is what a separately-built section of the same domain looks like. Nothing about whether tracking survives a page change follows from them, in either direction. Check a page the install does cover by hand.`
+                : "Nothing tracked the first page in any phase that reached a second one, so there was no tracking for a page change to interrupt.",
+            evidence: continuityEvidence(walkedByKind),
+            phases: walkedByKind.map((w) => w.phase.phase),
+        };
+    }
+    const failures = judged.flatMap((v) => v.failures);
+    const mechanism = kind === "hard"
+        ? "The second page was a full document load, so every bundle got a fresh chance to run: check that the bundle — and, if a tag manager injects it, that tag's own firing trigger — is present on pages other than the entry page."
+        : "The second page was a same-document route change, so no script re-ran. A bundle that only tracks on load will never fire again: the site's router has to call page() itself on every route change.";
+    const walkedPast = walkedPastNote(walkedByKind);
+    return {
+        id,
+        title,
+        status: failures.length === 0 ? "pass" : "fail",
+        detail: failures.length === 0
+            ? `Tracking continued onto the second page in every phase that reached one (${judged
+                .map((v) => v.phase)
+                .join(", ")}).${walkedPast}`
+            : `Tracking stopped after the first page view: ${failures.join("; ")}. ${mechanism}${walkedPast}`,
+        evidence: continuityEvidence(walkedByKind),
+        // Only the phases that actually stopped tracking. One broken phase out of
+        // three used to read as all three being broken to anything reading the
+        // status alone.
+        phases: (failures.length === 0 ? judged : judged.filter((v) => v.failures.length > 0)).map((v) => v.phase),
+    };
+}
+/**
+ * Whether the consent decision still held one page later.
+ *
+ * Only the states where identified tracking is not allowed can fail this. The
+ * usual cause is a CMP configured to treat a navigation as implied consent,
+ * which is invisible to any single-page-load check and turns an unanswered or
+ * refused banner into a live normal bundle on page two.
+ */
+function buildSecondPageConsentCheck(phases, walked) {
+    const id = "second-page-honours-consent";
+    const title = "The consent decision still holds one page later";
+    const candidates = walked.filter(({ phase }) => phase.phase === "clean" || phase.phase === "reject");
+    if (candidates.length === 0) {
+        return {
+            id,
+            title,
+            status: "inconclusive",
+            detail: "Neither the clean nor the reject phase reached a second page, so whether an unanswered or refused banner still holds after a navigation is unknown.",
+            evidence: walked.length === 0 ? "no phase reached a second page" : `second pages reached: ${walked.map((w) => w.phase.phase).join(", ")}`,
+            phases: phases.filter((p) => p.phase !== "grant").map((p) => p.phase),
+        };
+    }
+    // A phase only has a consent decision to still honour one page later if it
+    // actually had one: "clean" needs a banner that exists and is genuinely
+    // unanswered, "reject" needs the refusal to have actually been driven. A
+    // site with no CMP at all firing the normal bundle everywhere is not this
+    // check's business — there is no decision for the second page to betray.
+    const gated = candidates.filter(({ phase }) => phase.phase === "clean"
+        ? phase.consent.cmpDetected && phase.consent.cmpHasResponse !== true
+        : phase.consentAcceptance.succeeded);
+    if (gated.length === 0) {
+        const anyCmpDetected = phases.some((p) => p.consent.cmpDetected);
+        const reasons = candidates.map(({ phase }) => phase.phase === "clean"
+            ? phase.consent.cmpDetected
+                ? `${phase.phase}: the banner was already answered on first load, so there was no unanswered state to carry forward`
+                : `${phase.phase}: no consent platform was detected, so there is no gate for tracking to honour`
+            : `${phase.phase}: ${undrivenDetail(phase.consentAcceptance)}`);
+        return {
+            id,
+            title,
+            status: anyCmpDetected ? "inconclusive" : "not_applicable",
+            detail: `${reasons.join("; ")}. A normal bundle firing on every page is expected when there is no consent decision to honour.`,
+            evidence: candidates
+                .map(({ phase }) => `${phase.phase}.consent.cmpDetected: ${phase.consent.cmpDetected}, consentAcceptance.succeeded: ${phase.consentAcceptance.succeeded}`)
+                .join("; "),
+            phases: [],
+        };
+    }
+    // Kept per-phase rather than flattened straight to strings, so the failure
+    // can be attributed to the state that broke instead of to both.
+    const perPhase = gated.map(({ phase, second }) => {
+        const stored = storedIdentityNames(second.cookies);
+        const problems = [];
+        if (second.network.normalRequestCount > 0) {
+            problems.push(`${phase.phase}: the normal bundle sent ${second.network.normalRequestCount} request(s) on ${second.toUrl} even though consent was ${phase.phase === "reject" ? "explicitly refused" : "never given"}`);
+        }
+        if (stored.length > 0 && identityCookiesSet(phase).length === 0) {
+            problems.push(`${phase.phase}: identity storage appeared only after the navigation (${stored.join(", ")}), so the page change itself was treated as consent`);
+        }
+        return { phase: phase.phase, problems };
+    });
+    const failures = perPhase.flatMap((p) => p.problems);
+    return {
+        id,
+        title,
+        status: failures.length === 0 ? "pass" : "fail",
+        detail: failures.length === 0
+            ? `Navigating to another page did not turn identified tracking on in the ${gated
+                .map((w) => w.phase.phase)
+                .join(" or ")} phase(s).`
+            : `${failures.join("; ")}. A CMP that treats a navigation as implied consent is the usual cause, and no single page load can reveal it.`,
+        evidence: gated
+            .map(({ phase, second }) => `${phase.phase}.secondPage.normalRequestCount: ${second.network.normalRequestCount}, identity storage: [${storedIdentityNames(second.cookies).join(", ")}]`)
+            .join("; "),
+        phases: failures.length === 0
+            ? gated.map((w) => w.phase.phase)
+            : perPhase.filter((p) => p.problems.length > 0).map((p) => p.phase),
+    };
+}
+/**
+ * Which identity fields a request must carry, decided by the bundle that sent
+ * it.
+ *
+ * The asymmetry is the whole point: a cookieless event carries NO anonymousId
+ * by design — identity is resolved server-side — so requiring one of it would
+ * report the cookieless bundle working exactly as built as a defect. An
+ * unknown mode is held only to the write key, since which bundle's rules
+ * apply cannot be read off the payload. hasUserId/hasUserData are optional in
+ * every mode: they depend on the site calling identify(), which this harness
+ * never triggers.
+ */
+function requiredIdentityFields(mode) {
+    return mode === "normal" ? ["hasWriteKey", "hasAnonymousId"] : ["hasWriteKey"];
+}
+function inspectRequests(phases) {
+    const inspected = [];
+    for (const phase of phases) {
+        const sources = [
+            [phase.network.requests, "first page"],
+            [phase.secondPage?.network.requests ?? [], "second page"],
+        ];
+        for (const [requests, where] of sources) {
+            for (const request of requests) {
+                inspected.push({
+                    phase: phase.phase,
+                    where,
+                    mode: request.mode,
+                    endpointName: request.endpointName ?? "unknown",
+                    missing: requiredIdentityFields(request.mode).filter((field) => !request.identity[field]),
+                    status: request.status,
+                });
+            }
+        }
+    }
+    return inspected;
+}
+/**
+ * Every event that reached Dreamdata carried the identity its own bundle owes.
+ *
+ * A request missing a field its mode requires is an event the server cannot
+ * attribute — a normal-bundle page view with no anonymousId cannot be joined
+ * to the visitor's other page views, so it lands as an orphan.
+ *
+ * The severity turns on whether ANY request of that mode got it right in the
+ * same phase, and the distinction is load-bearing rather than cosmetic. All
+ * of them malformed means that bundle's identity is genuinely broken and the
+ * events are being lost — a failure. Some malformed alongside well-formed
+ * ones means the page view WAS delivered attributably and something sent an
+ * extra, thinner copy: a real defect that this run proved is not costing the
+ * customer the page view, which is exactly what "warn" is for. Reporting the
+ * second as a failure would sink a run whose tracking demonstrably works.
+ */
+function buildRequestPayloadCheck(phases) {
+    const id = "request-payload-complete";
+    const title = "Every event carried the identity its bundle owes";
+    const inspected = inspectRequests(phases);
+    if (inspected.length === 0) {
+        return {
+            id,
+            title,
+            status: "not_applicable",
+            detail: "No request reached Dreamdata in any phase, so there was no payload to inspect. Whether anything should have fired is a question for the consent and core-tracking checks, not this one.",
+            evidence: `requests observed: 0 across ${phases.length} phase(s)`,
+            phases: [],
+        };
+    }
+    const malformed = inspected.filter((b) => b.missing.length > 0);
+    if (malformed.length === 0) {
+        return {
+            id,
+            title,
+            status: "pass",
+            detail: `All ${inspected.length} event(s) carried the identity fields their bundle requires.`,
+            evidence: `${inspected.length} request(s) inspected; 0 missing a required identity field`,
+            phases: [...new Set(inspected.map((b) => b.phase))],
+        };
+    }
+    // Per phase AND mode: "the normal bundle never identified anything in the
+    // reject phase" is a different statement from "one of its three events in
+    // the grant phase went out thin", and only the first is a failure.
+    const brokenGroups = [...new Set(malformed.map((b) => `${b.phase}/${b.mode}`))].filter((key) => inspected.filter((b) => `${b.phase}/${b.mode}` === key).every((b) => b.missing.length > 0));
+    const describe = (b) => `${b.phase}/${b.where}: a ${b.mode} ${b.endpointName} event with no ${b.missing.join(" or ")}`;
+    return {
+        id,
+        title,
+        status: brokenGroups.length > 0 ? "fail" : "warn",
+        detail: brokenGroups.length > 0
+            ? `${malformed.map(describe).join("; ")}. Every ${brokenGroups.join(" and ")} event this run saw was missing a required field, so those events cannot be attributed to the visitor who generated them.`
+            : `${malformed.map(describe).join("; ")}. The same page view was also delivered with full identity in that phase, so the visitor is attributed and nothing was lost — but something is sending an extra, thinner copy of the event, which is worth removing.`,
+        evidence: malformed
+            .map((b) => `${b.phase}.${b.where === "first page" ? "network" : "secondPage.network"}.requests: ${b.mode} ${b.endpointName} missing ${b.missing.join(", ")}`)
+            .join("; "),
+        phases: [...new Set(malformed.map((b) => b.phase))],
+    };
+}
+/**
+ * What the install said about itself in the console.
+ *
+ * The collector keeps only messages mentioning "dreamdata" (see
+ * attachConsoleCollector), so this is a narrow signal in both directions: a
+ * message here is almost certainly about the install, and an empty list says
+ * nothing whatsoever about the page's overall health. The detail says so
+ * rather than letting "no errors" read as "the page is clean".
+ *
+ * **This check never fails**, whatever severity the message was printed at.
+ * A console message is the install narrating itself; it is not evidence that
+ * anything the customer cares about broke, and every consequence that would
+ * matter is already observed directly somewhere else — a bundle that never
+ * loaded fails script-installed, events that never fired fail the consent
+ * checks, events that were rejected fail request-delivery-accepted. Two runs
+ * settled it: blackline.com prints "Plugin loaded - YOU SHOULD SEE THIS IN
+ * PRODUCTION" through console.error on every page load, and qa.com's install
+ * reports "Failed to enable Dynamics 365 Marketing" — a third-party
+ * destination that was not ready — while its own page views were delivered
+ * and answered 2xx in all three phases. Both sank a report that was otherwise
+ * clean, on a line of text no visitor sees and no event lost.
+ *
+ * So the message is reported, quoted in full, and graded a warning: a real
+ * defect worth fixing that this run showed cost nothing (see CrossPhaseCheck).
+ * describesFailure only decides how it is worded — whether the install is
+ * reporting a failure or narrating itself in production.
+ *
+ * Kept apart from global-handoff, which uses these same messages only to
+ * EXPLAIN a stub-queue failure it detected another way. A site can log
+ * "Dreamdata snippet included twice" while the handoff still completes, and
+ * that is worth reporting on its own.
+ */
+function buildConsoleCheck(phases) {
+    const id = "console-clean";
+    const title = "No Dreamdata errors in the console";
+    // Filtered again here, not only in the collector: replay re-scores evidence
+    // JSON collected by an older build, and idtdna.com's corpus entry carries a
+    // CSP error that only matched because the policy it printed allows
+    // cdn.dreamdata.cloud. Re-running the crawl is not a reasonable price for
+    // correcting a false positive in a stored run.
+    const errors = phases.flatMap((p) => p.console.errors.filter(mentionsDreamdata).map((text) => ({ phase: p.phase, text })));
+    const warnings = phases.flatMap((p) => p.console.warnings.filter(mentionsDreamdata).map((text) => ({ phase: p.phase, text })));
+    const logged = [...errors, ...warnings];
+    const quote = (entries) => entries.map((e) => `${e.phase}: "${e.text}"`).join("; ");
+    if (logged.length > 0) {
+        // Severity is the site's choice and a poor guide to it: blackline.com's
+        // announcement arrives at error level, and plenty of real trouble arrives
+        // as a warning. What the message SAYS is the better reading, and it only
+        // shapes the sentence — never the status.
+        const reported = errors.filter((e) => describesFailure(e.text));
+        const chatter = errors.filter((e) => !describesFailure(e.text));
+        const parts = [
+            `The install logged ${logged.length} Dreamdata message(s) to the console: ${quote(logged)}.`,
+            reported.length > 0
+                ? `${reported.length} of them report something the install could not do.`
+                : "",
+            chatter.length > 0
+                ? `${chatter.length} ${chatter.length === 1 ? "is" : "are"} printed at error level but report nothing going wrong — debug output left on in production.`
+                : "",
+            "Nothing in this run showed tracking failing because of any of them; delivery, consent and identity are judged by their own checks.",
+        ];
+        return {
+            id,
+            title,
+            status: "warn",
+            detail: parts.filter((part) => part !== "").join(" "),
+            evidence: quote(logged),
+            phases: [...new Set(logged.map((e) => e.phase))],
+        };
+    }
+    return {
+        id,
+        title,
+        status: "pass",
+        detail: "No Dreamdata error or warning was logged in any phase. Only messages mentioning Dreamdata are captured, so this says nothing about the page's other scripts.",
+        evidence: `console.errors and console.warnings empty across ${phases.length} phase(s)`,
+        phases: phases.map((p) => p.phase),
+    };
+}
+/**
+ * Everything this run set out to observe, it observed.
+ *
+ * The other half of debugging-signals. console-clean speaks for what the
+ * install printed; this speaks for what the harness itself could not reach —
+ * a phase that timed out, a banner it failed to drive, a navigation it gave
+ * up on. Those are limits of the observation, never a defect of the site, so
+ * this check never fails: it is "inconclusive", which says the run saw less
+ * than it meant to without pretending the site did something wrong.
+ *
+ * It exists so debugging-signals is decided by checks rather than by the
+ * model's reading (see CHECK_DECIDED_ITEMS). Without it, the one thing left
+ * for the model to score the item down for was a collection error, and it had
+ * to be trusted to tell that apart from a broken install.
+ */
+function buildCollectionCompleteCheck(phases) {
+    const id = "collection-complete";
+    const title = "The run observed everything it set out to";
+    const errors = phases.flatMap((p) => p.collectionErrors.map((text) => ({ phase: p.phase, text })));
+    if (errors.length > 0) {
+        return {
+            id,
+            title,
+            status: "inconclusive",
+            detail: `The harness logged ${errors.length} collection error(s): ${errors.map((e) => `${e.phase}: "${e.text}"`).join("; ")}. These limit what this run could see; they say nothing about the install.`,
+            evidence: errors.map((e) => `${e.phase}.collectionErrors: "${e.text}"`).join("; "),
+            phases: [...new Set(errors.map((e) => e.phase))],
+        };
+    }
+    return {
+        id,
+        title,
+        status: "pass",
+        detail: "No phase logged a collection error, so nothing in the report is limited by something the harness failed to reach.",
+        evidence: `collectionErrors empty across ${phases.length} phase(s)`,
+        phases: phases.map((p) => p.phase),
+    };
+}
+/**
+ * The events went to the site's own domain, and the writeKey proves they are
+ * this install's.
+ *
+ * respond.io delivers to dd.respond.io, a first-party CNAME onto Dreamdata.
+ * Nothing in the URL says so, and the run that could not see it reported "no
+ * request reached Dreamdata in any phase" about a site whose every page view
+ * was being delivered and accepted — the worst kind of wrong a verification
+ * report can be. The collector now claims a Segment-shaped request on any host
+ * when it carries the same writeKey the installed bundle does (see
+ * attributeTo); this check is where that claim is stated out loud, because a
+ * host the run decided to trust on its own should never be something the
+ * reader has to reverse-engineer from a URL in the request log.
+ *
+ * The leftovers matter too, and differently:
+ * - No key anywhere in the page (a bundled npm install) means there was
+ *   nothing to match against, so a real first-party host would look exactly
+ *   like this. That is a warn naming --tracking-host, not a silent pass.
+ * - A key that simply differs is somebody else's Segment-shaped collector.
+ *   Not this install, and not this check's business.
+ */
+function buildFirstPartyDeliveryCheck(phases, install) {
+    const id = "first-party-delivery-host";
+    const title = "Events delivered to a first-party domain";
+    const hostOf = (url) => {
+        try {
+            return new URL(url).hostname;
+        }
+        catch {
+            return url;
+        }
+    };
+    // A host the operator named with --tracking-host is not a discovery: the run
+    // was told to watch it, and saying the writeKey is what claimed it would
+    // credit this check with work the flag did.
+    const configured = [...new Set(phases.flatMap((p) => p.network.trackingHosts))];
+    const offHost = (requests) => requests.map((r) => hostOf(r.url)).filter((host) => !isDreamdataUrl(`https://${host}/`, configured));
+    const claimed = [...new Set(phases.flatMap((p) => offHost(p.network.requests)))];
+    const leftover = phases.flatMap((p) => p.network.unattributedRequests);
+    const leftoverHosts = [...new Set(leftover.map((b) => hostOf(b.url)))];
+    if (claimed.length > 0) {
+        return {
+            id,
+            title,
+            status: "pass",
+            detail: `Events are delivered to ${claimed.join(", ")} rather than to a Dreamdata host directly — a first-party CNAME. They are counted as this install's because every one carries writeKey ${install.writeKey}, the key the installed bundle itself uses.`,
+            evidence: `network.requests hosts: ${claimed.join(", ")}; install.writeKey: ${install.writeKey ?? "null"}`,
+            phases: phases.filter((p) => offHost(p.network.requests).length > 0).map((p) => p.phase),
+        };
+    }
+    if (leftover.length > 0 && install.writeKey === null) {
+        return {
+            id,
+            title,
+            status: "warn",
+            detail: `${leftover.length} request(s) with the right shape went to ${leftoverHosts.join(", ")}, but this install exposes no writeKey anywhere in the page, so nothing can confirm they are Dreamdata's rather than another Segment-compatible tool's. Re-run with --tracking-host ${leftoverHosts[0]} if that host is yours.`,
+            evidence: `${leftoverHosts.join(", ")}; install.writeKey: null`,
+            phases: [...new Set(phases.filter((p) => p.network.unattributedRequests.length > 0).map((p) => p.phase))],
+        };
+    }
+    if (leftover.length > 0) {
+        return {
+            id,
+            title,
+            status: "not_applicable",
+            detail: `${leftover.length} Segment-shaped request(s) went to ${leftoverHosts.join(", ")} carrying a different writeKey than this install's (${install.writeKey}), so they belong to another tool and are not counted here.`,
+            evidence: `${leftoverHosts.join(", ")} carry a writeKey other than ${install.writeKey}`,
+            phases: [...new Set(phases.filter((p) => p.network.unattributedRequests.length > 0).map((p) => p.phase))],
+        };
+    }
+    return {
+        id,
+        title,
+        status: "not_applicable",
+        detail: "Every request this run saw went to a host it was already watching, so no first-party delivery domain had to be recognised.",
+        evidence: `no request outside the watched hosts (${["Dreamdata-owned", ...configured].join(", ")})`,
+        phases: phases.map((p) => p.phase),
+    };
+}
+/**
+ * Dreamdata accepted the events the site sent it.
+ *
+ * A request leaving the browser is not the same as an event being recorded:
+ * the request can be answered 400 for a write key the account does not
+ * recognise, 403, or 5xx. Every other check in this file reads the REQUEST —
+ * whether a bundle fired, what it carried, when — and would report a site
+ * whose every event is being rejected as tracking perfectly, because from the
+ * page's side it is. This is the one that reads the answer.
+ *
+ * A request whose response never came back is not counted either way: the page
+ * navigated away or the phase ended before it resolved, which is a limit of
+ * the observation and not a verdict about the server.
+ */
+function buildRequestDeliveryCheck(phases) {
+    const id = "request-delivery-accepted";
+    const title = "Dreamdata accepted the events it was sent";
+    const answered = inspectRequests(phases).filter((b) => b.status !== undefined);
+    if (answered.length === 0) {
+        return {
+            id,
+            title,
+            status: "not_applicable",
+            detail: "No event's response was observed in any phase, so whether Dreamdata accepted anything could not be read. That is a limit of what this run could see, not a statement about the server.",
+            evidence: "requests with an observed response status: 0",
+            phases: [],
+        };
+    }
+    const rejected = answered.filter((b) => b.status < 200 || b.status >= 300);
+    return {
+        id,
+        title,
+        status: rejected.length === 0 ? "pass" : "fail",
+        detail: rejected.length === 0
+            ? `All ${answered.length} event(s) whose response was observed were accepted (2xx).`
+            : `${rejected
+                .map((b) => `${b.phase}/${b.where}: a ${b.mode} ${b.endpointName} event was answered HTTP ${b.status}`)
+                .join("; ")}. Those events left the browser but were not recorded, so the site looks instrumented from the page's side while Dreamdata receives nothing. A write key the account does not recognise is the usual cause of a 4xx here.`,
+        evidence: rejected.length === 0
+            ? `${answered.length} request(s) answered 2xx`
+            : rejected.map((b) => `${b.phase}: ${b.mode} ${b.endpointName} status ${b.status}`).join("; "),
+        phases: rejected.length === 0 ? [...new Set(answered.map((b) => b.phase))] : [...new Set(rejected.map((b) => b.phase))],
+    };
+}
+/**
+ * The visitor's anonymous id, wherever this install keeps it.
+ *
+ * Cookie first, then localStorage: a bundle configured for localStorage
+ * storage keeps no cookie at all, and reading only the cookie would report
+ * that install as having no id rather than as storing it elsewhere.
+ *
+ * The value is normalised before anyone compares two of them, because the
+ * SAME id genuinely arrives in three different spellings: JSON-quoted in
+ * localStorage (`"abc"`), percent-encoded in a cookie (`%22abc%22`), and bare
+ * (`abc`). manatal.com serves the entry page's cookie percent-encoded and the
+ * second page's bare, so a comparison on the raw strings reports a stable id
+ * as having changed — a defect this harness would have manufactured for
+ * itself. Decode first, then strip the quotes.
+ */
+function anonymousIdOf(storage) {
+    const unquote = (value) => {
+        let decoded = value;
+        try {
+            decoded = decodeURIComponent(value);
+        }
+        catch {
+            // A malformed escape is not an id worth rewriting; compare it as-is.
+        }
+        return decoded.replace(/^"|"$/g, "");
+    };
+    const candidates = [
+        storage.values?.["dd_anonymous_id"],
+        storage.ajsValues?.["ajs_anonymous_id"],
+        storage.localStorageValues?.["dd_anonymous_id"],
+        storage.ajsLocalStorageValues?.["ajs_anonymous_id"],
+    ];
+    for (const value of candidates) {
+        if (typeof value === "string" && value !== "")
+            return unquote(value);
+    }
+    return null;
+}
+/**
+ * One visitor must stay one visitor across a navigation.
+ *
+ * An anonymous id that changes between the entry page and the page the phase
+ * walked to splits a single session into two visitors: the two page views
+ * cannot be stitched together, every downstream journey is cut in half, and
+ * nothing about a single page load can reveal it — the entry page looks
+ * perfect, and so does the second one in isolation.
+ *
+ * Deliberately narrow. The id APPEARING only on the second page is a consent
+ * question, not a continuity one, and second-page-honours-consent already
+ * asks it; judging it here too would report one defect as two. This check
+ * only ever fires when both pages had an id and the id is not the same one.
+ */
+function buildAnonymousIdStableCheck(phases, walked) {
+    const id = "anonymous-id-stable";
+    const title = "The anonymous id survives a page change";
+    const compared = walked
+        .map(({ phase, second }) => ({
+        phase: phase.phase,
+        first: anonymousIdOf(phase.cookies),
+        next: anonymousIdOf(second.cookies),
+        toUrl: second.toUrl,
+    }))
+        .filter((c) => c.first !== null && c.next !== null);
+    if (compared.length === 0) {
+        const anyIdAnywhere = phases.some((p) => anonymousIdOf(p.cookies) !== null);
+        return {
+            id,
+            title,
+            status: anyIdAnywhere ? "inconclusive" : "not_applicable",
+            detail: anyIdAnywhere
+                ? "No phase reached a second page while holding an anonymous id on both sides of the navigation, so whether the id survives a page change was not observed."
+                : "No anonymous id was stored in any phase — expected for a cookieless-by-design install, and for any phase where consent was withheld — so there is no id whose stability could be judged.",
+            evidence: walked.length === 0
+                ? "no phase reached a second page"
+                : walked
+                    .map(({ phase, second }) => `${phase.phase}: first ${anonymousIdOf(phase.cookies) ?? "none"}, second ${anonymousIdOf(second.cookies) ?? "none"}`)
+                    .join("; "),
+            phases: walked.map((w) => w.phase.phase),
+        };
+    }
+    const changed = compared.filter((c) => c.first !== c.next);
+    return {
+        id,
+        title,
+        status: changed.length === 0 ? "pass" : "fail",
+        detail: changed.length === 0
+            ? `The anonymous id was the same before and after the navigation in the ${compared.map((c) => c.phase).join(" and ")} phase(s), so both page views belong to one visitor.`
+            : `${changed
+                .map((c) => `in the ${c.phase} phase the anonymous id changed from ${c.first} to ${c.next} on the way to ${c.toUrl}`)
+                .join("; ")}. One visitor is being recorded as two, so their page views cannot be stitched into a single journey. A bundle re-initialising with a fresh id, or an id written to a storage the next page cannot read back (a cookie scoped to the wrong path or subdomain), are the usual causes.`,
+        evidence: compared
+            .map((c) => `${c.phase}: cookies ${c.first} -> secondPage ${c.next}`)
+            .join("; "),
+        phases: changed.length === 0 ? compared.map((c) => c.phase) : changed.map((c) => c.phase),
+    };
+}
+/** The checks that need a second page view, and so a navigation, to exist at all. */
+function buildSecondPageChecks(phases) {
+    const walked = phases
+        .filter((phase) => secondPageObserved(phase.secondPage))
+        .map((phase) => ({ phase, second: phase.secondPage }));
+    return [
+        buildContinuityCheck("hard", phases, walked.filter((w) => w.second.kind === "hard")),
+        buildContinuityCheck("soft", phases, walked.filter((w) => w.second.kind === "soft")),
+        buildSecondPageConsentCheck(phases, walked),
+        buildAnonymousIdStableCheck(phases, walked),
+    ];
+}
+/**
+ * True when a real consent gate exists on the page but every attempt to
+ * answer it (grant and/or reject, whichever ran) failed to actually drive
+ * it. Distinct from "no CMP" (nothing to drive, so silence is expected) and
+ * from a phase simply not being requested (phasesMissing already covers
+ * that): this is specifically "a banner was seen, and this run could not get
+ * past it", which means any conclusion resting on "the normal bundle never
+ * showed up" — cookieless-by-design, nothing-installed — was never actually
+ * tested against the answered state and cannot be trusted.
+ */
+function isConsentGateUndetermined(phases) {
+    const nonClean = phases.filter((p) => p.phase !== "clean");
+    if (nonClean.length === 0)
+        return false;
+    const anyCmpDetected = phases.some((p) => p.consent.cmpDetected);
+    if (!anyCmpDetected)
+        return false;
+    return nonClean.every((p) => p.consentAcceptance.attempted && !p.consentAcceptance.succeeded);
+}
+/**
+ * True when this phase's browser found NOTHING — not "nothing Dreamdata", but
+ * nothing at all.
+ *
+ * Every clause on its own is a normal thing to see on some real site, which is
+ * why the composite matters: a site can genuinely have no Dreamdata tag, or no
+ * consent banner, or (rarely) no followable internal link. A page with none of
+ * them, no bundle global on window, and not one request to any host we watch
+ * is not a site — it is a document with no site in it.
+ *
+ * Strictly the BROWSER's own evidence. Notably NOT
+ * script.tagManager.containerIds, which by this point may hold ids the
+ * plain-HTTP probe supplied (see scanTagManagerContainers) — using a field the
+ * probe feeds would let the corroboration corroborate itself, and the
+ * comparison below is the whole basis of the call.
+ */
+function phaseFoundNothing(phase) {
+    return (!phase.script.present &&
+        phase.script.matches.length === 0 &&
+        !phase.globals.dreamdataExists &&
+        !phase.globals.cookielessGlobalExists &&
+        !phase.globals.segmentCompatGlobalExists &&
+        !phase.consent.cmpDetected &&
+        phase.network.requests.length === 0 &&
+        (phase.secondPage === null || !phase.secondPage.urlChanged));
+}
+/**
+ * Decides whether the browser was ever shown the real page — see
+ * PageReadability for why this has to be asked before anything else.
+ *
+ * Asserted only on a CONTRADICTION, never on the browser's emptiness alone.
+ * "The browser found nothing" is the ordinary shape of a site with nothing
+ * installed and must stay reportable as one; what makes it a blocked run is
+ * the same URL, fetched without a browser, coming back with the site in it.
+ * With no probe to compare against, this stays false and the run reports what
+ * it saw — a false negative is better than a fabricated excuse for one.
+ */
+function assessPageReadability(phases, httpProbe) {
+    const blind = phases.filter(phaseFoundNothing);
+    if (blind.length === 0 || phases.length === 0) {
+        return {
+            unreadable: false,
+            reason: "The browser found page content in at least one phase, so it was served the site.",
+            signals: [],
+        };
+    }
+    const blindLabel = blind.length === phases.length ? "every phase" : `the ${blind.map((p) => p.phase).join(", ")} phase(s)`;
+    if (httpProbe === null || !httpProbe.attempted) {
+        return {
+            unreadable: false,
+            reason: `${blindLabel} found no script, no tag-manager container, no consent banner, no request and no second page — but no plain-HTTP fetch was taken, so there is nothing to tell "nothing is installed" apart from "the browser was served a different page". Re-run without --no-http-probe.`,
+            signals: [],
+        };
+    }
+    if (httpProbe.failedReason !== null) {
+        return {
+            unreadable: false,
+            reason: `${blindLabel} found nothing at all, and the plain-HTTP fetch that would corroborate it also failed (${httpProbe.failedReason}), so this run cannot say whether the site is empty or the browser was turned away.`,
+            signals: [],
+        };
+    }
+    // A refusal is a finding, not a missing one. The browser found nothing and
+    // the plain HTTP GET was turned away outright — two independent clients,
+    // both refused, which is what a host defending itself against automation
+    // looks like and is not what a site with nothing installed looks like. This
+    // is the branch zoominfo.com lands on when the wall extends to the probe:
+    // asserting "nothing is installed" off the back of two refusals is the
+    // false negative this whole assessment exists to prevent.
+    const status = httpProbe.status;
+    if (status !== null && (status < 200 || status >= 300)) {
+        return {
+            unreadable: true,
+            reason: `${blindLabel} found no script, no tag-manager container, no consent banner, no request and no second page, ` +
+                `and a plain HTTP GET of the same URL was refused as well (HTTP ${status}, ${httpProbe.bytes} bytes — a body far too small to be the site). ` +
+                "Both clients were turned away, so this run never reached this site's page and nothing here is a finding about its tracking. " +
+                "A --headed re-run is worth one try, but a behavioural challenge (a press-and-hold control, a \"verify you are human\" step) " +
+                "usually survives it — expect to confirm this install in a real browser by hand.",
+            signals: [
+                `the plain HTTP GET was answered HTTP ${status} with a ${httpProbe.bytes}-byte body rather than the site's page`,
+            ],
+        };
+    }
+    // What the served document has that the rendered page did not. Each of
+    // these alone is the same page answering the same question two ways.
+    const signals = [];
+    if (httpProbe.sameOriginLinkCount > 0) {
+        signals.push(`a plain HTTP GET of the same URL was served ${httpProbe.sameOriginLinkCount} same-origin link(s), while the rendered page had none to walk to`);
+    }
+    if (httpProbe.tagManagerContainerIds.length > 0) {
+        signals.push(`the served markup names tag-manager container(s) ${httpProbe.tagManagerContainerIds.join(", ")}, which the rendered page did not`);
+    }
+    if (httpProbe.cmpMarkers.length > 0) {
+        signals.push(`the served markup loads ${httpProbe.cmpMarkers.join(", ")}, while no consent platform was detected on the rendered page`);
+    }
+    if (httpProbe.script?.present) {
+        signals.push("the served markup contains a Dreamdata tag that was not in the rendered DOM");
+    }
+    if (signals.length === 0) {
+        return {
+            unreadable: false,
+            reason: `${blindLabel} found nothing, and a plain HTTP GET of the same URL (HTTP ${httpProbe.status}) found nothing either — the two agree, so this reads as a genuinely empty page rather than a blocked run.`,
+            signals: [],
+        };
+    }
+    return {
+        unreadable: true,
+        reason: `${blindLabel} found no script, no tag-manager container, no consent banner, no request and no second page, ` +
+            `yet a plain HTTP GET of the same URL (HTTP ${httpProbe.status}, ${httpProbe.bytes} bytes) was served a real page. ` +
+            "The browser was shown something else — a bot wall's challenge document is the usual cause — so this run observed " +
+            "no page belonging to this site and cannot judge its tracking. A --headed re-run is worth one try, but a " +
+            "behavioural challenge (a press-and-hold control, a \"verify you are human\" step) usually survives it, so expect " +
+            "to confirm this in a real browser by hand. What IS installed was still recovered, from the served markup and the " +
+            "tag-manager container it names — that part of the report the wall did not cost.",
+        signals,
+    };
+}
+/**
+ * Every reason to believe a REAL (non-Dreamdata) Segment install is on this
+ * page, across phases — the clio_com case: Segment forwards to Dreamdata
+ * server-to-server, so no Dreamdata script, global or request ever appears,
+ * and this is the only client-side trace such a pipeline leaves.
+ *
+ * The tag-manager container matters as much as the DOM/request here, and for
+ * the same reason it matters for Dreamdata's own bundles: clio.com ships its
+ * Segment tag from GTM container GTM-TXX2PT8, fired on its own trigger, so a
+ * bounded crawl that never satisfies that trigger sees nothing in the live
+ * DOM or on the wire even though nothing is gating it on consent — reading
+ * the published container is the only way to see it at all.
+ */
+function thirdPartySegmentSignals(phases) {
+    const signals = [];
+    const seenContainers = new Set();
+    for (const phase of phases) {
+        // Older evidence (collected before this signal existed) has no
+        // `thirdPartySegment` field at all — that is "not collected", not "no
+        // signal found", but it must not crash the offline replay of that
+        // evidence either. Skip the phase rather than fabricate a value.
+        const seg = phase.thirdPartySegment;
+        if (!seg)
+            continue;
+        if (seg.scriptDetected) {
+            signals.push(`${phase.phase}: <script src=${seg.scriptSrc}> loads Segment's own library, not a Dreamdata bundle`);
+        }
+        if (seg.requestCount > 0) {
+            signals.push(`${phase.phase}: ${seg.requestCount} request(s) sent to Segment's own collection endpoint (api.segment.io)`);
+        }
+        const tagManager = phase.script.tagManager;
+        if (tagManager.thirdPartySegmentTagFound) {
+            const key = tagManager.containerIds.join(",");
+            if (!seenContainers.has(key)) {
+                seenContainers.add(key);
+                signals.push(`GTM container ${tagManager.containerIds.join(", ")} ships a tag loading Segment's own library (cdn.segment.com), not a Dreamdata tag`);
+            }
+        }
+    }
+    return signals;
+}
+/**
+ * Reconciles the per-phase navigation observations into one statement, and
+ * subordinates the served markup to them.
+ *
+ * Behaviour decides, in this order, and a marker only ever changes the
+ * wording — except in branch 3, where there is no behaviour left to describe.
+ */
+function classifyRouting(phases, httpProbe) {
+    const markers = httpProbe?.frameworkMarkers ?? [];
+    const named = markers.join(", ");
+    const softPhases = phases.filter((p) => p.secondPage?.kind === "soft").map((p) => p.phase);
+    const hardPhases = phases.filter((p) => p.secondPage?.kind === "hard").map((p) => p.phase);
+    const pathsFollowed = softPhases.length + hardPhases.length;
+    const base = { softPhases, hardPhases, frameworkMarkers: markers, pathsFollowed };
+    // One observed router proves a router exists, so a mixed run resolves here
+    // — but the reason names both lists rather than hiding the hard phases,
+    // because a consent-gated router would look exactly like this.
+    if (softPhases.length > 0) {
+        const mixed = hardPhases.length > 0 ? ` The ${hardPhases.join(", ")} phase(s) loaded a new document for the link they followed.` : "";
+        const corroboration = markers.length > 0 ? ` The served markup names ${named}.` : "";
+        return {
+            ...base,
+            mode: "client-routed",
+            observed: true,
+            reason: `The site's own router handled the link this run followed in the ${softPhases.join(", ")} phase(s) without loading a new document.${mixed}${corroboration}`,
+        };
+    }
+    if (hardPhases.length > 0) {
+        // The honesty guarantee, and the corpus contains the site that needs it:
+        // yougov.com serves ng-version, ships the Angular router, and loaded a
+        // new document for every link followed. The marker is reported and then
+        // explicitly denied any authority over what was observed.
+        const corroboration = markers.length > 0
+            ? ` The served markup names ${named}, which does not by itself mean client-side routing.`
+            : "";
+        return {
+            ...base,
+            mode: "document-loads",
+            observed: true,
+            reason: `Every link this run followed loaded a new document (the ${hardPhases.join(", ")} phase(s)).${corroboration}`,
+        };
+    }
+    if (markers.length > 0) {
+        return {
+            ...base,
+            mode: "client-routed-suspected",
+            observed: false,
+            reason: `No navigation was classified in any phase, so how this site changes pages was not observed. The served markup names ${named}, which ships a client-side router — a suspicion about the markup, not a finding about behaviour.`,
+        };
+    }
+    return {
+        ...base,
+        mode: "unobserved",
+        observed: false,
+        reason: "No navigation was classified in any phase and the served markup names no framework, so how this site changes pages was not observed.",
+    };
+}
+function classifyShape(phases, normalBundleConfigured, cookielessBundleConfigured) {
+    const anyPresent = phases.some((p) => p.script.present);
+    const anyRequest = phases.some((p) => p.network.requests.length > 0);
+    if (!anyPresent && !anyRequest && !normalBundleConfigured && !cookielessBundleConfigured) {
+        return {
+            shape: "nothing-installed",
+            shapeReason: "No Dreamdata bundle, request or tag-manager tag was found in any phase.",
+        };
+    }
+    if (!normalBundleConfigured && !cookielessBundleConfigured && phases.some((p) => p.script.helperScriptOnly)) {
+        return {
+            shape: "helper-only",
+            shapeReason: "The only Dreamdata script found was a helper (identify-form), not a tracking bundle.",
+        };
+    }
+    if (normalBundleConfigured && cookielessBundleConfigured) {
+        return {
+            shape: "consent-gated-dual",
+            shapeReason: "Both bundles belong to this deployment, so which one runs is expected to follow the visitor's consent choice.",
+        };
+    }
+    if (normalBundleConfigured) {
+        // Said with the container's authority when there is one: "only the
+        // standard bundle is installed" reads as a gap on its own, and on a
+        // tag-manager install it is a published configuration.
+        const byDesign = cookielessAbsentByDesign(phases);
+        return {
+            shape: "normal-only",
+            shapeReason: byDesign
+                ? `Only the standard cookie-based bundle is installed, by configuration: the published tag-manager ${byDesign.containers} ships its tag and no cookieless one.`
+                : "Only the standard cookie-based bundle is installed.",
+        };
+    }
+    return {
+        shape: "cookieless-by-design",
+        shapeReason: "Only the cookieless bundle is installed: no normal-bundle tag, tag-manager tag, blocked tag, loader companion reference or request was found in any phase.",
+    };
+}
+/**
+ * The page URL a `page` request reported, or null if this is not one.
+ *
+ * Scoped to the dedicated endpoint on purpose: a `batch` envelope can carry
+ * page events too, but reading duplicates out of one would mean deciding
+ * whether two events inside a single envelope are two page views or one
+ * delivery — and a missed duplicate is a far cheaper mistake here than an
+ * invented one.
+ */
+function pageRequestUrl(request) {
+    if (request.endpointName !== "page")
+        return null;
+    const payload = request.payload;
+    const url = payload?.properties?.url ?? payload?.context?.page?.url;
+    return typeof url === "string" && url.length > 0 ? url : null;
+}
+/** The `name@version` build(s) this request's own payload says sent it. */
+function librariesOf(request) {
+    return extractLibraries(request.payload).map(formatLibraryBuild);
+}
+/**
+ * The build VERSIONS behind a set of requests — the part that separates two
+ * copies of the script from one install's two bundles.
+ *
+ * One install ships its normal and cookieless bundles at the same version
+ * under two different `library.name`s, so the name alone would read a
+ * correctly gated pair (paytronix.com) as a duplicate install. A second
+ * COPY is a second thing someone added — an npm build inside the app next to
+ * a CDN build from a tag manager — and that shows in the version.
+ */
+function libraryVersionsOf(requests) {
+    return [...new Set(requests.flatMap((r) => extractLibraries(r.payload).map((build) => build.version)))];
+}
+function observedPageViews(phase) {
+    const views = [
+        {
+            phase: phase.phase,
+            label: `${phase.phase} phase, first page`,
+            requests: phase.network.requests,
+            loadedTwiceAroundConsent: phase.network.spansConsentAnswer,
+        },
+    ];
+    const second = phase.secondPage;
+    if (secondPageObserved(second)) {
+        // A page the run walked to with the consent state already settled: one
+        // load, one chance for each bundle to fire, and the page view where a
+        // duplicate loader has nowhere left to hide.
+        views.push({
+            phase: phase.phase,
+            label: `${phase.phase} phase, ${second.toUrl}`,
+            requests: second.network.requests,
+            loadedTwiceAroundConsent: false,
+        });
+    }
+    // The document load taken when the walk did not produce one. On a site that
+    // routes internally this is the phase's ONLY unambiguous page view — the
+    // entry page was loaded twice around the consent answer and the walked page
+    // never re-ran a script, so without this a doubled page view has nowhere it
+    // can be seen. See SecondPageEvidence.hardLoad.
+    const hardLoad = second?.hardLoad;
+    if (hardLoad && hardLoad.failedReason === null) {
+        views.push({
+            phase: phase.phase,
+            label: `${phase.phase} phase, ${hardLoad.url} (document load)`,
+            requests: hardLoad.network.requests,
+            loadedTwiceAroundConsent: false,
+        });
+    }
+    return views;
+}
+function findDuplicatePageViews({ phase, label, requests, loadedTwiceAroundConsent }) {
+    const byUrl = new Map();
+    for (const request of requests) {
+        const url = pageRequestUrl(request);
+        if (url === null)
+            continue;
+        byUrl.set(url, [...(byUrl.get(url) ?? []), request]);
+    }
+    return [...byUrl.entries()]
+        .filter(([, sent]) => sent.length > 1)
+        .map(([url, sent]) => {
+        const libraryVersions = libraryVersionsOf(sent);
+        return {
+            phase,
+            where: label,
+            url,
+            modes: sent.map((r) => r.mode),
+            messageIds: sent.map((r) => extractMessageId(r.payload)).filter((id) => id !== null),
+            libraries: [...new Set(sent.flatMap(librariesOf))],
+            libraryVersions,
+            // Two loads around a consent answer are two runs of one install, at
+            // one version. Two versions cannot be that, whatever the timing, so
+            // they are judged even on the page where the banner was answered.
+            judged: !loadedTwiceAroundConsent || libraryVersions.length > 1,
+        };
+    });
+}
+/**
+ * Which mechanism produced one double-counted page view.
+ *
+ * Split out of explainDuplicate's prose so the answer is available as DATA:
+ * the diagnosis layer needs to pick a root cause and a fix from it, and the
+ * four mechanisms are fixed in four different places — a tag manager, a
+ * snippet's placement, an app's own bundle, a second copy that must be
+ * removed rather than reconfigured. The branch order is unchanged, and
+ * explainDuplicate still produces the identical sentence for each.
+ */
+function classifyDuplicate(duplicate) {
+    const { modes, messageIds, libraryVersions } = duplicate;
+    if (messageIds.length > 1 && new Set(messageIds).size === 1)
+        return "replayed-buffer";
+    if (libraryVersions.length > 1)
+        return "two-builds";
+    if (modes.includes("normal") && modes.includes("cookieless"))
+        return "mixed-modes";
+    return "same-build";
+}
+/**
+ * Names the mechanism behind one double-counted page view, because the
+ * causes are fixed in different places — a tag manager, a snippet's
+ * placement, an app's own bundle — and the numbers alone do not say which
+ * one this is.
+ */
+function explainDuplicate(duplicate) {
+    const { where, url, modes, messageIds, libraries, libraryVersions } = duplicate;
+    const head = `${where}: ${modes.length} page events for ${url}`;
+    switch (classifyDuplicate(duplicate)) {
+        case "replayed-buffer":
+            return `${head} sharing one messageId (${messageIds[0]}) — the SAME event delivered twice, which no single healthy instance does: a second bundle replayed a buffer the first had already sent`;
+        case "two-builds":
+            return `${head} from ${libraryVersions.length} different builds of the script (${libraries.join(", ")}) — one install ships every bundle it has at ONE version, so this page is running ${libraryVersions.length} separate copies, each firing its own page() on load. The usual pair is a copy bundled into the site's own app (\`npm:\` versions) next to a CDN copy a tag manager injects. The messageIds differ (${messageIds.join(", ") || "unavailable"}), so ingest cannot collapse them: every document load is counted ${libraryVersions.length} times. A soft (router) navigation hides it, since only the copy wired to the router fires there`;
+        case "mixed-modes":
+            return `${head}, one from each bundle — the page view was counted twice, once identified and once anonymous. The two are built to be mutually exclusive, so this is a snippet PLACEMENT error: the cookieless snippet sits above the normal one, or a tag manager injects them in that order, and the cookieless guards ran before the normal tag existed to be seen`;
+        case "same-build":
+            return `${head} from the ${modes[0]} bundle alone (messageIds ${messageIds.join(", ") || "unavailable"}) — one loader cannot produce two page() calls for one load, so more than one copy of the same snippet is running, typically one hardcoded and one injected by a tag manager`;
+    }
+}
+/**
+ * What the duplicate actually costs, which is not the same answer for each
+ * kind.
+ *
+ * The blanket "every affected page view is inflated in reporting" this
+ * replaced was wrong for mixed-modes, and wrong in the direction that gets a
+ * report disbelieved: ingest recognises a cookieless event arriving for a
+ * session that already has an anonymous id and deduplicates it — Dreamdata's
+ * own debugger calls it a Tracking Reset and says in as many words that the
+ * cookieless tracks "will be deduplicated but should not happen". A customer
+ * who checks nuvei.com's events and finds no duplicates there has just been
+ * told something they can see is untrue, about a defect that IS real.
+ *
+ * The two-builds text already carries its own reasoning about whether ingest
+ * can collapse the events (it cannot: the messageIds differ), so the rule
+ * this follows is not new — it is applied consistently now.
+ */
+/**
+ * True when every duplicate here is the pair ingest is known to collapse.
+ *
+ * This is the whole basis for warning rather than failing (see
+ * CrossPhaseCheck): a warn is a real configuration defect that this run showed
+ * is currently held in check by something else, which is exactly a mixed-mode
+ * pair — the page is wrong, and the numbers a customer reads are not. A single
+ * duplicate of any OTHER kind in the same run sinks it back to a failure,
+ * because nothing is holding those in check.
+ */
+function isCollapsedByIngest(duplicates) {
+    const kinds = new Set(duplicates.map(classifyDuplicate));
+    return kinds.size === 1 && kinds.has("mixed-modes");
+}
+function duplicateConsequence(duplicates) {
+    if (isCollapsedByIngest(duplicates)) {
+        return ("Ingest deduplicates this pair, so the page-view counts a customer reads are not inflated by it — but the visitor's " +
+            "session is reset and re-stitched on every affected page view, each one costs an ingested event, and the correction " +
+            "depends on a safety net rather than on the page behaving. It stops when the extra loader stops firing.");
+    }
+    return "Every affected page view is inflated in reporting until the extra loader is removed";
+}
+/**
+ * The duplicates page-view-counted-once actually judges, as data.
+ *
+ * Called by that check and, separately, by analyzeDeployment for the
+ * diagnosis. Computing it twice rather than threading it through is
+ * deliberate: it is a pure function of the phases, so the two callers cannot
+ * disagree, whereas a parameter carrying a second derivation could drift out
+ * of step with the check's own prose.
+ */
+export function findJudgedDuplicates(phases) {
+    return phases
+        .flatMap(observedPageViews)
+        .filter((view) => view.requests.some((r) => pageRequestUrl(r) !== null))
+        .flatMap(findDuplicatePageViews)
+        .filter((duplicate) => duplicate.judged)
+        .map((duplicate) => ({ phase: duplicate.phase, kind: classifyDuplicate(duplicate) }));
+}
+/**
+ * Whether one page view produced exactly one page event.
+ *
+ * Deliberately scoped to page events sharing a URL WITHIN a single observed
+ * page view, rather than to a phase's mode counts. A phase's counts span two
+ * page views, so a cookieless entry page followed by a normal second page
+ * adds up to "both modes fired" while being nothing of the sort — that
+ * combination is a consent question, and second-page-honours-consent asks it.
+ * Only the same page, counted more than once, is this check's business.
+ *
+ * And "one page view" mostly excludes the entry page of a phase that
+ * ANSWERED the banner, because there the run loaded one URL twice: once
+ * unanswered, then again with the decision in force. A correct consent-gated
+ * install tracks both — the cookieless bundle anonymously before the answer,
+ * the normal bundle with an anonymousId after it — so two page events for
+ * that URL are the upgrade the visitor just consented to, not a second
+ * loader. Reading them as a duplicate failed real installs (maxio.com among
+ * them) for behaving exactly as designed.
+ *
+ * "Mostly", because that story has a limit: two loads are two runs of the
+ * SAME install and report one `context.library` build. When the page events
+ * name two different builds, no ordering of loads, queued requests or retried
+ * deliveries can produce them — two copies of the script are installed — so
+ * those are judged on the answered entry page too. getmoss.com is the case:
+ * an npm copy in the site's own Next.js bundle firing alongside the CDN copy
+ * GTM injects, two page events per document load with different messageIds,
+ * and every other field on both looking perfectly healthy.
+ *
+ * A duplicate the check does leave unjudged still shows elsewhere, since a
+ * second loader fires on EVERY load: on the unanswered entry page, and on
+ * the page each phase walks to afterwards.
+ */
+function buildPageViewCountedOnceCheck(phases) {
+    const id = "page-view-counted-once";
+    const title = "Each page view is counted once";
+    const views = phases.flatMap(observedPageViews);
+    const tracked = views.filter((view) => view.requests.some((r) => pageRequestUrl(r) !== null));
+    const judged = tracked.filter((view) => !view.loadedTwiceAroundConsent);
+    const consentTransition = tracked.filter((view) => view.loadedTwiceAroundConsent);
+    const duplicates = tracked.flatMap(findDuplicatePageViews).filter((duplicate) => duplicate.judged);
+    const describe = ({ label, requests, loadedTwiceAroundConsent }) => {
+        const sent = requests.filter((r) => pageRequestUrl(r) !== null);
+        const builds = [...new Set(sent.flatMap(librariesOf))];
+        const note = loadedTwiceAroundConsent
+            ? " — this URL was loaded twice, either side of the consent answer, so a second event from the same build is not judged"
+            : "";
+        const from = builds.length > 0 ? ` from ${builds.join(", ")}` : "";
+        return `${label}: ${sent.length} page request(s) [${sent.map((r) => r.mode).join(", ")}]${from}${note}`;
+    };
+    const evidence = tracked.map(describe).join("; ");
+    if (judged.length === 0 && duplicates.length === 0) {
+        return {
+            id,
+            title,
+            status: "not_applicable",
+            detail: consentTransition.length === 0
+                ? "No automatic page view reached the wire in any phase, so there was nothing that could be counted twice. Whether one should have fired is core-tracking's question."
+                : `The only page views that tracked were entry pages loaded twice around a consent answer (${consentTransition.length}), where a second page event is the expected consent upgrade rather than a duplicate. No single-load page view was observed, so exclusivity could not be judged — run the clean phase, or let the second-page probe run, to get one.`,
+            evidence: evidence || `page requests observed: 0 across ${views.length} observed page view(s)`,
+            phases: phases.map((p) => p.phase),
+        };
+    }
+    const scope = consentTransition.length === 0
+        ? `${judged.length} page view(s) observed`
+        : `${judged.length} single-load page view(s) judged; ${consentTransition.length} entry page(s) loaded twice around a consent answer judged only on whether they name more than one build, since a second event from ONE build is the consent upgrade working`;
+    return {
+        id,
+        title,
+        status: duplicates.length === 0 ? "pass" : isCollapsedByIngest(duplicates) ? "warn" : "fail",
+        detail: duplicates.length === 0
+            ? `Every page view that tracked produced exactly one page event (${scope}).`
+            : `${duplicates.map(explainDuplicate).join("; ")}. ${duplicateConsequence(duplicates)} (${scope}).`,
+        evidence,
+        phases: [...new Set((duplicates.length === 0 ? judged : duplicates).map((v) => v.phase))],
+    };
+}
+/** The handoff is confirmed by either signal; neither one's absence condemns it. */
+function handoffCompleted(s) {
+    return s.initialized || s.readyFired;
+}
+/**
+ * Only two states are actually broken: the global is still the loader's stub
+ * array, or the normal bundle sent requests and left the cookieless global it
+ * deletes on a successful handoff in place while never confirming its own.
+ */
+function handoffBroken(s) {
+    if (handoffCompleted(s))
+        return false;
+    return s.isStub || s.cookielessGlobalSurvived;
+}
+/**
+ * The global a phase is answerable for, picked from the bundle that
+ * demonstrably ran there rather than from the deployment shape.
+ *
+ * A phase where nothing sent a request is not judged at all: a gated bundle
+ * that never loaded has no handoff to complete, and holding it to one is the
+ * failure mode this check exists to avoid.
+ */
+function handoffSubject(phase, segmentCompat) {
+    const g = phase.globals;
+    const base = { phase: phase.phase, cookielessGlobalSurvived: false };
+    if (phase.network.normalRequestCount > 0) {
+        const key = segmentCompat ? SEGMENT_COMPAT_GLOBAL_KEY : "dreamdata";
+        const exists = segmentCompat ? g.segmentCompatGlobalExists : g.dreamdataExists;
+        const initialized = segmentCompat ? g.segmentCompatInitialized : g.initialized;
+        const isStub = segmentCompat ? g.segmentCompatIsStubQueue : g.dreamdataIsStubQueue;
+        return {
+            ...base,
+            key,
+            exists,
+            initialized,
+            readyFired: g.readyCallbackFired && g.readyCallbackGlobal === key,
+            isStub,
+            cookielessGlobalSurvived: g.cookielessGlobalExists,
+            evidence: `${phase.phase}: normalRequestCount ${phase.network.normalRequestCount}, window.${key} exists ${exists}, ` +
+                `initialized ${initialized}, ready() fired ${g.readyCallbackFired && g.readyCallbackGlobal === key}, ` +
+                `stub array ${isStub}, window['${COOKIELESS_GLOBAL_KEY}'] still present ${g.cookielessGlobalExists}`,
+        };
+    }
+    if (phase.network.cookielessRequestCount > 0) {
+        return {
+            ...base,
+            key: COOKIELESS_GLOBAL_KEY,
+            exists: g.cookielessGlobalExists,
+            initialized: g.cookielessInitialized,
+            readyFired: g.readyCallbackFired && g.readyCallbackGlobal === COOKIELESS_GLOBAL_KEY,
+            isStub: false,
+            evidence: `${phase.phase}: cookielessRequestCount ${phase.network.cookielessRequestCount}, ` +
+                `window['${COOKIELESS_GLOBAL_KEY}'] exists ${g.cookielessGlobalExists}, initialized ${g.cookielessInitialized}`,
+        };
+    }
+    return null;
+}
+/**
+ * Whether the bundle that ran finished becoming its global.
+ *
+ * Computed here rather than argued from the evidence each run, because the
+ * absence of a global has two opposite meanings and the model reliably picked
+ * the wrong one. A loader-based install that never becomes its global is
+ * broken in a way the wire cannot show: the automatic page view looks
+ * perfect and every `dreamdata.track()` the site makes goes into a dead
+ * array. A BUNDLED install has no global by construction — the site imported
+ * the SDK and calls the instance directly — and elliptic.co was failed for
+ * exactly that, an install whose every other check passed.
+ *
+ * So the question is asked as "did the global this phase's own requests imply
+ * actually initialize", and only where a global was there to initialize.
+ */
+function buildGlobalHandoffCheck(phases, install, segmentCompat) {
+    const id = "global-handoff";
+    const title = "The bundle finished handing off to its global";
+    const subjects = phases
+        .map((phase) => handoffSubject(phase, segmentCompat))
+        .filter((s) => s !== null);
+    const evidence = subjects.length > 0
+        ? subjects.map((s) => s.evidence).join("; ")
+        : `no bundle sent a request in any phase (${phases.map((p) => p.phase).join(", ") || "none collected"})`;
+    if (install.method === "bundled-no-global") {
+        // The strongest corroboration available: the SDK has no route-change
+        // tracking of its own, so a soft navigation that still tracked can only
+        // be the site's own code calling page() on a reference it holds — which
+        // is the very call the "missing global" reading claims is impossible.
+        const softNavTracked = phases.filter((p) => secondPageObserved(p.secondPage) &&
+            p.secondPage.kind === "soft" &&
+            p.secondPage.network.normalRequestCount + p.secondPage.network.cookielessRequestCount > 0);
+        const corroboration = softNavTracked.length > 0
+            ? ` A page event also fired on a route change the site's own router handled (${softNavTracked
+                .map((p) => p.phase)
+                .join(", ")}), which the SDK cannot do by itself — so the site demonstrably holds a working reference and can call track/identify on it.`
+            : "";
+        return {
+            id,
+            title,
+            status: "not_applicable",
+            detail: "The SDK is built into the site's own bundle and never touches window, so there is no handoff to complete and no global to look for." +
+                corroboration +
+                " Nothing is missing from the wire; what is missing is only the window handle, which costs no events but does mean console debugging and any window.dreamdata call from outside the bundle (a GTM custom HTML tag, a third-party script) will not find it.",
+            evidence,
+            phases: subjects.map((s) => s.phase),
+        };
+    }
+    const broken = subjects.filter((s) => s.exists && handoffBroken(s));
+    if (broken.length > 0) {
+        const mechanism = broken
+            .map((s) => {
+            const shape = s.isStub
+                ? `window.${s.key} is still the loader's stub ARRAY, so every call the site makes is pushed into a buffer nothing drains`
+                : `window.${s.key} exists but neither reported initialized nor ran its ready() callback`;
+            const proof = s.cookielessGlobalSurvived
+                ? `, and window['${COOKIELESS_GLOBAL_KEY}'] survived, which a completed handoff deletes`
+                : "";
+            return `${s.phase}: the bundle sent requests and ${shape}${proof}`;
+        })
+            .join("; ");
+        return {
+            id,
+            title,
+            status: "fail",
+            detail: `${mechanism}. The automatic page view looks fine on the wire while every dreamdata.track/identify call the site's own code makes is silently dropped — the usual causes are a write key that never reached the bundle, two copies of the snippet on the page, or a CSP blocking the bundle's CDN.`,
+            evidence,
+            phases: broken.map((s) => s.phase),
+        };
+    }
+    const completed = subjects.filter(handoffCompleted);
+    if (completed.length > 0) {
+        return {
+            id,
+            title,
+            status: "pass",
+            detail: `The bundle that ran finished handing off to its global (${completed
+                .map((s) => `${s.phase}: window.${s.key}`)
+                .join(", ")}), so calls the site's own code makes reach the real SDK.`,
+            evidence,
+            phases: completed.map((s) => s.phase),
+        };
+    }
+    if (subjects.length === 0) {
+        return {
+            id,
+            title,
+            status: "not_applicable",
+            detail: "No bundle sent a request in any phase, so no global was expected to appear. Whether one should have is script-presence and core-tracking's question.",
+            evidence,
+            phases: phases.map((p) => p.phase),
+        };
+    }
+    return {
+        id,
+        title,
+        status: "inconclusive",
+        detail: `Requests reached Dreamdata (${subjects
+            .map((s) => s.phase)
+            .join(", ")}), and the global they imply neither confirmed its handoff (no initialized flag, no ready() callback) nor showed any of the broken states — so this is neither a confirmed handoff nor a confirmed stall. Check by hand whether window.${subjects[0].key} is the real SDK once the page has settled.`,
+        evidence,
+        phases: subjects.map((s) => s.phase),
+    };
+}
+const BUNDLE_LABEL = {
+    normal: "the standard cookie-based bundle",
+    cookieless: "the cookieless bundle",
+    helper: "a helper script (identify-form)",
+    unknown: "a Dreamdata script whose bundle could not be read off the tag",
+};
+function bundleList(kinds) {
+    return kinds.map((k) => BUNDLE_LABEL[k]).join(" and ");
+}
+function sentenceCase(text) {
+    return text.charAt(0).toUpperCase() + text.slice(1);
+}
+/**
+ * Which bundles the DOM carried, across every phase.
+ *
+ * A DOM tag does NOT mean the tag is hardcoded: `page.content()` is the live
+ * document, so a tag GTM injected is in it too. That ambiguity is resolved
+ * below by the container scan, which is the only thing that can say a tag was
+ * published through GTM.
+ */
+function domBundlesSeen(phases) {
+    const kinds = new Set();
+    for (const p of phases)
+        for (const m of p.script.matches)
+            kinds.add(m.kind);
+    return [...kinds];
+}
+/**
+ * True when no Dreamdata global was ever on `window` — not the real SDK
+ * object, not the loader's stub array, in any phase.
+ *
+ * This is the one thing that separates a bundled (npm) install from a loader
+ * this run could not name. Every loader-based install touches `window`: the
+ * snippet creates its global as a stub array before the bundle even arrives,
+ * and a bare CDN tag creates it on load. So requests on the wire with nothing
+ * on `window` anywhere means the SDK was imported as a module and lives in
+ * the site's own bundle scope, where there is no global to create.
+ */
+function noGlobalInAnyPhase(phases) {
+    return phases.every((p) => !p.globals.dreamdataExists && !p.globals.cookielessGlobalExists && !p.globals.segmentCompatGlobalExists);
+}
+/**
+ * Tags that load BOTH bundles from one GTM tag.
+ *
+ * The single definition, because three readers need it and must agree: the
+ * install `detail`, the `bundles-share-one-tag` cause, and the check that
+ * cause claims. One tag has one `consent` field and one trigger set, so a
+ * combined tag cannot hold the two bundles to opposite consent states however
+ * it is configured — the gate necessarily falls to the snippet's own JS.
+ */
+export function combinedBundleTags(containers) {
+    return containers.flatMap((container) => container.tags
+        .filter((tag) => tag.bundles.includes("normal") && tag.bundles.includes("cookieless"))
+        .map((tag) => ({ containerId: container.containerId, tag })));
+}
+/**
+ * The consent signal a Dreamdata tag has to be gated on, and the only one.
+ *
+ * A gate on any other signal is either inert (telaid.com's normal tag
+ * requires `targeted_advertising`, which nothing on that page grants, and it
+ * never fires at all) or right by coincidence (tumodo.io's requires
+ * `ad_storage`, which Cookiebot happens to grant alongside analytics — and
+ * which stops being true for a visitor who accepts analytics and declines
+ * marketing).
+ */
+const REQUIRED_CONSENT_SIGNAL = "analytics_storage";
+/** Dreamdata tags gated on some consent signal, but not on analytics_storage. */
+export function tagsGatedOnWrongSignal(containers) {
+    return containers.flatMap((container) => container.tags
+        .filter((tag) => tag.bundles.includes("normal") &&
+        tag.consent !== null &&
+        tag.consent.length > 0 &&
+        !tag.consent.includes(REQUIRED_CONSENT_SIGNAL))
+        .map((tag) => ({ containerId: container.containerId, tag })));
+}
+/** The cookieless tag's own gate, when the container shows it has one. */
+export function cookielessTagGates(containers) {
+    return containers.flatMap((container) => container.tags
+        .filter((tag) => tag.bundles.includes("cookieless") && ((tag.consent?.length ?? 0) > 0 || tag.blockedWhen.length > 0))
+        .map((tag) => ({ containerId: container.containerId, tag })));
+}
+/**
+ * Which container ships which bundle, in words.
+ *
+ * Replaces "ships from one of them", which was all the flat fields could say
+ * about a page loading several containers — and which hid that checkproof.com
+ * loads two and only GTM-WXSP5VK carries any Dreamdata tag at all.
+ */
+function describeContainerAttribution(containers) {
+    const parts = containers.map((container) => {
+        if (!container.read)
+            return `${container.containerId} could not be read`;
+        if (container.tags.length === 0)
+            return `${container.containerId} carries no Dreamdata tag`;
+        const combined = container.tags.filter((t) => t.bundles.length > 1).length;
+        const shipped = combined > 0 ? `${bundleList(container.bundles)} from one combined tag` : bundleList(container.bundles);
+        // The gate belongs in the same clause as the container that carries it.
+        // Naming it once at the end of the sentence instead produced "GTM-TKR4CP3
+        // carries no Dreamdata tag, gated in GTM on analytics_storage", which
+        // attributes checkproof.com's gate to the container that has no tag.
+        const normal = container.tags.find((tag) => tag.bundles.includes("normal"));
+        const consent = normal?.consent?.length ? ` gated on ${normal.consent.join(" + ")}` : "";
+        const blocked = normal?.blockedWhen.length
+            ? `${consent ? " and" : ""} blocked whenever ${normal.blockedWhen.join("; or ")}`
+            : "";
+        // The event requirement is the gate a reader is least likely to guess at
+        // and the one most likely to be the actual fault: verda.com's tag fires
+        // only on virtualPageView or cookie_consent_update, so it is not on "all
+        // pages" at all and a route change that skips the push goes untracked.
+        const events = normal?.requiresEvents?.length
+            ? `${consent || blocked ? " and" : ""} fired only on the ${normal.requiresEvents.join(" or ")} dataLayer event${normal.requiresEvents.length > 1 ? "s" : ""}`
+            : "";
+        const gate = consent || blocked || events ? `,${consent}${blocked}${events}` : "";
+        return `${container.containerId} ships ${shipped}${gate}`;
+    });
+    return parts.join("; ");
+}
+function summarizeInstall(phases) {
+    const containerIds = [...new Set(phases.flatMap((p) => p.script.tagManager.containerIds))];
+    const tagManagerScanned = phases.some((p) => p.script.tagManager.scanned);
+    const tagManagerBundles = [];
+    if (phases.some((p) => p.script.tagManager.normalBundleTagFound))
+        tagManagerBundles.push("normal");
+    if (phases.some((p) => p.script.tagManager.cookielessBundleTagFound))
+        tagManagerBundles.push("cookieless");
+    const tagManagerNormalConsentGate = phases.find((p) => p.script.tagManager.normalBundleConsentGate !== null)?.script.tagManager
+        .normalBundleConsentGate ?? null;
+    const tagManagerNormalBlockingTriggers = phases.find((p) => p.script.tagManager.normalBundleBlockingTriggers !== null)?.script.tagManager
+        .normalBundleBlockingTriggers ?? null;
+    const tagManagerErrors = [...new Set(phases.flatMap((p) => p.script.tagManager.errors))];
+    // One phase's scan, not a merge across phases: the published container does
+    // not change between them, and the phase that read the most containers is
+    // the one whose read completed. Merging would have to reconcile tag indexes
+    // across separately-parsed bodies for no gain.
+    const tagManagerContainers = phases
+        .map((p) => p.script.tagManager.containers ?? [])
+        .reduce((best, current) => (current.length > best.length ? current : best), []);
+    const domBundles = domBundlesSeen(phases);
+    const domTracking = domBundles.filter((k) => k !== "helper");
+    const segmentCompatSnippet = phases.some((p) => p.script.segmentCompatSnippet);
+    const blockedTagVendors = [
+        ...new Set(phases.flatMap((p) => p.script.matches.map((m) => m.blockedBy)).filter((v) => v !== null)),
+    ];
+    // script.writeKey is only ever extracted from a matched snippet, so it is
+    // null for every install that has no snippet to read — a bundled-no-global
+    // (npm) install has no tag in the DOM at all, and a tag-manager-injected
+    // one carries the key inside the container rather than in the page. The key
+    // those installs DO expose is the one their requests put on the wire, which
+    // is the same key and is directly observed. Falling back to it here is what
+    // the checklist has so far been asking the model to do in prose ("check
+    // network.observedWriteKeys before calling it a failure"); a field that is
+    // null while the run plainly observed the key is a fact the report should
+    // not be leaving to a language model to reconstruct.
+    const writeKey = phases.find((p) => p.script.writeKey !== null)?.script.writeKey ??
+        phases.flatMap((p) => p.network.observedWriteKeys)[0] ??
+        null;
+    const requests = phases.some((p) => p.network.requests.length > 0);
+    const containers = containerIds.join(", ");
+    const gtmShipsDreamdata = tagManagerBundles.length > 0;
+    // Per-container attribution when the scan recorded it, so a page loading
+    // several containers says WHICH one ships the tag rather than "one of
+    // them". Falls back to the old phrasing for evidence collected before
+    // TagManagerScan.containers existed.
+    const gtmNote = tagManagerScanned
+        ? `GTM container${containerIds.length > 1 ? "s" : ""} ${containers} read; ${tagManagerContainers.length > 0
+            ? describeContainerAttribution(tagManagerContainers)
+            : gtmShipsDreamdata
+                ? `${bundleList(tagManagerBundles)} ${tagManagerBundles.length > 1 ? "ship" : "ships"} from ${containerIds.length > 1 ? "one of them" : "it"}`
+                : "no Dreamdata tag in it"}`
+        : "no GTM container was found on the page (or --no-tag-manager-scan skipped the read)";
+    const base = {
+        tagManagerContainerIds: containerIds,
+        tagManagerScanned,
+        tagManagerBundles,
+        tagManagerContainers,
+        tagManagerNormalConsentGate,
+        tagManagerNormalBlockingTriggers,
+        tagManagerErrors,
+        domBundles,
+        segmentCompatSnippet,
+        blockedTagVendors,
+        writeKey,
+    };
+    // Only the container can prove a tag is published through GTM, so it is
+    // read first: a hardcoded verdict is what is left when it says no.
+    if (gtmShipsDreamdata) {
+        // The container ships one bundle and the DOM carries another: the second
+        // one cannot have come from the container, so something else placed it.
+        const extraInDom = domTracking.filter((k) => k === "normal" || k === "cookieless").filter((k) => !tagManagerBundles.includes(k));
+        // Both halves of the gate are named, because a tag whose consent list is
+        // satisfied can still be held back by an exception — and then the thing
+        // keeping tracking off before consent is not Consent Mode at all.
+        const consentGate = tagManagerNormalConsentGate?.length
+            ? `, gated in GTM on ${tagManagerNormalConsentGate.join(" + ")}`
+            : "";
+        const blockingGate = tagManagerNormalBlockingTriggers?.length
+            ? `${consentGate ? " and" : ","} blocked in GTM whenever ${tagManagerNormalBlockingTriggers.join("; or ")}`
+            : "";
+        // Suppressed when describeContainerAttribution already named the gate
+        // against its own container — otherwise the same clause appears twice.
+        const gate = tagManagerContainers.length > 0 ? "" : `${consentGate}${blockingGate}`;
+        if (extraInDom.length > 0) {
+            return {
+                ...base,
+                method: "hardcoded-and-tag-manager",
+                label: `Google Tag Manager (${containers}) + a snippet on the page`,
+                detail: `${gtmNote}${gate}. On top of that, ${bundleList(extraInDom)} was in the DOM without the container shipping it, so that one is placed on the page directly. Two loaders for one account is the usual cause of double-counted page views.`,
+            };
+        }
+        return {
+            ...base,
+            method: "google-tag-manager",
+            label: `Google Tag Manager (${containers})`,
+            detail: `${gtmNote}${gate}. ${domTracking.length > 0
+                ? `The matching tag was also in the live DOM, which is what GTM injecting it looks like — a hardcoded second copy cannot be ruled out from the DOM alone.`
+                : `The tag was never in the DOM in any phase, so it is installed but did not fire under the conditions this run created.`}`,
+        };
+    }
+    if (domTracking.length > 0) {
+        return {
+            ...base,
+            method: "hardcoded-snippet",
+            label: segmentCompatSnippet
+                ? "Hardcoded on the page — Segment-compatible inline snippet"
+                : "Hardcoded on the page — <script> tag",
+            detail: `${sentenceCase(bundleList(domTracking))} is in the page's own markup as ${segmentCompatSnippet ? "an inline loader snippet" : "a script tag"}, and ${gtmNote}, so no tag manager is placing it.${blockedTagVendors.length > 0
+                ? ` ${blockedTagVendors.join(", ")} neutralised the tag rather than removing it — installed, gated.`
+                : ""}`,
+        };
+    }
+    if (requests && noGlobalInAnyPhase(phases)) {
+        return {
+            ...base,
+            method: "bundled-no-global",
+            label: "Built into the site's own bundle — module-scoped SDK, no window global",
+            detail: `Requests reached Dreamdata, no Dreamdata tag was in the DOM in any phase, ${gtmNote}, and no Dreamdata global — not the SDK object, not the loader's stub array — was ever on window. That combination is what importing the SDK as a package (npm) and holding the instance in module scope looks like: there is no loader, so there is nothing to create a global. The install is working; the only cost is that code outside that bundle (a browser console, a GTM custom HTML tag, a third-party script) cannot reach it through window.dreamdata, and the bundle version is pinned at build time rather than following the CDN.`,
+        };
+    }
+    if (requests) {
+        return {
+            ...base,
+            method: "injected-unidentified",
+            label: "Injected at runtime — no snippet and no GTM tag found",
+            detail: `Requests reached Dreamdata, but no Dreamdata tag was in the DOM in any phase and ${gtmNote}. Something injects the loader that this run cannot name — another tag manager, a CMP-managed loader, or a bundler that inlines it after load.`,
+        };
+    }
+    if (domBundles.includes("helper")) {
+        return {
+            ...base,
+            method: "not-installed",
+            label: "Helper script only — no tracking bundle",
+            detail: `The only Dreamdata script on the page is a helper (identify-form). ${gtmNote}.`,
+        };
+    }
+    // Nothing anywhere is only a real answer once the container was actually
+    // readable; an unread container is a gap, not an absence.
+    if (!tagManagerScanned && containerIds.length === 0 && tagManagerErrors.length > 0) {
+        return {
+            ...base,
+            method: "undetermined",
+            label: "Could not tell how the script is installed",
+            detail: `No tag was found in the DOM and the tag-manager read failed: ${tagManagerErrors.join("; ")}.`,
+        };
+    }
+    return {
+        ...base,
+        method: "not-installed",
+        label: "No Dreamdata script installed",
+        detail: `No Dreamdata tag in the DOM, no request on the wire, and ${gtmNote}.`,
+    };
+}
+function summarizeCmp(phases) {
+    const detected = phases.some((p) => p.consent.cmpDetected);
+    // A vendor recognised in one phase and only text-matched in another is that
+    // vendor: prefer the confirmed reading over the heuristic one.
+    const withVendor = phases.find((p) => p.consent.cmpVendorConfirmed) ?? phases.find((p) => p.consent.cmpVendor !== null);
+    const vendor = withVendor?.consent.cmpVendor ?? null;
+    const vendorConfirmed = withVendor?.consent.cmpVendorConfirmed ?? false;
+    const driven = phases.filter((p) => p.consentAcceptance.succeeded && p.consentAcceptance.vendor !== null);
+    const drivenVendor = driven[0]?.consentAcceptance.vendor ?? null;
+    const drivenPhases = driven.map((p) => p.phase);
+    const blockedTagVendors = [
+        ...new Set(phases.flatMap((p) => p.script.matches.map((m) => m.blockedBy)).filter((v) => v !== null)),
+    ];
+    const corroboration = blockedTagVendors.length > 0 ? ` A Dreamdata tag on the page is neutralised by ${blockedTagVendors.join(", ")}.` : "";
+    if (!detected) {
+        return {
+            detected: false,
+            vendor: null,
+            vendorConfirmed: false,
+            label: "No CMP detected",
+            detail: `No recognised consent platform global, no known banner element, and no banner-shaped accept/reject control in any phase.${corroboration}`,
+            drivenVendor,
+            drivenPhases,
+        };
+    }
+    if (vendor === "unknown-custom" || !vendorConfirmed) {
+        return {
+            detected: true,
+            vendor,
+            vendorConfirmed: false,
+            label: "Custom banner — vendor not identified",
+            detail: `A consent banner is on the page, but it exposes no recognised vendor global or element id: it was matched only by its accept/reject button text, so the vendor cannot be named.${corroboration}`,
+            drivenVendor,
+            drivenPhases,
+        };
+    }
+    return {
+        detected: true,
+        vendor,
+        vendorConfirmed: true,
+        label: vendor ?? "unrecognised",
+        detail: `Recognised by its own global/banner element.${drivenVendor !== null ? ` This run drove it successfully in the ${drivenPhases.join(" and ")} phase(s).` : " This run never managed to drive it."}${corroboration}`,
+        drivenVendor,
+        drivenPhases,
+    };
+}
+/**
+ * Every behavioural check re-stated as "we could not look".
+ *
+ * Each check's own status was derived from the page the browser was shown, so
+ * on a blocked run every one of them is describing a document that does not
+ * belong to this site — including the not_applicable ones, which reached that
+ * status from the same blindness ("no CMP was detected, so there is no gate").
+ * Leaving any of them standing is what turned a wall into a verdict, so they
+ * all go, uniformly, rather than being triaged one by one.
+ */
+/**
+ * A Dreamdata bundle is part of this deployment, and it knows which account
+ * it belongs to.
+ *
+ * Every trap in this question is about an ABSENCE that is not a missing
+ * install, and each one is already resolved upstream — which is why this
+ * check reads `shape` rather than any phase's `script.present`:
+ *
+ * - a consent-gated bundle is absent from the DOM until the banner is
+ *   answered, so a per-phase reading of `script.present` says "not installed"
+ *   about a healthy install. The shape is a union across every phase.
+ * - a CMP-neutralised tag is installed and deliberately not executing;
+ *   install.blockedTagVendors names who did it.
+ * - a bundled-no-global (npm) install has no tag in the DOM in ANY phase and
+ *   never will, because the SDK is imported as a package.
+ * - a tag-manager-injected bundle lives in the container, not the page.
+ *
+ * The write key is the second half: a bundle that loaded but names no account
+ * cannot deliver anything. It is only ever "warn" here, never "fail" — the
+ * install is present either way, and a run that saw requests has already
+ * proven delivery works regardless of where the key was read from.
+ */
+function buildScriptInstalledCheck(phases, shape, shapeReason, install) {
+    const id = "script-installed";
+    const title = "A Dreamdata bundle is installed, with a write key";
+    const everyPhase = phases.map((p) => p.phase);
+    if (shape === "nothing-installed" || shape === "helper-only") {
+        const helperOnly = phases.length > 0 && phases.every((p) => p.script.helperScriptOnly);
+        return {
+            id,
+            title,
+            status: "fail",
+            detail: helperOnly
+                ? `The only Dreamdata script found in any phase was a helper (identify-form), which is not a tracking bundle, so nothing on this site can send an event. ${shapeReason}`
+                : `No Dreamdata tracking bundle was found in any phase — not in the DOM, not in a tag-manager container, and no request left the page. ${shapeReason}`,
+            evidence: `deployment.shape: ${shape}, install.method: ${install.method}, install.writeKey: ${install.writeKey ?? "null"}`,
+            phases: everyPhase,
+        };
+    }
+    if (shape === "undetermined" || shape === "third-party-segment-undetermined" || shape === "page-unreadable") {
+        return {
+            id,
+            title,
+            status: "inconclusive",
+            detail: `Whether a Dreamdata bundle is installed could not be settled by this run. ${shapeReason}`,
+            evidence: `deployment.shape: ${shape}, install.method: ${install.method}`,
+            phases: everyPhase,
+        };
+    }
+    const blocked = install.blockedTagVendors.length > 0
+        ? ` A tag neutralised by ${install.blockedTagVendors.join(" and ")} is installed and gated, not absent.`
+        : "";
+    if (install.writeKey === null) {
+        return {
+            id,
+            title,
+            status: "warn",
+            detail: `${install.label} is installed, but no write key was found — neither in a snippet nor on any request this run saw — so which Dreamdata account it reports to could not be confirmed.${blocked}`,
+            evidence: `deployment.shape: ${shape}, install.method: ${install.method}, install.writeKey: null`,
+            phases: everyPhase,
+        };
+    }
+    return {
+        id,
+        title,
+        status: "pass",
+        detail: `${install.label} is installed and configured with a write key.${blocked}`,
+        evidence: `deployment.shape: ${shape}, install.method: ${install.method}, install.writeKey: ${install.writeKey}`,
+        phases: everyPhase,
+    };
+}
+/**
+ * Every check on a run where the browser was never served the page.
+ *
+ * This must stay ORDERED BEFORE the diagnosis (see analyzeDeployment): the
+ * diagnosis reads statuses to pick a root cause, and voiding first is what
+ * leaves it nothing to claim, so the only cause that can fire is
+ * `page-unreadable`. Diagnose the pre-void array and the report confidently
+ * tells a customer whose GTM container ships both bundles to install the
+ * script.
+ */
+function voidChecks(checks) {
+    return checks.map((check) => ({
+        ...check,
+        status: "inconclusive",
+        // Points at pageReadability rather than restating it: the reason is a
+        // paragraph, and repeating it under all thirteen checks buries the report
+        // it is supposed to qualify.
+        detail: "Not evaluated: the browser was never served this site's page, so there was no behaviour to observe. See deployment.pageReadability for what was found instead and what to do about it.",
+        evidence: `deployment.pageReadability.unreadable: true (was: ${check.status} — ${check.evidence})`,
+    }));
+}
+export function analyzeDeployment(evidence, requested) {
+    const phases = evidence.phases;
+    const byPhase = new Map(phases.map((p) => [p.phase, p]));
+    // Union across phases: a bundle absent from the DOM pre-consent and present
+    // post-consent is one deployment, not two.
+    const normalBundleSignals = [...new Map(phases.flatMap((p) => p.script.normalBundleSignals).map((s) => [s.detail, s])).values()];
+    const normalBundleConfigured = normalBundleSignals.length > 0;
+    const cookielessBundleConfigured = phases.some((p) => p.script.cookielessSnippet ||
+        p.network.cookielessRequestCount > 0 ||
+        p.globals.cookielessGlobalExists ||
+        p.script.tagManager.cookielessBundleTagFound);
+    // Asked before the shape, because a shape derived from a page the browser
+    // never saw is the exact failure this guards against.
+    const pageReadability = assessPageReadability(phases, evidence.httpProbe);
+    const routing = classifyRouting(phases, evidence.httpProbe);
+    let { shape, shapeReason } = classifyShape(phases, normalBundleConfigured, cookielessBundleConfigured);
+    // A blocked run can still have real install evidence — the plain-HTTP probe
+    // recovers the served markup and the tag-manager container it names, and
+    // neither depends on the browser having rendered anything. So the shape is
+    // only overridden when there is nothing left to conclude it from: with the
+    // install known, "consent-gated-dual" stands as a statement about what is
+    // installed, and pageReadability is what says its BEHAVIOUR is unverified.
+    if (pageReadability.unreadable && !normalBundleConfigured && !cookielessBundleConfigured) {
+        shape = "page-unreadable";
+        shapeReason = pageReadability.reason;
+    }
+    else if (pageReadability.unreadable) {
+        shapeReason = `${shapeReason} This is what is INSTALLED, recovered from the markup the site serves a plain HTTP GET and the tag-manager container that markup names; how it BEHAVES was not observed, because the browser was never served this site's page — see deployment.pageReadability.`;
+    }
+    // A run that would otherwise read "nothing tracking-related is here" can
+    // still have found a REAL Segment install — not a Dreamdata bundle, but
+    // evidence the site sends events somewhere. If Dreamdata receives a copy at
+    // all it is via a server-side Segment destination this harness cannot see
+    // (see thirdPartySegmentSignals), so this is reported as its own
+    // undetermined shape rather than as "nothing-installed" — which would
+    // wrongly read as "go install the script" on a site that already has one,
+    // just not Dreamdata's. Skipped on a blocked run: pageReadability already
+    // has the more fundamental explanation for why nothing showed up.
+    const thirdPartySegmentEvidence = thirdPartySegmentSignals(phases);
+    if (thirdPartySegmentEvidence.length > 0 && !pageReadability.unreadable && (shape === "nothing-installed" || shape === "helper-only")) {
+        shapeReason =
+            `Would otherwise read as "${shape}", but a real Segment install was found instead of a Dreamdata bundle: ` +
+                `${thirdPartySegmentEvidence.join("; ")}. If Dreamdata receives these events at all, it is via a ` +
+                "server-side Segment destination/connection, which happens entirely outside the browser and cannot be " +
+                "confirmed or denied by this run. Check Segment's own source/destination configuration, or Dreamdata's " +
+                "ingestion records, directly.";
+        shape = "third-party-segment-undetermined";
+    }
+    // Both remaining shapes this run could still land on hinge on "the normal
+    // bundle was never seen" — which is not trustworthy evidence when the
+    // banner itself was never successfully answered. Downgrade to
+    // "undetermined" rather than asserting either one with confidence.
+    const consentGateUndetermined = isConsentGateUndetermined(phases);
+    if (consentGateUndetermined && (shape === "nothing-installed" || shape === "cookieless-by-design")) {
+        shapeReason =
+            `Would otherwise read as "${shape}", but a consent banner was detected and this run could not ` +
+                `successfully drive it (grant/reject) in any phase — so the absence of a normal bundle cannot be ` +
+                `trusted. This may be a genuine ${shape === "cookieless-by-design" ? "cookieless-by-design install" : "install with nothing tracking"}, ` +
+                "or the normal bundle may simply be gated behind a banner this harness could not click. Verify the banner manually.";
+        shape = "undetermined";
+    }
+    const segmentCompat = phases.some((p) => p.globals.segmentCompatGlobalExists || p.cookies.usesAjsCompatPrefix);
+    // Read before the checks, because global-handoff's whole question turns on
+    // whether a loader was ever involved.
+    const install = summarizeInstall(phases);
+    const checks = [
+        ...buildChecks(byPhase, { normalBundleConfigured, cookielessBundleConfigured, normalBundleSignals }),
+        ...buildSecondPageChecks(phases),
+        buildPageViewCountedOnceCheck(phases),
+        buildGlobalHandoffCheck(phases, install, segmentCompat),
+        buildRequestPayloadCheck(phases),
+        buildRequestDeliveryCheck(phases),
+        buildConsoleCheck(phases),
+        buildCollectionCompleteCheck(phases),
+        buildScriptInstalledCheck(phases, shape, shapeReason, install),
+        buildFirstPartyDeliveryCheck(phases, install),
+    ];
+    // Built in two steps so the diagnosis sees the RESOLVED checks. Diagnosing
+    // the pre-void array on a blocked run would produce a confident root cause
+    // ("no tracking script is installed") about a bot wall's challenge
+    // document, which is the one thing this layer must never do.
+    const analysis = {
+        shape,
+        shapeReason,
+        pageReadability,
+        consentGateUndetermined,
+        segmentCompat,
+        normalBundleConfigured,
+        normalBundleSignals,
+        cookielessBundleConfigured,
+        thirdPartySegmentSignals: thirdPartySegmentEvidence,
+        cmpVendor: phases.find((p) => p.consent.cmpVendor !== null)?.consent.cmpVendor ?? null,
+        install,
+        cmp: summarizeCmp(phases),
+        consentModeV2: judgeConsentModeV2(phases),
+        routing,
+        phasesObserved: phases.map((p) => p.phase),
+        phasesMissing: requested.filter((name) => !byPhase.has(name)),
+        matrix: phases.map(summarizePhase),
+        checks: pageReadability.unreadable ? voidChecks(checks) : checks,
+    };
+    return { ...analysis, diagnosis: diagnose(analysis, { duplicates: findJudgedDuplicates(phases) }) };
+}
+//# sourceMappingURL=deployment.js.map