@enricai/barnacle 1.12.24 → 1.12.26

package/dist/scraper/flow-runner.js

@@ -670,6 +670,30 @@ const INVALID_MARKER_EL_EXPR = `((el) => {
   if (el.getAttribute && el.getAttribute("aria-invalid") === "true") return true;
   return false;
 })`;
+/**
+ * Browser-context predicate string: given an element `el` in scope, is it
+ * disabled — either directly (native `disabled` property or
+ * `aria-disabled="true"`) or via an ancestor within
+ * {@link MAX_SELECTION_ANCESTOR_DEPTH} levels? Stagehand can resolve a click
+ * to a decorative leaf (a plain `<span>`/text node) nested inside a
+ * non-form clickable wrapper (`<div role="button" aria-disabled="true">`) —
+ * the leaf itself carries no `disabled` property and no `aria-disabled`
+ * attribute of its own, so a leaf-only check misses it even though the
+ * click can't have done anything. Climbs the SAME bounded depth as
+ * {@link NEARBY_SELECTION_CONTAINER_FN_SRC} rather than an unbounded walk,
+ * so a disabled ancestor far up the tree (e.g. a disabled `<fieldset>`
+ * wrapping an entire form section) doesn't false-positive-veto an
+ * unrelated enabled control nested arbitrarily deep inside it. Interpolate
+ * into a `page.evaluate` expr where `el` is bound.
+ */
+const DISABLED_MARKER_EL_EXPR = `((el) => {
+  for (let depth = 0; depth < ${browser_click_expr_1.MAX_SELECTION_ANCESTOR_DEPTH} && el; depth++) {
+    if (el.disabled === true) return true;
+    if (el.getAttribute && el.getAttribute("aria-disabled") === "true") return true;
+    el = el.parentElement;
+  }
+  return false;
+})`;
 /**
  * How many steps from the end of the flow are considered "trailing" for the
  * Tier 1 grace path. A verification failure on an optional step within this
@@ -709,11 +733,17 @@ function prepareFailureDumpBody(raw) {
     return pruned.slice(0, FAILURE_DUMP_MAX_BODY_LENGTH);
 }
 /**
- * Trust boundary: static string literal, fixed at compile time. No interpolation
- * means no injection surface. Runs in browser context and returns a typed-narrow
- * shape via Runtime.callFunctionOn.
+ * Trust boundary: composed only from compile-time constants
+ * ({@link SELECTION_MARKER_CLASS_SELECTOR_SRC},
+ * {@link SELECTION_MARKER_CLASS_TOKEN_REGEX_SRC}) — no runtime/request
+ * interpolation, so no injection surface. Runs in browser context and returns
+ * a typed-narrow shape via Runtime.callFunctionOn. The class-token selector
+ * and regex are the SAME source {@link SELECTION_STATE_MAP_EXPR} uses to
+ * decide which class-only-marked elements get a strict-verification baseline
+ * entry, so the weak page-wide signature and the strict per-element gate
+ * agree on exactly what counts as a class-token selection marker.
  */
-const DOM_SNAPSHOT_EXPR = `(() => { const b = document.body; if (!b) return { html: 0, text: "", values: "", state: "" }; const t = b.innerText || ""; const controls = Array.from(b.querySelectorAll("input, textarea, select")).filter((el) => el.offsetParent !== null); const values = controls.map((el) => { if (el.type === "checkbox" || el.type === "radio") return el.checked ? "1" : "0"; return el.value || ""; }).join("|").slice(0, 2000); const ariaSel = "[aria-pressed],[aria-checked],[aria-selected],[data-state],[data-selected],[data-checked],[role=option],[role=switch],[role=checkbox],[role=menuitemcheckbox]"; const classSel = "button.selected,button.active,button.checked,button.Mui-selected,button.is-selected,a.selected,a.active,a.checked,[role=button].selected,[role=button].active,[role=button].checked,[role=option].selected,[role=tab].active,[tabindex].selected,[tabindex].active,[tabindex].checked,input.selected,input.active"; const classRx = /(?:^|\\s)(selected|active|checked|Mui-selected|is-selected)(?:\\s|$)/; const skip = (el) => el.closest("[role=dialog],[role=tooltip],[aria-live]") !== null; const seen = new Set(); for (const el of b.querySelectorAll(ariaSel + "," + classSel)) { if (el.offsetParent !== null && !skip(el)) seen.add(el); } let idx = 0; const parts = []; for (const el of seen) { const ap = el.getAttribute("aria-pressed") || ""; const ac = el.getAttribute("aria-checked") || ""; const as = el.getAttribute("aria-selected") || ""; const dsRaw = el.getAttribute("data-state") || ""; const ds = (dsRaw === "open" || dsRaw === "closed") ? "" : dsRaw; const dsel = el.hasAttribute("data-selected") ? "1" : ""; const dchk = el.hasAttribute("data-checked") ? "1" : ""; const clsHit = classRx.test(el.getAttribute("class") || "") ? "1" : "0"; const i = idx++; if (!ap && !ac && !as && !ds && !dsel && !dchk && clsHit === "0") continue; parts.push(i + ":" + ap + "," + ac + "," + as + "," + ds + "," + dsel + "," + dchk + "," + clsHit); } const joined = parts.join("|"); let h = 2166136261; for (let k = 0; k < joined.length; k++) { h ^= joined.charCodeAt(k); h = Math.imul(h, 16777619); } const state = (h >>> 0).toString(36) + ":" + parts.length; return { html: (b.outerHTML || "").length, text: t.length + ":" + t.slice(0, 200), values, state }; })()`;
+const DOM_SNAPSHOT_EXPR = `(() => { const b = document.body; if (!b) return { html: 0, text: "", values: "", state: "" }; const t = b.innerText || ""; const controls = Array.from(b.querySelectorAll("input, textarea, select")).filter((el) => el.offsetParent !== null); const values = controls.map((el) => { if (el.type === "checkbox" || el.type === "radio") return el.checked ? "1" : "0"; return el.value || ""; }).join("|").slice(0, 2000); const ariaSel = "[aria-pressed],[aria-checked],[aria-selected],[data-state],[data-selected],[data-checked],[role=option],[role=switch],[role=checkbox],[role=menuitemcheckbox]"; const classSel = ${JSON.stringify(browser_click_expr_1.SELECTION_MARKER_CLASS_SELECTOR_SRC)}; const classRx = ${browser_click_expr_1.SELECTION_MARKER_CLASS_TOKEN_REGEX_SRC}; const skip = (el) => el.closest("[role=dialog],[role=tooltip],[aria-live]") !== null; const seen = new Set(); for (const el of b.querySelectorAll(ariaSel + "," + classSel)) { if (el.offsetParent !== null && !skip(el)) seen.add(el); } let idx = 0; const parts = []; for (const el of seen) { const ap = el.getAttribute("aria-pressed") || ""; const ac = el.getAttribute("aria-checked") || ""; const as = el.getAttribute("aria-selected") || ""; const dsRaw = el.getAttribute("data-state") || ""; const ds = (dsRaw === "open" || dsRaw === "closed") ? "" : dsRaw; const dsel = el.hasAttribute("data-selected") ? "1" : ""; const dchk = el.hasAttribute("data-checked") ? "1" : ""; const clsHit = classRx.test(el.getAttribute("class") || "") ? "1" : "0"; const i = idx++; if (!ap && !ac && !as && !ds && !dsel && !dchk && clsHit === "0") continue; parts.push(i + ":" + ap + "," + ac + "," + as + "," + ds + "," + dsel + "," + dchk + "," + clsHit); } const joined = parts.join("|"); let h = 2166136261; for (let k = 0; k < joined.length; k++) { h ^= joined.charCodeAt(k); h = Math.imul(h, 16777619); } const state = (h >>> 0).toString(36) + ":" + parts.length; return { html: (b.outerHTML || "").length, text: t.length + ":" + t.slice(0, 200), values, state }; })()`;
 /**
  * Captures the pre/post signal triple the submit-verify cascade diffs.
  * Accepts the optional `page` so a resolved child `FrameTarget` whose
@@ -3022,6 +3052,37 @@ function selectionFingerprintObjSrc(elVar, dsVar) {
 function elementSelectionFingerprintExpr(xpath) {
     return `(() => { const r = document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null); const el = r.singleNodeValue; if (!el) return null; const ds = el.getAttribute("data-state") || ""; return ${selectionFingerprintObjSrc("el", "ds")}; })()`;
 }
+/**
+ * In-page source for `(el) => Element | null`: the nearest ancestor of `el`,
+ * within {@link MAX_SELECTION_ANCESTOR_DEPTH} levels, whose subtree contains a
+ * selection-marker element (`role="combobox"`/`role="listbox"`, or a
+ * {@link WIDGET_KIT_SELECTION_MARKER_SELECTORS} match) — climbing ancestor
+ * levels rather than a single `closest()` call, because a design-system
+ * combobox's marker (the `role="combobox"` trigger) and its committed-value
+ * control (a hidden `<input>`) are commonly SIBLINGS under a shared wrapper
+ * that itself carries no role/class marker: `closest()` only searches
+ * self-and-ancestors of `el`, so it can never see a marker that lives on a
+ * cousin subtree. At each level, `querySelectorAll` searches the WHOLE
+ * subtree (not just direct children), so the marker may be nested arbitrarily
+ * deep under that ancestor. Returns the FIRST (nearest) qualifying ancestor,
+ * so a same-shaped input/select outside that common ancestor is never
+ * mistaken for the same control's committed-value sibling. Shared by
+ * {@link SELECTION_STATE_MAP_EXPR}'s `isCommittedValueControl` and
+ * {@link selectionSiblingCommittedValueChanged}'s container resolution so the
+ * baseline capture and the read-back agree on exactly what counts as
+ * "nearby" — two independently-drifting copies would silently disagree on
+ * which hidden controls get a baseline entry vs. which get diffed against
+ * one, reintroducing the bug this closes.
+ */
+const NEARBY_SELECTION_CONTAINER_FN_SRC = `(el) => {
+    const MARKER_SEL = '[role="combobox"],[role="listbox"],' + ${JSON.stringify(browser_click_expr_1.WIDGET_KIT_SELECTION_MARKER_SELECTORS)};
+    let node = el.parentElement;
+    for (let depth = 0; depth < ${browser_click_expr_1.MAX_SELECTION_ANCESTOR_DEPTH} && node; depth++) {
+      if (node.querySelectorAll && node.querySelectorAll(MARKER_SEL).length > 0) return node;
+      node = node.parentElement;
+    }
+    return null;
+  }`;
 /**
  * Browser-side expression: build `{ absolutePositionalXpath →
  * ElementSelectionFingerprint }` for every VISIBLE interactive element, the
@@ -3036,22 +3097,40 @@ function elementSelectionFingerprintExpr(xpath) {
  * rect + `getComputedStyle` idiom as `deep-locator-scan.ts`'s `IS_VISIBLE_EXPR`
  * (rather than `offsetParent`), so on-screen `position:fixed` controls — a
  * sticky Next/Submit bar, whose `offsetParent` is `null` — still enter the map.
+ * The visibility gate is waived for an `input`/`select` nested inside a nearby
+ * combobox/listbox/group container: a design-system option commits its real
+ * selection to a `display:none` or `aria-hidden` sibling input, not to the
+ * visible trigger label, so excluding it here would make that control
+ * permanently invisible to the read-back — the baseline is where a hidden
+ * committed-value control gets ITS OWN entry (keyed by its own xpath, reusing
+ * the existing `value` field), so a later diff has something to compare
+ * against. The selector also folds in
+ * {@link SELECTION_MARKER_CLASS_SELECTOR_SRC} — the SAME class-token vocabulary
+ * `DOM_SNAPSHOT_EXPR`'s weak diagnostic signature uses — so a custom option
+ * widget that flips a class on ITSELF (`class="option selected"`, no role/
+ * aria-state) gets its own baseline entry: without it,
+ * {@link selectionAncestorChanged}'s ancestor-diff would have nothing to
+ * compare against for a widget that never writes a hidden sibling control.
  */
 const SELECTION_STATE_MAP_EXPR = `(() => {
   const b = document.body;
   if (!b) return {};
   const xpathOf = ${XPATH_OF_FN_SRC};
+  const nearbySelectionContainer = ${NEARBY_SELECTION_CONTAINER_FN_SRC};
   const visible = (el) => {
     const rect = el.getBoundingClientRect();
     if (rect.width === 0 && rect.height === 0) return false;
     const style = getComputedStyle(el);
     return style.display !== "none" && style.visibility !== "hidden";
   };
-  const sel = "button,[role=button],a,[tabindex],input,select,textarea,[role=option],[role=tab],[role=switch],[role=checkbox],[role=menuitemcheckbox]";
+  const sel = "button,[role=button],a,li,[tabindex],input,select,textarea,[role=option],[role=tab],[role=switch],[role=checkbox],[role=menuitemcheckbox]," + ${JSON.stringify(browser_click_expr_1.SELECTION_MARKER_CLASS_SELECTOR_SRC)};
   const skip = (el) => el.closest("[role=dialog],[role=tooltip],[aria-live]") !== null;
+  const isCommittedValueControl = (el) =>
+    (el.tagName === "INPUT" || el.tagName === "SELECT") &&
+    nearbySelectionContainer(el) !== null;
   const out = {};
   for (const el of b.querySelectorAll(sel)) {
-    if (!visible(el) || skip(el)) continue;
+    if ((!visible(el) && !isCommittedValueControl(el)) || skip(el)) continue;
     const ds = el.getAttribute("data-state") || "";
     out[xpathOf(el)] = ${selectionFingerprintObjSrc("el", "ds")};
   }
@@ -3129,30 +3208,6 @@ async function readElementSelectionFingerprint(target, selector) {
         return null;
     }
 }
-/**
- * How far up from the clicked leaf {@link selectionAncestorChanged} walks
- * looking for the option/toggle that carries the selection. Design-system
- * options nest their label 1-2 levels deep (a `<span title>` inside a
- * `role="option"`, plus the odd icon/wrapper); 6 matches the vacuous-click
- * ancestor guard in {@link verifyDomEffect}'s click branch and covers that
- * nesting without over-reaching into an outer listbox/group.
- */
-const MAX_SELECTION_ANCESTOR_DEPTH = 6;
-/**
- * Cross-vendor selector union for a selection-state widget that carries NO
- * standard selection `role` or `aria-*`/`data-state` marker — a component-kit
- * container whose selected-ness lives only in the library's own private
- * attribute. Same multi-vendor-union discipline as {@link INVALID_MARKER_CLASS_SOURCE}
- * and the `PROMPT_*_SELECTORS` unions: standards are checked FIRST (see
- * `hasMarker` in {@link selectionAncestorChanged}); this union is the fallback
- * for widgets that under-annotate ARIA, and no member is a per-site branch —
- * each is one component library's signature. Grows by a one-line edit.
- *
- * Members: `data-baseweb` (Uber Base Web — verified in a real capture to mark
- * 150 selection elements that expose no role/aria-state, so dropping it loses
- * real coverage). Add other under-annotating kits here as they surface.
- */
-const WIDGET_KIT_SELECTION_MARKER_SELECTORS = ["[data-baseweb]"].join(",");
 /**
  * Element-scoped selection read-back for the case the clicked node's OWN
  * fingerprint can't credit: a design-system option that wraps its label in a
@@ -3185,13 +3240,26 @@ async function selectionAncestorChanged(target, leafXpath, preSelectionState) {
     const xpathOf = ${XPATH_OF_FN_SRC};
     const fp = (el) => { const ds = el.getAttribute("data-state") || ""; return ${selectionFingerprintObjSrc("el", "ds")}; };
     const SELECTION_ROLES = new Set(["option", "tab", "switch", "radio", "checkbox", "menuitemcheckbox"]);
-    const KIT_MARKER_SEL = ${JSON.stringify(WIDGET_KIT_SELECTION_MARKER_SELECTORS)};
+    const KIT_MARKER_SEL = ${JSON.stringify(browser_click_expr_1.WIDGET_KIT_SELECTION_MARKER_SELECTORS)};
+    const CLASS_TOKEN_RX = ${browser_click_expr_1.SELECTION_MARKER_CLASS_TOKEN_REGEX_SRC};
     const hasMarker = (el, f) => {
       // Standards first: fingerprint fields / aria-states, then a selection role.
       if (f.kind || f.ariaPressed || f.ariaChecked || f.ariaSelected || f.dataState || f.dataSelected || f.dataChecked || f.checked) return true;
       if (SELECTION_ROLES.has((el.getAttribute("role") || "").toLowerCase())) return true;
       // Fallback: a component-kit selection widget that exposes no standard marker.
       if (el.matches(KIT_MARKER_SEL)) return true;
+      // Fallback: a widget authored with no role/aria-state, marked purely by a class token.
+      if (CLASS_TOKEN_RX.test(el.getAttribute("class") || "")) return true;
+      // Fallback: a broken click handler never adds the token to THIS node, but a
+      // sibling still carrying it (the untouched prior selection) proves the
+      // group uses the class-token convention — so this node is a member of it.
+      if (el.parentElement && el.parentElement.children) {
+        const siblings = el.parentElement.children;
+        for (let i = 0; i < siblings.length; i++) {
+          const sib = siblings[i];
+          if (sib !== el && CLASS_TOKEN_RX.test(sib.getAttribute("class") || "")) return true;
+        }
+      }
       return false;
     };
     const changed = (a, b) =>
@@ -3202,7 +3270,7 @@ async function selectionAncestorChanged(target, leafXpath, preSelectionState) {
     const r = document.evaluate(LEAF, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
     let node = r.singleNodeValue;
     if (!node) return false;
-    for (let depth = 0; depth < ${MAX_SELECTION_ANCESTOR_DEPTH} && node; depth++) {
+    for (let depth = 0; depth < ${browser_click_expr_1.MAX_SELECTION_ANCESTOR_DEPTH} && node; depth++) {
       if (node.getAttribute) {
         const now = fp(node);
         if (hasMarker(node, now)) {
@@ -3222,6 +3290,100 @@ async function selectionAncestorChanged(target, leafXpath, preSelectionState) {
         return false;
     }
 }
+/**
+ * Structural marker probe for the n+16 fallback's weak-signal gate — reuses
+ * the SAME `hasMarker` predicate {@link selectionAncestorChanged} diffs
+ * against, but only asks presence, not before/after equality. A click that
+ * resolves onto (or under) a `role=option`/aria-selection/component-kit
+ * marker element must clear the strict {@link selectionAncestorChanged} /
+ * {@link selectionSiblingCommittedValueChanged} signal to be credited —
+ * html-byte-delta/text-change/form-value alone (a label re-render with no
+ * committed-control change) is exactly the reported defect
+ * (textChanged=true, selectionStateChanged=false, verified=true) this
+ * closes off. Returns `false` on any miss / malformed result / evaluate
+ * throw (defer to the strict signal already gating `retryVerified`).
+ */
+async function clickTargetHasSelectionMarker(target, leafXpath) {
+    const expr = `(() => {
+    const LEAF = ${JSON.stringify(leafXpath)};
+    const fp = (el) => { const ds = el.getAttribute("data-state") || ""; return ${selectionFingerprintObjSrc("el", "ds")}; };
+    const SELECTION_ROLES = new Set(["option", "tab", "switch", "radio", "checkbox", "menuitemcheckbox"]);
+    const KIT_MARKER_SEL = ${JSON.stringify(browser_click_expr_1.WIDGET_KIT_SELECTION_MARKER_SELECTORS)};
+    const CLASS_TOKEN_RX = ${browser_click_expr_1.SELECTION_MARKER_CLASS_TOKEN_REGEX_SRC};
+    const hasMarker = (el, f) => {
+      if (f.kind || f.ariaPressed || f.ariaChecked || f.ariaSelected || f.dataState || f.dataSelected || f.dataChecked || f.checked) return true;
+      if (SELECTION_ROLES.has((el.getAttribute("role") || "").toLowerCase())) return true;
+      if (el.matches(KIT_MARKER_SEL)) return true;
+      if (CLASS_TOKEN_RX.test(el.getAttribute("class") || "")) return true;
+      if (el.parentElement && el.parentElement.children) {
+        const siblings = el.parentElement.children;
+        for (let i = 0; i < siblings.length; i++) {
+          const sib = siblings[i];
+          if (sib !== el && CLASS_TOKEN_RX.test(sib.getAttribute("class") || "")) return true;
+        }
+      }
+      return false;
+    };
+    const r = document.evaluate(LEAF, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+    let node = r.singleNodeValue;
+    if (!node) return false;
+    for (let depth = 0; depth < ${browser_click_expr_1.MAX_SELECTION_ANCESTOR_DEPTH} && node; depth++) {
+      if (node.getAttribute && hasMarker(node, fp(node))) return true;
+      node = node.parentElement;
+    }
+    return false;
+  })()`;
+    try {
+        return (await target.evaluate(expr)) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Sibling read-back for the case NEITHER the clicked leaf NOR any of its
+ * ancestors ({@link selectionAncestorChanged}) ever change: a design-system
+ * combobox where the click re-renders only the visible trigger label, and the
+ * REAL committed selection lives on a hidden associated `<input>`/`<select>`
+ * that is a sibling/cousin of the leaf, not an ancestor — so an UP-only walk
+ * can never reach it. Finds the nearest combobox/listbox/group container
+ * around the leaf (the same idiom the `selectOption` verifier uses at the
+ * nested-input search), diffs every `input`/`select` inside it against the
+ * baseline entry {@link SELECTION_STATE_MAP_EXPR} captured for that control's
+ * OWN xpath (visibility-gate-waived there for exactly this control class).
+ * Returns `false` on any miss / malformed result / evaluate throw (defer to
+ * the ancestor and network/URL signals).
+ */
+async function selectionSiblingCommittedValueChanged(target, leafXpath, preSelectionState) {
+    const expr = `(() => {
+    const LEAF = ${JSON.stringify(leafXpath)};
+    const BASE = ${JSON.stringify(preSelectionState)};
+    const xpathOf = ${XPATH_OF_FN_SRC};
+    const nearbySelectionContainer = ${NEARBY_SELECTION_CONTAINER_FN_SRC};
+    const r = document.evaluate(LEAF, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+    const leaf = r.singleNodeValue;
+    if (!leaf) return false;
+    // The hidden committed-value control's marker (the role=combobox trigger)
+    // is commonly a SIBLING of the leaf and the control, not an ancestor of
+    // either — climb bounded ancestor levels for the nearest subtree that
+    // contains a marker, rather than a single self-and-ancestors closest().
+    const container = nearbySelectionContainer(leaf) || leaf.parentElement;
+    if (!container || !container.querySelectorAll) return false;
+    for (const control of container.querySelectorAll("input,select")) {
+      const pre = BASE[xpathOf(control)];
+      if (!pre) continue;
+      const now = typeof control.value === "string" ? control.value.slice(0, 200) : "";
+      if (pre.value !== now) return true;
+    }
+    return false;
+  })()`;
+    try {
+        return (await target.evaluate(expr)) === true;
+    }
+    catch {
+        return false;
+    }
+}
 /** How long the upload primitive waits for a post-setInputFiles network POST. */
 const UPLOAD_NETWORK_TIMEOUT_MS = 5_000;
 /** Polling interval while waiting for the upload's network signal. */
@@ -5960,6 +6122,19 @@ async function verifyDomEffect(target, action, preSelectionState = {}) {
                 const xpath = xpathBody(selector);
                 if (!xpath)
                     return false;
+                // A click that resolved to a disabled (or aria-disabled) target can't
+                // have done anything — veto before trusting any other signal below.
+                const targetDisabledExpr = `(() => {
+          const isDisabled = ${DISABLED_MARKER_EL_EXPR};
+          const r = document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+          const el = r.singleNodeValue;
+          return el ? isDisabled(el) : false;
+        })()`;
+                const targetDisabled = await target
+                    .evaluate(targetDisabledExpr)
+                    .catch(() => false);
+                if (targetDisabled)
+                    return false;
                 let inputType = null;
                 try {
                     // Trust boundary: xpath comes from Stagehand's own resolved selector
@@ -5996,7 +6171,14 @@ async function verifyDomEffect(target, action, preSelectionState = {}) {
                     // selection on the ancestor `role="option"`, not the clicked leaf —
                     // so walk up to the nearest baseline-present selection ancestor and
                     // diff THAT. No eligible ancestor → false (defer to network/URL).
-                    return await selectionAncestorChanged(target, xpath, preSelectionState);
+                    if (await selectionAncestorChanged(target, xpath, preSelectionState)) {
+                        return true;
+                    }
+                    // Neither the leaf nor any ancestor moved: the widget's real commit
+                    // may live on a hidden sibling `<input>`/`<select>` the click never
+                    // re-renders visibly. Diff that control against its own baseline
+                    // entry instead.
+                    return await selectionSiblingCommittedValueChanged(target, xpath, preSelectionState);
                 }
                 const isCheckedNow = await locator.isChecked();
                 if (!isCheckedNow)
@@ -8291,7 +8473,7 @@ async function executeStepWithHealing(params) {
                     // even though the leaf element is still live; re-anchor on the
                     // leaf's own last two steps before giving up.
                     const xpathTail = xpathTailForRetarget(xpath);
-                    const clickExpr = `(() => { const r = document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null); let el = r.singleNodeValue; if (!el && ${JSON.stringify(xpathTail)}) { const r2 = document.evaluate("//" + ${JSON.stringify(xpathTail)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null); el = r2.singleNodeValue; } if (!el || typeof el.click !== "function") return { fired: false }; if (el.tagName === "LABEL") { const wrapped = el.querySelector("input[type=checkbox], input[type=radio]"); if (wrapped) el = wrapped; } if (el.type === "checkbox" || el.type === "radio") { el.checked = true; el.dispatchEvent(new Event("click", { bubbles: true })); el.dispatchEvent(new Event("change", { bubbles: true })); return { fired: true, kind: "checkbox", checked: el.checked }; } ${(0, browser_click_expr_1.clickActivationExpr)("el")} return { fired: true, kind: "click" }; })()`;
+                    const clickExpr = `(() => { const r = document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null); let el = r.singleNodeValue; if (!el && ${JSON.stringify(xpathTail)}) { const r2 = document.evaluate("//" + ${JSON.stringify(xpathTail)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null); el = r2.singleNodeValue; } if (!el || typeof el.click !== "function") return { fired: false }; if (el.tagName === "LABEL") { const wrapped = el.querySelector("input[type=checkbox], input[type=radio]"); if (wrapped) el = wrapped; } if (el.type === "checkbox" || el.type === "radio") { el.checked = true; el.dispatchEvent(new Event("click", { bubbles: true })); el.dispatchEvent(new Event("change", { bubbles: true })); return { fired: true, kind: "checkbox", checked: el.checked }; } let __n16SmMatched = false; ${(0, browser_click_expr_1.retargetToSelectionMarkerExpr)("el", "__n16SmMatched")} ${(0, browser_click_expr_1.clickActivationExpr)("el")} if (__n16SmMatched) { el.dispatchEvent(new Event("change", { bubbles: true })); } return { fired: true, kind: "click" }; })()`;
                     const n16FallbackTarget = frameTarget ?? (0, frame_target_1.mainFrameTarget)(page);
                     const probeResult = (await n16FallbackTarget.evaluate(clickExpr));
                     const fired = probeResult.fired;
@@ -8362,7 +8544,14 @@ async function executeStepWithHealing(params) {
                             // to the nearest baseline-present selection ancestor and diff THAT,
                             // the same fallback `verifyDomEffect`'s primary read-back uses. No
                             // eligible ancestor → false (defer to the other retry signals).
-                            return await selectionAncestorChanged(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page), xpath, pre.selectionStateByXpath);
+                            if (await selectionAncestorChanged(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page), xpath, pre.selectionStateByXpath)) {
+                                return true;
+                            }
+                            // Neither the leaf nor any ancestor moved: the widget's real
+                            // commit may live on a hidden sibling `<input>`/`<select>` the
+                            // click never re-renders visibly. Diff that control against its
+                            // own baseline entry instead.
+                            return await selectionSiblingCommittedValueChanged(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page), xpath, pre.selectionStateByXpath);
                         })());
                     // RC2: an advance/`kind=click` "Next" that only grew the DOM
                     // (validation errors rendered) with NO network/URL change is a
@@ -8375,6 +8564,27 @@ async function executeStepWithHealing(params) {
                     // verifying so the cascade routes to the fill-invalid-fields replan.
                     // Confirmed no-op signature on the wizard ATS's COMPENSATION page (network=false
                     // url=false htmlDelta>0 textChanged) mis-scored verified=true(dom).
+                    // A click that resolved to a disabled (or aria-disabled) target
+                    // can't have done anything — same veto as verifyDomEffect's click
+                    // branch, applied here so the n+16 fallback can't ride past it on
+                    // a weak htmlDelta/textChanged signal.
+                    const clickBlockedByDisabled = probeResult.kind === "click" &&
+                        xpath !== null &&
+                        (await (async () => {
+                            const disabledExpr = `(() => {
+                const isDisabled = ${DISABLED_MARKER_EL_EXPR};
+                const r = document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+                let el = r.singleNodeValue;
+                if (!el && ${JSON.stringify(xpathTail)}) {
+                  const r2 = document.evaluate("//" + ${JSON.stringify(xpathTail)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+                  el = r2.singleNodeValue;
+                }
+                return el ? isDisabled(el) : false;
+              })()`;
+                            return await (frameTarget ?? (0, frame_target_1.mainFrameTarget)(page))
+                                .evaluate(disabledExpr)
+                                .catch(() => false);
+                        })());
                     const clickWasDomOnly = probeResult.kind === "click" && !retryNetworkFired && !retryUrlChanged;
                     const clickBlockedByInvalid = clickWasDomOnly &&
                         (await countNgInvalidContainers(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page)).catch(() => 0)) >
@@ -8429,9 +8639,19 @@ async function executeStepWithHealing(params) {
                     // earlier fill included), so it says nothing about whether THIS
                     // control committed — only the element's own `checkboxStateVerified`
                     // (or a real network/url/selection-state signal) may verify it.
+                    // A click that resolved onto (or under) a selection-marker element
+                    // (role=option, aria-selected/checked/pressed, a component-kit
+                    // marker) must clear the strict retrySelectionStateChanged signal —
+                    // the weak html/text/form-value OR-branch alone can never credit
+                    // it, closing the reported textChanged=true/selectionStateChanged=
+                    // false/verified=true defect.
+                    const clickTargetIsSelectionMarker = xpath !== null &&
+                        (await clickTargetHasSelectionMarker(frameTarget ?? (0, frame_target_1.mainFrameTarget)(page), xpath));
                     const weakDomSignalsAllowed = ((!isFinalStep && !submitStep) || requireSubmitEndpoint) &&
-                        !isCheckboxOrRadioIntentStep(step);
-                    let retryVerified = !clickBlockedByInvalid &&
+                        !isCheckboxOrRadioIntentStep(step) &&
+                        !clickTargetIsSelectionMarker;
+                    let retryVerified = !clickBlockedByDisabled &&
+                        !clickBlockedByInvalid &&
                         !fallbackDomOnlyAdvance &&
                         (retryNetworkFired ||
                             retryUrlChanged ||