scenescout 3.11.1 → 3.13.0

package/dist/engine/bench.js

@@ -31,6 +31,9 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
 import { BUCKET_EDGES, bucketLabel, bucketOf } from "./calibration.js";
+import { laneRoutePaths, stripRouteQuery } from "./fingerprint.js";
+import { isWorthALook } from "./memory.js";
+export { laneRoutePaths };
 export const LEVELS = ["minimal", "medium", "extensive"];
 const SEVERITIES = ["high", "medium", "low"];
 const Pattern = z.string().refine((p) => {
@@ -42,10 +45,24 @@ const Pattern = z.string().refine((p) => {
         return false;
     }
 }, { message: "is not a valid regular expression" });
+/**
+ * Other pages the same defect shows on, beyond `route`. A lane that owns any
+ * of them owns the defect, so its "not a defect" is a verdict, not a remark
+ * about another lane's page.
+ */
+const AlsoOn = z.array(z.string().startsWith("/")).min(1).optional();
+/**
+ * Every lane can reach the defect: it is in chrome every page carries (a
+ * shared nav, header or footer), or in an endpoint any lane can call. No lane
+ * can call it another lane's, so a verdict on it is always scored.
+ */
+const EveryPage = z.boolean().optional();
 const Entry = z
     .object({
     id: z.string().min(1),
     route: z.string().startsWith("/"),
+    alsoOn: AlsoOn,
+    everyPage: EveryPage,
     title: z.string().min(1),
     /** The category a finding for it should carry. Reported, not enforced: two categories can both be defensible. */
     category: z.string().min(1),
@@ -83,6 +100,8 @@ const Contextual = z
     .object({
     id: z.string().min(1),
     route: z.string().startsWith("/"),
+    alsoOn: AlsoOn,
+    everyPage: EveryPage,
     title: z.string().min(1),
     category: z.string().min(1),
     /** The convention that decides it: where it would be a defect, and why the run cannot tell whether it holds here. */
@@ -130,6 +149,14 @@ export function parseKey(raw) {
     const dup = ids.find((id, i) => ids.indexOf(id) !== i);
     if (dup)
         throw new Error(`The answer key uses the id ${JSON.stringify(dup)} twice.`);
+    for (const e of [...parsed.data.defects, ...parsed.data.alsoReal, ...parsed.data.contextual]) {
+        if (e.alsoOn && e.everyPage)
+            throw new Error(`The entry ${JSON.stringify(e.id)} has both alsoOn and everyPage; an entry on every page names no other pages.`);
+        const pages = [e.route, ...(e.alsoOn ?? [])];
+        const dup = pages.find((p, i) => pages.indexOf(p) !== i);
+        if (dup)
+            throw new Error(`The entry ${JSON.stringify(e.id)} names the page ${JSON.stringify(dup)} twice in route and alsoOn.`);
+    }
     const real = new Set([...parsed.data.defects, ...parsed.data.alsoReal].map((e) => e.id));
     for (const nd of parsed.data.nonDefects) {
         const unknown = nd.overrides.find((id) => !real.has(id));
@@ -241,14 +268,14 @@ export function lintKey(key) {
  *
  * "defect" on a planted or also-real defect is right, and on a known
  * non-defect is wrong. "not_a_defect" is the reverse. An "unsure" verdict, a
- * dismissal as another lane's, a decision the key does not name, one it
- * names ambiguously, and one about a contextual entry are not scored — the same rule the in-product calibration
+ * "worth_a_look", a dismissal as another lane's, a decision the key does not
+ * name, one it names ambiguously, and one about a contextual entry are not scored — the same rule the in-product calibration
  * follows, for the same reason.
  */
-export function judgeDecision(d, key) {
-    if (d.verdict === "unsure")
+export function judgeDecision(d, key, laneRoutes) {
+    if (d.verdict === "unsure" || d.verdict === "worth_a_look")
         return null;
-    if (isScopeDismissal(d))
+    if (isOwnershipRemark(d, key, laneRoutes))
         return null;
     const m = classify(decisionText(d), key);
     if (!m || m.kind === "ambiguous" || m.kind === "contextual")
@@ -258,13 +285,79 @@ export function judgeDecision(d, key) {
 }
 /** How a lane says "not mine": the wording lanes actually used, none of it about a particular app. */
 const SCOPE_DISMISSAL_RE = /out.of.lane.scope|out-of-scope|out of (my|this) (lane|scope)|belongs?.to.{0,20}\b(lane|route|page)\b|belongs-to-|(handled|owned) by (the |another )?[\w-]* ?lane|lane owns it|not (in |on |from |part of )?(my|this) (lane|assigned routes|routes?|pages?)\b|outside (my|this) (lane|routes?|pages?)|not part of my (assigned )?routes/i;
-/** A not-a-defect verdict whose stated reason is that the thing is another lane's. */
+/**
+ * A not-a-defect verdict whose stated reason is that the thing is another
+ * lane's. The WORDING rule: all a run archived before lane routes were kept
+ * can be judged by, and still what decides for a lane whose routes are not
+ * known. It cannot tell a lane's own page from another's, which is why it is
+ * not widened (see `isOwnershipRemark`).
+ */
 export function isScopeDismissal(d) {
     return d.verdict === "not_a_defect" && SCOPE_DISMISSAL_RE.test(decisionText(d));
 }
-export function calibrateAgainstKey(decisions, key) {
+/** The pages a key entry is on, in the same form as `laneRoutePaths`. */
+function entryPaths(e) {
+    return [e.route, ...(e.alsoOn ?? [])].flatMap(laneRoutePaths);
+}
+/**
+ * A lane's routes as a set of paths, or undefined when they are not known
+ * well enough to decide by: none were recorded, or ANY of them names no path
+ * ("the orders area"). A route that could not be read may be the very page a
+ * verdict is about, and deciding without it would set that verdict aside.
+ */
+function lanePaths(lane, laneRoutes) {
+    const routes = laneRoutes && Object.hasOwn(laneRoutes, lane) ? laneRoutes[lane] : undefined;
+    if (!routes || routes.length === 0)
+        return undefined;
+    const paths = new Set();
+    for (const r of routes) {
+        const named = laneRoutePaths(r);
+        if (named.length === 0)
+            return undefined;
+        for (const p of named)
+            paths.add(p);
+    }
+    return paths;
+}
+/**
+ * A not-a-defect that is a remark about who owns the thing, not a verdict on
+ * whether it is broken.
+ *
+ * Where the lane's routes are known, decided by WHERE the thing is: the
+ * verdict matches a planted or also-real defect whose pages are all outside
+ * the lane's routes. The wording no longer matters either way — "raised on /
+ * before navigating" from the orders lane is a remark about the dashboard's
+ * defect, and "handled by another lane" from the lane that owns the page is
+ * its own wrong verdict. A defect in chrome every page carries (`everyPage`)
+ * is every lane's, so it is never another lane's. A verdict that matches a
+ * known non-defect, a contextual entry, several entries or none is not about
+ * a defect with a page to own, and is judged as it would be otherwise.
+ *
+ * Where they are not known — every archive made before routes were kept, and
+ * any lane that reported no route — the wording rule decides, unchanged, so
+ * those runs score as they always have.
+ */
+export function ownershipRemark(d, key, laneRoutes) {
+    if (d.verdict !== "not_a_defect")
+        return null;
+    const own = lanePaths(d.lane, laneRoutes);
+    if (!own)
+        return isScopeDismissal(d) ? { by: "wording" } : null;
+    const m = classify(decisionText(d), key);
+    if (!m || (m.kind !== "defect" && m.kind !== "alsoReal"))
+        return null;
+    if (m.entry.everyPage)
+        return null;
+    return entryPaths(m.entry).some((p) => own.has(p)) ? null : { by: "routes", id: m.entry.id };
+}
+export function isOwnershipRemark(d, key, laneRoutes) {
+    return ownershipRemark(d, key, laneRoutes) !== null;
+}
+export function calibrateAgainstKey(decisions, key, laneRoutes) {
     if (decisions.length === 0)
         return null;
+    const lanes = [...new Set(decisions.map((d) => d.lane))];
+    const known = lanes.filter((l) => lanePaths(l, laneRoutes) !== undefined).length;
     const buckets = BUCKET_EDGES.map(() => ({ n: 0, conf: 0, right: 0 }));
     const out = {
         judged: 0,
@@ -274,7 +367,10 @@ export function calibrateAgainstKey(decisions, key) {
         badConfidence: 0,
         unsure: 0,
         outOfScope: 0,
+        ownership: known === 0 ? "wording" : known === lanes.length ? "routes" : "mixed",
+        setAsideByRoute: [],
         contextual: 0,
+        worthALook: 0,
         buckets: [],
         ece: 0,
         brier: 0,
@@ -284,8 +380,15 @@ export function calibrateAgainstKey(decisions, key) {
             out.unsure += 1;
             continue;
         }
-        if (isScopeDismissal(d)) {
+        if (d.verdict === "worth_a_look") {
+            out.worthALook += 1;
+            continue;
+        }
+        const remark = ownershipRemark(d, key, laneRoutes);
+        if (remark) {
             out.outOfScope += 1;
+            if (remark.by === "routes")
+                out.setAsideByRoute.push({ lane: d.lane, id: remark.id, confidence: d.confidence });
             continue;
         }
         const c = d.confidence;
@@ -334,14 +437,19 @@ export function calibrateAgainstKey(decisions, key) {
  * across runs, and scoring an accumulated one credits a run with what an
  * earlier run found. Point the scorer at a fresh project directory per run.
  */
-export function score(key, findings, decisions, level = "medium") {
+export function score(key, findings, decisions, level = "medium", laneRoutes) {
     const hitsByDefect = new Map();
     const falsePositives = [];
     const unknown = [];
     const ambiguous = [];
     const contextual = [];
+    const worthALook = [];
     let correct = 0;
     for (const f of findings) {
+        if (isWorthALook(f)) {
+            worthALook.push({ title: f.title, convention: f.convention ?? "" });
+            continue;
+        }
         const m = classify(findingText(f), key);
         if (!m) {
             unknown.push({ title: f.title, severity: f.severity, evidence: f.evidence ?? "" });
@@ -410,11 +518,12 @@ export function score(key, findings, decisions, level = "medium") {
         correct,
         falsePositives,
         contextual,
+        worthALook,
         unknown,
         ambiguous,
         duplicates,
         severity,
-        calibration: calibrateAgainstKey(decisions, key),
+        calibration: calibrateAgainstKey(decisions, key, laneRoutes),
     };
 }
 const pct = (n, d) => (d === 0 ? "—" : `${Math.round((n / d) * 100)}%`);
@@ -424,13 +533,18 @@ const pct = (n, d) => (d === 0 ? "—" : `${Math.round((n / d) * 100)}%`);
  * false claims nobody has judged yet. The bounds can: the lower one counts
  * every open finding as wrong, the upper one as right. Findings set aside as
  * contextual are in neither: they are not claims the run could get right.
+ * Nor are findings the run filed as worth a look: it did not claim them.
  */
 export function precisionBounds(c) {
     const labelled = c.correct + c.falsePositives.length;
     const open = c.unknown.length + c.ambiguous.length;
-    const scored = c.findings - c.contextual.length;
+    const scored = c.findings - setAside(c);
     return { labelled: `${c.correct}/${labelled} (${pct(c.correct, labelled)})`, low: pct(c.correct, scored), high: pct(c.correct + open, scored) };
 }
+/** Findings in neither precision count: contextual ones, and the run's own worth-a-looks. */
+function setAside(c) {
+    return c.contextual.length + (c.worthALook?.length ?? 0);
+}
 /** The scorecard as a person reads it. Leads with the two numbers, then says what each is made of. */
 export function formatScorecard(c) {
     const p = precisionBounds(c);
@@ -441,11 +555,13 @@ export function formatScorecard(c) {
         `Recall     ${c.found.length}/${c.expected} (${pct(c.found.length, c.expected)}) of the planted defects expected at this level`,
         `Precision  ${p.labelled} of the findings the key can label` +
             (open
-                ? ` — ${open} of ${c.findings - c.contextual.length} unlabelled, so between ${p.low} and ${p.high} of ${c.contextual.length ? "the findings not set aside" : "all findings"}`
+                ? ` — ${open} of ${c.findings - setAside(c)} unlabelled, so between ${p.low} and ${p.high} of ${setAside(c) ? "the findings not set aside" : "all findings"}`
                 : ""),
     ];
     if (c.contextual.length)
         lines.push(`Set aside  ${c.contextual.length} of ${c.findings} finding(s): defects only under a convention the run cannot see, so in neither count`);
+    if (c.worthALook.length)
+        lines.push(`Set aside  ${c.worthALook.length} of ${c.findings} finding(s) the run filed as worth a look: not claimed as defects, so in neither recall nor precision`);
     lines.push(``);
     if (c.missed.length)
         lines.push(`Missed: ${c.missed.join(", ")}`);
@@ -463,6 +579,11 @@ export function formatScorecard(c) {
         for (const x of c.contextual)
             lines.push(`  ${x.title} (${x.id})`);
     }
+    if (c.worthALook.length) {
+        lines.push(``, `Filed as worth a look (${c.worthALook.length}):`);
+        for (const x of c.worthALook)
+            lines.push(`  ${x.title}${x.convention ? ` — a defect only if the project uses ${x.convention}` : ""}`);
+    }
     if (c.ambiguous.length) {
         lines.push(``, `Ambiguous (${c.ambiguous.length}) — the key claims each twice; sharpen it:`);
         for (const a of c.ambiguous)
@@ -490,8 +611,10 @@ export function formatScorecard(c) {
             k.ambiguous && `${k.ambiguous} the key names ambiguously`,
             k.badConfidence && `${k.badConfidence} with an unusable confidence`,
             k.unsure && `${k.unsure} unsure`,
-            k.outOfScope && `${k.outOfScope} dismissed as another lane's`,
+            k.outOfScope &&
+                `${k.outOfScope} dismissed as another lane's (${k.ownership === "routes" ? "by the lanes' routes" : k.ownership === "wording" ? "by wording: no lane routes archived" : "by the lanes' routes where archived, else by wording"})`,
             k.contextual && `${k.contextual} about things that are defects only under a convention the run cannot see`,
+            k.worthALook && `${k.worthALook} the lane marked worth a look`,
         ].filter(Boolean);
         lines.push(``, k.judged === 0
             ? `Lane calibration against the key: nothing the key could judge` + (skipped.length ? ` (${skipped.join(", ")})` : "")
@@ -499,6 +622,11 @@ export function formatScorecard(c) {
                 (skipped.length ? ` — not scored: ${skipped.join(", ")}` : ""));
         for (const b of k.buckets)
             lines.push(`  stated ${b.label}: ${b.decisions} decision(s), said ${b.stated.toFixed(2)}, right ${Math.round(b.correct * 100)}%`);
+        if (k.setAsideByRoute.length) {
+            lines.push(`  Set aside as another lane's, by the lanes' routes (${k.setAsideByRoute.length}):`);
+            for (const r of k.setAsideByRoute)
+                lines.push(`    ${r.lane} on ${r.id}, stated ${Number.isFinite(r.confidence) ? r.confidence.toFixed(2) : "?"}`);
+        }
     }
     return lines.join("\n");
 }
@@ -543,17 +671,22 @@ const LOCAL_PATH_RE = /(?:\/Users\/[^/\s"']+|\/home\/[^/\s"']+|\/private\/tmp|\/
 export function sanitize(text) {
     return text.replace(LOCAL_PATH_RE, "<path>");
 }
-export function toArchive(run, date, note, findings, decisions, app) {
+export function toArchive(run, date, note, findings, decisions, app, laneRoutes = {}) {
+    // No query string or fragment reaches an archive: a lane copies routes from
+    // the address bar, and an address can carry a token.
+    const routes = Object.fromEntries(Object.entries(laneRoutes).map(([lane, list]) => [lane, list.map((r) => sanitize(stripRouteQuery(r)))]));
     return {
         app,
         run,
         date,
         note,
+        ...(Object.keys(routes).length ? { laneRoutes: routes } : {}),
         findings: findings.map((f) => ({
             title: sanitize(f.title),
             severity: f.severity,
             ...(f.category ? { category: f.category } : {}),
             ...(f.evidence ? { evidence: sanitize(f.evidence) } : {}),
+            ...(isWorthALook(f) ? { tier: "worth_a_look", ...(f.convention ? { convention: sanitize(f.convention) } : {}) } : {}),
         })),
         decisions: decisions.map((d) => ({ ...d, observation: sanitize(d.observation), evidence: d.evidence === null ? null : sanitize(d.evidence) })),
     };

package/dist/engine/browser.js

@@ -22,7 +22,7 @@ import { explainLaunchFailure, isMissingBrowser } from "./launch.js";
 import { ACTION_TIMEOUT_MS, performScroll, probeFocusIndicators, probeOverlays, scrollContainer } from "./probes.js";
 import { BROWSER_MARKER, reapOrphanBrowsers } from "./reaper.js";
 import { planUploadOptions, resolveDiskUpload } from "./uploads.js";
-import { answersWithRefusal, destructiveRefusal, isDestructive, isDestructiveWire, allowsWrite, policyRefusal, foreignFrameOrigin, foreignWrite, withForeignFrameSandbox, offAppPageWrite, embedOfRequest, hostileForEmbed, trustedEmbedOrigins, MAX_TRUSTED_EMBEDS, trustsForeignWrite, embedProbeRefusal, EmbedMoveTracker, sandboxedRedirectPage, allowsForeignWriteOnSignIn, isAuthExempt, } from "./policy.js";
+import { answersWithRefusal, destructiveRefusal, isDestructive, isDestructiveWire, allowsWrite, policyRefusal, foreignFrameOrigin, foreignWrite, withForeignFrameSandbox, offAppPageWrite, embedOfRequest, hostileForEmbed, trustedEmbedOrigins, MAX_TRUSTED_EMBEDS, trustsForeignWrite, embedProbeRefusal, EmbedMoveTracker, sandboxedRedirectPage, allowsForeignWriteOnSignIn, isAuthExempt, WriteRule, } from "./policy.js";
 import { scanProject } from "../scan.js";
 import { analyzeDesign, DESIGN_COLLECT_SCRIPT } from "./design.js";
 import { acceptMatches, generatedUpload } from "./fixtures.js";
@@ -201,7 +201,13 @@ export class BrowserEngine {
     /** Set when the project's real path could not be resolved — named in fence refusals, which it may then cause. */
     projectDirNote = "";
     memory = null;
-    mode = "read-only";
+    currentMode = "read-only";
+    /** The rule the write policy judges by: `mode`, and for a moment after a flow hands back, the flow's stricter one. */
+    writeRule = new WriteRule("read-only");
+    /** The session's write mode. Read-only from outside: it changes only through `setMode`, which keeps `writeRule` in step. */
+    get mode() {
+        return this.currentMode;
+    }
     /** Origins named as trusted embeds (policy.ts trustsEmbedWrite decides when that counts). */
     trustedEmbeds = new Set();
     trustNotice = "";
@@ -665,7 +671,8 @@ export class BrowserEngine {
         if (opts.storageStatePath && !fs.existsSync(opts.storageStatePath)) {
             throw new Error(`storageStatePath does not exist: ${opts.storageStatePath}`);
         }
-        this.mode = opts.mode ?? "read-only";
+        this.currentMode = opts.mode ?? "read-only";
+        this.writeRule = new WriteRule(this.currentMode);
         const trust = trustedEmbedOrigins(opts.trustedEmbeds);
         this.trustedEmbeds = new Set(trust.origins);
         this.trustNotice =
@@ -815,16 +822,17 @@ export class BrowserEngine {
             // that was never submitted reading as tested, in read-only mode where by
             // definition nothing is.
             // Same test the route handler uses: in observe only an exempt auth request goes out.
-            if (this.mode === "observe" && !isAuthExempt(this.mode, method, pathnameOf(req.url()), isDestructiveWire(pathnameOf(req.url()), req.postData())))
+            const rule = this.writeRule.at();
+            if (rule === "observe" && !isAuthExempt(rule, method, pathnameOf(req.url()), isDestructiveWire(pathnameOf(req.url()), req.postData())))
                 return;
-            if (this.readOnly && isDestructiveWire(pathnameOf(req.url()), req.postData()))
+            if ((rule === "read-only" || rule === "observe") && isDestructiveWire(pathnameOf(req.url()), req.postData()))
                 return;
             // A foreign frame's write is refused in every mode the route handler runs in.
-            if (this.mode !== "destructive" && this.foreignWriteOf(req))
+            if (rule !== "destructive" && this.foreignWriteOf(req))
                 return;
-            if (this.mode !== "destructive" &&
+            if (rule !== "destructive" &&
                 offAppPageWrite(this.baseUrl, this.page?.url(), req.url(), this.embedMoves.movedTo) &&
-                !isAuthExempt(this.mode, method, pathnameOf(req.url()), isDestructiveWire(pathnameOf(req.url()), req.postData())))
+                !isAuthExempt(rule, method, pathnameOf(req.url()), isDestructiveWire(pathnameOf(req.url()), req.postData())))
                 return;
             const pageUrl = this.page?.url();
             if (pageUrl && this.memory) {
@@ -841,6 +849,8 @@ export class BrowserEngine {
             await this.context.route("**/*", async (route) => {
                 const req = route.request();
                 const method = req.method();
+                // Read once, as the request arrives: the rule the page sent it under (policy.ts WriteRule), not whatever holds after an await below.
+                const rule = this.writeRule.at();
                 // A redirect is followed by the browser without asking, so its target
                 // would load unsandboxed: a frame's redirect is answered with a
                 // sandboxed page that navigates there itself, and the next hop comes
@@ -932,7 +942,7 @@ export class BrowserEngine {
                     // of one actually runs; a navigation is dropped (policy.ts says why).
                     // Caught: a request the page has already cancelled rejects these, and an unhandled rejection ends the process.
                     if (answered)
-                        return route.fulfill(policyRefusal(this.mode, method, pathname, req.headers()["origin"], why)).catch(() => { });
+                        return route.fulfill(policyRefusal(rule, method, pathname, req.headers()["origin"], why)).catch(() => { });
                     return route.abort("blockedbyclient").catch(() => { });
                 };
                 // An embedded widget from another site writes to that site, not to the
@@ -944,12 +954,12 @@ export class BrowserEngine {
                 const destructiveWire = isDestructiveWire(pathname, req.postData());
                 // An embed moved the session's page off the app: its writes out are not the app's, a sign-in excepted.
                 const offApp = offAppPageWrite(this.baseUrl, this.page?.url(), url, this.embedMoves.movedTo);
-                if (offApp && !isAuthExempt(this.mode, method, pathname, destructiveWire))
+                if (offApp && !isAuthExempt(rule, method, pathname, destructiveWire))
                     return refuse(`sent from a page of ${offApp}, outside the app`);
                 // Auth/session flows must work in every mode — but never a destructive
                 // one, and in observe only the requests a login itself needs.
-                if (isAuthExempt(this.mode, method, pathname, destructiveWire)) {
-                    this.routedWrites.note(this.mode, method, url, bodyDigest(req.postDataBuffer()));
+                if (isAuthExempt(rule, method, pathname, destructiveWire)) {
+                    this.routedWrites.note(rule, method, url, bodyDigest(req.postDataBuffer()));
                     return route.continue();
                 }
                 let owned = this.isOwnedResource(pathname);
@@ -962,13 +972,13 @@ export class BrowserEngine {
                 // guaranteed visible — give it a bounded moment to land before the
                 // mutation is judged not-owned, otherwise the session's own,
                 // just-created resource gets wrongly blocked by a timing accident.
-                if (!owned && this.mode === "safe-write" && method !== "POST" && this.pendingCreations.size > 0) {
+                if (!owned && rule === "safe-write" && method !== "POST" && this.pendingCreations.size > 0) {
                     await BrowserEngine.settleWithin(Promise.allSettled([...this.pendingCreations]), 1500);
                     owned = this.isOwnedResource(pathname);
                 }
                 // POST: creation/RPC passes unless it smells destructive and isn't ours.
                 // PUT/PATCH/DELETE: only in safe-write, only on our own resources.
-                const allow = allowsWrite(this.mode, method, destructiveWire, owned);
+                const allow = allowsWrite(rule, method, destructiveWire, owned);
                 if (allow) {
                     // Ownership tracking (safe-write): register the creation-tracking
                     // task BEFORE the POST goes out. Registering from a context
@@ -977,7 +987,7 @@ export class BrowserEngine {
                     // chained directly off the POST's json() could be judged before
                     // the listener ever ran. Here the registration is synchronous with
                     // request dispatch, which closes that window completely.
-                    if (this.mode === "safe-write" && method === "POST" && !BENIGN_MUTATION_RE.test(url)) {
+                    if (rule === "safe-write" && method === "POST" && !BENIGN_MUTATION_RE.test(url)) {
                         const task = req
                             .response()
                             .then((res) => (res && res.ok() ? this.recordCreation(res) : undefined))
@@ -985,7 +995,7 @@ export class BrowserEngine {
                             .finally(() => this.pendingCreations.delete(task));
                         this.pendingCreations.add(task);
                     }
-                    this.routedWrites.note(this.mode, method, url, bodyDigest(req.postDataBuffer()));
+                    this.routedWrites.note(rule, method, url, bodyDigest(req.postDataBuffer()));
                     return route.continue();
                 }
                 return refuse();
@@ -1806,7 +1816,7 @@ export class BrowserEngine {
         }
         if (frame === frame.page().mainFrame())
             return null;
-        if (allowsForeignWriteOnSignIn(this.mode, this.page?.url() ?? "", this.baseUrl))
+        if (allowsForeignWriteOnSignIn(this.writeRule.at(), this.page?.url() ?? "", this.baseUrl))
             return null;
         let url;
         try {
@@ -1839,10 +1849,10 @@ export class BrowserEngine {
         const source = requestSource(req);
         const originHeader = req.headers()["origin"];
         const foreign = foreignWrite(this.baseUrl, { url: req.url(), originHeader, unadoptedPageUrl, pageHasForeignFrame, ...source });
-        if (foreign && allowsForeignWriteOnSignIn(this.mode, this.page?.url() ?? "", this.baseUrl))
+        if (foreign && allowsForeignWriteOnSignIn(this.writeRule.at(), this.page?.url() ?? "", this.baseUrl))
             return null;
         // Frames of origins the user named as trusted, in safe-write, every one involved: the ordinary rules.
-        if (foreign && trustsForeignWrite(this.mode, this.trustedEmbeds, this.baseUrl, { frameChain: source.frameChain, originHeader, unadoptedPageUrl }))
+        if (foreign && trustsForeignWrite(this.writeRule.at(), this.trustedEmbeds, this.baseUrl, { frameChain: source.frameChain, originHeader, unadoptedPageUrl }))
             return null;
         return foreign;
     }
@@ -1870,11 +1880,13 @@ export class BrowserEngine {
             });
         };
         try {
+            // A request paused here was sent a moment ago, possibly by a page a flow has just left: WriteRule still holds the flow's rule.
+            const rule = this.writeRule.at();
             // Reads, and everything in destructive, go on. A later hop of a redirect is judged like any write: the route handler never sees one.
-            if (isReadMethod(method) || this.mode === "destructive")
+            if (isReadMethod(method) || rule === "destructive")
                 return await answer(true);
             const bytes = pausedRequestBytes(event.request);
-            if (this.routedWrites.claim(this.mode, method, url, bodyDigest(bytes)))
+            if (this.routedWrites.claim(rule, method, url, bodyDigest(bytes)))
                 return await answer(true);
             let verdict;
             let pathname = url;
@@ -1882,7 +1894,7 @@ export class BrowserEngine {
                 pathname = pathnameOf(url);
                 const { foreign, offApp } = unseenWriteSource({
                     appUrl: this.baseUrl,
-                    mode: this.mode,
+                    mode: rule,
                     url,
                     originHeader: headerOf(headers, "origin"),
                     referer: headerOf(headers, "referer"),
@@ -1891,7 +1903,7 @@ export class BrowserEngine {
                     movedByEmbed: this.embedMoves.movedTo,
                 });
                 verdict = judgeUnseenWrite({
-                    mode: this.mode,
+                    mode: rule,
                     method,
                     pathname,
                     destructiveWire: isDestructiveWire(pathname, bytes?.toString("utf8")),
@@ -1976,7 +1988,9 @@ export class BrowserEngine {
         const escaped = reasons.delete(ESCAPE_REFUSAL);
         const foreign = [...reasons];
         this.blockedRequests = [];
-        return (`\n🛡 WRITE-POLICY blocked (${this.mode}): ${list}${extra}. ` +
+        // The rule that judged them, which just after a flow hands back is still the flow's (WriteRule).
+        const rule = this.writeRule.at();
+        return (`\n🛡 WRITE-POLICY blocked (${rule}): ${list}${extra}. ` +
             `This is the tester's safety policy, NOT an app bug — do not file a finding for the resulting error UI. ` +
             (foreign.length > 0
                 ? `Refused because it was ${foreign.join("; ")}: it would reach a site embedded in the page rather than the app, which no mode but destructive allows. `
@@ -1987,9 +2001,9 @@ export class BrowserEngine {
             (answered
                 ? `The page's own requests were answered with a 403 in the server's place, so the page's handling of a refusal is real: an error message is correct, and a success message is a false_success violation. `
                 : "") +
-            (this.mode === "observe"
+            (rule === "observe"
                 ? `observe mode blocks every request that is not a GET, so no form submission reaches the server. Re-attach with mode="read-only" ONLY if the user confirms that ordinary form submissions are acceptable on this target.`
-                : this.mode === "read-only"
+                : rule === "read-only"
                     ? `Re-attach with mode="safe-write" to test create/edit flows, or "destructive" (user-approved disposable env only).`
                     : `In safe-write, updates/deletes are only allowed on resources this session created (${this.createdResources.length} so far).`));
     }
@@ -3318,9 +3332,9 @@ export class BrowserEngine {
      */
     async replayFlow(steps, mode = this.mode === "observe" ? "observe" : "read-only") {
         const page = this.requirePage();
-        // The write policy reads this.mode on every request, so the flow's rule holds for exactly as long as the flow runs.
+        // The write policy judges by writeRule, so the flow's rule holds from here until the flow has handed back (finally).
         const crawlMode = this.mode;
-        this.mode = mode;
+        this.setMode(mode);
         const context = this.context;
         const violations = [];
         const here = () => {
@@ -3472,7 +3486,7 @@ export class BrowserEngine {
                 // What the write policy refused of the app's own requests while this step ran is the step's, whatever caused it.
                 const blocked = ownRefusals();
                 if (!refusal && blocked.length > 0)
-                    refusal = `the ${this.mode} write policy refused ${blocked.join(", ")}`;
+                    refusal = `the ${this.writeRule.at()} write policy refused ${blocked.join(", ")}`;
                 collect();
                 if (refusal)
                     return done({ status: "refused", step: n, did, reason: refusal.split("\n")[0], path: here() });
@@ -3495,18 +3509,24 @@ export class BrowserEngine {
                     status: "refused",
                     step: steps.length,
                     did: describeStep(last),
-                    reason: `after the last step, the ${this.mode} write policy refused ${late.join(", ")}`,
+                    reason: `after the last step, the ${this.writeRule.at()} write policy refused ${late.join(", ")}`,
                     path: here(),
                 });
             }
             return done({ status: "passed" });
         }
         finally {
-            // Leave the flow's page before the crawl's rule comes back, so nothing it still sends goes out under a looser one.
-            await (this.page ?? page).goto("about:blank").catch(() => { });
+            // The hand-back, in order. Every page in the context is left while the flow's rule holds, the one a step opened
+            // a tab from included (a popup adopted as the session's page leaves it running), so nothing a page the flow used
+            // does runs on under the crawl's rule. Only then is the crawl's rule restored, and WriteRule keeps the flow's for
+            // a moment longer, for a write a page sent as it was left that the engine hears of late.
+            await BrowserEngine.settleWithin(Promise.allSettled(context.pages().map((p) => BrowserEngine.leave(p))), 5000);
             this.blockedRequests = [];
             this.oracles.drain(false);
-            this.mode = crawlMode;
+            this.setMode(crawlMode);
+            // Pages the session no longer drives are closed only now, at about:blank and under the held rule: in Firefox a
+            // page closed straight after it is left sent its leaving beacon unjudged about one time in forty.
+            await BrowserEngine.settleWithin(Promise.allSettled(context.pages().map((p) => (p === this.page ? undefined : p.close().catch(() => { })))), 5000);
             page.off("websocket", onSocket);
             context.off("response", onResponse);
             this.refs.clear();
@@ -3514,6 +3534,11 @@ export class BrowserEngine {
             this.snapshotUrl = "";
         }
     }
+    /** Change the write mode; a looser one takes over the judging only after WriteRule's hold (policy.ts). */
+    setMode(mode) {
+        this.currentMode = mode;
+        this.writeRule.set(mode);
+    }
     /** Computed-style design audit of the current page — visual judgment material without pixels. */
     async designAudit() {
         const { url, report } = await this.auditPage();
@@ -3769,7 +3794,11 @@ export class BrowserEngine {
             return;
         await page.goto("about:blank", { timeout: 3000 }).catch(() => { });
     }
-    /** Close a page the engine will not drive, after leaving it (`leave`), so what it sends on its way out meets the policy. */
+    /**
+     * Close a page the engine will not drive, after leaving it (`leave`), so what it sends on its way out meets the policy.
+     * Known limit: in Firefox, a close straight after the leave has let the page's leaving beacon out unjudged (seen 2 times
+     * in 80 under load). replayFlow's hand-back closes pages only once every page is at about:blank; this and `close` do not yet.
+     */
     static async leaveAndClose(page) {
         await BrowserEngine.leave(page);
         await page.close().catch(() => { });