ravensight-playtest 0.3.0 → 0.3.1

package/README.md

@@ -118,7 +118,7 @@ setup with the expected rows at each step.
   "ok": true,
   "reserves_units": false,
   "note": "check reserves no units and starts no job: ...",
-  "cli": { "installed": "0.3.0", "latest": "0.3.0", "min_supported": "0.1.0" },
+  "cli": { "installed": "0.3.1", "latest": "0.3.1", "min_supported": "0.1.0" },
   "login": { "present": true, "valid": true, "games": [{ "gameId": "g1", "name": "Pocket Knight" }] },
   "project": { "game": "g1", "environment": null, "in_scope": true },
   "brief": { "present": true, "complete": true, "missing": [] },
@@ -306,9 +306,21 @@ How the report step reads what happened:
 
 - Console errors are recorded as automatic notes. A 4xx on a request (`Failed
   to load resource`, `HTTP 404`, `status: 401`, `401 Unauthorized` and similar)
-  is a network note: context, not a bug. A finding whose only evidence is
-  automatic network notes is capped at `minor` by the CLI, and its description
-  says so.
+  is a network note: context, not a bug. On the web a `Failed to load
+  resource` note names the request's method, URL (with its query string and
+  fragment removed) and status, and the report lists those requests under
+  network notes. A finding whose only evidence is automatic network notes is
+  capped at `minor` by the CLI, and its description says so.
+- The report step is given every action that went through (the newest 60):
+  what was clicked or typed into, by name or ref, and whether the screen
+  changed. A claim that something was never done or did nothing has to agree
+  with that list. A finding that says a named control "did nothing", "does
+  nothing", "never kicked off", "never started", "no response" or "nothing
+  happened", when the most recent click
+  on that control changed the screen without bringing up an error or a dialog,
+  at or after the screen the finding cites, is downgraded one severity in
+  report.json and report.md with a note saying at which step. It is never
+  dropped.
 - Every note carries `after`, the URL and title of the screen that followed
   it. A blocker or major finding has to cite the observation where the failure
   is visible and must not be contradicted by that next screen or by a later
@@ -362,6 +374,13 @@ are the driver's, not the game's: they are recorded as `driver_error`, and a
 blocker or major resting only on them is dropped before upload, as is any
 finding resting only on the persona's "waiting for X to finish" notes.
 
+Every field, checkbox, radio, slider and select the persona sees carries what
+it holds now, read from the page rather than from the accessibility text:
+`value="..."` (cut at 80 characters), `checked` or `not checked`, or
+`selected option="..."`. A password field shows `value=(hidden)`, and a field
+the page could not answer for shows no value at all, so a typed password never
+reaches the model.
+
 On a long web page the persona's text view of the screen is capped at 4,000
 characters. Over the cap, buttons, links and fields are kept first, a long run
 of look-alike items (a list of 249 cards) is shown as its first two and "and
@@ -370,7 +389,10 @@ after a long list still reaches the persona.
 
 Each persona starts at the game's URL as a fresh player with no account, so a
 sign-up form with validation can use up a whole unit before the game itself is
-reached. Point `--build-url` at a guest or demo path, or say where to start in
+reached. Every run gets its own identity to sign up with, an email
+`persona-<persona>-<short run id>@example.test` and a display name ending in the
+short run id, so a second run never hits "that email is taken" from the first.
+`example.test` is a reserved name and never delivers mail. Point `--build-url` at a guest or demo path, or say where to start in
 the brief's `how_to_start` note (for example "choose Play as guest"), when the
 sign-up is not what you want tested.
 

package/docs/NATIVE_RUNNER.md

@@ -60,7 +60,7 @@ Every device command times out after 30 seconds and responses are capped at
 ## Step 1: the account side
 
 ```bash
-npm install -g ravensight-playtest@0.3.0
+npm install -g ravensight-playtest@0.3.1
 ravensight-playtest login
 cd path/to/your/game
 ravensight-playtest init --game <gameId>
@@ -70,7 +70,7 @@ ravensight-playtest check --driver ios_driver
 Expected rows (your email, game and version differ):
 
 ```
-pass  cli version        installed 0.3.0; server latest 0.3.0, min_supported 0.1.0
+pass  cli version        installed 0.3.1; server latest 0.3.1, min_supported 0.1.0
 pass  login              you@example.com, valid, scoped to 1 game: Pocket Knight (g1)
 pass  project binding    linked to Pocket Knight (g1), in the token's scope
 fail  brief              this game has no expectations brief, and a persona run needs one

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ravensight-playtest",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "AI personas play your game and file reports to Ravensight.",
   "license": "MIT",
   "homepage": "https://ravensight.io/docs/#playtest",

package/src/commands/run.js

@@ -698,6 +698,18 @@ export async function playPersonaRun({
   return { runId, persona: persona.slug, state: outcome.state, quitReason: outcome.quitReason };
 }
 
+/**
+ * A run's duration as `complete` sends it: `{ wall_seconds, model_seconds }`,
+ * each a number or null.
+ *
+ * @param {{wall_seconds?: number, model_seconds?: number}} duration
+ * @returns {{wall_seconds: number|null, model_seconds: number|null}}
+ */
+export function durationBody(duration) {
+  const value = key => (duration && Number.isFinite(Number(duration[key])) && duration[key] !== null ? Number(duration[key]) : null);
+  return { wall_seconds: value('wall_seconds'), model_seconds: value('model_seconds') };
+}
+
 /**
  * Upload the run directory and complete the run, through cli-core's
  * `finalizeRun` so the 422 `upload_unverified` repair pass lives in one place.
@@ -723,12 +735,7 @@ export async function deliver({ deps, api, gameId, jobId, runId, directory, outc
   };
   // The run card's duration. The server lane accepts `duration`; an older
   // server ignores a key it does not know.
-  if (outcome.duration) {
-    body.duration = {
-      wall_seconds: Number.isFinite(Number(outcome.duration.wall_seconds)) ? Number(outcome.duration.wall_seconds) : null,
-      model_seconds: Number.isFinite(Number(outcome.duration.model_seconds)) ? Number(outcome.duration.model_seconds) : null
-    };
-  }
+  if (outcome.duration) body.duration = durationBody(outcome.duration);
   if (outcome.report) body.report = outcome.report;
   // `report_md` is what the server lints for its four required sections. Not
   // sending it means `report_lint` is silently empty on every run, which reads
@@ -910,6 +917,8 @@ async function aggregatePhase({
   log
 }) {
   const runId = aggregateRun ? aggregateRun.run_id : null;
+  // Created here, so its wall clock is measured from the start of the
+  // aggregate phase: what the summary step's card shows as its duration.
   const ledger = createUsageLedger();
   const heartbeat = runId
     ? createHeartbeat({ api, gameId, jobId, runId, onUsage: usage => ledger.recordServerUsage(usage), onError: () => {} })
@@ -966,7 +975,7 @@ async function aggregatePhase({
     log('The aggregate was built locally: this job has no aggregate_report run to spend a model turn from, so the dedup and judgement passes were skipped.');
   }
 
-  const published = await publishAggregate({ deps, api, gameId, jobId, repoRoot, directory, options, log });
+  const published = await publishAggregate({ deps, api, gameId, jobId, repoRoot, directory, options, log, duration: durationBody(ledger.duration()) });
   if (published === 'finished') reached = 'succeeded';
   else if (published) await advance('uploading');
 
@@ -976,7 +985,8 @@ async function aggregatePhase({
         state: reached === 'uploading' ? 'succeeded' : 'failed',
         actions_taken: 0,
         quit_reason: reached === 'uploading' ? 'goal_reached' : 'error',
-        reason: reached === 'uploading' ? '' : 'the aggregate was not published'
+        reason: reached === 'uploading' ? '' : 'the aggregate was not published',
+        duration: durationBody(ledger.duration())
       });
     } catch (error) {
       log(`aggregate run ${runId}: complete was refused (${String(error && error.message)}).`);
@@ -996,7 +1006,7 @@ async function aggregatePhase({
  *   sent, 'published' when the server has it, 'finished' when it also closed
  *   the aggregate run
  */
-async function publishAggregate({ deps, api, gameId, jobId, repoRoot, directory, options, log }) {
+async function publishAggregate({ deps, api, gameId, jobId, repoRoot, directory, options, log, duration = null }) {
   if (options.dryUpload) {
     log('The aggregate was not published: --dry-upload.');
     return false;
@@ -1023,7 +1033,11 @@ async function publishAggregate({ deps, api, gameId, jobId, repoRoot, directory,
       md_size: markdown.size,
       md_sha256: markdown.sha256,
       json_size: json.size,
-      json_sha256: json.sha256
+      json_sha256: json.sha256,
+      // The server closes the aggregate run on this call, so the duration
+      // rides here as well as on the run's own complete; an older server
+      // ignores a key it does not know.
+      ...(duration ? { duration } : {})
     });
     // The server finishes the aggregate run itself when it accepts the
     // report, and says so in `run`. A caller that then tries to move the

package/src/run/aggregate.js

@@ -196,7 +196,7 @@ export function clusterFindings(runs) {
  *
  * @returns {Promise<Map<string, {same: boolean, title: string|null}>>}
  */
-export async function judgeClusters({ client, jobId, runId, clusters, log = () => {} }) {
+export async function judgeClusters({ client, jobId, runId, clusters, ledger = null, log = () => {} }) {
   const verdicts = new Map();
   // A certain cluster is one finding written twice; nothing to ask.
   const ambiguous = clusters.filter(cluster => cluster.members.length > 1 && !cluster.certain);
@@ -214,6 +214,7 @@ export async function judgeClusters({ client, jobId, runId, clusters, log = () =
   ].join('\n');
 
   try {
+    const askedAt = Date.now();
     const answer = await callStepWithRetry({
       client,
       jobId,
@@ -222,6 +223,7 @@ export async function judgeClusters({ client, jobId, runId, clusters, log = () =
       messages: [{ role: 'user', content: [{ type: 'text', text: prompt }] }],
       maxTokens: 512
     });
+    if (ledger) ledger.record({ model: answer.model, usage: answer.usage, ms: Date.now() - askedAt });
     for (const entry of parseJsonArray(answer.text)) {
       const cluster = ambiguous[Number(entry.cluster)];
       if (!cluster) continue;
@@ -400,7 +402,7 @@ export async function buildAggregate({
   const { kept, observations } = applyQualityGate(inputs);
   const clusters = clusterFindings(kept);
   const verdicts = aggregateRunId
-    ? await judgeClusters({ client, jobId, runId: aggregateRunId, clusters, log })
+    ? await judgeClusters({ client, jobId, runId: aggregateRunId, clusters, ledger, log })
     : new Map();
 
   const issues = clusters.flatMap(cluster => toIssues(cluster, verdicts.get(cluster.signature)));
@@ -523,6 +525,7 @@ export async function judgeAggregate({ client, jobId, runId, ranked, inputs, bri
   ].join('\n');
 
   try {
+    const askedAt = Date.now();
     const answer = await callStepWithRetry({
       client,
       jobId,
@@ -531,7 +534,7 @@ export async function judgeAggregate({ client, jobId, runId, ranked, inputs, bri
       messages: [{ role: 'user', content: [{ type: 'text', text: prompt }] }],
       maxTokens: 8192
     });
-    if (ledger) ledger.record({ model: answer.model, usage: answer.usage });
+    if (ledger) ledger.record({ model: answer.model, usage: answer.usage, ms: Date.now() - askedAt });
     return parseJsonObject(answer.text);
   } catch (error) {
     // A budget or cancel refusal decides the caller's exit code and has to

package/src/run/drivers/web.js

@@ -133,6 +133,136 @@ export function visibleCentre(box, viewport = DEFAULT_VIEWPORT) {
   return { x: cx, y: cy };
 }
 
+/** Roles whose current value the snapshot carries, read from the DOM. */
+export const VALUE_ROLES = new Set(['textbox', 'searchbox', 'combobox', 'listbox', 'checkbox', 'radio', 'switch', 'slider', 'spinbutton', 'menuitemcheckbox', 'menuitemradio']);
+
+/** The longest value shown for a control; a longer one is cut with "...". */
+export const MAX_VALUE_CHARS = 80;
+
+/** How many controls on one screen have their value read; a typed field past it shows no value at all. */
+export const MAX_VALUE_READS = 60;
+
+/** What a password field's value is always shown as, empty or not. */
+export const MASKED_VALUE = '(hidden)';
+
+/**
+ * Roles whose snapshot text can be what the user typed. Their printed value is
+ * removed before anything is compacted, and a value is shown only when the DOM
+ * answered and said the field is not a password: Playwright's snapshot prints
+ * a password field's contents in clear, and 0.3.0 sent that to the model.
+ */
+export const TYPED_VALUE_ROLES = new Set(['textbox', 'searchbox', 'combobox', 'spinbutton']);
+
+/**
+ * A node body with the value the snapshot printed after its name removed:
+ * `textbox "Pass" [ref=e6]: hunter22` becomes `textbox "Pass" [ref=e6]`. A
+ * trailing `:` (children follow) is kept.
+ *
+ * @param {string} body
+ * @returns {string}
+ */
+export function withoutPrintedValue(body) {
+  const match = String(body).match(/^([a-z]+(?: "[^"]*")?(?: \[[^\]]*\])*)(:?)(.*)$/s);
+  if (!match) return String(body);
+  return match[3].trim() ? match[1] : `${match[1]}${match[2]}`;
+}
+
+/**
+ * A control's current state as the snapshot shows it: `value="..."` for a
+ * field or a slider, `checked` or `not checked` for a checkbox, radio or
+ * switch, `selected option="..."` for a select. A password is masked, and a
+ * value over {@link MAX_VALUE_CHARS} is cut.
+ *
+ * @param {{kind: string, value?: string, checked?: boolean|'mixed', password?: boolean, selected?: Array<string>}} state
+ * @returns {string|null}
+ */
+export function formatControlState(state) {
+  if (!state || typeof state !== 'object') return null;
+  const quote = value => {
+    let text = String(value == null ? '' : value);
+    if (text.length > MAX_VALUE_CHARS) text = `${text.slice(0, MAX_VALUE_CHARS - 3)}...`;
+    return JSON.stringify(text);
+  };
+  if (state.kind === 'check') return state.checked === 'mixed' ? 'partly checked' : state.checked ? 'checked' : 'not checked';
+  if (state.kind === 'select') return `selected option=${quote((state.selected || []).join(', '))}`;
+  if (state.kind === 'value') return state.password ? `value=${MASKED_VALUE}` : `value=${quote(state.value)}`;
+  return null;
+}
+
+/**
+ * Read a control's state in the page. Runs in the browser, serialised by
+ * Playwright, so it must not close over anything.
+ *
+ * @param {Element} el
+ * @returns {{kind: string, value?: string, checked?: boolean|'mixed', password?: boolean, selected?: Array<string>}|null}
+ */
+function readControlState(el) {
+  if (!el) return null;
+  const tag = String(el.tagName || '').toLowerCase();
+  const type = String(el.getAttribute('type') || '').toLowerCase();
+  const role = String(el.getAttribute('role') || '').toLowerCase();
+  if (tag === 'input' && (type === 'checkbox' || type === 'radio')) return { kind: 'check', checked: el.indeterminate ? 'mixed' : Boolean(el.checked) };
+  if (tag === 'select') return { kind: 'select', selected: Array.from(el.selectedOptions || []).map(option => String(option.label || option.textContent || '').trim()) };
+  if (tag === 'input' || tag === 'textarea') return { kind: 'value', value: String(el.value == null ? '' : el.value), password: tag === 'input' && type === 'password' };
+  const ariaChecked = el.getAttribute('aria-checked');
+  if (ariaChecked !== null || ['checkbox', 'radio', 'switch', 'menuitemcheckbox', 'menuitemradio'].includes(role)) {
+    return { kind: 'check', checked: ariaChecked === 'mixed' ? 'mixed' : ariaChecked === 'true' };
+  }
+  if (el.isContentEditable) return { kind: 'value', value: String(el.innerText || '').replace(/\s+/g, ' ').trim() };
+  const now = el.getAttribute('aria-valuetext') || el.getAttribute('aria-valuenow');
+  if (now !== null) return { kind: 'value', value: String(now) };
+  return null;
+}
+
+/**
+ * The refs of the controls in an AI mode snapshot whose value is worth
+ * reading, in page order and bounded by {@link MAX_VALUE_READS}.
+ *
+ * @param {string} text
+ * @returns {Array<string>}
+ */
+export function valueRefs(text) {
+  const refs = [];
+  for (const line of String(text == null ? '' : text).split('\n')) {
+    const raw = unquoteKey(line.trim().replace(/^- /, ''));
+    const role = (raw.match(/^([a-z]+)/) || [])[1] || '';
+    if (!VALUE_ROLES.has(role)) continue;
+    const ref = (raw.match(REF_ATTRIBUTE) || [])[1];
+    if (ref && !refs.includes(ref)) refs.push(ref);
+    if (refs.length >= MAX_VALUE_READS) break;
+  }
+  return refs;
+}
+
+/** How long reading one control's value may take before it is skipped. */
+export const VALUE_READ_TIMEOUT_MS = 1000;
+
+/**
+ * Read the current state of every control in a snapshot from the DOM, by
+ * ref. A control that cannot answer (gone, detached, a frame) is left out
+ * and shows what the snapshot printed.
+ *
+ * @param {any} page
+ * @param {string} text an AI mode snapshot
+ * @returns {Promise<Map<string, Object>>}
+ */
+export async function readControlValues(page, text) {
+  const values = new Map();
+  const refs = valueRefs(text);
+  if (refs.length === 0 || !page || typeof page.locator !== 'function') return values;
+  await Promise.all(refs.map(async ref => {
+    try {
+      const locator = page.locator(`aria-ref=${ref}`);
+      if (typeof locator.evaluate !== 'function') return;
+      const state = await locator.evaluate(readControlState, null, { timeout: VALUE_READ_TIMEOUT_MS });
+      if (state && typeof state === 'object') values.set(ref, state);
+    } catch {
+      // Not answerable now; the snapshot's own text stands for it.
+    }
+  }));
+  return values;
+}
+
 /**
  * The kept nodes of an aria snapshot with the depth each one had, or null for
  * text that is not an aria snapshot. The depth is not shown to the model; it
@@ -152,7 +282,7 @@ export function visibleCentre(box, viewport = DEFAULT_VIEWPORT) {
  * @param {{viewport?: {width: number, height: number}}} [options]
  * @returns {Array<{depth: number, line: string, hashLine: string, body: string, role: string, name: string|null, ref: string|null, centre: Object|null, hint: string|null, key: string|null, duplicate: boolean}>|null}
  */
-export function compactAriaNodes(text, { viewport = DEFAULT_VIEWPORT } = {}) {
+export function compactAriaNodes(text, { viewport = DEFAULT_VIEWPORT, values = null } = {}) {
   const value = String(text == null ? '' : text);
   const lines = value.split('\n');
   if (!lines.some(line => /^\s*- /.test(line))) return null;
@@ -170,7 +300,9 @@ export function compactAriaNodes(text, { viewport = DEFAULT_VIEWPORT } = {}) {
     const ref = (raw.match(REF_ATTRIBUTE) || [])[1] || null;
     const boxMatch = raw.match(BOX_ATTRIBUTE);
     const box = boxMatch ? boxMatch.slice(1, 5).map(Number) : null;
-    const body = raw.replace(NOISE_ATTRIBUTE, '');
+    // A field's printed value goes before anything else reads the line: only
+    // a value the DOM confirmed (and never a password) is shown, below.
+    const body = TYPED_VALUE_ROLES.has(role) ? withoutPrintedValue(raw.replace(NOISE_ATTRIBUTE, '')) : raw.replace(NOISE_ATTRIBUTE, '');
     ancestors.push({ depth, role, name });
     const named = /^[a-z]+ "[^"]*"/.test(body);
     const inlineText = /^[a-z]+(?: "[^"]*")?(?: \[[^\]]*\])*: \S/.test(body);
@@ -180,11 +312,13 @@ export function compactAriaNodes(text, { viewport = DEFAULT_VIEWPORT } = {}) {
     const hint = container
       ? (container.name ? `${container.name}${LANDMARK_LABELS[container.role] && container.role !== 'region' ? ` ${LANDMARK_LABELS[container.role]}` : ''}` : LANDMARK_LABELS[container.role])
       : null;
+    const state = interactive && ref && values && typeof values.get === 'function' && VALUE_ROLES.has(role) ? values.get(ref) : null;
     kept.push({
       depth,
       body,
       role,
       name,
+      state: state ? formatControlState(state) : null,
       ref: interactive ? ref : null,
       centre: interactive ? visibleCentre(box, viewport) : null,
       hint,
@@ -199,8 +333,15 @@ export function compactAriaNodes(text, { viewport = DEFAULT_VIEWPORT } = {}) {
   for (const node of kept) {
     node.duplicate = Boolean(node.key) && counts.get(node.key) > 1;
     const split = node.body.match(/^([a-z]+(?: "[^"]*")?(?: \[[^\]]*\])*)(.*)$/s) || [null, node.body, ''];
-    const head = split[1];
-    const tail = split[2];
+    let head = split[1];
+    let tail = split[2];
+    if (node.state) {
+      // The value read from the DOM replaces whatever the snapshot printed
+      // after the name and its checked attribute, so there is one answer, and
+      // it is the one the page holds.
+      head = head.replace(/ \[(?:checked|selected)(?:=[^\]]*)?\]/g, '');
+      tail = ` ${node.state}`;
+    }
     const refPart = node.ref ? ` [${node.ref}]` : '';
     const hintPart = node.duplicate && node.hint ? ` (in ${node.hint})` : '';
     const centrePart = node.centre ? ` @(${node.centre.x},${node.centre.y})` : '';
@@ -328,8 +469,8 @@ export function collapseRepeatedSiblings(nodes) {
  * @param {{max?: number, previous?: Set<string>|null}} [options]
  * @returns {{text: string, lines: Array<string>}|null} null when the text is not an aria snapshot
  */
-export function fitAriaSnapshot(text, { max = WEB_OBSERVATION_MAX_CHARS, previous = null, viewport = DEFAULT_VIEWPORT } = {}) {
-  const nodes = compactAriaNodes(text, { viewport });
+export function fitAriaSnapshot(text, { max = WEB_OBSERVATION_MAX_CHARS, previous = null, viewport = DEFAULT_VIEWPORT, values = null } = {}) {
+  const nodes = compactAriaNodes(text, { viewport, values });
   if (nodes === null) return null;
   const lines = nodes.map(node => node.hashLine);
   const full = nodes.map(node => node.line).join('\n');
@@ -721,6 +862,8 @@ export function createWebDriver({ importer, headless = true, playtest = null, pl
   // compared with the current one before any ref is used.
   let lastNodesDocument = null;
   const consoleBuffer = [];
+  /** Recent failed requests, newest last, bounded: what a console line is matched against. */
+  const networkFailures = [];
 
   /** @returns {any} */
   function requirePage() {
@@ -737,6 +880,7 @@ export function createWebDriver({ importer, headless = true, playtest = null, pl
     const current = requirePage();
     let text = '';
     let aria = true;
+    let values = null;
     const body = current.locator('body');
     // The page level AI mode snapshot carries a ref per element, which
     // `aria-ref=e12` resolves, and each element's box. Older Playwright
@@ -747,6 +891,10 @@ export function createWebDriver({ importer, headless = true, playtest = null, pl
       } catch {
         text = '';
       }
+      // What each field, box and select holds now, from the DOM rather than
+      // the snapshot's text: the Texas run typed a coach name twice and
+      // filed a bug because the observation kept showing the field empty.
+      if (text) values = await readControlValues(current, text);
     }
     if (!text && typeof body.ariaSnapshot === 'function') {
       try {
@@ -770,7 +918,7 @@ export function createWebDriver({ importer, headless = true, playtest = null, pl
         // is the honest answer, and the screenshot fallback below covers it.
       }
     }
-    return { text, aria };
+    return { text, aria, values };
   }
 
   /**
@@ -783,7 +931,7 @@ export function createWebDriver({ importer, headless = true, playtest = null, pl
    */
   function shownText(snap) {
     if (snap.aria) {
-      const fitted = fitAriaSnapshot(snap.text, { max: WEB_OBSERVATION_MAX_CHARS, previous: lastObservedLines ? new Set(lastObservedLines) : null, viewport: viewportSize });
+      const fitted = fitAriaSnapshot(snap.text, { max: WEB_OBSERVATION_MAX_CHARS, previous: lastObservedLines ? new Set(lastObservedLines) : null, viewport: viewportSize, values: snap.values });
       if (fitted) return fitted;
     }
     return { text: truncateObservation(snap.text, WEB_OBSERVATION_MAX_CHARS), lines: null, nodes: null };
@@ -947,9 +1095,36 @@ export function createWebDriver({ importer, headless = true, playtest = null, pl
       if (typeof context.addInitScript === 'function') await context.addInitScript(markDocument);
       page = await context.newPage();
       page.on('console', message => {
-        if (message.type() === 'error') consoleBuffer.push({ type: 'console', text: message.text() });
+        if (message.type() !== 'error') return;
+        let location = null;
+        try {
+          location = typeof message.location === 'function' ? message.location() : null;
+        } catch {
+          location = null;
+        }
+        consoleBuffer.push({ type: 'console', text: message.text(), ...(location && location.url ? { locationUrl: String(location.url) } : {}) });
       });
       page.on('pageerror', error => consoleBuffer.push({ type: 'pageerror', text: String(error && error.message) }));
+      // The failing request behind a "Failed to load resource" line, which
+      // the console text alone never names.
+      page.on('response', response => {
+        try {
+          const status = response.status();
+          if (status < 400) return;
+          const request = typeof response.request === 'function' ? response.request() : null;
+          rememberNetworkFailure(networkFailures, { url: response.url(), status, method: request && typeof request.method === 'function' ? request.method() : null });
+        } catch {
+          // A response that cannot be read is not worth a note.
+        }
+      });
+      page.on('requestfailed', request => {
+        try {
+          const failure = typeof request.failure === 'function' ? request.failure() : null;
+          rememberNetworkFailure(networkFailures, { url: request.url(), status: null, method: typeof request.method === 'function' ? request.method() : null, error: failure && failure.errorText ? String(failure.errorText) : null });
+        } catch {
+          // Same: nothing to record.
+        }
+      });
 
       const response = await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000 });
       // A 404 is not something to guess around: the build is not there, and
@@ -1110,7 +1285,7 @@ export function createWebDriver({ importer, headless = true, playtest = null, pl
 
     /** @returns {Promise<Array<{type: string, text: string}>>} */
     async consoleErrors() {
-      return consoleBuffer.splice(0, consoleBuffer.length);
+      return attachNetworkFailures(consoleBuffer.splice(0, consoleBuffer.length), networkFailures);
     },
 
     /** @returns {Promise<{videoPath: string|null}>} */
@@ -1143,6 +1318,72 @@ export function createWebDriver({ importer, headless = true, playtest = null, pl
   };
 }
 
+/** How many recent failed requests are kept to match console lines against. */
+export const MAX_NETWORK_FAILURES = 50;
+
+/** The longest request URL a note carries. */
+export const MAX_NETWORK_URL_CHARS = 200;
+
+/**
+ * A request URL as a note carries it: no query string and no fragment (they
+ * carry tokens and session ids as often as anything useful), and bounded.
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+export function networkUrl(url) {
+  let value = String(url == null ? '' : url);
+  try {
+    const parsed = new URL(value);
+    value = `${parsed.origin === 'null' ? `${parsed.protocol}` : parsed.origin}${parsed.pathname}`;
+  } catch {
+    value = value.split(/[?#]/)[0];
+  }
+  return value.length > MAX_NETWORK_URL_CHARS ? `${value.slice(0, MAX_NETWORK_URL_CHARS - 3)}...` : value;
+}
+
+/**
+ * @param {Array<Object>} list
+ * @param {{url: string, status: number|null, method?: string|null, error?: string|null}} failure
+ */
+export function rememberNetworkFailure(list, failure) {
+  list.push({ url: networkUrl(failure.url), status: Number.isInteger(failure.status) ? failure.status : null, method: failure.method || null, error: failure.error || null, claimed: false });
+  while (list.length > MAX_NETWORK_FAILURES) list.shift();
+}
+
+/** The console line a browser prints for a failed request. */
+const FAILED_RESOURCE = /^Failed to load resource\b/i;
+
+/**
+ * Give each "Failed to load resource" console line the request it was about:
+ * the one at the line's own location when the browser gave one, otherwise the
+ * oldest unclaimed failure with the same status (or the same network error).
+ * The line's text gains the method, the URL and the status, so the note says
+ * what failed; `url` and `status` ride along for the report.
+ *
+ * @param {Array<{type: string, text: string, locationUrl?: string}>} entries
+ * @param {Array<Object>} failures the driver's recent failed requests
+ * @returns {Array<Object>}
+ */
+export function attachNetworkFailures(entries, failures) {
+  return entries.map(entry => {
+    const { locationUrl, ...rest } = entry;
+    if (!FAILED_RESOURCE.test(String(entry.text || ''))) return rest;
+    const status = Number((String(entry.text).match(/status of (\d{3})/) || [])[1]) || null;
+    const location = locationUrl ? networkUrl(locationUrl) : null;
+    let match = location ? failures.find(failure => !failure.claimed && failure.url === location) : null;
+    if (!match) {
+      match = failures.find(failure => !failure.claimed && (status ? failure.status === status : failure.status === null && failure.error && String(entry.text).includes(failure.error)));
+    }
+    const url = match ? match.url : location;
+    if (!url) return rest;
+    if (match) match.claimed = true;
+    const shownStatus = match && match.status ? match.status : status;
+    const method = match && match.method ? `${match.method} ` : '';
+    return { ...rest, text: `${rest.text} (${method}${url}${shownStatus ? ` answered ${shownStatus}` : ''})`, url, status: shownStatus || null };
+  });
+}
+
 /**
  * Playwright names its recording with a random id. The upload allowlist and
  * the server's 90 day lifecycle rule are written against `session.webm`, so

package/src/run/personaLoop.js

@@ -344,7 +344,8 @@ async function playLoop({
   onBudgetWarning = null,
   log = () => {}
 }) {
-  const system = buildSystem({ skill, persona, brief, intentNotes, driverName, target, maxActions });
+  const system = buildSystem({ skill, persona, brief, intentNotes, driverName, target, maxActions, runId });
+  const identity = runIdentity({ persona, runId });
   if (controller === 'jev') system.push({ type: 'text', text: JEV_CONTROLLER_PROMPT });
   const availableTools = driver.supportedActions
     ? [...PLAY_TOOLS, ...(driver.supportedActions.includes('swipe') ? [SWIPE_TOOL] : [])].filter(tool => !ACTION_TOOLS.includes(tool.name) || driver.supportedActions.includes(tool.name))
@@ -362,6 +363,9 @@ async function playLoop({
     }
   })) : availableTools;
   const recentActions = [];
+  // The observation and action lines of the transcript, kept for the report
+  // step's "Actions you took" list.
+  const actionRecords = [];
   let latestObservation = '';
   let visualObservation = false;
   const messages = [];
@@ -398,6 +402,7 @@ async function playLoop({
   latestObservation = first.text;
   visualObservation = Boolean(first.screenshotBase64);
   transcript.write({ kind: 'observation', step: first.step, text: first.text, url: first.url });
+  actionRecords.push({ kind: 'observation', text: first.text });
   const landing = await safeScreenshot(driver, 'landing', screenshots, transcript, observations.length);
   messages.push({
     role: 'user',
@@ -508,6 +513,7 @@ async function playLoop({
         driver,
         toolUse,
         staleRefs: screenChangedThisTurn,
+        identity,
         onNote: note => {
           // The note is nested rather than spread: its own `kind`
           // (bug, confusing, good, suggestion, reaction) would otherwise
@@ -524,7 +530,7 @@ async function playLoop({
       results.push(executed.result);
       if (executed.spentAction) actions += 1;
       if (executed.changed && ACTION_TOOLS.includes(toolUse.name)) screenChangedThisTurn = true;
-      transcript.write({
+      const actionLine = {
         kind: 'action',
         tool: toolUse.name,
         input: redactToolInput(toolUse),
@@ -533,7 +539,9 @@ async function playLoop({
         error: executed.error,
         changed: executed.changed,
         actions
-      });
+      };
+      transcript.write(actionLine);
+      actionRecords.push(actionLine);
       if (executed.driverError) {
         // The driver failed, not the game: a target that matched twice,
         // locator code, a ref not on screen, a timeout on an unchanged page.
@@ -551,6 +559,7 @@ async function playLoop({
         recentActions.push(`${toolUse.name}: ${executed.changed ? 'screen changed' : 'no observed change'}`);
         if (recentActions.length > 10) recentActions.shift();
         transcript.write({ kind: 'observation', step: executed.observation.step, text: executed.observation.text, url: executed.observation.url });
+        actionRecords.push({ kind: 'observation', text: executed.observation.text });
         // Only an input to the game can tell us anything about being stuck. A
         // `snapshot` or a `screenshot` never changes the screen by design, so
         // counting those would have a persona that looks twice before acting
@@ -580,7 +589,14 @@ async function playLoop({
       const shot = await safeScreenshot(driver, 'console-error', screenshots, transcript, observations.length);
       for (const entry of consoleErrors) {
         const kind = RESOURCE_4XX.test(String(entry.text)) ? 'network' : 'bug';
-        const note = { kind, text: `${entry.type}: ${entry.text}`, automatic: true, ...(shot ? { screenshot: shot.relativePath } : {}) };
+        const note = {
+          kind,
+          text: `${entry.type}: ${entry.text}`,
+          automatic: true,
+          ...(entry.url ? { url: String(entry.url).slice(0, 200) } : {}),
+          ...(entry.url && Number.isInteger(entry.status) ? { status: entry.status } : {}),
+          ...(shot ? { screenshot: shot.relativePath } : {})
+        };
         noted(note);
         transcript.write({ kind: 'note', note });
       }
@@ -631,7 +647,8 @@ async function playLoop({
     budgetExceeded,
     canceled,
     imageBudget,
-    finalScreenshot: final ? final.relativePath : null
+    finalScreenshot: final ? final.relativePath : null,
+    actionLog: actionLogFrom(actionRecords)
   };
 }
 
@@ -661,7 +678,7 @@ async function reportPhase({
   endedAt,
   log
 }) {
-  const system = buildSystem({ skill, persona, brief, intentNotes, driverName, target, maxActions: play.actionsTaken });
+  const system = buildSystem({ skill, persona, brief, intentNotes, driverName, target, maxActions: play.actionsTaken, runId });
   const messages = [{
     role: 'user',
     content: [{
@@ -681,6 +698,14 @@ async function reportPhase({
         'Observations the persona was shown, by index:',
         observationLines(observations),
         '',
+        'Actions you took (every action that went through, numbered by action; "screen changed" means the screen after it differed from the screen before):',
+        actionLogLines(play.actionLog),
+        '',
+        'A claim in report.md or report.json that something was never done, never worked, did nothing or could not be done must agree with this list. If the list shows you clicked a control and the screen changed, do not write that you never clicked it or that it did nothing; describe what the screen showed after it instead. The runner downgrades a finding that says otherwise.',
+        '',
+        'Network notes (failed requests the runner recorded, with the URL and the status; list them under a "Network notes" heading in report.md when there are any):',
+        networkNoteLines(notes),
+        '',
         'Each note carries "after": the URL and title of the observation that followed it. A blocker or major finding must cite the observation index where the failure is visible, as evidence {"type": "transcript_step", "ref": "observation N"}, and must not be contradicted by its note\'s "after" state or by a later persona note: if the next screen or a later note shows the game working, it is not a blocker or a major. Cite a note as {"type": "transcript_step", "ref": "note N"}.',
         'A blocker or major finding must also cite the screenshot taken at or after that observation (the list below says which observation each one followed), and that screenshot must not contradict it: if it shows the thing the finding says is missing or broken, such as the field or the button, it is not a blocker or a major. A text observation can be cut short on a long page; the screenshot is what the player saw.',
         '',
@@ -707,6 +732,7 @@ async function reportPhase({
   let repaired = false;
   let continued = false;
   let droppedByRunner = [];
+  let downgradedByRunner = [];
 
   // One repair at most when the schema or the evidence refs refuse what was
   // written: each turn is a metered question, and the dogfood gate asks for
@@ -809,11 +835,19 @@ async function reportPhase({
     }
     const capped = normalised ? capNetworkOnlyFindings(stampReport(normalised.report, facts), { notes, screenshots }) : null;
     const runnerDrop = capped ? dropRunnerRejectedFindings(capped, { notes, observations }) : { report: null, dropped: [] };
-    const candidate = runnerDrop.report;
     for (const entry of runnerDrop.dropped) {
       transcript.write({ kind: 'finding_dropped', id: entry.finding.id, severity: entry.finding.severity, title: entry.finding.title, reason: entry.reason });
     }
     droppedByRunner = runnerDrop.dropped;
+    const contradicted = runnerDrop.report ? downgradeContradictedFindings(runnerDrop.report, play.actionLog) : { report: null, downgraded: [] };
+    const candidate = contradicted.report;
+    for (const entry of contradicted.downgraded) {
+      transcript.write({ kind: 'finding_downgraded', id: entry.id, from: entry.from, to: entry.to, control: entry.control, action: entry.action });
+    }
+    downgradedByRunner = contradicted.downgraded;
+    if (contradicted.downgraded.length > 0) {
+      log(`downgraded ${contradicted.downgraded.length} finding(s) the action log contradicts: ${contradicted.downgraded.map(entry => `${entry.id} (${entry.from} to ${entry.to}, ${entry.control} clicked at step ${entry.action})`).join(', ')}`);
+    }
     if (candidate) lastCandidate = candidate;
     const validation = candidate ? validator.validate(candidate) : { ok: false, details: [{ instancePath: '/', message: parseError || 'report.json was not written' }] };
     const evidenceProblems = candidate ? await checkEvidence(candidate, runDirectory) : [];
@@ -879,6 +913,8 @@ async function reportPhase({
     markdown = rewriteMarkdown(markdown, droppedByRunner.map(entry => entry.finding), report.findings || [], RUNNER_DROPPED_SECTION);
     log(`dropped ${droppedByRunner.length} finding(s) the runner's evidence rules refuse: ${droppedByRunner.map(entry => `${entry.finding.id} (${entry.reason})`).join(', ')}`);
   }
+  // The uploaded pair agree: report.md says the severity report.json does.
+  if (downgradedByRunner.length > 0) markdown = rewriteDowngradedMarkdown(markdown, downgradedByRunner);
   const generatedAt = new Date().toISOString();
   const facts = reportFacts({ persona, driverName, target, play });
   markdown = stampGeneratedAt(markdown, generatedAt, facts);
@@ -988,7 +1024,8 @@ async function callWithImageRetry({ imageBudget, keepObservations, messages, onI
  * product where the same few thousand tokens are re-sent tens of times. The
  * proxy allowlists `system` and passes the blocks through unchanged.
  */
-export function buildSystem({ skill, persona, brief, intentNotes, driverName, target, maxActions }) {
+export function buildSystem({ skill, persona, brief, intentNotes, driverName, target, maxActions, runId = null }) {
+  const identity = runIdentity({ persona, runId });
   return [
     { type: 'text', text: skill },
     { type: 'text', text: `<persona_file>\n${persona.body}\n</persona_file>` },
@@ -999,13 +1036,55 @@ export function buildSystem({ skill, persona, brief, intentNotes, driverName, ta
         `target: ${target}`,
         `max_actions: ${maxActions}`,
         `<expectations_brief>\n${briefForPrompt(brief)}\n</expectations_brief>`,
-        `<design_intent_notes>\n${intentNotesForPrompt(brief, intentNotes)}\n</design_intent_notes>`
+        `<design_intent_notes>\n${intentNotesForPrompt(brief, intentNotes)}\n</design_intent_notes>`,
+        ...(identity ? [`<run_identity>\n${runIdentityForPrompt(identity)}\n</run_identity>`] : [])
       ].join('\n'),
       cache_control: { type: 'ephemeral' }
     }
   ];
 }
 
+/**
+ * The run id cut to something short enough for an email or a display name:
+ * the last eight letters and digits after the `pt_run_` prefix.
+ *
+ * @param {string} runId
+ * @returns {string}
+ */
+export function shortRunId(runId) {
+  const compact = String(runId == null ? '' : runId).replace(/^pt_run_/, '').toLowerCase().replace(/[^a-z0-9]/g, '');
+  return compact.slice(-8);
+}
+
+/**
+ * A fresh identity for every run, so a sign-up form never sees an email an
+ * earlier run already registered. The Texas round lost actions to a 409 on
+ * sign-up from a reused address. `example.test` is a reserved name that never
+ * delivers mail.
+ *
+ * @param {{persona: {slug?: string, name?: string}, runId: string}} args
+ * @returns {{email: string, displayName: string, short: string}|null}
+ */
+export function runIdentity({ persona, runId }) {
+  const short = shortRunId(runId);
+  if (!short) return null;
+  const slug = String((persona && persona.slug) || 'player').toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40) || 'player';
+  const name = String((persona && (persona.name || persona.slug)) || 'Player').replace(/\s+/g, ' ').trim().slice(0, 40) || 'Player';
+  return { email: `persona-${slug}-${short}@example.test`, displayName: `${name} ${short}`, short };
+}
+
+/**
+ * @param {{email: string, displayName: string}} identity
+ * @returns {string}
+ */
+export function runIdentityForPrompt(identity) {
+  return [
+    `email: ${identity.email}`,
+    `display_name: ${identity.displayName}`,
+    'Use this email and this display name whenever a form asks for an email, a name, a username or a coach or player name, unless the brief says otherwise. They are new for this run, so an account made with them does not exist yet. Never reuse an email from an earlier run.'
+  ].join('\n');
+}
+
 /**
  * The brief as the persona skill expects it: the `fields` object the
  * expectations-brief schema describes, with the version alongside so a report
@@ -1143,6 +1222,7 @@ async function finish(outcome, ledger, runDirectory, transcript, heartbeat) {
 export function renderFallbackMarkdown({ persona, driverName, target, notes, screenshots, play, reason }) {
   const good = notes.filter(note => note.kind === 'good');
   const bad = notes.filter(note => note.kind === 'bug' || note.kind === 'confusing');
+  const network = notes.filter(note => note.automatic && note.url);
   const list = entries => (entries.length > 0
     ? entries.map(note => `- **${note.kind}${note.severity ? `/${note.severity}` : ''}**: ${note.text}`).join('\n')
     : '- Nothing was logged.');
@@ -1170,6 +1250,7 @@ export function renderFallbackMarkdown({ persona, driverName, target, notes, scr
     '## Suggested next step',
     'Run this persona again once the reason above is resolved.',
     '',
+    ...(network.length > 0 ? ['## Network notes', network.map(note => `- ${note.status ? `${note.status} ` : ''}${note.url}`).join('\n'), ''] : []),
     '## Evidence',
     screenshots.length > 0 ? screenshots.map(shot => `- ${shot.relativePath}`).join('\n') : '- (none)',
     ''
@@ -1425,6 +1506,273 @@ export function dropRunnerRejectedFindings(report, { notes = [], observations =
   return { report: dropped.length > 0 ? { ...report, findings } : report, dropped };
 }
 
+/** The most actions the report prompt lists; the newest are kept. */
+export const MAX_ACTIONS_IN_REPORT = 60;
+
+/** The longest typed text an action line repeats. */
+const MAX_TYPED_CHARS = 40;
+
+/**
+ * The names of the refs a compacted snapshot shows: `- button "Start" [e12]`
+ * gives e12 -> button "Start".
+ *
+ * @param {string} text
+ * @returns {Map<string, {role: string, name: string}>}
+ */
+export function refNamesFrom(text) {
+  const names = new Map();
+  for (const line of String(text == null ? '' : text).split('\n')) {
+    const match = line.match(/^\s*- ([a-z]+) "([^"]*)"(?: \[[^\]]*\])*? \[(e\d+)\]/);
+    if (match && match[2]) names.set(match[3], { role: match[1], name: match[2] });
+  }
+  return names;
+}
+
+/**
+ * Every action that went through, from the transcript's observation and
+ * action lines, with the name of what it targeted when the screen before it
+ * showed one.
+ *
+ * @param {Array<Object>} records transcript lines of kind observation and action, in order
+ * @returns {Array<{action: number, kind: string, target: string, name: string|null, ref: string|null, changed: boolean}>}
+ */
+export function actionLogFrom(records) {
+  const log = [];
+  let names = new Map();
+  // Observations are numbered as the report prompt numbers them: one per
+  // observation line, in order.
+  let observation = 0;
+  let previousText = '';
+  let pending = null;
+  for (const record of Array.isArray(records) ? records : []) {
+    if (!record) continue;
+    if (record.kind === 'observation') {
+      observation += 1;
+      const text = String(record.text == null ? '' : record.text);
+      if (pending) {
+        pending.observationAfter = observation;
+        pending.introducedError = introducesError(previousText, text);
+        pending = null;
+      }
+      previousText = text;
+      const next = refNamesFrom(text);
+      // An unchanged marker or a canvas shows no refs; the last names stand.
+      if (next.size > 0) names = next;
+      continue;
+    }
+    if (record.kind !== 'action') continue;
+    pending = null;
+    if (!record.ok || !ACTION_TOOLS.includes(record.tool)) continue;
+    const input = record.input || {};
+    const ref = typeof input.ref === 'string' && input.ref.trim() ? input.ref.trim() : null;
+    const known = ref ? names.get(ref) : null;
+    let name = known ? known.name : null;
+    let target;
+    if (record.tool === 'key') target = `key ${String(input.key || '')}`;
+    else if (record.tool === 'navigate') target = String(input.url || '');
+    else if (record.tool === 'swipe') target = `from (${input.x},${input.y}) to (${input.toX},${input.toY})`;
+    else {
+      const named = typeof input.target === 'string' && input.target.trim() ? input.target.trim() : null;
+      if (!name && named) {
+        const roleAndName = named.match(/^[a-z]+\s+"([^"]*)"$/);
+        name = roleAndName ? roleAndName[1] : named;
+      }
+      const where = known ? `${known.role} "${known.name}" [${ref}]` : ref ? `[${ref}]` : named || (Number.isFinite(Number(input.x)) && Number.isFinite(Number(input.y)) ? `(${input.x},${input.y})` : 'the focused element');
+      if (record.tool === 'type') {
+        const text = String(input.text == null ? '' : input.text);
+        target = `${JSON.stringify(text.length > MAX_TYPED_CHARS ? `${text.slice(0, MAX_TYPED_CHARS - 3)}...` : text)} into ${where}${input.replace ? ' (replacing)' : ''}${input.submit ? ' then Enter' : ''}`;
+      } else {
+        target = where;
+      }
+    }
+    const entry = { action: Number(record.actions) || log.length + 1, kind: record.tool, target, name, ref, changed: Boolean(record.changed), observationBefore: observation, observationAfter: null, introducedError: false };
+    log.push(entry);
+    pending = entry;
+  }
+  return log;
+}
+
+/** A line that reads as an error: an alert or a dialog, or error wording. */
+const ERROR_LINE = /^\s*- (?:alert|alertdialog|dialog)\b|\b(?:error|errors|failed|invalid)\b/i;
+
+/**
+ * Whether the screen after an action shows an alert, a dialog or error
+ * wording that the screen before it did not: a change, but not the one the
+ * persona wanted.
+ *
+ * @param {string} before
+ * @param {string} after
+ * @returns {boolean}
+ */
+export function introducesError(before, after) {
+  const seen = new Set(String(before || '').split('\n').map(line => line.trim()));
+  return String(after || '').split('\n').some(line => !seen.has(line.trim()) && ERROR_LINE.test(line));
+}
+
+/**
+ * The action log as the report prompt's numbered list, bounded to the newest
+ * {@link MAX_ACTIONS_IN_REPORT}.
+ *
+ * @param {Array<Object>} log
+ * @returns {string}
+ */
+export function actionLogLines(log) {
+  if (!Array.isArray(log) || log.length === 0) return '(none)';
+  const shown = log.slice(-MAX_ACTIONS_IN_REPORT);
+  const lines = shown.map(entry => `${entry.action}. ${entry.kind} ${entry.target}: ${entry.changed ? 'screen changed' : 'no change'}`);
+  if (shown.length < log.length) lines.unshift(`(the first ${log.length - shown.length} are left out)`);
+  return lines.join('\n');
+}
+
+/**
+ * The failed requests the runner recorded, one line each, for the report
+ * prompt's network notes.
+ *
+ * @param {Array<Object>} notes
+ * @returns {string}
+ */
+export function networkNoteLines(notes) {
+  const lines = [];
+  (notes || []).forEach((note, index) => {
+    if (!note || !note.automatic || !note.url) return;
+    lines.push(`- note ${index + 1}: ${note.status ? `${note.status} ` : ''}${note.url}`);
+  });
+  return lines.length > 0 ? lines.join('\n') : '(none)';
+}
+
+/**
+ * The "nothing happens" family: wording that says a control was used and
+ * produced nothing. Deliberately narrow; "cannot" or "fails" can be true of a
+ * control the persona clicked.
+ */
+const NOTHING_HAPPENED = /\b(?:did nothing|does nothing|never kicked off|never started|no response|nothing happened)\b/i;
+
+/** One step down the severity scale. Cosmetic and praise are never touched. */
+const DOWNGRADE = Object.freeze({ blocker: 'major', major: 'minor', minor: 'cosmetic' });
+
+/**
+ * Whether a text names a control as a whole word, ignoring case: "Play"
+ * matches "press Play" and never "Players".
+ *
+ * @param {string} text
+ * @param {string} name
+ * @returns {boolean}
+ */
+export function namesControl(text, name) {
+  const value = String(name || '').trim();
+  if (value.length < 3) return false;
+  const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(?<![\\p{L}\\p{N}])${escaped}(?![\\p{L}\\p{N}])`, 'iu').test(String(text || ''));
+}
+
+/**
+ * Downgrade, never drop, a finding the action log contradicts. All of these
+ * have to hold, or the severity is left alone:
+ *
+ * - its title or description is in the "nothing happens" family ("did
+ *   nothing", "does nothing", "never kicked off", "never started", "no
+ *   response", "nothing happened") and names a control, whole word, of at
+ *   least three characters;
+ * - the most recent click on that control changed the screen, and the screen
+ *   after it gained no alert, dialog or error wording;
+ * - that click happened at or after the latest observation the finding cites
+ *   (a finding citing no observation is left alone).
+ *
+ * The Texas round's report said the season was never kicked off, with the
+ * click on KICK OFF THE SEASON and a changed screen in its own transcript.
+ *
+ * @param {Object} report
+ * @param {Array<Object>} log from {@link actionLogFrom}
+ * @returns {{report: Object, downgraded: Array<{id: string, from: string, to: string, control: string, action: number, note: string}>}}
+ */
+export function downgradeContradictedFindings(report, log) {
+  if (!report || !Array.isArray(report.findings) || !Array.isArray(log) || log.length === 0) return { report, downgraded: [] };
+  const clicks = log.filter(entry => entry.kind === 'click' && entry.name && entry.name.trim().length >= 3);
+  if (clicks.length === 0) return { report, downgraded: [] };
+  const downgraded = [];
+  const findings = report.findings.map(finding => {
+    if (!finding || !DOWNGRADE[finding.severity]) return finding;
+    const text = `${finding.title || ''}\n${finding.description || ''}`;
+    if (!NOTHING_HAPPENED.test(text)) return finding;
+    const cited = (Array.isArray(finding.evidence) ? finding.evidence : [])
+      .map(item => (item && item.type === 'transcript_step' ? String(item.ref || '').match(/^\s*observation\s*#?\s*(\d+)\s*$/i) : null))
+      .filter(Boolean)
+      .map(match => Number(match[1]));
+    if (cited.length === 0) return finding;
+    const citedLatest = Math.max(...cited);
+    // The controls the finding names, each judged by its most recent click.
+    const named = [...new Set(clicks.map(entry => entry.name.trim().toLowerCase()))]
+      .filter(name => namesControl(text, name));
+    let hit = null;
+    for (const name of named) {
+      const latest = clicks.filter(entry => entry.name.trim().toLowerCase() === name).at(-1);
+      if (!latest.changed || latest.introducedError) continue;
+      if (!Number.isInteger(latest.observationBefore) || latest.observationBefore < citedLatest) continue;
+      hit = latest;
+      break;
+    }
+    if (!hit) return finding;
+    const to = DOWNGRADE[finding.severity];
+    const note = `the action log shows ${hit.name.trim()} clicked at step ${hit.action} with the screen changing`;
+    const description = String(finding.description || '');
+    downgraded.push({ id: finding.id, from: finding.severity, to, control: hit.name.trim(), action: hit.action, note });
+    return { ...finding, severity: to, description: description ? `${description}\n\nDowngraded by the runner: ${note}.` : `Downgraded by the runner: ${note}.` };
+  });
+  return { report: downgraded.length > 0 ? { ...report, findings } : report, downgraded };
+}
+
+/** How report.md lists the findings the runner downgraded. */
+export const DOWNGRADED_HEADING = '## Downgraded by the runner (the action log contradicts the claim)';
+
+/**
+ * report.md agreeing with report.json about downgraded findings: on every
+ * line that names a downgraded finding's id, its old severity word becomes
+ * the new one, and a section lists each downgrade with the runner's note,
+ * replacing one written before.
+ *
+ * @param {string} markdown
+ * @param {Array<{id: string, from: string, to: string, note: string}>} downgraded
+ * @returns {string}
+ */
+export function rewriteDowngradedMarkdown(markdown, downgraded) {
+  if (!Array.isArray(downgraded) || downgraded.length === 0) return markdown;
+  const text = String(markdown || '');
+  const at = text.indexOf(`\n${DOWNGRADED_HEADING}`);
+  let body = (at === -1 ? (text.startsWith(DOWNGRADED_HEADING) ? '' : text) : text.slice(0, at)).replace(/\s+$/, '');
+  const recase = (word, to) => (word === word.toUpperCase() ? to.toUpperCase() : word[0] === word[0].toUpperCase() ? to[0].toUpperCase() + to.slice(1) : to);
+  const escape = value => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const namesId = (line, id) => new RegExp(`(^|[^A-Za-z0-9])${escape(id)}(?![0-9])`).test(line);
+  // The finding a "Severity:" line belongs to: the one named by the nearest
+  // heading or list item above it. A heading naming none ends it.
+  let current = null;
+  body = body.split('\n').map(line => {
+    let out = line;
+    const named = downgraded.find(entry => entry.id && namesId(line, String(entry.id)));
+    if (named) current = named;
+    else if (/^#{1,6} /.test(line) || /^\s*(?:[-*+]|\d+[.)])\s+\S*\b[A-Z]\d{2,}\b/.test(line)) current = null;
+    for (const entry of downgraded) {
+      const id = String(entry.id || '');
+      if (!id) continue;
+      // Only the severity slot the writer labels: right after the id in
+      // parentheses or brackets ("F001 (major)", "**F001 [Major, bug]**"), or
+      // after "Severity:" within that finding. A title that happens to
+      // contain the word stays as written.
+      if (namesId(out, id)) {
+        out = out.replace(new RegExp(`(${escape(id)}\\**\\s*[([]\\s*)(${entry.from})\\b`, 'i'), (match, lead, word) => `${lead}${recase(word, entry.to)}`);
+      }
+      if (current === entry) {
+        out = out.replace(new RegExp(`(severity\\**\\s*:\\s*\\**\\s*)(${entry.from})\\b`, 'gi'), (match, lead, word) => `${lead}${recase(word, entry.to)}`);
+      }
+    }
+    return out;
+  }).join('\n');
+  const section = [
+    DOWNGRADED_HEADING,
+    ...downgraded.map(entry => `- ${entry.id}: ${entry.from} to ${entry.to}, because ${entry.note}.`)
+  ].join('\n');
+  return `${body}\n\n${section}\n`;
+}
+
 export function capNetworkOnlyFindings(report, { notes = [], screenshots = [] } = {}) {
   if (!report || !Array.isArray(report.findings)) return report;
   const byShot = new Map();

package/src/run/tools.js

@@ -68,7 +68,7 @@ const note = {
 export const PLAY_TOOLS = Object.freeze([
   {
     name: 'snapshot',
-    description: 'Look at the current screen. Does not spend an action. Use it after anything that might have changed the game state.',
+    description: 'Look at the current screen. Does not spend an action. Use it after anything that might have changed the game state. The result also repeats this run\'s identity (the email and display name to use whenever a form asks for one).',
     input_schema: {
       type: 'object',
       additionalProperties: false,
@@ -234,7 +234,7 @@ export function actionFor(toolUse) {
  *   screen, so a ref in this call was read off a screen that is gone
  * @returns {Promise<{result: Object, observation: Object|null, spentAction: boolean, changed: boolean, error: string|null}>}
  */
-export async function executeTool({ driver, toolUse, onNote, onScreenshot, staleRefs = false }) {
+export async function executeTool({ driver, toolUse, onNote, onScreenshot, staleRefs = false, identity = null }) {
   const input = toolUse.input || {};
   if (toolUse.malformed) {
     return {
@@ -272,8 +272,13 @@ export async function executeTool({ driver, toolUse, onNote, onScreenshot, stale
 
   if (toolUse.name === 'snapshot') {
     const observation = await driver.observe();
+    const result = observationResult(toolUse.id, observation);
+    // The run's identity rides on the one tool a persona calls to look
+    // around: the act step's tool allowlist has no room for a tool of its own.
+    const line = identityLine(identity);
+    if (line) result.content.push({ type: 'text', text: line });
     return {
-      result: observationResult(toolUse.id, observation),
+      result,
       observation,
       spentAction: false,
       changed: false,
@@ -351,6 +356,17 @@ export function observationResult(id, observation, prefix = '', isError = false)
   return { type: 'tool_result', tool_use_id: id, content, ...(isError ? { is_error: true } : {}) };
 }
 
+/**
+ * The run's identity as one line of a snapshot result, or '' with none.
+ *
+ * @param {{email?: string, displayName?: string}|null} identity
+ * @returns {string}
+ */
+export function identityLine(identity) {
+  if (!identity || !identity.email) return '';
+  return `run identity: email ${identity.email}, display name ${identity.displayName}. Use these whenever a form asks for an email or a name.`;
+}
+
 /**
  * @param {string} id
  * @param {string} text