cyborg-hunter 0.5.0 → 0.7.2

package/src/core/monitor.js

@@ -7,14 +7,14 @@
 
 import { createStateMachine, deepCopy } from './state-machine.js';
 import { DEFAULT_THRESHOLDS, PRESETS, VERSION } from '../shared/constants.js';
-import { validateConfig } from '../shared/validation.js';
+import { validateConfig, validateScoringShape } from '../shared/validation.js';
 import { computeTrialScores, shouldScreenout as _shouldScreenout } from './scoring.js';
 import { attachClipboardSignals } from './signals/clipboard.js';
 import { attachFocusSignals, attachIdleGapSignals } from './signals/focus.js';
 import { attachMouseSignals, computeMouseMetrics } from './signals/mouse.js';
 import { attachTypingSignals, attachForeignInputSignals, computeTypingSpeed } from './signals/typing.js';
 import { attachBrowserSignals, attachElementTrace } from './signals/browser.js';
-import { injectDecoy, removeDecoyElement } from './signals/dom-protection.js';
+import { injectDecoy, removeDecoyElement, resetDecoyState } from './signals/dom-protection.js';
 
 let _activeInstance = null; // Track for idempotent init
 
@@ -88,6 +88,14 @@ export function init(userConfig) {
   var warnings = validateConfig(userConfig, KNOWN_KEYS);
   warnings.forEach(function (w) { console.warn("[cyborg-hunter] " + w); });
 
+  // Shape-check the MERGED scoring config: a nested typo in an override
+  // (e.g. countThreshhold) silently disables a screenout rule because the
+  // rule object is replaced wholesale and top-level key validation can't see
+  // inside it. Warn so the misconfiguration is visible instead of silent.
+  validateScoringShape(mergedScoring).forEach(function (w) {
+    console.warn("[cyborg-hunter] " + w);
+  });
+
   // Freeze config
   Object.freeze(config);
   Object.freeze(config.signals);
@@ -141,20 +149,32 @@ export function init(userConfig) {
 
   // ── Internal state ──
   var sm = createStateMachine();
+  // viewportWidthShifts is the canonical name since 0.6.1 (the signal measures
+  // viewport-width changes, not Web-Vitals-style layout shift). layoutShifts is
+  // kept as a deprecated alias pointing at the SAME array, so serialized
+  // reports carry both keys and downstream consumers reading either keep
+  // working. The alias will be removed in a future major version.
+  var _viewportWidthShifts = [];
   var sessionData = {
     pasteCount: 0, copyCount: 0, dropCount: 0,
-    tabAwaySums: [], charsPerSec: [],
+    tabAwaySums: [], tabAwayEvents: [], charsPerSec: [],
     sidebarEvents: [], devToolsEvents: [],
     aiExtensionsFound: [], keyboardShortcuts: [],
     windowPositions: [], idleGaps: [],
-    extensionInjections: [], layoutShifts: [],
+    extensionInjections: [],
+    viewportWidthShifts: _viewportWidthShifts,
+    layoutShifts: _viewportWidthShifts,
     zoomChanges: [],
     hardScore: {}, softScore: 0, trialsCompleted: 0
   };
   var trialData = null;
   var listeners = [];
   var trialListeners = [];
-  var intervals = [];
+  var intervals = [];        // session-scoped, cleared at destroy()
+  var trialIntervals = [];   // trial-scoped, cleared at endTrial() AND destroy()
+
+  // Module-level decoy state (cal-{N} numbering) must restart per instance.
+  resetDecoyState();
 
   function transition(to) {
     if (!sm.transition(to)) {
@@ -185,11 +205,17 @@ export function init(userConfig) {
     intervals.push(id);
   }
 
+  function addTrialInterval(id) {
+    trialIntervals.push(id);
+  }
+
   function removeTrialListeners() {
     trialListeners.forEach(function (l) {
       l.target.removeEventListener(l.event, l.handler, l.options);
     });
     trialListeners = [];
+    trialIntervals.forEach(function (id) { clearInterval(id); });
+    trialIntervals = [];
     removeDecoyElement();
   }
 
@@ -208,7 +234,7 @@ export function init(userConfig) {
   function buildTrialCtx() {
     return {
       config, sessionData, trialData, listeners,
-      addTrialListener, addInterval, fireSignal, isKnownInput,
+      addTrialListener, addInterval, addTrialInterval, fireSignal, isKnownInput,
       getTrialData: function () { return trialData; }
     };
   }
@@ -316,6 +342,14 @@ export function init(userConfig) {
       report.duration_ms = performance.now() - trialData.startTime;
       report.libraryVersion = VERSION;
       report.participantId = config.participantId;
+      // Wall-clock stamp at trial end (ISO 8601). Downstream renderers anchor
+      // per-rule phase bands with Date.parse(trial.timestamp); before 0.6.1
+      // the report carried only performance.now() values, so payloads whose
+      // app layer didn't stamp its own timestamp produced NaN anchors.
+      // Note: in Shape-1 ingest the integrity sub-object wins key collisions,
+      // so for new data this stamp shadows an app-level trial timestamp —
+      // both are trial-end wall-clocks, so they agree to within milliseconds.
+      report.timestamp = new Date().toISOString();
 
       // Compute typing speed
       var cps = computeTypingSpeed(trialData.editTimestamps);
@@ -324,6 +358,17 @@ export function init(userConfig) {
         sessionData.charsPerSec.push(cps);
       }
 
+      // Privacy gate: the raw per-edit timestamps are keystroke-timing data.
+      // Persist them ONLY when keystroke dynamics are explicitly enabled
+      // (signals.keystrokeDynamics, or collectForPostHoc.fullKeystrokeTimestamps).
+      // Otherwise keep only the derived charsPerSec — the typing-speed signal
+      // still works, but the raw timings never leave the browser. Without this,
+      // the documented "off by default in permissive/standard" privacy toggle was
+      // inert and the timings were saved verbatim regardless.
+      if (!config.signals.keystrokeDynamics && !config.collectForPostHoc.fullKeystrokeTimestamps) {
+        report.editTimestamps = [];
+      }
+
       // Compute mouse bot metrics
       var mouseMetrics = computeMouseMetrics(
         trialData.mouseEvents,
@@ -333,6 +378,23 @@ export function init(userConfig) {
         report.mouseMetrics = mouseMetrics;
       }
 
+      // Privacy gate: the raw per-sample mouse coordinates are a much
+      // higher-resolution behavioral trace than the derived mouseMetrics
+      // above. Persist them ONLY when explicitly enabled
+      // (collectForPostHoc.rawMouseTrack) — under the `mouseTrack` name,
+      // which is what extract-core's field map already expects (mouseTrack →
+      // mouseEvents), so a saved report round-trips through
+      // extractIntegrityData() without new glue. Otherwise drop the raw
+      // report.mouseEvents entirely — the mouseMetrics signal above still
+      // works, but the {x,y,t,type} samples never leave the browser. Before
+      // this gate, deepCopy(trialData) put the full raw track in every
+      // report regardless of the documented off-by-default rawMouseTrack
+      // toggle.
+      if (config.collectForPostHoc.rawMouseTrack) {
+        report.mouseTrack = report.mouseEvents;
+      }
+      delete report.mouseEvents;
+
       // Accumulate into session
       sessionData.trialsCompleted++;
 
@@ -370,9 +432,17 @@ export function init(userConfig) {
         return sessionData.hardScore[k].triggered;
       });
       report.trialsCompleted = sessionData.trialsCompleted;
+      // Carry the effective runtime settings the CLI report needs to interpret
+      // this participant's data with the SAME thresholds the library screened
+      // them against (e.g. a strict-preset participant's tab-away cutoff), rather
+      // than analyst-side CLI defaults.
       report.config = {
         preset: config.preset,
-        participantId: config.participantId
+        participantId: config.participantId,
+        thresholds: {
+          tabAwayDurationMs: config.thresholds.tabAwayDurationMs,
+          typingSpeedCps: config.thresholds.typingSpeedCps
+        }
       };
       report.libraryVersion = VERSION;
       return report;

package/src/core/scoring.js

@@ -81,11 +81,20 @@ export function computeTrialScores(trialData, sessionData, config, report) {
     };
   }
 
+  // ── Trial window upper bound ──
+  // Session-scoped events (sidebar, devTools shortcuts) count toward this
+  // trial only if they fall inside [startTime, startTime + duration]. Using
+  // performance.now() here would silently widen the window if scoring were
+  // ever deferred past endTrial.
+  var trialEnd = trialData.startTime + (report && report.duration_ms != null
+    ? report.duration_ms
+    : performance.now() - trialData.startTime);
+
   // ── Soft signal: sidebarEvent ──
   // Counts sidebar events that occurred during this trial's time window.
   if (scoring.soft.sidebarEvent) {
     var trialSidebarHits = sessionData.sidebarEvents.filter(function (e) {
-      return e.t >= trialData.startTime && e.t <= performance.now();
+      return e.t >= trialData.startTime && e.t <= trialEnd;
     }).length;
     if (trialSidebarHits > 0) {
       var sidebarScore = scoring.soft.sidebarEvent.weight;
@@ -98,7 +107,7 @@ export function computeTrialScores(trialData, sessionData, config, report) {
   // Counts keyboard shortcuts detected during this trial's time window.
   if (scoring.soft.devTools) {
     var trialDevToolsHits = sessionData.keyboardShortcuts.filter(function (e) {
-      return e.t >= trialData.startTime && e.t <= performance.now();
+      return e.t >= trialData.startTime && e.t <= trialEnd;
     }).length;
     if (trialDevToolsHits > 0) {
       var devToolsScore = scoring.soft.devTools.weight;

package/src/core/signals/browser.js

@@ -24,8 +24,11 @@ export function attachBrowserSignals(ctx) {
   // ── Sidebar gap detection (2s polling) ──
   // Tracks state TRANSITIONS in innerWidth. A sidebar opening shrinks
   // innerWidth by 300-500px. Also checks layout compression (extension
-  // padding/margin on <html> element).
-  if (config.signals.sidebarGap || config.signals.devTools) {
+  // padding/margin on <html> element) and zoom changes. None of these are
+  // DevTools-related, so this interval is gated by `sidebarGap` alone — the
+  // earlier `|| devTools` here was a mis-routed toggle (DevTools evidence comes
+  // from the keyboard-shortcut listener below, not from viewport polling).
+  if (config.signals.sidebarGap) {
     var _lastZoom = window.devicePixelRatio || 1;
     var _baselineIW = window.innerWidth;
     var _sidebarOpen = false;
@@ -138,9 +141,12 @@ export function attachBrowserSignals(ctx) {
     ctx.addInterval(setInterval(scanExtensions, config.thresholds.extensionScanMs));
   }
 
-  // ── Keyboard shortcut detection ──
-  // Catches DevTools shortcuts (Ctrl+Shift+I/J/C, F12)
-  if (config.signals.keyboardShortcuts) {
+  // ── Keyboard shortcut / DevTools-hotkey detection ──
+  // Catches DevTools shortcuts (Ctrl+Shift+I/J/C, F12). This listener IS the
+  // "DevTools" detector, so EITHER the `keyboardShortcuts` or the `devTools`
+  // signal enables it (the soft `devTools` weight then scores the captured
+  // hotkeys). Records into sessionData.keyboardShortcuts.
+  if (config.signals.keyboardShortcuts || config.signals.devTools) {
     ctx.addListener(document, "keydown", function (e) {
       var dominated = e.ctrlKey || e.metaKey;
       if (dominated && e.shiftKey && (e.key === "I" || e.key === "J" || e.key === "C")) {
@@ -237,25 +243,50 @@ export function attachBrowserSignals(ctx) {
     });
   }
 
-  // ── ResizeObserver for layout compression ──
+  // ── ResizeObserver for viewport-width shifts ──
   // Fires when <html> element dimensions change. Catches extensions that
   // add margin-right/padding-right to <html> to make room for their panel.
+  //
+  // Renamed from "layoutShifts" in 0.6.1: the signal measures VIEWPORT-WIDTH
+  // changes, not Web-Vitals CLS-style layout shift — the old name collided
+  // with that semantics. Records go to sessionData.viewportWidthShifts
+  // (canonical); sessionData.layoutShifts aliases the same array.
+  //
+  // Debounced (0.6.1): a drag-resize fires the observer once per frame, so a
+  // single gesture used to log 5+ shift events. Now the shift is logged only
+  // after viewportShiftDebounceMs of quiet, as ONE event carrying the net
+  // old→new change of the whole gesture. A shift still settling when
+  // destroy() runs is dropped (the debounce timer is cleared with the other
+  // intervals) — acceptable, since destroy() means the session is over.
   if (config.signals.sidebarGap) {
     var baselineWidth = document.documentElement.clientWidth;
+    var _pendingWidth = null;
+    var _shiftTimer = null;
+    var flushShift = function () {
+      _shiftTimer = null;
+      if (_pendingWidth === null) return;
+      var settledWidth = _pendingWidth;
+      _pendingWidth = null;
+      var delta = baselineWidth - settledWidth;
+      if (Math.abs(delta) > config.thresholds.layoutCompressionPx) {
+        sessionData.viewportWidthShifts.push({
+          oldWidth: Math.round(baselineWidth),
+          newWidth: Math.round(settledWidth),
+          delta: Math.round(delta),
+          t: performance.now()
+        });
+        baselineWidth = settledWidth;
+      }
+    };
     var resizeObs = new ResizeObserver(function (entries) {
       for (var i = 0; i < entries.length; i++) {
-        var currentWidth = entries[i].contentRect.width;
-        var delta = baselineWidth - currentWidth;
-        if (Math.abs(delta) > config.thresholds.layoutCompressionPx) {
-          sessionData.layoutShifts.push({
-            oldWidth: Math.round(baselineWidth),
-            newWidth: Math.round(currentWidth),
-            delta: Math.round(delta),
-            t: performance.now()
-          });
-          baselineWidth = currentWidth;
-        }
+        _pendingWidth = entries[i].contentRect.width;
       }
+      if (_shiftTimer) clearTimeout(_shiftTimer);
+      _shiftTimer = setTimeout(flushShift, config.thresholds.viewportShiftDebounceMs);
+      // Tracked so destroy() clears a still-pending debounce (clearInterval
+      // and clearTimeout are interchangeable per the HTML spec).
+      ctx.addInterval(_shiftTimer);
     });
     resizeObs.observe(document.documentElement);
     ctx.listeners.push({
@@ -298,6 +329,8 @@ export function attachElementTrace(ctx) {
         }
       } catch (e) { /* elementsFromPoint not supported */ }
     }, config.thresholds.elementTraceHz);
-    ctx.addInterval(elementTraceId);
+    // Trial-scoped: cleared at endTrial. Registering session-scoped here
+    // leaked one live interval per trial until destroy().
+    ctx.addTrialInterval(elementTraceId);
   }
 }

package/src/core/signals/clipboard.js

@@ -57,17 +57,25 @@ export function attachClipboardSignals(ctx) {
     });
 
     // Cut is logged under the copy signal (same data concern — text leaving
-    // the page). Stored in copyEvents alongside copy entries.
+    // the page). Stored in copyEvents alongside copy entries, and — like copy —
+    // increments the session copyCount so the hard-copy screenout counts cuts
+    // too. Without this, a cut showed up in the per-trial hard `trialHits` and
+    // in the soft-copy score but never in the session total that actually
+    // triggers, so strict-preset hard-copy could not fire on cuts.
     ctx.addTrialListener(document, "cut", function (e) {
       trialData.copyEvents.push({
         type: "cut", t: performance.now()
       });
+      ctx.sessionData.copyCount++;
       ctx.fireSignal("cut", e, {});
     });
   }
 
   // ── Drop detection ──
-  if (config.signals.paste) {
+  // Gated on its own signal flag (presets declare drop explicitly). Was
+  // previously gated on paste by copy-paste error, so disabling paste
+  // silently disabled drop — a separately hard-scored signal.
+  if (config.signals.drop) {
     ctx.addTrialListener(document, "drop", function (e) {
       var text = "";
       try { text = e.dataTransfer.getData("text"); } catch (err) {}

package/src/core/signals/dom-protection.js

@@ -143,6 +143,15 @@ function scanDomForDecoy(excludeSelectors) {
 // Internal trial counter for Tier 3/4 template variable
 var _decoyTrialIndex = 0;
 
+/**
+ * Resets module-level decoy state. Called from monitor.js init() so a second
+ * CyborgHunter.init() in the same page load restarts cal-{N} numbering at 1
+ * instead of continuing where the previous instance left off.
+ */
+export function resetDecoyState() {
+  _decoyTrialIndex = 0;
+}
+
 /**
  * Main decoy injection function. Called from monitor.js at startTrial().
  *

package/src/core/signals/focus.js

@@ -33,10 +33,22 @@ export function attachFocusSignals(ctx) {
       var event = {
         start: _tabAwayStart,
         duration_ms: Math.round(duration),
-        type: _tabAwayType
+        type: _tabAwayType,
+        // Wall-clock at the LEAVE moment (ISO 8601), reconstructed at return
+        // time. Lets timelines place session-level events absolutely without
+        // a perfNow→wall-clock offset estimator.
+        timestamp: new Date(Date.now() - duration).toISOString()
       };
       // Push to current trial if one is active
       if (ctx.getTrialData()) ctx.getTrialData().tabAwayEvents.push(event);
+      // Session-level record (0.6.1). tabAwaySums keeps only durations, so
+      // events OUTSIDE startTrial/endTrial (consent, tutorial, comprehension,
+      // gallery study) used to lose their timing entirely — timelines could
+      // count them but not place them. tabAwayEvents preserves the full
+      // {start, duration_ms, type, timestamp} for every tab-away in the
+      // session, on-trial or off. tabAwaySums is kept alongside for backward
+      // compatibility.
+      ctx.sessionData.tabAwayEvents.push(event);
       ctx.sessionData.tabAwaySums.push(Math.round(duration));
       ctx.fireSignal("tabReturn", null, {
         duration_ms: Math.round(duration),
@@ -96,6 +108,8 @@ export function attachIdleGapSignals(ctx) {
         lastActivityTime = performance.now();
       }
     }, config.thresholds.idleCheckIntervalMs);
-    ctx.addInterval(idleCheckId);
+    // Trial-scoped: cleared at endTrial. Registering session-scoped here
+    // leaked one live interval per trial until destroy().
+    ctx.addTrialInterval(idleCheckId);
   }
 }

package/src/jspsych/extension-cyborg-hunter-replay.js

@@ -0,0 +1,135 @@
+// jsPsych extension adapter for the cyborg-hunter session replay recorder.
+// Bundled SELF-CONTAINED (imports the replay core), following the guard-
+// extension precedent: one dist file provides both window.CyborgHunterReplay
+// (standalone use) and window.jsPsychCyborgHunterReplay (jsPsych use).
+//
+// Wiring (order matters at finalize; declaration order is free):
+//
+//   const jsPsych = initJsPsych({
+//     extensions: [
+//       { type: jsPsychCyborgHunter,       params: { participantId, preset } },
+//       { type: jsPsychGuardFriction },
+//       { type: jsPsychGuardHoneypot },
+//       { type: jsPsychCyborgHunterReplay, params: {
+//           participantId, tier: 'dom',
+//           autoSave: { mode: 'datapipe', experimentId: 'ABC123' } } }
+//     ],
+//     on_finish: async function () {
+//       jsPsych.extensions['guard-friction'].finalize();
+//       jsPsych.extensions['guard-honeypot'].finalize();
+//       jsPsych.extensions['cyborg-hunter'].finalize();
+//       await jsPsych.extensions['cyborg-hunter-replay'].finalize();
+//       jsPsych.data.get().localSave('csv', 'data.csv');
+//     }
+//   });
+//
+// Replay finalizes LAST: it pulls CH's session report through a monitor
+// reference stashed at initialize() — never through window.CyborgHunter,
+// whose singleton slot is nulled by CH's destroy(). getSessionReport()
+// remains callable after destroy() (sessionData survives teardown), so the
+// pull works even though CH finalized first.
+
+import * as CHReplay from '../replay/index.js';
+import { buildReplayMeta } from '../replay/persistence.js';
+
+class CyborgHunterReplayExtension {
+  static info = {
+    name: 'cyborg-hunter-replay',
+    version: '0.7.2',
+    data: {}   // per-trial return is {}; session meta goes via addProperties
+  };
+
+  constructor(jsPsych) {
+    this.jsPsych = jsPsych;
+    this.api = null;
+    this._chMonitor = null;
+    this._lastRecording = null;
+    this._monitoring = false;
+  }
+
+  initialize(params) {
+    this.params = params || {};
+    this.api = CHReplay.attach(this.params);
+    this.api.startSession();
+    this._stashChMonitor();
+  }
+
+  // The cyborg-hunter extension initializes before this one when declared
+  // earlier in the extensions array; if not, retry the stash at finalize.
+  _stashChMonitor() {
+    try {
+      var ch = this.jsPsych && this.jsPsych.extensions &&
+        this.jsPsych.extensions['cyborg-hunter'];
+      if (ch && ch.monitor) this._chMonitor = ch.monitor;
+    } catch (e) { /* standalone replay is fine */ }
+  }
+
+  // jsPsych 7 calls on_start unconditionally for every trial that lists the
+  // extension — must exist even as a no-op (see extension-cyborg-hunter.js).
+  on_start(_params) {}
+
+  on_load(params) {
+    if (!this.api) return;
+    this._monitoring = true;
+    var trialIndex = 0;
+    var plugin = 'unknown';
+    try { trialIndex = this.jsPsych.getProgress().current_trial_global; } catch (e) {}
+    try {
+      plugin = (this.jsPsych.getCurrentTrial() || {}).type?.info?.name || 'unknown';
+    } catch (e) {}
+    this.api.startTrial({
+      trialId: (params && params.trialId) || 'trial-' + trialIndex,
+      plugin: plugin
+    });
+  }
+
+  on_finish(_params) {
+    if (this.api && this._monitoring) {
+      this._monitoring = false;
+      this.api.endTrial();
+    }
+    return {};
+  }
+
+  // Called manually from the experiment's on_finish, AFTER the other three
+  // extensions (see header). Serializes, autosaves, attaches the meta
+  // pointer. Never throws — the experiment's save path must always run.
+  async finalize() {
+    if (!this.api) return;
+    try {
+      try { this.api.stopSession('finished'); } catch (e) { /* already stopped */ }
+      if (!this._chMonitor) this._stashChMonitor();
+      var chReport = null;
+      try {
+        chReport = this._chMonitor ? this._chMonitor.getSessionReport() : null;
+      } catch (e) {
+        console.warn('[cyborg-hunter-replay] could not pull CH session report:', e);
+      }
+      var result = await this.api.autoSaveNow({ chSessionReport: chReport });
+      this._lastRecording = result.recording;
+      this.jsPsych.data.addProperties({ integrityReplayMeta: result.meta });
+    } catch (e) {
+      console.warn('[cyborg-hunter-replay] finalize failed:', e);
+      try {
+        this.jsPsych.data.addProperties({
+          replayFinalizeError: String(e && e.message ? e.message : e)
+        });
+      } catch (_) { /* nothing left to do */ }
+    }
+    try { this.api.destroy(); } catch (e) { /* teardown best-effort */ }
+    // Null the handle so a second finalize() (e.g. duplicated on_finish
+    // wiring) is a clean no-op instead of re-serializing and re-saving.
+    this.api = null;
+  }
+
+  // Debug/test access to the finalized recording (also handy in the console
+  // during piloting: jsPsych.extensions['cyborg-hunter-replay'].getLastRecording()).
+  getLastRecording() {
+    return this._lastRecording;
+  }
+}
+
+export { CyborgHunterReplayExtension };
+if (typeof window !== 'undefined') {
+  window.jsPsychCyborgHunterReplay = CyborgHunterReplayExtension;
+}

package/src/jspsych/extension-cyborg-hunter.js

@@ -10,7 +10,7 @@ class CyborgHunterExtension {
     // and package.json). Hand-bumped on each release; if you forget, the
     // jsPsych developer console shows a stale number — the actual version
     // attached to data is read from window.CyborgHunter.VERSION at runtime.
-    version: '0.3.0',
+    version: '0.7.2',
     data: { integrity: { type: 'object' } }
   };
 
@@ -71,7 +71,10 @@ class CyborgHunterExtension {
     this.monitor.startTrial({
       trialId: (params && params.trialId) || `trial-${trialIndex}`,
       phase: params?.phase || null,
-      decoyAnswer: params?.decoyAnswer || null,
+      // Nullish coalescing (not ||) so an explicit `decoyAnswer: false` — the
+      // per-trial "skip the decoy" opt-out — reaches the core as false. With
+      // `|| null` it became null, and the core auto-generated a decoy instead.
+      decoyAnswer: params?.decoyAnswer ?? null,
       experimentContainer: params?.experimentContainer || null
     });
   }
@@ -154,6 +157,10 @@ class CyborgHunterExtension {
           sidebarEvents, keyboardShortcuts, windowPositions,
           layoutShifts, zoomChanges, idleGaps, extensionInjections,
           tabAwaySums, charsPerSec, aiExtensionsFound,
+          // Persist the effective runtime settings (preset + thresholds the CLI
+          // consumes) so the report can interpret this participant with the
+          // thresholds the library actually used, not analyst-side defaults.
+          config,
           ...extras
         },
         integrityScore: { hardScore, softScore, anyHardTriggered, trialsCompleted, softScoreThreshold },