automated-qa 0.11.0

package/references/ATLAS-COVERAGE.md

@@ -0,0 +1,231 @@
+# Atlas coverage
+
+Generated by `qa dev atlas --write` from `references/atlas.md` and the detectors
+(`bin/classify.mjs`, every JavaScript producer under `bin/` and `lib/`, and
+`lib/qa/atlas.mjs`). Do not edit by hand — it will be overwritten on the next
+`--write`.
+
+77 of 105 S/R classes fully implemented (0 partial, 3 deliberate, 25 gaps); 79 of 108 mode obligations met; 30 not-automatable (G 16, H 12, A 2)
+
+## L1 — Delivery: the code under test is not the code being served
+
+11 classes: 6 implemented, 0 partial, 0 deliberate, 4 gap, 1 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L1.1 | S | implemented | Build-time env (`NEXT_PUBLIC_*`, `VITE_*`) set at runtime — never reaches the browser | S:runtime-env-in-client-code, S:runtime-env-in-client-code |
+| L1.2 | R | gap | CDN/edge cache not invalidated after deploy; old bundle still served | no detector for R |
+| L1.3 | R | implemented | Two hosts serving different builds; health check green against a placeholder | R:route.unreachable |
+| L1.4 | R | gap | Service worker serving a stale app shell | no detector for R |
+| L1.5 | R | implemented | `ChunkLoadError` — hashed chunk gone after deploy, open tabs break | R:delivery.chunk-load |
+| L1.6 | R | implemented | Wrong `basePath`/`assetPrefix` → every asset 404s | R:route.status-* |
+| L1.7 | S | gap | Env var present in CI, absent in the runtime image | no detector for S |
+| L1.8 | S | gap | Build succeeded with a stub/fallback module aliased in | no detector for S |
+| L1.9 | H | not-automatable | Verified on preview, shipped from prod — different pipeline | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L1.10 | R | implemented | Route's first visit failed, retry succeeded — intermittent; reported as `route.flaky`, never as a silent pass | R:route.flaky |
+| L1.11 | R | implemented | Route reached only through two or more intermediate paths — a redirect chain, not a direct landing (`route.indirect-landing`; auth bounces are reported as unreached, not here) | R:route.indirect-landing |
+
+## L2 — Contracts and boundaries: the typed line between two sides is not honoured
+
+3 classes: 2 implemented, 0 partial, 0 deliberate, 1 gap, 0 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L2.1 | S | implemented | Typed-boundary bypass — a raw/untyped value crosses an API or component boundary that declares a generated or validated type, skipping the check the type exists to enforce | S:unchecked-fetch-response, S:unchecked-fetch-response |
+| L2.2 | S | gap | Application contract, fixture, or RBAC drift — the client's assumed shape/permission set has diverged from what the server (or its schema/fixture) actually declares | no detector for S |
+| L2.3 | S | implemented | Authenticated-transport bypass — a request goes direct to the app's own API while every sibling caller goes through an authenticated client, so whatever that client attaches (session token, error contract) is absent. Source cannot see the endpoint's authentication contract, so this is a candidate for the real-persona lane to confirm with a live 401, never a confirmed defect on its own | S:unauthenticated-api-fetch |
+
+## L3 — Arrival: the data never gets there
+
+17 classes: 9 implemented, 0 partial, 1 deliberate, 5 gap, 2 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L3.10 | R | gap | Request never fired (`enabled: false`, conditional hook) | no detector for R |
+| L3.11 | R | implemented | 401/403 — token not attached, or expired mid-session | R:network.http-* |
+| L3.12 | G | not-automatable | HTTP 200 with an empty array — wrong tenant or filter scope | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L3.13 | G | not-automatable | Only page 1 rendered; pagination never wired | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L3.14 | S+R | deliberately-not-implemented | Race: the slower response overwrites the newer one | duplicate-in-flight-request (3.14's runtime half): needs a proven guard separating React StrictMode's double-invoke from a real race; ship only with a StrictMode fixture asserted silent |
+| L3.15 | R | implemented | Waterfall — dependent sequential fetches; partial at every instant | R:network.waterfall |
+| L3.16 | S | implemented | Response applied after unmount; no `AbortController` | S:effect-fetch-without-abort |
+| L3.17 | S | implemented | Cache-key collision — two queries share one key | S:cache-key-collision |
+| L3.18 | S | gap | Cache-key over-specificity — one entity cached under N key shapes | no detector for S |
+| L3.19 | R | gap | Retry storm → rate limit → looks like "no data" | no detector for R |
+| L3.20 | R | implemented | CORS preflight failure — invisible behind a dev proxy | R:network.requestfailed |
+| L3.21 | R | gap | Parse failure returns `undefined`, treated as empty | no detector for R |
+| L3.22 | R | implemented | Same-origin JSON array carried N>0 records; every list on the page rendered zero rows — the data arrived and was never rendered | R:data.rendered-zero-of-n |
+| L3.23 | R | implemented | An endpoint TEMPLATE answered 5xx, aggregated across the cell rather than per response (`network.endpoint-5xx`) | R:network.endpoint-5xx |
+| L3.24 | R | implemented | The same (method, endpoint template) fired 3+ times in one passive page load — a refetch loop or a missing cache key, with no user action to explain it (`network.duplicate-request`) | R:network.duplicate-request |
+| L3.25 | R | gap | Fewer distinct endpoint templates fired than the route's declared query hooks — the "suspiciously low, not zero" case 3.10 cannot see (`network.request-count-below-declared`; only filed when the import-graph join is trusted) | no detector for R |
+| L3.26 | R | implemented | A cross-origin request failed — a third-party script, font, analytics or CDN asset the page depends on (`network.requestfailed.external`) | R:network.requestfailed.external |
+
+## L4 — Synchronisation: data arrives, then diverges
+
+14 classes: 6 implemented, 0 partial, 0 deliberate, 1 gap, 7 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L4.22 | S | implemented | Server entity copied into a client store — a second source of truth the query cache cannot invalidate | S:server-state-in-client-store |
+| L4.23 | S | implemented | Mutation with no invalidation → every sibling view stale | S:no-invalidation |
+| L4.24 | S | implemented | Invalidation targets the wrong key — nothing the written resource's readers query under; blast radius resolved | S:partial-invalidation |
+| L4.25 | G | not-automatable | Optimistic update never reconciled with server truth | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule (but a detector exists: R:coherence.write-not-durable, R:coherence.write-not-durable, R:crud.write-lost — atlas Det may be stale) |
+| L4.26 | G | not-automatable | Optimistic update not rolled back on error | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L4.27 | S | gap | Two components own one mutation; only one invalidates | no detector for S |
+| L4.28 | S | implemented | Derived state not recomputed — `useState(props.x)`, stale closure, dead memo | S:derived-state-in-useState, S:stale-closure |
+| L4.29 | S | implemented | Tearing — external store read without `useSyncExternalStore` under concurrent rendering | S:external-store-without-sync |
+| L4.30 | A | not-automatable | Cross-tab divergence (no storage/broadcast sync) | architecture-dependent — applies only if this repo chose that architecture; a configuration question, not a missing rule |
+| L4.31 | A | not-automatable | Realtime subscription not re-established after reconnect | architecture-dependent — applies only if this repo chose that architecture; a configuration question, not a missing rule (but a detector exists: R:coherence.offline-replay-divergence — atlas Det may be stale) |
+| L4.32 | G | not-automatable | Form draft silently overwritten by a background refetch | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L4.33 | G | not-automatable | Deleted entity still referenced by a cached list | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule (but a detector exists: R:crud.delete-ineffective — atlas Det may be stale) |
+| L4.34 | G | not-automatable | Pagination cache not reset on filter change → mixed pages | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L4.35 | R | implemented | Write succeeded through the real form, then client-side navigation to a blast-radius route refetched nothing and shows the old value — 4.23/4.24 confirmed live (`--mutate`) | R:coherence.stale-after-write, R:coherence.stale-after-write, R:coherence.refetched-stale, R:coherence.refetched-stale, R:crud.update-lost |
+
+## L5 — Rendering/representation: the frame paints wrong, or the value in it lies
+
+26 classes: 19 implemented, 0 partial, 0 deliberate, 3 gap, 4 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L5.34 | S+R | implemented | Missing loading state → empty shell paints first | S:unread-query-loading, S:no-loading-boundary, R:render.empty, R:state.slow-blank |
+| L5.35 | S | implemented | Missing error state → failure renders as empty, silently | S:unread-query-error |
+| L5.36 | S+R | implemented | Missing empty state → an empty list and a failed fetch are indistinguishable | S:missing-empty-state, R:render.empty-list-no-state, R:state.no-empty-state, R:coherence.missing-required-summary |
+| L5.37 | R | implemented | Suspense boundary converts an error into a permanent spinner | R:render.stuck-loading, R:state.stuck-spinner |
+| L5.38 | S | implemented | Error boundary catches and renders nothing | S:no-error-boundary, S:no-error-boundary |
+| L5.39 | R | implemented | Hydration mismatch — SSR output ≠ first client render | R:render.hydration-mismatch |
+| L5.40 | S | implemented | List key collision (`key={index}`) → possible local state or focus mismatch when a list reorders | S:index-as-list-key |
+| L5.41 | S | gap | Effect dependency bug → infinite render, or never runs | no detector for S |
+| L5.42 | S | implemented | Conditional hook order violation | S:conditional-hook-call |
+| L5.43 | R | gap | Portal/modal escapes its theme or stacking context | no detector for R |
+| L5.44 | R | implemented | Virtualised list renders zero rows at certain heights | R:render.virtualized-empty |
+| L5.45 | R | implemented | Layout shift on data arrival (no reserved space) | R:perf.layout-shift |
+| L5.46 | R | implemented | `undefined` rendered as text † (this one reached a live API in prod) | R:value.leak |
+| L5.47 | R | implemented | `NaN` rendered | R:value.leak |
+| L5.48 | R | implemented | `[object Object]` rendered | R:value.leak |
+| L5.49 | R | implemented | `Invalid Date` rendered | R:value.leak |
+| L5.50 | R | implemented | The string `"null"` rendered | R:value.leak |
+| L5.51 | R | implemented | Unresolved template variable | R:value.leak |
+| L5.52 | H | not-automatable | Timezone — the date shifts by a day | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L5.53 | H | not-automatable | Currency — cents/dollars confusion, float rounding | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L5.54 | H | not-automatable | Locale/number formatting inconsistent between views | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone (but a detector exists: R:coherence.representation-divergence — atlas Det may be stale) |
+| L5.55 | S | implemented | Unescaped HTML or raw markdown shown | S:unsanitized-markdown-raw-html |
+| L5.56 | R | implemented | Truncation with no ellipsis or title | R:layout.truncated-no-title |
+| L5.57 | R | implemented | Enum rendered raw (`in_progress`, not "In progress") | R:value.raw-enum |
+| L5.58 | H | not-automatable | Precision loss on large IDs (JS number vs int64) | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L5.59 | R | gap | Fabricated success — the run reports a pass that the underlying evidence does not support. Currently unmeasured: no encoded oracle exists, and this class has no producer | no detector for R |
+
+## L6 — Interaction and control flow
+
+14 classes: 9 implemented, 0 partial, 0 deliberate, 1 gap, 4 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L6.59 | S | implemented | Double submit — no pending guard → duplicate records | S:submit-without-pending-guard |
+| L6.60 | G | not-automatable | Navigation during a pending mutation → lost write | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L6.61 | G | not-automatable | Back button does not restore list state, scroll, or filters | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L6.62 | G | not-automatable | Refresh on a deep link loses required state | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L6.63 | S | implemented | Unsaved-changes guard missing | S:unsaved-changes-guard-missing |
+| L6.64 | R | implemented | Interactive element covered by another element — clicks land on the occluder (`interact.click-occluded`; open dialogs and `pointer-events:none` overlays excluded) | R:interact.click-occluded |
+| L6.65 | R | gap | Focus lost after an action → keyboard user stranded | no detector for R |
+| L6.66 | G | not-automatable | Client validation passes; server rejects with an unhandled error shape | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule (but a detector exists: R:crud.create-failed — atlas Det may be stale) |
+| L6.67 | R | implemented | Disabled state not conveyed — looks clickable, does nothing | R:interact.disabled-not-conveyed |
+| L6.68 | S | implemented | Async action with no feedback → the user clicks again | S:async-click-without-feedback |
+| L6.69 | R | implemented | A control the surface should render never appeared, waited for rather than raced (`interact.never-appeared`) | R:interact.never-appeared |
+| L6.70 | R | implemented | A control appeared but was never clickable — a different defect from never appearing, and it needs a different fix (`interact.not-clickable`) | R:interact.not-clickable |
+| L6.71 | R | implemented | Inert affordance — a control was clicked and nothing observable followed: no DOM mutation, no request, no navigation, no ARIA state change (`interact.inert-control`) | R:interact.inert-control |
+| L6.72 | R | implemented | Clicking a control throws — the handler errors where a user would click (`interact.click-error`) | R:interact.click-error |
+
+## L7 — Access, identity, client security
+
+10 classes: 4 implemented, 0 partial, 0 deliberate, 2 gap, 4 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L7.69 | G | not-automatable | Role-gated route reachable by deep link | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L7.70 | G | not-automatable | UI hides an action the API allows — or shows one it denies | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule (but a detector exists: R:crud.unauthorized-allowed — atlas Det may be stale) |
+| L7.71 | G | not-automatable | Tenant scope missing from a query → cross-tenant leak | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule |
+| L7.72 | R | gap | Session expiry → redirect loop, or silent empty data | no detector for R |
+| L7.73 | G | not-automatable | Stale permissions cached after a role change | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule (but a detector exists: R:coherence.cross-principal-divergence, R:coherence.cross-principal-divergence — atlas Det may be stale) |
+| L7.74 | S | implemented | XSS sink — unsanitised HTML injection | S:unsanitized-html |
+| L7.75 | S | implemented | Prototype pollution — merging untrusted payload into an object | S:prototype-pollution-shape |
+| L7.76 | S | gap | DOM clobbering — a named element shadowing a global | no detector for S |
+| L7.77 | R | implemented | CSP violation blocking a real resource | R:security.csp-violation |
+| L7.78 | R | implemented | `SameSite=None` cookie without `Secure` — the browser rejects it; auth silently absent (`security.cookie-samesite-none-insecure`) | R:security.cookie-samesite-none-insecure |
+
+## L8 — Responsive and layout
+
+7 classes: 5 implemented, 0 partial, 0 deliberate, 2 gap, 0 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L8.79 | R | implemented | Horizontal scroll at 320/390 | R:layout.h-scroll |
+| L8.80 | R | implemented | Overlap or clipping at a breakpoint | R:layout.clipped-text |
+| L8.82 | R | gap | Long content (400-char name) breaks the layout | no detector for R |
+| L8.83 | R | implemented | Broken image with no fallback dimension | R:render.broken-image |
+| L8.84 | R | implemented | Dark-mode override missed | R:theme.tokens-not-applied, R:theme.light-hardcoded |
+| L8.85 | R | gap | Font swap shift | no detector for R |
+| L8.86 | R | implemented | Fixed height clips content at large text size or zoom | R:layout.fixed-height-clip |
+
+## L9 — Accessibility
+
+8 classes: 7 implemented, 0 partial, 1 deliberate, 0 gap, 0 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L9.87 | R | implemented | Contrast below threshold | R:a11y.contrast |
+| L9.88 | R | implemented | Control with no accessible name | R:a11y.unlabeled-control, R:a11y.label-association-broken |
+| L9.89 | R | implemented | Keyboard trap, or unreachable control | R:a11y.keyboard-trap |
+| L9.90 | R | implemented | Focus order does not follow visual order | R:a11y.focus-order |
+| L9.91 | R | implemented | No visible focus ring | R:a11y.no-focus-ring |
+| L9.92 | S | deliberately-not-implemented | Async result with no live region | missing-live-region-for-async-status (9.92): scoping unresolved: a live region far from the toast is still a live region; the conservative gate leaves mostly misses |
+| L9.93 | R | implemented | Tap target < 24px — excluding sr-only elements † (moved from L8 in v2: reachability by touch is an accessibility property) | R:a11y.tap-target |
+| L9.94 | R | implemented | ARIA state attribute the element's role does not support — `aria-selected`, `aria-pressed` (the rest of the `aria-allowed-attr` table is not measured) | R:a11y.aria-attr-not-allowed |
+
+## L10 — Performance
+
+9 classes: 7 implemented, 0 partial, 1 deliberate, 1 gap, 0 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L10.93 | R | implemented | Long task > 200ms — input blocked for that window (INP) | R:perf.long-task |
+| L10.94 | R | implemented | CLS > 0.1 — content moves under the cursor | R:perf.layout-shift |
+| L10.95 | R | implemented | LCP > 2500ms | R:perf.lcp |
+| L10.96 | R | implemented | Layout thrash — geometry read after DOM write, in a loop | R:perf.layout-thrash |
+| L10.97 | R | implemented | Memory leak — heap retained after GC across navigation | R:perf.memory-leak |
+| L10.98 | S | implemented | Unstable context value → re-render storm, memoisation dead | S:unstable-context-value |
+| L10.99 | S | gap | Unbounded list render | no detector for S |
+| L10.100 | S | deliberately-not-implemented | Bundle size regression | bundle-size-regression (10.100's runtime half): needs a per-repo build-output path; no universal baseline location in monorepos |
+| L10.101 | R | implemented | Preloaded resource never used — Chrome's own diagnostic, exact-matched (`perf.unused-preload`) | R:perf.unused-preload |
+
+## L11 — Verification integrity
+
+16 classes: 3 implemented, 0 partial, 0 deliberate, 5 gap, 8 not-automatable.
+
+| id | det | status | class | detail |
+|---|---|---|---|---|
+| L11.101 | H | not-automatable | Capture fires before render → the gate measures nothing † *"worse than no gate — it consumes the verification slot without occupying it"* | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone (but a detector exists: R:state.not-intercepted — atlas Det may be stale) |
+| L11.102 | H | not-automatable | Baseline captured from the buggy build → locks the bug in as correct | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L11.103 | H | not-automatable | An assertion that cannot fail (empty selector, truthy on undefined) | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L11.104 | R | implemented | The check ran against the wrong host or build | R:route.not-found-shell |
+| L11.105 | H | not-automatable | Test skipped or filtered, reported green | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone (but a detector exists: R:journey.load-failed — atlas Det may be stale) |
+| L11.106 | H | not-automatable | Claim inflation — report says 103, reality is 1 | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L11.107 | G | not-automatable | Verified at the wrong layer — API green, UI broken | generated journey — derived from the route×entity matrix (route×role sweep or a journey), not a standing rule (but a detector exists: R:journey.failed — atlas Det may be stale) |
+| L11.108 | H | not-automatable | Fixture regenerated from actual output → the test becomes a screenshot of the bug | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L11.109 | H | not-automatable | Gate returns "inconclusive" and is read as pass | human intent — the irreducible part; one question per entity, not automatable from source or the DOM alone |
+| L11.110 | S | gap | Route absent from the sweep because the route list is hardcoded | no detector for S |
+| L11.111 | R | implemented | The dark-mode pass could not run — the theme seeding itself threw, so "dark renders correctly" was never measured (`theme.check-failed`) | R:theme.check-failed |
+| L11.112 | R | implemented | The `--mutate` replay could not complete, so nothing is claimed about the write either way (`mutate.failed`) | R:crud.cleanup-failed, R:crud.cleanup-failed, R:crud.cleanup-failed |
+| L11.113 | R | gap | Import-walk vs request-log blind spot — the static import graph and the runtime request log disagree about what a route depends on, and neither is trusted as the superset of the other | no detector for R |
+| L11.114 | S | gap | Wrong-layer verification (of the harness itself) — a claim scoped to one detection mode (S or R) is verified using evidence produced by the other mode, and reported as if the claimed mode had actually run | no detector for S |
+| L11.115 | S | gap | Incomplete denominator — a pass/fail claim is reported without stating how many of what, or the denominator silently drops an unmeasured/unreached population instead of naming it | no detector for S |
+| L11.116 | S | gap | Unmeasured promoted to pass — a route, cell, or class the run never reached is folded into the passing count instead of `report.unreached` | no detector for S |
+
+## Reverse drift
+
+None today.
+## Deliberately not implemented, not linked to one class
+
+- **render-blocking-head-script** — fires on deliberately synchronous analytics snippets — "verify this is intentional" is not a defect claim
+- **indexeddb-open-error** — too narrow — apps touch IndexedDB through libraries that already handle it
+- **deterministic-rendering (render twice, diff)** — the noisiest possible rule: timestamps, counters, carousels and A/B buckets are legitimately non-deterministic
+- **CSRF-token-presence** — token-auth and SameSite-cookie architectures are both healthy without one; the absence proves nothing
+

package/references/atlas-v1.md

@@ -0,0 +1,318 @@
+# Frontend failure atlas
+
+> **FROZEN — this is atlas v1.** Every archive, fid, diff and external
+> consumer that predates atlas v2 resolves through this file and through
+> `lib/qa/atlas-v1.mjs`. Do not add, renumber, retitle or reword a row here —
+> that would reinterpret evidence that was already measured and already acted
+> on. The current taxonomy is `references/atlas.md` (v2); fix it there.
+
+Every way a frontend fails, organised by **pipeline position** — the order is
+information: a defect at L1 makes every check below it meaningless, because you
+are testing a build nobody is serving.
+
+Detection column:
+
+| | Meaning |
+|---|---|
+| **S** | Static. `classify.mjs` / `inventory.mjs`. Free, exhaustive, runs on save. |
+| **R** | Runtime invariant. `sweep.mjs` + `probe.js`. No per-feature authoring. |
+| **G** | Generated journey. Derived from the route×entity matrix. |
+| **H** | Human intent. The irreducible part — one question per entity. |
+| **A** | Architecture-dependent: applies only if you chose that architecture. |
+
+`†` = observed in this user's own session corpus (86 sessions, 532 findings).
+
+---
+
+## L1 — Delivery: the code under test is not the code being served
+
+Everything below L1 is void if L1 is wrong. Check it first, always.
+
+| # | Class | Det |
+|---|---|---|
+| 1.1 | Build-time env (`NEXT_PUBLIC_*`, `VITE_*`) set at runtime — never reaches the browser † | S |
+| 1.2 | CDN/edge cache not invalidated after deploy; old bundle still served † | R |
+| 1.3 | Two hosts serving different builds; health check green against a placeholder † | R |
+| 1.4 | Service worker serving a stale app shell | R |
+| 1.5 | `ChunkLoadError` — hashed chunk gone after deploy, open tabs break | R |
+| 1.6 | Wrong `basePath`/`assetPrefix` → every asset 404s | R |
+| 1.7 | Env var present in CI, absent in the runtime image | S |
+| 1.8 | Build succeeded with a stub/fallback module aliased in | S |
+| 1.9 | Verified on preview, shipped from prod — different pipeline † | H |
+| 1.10 | Route's first visit failed, retry succeeded — intermittent; reported as `route.flaky`, never as a silent pass | R |
+| 1.11 | Route reached only through two or more intermediate paths — a redirect chain, not a direct landing (`route.indirect-landing`; auth bounces are reported as unreached, not here) | R |
+
+## L2 — Arrival: the data never gets there
+
+| # | Class | Det |
+|---|---|---|
+| 2.10 | Request never fired (`enabled: false`, conditional hook) | R |
+| 2.11 | 401/403 — token not attached, or expired mid-session | R |
+| 2.12 | HTTP 200 with an empty array — wrong tenant or filter scope | G |
+| 2.13 | Only page 1 rendered; pagination never wired | G |
+| 2.14 | Race: the slower response overwrites the newer one | S+R |
+| 2.15 | Waterfall — dependent sequential fetches; partial at every instant | R |
+| 2.16 | Response applied after unmount; no `AbortController` | S |
+| 2.17 | Cache-key collision — two queries share one key | S |
+| 2.18 | Cache-key over-specificity — one entity cached under N key shapes | S |
+| 2.19 | Retry storm → rate limit → looks like "no data" | R |
+| 2.20 | CORS preflight failure — invisible behind a dev proxy | R |
+| 2.21 | Parse failure returns `undefined`, treated as empty | R |
+| 2.22 | Same-origin JSON array carried N>0 records; every list on the page rendered zero rows — the data arrived and was never rendered | R |
+| 2.23 | An endpoint TEMPLATE answered 5xx, aggregated across the cell rather than per response (`network.endpoint-5xx`) | R |
+| 2.24 | The same (method, endpoint template) fired 3+ times in one passive page load — a refetch loop or a missing cache key, with no user action to explain it (`network.duplicate-request`) | R |
+| 2.25 | Fewer distinct endpoint templates fired than the route's declared query hooks — the "suspiciously low, not zero" case 2.10 cannot see (`network.request-count-below-declared`; only filed when the import-graph join is trusted) | R |
+| 2.26 | A cross-origin request failed — a third-party script, font, analytics or CDN asset the page depends on (`network.requestfailed.external`) | R |
+
+## L3 — Synchronisation: data arrives, then diverges
+
+**The cross-page sync bug lives here.** `inventory.mjs syncRisks` finds most of
+it statically, with blast radius.
+
+| # | Class | Det |
+|---|---|---|
+| 3.22 | **Server entity copied into a client store** — a second source of truth the query cache cannot invalidate | S |
+| 3.23 | Mutation with no invalidation → every sibling view stale | S |
+| 3.24 | Invalidation targets the wrong key — nothing the written resource's readers query under; blast radius resolved | S |
+| 3.25 | Optimistic update never reconciled with server truth | G |
+| 3.26 | Optimistic update not rolled back on error | G |
+| 3.27 | Two components own one mutation; only one invalidates | S |
+| 3.28 | Derived state not recomputed — `useState(props.x)`, stale closure, dead memo | S |
+| 3.29 | Tearing — external store read without `useSyncExternalStore` under concurrent rendering | S |
+| 3.30 | Cross-tab divergence (no storage/broadcast sync) | A |
+| 3.31 | Realtime subscription not re-established after reconnect | A |
+| 3.32 | Form draft silently overwritten by a background refetch | G |
+| 3.33 | Deleted entity still referenced by a cached list | G |
+| 3.34 | Pagination cache not reset on filter change → mixed pages | G |
+| 3.35 | Write succeeded through the real form, then client-side navigation to a blast-radius route refetched nothing and shows the old value — 3.23/3.24 confirmed live (`--mutate`) | R |
+
+## L4 — Rendering and lifecycle
+
+| # | Class | Det |
+|---|---|---|
+| 4.34 | Missing loading state → empty shell paints first | S+R |
+| 4.35 | Missing error state → failure renders as empty, silently | S |
+| 4.36 | **Missing empty state → an empty list and a failed fetch are indistinguishable** | S+R |
+| 4.37 | Suspense boundary converts an error into a permanent spinner | R |
+| 4.38 | Error boundary catches and renders nothing | S |
+| 4.39 | Hydration mismatch — SSR output ≠ first client render | R |
+| 4.40 | List key collision (`key={index}`) → wrong row updates on reorder | S |
+| 4.41 | Effect dependency bug → infinite render, or never runs | S |
+| 4.42 | Conditional hook order violation | S |
+| 4.43 | Portal/modal escapes its theme or stacking context | R |
+| 4.44 | Virtualised list renders zero rows at certain heights | R |
+| 4.45 | Layout shift on data arrival (no reserved space) | R |
+
+## L5 — Value and serialisation: the leaks
+
+Cheapest class to detect, highest hit rate, almost nobody checks it.
+
+| # | Class | Det |
+|---|---|---|
+| 5.46 | `undefined` rendered as text † (this one reached a live API in prod) | R |
+| 5.47 | `NaN` rendered | R |
+| 5.48 | `[object Object]` rendered | R |
+| 5.49 | `Invalid Date` rendered | R |
+| 5.50 | The string `"null"` rendered | R |
+| 5.51 | Unresolved template variable † | R |
+| 5.52 | Timezone — the date shifts by a day | H |
+| 5.53 | Currency — cents/dollars confusion, float rounding | H |
+| 5.54 | Locale/number formatting inconsistent between views | H |
+| 5.55 | Unescaped HTML or raw markdown shown | S |
+| 5.56 | Truncation with no ellipsis or title | R |
+| 5.57 | Enum rendered raw (`in_progress`, not "In progress") | R |
+| 5.58 | Precision loss on large IDs (JS number vs int64) | H |
+
+## L6 — Interaction and control flow
+
+| # | Class | Det |
+|---|---|---|
+| 6.59 | **Double submit** — no pending guard → duplicate records | S |
+| 6.60 | Navigation during a pending mutation → lost write | G |
+| 6.61 | Back button does not restore list state, scroll, or filters | G |
+| 6.62 | Refresh on a deep link loses required state | G |
+| 6.63 | Unsaved-changes guard missing | S |
+| 6.64 | Interactive element covered by another element — clicks land on the occluder (`interact.click-occluded`; open dialogs and `pointer-events:none` overlays excluded) | R |
+| 6.65 | Focus lost after an action → keyboard user stranded | R |
+| 6.66 | Client validation passes; server rejects with an unhandled error shape | G |
+| 6.67 | Disabled state not conveyed — looks clickable, does nothing | R |
+| 6.68 | Async action with no feedback → the user clicks again | S |
+| 6.69 | A control the surface should render never appeared, waited for rather than raced (`interact.never-appeared`) | R |
+| 6.70 | A control appeared but was never clickable — a different defect from never appearing, and it needs a different fix (`interact.not-clickable`) | R |
+| 6.71 | **Inert affordance** — a control was clicked and nothing observable followed: no DOM mutation, no request, no navigation, no ARIA state change (`interact.inert-control`) | R |
+| 6.72 | Clicking a control throws — the handler errors where a user would click (`interact.click-error`) | R |
+
+## L7 — Access and identity
+
+| # | Class | Det |
+|---|---|---|
+| 7.69 | Role-gated route reachable by deep link | G |
+| 7.70 | UI hides an action the API allows — or shows one it denies | G |
+| 7.71 | Tenant scope missing from a query → cross-tenant leak | G |
+| 7.72 | Session expiry → redirect loop, or silent empty data | R |
+| 7.73 | Stale permissions cached after a role change | G |
+| 7.74 | XSS sink — unsanitised HTML injection | S |
+| 7.75 | Prototype pollution — merging untrusted payload into an object | S |
+| 7.76 | DOM clobbering — a named element shadowing a global | S |
+| 7.77 | CSP violation blocking a real resource | R |
+| 7.78 | `SameSite=None` cookie without `Secure` — the browser rejects it; auth silently absent (`security.cookie-samesite-none-insecure`) | R |
+
+## L8 — Responsive and layout
+
+| # | Class | Det |
+|---|---|---|
+| 8.79 | Horizontal scroll at 320/390 | R |
+| 8.80 | Overlap or clipping at a breakpoint | R |
+| 8.81 | Tap target < 24px — **excluding sr-only elements** † | R |
+| 8.82 | Long content (400-char name) breaks the layout | R |
+| 8.83 | Broken image with no fallback dimension | R |
+| 8.84 | Dark-mode override missed † | R |
+| 8.85 | Font swap shift | R |
+| 8.86 | Fixed height clips content at large text size or zoom | R |
+
+## L9 — Accessibility
+
+| # | Class | Det |
+|---|---|---|
+| 9.87 | Contrast below threshold | R |
+| 9.88 | Control with no accessible name | R |
+| 9.89 | Keyboard trap, or unreachable control | R |
+| 9.90 | Focus order does not follow visual order | R |
+| 9.91 | No visible focus ring | R |
+| 9.92 | Async result with no live region | S |
+
+## L10 — Performance
+
+| # | Class | Det |
+|---|---|---|
+| 10.93 | Long task > 200ms — input blocked for that window (INP) | R |
+| 10.94 | CLS > 0.1 — content moves under the cursor | R |
+| 10.95 | LCP > 2500ms | R |
+| 10.96 | Layout thrash — geometry read after DOM write, in a loop | R |
+| 10.97 | Memory leak — heap retained after GC across navigation | R |
+| 10.98 | Unstable context value → re-render storm, memoisation dead | S |
+| 10.99 | Unbounded list render | S |
+| 10.100 | Bundle size regression | S |
+| 10.101 | Preloaded resource never used — Chrome's own diagnostic, exact-matched (`perf.unused-preload`) | R |
+
+## L11 — The check itself
+
+**The highest-leverage layer and the one nobody writes down.** Every class here
+makes the layers above report green while broken.
+
+| # | Class | Det |
+|---|---|---|
+| 11.101 | Capture fires before render → the gate measures nothing † *"worse than no gate — it consumes the verification slot without occupying it"* | H |
+| 11.102 | Baseline captured from the buggy build → locks the bug in as correct | H |
+| 11.103 | An assertion that cannot fail (empty selector, truthy on undefined) | H |
+| 11.104 | The check ran against the wrong host or build † | R |
+| 11.105 | Test skipped or filtered, reported green | H |
+| 11.106 | Claim inflation — report says 103, reality is 1 † | H |
+| 11.107 | **Verified at the wrong layer — API green, UI broken** † | G |
+| 11.108 | Fixture regenerated from actual output → the test becomes a screenshot of the bug † | H |
+| 11.109 | Gate returns "inconclusive" and is read as pass | H |
+| 11.110 | Route absent from the sweep because the route list is hardcoded | S |
+| 11.111 | The dark-mode pass could not run — the theme seeding itself threw, so "dark renders correctly" was never measured (`theme.check-failed`) | R |
+| 11.112 | The `--mutate` replay could not complete, so nothing is claimed about the write either way (`mutate.failed`) | R |
+
+11.107 is the mechanism behind "Claude said it was built": the API was checked,
+it answered correctly, and the UI had no password field because the env var was
+inlined at build time. Verification at one layer says nothing about the layer
+above it.
+
+---
+
+## The advanced concept list, sorted by what you can do with it
+
+Concepts split three ways. Only the middle column is testable — but the first
+column is what tells you **where to place the probe**, so it is not wasted.
+
+### Mechanisms — explain why a class exists; not themselves testable
+
+Reconciliation · Fiber · virtual DOM diffing · structural sharing · referential
+equality · immutable data patterns · event loop (macro/microtasks) · scheduler
+priorities · time slicing · concurrent rendering · critical rendering path ·
+paint vs composite vs layout · browser compositing layers · GPU acceleration ·
+subpixel rendering · tree shaking internals · garbage collection timing ·
+accessibility tree · virtual DOM complexity · priority inversion
+
+Read these to know *why* `key={index}` corrupts rows (reconciliation), why a new
+object literal kills memoisation (referential equality), why a geometry read
+after a write stalls (layout → paint → composite ordering).
+
+### Observable — these ARE the runtime probes
+
+| Concept | Becomes | Atlas |
+|---|---|---|
+| Hydration / selective hydration | React #418/#423/#425 in console; click before hydrate is dropped | 4.39 |
+| Tearing in concurrent UI | external store read without `useSyncExternalStore` | 3.29 |
+| Stale closure problem | effect with `[]` deps reading state | 3.28 |
+| Memoisation pitfalls | Provider value is a fresh literal each render | 10.98 |
+| Layout thrashing | geometry reads interleaved with writes in one frame | 10.96 |
+| Long tasks API / FID / INP | longest task > 200ms | 10.93 |
+| CLS / LCP | PerformanceObserver, buffered | 10.94-95 |
+| Detached DOM nodes / leak detection | heap retained after GC across navigation | 10.97 |
+| `ResizeObserver` loop limit | its own console error — free once console is a gate | 4.41 |
+| `MutationObserver` cost | forced-reflow counter | 10.96 |
+| Render waterfalls | dependent request chain ≥ 3 | 2.15 |
+| `AbortController` | fetch in effect without a signal | 2.16 |
+| Backpressure / streaming fetch | unconsumed reader → stalled render | 2.21 |
+| Task starvation | long task + no yield | 10.93 |
+| Service Worker lifecycle traps | stale app shell; buildId mismatch | 1.4 |
+| Cache invalidation / SWR / ETag vs Cache-Control | response headers on the sweep | 1.2 |
+| Code splitting / dynamic import chunking | `ChunkLoadError` | 1.5 |
+| CORS preflight | failed OPTIONS | 2.20 |
+| CSP / Trusted Types | `securitypolicyviolation` | 7.77 |
+| SameSite cookie modes | cookie attributes after login | 7.78 |
+| XSS / CSRF / DOM clobbering / prototype pollution | static sink detection | 7.74-76 |
+| Race conditions in UI state | two fetches, slower wins | 2.14 |
+| Optimistic UI rollback | mutate → force error → assert revert | 3.26 |
+| Idempotent UI actions | double-submit guard | 6.59 |
+| Deterministic rendering | render twice, diff | 11.103 |
+| Preload / prefetch / preconnect, priority hints | resource timing on the sweep | 10.95 |
+| IndexedDB | quota + upgrade failure paths | A |
+| ARIA live regions | async result with no announcement | 9.92 |
+| Pointer events | tap target + hit testing | 8.81 |
+| Speculative prerendering | double-fired effects on prerender | A |
+
+### Architecture — change which classes apply, not what you check
+
+Islands · partial hydration · streaming SSR · server components · edge rendering
+· micro-frontend orchestration · module federation · Shadow DOM · custom
+elements · Web Components interop · Web Workers vs Service Workers ·
+`SharedArrayBuffer` · transferable objects · `OffscreenCanvas` · WebAssembly ·
+WebRTC · CRDTs · event sourcing · finite state modelling · offline conflict
+resolution · CSS containment
+
+Pick one and a whole column of classes switches on. Islands and partial
+hydration make 4.39 and "click before hydrate" primary. Micro-frontends and
+module federation make 1.3 (two hosts, different builds) a weekly event. CRDTs
+and offline make 3.30-3.31 the dominant risk. **Configuration, not new code.**
+
+---
+
+## Evaluated and deliberately not implemented
+
+Each of these was specced far enough to know why it must not ship yet. A rule
+that fires on healthy apps costs more than the class it catches.
+
+| Check | Why not |
+|---|---|
+| duplicate-in-flight-request (2.14's runtime half) | needs a proven guard separating React StrictMode's double-invoke from a real race; ship only with a StrictMode fixture asserted silent |
+| bundle-size-regression (10.100's runtime half) | needs a per-repo build-output path; no universal baseline location in monorepos |
+| render-blocking-head-script | fires on deliberately synchronous analytics snippets — "verify this is intentional" is not a defect claim |
+| missing-live-region-for-async-status (9.92) | scoping unresolved: a live region far from the toast is still a live region; the conservative gate leaves mostly misses |
+| indexeddb-open-error | too narrow — apps touch IndexedDB through libraries that already handle it |
+| deterministic-rendering (render twice, diff) | the noisiest possible rule: timestamps, counters, carousels and A/B buckets are legitimately non-deterministic |
+| CSRF-token-presence | token-auth and SameSite-cookie architectures are both healthy without one; the absence proves nothing |
+
+## Adding a class
+
+1. Reproduce it once, by hand.
+2. Add the rule to `classify.mjs` (S) or `probe.js` (R).
+3. Plant an instance in `references/fixture.html` or `selftest-static.sh`.
+4. Confirm the selftest **fails without the fix and passes with it**.
+5. Give it a number here.
+
+Step 4 is the one people skip, and skipping it produces 11.103 — a rule that
+occupies the verification slot while asserting nothing.