@molecule/api-ai-tools 1.9.15 → 1.9.18

package/dist/trace-artifacts.js

@@ -27,7 +27,6 @@
  * @module
  */
 import { locatedCommandSegments, statementArgumentEnd } from './command-position.js';
-import { isDiagnosisRun } from './suite-overlap.js';
 import { isPlaywrightRunCommand, redactSecrets } from './utilities.js';
 /** How many traces one read reports, newest first. */
 export const MAX_TRACE_ARTIFACTS = 12;
@@ -84,6 +83,13 @@ const TRACE_NOTE_FAILURE_CHARS = 120;
  * test's trace holds the whole page load. A request with no response and NO error text was aborted
  * or still in flight when the test ended; it is kept too, but as what it is, not as a failure.
  *
+ * A trace.zip holds ONE trace member per browser context the test used (beside the runner's own
+ * `test.trace`), and the archive's member order is not the test's chronology. Each member is read
+ * as its own context: actions and requests keep their context id, requests and frame snapshots
+ * keep the pageId Playwright records, and the failing assertion's page — the page its own step id
+ * ran on — decides which actions, snapshots and requests become the test's row. What the test's
+ * other browser contexts recorded is reported apart, as `otherContexts` (xr-molecule-flash-m160).
+ *
  * A request answered 4xx by the app's OWN API also keeps what the page SENT and the first of what
  * came back: Playwright stores either inline (`text`) or in a resource entry (`_file`), and both
  * are read. That is where a wrapped body shows: xr-molecule-flash-m111's helper passed
@@ -191,6 +197,27 @@ function messageOf(value) {
   return null
 }
 
+// The text a failing assertion waited for, named by its own error: a \`has-text(…)\` CSS
+// pseudo-class, a \`getByText(…)\` locator, or a \`toContainText(…)\` expectation. A strict-mode
+// violation is not this shape — two elements DID match the text — and neither is a wait on a
+// selector with no text argument. The ANSI colouring Playwright leaves in the message is dropped
+// before the read, or the quotes it wraps around a locator would never parse.
+function waitedTextOf(message) {
+  if (!message) return null
+  const text = String(message).replace(/\\u001b\\[[0-9;]*m/g, '')
+  if (text.indexOf('strict mode violation') !== -1) return null
+  const quoted = function (pattern) {
+    const m = pattern.exec(text)
+    return m === null ? null : m[2]
+  }
+  const hasText = quoted(/has-text\\(\\s*(['"])((?:(?!\\1).)*)\\1/)
+  if (hasText !== null) return hasText
+  const byText = quoted(/getByText\\(\\s*(['"])((?:(?!\\1).)*)\\1/)
+  if (byText !== null) return byText
+  if (text.indexOf('toContainText') === -1) return null
+  return quoted(/Expected(?: string)?:\\s*(["'])((?:(?!\\1).)*)\\1/)
+}
+
 // A request/response body exactly as Playwright stored it: inline on the value, or in a resource
 // entry the value names. Bounded, and binary is dropped — a JSON body is what this is for, and a
 // multipart upload would print bytes.
@@ -276,26 +303,69 @@ const found = []
 walk(ROOT, 5, found)
 found.sort(function (a, b) { return b.mtime - a.mtime })
 
+// A trace.zip holds ONE trace member per browser context the test used (1-trace.trace,
+// 3-trace.trace, …) beside the test runner's own test.trace. The archive ORDER of those members
+// is not the test's chronology: xr-molecule-flash-m160's helper context was written after the
+// primary page's, so the concatenation's last user action was the helper's editor click and the
+// last frame snapshot was /editor, while the assertion had failed on the primary page at
+// /profile/:username. Each member is read as its own context, and everything below attributes a
+// request, an action and a frame snapshot to the page and context that recorded it.
+function traceContextOf(name) {
+  if (name === 'test.trace') return 'test'
+  if (name === 'trace.trace') return '0'
+  const m = /^(.+)-trace\\.trace$/.exec(name)
+  return m === null ? null : m[1]
+}
+function networkContextOf(name) {
+  if (name === 'trace.network') return '0'
+  const m = /^(.+)-trace\\.network$/.exec(name)
+  return m === null ? null : m[1]
+}
+
 for (const one of found.slice(0, MAX_TRACES)) {
   let buf
   try { buf = fs.readFileSync(one.file) } catch (e) { continue }
   let entries
   try { entries = zipEntries(buf) } catch (e) { continue }
-  const network = []
-  const trace = []
+  const runner = []
+  const contexts = []
+  const contextById = {}
+  function contextFor(id) {
+    let ctx = contextById[id]
+    if (!ctx) {
+      ctx = { id: id, trace: [], network: [], requests: [], actions: [], frames: [] }
+      contextById[id] = ctx
+      contexts.push(ctx)
+    }
+    return ctx
+  }
   for (const entry of entries) {
-    if (/\\.network$/.test(entry.name)) network.push.apply(network, ndjson(zipData(buf, entry)))
-    else if (/\\.trace$/.test(entry.name)) trace.push.apply(trace, ndjson(zipData(buf, entry)))
+    const traceContext = traceContextOf(entry.name)
+    if (traceContext === 'test') {
+      runner.push.apply(runner, ndjson(zipData(buf, entry)))
+      continue
+    }
+    if (traceContext !== null) {
+      const ctx = contextFor(traceContext)
+      ctx.trace.push.apply(ctx.trace, ndjson(zipData(buf, entry)))
+      continue
+    }
+    const networkContext = networkContextOf(entry.name)
+    if (networkContext !== null) {
+      const ctx = contextFor(networkContext)
+      ctx.network.push.apply(ctx.network, ndjson(zipData(buf, entry)))
+    }
   }
-  const requests = []
-  for (const line of network) {
-    if (!line || line.type !== 'resource-snapshot') continue
-    const snapshot = line.snapshot || {}
-    const request = snapshot.request || {}
-    if (!request.url || !request.method) continue
-    const response = snapshot.response || {}
-    const type = String(snapshot._resourceType || '')
-    if (!origin) origin = type === 'document' ? originOf(String(request.url)) : ''
+  const requestsAll = []
+  for (const ctx of contexts) {
+    for (const line of ctx.network) {
+      if (!line || line.type !== 'resource-snapshot') continue
+      const snapshot = line.snapshot || {}
+      const request = snapshot.request || {}
+      if (!request.url || !request.method) continue
+      const response = snapshot.response || {}
+      const type = String(snapshot._resourceType || '')
+      if (!origin) origin = type === 'document' ? originOf(String(request.url)) : ''
     // What the request carried for CREDENTIALS — never the secret itself. A 401 on the app's own
     // API cannot be read without this: m148's favorite POST answered 401 with no Authorization
     // header at all, so the client never attached the token, and the note sent the run to the
@@ -312,51 +382,215 @@ for (const one of found.slice(0, MAX_TRACES)) {
     const authSpace = authValue.search(/\\s/)
     const authWord = authSpace > 0 ? authValue.slice(0, authSpace) : ''
     const authScheme = /^[A-Za-z][A-Za-z0-9._~+/-]{0,23}$/.test(authWord) ? authWord : undefined
-    const sentCookie = headerList.some(function (h) {
-      return h && typeof h.name === 'string' && /^cookie$/i.test(h.name)
-    })
-    requests.push({
-      method: String(request.method).toUpperCase(),
-      path: String(request.url).slice(0, MAX_URL),
-      status: Number(response.status) || 0,
-      failure: typeof response._failureText === 'string' ? response._failureText : undefined,
-      type: type,
-      sentAuthorization: authHeader !== undefined,
-      authorization: authScheme,
-      sentCookie: sentCookie,
-      // The HAR entry carries the monotonic clock the trace's action entries use, so a request
-      // can be attributed to the action that caused it (see \`lastAction\` below).
-      startedAt: typeof snapshot._monotonicTime === 'number' ? snapshot._monotonicTime : undefined,
-      postData: request.postData,
-      content: response.content,
-    })
+      const sentCookie = headerList.some(function (h) {
+        return h && typeof h.name === 'string' && /^cookie$/i.test(h.name)
+      })
+      const parsed = {
+        method: String(request.method).toUpperCase(),
+        path: String(request.url).slice(0, MAX_URL),
+        status: Number(response.status) || 0,
+        failure: typeof response._failureText === 'string' ? response._failureText : undefined,
+        type: type,
+        sentAuthorization: authHeader !== undefined,
+        authorization: authScheme,
+        sentCookie: sentCookie,
+        // The HAR entry carries the monotonic clock the trace's action entries use, so a request
+        // can be attributed to the action that caused it (see \`lastAction\` below).
+        startedAt: typeof snapshot._monotonicTime === 'number' ? snapshot._monotonicTime : undefined,
+        // The context member and the page ref the HAR entry records: a request made by the test's
+        // helper context is not the failing page's, however late the archive wrote it (m160).
+        context: ctx.id,
+        pageId: typeof snapshot.pageref === 'string' ? snapshot.pageref : undefined,
+        postData: request.postData,
+        content: response.content,
+      }
+      ctx.requests.push(parsed)
+      requestsAll.push(parsed)
+    }
   }
   if (!origin) {
-    const first = requests.find(function (r) { return r.type === 'document' }) || requests[0]
+    const first = requestsAll.find(function (r) { return r.type === 'document' }) || requestsAll[0]
     origin = first ? originOf(first.path) : ''
   }
-  for (const r of requests) r.path = pathOf(r.path).slice(0, MAX_URL)
+  for (const r of requestsAll) r.path = pathOf(r.path).slice(0, MAX_URL)
   // The page's own actions, timed. before/after pair on the call id, and only the LIBRARY
   // traces carry a class and a method (Frame.goto, Locator.fill); the test runner's own
-  // trace times its hooks and fixtures with class Test, which is not a page action. Read BEFORE
-  // the request buckets: whether the navigation itself finished decides whether a subresource
-  // with no response is evidence (see \`navigationOpen\` below).
-  const ended = {}
-  for (const entry of trace) {
-    if (entry && entry.type === 'after' && typeof entry.callId === 'string' && typeof entry.endTime === 'number')
-      ended[entry.callId] = entry.endTime
+  // trace times its hooks and fixtures with class Test, which is not a page action. Each action
+  // keeps the context it came from and the page/frame its frame snapshot names, so the failing
+  // assertion's own page can be selected below (m160).
+  const actionsAll = []
+  const framesAll = []
+  for (const ctx of contexts) {
+    const ended = {}
+    for (const entry of ctx.trace) {
+      if (entry && entry.type === 'after' && typeof entry.callId === 'string' && typeof entry.endTime === 'number')
+        ended[entry.callId] = entry.endTime
+    }
+    const pageByCall = {}
+    for (const entry of ctx.trace) {
+      if (!entry || entry.type !== 'frame-snapshot') continue
+      const snap = entry.snapshot || {}
+      if (typeof snap.callId === 'string' && typeof snap.pageId === 'string' && pageByCall[snap.callId] === undefined)
+        pageByCall[snap.callId] = snap.pageId
+      if (snap.isMainFrame === false) continue
+      if (typeof snap.frameUrl !== 'string' || typeof snap.timestamp !== 'number') continue
+      ctx.frames.push({
+        url: pathOf(snap.frameUrl).slice(0, MAX_URL),
+        at: snap.timestamp,
+        context: ctx.id,
+        pageId: typeof snap.pageId === 'string' ? snap.pageId : undefined,
+        frameId: typeof snap.frameId === 'string' ? snap.frameId : undefined,
+      })
+    }
+    for (const entry of ctx.trace) {
+      if (!entry || entry.type !== 'before') continue
+      if (typeof entry.class !== 'string' || typeof entry.method !== 'string') continue
+      if (entry.class === 'Test' || typeof entry.startTime !== 'number') continue
+      const action = {
+        api: entry.class + '.' + entry.method,
+        start: entry.startTime,
+        end: typeof ended[entry.callId] === 'number' ? ended[entry.callId] : null,
+        context: ctx.id,
+        pageId: typeof entry.callId === 'string' ? pageByCall[entry.callId] : undefined,
+        frameId: undefined,
+        stepId: typeof entry.stepId === 'string' ? entry.stepId : undefined,
+      }
+      if (action.pageId !== undefined) {
+        for (const frame of ctx.frames) {
+          if (frame.pageId !== action.pageId) continue
+          action.frameId = frame.frameId
+          break
+        }
+      }
+      ctx.actions.push(action)
+    }
+    // Monotonic time, not archive order: two contexts interleave in the zip, and one context's
+    // own actions still have to be read in the order the page performed them.
+    ctx.actions.sort(function (a, b) { return a.start - b.start })
+    ctx.frames.sort(function (a, b) { return a.at - b.at })
+    for (const action of ctx.actions) actionsAll.push(action)
+    for (const frame of ctx.frames) framesAll.push(frame)
   }
-  const actions = []
-  for (const entry of trace) {
-    if (!entry || entry.type !== 'before') continue
-    if (typeof entry.class !== 'string' || typeof entry.method !== 'string') continue
-    if (entry.class === 'Test' || typeof entry.startTime !== 'number') continue
-    actions.push({
-      api: entry.class + '.' + entry.method,
-      start: entry.startTime,
-      end: typeof ended[entry.callId] === 'number' ? ended[entry.callId] : null,
-    })
+  // The step the runner itself reports as failed, and the location it names. The runner writes
+  // the error on the failed step's \`after\` entry; taking the LAST step with a spec stack instead
+  // named the afterEach's \`context.close()\` (m160's social.spec.ts:13) rather than the strict-mode
+  // assertion at :90. The first error is the test's own failure — an afterEach that also fails
+  // runs after it.
+  let failedStepId = null
+  let failedStep = null
+  let failedEnd = null
+  let failedError = ''
+  let failureSpec = null
+  let failureLine = 0
+  let lastSpec = null
+  let lastSpecLine = 0
+  for (const entry of runner) {
+    if (!entry) continue
+    if (entry.type === 'after' && entry.error && typeof entry.callId === 'string' && failedStepId === null) {
+      failedStepId = entry.callId
+      failedEnd = typeof entry.endTime === 'number' ? entry.endTime : null
+      failedError = messageOf(entry.error) || ''
+    }
   }
+  // The fallback location — the last step that names a spec — is read from every member, runner
+  // and library alike: a trace written without a test.trace (a synthetic fixture, an older
+  // Playwright) still names its spec on the library entries, and dropping that would leave the
+  // row placeless.
+  for (const traceEntries of [runner].concat(contexts.map(function (ctx) { return ctx.trace }))) {
+    for (const entry of traceEntries) {
+      if (!entry || entry.type !== 'before' || !Array.isArray(entry.stack)) continue
+      for (const frame of entry.stack) {
+        if (typeof frame.file !== 'string' || !/\\.(?:spec|test)\\.[cm]?[jt]sx?$/.test(frame.file)) continue
+        lastSpec = specPathOf(frame.file)
+        lastSpecLine = Number(frame.line) || 0
+        break
+      }
+    }
+  }
+  if (failedStepId !== null) {
+    for (const entry of runner) {
+      if (!entry || entry.type !== 'before' || entry.callId !== failedStepId) continue
+      failedStep = entry
+      if (!Array.isArray(entry.stack)) break
+      for (const frame of entry.stack) {
+        if (typeof frame.file !== 'string' || !/\\.(?:spec|test)\\.[cm]?[jt]sx?$/.test(frame.file)) continue
+        failureSpec = specPathOf(frame.file)
+        failureLine = Number(frame.line) || 0
+        break
+      }
+      break
+    }
+  }
+  const spec = failureSpec !== null ? failureSpec : lastSpec
+  const line = failureSpec !== null ? failureLine : lastSpecLine
+  // The page the failing step ran on. The library trace records the runner's step id on every
+  // action it performed for that step, and each action's frame snapshot carries its pageId — so
+  // the failing assertion's page is the step's own page, never the last page any context left
+  // behind (m160: the helper context's /editor won because its member came later in the zip).
+  let failedPageIds = []
+  if (failedStepId !== null) {
+    for (const action of actionsAll) {
+      if (action.stepId !== failedStepId || action.pageId === undefined) continue
+      if (failedPageIds.indexOf(action.pageId) === -1) failedPageIds.push(action.pageId)
+    }
+    // A step with no library action of its own (a plain \`page.waitForTimeout\`, a runner-only
+    // step) falls back to the actions that ran inside its own interval.
+    if (failedPageIds.length === 0 && failedStep !== null && typeof failedStep.startTime === 'number') {
+      for (const action of actionsAll) {
+        if (action.pageId === undefined) continue
+        if (action.start < failedStep.startTime - 1) continue
+        if (failedEnd !== null && action.start > failedEnd + 1) continue
+        if (failedPageIds.indexOf(action.pageId) === -1) failedPageIds.push(action.pageId)
+      }
+    }
+  }
+  let failedPage = failedPageIds.length === 1 ? failedPageIds[0] : null
+  // A member with no action, request or frame is not a context the test used: Playwright writes
+  // a trace entry for a context it opened and closed without a page, and counting that as a
+  // second context would make every ordinary trace unattributable.
+  const usedContexts = contexts.filter(function (ctx) {
+    return ctx.actions.length > 0 || ctx.requests.length > 0 || ctx.frames.length > 0
+  })
+  // One context, one page: nothing to attribute, and no second context to merge.
+  if (failedPage === null && usedContexts.length === 1) {
+    const pages = []
+    for (const frame of framesAll) {
+      if (frame.pageId !== undefined && pages.indexOf(frame.pageId) === -1) pages.push(frame.pageId)
+    }
+    if (pages.length === 1) failedPage = pages[0]
+  }
+  let failedContext = null
+  if (failedPage !== null) {
+    for (const frame of framesAll) {
+      if (frame.pageId !== failedPage) continue
+      failedContext = frame.context
+      break
+    }
+    if (failedContext === null) {
+      for (const action of actionsAll) {
+        if (action.pageId !== failedPage) continue
+        failedContext = action.context
+        break
+      }
+    }
+    if (failedContext === null) {
+      for (const r of requestsAll) {
+        if (r.pageId !== failedPage) continue
+        failedContext = r.context
+        break
+      }
+    }
+  }
+  // Two used contexts and no identified page: the note makes no causal claim rather than
+  // merging them (m160's rule). With one used context everything in it belongs to the test's page.
+  const unattributed = failedPage === null && usedContexts.length > 1
+  const actions = failedPage === null ? actionsAll : actionsAll.filter(function (a) { return a.pageId === failedPage })
+  const frames = failedPage === null ? (usedContexts.length === 1 ? framesAll : []) : framesAll.filter(function (f) { return f.pageId === failedPage })
+  let requests = failedPage === null ? requestsAll : requestsAll.filter(function (r) { return r.pageId === failedPage })
+  // A trace whose HAR entries carry no page ref: the failing context's own requests are still
+  // its page's, because a context in a test with one page has nowhere else to send them.
+  if (failedPage !== null && requests.length === 0 && failedContext !== null)
+    requests = requestsAll.filter(function (r) { return r.context === failedContext })
   // A \`page.goto\` that has no end time: the page never finished loading. When that is the
   // failure, a document subresource with no response is the reason — the navigation waits for
   // its stylesheets and scripts — and it is evidence, not the aborted noise a finished
@@ -446,7 +680,9 @@ for (const one of found.slice(0, MAX_TRACES)) {
   // then rendering signed-out) leads instead of the Home page's own fetch.
   const USER_ACTION = /\\.(?:click|dblclick|tap|fill|press|pressSequentially|selectOption|check|uncheck|setInputFiles|goto|type)$/
   const userActions = actions.filter(function (a) { return USER_ACTION.test(a.api) })
-  const lastAction = userActions.length > 0 ? userActions[userActions.length - 1] : null
+  // With two contexts and no identified page there is no causal claim to make: the last action
+  // of the concatenation could belong to the helper's page (m160).
+  const lastAction = unattributed || userActions.length === 0 ? null : userActions[userActions.length - 1]
   // A request the action caused started after it (a millisecond of clock slack) and before the
   // assertion — which is everything later in the trace. A request that started before it is the
   // page's own load, not the action's; the page shell's files are never the step's, except a
@@ -496,6 +732,26 @@ for (const one of found.slice(0, MAX_TRACES)) {
     if (sent) r.sent = sent
     if (got) r.got = got
   }
+  // The text the failing assertion waited for, and a response the SAME page received that carried
+  // it (m169). The assertion's own error names the text; the network log says whether it ever
+  // reached the browser. Only an answered fetch/xhr can say the API returned it — a 4xx body is an
+  // error message, not data. The most focused response wins (smallest body): an articles list also
+  // carries tag names in its \`tagList\`, while the tags response is the collection whose membership
+  // the assertion tests.
+  const waitedText = waitedTextOf(failedError)
+  let missingText = null
+  if (waitedText !== null && !unattributed) {
+    let best = null
+    for (const r of requests) {
+      if (r.type !== 'fetch' && r.type !== 'xhr') continue
+      if (r.status < 200 || r.status >= 400) continue
+      const got = gotText(buf, entries, r)
+      if (!got || got.indexOf(waitedText) === -1) continue
+      if (best === null || got.length < best.got.length) best = { request: r, got: got }
+    }
+    if (best !== null)
+      missingText = { text: waitedText, method: best.request.method, path: best.request.path }
+  }
   function wire(r) {
     return {
       method: r.method,
@@ -511,19 +767,13 @@ for (const one of found.slice(0, MAX_TRACES)) {
       ...(r.sentAuthorization ? { sentAuthorization: true } : {}),
       ...(r.authorization ? { authorization: r.authorization } : {}),
       ...(r.sentCookie ? { sentCookie: true } : {}),
+      ...(r.context ? { context: r.context } : {}),
+      ...(r.pageId ? { pageId: r.pageId } : {}),
     }
   }
-  // The main frame's URL, timed: what the page showed when the action ran, and where it ended up.
-  // The trace records these around every action, which is how the note can say what the page did
-  // after the request — a client-side redirect never appears in the network log as a document.
-  const frames = []
-  for (const entry of trace) {
-    if (!entry || entry.type !== 'frame-snapshot') continue
-    const snap = entry.snapshot || {}
-    if (snap.isMainFrame === false) continue
-    if (typeof snap.frameUrl !== 'string' || typeof snap.timestamp !== 'number') continue
-    frames.push({ url: pathOf(snap.frameUrl).slice(0, MAX_URL), at: snap.timestamp })
-  }
+  // The failing page's own frame snapshots, timed: what the page showed when the action ran, and
+  // where it ended up. They are the snapshots of the assertion's page only — another context's
+  // editor page is not where this page went (m160) — and they are ordered by the trace's clock.
   let last = null
   if (lastAction !== null) {
     let pageBefore
@@ -547,8 +797,9 @@ for (const one of found.slice(0, MAX_TRACES)) {
   }
   // The fallback lead stays for traces with no action clock. With an action, only a request it
   // caused is the lead; an action that sent none leaves the page's own load to the row's
-  // "also answered" bucket, not to a lead that would hide it.
-  if (lead === null && lastAction === null) {
+  // "also answered" bucket, not to a lead that would hide it. With two contexts and no identified
+  // page there is no causal lead at all (m160).
+  if (!unattributed && lead === null && lastAction === null) {
     let leadIndex = -1
     for (let i = requests.length - 1; i >= 0; i--) {
       const r = requests[i]
@@ -608,26 +859,51 @@ for (const one of found.slice(0, MAX_TRACES)) {
   const consoleErrors = []
   const consoleSignals = []
   const consoleWarnings = []
-  let spec = null
-  let line = 0
-  for (const entry of trace) {
-    if (!entry) continue
-    if (entry.type === 'console' && typeof entry.text === 'string') {
-      if (entry.messageType === 'error') consoleErrors.push(entry.text)
-      else if (consoleSignal(entry.text)) consoleSignals.push(entry.text)
-      else if (entry.messageType === 'warning' || entry.messageType === 'warn')
-        consoleWarnings.push(entry.text)
-    } else if (entry.type === 'event' && entry.method === 'pageError') {
-      const message = messageOf(entry.params)
-      if (message) consoleErrors.push(message)
-    } else if (entry.type === 'before' && Array.isArray(entry.stack) && entry.stack.length) {
-      const frame = entry.stack[0] || {}
-      if (typeof frame.file === 'string' && /\\.(?:spec|test)\\.[cm]?[jt]sx?$/.test(frame.file)) {
-        spec = specPathOf(frame.file)
-        line = Number(frame.line) || 0
+  // The console lines of the page the assertion ran on; with no identified page, of every context.
+  const consoleTraces =
+    failedContext === null
+      ? contexts.map(function (ctx) { return ctx.trace })
+      : contexts.filter(function (ctx) { return ctx.id === failedContext }).map(function (ctx) { return ctx.trace })
+  for (const traceEntries of consoleTraces) {
+    for (const entry of traceEntries) {
+      if (!entry) continue
+      if (entry.type === 'console' && typeof entry.text === 'string') {
+        if (entry.messageType === 'error') consoleErrors.push(entry.text)
+        else if (consoleSignal(entry.text)) consoleSignals.push(entry.text)
+        else if (entry.messageType === 'warning' || entry.messageType === 'warn')
+          consoleWarnings.push(entry.text)
+      } else if (entry.type === 'event' && entry.method === 'pageError') {
+        const message = messageOf(entry.params)
+        if (message) consoleErrors.push(message)
       }
     }
   }
+  // Evidence from the OTHER browser contexts the test opened — kept apart from the failing page's
+  // requests and labelled as set-up work, never as the failing action's effect (m160).
+  const otherContexts = []
+  if (failedContext !== null) {
+    for (const ctx of usedContexts) {
+      if (ctx.id === failedContext) continue
+      const picked = []
+      for (const r of ctx.requests) {
+        if (shellRequest(r)) continue
+        const sent = bodyText(buf, entries, r.postData, MAX_BODY)
+        const got = gotText(buf, entries, r)
+        if (sent) r.sent = sent
+        if (got) r.got = got
+        picked.push(r)
+      }
+      if (picked.length === 0 && ctx.actions.length === 0) continue
+      // Failures first, then by the trace's clock: a 401 from the helper context is worth naming
+      // even when its later answered calls would fill the bound.
+      picked.sort(function (a, b) {
+        const left = failedRequest(a) ? 0 : 1
+        const right = failedRequest(b) ? 0 : 1
+        return left === right ? (a.startedAt || 0) - (b.startedAt || 0) : left - right
+      })
+      otherContexts.push({ context: ctx.id, requests: picked.slice(0, MAX_NOTE).map(wire) })
+    }
+  }
   // Chromium reports every failed request as a console error too; where the page logged something
   // of its own about it, that is the line worth reading. Errors lead, then the lines that name a
   // session decision or come from a molecule package (m148), then any other warning — the browser's
@@ -647,8 +923,11 @@ for (const one of found.slice(0, MAX_TRACES)) {
     // tail here dropped every failed request as soon as a page made more than MAX_REQUESTS of them
     // plus the answered ones (xr-molecule-flash-m112's note listed only -1s and 200s).
     requests: chosen.slice(0, MAX_REQUESTS),
+    ...(missingText === null ? {} : { missingText: missingText }),
     console: keptConsole.slice(0, MAX_CONSOLE).map(function (text) { return text.slice(0, 300) }),
     actions: actions.slice(-MAX_ACTIONS),
+    ...(unattributed ? { unattributed: true } : {}),
+    ...(otherContexts.length > 0 ? { otherContexts: otherContexts } : {}),
   }) + '\\n')
 }
 `;
@@ -677,8 +956,28 @@ function parseTraceRequest(value) {
             ? { authorization: r.authorization }
             : {}),
         ...(r.sentCookie === true ? { sentCookie: true } : {}),
+        ...(typeof r.context === 'string' && r.context ? { context: r.context } : {}),
+        ...(typeof r.pageId === 'string' && r.pageId ? { pageId: r.pageId } : {}),
     };
 }
+/**
+ * One `missingText` out of a `TRACE` line's json, or null when the value is not one.
+ *
+ * @param value - The line's `missingText`.
+ * @returns The awaited text and the response that carried it, or null.
+ */
+function parseMissingText(value) {
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const raw = value;
+    if (typeof raw.text !== 'string' || raw.text === '')
+        return null;
+    if (typeof raw.method !== 'string' || raw.method === '')
+        return null;
+    if (typeof raw.path !== 'string' || raw.path === '')
+        return null;
+    return { text: raw.text, method: raw.method, path: raw.path };
+}
 /**
  * One `lastAction` out of a `TRACE` line's json, or null when the value is not one.
  *
@@ -724,6 +1023,18 @@ export function parseTraceArtifacts(stdout) {
             const actions = Array.isArray(raw.actions) ? raw.actions : [];
             const lead = parseTraceRequest(raw.lead);
             const lastAction = parseLastAction(raw.lastAction);
+            const missingText = parseMissingText(raw.missingText);
+            const otherContexts = Array.isArray(raw.otherContexts)
+                ? raw.otherContexts
+                    .filter((c) => typeof c === 'object' && c !== null)
+                    .filter((c) => typeof c.context === 'string')
+                    .map((c) => ({
+                    context: String(c.context),
+                    requests: (Array.isArray(c.requests) ? c.requests : [])
+                        .map(parseTraceRequest)
+                        .filter((request) => request !== null),
+                }))
+                : [];
             out.push({
                 spec: typeof raw.spec === 'string' ? raw.spec : null,
                 line: typeof raw.line === 'number' ? raw.line : 0,
@@ -740,7 +1051,13 @@ export function parseTraceArtifacts(stdout) {
                     api: String(a.api),
                     start: Number(a.start),
                     end: a.end === null || a.end === undefined ? null : Number(a.end),
+                    ...(typeof a.context === 'string' ? { context: a.context } : {}),
+                    ...(typeof a.pageId === 'string' ? { pageId: a.pageId } : {}),
+                    ...(typeof a.frameId === 'string' ? { frameId: a.frameId } : {}),
                 })),
+                ...(otherContexts.length === 0 ? {} : { otherContexts }),
+                ...(raw.unattributed === true ? { unattributed: true } : {}),
+                ...(missingText === null ? {} : { missingText }),
             });
         }
         catch (_error) {
@@ -1062,6 +1379,36 @@ function runFailureOf(item, failures) {
     }
     return undefined;
 }
+/**
+ * Where the row names this failing test.
+ *
+ * The trace names the line of the step it recorded — the failing assertion when the runner wrote
+ * its error on that step, and the suite's `afterEach` (`context.close()`) when it did not. The
+ * runner's own summary names the test's DECLARATION line, and that is the location the result
+ * quotes and the line a re-run command takes, so it wins whenever the run reported one for this
+ * file: matched by the trace's own line inside the test body ({@link runFailureOf}), and otherwise
+ * by the file alone when that file has exactly ONE reported failure — an `afterEach` line sits
+ * BEFORE the declaration, so the line window cannot match it (xr-molecule-flash-m163's row said
+ * `navigation.spec.ts:12`, the suite's `afterEach`, for the test declared at `:200`).
+ *
+ * @param item - One traced failure.
+ * @param failures - The runner's report, one entry per failing test.
+ * @returns The `file:line` the row names.
+ */
+function failureWhereOf(item, failures) {
+    const spec = item.spec;
+    if (spec === null)
+        return whereOf(item);
+    let reported = runFailureOf(item, failures);
+    if (reported === undefined) {
+        const sameFile = failures.filter((failure) => sameLocationFile(spec, failure.spec));
+        if (sameFile.length === 1)
+            reported = sameFile[0];
+    }
+    if (reported === undefined)
+        return whereOf(item);
+    return reported.line > 0 ? `${reported.spec}:${reported.line}` : reported.spec;
+}
 /**
  * Whether a pending request's interval covers a navigation's wait: it started while the
  * navigation was loading (at or after the wait began) and it has no recorded response, so it was
@@ -1216,6 +1563,68 @@ function sameOriginPath(request) {
         return null;
     return raw.replace(/\/+$/, '');
 }
+/**
+ * The path segments a request ASKS FOR a credential through — a login, a registration, a token
+ * endpoint — as opposed to a protected resource that presents one.
+ */
+const CREDENTIAL_EXCHANGE_PATH = /(?:^|\/)(?:login|log-in|signin|sign-in|register|signup|sign-up|token)(?:\/|$)/i;
+/** The field a credential payload carries: a password, a grant, or a refresh token. */
+const CREDENTIAL_FIELD = /"(?:password|credentials|grant_type|refresh_token)"\s*:/i;
+/** The field that pairs with a password in a login/registration body. */
+const CREDENTIAL_IDENTITY = /"(?:email|username)"\s*:/i;
+/**
+ * Whether a request's recorded body is a credential payload — the shape a login, a registration
+ * or a token exchange sends, never a protected write (an article, a comment, a profile).
+ *
+ * @param sent - What the request sent, as the trace recorded it (bounded).
+ * @returns True for a body carrying credentials.
+ */
+function credentialExchangeBody(sent) {
+    if (!sent)
+        return false;
+    const text = sent.slice(0, MAX_TRACED_BODY_CHARS);
+    // A password alone is a profile write as often as a login; the exchange is a password beside
+    // an identity, or a token grant.
+    if (!CREDENTIAL_FIELD.test(text))
+        return false;
+    return (CREDENTIAL_IDENTITY.test(text) || /"(?:credentials|grant_type|refresh_token)"\s*:/i.test(text));
+}
+/**
+ * Whether a refused request is a CREDENTIAL EXCHANGE: the app was asked to mint a token (a login,
+ * a registration, a token endpoint), so it never needed one attached.
+ *
+ * Three readings, weakest last: the app's own auth config names the endpoint (a project may mount
+ * `/session` or `/auth/signin`), the path's own last segments name it (`/users/login`), or the
+ * body is a credential payload (`{"user":{"email":…,"password":…}}` sends a registration).
+ *
+ * xr-molecule-flash-m165 (+10:22): `POST /api/users/login → 401
+ * {"errors":{"credentials":["invalid"]}}` was answered with the missing-token sentence — "the
+ * client did not attach the token … The API handler is not the problem" — for a request whose
+ * whole purpose is to obtain a token. The model read helpers and configs for 40 minutes instead of
+ * the real cause: the suite's setup had seeded `https://api.realworld.show`, not this app.
+ *
+ * @param request - The refused request (401/403).
+ * @param authEndpoints - The endpoints the app's auth config names (`/users/login`).
+ * @returns True when the request is a credential exchange.
+ */
+function isCredentialExchange(request, authEndpoints) {
+    if (request.method !== 'POST')
+        return false;
+    const path = sameOriginPath(request);
+    if (path === null)
+        return false;
+    // The app's own config names it: matched as a path suffix, because an auth config writes the
+    // endpoint relative to its API base (`/users/login`) while the trace records the mounted path
+    // (`/api/users/login`).
+    if (authEndpoints.some((endpoint) => {
+        const named = `/${String(endpoint).replace(/^\/+|\/+$/g, '')}`;
+        return named.length > 1 && (path === named || path.endsWith(named));
+    }))
+        return true;
+    if (CREDENTIAL_EXCHANGE_PATH.test(path))
+        return true;
+    return credentialExchangeBody(request.sent);
+}
 /**
  * The sentence a 401/403 on the app's own API gets: which half of the wire refused the request.
  *
@@ -1237,6 +1646,15 @@ function sameOriginPath(request) {
  * sent through. When the trace carries that line, the no-header sentence names the ordering fix
  * instead of leaving the run to re-derive it.
  *
+ * xr-molecule-flash-m165 (+10:22): a `POST /api/users/login → 401
+ * {"errors":{"credentials":["invalid"]}}` is a CREDENTIAL EXCHANGE — the request is how a token is
+ * obtained, so an absent `Authorization` header is the request being what it is, not a client bug.
+ * The note said "the client did not attach the token … The API handler is not the problem" and the
+ * run went looking through the app instead of at the credentials or the setup's API origin. The
+ * exchange branch names the credentials, the account's origin, and the response body; the
+ * categorical handler sentence is gone from the no-header branch too, because a route that
+ * requires a token where the app allows anonymous access is the handler's own mistake.
+ *
  * The trace cannot name the file that made the call: a real HAR entry carries the request, response,
  * `_resourceType`, `_monotonicTime` and a frame ref, but no initiator stack. So the sentence names
  * the shared client and the auth bond instead of guessing a file.
@@ -1244,14 +1662,30 @@ function sameOriginPath(request) {
  * @param request - The refused request, a 401 or 403 on the app's own origin.
  * @param unbondedClient - Whether the traced page logged `no client is bonded`, which explains a
  *   request that carried no `Authorization` header.
+ * @param authEndpoints - The endpoints the app's auth config names, so a credential exchange is
+ *   recognised even under a path the segment list does not.
  * @returns The sentence the note appends.
  */
-function authRefusalSentence(request, unbondedClient = false) {
+function authRefusalSentence(request, unbondedClient = false, authEndpoints = []) {
     const label = requestLabel(request);
     // The header's scheme, when it parsed; presence alone is still the server's half of the wire.
     const carried = request.authorization !== undefined
         ? `with \`Authorization: ${request.authorization} …\``
         : 'with an `Authorization` header';
+    // A credential exchange asks the app to MINT a token: no token is expected to be attached, so a
+    // refusal here is about the credentials themselves — never the client's omission (m165).
+    if (isCredentialExchange(request, authEndpoints)) {
+        const got = request.got
+            ? ` got ${bodyLine(redactSecrets(request.got), TRACE_NOTE_GOT_CHARS)}`
+            : '';
+        return (`The browser sent \`${label}\`${got} and the API answered ${request.status} — this is a ` +
+            'credential exchange (a login/registration/token endpoint), so the client is not expected ' +
+            'to attach a token: the credentials were rejected. Check that the account the test logs in ' +
+            'with was created on THIS app — the same database and origin this run drives; a user seeded ' +
+            'somewhere else is unknown here — and read the response body’s `errors` (a login answers 401 ' +
+            '`{"errors":{"credentials":["invalid"]}}` for a wrong email/password or a user that does not ' +
+            'exist here).');
+    }
     // The console line names the mechanism the no-header branch otherwise has to guess at:
     // `getClient()` ran before `setupHttpDefault()` and the token was mirrored into the
     // client that later setup replaced (xr-molecule-flash-m156).
@@ -1289,21 +1723,23 @@ function authRefusalSentence(request, unbondedClient = false) {
             ? 'The request did carry a `Cookie` header, so if this app signs in with a session cookie ' +
                 'that is the credential the server did not accept. '
             : '') +
-        'The API handler is not the problem.' +
         unbonded);
 }
 /**
  * The note's credential-refusal advice, one sentence per distinct shape — at most two.
  *
- * The shapes are `(status, Authorization scheme, cookie present)`: m148's ten walks repeated one
- * shape (`401`, no header) on every failing test, and repeating its sentence per row would bury
- * the fact rather than state it.
+ * The shapes are `(status, Authorization scheme, cookie present, credential exchange)`: m148's ten
+ * walks repeated one shape (`401`, no header) on every failing test, and repeating its sentence per
+ * row would bury the fact rather than state it. A login and a protected request that both carry no
+ * header are DIFFERENT shapes — one is the credentials being checked, the other is a token that was
+ * never attached (m165).
  *
  * @param items - The traces the note is about.
+ * @param authEndpoints - The endpoints the app's auth config names.
  * @returns The sentences to append (each led by a space), or '' when no same-origin 401/403 was
  *   traced.
  */
-function authRefusalAdvice(items) {
+function authRefusalAdvice(items, authEndpoints = []) {
     const sentences = [];
     const seen = new Set();
     // A page that logged `no client is bonded` explains every request it sent without a
@@ -1320,11 +1756,12 @@ function authRefusalAdvice(items) {
             // ignores it and clears the session, and the page owes the navigation (m156).
             if (isLogoutRequest(request))
                 continue;
-            const key = `${request.status} ${request.sentAuthorization ? (request.authorization ?? 'header') : 'none'} ${request.sentCookie ? 'cookie' : ''}`;
+            const exchange = isCredentialExchange(request, authEndpoints);
+            const key = `${request.status} ${exchange ? 'exchange' : request.sentAuthorization ? (request.authorization ?? 'header') : 'none'} ${request.sentCookie ? 'cookie' : ''}`;
             if (seen.has(key))
                 continue;
             seen.add(key);
-            sentences.push(authRefusalSentence(request, unbondedClient));
+            sentences.push(authRefusalSentence(request, unbondedClient, authEndpoints));
             if (sentences.length === 2)
                 return ` ${sentences.join(' ')}`;
         }
@@ -1390,6 +1827,117 @@ function tracedApiPrefixes(items) {
     }
     return [...prefixes].sort();
 }
+/**
+ * Every API path prefix the traces support: the one the app's client config names and the ones the
+ * traces' own same-origin requests show ({@link tracedApiPrefixes}).
+ *
+ * @param items - The traces the note is about.
+ * @param apiPrefixes - Prefixes the app's client config names (`['/api']`), never a literal.
+ * @returns The one-segment prefixes, without duplicates.
+ */
+function knownApiPrefixes(items, apiPrefixes) {
+    const prefixes = new Set([...apiPrefixes, ...tracedApiPrefixes(items)]
+        .map((prefix) => `/${String(prefix).replace(/^\/+|\/+$/g, '')}`)
+        .filter((prefix) => prefix !== '/'));
+    return [...prefixes];
+}
+/** A URL written in full (`https://api.realworld.show/api/articles`). */
+const ABSOLUTE_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
+/**
+ * The API requests a trace made to an origin other than the page's own — set-up traffic that ran
+ * against someone else's server.
+ *
+ * The trace reader relativises every request whose origin is the page's (`pathOf`), so a request
+ * recorded with an absolute URL went to ANOTHER origin by construction. It counts as set-up/API
+ * traffic when its path carries a prefix the app's own API is known to use ({@link
+ * knownApiPrefixes}) — a CDN font or a third-party script has no `/api` under it, and with no
+ * known prefix nothing is claimed.
+ *
+ * xr-molecule-flash-m165 (+10:22): the suite's helper defaulted `API_BASE` to
+ * `https://api.realworld.show/api` and its set-up seeded rows there, while the browser drove this
+ * app — whose own `/api` answers a login for none of those users. The trace's absolute-URL rows
+ * were the evidence, and the note said nothing about them.
+ *
+ * @param items - The traces the note is about.
+ * @param apiPrefixes - Prefixes the app's client config names (`['/api']`).
+ * @returns One entry per distinct (origin, prefix), in trace order.
+ */
+function foreignOriginApiRequests(items, apiPrefixes) {
+    const prefixes = knownApiPrefixes(items, apiPrefixes);
+    if (prefixes.length === 0)
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const item of items) {
+        for (const request of item.requests) {
+            const raw = String(request.path ?? '');
+            if (!ABSOLUTE_URL.test(raw))
+                continue;
+            let parsed;
+            try {
+                parsed = new URL(raw);
+            }
+            catch (_error) {
+                // Not a URL this can parse: it is not evidence of another origin.
+                continue;
+            }
+            const prefix = prefixes.find((one) => parsed.pathname === one || parsed.pathname.startsWith(`${one}/`));
+            if (prefix === undefined)
+                continue;
+            const key = `${parsed.origin}${prefix}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({ origin: parsed.origin, prefix, request });
+        }
+    }
+    return out;
+}
+/**
+ * The origin a run's target names, when it names one: a URL (`http://localhost:4173`), or the
+ * deployed host the note prints (`loopcheck-….apps.mlcl.dev`). Null for the note's descriptive
+ * targets ("the deployed app", "the local app").
+ *
+ * @param target - Where the run went, as {@link failureTraceNote} names it.
+ * @returns The origin, or null.
+ */
+function appOriginOfTarget(target) {
+    const text = target.trim();
+    try {
+        if (ABSOLUTE_URL.test(text))
+            return new URL(text).origin;
+        if (/^[a-z0-9.-]+(?::\d+)?$/i.test(text))
+            return new URL(`https://${text}`).origin;
+    }
+    catch (_error) {
+        // A target that is not a URL names no origin.
+    }
+    return null;
+}
+/**
+ * The sentence naming the foreign origin a run's set-up traffic went to, and the setting that
+ * points it at this app instead.
+ *
+ * It leads the note because it is the cheapest possible wrong result: every row the suite creates
+ * lands in a database this app never reads, so the failure says nothing about the app's code.
+ * xr-molecule-flash-m165 spent the walk after its failed login reading helpers and configs for a
+ * missing token, when the command's `BASE_URL`/`API_BASE` disagreement was the cause.
+ *
+ * @param found - The foreign-origin request the trace holds.
+ * @param target - Where the run went, for the app's own origin when the note knows it.
+ * @returns The sentence, led by nothing and closed by a blank line.
+ */
+function foreignOriginSentence(found, target) {
+    const appOrigin = appOriginOfTarget(target);
+    const where = appOrigin ?? 'this app’s origin';
+    const apiBase = `${appOrigin ?? '<this app’s origin>'}${found.prefix}`;
+    return (`The suite’s setup ran against ${found.origin}, not this app ` +
+        `(\`${requestLabel(found.request)}\`) — its set-up/API traffic went to another origin while ` +
+        `this app serves its own API at \`${found.prefix}\` on ${where}. Set ` +
+        `\`API_BASE=${apiBase}\` on the run — the supplied suite reads it (verify the variable name ` +
+        `in the suite’s own helpers before writing it) — so the rows it creates are in the database ` +
+        `this app reads.\n\n`);
+}
 /**
  * The failed 404s whose path carries none of the known API prefixes.
  *
@@ -1403,12 +1951,9 @@ function tracedApiPrefixes(items) {
  * @returns One entry per distinct failed 404, in trace order.
  */
 function missingApiPrefixRequests(items, apiPrefixes) {
-    const prefixes = new Set([...apiPrefixes, ...tracedApiPrefixes(items)]
-        .map((prefix) => `/${String(prefix).replace(/^\/+|\/+$/g, '')}`)
-        .filter((prefix) => prefix !== '/'));
-    if (prefixes.size === 0)
+    const known = knownApiPrefixes(items, apiPrefixes);
+    if (known.length === 0)
         return [];
-    const known = [...prefixes];
     const out = [];
     const seen = new Set();
     for (const item of items) {
@@ -1442,6 +1987,22 @@ function missingApiPrefixSentence(request) {
         `without the \`${request.prefix}\` prefix — the HTTP client's base URL is not set: is ` +
         '`setupProviders()` (which runs the HTTP bond setup) called in `main.tsx`?');
 }
+/**
+ * The sentence for a failing assertion whose awaited text a same-page API response carried.
+ *
+ * It names the response and the fact the trace proves — the value reached the browser and the page
+ * did not render it — and stops there. Which cut drops it (a slice, a filter, a limit) is in the
+ * component that maps the response, and the note cannot see that component; naming the mapping
+ * step is the whole instruction (xr-molecule-flash-m169).
+ *
+ * @param missing - The awaited text and the response that carried it.
+ * @returns The sentence the note leads with.
+ */
+function missingTextSentence(missing) {
+    return (`The API returned "${missing.text}" (in ${missing.method} ${missing.path}), but the page did ` +
+        `not render it — the page drops it before rendering (a slice/filter/limit in the component ` +
+        `that renders that list); find where that response is mapped.`);
+}
 /**
  * The note a failed suite run's result carries: what each failing test's page actually sent, and
  * what came back.
@@ -1473,6 +2034,14 @@ function missingApiPrefixSentence(request) {
  * (answered 201, the page still rendering signed-out) never appeared. With no action clock, the
  * row falls back to {@link TraceArtifact.lead}: the page's last answered fetch/xhr.
  *
+ * The action, the URL and the requests are the FAILING ASSERTION'S PAGE's ({@link
+ * TraceArtifact.lastAction}), never the archive's last context: a test that creates its data in a
+ * second browser context writes that context's click and `/editor` snapshot into the same zip, and
+ * reading the concatenation made them the failing page (xr-molecule-flash-m160). The other
+ * contexts' requests are named separately as set-up work. When the trace holds more than one used
+ * context and the assertion's page cannot be identified, the note lists the requests and makes NO
+ * causal claim — no "the test's last action", no "the page stayed at …" — instead of merging them.
+ *
  * WHICH rows it spends is evidence, not artifact order (xr-molecule-flash-m112 +53:46): a row
  * needs a recorded response, a real failure or a console line ({@link traceRowEvidence}), rows are
  * deduplicated by the test's location, and they are ordered real failure → repeated from an
@@ -1511,6 +2080,13 @@ function missingApiPrefixSentence(request) {
  * xr-molecule-flash-m148 (+29:18) hit this exactly: six local walks read
  * `POST …/favorite → 401 {"errors":{"token":["is missing"]}}` as a handler bug.
  *
+ * A credential EXCHANGE (a login/registration/token endpoint, read from the app's auth config, the
+ * path or the body) is never that shape: the request's purpose is to obtain a token, so an absent
+ * header is not a client omission ({@link isCredentialExchange}). xr-molecule-flash-m165's login
+ * 401 was answered as one for 40 minutes; the trace also showed the suite's SET-UP traffic going
+ * to `https://api.realworld.show/api` instead of this app, which is what the note leads with
+ * ({@link foreignOriginApiRequests}).
+ *
  * @param items - The traces {@link parseTraceArtifacts} read.
  * @param target - Where the run went — the deployed host, as the note names it.
  * @param earlierFailures - The failing `file:line`s earlier walks of this suite left, so a repeat
@@ -1527,6 +2103,7 @@ function missingApiPrefixSentence(request) {
  *   error.
  */
 export function failureTraceNote(items, target, earlierFailures = [], apiPrefixes = [], report = {}) {
+    const failures = report.failures ?? [];
     const candidates = items.filter((item) => traceRowEvidence(item, report));
     if (candidates.length === 0)
         return null;
@@ -1539,7 +2116,7 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
     const seen = new Set();
     for (const { item, index } of ranked) {
         // A trace that names no spec cannot be placed; it is never collapsed onto another one.
-        const where = item.spec === null ? `#${index}` : whereOf(item);
+        const where = item.spec === null ? `#${index}` : failureWhereOf(item, failures);
         if (seen.has(where))
             continue;
         seen.add(where);
@@ -1577,7 +2154,12 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
     // Every recorded failure is the logout endpoint answering 4xx: the row's own sentence explains
     // it, and neither the handler lead nor the credential reading applies (m156 +24:02).
     const onlyLogoutFailures = failedRequests.length > 0 && failedRequests.every((request) => isLogoutRequest(request));
-    const authAdvice = authRefusalAdvice(traced);
+    const authAdvice = authRefusalAdvice(traced, report.authEndpoints ?? []);
+    // Set-up traffic the trace shows going to an origin other than the app's (m165): the rows it
+    // creates are not in this app's database, so the note says it before any app-side reading.
+    const foreignOrigins = foreignOriginApiRequests(traced, apiPrefixes);
+    const [firstForeign] = foreignOrigins;
+    const setupOriginLead = firstForeign === undefined ? '' : foreignOriginSentence(firstForeign, target);
     // The stalled-navigation reading, per traced test: non-null only when the RUNNER says this
     // test's failing operation is a navigation and a document subresource still pending at the end
     // started inside that wait ({@link stalledNavigation}).
@@ -1593,6 +2175,9 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
     ];
     const anyStalled = stalls.some((stall) => stall !== null);
     const rows = [];
+    // Rows whose failing action sent nothing and left the page on a new route: the page is still
+    // showing the previous route's data. Counted so the note can say it once for the whole run.
+    let staleRouteRows = 0;
     for (const [index, item] of traced.entries()) {
         // The test's LAST action before the failing assertion leads the row (m148): the requests it
         // caused and what came back explain a page that never showed the signed-in state, while the
@@ -1630,7 +2215,26 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
         const parts = [];
         if (step !== undefined && !stalledNav) {
             const head = `the test's last action was ${step.api} at ${actionClock(item, step.start)}`;
-            if (stepRequests.length === 0) {
+            const pageBefore = step.pageBefore;
+            const pageAfter = step.pageAfter;
+            // The action asked the API for nothing and the page ended up on another route: the page is
+            // still showing the data it fetched for the route before, which is why the new route's list
+            // is wrong (xr-molecule-flash-m163 +10:00 — the note printed "it sent no request" beside
+            // "the page then navigated to …", then pointed at a response body that never existed, and
+            // the run spent six minutes on markup and CSS).
+            const staleRoute = stepRequests.length === 0 &&
+                pageBefore !== undefined &&
+                pageAfter !== undefined &&
+                pageBefore !== pageAfter;
+            if (staleRoute) {
+                staleRouteRows += 1;
+                parts.push(`${head}, and it sent no request — the page moved from ${pageBefore} to ${pageAfter}. ` +
+                    `The page changed route but fetched nothing new, so it is still showing the previous ` +
+                    `route's data: check how the page reads the route (a param the route does not define ` +
+                    `is always undefined; a missing effect dependency on the route means the fetch never ` +
+                    `re-runs), not the markup or the CSS`);
+            }
+            else if (stepRequests.length === 0) {
                 parts.push(`${head}, and it sent no request`);
             }
             else {
@@ -1642,10 +2246,10 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
             }
             // What the page did next: a navigation shows in the main frame's URL even when the app moved
             // client-side and the network log recorded no document request.
-            if (step.pageAfter !== undefined) {
-                parts.push(step.pageBefore !== undefined && step.pageBefore !== step.pageAfter
-                    ? `the page then navigated to ${step.pageAfter}`
-                    : `the page stayed at ${step.pageAfter}`);
+            if (!staleRoute && pageAfter !== undefined) {
+                parts.push(pageBefore !== undefined && pageBefore !== pageAfter
+                    ? `the page then navigated to ${pageAfter}`
+                    : `the page stayed at ${pageAfter}`);
             }
             // A 4xx on the logout endpoint with the page unmoved is not a backend failure: the auth
             // client swallows the call and clears the session, and the URL can only move if the page
@@ -1702,14 +2306,29 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
                 .slice(0, 2)
                 .map((text) => text.replace(/\s+/g, ' ').trim().slice(0, 160))
                 .join(' | ')}`);
-        rows.push(`  ${index + 1}. ${whereOf(item)} — ${parts.join(' — ')}`);
+        // A request from another browser context the test opened is not the failing action's effect:
+        // it is set-up work on a different page, and it is named as such rather than merged into the
+        // row (xr-molecule-flash-m160: the helper context's POST /api/articles was printed as the
+        // click's effect while the assertion had failed on the profile page).
+        const others = (item.otherContexts ?? []).filter((context) => context.requests.length > 0);
+        for (const [otherIndex, context] of others.slice(0, 2).entries()) {
+            const label = otherIndex === 0
+                ? 'a second browser context, opened by the test for set-up and not the page the assertion ran on'
+                : 'another browser context the test opened';
+            parts.push(`${label}: ${context.requests.slice(0, 2).map(requestLine).join('; ')}`);
+        }
+        rows.push(`  ${index + 1}. ${failureWhereOf(item, failures)} — ${parts.join(' — ')}`);
     }
     // Distinct locations the note did not name: the repeats collapse, so the count is what is left
     // to look at, not how many zips Playwright wrote.
-    const distinct = new Set(candidates.map((item, index) => (item.spec === null ? `#${index}` : whereOf(item))));
+    const distinct = new Set(candidates.map((item, index) => item.spec === null ? `#${index}` : failureWhereOf(item, failures)));
     const more = distinct.size > traced.length
         ? `\n  … and ${distinct.size - traced.length} more traced failures`
         : '';
+    // Every row came from a trace with more than one browser context and no page to tie the
+    // assertion to: the note may list the requests, and may not say what action sent them or where
+    // "the page" went (m160).
+    const allUnattributed = traced.every((item) => item.unattributed === true);
     // A run whose pages never loaded has one cause, and it is not in the app: every traced failure is
     // a `page.goto` that timed out on a document the browser could not load. The transport error is
     // the first line the executor needs — m118 (+37:09) read 14 goto timeouts as app failures while
@@ -1752,12 +2371,50 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
                     `and if the stall repeats measure that exact fetch ` +
                     `(\`curl -o /dev/null -w '%{time_starttransfer} %{time_total}' <url>\`) before ` +
                     `treating it as the app's.\n\n`);
-    return (transportLead +
+    // Every row is a route change that fetched nothing: the cause and the next read are the same
+    // for the whole run, and the generic "read the response body" paragraph would point at a
+    // response that never existed (xr-molecule-flash-m163 +10:00).
+    const everyStaleRoute = staleRouteRows > 0 &&
+        staleRouteRows === traced.length &&
+        !anyFailed &&
+        !anyStalled &&
+        !allUnattributed &&
+        transport === null;
+    const staleRouteLead = everyStaleRoute
+        ? `Every failure this run traced is the same shape: the failing action asked the API for ` +
+            `nothing and the page changed route, so the page is still showing the data it fetched for ` +
+            `the route before. Read how each page derives its query from the route — a param the route ` +
+            `does not define is always undefined, and a missing effect dependency on the route means ` +
+            `the fetch never re-runs — before touching the markup or the CSS.\n\n`
+        : '';
+    // An assertion whose awaited text a same-page API response carried: the fact the run needs
+    // first, before any row, is that the value arrived and the page dropped it (m169's missing
+    // "trending" came back from GET /api/tags while the sidebar rendered a cut list). Each distinct
+    // response is named once; the note makes no claim about which cut did it.
+    const missingTexts = [
+        ...new Map(traced
+            .filter((item) => item.missingText !== undefined)
+            .map((item) => {
+            const missing = item.missingText;
+            return [`${missing.method} ${missing.path}\u0000${missing.text}`, missing];
+        })).values(),
+    ];
+    const missingTextLead = missingTexts.length === 0
+        ? ''
+        : `${missingTexts.slice(0, 2).map(missingTextSentence).join(' ')}\n\n`;
+    return (missingTextLead +
+        transportLead +
+        setupOriginLead +
         stalledLead +
+        staleRouteLead +
         `The platform read the failing tests' own Playwright traces from the run against ${target} ` +
-        `(what each page sent and got — first what the test's last action sent and where the page went ` +
-        `next, then the requests that failed, the ones that got no response, and its last answered ` +
-        `ones):\n` +
+        (allUnattributed
+            ? `(what each page sent and got — the requests their contexts recorded, with no claim about ` +
+                `which action caused them, then the ones that failed, the ones that got no response, and ` +
+                `the last answered ones):\n`
+            : `(what each page sent and got — first what the test's last action sent and where the page ` +
+                `went next, then the requests that failed, the ones that got no response, and its last ` +
+                `answered ones):\n`) +
         `${rows.join('\n')}${more}\n` +
         (anyFailed
             ? everyFailureLacksPrefix
@@ -1787,13 +2444,24 @@ export function failureTraceNote(items, target, earlierFailures = [], apiPrefixe
                         'not finish loading because its own subresource never answered. Do not read this as a ' +
                         'page-state bug: re-run these tests against the same URL first, and change the app only ' +
                         'if the same navigation times out again with no stalled asset in the trace.'
-                : 'No listed request failed — none got a 4xx/5xx or a network error — so the cause is in the ' +
-                    "page, not the API. Start with what the test's last action sent (the first line of each " +
-                    'row) and what the page did next: a request that answered (2xx included) while the page ' +
-                    'still did not show the state the assertion waited on is the fact to read — its status ' +
-                    'and response body, not the selector. If the request is not the one the test meant — an ' +
-                    'unfollow sent where the test clicked follow — the state the action read was stale ' +
-                    'before it.') +
+                : allUnattributed
+                    ? 'No listed request failed — none got a 4xx/5xx or a network error. The trace held more ' +
+                        'than one browser context and nothing ties a page to the failing assertion, so no ' +
+                        'action or URL is attributed here: read the requests above together with the runner’s ' +
+                        'own failure text to tell which page the test asserted on, and read that page’s state, ' +
+                        'not the selector.'
+                    : everyStaleRoute
+                        ? 'No listed request failed — none got a 4xx/5xx or a network error — and the failing ' +
+                            'action sent no request at all, so there is no response to read. The page changed ' +
+                            'route and fetched nothing, which is why it still shows the previous route’s data: ' +
+                            'fix how the page reads the route, not the selector.'
+                        : 'No listed request failed — none got a 4xx/5xx or a network error — so the cause is in the ' +
+                            "page, not the API. Start with what the test's last action sent (the first line of each " +
+                            'row) and what the page did next: a request that answered (2xx included) while the page ' +
+                            'still did not show the state the assertion waited on is the fact to read — its status ' +
+                            'and response body, not the selector. If the request is not the one the test meant — an ' +
+                            'unfollow sent where the test clicked follow — the state the action read was stale ' +
+                            'before it.') +
         prefixAdvice +
         (wrapped
             ? ' The API received a body wrapped in `data`: app-http’s `post(url, data, config)` / ' +
@@ -1927,24 +2595,27 @@ async function readRunConfig(command, cwd, readFile) {
     return '';
 }
 /**
- * The command a DIAGNOSIS run needs to leave a readable trace behind, when the suite's config
+ * The command a Playwright run needs to leave a readable trace behind, when the suite's config
  * would record none.
  *
  * The failing tests' requests are only readable if the run wrote them down (see the module doc),
  * and the config is where the decision about that lives — the platform does not edit the suite's
- * config, so it passes the flag instead, and only where it can do no harm: on a run narrowed to a
- * part of the suite or capped ({@link isDiagnosisRun}), never on the whole-suite proof run, and
- * never over a `--trace` the executor wrote itself. A capped walk is exactly the run whose
- * failures someone is about to work on; the proof run is graded as it is.
+ * config, so it passes the flag instead, on every Playwright run that starts tests and does not
+ * already decide its own `--trace`. That includes the whole-suite proof run, which an earlier
+ * version of this function skipped on the reasoning that its flags are graded: the flag changes
+ * what is RETAINED, not what passes. `retain-on-failure` keeps the trace only of a test that
+ * fails — Playwright records it and deletes it when the test passes (playwright's
+ * `_shouldAbandonTrace` unlinks the temporary trace files of a passing test) — so a green proof
+ * run keeps nothing extra. A failing one keeps the network log its failures need.
+ * xr-molecule-flash-m163 (+24:58) is why the proof run is no longer skipped: its one deployed
+ * failure left only an `error-context.md`, the executor spent the next calls hunting a `trace.zip`
+ * that could not exist, and then shipped a guessed fix.
  *
  * @param args - The command, the directory it starts in, and the backend's file read.
  * @returns The command to run and the sentence to report, or the command unchanged.
  */
 export async function diagnosisTraceCommand(args) {
     const unchanged = { command: args.command, change: null };
-    // The proof run is the one run this must never touch: its flags are graded.
-    if (!isDiagnosisRun(args.command))
-        return unchanged;
     if (namesTraceMode(args.command))
         return unchanged;
     // Only a Playwright run leaves a trace to read.
@@ -1968,7 +2639,8 @@ export async function diagnosisTraceCommand(args) {
     return {
         command: `${args.command.slice(0, at)} ${DIAGNOSIS_TRACE_FLAG}${args.command.slice(at)}`,
         change: `Added \`${DIAGNOSIS_TRACE_FLAG}\`: the suite's config records no trace for a failure` +
-            `${/trace:/.test(config) ? '' : ' (it sets none)'}, and this diagnosis run's failures are ` +
-            'what the platform reads the network log from. The proof run keeps the suite’s own settings.',
+            `${/trace:/.test(config) ? '' : ' (it sets none)'}, and a failing test's own network log is ` +
+            'what the platform reads the cause from. It keeps a trace only for a test that fails, so a ' +
+            'green run retains nothing.',
     };
 }