scenescout 3.3.0 → 3.5.0

package/dist/engine/brief.js

@@ -92,8 +92,17 @@ export function planLanes(routes, laneCount, opts = {}) {
         objective: laneObjective(lane.modules, opts.goal),
         modules: lane.modules,
         routes: lane.routes,
+        landing: landingOf(lane.routes),
     }));
 }
+/**
+ * The first of a lane's routes a browser can open as it stands. A route the
+ * engine normalised (`/orders/:id`) is a pattern, not an address; a lane with
+ * nothing else lands on the app's root and navigates from there.
+ */
+export function landingOf(routes) {
+    return routes.find((r) => !/(^|\/)[:*]|\[[^\]]+\]/.test(r)) ?? "/";
+}
 function laneObjective(modules, goal) {
     const owned = modules.length === 1 ? modules[0] : `${modules.slice(0, -1).join(", ")} and ${modules[modules.length - 1]}`;
     const what = `Own ${owned}`;
@@ -114,19 +123,25 @@ export function formatBriefs(briefs, opts = {}) {
     const lines = [
         `LANE PLAN — ${briefs.length} lane(s) over ${briefs.reduce((n, b) => n + b.routes.length, 0)} route(s).`,
         ``,
-        `Give each lane its own agent. Every lane attaches with its own session name, so the browsers run genuinely in parallel:`,
-        `  scout_attach { session: "<lane>", url, projectPath, mode: "${mode}"${opts.role ? `, storageStatePath: "<${opts.role}>"` : ""}, objective: "<objective>" }`,
+        `Give each lane its own agent. Every lane attaches with its own session name, so the browsers run genuinely in parallel, and lands on its own first route rather than the home page:`,
+        `  scout_attach { session: "<lane>", url: "<origin><landing>", projectPath, mode: "${mode}"${opts.role ? `, storageStatePath: "<${opts.role}>"` : ""}, objective: "<objective>" }`,
         ``,
-        `Rules to pass on, both of which a hand-written brief tends to drop:`,
-        `  · A lane works ITS routes only. Two lanes auditing the same register while a third module is never opened is the failure this plan exists to prevent — and route coverage will look complete either way.`,
+        `Rules to pass on, which a hand-written brief tends to drop:`,
+        `  · A lane works ITS routes only. Two lanes auditing the same register while a third module is never opened is the failure this plan exists to prevent — and route coverage will look complete either way. A defect on a page it does not own is that page's lane's to file.`,
         `  · Every acting tool takes a \`task\`. A lane that acts with none is refused, and the person watching the live view would otherwise see a browser clicking through their app with nothing to say why.`,
-        `  · A lane reports back with scout_lane_report, not prose. Call scout_lane_report with no reply to get the instruction to put in its prompt.`,
+        `  · File each defect with scout_finding the moment it is judged, before writing the report. A defect only in the report is not in the run's report.`,
+        `  · Before calling a list empty, stale or stuck, read the status of the request behind it: a correct empty result and a failed one can render identically.`,
+        `  · On a create form, submit one markup-shaped value, then open where that record is listed. Any lane's session catches it rendering as markup, so the list may belong to another lane.`,
+        `  · When a control is withheld from this role, call the endpoint behind it with scout_request: hiding a button is not enforcing a rule. When a sort or filter runs, check the result is what it claims.`,
+        `  · Check scout_coverage before finishing.`,
+        `  · A lane reports back with scout_lane_report, not prose, and does NOT close its session: the planner folds the report, which checks each judged defect was filed, then closes it. Call scout_lane_report with no reply to get the instruction to put in its prompt.`,
         ``,
     ];
     for (const b of briefs) {
         lines.push(`── ${b.lane} ──`);
         lines.push(`objective: ${b.objective}`);
         lines.push(`owns: ${b.modules.join(", ")} (${b.routes.length} route(s))`);
+        lines.push(`landing: ${b.landing}`);
         lines.push(`routes: ${b.routes.slice(0, 20).join(", ")}${b.routes.length > 20 ? ` … and ${b.routes.length - 20} more` : ""}`);
         lines.push(``);
     }

package/dist/engine/browser.js

@@ -7,7 +7,7 @@ import { normalizeTask } from "./task.js";
 import { CLAIM_SCAN_SCRIPT, findContradictions } from "./claims.js";
 import { describeInjection, newInjections, probeQueries, probeScript, probeShape, rememberProbe } from "./injection.js";
 import { AuthLossTracker } from "./authloss.js";
-import { COLLECT_INTERACTABLES_SCRIPT, VISIBLE_SRC, geometryIssues, BROKEN_IMAGES_SCRIPT, brokenImageIssues, } from "./collector.js";
+import { COLLECT_INTERACTABLES_SCRIPT, VISIBLE_SRC, geometryIssues, BROKEN_IMAGES_SCRIPT, brokenImageIssues, displayName, missingName, } from "./collector.js";
 import { OracleMonitor, formatViolations } from "./oracles.js";
 import { extractCreatedIds, isOwnedResource, normalizeId } from "./ownership.js";
 import { formatJourney, measureJourney } from "./journey.js";
@@ -20,7 +20,7 @@ import { explainLaunchFailure, isMissingBrowser } from "./launch.js";
 import { ACTION_TIMEOUT_MS, performScroll, probeFocusIndicators, probeOverlays, scrollContainer } from "./probes.js";
 import { BROWSER_MARKER, reapOrphanBrowsers } from "./reaper.js";
 import { planUploadOptions, resolveDiskUpload } from "./uploads.js";
-import { destructiveRefusal, isDestructive, isDestructiveWire, allowsWrite, isAuthExempt } from "./policy.js";
+import { answersWithRefusal, destructiveRefusal, isDestructive, isDestructiveWire, allowsWrite, policyRefusal, isAuthExempt, } from "./policy.js";
 import { scanProject } from "../scan.js";
 import { analyzeDesign, DESIGN_COLLECT_SCRIPT } from "./design.js";
 import { acceptMatches, generatedUpload } from "./fixtures.js";
@@ -206,7 +206,7 @@ export class BrowserEngine {
         const list = this.newlyCreated.splice(0);
         return `\n(created: ${list.join(", ")} — this session may edit or delete ${list.length === 1 ? "it" : "them"})`;
     }
-    /** Design audits run this session — the report gate requires at least one. */
+    /** Design audits run by this session. The report gate counts the whole run's, on the shared store (MemoryStore.auditsThisRun). */
     designAuditCount = 0;
     /** Active task-efficiency measurement (scout_journey), if any. */
     journey = null;
@@ -240,8 +240,9 @@ export class BrowserEngine {
      *
      * The fetch runs IN the page, so it passes through the same interception the
      * write policy is enforced on: a safe-write session cannot reach past the
-     * policy by calling an endpoint instead of clicking it. The refusal comes
-     * back as the policy's own error, exactly as it would for a click.
+     * policy by calling an endpoint instead of clicking it. The policy answers
+     * the fetch with its stand-in 403, and the result says so rather than
+     * printing it as the server's status.
      */
     async apiRequest(input) {
         const page = this.requirePage();
@@ -260,23 +261,41 @@ export class BrowserEngine {
         let raw;
         try {
             raw = (await page.evaluate(script));
+            this.forgetReplay(method.method, target.url);
         }
         catch (err) {
-            // A blocked request rejects the fetch inside the page. That is the write
-            // policy doing its job, not an app fault, and it is reported as such.
+            // The page could not run the fetch at all (a navigation mid-call, a
+            // closed page). The policy answers rather than rejects, so this is not it.
             const message = err instanceof Error ? err.message : String(err);
             this.logAction({ action: "request", target: `${method.method} ${input.path}`, url: page.url(), result: `blocked: ${message.split("\n")[0]}` });
-            return `${method.method} ${input.path} — the request did not complete: ${message.split("\n")[0]}\nIn a write-limited mode this is usually the policy refusing it, which is the engine's safety net and not a finding about the app.`;
+            return `${method.method} ${input.path} — the request did not complete: ${message.split("\n")[0]}`;
         }
         const result = toReplayResult(raw);
         this.logAction({
             action: "request",
             target: `${method.method} ${input.path}`,
             url: page.url(),
-            result: replaySignature(method.method, result.url, result.status),
+            // Not a status signature: the trail must not record the stand-in as the server's answer.
+            result: result.refusedByPolicy ? `blocked: write policy (${result.refusedByPolicy})` : replaySignature(method.method, result.url, result.status),
         });
         return formatReplay(method.method, result);
     }
+    /**
+     * Take the replayed request back out of the contradiction ledger. It was the
+     * agent's call, not the page's, so whatever the page says next is not its
+     * answer — and left in, a replay the policy refused was blamed on the next
+     * click as that click's false success, in place of the click's own request.
+     * Only this request: anything else the page fetched meanwhile stays.
+     */
+    forgetReplay(method, url) {
+        for (let i = this.watchedResponses.length - 1; i >= 0; i -= 1) {
+            const r = this.watchedResponses[i];
+            if (r.method === method && r.url === url) {
+                this.watchedResponses.splice(i, 1);
+                return;
+            }
+        }
+    }
     /**
      * The frame field for a log entry, or nothing. Spread into logAction so a
      * caller that is not going through afterAction can still record what the
@@ -419,7 +438,8 @@ export class BrowserEngine {
     watchedResponses = [];
     static MAX_WATCHED_RESPONSES = 60;
     /**
-     * Requests the write policy aborted, by identity. The request event fires for
+     * Requests the write policy stopped, by identity — whether it dropped them or
+     * answered them with a stand-in refusal. The request event fires for
      * every non-GET the page ATTEMPTS, before the route handler decides its fate,
      * so without this the same DELETE was reported twice with opposite meanings:
      * "server state may have mutated despite read-only mode" and "WRITE-POLICY
@@ -427,11 +447,27 @@ export class BrowserEngine {
      * meet different fates, and a blocked /items/7/archive must not hide an
      * allowed POST /items that shares its prefix.
      */
-    abortedByPolicy = new WeakSet();
-    /** Markup-shaped values this session typed, so every later page can be checked for them rendering as elements. */
-    probes = [];
-    /** Injections already reported, by payload and route, so a page is not reported on every snapshot. */
-    injectionsReported = new Set();
+    refusedByPolicy = new WeakSet();
+    /**
+     * Markup-shaped values typed by any session of this run, so every later page
+     * — in this browser or another lane's — can be checked for them rendering as
+     * elements. On the shared MemoryStore, like ownership; local before attach.
+     */
+    get probes() {
+        return this.memory?.probes ?? this.localProbes;
+    }
+    set probes(list) {
+        if (this.memory)
+            this.memory.probes = list;
+        else
+            this.localProbes = list;
+    }
+    localProbes = [];
+    /** Injections already reported, by payload and route, so a page is not reported on every snapshot — nor by a second lane that opens it. */
+    get injectionsReported() {
+        return this.memory?.injectionsReported ?? this.localInjectionsReported;
+    }
+    localInjectionsReported = new Set();
     /**
      * Remember a typed value when it holds an element worth watching for. What
      * to type is the agent's choice; this only watches for the outcome. The
@@ -459,7 +495,7 @@ export class BrowserEngine {
      * element on the current page? Runs wherever violations are drained, so the
      * finding reaches the agent in the result of the action that revealed it.
      */
-    /** Record one answered request for the contradiction rules. Policy-aborted ones are marked, never dropped: the rules need to know they were ours. */
+    /** Record one answered request for the contradiction rules. Ones the policy stopped are marked, never dropped: the rules need to know they were ours. */
     watchResponse(req, status) {
         if (this.watchedResponses.length >= BrowserEngine.MAX_WATCHED_RESPONSES)
             return;
@@ -468,7 +504,7 @@ export class BrowserEngine {
             url: req.url(),
             status,
             resourceType: req.resourceType(),
-            blockedByPolicy: this.abortedByPolicy.has(req),
+            blockedByPolicy: this.refusedByPolicy.has(req),
         });
     }
     /**
@@ -507,18 +543,22 @@ export class BrowserEngine {
     contradictionsReported = new Set();
     async scanForInjections() {
         const page = this.page;
-        if (!page || page.isClosed() || this.probes.length === 0)
+        // One copy for the whole scan: the list is shared with every lane, and
+        // another lane typing a payload during the await below would shift the
+        // indices the hits are matched back to.
+        const probes = this.probes;
+        if (!page || page.isClosed() || probes.length === 0)
             return;
         const url = page.url();
         let hits;
         try {
-            hits = (await page.evaluate(probeScript(probeQueries(this.probes))));
+            hits = (await page.evaluate(probeScript(probeQueries(probes))));
         }
         catch {
             // A page mid-navigation has no DOM to ask; the next drain looks again.
             return;
         }
-        for (const found of newInjections(this.probes, hits, url, this.injectionsReported)) {
+        for (const found of newInjections(probes, hits, url, this.injectionsReported)) {
             this.oracles.noteInjection(describeInjection(found.probe, url, found.outer), url);
         }
     }
@@ -571,7 +611,7 @@ export class BrowserEngine {
             this.projectDirNote = ` (its real path could not be resolved: ${err instanceof Error ? err.message : String(err)} — a symlinked project path may be wrongly refused)`;
         }
         this.oracles = new OracleMonitor();
-        this.oracles.setPolicyAbortCheck((req) => this.abortedByPolicy.has(req));
+        this.oracles.setPolicyRefusalCheck((req) => this.refusedByPolicy.has(req));
         this.lastSnap = null;
         this.designAuditCount = 0;
         // The engine learns the route list itself so completion is an objective,
@@ -642,7 +682,7 @@ export class BrowserEngine {
             // not just looked at — the difference between visited and tested.
             //
             // Only for requests the policy will actually let through. This event
-            // fires BEFORE the route handler aborts a blocked one, so counting it
+            // fires BEFORE the route handler stops a blocked one, so counting it
             // here let a REFUSED destructive POST mark the route as mutated — a form
             // that was never submitted reading as tested, in read-only mode where by
             // definition nothing is.
@@ -711,11 +751,16 @@ export class BrowserEngine {
                     }
                     return route.continue();
                 }
+                const answered = answersWithRefusal(req.resourceType());
                 if (this.blockedRequests.length < 20)
-                    this.blockedRequests.push({ at: Date.now(), sig: `${method} ${url.slice(0, 140)}` });
+                    this.blockedRequests.push({ at: Date.now(), sig: `${method} ${url.slice(0, 140)}`, answered });
                 this.logAction({ action: "write-policy:blocked", target: `${method} ${pathname}`, url: this.page?.url() ?? "" });
-                this.abortedByPolicy.add(req);
+                this.refusedByPolicy.add(req);
                 this.oracles.notePolicyBlock();
+                // A script's request is answered with a refusal, so the page's handling
+                // of one actually runs; a navigation is dropped (policy.ts says why).
+                if (answered)
+                    return route.fulfill(policyRefusal(this.mode, method, pathname, req.headers()["origin"]));
                 return route.abort("blockedbyclient");
             });
         }
@@ -1036,7 +1081,7 @@ export class BrowserEngine {
                 memory.wasExercised(fp, el.key) ? "done" : null,
                 el.href ? `href=${el.href.slice(0, 60)}` : null,
             ].filter(Boolean);
-            return `${el.ref} ${el.role} "${el.name || "(unnamed)"}"${flags.length ? ` [${flags.join(", ")}]` : ""}`;
+            return `${el.ref} ${el.role} "${displayName(el)}"${flags.length ? ` [${flags.join(", ")}]` : ""}`;
         };
         // Diff mode: when re-snapshotting the same route, report only what
         // changed — same idea as UI reconciliation, applied to agent context.
@@ -1254,9 +1299,13 @@ export class BrowserEngine {
             .map((e) => this.lateMark(e))
             .join("; ");
         const extra = this.blockedRequests.length > 5 ? ` (+${this.blockedRequests.length - 5} more)` : "";
+        const answered = this.blockedRequests.some((e) => e.answered);
         this.blockedRequests = [];
         return (`\n🛡 WRITE-POLICY blocked (${this.mode}): ${list}${extra}. ` +
             `This is the tester's safety policy, NOT an app bug — do not file a finding for the resulting error UI. ` +
+            (answered
+                ? `The page's own requests were answered with a 403 in the server's place, so the page's handling of a refusal is real: an error message is correct, and a success message is a false_success violation. `
+                : "") +
             (this.mode === "observe"
                 ? `observe mode blocks every request that is not a GET, so no form submission reaches the server. Re-attach with mode="read-only" ONLY if the user confirms that ordinary form submissions are acceptable on this target.`
                 : this.mode === "read-only"
@@ -1281,7 +1330,7 @@ export class BrowserEngine {
         // to see the DUPLICATES that the reporting dedup below intentionally hides.
         this.lastActionMutationSigs = this.mutationRequests.map((e) => e.sig);
         const fresh = this.mutationRequests
-            .filter((entry) => !this.abortedByPolicy.has(entry.req))
+            .filter((entry) => !this.refusedByPolicy.has(entry.req))
             .filter((entry) => {
             const key = entry.sig.split("?")[0];
             if (this.reportedMutationSigs.has(key))
@@ -2009,7 +2058,7 @@ export class BrowserEngine {
             await this.scanForContradictions();
             const violations = this.oracles.drain();
             const deadEnd = elements.length === 0;
-            const unnamed = elements.filter((el) => !el.name).length;
+            const unnamed = elements.filter(missingName).length;
             const missingTestid = elements.filter((el) => !el.testid && !el.disabled).length;
             const flags = [loginRedirect ? "AUTH-REDIRECT" : null, deadEnd ? "DEAD-END" : null, violations.length > 0 ? `${violations.length}⚠` : null].filter(Boolean);
             summary.push(`${path} — ${status} · ${elements.length} el` +
@@ -2276,6 +2325,8 @@ export class BrowserEngine {
         const payload = (await page.evaluate(DESIGN_COLLECT_SCRIPT));
         payload.page.focusSamples = await probeFocusIndicators(page);
         this.designAuditCount += 1;
+        if (this.memory)
+            this.memory.auditsThisRun += 1;
         // The census is built from previous audits, so the first few pages of a run
         // score with chrome included and later ones don't. That is the same warm-up
         // the coverage census has: nothing is knowable as "shared" until it has been
@@ -2506,6 +2557,12 @@ export class BrowserEngine {
         }
     }
     async close() {
+        // Marks the end of the time this session held a browser, so the pace
+        // section can say how long it was held with nothing happening. Only when a
+        // browser is actually open: attach() closes first, and a close of nothing
+        // is not an event.
+        if (this.page)
+            this.logAction({ action: "close", url: this.page.isClosed() ? "" : this.page.url() });
         // Pending debounced coverage writes must land before the process can exit.
         try {
             this.memory?.flush();

package/dist/engine/calibration.js

@@ -0,0 +1,274 @@
+/**
+ * Whether a lane's confidence means anything.
+ *
+ * `lane.ts` tells every lane its confidence must be calibrated — "0.5 means a
+ * coin flip, 0.95 means you would bet on it" — and then the number was
+ * averaged into one line and thrown away. Nothing was stored, so nothing could
+ * ever be checked, and a confidence nobody checks is decoration. Decision-only
+ * models report an expected calibration error for exactly this reason; asking
+ * for calibration without measuring it is the half of the idea that costs
+ * nothing and buys nothing.
+ *
+ * WHAT THIS MEASURES, precisely, because the number is easy to over-read: a
+ * lane says "defect" about an observation and attaches a machine signature.
+ * The run either went on to file a finding carrying that signature or it did
+ * not. That is agreement between the lane and the bar the run actually
+ * applied — NOT ground truth about the app. A lane can be perfectly calibrated
+ * against a planner that files the wrong things. Where a finding has since
+ * been re-tested through `scout_verify`, the verdict is reported beside it,
+ * and that IS evidence about the app.
+ *
+ * Pure, so every rule here is table-tested.
+ */
+import { failingSignatures } from "./memory.js";
+/**
+ * Upper edge of each confidence bucket. Five is enough to see a shape and few
+ * enough that each holds a usable count on a run of a few dozen decisions;
+ * twenty buckets of one decision each measure nothing.
+ */
+export const BUCKET_EDGES = [0.2, 0.4, 0.6, 0.8, 1.0];
+/**
+ * Which bucket a confidence falls in. The top bucket is closed so 1.0 has
+ * somewhere to go.
+ *
+ * A value that is not a number lands in the LOWEST bucket, not the highest.
+ * The schema refuses those, but stored history is read back without one, and
+ * falling through the comparisons put a NaN in the 0.8–1.0 bucket — a
+ * confidence nobody stated, reported as near-certainty.
+ */
+export function bucketOf(confidence) {
+    if (!Number.isFinite(confidence))
+        return 0;
+    const c = Math.min(1, Math.max(0, confidence));
+    for (let i = 0; i < BUCKET_EDGES.length; i += 1) {
+        if (c <= BUCKET_EDGES[i])
+            return i;
+    }
+    return BUCKET_EDGES.length - 1;
+}
+export function bucketLabel(i) {
+    const low = i === 0 ? 0 : BUCKET_EDGES[i - 1];
+    return `${low.toFixed(1)}–${BUCKET_EDGES[i].toFixed(1)}`;
+}
+/**
+ * The keys a piece of evidence can be joined on, or nothing when it cannot be
+ * joined at all.
+ *
+ * Findings MERGE: the store treats `GET /api/things/3 500` and
+ * `GET /api/things/7 500` as one bug, because the path normalises to
+ * `/api/things/:id`. Joining on the literal string reported five lane
+ * decisions about one endpoint as one filed and four dropped — the lanes
+ * understated fivefold, and the number read as a finding about them rather
+ * than a bug in this join. So the join uses the store's own rule.
+ *
+ * Evidence carrying no failure signature returns NOTHING rather than falling
+ * back to its literal text. That fallback looked harmless and was the single
+ * worst thing here: `500 on GET /api/r0` — ordinary English, and whichever
+ * agent wrote the finding chose the word order — produced a key that matched
+ * nothing, and a lane that was right about a bug that WAS filed published an
+ * expected calibration error of 0.90. An unjoinable decision is now counted
+ * and disclosed as unjoinable, not scored as a lane being wrong.
+ */
+export function joinKeys(evidence) {
+    return failingSignatures(evidence);
+}
+/** A confidence as stored may be anything; the schema guards the wire, not the file. */
+function usableConfidence(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1 ? value : null;
+}
+/**
+ * Join lane decisions to what the run filed.
+ *
+ * Only a "defect" carrying a signature has a checkable outcome. An "unsure" is
+ * a request to look closer rather than a claim, and a decision with no
+ * signature cannot be joined to anything — counting either would measure the
+ * lane's willingness to attach evidence, not its judgement.
+ */
+export function calibrate(decisions, findings) {
+    const filedKeys = new Map();
+    for (const f of findings) {
+        if (!f.evidence)
+            continue;
+        // A finding verified as still present is the most informative match, so it
+        // wins a key two findings share; otherwise first write wins and the result
+        // does not depend on the order findings came back in.
+        for (const key of joinKeys(f.evidence)) {
+            const prev = filedKeys.get(key);
+            if (!prev || (f.verdict && f.verifiedAt && !(prev.verdict && prev.verifiedAt)))
+                filedKeys.set(key, f);
+        }
+    }
+    const claims = decisions.filter((d) => d.verdict === "defect" && d.evidence !== null);
+    const checkable = claims.filter((d) => usableConfidence(d.confidence) !== null && joinKeys(d.evidence).size > 0);
+    const unjoinable = claims.length - checkable.length;
+    if (checkable.length === 0)
+        return unjoinable > 0 ? { checkable: 0, filed: 0, stated: 0, buckets: [], ece: 0, verified: { present: 0, gone: 0, changed: 0 }, unjoinable } : null;
+    const buckets = BUCKET_EDGES.map(() => ({ n: 0, conf: 0, hits: 0 }));
+    const verified = { present: 0, gone: 0, changed: 0 };
+    const matched = new Map();
+    let filed = 0;
+    let stated = 0;
+    for (const d of checkable) {
+        let match;
+        for (const key of joinKeys(d.evidence)) {
+            match = filedKeys.get(key);
+            if (match)
+                break;
+        }
+        const hit = match !== undefined;
+        const confidence = usableConfidence(d.confidence);
+        const b = buckets[bucketOf(confidence)];
+        b.n += 1;
+        b.conf += confidence;
+        if (hit)
+            b.hits += 1;
+        if (hit)
+            filed += 1;
+        stated += confidence;
+        // By finding, not by decision: several decisions can match one finding,
+        // and this sentence counts findings.
+        if (match)
+            matched.set(match.id, match);
+    }
+    for (const f of matched.values()) {
+        // A verdict read from disk is not guaranteed to be one of the three.
+        if (f.verifiedAt && f.verdict && f.verdict in verified)
+            verified[f.verdict] += 1;
+    }
+    const n = checkable.length;
+    let ece = 0;
+    const out = [];
+    buckets.forEach((b, i) => {
+        if (b.n === 0)
+            return;
+        const meanConf = b.conf / b.n;
+        const rate = b.hits / b.n;
+        ece += (b.n / n) * Math.abs(meanConf - rate);
+        out.push({ label: bucketLabel(i), decisions: b.n, stated: meanConf, filed: rate });
+    });
+    return { checkable: n, filed, stated: stated / n, buckets: out, ece, verified, unjoinable };
+}
+const pct = (x) => `${Math.round(x * 100)}%`;
+/**
+ * The report section. It leads with what the number is not, because "ECE 0.24"
+ * above a table of percentages reads as a verdict on the app rather than on
+ * the lanes that judged it.
+ */
+export function formatCalibration(c) {
+    if (!c)
+        return [];
+    if (c.checkable < MIN_FOR_A_VERDICT) {
+        // Suppress the NUMBER, not the fact. A run that recorded seven decisions
+        // and a run that recorded none look identical when the section simply
+        // vanishes, and the reader concludes the feature is broken — which is this
+        // project's own definition of a silent path.
+        const had = c.checkable + c.unjoinable;
+        if (had === 0)
+            return [];
+        return [
+            `## How well the lanes judged`,
+            ``,
+            `Not enough to say yet: ${c.checkable} lane decision(s) could be checked${c.unjoinable > 0 ? ` (and ${c.unjoinable} could not be looked up at all)` : ""}, ` +
+                `and ${MIN_FOR_A_VERDICT} are needed before a calibration figure survives one of them changing.`,
+            ``,
+        ];
+    }
+    const lines = [
+        `## How well the lanes judged`,
+        ``,
+        `${c.checkable} lane decision(s) called a defect on an endpoint that failed; ${c.filed} of them match a finding this project holds (${pct(c.filed / c.checkable)}), ` +
+            `against a mean stated confidence of ${c.stated.toFixed(2)}.`,
+        ``,
+        `**What this is not.** It covers the project's whole history, not this run, and it measures agreement between the lanes and the bar this project applies — not whether the app is broken. ` +
+            `A lane can be perfectly calibrated against a planner that files the wrong things. Two things also count against a lane through no fault of its own: a defect filed with no machine signature, ` +
+            `and a finding whose signature was dropped when the store merged it into another. Read the figure as an ordering, not a measurement.`,
+        ``,
+        `| Stated confidence | Decisions | Said | Filed |`,
+        `|---|---:|---:|---:|`,
+    ];
+    for (const b of c.buckets) {
+        lines.push(`| ${b.label} | ${b.decisions} | ${b.stated.toFixed(2)} | ${pct(b.filed)} |`);
+    }
+    lines.push(``, `Expected calibration error **${c.ece.toFixed(2)}** — the gap between what the lanes said and what happened, weighted by bucket. ${readEce(c.ece)}`);
+    if (c.unjoinable > 0) {
+        lines.push(``, `${c.unjoinable} further decision(s) called a defect but named no failing endpoint, so nothing could be looked up for them. They are excluded above rather than counted as wrong.`);
+    }
+    const seen = c.verified.present + c.verified.gone + c.verified.changed;
+    if (seen > 0) {
+        lines.push(``, `${seen} of the findings those decisions matched ${seen === 1 ? "has" : "have"} since been re-tested with \`scout_verify\`: ${c.verified.present} still present, ${c.verified.gone} gone, ${c.verified.changed} changed. ` +
+            `Those verdicts are evidence about the app, unlike the table above. Findings no lane decision matched are not counted here, so this will not agree with the re-tested column elsewhere in the report.`);
+    }
+    lines.push(``);
+    return lines;
+}
+/** Below this, the number swings on a single decision and is worse than no number. */
+export const MIN_FOR_A_VERDICT = 8;
+/**
+ * What the figure suggests, hedged on purpose. The join loses decisions it
+ * cannot key and findings whose signature a merge discarded, and both push the
+ * error upward — so a confident "these numbers are wrong" can itself be wrong.
+ */
+function readEce(ece) {
+    if (ece <= 0.05)
+        return "The lanes' numbers track what happened closely.";
+    if (ece <= 0.15)
+        return "Close enough to compare lanes by.";
+    return "Far enough apart that a lane's confidence is worth reading as an ordering rather than a rate — after checking the exclusions above, which push this upward.";
+}
+/** Most unfiled defects named when a lane report is folded; the rest are counted. */
+export const MAX_UNFILED_NAMED = 10;
+/**
+ * The defects a lane judged that no finding in the store covers yet.
+ *
+ * A lane's report is a verdict, not a filing: a defect it judged and never
+ * passed to scout_finding never reaches the report. That happened in a
+ * measured run — a covered Save button, judged a defect at 0.75 and filed by
+ * nobody — and it is cheapest to catch at the moment the planner folds the
+ * report, while the lane's session is still open.
+ *
+ * Matched on the store's failing-endpoint signature where the evidence has
+ * one, and on the evidence text otherwise. The text match is what the
+ * calibration join refuses, because there a miss is scored against the lane;
+ * here a miss only asks someone to check, which costs a look and nothing more.
+ */
+export function unfiledDefects(decisions, findings) {
+    const keys = new Set();
+    const texts = [];
+    for (const f of findings) {
+        if (!f.evidence)
+            continue;
+        for (const key of joinKeys(f.evidence))
+            keys.add(key);
+        texts.push(squash(f.evidence));
+    }
+    const out = [];
+    for (const d of decisions) {
+        if (d.verdict !== "defect")
+            continue;
+        if (d.evidence) {
+            const joined = [...joinKeys(d.evidence)];
+            if (joined.some((k) => keys.has(k)))
+                continue;
+            // A failing-endpoint signature is the store's own identity for a bug. When
+            // the decision has one and no finding shares it, text overlap is not a
+            // match: "GET /api/items" inside "... GET /api/items returned 500" is.
+            if (joined.length > 0) {
+                out.push(`${d.observation} — ${d.evidence}`);
+                continue;
+            }
+            const text = squash(d.evidence);
+            if (text && texts.some((t) => t === text || contains(t, text) || contains(text, t)))
+                continue;
+        }
+        out.push(d.evidence ? `${d.observation} — ${d.evidence}` : d.observation);
+    }
+    return out;
+}
+/** One signature inside another, when the inner one is long enough to mean something: "404" is inside half the findings in a run. */
+function contains(outer, inner) {
+    return inner.length >= MIN_CONTAINED && outer.includes(inner);
+}
+const MIN_CONTAINED = 12;
+function squash(text) {
+    return text.toLowerCase().replace(/\s+/g, " ").trim();
+}

package/dist/engine/claims.js

@@ -41,7 +41,7 @@ const WRITING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 const DATA_RESOURCES = new Set(["xhr", "fetch", "document"]);
 /** Whether this request is one whose refusal the page should be admitting to. */
 export function isRefused(req) {
-    if (req.blockedByPolicy)
+    if (req.blockedByPolicy && req.status === null)
         return false;
     if (!DATA_RESOURCES.has(req.resourceType))
         return false;
@@ -100,6 +100,12 @@ function shortUrl(url) {
 function say(req) {
     return `${req.method} ${shortUrl(req.url)} ${req.status === null ? "failed" : req.status}`;
 }
+/** Said after a contradiction whose refusal the write policy wrote, so nobody goes looking for it in the server's logs. */
+function standIn(req) {
+    return req.blockedByPolicy
+        ? ` The refusal was the write policy's stand-in (the server never received the request); what failed is the page's handling of a refusal, which a real one would meet the same way.`
+        : "";
+}
 /**
  * The contradictions this action produced, if any.
  *
@@ -125,7 +131,8 @@ export function findContradictions(requests, page) {
         out.push({
             kind: "refused_empty",
             detail: `${say(worst)} was refused, and the page shows ${how} with no error. ` +
-                `The user is told there is nothing to see when the truth is that nothing could be loaded.`,
+                `The user is told there is nothing to see when the truth is that nothing could be loaded.` +
+                standIn(worst),
             evidence: `refused-empty ${say(worst)}`,
         });
     }
@@ -135,7 +142,7 @@ export function findContradictions(requests, page) {
         const message = page.texts[claims.indexOf("success")];
         out.push({
             kind: "false_success",
-            detail: `${say(worst)} was refused, and the page says ${JSON.stringify(message.trim().slice(0, 80))}. The user is told their change was kept when the server rejected it.`,
+            detail: `${say(worst)} was refused, and the page says ${JSON.stringify(message.trim().slice(0, 80))}. The user is told their change was kept when the server rejected it.${standIn(worst)}`,
             evidence: `false-success ${say(worst)}`,
         });
     }

package/dist/engine/collector.js

@@ -276,6 +276,23 @@ export const COLLECT_INTERACTABLES_SCRIPT = `(() => {
   }
   return out;
 })()`;
+/**
+ * Roles that announce content rather than take input: a live region is empty
+ * until it has something to say, and ARIA does not require it to have a name.
+ * Reporting an empty status line as an unnamed control sent lanes to file it
+ * as an accessibility defect — twice in one measured run.
+ */
+const LIVE_REGION_ROLES = new Set(["status", "alert", "log", "timer", "marquee"]);
+/** Whether an element with this role and no accessible name is an unnamed control, as opposed to a live region with nothing in it yet. */
+export function missingName(el) {
+    return !el.name && !LIVE_REGION_ROLES.has(el.role);
+}
+/** How the snapshot shows an element's name: an empty live region says so rather than reading as an unnamed control. */
+export function displayName(el) {
+    if (el.name)
+        return el.name;
+    return LIVE_REGION_ROLES.has(el.role) ? "(empty live region)" : "(unnamed)";
+}
 /**
  * Deterministic geometry oracles — the checks people reach for screenshots to
  * do, computed from layout boxes instead: interactables rendered fully outside