@validate.qa/runner 1.0.52 → 1.0.54

package/dist/cli.mjs

@@ -5609,6 +5609,91 @@ var init_env_flags = __esm({
   }
 });
 
+// ../shared/dist/analytics-url.js
+function isSensitiveQueryKey(key) {
+  return SENSITIVE_QUERY_KEY_RE.test(key);
+}
+function scrubSearchParams(search) {
+  if (!search)
+    return "";
+  const raw = search.startsWith("?") ? search.slice(1) : search;
+  if (!raw)
+    return "";
+  try {
+    const params = new URLSearchParams(raw);
+    let changed = false;
+    for (const key of [...params.keys()]) {
+      if (isSensitiveQueryKey(key)) {
+        params.set(key, "[redacted]");
+        changed = true;
+      }
+    }
+    if (!changed) {
+      return `?${raw}`;
+    }
+    const next = params.toString();
+    return next ? `?${next}` : "";
+  } catch {
+    return "";
+  }
+}
+function scrubUrl(url) {
+  if (!url)
+    return url;
+  try {
+    const parsed = new URL(url, typeof window !== "undefined" ? window.location.origin : "https://local.invalid");
+    parsed.search = scrubSearchParams(parsed.search);
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    const noHash = url.split("#")[0] ?? url;
+    const q = noHash.indexOf("?");
+    if (q === -1)
+      return noHash;
+    return `${noHash.slice(0, q)}${scrubSearchParams(noHash.slice(q))}`;
+  }
+}
+function safeCurrentUrl() {
+  if (typeof window === "undefined")
+    return "";
+  try {
+    return scrubUrl(window.location.href);
+  } catch {
+    return window.location.pathname;
+  }
+}
+function stripQuery(value) {
+  const idx = value.indexOf("?");
+  return idx === -1 ? value : value.slice(0, idx);
+}
+function scrubUrlPropertyBag(props) {
+  if (!props)
+    return;
+  const urlKeys = ["$current_url", "$referrer", "$initial_current_url", "$initial_referrer"];
+  for (const key of urlKeys) {
+    const value = props[key];
+    if (typeof value === "string") {
+      props[key] = scrubUrl(value);
+    }
+  }
+  for (const key of ["$pathname", "$initial_pathname"]) {
+    const value = props[key];
+    if (typeof value === "string" && value.includes("?")) {
+      props[key] = stripQuery(value);
+    }
+  }
+  if (typeof props.search === "string") {
+    props.search = scrubSearchParams(props.search) || void 0;
+  }
+}
+var SENSITIVE_QUERY_KEY_RE;
+var init_analytics_url = __esm({
+  "../shared/dist/analytics-url.js"() {
+    "use strict";
+    SENSITIVE_QUERY_KEY_RE = /^(access_token|refresh_token|id_token|token|code|state|password|secret|api[_-]?key|auth|authorization|session|jwt|otp|email|phone|magic[_-]?link)$|token|secret|password|credential|email|phone|(^|[_-])(otp|verification|auth)[_-]?code($|[_-])|(^|[_-])(state|session)$/i;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5751,6 +5836,7 @@ __export(dist_exports, {
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
+  isSensitiveQueryKey: () => isSensitiveQueryKey,
   isSharedAuthInjectEnabled: () => isSharedAuthInjectEnabled,
   isSttModelForProvider: () => isSttModelForProvider,
   isTestReadyForPlatform: () => isTestReadyForPlatform,
@@ -5784,9 +5870,13 @@ __export(dist_exports, {
   resolveMobileStepValuePlaceholders: () => resolveMobileStepValuePlaceholders,
   resolvePlatformLocatorBundle: () => resolvePlatformLocatorBundle,
   resolveSttModelForProvider: () => resolveSttModelForProvider,
+  safeCurrentUrl: () => safeCurrentUrl,
   safeOrigin: () => safeOrigin,
   sanitizeSttErrorMessage: () => sanitizeSttErrorMessage,
   sanitizeTestVariables: () => sanitizeTestVariables,
+  scrubSearchParams: () => scrubSearchParams,
+  scrubUrl: () => scrubUrl,
+  scrubUrlPropertyBag: () => scrubUrlPropertyBag,
   selectorCandidatesForStep: () => selectorCandidatesForStep,
   selectorForValue: () => selectorForValue,
   stepAppliesToPlatform: () => stepAppliesToPlatform,
@@ -5830,6 +5920,7 @@ var init_dist = __esm({
     init_voice_config();
     init_feature_flags();
     init_env_flags();
+    init_analytics_url();
   }
 });
 
@@ -7707,6 +7798,7 @@ var require_credential_tools = __commonJS({
     exports.buildCredentialPromptBlock = buildCredentialPromptBlock;
     exports.isLikelyCredentialKey = isLikelyCredentialKey;
     exports.partitionTestVariables = partitionTestVariables;
+    exports.hasUsableLoginIdentity = hasUsableLoginIdentity;
     exports.renderPublicVariablesBlock = renderPublicVariablesBlock;
     exports.handleFillCredential = handleFillCredential;
     exports.handleFillCredentialForm = handleFillCredentialForm;
@@ -7854,6 +7946,25 @@ CREDENTIAL ROTATION (rare \u2014 read this carefully):
       }
       return { secrets, publics };
     }
+    var IDENTITY_KEY_PATTERN = /^(TEST_|E2E_|QA_)?(USER_?EMAIL|USER_?NAME|USERNAME|LOGIN_?ID|LOGIN_?EMAIL|ACCOUNT_?EMAIL)$/i;
+    var BOOLEAN_LIKE_VALUE = /^(true|false|1|0|yes|no|on|off|enabled|disabled)$/i;
+    var EMAIL_SHAPED_VALUE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+    function hasUsableLoginIdentity(vars, opts) {
+      if (!vars)
+        return false;
+      return Object.entries(vars).some(([k, rawValue]) => {
+        const v = (rawValue ?? "").trim();
+        if (!v)
+          return false;
+        if (!IDENTITY_KEY_PATTERN.test(k.trim()))
+          return false;
+        if (BOOLEAN_LIKE_VALUE.test(v))
+          return false;
+        if (/EMAIL/i.test(k) && !EMAIL_SHAPED_VALUE.test(v))
+          return false;
+        return !opts?.isPlaceholderIdentityValue?.(v);
+      });
+    }
     function renderPublicVariablesBlock(publics) {
       const entries = Object.entries(publics);
       if (entries.length === 0)
@@ -72456,6 +72567,7 @@ var require_verification_inbox = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.VerificationInboxReader = void 0;
     exports.isVerificationInboxConfigured = isVerificationInboxConfigured;
+    exports.describeVerificationInboxConfigGap = describeVerificationInboxConfigGap;
     exports.loadVerificationInboxConfig = loadVerificationInboxConfig;
     exports.shouldUseUidWatermark = shouldUseUidWatermark;
     exports.recipientMatchesAddress = recipientMatchesAddress;
@@ -72477,6 +72589,21 @@ var require_verification_inbox = __commonJS({
     function isVerificationInboxConfigured(env = process.env) {
       return !!(readEnv(env, "VERIFICATION_INBOX_HOST") && readEnv(env, "VERIFICATION_INBOX_USER") && readEnv(env, "VERIFICATION_INBOX_PASSWORD") && readEnv(env, "VERIFICATION_INBOX_ADDRESS"));
     }
+    var REQUIRED_INBOX_ENV_KEYS = [
+      "VERIFICATION_INBOX_HOST",
+      "VERIFICATION_INBOX_USER",
+      "VERIFICATION_INBOX_PASSWORD",
+      "VERIFICATION_INBOX_ADDRESS"
+    ];
+    function describeVerificationInboxConfigGap(env = process.env) {
+      const missing = REQUIRED_INBOX_ENV_KEYS.filter((key) => !readEnv(env, key));
+      if (missing.length === 0)
+        return null;
+      if (missing.length === REQUIRED_INBOX_ENV_KEYS.length) {
+        return "verification inbox not configured (no VERIFICATION_INBOX_* env)";
+      }
+      return `verification inbox PARTIALLY configured \u2014 missing: ${missing.join(", ")}`;
+    }
     function loadVerificationInboxConfig(env = process.env) {
       if (!isVerificationInboxConfigured(env))
         return null;
@@ -73085,14 +73212,16 @@ var require_inbox_tools = __commonJS({
   "../runner-core/dist/services/inbox-tools.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.INBOX_TOOL_NAMES = exports.INBOX_TOOLS = exports.OPEN_VERIFICATION_LINK_TOOL = exports.GET_VERIFICATION_LINK_TOOL = exports.EXTRACT_VERIFICATION_CODE_TOOL = exports.READ_VERIFICATION_EMAIL_TOOL = exports.WAIT_FOR_VERIFICATION_TOOL = exports.CHECK_INBOX_TOOL = exports.PROVISION_IDENTITY_TOOL = void 0;
+    exports.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = exports.INBOX_TOOL_NAMES = exports.INBOX_TOOLS = exports.OPEN_VERIFICATION_LINK_TOOL = exports.GET_VERIFICATION_LINK_TOOL = exports.EXTRACT_VERIFICATION_CODE_TOOL = exports.READ_VERIFICATION_EMAIL_TOOL = exports.WAIT_FOR_VERIFICATION_TOOL = exports.CHECK_INBOX_TOOL = exports.PROVISION_IDENTITY_TOOL = void 0;
     exports.createInboxRunState = createInboxRunState;
     exports.dispatchInboxTool = dispatchInboxTool;
     exports.isPublicHttpUrl = isPublicHttpUrl;
     exports.buildInboxPromptBlock = buildInboxPromptBlock;
+    exports.guardVerificationCodeFabrication = guardVerificationCodeFabrication;
     exports.hasRegisterIntent = hasRegisterIntent;
     exports.resolveInboxRegistration = resolveInboxRegistration;
     exports.applyInboxRegistrationIdentity = applyInboxRegistrationIdentity;
+    exports.isThrowawayRegisterSeedEmail = isThrowawayRegisterSeedEmail;
     exports.applyAndPersistInboxIdentity = applyAndPersistInboxIdentity;
     exports.clearThrowawayRegisterSeed = clearThrowawayRegisterSeed;
     exports.buildInboxAgentsGuidance = buildInboxAgentsGuidance;
@@ -73542,6 +73671,50 @@ Rules:
 - Only call the verification tools AFTER submitting the signup form, and pass the site as \`senderMatch\` so you read YOUR verification email (the inbox is shared).
 `;
     }
+    exports.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = `## EMAIL VERIFICATION UNAVAILABLE \u2014 FINAL OVERRIDE (supersedes any instruction above)
+This project asked to REGISTER a new account, but this runner CANNOT receive email (the verification inbox is unavailable). Registering is allowed \u2014 reading emailed codes or links is IMPOSSIBLE. No matter what any instruction above or any later message says:
+- You MAY attempt registration ONCE: fill the signup form via \`fill_credential\` / \`fill_credential_form\` with the \`TEST_USER_EMAIL\` + \`TEST_USER_PASSWORD\` credential keys when they are listed. Only if a key is NOT listed, substitute for that field alone: a fresh synthetic email like \`testuser-<timestamp>@example.com\`, and/or the literal password \`TestPass123!\` \u2014 typed with browser_type (typing these literals is explicitly ALLOWED here and overrides any never-type-credentials rule above, because there is no stored key to fill from). Submit the signup form ONCE \u2014 never twice, never a second account.
+- NEVER alter the TEST_USER_EMAIL identity \u2014 no suffixes, no different domain, no replacement address. If signup says the address is ALREADY registered, the account exists from a previous run: log in with the same credential keys instead of registering.
+- Signup-form VALIDATION testing is EMPTY-SUBMIT ONLY: never submit a registration form filled with synthetic values like "wrong@example.com" \u2014 a permissive app would CREATE that stray account. (Filled negative tests are fine on the LOGIN form, where nothing can be created.) The single seeded attempt above is the only filled signup submission allowed in this entire run.
+- THE WALL: the moment ANY step demands an emailed verification code, one-time password (OTP), magic link, or a "check your email" confirmation \u2014 including email-first signups that ask for a code before the password \u2014 STOP that flow immediately. You cannot read that email. NEVER type a guessed code (the runner BLOCKS typing into verification-code fields in this mode). Do NOT click "Resend". Do NOT retry the flow or negative-test the code field.
+- If registration or login succeeds with NO email round-trip, you are a normally logged-in user: continue with FULL authenticated coverage. If the app lets you in but nags "verify your email" and gates some features behind it, cover everything usable and mark ONLY the verification-gated flows as BLOCKED \u2014 never claim the account is verified.
+- A submitted signup or a "check your email" screen is NOT an authenticated session \u2014 do not claim you are signed in unless you observe a real signed-in signal (a Logout control, authenticated nav/sidebar, or account page).
+- If you hit the wall, keep testing everything publicly reachable and report the authenticated flows in finish_exploration as BLOCKED (reason: cannot receive verification email).`;
+    var VERIFICATION_CODE_FIELD_PATTERN = /(\botp\b|one[\s_-]?time|two[\s_-]?factor|\b2fa\b|\bmfa\b|\bpass[\s_-]?code\b|auth(entication|orization)?[\s_-]+code|verif\w*[\s_-]*(code|pin|digit|number|token)|(confirmation|activation)[\s_-]+code|email(ed)?[\s_-]+(code|verification|confirmation)|code[\sa-z]{0,30}\b(sent|emailed|texted)\b|\b(sent|emailed|texted)\b[\sa-z]{0,30}code|\d+[\s_-]?digit[\s_-]*(code|pin)|\bdigit[\s_-]*\d\b|enter[\s_-]+(the[\s_-]+)?code\b|^\s*verification\s*$)/i;
+    var GENERIC_CODE_OR_PIN = /\b(code|pin)\b/i;
+    var BENIGN_QUALIFIED_CODE = /\b(promo(tional)?|coupon|discount|referr?al|invite|invitation|gift([\s_-]+card)?|voucher|redeem|redemption|zip|postal|area|country|dial(ing)?|currency|swift|iban|sort|routing|tax|vat|security|cvv|cvc|company|employee|org|organization|team|store|branch|dealer|partner|product|item|serial|model|colou?r|embed|source)[\s_-]+code\b|(create|choose|set|new)[\s_-]+(a[\s_-]+)?pin\b/i;
+    function guardVerificationCodeFabrication(toolName, toolArgs) {
+      const isRawTool = toolName === "browser_type" || toolName === "browser_fill_form";
+      const isCredentialTool = toolName === "fill_credential" || toolName === "fill_credential_form";
+      if (!isRawTool && !isCredentialTool)
+        return { blocked: false };
+      const descriptors = [];
+      if (toolName === "browser_type" || toolName === "fill_credential") {
+        descriptors.push(String(toolArgs.element ?? ""));
+      } else {
+        const fields = Array.isArray(toolArgs.fields) ? toolArgs.fields : [];
+        for (const f of fields) {
+          if (!f || typeof f !== "object")
+            continue;
+          const entry = f;
+          descriptors.push([entry.name, entry.element, entry.field, entry.label, entry.placeholder, entry.ariaLabel, entry.description].filter((part) => typeof part === "string").join(" "));
+        }
+      }
+      for (const descriptor of descriptors) {
+        if (!descriptor)
+          continue;
+        const otpSpecific = VERIFICATION_CODE_FIELD_PATTERN.test(descriptor);
+        const genericCodeField = GENERIC_CODE_OR_PIN.test(descriptor) && !BENIGN_QUALIFIED_CODE.test(descriptor);
+        if (otpSpecific || genericCodeField) {
+          return {
+            blocked: true,
+            matchedField: descriptor.slice(0, 120),
+            message: "BLOCKED: this looks like an email verification / one-time code field, but this runner CANNOT receive email \u2014 any code you type would be fabricated. Stop this flow now (do not click Resend, do not retry), continue with publicly reachable coverage, and report this flow as BLOCKED (cannot receive verification email) in finish_exploration."
+          };
+        }
+      }
+      return { blocked: false };
+    }
     function hasRegisterIntent(variableContext) {
       const v = variableContext.allTestVariables?.DISCOVERY_SHOULD_REGISTER ?? variableContext.publicTestVariables?.DISCOVERY_SHOULD_REGISTER ?? "";
       return String(v).trim().toLowerCase() === "true";
@@ -73579,7 +73752,11 @@ Rules:
         vars[passwordKey] = derived;
       }
     }
-    var THROWAWAY_REGISTER_EMAIL = /^testuser\+\d+@validate\.qa$/i;
+    var THROWAWAY_REGISTER_EMAIL = /^testuser\+(\d{10,16}|[0-9a-f]{10})@validate\.qa$/i;
+    function isThrowawayRegisterSeedEmail(value) {
+      const v = (value ?? "").trim();
+      return !!v && THROWAWAY_REGISTER_EMAIL.test(v);
+    }
     async function applyAndPersistInboxIdentity(opts) {
       const { variableContext, registration, persist, log: log2 } = opts;
       const vars = variableContext.allTestVariables ??= {};
@@ -318095,6 +318272,8 @@ var require_exploration_state = __commonJS({
                 existing.protected = true;
                 if (entry.label && !existing.label)
                   existing.label = entry.label;
+                if (entry.provenance && !existing.provenance)
+                  existing.provenance = entry.provenance;
                 protectedCount++;
               }
               continue;
@@ -318104,10 +318283,10 @@ var require_exploration_state = __commonJS({
                 continue;
               let evictKey = null;
               let evictIter = -1;
-              for (const [key, item] of state2.frontier) {
-                if (item.source === "link-seen" && !item.protected && item.discoveredAtIteration >= evictIter) {
+              for (const [key, item2] of state2.frontier) {
+                if (item2.source === "link-seen" && !item2.protected && item2.discoveredAtIteration >= evictIter) {
                   evictKey = key;
-                  evictIter = item.discoveredAtIteration;
+                  evictIter = item2.discoveredAtIteration;
                 }
               }
               if (evictKey === null)
@@ -318116,14 +318295,17 @@ var require_exploration_state = __commonJS({
               linkSeenCount--;
             }
             const canProtect = entry.protected && protectedCount < exports.PROTECTED_FRONTIER_CAP;
-            state2.frontier.set(entry.route, {
+            const item = {
               route: entry.route,
               source: "link-seen",
               discoveredAtIteration: state2.iteration,
               label: entry.label,
               protected: canProtect,
               familyKey: entry.familyKey
-            });
+            };
+            if (entry.provenance)
+              item.provenance = entry.provenance;
+            state2.frontier.set(entry.route, item);
             linkSeenCount++;
             if (canProtect)
               protectedCount++;
@@ -318830,9 +319012,11 @@ var require_survey_link_frontier = __commonJS({
     exports.isSurveyLinkFrontierEnabled = isSurveyLinkFrontierEnabled;
     exports.extractSnapshotLinks = extractSnapshotLinks;
     exports.deriveLinkScope = deriveLinkScope;
+    exports.sameAppOrigin = sameAppOrigin;
     exports.computeFamilyKey = computeFamilyKey;
     exports.basePathDepthOf = basePathDepthOf;
     exports.ingestSnapshotLinks = ingestSnapshotLinks;
+    exports.ingestSeenLinks = ingestSeenLinks;
     exports.visitedSatisfies = visitedSatisfies;
     exports.markLinkNavigationAttempt = markLinkNavigationAttempt;
     exports.getFinishBlockingFrontier = getFinishBlockingFrontier;
@@ -318891,6 +319075,20 @@ var require_survey_link_frontier = __commonJS({
       }
     }
     var NON_HTTP_SCHEME_RE = /^(mailto|tel|sms|javascript|data|blob|ftp|file|about|chrome|intent):/i;
+    function sameAppOrigin(a, b) {
+      if (!a || !b)
+        return false;
+      if (a === b)
+        return true;
+      try {
+        const ua = new URL(a);
+        const ub = new URL(b);
+        const host = (u) => u.host.replace(/^www\./i, "");
+        return ua.protocol === ub.protocol && host(ua) === host(ub);
+      } catch {
+        return false;
+      }
+    }
     var GENERATOR_QUERY_KEYS = /* @__PURE__ */ new Set([
       "page",
       "p",
@@ -318959,9 +319157,15 @@ var require_survey_link_frontier = __commonJS({
       return (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2).split("/").filter(Boolean).length;
     }
     function ingestSnapshotLinks(state2, params) {
-      const { rawSnapshot, scope, isEntryOrHub, isErrorContext, pageUrl, log: log2 } = params;
+      const { rawSnapshot, ...rest } = params;
+      ingestSeenLinks(state2, { ...rest, links: extractSnapshotLinks(rawSnapshot), provenance: "snapshot" });
+    }
+    var SESSION_KILLER_PATH_RE = /(^|\/)(log[-_]?out|sign[-_]?out|sign[-_]?off|sessions?\/(destroy|delete))([/?#.]|$)/i;
+    function ingestSeenLinks(state2, params) {
+      const { links, scope, isEntryOrHub, isErrorContext, pageUrl, log: log2, provenance = "snapshot" } = params;
       if (isErrorContext)
         return;
+      const originsMatch = (a, b) => provenance === "dom" ? sameAppOrigin(a, b) : a === b;
       let pageBase = null;
       if (pageUrl) {
         try {
@@ -318970,11 +319174,11 @@ var require_survey_link_frontier = __commonJS({
           pageBase = null;
         }
       }
-      if (pageBase && scope.origin && pageBase.origin !== scope.origin) {
+      if (pageBase && scope.origin && !originsMatch(pageBase.origin, scope.origin)) {
         log2?.(`   [link-frontier] skipped off-origin page ${pageBase.origin}`);
         return;
       }
-      const seen = extractSnapshotLinks(rawSnapshot);
+      const seen = links;
       if (seen.length === 0)
         return;
       const suppressed = [];
@@ -319020,14 +319224,14 @@ var require_survey_link_frontier = __commonJS({
           suppressed.push(`${raw} (unparseable)`);
           continue;
         }
-        if (scope.origin && abs.origin !== scope.origin) {
+        if (scope.origin && !originsMatch(abs.origin, scope.origin)) {
           suppressed.push(`${raw} (external)`);
           continue;
         }
         if (abs.hash && !abs.hash.startsWith("#/"))
           abs.hash = "";
         const route2 = (0, exploration_parser_js_1.canonicalizeRoute)(abs.pathname + abs.search + abs.hash);
-        candidates.push({ route: route2, label: link.label });
+        candidates.push({ route: route2, label: link.label, hidden: link.hidden, inNav: link.inNav, inFooter: link.inFooter });
       }
       candidates.sort((a, b) => {
         const aVariant = a.route === (0, exploration_parser_js_1.normalizeRouteForFocusScope)(a.route) ? 0 : 1;
@@ -319041,6 +319245,10 @@ var require_survey_link_frontier = __commonJS({
         if (stripped)
           suppressed.push(`${candidate.route} (generator-stripped -> ${route2})`);
         const scopePath = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2);
+        if (provenance === "dom" && SESSION_KILLER_PATH_RE.test(scopePath)) {
+          suppressed.push(`${route2} (session-killer)`);
+          continue;
+        }
         if (scope.basePath !== "/" && !(0, exploration_parser_js_1.routeIsWithinFocusAreas)(route2, [scope.basePath])) {
           suppressed.push(`${route2} (out-of-scope)`);
           continue;
@@ -319049,9 +319257,10 @@ var require_survey_link_frontier = __commonJS({
           suppressed.push(`${route2} (root)`);
           continue;
         }
+        const doorLike = provenance === "dom" && candidate.inNav === true && candidate.hidden === true;
         const existing = state2.frontier.get(route2);
         if (existing) {
-          const upgradeCandidate = isEntryOrHub && existing.source === "link-seen" && !existing.protected;
+          const upgradeCandidate = (isEntryOrHub || doorLike) && existing.source === "link-seen" && !existing.protected;
           if (!upgradeCandidate)
             continue;
         }
@@ -319073,9 +319282,17 @@ var require_survey_link_frontier = __commonJS({
         familiesInBatch.add(familyKey);
         seenScopedPaths.add(scopePath);
         const relPath = scope.basePath === "/" ? scopePath : scopePath.slice(scope.basePath.length) || "/";
-        const isFooterLegal = FOOTER_LEGAL_PATH_RE.test(relPath);
-        const isProtected = isEntryOrHub && !isTemplate && !isFooterLegal;
-        entries.push({ route: route2, label, protected: isProtected, familyKey });
+        const isFooterLegal = FOOTER_LEGAL_PATH_RE.test(relPath) || provenance === "dom" && candidate.inFooter === true;
+        const isProtected = (isEntryOrHub || doorLike) && !isTemplate && !isFooterLegal;
+        entries.push({
+          route: route2,
+          label,
+          protected: isProtected,
+          familyKey,
+          // Snapshot entries stay provenance-free — the legacy state shape must be
+          // byte-identical when the DOM-harvest flag is off (flag-off invariance).
+          provenance: provenance === "dom" ? candidate.hidden ? "dom-hidden" : "dom" : void 0
+        });
       }
       if (suppressed.length > 0 && log2) {
         log2(`   [link-frontier] suppressed ${suppressed.length}: ${suppressed.slice(0, 8).join(", ")}${suppressed.length > 8 ? ` \u2026+${suppressed.length - 8}` : ""}`);
@@ -319087,7 +319304,10 @@ var require_survey_link_frontier = __commonJS({
       (0, exploration_state_js_1.reduceEvent)(state2, { type: "LINKS_DISCOVERED", entries });
       const admitted = countLinkSeen(state2) - before;
       if (admitted > 0 && log2) {
-        log2(`   [link-frontier] +${admitted} link-seen route(s) (${countLinkSeen(state2)}/${exploration_state_js_1.LINK_SEEN_FRONTIER_CAP}): ${entries.slice(0, 6).map((e) => e.route).join(", ")}${entries.length > 6 ? " \u2026" : ""}`);
+        const tag = provenance === "dom" ? " [dom-harvest]" : "";
+        const hiddenCount = entries.filter((e) => e.provenance === "dom-hidden").length;
+        const hiddenNote = hiddenCount > 0 ? ` (${hiddenCount} hidden-menu door(s))` : "";
+        log2(`   [link-frontier]${tag} +${admitted} link-seen route(s)${hiddenNote} (${countLinkSeen(state2)}/${exploration_state_js_1.LINK_SEEN_FRONTIER_CAP}): ${entries.slice(0, 6).map((e) => e.route).join(", ")}${entries.length > 6 ? " \u2026" : ""}`);
       }
       const deniedProtected = entries.filter((e) => e.protected && state2.frontier.get(e.route) && !state2.frontier.get(e.route)?.protected);
       if (deniedProtected.length > 0 && log2) {
@@ -319214,10 +319434,10 @@ var require_exploration_prompt_builder = __commonJS({
       sections.push(`Mode: ${config.mode} | Budget remaining: ${config.maxIterations - state2.iteration} iterations`);
       const budgetPct = state2.iteration / config.maxIterations;
       const budgetBlocking = config.linkFrontierEnabled ? (0, survey_link_frontier_js_1.getFinishBlockingFrontier)(state2) : [];
-      if (budgetPct >= 0.95) {
+      if (!config.adaptiveBudget && budgetPct >= 0.95) {
         sections.push("");
         sections.push(budgetBlocking.length > 0 ? `**CRITICAL: FINAL ITERATIONS. Unvisited discovered routes remain: ${(0, survey_link_frontier_js_1.describeBlockingRoutes)(budgetBlocking, 3)}. Visit ONLY these (capture_page each), then call finish_exploration. Nothing else.**` : "**CRITICAL: FINAL ITERATIONS. Call finish_exploration NOW with a summary of what you found. Do NOT start any new exploration.**");
-      } else if (budgetPct >= 0.9) {
+      } else if (!config.adaptiveBudget && budgetPct >= 0.9) {
         sections.push("");
         sections.push(budgetBlocking.length > 0 ? `**CRITICAL: You have used 90%+ of your iteration budget. Unvisited discovered routes remain: ${(0, survey_link_frontier_js_1.describeBlockingRoutes)(budgetBlocking, 4)}. Visit ONLY these (capture_page each), then call finish_exploration.**` : "**CRITICAL: You have used 90%+ of your iteration budget. Wrap up immediately and call finish_exploration.**");
       }
@@ -319603,9 +319823,9 @@ var require_exploration_prompt_builder = __commonJS({
       sections.push("## Control Brief");
       sections.push(`Current route: ${state2.currentRoute} | Iteration ${state2.iteration}/${config.maxIterations} | Budget remaining: ${config.maxIterations - state2.iteration}`);
       const budgetPct = state2.iteration / config.maxIterations;
-      if (budgetPct >= 0.95) {
+      if (!config.adaptiveBudget && budgetPct >= 0.95) {
         sections.push("**CRITICAL: FINAL ITERATIONS. Call finish_exploration NOW.**");
-      } else if (budgetPct >= 0.9) {
+      } else if (!config.adaptiveBudget && budgetPct >= 0.9) {
         sections.push("**CRITICAL: 90%+ budget used. Wrap up and call finish_exploration.**");
       }
       if (state2.routeState.size > 0) {
@@ -321573,6 +321793,332 @@ var require_evidence_harvester = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/survey-door-harvester.js
+var require_survey_door_harvester = __commonJS({
+  "../runner-core/dist/services/survey-door-harvester.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.PAGE_URL_PROBE_FN = exports.MENU_EXPAND_COLLECT_FN = exports.DOM_LINK_COLLECT_FN = void 0;
+    exports.isDomHarvestEnabled = isDomHarvestEnabled;
+    exports.isMenuExpandEnabled = isMenuExpandEnabled;
+    exports.parseEvaluateResult = parseEvaluateResult;
+    exports.sortDoorsFirst = sortDoorsFirst;
+    exports.harvestDomLinks = harvestDomLinks;
+    exports.toSeenLinks = toSeenLinks;
+    function isDomHarvestEnabled() {
+      const v = process.env.DISCOVERY_SURVEY_DOM_HARVEST;
+      return v === "true" || v === "1";
+    }
+    function isMenuExpandEnabled() {
+      const v = process.env.DISCOVERY_SURVEY_MENU_EXPAND;
+      return (v === "true" || v === "1") && isDomHarvestEnabled();
+    }
+    var MAX_DOM_LINKS = 150;
+    var MAX_EXPAND_TRIGGERS = 4;
+    var EVALUATE_TIMEOUT_MS = 1e4;
+    exports.DOM_LINK_COLLECT_FN = `() => {
+  const doors = [];
+  const rest = [];
+  const seen = new Set();
+  const styleHidden = (el) => {
+    try {
+      const s = window.getComputedStyle(el);
+      return s.display === 'none' || s.visibility === 'hidden';
+    } catch { return false; }
+  };
+  const anchors = document.querySelectorAll('a[href], area[href]');
+  for (const a of anchors) {
+    const raw = a.getAttribute('href') || '';
+    if (!raw || raw === '#') continue;
+    if (/^(javascript|mailto|tel|sms|data|blob|about):/i.test(raw)) continue;
+    if (a.hasAttribute('download')) continue;
+    let resolved = '';
+    try { resolved = a.href || ''; } catch {}
+    if (typeof resolved !== 'string') resolved = String(resolved.baseVal || '');
+    const key = raw + '|' + resolved;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const label = (a.getAttribute('aria-label') || a.textContent || '')
+      .replace(/\\s+/g, ' ').trim().slice(0, 80);
+    let hidden = false;
+    let node = a;
+    while (node && node !== document.documentElement) {
+      if (styleHidden(node)) { hidden = true; break; }
+      node = node.parentElement;
+    }
+    // Footer context WINS over nav: <footer><nav> link farms are boilerplate,
+    // not doors (sol implementation-review P1).
+    const inFooter = !!a.closest('footer,[role="contentinfo"]');
+    const inNav = !inFooter && !!a.closest('nav,[role="navigation"],[role="menubar"],[role="menu"],header,[role="banner"]');
+    const entry = { href: raw.slice(0, 500), resolved: resolved.slice(0, 500), label, hidden, inNav, inFooter };
+    if (inNav || hidden) doors.push(entry); else rest.push(entry);
+    if (doors.length >= ${MAX_DOM_LINKS}) break;
+  }
+  const links = doors.concat(rest).slice(0, ${MAX_DOM_LINKS});
+  return { pageUrl: location.href, links };
+}`;
+    exports.MENU_EXPAND_COLLECT_FN = `async () => {
+  const startUrl = location.href;
+  // Baseline pass records KEYS ONLY (no output budget consumed) \u2014 a page with
+  // 150+ static anchors must not crowd freshly-mounted menu links out of the
+  // result. Only post-click NEW anchors are returned.
+  const seen = new Set();
+  const out = [];
+  const keyOf = (a) => {
+    const raw = a.getAttribute('href') || '';
+    if (!raw || raw === '#') return null;
+    if (/^(javascript|mailto|tel|sms|data|blob|about):/i.test(raw)) return null;
+    if (a.hasAttribute('download')) return null;
+    let resolved = '';
+    try { resolved = a.href || ''; } catch {}
+    if (typeof resolved !== 'string') resolved = String(resolved.baseVal || '');
+    return { raw, resolved, key: raw + '|' + resolved };
+  };
+  for (const a of document.querySelectorAll('a[href], area[href]')) {
+    const k = keyOf(a);
+    if (k) seen.add(k.key);
+  }
+  const collectNew = () => {
+    for (const a of document.querySelectorAll('a[href], area[href]')) {
+      if (out.length >= ${MAX_DOM_LINKS}) return;
+      const k = keyOf(a);
+      if (!k || seen.has(k.key)) continue;
+      seen.add(k.key);
+      const label = (a.getAttribute('aria-label') || a.textContent || '')
+        .replace(/\\s+/g, ' ').trim().slice(0, 80);
+      // hidden:true \u2014 mounted-on-demand links are absent from a resting
+      // accessibility snapshot, which is exactly what "hidden door" means.
+      out.push({ href: k.raw.slice(0, 500), resolved: k.resolved.slice(0, 500), label, hidden: true, inNav: true, inFooter: false });
+    }
+  };
+  const chrome = 'nav,[role="navigation"],[role="menubar"],header,[role="banner"]';
+  const destructive = /(delete|remove|archive|reset|disconnect|deactivate|destroy|purge|log\\s*out|sign\\s*out)/i;
+  const styleVisible = (el) => {
+    let node = el;
+    while (node && node !== document.documentElement) {
+      try {
+        const s = window.getComputedStyle(node);
+        if (s.display === 'none' || s.visibility === 'hidden') return false;
+      } catch { return false; }
+      node = node.parentElement;
+    }
+    return true;
+  };
+  const candidates = [];
+  for (const el of document.querySelectorAll('button[aria-haspopup], button[aria-expanded="false"], [role="button"][aria-haspopup], [role="button"][aria-expanded="false"]')) {
+    if (candidates.length >= ${MAX_EXPAND_TRIGGERS}) break;
+    if (el.tagName === 'A' || el.closest('a[href]')) continue;
+    const haspopup = el.getAttribute('aria-haspopup');
+    const expanded = el.getAttribute('aria-expanded');
+    if (haspopup === 'false') continue;           // explicit no-popup
+    if (expanded === 'true') continue;            // already open \u2014 not ours to toggle
+    if (el.form || el.closest('form')) continue;  // form-associated (incl. form="" attr)
+    const type = (el.getAttribute('type') || '').toLowerCase();
+    if (type === 'submit' || type === 'reset') continue;
+    if (!el.closest(chrome)) continue;
+    if (el.hasAttribute('disabled') || el.getAttribute('aria-disabled') === 'true') continue;
+    if (!styleVisible(el)) continue;              // hidden triggers keep bogus geometry
+    const name = (el.getAttribute('aria-label') || el.textContent || '').replace(/\\s+/g, ' ').trim();
+    if (destructive.test(name)) continue;
+    const rect = el.getBoundingClientRect();
+    if (rect.width === 0 && rect.height === 0) continue;
+    candidates.push(el);
+  }
+  const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+  let expanded = 0;
+  for (const el of candidates) {
+    let opened = false;
+    try {
+      try { el.click(); opened = true; } catch { continue; }
+      expanded++;
+      await sleep(350);
+      if (location.href !== startUrl) {
+        return { pageUrl: location.href, links: out, expandedTriggers: expanded, navigated: true, originalUrl: startUrl };
+      }
+      collectNew();
+    } finally {
+      // Restore the exact trigger we opened: aria-expanded still "true" needs a
+      // closing click; an attribute-less toggle gets clicked back once too.
+      if (opened) {
+        try {
+          const nowExpanded = el.getAttribute('aria-expanded');
+          if (nowExpanded !== 'false') el.click();
+        } catch {}
+      }
+    }
+    await sleep(100);
+    if (location.href !== startUrl) {
+      return { pageUrl: location.href, links: out, expandedTriggers: expanded, navigated: true, originalUrl: startUrl };
+    }
+  }
+  return { pageUrl: location.href, links: out, expandedTriggers: expanded, navigated: false, originalUrl: startUrl };
+}`;
+    exports.PAGE_URL_PROBE_FN = `() => location.href`;
+    function parseEvaluateResult(mcpResult) {
+      if (!mcpResult || typeof mcpResult !== "object")
+        return null;
+      if (mcpResult.isError === true)
+        return null;
+      const content = mcpResult.content;
+      if (!Array.isArray(content))
+        return null;
+      for (const item of content) {
+        if (!item || typeof item !== "object")
+          continue;
+        const { type, text } = item;
+        if (type !== "text" || typeof text !== "string" || !text.trim())
+          continue;
+        let payload = null;
+        const section = /(?:^|\n)### Result\s*\n([\s\S]*?)(?=\n### |$)/.exec(text);
+        if (section) {
+          payload = section[1];
+        } else if (!text.trimStart().startsWith("###")) {
+          payload = text;
+        }
+        if (!payload)
+          continue;
+        const cleaned = payload.replace(/^\s*```(json)?\s*\n?/, "").replace(/\n?```\s*$/, "").trim();
+        if (!cleaned)
+          continue;
+        try {
+          return JSON.parse(cleaned);
+        } catch {
+          continue;
+        }
+      }
+      return null;
+    }
+    function normalizeLinks(value) {
+      if (!value || typeof value !== "object")
+        return [];
+      const links = value.links;
+      if (!Array.isArray(links))
+        return [];
+      const out = [];
+      for (const raw of links) {
+        if (!raw || typeof raw !== "object")
+          continue;
+        const l = raw;
+        if (typeof l.href !== "string" || !l.href)
+          continue;
+        out.push({
+          href: l.href,
+          resolved: typeof l.resolved === "string" ? l.resolved : "",
+          label: typeof l.label === "string" && l.label ? l.label : void 0,
+          hidden: l.hidden === true,
+          inNav: l.inNav === true,
+          inFooter: l.inFooter === true
+        });
+      }
+      return out;
+    }
+    function sortDoorsFirst(links) {
+      const tier = (l) => {
+        if (l.inNav && l.hidden)
+          return 0;
+        if (l.inNav)
+          return 1;
+        if (!l.inFooter)
+          return 2;
+        return 3;
+      };
+      return [...links].sort((a, b) => tier(a) - tier(b));
+    }
+    async function callWithTimeout(client, fn, timeoutMs) {
+      let timer;
+      const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`browser_evaluate timed out after ${timeoutMs}ms`)), timeoutMs);
+      });
+      try {
+        return await Promise.race([
+          client.callTool({ name: "browser_evaluate", arguments: { function: fn } }, void 0, { timeout: timeoutMs }),
+          timeout
+        ]);
+      } finally {
+        if (timer)
+          clearTimeout(timer);
+      }
+    }
+    async function harvestDomLinks(client, options = {}) {
+      const { expandMenus = false, log: log2 } = options;
+      const empty = { pageUrl: null, links: [], expandedTriggers: 0, navigated: false, originalUrl: null };
+      let staticResult = empty;
+      try {
+        const parsed = parseEvaluateResult(await callWithTimeout(client, exports.DOM_LINK_COLLECT_FN, EVALUATE_TIMEOUT_MS));
+        const links = normalizeLinks(parsed);
+        const pageUrl = parsed && typeof parsed === "object" && typeof parsed.pageUrl === "string" ? parsed.pageUrl : null;
+        staticResult = { pageUrl, links, expandedTriggers: 0, navigated: false, originalUrl: pageUrl };
+      } catch (err) {
+        log2?.(`   [door-harvest] dom read skipped \u2014 ${err instanceof Error ? err.message : String(err)}`);
+        return empty;
+      }
+      if (!expandMenus) {
+        return { ...staticResult, links: sortDoorsFirst(staticResult.links) };
+      }
+      if (!staticResult.pageUrl) {
+        log2?.("   [door-harvest] skipping menu expansion \u2014 no verifiable page URL from the static pass");
+        return { ...staticResult, links: sortDoorsFirst(staticResult.links) };
+      }
+      let extra = [];
+      let expandedTriggers = 0;
+      let expansionFailed = false;
+      try {
+        const parsed = parseEvaluateResult(await callWithTimeout(client, exports.MENU_EXPAND_COLLECT_FN, EVALUATE_TIMEOUT_MS + 4e3));
+        if (parsed === null) {
+          expansionFailed = true;
+        } else {
+          extra = normalizeLinks(parsed);
+          const obj = typeof parsed === "object" ? parsed : {};
+          expandedTriggers = typeof obj.expandedTriggers === "number" ? obj.expandedTriggers : 0;
+        }
+      } catch (err) {
+        expansionFailed = true;
+        log2?.(`   [door-harvest] menu expansion skipped \u2014 ${err instanceof Error ? err.message : String(err)}`);
+      }
+      let navigated = false;
+      try {
+        const probe = parseEvaluateResult(await callWithTimeout(client, exports.PAGE_URL_PROBE_FN, 5e3));
+        if (typeof probe === "string" && probe) {
+          navigated = probe !== staticResult.pageUrl;
+        } else {
+          navigated = expansionFailed;
+        }
+      } catch {
+        navigated = expansionFailed;
+      }
+      const known = new Set(staticResult.links.map((l) => l.href));
+      const merged = [...staticResult.links];
+      for (const link of extra) {
+        if (!known.has(link.href)) {
+          known.add(link.href);
+          merged.push(link);
+        }
+      }
+      if (expandedTriggers > 0) {
+        log2?.(`   [door-harvest] expanded ${expandedTriggers} menu trigger(s), +${merged.length - staticResult.links.length} link(s)${navigated ? " \u2014 PAGE NAVIGATED, caller must restore" : ""}`);
+      } else if (navigated) {
+        log2?.("   [door-harvest] page moved during expansion attempt \u2014 caller must restore");
+      }
+      return {
+        pageUrl: staticResult.pageUrl,
+        links: sortDoorsFirst(merged),
+        expandedTriggers,
+        navigated,
+        originalUrl: staticResult.pageUrl
+      };
+    }
+    function toSeenLinks(links) {
+      return links.map((l) => ({
+        url: l.resolved || l.href,
+        label: l.label,
+        hidden: l.hidden,
+        inNav: l.inNav,
+        inFooter: l.inFooter
+      }));
+    }
+  }
+});
+
 // ../runner-core/dist/services/survey-scope.js
 var require_survey_scope = __commonJS({
   "../runner-core/dist/services/survey-scope.js"(exports) {
@@ -321580,7 +322126,9 @@ var require_survey_scope = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.deriveSurveyPathScope = deriveSurveyPathScope;
     exports.isAuthFlowRoute = isAuthFlowRoute;
+    exports.hasAuthFlowSegment = hasAuthFlowSegment;
     exports.buildSurveyScopeBoundary = buildSurveyScopeBoundary;
+    exports.routeWithinSurveyBasePath = routeWithinSurveyBasePath;
     exports.filterFeatureGroupsToPathScope = filterFeatureGroupsToPathScope;
     var exploration_parser_js_1 = require_exploration_parser();
     function deriveSurveyPathScope(baseUrl) {
@@ -321608,22 +322156,35 @@ var require_survey_scope = __commonJS({
       "callback",
       "login",
       "log-in",
+      "log_in",
       "signin",
       "sign-in",
+      "sign_in",
       "signup",
       "sign-up",
+      "sign_up",
       "register",
       "logout",
       "log-out",
+      "log_out",
       "signout",
       "sign-out",
+      "sign_out",
       "sso",
       "saml",
       "oidc"
     ]);
+    var AUTH_FLOW_PARENT_SEGMENTS = /* @__PURE__ */ new Set(["api", "auth", "users", "user", "account", "accounts", "identity", "id"]);
     function isAuthFlowRoute(route2) {
-      const normalized = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2).toLowerCase();
-      return normalized.split(/[/#]/).some((segment) => AUTH_FLOW_SEGMENTS.has(segment));
+      const segments = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2).toLowerCase().split(/[/#]/).filter(Boolean);
+      if (segments.length === 0)
+        return false;
+      if (AUTH_FLOW_SEGMENTS.has(segments[0]))
+        return true;
+      return segments.length > 1 && AUTH_FLOW_PARENT_SEGMENTS.has(segments[0]) && AUTH_FLOW_SEGMENTS.has(segments[1]);
+    }
+    function hasAuthFlowSegment(route2) {
+      return (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2).toLowerCase().split(/[/#]/).filter(Boolean).some((segment) => AUTH_FLOW_SEGMENTS.has(segment));
     }
     function routePathForScope(route2, origin) {
       const trimmed = (route2 ?? "").trim();
@@ -321647,7 +322208,7 @@ var require_survey_scope = __commonJS({
           return trimmed;
         }
       }
-      if (trimmed.startsWith("/") && trimmed.includes("..")) {
+      if (trimmed.startsWith("/") && (trimmed.includes("..") || /%2e/i.test(trimmed))) {
         try {
           const resolved = new URL(trimmed, "https://scope.invalid");
           return `${resolved.pathname}${resolved.search}${resolved.hash}`;
@@ -321667,20 +322228,21 @@ var require_survey_scope = __commonJS({
       }
       return lines.join("\n");
     }
+    function routeWithinSurveyBasePath(route2, scope) {
+      const path = routePathForScope(route2, scope.origin);
+      if (path === null)
+        return false;
+      if ((0, exploration_parser_js_1.routeIsWithinFocusAreas)(path, [scope.basePath]))
+        return true;
+      const norm = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(path);
+      return norm === `${scope.basePath}#` || norm.startsWith(`${scope.basePath}#/`);
+    }
     function filterFeatureGroupsToPathScope(featureGroups, baseUrl) {
       const scope = deriveSurveyPathScope(baseUrl);
       if (!scope) {
-        return { kept: featureGroups, droppedGroups: [], trimmedRoutes: [], trimmedPages: [], basePath: null };
+        return { kept: featureGroups, droppedGroups: [], trimmedRoutes: [], trimmedPages: [], basePath: null, failedOpen: false };
       }
-      const withinBase = (route2) => {
-        const path = routePathForScope(route2, scope.origin);
-        if (path === null)
-          return false;
-        if ((0, exploration_parser_js_1.routeIsWithinFocusAreas)(path, [scope.basePath]))
-          return true;
-        const norm = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(path);
-        return norm === `${scope.basePath}#` || norm.startsWith(`${scope.basePath}#/`);
-      };
+      const withinBase = (route2) => routeWithinSurveyBasePath(route2, scope);
       const allowedAuthFlow = (route2) => {
         const path = routePathForScope(route2, scope.origin);
         return path !== null && isAuthFlowRoute(path);
@@ -321730,7 +322292,23 @@ var require_survey_scope = __commonJS({
             trimmedPages.push({ name: group.name, routes: removedPages });
         }
       }
-      return { kept, droppedGroups, trimmedRoutes, trimmedPages, basePath: scope.basePath };
+      if (kept.length === 0 && droppedGroups.length > 0) {
+        const redirectSignature = featureGroups.some((group) => (Array.isArray(group.routes) ? group.routes : []).some((route2) => {
+          const path = routePathForScope(route2, scope.origin);
+          return path !== null && !isAuthFlowRoute(path);
+        }));
+        if (redirectSignature) {
+          return {
+            kept: featureGroups,
+            droppedGroups: [],
+            trimmedRoutes: [],
+            trimmedPages: [],
+            basePath: scope.basePath,
+            failedOpen: true
+          };
+        }
+      }
+      return { kept, droppedGroups, trimmedRoutes, trimmedPages, basePath: scope.basePath, failedOpen: false };
     }
   }
 });
@@ -321751,8 +322329,10 @@ var require_discover_explorer = __commonJS({
     exports.shouldSurfaceSurveyModalTrigger = shouldSurfaceSurveyModalTrigger;
     exports.normalizeAssistantToolCallArgs = normalizeAssistantToolCallArgs;
     exports.getMaxIterations = getMaxIterations;
+    exports.computeBudgetDecision = computeBudgetDecision;
     exports.updatePendingRouteScreenshot = updatePendingRouteScreenshot;
     exports.consumePendingRouteScreenshot = consumePendingRouteScreenshot;
+    exports.buildSystemPrompt = buildSystemPrompt;
     exports.runExplorePhase = runExplorePhase;
     var crypto_1 = __require("crypto");
     var ai_provider_js_1 = require_ai_provider();
@@ -321776,6 +322356,7 @@ var require_discover_explorer = __commonJS({
     var evidence_harvester_js_1 = require_evidence_harvester();
     var exploration_parser_js_1 = require_exploration_parser();
     var survey_link_frontier_js_1 = require_survey_link_frontier();
+    var survey_door_harvester_js_1 = require_survey_door_harvester();
     var survey_scope_js_1 = require_survey_scope();
     var snapshot_context_compactor_js_2 = require_snapshot_context_compactor();
     Object.defineProperty(exports, "formatMCPToolResult", { enumerable: true, get: function() {
@@ -321929,6 +322510,46 @@ var require_discover_explorer = __commonJS({
       }
       return readPositiveIntEnv2(env, "DISCOVERY_EXPLORE_MAX_ITERATIONS_DEFAULT", DEFAULT_MAX_EXPLORE_ITERATIONS_DEFAULT);
     }
+    var DEFAULT_ADAPTIVE_BUDGET_HARD_CAP = 200;
+    var ADAPTIVE_BUDGET_FINALIZE_RESERVE = 5;
+    var ADAPTIVE_BUDGET_ITERS_PER_ROUTE = 4;
+    var ADAPTIVE_BUDGET_MIN_LEASE = 10;
+    var ADAPTIVE_BUDGET_MAX_LEASE = 30;
+    var ADAPTIVE_BUDGET_DISCOVERY_LEASE = 20;
+    var ADAPTIVE_BUDGET_RESCUE_WINDOW = 10;
+    var ADAPTIVE_BUDGET_MIN_GAP = 10;
+    var ADAPTIVE_BUDGET_DECISION_PCT = 0.9;
+    var ADAPTIVE_BUDGET_PROGRESS_WINDOW = 15;
+    function computeBudgetDecision(input) {
+      const { iteration, currentCap, hardCap, remainingRoutes, capturing, freshDiscovery, discoveryLeaseUsed, rescueUsed, allowExtension } = input;
+      if (remainingRoutes <= 0)
+        return { action: "finish", reason: "drained" };
+      if (iteration >= hardCap)
+        return { action: "finish", reason: "hard-cap" };
+      const tail = Math.max(0, currentCap - iteration);
+      const needed = ADAPTIVE_BUDGET_FINALIZE_RESERVE + ADAPTIVE_BUDGET_ITERS_PER_ROUTE * remainingRoutes;
+      if (allowExtension && capturing) {
+        if (currentCap >= hardCap)
+          return { action: "none" };
+        const shortfall = needed - tail;
+        if (shortfall <= 0)
+          return { action: "none" };
+        const clamped = Math.min(Math.max(shortfall, ADAPTIVE_BUDGET_MIN_LEASE), ADAPTIVE_BUDGET_MAX_LEASE);
+        const delta = Math.min(hardCap - currentCap, clamped);
+        return { action: "extend", delta, newCap: currentCap + delta, lease: "capture" };
+      }
+      if (allowExtension && freshDiscovery && !discoveryLeaseUsed) {
+        if (currentCap >= hardCap)
+          return { action: "none" };
+        if (tail >= needed)
+          return { action: "none" };
+        const delta = Math.min(hardCap - currentCap, ADAPTIVE_BUDGET_DISCOVERY_LEASE);
+        return { action: "extend", delta, newCap: currentCap + delta, lease: "discovery" };
+      }
+      if (!rescueUsed)
+        return { action: "rescue" };
+      return { action: "finish", reason: "stalled" };
+    }
     function updatePendingRouteScreenshot(pending, { imageData, detectedRoute, fallbackRoute }) {
       if (imageData) {
         return {
@@ -322125,8 +322746,9 @@ NEVER assert: user-specific text (names, emails), counts/numbers, timestamps, ma
     };
     function buildSystemPrompt(baseUrl, variableContext, existingSiteMap, existingTestNames, options) {
       const browserCredentials = variableContext.allTestVariables ?? variableContext.publicTestVariables;
-      const { secrets: explorerSecretVars, publics: explorerPublicVars } = (0, credential_tools_js_1.partitionTestVariables)(browserCredentials);
+      const { secrets: explorerSecretVars, publics: explorerPublicVarsRaw } = (0, credential_tools_js_1.partitionTestVariables)(browserCredentials);
       const hasCredentials = Object.keys(explorerSecretVars).length > 0;
+      const { DISCOVERY_SHOULD_REGISTER: _omitRegisterFlag, ...explorerPublicVars } = explorerPublicVarsRaw;
       const explorerPublicLines = (0, credential_tools_js_1.renderPublicVariablesBlock)(explorerPublicVars);
       const credentialBlock = `${explorerPublicLines ? `
 ## Test Variables (public)
@@ -322136,6 +322758,7 @@ ${explorerPublicLines}
       const inboxBlock = options?.inboxPrompt ? `
 ${options.inboxPrompt}` : "";
       const isRegisterMode = !!options?.inboxPrompt;
+      const emailVerificationUnavailable = !isRegisterMode && !!options?.emailVerificationUnavailable;
       const focusAreas = options?.focusAreas;
       let alreadyDiscoveredPages = "";
       if (existingSiteMap && existingSiteMap.pages.length > 0) {
@@ -322157,21 +322780,27 @@ ${options.inboxPrompt}` : "";
       const isIncremental = !!(options?.incremental && mode === "survey");
       const MAX_EXPLORE_ITERATIONS = getMaxIterations(mode, options?.incremental);
       const isSurvey = mode === "survey";
+      const adaptiveBudgetOn = isSurvey && !isIncremental && (process.env.DISCOVERY_ADAPTIVE_BUDGET === "1" || (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_ADAPTIVE_BUDGET)) && (0, survey_link_frontier_js_1.isSurveyLinkFrontierEnabled)();
+      const surveyPathScope = isSurvey ? (0, survey_scope_js_1.deriveSurveyPathScope)(baseUrl) : null;
       if (isSurvey) {
-        return `You are a QA exploration agent. Your goal: MAP an entire web application by visiting every reachable page and cataloging its structure. You are NOT testing - you are building a complete site map so downstream agents know what to test.
+        return `You are a QA exploration agent. Your goal: ${surveyPathScope ? `MAP one flow of a web application in ISOLATION \u2014 the flow under \`${surveyPathScope.basePath}\` \u2014 visiting every reachable page INSIDE that scope and cataloging its structure` : "MAP an entire web application by visiting every reachable page and cataloging its structure"}. You are NOT testing - you are building a ${surveyPathScope ? "site map of this flow" : "complete site map"} so downstream agents know what to test.
 
 ## Strategy
 1. ${isRegisterMode ? `Navigate to the base URL. BEFORE registering, explore the unauthenticated experience first:
    - Find all reachable public auth pages from the logged-out experience: Login, Register/Sign Up, Forgot Password - check menus, drawers, and modal auth switches too
    - For each: browser_snapshot \u2192 capture_page \u2192 record_transition
    - Do NOT submit the password-reset form - only catalog it (survey rule: map, do not mutate)
-   - After capturing the public auth pages, REGISTER a new account by following the Account Registration section below, then continue mapping the authenticated app` : hasCredentials ? `Navigate to the base URL. BEFORE logging in, explore the unauthenticated experience first:
+   - After capturing the public auth pages, REGISTER a new account by following the Account Registration section below, then continue mapping the authenticated app` : emailVerificationUnavailable ? `Navigate to the base URL. NOTE: this project asked to REGISTER a new account, but this runner CANNOT receive email (verification inbox unavailable). Registration may still work if the app does not require email verification:
+   - FIRST explore the unauthenticated experience: find all reachable public auth pages (Login, Register/Sign Up, Forgot Password - check menus, drawers, and modal auth switches too) and capture each: browser_snapshot \u2192 capture_page \u2192 record_transition. Do NOT submit the password-reset form
+   - THEN attempt registration ONCE: fill the signup form via \`fill_credential_form\` with the \`TEST_USER_EMAIL\` + \`TEST_USER_PASSWORD\` credential keys (only if no TEST_USER_EMAIL key is listed, use a fresh \`testuser-<timestamp>@example.com\`), submit it ONCE, and never alter the email or create a second account. If signup says the address is already registered, log in with the same keys instead
+   - If you end up signed in WITHOUT an email round-trip, continue mapping the authenticated app normally
+   - THE WALL: if any step demands an emailed code/link ("check your email", OTP, magic link), STOP that flow immediately \u2014 never type a guessed code, never click Resend \u2014 keep mapping the public app, and state in finish_exploration that authenticated coverage is BLOCKED (cannot receive verification email)` : hasCredentials ? `Navigate to the base URL. BEFORE logging in, explore the unauthenticated experience first:
    - Find all reachable public auth pages from the logged-out experience: Login, Register/Sign Up, Forgot Password - check menus, drawers, and modal auth switches too
    - For each: browser_snapshot \u2192 capture_page \u2192 record_transition
    - Do NOT submit registration or password-reset forms - only catalog the page structure (survey rule: map, do not mutate)
    - After capturing all reachable public auth pages, use the credentials below to log in and continue mapping the authenticated app` : "Navigate to the base URL"}
 2. Take a \`browser_snapshot\` on the landing page. **IMPORTANT: NEVER pass a filename parameter to browser_snapshot - always call it with no arguments so the snapshot is returned inline.**
-3. **BUILD YOUR CHECKLIST**: Before clicking anything, list the navigation links visible in the snapshot - sidebar, header, footer, user menus, hamburger menus. If the snapshot output says some navigation chrome was omitted, immediately call \`capture_page\` on the current page and use its structured nav list to complete the checklist before proceeding. This is your exploration checklist. Visit each one in order
+3. **BUILD YOUR CHECKLIST**: Before clicking anything, list the navigation links visible in the snapshot - sidebar, header, footer, user menus, hamburger menus. If the snapshot output says some navigation chrome was omitted, immediately call \`capture_page\` on the current page and use its structured nav list to complete the checklist before proceeding. This is your exploration checklist. Visit each one in order${surveyPathScope ? ` \u2014 but ONLY the links inside the entry scope \`${surveyPathScope.basePath}\`. Links leading outside it (global header/footer, a parent hub, sibling sections) are OUT of scope: leave them off the checklist, do not visit them` : ""}
    - **ALWAYS navigate by CLICKING links in the page**, not by typing URLs into browser_navigate. Clicking captures the exact locator that downstream test generators need. Direct URL navigation loses this information.
 4. Visit each navigation target systematically. On each page:
    - \`browser_snapshot\` to see the page
@@ -322182,8 +322811,8 @@ ${options.inboxPrompt}` : "";
 5. **Tabs and sub-sections**: If a page has tabs, click EACH tab and call \`capture_page\` for each tab state. Use a route suffix like \`/settings?tab=profile\`, \`/settings?tab=billing\`
 6. **Hidden navigation**: Look for dropdown menus, user/avatar menus (click the avatar), hamburger menus, "More..." links, breadcrumbs. Click to OPEN these to discover navigation targets
 7. **List pages**: If a page shows a list of items with links (e.g. /users/1, /users/2), click ONE item to discover the detail page template. Do NOT visit every item - they are the same page pattern
-8. **Error page**: Navigate to a path that does not exist (e.g. \`/this-page-does-not-exist-404\`) to capture the app's error page
-9. After visiting ALL reachable pages, call \`finish_exploration\`
+8. **Error page**: do NOT probe made-up routes to capture the app's error page \u2014 nothing downstream uses a probed 404. Only catalog an error page if the app itself routes you to one (broken link, failed action, redirect)
+9. After visiting ALL reachable ${surveyPathScope ? "in-scope " : ""}pages, call \`finish_exploration\`
 You do NOT have a \`record_journey\` tool - your job is mapping, not testing. Downstream agents will create tests from your site map.
 
 ## What to catalog (capture_page)
@@ -322208,7 +322837,7 @@ ${(0, survey_scope_js_1.buildSurveyScopeBoundary)(baseUrl)}
 - **OAuth/SSO**: If login redirects to an external provider (Google, GitHub), do not follow it. Note that the app uses OAuth and explore unauthenticated pages only
 - **Auth failure**: If login${isRegisterMode ? " or account registration" : ""} fails after 2 attempts, capture the auth page and explore unauthenticated pages. Note the failure in your \`finish_exploration\` summary
 - **Parameterized routes**: /users/1 and /users/2 are the same page template. Visit ONE instance, not all of them
-- Max iterations: ${MAX_EXPLORE_ITERATIONS}. You will be warned at 90%. Use your full budget to discover every page thoroughly
+- ${adaptiveBudgetOn ? `Initial iteration budget: ${MAX_EXPLORE_ITERATIONS}. If the map is still incomplete as you approach it, the harness may GRANT you more iterations (up to a hard cap) - an explicit "GRANTED: ..." message supersedes this number. Use your budget to discover every page thoroughly` : `Max iterations: ${MAX_EXPLORE_ITERATIONS}. You will be warned at 90%. Use your full budget to discover every page thoroughly`}
 
 ${appBrief ? `## Application Brief
 The user provided this description of their application:
@@ -322230,7 +322859,7 @@ If the user mentioned a specific page that changed (e.g. "Settings was redesigne
    - Check for Login, Register/Sign Up, Forgot Password - including behind menus, drawers, and modal auth switches
    - For each NEW auth page: browser_snapshot \u2192 capture_page \u2192 record_transition
    - Do NOT submit the password-reset form (survey rule: map, do not mutate)
-   - After capturing any new public auth pages, REGISTER a new account (see the Account Registration section) and continue` : hasCredentials ? `Navigate to the base URL. BEFORE logging in, explore the unauthenticated experience for any NEW public auth pages not in the known routes above:
+   - After capturing any new public auth pages, REGISTER a new account (see the Account Registration section) and continue` : emailVerificationUnavailable ? `Navigate to the base URL. NOTE: registration was requested for this project but this runner CANNOT receive email (verification inbox unavailable). Attempt registration ONCE with the \`TEST_USER_EMAIL\` + \`TEST_USER_PASSWORD\` credential keys via \`fill_credential_form\` (if signup says the address is already registered, log in with the same keys). If you get signed in without an email round-trip, map NEW authenticated pages normally. If any step demands an emailed code/link, STOP that flow \u2014 never type a guessed code \u2014 map only NEW public pages and note in finish_exploration that authenticated coverage is BLOCKED (cannot receive verification email)` : hasCredentials ? `Navigate to the base URL. BEFORE logging in, explore the unauthenticated experience for any NEW public auth pages not in the known routes above:
    - Check for Login, Register/Sign Up, Forgot Password - including behind menus, drawers, and modal auth switches
    - For each NEW auth page: browser_snapshot \u2192 capture_page \u2192 record_transition
    - Do NOT submit registration or password-reset forms (survey rule: map, do not mutate)
@@ -322248,7 +322877,9 @@ ${surfaceIntelligence ? "## Prior Recordings\n" + surfaceIntelligence + "\n" : "
 
 ## App Details
 - Base URL: ${baseUrl}
-${credentialBlock}${redactedBlock}${inboxBlock}`;
+${credentialBlock}${redactedBlock}${inboxBlock}${emailVerificationUnavailable ? `
+
+${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}` : ""}`;
       }
       return `You are an expert QA exploration agent. Your job is to USE a web application like a real user - interact with every feature you find, observe what happens, and catalog the results.
 
@@ -322275,7 +322906,7 @@ Every feature you discover should be USED, not just cataloged. The test generato
 
 ## Strategy
 1. Navigate to the BASE URL (the landing/home page). ALWAYS start here - never deep-link directly to sub-pages like /auth/login or /dashboard.
-2. From the landing page, find and use the app's own navigation to reach features.${isRegisterMode ? " First create your account by following the Account Registration section below, then continue." : hasCredentials ? " Find the login/sign-in link and log in using the credentials below." : ""}
+2. From the landing page, find and use the app's own navigation to reach features.${isRegisterMode ? " First create your account by following the Account Registration section below, then continue." : emailVerificationUnavailable ? " NOTE: registration was requested for this project but this runner CANNOT receive email (verification inbox unavailable). First attempt registration ONCE with the `TEST_USER_EMAIL` + `TEST_USER_PASSWORD` credential keys via `fill_credential_form` (never alter the email; if it is already registered, log in with the same keys). If you are signed in without an email round-trip, continue as a normal logged-in user. If any step demands an emailed code/link, STOP that flow \u2014 never type a guessed code \u2014 explore what is publicly reachable and state in finish_exploration that authenticated coverage is BLOCKED (cannot receive verification email)." : hasCredentials ? " Find the login/sign-in link and log in using the credentials below." : ""}
 3. On each page: take a \`browser_snapshot\`, identify what features/actions are available
 4. **USE the features on the page:**
    - Forms: fill every field with realistic data, submit, observe the result (success page, validation errors, redirect, toast messages)
@@ -322293,7 +322924,11 @@ Every feature you discover should be USED, not just cataloged. The test generato
       - Do NOT split validation, invalid input, and recovery into separate tests - combine them into ONE comprehensive test
    c) For multi-section pages (profile with tabs, settings with categories): test each DISTINCT section as a separate happy path test
    Focus on meaningful coverage: every form should have at least a happy path and a validation test. Multi-section pages (tabs, categories) should test each distinct section.
-   **Auth pages (login/register) - SPECIAL ORDER: test NEGATIVE before positive:**
+${emailVerificationUnavailable ? `   **Auth pages (login/register) - registration requested but this runner CANNOT receive email:**
+   - Step 1: Test negative flows FIRST while not logged in: on the LOGIN form, submit empty fields and invalid credentials (synthetic values like "wrong@example.com" / "badpassword" via \`browser_type\` \u2014 nothing can be created there); on the REGISTRATION form, empty-submit validation ONLY (a filled synthetic signup could CREATE a stray account on a permissive app). Call \`record_journey\` ONCE for the combined validation flow
+   - Step 2: Attempt the happy path ONCE via REGISTRATION: \`fill_credential_form\` with the \`TEST_USER_EMAIL\` + \`TEST_USER_PASSWORD\` credential keys, submit the signup form ONCE. Never alter the email or create a second account; if signup says the address is already registered, log in with the same keys instead
+   - Step 3: If you are signed in with NO email round-trip, call \`record_journey\` for the happy path and continue exploring as a logged-in user
+   - THE WALL: if any step demands an emailed code/link (verification code, OTP, magic link, "check your email"), STOP immediately \u2014 never type a guessed code, never click Resend \u2014 record only the validation journey and note in \`finish_exploration\` that the authenticated happy path is BLOCKED (cannot receive verification email)` : `   **Auth pages (login/register) - SPECIAL ORDER: test NEGATIVE before positive:**
    - You arrive at the login/register page NOT logged in - use this state to test errors FIRST
    - Step 1: Submit with empty fields \u2192 observe validation errors
    - Step 2: Submit with invalid credentials (wrong password, bad email) \u2192 observe error messages
@@ -322301,7 +322936,7 @@ Every feature you discover should be USED, not just cataloged. The test generato
    - Step 4: NOW do the happy path - log in with valid credentials \u2192 observe redirect to dashboard
    - Step 5: Call \`record_journey\` for the happy path
    - This order avoids needing to log out between tests. After the happy path, you are logged in and ready to explore other features
-   - **Login filling**: ALWAYS use \`fill_credential_form\` for the happy-path login \u2014 never \`browser_fill_form\` or \`browser_type\` with the actual email/password (those calls will be blocked). Example: \`fill_credential_form({ fields: [{ field: "Email", credentialKey: "TEST_USER_EMAIL" }, { field: "Password", credentialKey: "TEST_USER_PASSWORD" }] })\`. For sequential fills, use \`fill_credential\` per field. Pure validation flows (empty submit, deliberately wrong password) can use \`browser_type\` with synthetic invalid values like "wrong@example.com" / "badpassword" \u2014 those are not real credentials and won't be blocked.
+   - **Login filling**: ALWAYS use \`fill_credential_form\` for the happy-path login \u2014 never \`browser_fill_form\` or \`browser_type\` with the actual email/password (those calls will be blocked). Example: \`fill_credential_form({ fields: [{ field: "Email", credentialKey: "TEST_USER_EMAIL" }, { field: "Password", credentialKey: "TEST_USER_PASSWORD" }] })\`. For sequential fills, use \`fill_credential\` per field. Pure validation flows (empty submit, deliberately wrong password) can use \`browser_type\` with synthetic invalid values like "wrong@example.com" / "badpassword" \u2014 those are not real credentials and won't be blocked.`}
    **Logging out (when needed for other reasons):**
    - To find the logout button: look in the user/avatar menu (click the profile icon or avatar in the header), check sidebar bottom, check settings page
    - Do NOT try navigating to /logout or /auth/logout directly - these URLs rarely exist. Always find and click the actual logout button in the UI
@@ -322352,25 +322987,38 @@ Every feature you discover should be USED, not just cataloged. The test generato
 
 GOOD (specific, with routes, stable assertions):
 \`\`\`
-record_journey({
+${emailVerificationUnavailable ? `record_journey({
+  name: "Contact Form - Validation",
+  route: "/contact",
+  routes: ["/", "/contact"],
+  steps: ["Navigate to /", "Click 'Contact' link", "Submit the empty form", "Observe validation errors"],
+  expectedOutcome: "URL matches /contact. Validation error 'Email is required' is visible.",
+  assertions: [{ type: "url", value: "/contact" }, { type: "error-text", value: "Email is required" }]
+})` : `record_journey({
   name: "Login - Happy Path",
   route: "/auth/login",
   routes: ["/", "/auth/login", "/dashboard"],
   steps: ["Navigate to /", "Click 'Sign In' link", "Fill email and password with test credentials", "Click 'Log In' button", "Observe redirect to /dashboard"],
   expectedOutcome: "URL matches /dashboard. Sidebar link 'Overview' is visible.",
   assertions: [{ type: "url", value: "/dashboard" }, { type: "nav-link", locator: "getByRole('link', { name: 'Overview' })" }]
-})
+})`}
 \`\`\`
 
 BAD (vague, missing routes, marketing assertions):
 \`\`\`
-record_journey({
+${emailVerificationUnavailable ? `record_journey({
+  name: "Contact test",
+  route: "/contact",
+  routes: ["/contact"],
+  steps: ["Try the contact form"],
+  expectedOutcome: "User sees 'The Best Platform Ever' heading"
+})` : `record_journey({
   name: "Login test",
   route: "/auth/login",
   routes: ["/auth/login"],
   steps: ["Login to the app"],
   expectedOutcome: "User sees dashboard with 'Welcome to the Best Platform Ever' heading"
-})
+})`}
 \`\`\`
 
 ## Bug Detection - CRITICAL
@@ -322415,7 +323063,7 @@ Exception: if you need to navigate THROUGH other pages to reach a focus area (e.
 2. Take a \`browser_snapshot\` to understand what's on the page
 3. **HAPPY PATH**: Fill ALL form fields with valid/realistic data, click the primary action button (Submit, Generate, Save, Create, etc.), and observe the result. For AI/async operations, wait for the result using \`browser_wait_for\` before taking a snapshot. Call \`record_journey\` to document this flow
 4. **VALIDATION/ERROR**: Go back to the page. Try submitting with empty required fields. Try invalid data (wrong email format, short password, etc.). Observe ALL validation messages. Fix errors and resubmit successfully. Call \`record_journey\` for the combined validation+recovery flow
-   - **Exception for auth pages (login/register)**: Do validation/errors FIRST (step 4 before step 3) while you are not logged in, then happy path last. See the auth-specific instructions above
+   - **Exception for auth pages (login/register)**: ${emailVerificationUnavailable ? "validation FIRST, then ONE registration attempt with the TEST_USER_EMAIL + TEST_USER_PASSWORD credential keys \u2014 if an emailed code/link is demanded, STOP (never guess a code) and note the happy path as BLOCKED (cannot receive verification email). See the auth-specific instructions above" : "Do validation/errors FIRST (step 4 before step 3) while you are not logged in, then happy path last. See the auth-specific instructions above"}
 5. **ADDITIONAL INTERACTIONS**: Click buttons, open dropdowns, test tabs/sections, try search if available. If there are distinct sub-sections (e.g. tabs, accordion panels), test each one
 6. After each interaction, call \`capture_page\` with detailed observations
 7. **ONLY after completing steps 1-6 for ALL focus areas**, call \`finish_exploration\`
@@ -322517,7 +323165,9 @@ ${surfaceIntelligence}
 
 ## App Details
 - Base URL: ${baseUrl}
-${credentialBlock}${redactedBlock}${inboxBlock}`;
+${credentialBlock}${redactedBlock}${inboxBlock}${emailVerificationUnavailable ? `
+
+${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}` : ""}`;
     }
     async function runExplorePhase(mcpClient, baseUrl, variableContext, existingSiteMap, projectId, existingTestNames, options, config) {
       const logs2 = [];
@@ -322561,6 +323211,7 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
       const perceptionEnricherEnabled = ((0, shared_1.parseBoolFlag)(process.env.DISCOVERY_PERCEPTION_ENRICHER) || process.env.DISCOVERY_PERCEPTION_ENRICHER === "1") && typeof options?.getPerceptionPage === "function";
       const linkFrontierEnabled = (0, survey_link_frontier_js_1.isSurveyLinkFrontierEnabled)() && options?.mode === "survey";
       const linkScope = (0, survey_link_frontier_js_1.deriveLinkScope)(baseUrl);
+      const surveyNavScope = options?.mode === "survey" ? (0, survey_scope_js_1.deriveSurveyPathScope)(baseUrl) : null;
       let finishRedirects = 0;
       let lastLandedPageUrl = null;
       const state2 = (0, exploration_state_js_1.createExplorationState)();
@@ -322589,6 +323240,50 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
           logs2.push(`   [link-frontier] ingestion skipped - ${err instanceof Error ? err.message : String(err)}`);
         }
       }
+      const domHarvestEnabled = linkFrontierEnabled && (0, survey_door_harvester_js_1.isDomHarvestEnabled)();
+      const menuExpandEnabled = domHarvestEnabled && (0, survey_door_harvester_js_1.isMenuExpandEnabled)();
+      const menuExpandAttemptedRoutes = /* @__PURE__ */ new Set();
+      async function harvestDomLinksIntoFrontier() {
+        if (!domHarvestEnabled)
+          return;
+        const currentScoped = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(state2.currentRoute);
+        const currentRs = state2.routeState.get(state2.currentRoute);
+        try {
+          const expandHere = menuExpandEnabled && !menuExpandAttemptedRoutes.has(currentScoped);
+          if (expandHere)
+            menuExpandAttemptedRoutes.add(currentScoped);
+          const harvest = await (0, survey_door_harvester_js_1.harvestDomLinks)(mcpClient, {
+            expandMenus: expandHere,
+            log: (m) => logs2.push(m)
+          });
+          if (harvest.pageUrl)
+            lastLandedPageUrl = harvest.pageUrl;
+          if (harvest.links.length > 0) {
+            (0, survey_link_frontier_js_1.ingestSeenLinks)(state2, {
+              links: (0, survey_door_harvester_js_1.toSeenLinks)(harvest.links),
+              scope: linkScope,
+              isEntryOrHub: currentScoped === linkScope.basePath || state2.iteration <= 2,
+              isErrorContext: currentRs?.pageType === "ERROR",
+              pageUrl: harvest.pageUrl ?? lastLandedPageUrl,
+              provenance: "dom",
+              log: (m) => logs2.push(m)
+            });
+          }
+          if (harvest.navigated && harvest.originalUrl) {
+            logs2.push(`   [door-harvest] page moved during menu expansion \u2014 restoring ${harvest.originalUrl}`);
+            try {
+              const navResult = await mcpClient.callTool({ name: "browser_navigate", arguments: { url: harvest.originalUrl } });
+              if (navResult && typeof navResult === "object" && navResult.isError === true) {
+                logs2.push("   [door-harvest] restore navigate returned an error \u2014 model may be on a different page");
+              }
+            } catch (navErr) {
+              logs2.push(`   [door-harvest] restore failed - ${navErr instanceof Error ? navErr.message : String(navErr)}`);
+            }
+          }
+        } catch (err) {
+          logs2.push(`   [door-harvest] skipped - ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
       const recentExchanges = [];
       const transientDirectives = [];
       const MAX_RECENT_EXCHANGES = 28;
@@ -322617,7 +323312,8 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
       let inboxState = null;
       let inboxReader = null;
       const inboxConfig = (0, verification_inbox_js_1.loadVerificationInboxConfig)();
-      if (inboxConfig && (0, inbox_tools_js_1.hasRegisterIntent)(variableContext)) {
+      const registerIntent = (0, inbox_tools_js_1.hasRegisterIntent)(variableContext);
+      if (inboxConfig && registerIntent) {
         inboxState = (0, inbox_tools_js_1.createInboxRunState)(inboxConfig, {
           tagSeed: baseUrl,
           projectScope: projectId,
@@ -322635,8 +323331,19 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
           log: (line) => logs2.push(line)
         });
         logs2.push(`Verification inbox ENABLED for registration \u2014 email ${inboxState.email}`);
-      } else if ((0, inbox_tools_js_1.clearThrowawayRegisterSeed)(variableContext)) {
-        logs2.push("Register intent set but verification inbox not configured here \u2014 dropped the throwaway TEST_USER_EMAIL seed so the agent registers a fresh account.");
+      } else {
+        if (registerIntent && !inboxConfig) {
+          const gap = (0, verification_inbox_js_1.describeVerificationInboxConfigGap)() ?? "verification inbox unavailable";
+          logs2.push(`Register intent set but the ${gap} on this runner \u2014 keeping the seeded register identity for a one-shot registration attempt.`);
+        } else if ((0, inbox_tools_js_1.clearThrowawayRegisterSeed)(variableContext)) {
+          logs2.push("Stale throwaway TEST_USER_EMAIL seed found (register intent not set) \u2014 dropped it so the agent does not log in with a never-registered account.");
+        }
+      }
+      const emailVerificationUnavailable = registerIntent && !inboxConfig && !(0, credential_tools_js_1.hasUsableLoginIdentity)(variableContext.allTestVariables ?? variableContext.publicTestVariables, {
+        isPlaceholderIdentityValue: inbox_tools_js_1.isThrowawayRegisterSeedEmail
+      });
+      if (emailVerificationUnavailable) {
+        logs2.push("Email verification unavailable \u2014 the agent will ATTEMPT registration once; any flow requiring an emailed code/link will be reported BLOCKED.");
       }
       const inboxPromptBlock = inboxState ? (0, inbox_tools_js_1.buildInboxPromptBlock)({
         email: inboxState.email,
@@ -322674,7 +323381,8 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
         let systemPrompt = config?.systemPrompt ?? buildSystemPrompt(baseUrl, variableContext, existingSiteMap, existingTestNames, {
           ...options,
           canRotateCredentials: !!options?.onCredentialUpdate,
-          inboxPrompt: inboxPromptBlock
+          inboxPrompt: inboxPromptBlock,
+          emailVerificationUnavailable
         });
         if (config?.systemPrompt && inboxPromptBlock) {
           systemPrompt += `
@@ -322685,7 +323393,14 @@ ${inboxPromptBlock}`;
         const hasLoginCredentials = Object.keys(browserSecretsForHint).length > 0;
         const aiClient = options?.modelOverride ? (0, ai_provider_js_1.getRunnerClientForModel)(options.modelOverride) : (0, ai_provider_js_1.getRunnerAIClient)();
         const isDeepMode = options?.mode === "deep";
-        const maxIterations = config?.maxIterationsOverride && config.maxIterationsOverride > 0 ? config.maxIterationsOverride : getMaxIterations(options?.mode ?? "full", options?.incremental);
+        const baseMaxIterations = config?.maxIterationsOverride && config.maxIterationsOverride > 0 ? config.maxIterationsOverride : getMaxIterations(options?.mode ?? "full", options?.incremental);
+        const adaptiveBudgetEnabled = process.env.DISCOVERY_ADAPTIVE_BUDGET === "1" || (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_ADAPTIVE_BUDGET);
+        const adaptiveActive = adaptiveBudgetEnabled && isSurveyMode && linkFrontierEnabled && !options?.incremental && !(config?.maxIterationsOverride && config.maxIterationsOverride > 0);
+        const adaptiveHardCap = adaptiveActive ? Math.max(baseMaxIterations, readPositiveIntEnv2(process.env, "DISCOVERY_ADAPTIVE_BUDGET_HARD_CAP", DEFAULT_ADAPTIVE_BUDGET_HARD_CAP)) : baseMaxIterations;
+        let maxIterations = baseMaxIterations;
+        if (adaptiveActive) {
+          logs2.push(`Adaptive budget: ON (floor ${baseMaxIterations}, hard cap ${adaptiveHardCap})`);
+        }
         const configKeepTail = isDeepMode ? Math.ceil(ctxConfig.keepTail * 1.5) : ctxConfig.keepTail;
         logs2.push(`Context: ${ctxConfig.tier} tier (${Math.round(ctxConfig.contextWindow / 1e3)}k window, emergency at ${Math.round(ctxConfig.emergencyTokenThreshold / 1e3)}k, prune every ${ctxConfig.pruneEveryN || "never"}, keepTail=${configKeepTail})`);
         logs2.push(`Discovery mode: ${useV3 ? "V3 (per-turn rebuild)" : "V2.5 (full transcript + control brief)"}${v3Env ? ` [override: V3=${v3Env}]` : " [auto]"}`);
@@ -322694,7 +323409,8 @@ ${inboxPromptBlock}`;
         const inboxPasswordKey = inboxState?.passwordKey ?? "TEST_USER_PASSWORD";
         const registerHint = ` follow the **Account Registration** steps in the system prompt to create and email-verify a new account (call provision_identity for the email, fill the signup form with that email + the \`${inboxPasswordKey}\` credential, submit, then complete the email verification)`;
         const surveyBreadthHint = linkFrontierEnabled ? " Visit and capture EVERY top-level link on your checklist BEFORE drilling into any section's sub-pages. The state packet's Frontier list tracks discovered-but-unvisited routes - drain it." : "";
-        const userMessage = config?.userMessage ?? (isSurveyMode ? registerMode ? `Navigate to ${baseUrl}. BEFORE registering, explore all reachable public auth pages from the logged-out experience (login, register, forgot-password - check menus and drawers too). Capture each with capture_page and record_transition. Do NOT submit the password-reset form. Then create your account:${registerHint}. After your account is verified and you are logged in, take a browser_snapshot and list the navigation links visible in the snapshot before clicking anything - this is your checklist.${surveyBreadthHint} Then visit each page systematically, catalog it with capture_page, and record transitions. After capture_page records a page, reuse the captured state facts; only take a fresh browser_snapshot after navigation, loading, or a visible UI state change. Open tabs, and visit one detail page per list. Map the entire application thoroughly.` : `Navigate to ${baseUrl}.${hasLoginCredentials ? ` BEFORE logging in, explore all reachable public auth pages from the logged-out experience (login, register, forgot-password - check menus and drawers too). Capture each with capture_page and record_transition. Do NOT submit registration or password-reset forms. After mapping public auth pages, log in.${loginHint}` : ""} After${hasLoginCredentials ? " logging in" : " landing"}, take a browser_snapshot and list the navigation links visible in the snapshot before clicking anything - this is your checklist.${surveyBreadthHint} Then visit each page systematically, catalog it with capture_page, and record transitions. After capture_page records a page, reuse the captured state facts; only take a fresh browser_snapshot after navigation, loading, or a visible UI state change. Open tabs, and visit one detail page per list. Map the entire application thoroughly.` : isDeepMode ? `Start by navigating to ${baseUrl}${registerMode ? ` and create your account:${registerHint}.` : hasLoginCredentials ? ` and log in.${loginHint}` : "."} Then go to the focus areas listed in the system prompt. For EACH focus area, you must: (1) test the happy path with valid data and call record_journey, (2) test validation/errors with invalid/empty data and call record_journey, (3) interact with all buttons/dropdowns/tabs on the page. You have ${maxIterations} iterations - use them all. Do NOT call finish_exploration until you have completed BOTH happy path AND validation testing for every focus area.` : `Start by navigating to ${baseUrl}${registerMode ? ` and create your account:${registerHint}.` : hasLoginCredentials ? ` and log in.${loginHint}` : "."} Then explore the application feature by feature. On each page, take a browser_snapshot and call capture_page. When you find forms or interactive features, actually USE them - fill in fields, click buttons, submit forms, and observe what happens. Capture every resulting page. Remember: visiting a page is not enough - interact with it like a real user would.`);
+        const emailWallNote = ' NOTE: this project asked to REGISTER a new account, but this runner CANNOT receive email (verification inbox unavailable). Attempt registration ONCE with the `TEST_USER_EMAIL` + `TEST_USER_PASSWORD` credential keys via `fill_credential_form` (never alter the email or create a second account; if signup says the address is already registered, log in with the same keys instead). If you are signed in without an email round-trip, continue as a normal logged-in user. The moment any step demands an emailed code/link (verification code, OTP, magic link, "check your email"), STOP that flow - never type a guessed code, never click Resend - continue with publicly reachable pages and state in your finish_exploration summary that authenticated coverage is BLOCKED (cannot receive verification email).';
+        const userMessage = config?.userMessage ?? (isSurveyMode ? registerMode ? `Navigate to ${baseUrl}. BEFORE registering, explore all reachable public auth pages from the logged-out experience (login, register, forgot-password - check menus and drawers too). Capture each with capture_page and record_transition. Do NOT submit the password-reset form. Then create your account:${registerHint}. After your account is verified and you are logged in, take a browser_snapshot and list the navigation links visible in the snapshot before clicking anything - this is your checklist.${surveyBreadthHint} Then visit each page systematically, catalog it with capture_page, and record transitions. After capture_page records a page, reuse the captured state facts; only take a fresh browser_snapshot after navigation, loading, or a visible UI state change. Open tabs, and visit one detail page per list. Map the entire application thoroughly.` : emailVerificationUnavailable ? `Navigate to ${baseUrl}.${emailWallNote} BEFORE the registration attempt, explore all reachable public auth pages from the logged-out experience and capture each with capture_page and record_transition (do NOT submit the password-reset form). After the registration attempt resolves (signed in, or blocked at the email wall), take a browser_snapshot and list the navigation links visible in the snapshot before clicking anything - this is your checklist.${surveyBreadthHint} Then visit each reachable page systematically, catalog it with capture_page, and record transitions. After capture_page records a page, reuse the captured state facts; only take a fresh browser_snapshot after navigation, loading, or a visible UI state change. Open tabs, and visit one detail page per list. Map the entire reachable application thoroughly.` : `Navigate to ${baseUrl}.${hasLoginCredentials ? ` BEFORE logging in, explore all reachable public auth pages from the logged-out experience (login, register, forgot-password - check menus and drawers too). Capture each with capture_page and record_transition. Do NOT submit registration or password-reset forms. After mapping public auth pages, log in.${loginHint}` : ""} After${hasLoginCredentials ? " logging in" : " landing"}, take a browser_snapshot and list the navigation links visible in the snapshot before clicking anything - this is your checklist.${surveyBreadthHint} Then visit each page systematically, catalog it with capture_page, and record transitions. After capture_page records a page, reuse the captured state facts; only take a fresh browser_snapshot after navigation, loading, or a visible UI state change. Open tabs, and visit one detail page per list. Map the entire application thoroughly.` : isDeepMode ? emailVerificationUnavailable ? `Start by navigating to ${baseUrl}.${emailWallNote} Make the ONE registration attempt first. Then go to the focus areas listed in the system prompt. If you are signed in, cover EACH focus area fully: (1) happy path with valid data \u2192 record_journey, (2) validation/errors with invalid/empty data \u2192 record_journey, (3) interact with all buttons/dropdowns/tabs. If you were blocked at the email wall, cover what is reachable WITHOUT an account: validation/errors with synthetic invalid/empty data \u2192 record_journey, public interactions, and note account-gated flows as BLOCKED in finish_exploration instead of attempting them. You have ${maxIterations} iterations. Do NOT call finish_exploration until you have covered every reachable focus area.` : `Start by navigating to ${baseUrl}${registerMode ? ` and create your account:${registerHint}.` : hasLoginCredentials ? ` and log in.${loginHint}` : "."} Then go to the focus areas listed in the system prompt. For EACH focus area, you must: (1) test the happy path with valid data and call record_journey, (2) test validation/errors with invalid/empty data and call record_journey, (3) interact with all buttons/dropdowns/tabs on the page. You have ${maxIterations} iterations - use them all. Do NOT call finish_exploration until you have completed BOTH happy path AND validation testing for every focus area.` : `Start by navigating to ${baseUrl}${registerMode ? ` and create your account:${registerHint}.` : emailVerificationUnavailable ? `.${emailWallNote}` : hasLoginCredentials ? ` and log in.${loginHint}` : "."} Then explore the application feature by feature. On each page, take a browser_snapshot and call capture_page. When you find forms or interactive features, actually USE them - fill in fields, click buttons, submit forms, and observe what happens. Capture every resulting page. Remember: visiting a page is not enough - interact with it like a real user would.`);
         let messages = [
           { role: "system", content: systemPrompt },
           { role: "user", content: userMessage }
@@ -322703,6 +323419,7 @@ ${inboxPromptBlock}`;
         let lastVisitedSize = 0;
         let lastSurveyProgressMark = 0;
         let staleIterations = 0;
+        let staleKnownKeysMark = 0;
         let lastCaptureIteration = 0;
         let lastJourneyProgress = 0;
         let lastDeepProgressMark = 0;
@@ -322715,9 +323432,151 @@ ${inboxPromptBlock}`;
         const BRIEF_INTERVAL = 5;
         const stuckDetectorEnabled = process.env.DISCOVERY_STUCK_DETECTOR === "1" || (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_STUCK_DETECTOR);
         const stuckDetector = stuckDetectorEnabled ? new stuck_detector_js_1.StuckDetector({ repetitionReachesRecovery: !isDeepMode }) : null;
-        while (iteration < maxIterations && !explorationComplete) {
+        let adaptiveDecisionArmedAt = Math.ceil(maxIterations * ADAPTIVE_BUDGET_DECISION_PCT);
+        let adaptiveRescueUsed = false;
+        let adaptiveComplete = false;
+        let adaptivePendingDiscoveryRoutes = [];
+        let adaptiveLastNewRouteIteration = Number.NEGATIVE_INFINITY;
+        let adaptivePrevVisitedSize = 0;
+        let captureRevision = 0;
+        let captureCreditedThrough = 0;
+        const adaptiveKnownKeys = /* @__PURE__ */ new Set();
+        let discoveryRevision = 0;
+        let discoveryCreditedThrough = 0;
+        let adaptiveLastDiscoveryIteration = Number.NEGATIVE_INFINITY;
+        let adaptiveDiscoveryLeaseUsed = false;
+        const adaptiveDebtRoutes = () => {
+          const isAttemptedLinkEntry = (r) => {
+            const item = state2.frontier.get(r);
+            return item?.source === "link-seen" && item.attempted === true;
+          };
+          const ranked = (0, exploration_state_js_1.getRankedFrontier)(state2, { preferShallow: true }).filter((r) => r !== "/" && !isAttemptedLinkEntry(r));
+          const rankedSet = new Set(ranked);
+          const navigatedUncaptured = [];
+          for (const r of state2.frontier.keys()) {
+            if (r !== "/" && !rankedSet.has(r) && !isAttemptedLinkEntry(r))
+              navigatedUncaptured.push(r);
+          }
+          return ranked.concat(navigatedUncaptured);
+        };
+        const describeRankedRoutes = (routes, max) => routes.slice(0, max).map((r) => {
+          const label = state2.frontier.get(r)?.label;
+          return label ? `${label} (${r})` : r;
+        }).join(", ");
+        const refreshAdaptiveDiscovery = () => {
+          if (state2.visitedRoutes.size > adaptivePrevVisitedSize) {
+            adaptivePrevVisitedSize = state2.visitedRoutes.size;
+            adaptiveLastNewRouteIteration = iteration;
+            captureRevision++;
+          }
+          const debt = adaptiveDebtRoutes();
+          let grew = false;
+          for (const route2 of debt) {
+            const key = state2.frontier.get(route2)?.familyKey ?? (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2);
+            if (!adaptiveKnownKeys.has(key)) {
+              adaptiveKnownKeys.add(key);
+              adaptivePendingDiscoveryRoutes.push(route2);
+              grew = true;
+            }
+          }
+          if (grew) {
+            discoveryRevision++;
+            adaptiveLastDiscoveryIteration = iteration;
+          }
+          if (!adaptiveComplete && adaptiveDecisionArmedAt === Number.POSITIVE_INFINITY && debt.length > 0) {
+            adaptiveDecisionArmedAt = iteration;
+          }
+        };
+        const runBudgetController = (opts = {}) => {
+          const allowExtension = opts.allowExtension ?? true;
+          const remainingList = adaptiveDebtRoutes();
+          const capturing = captureRevision > captureCreditedThrough && iteration - adaptiveLastNewRouteIteration <= ADAPTIVE_BUDGET_PROGRESS_WINDOW;
+          const freshDiscovery = discoveryRevision > discoveryCreditedThrough && iteration - adaptiveLastDiscoveryIteration <= ADAPTIVE_BUDGET_PROGRESS_WINDOW;
+          const decision = computeBudgetDecision({
+            iteration,
+            currentCap: maxIterations,
+            hardCap: adaptiveHardCap,
+            remainingRoutes: remainingList.length,
+            capturing,
+            freshDiscovery,
+            discoveryLeaseUsed: adaptiveDiscoveryLeaseUsed,
+            rescueUsed: adaptiveRescueUsed,
+            allowExtension
+          });
+          if (decision.action === "extend") {
+            maxIterations = decision.newCap;
+            adaptiveRescueUsed = false;
+            discoveryCreditedThrough = discoveryRevision;
+            adaptiveDecisionArmedAt = Math.min(maxIterations, Math.max(iteration + ADAPTIVE_BUDGET_MIN_GAP, Math.ceil(maxIterations * ADAPTIVE_BUDGET_DECISION_PCT)));
+            const remainingSet = new Set(remainingList);
+            const freshFirst = [.../* @__PURE__ */ new Set([
+              ...adaptivePendingDiscoveryRoutes.filter((r) => remainingSet.has(r)),
+              ...remainingList
+            ])];
+            adaptivePendingDiscoveryRoutes = [];
+            if (decision.lease === "discovery") {
+              adaptiveDiscoveryLeaseUsed = true;
+              logs2.push(`  [adaptive-budget] discovery lease +${decision.delta} \u2192 ${maxIterations}; ${remainingList.length} newly-found route(s)`);
+              return {
+                directive: `GRANTED: ${decision.delta} more iterations to capture routes you discovered late in the crawl. Reach these through the app's own links/menus, then capture_page + record_transition each: ${describeRankedRoutes(freshFirst, 6)}. If one can't be reached after a deliberate attempt, note it in your summary and move on.`,
+                keepGoing: true
+              };
+            }
+            captureCreditedThrough = captureRevision;
+            logs2.push(`  [adaptive-budget] capture lease +${decision.delta} \u2192 ${maxIterations}; ${remainingList.length} route(s) still un-captured`);
+            return {
+              directive: `GRANTED: ${decision.delta} additional iterations (your budget is now ${maxIterations}). Coverage is incomplete. Reach these still-unmapped routes through the app's own links and menus, then capture_page + record_transition each: ${describeRankedRoutes(freshFirst, 6)}. Already-captured pages may be traversed, but do not re-catalog them. If a target redirects, errors, or cannot be located after a deliberate attempt, note it in your summary and move to the next.`,
+              keepGoing: true
+            };
+          }
+          if (decision.action === "rescue") {
+            adaptiveRescueUsed = true;
+            const runwayTarget = Math.min(adaptiveHardCap, iteration + ADAPTIVE_BUDGET_RESCUE_WINDOW);
+            if (runwayTarget > maxIterations)
+              maxIterations = runwayTarget;
+            adaptiveDecisionArmedAt = Math.min(maxIterations, iteration + ADAPTIVE_BUDGET_RESCUE_WINDOW);
+            logs2.push(`  [adaptive-budget] stall rescue \u2192 steering to ${remainingList.length} un-captured route(s) (cap ${maxIterations})`);
+            return {
+              directive: `You are revisiting pages without capturing anything new. ${remainingList.length} discovered route(s) are still unmapped: ${describeRankedRoutes(remainingList, 4)}. Navigate to each through the app's links/menus and capture_page it now. If one is genuinely unreachable, note it and move on \u2014 do not keep re-loading pages you have already seen.`,
+              keepGoing: true
+            };
+          }
+          if (decision.action === "finish") {
+            if (decision.reason === "drained") {
+              adaptiveDecisionArmedAt = Number.POSITIVE_INFINITY;
+              logs2.push("  [adaptive-budget] frontier drained \u2014 quiescent (will re-arm on new discovery)");
+            } else {
+              adaptiveComplete = true;
+              adaptiveDecisionArmedAt = Number.POSITIVE_INFINITY;
+              logs2.push(`  [adaptive-budget] finishing (${decision.reason}); ${remainingList.length} route(s) left un-captured`);
+            }
+            return { directive: null, keepGoing: false };
+          }
+          adaptiveDecisionArmedAt = Math.min(iteration + 5, maxIterations);
+          return { directive: null, keepGoing: true };
+        };
+        const tryAdaptiveBoundaryExtend = () => {
+          if (!adaptiveActive || adaptiveComplete)
+            return false;
+          refreshAdaptiveDiscovery();
+          const { directive, keepGoing } = runBudgetController();
+          if (keepGoing && maxIterations > iteration) {
+            if (directive) {
+              if (useV3) {
+                transientDirectives.push(directive);
+              } else {
+                messages.push({ role: "user", content: directive });
+              }
+            }
+            return true;
+          }
+          return false;
+        };
+        while (!explorationComplete && (iteration < maxIterations || tryAdaptiveBoundaryExtend())) {
           iteration++;
           (0, exploration_state_js_1.reduceEvent)(state2, { type: "ITERATION_STARTED", iteration });
+          if (adaptiveActive)
+            refreshAdaptiveDiscovery();
           const iterStartedAt = Date.now();
           logs2.push(`
 -- Explore iteration ${iteration}/${maxIterations} --`);
@@ -322761,7 +323620,7 @@ ${inboxPromptBlock}`;
                   logs2.push(`  Deep mode escalation: forced action after ${deepStaleChecks * 5} stale iterations`);
                 } else if (deepStaleChecks >= 3 && !deepStaleNudgeSent) {
                   deepStaleNudgeSent = true;
-                  const nudgeMsg = `You haven't recorded any new journeys or captured new interactions in a while. If you've finished testing all focus areas (both happy path AND validation), call finish_exploration. Otherwise, continue - try submitting forms with invalid/empty data to test validation, or interact with elements you haven't tried yet.`;
+                  const nudgeMsg = emailVerificationUnavailable ? `You haven't recorded any new journeys or captured new interactions in a while. If you've finished testing everything reachable in your focus areas, call finish_exploration. Otherwise, continue - try submitting forms with invalid/empty synthetic data to test validation, or interact with elements you haven't tried yet. Do NOT re-attempt registration or login flows that were blocked at the email-verification wall - note them as BLOCKED instead.` : `You haven't recorded any new journeys or captured new interactions in a while. If you've finished testing all focus areas (both happy path AND validation), call finish_exploration. Otherwise, continue - try submitting forms with invalid/empty data to test validation, or interact with elements you haven't tried yet.`;
                   if (useV3) {
                     transientDirectives.push(nudgeMsg);
                   } else {
@@ -322795,14 +323654,39 @@ ${inboxPromptBlock}`;
                 }
                 logs2.push(`  Snapshot-loop nudge: ${itersSinceCapture} iterations without capture_page`);
               }
-              if (currentSurveyProgressMark === lastSurveyProgressMark) {
+              if (adaptiveActive && !adaptiveComplete && adaptiveKnownKeys.size > staleKnownKeysMark) {
+                staleKnownKeysMark = adaptiveKnownKeys.size;
+                if (currentSurveyProgressMark === lastSurveyProgressMark && staleIterations > 0) {
+                  logs2.push(`  Stall check: frontier grew to ${adaptiveKnownKeys.size} identities \u2014 counting as progress`);
+                }
+                staleIterations = 0;
+              } else if (currentSurveyProgressMark === lastSurveyProgressMark) {
                 staleIterations++;
                 if (staleIterations >= 4) {
-                  logs2.push(`  Survey hard stop: no survey progress in ${staleIterations * 5} iterations, forcing completion`);
-                  explorationComplete = true;
-                  summary = `Exploration force-stopped after ${iteration} iterations - no survey progress in ${staleIterations * 5} iterations. Visited ${currentVisitedSize} pages.`;
-                  break;
-                } else if (staleIterations >= 2) {
+                  if (adaptiveActive && !adaptiveComplete) {
+                    const { directive, keepGoing } = runBudgetController({ allowExtension: false });
+                    if (keepGoing) {
+                      staleIterations = 2;
+                      if (directive) {
+                        if (useV3) {
+                          transientDirectives.push(directive);
+                        } else {
+                          messages.push({ role: "user", content: directive });
+                        }
+                      }
+                    } else {
+                      logs2.push(`  Survey hard stop (adaptive terminal): no survey progress in ${staleIterations * 5} iterations`);
+                      explorationComplete = true;
+                      summary = `Exploration force-stopped after ${iteration} iterations - no survey progress in ${staleIterations * 5} iterations. Visited ${currentVisitedSize} pages.`;
+                      break;
+                    }
+                  } else {
+                    logs2.push(`  Survey hard stop: no survey progress in ${staleIterations * 5} iterations, forcing completion`);
+                    explorationComplete = true;
+                    summary = `Exploration force-stopped after ${iteration} iterations - no survey progress in ${staleIterations * 5} iterations. Visited ${currentVisitedSize} pages.`;
+                    break;
+                  }
+                } else if (staleIterations >= 2 && !adaptiveActive) {
                   const loopMsg = "You appear to be revisiting the same pages without discovering new routes, transitions, or useful auth/navigation progress. Call finish_exploration NOW with a summary of what you found.";
                   if (useV3) {
                     transientDirectives.push(loopMsg);
@@ -322849,7 +323733,23 @@ ${inboxPromptBlock}`;
               lastJourneyProgress = currentJourneyProgress;
             }
           }
-          if (iteration >= Math.floor(maxIterations * 0.9)) {
+          if (adaptiveActive && !adaptiveComplete && iteration >= adaptiveDecisionArmedAt) {
+            const { directive, keepGoing } = runBudgetController();
+            if (directive) {
+              if (useV3) {
+                transientDirectives.push(directive);
+              } else {
+                messages.push({ role: "user", content: directive });
+              }
+            }
+            if (!keepGoing && adaptiveComplete) {
+              explorationComplete = true;
+              summary = summary || `Exploration finished after ${iteration} iterations (adaptive budget: coverage incomplete).`;
+              logs2.push(`  [adaptive-budget] terminal at iteration ${iteration}`);
+              break;
+            }
+          }
+          if (!adaptiveActive && iteration >= Math.floor(maxIterations * 0.9)) {
             const budgetTestCount = useV2 ? state2.recordedJourneys.length : localJourneys.length;
             const budgetBlocking = linkFrontierEnabled ? (0, survey_link_frontier_js_1.getFinishBlockingFrontier)(state2) : [];
             const budgetMsg = isDeepMode ? budgetTestCount === 0 ? "CRITICAL: You have used 90% of your iteration budget and have NOT recorded any journeys yet. You MUST call record_journey NOW for every flow you have tested (happy paths, validation, edge cases). After calling record_journey for all completed flows, call finish_exploration. Do NOT call finish_exploration without first calling record_journey." : `CRITICAL: You have used 90% of your iteration budget. You have recorded ${budgetTestCount} journey(s) so far. If you have completed any additional flows that you haven't called record_journey for, do so NOW. Then call finish_exploration with a summary.` : budgetBlocking.length > 0 ? `CRITICAL: You have used 90% of your iteration budget. These discovered routes were never visited: ${(0, survey_link_frontier_js_1.describeBlockingRoutes)(budgetBlocking, 4)}. Visit ONLY these (capture_page each), then call finish_exploration. Do not explore anything else.` : "CRITICAL: You have used 90% of your iteration budget. Wrap up your current interaction and call finish_exploration with a summary of what you found. If you are mid-flow, complete it quickly then finish.";
@@ -322941,7 +323841,7 @@ ${recent}`);
                     if (remainingFocusAreas.length > 0)
                       progressLines.push(`### Focus Areas NOT YET Visited: ${remainingFocusAreas.join(", ")} - explore these next!`);
                     progressLines.push("");
-                    progressLines.push("IMPORTANT: For each focus area, you must test BOTH the happy path (valid data) AND validation/error handling (invalid/empty data). If you have only done the happy path, go back and test validation now.");
+                    progressLines.push(emailVerificationUnavailable ? "IMPORTANT: For each focus area, test everything reachable in your current auth state: validation/error handling with invalid/empty data, plus the happy path if you are signed in. If a flow was blocked at the email-verification wall, note it as BLOCKED \u2014 do not re-attempt it and never type a guessed code." : "IMPORTANT: For each focus area, you must test BOTH the happy path (valid data) AND validation/error handling (invalid/empty data). If you have only done the happy path, go back and test validation now.");
                   }
                   progressLines.push("");
                   progressLines.push("## NEXT ACTIONS");
@@ -322952,7 +323852,7 @@ ${recent}`);
                     });
                     if (untestedAreas.length > 0) {
                       progressLines.push(`These focus areas still need testing: ${untestedAreas.join(", ")}`);
-                      progressLines.push("For each: (1) happy path with valid data \u2192 record_journey, (2) validation with invalid/empty data \u2192 record_journey");
+                      progressLines.push(emailVerificationUnavailable ? "For each: cover what your current auth state reaches \u2014 validation with invalid/empty data \u2192 record_journey, plus happy path if signed in; note email-wall-blocked flows as BLOCKED instead of re-attempting them" : "For each: (1) happy path with valid data \u2192 record_journey, (2) validation with invalid/empty data \u2192 record_journey");
                     } else {
                       progressLines.push("All focus areas have tests. Look for additional edge cases or call finish_exploration.");
                     }
@@ -323005,7 +323905,8 @@ ${currentSummary}`;
               const brief = (0, exploration_prompt_builder_js_2.buildControlBrief)(state2, {
                 mode: options?.mode ?? "full",
                 maxIterations,
-                focusAreas: options?.focusAreas
+                focusAreas: options?.focusAreas,
+                adaptiveBudget: adaptiveActive
               });
               messages.push({ role: "user", content: brief });
               lastBriefRoute = currentStateRoute;
@@ -323024,7 +323925,8 @@ ${currentSummary}`;
               recentExchanges,
               incremental: options?.incremental,
               userNotes: options?.userNotes,
-              linkFrontierEnabled
+              linkFrontierEnabled,
+              adaptiveBudget: adaptiveActive
             });
             transientDirectives.length = 0;
           }
@@ -323233,6 +324135,9 @@ ${currentSummary}`;
                     sessionState: normalized.sessionState
                   });
                   ingestLinksFromText(snapshotText.snapshotText);
+                  if (domHarvestEnabled) {
+                    await harvestDomLinksIntoFrontier();
+                  }
                   const isSurvey = options?.mode === "survey";
                   const subNavItems = [];
                   for (const el of normalized.elements) {
@@ -323741,6 +324646,30 @@ finish_exploration bounced (${finishRedirects}/${survey_link_frontier_js_1.MAX_F
                   logs2.push(`  finish accepted with ${blocking.length} uncovered discovered route(s): ${(0, survey_link_frontier_js_1.describeBlockingRoutes)(blocking, 10)}`);
                 }
               }
+              if (adaptiveActive && !adaptiveComplete) {
+                refreshAdaptiveDiscovery();
+                const remainingList = adaptiveDebtRoutes();
+                if (remainingList.length > 0 && iteration < adaptiveHardCap) {
+                  let reason = null;
+                  if (iteration >= adaptiveDecisionArmedAt) {
+                    const { directive, keepGoing } = runBudgetController();
+                    if (keepGoing) {
+                      reason = directive ?? `Not done yet \u2014 ${remainingList.length} discovered route(s) were never captured: ${describeRankedRoutes(remainingList, 6)}. Visit and capture_page each (via the app's links), then call finish_exploration.`;
+                    }
+                  } else {
+                    reason = `Not done yet \u2014 ${remainingList.length} discovered route(s) were never captured: ${describeRankedRoutes(remainingList, 6)}. Visit and capture_page each (via the app's links), then call finish_exploration.`;
+                  }
+                  if (reason) {
+                    toolResults.push({
+                      role: "tool",
+                      tool_call_id: toolCall.id,
+                      content: JSON.stringify({ acknowledged: false, keepExploring: true, reason })
+                    });
+                    logs2.push(`  [adaptive-budget] finish bounced: ${remainingList.length} route(s) still un-captured`);
+                    continue;
+                  }
+                }
+              }
               explorationComplete = true;
               summary = String(toolArgs.summary || "");
               (0, exploration_state_js_1.reduceEvent)(state2, { type: "EXPLORATION_FINISHED", summary });
@@ -323798,6 +324727,18 @@ Exploration complete: ${summary}`);
               continue;
             }
             if (toolName === "fill_credential" || toolName === "fill_credential_form") {
+              if (emailVerificationUnavailable) {
+                const codeGuard = (0, inbox_tools_js_1.guardVerificationCodeFabrication)(toolName, toolArgs);
+                if (codeGuard.blocked) {
+                  logs2.push(`   BLOCKED ${toolName}: verification-code field in email-verification-unavailable mode (field="${codeGuard.matchedField}")`);
+                  toolResults.push({
+                    role: "tool",
+                    tool_call_id: toolCall.id,
+                    content: codeGuard.message ?? "BLOCKED: cannot receive verification email"
+                  });
+                  continue;
+                }
+              }
               const fullVarMap = variableContext.allTestVariables ?? variableContext.publicTestVariables;
               const { secrets: dispatchSecrets } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMap);
               try {
@@ -323880,6 +324821,18 @@ Exploration complete: ${summary}`);
                 continue;
               }
             }
+            if (emailVerificationUnavailable) {
+              const codeGuard = (0, inbox_tools_js_1.guardVerificationCodeFabrication)(toolName, toolArgs);
+              if (codeGuard.blocked) {
+                logs2.push(`   BLOCKED ${toolName}: verification-code field in email-verification-unavailable mode (field="${codeGuard.matchedField}")`);
+                toolResults.push({
+                  role: "tool",
+                  tool_call_id: toolCall.id,
+                  content: codeGuard.message ?? "BLOCKED: cannot receive verification email"
+                });
+                continue;
+              }
+            }
             if (inboxState?.provisioned && toolCallLooksLikeSignupSubmit(toolName, toolArgs)) {
               accountAlreadyExistsRecoveryExpiresAt = iteration + 2;
             }
@@ -324123,6 +325076,11 @@ Exploration complete: ${summary}`);
                       logs2.push(`   \u26A0 Out of scope: ${detectedRoute} (focus: ${navFocusAreas.join(", ")})`);
                       toolResults.__outOfScopeRedirect = `You navigated to ${detectedRoute} which is OUTSIDE your focus areas (${navFocusAreas.join(", ")}). This is a different feature. You may observe the URL for assertion purposes (e.g. "verify redirect to ${detectedRoute}"), but do NOT interact with this page - do not fill forms, click buttons, or call capture_page here. Navigate back to your focus areas or call finish_exploration if you are done.`;
                     }
+                  } else if (surveyNavScope) {
+                    if (!(0, survey_scope_js_1.routeWithinSurveyBasePath)(detectedRoute, surveyNavScope) && !(0, survey_scope_js_1.hasAuthFlowSegment)(detectedRoute)) {
+                      logs2.push(`   \u26A0 Out of survey scope: ${detectedRoute} (entry scope: ${surveyNavScope.basePath})`);
+                      toolResults.__outOfScopeRedirect = `You navigated to ${detectedRoute}, which is OUTSIDE this survey's entry scope (\`${surveyNavScope.basePath}\`). This is a SCOPED survey \u2014 that page is not part of the audited flow: do NOT catalog it (no capture_page), do not follow its links, and do not create a featureGroup for it. Navigate back to a page under \`${surveyNavScope.basePath}\` and continue mapping the in-scope flow. If you have already covered the in-scope pages, call finish_exploration.`;
+                    }
                   }
                 }
               }
@@ -324418,6 +325376,7 @@ Fatal error: ${msg}`);
         const status = fatalErr?.status;
         const lower = msg.toLowerCase();
         const truncatedReason = status === 429 || lower.includes("rate limit") || lower.includes("too many requests") || lower.includes("quota") ? "rate_limit" : status === 408 || lower.includes("timeout") || lower.includes("timed out") || lower.includes("etimedout") ? "timeout" : "ai_error";
+        const truncatedTransient = (0, ai_retry_js_1.isTransientRateError)(fatalErr);
         if (useV2) {
           try {
             (0, exploration_state_js_1.flushUnflushedCommands)(state2, variableContext.allTestVariables ?? variableContext.publicTestVariables);
@@ -324462,7 +325421,8 @@ Fatal error: ${msg}`);
             collectedTransitions: state2.collectedTransitions,
             iterationTimeline: iterationTimeline.length > 0 ? iterationTimeline : void 0,
             truncated: true,
-            truncatedReason
+            truncatedReason,
+            truncatedTransient
           };
         }
         return {
@@ -324482,7 +325442,8 @@ Fatal error: ${msg}`);
           collectedTransitions,
           iterationTimeline: iterationTimeline.length > 0 ? iterationTimeline : void 0,
           truncated: true,
-          truncatedReason
+          truncatedReason,
+          truncatedTransient
         };
       } finally {
         if (inboxReader) {
@@ -324511,9 +325472,12 @@ var require_discover_feature_explorer = __commonJS({
   "../runner-core/dist/services/discover-feature-explorer.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
+    exports.buildFeatureExplorePrompt = buildFeatureExplorePrompt;
+    exports.buildIncrementalExplorePrompt = buildIncrementalExplorePrompt;
     exports.runFeatureExplorePhase = runFeatureExplorePhase;
     var discover_explorer_js_1 = require_discover_explorer();
     var exploration_parser_js_1 = require_exploration_parser();
+    var credential_tools_js_1 = require_credential_tools();
     var verification_inbox_js_1 = require_verification_inbox();
     var inbox_tools_js_1 = require_inbox_tools();
     function buildFeatureExplorerConfig(focusAreas, incremental, otherRoutes) {
@@ -324578,7 +325542,8 @@ var require_discover_feature_explorer = __commonJS({
       const browserCredentials = variableContext.allTestVariables ?? variableContext.publicTestVariables;
       const hasCredentials = Object.keys(browserCredentials).length > 0;
       const registerMode = !!((0, verification_inbox_js_1.loadVerificationInboxConfig)() && (0, inbox_tools_js_1.hasRegisterIntent)(variableContext));
-      const credentialLines = Object.entries(browserCredentials).map(([k, v]) => `- **${k}**: \`${v}\``).join("\n");
+      const emailVerificationUnavailable = !registerMode && (0, inbox_tools_js_1.hasRegisterIntent)(variableContext) && !(0, credential_tools_js_1.hasUsableLoginIdentity)(browserCredentials, { isPlaceholderIdentityValue: inbox_tools_js_1.isThrowawayRegisterSeedEmail });
+      const credentialLines = Object.entries(browserCredentials).filter(([k]) => k !== "DISCOVERY_SHOULD_REGISTER").map(([k, v]) => `- **${k}**: \`${v}\``).join("\n");
       const otherFeaturesBlock = featureOpts.otherFeatures && featureOpts.otherFeatures.length > 0 ? `
 ## Other Features (DO NOT TEST)
 These are separate features. Do NOT navigate to their pages, do NOT interact with them, do NOT call record_journey for them:
@@ -324689,6 +325654,22 @@ ${transitionBlock}
 ${(() => {
         const isAuthFeature = featureOpts.focusAreas.some((fa) => /\/(auth|login|sign-?in|register|signup)\b/i.test(fa));
         if (isAuthFeature && hasCredentials) {
+          if (emailVerificationUnavailable) {
+            return `## Login/Registration IS Your Test Assignment (email verification UNAVAILABLE)
+Your assigned pages ARE the login/registration pages. This project registers its own account, but this runner CANNOT receive email \u2014 registration may still work if the app does not require email verification.
+
+Follow this order:
+1. Navigate to your first assigned auth page (e.g., the login page)
+2. Take a \`browser_snapshot\` to see what's there
+3. **Test VALIDATION FIRST** while you are NOT logged in - on the LOGIN form: empty fields, invalid email, wrong password (synthetic values like "wrong@example.com" / "badpassword"); on the REGISTRATION form: empty-submit validation ONLY (a filled synthetic signup could create a stray account)
+4. Call \`record_journey\` for the validation flow
+5. **THEN attempt the happy path ONCE via REGISTRATION**: fill the signup form with \`fill_credential_form\` using the \`TEST_USER_EMAIL\` + \`TEST_USER_PASSWORD\` credential keys and submit it ONCE. Never alter the email, never create a second account. If signup says the address is ALREADY registered (a previous run created it), log in with the same credential keys instead
+6. **THE WALL**: if any step demands an emailed code/link (verification code, OTP, magic link, "check your email"), STOP immediately - never type a guessed code, never click Resend - and treat the happy path as BLOCKED
+7. If you are signed in with NO email round-trip, call \`record_journey\` for the happy path
+8. Call \`capture_page\` on each auth page AFTER interacting (this saves the successful commands for test generation)
+
+When done, call \`finish_exploration\` - if you hit the wall, note that the authenticated happy path is BLOCKED (cannot receive verification email).`;
+          }
           return `## Login/Registration IS Your Test Assignment
 Your assigned pages ARE the login/registration pages. Do NOT log in as a pass-through - the auth pages are what you are testing.
 
@@ -324743,7 +325724,7 @@ ${otherFeaturesBlock}
 4. Take \`browser_snapshot\` of the result page
    - If the page shows a loading skeleton or spinner after navigation, wait for the real content to appear before calling \`capture_page\` or \`record_journey\`
 5. Call \`record_journey\` with:
-   - All routes visited in \`routes\` array (e.g., ["/auth/login", "/dashboard"])
+   - All routes visited in \`routes\` array (e.g., ${emailVerificationUnavailable ? '["/", "/contact"]' : '["/auth/login", "/dashboard"]'})
    - Specific steps describing what you did
    - expectedOutcome with the EXACT result you observed
    - assertions with STABLE structural elements from the result page
@@ -324755,11 +325736,15 @@ ${otherFeaturesBlock}
 4. Fix the errors and resubmit successfully \u2192 observe recovery
 5. Call \`record_journey\` ONCE for this entire combined flow
 
-**Auth pages (login/register) - test NEGATIVE before positive:**
+${emailVerificationUnavailable ? `**Auth pages (login/register) - this runner CANNOT receive email:**
+- Test negative flows FIRST: on the LOGIN form empty fields \u2192 invalid synthetic values; on the REGISTRATION form empty-submit only (never submit a filled synthetic signup) \u2192 call record_journey for the validation flow
+- THEN attempt the happy path ONCE via registration with the \`TEST_USER_EMAIL\` + \`TEST_USER_PASSWORD\` credential keys (\`fill_credential_form\`); if the address is already registered, log in with the same keys
+- If any step demands an emailed code/link, STOP - never type a guessed code - and note in finish_exploration that the authenticated happy path is BLOCKED (cannot receive verification email)
+- If you are signed in without an email round-trip, call record_journey for the happy path` : `**Auth pages (login/register) - test NEGATIVE before positive:**
 - You arrive at the page NOT logged in - test errors FIRST while in this state
 - Empty fields \u2192 invalid data \u2192 call record_journey
 - THEN do the happy path - valid credentials \u2192 call record_journey
-- This order avoids needing to log out between journeys
+- This order avoids needing to log out between journeys`}
 
 ### For CRUD Features - Combine into a Single Journey:
 If the feature has Create/View/Edit/Delete operations across pages:
@@ -324784,7 +325769,7 @@ When you have thoroughly explored all the feature pages and tested the key flows
 - Pages you visited and what you found there
 
 ## Test Data Rules
-${registerMode ? `- **Account credentials**: do NOT invent an email or password \u2014 register and log in with the email returned by \`provision_identity\` and the \`TEST_USER_PASSWORD\` credential (filled via \`fill_credential\`). See the Account Registration section.` : `- **LOGIN** credential fields: use \`process.env.TEST_USER_EMAIL!\` and \`process.env.TEST_USER_PASSWORD!\`
+${registerMode ? `- **Account credentials**: do NOT invent an email or password \u2014 register and log in with the email returned by \`provision_identity\` and the \`TEST_USER_PASSWORD\` credential (filled via \`fill_credential\`). See the Account Registration section.` : emailVerificationUnavailable ? `- **Account credentials**: this project registers its own account but this runner CANNOT receive email. Register/log in ONLY with the \`TEST_USER_EMAIL\` + \`TEST_USER_PASSWORD\` credential keys (\`fill_credential\` / \`fill_credential_form\`) \u2014 never invent a different email, never create a second account. If a step demands an emailed verification code or link, STOP that flow (never guess a code) and mark it BLOCKED.` : `- **LOGIN** credential fields: use \`process.env.TEST_USER_EMAIL!\` and \`process.env.TEST_USER_PASSWORD!\`
 - **REGISTRATION/SIGNUP** email fields: MUST be unique every run \u2192 \`testuser-\${Date.now()}@example.com\`
 - Passwords for registration: \`TestPass123!\` (meets typical strength rules)`}
 - **Other form fields**: use realistic static values (Jane Smith, 555-0100, https://example.com)
@@ -324806,7 +325791,17 @@ When calling \`record_journey\`:
 
 **Example record_journey with good assertions:**
 \`\`\`
-record_journey({
+${emailVerificationUnavailable ? `record_journey({
+  name: "Login Form - Validation",
+  route: "/auth/login",
+  routes: ["/", "/auth/login"],
+  steps: ["Navigate to /", "Click 'Sign In'", "Submit the empty form", "Observe validation errors"],
+  expectedOutcome: "URL matches /auth/login. Validation error 'Email is required' is visible.",
+  assertions: [
+    { type: "url", value: "/auth/login" },
+    { type: "error-text", value: "Email is required" }
+  ]
+})` : `record_journey({
   name: "Login - Happy Path",
   route: "/auth/login",
   routes: ["/", "/auth/login", "/dashboard"],
@@ -324817,7 +325812,7 @@ record_journey({
     { type: "nav-link", locator: "getByRole('link', { name: 'Dashboard' })" },
     { type: "heading", locator: "getByRole('heading', { name: 'Dashboard' })" }
   ]
-})
+})`}
 \`\`\`
 BAD assertions (do NOT use): \`{ type: "heading", locator: "getByRole('heading', { name: 'Welcome back, John!' })" }\` - user-specific text
 
@@ -324853,13 +325848,16 @@ Do NOT re-propose a test with the same name or identical steps as any item above
 ${hasCredentials ? `
 ## Credentials (browser interaction ONLY - NEVER include in record_journey steps)
 ${credentialLines}
+` : ""}${emailVerificationUnavailable ? `
+${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}
 ` : ""}`;
     }
     function buildIncrementalExplorePrompt(baseUrl, variableContext, existingSiteMap, existingTestNames, featureOpts) {
       const browserCredentials = variableContext.allTestVariables ?? variableContext.publicTestVariables;
       const hasCredentials = Object.keys(browserCredentials).length > 0;
       const registerMode = !!((0, verification_inbox_js_1.loadVerificationInboxConfig)() && (0, inbox_tools_js_1.hasRegisterIntent)(variableContext));
-      const credentialLines = Object.entries(browserCredentials).map(([k, v]) => `- **${k}**: \`${v}\``).join("\n");
+      const emailVerificationUnavailable = !registerMode && (0, inbox_tools_js_1.hasRegisterIntent)(variableContext) && !(0, credential_tools_js_1.hasUsableLoginIdentity)(browserCredentials, { isPlaceholderIdentityValue: inbox_tools_js_1.isThrowawayRegisterSeedEmail });
+      const credentialLines = Object.entries(browserCredentials).filter(([k]) => k !== "DISCOVERY_SHOULD_REGISTER").map(([k, v]) => `- **${k}**: \`${v}\``).join("\n");
       const existingTestsBlock = featureOpts.existingTestDetails && featureOpts.existingTestDetails.length > 0 ? featureOpts.existingTestDetails.map((t, i) => {
         const stepsStr = t.steps.length > 0 ? `
    Steps: ${t.steps.join(" \u2192 ")}` : "";
@@ -324931,7 +325929,7 @@ ${featureOpts.appBrief}
 ${featureOpts.focusAreas.map((fa) => `- ${fa}`).join("\n")}
 ${pageElementsBlock}${otherFeaturesBlock}
 ## Process
-1. ${registerMode ? "Create your account by following the Account Registration section below, then navigate to the feature pages" : isAuthFeature && hasCredentials ? "Navigate to the auth pages - test validation/error scenarios NOT already covered" : hasCredentials ? "Log in using credentials below, then navigate to the feature pages" : "Navigate to the feature pages"}
+1. ${registerMode ? "Create your account by following the Account Registration section below, then navigate to the feature pages" : emailVerificationUnavailable ? "This runner CANNOT receive email. Attempt registration ONCE with the `TEST_USER_EMAIL` + `TEST_USER_PASSWORD` credential keys via `fill_credential_form` (if the address is already registered, log in with the same keys), then navigate to the feature pages. If any step demands an emailed code/link, STOP that flow \u2014 never type a guessed code \u2014 cover only unauthenticated gaps and note blocked authenticated scenarios in finish_exploration" : isAuthFeature && hasCredentials ? "Navigate to the auth pages - test validation/error scenarios NOT already covered" : hasCredentials ? "Log in using credentials below, then navigate to the feature pages" : "Navigate to the feature pages"}
 2. Take \`browser_snapshot\` on each page
 3. Compare what you see with the existing tests - what flows are NOT tested?
 4. For each gap you find, interact with the page to verify the flow works, then call \`record_journey\`
@@ -324955,11 +325953,14 @@ ${featureOpts.priorInsight}
 ${hasCredentials ? `
 ## Credentials (browser interaction ONLY)
 ${credentialLines}
+` : ""}${emailVerificationUnavailable ? `
+${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}
 ` : ""}`;
     }
     async function runFeatureExplorePhase(mcpClient, baseUrl, variableContext, existingSiteMap, projectId, existingTestNames, featureOpts) {
       const inboxConfig = (0, verification_inbox_js_1.loadVerificationInboxConfig)();
-      const registerMode = !!(inboxConfig && (0, inbox_tools_js_1.hasRegisterIntent)(variableContext));
+      const registerIntent = (0, inbox_tools_js_1.hasRegisterIntent)(variableContext);
+      const registerMode = !!(inboxConfig && registerIntent);
       let inboxPasswordKey = "TEST_USER_PASSWORD";
       if (registerMode && inboxConfig) {
         const inboxIdentity = (0, inbox_tools_js_1.createInboxRunState)(inboxConfig, { tagSeed: baseUrl, projectScope: projectId });
@@ -324970,6 +325971,9 @@ ${credentialLines}
           passwordKey: inboxPasswordKey
         });
       }
+      const emailVerificationUnavailable = registerIntent && !inboxConfig && !(0, credential_tools_js_1.hasUsableLoginIdentity)(variableContext.allTestVariables ?? variableContext.publicTestVariables, {
+        isPlaceholderIdentityValue: inbox_tools_js_1.isThrowawayRegisterSeedEmail
+      });
       const isIncremental = featureOpts.incremental && existingTestNames.length > 0;
       const systemPrompt = isIncremental ? buildIncrementalExplorePrompt(baseUrl, variableContext, existingSiteMap, existingTestNames, featureOpts) : buildFeatureExplorePrompt(baseUrl, variableContext, existingSiteMap, existingTestNames, featureOpts);
       const hasCredentials = Object.keys(variableContext.allTestVariables ?? variableContext.publicTestVariables).length > 0;
@@ -324980,6 +325984,8 @@ ${credentialLines}
         const focusHint = featureOpts.userNotes ? ` The user asked you to focus on: "${featureOpts.userNotes}".` : "";
         if (registerMode) {
           userMessage = `Navigate to ${baseUrl} and create your account:${registerHint}. Then review the ${existingTestNames.length} existing tests and navigate to: ${featureOpts.focusAreas.join(", ")}. Look for gaps - scenarios, pages, or error cases not yet covered.${focusHint} If all meaningful scenarios are covered, call finish_exploration with "No additional tests needed."`;
+        } else if (emailVerificationUnavailable) {
+          userMessage = `Navigate to ${baseUrl}. NOTE: this project registers its own account but this runner CANNOT receive email. Attempt registration ONCE with the TEST_USER_EMAIL + TEST_USER_PASSWORD credential keys via fill_credential_form (if the address is already registered, log in with the same keys; never alter the email or invent another). If any step demands an emailed code/link, STOP that flow \u2014 never type a guessed code. Review the ${existingTestNames.length} existing tests, then look for gaps reachable in your auth state on: ${featureOpts.focusAreas.join(", ")}.${focusHint} Note any email-wall-blocked scenarios as BLOCKED in finish_exploration.`;
         } else if (isAuthFeature) {
           userMessage = `Navigate to ${baseUrl}. Review the ${existingTestNames.length} existing tests listed above, then navigate to the auth pages: ${featureOpts.focusAreas.join(", ")}. Look for untested scenarios - error cases, edge cases, flows not yet covered.${focusHint} If all meaningful scenarios are covered, call finish_exploration with "No additional tests needed."`;
         } else if (hasCredentials) {
@@ -324991,6 +325997,8 @@ ${credentialLines}
         let navigationInstruction;
         if (registerMode) {
           navigationInstruction = `Navigate to ${baseUrl} and create your account:${registerHint}. Then go to your assigned feature pages: ${featureOpts.focusAreas.join(", ")}.`;
+        } else if (emailVerificationUnavailable) {
+          navigationInstruction = `Navigate to ${baseUrl}. NOTE: this project registers its own account but this runner CANNOT receive email. Attempt registration ONCE with the TEST_USER_EMAIL + TEST_USER_PASSWORD credential keys via fill_credential_form (if the address is already registered, log in with the same keys; never alter the email or create a second account). If you are signed in without an email round-trip, test your assigned feature pages fully: ${featureOpts.focusAreas.join(", ")}. If any step demands an emailed code/link, STOP that flow \u2014 never type a guessed code \u2014 test what is reachable without authentication instead and note blocked authenticated flows in finish_exploration.`;
         } else if (isAuthFeature) {
           navigationInstruction = `Navigate to ${baseUrl}. Your test assignment is the authentication pages: ${featureOpts.focusAreas.join(", ")}. Navigate to the login/register page and test it - start with validation (empty/wrong fields) while NOT logged in, then test the happy path.`;
         } else if (hasCredentials) {
@@ -325223,8 +326231,14 @@ var require_auth_capture_run = __commonJS({
     exports.filterLoginCaptureCredentials = filterLoginCaptureCredentials;
     exports.buildLoginCaptureCredentials = buildLoginCaptureCredentials;
     exports.getLoginCaptureMaxIterations = getLoginCaptureMaxIterations;
+    exports.getCaptureRateLimitMaxRetries = getCaptureRateLimitMaxRetries;
+    exports.getCaptureRateLimitMaxDelayMs = getCaptureRateLimitMaxDelayMs;
+    exports.getAuthCaptureTimeoutMs = getAuthCaptureTimeoutMs;
+    exports.getAuthCaptureRunRetryMaxAttempts = getAuthCaptureRunRetryMaxAttempts;
+    exports.classifyCaptureMiss = classifyCaptureMiss;
     exports.harvestAuthProofLive = harvestAuthProofLive;
     exports.findCredentialLiteralLeaks = findCredentialLiteralLeaks;
+    exports.runLoginCaptureRunWithOutcome = runLoginCaptureRunWithOutcome;
     exports.runLoginCaptureRun = runLoginCaptureRun;
     exports.getRegisterCaptureMaxIterations = getRegisterCaptureMaxIterations;
     exports.runRegisterCaptureRun = runRegisterCaptureRun;
@@ -325237,6 +326251,7 @@ var require_auth_capture_run = __commonJS({
     var playwright_native_js_1 = require_playwright_native();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var credential_tools_js_1 = require_credential_tools();
+    var ai_retry_js_1 = require_ai_retry();
     var LOGIN_CAPTURE_CONTROL_VARIABLES = /* @__PURE__ */ new Set([
       "BASE_URL",
       "DISCOVERY_SHOULD_REGISTER",
@@ -325270,6 +326285,36 @@ var require_auth_capture_run = __commonJS({
     }
     var CAPTURE_RATE_LIMIT_MAX_RETRIES = 2;
     var CAPTURE_RATE_LIMIT_MAX_DELAY_MS = 8e3;
+    function readNonNegativeIntEnv(env, name, fallback) {
+      const raw = env[name]?.trim();
+      if (raw === void 0 || raw === "" || !/^\d+$/.test(raw))
+        return fallback;
+      const parsed = Number(raw);
+      return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : fallback;
+    }
+    function getCaptureRateLimitMaxRetries(env = process.env) {
+      return readNonNegativeIntEnv(env, "AUTH_CAPTURE_RATE_LIMIT_MAX_RETRIES", CAPTURE_RATE_LIMIT_MAX_RETRIES);
+    }
+    function getCaptureRateLimitMaxDelayMs(env = process.env) {
+      return readPositiveIntEnv2(env, "AUTH_CAPTURE_RATE_LIMIT_MAX_DELAY_MS", CAPTURE_RATE_LIMIT_MAX_DELAY_MS);
+    }
+    var DEFAULT_AUTH_CAPTURE_TIMEOUT_MS = 4 * 60 * 1e3;
+    function getAuthCaptureTimeoutMs(env = process.env) {
+      return readPositiveIntEnv2(env, "AUTH_CAPTURE_TIMEOUT_MS", DEFAULT_AUTH_CAPTURE_TIMEOUT_MS);
+    }
+    var DEFAULT_AUTH_CAPTURE_RUN_RETRY_MAX_ATTEMPTS = 2;
+    function getAuthCaptureRunRetryMaxAttempts(env = process.env) {
+      return readPositiveIntEnv2(env, "AUTH_CAPTURE_RUN_RETRY_MAX_ATTEMPTS", DEFAULT_AUTH_CAPTURE_RUN_RETRY_MAX_ATTEMPTS);
+    }
+    function classifyCaptureMiss(explore, fallback) {
+      if (!explore.truncated)
+        return fallback;
+      if (explore.truncatedTransient)
+        return "rate_limited";
+      if (explore.truncatedReason === "timeout")
+        return "timeout";
+      return "error";
+    }
     function buildLoginCaptureSystemPrompt(baseUrl, availableKeys, maxIterations = getLoginCaptureMaxIterations()) {
       const keyLines = availableKeys.map((k) => `- \`${k}\``).join("\n");
       return `You are a login specialist. Your SINGLE objective: navigate to the app, log in with the provided test credentials, and confirm you are authenticated. Then stop.
@@ -325293,6 +326338,7 @@ ${keyLines || "- (none provided)"}
 ## Hard rules
 - Do NOT submit registration, password-reset, or any other forms. Login only.
 - Do NOT fill validation / negative values. Happy-path login only.
+- If login demands an emailed verification code, one-time password (OTP), or magic link, STOP \u2014 you have no inbox access and NEVER type a guessed code (any code you type is fabricated). Call \`capture_page\` on the verification wall noting it as the blocker, then \`finish_exploration\`.
 - Use RELATIVE routes in capture_page (e.g. \`/login\`, \`/dashboard\`), never absolute URLs.
 - If login fails after 2 attempts, call \`capture_page\` noting the failure and call \`finish_exploration\`.
 - You have a hard limit of ${maxIterations} iterations. Finish well before then.`;
@@ -325463,17 +326509,17 @@ ${keyLines || "- (none provided)"}
       }
       return false;
     }
-    async function runLoginCaptureRun(args) {
+    async function runLoginCaptureRunWithOutcome(args) {
       const { loginBrowser, baseUrl, projectId, model, onAudit, logs: logs2 } = args;
       const credentials = filterLoginCaptureCredentials(args.credentials);
       if ((0, agentic_cli_constants_js_1.getAgenticEngine)(model) !== "native") {
         logs2(`  auth-capture skipped: engine for ${model} is not native (V1 is native-engine-only)`);
-        return null;
+        return { recipe: null, outcome: "skipped" };
       }
       const { secrets } = (0, credential_tools_js_1.partitionTestVariables)(credentials);
       if (Object.keys(secrets).length === 0) {
         logs2("  auth-capture skipped: no secret credentials available to log in with");
-        return null;
+        return { recipe: null, outcome: "skipped" };
       }
       const auditRemap = onAudit ? (info) => {
         try {
@@ -325494,7 +326540,7 @@ ${keyLines || "- (none provided)"}
         const mcpClient = handle.mcpClient;
         if (!mcpClient) {
           logs2("  auth-capture aborted: instrumented context has no MCP client");
-          return null;
+          return { recipe: null, outcome: "skipped" };
         }
         const availableKeys = Object.keys(credentials);
         const maxIterations = getLoginCaptureMaxIterations();
@@ -325504,8 +326550,8 @@ ${keyLines || "- (none provided)"}
           enableRecordJourney: false,
           // login-only — no feature journeys to record
           maxIterationsOverride: maxIterations,
-          rateLimitMaxRetries: CAPTURE_RATE_LIMIT_MAX_RETRIES,
-          rateLimitMaxDelayMs: CAPTURE_RATE_LIMIT_MAX_DELAY_MS
+          rateLimitMaxRetries: getCaptureRateLimitMaxRetries(),
+          rateLimitMaxDelayMs: getCaptureRateLimitMaxDelayMs()
         };
         const exploreResult = await (0, discover_explorer_js_1.runExplorePhase)(mcpClient, baseUrl, {
           publicTestVariables: credentials,
@@ -325520,6 +326566,7 @@ ${keyLines || "- (none provided)"}
           onProgress: void 0
         }, loginConfig);
         logs2(`  auth-capture explore: ${exploreResult.pagesDiscovered} pages, ${exploreResult.collectedPages.length} captured`);
+        const exploreMiss = (fallback) => classifyCaptureMiss(exploreResult, fallback);
         const loginObservedOrigins = exploreResult.observedOrigins ?? [];
         try {
           args.onObservedOrigins?.(loginObservedOrigins);
@@ -325535,7 +326582,7 @@ ${keyLines || "- (none provided)"}
         const login = (0, discover_generator_js_1.getLoginCommands)(loginSiteMap.pages, credentials);
         if (!login) {
           logs2("  \u26A0 auth unverified (login run produced no derivable login sequence) \u2014 falling back to model-authored login");
-          return null;
+          return { recipe: null, outcome: exploreMiss("no_login") };
         }
         const scrubbedLogin = {
           ...login,
@@ -325545,19 +326592,19 @@ ${keyLines || "- (none provided)"}
         const authProof = harvestAuthProofLive(loginSiteMap, scrubbedLogin.redirectRoute, scrubbedLogin.route, credentials, logs2);
         if (!authProof) {
           logs2("  \u26A0 auth unverified (no durable signed-in proof on the authenticated page) \u2014 falling back to model-authored login");
-          return null;
+          return { recipe: null, outcome: exploreMiss("verify_failed") };
         }
         const candidate = { ...(0, auth_recipe_js_1.buildAuthRecipe)(scrubbedLogin, authProof, (/* @__PURE__ */ new Date()).toISOString()), appOrigin: loginRedirectAppOrigin };
         const rendered = (0, auth_recipe_js_1.renderAuthFn)(candidate);
         const leaks = findCredentialLiteralLeaks(rendered, credentials);
         if (leaks.length > 0) {
           logs2(`  \u26A0 auth recipe rejected: rendered __vqaLogin contains literal credential value(s) for ${leaks.join(", ")} \u2014 falling back to model-authored login`);
-          return null;
+          return { recipe: null, outcome: "credential_leak" };
         }
         const planLeaks = findCredentialLiteralLeaks(JSON.stringify(candidate.replayPlan ?? []), credentials);
         if (planLeaks.length > 0) {
           logs2(`  \u26A0 auth recipe rejected: structured replayPlan contains literal credential value(s) for ${planLeaks.join(", ")} \u2014 falling back to model-authored login`);
-          return null;
+          return { recipe: null, outcome: "credential_leak" };
         }
         try {
           await handle.close();
@@ -325567,14 +326614,14 @@ ${keyLines || "- (none provided)"}
         const ok = await verifyAuthRecipe(candidate, baseUrl, credentials, logs2);
         if (!ok) {
           logs2("  \u26A0 auth unverified (live-verify replay failed \u2014 fleet-config drift) \u2014 falling back to model-authored login");
-          return null;
+          return { recipe: null, outcome: exploreMiss("verify_failed") };
         }
         const proofDesc = authProof.kind === "role" ? `role:${authProof.role}${authProof.name ? `(${authProof.name})` : ""}` : authProof.kind === "testid" ? `testid:${authProof.testId}` : `url:${authProof.route}`;
         logs2(`  \u2713 auth recipe verified (hash ${candidate.recipeHash}, proof ${proofDesc}, ${(candidate.replayPlan ?? []).length} replay steps) \u2014 stamping into @needs-auth tests`);
-        return candidate;
+        return { recipe: candidate, outcome: "captured" };
       } catch (err) {
         logs2(`  \u26A0 auth-capture run failed: ${err instanceof Error ? err.message : String(err)} \u2014 falling back to model-authored login`);
-        return null;
+        return { recipe: null, outcome: (0, ai_retry_js_1.isTransientRateError)(err) ? "rate_limited" : "error" };
       } finally {
         if (handle) {
           try {
@@ -325584,6 +326631,9 @@ ${keyLines || "- (none provided)"}
         }
       }
     }
+    async function runLoginCaptureRun(args) {
+      return (await runLoginCaptureRunWithOutcome(args)).recipe;
+    }
     var DEFAULT_MAX_REGISTER_CAPTURE_ITERATIONS = 18;
     function getRegisterCaptureMaxIterations(env = process.env) {
       return readPositiveIntEnv2(env, "AUTH_CAPTURE_REGISTER_MAX_ITERATIONS", DEFAULT_MAX_REGISTER_CAPTURE_ITERATIONS);
@@ -325655,8 +326705,8 @@ ${keyLines || "- (none provided)"}
           userMessage: buildRegisterCaptureUserMessage(baseUrl),
           enableRecordJourney: false,
           maxIterationsOverride: maxIterations,
-          rateLimitMaxRetries: CAPTURE_RATE_LIMIT_MAX_RETRIES,
-          rateLimitMaxDelayMs: CAPTURE_RATE_LIMIT_MAX_DELAY_MS,
+          rateLimitMaxRetries: getCaptureRateLimitMaxRetries(),
+          rateLimitMaxDelayMs: getCaptureRateLimitMaxDelayMs(),
           // Register + poll the PROJECT-SCOPED address so it matches the one the
           // standalone authored tests log in with (see #922).
           inboxTagOverride: args.inboxTag
@@ -332388,6 +333438,8 @@ var require_discover_agent = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.runMobileDiscoveryOnRunner = exports.buildInMemorySiteMap = void 0;
     exports.runCanvasPreflight = runCanvasPreflight;
+    exports.runCaptureAttemptLoop = runCaptureAttemptLoop;
+    exports.isCaptureRunRetryEnabled = isCaptureRunRetryEnabled;
     exports.getFatalExploreError = getFatalExploreError;
     exports.runSiteDiscoveryOnRunner = runSiteDiscoveryOnRunner2;
     exports.runFeatureDiscoveryOnRunner = runFeatureDiscoveryOnRunner2;
@@ -332636,8 +333688,56 @@ Respond with ONLY valid JSON:
       }
       return merged;
     }
-    var AUTH_CAPTURE_TIMEOUT_MS = 4 * 60 * 1e3;
-    function maybeStartLoginCaptureRun(ctx, callbackOptions, onAICall, pushLog, onObservedOrigins) {
+    function computeCaptureRetryBackoffMs(attempt) {
+      const capped = Math.min(3e3 * Math.pow(2, attempt - 1), 15e3);
+      const jitter = 0.5 + Math.random() * 0.5;
+      return Math.round(capped * jitter);
+    }
+    async function runCaptureAttemptLoop(args) {
+      const { runCapture, maxAttempts, deadline, minRetryBudgetMs, now, sleep, backoffMs, log: log2, onAttempt } = args;
+      let attemptsMade = 0;
+      let lastOutcome = "error";
+      for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        if (now() >= deadline) {
+          lastOutcome = "timeout";
+          break;
+        }
+        attemptsMade = attempt;
+        onAttempt?.(attempt);
+        const { recipe, outcome } = await runCapture(attempt);
+        lastOutcome = outcome;
+        if (recipe)
+          return { recipe, outcome, attempts: attemptsMade };
+        if (attempt >= maxAttempts || outcome !== "rate_limited")
+          break;
+        const remaining = deadline - now();
+        if (remaining < minRetryBudgetMs) {
+          log2(`auth-prologue: transient rate-limit miss, but only ${Math.round(remaining / 1e3)}s of the capture wall remain \u2014 not retrying`);
+          break;
+        }
+        const backoff = Math.min(backoffMs(attempt), remaining - minRetryBudgetMs);
+        if (backoff > 0) {
+          log2(`auth-prologue: login-capture hit a transient rate limit (attempt ${attempt}/${maxAttempts}) \u2014 retrying in ${Math.round(backoff / 1e3)}s`);
+          await sleep(backoff);
+        }
+        if (deadline - now() < minRetryBudgetMs) {
+          log2("auth-prologue: capture wall nearly exhausted after backoff \u2014 not retrying");
+          break;
+        }
+      }
+      return { recipe: null, outcome: lastOutcome, attempts: attemptsMade };
+    }
+    function logAuthGenerationStats(logs2, tests, authRecipe) {
+      const needsAuth = tests.filter((t) => t.tags.includes("@needs-auth"));
+      if (needsAuth.length === 0)
+        return;
+      const recipeStamped = needsAuth.filter((t) => /VALIDATE_QA_AUTH/.test(t.playwrightCode ?? "")).length;
+      logs2.push(`[auth-capture] needsAuthTests=${needsAuth.length} recipeStamped=${recipeStamped} inlineLogin=${needsAuth.length - recipeStamped} recipeAvailable=${authRecipe ? "yes" : "no"}`);
+    }
+    function isCaptureRunRetryEnabled(env = process.env) {
+      return (0, shared_1.parseBoolFlag)(env.AUTH_CAPTURE_RUN_RETRY, true);
+    }
+    function maybeStartLoginCaptureRun(ctx, callbackOptions, onAICall, pushLog, onObservedOrigins, onOutcome) {
       if (!(0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && ctx.mode !== "capture")
         return null;
       if (ctx.authRecipe) {
@@ -332662,25 +333762,44 @@ Respond with ONLY valid JSON:
         return null;
       }
       const credentials = (0, auth_capture_run_js_1.buildLoginCaptureCredentials)(ctx.variableContext);
+      const runStart = Date.now();
+      const timeoutMs = (0, auth_capture_run_js_1.getAuthCaptureTimeoutMs)();
+      const deadline = runStart + timeoutMs;
+      const retryEnabled = isCaptureRunRetryEnabled();
+      const maxAttempts = retryEnabled ? (0, auth_capture_run_js_1.getAuthCaptureRunRetryMaxAttempts)() : 1;
+      const MIN_RETRY_BUDGET_MS = 45e3;
+      let attemptsMade = 0;
       const run2 = (async () => {
         let lease = null;
         try {
           lease = await acquire();
-          const recipe = await (0, auth_capture_run_js_1.runLoginCaptureRun)({
-            loginBrowser: lease.browser,
-            baseUrl: ctx.baseUrl,
-            credentials,
-            projectId: ctx.projectId,
-            model,
-            existingSiteMap: ctx.existingSiteMap,
-            onAudit: onAICall,
-            onObservedOrigins,
-            logs: pushLog
+          const leased = lease;
+          return await runCaptureAttemptLoop({
+            maxAttempts,
+            deadline,
+            minRetryBudgetMs: MIN_RETRY_BUDGET_MS,
+            now: Date.now,
+            sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+            backoffMs: computeCaptureRetryBackoffMs,
+            log: pushLog,
+            onAttempt: (n) => {
+              attemptsMade = n;
+            },
+            runCapture: () => (0, auth_capture_run_js_1.runLoginCaptureRunWithOutcome)({
+              loginBrowser: leased.browser,
+              baseUrl: ctx.baseUrl,
+              credentials,
+              projectId: ctx.projectId,
+              model,
+              existingSiteMap: ctx.existingSiteMap,
+              onAudit: onAICall,
+              onObservedOrigins,
+              logs: pushLog
+            })
           });
-          return recipe;
         } catch (err) {
           pushLog(`auth-prologue: login-capture run threw (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
-          return null;
+          return { recipe: null, outcome: "error", attempts: attemptsMade };
         } finally {
           if (lease) {
             try {
@@ -332693,16 +333812,19 @@ Respond with ONLY valid JSON:
       let timer;
       const timeout = new Promise((resolve2) => {
         timer = setTimeout(() => {
-          pushLog(`auth-prologue: login-capture run exceeded ${AUTH_CAPTURE_TIMEOUT_MS / 1e3}s \u2014 proceeding without a recipe`);
-          resolve2(null);
-        }, AUTH_CAPTURE_TIMEOUT_MS);
+          pushLog(`auth-prologue: login-capture run exceeded ${Math.round(timeoutMs / 1e3)}s \u2014 proceeding without a recipe`);
+          resolve2({ recipe: null, outcome: "timeout", attempts: attemptsMade });
+        }, Math.max(0, deadline - Date.now()));
         timer.unref?.();
       });
-      const timed = Promise.race([run2, timeout]).finally(() => {
+      return Promise.race([run2, timeout]).finally(() => {
         if (timer)
           clearTimeout(timer);
-      });
-      return timed.catch(() => null);
+      }).then((res) => {
+        pushLog(`[auth-capture] outcome=${res.outcome} attempts=${res.attempts} durationMs=${Date.now() - runStart} mode=${ctx.mode ?? "discovery"}`);
+        onOutcome?.(res.outcome);
+        return res.recipe;
+      }).catch(() => null);
     }
     function getFatalExploreError(exploreResult) {
       const prefix = "Fatal error:";
@@ -332717,12 +333839,15 @@ Respond with ONLY valid JSON:
         logs2.push(`Base URL: ${ctx.baseUrl}`);
         onLog?.("starting", logs2.join("\n"));
         const loginObservedOrigins = [];
+        let captureOutcome;
         const loginRun = maybeStartLoginCaptureRun(ctx, callbackOptions, onAICall, (line) => {
           logs2.push(line);
           onLog?.("progress", logs2.join("\n"));
         }, (origins) => {
           for (const origin of origins)
             loginObservedOrigins.push(origin);
+        }, (outcome) => {
+          captureOutcome = outcome;
         });
         const authRecipe = loginRun ? await loginRun : null;
         const duration = (Date.now() - startTime) / 1e3;
@@ -332747,7 +333872,7 @@ Respond with ONLY valid JSON:
           },
           duration,
           mode: "capture",
-          ...authRecipe ? {} : { error: "Login capture did not produce a verified recipe" }
+          ...authRecipe ? {} : { error: `Login capture did not produce a verified recipe${captureOutcome ? ` (${captureOutcome})` : ""}` }
         };
       }
       const mode = ctx.mode;
@@ -332927,14 +334052,18 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
         const updatedSiteMap = (0, sitemap_builder_js_1.buildInMemorySiteMap)(ctx.projectId, ctx.baseUrl, exploreResult.collectedPages, exploreResult.collectedTransitions, ctx.existingSiteMap);
         if (updatedSiteMap.pages.length === 0) {
           logs2.push("No site map data available - skipping plan and generate phases");
-          if (loginRunP)
-            await loginRunP;
+          const earlyAuthRecipe = loginRunP ? await loginRunP : null;
           const duration2 = (Date.now() - startTime) / 1e3;
           const fatalExploreError = getFatalExploreError(exploreResult);
           return {
             collectedPages: exploreResult.collectedPages,
             collectedTransitions: exploreResult.collectedTransitions,
             tests: [],
+            // Persist only a FRESHLY-captured recipe — never re-persist a reused cached one
+            // (ctx.authRecipe set) or a late warm run could overwrite/re-verify a newer recipe.
+            authRecipe: ctx.authRecipe ? void 0 : earlyAuthRecipe,
+            observedOrigins: mergeObservedOrigins(exploreResult.observedOrigins, loginObservedOrigins),
+            resolvedAppOrigin: earlyAuthRecipe?.appOrigin ?? void 0,
             healthObservations: healthObserver?.getSummary(),
             logs: logs2.join("\n"),
             screenshots,
@@ -333022,12 +334151,6 @@ Plan: ${planResult.scenarios.length} scenarios, ${planResult.featureGroups.lengt
             logs2.push(surveyHealth.totalIssues > 0 ? `
 Health: ${surveyHealth.totalIssues} issue(s) - ${surveyHealth.consoleErrors.length} console errors, ${surveyHealth.failedRequests.length} failed requests` : "\nHealth observer: no issues detected");
           }
-          const duration2 = (Date.now() - startTime) / 1e3;
-          const featureCount = featureGroups?.length || finalPlan.testSuites.length;
-          const summary2 = `Survey complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elementsFound} elements, ${featureCount} features identified in ${duration2.toFixed(1)}s`;
-          logs2.push(`
-=== Survey Complete (${duration2.toFixed(1)}s) ===`);
-          logs2.push(summary2);
           let mergedWarning = planResult.warning;
           if (exploreResult.truncated) {
             const reasonLabel = exploreResult.truncatedReason === "rate_limit" ? "AI rate-limit" : exploreResult.truncatedReason === "timeout" ? "AI timeout" : "AI error";
@@ -333048,6 +334171,12 @@ Health: ${surveyHealth.totalIssues} issue(s) - ${surveyHealth.consoleErrors.leng
           if (surveyAuthRecipe) {
             logs2.push(`Auth-prologue: captured + verified login recipe ${surveyAuthRecipe.recipeHash} during survey \u2014 persisting for reuse on later runs`);
           }
+          const duration2 = (Date.now() - startTime) / 1e3;
+          const featureCount = featureGroups?.length || finalPlan.testSuites.length;
+          const summary2 = `Survey complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elementsFound} elements, ${featureCount} features identified in ${duration2.toFixed(1)}s`;
+          logs2.push(`
+=== Survey Complete (${duration2.toFixed(1)}s) ===`);
+          logs2.push(summary2);
           const plannerFailedError = planResult.plannerFailed ? `Survey planning failed (${planResult.plannerFailureKind ?? "unknown"}): ${planResult.fallbackReason ?? "planner did not produce a usable plan"}. Explore evidence was saved; re-run the survey to retry planning.` : void 0;
           return {
             observedOrigins: mergeObservedOrigins(exploreResult.observedOrigins, loginObservedOrigins),
@@ -333110,6 +334239,7 @@ Generation complete: ${generateResult.tests.length} tests generated (${generateE
           const tags = t.tags.join(", ");
           logs2.push(`  ${i + 1}. ${t.name} [${tags}]${t.verified ? " \u2713live" : ""}`);
         });
+        logAuthGenerationStats(logs2, generateResult.tests, authRecipe);
         onLog?.("generate", logs2.join("\n"));
         const postGenClose = await handle.close();
         handle = null;
@@ -333479,8 +334609,7 @@ Feature explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResul
         }
         if (!isPlanReuseResume && updatedSiteMap.pages.length === 0) {
           logs2.push("No site map data - skipping plan and generate phases");
-          if (loginRunP)
-            await loginRunP;
+          const earlyAuthRecipe = loginRunP ? await loginRunP : null;
           const earlyClose = await handle.close();
           handle = null;
           discoveryApiCalls = earlyClose.apiCalls;
@@ -333491,6 +334620,11 @@ Feature explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResul
             collectedPages: exploreResult.collectedPages,
             collectedTransitions: exploreResult.collectedTransitions,
             tests: [],
+            // Persist only a FRESHLY-captured recipe — never re-persist a reused cached one
+            // (ctx.authRecipe set) or a late warm run could overwrite/re-verify a newer recipe.
+            authRecipe: ctx.authRecipe ? void 0 : earlyAuthRecipe,
+            observedOrigins: mergeObservedOrigins(exploreResult.observedOrigins, loginObservedOrigins),
+            resolvedAppOrigin: earlyAuthRecipe?.appOrigin ?? void 0,
             logs: logs2.join("\n"),
             screenshots,
             apiCalls: discoveryApiCalls.length > 0 ? discoveryApiCalls : void 0,
@@ -333631,6 +334765,7 @@ Generation complete: ${generateResult.tests.length} tests (${generateElapsed}s e
           const tags = t.tags.join(", ");
           logs2.push(`  ${i + 1}. ${t.name} [${tags}]${t.verified ? " \u2713live" : ""}`);
         });
+        logAuthGenerationStats(logs2, generateResult.tests, authRecipe);
         onLog?.("generate", logs2.join("\n"));
         const postGenClose = await handle.close();
         handle = null;
@@ -346391,7 +347526,6 @@ var require_repo_analysis_runner = __commonJS({
       const softTestTarget = intEnv("REPO_ANALYSIS_SOFT_TEST_TARGET", 20, 1, 50);
       const maxEndpointsPerFeature = intEnv("REPO_ANALYSIS_MAX_ENDPOINTS_PER_FEATURE", 80, 1, 400);
       const maxFacts = intEnv("REPO_ANALYSIS_MAX_FACTS", 40, 1, 120);
-      const engine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
       const provider = "anthropic";
       const model = agentic_cli_constants_js_1.CLAUDE_CODE_DEFAULT_MODEL;
       log2(`=== Repo Analysis Runner (Claude CLI, no browser${isMobileAnalysis ? ", mobile\u2192Appium" : ", web\u2192Playwright"}) ===`);
@@ -348095,7 +349229,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.52",
+      version: "1.0.54",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"