scenescout 3.3.0 → 3.5.0

package/dist/engine/lane.js

@@ -90,12 +90,21 @@ export const LaneReport = z
         seen.add(d.observation);
     });
 });
-const FENCE_OPEN = /^```[a-z]*\s*\n/i;
-const FENCE_CLOSE = /\n?```\s*$/;
+const FENCE_OPEN = /^```[a-z]*\s*\r?\n/i;
+const FENCE_CLOSE = /\r?\n?```\s*$/;
+/** Every fenced block in a reply, with its contents. */
+const FENCED_BLOCK = /```[a-z]*[ \t]*\r?\n([\s\S]*?)\r?\n?```/gi;
 /**
  * The reply is one JSON object and nothing else. A fenced block around it is
- * tolerated, because every model has been trained to add one; text before or
- * after it is not, because the point is that no one has to read the reply.
+ * tolerated, because every model has been trained to add one.
+ *
+ * Prose around ONE fenced JSON block is tolerated too, and dropped unread. The
+ * rule used to refuse it, and in a measured run six of eight lanes did it
+ * anyway: each refusal cost the planner a round trip or a hand-unwrap, to
+ * recover an object that was already unambiguous. The point — nobody has to
+ * READ the reply — survives, because the prose is never looked at. Unfenced
+ * prose is still refused, because where the object starts and ends is then a
+ * guess, and so is more than one fenced object.
  * The reason names what was wrong, since the planner relays it to the lane.
  *
  * With `expectedLane`, a report that names another lane is refused: the
@@ -104,13 +113,19 @@ const FENCE_CLOSE = /\n?```\s*$/;
  */
 export function parseLaneReport(text, expectedLane) {
     let body = text.trim();
-    if (FENCE_OPEN.test(body)) {
-        if (!FENCE_CLOSE.test(body))
-            return { ok: false, reason: "the closing ``` must end the reply, with no text after it" };
+    let aroundIgnored = false;
+    if (FENCE_OPEN.test(body) && FENCE_CLOSE.test(body) && [...body.matchAll(FENCED_BLOCK)].length === 1) {
         body = body.replace(FENCE_OPEN, "").replace(FENCE_CLOSE, "").trim();
     }
-    if (!body.startsWith("{"))
-        return { ok: false, reason: "the reply must be one JSON object, with no text before it" };
+    else if (!body.startsWith("{")) {
+        const objects = [...body.matchAll(FENCED_BLOCK)].map((m) => m[1].trim()).filter((b) => b.startsWith("{"));
+        if (objects.length > 1)
+            return { ok: false, reason: `the reply holds ${objects.length} fenced JSON blocks; hand back exactly one object` };
+        if (objects.length === 0)
+            return { ok: false, reason: "the reply must be one JSON object, with no text before it" };
+        body = objects[0];
+        aroundIgnored = true;
+    }
     let raw;
     try {
         raw = JSON.parse(body);
@@ -129,7 +144,7 @@ export function parseLaneReport(text, expectedLane) {
     if (expectedLane !== undefined && result.data.lane !== expectedLane) {
         return { ok: false, reason: `the report names lane "${result.data.lane}", but this reply was asked of lane "${expectedLane}"` };
     }
-    return { ok: true, report: result.data };
+    return { ok: true, report: result.data, aroundIgnored };
 }
 /**
  * The paragraph the planner puts in every lane's prompt. It is generated from
@@ -138,14 +153,28 @@ export function parseLaneReport(text, expectedLane) {
  */
 export function laneReportInstruction(lane) {
     return [
-        "Reply with ONE JSON object and nothing else — no prose before or after it, no explanation, no headings. A fenced ```json block is fine.",
-        `Shape: {"lane":${JSON.stringify(lane)},"status":<${quoteAll(LANE_STATUSES)}>,"decisions":[…],"routes":[…],"blocked_by":<string or null>}.`,
-        `Each decision: {"observation":<a short id for what was observed, unique in the report, at most ${LANE_OBSERVATION_MAX} characters>,"verdict":<${quoteAll(LANE_VERDICTS)}>,"severity":<${quoteAll(LANE_SEVERITIES)} or null>,"category":<${quoteAll(LANE_CATEGORIES)} or null>,"confidence":<0..1>,"evidence":<machine signature such as "GET /api/things 500", or null>}.`,
-        `A "defect" must carry a severity and a category. "evidence" is a signature, not a sentence: at most ${LANE_EVIDENCE_MAX} characters. "confidence" is how sure you are of the verdict, calibrated: 0.5 means a coin flip, 0.95 means you would bet on it.`,
-        `"routes" lists the routes you covered, each at most ${LANE_ROUTE_MAX} characters. "blocked_by" is one line of at most ${LANE_BLOCKED_BY_MAX} characters saying what stopped you: required when the status is "blocked", allowed with "partial", null with "complete"; the detail belongs in a finding. The lane name is at most ${LANE_NAME_MAX} characters. At most ${LANE_MAX_ITEMS} decisions and ${LANE_MAX_ITEMS} routes. Unknown keys are refused.`,
-        "The object IS your final report: whatever hands it back must hand back the object verbatim, not a summary of it.",
+        ...LANE_RUBRIC,
+        // The ONLY lane-specific sentence, and it comes last on purpose. Every
+        // lane in a wave is given the same rubric, so keeping it byte-identical up
+        // to here makes it one shared prompt prefix: the cache hits from the
+        // second lane onward instead of diverging at the first sentence, which is
+        // what putting the name in the shape line used to do.
+        `Your lane name is ${JSON.stringify(lane)}; put exactly that in "lane".`,
     ].join(" ");
 }
+/**
+ * Everything every lane is told, identical for all of them. Built once from
+ * the same constants the parser enforces, because a limit a lane is not told
+ * refuses good replies.
+ */
+const LANE_RUBRIC = [
+    "Reply with ONE JSON object and nothing else — no prose before or after it, no explanation, no headings. A fenced ```json block is fine; anything outside it is discarded unread, so put nothing there you want kept.",
+    `Shape: {"lane":<your lane name>,"status":<${quoteAll(LANE_STATUSES)}>,"decisions":[…],"routes":[…],"blocked_by":<string or null>}.`,
+    `Each decision: {"observation":<a short id for what was observed, unique in the report, at most ${LANE_OBSERVATION_MAX} characters>,"verdict":<${quoteAll(LANE_VERDICTS)}>,"severity":<${quoteAll(LANE_SEVERITIES)} or null>,"category":<${quoteAll(LANE_CATEGORIES)} or null>,"confidence":<0..1>,"evidence":<machine signature such as "GET /api/things 500", or null>}.`,
+    `A "defect" must carry a severity and a category. "evidence" is a signature, not a sentence: at most ${LANE_EVIDENCE_MAX} characters. "confidence" is how sure you are of the verdict, calibrated: 0.5 means a coin flip, 0.95 means you would bet on it.`,
+    `"routes" lists the routes you covered, each at most ${LANE_ROUTE_MAX} characters. "blocked_by" is one line of at most ${LANE_BLOCKED_BY_MAX} characters saying what stopped you: required when the status is "blocked", allowed with "partial", null with "complete"; the detail belongs in a finding. The lane name is at most ${LANE_NAME_MAX} characters. At most ${LANE_MAX_ITEMS} decisions and ${LANE_MAX_ITEMS} routes. Unknown keys are refused.`,
+    "The object IS your final report: whatever hands it back must hand back the object verbatim, not a summary of it.",
+];
 function quoteAll(values) {
     return values.map((v) => `"${v}"`).join("|");
 }

package/dist/engine/memory.js

@@ -250,8 +250,39 @@ export function mergeMemory(mine, theirs) {
     }
     if (Object.keys(out.roleAccess).length === 0)
         delete out.roleAccess;
+    // Lanes commonly run in SEPARATE processes — that is the point of a lane —
+    // so without this the spread at the top would keep one process's decisions
+    // and drop every other lane's, which is the exact bug this merge exists to
+    // prevent for findings. Keyed so merging the same foreign document twice is
+    // idempotent.
+    const byDecision = new Map();
+    for (const d of theirs.laneDecisions ?? [])
+        byDecision.set(decisionKey(d), d);
+    for (const d of mine.laneDecisions ?? [])
+        byDecision.set(decisionKey(d), d);
+    out.laneDecisions = [...byDecision.values()].sort((a, b) => a.at.localeCompare(b.at)).slice(-MAX_LANE_DECISIONS);
+    if (out.laneDecisions.length === 0)
+        delete out.laneDecisions;
     return out;
 }
+/**
+ * What makes two stored decisions the same judgement.
+ *
+ * Deliberately NOT the timestamp. `at` is stamped when the planner folds the
+ * reply, not when the lane judged, so relaying one reply twice — which the
+ * protocol invites, since a refused report is asked for again — wrote every
+ * decision a second time and doubled the lane's weight in the calibration.
+ * Identity is what was decided, so re-folding the same reply is a no-op.
+ */
+function decisionKey(d) {
+    return [d.lane, d.observation, d.verdict, d.severity ?? "", d.category ?? "", d.confidence, d.evidence ?? ""].join("|");
+}
+/**
+ * Most lane decisions kept. Calibration wants a few dozen; a long-lived
+ * project would otherwise accumulate every decision ever made and re-serialise
+ * them on each save, which is what made an old history slow to open.
+ */
+export const MAX_LANE_DECISIONS = 1000;
 const MAX_DISCOVERED_ROUTES = 300;
 /** Shared finding-similarity helpers (used by live dedup and retro-merge). */
 function findingTokens(s) {
@@ -295,7 +326,22 @@ function findingLiterals(...texts) {
  * (`/api/users/7` and `/api/users/9` are one endpoint) so a per-record repro
  * does not read as a per-record bug.
  */
-function endpointSignatures(evidence) {
+/**
+ * The signatures that identify a BUG: only those carrying a failure status.
+ *
+ * A bare `POST /api/orders` says which endpoint was involved, not what went
+ * wrong — a double submit and an accepted negative quantity both name it, and
+ * are two bugs. Exported so calibration applies the store's own rule instead
+ * of a second copy of this regex, which is what it had.
+ */
+export function failingSignatures(evidence) {
+    return new Set([...endpointSignatures(evidence)].filter((sig) => /\s[45]\d{2}$/.test(sig)));
+}
+/**
+ * The endpoint signatures a piece of evidence names: method + normalised path,
+ * with the failure status when one follows.
+ */
+export function endpointSignatures(evidence) {
     const out = new Set();
     if (!evidence)
         return out;
@@ -338,11 +384,10 @@ function sharesEndpointSignature(a, b) {
     // `POST /api/orders` (the endpoint answered 2xx, or no status was named)
     // says which endpoint was involved, not what went wrong: a double submit
     // and an accepted negative quantity both name it, and are two bugs.
-    const failing = (evidence) => new Set([...endpointSignatures(evidence)].filter((sig) => /\s[45]\d{2}$/.test(sig)));
-    const aSigs = failing(a.evidence);
+    const aSigs = failingSignatures(a.evidence);
     if (aSigs.size === 0)
         return false;
-    for (const sig of failing(b.evidence))
+    for (const sig of failingSignatures(b.evidence))
         if (aSigs.has(sig))
             return true;
     return false;
@@ -522,6 +567,35 @@ export class MemoryStore {
     ownedIds = new Map();
     /** Human-readable creation log for this run — becomes the report's cleanup list. */
     createdResources = [];
+    /**
+     * Markup-shaped values any session of this run typed, and the injections
+     * already reported. Shared for the same reason ownership is: a parallel run
+     * splits the app by route, so the lane that types a payload into a create
+     * form is rarely the lane that opens the list rendering it, and a probe kept
+     * per session could only ever catch a reflected injection. Not persisted: a
+     * payload typed in an earlier run is not this run's evidence.
+     */
+    probes = [];
+    injectionsReported = new Set();
+    /**
+     * Design audits any session of this run performed. The report's gate asked
+     * the session that happened to call scout_report, so a run whose lanes
+     * audited every page was refused because the planner's own session had not.
+     * Not persisted: an audit from an earlier run does not satisfy this one.
+     */
+    auditsThisRun = 0;
+    /**
+     * End the run: forget what only this run's sessions know. Called when the
+     * last session on this project closes. The store itself outlives it — the
+     * server keeps one per project for the life of the process — so without
+     * this, a second run in the same process passed the audit gate on the first
+     * run's audit and stayed silent about an injection the first run reported.
+     */
+    endRun() {
+        this.probes = [];
+        this.injectionsReported.clear();
+        this.auditsThisRun = 0;
+    }
     constructor(projectDir) {
         this.dir = path.join(projectDir, MEMORY_DIRNAME);
         this.legacyDirNote = adoptLegacyMemoryDir(projectDir);
@@ -782,6 +856,45 @@ export class MemoryStore {
         fs.writeFileSync(this.assumptionsPath, content);
         return true;
     }
+    /** What the lanes decided, oldest first. Empty on a project that has never run one. */
+    get laneDecisions() {
+        return this.data.laneDecisions ?? [];
+    }
+    /**
+     * Record what a lane decided. Called once per accepted lane report, so the
+     * confidence it stated can be checked later against what the run filed.
+     * Free text from the lane is redacted like every other stored string: an
+     * observation is written by a model reading the app under test.
+     */
+    addLaneDecisions(lane, decisions) {
+        if (decisions.length === 0)
+            return 0;
+        const list = this.data.laneDecisions ?? [];
+        const seen = new Set(list.map(decisionKey));
+        let added = 0;
+        for (const d of decisions) {
+            const record = {
+                ...d,
+                lane,
+                observation: redactSecrets(d.observation).slice(0, 200),
+                evidence: d.evidence === null ? null : redactSecrets(d.evidence).slice(0, 200),
+            };
+            if (seen.has(decisionKey(record)))
+                continue;
+            seen.add(decisionKey(record));
+            list.push(record);
+            added += 1;
+        }
+        this.data.laneDecisions = list.slice(-MAX_LANE_DECISIONS);
+        if (added > 0)
+            this.flush();
+        // What survives the cap. Appends go to the tail and the cap keeps the
+        // tail, so all of `added` survives unless the call itself exceeds the cap.
+        // Measuring it as growth instead looked right and was not: `list` aliases
+        // the stored array, so the "before" length was read after the appends and
+        // every call after the first reported nothing kept — while storing fine.
+        return Math.min(added, MAX_LANE_DECISIONS);
+    }
     /** Mark a finding resolved; returns it or null. */
     resolveFinding(id) {
         const f = this.data.findings.find((x) => x.id === id);

package/dist/engine/oracles.js

@@ -17,7 +17,8 @@ export const POLICY_BLOCK_WINDOW_MS = 2000;
  * block rather than something the app did?
  *
  * Aborting a request makes the browser print a console error, and — when the
- * app does not catch the rejection — raise a page error. Left in, a report
+ * app does not catch the rejection — raise a page error. Answering one with the
+ * policy's stand-in 403 makes the browser print its "status of 403" line. Left in, a report
  * lists the tool's own safety net as defects of the app under test. (The
  * failed REQUEST itself is matched exactly, by request identity, in the
  * monitor; these two carry no request to match on, so they are attributed by
@@ -32,7 +33,7 @@ export function isPolicyInduced(v, msSincePolicyBlock) {
         return false;
     if (v.kind !== "page_error" && v.kind !== "console_error")
         return false;
-    return /ERR_BLOCKED_BY_CLIENT|Failed to fetch|NetworkError when attempting to fetch|Load failed/i.test(v.detail);
+    return /ERR_BLOCKED_BY_CLIENT|Failed to fetch|NetworkError when attempting to fetch|Load failed|the server responded with a status of 403\b/i.test(v.detail);
 }
 /**
  * Invariant oracles: passive listeners that record violations regardless of
@@ -74,7 +75,7 @@ export class OracleMonitor {
                 return;
             if (BENIGN_URL_RE.test(req.url()))
                 return;
-            if (this.abortedByPolicy(req)) {
+            if (this.refusedByPolicy(req)) {
                 this.policyAttributed += 1;
                 return;
             }
@@ -93,6 +94,12 @@ export class OracleMonitor {
             // reported here on every page load teaches the driver to ignore http_error.
             if (BENIGN_URL_RE.test(res.url()))
                 return;
+            // The write policy's own stand-in refusal, matched by request identity
+            // like a dropped one: the server never said this.
+            if (this.refusedByPolicy(res.request())) {
+                this.policyAttributed += 1;
+                return;
+            }
             // 401/403 are often expected (auth probes); still report, but as medium.
             this.record({
                 kind: "http_error",
@@ -113,7 +120,7 @@ export class OracleMonitor {
      */
     static MAX_REPORTED_SIGS = 5000;
     lastPolicyBlockAt = null;
-    abortedByPolicy = () => false;
+    refusedByPolicy = () => false;
     /**
      * Errors attributed to the write policy's own blocks and therefore not
      * recorded as violations. Counted, so a report can say how many there were:
@@ -121,11 +128,11 @@ export class OracleMonitor {
      * errors look the same.
      */
     policyAttributed = 0;
-    /** The engine knows exactly which requests it aborted; failed requests are matched against that, not against wording. */
-    setPolicyAbortCheck(check) {
-        this.abortedByPolicy = check;
+    /** The engine knows exactly which requests its policy stopped; failed requests and stand-in refusals are matched against that, not against wording. */
+    setPolicyRefusalCheck(check) {
+        this.refusedByPolicy = check;
     }
-    /** Called by the engine when the write policy aborts a request, so the errors that abort causes are not held against the app. */
+    /** Called by the engine when the write policy stops a request (dropped or answered), so the errors that causes are not held against the app. */
     notePolicyBlock() {
         this.lastPolicyBlockAt = Date.now();
     }

package/dist/engine/pace.js

@@ -4,7 +4,7 @@
  * counting them inflates the action count and drags the median gap toward
  * zero. One real run logged 325 entries of which 107 were stated tasks.
  */
-const MARKER_ACTIONS = new Set(["task", "attach", "created-resource", "journey:start", "journey:end", "record:full", "record:failed"]);
+const MARKER_ACTIONS = new Set(["task", "attach", "close", "created-resource", "journey:start", "journey:end", "record:full", "record:failed"]);
 /** Whether a log entry represents work the browser actually did. */
 export function isActing(action) {
     return !MARKER_ACTIONS.has(action);
@@ -27,23 +27,37 @@ function median(sorted) {
 export function measurePace(log, nowMs, attached = []) {
     const stillOpen = new Set(attached);
     const bySession = new Map();
+    const lifecycle = new Map();
     for (const entry of log) {
-        if (!isActing(entry.action))
-            continue;
         const name = entry.session ?? "default";
-        const list = bySession.get(name);
+        const into = isActing(entry.action) ? bySession : entry.action === "attach" || entry.action === "close" ? lifecycle : null;
+        if (!into)
+            continue;
+        const list = into.get(name);
         if (list)
             list.push(entry);
         else
-            bySession.set(name, [entry]);
+            into.set(name, [entry]);
     }
+    // A session that attached and never acted still held a browser.
+    for (const name of lifecycle.keys())
+        if (!bySession.has(name))
+            bySession.set(name, []);
     const sessions = [];
     let first = Number.POSITIVE_INFINITY;
     let last = 0;
     for (const [session, entries] of bySession) {
-        const times = entries.map((e) => Date.parse(e.at)).filter((t) => Number.isFinite(t));
-        if (times.length === 0)
+        const times = entries
+            .map((e) => Date.parse(e.at))
+            .filter((t) => Number.isFinite(t))
+            .sort((a, b) => a - b);
+        const heldIdleMs = heldIdle(lifecycle.get(session) ?? [], times, nowMs, stillOpen.has(session));
+        if (times.length === 0) {
+            if (heldIdleMs > 0) {
+                sessions.push({ session, actions: 0, spanMs: 0, medianGapMs: 0, maxGapMs: 0, idleShare: 0, quietMs: 0, framed: 0, heldIdleMs });
+            }
             continue;
+        }
         times.sort((a, b) => a - b);
         first = Math.min(first, times[0]);
         last = Math.max(last, times[times.length - 1]);
@@ -61,6 +75,7 @@ export function measurePace(log, nowMs, attached = []) {
             idleShare: spanMs > 0 ? idleMs / spanMs : 0,
             quietMs: Math.max(0, nowMs - times[times.length - 1]),
             framed: entries.filter((e) => e.frame).length,
+            heldIdleMs,
         });
     }
     sessions.sort((a, b) => b.actions - a.actions);
@@ -75,6 +90,37 @@ export function measurePace(log, nowMs, attached = []) {
         quiet: sessions.filter((s) => s.quietMs > STALE_SESSION_MS && stillOpen.has(s.session)).map((s) => s.session),
     };
 }
+/**
+ * Idle time at the edges of each attach: attach to first action, last action
+ * to close. An attach with no close after it ends at the next attach, or at
+ * now while the session is still open. A log written before close was
+ * recorded has no close marker; its closed sessions count no trailing idle,
+ * because when they closed is unknown.
+ */
+function heldIdle(markers, actionTimes, nowMs, stillOpen) {
+    const events = markers
+        .map((m) => ({ kind: m.action, at: Date.parse(m.at) }))
+        .filter((e) => Number.isFinite(e.at))
+        .sort((a, b) => a.at - b.at);
+    let idle = 0;
+    for (let i = 0; i < events.length; i += 1) {
+        if (events[i].kind !== "attach")
+            continue;
+        const start = events[i].at;
+        const next = events.slice(i + 1).find((e) => e.kind === "attach" || e.kind === "close");
+        const end = next ? next.at : stillOpen ? nowMs : null;
+        const inside = actionTimes.filter((t) => t >= start && (end === null || t <= end));
+        if (inside.length === 0) {
+            if (end !== null)
+                idle += end - start;
+            continue;
+        }
+        idle += inside[0] - start;
+        if (end !== null)
+            idle += end - inside[inside.length - 1];
+    }
+    return Math.max(0, idle);
+}
 /** Milliseconds as a person says them: 45s, 4m12s, 1h03m. */
 export function sayDuration(ms) {
     const total = Math.max(0, Math.round(ms / 1000));
@@ -96,13 +142,13 @@ export function formatPace(pace) {
     const lines = [
         `## How the run was paced`,
         ``,
-        `${pace.actions} action(s) over ${sayDuration(pace.spanMs)}. Stated tasks and attaches are not counted: they take no time. Idle share is time the browser stood still waiting for the agent, not time the engine spent working.`,
+        `${pace.actions} action(s) over ${sayDuration(pace.spanMs)}. Stated tasks and attaches are not counted: they take no time. Idle share is time the browser stood still waiting for the agent, not time the engine spent working. Held idle is time a browser was open before a session's first action or after its last one — a lane waiting to be folded, or attached and never used.`,
         ``,
-        `| Session | Actions | Span | Median gap | Longest gap | Idle | Frames |`,
-        `|---|---:|---:|---:|---:|---:|---:|`,
+        `| Session | Actions | Span | Median gap | Longest gap | Idle | Held idle | Frames |`,
+        `|---|---:|---:|---:|---:|---:|---:|---:|`,
     ];
     for (const s of pace.sessions) {
-        lines.push(`| ${s.session} | ${s.actions} | ${sayDuration(s.spanMs)} | ${sayDuration(s.medianGapMs)} | ${sayDuration(s.maxGapMs)} | ${Math.round(s.idleShare * 100)}% | ${s.framed} |`);
+        lines.push(`| ${s.session} | ${s.actions} | ${sayDuration(s.spanMs)} | ${sayDuration(s.medianGapMs)} | ${sayDuration(s.maxGapMs)} | ${Math.round(s.idleShare * 100)}% | ${sayDuration(s.heldIdleMs)} | ${s.framed} |`);
     }
     lines.push(``);
     if (pace.quiet.length > 0) {

package/dist/engine/policy.js

@@ -185,3 +185,43 @@ export function allowsWrite(mode, method, destructiveWire, owned) {
     // PUT/PATCH/DELETE: only in safe-write, only on this run's own records.
     return mode === "safe-write" && owned;
 }
+/**
+ * Which blocked requests the write policy answers rather than drops.
+ *
+ * A dropped request tells the page nothing it would ever meet in production:
+ * `fetch` rejects with a network error, and the code that handles a refusal —
+ * the branch that should say "couldn't save" — never runs. Answering a script's
+ * request with a refusal keeps the server untouched and exercises that branch,
+ * so a page that reports a refused save as saved is caught. A navigation (a
+ * native form post) is still dropped: answering it would replace the page the
+ * user was on with the stand-in body.
+ */
+export function answersWithRefusal(resourceType) {
+    return resourceType === "fetch" || resourceType === "xhr";
+}
+/** Header on every refusal the policy writes, so the stand-in can be told from the server's own answer. */
+export const POLICY_REFUSAL_HEADER = "x-scenescout-policy";
+/**
+ * The response the write policy sends in the server's place. 403, because the
+ * request is forbidden, not failed: a 5xx invites retries, and a 401 is what
+ * many apps read as "signed out". The CORS headers let a cross-origin API
+ * call read the refusal instead of failing as a network error, which would
+ * drop it all over again. `origin` is the request's own Origin header, echoed
+ * only when there is one.
+ */
+export function policyRefusal(mode, method, pathname, origin) {
+    const headers = { "content-type": "application/json", [POLICY_REFUSAL_HEADER]: `refused; mode=${mode}` };
+    if (origin) {
+        headers["access-control-allow-origin"] = origin;
+        headers["access-control-allow-credentials"] = "true";
+        headers["access-control-expose-headers"] = POLICY_REFUSAL_HEADER;
+    }
+    return {
+        status: 403,
+        headers,
+        body: JSON.stringify({
+            error: "Forbidden",
+            message: `${method} ${pathname} was refused by the tester's ${mode} write policy. The server never received it.`,
+        }),
+    };
+}

package/dist/engine/report.js

@@ -4,6 +4,7 @@ import { SHARED_CHROME_ROUTE } from "./memory.js";
 import { sayVerification } from "./verify.js";
 import { feedForSession } from "./live.js";
 import { buildReplayHtml, evidenceFor } from "./replay.js";
+import { calibrate, formatCalibration } from "./calibration.js";
 import { formatPace, measurePace } from "./pace.js";
 function playwrightSkeleton(f) {
     const routeClass = f.state.split("#")[0].split("?")[0];
@@ -414,7 +415,7 @@ export function generateReport(memory, oracleLog, extras, opts = {}) {
         lines.push(`| Route coverage | ${extras.routesVisited}/${extras.routesTotal} |`);
     lines.push(`| States explored | ${cov.states} |`);
     if (extras)
-        lines.push(`| Design audits this session | ${extras.designAudits} |`);
+        lines.push(`| Design audits this run (all sessions) | ${extras.designAudits} |`);
     lines.push(`| Oracle violations this session | ${oracleLog.length} |`);
     if (extras?.policyAttributed) {
         lines.push(`| Errors caused by the tester's own write-policy blocks (not counted above) | ${extras.policyAttributed} |`);
@@ -616,6 +617,9 @@ export function generateReport(memory, oracleLog, extras, opts = {}) {
     if (extras?.pace !== false) {
         lines.push(...formatPace(measurePace(memory.actionLog, Date.now(), extras?.attachedSessions ?? [])));
     }
+    // Only on a run that used lanes, and only once enough of them have been
+    // judged for the number to mean anything; formatCalibration decides both.
+    lines.push(...formatCalibration(calibrate(memory.laneDecisions, memory.findings)));
     const markdown = lines.join("\n");
     const outPath = path.join(memory.dir, "report.md");
     const htmlPath = path.join(memory.dir, "report.html");

package/dist/engine/request.js

@@ -22,6 +22,7 @@
  * Everything in this file is pure so it can be table-tested; the one
  * `page.evaluate` lives in browser.ts.
  */
+import { POLICY_REFUSAL_HEADER } from "./policy.js";
 /** Methods a session may replay. Anything else is refused before it reaches the page. */
 export const REPLAYABLE_METHODS = ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
 /** Most of a response body that reaches the agent. A JSON list can be megabytes; the signature is in the first lines. */
@@ -114,6 +115,7 @@ export function toReplayResult(raw) {
         truncated: raw.full > BODY_MAX,
         ms: raw.ms,
         url: raw.url,
+        refusedByPolicy: raw.headers[POLICY_REFUSAL_HEADER] ?? null,
     };
 }
 /** The signature a finding carries for this call: the line that dedups the same refusal across runs. */
@@ -128,8 +130,19 @@ export function replaySignature(method, url, status) {
     }
     return `${method} ${path} ${status}`;
 }
-/** What the agent reads back. Leads with the signature, because that is what a finding quotes. */
+/**
+ * What the agent reads back. Leads with the signature, because that is what a
+ * finding quotes — except when the write policy answered, where there is no
+ * server signature to quote. Printing the stand-in's 403 as one would read as
+ * the server enforcing a permission it was never asked about.
+ */
 export function formatReplay(method, result) {
+    if (result.refusedByPolicy) {
+        const path = replaySignature(method, result.url, result.status).replace(/ \d+$/, "");
+        return (`REFUSED by the write policy (${result.refusedByPolicy}): ${path} never reached the server.\n` +
+            `This is the engine's safety net, not the server's answer, so it says nothing about whether the server enforces this rule. ` +
+            `To test that, re-attach in a mode that allows the request on a record this session owns, or leave it out of the finding.`);
+    }
     const lines = [replaySignature(method, result.url, result.status) + (result.statusText ? ` ${result.statusText}` : ""), `took ${result.ms} ms`];
     const headers = Object.entries(result.headers);
     if (headers.length > 0)