scenescout 3.6.0 → 3.7.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # scenescout
 
+## 3.7.0
+
+### Minor Changes
+
+- 1b4a688: The live view's close-up has its own Stream button, the same one as the session's card: switch streaming off or on without leaving the close-up. Opening a close-up still streams its session, and closing it without touching the button leaves the card as it was.
+- a11c96e: `scout_coverage` lists the options of each dropdown used in the run that no session has chosen, since a filter counts as exercised after one choice. Disabled and hidden options, and an empty-value placeholder or "all" option, are never listed; dropdowns with more than 20 options are pickers and are not listed either.
+
+### Patch Changes
+
+- b726af1: Two findings that quote the same control no longer merge when their evidence names different requests, and a filing merged into an existing finding now names it, with its severity and title.
+- 56382db: The lane-report fold no longer lists a judged defect as unfiled when its evidence appears word for word inside a filed finding's evidence.
+
+## 3.6.1
+
+### Patch Changes
+
+- 90d1aec: Two findings that share only a quoted string are merged only when their kinds are one family (data, failures, presentation, flow, security, performance, and "other" on its own). A layout defect naming the button it covers ("Save notes") was being folded into the data defect about what that button does, and dropped from the report. The same bug filed twice under neighbouring categories — data-loss and data-inconsistency, page-error and console-error — still merges.
+- 8abf639: The false-success check recognises a refusal the page announces in its own words — "Only an open order can be sent for approval", "You can't delete an approved order", "This order is already approved" — in a status region, alert or dialog, as the page admitting the refusal, instead of reporting the word "sent" or "approved" as a false claim of success. The same wording as ordinary help text elsewhere on the page ("This cannot be undone", "Password must be at least 8 characters") excuses nothing.
+- ca52079: The lane-report fold's check for defects judged but never filed now recognises a filed finding when the lane reworded its evidence, matching on the identifiers that survive rewording — test ids and contrast ratios, two of them in common — or on near-identical wording. Replayed against three archived benchmark runs it raised 6 flags where it had raised 39, and still named every defect that was genuinely left unfiled. One shared test id is never enough, and API paths are not identifiers, so a missed defect on the same button or endpoint as a filed one is still named.
+
 ## 3.6.0
 
 ### Minor Changes

package/dist/engine/browser.js

@@ -56,6 +56,31 @@ const BENIGN_MUTATION_RE = /\/auth\/(refresh|token|session)|refresh[-_]?token|\/
 function xpathLookup(xpath) {
     return `document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue`;
 }
+/**
+ * Runs in the page against one dropdown, BEFORE a choice: its options' values
+ * and labels. Read first because a dropdown may reset itself (a bulk-action or
+ * "jump to" menu) or remove itself on change. Skips disabled and hidden
+ * options, and a placeholder or "all" option with an empty value — the state
+ * the page loads in, which is not an option anyone owes a choice.
+ */
+function describeSelect(node) {
+    // A plan may target the dropdown by its <label>; selectOption follows a label to its control, so this does too.
+    const target = node instanceof HTMLLabelElement ? (node.control ?? node.querySelector("select")) : node;
+    const select = target;
+    if (!select || !select.options)
+        return null;
+    return Array.from(select.options)
+        .filter((o) => !o.disabled && !o.hidden && o.value !== "")
+        .map((o) => ({ value: o.value, label: (o.label || o.textContent || "").trim().slice(0, 80) }))
+        .filter((o) => o.label !== "");
+}
+/**
+ * A dropdown's options, read without waiting: a select that is not there to
+ * read is not worth stalling the action for.
+ */
+async function readSelectOptions(loc) {
+    return loc.evaluate(describeSelect, undefined, { timeout: 1000 }).catch(() => null);
+}
 /** Runs in the page against one file input (or the one a chooser belongs to). */
 function describeFileInput(node) {
     const input = node;
@@ -1783,6 +1808,15 @@ export class BrowserEngine {
                 ? `\nRevealed on hover:\n${notes.map((t) => `  · ${t}`).join("\n")}${caveat}`
                 : `\n(no tooltip, overlay, or new page text appeared within ${HOVER_REVEAL_WINDOW_MS / 1000}s — this element reveals nothing on hover${churning ? "; page content was changing on its own, so the text-diff fallback was suppressed" : ""}${this.headed ? ". NOTE: in headed mode the PHYSICAL mouse cursor competes with the synthetic pointer — if it is resting over the browser window, hover warm-ups are cancelled; ask the user to move it off the window and retry" : ""})`));
     }
+    /** Record a dropdown's options and the ones picked, by the values selectOption reported. */
+    recordSelectChoice(fingerprint, key, options, picked) {
+        const labels = options.map((o) => o.label);
+        const chosen = picked.map((v) => options.find((o) => o.value === v)?.label).filter((l) => !!l);
+        if (chosen.length === 0)
+            this.memory.recordSelectChoice(fingerprint, key, labels, "");
+        for (const label of chosen)
+            this.memory.recordSelectChoice(fingerprint, key, labels, label);
+    }
     async select(ref, value) {
         const page = this.requirePage();
         const { el, liveLabel } = await this.resolveForAction(ref);
@@ -1802,8 +1836,12 @@ export class BrowserEngine {
                 return destructiveRefusal(optionLabel || value, this.mode);
             }
         }
-        await page.locator(`xpath=${el.xpath}`).selectOption(value, { timeout: ACTION_TIMEOUT_MS });
+        const loc = page.locator(`xpath=${el.xpath}`);
+        const options = el.tag === "select" ? await readSelectOptions(loc) : null;
+        const picked = await loc.selectOption(value, { timeout: ACTION_TIMEOUT_MS });
         this.memory.markExercised(this.currentFingerprint, el.key, "select");
+        if (options)
+            this.recordSelectChoice(this.currentFingerprint, el.key, options, picked);
         return this.afterAction("select", `${el.role} "${el.name}" = ${value}`);
     }
     /**
@@ -2131,6 +2169,8 @@ export class BrowserEngine {
             // What a type step has to say about the field it typed into; it goes on
             // the step's own line, so it cannot read as the previous step's.
             let note = "";
+            // A select step's options and choice, recorded against the dropdown the bookkeeping below finds.
+            let chose = null;
             let preState = null;
             try {
                 if (step.action === "navigate") {
@@ -2215,8 +2255,12 @@ export class BrowserEngine {
                             await loc.press("Enter", { timeout: ACTION_TIMEOUT_MS });
                         }
                     }
-                    else if (step.action === "select")
-                        await loc.selectOption(step.value ?? "", { timeout: ACTION_TIMEOUT_MS });
+                    else if (step.action === "select") {
+                        const options = await readSelectOptions(loc);
+                        const picked = await loc.selectOption(step.value ?? "", { timeout: ACTION_TIMEOUT_MS });
+                        if (options)
+                            chose = { options, picked };
+                    }
                     else if (step.action === "upload") {
                         const r = await this.performUpload(loc, planUploadOptions(step.value));
                         if (r.refused) {
@@ -2263,12 +2307,13 @@ export class BrowserEngine {
                         // state so a target the pre-capture missed (or a failed capture)
                         // still records something rather than nothing.
                         const preHit = preState ? findIn(preState.elements) : undefined;
-                        if (preHit)
-                            this.memory.markExercised(preState.fp, preHit.key, `plan:${step.action}`);
-                        else {
-                            const postHit = findIn(elements);
-                            if (postHit)
-                                this.memory.markExercised(fp, postHit.key, `plan:${step.action}`);
+                        const postHit = preHit ? undefined : findIn(elements);
+                        const hit = preHit ? { fp: preState.fp, el: preHit } : postHit ? { fp, el: postHit } : undefined;
+                        if (hit) {
+                            this.memory.markExercised(hit.fp, hit.el.key, `plan:${step.action}`);
+                            // The lookup can fall back to a name match; options belong only to a dropdown.
+                            if (chose && hit.el.tag === "select")
+                                this.recordSelectChoice(hit.fp, hit.el.key, chose.options, chose.picked);
                         }
                     }
                     catch {

package/dist/engine/calibration.js

@@ -233,13 +233,13 @@ export const MAX_UNFILED_NAMED = 10;
  */
 export function unfiledDefects(decisions, findings) {
     const keys = new Set();
-    const texts = [];
+    const filed = [];
     for (const f of findings) {
-        if (!f.evidence)
-            continue;
-        for (const key of joinKeys(f.evidence))
-            keys.add(key);
-        texts.push(squash(f.evidence));
+        const text = `${f.evidence ?? ""} ${f.title}`;
+        if (f.evidence)
+            for (const key of joinKeys(f.evidence))
+                keys.add(key);
+        filed.push({ ids: identifiers(text), words: words(text), evidenceWords: words(f.evidence ?? ""), evidence: squash(f.evidence ?? "") });
     }
     const out = [];
     for (const d of decisions) {
@@ -250,25 +250,117 @@ export function unfiledDefects(decisions, findings) {
             if (joined.some((k) => keys.has(k)))
                 continue;
             // A failing-endpoint signature is the store's own identity for a bug. When
-            // the decision has one and no finding shares it, text overlap is not a
-            // match: "GET /api/items" inside "... GET /api/items returned 500" is.
+            // the decision has one and no finding shares it, nothing else is a match.
             if (joined.length > 0) {
                 out.push(`${d.observation} — ${d.evidence}`);
                 continue;
             }
+            const ids = identifiers(d.evidence);
+            const w = words(d.evidence);
             const text = squash(d.evidence);
-            if (text && texts.some((t) => t === text || contains(t, text) || contains(text, t)))
+            if (filed.some((f) => (text !== "" && f.evidence === text) || restates(text, f) || covers(ids, w, f)))
                 continue;
         }
         out.push(d.evidence ? `${d.observation} — ${d.evidence}` : d.observation);
     }
     return out;
 }
-/** One signature inside another, when the inner one is long enough to mean something: "404" is inside half the findings in a run. */
-function contains(outer, inner) {
-    return inner.length >= MIN_CONTAINED && outer.includes(inner);
+/**
+ * Shortest reported evidence that counts as restating a filing it is part of.
+ */
+const MIN_RESTATED = 24;
+/** A test id, captured without its attribute; and a kebab-case id of three or more parts. Lowercase text only. */
+const TESTID_RE = /testid=["']?([a-z0-9_-]+)/g;
+const KEBAB_ID_RE = /\b[a-z][a-z0-9]*(?:-[a-z0-9]+){2,}\b/g;
+/**
+ * Whether the reported evidence appears word for word inside a finding's
+ * evidence: a lane that filed "testid=row-1..6 non-interactive; GET /api/x 200
+ * with only three fields" and reported the first half. It must say something
+ * beyond naming a control — two words once test ids and kebab-case ids of
+ * three or more parts are taken out — or a bare "testid=inventory-sort-qty" would be found inside
+ * every finding about that control, which is the one-shared-id match covers()
+ * refuses. One direction only: a short FILED evidence found inside a longer
+ * report proves nothing about the rest of the report.
+ */
+function restates(reported, f) {
+    if (reported.length < MIN_RESTATED || !f.evidence.includes(reported))
+        return false;
+    const rest = reported.replace(TESTID_RE, " ").replace(KEBAB_ID_RE, " ");
+    return words(rest).size >= 2;
+}
+/**
+ * Whether a finding covers a decision. Lanes reword evidence between filing it
+ * and reporting it — an arrow for a hyphen, quoted JSON for bare, "8 links"
+ * for "8 link(s)" — but keep the identifiers: test ids and contrast ratios.
+ * Two shared identifiers, or a near-identical wording, is the same
+ * observation. One shared test id is never enough, with or without some
+ * words in common: two different defects on one control share both (sort by
+ * quantity sorting as text, and the same sort showing no active state), and a
+ * real miss must not hide behind its neighbour.
+ */
+function covers(ids, w, f) {
+    let shared = 0;
+    for (const id of ids)
+        if (f.ids.has(id))
+            shared += 1;
+    // Against the evidence alone as well: a finding's title adds words the
+    // lane's report never repeats, and diluted an otherwise identical signature.
+    const overlap = Math.max(jaccard(w, f.words), jaccard(w, f.evidenceWords));
+    return shared >= 2 || overlap >= 0.6;
+}
+/**
+ * Test ids, kebab-case identifiers of three or more parts, and contrast ratios.
+ * Not API paths: a path that answered 2xx names a resource, not a defect — two
+ * different bugs on POST /api/orders share it — and a failing path already has
+ * its own identity in joinKeys.
+ */
+function identifiers(text) {
+    const out = new Set();
+    const t = text.toLowerCase();
+    for (const m of t.matchAll(TESTID_RE))
+        out.add(m[1]);
+    for (const m of t.matchAll(KEBAB_ID_RE))
+        out.add(m[0]);
+    for (const m of t.matchAll(/\b\d+(?:\.\d+)?:1\b/g))
+        out.add(m[0]);
+    return out;
+}
+const STOP = new Set([
+    "the",
+    "and",
+    "with",
+    "for",
+    "but",
+    "not",
+    "was",
+    "are",
+    "has",
+    "this",
+    "that",
+    "from",
+    "into",
+    "when",
+    "then",
+    "than",
+    "only",
+    "also",
+    "its",
+]);
+function words(text) {
+    return new Set(text
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((w) => w.length >= 3 && !STOP.has(w)));
+}
+function jaccard(a, b) {
+    if (a.size === 0 || b.size === 0)
+        return 0;
+    let both = 0;
+    for (const x of a)
+        if (b.has(x))
+            both += 1;
+    return both / (a.size + b.size - both);
 }
-const MIN_CONTAINED = 12;
 function squash(text) {
     return text.toLowerCase().replace(/\s+/g, " ").trim();
 }

package/dist/engine/claims.js

@@ -64,11 +64,33 @@ const EMPTY_RE = /\b(?:no (?:results?|items?|records?|rows?|data|entries|matches
  */
 const SUCCESS_RE = /\b(?:success(?:fully)?|saved|created|updated|deleted|removed|submitted|sent|published|approved|completed|added|changes? saved|done)\b/i;
 /**
- * Phrases that admit something went wrong. Their presence is what makes a page
+ * Phrases that admit something went wrong — including a refusal explained in
+ * the app's own words ("Only an open order can be sent for approval", "You
+ * can't delete an approved order"), which is correct behaviour even though it
+ * uses none of the words for an error and may contain one for success. Their presence is what makes a page
  * INNOCENT: an app that refuses a request and says so has behaved correctly,
  * whatever else is on the screen, and must not be reported.
  */
-const ERROR_RE = /\b(?:error|failed|failure|could ?n[o']?t|unable to|went wrong|try again|retry|denied|forbidden|unauthori[sz]ed|not allowed|no permission|timed out|unavailable|problem loading)\b/i;
+const ERROR_RE = /\b(?:error|failed|failure|could ?n[o'’]?t|unable to|went wrong|try again|retry|denied|forbidden|unauthori[sz]ed|not allowed|no permission|timed out|unavailable|problem loading)\b/i;
+/**
+ * A refusal explained in the app's own words: "Only an open order can be sent
+ * for approval", "You can't delete an approved order", "Nothing was saved".
+ * Correct behaviour after a refused request, though it uses none of the words
+ * for an error and may contain one for success ("sent").
+ *
+ * Unlike ERROR_RE, this counts only in text the page ANNOUNCES — a live region
+ * or an alert (see PageState.announced). The same phrasing is ordinary
+ * help text everywhere else ("This cannot be undone", "Password must be at
+ * least 8 characters", "Only admins can invite members"), and page-wide it
+ * excused real lies: a refused delete reporting "Workspace deleted." went
+ * unreported because the Danger zone said "This cannot be undone."
+ */
+const REFUSAL_RE = /\b(?:can(?:not|[’'`]?t| not)|must be|(?:is|are) already|only (?:an? |the )?\w+(?: \w+)? (?:can|may|be)|may only|can only(?: be)?|(?:nothing|not) (?:was|has been|have been|been) (?:saved|sent|deleted|updated|created|changed|submitted)|(?:was|were|has|have|is|are)(?: not|n[’']t)(?: been)? (?:saved|sent|deleted|updated|created|changed|submitted))\b/i;
+/** Whether a piece of announced text explains a refusal. */
+export function isRefusalNotice(text) {
+    const trimmed = text.trim();
+    return trimmed.length > 0 && trimmed.length <= CLAIM_TEXT_MAX && REFUSAL_RE.test(trimmed);
+}
 /** Longest piece of text judged. An empty state is a sentence; a paragraph that happens to contain one of these words is not a claim. */
 export const CLAIM_TEXT_MAX = 120;
 /**
@@ -122,6 +144,10 @@ export function findContradictions(requests, page) {
     // an error banner and a stale empty state is not reported.
     if (claims.includes("error"))
         return [];
+    // A refusal explained in the app's own words, where the page announces its
+    // responses. Help text with the same wording elsewhere excuses nothing.
+    if ((page.announced ?? []).some(isRefusalNotice))
+        return [];
     const out = [];
     const reads = refused.filter((r) => !WRITING_METHODS.has(r.method.toUpperCase()));
     const saysEmpty = claims.includes("empty") || page.emptyLists > 0;
@@ -148,6 +174,8 @@ export function findContradictions(requests, page) {
     }
     return out;
 }
+/** Most announced regions read from one page. */
+export const MAX_ANNOUNCED = 40;
 /** Most pieces of text read from one page. A page with more than this has nothing useful to say in the extra ones. */
 export const MAX_CLAIM_TEXTS = 120;
 /**
@@ -167,6 +195,11 @@ export const MAX_CLAIM_TEXTS = 120;
 export const CLAIM_SCAN_SCRIPT = `(() => {
   const visible = ${VISIBLE_SRC};
   const texts = [];
+  const announced = [];
+  // Where a page SAYS something in response to an action. Not dialogs: a modal
+  // is a container of static text (its form's help, its warning), and counting
+  // it brought back the help text this set exists to exclude.
+  const ANNOUNCES = "[role~='status'], [role~='alert'], [aria-live]:not([aria-live='off']), output";
   const seen = new Set();
   const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_ELEMENT);
   let el = document.body;
@@ -197,5 +230,20 @@ export const CLAIM_SCAN_SCRIPT = `(() => {
     const rows = list.querySelectorAll(":scope > li, :scope > [role='row'], :scope > [role='listitem']");
     if (rows.length === 0) emptyLists += 1;
   }
-  return { texts, emptyLists };
+  // Read on its own, past the cap on page texts: a toast rendered at the end of
+  // a long page is exactly the text that must not be missed.
+  for (const region of document.querySelectorAll(ANNOUNCES)) {
+    if (!visible(region)) continue;
+    // innerText, not textContent: hidden parts of a region are not said. Split
+    // into sentences so a long region is read rather than dropped whole.
+    const said = (region.innerText || "").replace(/\\s+/g, " ").trim();
+    for (const sentence of said.split(/(?<=[.!?])\\s+/)) {
+      if (announced.length >= ${MAX_ANNOUNCED}) break;
+      const s = sentence.trim();
+      if (s && s.length <= ${CLAIM_TEXT_MAX} && !announced.includes(s)) announced.push(s);
+    }
+  }
+
+
+  return { texts, announced, emptyLists };
 })()`;

package/dist/engine/live-page.js

@@ -225,6 +225,7 @@ export const LIVE_PAGE = `<!doctype html>
   <div class="bar">
     <strong id="focus-name"></strong>
     <span class="line" id="focus-line"></span>
+    <button type="button" id="focus-stream" aria-pressed="false" data-testid="live-focus-stream-toggle">Stream</button>
     <button type="button" id="focus-close" data-testid="live-focus-close">Close</button>
   </div>
   <div class="stage" id="focus-stage">
@@ -253,6 +254,11 @@ export const LIVE_PAGE = `<!doctype html>
   /** The header filter, lower-cased. Hides cards; never stops a session running. */
   var filter = '';
   var focused = null;
+  // Whether opening the close-up is what switched its session's stream on. The
+  // close-up streams while it is open; closing it hands the card back as it
+  // was, unless the viewer used the close-up's own Stream button, whose choice
+  // stands.
+  var focusStartedStream = false;
   var skew = 0;
   var latest = {};
   var focusTick = 0;
@@ -309,7 +315,6 @@ export const LIVE_PAGE = `<!doctype html>
   function syncEvents() {
     var want = {};
     Object.keys(cards).forEach(function (name) { if (cards[name].live) want[name] = true; });
-    if (focused && cards[focused]) want[focused] = true;
     var key = Object.keys(want).sort().join(',');
     if (key === eventsKey) return;
     eventsKey = key;
@@ -353,8 +358,20 @@ export const LIVE_PAGE = `<!doctype html>
     // Frames for a live card arrive over the shared connection; the thumbnail poll takes over again when it is switched off.
     if (on && frames[card.name]) card.img.src = frames[card.name];
     if (!on) card.img.src = shotUrl(card.name);
+    if (focused === card.name) paintFocusStream();
     syncEvents();
   }
+  // The close-up's Stream button is the card's, shown where the viewer is looking.
+  function paintFocusStream() {
+    var card = focused && cards[focused];
+    var button = document.getElementById('focus-stream');
+    button.hidden = !card;
+    if (!card) return;
+    button.setAttribute('aria-pressed', card.live ? 'true' : 'false');
+    button.textContent = card.live ? 'Streaming' : 'Stream';
+    // Off, the picture is a still that the status poll refreshes.
+    if (!card.live && !scrubbed) document.getElementById('focus-img').src = shotUrl(card.name);
+  }
   function refreshThumb(card) {
     if (card.live || document.hidden) return;
     var next = new Image();
@@ -697,7 +714,7 @@ export const LIVE_PAGE = `<!doctype html>
     scrubbed = null;
     document.getElementById('scrub-where').textContent = 'Live';
     document.getElementById('scrub-live').hidden = true;
-    if (focused) document.getElementById('focus-img').src = frames[focused] || shotUrl(focused);
+    if (focused) document.getElementById('focus-img').src = (cards[focused] && cards[focused].live && frames[focused]) || shotUrl(focused);
     // Otherwise the step just left keeps its outline until the next full feed.
     renderTimeline(null);
   }
@@ -794,6 +811,10 @@ export const LIVE_PAGE = `<!doctype html>
     document.getElementById('scrub-where').textContent = 'Live';
     document.getElementById('scrub-live').hidden = true;
     document.getElementById('focus').classList.add('open');
+    var card = cards[name];
+    focusStartedStream = !!card && !card.live;
+    if (focusStartedStream) setLive(card, true);
+    paintFocusStream();
     hoverTask = null;
     renderFeed(document.getElementById('focus-feed'), (latest[name] || {}).feed, showTask);
     syncEvents();
@@ -806,6 +827,8 @@ export const LIVE_PAGE = `<!doctype html>
     focused = null;
     document.getElementById('focus').classList.remove('open');
     document.getElementById('focus-img').removeAttribute('src');
+    if (focusStartedStream && was && cards[was]) setLive(cards[was], false);
+    focusStartedStream = false;
     syncEvents();
     if (was && cards[was]) cards[was].shot.focus();
   }
@@ -865,6 +888,7 @@ export const LIVE_PAGE = `<!doctype html>
     if (!s) { line.textContent = focused ? 'This session has closed.' : ''; return; }
     var d = describe(s);
     line.textContent = d.badge + ' · ' + d.tool + ' · ' + (s.url || '');
+    paintFocusStream();
     if (focusTick % 3 === 0) loadFullFeed(focused);
     focusTick += 1;
   }
@@ -981,6 +1005,13 @@ export const LIVE_PAGE = `<!doctype html>
   });
   document.getElementById('focus-img').addEventListener('load', function () { document.getElementById('focus-stage').classList.remove('empty'); });
   document.getElementById('focus-close').addEventListener('click', closeFocus);
+  document.getElementById('focus-stream').addEventListener('click', function () {
+    var card = focused && cards[focused];
+    if (!card) return;
+    // The viewer chose: closing the close-up no longer undoes it.
+    focusStartedStream = false;
+    setLive(card, !card.live);
+  });
   // A re-rendered feed replaces the group under the pointer without a mouseleave; leaving the feed itself still resets.
   document.getElementById('focus-feed').addEventListener('mouseleave', function () { showTask(null); });
   document.getElementById('focus').addEventListener('click', function (e) { if (e.target === this) closeFocus(); });

package/dist/engine/memory.js

@@ -283,6 +283,13 @@ function decisionKey(d) {
  * them on each save, which is what made an old history slow to open.
  */
 export const MAX_LANE_DECISIONS = 1000;
+/**
+ * Most options a dropdown may have and still be tracked for unchosen options.
+ * A status or sort filter has a handful, each of which can change what the
+ * page asks the server for; a country or time-zone picker has hundreds, and
+ * nobody owes the page a choice of each. Larger dropdowns are not tracked.
+ */
+export const MAX_SELECT_OPTIONS = 20;
 const MAX_DISCOVERED_ROUTES = 300;
 /** Shared finding-similarity helpers (used by live dedup and retro-merge). */
 function findingTokens(s) {
@@ -412,6 +419,63 @@ function sameEndpointBug(existing, incoming) {
         return false;
     return sharesEndpointSignature(existing, incoming);
 }
+/**
+ * Whether two pieces of evidence each name a request and share none — compared
+ * by method and normalised path, ignoring the status, so `GET /api/x` and
+ * `GET /api/x/ 404` are one request. Evidence that names no request (a test id,
+ * a toast's text) disagrees with nothing.
+ */
+export function requestsDisagree(a, b) {
+    const requests = (ev) => new Set([...endpointSignatures(ev)].map((sig) => sig.split(" ").slice(0, 2).join(" ")));
+    const aReq = requests(a);
+    const bReq = requests(b);
+    if (aReq.size === 0 || bReq.size === 0)
+        return false;
+    for (const r of aReq)
+        if (bReq.has(r))
+            return false;
+    return true;
+}
+/**
+ * Families of finding kinds that one bug is plausibly filed under by two
+ * sessions: a crash is a page-error to one and a console-error to another, a
+ * refused save is data-loss to one and data-inconsistency to another. Across
+ * families — a layout defect and a data defect — a shared quoted string names
+ * a place on the page, not a bug.
+ */
+const CATEGORY_FAMILY = {
+    "data-inconsistency": "data",
+    "data-loss": "data",
+    "stale-state": "data",
+    "http-error": "failure",
+    network: "failure",
+    "console-error": "failure",
+    "page-error": "failure",
+    visual: "presentation",
+    "ux-polish": "presentation",
+    a11y: "presentation",
+    "missing-testid": "presentation",
+    "ux-confusing": "flow",
+    "dead-end": "flow",
+    security: "security",
+    "permission-leak": "security",
+    performance: "performance",
+};
+/**
+ * Whether two categories are one family. "other" — the category for nothing
+ * that fits — is a family of its own: as a wildcard, one "other" finding
+ * quoting a control absorbed both the layout and the data finding about it. A
+ * missing or unknown category matches nothing, so a finding read from an older
+ * file never merges on a guess.
+ */
+export function sameFamily(a, b) {
+    if (!a || !b)
+        return false;
+    if (a === "other" || b === "other")
+        return a === b;
+    const fa = CATEGORY_FAMILY[a];
+    return fa !== undefined && fa === CATEGORY_FAMILY[b];
+}
 function sameFinding(a, b) {
     const aEv = a.evidence?.toLowerCase().replace(/\s+/g, " ").trim();
     const bEv = b.evidence?.toLowerCase().replace(/\s+/g, " ").trim();
@@ -426,17 +490,39 @@ function sameFinding(a, b) {
     // them, and collapsed into one. Matching a title literal against the other
     // finding's full text keeps the intended case (one states the string in its
     // title, the other mentions it in its detail).
-    const aTitleLits = findingLiterals(a.title);
-    const bTitleLits = findingLiterals(b.title);
-    if (aTitleLits.size > 0 || bTitleLits.size > 0) {
-        const aAll = findingLiterals(a.title, a.detail, a.evidence);
-        const bAll = findingLiterals(b.title, b.detail, b.evidence);
-        for (const lit of aTitleLits)
-            if (bAll.has(lit))
-                return true;
-        for (const lit of bTitleLits)
-            if (aAll.has(lit))
-                return true;
+    //
+    // Only between findings of one FAMILY of kinds (see sameFamily). A quoted
+    // string is as often the name of a control as a message the app showed, and
+    // a layout defect naming the button it covers ("Save notes") shares that
+    // literal with the data defect describing what the button does — in its
+    // detail or its own title. Merged, the layout defect was filed and then lost
+    // from the report on most runs of a benchmark. Within a family, one bug
+    // filed twice under neighbouring categories still merges.
+    //
+    // And never when both findings' evidence names requests with no endpoint in
+    // common. A quoted control name bridges two findings about that control
+    // within one family too: "an unknown order id still offers its actions"
+    // (GET /api/orders/9999 404) mentions the "Request manager approval" button
+    // that "Request manager approval stays enabled on a pending order" (POST
+    // …/request-approval 409) quotes in its title, and was merged into it.
+    // Evidence that names a request is the finding's own statement of where it
+    // happened; two findings naming different requests are two bugs. A request
+    // that answered 2xx counts too — a false success names one — so the same bug
+    // described once by its page load and once by its failing call stays as two
+    // findings: a visible duplicate, the direction ADR 4 accepts.
+    if (sameFamily(a.category, b.category) && !requestsDisagree(a.evidence, b.evidence)) {
+        const aTitleLits = findingLiterals(a.title);
+        const bTitleLits = findingLiterals(b.title);
+        if (aTitleLits.size > 0 || bTitleLits.size > 0) {
+            const aAll = findingLiterals(a.title, a.detail, a.evidence);
+            const bAll = findingLiterals(b.title, b.detail, b.evidence);
+            for (const lit of aTitleLits)
+                if (bAll.has(lit))
+                    return true;
+            for (const lit of bTitleLits)
+                if (aAll.has(lit))
+                    return true;
+        }
     }
     // Both carry evidence and neither matched above: distinct bugs, however
     // similar the titles — never fuzzy-merge across differing evidence.
@@ -595,6 +681,44 @@ export class MemoryStore {
         this.probes = [];
         this.injectionsReported.clear();
         this.auditsThisRun = 0;
+        this.selectChoices.clear();
+    }
+    /**
+     * Each dropdown's options and the ones chosen in THIS run, by any session,
+     * keyed by route and element. A select counts as exercised after one choice,
+     * so a lane that tried four of a filter's seven options — and reported having
+     * tried them all — left the one that failed untried with nothing to say so.
+     * Per run, like the probes: whether an earlier run chose an option says
+     * nothing about whether this one looked. Keyed without the role: when two
+     * roles see different options in one dropdown, the list read last is the
+     * one reported.
+     */
+    selectChoices = new Map();
+    recordSelectChoice(fingerprint, key, options, chosen) {
+        const route = fingerprint.split("#")[0];
+        const id = `${route}\u0000${key}`;
+        const distinct = [...new Set(options)];
+        if (distinct.length > MAX_SELECT_OPTIONS) {
+            this.selectChoices.delete(id);
+            return;
+        }
+        const entry = this.selectChoices.get(id) ?? { route, key, options: [], chosen: new Set() };
+        // The latest list wins: options a page added or removed since are not owed.
+        if (distinct.length > 0)
+            entry.options = distinct;
+        if (chosen)
+            entry.chosen.add(chosen);
+        this.selectChoices.set(id, entry);
+    }
+    /** Dropdowns with options no session chose this run, in the order they were first used. */
+    unchosenOptions() {
+        const out = [];
+        for (const { route, key, options, chosen } of this.selectChoices.values()) {
+            const unchosen = options.filter((o) => !chosen.has(o));
+            if (unchosen.length > 0)
+                out.push({ route, key, unchosen });
+        }
+        return out;
     }
     constructor(projectDir) {
         this.dir = path.join(projectDir, MEMORY_DIRNAME);

package/dist/engine/report.js

@@ -318,6 +318,21 @@ export function formatRouteCoverage(allRoutes, unvisited) {
             ? ` — UNVISITED: ${unvisited.slice(0, 25).join(", ")}${unvisited.length > 25 ? " …" : ""} (scout_crawl covers these in one call)`
             : " ✓"));
 }
+/**
+ * The dropdowns this run used without trying every option. A select counts as
+ * exercised after one choice, so the unexercised list above never shows these:
+ * a status filter whose one failing option nobody chose looks fully covered.
+ * Empty when there is nothing to say.
+ */
+export function formatUnchosenOptions(dropdowns) {
+    if (dropdowns.length === 0)
+        return [];
+    return [
+        "Dropdown options never chosen this run (each can change what the page asks the server for):",
+        ...dropdowns.slice(0, 15).map((d) => `  ${d.route} ${d.key}: ${d.unchosen.map((o) => JSON.stringify(o)).join(", ")}`),
+        ...(dropdowns.length > 15 ? [`  … +${dropdowns.length - 15} more`] : []),
+    ];
+}
 /**
  * The GAP LEDGER — an explicit enumeration of what was NOT tested. This is
  * what turns "extensive" from a vibe into a verifiable claim: a run is only

package/dist/mcp-server.js

@@ -41,7 +41,7 @@ import { SessionQueue, withWatchdog } from "./engine/dispatch.js";
 import { FIXTURE_KINDS } from "./engine/fixtures.js";
 import { feedForSession, LIVE_ENV, writeStatusFile, LIVE_TOKEN_FILE, liveEngines, liveTokenFileName, pidAlive, statusFileName, LiveServer, StatusBoard, } from "./engine/live.js";
 import { formatBriefs, MAX_LANES, planLanes } from "./engine/brief.js";
-import { computeGaps, formatRouteCoverage, generateReport, replayDocument, reportEvidence } from "./engine/report.js";
+import { computeGaps, formatRouteCoverage, formatUnchosenOptions, generateReport, replayDocument, reportEvidence } from "./engine/report.js";
 import { describeVerdict, formatWorklist, unknownIds, VERDICTS, verifyWorklist } from "./engine/verify.js";
 import { RECORD_MAX_FRAMES, resolveFrame } from "./engine/replay.js";
 import { describePace, normalizePace } from "./engine/settle.js";
@@ -1147,14 +1147,14 @@ server.registerTool("scout_finding", {
             ? `Finding recorded: [${finding.severity}] ${finding.title} (id ${finding.id})`
             : finding.regressedAt
                 ? `⟳ REOPENED as a REGRESSION: finding ${finding.id} was previously resolved but the evidence reproduces again (seen in ${finding.runs} runs). Worth calling out to the user.`
-                : `Duplicate of existing finding ${finding.id} (seen in ${finding.runs} runs) — already known, keep exploring.`, session);
+                : `Not recorded as new: merged into existing finding ${finding.id} — [${finding.severity}] ${finding.title}${finding.evidence ? ` (evidence: ${finding.evidence.slice(0, 160)})` : " (no evidence)"}, seen in ${finding.runs} runs. If yours is a different bug, file it again with evidence naming the request that failed for you (method and path): two findings are kept apart when both name requests and none is shared.`, session);
     }
     catch (err) {
         return errorText(err);
     }
 }));
 server.registerTool("scout_coverage", {
-    description: "Show exploration coverage: states visited across all runs and which elements remain unexercised. Use to decide where to explore next and when the level's budget is satisfied.",
+    description: "Show exploration coverage: states visited across all runs, which elements remain unexercised, and which options of a dropdown used this run no session has chosen yet. Use to decide where to explore next and when the level's budget is satisfied.",
     inputSchema: { session: sessionParam },
 }, serializedPerSession("scout_coverage", async (_args, session) => {
     try {
@@ -1173,6 +1173,7 @@ server.registerTool("scout_coverage", {
             formatRouteCoverage(eng.allKnownRoutes(), unvisited),
             `Unexercised elements by route:`,
             ...cov.unexercised.slice(0, 25).map((u) => `  ${u.state}: ${u.keys.slice(0, 6).join(", ")}${u.keys.length > 6 ? ` … +${u.keys.length - 6}` : ""}`),
+            ...formatUnchosenOptions(eng.memory.unchosenOptions()),
         ];
         return text(lines.join("\n"), session);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",

package/skills/scenescout/SKILL.md

@@ -42,7 +42,7 @@ You are the brain of an exploratory UI tester. The SceneScout MCP server gives y
 8. **Design-connoisseur pass without pixels: `scout_design_audit`.** Run it once per representative page (dashboard, a form, a detail view, a data table). Its output has two tiers: **⚠ measurable defects** (WCAG contrast, tiny targets, clipped text, aspect-distorted images, horizontal overflow, keyboard tab stops with no visible focus indicator — sampled with real Tab presses) and **→ craft suggestions** (line measure and line-height rhythm, spacing-grid adherence, typography entropy, gray census and accent-hue count, pure-#000 body text, elevation/control consistency, heading structure, indistinguishable links, AI-slop tells like gradient text/glassmorphism/side-stripe borders/identical card grids), closing with a SYSTEM SUMMARY of design-system coherence. Judge every line with product context (dense tables legitimately have small targets; a chart page legitimately uses many hues). File ⚠ defects as `visual`/`a11y`, and genuine → opportunities as `ux-polish` findings **quoting the concrete numbers** — "~142 characters per line (65–75 ideal)" beats "text feels wide". Every audit ends with a **PAGE SCORE** (0–100 overall + a11y/craft/consistency/task-clarity subscores) persisted per route — the report ranks pages worst-first, so re-runs show whether pages got better or worse. Separately, every `scout_snapshot` runs an **overlay/modal probe** automatically: an empty dialog over a grayed page, a backdrop with no dialog, a far-off-centre dialog leaving a blank band, or a dialog extending unreachably below the viewport appear as OVERLAY lines in GEOMETRY issues — treat these as high-value findings (the user is visually stuck). This is where "how could this page be better" gets answered, not just "is it broken".
 9. **Measure task EASE with `scout_journey`, not just correctness.** Wrap each module's primary task (`{action:"start", goal:"Create an order"}` → do it → `{action:"end", completed:…}`). Navigate by CLICKING like a first-time user — typing a known deep URL shortcuts the very thing being measured (a route you can only reach by editing the address bar is itself a finding). The result gives interaction count, distinct screens, the path taken, and BACKTRACKS — returning to a screen already left is the clearest evidence the next step wasn't discoverable. An abandoned journey (`completed:false`) is a high-severity finding: the task is blocked or undiscoverable, which no passing e2e suite would ever reveal.
 10. **Walk the auth surface too — anonymously.** Attach a second session WITHOUT a storage-state file (a fresh logged-out profile) and exercise signup, login failure states, and forgot/reset-password **as far as they physically go**. The mailbox wall is expected — reaching "check your email" IS the success condition; everything before it is what you're testing: does submit actually fire (a dead signup button is a high finding), are errors specific and actionable, can the user resend or recover from a typo, does the flow dead-end. Use plausible synthetic identities only (invent `qa-<runid>@example.com`-style addresses, never a real person's), submit each form valid AND invalid, and judge the feedback. Two classic findings live here: a forgot-password that answers "no account with that email" is an **account-enumeration leak** (file as security; "if an account exists, we sent a link" is the correct shape), and a signup that accepts the form then lands on a blank or logged-out page with no guidance is a **journey dead-end**. Signup creates a record, so what this pass may do depends on the mode. In `observe`, fill and submit the auth forms for their CLIENT-SIDE behaviour only: the engine blocks signup, password change and reset, and lets only a login itself go out. Disclose the server-side half as a gap. Actually creating an account needs the user's explicit okay and safe-write mode; the engine tracks the created account like any other creation.
-11. **`scout_coverage` decides what's next** — it lists unvisited routes and unexercised elements. Trust it over your memory. Prefer reaching routes by clicking real navigation; fall back to direct URLs for coverage completeness and re-verification, and say which you used when it affects the finding (see the provenance rule below).
+11. **`scout_coverage` decides what's next** — it lists unvisited routes, unexercised elements, and the options of each dropdown you used that no session has chosen this run (a filter counts as exercised after one choice, and the option you skipped can be the one whose request fails). Trust it over your memory. Prefer reaching routes by clicking real navigation; fall back to direct URLs for coverage completeness and re-verification, and say which you used when it affects the finding (see the provenance rule below).
 
 ## Levels (completion contracts — the engine ENFORCES them via `scout_report {level}`)