create-pmos 0.188.0 → 0.189.0

package/workspace/c3-scan-test.js

@@ -1,16 +1,27 @@
 #!/usr/bin/env node
 'use strict';
-/* c3-scan-test.js — the Horizon scan on console3 (initiative horizon-scan; PRD section 6 and the mockup 40-scan).
- * LIVE mode: a real server and a scratch repository whose scan ledger this suite seeds (c3-scan-fixture.js; PMOS_DRIVER=off, so no scan
- * and no suggest run starts and every line the page shows is one the fixture wrote). A real Chromium drives /c3.html.
+/* c3-scan-test.js — the portfolio Horizon scan on console3 (initiative horizon-scan-portfolio; PRD sections 1 to 4 and 7; the approved mockup 42-hscan).
+ * LIVE mode: a real server and a scratch repository (c3-scan-fixture.js) and a real Chromium driving /c3.html. The first part routes the page's
+ * /api/scan/* calls to a model that answers with the REAL view functions and presses of lib/scan.js and lib/routes-scan.js over a ledger of its own
+ * (portfolioStub), so a test can move a scan one step at a time. The last part (E) is end to end: no routing at all, the server's own scan routes over a
+ * seeded state folder, the runner stubbed, a real initiative created. The report documents are real markdown files read through GET /api/doc.
  *
- *   settings   Board settings has the Horizon scan block: How often (Daily, Weekly, Off), the schedule line, the banner, the watch list with
- *              Keep, Edit and Remove on each suggestion, Undo after Remove, and Add; every press posts to /api/scan/* with no writer field
- *   triage     the asks a scan found read "Found by agent", with the reason, source chips (a public page is a link), the match chip and
- *              Accept, Ask for more and Decline
- *   briefing   the Horizon scan card: the counts, one row per finding, "Nothing was sent", Open Triage and Scan settings both navigate
- *   phone      at 400 wide none of the three has a horizontal scroll
- * Set SCAN_SHOTS=<dir> to save screenshots of the three screens at 1280 and 400 wide. Every wait polls the page. No script error may be raised.
+ *   pure       the client's readers: portfolio shape, front matter, evidence links, the summary line
+ *   portfolio  the Horizon scan section of Initiatives > Portfolio: Scan now and "Horizon scan setup" visible in the first-time state, the board count
+ *   setup      the sheet: last and next scan, Scan now (also in the header), How often, repository and report types, the watch list with kind and
+ *              board chips, Keep all, Keep, Edit, Remove with Undo and Add; every press posts to /api/scan/* with no writer field
+ *   picker     Scan now: items, repository and report types, a plain warning when nothing is chosen, the server's refusal in words
+ *   running    the steps with Stop; Stop posts; a finished scan lists its reports
+ *   document   a report opens in the existing document sheet by its state-folder path, with the Proposed next steps panel under the header and
+ *              tabs: create, research and attach; Approve, Change first, Dismiss (a reason is required), Undo and the toasts
+ *   portfolio  after a scan: the latest scan's reports and "Waiting for you: N proposals"
+ *   briefing   the Horizon scan card; Open and Scan now
+ *   board      Board settings holds one pointer line, no scan block
+ *   E          end to end on the real server routes: Scan now, setup and Keep, a seeded report with its proposals panel, Change first then Approve
+ *              (a real initiative in the first stage), Dismiss with a reason then Undo
+ *   triage     the asks an earlier per-board scan found still read "Found by agent" (c3-ib-triage.js)
+ *   phone      at 400 wide none of these has a horizontal scroll
+ * Set SCAN_SHOTS=<dir> to save screenshots. Every wait polls the page. No script error may be raised.
  */
 const fs = require('fs');
 const path = require('path');
@@ -18,7 +29,7 @@ const { findBrowser } = require('./lib/find-browser');
 const F = require('./c3-scan-fixture');
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-const until = async (fn, ms = 20000, step = 120) => { const t0 = Date.now(); for (;;) { const v = await fn(); if (v) return v; if (Date.now() - t0 > ms) return v; await sleep(step); } };
+const until = async (fn, ms = 20000, step = 100) => { const t0 = Date.now(); for (;;) { const v = await fn(); if (v) return v; if (Date.now() - t0 > ms) return v; await sleep(step); } };
 const results = [];
 const ok = (n, cond, extra = '') => { results.push({ n, cond: !!cond }); console.log(`${cond ? '✓' : '✗'} ${n}${!cond && extra !== '' ? ' — ' + String(extra).slice(0, 500) : ''}`); };
 let fx = null; let browser = null;
@@ -37,134 +48,470 @@ process.on('unhandledRejection', (e) => { console.error(e); finish(1); });
   let chromium;
   try { ({ chromium } = require('playwright-core')); } catch { console.log('· playwright-core not installed — c3-scan suite skipped'); process.exit(0); }
   fx = await F.start({ name: 'c3-scan' });
-  const { BASE, ws, S, ledger } = fx;
-  const state = () => S.fold(S.readLines(ledger));
+  const { BASE, ws } = fx;
   browser = await chromium.launch({ executablePath: exe });
+  require('./lib/c3-full-console').fullConsole(browser);   // the desktop layout at phone width (c3-phone-companion)
   const ctx = await browser.newContext({ viewport: { width: 1280, height: 900 } });
   const page = await ctx.newPage();
   const errors = []; page.on('pageerror', (e) => errors.push(String((e && e.message) || e)));
-  const posts = []; page.on('request', (r) => { if (r.method() === 'POST' && r.url().includes('/api/scan/')) posts.push({ path: new URL(r.url()).pathname, body: JSON.parse(r.postData() || '{}') }); });
+  const docReads = []; page.on('request', (r) => { if (r.url().includes('/api/doc?')) docReads.push(new URL(r.url()).searchParams.get('path') || ''); });
+  const P = fx.portfolio(); await P.install(page);
+  const posts = () => P.calls.filter((c) => c.method === 'POST');
+  const lastPost = (p) => posts().filter((c) => c.path === p).pop();
   const st = (f, a) => page.evaluate(f, a);
-  const sel = (s) => until(() => page.$(s));
+  const sel = (s, ms) => until(() => page.$(s), ms);
   const shots = process.env.SCAN_SHOTS || '';
   if (shots) fs.mkdirSync(shots, { recursive: true });
   const shot = async (name) => { if (shots) await page.screenshot({ path: path.join(shots, name + '.png'), fullPage: false }); };
-  const noScroll = () => st(() => document.documentElement.scrollWidth <= window.innerWidth + 1);
-  const openSettings = async () => {
-    await page.goto(BASE + `/c3.html?tab=init&init=board:${ws}:summary`, { waitUntil: 'load' });
-    await (await sel('[data-ini=board-settings]')).click();
-    await sel('[data-scan-set] [data-scan-item]');
-  };
-
-  /* ── settings ── */
-  await openSettings();
-  const items = () => st(() => [...document.querySelectorAll('[data-scan-item]')].map((n) => ({ id: n.dataset.scanItem, state: n.dataset.scanState, text: n.textContent })));
-  const blk = await st(() => document.querySelector('[data-scan-set]').textContent);
-  ok('T1 the block says HORIZON SCAN, How often, the schedule line and the watch list count', /HORIZON SCAN/.test(blk) && /HOW OFTEN/.test(blk) && /Every working day, 09:00/.test(blk) && /WATCH LIST \(3\)/.test(blk), blk.slice(0, 300));
-  ok('T2 Daily is pressed; Weekly and Off are not', await st(() => ['daily', 'weekly', 'off'].map((k) => document.querySelector(`[data-scan-freq=${k}]`).getAttribute('aria-pressed')).join() === 'true,false,false'));
-  ok('T3 the first-time banner says the agent suggests 3 things and to keep, edit or remove each', /The agent suggests 3 things to watch\. Keep, edit or remove each before the first scan\./.test(await st(() => (document.querySelector('[data-scan="banner"]') || {}).textContent || '')));
-  ok('T4 the last scan line says none yet and that nothing runs until an item is kept', /Last scan: none yet/.test(blk) && /No scan runs until you keep an item/.test(blk), blk);
+  const noScroll = () => st(() => document.documentElement.scrollWidth <= window.innerWidth + 1 && [...document.querySelectorAll('.sheet .sb')].every((n) => n.scrollWidth <= n.clientWidth + 1));
+  const text = (s) => st((q) => { const n = document.querySelector(q); return n ? n.textContent : ''; }, s);
+  const toastText = () => st(() => (document.querySelector('[data-c3-toast]') || {}).textContent || '');
+  const portfolio = async () => { await page.goto(BASE + '/c3.html?tab=init', { waitUntil: 'load' }); await sel('[data-scan-section="portfolio"] [data-scan-act=scan]'); };
+
+  /* ── pure parts, read in the page ── */
+  await portfolio();
+  const pure = await st(async () => {
+    const A = await import('/pm/c3-scan-api.js'); const N = await import('/pm/c3-scan-next.js');
+    const real = { ok: true, setting: { cadence: 'weekly', repo: false, types: ['benchmark'] }, switched_off: false, next: '2026-10-19T09:00:00.000Z',
+      items: [{ id: 'w-0000000a', kind: 'weird', name: 'A', why: '', ini: 'IDPF-1', added: false, state: 'suggested', boards: ['b1'], ids: ['w-0000000a'] }, { id: 'w-0000000b', kind: 'domain', name: 'B', why: 'y', ini: null, added: true, state: 'kept', boards: [], ids: ['w-0000000b'] }],
+      last: { scan: 'scan-1', at: 'a', end: 'b', ok: true, reason: null, found: 3, skipped: 1, pages: 12, manual: false, stopped: false }, manual: { limit: 3, used: 2, left: 1, ok: true },
+      open: { scan: 'scan-2', mode: 'scan', manual: true, start: 'c', stopping: false, steps: [{ id: 'web', label: 'Searching the public web', state: 'running' }, { id: 'repo', label: 'Reading the repository', state: 'pending' }], reports: [] },
+      reports: [{ id: 'r-1', scan: 'scan-1', type: 'benchmark', label: 'Benchmark report', title: 'T', path: 'pmos/state/reports/scan-benchmark/2026-10-13.md', written: true, parent: null, proposals: { open: 1, total: 3 } }],
+      proposals_waiting: 2,
+      proposals: [{ id: 'p-1', report: 'r-1', report_title: 'T', kind: 'attach', title: 'X', why: 'w', finding: 'F', evidence: [{ label: 'L', ref: 'IDPF-1' }, { label: 'x', ref: '' }, { label: 'W', ref: 'https://a.example/b' }, { label: 'P', ref: 'src/a.js' }],
+        fields: { initiative: 'IDPF-1' }, state: 'approved', changed: true, dismissed_why: null, result: { initiative: 'IDPF-1' }, at: 'x', decided_at: 'y' },
+      { id: 'p-2', report: 'r-1', report_title: 'T', kind: 'create', title: 'Y', why: 'w', finding: 'G', evidence: [], fields: { board: 'b1', lane: 'feature', anchor: 'health:tech', intent: 'i' }, state: 'dismissed', changed: false, dismissed_why: 'no', result: null }] };
+    const d = A.readPortfolio(real); const p0 = d.proposals[0]; const p1 = d.proposals[1];
+    return { cad: d.setting.cadence, repo: d.setting.repo, types: d.setting.types.join(), items: d.items.map((w) => w.id + w.kind + w.state + (w.added ? '+' : '-') + w.ini).join(), waiting: d.waiting, open: d.open.scan + d.open.steps.map((x) => x.id).join(), left: d.manual.left,
+      rep: d.reports[0].open + '/' + d.reports[0].total + d.reports[0].written, kind: p0.kind, fields: JSON.stringify(p0.fields), from: p0.from, ev: p0.evidence.map((e) => e.kind).join(), state: p0.state, out: JSON.stringify(A.readOut({ initiative: { id: 'X-1' }, board: 'b', stage: 'Discover' })), outStr: p0.out.id, changed: p0.changed,
+      reason: p1.reason, create: JSON.stringify(p1.fields), state2: p1.state,
+      words: [A.scanNowWords({ why: 'running' }), A.scanNowWords({ why: 'quiet-hours' }), A.scanNowWords({ why: 'manual-limit', limit: 3 })].join('|'),
+      front: A.frontOf('---\ntype: Reference\nsource: scan:portfolio\nreport: r-1\n---\n# T').source, none: Object.keys(A.frontOf('# T')).length,
+      js: N.evidenceHref({ kind: 'web', ref: 'javascript:alert(1)' }), host: N.evidenceHref({ kind: 'web', ref: 'docs.stripe.com/changelog' }), jira: N.evidenceHref({ kind: 'jira', ref: 'IDPF-1' }), outOf: JSON.stringify(N.outOf({ result: { initiative: { id: 'X-1' }, board: 'b', stage: 'Discover' } })),
+      sum: N.sumLine([{ kind: 'create', state: 'open' }, { kind: 'attach', state: 'open' }, { kind: 'attach', state: 'done' }]), all: N.sumLine([]) };
+  });
+  ok('U1 readPortfolio reads the server\'s names: items (state suggested or kept, ini, added), proposals_waiting, open.scan and steps[].id, manual.left, reports[].proposals.open, an unknown kind as product',
+    pure.cad === 'weekly' && pure.repo === false && pure.types === 'benchmark' && pure.items === 'w-0000000aproductsuggested-IDPF-1,w-0000000bdomainkept+' && pure.waiting === 2 && pure.open === 'scan-2web,repo' && pure.left === 1 && pure.rep === '1/3true', JSON.stringify(pure));
+  ok('U2 readProposal reads approved as done, finding as from, evidence { label, ref } with a kind taken from the ref (an empty ref dropped), result.initiative as out, dismissed_why as reason, and the create fields by the server\'s names',
+    pure.kind === 'attach' && pure.fields === '{"initiative":"IDPF-1"}' && pure.from === 'F' && pure.ev === 'jira,web,repo' && pure.state === 'done' && pure.outStr === 'IDPF-1' && pure.changed === true && pure.reason === 'no' && pure.state2 === 'dismissed'
+    && pure.create === '{"title":"Y","board":"b1","lane":"feature","anchor":"health:tech","intent":"i"}' && pure.out === '{"id":"X-1","board":"b","stage":"Discover","scan":"","report":""}' && pure.outOf === '{"id":"X-1","board":"b","stage":"Discover"}', JSON.stringify(pure));
+  ok('U3 frontOf, evidenceHref, sumLine and the words of a refused Scan now: a javascript: reference opens nothing, a bare host opens https, a Jira key opens nothing; running, quiet hours and the daily limit each have their own sentence',
+    pure.front === 'scan:portfolio' && pure.none === 0 && pure.js === '' && pure.host === 'https://docs.stripe.com/changelog' && pure.jira === '' && pure.sum === '1 create initiative, 1 add to an existing initiative' && pure.all === 'All handled.'
+    && /^A scan is running now\. .*\|Quiet hours hold.*\|You used all 3 manual scans today/.test(pure.words), JSON.stringify(pure));
+
+  /* ── portfolio, first time ── */
+  const sec = await text('[data-scan-section="portfolio"]');
+  ok('P1 Initiatives > Portfolio has a Horizon scan section that names the whole portfolio and its board count', /Horizon scan/i.test(sec) && /Whole portfolio: 1 board/.test(sec), sec);
+  ok('P2 in the first-time state the section says the agent suggests 4 things to watch', /The agent suggests 4 things to watch/.test(sec), sec);
+  ok('P3 Scan now is visible and primary, and "Horizon scan setup" is beside it', await st(() => { const s = document.querySelector('[data-scan-section="portfolio"]'); const a = s.querySelector('[data-scan-act=scan]'); const b = s.querySelector('[data-scan-act=setup]');
+    return a && b && a.offsetWidth > 0 && /primary/.test(a.className) && /Scan now/.test(a.textContent) && /Horizon scan setup/.test(b.textContent); }));
+  ok('P4 the section has no report rows and no "Waiting for you" line before a scan', !(await page.$('[data-scan-section] [data-scan-report]')) && !(await page.$('[data-scan="waiting"]')));
+  ok('P5 the page read GET /api/scan/portfolio with the workspace', P.calls.some((c) => c.method === 'GET' && c.path === '/api/scan/portfolio' && c.query.ws === ws));
+  ok('P6 every control in the section is a real button (the primitive)', await st(() => [...document.querySelectorAll('[data-scan-section] button')].every((b) => /pmc-btn/.test(b.className))));
+  await shot('portfolio-first');
+
+  /* ── setup ── */
+  await page.click('[data-scan-section] [data-scan-act=setup]');
+  await sel('[data-scan-setup] [data-scan-item]');
+  const set0 = await text('[data-scan-setup]');
+  ok('S1 the sheet has Last scan and next scan, How often, Watch list (4), Sources and Report types', /Last scan and next scan/i.test(set0) && /How often/i.test(set0) && /Watch list\s*4/i.test(set0) && /Sources/i.test(set0) && /Report types/i.test(set0), set0.slice(0, 300));
+  ok('S2 Last scan says none yet, the schedule says Every working day, 09:00, and the first scan waits for the list', /Last scan: none yet/.test(set0) && /Every working day, 09:00/.test(set0) && /first scheduled scan runs after you decide on the watch list/.test(set0), set0.slice(0, 400));
+  ok('S3 Scan now is in the sheet header and in the status block', (await page.$$('[data-scan-setup] [data-scan-act=scan]')).length === 1 && !!(await page.$('.sheet [data-scan-head]')));
+  ok('S4 Daily is pressed; Weekly and Off are not', await st(() => ['daily', 'weekly', 'off'].map((k) => document.querySelector(`[data-scan-freq=${k}]`).getAttribute('aria-pressed')).join() === 'true,false,false'));
+  ok('S5 the banner says the agent suggests 4 things, 4 still to decide, with Keep all', /The agent suggests 4 things to watch/.test(await text('[data-scan="banner"]')) && /4 still to decide/.test(await text('[data-scan="banner"]')) && !!(await page.$('[data-scan-act=keepall]')));
+  const items = () => st(() => [...document.querySelectorAll('[data-scan-item]')].map((n) => ({ id: n.dataset.scanItem, state: n.dataset.scanState, kind: n.dataset.scanKind, text: n.textContent, keep: !!n.querySelector('[data-scan-act=keep]'), edit: !!n.querySelector('[data-scan-act=edit]'), remove: !!n.querySelector('[data-scan-act=remove]') })));
   const its = await items();
-  ok('T5 three suggestions, each with a kind tag, the initiative it came from, Keep, Edit and Remove', its.length === 3 && its.every((i) => i.state === 'suggested') && await st(() => [...document.querySelectorAll('[data-scan-item]')].every((n) => n.querySelector('[data-scan-act=keep]') && n.querySelector('[data-scan-act=edit]') && n.querySelector('[data-scan-act=remove]') && /from scan-ui/.test(n.textContent))), JSON.stringify(its));
-  await st(() => document.querySelector('[data-scan-set]').scrollIntoView({ block: 'start' }));
-  await shot('settings-1280');
-  ok('T6 the block uses the real buttons (no hand-made controls)', await st(() => [...document.querySelectorAll('[data-scan-set] button')].every((b) => /pmc-btn|(^| )btn( |$)/.test(b.className))));
-  await page.click('[data-scan-item="w-00000001"] [data-scan-act=keep]');
-  await until(() => state().boards.get(ws).items.get('w-00000001').state === 'kept');
-  await until(() => st(() => document.querySelector('[data-scan-item="w-00000001"]').dataset.scanState === 'kept'));
-  ok('T7 Keep posts op keep with the item and no writer field; the ledger holds the keep by the PM; the row reads Kept', posts.some((p) => p.path === '/api/scan/watch' && p.body.op === 'keep' && p.body.id === 'w-00000001' && !('by' in p.body))
-    && S.readLines(ledger).some((l) => l.ev === 'watch-keep' && l.id === 'w-00000001' && l.by === 'pm:wawan') && /Kept/.test((await items())[0].text));
-  await page.click('[data-scan-item="w-00000002"] [data-scan-act=edit]');
+  ok('S6 four items, each with a kind tag, board chips, where it came from, and Keep, Edit and Remove', its.length === 4 && its.every((i) => i.keep && i.edit && i.remove && /BOARDS/.test(i.text) && /team/.test(i.text) && /from IDPF-/.test(i.text)) && its[0].kind === 'product' && its[2].kind === 'domain' && its[3].kind === 'approach', JSON.stringify(its.map((i) => i.text)));
+  ok('S7 the first-time items show why the agent suggests them', /usual reference/.test(its[0].text));
+  await shot('setup-first');
+  await page.click('[data-scan-item=w-00000011] [data-scan-act=keep]');
+  await until(() => st(() => document.querySelector('[data-scan-item=w-00000011]').dataset.scanState === 'kept'));
+  ok('S8 Keep posts op keep with the item, no writer field; the row reads Kept', JSON.stringify(lastPost('/api/scan/watch').body) === JSON.stringify({ ws, op: 'keep', id: 'w-00000011' }) && /Kept/.test((await items())[0].text));
+  await page.click('[data-scan-item=w-00000012] [data-scan-act=edit]');
   await sel('[data-scan-edit-in]');
-  await page.fill('[data-scan-edit-in]', 'Data privacy law (EU)');
+  await page.fill('[data-scan-edit-in]', 'Twilio onboarding');
   await page.click('[data-scan-act=save]');
-  await until(() => state().boards.get(ws).items.get('w-00000002').name === 'Data privacy law (EU)');
-  ok('T8 Edit then Save posts op edit with the new name and the item becomes kept', posts.some((p) => p.body.op === 'edit' && p.body.name === 'Data privacy law (EU)') && state().boards.get(ws).items.get('w-00000002').state === 'kept');
-  await page.click('[data-scan-item="w-00000003"] [data-scan-act=edit]');
+  await until(() => st(() => /Twilio onboarding/.test(document.querySelector('[data-scan-item=w-00000012]').textContent) && document.querySelector('[data-scan-item=w-00000012]').dataset.scanState === 'kept'));
+  ok('S9 Edit then Save posts op edit with the new name, and the item is kept', lastPost('/api/scan/watch').body.op === 'edit' && lastPost('/api/scan/watch').body.name === 'Twilio onboarding');
+  await page.click('[data-scan-item=w-00000013] [data-scan-act=edit]');
   await sel('[data-scan-edit-in]');
   await page.click('[data-scan-act=cancel]');
-  ok('T9 Cancel leaves the item as it was', state().boards.get(ws).items.get('w-00000003').name === 'Eval-first delivery' && state().boards.get(ws).items.get('w-00000003').state === 'suggested' && !(await page.$('[data-scan-edit-in]')));
-  await page.click('[data-scan-item="w-00000003"] [data-scan-act=remove]');
-  await until(() => !state().boards.get(ws).items.get('w-00000003') || state().boards.get(ws).items.get('w-00000003').state === 'removed');
+  ok('S10 Cancel leaves the item as it was', !(await page.$('[data-scan-edit-in]')) && (await items())[2].state === 'suggested');
+  await page.click('[data-scan-item=w-00000013] [data-scan-act=remove]');
+  await until(async () => (await items()).length === 3);
   await sel('[data-c3-toast-action]');
-  ok('T10 Remove posts op remove, the row leaves, and a toast offers Undo', posts.some((p) => p.body.op === 'remove' && p.body.id === 'w-00000003') && (await items()).length === 2 && /Removed Eval-first delivery/.test(await st(() => document.querySelector('[data-c3-toast]').textContent)));
+  ok('S11 Remove posts op remove, the row leaves, and a toast offers Undo', lastPost('/api/scan/watch').body.op === 'remove' && /Removed API rate limits/.test(await toastText()));
   await page.click('[data-c3-toast-action]');
-  await until(() => state().boards.get(ws).items.get('w-00000003').state === 'suggested');
-  await until(async () => (await items()).length === 3);
-  ok('T11 Undo posts keep with restore and the item is back as it was (suggested)', posts.some((p) => p.body.op === 'keep' && p.body.restore === true && p.body.id === 'w-00000003') && (await items()).length === 3);
+  await until(async () => (await items()).length === 4);
+  ok('S12 Undo posts keep with restore and the item is back as it was', posts().some((c) => c.path === '/api/scan/watch' && c.body.op === 'keep' && c.body.restore === true && c.body.id === 'w-00000013') && (await items())[2].state === 'suggested');
   await page.click('[data-scan-act=add]');
-  ok('T12 Add with nothing typed says so in plain words and posts nothing', /Write what to watch first/.test(await st(() => (document.querySelector('[data-scan="add-error"]') || {}).textContent || '')) && !posts.some((p) => p.body.op === 'add'));
+  ok('S13 Add with nothing typed says so in plain words and posts nothing', /Write what to watch first/.test(await text('[data-scan="add-error"]')) && !posts().some((c) => c.body.op === 'add'));
   await page.fill('[data-scan-add-in]', 'Partner SDK trends');
   await page.selectOption('[data-scan-add-kind]', 'domain');
+  await page.fill('[data-scan-add-why]', 'Partners ask which SDKs we support');
+  await page.selectOption('[data-scan-add-board]', ws);
   await page.click('[data-scan-act=add]');
-  await until(() => [...state().boards.get(ws).items.values()].some((i) => i.name === 'Partner SDK trends'));
-  await until(async () => (await items()).length === 4);
-  const added = [...state().boards.get(ws).items.values()].find((i) => i.name === 'Partner SDK trends');
-  ok('T13 Add posts op add with the name and kind; the item is kept and marked added by you', posts.some((p) => p.body.op === 'add' && p.body.kind === 'domain' && p.body.name === 'Partner SDK trends') && added.state === 'kept' && added.added === true && /added by you/.test((await items()).find((i) => i.id === added.id).text));
+  await until(async () => (await items()).length === 5);
+  const added = lastPost('/api/scan/watch').body;
+  ok('S14 Add posts op add with the name, kind, why and the board it relates to; the item is kept, says "added by you", and carries that board and that why', added.op === 'add' && added.name === 'Partner SDK trends' && added.kind === 'domain' && added.why === 'Partners ask which SDKs we support' && JSON.stringify(added.boards) === JSON.stringify([ws])
+    && /added by you/.test((await items())[4].text) && /Partners ask which SDKs/.test((await items())[4].text) && (await items())[4].state === 'kept' && /team/.test((await items())[4].text), JSON.stringify(added));
+  await page.fill('[data-scan-add-in]', 'Webhook retries');
+  await page.click('[data-scan-act=add]');
+  await until(async () => (await items()).length === 6);
+  ok('S14b Add with the board left on "Whole portfolio" posts an empty boards list and an empty why', JSON.stringify(lastPost('/api/scan/watch').body.boards) === '[]' && lastPost('/api/scan/watch').body.why === '' && /BOARDS\s*none yet/.test((await items())[5].text), JSON.stringify(lastPost('/api/scan/watch').body));
+  await page.click('[data-scan-item=' + (await items())[5].id + '] [data-scan-act=remove]');
+  await until(async () => (await items()).length === 5);
+  await page.click('[data-scan-act=keepall]');
+  await until(async () => (await items()).every((i) => i.state === 'kept'));
+  const keeps = posts().filter((c) => c.path === '/api/scan/watch' && c.body.op === 'keep' && !c.body.restore).map((c) => c.body.id);
+  ok('S15 Keep all keeps what is still undecided (the third and the fourth) and the banner then says you decided on all of them', keeps.includes('w-00000013') && keeps.includes('w-00000014') && /You decided on all of them/.test(await text('[data-scan="banner"]')) && !(await page.$('[data-scan-act=keepall]')));
   await page.click('[data-scan-freq=weekly]');
-  await until(() => S.cadenceOf(state(), ws) === 'weekly');
   await until(() => st(() => document.querySelector('[data-scan-freq=weekly]').getAttribute('aria-pressed') === 'true'));
-  ok('T14 Weekly posts the cadence; the line says Every Monday, 09:00 and a toast says so', posts.some((p) => p.path === '/api/scan/cadence' && p.body.cadence === 'weekly' && p.body.board === ws) && /Every Monday, 09:00/.test(await st(() => document.querySelector('[data-scan="schedule"]').textContent)));
+  ok('S16 Weekly posts the cadence for the workspace; the line says Every Monday, 09:00 and a toast says so', JSON.stringify(lastPost('/api/scan/setting').body) === JSON.stringify({ ws, cadence: 'weekly' }) && /Every Monday, 09:00/.test(await text('[data-scan="schedule"]')) && /every monday/i.test(await toastText()));
   await page.click('[data-scan-freq=off]');
-  await until(() => S.cadenceOf(state(), ws) === 'off');
-  await until(() => st(() => /^Off\./.test(document.querySelector('[data-scan="schedule"]').textContent)));
-  ok('T15 Off says that no scan runs and shows no next scan', await st(() => /Off\. No scan runs on this board/.test(document.querySelector('[data-scan="schedule"]').textContent) && !document.querySelector('[data-scan="next"]')));
+  await until(() => st(() => document.querySelector('[data-scan-freq=off]').getAttribute('aria-pressed') === 'true'));
+  ok('S17 Off says no scan runs by itself, and that Scan now still works', /Off\. No scan runs by itself/.test(await text('[data-scan="schedule"]')) && /Scan now still works/.test(await text('[data-scan="next"]')));
   await page.click('[data-scan-freq=daily]');
-  await until(() => S.cadenceOf(state(), ws) === 'daily');
   await until(() => st(() => document.querySelector('[data-scan-freq=daily]').getAttribute('aria-pressed') === 'true'));
-  ok('T16 Daily brings the schedule back, with a next scan', await st(() => /Every working day, 09:00/.test(document.querySelector('[data-scan="schedule"]').textContent) && !!document.querySelector('[data-scan="next"]')));
-  await page.setViewportSize({ width: 400, height: 900 });
-  await sleep(300);
-  await st(() => document.querySelector('[data-scan-set]').scrollIntoView({ block: 'start' }));
-  await shot('settings-400');
-  ok('T17 at 400 wide the settings have no horizontal scroll', await noScroll(), await st(() => document.documentElement.scrollWidth));
-  await page.setViewportSize({ width: 1280, height: 900 });
+  ok('S18 Daily brings a next scan back', /Next scan/.test(await text('[data-scan="next"]')) && /Every working day, 09:00/.test(await text('[data-scan="schedule"]')));
+  await page.uncheck('[data-scan-repo]');
+  await until(() => lastPost('/api/scan/setting').body.repo === false);
+  await page.uncheck('[data-scan-type=insight]');
+  await until(() => Array.isArray(lastPost('/api/scan/setting').body.types));
+  ok('S19 the repository switch posts repo:false and a report type posts the list of types still on', lastPost('/api/scan/setting').body.types.join() === 'benchmark,competitive,productivity');
+  ok('S20 the productivity report is marked repository only; the web is marked topics only', /repository only/.test(await text('[data-scan="types"]')) && /topics only/.test(await text('[data-scan="sources"]')));
+  await shot('setup-kept');
+  await page.check('[data-scan-repo]'); await page.check('[data-scan-type=insight]');
+  await until(() => { const l = lastPost('/api/scan/setting').body; return Array.isArray(l.types) && l.types.length === 4; });
+  P.fail = { path: '/api/scan/watch', error: 'the state folder is read only' };
+  await page.click('[data-scan-item=w-00000011] [data-scan-act=remove]');
+  await until(async () => /the state folder is read only/.test(await toastText()));
+  ok('S21 a press the server refuses shows the server\'s reason in plain words and the item stays', /the state folder is read only/.test(await toastText()) && (await items()).some((i) => i.id === 'w-00000011'));
+
+  /* ── the picker ── */
+  await page.click('[data-scan-setup] [data-scan-act=scan]:not([data-scan-head])');
+  await sel('[data-scan-pick] [data-scan-pi]');
+  const pick0 = await st(() => ({ items: [...document.querySelectorAll('[data-scan-pi]')].map((i) => i.checked), repo: document.querySelector('[data-scan-prepo]').checked, types: [...document.querySelectorAll('[data-scan-pt]')].map((i) => i.checked), t: document.querySelector('[data-scan-pick]').textContent }));
+  ok('K1 the picker lists the 5 kept items (all ticked), the repository and the 4 report types, and says how many manual scans are left today', pick0.items.length === 5 && pick0.items.every(Boolean) && pick0.repo && pick0.types.length === 4 && pick0.types.every(Boolean) && /does not change your schedule/.test(pick0.t) && /3 of 3 manual scans left today/.test(pick0.t), JSON.stringify(pick0));
+  await shot('picker');
+  await page.click('[data-scan-act=pnone]');
+  await page.uncheck('[data-scan-prepo]');
+  ok('K2 with no item and no repository the picker says so and Start is disabled', /Choose at least one watch item or the repository/.test(await text('[data-scan-pick]')) && await st(() => document.querySelector('[data-scan-act=start]').disabled));
+  await page.check('[data-scan-prepo]');
+  ok('K3 with the repository only, it warns that only the Productivity report can run', /Only the Productivity report can run/.test(await text('[data-scan-pick]')));
+  await page.click('[data-scan-act=pall]');
+  await page.uncheck('[data-scan-pt=competitive]');
+  P.fail = { path: '/api/scan/now', status: 409, why: 'quiet-hours', error: 'Quiet hours hold. A manual scan does not start inside them.' };
+  await page.click('[data-scan-act=start]');
+  await sel('[data-scan="start-error"]');
+  ok('K4a a 409 for quiet hours shows in the picker in plain words and the picker stays', /Quiet hours hold, so a manual scan does not start now/.test(await text('[data-scan="start-error"]')) && !!(await page.$('[data-scan-pick]')));
+  P.fail = { path: '/api/scan/now', status: 429, why: 'manual-limit', error: 'At most 3 manual scans a day. Today\'s 3 are used.' };
+  await page.click('[data-scan-act=start]');
+  await until(async () => /You used all 3 manual scans today/.test(await text('[data-scan="start-error"]')));
+  ok('K4 a 429 (the 3-a-day limit) shows in the picker as "You used all 3 manual scans today" and says the scheduled scan still runs', /You used all 3 manual scans today/.test(await text('[data-scan="start-error"]')) && /scheduled scan still runs/.test(await text('[data-scan="start-error"]')) && !!(await page.$('[data-scan-pick]')));
+  await page.click('[data-scan-act=start]');
+  await sel('[data-scan-run] [data-scan-act=stop]');
+  const now = lastPost('/api/scan/now').body;
+  ok('K5 Start posts items, repository and the chosen report types', now.ws === ws && now.items.length === 5 && now.items.slice(0, 4).join() === 'w-00000011,w-00000012,w-00000013,w-00000014' && /^w-[0-9a-f]{8}$/.test(now.items[4]) && now.repo === true && now.types.join() === 'benchmark,insight,productivity', JSON.stringify(now));
+
+  /* ── running ── */
+  const run0 = await st(() => ({ t: document.querySelector('[data-scan-run]').textContent, steps: [...document.querySelectorAll('[data-scan-step]')].map((n) => n.dataset.scanStep + ':' + n.dataset.scanStepState) }));
+  ok('R1 the running sheet shows the server\'s 3 steps (web, repo, reports) with the first running, Step 1 of 3 and Stop', run0.steps.join() === 'web:running,repo:pending,reports:pending' && /Step 1 of 3/.test(run0.t) && /Stopping keeps what was already filed/.test(run0.t), JSON.stringify(run0));
+  await shot('running');
+  P.advance(); P.advance();
+  await until(async () => /Step 3 of 3/.test(await text('[data-scan-run]')));
+  ok('R2 the sheet follows the server: two steps done, the third running', /Step 3 of 3/.test(await text('[data-scan-run]')) && (await text('[data-scan-step="web"]')).includes('done') && (await text('[data-scan-step="reports"]')).includes('now'));
+  await page.click('[data-scan-act=stop]');
+  await sel('[data-scan="stopped"]');
+  ok('R3 Stop posts /api/scan/stop and the sheet says it stopped and that nothing was sent', !!lastPost('/api/scan/stop') && /Stopped at step 3 of 3/.test(await text('[data-scan="stopped"]')) && /Nothing was sent/.test(await text('[data-scan="stopped"]')) && !fx.S.openScans(P.state()).some((x) => x.mode !== 'suggest') && P.state().scans.get(P.state().scanOrder[P.state().scanOrder.length - 1]).stopped === true);
+  await page.click('[data-scan-run] [data-scan-act=scan]');
+  await sel('[data-scan-pick] [data-scan-act=start]');
+  await page.click('[data-scan-act=start]');
+  await sel('[data-scan-run] [data-scan-act=stop]');
+  for (let i = 0; i < 4; i++) P.advance();
+  await sel('[data-scan="finished"]');
+  const fin = await text('[data-scan-run]');
+  ok('R4 a finished scan says how many reports were written and how many proposals wait, and lists each report with Open', /Scan finished: 4 reports written/.test(fin) && /4 proposals wait for you/.test(fin) && (await page.$$('[data-scan-run] [data-scan-report]')).length === 4, fin.slice(0, 300));
+  await shot('finished');
+  const RB = P.reportOf('benchmark'); const RC = P.reportOf('competitive'); const RP = P.reportOf('productivity');
+  const propOf = (rep, kind) => [...P.state().proposals.values()].find((x) => x.report === rep.id && x.kind === kind).id;
+  const BM1 = propOf(RB, 'create'); const BM2 = propOf(RB, 'research'); const BM3 = propOf(RB, 'attach'); const CP1 = propOf(RC, 'create');
+  await page.click(`[data-scan-run] [data-scan-act=opendoc][data-id=${RB.id}]`);
+  await sel('[data-scan-next]:not([hidden]) [data-scan-prop]', 15000);
+
+  /* ── a report document ── */
+  const rel = RB.path;
+  await until(() => docReads.includes(rel));
+  ok('D1 a scan report opens in the existing document sheet by the path the server gives (reports[].path, relative to the repository)', docReads.includes(rel) && /Benchmark report: partner onboarding/.test(await text('.sheet')) && /^(planning|pmos\/state)\/reports\/scan-benchmark\/\d{4}-\d{2}-\d{2}(-\d+)?\.md$/.test(rel), docReads.join());
+  ok('D2 the document sheet shows the text of the report (a section from the file)', await until(async () => /Gap 1: 9 days to first API call/.test(await text('.sheet'))));
+  const panel = () => st(() => { const p = document.querySelector('[data-scan-next]'); const sh = p && p.closest('.sheet'); const top = sh && sh.querySelector('.ds-top');
+    return p ? { hidden: p.hidden, expanded: p.querySelector('[data-scan-act=panel]').getAttribute('aria-expanded'), head: p.querySelector('.hd').textContent, below: !!(top && (top.compareDocumentPosition(p) & Node.DOCUMENT_POSITION_FOLLOWING)), props: p.querySelectorAll('[data-scan-prop]').length } : null; });
+  const p0 = await panel();
+  ok('D3 the panel says Proposed next steps (3), summarises the kinds, says nothing happens until you click, and sits under the sheet\'s header and tabs', p0 && !p0.hidden && /Proposed next steps \(3\)/.test(p0.head) && /1 create initiative, 1 research more, 1 add to an existing initiative/.test(p0.head) && /Nothing happens until you click/.test(p0.head) && p0.below, JSON.stringify(p0));
+  await shot('doc-next');
+  const kinds = await st(() => [...document.querySelectorAll('[data-scan-prop]')].map((n) => ({ id: n.dataset.scanProp, kind: n.dataset.scanKind, t: n.textContent, kv: [...n.querySelectorAll('dt')].map((d) => d.textContent).join('|'), ev: n.querySelectorAll('[data-scan-ev]').length, from: !!n.querySelector('[data-scan-act=jump]') })));
+  ok('D4 a create proposal shows title, board, lane, anchor, intent and starts-in, with FROM and EVIDENCE chips', kinds[0].kind === 'create' && kinds[0].kv === 'Title|Board|Lane|Anchor|Intent|Starts in' && /Gap 2: no changelog/.test(kinds[0].t) && kinds[0].ev === 3 && kinds[0].from && /chosen by the agent/.test(kinds[0].t), JSON.stringify(kinds[0]));
+  ok('D5 a research proposal shows question, sources, depth and result', kinds[1].kind === 'research' && kinds[1].kv === 'Question|Sources|Depth|Result' && /Standard: About 20 public pages, 10 minutes/.test(kinds[1].t), JSON.stringify(kinds[1]));
+  ok('D6 an attach proposal shows attach-to and what-it-adds', kinds[2].kind === 'attach' && kinds[2].kv === 'Attach to|What it adds|Shown in' && /scan-ui/.test(kinds[2].t), JSON.stringify(kinds[2]));
+  ok('D7 the buttons read Approve, Approve and start, Approve and attach, each with Change first and Dismiss', await st(() => [...document.querySelectorAll('[data-scan-prop]')].map((n) => [...n.querySelectorAll('[data-scan-act=approve],[data-scan-act=change],[data-scan-act=dismiss]')].map((b) => b.textContent.trim()).join('/')).join(',')) === 'Approve/Change first/Dismiss,Approve and start/Change first/Dismiss,Approve and attach/Change first/Dismiss');
+  const links = await st(() => [...document.querySelectorAll('[data-scan-prop] a[data-scan-ev=web]')].map((a) => ({ href: a.href, target: a.target, rel: a.rel })));
+  ok('D8 a public-page evidence chip is a link that opens in a new tab with noopener; a Jira key is not a link', links.length >= 3 && links.every((l) => l.target === '_blank' && /noopener/.test(l.rel)) && links[0].href === 'https://docs.stripe.com/changelog' && !(await page.$('a[data-scan-ev=jira]')), JSON.stringify(links));
+  await page.click(`[data-scan-prop=${BM1}] [data-scan-act=jump]`);
+  ok('D9 the FROM chip takes you to that place in the text and marks it', await until(() => st(() => !!document.querySelector('.sheet .flash')), 3000));
+
+  /* approve a create, after Change first */
+  await page.click(`[data-scan-act=change][data-id=${BM1}]`);
+  await sel(`[data-scan-form=${BM1}] [data-scan-f=title]`);
+  const form = await st((id) => ({ fields: [...document.querySelectorAll(`[data-scan-form="${id}"] [data-scan-f]`)].map((f) => f.dataset.scanF).join(), t: document.querySelector(`[data-scan-prop=${id}]`).textContent, approve: document.querySelector(`[data-scan-act=approve][data-id=${id}]`).textContent }), BM1);
+  ok('D10 Change first turns the fields into a form (title, board, lane, anchor, intent) and the button says Approve with changes', form.fields === 'title,board,lane,anchor,intent' && /Approve with changes/.test(form.approve) && /agent choice/.test(form.t), JSON.stringify(form));
+  await shot('doc-change');
+  await page.fill(`[data-scan-form=${BM1}] [data-scan-f=title]`, 'Changelog and change notices');
+  await page.selectOption(`[data-scan-form=${BM1}] [data-scan-f=lane]`, 'discovery');
+  await page.click(`[data-scan-act=approve][data-id=${BM1}]`);
+  await until(() => st((id) => document.querySelector(`[data-scan-prop=${id}]`).dataset.scanState === 'done', BM1));
+  const seq = posts().filter((c) => c.path === '/api/scan/proposal' && c.body.id === BM1).map((c) => c.body.action);
+  const ch = posts().find((c) => c.path === '/api/scan/proposal' && c.body.action === 'change' && c.body.id === BM1);
+  ok('D11 Approve with changes posts only the changed fields under the server\'s names (action change), then approve, and no writer field', seq.join() === 'change,approve' && Object.keys(ch.body.fields).sort().join() === 'lane,title' && ch.body.fields.title === 'Changelog and change notices' && ch.body.fields.lane === 'discovery' && !('by' in ch.body), JSON.stringify(ch.body));
+  ok('D12 the proposal then reads Created idpf-98 with Open in the board, and a toast says the initiative starts in Discover', /Created idpf-98/.test(await text('[data-scan-result=create]')) && !!(await page.$('[data-scan-result=create] [data-scan-act=go-board]')) && /idpf-98 created on team in Discover, with the report as evidence/.test(await toastText()), await toastText());
+  ok('D13 the count falls to Proposed next steps (2)', /Proposed next steps \(2\)/.test((await panel()).head));
+  ok('D14 an approval has no Undo: not on the toast, not on the proposal, and no undo is ever posted for it', !(await page.$('[data-c3-toast-action]')) && !(await page.$(`[data-scan-prop="${BM1}"] [data-scan-act=undo]`)) && !posts().some((c) => c.body.action === 'undo' && c.body.id === BM1));
+
+  /* dismiss needs a reason, then Undo */
+  await page.click(`[data-scan-act=dismiss][data-id=${BM3}]`);
+  await sel(`[data-scan-f=why][data-id=${BM3}]`);
+  const before = posts().length;
+  await page.click(`[data-scan-act=dismiss-ok][data-id=${BM3}]`);
+  await sel('[data-scan-need-why]');
+  ok('D15 Dismiss with no reason says "Say why" and posts nothing', /Say why/.test(await text('[data-scan-need-why]')) && posts().length === before && await st((id) => document.querySelector(`[data-scan-f=why][data-id=${id}]`).classList.contains('bad'), BM3));
+  await shot('doc-dismiss');
+  await page.fill(`[data-scan-f=why][data-id=${BM3}]`, 'we already decided this');
+  await page.click(`[data-scan-act=dismiss-ok][data-id=${BM3}]`);
+  await until(() => st((id) => document.querySelector(`[data-scan-prop=${id}]`).dataset.scanState === 'dismissed', BM3));
+  const dis = lastPost('/api/scan/proposal').body;
+  ok('D16 Dismiss with a reason posts action dismiss with the why; the proposal says it was dismissed (the reason is the server\'s dismissed_why), counted as a correction, not raised again', dis.action === 'dismiss' && dis.why === 'we already decided this' && /Dismissed: we already decided this/.test(await text('[data-scan-result=dismissed]')) && /Counted as a correction/.test(await toastText()));
+  await page.click(`[data-scan-act=dismiss][data-id=${BM2}]`);
+  await page.fill(`[data-scan-f=why][data-id=${BM2}]`, 'not now');
+  await page.click(`[data-scan-act=dismiss-ok][data-id=${BM2}]`);
+  await until(() => st((id) => document.querySelector(`[data-scan-prop=${id}]`).dataset.scanState === 'dismissed', BM2));
+  await page.click('[data-c3-toast-action]');
+  await until(() => st((id) => document.querySelector(`[data-scan-prop=${id}]`).dataset.scanState === 'open', BM2));
+  ok('D16b the Undo on the dismissal toast posts undo and the proposal waits again, with no reason left', lastPost('/api/scan/proposal').body.action === 'undo' && lastPost('/api/scan/proposal').body.id === BM2 && /Proposed next steps \(1\)/.test((await panel()).head) && !(await page.$(`[data-scan-prop="${BM2}"] [data-scan-result]`)));
+  await page.click(`[data-scan-act=dismiss][data-id=${BM2}]`);
+  await page.fill(`[data-scan-f=why][data-id=${BM2}]`, 'not now');
+  await page.click(`[data-scan-act=dismiss-ok][data-id=${BM2}]`);
+  await until(() => st((id) => document.querySelector(`[data-scan-prop=${id}]`).dataset.scanState === 'dismissed', BM2));
+  await page.click(`[data-scan-prop="${BM2}"] [data-scan-act=undo]`);
+  await until(() => st((id) => document.querySelector(`[data-scan-prop=${id}]`).dataset.scanState === 'open', BM2));
+  ok('D16c the Undo button on a dismissed proposal does the same', lastPost('/api/scan/proposal').body.action === 'undo' && lastPost('/api/scan/proposal').body.id === BM2 && P.state().proposals.get(BM2).state === 'open');
+  // A change made and not approved (an approval that failed after it): the proposal shows Undo my changes, and the press posts undo.
+  fx.S.proposalChange(P.file, BM2, { depth: 'deep' }, { by: 'pm:wawan' });
+  await st(() => import('/pm/c3-scan-api.js').then((m) => m.scanChanged()));
+  await sel(`[data-scan-act=undo-change][data-id=${BM2}]`);
+  await page.click(`[data-scan-act=undo-change][data-id=${BM2}]`);
+  await until(() => !P.state().proposals.get(BM2).changed);
+  ok('D16d a proposal with a change the PM did not approve offers Undo my changes; it posts undo and the agent\'s fields come back', lastPost('/api/scan/proposal').body.action === 'undo' && P.state().proposals.get(BM2).fields.depth === 'standard' && await until(async () => !(await page.$(`[data-scan-act=undo-change][data-id=${BM2}]`))));
+
+  /* research */
+  await page.click(`[data-scan-act=approve][data-id=${BM2}]`);
+  await sel(`[data-scan-run="${BM2}"]`);
+  const steps0 = await st(() => [...document.querySelectorAll('[data-scan-run] li')].map((n) => n.textContent).join('|'));
+  ok('D17 Approve and start posts approve; the proposal shows the research running with the open scan\'s steps and Stop; no Undo', lastPost('/api/scan/proposal').body.action === 'approve' && lastPost('/api/scan/proposal').body.id === BM2 && !!(await page.$(`[data-scan-run="${BM2}"] [data-scan-act=rstop]`)) && /Research started/.test(await toastText())
+    && /Searching the public web/.test(steps0) && !(await page.$('[data-c3-toast-action]')), steps0);
+  await shot('doc-research');
+  const fol = P.research();
+  await sel('[data-scan-result=research]', 12000);
+  ok('D18 when the research ends the proposal offers the follow-up document', /Research finished/.test(await text('[data-scan-result=research]')));
+  await page.click('[data-scan-act=follow-up]');
+  await until(() => docReads.includes(fol.path));
+  ok('D19 Open the follow-up document opens the child report (its parent is the benchmark) in the sheet', docReads.includes(fol.path) && P.state().reports.get(fol.id).parent === RB.id && await until(async () => /Research: Which rate-limit headers/.test(await text('.sheet'))));
+
+  /* ── the Portfolio lists the reports and what waits ── */
+  await portfolio();
+  await sel('[data-scan-section] [data-scan-report]');
+  const sec2 = await text('[data-scan-section="portfolio"]');
+  ok('L1 the section lists the latest scan\'s reports (4, not the follow-up)', (await page.$$('[data-scan-section] [data-scan-report]')).length === 4 && /Benchmark report: partner onboarding/.test(sec2) && /Competitive analysis/.test(sec2) && /Productivity report/.test(sec2) && !/Research: /.test(sec2), sec2);
+  ok('L2 it says "Waiting for you: 1 proposal" (the competitive one; one created, one researched, one dismissed)', /Waiting for you: 1 proposal(?!s)/.test(await text('[data-scan="waiting"]')), await text('[data-scan="waiting"]'));
+  ok('L2b it says how many manual scans are left today (1 of 3 after the two above)', /1 of 3 manual scans left today/.test(sec2) && !(await st(() => document.querySelector('[data-scan-section] [data-scan-act=scan]').disabled)), sec2);
+  ok('L3 the section says the schedule, last scan and next scan', /Daily\. Last scan/.test(sec2) && /Next scan/.test(sec2), sec2);
+  await shot('portfolio-after');
+  await page.click(`[data-scan-section] [data-scan-report="${RC.id}"] .tt`);
+  await sel('[data-scan-next]:not([hidden]) [data-scan-prop]');
+  ok('L4 opening a report with proposals waiting opens its panel expanded', (await panel()).expanded === 'true' && (await panel()).props === 1);
+  await page.click('[data-scan-act=panel]');
+  ok('L5 the toggle closes the panel', (await panel()).expanded === 'false' && !(await page.$('[data-scan-prop]')));
+  await page.keyboard.press('Escape');
+  await page.click(`[data-scan-section] [data-scan-report="${RP.id}"] .tt`);
+  await sel('.sheet [data-doc-meta]');
+  await sleep(500);
+  ok('L6 a report with no proposals shows no panel', await st(() => { const p = document.querySelector('[data-scan-next]'); return !p || p.hidden; }));
+  await page.keyboard.press('Escape');
+
+  /* ── Briefing ── */
+  await page.goto(BASE + '/c3.html?tab=brief', { waitUntil: 'load' });
+  await sel('[data-c3pg="scan"] [data-scan-report]');
+  const card = await text('[data-c3pg="scan"]');
+  ok('B1 the Briefing has a Horizon scan card: when it ran, the boards scanned, the reports of the day', /Horizon scan/.test(card) && /today, \d\d:\d\d/.test(card) && /1 board scanned/.test(card) && /4 reports today/.test(card), card);
+  ok('B2 one row per report with the proposals waiting on it, and an Open', (await page.$$('[data-c3pg="scan"] [data-scan-report]')).length === 4 && /0 proposals waiting/.test(await text(`[data-scan-report="${RB.id}"]`)) && /1 proposal waiting/.test(await text(`[data-scan-report="${RC.id}"]`)) && /0 proposals waiting/.test(await text(`[data-scan-report="${RP.id}"]`)));
+  ok('B3 the card says 1 proposal waiting for you and that nothing was sent, 31 public pages were read and 2 findings skipped', /1 proposal waiting for you/.test(card) && /Nothing was sent\. The agent read 31 public pages, by topic only\. It skipped 2 findings you dismissed before\./.test(card), card);
+  await shot('briefing');
+  await page.click(`[data-c3pg="scan"] [data-scan-act=open-report][data-id=${RC.id}]`);
+  await sel('[data-scan-next]:not([hidden]) [data-scan-prop]');
+  ok('B4 Open on a report opens it in the document sheet with its proposals showing', (await panel()).expanded === 'true');
+  await page.keyboard.press('Escape');
+  await page.click('[data-c3pg="scan"] [data-scan-act=scan]');
+  ok('B5 Scan now on the card opens the picker', !!(await sel('[data-scan-pick] [data-scan-act=start]')));
+  await page.keyboard.press('Escape');
+
+  /* ── Board settings ── */
+  await page.goto(BASE + `/c3.html?tab=init&init=board:${ws}:summary`, { waitUntil: 'load' });
+  await (await sel('[data-ini=board-settings]')).click();
+  await sel('[data-scan-ptr]');
+  const ptr = await text('[data-scan-ptr]');
+  ok('G1 Board settings has one line: "Horizon scan runs for the whole portfolio" with "Open the Horizon scan setup"', /Horizon scan runs for the whole portfolio\./.test(ptr) && /Open the Horizon scan setup/.test(ptr) && /It is not set per board/.test(ptr), ptr);
+  ok('G2 the per-board watch list, schedule and Keep, Edit, Remove are gone from Board settings', !(await page.$('[data-scan-set]')) && !(await page.$('.sheet [data-scan-item]')) && !(await page.$('.sheet [data-scan-freq]')));
+  await shot('board-settings');
+  await page.click('[data-scan-ptr] [data-scan-act=setup]');
+  await sel('[data-scan-setup] [data-scan-freq=daily]');
+  ok('G3 "Open the Horizon scan setup" opens the portfolio setup sheet', !!(await page.$('[data-scan-setup]')) && !(await page.$('[data-scan-ptr]')));
+  const set1 = await until(async () => { const t = await text('[data-scan-setup]'); return /Last scan: today/.test(t) ? t : ''; });
+  ok('G4 once a scan has run the setup shows the last scan, its reports and the proposals waiting in Reports', /Last scan: today/.test(set1) && /4 reports written/.test(set1) && /1 proposal waiting in Reports/.test(set1) && !!(await page.$('[data-scan-setup] [data-scan-act=reports]')), set1.slice(0, 400));
+  ok('G5 the dismissed proposal is listed with its reason (read from the reports that hold it) as not raised again', await until(async () => /we already decided this/.test(await text('[data-scan="dismissed"]'))) && /not raised again/.test(await text('[data-scan="dismissed"]')) && !/not now/.test(await text('[data-scan="dismissed"]')));
+  await page.keyboard.press('Escape');
 
-  /* ── triage ── */
+  /* ── triage: an ask an earlier per-board scan found ── */
   const seed = fx.seedScan();
   await page.goto(BASE + `/c3.html?tab=init&init=board:${ws}:triage`, { waitUntil: 'load' });
   await sel(`[data-ibt-ask="${seed.asks[0]}"]`);
-  const row = (i) => st((id) => { const r = document.querySelector(`[data-ibt-ask="${id}"]`); return { text: r.textContent, agent: !!r.querySelector('[data-scan="found-by-agent"]'), links: [...r.querySelectorAll('a[data-scan-src=web]')].map((a) => ({ href: a.href, target: a.target, rel: a.rel })),
-    noMatch: !!r.querySelector('[data-scan="no-match"]'), accept: !!r.querySelector('[data-ibt-accept]'), more: !!r.querySelector('[data-ibt-more]'), decline: !!r.querySelector('[data-ibt-decline]'), srcs: r.querySelectorAll('[data-scan-src]').length }; }, seed.asks[i]);
-  const r0 = await row(0); const r1 = await row(1); const r2 = await row(2);
-  ok('R1 each scan ask reads "Found by agent" with the reason, the Horizon scan chip and the source count', [r0, r1, r2].every((r) => r.agent && /Horizon scan/.test(r.text)) && /A rival added PDF export for partner reports/.test(r0.text) && /2 sources/.test(r0.text), r0.text.slice(0, 400));
-  ok('R2 a public page source is a link that opens in a new tab with noopener; a repository path and a Jira key are chips', r0.links.length === 2 && r0.links.every((l) => l.target === '_blank' && /noopener/.test(l.rel)) && /rivalnotes\.example\/blog\/pdf-export/.test(r0.links[0].href) && r2.links.length === 0 && r2.srcs === 2 && /src\/importer\.js/.test(r2.text) && /IDPF-1204/.test(r2.text), JSON.stringify([r0.links, r2.srcs]));
-  ok('R3 the match chip names the initiative; an ask with no match says "no initiative yet"', /matches scan-ui/.test(r1.text) && !r1.noMatch && r0.noMatch && r2.noMatch);
-  ok('R4 each has Accept, Ask for more and Decline with the shared attributes', [r0, r1, r2].every((r) => r.accept && r.more && r.decline) && /Accept into/.test(r0.text) && /Ask for more/.test(r0.text) && /Decline/.test(r0.text));
-  ok('R5 the agent is named by page name with no token', !/0a1b2c3d/.test(await st(() => document.body.innerHTML)));
-  await shot('triage-1280');
-  await page.setViewportSize({ width: 400, height: 900 });
-  await sleep(300);
-  await st((id) => document.querySelector(`[data-ibt-ask="${id}"]`).scrollIntoView({ block: 'start' }), seed.asks[0]);
-  await shot('triage-400');
-  ok('R6 at 400 wide Triage has no horizontal scroll', await noScroll(), await st(() => document.documentElement.scrollWidth));
-  await page.setViewportSize({ width: 1280, height: 900 });
+  const row = (i) => st((id) => { const r = document.querySelector(`[data-ibt-ask="${id}"]`); return { text: r.textContent, agent: !!r.querySelector('[data-scan="found-by-agent"]'), links: [...r.querySelectorAll('a[data-scan-src=web]')].map((a) => ({ target: a.target, rel: a.rel })), accept: !!r.querySelector('[data-ibt-accept]'), more: !!r.querySelector('[data-ibt-more]'), decline: !!r.querySelector('[data-ibt-decline]') }; }, seed.asks[i]);
+  const r0 = await row(0); const r2 = await row(2);
+  ok('T1 an ask an earlier scan found still reads "Found by agent", with the reason, source links that open in a new tab, and Accept, Ask for more and Decline',
+    r0.agent && /Horizon scan/.test(r0.text) && /A rival added PDF export/.test(r0.text) && r0.links.length === 2 && r0.links.every((l) => l.target === '_blank' && /noopener/.test(l.rel)) && r2.links.length === 0 && r0.accept && r0.more && r0.decline, JSON.stringify(r0));
 
-  /* ── briefing ── */
-  await page.goto(BASE + '/c3.html?tab=brief', { waitUntil: 'load' });
-  await sel('[data-c3pg="scan"] [data-scan-find]');
-  const card = await st(() => document.querySelector('[data-c3pg="scan"]').textContent);
-  ok('B1 the Horizon scan card counts the day: 3 asks found, 1 matches an initiative, 2 new, the board scanned', /Horizon scan/.test(card) && /3 asks found/.test(card) && /1 matches an initiative/.test(card) && /2 new/.test(card) && /1 board scanned/.test(card), card.slice(0, 400));
-  ok('B2 one row per finding, in the order they were found', await st(() => [...document.querySelectorAll('[data-scan-find]')].map((n) => n.dataset.scanFind).join()) === seed.findings.join());
-  ok('B3 the foot says nothing was sent, 12 public pages were read and 1 finding was skipped', /Nothing was sent\. The agent read 12 public pages\. It skipped 1 finding from earlier scans\./.test(card), card);
-  await shot('briefing-1280');
-  await page.click('[data-scan-find] [data-scan-go]');
-  await until(() => page.$('[data-ibt-ask]'));
-  ok('B4 "Open in Triage" on a finding opens that board\'s Triage', !!(await page.$(`[data-ibt-ask="${seed.asks[0]}"]`)) && /board:.*triage/.test(decodeURIComponent(page.url())), page.url());
-  await page.goto(BASE + '/c3.html?tab=brief', { waitUntil: 'load' });
-  await sel('[data-scan-settings]');
-  await page.click('[data-scan-settings]');
-  await until(() => page.$('[data-scan-set] [data-scan-item]'));
-  ok('B5 "Scan settings" opens the board with its settings open at the Horizon scan block', !!(await page.$('[data-scan-set] [data-scan-freq=daily]')));
-  ok('B6 the block now shows the last scan', /Last scan: today/.test(await st(() => document.querySelector('[data-scan="last"]').textContent)), await st(() => document.querySelector('[data-scan="last"]').textContent));
-  await page.goto(BASE + '/c3.html?tab=brief', { waitUntil: 'load' });
-  await sel('[data-c3pg="scan"] [data-scan-find]');
+  /* ── the phone ── */
   await page.setViewportSize({ width: 400, height: 900 });
+  await portfolio(); await sel('[data-scan-section] [data-scan-report]');
   await sleep(300);
-  await st(() => document.querySelector('[data-c3pg="scan"]').scrollIntoView({ block: 'start' }));
+  await shot('portfolio-400');
+  ok('M1 at 400 wide the Portfolio has no horizontal scroll', await noScroll(), await st(() => document.documentElement.scrollWidth));
+  await page.click('[data-scan-section] [data-scan-act=setup]'); await sel('[data-scan-setup] [data-scan-item]'); await sleep(300);
+  await shot('setup-400');
+  ok('M2 at 400 wide the setup sheet has no horizontal scroll', await noScroll());
+  await page.keyboard.press('Escape');
+  await page.click('[data-scan-section] [data-scan-act=scan]'); await sel('[data-scan-pick] [data-scan-pi]'); await sleep(300);
+  ok('M3 at 400 wide the picker has no horizontal scroll', await noScroll());
+  await page.keyboard.press('Escape');
+  await page.click(`[data-scan-section] [data-scan-report="${RC.id}"] .tt`); await sel('[data-scan-next]:not([hidden]) [data-scan-prop]'); await sleep(500);
+  await shot('doc-next-400');
+  ok('M4 at 400 wide a report with its proposals open has no horizontal scroll', await noScroll());
+  await page.click(`[data-scan-act=change][data-id=${CP1}]`); await sleep(300);
+  ok('M5 at 400 wide the Change first form has no horizontal scroll', await noScroll());
+  await page.keyboard.press('Escape');
+  await page.goto(BASE + '/c3.html?tab=brief', { waitUntil: 'load' });
+  await sel('[data-c3pg="scan"] [data-scan-report]'); await sleep(300);
   await shot('briefing-400');
-  ok('B7 at 400 wide the Briefing has no horizontal scroll', await noScroll(), await st(() => document.documentElement.scrollWidth));
+  ok('M6 at 400 wide the Briefing has no horizontal scroll', await noScroll());
+
+  /* Scan now is off once the day's three manual scans are used: the buttons are disabled and the server's sentence says why */
+  P.tools.w({ ev: 'scan-start', board: 'portfolio', scan: 'scan-00000000ff', mode: 'scan', watch: [], manual: true, repo: true, types: ['productivity'], plan: { web: false, repo: true }, by: 'pm:wawan' }, Date.now() - 60000);
+  P.tools.w({ ev: 'scan-end', board: 'portfolio', scan: 'scan-00000000ff', ok: false, reason: 'the repository run failed', pages: 0, found: 0, skipped: 0, runs: 1 }, Date.now() - 30000);
+  await page.setViewportSize({ width: 1280, height: 900 });
+  await portfolio();
+  await until(() => st(() => { const b = document.querySelector('[data-scan-section] [data-scan-act=scan]'); return b && b.disabled; }));
+  ok('X1 after three manual scans Scan now is disabled in the Portfolio section and the line says "You used all 3 manual scans today"', await st(() => document.querySelector('[data-scan-section] [data-scan-act=scan]').disabled) && /You used all 3 manual scans today/.test(await text('[data-scan-section] [data-scan="manual"]')), await text('[data-scan-section]'));
+  await page.click('[data-scan-section] [data-scan-act=setup]'); await sel('[data-scan-setup] [data-scan-item]');
+  ok('X2 the setup sheet disables Scan now in its header and in its status block', await st(() => [...document.querySelectorAll('.sheet [data-scan-act=scan]')].length === 2 && [...document.querySelectorAll('.sheet [data-scan-act=scan]')].every((b) => b.disabled)));
+  await page.keyboard.press('Escape');
 
   ok('Z1 the page raised no script error', errors.length === 0, errors.join(' | '));
+  ok('Z2 no request carried a writer field (by, via, at)', posts().every((c) => !('by' in c.body) && !('via' in c.body) && !('at' in c.body)));
+
+  /* ── E · end to end on the real server routes ──────────────────────────────────────────────────────────
+   * A second server and repository with a seeded state folder (three suggestions, one kept and scanned, a finished scan of today with four reports and
+   * four proposals). No route is replaced: the page calls the server's own /api/scan/* routes. The runner is stubbed: PMOS_DRIVER=off, and a `claude`
+   * on the PATH that only records a call. Nothing may call it. */
+  fx.stop();
+  fx = await F.start({ name: 'c3-scan-e2e', clean: true, guard: true });
+  const E = fx.seedPortfolio();
+  const eBase = fx.BASE; const eWs = fx.ws; const eS = fx.S;
+  const eState = () => eS.fold(eS.readLines(fx.ledger));
+  const eLines = () => eS.readLines(fx.ledger);
+  const page2 = await (await browser.newContext({ viewport: { width: 1280, height: 900 } })).newPage();
+  const eErrors = []; page2.on('pageerror', (e) => eErrors.push(String((e && e.message) || e)));
+  const eDocs = []; page2.on('request', (r) => { if (r.url().includes('/api/doc?')) eDocs.push(new URL(r.url()).searchParams.get('path') || ''); });
+  const eSel = (q, ms) => until(() => page2.$(q), ms);
+  const eText = (q) => page2.evaluate((x) => { const n = document.querySelector(x); return n ? n.textContent : ''; }, q);
+  const eToast = () => page2.evaluate(() => (document.querySelector('[data-c3-toast]') || {}).textContent || '');
+  const eRb = E.reports.find((r) => r.type === 'benchmark'); const eRc = E.reports.find((r) => r.type === 'competitive');
+  const eProp = (rep, kind) => [...eState().proposals.values()].find((p) => p.report === rep.id && p.kind === kind);
+  await page2.goto(eBase + '/c3.html?tab=init', { waitUntil: 'load' });
+  await eSel('[data-scan-section="portfolio"] [data-scan-act=scan]');
+  await eSel('[data-scan-section] [data-scan-report]');
+  const eSec = await eText('[data-scan-section="portfolio"]');
+  ok('E1 the real portfolio route fills the Horizon scan section: Scan now is enabled and says 3 of 3 manual scans are left, the latest scan\'s 4 reports are listed, and 4 proposals wait',
+    /3 of 3 manual scans left today/.test(eSec) && !(await page2.evaluate(() => document.querySelector('[data-scan-section] [data-scan-act=scan]').disabled)) && (await page2.$$('[data-scan-section] [data-scan-report]')).length === 4 && /Waiting for you: 4 proposals/.test(eSec), eSec);
+  await page2.click('[data-scan-section] [data-scan-act=setup]');
+  await eSel('[data-scan-setup] [data-scan-item]');
+  const eItems = () => page2.evaluate(() => [...document.querySelectorAll('[data-scan-item]')].map((n) => ({ id: n.dataset.scanItem, state: n.dataset.scanState, text: n.textContent })));
+  const i0 = await eItems();
+  ok('E2 the setup sheet lists the 3 items of the real answer: one kept, two suggested with where they came from', i0.length === 3 && i0[0].state === 'kept' && i0[1].state === 'suggested' && /from scan-ui/.test(i0[1].text) && /Kept/.test(i0[0].text), JSON.stringify(i0.map((i) => i.state)));
+  await page2.click('[data-scan-item=w-00000022] [data-scan-act=keep]');
+  await until(async () => (await eItems()).find((i) => i.id === 'w-00000022').state === 'kept');
+  const keepLine = eLines().filter((l) => l.ev === 'watch-keep' && l.id === 'w-00000022').pop();
+  ok('E3 Keep writes a watch-keep line for that item, by the PM, to the real ledger', !!keepLine && keepLine.by === 'pm:wawan' && eState().itemById.get('w-00000022').state === 'kept', JSON.stringify(keepLine));
+  await page2.fill('[data-scan-add-in]', 'Webhook retries');
+  await page2.fill('[data-scan-add-why]', 'Partners lose events');
+  await page2.selectOption('[data-scan-add-board]', eWs);
+  await page2.click('[data-scan-act=add]');
+  await until(async () => (await eItems()).length === 4);
+  const addLine = eLines().filter((l) => l.ev === 'watch-add').pop();
+  ok('E4 Add writes a watch-add line with the name, the why and the board', !!addLine && addLine.name === 'Webhook retries' && addLine.why === 'Partners lose events' && JSON.stringify(addLine.boards) === JSON.stringify([eWs]) && addLine.by === 'pm:wawan', JSON.stringify(addLine));
+  await page2.keyboard.press('Escape');
+  // the seeded report opens in the document sheet by the path the server gave, and /api/doc serves it
+  const eRel = eRb.path;
+  const served = await fetch(eBase + `/api/doc?ws=${eWs}&path=${encodeURIComponent(eRel)}`);
+  ok('E5 the path the server gives for a report (reports[].path) is one that /api/doc serves, and the file says source: scan:portfolio', served.status === 200 && /^source: scan:portfolio$/m.test(await served.text()) && !path.isAbsolute(eRel), eRel);
+  await page2.click(`[data-scan-section] [data-scan-report="${eRb.id}"] .tt`);
+  await eSel('[data-scan-next]:not([hidden]) [data-scan-prop]', 15000);
+  const eProps = await page2.evaluate(() => [...document.querySelectorAll('[data-scan-prop]')].map((n) => ({ id: n.dataset.scanProp, kind: n.dataset.scanKind })));
+  ok('E6 the report opens in the document sheet and the docAbove hook shows its proposals panel (source: scan:*): 3 proposals, expanded because proposals wait', eDocs.includes(eRel) && eProps.map((p) => p.kind).join() === 'create,research,attach' && /Proposed next steps \(3\)/.test(await eText('[data-scan-next] .hd')) && /Gap 2: no changelog/.test(await eText('.sheet')), eDocs.join());
+  // Change first on the create proposal, then Approve
+  const create = eProp(eRb, 'create');
+  await page2.click(`[data-scan-act=change][data-id=${create.id}]`);
+  await eSel(`[data-scan-form=${create.id}] [data-scan-f=title]`);
+  await page2.fill(`[data-scan-form=${create.id}] [data-scan-f=title]`, 'Changelog and change notices');
+  await page2.fill(`[data-scan-form=${create.id}] [data-scan-f=intent]`, 'Partners read one dated page and subscribe by email.');
+  await page2.selectOption(`[data-scan-form=${create.id}] [data-scan-f=lane]`, 'discovery');
+  await page2.click(`[data-scan-act=approve][data-id=${create.id}]`);
+  await eSel(`[data-scan-result=create]`, 30000);
+  const ap = eState().proposals.get(create.id);
+  const boardsAns = (await fx.get(`/api/boards?ws=${eWs}`)).body;
+  const first = boardsAns.boards.find((b) => b.id === eWs).workflow[0].name;
+  const bl = fs.readFileSync(fx.boards, 'utf8').split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  const moved = bl.find((l) => l.kind === 'move' && l.id === ap.result.initiative);
+  const eSeq = eLines().filter((l) => l.id === create.id).map((l) => l.ev);
+  ok('E7 Change first then Approve: the ledger has proposal-change then proposal-approve, and the proposal carries the changed title, lane and intent', eSeq.join() === 'proposal,proposal-change,proposal-approve' && ap.state === 'approved' && ap.title === 'Changelog and change notices' && ap.fields.lane === 'discovery' && /^Partners read/.test(ap.fields.intent), eSeq.join());
+  ok('E8 Approve made a real initiative in the first stage of the board\'s workflow: the file is in the repository, the boards ledger has the assign and the move into the first stage, and an evidence line links the report', !!ap.result.initiative && fs.existsSync(path.join(fx.team, ap.result.path)) && ap.result.stage === first && !!moved && moved.to === first && moved.from === null
+    && eS.evidenceOf(eState(), ap.result.initiative).some((x) => x.report === eRb.id && x.proposal === create.id), JSON.stringify([ap.result, first, moved]));
+  const resTxt = await eText('[data-scan-result=create]');
+  ok('E9 the proposal reads Created <id> in the first stage with Open in the board; the toast says what happened and offers no Undo', new RegExp('Created ' + ap.result.initiative).test(resTxt) && resTxt.includes(first) && !!(await page2.$('[data-scan-result=create] [data-scan-act=go-board]')) && !(await page2.$('[data-c3-toast-action]')) && !(await page2.$(`[data-scan-prop="${create.id}"] [data-scan-act=undo]`))
+    && new RegExp(ap.result.initiative + ' created on team in ' + first).test(await eToast()), resTxt + ' | ' + await eToast());
+  // Dismiss with a reason, then Undo
+  const attach = eProp(eRb, 'attach');
+  await page2.click(`[data-scan-act=dismiss][data-id=${attach.id}]`);
+  await page2.click(`[data-scan-act=dismiss-ok][data-id=${attach.id}]`);
+  ok('E10 Dismiss without a reason is refused in the panel and writes nothing', /Say why/.test(await eText('[data-scan-need-why]')) && !eLines().some((l) => l.ev === 'proposal-dismiss'));
+  await page2.fill(`[data-scan-f=why][data-id=${attach.id}]`, 'we already track this');
+  await page2.click(`[data-scan-act=dismiss-ok][data-id=${attach.id}]`);
+  await eSel(`[data-scan-prop="${attach.id}"][data-scan-state=dismissed]`);
+  const dl = eLines().filter((l) => l.ev === 'proposal-dismiss').pop();
+  ok('E11 Dismiss with a reason writes proposal-dismiss with that why, and the panel shows the reason', !!dl && dl.id === attach.id && dl.why === 'we already track this' && dl.by === 'pm:wawan' && eState().proposals.get(attach.id).state === 'dismissed' && /Dismissed: we already track this/.test(await eText('[data-scan-result=dismissed]')), JSON.stringify(dl));
+  await page2.click(`[data-scan-prop="${attach.id}"] [data-scan-act=undo]`);
+  await eSel(`[data-scan-prop="${attach.id}"][data-scan-state=open]`);
+  const ul = eLines().filter((l) => l.ev === 'proposal-undo').pop();
+  ok('E12 Undo appends a proposal-undo line (the dismiss line is still in the file) and the proposal waits for the PM again; the report route says open with no reason', !!ul && ul.id === attach.id && eLines().filter((l) => l.ev === 'proposal-dismiss' && l.id === attach.id).length === 1
+    && eState().proposals.get(attach.id).state === 'open' && (await fx.get(`/api/scan/report?ws=${eWs}&id=${eRb.id}`)).body.proposals.find((p) => p.id === attach.id).dismissed_why === null && /Proposed next steps \(2\)/.test(await eText('[data-scan-next] .hd')), JSON.stringify(ul));
+  ok('E13 an approved proposal cannot be undone on the server (409), which is why the page offers no Undo for it', (await fx.post('/api/scan/proposal', { ws: eWs, id: create.id, action: 'undo' })).status === 409);
+  ok('E14 the runner never ran: no call to `claude`, and the ledger has no scan other than the seeded ones', fx.calls().length === 0 && eState().scanOrder.length === 2, fx.calls().join());
+  ok('E15 the end-to-end page raised no script error', eErrors.length === 0, eErrors.join(' | '));
   await finish();
 })().catch((e) => { console.error(e); finish(1); });