create-backlist 10.0.2 → 10.0.4

package/src/qa/qa-engine.js

@@ -1,1450 +1,912 @@
 // ═══════════════════════════════════════════════════════════════════════════
-//  Backlist QA Engine — qa-engine.js  v10.0
-//  Full live QA runtime: manual + automated + URL-based browser QA
+//  Backlist Enterprise AI QA Platform — qa-engine.js  v12.0
 //  Copyright (c) W.A.H.ISHAN — MIT License
 //
-//  NEW in v10.0:
-//  ✦ URL-based QA — test localhost AND production simultaneously
-//  ✦ Real HTTP endpoint probing (fetch-based, no browser needed)
-//  ✦ Auto route crawler — discovers pages from sitemap / common paths
-//  ✦ Response time p50/p95/p99 benchmarking per route
-//  ✦ Security header scanner (CSP, CORS, X-Frame, HSTS, etc.)
-//  ✦ Auth flow validator (login / protected route / token check)
-//  ✦ Broken link detector across crawled pages
-//  ✦ SEO meta tag validator per page
-//  ✦ Accessibility quick-check (meta viewport, lang attr, alt probes)
-//  ✦ Mobile responsiveness header check
-//  ✦ Console error simulation via HTML response parsing
-//  ✦ Rich HTML report v10 with Chart.js + timeline + per-page cards
-//  ✦ Dual-URL diff report (localhost vs production)
-//  ✦ JSON CI output with exit-code propagation
-//  ✦ All v9.0 features retained
+//  REAL RUNTIME TESTING — NO FAKE DATA
+//  Every result is collected from actual browser execution
 // ═══════════════════════════════════════════════════════════════════════════
 
-import * as p    from '@clack/prompts';
-import chalk     from 'chalk';
-import fs        from 'fs-extra';
-import path      from 'node:path';
-import os        from 'node:os';
-import http      from 'node:http';
-import https     from 'node:https';
-import { URL }   from 'node:url';
-import { EventEmitter } from 'node:events';
+import * as p           from '@clack/prompts';
+import chalk            from 'chalk';
+import fs               from 'fs-extra';
+import path             from 'node:path';
+import os               from 'node:os';
 import { performance }  from 'node:perf_hooks';
+import { EventEmitter } from 'node:events';
 
-// ── Constants ─────────────────────────────────────────────────────────────
+import { SmartCrawler }        from './browser/crawler.js';
+import { BrowserInteractor }   from './browser/interactions.js';
+import { ScreenshotCapture }   from './browser/screenshot.js';
+import { RealAPIValidator }    from './analyzers/api.js';
+import { SecurityScanner }     from './analyzers/security.js';
+import { PerformanceProfiler } from './analyzers/performance.js';
+import { AccessibilityChecker} from './analyzers/accessibility.js';
+import { SEOScanner }          from './analyzers/seo.js';
+import { HTMLReporter }        from './reporters/html.js';
+import { TerminalDashboard }   from './reporters/terminal.js';
+import { JSONReporter }        from './reporters/json.js';
+import { AIClassifier }        from './utils/ai-classifier.js';
 
-const VERSION        = '10.0.0';
-const QA_DIR         = path.join(process.cwd(), '.backlist', 'qa');
-const HISTORY_FILE   = path.join(QA_DIR, 'history.json');
-const REPORT_DIR     = path.join(QA_DIR, 'reports');
-
-const SEVERITY_LEVELS    = { P0: 'Critical', P1: 'High', P2: 'Medium', P3: 'Low' };
-const TEST_TYPES         = ['happy-path', 'validation', 'auth', 'edge-case', 'performance', 'security', 'e2e', 'ui', 'seo', 'a11y', 'links', 'http'];
-const DEFAULT_TIMEOUT_MS = 15_000;
-const HTTP_TIMEOUT_MS    = 8_000;
-const FLAKY_RETRY_COUNT  = 2;
-const WATCH_INTERVAL_MS  = 30_000;
-
-// ── Common routes to probe ────────────────────────────────────────────────
-const COMMON_ROUTES = [
-  '/', '/login', '/register', '/dashboard', '/dashboard/analytics',
-  '/dashboard/sales', '/profile', '/settings', '/admin', '/about',
-  '/contact', '/api/health', '/api/status', '/api/v1/health',
-  '/sitemap.xml', '/robots.txt', '/favicon.ico',
-];
-
-// ── Security headers to check ─────────────────────────────────────────────
-const SECURITY_HEADERS = [
-  { header: 'content-security-policy',   label: 'CSP',          sev: 'P1' },
-  { header: 'x-frame-options',           label: 'X-Frame',      sev: 'P1' },
-  { header: 'x-content-type-options',    label: 'X-Content',    sev: 'P2' },
-  { header: 'strict-transport-security', label: 'HSTS',         sev: 'P1' },
-  { header: 'referrer-policy',           label: 'Referrer',     sev: 'P2' },
-  { header: 'permissions-policy',        label: 'Permissions',  sev: 'P3' },
-  { header: 'access-control-allow-origin', label: 'CORS',       sev: 'P2' },
-];
-
-// ── ANSI escape helpers ───────────────────────────────────────────────────
-const ESC         = '\x1b[';
-const CLEAR_LINE  = ESC + '2K\r';
-const CURSOR_UP   = (n) => ESC + `${n}A`;
-const CURSOR_HIDE = ESC + '?25l';
-const CURSOR_SHOW = ESC + '?25h';
-const BOLD        = chalk.bold;
-const DIM         = chalk.dim;
+// ── Constants ─────────────────────────────────────────────────────────────
+export const VERSION      = '12.0.0';
+export const QA_DIR       = path.join(process.cwd(), '.backlist', 'qa');
+export const REPORT_DIR   = path.join(QA_DIR, 'reports');
+export const HISTORY_FILE = path.join(QA_DIR, 'history.json');
+export const SCREENSHOT_DIR = path.join(REPORT_DIR, 'screenshots');
 
 // ── Utilities ─────────────────────────────────────────────────────────────
-function timestamp()     { return new Date().toISOString(); }
-function shortId()       { return Math.random().toString(36).slice(2, 9); }
-function sleep(ms)       { return new Promise(r => setTimeout(r, ms)); }
-function pluralize(n, w) { return `${n} ${n === 1 ? w : w + 's'}`; }
-
-function colorSeverity(sev) {
-  return ({ P0: chalk.red.bold, P1: chalk.yellow.bold, P2: chalk.cyan, P3: chalk.gray }[sev] ?? chalk.white)(sev);
-}
-
-function colorStatus(status) {
-  return ({
-    PASS  : chalk.green('✓ PASS'),
-    FAIL  : chalk.red('✗ FAIL'),
-    SKIP  : chalk.gray('⊘ SKIP'),
-    FLAKY : chalk.yellow('⚠ FLAKY'),
-    RUN   : chalk.cyan('⟳ RUN'),
-  })[status] ?? status;
-}
-
-function buildProgressBar(pct, width = 20) {
-  const filled = Math.min(Math.round((pct / 100) * width), width);
-  const empty  = width - filled;
-  const color  = pct >= 90 ? chalk.green : pct >= 70 ? chalk.yellow : chalk.red;
-  return color('█'.repeat(filled)) + chalk.gray('░'.repeat(empty));
-}
-
-function formatDuration(ms) {
-  if (ms < 1000) return `${ms}ms`;
+export function timestamp()     { return new Date().toISOString(); }
+export function shortId()       { return Math.random().toString(36).slice(2, 9); }
+export function sleep(ms)       { return new Promise(r => setTimeout(r, ms)); }
+export function formatDuration(ms) {
+  if (ms < 1000) return `${Math.round(ms)}ms`;
   return `${(ms / 1000).toFixed(2)}s`;
 }
-
-function formatBytes(b) {
+export function formatBytes(b) {
+  if (!b || b < 0) return '0B';
   if (b < 1024)        return `${b}B`;
   if (b < 1024 * 1024) return `${(b / 1024).toFixed(1)}KB`;
   return `${(b / 1024 / 1024).toFixed(1)}MB`;
 }
 
-function getSystemStats() {
-  const mem    = process.memoryUsage();
-  const heapMB = (mem.heapUsed / 1024 / 1024).toFixed(1);
-  const rss    = formatBytes(mem.rss);
-  const uptime = process.uptime().toFixed(1);
-  return { heapMB, rss, uptime };
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-//  v10.0: HTTP Probe Engine
-// ─────────────────────────────────────────────────────────────────────────
-
-export class HttpProbe {
-  #baseUrl;
-  #agent;
-
-  constructor(baseUrl) {
-    this.#baseUrl = baseUrl.replace(/\/$/, '');
-    const isHttps = baseUrl.startsWith('https');
-    this.#agent = isHttps
-      ? new https.Agent({ rejectUnauthorized: false, timeout: HTTP_TIMEOUT_MS })
-      : new http.Agent({ timeout: HTTP_TIMEOUT_MS });
+// ── QA Session ────────────────────────────────────────────────────────────
+export class QASession {
+  id;
+  startedAt;
+  urls = {};
+  results    = [];  // real test results only
+  bugs       = [];  // real detected bugs only
+  screenshots = []; // real screenshots
+  consoleErrors = [];
+  networkLog  = [];
+  apiLog      = [];
+  routeMap    = [];
+  perfMetrics = {};
+  secFindings = [];
+  a11yResults = [];
+  seoResults  = [];
+
+  constructor(urls) {
+    this.id        = `QA-${shortId()}`;
+    this.startedAt = timestamp();
+    this.urls      = urls;
+  }
+
+  addResult(result) {
+    this.results.push(result);
+  }
+
+  addBug(bug) {
+    this.bugs.push({ ...bug, id: `BUG-${shortId()}`, createdAt: timestamp() });
+  }
+
+  getSummary() {
+    const passed  = this.results.filter(r => r.status === 'PASS').length;
+    const failed  = this.results.filter(r => r.status === 'FAIL').length;
+    const skipped = this.results.filter(r => r.status === 'SKIP').length;
+    const flaky   = this.results.filter(r => r.status === 'FLAKY').length;
+    const total   = this.results.length;
+    return {
+      total, passed, failed, skipped, flaky,
+      passRate: total > 0 ? ((passed + flaky) / total * 100).toFixed(1) : '0.0',
+      duration: Date.now() - new Date(this.startedAt).getTime(),
+    };
   }
+}
 
-  async fetch(route = '/', options = {}) {
-    const url  = this.#baseUrl + route;
-    const t0   = performance.now();
+// ── Main QA Engine ────────────────────────────────────────────────────────
+export class QAEngine extends EventEmitter {
+  #session;
+  #terminal;
+  #crawler;
+  #interactor;
+  #screenshotter;
+  #apiValidator;
+  #security;
+  #performance;
+  #a11y;
+  #seo;
+  #aiClassifier;
+  #aborted = false;
+
+  constructor(session, options = {}) {
+    super();
+    this.#session      = session;
+    this.#terminal     = new TerminalDashboard(session);
+    this.#screenshotter = new ScreenshotCapture(SCREENSHOT_DIR);
+    this.#aiClassifier  = new AIClassifier();
+  }
+
+  async init() {
+    // Dynamically import Playwright — optional peer dependency
+    let playwright;
     try {
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
-      const res = await fetch(url, {
-        signal : controller.signal,
-        headers: { 'User-Agent': 'Backlist-QA/10.0', ...options.headers },
-        method : options.method || 'GET',
-        ...(options.body ? { body: options.body } : {}),
-      });
-      clearTimeout(timer);
-      const duration = Math.round(performance.now() - t0);
-      const headers  = {};
-      res.headers.forEach((v, k) => { headers[k] = v; });
-      const text = options.readBody ? await res.text().catch(() => '') : '';
-      return { ok: true, status: res.status, headers, duration, url, text };
-    } catch (err) {
-      const duration = Math.round(performance.now() - t0);
-      return { ok: false, status: 0, headers: {}, duration, url, error: err.message };
+      playwright = await import('playwright');
+    } catch {
+      throw new Error(
+        'Playwright not installed. Run: npm install playwright && npx playwright install chromium'
+      );
     }
-  }
 
-  async probeRoutes(routes = COMMON_ROUTES) {
-    const results = [];
-    for (const route of routes) {
-      const r = await this.fetch(route, { readBody: true });
-      results.push({ route, ...r });
-    }
-    return results;
-  }
+    this.#crawler     = new SmartCrawler(playwright);
+    this.#interactor  = new BrowserInteractor(playwright, this.#session);
+    this.#apiValidator = new RealAPIValidator(this.#session);
+    this.#security    = new SecurityScanner(this.#session);
+    this.#performance = new PerformanceProfiler(this.#session);
+    this.#a11y        = new AccessibilityChecker(playwright, this.#session);
+    this.#seo         = new SEOScanner(this.#session);
 
-  async checkSecurityHeaders(route = '/') {
-    const r = await this.fetch(route);
-    if (!r.ok && r.status === 0) return { ok: false, results: [], error: r.error };
-    const results = SECURITY_HEADERS.map(({ header, label, sev }) => ({
-      header, label, sev,
-      present: header in r.headers,
-      value  : r.headers[header] || null,
-    }));
-    return { ok: true, results };
-  }
-
-  async benchmarkRoute(route = '/', samples = 5) {
-    const timings = [];
-    for (let i = 0; i < samples; i++) {
-      const r = await this.fetch(route);
-      if (r.ok || r.status > 0) timings.push(r.duration);
-      await sleep(100);
-    }
-    if (!timings.length) return { p50: 0, p95: 0, p99: 0, avg: 0, samples: 0 };
-    timings.sort((a, b) => a - b);
-    const p = (pct) => timings[Math.min(Math.floor(timings.length * pct / 100), timings.length - 1)];
-    return {
-      p50    : p(50),
-      p95    : p(95),
-      p99    : p(99),
-      avg    : Math.round(timings.reduce((a, b) => a + b, 0) / timings.length),
-      samples: timings.length,
-    };
+    await this.#interactor.launch();
+    await this.#screenshotter.init();
   }
 
-  async checkSEO(route = '/') {
-    const r = await this.fetch(route, { readBody: true });
-    if (!r.ok && r.status === 0) return { ok: false, checks: [] };
-    const html = r.text || '';
-    const checks = [
-      { name: 'Title tag',       pass: /<title[^>]*>[^<]+<\/title>/i.test(html), sev: 'P1' },
-      { name: 'Meta description',pass: /<meta[^>]+name=["']description["'][^>]*>/i.test(html), sev: 'P2' },
-      { name: 'H1 tag',          pass: /<h1[^>]*>[^<]+<\/h1>/i.test(html), sev: 'P1' },
-      { name: 'Viewport meta',   pass: /<meta[^>]+name=["']viewport["'][^>]*>/i.test(html), sev: 'P1' },
-      { name: 'Lang attribute',  pass: /<html[^>]+lang=["'][^"']+["']/i.test(html), sev: 'P2' },
-      { name: 'Canonical link',  pass: /<link[^>]+rel=["']canonical["'][^>]*>/i.test(html), sev: 'P2' },
-      { name: 'OG meta tags',    pass: /<meta[^>]+property=["']og:/i.test(html), sev: 'P3' },
-    ];
-    return { ok: true, checks, statusCode: r.status };
-  }
+  async run() {
+    this.#terminal.start();
+    this.emit('session:start', this.#session);
 
-  get baseUrl() { return this.#baseUrl; }
-}
+    try {
+      // Phase 1 — Discovery
+      this.#terminal.setPhase('🔍 Phase 1: Route Discovery & Crawling');
+      await this.#phaseDiscovery();
 
-// ─────────────────────────────────────────────────────────────────────────
-//  v10.0: URL-Based QA Test Suite Builder
-// ─────────────────────────────────────────────────────────────────────────
+      // Phase 2 — API Validation
+      this.#terminal.setPhase('📡 Phase 2: Real API Validation');
+      await this.#phaseAPIValidation();
 
-function buildUrlTestSuite(probe, label = 'target') {
-  const tests = [];
-
-  // ── Connectivity ──────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: `[${label}] Homepage reachable`, type: 'http', sev: 'P0', fn: async () => {
-    const r = await probe.fetch('/');
-    if (!r.ok && r.status === 0) throw new Error(`Connection failed: ${r.error}`);
-    if (r.status >= 500) throw new Error(`Server error: HTTP ${r.status}`);
-  }});
-
-  tests.push({ id: shortId(), name: `[${label}] API health endpoint`, type: 'http', sev: 'P0', fn: async () => {
-    const candidates = ['/api/health', '/api/status', '/api/v1/health', '/health'];
-    let found = false;
-    for (const c of candidates) {
-      const r = await probe.fetch(c);
-      if (r.status >= 200 && r.status < 400) { found = true; break; }
-    }
-    if (!found) throw new Error('No reachable API health endpoint found');
-  }});
-
-  tests.push({ id: shortId(), name: `[${label}] 404 handler works`, type: 'http', sev: 'P2', fn: async () => {
-    const r = await probe.fetch('/this-page-does-not-exist-qa-test-' + shortId());
-    if (r.status !== 404) throw new Error(`Expected 404, got ${r.status}`);
-  }});
-
-  // ── Security Headers ──────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: `[${label}] Security headers scan`, type: 'security', sev: 'P1', fn: async () => {
-    const scan = await probe.checkSecurityHeaders('/');
-    if (!scan.ok) throw new Error(`Could not reach server: ${scan.error}`);
-    const critical = scan.results.filter(r => !r.present && (r.sev === 'P0' || r.sev === 'P1'));
-    if (critical.length > 0) {
-      throw new Error(`Missing critical headers: ${critical.map(r => r.label).join(', ')}`);
-    }
-  }});
+      // Phase 3 — Browser Interactions
+      this.#terminal.setPhase('🖱️  Phase 3: Browser Interaction Testing');
+      await this.#phaseBrowserInteractions();
 
-  tests.push({ id: shortId(), name: `[${label}] HTTPS redirect check`, type: 'security', sev: 'P1', fn: async () => {
-    const r = await probe.fetch('/');
-    if (probe.baseUrl.startsWith('http://') && r.status === 200) {
-      throw new Error('HTTP serving without redirect — HTTPS not enforced');
-    }
-  }});
-
-  // ── Authentication ────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: `[${label}] Login page accessible`, type: 'auth', sev: 'P1', fn: async () => {
-    const candidates = ['/login', '/auth/login', '/signin', '/auth', '/user/login'];
-    let found = false;
-    for (const c of candidates) {
-      const r = await probe.fetch(c);
-      if (r.status >= 200 && r.status < 400) { found = true; break; }
-    }
-    if (!found) throw new Error('No login page found at common paths');
-  }});
-
-  tests.push({ id: shortId(), name: `[${label}] Protected route redirects`, type: 'auth', sev: 'P0', fn: async () => {
-    const candidates = ['/dashboard', '/admin', '/profile', '/settings'];
-    for (const c of candidates) {
-      const r = await probe.fetch(c);
-      if (r.status === 200) {
-        const html = r.text || '';
-        const hasAuthBlock = /login|signin|unauthorized|forbidden|redirect/i.test(html);
-        if (!hasAuthBlock) throw new Error(`${c} appears accessible without auth (HTTP ${r.status})`);
-      }
-    }
-  }});
-
-  // ── Performance ───────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: `[${label}] Homepage response time < 3s`, type: 'performance', sev: 'P1', fn: async () => {
-    const bench = await probe.benchmarkRoute('/', 3);
-    if (bench.avg > 3000) throw new Error(`Avg response ${bench.avg}ms exceeds 3000ms threshold`);
-  }});
-
-  tests.push({ id: shortId(), name: `[${label}] API latency p95 < 1s`, type: 'performance', sev: 'P2', fn: async () => {
-    const candidates = ['/api/health', '/api/status', '/api/v1/health'];
-    for (const c of candidates) {
-      const r = await probe.fetch(c);
-      if (r.status > 0) {
-        const bench = await probe.benchmarkRoute(c, 3);
-        if (bench.p95 > 1000) throw new Error(`p95 latency ${bench.p95}ms on ${c} exceeds 1000ms`);
-        return;
-      }
-    }
-  }});
-
-  // ── SEO ───────────────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: `[${label}] Homepage SEO tags`, type: 'seo', sev: 'P1', fn: async () => {
-    const seo = await probe.checkSEO('/');
-    if (!seo.ok) throw new Error('Could not fetch homepage');
-    const failing = seo.checks.filter(c => !c.pass && c.sev === 'P1');
-    if (failing.length > 0) throw new Error(`Missing SEO tags: ${failing.map(c => c.name).join(', ')}`);
-  }});
-
-  tests.push({ id: shortId(), name: `[${label}] robots.txt accessible`, type: 'seo', sev: 'P2', fn: async () => {
-    const r = await probe.fetch('/robots.txt');
-    if (r.status !== 200) throw new Error(`robots.txt returned ${r.status}`);
-  }});
-
-  // ── Accessibility ─────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: `[${label}] Viewport meta tag`, type: 'a11y', sev: 'P1', fn: async () => {
-    const r = await probe.fetch('/', { readBody: true });
-    if (!r.ok && r.status === 0) throw new Error('Could not fetch homepage');
-    if (!/<meta[^>]+name=["']viewport["']/i.test(r.text || '')) {
-      throw new Error('Missing viewport meta tag — mobile responsiveness broken');
-    }
-  }});
+      // Phase 4 — Security Scan
+      this.#terminal.setPhase('🛡️  Phase 4: Security Deep Scan');
+      await this.#phaseSecurityScan();
 
-  tests.push({ id: shortId(), name: `[${label}] HTML lang attribute`, type: 'a11y', sev: 'P2', fn: async () => {
-    const r = await probe.fetch('/', { readBody: true });
-    if (!r.ok && r.status === 0) throw new Error('Could not fetch homepage');
-    if (!/<html[^>]+lang=["'][^"']+["']/i.test(r.text || '')) {
-      throw new Error('Missing lang attribute on <html> — screen reader accessibility issue');
-    }
-  }});
-
-  // ── Common routes ─────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: `[${label}] Core routes return non-500`, type: 'e2e', sev: 'P1', fn: async () => {
-    const routes = ['/', '/login', '/about', '/contact'];
-    const errors = [];
-    for (const route of routes) {
-      const r = await probe.fetch(route);
-      if (r.status >= 500) errors.push(`${route} → ${r.status}`);
-    }
-    if (errors.length > 0) throw new Error(`Server errors: ${errors.join(', ')}`);
-  }});
-
-  tests.push({ id: shortId(), name: `[${label}] sitemap.xml or sitemap`, type: 'seo', sev: 'P3', fn: async () => {
-    const r = await probe.fetch('/sitemap.xml');
-    if (r.status !== 200) throw new Error(`sitemap.xml returned ${r.status}`);
-  }});
-
-  // ── Content-Type ──────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: `[${label}] HTML content-type correct`, type: 'http', sev: 'P2', fn: async () => {
-    const r = await probe.fetch('/');
-    if (!r.ok && r.status === 0) throw new Error('Connection failed');
-    const ct = r.headers['content-type'] || '';
-    if (!ct.includes('text/html')) throw new Error(`Expected text/html, got: ${ct}`);
-  }});
-
-  tests.push({ id: shortId(), name: `[${label}] API returns JSON`, type: 'http', sev: 'P2', fn: async () => {
-    const candidates = ['/api/health', '/api/status', '/api/v1/health'];
-    for (const c of candidates) {
-      const r = await probe.fetch(c);
-      if (r.status > 0 && r.status < 500) {
-        const ct = r.headers['content-type'] || '';
-        if (!ct.includes('json')) throw new Error(`${c} does not return JSON (${ct})`);
-        return;
-      }
-    }
-  }});
+      // Phase 5 — Performance
+      this.#terminal.setPhase('⚡ Phase 5: Performance Profiling');
+      await this.#phasePerformance();
 
-  return tests;
-}
+      // Phase 6 — Accessibility
+      this.#terminal.setPhase('♿ Phase 6: Accessibility Testing');
+      await this.#phaseAccessibility();
 
-// ─────────────────────────────────────────────────────────────────────────
-//  v10.0: Run URL-Based QA
-// ─────────────────────────────────────────────────────────────────────────
+      // Phase 7 — SEO
+      this.#terminal.setPhase('🔎 Phase 7: SEO Validation');
+      await this.#phaseSEO();
 
-export async function runUrlQA({ localUrl, prodUrl, silent = false } = {}) {
-  const runId     = `UQA-${shortId()}`;
-  const startedAt = timestamp();
-  const allTests  = [];
-  const probes    = [];
+      // Phase 8 — AI Bug Classification
+      this.#terminal.setPhase('🤖 Phase 8: AI Bug Classification');
+      await this.#phaseAIClassification();
 
-  if (!localUrl && !prodUrl) {
-    console.log(chalk.red('  No URLs provided. Use --url=http://localhost:3000 or pass { localUrl, prodUrl }.'));
-    return null;
-  }
+    } catch (err) {
+      this.emit('engine:error', err);
+      throw err;
+    } finally {
+      this.#terminal.stop();
+      await this.#interactor.close().catch(() => {});
+    }
 
-  if (!silent) {
-    console.log('');
-    console.log(chalk.hex('#00F5FF').bold('  ── 🌐 URL-Based QA Scan v10.0 ─────────────────────────'));
-    console.log('');
+    return this.#session;
   }
 
-  if (localUrl) {
-    const probe = new HttpProbe(localUrl);
-    probes.push({ probe, label: 'localhost', url: localUrl });
-    if (!silent) console.log(chalk.gray(`  → Probing localhost: ${localUrl}`));
-  }
-  if (prodUrl) {
-    const probe = new HttpProbe(prodUrl);
-    probes.push({ probe, label: 'production', url: prodUrl });
-    if (!silent) console.log(chalk.gray(`  → Probing production: ${prodUrl}`));
+  abort() {
+    this.#aborted = true;
+    this.#terminal.stop();
+    this.#interactor.close().catch(() => {});
   }
 
-  for (const { probe, label } of probes) {
-    allTests.push(...buildUrlTestSuite(probe, label));
-  }
+  // ── Phase 1: Discovery ─────────────────────────────────────────────────
+  async #phaseDiscovery() {
+    for (const [label, url] of Object.entries(this.#session.urls)) {
+      if (!url) continue;
+      this.#terminal.log(`Crawling ${label}: ${url}`);
 
-  if (!silent) {
-    console.log(chalk.gray(`\n  Building HTTP test suite: ${allTests.length} tests across ${probes.length} target(s)\n`));
-  }
+      const routes = await this.#crawler.crawl(url, {
+        maxPages   : 60,
+        maxDepth   : 4,
+        onRoute    : (route) => {
+          this.#session.routeMap.push(route);
+          this.#terminal.log(`  Found: ${route.url} (${route.type})`);
+        },
+      });
 
-  const dashboard = silent ? null : new LiveDashboard();
-  const runner    = new TestRunner();
-  const autoBugs  = [];
-
-  runner.on('result', r => {
-    if (r.status === 'FAIL') {
-      autoBugs.push({
-        id         : `HTTP-${shortId()}`,
-        title      : r.name,
-        severity   : r.sev || (r.type === 'security' || r.type === 'auth' ? 'P0' : 'P2'),
-        status     : 'OPEN',
-        description: r.error || '',
-        createdAt  : timestamp(),
+      this.#addResult({
+        name    : `[${label}] Route Discovery`,
+        type    : 'discovery',
+        category: 'crawl',
+        status  : routes.length > 0 ? 'PASS' : 'FAIL',
+        message : routes.length > 0
+          ? `Discovered ${routes.length} routes`
+          : 'No routes discovered — site may be unreachable',
+        data    : { routeCount: routes.length, routes },
+        url,
+        label,
       });
     }
-  });
+  }
+
+  // ── Phase 2: Real API Validation ───────────────────────────────────────
+  async #phaseAPIValidation() {
+    const apiRoutes = this.#session.routeMap.filter(r =>
+      r.type === 'api' || r.url.includes('/api/')
+    );
 
-  if (dashboard) dashboard.start();
-  const results = await runner.run(allTests, dashboard);
-  if (dashboard) dashboard.stop();
+    this.#terminal.log(`Validating ${apiRoutes.length} API endpoints...`);
 
-  // ── Route scan summary ─────────────────────────────────────────────────
-  const routeScans = [];
-  for (const { probe, label, url } of probes) {
-    if (!silent) {
-      console.log(chalk.gray(`\n  Crawling routes for ${label}...`));
+    for (const route of apiRoutes) {
+      if (this.#aborted) break;
+      this.#terminal.setCurrentTest(`API: ${route.url}`);
+
+      const result = await this.#apiValidator.probe(route.url);
+      this.#session.apiLog.push(result);
+
+      this.#addResult({
+        name    : `API: ${route.url}`,
+        type    : 'api',
+        category: 'api-validation',
+        status  : result.pass ? 'PASS' : 'FAIL',
+        message : result.message,
+        data    : {
+          statusCode : result.statusCode,
+          responseTime: result.responseTime,
+          contentType: result.contentType,
+          body       : result.body?.slice(0, 500),
+          headers    : result.headers,
+        },
+        url     : route.url,
+        duration: result.responseTime,
+      });
+
+      if (!result.pass) {
+        this.#session.addBug({
+          title      : `API Failure: ${route.url}`,
+          severity   : result.statusCode >= 500 ? 'P0' : 'P1',
+          type       : 'api',
+          description: result.message,
+          evidence   : result,
+        });
+      }
     }
-    const probeResults = await probe.probeRoutes(COMMON_ROUTES.slice(0, 12));
-    for (const pr of probeResults) {
-      routeScans.push({ label, url, ...pr });
+
+    // Detect APIs from network traffic
+    const discoveredAPIs = await this.#apiValidator.discoverFromNetworkLog(
+      this.#session.networkLog
+    );
+    for (const api of discoveredAPIs) {
+      if (!apiRoutes.find(r => r.url === api.url)) {
+        this.#session.apiLog.push(api);
+      }
     }
   }
 
-  const duration = Date.now() - new Date(startedAt).getTime();
-  const summary  = buildSummary(results);
-  const coverage = buildCoverageMatrix(results);
+  // ── Phase 3: Browser Interactions ─────────────────────────────────────
+  async #phaseBrowserInteractions() {
+    const pageRoutes = this.#session.routeMap.filter(r =>
+      r.type === 'page' || r.type === 'unknown'
+    );
 
-  if (!silent) printResultsSummary(results);
+    for (const route of pageRoutes.slice(0, 25)) {
+      if (this.#aborted) break;
+      this.#terminal.setCurrentTest(`Browser: ${route.url}`);
+
+      const result = await this.#interactor.testPage(route.url, {
+        onConsoleError: (err) => {
+          this.#session.consoleErrors.push({ url: route.url, ...err });
+        },
+        onNetworkEvent: (event) => {
+          this.#session.networkLog.push({ url: route.url, ...event });
+        },
+      });
 
-  const run = {
-    id: runId, type: 'url-qa', version: VERSION, startedAt, duration,
-    urls  : probes.map(p => ({ label: p.label, url: p.url })),
-    results, bugReports: autoBugs, summary, coverage, routeScans,
-  };
+      // Real screenshot on failure
+      if (!result.pass || result.consoleErrors.length > 0) {
+        const screenshot = await this.#screenshotter.capture(
+          result.page,
+          `fail-${shortId()}`
+        );
+        if (screenshot) {
+          result.screenshotPath = screenshot;
+          this.#session.screenshots.push({ url: route.url, path: screenshot, reason: result.failReason });
+        }
+      }
 
-  await saveRun(run);
-  const reportFile = await exportReport(run);
+      this.#addResult({
+        name    : `Page: ${route.url}`,
+        type    : 'browser',
+        category: 'interaction',
+        status  : result.pass ? (result.consoleErrors.length > 0 ? 'FLAKY' : 'PASS') : 'FAIL',
+        message : result.message,
+        data    : {
+          loadTime      : result.loadTime,
+          consoleErrors : result.consoleErrors,
+          networkErrors : result.networkErrors,
+          interactedElements: result.interactedElements,
+          screenshotPath: result.screenshotPath,
+          jsErrors      : result.jsErrors,
+          resourcesFailed: result.resourcesFailed,
+          renderTime    : result.renderTime,
+          domContentLoaded: result.domContentLoaded,
+        },
+        url     : route.url,
+        duration: result.loadTime,
+        screenshotPath: result.screenshotPath,
+      });
 
-  if (!silent && reportFile) {
-    console.log(chalk.gray(`  📄 URL QA Report: ${reportFile}`));
-  }
+      // Real console errors → bugs
+      for (const err of result.consoleErrors) {
+        this.#session.addBug({
+          title      : `JS Error: ${err.text?.slice(0, 80)}`,
+          severity   : err.type === 'error' ? 'P1' : 'P2',
+          type       : 'javascript',
+          description: err.text,
+          url        : route.url,
+          evidence   : err,
+        });
+      }
 
-  return run;
-}
+      // Real network failures → bugs
+      for (const nErr of result.networkErrors) {
+        this.#session.addBug({
+          title      : `Network Failure: ${nErr.url}`,
+          severity   : 'P2',
+          type       : 'network',
+          description: `${nErr.method} ${nErr.url} → ${nErr.failure}`,
+          url        : route.url,
+          evidence   : nErr,
+        });
+      }
 
-// ─────────────────────────────────────────────────────────────────────────
-//  Live Dashboard Renderer (v9.0 retained + v10 label)
-// ─────────────────────────────────────────────────────────────────────────
+      // Test forms on the page
+      if (result.forms && result.forms.length > 0) {
+        await this.#testForms(route.url, result.forms, result.page);
+      }
 
-class LiveDashboard {
-  #lines       = 0;
-  #active      = false;
-  #startTime   = Date.now();
-  #lastResults = [];
-  #runningTest = null;
-  #bugs        = [];
-  #log         = [];
-
-  start() {
-    this.#active    = true;
-    this.#startTime = Date.now();
-    process.stdout.write(CURSOR_HIDE);
-    this.render({});
+      // Test auth flows
+      if (this.#isAuthPage(route.url)) {
+        await this.#testAuthFlow(route.url, result.page);
+      }
+    }
   }
 
-  stop() {
-    this.#active = false;
-    process.stdout.write(CURSOR_SHOW);
-    this.#clearLines();
-  }
+  // ── Phase 4: Security ─────────────────────────────────────────────────
+  async #phaseSecurityScan() {
+    for (const [label, url] of Object.entries(this.#session.urls)) {
+      if (!url) continue;
 
-  updateRunning(name) { this.#runningTest = name; }
-  addResult(r)        { this.#lastResults.push(r); this.#runningTest = null; }
-  addBug(b)           { this.#bugs.push(b); }
-  addLog(msg)         { this.#log.push(`${DIM(new Date().toLocaleTimeString())} ${msg}`); if (this.#log.length > 8) this.#log.shift(); }
-
-  render(summary) {
-    if (!this.#active) return;
-    this.#clearLines();
-    const lines   = this.#buildLines(summary);
-    this.#lines   = lines.length;
-    process.stdout.write(lines.join('\n') + '\n');
-  }
+      const findings = await this.#security.scan(url);
+      this.#session.secFindings.push(...findings);
+
+      for (const finding of findings) {
+        this.#addResult({
+          name    : `Security: ${finding.check}`,
+          type    : 'security',
+          category: finding.category,
+          status  : finding.pass ? 'PASS' : 'FAIL',
+          message : finding.detail,
+          data    : finding.evidence,
+          url,
+          label,
+          severity: finding.severity,
+        });
 
-  #clearLines() {
-    if (this.#lines > 0) {
-      process.stdout.write(CURSOR_UP(this.#lines) + CLEAR_LINE);
-      for (let i = 1; i < this.#lines; i++) process.stdout.write('\n' + CLEAR_LINE);
-      process.stdout.write(CURSOR_UP(this.#lines - 1));
+        if (!finding.pass && (finding.severity === 'P0' || finding.severity === 'P1')) {
+          this.#session.addBug({
+            title      : `Security: ${finding.check}`,
+            severity   : finding.severity,
+            type       : 'security',
+            description: finding.detail,
+            url,
+            evidence   : finding.evidence,
+            recommendation: finding.recommendation,
+          });
+        }
+      }
     }
   }
 
-  #buildLines(summary = {}) {
-    const elapsed   = ((Date.now() - this.#startTime) / 1000).toFixed(1);
-    const sys       = getSystemStats();
-    const results   = this.#lastResults;
-    const total     = results.length;
-    const passed    = results.filter(r => ['PASS','FLAKY'].includes(r.status)).length;
-    const failed    = results.filter(r => r.status === 'FAIL').length;
-    const flaky     = results.filter(r => r.status === 'FLAKY').length;
-    const passRate  = total > 0 ? Math.round((passed / total) * 100) : 0;
-
-    const lines = [];
-    const w     = Math.min(process.stdout.columns || 80, 88);
-    const bar   = '─'.repeat(w - 2);
-
-    lines.push(chalk.hex('#00F5FF').bold(`┌${bar}┐`));
-    lines.push(chalk.hex('#00F5FF').bold('│') + chalk.hex('#BF40FF').bold(`  ⚡ BACKLIST LIVE QA DASHBOARD v${VERSION}`.padEnd(w - 2)) + chalk.hex('#00F5FF').bold('│'));
-    lines.push(chalk.hex('#00F5FF').bold(`├${bar}┤`));
-
-    const metrics = [
-      `${chalk.green('✓')} ${chalk.white.bold(passed)} passed`,
-      `${chalk.red('✗')} ${chalk.white.bold(failed)} failed`,
-      `${chalk.yellow('⚠')} ${chalk.white.bold(flaky)} flaky`,
-      `${chalk.cyan('🐛')} ${chalk.white.bold(this.#bugs.length)} bugs`,
-      `${chalk.gray('⏱')} ${chalk.white(elapsed + 's')}`,
-    ].map(m => m.padEnd(20)).join('  ');
-    lines.push(chalk.hex('#00F5FF').bold('│') + '  ' + metrics.slice(0, w - 4) + chalk.hex('#00F5FF').bold('│'));
-
-    const pBar = buildProgressBar(passRate, 30);
-    lines.push(chalk.hex('#00F5FF').bold('│') + `  Pass rate [${pBar}] ${chalk.white.bold(passRate + '%')} (${total} tests)`.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-
-    const sysLine = `  ${DIM('Heap')} ${chalk.white(sys.heapMB + 'MB')}  ${DIM('RSS')} ${chalk.white(sys.rss)}  ${DIM('Uptime')} ${chalk.white(sys.uptime + 's')}  ${DIM('Node')} ${chalk.white(process.version)}`;
-    lines.push(chalk.hex('#00F5FF').bold('│') + sysLine.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    lines.push(chalk.hex('#00F5FF').bold(`├${'─'.repeat(w - 2)}┤`));
-
-    const runLine = this.#runningTest
-      ? `  ${chalk.cyan('⟳')} ${chalk.cyan('Running:')} ${chalk.white(this.#runningTest.slice(0, w - 16))}`
-      : `  ${chalk.gray('⊘  Idle...')}`;
-    lines.push(chalk.hex('#00F5FF').bold('│') + runLine.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    lines.push(chalk.hex('#00F5FF').bold(`├${'─'.repeat(w - 2)}┤`));
-
-    lines.push(chalk.hex('#00F5FF').bold('│') + chalk.gray('  Recent results:').padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    const recentResults = results.slice(-5);
-    for (const r of recentResults) {
-      const type = chalk.gray(`[${(r.type || '').padEnd(11)}]`);
-      const dur  = chalk.gray(formatDuration(r.duration));
-      const name = r.name.slice(0, w - 40);
-      const row  = `  ${colorStatus(r.status)}  ${type} ${chalk.white(name)}  ${dur}`;
-      lines.push(chalk.hex('#00F5FF').bold('│') + row.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    }
-    for (let i = recentResults.length; i < 5; i++) {
-      lines.push(chalk.hex('#00F5FF').bold('│') + '  '.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    }
+  // ── Phase 5: Performance ──────────────────────────────────────────────
+  async #phasePerformance() {
+    for (const [label, url] of Object.entries(this.#session.urls)) {
+      if (!url) continue;
+
+      const metrics = await this.#performance.profile(url);
+      this.#session.perfMetrics[label] = metrics;
+
+      // Core Web Vitals as real test results
+      const vitals = [
+        { name: 'LCP',  value: metrics.lcp,  threshold: 2500,  unit: 'ms' },
+        { name: 'FID',  value: metrics.fid,  threshold: 100,   unit: 'ms' },
+        { name: 'CLS',  value: metrics.cls,  threshold: 0.1,   unit: ''   },
+        { name: 'FCP',  value: metrics.fcp,  threshold: 1800,  unit: 'ms' },
+        { name: 'TTFB', value: metrics.ttfb, threshold: 800,   unit: 'ms' },
+        { name: 'TTI',  value: metrics.tti,  threshold: 3800,  unit: 'ms' },
+        { name: 'TBT',  value: metrics.tbt,  threshold: 200,   unit: 'ms' },
+      ];
+
+      for (const vital of vitals) {
+        const pass = vital.value !== null && vital.value <= vital.threshold;
+        const na   = vital.value === null;
+
+        this.#addResult({
+          name    : `[${label}] ${vital.name} — Core Web Vital`,
+          type    : 'performance',
+          category: 'web-vitals',
+          status  : na ? 'SKIP' : (pass ? 'PASS' : 'FAIL'),
+          message : na
+            ? `${vital.name} not measurable`
+            : `${vital.name}: ${vital.value}${vital.unit} (threshold: ${vital.threshold}${vital.unit})`,
+          data    : { value: vital.value, threshold: vital.threshold, unit: vital.unit },
+          url,
+          label,
+          duration: vital.value,
+        });
 
-    lines.push(chalk.hex('#00F5FF').bold(`├${'─'.repeat(w - 2)}┤`));
-    lines.push(chalk.hex('#00F5FF').bold('│') + chalk.gray('  Active bugs:').padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    const recentBugs = this.#bugs.slice(-3);
-    for (const b of recentBugs) {
-      const bugLine = `  ${colorSeverity(b.severity)} ${chalk.white(b.title.slice(0, w - 20))}`;
-      lines.push(chalk.hex('#00F5FF').bold('│') + bugLine.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    }
-    for (let i = recentBugs.length; i < 3; i++) {
-      lines.push(chalk.hex('#00F5FF').bold('│') + '  '.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    }
+        if (!na && !pass) {
+          this.#session.addBug({
+            title      : `Poor ${vital.name}: ${vital.value}${vital.unit} (>${vital.threshold}${vital.unit})`,
+            severity   : vital.name === 'LCP' || vital.name === 'CLS' ? 'P1' : 'P2',
+            type       : 'performance',
+            description: `${vital.name} exceeds threshold on ${label}`,
+            url,
+            evidence   : { value: vital.value, threshold: vital.threshold },
+            recommendation: `Optimize ${vital.name} — see https://web.dev/vitals`,
+          });
+        }
+      }
 
-    lines.push(chalk.hex('#00F5FF').bold(`├${'─'.repeat(w - 2)}┤`));
-    lines.push(chalk.hex('#00F5FF').bold('│') + chalk.gray('  Event log:').padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    const recentLogs = this.#log.slice(-4);
-    for (const entry of recentLogs) {
-      lines.push(chalk.hex('#00F5FF').bold('│') + ('  ' + entry).slice(0, w - 2).padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-    }
-    for (let i = recentLogs.length; i < 4; i++) {
-      lines.push(chalk.hex('#00F5FF').bold('│') + '  '.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
+      // Real resource analysis
+      for (const resource of (metrics.slowResources || [])) {
+        this.#addResult({
+          name    : `[${label}] Slow resource: ${resource.url.split('/').pop()}`,
+          type    : 'performance',
+          category: 'resource',
+          status  : 'FAIL',
+          message : `${resource.url} took ${resource.duration}ms (${formatBytes(resource.size)})`,
+          data    : resource,
+          url,
+          label,
+          duration: resource.duration,
+        });
+      }
     }
-
-    lines.push(chalk.hex('#00F5FF').bold(`└${bar}┘`));
-    lines.push(DIM('  Press Ctrl+C to stop'));
-    return lines;
   }
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-//  Test Runner (v9 retained + sev field propagation)
-// ─────────────────────────────────────────────────────────────────────────
 
-class TestRunner extends EventEmitter {
-  #results  = [];
-  #running  = false;
-  #aborted  = false;
+  // ── Phase 6: Accessibility ────────────────────────────────────────────
+  async #phaseAccessibility() {
+    const pageRoutes = this.#session.routeMap
+      .filter(r => r.type === 'page' || r.type === 'unknown')
+      .slice(0, 15);
 
-  async run(tests, dashboard = null) {
-    this.#running = true;
-    this.#aborted = false;
-    this.#results = [];
-
-    for (const test of tests) {
+    for (const route of pageRoutes) {
       if (this.#aborted) break;
-      if (dashboard) {
-        dashboard.updateRunning(test.name);
-        dashboard.addLog(`Starting: ${test.name}`);
-        dashboard.render({});
-      }
+      this.#terminal.setCurrentTest(`A11y: ${route.url}`);
+
+      const result = await this.#a11y.check(route.url);
+      this.#session.a11yResults.push({ url: route.url, ...result });
+
+      for (const violation of result.violations) {
+        this.#addResult({
+          name    : `A11y [${violation.impact}]: ${violation.description}`,
+          type    : 'accessibility',
+          category: violation.category || 'wcag',
+          status  : 'FAIL',
+          message : `${violation.nodes} element(s) affected — ${violation.help}`,
+          data    : {
+            impact  : violation.impact,
+            wcagTags: violation.tags,
+            nodes   : violation.affectedNodes,
+            helpUrl : violation.helpUrl,
+          },
+          url     : route.url,
+          severity: violation.impact === 'critical' ? 'P0'
+                  : violation.impact === 'serious'  ? 'P1'
+                  : violation.impact === 'moderate' ? 'P2' : 'P3',
+        });
 
-      const result = await this.#runOne(test);
-      this.#results.push(result);
-      this.emit('result', result);
-
-      if (dashboard) {
-        dashboard.addResult(result);
-        if (result.status === 'FAIL') {
-          dashboard.addBug({
-            id      : `AUTO-${shortId()}`,
-            title   : `${test.name}`,
-            severity: test.sev || this.#classifySeverity(test.type, result.error),
-            status  : 'OPEN',
+        if (violation.impact === 'critical' || violation.impact === 'serious') {
+          this.#session.addBug({
+            title      : `A11y: ${violation.description}`,
+            severity   : violation.impact === 'critical' ? 'P0' : 'P1',
+            type       : 'accessibility',
+            description: `${violation.nodes} element(s): ${violation.help}`,
+            url        : route.url,
+            evidence   : violation.affectedNodes,
+            recommendation: violation.helpUrl,
           });
-          dashboard.addLog(chalk.red(`FAIL: ${test.name} — ${result.error ?? 'unknown'}`));
-        } else {
-          dashboard.addLog(chalk.green(`${result.status}: ${test.name} (${formatDuration(result.duration)})`));
         }
-        dashboard.render({});
-        await sleep(60);
       }
-    }
 
-    this.#running = false;
-    return [...this.#results];
+      // Passes also recorded as real results
+      for (const pass of (result.passes || []).slice(0, 5)) {
+        this.#addResult({
+          name    : `A11y Pass: ${pass.description}`,
+          type    : 'accessibility',
+          category: 'wcag',
+          status  : 'PASS',
+          message : `${pass.nodes} element(s) verified`,
+          data    : pass,
+          url     : route.url,
+        });
+      }
+    }
   }
 
-  abort() { this.#aborted = true; }
+  // ── Phase 7: SEO ──────────────────────────────────────────────────────
+  async #phaseSEO() {
+    const pageRoutes = this.#session.routeMap
+      .filter(r => r.type === 'page' || r.type === 'unknown')
+      .slice(0, 20);
 
-  #classifySeverity(type, error = '') {
-    if (type === 'auth' || type === 'security') return 'P0';
-    if (type === 'e2e'  || error?.includes('crash')) return 'P1';
-    if (type === 'validation' || type === 'performance') return 'P2';
-    return 'P3';
-  }
+    for (const route of pageRoutes) {
+      if (this.#aborted) break;
+      this.#terminal.setCurrentTest(`SEO: ${route.url}`);
+
+      const result = await this.#seo.scan(route.url);
+      this.#session.seoResults.push({ url: route.url, ...result });
+
+      for (const check of result.checks) {
+        this.#addResult({
+          name    : `SEO: ${check.name} — ${new URL(route.url).pathname}`,
+          type    : 'seo',
+          category: check.category,
+          status  : check.pass ? 'PASS' : 'FAIL',
+          message : check.detail,
+          data    : check.data,
+          url     : route.url,
+          severity: check.severity,
+        });
 
-  async #runOne(test) {
-    const { id, name, type, sev, fn, timeout = DEFAULT_TIMEOUT_MS } = test;
-    const start   = Date.now();
-    let retries   = 0;
-    let lastError = null;
-
-    for (let attempt = 0; attempt <= FLAKY_RETRY_COUNT; attempt++) {
-      try {
-        await Promise.race([
-          fn(),
-          sleep(timeout).then(() => { throw new Error(`Timed out after ${timeout}ms`); }),
-        ]);
-        const status = attempt > 0 ? 'FLAKY' : 'PASS';
-        return { id, name, type, sev, status, duration: Date.now() - start, retries: attempt, error: null };
-      } catch (err) {
-        lastError = err.message;
-        retries   = attempt;
-        if (attempt < FLAKY_RETRY_COUNT) await sleep(200);
+        if (!check.pass && (check.severity === 'P0' || check.severity === 'P1')) {
+          this.#session.addBug({
+            title      : `SEO: ${check.name}`,
+            severity   : check.severity,
+            type       : 'seo',
+            description: check.detail,
+            url        : route.url,
+            recommendation: check.recommendation,
+          });
+        }
       }
     }
-
-    return { id, name, type, sev, status: 'FAIL', duration: Date.now() - start, retries, error: lastError };
   }
-}
 
-// ─────────────────────────────────────────────────────────────────────────
-//  File-System Test Suites (v9 retained)
-// ─────────────────────────────────────────────────────────────────────────
+  // ── Phase 8: AI Classification ────────────────────────────────────────
+  async #phaseAIClassification() {
+    this.#terminal.log(`AI classifying ${this.#session.bugs.length} bugs...`);
 
-function buildEndpointTests(endpoints) {
-  const tests = [];
-  for (const ep of endpoints) {
-    const label = `${ep.method} ${ep.route}`;
-    tests.push({ id: shortId(), name: `Happy path: ${label}`, type: 'happy-path', sev: 'P2', fn: async () => {
-      await sleep(30 + Math.random() * 80);
-      if (!ep.route || !ep.method) throw new Error('Endpoint missing route or method');
-    }});
-    if (ep.schemaFields && Object.keys(ep.schemaFields).length > 0) {
-      tests.push({ id: shortId(), name: `Validation: ${label}`, type: 'validation', sev: 'P2', fn: async () => {
-        await sleep(25);
-        const missing = Object.entries(ep.schemaFields).filter(([, t]) => !t);
-        if (missing.length) throw new Error(`Fields missing types: ${missing.map(([k]) => k).join(', ')}`);
-      }});
-    }
-    if (/\/admin|\/user|\/auth|\/profile|\/dashboard|\/private/i.test(ep.route)) {
-      tests.push({ id: shortId(), name: `Auth guard: ${label}`, type: 'auth', sev: 'P0', fn: async () => {
-        await sleep(40);
-      }});
+    for (const bug of this.#session.bugs) {
+      const classification = await this.#aiClassifier.classify(bug, this.#session);
+      bug.aiSeverity     = classification.severity;
+      bug.aiCategory     = classification.category;
+      bug.aiRecommendation = classification.recommendation;
+      bug.aiConfidence   = classification.confidence;
     }
+
+    // Sort bugs by AI-determined severity
+    this.#session.bugs.sort((a, b) => {
+      const order = { P0: 0, P1: 1, P2: 2, P3: 3 };
+      return (order[a.aiSeverity || a.severity] || 3) - (order[b.aiSeverity || b.severity] || 3);
+    });
   }
-  return tests;
-}
 
-function buildFullSystemTests(projectDir = process.cwd()) {
-  const tests = [];
-
-  tests.push({ id: shortId(), name: 'Project structure integrity', type: 'e2e', sev: 'P1', fn: async () => {
-    if (!(await fs.pathExists(projectDir))) throw new Error('Project directory not found');
-  }});
-  tests.push({ id: shortId(), name: 'Package.json valid', type: 'validation', sev: 'P1', fn: async () => {
-    const pkgPath = path.join(projectDir, 'package.json');
-    if (!(await fs.pathExists(pkgPath))) throw new Error('package.json missing');
-    const pkg = await fs.readJson(pkgPath);
-    if (!pkg.name) throw new Error('package.json has no name field');
-  }});
-  tests.push({ id: shortId(), name: 'Dependencies declared', type: 'validation', sev: 'P2', fn: async () => {
-    const pkgPath = path.join(projectDir, 'package.json');
-    if (!(await fs.pathExists(pkgPath))) return;
-    const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
-    const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    if (Object.keys(deps).length === 0) throw new Error('No dependencies declared');
-  }});
-  tests.push({ id: shortId(), name: 'API routes file exists', type: 'happy-path', sev: 'P1', fn: async () => {
-    const candidates = ['src/routes', 'routes', 'src/api', 'api', 'src/controllers', 'controllers'];
-    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
-    throw new Error('No routes/api directory found');
-  }});
-  tests.push({ id: shortId(), name: 'Entry point reachable', type: 'happy-path', sev: 'P0', fn: async () => {
-    const candidates = ['src/index.ts', 'src/index.js', 'index.ts', 'index.js', 'main.py', 'main.go', 'Program.cs'];
-    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
-    throw new Error('No recognisable entry point found');
-  }});
-  tests.push({ id: shortId(), name: 'Environment config present', type: 'validation', sev: 'P1', fn: async () => {
-    const candidates = ['.env', '.env.example', '.env.sample', 'config.js', 'config.ts', 'appsettings.json'];
-    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
-    throw new Error('No environment config file found');
-  }});
-  tests.push({ id: shortId(), name: 'Password hashing library', type: 'security', sev: 'P0', fn: async () => {
-    const pkgPath = path.join(projectDir, 'package.json');
-    if (!(await fs.pathExists(pkgPath))) return;
-    const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
-    const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    if (!['bcrypt', 'bcryptjs', 'argon2', 'argon2d'].some(d => deps[d]))
-      throw new Error('No password hashing library (bcrypt/argon2) found');
-  }});
-  tests.push({ id: shortId(), name: 'Database schema defined', type: 'validation', sev: 'P1', fn: async () => {
-    const candidates = ['prisma/schema.prisma', 'schema.prisma', 'src/models', 'models', 'src/entities'];
-    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
-    throw new Error('No database schema/models directory found');
-  }});
-  tests.push({ id: shortId(), name: 'CORS config found', type: 'security', sev: 'P1', fn: async () => {
-    const candidates = ['src/index.ts', 'src/index.js', 'src/app.ts', 'src/app.js', 'index.js', 'index.ts'];
-    for (const c of candidates) {
-      const filePath = path.join(projectDir, c);
-      if (await fs.pathExists(filePath)) {
-        const content = await fs.readFile(filePath, 'utf8').catch(() => '');
-        if (/cors|CORS/i.test(content)) return;
-      }
-    }
-    throw new Error('No CORS configuration detected');
-  }});
-  tests.push({ id: shortId(), name: 'Rate limiting configured', type: 'security', sev: 'P1', fn: async () => {
-    const pkgPath = path.join(projectDir, 'package.json');
-    if (!(await fs.pathExists(pkgPath))) return;
-    const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
-    const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    if (!['express-rate-limit', 'rate-limiter-flexible', 'fastapi-limiter', 'throttler'].some(d => deps[d]))
-      throw new Error('No rate-limiting library found');
-  }});
-  tests.push({ id: shortId(), name: 'Secrets not hardcoded', type: 'security', sev: 'P0', fn: async () => {
-    const pattern = /(?:password|secret|apikey|api_key)\s*=\s*['"][^'"]{6,}['"]/i;
-    const targets = ['src/index.ts', 'src/index.js', 'src/app.ts', 'src/app.js'];
-    for (const t of targets) {
-      const fp = path.join(projectDir, t);
-      if (await fs.pathExists(fp)) {
-        const content = await fs.readFile(fp, 'utf8').catch(() => '');
-        if (pattern.test(content)) throw new Error(`Hardcoded secret detected in ${t}`);
-      }
-    }
-  }});
-  tests.push({ id: shortId(), name: 'Heap memory acceptable', type: 'performance', sev: 'P2', fn: async () => {
-    const heapMB = process.memoryUsage().heapUsed / 1024 / 1024;
-    if (heapMB > 512) throw new Error(`Heap ${heapMB.toFixed(0)}MB exceeds 512MB limit`);
-  }});
-  tests.push({ id: shortId(), name: 'Dockerfile present', type: 'e2e', sev: 'P2', fn: async () => {
-    const candidates = ['Dockerfile', 'Dockerfile.dev', 'docker-compose.yml', 'docker-compose.yaml'];
-    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
-    throw new Error('No Docker configuration found');
-  }});
-  tests.push({ id: shortId(), name: 'CI/CD pipeline configured', type: 'e2e', sev: 'P2', fn: async () => {
-    const ciPaths = ['.github/workflows', '.gitlab-ci.yml', '.circleci', 'Jenkinsfile'];
-    for (const c of ciPaths) { if (await fs.pathExists(path.join(projectDir, c))) return; }
-    throw new Error('No CI/CD pipeline detected');
-  }});
-  tests.push({ id: shortId(), name: 'Test files exist', type: 'e2e', sev: 'P2', fn: async () => {
-    const testDirs = ['tests', 'test', '__tests__', 'spec'];
-    for (const d of testDirs) {
-      if (await fs.pathExists(path.join(projectDir, d))) {
-        const files = await fs.readdir(path.join(projectDir, d)).catch(() => []);
-        if (files.length > 0) return;
+  // ── Form Testing ──────────────────────────────────────────────────────
+  async #testForms(url, forms, page) {
+    for (const form of forms.slice(0, 3)) {
+      this.#terminal.setCurrentTest(`Form: ${url} — ${form.action || 'unknown'}`);
+
+      const result = await this.#interactor.testForm(page, form);
+
+      this.#addResult({
+        name    : `Form test: ${url} → ${form.action || 'inline'}`,
+        type    : 'form',
+        category: 'user-flow',
+        status  : result.pass ? 'PASS' : 'FAIL',
+        message : result.message,
+        data    : {
+          fields      : form.fields,
+          action      : form.action,
+          method      : form.method,
+          validationOk: result.validationOk,
+          submissionOk: result.submissionOk,
+          errors      : result.errors,
+        },
+        url,
+        duration: result.duration,
+      });
+
+      if (!result.pass) {
+        this.#session.addBug({
+          title      : `Form broken: ${form.action || url}`,
+          severity   : 'P1',
+          type       : 'form',
+          description: result.message,
+          url,
+          evidence   : result.errors,
+        });
       }
     }
-    throw new Error('No test files found');
-  }});
-  tests.push({ id: shortId(), name: 'API documentation configured', type: 'happy-path', sev: 'P3', fn: async () => {
-    const pkgPath = path.join(projectDir, 'package.json');
-    if (!(await fs.pathExists(pkgPath))) return;
-    const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
-    const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    if (!['swagger-ui-express', 'swagger-jsdoc', '@nestjs/swagger', 'fastapi', 'springdoc-openapi'].some(d => deps[d]))
-      throw new Error('No API documentation library found');
-  }});
-  tests.push({ id: shortId(), name: 'Logging library present', type: 'validation', sev: 'P2', fn: async () => {
-    const pkgPath = path.join(projectDir, 'package.json');
-    if (!(await fs.pathExists(pkgPath))) return;
-    const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
-    const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    if (!['winston', 'pino', 'morgan', 'log4j', 'structlog'].some(d => deps[d]))
-      throw new Error('No structured logging library found');
-  }});
-  tests.push({ id: shortId(), name: 'QA system operational', type: 'happy-path', sev: 'P3', fn: async () => {
-    await fs.ensureDir(QA_DIR);
-  }});
-  tests.push({ id: shortId(), name: 'Report directory writable', type: 'happy-path', sev: 'P3', fn: async () => {
-    await fs.ensureDir(REPORT_DIR);
-    const testFile = path.join(REPORT_DIR, `.write-test-${shortId()}`);
-    await fs.writeFile(testFile, 'ok');
-    await fs.remove(testFile);
-  }});
-
-  return tests;
-}
-
-function buildUITests(srcDir = path.join(process.cwd(), 'src')) {
-  return [
-    { id: shortId(), name: 'Frontend src directory exists', type: 'ui', sev: 'P1', fn: async () => {
-      if (!(await fs.pathExists(srcDir))) throw new Error(`src not found: ${srcDir}`);
-    }},
-    { id: shortId(), name: 'Component files present', type: 'ui', sev: 'P1', fn: async () => {
-      const exts = ['.tsx', '.jsx', '.vue', '.svelte'];
-      let found = false;
-      const walk = async (dir) => {
-        const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
-        for (const e of entries) {
-          if (e.isDirectory() && e.name !== 'node_modules') await walk(path.join(dir, e.name));
-          else if (exts.some(x => e.name.endsWith(x))) { found = true; return; }
-        }
-      };
-      await walk(srcDir);
-      if (!found) throw new Error('No component files found');
-    }},
-    { id: shortId(), name: 'Styles configured', type: 'ui', sev: 'P2', fn: async () => {
-      const patterns = ['tailwind.config', 'postcss.config', 'vite.config', 'styles', 'css', 'scss'];
-      const entries  = await fs.readdir(process.cwd()).catch(() => []);
-      if (!entries.some(f => patterns.some(p => f.includes(p)))) throw new Error('No styling configuration found');
-    }},
-    { id: shortId(), name: 'API client configuration', type: 'ui', sev: 'P2', fn: async () => {
-      const apiFiles = ['src/api', 'src/services', 'src/lib', 'src/utils'];
-      for (const f of apiFiles) { if (await fs.pathExists(path.join(process.cwd(), f))) return; }
-      throw new Error('No API client/services directory found');
-    }},
-  ];
-}
-
-// ── Helpers ────────────────────────────────────────────────────────────────
-function buildCoverageMatrix(results) {
-  const matrix = {};
-  for (const r of results) {
-    if (!matrix[r.type]) matrix[r.type] = { total: 0, passed: 0, failed: 0, skipped: 0, flaky: 0 };
-    matrix[r.type].total++;
-    if (r.status === 'PASS')  matrix[r.type].passed++;
-    if (r.status === 'FAIL')  matrix[r.type].failed++;
-    if (r.status === 'SKIP')  matrix[r.type].skipped++;
-    if (r.status === 'FLAKY') { matrix[r.type].flaky++; matrix[r.type].passed++; }
   }
-  return matrix;
-}
 
-function buildSummary(results) {
-  return {
-    total  : results.length,
-    passed : results.filter(r => ['PASS','FLAKY'].includes(r.status)).length,
-    failed : results.filter(r => r.status === 'FAIL').length,
-    skipped: results.filter(r => r.status === 'SKIP').length,
-    flaky  : results.filter(r => r.status === 'FLAKY').length,
-  };
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-//  HTML Report v10.0 — with route cards + dual-URL diff
-// ─────────────────────────────────────────────────────────────────────────
+  // ── Auth Flow Testing ─────────────────────────────────────────────────
+  async #testAuthFlow(url, page) {
+    this.#terminal.setCurrentTest(`Auth flow: ${url}`);
 
-function buildHTMLReport(runData) {
-  const { id, startedAt, duration, results, bugReports, coverage, summary, urls = [], routeScans = [] } = runData;
-  const passRate    = summary.total > 0 ? ((summary.passed / summary.total) * 100).toFixed(1) : 0;
-  const statusColor = passRate >= 90 ? '#22c55e' : passRate >= 70 ? '#f59e0b' : '#ef4444';
-
-  const typeColors = {
-    'happy-path' : ['#064e3b','#34d399'], 'validation' : ['#1e3a5f','#60a5fa'],
-    'auth'       : ['#3b1f5e','#c084fc'], 'edge-case'  : ['#3b2a1a','#f59e0b'],
-    'performance': ['#1a2a3b','#38bdf8'], 'security'   : ['#450a0a','#f87171'],
-    'e2e'        : ['#1a3b2a','#4ade80'], 'ui'         : ['#2a1a3b','#a78bfa'],
-    'http'       : ['#0f2a3b','#38bdf8'], 'seo'        : ['#1a2e0f','#86efac'],
-    'a11y'       : ['#2e1a0f','#fca5a5'], 'links'      : ['#0f1a2e','#93c5fd'],
-  };
+    const result = await this.#interactor.testAuthFlow(page, url, {
+      testCredentials: [
+        { username: 'test@example.com',  password: 'wrong-password-test', expectFail: true },
+        { username: 'invalid@test.com',  password: 'wrong123',            expectFail: true },
+        { username: '',                  password: '',                    expectFail: true },
+      ],
+    });
 
-  const badgeStyle = (type) => {
-    const [bg, fg] = typeColors[type] ?? ['#1e293b','#94a3b8'];
-    return `background:${bg};color:${fg};padding:2px 8px;border-radius:4px;font-size:.75rem;font-weight:500`;
-  };
+    this.#addResult({
+      name    : `Auth flow: ${url}`,
+      type    : 'auth',
+      category: 'authentication',
+      status  : result.pass ? 'PASS' : 'FAIL',
+      message : result.message,
+      data    : result.details,
+      url,
+      duration: result.duration,
+    });
 
-  const covBars = Object.entries(coverage).map(([type, d]) => {
-    const pct = d.total ? ((d.passed / d.total) * 100).toFixed(0) : 0;
-    const [, fg] = typeColors[type] ?? ['','#94a3b8'];
-    return `<div style="display:flex;align-items:center;gap:1rem;margin-bottom:.75rem">
-      <div style="width:110px;font-size:.8rem;color:#94a3b8">${type}</div>
-      <div style="flex:1;background:#2d2d4e;border-radius:4px;height:8px;overflow:hidden">
-        <div style="height:100%;width:${pct}%;background:${fg};border-radius:4px"></div>
-      </div>
-      <div style="width:60px;text-align:right;font-size:.8rem;color:#64748b">${d.passed}/${d.total}</div>
-    </div>`;
-  }).join('');
-
-  const rows = results.map(r => `<tr class="${r.status.toLowerCase()}">
-    <td>${r.name}</td>
-    <td><span style="${badgeStyle(r.type)}">${r.type}</span></td>
-    <td><span class="status status-${r.status.toLowerCase()}">${r.status}</span></td>
-    <td>${r.sev ? `<span class="sev-${(r.sev||'').toLowerCase()}">${r.sev}</span>` : '—'}</td>
-    <td>${r.duration}ms</td>
-    <td>${r.retries > 0 ? `<span style="background:#422006;color:#fb923c;padding:2px 8px;border-radius:4px;font-size:.75rem">${r.retries}x retry</span>` : '—'}</td>
-    <td class="err">${r.error ? `<code>${r.error}</code>` : '—'}</td>
-  </tr>`).join('');
-
-  const bugCards = bugReports.length ? bugReports.map(b => `
-    <div class="bug-card bug-${(b.severity||'p3').toLowerCase()}">
-      <div class="bug-header">
-        <span class="bug-id">${b.id}</span>
-        <span class="bug-sev">${b.severity}</span>
-        <span class="bug-st">${b.status}</span>
-      </div>
-      <div class="bug-title">${b.title}</div>
-      ${b.description ? `<div class="bug-desc">${b.description}</div>` : ''}
-    </div>`).join('') : '<p style="color:#34d399;text-align:center;padding:1rem">No bug reports 🎉</p>';
-
-  const urlCards = urls.length ? urls.map(u => `
-    <div style="background:#1e1e30;border:1px solid #2d2d4e;border-radius:8px;padding:1rem;margin-bottom:.75rem">
-      <div style="display:flex;justify-content:space-between;align-items:center">
-        <span style="font-size:.8rem;color:#64748b;text-transform:uppercase">${u.label}</span>
-        <a href="${u.url}" target="_blank" style="font-size:.8rem;color:#60a5fa">${u.url}</a>
-      </div>
-    </div>`).join('') : '';
-
-  const routeCards = routeScans.length ? routeScans.map(r => `
-    <div style="display:flex;align-items:center;gap:.75rem;padding:.5rem .75rem;border-bottom:1px solid #1a1a2e;font-size:.8rem">
-      <span style="font-family:monospace;color:${r.status >= 200 && r.status < 400 ? '#34d399' : r.status >= 500 ? '#f87171' : '#f59e0b'}">${r.status || 'ERR'}</span>
-      <span style="flex:1;color:#94a3b8;font-family:monospace">${r.route}</span>
-      <span style="color:#64748b">${r.duration}ms</span>
-      <span style="font-size:.7rem;padding:2px 6px;background:#1e293b;color:#64748b;border-radius:3px">${r.label}</span>
-    </div>`).join('') : '<p style="color:#64748b;font-size:.85rem;padding:.5rem">No route scans recorded.</p>';
-
-  const chartLabels = JSON.stringify(Object.keys(coverage));
-  const chartPassed = JSON.stringify(Object.values(coverage).map(d => d.passed));
-  const chartFailed = JSON.stringify(Object.values(coverage).map(d => d.failed));
-
-  const sevCounts = { P0: 0, P1: 0, P2: 0, P3: 0 };
-  bugReports.forEach(b => { if (sevCounts[b.severity] !== undefined) sevCounts[b.severity]++; });
-
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Backlist QA Report v${VERSION} — ${id}</title>
-<script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.js"></script>
-<style>
-*{box-sizing:border-box;margin:0;padding:0}
-body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#0a0a12;color:#e2e8f0;font-size:14px;line-height:1.6}
-header{background:#0f0f1e;border-bottom:1px solid #00f5ff22;padding:1.5rem 2rem;display:flex;align-items:center;justify-content:space-between}
-header h1{font-size:1.25rem;font-weight:600;color:#00f5ff}
-header .version{font-size:.75rem;color:#534AB7;padding:3px 10px;border:1px solid #534AB7;border-radius:20px}
-header p{color:#64748b;font-size:.85rem;margin-top:4px}
-.container{max-width:1200px;margin:0 auto;padding:2rem}
-.metrics{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:.75rem;margin-bottom:1.5rem}
-.mc{background:#1e1e30;border:1px solid #2d2d4e;border-radius:10px;padding:1rem 1.25rem}
-.ml{font-size:.7rem;color:#64748b;text-transform:uppercase;letter-spacing:.05em}
-.mv{font-size:2rem;font-weight:700;margin-top:4px}
-.section{background:#1e1e30;border:1px solid #2d2d4e;border-radius:10px;padding:1.5rem;margin-bottom:1.25rem}
-.section-title{font-size:.95rem;font-weight:600;margin-bottom:1rem;color:#cbd5e1;border-bottom:1px solid #2d2d4e;padding-bottom:.75rem;display:flex;justify-content:space-between}
-.grid2{display:grid;grid-template-columns:1fr 1fr;gap:1rem}
-table{width:100%;border-collapse:collapse;font-size:.82rem}
-th{text-align:left;color:#64748b;font-weight:500;padding:.5rem .75rem;border-bottom:1px solid #2d2d4e}
-td{padding:.5rem .75rem;border-bottom:1px solid #1a1a2e;vertical-align:top}
-tr.fail td{background:rgba(239,68,68,.04)}tr.flaky td{background:rgba(245,158,11,.04)}
-.status{display:inline-block;padding:2px 8px;border-radius:4px;font-size:.72rem;font-weight:600}
-.status-pass{background:#064e3b;color:#34d399}.status-fail{background:#450a0a;color:#f87171}
-.status-skip{background:#1e293b;color:#94a3b8}.status-flaky{background:#422006;color:#fbbf24}
-.sev-p0{background:#450a0a;color:#f87171;padding:2px 6px;border-radius:3px;font-size:.72rem;font-weight:700}
-.sev-p1{background:#422006;color:#fbbf24;padding:2px 6px;border-radius:3px;font-size:.72rem;font-weight:700}
-.sev-p2{background:#1e3a5f;color:#60a5fa;padding:2px 6px;border-radius:3px;font-size:.72rem}
-.sev-p3{background:#1e293b;color:#94a3b8;padding:2px 6px;border-radius:3px;font-size:.72rem}
-.err code{font-size:.72rem;color:#f87171;background:#1a0a0a;padding:2px 6px;border-radius:3px;word-break:break-all}
-.bug-card{border-radius:8px;padding:1rem;margin-bottom:.75rem;border-left:3px solid}
-.bug-p0{background:rgba(239,68,68,.08);border-color:#ef4444}
-.bug-p1{background:rgba(245,158,11,.08);border-color:#f59e0b}
-.bug-p2{background:rgba(96,165,250,.08);border-color:#60a5fa}
-.bug-p3{background:rgba(148,163,184,.08);border-color:#64748b}
-.bug-header{display:flex;gap:.75rem;align-items:center;margin-bottom:.5rem}
-.bug-id{font-family:monospace;font-size:.75rem;color:#64748b}
-.bug-sev{font-size:.72rem;font-weight:700;color:#f87171}
-.bug-st{font-size:.72rem;padding:2px 8px;border-radius:4px;background:#1e293b;color:#94a3b8}
-.bug-title{font-weight:600;margin-bottom:.25rem;font-size:.9rem}
-.bug-desc{font-size:.8rem;color:#94a3b8}
-.chart-wrap{position:relative;height:260px}
-footer{text-align:center;color:#334155;font-size:.72rem;padding:2rem;border-top:1px solid #1e293b;margin-top:2rem}
-</style>
-</head>
-<body>
-<header>
-  <div>
-    <h1>Backlist QA Report</h1>
-    <p>Run ID: ${id} &nbsp;·&nbsp; ${new Date(startedAt).toLocaleString()} &nbsp;·&nbsp; ${formatDuration(duration)}</p>
-  </div>
-  <span class="version">v${VERSION}</span>
-</header>
-<div class="container">
-
-  ${urlCards ? `<div class="section"><div class="section-title">Target URLs</div>${urlCards}</div>` : ''}
-
-  <div class="metrics">
-    <div class="mc"><div class="ml">Pass Rate</div><div class="mv" style="color:${statusColor}">${passRate}%</div></div>
-    <div class="mc"><div class="ml">Total</div><div class="mv">${summary.total}</div></div>
-    <div class="mc"><div class="ml">Passed</div><div class="mv" style="color:#34d399">${summary.passed}</div></div>
-    <div class="mc"><div class="ml">Failed</div><div class="mv" style="color:#f87171">${summary.failed}</div></div>
-    <div class="mc"><div class="ml">Flaky</div><div class="mv" style="color:#fbbf24">${summary.flaky}</div></div>
-    <div class="mc"><div class="ml">Bugs</div><div class="mv" style="color:#c084fc">${bugReports.length}</div></div>
-    <div class="mc"><div class="ml">P0 Critical</div><div class="mv" style="color:#f87171;font-size:1.6rem">${sevCounts.P0}</div></div>
-    <div class="mc"><div class="ml">P1 High</div><div class="mv" style="color:#fbbf24;font-size:1.6rem">${sevCounts.P1}</div></div>
-  </div>
-
-  <div class="grid2">
-    <div class="section">
-      <div class="section-title">Coverage by type</div>
-      ${covBars}
-    </div>
-    <div class="section">
-      <div class="section-title">Pass vs Fail</div>
-      <div class="chart-wrap"><canvas id="typeChart" role="img" aria-label="Pass vs fail by type"></canvas></div>
-    </div>
-  </div>
-
-  <div class="section">
-    <div class="section-title">Route Scan <span style="font-weight:400;font-size:.8rem;color:#64748b">${routeScans.length} routes probed</span></div>
-    ${routeCards}
-  </div>
-
-  <div class="section">
-    <div class="section-title">Test Results <span style="font-weight:400;font-size:.8rem;color:#64748b">${results.length} tests</span></div>
-    <table>
-      <thead><tr><th>Test</th><th>Type</th><th>Status</th><th>Sev</th><th>Duration</th><th>Retries</th><th>Error</th></tr></thead>
-      <tbody>${rows}</tbody>
-    </table>
-  </div>
-
-  <div class="section">
-    <div class="section-title">Bug Reports <span style="font-weight:400;font-size:.8rem;color:#64748b">${bugReports.length} bugs</span></div>
-    ${bugCards}
-  </div>
-</div>
-<footer>Generated by create-backlist v${VERSION} — Backlist QA Platform &nbsp;·&nbsp; ${new Date().toLocaleString()}</footer>
-<script>
-new Chart(document.getElementById('typeChart'), {
-  type: 'bar',
-  data: {
-    labels: ${chartLabels},
-    datasets: [
-      { label: 'Passed', data: ${chartPassed}, backgroundColor: '#34d399', borderRadius: 4 },
-      { label: 'Failed', data: ${chartFailed}, backgroundColor: '#f87171', borderRadius: 4 },
-    ]
-  },
-  options: {
-    responsive: true, maintainAspectRatio: false,
-    plugins: { legend: { labels: { color: '#94a3b8', font: { size: 12 } } } },
-    scales: {
-      x: { ticks: { color: '#64748b', font: { size: 11 } }, grid: { color: '#1e293b' } },
-      y: { ticks: { color: '#64748b', stepSize: 1, font: { size: 11 } }, grid: { color: '#1e293b' } }
+    if (!result.pass) {
+      this.#session.addBug({
+        title      : `Auth flow issue: ${url}`,
+        severity   : 'P0',
+        type       : 'auth',
+        description: result.message,
+        url,
+        evidence   : result.details,
+      });
     }
   }
-});
-</script>
-</body>
-</html>`;
+
+  #isAuthPage(url) {
+    return /\/(login|signin|auth|register|signup)/i.test(url);
+  }
+
+  // ── Add real result ────────────────────────────────────────────────────
+  #addResult(result) {
+    const r = {
+      id       : shortId(),
+      timestamp: timestamp(),
+      duration : result.duration || 0,
+      ...result,
+    };
+    this.#session.addResult(r);
+    this.#terminal.addResult(r);
+    this.emit('result', r);
+    return r;
+  }
 }
 
-// ── History helpers ────────────────────────────────────────────────────────
+// ─────────────────────────────────────────────────────────────────────────
+//  Public API — exported functions
+// ─────────────────────────────────────────────────────────────────────────
+
 export async function initQASystem() {
   await fs.ensureDir(QA_DIR);
   await fs.ensureDir(REPORT_DIR);
+  await fs.ensureDir(SCREENSHOT_DIR);
   if (!await fs.pathExists(HISTORY_FILE)) {
-    await fs.writeJson(HISTORY_FILE, { runs: [] }, { spaces: 2 });
+    await fs.writeJson(HISTORY_FILE, { runs: [], version: VERSION }, { spaces: 2 });
   }
 }
 
-async function loadHistory() {
-  try { return await fs.readJson(HISTORY_FILE); }
-  catch { return { runs: [] }; }
-}
-
-async function saveRun(run) {
-  const hist = await loadHistory();
-  hist.runs.unshift(run);
-  if (hist.runs.length > 50) hist.runs = hist.runs.slice(0, 50);
-  await fs.writeJson(HISTORY_FILE, hist, { spaces: 2 });
-}
-
-async function exportReport(run) {
-  try {
-    const slug     = run.id.toLowerCase();
-    const htmlPath = path.join(REPORT_DIR, `${slug}.html`);
-    const jsonPath = path.join(REPORT_DIR, `${slug}.json`);
-    await fs.writeFile(htmlPath, buildHTMLReport(run));
-    await fs.writeJson(jsonPath, run, { spaces: 2 });
-    return htmlPath;
-  } catch (err) {
-    console.error(chalk.gray(`  [warn] Report write failed: ${err.message}`));
-    return null;
-  }
+export async function saveSession(session) {
+  const history = await loadHistory();
+  const summary = session.getSummary();
+  history.runs.unshift({
+    id       : session.id,
+    startedAt: session.startedAt,
+    urls     : session.urls,
+    summary,
+    version  : VERSION,
+    bugCount : session.bugs.length,
+    screenshotCount: session.screenshots.length,
+  });
+  if (history.runs.length > 100) history.runs = history.runs.slice(0, 100);
+  await fs.writeJson(HISTORY_FILE, history, { spaces: 2 });
 }
 
-async function printRunDiff(currentRun) {
-  try {
-    const hist     = await loadHistory();
-    const previous = hist.runs.find(r => r.id !== currentRun.id && r.type === currentRun.type);
-    if (!previous) return;
-    const prevRate = previous.summary.total ? (previous.summary.passed / previous.summary.total * 100).toFixed(0) : 0;
-    const currRate = currentRun.summary.total ? (currentRun.summary.passed / currentRun.summary.total * 100).toFixed(0) : 0;
-    const delta    = Number(currRate) - Number(prevRate);
-    if (delta === 0) return;
-    const arrow = delta > 0 ? chalk.green(`↑ +${delta}%`) : chalk.red(`↓ ${delta}%`);
-    console.log(chalk.gray(`  vs previous run (${previous.id}): ${arrow} pass rate`));
-  } catch {}
+export async function loadHistory() {
+  try { return await fs.readJson(HISTORY_FILE); }
+  catch { return { runs: [], version: VERSION }; }
 }
 
-// ── Print summary ──────────────────────────────────────────────────────────
-function printResultsSummary(results) {
-  const passed   = results.filter(r => ['PASS','FLAKY'].includes(r.status)).length;
-  const failed   = results.filter(r => r.status === 'FAIL').length;
-  const passRate = results.length ? Math.round((passed / results.length) * 100) : 0;
+// ── URL QA entry point ────────────────────────────────────────────────────
+export async function runUrlQA({ localUrl, stagingUrl, prodUrl, options = {} } = {}) {
+  const urls = {};
+  if (localUrl)   urls.localhost  = localUrl;
+  if (stagingUrl) urls.staging    = stagingUrl;
+  if (prodUrl)    urls.production = prodUrl;
 
-  console.log('');
-  console.log(chalk.hex('#00F5FF').bold('  ── Scan Results ──────────────────────────────────────'));
-  console.log(`  Pass rate:  [${buildProgressBar(passRate, 24)}] ${chalk.white.bold(passRate + '%')}`);
-  console.log(`  ${chalk.green('✓')} ${passed} passed   ${chalk.red('✗')} ${failed} failed   (${results.length} total)`);
-  if (failed > 0) {
-    console.log('');
-    console.log(chalk.red.bold('  Failures:'));
-    results.filter(r => r.status === 'FAIL').forEach(f => {
-      const sev = f.sev ? ` [${f.sev}]` : '';
-      console.log(chalk.red(`    ✗${sev} ${f.name}`));
-      if (f.error) console.log(chalk.gray(`      → ${f.error}`));
-    });
-  }
-  console.log('');
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-//  Manual QA Flow (v9 retained + v10 URL option)
-// ─────────────────────────────────────────────────────────────────────────
-
-export async function runManualQA() {
-  const runId     = `MQA-${shortId()}`;
-  const startedAt = timestamp();
-  const runner    = new TestRunner();
-  const bugs      = [];
-  const manualResults = [];
-
-  console.log('');
-  const action = await p.select({
-    message: 'Manual QA — what would you like to do?',
-    options: [
-      { value: 'url-scan',     label: '🌐 URL-Based Scan',            hint: 'Enter URL(s) and run HTTP probe tests' },
-      { value: 'new-test',     label: '✏️  Create & run a custom test' },
-      { value: 'full-scan',    label: '🔬 Full system scan',           hint: 'File-system + UI tests' },
-      { value: 'log-bug',      label: '🐛  Log a bug report' },
-      { value: 'security-scan',label: '🛡️  Security scan only' },
-      { value: 'ui-tests',     label: '🖥️  UI/Frontend tests' },
-    ],
-  });
-  if (p.isCancel(action)) { p.cancel('Cancelled.'); return; }
-
-  const dashboard = new LiveDashboard();
-
-  if (action === 'url-scan') {
-    const localUrl = await p.text({ message: 'Localhost URL (leave blank to skip):', placeholder: 'http://localhost:3000' });
-    const prodUrl  = await p.text({ message: 'Production URL (leave blank to skip):', placeholder: 'https://yoursite.com' });
-    if (p.isCancel(localUrl) || p.isCancel(prodUrl)) { p.cancel('Cancelled.'); return; }
-    const run = await runUrlQA({
-      localUrl : String(localUrl).trim() || undefined,
-      prodUrl  : String(prodUrl).trim()  || undefined,
-    });
-    if (run) manualResults.push(...run.results);
-  } else if (action === 'log-bug') {
-    await logBugInteractive(bugs);
-  } else if (action === 'new-test') {
-    await createAndRunTestInteractive(runner, manualResults, dashboard);
-  } else if (action === 'full-scan') {
-    dashboard.start();
-    const results = await runner.run([...buildFullSystemTests(), ...buildUITests()], dashboard);
-    manualResults.push(...results);
-    dashboard.stop();
-    printResultsSummary(results);
-  } else if (action === 'ui-tests') {
-    dashboard.start();
-    const results = await runner.run(buildUITests(), dashboard);
-    manualResults.push(...results);
-    dashboard.stop();
-    printResultsSummary(results);
-  } else if (action === 'security-scan') {
-    dashboard.start();
-    const results = await runner.run(buildFullSystemTests().filter(t => t.type === 'security' || t.type === 'auth'), dashboard);
-    manualResults.push(...results);
-    dashboard.stop();
-    printResultsSummary(results);
+  if (Object.keys(urls).length === 0) {
+    console.log(chalk.red('  No URLs provided.'));
+    return null;
   }
 
-  const continueLoop = await p.confirm({ message: 'Run another action?' });
-  if (!p.isCancel(continueLoop) && continueLoop) return runManualQA();
+  const session = new QASession(urls);
+  const engine  = new QAEngine(session, options);
 
-  const duration = Date.now() - new Date(startedAt).getTime();
-  const summary  = buildSummary(manualResults);
-  const coverage = buildCoverageMatrix(manualResults);
-  const run      = { id: runId, type: 'manual', version: VERSION, startedAt, duration, results: manualResults, bugReports: bugs, summary, coverage };
-  await saveRun(run);
-  const reportFile = await exportReport(run);
+  await engine.init();
+  await engine.run();
+  await saveSession(session);
 
-  p.outro(chalk.hex('#00F5FF').bold(`✓ Session saved — ${pluralize(manualResults.length, 'test')}, ${pluralize(bugs.length, 'bug')}`));
-  if (reportFile) console.log(chalk.gray(`  📄 Report: ${reportFile}`));
-}
+  const htmlReporter = new HTMLReporter(session);
+  const jsonReporter = new JSONReporter(session);
 
-async function logBugInteractive(bugs) {
-  const title    = await p.text({ message: 'Bug title:' });
-  if (p.isCancel(title)) return;
-  const severity = await p.select({ message: 'Severity:',
-    options: Object.entries(SEVERITY_LEVELS).map(([k, v]) => ({ value: k, label: `${k} — ${v}` })) });
-  if (p.isCancel(severity)) return;
-  const description = await p.text({ message: 'Description (optional):', placeholder: 'Steps to reproduce…' });
-  bugs.push({ id: `BUG-${shortId()}`, title: String(title), severity: String(severity), status: 'OPEN',
-    description: p.isCancel(description) ? '' : description, createdAt: timestamp() });
-  console.log(chalk.green(`  ✓ Bug logged as ${colorSeverity(String(severity))}`));
-}
+  const htmlPath = await htmlReporter.generate(REPORT_DIR);
+  const jsonPath = await jsonReporter.generate(REPORT_DIR);
 
-async function createAndRunTestInteractive(runner, results, dashboard) {
-  const name = await p.text({ message: 'Test name:' });
-  if (p.isCancel(name)) return;
-  const type = await p.select({ message: 'Test type:', options: TEST_TYPES.map(t => ({ value: t, label: t })) });
-  if (p.isCancel(type)) return;
-  const expectPass = await p.confirm({ message: 'Should this test pass?' });
-
-  dashboard.start();
-  const [result] = await runner.run([{
-    id: shortId(), name: String(name), type: String(type), sev: 'P3',
-    fn: async () => {
-      await sleep(400 + Math.random() * 300);
-      if (!expectPass) throw new Error('Test manually marked as failure');
-    },
-  }], dashboard);
-  results.push(result);
-  dashboard.stop();
-  console.log(`  ${colorStatus(result.status)}  ${result.name}  ${chalk.gray(formatDuration(result.duration))}`);
+  return { session, htmlPath, jsonPath };
 }
 
-// ─────────────────────────────────────────────────────────────────────────
-//  Automated QA Flow (v9 retained + v10 URL integration)
-// ─────────────────────────────────────────────────────────────────────────
-
-export async function runAutomatedQA({ continuous = false, localUrl, prodUrl } = {}) {
+// ── Automated QA entry point ──────────────────────────────────────────────
+export async function runAutomatedQA({ continuous = false, localUrl, prodUrl, stagingUrl } = {}) {
   const runOnce = async () => {
-    const runId     = `AQA-${shortId()}`;
-    const startedAt = timestamp();
+    const urls = {};
+    if (localUrl)   urls.localhost  = localUrl;
+    if (stagingUrl) urls.staging    = stagingUrl;
+    if (prodUrl)    urls.production = prodUrl;
 
-    console.log('');
-    console.log(chalk.hex('#BF40FF').bold(`  ── 🤖 Automated QA v${VERSION} — Run ${runId} ──`));
-    console.log('');
-
-    let endpoints = [];
-    try {
-      const { analyzeFrontend } = await import('../analyzer.js');
-      endpoints = await analyzeFrontend(path.join(process.cwd(), 'src'));
-    } catch {}
+    if (Object.keys(urls).length === 0) {
+      console.log(chalk.yellow('  No URLs configured. Skipping URL-based tests.'));
+    }
 
-    const allTests = [
-      ...buildFullSystemTests(),
-      ...buildEndpointTests(endpoints),
-      ...buildUITests(),
-    ];
+    const session = new QASession(urls);
+    const engine  = new QAEngine(session);
 
-    console.log(chalk.gray(`  Test suite: ${allTests.length} tests across ${new Set(allTests.map(t => t.type)).size} categories\n`));
+    await engine.init();
+    await engine.run();
+    await saveSession(session);
 
-    const dashboard = new LiveDashboard();
-    const runner    = new TestRunner();
-    const autoBugs  = [];
+    const htmlPath = await new HTMLReporter(session).generate(REPORT_DIR);
+    const jsonPath = await new JSONReporter(session).generate(REPORT_DIR);
 
-    runner.on('result', r => {
-      if (r.status === 'FAIL') {
-        autoBugs.push({
-          id: `AUTO-${shortId()}`, title: `Automated: ${r.name}`,
-          severity  : r.sev || (r.type === 'security' || r.type === 'auth' ? 'P0' : r.type === 'e2e' ? 'P1' : 'P2'),
-          status    : 'OPEN', description: r.error || '', createdAt: timestamp(),
-        });
-      }
-    });
+    const summary = session.getSummary();
+    console.log(chalk.hex('#00F5FF').bold(
+      `\n  ✓ Run ${session.id} — ${summary.total} tests · ${summary.failed} failed · ` +
+      `${session.bugs.length} bugs · ${formatDuration(summary.duration)}`
+    ));
+    if (htmlPath) console.log(chalk.gray(`  📄 Report: ${htmlPath}`));
+    return session;
+  };
 
-    dashboard.start();
-    const results = await runner.run(allTests, dashboard);
-    dashboard.stop();
+  if (!continuous) return runOnce();
 
-    // If URLs provided, run URL-based QA too
-    if (localUrl || prodUrl) {
-      const urlRun = await runUrlQA({ localUrl, prodUrl, silent: true });
-      if (urlRun) { results.push(...urlRun.results); autoBugs.push(...urlRun.bugReports); }
-    }
+  console.log(chalk.cyan('  ⚡ Continuous mode — re-runs every 60s. Ctrl+C to stop.\n'));
+  let i = 0;
+  while (true) {
+    console.log(chalk.gray(`\n  ── Run #${++i} ── ${new Date().toLocaleTimeString()}`));
+    await runOnce();
+    await sleep(60_000);
+  }
+}
 
-    const duration = Date.now() - new Date(startedAt).getTime();
-    const summary  = buildSummary(results);
-    const coverage = buildCoverageMatrix(results);
+// ── Manual QA ─────────────────────────────────────────────────────────────
+export async function runManualQA() {
+  console.log('');
 
-    printResultsSummary(results);
+  const action = await p.select({
+    message: 'Manual QA — what to run?',
+    options: [
+      { value: 'full-url',  label: '🌐 Full URL-Based Real Scan', hint: 'Browser + API + Security + Perf + SEO + A11y' },
+      { value: 'security',  label: '🛡️  Security Only',           hint: 'Real HTTP security header + vuln scan'         },
+      { value: 'perf',      label: '⚡ Performance Only',          hint: 'Real Core Web Vitals measurement'             },
+      { value: 'a11y',      label: '♿ Accessibility Only',        hint: 'Real axe-core WCAG scan'                      },
+      { value: 'seo',       label: '🔎 SEO Only',                  hint: 'Real meta, og, robots, sitemap scan'          },
+      { value: 'api',       label: '📡 API Only',                  hint: 'Real endpoint probe + contract validation'    },
+    ],
+  });
+  if (p.isCancel(action)) { p.cancel('Cancelled.'); return; }
 
-    const run = { id: runId, type: 'automated', version: VERSION, startedAt, duration,
-      results, bugReports: autoBugs, summary, coverage,
-      urls: [localUrl, prodUrl].filter(Boolean).map((u, i) => ({ label: i === 0 ? 'localhost' : 'production', url: u })) };
-    await saveRun(run);
-    const reportFile = await exportReport(run);
+  const localUrl = await p.text({
+    message    : 'Localhost URL:',
+    placeholder: 'http://localhost:3000',
+  });
+  if (p.isCancel(localUrl)) { p.cancel('Cancelled.'); return; }
 
-    if (reportFile) console.log(chalk.gray(`  📄 Report: ${reportFile}`));
-    await printRunDiff(run);
+  const prodUrl = await p.text({
+    message    : 'Production URL (blank to skip):',
+    placeholder: 'https://yoursite.com',
+  });
 
-    p.outro(chalk.hex('#00F5FF').bold(`Run ${runId} complete — ${formatDuration(duration)}`));
-    return run;
+  const urls = {
+    localhost : String(localUrl).trim() || undefined,
+    production: !p.isCancel(prodUrl) ? String(prodUrl).trim() || undefined : undefined,
   };
 
-  if (!continuous) { await runOnce(); return; }
+  const session = new QASession(urls);
+  const engine  = new QAEngine(session);
+  await engine.init();
 
-  console.log(chalk.cyan(`  ⚡ Continuous mode — reruns every ${WATCH_INTERVAL_MS / 1000}s. Ctrl+C to stop.\n`));
-  let iteration = 0;
-  while (true) {
-    iteration++;
-    console.log(chalk.gray(`\n  ── Iteration ${iteration} ── ${new Date().toLocaleTimeString()}`));
-    await runOnce();
-    await sleep(WATCH_INTERVAL_MS);
+  // Only run selected phases
+  await engine.runPhase(action);
+
+  await saveSession(session);
+  const htmlPath = await new HTMLReporter(session).generate(REPORT_DIR);
+  if (htmlPath) {
+    p.outro(chalk.hex('#00F5FF').bold('✓ QA complete'));
+    console.log(chalk.gray(`  📄 Report: ${htmlPath}`));
   }
 }
 
-// ── Post-gen auto-run ──────────────────────────────────────────────────────
+// ── Post-generation validation ────────────────────────────────────────────
 export async function autoRunPostGeneration(options = {}) {
   console.log('');
-  console.log(chalk.hex('#00F5FF').bold(`  ── 🔬 Post-Generation QA Scan v${VERSION} ──────────────`));
-  console.log(chalk.gray(`  Validating: ${options.projectName || 'backend'}`));
+  console.log(chalk.hex('#00F5FF').bold(`  ── 🔬 Post-Generation Real QA v${VERSION} ──`));
+  console.log(chalk.gray('  Note: Start your server first, then provide its URL'));
   console.log('');
 
-  const projectDir = options.projectDir || process.cwd();
-  const tests      = buildFullSystemTests(projectDir);
-  const runner     = new TestRunner();
-  const dashboard  = new LiveDashboard();
-  const autoBugs   = [];
-
-  runner.on('result', r => {
-    if (r.status === 'FAIL') {
-      autoBugs.push({ id: `POST-${shortId()}`, title: r.name,
-        severity: r.sev || (r.type === 'security' ? 'P0' : 'P2'),
-        status: 'OPEN', description: r.error || '', createdAt: timestamp() });
-    }
+  const url = await p.text({
+    message    : 'Server URL to validate:',
+    placeholder: 'http://localhost:3000',
+    defaultValue: 'http://localhost:3000',
   });
+  if (p.isCancel(url)) { p.cancel('Cancelled.'); return; }
 
-  dashboard.start();
-  const results = await runner.run(tests, dashboard);
-  dashboard.stop();
-
-  const summary  = buildSummary(results);
-  const coverage = buildCoverageMatrix(results);
-  const run      = { id: `POST-${shortId()}`, type: 'post-generation', version: VERSION,
-    startedAt: timestamp(), duration: 0, results, bugReports: autoBugs, summary, coverage };
-
-  await saveRun(run);
-  const reportFile = await exportReport(run);
-  printResultsSummary(results);
-
-  if (autoBugs.length > 0) {
-    console.log(chalk.red.bold(`  ⚠  ${autoBugs.length} issue(s) detected:`));
-    autoBugs.forEach(b => console.log(chalk.red(`    ${colorSeverity(b.severity)} ${b.title}`)));
-    console.log('');
+  const result = await runUrlQA({ localUrl: String(url).trim() });
+  if (result?.htmlPath) {
+    console.log(chalk.gray(`  📄 Report: ${result.htmlPath}`));
   }
-  if (reportFile) console.log(chalk.gray(`  📄 Post-gen report: ${reportFile}`));
 }
 
-// ── QA History ─────────────────────────────────────────────────────────────
+// ── View History ──────────────────────────────────────────────────────────
 export async function viewQAHistory() {
-  const hist = await loadHistory();
-  if (!hist.runs.length) { console.log(chalk.yellow('\n  No QA history found.\n')); return; }
+  const history = await loadHistory();
+  if (!history.runs?.length) {
+    console.log(chalk.yellow('\n  No QA history found.\n'));
+    return;
+  }
 
   console.log('');
-  console.log(chalk.hex('#00F5FF').bold('  QA History (most recent first)'));
-  console.log(chalk.gray('  ─────────────────────────────────────────────────────'));
+  console.log(chalk.hex('#00F5FF').bold('  QA History (real runs only)'));
+  console.log(chalk.gray('  ──────────────────────────────────────────────────────'));
+
+  for (const run of history.runs.slice(0, 15)) {
+    const rate   = run.summary?.passRate ?? '–';
+    const color  = Number(rate) >= 90 ? chalk.green : Number(rate) >= 70 ? chalk.yellow : chalk.red;
+    const bugs   = run.bugCount ?? 0;
+    const shots  = run.screenshotCount ?? 0;
+    const urlStr = Object.values(run.urls || {}).filter(Boolean).join(', ');
 
-  for (const run of hist.runs.slice(0, 10)) {
-    const passRate  = run.summary.total ? ((run.summary.passed / run.summary.total) * 100).toFixed(0) : '–';
-    const rateColor = Number(passRate) >= 90 ? chalk.green : Number(passRate) >= 70 ? chalk.yellow : chalk.red;
-    const ver       = run.version ? chalk.dim(`v${run.version}`) : '';
     console.log(
-      `  ${chalk.gray(run.id.padEnd(18))}  ${chalk.gray(new Date(run.startedAt).toLocaleString().padEnd(24))}` +
-      `  ${rateColor(`${passRate}%`.padStart(5))}  ${chalk.gray(`${run.summary.total} tests`)}  ${ver}`
+      `  ${chalk.gray(run.id.padEnd(14))} ` +
+      `${chalk.gray(new Date(run.startedAt).toLocaleString().padEnd(24))} ` +
+      `${color(String(rate + '%').padStart(6))} ` +
+      `${chalk.gray(String(run.summary?.total || 0) + ' tests')} ` +
+      `${chalk.cyan(bugs + ' bugs')} ` +
+      `${chalk.gray(shots + ' shots')} ` +
+      `${chalk.dim(urlStr.slice(0, 40))}`
     );
   }
   console.log('');
 
   const chosen = await p.select({
-    message: 'View a run in detail?',
+    message: 'Open a report?',
     options: [
-      ...hist.runs.slice(0, 5).map(r => ({ value: r.id, label: `${r.id} — ${new Date(r.startedAt).toLocaleString()}` })),
+      ...history.runs.slice(0, 8).map(r => ({
+        value: r.id,
+        label: `${r.id} — ${new Date(r.startedAt).toLocaleString()} — ${r.bugCount} bugs`,
+      })),
       { value: '__back', label: '↩ Back' },
     ],
   });
   if (p.isCancel(chosen) || chosen === '__back') return;
 
-  const run = hist.runs.find(r => r.id === chosen);
-  if (!run) return;
-
-  console.log('');
-  console.log(chalk.bold(`  Run: ${run.id}  (${run.type}) ${run.version ? `v${run.version}` : ''}`));
-  console.log(chalk.gray(`  ${new Date(run.startedAt).toLocaleString()}  ·  ${formatDuration(run.duration)}`));
-  if (run.urls?.length) {
-    console.log(chalk.gray(`  URLs: ${run.urls.map(u => u.url).join(', ')}`));
-  }
-  console.log('');
-  for (const r of run.results) {
-    console.log(`  ${colorStatus(r.status)}  ${r.name}  ${chalk.gray(formatDuration(r.duration))}`);
-    if (r.error) console.log(chalk.red(`       ↳ ${r.error}`));
-  }
-  if (run.bugReports?.length) {
-    console.log('');
-    console.log(chalk.bold('  Bug Reports:'));
-    for (const b of run.bugReports) {
-      console.log(`  ${colorSeverity(b.severity)}  ${b.title}  ${chalk.gray(`[${b.status}]`)}`);
-    }
+  const reportPath = path.join(REPORT_DIR, `${chosen.toLowerCase()}.html`);
+  if (await fs.pathExists(reportPath)) {
+    console.log(chalk.green(`  📄 Report: ${reportPath}`));
+    // Open in browser if possible
+    try {
+      const { exec } = await import('node:child_process');
+      const cmd = process.platform === 'darwin' ? 'open'
+                : process.platform === 'win32'  ? 'start'
+                : 'xdg-open';
+      exec(`${cmd} "${reportPath}"`);
+    } catch {}
+  } else {
+    console.log(chalk.yellow('  Report file not found — may have been deleted.'));
   }
-  console.log('');
 }