@enricai/barnacle 1.11.0 → 1.12.1

package/dist/scraper/flow-runner.js

@@ -66,6 +66,7 @@ exports.parseSelectStep = parseSelectStep;
 exports.parseFillStep = parseFillStep;
 exports.parseFillValueIntent = parseFillValueIntent;
 exports.parseRadioStep = parseRadioStep;
+exports.parseCheckStep = parseCheckStep;
 exports.pollEnumerate = pollEnumerate;
 exports.waitForTransitionBody = waitForTransitionBody;
 exports.chooseRequiredSelectOption = chooseRequiredSelectOption;
@@ -1034,11 +1035,26 @@ function isDomOnlyAdvanceVerified(params) {
  * `describeAttemptEffectSignals`'s own reflow-vs-reveal boundary). Requiring
  * `textChanged` keeps a trivial reflow/tooltip (DOM churn with no new visible
  * content) from being credited — those still cascade to failure as before.
+ *
+ * **Blocked-submit veto:** a form-submit/advance click that a wizard-style
+ * client-side validation rejects renders inline error text — exactly the
+ * `textChanged` + DOM-growth shape the reveal-credit branch above rewards —
+ * with zero network, zero URL change. The reported false positive
+ * (`recon-viewswap-false-positive-on-blocked-form-submit.md`): a "Create
+ * Account" click with two empty required fields was scored
+ * `verifiedBy=view-swap` on `network=false url=false dom=false`, and recon
+ * advanced past a step the wizard never left. When `invalidMarkerDelta`
+ * (post-click minus pre-click ng-invalid-style container count, from
+ * {@link countNgInvalidContainers}) is positive, the click revealed NEW
+ * validation errors rather than a legitimate view transition — veto the
+ * credit regardless of which growth branch would otherwise fire. Optional
+ * and defaults to 0 (no veto) so existing callers that don't thread the
+ * marker count are unaffected.
  */
 function isClickViewSwapVerified(params) {
     const VIEW_SWAP_MIN_BYTES = config_1.config.scraper.viewSwapMinBytesThreshold;
     const VIEW_SWAP_REVEAL_MIN_BYTES = config_1.config.scraper.viewSwapRevealMinBytesThreshold;
-    const { resolvedAction, isFinalStep, submitStep, isAdvanceWithPattern, networkDelta, bytesDelta, textChanged, } = params;
+    const { resolvedAction, isFinalStep, submitStep, isAdvanceWithPattern, networkDelta, bytesDelta, textChanged, invalidMarkerDelta = 0, } = params;
     if (resolvedAction?.method !== "click")
         return false;
     if (isFinalStep || submitStep)
@@ -1047,6 +1063,8 @@ function isClickViewSwapVerified(params) {
         return false;
     if (networkDelta !== 0)
         return false;
+    if (invalidMarkerDelta > 0)
+        return false;
     if (bytesDelta >= VIEW_SWAP_MIN_BYTES)
         return true;
     return textChanged && bytesDelta >= VIEW_SWAP_REVEAL_MIN_BYTES;
@@ -2649,6 +2667,46 @@ function xpathBodyForEvaluate(selector) {
     const stripped = selector.startsWith("xpath=") ? selector.slice("xpath=".length) : selector;
     return stripped.startsWith("/") || stripped.startsWith("(") ? stripped : null;
 }
+/**
+ * In-page source for the absolute positional xpath walk, shared by every
+ * expression that must produce keys byte-identical to Stagehand's resolved
+ * `xpath=/html[1]/…` selectors AND to each other: the baseline map
+ * ({@link SELECTION_STATE_MAP_EXPR}) and the ancestor read-back
+ * ({@link selectionAncestorChanged}). Kept as one constant so a future edit
+ * can't drift one copy — a divergent walk would silently produce keys that miss
+ * the baseline, making the ancestor read-back a no-op. Hardcoded
+ * `/html[1]/body[1]/` prefix, `previousElementSibling` index,
+ * `nodeName.toLowerCase()`, stop at `document.body`.
+ */
+const XPATH_OF_FN_SRC = `(node) => {
+    const parts = [];
+    while (node && node.nodeType === 1 && node !== document.body) {
+      const tag = node.nodeName.toLowerCase();
+      let idx = 1;
+      let sib = node.previousElementSibling;
+      while (sib) {
+        if (sib.nodeName.toLowerCase() === tag) idx++;
+        sib = sib.previousElementSibling;
+      }
+      parts.unshift(tag + "[" + idx + "]");
+      node = node.parentElement;
+    }
+    return "/html[1]/body[1]/" + parts.join("/");
+  }`;
+/**
+ * In-page source for one element's {@link ElementSelectionFingerprint} object
+ * literal, given the name of the element variable (`elVar`) and a variable
+ * (`dsVar`) already bound to `elVar.getAttribute("data-state") || ""`. Shared by
+ * {@link elementSelectionFingerprintExpr}, {@link SELECTION_STATE_MAP_EXPR}, and
+ * {@link selectionAncestorChanged} so all three compute the SAME fingerprint —
+ * a field drifting in one copy would make the pre/post diff compare mismatched
+ * shapes. The `data-state` disclosure values `open`/`closed` (the
+ * `aria-expanded` equivalent) are blanked by the caller's `dsVar` so opening a
+ * popover isn't mistaken for a selection.
+ */
+function selectionFingerprintObjSrc(elVar, dsVar) {
+    return `{ kind: ${elVar}.getAttribute("kind") || "", cls: ${elVar}.getAttribute("class") || "", ariaPressed: ${elVar}.getAttribute("aria-pressed") || "", ariaChecked: ${elVar}.getAttribute("aria-checked") || "", ariaSelected: ${elVar}.getAttribute("aria-selected") || "", dataState: (${dsVar} === "open" || ${dsVar} === "closed") ? "" : ${dsVar}, dataSelected: ${elVar}.hasAttribute("data-selected") ? "1" : "", dataChecked: ${elVar}.hasAttribute("data-checked") ? "1" : "", checked: (${elVar}.type === "checkbox" || ${elVar}.type === "radio") ? (${elVar}.checked ? "1" : "0") : "", value: typeof ${elVar}.value === "string" ? ${elVar}.value.slice(0, 200) : "" }`;
+}
 /**
  * Browser-side expression body that resolves `xpath` and returns that one
  * element's {@link ElementSelectionFingerprint} (or `null` when the node is
@@ -2659,18 +2717,18 @@ function xpathBodyForEvaluate(selector) {
  * for a selection.
  */
 function elementSelectionFingerprintExpr(xpath) {
-    return `(() => { const r = document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null); const el = r.singleNodeValue; if (!el) return null; const ds = el.getAttribute("data-state") || ""; return { kind: el.getAttribute("kind") || "", cls: el.getAttribute("class") || "", ariaPressed: el.getAttribute("aria-pressed") || "", ariaChecked: el.getAttribute("aria-checked") || "", ariaSelected: el.getAttribute("aria-selected") || "", dataState: (ds === "open" || ds === "closed") ? "" : ds, dataSelected: el.hasAttribute("data-selected") ? "1" : "", dataChecked: el.hasAttribute("data-checked") ? "1" : "", checked: (el.type === "checkbox" || el.type === "radio") ? (el.checked ? "1" : "0") : "", value: typeof el.value === "string" ? el.value.slice(0, 200) : "" }; })()`;
+    return `(() => { const r = document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null); const el = r.singleNodeValue; if (!el) return null; const ds = el.getAttribute("data-state") || ""; return ${selectionFingerprintObjSrc("el", "ds")}; })()`;
 }
 /**
  * Browser-side expression: build `{ absolutePositionalXpath →
  * ElementSelectionFingerprint }` for every VISIBLE interactive element, the
  * pre-action baseline {@link verifyDomEffect} diffs the resolved element
- * against. Trust boundary: static string literal, no interpolation. The xpath
- * is generated by `xpathOf`, character-identical to the two other in-page
- * copies in this file (the ng-invalid probe and the field-label scan) so it
- * byte-matches Stagehand's resolved `xpath=/html[1]/…` selectors: hardcoded
- * `/html[1]/body[1]/` prefix, walk `!== document.body`, `nodeName.toLowerCase()`,
- * `parentElement`. `[role=dialog],[role=tooltip],[aria-live]` subtrees are
+ * against. Trust boundary: composed only from the {@link XPATH_OF_FN_SRC} and
+ * {@link selectionFingerprintObjSrc} constants (no external interpolation). The
+ * xpath is generated by the shared {@link XPATH_OF_FN_SRC} walk — the SAME
+ * source {@link selectionAncestorChanged} recomputes ancestor keys with, so the
+ * two byte-match each other and Stagehand's resolved `xpath=/html[1]/…`
+ * selectors. `[role=dialog],[role=tooltip],[aria-live]` subtrees are
  * skipped — they churn without a selection change. Visibility uses the same
  * rect + `getComputedStyle` idiom as `deep-locator-scan.ts`'s `IS_VISIBLE_EXPR`
  * (rather than `offsetParent`), so on-screen `position:fixed` controls — a
@@ -2679,21 +2737,7 @@ function elementSelectionFingerprintExpr(xpath) {
 const SELECTION_STATE_MAP_EXPR = `(() => {
   const b = document.body;
   if (!b) return {};
-  const xpathOf = (node) => {
-    const parts = [];
-    while (node && node.nodeType === 1 && node !== document.body) {
-      const tag = node.nodeName.toLowerCase();
-      let idx = 1;
-      let sib = node.previousElementSibling;
-      while (sib) {
-        if (sib.nodeName.toLowerCase() === tag) idx++;
-        sib = sib.previousElementSibling;
-      }
-      parts.unshift(tag + "[" + idx + "]");
-      node = node.parentElement;
-    }
-    return "/html[1]/body[1]/" + parts.join("/");
-  };
+  const xpathOf = ${XPATH_OF_FN_SRC};
   const visible = (el) => {
     const rect = el.getBoundingClientRect();
     if (rect.width === 0 && rect.height === 0) return false;
@@ -2706,18 +2750,7 @@ const SELECTION_STATE_MAP_EXPR = `(() => {
   for (const el of b.querySelectorAll(sel)) {
     if (!visible(el) || skip(el)) continue;
     const ds = el.getAttribute("data-state") || "";
-    out[xpathOf(el)] = {
-      kind: el.getAttribute("kind") || "",
-      cls: el.getAttribute("class") || "",
-      ariaPressed: el.getAttribute("aria-pressed") || "",
-      ariaChecked: el.getAttribute("aria-checked") || "",
-      ariaSelected: el.getAttribute("aria-selected") || "",
-      dataState: (ds === "open" || ds === "closed") ? "" : ds,
-      dataSelected: el.hasAttribute("data-selected") ? "1" : "",
-      dataChecked: el.hasAttribute("data-checked") ? "1" : "",
-      checked: (el.type === "checkbox" || el.type === "radio") ? (el.checked ? "1" : "0") : "",
-      value: typeof el.value === "string" ? el.value.slice(0, 200) : "",
-    };
+    out[xpathOf(el)] = ${selectionFingerprintObjSrc("el", "ds")};
   }
   return out;
 })()`;
@@ -2793,6 +2826,80 @@ async function readElementSelectionFingerprint(target, selector) {
         return null;
     }
 }
+/**
+ * How far up from the clicked leaf {@link selectionAncestorChanged} walks
+ * looking for the option/toggle that carries the selection. Design-system
+ * options nest their label 1-2 levels deep (a `<span title>` inside a
+ * `role="option"`, plus the odd icon/wrapper); 6 matches the vacuous-click
+ * ancestor guard in {@link verifyDomEffect}'s click branch and covers that
+ * nesting without over-reaching into an outer listbox/group.
+ */
+const MAX_SELECTION_ANCESTOR_DEPTH = 6;
+/**
+ * Element-scoped selection read-back for the case the clicked node's OWN
+ * fingerprint can't credit: a design-system option that wraps its label in a
+ * child element (Base Web `tag`, and the standard listbox/combobox idiom where
+ * an option's accessible name comes from its descendant content). Stagehand
+ * resolves the click to the label leaf, but `aria-selected` / the hashed class
+ * flips on the ancestor `role="option"` — so the leaf has no baseline entry and
+ * never changes state, and the leaf-only read-back mis-scores a genuine
+ * selection as a phantom click.
+ *
+ * Walks from the leaf up to {@link MAX_SELECTION_ANCESTOR_DEPTH}, and on the
+ * NEAREST ancestor that (a) carries a selection marker (a non-empty fingerprint
+ * field, a selection `role`, or a `data-baseweb` attribute — `aria-expanded` is
+ * deliberately NOT a marker so a bare disclosure/expander is skipped) AND (b) is
+ * present in the pre-baseline map, diffs that ancestor's current fingerprint
+ * against its baseline. Nearest-wins and returns even when unchanged, so a
+ * re-click of an already-selected option (or a decoy marker on an outer group)
+ * can never be laundered into a credit. Authoritative and element-scoped: only
+ * baseline-keyed ancestors are consulted, so an unrelated element's change can
+ * never credit the step. Recomputes ancestor xpaths with the SAME
+ * {@link XPATH_OF_FN_SRC} walk that built the baseline so the keys byte-match.
+ * Returns `false` on any miss / malformed result / evaluate throw (defer to the
+ * network/URL signal).
+ */
+async function selectionAncestorChanged(target, leafXpath, preSelectionState) {
+    const expr = `(() => {
+    const LEAF = ${JSON.stringify(leafXpath)};
+    const BASE = ${JSON.stringify(preSelectionState)};
+    const xpathOf = ${XPATH_OF_FN_SRC};
+    const fp = (el) => { const ds = el.getAttribute("data-state") || ""; return ${selectionFingerprintObjSrc("el", "ds")}; };
+    const SELECTION_ROLES = new Set(["option", "tab", "switch", "radio", "checkbox", "menuitemcheckbox"]);
+    const hasMarker = (el, f) => {
+      if (f.kind || f.ariaPressed || f.ariaChecked || f.ariaSelected || f.dataState || f.dataSelected || f.dataChecked || f.checked) return true;
+      if (SELECTION_ROLES.has((el.getAttribute("role") || "").toLowerCase())) return true;
+      if (el.hasAttribute("data-baseweb")) return true;
+      return false;
+    };
+    const changed = (a, b) =>
+      a.kind !== b.kind || a.cls !== b.cls || a.ariaPressed !== b.ariaPressed ||
+      a.ariaChecked !== b.ariaChecked || a.ariaSelected !== b.ariaSelected ||
+      a.dataState !== b.dataState || a.dataSelected !== b.dataSelected ||
+      a.dataChecked !== b.dataChecked || a.checked !== b.checked || a.value !== b.value;
+    const r = document.evaluate(LEAF, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+    let node = r.singleNodeValue;
+    if (!node) return false;
+    for (let depth = 0; depth < ${MAX_SELECTION_ANCESTOR_DEPTH} && node; depth++) {
+      if (node.getAttribute) {
+        const now = fp(node);
+        if (hasMarker(node, now)) {
+          const pre = BASE[xpathOf(node)];
+          if (!pre) return false;
+          return changed(pre, now);
+        }
+      }
+      node = node.parentElement;
+    }
+    return false;
+  })()`;
+    try {
+        return (await target.evaluate(expr)) === true;
+    }
+    catch {
+        return false;
+    }
+}
 /** How long the upload primitive waits for a post-setInputFiles network POST. */
 const UPLOAD_NETWORK_TIMEOUT_MS = 5_000;
 /** Polling interval while waiting for the upload's network signal. */
@@ -3400,6 +3507,49 @@ function parseRadioStep(instruction) {
     const questionLabel = quoted.find((q) => q.trim() !== option)?.trim() ?? null;
     return { option, questionLabel };
 }
+/**
+ * Parse a CHECKBOX flow step into the label of the checkbox it targets.
+ *
+ * Why this exists (sibling of `parseSelectStep`/`parseFillStep`): checkbox
+ * steps are phrased as "Check the '…' checkbox" or "Click the '…' checkbox"
+ * (see `src/recon/fixtures/shipped-ats-flow-steps.json`), neither of which
+ * `parseSelectStep` recognizes (no "select" verb) and neither of which
+ * `parseRadioStep` recognizes (no "answer"/"radio" noun) — so a checkbox
+ * step's label was previously unextractable by any parser.
+ *
+ * Recognizes: "Check the 'Nights' workshift checkbox", "Click the 'No'
+ * checkbox for 'Please indicate if you are Hispanic or Latino'". Returns
+ * null when the step isn't checkbox-shaped or has no quoted label.
+ */
+function parseCheckStep(instruction) {
+    const lower = instruction.toLowerCase();
+    if (/\bany\s+remaining\b/.test(lower))
+        return null;
+    const match = instruction.match(/\b(?:check|click)\s+(?:the\s+)?'([^']+)'.*?\bcheckbox\b/i);
+    const label = match?.[1]?.trim();
+    return label ? { label } : null;
+}
+/** Strips wrapping single quotes a parser's capture group may include (e.g. when a flow author quotes the field name itself), so a probe label compares plain text against plain text. */
+function stripQuotedLabel(label) {
+    return label.replace(/^'+|'+$/g, "").trim();
+}
+/**
+ * Extracts the DOM label {@link hasUnfilledRequiredControlForStep}'s probe
+ * should match against, widened beyond `parseSelectStep`'s literal "select"
+ * verb (which never matches fill or checkbox phrasing) to also try
+ * `parseFillStep` and `parseCheckStep` — see that function's docblock for
+ * why generalizing the label source, not just the select-step case, matters.
+ */
+function extractRequiredControlProbeLabel(instruction) {
+    const selectLabel = parseSelectStep(instruction)?.questionLabel;
+    if (selectLabel)
+        return selectLabel;
+    const fillLabel = parseFillStep(instruction)?.fieldLabel;
+    if (fillLabel)
+        return stripQuotedLabel(fillLabel);
+    const checkLabel = parseCheckStep(instruction)?.label;
+    return checkLabel ? stripQuotedLabel(checkLabel) : null;
+}
 function resolveDeepLocatorActuation(step) {
     const selectParsed = parseSelectStep(step);
     if (selectParsed)
@@ -4513,14 +4663,15 @@ async function applyRadioSelection(target, gi, ri, hint) {
  * should fall through to the cascade/replan instead.
  *
  * Conservative by construction: returns false unless the step parses as a
- * select/answer step AND a required-and-unsatisfied control with a
- * label-matching the question is actually present. A genuinely-absent optional
- * step (e.g. "dismiss modal" on a modal-less page) has no such control, so the
- * fast-skip the comments call essential is preserved.
+ * select/fill/check step (via {@link extractRequiredControlProbeLabel}) AND a
+ * required-and-unsatisfied control with a label matching that target is
+ * actually present. A genuinely-absent optional step (e.g. "dismiss modal" on
+ * a modal-less page) has no such control, so the fast-skip the comments call
+ * essential is preserved.
  */
 async function hasUnfilledRequiredControlForStep(target, instruction) {
-    const parsed = parseSelectStep(instruction);
-    if (!parsed?.questionLabel)
+    const label = extractRequiredControlProbeLabel(instruction);
+    if (!label)
         return false;
     const expr = `((label) => {
     const norm = (s) => (s || "").replace(/\\s+/g, " ").trim().toLowerCase();
@@ -4565,7 +4716,7 @@ async function hasUnfilledRequiredControlForStep(target, instruction) {
       }
     }
     return false;
-  })(${JSON.stringify(parsed.questionLabel)})`;
+  })(${JSON.stringify(label)})`;
     try {
         return (await target.evaluate(expr)) === true;
     }
@@ -4891,17 +5042,22 @@ async function verifyDomEffect(target, action, preSelectionState = {}) {
                     // same absolute positional xpath Stagehand resolves to, so a lookup
                     // by the resolved element's xpath body yields THAT element's baseline.
                     // Credit the click iff the element's own committed state moved across
-                    // it. No baseline (element newly mounted, or an xpath the generator
-                    // and Stagehand index differently) → hold no opinion and let the
-                    // network/URL signal decide: a miss is never a false credit, and a
-                    // selection change on any OTHER element can never credit this step.
+                    // it. A selection change on any OTHER element can never credit this
+                    // step.
                     const preFingerprint = preSelectionState[xpath];
-                    if (!preFingerprint)
-                        return false;
-                    const postFingerprint = await readElementSelectionFingerprint(target, selector);
-                    if (!postFingerprint)
-                        return false;
-                    return selectionFingerprintChanged(preFingerprint, postFingerprint);
+                    if (preFingerprint) {
+                        const postFingerprint = await readElementSelectionFingerprint(target, selector);
+                        if (postFingerprint && selectionFingerprintChanged(preFingerprint, postFingerprint)) {
+                            return true;
+                        }
+                    }
+                    // The clicked node's own state didn't credit it (no baseline for the
+                    // leaf, or the leaf carries no selection state). A design-system
+                    // option that wraps its label in a child element commits its
+                    // selection on the ancestor `role="option"`, not the clicked leaf —
+                    // so walk up to the nearest baseline-present selection ancestor and
+                    // diff THAT. No eligible ancestor → false (defer to network/URL).
+                    return await selectionAncestorChanged(target, xpath, preSelectionState);
                 }
                 const isCheckedNow = await locator.isChecked();
                 if (!isCheckedNow)
@@ -5897,6 +6053,12 @@ async function executeStepWithHealing(params) {
         // disk for entries indexed after this point, which is eviction-proof when
         // >RECENT_CAPTURES_WINDOW captures flood during the step.
         const preCaptureIdx = latestCaptureIndex(recentCaptures);
+        // Pre-click ng-invalid baseline for the view-swap veto below
+        // (isClickViewSwapVerified's invalidMarkerDelta). Read unconditionally —
+        // cheap DOM query, and unlike `preSubmitInvalidCount` (final/submit-only)
+        // this must cover ANY click step: the reported false positive was an
+        // interior "Create Account" click, not the flow's final step.
+        const preInvalidMarkerCount = await countNgInvalidContainers(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page)).catch(() => 0);
         const record = {
             attempt,
             technique: "act-string",
@@ -6809,13 +6971,24 @@ async function executeStepWithHealing(params) {
         if (domVerified && !domVerifiedForStep) {
             logger.info(`${formatStepPrefix(stepIndex, totalSteps)} advance step succeeded only via DOM state change (field toggle / non-advancing POST), not a real transition; not treating as verified`);
         }
+        // Blocked-submit veto input for the view-swap gate below. Read post-click
+        // ng-invalid count only for a resolved click — the veto is meaningless
+        // for fill/select attempts, and this avoids a page.evaluate on every
+        // non-click attempt. See recon-viewswap-false-positive-on-blocked-form-submit.md:
+        // a "Create Account" click blocked by required-field validation grew the
+        // DOM (inline error text) with network=false url=false, which the reveal
+        // branch below alone would credit as verified.
+        const postInvalidMarkerCount = isClick
+            ? await countNgInvalidContainers(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page)).catch(() => 0)
+            : preInvalidMarkerCount;
         // Client-side view-swap gate: credit a click that produces substantial
         // DOM growth (≥5KB) with zero network when it's NOT a submit/final step
         // and NOT an advance-pattern step. Fixes the top-window site "Manual Application"
         // case where a +49KB DOM-only view swap was scored as "no observable effect".
         // Below that threshold, also credits a smaller text-changing reveal (≥500B) —
         // fixes the top-window site Work-History gate-message reveal (+789B) that used to
-        // cascade to a 5-attempt failure and global replan.
+        // cascade to a 5-attempt failure and global replan. Vetoed when the click's
+        // ng-invalid marker count grew (see isClickViewSwapVerified's doc comment).
         const clickViewSwapVerified = isClickViewSwapVerified({
             resolvedAction,
             isFinalStep,
@@ -6824,7 +6997,16 @@ async function executeStepWithHealing(params) {
             networkDelta: post.networkCount - pre.networkCount,
             bytesDelta: post.bodyHtmlLength - pre.bodyHtmlLength,
             textChanged: post.visibleTextSignature !== pre.visibleTextSignature,
+            invalidMarkerDelta: postInvalidMarkerCount - preInvalidMarkerCount,
         });
+        if (clickViewSwapVerified === false &&
+            isClick &&
+            postInvalidMarkerCount > preInvalidMarkerCount &&
+            post.networkCount - pre.networkCount === 0 &&
+            post.url === pre.url &&
+            post.bodyHtmlLength - pre.bodyHtmlLength >= config_1.config.scraper.viewSwapRevealMinBytesThreshold) {
+            logger.info(`${formatStepPrefix(stepIndex, totalSteps)} click grew the DOM (view-swap shape) but ng-invalid markers grew from ${preInvalidMarkerCount} to ${postInvalidMarkerCount} — a blocked form submit, not a real view transition; not treating as verified`);
+        }
         // A network-free selection/option toggle — including a Base Web `kind`
         // flip or hashed-class swap that exposes no aria/data-state marker and
         // moves a trivial or NEGATIVE byte delta — is now credited authoritatively
@@ -7128,13 +7310,23 @@ async function executeStepWithHealing(params) {
                     // or suppress when the element's own state is read directly.
                     const retrySelectionStateChanged = !isAdvanceStep(step) &&
                         (await (async () => {
-                            const preFingerprint = xpath ? pre.selectionStateByXpath[xpath] : undefined;
-                            if (!preFingerprint || !resolvedAction?.selector)
+                            if (!xpath || !resolvedAction?.selector)
                                 return false;
-                            const postFingerprint = await readElementSelectionFingerprint(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page), resolvedAction.selector);
-                            return postFingerprint !== null
-                                ? selectionFingerprintChanged(preFingerprint, postFingerprint)
-                                : false;
+                            const preFingerprint = pre.selectionStateByXpath[xpath];
+                            if (preFingerprint) {
+                                const postFingerprint = await readElementSelectionFingerprint(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page), resolvedAction.selector);
+                                if (postFingerprint !== null &&
+                                    selectionFingerprintChanged(preFingerprint, postFingerprint)) {
+                                    return true;
+                                }
+                            }
+                            // Leaf had no baseline entry (or carried no selection state): a
+                            // design-system option that wraps its label commits its selection
+                            // on the ancestor `role="option"`, not the clicked leaf — walk up
+                            // to the nearest baseline-present selection ancestor and diff THAT,
+                            // the same fallback `verifyDomEffect`'s primary read-back uses. No
+                            // eligible ancestor → false (defer to the other retry signals).
+                            return await selectionAncestorChanged(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page), xpath, pre.selectionStateByXpath);
                         })());
                     // RC2: an advance/`kind=click` "Next" that only grew the DOM
                     // (validation errors rendered) with NO network/URL change is a