[casoon]

Package 2, part 1: the shared collection contract (#777) and its use in every module outside performance, security/DNS and C2PA. Those three follow as separate PRs (#769/#770, #774–#776, #789).

Contract

• audit::collection:
  • Collected<T> with the states measured, empty, partial, failed, unsupported and not_applicable. JS, CDP, HTTP and DNS adapters produce it, never a default value.
  • CollectionLog records each collection for the page.
  • COLLECTORS is the inventory.
• JSON: module_runs[].subchecks[] carries state, method, method_version, reason_code, scoring and gaps. The schemas now describe moduleRun/subcheckRun, and measurement_type now allows partial and not_measured (performance already emitted them).
• Score:
  • A module that lost a scoring collection is partial and leaves the overall score, in both the module scores and the per-viewport blend.
  • A module whose every collection was lost is Failed.
  • Derived indicators are Skipped over a failed upstream module and Partial over a partial one.
• Validation: the contract rejects a run that lost a collection but is marked Completed (collection_gap_completed), and a score built on a lost collection that is still counted (collection_gap_scored).
• Inventory test every_collector_has_counter_cases:
  • Each COLLECTORS entry needs counter-cases. The JS contract (missing result, invalid JSON, scalar, wrong shape, valid empty) and domain cases are run.
  • In debug builds, recording an unlisted collector panics.

Collectors migrated

• SEO: all extractors, plus:
  • page-health DOM and HTTP probes;
  • cookie inventory, broken links, service workers, web manifest, www redirect;
  • robots.txt, sitemap noindex, visible schema facts.
• Other modules: dark mode, mobile, design quality, best practices, tech stack, journey, SSR gap, HTML conformance, help mechanisms, easy language, display modes.
• Browser WCAG page rules: text spacing, reflow, page title, on-input, orientation.
• Accessibility journeys: form error, add to cart.

Behaviour fixes this exposes

• These are no longer reported when the probe did not answer: http1_only, missing_compression, www_not_consolidated, http_not_redirected_to_https, pwa_invalid_manifest, broken links, NoPrintStylesheet/NoForcedColorsSupport, print and focus layout risks without emulation, "no live region".
• These clean results no longer stand in for a failed collection: "no cookies", "no libraries", "no console errors", "no contrast failures", 100 image-efficiency points, "no stack", "hardened".
• The console collector is now installed whenever best practices run, so security-only audits read the console too.
• The SSR content-gap check loads the page itself. Before, after interactive journeys it measured about:blank.
• Page rules tell an explicit null ("nothing found") from no answer by the RemoteObject subtype.

Validation (local, all green)

• cargo fmt --check passes, and clippy -D warnings is clean with all features and with no default features.
• cargo test --all-features passes.
• The ignored suites CI runs all pass: integration_test 42/42, detection_corpus_test, schema_rules_detection_corpus_test, vulnerable_libs_detection_corpus_test, easy_language_detection_test, help_mechanisms_detection_test, score_calibration_test.
• reference_sites_test shows no deviation from the reviewed bands.

#777 stays open. Its inventory is complete only once the performance, security/DNS and C2PA collectors and the remaining infrastructure probes (navigation snapshot, frames, consent, interaction) are in.