scenescout 3.9.0 → 3.11.0

package/dist/engine/forms.js

@@ -0,0 +1,290 @@
+/**
+ * Forms never submitted empty.
+ *
+ * The commonest defect behind a form is a submit that silently does nothing
+ * when its required fields are blank: no request, no message. The engine
+ * already notes a submit-style click that fires no request, but only when
+ * somebody tries the empty submit, and lanes that fill a form in and submit
+ * it rarely do. So scout_coverage lists every form a session saw that no
+ * session has yet submitted empty.
+ *
+ * THE DEFINITION. A form is a `<form>` element. Its controls are the ones the
+ * browser associates with it (`form.elements`), so a submit button outside
+ * the element linked back by `form="id"` is one of them. It is tracked when it
+ * has a native submit control (a `<button>` with no type or type="submit", an
+ * `<input type="submit|image">`) and at least one TEXT-ENTRY field.
+ *
+ * IDENTITY (formIdentity), per route, first match wins:
+ *   1. the form's own `id` attribute         → `form:#signup`
+ *   2. its `name` attribute                  → `form:name=pay`
+ *   3. its `action` attribute with its method → `form:POST /things`
+ *   4. only when it has none of those, the coverage key the snapshot gives its
+ *      first submit control (`tid:thing-save`, `button:save`).
+ * The form's own attributes come first because a submit control's key is the
+ * weakest name it has: an untagged "Save" in two tab panels is the same key
+ * for two forms, and a label that changes ("Pay $12", "Saving…") is a new key
+ * for the same one. Attributes are read with getAttribute, never `form.id` or
+ * `form.name`, which a field named "id" or "name" shadows.
+ *
+ * Only the inventory (a snapshot, a crawl, a plan's capture) puts a form on
+ * the list. A submit only marks a listed form; one that cannot be matched to
+ * a listed form is logged (FORMS_SUBMIT_UNMATCHED), never guessed.
+ *
+ * A text-entry field is a `<textarea>`, or an `<input>` whose type takes typed
+ * text (TEXT_ENTRY_TYPES), that is visible, not disabled (itself or by a
+ * disabled fieldset) and not read-only. Checkboxes, radios, selects, file,
+ * hidden, search, range and colour inputs are not: none of them can be "left
+ * blank" by typing, and a search box's empty submit is a filter, not the
+ * defect this looks for.
+ *
+ * A form counts as SUBMITTED EMPTY when a submit happened while every one of
+ * its text-entry fields held the empty string (whitespace is content: that is
+ * a separate boundary probe). A submit is a click on one of its native submit
+ * controls, or Enter where the browser's implicit submission applies: in one
+ * of its text-like inputs (IMPLICIT_SUBMIT_TYPES) while its default button is
+ * enabled, or on a focused submit control. It counts whether the click or key
+ * came from scout_click, scout_type's pressEnter, scout_press or a plan step.
+ * A form with no text-entry field is never listed, and neither is one whose
+ * every submit control is disabled while its fields are blank: the page
+ * already refuses the empty submit, and nothing could clear the entry.
+ *
+ * WHY ONLY `<form>`. A "form-like group" of loose fields and buttons had to be
+ * guessed from layout and button labels. The guess listed page chrome (a
+ * header search box beside "Sign in", under an app root that held every
+ * row's "Add" button) and walked the whole document once per button. A real
+ * form is the one grouping the browser itself submits, so it is exact and
+ * cheap (`document.forms`).
+ *
+ * NOT CAUGHT, by design of the above:
+ *   - fields and a save button with no `<form>` around them (a JS-driven panel);
+ *   - forms whose only submit control is a `role="button"` element, or a
+ *     `<button type="button">` wired up in script;
+ *   - forms that submit from script on change (`form.submit()` in a handler);
+ *   - Ctrl+Enter or Cmd+Enter in a textarea, which some apps treat as send.
+ * And kept apart imperfectly, by design of IDENTITY:
+ *   - forms with no id or name that share an action and method are one entry,
+ *     so an empty submit of one clears them all;
+ *   - forms with no id, name or action whose first submit controls are the
+ *     same untagged button ("Save") are one entry too;
+ *   - on a page with more controls than a snapshot lists (150), a form with
+ *     none of those attributes whose submit control is past the cap is not
+ *     tracked at all.
+ *
+ * The page reports facts; the rule deciding what they mean lives here as pure
+ * functions, so it is table-tested (memory-test) without a browser.
+ */
+import { ACCESSIBLE_NAME_SRC, VISIBLE_SRC, XPATH_OF_SRC } from "./collector.js";
+import { normalizePath } from "./fingerprint.js";
+/**
+ * Action-log entries this bookkeeping writes. They record what the engine
+ * could not do, not a step anyone took on the page: pace.ts does not count
+ * them as actions and a finding's repro trace leaves them out.
+ */
+export const FORMS_READ_FAILED = "forms:read-failed";
+export const FORMS_SUBMIT_UNMATCHED = "forms:submit-unmatched";
+/** Whether an action-log entry is this bookkeeping rather than a step. */
+export function isFormBookkeeping(action) {
+    return action === FORMS_READ_FAILED || action === FORMS_SUBMIT_UNMATCHED;
+}
+/** The form's identity from its own attributes, or null when it has none (see IDENTITY above). */
+export function formIdentity(attrs) {
+    const id = attrs.id.trim();
+    if (id)
+        return `form:#${id.slice(0, 80)}`;
+    const name = attrs.name.trim();
+    if (name)
+        return `form:name=${name.slice(0, 80)}`;
+    // Normalized as a route is: a record id or a per-load token in the action
+    // would otherwise name a new form on every record or every load.
+    const action = attrs.action.trim();
+    if (action)
+        return `form:${(attrs.method.trim() || "get").toUpperCase()} ${normalizePath(action).slice(0, 120)}`;
+    return null;
+}
+/**
+ * Whether a snapshot element is the submit control the probe found. An xpath
+ * alone is not enough: a sibling added or removed since the snapshot makes the
+ * same path name another button (a "Cancel" where "Send" was). The testid and
+ * the accessible name, computed by the collector's own rule, must agree too.
+ */
+export function sameControl(el, probe) {
+    return (el.testid ?? null) === (probe.submitTestid ?? null) && el.name === probe.submitName;
+}
+/** Input types that take typed text. `search` is left out on purpose (see above). */
+export const TEXT_ENTRY_TYPES = new Set([
+    "text",
+    "email",
+    "number",
+    "tel",
+    "url",
+    "password",
+    "date",
+    "datetime-local",
+    "month",
+    "week",
+    "time",
+]);
+/**
+ * Input types in which Enter submits the form (the HTML standard's implicit
+ * submission). Not checkboxes, radios or buttons: Enter does nothing there.
+ */
+export const IMPLICIT_SUBMIT_TYPES = new Set([...TEXT_ENTRY_TYPES, "search"]);
+/** Whether a field takes typed text and a user could type into it right now. */
+export function isTextEntry(f) {
+    if (!f.visible || f.disabled || f.readOnly)
+        return false;
+    if (f.tag === "textarea")
+        return true;
+    return f.tag === "input" && TEXT_ENTRY_TYPES.has(f.type || "text");
+}
+/** Whether a form is tracked at all: it must hold something to leave blank. */
+export function tracksForm(fields) {
+    return fields.some(isTextEntry);
+}
+/** Whether every text-entry field is empty — and there is at least one. */
+export function allTextEmpty(fields) {
+    const text = fields.filter(isTextEntry);
+    return text.length > 0 && text.every((f) => !f.filled);
+}
+/**
+ * What the inventory makes of a form: not tracked, tracked and owed an empty
+ * submit, or GUARDED — every submit control disabled while the fields are
+ * blank, so the page itself refuses the empty submit and nobody could clear
+ * the entry by trying it.
+ */
+export function formStatus(form) {
+    if (!tracksForm(form.fields))
+        return "untracked";
+    return form.submitDisabled && allTextEmpty(form.fields) ? "guarded" : "open";
+}
+/**
+ * Whether the action submitted the form. A click submits when it lands on a
+ * native submit control. Enter submits from a focused submit control, or from
+ * a text-like input while the form's default button is enabled.
+ */
+export function submits(kind, probe) {
+    if (probe.selfIsSubmit)
+        return true;
+    if (kind !== "enter" || probe.defaultDisabled)
+        return false;
+    return probe.self.tag === "input" && IMPLICIT_SUBMIT_TYPES.has(probe.self.type || "text");
+}
+/** Whether this action was an empty submit of a tracked form. */
+export function isEmptySubmit(kind, probe) {
+    return probe !== null && submits(kind, probe) && allTextEmpty(probe.fields);
+}
+/**
+ * Whether a failed page read is the page going away under it (a navigation
+ * or a closed tab), which is expected after a submit and says nothing. Any
+ * other failure is worth a line in the action log.
+ */
+export function isNavigationTeardown(message) {
+    return /execution context was destroyed|target (page, context or browser )?(has been )?closed|frame (was|has been) detached|navigat/i.test(message);
+}
+/** Page-side helpers shared by the inventory and the probe. Statements, not an expression. */
+const FORM_HELPERS_SRC = `
+  const visible = ${VISIBLE_SRC};
+  const xpathOf = ${XPATH_OF_SRC};
+  const facts = (f) => ({
+    tag: f.tagName.toLowerCase(),
+    type: f.tagName.toLowerCase() === "input" ? String(f.type || "text").toLowerCase() : "",
+    disabled: f.matches(":disabled"),
+    readOnly: f.readOnly === true,
+    visible: visible(f),
+    filled: typeof f.value === "string" && f.value !== "",
+  });
+  // The type PROPERTY: a button with no type, or an unknown one, reports "submit".
+  const isSubmit = (el) => {
+    const tag = el.tagName.toLowerCase();
+    return (tag === "button" && el.type === "submit") || (tag === "input" && (el.type === "submit" || el.type === "image"));
+  };
+  const submitsOf = (form) => Array.from(form.elements).filter((c) => isSubmit(c) && visible(c));
+  // Each DISTINCT set of field facts once. The rules ask whether any field is
+  // text entry and whether every one is blank, which repeats do not change,
+  // and a form of 2000 identical rows would otherwise ship 2000 objects back.
+  const fieldFactsOf = (form) => {
+    const seen = new Map();
+    for (const c of Array.from(form.elements)) {
+      if (!/^(input|textarea|select)$/i.test(c.tagName) || c.type === "hidden") continue;
+      const f = facts(c);
+      const id = f.tag + "|" + f.type + "|" + f.disabled + "|" + f.readOnly + "|" + f.visible + "|" + f.filled;
+      if (!seen.has(id)) seen.set(id, f);
+    }
+    return Array.from(seen.values());
+  };
+  // Resolved against the base URL, so a relative and an absolute action agree;
+  // one that is not a URL at all is kept as written.
+  const resolvedAction = (form) => {
+    const raw = (form.getAttribute("action") || "").trim();
+    if (!raw) return "";
+    try { return new URL(raw, document.baseURI).href; } catch (e) { return raw; }
+  };
+  // getAttribute, not form.id / form.name: a field named "id" or "name" shadows those.
+  const attrsOf = (form) => ({
+    id: form.getAttribute("id") || "",
+    name: form.getAttribute("name") || "",
+    action: resolvedAction(form),
+    method: form.getAttribute("method") || "",
+  });
+`;
+/**
+ * Page-side: every form on the page with a visible native submit control, as
+ * the xpath of its first one and the facts of its fields. One pass over
+ * `document.forms`; which of them are tracked is decided in Node (formStatus).
+ */
+export const FORMS_INVENTORY_SCRIPT = `(() => {
+  ${FORM_HELPERS_SRC}
+  const out = [];
+  for (const form of Array.from(document.forms)) {
+    const submits = submitsOf(form);
+    if (submits.length === 0) continue;
+    out.push({
+      attrs: attrsOf(form),
+      submit: xpathOf(submits[0]),
+      fields: fieldFactsOf(form),
+      submitDisabled: submits.every((s) => s.matches(":disabled")),
+    });
+  }
+  return out;
+})()`;
+/**
+ * Page-side body of the probe run on the element an action is about to
+ * submit through: `(node) => FormProbe | null`, null when it belongs to no
+ * form. Shipped as source rather than a transpiled function, for the reason
+ * the collector is a string: a loader's helpers do not exist in the page.
+ */
+export const FORM_PROBE_BODY = `
+  if (!node || node.nodeType !== 1 || !node.form) return null;
+  ${FORM_HELPERS_SRC}
+  const form = node.form;
+  const submits = submitsOf(form);
+  if (submits.length === 0) return null;
+  const accessibleName = ${ACCESSIBLE_NAME_SRC};
+  return {
+    attrs: attrsOf(form),
+    submit: xpathOf(submits[0]),
+    submitTestid: submits[0].getAttribute("data-testid"),
+    submitName: accessibleName(submits[0]),
+    fields: fieldFactsOf(form),
+    self: facts(node),
+    selfIsSubmit: isSubmit(node),
+    defaultDisabled: submits[0].matches(":disabled"),
+  };
+`;
+/** The probe as an expression over a node expression, for a page-level evaluate. */
+export function formProbeExpression(nodeExpression) {
+    return `((node) => {${FORM_PROBE_BODY}})(${nodeExpression})`;
+}
+/**
+ * The scout_coverage lines for forms no session has submitted empty this
+ * run. Empty when there is nothing to say.
+ */
+export function formatNeverSubmittedEmpty(forms) {
+    if (forms.length === 0)
+        return [];
+    return [
+        "Forms never submitted empty this run (submit each once with every text field blank: a submit that silently does nothing — no request, no message — hides there):",
+        ...forms.slice(0, 15).map((f) => `  ${f.route} ${f.key}`),
+        ...(forms.length > 15 ? [`  … +${forms.length - 15} more`] : []),
+    ];
+}

package/dist/engine/lane.js

@@ -135,7 +135,12 @@ export function parseLaneReport(text, expectedLane) {
         const trailing = /after JSON|Unexpected non-whitespace/i.test(message);
         return { ok: false, reason: trailing ? "the reply must be one JSON object, with no text after it" : `not valid JSON: ${message}` };
     }
-    const result = LaneReport.safeParse(raw);
+    // Decoded before the schema, so every cap measures the text the lane wrote.
+    // Only a reply that looks relay-escaped is decoded: one holding a literal
+    // `<` or `>` was not escaped on the way, and its `&amp;` is what the lane
+    // meant (a page that double-escapes its text is a defect a lane can report).
+    const decoded = /[<>]/.test(text) ? { value: raw, count: 0 } : decodeStringValues(raw);
+    const result = LaneReport.safeParse(decoded.value);
     if (!result.success) {
         const issue = result.error.issues[0];
         const at = issue.path.length ? ` at ${issue.path.join(".")}` : "";
@@ -144,7 +149,77 @@ export function parseLaneReport(text, expectedLane) {
     if (expectedLane !== undefined && result.data.lane !== expectedLane) {
         return { ok: false, reason: `the report names lane "${result.data.lane}", but this reply was asked of lane "${expectedLane}"` };
     }
-    return { ok: true, report: result.data, aroundIgnored };
+    return { ok: true, report: result.data, aroundIgnored, entitiesDecoded: decoded.count };
+}
+/**
+ * The HTML character references a relay adds when it escapes text: the five
+ * named ones an escaper emits, and decimal or hex numeric ones. Anything else
+ * that looks like a reference (`&nbsp;`, `&#0;`, a bare `&`) is left as it is.
+ */
+const CHAR_REFERENCE = /&(?:(lt|gt|amp|quot|apos)|#(\d{1,7})|#[xX]([0-9a-fA-F]{1,6}));/g;
+const NAMED_REFERENCES = { lt: "<", gt: ">", amp: "&", quot: '"', apos: "'" };
+/**
+ * One pass over the text, so each reference is decoded exactly once:
+ * `&amp;lt;` becomes `&lt;`, not `<`, because the `&` a match produces is
+ * never scanned again.
+ */
+function decodeReferences(text) {
+    let count = 0;
+    const out = text.replace(CHAR_REFERENCE, (whole, name, dec, hex) => {
+        if (name) {
+            count += 1;
+            return NAMED_REFERENCES[name];
+        }
+        const code = hex !== undefined ? parseInt(hex, 16) : Number(dec);
+        // NUL, surrogates and anything past the last code point are not characters a relay escaped.
+        if (code === 0 || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff))
+            return whole;
+        count += 1;
+        return String.fromCodePoint(code);
+    });
+    return { text: out, count };
+}
+/**
+ * A planner relaying a lane's reply often HTML-escapes it, so `->` arrives as
+ * `-&gt;` and no longer matches the finding filed with the same evidence.
+ * Decoded in string VALUES only, after JSON.parse: JSON's own syntax contains
+ * no `<`, `>` or `&`, so an escaper can only have touched it by turning its
+ * quotes into `&quot;`, and that reply does not parse at all; it is refused
+ * as invalid JSON rather than repaired. Keys are a fixed set of plain words
+ * and are left alone.
+ */
+function decodeStringValues(value) {
+    if (typeof value === "string") {
+        const d = decodeReferences(value);
+        return { value: d.text, count: d.count };
+    }
+    if (Array.isArray(value)) {
+        let count = 0;
+        const out = value.map((v) => {
+            const d = decodeStringValues(v);
+            count += d.count;
+            return d.value;
+        });
+        return { value: out, count };
+    }
+    if (value !== null && typeof value === "object") {
+        let count = 0;
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            const d = decodeStringValues(v);
+            count += d.count;
+            out[k] = d.value;
+        }
+        return { value: out, count };
+    }
+    return { value, count: 0 };
+}
+/** The line the fold adds when the parse decoded references, so a reader knows the tool changed the text; empty when it did not. */
+export function decodedEntitiesNote(count) {
+    if (count === 0)
+        return "";
+    const what = count === 1 ? "1 HTML character reference" : `${count} HTML character references`;
+    return `\n(${what} in the report ${count === 1 ? "was" : "were"} decoded once, as a relay that escapes text would have added ${count === 1 ? "it" : "them"}.)`;
 }
 /**
  * The paragraph the planner puts in every lane's prompt. It is generated from
@@ -196,3 +271,105 @@ export function summarizeLaneReport(r) {
         parts.push(`blocked by ${r.blocked_by}`);
     return `${r.lane}: ${parts.join(", ")}`;
 }
+/**
+ * Which sessions are lanes of a parallel run, and whether each one's report
+ * has been folded, so a lane's session is not closed before its decisions
+ * have somewhere to go.
+ *
+ * Folding a report writes its decisions to the lane's own session's project
+ * memory. Closing that session first leaves nothing to write to: a planner
+ * that closes a lane whose fold was just refused (a cap exceeded, say) and
+ * then re-sends the corrected object loses every decision in it.
+ *
+ * A session counts as a lane only when something in this run named it as
+ * one: scout_lane_brief listed it, scout_lane_report issued its instruction,
+ * or a reply was folded (accepted or refused) under its name while that
+ * session was attached. Nothing is inferred from other lanes' activity: the
+ * planner's own session is not a lane, and a single-session run never names
+ * one, so neither is ever refused a close by this. The ledger belongs to one
+ * run: the server clears it when the last session closes, because lane names
+ * are module names and a later run may well attach a role with one of them.
+ */
+export class LaneLedger {
+    named = new Set();
+    refused = new Set();
+    folded = new Set();
+    /** An instruction named this session as a lane. */
+    name(lane) {
+        this.named.add(lane);
+    }
+    /**
+     * A brief's lanes. One whose name is a session already live is skipped:
+     * that session was attached before the split existed, so it is the
+     * planner's own (or another role's), not a lane waiting to report.
+     */
+    nameBriefed(lanes, isLive) {
+        for (const lane of lanes)
+            if (!isLive(lane))
+                this.named.add(lane);
+    }
+    /**
+     * A reply for this lane was refused: it is a lane, and nothing it decided is
+     * kept yet. Only while its session is attached: a reply for a session that
+     * is gone says nothing about a later session given the same name.
+     */
+    refuse(lane, attached) {
+        if (!attached)
+            return;
+        this.named.add(lane);
+        if (!this.folded.has(lane))
+            this.refused.add(lane);
+    }
+    /** A reply for this lane was accepted. Only while its session is attached, for the same reason. */
+    fold(lane, attached) {
+        if (!attached)
+            return;
+        this.named.add(lane);
+        this.folded.add(lane);
+        this.refused.delete(lane);
+    }
+    /** The session closed: a later session with the same name is a fresh lane. */
+    forget(lane) {
+        this.named.delete(lane);
+        this.refused.delete(lane);
+        this.folded.delete(lane);
+    }
+    clear() {
+        this.named.clear();
+        this.refused.clear();
+        this.folded.clear();
+    }
+    state(lane) {
+        if (!this.named.has(lane))
+            return "not-a-lane";
+        if (this.folded.has(lane))
+            return "folded";
+        return this.refused.has(lane) ? "refused" : "unfolded";
+    }
+}
+/**
+ * Whether scout_close may close these sessions. Refused only when one of them
+ * is a lane whose report has not been accepted; `force` closes anyway. The
+ * message names every such lane and the two ways on.
+ */
+export function laneCloseGuard(sessions, ledger, force = false) {
+    if (force)
+        return { ok: true };
+    const pending = sessions.filter((s) => ledger.state(s) === "refused" || ledger.state(s) === "unfolded");
+    if (pending.length === 0)
+        return { ok: true };
+    const one = pending.length === 1;
+    const lines = pending.map((s) => ledger.state(s) === "refused"
+        ? `  · ${JSON.stringify(s)}: its last report was REFUSED and no corrected one has been accepted`
+        : `  · ${JSON.stringify(s)}: no report from it has been accepted yet`);
+    const others = sessions.filter((s) => !pending.includes(s));
+    const message = `Not closed: ${one ? "this session is a lane" : `${pending.length} sessions are lanes`} of a parallel run whose report has not been folded.\n` +
+        lines.join("\n") +
+        `\nFolding keeps a lane's decisions in its own session's project memory and checks its defects were filed; closing the session first loses them. ` +
+        `Fold with scout_lane_report { lane, reply } (for a refused report, the lane's corrected object), then close. ` +
+        `To close anyway and lose ${one ? "that lane's" : "those lanes'"} decisions, pass force: true.` +
+        (others.length > 0
+            ? `\nThe other session(s) can be closed one by one by name meanwhile: ${others.map((s) => `scout_close { session: ${JSON.stringify(s)} }`).join(", ")}.`
+            : "");
+    return { ok: false, unfolded: pending, message };
+}

package/dist/engine/memory.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { normalizePath, shortHash } from "./fingerprint.js";
+import { isFormBookkeeping } from "./forms.js";
 /**
  * The kinds a finding can be. One list: scout_finding's input schema, the lane
  * report a parallel agent hands back, and the skill text all read it from
@@ -540,6 +541,8 @@ function sameFinding(a, b) {
 }
 /** Per-project directory for memory, session logs, and reports. */
 export const MEMORY_DIRNAME = ".scenescout";
+/** The one directory under it that is committed rather than ignored: saved flows (flow.ts). */
+export const SELF_IGNORE_KEEP = "flows";
 /** What the directory was called before the tool was renamed. */
 export const LEGACY_MEMORY_DIRNAME = ".scenecraft";
 /**
@@ -610,17 +613,24 @@ function liveOwnerPid(dir, isAlive) {
  * `git status`. That gets the same result without editing a file we do not
  * own, and it disappears cleanly when someone deletes the directory.
  *
+ * The one exception is `flows/`: saved flows are inputs a team commits so
+ * CI replays them, not output. A file written before that exception existed
+ * is still left alone; docs/ci.md says which two lines to add to it.
+ *
  * Best-effort and idempotent — a read-only checkout must never break attach,
  * and an existing file is left exactly as the user left it.
  */
-function writeSelfIgnore(dir) {
+export function writeSelfIgnore(dir) {
     try {
         const ignorePath = path.join(dir, ".gitignore");
         if (fs.existsSync(ignorePath))
             return null;
         fs.writeFileSync(ignorePath, "# SceneScout exploratory-test artifacts: memory, session logs, status, report.\n" +
             "# Self-ignoring so a `git add -A` in the tested project can never commit them.\n" +
-            "*\n");
+            "*\n" +
+            "# Except the flows `scenescout check` replays: they are written to be committed.\n" +
+            `!${SELF_IGNORE_KEEP}/\n` +
+            `!${SELF_IGNORE_KEEP}/*.json\n`);
         return `Wrote ${MEMORY_DIRNAME}/.gitignore so these test artifacts stay out of your commits.`;
     }
     catch {
@@ -690,6 +700,7 @@ export class MemoryStore {
         this.injectionsReported.clear();
         this.auditsThisRun = 0;
         this.selectChoices.clear();
+        this.emptySubmits.clear();
     }
     /**
      * Each dropdown's options and the ones chosen in THIS run, by any session,
@@ -728,6 +739,55 @@ export class MemoryStore {
         }
         return out;
     }
+    /**
+     * Each form a session saw this run, by route and identity (forms.ts
+     * formIdentity: its own attributes, else its first submit control's
+     * coverage key), and whether any session has submitted it with every
+     * text field blank (forms.ts has the definition). Per run and shared across
+     * sessions, like the dropdown choices: an earlier run's empty submit says
+     * nothing about this build, and in a parallel run any lane may try it.
+     */
+    emptySubmits = new Map();
+    /**
+     * A form seen on a visited state. Recording it again changes nothing, except
+     * that `guarded` (every submit control disabled while its fields were blank)
+     * takes it off the list for good: the page refuses the empty submit itself,
+     * and no one could clear an entry whose submit cannot be pressed.
+     */
+    recordForm(fingerprint, key, guarded = false) {
+        const entry = this.formEntry(fingerprint, key);
+        if (entry && guarded)
+            entry.guarded = true;
+    }
+    /**
+     * A submit of a form already seen; `empty` when every text field was blank
+     * at the moment it went. It only marks: a submit never puts a form on the
+     * list, since a key read at submit time is the one most likely to be stale.
+     * Returns whether the form was on the list, so a miss can be logged.
+     */
+    recordFormSubmit(fingerprint, key, empty) {
+        const entry = this.formEntry(fingerprint, key, false);
+        if (entry && empty)
+            entry.triedEmpty = true;
+        return entry !== null;
+    }
+    formEntry(fingerprint, key, create = true) {
+        // Another site's frame is not the app's form to probe.
+        if (isEmbedKey(key))
+            return null;
+        const route = fingerprint.split("#")[0];
+        const id = `${route}\u0000${key}`;
+        let entry = this.emptySubmits.get(id) ?? null;
+        if (!entry && create) {
+            entry = { route, key, triedEmpty: false };
+            this.emptySubmits.set(id, entry);
+        }
+        return entry;
+    }
+    /** Forms seen this run that no session has submitted empty, in the order they were first seen. */
+    formsNeverSubmittedEmpty() {
+        return [...this.emptySubmits.values()].filter((f) => !f.triedEmpty && !f.guarded).map(({ route, key }) => ({ route, key }));
+    }
     constructor(projectDir) {
         this.dir = path.join(projectDir, MEMORY_DIRNAME);
         this.legacyDirNote = adoptLegacyMemoryDir(projectDir);
@@ -1347,7 +1407,8 @@ export class MemoryStore {
         // The planner's fold marker is not a step anyone took on a page. Left in,
         // its empty URL read as a route change and cut the trace of a finding filed
         // right after a fold — which is when the fold asks lanes to file.
-        const log = this.actionLog.filter((a) => a.action !== "lane-report");
+        // Nor is the forms bookkeeping (a read that failed, a submit it could not match).
+        const log = this.actionLog.filter((a) => a.action !== "lane-report" && !isFormBookkeeping(a.action));
         let start = Math.max(0, log.length - 12);
         for (let i = log.length - 1; i >= 0 && i >= log.length - 12; i--) {
             if (routeOf(log[i].url) !== routeOf(f.url)) {