cyborg-hunter 0.4.0 → 0.7.0

package/src/cli/renderers/summary-csv.js

@@ -42,6 +42,11 @@ const COLUMNS = [
   ['zoom_change_count', (s, t) => s.zoomChangeCount || 0],
   ['dev_tools_event_count', (s, t) => s.devToolsEventCount || 0],
   ['authoritative_soft_score', (s, t) => s.authoritativeSoftScore ?? ''],
+  // Guard-honeypot self-disclosure. Three states: 'YES' = box ticked,
+  // 'no' = honeypot present but unticked (negative evidence), '' = honeypot
+  // extension not used for this participant (honeypotAiUse is null).
+  ['honeypot_ai_use', (s, t) => s.honeypotAiUse == null ? '' : (s.honeypotAiUse ? 'YES' : 'no')],
+  ['honeypot_ai_report', (s, t) => s.honeypotAiReport || ''],
 ];
 
 export async function renderSummaryCSV(summaries, triage, config) {

package/src/cli/renderers/trajectories.js

@@ -1,6 +1,6 @@
 // Mouse trajectory rendering (node-canvas). One PNG per participant, grid of
 // per-trial panels. Mirrors the visual conventions of the Python reference
-// pipeline in card-games/rule-gallery/analysis/trajectories.py.
+// pipeline used during development (not included in this repo).
 //
 // Per-panel visual elements:
 //   - Time-colored path (blue → red gradient over the trial's duration)
@@ -16,13 +16,14 @@
 
 import { writeFileSync } from 'fs';
 import { join } from 'path';
+import { ruleChronologicalCompare } from '../ingest.js';
 
 // Panel dimensions (pixels).
 const PANEL_W = 400;
 const PANEL_H = 300;
 const PANEL_PAD = 40;
 const TITLE_HEIGHT = 40;
-const HEADER_HEIGHT = 80;   // accommodates 2-line legend
+const HEADER_HEIGHT = 96;   // accommodates 3-line legend
 const PANEL_MARGIN = 15;    // inset between panel border and content area
 
 // Color palette. Hoisted from inline string literals to give the rendering
@@ -50,12 +51,50 @@ const COLORS = {
   pauseCircle: '#ccc',
 };
 
+// Panel-background tints by trial phase (0.6.1, retro item 9) — same palette
+// as the session-timeline phase strip (session-timeline.js C.phase*), so a
+// panel's tint and the timeline band for the same phase read as one system.
+// Trials without a recognized phase keep the neutral panelBg.
+const PHASE_TINTS = {
+  gallery: '#ffe0b2',             // peach — matches C.phaseGallery
+  post_gallery_query: '#e1bee7',  // light purple — matches C.phaseTyping
+  typing: '#e1bee7',
+  classification: '#bbdefb',      // light blue — matches C.phaseClass
+  end_requery: '#eceff1',         // bluish grey — matches C.phasePre/Post
+};
+
+// Orders a participant's trials for the panel grid (0.6.1, retro item 3).
+// config.trajectoryDisplayOrder:
+//   'rule'      (default) chronological by rule — (rulePosition, phase-rank,
+//               trialNumber), the order each rule was actually experienced.
+//               Same comparator the ingest uses when merging phaseTrials, so
+//               already-sorted data keeps its order (stable sort).
+//   'time'      wall-clock trial timestamps (fallback: trialNumber)
+//   'insertion' raw ingest order (pre-0.6.1 behavior)
+// Exported for tests.
+export function orderTrials(trials, config) {
+  const mode = config.trajectoryDisplayOrder || 'rule';
+  if (mode === 'insertion') return trials;
+  const ordered = trials.slice();
+  if (mode === 'time') {
+    ordered.sort((a, b) => {
+      const at = a?.timestamp ? Date.parse(a.timestamp) : NaN;
+      const bt = b?.timestamp ? Date.parse(b.timestamp) : NaN;
+      if (Number.isFinite(at) && Number.isFinite(bt) && at !== bt) return at - bt;
+      return (a.trialNumber ?? 0) - (b.trialNumber ?? 0);
+    });
+  } else {
+    ordered.sort(ruleChronologicalCompare);
+  }
+  return ordered;
+}
+
 export async function renderTrajectories(participants, triage, config) {
   const { createCanvas } = await import('canvas');
   const triageMap = new Map(triage.map(t => [t.participantId, t]));
 
   for (const p of participants) {
-    const trials = p.trials;
+    const trials = orderTrials(p.trials, config);
     if (trials.length === 0) continue;
 
     // Compute grid layout
@@ -90,6 +129,10 @@ export async function renderTrajectories(participants, triage, config) {
       'Teal outer rect=screen  Purple dashed rect=browser window  Red panel frame=hard signal triggered on this trial',
       PANEL_PAD, 64
     );
+    ctx.fillText(
+      'Panel tint=phase: peach gallery, purple typing/query, blue classification, grey re-query (neutral = unphased) — matches the session-timeline strip',
+      PANEL_PAD, 80
+    );
 
     // session.windowPositions is the 2-second-poll-plus-resize-event record
     // from core/signals/browser.js. Per-trial geometry uses the sample whose
@@ -128,7 +171,10 @@ export async function renderTrajectories(participants, triage, config) {
 function renderTrialPanel(ctx, trial, x0, y0, config, metadata) {
   const mouse = trial.mouseEvents || [];
   const tabAways = trial.tabAwayEvents || [];
-  const trialId = trial.trialId || trial.ruleId || '?';
+  // String() guard: a numeric trialId/ruleId (from a hand-edited payload or a
+  // dynamicTyping CSV) would otherwise throw on .substring() below and, with no
+  // per-participant boundary, abort every remaining visual.
+  const trialId = String(trial.trialId || trial.ruleId || '?');
   const rt = (trial.duration_ms || trial.responseTime_ms || 0) / 1000;
   const moves = mouse.filter(e => e.type === 'move');
   const downs = mouse.filter(e => e.type === 'down');
@@ -141,8 +187,9 @@ function renderTrialPanel(ctx, trial, x0, y0, config, metadata) {
   ctx.lineWidth = anyHardHit ? 3 : 1;
   ctx.strokeRect(x0, y0 + TITLE_HEIGHT, PANEL_W, PANEL_H);
 
-  // Panel background
-  ctx.fillStyle = COLORS.panelBg;
+  // Panel background — tinted by trial phase (see PHASE_TINTS), neutral for
+  // unphased trials.
+  ctx.fillStyle = PHASE_TINTS[trial.phase] || COLORS.panelBg;
   ctx.fillRect(x0 + 1, y0 + TITLE_HEIGHT + 1, PANEL_W - 2, PANEL_H - 2);
 
   // Title
@@ -403,10 +450,24 @@ function sanitize(name) {
 // The screenWidth/screenHeight fields are conditionally included — the
 // April 2026 monitor change added sw/sh capture, but older recordings
 // won't have it. Omitting (rather than zero-filling) lets chooseScreenFrame
-// fall through its legacy/auto-fit branches honestly.
+// fall through its compatibility/auto-fit branches honestly.
 export function pickWindowGeometryForTrial(trial, windowPositions) {
   if (!Array.isArray(windowPositions) || windowPositions.length === 0) return null;
-  const anchor = trial?.trialStart_perfNow;
+  // Time anchor for matching the right windowPositions sample.
+  //
+  // jsPsych extension data carries `trialStart_perfNow` (set by the wrapper's
+  // on_load). Raw-DOM extension users save
+  // `startTime` directly from `performance.now()` at trial start. Both are in
+  // the same reference frame as `windowPositions[].t` (performance.now()), so
+  // either works.
+  //
+  // Without this fallback, raw-DOM users see auto-fit or stale session-level
+  // window dimensions — symptom: the dashed "window" box in the trajectory
+  // PNG is sized for the pre-fullscreen viewport even when the trial happened
+  // in fullscreen, so mouse dots plot outside the box.
+  const anchor = (typeof trial?.trialStart_perfNow === 'number')
+    ? trial.trialStart_perfNow
+    : (typeof trial?.startTime === 'number' ? trial.startTime : null);
   if (typeof anchor !== 'number') return null;
 
   // Selection strategy (in priority order):

package/src/cli/renderers/triage-md.js

@@ -11,15 +11,21 @@ export async function renderTriage(triage, config) {
     '',
     `_${triage.length} participants analyzed_`,
     '',
-    '| Rank | Participant | Score | Hard | Reason |',
-    '|------|-------------|-------|------|--------|',
+    '**Tier** is the library\'s two-tier screening verdict: `HARD` = a hard signal',
+    '(paste/drop/copy) crossed its count threshold; `soft` = library soft score ≥',
+    'its threshold; `clean` = neither. **Score** is the CLI\'s separate ranking',
+    'heuristic (5×paste + 5×copy + 3×sidebar + 1×tab-away) — it orders rows',
+    '*within* a tier and is not the library soft score.',
+    '',
+    '| Rank | Participant | Tier | Score | Reason |',
+    '|------|-------------|------|-------|--------|',
   ];
 
   triage.forEach((t, i) => {
-    const hard = t.hardTriggered ? '**YES**' : 'no';
+    const tier = t.hardTriggered ? '**HARD**' : t.softFlagged ? 'soft' : 'clean';
     // Escape pipe characters in reason text to avoid breaking the table
     const reason = t.reason.replace(/\|/g, '\\|');
-    lines.push(`| ${i + 1} | ${t.participantId} | ${t.score} | ${hard} | ${reason} |`);
+    lines.push(`| ${i + 1} | ${t.participantId} | ${tier} | ${t.score} | ${reason} |`);
   });
 
   lines.push('');

package/src/cli/renderers/typing-profile.js

@@ -15,12 +15,18 @@ const LEFT_PAD = 60;
 
 export async function renderTypingProfiles(participants, config) {
   const { createCanvas } = await import('canvas');
-  const threshold = config.typingSpeedThreshold_cps || 10;
 
   for (const p of participants) {
     const trials = p.trials;
     if (trials.length === 0) continue;
 
+    // Per-participant threshold line: prefer the typing-speed cutoff the library
+    // actually screened this participant with (saved in session.config.thresholds)
+    // so the red "fast typing" line matches summary.csv's count; fall back to the
+    // CLI/default. A strict participant (8 cps) otherwise shows a 10 cps line.
+    const threshold =
+      p.session?.config?.thresholds?.typingSpeedCps ?? config.typingSpeedThreshold_cps ?? 10;
+
     // Per-trial state. We distinguish three cases:
     //   "typed"       — charsPerSec is a real number, draw a normal bar
     //   "paste-only"  — charsPerSec is null but there's a paste event; draw a

package/src/cli/report.js

@@ -12,6 +12,7 @@ import { ingest } from './ingest.js';
 import { computeSummary } from './analyzers/summary.js';
 import { detectEdgeExits } from './analyzers/edge-exit.js';
 import { rankTriage } from './analyzers/triage.js';
+import { applyPhaseScope, describePhaseScope, findUnmatchedPhaseScopePhases } from './analyzers/phase-scope.js';
 import { VERSION } from '../shared/constants.js';
 
 export async function run(args) {
@@ -44,19 +45,43 @@ export async function run(args) {
     process.exit(1);
   }
 
-  // 3. Analyze — compute summaries, detect edge exits, rank by triage priority
-  const summaries = computeSummary(participants, config);
-  const edgeExits = detectEdgeExits(participants, config);
+  // 3. Analyze — compute summaries, detect edge exits, rank by triage priority.
+  // config.phaseScope (0.6.1) filters which trials feed the analyzers so
+  // scores can honor pre-registered phase scoping; renderers below still get
+  // the FULL participants, so the visual evidence is never hidden.
+  const scoredParticipants = applyPhaseScope(participants, config.phaseScope);
+  if (scoredParticipants !== participants) {
+    console.log(`\nPhase scope active (${describePhaseScope(config.phaseScope)}):`);
+    console.log(`  scores count per-trial signals inside the scope only; ambient session`);
+    console.log(`  signals (sidebar, shortcuts, viewport shifts, zoom) stay session-wide.`);
+    // A configured phase name that matches no trial is almost always a typo. For
+    // an `include`, it silently filters every trial and reports the cohort clean.
+    const unmatched = findUnmatchedPhaseScopePhases(participants, config.phaseScope);
+    if (unmatched.length > 0) {
+      console.warn(`[cyborg-hunter] phaseScope names match NO trial in the data: ` +
+        `${unmatched.join(', ')} — likely a typo; scored trials may be wrongly emptied.`);
+    }
+  }
+  const summaries = computeSummary(scoredParticipants, config);
+  const edgeExits = detectEdgeExits(scoredParticipants, config);
   const triage = rankTriage(summaries, edgeExits, config);
 
   const flaggedHard = triage.filter(t => t.hardTriggered).length;
   const flaggedSoft = triage.filter(t => !t.hardTriggered && t.softFlagged).length;
   const clean = triage.length - flaggedHard - flaggedSoft;
 
+  // Two DIFFERENT numbers live in this report and used to share the word
+  // "flagged": the tier counts below come from the LIBRARY's two-tier
+  // screening (hard count thresholds / soft score vs its threshold), while
+  // triage.md is ORDERED by the CLI's separate composite triage score
+  // (5×paste + 5×copy + 3×sidebar + 1×tab-away) within each tier. Label both
+  // explicitly so the console summary can't be read as "top N of triage.md".
   console.log(`\nAnalyzing...`);
-  console.log(`  Participants flagged (hard signals): ${flaggedHard}`);
-  console.log(`  Participants flagged (soft score): ${flaggedSoft}`);
-  console.log(`  Participants clean: ${clean}`);
+  console.log(`  Hard-flagged (hard signal crossed its count threshold): ${flaggedHard}`);
+  console.log(`  Soft-flagged (library soft score >= its threshold):     ${flaggedSoft}`);
+  console.log(`  Clean:                                                  ${clean}`);
+  console.log(`  Triage.md orders tier-first (hard > soft > clean), then by the CLI`);
+  console.log(`  triage score (5xpaste + 5xcopy + 3xsidebar + 1xtab-away) within a tier.`);
 
   // 4. Render outputs
   console.log(`\nRendering...`);
@@ -92,19 +117,28 @@ export async function run(args) {
 
     if (canvas) {
       const { renderTrajectories } = await import('./renderers/trajectories.js');
-      const { renderTabTimelines } = await import('./renderers/tab-timeline.js');
+      const { renderSessionTimelines } = await import('./renderers/session-timeline.js');
       const { renderTypingProfiles } = await import('./renderers/typing-profile.js');
 
       // Create images/ subdirectory for visual outputs
       mkdirSync(join(config.outputDir, 'images'), { recursive: true });
 
       await renderTrajectories(participants, triage, config);
-      await renderTabTimelines(participants, config);
+      await renderSessionTimelines(participants, config);
       await renderTypingProfiles(participants, config);
       visualsRendered = true;
     }
   }
 
+  // Replay assets — per-participant JSONP models under replay/, lazy-loaded
+  // by the HTML report. Size is printed because dom-tier models dominate
+  // the report's disk footprint.
+  const { renderReplayAssets } = await import('./renderers/replay-assets.js');
+  const replayAssets = renderReplayAssets(participants, config.outputDir);
+  if (replayAssets.count > 0) {
+    console.log(`  replay/ — ${replayAssets.count} session replays (${(replayAssets.totalBytes / 1024 / 1024).toFixed(1)} MB)`);
+  }
+
   // HTML index page — references images/ folder (not base64-embedded)
   const { renderHtmlIndex } = await import('./renderers/html-index.js');
   await renderHtmlIndex(summaries, triage, participants, config, visualsRendered);

package/src/core/monitor.js

@@ -7,14 +7,14 @@
 
 import { createStateMachine, deepCopy } from './state-machine.js';
 import { DEFAULT_THRESHOLDS, PRESETS, VERSION } from '../shared/constants.js';
-import { validateConfig } from '../shared/validation.js';
+import { validateConfig, validateScoringShape } from '../shared/validation.js';
 import { computeTrialScores, shouldScreenout as _shouldScreenout } from './scoring.js';
 import { attachClipboardSignals } from './signals/clipboard.js';
 import { attachFocusSignals, attachIdleGapSignals } from './signals/focus.js';
 import { attachMouseSignals, computeMouseMetrics } from './signals/mouse.js';
 import { attachTypingSignals, attachForeignInputSignals, computeTypingSpeed } from './signals/typing.js';
 import { attachBrowserSignals, attachElementTrace } from './signals/browser.js';
-import { injectDecoy, removeDecoyElement } from './signals/dom-protection.js';
+import { injectDecoy, removeDecoyElement, resetDecoyState } from './signals/dom-protection.js';
 
 let _activeInstance = null; // Track for idempotent init
 
@@ -88,6 +88,14 @@ export function init(userConfig) {
   var warnings = validateConfig(userConfig, KNOWN_KEYS);
   warnings.forEach(function (w) { console.warn("[cyborg-hunter] " + w); });
 
+  // Shape-check the MERGED scoring config: a nested typo in an override
+  // (e.g. countThreshhold) silently disables a screenout rule because the
+  // rule object is replaced wholesale and top-level key validation can't see
+  // inside it. Warn so the misconfiguration is visible instead of silent.
+  validateScoringShape(mergedScoring).forEach(function (w) {
+    console.warn("[cyborg-hunter] " + w);
+  });
+
   // Freeze config
   Object.freeze(config);
   Object.freeze(config.signals);
@@ -141,20 +149,32 @@ export function init(userConfig) {
 
   // ── Internal state ──
   var sm = createStateMachine();
+  // viewportWidthShifts is the canonical name since 0.6.1 (the signal measures
+  // viewport-width changes, not Web-Vitals-style layout shift). layoutShifts is
+  // kept as a deprecated alias pointing at the SAME array, so serialized
+  // reports carry both keys and downstream consumers reading either keep
+  // working. The alias will be removed in a future major version.
+  var _viewportWidthShifts = [];
   var sessionData = {
     pasteCount: 0, copyCount: 0, dropCount: 0,
-    tabAwaySums: [], charsPerSec: [],
+    tabAwaySums: [], tabAwayEvents: [], charsPerSec: [],
     sidebarEvents: [], devToolsEvents: [],
     aiExtensionsFound: [], keyboardShortcuts: [],
     windowPositions: [], idleGaps: [],
-    extensionInjections: [], layoutShifts: [],
+    extensionInjections: [],
+    viewportWidthShifts: _viewportWidthShifts,
+    layoutShifts: _viewportWidthShifts,
     zoomChanges: [],
     hardScore: {}, softScore: 0, trialsCompleted: 0
   };
   var trialData = null;
   var listeners = [];
   var trialListeners = [];
-  var intervals = [];
+  var intervals = [];        // session-scoped, cleared at destroy()
+  var trialIntervals = [];   // trial-scoped, cleared at endTrial() AND destroy()
+
+  // Module-level decoy state (cal-{N} numbering) must restart per instance.
+  resetDecoyState();
 
   function transition(to) {
     if (!sm.transition(to)) {
@@ -185,11 +205,17 @@ export function init(userConfig) {
     intervals.push(id);
   }
 
+  function addTrialInterval(id) {
+    trialIntervals.push(id);
+  }
+
   function removeTrialListeners() {
     trialListeners.forEach(function (l) {
       l.target.removeEventListener(l.event, l.handler, l.options);
     });
     trialListeners = [];
+    trialIntervals.forEach(function (id) { clearInterval(id); });
+    trialIntervals = [];
     removeDecoyElement();
   }
 
@@ -208,7 +234,7 @@ export function init(userConfig) {
   function buildTrialCtx() {
     return {
       config, sessionData, trialData, listeners,
-      addTrialListener, addInterval, fireSignal, isKnownInput,
+      addTrialListener, addInterval, addTrialInterval, fireSignal, isKnownInput,
       getTrialData: function () { return trialData; }
     };
   }
@@ -316,6 +342,14 @@ export function init(userConfig) {
       report.duration_ms = performance.now() - trialData.startTime;
       report.libraryVersion = VERSION;
       report.participantId = config.participantId;
+      // Wall-clock stamp at trial end (ISO 8601). Downstream renderers anchor
+      // per-rule phase bands with Date.parse(trial.timestamp); before 0.6.1
+      // the report carried only performance.now() values, so payloads whose
+      // app layer didn't stamp its own timestamp produced NaN anchors.
+      // Note: in Shape-1 ingest the integrity sub-object wins key collisions,
+      // so for new data this stamp shadows an app-level trial timestamp —
+      // both are trial-end wall-clocks, so they agree to within milliseconds.
+      report.timestamp = new Date().toISOString();
 
       // Compute typing speed
       var cps = computeTypingSpeed(trialData.editTimestamps);
@@ -324,6 +358,17 @@ export function init(userConfig) {
         sessionData.charsPerSec.push(cps);
       }
 
+      // Privacy gate: the raw per-edit timestamps are keystroke-timing data.
+      // Persist them ONLY when keystroke dynamics are explicitly enabled
+      // (signals.keystrokeDynamics, or collectForPostHoc.fullKeystrokeTimestamps).
+      // Otherwise keep only the derived charsPerSec — the typing-speed signal
+      // still works, but the raw timings never leave the browser. Without this,
+      // the documented "off by default in permissive/standard" privacy toggle was
+      // inert and the timings were saved verbatim regardless.
+      if (!config.signals.keystrokeDynamics && !config.collectForPostHoc.fullKeystrokeTimestamps) {
+        report.editTimestamps = [];
+      }
+
       // Compute mouse bot metrics
       var mouseMetrics = computeMouseMetrics(
         trialData.mouseEvents,
@@ -370,9 +415,17 @@ export function init(userConfig) {
         return sessionData.hardScore[k].triggered;
       });
       report.trialsCompleted = sessionData.trialsCompleted;
+      // Carry the effective runtime settings the CLI report needs to interpret
+      // this participant's data with the SAME thresholds the library screened
+      // them against (e.g. a strict-preset participant's tab-away cutoff), rather
+      // than analyst-side CLI defaults.
       report.config = {
         preset: config.preset,
-        participantId: config.participantId
+        participantId: config.participantId,
+        thresholds: {
+          tabAwayDurationMs: config.thresholds.tabAwayDurationMs,
+          typingSpeedCps: config.thresholds.typingSpeedCps
+        }
       };
       report.libraryVersion = VERSION;
       return report;

package/src/core/scoring.js

@@ -81,11 +81,20 @@ export function computeTrialScores(trialData, sessionData, config, report) {
     };
   }
 
+  // ── Trial window upper bound ──
+  // Session-scoped events (sidebar, devTools shortcuts) count toward this
+  // trial only if they fall inside [startTime, startTime + duration]. Using
+  // performance.now() here would silently widen the window if scoring were
+  // ever deferred past endTrial.
+  var trialEnd = trialData.startTime + (report && report.duration_ms != null
+    ? report.duration_ms
+    : performance.now() - trialData.startTime);
+
   // ── Soft signal: sidebarEvent ──
   // Counts sidebar events that occurred during this trial's time window.
   if (scoring.soft.sidebarEvent) {
     var trialSidebarHits = sessionData.sidebarEvents.filter(function (e) {
-      return e.t >= trialData.startTime && e.t <= performance.now();
+      return e.t >= trialData.startTime && e.t <= trialEnd;
     }).length;
     if (trialSidebarHits > 0) {
       var sidebarScore = scoring.soft.sidebarEvent.weight;
@@ -98,7 +107,7 @@ export function computeTrialScores(trialData, sessionData, config, report) {
   // Counts keyboard shortcuts detected during this trial's time window.
   if (scoring.soft.devTools) {
     var trialDevToolsHits = sessionData.keyboardShortcuts.filter(function (e) {
-      return e.t >= trialData.startTime && e.t <= performance.now();
+      return e.t >= trialData.startTime && e.t <= trialEnd;
     }).length;
     if (trialDevToolsHits > 0) {
       var devToolsScore = scoring.soft.devTools.weight;

package/src/core/signals/browser.js

@@ -24,8 +24,11 @@ export function attachBrowserSignals(ctx) {
   // ── Sidebar gap detection (2s polling) ──
   // Tracks state TRANSITIONS in innerWidth. A sidebar opening shrinks
   // innerWidth by 300-500px. Also checks layout compression (extension
-  // padding/margin on <html> element).
-  if (config.signals.sidebarGap || config.signals.devTools) {
+  // padding/margin on <html> element) and zoom changes. None of these are
+  // DevTools-related, so this interval is gated by `sidebarGap` alone — the
+  // earlier `|| devTools` here was a mis-routed toggle (DevTools evidence comes
+  // from the keyboard-shortcut listener below, not from viewport polling).
+  if (config.signals.sidebarGap) {
     var _lastZoom = window.devicePixelRatio || 1;
     var _baselineIW = window.innerWidth;
     var _sidebarOpen = false;
@@ -138,9 +141,12 @@ export function attachBrowserSignals(ctx) {
     ctx.addInterval(setInterval(scanExtensions, config.thresholds.extensionScanMs));
   }
 
-  // ── Keyboard shortcut detection ──
-  // Catches DevTools shortcuts (Ctrl+Shift+I/J/C, F12)
-  if (config.signals.keyboardShortcuts) {
+  // ── Keyboard shortcut / DevTools-hotkey detection ──
+  // Catches DevTools shortcuts (Ctrl+Shift+I/J/C, F12). This listener IS the
+  // "DevTools" detector, so EITHER the `keyboardShortcuts` or the `devTools`
+  // signal enables it (the soft `devTools` weight then scores the captured
+  // hotkeys). Records into sessionData.keyboardShortcuts.
+  if (config.signals.keyboardShortcuts || config.signals.devTools) {
     ctx.addListener(document, "keydown", function (e) {
       var dominated = e.ctrlKey || e.metaKey;
       if (dominated && e.shiftKey && (e.key === "I" || e.key === "J" || e.key === "C")) {
@@ -237,25 +243,50 @@ export function attachBrowserSignals(ctx) {
     });
   }
 
-  // ── ResizeObserver for layout compression ──
+  // ── ResizeObserver for viewport-width shifts ──
   // Fires when <html> element dimensions change. Catches extensions that
   // add margin-right/padding-right to <html> to make room for their panel.
+  //
+  // Renamed from "layoutShifts" in 0.6.1: the signal measures VIEWPORT-WIDTH
+  // changes, not Web-Vitals CLS-style layout shift — the old name collided
+  // with that semantics. Records go to sessionData.viewportWidthShifts
+  // (canonical); sessionData.layoutShifts aliases the same array.
+  //
+  // Debounced (0.6.1): a drag-resize fires the observer once per frame, so a
+  // single gesture used to log 5+ shift events. Now the shift is logged only
+  // after viewportShiftDebounceMs of quiet, as ONE event carrying the net
+  // old→new change of the whole gesture. A shift still settling when
+  // destroy() runs is dropped (the debounce timer is cleared with the other
+  // intervals) — acceptable, since destroy() means the session is over.
   if (config.signals.sidebarGap) {
     var baselineWidth = document.documentElement.clientWidth;
+    var _pendingWidth = null;
+    var _shiftTimer = null;
+    var flushShift = function () {
+      _shiftTimer = null;
+      if (_pendingWidth === null) return;
+      var settledWidth = _pendingWidth;
+      _pendingWidth = null;
+      var delta = baselineWidth - settledWidth;
+      if (Math.abs(delta) > config.thresholds.layoutCompressionPx) {
+        sessionData.viewportWidthShifts.push({
+          oldWidth: Math.round(baselineWidth),
+          newWidth: Math.round(settledWidth),
+          delta: Math.round(delta),
+          t: performance.now()
+        });
+        baselineWidth = settledWidth;
+      }
+    };
     var resizeObs = new ResizeObserver(function (entries) {
       for (var i = 0; i < entries.length; i++) {
-        var currentWidth = entries[i].contentRect.width;
-        var delta = baselineWidth - currentWidth;
-        if (Math.abs(delta) > config.thresholds.layoutCompressionPx) {
-          sessionData.layoutShifts.push({
-            oldWidth: Math.round(baselineWidth),
-            newWidth: Math.round(currentWidth),
-            delta: Math.round(delta),
-            t: performance.now()
-          });
-          baselineWidth = currentWidth;
-        }
+        _pendingWidth = entries[i].contentRect.width;
       }
+      if (_shiftTimer) clearTimeout(_shiftTimer);
+      _shiftTimer = setTimeout(flushShift, config.thresholds.viewportShiftDebounceMs);
+      // Tracked so destroy() clears a still-pending debounce (clearInterval
+      // and clearTimeout are interchangeable per the HTML spec).
+      ctx.addInterval(_shiftTimer);
     });
     resizeObs.observe(document.documentElement);
     ctx.listeners.push({
@@ -298,6 +329,8 @@ export function attachElementTrace(ctx) {
         }
       } catch (e) { /* elementsFromPoint not supported */ }
     }, config.thresholds.elementTraceHz);
-    ctx.addInterval(elementTraceId);
+    // Trial-scoped: cleared at endTrial. Registering session-scoped here
+    // leaked one live interval per trial until destroy().
+    ctx.addTrialInterval(elementTraceId);
   }
 }

package/src/core/signals/clipboard.js

@@ -57,17 +57,25 @@ export function attachClipboardSignals(ctx) {
     });
 
     // Cut is logged under the copy signal (same data concern — text leaving
-    // the page). Stored in copyEvents alongside copy entries.
+    // the page). Stored in copyEvents alongside copy entries, and — like copy —
+    // increments the session copyCount so the hard-copy screenout counts cuts
+    // too. Without this, a cut showed up in the per-trial hard `trialHits` and
+    // in the soft-copy score but never in the session total that actually
+    // triggers, so strict-preset hard-copy could not fire on cuts.
     ctx.addTrialListener(document, "cut", function (e) {
       trialData.copyEvents.push({
         type: "cut", t: performance.now()
       });
+      ctx.sessionData.copyCount++;
       ctx.fireSignal("cut", e, {});
     });
   }
 
   // ── Drop detection ──
-  if (config.signals.paste) {
+  // Gated on its own signal flag (presets declare drop explicitly). Was
+  // previously gated on paste by copy-paste error, so disabling paste
+  // silently disabled drop — a separately hard-scored signal.
+  if (config.signals.drop) {
     ctx.addTrialListener(document, "drop", function (e) {
       var text = "";
       try { text = e.dataTransfer.getData("text"); } catch (err) {}

package/src/core/signals/dom-protection.js

@@ -143,6 +143,15 @@ function scanDomForDecoy(excludeSelectors) {
 // Internal trial counter for Tier 3/4 template variable
 var _decoyTrialIndex = 0;
 
+/**
+ * Resets module-level decoy state. Called from monitor.js init() so a second
+ * CyborgHunter.init() in the same page load restarts cal-{N} numbering at 1
+ * instead of continuing where the previous instance left off.
+ */
+export function resetDecoyState() {
+  _decoyTrialIndex = 0;
+}
+
 /**
  * Main decoy injection function. Called from monitor.js at startTrial().
  *

package/src/core/signals/focus.js

@@ -33,10 +33,22 @@ export function attachFocusSignals(ctx) {
       var event = {
         start: _tabAwayStart,
         duration_ms: Math.round(duration),
-        type: _tabAwayType
+        type: _tabAwayType,
+        // Wall-clock at the LEAVE moment (ISO 8601), reconstructed at return
+        // time. Lets timelines place session-level events absolutely without
+        // a perfNow→wall-clock offset estimator.
+        timestamp: new Date(Date.now() - duration).toISOString()
       };
       // Push to current trial if one is active
       if (ctx.getTrialData()) ctx.getTrialData().tabAwayEvents.push(event);
+      // Session-level record (0.6.1). tabAwaySums keeps only durations, so
+      // events OUTSIDE startTrial/endTrial (consent, tutorial, comprehension,
+      // gallery study) used to lose their timing entirely — timelines could
+      // count them but not place them. tabAwayEvents preserves the full
+      // {start, duration_ms, type, timestamp} for every tab-away in the
+      // session, on-trial or off. tabAwaySums is kept alongside for backward
+      // compatibility.
+      ctx.sessionData.tabAwayEvents.push(event);
       ctx.sessionData.tabAwaySums.push(Math.round(duration));
       ctx.fireSignal("tabReturn", null, {
         duration_ms: Math.round(duration),
@@ -96,6 +108,8 @@ export function attachIdleGapSignals(ctx) {
         lastActivityTime = performance.now();
       }
     }, config.thresholds.idleCheckIntervalMs);
-    ctx.addInterval(idleCheckId);
+    // Trial-scoped: cleared at endTrial. Registering session-scoped here
+    // leaked one live interval per trial until destroy().
+    ctx.addTrialInterval(idleCheckId);
   }
 }