@matt82198/aesop 0.1.0-beta.4 → 0.1.0-beta.5

package/tools/verify_dash.py

@@ -1,18 +1,31 @@
-"""Browser-level proof for the realtime SSE dashboard (ui/serve.py).
-
-Drives a real headless Chromium (python-playwright) against a fixture fleet and
-asserts the contract the unit tests can't see:
-  (a) zero console errors on load and across the run
-  (b) backlog panel renders the seeded tiers/items
-  (c) clicking an agent row expands detail containing the actual dispatch prompt
-  (d) file changes push to the page over SSE within ~5s WITHOUT reload
-  (e) the expanded row is STILL expanded after those live updates
+"""Browser-level proof for the wave-14 React dashboard (ui/web/dist/).
+
+Drives the BUILT app served by `python ui/serve.py` against fixture fleet state,
+asserting the contract via data-testid hooks only (never CSS internals):
+
+Populated-state phase:
+  (a) console clean of errors across the whole run
+  (b) app serves React dist (not legacy template)
+  (c) health-header testid present and rendered
+  (d) view testids present (overview on first paint)
+  (e) inbox form testids (submit flow)
+  (f) cost view renders table/chart/scorecard from the fixture ledger
+  (g) CSS stylesheet loaded (reduced-motion media query proven by vitest)
+  (h) a11y live regions present (role=status or aria-live)
+  (j) SSE live update WITHOUT reload (tracker.json mutation appears in DOM)
+  (k) tracker round-trip through the real form: create -> proposed lane, claim/done move lanes
+  (l) hostile javascript: pr_link is inert in the real DOM (no javascript: href)
+  (m) keyboard-only agent-row expand; expansion SURVIVES an SSE agents update
+  (n) computed contrast of health-header label >= 4.5:1 in BOTH themes (toggle exercised)
+  (o) orchestrator-status phase=audit -> audit badge appears in a live region
+
+Empty-state phase (separate boot, empty tracker/agents/alerts/backlog):
+  (i) all four views render their empty states with a clean console
 
 Run: python tools/verify_dash.py            (exit 0 = proven, 1 = failed)
      python tools/verify_dash.py --allow-skip (exit 0 = proven or skipped, 1 = failed)
 
 Fails with exit 1 if playwright/chromium is unavailable (unless --allow-skip is passed).
-Use --allow-skip for environments that legitimately can't run a browser.
 """
 import argparse
 import json
@@ -23,31 +36,79 @@ import subprocess
 import sys
 import tempfile
 import time
-from datetime import datetime, timezone
 from pathlib import Path
 
 REPO = Path(__file__).resolve().parent.parent
 SERVE = REPO / "ui" / "serve.py"
 
-FIXTURE_BACKLOG = """# Audit backlog — verify_dash fixture
+
+def _real_console_errors(console_errors, failed_urls):
+    """Drop noise from the captured console errors.
+
+    Playwright reports a failed sub-resource as a generic
+    "Failed to load resource: ... 404" console line that carries NO url, so
+    string-matching it is fragile. We instead correlate with the actual
+    failed-response urls: a generic resource-load line is ignorable when the
+    only failed responses were favicon (which the server now answers 204, so
+    this is belt-and-suspenders). Non-favicon failed responses are surfaced
+    explicitly so a real broken asset still fails the proof.
+    """
+    non_favicon = [u for u in failed_urls if "favicon" not in u.lower()]
+    real = []
+    for e in console_errors:
+        low = e.lower()
+        if "favicon" in low:
+            continue
+        if "failed to load resource" in low and not non_favicon:
+            continue  # only favicon failed → ignore the urlless generic line
+        real.append(e)
+    real.extend(f"failed resource: {u}" for u in non_favicon)
+    return real
+
+AGENT_FULL_ID = "verifyagent0123456789ab"
+PROMPT_MARKER = "FIXTURE-PROMPT-MARKER: rebuild the flux capacitor\n" + "\n".join(
+    f"line {i}: recalibrate subsystem {i} and verify each tolerance band carefully"
+    for i in range(60))
+
+FIXTURE_BACKLOG = """# Audit backlog — wave-14 verify_dash fixture
 
 **Status legend:** ⬜ unclaimed · 🔵 dispatched · ✅ merged · ⏸ user call
 
 ## P0 — correctness / security
 
-- ✅ **[sec] BACKLOG-SEED-ALPHA item.** done.
-- 🔵 **[js] BACKLOG-SEED-BETA item.** in flight.
+- ✅ **[sec] Dashboard rewrite (U1 foundation).** completed.
+- 🔵 **[ui] React component library (U4-U7).** in progress.
+
+## P1 — observability
+
+- ⬜ **[cost] Cost analytics per model.** todo.
 
 ## Landing log
 - fixture
 """
 
-AGENT_FULL_ID = "verifyagent0123456789ab"
-# Long, multi-line prompt so the .dispatch-prompt box (max-height 300px) actually
-# overflows and is scrollable — required to test scroll-position preservation.
-PROMPT_MARKER = "FIXTURE-PROMPT-MARKER: rebuild the flux capacitor\n" + "\n".join(
-    f"line {i}: recalibrate subsystem {i} and verify each tolerance band carefully"
-    for i in range(60))
+FIXTURE_LEDGER = """| timestamp | agent_type | model | duration_seconds | tokens_in | tokens_out | verdict |
+| --- | --- | --- | --- | --- | --- | --- |
+| 2026-07-13T14:00:00Z | orchestrator | claude-opus-4-20250805 | 120 | 50000 | 12000 | OK |
+| 2026-07-13T14:02:30Z | haiku | claude-haiku-4-5-20251001 | 45 | 12000 | 3500 | OK |
+| 2026-07-13T14:05:15Z | haiku | claude-haiku-4-5-20251001 | 50 | 14000 | 4200 | OK |
+| 2026-07-13T14:08:00Z | sonnet | claude-sonnet-4-5-20250929 | 85 | 28000 | 8100 | OK |
+| 2026-07-13T14:12:20Z | haiku | claude-haiku-4-5-20251001 | 40 | 11000 | 3200 | FAILED |
+"""
+
+XSS_ITEM = {
+    "id": "fixturexss01",
+    "title": "fixture xss probe",
+    "priority": "P2",
+    "status": "todo",
+    "lane": "proposed",
+    "source": "verify-dash",
+    "tags": ["fixture"],
+    "notes": "hostile pr_link must render inert",
+    "pr_link": "javascript:alert(1)",
+    "created_at": "2026-07-14T00:00:00Z",
+    "completed_at": None,
+}
 
 
 def free_port():
@@ -58,20 +119,52 @@ def free_port():
     return port
 
 
-def build_fixture(root: Path, hint: str, with_high_alerts: bool = False):
+def _rel_luminance(rgb):
+    def chan(c):
+        c = c / 255.0
+        return c / 12.92 if c <= 0.04045 else ((c + 0.055) / 1.055) ** 2.4
+    r, g, b = (chan(v) for v in rgb)
+    return 0.2126 * r + 0.7152 * g + 0.0722 * b
+
+
+def contrast_ratio(rgb1, rgb2):
+    l1, l2 = _rel_luminance(rgb1), _rel_luminance(rgb2)
+    hi, lo = max(l1, l2), min(l1, l2)
+    return (hi + 0.05) / (lo + 0.05)
+
+
+def parse_rgb(css_color):
+    """Parse 'rgb(r, g, b)' / 'rgba(r, g, b, a)' into an (r, g, b) tuple."""
+    inner = css_color[css_color.index("(") + 1: css_color.rindex(")")]
+    parts = [p.strip() for p in inner.split(",")]
+    return tuple(int(float(p)) for p in parts[:3])
+
+
+def copy_dist(root: Path):
+    real_dist = REPO / "ui" / "web" / "dist"
+    if real_dist.is_dir():
+        shutil.copytree(real_dist, root / "ui" / "web" / "dist")
+
+
+def build_fixture(root: Path, hint: str):
+    """Populated fixture: agent + tracker (with XSS probe) + alerts + ledger + backlog."""
     (root / "state").mkdir(exist_ok=True)
     (root / "transcripts").mkdir(exist_ok=True)
     (root / "dash").mkdir(exist_ok=True)
+    copy_dist(root)
+
     (root / "AUDIT-BACKLOG.md").write_text(FIXTURE_BACKLOG, encoding="utf-8")
 
-    # Optional: seed with HIGH and MED severity alerts for testing
-    if with_high_alerts:
-        alerts_log = root / "state" / "SECURITY-ALERTS.log"
-        alerts_log.write_text(
-            "2025-07-12T14:32:01Z | HIGH | API secret exposed in logs\n"
-            "2025-07-12T14:30:05Z | MED | Unvalidated user input detected\n",
-            encoding="utf-8"
-        )
+    (root / "state" / "ledger").mkdir(parents=True, exist_ok=True)
+    (root / "state" / "ledger" / "OUTCOMES-LEDGER.md").write_text(
+        FIXTURE_LEDGER, encoding="utf-8")
+
+    (root / "state" / "SECURITY-ALERTS.log").write_text(
+        "2026-07-13T14:32:01Z | HIGH | fixture alert high\n"
+        "2026-07-13T14:30:05Z | MED | fixture alert med\n", encoding="utf-8")
+
+    (root / "state" / "tracker.json").write_text(
+        json.dumps({"version": 1, "items": [XSS_ITEM]}), encoding="utf-8")
 
     # Fake detector: reads hint.txt so live agent updates are deterministic.
     (root / "hint.txt").write_text(hint, encoding="utf-8")
@@ -82,7 +175,7 @@ def build_fixture(root: Path, hint: str, with_high_alerts: bool = False):
         "status:'running',age_s:4,hint:hint,taskLabel:hint}]));\n"
     )
     (root / "dash" / "dash-extra.mjs").write_text(fake, encoding="utf-8")
-    transcript = root / "transcripts" / f"{AGENT_FULL_ID}.output"
+    transcript = root / "transcripts" / f"agent-{AGENT_FULL_ID}.jsonl"
     lines = [
         json.dumps({"type": "user", "parentUuid": None,
                     "message": {"content": PROMPT_MARKER}}),
@@ -90,589 +183,315 @@ def build_fixture(root: Path, hint: str, with_high_alerts: bool = False):
                     "message": {"content": "working"}}),
     ]
     transcript.write_text("\n".join(lines) + "\n", encoding="utf-8")
-    # fingerprint seed so the collector re-invokes the fake detector on touch
     (root / "transcripts" / "agent-seed.jsonl").write_text("{}\n", encoding="utf-8")
 
 
-def main():
-    parser = argparse.ArgumentParser(
-        description="Browser-level proof for the realtime SSE dashboard"
-    )
-    parser.add_argument(
-        "--allow-skip",
-        action="store_true",
-        help="Allow skipping if playwright/chromium is unavailable (exit 0 instead of 1)"
-    )
-    args = parser.parse_args()
+def build_empty_fixture(root: Path):
+    """Empty fixture: no tracker items, no agents, no alerts, no backlog, no ledger."""
+    (root / "state").mkdir(exist_ok=True)
+    (root / "transcripts").mkdir(exist_ok=True)
+    (root / "dash").mkdir(exist_ok=True)
+    copy_dist(root)
+    (root / "dash" / "dash-extra.mjs").write_text(
+        "console.log(JSON.stringify([]));\n", encoding="utf-8")
 
-    try:
-        from playwright.sync_api import sync_playwright
-    except ImportError:
-        msg = "playwright missing — run `python -m playwright install chromium`, or pass --allow-skip"
-        if args.allow_skip:
-            print(f"SKIP: {msg}")
-            return 0
-        else:
-            print(f"FAIL: {msg}")
-            return 1
-
-    root = Path(tempfile.mkdtemp(prefix="aesop-verify-dash-"))
-    state_root = root / "state"
 
-    # HARD GUARD: refuse to run if state_root looks like the real repo state dir
-    # (e.g., ~/aesop/state or an absolute path ending with /aesop/state)
+def start_server(root: Path, port: int):
+    state_root = root / "state"
     real_state = Path.home() / "aesop" / "state"
     if state_root.resolve() == real_state.resolve():
-        print("FAIL: state dir resolved to real repo state (~aesop/state), refusing to run")
-        return 1
-
-    port = free_port()
+        raise RuntimeError("state dir resolved to real repo state (~aesop/state)")
     env = dict(os.environ,
                AESOP_ROOT=str(root),
                AESOP_STATE_ROOT=str(state_root),
                AESOP_TRANSCRIPTS_ROOT=str(root / "transcripts"),
                AESOP_UI_COLLECT_INTERVAL="0.3",
                PORT=str(port))
-    # Build with HIGH/MED severity alerts for testing alarm color semantics
-    build_fixture(root, hint="initial fixture task", with_high_alerts=True)
     server = subprocess.Popen([sys.executable, str(SERVE)], env=env,
                               stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    for _ in range(50):
+        try:
+            socket.create_connection(("127.0.0.1", port), timeout=0.2).close()
+            return server
+        except OSError:
+            time.sleep(0.2)
+    server.kill()
+    raise RuntimeError("server never came up")
+
+
+def stop_server(server):
+    server.terminate()
+    try:
+        server.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        server.kill()
+
+
+def run_empty_phase(pw, failures):
+    """(i) all four views render empty states with a clean console."""
+    root = Path(tempfile.mkdtemp(prefix="aesop-verify-w14-empty-"))
+    port = free_port()
     console_errors = []
-    failures = []
+    failed_urls = []
+    build_empty_fixture(root)
     try:
-        # wait for server
-        for _ in range(50):
+        server = start_server(root, port)
+    except RuntimeError as e:
+        failures.append(f"(i) empty-state server failed: {e}")
+        shutil.rmtree(root, ignore_errors=True)
+        return
+    try:
+        browser = pw.chromium.launch(headless=True)
+        page = browser.new_page()
+        page.on("console", lambda m: console_errors.append(m.text)
+                if m.type == "error" else None)
+        page.on("pageerror", lambda e: console_errors.append(str(e)))
+        page.on("response", lambda r: failed_urls.append(r.url) if r.status >= 400 else None)
+        page.goto(f"http://127.0.0.1:{port}/", wait_until="domcontentloaded")
+        try:
+            page.wait_for_selector("[data-testid='health-header']", timeout=15000)
+        except Exception as e:
+            failures.append(f"(i) empty-state app never mounted: {e}")
+        views = [("#/", "view-overview"), ("#/work", "view-work"),
+                 ("#/activity", "view-activity"), ("#/cost", "view-cost")]
+        for hash_, testid in views:
+            page.evaluate(f"location.hash = '{hash_}'")
             try:
-                socket.create_connection(("127.0.0.1", port), timeout=0.2).close()
-                break
-            except OSError:
-                time.sleep(0.2)
-        else:
-            print("FAIL: server never came up")
-            return 1
+                page.wait_for_selector(f"[data-testid='{testid}']", timeout=12000)
+            except Exception as e:
+                failures.append(f"(i) empty-state view {testid} did not render: {e}")
+        time.sleep(0.5)
+        real_errors = _real_console_errors(console_errors, failed_urls)
+        if real_errors:
+            failures.append(f"(i) empty-state console errors: {real_errors[:3]}")
+        browser.close()
+    finally:
+        stop_server(server)
+        shutil.rmtree(root, ignore_errors=True)
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Browser-level proof for the wave-14 React dashboard (ui/web/dist/)")
+    parser.add_argument("--allow-skip", action="store_true",
+                        help="Allow skipping if playwright/chromium is unavailable")
+    args = parser.parse_args()
+
+    try:
+        from playwright.sync_api import sync_playwright
+    except ImportError:
+        msg = "playwright missing — run `python -m playwright install chromium`, or pass --allow-skip"
+        print(f"SKIP: {msg}" if args.allow_skip else f"FAIL: {msg}")
+        return 0 if args.allow_skip else 1
+
+    root = Path(tempfile.mkdtemp(prefix="aesop-verify-wave14-dash-"))
+    port = free_port()
+    console_errors = []
+    failed_urls = []
+    failures = []
+    build_fixture(root, hint="fixture hint alpha")
+    try:
+        server = start_server(root, port)
+    except RuntimeError as e:
+        print(f"FAIL: {e}")
+        shutil.rmtree(root, ignore_errors=True)
+        return 1
 
+    try:
         with sync_playwright() as pw:
             try:
                 browser = pw.chromium.launch(headless=True)
             except Exception as e:
                 msg = f"chromium unavailable ({e}); run: python -m playwright install chromium"
-                if args.allow_skip:
-                    print(f"SKIP: {msg}")
-                    return 0
-                else:
-                    print(f"FAIL: {msg}")
-                    return 1
+                print(f"SKIP: {msg}" if args.allow_skip else f"FAIL: {msg}")
+                return 0 if args.allow_skip else 1
+
             page = browser.new_page()
             page.on("console", lambda m: console_errors.append(m.text)
                     if m.type == "error" else None)
             page.on("pageerror", lambda e: console_errors.append(str(e)))
+            page.on("response", lambda r: failed_urls.append(r.url) if r.status >= 400 else None)
             page.goto(f"http://127.0.0.1:{port}/", wait_until="domcontentloaded")
 
-            # (b) backlog panel renders seeded items
-
-            # (P2-UX) Layout order verification: Fleet Agents + Security Alerts in top third
-            try:
-                page.wait_for_selector("#agents-list", timeout=8000)
-                page.wait_for_selector("#alerts-list", timeout=8000)
-                page.wait_for_selector("#backlog-tiers", timeout=8000)
-                
-                # Verify DOM order: agents should appear before backlog
-                agents_index = page.evaluate(
-                    "Array.from(document.querySelectorAll('[id]')).findIndex(el => el.id === 'agents-list')"
-                )
-                alerts_index = page.evaluate(
-                    "Array.from(document.querySelectorAll('[id]')).findIndex(el => el.id === 'alerts-list')"
-                )
-                backlog_index = page.evaluate(
-                    "Array.from(document.querySelectorAll('[id]')).findIndex(el => el.id === 'backlog-tiers')"
-                )
-                
-                assert agents_index < backlog_index,                     f"Fleet Agents should appear BEFORE Audit Backlog in DOM (agents={agents_index}, backlog={backlog_index})"
-                assert alerts_index < backlog_index,                     f"Security Alerts should appear BEFORE Audit Backlog in DOM (alerts={alerts_index}, backlog={backlog_index})"
-                    
-            except Exception as e:
-                failures.append(f"(P2-UX) layout order verification failed: {e}")
-            
-            # (P2-UX) Collapsed done backlog items: verify reduced padding and opacity
-            try:
-                # Ensure backlog items render with the fixture
-                page.wait_for_function(
-                    "document.querySelector('.backlog-item.done') !== null",
-                    timeout=8000
-                )
-                
-                # Get height and opacity of done item vs active item
-                done_item_styles = page.evaluate("""
-                    (() => {
-                        const done = document.querySelector('.backlog-item.done');
-                        const cs = window.getComputedStyle(done);
-                        return {
-                            height: done.offsetHeight,
-                            opacity: cs.opacity,
-                            padding: cs.padding
-                        };
-                    })()
-                """)
-                
-                active_item_styles = page.evaluate("""
-                    (() => {
-                        const active = Array.from(document.querySelectorAll('.backlog-item'))
-                            .find(el => !el.classList.contains('done'));
-                        if (!active) return {height: 0, opacity: '1', padding: '0px'};
-                        const cs = window.getComputedStyle(active);
-                        return {
-                            height: active.offsetHeight,
-                            opacity: cs.opacity,
-                            padding: cs.padding
-                        };
-                    })()
-                """)
-                
-                # Done items should be more compact (lower height, lower opacity)
-                assert done_item_styles['height'] <= active_item_styles['height'],                     f"Done items should be more compact (height {done_item_styles['height']} > {active_item_styles['height']})"
-                assert float(done_item_styles['opacity']) < 1.0,                     f"Done items should have reduced opacity (got {done_item_styles['opacity']})"
-                    
-            except Exception as e:
-                failures.append(f"(P2-UX) done item visual collapse verification failed: {e}")
-
-
-            try:
-                page.wait_for_selector("#backlog-tiers:not(.loading)", timeout=8000)
-                assert "BACKLOG-SEED-ALPHA" in page.inner_text("#backlog-tiers")
-            except Exception as e:
-                failures.append(f"(b) backlog panel did not render seed items: {e}")
-
-            # (b2) alarm color semantics: alert count renders in alarm color when HIGH alerts exist
+            # (b) app serves React dist, not the legacy template
             try:
-                # Wait for the alert count to get a class (indicating data has loaded)
-                page.wait_for_function(
-                    "document.getElementById('alert-count').className !== ''",
-                    timeout=8000
-                )
-                # Check that the element has the alarm-high class (red color)
-                class_list = page.evaluate("document.getElementById('alert-count').className")
-                assert "alarm-high" in class_list or "alarm-med" in class_list, \
-                    f"Alert count should have 'alarm-high' or 'alarm-med' class for severity, got: {class_list}"
-                # Verify computed color is NOT neutral gray (should be red/amber)
-                color = page.evaluate("window.getComputedStyle(document.getElementById('alert-count')).color")
-                # Color should be high-alert red (not gray/neutral) — just verify it's a color
-                assert "rgb(" in color, f"Alert count should have computed color, got: {color}"
-            except Exception as e:
-                failures.append(f"(b2) alert count alarm color not set: {e}")
-
-            # (b3) Security Alerts panel has distinct alarm styling when HIGH alerts exist
-            try:
-                alerts_box = page.query_selector(".alerts-box")
-                alerts_box_class = page.evaluate("document.querySelector('.alerts-box').className")
-                assert "has-high-alerts" in alerts_box_class or "has-alerts" in alerts_box_class, \
-                    f"Alerts box should have alarm styling class, got: {alerts_box_class}"
-                # Verify border changed from neutral #333 to alarm #f44
-                border_color = page.evaluate("window.getComputedStyle(document.querySelector('.alerts-box')).borderColor")
-                assert "rgb(" in border_color, f"Alerts box should have computed border color: {border_color}"
+                page_html = page.content()
+                assert "data-testid" in page_html, "React app should use data-testid hooks"
+                assert "audit-banner" not in page_html, "should not be serving old template"
             except Exception as e:
-                failures.append(f"(b3) alerts panel alarm styling not applied: {e}")
+                failures.append(f"(b) app does not serve React dist: {e}")
 
-            # (b4) affordances: stronger expand-toggle + responsive header wrap (no horizontal overflow when narrow)
+            # (c) health header rendered
             try:
-                page.wait_for_selector(".agent-row", timeout=8000)
-                toggle_size = page.evaluate(
-                    "parseFloat(getComputedStyle(document.querySelector('.agent-expand-toggle')).fontSize)")
-                assert toggle_size >= 13, f"expand toggle should be a stronger affordance (>=13px), got {toggle_size}px"
-                # narrow the viewport: header must wrap, body must not scroll horizontally
-                page.set_viewport_size({"width": 600, "height": 800})
-                page.wait_for_timeout(200)
-                overflow = page.evaluate(
-                    "document.documentElement.scrollWidth - document.documentElement.clientWidth")
-                assert overflow <= 2, f"body overflows horizontally at 600px (header not wrapping): {overflow}px"
-                page.set_viewport_size({"width": 1280, "height": 900})
-            except Exception as e:
-                failures.append(f"(b4) affordance/responsive-header check failed: {e}")
-
-            # (c) click agent row -> expands with the real dispatch prompt
-            try:
-                page.wait_for_selector(".agent-row", timeout=8000)
-                page.click(".agent-row")
-                page.wait_for_selector(".agent-row.expanded", timeout=4000)
-                page.wait_for_function(
-                    "document.querySelector('.agent-row.expanded .agent-details')"
-                    f" && document.querySelector('.agent-row.expanded .agent-details').innerText.includes('FIXTURE-PROMPT-MARKER')",
-                    timeout=8000)
+                page.wait_for_selector("[data-testid='health-header']", timeout=5000)
             except Exception as e:
-                failures.append(f"(c) click-to-expand with prompt failed: {e}")
+                failures.append(f"(c) health-header testid not found: {e}")
 
-            # (d) live updates over SSE, no reload: backlog file + agent hint change
+            # (d) overview view on first paint
             try:
-                bl = root / "AUDIT-BACKLOG.md"
-                content = bl.read_text(encoding="utf-8").replace(
-                    "## Landing log",
-                    "- ⬜ **[test] LIVE-BACKLOG-MARKER item.** pushed live.\n\n## Landing log")
-                bl.write_text(content, encoding="utf-8")
-                (root / "hint.txt").write_text("LIVE-AGENT-MARKER task", encoding="utf-8")
-                (root / "transcripts" / "agent-live.jsonl").write_text("{}\n", encoding="utf-8")
-                page.wait_for_function(
-                    "document.querySelector('#backlog-tiers').innerText.includes('LIVE-BACKLOG-MARKER')",
-                    timeout=8000)
-                page.wait_for_function(
-                    "document.querySelector('#agents-list').innerText.includes('LIVE-AGENT-MARKER')",
-                    timeout=8000)
+                page.wait_for_selector("[data-testid='view-overview']", timeout=5000)
             except Exception as e:
-                failures.append(f"(d) live SSE update did not reach the page: {e}")
+                failures.append(f"(d) view testids not found: {e}")
 
-            # (e) expansion survived the live updates
+            # (e) inbox form present
             try:
-                assert page.query_selector(".agent-row.expanded") is not None, \
-                    "expanded row lost after live updates"
+                page.wait_for_selector("[data-testid='inbox-input']", timeout=5000)
+                page.wait_for_selector("[data-testid='inbox-submit']", timeout=5000)
             except Exception as e:
-                failures.append(f"(e) {e}")
+                failures.append(f"(e) inbox form testids not found: {e}")
 
-
-            # (f) scroll position and text selection survive live updates (bugfix P2 #1)
+            # (m) keyboard-only agent expand + survival across an SSE agents update
             try:
-                # Expand an agent again to get its prompt box visible
-                expanded_row = page.query_selector(".agent-row.expanded")
-                if not expanded_row:
-                    # Re-expand if needed
-                    page.click(".agent-row")
-                    page.wait_for_selector(".agent-row.expanded", timeout=4000)
-
-                # Get the prompt box and scroll it down
-                prompt_box = page.query_selector(".agent-row.expanded .dispatch-prompt")
-                assert prompt_box is not None, "Prompt box not found"
-
-                # Scroll the prompt box to bottom
-                initial_scroll = page.evaluate(
-                    "document.querySelector('.agent-row.expanded .dispatch-prompt').scrollTop || 0")
-                page.evaluate(
-                    "document.querySelector('.agent-row.expanded .dispatch-prompt').scrollTop = 999")
-                scroll_before = page.evaluate(
-                    "document.querySelector('.agent-row.expanded .dispatch-prompt').scrollTop")
-                assert scroll_before > initial_scroll, f"Failed to scroll; before={initial_scroll}, after={scroll_before}"
-
-                # Trigger a live update by touching the backlog
-                bl = root / "AUDIT-BACKLOG.md"
-                content = bl.read_text(encoding="utf-8").replace(
-                    "## Landing log",
-                    "- ⬜ **[test] SCROLL-PERSIST-MARKER item.** live update.\n\n## Landing log")
-                bl.write_text(content, encoding="utf-8")
-
-                # Wait for the update to arrive
+                page.wait_for_selector("[data-testid='agent-row']", timeout=8000)
+                # keyboard-only: focus the row's real <button> and press Enter
+                expand_btn = page.locator("[data-testid='agent-row'] button").first
+                expand_btn.focus()
+                page.keyboard.press("Enter")
+                page.wait_for_selector("[data-testid='agent-row-detail']", timeout=8000)
+                # trigger a live agents update: change hint + touch the fingerprint seed
+                (root / "hint.txt").write_text("fixture hint beta", encoding="utf-8")
+                seed = root / "transcripts" / "agent-seed.jsonl"
+                seed.write_text('{"touch": %d}\n' % time.time_ns(), encoding="utf-8")
                 page.wait_for_function(
-                    "document.querySelector('#backlog-tiers').innerText.includes('SCROLL-PERSIST-MARKER')",
-                    timeout=8000)
-
-                # Check that scroll position survived the update
-                scroll_after = page.evaluate(
-                    "document.querySelector('.agent-row.expanded .dispatch-prompt').scrollTop")
-                assert scroll_after >= scroll_before - 2,                     f"Scroll position lost during live update: before={scroll_before}, after={scroll_after}"
+                    "document.body.innerText.includes('fixture hint beta')", timeout=10000)
+                assert page.query_selector("[data-testid='agent-row-detail']") is not None, \
+                    "expansion did not survive the SSE agents update"
             except Exception as e:
-                failures.append(f"(f) scroll position/selection not preserved during live update: {e}")
+                failures.append(f"(m) keyboard expand / expansion-survival failed: {e}")
 
-            # (g) promptCache eviction works: removed agents don't stay cached (bugfix P2 #2)
+            # (j) SSE live update WITHOUT reload: mutate tracker.json directly
             try:
-                # Get initial cache size
-                cache_size_before = page.evaluate("window.__getPromptCacheSize()")
-                assert cache_size_before > 0, "Cache should have entries for expanded agents"
-
-                # Change agent hint to force a new agent to appear
-                (root / "hint.txt").write_text("NEW-AGENT-AFTER-EVICT", encoding="utf-8")
-                (root / "transcripts" / "agent-evict-marker.jsonl").write_text("{}", encoding="utf-8")
-                page.wait_for_function(
-                    "document.querySelector('#agents-list').innerText.includes('NEW-AGENT-AFTER-EVICT')",
-                    timeout=8000)
-
-                # Now change it again to a different agent (old one gets removed from DOM)
-                (root / "hint.txt").write_text("FINAL-AGENT-STATE", encoding="utf-8")
-                (root / "transcripts" / "agent-final-marker.jsonl").write_text("{}", encoding="utf-8")
+                page.evaluate("location.hash = '#/work'")
+                page.wait_for_selector("[data-testid='view-work']", timeout=5000)
+                tracker_file = root / "state" / "tracker.json"
+                data = json.loads(tracker_file.read_text(encoding="utf-8"))
+                data["items"].append(dict(XSS_ITEM, id="fixturesse001",
+                                          title="SSE-LIVE-MARKER item",
+                                          pr_link=None))
+                tracker_file.write_text(json.dumps(data), encoding="utf-8")
                 page.wait_for_function(
-                    "document.querySelector('#agents-list').innerText.includes('FINAL-AGENT-STATE')",
-                    timeout=8000)
-
-                # Cache should have evicted old entries
-                cache_size_after = page.evaluate("window.__getPromptCacheSize()")
-                assert cache_size_after <= cache_size_before + 1,                     f"Cache grew unbounded: before={cache_size_before}, after={cache_size_after}"
+                    "document.body.innerText.includes('SSE-LIVE-MARKER')", timeout=10000)
             except Exception as e:
-                failures.append(f"(g) promptCache not evicting removed agents: {e}")
+                failures.append(f"(j) SSE live tracker update failed: {e}")
 
-            # (h) /submit writes the inbox file as valid UTF-8, even on first write
-            #     (regression for PR #36: an encoding-less header write corrupted the file)
+            # (l) hostile javascript: pr_link inert in the real DOM
             try:
-                marker = "SUBMIT-ENC-MARKER café ✓ orchestrator"
-                page.fill("#inbox-input", marker)
-                page.click("#inbox-button")
-                inbox_file = root / "state" / "ui-inbox.md"
-                deadline = time.time() + 6
-                ok = False
-                while time.time() < deadline:
-                    if inbox_file.exists():
-                        # Must decode as UTF-8 without raising UnicodeDecodeError.
-                        text = inbox_file.read_text(encoding="utf-8")
-                        if marker in text:
-                            ok = True
-                            break
-                    time.sleep(0.2)
-                assert ok, f"submitted UTF-8 marker not found in {inbox_file}"
+                bad = page.evaluate(
+                    "Array.from(document.querySelectorAll('a[href]'))"
+                    ".filter(a => a.href.toLowerCase().startsWith('javascript:')).length")
+                assert bad == 0, f"{bad} anchor(s) carry a javascript: href"
             except Exception as e:
-                failures.append(f"(h) /submit did not write a valid UTF-8 inbox file: {e}")
+                failures.append(f"(l) XSS pr_link not inert: {e}")
 
-            # (i) tracker panel renders with lanes (proposed, ranked, in-progress, done)
+            # (k) tracker round-trip through the real form (CSRF path)
             try:
-                page.wait_for_selector("#tracker-lanes", timeout=8000)
-                # Verify lane headers exist
+                # the add form sits behind a "+ Add Item" toggle
+                if page.locator("[data-testid='tracker-form-title']").count() == 0:
+                    page.get_by_role("button", name="+ Add Item").click()
+                page.fill("[data-testid='tracker-form-title']", "ROUNDTRIP-MARKER item")
+                page.click("[data-testid='tracker-form-submit']")
                 page.wait_for_function(
-                    "document.querySelector('[data-lane=\"proposed\"]') !== null",
-                    timeout=5000)
-                lanes = page.evaluate(
-                    "Array.from(document.querySelectorAll('[data-lane]')).map(el => el.dataset.lane)")
-                expected_lanes = ['proposed', 'ranked', 'in-progress', 'done']
-                for lane in expected_lanes:
-                    assert lane in lanes, f"Lane '{lane}' not found in tracker"
-            except Exception as e:
-                failures.append(f"(i) tracker panel did not render lanes: {e}")
-
-            # (j) POST tracker item via form → appears in proposed lane via SSE (no reload)
-            try:
-                page.fill("#tracker-title", "Tracker Test Item")
-                page.select_option("#tracker-priority", "P1")
-                page.fill("#tracker-notes", "Test notes for tracker item")
-                page.click("#tracker-add-btn")
-                # Wait for item to appear in proposed lane via SSE (no page reload)
-                page.wait_for_function(
-                    "document.querySelector('[data-lane=\"proposed\"]')?.innerText.includes('Tracker Test Item')",
-                    timeout=8000)
-                # Verify priority chip rendered
-                page.wait_for_function(
-                    "document.querySelector('.priority-p1') !== null",
-                    timeout=5000)
-            except Exception as e:
-                failures.append(f"(j) tracker add-item form did not create/SSE item: {e}")
-
-            # (m) tracker item pr_link XSS: javascript: URLs must never reach a DOM href
-            # (wave-10 P0 — render-side defense-in-depth for buildTrackerItem)
-            try:
-                render = page.evaluate(
-                    """
-                    (() => {
-                        const el = buildTrackerItem({
-                            id: 'xss-test-item',
-                            title: 'XSS Probe',
-                            priority: 'P1',
-                            lane: 'proposed',
-                            pr_link: 'javascript:alert(1)'
-                        });
-                        const a = el.querySelector('a');
-                        return {
-                            html: el.innerHTML,
-                            anchorHref: a ? a.getAttribute('href') : null,
-                            anchorPresent: a !== null
-                        };
-                    })()
-                    """
-                )
-                # The raw pr_link text may still be SHOWN (escaped, inert) to the user
-                # for visibility — that's fine. What must never happen is the scheme
-                # landing inside an href="..." attribute, which is what makes it
-                # click-to-execute.
-                assert 'href="javascript' not in render["html"].lower(), \
-                    f"(m) javascript: scheme leaked into a rendered href attribute: {render['html']}"
-                # No <a> should be emitted for a rejected scheme (label falls back to
-                # a plain, non-clickable span), and no href value may resolve to
-                # anything other than the empty/neutralized string.
-                assert not (render["anchorPresent"] and render["anchorHref"]
-                            and "javascript:" in render["anchorHref"].lower()), \
-                    f"(m) tracker item rendered an executable javascript: href: {render['anchorHref']}"
-                assert not render["anchorPresent"], \
-                    f"(m) expected pr_link with unsafe scheme to render inert (no <a>), got href={render['anchorHref']}"
-
-                # Sanity check: a legitimate https:// pr_link must still render as a
-                # real, clickable link so the fix doesn't break valid PR links.
-                safe_render = page.evaluate(
-                    """
-                    (() => {
-                        const el = buildTrackerItem({
-                            id: 'safe-link-item',
-                            title: 'Safe Link',
-                            priority: 'P1',
-                            lane: 'proposed',
-                            pr_link: 'https://github.com/example/repo/pull/1'
-                        });
-                        const a = el.querySelector('a');
-                        return { anchorHref: a ? a.getAttribute('href') : null };
-                    })()
-                    """
-                )
-                assert safe_render["anchorHref"] == "https://github.com/example/repo/pull/1", \
-                    f"(m) valid https pr_link should still render a real href, got: {safe_render['anchorHref']}"
+                    "document.body.innerText.includes('ROUNDTRIP-MARKER')", timeout=10000)
+                # locate the card, then drive its lane actions by accessible name
+                card = page.locator("[data-testid='tracker-card']",
+                                    has_text="ROUNDTRIP-MARKER").first
+                moved = 0
+                for action in ("Claim", "Done"):
+                    btn = card.get_by_role("button", name=action)
+                    if btn.count() == 0:
+                        # expand the card first if actions are inside the detail area
+                        card.click()
+                        btn = card.get_by_role("button", name=action)
+                    if btn.count() > 0:
+                        btn.first.click()
+                        time.sleep(1.0)
+                        moved += 1
+                assert moved == 2, f"only {moved}/2 lane actions (Claim/Done) were operable"
             except Exception as e:
-                failures.append(f"(m) tracker pr_link XSS probe failed: {e}")
+                failures.append(f"(k) tracker round-trip failed: {e}")
 
-            # (k) orchestrator status shows "no active session" when file absent
+            # (f) cost view renders table/chart/scorecard from the fixture ledger
             try:
-                orch_status = page.inner_text("#orchestrator-status")
-                assert "no active session" in orch_status or orch_status == "—", \
-                    f"Expected 'no active session' when status file absent, got: '{orch_status}'"
+                page.evaluate("location.hash = '#/cost'")
+                page.wait_for_selector("[data-testid='cost-table']", timeout=8000)
+                page.wait_for_selector("[data-testid='cost-chart']", timeout=5000)
+                page.wait_for_selector("[data-testid='scorecard']", timeout=5000)
+                assert "haiku" in page.inner_text("[data-testid='cost-table']").lower(), \
+                    "fixture ledger models not rendered in cost table"
             except Exception as e:
-                failures.append(f"(k) orchestrator status did not show 'no active session': {e}")
+                failures.append(f"(f) cost view did not render fixture ledger: {e}")
 
-            # (l) write orchestrator-status.json with phase=audit → ASCII banner appears
+            # (o) orchestrator-status phase=audit -> audit badge in a live region
             try:
-                status_data = {
-                    "id": "main",
-                    "role": "orchestrator",
-                    "activity": "running audit",
-                    "phase": "audit",
-                    "updated_at": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-                }
                 status_file = root / "state" / "orchestrator-status.json"
-                status_file.write_text(json.dumps(status_data, indent=2), encoding="utf-8")
-                # Wait for banner to appear via SSE
+                status_file.write_text(json.dumps({
+                    "id": "main", "role": "orchestrator",
+                    "activity": "running audit", "phase": "audit"}), encoding="utf-8")
                 page.wait_for_function(
-                    "document.getElementById('audit-banner').style.display === 'block'",
-                    timeout=8000)
-                # Verify ASCII art is present
-                banner_text = page.inner_text("#audit-banner")
-                assert "AUDIT CYCLE RUNNING" in banner_text and "scanning" in banner_text, \
-                    f"Audit banner missing expected content: {banner_text}"
+                    "(() => { const el = document.querySelector(\"[data-testid='health-orchestrator']\");"
+                    " return el && /audit/i.test(el.textContent); })()", timeout=10000)
+                announced = page.evaluate(
+                    "(() => { const el = document.querySelector(\"[data-testid='health-orchestrator']\");"
+                    " const near = el.closest('[role=status],[aria-live]') || el.querySelector('[role=status],[aria-live]');"
+                    " return !!near || el.getAttribute('role') === 'status' || el.hasAttribute('aria-live'); })()")
+                assert announced, "audit badge is not in/near a live region"
             except Exception as e:
-                failures.append(f"(l) orchestrator status audit banner did not appear: {e}")
+                failures.append(f"(o) audit-phase badge failed: {e}")
 
-            # (n) Wave-13 UX/a11y fixes validation
-            # (n1) header-label contrast: verify color changed from #666 to #999
+            # (n) computed contrast of a health-header label in BOTH themes
             try:
-                header_label_color = page.evaluate(
-                    "window.getComputedStyle(document.querySelector('.header-label')).color")
-                # #999 = rgb(153, 153, 153)
-                assert "153" in header_label_color, \
-                    f"(n1) header-label should have #999 contrast fix (rgb ~153,153,153), got: {header_label_color}"
+                page.evaluate("location.hash = '#/'")
+                page.wait_for_selector("[data-testid='health-watchdog']", timeout=5000)
+                ratios = {}
+                for theme_pass in ("first", "second"):
+                    styles = page.evaluate(
+                        "(() => { const el = document.querySelector(\"[data-testid='health-watchdog']\");"
+                        " const cs = getComputedStyle(el);"
+                        " let bg = 'rgba(0, 0, 0, 0)'; let node = el;"
+                        " while (node) { const c = getComputedStyle(node).backgroundColor;"
+                        "   if (c && !c.includes('0, 0, 0, 0')) { bg = c; break; } node = node.parentElement; }"
+                        " if (bg.includes('0, 0, 0, 0')) bg = getComputedStyle(document.body).backgroundColor;"
+                        " return { fg: cs.color, bg: bg,"
+                        "          theme: document.documentElement.getAttribute('data-theme') || 'default' }; })()")
+                    ratio = contrast_ratio(parse_rgb(styles["fg"]), parse_rgb(styles["bg"]))
+                    ratios[styles["theme"] + "/" + theme_pass] = round(ratio, 2)
+                    assert ratio >= 4.5, \
+                        f"health label contrast {ratio:.2f}:1 in theme '{styles['theme']}' (< 4.5)"
+                    if theme_pass == "first":
+                        page.click("[data-testid='theme-toggle']")
+                        time.sleep(0.5)
+                print(f"  contrast ratios: {ratios}")
             except Exception as e:
-                failures.append(f"(n1) header-label contrast check failed: {e}")
+                failures.append(f"(n) theme contrast check failed: {e}")
 
-            # (n2) priority select has visual affordance (chevron)
+            # (g) CSS stylesheet loaded
             try:
-                select_bg = page.evaluate(
-                    "window.getComputedStyle(document.getElementById('tracker-priority')).backgroundImage")
-                assert "url(" in select_bg and ("svg" in select_bg.lower() or "data:" in select_bg), \
-                    f"(n2) tracker-priority should have chevron background, got: {select_bg}"
+                assert page.query_selector("link[rel='stylesheet']") is not None, \
+                    "page should have CSS stylesheet links"
             except Exception as e:
-                failures.append(f"(n2) priority select chevron not found: {e}")
+                failures.append(f"(g) CSS stylesheet check failed: {e}")
 
-            # (n3) empty tracker lane shows placeholder
+            # (h) live regions present
             try:
-                # Create a tracker with no items to get empty state
-                page.evaluate("""
-                    (() => {
-                        const container = document.getElementById('tracker-lanes');
-                        container.innerHTML = '';
-                        const laneEl = document.createElement('div');
-                        laneEl.className = 'tracker-lane';
-                        laneEl.innerHTML = `
-                            <div class="lane-header">
-                                <span>Empty Test Lane</span>
-                                <span class="lane-count" aria-label="Empty Test Lane: 0 items">0</span>
-                            </div>
-                            <div class="lane-items empty" data-lane="test"></div>
-                        `;
-                        const itemsContainer = laneEl.querySelector('.lane-items');
-                        const placeholder = document.createElement('div');
-                        placeholder.className = 'lane-empty-placeholder';
-                        placeholder.textContent = 'empty';
-                        itemsContainer.appendChild(placeholder);
-                        container.appendChild(laneEl);
-                    })()
-                """)
-                empty_lane_text = page.inner_text('[data-lane="test"]')
-                assert "empty" in empty_lane_text.lower(), \
-                    f"(n3) empty lane should show 'empty' placeholder, got: '{empty_lane_text}'"
+                live_regions = page.evaluate(
+                    "document.querySelectorAll('[role=\"status\"], [aria-live]').length")
+                assert live_regions > 0, "no live regions on page"
             except Exception as e:
-                failures.append(f"(n3) empty lane placeholder check failed: {e}")
+                failures.append(f"(h) live regions check failed: {e}")
 
-            # (n4) prefers-reduced-motion media query is in CSS
-            try:
-                css_contains_prefers = page.evaluate("""
-                    (() => {
-                        const styles = Array.from(document.styleSheets)
-                            .filter(s => !s.href || s.href.includes('http://localhost'))
-                            .map(s => {
-                                try { return s.cssText; } catch { return ''; }
-                            })
-                            .join(' ');
-                        const pageContent = document.documentElement.outerHTML;
-                        return pageContent.includes('prefers-reduced-motion');
-                    })()
-                """)
-                assert css_contains_prefers, \
-                    "(n4) CSS should include @media (prefers-reduced-motion: reduce) query"
-            except Exception as e:
-                failures.append(f"(n4) prefers-reduced-motion query check failed: {e}")
-
-            # (n5) tracker-live-region exists for a11y announcements (sr-only)
-            try:
-                live_region = page.query_selector("#tracker-live-region")
-                assert live_region is not None, \
-                    "(n5) tracker-live-region should exist for screen reader announcements"
-                # Verify it's sr-only (absolutely positioned, off-screen)
-                sr_only_styles = page.evaluate("""
-                    (() => {
-                        const el = document.getElementById('tracker-live-region');
-                        const cs = window.getComputedStyle(el);
-                        return {
-                            position: cs.position,
-                            width: cs.width,
-                            height: cs.height
-                        };
-                    })()
-                """)
-                assert sr_only_styles["position"] == "absolute", \
-                    f"(n5) tracker-live-region should be sr-only (position:absolute), got: {sr_only_styles}"
-            except Exception as e:
-                failures.append(f"(n5) tracker-live-region sr-only check failed: {e}")
-
-            # (n6) lane-count elements have aria-labels
-            try:
-                page.wait_for_selector(".lane-count", timeout=5000)
-                lane_count_labels = page.evaluate("""
-                    (() => {
-                        return Array.from(document.querySelectorAll('.lane-count'))
-                            .map(el => el.getAttribute('aria-label') || 'missing')
-                            .filter(l => l !== 'missing');
-                    })()
-                """)
-                assert len(lane_count_labels) > 0 and all(": " in l for l in lane_count_labels), \
-                    f"(n6) lane-count elements should have 'Lane Name: N items' aria-labels, got: {lane_count_labels}"
-            except Exception as e:
-                failures.append(f"(n6) lane-count aria-label check failed: {e}")
-
-            # (n7) running-count has toned down styling (not 18px/900)
-            try:
-                running_count_style = page.evaluate("""
-                    (() => {
-                        const el = document.getElementById('running-count');
-                        const cs = window.getComputedStyle(el);
-                        return { fontSize: cs.fontSize, fontWeight: cs.fontWeight };
-                    })()
-                """)
-                # After fix: 16px/600, not 18px/900
-                font_size = int(running_count_style["fontSize"].replace("px", ""))
-                assert font_size <= 16, \
-                    f"(n7) running-count should have toned down font-size (<=16px), got: {font_size}px"
-                # Font-weight 600 should be "600" or similar, not "900"
-                assert "900" not in str(running_count_style["fontWeight"]), \
-                    f"(n7) running-count should have reduced font-weight (not 900), got: {running_count_style['fontWeight']}"
-            except Exception as e:
-                failures.append(f"(n7) running-count styling check failed: {e}")
-
-            # (a) console clean across the whole run
-            time.sleep(1.0)
-            real_errors = [e for e in console_errors if "favicon" not in e.lower()]
+            # (a) console clean across the whole populated run
+            time.sleep(0.5)
+            real_errors = _real_console_errors(console_errors, failed_urls)
             if real_errors:
-                failures.append(f"(a) console errors: {real_errors[:5]}")
+                failures.append(f"(a) console errors: {real_errors[:3]}")
 
             browser.close()
+
+            # (i) empty-state phase — separate boot, separate console
+            run_empty_phase(pw, failures)
+
     finally:
-        server.terminate()
-        try:
-            server.wait(timeout=5)
-        except subprocess.TimeoutExpired:
-            server.kill()
+        stop_server(server)
         shutil.rmtree(root, ignore_errors=True)
 
     if failures:
@@ -680,13 +499,13 @@ def main():
         for f in failures:
             print("  -", f)
         return 1
-    print("PROVEN: (a) console clean (b) backlog rendered (b2) alert-count alarm color "
-          "(b3) alerts-box alarm styling (c) click-expand with prompt (d) SSE live updates (e) expansion survived "
-          "(i) tracker lanes rendered (j) tracker add-item SSE (k) orchestrator status (l) audit banner ASCII "
-          "(m) tracker pr_link javascript: XSS neutralized, https pr_link still clickable "
-          "(n1) header-label contrast #999 (7.5:1 WCAG AA) (n2) priority select chevron affordance "
-          "(n3) empty lane placeholder (n4) prefers-reduced-motion animations disabled "
-          "(n5) tracker sr-only live region (n6) lane-count aria-labels (n7) running-count toned down")
+
+    print("PROVEN: (a) console clean (b) React dist served (c) health-header "
+          "(d) view testids (e) inbox form (f) cost view renders fixture ledger "
+          "(g) stylesheet (h) live regions (i) empty-state pass all views "
+          "(j) SSE tracker update w/o reload (k) tracker form round-trip incl. lane actions "
+          "(l) javascript: pr_link inert (m) keyboard expand survives SSE update "
+          "(n) AA contrast both themes (o) audit badge announced")
     return 0