@nextcommerce/campaigns-os 1.46.0 → 1.47.0

package/skills/campaign-readback-classification/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: campaign-readback-classification
-version: 1.0.17
+version: 1.0.19
 description: Classify a selected campaign from the readback projection's v2 fields and write a read-only handoff without turning diagnosis into permission.
 ---
 
-Bundle revision: 1.46.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.46.0+skills.1`
+Bundle revision: 1.47.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/campaign-run-evidence/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: campaign-run-evidence
-version: 1.0.17
+version: 1.0.19
 description: Interpret existing Campaigns OS doctor, QA and proof-depth evidence without claiming more proof than the artifacts contain.
 ---
 
-Bundle revision: 1.46.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.46.0+skills.1`
+Bundle revision: 1.47.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/contribution-intake/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: contribution-intake
-version: 1.0.17
+version: 1.0.19
 description: Turn a suggestion about the agent surface into a classified, evidence-checked proposal and, only with attended approval, one issue on this repository's tracker.
 ---
 
-Bundle revision: 1.46.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.46.0+skills.1`
+Bundle revision: 1.47.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-build/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-build
-version: 1.0.22
+version: 1.0.24
 description: Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts.
 ---
 
-Bundle revision: 1.46.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.46.0+skills.1`
+Bundle revision: 1.47.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -87,7 +87,7 @@ Build rules:
 - If `doctor` (tier `A`: inspection that writes nothing, plus one read-only live campaign request once the site is built and a public campaign key resolves; `--write` is also tier `A` and writes doctor output; `--built` is tier `B`) reports `derived.scope.mode = "partial"`, build the pages listed in `derived.scope.built_pages` from their prepared source. Keep every out-of-scope route unbuilt by default, including pages marked `template_stock: true`; never publish placeholder presell/landing pages that remain on another host. Materialize a stock page only with explicit per-page operator opt-in (including a required pre-checkout `select` stand-in). For opted-in pages use the locked family's own page for that role with its dependent `_includes/`, `_layouts/`, and assets, wire it from CampaignSpec, and build a required select step first. Do not attest stock screenshots as design source. Built stock pages rejoin preview QA once their HTML exists. Carry remaining `skip_reason` declarations into the report and label the preview route/visual-testable rather than full-funnel launch-ready.
 - For `landing` and `presell` pages, prefer the prepared source HTML when `source_html.pages[].path` points at a real standalone page. Preserve the design/content through a passthrough page-kit layout, inject the SDK loader/config as needed, and repoint CTAs into the CampaignSpec flow. Treat `source_html.pages[].path` and `context.page_map[].source_path` as source provenance. Treat `source_html.pages[].page_kit`, `context.page_map[].page_kit`, and `context.page_map[].output_path` as the Page Kit target file, route, CPK `page_type`, and frontmatter projection.
 - Prepared source HTML means page-kit-ready markup, not a wholesale Liquid rewrite. Standalone HTML mockups that are meant to stay whole (their `source_screenshot` proof is of the full document) keep their document wrappers: the source-html manifest records `wrapper_policy: preserve_document_wrappers` (or `--wrapper-policy preserve_document_wrappers` on `start` / `prepare-build`), and doctor reports the wrappers as a warning. Otherwise, standalone AI/exported HTML should keep page-owned body markup, remove document wrappers, add YAML frontmatter, move shared CSS/assets into the campaign structure, and use Liquid helpers only where page-kit needs campaign-rooted links/assets/includes.
-- For `checkout`, `upsell`, `downsell`, and `receipt` pages, treat the selected starter-template commerce surface as the SDK contract reference: preserve required `data-next-*` controls, hidden fields, payment/address/totals/submit wiring, and `next_dont_touch` regions. The surrounding HTML wrapper, page composition, imagery, copy hierarchy, and brand layer are campaign/source-owned. Do not carry starter visual chrome forward when prepared source design should own that surface. QA checks what the checkout does, not family class names: do not add family shell classes (`.checkout-wrapper`, `.checkout-layout__left/right`) to the campaign's own grid or swap source-owned field markup for family includes to satisfy QA. Keep the checkout working instead: a `<form data-next-checkout="form">`, the contact and shipping fields bound with `data-next-checkout-field` inside it, and a visible cart total.
+- For `checkout`, `upsell`, `downsell`, and `receipt` pages, treat the selected starter-template commerce surface as the SDK contract reference: preserve required `data-next-*` controls, hidden fields, payment/address/totals/submit wiring, and `next_dont_touch` regions. The surrounding HTML wrapper, page composition, imagery, copy hierarchy, and brand layer are campaign/source-owned. Do not carry starter visual chrome forward when prepared source design should own that surface. QA checks what the checkout does, not family class names: do not add family shell classes (`.checkout-wrapper`, `.checkout-layout__left/right`) to the campaign's own grid or swap source-owned field markup for family includes to satisfy QA. Keep the checkout working instead: a `<form data-next-checkout="form">`, the contact and shipping fields bound with `data-next-checkout-field` inside it, and a visible cart total. A required field bound only on a `type="hidden"` input, a disabled control, a read-only input or read-only textarea, or a control with `aria-disabled="true"` does not count as bound: QA reports it in `fields_bound.missing`.
 - Read `context.theme` and `.campaign-runtime/theme/theme-report.json` when present. If a fresh `brand-theme.css` artifact exists, copy it into the campaign asset tree and load it after `next-core.css` on checkout, upsell, downsell, and receipt pages. If policy is `inspect_only`, either run `campaigns-os theme generate` (tier `B`: writes the theme artifacts and doctor output under the target; `--force` is tier `C`) or record an explicit skipped reason before applying a new brand layer.
 - Generated brand-theme v0 is root-variable-only. It may skin commerce pages through next-core custom properties, but it is not permission to edit SDK-owned selectors, package controls, payment fields, totals, submit controls, receipt templates, route meta tags, or SDK JavaScript.
 - Payment, express checkout, bundle selectors, and order bumps must start from the selected family's canonical component DOM/classes, not from raw custom/source HTML with `data-next-*` added afterward. For payment specifically, preserve the family payment-method wrapper, hosted field classes, and iframe geometry assumptions (for example `input-flds spreedly-field` in shop-style templates). Skin these components with campaign tokens; do not rebuild Spreedly/card fields as arbitrary divs.

package/skills/next-campaigns-os/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-os
-version: 1.0.37
+version: 1.0.39
 description: Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth.
 ---
 
-Bundle revision: 1.46.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.46.0+skills.1`
+Bundle revision: 1.47.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-os-setup/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-os-setup
-version: 2.0.20
+version: 2.0.22
 description: Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly installed as next-campaigns-setup; renamed 2026-08 to stop colliding with the published NextCommerceCo/skills scaffolder of that name.
 ---
 
-Bundle revision: 1.46.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.46.0+skills.1`
+Bundle revision: 1.47.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-polish/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-polish
-version: 1.1.21
+version: 1.1.23
 description: Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign.
 ---
 
-Bundle revision: 1.46.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.46.0+skills.1`
+Bundle revision: 1.47.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-qa/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-qa
-version: 1.3.21
+version: 1.3.23
 description: Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof.
 ---
 
-Bundle revision: 1.46.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.46.0+skills.1`
+Bundle revision: 1.47.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -83,7 +83,7 @@ Rules:
 - Template residue is a QA dimension, not advice: promoted starter families must have a brand/residue/pricing contract (`contracts/template-brand-contract.<family>.v0.json`). Browser QA inspects computed styles on commerce surfaces and fails pages that still render starter defaults (`#3c7dff`/`#0a265c`, starter `next-logo.png`, paypal/klarna chrome absent from the spec).
 - Pricing visibility is a blocker: an upsell/downsell offer with zero visible price rows fails QA. Pricing surfaces render via template pricing modes (`full_price`, `compare_at_current`, `unit_price_plus_total`, `savings_badge_amount`, `code_discounted_post_checkout`), never via campaign CSS `display:none` on price wrappers.
 - The upsell and checkout bundle price checks count the SDK's `data-next-bundle-display` price as a price row when it is visible and not empty.
-- `browser-commerce-structure` checks what the checkout does, not family class names; the checkout wrapper and page composition are source-owned. A missing family shell selector (only `.checkout-wrapper`, `.checkout-layout__left/right`, `.checkout__layout`, `.checkout__column--left/right` and the shipping field row marker) is `warn` when the checkout passes the behaviour checks in `evidence.behaviour`: a `<form data-next-checkout="form">`, `email`/`fname`/`lname`/`country`/`address1`/`city`/`province`/`postal` bound with `data-next-checkout-field` on an input, select or textarea inside it that is not `type="hidden"` or disabled (it may be hidden until a country is chosen), and a visible cart total. It stays `fail` when any of those fails or no checkout form is found, and any other missing selector (SDK attributes, payment field classes) is always `fail`. Do not ask the build to add family classes to clear a `warn`; fix the failing behaviour check.
+- `browser-commerce-structure` checks what the checkout does, not family class names; the checkout wrapper and page composition are source-owned. A missing family shell selector (only `.checkout-wrapper`, `.checkout-layout__left/right`, `.checkout__layout`, `.checkout__column--left/right` and the shipping field row marker) is `warn` when the checkout passes the behaviour checks in `evidence.behaviour`: a `<form data-next-checkout="form">`, `email`/`fname`/`lname`/`country`/`address1`/`city`/`province`/`postal` bound with `data-next-checkout-field` on an input, select or textarea inside it that is not `type="hidden"` or disabled (it may be hidden until a country is chosen), and a visible cart total. A required field bound only on a `type="hidden"` input, a disabled control, a read-only input or read-only textarea, or a control with `aria-disabled="true"` does not count as bound: QA reports it in `fields_bound.missing`. It stays `fail` when any of those fails or no checkout form is found, and any other missing selector (SDK attributes, payment field classes) is always `fail`. Do not ask the build to add family classes to clear a `warn`; fix the failing behaviour check.
 - Exit-pop widgets are governed offer surfaces. If the selected family ships or copies a default exit-pop and CampaignSpec has no checkout `exit_intent` or `promo_code_input`, QA/doctor must report it as residue; strip it or wire the mapped offer/code through the SDK coupon path.
 - Typed-card runs emit a per-step ladder (`[qa:test-order] step=... status=...`) with bounded per-step and per-path timeouts, and always produce a verdict — a hung or crashed path is a blocked verdict with the step ladder as evidence, not a silent exit. Read the last completed step before re-running.
 - A typed-card path that fails is classified by **what it did to the store** before the runner decides what to do about it. A failure the runner can prove happened before submit (`not_created`) is **re-run once, if the creation budget has a slot no still-unrun planned path needs** — so a transient miss is not reported as a defect in the build, without an early path eating budget the last planned paths need. Under the default budget a path whose submit was *rejected* has already spent its own slot, so it is not re-run and records `evidence.order_creation.rerun_skipped` instead. When the re-run does happen, both attempts appear in `test_orders[]` and `evidence.retry` names the first attempt's error and ref id. A failure that happened **after** the order was created (`created` — most often a receipt that did not render) is **never resubmitted**: the runner reloads that order's receipt and re-runs only the read-only checks, and `evidence.recovery` carries the original failure, the checks re-run, and whether it cleared. Read `evidence.order_creation` for two separate counts: `submissions_reserved` (platform-side creation slots charged to this path — reserved before a submit click, or charged for a hosted-checkout redirect where no submit click happens — which stand even when the create then failed) and `orders_confirmed_created` (creates the platform was observed to accept) — a spent slot with no confirmed order is the ambiguous case, not an order to reconcile. Recovery clears only on persisted evidence it re-read on that pass: a failed or absent order read-back stops it honestly rather than re-deciding against the original attempt's numbers. An outcome it cannot prove either way (`ambiguous` — an unusable read-back, a lost create response, a network-failed create, a 4xx after an earlier 2xx) stops the path and names the operator check instead of buying again. A pass that only came back after recovery is never indistinguishable from a first-attempt pass, and a failure that survives recovery still blocks.

package/skills.json

@@ -1,7 +1,7 @@
 {
   "name": "campaigns-os-skills",
   "description": "Skills bundled with Campaigns OS. `skills.sh` installs these into the shared agent skill directories (~/.claude/skills, ~/.codex/skills), so each one is a versioned package: bump the version whenever a package changes. `bundle_revision` identifies the bundle as a whole — `<package version>+skills.<n>`, where the prefix is this package's version and `<n>` counts the skill-text revisions published against it. It advances whenever ANY bundled skill changes, every SKILL.md states it on its first body line, and `campaigns-os tooling status --skills-revision <value>` compares the value an agent read from a skill against the bundle on disk. See docs/skills-revision.md.",
-  "bundle_revision": "1.46.0+skills.1",
+  "bundle_revision": "1.47.0+skills.1",
   "homepage": "https://github.com/NextCommerceCo/campaigns-os",
   "retired_skills": [
     {
@@ -16,7 +16,7 @@
     {
       "id": "next-campaigns-os",
       "name": "Campaigns OS Lifecycle",
-      "version": "1.0.37",
+      "version": "1.0.39",
       "path": "skills/next-campaigns-os/SKILL.md",
       "domain": "campaigns",
       "description": "Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth."
@@ -24,7 +24,7 @@
     {
       "id": "next-campaigns-os-setup",
       "name": "Campaigns OS Setup",
-      "version": "2.0.20",
+      "version": "2.0.22",
       "path": "skills/next-campaigns-os-setup/SKILL.md",
       "domain": "campaigns",
       "description": "Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly next-campaigns-setup; renamed to release that name to the published NextCommerceCo/skills scaffolder."
@@ -32,7 +32,7 @@
     {
       "id": "next-campaigns-build",
       "name": "Campaign Build",
-      "version": "1.0.22",
+      "version": "1.0.24",
       "path": "skills/next-campaigns-build/SKILL.md",
       "domain": "campaigns",
       "description": "Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts."
@@ -40,7 +40,7 @@
     {
       "id": "next-campaigns-polish",
       "name": "Campaign Polish",
-      "version": "1.1.21",
+      "version": "1.1.23",
       "path": "skills/next-campaigns-polish/SKILL.md",
       "domain": "campaigns",
       "description": "Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign."
@@ -48,7 +48,7 @@
     {
       "id": "next-campaigns-qa",
       "name": "Campaign QA",
-      "version": "1.3.21",
+      "version": "1.3.23",
       "path": "skills/next-campaigns-qa/SKILL.md",
       "domain": "campaigns",
       "description": "Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof."
@@ -56,7 +56,7 @@
     {
       "id": "campaign-lifecycle-orientation",
       "name": "Campaign Lifecycle Orientation",
-      "version": "1.0.17",
+      "version": "1.0.19",
       "path": "skills/campaign-lifecycle-orientation/SKILL.md",
       "domain": "campaigns",
       "description": "Orient a reader to the Campaigns OS lifecycle artifacts a run has already emitted, without advancing their state: the shared vocabulary, doctor as a gate, the stage record, and the store-theme/Page Kit two-worlds trap."
@@ -64,7 +64,7 @@
     {
       "id": "campaign-run-evidence",
       "name": "Campaign Run Evidence",
-      "version": "1.0.17",
+      "version": "1.0.19",
       "path": "skills/campaign-run-evidence/SKILL.md",
       "domain": "campaigns",
       "description": "Interpret existing doctor, QA verdict and proof-depth evidence without claiming more proof than the artifacts contain, and keep funnel proof apart from merchant launch readiness."
@@ -72,7 +72,7 @@
     {
       "id": "campaign-readback-classification",
       "name": "Campaign Readback Classification",
-      "version": "1.0.17",
+      "version": "1.0.19",
       "path": "skills/campaign-readback-classification/SKILL.md",
       "domain": "campaigns",
       "description": "Classify a selected campaign from the campaigns-os-readback/v2 fields (artifacts, staleness.stale_keys, clean, doctor, divergences, skip_cascades) and write a read-only handoff without turning diagnosis into permission."
@@ -80,7 +80,7 @@
     {
       "id": "contribution-intake",
       "name": "Contribution Intake",
-      "version": "1.0.17",
+      "version": "1.0.19",
       "path": "skills/contribution-intake/SKILL.md",
       "domain": "campaigns",
       "description": "Turn a suggestion about the agent surface into a classified, evidence-checked and redacted proposal, filed on this repository tracker only with attended approval."

package/src/built-script-syntax.mjs

@@ -17,10 +17,17 @@
 // nothing it would define runs, but whether the page needs it is not known
 // here, so it does not block.
 //
+// Two shapes are not read and only warn (#515). A `<script>` left unclosed at
+// the end of the file never runs: the browser does not prepare a script
+// element whose end tag never arrives. And a script that is a symlink, or
+// sits under a symlinked directory, resolving outside the site root: a static
+// server would follow it, but its bytes are not part of the built output. A
+// symlink that stays inside the site root is read where it points.
+//
 // Not waivable: a script that cannot be parsed cannot be intended to ship.
 // Both doctor entry points drive it, like the other static built-output gates.
 
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, isAbsolute, posix, relative, resolve, sep } from "node:path";
 
 import { parse as parseJs } from "acorn";
@@ -29,6 +36,8 @@ import { parse as parseHtml } from "parse5";
 export const SCRIPT_SYNTAX = "built_output.script_syntax";
 export const SCRIPT_SYNTAX_PARSE_FAILURE = `${SCRIPT_SYNTAX}.parse_failure`;
 export const SCRIPT_SYNTAX_MISSING_SCRIPT = `${SCRIPT_SYNTAX}.missing_script`;
+export const SCRIPT_SYNTAX_UNCLOSED_SCRIPT = `${SCRIPT_SYNTAX}.unclosed_script`;
+export const SCRIPT_SYNTAX_SYMLINK_OUTSIDE_SITE = `${SCRIPT_SYNTAX}.symlink_outside_site`;
 
 // Classic script MIME types the browser executes. Anything else with a type
 // attribute (JSON-LD, text/template, importmap) is a data block, not script.
@@ -200,6 +209,17 @@ export function baseInEffect(bases, scriptNode) {
   return base ? base.href : null;
 }
 
+/**
+ * Whether the file ended inside this parse5 element, before its end tag. The
+ * parser prepares a script at its end tag; at end of file it marks the element
+ * "already started" instead, so the browser never fetches or runs it.
+ *
+ * @param {object} node a parse5 element parsed with `sourceCodeLocationInfo`
+ */
+export function endsUnclosed(node) {
+  return Boolean(node?.sourceCodeLocation) && !node.sourceCodeLocation.endTag;
+}
+
 /**
  * `<script src>` references on a page, in document order, with whether each
  * is a module and the `<base href>` in effect when the browser prepares it
@@ -215,16 +235,21 @@ export function baseInEffect(bases, scriptNode) {
  * load there. A module script ignores `nomodule` and is kept (see scriptKind).
  * Template content and noscript are inert and not walked.
  *
+ * A script element the file ends inside (its end tag never arrives) is never
+ * prepared, so it never runs and is not a reference. It is returned in
+ * `unclosed` instead: its src, or null for an inline script.
+ *
  * @param {string} html
- * @returns {{ base: string | null, refs: Array<{ src: string, module: boolean, base: string | null }> }}
+ * @returns {{ base: string | null, refs: Array<{ src: string, module: boolean, base: string | null }>, unclosed: Array<{ src: string | null }> }}
  */
 export function pageScriptDocument(html) {
   const refs = [];
+  const unclosed = [];
   let document;
   try {
     document = parseHtml(String(html ?? ""), { sourceCodeLocationInfo: true });
   } catch {
-    return { base: null, refs };
+    return { base: null, refs, unclosed };
   }
   const bases = documentBases(document);
   const walk = (node) => {
@@ -233,9 +258,12 @@ export function pageScriptDocument(html) {
     // href / xlink:href, and a MathML "script" is not a script element.
     if (node.tagName === "script" && node.namespaceURI === HTML_NAMESPACE) {
       const kind = scriptKind(attrs);
+      const hasSrc = typeof attrs.src === "string" && attrs.src !== "";
+      if (kind && endsUnclosed(node)) {
+        unclosed.push({ src: hasSrc ? stripUrlSpace(attrs.src) : null });
       // "prepare the script element" skips only an empty src; anything else,
       // even whitespace, is parsed as a URL and fetched.
-      if (kind && typeof attrs.src === "string" && attrs.src !== "") {
+      } else if (kind && hasSrc) {
         refs.push({ src: stripUrlSpace(attrs.src), module: kind === "module", base: baseInEffect(bases, node) });
       }
     }
@@ -243,7 +271,7 @@ export function pageScriptDocument(html) {
     for (const child of node.childNodes || []) walk(child);
   };
   walk(document);
-  return { base: bases[0]?.href ?? null, refs };
+  return { base: bases[0]?.href ?? null, refs, unclosed };
 }
 
 /**
@@ -317,6 +345,15 @@ function isRemote(src) {
   return /^[a-z][a-z0-9+.-]*:/i.test(src) || src.startsWith("//");
 }
 
+// The real path of a file, or null when it cannot be resolved.
+function realPathOf(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+}
+
 function relFrom(root, path) {
   const rel = relative(root, path);
   return rel && !rel.startsWith("..") ? rel.split(sep).join("/") : path;
@@ -334,13 +371,23 @@ function relFrom(root, path) {
  * emits `/js/...`), never outside either. A base or src on another origin is
  * remote and not read.
  *
+ * Missing scripts are keyed by the URL the browser resolves, so two spellings
+ * of one URL (`check&#9;out.js`, `checkout.js`) are one entry, under the first
+ * spelling met. A path whose real path leaves the site root (a symlinked file
+ * or directory pointing elsewhere) is not read and is listed in
+ * `outside_site` by the link's own path. A page that ends inside a script
+ * element is listed in `unclosed`.
+ *
  * @param {{ site_root: string, campaign_dir: string, pages: Array<{ page_id: string, built_path: string }> }} scope
  * @param {string} targetRepo
  */
 export function collectBuiltScriptSyntaxInputs(scope, targetRepo) {
   const scripts = new Map();
   const unresolved = new Map();
+  const outsideSite = new Map();
+  const unclosed = [];
   const pages = Array.isArray(scope?.pages) ? scope.pages : [];
+  const siteRootReal = scope?.site_root ? realPathOf(scope.site_root) : null;
   for (const page of pages) {
     let html;
     try {
@@ -348,9 +395,12 @@ export function collectBuiltScriptSyntaxInputs(scope, targetRepo) {
     } catch {
       continue;
     }
-    const { refs } = pageScriptDocument(html);
+    const document = pageScriptDocument(html);
+    // One entry per page: the file ends inside at most one script, and the
+    // warning is about the page's truncated output.
+    if (document.unclosed.length) unclosed.push({ src: document.unclosed[0].src, pages: [page.page_id] });
     const pageUrl = pageUrlFor(scope.site_root, page.built_path);
-    for (const ref of refs) {
+    for (const ref of document.refs) {
       if (isRemote(ref.src)) continue;
       const { remote, pathname } = resolveScriptUrl(ref.src, ref.base, pageUrl);
       if (remote) continue;
@@ -366,9 +416,21 @@ export function collectBuiltScriptSyntaxInputs(scope, targetRepo) {
         isFile = false;
       }
       if (!isFile) {
-        const entry = unresolved.get(ref.src) || { src: ref.src, pages: [] };
+        const urlKey = pathname ?? `\u0000${ref.src}`;
+        const entry = unresolved.get(urlKey) || { src: ref.src, pages: [] };
         if (!entry.pages.includes(page.page_id)) entry.pages.push(page.page_id);
-        unresolved.set(ref.src, entry);
+        unresolved.set(urlKey, entry);
+        continue;
+      }
+      // Read where a static server would serve it, but only while the real
+      // path stays inside the site root. When either real path is unknown the
+      // check is undecidable, and the script is read as before.
+      const real = realPathOf(path);
+      if (siteRootReal && real && real !== siteRootReal && !real.startsWith(`${siteRootReal}${sep}`)) {
+        const file = relFrom(targetRepo, resolve(path));
+        const entry = outsideSite.get(file) || { file, src: ref.src, pages: [] };
+        if (!entry.pages.includes(page.page_id)) entry.pages.push(page.page_id);
+        outsideSite.set(file, entry);
         continue;
       }
       const key = `${resolve(path)}\u0000${ref.module ? "module" : "script"}`;
@@ -386,7 +448,13 @@ export function collectBuiltScriptSyntaxInputs(scope, targetRepo) {
       if (!entry.pages.includes(page.page_id)) entry.pages.push(page.page_id);
     }
   }
-  return { pages_scanned: pages.length, scripts: [...scripts.values()], unresolved: [...unresolved.values()] };
+  return {
+    pages_scanned: pages.length,
+    scripts: [...scripts.values()],
+    unresolved: [...unresolved.values()],
+    outside_site: [...outsideSite.values()],
+    unclosed,
+  };
 }
 
 function gateBase(subject) {
@@ -405,11 +473,16 @@ function gateBase(subject) {
  *
  * @param {{ subject?: object, pages_scanned?: number,
  *   scripts?: Array<{ file: string, module?: boolean, content: string, pages?: string[] }>,
- *   unresolved?: Array<{ src: string, pages: string[] }> }} input
+ *   unresolved?: Array<{ src: string, pages: string[] }>,
+ *   outside_site?: Array<{ file: string, src: string, pages: string[] }>,
+ *   unclosed?: Array<{ src: string | null, pages: string[] }> }} input
  */
-export function evaluateBuiltScriptSyntax({ subject, pages_scanned: pagesScanned = 0, scripts = [], unresolved = [] } = {}) {
+export function evaluateBuiltScriptSyntax({ subject, pages_scanned: pagesScanned = 0, scripts = [], unresolved = [], outside_site: outsideSite = [], unclosed = [] } = {}) {
   const list = Array.isArray(scripts) ? scripts : [];
   const missing = Array.isArray(unresolved) ? unresolved : [];
+  const outside = Array.isArray(outsideSite) ? outsideSite : [];
+  const open = Array.isArray(unclosed) ? unclosed : [];
+  const onPages = (pages) => (pages.length ? ` on ${pages.join(", ")}` : "");
   // A local script the page loads that is not in the built output: a 404 at
   // runtime. A warning, not a blocker (#502).
   const warned = missing.map((entry) => {
@@ -418,11 +491,39 @@ export function evaluateBuiltScriptSyntax({ subject, pages_scanned: pagesScanned
       code: SCRIPT_SYNTAX_MISSING_SCRIPT,
       src: entry.src,
       pages,
-      message: `${entry.src} is loaded by a local <script src>${pages.length ? ` on ${pages.join(", ")}` : ""} but is not in the built output. The browser gets a 404 for it and nothing it would define runs. Add the file to the build, or remove the reference if the page does not need it.`,
+      message: `${entry.src} is loaded by a local <script src>${onPages(pages)} but is not in the built output. The browser gets a 404 for it and nothing it would define runs. Add the file to the build, or remove the reference if the page does not need it.`,
     };
   });
-  const missingNote = warned.length ? ` ${warned.length} referenced local script(s) are not in the built output.` : "";
-  const common = { scripts_unresolved: missing, warned, pages_scanned: pagesScanned };
+  // A script symlink whose target is outside the site root (#515): not read,
+  // and named by the link, never by where it points.
+  for (const entry of outside) {
+    const pages = Array.isArray(entry.pages) ? entry.pages : [];
+    warned.push({
+      code: SCRIPT_SYNTAX_SYMLINK_OUTSIDE_SITE,
+      file: entry.file,
+      src: entry.src,
+      pages,
+      message: `${entry.file} is loaded by a local <script src>${onPages(pages)} but is a symlink whose target is outside the site root, so its syntax was not checked. A static server may still serve it. Copy the script into the build output instead of linking to it.`,
+    });
+  }
+  // A page that ends inside a script element (#515): the browser never runs
+  // that script, so it is not parsed. The page output is probably truncated.
+  for (const entry of open) {
+    const pages = Array.isArray(entry.pages) ? entry.pages : [];
+    warned.push({
+      code: SCRIPT_SYNTAX_UNCLOSED_SCRIPT,
+      src: entry.src ?? null,
+      pages,
+      message: `${entry.src ? `The <script src="${entry.src}">` : "An inline <script>"}${onPages(pages)} is never closed: the page ends before its </script>. The browser does not run a script element whose end tag never arrives, so it was not parsed. Check the page for truncated output and rebuild.`,
+    });
+  }
+  const notes = [
+    missing.length ? ` ${missing.length} referenced local script(s) are not in the built output.` : "",
+    outside.length ? ` ${outside.length} script symlink(s) resolve outside the site root and were not read.` : "",
+    open.length ? ` ${open.length} page(s) end inside an unclosed <script>.` : "",
+  ];
+  const missingNote = notes.join("");
+  const common = { scripts_unresolved: missing, scripts_outside_site: outside, warned, pages_scanned: pagesScanned };
   if (list.length === 0) {
     return {
       ...gateBase(subject),

package/src/diagnostic.mjs

@@ -20,7 +20,8 @@ const REASONS = new Set([
   "built_output.upsell_selector_scope", "built_output.sdk_markup.swap_with_add_to_cart",
   "built_output.sdk_markup.checkout_not_form", "built_output.sdk_markup.wrong_field_name",
   "built_output.sdk_markup.missing_selector_id_match", "built_output.script_syntax.parse_failure",
-  "built_output.script_syntax.missing_script", "source_html.producer_provenance",
+  "built_output.script_syntax.missing_script", "built_output.script_syntax.unclosed_script",
+  "built_output.script_syntax.symlink_outside_site", "source_html.producer_provenance",
   "source_html.producer_provenance.source_type", "source_html.producer_provenance.screenshot_fallback_used",
   "source_html.producer_provenance.semantic_section_count", "source_html.producer_provenance.material_fingerprint",
   "source_html.producer_provenance.section_exports", "source_html.producer_provenance.waiver_inert",

package/src/doctor/checks.mjs

@@ -2041,7 +2041,6 @@ function collectBuiltPageIdentityInputs(scope, targetRepo) {
     }
     return {
       page_id: page.page_id,
-      page_type: page.page_type,
       route: page.route,
       file: relFromDir(targetRepo, page.built_path),
       content,

package/src/qa-analytics-parity.mjs

@@ -547,6 +547,10 @@ function valuesEqual(a, b) {
 // flag carried-over-tag regressions for human review.
 // `options.url` is the candidate URL that was captured (the resolved capture
 // target) — stamped on every emitted assertion, pass and fail alike.
+// `options.candidatePage` describes the page the candidate was captured on when
+// the leg picked it automatically (#512): `{ receipt, source, page_type }`.
+// An explicit --analytics-candidate passes none and is treated as the receipt
+// the operator named.
 export function diffAnalyticsParity(baseline, candidate, options = {}) {
   const assertions = [];
   const auditedUrl = (typeof options.url === "string" && options.url.trim()) ? options.url.trim() : null;
@@ -561,13 +565,44 @@ export function diffAnalyticsParity(baseline, candidate, options = {}) {
   const cEff = effectivePurchase(c);
 
   // 1. Purchase present on candidate — the highest-value blocking check.
-  assertions.push(emit({
+  // #512: Purchase fires only on a receipt. When the candidate is known not to
+  // be one (the automatic capture page is the campaign root or a built entry),
+  // a missing Purchase is a page mismatch, not a regression, so it goes to
+  // manual review naming the mismatch. A receipt candidate, or one the
+  // operator named, still blocks.
+  const candidatePage = options.candidatePage && typeof options.candidatePage === "object" ? options.candidatePage : null;
+  if (!cEff.fired && candidatePage?.receipt === false) {
+    const baselineFired = effectivePurchase(b).fired;
+    assertions.push(emit({
+      id: "analytics-parity:purchase-present",
+      status: STATUS.MANUAL_REVIEW,
+      severity: SEVERITY.WARN,
+      expected: "a receipt candidate to check Purchase on; the automatic candidate is not a receipt, so pair receipts with --analytics-candidate",
+      actual: baselineFired
+        ? "baseline fired a Purchase but the automatic candidate is not a receipt page; pass --analytics-candidate <candidate receipt url> to compare receipts"
+        : "neither page fired a Purchase and the automatic candidate is not a receipt page; pass receipt URLs to --analytics-baseline and --analytics-candidate to compare Purchase",
+      evidence: {
+        via: cEff.via,
+        candidate_events: c.eventNames || [],
+        baseline_purchase: bp,
+        page_mismatch: {
+          reason: baselineFired ? "receipt_baseline_non_receipt_candidate" : "candidate_not_receipt",
+          baseline_fired_purchase: baselineFired,
+          candidate_receipt: candidatePage.receipt,
+          candidate_source: candidatePage.source ?? null,
+          candidate_page_type: candidatePage.page_type ?? null,
+        },
+      },
+    }));
+  } else assertions.push(emit({
     id: "analytics-parity:purchase-present",
     status: cEff.fired ? STATUS.PASS : STATUS.FAIL,
     severity: SEVERITY.BLOCKER,
     expected: "candidate fires a Purchase (dl_purchase, or Meta/GA4 pixel if the SDK event is blocked)",
     actual: cEff.fired ? `purchase fired via ${cEff.via}` : "no purchase fire captured on candidate (dataLayer, Meta, or GA4)",
-    evidence: { via: cEff.via, candidate_events: c.eventNames || [], candidate_signals: c.purchaseSignals || {}, baseline_purchase: bp },
+    // An automatic candidate's page is recorded even when it fired, so a pass on
+    // a non-receipt page reads as such.
+    evidence: { via: cEff.via, candidate_events: c.eventNames || [], candidate_signals: c.purchaseSignals || {}, baseline_purchase: bp, ...(candidatePage ? { candidate_page: candidatePage } : {}) },
   }));
 
   if (cEff.fired) {

package/src/qa-binding-evidence.mjs

@@ -1,7 +1,7 @@
 import { parse as parseHtml } from 'parse5';
 import { parse as parseJs } from 'acorn';
 import { createPageSourceLoader, resolveCommercialApiKey } from './qa-commercial-parity.mjs';
-import { HTML_NAMESPACE, baseInEffect, documentBases, frozenBaseUrl, parseFailureDiagnostic, scriptKind } from './built-script-syntax.mjs';
+import { HTML_NAMESPACE, baseInEffect, documentBases, endsUnclosed, frozenBaseUrl, parseFailureDiagnostic, scriptKind } from './built-script-syntax.mjs';
 
 export const BINDING_SCHEMA = 'campaigns-os-page-binding/v0';
 export const BINDING_LIMITS = Object.freeze({ scripts_per_page: 6, scripts_per_run: 24, script_bytes: 262144, timeout_ms: 5000 });
@@ -124,8 +124,10 @@ export async function observeBinding({ source, page, expected, scriptLoader, par
     // Only an HTML-namespace <script> loads `src`. An SVG script runs from
     // href / xlink:href or its inline text, which this static read does not
     // model: it is not fetched and leaves the binding dynamic.
+    // A script the file ends inside never reaches its end tag, so the parser
+    // never prepares it: the browser neither fetches nor runs it (#515).
     if (node.tagName === 'script' && node.namespaceURI !== HTML_NAMESPACE) dynamic = true;
-    else if (node.tagName === 'script') scripts.push({ attrs, base: baseInEffect(bases, node), text: (node.childNodes || []).map(n => n.value || '').join('') });
+    else if (node.tagName === 'script' && !endsUnclosed(node)) scripts.push({ attrs, base: baseInEffect(bases, node), text: (node.childNodes || []).map(n => n.value || '').join('') });
     // parse5 keeps template content separate; it is inert, as is noscript at boot.
     if (node.tagName !== 'noscript') for (const child of node.childNodes || []) walk(child);
   };