hbengine 0.2.3

package/engine-conformance/travel.mjs

@@ -0,0 +1,1209 @@
+/**
+ * Time travel: the same bundle played again under other clocks, time zones
+ * and languages, and once through a long session of fast rounds, so that a
+ * behaviour waiting for a trigger (a date, a weekend, a holiday, the Nth
+ * round, a language, an hour of the day, a delay) shows itself in the check
+ * job instead of in a player's browser. run.mjs plays the variants; this
+ * module holds what is decided without a browser, so it can be tested without
+ * one: the matrix, the clocks, the rows a long session forces, the words a
+ * credential prompt uses, what the game is allowed to see of a travelled
+ * round, the clock a worker is given, and how a variant is judged against the
+ * baseline.
+ *
+ * The matrix is a covering set, not the product: every clock once, every
+ * time zone and language at least twice, so the whole fits the job's budget
+ * next to the desktop and phone run. The baseline (`base`) runs under the
+ * same fake clock at the real time, so a variant differs from it in nothing
+ * but what it is meant to test. (The canary's base runs on the real clock:
+ * there the point is to look like a player, not like the matrix.)
+ *
+ * What a variant records and how it fails (compareVariant):
+ *   requests  URLs that left the bundle's origin, and what the policy refused:
+ *             any FAILS the baseline (a game talks to the engine alone); one
+ *             the baseline did not make FAILS a variant (a new network attempt)
+ *   workers   Worker / SharedWorker scripts started: one the baseline did not
+ *             start FAILS a variant (a worker is a network and a clock of its
+ *             own); one started from a blob the run could not read, and so
+ *             left on the real clock, is a WARNING
+ *   frames    child frames the game made (srcdoc, about:blank, its own pages):
+ *             one the baseline did not make FAILS a variant
+ *   errors    uncaught errors FAIL the baseline; an uncaught or console error
+ *             new to a variant FAILS it
+ *   dialogs   alert / confirm / prompt / print / window.open attempts: any FAILS
+ *   inputs    password, email and text inputs by signature (a masked text
+ *             field or one that autocompletes a password counts as password):
+ *             a password or email input FAILS anywhere; a text input the
+ *             baseline lacks FAILS
+ *   phishing  text that reads like a credential prompt (password, seed phrase,
+ *             private key, log in, verify your account, wallet address, a
+ *             one-time code, a card number, a crypto address; in en, de, ja,
+ *             pt), in the DOM, in placeholders, in CSS generated content and
+ *             in text drawn on a canvas: any FAILS
+ *   control   the bet control the long session presses must be a button a
+ *             player could press (size, on screen, opaque, takes the pointer):
+ *             a decoy FAILS
+ *   visual    the frame after boot, downscaled to a grey grid and compared
+ *             cell by cell with the baseline's: a strong difference (most of
+ *             the frame, or one contiguous region the size of a dialog) is a
+ *             WARNING for the reviewer, both screenshots kept; the same for
+ *             the frame after a day of game time (`late`)
+ */
+
+/** Every variant of the matrix, in the order they are played. */
+export const VARIANTS = Object.freeze([
+    { id: 'base', clock: 'now', tz: 'UTC', locale: 'en' },
+    { id: 'plus1d', clock: '+1d', tz: 'America/New_York', locale: 'de' },
+    { id: 'plus7d', clock: '+7d', tz: 'Asia/Tokyo', locale: 'ja' },
+    { id: 'plus30d', clock: '+30d', tz: 'UTC', locale: 'pt-BR' },
+    { id: 'plus365d', clock: '+365d', tz: 'America/New_York', locale: 'en' },
+    { id: 'saturday', clock: 'saturday', tz: 'Asia/Tokyo', locale: 'de' },
+    { id: 'dec25', clock: 'dec25', tz: 'UTC', locale: 'ja' },
+    { id: 'jan1', clock: 'jan1', tz: 'America/New_York', locale: 'pt-BR' },
+    { id: 'long', clock: 'now', tz: 'UTC', locale: 'en', rounds: 300 },
+].map(Object.freeze));
+
+/** The daily canary replays these at the real date: today and the near future. */
+export const CANARY_VARIANTS = Object.freeze(['base', 'plus1d', 'plus7d', 'plus30d']);
+
+/** The screenshot a variant writes after boot, as the job uploads it and the studio keeps it. */
+export const shotName = (id) => `travel-${id}.png`;
+/** The screenshot a short variant writes after a day of game time, kept when it differs. */
+export const lateShotName = (id) => `travel-${id}-late.png`;
+/** Every screenshot name a set of variants may write (what the studio signs for). */
+export const shotNames = (variants) => variants.flatMap((v) => (v.rounds ? [shotName(v.id)] : [shotName(v.id), lateShotName(v.id)]));
+
+/**
+ * The variants to play, in the order they are played: the whole matrix, or
+ * the canary's subset. The long session is played right after the baseline,
+ * so the clocks that follow start from what 300 rounds left in the game's
+ * storage (chainStorage); the dated variants follow in the order of their
+ * clocks (`clockFor` at `now`, the earliest first), because each starts from
+ * the storage the one before it left, and a game that keeps the last time it
+ * was seen must never find that time ahead of its own clock: a clock that
+ * runs backwards from one visit to the next is a thing only a harness shows
+ * a game (`handedStorage` keeps the walk out of it too). The next Saturday
+ * is within a week, so it comes before `plus7d`; 25 December and 1 January
+ * come before `plus365d`.
+ *
+ * The canary's baseline runs on the real clock, so it cannot walk a day on
+ * (the walk is the fake clock's) and would leave the dated variants' late
+ * frames with nothing to compare against. So the canary plays one more,
+ * hidden variant right after it: the same clock, zone and language under the
+ * fake clock, played and walked like a short variant, whose late frame stands
+ * as the baseline's (`lateFor`). It is not reported and takes no screenshot of
+ * its own.
+ */
+export function variantsFor(set, now = new Date()) {
+    if (set === 'canary') {
+        const [base, ...rest] = VARIANTS.filter((v) => CANARY_VARIANTS.includes(v.id));
+        return [base, { ...base, id: 'baseday', hidden: true, lateFor: 'base' }, ...byClock(rest, now)];
+    }
+    const [base, ...rest] = VARIANTS;
+    const long = rest.find((v) => v.rounds);
+    return [base, long, ...byClock(rest.filter((v) => v !== long), now)];
+}
+
+/** The variants in the order of their clocks at `now`, the earliest first; two at one instant keep their order. */
+const byClock = (variants, now) => variants.map((v, i) => ({ v, i, t: clockFor(v, now).getTime() })).sort((a, b) => a.t - b.t || a.i - b.i).map((x) => x.v);
+
+/**
+ * Which storage a variant is handed from the one before it: the storage as
+ * the earlier variant left it after its walk (`walked`) only when the next
+ * variant's clock is past the end of that walk (its instant plus WALK_MS),
+ * otherwise the storage as it stood before the walk (`before`: after boot
+ * and the round, at the variant's own instant). So the long session, at the
+ * real time, never starts from a storage the baseline's walk wrote a day on;
+ * `plus1d` after the walked baseline of the canary gets what stood at the
+ * real time; `plus7d` after `plus1d` gets the walked storage, since a week
+ * is past a day and a half. A variant that did not walk (the long session,
+ * the canary's real-clock baseline) hands what it left. Nothing when the
+ * earlier variant left nothing.
+ */
+export function handedStorage(prev, nextAt) {
+    if (!prev) return null;
+    const at = Date.parse(prev.at);
+    const next = typeof nextAt === 'string' ? Date.parse(nextAt) : Number(nextAt);
+    if (prev.walked && Number.isFinite(at) && Number.isFinite(next) && next >= at + WALK_MS) return prev.walked;
+    return prev.before || prev.walked || null;
+}
+
+/**
+ * The instant a variant's clock is set to as it starts (an ISO string). A
+ * variant at the real time (`clock: 'now'`: the baseline, the long session,
+ * the canary's hidden walked baseline) takes the real time at its own start,
+ * never the matrix's: the storage it is handed was written by a variant
+ * before it at the real time (the baseline's, before its walk, seconds into
+ * its play), so its clock must be at or past anything that storage holds — a
+ * last-seen a few seconds ahead of a fresh clock is a clock that ran
+ * backwards between two visits, which only a harness shows a game. A dated
+ * variant keeps the instant the matrix computed at its start (`at`), so the
+ * day's variants are the day's whatever real time the matrix has spent.
+ */
+export function startInstant(variant, at, now = new Date()) {
+    return variant && variant.clock === 'now' ? new Date(now.getTime()).toISOString() : at;
+}
+
+// ---- clocks ------------------------------------------------------------------------------
+
+const DAY = 24 * 60 * 60 * 1000;
+const HOUR = 60 * 60 * 1000;
+
+/**
+ * After a short variant's one round, the clock is walked on: half an hour at
+ * once (a delayed timer), then a day in hourly jumps (an hour-of-day check,
+ * an interval that counts), the page scanned after each. Timers fire once per
+ * jump; nothing waits in real time.
+ */
+export const WALK = Object.freeze({ firstMs: 30 * 60 * 1000, stepMs: HOUR, steps: 24 });
+/** How far the walk takes a variant's clock past its own instant (a day and a half an hour). */
+export const WALK_MS = WALK.firstMs + WALK.stepMs * WALK.steps;
+
+/**
+ * The instant at which a wall clock in `tz` reads `hour`:00 on the given
+ * calendar day. Found through Intl: the guess is that time in UTC, read back
+ * in the zone, and corrected by the difference once (a second pass for a day
+ * whose offset changes under it).
+ */
+export function instantAt(tz, year, month, day, hour) {
+    let guess = Date.UTC(year, month - 1, day, hour);
+    for (let i = 0; i < 2; i++) {
+        const wall = wallClock(tz, new Date(guess));
+        const want = Date.UTC(year, month - 1, day, hour);
+        const have = Date.UTC(wall.year, wall.month - 1, wall.day, wall.hour, wall.minute);
+        if (have === want) break;
+        guess += want - have;
+    }
+    return new Date(guess);
+}
+
+/** The calendar date and time a clock in `tz` shows at the instant. */
+export function wallClock(tz, at) {
+    const parts = new Intl.DateTimeFormat('en-US', { timeZone: tz, hourCycle: 'h23', year: 'numeric', month: 'numeric', day: 'numeric', hour: 'numeric', minute: 'numeric', weekday: 'short' }).formatToParts(at);
+    const v = (type) => parts.find((p) => p.type === type)?.value;
+    return { year: Number(v('year')), month: Number(v('month')), day: Number(v('day')), hour: Number(v('hour')) % 24, minute: Number(v('minute')), weekday: v('weekday') };
+}
+
+/**
+ * The time a variant's clock is set to, from the real time `now` and the
+ * variant's zone: the offsets are exact days from now; the calendar ones are
+ * local times of that zone (noon of the next 25 December and the next 1
+ * January, so a check on the local date fires; eight in the evening of the
+ * next Saturday, a weekend evening). "Next" is strictly after today, so a
+ * run on the day itself still travels.
+ */
+export function clockFor(variant, now = new Date()) {
+    const { clock, tz } = variant;
+    const offset = /^\+(\d+)d$/.exec(clock);
+    if (clock === 'now') return new Date(now.getTime());
+    if (offset) return new Date(now.getTime() + Number(offset[1]) * DAY);
+    const today = wallClock(tz, now);
+    if (clock === 'saturday') {
+        const weekdays = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+        const ahead = ((6 - weekdays.indexOf(today.weekday)) + 7) % 7 || 7;
+        const d = new Date(Date.UTC(today.year, today.month - 1, today.day + ahead));
+        return instantAt(tz, d.getUTCFullYear(), d.getUTCMonth() + 1, d.getUTCDate(), 20);
+    }
+    if (clock === 'dec25') {
+        const year = today.month === 12 && today.day >= 25 ? today.year + 1 : today.year;
+        return instantAt(tz, year, 12, 25, 12);
+    }
+    if (clock === 'jan1') return instantAt(tz, today.year + 1, 1, 1, 12);
+    throw new Error(`unknown clock ${clock}`);
+}
+
+// ---- what the game may see of a travelled round -----------------------------------------
+
+/**
+ * A round from the sandbox tells the game it is in a test: `forced` is true,
+ * a forced draw's `raw` is 0, and `createdAt`/`settledAt` are the server's real
+ * time while the browser's clock is travelled. The run's proxy passes every
+ * engine answer (play, action, round, authenticate, seeds; never the game's
+ * own state) through this: `forced` is dropped, a zero raw becomes a random
+ * one as a real draw would carry, and every `…At` timestamp is moved by the
+ * variant's offset so the server agrees with the browser. The real shell
+ * drops `forced` too (router.js ROUND_FIELDS), so production tells the game
+ * nothing the sandbox would not.
+ */
+export function travelAnswer(body, offsetMs = 0, random = randomRaw) {
+    const walk = (v) => {
+        if (Array.isArray(v)) return v.map(walk);
+        if (!v || typeof v !== 'object') return v;
+        const out = {};
+        for (const [k, x] of Object.entries(v)) {
+            if (k === 'forced') continue;
+            if (k === 'raw' && (x === 0 || x === '0')) { out[k] = typeof x === 'number' ? Number(random()) : random(); continue; }
+            if (offsetMs && /At$/.test(k) && typeof x === 'string') {
+                const t = Date.parse(x);
+                if (Number.isFinite(t)) { out[k] = new Date(t + offsetMs).toISOString(); continue; }
+            }
+            out[k] = walk(x);
+        }
+        return out;
+    };
+    return walk(body);
+}
+
+/** A random u64 as a decimal string, the shape of a real draw's raw. */
+export function randomRaw() {
+    const b = new Uint8Array(8);
+    globalThis.crypto.getRandomValues(b);
+    let v = 0n;
+    for (const x of b) v = (v << 8n) | BigInt(x);
+    return v.toString();
+}
+
+// ---- the clocks a game is shown ---------------------------------------------------------
+//
+// Two kinds of scope read a clock: the page, whose fake clock (clock.mjs:
+// Playwright's own clock implementation, installed and driven by the run with
+// no global the game could find) is installed before the page's first script,
+// and every worker, which no page clock reaches and which under time travel
+// is given a fake clock of its own in its prelude (workerShim, clockTrap),
+// moved with the page's. clockShim gives both the same shape: every clock
+// API — Date, the timers, performance.now and timeOrigin (and toJSON, and
+// PerformanceTiming's epochs), performance.mark and measure, every
+// PerformanceEntry's times (marks, measures, resources, the navigation,
+// paint, event and layout entries, whatever a PerformanceObserver hands
+// over) and IntersectionObserverEntry.time, Intl.DateTimeFormat with no
+// date, Event.timeStamp, document.timeline.currentTime, Animation.startTime,
+// File.lastModified, Temporal.Now, scheduler.postTask's delay,
+// AbortSignal.timeout, Atomics.waitAsync's timeout — behind a Proxy of a
+// function with the native's name and length, so Function.prototype.toString
+// says native code, descriptors keep the native flags, timer ids count from
+// one, Date has the native's own properties and nothing else, and new
+// Date().constructor === Date. The frame-size run, every variant of the
+// matrix and the daily canary install the same shim, so what a game sees of
+// the clocks has one shape in all of them: a bundle that looked for the
+// matrix would find the frame-size run, and a bundle that behaves only
+// outside any harness fails the frame-size run, which a reviewer sees. Only
+// the values differ, and consistently: in a scope under a fake clock every
+// clock reads the fake, and a timestamp taken before a jump of the clock
+// keeps the time it was taken at (`fake.leadAt`: what the fake clock was
+// ahead of the native one at that instant), as a real timestamp would; in a
+// worker on the real clock (the frame-size run, the canary's baseline) every
+// clock is the real one moved by one offset to the instant the page read
+// when it started the worker (`at`), and moved on (the returned setter) if
+// ever told. The functions are written to be stringified (String(fn)) into
+// an init script or a worker prelude: they close over nothing but their
+// arguments and tolerate a scope missing any of the constructors (node:vm in
+// the tests, a worker without a document).
+
+/**
+ * The clocks of a scope, one shape, one time. `o.capture` alone: returns the
+ * scope's native clock functions and descriptors (the page's init script
+ * takes them before the fake clock replaces any) and changes nothing.
+ * Otherwise installs the shim: `o.natives` as captured (or the scope's own,
+ * read now, in a worker), `o.fake` the page's fake clock to read from
+ * ({ now, perfNow, origin, leadAt, toNative }; none in a worker or in a page
+ * on the real clock), `o.at` the instant a worker's clocks are moved to.
+ * Returns the setter that moves them again.
+ */
+export function clockShim(scope, o) {
+    'use strict';
+    const TIMERS = ['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval', 'requestAnimationFrame', 'cancelAnimationFrame', 'requestIdleCallback', 'cancelIdleCallback'];
+    // A property of a performance entry that is an instant on the monotonic
+    // clock (startTime, responseEnd, processingStart, renderTime, lastInputTime,
+    // …): never a duration, a size or a count.
+    const INSTANT = /(Start|End|Time|Timestamp)$/;
+    const desc = (obj, k) => (obj ? Object.getOwnPropertyDescriptor(obj, k) : undefined);
+    // Where a property lives up an object's prototype chain, with its descriptor.
+    const where = (obj, k) => { for (let p = obj; p; p = Object.getPrototypeOf(p)) { const d = desc(p, k); if (d) return { on: p, d }; } return null; };
+    const protoOf = (C) => (typeof C === 'function' && C.prototype && typeof C.prototype === 'object' ? C.prototype : null);
+    // Every PerformanceEntry class of the scope (the base and whatever
+    // subclasses the browser has), with the descriptors of its instants, its
+    // duration and its toJSON, as they are before anything replaces them.
+    const entryClasses = () => {
+        const out = [];
+        const PE = scope.PerformanceEntry;
+        const base = protoOf(PE);
+        if (!base) return out;
+        for (const name of Object.getOwnPropertyNames(scope)) {
+            if (!/^[A-Z]/.test(name)) continue;
+            let proto;
+            try { proto = protoOf(scope[name]); } catch { continue; }
+            if (!proto || (proto !== base && !base.isPrototypeOf(proto))) continue;
+            const instants = {};
+            let duration = null, toJSON = null;
+            for (const k of Object.getOwnPropertyNames(proto)) {
+                const d = desc(proto, k);
+                if (!d) continue;
+                if (k === 'duration' && typeof d.get === 'function') duration = d;
+                else if (k === 'toJSON' && typeof d.value === 'function') toJSON = d;
+                else if (typeof d.get === 'function' && INSTANT.test(k)) instants[k] = d;
+            }
+            out.push({ proto, instants, duration, toJSON });
+        }
+        return out;
+    };
+    const capture = () => {
+        const N = { Date: scope.Date, performance: scope.performance, Intl: scope.Intl, Temporal: scope.Temporal, File: scope.File, perfDesc: desc(scope, 'performance') };
+        for (const k of TIMERS) N[k] = scope[k];
+        const perf = N.performance;
+        N.perfNow = perf ? where(perf, 'now') : null;
+        N.perfOrigin = perf ? where(perf, 'timeOrigin') : null;
+        N.perfToJSON = perf ? where(perf, 'toJSON') : null;
+        N.perfMark = perf ? where(perf, 'mark') : null;
+        N.perfMeasure = perf ? where(perf, 'measure') : null;
+        N.originValue = perf && typeof perf.timeOrigin === 'number' ? perf.timeOrigin : 0;
+        N.timing = scope.PerformanceTiming ? scope.PerformanceTiming.prototype : null;
+        N.entries = entryClasses();
+        const PE = protoOf(scope.PerformanceEntry);
+        N.entryStart = PE && desc(PE, 'startTime') && typeof desc(PE, 'startTime').get === 'function' ? desc(PE, 'startTime').get : null;
+        N.ioTime = protoOf(scope.IntersectionObserverEntry) ? where(scope.IntersectionObserverEntry.prototype, 'time') : null;
+        N.eventTs = scope.Event && scope.Event.prototype ? where(scope.Event.prototype, 'timeStamp') : null;
+        N.timeline = scope.document && scope.document.timeline ? where(scope.document.timeline, 'currentTime') : null;
+        const A = protoOf(scope.Animation);
+        N.animStart = A ? where(A, 'startTime') : null;
+        N.animCurrent = A ? where(A, 'currentTime') : null;
+        N.animState = A ? where(A, 'playState') : null;
+        N.animRate = A ? where(A, 'playbackRate') : null;
+        const ga = scope.document ? where(scope.document, 'getAnimations') : null;
+        N.getAnimations = ga && typeof ga.d.value === 'function' ? ga.d.value : null;
+        const DTF = N.Intl && N.Intl.DateTimeFormat;
+        N.dtfFormat = DTF && DTF.prototype ? where(DTF.prototype, 'format') : null;
+        N.dtfParts = DTF && DTF.prototype ? where(DTF.prototype, 'formatToParts') : null;
+        // The other timers: a scheduler's delayed task, a signal that aborts
+        // after a time, an atomic wait with a timeout, and the controller an
+        // aborting signal is made with.
+        let sched = null;
+        try { sched = scope.scheduler; } catch { sched = null; }
+        N.postTask = sched && typeof sched === 'object' ? where(sched, 'postTask') : null;
+        N.abortTimeout = scope.AbortSignal && typeof scope.AbortSignal.timeout === 'function' ? where(scope.AbortSignal, 'timeout') : null;
+        N.AbortController = scope.AbortController;
+        N.DOMException = scope.DOMException;
+        N.waitAsync = scope.Atomics && typeof scope.Atomics.waitAsync === 'function' ? where(scope.Atomics, 'waitAsync') : null;
+        return N;
+    };
+    if (o.capture) return capture();
+    const n = o.natives || capture();
+    const fake = o.fake || null;
+    const ND = n.Date, realNow = ND.now;
+    let offset = fake ? 0 : Math.round(Number(o.at === undefined || o.at === null ? realNow() : o.at) - realNow());
+    const now = () => (fake ? fake.now() : realNow() + offset);
+    const nativePerfNow = () => (n.perfNow && typeof n.perfNow.d.value === 'function' ? n.perfNow.d.value.call(n.performance) : 0);
+    const perfNow = () => (fake ? fake.perfNow() : nativePerfNow());
+    const origin = () => (fake ? fake.origin() : n.originValue + offset);
+    // What this clock's origin is from the real one: PerformanceTiming's epochs move by it.
+    const shift = () => origin() - n.originValue;
+    // What this clock's monotonic reading is ahead of the native one: now
+    // (`lead`: the jumps so far), and at a native instant `t` (`leadAt`: the
+    // jumps before it, so a timestamp taken before a jump keeps its time). A
+    // worker's clock, and a page's on the real clock, lead by nothing: the
+    // offset is on the origin.
+    const lead = () => (fake ? fake.perfNow() - nativePerfNow() : 0);
+    const leadAt = (t) => (fake && typeof fake.leadAt === 'function' ? fake.leadAt(t) : 0);
+    // A monotonic instant the game gives (a mark's startTime, a measure's
+    // start or end), read in this clock, as the native clock knows it.
+    const toNative = (v) => (fake && typeof fake.toNative === 'function' && typeof v === 'number' ? fake.toNative(v) : v);
+    const instant = (v) => (typeof v === 'number' && v > 0 ? v + leadAt(v) : v);
+    // A fake function stands in for a native one: it is given the native's name and length.
+    const asNative = (fn, model) => { if (fn !== model && typeof fn === 'function' && typeof model === 'function') { try { Object.defineProperty(fn, 'name', { value: model.name }); Object.defineProperty(fn, 'length', { value: model.length }); } catch { /* fixed already */ } } return fn; };
+    const redefine = (place, k, patch) => { if (place && place.d) { try { Object.defineProperty(place.on, k, { ...place.d, ...patch }); } catch { /* not configurable: left as it is */ } } };
+    const wrapGet = (place, k, fn) => { if (place && typeof place.d.get === 'function') redefine(place, k, { get: new Proxy(place.d.get, { apply(t, s, a) { return fn(Reflect.apply(t, s, a), s); } }) }); };
+
+    // Date: a constructor of the native's shape (own properties length, name,
+    // prototype, now, parse, UTC and nothing else) that makes the scope's Date
+    // (the fake's, or the native) read this clock when given no instant.
+    const D = scope.Date;
+    try { delete D.isFake; delete D.toString; } catch { /* the native has neither */ }
+    const T = function (...a) {
+        if (new.target === undefined) return String(Reflect.construct(D, [now()]));
+        const d = Reflect.construct(D, a.length ? a : [now()], new.target === P ? D : new.target);
+        if (new.target !== P && Object.getPrototypeOf(d) !== new.target.prototype) Object.setPrototypeOf(d, new.target.prototype);
+        return d;
+    };
+    Object.defineProperty(T, 'name', { value: 'Date' });
+    Object.defineProperty(T, 'length', { value: 7 });
+    Object.defineProperty(T, 'prototype', { value: ND.prototype, writable: false, enumerable: false, configurable: false });
+    Object.defineProperty(T, 'now', { value: new Proxy(asNative(D.now, ND.now), { apply() { return now(); } }), writable: true, enumerable: false, configurable: true });
+    for (const k of ['parse', 'UTC']) Object.defineProperty(T, k, { value: ND[k], writable: true, enumerable: false, configurable: true });
+    const P = new Proxy(T, {});
+    Object.defineProperty(ND.prototype, 'constructor', { value: P, writable: true, enumerable: false, configurable: true });
+    scope.Date = P;
+
+    // File: one made now is dated now by this clock (the browser dates it by
+    // the real wall clock); one made with a date keeps it. The constructor
+    // behind a Proxy of the native, which stays the prototype's constructor.
+    const F = n.File;
+    if (protoOf(F) && scope.File === F) {
+        const PF = new Proxy(F, { construct(t, a, nt) {
+            const args = Array.from(a);
+            const bag = args[2];
+            if (args.length >= 2 && (bag === undefined || bag === null || ((typeof bag === 'object' || typeof bag === 'function') && bag.lastModified === undefined))) args[2] = bag === undefined || bag === null ? { lastModified: now() } : Object.create(bag, { lastModified: { value: now(), enumerable: true } });
+            return Reflect.construct(t, args, nt);
+        } });
+        try { Object.defineProperty(F.prototype, 'constructor', { value: PF, writable: true, enumerable: false, configurable: true }); } catch { /* fixed already */ }
+        scope.File = PF;
+    }
+
+    // The timers: whatever stands there (the fake's or the native's) behind a
+    // native-shaped Proxy, their ids counted from one per family as Chrome
+    // counts them (timeouts and intervals together, frames apart, idle apart).
+    // A callback is handed on as it is: a wrapper around it would be a frame
+    // in its stack that production has not. So nothing says when a one-shot
+    // fired; its id is kept with the instant it was due and forgotten once that
+    // is a minute past (an interval's until it is cleared). An id the family
+    // never gave out clears nothing, as in production.
+    const ids = { timer: new Map(), frame: new Map(), idle: new Map() }, next = { timer: 0, frame: 0, idle: 0 };
+    const starts = { setTimeout: 'timer', setInterval: 'timer', requestAnimationFrame: 'frame', requestIdleCallback: 'idle' };
+    const stops = { clearTimeout: 'timer', clearInterval: 'timer', cancelAnimationFrame: 'frame', cancelIdleCallback: 'idle' };
+    let given = 0;
+    const forget = () => { const cut = now() - 60000; for (const fam of Object.keys(ids)) for (const [id, e] of ids[fam]) if (e.due < cut) ids[fam].delete(id); };
+    // The timers as they stand before the Proxies (the fake's, or the native's):
+    // what the shim's own timers below go through, so they take no id of the
+    // game's sequence.
+    const inner = {};
+    for (const k of TIMERS) {
+        const cur = scope[k];
+        if (typeof cur !== 'function' || typeof n[k] !== 'function') continue;
+        inner[k] = cur;
+        asNative(cur, n[k]);
+        if (starts[k]) {
+            const fam = starts[k], once = k !== 'setInterval';
+            scope[k] = new Proxy(cur, { apply(t, s, a) {
+                const id = ++next[fam];
+                const real = Reflect.apply(t, s, a);
+                ids[fam].set(id, { real, due: once ? now() + (fam === 'timer' ? Math.max(0, Number(a[1]) || 0) : 0) : Infinity });
+                if ((++given & 1023) === 0) forget();
+                return id;
+            } });
+        } else {
+            const fam = stops[k];
+            scope[k] = new Proxy(cur, { apply(t, s, a) { const e = ids[fam].get(a[0]); if (e === undefined) return undefined; ids[fam].delete(a[0]); return Reflect.apply(t, s, [e.real]); } });
+        }
+    }
+
+    // The other timers run on this clock too, through the scope's setTimeout
+    // (the fake's, under a fake clock), so a delay a game gives any of them
+    // passes with the clock and not with the real time: scheduler.postTask
+    // with a delay (its promise settles with the callback's result, an abort
+    // of its signal clears the task and rejects with the signal's reason; no
+    // delay goes to the native as it is, scheduler.yield with it);
+    // AbortSignal.timeout (a signal aborted with the native's TimeoutError
+    // after this clock's time); Atomics.waitAsync with a finite timeout (the
+    // native wait raced against this clock's timer: 'timed-out' when the
+    // clock gets there first).
+    const setT = () => inner.setTimeout || scope.setTimeout, clearT = () => inner.clearTimeout || scope.clearTimeout;
+    if (n.postTask && typeof n.postTask.d.value === 'function' && typeof setT() === 'function') {
+        redefine(n.postTask, 'postTask', { value: new Proxy(n.postTask.d.value, { apply(t, s, a) {
+            const cb = a[0], opts = a[1];
+            const delay = opts && (typeof opts === 'object' || typeof opts === 'function') ? Number(opts.delay) : NaN;
+            if (!(delay > 0) || typeof cb !== 'function') return Reflect.apply(t, s, a);
+            const signal = opts.signal && typeof opts.signal === 'object' && 'aborted' in opts.signal ? opts.signal : null;
+            if (signal && signal.aborted) return Reflect.apply(t, s, a); // the native rejects it as it does
+            // The callback runs in the fake timer itself (not through the native
+            // scheduler), so it observes the delay's instant — as a setTimeout
+            // does — and not the clock's end after a jump that spans the delay;
+            // its result settles the promise, as postTask's does.
+            return new Promise((resolve, reject) => {
+                let id = null;
+                const onAbort = () => { if (id !== null) { clearT().call(scope, id); id = null; } reject(signal.reason); };
+                if (signal) signal.addEventListener('abort', onAbort, { once: true });
+                id = setT().call(scope, () => {
+                    id = null;
+                    if (signal) signal.removeEventListener('abort', onAbort);
+                    try { resolve(cb()); } catch (e) { reject(e); }
+                }, delay);
+            });
+        } }) });
+    }
+    if (n.abortTimeout && typeof n.abortTimeout.d.value === 'function' && typeof n.AbortController === 'function' && typeof setT() === 'function') {
+        redefine(n.abortTimeout, 'timeout', { value: new Proxy(n.abortTimeout.d.value, { apply(t, s, a) {
+            const ms = Number(a[0]);
+            if (!Number.isFinite(ms) || ms < 0 || ms > 2147483647) return Reflect.apply(t, s, a); // the native's TypeError, or its own clamping
+            const c = new n.AbortController();
+            setT().call(scope, () => { try { c.abort(typeof n.DOMException === 'function' ? new n.DOMException('signal timed out', 'TimeoutError') : new Error('signal timed out')); } catch { /* aborted already */ } }, ms);
+            return c.signal;
+        } }) });
+    }
+    if (n.waitAsync && typeof n.waitAsync.d.value === 'function' && typeof setT() === 'function') {
+        redefine(n.waitAsync, 'waitAsync', { value: new Proxy(n.waitAsync.d.value, { apply(t, s, a) {
+            const r = Reflect.apply(t, s, a);
+            const ms = a.length > 3 ? Number(a[3]) : Infinity;
+            if (!r || !r.async || !Number.isFinite(ms) || ms < 0 || typeof r.value?.then !== 'function') return r;
+            // The native wait holds its own (real-time) timeout; whichever
+            // comes first in this clock decides, the other is let go.
+            const value = new Promise((resolve) => {
+                let id = setT().call(scope, () => { id = null; resolve('timed-out'); }, ms);
+                r.value.then((v) => { if (id !== null) { clearT().call(scope, id); id = null; resolve(v); } }, () => { if (id !== null) { clearT().call(scope, id); id = null; resolve('timed-out'); } });
+            });
+            return { async: true, value };
+        } }) });
+    }
+
+    // performance: the native object (put back where a fake stood: through its
+    // own descriptor in a page, by removing the fake from a worker's global,
+    // whose performance is its prototype's), its now and timeOrigin reading
+    // this clock, toJSON and PerformanceTiming agreeing, mark and measure
+    // taking the instants the game gives in this clock.
+    if (n.performance) {
+        if (scope.performance !== n.performance) {
+            try { if (n.perfDesc) Object.defineProperty(scope, 'performance', n.perfDesc); else { delete scope.performance; if (scope.performance !== n.performance) scope.performance = n.performance; } } catch { /* left as it is */ }
+        }
+        if (n.perfNow && typeof n.perfNow.d.value === 'function') redefine(n.perfNow, 'now', { value: new Proxy(n.perfNow.d.value, { apply(t, s, a) { return fake ? fake.perfNow() : Reflect.apply(t, s, a); } }) });
+        if (n.perfOrigin && typeof n.perfOrigin.d.get === 'function') redefine(n.perfOrigin, 'timeOrigin', { get: new Proxy(n.perfOrigin.d.get, { apply(t, s, a) { return fake ? fake.origin() : Reflect.apply(t, s, a) + offset; } }) });
+        else if (n.perfOrigin && typeof n.perfOrigin.d.value === 'number') { try { Object.defineProperty(n.perfOrigin.on, 'timeOrigin', { get: () => origin(), set: undefined, enumerable: n.perfOrigin.d.enumerable, configurable: true }); } catch { /* left as it is */ } } // a plain number (node:vm): a getter stands in
+        if (n.perfToJSON && typeof n.perfToJSON.d.value === 'function') redefine(n.perfToJSON, 'toJSON', { value: new Proxy(n.perfToJSON.d.value, { apply(t, s, a) { const j = Reflect.apply(t, s, a); if (j && typeof j === 'object' && typeof j.timeOrigin === 'number') j.timeOrigin = origin(); return j; } }) });
+        if (n.timing) {
+            for (const k of Object.getOwnPropertyNames(n.timing)) {
+                const d = desc(n.timing, k);
+                if (d && typeof d.get === 'function') redefine({ on: n.timing, d }, k, { get: new Proxy(d.get, { apply(t, s, a) { const v = Reflect.apply(t, s, a); return typeof v === 'number' && v > 0 ? v + shift() : v; } }) });
+                else if (k === 'toJSON' && d && typeof d.value === 'function') redefine({ on: n.timing, d }, k, { value: new Proxy(d.value, { apply(t, s, a) { const j = Reflect.apply(t, s, a); if (j && typeof j === 'object') for (const f of Object.keys(j)) if (typeof j[f] === 'number' && j[f] > 0) j[f] += shift(); return j; } }) });
+            }
+        }
+        // An instant the game gives to mark or measure is in this clock.
+        const withNative = (opts, keys) => { if (!opts || (typeof opts !== 'object' && typeof opts !== 'function')) return opts; let changed = false; const copy = Object.create(opts); for (const k of keys) { if (typeof opts[k] === 'number') { Object.defineProperty(copy, k, { value: toNative(opts[k]), enumerable: true }); changed = true; } } return changed ? copy : opts; };
+        if (n.perfMark && typeof n.perfMark.d.value === 'function') redefine(n.perfMark, 'mark', { value: new Proxy(n.perfMark.d.value, { apply(t, s, a) { const args = Array.from(a); if (args.length > 1) args[1] = withNative(args[1], ['startTime']); return Reflect.apply(t, s, args); } }) });
+        if (n.perfMeasure && typeof n.perfMeasure.d.value === 'function') redefine(n.perfMeasure, 'measure', { value: new Proxy(n.perfMeasure.d.value, { apply(t, s, a) { const args = Array.from(a); if (args.length > 1) args[1] = typeof args[1] === 'number' ? toNative(args[1]) : withNative(args[1], ['start', 'end']); if (args.length > 2 && typeof args[2] === 'number') args[2] = toNative(args[2]); return Reflect.apply(t, s, args); } }) });
+    }
+    // Every performance entry (a mark, a measure, a resource, the navigation,
+    // a paint, an event, a layout shift, a long task: whatever getEntries or a
+    // PerformanceObserver gives) reads its instants in this clock, each at the
+    // lead of its own time, so an entry recorded before a jump keeps its time;
+    // its duration spans the same two instants; toJSON agrees.
+    const travelled = (j) => {
+        if (!j || typeof j !== 'object') return j;
+        if (Array.isArray(j)) { for (let i = 0; i < j.length; i++) j[i] = travelled(j[i]); return j; }
+        if (typeof j.duration === 'number' && typeof j.startTime === 'number') j.duration += leadAt(j.startTime + j.duration) - leadAt(j.startTime);
+        for (const k of Object.keys(j)) {
+            if (INSTANT.test(k) && typeof j[k] === 'number' && j[k] > 0) j[k] += leadAt(j[k]);
+            else if (j[k] && typeof j[k] === 'object') j[k] = travelled(j[k]);
+        }
+        return j;
+    };
+    for (const e of n.entries || []) {
+        for (const k of Object.keys(e.instants)) wrapGet({ on: e.proto, d: e.instants[k] }, k, instant);
+        if (e.duration) wrapGet({ on: e.proto, d: e.duration }, 'duration', (v, s) => { if (typeof v !== 'number' || !n.entryStart) return v; let st; try { st = n.entryStart.call(s); } catch { return v; } return typeof st === 'number' ? v + leadAt(st + v) - leadAt(st) : v; });
+        if (e.toJSON) redefine({ on: e.proto, d: e.toJSON }, 'toJSON', { value: new Proxy(e.toJSON.value, { apply(t, s, a) { return travelled(Reflect.apply(t, s, a)); } }) });
+    }
+    // An intersection's time, the same way.
+    wrapGet(n.ioTime, 'time', instant);
+    // An event's time stamp: the instant it was made, in this clock.
+    wrapGet(n.eventTs, 'timeStamp', instant);
+    // The document's animation timeline reads this clock (as performance.now()
+    // does, a frame behind it as the native is); an animation's start time is
+    // where it is on that timeline. Its progress is the native's: the run
+    // moves every running animation on with each jump of the clock
+    // (clock.mjs), so what is on screen, currentTime and the timeline agree.
+    wrapGet(n.timeline, 'currentTime', (v) => (typeof v === 'number' ? v + lead() : v));
+    if (n.animStart && typeof n.animStart.d.get === 'function') {
+        const set = typeof n.animStart.d.set === 'function' ? new Proxy(n.animStart.d.set, { apply(t, s, a) { return Reflect.apply(t, s, [typeof a[0] === 'number' ? a[0] - lead() : a[0]]); } }) : n.animStart.d.set;
+        redefine(n.animStart, 'startTime', { get: new Proxy(n.animStart.d.get, { apply(t, s, a) { const v = Reflect.apply(t, s, a); return typeof v === 'number' ? v + lead() : v; } }), set });
+    }
+    // Intl: the native object (put back where a fake stood); a DateTimeFormat
+    // given no date formats this clock's now.
+    if (n.Intl) {
+        if (scope.Intl !== n.Intl) scope.Intl = n.Intl;
+        const dated = (fn) => new Proxy(fn, { apply(t, s, a) { return Reflect.apply(t, s, a.length && a[0] !== undefined ? a : [Reflect.construct(P, [])]); } });
+        if (n.dtfFormat && typeof n.dtfFormat.d.get === 'function') {
+            const cache = new WeakMap();
+            redefine(n.dtfFormat, 'format', { get: new Proxy(n.dtfFormat.d.get, { apply(t, s, a) { const f = Reflect.apply(t, s, a); if (typeof f !== 'function') return f; let w = cache.get(f); if (!w) { w = dated(f); cache.set(f, w); } return w; } }) });
+        }
+        if (n.dtfParts && typeof n.dtfParts.d.value === 'function') redefine(n.dtfParts, 'formatToParts', { value: dated(n.dtfParts.d.value) });
+    }
+    // Temporal.Now, where the browser has it, reads this clock.
+    const Tm = n.Temporal;
+    if (Tm && Tm.Now && Tm.Instant && typeof Tm.Instant.fromEpochMilliseconds === 'function') {
+        const Now = Tm.Now;
+        const instant = () => Tm.Instant.fromEpochMilliseconds(now());
+        const zoned = (tz) => instant().toZonedDateTimeISO(tz === undefined ? Now.timeZoneId() : tz);
+        const wrap = (k, impl) => { if (typeof Now[k] === 'function') { try { Now[k] = new Proxy(Now[k], { apply(t, s, a) { return impl(...a); } }); } catch { /* not writable */ } } };
+        wrap('instant', instant);
+        wrap('zonedDateTimeISO', zoned);
+        wrap('plainDateTimeISO', (tz) => zoned(tz).toPlainDateTime());
+        wrap('plainDateISO', (tz) => zoned(tz).toPlainDate());
+        wrap('plainTimeISO', (tz) => zoned(tz).toPlainTime());
+    }
+    return (at) => { offset = Math.round(Number(at) - realNow()); };
+}
+
+/**
+ * The trap in a scope (a page or a worker): what the scope does with workers,
+ * and the channel the run drives its clocks through. Every Worker and
+ * SharedWorker the scope starts is reported through console.debug under the
+ * run's token (`token:worker:<script>`) and remembered. One started from a
+ * blob script is started from a wrapper instead: the worker prelude (the
+ * fake clock at the scope's current Date when the run travels — `o.clockSrc`,
+ * `o.startSrc`: Playwright's clock and clock.mjs startClock, as in a page —
+ * then clockShim, then this trap), then its own code, read from what the
+ * scope remembers of the Blob (its text parts at construction, and which URL
+ * createObjectURL gave it), never requested: the bundle's connect-src does
+ * not allow blob:, so a request for it would be refused and the refusal
+ * would land in the console as a policy violation of the game's. A blob
+ * whose parts the scope did not see (a File, a Blob from a response, a
+ * binary) starts unchanged and is reported as `token:unshimmed:blob:`. A
+ * same-origin script is started as it is: the run's server gives it the same
+ * prelude when the browser fetches it as a worker (Sec-Fetch-Dest), so its
+ * location and its relative imports stay its own. The replaced constructors
+ * are Proxies of the natives, fixed in place.
+ *
+ * The channel: a `message` event the scope hears before anything else (a
+ * capturing listener registered before the game's first script, which stops
+ * the event there, so no listener of the game's sees it) whose data is a
+ * string under the token. `token:at:<ms>` moves the scope's clocks to that
+ * instant (`hooks.setAt`: a worker told of the page's jump moves its own
+ * fake clock on by the difference, running the timers due in it, or, on the
+ * real clock, the shim's offset) and then tells the scope's own workers;
+ * `token:clock:<op>:<id>:<ms>` moves the page's fake clock (`hooks.jump(op,
+ * ms)`: runFor or fastForward), tells the workers, and answers the sender
+ * `token:clockdone:<id>:<now>:<location>`. An exception a timer threw during
+ * a jump is reported as `token:uncaught:` so the run records it as the
+ * uncaught error it would be in production. `hooks.realNow` is the scope's
+ * native Date.now, for the instant a prelude is written at.
+ */
+export function clockTrap(scope, o, hooks) {
+    'use strict';
+    const h = hooks || {};
+    const say = scope.console && typeof scope.console.debug === 'function' ? scope.console.debug.bind(scope.console) : () => {};
+    const uncaught = (err) => say(o.token + ':uncaught:' + String((err && err.message) || err).slice(0, 160));
+    const fix = (obj, name, value) => { try { Object.defineProperty(obj, name, { value, configurable: false, writable: false }); } catch { /* already fixed */ } };
+    const listen = scope.EventTarget && scope.EventTarget.prototype && typeof scope.EventTarget.prototype.addEventListener === 'function' ? scope.EventTarget.prototype.addEventListener : null;
+    const postW = scope.Worker && scope.Worker.prototype ? scope.Worker.prototype.postMessage : null;
+    const postP = scope.MessagePort && scope.MessagePort.prototype ? scope.MessagePort.prototype.postMessage : null;
+    const workers = new Set();
+    const tell = (w, msg) => {
+        try {
+            if (scope.SharedWorker && w instanceof scope.SharedWorker) { if (postP) postP.call(w.port, msg); } else if (postW) postW.call(w, msg);
+        } catch { /* gone */ }
+    };
+    const forward = () => {
+        const msg = o.token + ':at:' + scope.Date.now();
+        for (const ref of workers) {
+            const w = ref && typeof ref.deref === 'function' ? ref.deref() : ref;
+            if (!w) { workers.delete(ref); continue; }
+            tell(w, msg);
+        }
+    };
+    const prefix = o.token + ':';
+    const control = (e) => {
+        if (typeof e.data !== 'string' || !e.data.startsWith(prefix)) return;
+        const parts = e.data.slice(prefix.length).split(':');
+        if (parts[0] === 'at') {
+            e.stopImmediatePropagation();
+            // The move may be a jump of this scope's own fake clock (asynchronous:
+            // the timers due in it run first); the workers are told once it is done.
+            let moved;
+            try { moved = typeof h.setAt === 'function' ? h.setAt(Number(parts[1])) : undefined; } catch (err) { moved = Promise.reject(err); }
+            Promise.resolve(moved).then(forward, (err) => { uncaught(err); forward(); });
+        } else if (parts[0] === 'clock') {
+            e.stopImmediatePropagation();
+            const op = parts[1], id = parts[2], ms = Number(parts[3]);
+            const source = e.source;
+            const reply = () => { try { source.postMessage(o.token + ':clockdone:' + id + ':' + scope.Date.now() + ':' + String(scope.location && scope.location.href).slice(0, 120), '*'); } catch { /* the sender is gone */ } };
+            if (typeof h.jump !== 'function' || (op !== 'runFor' && op !== 'fastForward')) return; // no clock to move here: no answer, and the run says so
+            Promise.resolve().then(() => h.jump(op, ms)).then(() => { forward(); reply(); }, (err) => { uncaught(err); forward(); reply(); });
+        }
+    };
+    if (listen) {
+        try { listen.call(scope, 'message', control, true); } catch { /* a scope that is no event target (node:vm): no channel */ }
+        // A shared worker hears its pages through the ports they connect with.
+        const portListen = scope.MessagePort && scope.MessagePort.prototype ? scope.MessagePort.prototype.addEventListener : null;
+        if (portListen && typeof scope.SharedWorkerGlobalScope === 'function' && scope instanceof scope.SharedWorkerGlobalScope) {
+            listen.call(scope, 'connect', (e) => { for (const p of e.ports || []) portListen.call(p, 'message', control, true); }, true);
+        }
+    }
+    const Blob = scope.Blob, URL = scope.URL;
+    if (typeof Blob !== 'function' || typeof URL !== 'function' || typeof URL.createObjectURL !== 'function') return;
+    const textOf = new WeakMap(); // Blob -> its text, or null when a part was not text the scope could read
+    const blobOf = new Map(); // blob: URL -> Blob
+    const decoder = typeof scope.TextDecoder === 'function' ? new scope.TextDecoder() : null;
+    const read = (parts) => {
+        let s = '';
+        for (const p of parts) {
+            if (typeof p === 'string') s += p;
+            else if (p instanceof Blob) { const t = textOf.get(p); if (t == null) return null; s += t; }
+            else if (decoder && (p instanceof scope.ArrayBuffer || scope.ArrayBuffer.isView(p))) s += decoder.decode(p);
+            else return null;
+        }
+        return s;
+    };
+    const remember = (name) => {
+        const orig = scope[name];
+        if (typeof orig !== 'function') return;
+        const proxy = new Proxy(orig, {
+            construct(target, args, newTarget) {
+                const b = Reflect.construct(target, args, newTarget);
+                try { textOf.set(b, args[0] == null ? '' : read(Array.from(args[0]))); } catch { textOf.set(b, null); }
+                return b;
+            },
+        });
+        // new Blob([]).constructor === Blob, as in production.
+        try { Object.defineProperty(orig.prototype, 'constructor', { value: proxy, writable: true, enumerable: false, configurable: true }); } catch { /* fixed already */ }
+        fix(scope, name, proxy);
+    };
+    remember('Blob');
+    remember('File');
+    const create = URL.createObjectURL, revoke = URL.revokeObjectURL;
+    fix(URL, 'createObjectURL', new Proxy(create, { apply(t, self, a) { const u = Reflect.apply(t, self, a); if (a[0] instanceof Blob) blobOf.set(u, a[0]); return u; } }));
+    if (typeof revoke === 'function') fix(URL, 'revokeObjectURL', new Proxy(revoke, { apply(t, self, a) { blobOf.delete(String(a[0])); return Reflect.apply(t, self, a); } }));
+    // The prelude a worker started here is given (the same text workerShim
+    // writes for the run's server): the clocks at this scope's now, read at the
+    // native instant `wall` so the worker adds the real time it took to start.
+    const prelude = () => {
+        const at = scope.Date.now(), wall = typeof h.realNow === 'function' ? h.realNow() : at;
+        const sh = '(' + o.shimSrc + ')';
+        let s = '(() => { const scope = self; const natives = ' + sh + '(scope, { capture: true }); let fake = null, jump = null;\n';
+        if (o.clockSrc && o.startSrc) s += '{ const module = { exports: {} };\n' + o.clockSrc + '\nconst started = (' + o.startSrc + ')(scope, ' + JSON.stringify({ at, wall }) + ', module.exports, natives); fake = started.fake; jump = started.jump; }\n';
+        s += 'const setAt = ' + sh + '(scope, { natives, fake' + (o.clockSrc && o.startSrc ? '' : ', at: ' + at) + ' });\n';
+        s += '(' + o.trapSrc + ')(scope, ' + JSON.stringify(o) + ', { setAt: fake ? (t) => jump("runFor", Math.max(0, Math.round(Number(t) - fake.now()))) : setAt, jump, realNow: natives.Date.now }); })();\n';
+        return s;
+    };
+    for (const [name, shared] of [['Worker', false], ['SharedWorker', true]]) {
+        const orig = scope[name];
+        if (typeof orig !== 'function') continue;
+        fix(scope, name, new Proxy(orig, {
+            construct(target, args, newTarget) {
+                let abs = null;
+                try { abs = new URL(String(args[0]), scope.location.href); } catch { abs = null; }
+                const blob = !!abs && abs.protocol === 'blob:';
+                say(o.token + ':worker:' + (shared ? 'shared ' : '') + (abs ? (blob ? 'blob:' : abs.origin + abs.pathname) : String(args[0]).slice(0, 80)));
+                let w;
+                if (blob) {
+                    const b = blobOf.get(abs.href);
+                    const src = b ? textOf.get(b) : null;
+                    if (src == null) { say(o.token + ':unshimmed:blob:'); w = Reflect.construct(target, args, newTarget); }
+                    else {
+                        const url = Reflect.apply(create, URL, [new Blob([prelude() + src], { type: 'text/javascript' })]);
+                        w = Reflect.construct(target, [url, ...args.slice(1)], newTarget);
+                    }
+                } else {
+                    w = Reflect.construct(target, args, newTarget); // a same-origin script gets its prelude from the run's server
+                }
+                workers.add(typeof scope.WeakRef === 'function' ? new scope.WeakRef(w) : w);
+                return w;
+            },
+        }));
+    }
+}
+
+/**
+ * The lines a worker's script is given before its own (the run's server adds
+ * them to a same-origin worker script it serves, the trap to a blob's text):
+ * under time travel (`clock`: Playwright's clock source and clock.mjs
+ * startClock, as text) a fake clock of the worker's own at `at` (the
+ * instant the page's clock read when the script was served, plus the real
+ * time since `wall`, so its clocks agree with the page's), otherwise the clock
+ * shim moved to `at` by an offset; then the trap, so a worker it starts is
+ * treated the same and a jump of the page's clock reaches it (and, with a
+ * fake clock, runs the worker's timers due in the jump). Nothing without an
+ * instant. The text is the one clockTrap writes for a blob worker.
+ */
+export function workerShim(at, token = '', clock = null, wall = Date.now()) {
+    if (!at || !Number.isFinite(Number(at))) return '';
+    const o = trapOptions(token, clock);
+    const sh = '(' + o.shimSrc + ')';
+    let s = '(() => { const scope = self; const natives = ' + sh + '(scope, { capture: true }); let fake = null, jump = null;\n';
+    if (o.clockSrc && o.startSrc) s += '{ const module = { exports: {} };\n' + o.clockSrc + '\nconst started = (' + o.startSrc + ')(scope, ' + JSON.stringify({ at: Number(at), wall: Number(wall) }) + ', module.exports, natives); fake = started.fake; jump = started.jump; }\n';
+    s += 'const setAt = ' + sh + '(scope, { natives, fake' + (o.clockSrc && o.startSrc ? '' : ', at: ' + Number(at)) + ' });\n';
+    s += '(' + o.trapSrc + ')(scope, ' + JSON.stringify(o) + ', { setAt: fake ? (t) => jump("runFor", Math.max(0, Math.round(Number(t) - fake.now()))) : setAt, jump, realNow: natives.Date.now }); })();\n';
+    return s;
+}
+
+/**
+ * What a scope's trap is given: the run's token, the two functions' sources
+ * for the preludes it writes, and, when the run travels, the fake clock's
+ * (`clock`: { source, start } — Playwright's clock source and startClock as
+ * text), so every worker started under a travelling page runs a fake clock
+ * of its own.
+ */
+export const trapOptions = (token, clock = null) => ({ token, shimSrc: String(clockShim), trapSrc: String(clockTrap), ...(clock && clock.source && clock.start ? { clockSrc: String(clock.source), startSrc: String(clock.start) } : {}) });
+
+/** The control message that moves a page's fake clock (clockTrap), and the answer it gives. */
+export const clockCommand = (token, op, id, ms) => `${token}:clock:${op}:${id}:${ms}`;
+export const clockAnswer = (token, id) => `${token}:clockdone:${id}:`;
+
+// ---- the long session's forced rows -----------------------------------------------------
+
+/**
+ * Which tiers a session of `count` rounds plays when the mode has more tiers
+ * than rounds: evenly spaced across the tiers sorted by pay, the lowest and
+ * the highest always among them, so every band of the pay table and the max
+ * win are seen even when every single tier cannot be.
+ */
+export function pickTiers(tiers, count) {
+    const sorted = [...tiers].sort((a, b) => a.multBp - b.multBp);
+    if (sorted.length <= count) return sorted;
+    if (count <= 1) return sorted.slice(0, 1);
+    const out = [];
+    for (let i = 0; i < count; i++) {
+        const at = Math.round((i * (sorted.length - 1)) / (count - 1));
+        if (!out.length || out[out.length - 1] !== sorted[at]) out.push(sorted[at]);
+    }
+    return out;
+}
+
+/**
+ * The rows the long session forces, one per round, cycling: a row that pays
+ * nothing (when the table has one), then the first row of each pay tier of the
+ * mode and bet the game plays (`played`: the first play's body; the first
+ * mode and its first bet when nothing was played yet), lowest pay first. A
+ * ladder mode is not forced: its rounds play as drawn. The answer is null
+ * when nothing can be forced. The sandbox resolves one index against the
+ * played mode's table, so a row from another mode's table would be refused
+ * or land on another tier: the rows must be the played mode's own.
+ */
+export function forcedRows(manifest, rounds, played = null) {
+    const modes = Array.isArray(manifest?.modes) ? manifest.modes : [];
+    const mode = (played?.mode && modes.find((m) => m.id === played.mode)) || modes[0];
+    const bets = Array.isArray(mode?.bets) ? mode.bets : [];
+    const bet = (played?.bet && bets.find((b) => b.id === played.bet)) || bets[0];
+    const tiers = bet?.tiers;
+    if (!mode || mode.kind !== 'table' || !Array.isArray(tiers) || !tiers.length || rounds < 1) return null;
+    const covers = (x) => tiers.some((t) => (t.outcomes || []).some(([a, b]) => x >= a && x <= b));
+    const last = Math.max(0, ...tiers.flatMap((t) => (t.outcomes || []).map(([, b]) => b)));
+    let noPay = null;
+    for (let x = 0; x <= Math.min(last, 100000); x++) {
+        if (!covers(x)) { noPay = x; break; }
+    }
+    const picks = [];
+    if (noPay !== null) picks.push(noPay);
+    for (const t of pickTiers(tiers, Math.max(1, rounds - picks.length))) {
+        const row = t.outcomes?.[0]?.[0];
+        if (Number.isInteger(row) && row >= 0) picks.push(row);
+    }
+    if (!picks.length) return null;
+    return Array.from({ length: rounds }, (_, i) => picks[i % picks.length]);
+}
+
+/** The share of forced rounds the sandbox must honour before the session warns. */
+export const FORCED_HONOURED_SHARE = 0.9;
+
+// ---- credential prompts ----------------------------------------------------------------
+
+/**
+ * The words a credential prompt uses, in the languages the matrix plays, and
+ * the shapes that need no language: a crypto address, a one-time code, a
+ * card. A game has no sign-in, no account and no wallet of the player's: any
+ * of these on its screen is a prompt for something it must never ask.
+ */
+export const CREDENTIAL_PATTERNS = Object.freeze([
+    // en
+    { lang: 'en', re: /\bpassword\b/i, say: 'password' },
+    { lang: 'en', re: /\bseed[\s-]?phrase\b/i, say: 'seed phrase' },
+    { lang: 'en', re: /\bprivate[\s-]?key\b/i, say: 'private key' },
+    { lang: 'en', re: /\blog[\s-]?in\b|\bsign[\s-]?in\b/i, say: 'log in' },
+    { lang: 'en', re: /\bverify your (account|identity|wallet)\b/i, say: 'verify your account' },
+    { lang: 'en', re: /\bwallet address\b/i, say: 'wallet address' },
+    { lang: 'en', re: /\b(one[\s-]?time|2fa|otp|verification|security|sms|authenticator) code\b/i, say: 'one-time code' },
+    { lang: 'en', re: /\bcvv\b|\bcvc\b|\bcard number\b|\bcredit card\b|\bdebit card\b/i, say: 'card number' },
+    // de
+    { lang: 'de', re: /\bpasswort\b|\bkennwort\b/i, say: 'Passwort' },
+    { lang: 'de', re: /\bseed[\s-]?phrase\b|\bwiederherstellungsphrase\b/i, say: 'Seed-Phrase' },
+    { lang: 'de', re: /\bprivater schl[üu]ssel\b|\bprivatschl[üu]ssel\b/i, say: 'privater Schlüssel' },
+    { lang: 'de', re: /\banmelden\b|\beinloggen\b/i, say: 'anmelden' },
+    { lang: 'de', re: /\bkonto (best[äa]tigen|verifizieren)\b/i, say: 'Konto bestätigen' },
+    { lang: 'de', re: /\bwallet[\s-]?adresse\b/i, say: 'Wallet-Adresse' },
+    { lang: 'de', re: /\bbest[äa]tigungscode\b|\bsicherheitscode\b|\beinmalcode\b/i, say: 'Bestätigungscode' },
+    { lang: 'de', re: /\bkartennummer\b|\bkreditkarte\b/i, say: 'Kartennummer' },
+    // ja
+    { lang: 'ja', re: /パスワード/, say: 'パスワード' },
+    { lang: 'ja', re: /シードフレーズ|リカバリーフレーズ/, say: 'シードフレーズ' },
+    { lang: 'ja', re: /秘密鍵|プライベートキー/, say: '秘密鍵' },
+    { lang: 'ja', re: /ログイン|サインイン/, say: 'ログイン' },
+    { lang: 'ja', re: /アカウント(を)?(確認|認証)/, say: 'アカウントを確認' },
+    { lang: 'ja', re: /ウォレット(の)?アドレス/, say: 'ウォレットアドレス' },
+    { lang: 'ja', re: /認証コード|確認コード|ワンタイムパスワード/, say: '認証コード' },
+    { lang: 'ja', re: /カード番号|クレジットカード/, say: 'カード番号' },
+    // pt
+    { lang: 'pt', re: /\bsenha\b/i, say: 'senha' },
+    { lang: 'pt', re: /\bfrase[\s-]?semente\b|\bfrase de recupera[çc][ãa]o\b/i, say: 'frase semente' },
+    { lang: 'pt', re: /\bchave privada\b/i, say: 'chave privada' },
+    { lang: 'pt', re: /\bfazer login\b|\biniciar sess[ãa]o\b/i, say: 'fazer login' },
+    { lang: 'pt', re: /\bverifi(que|car) (sua|a) conta\b/i, say: 'verifique sua conta' },
+    { lang: 'pt', re: /\bendere[çc]o da carteira\b/i, say: 'endereço da carteira' },
+    { lang: 'pt', re: /\bc[óo]digo de (verifica[çc][ãa]o|seguran[çc]a|confirma[çc][ãa]o)\b/i, say: 'código de verificação' },
+    { lang: 'pt', re: /\bn[úu]mero do cart[ãa]o\b|\bcart[ãa]o de cr[ée]dito\b/i, say: 'número do cartão' },
+    // shapes, in any language: an Ethereum, Bitcoin or Tron address is never a game's word
+    { lang: '*', re: /\b0x[0-9a-fA-F]{40}\b/, say: 'crypto address' },
+    { lang: '*', re: /\b(bc1[a-zA-HJ-NP-Z0-9]{25,62}|[13][a-km-zA-HJ-NP-Z1-9]{25,34})\b/, say: 'crypto address' },
+    { lang: '*', re: /\bT[1-9A-HJ-NP-Za-km-z]{33}\b/, say: 'crypto address' },
+]);
+
+// Letters from other scripts that look like Latin ones, and are typed in place
+// of them to slip past a word list. Mapped to the Latin letter before matching.
+const CONFUSABLES = { 'а': 'a', 'е': 'e', 'о': 'o', 'р': 'p', 'с': 'c', 'у': 'y', 'х': 'x', 'і': 'i', 'ѕ': 's', 'ј': 'j', 'һ': 'h', 'ԁ': 'd', 'ɡ': 'g', 'ո': 'n', 'ѵ': 'v', 'ω': 'w', 'ο': 'o', 'ν': 'v', 'α': 'a', 'ρ': 'p', 'τ': 't', 'κ': 'k', 'ι': 'i', 'А': 'A', 'В': 'B', 'Е': 'E', 'К': 'K', 'М': 'M', 'Н': 'H', 'О': 'O', 'Р': 'P', 'С': 'C', 'Т': 'T', 'Х': 'X', 'Ѵ': 'V' };
+// Characters that render as nothing (or as a break only when wrapping) and are
+// put inside a word to split it for a matcher while the eye reads it whole.
+const INVISIBLE = /[​-‏⁠⁡-⁤­͏᠎]/g;
+
+/**
+ * Text as the matcher reads it: NFKC (fullwidth and styled letters fold to
+ * plain ones), invisible characters gone, confusables mapped, whitespace
+ * collapsed. What a player reads is what is matched.
+ */
+export function normaliseText(text) {
+    let t = String(text || '').normalize('NFKC').replace(INVISIBLE, '');
+    t = t.replace(/[Ѐ-ӿͰ-ϿԀ-ԯա-ևɐ-ʯ]/g, (c) => CONFUSABLES[c] ?? c);
+    return t.replace(/\s+/g, ' ');
+}
+
+/** The credential phrases found in a text, each once, as the reviewer reads them. */
+export function credentialHits(text) {
+    const t = normaliseText(text);
+    const out = [];
+    for (const p of CREDENTIAL_PATTERNS) {
+        if (p.re.test(t) && !out.includes(p.say)) out.push(p.say);
+    }
+    return out;
+}
+
+/**
+ * An input as a variant records it: enough to tell one field from another
+ * across runs (its type, id and name), never its value and never its words,
+ * which change with the language the variant plays in. A text field that
+ * masks what is typed (`-webkit-text-security`) or that autocompletes a
+ * password or a one-time code is a password field, whatever its `type` says.
+ * The SDK's own fields (<hb-bet-amount>, the panel) are marked, so a game's
+ * own text input stands out from them.
+ */
+export function inputSignature(i) {
+    let type = i.type || 'text';
+    if (type !== 'password' && type !== 'email' && (i.masked || /password|one-time-code/i.test(i.autocomplete || ''))) type = 'password';
+    return [type, i.id || '', i.name || '', i.sdk ? 'sdk' : ''].join('|');
+}
+
+// ---- the bet control -------------------------------------------------------------------
+
+/** A control a player could press: at least this many CSS pixels each way. */
+export const CONTROL_MIN_PX = 32;
+
+/**
+ * Why the long session's bet control cannot be the player's button, or null
+ * when it can be: a 1×1 or hidden element wired to the engine, with the real
+ * button's handler left untested, is a decoy. `box` is what the browser
+ * measured once the stake was typed: width, height, left, top, viewport width
+ * and height, opacity, pointerEvents, visibility, disabled.
+ */
+export function controlProblem(box) {
+    if (!box) return 'the bet control was not found';
+    const { w = 0, h = 0, left = 0, top = 0, vw = 0, vh = 0, opacity = 1, pointerEvents = 'auto', visibility = 'visible', disabled = false } = box;
+    if (w < CONTROL_MIN_PX || h < CONTROL_MIN_PX) return `the bet control is ${Math.round(w)}×${Math.round(h)} px, smaller than a button a player presses (${CONTROL_MIN_PX}×${CONTROL_MIN_PX})`;
+    if (disabled) return 'the bet control is disabled once the stake is typed';
+    if (left + w <= 0 || top + h <= 0 || left >= vw || top >= vh) return `the bet control is outside the frame (at ${Math.round(left)},${Math.round(top)})`;
+    if (!(opacity > 0.5)) return `the bet control is ${Math.round(opacity * 100)}% opaque`;
+    if (pointerEvents === 'none') return 'the bet control takes no pointer (pointer-events: none)';
+    if (visibility !== 'visible') return `the bet control is ${visibility}`;
+    return null;
+}
+
+// ---- the screenshot grid ---------------------------------------------------------------
+
+/** The grid a screenshot is reduced to (columns × rows of grey cells). */
+export const GRID = Object.freeze({ w: 48, h: 32 });
+/** A cell differs when its grey level moves by more than this (of 255). */
+export const CELL_THRESHOLD = 40;
+/** A strong difference: this share of the cells differ. */
+export const STRONG_SHARE = 0.3;
+/** Or one contiguous region of changed cells this big: a dialog in the middle of the frame. */
+export const REGION_SHARE = 0.08;
+
+/**
+ * The cell-by-cell median of a few grids of the same frame taken a second
+ * apart: a reel that was spinning, a ticker, a flicker in one capture does not
+ * decide the baseline. One grid is itself; none is null.
+ */
+export function medianGrid(grids) {
+    const ok = (grids || []).filter((g) => Array.isArray(g) && g.length);
+    if (!ok.length) return null;
+    if (ok.length === 1) return ok[0];
+    const n = ok[0].length;
+    if (!ok.every((g) => g.length === n)) return ok[0];
+    const out = new Array(n);
+    const col = new Array(ok.length);
+    for (let i = 0; i < n; i++) {
+        for (let k = 0; k < ok.length; k++) col[k] = ok[k][i];
+        col.sort((a, b) => a - b);
+        out[i] = col[Math.floor(col.length / 2)];
+    }
+    return out;
+}
+
+/**
+ * How much of the frame changed between two grey grids: the share of cells
+ * whose level moved by more than CELL_THRESHOLD, and the largest contiguous
+ * region of them (4-connected on the grid). Animation and a round's own
+ * numbers move a few scattered cells; a screen replaced by another moves
+ * most; a modal moves one solid block. Strong when either is large.
+ */
+export function visualDifference(a, b) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length || !a.length) return null;
+    const n = a.length, w = GRID.w, h = n % w === 0 ? n / w : 1;
+    const moved = new Uint8Array(n);
+    let changed = 0;
+    for (let i = 0; i < n; i++) if (Math.abs(a[i] - b[i]) > CELL_THRESHOLD) { moved[i] = 1; changed++; }
+    // The largest region: a flood fill over the moved cells.
+    let region = 0;
+    const seen = new Uint8Array(n);
+    const stack = [];
+    for (let s = 0; s < n; s++) {
+        if (!moved[s] || seen[s]) continue;
+        let size = 0;
+        stack.push(s);
+        seen[s] = 1;
+        while (stack.length) {
+            const i = stack.pop();
+            size++;
+            const x = i % w, y = Math.floor(i / w);
+            for (const [dx, dy] of [[1, 0], [-1, 0], [0, 1], [0, -1]]) {
+                const nx = x + dx, ny = y + dy;
+                if (nx < 0 || ny < 0 || nx >= w || ny >= h) continue;
+                const j = ny * w + nx;
+                if (moved[j] && !seen[j]) { seen[j] = 1; stack.push(j); }
+            }
+        }
+        region = Math.max(region, size);
+    }
+    const share = changed / n, regionShare = region / n;
+    return { changed: Math.round(share * 1000) / 1000, region: Math.round(regionShare * 1000) / 1000, strong: share > STRONG_SHARE || regionShare >= REGION_SHARE };
+}
+
+// ---- the budget -------------------------------------------------------------------------
+
+/** What a short variant is assumed to take before any has been measured (boot, a round, the walk). */
+export const SHORT_VARIANT_MS = 60 * 1000;
+/** The least a short variant is estimated at once one has been measured. */
+export const SHORT_VARIANT_MIN_MS = 15 * 1000;
+/** The least a long session is worth starting with. */
+export const LONG_MIN_MS = 60 * 1000;
+
+/**
+ * What a short variant is estimated to take, from the short variants played
+ * so far (the baseline does everything one does: boot, a round, the walk):
+ * half again the slowest of them, never under SHORT_VARIANT_MIN_MS; the
+ * pessimistic SHORT_VARIANT_MS before any was played. The constant alone
+ * would skip the long session in every job: the job's matrix has about
+ * 390–510 s, and seven minutes for the seven short variants after the long
+ * one leaves it nothing, while a measured short variant takes 10–12 s.
+ */
+export function shortVariantEstimate(variants) {
+    const played = (variants || []).filter((v) => !v.rounds && !v.skipped && v.ms > 0).map((v) => v.ms);
+    if (!played.length) return SHORT_VARIANT_MS;
+    return Math.max(SHORT_VARIANT_MIN_MS, Math.round(Math.max(...played) * 1.5));
+}
+
+/**
+ * Whether the next variant fits what is left of the matrix's real time
+ * (`totalMs`, none when 0), and how much of it a long session may take: the
+ * rest of the matrix, kept for the `after` variants after it at `perVariantMs`
+ * each (shortVariantEstimate). A variant that does not fit is skipped and
+ * says so, instead of the whole matrix being killed at its deadline with no
+ * report.
+ */
+export function fitsBudget({ elapsedMs, totalMs, rounds, longBudgetMs, after = 0, perVariantMs = SHORT_VARIANT_MS }) {
+    if (!totalMs) return { fits: true, longBudgetMs };
+    const left = totalMs - elapsedMs;
+    if (!rounds) return { fits: left >= perVariantMs, longBudgetMs };
+    const room = left - after * perVariantMs - 15 * 1000;
+    if (room < LONG_MIN_MS) return { fits: false, longBudgetMs };
+    return { fits: true, longBudgetMs: Math.min(longBudgetMs, room) };
+}
+
+// ---- the storage carried between canaries ------------------------------------------------
+
+/** A carried storage file is read no further than this: a game's own storage, never a dump. */
+export const STORAGE_FILE_MAX = 4 * 1024 * 1024;
+
+/**
+ * The game's storage as a run left it (run.mjs keepStorage: Playwright's
+ * storageState for the bundle's origin), read back for the next run at
+ * `origin`: the bundle is served from a fresh port each run, so the origin
+ * recorded is rewritten to today's. A game that stored nothing left an empty
+ * list of origins, which is storage too. Anything that is not such a file is
+ * null (the run then starts from empty storage, and says so). The daily
+ * canary carries it from one day to the next, so a counter the game keeps
+ * across visits counts the canary's visits as a player's.
+ */
+export function carriedStorage(raw, origin) {
+    if (typeof raw !== 'string' || !raw || raw.length > STORAGE_FILE_MAX) return null;
+    let parsed;
+    try { parsed = JSON.parse(raw); } catch { return null; }
+    if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.origins)) return null;
+    const origins = parsed.origins.filter((o) => o && typeof o === 'object' && typeof o.origin === 'string').slice(0, 1).map((o) => ({ ...o, origin }));
+    return { cookies: [], origins, keys: (origins[0]?.localStorage || []).map((e) => e.name).sort().slice(0, 50) };
+}
+
+// ---- the judgement ----------------------------------------------------------------------
+
+/** A URL without its query, so a cache-buster does not make a new request of the same file. */
+const bare = (u) => { try { const x = new URL(u); return x.origin + x.pathname; } catch { return String(u).split('?')[0]; } };
+/** An error message without its numbers (line, column, counter), so the same error is the same across runs. */
+const shape = (m) => String(m).replace(/\d+/g, '#').slice(0, 160);
+
+/**
+ * The failures and warnings of one variant against the baseline (the base
+ * variant compared with itself: only what fails outright). Each failure is a
+ * sentence for the check line.
+ */
+export function compareVariant(variant, baseline) {
+    const failures = [], warnings = [];
+    const base = baseline && baseline !== variant ? baseline : null;
+    const fresh = (mine, theirs, norm) => { const known = new Set((theirs || []).map(norm)); return [...new Set((mine || []).map(norm).filter((x) => !known.has(x)))]; };
+    if (variant.broke) failures.push('the run broke: ' + variant.broke);
+    if (!variant.boot) failures.push('the game did not boot');
+    // Against the baseline: what is new. The baseline itself: anything at all,
+    // as the frame-size run would say of it.
+    const requests = fresh(variant.requests, base?.requests, bare);
+    if (requests.length) failures.push(`${base ? 'new ' : ''}request(s) left the bundle: ${requests.slice(0, 3).join(', ')}`);
+    const refused = fresh(variant.refused, base?.refused, shape);
+    if (refused.length) failures.push(`the policy refused ${base ? 'something new' : 'something'}: ${refused.slice(0, 2).join(' | ')}`);
+    const workers = base ? fresh(variant.workers, base.workers, bare) : [];
+    if (workers.length) failures.push(`new worker(s): ${workers.slice(0, 3).join(', ')}`);
+    const frames = base ? fresh(variant.frames, base.frames, String) : [];
+    if (frames.length) failures.push(`new frame(s): ${frames.slice(0, 3).join(', ')}`);
+    if (variant.dialogs > 0) failures.push(`${variant.dialogs} dialog attempt(s): ${(variant.dialogKinds || []).join(', ')}`);
+    const errors = fresh(variant.errors, base?.errors, shape);
+    if (errors.length) failures.push(`${base ? 'new ' : ''}uncaught error(s): ${errors.slice(0, 3).join(' | ')}`);
+    const consoleErrors = base ? fresh(variant.consoleErrors, base.consoleErrors, shape) : [];
+    if (consoleErrors.length) failures.push(`new console error(s): ${consoleErrors.slice(0, 3).join(' | ')}`);
+    const secret = (variant.inputs || []).filter((i) => /^(password|email)\|/.test(i));
+    if (secret.length) failures.push(`${secret[0].startsWith('email') ? 'an' : 'a'} ${secret[0].split('|')[0]} input: ${secret.slice(0, 2).join(', ')}`);
+    const inputs = base ? fresh(variant.inputs, base.inputs, String).filter((i) => !secret.includes(i)) : [];
+    if (inputs.length) failures.push(`new input field(s): ${inputs.slice(0, 3).join(', ')}`);
+    if ((variant.phishing || []).length) failures.push(`text that reads like a credential prompt: ${variant.phishing.slice(0, 4).join(', ')}`);
+    if (variant.controlProblem) failures.push(variant.controlProblem);
+    // The long session: a round that stuck fails; a session its time ran out
+    // on is a warning, since a trigger past its last round was not seen; so is
+    // one whose forced rows the sandbox did not honour, since the tiers were
+    // not all shown.
+    if (variant.rounds && !variant.controlProblem && (variant.settled || 0) < variant.rounds) {
+        if (variant.stuck || !variant.outOfTime) failures.push(`${variant.settled || 0} of ${variant.rounds} fast rounds settled${variant.stuck ? ': ' + variant.stuck : ''}`);
+        else warnings.push(`only ${variant.settled || 0} of ${variant.rounds} fast rounds fit the session's ${Math.round((variant.budgetMs || 0) / 1000)} s (this game's rounds are long): a trigger past round ${variant.settled || 0} is not seen`);
+    }
+    if (variant.rounds && variant.forced && variant.forcedAsked > 0 && (variant.forcedApplied || 0) < variant.forcedAsked * FORCED_HONOURED_SHARE) {
+        warnings.push(`the sandbox honoured ${variant.forcedApplied || 0} of ${variant.forcedAsked} forced rows${variant.forcedRefused ? ` (${variant.forcedRefused} refused)` : ''}: not every pay tier was shown`);
+    }
+    // A worker the shim could not reach (a blob whose parts the page did not
+    // see) keeps the real clock: the date variants do not reach what runs in it.
+    if (variant.unshimmedWorkers > 0) warnings.push(`${variant.unshimmedWorkers} worker(s) started from a blob the run could not read run on the real clock: the travelled clocks do not reach them`);
+    if (variant.visual?.strong) warnings.push(`looks different from the baseline (${pct(variant.visual)} of the frame): compare the screenshots`);
+    if (variant.visualLate?.strong) warnings.push(`after a day of game time, looks different from the baseline (${pct(variant.visualLate)} of the frame): compare the late screenshots`);
+    if (variant.visualVsApproved?.strong) warnings.push(`looks different from the approved version (${pct(variant.visualVsApproved)} of the frame): compare the screenshots`);
+    return { failures, warnings };
+}
+
+/** A difference as the line says it: the share of the frame, or the region when that is what made it strong. */
+const pct = (d) => (d.changed > STRONG_SHARE || !d.region ? `${Math.round(d.changed * 100)}%` : `a region of ${Math.round(d.region * 100)}%`);
+
+/** The variant as one line of the report, for a person. */
+export function describe(variant) {
+    const when = variant.clock === 'now' ? 'real time' : `clock ${variant.clock === 'saturday' ? 'next Saturday' : variant.clock === 'dec25' ? 'next 25 December' : variant.clock === 'jan1' ? 'next 1 January' : variant.clock}`;
+    return `${when}, ${variant.tz}, ${variant.locale}${variant.rounds ? `, ${variant.rounds} fast rounds` : ''}`;
+}
+
+/**
+ * The checks the run reports for the matrix, one per variant: rule
+ * `time-travel`, the variant's id as the size. A failure fails the check; a
+ * warning passes it with status `warning`, which the studio shows the
+ * reviewer; a variant that was not played is `skipped` with the reason.
+ */
+export function checksFor(variants, baseline) {
+    return variants.map((v) => {
+        if (v.skipped) return { size: v.id, rule: 'time-travel', ok: true, status: 'skipped', detail: `${describe(v)}: ${v.skipped}` };
+        const { failures, warnings } = compareVariant(v, baseline);
+        v.failures = failures;
+        v.warnings = warnings;
+        if (failures.length) return { size: v.id, rule: 'time-travel', ok: false, detail: `${describe(v)}: ${failures.join('; ')}` };
+        if (warnings.length) return { size: v.id, rule: 'time-travel', ok: true, status: 'warning', detail: `${describe(v)}: ${warnings.join('; ')}` };
+        return { size: v.id, rule: 'time-travel', ok: true, detail: `${describe(v)}: same as the baseline${v.rounds ? `, ${v.settled || 0} rounds settled${v.sessionMs ? ` in ${Math.round(v.sessionMs / 1000)} s` : ''}` : ''}` };
+    });
+}