scenescout 3.11.0 → 3.12.0

package/dist/engine/browser.js

@@ -15,7 +15,7 @@ import { describeStep, FLOW_AFTER_LAST_STEP_MS, FLOW_STEP_TIMEOUT_MS, isAction,
 import { framePath, RECORD_MAX_FRAMES } from "./replay.js";
 import { keepWatchingUrl, normalizePace, SETTLE_TICK_MS, shouldKeepWaiting } from "./settle.js";
 import { buildRequestScript, formatReplay, replaySignature, requestHeaders, resolveMethod, resolveRequestUrl, toReplayResult } from "./request.js";
-import { defaultEngine, focusAdvanceKey, REMOVE_SHARED_WORKER_SCRIPT, screencastSupport, serviceWorkerPolicy, sharedWorkersAllowed, } from "../browsers.js";
+import { defaultEngine, focusAdvanceKey, REMOVE_SHARED_WORKER_SCRIPT, screencastSupport, serviceWorkerPolicy, sharedWorkersAllowed, unloadWriteInterception, } from "../browsers.js";
 import { revealedLines } from "./hover.js";
 import { FORMS_INVENTORY_SCRIPT, FORM_PROBE_BODY, formProbeExpression, formIdentity, formStatus, FORMS_READ_FAILED, FORMS_SUBMIT_UNMATCHED, isEmptySubmit, sameControl, isNavigationTeardown, submits, tracksForm, } from "./forms.js";
 import { explainLaunchFailure, isMissingBrowser } from "./launch.js";
@@ -26,6 +26,7 @@ import { answersWithRefusal, destructiveRefusal, isDestructive, isDestructiveWir
 import { scanProject } from "../scan.js";
 import { analyzeDesign, DESIGN_COLLECT_SCRIPT } from "./design.js";
 import { acceptMatches, generatedUpload } from "./fixtures.js";
+import { bodyDigest, headerOf, isReadMethod, judgeUnseenWrite, pausedRequestBytes, RoutedWrites, UnseenRefusals, unseenWriteSource, } from "./unload.js";
 const SETTLE_MS = 400;
 /**
  * Request URL → pathname, falling back to the raw string for anything
@@ -504,6 +505,19 @@ export class BrowserEngine {
     engineName = "chromium";
     /** Non-GET requests fired since the last action — surfaces silent state mutation in read-only runs (timestamped for attribution). */
     mutationRequests = [];
+    /**
+     * Chromium only (browsers.ts `unloadWriteInterception`): the writes the
+     * route handler already let through, so the browser-level interception that
+     * catches what it never sees does not judge them twice. That session lives
+     * as long as the browser, so a page closed at the end still meets it.
+     */
+    routedWrites = new RoutedWrites();
+    /** Writes refused at the browser level, so the driver's own report of them (a redirect hop failing) is known as the policy's doing. */
+    unseenRefusals = new UnseenRefusals();
+    /** Whether the write policy stopped this request, at the route handler or at the browser level. */
+    refusedByAnyPolicy(req) {
+        return this.refusedByPolicy.has(req) || this.unseenRefusals.has(req.method(), req.url());
+    }
     /**
      * Every request answered since the last action, with its status. The HTTP
      * oracle sees each 4xx as it happens and reports it on its own; this ledger
@@ -580,7 +594,7 @@ export class BrowserEngine {
             url: req.url(),
             status,
             resourceType: req.resourceType(),
-            blockedByPolicy: this.refusedByPolicy.has(req),
+            blockedByPolicy: this.refusedByAnyPolicy(req),
         });
     }
     /**
@@ -700,7 +714,7 @@ export class BrowserEngine {
             this.projectDirNote = ` (its real path could not be resolved: ${err instanceof Error ? err.message : String(err)} — a symlinked project path may be wrongly refused)`;
         }
         this.oracles = new OracleMonitor();
-        this.oracles.setPolicyRefusalCheck((req) => this.refusedByPolicy.has(req));
+        this.oracles.setPolicyRefusalCheck((req) => this.refusedByAnyPolicy(req));
         // A request an embed sends to the app is the app's to answer: only one headed outside the app is the embed's.
         this.oracles.setEmbedAttribution((req) => {
             let site = null;
@@ -934,8 +948,10 @@ export class BrowserEngine {
                     return refuse(`sent from a page of ${offApp}, outside the app`);
                 // Auth/session flows must work in every mode — but never a destructive
                 // one, and in observe only the requests a login itself needs.
-                if (isAuthExempt(this.mode, method, pathname, destructiveWire))
+                if (isAuthExempt(this.mode, method, pathname, destructiveWire)) {
+                    this.routedWrites.note(this.mode, method, url, bodyDigest(req.postDataBuffer()));
                     return route.continue();
+                }
                 let owned = this.isOwnedResource(pathname);
                 // A single UI action commonly fires create-then-immediately-save
                 // (POST gets an id, PUT saves content under it) faster than the
@@ -969,10 +985,22 @@ export class BrowserEngine {
                             .finally(() => this.pendingCreations.delete(task));
                         this.pendingCreations.add(task);
                     }
+                    this.routedWrites.note(this.mode, method, url, bodyDigest(req.postDataBuffer()));
                     return route.continue();
                 }
                 return refuse();
             });
+            // Chromium never routes a write a page sends as it is being left; it is judged at the browser level instead.
+            if (unloadWriteInterception(this.engineName) === "browser-fetch" && this.browser) {
+                try {
+                    await this.interceptUnseenWrites(this.browser);
+                }
+                catch (err) {
+                    // Fail closed: without it, a page being left would write past the policy.
+                    await this.close();
+                    throw new Error(`Could not start the write policy's browser-level interception: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+                }
+            }
         }
         // Popups / target=_blank: adopt same-origin pages as the active page (with
         // oracles attached); close foreign-origin popups so exploration cannot
@@ -999,7 +1027,7 @@ export class BrowserEngine {
                     this.lastSnap = null;
                 }
                 else {
-                    void newPage.close().catch(() => { });
+                    void BrowserEngine.leaveAndClose(newPage);
                 }
             })
                 .catch(() => { });
@@ -1818,6 +1846,121 @@ export class BrowserEngine {
             return null;
         return foreign;
     }
+    /**
+     * Pause, at the browser level, every request the context's route handler
+     * lets through or never sees (unload.ts says why), and judge the writes it
+     * never saw. Everything else is sent on at once.
+     */
+    async interceptUnseenWrites(browser) {
+        this.routedWrites.clear();
+        const session = await browser.newBrowserCDPSession();
+        session.on("Fetch.requestPaused", (event) => void this.judgeUnseenRequest(session, event));
+        await session.send("Fetch.enable", { patterns: [{ urlPattern: "*" }] });
+    }
+    async judgeUnseenRequest(session, event) {
+        const { url, method, headers } = event.request;
+        // Every paused request gets exactly one answer, whatever throws on the way: a request left paused hangs its page.
+        let answered = false;
+        const answer = async (allow) => {
+            answered = true;
+            await (allow
+                ? session.send("Fetch.continueRequest", { requestId: event.requestId })
+                : session.send("Fetch.failRequest", { requestId: event.requestId, errorReason: "BlockedByClient" })).catch(() => {
+                /* the request or the browser is already gone */
+            });
+        };
+        try {
+            // Reads, and everything in destructive, go on. A later hop of a redirect is judged like any write: the route handler never sees one.
+            if (isReadMethod(method) || this.mode === "destructive")
+                return await answer(true);
+            const bytes = pausedRequestBytes(event.request);
+            if (this.routedWrites.claim(this.mode, method, url, bodyDigest(bytes)))
+                return await answer(true);
+            let verdict;
+            let pathname = url;
+            try {
+                pathname = pathnameOf(url);
+                const { foreign, offApp } = unseenWriteSource({
+                    appUrl: this.baseUrl,
+                    mode: this.mode,
+                    url,
+                    originHeader: headerOf(headers, "origin"),
+                    referer: headerOf(headers, "referer"),
+                    currentPageUrl: this.page?.url(),
+                    trustedEmbeds: this.trustedEmbeds,
+                    movedByEmbed: this.embedMoves.movedTo,
+                });
+                verdict = judgeUnseenWrite({
+                    mode: this.mode,
+                    method,
+                    pathname,
+                    destructiveWire: isDestructiveWire(pathname, bytes?.toString("utf8")),
+                    foreign,
+                    offApp,
+                    owned: this.isOwnedResource(pathname),
+                });
+            }
+            catch (err) {
+                // Fail closed: a write that cannot be judged is refused, and reported as refused below.
+                console.error(`[scenescout] write policy: could not judge ${method} at the browser level, refused: ${err instanceof Error ? err.message : String(err)}`);
+                verdict = { allow: false };
+            }
+            // Known as refused before the browser fails it, so the driver's report of the failure finds it.
+            if (!verdict.allow)
+                this.unseenRefusals.note(method, url);
+            await answer(verdict.allow);
+            if (verdict.allow) {
+                // Reported like any other write that went out, as the request event does for a routed one.
+                if (!BENIGN_MUTATION_RE.test(url) && this.mutationRequests.length < 20)
+                    this.mutationRequests.push({ at: Date.now(), sig: `${method} ${url.slice(0, 120)}` });
+                return;
+            }
+            // Refused and reported as any refusal is. Dropped rather than answered: the page that sent it is going or gone.
+            if (this.blockedRequests.length < 20)
+                this.blockedRequests.push({
+                    at: Date.now(),
+                    sig: `${method} ${url.slice(0, 140)}`,
+                    answered: false,
+                    why: verdict.why,
+                    type: (event.resourceType ?? "other").toLowerCase(),
+                });
+            this.logAction({ action: "write-policy:blocked", target: `${method} ${pathname}${verdict.why ? ` (${verdict.why})` : ""}`, url: this.page?.url() ?? "" });
+            this.oracles.notePolicyBlock();
+        }
+        catch (err) {
+            console.error(`[scenescout] write policy: browser-level interception failed on ${method}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        finally {
+            if (!answered) {
+                // Fail closed, and still say so: a refusal nobody hears about reads as a write that went out.
+                try {
+                    this.unseenRefusals.note(method, url);
+                }
+                catch {
+                    /* the error above is already logged */
+                }
+                await answer(false);
+                try {
+                    if (this.blockedRequests.length < 20)
+                        this.blockedRequests.push({
+                            at: Date.now(),
+                            sig: `${method} ${url.slice(0, 140)}`,
+                            answered: false,
+                            type: (event.resourceType ?? "other").toLowerCase(),
+                        });
+                    this.logAction({
+                        action: "write-policy:blocked",
+                        target: `${method} ${url.slice(0, 140)} (not judged: an error in the policy)`,
+                        url: this.page?.url() ?? "",
+                    });
+                    this.oracles.notePolicyBlock();
+                }
+                catch (err) {
+                    console.error(`[scenescout] write policy: could not report a refusal: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
     /** Report (and clear) write-policy blocks since the last action. */
     drainBlocked() {
         this.lastActionBlocked = this.blockedRequests.length;
@@ -1868,7 +2011,7 @@ export class BrowserEngine {
         // to see the DUPLICATES that the reporting dedup below intentionally hides.
         this.lastActionMutationSigs = this.mutationRequests.map((e) => e.sig);
         const fresh = this.mutationRequests
-            .filter((entry) => !this.refusedByPolicy.has(entry.req))
+            .filter((entry) => !entry.req || !this.refusedByAnyPolicy(entry.req))
             .filter((entry) => {
             const key = entry.sig.split("?")[0];
             if (this.reportedMutationSigs.has(key))
@@ -3614,6 +3757,23 @@ export class BrowserEngine {
             }
         }
     }
+    /**
+     * Leave a page for about:blank. A write a page sends as it is closed (a
+     * sendBeacon or keepalive fetch on pagehide) is not routed in Firefox or
+     * WebKit, so it reached the server in every mode; one it sends as it
+     * navigates is routed and judged like any other. (Chromium routes neither;
+     * its browser-level interception catches both.)
+     */
+    static async leave(page) {
+        if (page.isClosed() || page.url() === "about:blank")
+            return;
+        await page.goto("about:blank", { timeout: 3000 }).catch(() => { });
+    }
+    /** Close a page the engine will not drive, after leaving it (`leave`), so what it sends on its way out meets the policy. */
+    static async leaveAndClose(page) {
+        await BrowserEngine.leave(page);
+        await page.close().catch(() => { });
+    }
     async close() {
         // Marks the end of the time this session held a browser, so the pace
         // section can say how long it was held with nothing happening. Only when a
@@ -3621,6 +3781,10 @@ export class BrowserEngine {
         // is not an event.
         if (this.page)
             this.logAction({ action: "close", url: this.page.isClosed() ? "" : this.page.url() });
+        // Every page is left before it is closed, while the write policy still holds, so what a page sends on its way out
+        // is judged and its refusal logged before the flush below.
+        const pages = this.context?.pages() ?? [];
+        await BrowserEngine.settleWithin(Promise.allSettled(pages.map((p) => BrowserEngine.leave(p))), 5000);
         // Pending debounced coverage writes must land before the process can exit.
         try {
             this.memory?.flush();
@@ -3636,13 +3800,16 @@ export class BrowserEngine {
         // If teardown overruns the cap, the leftover process is reaped by the
         // orphan cleaner on the next attach (or server start).
         await BrowserEngine.settleWithin((async () => {
-            await this.page?.close().catch(() => { });
+            for (const p of this.context?.pages() ?? [])
+                await p.close().catch(() => { });
             await this.context?.close().catch(() => { });
             await this.browser?.close().catch(() => { });
         })(), 8000);
         this.page = null;
         this.context = null;
         this.browser = null;
+        this.routedWrites.clear();
+        this.unseenRefusals.clear();
         this.refs.clear();
         this.snapshotUrl = "";
         this.currentFingerprint = "";

package/dist/engine/calibration.js

@@ -20,7 +20,8 @@
  *
  * Pure, so every rule here is table-tested.
  */
-import { failingSignatures } from "./memory.js";
+import { requestsPair, statedRequests, templatedPathsMatch } from "./lane.js";
+import { failingSignatures, isWorthALook } from "./memory.js";
 /**
  * Upper edge of each confidence bucket. Five is enough to see a shape and few
  * enough that each holds a usable count on a run of a few dozen decisions;
@@ -86,7 +87,8 @@ function usableConfidence(value) {
  */
 export function calibrate(decisions, findings) {
     const filedKeys = new Map();
-    for (const f of findings) {
+    // Filed as worth a look is not filed as a defect: a lane that called it a defect was not agreed with.
+    for (const f of findings.filter((x) => !isWorthALook(x))) {
         if (!f.evidence)
             continue;
         // A finding verified as still present is the most informative match, so it
@@ -101,8 +103,11 @@ export function calibrate(decisions, findings) {
     const claims = decisions.filter((d) => d.verdict === "defect" && d.evidence !== null);
     const checkable = claims.filter((d) => usableConfidence(d.confidence) !== null && joinKeys(d.evidence).size > 0);
     const unjoinable = claims.length - checkable.length;
+    const worthALook = decisions.filter((d) => d.verdict === "worth_a_look").length;
     if (checkable.length === 0)
-        return unjoinable > 0 ? { checkable: 0, filed: 0, stated: 0, buckets: [], ece: 0, verified: { present: 0, gone: 0, changed: 0 }, unjoinable } : null;
+        return unjoinable > 0 || worthALook > 0
+            ? { checkable: 0, filed: 0, stated: 0, buckets: [], ece: 0, verified: { present: 0, gone: 0, changed: 0 }, unjoinable, worthALook }
+            : null;
     const buckets = BUCKET_EDGES.map(() => ({ n: 0, conf: 0, hits: 0 }));
     const verified = { present: 0, gone: 0, changed: 0 };
     const matched = new Map();
@@ -146,7 +151,7 @@ export function calibrate(decisions, findings) {
         ece += (b.n / n) * Math.abs(meanConf - rate);
         out.push({ label: bucketLabel(i), decisions: b.n, stated: meanConf, filed: rate });
     });
-    return { checkable: n, filed, stated: stated / n, buckets: out, ece, verified, unjoinable };
+    return { checkable: n, filed, stated: stated / n, buckets: out, ece, verified, unjoinable, worthALook };
 }
 const pct = (x) => `${Math.round(x * 100)}%`;
 /**
@@ -162,7 +167,7 @@ export function formatCalibration(c) {
         // and a run that recorded none look identical when the section simply
         // vanishes, and the reader concludes the feature is broken — which is this
         // project's own definition of a silent path.
-        const had = c.checkable + c.unjoinable;
+        const had = c.checkable + c.unjoinable + c.worthALook;
         if (had === 0)
             return [];
         return [
@@ -170,6 +175,7 @@ export function formatCalibration(c) {
             ``,
             `Not enough to say yet: ${c.checkable} lane decision(s) could be checked${c.unjoinable > 0 ? ` (and ${c.unjoinable} could not be looked up at all)` : ""}, ` +
                 `and ${MIN_FOR_A_VERDICT} are needed before a calibration figure survives one of them changing.`,
+            ...worthALookNote(c),
             ``,
         ];
     }
@@ -193,6 +199,7 @@ export function formatCalibration(c) {
     if (c.unjoinable > 0) {
         lines.push(``, `${c.unjoinable} further decision(s) called a defect but named no failing endpoint, so nothing could be looked up for them. They are excluded above rather than counted as wrong.`);
     }
+    lines.push(...worthALookNote(c));
     const seen = c.verified.present + c.verified.gone + c.verified.changed;
     if (seen > 0) {
         lines.push(``, `${seen} of the findings those decisions matched ${seen === 1 ? "has" : "have"} since been re-tested with \`scout_verify\`: ${c.verified.present} still present, ${c.verified.gone} gone, ${c.verified.changed} changed. ` +
@@ -201,6 +208,16 @@ export function formatCalibration(c) {
     lines.push(``);
     return lines;
 }
+/** The line saying how many "worth a look" decisions were left out, and why; nothing when there were none. */
+function worthALookNote(c) {
+    if (c.worthALook === 0)
+        return [];
+    return [
+        ``,
+        `${c.worthALook} decision(s) were marked worth a look: real, and a defect only under a convention of the project the run cannot see. ` +
+            `Whether one was filed says nothing about whether the lane was right, so they are not scored.`,
+    ];
+}
 /** Below this, the number swings on a single decision and is worse than no number. */
 export const MIN_FOR_A_VERDICT = 8;
 /**
@@ -226,45 +243,130 @@ export const MAX_UNFILED_NAMED = 10;
  * nobody — and it is cheapest to catch at the moment the planner folds the
  * report, while the lane's session is still open.
  *
- * Matched on the store's failing-endpoint signature where the evidence has
- * one, and on the evidence text otherwise. The text match is what the
- * calibration join refuses, because there a miss is scored against the lane;
- * here a miss only asks someone to check, which costs a look and nothing more.
+ * The check exists to catch unfiled defects, so a false "filed" costs more
+ * than a false alarm, which only asks someone to look. A decision counts as
+ * filed by one of three rules, tried in order:
+ *
+ * 1. Failing signatures. When the decision's evidence names one or more
+ *    failing requests (the store's `failingSignatures`), it is filed only when
+ *    EVERY one of them is covered by a finding's signature: same method, same
+ *    status, same route, where a path-template segment (`{id}`, `:id`, `*`) on
+ *    either side stands for one id segment (see `templatedPathsMatch`). So a
+ *    finding filed as `GET /api/things/{id} 500` covers `GET /api/things/7 500`,
+ *    and a decision naming two failing requests is not filed by a finding for
+ *    one of them.
+ * 2. A request that did not fail. When the decision names a request with a
+ *    2xx or 3xx status, or none, and a finding names the same request
+ *    (template-aware, same status), the decision is filed only when its
+ *    evidence, with its path written as the finding's, is the finding's
+ *    evidence exactly, restates part of it, or is the finding's evidence
+ *    followed only by that request's other status (`… 200 as role=viewer
+ *    (expected 403)` against `… 200 as role=viewer`). Word overlap is not enough
+ *    there: a 200 names a resource, not a defect, and two different defects
+ *    on one endpoint read alike. A failing signature in the decision does not
+ *    block this when it names the same request (`POST /api/things/7/archive
+ *    200 (expected 403)` reads as a 403 to the store); one naming any other
+ *    request does, and sends the decision to rule 1's verdict.
+ * 3. Text. Evidence naming no failing request is matched on its text: the
+ *    same evidence, a restatement of part of it, or shared identifiers and
+ *    near-identical wording. The calibration join refuses a text match,
+ *    because there a miss is scored against the lane.
  */
 export function unfiledDefects(decisions, findings) {
-    const keys = new Set();
+    const keys = [];
     const filed = [];
-    for (const f of findings) {
+    // A defect filed only as worth a look is not in the report's findings, so it is still unfiled.
+    for (const f of findings.filter((x) => !isWorthALook(x))) {
         const text = `${f.evidence ?? ""} ${f.title}`;
+        const requests = statedRequests(f.evidence ?? "");
+        // The store's signatures, and the finding's own failing requests as
+        // written: the store reads no `*` in a path, so `GET /api/things/* 500`
+        // has no signature of its own.
         if (f.evidence)
             for (const key of joinKeys(f.evidence))
-                keys.add(key);
-        filed.push({ ids: identifiers(text), words: words(text), evidenceWords: words(f.evidence ?? ""), evidence: squash(f.evidence ?? "") });
+                keys.push(...statedRequests(key));
+        keys.push(...requests.filter((q) => q.status !== null && /^[45]/.test(q.status)));
+        filed.push({
+            ids: identifiers(text),
+            words: words(text),
+            evidenceWords: words(f.evidence ?? ""),
+            evidence: squash(f.evidence ?? ""),
+            raw: f.evidence ?? "",
+            requests,
+        });
     }
     const out = [];
     for (const d of decisions) {
         if (d.verdict !== "defect")
             continue;
         if (d.evidence) {
-            const joined = [...joinKeys(d.evidence)];
-            if (joined.some((k) => keys.has(k)))
+            const evidence = d.evidence;
+            const joined = [...joinKeys(evidence)];
+            const failing = joined.flatMap((sig) => statedRequests(sig));
+            if (failing.length > 0 && failing.every((sig) => keys.some((k) => requestsPair(sig, k))))
+                continue;
+            if (filed.some((f) => restatesRequest(evidence, failing, f)))
                 continue;
             // A failing-endpoint signature is the store's own identity for a bug. When
-            // the decision has one and no finding shares it, nothing else is a match.
+            // the decision has one and no finding covers it, nothing else is a match.
             if (joined.length > 0) {
                 out.push(`${d.observation} — ${d.evidence}`);
                 continue;
             }
-            const ids = identifiers(d.evidence);
-            const w = words(d.evidence);
-            const text = squash(d.evidence);
-            if (filed.some((f) => (text !== "" && f.evidence === text) || restates(text, f) || covers(ids, w, f)))
+            if (filed.some((f) => matchesText(evidence, f)))
                 continue;
         }
         out.push(d.evidence ? `${d.observation} — ${d.evidence}` : d.observation);
     }
     return out;
 }
+/** Rule 3: the same evidence, a restatement of part of it, or shared identifiers and wording. */
+function matchesText(reported, f) {
+    const text = squash(reported);
+    return (text !== "" && f.evidence === text) || restates(text, f) || covers(identifiers(reported), words(reported), f);
+}
+/**
+ * Rule 2 of unfiledDefects: the decision names a request that did not fail,
+ * the finding names the same request, and the decision's evidence — its path
+ * written as the finding's, so a template and the id it stands for are not a
+ * difference — is the finding's evidence exactly, restates part of it, or
+ * adds only the status the request should have returned.
+ * `failing` is the decision's failing signatures; each must name this same
+ * request, or the pair is refused.
+ */
+function restatesRequest(evidence, failing, f) {
+    for (const r of statedRequests(evidence)) {
+        if (r.status !== null && /^[45]/.test(r.status))
+            continue;
+        const paired = f.requests.find((q) => requestsPair(r, q));
+        if (!paired)
+            continue;
+        if (!failing.every((sig) => sig.method === r.method && templatedPathsMatch(sig.segments, r.segments)))
+            continue;
+        const aligned = squash(evidence.slice(0, r.start) + f.raw.slice(paired.start, paired.end) + evidence.slice(r.end));
+        if (aligned !== "" && (f.evidence === aligned || restates(aligned, f) || addsOnlyExpectedStatus(aligned, f.evidence, r.status)))
+            return true;
+    }
+    return false;
+}
+/**
+ * The status a lane adds after the call it quotes, to say what the call
+ * should have returned: "(expected 403)", "(reject 403)", "reject 403". One
+ * status, an optional verb, optional brackets, and nothing else.
+ */
+const EXPECTED_STATUS_RE = /^[\s,;]*\(?\s*(?:(?:expected|expect|rejected|reject)\s*:?\s*)?([1-5]\d{2})\s*\)?[\s.,;]*$/;
+/**
+ * Whether the reported evidence is the filed evidence followed by nothing but
+ * the status the request should have returned, which differs from the one it
+ * did. Anything else after it — another request, another role, another
+ * claim — is something the finding does not say, so it is not covered.
+ */
+function addsOnlyExpectedStatus(reported, filed, status) {
+    if (filed === "" || !reported.startsWith(filed))
+        return false;
+    const expected = EXPECTED_STATUS_RE.exec(reported.slice(filed.length))?.[1];
+    return expected !== undefined && expected !== status;
+}
 /**
  * Shortest reported evidence that counts as restating a filing it is part of.
  */