scenescout 3.15.0 → 3.16.0

package/dist/engine/ci.js

@@ -11,9 +11,11 @@
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { BROWSER_ENGINES } from "../browsers.js";
+import { MAX_LANES } from "./brief.js";
 import { markdownCell } from "./check.js";
 import { parseLimitFlag } from "./limits.js";
 import { isWorthALook, redactSecrets } from "./memory.js";
+import { SARIF_ANCHOR_FALLBACKS, checkSarifAnchor, sarifLocation } from "./sarif.js";
 // ── options ─────────────────────────────────────────────────────────────────
 export const PROVIDERS = ["anthropic", "openai"];
 /** Where each provider's key is read from. Nothing else is: no flag, no file, no input. */
@@ -53,6 +55,14 @@ export const DEDUP_ENV = "SCENESCOUT_DEDUP";
 export const DEDUP_PROVIDER_ENV = "SCENESCOUT_DEDUP_PROVIDER";
 export const DEFAULT_CAPS = { turns: 40, tokens: 1_500_000, wallMs: 20 * 60_000 };
 const CAP_BOUNDS = { turns: [1, 500], tokens: [1_000, 20_000_000], minutes: [1, 360] };
+/**
+ * How many model loops explore at once, each in its own browser session and
+ * its own part of the app (engine/ci-lanes.ts). 1 is the single loop. The most
+ * is scout_lane_brief's, since the split is the same one. Why the default is
+ * what it is: docs/benchmark.md, "Unattended runs".
+ */
+export const DEFAULT_LANES = 1;
+export const MAX_CI_LANES = MAX_LANES;
 /** Every option `scenescout ci` accepts; the ci action's inputs are these names (ci-test holds them equal). */
 export const CI_OPTION_NAMES = [
     "provider",
@@ -62,6 +72,7 @@ export const CI_OPTION_NAMES = [
     "max-turns",
     "max-tokens",
     "max-minutes",
+    "lanes",
     "price-in",
     "price-cached-in",
     "price-out",
@@ -78,6 +89,7 @@ export const CI_OPTION_NAMES = [
     "show",
     "compare-url",
     "dedup",
+    "sarif-file-anchor",
 ];
 /** The longest --show description: it becomes a line of the model's prompt. */
 export const MAX_SHOW = 200;
@@ -171,9 +183,13 @@ export function parseCiArgs(args, cwd) {
     const turns = whole("max-turns", CAP_BOUNDS.turns, DEFAULT_CAPS.turns);
     const tokens = whole("max-tokens", CAP_BOUNDS.tokens, DEFAULT_CAPS.tokens);
     const minutes = whole("max-minutes", CAP_BOUNDS.minutes, DEFAULT_CAPS.wallMs / 60_000);
-    for (const v of [turns, tokens, minutes])
+    const lanes = whole("lanes", [1, MAX_CI_LANES], DEFAULT_LANES);
+    for (const v of [turns, tokens, minutes, lanes])
         if (typeof v === "string")
             return { ok: false, error: v };
+    // The lanes share the run's turns rather than getting a cap each: fewer turns than lanes would leave a lane none.
+    if (lanes > turns)
+        return { ok: false, error: `--lanes ${lanes} needs --max-turns of at least ${lanes}: the lanes share the run's turns, and each needs one` };
     const price = {};
     for (const [flag, field] of [
         ["price-in", "input"],
@@ -218,6 +234,8 @@ export function parseCiArgs(args, cwd) {
         return { ok: false, error: `--show is at most ${MAX_SHOW} characters` };
     if (flags.has("show") && !show)
         return { ok: false, error: '--show needs a few words describing the element, e.g. --show "the Save button"' };
+    if (show && lanes > 1)
+        return { ok: false, error: "--lanes splits an exploration between model loops, and --show explores nothing: give one or the other" };
     let compareUrl;
     if (flags.has("compare-url")) {
         if (!show)
@@ -244,6 +262,9 @@ export function parseCiArgs(args, cwd) {
     const dedup = flags.get("dedup") ?? DEFAULT_CI_DEDUP;
     if (!DEDUP_MODES.includes(dedup))
         return { ok: false, error: `--dedup must be one of ${DEDUP_MODES.join(", ")}` };
+    const anchor = flags.has("sarif-file-anchor") ? checkSarifAnchor(flags.get("sarif-file-anchor")) : undefined;
+    if (anchor && !anchor.ok)
+        return anchor;
     const resolve = (p) => (p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p) ? p : `${cwd.replace(/[\\/]$/, "")}/${p}`);
     return {
         ok: true,
@@ -256,6 +277,7 @@ export function parseCiArgs(args, cwd) {
             ...(effort ? { effort } : {}),
             ...(baseUrl ? { baseUrl } : {}),
             caps: { turns: turns, tokens: tokens, wallMs: minutes * 60_000 },
+            lanes: lanes,
             ...(Object.keys(price).length > 0 ? { price } : {}),
             mode: mode,
             level: level,
@@ -267,9 +289,23 @@ export function parseCiArgs(args, cwd) {
             ...(actionTimeout.value !== undefined ? { actionTimeoutMs: actionTimeout.value } : {}),
             ...(navTimeout.value !== undefined ? { navTimeoutMs: navTimeout.value } : {}),
             dedup: dedup,
+            ...(anchor ? { sarifFileAnchor: anchor.value } : {}),
         },
     };
 }
+/**
+ * Why scout_attach did not leave a session the run can use, or null when it
+ * did: an error result, or a saved sign-in the app no longer accepts (the
+ * attach succeeds, and says so on a line of its own).
+ */
+export function attachFailure(r) {
+    const authFailed = r.text.split("\n").find((l) => l.startsWith("⚠ AUTH FAILED"));
+    if (authFailed)
+        return authFailed;
+    if (r.isError || /^ERROR:/.test(r.text))
+        return r.text.replace(/^ERROR:\s*/, "");
+    return null;
+}
 const present = (env, name) => (env[name] ?? "").trim() !== "";
 /**
  * Which provider a run uses: the one whose key is set. With both set the
@@ -362,6 +398,12 @@ export function childEnv(env) {
             out[k] = v;
     // Nobody watches a CI run: the live view would only hold a port open.
     out.SCENESCOUT_LIVE = "off";
+    // ...and an unattended run opens nothing in a browser, even on a desktop, unless the user set it.
+    if (!out.SCENESCOUT_OPEN?.trim())
+        out.SCENESCOUT_OPEN = "none";
+    // The loop is text-only (toolResultText), so a finding's picture is kept for the report, never sent back. A choice the job made is its own.
+    if (!out.SCENESCOUT_EVIDENCE?.trim())
+        out.SCENESCOUT_EVIDENCE = "file";
     return out;
 }
 // ── never printing a key ────────────────────────────────────────────────────
@@ -392,7 +434,8 @@ export function addUsage(a, b) {
 /**
  * Which cap, if any, stops the run before its next model call. Checked
  * between turns: one turn's usage is only known after it, so a run can end
- * up to one turn over the token cap, and the report says by how much.
+ * up to one turn over the token cap (one per lane in a run split into lanes:
+ * see Budget), and the report says by how much.
  */
 export function capReached(spend, caps, now) {
     if (now - spend.startedAt >= caps.wallMs)
@@ -407,6 +450,31 @@ export function capReached(spend, caps, now) {
 export function wallLeftMs(spend, caps, now) {
     return Math.max(0, caps.wallMs - (now - spend.startedAt));
 }
+export function newBudget(caps, startedAt) {
+    return { caps, startedAt, turns: 0, usage: { ...NO_USAGE }, inFlight: 0 };
+}
+/** What the budget's loops have spent between them. */
+export function budgetSpend(b) {
+    return { turns: b.turns, usage: { ...b.usage }, startedAt: b.startedAt };
+}
+/** Take the next turn for one loop, or name the cap that refuses it. */
+export function takeTurn(b, now) {
+    const cap = capReached({ turns: b.turns + b.inFlight, usage: b.usage, startedAt: b.startedAt }, b.caps, now);
+    if (cap === null)
+        b.inFlight += 1;
+    return cap;
+}
+/** A taken turn's call has ended: counted with the usage it reported, or given back when it failed. */
+export function settleTurn(b, usage) {
+    // A settle with no turn taken would count a call nobody reserved: a bug in the caller, not a state to carry on from.
+    if (b.inFlight <= 0)
+        throw new Error("settleTurn without a turn taken: every settle must follow a takeTurn that returned null");
+    b.inFlight -= 1;
+    if (!usage)
+        return;
+    b.turns += 1;
+    b.usage = addUsage(b.usage, usage);
+}
 export const EXIT_CI = { completed: 0, couldNotRun: 2 };
 /**
  * A CI run reports and never gates, so its findings never set the exit code.
@@ -486,7 +554,8 @@ export function usageLine(spend, model, endedAt, override) {
  * closes itself, so the mode and the target cannot change), scout_session,
  * scout_playbook (the method is the system prompt), scout_screenshot (the
  * loop is text-only), scout_resolve (scout_verify records re-tests), and the
- * lane tools (one agent, ADR 14).
+ * lane tools (a run split into lanes is planned and folded by the run itself,
+ * not by a model: engine/ci-lanes.ts, ADR 20).
  */
 export const CI_TOOLS = [
     "scout_scan",
@@ -683,12 +752,15 @@ export function ciSummaryMarkdown(r, secrets = []) {
         ...(r.capture ? [] : [`| Level | ${r.level} — completion contract ${r.contractMet ? "met" : "not met (the report's gap ledger says what is missing)"} |`]),
         `| Mode | ${r.mode} |`,
         `| Model | ${r.provider} ${cell(r.model, secrets)}, effort ${r.effort} |`,
+        ...(r.lanes ? [`| Lanes | ${lanesCell(r.lanes, secrets)} |`] : []),
         ...(r.dedup ? [`| Finding dedup | ${dedupLine(r.dedup)} |`] : []),
         `| Usage | ${usageLine(r.spend, r.model, r.endedAt, r.price)} |`,
         ``,
     ];
     if (r.capture)
         lines.push(...captureSummaryLines(r.capture, secrets));
+    if (r.lanes && r.lanes.sessions.length > 0)
+        lines.push(...laneSummaryLines(r.lanes, secrets));
     if (defects.length > 0) {
         lines.push(`| Severity | Category | Finding | Page |`, `|---|---|---|---|`);
         for (const f of defects.slice(0, 50))
@@ -707,6 +779,22 @@ export function ciSummaryMarkdown(r, secrets = []) {
     lines.push(r.capture ? `The pictures are in shots/.` : `The full report, with repro steps and the gap ledger, is report.md.`, ``);
     return lines.join("\n");
 }
+function lanesCell(l, secrets) {
+    if (l.oneLoop)
+        return `${l.asked} asked; explored in one loop: ${cell(l.oneLoop, secrets)}`;
+    const ran = l.sessions.filter((s) => s.attached).length;
+    const planned = l.sessions.length;
+    return (`${ran} of ${l.asked} asked ran at once, sharing the caps below` +
+        (planned < l.asked ? `; the app split into ${planned}` : "") +
+        (ran < planned ? `; ${planned - ran} could not attach` : ""));
+}
+function laneSummaryLines(l, secrets) {
+    const out = [`| Lane | Owns | Routes | Turns | Tokens | Ended |`, `|---|---|---:|---:|---:|---|`];
+    for (const s of l.sessions)
+        out.push(`| ${cell(s.session, secrets)} | ${cell(s.modules.join(", "), secrets)} | ${s.routes} | ${s.turns} | ${n(s.usage.input + s.usage.output)} | ${s.stop}${s.stopDetail ? `: ${cell(s.stopDetail, secrets)}` : ""} |`);
+    out.push(``);
+    return out;
+}
 function captureSummaryLines(c, secrets) {
     const out = [`**Asked to show:** ${cell(c.what, secrets)}`, ``];
     if (c.status !== "captured")
@@ -781,6 +869,28 @@ export function ciSummaryJson(r, version, secrets = []) {
             ...(isWorthALook(f) ? { tier: "worth-a-look", convention: clean(f.convention ?? "") } : {}),
         })),
         ...(r.capture ? { capture: cleanCapture(r.capture, clean) } : {}),
+        ...(r.lanes ? { lanes: lanesJson(r.lanes, clean) } : {}),
+    };
+}
+/** The lanes as ci.json holds them. Module paths and lane names come from the app's routes: redacted like the rest. */
+function lanesJson(l, clean) {
+    return {
+        asked: l.asked,
+        planned: l.sessions.length,
+        ran: l.sessions.filter((s) => s.attached).length,
+        ...(l.oneLoop ? { oneLoop: clean(l.oneLoop) } : {}),
+        sessions: l.sessions.map((s) => ({
+            session: clean(s.session),
+            modules: s.modules.map(clean),
+            routes: s.routes,
+            attached: s.attached,
+            stop: s.stop,
+            ...(s.stopDetail ? { detail: clean(s.stopDetail) } : {}),
+            turns: s.turns,
+            inputTokens: s.usage.input,
+            cachedInputTokens: s.usage.cachedInput,
+            outputTokens: s.usage.output,
+        })),
     };
 }
 /** The capture as ci.json holds it: the words a person or a model wrote, and the URLs, passed through the same redaction as the rest. */
@@ -802,8 +912,13 @@ function appOrigin(url) {
         return url;
     }
 }
-/** This run's findings as SARIF 2.1.0: one rule per category, the finding's id as its fingerprint. */
-export function ciSarif(r, version, secrets = []) {
+/**
+ * This run's findings as SARIF 2.1.0: one rule per category, the finding's id
+ * as its fingerprint. Code scanning keeps only results located in a repository
+ * file, so each points at the anchor (sarif.ts) and carries its page as a
+ * logical location, in `properties.route` and in its message.
+ */
+export function ciSarif(r, version, secrets = [], anchor = SARIF_ANCHOR_FALLBACKS[0]) {
     const clean = (s) => redactKeys(redactSecrets(s), secrets);
     const categories = [...new Set(r.findings.map((f) => f.category))].sort();
     return {
@@ -820,19 +935,22 @@ export function ciSarif(r, version, secrets = []) {
                     },
                 },
                 invocations: [{ executionSuccessful: r.stop !== "provider-error" && r.stop !== "could-not-start", properties: { stop: r.stop } }],
-                originalUriBaseIds: { APP: { uri: `${appOrigin(r.url)}/` } },
-                results: r.findings.map((f) => ({
-                    ruleId: `finding/${f.category}`,
-                    level: isWorthALook(f) ? "note" : SARIF_LEVEL[f.severity],
-                    message: {
-                        text: isWorthALook(f)
-                            ? `Worth a look — ${clean(f.title)}. A defect only if your project uses ${clean(f.convention ?? "a convention")}.`
-                            : `[${f.severity}] ${clean(f.title)}${f.evidence ? ` — ${clean(f.evidence)}` : ""}`,
-                    },
-                    locations: [{ physicalLocation: { artifactLocation: { uri: clean(pathOf(f.url)).replace(/^\//, ""), uriBaseId: "APP" } } }],
-                    partialFingerprints: { "scenescoutFinding/v1": createHash("sha256").update(f.id).digest("hex").slice(0, 32) },
-                    ...(isWorthALook(f) ? { properties: { tier: "worth-a-look", convention: clean(f.convention ?? "") } } : {}),
-                })),
+                properties: { app: clean(appOrigin(r.url)) },
+                results: r.findings.map((f) => {
+                    const route = clean(pathOf(f.url));
+                    return {
+                        ruleId: `finding/${f.category}`,
+                        level: isWorthALook(f) ? "note" : SARIF_LEVEL[f.severity],
+                        message: {
+                            text: isWorthALook(f)
+                                ? `Worth a look — ${clean(f.title)} — on ${route}. A defect only if your project uses ${clean(f.convention ?? "a convention")}.`
+                                : `[${f.severity}] ${clean(f.title)}${f.evidence ? ` — ${clean(f.evidence)}` : ""} — on ${route}`,
+                        },
+                        locations: [sarifLocation(anchor, route)],
+                        partialFingerprints: { "scenescoutFinding/v1": createHash("sha256").update(f.id).digest("hex").slice(0, 32) },
+                        properties: { route, ...(isWorthALook(f) ? { tier: "worth-a-look", convention: clean(f.convention ?? "") } : {}) },
+                    };
+                }),
             },
         ],
     };

package/dist/engine/claims.js

@@ -99,7 +99,28 @@ const REFUSED_RE = /\b(?:refused|rejected|blocked)\b/i;
  * an error monitor, a heartbeat. Refusing one says nothing about whether the
  * change the user made was kept, so it is never paired with a success claim.
  */
-export const INFRASTRUCTURE_WRITE_RE = /\/auth\/(refresh|token|session)|refresh[-_]?token|\/telemetry|\/analytics|\/heartbeat|\/sentry|\/collect\b|\/logs?\b|\/metrics\b/i;
+export const INFRASTRUCTURE_WRITE_RE = /\/auth\/(refresh|token|session)|refresh[-_]?token|\/telemetry|\/analytics|\/heartbeat|\/sentry|\/envelope\b|client[-_]?errors?\b|\/collect\b|\/logs?\b|\/metrics\b/i;
+/**
+ * Whether a request is one the action being judged did not send (see
+ * `WatchedRequest.background`).
+ *
+ * Once a click has started loading a new document, what follows is not the
+ * click's own write. Requests the old page sends as it is left (a preference
+ * save on pagehide) belong to that page, and requests the new page sends as it
+ * loads (an error monitor, a visit beacon) are sent with no input on it yet.
+ * Neither is answered by anything on screen, and the new page's text is all
+ * new against the old page's, so paired they read every static "Completed" as
+ * a false success. The click's own writes come before the navigation starts:
+ * a script's save awaited before it moves the page, or the navigation itself
+ * when it is a native form post.
+ */
+export function isBackgroundRequest(t) {
+    if (t.inputSince === null || t.inputSince < t.actionStartedAt || t.started < t.inputSince)
+        return true;
+    if (t.isDocumentLoad)
+        return false;
+    return t.documentLoadSince !== null && t.started > t.documentLoadSince;
+}
 /** Whether a piece of announced text explains a refusal. */
 export function isRefusalNotice(text) {
     const trimmed = text.trim();
@@ -167,7 +188,7 @@ function admitsInAnnouncement(text) {
  * "Published", a heading, a row from earlier. Only what the action put up can
  * contradict what the action's write met. Without it, every text counts.
  */
-export function findContradictions(requests, page, before) {
+export function findContradictions(requests, page, before, acted) {
     const refused = requests.filter(isRefused);
     if (refused.length === 0)
         return [];
@@ -233,8 +254,140 @@ export function findContradictions(requests, page, before) {
             });
         }
     }
+    // No success word, but the control or a counter beside it shows the change
+    // as kept: an optimistic UI telling the same falsehood without words.
+    // Medium: the page never said "saved", and a reader may still notice a
+    // reload putting the old value back.
+    const change = acted && writes.length > 0 && kept.length === 0 && successAt < 0 ? keptChange(acted.before, acted.after) : null;
+    if (change) {
+        const worst = writes[0];
+        out.push({
+            kind: "false_success",
+            severity: "medium",
+            detail: `${say(worst)} was refused, and the page shows the change as kept (${change}) with no error. The user is told their change was kept when the server rejected it.${standIn(worst)}`,
+            evidence: `false-success-kept ${say(worst)}`,
+        });
+    }
     return out;
 }
+/** A counter: "1/3", "2 of 5", "40%". Not a date ("10/02/2026") nor a part of a longer number. */
+export const COUNTER_RE = /(?<![\d/.,:])(?:\d{1,4} ?(?:\/|of) ?\d{1,4}|\d{1,3} ?%)(?![\d/.,:])/i;
+/** The containers a counter must share with the control to count as its counter. */
+const CONTROL_CONTAINER_SEL = 'dialog, [role="dialog"], [role="alertdialog"], fieldset, form, [role="group"], [role="radiogroup"], [role="toolbar"], [role="region"], section, aside, [role="complementary"]';
+/** Most counters read for one control. */
+export const MAX_COUNTERS = 20;
+/**
+ * Page-side reader of an acted-on control: `(${ACTED_CONTROL_SRC})(node)`
+ * returns an ActedControl, or null for no node. A label stands for the box it
+ * labels. Shipped as a string for the same reason CLAIM_SCAN_SCRIPT is.
+ */
+export const ACTED_CONTROL_SRC = `(node) => {
+  if (!node) return null;
+  const visible = ${VISIBLE_SRC};
+  const box = (n) => n && n.tagName === "INPUT" && (n.type === "checkbox" || n.type === "radio");
+  const control = node.control || (box(node) ? node : node.querySelector && node.querySelector("input[type=checkbox], input[type=radio]")) || node;
+  const flag = (v) => (v === "true" ? true : v === "false" ? false : null);
+  const role = control.getAttribute("role") || (box(control) ? control.type : control.tagName.toLowerCase());
+  const counter = ${COUNTER_RE};
+  const counters = [];
+  const add = (t) => {
+    const text = (t || "").replace(/\\s+/g, " ").trim();
+    if (text && text.length <= 60 && counter.test(text) && !counters.includes(text) && counters.length < ${MAX_COUNTERS}) counters.push(text);
+  };
+  const near = control.closest(${JSON.stringify(CONTROL_CONTAINER_SEL)}) || (control.parentElement && control.parentElement.parentElement);
+  if (near) {
+    const walker = document.createTreeWalker(near, NodeFilter.SHOW_ELEMENT);
+    for (let el = near; el && counters.length < ${MAX_COUNTERS}; el = walker.nextNode()) {
+      let own = "";
+      for (const child of el.childNodes) if (child.nodeType === 3) own += child.nodeValue;
+      if (own.trim() && visible(el)) add(own);
+    }
+  }
+  for (const region of document.querySelectorAll("[role~='status'], [role~='alert'], [aria-live]:not([aria-live='off']), output")) {
+    if (visible(region)) add(region.innerText);
+  }
+  return {
+    role,
+    checked: box(control) ? control.checked : flag(control.getAttribute("aria-checked")),
+    pressed: flag(control.getAttribute("aria-pressed")),
+    selected: flag(control.getAttribute("aria-selected")),
+    counters,
+  };
+}`;
+/**
+ * How the acted-on control shows its change as kept, or null when it does not.
+ *
+ * A checked, pressed or selected state that moved is the change itself (a
+ * tab's selection is not: choosing a tab is moving around, not a change the
+ * user asked to keep). A counter beside it that moved ("0/3" to "1/3
+ * completed") counts it as done. A counter that merely appeared does not: a
+ * step that opens with "Step 1 of 3" counts nothing yet.
+ */
+export function keptChange(before, after) {
+    for (const state of ["checked", "pressed", "selected"]) {
+        if (state === "selected" && after.role === "tab")
+            continue;
+        const was = before[state];
+        const now = after[state];
+        if (was !== null && now !== null && was !== now)
+            return `the control is now ${now ? state : `not ${state}`}`;
+    }
+    const gone = before.counters.filter((c) => !after.counters.includes(c));
+    const fresh = after.counters.filter((c) => !before.counters.includes(c));
+    if (gone.length > 0 && fresh.length > 0)
+        return `${JSON.stringify(gone[0])} became ${JSON.stringify(fresh[0])}`;
+    return null;
+}
+/**
+ * Whether a submit-shaped click that sent no request was answered on the page
+ * anyway, judged from the page as the click began and as it settled.
+ *
+ * - A dialog opened: a step (a confirmation), not a submit.
+ * - A field became invalid, or the page announced something new that is not
+ *   a success claim: client-side validation said what was wrong, and no
+ *   request was expected. A new "Saved!" is the opposite, the very case the
+ *   silent-submit note is for, so it never counts.
+ *
+ * Null when either reading is missing or nothing visible answered.
+ */
+export function quietAnswer(before, after) {
+    if (!before || !after)
+        return null;
+    if ((after.dialogs ?? 0) > (before.dialogs ?? 0))
+        return "dialog";
+    if ((after.invalid ?? 0) > (before.invalid ?? 0))
+        return "validation";
+    const said = new Set(before.announced ?? []);
+    if ((after.announced ?? []).some((text) => !said.has(text) && classify(text) !== "success"))
+        return "validation";
+    return null;
+}
+/**
+ * Whether a piece of announced text (an alert's or a live region's name, as
+ * the snapshot lists it) was not on the page at `baseline`. The name may be a
+ * region's sentences run together and cut short, so it is matched by prefix
+ * either way against the baseline's texts and announced sentences. False
+ * when there is no baseline: nothing says when the text arrived.
+ */
+export function saidSince(text, baseline) {
+    if (!baseline)
+        return false;
+    const norm = (t) => t.replace(/\s+/g, " ").trim();
+    const said = norm(text);
+    if (!said)
+        return false;
+    for (const earlier of [...baseline.texts, ...(baseline.announced ?? [])]) {
+        const e = norm(earlier);
+        if (!e)
+            continue;
+        if (e === said)
+            return false;
+        const shorter = Math.min(e.length, said.length);
+        if (shorter >= 20 && (e.startsWith(said) || said.startsWith(e)))
+            return false;
+    }
+    return true;
+}
 /** Most announced regions read from one page. */
 export const MAX_ANNOUNCED = 40;
 /** Most pieces of text read from one page. A page with more than this has nothing useful to say in the extra ones. */
@@ -310,6 +463,9 @@ export const CLAIM_SCAN_SCRIPT = `(() => {
   // confirmation a router cancelled a route change for (oracles.ts).
   let dialogs = 0;
   for (const d of document.querySelectorAll(${JSON.stringify(DIALOG_SEL)})) if (visible(d)) dialogs += 1;
+  // Fields the page marked invalid, so a submit answered by validation is not called silent.
+  let invalid = 0;
+  for (const f of document.querySelectorAll('[aria-invalid="true"]')) if (visible(f)) invalid += 1;
 
-  return { texts, announced, emptyLists, dialogs };
+  return { texts, announced, emptyLists, dialogs, invalid };
 })()`;