scenescout 3.4.0 → 3.5.0

package/dist/engine/brief.js

@@ -92,8 +92,17 @@ export function planLanes(routes, laneCount, opts = {}) {
         objective: laneObjective(lane.modules, opts.goal),
         modules: lane.modules,
         routes: lane.routes,
+        landing: landingOf(lane.routes),
     }));
 }
+/**
+ * The first of a lane's routes a browser can open as it stands. A route the
+ * engine normalised (`/orders/:id`) is a pattern, not an address; a lane with
+ * nothing else lands on the app's root and navigates from there.
+ */
+export function landingOf(routes) {
+    return routes.find((r) => !/(^|\/)[:*]|\[[^\]]+\]/.test(r)) ?? "/";
+}
 function laneObjective(modules, goal) {
     const owned = modules.length === 1 ? modules[0] : `${modules.slice(0, -1).join(", ")} and ${modules[modules.length - 1]}`;
     const what = `Own ${owned}`;
@@ -114,19 +123,25 @@ export function formatBriefs(briefs, opts = {}) {
     const lines = [
         `LANE PLAN — ${briefs.length} lane(s) over ${briefs.reduce((n, b) => n + b.routes.length, 0)} route(s).`,
         ``,
-        `Give each lane its own agent. Every lane attaches with its own session name, so the browsers run genuinely in parallel:`,
-        `  scout_attach { session: "<lane>", url, projectPath, mode: "${mode}"${opts.role ? `, storageStatePath: "<${opts.role}>"` : ""}, objective: "<objective>" }`,
+        `Give each lane its own agent. Every lane attaches with its own session name, so the browsers run genuinely in parallel, and lands on its own first route rather than the home page:`,
+        `  scout_attach { session: "<lane>", url: "<origin><landing>", projectPath, mode: "${mode}"${opts.role ? `, storageStatePath: "<${opts.role}>"` : ""}, objective: "<objective>" }`,
         ``,
-        `Rules to pass on, both of which a hand-written brief tends to drop:`,
-        `  · A lane works ITS routes only. Two lanes auditing the same register while a third module is never opened is the failure this plan exists to prevent — and route coverage will look complete either way.`,
+        `Rules to pass on, which a hand-written brief tends to drop:`,
+        `  · A lane works ITS routes only. Two lanes auditing the same register while a third module is never opened is the failure this plan exists to prevent — and route coverage will look complete either way. A defect on a page it does not own is that page's lane's to file.`,
         `  · Every acting tool takes a \`task\`. A lane that acts with none is refused, and the person watching the live view would otherwise see a browser clicking through their app with nothing to say why.`,
-        `  · A lane reports back with scout_lane_report, not prose. Call scout_lane_report with no reply to get the instruction to put in its prompt.`,
+        `  · File each defect with scout_finding the moment it is judged, before writing the report. A defect only in the report is not in the run's report.`,
+        `  · Before calling a list empty, stale or stuck, read the status of the request behind it: a correct empty result and a failed one can render identically.`,
+        `  · On a create form, submit one markup-shaped value, then open where that record is listed. Any lane's session catches it rendering as markup, so the list may belong to another lane.`,
+        `  · When a control is withheld from this role, call the endpoint behind it with scout_request: hiding a button is not enforcing a rule. When a sort or filter runs, check the result is what it claims.`,
+        `  · Check scout_coverage before finishing.`,
+        `  · A lane reports back with scout_lane_report, not prose, and does NOT close its session: the planner folds the report, which checks each judged defect was filed, then closes it. Call scout_lane_report with no reply to get the instruction to put in its prompt.`,
         ``,
     ];
     for (const b of briefs) {
         lines.push(`── ${b.lane} ──`);
         lines.push(`objective: ${b.objective}`);
         lines.push(`owns: ${b.modules.join(", ")} (${b.routes.length} route(s))`);
+        lines.push(`landing: ${b.landing}`);
         lines.push(`routes: ${b.routes.slice(0, 20).join(", ")}${b.routes.length > 20 ? ` … and ${b.routes.length - 20} more` : ""}`);
         lines.push(``);
     }

package/dist/engine/browser.js

@@ -7,7 +7,7 @@ import { normalizeTask } from "./task.js";
 import { CLAIM_SCAN_SCRIPT, findContradictions } from "./claims.js";
 import { describeInjection, newInjections, probeQueries, probeScript, probeShape, rememberProbe } from "./injection.js";
 import { AuthLossTracker } from "./authloss.js";
-import { COLLECT_INTERACTABLES_SCRIPT, VISIBLE_SRC, geometryIssues, BROKEN_IMAGES_SCRIPT, brokenImageIssues, } from "./collector.js";
+import { COLLECT_INTERACTABLES_SCRIPT, VISIBLE_SRC, geometryIssues, BROKEN_IMAGES_SCRIPT, brokenImageIssues, displayName, missingName, } from "./collector.js";
 import { OracleMonitor, formatViolations } from "./oracles.js";
 import { extractCreatedIds, isOwnedResource, normalizeId } from "./ownership.js";
 import { formatJourney, measureJourney } from "./journey.js";
@@ -20,7 +20,7 @@ import { explainLaunchFailure, isMissingBrowser } from "./launch.js";
 import { ACTION_TIMEOUT_MS, performScroll, probeFocusIndicators, probeOverlays, scrollContainer } from "./probes.js";
 import { BROWSER_MARKER, reapOrphanBrowsers } from "./reaper.js";
 import { planUploadOptions, resolveDiskUpload } from "./uploads.js";
-import { destructiveRefusal, isDestructive, isDestructiveWire, allowsWrite, isAuthExempt } from "./policy.js";
+import { answersWithRefusal, destructiveRefusal, isDestructive, isDestructiveWire, allowsWrite, policyRefusal, isAuthExempt, } from "./policy.js";
 import { scanProject } from "../scan.js";
 import { analyzeDesign, DESIGN_COLLECT_SCRIPT } from "./design.js";
 import { acceptMatches, generatedUpload } from "./fixtures.js";
@@ -206,7 +206,7 @@ export class BrowserEngine {
         const list = this.newlyCreated.splice(0);
         return `\n(created: ${list.join(", ")} — this session may edit or delete ${list.length === 1 ? "it" : "them"})`;
     }
-    /** Design audits run this session — the report gate requires at least one. */
+    /** Design audits run by this session. The report gate counts the whole run's, on the shared store (MemoryStore.auditsThisRun). */
     designAuditCount = 0;
     /** Active task-efficiency measurement (scout_journey), if any. */
     journey = null;
@@ -240,8 +240,9 @@ export class BrowserEngine {
      *
      * The fetch runs IN the page, so it passes through the same interception the
      * write policy is enforced on: a safe-write session cannot reach past the
-     * policy by calling an endpoint instead of clicking it. The refusal comes
-     * back as the policy's own error, exactly as it would for a click.
+     * policy by calling an endpoint instead of clicking it. The policy answers
+     * the fetch with its stand-in 403, and the result says so rather than
+     * printing it as the server's status.
      */
     async apiRequest(input) {
         const page = this.requirePage();
@@ -260,23 +261,41 @@ export class BrowserEngine {
         let raw;
         try {
             raw = (await page.evaluate(script));
+            this.forgetReplay(method.method, target.url);
         }
         catch (err) {
-            // A blocked request rejects the fetch inside the page. That is the write
-            // policy doing its job, not an app fault, and it is reported as such.
+            // The page could not run the fetch at all (a navigation mid-call, a
+            // closed page). The policy answers rather than rejects, so this is not it.
             const message = err instanceof Error ? err.message : String(err);
             this.logAction({ action: "request", target: `${method.method} ${input.path}`, url: page.url(), result: `blocked: ${message.split("\n")[0]}` });
-            return `${method.method} ${input.path} — the request did not complete: ${message.split("\n")[0]}\nIn a write-limited mode this is usually the policy refusing it, which is the engine's safety net and not a finding about the app.`;
+            return `${method.method} ${input.path} — the request did not complete: ${message.split("\n")[0]}`;
         }
         const result = toReplayResult(raw);
         this.logAction({
             action: "request",
             target: `${method.method} ${input.path}`,
             url: page.url(),
-            result: replaySignature(method.method, result.url, result.status),
+            // Not a status signature: the trail must not record the stand-in as the server's answer.
+            result: result.refusedByPolicy ? `blocked: write policy (${result.refusedByPolicy})` : replaySignature(method.method, result.url, result.status),
         });
         return formatReplay(method.method, result);
     }
+    /**
+     * Take the replayed request back out of the contradiction ledger. It was the
+     * agent's call, not the page's, so whatever the page says next is not its
+     * answer — and left in, a replay the policy refused was blamed on the next
+     * click as that click's false success, in place of the click's own request.
+     * Only this request: anything else the page fetched meanwhile stays.
+     */
+    forgetReplay(method, url) {
+        for (let i = this.watchedResponses.length - 1; i >= 0; i -= 1) {
+            const r = this.watchedResponses[i];
+            if (r.method === method && r.url === url) {
+                this.watchedResponses.splice(i, 1);
+                return;
+            }
+        }
+    }
     /**
      * The frame field for a log entry, or nothing. Spread into logAction so a
      * caller that is not going through afterAction can still record what the
@@ -419,7 +438,8 @@ export class BrowserEngine {
     watchedResponses = [];
     static MAX_WATCHED_RESPONSES = 60;
     /**
-     * Requests the write policy aborted, by identity. The request event fires for
+     * Requests the write policy stopped, by identity — whether it dropped them or
+     * answered them with a stand-in refusal. The request event fires for
      * every non-GET the page ATTEMPTS, before the route handler decides its fate,
      * so without this the same DELETE was reported twice with opposite meanings:
      * "server state may have mutated despite read-only mode" and "WRITE-POLICY
@@ -427,11 +447,27 @@ export class BrowserEngine {
      * meet different fates, and a blocked /items/7/archive must not hide an
      * allowed POST /items that shares its prefix.
      */
-    abortedByPolicy = new WeakSet();
-    /** Markup-shaped values this session typed, so every later page can be checked for them rendering as elements. */
-    probes = [];
-    /** Injections already reported, by payload and route, so a page is not reported on every snapshot. */
-    injectionsReported = new Set();
+    refusedByPolicy = new WeakSet();
+    /**
+     * Markup-shaped values typed by any session of this run, so every later page
+     * — in this browser or another lane's — can be checked for them rendering as
+     * elements. On the shared MemoryStore, like ownership; local before attach.
+     */
+    get probes() {
+        return this.memory?.probes ?? this.localProbes;
+    }
+    set probes(list) {
+        if (this.memory)
+            this.memory.probes = list;
+        else
+            this.localProbes = list;
+    }
+    localProbes = [];
+    /** Injections already reported, by payload and route, so a page is not reported on every snapshot — nor by a second lane that opens it. */
+    get injectionsReported() {
+        return this.memory?.injectionsReported ?? this.localInjectionsReported;
+    }
+    localInjectionsReported = new Set();
     /**
      * Remember a typed value when it holds an element worth watching for. What
      * to type is the agent's choice; this only watches for the outcome. The
@@ -459,7 +495,7 @@ export class BrowserEngine {
      * element on the current page? Runs wherever violations are drained, so the
      * finding reaches the agent in the result of the action that revealed it.
      */
-    /** Record one answered request for the contradiction rules. Policy-aborted ones are marked, never dropped: the rules need to know they were ours. */
+    /** Record one answered request for the contradiction rules. Ones the policy stopped are marked, never dropped: the rules need to know they were ours. */
     watchResponse(req, status) {
         if (this.watchedResponses.length >= BrowserEngine.MAX_WATCHED_RESPONSES)
             return;
@@ -468,7 +504,7 @@ export class BrowserEngine {
             url: req.url(),
             status,
             resourceType: req.resourceType(),
-            blockedByPolicy: this.abortedByPolicy.has(req),
+            blockedByPolicy: this.refusedByPolicy.has(req),
         });
     }
     /**
@@ -507,18 +543,22 @@ export class BrowserEngine {
     contradictionsReported = new Set();
     async scanForInjections() {
         const page = this.page;
-        if (!page || page.isClosed() || this.probes.length === 0)
+        // One copy for the whole scan: the list is shared with every lane, and
+        // another lane typing a payload during the await below would shift the
+        // indices the hits are matched back to.
+        const probes = this.probes;
+        if (!page || page.isClosed() || probes.length === 0)
             return;
         const url = page.url();
         let hits;
         try {
-            hits = (await page.evaluate(probeScript(probeQueries(this.probes))));
+            hits = (await page.evaluate(probeScript(probeQueries(probes))));
         }
         catch {
             // A page mid-navigation has no DOM to ask; the next drain looks again.
             return;
         }
-        for (const found of newInjections(this.probes, hits, url, this.injectionsReported)) {
+        for (const found of newInjections(probes, hits, url, this.injectionsReported)) {
             this.oracles.noteInjection(describeInjection(found.probe, url, found.outer), url);
         }
     }
@@ -571,7 +611,7 @@ export class BrowserEngine {
             this.projectDirNote = ` (its real path could not be resolved: ${err instanceof Error ? err.message : String(err)} — a symlinked project path may be wrongly refused)`;
         }
         this.oracles = new OracleMonitor();
-        this.oracles.setPolicyAbortCheck((req) => this.abortedByPolicy.has(req));
+        this.oracles.setPolicyRefusalCheck((req) => this.refusedByPolicy.has(req));
         this.lastSnap = null;
         this.designAuditCount = 0;
         // The engine learns the route list itself so completion is an objective,
@@ -642,7 +682,7 @@ export class BrowserEngine {
             // not just looked at — the difference between visited and tested.
             //
             // Only for requests the policy will actually let through. This event
-            // fires BEFORE the route handler aborts a blocked one, so counting it
+            // fires BEFORE the route handler stops a blocked one, so counting it
             // here let a REFUSED destructive POST mark the route as mutated — a form
             // that was never submitted reading as tested, in read-only mode where by
             // definition nothing is.
@@ -711,11 +751,16 @@ export class BrowserEngine {
                     }
                     return route.continue();
                 }
+                const answered = answersWithRefusal(req.resourceType());
                 if (this.blockedRequests.length < 20)
-                    this.blockedRequests.push({ at: Date.now(), sig: `${method} ${url.slice(0, 140)}` });
+                    this.blockedRequests.push({ at: Date.now(), sig: `${method} ${url.slice(0, 140)}`, answered });
                 this.logAction({ action: "write-policy:blocked", target: `${method} ${pathname}`, url: this.page?.url() ?? "" });
-                this.abortedByPolicy.add(req);
+                this.refusedByPolicy.add(req);
                 this.oracles.notePolicyBlock();
+                // A script's request is answered with a refusal, so the page's handling
+                // of one actually runs; a navigation is dropped (policy.ts says why).
+                if (answered)
+                    return route.fulfill(policyRefusal(this.mode, method, pathname, req.headers()["origin"]));
                 return route.abort("blockedbyclient");
             });
         }
@@ -1036,7 +1081,7 @@ export class BrowserEngine {
                 memory.wasExercised(fp, el.key) ? "done" : null,
                 el.href ? `href=${el.href.slice(0, 60)}` : null,
             ].filter(Boolean);
-            return `${el.ref} ${el.role} "${el.name || "(unnamed)"}"${flags.length ? ` [${flags.join(", ")}]` : ""}`;
+            return `${el.ref} ${el.role} "${displayName(el)}"${flags.length ? ` [${flags.join(", ")}]` : ""}`;
         };
         // Diff mode: when re-snapshotting the same route, report only what
         // changed — same idea as UI reconciliation, applied to agent context.
@@ -1254,9 +1299,13 @@ export class BrowserEngine {
             .map((e) => this.lateMark(e))
             .join("; ");
         const extra = this.blockedRequests.length > 5 ? ` (+${this.blockedRequests.length - 5} more)` : "";
+        const answered = this.blockedRequests.some((e) => e.answered);
         this.blockedRequests = [];
         return (`\n🛡 WRITE-POLICY blocked (${this.mode}): ${list}${extra}. ` +
             `This is the tester's safety policy, NOT an app bug — do not file a finding for the resulting error UI. ` +
+            (answered
+                ? `The page's own requests were answered with a 403 in the server's place, so the page's handling of a refusal is real: an error message is correct, and a success message is a false_success violation. `
+                : "") +
             (this.mode === "observe"
                 ? `observe mode blocks every request that is not a GET, so no form submission reaches the server. Re-attach with mode="read-only" ONLY if the user confirms that ordinary form submissions are acceptable on this target.`
                 : this.mode === "read-only"
@@ -1281,7 +1330,7 @@ export class BrowserEngine {
         // to see the DUPLICATES that the reporting dedup below intentionally hides.
         this.lastActionMutationSigs = this.mutationRequests.map((e) => e.sig);
         const fresh = this.mutationRequests
-            .filter((entry) => !this.abortedByPolicy.has(entry.req))
+            .filter((entry) => !this.refusedByPolicy.has(entry.req))
             .filter((entry) => {
             const key = entry.sig.split("?")[0];
             if (this.reportedMutationSigs.has(key))
@@ -2009,7 +2058,7 @@ export class BrowserEngine {
             await this.scanForContradictions();
             const violations = this.oracles.drain();
             const deadEnd = elements.length === 0;
-            const unnamed = elements.filter((el) => !el.name).length;
+            const unnamed = elements.filter(missingName).length;
             const missingTestid = elements.filter((el) => !el.testid && !el.disabled).length;
             const flags = [loginRedirect ? "AUTH-REDIRECT" : null, deadEnd ? "DEAD-END" : null, violations.length > 0 ? `${violations.length}⚠` : null].filter(Boolean);
             summary.push(`${path} — ${status} · ${elements.length} el` +
@@ -2276,6 +2325,8 @@ export class BrowserEngine {
         const payload = (await page.evaluate(DESIGN_COLLECT_SCRIPT));
         payload.page.focusSamples = await probeFocusIndicators(page);
         this.designAuditCount += 1;
+        if (this.memory)
+            this.memory.auditsThisRun += 1;
         // The census is built from previous audits, so the first few pages of a run
         // score with chrome included and later ones don't. That is the same warm-up
         // the coverage census has: nothing is knowable as "shared" until it has been
@@ -2506,6 +2557,12 @@ export class BrowserEngine {
         }
     }
     async close() {
+        // Marks the end of the time this session held a browser, so the pace
+        // section can say how long it was held with nothing happening. Only when a
+        // browser is actually open: attach() closes first, and a close of nothing
+        // is not an event.
+        if (this.page)
+            this.logAction({ action: "close", url: this.page.isClosed() ? "" : this.page.url() });
         // Pending debounced coverage writes must land before the process can exit.
         try {
             this.memory?.flush();

package/dist/engine/calibration.js

@@ -215,3 +215,60 @@ function readEce(ece) {
         return "Close enough to compare lanes by.";
     return "Far enough apart that a lane's confidence is worth reading as an ordering rather than a rate — after checking the exclusions above, which push this upward.";
 }
+/** Most unfiled defects named when a lane report is folded; the rest are counted. */
+export const MAX_UNFILED_NAMED = 10;
+/**
+ * The defects a lane judged that no finding in the store covers yet.
+ *
+ * A lane's report is a verdict, not a filing: a defect it judged and never
+ * passed to scout_finding never reaches the report. That happened in a
+ * measured run — a covered Save button, judged a defect at 0.75 and filed by
+ * nobody — and it is cheapest to catch at the moment the planner folds the
+ * report, while the lane's session is still open.
+ *
+ * Matched on the store's failing-endpoint signature where the evidence has
+ * one, and on the evidence text otherwise. The text match is what the
+ * calibration join refuses, because there a miss is scored against the lane;
+ * here a miss only asks someone to check, which costs a look and nothing more.
+ */
+export function unfiledDefects(decisions, findings) {
+    const keys = new Set();
+    const texts = [];
+    for (const f of findings) {
+        if (!f.evidence)
+            continue;
+        for (const key of joinKeys(f.evidence))
+            keys.add(key);
+        texts.push(squash(f.evidence));
+    }
+    const out = [];
+    for (const d of decisions) {
+        if (d.verdict !== "defect")
+            continue;
+        if (d.evidence) {
+            const joined = [...joinKeys(d.evidence)];
+            if (joined.some((k) => keys.has(k)))
+                continue;
+            // A failing-endpoint signature is the store's own identity for a bug. When
+            // the decision has one and no finding shares it, text overlap is not a
+            // match: "GET /api/items" inside "... GET /api/items returned 500" is.
+            if (joined.length > 0) {
+                out.push(`${d.observation} — ${d.evidence}`);
+                continue;
+            }
+            const text = squash(d.evidence);
+            if (text && texts.some((t) => t === text || contains(t, text) || contains(text, t)))
+                continue;
+        }
+        out.push(d.evidence ? `${d.observation} — ${d.evidence}` : d.observation);
+    }
+    return out;
+}
+/** One signature inside another, when the inner one is long enough to mean something: "404" is inside half the findings in a run. */
+function contains(outer, inner) {
+    return inner.length >= MIN_CONTAINED && outer.includes(inner);
+}
+const MIN_CONTAINED = 12;
+function squash(text) {
+    return text.toLowerCase().replace(/\s+/g, " ").trim();
+}

package/dist/engine/claims.js

@@ -41,7 +41,7 @@ const WRITING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 const DATA_RESOURCES = new Set(["xhr", "fetch", "document"]);
 /** Whether this request is one whose refusal the page should be admitting to. */
 export function isRefused(req) {
-    if (req.blockedByPolicy)
+    if (req.blockedByPolicy && req.status === null)
         return false;
     if (!DATA_RESOURCES.has(req.resourceType))
         return false;
@@ -100,6 +100,12 @@ function shortUrl(url) {
 function say(req) {
     return `${req.method} ${shortUrl(req.url)} ${req.status === null ? "failed" : req.status}`;
 }
+/** Said after a contradiction whose refusal the write policy wrote, so nobody goes looking for it in the server's logs. */
+function standIn(req) {
+    return req.blockedByPolicy
+        ? ` The refusal was the write policy's stand-in (the server never received the request); what failed is the page's handling of a refusal, which a real one would meet the same way.`
+        : "";
+}
 /**
  * The contradictions this action produced, if any.
  *
@@ -125,7 +131,8 @@ export function findContradictions(requests, page) {
         out.push({
             kind: "refused_empty",
             detail: `${say(worst)} was refused, and the page shows ${how} with no error. ` +
-                `The user is told there is nothing to see when the truth is that nothing could be loaded.`,
+                `The user is told there is nothing to see when the truth is that nothing could be loaded.` +
+                standIn(worst),
             evidence: `refused-empty ${say(worst)}`,
         });
     }
@@ -135,7 +142,7 @@ export function findContradictions(requests, page) {
         const message = page.texts[claims.indexOf("success")];
         out.push({
             kind: "false_success",
-            detail: `${say(worst)} was refused, and the page says ${JSON.stringify(message.trim().slice(0, 80))}. The user is told their change was kept when the server rejected it.`,
+            detail: `${say(worst)} was refused, and the page says ${JSON.stringify(message.trim().slice(0, 80))}. The user is told their change was kept when the server rejected it.${standIn(worst)}`,
             evidence: `false-success ${say(worst)}`,
         });
     }

package/dist/engine/collector.js

@@ -276,6 +276,23 @@ export const COLLECT_INTERACTABLES_SCRIPT = `(() => {
   }
   return out;
 })()`;
+/**
+ * Roles that announce content rather than take input: a live region is empty
+ * until it has something to say, and ARIA does not require it to have a name.
+ * Reporting an empty status line as an unnamed control sent lanes to file it
+ * as an accessibility defect — twice in one measured run.
+ */
+const LIVE_REGION_ROLES = new Set(["status", "alert", "log", "timer", "marquee"]);
+/** Whether an element with this role and no accessible name is an unnamed control, as opposed to a live region with nothing in it yet. */
+export function missingName(el) {
+    return !el.name && !LIVE_REGION_ROLES.has(el.role);
+}
+/** How the snapshot shows an element's name: an empty live region says so rather than reading as an unnamed control. */
+export function displayName(el) {
+    if (el.name)
+        return el.name;
+    return LIVE_REGION_ROLES.has(el.role) ? "(empty live region)" : "(unnamed)";
+}
 /**
  * Deterministic geometry oracles — the checks people reach for screenshots to
  * do, computed from layout boxes instead: interactables rendered fully outside

package/dist/engine/lane.js

@@ -90,12 +90,21 @@ export const LaneReport = z
         seen.add(d.observation);
     });
 });
-const FENCE_OPEN = /^```[a-z]*\s*\n/i;
-const FENCE_CLOSE = /\n?```\s*$/;
+const FENCE_OPEN = /^```[a-z]*\s*\r?\n/i;
+const FENCE_CLOSE = /\r?\n?```\s*$/;
+/** Every fenced block in a reply, with its contents. */
+const FENCED_BLOCK = /```[a-z]*[ \t]*\r?\n([\s\S]*?)\r?\n?```/gi;
 /**
  * The reply is one JSON object and nothing else. A fenced block around it is
- * tolerated, because every model has been trained to add one; text before or
- * after it is not, because the point is that no one has to read the reply.
+ * tolerated, because every model has been trained to add one.
+ *
+ * Prose around ONE fenced JSON block is tolerated too, and dropped unread. The
+ * rule used to refuse it, and in a measured run six of eight lanes did it
+ * anyway: each refusal cost the planner a round trip or a hand-unwrap, to
+ * recover an object that was already unambiguous. The point — nobody has to
+ * READ the reply — survives, because the prose is never looked at. Unfenced
+ * prose is still refused, because where the object starts and ends is then a
+ * guess, and so is more than one fenced object.
  * The reason names what was wrong, since the planner relays it to the lane.
  *
  * With `expectedLane`, a report that names another lane is refused: the
@@ -104,13 +113,19 @@ const FENCE_CLOSE = /\n?```\s*$/;
  */
 export function parseLaneReport(text, expectedLane) {
     let body = text.trim();
-    if (FENCE_OPEN.test(body)) {
-        if (!FENCE_CLOSE.test(body))
-            return { ok: false, reason: "the closing ``` must end the reply, with no text after it" };
+    let aroundIgnored = false;
+    if (FENCE_OPEN.test(body) && FENCE_CLOSE.test(body) && [...body.matchAll(FENCED_BLOCK)].length === 1) {
         body = body.replace(FENCE_OPEN, "").replace(FENCE_CLOSE, "").trim();
     }
-    if (!body.startsWith("{"))
-        return { ok: false, reason: "the reply must be one JSON object, with no text before it" };
+    else if (!body.startsWith("{")) {
+        const objects = [...body.matchAll(FENCED_BLOCK)].map((m) => m[1].trim()).filter((b) => b.startsWith("{"));
+        if (objects.length > 1)
+            return { ok: false, reason: `the reply holds ${objects.length} fenced JSON blocks; hand back exactly one object` };
+        if (objects.length === 0)
+            return { ok: false, reason: "the reply must be one JSON object, with no text before it" };
+        body = objects[0];
+        aroundIgnored = true;
+    }
     let raw;
     try {
         raw = JSON.parse(body);
@@ -129,7 +144,7 @@ export function parseLaneReport(text, expectedLane) {
     if (expectedLane !== undefined && result.data.lane !== expectedLane) {
         return { ok: false, reason: `the report names lane "${result.data.lane}", but this reply was asked of lane "${expectedLane}"` };
     }
-    return { ok: true, report: result.data };
+    return { ok: true, report: result.data, aroundIgnored };
 }
 /**
  * The paragraph the planner puts in every lane's prompt. It is generated from
@@ -153,7 +168,7 @@ export function laneReportInstruction(lane) {
  * refuses good replies.
  */
 const LANE_RUBRIC = [
-    "Reply with ONE JSON object and nothing else — no prose before or after it, no explanation, no headings. A fenced ```json block is fine.",
+    "Reply with ONE JSON object and nothing else — no prose before or after it, no explanation, no headings. A fenced ```json block is fine; anything outside it is discarded unread, so put nothing there you want kept.",
     `Shape: {"lane":<your lane name>,"status":<${quoteAll(LANE_STATUSES)}>,"decisions":[…],"routes":[…],"blocked_by":<string or null>}.`,
     `Each decision: {"observation":<a short id for what was observed, unique in the report, at most ${LANE_OBSERVATION_MAX} characters>,"verdict":<${quoteAll(LANE_VERDICTS)}>,"severity":<${quoteAll(LANE_SEVERITIES)} or null>,"category":<${quoteAll(LANE_CATEGORIES)} or null>,"confidence":<0..1>,"evidence":<machine signature such as "GET /api/things 500", or null>}.`,
     `A "defect" must carry a severity and a category. "evidence" is a signature, not a sentence: at most ${LANE_EVIDENCE_MAX} characters. "confidence" is how sure you are of the verdict, calibrated: 0.5 means a coin flip, 0.95 means you would bet on it.`,

package/dist/engine/memory.js

@@ -567,6 +567,35 @@ export class MemoryStore {
     ownedIds = new Map();
     /** Human-readable creation log for this run — becomes the report's cleanup list. */
     createdResources = [];
+    /**
+     * Markup-shaped values any session of this run typed, and the injections
+     * already reported. Shared for the same reason ownership is: a parallel run
+     * splits the app by route, so the lane that types a payload into a create
+     * form is rarely the lane that opens the list rendering it, and a probe kept
+     * per session could only ever catch a reflected injection. Not persisted: a
+     * payload typed in an earlier run is not this run's evidence.
+     */
+    probes = [];
+    injectionsReported = new Set();
+    /**
+     * Design audits any session of this run performed. The report's gate asked
+     * the session that happened to call scout_report, so a run whose lanes
+     * audited every page was refused because the planner's own session had not.
+     * Not persisted: an audit from an earlier run does not satisfy this one.
+     */
+    auditsThisRun = 0;
+    /**
+     * End the run: forget what only this run's sessions know. Called when the
+     * last session on this project closes. The store itself outlives it — the
+     * server keeps one per project for the life of the process — so without
+     * this, a second run in the same process passed the audit gate on the first
+     * run's audit and stayed silent about an injection the first run reported.
+     */
+    endRun() {
+        this.probes = [];
+        this.injectionsReported.clear();
+        this.auditsThisRun = 0;
+    }
     constructor(projectDir) {
         this.dir = path.join(projectDir, MEMORY_DIRNAME);
         this.legacyDirNote = adoptLegacyMemoryDir(projectDir);

package/dist/engine/oracles.js

@@ -17,7 +17,8 @@ export const POLICY_BLOCK_WINDOW_MS = 2000;
  * block rather than something the app did?
  *
  * Aborting a request makes the browser print a console error, and — when the
- * app does not catch the rejection — raise a page error. Left in, a report
+ * app does not catch the rejection — raise a page error. Answering one with the
+ * policy's stand-in 403 makes the browser print its "status of 403" line. Left in, a report
  * lists the tool's own safety net as defects of the app under test. (The
  * failed REQUEST itself is matched exactly, by request identity, in the
  * monitor; these two carry no request to match on, so they are attributed by
@@ -32,7 +33,7 @@ export function isPolicyInduced(v, msSincePolicyBlock) {
         return false;
     if (v.kind !== "page_error" && v.kind !== "console_error")
         return false;
-    return /ERR_BLOCKED_BY_CLIENT|Failed to fetch|NetworkError when attempting to fetch|Load failed/i.test(v.detail);
+    return /ERR_BLOCKED_BY_CLIENT|Failed to fetch|NetworkError when attempting to fetch|Load failed|the server responded with a status of 403\b/i.test(v.detail);
 }
 /**
  * Invariant oracles: passive listeners that record violations regardless of
@@ -74,7 +75,7 @@ export class OracleMonitor {
                 return;
             if (BENIGN_URL_RE.test(req.url()))
                 return;
-            if (this.abortedByPolicy(req)) {
+            if (this.refusedByPolicy(req)) {
                 this.policyAttributed += 1;
                 return;
             }
@@ -93,6 +94,12 @@ export class OracleMonitor {
             // reported here on every page load teaches the driver to ignore http_error.
             if (BENIGN_URL_RE.test(res.url()))
                 return;
+            // The write policy's own stand-in refusal, matched by request identity
+            // like a dropped one: the server never said this.
+            if (this.refusedByPolicy(res.request())) {
+                this.policyAttributed += 1;
+                return;
+            }
             // 401/403 are often expected (auth probes); still report, but as medium.
             this.record({
                 kind: "http_error",
@@ -113,7 +120,7 @@ export class OracleMonitor {
      */
     static MAX_REPORTED_SIGS = 5000;
     lastPolicyBlockAt = null;
-    abortedByPolicy = () => false;
+    refusedByPolicy = () => false;
     /**
      * Errors attributed to the write policy's own blocks and therefore not
      * recorded as violations. Counted, so a report can say how many there were:
@@ -121,11 +128,11 @@ export class OracleMonitor {
      * errors look the same.
      */
     policyAttributed = 0;
-    /** The engine knows exactly which requests it aborted; failed requests are matched against that, not against wording. */
-    setPolicyAbortCheck(check) {
-        this.abortedByPolicy = check;
+    /** The engine knows exactly which requests its policy stopped; failed requests and stand-in refusals are matched against that, not against wording. */
+    setPolicyRefusalCheck(check) {
+        this.refusedByPolicy = check;
     }
-    /** Called by the engine when the write policy aborts a request, so the errors that abort causes are not held against the app. */
+    /** Called by the engine when the write policy stops a request (dropped or answered), so the errors that causes are not held against the app. */
     notePolicyBlock() {
         this.lastPolicyBlockAt = Date.now();
     }