T07: agentic realization over a stdlib browser surface

Two decisions taken with the operator: stdlib HTML driver instead of
Playwright (F-0004), and a deterministic discovery runtime instead of a live
model. Both sit behind interfaces so the alternatives drop in later.

- html.py: stdlib DOM parse and query
- agentic.py: DiscoveryRuntime (agentic arm, ignores data-td by construction)
  and RecordedSelectorRuntime (control arm, uses the strongest identifier the
  page offers)
- browser.py: per-actor sessions over real HTTP, constructed per call so no
  actor inherits another's connection state
- cost/nondeterminism metrics recorded from the first run

F-0005 (CONCEPT_DRIFT): the H-001 result is a narrowing. Where test ids are
preserved, discovery 9/9 and recorded selectors 9/9 - the semantic action buys
nothing. Where they are dropped, discovery 2/3 and recorded 0/3. The concept
model presents semantic actions as generally superior; the evidence says
conditionally superior.

M21 and M22 added mid-task: the deciding side of the axis was N=1. M22 (field
names renamed) defeats the heuristic and is the first concrete evidence that a
live model would add capability, not just cost.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1629012@bnt-lap001
Assistant-Session: 78d4fb13-8a1e-474b-87a3-9b9261c49a39

lab/mutations.py

@@ -90,6 +90,10 @@ def _m10(app): _m(app, denied_status=401)
 # --- SEMANTIC -------------------------------------------------------------
 # Intended behaviour changed. A human must decide; test-driver must not.
 
+def _m21(app): _m(app, ui_labels="verbose", ui_test_ids="dropped")
+def _m22(app): _m(app, ui_field_names="renamed", ui_test_ids="dropped")
+
+
 def _m11(app): _m(app, require_share_acceptance=True)
 def _m12(app): _m(app, revoke_delay_seconds=3600.0)
 def _m13(app): _m(app, grant_permission_for=lambda p: p or "WRITE")
@@ -154,6 +158,17 @@ CATALOGUE: tuple[Mutation, ...] = (
     Mutation("M10", "Denials return 401 instead of 403", "MECHANICAL", "api",
              "Both mean refused. A driver keying on the exact code breaks.", _m10),
 
+    Mutation("M21", "Controls reworded and test ids dropped", "MECHANICAL", "ui",
+             "Two signals disturbed at once: the wording changed and the stable "
+             "identifiers are gone. Extends the deciding side of the test-id "
+             "axis, which was N=1 after T07's first run.", _m21,
+             preserves_test_ids=False),
+    Mutation("M22", "Form field names changed", "MECHANICAL", "ui",
+             "subject_id becomes recipient, test ids dropped. The API still means "
+             "the same thing. This is the case that probes whether discovery "
+             "generalises or merely pattern-matches known field names.", _m22,
+             preserves_test_ids=False),
+
     Mutation("M11", "A share must be accepted before it takes effect", "SEMANTIC", "domain",
              "Bob genuinely cannot read until he accepts. The old claim 'Bob can "
              "read after the grant' is now wrong, and only a human may say so.", _m11),