scenescout 3.17.0 → 3.18.0

package/dist/engine/collector.js

@@ -39,6 +39,25 @@ export const XPATH_OF_SRC = `(el) => {
     }
     return "/html/" + parts.join("/");
   }`;
+/**
+ * What one descendant of a control says toward the control's name, as
+ * page-side source, in the order the accessible-name computation reads it
+ * when a name comes from content: its aria-label; for an <img>, its alt text,
+ * and when that is empty or missing, its title (an avatar with alt="" and a
+ * title names the link around it); for an <svg>, its <title>. Anything else
+ * says nothing. Kept apart from NAME_FACTS_SRC so the order can be
+ * table-tested without a browser (contentSays).
+ */
+export const CONTENT_SAYS_SRC = `(d) => {
+    if (d.ariaLabel && d.ariaLabel.trim()) return d.ariaLabel;
+    if (d.tag === "img") return d.alt && d.alt.trim() ? d.alt : d.title;
+    if (d.tag === "svg") return d.svgTitle;
+    return "";
+  }`;
+/** CONTENT_SAYS_SRC run outside a page, from the same source the page runs. */
+export function contentSays(facts) {
+    return new Function(`return (${CONTENT_SAYS_SRC});`)()(facts);
+}
 /**
  * What an element's accessible name is read from, as page-side source: every
  * candidate source, read from the DOM and nothing decided. PICK_NAME_SRC
@@ -48,31 +67,45 @@ export const XPATH_OF_SRC = `(el) => {
  * holds the control, and a select's options or a textarea's contents are not
  * its label.
  *
- * `content` is what the element's image content says, which the text cannot
- * hold: the alt text of the first descendant <img>, else the aria-label or
- * <title> of a descendant <svg> or role="img", in document order, skipping
- * anything inside an aria-hidden part of the element.
+ * `content` is what the element's content says that its text cannot hold:
+ * the first descendant, in document order, that CONTENT_SAYS_SRC finds a word
+ * in (an aria-label, an image's alt or title, an svg's <title>), skipping
+ * anything inside an aria-hidden part of the element. `content2` is what the
+ * same content said under name rule 2 (memory.ts NAME_RULE), which read only
+ * an <img>'s alt and an <svg>'s or role="img"'s aria-label or <title>: it is
+ * read so a control renamed since keeps its coverage.
  */
 export const NAME_FACTS_SRC = `(el) => {
     const tag = el.tagName.toLowerCase();
     const role = el.getAttribute("role") || "";
     const inputType = tag === "input" ? el.type : "";
-    const byId = (id) => { const n = document.getElementById(id); return n ? n.textContent || "" : ""; };
+    const byId = (id) => { const n = (el.ownerDocument || document).getElementById(id); return n ? n.textContent || "" : ""; };
     const labels = [];
     for (const label of Array.from(el.labels || [])) {
       const own = label.contains(el) ? el.textContent || "" : "";
       labels.push((label.textContent || "").replace(own, ""));
     }
+    const says = ${CONTENT_SAYS_SRC};
     let content = "";
-    for (const d of el.querySelectorAll("img, svg, [role='img']")) {
+    let content2 = "";
+    for (const d of el.querySelectorAll("img, svg, [role='img'], [aria-label]")) {
       const hidden = d.closest('[aria-hidden="true"]');
       if (hidden && el.contains(hidden)) continue;
-      const title = d.tagName.toLowerCase() === "svg" ? d.querySelector(":scope > title") : null;
-      const said = (d.tagName === "IMG" ? d.getAttribute("alt") : d.getAttribute("aria-label") || (title ? title.textContent : "")) || "";
-      if (said.trim()) {
-        content = said;
-        break;
+      const svgTitle = d.tagName.toLowerCase() === "svg" ? d.querySelector(":scope > title") : null;
+      const said = says({
+        tag: d.tagName.toLowerCase(),
+        ariaLabel: d.getAttribute("aria-label"),
+        alt: d.getAttribute("alt"),
+        title: d.getAttribute("title") || "",
+        svgTitle: svgTitle ? svgTitle.textContent || "" : "",
+      });
+      if (!content && said.trim()) content = said;
+      // Name rule 2, frozen: what this content said before a descendant's aria-label and an image's title counted.
+      if (!content2 && d.matches("img, svg, [role='img']")) {
+        const said2 = (d.tagName === "IMG" ? d.getAttribute("alt") : d.getAttribute("aria-label") || (svgTitle ? svgTitle.textContent : "")) || "";
+        if (said2.trim()) content2 = said2;
       }
+      if (content && content2) break;
     }
     const live = /^(status|alert|log|timer|marquee)$/.test(role) || tag === "output" ||
       (el.hasAttribute("aria-live") && el.getAttribute("aria-live") !== "off");
@@ -91,6 +124,7 @@ export const NAME_FACTS_SRC = `(el) => {
       live,
       text: el.innerText || el.textContent || "",
       content,
+      content2,
     };
   }`;
 /**
@@ -105,15 +139,18 @@ export const NAME_FACTS_SRC = `(el) => {
  * fallback stays.
  *
  * - A select is never named by its options: their text is its value, not its name.
- * - Other elements are named by their text; with none, by their image content
+ * - Other elements are named by their text; with none, by their content
  *   (a link holding only a logo with alt text, a button holding only an svg
- *   with a <title>); and with neither, by title (an icon-only button with a
- *   tooltip). Text and image content are not joined: a control with both is
- *   named by its text, as it was before image content counted.
- * - A name taken from image content carries `prior`, the name the rule gave
- *   before image content counted (the title, or nothing). The name is half of
- *   the coverage key, so the key under the earlier rule is kept beside the new
- *   one and coverage recorded under it carries over (memory.ts keyAliases).
+ *   with a <title>, a link around an icon element with an aria-label or an
+ *   avatar with a title); and with neither, by title (an icon-only button
+ *   with a tooltip). Text and content are not joined: a control with both is
+ *   named by its text, as it was before content counted.
+ * - A name taken from content carries `priors`, the name each earlier rule
+ *   gave (memory.ts NAME_RULE), rule 1 first: rule 1 read no content (the
+ *   title, or nothing), rule 2 read only image content. The name is half of
+ *   the coverage key, so the key under each earlier rule is kept beside the
+ *   new one and coverage recorded under it carries over (memory.ts keyAliases,
+ *   ruleKeyAliases).
  * - A live region (status, alert, log, timer, an aria-live region, <output>)
  *   is named by the text it announces, which is what matters after an action.
  * - A whitespace-only aria-label ends the name with nothing, as it always has
@@ -145,7 +182,11 @@ export const PICK_NAME_SRC = `(f) => {
       return { name: (clean(f.nameAttr) || t || f.tag).slice(0, 80), from: "fallback" };
     }
     if (clean(f.text)) return named(clean(f.text));
-    if (clean(f.content)) return { ...named(clean(f.content)), prior: clean(f.title).slice(0, 80) };
+    if (clean(f.content)) {
+      // The name under rule 1 (no content) and under rule 2 (content2), so coverage keys can be carried across.
+      const title = clean(f.title).slice(0, 80);
+      return { ...named(clean(f.content)), priors: [title, clean(f.content2) ? clean(f.content2).slice(0, 80) : title] };
+    }
     return named(clean(f.title));
   }`;
 /**
@@ -656,7 +697,7 @@ export const COLLECT_INTERACTABLES_SCRIPT = `(() => {
       name: named.name,
       ...policyText(el),
       nameFrom: named.from,
-      ...(named.prior !== undefined ? { priorName: named.prior } : {}),
+      ...(named.priors ? { priorNames: named.priors } : {}),
       testid: el.getAttribute("data-testid"),
       interactive,
       affords: affords && (affords.tabStop || affords.clickHandler || affords.pointer) ? affords : null,

package/dist/engine/crawl.js

@@ -47,3 +47,40 @@ export function crawlLine(o, counts, flags) {
         (counts.unnamed ? ` · ${counts.unnamed} unnamed` : "") +
         (allFlags.length ? ` · ${allFlags.join(" ")}` : ""));
 }
+/** The media types a browser renders as a page: anything else a route answers with is a file, a feed or data. */
+export const PAGE_MEDIA_TYPES = ["text/html", "application/xhtml+xml"];
+/**
+ * A Content-Type header's media type, lowercased and without its parameters
+ * ("text/HTML; charset=utf-8" → "text/html"); undefined when there is none.
+ */
+export function mediaTypeOf(header) {
+    const type = (header ?? "").split(";")[0].trim().toLowerCase();
+    return type === "" ? undefined : type;
+}
+/**
+ * Whether a route's document answered as something other than a page: an RSS
+ * or Atom feed, XML, JSON, plain text, a PDF, an image. Decided from the
+ * response's content type, not the path, because a feed at `/feed`, a licence
+ * file or a raw-file view has no extension to give it away, and a path ending
+ * `.xml` can be served as HTML. Such a route has no controls by nature, so the
+ * page rules (a dead end among them) do not apply to it, and it is not a page
+ * for the route count. Only a response that succeeded counts: the body of a
+ * 4xx or 5xx describes the error, not the route, and the error is reported as
+ * the route's own. A response with no content type is read as a page, the
+ * behaviour before the type was consulted.
+ */
+export function isNonPageResource(r) {
+    if (r.status === null || r.status >= 400)
+        return false;
+    return isFileMediaType(r.contentType);
+}
+/**
+ * Whether a response's content type names something other than a page, whatever
+ * its status. A browser may take such a response as a download and fail the
+ * navigation, so this is what says the route answered (with its status) rather
+ * than failed to load.
+ */
+export function isFileMediaType(contentType) {
+    const type = mediaTypeOf(contentType);
+    return type !== undefined && !PAGE_MEDIA_TYPES.includes(type);
+}

package/dist/engine/design.js

@@ -22,6 +22,32 @@
  * controls, visible keyboard focus.
  */
 import { missingName, NAME_SRC, placeholderOnly } from "./collector.js";
+/**
+ * The control a Tab press focused, as the focus-indicator rule measures it. It runs
+ * page-side (probes.ts embeds its source), so it is plain JavaScript once compiled.
+ *
+ * A Tab that lands on an iframe or frame moves focus into the frame's document: the
+ * frame element is not the control the user sees focused, and its own outline staying
+ * the same says nothing. So the walk follows focus into a same-origin frame and returns
+ * the element focused there. It returns "frame" when focus is inside a frame it cannot
+ * follow (another site's, whose document is not readable) or a frame whose document has
+ * nothing focused: that press is skipped, not sampled. It returns null when nothing in
+ * the page is focused, which ends the sampling.
+ */
+export function focusedControl(doc) {
+    let d = doc;
+    let el = d.activeElement;
+    while (el && /^i?frame$/i.test(el.tagName)) {
+        const inner = el.contentDocument ?? null;
+        if (!inner)
+            return "frame";
+        d = inner;
+        el = inner.activeElement;
+    }
+    if (!el || el === d.body || el === d.documentElement)
+        return d === doc ? null : "frame";
+    return el;
+}
 /**
  * Whether some text names a filter or a facet, as page-side source: one of its
  * words, split at camelCase and punctuation, is filter(s) or facet(s). Whole
@@ -63,20 +89,47 @@ export const DESIGN_COLLECT_SCRIPT = `(() => {
     const p = parseColor(c);
     return p ? "rgba(" + p[0] + ", " + p[1] + ", " + p[2] + ", " + p[3] + ")" : "unknown";
   };
+  // Replaced content that paints pixels the audit cannot read: an <img>,
+  // <picture>, <video> or <canvas>, often absolutely positioned under a hero
+  // heading as a sibling or cousin of the text rather than its ancestor.
+  let media = null;
+  const mediaUnder = (el, within) => {
+    if (media === null) media = Array.from(document.querySelectorAll("img, picture, video, canvas")).slice(0, 300);
+    const r = el.getBoundingClientRect();
+    const cx = r.left + r.width / 2, cy = r.top + r.height / 2;
+    for (const m of media) {
+      // The text's own subtree holds inline icons, not its background; and an
+      // image outside the opaque ancestor the text sits on is treated as hidden
+      // behind it. An opaque overlay that is NOT an ancestor (a sibling scrim)
+      // is not seen, so text on it over an image is skipped, not measured.
+      if (el.contains(m) || (within && !within.contains(m))) continue;
+      const mr = m.getBoundingClientRect();
+      if (mr.width === 0 || mr.height === 0 || cx < mr.left || cx > mr.right || cy < mr.top || cy > mr.bottom) continue;
+      const ms = window.getComputedStyle(m);
+      if (ms.visibility === "hidden" || ms.display === "none" || ms.opacity === "0") continue;
+      return true;
+    }
+    return false;
+  };
   // Effective background: COMPOSITE translucent ancestor layers (a chip with
   // rgba(...,0.12) over white is nearly white — treating it as opaque produces
   // false WCAG failures). Stops at the first opaque layer; white fallback.
+  // "image" when an ancestor's background-image or a media element under the
+  // text's centre paints behind it: no single colour stands for that, so the
+  // contrast check skips it rather than report a ratio against the page.
   const effBg = (el) => {
     const layers = [];
     let node = el;
+    let opaque = null;
     for (let i = 0; node && i < 20; i++, node = node.parentElement) {
       const s = window.getComputedStyle(node);
       if (s.backgroundImage && s.backgroundImage !== "none") return "image";
       const c = parseColor(s.backgroundColor);
       if (!c || c[3] === 0) continue;
       layers.push(c);
-      if (c[3] >= 1) break;
+      if (c[3] >= 1) { opaque = node; break; }
     }
+    if (mediaUnder(el, opaque)) return "image";
     let base = [255, 255, 255];
     for (let i = layers.length - 1; i >= 0; i--) {
       const [r, g, b, a] = layers[i];
@@ -264,7 +317,7 @@ export const DESIGN_COLLECT_SCRIPT = `(() => {
     if (img.naturalWidth <= 1 || img.naturalHeight <= 1 || r.width < 24 || r.height < 24) continue;
     const tid = img.getAttribute("data-testid");
     const label = tid ? "[" + tid + "]" : (img.getAttribute("alt") || (img.getAttribute("src") || "").split("/").pop() || "img").slice(0, 40);
-    images.push({ label, nw: img.naturalWidth, nh: img.naturalHeight, rw: Math.round(r.width), rh: Math.round(r.height) });
+    images.push({ label, nw: img.naturalWidth, nh: img.naturalHeight, rw: Math.round(r.width), rh: Math.round(r.height), fit: window.getComputedStyle(img).objectFit || "fill" });
   }
   const page = {
     scrollW: Math.max(document.documentElement.scrollWidth, document.body ? document.body.scrollWidth : 0),
@@ -574,6 +627,20 @@ export function spacedApart(r, others) {
 export function tooSmall(r, all) {
     return undersized(r) && !spacedApart(r, all);
 }
+/** Past this, a stretched image reads as distorted rather than as rounding. */
+export const ASPECT_TOLERANCE = 0.12;
+/**
+ * How far an image is stretched out of its proportions, or null when it is not.
+ * Only `fill`, the default, stretches the picture to its box: `cover` and `contain`
+ * scale it uniformly and crop or letterbox, `none` draws it at its own size and
+ * `scale-down` is one of those two. So a mismatched box is distortion only under `fill`.
+ */
+export function aspectDistortion(img) {
+    if (img.fit !== "fill")
+        return null;
+    const off = Math.abs(img.rw / img.rh / (img.nw / img.nh) - 1);
+    return off > ASPECT_TOLERANCE ? off : null;
+}
 /**
  * Reduce raw style records + page facts to a judgeable design digest + score.
  *
@@ -884,7 +951,10 @@ export function analyzeDesign(payload, viewport, chromeKeys = new Set()) {
     if (affordances.length > 0)
         sections.push(`AFFORDANCES:\n` + affordances.map((s) => `  ${s}`).join("\n"));
     // ---- 12. IMAGES: aspect-ratio distortion (rendered box fights the source's proportions).
-    const distorted = page.images.map((img) => ({ img, off: Math.abs(img.rw / img.rh / (img.nw / img.nh) - 1) })).filter(({ off }) => off > 0.12);
+    const distorted = page.images.flatMap((img) => {
+        const off = aspectDistortion(img);
+        return off === null ? [] : [{ img, off }];
+    });
     if (distorted.length > 0) {
         sections.push(`IMAGES (${distorted.length} distorted):\n` +
             distorted

package/dist/engine/fingerprint.js

@@ -177,6 +177,22 @@ export function keyAliases(bases) {
     });
     return out;
 }
+/**
+ * keyAliases for every step between name rules, from each element's base key
+ * under each rule, rule 1 first and the current rule last: rule r (from 2)
+ * → the step's aliases, current key under r → key under r - 1. A step that
+ * renamed nothing is left out.
+ */
+export function keyAliasSteps(bases) {
+    const rules = bases.length > 0 ? bases[0].byRule.length : 0;
+    const out = {};
+    for (let i = 1; i < rules; i++) {
+        const step = keyAliases(bases.map((b) => ({ base: b.byRule[i], prior: b.byRule[i - 1], tracked: b.tracked })));
+        if (Object.keys(step).length > 0)
+            out[i + 1] = step;
+    }
+    return out;
+}
 /**
  * Fingerprint a UI state: normalized route + hash of the set of interactable
  * element classes. Same page with different data → same fingerprint; a page

package/dist/engine/memory.js

@@ -7,9 +7,11 @@ import { addReading, addVerdict, MAX_TICKETS_KEPT, mergeTicketData } from "./tic
 /**
  * The element-name rule current keys are made under. 2: a link or button with
  * no text is named by its image content (an <img>'s alt text, an <svg>'s
- * aria-label or <title>) before its title attribute.
+ * aria-label or <title>) before its title attribute. 3: that content also
+ * counts a descendant's aria-label and an <img>'s title when its alt is empty
+ * (collector.ts CONTENT_SAYS_SRC).
  */
-export const NAME_RULE = 2;
+export const NAME_RULE = 3;
 /**
  * The kinds a finding can be. One list: scout_finding's input schema, the lane
  * report a parallel agent hands back, and the skill text all read it from
@@ -278,6 +280,20 @@ export function rekeyed(elements, aliases) {
     }
     return out;
 }
+/** A route's aliases for the step that leads to `rule`: key under rule - 1 → key under rule. */
+function stepAliases(data, rule, route) {
+    return rule === 2 ? data.keyAliases?.[route] : data.ruleKeyAliases?.[String(rule)]?.[route];
+}
+/**
+ * A state's elements moved from the keys of name rule `from` to those of rule
+ * `to`, one step at a time, each through the route's aliases for that step.
+ */
+function keysUnderRule(elements, from, to, data, route) {
+    let out = elements;
+    for (let rule = from + 1; rule <= to; rule++)
+        out = rekeyed(out, stepAliases(data, rule, route));
+    return out;
+}
 /**
  * Fold another process's memory into ours, losing nothing from either side.
  *
@@ -300,6 +316,15 @@ export function mergeMemory(mine, theirs) {
     }
     if (Object.keys(out.keyAliases).length === 0)
         delete out.keyAliases;
+    out.ruleKeyAliases = {};
+    for (const rule of new Set([...Object.keys(theirs.ruleKeyAliases ?? {}), ...Object.keys(mine.ruleKeyAliases ?? {})])) {
+        const step = { ...(theirs.ruleKeyAliases?.[rule] ?? {}) };
+        for (const [route, aliases] of Object.entries(mine.ruleKeyAliases?.[rule] ?? {}))
+            step[route] = { ...aliases, ...(step[route] ?? {}) };
+        out.ruleKeyAliases[rule] = step;
+    }
+    if (Object.keys(out.ruleKeyAliases).length === 0)
+        delete out.ruleKeyAliases;
     out.states = { ...theirs.states };
     for (const [fp, ours] of Object.entries(mine.states)) {
         const other = theirs.states[fp];
@@ -308,10 +333,10 @@ export function mergeMemory(mine, theirs) {
             continue;
         }
         const nameRule = Math.max(ours.nameRule ?? 0, other.nameRule ?? 0);
-        // When one side is under the current name rule and the other is not, the
-        // other's keys are moved to current ones before the union, as a revisit
-        // moves them (MemoryStore visitState).
-        const current = (side) => nameRule >= NAME_RULE && (side.nameRule ?? 1) < NAME_RULE ? rekeyed(side.elements, out.keyAliases?.[routeIdentity(side.route)]) : side.elements;
+        // When one side is under a later name rule than the other, the other's
+        // keys are moved to that rule's before the union, as a revisit moves them
+        // (MemoryStore visitState).
+        const current = (side) => keysUnderRule(side.elements, side.nameRule ?? 1, Math.max(nameRule, 1), out, routeIdentity(side.route));
         const elements = { ...current(other) };
         for (const [key, el] of Object.entries(current(ours))) {
             const prev = elements[key];
@@ -384,6 +409,7 @@ export function mergeMemory(mine, theirs) {
     const unionRecord = (a, b) => (a || b ? { ...(b ?? {}), ...(a ?? {}) } : undefined);
     out.discoveredRoutes = unionRecord(mine.discoveredRoutes, theirs.discoveredRoutes);
     out.attemptedRoutes = unionRecord(mine.attemptedRoutes, theirs.attemptedRoutes);
+    out.resourceRoutes = unionRecord(mine.resourceRoutes, theirs.resourceRoutes);
     out.designElements = unionRecord(mine.designElements, theirs.designElements);
     out.pageScores = { ...(theirs.pageScores ?? {}) };
     for (const [route, score] of Object.entries(mine.pageScores ?? {})) {
@@ -1289,6 +1315,31 @@ export class MemoryStore {
     get discoveredRoutes() {
         return this.data.discoveredRoutes ?? {};
     }
+    /**
+     * Record that a route answered with a feed, a file or data (crawl.ts
+     * isNonPageResource). A route harvested from a link joins the contract before
+     * anything knows what it serves; this takes it back out, for every role and
+     * every later run, so a feed linked from every page is not a gap forever.
+     */
+    markResource(route, mediaType) {
+        const map = this.data.resourceRoutes ?? {};
+        if (map[route] !== mediaType) {
+            map[route] = mediaType;
+            this.data.resourceRoutes = map;
+            this.save();
+        }
+    }
+    /** A route that has since answered as a page is one again: back into the contract. */
+    clearResource(route) {
+        const map = this.data.resourceRoutes;
+        if (map && route in map) {
+            delete map[route];
+            this.save();
+        }
+    }
+    get resourceRoutes() {
+        return this.data.resourceRoutes ?? {};
+    }
     /**
      * Record that a route was attempted but landed elsewhere (e.g. auth-redirect).
      *
@@ -1827,9 +1878,10 @@ export class MemoryStore {
      * listed keys a user cannot act on (collector inertKeys): they stay known,
      * so a click on one still registers, but coverage does not count them.
      * `session` names who visited, for this run's per-session coverage.
-     * `aliases` maps a listed key to the key the same control had under the
-     * earlier name rule (fingerprint.ts keyAliases); the route keeps them so
-     * states written before the rule changed are read under current keys.
+     * `aliases` maps, for each step between name rules, a listed key to the
+     * key the same control had under the rule before (KeyAliasSteps); the route
+     * keeps them so states written before a rule changed are read under
+     * current keys.
      */
     visitState(fingerprint, url, route, elementKeys, inertKeys = [], session, aliases = {}) {
         this.runStates.add(fingerprint);
@@ -1856,7 +1908,7 @@ export class MemoryStore {
         // named like a text button beside it) leaves it unchanged. Its keys are
         // moved to the current ones before it is marked current.
         if ((rec.nameRule ?? 1) < NAME_RULE)
-            rec.elements = rekeyed(rec.elements, this.data.keyAliases?.[routeIdentity(route)]);
+            rec.elements = keysUnderRule(rec.elements, rec.nameRule ?? 1, NAME_RULE, this.data, routeIdentity(route));
         rec.nameRule = NAME_RULE;
         const present = new Set(elementKeys);
         const inert = new Set(inertKeys);
@@ -1888,16 +1940,18 @@ export class MemoryStore {
      * hand out ordinals differently, and the states written under the earlier
      * rule do not change, so neither should what their keys are read as.
      */
-    learnAliases(route, aliases) {
-        const pairs = Object.entries(aliases);
-        if (pairs.length === 0)
-            return;
-        const byRoute = (this.data.keyAliases ??= {});
+    learnAliases(route, steps) {
         const id = routeIdentity(route);
-        const known = (byRoute[id] ??= {});
-        for (const [key, prior] of pairs)
-            if (!Object.hasOwn(known, prior))
-                known[prior] = key;
+        for (const [rule, aliases] of Object.entries(steps)) {
+            const pairs = Object.entries(aliases);
+            if (pairs.length === 0)
+                continue;
+            const byRoute = rule === "2" ? (this.data.keyAliases ??= {}) : ((this.data.ruleKeyAliases ??= {})[rule] ??= {});
+            const known = (byRoute[id] ??= {});
+            for (const [key, prior] of pairs)
+                if (!Object.hasOwn(known, prior))
+                    known[prior] = key;
+        }
     }
     markExercised(fingerprint, key, action) {
         const rec = this.data.states[fingerprint];
@@ -2265,7 +2319,7 @@ export class MemoryStore {
             const route = routeIdentity(rec.route);
             const keys = only && !only.has(fp) ? null : bucket(listed, route);
             // A state written under an earlier name rule is read under current keys.
-            const elements = (rec.nameRule ?? 1) < NAME_RULE ? rekeyed(rec.elements, this.data.keyAliases?.[route]) : rec.elements;
+            const elements = keysUnderRule(rec.elements, rec.nameRule ?? 1, NAME_RULE, this.data, route);
             for (const [key, v] of Object.entries(elements)) {
                 if (v.inert)
                     bucket(inert, route).add(key);

package/dist/engine/policy.js

@@ -887,6 +887,37 @@ export function matchReadPost(entries, appUrl, url) {
     const segments = target.pathname.split("/").filter(Boolean);
     return (entries.find((e) => (e.origin ?? app) === target.origin && e.segments.length === segments.length && e.segments.every((seg, i) => seg === "*" || seg === segments[i])) ?? null);
 }
+/**
+ * The page a script's POST was sent from, for the gap ledger's list of pages
+ * observe refused a POST on. The Referer of a request the top document sent,
+ * when it is a page of the app; otherwise the page the session drives when the
+ * request is seen. A frame's Referer is its own document, which the session
+ * never navigates to, so the caller passes none for a frame's request.
+ *
+ * The Referer comes first because the session's page URL can lag: a page's
+ * script can send its first request before the browser has told Playwright
+ * that the page committed, so the session still reports the page it came
+ * from. A Referer that is the app's bare origin is set aside for the session's
+ * page: an app whose referrer policy sends only the origin would otherwise
+ * charge every page's POST to "/". The price is that the app's root page,
+ * whose own Referer is that bare origin, still relies on the session's page
+ * URL, lag and all.
+ */
+export function refusedPostPage(appUrl, referer, pageUrl) {
+    if (!referer)
+        return pageUrl;
+    let from;
+    try {
+        from = new URL(referer);
+        if (from.origin !== new URL(appUrl).origin)
+            return pageUrl;
+    }
+    catch {
+        return pageUrl;
+    }
+    const bareOrigin = from.pathname === "/" && !from.search;
+    return bareOrigin && pageUrl ? pageUrl : referer;
+}
 /** The longest body read for a GraphQL operation; a longer one cannot be vetted and is refused. */
 export const MAX_READ_POST_BODY = 100_000;
 /** A GraphQL operation that writes: `mutation` or `subscription`, then an optional name, then its variables, directives or selection. */