@sun-asterisk/sungen 3.2.32 → 3.2.34-beta.1

package/src/harness/sensors.ts

@@ -11,6 +11,9 @@ import * as path from 'path';
 import { parse as parseYaml } from 'yaml';
 import { ScenarioInfo, ViewpointEntry, idPrefix } from './parse';
 import { readTextFile } from './read-text';
+import { keywordHit, hasKeyword } from './keyword-match';
+import { parsePriority } from './viewpoint-priority';
+import { countedAssertions } from './counted-assertions';
 
 // Business-critical category keywords (matched by CONTAINMENT against the VP category, so a
 // compound category like LIST-DISPLAY / ADD-TO-CART / PRODUCT-DISCOVERY classifies correctly).
@@ -86,18 +89,11 @@ export function loadCatalog(): Catalog {
   return parseYaml(readTextFile(p)) as Catalog;
 }
 
-// Word-aware keyword match: `\b<kw>(s|es|ed|ing)?\b`, so a keyword matches whole words (plus
-// simple plural/verb suffixes) but NOT as a substring of a larger word — e.g. `form` must not
-// match inside `Format` or `@platform`, while `product` still matches `products`. Multi-word
-// keywords ("add to cart", "is hidden") match the phrase with a boundary at each end.
-const wordRe = (kw: string) => {
-  const esc = kw.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  return new RegExp(`\\b${esc}(?:s|es|ed|ing)?\\b`);
-};
-const has = (haystacks: string[], kw: string) => {
-  const re = wordRe(kw);
-  return haystacks.some((h) => re.test(h));
-};
+// Word-aware keyword match — one rule for every sensor, in ./keyword-match (#776). A keyword
+// matches at a word START but may carry any suffix, so `form` does not match inside `Format` or
+// `@platform` while `submit` still matches `submitted`. The old local copy anchored BOTH ends,
+// which silently dropped every inflected true positive; see that module for the measurements.
+const has = hasKeyword;
 
 // ---------- Sensor 1: Viewpoint Gate (catalog-driven) ----------
 
@@ -112,6 +108,13 @@ export interface GateResult {
   coverageRatio: number;
   gaps: { theme: string; keywords: string[]; status: 'missing' | 'shallow' }[];
   universalGaps: string[];
+  /**
+   * WHICH scenario covered each satisfied theme, and on which keyword — the audit's second line of
+   * defence against a bogus coverage claim (#776). A bare count ("themes 3/3") gives a reviewer
+   * nothing to check, so a nonsense match survives; naming the evidence makes it obvious on sight.
+   * Mirrors how the Claim-Proof section already names the scenario behind each claim.
+   */
+  coveredBy: { theme: string; by: string; keyword: string }[];
 }
 
 /**
@@ -166,20 +169,36 @@ export function viewpointGate(scenarios: ScenarioInfo[], viewpoints: ViewpointEn
 
   const evidence = { hits: best, runnerUp };
   const gaps: GateResult['gaps'] = [];
+  const coveredBy: GateResult['coveredBy'] = [];
   let total = 0, covered = 0;
   if (pageType) {
     for (const t of catalog.page_types[pageType].must_cover) {
       total++;
       // Scenarios that cover this theme by keyword (include @manual — a manual
       // scenario with a real assertion still covers the viewpoint for design).
-      const coverers = scenarios.filter((s) => t.keywords.some((k) => s.haystack.includes(k.toLowerCase())));
+      // Word-aware since #776: a substring match let `information` satisfy `format-boundary`.
+      const coverers = scenarios.filter((s) => t.keywords.some((k) => keywordHit(s.haystack, k)));
       if (coverers.length === 0) { gaps.push({ theme: t.theme, keywords: t.keywords, status: 'missing' }); continue; }
       // A theme WITHOUT `depth:` is visibility/navigation — landing/seeing/leaving IS the
       // assertion, so mere presence covers it. Only DATA-correctness themes (depth.requires:
       // data-assertion) need a data assertion to count as deeply covered.
       const needsDepth = t.depth?.requires === 'data-assertion';
-      if (!needsDepth) { covered++; continue; }
-      if (coverers.some((s) => s.hasDataAssertion)) covered++;
+      // Name the evidence for whichever scenario actually carries the theme — the one with the
+      // data assertion when depth is required, since that is the scenario the credit rests on.
+      const proof = (needsDepth ? coverers.find((s) => s.hasDataAssertion) : undefined) ?? coverers[0];
+      const credit = (): void => {
+        covered++;
+        coveredBy.push({
+          theme: t.theme,
+          by: proof.haystack,
+          // `proof` came out of `coverers`, which was filtered on this same predicate, so the find
+          // always lands — the `!` states that rather than inventing a fallback keyword that would
+          // misattribute the credit if the invariant ever broke.
+          keyword: t.keywords.find((k) => keywordHit(proof.haystack, k))!,
+        });
+      };
+      if (!needsDepth) { credit(); continue; }
+      if (coverers.some((s) => s.hasDataAssertion)) credit();
       else gaps.push({ theme: t.theme, keywords: t.keywords, status: 'shallow' });
     }
   }
@@ -203,6 +222,7 @@ export function viewpointGate(scenarios: ScenarioInfo[], viewpoints: ViewpointEn
     coverageRatio: total ? covered / total : 1,
     gaps,
     universalGaps,
+    coveredBy,
   };
 }
 
@@ -269,7 +289,7 @@ export function assertionDepth(
   const isDismissBehavior = (s: ScenarioInfo) =>
     /\bis hidden\b|\bare hidden\b|\bdismiss|\bdisappear|\bno longer (visible|shown|present|displayed)\b|\bcloses? the (modal|dialog|popup|overlay|panel|menu)\b/.test(s.haystack);
   const isDepthRequired = (s: ScenarioInfo) =>
-    s.category !== 'NAV' && !isDismissBehavior(s) && depthKeywords.some((k) => s.haystack.includes(k.toLowerCase()));
+    s.category !== 'NAV' && !isDismissBehavior(s) && depthKeywords.some((k) => keywordHit(s.haystack, k));
 
   const required = nonManual.filter(isDepthRequired);
   const reqShallow = required.filter((s) => s.shallow);
@@ -347,7 +367,7 @@ export function flowCoveredThemes(
 ): { theme: string; flow: string }[] {
   const out: { theme: string; flow: string }[] = [];
   for (const g of gaps) {
-    const hit = flowScenarios.find((s) => s.deep && g.keywords.some((k) => s.haystack.includes(k.toLowerCase())));
+    const hit = flowScenarios.find((s) => s.deep && g.keywords.some((k) => keywordHit(s.haystack, k)));
     if (hit) out.push({ theme: g.theme, flow: hit.flow });
   }
   return out;
@@ -394,7 +414,8 @@ export function flowRegressionDepth(scenarios: ScenarioInfo[]): FlowDepthResult
 export interface OracleStrengthResult {
   weak: { name: string; hint: string; code?: string }[];   // facet-by-name-substring, or URL-only (code ORACLE-URL-ONLY)
   facetClaims: number;                       // scenarios that touch a category/brand facet (denominator)
-  ratio: number;                             // 1 - weak/facetClaims (1 when none) — caps businessDepth
+  weakFacet: number;                         // the facet-class subset of `weak` — the only numerator `facetClaims` denominates
+  ratio: number;                             // 1 - weakFacet/facetClaims, clamped 0..1 (1 when no facet claim) — caps businessDepth
 }
 
 // "see all [<item name/title>] ... contain(s) {{<facet>.term}}" — asserting every item's NAME carries
@@ -429,9 +450,11 @@ export function oracleStrength(scenarios: ScenarioInfo[]): OracleStrengthResult
       hint: `every \`Then\` is a URL assertion${guardLike ? ' on a permission / guard scenario' : ''} — it proves the router pushed a path, not that the page rendered for this user${guardLike ? ', and this is exactly the scenario a late 403 redirect turns falsely green' : ''}. Give the page selector an \`anchor:\` (a heading/landmark only the rendered page has) — one line per screen, and every \`see [X] page\` on it becomes a content oracle — or add a content assertion after it.`,
     });
   }
+  let weakFacet = 0;
   for (const s of scenarios) {
     if (s.manual) continue; // a @manual facet check is a deliberate deferral, not a weak automated oracle
     if (WEAK_FACET_ORACLE.test(s.stepsText)) {
+      weakFacet++;
       weak.push({
         name: s.name.slice(0, 80),
         hint: 'asserting every item NAME contains a category/brand term does not prove facet membership — assert the results-page TITLE/header carries the facet, a detail-page facet field, or an API/DB oracle; or defer the exhaustive check to @manual:M2.',
@@ -439,7 +462,17 @@ export function oracleStrength(scenarios: ScenarioInfo[]): OracleStrengthResult
     }
   }
   const facetClaims = scenarios.filter((s) => FACET_REF.test(s.stepsText) || FACET_REF.test(s.name)).length;
-  return { weak, facetClaims, ratio: facetClaims ? 1 - weak.length / Math.max(1, facetClaims) : 1 };
+  // Only the FACET class is denominated by `facetClaims`. `weak` also carries ORACLE-URL-ONLY
+  // findings (#662), which make no category/brand claim at all — averaging them into this axis
+  // drove `ratio` negative (5 URL-only over 2 facet claims → 1 - 5/2 = -1.5), which walked through
+  // the businessDepth floor and took the CLI's bar renderer down with it (#762). A URL-only oracle
+  // is NAMED as a finding and holds the score out of the senior band (`seniorBandedOverall`);
+  // it is not averaged into the facet axis — the invariant `url-only-oracle.run.ts` asserts.
+  // The clamp is not belt-and-braces: a weak-facet scenario need not itself satisfy FACET_REF
+  // (`see all [name] contains {{price.term}}` is weak but claims no facet), so `weakFacet` can
+  // still outrun `facetClaims`. This axis is declared 0..1; it leaves here inside 0..1.
+  const ratio = facetClaims ? Math.max(0, Math.min(1, 1 - weakFacet / facetClaims)) : 1;
+  return { weak, facetClaims, weakFacet, ratio };
 }
 
 /** Collect data-correctness themes (depth.requires) for a page-type + universal. */
@@ -603,6 +636,9 @@ export interface TraceResult {
   mappedToOverview: number;
   withVpCodeRatio: number;
   mappedRatio: number;
+  /** Viewpoint IDs read from test-viewpoint.md. 0 = nothing to map to, so `mappedRatio` is not a
+   *  measurement — the scenario IDs were never checked (#832). */
+  overviewIds: number;
   note: string;
 }
 
@@ -614,6 +650,24 @@ export interface TraceResult {
  */
 const unprefixed = (id: string): string => id.replace(/^(?:VP|FL)-/i, '').toUpperCase();
 
+/**
+ * The traceability note, worded from the SAME ratio the audit's TRACE finding fires on —
+ * mapped / ALL scenarios (#852). It used to compare mapped against scenarios WITH an id, so 0 of
+ * 0 (no scenario yet, or none tagged) and 2 of 2 tagged out of 10 all read "Traceable." while
+ * the audit reported `TRACE: Traceable.` for a 0–20% mapping.
+ */
+function traceNote(total: number, withCode: number, mapped: number, declared: number, exampleId?: string): string {
+  if (declared === 0) {
+    return 'No viewpoint ID found in test-viewpoint.md — the file is missing, or none of its sections declares one — so the scenario IDs were not checked. Declarations are read from a `## Priority Viewpoints` table, `### Required / Recommended / Optional` lists, and tables whose first column is a `VP-`/`FL-` ID or an ID of a family declared there (Known Issues / Traceability / References sections are skipped).';
+  }
+  if (total === 0) return 'No scenarios yet — traceability is measured once the feature has scenarios.';
+  if (mapped >= total * 0.5) return 'Traceable.';
+  const example = exampleId ? ` (e.g. \`${exampleId}-001 …\`)` : '';
+  if (withCode === 0) return `No scenario carries a viewpoint ID — start each title with one of the IDs declared in test-viewpoint.md${example}.`;
+  if (mapped < withCode * 0.5) return 'Scenario IDs do not match the viewpoint-overview ids (weak traceability — re-tag to the project viewpoint IDs).';
+  return `Only ${mapped} of ${total} scenarios carry a declared viewpoint ID — ${total - withCode} have no ID at all; tag them with the project's IDs${example}.`;
+}
+
 export function traceability(scenarios: ScenarioInfo[], viewpoints: ViewpointEntry[]): TraceResult {
   const overviewIds = new Set(viewpoints.map((v) => v.id.toUpperCase()));
   const overviewBare = new Set(viewpoints.map((v) => unprefixed(v.id)));
@@ -638,9 +692,10 @@ export function traceability(scenarios: ScenarioInfo[], viewpoints: ViewpointEnt
     mappedToOverview: mapped.length,
     withVpCodeRatio: scenarios.length ? withCode.length / scenarios.length : 0,
     mappedRatio: scenarios.length ? mapped.length / scenarios.length : 0,
-    note: withCode.length && mapped.length < withCode.length * 0.5
-      ? 'Scenario IDs do not match the viewpoint-overview ids (weak traceability — re-tag to the project viewpoint IDs).'
-      : 'Traceable.',
+    overviewIds: overviewIds.size,
+    // With no ID read there is nothing to match against: telling the author to re-tag sends them
+    // to change scenarios that may be right (#832). Name the file and the sections read instead.
+    note: traceNote(scenarios.length, withCode.length, mapped.length, overviewIds.size, viewpoints[0]?.id),
   };
 }
 
@@ -702,6 +757,31 @@ const CLAIM_RULES: ClaimRule[] = [
     hint: 'swap `contains {{v}}` for `with {{v}}` on the continuity rows. A substring match cannot distinguish "unchanged" from "changed by adding a prefix" — and if the screen genuinely renders extra text around the value, say so in the title instead of claiming exactness.',
     severity: 'warn',
   },
+  {
+    // An ORDER claim ("sorted by date descending", "ties broken by last-updated") is invisible to
+    // a presence check: `see [List] table` passes whatever order the rows are in. It sits ahead of
+    // the generic rules so "all results sorted …" is judged as an ordering claim, not an all-claim.
+    // A tiebreaker is a Tier-1 guard in the tc-generation skill, yet no rule recognised it (#810).
+    claim: 'ordering/sort',
+    title: /\b(ascending|descending|sorted|sorts|sort order|ordered by|order by|in (?:chronological|alphabetical|reverse|numeric) order|(?:newest|oldest|latest|earliest|highest|lowest) first|tie-?break(?:s|er|ers)?|ties?)\b|降順|昇順|並び順|giảm dần|tăng dần|sắp xếp/,
+    proof: /match data|is sorted|sorted (?:ascending|descending)|\brow \d+\b|\.first\.|\.last\.|\[\d+\]\.|order by/,
+    need: 'an order-sensitive assertion (`table match data:` rows in the expected order, `is sorted ascending|descending`, or positional `row N` checks)',
+    hint: 'a presence check passes in any order — assert the rows in their expected sequence (`User see [T] table match data:`), or the column sort state; a tiebreak needs two rows sharing the primary key.',
+    severity: 'fail',
+  },
+  {
+    // A LIMIT claim ("never exceeds 10", "at most 5 files") is a count claim in disguise.
+    // Ahead of 'no-side-effect', whose negation+effect pattern would otherwise swallow
+    // "never exceeds 10 records" and ask for a duplicate-count proof.
+    claim: 'limit/cap',
+    // The quantity must be ≥2 ("at most ONE order" is a no-duplicate claim — left to the rules
+    // below) and not a duration ("up to 30 seconds" is a timing claim, not a cap).
+    title: /\b(?:never exceeds?|(?:does not|doesn['’]t|not) exceed|at most|no more than|up to|capped at|caps? at|maximum of|max(?:imum)?)\s+(?:\d{2,}|[2-9]|two|three|four|five|six|seven|eight|nine|ten)\b(?!\s*(?:ms|milliseconds?|s|secs?|seconds?|mins?|minutes?|hours?|days?)\b)|\b(?:never exceeds?|(?:does not|doesn['’]t) exceed) (?:the )?(?:limit|cap|quota|maximum)\b|以内|上限|tối đa/,
+    proof: /\bcount\b|tohavecount|table with|row with \{\{|match data|is at most|\bexactly\b|field with \{\{|\berror\b|invalid|is disabled/,
+    need: 'a count/boundary assertion (count is N, `is at most`, the N+1th input rejected or truncated)',
+    hint: 'assert the boundary itself — the count at the cap, or the value/error when one more is attempted — not just that the list or field is present.',
+    severity: 'fail',
+  },
   {
     claim: 'all/every/each',
     title: /\b(all|every|each)\b/,
@@ -869,7 +949,14 @@ export interface TaxonomyResult {
 
 const TAXONOMY_KNOWN = new Set(['LIST', 'PRODUCT', 'CART', 'FILTER', 'NAV', 'VAL', 'SEC']);
 
-const CATEGORY_SIGNALS: { cat: string; re: RegExp }[] = [
+/**
+ * Words of ACCESS — a title about who may reach something. They make the robustness/routing words
+ * below security evidence ("deep link without authentication"); alone those words describe routing.
+ */
+const ACCESS_CONTEXT = /\b(xss|sql|injection|without authentication|unauthenticated|unauthori[sz]ed|without an? (?:authenticated|valid|active) \w+|without (?:permission|login|logging in|signing in|an? account|access)|not (?:logged|signed) in|logged[- ]out|direct(?:ly)? access\w*|auth[- ]?guard|forbidden|\b403\b|(?:no|insufficient|missing) permissions?|permission required|session expired|expired session|tamper\w*)\b/;
+
+/** `requires`: the signal counts only when the title ALSO matches it (#888). */
+const CATEGORY_SIGNALS: { cat: string; re: RegExp; requires?: RegExp }[] = [
   { cat: 'FILTER', re: /\b(categor(y|ies)|sub-?categor\w*|expand\w*|collaps\w*|\bfacet\b|filter\w*|belongs? to)\b/ },
   { cat: 'CART', re: /\b(add(ed|ing)? to cart|added (dialog|modal|message|confirmation)|cart (page|table|line|item)|view cart|continue shopping|quantit)\b/ },
   { cat: 'PRODUCT', re: /\b(product detail|product-detail|view product|product page|same product|product name and price|product identity|detail product)\b/ },
@@ -881,9 +968,16 @@ const CATEGORY_SIGNALS: { cat: string; re: RegExp }[] = [
 // SEC, so the linter told QA to re-tag genuine auth-gate tests as navigation — diluting the
 // visibility of the security suite (QA field report, 3.2.23). The guard vocabulary below is
 // what makes the INTENT matchable, and GUARD_INTENT then wins over a mere observable.
-  { cat: 'SEC', re: /\b(xss|sql|injection|payload|without authentication|unauthenticated|without an? (?:authenticated|valid|active) \w+|direct(?:ly)? access\w*|deep[- ]link\w*|auth[- ]?guard|not skippable|without having (?:completed|submitted|logged)|remains? unauthenticated|\binert\b|tamper\w*|malformed|url parameter|query param\w*|falls? back|gracefull?y|without a crash|not[- ]found|\b404\b|special character|abuse)\b/ },
+  { cat: 'SEC', re: /\b(xss|sql|injection|payload|without authentication|unauthenticated|without an? (?:authenticated|valid|active) \w+|direct(?:ly)? access\w*|auth[- ]?guard|not skippable|without having (?:completed|submitted|logged)|remains? unauthenticated|\binert\b|tamper\w*|malformed|special character|abuse)\b/ },
+  // Robustness and routing words are SEC evidence only beside an ACCESS word. Alone they describe
+  // routing — "Unknown route shows the 404 page", "Deep link opens the item", "the tab from the url
+  // parameter" — and the linter told QA to re-tag those navigation tests as VP-SEC (#888).
+  { cat: 'SEC', re: /\b(deep[- ]link\w*|url parameter|query param\w*|falls? back|gracefull?y|without a crash|not[- ]found|\b404\b)\b/, requires: ACCESS_CONTEXT },
 ];
 
+const signalMatches = (c: { re: RegExp; requires?: RegExp }, title: string): boolean =>
+  c.re.test(title) && (!c.requires || c.requires.test(title));
+
 /**
  * Categories whose signal describes the test's INTENT/risk rather than the observable action.
  * When one of these matches, a competing observable-only category (NAV: "redirects", "navigates")
@@ -901,14 +995,19 @@ export function taxonomyLint(scenarios: ScenarioInfo[]): TaxonomyResult {
     if (!cat || !TAXONOMY_KNOWN.has(cat)) continue;
     checked++;
     const title = s.name.toLowerCase();
-    const matched = [...new Set(CATEGORY_SIGNALS.filter((c) => c.re.test(title)).map((c) => c.cat))];
+    const matched = [...new Set(CATEGORY_SIGNALS.filter((c) => signalMatches(c, title)).map((c) => c.cat))];
     if (matched.includes(cat)) continue;             // title supports its own category → fine
+    // A gate (`requires`) only stops a word from SUGGESTING its category. An author who already
+    // chose that category is supported by the word alone: a VP-SEC "Deep link to the filtered
+    // list …" stays SEC instead of being pushed toward FILTER (#888 review).
+    if (CATEGORY_SIGNALS.some((c) => c.cat === cat && c.requires && c.re.test(title))) continue;
     // The declared category may be an INTENT category whose signal this title spells
     // differently; never "correct" it toward a category that only names the observable.
     const suppressed = INTENT_OVER_OBSERVABLE[cat];
     const others = matched.filter((c) => c !== cat && !(suppressed && suppressed.has(c)));
     if (others.length === 1) {                        // unambiguous mismatch
-      const sig = CATEGORY_SIGNALS.find((c) => c.cat === others[0])!;
+      // The entry that MATCHED — a category can have several (SEC: guard words, gated robustness words).
+      const sig = CATEGORY_SIGNALS.find((c) => c.cat === others[0] && signalMatches(c, title))!;
       const m = title.match(sig.re);
       mislabeled.push({ name: s.name, current: cat, suggested: others[0], signal: m ? m[0] : others[0] });
     }
@@ -980,9 +1079,8 @@ export function numericClaimGaps(scenarios: ScenarioInfo[]): Array<{ name: strin
     if (!m) continue;
     const claimed = NUMBER_WORDS[m[1]] ?? Number(m[1]);
     if (!Number.isFinite(claimed) || claimed < 2) continue;
-    // Only value-bearing assertions count: `see [X] … with/contains {{v}}`. A visibility check
-    // does not demonstrate one of N values.
-    const asserted = (s.stepsText.match(/\bsee \[[^\]]+\][^|]*?\b(?:with|contains) \{\{/g) ?? []).length;
+    // Values, positive states and indicator presence count; plain text visibility does not (#866).
+    const asserted = countedAssertions(s.stepsText);
     if (asserted > 0 && asserted < claimed) out.push({ name: s.name, claimed, asserted, noun: m[2] });
   }
   return out;
@@ -994,17 +1092,17 @@ export function numericClaimGaps(scenarios: ScenarioInfo[]): Array<{ name: strin
  * The Priority-Viewpoints table is where release selection is supposed to come from. When the
  * table says a flow is `Low` and its scenario is tagged `@high`, a smoke run picks up work the QA
  * deliberately deprioritised — and nobody can tell which of the two was the decision (#622).
+ *
+ * Reads the SAME parse traceability does (`parseViewpointOverview`). It used to scan the raw text
+ * for any `| VP-… | high |` row, so one audit run "saw" an id for this check and not for
+ * traceability (#833), and a row in a Known Issues table could raise a contradiction.
  */
 export function priorityMismatches(
-  viewpointText: string, scenarios: ScenarioInfo[],
+  viewpoints: ViewpointEntry[], scenarios: ScenarioInfo[],
 ): Array<{ id: string; declared: string; tagged: string; scenario: string }> {
   const declared = new Map<string, string>();
-  for (const m of viewpointText.matchAll(/^\|\s*((?:VP|FL)[A-Z0-9._-]*)\s*\|\s*(critical|high|medium|normal|low|deferred)\s*\|/gim)) {
-    declared.set(m[1].toUpperCase(), m[2].toLowerCase());
-  }
+  for (const v of viewpoints) if (v.priorityWord) declared.set(v.id.toUpperCase(), v.priorityWord);
   if (declared.size === 0) return [];
-  // `medium` and `normal` are the same rank under different names in real documents.
-  const rank = (p: string): string => (p === 'medium' ? 'normal' : p);
   const out: Array<{ id: string; declared: string; tagged: string; scenario: string }> = [];
   for (const s of scenarios) {
     const id = (s.vpId ?? '').toUpperCase();
@@ -1012,11 +1110,14 @@ export function priorityMismatches(
     // The most specific declared row that prefixes this id.
     const key = [...declared.keys()].filter((k) => id.startsWith(k)).sort((a, b) => b.length - a.length)[0];
     if (!key) continue;
-    const want = rank(declared.get(key)!);
-    const got = rank(String(s.priority).toLowerCase());
-    // `critical` and `deferred` have no tag equivalent — nothing to contradict.
-    if (want === 'critical' || want === 'deferred') continue;
-    if (want !== got) out.push({ id: key, declared: declared.get(key)!, tagged: got, scenario: s.name });
+    // Both sides fold through the one priority reading (`critical` ≡ high, `medium`/`med` ≡ normal).
+    const want = parsePriority(declared.get(key)!);
+    // `deferred` and `skip` (declared not applicable, #853) have no tag equivalent — nothing to contradict.
+    if (want === 'deferred' || want === 'skip') continue;
+    // An untagged scenario states no priority, so it cannot contradict one (#861).
+    const tagged = s.priorityTag ?? (s.priority === 'unknown' ? undefined : String(s.priority));
+    if (!tagged) continue;
+    if (want !== parsePriority(tagged)) out.push({ id: key, declared: declared.get(key)!, tagged, scenario: s.name });
   }
   return out;
 }

package/src/harness/spec-branches.ts

@@ -16,6 +16,7 @@
  * explicit — a named heading, a table that declares conditions and outcomes, or an if/else
  * cascade — because a false "you missed a branch" costs more trust than it buys coverage.
  */
+import { keywordHit } from './keyword-match';
 import { ScenarioInfo } from './parse';
 
 export interface SpecBranch {
@@ -172,7 +173,9 @@ export function unenumeratedBranches(branches: SpecBranch[], featureText: string
     const words = [...new Set((b.label.toLowerCase().match(/[a-z][a-z-]{3,}/g) ?? []))]
       .filter((w) => !GENERIC_WORD.has(w));
     if (words.length === 0) return !hay.includes(b.label.toLowerCase());
-    const hits = words.filter((w) => hay.includes(w)).length;
+    // Word-aware (#779): `in·active` and `check·list` are not mentions of `active` and `list`,
+    // and two of them credited a branch no scenario cites.
+    const hits = words.filter((w) => keywordHit(hay, w)).length;
     return hits < Math.min(2, words.length);
   });
 }
@@ -191,7 +194,7 @@ export function sameOracleClusters(scenarios: ScenarioInfo[]): Array<{ oracle: s
     if (s.manual) continue;                     // a procedure's oracle is prose
     const asserts = [...(s.steps ?? [])]
       .filter((st) => st.bucket === 'then')
-      .map((st) => st.text.toLowerCase().replace(/\s+/g, ' ').trim())
+      .map((st) => `${st.text} ${st.arg ?? ''}`.toLowerCase().replace(/\s+/g, ' ').trim())   // the table is the oracle too (#817)
       .sort();
     if (asserts.length === 0) continue;
     const key = asserts.join(' ; ');
@@ -289,7 +292,7 @@ export function visibilityPairGaps(scenarios: ScenarioInfo[]): VisibilityPairGap
     const subject = distinctive(s);
     // The counterpart has to be about the SAME thing — two shared distinctive words, the same
     // bar the ledger's prose matching uses.
-    const paired = allows.some((a) => subject.filter((w) => a.haystack.includes(w)).length >= Math.min(2, subject.length));
+    const paired = allows.some((a) => subject.filter((w) => keywordHit(a.haystack, w)).length >= Math.min(2, subject.length));
     if (!paired) out.push({ scenario: s.name, subject: subject.slice(0, 4), kind: 'permission' });
   }
   return out;

package/src/harness/spec-coverage.ts

@@ -9,6 +9,7 @@
  * Generic: no project data.
  */
 import * as fs from 'fs';
+import { keywordHit } from './keyword-match';
 import { ScenarioInfo } from './parse';
 import { readTextFile } from './read-text';
 
@@ -139,7 +140,11 @@ function directionCovered(block: string, dir: FrDirection, subject: string[]): b
   const pool = lines.length ? lines : [block];
   // Narrow to the lines about the clause's element when the suite names it the same way the spec
   // does; a spec in one language and selector keys in another must not read as "no evidence".
-  const about = subject.length ? pool.filter((l) => subject.some((x) => l.includes(x))) : [];
+  // Word-aware (#779), or the narrowing lets in a line about something else and then trusts it:
+  // `under·score` is not a mention of `Score`, but it selected the only absence assertion in the
+  // block and so proved a MUST NOT clause about the Score. (`keywordHit` keeps substring semantics
+  // for a non-ASCII element name, which is what the cross-language case above depends on.)
+  const about = subject.length ? pool.filter((l) => subject.some((x) => keywordHit(l, x))) : [];
   const scan = about.length ? about : pool;
   return scan.some((l) => NEGATIVE_ASSERTION.test(l) === (dir.polarity === 'negate'));
 }
@@ -269,7 +274,12 @@ export function specCoverage(specPath: string, scenarios: ScenarioInfo[], featur
     const cited = featLower.includes(idLower) || cites.has(fr.id.toUpperCase());
     const words = [...new Set((fr.text.toLowerCase().match(/[a-z][a-z-]{4,}/g) || []))]
       .filter((w) => !/must|should|system|screen|users?|value|input|field/.test(w));
-    const kwHit = words.length > 0 && scenarios.some((s) => words.filter((w) => s.haystack.includes(w)).length >= Math.min(2, words.length));
+    // Word-aware, not substring (#779). `haystack.includes('format')` is satisfied by
+    // in·format·ion and `includes('length')` by wave·length, and two such collisions clear the
+    // `>= 2 words` bar as easily as one — so a MUST clause nobody tested read as covered. The
+    // threshold is a separate judgement (is one word enough evidence?) and is unchanged; see
+    // keyword-match.ts for why the boundary is leading-only.
+    const kwHit = words.length > 0 && scenarios.some((s) => words.filter((w) => keywordHit(s.haystack, w)).length >= Math.min(2, words.length));
     if (!cited && !kwHit) {
       if (fr.modality === 'MUST') uncoveredMust.push({ id: fr.id, text: fr.text.slice(0, 90) });
       continue;
@@ -279,7 +289,7 @@ export function specCoverage(specPath: string, scenarios: ScenarioInfo[], featur
     // Which scenarios speak for this requirement — by its id (tags and comments sit in the block)
     // or by the same keyword rule used above.
     const owning = blocks.filter((b) => b.includes(idLower)
-      || (words.length > 0 && words.filter((w) => b.includes(w)).length >= Math.min(2, words.length)));
+      || (words.length > 0 && words.filter((w) => keywordHit(b, w)).length >= Math.min(2, words.length)));
     // Cited from outside any scenario (a header comment): nothing to judge a direction against, so
     // report nothing rather than invent a gap.
     if (!owning.length) { frCovered += units; continue; }
@@ -299,7 +309,7 @@ export function specCoverage(specPath: string, scenarios: ScenarioInfo[], featur
     // blocks that belong to this constraint: cite its msg code (primary), or mention a
     // DISTINCTIVE constraint word (generic words filtered to avoid matching happy paths).
     const own = blocks.filter((b) =>
-      (row.code && b.includes(row.code.toLowerCase())) || kw.some((w) => b.includes(w)),
+      (row.code && b.includes(row.code.toLowerCase())) || kw.some((w) => keywordHit(b, w)),
     );
     if (!own.length) continue; // constraint has no scenarios at all — FR/viewpoint gate covers that
     const found = [...new Set(own.flatMap((b) => actionTriggersIn(b)))];

package/src/harness/triage-signals.ts

@@ -0,0 +1,46 @@
+/**
+ * Triage signal library — the ordered message patterns `sungen triage` matches a red scenario's
+ * error against. Seeded from the repair rules (`harness/repair.ts`, driver-mobile `mobile-repair.ts`);
+ * the patterns are COPIED, not imported, because core never loads a driver at runtime. The parity
+ * check in tests/harness/triage-classification.run.ts keeps the environment rules in step.
+ *
+ * Order matters and is the classification order: environment first (nothing about the test or the
+ * app can be judged when the session never started), then test defects (the test never reached the
+ * app). Assertions are decided in triage.ts from the parsed Expected/Received, not here.
+ */
+export type SignalClass = 'environment' | 'test-defect';
+
+export interface TriageSignal {
+  id: string;
+  class: SignalClass;
+  match: RegExp;
+}
+
+export const TRIAGE_SIGNALS: TriageSignal[] = [
+  // --- environment: the run could not reach a usable app/session -----------------------------------
+  { id: 'env-network', class: 'environment', match: /net::ERR_[A-Z_]+|\bECONNREFUSED\b|\bENOTFOUND\b|\bEAI_AGAIN\b|\bETIMEDOUT\b/ },
+  // mirrors mobile-session-not-created
+  { id: 'env-session-not-created', class: 'environment', match: /A new session could not be created|session not created/i },
+  // mirrors mobile-driver-proxy-lost
+  { id: 'env-driver-proxy-lost', class: 'environment', match: /Could not proxy command to (?:the )?remote server|socket hang up|ECONNRESET/ },
+  // mirrors mobile-instrumentation-failed
+  { id: 'env-instrumentation-failed', class: 'environment', match: /instrumentation process (?:cannot|could not) be (?:initialized|started)|Cannot start the instrumentation process/ },
+  // mirrors mobile-chromedriver-mismatch
+  { id: 'env-chromedriver-mismatch', class: 'environment', match: /No Chromedriver found|chromedriver.*(?:version|mismatch)|Chrome version must be/i },
+  // mirrors mobile-webview-context-absent
+  { id: 'env-webview-context-absent', class: 'environment', match: /no WEBVIEW\/CHROMIUM context appeared within/ },
+  { id: 'env-auth-state-missing', class: 'environment', match: /storageState|\.auth\/[\w.-]+\.json|ENOENT[^\n]*\.auth/ },
+  { id: 'env-base-url-unresolved', class: 'environment', match: /Cannot navigate to invalid URL|baseURL (?:is )?(?:not set|undefined)|Invalid URL/ },
+  { id: 'env-browser-closed', class: 'environment', match: /Target page, context or browser has been closed|browserType\.launch/ },
+
+  // --- test defect: the test could not reach the element or its data -------------------------------
+  { id: 'test-strict-mode', class: 'test-defect', match: /strict mode violation/ },
+  { id: 'test-locator-unresolved', class: 'test-defect', match: /locator\.\w+: [^\n]*(?:Timeout|timeout)[^\n]*exceeded[\s\S]*waiting for |resolved to 0 elements/ },
+  { id: 'test-element-absent', class: 'test-defect', match: /no such element|Element not found:|An element could not be located/ },
+  { id: 'test-data-missing', class: 'test-defect', match: /Test data key not found:|@cases dataset "[^"]+" not found/ },
+  { id: 'test-step-unmatched', class: 'test-defect', match: /\[sungen\] step "[^"]*" matched no pattern|\bSG\d{3}\b/ },
+  { id: 'test-tap-intercepted', class: 'test-defect', match: /element click intercepted|is not clickable at point|element is obscured|intercepts pointer events/i },
+];
+
+/** A failure that is only Playwright's test-level timeout — no locator, no assertion detail (→ unclassified). */
+export const BARE_TIMEOUT = /^(?:Error:\s*)?Test timeout of \d+ms exceeded\.?$/;

package/src/harness/triage-unit.ts

@@ -0,0 +1,113 @@
+/**
+ * `sungen triage` IO: find a unit's feature(s) and result file(s), join them on the same seam
+ * delivery and the dashboard use (`mergeFeatureAndSpec` + `resolveResultVariants`), classify each
+ * scenario, and persist `.sungen/triage/<unit>.json`. Read-only apart from that one report file.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { parseFeatureMetadata } from '../exporters/feature-parser';
+import { loadPlaywrightReport, resolveResultsPath } from '../exporters/playwright-report-parser';
+import { collectQaEnvSecretDenylist } from '../exporters/qa-env-secret-denylist';
+import { isSensitiveKey } from '../exporters/sensitive-key';
+import { resolveResultVariants } from '../exporters/result-variants';
+import { mergeFeatureAndSpec } from '../exporters/scenario-merger';
+import { parseSpecFile } from '../exporters/spec-parser';
+import { loadTestData } from '../exporters/test-data-resolver';
+import type { ResolvedUnit } from '../cli/resolve-unit';
+import { classifyScenario, TriageClass, TriageRow } from './triage';
+
+export interface TriageReport {
+  unit: string;
+  generatedAt: string;
+  /** Result files read, relative to the project root. Empty → nothing has run yet. */
+  resultFiles: string[];
+  counts: Partial<Record<TriageClass, number>>;
+  rows: TriageRow[];
+}
+
+/**
+ * Values that must never reach a triage evidence line or a defect record: the resolved `${QA_*}`
+ * secrets AND the literal values of credential-named test-data keys — an assertion on a password
+ * field prints that value in its Expected/Received.
+ */
+export function unitSecrets(testData: Record<string, string>, cwd: string): string[] {
+  const literal = Object.entries(testData)
+    .filter(([k, v]) => isSensitiveKey(k) && typeof v === 'string' && v.length >= 3 && !v.includes('${'))
+    .map(([, v]) => String(v));
+  return [...new Set([...collectQaEnvSecretDenylist(testData, cwd).values, ...literal])].sort((a, b) => b.length - a.length);
+}
+
+function generatedDir(cwd: string, u: ResolvedUnit): string {
+  return path.join(cwd, 'specs', 'generated', u.unitId);
+}
+
+/**
+ * Every result file of one feature, labelled by variant: `<base>-test-result.json` (no label),
+ * `<base>-test-result.<os|env>[.<env>].json` (label = the middle part). A mobile unit has only
+ * per-OS files, so all of them are read rather than the first one found. Falls back to the shared
+ * lookup (incl. `test-results/results.json`) when the generated dir holds none.
+ */
+function resultFilesFor(cwd: string, genDir: string, base: string): Array<{ file: string; variant?: string }> {
+  const prefix = `${base}-test-result`;
+  const own = fs.existsSync(genDir)
+    ? fs.readdirSync(genDir).filter((f) => f.startsWith(prefix) && f.endsWith('.json')).sort()
+    : [];
+  if (own.length > 0) {
+    return own.map((f) => {
+      const variant = f.slice(prefix.length, -'.json'.length).replace(/^\./, '');
+      return { file: path.join(genDir, f), ...(variant ? { variant } : {}) };
+    });
+  }
+  const shared = resolveResultsPath(cwd, genDir, base);
+  return shared ? [{ file: shared }] : [];
+}
+
+export function triageUnit(cwd: string, u: ResolvedUnit): TriageReport {
+  const genDir = generatedDir(cwd, u);
+  const featuresDir = path.join(u.dir, 'features');
+  const features = fs.existsSync(featuresDir) ? fs.readdirSync(featuresDir).filter((f) => f.endsWith('.feature')).sort() : [];
+  const rows: TriageRow[] = [];
+  const resultFiles: string[] = [];
+
+  for (const f of features) {
+    const base = f.replace(/\.feature$/, '');
+    const files = resultFilesFor(cwd, genDir, base);
+    if (files.length === 0) continue;
+    const merged = mergeFeatureAndSpec(parseFeatureMetadata(path.join(featuresDir, f)), parseSpecFile(path.join(genDir, `${base}.spec.ts`)));
+    const dataFile = path.join(u.dir, 'test-data', `${base}.yaml`);
+    const testData = fs.existsSync(dataFile) ? loadTestData(dataFile) : {};
+    const secrets = unitSecrets(testData, cwd);
+
+    for (const { file, variant } of files) {
+      resultFiles.push(path.relative(cwd, file));
+      const results = loadPlaywrightReport(file);
+      for (const m of merged) {
+        for (const v of resolveResultVariants(m, results, testData)) {
+          const r = classifyScenario({ unit: u.unitId, title: `${m.feature.name}${v.nameSuffix}`, tags: m.feature.tags, result: v.result, variant }, secrets);
+          if (r) rows.push(r);
+        }
+      }
+    }
+  }
+
+  const counts: Partial<Record<TriageClass, number>> = {};
+  for (const r of rows) counts[r.class] = (counts[r.class] ?? 0) + 1;
+  return { unit: u.unitId, generatedAt: new Date().toISOString(), resultFiles, counts, rows };
+}
+
+export function triageReportPath(cwd: string, unitId: string): string {
+  return path.join(cwd, '.sungen', 'triage', `${unitId.replace(/\//g, '-')}.json`);
+}
+
+/** The last triage of a unit, or null when `sungen triage` has not run for it. */
+export function readTriageReport(cwd: string, unitId: string): TriageReport | null {
+  try { return JSON.parse(fs.readFileSync(triageReportPath(cwd, unitId), 'utf-8')) as TriageReport; } catch { return null; }
+}
+
+/** Persist under `.sungen/triage/<unit>.json` (a flow `flows/x` → `flows-x.json`); returns the path. */
+export function writeTriageReport(cwd: string, report: TriageReport): string {
+  const out = triageReportPath(cwd, report.unit);
+  fs.mkdirSync(path.dirname(out), { recursive: true });
+  fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`, 'utf-8');
+  return out;
+}