agent-led-growth 0.8.2 → 0.8.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-led-growth",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Score: evals for agents as customers. Runs a real agent through signup, key and first call on your product, before you ship. Track, the analytics half, measures which agents convert after.",
   "author": {
     "name": "Kat Laszlo",

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.8.4 (2026-10-24)
+
+Quotes you can check. 0.8.3 printed each requirement with the text it came from, but the text was cut from the page as flat words, so on resend.com Pay quoted "scale as you grow. Are you an AI agent? See pricing Add-ons if you send from a": a subtitle, a link and a heading run together.
+
+- Rule: a quote is one or two whole sentences from one element of the page (a paragraph, a list item, a table cell), cut only at sentence ends, and it holds the words that triggered the rule. When those words sit in an element that is not a sentence, the quote is that element with a label: `Heading: "Domains - $20 / mo" (/pricing)`, `Table cell: "/v1/x402/search"`, `List item: "Identity provider: AgentID OpenID Connect"`, `OpenAPI path: "/v1/x402/numbers/buy"`, `pricing.json: "Pro: 20 USD per month"`. Words that run across two elements are never a quote, and the rule tries its next match instead. Quotes are printed whole; the 160-character cut with "..." is gone.
+- The rules read the same sentence they quote, so a guard never decides on words from a neighbouring element.
+- Pay quotes a paid price, from the pricing page before the homepage: firecrawl.dev's quote was its "$75M Series B" announcement and is now "Standard: $83/month" from /pricing. A price that can only be read out of a script's data and never appears in a sentence or table no longer makes Pay "needs a person"; it says the prices could not be quoted and a test decides. No recorded product changed state from this.
+- Inbox: an emailed code or link counts only when the sentence is about the product's own signup: it names the product's signup or verify call, names the product ("Sign up for Acme", "Acme emails"), says "we send" or "our signup", sits on the product's agent-signup or auth page, or sits in a signup section of a page (a "Sign up" or "Quick start" heading, or right after the product's signup call). A narrative about agents in general ("An agent signs up with its owner's email, reads the verification code out of the owner's inbox") does not count, except on the product's own signup page. www.agentid.com no longer needs an inbox; telnyx.com, inkbox.ai, agentmail.to, aisend.app, www.cosmicjs.com and agentline.cloud still do, each quoting its own signup sentence.
+- CLI signup: a bare `init` no longer counts as signing up; it needs `--agent`, `--temporary` or a signup subcommand. AgentID's `npx @agentmail/agentid-cli init` registers a developer's app and read as AgentID's signup needing a shell. Cloudflare's CLI quote is now its `wrangler deploy --temporary` sentence instead of `wrangler init my-worker`.
+- Signup: www.agentid.com read as "Try first, claim later" from three things that say nothing about its own signup: a blog link ("[can an AI agent sign up for a SaaS](/blog/can-an-ai-agent-sign-up-for-a-saas)", also in its sitemap), "owner claim", which on AgentID is an OpenID Connect field in a token, and the question "How can you tell an agent signup from a human one?". Now a match inside link text or a URL slug, a sitemap entry, or a question does not count as an agent signup, and the claim rule needs a person doing it ("the owner claims the workspace"). HTML written inline in a text file is split at its tags like an HTML page, so a quote never shows raw `<td className=...>`.
+- Signup elsewhere: when the product's agent-facing pages send the agent to sign up on another company's site (AgentID's llms.txt: "Create an AgentMail inbox to get an AgentID", linking console.agentmail.to/sign-up), Sign up and Access say so and need a test run, instead of saying a person has to create the account. AgentID's Sign up and Access moved from "agent can" to "needs a test run"; no other recorded product changed state. JSON: `onboarding.signupElsewhere`.
+- JSON: quotes can carry `label` (`steps[].quotes[]`, `needsEvidence`, pattern `evidence`); `observedPrices[]` can carry `paidQuote`. Nothing is removed.
+- Tests: resend.com is recorded in fixtures/onboarding. Over every recorded product, each quote is a whole sentence ending in terminal punctuation or a labelled element, sits inside one block of its page, starts a sentence and holds its trigger. The inbox products above are pinned with their exact sentences, and AgentID, firecrawl.dev, mem0.ai, moltbook.com, neon.com, paywithlocus.com, Track and Resend with none.
+
+## 0.8.3 (2026-10-24)
+
+False findings fixed. `check` read Track (alg.katrinalaszlo.com), which is free and takes no email, as charging per request, needing an inbox and having a plan to change.
+
+- Rule: a step that says the product needs or requires something (an inbox, a payment, a person at checkout, a shell for its CLI) is reported only with the sentence it came from, and that sentence is printed under the step with its page. A need with no quote is not reported. A negated sentence ("takes no email", "cannot sign in to the dashboard", "nothing is deleted"), an example ("such as opening a verification email"), a line of a link index, an optional step and text about the reader's own customers never count.
+- Pay reads machine-readable pricing first. When every plan in /pricing.json costs 0 and no purchase is documented, Pay is `not_applicable`: "Nothing to buy: every plan is free (pricing.json)." Before, x402 named in Track's docs (as a task Score tests) made Pay "The docs mention paying per request", and a demo's "$49.00" on its homepage would have read as a paid plan. "per request" counts as a usage price only beside a price word ("priced per request", "$0.01 per request"); "4 KB per request" is a limit.
+- Manage is `not_applicable` when pricing.json lists exactly one plan and it is free: "One free plan: no plan or limit to change." Otherwise unchanged.
+- Inbox: an emailed code or link counts only in a sentence about the product's own signup or sign-in, and an explicit negative on the product's pages ("takes no email", "needs no inbox", "no account, email or browser") clears it. `test --check` warns about a missing inbox only with that sentence, which it quotes; an `interface.json` from before 0.8.3 carries none, so it no longer warns from one.
+- Other rules audited for the same failure (text that mentions a thing read as the product requiring it), each with a test: expiry ignores "nothing is deleted" and "never expire"; restricted access, a person setting access up, and x402 ignore a negation in the same clause; x402 is ignored when pricing.json lists only free plans; a CLI signup needs the flag or subcommand within four words of the command, so "npx agent-led-growth check <url> runs a real agent through signup" is not one.
+- The step count skips steps that do not apply: "Your public pages document 5 of 5 applicable steps; Pay and Manage don't apply." A not-applicable step is marked `-` and tagged "from your files".
+- After a passing `test`, `check` no longer ends with "Step 3 of 3: test". Next says what is left ("Your latest test passed. Nothing left to fix or test. Pay and Manage don't apply.") and how to keep it passing in CI, and the What next? menu is not offered.
+- JSON, backward compatible (`agent-ready/audit-report@1` keeps its name): `steps[].state` can be `not_applicable`; steps can carry `quotes: [{ for, obs, quote, url }]`; the report adds `applicable`, the number of steps that apply. `documented`, `verified` and `of` (7) are unchanged; the headline text changes only when a step does not apply. In `interface.json`, onboarding patterns add `needsEvidence`.
+- Tests: Track's live pages are recorded in fixtures/onboarding/alg.katrinalaszlo.com.json.gz and its whole check result is asserted, with contrasting products (paid per request over x402, a price per request in prose, an email-gated signup) where each rule must still fire, and a test over every recorded product that each stated requirement carries a quote. Re-checked against the recorded products, the inbox need is no longer reported for firecrawl.dev ("for example OTP flows"), mem0.ai ("no email, no dashboard, no OTP required"), moltbook.com (a verification code for a math challenge), neon.com (a link to its Email OTP feature) and paywithlocus.com ("an optional AgentMail OTP"); it is kept for telnyx.com, inkbox.ai, agentmail.to, aisend.app, www.cosmicjs.com and agentline.cloud.
+
 ## 0.8.2 (2026-10-24)
 
 - `alg connect`: Track's /connect page no longer fills in the code, so the CLI now asks you to type the code it prints on that page, check where the page says the request came from, then approve. The code is printed on its own line. The CLI opens the `verification_url` Track returns as it is and does not expect the code in it.

package/README.md

@@ -53,6 +53,8 @@ $ npx agent-led-growth check resend.com
 
 Six seconds. No account, no Docker, nothing sent to your product but GET requests. Needs Node 20.9 or later.
 
+When a step says your product needs or requires something (an inbox, a payment, a person at checkout), the sentence it came from is printed under the step with the page it is on. A sentence that says the opposite ("takes no email"), an example ("such as a verification email") or text about your own customers never counts. A step that does not apply is marked `-`: Pay when every plan in /pricing.json is free, Manage when there is one free plan.
+
 Then fix and test:
 
 ```bash

package/bin/cli.js

@@ -25,7 +25,7 @@ import { runHarness, TASKS } from "../src/harness/index.js";
 import { inspect, buildAudit, writeAudit, parseTarget, unreachableReason, DEFAULT_TASK } from "../src/audit/index.js";
 import { defaultAnswers, askQuestions, QUESTIONS } from "../src/audit/questions.js";
 import { readConfig, writeConfig, writeVerifyCall, configHost, CONFIG_FILE } from "../src/audit/config.js";
-import { makeStyle, renderAnswer, renderVerdict, renderSteps, renderSummary, renderNext, renderStandardsStart, renderStandards, renderStrip } from "../src/audit/render.js";
+import { makeStyle, renderAnswer, renderVerdict, renderSteps, renderSummary, renderNext, renderStandardsStart, renderStandards, renderStrip, latestTestOutcome } from "../src/audit/render.js";
 import { localJourney, localTestRuns } from "../src/verify/journey.js";
 import { applyEvidence } from "../src/interface/evidence.js";
 import { runStandards } from "../src/audit/standards.js";
@@ -184,7 +184,9 @@ Examples:
     if (!opts.json) for (const line of renderSummary(audit, paths, style, rel, savedTo)) say(line);
     // Skipped, the benchmarks get one line above Next, so Next stays the last thing on screen.
     if (!opts.json && !opts.standards) for (const line of renderStandards(null, style)) say(line);
-    if (!opts.json) for (const line of renderNext(audit, paths, style, rel)) say(line);
+    const latestTest = latestTestOutcome(funnel);
+    const testPassed = latestTest === "passed" || latestTest === "handoff";
+    if (!opts.json) for (const line of renderNext(audit, paths, style, rel, latestTest)) say(line);
 
     let standardsFile = null;
     if (opts.standards) {
@@ -216,7 +218,7 @@ Examples:
       if (!opts.json) for (const line of renderStandards(standards, style, raw ? rel(raw) : null)) say(line);
       // The last line on screen is the next action, not the benchmark table.
       if (!opts.json) {
-        const next = audit.findings.length ? " Next: the fix prompt above, then check again." : ` Next: ${style.bold(`${TEST_CMD} ${host} --check`)}`;
+        const next = audit.findings.length ? " Next: the fix prompt above, then check again." : testPassed ? " Your latest test passed; Next is above." : ` Next: ${style.bold(`${TEST_CMD} ${host} --check`)}`;
         say(`  Done in ${duration(Date.now() - started)}.${next}`);
         say("");
       }
@@ -227,7 +229,7 @@ Examples:
     if (opts.failOn && audit.findings.some((f) => FAIL_ON[opts.failOn].includes(f.severity))) process.exitCode = 1;
     // With nothing to fix, the next step is a test, and a person at a terminal can start it here.
     const canAsk = Boolean(process.stdin.isTTY && process.stderr.isTTY) && !opts.yes && !opts.json;
-    if (canAsk && !audit.findings.length) await offerTest({ audit, style, say });
+    if (canAsk && !audit.findings.length && !testPassed) await offerTest({ audit, style, say });
   });
 
 // check reads public pages; test has a real agent do the steps. With nothing to fix, a person at a terminal can
@@ -402,7 +404,11 @@ Examples:
       // The onboarding pattern chosen in alg.yml, as the last check's interface.json describes it.
       const onboarding = latestInterface(process.cwd(), url)?.doc.onboarding;
       const chosen = onboarding?.patterns?.find((p) => p.id === (config.onboarding || onboarding.primary));
-      if (chosen?.needs?.includes("inbox") && !process.env.AGENTMAIL_API_KEY && !opts.inbox) plan.warnings = ["The product's docs mention an emailed code or link and no inbox is set. Set AGENTMAIL_API_KEY or pass --inbox, or the run may end inconclusive."];
+      // Only with the sentence it came from: a need without a quote is not reported (interface.json from before 0.8.3
+      // has none).
+      const inboxEvidence = chosen?.needs?.includes("inbox") ? chosen.needsEvidence?.inbox?.[0] : null;
+      const inboxQuote = inboxEvidence?.quote ? `${inboxEvidence.label ? `${inboxEvidence.label}: ` : ""}"${inboxEvidence.quote}"` : null;
+      if (inboxQuote && !process.env.AGENTMAIL_API_KEY && !opts.inbox) plan.warnings = [`The product's signup sends an emailed code or link (${inboxQuote}) and no inbox is set. Set AGENTMAIL_API_KEY or pass --inbox, or the run may end inconclusive.`];
       if (opts.json) process.stdout.write(JSON.stringify(plan, null, 2) + "\n");
       else for (const line of renderPlan(plan, style)) console.error(line);
       process.exit(plan.ready ? 0 : 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-led-growth",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "Score: evals for agents as customers. Runs a real agent through signup, key and first call on your product, before you ship. Track, the analytics half, measures which agents convert after.",
   "type": "module",
   "bin": {

package/skills/alg/SKILL.md

@@ -41,7 +41,7 @@ The fix prompts build toward the chosen model. Say which answers you used and th
 
 1. Lead with `headline` ("Your public pages document N of 7 steps. No step has been tested yet: a test runs a real agent."). `documented` and `verified` hold the two counts; a check never verifies, so `verified` is 0.
 2. List each finding: its step, its title and its reason.
-3. Never call a step verified or confirmed: a check only reads pages. Say how each step was found (`basis`): `observed` comes from a structured file or an HTTP status, `heuristic` from matching page text (it can be wrong), and `not_checked` means public pages cannot show it. Only a test with a real agent shows a step works. `state`: `agent_can`/`agent_did` pass, `handoff` passes with one person step, `needs_person`/`blocked` are gaps, `not_checked` needs a test.
+3. Never call a step verified or confirmed: a check only reads pages. Say how each step was found (`basis`): `observed` comes from a structured file or an HTTP status, `heuristic` from matching page text (it can be wrong), and `not_checked` means public pages cannot show it. Only a test with a real agent shows a step works. `state`: `agent_can`/`agent_did` pass, `handoff` passes with one person step, `needs_person`/`blocked` are gaps, `not_checked` needs a test, `not_applicable` has nothing to do (Pay with only free plans in pricing.json, Manage with one free plan). A step that says the product needs or requires something carries `quotes`, the sentences it came from; quote them rather than restating the claim.
 4. After the findings, summarize `standards` in a few lines: each benchmark's passed/total and score, then the failed check names the developer asks about. Say they are third-party benchmarks and separate from the seven steps. If `standards.error` is set, tell the developer aeo-ready did not run and quote it.
 5. Give the paths in `files`: `files.prompts` (one fix prompt per finding), `files.brief` (a one-page brief for security, legal and billing), `files.config` and `files.standards` (aeo-ready's full output).
 6. Then tell the developer the next step is a test, and offer the free plan: `npx agent-led-growth test <url> --check --json`. Do not run `test` itself; see 'If the developer asks for a test'.

package/src/audit/index.js

@@ -15,6 +15,7 @@ export const DEFAULT_TASK = "Sign up, get an API key, and make one authenticated
 // reads Agent did.
 export function basisFor(step, doc) {
   if (step.live) return "tested";
+  if (step.state === "not_applicable") return "observed";
   if (step.state === "not_checked") return "not_checked";
   if (step.id === "discover") return "observed";
   if (step.id === "understand") return doc.pricing?.agentCanDetermineCost?.verdict === "yes" ? "observed" : "heuristic";
@@ -85,7 +86,11 @@ export function patternInfo(id) {
 // Everything the audit reports, from the inspection and the answers. Pure, so it is tested without a network.
 export function buildAudit({ doc, funnel, answers, task, runId, version }) {
   const pattern = patternInfo(answers.onboarding.value);
-  const steps = funnel.steps.map((s) => ({ id: s.id, name: s.name, state: s.state, basis: basisFor(s, doc), reason: s.reason, basedOn: s.basedOn, ...(s.fix ? { fix: s.fix } : {}) }));
+  // quotes: the sentences behind a claim that the product requires something, with the page each is on. A step a test
+  // decided says what the test did instead, so it carries none.
+  const urlOf = (obs) => doc.observations.find((o) => o.id === obs)?.url || null;
+  const quotesOf = (s) => (!s.live && s.quotes?.length ? { quotes: s.quotes.map((q) => ({ ...q, url: urlOf(q.obs) })) } : {});
+  const steps = funnel.steps.map((s) => ({ id: s.id, name: s.name, state: s.state, basis: basisFor(s, doc), reason: s.reason, basedOn: s.basedOn, ...quotesOf(s), ...(s.fix ? { fix: s.fix } : {}) }));
   // The chosen model is the target. A product whose docs only describe a person handing over a key passes Sign up
   // as a handoff, but if the owner chose an agent-first model, that handoff is the gap to close. Agent identity
   // counts: the agent is meant to sign in as itself (for example with AgentID), not take a key from a person.
@@ -108,6 +113,7 @@ export function buildAudit({ doc, funnel, answers, task, runId, version }) {
     headline: funnel.headline,
     documented: funnel.documented,
     verified: funnel.verified,
+    applicable: funnel.applicable ?? funnel.steps.filter((s) => s.state !== "not_applicable").length,
     pagesRead: doc.observations.filter((o) => o.ok).length,
     steps,
     onboarding: {
@@ -151,7 +157,7 @@ export function renderBrief(audit, doc) {
     lines.push(`Conflict: a verified person must exist before any use, but ${audit.onboarding.chosen.name} lets an agent act first. Consider "A person sets up access first".`, "");
   }
   lines.push("## Steps", "", "| Step | State | How we know | Evidence |", "| --- | --- | --- | --- |");
-  for (const s of audit.steps) lines.push(`| ${s.name} | ${s.state.replace("_", " ")} | ${s.basis.replace("_", " ")} | ${evidence(s.basedOn).join(", ") || "none"} |`);
+  for (const s of audit.steps) lines.push(`| ${s.name} | ${s.state.replace("_", " ")} | ${s.basis.replace("_", " ")} | ${evidence(s.basedOn).join(", ") || "none"}${(s.quotes || []).map((q) => `<br>${q.label ? `${q.label}: ` : ""}"${q.quote.replace(/\|/g, "\\|")}"`).join("")} |`);
   lines.push("", "## Fixes", "");
   if (!audit.findings.length) lines.push("None from public pages. A test with a real agent is the next step: `npx agent-led-growth test --check` shows the plan for free, `npx agent-led-growth test` runs it.");
   for (const f of audit.findings) lines.push(`${f.n}. **${f.title}** (${f.severity}, ${f.name}). Prompt: prompts/${f.file}`);

package/src/audit/render.js

@@ -9,6 +9,15 @@ export function makeStyle(enabled) {
 import { PASSING, mark, label } from "../dashboard/strip.js";
 const TAG = { observed: "from your files", heuristic: "from page text", not_checked: "needs a test run", tested: "from your test" };
 
+// The page a quote is on, as a path: "/docs.md".
+const pathOf = (url) => {
+  try {
+    return new URL(url).pathname;
+  } catch {
+    return url || "";
+  }
+};
+
 
 // Breaks text into lines of at most `width` characters, at spaces. A word longer than a line (a long URL) is split.
 export function wrap(text, width) {
@@ -26,6 +35,14 @@ export function wrap(text, width) {
 }
 
 const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+const listNames = (names) => (names.length < 2 ? names.join("") : `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`);
+
+// The outcome of the newest test of this product on this machine, from the funnel's evidence, or null.
+export function latestTestOutcome(funnel) {
+  const tests = (funnel?.steps || []).flatMap((s) => (s.evidence || []).filter((e) => e.kind === "test"));
+  tests.sort((a, b) => (b.at > a.at ? 1 : b.at < a.at ? -1 : 0));
+  return tests[0]?.outcome || null;
+}
 
 // The answer to "can an agent do it?", before the tally: which steps the pages leave an agent without.
 const DOES = { discover: "finds you", understand: "understands what you sell", signup: "signs up", access: "gets a key", use: "uses the product", pay: "pays", manage: "changes a plan" };
@@ -59,6 +76,11 @@ export function renderSteps(audit, style) {
     const [first = "", ...rest] = wrap(s.reason, REASON);
     out.push(`  ${mark(s.state, style)} ${s.name.padEnd(NAME)}  ${first.padEnd(REASON)}  ${style.dim(TAG[s.basis] || s.basis)}`);
     for (const line of rest) out.push(`  ${" ".repeat(NAME + 4)}${line}`);
+    // A claim that the product requires something is shown with the sentence it came from, so a reader can check it.
+    // The quote is whole (src/interface/quote.js), never cut here; an element that is not a sentence carries its label.
+    for (const q of s.quotes || []) {
+      for (const line of wrap(`${q.label ? `${q.label}: ` : ""}"${q.quote}" (${pathOf(q.url)})`, 60)) out.push(`  ${" ".repeat(NAME + 4)}${style.dim(line)}`);
+    }
   }
   return out;
 }
@@ -85,10 +107,20 @@ export function renderSummary(audit, paths, style, relative, savedTo) {
 // What to do next, as the README's three steps: 1 check, 2 fix, 3 test. With fixes, step 2 names the first prompt
 // by its full path, so it can be copied; the test commands follow for later. They name the product, so test runs on
 // it whatever alg.yml the folder holds.
-export function renderNext(audit, paths, style, relative) {
+// latestTest: the outcome of the newest local test of this product (latestTestOutcome), or null. After a passing test
+// with nothing to fix, Next says what is left instead of suggesting the same test again.
+export function renderNext(audit, paths, style, relative, latestTest = null) {
   const cmd = `npx agent-led-growth test ${audit.target.host}`;
   const test = [`        ${style.bold(`${cmd} --check`)}`, `        ${style.bold(cmd)}`, ""];
   const step3 = "Step 3 of 3: test. The plan is free; a signup uses your Claude Code.";
+  if (!audit.findings.length && (latestTest === "passed" || latestTest === "handoff")) {
+    const skipped = audit.steps.filter((s) => s.state === "not_applicable").map((s) => s.name);
+    const open = audit.steps.filter((s) => s.state === "not_checked").map((s) => s.name);
+    const left = open.length ? `Not shown by a test yet: ${listNames(open)}.` : "Nothing left to fix or test.";
+    const na = skipped.length ? ` ${listNames(skipped)} ${skipped.length === 1 ? "doesn't" : "don't"} apply.` : "";
+    const [first, ...rest] = wrap(`Your latest test passed. ${left}${na} Keep it passing in CI:`, 68);
+    return [`  ${style.bold("Next")}  ${first}`, ...rest.map((l) => `        ${l}`), `        ${style.bold(`${cmd} --yes --json`)}`, ""];
+  }
   if (!audit.findings.length) return [`  ${style.bold("Next")}  ${step3}`, ...test];
   return [
     `  ${style.bold("Next")}  Step 2 of 3: fix. Paste a prompt into your coding agent, deploy,`,

package/src/dashboard/strip.js

@@ -6,9 +6,9 @@ export const PASSING = new Set(["agent_did", "agent_can", "handoff"]);
 export const FAILING = new Set(["needs_person", "blocked"]);
 
 // Who the colour stands for. A handoff is a person stepping in at a documented point, so it reads as a person.
-export const WHO = { agent_did: "agent", agent_can: "agent", handoff: "person", needs_person: "person", blocked: "blocked", not_checked: "none" };
-export const LABEL = { agent_did: "Agent did", agent_can: "Agent can", handoff: "Handoff", needs_person: "Needs a person", blocked: "Blocked", not_checked: "Needs a test" };
-export const KIND = { agent_did: "success", agent_can: "success", handoff: "success", needs_person: "warning", blocked: "error", not_checked: "neutral" };
+export const WHO = { agent_did: "agent", agent_can: "agent", handoff: "person", needs_person: "person", blocked: "blocked", not_checked: "none", not_applicable: "none" };
+export const LABEL = { agent_did: "Agent did", agent_can: "Agent can", handoff: "Handoff", needs_person: "Needs a person", blocked: "Blocked", not_checked: "Needs a test", not_applicable: "Doesn't apply" };
+export const KIND = { agent_did: "success", agent_can: "success", handoff: "success", needs_person: "warning", blocked: "error", not_checked: "neutral", not_applicable: "neutral" };
 export const EVIDENCE_KIND = { check: "Check of public pages", test: "Test with a real agent", pay: "Payment run", signal: "Your server", stuck: "Stuck report" };
 
 export const who = (state) => WHO[state] || "none";
@@ -20,6 +20,7 @@ export function mark(state, style = null) {
   const paint = (name, s) => (style ? style[name](s) : s);
   if (PASSING.has(state)) return paint("green", "✓");
   if (FAILING.has(state)) return paint("red", "✗");
+  if (state === "not_applicable") return paint("dim", "-");
   return paint("dim", "·");
 }
 export const markOk = (ok, style = null) => (style ? (ok ? style.green("✓") : style.red("✗")) : ok ? "✓" : "✗");

package/src/interface/evaluate.js

@@ -227,6 +227,13 @@ export function evaluateAuthentication(x, observations) {
   return { methods, mentions, requirement, agentCanUnderstandSetup: setup, friction };
 }
 
+// pricing.json lists plans and every one costs 0: nothing to buy. Only machine-readable plans count; a price in prose
+// can be a demo's sample data (Track's homepage shows a customer paying $49.00).
+export function freePlansOnly(pricing) {
+  const plans = pricing?.plans || [];
+  return plans.length > 0 && plans.every((p) => p.amount === 0);
+}
+
 export function evaluatePricing(x, observations) {
   const pj = x.pricingJson;
   const pagesFound = x.pricingPages;
@@ -247,7 +254,7 @@ export function evaluatePricing(x, observations) {
   return {
     model: pj?.value.revenueModel ? { value: pj.value.revenueModel, method: "extracted", evidence: pj.evidence } : null,
     plans: plans.map((p) => ({ ...p, evidence: pj.evidence })),
-    observedPrices: pagesFound.map((p) => ({ prices: p.value.prices, evidence: p.evidence })),
+    observedPrices: pagesFound.map((p) => ({ prices: p.value.prices, evidence: p.evidence, ...(p.value.paidQuote ? { paidQuote: p.value.paidQuote } : {}) })),
     agentCanDetermineCost: cost,
     ambiguities,
   };

package/src/interface/extract.js

@@ -1,5 +1,6 @@
 import { parseRobots, AI_BOTS } from "../probe/index.js";
 import { htmlToText } from "./sources.js";
+import { quoteAt } from "./quote.js";
 
 // Deterministic extraction. Every fact carries the observation it came from and a quote from that page.
 // A fact that cannot be extracted is null; callers turn nulls into unknowns. No inference happens here.
@@ -172,7 +173,21 @@ export function extractPricingJson(observations, bodies) {
 
 const PRICE_RE = /(?:\$|€|£|USD\s?)\s?\d[\d,]*(?:\.\d+)?(?:\s?(?:\/|per)\s?(?:mo(?:nth)?|yr|year|seat|user|request|call|1k|1000|k)\b)?/gi;
 const AMBIGUITY_RE = /contact (?:us|sales)|custom pricing|talk to sales|get a quote|enterprise pricing|request a demo/gi;
-const USAGE_RE = /usage[- ]based|pay[- ]as[- ]you[- ]go|per (?:request|call|token|seat|user)|metered/gi;
+// "per request" is a price only beside a price word: "priced per request", "billed per call". Alone it is usually a
+// limit: Track's "4 KB per request", "What it sends, per request".
+const USAGE_RE = /usage[- ]based|pay[- ]as[- ]you[- ]go|\b(?:priced|charged|billed|paid|pay|costs?|fee|price)\s+(?:\w+\s+)?per (?:request|call|token|seat|user)\b|metered billing/gi;
+
+function paidPriceQuote(page, text) {
+  let tried = 0;
+  for (const m of text.matchAll(PRICE_RE)) {
+    // "$75M Series B" is a funding round, not a plan.
+    if (!/[1-9]/.test(m[0]) || /^[MB]\b/i.test(text.slice(m.index + m[0].length))) continue;
+    const q = quoteAt(page, text, m.index, m.index + m[0].length, page.obs.role);
+    if (q) return q;
+    if (++tried >= 200) return null;
+  }
+  return null;
+}
 
 export function extractPricingPages(observations, bodies) {
   const out = [];
@@ -182,7 +197,10 @@ export function extractPricingPages(observations, bodies) {
     const ambiguities = [...new Set((text.match(AMBIGUITY_RE) || []).map((s) => s.toLowerCase()))];
     const usage = [...new Set((text.match(USAGE_RE) || []).map((s) => s.toLowerCase()))];
     if (page.obs.role === "homepage" && !prices.length) continue;
-    out.push(fact({ prices, ambiguities, usageTerms: usage }, page.obs.id, quoteAround(text, /(\$|€|£)\s?\d/) || quoteAround(text, AMBIGUITY_RE) || text.slice(0, 140)));
+    // A paid price is what Pay quotes when it says paid plans are published, so it gets a clean quote: the sentence or
+    // labelled element holding the first price above zero that has one (src/interface/quote.js), or null.
+    const paid = paidPriceQuote(page, text);
+    out.push(fact({ prices, ambiguities, usageTerms: usage, paidQuote: paid ? { obs: page.obs.id, ...paid } : null }, page.obs.id, quoteAround(text, /(\$|€|£)\s?\d/) || quoteAround(text, AMBIGUITY_RE) || text.slice(0, 140)));
   }
   return out;
 }

package/src/interface/funnel.js

@@ -1,6 +1,7 @@
 import { STAGES, PILLAR } from "../schema/stages.js";
 import { AGENTID_NEEDS } from "./onboarding.js";
 import { PASSING } from "../dashboard/strip.js";
+import { freePlansOnly } from "./evaluate.js";
 
 // The seven-step answer for one public check: how far an agent can get, where it stops, and what to build.
 // Rule-based over the interface document only. Public evidence can show a path is documented; only a live
@@ -8,7 +9,9 @@ import { PASSING } from "../dashboard/strip.js";
 export const FUNNEL_SCHEMA = "agent-ready/funnel@1";
 // handoff: a person steps in at a documented point and the agent carries on. That is a working path, not a failure.
 // agent_did: a live test proved the step. Only a live test sets it.
-export const STEP_STATES = ["agent_did", "agent_can", "handoff", "needs_person", "blocked", "not_checked"];
+// not_applicable: the product's machine-readable files say the step has nothing to do (every plan in pricing.json is
+// free, so there is nothing to pay for). It neither passes nor fails and is left out of the counts.
+export const STEP_STATES = ["agent_did", "agent_can", "handoff", "needs_person", "blocked", "not_checked", "not_applicable"];
 // Kept under this name for callers; the order itself lives in schema/stages.js.
 export const FUNNEL_ORDER = STAGES;
 
@@ -52,15 +55,23 @@ const NEEDS_SENTENCE = {
   wallet: "Needs a wallet the agent can pay from.",
   agent_identity: "Needs an identity provider the agent can sign in with.",
 };
-function needsSentences(needs) {
-  return needs.map((need) => {
+// A step that says the product needs something carries the sentence it came from. A need with no quote is not said:
+// the rule is that a requirement is reported only with the exact text that states it.
+function needsOf(pattern) {
+  const quoted = (need) => (pattern.needsEvidence?.[need] || []).filter((e) => e.quote);
+  const kept = pattern.needs.filter((need) => quoted(need).length);
+  const sentence = kept.map((need) => {
     if (!NEEDS_SENTENCE[need]) throw new Error(`no sentence for need "${need}"`);
     return NEEDS_SENTENCE[need];
   }).join(" ");
+  const quotes = kept.flatMap((need) => quoted(need).slice(0, 1).map((e) => ({ for: need, obs: e.obs, quote: e.quote, ...(e.label ? { label: e.label } : {}) })));
+  return { kept, sentence, quotes };
 }
 
-function step(id, state, reason, basedOn = [], tip = null) {
+// quotes: [{ for, obs, quote }], the sentences behind a claim that the product requires something, shown with the step.
+function step(id, state, reason, basedOn = [], tip = null, quotes = []) {
   const out = { id, name: STEP_NAME[id], area: PILLAR[id], question: STEP_QUESTION[id], state, reason, basedOn: [...new Set(basedOn.filter(Boolean))] };
+  if (quotes.length) out.quotes = quotes;
   // Only a step known to fail gets a fix. An unchecked step needs a live test first.
   if (state === "needs_person" || state === "blocked") out.fix = FIX[id];
   // A passing step can still be easier for agents; that is a tip, not a fix.
@@ -103,8 +114,9 @@ function signup(doc) {
   const existing = patterns.find((p) => p.id === "existing_account");
   const refs = (p) => (p?.evidence || []).map((e) => e.obs);
   // The pattern's reason already names AgentID, what the agent needs, and whether the owner is shared.
-  if (self?.provider === "AgentID") return step("signup", "agent_can", self.reason, refs(self));
-  if (self && self.needs.length) return step("signup", "agent_can", `The docs describe an agent signing up on its own (${self.name}). ${needsSentences(self.needs)}`, refs(self));
+  const needs = self ? needsOf(self) : null;
+  if (self?.provider === "AgentID") return step("signup", "agent_can", self.reason, refs(self), null, needs.quotes);
+  if (self && needs.kept.length) return step("signup", "agent_can", `The docs describe an agent signing up on its own (${self.name}). ${needs.sentence}`, [...refs(self), ...needs.quotes.map((q) => q.obs)], null, needs.quotes);
   // "Agent is the customer" has no person step, and its boundary text says so ("None documented. ..."), which does
   // not read after "A person steps in".
   const boundary = !self?.humanBoundary ? "" : /^None\b/.test(self.humanBoundary) ? " No person step is documented: the agent holds the account itself." : ` A person steps in ${self.humanBoundary.charAt(0).toLowerCase()}${self.humanBoundary.slice(1)}`;
@@ -112,6 +124,9 @@ function signup(doc) {
   if (existing?.cli === "token") return step("signup", "handoff", "A person creates the account and a token. The agent's CLI takes the token from a flag or an environment variable, with no browser.", refs(existing));
   if (existing?.cli === "browser") return step("signup", "handoff", "A person creates the account and signs the CLI in through a browser; no token option was found in the pages read. The agent carries on from there.", refs(existing));
   if (existing) return step("signup", "handoff", "A person creates the account and gives the agent a key. The agent carries on from there.", refs(existing));
+  // The product sends the agent to sign up on another company's site, which is not read: unknown, not a gap.
+  const elsewhere = doc.onboarding?.signupElsewhere;
+  if (elsewhere) return step("signup", "not_checked", `The docs send the agent to sign up on ${elsewhere.domain}, another company's site, which was not read. Only a test run shows whether an agent can sign up there.`, elsewhere.evidence.map((e) => e.obs));
   return step("signup", "needs_person", "The pages read document no way for an agent to sign up. A person may have to create the account; only a real agent run can confirm.");
 }
 
@@ -126,6 +141,8 @@ function access(doc, signupStep) {
   const self = (doc.onboarding?.patterns || []).find((p) => SIGNUP_PATTERNS.has(p.id));
   if (signupStep.state === "agent_can" && self?.provider === "AgentID") return step("access", "agent_can", "Signed in with AgentID, the agent holds its own account and gets its key or session from it, not from a person.", [...refs, ...signupStep.basedOn]);
   if (signupStep.state === "agent_can") return step("access", "agent_can", "The agent signup path hands back a key the agent can use.", [...refs, ...signupStep.basedOn]);
+  const elsewhere = doc.onboarding?.signupElsewhere;
+  if (elsewhere && signupStep.state === "not_checked") return step("access", "not_checked", `The agent gets its credential where it signs up, on ${elsewhere.domain}. Only a test run shows whether it can.`, [...refs, ...signupStep.basedOn]);
   if (methods.length || terms.length) return step("access", "needs_person", `The docs describe ${describeAuth(methods, terms)}, but the pages read do not show how an agent gets one.`, refs);
   return step("access", "not_checked", "The docs read do not say how an agent authenticates.", refs);
 }
@@ -142,35 +159,55 @@ function pay(doc) {
   const plans = doc.pricing?.plans || [];
   const observed = doc.pricing?.observedPrices || [];
   const paidPlans = plans.filter((p) => typeof p.amount === "number" && p.amount > 0);
-  const paidText = observed.filter((o) => (o.prices || []).some((price) => /[1-9]/.test(price)));
+  // The pricing page first: a homepage price can be anything (a demo's "$49.00", a funding round).
+  const roleOf = (o) => doc.observations?.find((x) => x.id === o.evidence?.[0]?.obs)?.role;
+  const paidText = observed.filter((o) => (o.prices || []).some((price) => /[1-9]/.test(price))).sort((a, b) => Number(roleOf(b) === "pricing") - Number(roleOf(a) === "pricing"));
   const refs = [...plans.flatMap((p) => (p.evidence || []).map((e) => e.obs)), ...paidText.flatMap((o) => (o.evidence || []).map((e) => e.obs))];
   // A purchase the product's own pages document (src/interface/purchase.js). One approval by a person, then the agent
   // buys on its own, is a handoff: a person steps in at a documented point and the agent carries on. It is not
   // agent_can, which would say no person is needed, and not needs_person, which would say a person checks out each time.
+  const quote = (entries, what) => (entries || []).filter((e) => e.quote).slice(0, 1).map((e) => ({ for: what, obs: e.obs, quote: e.quote, ...(e.label ? { label: e.label } : {}) }));
   const purchase = doc.pricing?.agentPurchase;
   const purchaseRefs = (purchase?.evidence || []).map((e) => e.obs);
+  const purchaseQuotes = quote(purchase?.evidence, "payment");
   const perRequestCall = purchase?.rule === "pay_per_request_own_api";
   const checkoutCall = purchase?.rule === "checkout_protocol_own_api";
   const call = purchase?.call ? ` (${purchase.call})` : "";
   const over = purchase?.protocol ? ` over ${purchase.protocol}` : "";
   if (purchase?.approval === "once") {
     const how = perRequestCall ? `pays over ${purchase.protocol || "x402 or MPP"}${call}` : checkoutCall ? `checks out over ${purchase.protocol}${call}` : purchase.call ? `buys through ${purchase.call}${over}` : `buys through the API${over}`;
-    return step("pay", "handoff", `A person sets payment up once (an approval link, a spending cap, a saved card or a delegation), then the agent ${how}, with no browser checkout. The docs say so; a test shows whether it works.`, purchaseRefs);
+    return step("pay", "handoff", `A person sets payment up once (an approval link, a spending cap, a saved card or a delegation), then the agent ${how}, with no browser checkout. The docs say so; a test shows whether it works.`, purchaseRefs, null, purchaseQuotes);
   }
-  if (purchase?.rule === "agent_buys_through_api") return step("pay", "agent_can", `The docs describe an agent buying through the API${call}${over}, and no person approving first. A test shows whether it works.`, purchaseRefs);
-  if (perRequestCall) return step("pay", "agent_can", `The docs show a paid call over ${purchase.protocol || "x402 or MPP"} on the product's own API${call}, with no browser checkout. The agent needs a funded wallet; a test shows whether the payment goes through.`, purchaseRefs);
-  if (checkoutCall && purchase.call) return step("pay", "agent_can", `The docs show a checkout an agent completes over ${purchase.protocol} on the product's own API${call}, with no browser checkout. A test shows whether a purchase goes through.`, purchaseRefs);
-  if (checkoutCall) return step("pay", "agent_can", `The product publishes a UCP business profile at /.well-known/ucp, so an agent can check out over UCP, with no browser checkout. A test shows whether a purchase goes through.`, purchaseRefs);
+  if (purchase?.rule === "agent_buys_through_api") return step("pay", "agent_can", `The docs describe an agent buying through the API${call}${over}, and no person approving first. A test shows whether it works.`, purchaseRefs, null, purchaseQuotes);
+  if (perRequestCall) return step("pay", "agent_can", `The docs show a paid call over ${purchase.protocol || "x402 or MPP"} on the product's own API${call}, with no browser checkout. The agent needs a funded wallet; a test shows whether the payment goes through.`, purchaseRefs, null, purchaseQuotes);
+  if (checkoutCall && purchase.call) return step("pay", "agent_can", `The docs show a checkout an agent completes over ${purchase.protocol} on the product's own API${call}, with no browser checkout. A test shows whether a purchase goes through.`, purchaseRefs, null, purchaseQuotes);
+  if (checkoutCall) return step("pay", "agent_can", `The product publishes a UCP business profile at /.well-known/ucp, so an agent can check out over UCP, with no browser checkout. A test shows whether a purchase goes through.`, purchaseRefs, null, purchaseQuotes);
+  // Machine-readable pricing comes before prose: with every plan in pricing.json at 0 and no purchase documented,
+  // there is nothing to pay for, whatever the page text says (a demo's "$49.00", x402 named as something tested).
+  if (freePlansOnly(doc.pricing)) return step("pay", "not_applicable", "Nothing to buy: every plan is free (pricing.json).", plans.flatMap((p) => (p.evidence || []).map((e) => e.obs)));
   // Pay-per-request wording is easy to misread: a billing product describing its own
   // customers' metering reads the same as an agent paying. Only a live test settles it.
-  if (perRequest) return step("pay", "not_checked", "The docs mention paying per request. A test with a real agent shows whether it can actually pay.", (perRequest.evidence || []).map((e) => e.obs));
+  if (perRequest) return step("pay", "not_checked", "The docs mention paying per request over x402. A test with a real agent shows whether it can actually pay.", (perRequest.evidence || []).map((e) => e.obs), null, quote(perRequest.evidence, "payment"));
   // Only the product's own domain is read: a purchase path on a payments provider's site (Stripe Projects lists
   // Cloudflare, Neon, Turso and others on stripe.com) is not seen here, so the sentence says what was read.
-  if (paidPlans.length || paidText.length) return step("pay", "needs_person", "Paid plans are published. The pages read document no way for an agent to buy one, so a person may have to check out.", refs);
+  // A paid price in prose counts only with a clean quote (the sentence or labelled element it is in): Cloudflare's
+  // pricing page carries its prices only inside a script's JSON, which is no sentence to show.
+  const quotedText = paidText.filter((o) => o.paidQuote);
+  if (paidPlans.length || quotedText.length) return step("pay", "needs_person", "Paid plans are published. The pages read document no way for an agent to buy one, so a person may have to check out.", refs, null, paidPlans.length ? planQuote(paidPlans[0]) : quote([quotedText[0].paidQuote], "payment"));
+  if (paidText.length) return step("pay", "not_checked", "Prices appear in the pages read, but not in a sentence or table that can be quoted. A test shows whether an agent can pay.", refs);
   if (plans.length || observed.length) return step("pay", "not_checked", "Only free plans were found, so there is nothing to pay for yet.", refs);
   return step("pay", "not_checked", "No plans were found in the pages read.");
 }
 
+// A paid plan from pricing.json, quoted as the plan it is rather than a cut of the file's JSON:
+// pricing.json: "Pro: 20 USD per month".
+function planQuote(plan) {
+  const obs = plan.evidence?.[0]?.obs;
+  if (!obs) return [];
+  const price = [plan.amount, plan.currency, plan.period ? `per ${plan.period}` : ""].filter((x) => x !== null && x !== "").join(" ");
+  return [{ for: "payment", obs, quote: `${plan.name || plan.id || "Plan"}: ${price}`, label: "pricing.json" }];
+}
+
 function use(doc) {
   const caps = doc.capabilities || [];
   const api = doc.interfaces?.api;
@@ -186,7 +223,9 @@ function use(doc) {
   return step("use", "not_checked", "No API actions were found in the pages read.", refs);
 }
 
-function manage() {
+function manage(doc) {
+  const plans = doc.pricing?.plans || [];
+  if (plans.length === 1 && freePlansOnly(doc.pricing) && !doc.pricing.agentPurchase) return step("manage", "not_applicable", "One free plan: no plan or limit to change.", (plans[0].evidence || []).map((e) => e.obs));
   return step("manage", "not_checked", "Changing a plan or a limit can only be proven by a test run.");
 }
 
@@ -199,14 +238,15 @@ function withAgentId(doc, s, sentence) {
   const self = patterns.find((p) => SIGNUP_PATTERNS.has(p.id));
   const agentId = patterns.find((p) => p.provider === "AgentID");
   if (!agentId || agentId === self) return s;
-  return { ...s, reason: `${s.reason} ${sentence}`, basedOn: [...new Set([...s.basedOn, ...agentId.evidence.map((e) => e.obs)])] };
+  const quotes = [...(s.quotes || []), ...agentId.evidence.filter((e) => e.quote).slice(0, 1).map((e) => ({ for: "agent_identity", obs: e.obs, quote: e.quote, ...(e.label ? { label: e.label } : {}) }))];
+  return { ...s, reason: `${s.reason} ${sentence}`, basedOn: [...new Set([...s.basedOn, ...agentId.evidence.map((e) => e.obs)])], quotes };
 }
 
 export function buildFunnel(doc) {
   const d = discover(doc);
   const s = withAgentId(doc, signup(doc), `The docs also describe the agent signing in with AgentID as itself, which needs ${AGENTID_NEEDS}.`);
   const a = withAgentId(doc, access(doc, s), "Signed in with AgentID, the agent would hold its own account and get its key or session from it.");
-  const byId = { discover: d, understand: understand(doc), signup: s, access: a, pay: pay(doc), use: use(doc), manage: manage() };
+  const byId = { discover: d, understand: understand(doc), signup: s, access: a, pay: pay(doc), use: use(doc), manage: manage(doc) };
   const steps = FUNNEL_ORDER.map((id) => byId[id]);
   const chosen = choosePath(doc);
   const paths = (doc.onboarding?.patterns || []).map((p) => ({ id: p.id, name: p.name, status: p.status, humanBoundary: p.humanBoundary || null, needs: p.needs, followed: p === chosen }));
@@ -217,20 +257,25 @@ export function buildFunnel(doc) {
 // that does not pass, and whether that step is a real stop or only unproven.
 // The headline keeps two counts apart: steps the public pages document (agent_can, handoff) and steps a test with a
 // real agent verified (agent_did). Reading pages is not running a task, so a check alone never says a step works.
+// A step that does not apply is skipped: it neither passes nor stops the walk, and applicable counts the rest.
 export function summarize(steps) {
-  const firstOpen = steps.findIndex((x) => !PASSING.has(x.state));
-  const passed = firstOpen === -1 ? steps.length : firstOpen;
+  const applicable = steps.filter((x) => x.state !== "not_applicable");
+  const firstOpen = applicable.findIndex((x) => !PASSING.has(x.state));
+  const passed = firstOpen === -1 ? applicable.length : firstOpen;
   const stop = steps.find((x) => x.state === "blocked" || x.state === "needs_person") || null;
   const verified = steps.filter((x) => x.state === "agent_did").length;
   const documented = steps.filter((x) => x.state === "agent_can" || x.state === "handoff").length;
   // stepsPassing (from #78) is every passing step, the total the headline gives: documented plus verified.
-  return { headline: headlineFor(steps, documented, verified), passed, stepsPassing: documented + verified, documented, verified, of: steps.length, stopsAt: stop?.id || null, fixes: steps.filter((x) => x.fix).map((x) => ({ step: x.id, name: x.name, fix: x.fix })) };
+  return { headline: headlineFor(steps, documented, verified), passed, stepsPassing: documented + verified, documented, verified, of: steps.length, applicable: applicable.length, stopsAt: stop?.id || null, fixes: steps.filter((x) => x.fix).map((x) => ({ step: x.id, name: x.name, fix: x.fix })) };
 }
 
 function headlineFor(steps, documented, verified) {
-  if (!steps.some((x) => x.live)) return `Your public pages document ${documented} of ${steps.length} steps. No step has been tested yet: a test runs a real agent.`;
+  const skipped = steps.filter((x) => x.state === "not_applicable").map((x) => x.name);
+  const of = skipped.length ? `${steps.length - skipped.length} applicable steps` : `${steps.length} steps`;
+  const dontApply = skipped.length ? `; ${listNames(skipped)} ${skipped.length === 1 ? "doesn't" : "don't"} apply` : "";
+  if (!steps.some((x) => x.live)) return `Your public pages document ${documented} of ${of}${dontApply}. No step has been tested yet: a test runs a real agent.`;
   const failed = steps.filter((x) => x.live && x.state === "blocked").map((x) => x.name);
-  const parts = [`${verified} of ${steps.length} steps verified by a test.`];
+  const parts = [`${verified} of ${of} verified by a test${dontApply}.`];
   if (documented) parts.push(`Your public pages document ${documented} more.`);
   if (failed.length) parts.push(`${listNames(failed)} failed a test.`);
   return parts.join(" ");

package/src/interface/onboarding.js

@@ -1,4 +1,6 @@
 import { htmlToText, registrableDomain, sameSite } from "./sources.js";
+import { freePlansOnly } from "./evaluate.js";
+import { blockContext, quoteAt } from "./quote.js";
 
 // Which ways can an agent start using this product? Read from public docs only, so every pattern is a claim the docs
 // make, with the quotes that make it; none is a result. A product can support several. Rules, not a model: each signal
@@ -13,8 +15,9 @@ const SIGNALS = {
   // Agent-infra products use the same words for signing up somewhere else: AgentLine's "so your agent can sign up and
   // verify", AgentID's "apps where agents can sign up and sign in with AgentID". "No agent can sign up" is the opposite.
   bootstrap: /\bagent[- ]?sign[- ]?up\b|(?<!\b(?:no|not|never|where)\s+(?:\w+\s+){0,2})\bagents? (?:can )?(?:sign(?:s)? (?:itself |themselves )?up|creates? (?:its|their) own (?:accounts?|API keys?))(?:\*\*)?(?: here| for an account| in one (?:API )?(?:call|request)| and get (?:an? |its |their )?(?:own )?(?:API )?key| \(beta\)| instantly| immediately| automatically| programmatically)*(?=(?:\*\*)?\s*(?:[.;!)\n]|,\s*(?:and )?get\b|[—–]|$))|\/agents?\/sign-?up\b|\bsign(?:s|ing)? (?:itself|themselves) up\b|\bregisters? itself\b|\bno (?:human|account|signup|sign-up)(?: or API key)? (?:is )?(?:needed|required)\b|\bwithout (?:a |an )?(?:human|account)\b|\banonymous(?:ly)? (?:create|creates|provision|access|account|project|identit)|\btemporary (?:account|project|deployment)s?\b|--temporary\b|\binit --agent\b|\bagent_mode\b|\bbot[_ ]signup\b|\bidentity_types_supported\b/i,
-  // A person can take ownership afterwards.
-  claim: /\bclaim(?:s|ed|ing)? (?:it|this|the|your|their) (?:account|project|workspace|deployment|bucket|inbox|resources?)\b|\bclaim (?:url|code|link|token|flow|page|email)\b|\bclaim_url\b|\bclaimUrl\b|\/claim\b|\bunclaimed\b|\bclaimable\b|\b(?:human|owner|person) (?:can |may |will )?(?:later )?claim\b|\battach (?:a |the )?(?:human )?owner\b|\badopt (?:the |this )?workspace\b/i,
+  // A person can take ownership afterwards. "The owner claims the workspace", with an object: an OpenID Connect "owner
+  // claim" is a field in a token (AgentID's llms-full.txt "the requested owner claim quietly missing"), not a person.
+  claim: /\bclaim(?:s|ed|ing)? (?:it|this|the|your|their) (?:account|project|workspace|deployment|bucket|inbox|resources?)\b|\bclaim (?:url|code|link|token|flow|page|email)\b|\bclaim_url\b|\bclaimUrl\b|\/claim\b|\bunclaimed\b|\bclaimable\b|\b(?:human|owner|person) (?:can |may |will |must |then )?(?:later )?claims? (?:it|this|the|your|their|its)\b|\battach (?:a |the )?(?:human )?owner\b|\badopt (?:the |this )?workspace\b/i,
   // What the agent made goes away unless someone keeps it.
   // Tied to the account or resource: "quotes expire after 5 minutes" is not this. The sentence must name an account,
   // project, workspace, key or token and not a stored thing (STORED_THING below): Supermemory's "temporary facts drop
@@ -41,7 +44,9 @@ const SIGNALS = {
   // use it to mean "claim first" (Cosmic) or "over your plan" (Inkbox).
   payPerRequest: /\bx402\b|\bX-PAYMENT\b|\bPAYMENT-REQUIRED\b/,
   // The documented way in is a command-line tool rather than an HTTP call.
-  cliBootstrap: /\b(?:npx|wrangler|mem0|stripe|npm i(?:nstall)?|pip install|brew install)\b[^\n]{0,60}(?:--temporary|--agent|\binit\b|\bsign-?up\b|projects init)/i,
+  // At most four words between the tool and the flag or subcommand, so it is one command line: Track's docs say
+  // "npx agent-led-growth check <url> runs a real agent through signup", which is prose after a command, not a signup.
+  cliBootstrap: /\b(?:npx|wrangler|mem0|stripe|npm i(?:nstall)?|pip install|brew install)\b(?:[ \t]+[^\s`]+){0,4}?[ \t]+(?:--temporary|--agent|sign-?up\b|projects init)/i,
   // The product's CLI takes a token without a browser, so an agent can run it unattended once a person has made the
   // token: Vercel's "Set the VERCEL_TOKEN environment variable" or "Pass the --token option", GitHub's "--with-token".
   // An environment variable counts only where the text calls it one: code samples are full of other _API_KEY names.
@@ -192,9 +197,19 @@ function findAgentIdSignIn(doc, bodies) {
       ...(agentFacing ? [...text.matchAll(AGENTID_DECLARED)] : []),
       ...[...text.matchAll(AGENTID_ROUTE)],
     ].sort((x, y) => x.index - y.index);
-    const match = matches.find((m) => !AGENTID_ELSEWHERE.test(text.slice(Math.max(0, m.index - 60), m.index + m[0].length + 60)) && !announcedByOther(text.slice(Math.max(0, m.index - 60), m.index + m[0].length), doc) && !AGENTID_VENDOR.test(sentenceAround(text, m.index, m.index + m[0].length)));
+    const kept = matches.filter((m) => !AGENTID_ELSEWHERE.test(text.slice(Math.max(0, m.index - 60), m.index + m[0].length + 60)) && !announcedByOther(text.slice(Math.max(0, m.index - 60), m.index + m[0].length), doc) && !AGENTID_VENDOR.test(sentenceAround(text, m.index, m.index + m[0].length)));
+    // The first kept match with a clean quote: one sentence or labelled element holding the words (src/interface/quote.js).
+    let match = null;
+    let q = null;
+    for (const m of kept) {
+      q = quoteAt(body, text, m.index, m.index + m[0].length, obs.role);
+      if (q) {
+        match = m;
+        break;
+      }
+    }
     if (!match) continue;
-    out.push({ obs: obs.id, quote: quoteAround(text, match.index), agentFacing });
+    out.push({ obs: obs.id, quote: q.quote, ...(q.label ? { label: q.label } : {}), agentFacing });
     if (AGENTID_OWNER.test(text.slice(Math.max(0, match.index - OWNER_WINDOW), match.index + OWNER_WINDOW))) ownerDocumented = true;
   }
   return { entries: out, ownerDocumented };
@@ -245,49 +260,165 @@ const EXAMPLE_PAGE = /\/(?:templates?|examples?|starters?)\//i;
 // OAuth dynamic client registration (POST /oauth/register, /oauth2/register, /connect/register) registers a client app
 // with an authorization server; it is not an agent getting an account.
 const OAUTH_REGISTRATION = /\/(?:oauth2?|connect|clients?|dcr)\/regist(?:er|ration)\b/i;
+// A signal that says the product requires something (an inbox, a person setting access up, restricted access, a
+// payment) counts only from a sentence that says so about the product itself. Text that merely mentions the thing never
+// counts: a negation ("No project key can sign in to the dashboard"), an example ("such as opening a verification
+// email") or a sentence about the reader's own customers. Each kept match is quoted, and the quote is shown with the
+// step it decides.
+// A negation in the same clause just before the match: "A project key cannot sign in to the dashboard". A comma ends
+// the clause, so "If you don't have one, create an API key in the dashboard" still counts.
+const CLAUSE_NEGATION = /\b(?:no|not|never|cannot|can't|can not|without|don't|doesn't|won't|isn't|aren't|nothing)\b[^.,;:!?\n]{0,40}$/i;
+const negatedBefore = (sentence, match) => {
+  const at = sentence.indexOf(match.replace(/\s+/g, " "));
+  return at >= 0 && CLAUSE_NEGATION.test(sentence.slice(0, at));
+};
+// Expiry said not to happen: Track's "Unclaimed, nothing is deleted", "the workspace and key never expire".
+const NO_EXPIRY = /\b(?:nothing|never|not|no\s+\w+)\s+(?:is\s+|are\s+|will\s+|gets?\s+|be\s+|ever\s+)*(?:deleted|removed|expires?)\b|\bdo(?:es)?(?: not|n't) expire\b/i;
+// An example of something, not the product's own step: Track's "For a step your API never sees, such as opening a
+// verification email, send an onboarding_step event".
+const EXAMPLE = /\b(?:such as|for example|for instance|e\.g\.|i\.e\.)/i;
+// An inbox step counts only in a sentence about the product's own signup or sign-in path. The words are looked for
+// outside the match, so "Verification email never opened" (a sample error message in Track's docs) is not its own
+// context.
+const SIGNUP_CONTEXT = /\bsign(?:s|ing|ed)?[- ]?(?:up|in)\b|\bsignups?\b|\bregist(?:er|ers|ered|ering|ration)\b|\bcreat(?:e|es|ing) (?:an? |your |the )?(?:new )?account\b|\bonboard(?:ing)?\b|\bverif(?:y|ies|ied|ication)\b|\bconfirm(?:s|ed)?\b|\blog ?in\b|\bget (?:an? |your )?(?:API )?key\b/i;
+// The product saying there is no inbox step. Authoritative: one such sentence on the product's own pages clears every
+// inbox match. Track's "POST /v1/signup returns a key with no account, email or browser", "Track needs no inbox
+// verification", "takes no email and sends nothing to confirm". Not "without email": Telnyx's "Without email access the
+// flow falls back to..." is a condition, and its signup does send a magic link.
+export const NO_INBOX = /\b(?:takes|needs|requires|asks for|sends) no (?:e-?mail|inbox)\b|\bneeds? no inbox\b|\bno inbox (?:verification|step|needed|required)\b|\bno (?:account, )?e-?mail(?:,| or| needed| required)\b|\bno (?:e-?mail )?verification (?:e-?mail|code|link|step)\b|\bsends nothing to confirm\b/i;
+const withoutMatch = (sentence, match) => sentence.replace(match.replace(/\s+/g, " "), " ");
+// A line of a link index ("- [Email OTP](https://neon.com/docs/auth/...): Sign in and verify email addresses") describes
+// another page, often a feature the product sells, not the product's own signup.
+const INDEX_LINE = /^\s*(?:[-*]\s*)?\[[^\]]+\]\([^)]+\)/;
+// Signing up somewhere else: AgentMail's "Enable browser agents to sign up for services by extracting OTP codes".
+// AgentLine's "Receive OTP codes so your agent can sign up and verify" is a feature for signing up elsewhere too.
+const SIGNUP_ELSEWHERE = /\bsign(?:s|ing)? up for (?:services|other|any|third-party|apps|sites|websites)\b|\b(?:other|third-party) (?:services|apps|sites|websites)\b|\bso (?:your|the|an) agents? can sign up\b/i;
+// An optional step is not a requirement: Locus's "the human is needed only for an optional AgentMail OTP".
+const OPTIONAL = /\boptional(?:ly)?\b/i;
+
+// An inbox step counts only when its subject is the product's own signup. AgentID's llms-full.txt tells the general
+// problem, "An agent signs up with its owner's email, reads the verification code out of the owner's inbox", and that
+// read as AgentID's own signup needing an inbox. A sentence counts when it says so itself (ownSignup below), or when it
+// sits on the product's own agent-signup or auth page, or in a signup section of a page (under a "Sign up", "Agent
+// Signup", "Registration" or "Quick start" heading, or right after a step that is the product's own signup call).
+// A third-person narrative ("an agent signs up", "AI agents can sign up for a SaaS product") counts only on the
+// product's own signup page.
+// The sentence calls one of the product's signup, sign-in or verify endpoints: AgentLine's "`POST /v1/auth/otp` →
+// `POST /v1/auth/verify`", Cosmic's "(POST /v3/agents/sign-up)", AgentMail's "curl -X POST .../v0/agent/sign-up".
+const SIGNUP_CALL = /\b(?:POST|GET|PUT)\b[^\n]{0,24}?\/[\w.\/{}:-]*?(?:sign[-_]?up|sign[-_]?in|register|registration|verif\w*|otp|auth|login|magic[-_]?link|onboard)\b/i;
+// "We send", "we'll email", "our signup": the product speaking about its own flow.
+const FIRST_PERSON = /\b(?:we|we'll|we will)\s+(?:then\s+)?(?:send|email|text|mail)\b|\bour (?:sign[- ]?up|signup|registration|onboarding|verification|sign[- ]?in|login)\b|\b(?:create an account|sign up|register) here\b/i;
+const SIGNUP_HEADING = /^\W*(?:\w+ )?(?:sign[- ]?up|signup|sign[- ]?in|register|registration|create (?:an |your )?account|get(?:ting)? started|quick ?start|onboarding)\b(?![^?]*\?)/i;
+const GENERIC_NARRATIVE = /\b(?:an?|every|each|any|most|many|some)\s+(?:AI\s+)?(?:agents?|users?|people|persons?|humans?|developers?|bots?)\b(?:\s+\w+){0,3}?\s+(?:sign(?:s|ed|ing)?|can sign|could sign) up\b/i;
+const OWN_SIGNUP_PAGES = new Set(["onboarding", "auth"]);
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+// The product's names: its host's labels (agentmail, cosmicjs and cosmic) and the first part of its page title.
+function productNames(doc) {
+  const labels = doc.target.host.toLowerCase().split(".").slice(0, -1).filter((l) => l !== "www" && l.length > 2);
+  const variants = labels.flatMap((l) => [l, l.replace(/(?:js|hq|app|ai|io|dev|labs)$/, "")]).filter((l) => l.length > 2);
+  const title = String(doc.product?.name?.value || "").split(/\s+[|\u2014\u2013:-]\s+|\s*[|:]\s*/)[0].trim();
+  return [...new Set([...variants, ...(title && title.length <= 40 ? [title.toLowerCase()] : [])])];
+}
+function ownSignupSentence(sentence, names) {
+  if (SIGNUP_CALL.test(sentence) || FIRST_PERSON.test(sentence)) return true;
+  if (!names.length) return false;
+  const name = `(?:${names.map(escapeRe).join("|")})`;
+  return new RegExp(`\\b(?:sign(?:s|ed|ing)?[- ]?(?:up|in)|log(?:s|ged|ging)?[- ]?in|register(?:s|ed|ing)?|creat(?:e|es|ed|ing) (?:an? |your )?account)\\s+(?:for|to|with|on|at|into)\\s+(?:an? )?${name}\\b|\\b${name}\\s+(?:sends?|emails?|will (?:send|email)|texts?)\\b|\\b(?:your|an?|the) ${name} account\\b|\\b${name}[\\w.]*\\/(?:sign-?up|register|signin|login)\\b`, "i").test(sentence);
+}
+function ownSignup(sentence, match, page) {
+  if (ownSignupSentence(sentence, page.names)) return true;
+  // On the product's own signup page the sentence still has to be about signing up: Moltbook's "Verification code
+  // expired." is a line of an error list, Locus's "Never ask the human to reveal their ... email verification
+  // code" is advice. The words are looked for outside the match.
+  if (OWN_SIGNUP_PAGES.has(page.role) && SIGNUP_CONTEXT.test(withoutMatch(sentence, match))) return true;
+  if (GENERIC_NARRATIVE.test(sentence)) return false;
+  const ctx = page.context();
+  if (!ctx) return false;
+  const heading = ctx.heading.replace(/[#*_`]/g, " ").trim();
+  return SIGNUP_HEADING.test(heading) || ownSignupSentence(heading, page.names) || ownSignupSentence(ctx.previous, page.names);
+}
+
+// A question says nothing about this product: AgentID's llms-full.txt "How can you tell an agent signup from a human
+// one?" heads an explainer, and its comparison table's row "Can the agent sign up for a new service on its own" has no
+// question mark. An FAQ's answer, where it says yes, is its own sentence and is tried next.
+const QUESTION = /\?\s*(?:\*\*)?\s*$|^\W*(?:can|could|does|do|is|are|will|should|how|why|what|when|where)\b/i;
+
+// The match names a page rather than saying anything: AgentID's "[can an AI agent sign up for a
+// SaaS](/blog/can-an-ai-agent-sign-up-for-a-saas)" is a link to a blog post, in its text and in its slug. A path like
+// /agents/signup starts with a slash and still counts.
+function inSlug(sentence, match) {
+  if (match.startsWith("/")) return false;
+  const m = escapeRe(match);
+  if (new RegExp(`\\[[^\\]]*${m}[^\\]]*\\]\\(`, "i").test(sentence)) return true;
+  const re = new RegExp(`[\\w/]-${m}|${m}-[a-z]`, "i");
+  return re.test(sentence) && !sentence.includes(` ${match} `) && !sentence.startsWith(`${match} `);
+}
+
 // Whether a sentence holding a match is about something else; such a match is skipped and the next one tried.
+// page: { role, names, context() } for the rules that read where the sentence is (the inbox rule).
 const SKIP = {
-  bootstrap: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || SIGNUP_OFF.test(sentence) || PERSON_WITHOUT_ACCOUNT.test(sentence) || PAYMENT_WAY_IN.test(sentence) || CLIENT_REGISTRATION.test(sentence) || BROKERED.test(sentence) || (/^temporary\b/i.test(match) && STORED_THING.test(sentence)),
-  expiry: (sentence) => !ACCOUNT_THING.test(sentence) || STORED_THING.test(sentence),
+  bootstrap: (sentence, ownDomain, match) => inSlug(sentence, match) || QUESTION.test(sentence) || DOMAIN_ACTORS.test(sentence) || SIGNUP_OFF.test(sentence) || PERSON_WITHOUT_ACCOUNT.test(sentence) || PAYMENT_WAY_IN.test(sentence) || CLIENT_REGISTRATION.test(sentence) || BROKERED.test(sentence) || (/^temporary\b/i.test(match) && STORED_THING.test(sentence)),
+  expiry: (sentence) => !ACCOUNT_THING.test(sentence) || STORED_THING.test(sentence) || NO_EXPIRY.test(sentence),
+  restricted: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || EXAMPLE.test(sentence) || negatedBefore(sentence, match),
+  emailStep: (sentence, ownDomain, match, page, label) => label === "Code" || DOMAIN_ACTORS.test(sentence) || EXAMPLE.test(sentence) || INDEX_LINE.test(sentence) || SIGNUP_ELSEWHERE.test(sentence) || OPTIONAL.test(sentence) || NO_INBOX.test(sentence) || negatedBefore(sentence, match) || !ownSignup(sentence, match, page),
+  humanFirst: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || EXAMPLE.test(sentence) || negatedBefore(sentence, match),
   httpBootstrap: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || OAUTH_REGISTRATION.test(match),
-  payPerRequest: (sentence, ownDomain) => DOMAIN_ACTORS.test(sentence) || SELLER.test(sentence) || PROTOCOL_DESCRIPTION.test(sentence) || paysElsewhere(sentence, ownDomain),
+  payPerRequest: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || SELLER.test(sentence) || PROTOCOL_DESCRIPTION.test(sentence) || paysElsewhere(sentence, ownDomain) || negatedBefore(sentence, match),
 };
-const GLOBAL = Object.fromEntries(Object.keys(SKIP).map((name) => [name, new RegExp(SIGNALS[name].source, `${SIGNALS[name].flags}g`)]));
+const GLOBAL = Object.fromEntries(Object.keys(SIGNALS).map((name) => [name, new RegExp(SIGNALS[name].source, `${SIGNALS[name].flags.replace("g", "")}g`)]));
 
-// The first match whose sentence is not about something else. Tries at most MAX_TRIED matches a page, so a page that
-// repeats a skipped phrase thousands of times costs no more than one that says it once.
+// The first match that has a clean quote (src/interface/quote.js) and whose sentence is not about something else. The
+// guards read the same sentence the quote shows, so a rule never decides on words from a neighbouring element of the
+// page. Tries at most MAX_TRIED matches a page, so a page that repeats a skipped phrase thousands of times costs no
+// more than one that says it once.
 const MAX_TRIED = 200;
-function firstKept(text, re, skip, ownDomain) {
+function firstKept(page, re, skip, ownDomain) {
   let tried = 0;
-  for (const m of text.matchAll(re)) {
-    if (!skip(sentenceAround(text, m.index, m.index + m[0].length).replace(/\s+/g, " "), ownDomain, m[0])) return m;
+  for (const m of page.text.matchAll(re)) {
+    const q = quoteAt(page.body, page.text, m.index, m.index + m[0].length, page.role);
+    const at = { ...page, context: () => blockContext(page.body, page.text, m.index, m.index + m[0].length, page.role) };
+    if (q && !(skip && skip(q.quote, ownDomain, m[0], at, q.label))) return { index: m.index, ...q };
     tried += 1;
     if (tried >= MAX_TRIED) return null;
   }
   return null;
 }
 
-function findSignals(observations, bodies, targetUrl) {
+function findSignals(observations, bodies, targetUrl, names) {
   const ownDomain = registrableDomain(new URL(targetUrl).hostname);
   const found = Object.fromEntries(Object.keys(SIGNALS).map((name) => [name, []]));
   for (const obs of observations) {
     const body = bodies.get(obs.id);
     if (!body) continue;
-    const text = body.html ? htmlToText(body.text) : body.text;
-    for (const [name, re] of Object.entries(SIGNALS)) {
+    const page = { body, role: obs.role, names, text: body.html ? htmlToText(body.text) : body.text };
+    for (const name of Object.keys(SIGNALS)) {
       if (found[name].length >= EVIDENCE_PER_SIGNAL) continue;
-      // A sitemap's URL slugs ("/posts/x402-launch") are page names, and a template or example page
-      // (vercel.com/templates/next.js/x402-ai-starter) is code for the reader's own app: neither documents paying this product.
-      if (name === "payPerRequest" && (obs.role === "sitemap" || EXAMPLE_PAGE.test(new URL(obs.url).pathname))) continue;
-      // Guarded signals try every match, so one sentence about something else does not hide a real one.
-      const skip = SKIP[name];
-      const match = skip ? firstKept(text, GLOBAL[name], skip, ownDomain) : re.exec(text);
-      if (match) found[name].push({ obs: obs.id, quote: quoteAround(text, match.index), agentFacing: AGENT_FACING.has(obs.role) });
+      // A sitemap's URL slugs ("/posts/x402-launch", "/blog/can-an-ai-agent-sign-up-for-a-saas") are page names, not
+      // claims. A template or example page (vercel.com/templates/next.js/x402-ai-starter) is code for the reader's own
+      // app: it does not document paying this product.
+      if (obs.role === "sitemap") continue;
+      if (name === "payPerRequest" && EXAMPLE_PAGE.test(new URL(obs.url).pathname)) continue;
+      // Every match is tried, so one sentence about something else, or words run together from two elements, does not
+      // hide a real one.
+      const match = firstKept(page, GLOBAL[name], SKIP[name], ownDomain);
+      if (match) found[name].push({ obs: obs.id, quote: match.quote, ...(match.label ? { label: match.label } : {}), agentFacing: AGENT_FACING.has(obs.role) });
     }
   }
   return found;
 }
 
+// The first sentence on the product's own pages saying signup has no inbox step, or null.
+function findNoInbox(doc, bodies) {
+  for (const obs of doc.observations) {
+    const body = bodies.get(obs.id);
+    if (!body || !sameSite(obs.url, doc.target.url)) continue;
+    const text = body.html ? htmlToText(body.text) : body.text;
+    const m = NO_INBOX.exec(text);
+    if (m) return { obs: obs.id, quote: quoteAround(text, m.index) };
+  }
+  return null;
+}
+
 // What testing this pattern end to end requires beyond HTTP requests: an inbox for an
 // email step, a command-line runner, a funded wallet. Whether a deployment has each is
 // decided where the report is shown, not here. Agent identity has no runner support.
@@ -302,11 +433,18 @@ function needsFor(id, found) {
   return needs;
 }
 
+// The quotes behind each need, so a step that says the product needs something can show the sentence it came from.
+const NEED_SIGNALS = { inbox: ["emailStep"], cli: ["cliBootstrap"], wallet: ["payPerRequest"], agent_identity: ["agentIdSignIn", "agentIdentity"] };
+function needsEvidenceFor(needs, found) {
+  const ordered = (entries) => [...entries.filter((e) => e.agentFacing), ...entries.filter((e) => !e.agentFacing)];
+  return Object.fromEntries(needs.map((need) => [need, ordered(NEED_SIGNALS[need].flatMap((name) => found[name] || [])).map(({ obs, quote, label }) => ({ obs, quote, ...(label ? { label } : {}) }))]));
+}
+
 function pattern(id, found, signalNames, reason) {
   // The product's agent-facing pages first: a quote from llms.txt or an agent-signup
   // page says more than the same words in homepage navigation.
   const entries = signalNames.flatMap((name) => found[name]);
-  const evidence = [...entries.filter((e) => e.agentFacing), ...entries.filter((e) => !e.agentFacing)].map(({ obs, quote }) => ({ obs, quote }));
+  const evidence = [...entries.filter((e) => e.agentFacing), ...entries.filter((e) => !e.agentFacing)].map(({ obs, quote, label }) => ({ obs, quote, ...(label ? { label } : {}) }));
   const documented = signalNames.some((name) => found[name].some((entry) => entry.agentFacing));
   return {
     id,
@@ -316,6 +454,7 @@ function pattern(id, found, signalNames, reason) {
     evidence,
     humanBoundary: PATTERNS[id].humanBoundary,
     needs: needsFor(id, found),
+    needsEvidence: needsEvidenceFor(needsFor(id, found), found),
   };
 }
 
@@ -342,9 +481,27 @@ function findApiHosts(doc, bodies) {
   return [...hosts.values()];
 }
 
+// A signup page on another company's site that the product's agent-facing pages send the agent to: AgentID's llms.txt
+// "[Get started](https://console.agentmail.to/sign-up): Create an AgentMail inbox to get an AgentID". That page is not
+// read, so whether an agent can sign up there is unknown, not a gap in this product's docs.
+const SIGNUP_URL = /https:\/\/([a-z0-9.-]+\.[a-z]{2,})(\/[^\s"'`<>)\]]*)?/gi;
+const SIGNUP_PATH = /\/(?:sign-?up|register|get-started)(?:[/?#]|$)/i;
+function findSignupElsewhere(doc, bodies) {
+  for (const obs of doc.observations) {
+    const body = bodies.get(obs.id);
+    if (!body || !obs.ok || !AGENT_FACING.has(obs.role)) continue;
+    const text = body.html ? htmlToText(body.text) : body.text;
+    for (const match of text.matchAll(SIGNUP_URL)) {
+      if (sameSite(`https://${match[1]}/`, doc.target.url) || !SIGNUP_PATH.test(match[2] || "")) continue;
+      return { domain: registrableDomain(match[1].toLowerCase()), url: match[0], evidence: [{ obs: obs.id, quote: quoteAround(text, match.index) }] };
+    }
+  }
+  return null;
+}
+
 export function detectOnboarding(doc, bodies) {
   const observations = doc.observations;
-  const found = findSignals(observations, bodies, doc.target.url);
+  const found = findSignals(observations, bodies, doc.target.url, productNames(doc));
   const onIssuerSite = sameSite(AGENTID_ISSUER, doc.target.url);
   const agentId = onIssuerSite ? { entries: [], ownerDocumented: false } : findAgentIdSignIn(doc, bodies);
   found.agentIdSignIn = agentId.entries;
@@ -352,6 +509,9 @@ export function detectOnboarding(doc, bodies) {
   // A signup call documented on a page written for agents is the product saying an agent can sign itself up, even
   // without the words "agent signup": Moltbook's skill.md says "register" and shows POST /api/v1/agents/register.
   found.bootstrap.push(...found.httpBootstrap.filter((e) => e.agentFacing && !found.bootstrap.some((b) => b.obs === e.obs)));
+  // The product saying it has no inbox step outweighs any mention of one.
+  const noInbox = findNoInbox(doc, bodies);
+  if (noInbox) found.emailStep = [];
   const has = (name) => found[name].length > 0;
   const patterns = [];
 
@@ -378,7 +538,9 @@ export function detectOnboarding(doc, bodies) {
     patterns.push(p);
   }
 
-  if (has("payPerRequest")) patterns.push(pattern("pay_per_request", found, ["payPerRequest"], "The docs describe paying per request over HTTP 402, with no account needed first."));
+  // Machine-readable pricing first: when pricing.json lists only free plans, x402 in prose is not a price. Track's docs
+  // name x402 as one of the tasks its sister product tests, and that read as Track charging per request.
+  if (has("payPerRequest") && !freePlansOnly(doc.pricing)) patterns.push(pattern("pay_per_request", found, ["payPerRequest"], "The docs describe paying per request over HTTP 402, with no account needed first."));
 
   // Only the signup side says a person sets access up: a key made in a dashboard, a token a person creates. An auth
   // scheme in the OpenAPI document (Turso's `bearerAuth: http bearer`) says how a request is signed, not who gets the
@@ -395,6 +557,7 @@ export function detectOnboarding(doc, bodies) {
   return {
     patterns,
     apiHosts: findApiHosts(doc, bodies),
+    signupElsewhere: findSignupElsewhere(doc, bodies),
     primary: agentFirst?.id || patterns[0]?.id || null,
     reason: patterns.length ? `${patterns.length} way${patterns.length === 1 ? "" : "s"} for an agent to start, from the sources read.` : `No way for an agent to start was found in the sources read.${doc.otherHostsSkipped ? " Links to other hosts were not read." : ""} This is not evidence that none exists.`,
   };

package/src/interface/purchase.js

@@ -1,5 +1,6 @@
 import { htmlToText, registrableDomain, sameSite } from "./sources.js";
-import { AGENT_FACING, DOMAIN_ACTORS, PROTOCOL_DESCRIPTION, PROTOCOL_SITES, SELLER, paysElsewhere, quoteAround, sentenceAround } from "./onboarding.js";
+import { AGENT_FACING, DOMAIN_ACTORS, PROTOCOL_DESCRIPTION, PROTOCOL_SITES, SELLER, paysElsewhere, sentenceAround } from "./onboarding.js";
+import { quoteAt } from "./quote.js";
 
 // Whether the product's own pages document a way for an agent to buy from it through an API, and whether a person
 // approves first. Rules over page text, like the onboarding signals: each rule is a named pattern, every hit carries
@@ -239,7 +240,7 @@ export function detectAgentPurchase(doc, bodies) {
     const text = body.html ? htmlToText(body.text) : body.text;
     // The product publishes its UCP business profile: the product saying agents can check out with it over UCP.
     if (obs.role === "ucp_profile") {
-      if (isUcpProfile(text)) hits.push({ rule: "checkout_protocol_own_api", obs: obs.id, quote: quoteAround(text, 0), approval: false, call: null, score: 2, protocol: "UCP", agentFacing: true });
+      if (isUcpProfile(text)) hits.push({ rule: "checkout_protocol_own_api", obs: obs.id, quote: new URL(obs.url).pathname, label: "UCP business profile", approval: false, call: null, score: 2, protocol: "UCP", agentFacing: true });
       continue;
     }
     const sellerPage = SELLER_PAGE.test(new URL(obs.url).pathname);
@@ -249,7 +250,10 @@ export function detectAgentPurchase(doc, bodies) {
       const hit = find(text, ownDomain);
       if (!hit) continue;
       const near = text.slice(Math.max(0, hit.index - APPROVAL_WINDOW), hit.index + APPROVAL_WINDOW);
-      hits.push({ rule, obs: obs.id, quote: quoteAround(text, hit.index), approval: Boolean(hit.approved) || APPROVAL.test(hit.sentence) || APPROVAL.test(near), call: hit.call, score: hit.score, protocol: hit.protocol || protocolIn(hit.sentence, text), agentFacing: AGENT_FACING.has(obs.role) });
+      // The sentence or labelled element holding the hit (src/interface/quote.js); null when the words run across two
+      // elements of the page, and then the hit has no quote.
+      const q = quoteAt(body, text, hit.index, hit.index + 1, obs.role);
+      hits.push({ rule, obs: obs.id, quote: q?.quote || null, ...(q?.label ? { label: q.label } : {}), approval: Boolean(hit.approved) || APPROVAL.test(hit.sentence) || APPROVAL.test(near), call: hit.call, score: hit.score, protocol: hit.protocol || protocolIn(hit.sentence, text), agentFacing: AGENT_FACING.has(obs.role) });
     }
   }
   if (!hits.length) return null;
@@ -265,6 +269,6 @@ export function detectAgentPurchase(doc, bodies) {
     approval: hits.some((h) => h.approval) ? "once" : "none_documented",
     call: ruled.find((h) => h.call)?.call || null,
     protocol: ruled.find((h) => h.protocol)?.protocol || null,
-    evidence: ordered.filter((h) => h.rule === rule).concat(ordered.filter((h) => h.rule !== rule)).slice(0, EVIDENCE_MAX * 2).map(({ obs, quote }) => ({ obs, quote })),
+    evidence: ordered.filter((h) => h.rule === rule).concat(ordered.filter((h) => h.rule !== rule)).slice(0, EVIDENCE_MAX * 2).map(({ obs, quote, label }) => ({ obs, quote, ...(label ? { label } : {}) })),
   };
 }

package/src/interface/quote.js

@@ -0,0 +1,255 @@
+// The quote shown under a step that says the product needs something. Kat reads every one, so a quote is one or two
+// whole sentences from one element of the page (a paragraph, a list item, a table cell), never text run together from
+// separate elements. Resend's pricing page flattened to "scale as you grow. Are you an AI agent? See pricing Add-ons if
+// you send from a": a subtitle, a link and a heading read as one sentence. When the words sit in an element with no
+// sentence (a heading, a table cell, a button, a line of code), the quote is that element's text with a label saying
+// what it is: Heading: "Domains - $20 / mo".
+
+// Elements that start a new block. Inline elements (a, span, strong, code) stay inside the sentence they are part of.
+const BLOCK_TAG = /^<\/?\s*(address|article|aside|blockquote|br|button|caption|dd|details|dialog|div|dl|dt|fieldset|figcaption|figure|footer|form|h[1-6]|header|hr|img|input|label|legend|li|main|menu|nav|ol|option|p|pre|section|select|summary|svg|table|tbody|td|template|textarea|tfoot|th|thead|title|tr|ul)\b/i;
+const KIND_OF_TAG = { td: "cell", th: "cell", li: "item", dt: "item", dd: "item", button: "button", option: "button", summary: "button", pre: "code", title: "heading" };
+export const LABEL = { cell: "Table cell", heading: "Heading", item: "List item", button: "Button", code: "Code", line: "Line", paragraph: "Text", phrase: "Phrase" };
+// An element's text with no sentence in it is quoted whole only up to this length; longer is a run of inline elements
+// (a navigation bar, a footer), which is not a quote.
+const PHRASE_MAX = 160;
+// A sentence longer than this is a run of data (a JSON blob in a page, a minified list), not a sentence to quote.
+const SENTENCE_MAX = 320;
+
+function decode(s) {
+  return s.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+}
+
+// Blocks of an HTML page, with offsets into htmlToText(html): the same steps in the same order, split where a block
+// element starts or ends, so the blocks joined with one space are exactly htmlToText's output.
+export function htmlBlocks(html) {
+  const src = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ");
+  const segments = [];
+  let kind = "phrase";
+  let last = 0;
+  for (const m of src.matchAll(/<[^>]+>/g)) {
+    const tag = BLOCK_TAG.exec(m[0]);
+    if (!tag) continue;
+    segments.push({ kind, raw: src.slice(last, m.index) });
+    const name = tag[1].toLowerCase();
+    const closing = /^<\s*\//.test(m[0]);
+    kind = closing ? "phrase" : /^h[1-6]$/.test(name) ? "heading" : KIND_OF_TAG[name] || "phrase";
+    last = m.index + m[0].length;
+  }
+  segments.push({ kind, raw: src.slice(last) });
+  const blocks = [];
+  let offset = 0;
+  for (const seg of segments) {
+    const text = decode(seg.raw).replace(/\s+/g, " ").trim();
+    if (!text) continue;
+    blocks.push({ start: offset, end: offset + text.length, kind: seg.kind, raw: seg.raw });
+    offset += text.length + 1;
+  }
+  return blocks;
+}
+
+const FENCE = /^\s*(?:```|~~~)/;
+const HEADING_LINE = /^\s{0,3}#{1,6}\s/;
+const ITEM_LINE = /^\s*(?:[-*+]|\d+[.)])\s+/;
+const TABLE_LINE = /^\s*\|/;
+// A line that is only an HTML or MDX tag (`<Card title="Verify" href="...">`, `</Card>`) ends a block, like a blank line.
+const TAG_LINE = /^\s*<\/?[A-Za-z][^>]*>\s*$/;
+const INLINE_BLOCK_TAG = /<\/?\s*(?:td|th|tr|table|thead|tbody|p|li|ul|ol|div|h[1-6])\b[^>]*>/i;
+const INLINE_BLOCK_TAG_NAME = /^<(\/)?\s*(td|th|tr|table|thead|tbody|p|li|ul|ol|div|h[1-6])\b/i;
+const TAG_KIND = { td: "cell", th: "cell", li: "item", h1: "heading", h2: "heading", h3: "heading", h4: "heading", h5: "heading", h6: "heading" };
+function pushPiece(blocks, line, start, a, b, kind) {
+  while (a < b && /\s/.test(line[a])) a += 1;
+  while (b > a && /\s/.test(line[b - 1])) b -= 1;
+  if (b > a) blocks.push({ start: start + a, end: start + b, kind });
+}
+// A shell-comment block in a text file (AgentMail's llms.txt): "#" alone is a blank line and "#" followed by two or
+// more spaces is text, not a heading.
+const COMMENT_BLANK = /^\s*#\s*$/;
+const COMMENT_TEXT = /^\s*#\s{2,}\S/;
+
+// Blocks of a Markdown or plain-text page, with offsets into the text: a paragraph (lines joined until a blank line),
+// a heading, a list item with its wrapped lines, a table cell, a line of a code block. lineMode makes every line its
+// own block, for YAML and other line-oriented files.
+export function textBlocks(text, { lineMode = false } = {}) {
+  const blocks = [];
+  let open = null;
+  const close = () => {
+    if (open) blocks.push(open);
+    open = null;
+  };
+  let inFence = false;
+  let at = 0;
+  for (const line of text.split("\n")) {
+    const start = at;
+    const end = at + line.length;
+    at = end + 1;
+    const blank = !line.trim() || (!inFence && (COMMENT_BLANK.test(line) || TAG_LINE.test(line)));
+    if (FENCE.test(line)) {
+      close();
+      inFence = !inFence;
+      continue;
+    }
+    if (blank) {
+      close();
+      continue;
+    }
+    if (inFence || lineMode) {
+      close();
+      blocks.push({ start, end, kind: inFence ? "code" : "line" });
+      continue;
+    }
+    // HTML or MDX written inline in a text file (AgentID's llms-full.txt has a table as `<td className="...">Can the
+    // agent sign up ...</td> <td ...>`): each piece of text between block tags is its own block, as in an HTML page.
+    if (INLINE_BLOCK_TAG.test(line)) {
+      close();
+      let kind = "paragraph";
+      let from = 0;
+      for (const m of line.matchAll(/<[^>]+>/g)) {
+        pushPiece(blocks, line, start, from, m.index, kind);
+        const tag = INLINE_BLOCK_TAG_NAME.exec(m[0]);
+        if (tag) kind = tag[1] ? "paragraph" : TAG_KIND[tag[2].toLowerCase()] || "paragraph";
+        from = m.index + m[0].length;
+      }
+      pushPiece(blocks, line, start, from, line.length, kind);
+      continue;
+    }
+    if (HEADING_LINE.test(line) && !COMMENT_TEXT.test(line)) {
+      close();
+      blocks.push({ start, end, kind: "heading" });
+      continue;
+    }
+    if (TABLE_LINE.test(line)) {
+      close();
+      for (const cell of line.matchAll(/[^|]+/g)) if (cell[0].trim() && !/^[\s:-]+$/.test(cell[0])) blocks.push({ start: start + cell.index, end: start + cell.index + cell[0].length, kind: "cell" });
+      continue;
+    }
+    if (ITEM_LINE.test(line)) {
+      close();
+      open = { start, end, kind: "item" };
+      continue;
+    }
+    if (open) open.end = end;
+    else open = { start, end, kind: "paragraph" };
+  }
+  close();
+  return blocks;
+}
+
+const blockCache = new WeakMap();
+// The page's blocks over the text the rules read (htmlToText for HTML, the body itself otherwise).
+export function blocksOf(body, role) {
+  if (blockCache.has(body)) return blockCache.get(body);
+  const blocks = body.html ? htmlBlocks(body.text) : isJson(body.text) ? null : textBlocks(body.text, { lineMode: role === "openapi" || role === "sitemap" || role === "robots" });
+  blockCache.set(body, blocks);
+  return blocks;
+}
+
+const isJson = (text) => /^\s*[[{]/.test(text);
+
+// Where one sentence ends inside a block: terminal punctuation, any closing quote, bracket or Markdown mark, then
+// space and a character that can start a sentence. Not after an abbreviation ("e.g.", "vs.") or an initial.
+const BOUNDARY = /[.!?]["'”’)\]*_`]*(?=\s+[^\sa-z])/g;
+const ABBREVIATION = /\b(?:e\.g|i\.e|etc|vs|cf|approx|incl|Inc|Ltd|Co|Mr|Mrs|Ms|Dr|St|No|U\.S)$/;
+const TERMINAL = /[.!?]["'”’)\]*_`]*$/;
+
+function sentencesIn(s) {
+  const out = [];
+  let from = 0;
+  for (const m of s.matchAll(BOUNDARY)) {
+    if (m[0][0] === "." && ABBREVIATION.test(s.slice(0, m.index))) continue;
+    const end = m.index + m[0].length;
+    out.push([from, end]);
+    from = end;
+  }
+  out.push([from, s.length]);
+  return out.map(([a, b]) => {
+    while (a < b && /\s/.test(s[a])) a += 1;
+    while (b > a && /\s/.test(s[b - 1])) b -= 1;
+    return [a, b];
+  }).filter(([a, b]) => b > a);
+}
+
+// Markdown marks at the start of a block are layout, not words: "- ", "## ", "> ", "1. ".
+// A "#" that opens each line of a comment block is layout too.
+const tidy = (s) => s.replace(/^\s*(?:#{1,6}\s+|>\s*|[-*+]\s+|\d+[.)]\s+)/, "").replace(/\n[ \t]*#(?=\s)/g, "\n").replace(/\s+/g, " ").trim();
+
+// A div's text with no sentence in it is often several links or buttons side by side ("Start Sending Free View B2B
+// Plans ($14/mo) Read the Docs"). Its phrase is then only the inline elements the words are in: split at every tag
+// but comments, the same way htmlBlocks splits a page, so the pieces line up with the block's text.
+function inlinePiece(raw, start, end) {
+  const pieces = [];
+  let offset = 0;
+  for (const part of raw.split(/<(?!!--)[^>]+>/)) {
+    const text = decode(part).replace(/\s+/g, " ").trim();
+    if (!text) continue;
+    pieces.push({ start: offset, end: offset + text.length, text });
+    offset += text.length + 1;
+  }
+  const hit = pieces.filter((p) => p.end > start && p.start < end);
+  return hit.length ? hit.map((p) => p.text).join(" ") : null;
+}
+
+// { quote, label? } for the words at [start, end) of a block's text, or null when they cross a sentence pair or the
+// block is a long run with no sentence in it.
+// Sentences are looked for only within WINDOW characters of the match: a 2 MB page on one line would otherwise be split
+// end to end for every match. A sentence that reaches the window's edge is longer than any quote, so it is none.
+const WINDOW = 1000;
+function fromBlock(s, kind, start, end, raw = null) {
+  const lo = Math.max(0, start - WINDOW);
+  const hi = Math.min(s.length, end + WINDOW);
+  const near = s.slice(lo, hi);
+  const hit = sentencesIn(near).filter(([a, b]) => b > start - lo && a < end - lo);
+  if (!hit.length || hit.length > 2) return null;
+  const a = hit[0][0];
+  const b = hit.at(-1)[1];
+  if ((a === 0 && lo > 0) || (b === near.length && hi < s.length)) return null;
+  const piece = tidy(near.slice(a, b));
+  if (!piece) return null;
+  if (TERMINAL.test(piece) && kind !== "code" && kind !== "cell" && kind !== "heading") return piece.length <= SENTENCE_MAX ? { quote: piece } : null;
+  // A Markdown paragraph or list item is one element as its author wrote it, so it is quoted whole even without a full
+  // stop (llms.txt lines often have none). A div's text is cut to the inline elements the words are in.
+  const phrase = raw !== null && kind === "phrase" ? tidy(inlinePiece(raw, start, end) || "") : piece;
+  const max = kind === "paragraph" || kind === "item" ? SENTENCE_MAX : PHRASE_MAX;
+  if (!phrase || phrase.length > max) return null;
+  return { quote: phrase, label: LABEL[kind] || LABEL.phrase };
+}
+
+// A JSON string at [start, end): its text, labelled with its key (description, summary), or for a key itself, "Key"
+// ("OpenAPI path" for an OpenAPI path).
+function fromJson(text, start, end, role) {
+  let qs = start;
+  while (qs >= 0 && !(text[qs] === '"' && text[qs - 1] !== "\\")) qs -= 1;
+  let qe = end;
+  while (qe < text.length && !(text[qe] === '"' && text[qe - 1] !== "\\")) qe += 1;
+  if (qs < 0 || qe >= text.length || qe - qs > 2000) return null;
+  // Inside a string only when an odd number of unescaped quotes come before the opening one plus it.
+  const before = text.slice(0, qs + 1).match(/(?<!\\)"/g)?.length || 0;
+  if (before % 2 === 0) return null;
+  const raw = text.slice(qs + 1, qe).replace(/\\n/g, " ").replace(/\\"/g, '"').replace(/\\\//g, "/").replace(/\\\\/g, "\\");
+  const isKey = /^\s*:/.test(text.slice(qe + 1, qe + 20));
+  if (isKey) return raw.length <= PHRASE_MAX ? { quote: raw, label: role === "openapi" && raw.startsWith("/") ? "OpenAPI path" : "Key" } : null;
+  const key = /"([^"\\]{1,40})"\s*:\s*$/.exec(text.slice(Math.max(0, qs - 60), qs))?.[1] || "Value";
+  const inner = fromBlock(raw, "phrase", start - qs - 1, end - qs - 1);
+  return inner ? { quote: inner.quote, label: key } : null;
+}
+
+// The quote for a match at [start, end) of a page's text, or null when no clean quote holds it: the match runs across
+// two elements of the page, or its element is a long run with no sentence. A caller with a null tries its next match.
+export function quoteAt(body, text, start, end, role) {
+  if (!body.html && isJson(body.text)) return fromJson(text, start, end, role);
+  const blocks = blocksOf(body, role);
+  const block = blocks.find((b) => b.start <= start && end <= b.end);
+  if (!block) return null;
+  return fromBlock(text.slice(block.start, block.end), block.kind, start - block.start, end - block.start, block.raw ?? null);
+}
+
+// The block holding [start, end), and the heading above it on the page, for rules that read what a sentence is about.
+export function blockContext(body, text, start, end, role) {
+  if (!body.html && isJson(body.text)) return null;
+  const blocks = blocksOf(body, role);
+  const i = blocks.findIndex((b) => b.start <= start && end <= b.end);
+  if (i < 0) return null;
+  let h = i - 1;
+  while (h >= 0 && blocks[h].kind !== "heading") h -= 1;
+  const slice = (b) => (b ? text.slice(b.start, b.end) : "");
+  return { block: slice(blocks[i]), heading: h >= 0 ? slice(blocks[h]) : "", previous: slice(blocks[i - 1]) };
+}

package/src/interface/schema.js

@@ -23,8 +23,8 @@ export const SCHEMA_DOC = {
     authentication_requirement: "{ value: none|required|mixed|not_declared|unknown, reason, basedOn, rule, operations: [{ operation, value, reason, basedOn, rule, source: operation|global|absent, schemeNames }] }; operation security overrides global security; none requires an explicit operation [] or anonymous {} alternative; absent or empty global security is not_declared; unresolved declarations or incomplete operation coverage are unknown",
     pricing: "model, plans, observedPrices, agentCanDetermineCost, ambiguities, agentPurchase. agentPurchase is null or { rule: agent_buys_through_api|payment_required_approval|pay_per_request_own_api|checkout_protocol_own_api, rules, approval: once|none_documented, call, protocol: x402|MPP|ACP|AP2|UCP|null, evidence: [{ obs, quote }] }: a way for an agent to buy from the product through an API, as the product's own pages describe it (an agent buying with a purchase call, a cap or an approval; 402 payment_required with an approval link; x402 or MPP on a call to the product's own API; an ACP or UCP checkout session call on the product's own API, or a UCP business profile at /.well-known/ucp). protocol names the payment or checkout protocol the quoted sentence names, when it names one. approval once means a person approves first and the agent buys after that. A documented claim, never a result.",
     machineAccess: "robots, llms.txt, agent.json facts plus aiCrawlersAllowed, hasAgentReadableIndex and agentAuthDiscoverable",
-    onboarding: "{ patterns: [{ id: try_then_claim|limited_until_claimed|agent_is_customer|agent_identity|existing_account|pay_per_request, name, status: documented|inferred, reason, evidence: [{ obs, quote }], humanBoundary, needs: [inbox|cli|wallet|agent_identity], provider?: AgentID }], apiHosts: [{ domain, host, example, evidence }], primary, reason }. apiHosts are API URLs on other domains that the product's agent-facing pages point to. Ways an agent can start, as the public docs describe them; needs lists what testing that way end to end requires beyond HTTP requests, which a given deployment may or may not provide. provider names the identity provider an agent_identity pattern uses, when the docs name one the detector knows (AgentID). A pattern is a documented claim, never a result.",
-    funnel: "{ headline, passed, stepsPassing, documented, verified, of, stopsAt, path, paths, steps: [{ id: discover|understand|signup|access|use|pay|manage, name, area: web|onboarding|monetization, question, state: agent_did|agent_can|handoff|needs_person|blocked|not_checked, reason, fix?, basedOn, live?, evidence? }], fixes }. The seven steps an agent takes, from public evidence only. handoff means a person steps in at a documented point and the agent carries on, which counts as passing. agent_did appears only when the latest test run for that step on this product passed; a blocked test run sets blocked. live names that test. evidence lists, newest first, what else set or touched the step: { kind: test|pay|signal|stuck, at, reason, runId?, outcome?, count? }; a test or payment or the product's own signals can decide the state, a stuck report only attaches. documented counts agent_can and handoff steps, verified counts agent_did steps; the headline gives both and never calls a documented step verified. passed counts the passing steps before the first one that does not pass; stepsPassing counts every passing step (documented plus verified), the total the headline gives.",
+    onboarding: "{ patterns: [{ id: try_then_claim|limited_until_claimed|agent_is_customer|agent_identity|existing_account|pay_per_request, name, status: documented|inferred, reason, evidence: [{ obs, quote }], humanBoundary, needs: [inbox|cli|wallet|agent_identity], needsEvidence?: { <need>: [{ obs, quote, label? }] }, provider?: AgentID }], apiHosts: [{ domain, host, example, evidence }], signupElsewhere: { domain, url, evidence } | null, primary, reason }. apiHosts are API URLs on other domains that the product's agent-facing pages point to. signupElsewhere is a signup page on another company's site that those pages send the agent to; it is not read. Ways an agent can start, as the public docs describe them; needs lists what testing that way end to end requires beyond HTTP requests, which a given deployment may or may not provide. provider names the identity provider an agent_identity pattern uses, when the docs name one the detector knows (AgentID). A pattern is a documented claim, never a result.",
+    funnel: "{ headline, passed, stepsPassing, documented, verified, of, stopsAt, path, paths, steps: [{ id: discover|understand|signup|access|use|pay|manage, name, area: web|onboarding|monetization, question, state: agent_did|agent_can|handoff|needs_person|blocked|not_checked|not_applicable, reason, fix?, basedOn, quotes?, live?, evidence? }], applicable, fixes }. not_applicable: the product's machine-readable files say the step has nothing to do (Pay when every plan in pricing.json costs 0 and no purchase is documented; Manage when that is one plan); it neither passes nor stops the walk, and applicable counts the other steps. quotes: [{ for, obs, quote, label? }], the sentences behind a claim that the product needs or requires something; a need with no quote is not reported. quote is one or two whole sentences from one element of the page; label is set when the quote is an element that is not a sentence (Heading, Table cell, List item, Button, Code, Text, Phrase, OpenAPI path, pricing.json, or a JSON key such as description). The seven steps an agent takes, from public evidence only. handoff means a person steps in at a documented point and the agent carries on, which counts as passing. agent_did appears only when the latest test run for that step on this product passed; a blocked test run sets blocked. live names that test. evidence lists, newest first, what else set or touched the step: { kind: test|pay|signal|stuck, at, reason, runId?, outcome?, count? }; a test or payment or the product's own signals can decide the state, a stuck report only attaches. documented counts agent_can and handoff steps, verified counts agent_did steps; the headline gives both and never calls a documented step verified. passed counts the passing steps before the first one that does not pass; stepsPassing counts every passing step (documented plus verified), the total the headline gives.",
     unknowns: "every field whose verdict is unknown or whose fact is null, with the reason",
     limits: "what this run could not do (no JS rendering, no login, no model interpretation)",
   },