[venkatas]

Summary

• Filter concatenated/non-absolute JS URLs before the JS analysis cap, prefer real *.js URLs, and append a curl rc histogram to the degrade reason.
• Label capped email posture as medium, capped from high (SPF stays capped). DKIM titles include the selector. Absent DMARC adkim/aspf tags are described as default relaxed alignment, not as an explicit tag.
• Do not treat 204 or OPTIONS/CORS preflight as a 403 bypass. Reporter still drops [403-BYPASS-CANDIDATE] lines.
• scanner.sh no longer pre-creates idor/jwt/ssrf/graphql dirs; upload Check 0 writes status.json so empty means scanned-zero. phase_manifest distinguishes never-invoked from timeout (exit -9).

Test plan

• pytest tests/test_session_replay_honesty.py tests/test_nomore403_audit.py tests/test_reporter_evidence_integrity.py tests/test_phase_manifest_coverage.py tests/test_email_audit_adapter.py tests/test_email_audit_integration.py