@nurix/etna 0.18.0 → 0.18.1

package/data/harnesses/discover/rules/tradecraft.md

@@ -1,22 +1,15 @@
 # Discover Harness — Session & Wire Tradecraft (keyboard-level reference)
 
-The executable field layer the browser-driving dimensions (`session`, `wire-capture`) reach for at
-the keyboard. Everything here is **runnable verbatim** — taps, scrubbers, escape snippets — not prose
-to re-derive. It is the distilled tradecraft from real teardowns; the `§1.x`/`§2.x` anchors are the
-origin tags from those runs.
+The executable field layer the browser-driving dimensions (`session`, `wire-capture`) reach for at the keyboard. Everything here is **runnable verbatim** — taps, scrubbers, escape snippets — not prose to re-derive. It is the distilled tradecraft from real teardowns; the `§1.x`/`§2.x` anchors are the origin tags from those runs.
 
 **How the dimensions use this file:**
+
 - `session` / `wire-capture` install the **Tap toolkit** taps first, then traverse via in-app nav.
-- Every captured value passes through the **runnable redaction layer** — which lives in the ethics
-  contract (`ingestion.md` §7, "Redaction — runnable") because redaction is non-negotiable —
-  before it is returned, logged, or written to `raw/`.
+- Every captured value passes through the **runnable redaction layer** — which lives in the ethics contract (`ingestion.md` §7, "Redaction — runnable") because redaction is non-negotiable — before it is returned, logged, or written to `raw/`.
 - Read the **Harness gotchas** before every run; reach for **Dead-end recovery** when a surface walls.
-- `discovery` (fingerprinting) and `evaluation` (classifying a finding) also cite
-  the **fingerprint tables** here.
+- `discovery` (fingerprinting) and `evaluation` (classifying a finding) also cite the **fingerprint tables** here.
 
-> Provenance: ported verbatim from the prior-generation playbook's `general-tricks.md` /
-> `general-saas.md`. Keep it living — fold every new gotcha / tap / fingerprint back in (the same
-> maintenance loop the redaction table carries).
+> Provenance: ported verbatim from the prior-generation playbook's `general-tricks.md` / `general-saas.md`. Keep it living — fold every new gotcha / tap / fingerprint back in (the same maintenance loop the redaction table carries).
 
 ---
 
@@ -39,27 +32,30 @@ The runnable in-page instrumentation `session`/`wire-capture` install to mine th
 
 ```js
 (() => {
-  if (window.__fetchTap) return 'already';
+  if (window.__fetchTap) return "already";
   window.__fetchTap = [];
   const orig = window.fetch.bind(window);
-  window.fetch = function(input, init) {
-    const url = typeof input === 'string' ? input : input.url;
-    const method = (init && init.method) || (input && input.method) || 'GET';
+  window.fetch = function (input, init) {
+    const url = typeof input === "string" ? input : input.url;
+    const method = (init && init.method) || (input && input.method) || "GET";
     const entry = { url, method, at: Date.now() };
-    if (init && typeof init.body === 'string') entry.body = init.body.slice(0, 8000);
+    if (init && typeof init.body === "string")
+      entry.body = init.body.slice(0, 8000);
     window.__fetchTap.push(entry);
-    return orig(input, init).then(resp => {
+    return orig(input, init).then((resp) => {
       try {
         entry.status = resp.status;
-        entry.respCt = resp.headers.get('content-type') || '';
+        entry.respCt = resp.headers.get("content-type") || "";
         const c = resp.clone();
         if (/json|text\/plain|event-stream/.test(entry.respCt)) {
-          c.text().then(t => {
-            entry.respLen = t.length;
-            entry.resp = t.slice(0, 12000);
-          }).catch(() => {});
+          c.text()
+            .then((t) => {
+              entry.respLen = t.length;
+              entry.resp = t.slice(0, 12000);
+            })
+            .catch(() => {});
         }
-      } catch(_){}
+      } catch (_) {}
       return resp;
     });
   };
@@ -67,21 +63,24 @@ The runnable in-page instrumentation `session`/`wire-capture` install to mine th
     window.__xhrTapped = true;
     const origOpen = XMLHttpRequest.prototype.open;
     const origSend = XMLHttpRequest.prototype.send;
-    XMLHttpRequest.prototype.open = function(method, url) {
-      this.__url = url; this.__method = method;
+    XMLHttpRequest.prototype.open = function (method, url) {
+      this.__url = url;
+      this.__method = method;
       return origOpen.apply(this, arguments);
     };
-    XMLHttpRequest.prototype.send = function(body) {
+    XMLHttpRequest.prototype.send = function (body) {
       window.__fetchTap.push({
-        kind: 'xhr', url: this.__url, method: this.__method,
-        body: typeof body === 'string' ? body.slice(0, 600) : '[non-string]',
+        kind: "xhr",
+        url: this.__url,
+        method: this.__method,
+        body: typeof body === "string" ? body.slice(0, 600) : "[non-string]",
         at: Date.now(),
       });
       return origSend.apply(this, arguments);
     };
   }
-  return 'tapped';
-})()
+  return "tapped";
+})();
 ```
 
 > Apply `SCRUB` (redaction section) to `entry.body` / `entry.resp` before returning or writing — body capture is clamped to 8000–12000 chars; larger bodies go to a `window.__RAW_*` global and are paged (ingestion §5, size discipline).
@@ -94,25 +93,29 @@ The runnable in-page instrumentation `session`/`wire-capture` install to mine th
 
 ```js
 (() => {
-  if (window.__wsTap) return 'already-tapped';
+  if (window.__wsTap) return "already-tapped";
   window.__wsTap = [];
   const OriginalWS = window.WebSocket;
   window.WebSocket = function (...args) {
     const ws = new OriginalWS(...args);
-    window.__wsTap.push({ kind: 'open', url: args[0], at: Date.now() });
-    ws.addEventListener('message', (e) => {
+    window.__wsTap.push({ kind: "open", url: args[0], at: Date.now() });
+    ws.addEventListener("message", (e) => {
       window.__wsTap.push({
-        kind: 'recv', url: args[0],
-        data: typeof e.data === 'string' ? e.data.slice(0, 4000) : '[binary]',
+        kind: "recv",
+        url: args[0],
+        data: typeof e.data === "string" ? e.data.slice(0, 4000) : "[binary]",
         at: Date.now(),
       });
     });
-    ws.addEventListener('close', () => window.__wsTap.push({ kind: 'close', url: args[0], at: Date.now() }));
+    ws.addEventListener("close", () =>
+      window.__wsTap.push({ kind: "close", url: args[0], at: Date.now() }),
+    );
     const origSend = ws.send.bind(ws);
     ws.send = (data) => {
       window.__wsTap.push({
-        kind: 'send', url: args[0],
-        data: typeof data === 'string' ? data.slice(0, 4000) : '[binary]',
+        kind: "send",
+        url: args[0],
+        data: typeof data === "string" ? data.slice(0, 4000) : "[binary]",
         at: Date.now(),
       });
       return origSend(data);
@@ -120,21 +123,29 @@ The runnable in-page instrumentation `session`/`wire-capture` install to mine th
     return ws;
   };
   Object.assign(window.WebSocket, OriginalWS);
-  return 'tapped';
-})()
+  return "tapped";
+})();
 ```
 
 > **Never log a binary frame as opaque `[binary]`** (ingestion §9.4). The snippet above stubs binary as `[binary]` for the string-clamp path; for any `ArrayBuffer`/`Blob` frame replace that branch with a **signature** capture — byte-length + first ~16 bytes as hex AND decoded as ASCII (a legible prefix names STOMP/Phoenix/Centrifugo/`+topic` in one step before guessing protobuf/MessagePack/CBOR/Yjs). Drop this into the `message`/`send` handlers in place of the `'[binary]'` literal:
 
 ```js
 const frameSig = (d) => {
-  if (typeof d === 'string') return { kind: 'text', len: d.length, data: d.slice(0, 4000) };
-  const buf = d instanceof ArrayBuffer ? d : (d && d.buffer) ? d.buffer : null;
-  if (!buf) return { kind: 'unknown' };
+  if (typeof d === "string")
+    return { kind: "text", len: d.length, data: d.slice(0, 4000) };
+  const buf = d instanceof ArrayBuffer ? d : d && d.buffer ? d.buffer : null;
+  if (!buf) return { kind: "unknown" };
   const head = new Uint8Array(buf.slice(0, 16));
-  const hex = [...head].map(b => b.toString(16).padStart(2, '0')).join(' ');
-  const ascii = [...head].map(b => (b >= 32 && b < 127) ? String.fromCharCode(b) : '.').join('');
-  return { kind: 'binary', byteLen: buf.byteLength, head16Hex: hex, head16Ascii: ascii };
+  const hex = [...head].map((b) => b.toString(16).padStart(2, "0")).join(" ");
+  const ascii = [...head]
+    .map((b) => (b >= 32 && b < 127 ? String.fromCharCode(b) : "."))
+    .join("");
+  return {
+    kind: "binary",
+    byteLen: buf.byteLength,
+    head16Hex: hex,
+    head16Ascii: ascii,
+  };
 };
 ```
 
@@ -146,26 +157,30 @@ const frameSig = (d) => {
 
 ```js
 (() => {
-  if (window.__esTapped) return 'already';
+  if (window.__esTapped) return "already";
   window.__esTapped = true;
   window.__esTap = [];
   const OrigES = window.EventSource;
-  window.EventSource = function(url, init) {
+  window.EventSource = function (url, init) {
     const es = new OrigES(url, init);
-    window.__esTap.push({ kind: 'es-open', url, at: Date.now() });
-    es.addEventListener('message', (e) => {
+    window.__esTap.push({ kind: "es-open", url, at: Date.now() });
+    es.addEventListener("message", (e) => {
       window.__esTap.push({
-        kind: 'es-msg', url,
-        data: typeof e.data === 'string' ? e.data.slice(0, 4000) : '[non-string]',
+        kind: "es-msg",
+        url,
+        data:
+          typeof e.data === "string" ? e.data.slice(0, 4000) : "[non-string]",
         at: Date.now(),
       });
     });
-    es.addEventListener('error', () => window.__esTap.push({ kind: 'es-err', url, at: Date.now() }));
+    es.addEventListener("error", () =>
+      window.__esTap.push({ kind: "es-err", url, at: Date.now() }),
+    );
     return es;
   };
   Object.assign(window.EventSource, OrigES);
-  return 'tapped';
-})()
+  return "tapped";
+})();
 ```
 
 ---
@@ -178,25 +193,30 @@ const frameSig = (d) => {
 
 ```js
 (() => {
-  if (!window.Pusher || !window.Pusher.instances || !window.Pusher.instances[0]) return 'no-pusher';
-  if (window.__pusherTapped) return 'already';
+  if (!window.Pusher || !window.Pusher.instances || !window.Pusher.instances[0])
+    return "no-pusher";
+  if (window.__pusherTapped) return "already";
   window.__pusherTapped = true;
   window.__pusherLog = [];
   const p = window.Pusher.instances[0];
   p.bind_global((eventName, data) => {
     window.__pusherLog.push({
-      ts: Date.now(), evt: eventName,
+      ts: Date.now(),
+      evt: eventName,
       channels: Object.keys(p.channels.channels),
-      data: typeof data === 'string' ? data.slice(0, 800) : JSON.stringify(data || {}).slice(0, 800)
+      data:
+        typeof data === "string"
+          ? data.slice(0, 800)
+          : JSON.stringify(data || {}).slice(0, 800),
     });
   });
   return JSON.stringify({
     state: p.connection.state,
     cluster: p.config.cluster,
     key: p.key,
-    channels: Object.keys(p.channels.channels)
+    channels: Object.keys(p.channels.channels),
   });
-})()
+})();
 ```
 
 > **For Ably:** `window.Ably.Realtime.instances` exposes the same pattern. The returned `{ state, cluster, key, channels }` is the realtime-handshake summary; the accumulating `window.__pusherLog` is the event/channel catalog. Pass the `key` field through `SCRUB` before returning.
@@ -205,29 +225,29 @@ const frameSig = (d) => {
 
 ### 5. Idempotent re-install guard
 
-**When to use:** every tap above — and any `window.__*` capture global — must early-exit if already installed, so re-running a snippet after a DOM-changing action does not double-wrap (`fetch` wrapped twice breaks `response.clone()`; source §2.9). The guard is the first line of each tap; for capture registries that should *survive and accumulate* within a navigation rather than early-exit, use the `||=` init form.
+**When to use:** every tap above — and any `window.__*` capture global — must early-exit if already installed, so re-running a snippet after a DOM-changing action does not double-wrap (`fetch` wrapped twice breaks `response.clone()`; source §2.9). The guard is the first line of each tap; for capture registries that should _survive and accumulate_ within a navigation rather than early-exit, use the `||=` init form.
 
 ```js
 // Guard form — early-exit if a wrapper is already installed (use atop every tap):
 (() => {
-  if (window.__xTap) return 'already';   // sentinel: unique per tap (__wsTap, __esTap, __fetchTap, __pusherTapped, ...)
+  if (window.__xTap) return "already"; // sentinel: unique per tap (__wsTap, __esTap, __fetchTap, __pusherTapped, ...)
   window.__xTap = [];
   // ... install wrapper here ...
-  return 'tapped';
-})()
+  return "tapped";
+})();
 
 // Init form — idempotent registry that survives & accumulates within one navigation
 // (re-init after every full nav; the global is wiped on reload — source §2.11):
 window.__probe = window.__probe || {};
 ```
 
-| Sentinel | Guards tap |
-|----------|-----------|
-| `window.__fetchTap` / `window.__xhrTapped` | Fetch + XHR (item 1) |
-| `window.__wsTap` | WebSocket (item 2) |
-| `window.__esTapped` / `window.__esTap` | EventSource (item 3) |
+| Sentinel                                       | Guards tap                  |
+| ---------------------------------------------- | --------------------------- | --- | ----------------------------- |
+| `window.__fetchTap` / `window.__xhrTapped`     | Fetch + XHR (item 1)        |
+| `window.__wsTap`                               | WebSocket (item 2)          |
+| `window.__esTapped` / `window.__esTap`         | EventSource (item 3)        |
 | `window.__pusherTapped` / `window.__pusherLog` | Pusher/Ably global (item 4) |
-| `window.__probe` (init-form `||=`) | per-navigation probe registry |
+| `window.__probe` (init-form `                  |                             | =`) | per-navigation probe registry |
 
 > The guard is a **per-navigation** sentinel: a full `navigate()` / `location.reload()` wipes both the wrapper and its sentinel, so re-running the snippet after a full nav correctly re-installs. Within a single SPA session, the sentinel prevents the double-wrap.
 
@@ -237,34 +257,34 @@ window.__probe = window.__probe || {};
 
 The Chrome-MCP browser-driving layer has ~27 recurring failure modes; every one bit a real run. Each entry below is **failure mode → concrete workaround**. They bind the `session` and `wire-capture` dimensions (the only browser-driving dimensions); the runnable taps/escapes are EXECUTABLE, not prose — paste them as-is.
 
-1. **Output that *looks* like cookie/query data is blocked** (`[BLOCKED: Cookie/query string data]`) — a `javascript_tool` result with JWT-shaped strings, long base64, long hex, many UUIDs, or query-string substrings is blocked on the *returned string*, not on what the code does → run the returned value through a `SCRUB()` (and, when that's not enough, the `ULTRA()` regex) before returning. *(§2.1)*
-2. **`read_network_requests` only tracks AFTER its first call** — initial page-load requests are invisible (it starts capturing on first invocation) → install the fetch/XHR taps **before** navigation, or reload after the first call. *(§2.2)*
-3. **`read_network_requests` misses cross-origin XHRs + cache-served loads (GraphQL SPAs)** — it may not surface cross-origin API XHRs (e.g. `i.jasper.ai/gw/graphql` from `app.jasper.ai`), and on reload data is served from the Apollo/SWR cache so no request fires at all → don't conclude "no API calls"; pivot to the client cache and force a refetch to capture verbatim bodies. *(§2.2 corollary)*
-4. **`EventSource` taps miss `text/event-stream` over `fetch`** — many products read SSE-formatted bodies via `fetch().body`, not `EventSource`, so the ES tap returns empty even while streaming → always run **both** the EventSource tap and the fetch/streaming-body tap. *(§2.3)*
-5. **Long-poll buffers rotate fast on heartbeats** — heartbeats fly every few seconds and evict interesting frames from bounded buffers → skip frames smaller than ~350 bytes when storing, and dedupe events by `id` so retried polls don't re-add. *(§2.4)*
-6. **`find` returns ghost duplicates in dynamic UIs** — modern apps render a textarea+button pair twice (visible+hidden, or in a portal); `find` returns both refs but only one is wired → default to coordinate clicks for action-bearing buttons; use refs only for stable structural elements. *(§2.5)*
-7. **`Enter` in textareas doesn't submit; contentEditable divs aren't textareas** — the submit handler is bound to a button, not the keypress, and many apps use `contentEditable` divs as fake textareas (`form_input` won't work) → click the submit button by coordinate after typing; on contentEditable use coordinate-click + `computer.type`. *(§2.6)*
-8. **`wait` caps at 10s** — a single `wait` won't hold longer → batch multiple `wait` calls, or use `browser_batch` with several `wait` actions; inside JS, `await new Promise(r => setTimeout(r, 4000))` works for ≤45s waits. *(§2.7)*
-9. **Don't dump raw tokens** — the harness (correctly) blocks raw `document.cookie` / `Authorization` dumps even when the user is OK seeing structure → inspect **shape** only (lengths, names, decoded JWT payload with PII redacted), never raw values. *(§2.8)*
-10. **`response.clone()` chains break if you wrap fetch twice** — a `clone()` from an inner wrapper may not work in the outer → install **one** tap and do everything in it; don't layer multiple body interceptors. *(§2.9)*
-11. **Sleep/wait is never your loop** — if you're doing `wait → check → wait → check`, server-side state is more reliable than babysitting client polling → switch to: trigger action → wait once → query the trajectory/history endpoint directly. *(§2.10)*
-12. **JS context is wiped on every full navigation** — `window.__TOK/__TAP/__RAW/__probe/__DUMP/...` are all gone after `navigate()`, `location.reload()`, or any anchor click triggering a full load → re-install the tap after every navigation, re-grab the token from localStorage, and use idempotent init (`window.__X = window.__X || {...}`). SPA-internal `pushState`-routed nav preserves context (keep your taps), **but** `history.pushState` + `dispatchEvent(new PopStateEvent('popstate'))` may trigger a *full* nav in Next.js App Router — don't rely on programmatic SPA-internal nav; use real link clicks or just navigate. *(§2.11)*
-13. **WebSocket tap doesn't catch sockets created before installation** — a library (Pusher, Ably) that inits its WebSocket at app-boot via `window.WebSocket` is invisible to a wrap installed after that point → use the library-specific event-bus tap (e.g. Pusher `bind_global`) instead. *(§2.12)*
-14. **Page renderer freezes during agent generation** — `find`, `screenshot`, `read_page` wait for `document_idle` and hang while the page constantly mutates (streaming output) → for liveness checks during generation, use `javascript_tool` (no idle wait). *(§2.13)*
-15. **`cloned.text()` never resolves on long-poll bodies** — the body tap reads via `response.clone().text()`, which only resolves on response *close*; a held-open long-poll never closes, so the promise never resolves → capturing chunks-as-they-arrive needs `getReader()`-based decoding; for most RE, skip streaming-chunk capture and hit the `/history` endpoint instead. *(§2.14)*
-16. **Be aggressive with body-capture limits** — when wrapping fetch, slice the response-body capture to 8000–12000 chars; the tap entry's `resp` field is for previewing only → anything bigger goes into a `window.__RAW_*` global and is paged through (the global is for the full body). *(§2.15)*
-17. **Output-truncation tells** — the harness truncates very long outputs at ~3–5KB; watch for `[TRUNCATED]` markers → either page-through via `slice()` or write the data to a file via the Write tool (skip the JS round-trip). *(§2.16)*
-18. **Slices get truncated even at 3000 chars** — empirically the harness truncates each slice output to ~2.5–3KB *regardless of slice size* → use **3000-char slices** as a defensive default and scrub aggressively before returning; for 100KB+ bodies switch to the aggregate-summary-from-window pattern (write decoded summaries + samples, not verbatim bodies). *(§2.17)*
-19. **`tabs_context_mcp` is required at the start of any session** — tab IDs from previous conversations are stale and won't work → always call `mcp__claude-in-chrome__tabs_context_mcp` first to confirm tab IDs and that the tab group is alive. *(§2.18)*
-20. **`read_network_requests` filters URL *substring*, not regex** — pass `urlPattern: "/api/"` for a literal substring match; no regex, no globs → don't try `urlPattern: "/api/*"` (it's treated as the literal substring `/api/*`, rarely what you want). *(§2.19)*
-21. **`read_network_requests` is cumulative within a domain** — the panel accumulates across the session and only clears on cross-domain nav OR when you pass `clear: true` → for per-route mining, clear the panel before navigating to each new route (`{tabId, urlPattern: "...", clear: true}`) so the request set is scoped to that page. *(§2.20)*
-22. **`browser_batch` outputs are individually capped, not jointly** — each item's output is independently capped (~3–5KB) → fit ~10 `slice()` calls in one batch for ~30KB total across separate output blocks (each item still truncates individually if too long). *(§2.21)*
-23. **A SyntaxError inside a batch fails the rest of the batch** — one bad `javascript_tool` item in a `browser_batch` can stop the rest from executing → test JS expressions in isolation before batching them. *(§2.22)*
-24. **CORS-walled serverless RPC is a hard read-only stop** — cross-origin fetch from the SPA origin to a Cloud Functions / Cloud-Run RPC host fails preflight (`TypeError: Failed to fetch`); POST-only RPC bodies/headers aren't probeable read-only → mine the **Firestore IndexedDB cache** (`collectionParents` census, `remoteDocuments` cached bodies+schemas, `targets` active subscriptions) + `redux-persist` slices; a Firestore REST `GET documents/users/{uid}` (200) confirms the Bearer model, `listCollectionIds` (403) is the negative control proving security rules are active. *(§2.23 — Plai)*
-25. **`403 "Token is not valid."` (not 401) = wrong-auth-scheme tripwire, not broken auth** — on single-host dual-auth-surface products, the app Bearer JWT hitting a *public-developer-API* path returns a 403 with a token message → conclude it's the wrong scheme for that path, not that the token is bad. *(§2.24 — Creatify)*
-26. **Onboarding gating can blank the whole live surface — an un-code-split bundle is the rescue** — when every route redirects to `/onboarding` for an incomplete tenant, no live traffic is harvestable → string-mine a single un-split SPA bundle (Omneky's 5.74 MB `index-*.js`) for the full API-path catalog + route table, and fill in confirmed schemas from the pre-onboarding-reachable endpoints (brand-setup/reference/account). Treat an un-split bundle as a gift, not a nuisance. *(§2.25 — Omneky)*
-27. **Probe Bearer vs cookie vs raw-token explicitly** — a JS-readable token cookie does NOT imply cookie-auth; on Creatify and Omneky the API rejects the raw cookie (`credentials:'include'` → `Failed to fetch` under `ACAO:*`) and accepts only an explicit `Authorization: Bearer` → probe all three (Bearer header / cookie / raw-token) to pin the real header model before mining. *(§2.26)*
-28. **Dynamic/runtime-constructed realtime hub URLs can't be recovered by bundle regex** — AdCreative's SignalR hub path is built at runtime in `initializeHub` with no static literal → record realtime *presence* + transport as confirmed, the URL + message contract as open (needs Pass 2). Don't report "no realtime" just because grep found no socket URL. *(§2.27 — AdCreative)*
+1. **Output that _looks_ like cookie/query data is blocked** (`[BLOCKED: Cookie/query string data]`) — a `javascript_tool` result with JWT-shaped strings, long base64, long hex, many UUIDs, or query-string substrings is blocked on the _returned string_, not on what the code does → run the returned value through a `SCRUB()` (and, when that's not enough, the `ULTRA()` regex) before returning. _(§2.1)_
+2. **`read_network_requests` only tracks AFTER its first call** — initial page-load requests are invisible (it starts capturing on first invocation) → install the fetch/XHR taps **before** navigation, or reload after the first call. _(§2.2)_
+3. **`read_network_requests` misses cross-origin XHRs + cache-served loads (GraphQL SPAs)** — it may not surface cross-origin API XHRs (e.g. `i.jasper.ai/gw/graphql` from `app.jasper.ai`), and on reload data is served from the Apollo/SWR cache so no request fires at all → don't conclude "no API calls"; pivot to the client cache and force a refetch to capture verbatim bodies. _(§2.2 corollary)_
+4. **`EventSource` taps miss `text/event-stream` over `fetch`** — many products read SSE-formatted bodies via `fetch().body`, not `EventSource`, so the ES tap returns empty even while streaming → always run **both** the EventSource tap and the fetch/streaming-body tap. _(§2.3)_
+5. **Long-poll buffers rotate fast on heartbeats** — heartbeats fly every few seconds and evict interesting frames from bounded buffers → skip frames smaller than ~350 bytes when storing, and dedupe events by `id` so retried polls don't re-add. _(§2.4)_
+6. **`find` returns ghost duplicates in dynamic UIs** — modern apps render a textarea+button pair twice (visible+hidden, or in a portal); `find` returns both refs but only one is wired → default to coordinate clicks for action-bearing buttons; use refs only for stable structural elements. _(§2.5)_
+7. **`Enter` in textareas doesn't submit; contentEditable divs aren't textareas** — the submit handler is bound to a button, not the keypress, and many apps use `contentEditable` divs as fake textareas (`form_input` won't work) → click the submit button by coordinate after typing; on contentEditable use coordinate-click + `computer.type`. _(§2.6)_
+8. **`wait` caps at 10s** — a single `wait` won't hold longer → batch multiple `wait` calls, or use `browser_batch` with several `wait` actions; inside JS, `await new Promise(r => setTimeout(r, 4000))` works for ≤45s waits. _(§2.7)_
+9. **Don't dump raw tokens** — the harness (correctly) blocks raw `document.cookie` / `Authorization` dumps even when the user is OK seeing structure → inspect **shape** only (lengths, names, decoded JWT payload with PII redacted), never raw values. _(§2.8)_
+10. **`response.clone()` chains break if you wrap fetch twice** — a `clone()` from an inner wrapper may not work in the outer → install **one** tap and do everything in it; don't layer multiple body interceptors. _(§2.9)_
+11. **Sleep/wait is never your loop** — if you're doing `wait → check → wait → check`, server-side state is more reliable than babysitting client polling → switch to: trigger action → wait once → query the trajectory/history endpoint directly. _(§2.10)_
+12. **JS context is wiped on every full navigation** — `window.__TOK/__TAP/__RAW/__probe/__DUMP/...` are all gone after `navigate()`, `location.reload()`, or any anchor click triggering a full load → re-install the tap after every navigation, re-grab the token from localStorage, and use idempotent init (`window.__X = window.__X || {...}`). SPA-internal `pushState`-routed nav preserves context (keep your taps), **but** `history.pushState` + `dispatchEvent(new PopStateEvent('popstate'))` may trigger a _full_ nav in Next.js App Router — don't rely on programmatic SPA-internal nav; use real link clicks or just navigate. _(§2.11)_
+13. **WebSocket tap doesn't catch sockets created before installation** — a library (Pusher, Ably) that inits its WebSocket at app-boot via `window.WebSocket` is invisible to a wrap installed after that point → use the library-specific event-bus tap (e.g. Pusher `bind_global`) instead. _(§2.12)_
+14. **Page renderer freezes during agent generation** — `find`, `screenshot`, `read_page` wait for `document_idle` and hang while the page constantly mutates (streaming output) → for liveness checks during generation, use `javascript_tool` (no idle wait). _(§2.13)_
+15. **`cloned.text()` never resolves on long-poll bodies** — the body tap reads via `response.clone().text()`, which only resolves on response _close_; a held-open long-poll never closes, so the promise never resolves → capturing chunks-as-they-arrive needs `getReader()`-based decoding; for most RE, skip streaming-chunk capture and hit the `/history` endpoint instead. _(§2.14)_
+16. **Be aggressive with body-capture limits** — when wrapping fetch, slice the response-body capture to 8000–12000 chars; the tap entry's `resp` field is for previewing only → anything bigger goes into a `window.__RAW_*` global and is paged through (the global is for the full body). _(§2.15)_
+17. **Output-truncation tells** — the harness truncates very long outputs at ~3–5KB; watch for `[TRUNCATED]` markers → either page-through via `slice()` or write the data to a file via the Write tool (skip the JS round-trip). _(§2.16)_
+18. **Slices get truncated even at 3000 chars** — empirically the harness truncates each slice output to ~2.5–3KB _regardless of slice size_ → use **3000-char slices** as a defensive default and scrub aggressively before returning; for 100KB+ bodies switch to the aggregate-summary-from-window pattern (write decoded summaries + samples, not verbatim bodies). _(§2.17)_
+19. **`tabs_context_mcp` is required at the start of any session** — tab IDs from previous conversations are stale and won't work → always call `mcp__claude-in-chrome__tabs_context_mcp` first to confirm tab IDs and that the tab group is alive. _(§2.18)_
+20. **`read_network_requests` filters URL _substring_, not regex** — pass `urlPattern: "/api/"` for a literal substring match; no regex, no globs → don't try `urlPattern: "/api/*"` (it's treated as the literal substring `/api/*`, rarely what you want). _(§2.19)_
+21. **`read_network_requests` is cumulative within a domain** — the panel accumulates across the session and only clears on cross-domain nav OR when you pass `clear: true` → for per-route mining, clear the panel before navigating to each new route (`{tabId, urlPattern: "...", clear: true}`) so the request set is scoped to that page. _(§2.20)_
+22. **`browser_batch` outputs are individually capped, not jointly** — each item's output is independently capped (~3–5KB) → fit ~10 `slice()` calls in one batch for ~30KB total across separate output blocks (each item still truncates individually if too long). _(§2.21)_
+23. **A SyntaxError inside a batch fails the rest of the batch** — one bad `javascript_tool` item in a `browser_batch` can stop the rest from executing → test JS expressions in isolation before batching them. _(§2.22)_
+24. **CORS-walled serverless RPC is a hard read-only stop** — cross-origin fetch from the SPA origin to a Cloud Functions / Cloud-Run RPC host fails preflight (`TypeError: Failed to fetch`); POST-only RPC bodies/headers aren't probeable read-only → mine the **Firestore IndexedDB cache** (`collectionParents` census, `remoteDocuments` cached bodies+schemas, `targets` active subscriptions) + `redux-persist` slices; a Firestore REST `GET documents/users/{uid}` (200) confirms the Bearer model, `listCollectionIds` (403) is the negative control proving security rules are active. _(§2.23 — Plai)_
+25. **`403 "Token is not valid."` (not 401) = wrong-auth-scheme tripwire, not broken auth** — on single-host dual-auth-surface products, the app Bearer JWT hitting a _public-developer-API_ path returns a 403 with a token message → conclude it's the wrong scheme for that path, not that the token is bad. _(§2.24 — Creatify)_
+26. **Onboarding gating can blank the whole live surface — an un-code-split bundle is the rescue** — when every route redirects to `/onboarding` for an incomplete tenant, no live traffic is harvestable → string-mine a single un-split SPA bundle (Omneky's 5.74 MB `index-*.js`) for the full API-path catalog + route table, and fill in confirmed schemas from the pre-onboarding-reachable endpoints (brand-setup/reference/account). Treat an un-split bundle as a gift, not a nuisance. _(§2.25 — Omneky)_
+27. **Probe Bearer vs cookie vs raw-token explicitly** — a JS-readable token cookie does NOT imply cookie-auth; on Creatify and Omneky the API rejects the raw cookie (`credentials:'include'` → `Failed to fetch` under `ACAO:*`) and accepts only an explicit `Authorization: Bearer` → probe all three (Bearer header / cookie / raw-token) to pin the real header model before mining. _(§2.26)_
+28. **Dynamic/runtime-constructed realtime hub URLs can't be recovered by bundle regex** — AdCreative's SignalR hub path is built at runtime in `initializeHub` with no static literal → record realtime _presence_ + transport as confirmed, the URL + message contract as open (needs Pass 2). Don't report "no realtime" just because grep found no socket URL. _(§2.27 — AdCreative)_
 
 ### The escape snippets (paste verbatim)
 
@@ -274,15 +294,17 @@ The Chrome-MCP browser-driving layer has ~27 recurring failure modes; every one
 // Pass 1: fire
 (() => {
   window.__done = false;
-  fetch(url, { headers }).then(r => r.text()).then(t => {
-    window.__raw = t;
-    window.__done = true;
-  });
-  return 'fired';
-})()
-
-// Pass 2..N: poll
-(() => 'done=' + window.__done + ' len=' + (window.__raw||'').length)()
+  fetch(url, { headers })
+    .then((r) => r.text())
+    .then((t) => {
+      window.__raw = t;
+      window.__done = true;
+    });
+  return "fired";
+})()(
+  // Pass 2..N: poll
+  () => "done=" + window.__done + " len=" + (window.__raw || "").length,
+)();
 ```
 
 **Window-storage + pagination — when a fetched body is larger than the harness output budget (~3–5KB), store it in a global and page through it; use 3000-char slices to leave headroom for the truncation tell, and scrub each slice before returning (§1.9):**
@@ -292,35 +314,38 @@ The Chrome-MCP browser-driving layer has ~27 recurring failure modes; every one
 (async () => {
   const r = await fetch(url, { headers });
   window.__RAW = await r.text();
-  return 'len=' + window.__RAW.length;
-})()
-
-// Pass 2..N: slice
-(() => window.__RAW.slice(0, 3000))()
-(() => window.__RAW.slice(3000, 6000))()
+  return "len=" + window.__RAW.length;
+})()(
+  // Pass 2..N: slice
+  () => window.__RAW.slice(0, 3000),
+)()(() => window.__RAW.slice(3000, 6000))();
 // etc.
 ```
 
 **SCRUB — neutralise blocked patterns on any string returned from `javascript_tool` (§2.1):**
 
 ```js
-const SCRUB = (s) => String(s||'')
-  .replace(/eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+/g, '<jwt>')
-  .replace(/[A-Za-z0-9+/]{40,}={0,2}/g, '<b64>')
-  .replace(/data:image\/[^"]+/g, '<data-image>')
-  .replace(/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/g, '<uuid>')
-  .replace(/[a-f0-9]{32,}/g, '<hex>')
-  .replace(/(user|org|ins|sess|cli)_[A-Za-z0-9]{20,}/g, '.$1id.')   // Clerk-style IDs
-  .replace(/\+91\d{10}/g, '<phone-in>')                            // Indian phone numbers
-  .replace(/\+1\d{10}/g, '<phone-us>')                             // US phone numbers
-  .replace(/\b\d{10,15}\b/g, '<phone>')                            // generic numeric phone
-  .replace(/[?&]([a-z_]+)=([^&\s"]+)/gi, (_,k,v) => '?'+k+'=<v>');
+const SCRUB = (s) =>
+  String(s || "")
+    .replace(/eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+/g, "<jwt>")
+    .replace(/[A-Za-z0-9+/]{40,}={0,2}/g, "<b64>")
+    .replace(/data:image\/[^"]+/g, "<data-image>")
+    .replace(
+      /[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/g,
+      "<uuid>",
+    )
+    .replace(/[a-f0-9]{32,}/g, "<hex>")
+    .replace(/(user|org|ins|sess|cli)_[A-Za-z0-9]{20,}/g, ".$1id.") // Clerk-style IDs
+    .replace(/\+91\d{10}/g, "<phone-in>") // Indian phone numbers
+    .replace(/\+1\d{10}/g, "<phone-us>") // US phone numbers
+    .replace(/\b\d{10,15}\b/g, "<phone>") // generic numeric phone
+    .replace(/[?&]([a-z_]+)=([^&\s"]+)/gi, (_, k, v) => "?" + k + "=<v>");
 ```
 
 **ULTRA scrub — last resort when SCRUB still isn't enough (agent-generated content matching the blocklist); loses JSON braces but keeps structural information (§2.1, §4.2):**
 
 ```js
-const ULTRA = (s) => String(s||'').replace(/[^a-zA-Z0-9 _.,:!?\-/]/g,'.');
+const ULTRA = (s) => String(s || "").replace(/[^a-zA-Z0-9 _.,:!?\-/]/g, ".");
 ```
 
 ---
@@ -330,10 +355,10 @@ const ULTRA = (s) => String(s||'').replace(/[^a-zA-Z0-9 _.,:!?\-/]/g,'.');
 When a surface is genuinely closed read-only, the failure mode is a recovery cue, not a stop. Each row pairs the wall with the pivot; the runnable ones carry the exact escape.
 
 | When X is walled | …try Y | Anchor |
-|---|---|---|
+| --- | --- | --- |
 | **CORS-walled serverless RPC** (Cloud Functions / Cloud-Run, POST-only, preflight `TypeError: Failed to fetch`) | mine the **Firestore IndexedDB cache** — `collectionParents` (census), `remoteDocuments` (cached bodies+schemas), `targets` (active listeners) + `redux-persist` slices. `GET documents/users/{uid}` (200) confirms Bearer; `listCollectionIds` (403) is the negative control proving rules are active | §2.23 — Plai |
 | **Onboarding gate blanks the surface** (every route → `/onboarding`, no live traffic) | string-mine the **un-code-split bundle** for the full API-path catalog + route table; fill confirmed schemas from pre-onboarding-reachable endpoints (brand-setup / reference / account) | §2.25 — Omneky |
-| **`403 "Token is not valid."`** on a path | NOT broken auth — it's a **wrong-auth-scheme tripwire**: the app Bearer JWT is hitting a *public-developer-API* path on a dual-auth host. Switch scheme for that path, don't discard the token | §2.24 — Creatify |
+| **`403 "Token is not valid."`** on a path | NOT broken auth — it's a **wrong-auth-scheme tripwire**: the app Bearer JWT is hitting a _public-developer-API_ path on a dual-auth host. Switch scheme for that path, don't discard the token | §2.24 — Creatify |
 | **Sleep/wait loop** (`wait → check → wait → check`) | trigger the action, **wait once, then query the history/trajectory endpoint** directly — server-side state beats babysitting client-side polling | §2.10 |
 | **`cloned.text()` never resolves** (held-open long-poll) | don't chase streaming chunks — hit the `/history` (or `/state`, `/snapshot`, `/page-metadata`) endpoint instead | §2.14 / §1.8 |
 | **JS-readable token cookie** tempts `credentials:'include'` | a readable cookie ≠ cookie-auth — probe **Bearer header / cookie / raw-token** all three to pin the real header model; the API often rejects the raw cookie under `ACAO:*` and requires explicit `Authorization: Bearer` | §2.26 |
@@ -347,35 +372,39 @@ When a surface is genuinely closed read-only, the failure mode is a recovery cue
 ```js
 (async () => {
   // For Bearer-token products:
-  const tok = JSON.parse(localStorage.getItem('sb-auth-auth-token')).access_token;
-  const id = '<entity-uuid>';
-  const r = await fetch('https://api.example.com/.../' + id + '/history', {
-    headers: { 'authorization': 'Bearer ' + tok }
+  const tok = JSON.parse(
+    localStorage.getItem("sb-auth-auth-token"),
+  ).access_token;
+  const id = "<entity-uuid>";
+  const r = await fetch("https://api.example.com/.../" + id + "/history", {
+    headers: { authorization: "Bearer " + tok },
   });
   return await r.json();
-})()
+})();
 ```
 
 For same-origin cookie-auth products (Clerk, Next.js axios proxies):
 
 ```js
 (async () => {
-  const r = await fetch('/api/conversations/page-metadata?agentIds=<uuid>', { credentials: 'include' });
+  const r = await fetch("/api/conversations/page-metadata?agentIds=<uuid>", {
+    credentials: "include",
+  });
   return await r.json();
-})()
+})();
 ```
 
 ---
 
 ## GraphQL read-side mining + classification fingerprint tables
 
-Two reusable assets for the `session` dimension (ingestion §9.4 runtime taps). Asset 1 is an **executable read-side recipe** for any Apollo/GraphQL SPA; Asset 2 is a set of **classification tables** that turn a raw observation (a storage key, a host, an envelope shape) into a *named* stack finding. Every code block below is runnable verbatim in the page console / in-page tap — do not paraphrase it into prose.
+Two reusable assets for the `session` dimension (ingestion §9.4 runtime taps). Asset 1 is an **executable read-side recipe** for any Apollo/GraphQL SPA; Asset 2 is a set of **classification tables** that turn a raw observation (a storage key, a host, an envelope shape) into a _named_ stack finding. Every code block below is runnable verbatim in the page console / in-page tap — do not paraphrase it into prose.
 
 ---
 
 ### 1. The Apollo-cache read-side recipe (the richest Pass-1 GraphQL source)
 
-> **Why this is the richest Pass-1 GraphQL source.** For Apollo-backed SPAs (look for `window.__APOLLO_CLIENT__`), the **normalized client cache is the single richest read-only source** — often better than network capture, which may miss cross-origin GraphQL XHRs and won't fire at all when data is served from cache on reload (a real run on Jasper saw the network panel show only telemetry because the reload was served entirely from the Apollo cache). The cache holds a normalized entity census, every entity's field schema, and enum distributions across all entities — the whole read-side data model — with **zero network cost and no state change**. Introspection is almost always disabled in prod (`{ __schema { ... } }` → `400 "introspection is not allowed"`), so the cache census + verbatim wire-body capture *is* the schema-recovery path, not a fallback.
+> **Why this is the richest Pass-1 GraphQL source.** For Apollo-backed SPAs (look for `window.__APOLLO_CLIENT__`), the **normalized client cache is the single richest read-only source** — often better than network capture, which may miss cross-origin GraphQL XHRs and won't fire at all when data is served from cache on reload (a real run on Jasper saw the network panel show only telemetry because the reload was served entirely from the Apollo cache). The cache holds a normalized entity census, every entity's field schema, and enum distributions across all entities — the whole read-side data model — with **zero network cost and no state change**. Introspection is almost always disabled in prod (`{ __schema { ... } }` → `400 "introspection is not allowed"`), so the cache census + verbatim wire-body capture _is_ the schema-recovery path, not a fallback.
 
 ### 1a. Entity census, field schema, and enum distributions
 
@@ -384,12 +413,19 @@ Dump the normalized cache, count entities per type, decode one entity of a type
 ```js
 // 1) entity census — what types exist and how many
 const ex = window.__APOLLO_CLIENT__.cache.extract();
-const counts = {}; Object.keys(ex).forEach(k => { const t = k.split(':')[0]; counts[t] = (counts[t]||0)+1; });
+const counts = {};
+Object.keys(ex).forEach((k) => {
+  const t = k.split(":")[0];
+  counts[t] = (counts[t] || 0) + 1;
+});
 // 2) decode one entity of a type = its field schema
-const sample = ex[Object.keys(ex).find(k => k.startsWith('Task:'))];
+const sample = ex[Object.keys(ex).find((k) => k.startsWith("Task:"))];
 // 3) enum distributions across all entities of a type
-const tasks = Object.keys(ex).filter(k=>k.startsWith('Task:')).map(k=>ex[k]);
-const dist = f => tasks.reduce((c,t)=>(c[t[f]]=(c[t[f]]||0)+1,c),{});
+const tasks = Object.keys(ex)
+  .filter((k) => k.startsWith("Task:"))
+  .map((k) => ex[k]);
+const dist = (f) =>
+  tasks.reduce((c, t) => ((c[t[f]] = (c[t[f]] || 0) + 1), c), {});
 ```
 
 ### 1b. List observable queries (operation names + variables + AST)
@@ -397,11 +433,15 @@ const dist = f => tasks.reduce((c,t)=>(c[t[f]]=(c[t[f]]||0)+1,c),{});
 Recover every live operation's name, variable keys, and selection-set AST — even when the production build has stripped the query source text:
 
 ```js
-const arr = [...window.__APOLLO_CLIENT__.getObservableQueries('all').values()];
-arr.map(q => { const d = q.query || q.options.query;
-  return { name: d.definitions.find(z=>z.operation)?.name?.value,
-           vars: Object.keys(q.variables||{}),
-           sel: d.definitions[0].selectionSet /* walk for fields */ }; });
+const arr = [...window.__APOLLO_CLIENT__.getObservableQueries("all").values()];
+arr.map((q) => {
+  const d = q.query || q.options.query;
+  return {
+    name: d.definitions.find((z) => z.operation)?.name?.value,
+    vars: Object.keys(q.variables || {}),
+    sel: d.definitions[0].selectionSet /* walk for fields */,
+  };
+});
 ```
 
 ### 1c. Force a refetch to capture verbatim query/mutation text off the wire
@@ -409,7 +449,7 @@ arr.map(q => { const d = q.query || q.options.query;
 Production strips `DocumentNode.loc.source.body`, but the **POST body still contains the full query**. Install a fetch tap that keeps `init.body`, then **force a re-send** so the tap captures the exact query string + fragments + variables:
 
 ```js
-await window.__APOLLO_CLIENT__.refetchQueries({ include: ['Web_Library'] });
+await window.__APOLLO_CLIENT__.refetchQueries({ include: ["Web_Library"] });
 ```
 
 The fetch tap then holds the verbatim query/mutation text + fragments + variables for that operation. (This is how the Jasper `Web_Library` / `Web_CreateAppSnapshot` queries and the 11-type `ContextItem` union were recovered.)
@@ -418,7 +458,7 @@ The fetch tap then holds the verbatim query/mutation text + fragments + variable
 
 ---
 
-### 2. Cross-cutting inference / fingerprint tables (classify what a finding *is*)
+### 2. Cross-cutting inference / fingerprint tables (classify what a finding _is_)
 
 These tables let a raw observation be **classified** — a storage key prefix names the stack, a key+host pair names the auth provider, an envelope shape names the backend framework, and the realtime-trap table stops a run concluding after one channel.
 
@@ -427,7 +467,7 @@ These tables let a raw observation be **classified** — a storage key prefix na
 Inferences from `localStorage` / `sessionStorage` / cookie / IndexedDB **key names alone** (no values):
 
 | Prefix | Stack signal |
-|--------|--------------|
+| --- | --- |
 | `sb-*-auth-*` | Supabase Auth |
 | `firebase:*`, `firebaseLocalStorage` (in IndexedDB) | Firebase Auth + Firestore |
 | `clerk-*`, `__clerk*` | **Clerk** |
@@ -458,7 +498,7 @@ Inferences from `localStorage` / `sessionStorage` / cookie / IndexedDB **key nam
 ### 2.2 Auth-provider fingerprint (storage keys + hosts → provider)
 
 | Provider pattern | Tells (storage keys + hosts + token shape) |
-|------------------|--------------------------------------------|
+| --- | --- |
 | **Supabase Auth, gateway-validated** | `sb-*-auth-token` in localStorage, HS256, **no `apikey` header** on calls (= a gateway sits in front) |
 | **Firebase Auth, IndexedDB-stored** | `firebaseLocalStorageDb` IndexedDB object store, RS256, ~1-hour token, auto-refreshed |
 | **Clerk** (standard) | `__clerk_db_jwt`, `__session` cookie, `clerk-*` localStorage |
@@ -469,32 +509,21 @@ Inferences from `localStorage` / `sessionStorage` / cookie / IndexedDB **key nam
 | **Self-hosted IdentityServer (Duende/IdentityServer4) OIDC** | `at+jwt` RS256 carrying short claims + classic WS-Federation claim URIs; very long TTL (~180 d); token is a **field inside a localStorage JSON blob** (`oidc-client-ts` idiom), not a bare key |
 | **Self-hosted JWT** | Custom claims, in-house signing, often HS256 (worst posture: multi-year exp, single shared secret across a host fleet, no refresh) |
 
-**Auth-token-location taxonomy** (*where* the token lives is a distinct axis from *who* issued it — it drives the XSS-reachability read):
+**Auth-token-location taxonomy** (_where_ the token lives is a distinct axis from _who_ issued it — it drives the XSS-reachability read):
 
 | Token location | Shape / retrieval tell | XSS-reachable? |
-|----------------|------------------------|----------------|
+| --- | --- | --- |
 | **Bearer-from-cookie** (JS-readable cookie → explicit `Authorization: Bearer`) | Non-HttpOnly cookie the SPA reads via `document.cookie` and re-attaches as a Bearer header; `credentials:'include'` with the raw cookie is **rejected** (forced by `ACAO:*`). Probe Bearer vs cookie vs raw-token to confirm. | Yes |
-| **Token-in-localStorage-blob** | Token is a *field inside a JSON object* in localStorage (`JSON.parse` then read `.access_token`), not a bare key — OIDC `oidc-client-ts` idiom. | Yes |
+| **Token-in-localStorage-blob** | Token is a _field inside a JSON object_ in localStorage (`JSON.parse` then read `.access_token`), not a bare key — OIDC `oidc-client-ts` idiom. | Yes |
 | **Opaque session cookie** (HttpOnly, same-origin, auto-attached) | No `Authorization` header anywhere on the SPA; the cookie auto-attaches because all API is same-origin. **The negative finding is the tell.** | No |
 | **Firebase ID token in IndexedDB** | `firebaseLocalStorageDb` → `stsTokenManager.accessToken`; Firebase Modular SDK v9+ store; short-lived (3600 s) + auto-refreshed. Confirm the Bearer model with one Firestore REST `GET documents/users/{uid}`. | Partially (IDB is JS-reachable, but token is short-lived + refreshed) |
 
-> **Same-origin replay — mine an opaque-session-cookie API without ever reading the cookie.** When the
-> taxonomy lands on **opaque session cookie** above (no `Authorization`, no JS-readable token, no CSRF
-> meta — a server-session app: Symfony/PHP, Rails, Django, classic ASP.NET), the *absence* in JS storage
-> **is** the positive fingerprint, not a dead end. Mine it with **in-page `fetch(path, {credentials:'same-origin'})`
-> replay from the app origin**: the browser auto-attaches the httpOnly cookie, so once the in-page tap has
-> revealed an endpoint you replay it for verbatim read bodies (and, Pass-2-gated, write bodies) **without
-> ever reading, returning, or writing the cookie value** — the secret never reaches the harness, which is
-> what keeps this inside the §7 ethics line. You do **not** need raw CDP `Network` for this case (it would
-> only add the literal `Cookie`/request headers, which you'd redact anyway); the in-page fetch/XHR tap +
-> same-origin replay is the complete tool. Reach for raw CDP only to reconstruct exact request headers for
-> an *out-of-browser* reproducer, or for non-`fetch` transports (WS frames). (Origin tag: Akeneo — httpOnly
-> `BAPID` Symfony session, 54-path internal API mined entirely by same-origin replay.)
-
-**Key claims to look for in the JWT payload** (decode *structure* only — redact `sub`/`email`/`session_id`/`provider_id`, never log the signature):
+> **Same-origin replay — mine an opaque-session-cookie API without ever reading the cookie.** When the taxonomy lands on **opaque session cookie** above (no `Authorization`, no JS-readable token, no CSRF meta — a server-session app: Symfony/PHP, Rails, Django, classic ASP.NET), the _absence_ in JS storage **is** the positive fingerprint, not a dead end. Mine it with **in-page `fetch(path, {credentials:'same-origin'})` replay from the app origin**: the browser auto-attaches the httpOnly cookie, so once the in-page tap has revealed an endpoint you replay it for verbatim read bodies (and, Pass-2-gated, write bodies) **without ever reading, returning, or writing the cookie value** — the secret never reaches the harness, which is what keeps this inside the §7 ethics line. You do **not** need raw CDP `Network` for this case (it would only add the literal `Cookie`/request headers, which you'd redact anyway); the in-page fetch/XHR tap + same-origin replay is the complete tool. Reach for raw CDP only to reconstruct exact request headers for an _out-of-browser_ reproducer, or for non-`fetch` transports (WS frames). (Origin tag: Akeneo — httpOnly `BAPID` Symfony session, 54-path internal API mined entirely by same-origin replay.)
+
+**Key claims to look for in the JWT payload** (decode _structure_ only — redact `sub`/`email`/`session_id`/`provider_id`, never log the signature):
 
 | Claim | What it tells you |
-|-------|-------------------|
+| --- | --- |
 | `iss` | Issuer URL — names the auth provider (a custom domain → enterprise tier) |
 | `org_id`, `org_slug`, `org_role`, `org_permissions` | **Tenant context inside the token** — backend does RBAC from the verified JWT alone, no separate org lookup (standard with Clerk Orgs) |
 | `azp` | Authorised party — typically the SPA origin |
@@ -504,7 +533,7 @@ Inferences from `localStorage` / `sessionStorage` / cookie / IndexedDB **key nam
 ### 2.3 API-envelope / style fingerprint (response shape → backend framework)
 
 | Style | Tells (envelope / endpoint shape) |
-|-------|-----------------------------------|
+| --- | --- |
 | **JSON-Schema-driven (Huma / similar)** | Every response carries inline `"$schema": "https://api.x.com/<TypeName>OutputBody.json"`; RFC 7807 error envelope |
 | **Hand-rolled FastAPI / Express** | No `$schema` field; minimal error shape (`{detail: "..."}`) |
 | **GraphQL** | Single `/graphql` endpoint, query/variables in body, often `apollo-cache-persist` storage |
@@ -521,14 +550,14 @@ Inferences from `localStorage` / `sessionStorage` / cookie / IndexedDB **key nam
 
 ### 2.4 The multi-channel-realtime trap (don't conclude after finding one)
 
-A single product often uses **multiple** realtime channels with different roles — install **all** taps simultaneously *before* triggering, and let each make its own claim. Two architectural patterns to name first: **content-streaming** (frames carry the actual deltas — text, edits) vs **cache-coherence-ping** (frames carry only metadata like `{job_id, step_num, function_name}`; the SPA re-fetches a REST endpoint after each ping).
+A single product often uses **multiple** realtime channels with different roles — install **all** taps simultaneously _before_ triggering, and let each make its own claim. Two architectural patterns to name first: **content-streaming** (frames carry the actual deltas — text, edits) vs **cache-coherence-ping** (frames carry only metadata like `{job_id, step_num, function_name}`; the SPA re-fetches a REST endpoint after each ping).
 
 **Channel-role split (the trap):** a realtime product commonly runs (1) a content/op stream **plus** (2) a REST refetch for snapshots **plus** (3) a separate presence channel — three channels, three roles. **A dashboard that is REST-only (no WS, no SSE, no long-poll) is a real architectural signal, not a miss** — record the negative.
 
 **Streaming-protocol detection table:**
 
 | Pattern | Tells (host / content-type / frame shape) |
-|---------|-------------------------------------------|
+| --- | --- |
 | **WebSocket** | `wss://` URLs in the network panel — wrap the `WebSocket` constructor |
 | **Server-Sent Events via `EventSource`** | `text/event-stream` content-type **and** `EventSource` constructor used — wrap `EventSource` |
 | **HTTP long-poll, SSE-formatted body via `fetch`** | Repeated GETs with `?last_*=` / `?cursor=`; `text/event-stream` content-type but **no** `EventSource` constructor — fetch response-body tap |