@validate.qa/runner 1.0.37 → 1.0.39

package/dist/cli.mjs

@@ -246,6 +246,9 @@ var require_ai_provider = __commonJS({
     exports.getAvailableModels = getAvailableModels;
     exports.getAvailableOrchestratorModels = getAvailableOrchestratorModels;
     exports.isAvailableModelId = isAvailableModelId;
+    exports.resolveWhisperProvider = resolveWhisperProvider;
+    exports.isWhisperConfigured = isWhisperConfigured;
+    exports.getWhisperModel = getWhisperModel;
     exports.getOpenAIWhisperClient = getOpenAIWhisperClient;
     exports.resetAIClient = resetAIClient;
     exports.getServerProxiedAIClient = getServerProxiedAIClient;
@@ -575,20 +578,70 @@ var require_ai_provider = __commonJS({
     function isAvailableModelId(modelId) {
       return getAvailableModels().some((model) => model.id === modelId);
     }
+    var GROQ_API_BASE_DEFAULT = "https://api.groq.com/openai/v1";
+    var GROQ_WHISPER_DEFAULT = "whisper-large-v3-turbo";
+    var OPENAI_WHISPER_DEFAULT = "whisper-1";
+    function isUsableApiKey(value) {
+      if (!value)
+        return false;
+      const trimmed = value.trim();
+      if (!trimmed)
+        return false;
+      if (/your[-_]?.*(key|api|secret)/i.test(trimmed))
+        return false;
+      if (trimmed === "sk-..." || trimmed === "gsk_...")
+        return false;
+      return true;
+    }
+    function resolveWhisperProvider() {
+      const forced = (process.env.STT_PROVIDER ?? process.env.WHISPER_PROVIDER ?? "").trim().toLowerCase();
+      const hasGroq = isUsableApiKey(process.env.GROQ_API_KEY);
+      const hasOpenAI = isUsableApiKey(process.env.OPENAI_API_KEY);
+      if (forced === "groq")
+        return hasGroq ? "groq" : null;
+      if (forced === "openai")
+        return hasOpenAI ? "openai" : null;
+      if (hasGroq)
+        return "groq";
+      if (hasOpenAI)
+        return "openai";
+      return null;
+    }
+    function isWhisperConfigured() {
+      return resolveWhisperProvider() !== null;
+    }
+    function getWhisperModel(provider) {
+      const p = provider ?? resolveWhisperProvider();
+      if (p === "groq") {
+        return process.env.GROQ_WHISPER_MODEL?.trim() || process.env.OPENAI_WHISPER_MODEL?.trim() || GROQ_WHISPER_DEFAULT;
+      }
+      return process.env.OPENAI_WHISPER_MODEL?.trim() || OPENAI_WHISPER_DEFAULT;
+    }
     var _whisperClient = null;
+    var _whisperClientProvider = null;
     function getOpenAIWhisperClient() {
-      if (_whisperClient)
+      const provider = resolveWhisperProvider();
+      if (!provider) {
+        throw new Error("Speech transcription is not configured (set GROQ_API_KEY or OPENAI_API_KEY)");
+      }
+      if (_whisperClient && _whisperClientProvider === provider) {
         return _whisperClient;
-      const apiKey = process.env.OPENAI_API_KEY;
-      if (!apiKey)
-        throw new Error("OPENAI_API_KEY is required for Whisper transcription");
-      _whisperClient = new openai_1.default({ apiKey });
+      }
+      if (provider === "groq") {
+        const apiKey = process.env.GROQ_API_KEY;
+        const baseURL = process.env.GROQ_API_BASE?.trim() || GROQ_API_BASE_DEFAULT;
+        _whisperClient = new openai_1.default({ apiKey, baseURL });
+      } else {
+        _whisperClient = new openai_1.default({ apiKey: process.env.OPENAI_API_KEY });
+      }
+      _whisperClientProvider = provider;
       return _whisperClient;
     }
     var _serverProxiedClient = null;
     function resetAIClient() {
       _clientCache.clear();
       _whisperClient = null;
+      _whisperClientProvider = null;
       _serverProxiedClient = null;
     }
     function buildServerProxiedClient() {
@@ -1687,6 +1740,7 @@ var init_constants = __esm({
       "DATABASE_URL",
       "JWT_SECRET",
       "OPENAI_API_KEY",
+      "GROQ_API_KEY",
       "GEMINI_API_KEY",
       "XAI_API_KEY",
       "GROK_API_KEY",
@@ -3253,8 +3307,10 @@ var init_audit_pricing = __esm({
       "MiniMax-M2.7-highspeed": { input: 0.6, output: 2.4 },
       "MiniMax-M2": { input: 0.3, output: 1.2 },
       "deepseek-v4-flash": { input: 0.14, output: 0.28 },
-      // Whisper bills per-minute, not per-token
+      // Whisper bills per-minute, not per-token (OpenAI + Groq)
       "whisper-1": null,
+      "whisper-large-v3": null,
+      "whisper-large-v3-turbo": null,
       // Historical / deprecated (kept so old audit rows still show a cost).
       // Deprecated Grok variants priced at the legacy authoritative Grok rate
       // ($0.20/$0.80) those rows were generated under.
@@ -3865,6 +3921,43 @@ function assertedText(stmt) {
   }
   return out.join(" ").toLowerCase();
 }
+function clickedAdditiveAffordance(lines) {
+  const nameRe = /name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/g;
+  for (const ln of lines) {
+    if (!/\.click\s*\(/.test(ln))
+      continue;
+    nameRe.lastIndex = 0;
+    let m;
+    while (m = nameRe.exec(ln)) {
+      const name = (m[1] ?? m[2]).toLowerCase();
+      if (EXCLUDE_AFFORDANCE.test(name))
+        continue;
+      if (ADDITIVE_AFFORDANCE.test(name))
+        return true;
+    }
+  }
+  return false;
+}
+function matcherText(stmt) {
+  const out = [];
+  const re = /\.(?:toContainText|toHaveText)\s*\(\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/g;
+  let m;
+  while (m = re.exec(stmt))
+    out.push(m[1] ?? m[2]);
+  return out.join(" ").toLowerCase();
+}
+function isEmptyStateProof(stmt) {
+  if (NEGATED_ASSERT.test(stmt))
+    return false;
+  if (/\.toHaveCount\s*\(\s*0\s*\)/.test(stmt))
+    return true;
+  if (/\.toBe\s*\(\s*0\s*\)/.test(stmt) && !isChromeTarget(stmt))
+    return true;
+  if (VISIBILITY_MATCHER.test(stmt) || TEXT_CONTENT_MATCHER.test(stmt)) {
+    return EMPTY_STATE_TEXT.test(`${assertedText(stmt)} ${matcherText(stmt)}`);
+  }
+  return false;
+}
 function hasAttributeTransition(stmts) {
   const byAttr = /* @__PURE__ */ new Map();
   for (const { stmt } of stmts) {
@@ -3971,6 +4064,21 @@ function validateAssertionStrength(code, opts = {}) {
   const interacted = mutated || navClicks > 0;
   navOnly = !mutated && navClicks > 0;
   const reloaded = RELOAD.test(body);
+  if (opts.flagContradictedAdditions && mutated && clickedAdditiveAffordance(interactionStmts)) {
+    const empties = stmts.filter(({ stmt }) => isEmptyStateProof(stmt));
+    if (empties.length > 0) {
+      const others = stmts.filter(({ stmt }) => !isEmptyStateProof(stmt));
+      const provesSomethingElse = detectOutcomeProof(others, mutated, false, clickedControlNames(interactionStmts), typedValues(interactionStmts));
+      if (!provesSomethingElse) {
+        return {
+          ok: false,
+          severity: "block",
+          reason: "additive action (add/create/save/favourite) proves no positive outcome \u2014 its only asserted result is that the target collection is still empty; hold @needs-review, do not ship as a passing regression",
+          signals: base2({ interacted, mutated, terminal })
+        };
+      }
+    }
+  }
   const hasOutcomeProof = detectOutcomeProof(stmts, mutated, reloaded, clickedControlNames(interactionStmts), typedValues(interactionStmts));
   const signals = base2({ interacted, mutated, navOnly, hasOutcomeProof, terminal });
   if (hasOutcomeProof) {
@@ -4025,7 +4133,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD, LOCATOR_BINDING, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, HAS_TEXT_FILTER, OUTCOME_TEXT, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, AUTH_START, AUTH_END, LOGIN_CALL_LINE, NEGATED_ASSERT, TYPED_INPUT, TITLE_LINE, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD, LOCATOR_BINDING, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, HAS_TEXT_FILTER, OUTCOME_TEXT, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, NEGATED_ASSERT, TYPED_INPUT, TITLE_LINE, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -4069,6 +4177,9 @@ var init_assertion_strength = __esm({
     MESSAGE_SURFACE = /getByText\s*\(|\.filter\s*\(\s*\{\s*hasText\s*:|getByRole\s*\(\s*['"`](?:alert|alertdialog|status|heading|dialog)['"`]/i;
     TEXT_CONTENT_MATCHER = /\.(toHaveText|toContainText)\s*\(/;
     VISIBILITY_MATCHER = /\.toBeVisible\s*\(/;
+    ADDITIVE_AFFORDANCE = /\b(add|adds|added|create|creates|save|saves|favou?rite|favou?rites|invite|invites|upload|uploads|insert|append|bookmark|follow|subscribe|post|posts|new)\b/i;
+    EXCLUDE_AFFORDANCE = /\b(filter|filters|search|searches|sort|view|views|tab|tabs|window|windows|toggle|expand|collapse|column|columns|zoom|layout)\b/i;
+    EMPTY_STATE_TEXT = /\bno\b[\s\S]{0,24}?\b(yet|found|results?|items?|favou?rites?|entries|records?|matches|posts?|comments?)\b|nothing (?:here|yet|to show|found)|\bempty\b|\(\s*0\s*\)|\b0\s+(?:favou?rites?|results?|items?|entries|records?|matches|posts?|comments?)\b/i;
     AUTH_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_AUTH/;
     AUTH_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_AUTH/;
     LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*;?\s*$/;
@@ -4091,6 +4202,24 @@ var init_assertion_strength = __esm({
 });
 
 // ../shared/dist/run-classification.js
+function pickLatestHealthRun(runs) {
+  for (const run2 of runs) {
+    if (run2.mode === "auth-setup")
+      continue;
+    if (run2.status === "PASSED" || run2.status === "FAILED" || run2.status === "ERROR") {
+      return run2;
+    }
+  }
+  return null;
+}
+function pickDisplayRun(runs) {
+  if (runs.length === 0)
+    return null;
+  const latest = runs[0];
+  if (latest.status === "PENDING" || latest.status === "RUNNING")
+    return latest;
+  return pickLatestHealthRun(runs) ?? latest;
+}
 function isEnvironmentalError(run2) {
   if (!run2)
     return false;
@@ -4552,6 +4681,262 @@ var init_origin_domain = __esm({
   }
 });
 
+// ../shared/dist/voice-config.js
+function normalizeTtsVoiceId(voiceId) {
+  if (!voiceId)
+    return null;
+  const trimmed = voiceId.trim();
+  if (!trimmed)
+    return null;
+  return LEGACY_TTS_VOICE_ID_MAP[trimmed] ?? trimmed;
+}
+function sttModelsForProvider(provider) {
+  if (provider === "openai") {
+    return STT_MODEL_OPTIONS.filter((m) => m.provider === "openai");
+  }
+  if (provider === "groq") {
+    return STT_MODEL_OPTIONS.filter((m) => m.provider === "groq");
+  }
+  return STT_MODEL_OPTIONS;
+}
+function isValidSttProvider(value) {
+  return value === "groq" || value === "openai";
+}
+function isSttModelForProvider(modelId, provider) {
+  if (!modelId)
+    return false;
+  return STT_MODEL_OPTIONS.some((m) => m.id === modelId && m.provider === provider);
+}
+function resolveSttModelForProvider(provider, configuredModel) {
+  if (configuredModel && isSttModelForProvider(configuredModel, provider)) {
+    return configuredModel;
+  }
+  return DEFAULT_STT_MODEL_BY_PROVIDER[provider];
+}
+function sanitizeSttErrorMessage(raw) {
+  if (!raw)
+    return "Speech transcription failed.";
+  let msg = String(raw).replace(/\b(sk-proj-|sk-|gsk_|sk-svcacct-)[A-Za-z0-9_-]{8,}/gi, "$1***").replace(/Incorrect API key provided:\s*\S+/gi, "Incorrect API key provided").replace(/You can find your API key at https?:\/\/\S+/gi, "").replace(/\s+/g, " ").trim();
+  if (/401|incorrect api key|invalid.?api.?key|authentication|unauthorized/i.test(msg)) {
+    return "Speech transcription failed: the speech API key was rejected. Prefer GROQ_API_KEY (same as Copilot voice) or a valid OPENAI_API_KEY on the org server.";
+  }
+  if (/429|rate.?limit|too many requests/i.test(msg)) {
+    return "Speech transcription failed: the speech provider rate-limited the request. Try again in a moment.";
+  }
+  if (/not configured|GROQ_API_KEY or OPENAI_API_KEY/i.test(msg)) {
+    return "Speech transcription is not configured. Set GROQ_API_KEY (preferred) or OPENAI_API_KEY on the org server.";
+  }
+  if (msg.length > 280)
+    msg = `${msg.slice(0, 277)}\u2026`;
+  return msg || "Speech transcription failed.";
+}
+function isValidTtsVoiceId(value) {
+  const normalized = normalizeTtsVoiceId(value);
+  if (!normalized)
+    return false;
+  return TTS_VOICE_OPTIONS.some((v) => v.id === normalized);
+}
+function isValidTtsModel(value) {
+  if (!value)
+    return false;
+  return TTS_MODEL_OPTIONS.some((m) => m.id === value);
+}
+var VOICE_PREVIEW_SAMPLE, DEFAULT_TTS_MODEL, DEFAULT_TTS_VOICE_ID, DEFAULT_TTS_SPEED, LEGACY_TTS_VOICE_ID_MAP, DEFAULT_STT_MODEL_BY_PROVIDER, STT_PROVIDER_OPTIONS, STT_MODEL_OPTIONS, TTS_MODEL_OPTIONS, TTS_VOICE_OPTIONS;
+var init_voice_config = __esm({
+  "../shared/dist/voice-config.js"() {
+    "use strict";
+    VOICE_PREVIEW_SAMPLE = "Hello! I am your Validate Copilot assistant. I can help you run tests, review failures, and generate new coverage for your project.";
+    DEFAULT_TTS_MODEL = "speech-2.6-hd";
+    DEFAULT_TTS_VOICE_ID = "English_Graceful_Lady";
+    DEFAULT_TTS_SPEED = 1;
+    LEGACY_TTS_VOICE_ID_MAP = {
+      English_LivelyGirl: "English_PlayfulGirl",
+      English_Insightful_Man: "English_Insightful_Speaker",
+      English_Deep_Voice_Man: "English_ManWithDeepVoice",
+      English_CasualMan: "English_Jovialman"
+    };
+    DEFAULT_STT_MODEL_BY_PROVIDER = {
+      groq: "whisper-large-v3-turbo",
+      openai: "whisper-1"
+    };
+    STT_PROVIDER_OPTIONS = [
+      {
+        id: "auto",
+        label: "Auto (prefer Groq)",
+        description: "Use Groq when GROQ_API_KEY is set, otherwise OpenAI Whisper."
+      },
+      {
+        id: "groq",
+        label: "Groq Whisper",
+        description: "Free-tier OpenAI-compatible Whisper via Groq. Requires GROQ_API_KEY on org servers."
+      },
+      {
+        id: "openai",
+        label: "OpenAI Whisper",
+        description: "OpenAI whisper-1 API. Requires OPENAI_API_KEY on org servers."
+      }
+    ];
+    STT_MODEL_OPTIONS = [
+      {
+        id: "whisper-large-v3-turbo",
+        label: "Whisper Large V3 Turbo",
+        provider: "groq",
+        description: "Fast, accurate default for Groq (recommended)."
+      },
+      {
+        id: "whisper-large-v3",
+        label: "Whisper Large V3",
+        provider: "groq",
+        description: "Full-size Groq Whisper model \u2014 higher quality, slower."
+      },
+      {
+        id: "distil-whisper-large-v3-en",
+        label: "Distil Whisper Large V3 (EN)",
+        provider: "groq",
+        description: "English-optimized distilled model \u2014 fastest Groq option."
+      },
+      {
+        id: "whisper-1",
+        label: "Whisper 1",
+        provider: "openai",
+        description: "OpenAI hosted Whisper model."
+      }
+    ];
+    TTS_MODEL_OPTIONS = [
+      {
+        id: "speech-2.8-hd",
+        label: "Speech 2.8 HD",
+        provider: "minimax",
+        description: "Latest high-definition model with interjection tags (recommended)."
+      },
+      {
+        id: "speech-2.8-turbo",
+        label: "Speech 2.8 Turbo",
+        provider: "minimax",
+        description: "Latest low-latency model with interjection tags."
+      },
+      {
+        id: "speech-2.6-hd",
+        label: "Speech 2.6 HD",
+        provider: "minimax",
+        description: "High-definition MiniMax voice model."
+      },
+      {
+        id: "speech-2.6-turbo",
+        label: "Speech 2.6 Turbo",
+        provider: "minimax",
+        description: "Lower-latency Speech 2.6 variant."
+      },
+      {
+        id: "speech-02-hd",
+        label: "Speech 02 HD",
+        provider: "minimax",
+        description: "Previous-generation HD model."
+      },
+      {
+        id: "speech-02-turbo",
+        label: "Speech 02 Turbo",
+        provider: "minimax",
+        description: "Lower-latency Speech 02 variant."
+      },
+      {
+        id: "speech-01-hd",
+        label: "Speech 01 HD",
+        provider: "minimax",
+        description: "Legacy HD model."
+      },
+      {
+        id: "speech-01-turbo",
+        label: "Speech 01 Turbo",
+        provider: "minimax",
+        description: "Legacy fast model."
+      }
+    ];
+    TTS_VOICE_OPTIONS = [
+      {
+        id: "English_Graceful_Lady",
+        label: "Graceful Lady",
+        description: "Warm, polished professional tone.",
+        gender: "female",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_ConfidentWoman",
+        label: "Confident Woman",
+        description: "Assured and direct \u2014 good for technical guidance.",
+        gender: "female",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_SereneWoman",
+        label: "Serene Woman",
+        description: "Calm and measured delivery.",
+        gender: "female",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_PlayfulGirl",
+        label: "Playful Girl",
+        description: "Upbeat and energetic.",
+        gender: "female",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_CalmWoman",
+        label: "Calm Woman",
+        description: "Soft, reassuring cadence.",
+        gender: "female",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_Insightful_Speaker",
+        label: "Insightful Speaker",
+        description: "Clear analyst-style narration.",
+        gender: "male",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_ManWithDeepVoice",
+        label: "Deep Voice Man",
+        description: "Rich, authoritative baritone.",
+        gender: "male",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_Jovialman",
+        label: "Jovial Man",
+        description: "Relaxed conversational style.",
+        gender: "male",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_PatientMan",
+        label: "Patient Man",
+        description: "Steady, tutorial-friendly pacing.",
+        gender: "male",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      },
+      {
+        id: "English_FriendlyPerson",
+        label: "Friendly Person",
+        description: "Neutral, approachable assistant voice.",
+        gender: "neutral",
+        accent: "English",
+        sampleText: VOICE_PREVIEW_SAMPLE
+      }
+    ];
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -4566,8 +4951,13 @@ __export(dist_exports, {
   CREDIT_PRICES_CENTS: () => CREDIT_PRICES_CENTS,
   DANGEROUS_DEEPLINK_SCHEMES: () => DANGEROUS_DEEPLINK_SCHEMES,
   DB_PRICING_PLAN_MAP: () => DB_PRICING_PLAN_MAP,
+  DEFAULT_STT_MODEL_BY_PROVIDER: () => DEFAULT_STT_MODEL_BY_PROVIDER,
+  DEFAULT_TTS_MODEL: () => DEFAULT_TTS_MODEL,
+  DEFAULT_TTS_SPEED: () => DEFAULT_TTS_SPEED,
+  DEFAULT_TTS_VOICE_ID: () => DEFAULT_TTS_VOICE_ID,
   DEFAULT_UI_VARIANT: () => DEFAULT_UI_VARIANT,
   ENVIRONMENTAL_ERROR_PREFIXES: () => ENVIRONMENTAL_ERROR_PREFIXES,
+  LEGACY_TTS_VOICE_ID_MAP: () => LEGACY_TTS_VOICE_ID_MAP,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
   MIN_CREDIT_TOPUP_CENTS: () => MIN_CREDIT_TOPUP_CENTS,
@@ -4589,10 +4979,15 @@ __export(dist_exports, {
   PLATFORM_ADMIN_EMAIL: () => PLATFORM_ADMIN_EMAIL,
   SELECTOR_PRIORITIES: () => SELECTOR_PRIORITIES,
   SHARED_PRICING_PLAN_MAP: () => SHARED_PRICING_PLAN_MAP,
+  STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
+  STT_PROVIDER_OPTIONS: () => STT_PROVIDER_OPTIONS,
   SUPPORT_EMAIL: () => SUPPORT_EMAIL,
   TRANSIENT_CONTROL_ROLES: () => TRANSIENT_CONTROL_ROLES,
   TRIAL_DURATION_DAYS: () => TRIAL_DURATION_DAYS,
+  TTS_MODEL_OPTIONS: () => TTS_MODEL_OPTIONS,
+  TTS_VOICE_OPTIONS: () => TTS_VOICE_OPTIONS,
   UI_VARIANTS: () => UI_VARIANTS,
+  VOICE_PREVIEW_SAMPLE: () => VOICE_PREVIEW_SAMPLE,
   accumulateStatements: () => accumulateStatements,
   aiCostToCreditCents: () => aiCostToCreditCents,
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
@@ -4655,16 +5050,23 @@ __export(dist_exports, {
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
+  isSttModelForProvider: () => isSttModelForProvider,
   isTestReadyForPlatform: () => isTestReadyForPlatform,
   isTrialExpired: () => isTrialExpired,
   isUIVariant: () => isUIVariant,
   isValidMobileAppId: () => isValidMobileAppId,
+  isValidSttProvider: () => isValidSttProvider,
+  isValidTtsModel: () => isValidTtsModel,
+  isValidTtsVoiceId: () => isValidTtsVoiceId,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
   normalizeControlName: () => normalizeControlName,
+  normalizeTtsVoiceId: () => normalizeTtsVoiceId,
   otherMobilePlatform: () => otherMobilePlatform,
   parenDepthDelta: () => parenDepthDelta,
+  pickDisplayRun: () => pickDisplayRun,
+  pickLatestHealthRun: () => pickLatestHealthRun,
   placeholderizeRecordedMobileAction: () => placeholderizeRecordedMobileAction,
   placeholderizeRecordedTypeValue: () => placeholderizeRecordedTypeValue,
   planHasBillingPortal: () => planHasBillingPortal,
@@ -4674,7 +5076,9 @@ __export(dist_exports, {
   resolveCrossOriginConfigOverride: () => resolveCrossOriginConfigOverride,
   resolveMobileStepValuePlaceholders: () => resolveMobileStepValuePlaceholders,
   resolvePlatformLocatorBundle: () => resolvePlatformLocatorBundle,
+  resolveSttModelForProvider: () => resolveSttModelForProvider,
   safeOrigin: () => safeOrigin,
+  sanitizeSttErrorMessage: () => sanitizeSttErrorMessage,
   sanitizeTestVariables: () => sanitizeTestVariables,
   selectorCandidatesForStep: () => selectorCandidatesForStep,
   selectorForValue: () => selectorForValue,
@@ -4684,6 +5088,7 @@ __export(dist_exports, {
   stepsNeedingReviewForPlatform: () => stepsNeedingReviewForPlatform,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
+  sttModelsForProvider: () => sttModelsForProvider,
   summarizeHealth: () => summarizeHealth,
   summarizeMobileReadiness: () => summarizeMobileReadiness,
   summarizeRunHealth: () => summarizeRunHealth,
@@ -4708,6 +5113,7 @@ var init_dist = __esm({
     init_agent_env();
     init_test_counting();
     init_origin_domain();
+    init_voice_config();
   }
 });
 
@@ -5812,6 +6218,689 @@ var require_mobile_observation = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/mobile/mobile-exploration-state.js
+var require_mobile_exploration_state = __commonJS({
+  "../runner-core/dist/services/mobile/mobile-exploration-state.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.MobileExplorationState = void 0;
+    exports.isDestructiveActionLabel = isDestructiveActionLabel;
+    exports.isDestructiveConfirmationInput = isDestructiveConfirmationInput;
+    exports.stableMobileControlIdentity = stableMobileControlIdentity;
+    exports.classifySafeMobileNavigationControl = classifySafeMobileNavigationControl;
+    exports.deriveScreenId = deriveScreenId;
+    var mobile_observation_js_1 = require_mobile_observation();
+    var DEFAULT_STALE_THRESHOLD = 4;
+    var MAX_SCREEN_OBSERVATIONS = 50;
+    var EDITABLE_CONTROL_ROLE_RE = /(?:android\.widget\.(?:EditText|AutoCompleteTextView)|XCUIElementType(?:TextField|SecureTextField|SearchField|TextView)|textbox|searchbox|combobox|textarea|select)$/i;
+    var STATEFUL_CONTROL_ROLE_RE = /(?:Switch|CheckBox|Checkbox|RadioButton|radio|Slider|SeekBar|Stepper|PickerWheel|Toggle)$/i;
+    var UNSAFE_OR_COMMIT_LABEL_RE = /\b(?:submit|save|confirm|delete|remove|archive|reset|disconnect|deactivate|destroy|purge|pay|purchase|buy|checkout|place\s+order|send|post|publish|upload|import|export|sign\s*out|log\s*out|logout|accept|agree|subscribe|unsubscribe|follow|unfollow|enable|disable|book|reserve|cancel|continue|next|previous|done|apply|retry|close|dismiss|sign\s*in|log\s*in|register)\b/i;
+    var SAFE_MODAL_TRIGGER_LABEL_RE = /^(?:create|new|add|edit|invite|configure|manage|details|preview|share)$/i;
+    var MENU_TRIGGER_LABEL_RE = /^(?:more|menu|options|actions|filter|filters|sort|columns|customize)$/i;
+    var GENERIC_NAVIGATION_DESTINATION_LABEL_RE = /^(?:home|feed|dashboard|profile|settings|inbox|messages?|notifications?|projects?|about|privacy|terms|learn\s+more)$/i;
+    var SYSTEM_BACK_CONTROL_LABEL_RE = /^(?:back|go\s+back|navigate\s+up|navigation\s+up|up)$/i;
+    var SYSTEM_BACK_CONTROL_ID_RE = /^(?:action_bar_up|arrow_back|back_arrow|navigate_up|navigation_up|nav_up|toolbar_back|action_back|btn_back|button_back|back_button|back_btn|back_icon|icon_back)$/i;
+    var DESTRUCTIVE_ACTION_LABEL_RE = /\b(?:deactivate|delete\s+account|delete\s+profile|close\s+account|cancel\s+account|remove\s+account|delete\s+(?:my\s+)?(?:data|history|everything|account)|delete\s+(?:all|forever|permanently)|permanently\s+(?:delete|remove|erase|deactivate)|erase\s+(?:all|everything|account|data)|wipe\s+(?:account|data|everything|all|device)|purge\s+(?:account|data|everything|all)|destroy\s+(?:account|data)|factory\s+reset|reset\s+(?:all\s+data|everything))\b/i;
+    var DESTRUCTIVE_CONFIRMATION_INPUT_RE = /^(?:delete|delete\s+my\s+account|delete\s+account|delete\s+forever|permanently\s+delete|confirm\s+delete|erase|erase\s+all|wipe|deactivate|remove\s+account|close\s+account|yes,?\s*delete(?:\s+my\s+account)?)$/i;
+    function isDestructiveActionLabel(label) {
+      if (!label)
+        return false;
+      return DESTRUCTIVE_ACTION_LABEL_RE.test(normalizeControlIdentityPart(label));
+    }
+    function isDestructiveConfirmationInput(value) {
+      if (!value)
+        return false;
+      return DESTRUCTIVE_CONFIRMATION_INPUT_RE.test(value.trim());
+    }
+    function normalizeControlIdentityPart(value) {
+      return value.trim().replace(/\s+/g, " ").toLowerCase();
+    }
+    function semanticControlAlias(label) {
+      return `navigation-label:${normalizeControlIdentityPart(label)}`;
+    }
+    function localControlCoverageIdentity(screenId, identity) {
+      return `screen:${screenId}:${identity}`;
+    }
+    function storedMobileControlIdentity(candidate) {
+      return [
+        candidate.identity,
+        `kind:${candidate.kind}`,
+        `label:${normalizeControlIdentityPart(candidate.label)}`
+      ].join(":");
+    }
+    function isSystemBackNavigationControl(element, label) {
+      if (SYSTEM_BACK_CONTROL_LABEL_RE.test(normalizeControlIdentityPart(label)))
+        return true;
+      return [element.accessibilityId, element.resourceId].filter((value) => Boolean(value?.trim())).some((value) => {
+        const leaf = normalizeControlIdentityPart(value).split(/[/:.]/).filter(Boolean).at(-1) ?? "";
+        return SYSTEM_BACK_CONTROL_ID_RE.test(leaf);
+      });
+    }
+    function stableMobileControlIdentity(element) {
+      const role = normalizeControlIdentityPart(element.role || "control");
+      const accessibilityId = element.accessibilityId?.trim();
+      if (accessibilityId)
+        return `a11y:${role}:${normalizeControlIdentityPart(accessibilityId)}`;
+      const resourceId = element.resourceId?.trim();
+      if (resourceId)
+        return `resource:${role}:${normalizeControlIdentityPart(resourceId)}`;
+      const label = (0, mobile_observation_js_1.safeMobileElementLabel)(element)?.trim();
+      if (label)
+        return `semantic:${role}:${normalizeControlIdentityPart(label)}`;
+      return null;
+    }
+    function classifySafeMobileNavigationControl(element) {
+      if (!element.actionable || element.enabled === false)
+        return null;
+      const label = (0, mobile_observation_js_1.safeMobileElementLabel)(element)?.trim();
+      const safetyIdentity = [label, element.accessibilityId, element.resourceId].filter(Boolean).join(" ");
+      if (!label || UNSAFE_OR_COMMIT_LABEL_RE.test(safetyIdentity))
+        return null;
+      if (isSystemBackNavigationControl(element, label))
+        return null;
+      const role = element.role.trim();
+      if (EDITABLE_CONTROL_ROLE_RE.test(role) || STATEFUL_CONTROL_ROLE_RE.test(role))
+        return null;
+      const linkLike = /(?:Link$|^a$)/i.test(role);
+      let kind = null;
+      if (/(?:TabBarItem|\btab\b)/i.test(role))
+        kind = "tab";
+      else if (/menuitem/i.test(role))
+        kind = "menu-item";
+      else if (linkLike && element.navigationProvenance)
+        kind = "link";
+      else if (linkLike)
+        return null;
+      else if (element.hasPopup && element.hasPopup.toLowerCase() !== "false")
+        kind = "menu-trigger";
+      else if (element.expanded === false)
+        kind = "disclosure";
+      else if (MENU_TRIGGER_LABEL_RE.test(label))
+        kind = "menu-trigger";
+      else if (SAFE_MODAL_TRIGGER_LABEL_RE.test(label))
+        kind = "modal-trigger";
+      else if (element.navigationProvenance)
+        kind = "navigation-button";
+      else if (GENERIC_NAVIGATION_DESTINATION_LABEL_RE.test(label))
+        kind = "navigation-button";
+      if (!kind)
+        return null;
+      const identity = stableMobileControlIdentity(element);
+      return identity ? { identity, label, kind } : null;
+    }
+    function sharedMobileControlCoverageIdentity(element, candidate, semanticFamilyId) {
+      if (!element.navigationProvenance)
+        return void 0;
+      const durableId = element.accessibilityId?.trim() ? `a11y:${normalizeControlIdentityPart(element.accessibilityId)}` : element.resourceId?.trim() ? `resource:${normalizeControlIdentityPart(element.resourceId)}` : "";
+      if (!durableId && !semanticFamilyId)
+        return void 0;
+      return [
+        "shared-navigation",
+        element.navigationProvenance,
+        !durableId && semanticFamilyId ? `family:${semanticFamilyId}` : "",
+        candidate.kind,
+        durableId || "semantic-only",
+        normalizeControlIdentityPart(candidate.label)
+      ].filter(Boolean).join(":");
+    }
+    function mobileNavigationRegion(element, windowSize) {
+      if (!windowSize || windowSize.width <= 0 || windowSize.height <= 0)
+        return "unknown";
+      const centerX = (element.bounds.x + element.bounds.width / 2) / windowSize.width;
+      const centerY = (element.bounds.y + element.bounds.height / 2) / windowSize.height;
+      if (centerY >= 0.72)
+        return "bottom";
+      if (centerY <= 0.28)
+        return "top";
+      if (centerX <= 0.35)
+        return "left";
+      if (centerX >= 0.65)
+        return "right";
+      return "center";
+    }
+    function buildSemanticNavigationGroups(elements, windowSize) {
+      const groups = /* @__PURE__ */ new Map();
+      for (const element of elements) {
+        if (!element.navigationProvenance)
+          continue;
+        const candidate = classifySafeMobileNavigationControl(element);
+        if (!candidate)
+          continue;
+        const groupKey = `${element.navigationProvenance}:${mobileNavigationRegion(element, windowSize)}`;
+        const labels = groups.get(groupKey) ?? /* @__PURE__ */ new Set();
+        labels.add(`${candidate.kind}:${normalizeControlIdentityPart(candidate.label)}`);
+        groups.set(groupKey, labels);
+      }
+      return new Map([...groups].filter(([, labels]) => labels.size >= 2));
+    }
+    function deriveScreenId(signal) {
+      const namespace = signal.activity?.trim() || signal.bundleId?.trim();
+      return namespace ? `${namespace}#${signal.screenHash}` : signal.screenHash;
+    }
+    function observedElementIdentity(element) {
+      return (0, mobile_observation_js_1.stableParsedMobileElementIdentity)(element);
+    }
+    function mergeObservedElements(previous, current) {
+      const merged = [...current];
+      const seen = new Set(current.map(observedElementIdentity));
+      for (const element of previous) {
+        const identity = observedElementIdentity(element);
+        if (seen.has(identity))
+          continue;
+        seen.add(identity);
+        merged.push(element);
+      }
+      return merged;
+    }
+    function sanitizeElementsForEvidence(elements) {
+      return elements.map((element) => {
+        const label = (0, mobile_observation_js_1.safeMobileElementLabel)(element);
+        return {
+          ...element,
+          ...label ? { label } : { label: void 0 },
+          text: void 0
+        };
+      });
+    }
+    var MobileExplorationState = class {
+      /** screenId -> ScreenState (the mobile analog of routeState). */
+      screens = /* @__PURE__ */ new Map();
+      /** Observed directed transitions between screens. */
+      transitions = [];
+      /** Transition-announced screens that do not yet have a live observation. */
+      frontier = /* @__PURE__ */ new Map();
+      /** Safe navigation controls observed on each screen, keyed by stable identity. */
+      safeControlsByScreen = /* @__PURE__ */ new Map();
+      /** Screen-scoped coverage keys plus explicitly proven shared-navigation keys. */
+      attemptedSafeControlCoverageIdentities = /* @__PURE__ */ new Set();
+      successfulSafeControlAttemptCount = 0;
+      /** Repeated id-less structural navigation families, grouped by region. */
+      semanticNavigationFamilies = /* @__PURE__ */ new Map();
+      nextSemanticNavigationFamilyId = 1;
+      /** The screen-id of the most recently observed screen. */
+      currentScreenId = null;
+      /** Latest iteration recorded (drives stale detection + firstSeen stamps). */
+      iteration = 0;
+      /** Stale detector: progress mark (#screens + #total elements) at last advance. */
+      lastProgressMark = 0;
+      /** Consecutive iterations observed with no progress. */
+      staleIterations = 0;
+      staleThreshold;
+      constructor(options = {}) {
+        this.staleThreshold = typeof options.staleThreshold === "number" && options.staleThreshold > 0 ? Math.floor(options.staleThreshold) : DEFAULT_STALE_THRESHOLD;
+      }
+      // -------------------------------------------------------------------------
+      // Observation recording
+      // -------------------------------------------------------------------------
+      /**
+       * Returns true when `signal` identifies a screen this run has never observed
+       * before. Pure read — does not mutate state.
+       */
+      isNewScreen(signal) {
+        return !this.screens.has(deriveScreenId(signal));
+      }
+      /**
+       * Record an observation of `screen` at `iteration`. Creates a `ScreenState`
+       * on first sight (stamping `firstSeenIteration`), otherwise refreshes the
+       * stored element set (latest-wins, mirroring the web reducer's PAGE_CAPTURED
+       * element refresh). A driver observation already contains the structural UI
+       * tree, elements, screenshot association, and screen identity, so it is
+       * captured evidence immediately; the model's capture_screen call only adds
+       * a friendly name/type. Returns the resolved screen-id.
+       */
+      recordObservation(signal, screen, iteration) {
+        this.iteration = iteration;
+        const screenId = deriveScreenId(signal);
+        const evidenceElements = sanitizeElementsForEvidence(screen.elements);
+        const existing = this.screens.get(screenId);
+        if (existing) {
+          this.screens.set(screenId, {
+            ...existing,
+            elements: mergeObservedElements(existing.elements, evidenceElements)
+          });
+        } else {
+          this.screens.set(screenId, {
+            screenId,
+            firstSeenIteration: iteration,
+            elements: evidenceElements,
+            visited: true
+          });
+        }
+        this.frontier.delete(screenId);
+        const controls = this.safeControlsByScreen.get(screenId) ?? /* @__PURE__ */ new Map();
+        const semanticNavigationGroups = buildSemanticNavigationGroups(evidenceElements, screen.windowSize);
+        const semanticNavigationFamilyIds = /* @__PURE__ */ new Map();
+        for (const [groupKey, labels] of semanticNavigationGroups) {
+          semanticNavigationFamilyIds.set(groupKey, this.resolveSemanticNavigationFamilyId(groupKey, labels));
+        }
+        for (const element of evidenceElements) {
+          const candidate = classifySafeMobileNavigationControl(element);
+          if (!candidate)
+            continue;
+          const storedIdentity = storedMobileControlIdentity(candidate);
+          const semanticGroupKey = element.navigationProvenance ? `${element.navigationProvenance}:${mobileNavigationRegion(element, screen.windowSize)}` : "";
+          controls.set(storedIdentity, {
+            ...candidate,
+            identity: storedIdentity,
+            sharedCoverageIdentity: sharedMobileControlCoverageIdentity(element, candidate, semanticNavigationFamilyIds.get(semanticGroupKey))
+          });
+        }
+        if (controls.size > 0)
+          this.safeControlsByScreen.set(screenId, controls);
+        this.currentScreenId = screenId;
+        this.updateStaleProgress();
+        return screenId;
+      }
+      /**
+       * Back-compatible acknowledgement from capture_screen. Observation already
+       * marks structural evidence visited; this call only resolves a rare pending
+       * transition frontier and preserves callers that annotate explicitly.
+       */
+      markVisited(screenId) {
+        const state2 = this.screens.get(screenId);
+        if (state2 && !state2.visited) {
+          this.screens.set(screenId, { ...state2, visited: true });
+        }
+        this.frontier.delete(screenId);
+      }
+      /**
+       * Record a confirmed tap against a safe navigation candidate. Callers invoke
+       * this only after the driver reports success; recovery-unknown, stale-ref, and
+       * failed actions must remain on the breadth frontier.
+       */
+      noteControlAttempt(screenId, element) {
+        if (!screenId)
+          return false;
+        const candidate = classifySafeMobileNavigationControl(element);
+        const controls = this.safeControlsByScreen.get(screenId) ?? /* @__PURE__ */ new Map();
+        if (candidate) {
+          const storedIdentity = storedMobileControlIdentity(candidate);
+          const existing = controls.get(storedIdentity);
+          controls.set(storedIdentity, {
+            ...candidate,
+            identity: storedIdentity,
+            sharedCoverageIdentity: existing?.sharedCoverageIdentity ?? sharedMobileControlCoverageIdentity(element, candidate)
+          });
+          this.safeControlsByScreen.set(screenId, controls);
+        }
+        const tappedLabel = (0, mobile_observation_js_1.safeMobileElementLabel)(element)?.trim();
+        if (!tappedLabel)
+          return false;
+        const before = this.attemptedSafeControlCoverageIdentities.size;
+        const alias = semanticControlAlias(tappedLabel);
+        for (const control of controls.values()) {
+          if (semanticControlAlias(control.label) === alias) {
+            this.attemptedSafeControlCoverageIdentities.add(localControlCoverageIdentity(screenId, control.identity));
+            if (control.sharedCoverageIdentity) {
+              this.attemptedSafeControlCoverageIdentities.add(control.sharedCoverageIdentity);
+            }
+          }
+        }
+        if (this.attemptedSafeControlCoverageIdentities.size > before) {
+          this.successfulSafeControlAttemptCount += 1;
+          this.staleIterations = 0;
+          return true;
+        }
+        return false;
+      }
+      /** Attach a human-friendly name / coarse type to a screen (capture_screen). */
+      annotateScreen(screenId, annotation) {
+        const state2 = this.screens.get(screenId);
+        if (!state2)
+          return;
+        this.screens.set(screenId, {
+          ...state2,
+          screenName: annotation.screenName ?? state2.screenName,
+          screenType: annotation.screenType ?? state2.screenType
+        });
+      }
+      /** Attach structurally observed authentication provenance to a screen. */
+      setScreenAuthEvidence(screenId, evidence) {
+        const state2 = this.screens.get(screenId);
+        if (!state2)
+          return;
+        this.screens.set(screenId, {
+          ...state2,
+          requiresAuth: evidence.requiresAuth,
+          authProvenance: evidence.authProvenance,
+          sessionState: { ...evidence.sessionState }
+        });
+      }
+      /** Append a free-form observation note to a screen (observations tool). */
+      addScreenObservation(screenId, note) {
+        const state2 = this.screens.get(screenId);
+        if (!state2)
+          return;
+        const normalized = note.trim();
+        if (!normalized)
+          return;
+        const current = state2.observations ?? [];
+        if (current.some((existing) => existing.trim().toLowerCase() === normalized.toLowerCase())) {
+          return;
+        }
+        const observations = [...current, normalized].slice(-MAX_SCREEN_OBSERVATIONS);
+        this.screens.set(screenId, { ...state2, observations });
+      }
+      /**
+       * Record a directed transition between two screens. Both endpoints are
+       * ensured to exist on the frontier if not yet observed (mirrors the web
+       * reducer adding both ends of a TRANSITION_RECORDED to the frontier). The
+       * `toScreenId` becomes the current screen when the transition starts from the
+       * current screen.
+      */
+      recordTransition(transition) {
+        let recordedTransition = transition;
+        if (!transition.viaControlIdentity && transition.viaRef) {
+          const sourceElement = this.screens.get(transition.fromScreenId)?.elements.find((element) => element.ref === transition.viaRef);
+          if (sourceElement) {
+            recordedTransition = {
+              ...transition,
+              viaControlIdentity: (0, mobile_observation_js_1.stableParsedMobileElementIdentity)(sourceElement)
+            };
+          }
+        }
+        const alreadyRecorded = this.transitions.some((existing) => existing.fromScreenId === recordedTransition.fromScreenId && existing.toScreenId === recordedTransition.toScreenId && existing.action === recordedTransition.action);
+        if (!alreadyRecorded) {
+          this.transitions.push(recordedTransition);
+        }
+        for (const endpointId of [transition.fromScreenId, transition.toScreenId]) {
+          if (!this.screens.has(endpointId) && !this.frontier.has(endpointId)) {
+            this.frontier.set(endpointId, {
+              screenId: endpointId,
+              source: "transition",
+              discoveredAtIteration: this.iteration
+            });
+          }
+        }
+        if (transition.fromScreenId === this.currentScreenId) {
+          this.currentScreenId = transition.toScreenId;
+        }
+      }
+      // -------------------------------------------------------------------------
+      // Selectors
+      // -------------------------------------------------------------------------
+      /** The current screen-id (most recently observed), or null before any observation. */
+      getCurrentScreenId() {
+        return this.currentScreenId;
+      }
+      /** ScreenState for `screenId`, if known. */
+      getScreen(screenId) {
+        return this.screens.get(screenId);
+      }
+      /** Number of distinct screens observed this run. */
+      getScreenCount() {
+        return this.screens.size;
+      }
+      /** Number of screens backed by a live structural driver observation. */
+      getVisitedScreenCount() {
+        let total = 0;
+        for (const state2 of this.screens.values()) {
+          if (state2.visited)
+            total += 1;
+        }
+        return total;
+      }
+      /** Total elements observed across all known screens (latest snapshot each). */
+      getTotalElementCount() {
+        let total = 0;
+        for (const state2 of this.screens.values()) {
+          total += state2.elements.length;
+        }
+        return total;
+      }
+      /**
+       * Frontier screen-ids ranked by recency (most recently discovered first),
+       * excluding any screen already visited. Mirrors the web `getRankedFrontier`
+       * intent (filter visited, rank by recency) — without URL prefix similarity,
+       * which has no mobile analog.
+       */
+      getFrontier() {
+        return [...this.frontier.values()].filter((item) => {
+          const state2 = this.screens.get(item.screenId);
+          return !state2 || !state2.visited;
+        }).sort((a, b) => b.discoveredAtIteration - a.discoveredAtIteration).map((item) => item.screenId);
+      }
+      /** Safe navigation candidates not yet attempted, deduped across shared chrome. */
+      getUnexploredSafeNavigationCandidates() {
+        const authenticatedProductObserved = [...this.screens.values()].some((screen) => screen.requiresAuth === true);
+        const candidates = [];
+        for (const [screenId, controls] of this.safeControlsByScreen) {
+          const origin = this.screens.get(screenId);
+          const originIsConfirmedPublicEntry = origin?.authProvenance === "public" || !origin?.authProvenance && origin?.requiresAuth !== true && /^(?:AUTH|LANDING)$/i.test(origin?.screenType ?? "");
+          if (authenticatedProductObserved && originIsConfirmedPublicEntry)
+            continue;
+          for (const control of controls.values()) {
+            const alias = semanticControlAlias(control.label);
+            const coverageIdentity = control.sharedCoverageIdentity ?? localControlCoverageIdentity(screenId, control.identity);
+            if (this.attemptedSafeControlCoverageIdentities.has(coverageIdentity) || this.attemptedSafeControlCoverageIdentities.has(localControlCoverageIdentity(screenId, control.identity)))
+              continue;
+            const existing = candidates.find((candidate) => candidate.identity === coverageIdentity || candidate.alias === alias && candidate.screenIds.has(screenId));
+            if (existing) {
+              existing.screenIds.add(screenId);
+            } else {
+              candidates.push({
+                identity: coverageIdentity,
+                label: control.label,
+                kind: control.kind,
+                alias,
+                screenIds: /* @__PURE__ */ new Set([screenId])
+              });
+            }
+          }
+        }
+        return candidates.map((candidate) => ({
+          identity: candidate.identity,
+          label: candidate.label,
+          kind: candidate.kind,
+          screenIds: [...candidate.screenIds]
+        })).sort((a, b) => {
+          const aCurrent = this.currentScreenId !== null && a.screenIds.includes(this.currentScreenId);
+          const bCurrent = this.currentScreenId !== null && b.screenIds.includes(this.currentScreenId);
+          if (aCurrent !== bCurrent)
+            return aCurrent ? -1 : 1;
+          return b.screenIds.length - a.screenIds.length;
+        });
+      }
+      /** Harness-owned survey completion floor, independent of model assertions. */
+      getSurveyBreadthCoverage() {
+        const unvisitedScreenIds = this.getFrontier();
+        const unexploredControls = this.getUnexploredSafeNavigationCandidates();
+        const complete = unvisitedScreenIds.length === 0 && unexploredControls.length === 0;
+        const missing = [];
+        if (unvisitedScreenIds.length > 0) {
+          missing.push(`${unvisitedScreenIds.length} uncaptured screen(s)`);
+        }
+        if (unexploredControls.length > 0) {
+          missing.push(`${unexploredControls.length} safe navigation control(s)`);
+        }
+        return {
+          required: true,
+          complete,
+          unvisitedScreenIds,
+          unexploredControls,
+          attemptedControlCount: this.successfulSafeControlAttemptCount,
+          ...missing.length > 0 ? { reason: `Missing ${missing.join(" and ")}.` } : {}
+        };
+      }
+      /**
+       * Monotonic structural progress token for adaptive survey leases. Frontier
+       * cardinality alone is insufficient: attempting control A can reveal control
+       * B and leave the remaining count unchanged even though real work happened.
+       */
+      getSurveyBreadthProgressMark() {
+        const discoveredControlIdentities = /* @__PURE__ */ new Set();
+        for (const [screenId, controls] of this.safeControlsByScreen) {
+          for (const control of controls.values()) {
+            discoveredControlIdentities.add(control.sharedCoverageIdentity ?? localControlCoverageIdentity(screenId, control.identity));
+          }
+        }
+        return [
+          `screens:${this.screens.size}`,
+          `attempts:${this.successfulSafeControlAttemptCount}`,
+          `controls:${discoveredControlIdentities.size}`,
+          `transitions:${this.transitions.length}`
+        ].join("|");
+      }
+      resolveSemanticNavigationFamilyId(groupKey, labels) {
+        const families = this.semanticNavigationFamilies.get(groupKey) ?? [];
+        let best;
+        let bestIntersection = 0;
+        for (const family of families) {
+          let intersection = 0;
+          for (const label of labels) {
+            if (family.labels.has(label))
+              intersection += 1;
+          }
+          const overlap = intersection / Math.min(labels.size, family.labels.size);
+          if (intersection >= 2 && overlap >= 0.6 && intersection > bestIntersection) {
+            best = family;
+            bestIntersection = intersection;
+          }
+        }
+        if (best) {
+          for (const label of labels)
+            best.labels.add(label);
+          return best.id;
+        }
+        const created = {
+          id: `semantic-nav-family-${this.nextSemanticNavigationFamilyId++}`,
+          labels: new Set(labels)
+        };
+        families.push(created);
+        this.semanticNavigationFamilies.set(groupKey, families);
+        return created.id;
+      }
+      /** Observed transitions (defensive copy). */
+      getTransitions() {
+        return [...this.transitions];
+      }
+      // -------------------------------------------------------------------------
+      // Stale-progress detection (ported semantics from the web stale guard)
+      // -------------------------------------------------------------------------
+      /**
+       * Progress mark: distinct screens weighted heavily, plus total elements seen.
+       * A run advances this mark whenever it finds a new screen OR new elements;
+       * the stale detector triggers when the mark stops advancing for
+       * `staleThreshold` consecutive iterations.
+       */
+      getProgressMark() {
+        return this.screens.size * 1e3 + this.transitions.length * 100 + this.successfulSafeControlAttemptCount * 10 + this.getTotalElementCount();
+      }
+      updateStaleProgress() {
+        const mark = this.getProgressMark();
+        if (mark > this.lastProgressMark) {
+          this.lastProgressMark = mark;
+          this.staleIterations = 0;
+        } else {
+          this.staleIterations += 1;
+        }
+      }
+      /** Consecutive no-progress iterations observed so far. */
+      getStaleIterations() {
+        return this.staleIterations;
+      }
+      /**
+       * True when the run has gone `staleThreshold` consecutive iterations with no
+       * new screen and no new element — the signal the explorer uses to nudge or
+       * finish (mirrors the web explorer's stale guard).
+       */
+      isStaleProgress() {
+        return this.staleIterations >= this.staleThreshold;
+      }
+      // -------------------------------------------------------------------------
+      // Planner evidence export
+      // -------------------------------------------------------------------------
+      /**
+       * Snapshot the screen-graph as a plain object (frozen mobile-types
+       * `MobileScreenGraph`). Defensive copies so callers cannot mutate internal
+       * state.
+       */
+      toScreenGraph() {
+        const screens = /* @__PURE__ */ new Map();
+        for (const [id, state2] of this.screens) {
+          screens.set(id, {
+            ...state2,
+            elements: [...state2.elements],
+            observations: state2.observations ? [...state2.observations] : void 0,
+            sessionState: state2.sessionState ? { ...state2.sessionState } : void 0
+          });
+        }
+        return {
+          screens,
+          transitions: this.transitions.map((t) => ({
+            fromScreenId: t.fromScreenId,
+            toScreenId: t.toScreenId,
+            viaRef: t.viaRef,
+            viaControlIdentity: t.viaControlIdentity,
+            action: t.action
+          }))
+        };
+      }
+      /**
+       * Build the planner evidence shape: one `CollectedPageData` per screen, with
+       * the screen-id carried in BOTH `route` (the on-the-wire positional field the
+       * server keys screenshots by) AND the explicit `screenId` field (per the
+       * Phase-0 `CollectedPageData.screenId` contract). `elements` are mapped from
+       * the screen's parsed actionable elements into the platform-neutral
+       * `CollectedPageElement[]` shape the server persists as SiteElements — without
+       * this, mobile screens land with zero elements (coverage always 0%, no element
+       * intelligence). `triggersNavigation` is derived from the durable source
+       * element identity captured when the transition happened (with ref-only
+       * fallback for legacy transitions). Insertion order matches first-seen order.
+       */
+      buildInMemoryScreenMap() {
+        const pages = [];
+        const ordered = [...this.screens.values()].sort((a, b) => a.firstSeenIteration - b.firstSeenIteration);
+        const navRefsByScreen = /* @__PURE__ */ new Map();
+        const navIdentitiesByScreen = /* @__PURE__ */ new Map();
+        for (const transition of this.transitions) {
+          if (transition.viaControlIdentity) {
+            const set = navIdentitiesByScreen.get(transition.fromScreenId) ?? /* @__PURE__ */ new Set();
+            set.add(transition.viaControlIdentity);
+            navIdentitiesByScreen.set(transition.fromScreenId, set);
+          } else if (transition.viaRef) {
+            const set = navRefsByScreen.get(transition.fromScreenId) ?? /* @__PURE__ */ new Set();
+            set.add(transition.viaRef);
+            navRefsByScreen.set(transition.fromScreenId, set);
+          }
+        }
+        for (const state2 of ordered) {
+          const page = {
+            route: state2.screenId,
+            screenId: state2.screenId,
+            pageType: state2.screenType ?? "UNKNOWN",
+            elements: (0, mobile_observation_js_1.buildCollectedElementsForScreen)(state2.elements, {
+              navigationRefs: navRefsByScreen.get(state2.screenId),
+              navigationIdentities: navIdentitiesByScreen.get(state2.screenId)
+            }),
+            requiresAuth: state2.requiresAuth ?? false
+          };
+          if (state2.sessionState) {
+            page.sessionState = { ...state2.sessionState };
+          }
+          if (state2.screenName) {
+            page.title = state2.screenName;
+          }
+          if (state2.observations && state2.observations.length > 0) {
+            page.observations = state2.observations.map((note) => ({
+              action: "observe",
+              outcome: note,
+              outcomeType: "SUCCESS"
+            }));
+          }
+          pages.push(page);
+        }
+        return pages;
+      }
+      /** Alias for `buildInMemoryScreenMap()` — name parity with the planner-evidence call site. */
+      toScreenMap() {
+        return this.buildInMemoryScreenMap();
+      }
+    };
+    exports.MobileExplorationState = MobileExplorationState;
+  }
+});
+
 // ../runner-core/dist/services/mobile/mobile-keyboard.js
 var require_mobile_keyboard = __commonJS({
   "../runner-core/dist/services/mobile/mobile-keyboard.js"(exports) {
@@ -63530,6 +64619,7 @@ var require_mobile_explorer = __commonJS({
     var ai_retry_js_1 = require_ai_retry();
     var mobile_source_parser_js_1 = require_mobile_source_parser();
     var mobile_observation_js_1 = require_mobile_observation();
+    var mobile_exploration_state_js_1 = require_mobile_exploration_state();
     var mobile_boundary_js_1 = require_mobile_boundary();
     var mobile_keyboard_js_1 = require_mobile_keyboard();
     var mobile_auth_coverage_js_1 = require_mobile_auth_coverage();
@@ -63887,6 +64977,10 @@ var require_mobile_explorer = __commonJS({
         return void 0;
       return normalized;
     }
+    function destructiveActionRefusal(label, kind = "tap") {
+      const what = kind === "confirmation" ? `Typing "${label}" is a destructive confirmation` : `Tapping "${label}" is an irreversible, high-stakes destructive action`;
+      return `Refused: ${what} (account/data deletion, deactivation, wipe, or similar). Autonomous testing must never execute irreversible destruction on the account under test. Record it as an untested destructive flow in your summary and choose a non-destructive control instead.`;
+    }
     function hybridElementForEvidence(element, credentials) {
       const id = safeHybridIdentity(element.id, credentials);
       const name = safeHybridIdentity(element.name, credentials);
@@ -64509,7 +65603,7 @@ Max iterations: ${maxIterations}. You will be warned near the end.`;
 3. After each navigation, capture_screen the destination and record_transition. After completing a meaningful flow (login, search, create), ${enableRecordJourney ? "call record_journey with the steps and expected outcome." : "continue exploring."}
 4. Use mobile_relaunch for a clean, hermetic restart before testing a distinct flow that needs fresh state.
 5. mobile_swipe to scroll; mobile_back to return.
-6. Do NOT trigger irreversible side effects (real payments, sending messages/invites to others). Note them instead.
+6. Do NOT trigger irreversible or destructive side effects \u2014 real payments; sending messages/invites to others; and ESPECIALLY account/data deletion, deactivation, "delete account", factory reset, or any "type DELETE to confirm" gate. The runner hard-blocks destructive taps and confirmation keystrokes, so attempting them only wastes an iteration. Note such flows in your summary and explore elsewhere.
 7. Stay inside this app.${targetLine} If a tap opens an app store, settings, browser, or another app, do not explore it; return with mobile_back or mobile_relaunch.
 
 Max iterations: ${maxIterations}. You will be warned near the end.`;
@@ -65374,6 +66468,11 @@ Exploration complete: ${summary}`);
             if (!driver.webTap) {
               return { ok: false, error: "This driver does not support hybrid WEBVIEW taps." };
             }
+            const hybridTapLabel = hybridElementForEvidence(hybrid, redactionCredentials).label ?? "";
+            if ((0, mobile_exploration_state_js_1.isDestructiveActionLabel)(hybridTapLabel)) {
+              log2(`   \u26A0 Refused destructive tap on "${hybridTapLabel}" (account/data-deletion class); noting instead.`);
+              return { ok: false, error: destructiveActionRefusal(hybridTapLabel) };
+            }
             const authSurfaceBeforeTap2 = currentAuthSurface();
             const fromScreenId2 = state2.getCurrentScreenId();
             const actionResult2 = await driver.webTap(hybrid.webviewContext, hybrid.css);
@@ -65404,6 +66503,11 @@ Exploration complete: ${summary}`);
           if (!resolved) {
             return { ok: false, error: `Unknown element ref "${String(toolArgs.ref)}". Call mobile_snapshot first; refs are only valid for the latest snapshot.` };
           }
+          const nativeTapLabel = resolved.element.label ?? resolved.element.text ?? resolved.element.accessibilityId ?? "";
+          if ((0, mobile_exploration_state_js_1.isDestructiveActionLabel)(nativeTapLabel)) {
+            log2(`   \u26A0 Refused destructive tap on "${nativeTapLabel}" (account/data-deletion class); noting instead.`);
+            return { ok: false, error: destructiveActionRefusal(nativeTapLabel) };
+          }
           const fromScreenId = state2.getCurrentScreenId();
           const boundaryBeforeAction = currentBoundary();
           const startedOutsideTarget = boundaryBeforeAction.kind !== "target" && boundaryBeforeAction.kind !== "unknown";
@@ -65444,6 +66548,10 @@ Exploration complete: ${summary}`);
         // ----- Type -----
         case "mobile_type": {
           const value = typeof toolArgs.value === "string" ? toolArgs.value : String(toolArgs.value ?? "");
+          if ((0, mobile_exploration_state_js_1.isDestructiveConfirmationInput)(value)) {
+            log2(`   \u26A0 Refused destructive confirmation input "${value}"; noting instead.`);
+            return { ok: false, error: destructiveActionRefusal(value, "confirmation") };
+          }
           const allowedLiteral = inbox ? inbox.state.email : "";
           for (const [key, secret] of Object.entries(credentials)) {
             if (!secret || secret.length < 4)
@@ -70153,7 +71261,7 @@ var require_mobile_generator = __commonJS({
 - Re-snapshot before every assertion so the ref is fresh.
 - Assert the OUTCOME of the flow (the new screen / new content), not the control you just tapped.
 - Assert only DURABLE elements \u2014 screen chrome that exists on every visit (tab labels, headers, nav bars, the entity you just created). NEVER assert one-time / data-dependent UI: empty-state CTAs, first-run or onboarding prompts, or counters \u2014 they vanish as soon as the account has data, and the test then fails forever on a healthy app.
-- Do NOT trigger irreversible side effects (real payments, sending messages to others) \u2014 note them and assert what you safely can.
+- Do NOT trigger irreversible or destructive side effects \u2014 real payments; sending messages to others; and ESPECIALLY account/data deletion, deactivation, or any "type DELETE to confirm" gate (the runner hard-blocks destructive taps and confirmation keystrokes). Note them and assert what you safely can.
 - Stay inside this app.${targetLine} Do not open or use app stores, browsers, email apps, settings, or any other app. If an action leaves the target app, the runner will relaunch the target app and reject that action.
 - NEVER tap the phone's home screen / launcher (app icons, "Predicted app" chips, search bars, widgets). Those are NOT part of the app under test \u2014 tapping them is junk that poisons the test. If the app ever backgrounds or you find yourself on the launcher, use mobile_relaunch to cold-start the app; do NOT tap a launcher icon or app-prediction to get back in.
 - Do NOT re-do a sequence you already completed. If you filled a form then navigated away, do NOT come back and fill it again \u2014 the scenario needs ONE clean pass. Filling the login form, going back, and re-filling it is exactly the kind of wandering that produces a bloated, broken test.
@@ -78826,6 +79934,34 @@ var require_anchor_harvester = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/discovery-lint-flags.js
+var require_discovery_lint_flags = __commonJS({
+  "../runner-core/dist/services/discovery-lint-flags.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.structuralLocatorLintMode = structuralLocatorLintMode;
+    exports.isPwMethodPreflightEnabled = isPwMethodPreflightEnabled;
+    exports.isVqaLoginDedupeEnabled = isVqaLoginDedupeEnabled;
+    function strictOn(value) {
+      return value === "true" || value === "1";
+    }
+    function structuralLocatorLintMode() {
+      const v = (process.env.DISCOVERY_STRUCTURAL_LOCATOR_LINT || "").trim().toLowerCase();
+      if (v === "warn")
+        return "warn";
+      if (v === "true" || v === "1" || v === "enforce")
+        return "enforce";
+      return "off";
+    }
+    function isPwMethodPreflightEnabled() {
+      return strictOn(process.env.DISCOVERY_PW_METHOD_PREFLIGHT);
+    }
+    function isVqaLoginDedupeEnabled() {
+      return strictOn(process.env.DISCOVERY_VQALOGIN_DEDUPE);
+    }
+  }
+});
+
 // ../runner-core/dist/services/auth-recipe.js
 var require_auth_recipe = __commonJS({
   "../runner-core/dist/services/auth-recipe.js"(exports) {
@@ -78848,9 +79984,11 @@ var require_auth_recipe = __commonJS({
     exports.extractAuthRegion = extractAuthRegion;
     exports.stripAuthRegions = stripAuthRegions;
     exports.ensureExpectImported = ensureExpectImported;
+    exports.ensureLoginCall = ensureLoginCall;
     exports.upsertAuthBlock = upsertAuthBlock;
     exports.buildHealAuthStamp = buildHealAuthStamp;
     var crypto_1 = __require("crypto");
+    var discovery_lint_flags_js_1 = require_discovery_lint_flags();
     exports.AUTH_MARKER_VERSION = "v1";
     var START_MARKER = `// >>> VALIDATE_QA_AUTH ${exports.AUTH_MARKER_VERSION} \u2014 generated, do not edit >>>`;
     var END_MARKER = `// <<< VALIDATE_QA_AUTH ${exports.AUTH_MARKER_VERSION} <<<`;
@@ -79114,10 +80252,13 @@ ${tail}`;
     var TEST_OPENER_RE = /test(?:\.(?:only|skip|fixme))?\s*\(\s*(['"`])(?:[^\\]|\\.)*?\1\s*,\s*(?:\{[\s\S]*?\}\s*,\s*)?async\s*\(\s*\{[^}]*\}[^)]*\)\s*=>\s*\{/;
     var LOGIN_CALL_RE = /await\s+__vqaLogin\s*\(\s*page\s*\)/;
     function ensureLoginCall(code) {
-      const matches = [...code.matchAll(new RegExp(TEST_OPENER_RE.source, "g"))];
-      if (matches.length === 0)
+      if (code.match(new RegExp(TEST_OPENER_RE.source, "g")) === null)
         return code;
       let result = code;
+      if ((0, discovery_lint_flags_js_1.isVqaLoginDedupeEnabled)()) {
+        result = result.replace(/^[ \t]*await[ \t]+__vqaLogin[ \t]*\([ \t]*page[ \t]*\)[ \t]*;?[ \t]*\r?\n/gm, "");
+      }
+      const matches = [...result.matchAll(new RegExp(TEST_OPENER_RE.source, "g"))];
       for (let i = matches.length - 1; i >= 0; i--) {
         const m = matches[i];
         if (m.index === void 0)
@@ -79526,7 +80667,7 @@ var require_agentic_discovery_prompts = __commonJS({
         "## Test-quality bar",
         "",
         "- ONE `test.describe(<featureName>)` block per file with ONE `test(...)` call inside.",
-        "- Use `await page.goto(<relativePath>)` \u2014 baseURL is set in the runner config; never hardcode the host.",
+        "- Use `await page.goto(<relativePath>)` \u2014 baseURL is set in the runner config; never hardcode the host. If the base URL includes a path (e.g. `https://host/app`), every goto path MUST start with that path: Playwright only prefixes relative paths, so `page.goto('/')` lands on the ORIGIN ROOT outside the app \u2014 the app home is `page.goto('/app')`.",
         "- Every test must contain at least one `expect(...)` assertion.",
         "- **The LAST statement inside the test body MUST be `await expect(...)` that PROVES THE OUTCOME of the test's primary action.** A test ending in `.click()`, `.fill()`, `.press()`, or a `console.log` is INVALID. For an INTERACTION test, re-asserting that the control you just clicked is visible or `aria-selected=true` proves NOTHING (the toggle could be broken and the test would still pass) and is rejected by the assertion-strength gate. Instead verify the post-action state: a before\u2192after count/value change, new content/value that appeared (`getByText` of the revealed value, `toHaveText`/`toContainText`), a created item present or a removed item gone (`toHaveCount`/`not.toBeVisible`), a field value (`toHaveValue`), or a control now disabled (`toBeDisabled`). EXEMPT: a pure navigation/routing test may end on `toHaveURL` + one landmark `toBeVisible`, and the mandatory post-login wait ends on a landmark `toBeVisible` \u2014 those are correct and required. The parent validator REJECTS tests whose last non-trivial line is anything other than `await expect(...)`.",
         "  Prefer: `expect(locator).toBeVisible()`, `expect(page).toHaveURL(/regex/)`, `expect(locator).toHaveText(...)`.",
@@ -81762,7 +82903,7 @@ var require_agentic_discovery_prompts = __commonJS({
       lines.push("## Test-quality bar");
       lines.push("");
       lines.push("- ONE `test.describe(<featureName>)` block per file with ONE `test(...)` inside.");
-      lines.push("- Use `await page.goto(<relativePath>)` \u2014 never hardcode the host.");
+      lines.push("- Use `await page.goto(<relativePath>)` \u2014 never hardcode the host. If the base URL includes a path (e.g. `https://host/app`), every goto path MUST start with that path (`page.goto('/')` escapes to the origin root \u2014 the app home is `page.goto('/app')`).");
       lines.push("- Every test MUST include the `@generated` tag.");
       lines.push("- Each test creates its OWN run-scoped data; never depend on pre-seeded data.");
       lines.push("");
@@ -82316,6 +83457,21 @@ var require_agentic_discovery_prompts = __commonJS({
       lines.push(`Use \`browser_navigate\` with the full URL (prepend ${baseUrl}). In the`);
       lines.push("emitted test code keep URLs RELATIVE (`page.goto('/path')`) \u2014 the Playwright");
       lines.push("config sets `baseURL`.");
+      {
+        const gotoBasePath = (() => {
+          try {
+            const p = new URL(baseUrl).pathname.replace(/\/+$/, "");
+            return p && p !== "/" ? p : void 0;
+          } catch {
+            return void 0;
+          }
+        })();
+        if (gotoBasePath) {
+          lines.push(`IMPORTANT: the base URL has a PATH (\`${gotoBasePath}\`) and a leading-slash path escapes`);
+          lines.push(`it to the origin root. Every \`page.goto\` path MUST start with \`${gotoBasePath}\` \u2014 the`);
+          lines.push(`app home is \`page.goto('${gotoBasePath}')\`, NOT \`page.goto('/')\`.`);
+        }
+      }
       lines.push("");
       lines.push("## The scenario");
       lines.push("");
@@ -82994,17 +84150,19 @@ var require_discover_generator = __commonJS({
   "../runner-core/dist/services/discover-generator.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.MIN_BUG_DESCRIPTION_LENGTH = exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
+    exports.MIN_BUG_DESCRIPTION_LENGTH = exports.VALID_PLAYWRIGHT_GETBY_METHODS = exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
     exports.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports.detectScenarioSignals = detectScenarioSignals;
     exports.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
     exports.getLoginCommands = getLoginCommands;
+    exports.hasConfiguredLoginCredentials = hasConfiguredLoginCredentials;
     exports.computeSkeletonTags = computeSkeletonTags;
     exports.shouldReplayAuthRecipe = shouldReplayAuthRecipe;
     exports.buildPageContext = buildPageContext;
     exports.stripTypescriptSyntax = stripTypescriptSyntax;
     exports.stripImportDeclarations = stripImportDeclarations;
     exports.stripStringsAndComments = stripStringsAndComments;
+    exports.gotoBasePathFromBaseUrl = gotoBasePathFromBaseUrl;
     exports.sanitizeCode = sanitizeCode;
     exports.validateTests = validateTests;
     exports.formatEvidenceForLiveGenerate = formatEvidenceForLiveGenerate;
@@ -83015,6 +84173,7 @@ var require_discover_generator = __commonJS({
     exports.upgradePositionalProvenLines = upgradePositionalProvenLines;
     exports.synthesizeRefActionLines = synthesizeRefActionLines;
     exports.renderSessionRecording = renderSessionRecording;
+    exports.scanFragileStructuralLocators = scanFragileStructuralLocators;
     exports.validateFinalActionFidelity = validateFinalActionFidelity;
     exports.resolveSuspectedBugVerdict = resolveSuspectedBugVerdict;
     exports.buildScenarioSystemPrompt = buildScenarioSystemPrompt;
@@ -83042,6 +84201,7 @@ var require_discover_generator = __commonJS({
     var auth_recipe_js_1 = require_auth_recipe();
     var auth_replay_js_1 = require_auth_replay();
     var agentic_discovery_prompts_js_1 = require_agentic_discovery_prompts();
+    var discovery_lint_flags_js_1 = require_discovery_lint_flags();
     exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = /* @__PURE__ */ new Set([
       "browser_install",
       "browser_close",
@@ -83591,11 +84751,15 @@ var require_discover_generator = __commonJS({
       const replayPlan = (0, auth_recipe_js_1.buildReplayPlan)(login);
       return { ...login, replayPlan };
     }
-    function computeSkeletonTags(targetPages, pages) {
+    function hasConfiguredLoginCredentials(credentials) {
+      return ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"].some((k) => typeof credentials?.[k] === "string" && credentials[k].trim().length > 0);
+    }
+    function computeSkeletonTags(targetPages, pages, opts) {
       const isAuthPage = (p) => p.pageType === "AUTH" || /\/(auth|login|sign-?in)\b/i.test(p.route);
+      const siteHasAuthEvidence = pages.some(isAuthPage) || opts?.extraAuthEvidence === true;
       const targetPagesInSiteMap = pages.filter((p) => targetPages.includes(p.route));
       const hasAuthPage = targetPagesInSiteMap.some(isAuthPage);
-      const hasAuthRequiredPage = targetPagesInSiteMap.some((p) => p.requiresAuth && !isAuthPage(p));
+      const hasAuthRequiredPage = siteHasAuthEvidence && targetPagesInSiteMap.some((p) => p.requiresAuth && !isAuthPage(p));
       if (hasAuthPage && !hasAuthRequiredPage)
         return ["@auth", "@discovered"];
       if (hasAuthRequiredPage)
@@ -83603,7 +84767,7 @@ var require_discover_generator = __commonJS({
       return ["@discovered", "@regression"];
     }
     function shouldReplayAuthRecipe(targetPages, siteMapPages, recipe) {
-      return !!recipe && computeSkeletonTags(targetPages, siteMapPages).includes("@needs-auth");
+      return !!recipe && computeSkeletonTags(targetPages, siteMapPages, { extraAuthEvidence: true }).includes("@needs-auth");
     }
     function isLowConfidenceSnapshotKind(kind) {
       return kind === "missing" || kind === "error" || kind === "timeout" || kind === "empty" || kind === "ai-capture_fallback";
@@ -83762,6 +84926,15 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
       return assembled.join(separator);
     }
     var SENSITIVE_ENV_KEY_RE = /email|password|token|secret|api[_-]?key|access[_-]?key|username|user(name)?|bearer|session|cookie|\bpat\b|refresh|jwt/i;
+    exports.VALID_PLAYWRIGHT_GETBY_METHODS = /* @__PURE__ */ new Set([
+      "getByRole",
+      "getByText",
+      "getByLabel",
+      "getByPlaceholder",
+      "getByTestId",
+      "getByAltText",
+      "getByTitle"
+    ]);
     var VALID_PLAYWRIGHT_MATCHERS = /* @__PURE__ */ new Set([
       // Locator assertions
       "toBeAttached",
@@ -84049,6 +85222,16 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
     function findSensitiveLiteralLeaks(code, testVariables) {
       return buildSensitiveEnvReplacements(testVariables).filter((replacement) => code.includes(replacement.value)).map((replacement) => replacement.key);
     }
+    function gotoBasePathFromBaseUrl(baseUrl) {
+      if (!baseUrl)
+        return void 0;
+      try {
+        const path = new URL(baseUrl).pathname.replace(/\/+$/, "");
+        return path && path !== "/" ? path : void 0;
+      } catch {
+        return void 0;
+      }
+    }
     function sanitizeCode(code, options) {
       let result = code;
       const isNetworkIdleWaitLine = (line) => /^\s*await page\.waitForLoadState\((['"])networkidle\1\);\s*$/.test(line);
@@ -84071,12 +85254,24 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
       result = result.replace(/\s*await page\.waitForTimeout\(\d+\);\s*/g, "\n");
       result = result.replace(/(await page\.goto\((?:[^()()]|\([^()]*\))*\);)\s*\n\s*await expect\(page\)\.toHaveURL\((?:[^()()]|\([^()]*\))*\);/g, (_match, gotoLine) => gotoLine);
       result = result.replace(/const baseUrl\s*=\s*process\.env\.BASE_URL[^;]*;\s*\n/g, "");
-      result = result.replace(/page\.goto\(`\$\{baseUrl\}([^`]*)`/g, (_match, path) => `page.goto('${path}'`);
+      result = result.replace(
+        /page\.goto\(`\$\{baseUrl\}([^`]*)`/g,
+        // Empty template path (goto(`${baseUrl}`)) means the app home → '/', which the
+        // path-scoped basePath pass below re-joins to the real base (e.g. '/wing').
+        (_match, path) => `page.goto('${path || "/"}'`
+      );
       result = result.replace(/test\s*\(\s*(['"`].*?['"`])\s*,\s*\{\s*tags\s*:\s*\[/g, (match) => match.replace("tags", "tag"));
       result = result.replace(/page\.goto\(\s*['"]https?:\/\/[^/'"]+(\/[^'"]*)?['"]/g, (_match, path) => `page.goto('${path || "/"}'`);
       result = result.replace(/waitForURL\(\s*['"]https?:\/\/[^/'"]+(\/.+?)['"]\s*\)/g, (_match, path) => `waitForURL(/${path.replace(/\//g, "\\/")}/)`);
       result = result.replace(/toHaveURL\(\s*['"]https?:\/\/[^/'"]+(\/.+?)['"]\s*\)/g, (_match, path) => `toHaveURL(/${path.replace(/\//g, "\\/")}/)`);
       result = result.replace(/(waitForURL|toHaveURL)\(\/(.*?)\\\/\/\)/g, (_match, fn, inner) => `${fn}(/${inner}/)`);
+      const basePath = options?.basePath && options.basePath !== "/" ? options.basePath.replace(/\/+$/, "") : void 0;
+      if (basePath) {
+        result = result.replace(/\b(goto|waitForURL|toHaveURL)\(\s*(['"])(\/(?!\/)[^'"]*)\2/g, (_match, fn, _quote, path) => {
+          const joined = path === basePath || path.startsWith(basePath + "/") ? path : basePath + (path === "/" ? "" : path);
+          return `${fn}('${joined}'`;
+        });
+      }
       result = result.replace(/\)\)\.(first\(\)|nth\(\d+\)|last\(\))\./g, (match, method) => `).${method}).`);
       result = result.replace(/^(\s+)expect\(page\b/gm, "$1await expect(page");
       result = result.replace(/^(\s+)page\.waitForURL\(/gm, "$1await page.waitForURL(");
@@ -84143,7 +85338,8 @@ ${testOpen}`;
         } : void 0;
         const playwrightCode = sanitizeCode(String(test.playwrightCode || ""), {
           sensitiveEnvMap: options?.sensitiveEnvMap,
-          authStamp
+          authStamp,
+          basePath: options?.basePath
         });
         const leakedSensitiveKeys = findSensitiveLiteralLeaks(playwrightCode, options?.sensitiveEnvMap);
         const authGuardStamped = !!options?.authRecipe && rawTags.includes("@needs-auth") && !rawTags.includes("@auth") && process.env.SHARED_AUTH_INJECT === "true";
@@ -84226,6 +85422,16 @@ ${testOpen}`;
             return false;
           }
         }
+        if ((0, discovery_lint_flags_js_1.isPwMethodPreflightEnabled)()) {
+          const getByCalls = codeForMatcherScan.match(/\.getBy[A-Za-z0-9_]*\s*\(/g) ?? [];
+          for (const call of getByCalls) {
+            const methodName = call.replace(/[\s(]+$/, "").slice(1);
+            if (!exports.VALID_PLAYWRIGHT_GETBY_METHODS.has(methodName)) {
+              logs2?.push(`  \u2717 Rejected "${t.name}": invalid Playwright locator method "${methodName}" (not a real getBy* API \u2014 likely hallucinated)`);
+              return false;
+            }
+          }
+        }
         if (code.includes("// TODO")) {
           logs2?.push(`  \u26A0 "${t.name}" contains TODO comment \u2014 marking as unverified`);
           t.tags = t.tags.filter((tag) => tag !== "@verified");
@@ -85339,6 +86545,35 @@ ${testOpen}`;
       }
       return null;
     }
+    var STRUCTURAL_ACTION_RE = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|selectOption|hover|check|uncheck|setChecked|setInputFiles|dragTo|focus|clear)\s*\(/;
+    var POSITIONAL_PSEUDO_RE = /:(?:last-child|first-child|nth-child|nth-of-type|nth-last-child|nth-last-of-type)\b/i;
+    var TABLE_TOKEN_RE = /\b(?:tr|td|th|tbody|thead)\b/i;
+    var ROW_ANCHOR_RE = /getByRole\s*\(\s*['"`]row['"`]|getByTestId|data-testid|data-test\b|\[role\s*=\s*['"`]row['"`]\]/i;
+    var LOCATOR_ARG_RE = /\.locator\(\s*(['"`])((?:\\.|(?!\1)[\s\S])*?)\1/g;
+    function scanFragileStructuralLocators(code) {
+      const findings = [];
+      const scanCode = code.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " "));
+      for (const rawLine of scanCode.split("\n")) {
+        const line = rawLine.replace(/\/\/.*$/, "");
+        if (!STRUCTURAL_ACTION_RE.test(line))
+          continue;
+        if (ROW_ANCHOR_RE.test(line))
+          continue;
+        LOCATOR_ARG_RE.lastIndex = 0;
+        let m;
+        while ((m = LOCATOR_ARG_RE.exec(line)) !== null) {
+          const css = m[2];
+          if (POSITIONAL_PSEUDO_RE.test(css) && TABLE_TOKEN_RE.test(css)) {
+            findings.push({
+              line: rawLine.trim().slice(0, 200),
+              reason: `Positional table-row selector "${css.slice(0, 120)}" is not scoped to a row identity \u2014 it breaks when rows reorder, sort, filter, or a row is inserted. Scope through the row: page.getByRole('row', { name: '<a stable cell value in that row>' }).getByRole('button', { name: '<verb>' }).`
+            });
+            break;
+          }
+        }
+      }
+      return findings;
+    }
     function validateFinalActionFidelity(playwrightCode, actionLedger, credentials, opts) {
       const ledgerSigs = [];
       for (const entry of actionLedger) {
@@ -85545,7 +86780,11 @@ ${outcomesText}
 ${hasVerifiedRecipe ? "The browser is ALREADY authenticated \u2014 `__vqaLogin(page)` ran first; cookies/session are populated. Do NOT log in again; begin from the authenticated app." : "The browser starts on about:blank with NO cookies, NO session, NO localStorage. You are NOT logged in."}
 The base URL is: ${baseUrl}
 When navigating, use \`browser_navigate\` with the full URL (prepend ${baseUrl}).
-In your generated test code, keep URLs RELATIVE (e.g. \`page.goto('/path')\`) \u2014 Playwright config has baseURL set.
+In your generated test code, keep URLs RELATIVE (e.g. \`page.goto('/path')\`) \u2014 Playwright config has baseURL set.${(() => {
+        const basePath = gotoBasePathFromBaseUrl(baseUrl);
+        return basePath ? `
+IMPORTANT: the base URL has a PATH (\`${basePath}\`), and Playwright's baseURL only prefixes relative paths \u2014 a leading-slash path escapes to the origin root. Every \`page.goto\` path MUST start with \`${basePath}\` (the app home is \`page.goto('${basePath}')\`, NOT \`page.goto('/')\`).` : "";
+      })()}
 
 ${evidenceBlock}${credentialNote}
 ## ASSERTION VERIFICATION WORKFLOW
@@ -85753,7 +86992,9 @@ ${tailBlock}`;
             }
           }
         });
-        const tags = computeSkeletonTags(scenario.targetPages, siteMap.pages);
+        const tags = computeSkeletonTags(scenario.targetPages, siteMap.pages, {
+          extraAuthEvidence: !!opts?.recipe || hasConfiguredLoginCredentials(credentials)
+        });
         const baseSkeletonHadRegression = tags.includes("@regression");
         const hasVerifiedRecipe = !!opts?.recipe && tags.includes("@needs-auth");
         const systemPrompt = buildScenarioSystemPrompt(scenario, baseUrl, credentials, tags, siteMap.pages, { appBrief: opts?.appBrief, availableVariableKeys: opts?.availableVariableKeys, hasVerifiedRecipe, knowledgeContext: opts?.knowledgeContext });
@@ -85772,6 +87013,7 @@ ${tailBlock}`;
         let actionRevisionAttempted = false;
         let ambiguityRevisionAttempted = false;
         let strengthRevisionAttempted = false;
+        let structuralRevisionAttempted = false;
         let lastRenderedLedgerEntryCount = 0;
         const successfulVerifications = [];
         const actionLedger = [];
@@ -85962,7 +87204,7 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
               const suspectedBugDeclared = toolArgs.suspectedBug === true;
               const bugDescription = String(toolArgs.bugDescription || "").slice(0, 500).replace(/[\u0000-\u001F\u007F]+/g, " ").replace(/\s+/g, " ").trim();
               const testObj = { name, description, playwrightCode: code, tags };
-              const validated = validateTests([testObj], logs2, { sensitiveEnvMap: credentials, authRecipe: opts?.recipe ?? null });
+              const validated = validateTests([testObj], logs2, { sensitiveEnvMap: credentials, authRecipe: opts?.recipe ?? null, basePath: gotoBasePathFromBaseUrl(baseUrl) });
               if (validated.length > 0) {
                 if (actionLedger.length > lastRenderedLedgerEntryCount && actionLedger.length > 0) {
                   const renderedLedger = renderSessionRecording(actionLedger, credentials);
@@ -86042,6 +87284,33 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                   });
                   continue;
                 }
+                const structuralLintMode = (0, discovery_lint_flags_js_1.structuralLocatorLintMode)();
+                const structuralFindings = structuralLintMode !== "off" ? scanFragileStructuralLocators(validated[0].playwrightCode) : [];
+                if (structuralLintMode === "warn" && structuralFindings.length > 0) {
+                  logs2.push(`    Structural-locator gate [warn]: ${structuralFindings.length} positional table-row selector(s) \u2014 ${structuralFindings.map((f) => sanitizeLedgerText(f.line)).join(" | ").slice(0, 300)}`);
+                }
+                if (structuralLintMode === "enforce" && structuralFindings.length > 0 && !structuralRevisionAttempted) {
+                  structuralRevisionAttempted = true;
+                  const renderedLedger = actionLedger.length > 0 ? renderSessionRecording(actionLedger, credentials) : "";
+                  if (renderedLedger)
+                    lastRenderedLedgerEntryCount = actionLedger.length;
+                  logs2.push(`    Structural-locator gate: ${structuralFindings.length} positional table-row selector(s) found \u2014 requesting one revision (recording attached: ${renderedLedger ? "yes" : "no"})`);
+                  const structuralPayload = {
+                    acknowledged: false,
+                    valid: false,
+                    revisionRequired: true,
+                    reason: "fragile_structural_locator",
+                    instruction: "One or more locators below select a table row by POSITION (tr:last-child, tr:nth-child, td:nth-child) instead of by identity. Positional row selectors break the moment rows are reordered, sorted, filtered, or a row is inserted.\nFor EACH flagged locator:\n1. Scope through the row IDENTITY: page.getByRole('row', { name: '<a stable cell value in that row \u2014 an id, name, email>' }).getByRole('button', { name: '<verb>' }).\n2. If the row genuinely has no stable text, use a data-testid on the row if one exists.\n3. Keep every other line exactly as-is. Submit the COMPLETE corrected test and call finish_generate again.",
+                    offendingLocators: structuralFindings.map((f) => ({
+                      line: sanitizeLedgerText(f.line),
+                      reason: f.reason
+                    }))
+                  };
+                  if (renderedLedger)
+                    structuralPayload.sessionRecording = renderedLedger;
+                  toolResults.push({ role: "tool", tool_call_id: toolCall.id, content: JSON.stringify(structuralPayload) });
+                  continue;
+                }
                 const ambiguityGateEval = evaluateAmbiguityGate(validated[0].playwrightCode, ambiguityRevisionAttempted, iteration < MAX_SCENARIO_ITERATIONS);
                 const ambiguousLocators = ambiguityGateEval.findings;
                 if (ambiguityGateEval.fire) {
@@ -86081,7 +87350,12 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                 const creditedControlSig = revealVerdict === "revealed" ? assertedSigs.find((s) => revealedControls.has(s)) ?? null : null;
                 let strengthVerdict = null;
                 try {
-                  strengthVerdict = (0, shared_1.validateAssertionStrength)(validated[0].playwrightCode, { revealedControls });
+                  strengthVerdict = (0, shared_1.validateAssertionStrength)(validated[0].playwrightCode, {
+                    revealedControls,
+                    // Opt-in additive-contradiction gate (see assertion-strength.ts). On Fargate this
+                    // env must be dispatcher-forwarded to take effect here; off → byte-identical.
+                    flagContradictedAdditions: process.env.STRENGTH_ADDITIVE_CONTRADICTION_GATE === "true"
+                  });
                 } catch (err) {
                   logs2.push(`    Strength gate errored \u2014 skipping (fail-open): ${String(err)}`);
                 }
@@ -86133,12 +87407,16 @@ Do NOT assert that the button/tab/heading you interacted with is merely visible
                 const strengthSeverity = strengthVerdict?.severity ?? "none";
                 const hasResidualViolations = qualityCheck.offendingLines.length > 0;
                 const hasResidualActionDrift = actionCheck.offendingActions.length > 0;
+                const hasResidualStructural = structuralLintMode === "enforce" && structuralFindings.length > 0;
                 if (hasResidualViolations) {
                   logs2.push(`    Assertion quality gate: violations remain after revision \u2014 downgrading to @needs-review`);
                 }
                 if (hasResidualActionDrift) {
                   logs2.push(`    Action fidelity gate: ${actionCheck.offendingActions.length} action drift(s) remain after revision \u2014 downgrading to @needs-review`);
                 }
+                if (hasResidualStructural) {
+                  logs2.push(`    Structural-locator gate: ${structuralFindings.length} positional table-row selector(s) remain after revision \u2014 downgrading to @needs-review`);
+                }
                 let actualVerified = verified;
                 if (verified && verifyCallCount === 0) {
                   actualVerified = false;
@@ -86191,6 +87469,16 @@ Do NOT assert that the button/tab/heading you interacted with is merely visible
                     residual: ambiguousLocators.length,
                     lines: ambiguousLocators.map((a) => sanitizeLedgerText(a.line))
                   },
+                  // G2 — omitted entirely when off so the off-path healingContext is
+                  // byte-identical; present in warn (measure) + enforce (act) modes.
+                  ...structuralLintMode !== "off" ? {
+                    structuralGate: {
+                      mode: structuralLintMode,
+                      fired: structuralRevisionAttempted,
+                      residual: structuralFindings.length,
+                      lines: structuralFindings.map((f) => sanitizeLedgerText(f.line))
+                    }
+                  } : {},
                   // Durable marker the server promote-seam (failure-analyzer.checkTestStability)
                   // reads to decide ACTIVE vs QUARANTINED(@bug-found) vs hold-DRAFT. Omitted when
                   // the gate errored (fail-open) so a missing marker is treated as "promote".
@@ -86216,7 +87504,7 @@ Do NOT assert that the button/tab/heading you interacted with is merely visible
                   verified: actualVerified,
                   healingContext: { ...baseHealingContext, gateActivity }
                 };
-                if ((hasResidualViolations || hasResidualActionDrift || hasUncoveredOutcomes) && !result.tags.includes("@needs-review")) {
+                if ((hasResidualViolations || hasResidualActionDrift || hasUncoveredOutcomes || hasResidualStructural) && !result.tags.includes("@needs-review")) {
                   result.tags.push("@needs-review");
                 }
                 if (actualVerified) {
@@ -301293,7 +302581,8 @@ ${currentError.slice(0, 2e3)}`
         }
         lastHealedCode = (0, discover_generator_js_1.sanitizeCode)(stripCodeFences(fixedCode), {
           sensitiveEnvMap: testVariables,
-          authStamp: (0, auth_recipe_js_1.buildHealAuthStamp)(playwrightCode, lastFailureError, logs2)
+          authStamp: (0, auth_recipe_js_1.buildHealAuthStamp)(playwrightCode, lastFailureError, logs2),
+          basePath: (0, discover_generator_js_1.gotoBasePathFromBaseUrl)(baseUrl)
         });
         logs2.push("\u{1F680} Running fixed code natively...");
         let verifyResult;
@@ -302747,7 +304036,8 @@ ${errorContent}`;
           }
           const candidateCode = (0, discover_generator_js_1.sanitizeCode)(stripCodeFences(fixedCode), {
             sensitiveEnvMap: testVariables,
-            authStamp: (0, auth_recipe_js_1.buildHealAuthStamp)(playwrightCode, options?.lastFailureError, logs2)
+            authStamp: (0, auth_recipe_js_1.buildHealAuthStamp)(playwrightCode, options?.lastFailureError, logs2),
+            basePath: (0, discover_generator_js_1.gotoBasePathFromBaseUrl)(baseUrl)
           });
           {
             const syntaxCheckCode = (0, discover_generator_js_1.stripTypescriptSyntax)((0, discover_generator_js_1.stripImportDeclarations)(candidateCode));
@@ -304494,7 +305784,8 @@ var require_grok_per_test_healer = __commonJS({
         }
         const healedCode = (0, discover_generator_js_1.sanitizeCode)(payload.playwrightCode, {
           sensitiveEnvMap: secrets,
-          authStamp: (0, auth_recipe_js_1.buildHealAuthStamp)(playwrightCode, options.lastFailureError, logs2)
+          authStamp: (0, auth_recipe_js_1.buildHealAuthStamp)(playwrightCode, options.lastFailureError, logs2),
+          basePath: (0, discover_generator_js_1.gotoBasePathFromBaseUrl)(baseUrl)
         });
         const leakedKey = findLeakedCredential(healedCode, secrets);
         if (leakedKey) {
@@ -305667,7 +306958,8 @@ var require_grok_batch_healer = __commonJS({
       }
       const healedCode = (0, discover_generator_js_1.sanitizeCode)(verdict.playwrightCode, {
         sensitiveEnvMap: secrets,
-        authStamp: (0, auth_recipe_js_1.buildHealAuthStamp)(test.playwrightCode, test.lastFailureError, logs2)
+        authStamp: (0, auth_recipe_js_1.buildHealAuthStamp)(test.playwrightCode, test.lastFailureError, logs2),
+        basePath: (0, discover_generator_js_1.gotoBasePathFromBaseUrl)(baseUrl)
       });
       const leakedKey = findLeakedCredential(healedCode, secrets);
       if (leakedKey) {
@@ -310679,7 +311971,7 @@ var require_discover_explorer = __commonJS({
             },
             requiresAuth: {
               type: "boolean",
-              description: "Whether this page requires authentication"
+              description: "OBSERVED evidence only: true if reaching this page logged-out redirected to a login page, returned 401/403, or showed an explicit sign-in wall. Never infer from content looking account-ish \u2014 a page you read without logging in does NOT require auth."
             },
             observations: {
               type: "array",
@@ -310908,7 +312200,7 @@ You do NOT have a \`record_journey\` tool - your job is mapping, not testing. Do
   2. Action buttons: submit, save, delete, create, edit - include label, triggersSubmit
   3. Navigation links to OTHER pages within the app - include label, triggersNavigation
   4. Skip repeated navigation chrome you already cataloged (sidebar/header links appear on every page)
-- **requiresAuth**: whether the page needs login
+- **requiresAuth**: OBSERVED evidence only \u2014 you were redirected to a login page, got 401/403, or hit a sign-in wall. If you are reading the page without having logged in, it does NOT require auth (account-ish CONTENT is not evidence)
 - **observations**: empty array (you are mapping, not interacting)
 
 ## Loading and readiness
@@ -314606,9 +315898,13 @@ var require_agentic_survey_prompts = __commonJS({
         '      route: string;             // path-only, e.g. "/dashboard/profile"',
         '      type: string;              // "AUTH" | "DASHBOARD" | "FORM" | "LIST" | ...',
         "      summary: string;           // 1-line of key elements/affordances",
-        "      requiresAuth?: boolean;    // true if reaching this page logged-out",
-        "                                 //   redirected to /login OR content was",
-        "                                 //   visibly gated behind authentication",
+        "      requiresAuth?: boolean;    // OBSERVED evidence ONLY: you were redirected",
+        "                                 //   to a login page, got 401/403, or hit an",
+        "                                 //   explicit sign-in wall. NEVER infer it from",
+        "                                 //   content merely LOOKING account-ish \u2014 if you",
+        "                                 //   read the page without logging in, it does",
+        "                                 //   NOT require auth. A site with no login at",
+        "                                 //   all has requiresAuth=false everywhere.",
         "    }>;",
         '    flows?: string[];            // ["/login \u2192 /dashboard (submit form)"]',
         "    observations?: string[];     // things YOU noticed in the loop",
@@ -320442,675 +321738,6 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
   }
 });
 
-// ../runner-core/dist/services/mobile/mobile-exploration-state.js
-var require_mobile_exploration_state = __commonJS({
-  "../runner-core/dist/services/mobile/mobile-exploration-state.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.MobileExplorationState = void 0;
-    exports.stableMobileControlIdentity = stableMobileControlIdentity;
-    exports.classifySafeMobileNavigationControl = classifySafeMobileNavigationControl;
-    exports.deriveScreenId = deriveScreenId;
-    var mobile_observation_js_1 = require_mobile_observation();
-    var DEFAULT_STALE_THRESHOLD = 4;
-    var MAX_SCREEN_OBSERVATIONS = 50;
-    var EDITABLE_CONTROL_ROLE_RE = /(?:android\.widget\.(?:EditText|AutoCompleteTextView)|XCUIElementType(?:TextField|SecureTextField|SearchField|TextView)|textbox|searchbox|combobox|textarea|select)$/i;
-    var STATEFUL_CONTROL_ROLE_RE = /(?:Switch|CheckBox|Checkbox|RadioButton|radio|Slider|SeekBar|Stepper|PickerWheel|Toggle)$/i;
-    var UNSAFE_OR_COMMIT_LABEL_RE = /\b(?:submit|save|confirm|delete|remove|archive|reset|disconnect|deactivate|destroy|purge|pay|purchase|buy|checkout|place\s+order|send|post|publish|upload|import|export|sign\s*out|log\s*out|logout|accept|agree|subscribe|unsubscribe|follow|unfollow|enable|disable|book|reserve|cancel|continue|next|previous|done|apply|retry|close|dismiss|sign\s*in|log\s*in|register)\b/i;
-    var SAFE_MODAL_TRIGGER_LABEL_RE = /^(?:create|new|add|edit|invite|configure|manage|details|preview|share)$/i;
-    var MENU_TRIGGER_LABEL_RE = /^(?:more|menu|options|actions|filter|filters|sort|columns|customize)$/i;
-    var GENERIC_NAVIGATION_DESTINATION_LABEL_RE = /^(?:home|feed|dashboard|profile|settings|inbox|messages?|notifications?|projects?|about|privacy|terms|learn\s+more)$/i;
-    var SYSTEM_BACK_CONTROL_LABEL_RE = /^(?:back|go\s+back|navigate\s+up|navigation\s+up|up)$/i;
-    var SYSTEM_BACK_CONTROL_ID_RE = /^(?:action_bar_up|arrow_back|back_arrow|navigate_up|navigation_up|nav_up|toolbar_back|action_back|btn_back|button_back|back_button|back_btn|back_icon|icon_back)$/i;
-    function normalizeControlIdentityPart(value) {
-      return value.trim().replace(/\s+/g, " ").toLowerCase();
-    }
-    function semanticControlAlias(label) {
-      return `navigation-label:${normalizeControlIdentityPart(label)}`;
-    }
-    function localControlCoverageIdentity(screenId, identity) {
-      return `screen:${screenId}:${identity}`;
-    }
-    function storedMobileControlIdentity(candidate) {
-      return [
-        candidate.identity,
-        `kind:${candidate.kind}`,
-        `label:${normalizeControlIdentityPart(candidate.label)}`
-      ].join(":");
-    }
-    function isSystemBackNavigationControl(element, label) {
-      if (SYSTEM_BACK_CONTROL_LABEL_RE.test(normalizeControlIdentityPart(label)))
-        return true;
-      return [element.accessibilityId, element.resourceId].filter((value) => Boolean(value?.trim())).some((value) => {
-        const leaf = normalizeControlIdentityPart(value).split(/[/:.]/).filter(Boolean).at(-1) ?? "";
-        return SYSTEM_BACK_CONTROL_ID_RE.test(leaf);
-      });
-    }
-    function stableMobileControlIdentity(element) {
-      const role = normalizeControlIdentityPart(element.role || "control");
-      const accessibilityId = element.accessibilityId?.trim();
-      if (accessibilityId)
-        return `a11y:${role}:${normalizeControlIdentityPart(accessibilityId)}`;
-      const resourceId = element.resourceId?.trim();
-      if (resourceId)
-        return `resource:${role}:${normalizeControlIdentityPart(resourceId)}`;
-      const label = (0, mobile_observation_js_1.safeMobileElementLabel)(element)?.trim();
-      if (label)
-        return `semantic:${role}:${normalizeControlIdentityPart(label)}`;
-      return null;
-    }
-    function classifySafeMobileNavigationControl(element) {
-      if (!element.actionable || element.enabled === false)
-        return null;
-      const label = (0, mobile_observation_js_1.safeMobileElementLabel)(element)?.trim();
-      const safetyIdentity = [label, element.accessibilityId, element.resourceId].filter(Boolean).join(" ");
-      if (!label || UNSAFE_OR_COMMIT_LABEL_RE.test(safetyIdentity))
-        return null;
-      if (isSystemBackNavigationControl(element, label))
-        return null;
-      const role = element.role.trim();
-      if (EDITABLE_CONTROL_ROLE_RE.test(role) || STATEFUL_CONTROL_ROLE_RE.test(role))
-        return null;
-      const linkLike = /(?:Link$|^a$)/i.test(role);
-      let kind = null;
-      if (/(?:TabBarItem|\btab\b)/i.test(role))
-        kind = "tab";
-      else if (/menuitem/i.test(role))
-        kind = "menu-item";
-      else if (linkLike && element.navigationProvenance)
-        kind = "link";
-      else if (linkLike)
-        return null;
-      else if (element.hasPopup && element.hasPopup.toLowerCase() !== "false")
-        kind = "menu-trigger";
-      else if (element.expanded === false)
-        kind = "disclosure";
-      else if (MENU_TRIGGER_LABEL_RE.test(label))
-        kind = "menu-trigger";
-      else if (SAFE_MODAL_TRIGGER_LABEL_RE.test(label))
-        kind = "modal-trigger";
-      else if (element.navigationProvenance)
-        kind = "navigation-button";
-      else if (GENERIC_NAVIGATION_DESTINATION_LABEL_RE.test(label))
-        kind = "navigation-button";
-      if (!kind)
-        return null;
-      const identity = stableMobileControlIdentity(element);
-      return identity ? { identity, label, kind } : null;
-    }
-    function sharedMobileControlCoverageIdentity(element, candidate, semanticFamilyId) {
-      if (!element.navigationProvenance)
-        return void 0;
-      const durableId = element.accessibilityId?.trim() ? `a11y:${normalizeControlIdentityPart(element.accessibilityId)}` : element.resourceId?.trim() ? `resource:${normalizeControlIdentityPart(element.resourceId)}` : "";
-      if (!durableId && !semanticFamilyId)
-        return void 0;
-      return [
-        "shared-navigation",
-        element.navigationProvenance,
-        !durableId && semanticFamilyId ? `family:${semanticFamilyId}` : "",
-        candidate.kind,
-        durableId || "semantic-only",
-        normalizeControlIdentityPart(candidate.label)
-      ].filter(Boolean).join(":");
-    }
-    function mobileNavigationRegion(element, windowSize) {
-      if (!windowSize || windowSize.width <= 0 || windowSize.height <= 0)
-        return "unknown";
-      const centerX = (element.bounds.x + element.bounds.width / 2) / windowSize.width;
-      const centerY = (element.bounds.y + element.bounds.height / 2) / windowSize.height;
-      if (centerY >= 0.72)
-        return "bottom";
-      if (centerY <= 0.28)
-        return "top";
-      if (centerX <= 0.35)
-        return "left";
-      if (centerX >= 0.65)
-        return "right";
-      return "center";
-    }
-    function buildSemanticNavigationGroups(elements, windowSize) {
-      const groups = /* @__PURE__ */ new Map();
-      for (const element of elements) {
-        if (!element.navigationProvenance)
-          continue;
-        const candidate = classifySafeMobileNavigationControl(element);
-        if (!candidate)
-          continue;
-        const groupKey = `${element.navigationProvenance}:${mobileNavigationRegion(element, windowSize)}`;
-        const labels = groups.get(groupKey) ?? /* @__PURE__ */ new Set();
-        labels.add(`${candidate.kind}:${normalizeControlIdentityPart(candidate.label)}`);
-        groups.set(groupKey, labels);
-      }
-      return new Map([...groups].filter(([, labels]) => labels.size >= 2));
-    }
-    function deriveScreenId(signal) {
-      const namespace = signal.activity?.trim() || signal.bundleId?.trim();
-      return namespace ? `${namespace}#${signal.screenHash}` : signal.screenHash;
-    }
-    function observedElementIdentity(element) {
-      return (0, mobile_observation_js_1.stableParsedMobileElementIdentity)(element);
-    }
-    function mergeObservedElements(previous, current) {
-      const merged = [...current];
-      const seen = new Set(current.map(observedElementIdentity));
-      for (const element of previous) {
-        const identity = observedElementIdentity(element);
-        if (seen.has(identity))
-          continue;
-        seen.add(identity);
-        merged.push(element);
-      }
-      return merged;
-    }
-    function sanitizeElementsForEvidence(elements) {
-      return elements.map((element) => {
-        const label = (0, mobile_observation_js_1.safeMobileElementLabel)(element);
-        return {
-          ...element,
-          ...label ? { label } : { label: void 0 },
-          text: void 0
-        };
-      });
-    }
-    var MobileExplorationState = class {
-      /** screenId -> ScreenState (the mobile analog of routeState). */
-      screens = /* @__PURE__ */ new Map();
-      /** Observed directed transitions between screens. */
-      transitions = [];
-      /** Transition-announced screens that do not yet have a live observation. */
-      frontier = /* @__PURE__ */ new Map();
-      /** Safe navigation controls observed on each screen, keyed by stable identity. */
-      safeControlsByScreen = /* @__PURE__ */ new Map();
-      /** Screen-scoped coverage keys plus explicitly proven shared-navigation keys. */
-      attemptedSafeControlCoverageIdentities = /* @__PURE__ */ new Set();
-      successfulSafeControlAttemptCount = 0;
-      /** Repeated id-less structural navigation families, grouped by region. */
-      semanticNavigationFamilies = /* @__PURE__ */ new Map();
-      nextSemanticNavigationFamilyId = 1;
-      /** The screen-id of the most recently observed screen. */
-      currentScreenId = null;
-      /** Latest iteration recorded (drives stale detection + firstSeen stamps). */
-      iteration = 0;
-      /** Stale detector: progress mark (#screens + #total elements) at last advance. */
-      lastProgressMark = 0;
-      /** Consecutive iterations observed with no progress. */
-      staleIterations = 0;
-      staleThreshold;
-      constructor(options = {}) {
-        this.staleThreshold = typeof options.staleThreshold === "number" && options.staleThreshold > 0 ? Math.floor(options.staleThreshold) : DEFAULT_STALE_THRESHOLD;
-      }
-      // -------------------------------------------------------------------------
-      // Observation recording
-      // -------------------------------------------------------------------------
-      /**
-       * Returns true when `signal` identifies a screen this run has never observed
-       * before. Pure read — does not mutate state.
-       */
-      isNewScreen(signal) {
-        return !this.screens.has(deriveScreenId(signal));
-      }
-      /**
-       * Record an observation of `screen` at `iteration`. Creates a `ScreenState`
-       * on first sight (stamping `firstSeenIteration`), otherwise refreshes the
-       * stored element set (latest-wins, mirroring the web reducer's PAGE_CAPTURED
-       * element refresh). A driver observation already contains the structural UI
-       * tree, elements, screenshot association, and screen identity, so it is
-       * captured evidence immediately; the model's capture_screen call only adds
-       * a friendly name/type. Returns the resolved screen-id.
-       */
-      recordObservation(signal, screen, iteration) {
-        this.iteration = iteration;
-        const screenId = deriveScreenId(signal);
-        const evidenceElements = sanitizeElementsForEvidence(screen.elements);
-        const existing = this.screens.get(screenId);
-        if (existing) {
-          this.screens.set(screenId, {
-            ...existing,
-            elements: mergeObservedElements(existing.elements, evidenceElements)
-          });
-        } else {
-          this.screens.set(screenId, {
-            screenId,
-            firstSeenIteration: iteration,
-            elements: evidenceElements,
-            visited: true
-          });
-        }
-        this.frontier.delete(screenId);
-        const controls = this.safeControlsByScreen.get(screenId) ?? /* @__PURE__ */ new Map();
-        const semanticNavigationGroups = buildSemanticNavigationGroups(evidenceElements, screen.windowSize);
-        const semanticNavigationFamilyIds = /* @__PURE__ */ new Map();
-        for (const [groupKey, labels] of semanticNavigationGroups) {
-          semanticNavigationFamilyIds.set(groupKey, this.resolveSemanticNavigationFamilyId(groupKey, labels));
-        }
-        for (const element of evidenceElements) {
-          const candidate = classifySafeMobileNavigationControl(element);
-          if (!candidate)
-            continue;
-          const storedIdentity = storedMobileControlIdentity(candidate);
-          const semanticGroupKey = element.navigationProvenance ? `${element.navigationProvenance}:${mobileNavigationRegion(element, screen.windowSize)}` : "";
-          controls.set(storedIdentity, {
-            ...candidate,
-            identity: storedIdentity,
-            sharedCoverageIdentity: sharedMobileControlCoverageIdentity(element, candidate, semanticNavigationFamilyIds.get(semanticGroupKey))
-          });
-        }
-        if (controls.size > 0)
-          this.safeControlsByScreen.set(screenId, controls);
-        this.currentScreenId = screenId;
-        this.updateStaleProgress();
-        return screenId;
-      }
-      /**
-       * Back-compatible acknowledgement from capture_screen. Observation already
-       * marks structural evidence visited; this call only resolves a rare pending
-       * transition frontier and preserves callers that annotate explicitly.
-       */
-      markVisited(screenId) {
-        const state2 = this.screens.get(screenId);
-        if (state2 && !state2.visited) {
-          this.screens.set(screenId, { ...state2, visited: true });
-        }
-        this.frontier.delete(screenId);
-      }
-      /**
-       * Record a confirmed tap against a safe navigation candidate. Callers invoke
-       * this only after the driver reports success; recovery-unknown, stale-ref, and
-       * failed actions must remain on the breadth frontier.
-       */
-      noteControlAttempt(screenId, element) {
-        if (!screenId)
-          return false;
-        const candidate = classifySafeMobileNavigationControl(element);
-        const controls = this.safeControlsByScreen.get(screenId) ?? /* @__PURE__ */ new Map();
-        if (candidate) {
-          const storedIdentity = storedMobileControlIdentity(candidate);
-          const existing = controls.get(storedIdentity);
-          controls.set(storedIdentity, {
-            ...candidate,
-            identity: storedIdentity,
-            sharedCoverageIdentity: existing?.sharedCoverageIdentity ?? sharedMobileControlCoverageIdentity(element, candidate)
-          });
-          this.safeControlsByScreen.set(screenId, controls);
-        }
-        const tappedLabel = (0, mobile_observation_js_1.safeMobileElementLabel)(element)?.trim();
-        if (!tappedLabel)
-          return false;
-        const before = this.attemptedSafeControlCoverageIdentities.size;
-        const alias = semanticControlAlias(tappedLabel);
-        for (const control of controls.values()) {
-          if (semanticControlAlias(control.label) === alias) {
-            this.attemptedSafeControlCoverageIdentities.add(localControlCoverageIdentity(screenId, control.identity));
-            if (control.sharedCoverageIdentity) {
-              this.attemptedSafeControlCoverageIdentities.add(control.sharedCoverageIdentity);
-            }
-          }
-        }
-        if (this.attemptedSafeControlCoverageIdentities.size > before) {
-          this.successfulSafeControlAttemptCount += 1;
-          this.staleIterations = 0;
-          return true;
-        }
-        return false;
-      }
-      /** Attach a human-friendly name / coarse type to a screen (capture_screen). */
-      annotateScreen(screenId, annotation) {
-        const state2 = this.screens.get(screenId);
-        if (!state2)
-          return;
-        this.screens.set(screenId, {
-          ...state2,
-          screenName: annotation.screenName ?? state2.screenName,
-          screenType: annotation.screenType ?? state2.screenType
-        });
-      }
-      /** Attach structurally observed authentication provenance to a screen. */
-      setScreenAuthEvidence(screenId, evidence) {
-        const state2 = this.screens.get(screenId);
-        if (!state2)
-          return;
-        this.screens.set(screenId, {
-          ...state2,
-          requiresAuth: evidence.requiresAuth,
-          authProvenance: evidence.authProvenance,
-          sessionState: { ...evidence.sessionState }
-        });
-      }
-      /** Append a free-form observation note to a screen (observations tool). */
-      addScreenObservation(screenId, note) {
-        const state2 = this.screens.get(screenId);
-        if (!state2)
-          return;
-        const normalized = note.trim();
-        if (!normalized)
-          return;
-        const current = state2.observations ?? [];
-        if (current.some((existing) => existing.trim().toLowerCase() === normalized.toLowerCase())) {
-          return;
-        }
-        const observations = [...current, normalized].slice(-MAX_SCREEN_OBSERVATIONS);
-        this.screens.set(screenId, { ...state2, observations });
-      }
-      /**
-       * Record a directed transition between two screens. Both endpoints are
-       * ensured to exist on the frontier if not yet observed (mirrors the web
-       * reducer adding both ends of a TRANSITION_RECORDED to the frontier). The
-       * `toScreenId` becomes the current screen when the transition starts from the
-       * current screen.
-      */
-      recordTransition(transition) {
-        let recordedTransition = transition;
-        if (!transition.viaControlIdentity && transition.viaRef) {
-          const sourceElement = this.screens.get(transition.fromScreenId)?.elements.find((element) => element.ref === transition.viaRef);
-          if (sourceElement) {
-            recordedTransition = {
-              ...transition,
-              viaControlIdentity: (0, mobile_observation_js_1.stableParsedMobileElementIdentity)(sourceElement)
-            };
-          }
-        }
-        const alreadyRecorded = this.transitions.some((existing) => existing.fromScreenId === recordedTransition.fromScreenId && existing.toScreenId === recordedTransition.toScreenId && existing.action === recordedTransition.action);
-        if (!alreadyRecorded) {
-          this.transitions.push(recordedTransition);
-        }
-        for (const endpointId of [transition.fromScreenId, transition.toScreenId]) {
-          if (!this.screens.has(endpointId) && !this.frontier.has(endpointId)) {
-            this.frontier.set(endpointId, {
-              screenId: endpointId,
-              source: "transition",
-              discoveredAtIteration: this.iteration
-            });
-          }
-        }
-        if (transition.fromScreenId === this.currentScreenId) {
-          this.currentScreenId = transition.toScreenId;
-        }
-      }
-      // -------------------------------------------------------------------------
-      // Selectors
-      // -------------------------------------------------------------------------
-      /** The current screen-id (most recently observed), or null before any observation. */
-      getCurrentScreenId() {
-        return this.currentScreenId;
-      }
-      /** ScreenState for `screenId`, if known. */
-      getScreen(screenId) {
-        return this.screens.get(screenId);
-      }
-      /** Number of distinct screens observed this run. */
-      getScreenCount() {
-        return this.screens.size;
-      }
-      /** Number of screens backed by a live structural driver observation. */
-      getVisitedScreenCount() {
-        let total = 0;
-        for (const state2 of this.screens.values()) {
-          if (state2.visited)
-            total += 1;
-        }
-        return total;
-      }
-      /** Total elements observed across all known screens (latest snapshot each). */
-      getTotalElementCount() {
-        let total = 0;
-        for (const state2 of this.screens.values()) {
-          total += state2.elements.length;
-        }
-        return total;
-      }
-      /**
-       * Frontier screen-ids ranked by recency (most recently discovered first),
-       * excluding any screen already visited. Mirrors the web `getRankedFrontier`
-       * intent (filter visited, rank by recency) — without URL prefix similarity,
-       * which has no mobile analog.
-       */
-      getFrontier() {
-        return [...this.frontier.values()].filter((item) => {
-          const state2 = this.screens.get(item.screenId);
-          return !state2 || !state2.visited;
-        }).sort((a, b) => b.discoveredAtIteration - a.discoveredAtIteration).map((item) => item.screenId);
-      }
-      /** Safe navigation candidates not yet attempted, deduped across shared chrome. */
-      getUnexploredSafeNavigationCandidates() {
-        const authenticatedProductObserved = [...this.screens.values()].some((screen) => screen.requiresAuth === true);
-        const candidates = [];
-        for (const [screenId, controls] of this.safeControlsByScreen) {
-          const origin = this.screens.get(screenId);
-          const originIsConfirmedPublicEntry = origin?.authProvenance === "public" || !origin?.authProvenance && origin?.requiresAuth !== true && /^(?:AUTH|LANDING)$/i.test(origin?.screenType ?? "");
-          if (authenticatedProductObserved && originIsConfirmedPublicEntry)
-            continue;
-          for (const control of controls.values()) {
-            const alias = semanticControlAlias(control.label);
-            const coverageIdentity = control.sharedCoverageIdentity ?? localControlCoverageIdentity(screenId, control.identity);
-            if (this.attemptedSafeControlCoverageIdentities.has(coverageIdentity) || this.attemptedSafeControlCoverageIdentities.has(localControlCoverageIdentity(screenId, control.identity)))
-              continue;
-            const existing = candidates.find((candidate) => candidate.identity === coverageIdentity || candidate.alias === alias && candidate.screenIds.has(screenId));
-            if (existing) {
-              existing.screenIds.add(screenId);
-            } else {
-              candidates.push({
-                identity: coverageIdentity,
-                label: control.label,
-                kind: control.kind,
-                alias,
-                screenIds: /* @__PURE__ */ new Set([screenId])
-              });
-            }
-          }
-        }
-        return candidates.map((candidate) => ({
-          identity: candidate.identity,
-          label: candidate.label,
-          kind: candidate.kind,
-          screenIds: [...candidate.screenIds]
-        })).sort((a, b) => {
-          const aCurrent = this.currentScreenId !== null && a.screenIds.includes(this.currentScreenId);
-          const bCurrent = this.currentScreenId !== null && b.screenIds.includes(this.currentScreenId);
-          if (aCurrent !== bCurrent)
-            return aCurrent ? -1 : 1;
-          return b.screenIds.length - a.screenIds.length;
-        });
-      }
-      /** Harness-owned survey completion floor, independent of model assertions. */
-      getSurveyBreadthCoverage() {
-        const unvisitedScreenIds = this.getFrontier();
-        const unexploredControls = this.getUnexploredSafeNavigationCandidates();
-        const complete = unvisitedScreenIds.length === 0 && unexploredControls.length === 0;
-        const missing = [];
-        if (unvisitedScreenIds.length > 0) {
-          missing.push(`${unvisitedScreenIds.length} uncaptured screen(s)`);
-        }
-        if (unexploredControls.length > 0) {
-          missing.push(`${unexploredControls.length} safe navigation control(s)`);
-        }
-        return {
-          required: true,
-          complete,
-          unvisitedScreenIds,
-          unexploredControls,
-          attemptedControlCount: this.successfulSafeControlAttemptCount,
-          ...missing.length > 0 ? { reason: `Missing ${missing.join(" and ")}.` } : {}
-        };
-      }
-      /**
-       * Monotonic structural progress token for adaptive survey leases. Frontier
-       * cardinality alone is insufficient: attempting control A can reveal control
-       * B and leave the remaining count unchanged even though real work happened.
-       */
-      getSurveyBreadthProgressMark() {
-        const discoveredControlIdentities = /* @__PURE__ */ new Set();
-        for (const [screenId, controls] of this.safeControlsByScreen) {
-          for (const control of controls.values()) {
-            discoveredControlIdentities.add(control.sharedCoverageIdentity ?? localControlCoverageIdentity(screenId, control.identity));
-          }
-        }
-        return [
-          `screens:${this.screens.size}`,
-          `attempts:${this.successfulSafeControlAttemptCount}`,
-          `controls:${discoveredControlIdentities.size}`,
-          `transitions:${this.transitions.length}`
-        ].join("|");
-      }
-      resolveSemanticNavigationFamilyId(groupKey, labels) {
-        const families = this.semanticNavigationFamilies.get(groupKey) ?? [];
-        let best;
-        let bestIntersection = 0;
-        for (const family of families) {
-          let intersection = 0;
-          for (const label of labels) {
-            if (family.labels.has(label))
-              intersection += 1;
-          }
-          const overlap = intersection / Math.min(labels.size, family.labels.size);
-          if (intersection >= 2 && overlap >= 0.6 && intersection > bestIntersection) {
-            best = family;
-            bestIntersection = intersection;
-          }
-        }
-        if (best) {
-          for (const label of labels)
-            best.labels.add(label);
-          return best.id;
-        }
-        const created = {
-          id: `semantic-nav-family-${this.nextSemanticNavigationFamilyId++}`,
-          labels: new Set(labels)
-        };
-        families.push(created);
-        this.semanticNavigationFamilies.set(groupKey, families);
-        return created.id;
-      }
-      /** Observed transitions (defensive copy). */
-      getTransitions() {
-        return [...this.transitions];
-      }
-      // -------------------------------------------------------------------------
-      // Stale-progress detection (ported semantics from the web stale guard)
-      // -------------------------------------------------------------------------
-      /**
-       * Progress mark: distinct screens weighted heavily, plus total elements seen.
-       * A run advances this mark whenever it finds a new screen OR new elements;
-       * the stale detector triggers when the mark stops advancing for
-       * `staleThreshold` consecutive iterations.
-       */
-      getProgressMark() {
-        return this.screens.size * 1e3 + this.transitions.length * 100 + this.successfulSafeControlAttemptCount * 10 + this.getTotalElementCount();
-      }
-      updateStaleProgress() {
-        const mark = this.getProgressMark();
-        if (mark > this.lastProgressMark) {
-          this.lastProgressMark = mark;
-          this.staleIterations = 0;
-        } else {
-          this.staleIterations += 1;
-        }
-      }
-      /** Consecutive no-progress iterations observed so far. */
-      getStaleIterations() {
-        return this.staleIterations;
-      }
-      /**
-       * True when the run has gone `staleThreshold` consecutive iterations with no
-       * new screen and no new element — the signal the explorer uses to nudge or
-       * finish (mirrors the web explorer's stale guard).
-       */
-      isStaleProgress() {
-        return this.staleIterations >= this.staleThreshold;
-      }
-      // -------------------------------------------------------------------------
-      // Planner evidence export
-      // -------------------------------------------------------------------------
-      /**
-       * Snapshot the screen-graph as a plain object (frozen mobile-types
-       * `MobileScreenGraph`). Defensive copies so callers cannot mutate internal
-       * state.
-       */
-      toScreenGraph() {
-        const screens = /* @__PURE__ */ new Map();
-        for (const [id, state2] of this.screens) {
-          screens.set(id, {
-            ...state2,
-            elements: [...state2.elements],
-            observations: state2.observations ? [...state2.observations] : void 0,
-            sessionState: state2.sessionState ? { ...state2.sessionState } : void 0
-          });
-        }
-        return {
-          screens,
-          transitions: this.transitions.map((t) => ({
-            fromScreenId: t.fromScreenId,
-            toScreenId: t.toScreenId,
-            viaRef: t.viaRef,
-            viaControlIdentity: t.viaControlIdentity,
-            action: t.action
-          }))
-        };
-      }
-      /**
-       * Build the planner evidence shape: one `CollectedPageData` per screen, with
-       * the screen-id carried in BOTH `route` (the on-the-wire positional field the
-       * server keys screenshots by) AND the explicit `screenId` field (per the
-       * Phase-0 `CollectedPageData.screenId` contract). `elements` are mapped from
-       * the screen's parsed actionable elements into the platform-neutral
-       * `CollectedPageElement[]` shape the server persists as SiteElements — without
-       * this, mobile screens land with zero elements (coverage always 0%, no element
-       * intelligence). `triggersNavigation` is derived from the durable source
-       * element identity captured when the transition happened (with ref-only
-       * fallback for legacy transitions). Insertion order matches first-seen order.
-       */
-      buildInMemoryScreenMap() {
-        const pages = [];
-        const ordered = [...this.screens.values()].sort((a, b) => a.firstSeenIteration - b.firstSeenIteration);
-        const navRefsByScreen = /* @__PURE__ */ new Map();
-        const navIdentitiesByScreen = /* @__PURE__ */ new Map();
-        for (const transition of this.transitions) {
-          if (transition.viaControlIdentity) {
-            const set = navIdentitiesByScreen.get(transition.fromScreenId) ?? /* @__PURE__ */ new Set();
-            set.add(transition.viaControlIdentity);
-            navIdentitiesByScreen.set(transition.fromScreenId, set);
-          } else if (transition.viaRef) {
-            const set = navRefsByScreen.get(transition.fromScreenId) ?? /* @__PURE__ */ new Set();
-            set.add(transition.viaRef);
-            navRefsByScreen.set(transition.fromScreenId, set);
-          }
-        }
-        for (const state2 of ordered) {
-          const page = {
-            route: state2.screenId,
-            screenId: state2.screenId,
-            pageType: state2.screenType ?? "UNKNOWN",
-            elements: (0, mobile_observation_js_1.buildCollectedElementsForScreen)(state2.elements, {
-              navigationRefs: navRefsByScreen.get(state2.screenId),
-              navigationIdentities: navIdentitiesByScreen.get(state2.screenId)
-            }),
-            requiresAuth: state2.requiresAuth ?? false
-          };
-          if (state2.sessionState) {
-            page.sessionState = { ...state2.sessionState };
-          }
-          if (state2.screenName) {
-            page.title = state2.screenName;
-          }
-          if (state2.observations && state2.observations.length > 0) {
-            page.observations = state2.observations.map((note) => ({
-              action: "observe",
-              outcome: note,
-              outcomeType: "SUCCESS"
-            }));
-          }
-          pages.push(page);
-        }
-        return pages;
-      }
-      /** Alias for `buildInMemoryScreenMap()` — name parity with the planner-evidence call site. */
-      toScreenMap() {
-        return this.buildInMemoryScreenMap();
-      }
-    };
-    exports.MobileExplorationState = MobileExplorationState;
-  }
-});
-
 // ../runner-core/dist/services/mobile/mobile-discovery-agent.js
 var require_mobile_discovery_agent = __commonJS({
   "../runner-core/dist/services/mobile/mobile-discovery-agent.js"(exports) {
@@ -321406,7 +322033,7 @@ Explore complete: ${explore.exploreStats.pagesDiscovered} screens, ${explore.exp
           };
         }
         if (isSurvey && explore.authCoverage && !explore.authCoverage.complete) {
-          throw new Error("Mobile survey authentication coverage is incomplete; planning was skipped. " + (explore.authCoverage.reason ?? "No authenticated product screen was proven."));
+          log2("Mobile survey continuing to planning with incomplete authenticated coverage: " + (explore.authCoverage.reason ?? "No authenticated product screen was proven."));
         }
         if (isSurvey && explore.breadthCoverage && !explore.breadthCoverage.complete) {
           log2("Mobile survey continuing to planning with residual breadth gaps: " + (explore.breadthCoverage.reason ?? "Unvisited screens or safe navigation controls remain."));
@@ -321667,6 +322294,9 @@ Fatal error: ${msg}`);
       if (explore.breadthCoverage && !explore.breadthCoverage.complete) {
         warnings.push("Discovery retained the captured mobile screen graph with residual navigation gaps: " + (explore.breadthCoverage.reason ?? "some observed controls could not be revisited."));
       }
+      if (explore.authCoverage && !explore.authCoverage.complete) {
+        warnings.push("Discovery retained the captured mobile screen graph with incomplete authenticated coverage: " + (explore.authCoverage.reason ?? "no authenticated product screen was proven."));
+      }
       if (explore.truncated) {
         const reasonLabel = explore.truncatedReason === "rate_limit" ? "AI rate-limit" : explore.truncatedReason === "timeout" ? "AI timeout" : "AI error";
         warnings.push(`Discovery may be incomplete: exploration aborted by ${reasonLabel}. Re-run after the limit clears for a complete screen graph.`);
@@ -336176,7 +336806,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.37",
+      version: "1.0.39",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -339434,8 +340064,9 @@ async function activateTargetApp(sessionId, platform3, appId) {
   const args = platform3 === "IOS" ? [{ bundleId: appId }] : [{ appId }];
   await executeMobileScript(sessionId, "mobile: activateApp", args);
 }
+var APP_TERMINATE_TIMEOUT_MS = 5e3;
 async function terminateTargetApp(sessionId, platform3, appId) {
-  const args = platform3 === "IOS" ? [{ bundleId: appId }] : [{ appId }];
+  const args = platform3 === "IOS" ? [{ bundleId: appId, timeout: APP_TERMINATE_TIMEOUT_MS }] : [{ appId, timeout: APP_TERMINATE_TIMEOUT_MS }];
   await executeMobileScript(sessionId, "mobile: terminateApp", args);
 }
 async function freshLaunchTargetApp(sessionId, platform3, appId, log2) {
@@ -342446,7 +343077,11 @@ var MobileBridgeDriver = class {
   async relaunch() {
     await this.withSessionRecovery("app relaunch", async () => {
       const args = this.appLifecycleArgs();
-      await this.executeScript("mobile: terminateApp", [args]);
+      try {
+        await this.executeScript("mobile: terminateApp", [{ ...args, timeout: 5e3 }]);
+      } catch (err) {
+        if (isRecoverableAppiumSessionFailure(err)) throw err;
+      }
       await this.executeScript("mobile: activateApp", [args]);
       try {
         await waitForColdBootSettle(this.sessionPath);