scenescout 3.6.1 → 3.7.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # scenescout
 
+## 3.7.0
+
+### Minor Changes
+
+- 1b4a688: The live view's close-up has its own Stream button, the same one as the session's card: switch streaming off or on without leaving the close-up. Opening a close-up still streams its session, and closing it without touching the button leaves the card as it was.
+- a11c96e: `scout_coverage` lists the options of each dropdown used in the run that no session has chosen, since a filter counts as exercised after one choice. Disabled and hidden options, and an empty-value placeholder or "all" option, are never listed; dropdowns with more than 20 options are pickers and are not listed either.
+
+### Patch Changes
+
+- b726af1: Two findings that quote the same control no longer merge when their evidence names different requests, and a filing merged into an existing finding now names it, with its severity and title.
+- 56382db: The lane-report fold no longer lists a judged defect as unfiled when its evidence appears word for word inside a filed finding's evidence.
+
 ## 3.6.1
 
 ### Patch Changes

package/dist/engine/browser.js

@@ -56,6 +56,31 @@ const BENIGN_MUTATION_RE = /\/auth\/(refresh|token|session)|refresh[-_]?token|\/
 function xpathLookup(xpath) {
     return `document.evaluate(${JSON.stringify(xpath)}, document, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue`;
 }
+/**
+ * Runs in the page against one dropdown, BEFORE a choice: its options' values
+ * and labels. Read first because a dropdown may reset itself (a bulk-action or
+ * "jump to" menu) or remove itself on change. Skips disabled and hidden
+ * options, and a placeholder or "all" option with an empty value — the state
+ * the page loads in, which is not an option anyone owes a choice.
+ */
+function describeSelect(node) {
+    // A plan may target the dropdown by its <label>; selectOption follows a label to its control, so this does too.
+    const target = node instanceof HTMLLabelElement ? (node.control ?? node.querySelector("select")) : node;
+    const select = target;
+    if (!select || !select.options)
+        return null;
+    return Array.from(select.options)
+        .filter((o) => !o.disabled && !o.hidden && o.value !== "")
+        .map((o) => ({ value: o.value, label: (o.label || o.textContent || "").trim().slice(0, 80) }))
+        .filter((o) => o.label !== "");
+}
+/**
+ * A dropdown's options, read without waiting: a select that is not there to
+ * read is not worth stalling the action for.
+ */
+async function readSelectOptions(loc) {
+    return loc.evaluate(describeSelect, undefined, { timeout: 1000 }).catch(() => null);
+}
 /** Runs in the page against one file input (or the one a chooser belongs to). */
 function describeFileInput(node) {
     const input = node;
@@ -1783,6 +1808,15 @@ export class BrowserEngine {
                 ? `\nRevealed on hover:\n${notes.map((t) => `  · ${t}`).join("\n")}${caveat}`
                 : `\n(no tooltip, overlay, or new page text appeared within ${HOVER_REVEAL_WINDOW_MS / 1000}s — this element reveals nothing on hover${churning ? "; page content was changing on its own, so the text-diff fallback was suppressed" : ""}${this.headed ? ". NOTE: in headed mode the PHYSICAL mouse cursor competes with the synthetic pointer — if it is resting over the browser window, hover warm-ups are cancelled; ask the user to move it off the window and retry" : ""})`));
     }
+    /** Record a dropdown's options and the ones picked, by the values selectOption reported. */
+    recordSelectChoice(fingerprint, key, options, picked) {
+        const labels = options.map((o) => o.label);
+        const chosen = picked.map((v) => options.find((o) => o.value === v)?.label).filter((l) => !!l);
+        if (chosen.length === 0)
+            this.memory.recordSelectChoice(fingerprint, key, labels, "");
+        for (const label of chosen)
+            this.memory.recordSelectChoice(fingerprint, key, labels, label);
+    }
     async select(ref, value) {
         const page = this.requirePage();
         const { el, liveLabel } = await this.resolveForAction(ref);
@@ -1802,8 +1836,12 @@ export class BrowserEngine {
                 return destructiveRefusal(optionLabel || value, this.mode);
             }
         }
-        await page.locator(`xpath=${el.xpath}`).selectOption(value, { timeout: ACTION_TIMEOUT_MS });
+        const loc = page.locator(`xpath=${el.xpath}`);
+        const options = el.tag === "select" ? await readSelectOptions(loc) : null;
+        const picked = await loc.selectOption(value, { timeout: ACTION_TIMEOUT_MS });
         this.memory.markExercised(this.currentFingerprint, el.key, "select");
+        if (options)
+            this.recordSelectChoice(this.currentFingerprint, el.key, options, picked);
         return this.afterAction("select", `${el.role} "${el.name}" = ${value}`);
     }
     /**
@@ -2131,6 +2169,8 @@ export class BrowserEngine {
             // What a type step has to say about the field it typed into; it goes on
             // the step's own line, so it cannot read as the previous step's.
             let note = "";
+            // A select step's options and choice, recorded against the dropdown the bookkeeping below finds.
+            let chose = null;
             let preState = null;
             try {
                 if (step.action === "navigate") {
@@ -2215,8 +2255,12 @@ export class BrowserEngine {
                             await loc.press("Enter", { timeout: ACTION_TIMEOUT_MS });
                         }
                     }
-                    else if (step.action === "select")
-                        await loc.selectOption(step.value ?? "", { timeout: ACTION_TIMEOUT_MS });
+                    else if (step.action === "select") {
+                        const options = await readSelectOptions(loc);
+                        const picked = await loc.selectOption(step.value ?? "", { timeout: ACTION_TIMEOUT_MS });
+                        if (options)
+                            chose = { options, picked };
+                    }
                     else if (step.action === "upload") {
                         const r = await this.performUpload(loc, planUploadOptions(step.value));
                         if (r.refused) {
@@ -2263,12 +2307,13 @@ export class BrowserEngine {
                         // state so a target the pre-capture missed (or a failed capture)
                         // still records something rather than nothing.
                         const preHit = preState ? findIn(preState.elements) : undefined;
-                        if (preHit)
-                            this.memory.markExercised(preState.fp, preHit.key, `plan:${step.action}`);
-                        else {
-                            const postHit = findIn(elements);
-                            if (postHit)
-                                this.memory.markExercised(fp, postHit.key, `plan:${step.action}`);
+                        const postHit = preHit ? undefined : findIn(elements);
+                        const hit = preHit ? { fp: preState.fp, el: preHit } : postHit ? { fp, el: postHit } : undefined;
+                        if (hit) {
+                            this.memory.markExercised(hit.fp, hit.el.key, `plan:${step.action}`);
+                            // The lookup can fall back to a name match; options belong only to a dropdown.
+                            if (chose && hit.el.tag === "select")
+                                this.recordSelectChoice(hit.fp, hit.el.key, chose.options, chose.picked);
                         }
                     }
                     catch {

package/dist/engine/calibration.js

@@ -258,13 +258,46 @@ export function unfiledDefects(decisions, findings) {
             const ids = identifiers(d.evidence);
             const w = words(d.evidence);
             const text = squash(d.evidence);
-            if (filed.some((f) => (text !== "" && f.evidence === text) || covers(ids, w, f)))
+            if (filed.some((f) => (text !== "" && f.evidence === text) || restates(text, f) || covers(ids, w, f)))
                 continue;
         }
         out.push(d.evidence ? `${d.observation} — ${d.evidence}` : d.observation);
     }
     return out;
 }
+/**
+ * Shortest reported evidence that counts as restating a filing it is part of.
+ */
+const MIN_RESTATED = 24;
+/** A test id, captured without its attribute; and a kebab-case id of three or more parts. Lowercase text only. */
+const TESTID_RE = /testid=["']?([a-z0-9_-]+)/g;
+const KEBAB_ID_RE = /\b[a-z][a-z0-9]*(?:-[a-z0-9]+){2,}\b/g;
+/**
+ * Whether the reported evidence appears word for word inside a finding's
+ * evidence: a lane that filed "testid=row-1..6 non-interactive; GET /api/x 200
+ * with only three fields" and reported the first half. It must say something
+ * beyond naming a control — two words once test ids and kebab-case ids of
+ * three or more parts are taken out — or a bare "testid=inventory-sort-qty" would be found inside
+ * every finding about that control, which is the one-shared-id match covers()
+ * refuses. One direction only: a short FILED evidence found inside a longer
+ * report proves nothing about the rest of the report.
+ */
+function restates(reported, f) {
+    if (reported.length < MIN_RESTATED || !f.evidence.includes(reported))
+        return false;
+    const rest = reported.replace(TESTID_RE, " ").replace(KEBAB_ID_RE, " ");
+    return words(rest).size >= 2;
+}
+/**
+ * Whether a finding covers a decision. Lanes reword evidence between filing it
+ * and reporting it — an arrow for a hyphen, quoted JSON for bare, "8 links"
+ * for "8 link(s)" — but keep the identifiers: test ids and contrast ratios.
+ * Two shared identifiers, or a near-identical wording, is the same
+ * observation. One shared test id is never enough, with or without some
+ * words in common: two different defects on one control share both (sort by
+ * quantity sorting as text, and the same sort showing no active state), and a
+ * real miss must not hide behind its neighbour.
+ */
 function covers(ids, w, f) {
     let shared = 0;
     for (const id of ids)
@@ -284,9 +317,9 @@ function covers(ids, w, f) {
 function identifiers(text) {
     const out = new Set();
     const t = text.toLowerCase();
-    for (const m of t.matchAll(/testid=["']?([a-z0-9_-]+)/g))
+    for (const m of t.matchAll(TESTID_RE))
         out.add(m[1]);
-    for (const m of t.matchAll(/\b[a-z][a-z0-9]*(?:-[a-z0-9]+){2,}\b/g))
+    for (const m of t.matchAll(KEBAB_ID_RE))
         out.add(m[0]);
     for (const m of t.matchAll(/\b\d+(?:\.\d+)?:1\b/g))
         out.add(m[0]);

package/dist/engine/live-page.js

@@ -225,6 +225,7 @@ export const LIVE_PAGE = `<!doctype html>
   <div class="bar">
     <strong id="focus-name"></strong>
     <span class="line" id="focus-line"></span>
+    <button type="button" id="focus-stream" aria-pressed="false" data-testid="live-focus-stream-toggle">Stream</button>
     <button type="button" id="focus-close" data-testid="live-focus-close">Close</button>
   </div>
   <div class="stage" id="focus-stage">
@@ -253,6 +254,11 @@ export const LIVE_PAGE = `<!doctype html>
   /** The header filter, lower-cased. Hides cards; never stops a session running. */
   var filter = '';
   var focused = null;
+  // Whether opening the close-up is what switched its session's stream on. The
+  // close-up streams while it is open; closing it hands the card back as it
+  // was, unless the viewer used the close-up's own Stream button, whose choice
+  // stands.
+  var focusStartedStream = false;
   var skew = 0;
   var latest = {};
   var focusTick = 0;
@@ -309,7 +315,6 @@ export const LIVE_PAGE = `<!doctype html>
   function syncEvents() {
     var want = {};
     Object.keys(cards).forEach(function (name) { if (cards[name].live) want[name] = true; });
-    if (focused && cards[focused]) want[focused] = true;
     var key = Object.keys(want).sort().join(',');
     if (key === eventsKey) return;
     eventsKey = key;
@@ -353,8 +358,20 @@ export const LIVE_PAGE = `<!doctype html>
     // Frames for a live card arrive over the shared connection; the thumbnail poll takes over again when it is switched off.
     if (on && frames[card.name]) card.img.src = frames[card.name];
     if (!on) card.img.src = shotUrl(card.name);
+    if (focused === card.name) paintFocusStream();
     syncEvents();
   }
+  // The close-up's Stream button is the card's, shown where the viewer is looking.
+  function paintFocusStream() {
+    var card = focused && cards[focused];
+    var button = document.getElementById('focus-stream');
+    button.hidden = !card;
+    if (!card) return;
+    button.setAttribute('aria-pressed', card.live ? 'true' : 'false');
+    button.textContent = card.live ? 'Streaming' : 'Stream';
+    // Off, the picture is a still that the status poll refreshes.
+    if (!card.live && !scrubbed) document.getElementById('focus-img').src = shotUrl(card.name);
+  }
   function refreshThumb(card) {
     if (card.live || document.hidden) return;
     var next = new Image();
@@ -697,7 +714,7 @@ export const LIVE_PAGE = `<!doctype html>
     scrubbed = null;
     document.getElementById('scrub-where').textContent = 'Live';
     document.getElementById('scrub-live').hidden = true;
-    if (focused) document.getElementById('focus-img').src = frames[focused] || shotUrl(focused);
+    if (focused) document.getElementById('focus-img').src = (cards[focused] && cards[focused].live && frames[focused]) || shotUrl(focused);
     // Otherwise the step just left keeps its outline until the next full feed.
     renderTimeline(null);
   }
@@ -794,6 +811,10 @@ export const LIVE_PAGE = `<!doctype html>
     document.getElementById('scrub-where').textContent = 'Live';
     document.getElementById('scrub-live').hidden = true;
     document.getElementById('focus').classList.add('open');
+    var card = cards[name];
+    focusStartedStream = !!card && !card.live;
+    if (focusStartedStream) setLive(card, true);
+    paintFocusStream();
     hoverTask = null;
     renderFeed(document.getElementById('focus-feed'), (latest[name] || {}).feed, showTask);
     syncEvents();
@@ -806,6 +827,8 @@ export const LIVE_PAGE = `<!doctype html>
     focused = null;
     document.getElementById('focus').classList.remove('open');
     document.getElementById('focus-img').removeAttribute('src');
+    if (focusStartedStream && was && cards[was]) setLive(cards[was], false);
+    focusStartedStream = false;
     syncEvents();
     if (was && cards[was]) cards[was].shot.focus();
   }
@@ -865,6 +888,7 @@ export const LIVE_PAGE = `<!doctype html>
     if (!s) { line.textContent = focused ? 'This session has closed.' : ''; return; }
     var d = describe(s);
     line.textContent = d.badge + ' · ' + d.tool + ' · ' + (s.url || '');
+    paintFocusStream();
     if (focusTick % 3 === 0) loadFullFeed(focused);
     focusTick += 1;
   }
@@ -981,6 +1005,13 @@ export const LIVE_PAGE = `<!doctype html>
   });
   document.getElementById('focus-img').addEventListener('load', function () { document.getElementById('focus-stage').classList.remove('empty'); });
   document.getElementById('focus-close').addEventListener('click', closeFocus);
+  document.getElementById('focus-stream').addEventListener('click', function () {
+    var card = focused && cards[focused];
+    if (!card) return;
+    // The viewer chose: closing the close-up no longer undoes it.
+    focusStartedStream = false;
+    setLive(card, !card.live);
+  });
   // A re-rendered feed replaces the group under the pointer without a mouseleave; leaving the feed itself still resets.
   document.getElementById('focus-feed').addEventListener('mouseleave', function () { showTask(null); });
   document.getElementById('focus').addEventListener('click', function (e) { if (e.target === this) closeFocus(); });

package/dist/engine/memory.js

@@ -283,6 +283,13 @@ function decisionKey(d) {
  * them on each save, which is what made an old history slow to open.
  */
 export const MAX_LANE_DECISIONS = 1000;
+/**
+ * Most options a dropdown may have and still be tracked for unchosen options.
+ * A status or sort filter has a handful, each of which can change what the
+ * page asks the server for; a country or time-zone picker has hundreds, and
+ * nobody owes the page a choice of each. Larger dropdowns are not tracked.
+ */
+export const MAX_SELECT_OPTIONS = 20;
 const MAX_DISCOVERED_ROUTES = 300;
 /** Shared finding-similarity helpers (used by live dedup and retro-merge). */
 function findingTokens(s) {
@@ -412,6 +419,23 @@ function sameEndpointBug(existing, incoming) {
         return false;
     return sharesEndpointSignature(existing, incoming);
 }
+/**
+ * Whether two pieces of evidence each name a request and share none — compared
+ * by method and normalised path, ignoring the status, so `GET /api/x` and
+ * `GET /api/x/ 404` are one request. Evidence that names no request (a test id,
+ * a toast's text) disagrees with nothing.
+ */
+export function requestsDisagree(a, b) {
+    const requests = (ev) => new Set([...endpointSignatures(ev)].map((sig) => sig.split(" ").slice(0, 2).join(" ")));
+    const aReq = requests(a);
+    const bReq = requests(b);
+    if (aReq.size === 0 || bReq.size === 0)
+        return false;
+    for (const r of aReq)
+        if (bReq.has(r))
+            return false;
+    return true;
+}
 /**
  * Families of finding kinds that one bug is plausibly filed under by two
  * sessions: a crash is a page-error to one and a console-error to another, a
@@ -474,7 +498,19 @@ function sameFinding(a, b) {
     // detail or its own title. Merged, the layout defect was filed and then lost
     // from the report on most runs of a benchmark. Within a family, one bug
     // filed twice under neighbouring categories still merges.
-    if (sameFamily(a.category, b.category)) {
+    //
+    // And never when both findings' evidence names requests with no endpoint in
+    // common. A quoted control name bridges two findings about that control
+    // within one family too: "an unknown order id still offers its actions"
+    // (GET /api/orders/9999 404) mentions the "Request manager approval" button
+    // that "Request manager approval stays enabled on a pending order" (POST
+    // …/request-approval 409) quotes in its title, and was merged into it.
+    // Evidence that names a request is the finding's own statement of where it
+    // happened; two findings naming different requests are two bugs. A request
+    // that answered 2xx counts too — a false success names one — so the same bug
+    // described once by its page load and once by its failing call stays as two
+    // findings: a visible duplicate, the direction ADR 4 accepts.
+    if (sameFamily(a.category, b.category) && !requestsDisagree(a.evidence, b.evidence)) {
         const aTitleLits = findingLiterals(a.title);
         const bTitleLits = findingLiterals(b.title);
         if (aTitleLits.size > 0 || bTitleLits.size > 0) {
@@ -645,6 +681,44 @@ export class MemoryStore {
         this.probes = [];
         this.injectionsReported.clear();
         this.auditsThisRun = 0;
+        this.selectChoices.clear();
+    }
+    /**
+     * Each dropdown's options and the ones chosen in THIS run, by any session,
+     * keyed by route and element. A select counts as exercised after one choice,
+     * so a lane that tried four of a filter's seven options — and reported having
+     * tried them all — left the one that failed untried with nothing to say so.
+     * Per run, like the probes: whether an earlier run chose an option says
+     * nothing about whether this one looked. Keyed without the role: when two
+     * roles see different options in one dropdown, the list read last is the
+     * one reported.
+     */
+    selectChoices = new Map();
+    recordSelectChoice(fingerprint, key, options, chosen) {
+        const route = fingerprint.split("#")[0];
+        const id = `${route}\u0000${key}`;
+        const distinct = [...new Set(options)];
+        if (distinct.length > MAX_SELECT_OPTIONS) {
+            this.selectChoices.delete(id);
+            return;
+        }
+        const entry = this.selectChoices.get(id) ?? { route, key, options: [], chosen: new Set() };
+        // The latest list wins: options a page added or removed since are not owed.
+        if (distinct.length > 0)
+            entry.options = distinct;
+        if (chosen)
+            entry.chosen.add(chosen);
+        this.selectChoices.set(id, entry);
+    }
+    /** Dropdowns with options no session chose this run, in the order they were first used. */
+    unchosenOptions() {
+        const out = [];
+        for (const { route, key, options, chosen } of this.selectChoices.values()) {
+            const unchosen = options.filter((o) => !chosen.has(o));
+            if (unchosen.length > 0)
+                out.push({ route, key, unchosen });
+        }
+        return out;
     }
     constructor(projectDir) {
         this.dir = path.join(projectDir, MEMORY_DIRNAME);

package/dist/engine/report.js

@@ -318,6 +318,21 @@ export function formatRouteCoverage(allRoutes, unvisited) {
             ? ` — UNVISITED: ${unvisited.slice(0, 25).join(", ")}${unvisited.length > 25 ? " …" : ""} (scout_crawl covers these in one call)`
             : " ✓"));
 }
+/**
+ * The dropdowns this run used without trying every option. A select counts as
+ * exercised after one choice, so the unexercised list above never shows these:
+ * a status filter whose one failing option nobody chose looks fully covered.
+ * Empty when there is nothing to say.
+ */
+export function formatUnchosenOptions(dropdowns) {
+    if (dropdowns.length === 0)
+        return [];
+    return [
+        "Dropdown options never chosen this run (each can change what the page asks the server for):",
+        ...dropdowns.slice(0, 15).map((d) => `  ${d.route} ${d.key}: ${d.unchosen.map((o) => JSON.stringify(o)).join(", ")}`),
+        ...(dropdowns.length > 15 ? [`  … +${dropdowns.length - 15} more`] : []),
+    ];
+}
 /**
  * The GAP LEDGER — an explicit enumeration of what was NOT tested. This is
  * what turns "extensive" from a vibe into a verifiable claim: a run is only

package/dist/mcp-server.js

@@ -41,7 +41,7 @@ import { SessionQueue, withWatchdog } from "./engine/dispatch.js";
 import { FIXTURE_KINDS } from "./engine/fixtures.js";
 import { feedForSession, LIVE_ENV, writeStatusFile, LIVE_TOKEN_FILE, liveEngines, liveTokenFileName, pidAlive, statusFileName, LiveServer, StatusBoard, } from "./engine/live.js";
 import { formatBriefs, MAX_LANES, planLanes } from "./engine/brief.js";
-import { computeGaps, formatRouteCoverage, generateReport, replayDocument, reportEvidence } from "./engine/report.js";
+import { computeGaps, formatRouteCoverage, formatUnchosenOptions, generateReport, replayDocument, reportEvidence } from "./engine/report.js";
 import { describeVerdict, formatWorklist, unknownIds, VERDICTS, verifyWorklist } from "./engine/verify.js";
 import { RECORD_MAX_FRAMES, resolveFrame } from "./engine/replay.js";
 import { describePace, normalizePace } from "./engine/settle.js";
@@ -1147,14 +1147,14 @@ server.registerTool("scout_finding", {
             ? `Finding recorded: [${finding.severity}] ${finding.title} (id ${finding.id})`
             : finding.regressedAt
                 ? `⟳ REOPENED as a REGRESSION: finding ${finding.id} was previously resolved but the evidence reproduces again (seen in ${finding.runs} runs). Worth calling out to the user.`
-                : `Duplicate of existing finding ${finding.id} (seen in ${finding.runs} runs) — already known, keep exploring.`, session);
+                : `Not recorded as new: merged into existing finding ${finding.id} — [${finding.severity}] ${finding.title}${finding.evidence ? ` (evidence: ${finding.evidence.slice(0, 160)})` : " (no evidence)"}, seen in ${finding.runs} runs. If yours is a different bug, file it again with evidence naming the request that failed for you (method and path): two findings are kept apart when both name requests and none is shared.`, session);
     }
     catch (err) {
         return errorText(err);
     }
 }));
 server.registerTool("scout_coverage", {
-    description: "Show exploration coverage: states visited across all runs and which elements remain unexercised. Use to decide where to explore next and when the level's budget is satisfied.",
+    description: "Show exploration coverage: states visited across all runs, which elements remain unexercised, and which options of a dropdown used this run no session has chosen yet. Use to decide where to explore next and when the level's budget is satisfied.",
     inputSchema: { session: sessionParam },
 }, serializedPerSession("scout_coverage", async (_args, session) => {
     try {
@@ -1173,6 +1173,7 @@ server.registerTool("scout_coverage", {
             formatRouteCoverage(eng.allKnownRoutes(), unvisited),
             `Unexercised elements by route:`,
             ...cov.unexercised.slice(0, 25).map((u) => `  ${u.state}: ${u.keys.slice(0, 6).join(", ")}${u.keys.length > 6 ? ` … +${u.keys.length - 6}` : ""}`),
+            ...formatUnchosenOptions(eng.memory.unchosenOptions()),
         ];
         return text(lines.join("\n"), session);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenescout",
-  "version": "3.6.1",
+  "version": "3.7.0",
   "description": "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memory across runs and a gap-checked report.",
   "license": "MIT",
   "author": "brunoboto96",

package/skills/scenescout/SKILL.md

@@ -42,7 +42,7 @@ You are the brain of an exploratory UI tester. The SceneScout MCP server gives y
 8. **Design-connoisseur pass without pixels: `scout_design_audit`.** Run it once per representative page (dashboard, a form, a detail view, a data table). Its output has two tiers: **⚠ measurable defects** (WCAG contrast, tiny targets, clipped text, aspect-distorted images, horizontal overflow, keyboard tab stops with no visible focus indicator — sampled with real Tab presses) and **→ craft suggestions** (line measure and line-height rhythm, spacing-grid adherence, typography entropy, gray census and accent-hue count, pure-#000 body text, elevation/control consistency, heading structure, indistinguishable links, AI-slop tells like gradient text/glassmorphism/side-stripe borders/identical card grids), closing with a SYSTEM SUMMARY of design-system coherence. Judge every line with product context (dense tables legitimately have small targets; a chart page legitimately uses many hues). File ⚠ defects as `visual`/`a11y`, and genuine → opportunities as `ux-polish` findings **quoting the concrete numbers** — "~142 characters per line (65–75 ideal)" beats "text feels wide". Every audit ends with a **PAGE SCORE** (0–100 overall + a11y/craft/consistency/task-clarity subscores) persisted per route — the report ranks pages worst-first, so re-runs show whether pages got better or worse. Separately, every `scout_snapshot` runs an **overlay/modal probe** automatically: an empty dialog over a grayed page, a backdrop with no dialog, a far-off-centre dialog leaving a blank band, or a dialog extending unreachably below the viewport appear as OVERLAY lines in GEOMETRY issues — treat these as high-value findings (the user is visually stuck). This is where "how could this page be better" gets answered, not just "is it broken".
 9. **Measure task EASE with `scout_journey`, not just correctness.** Wrap each module's primary task (`{action:"start", goal:"Create an order"}` → do it → `{action:"end", completed:…}`). Navigate by CLICKING like a first-time user — typing a known deep URL shortcuts the very thing being measured (a route you can only reach by editing the address bar is itself a finding). The result gives interaction count, distinct screens, the path taken, and BACKTRACKS — returning to a screen already left is the clearest evidence the next step wasn't discoverable. An abandoned journey (`completed:false`) is a high-severity finding: the task is blocked or undiscoverable, which no passing e2e suite would ever reveal.
 10. **Walk the auth surface too — anonymously.** Attach a second session WITHOUT a storage-state file (a fresh logged-out profile) and exercise signup, login failure states, and forgot/reset-password **as far as they physically go**. The mailbox wall is expected — reaching "check your email" IS the success condition; everything before it is what you're testing: does submit actually fire (a dead signup button is a high finding), are errors specific and actionable, can the user resend or recover from a typo, does the flow dead-end. Use plausible synthetic identities only (invent `qa-<runid>@example.com`-style addresses, never a real person's), submit each form valid AND invalid, and judge the feedback. Two classic findings live here: a forgot-password that answers "no account with that email" is an **account-enumeration leak** (file as security; "if an account exists, we sent a link" is the correct shape), and a signup that accepts the form then lands on a blank or logged-out page with no guidance is a **journey dead-end**. Signup creates a record, so what this pass may do depends on the mode. In `observe`, fill and submit the auth forms for their CLIENT-SIDE behaviour only: the engine blocks signup, password change and reset, and lets only a login itself go out. Disclose the server-side half as a gap. Actually creating an account needs the user's explicit okay and safe-write mode; the engine tracks the created account like any other creation.
-11. **`scout_coverage` decides what's next** — it lists unvisited routes and unexercised elements. Trust it over your memory. Prefer reaching routes by clicking real navigation; fall back to direct URLs for coverage completeness and re-verification, and say which you used when it affects the finding (see the provenance rule below).
+11. **`scout_coverage` decides what's next** — it lists unvisited routes, unexercised elements, and the options of each dropdown you used that no session has chosen this run (a filter counts as exercised after one choice, and the option you skipped can be the one whose request fails). Trust it over your memory. Prefer reaching routes by clicking real navigation; fall back to direct URLs for coverage completeness and re-verification, and say which you used when it affects the finding (see the provenance rule below).
 
 ## Levels (completion contracts — the engine ENFORCES them via `scout_report {level}`)