@@ -11,7 +11,12 @@
  *                        file a `--driver recorded:F` run replayed); repeatable
  *   --cards DIR          the card directory (default: the repo's docs/qa/scenarios)
  *   --work DIR           read the projects here, not at each record's `evidenceDir`
- *   --no-screenshots     export without screenshots (no app is booted)
+ *                        (both directories are redacted to `$WORK` in the output)
+ *   --no-screenshots     export without screenshots (no app is booted); an app
+ *                        whose previous export had screenshots is kept as it was
+ *
+ * A runs directory with no scenario record, over an index that lists apps,
+ * exits non-zero and touches nothing (a wrong `--runs`, never "every app gone").
  *   --chromium PATH      the Chromium executable for the screenshots
  *
  * It writes only under `--out`; it pushes nothing anywhere. ⛔ It exports only
@@ -70,9 +75,10 @@ export function renderSummary(s: ExportSummary): string[] {
   for (const e of s.exported) lines.push(`exported ${e.id} · ${e.screenshots.length} screenshot(s)${e.skippedShots.map((k) => ` · no ${k.kind}: ${k.reason}`).join('')}`);
   for (const r of s.refused) lines.push(`refused  ${r.id} · ${r.reasons.join(' · ')}`);
   for (const r of s.removed) lines.push(`removed  ${r.id} · ${r.why}`);
+  for (const k of s.kept) lines.push(`kept     ${k.id} · ${k.why}`);
   for (const u of s.unowned) lines.push(`left     apps/${u} · not in the previous index, so not the exporter's`);
   for (const f of s.ignoredFiles) lines.push(`ignored  ${f} · not a scenario-runner record`);
-  lines.push(`index.json ${s.indexChanged ? 'written' : 'unchanged'} · ${s.exported.length} exported, ${s.refused.length} refused, ${s.removed.length} removed`);
+  lines.push(`index.json ${s.indexChanged ? 'written' : 'unchanged'} · ${s.exported.length} exported, ${s.refused.length} refused, ${s.removed.length} removed, ${s.kept.length} kept`);
   return lines;
 }
 
@@ -103,7 +109,7 @@ export async function main(argv: readonly string[], deps: ExportCliDeps = {}): P
     ...(args.work ? { workDir: resolve(args.work) } : {}),
     screenshots,
   });
-  for (const line of renderSummary(summary)) (line.startsWith('refused') || line.startsWith('removed') ? console.error : console.log)(line);
+  for (const line of renderSummary(summary)) (/^(refused|removed|kept) /.test(line) ? console.error : console.log)(line);
   return 0;
 }
 
 
@@ -20,7 +20,7 @@
  *
  *   apps/<id>/README.md               what the app is, its scorecard, the files
  *   apps/<id>/source/…                the authored metadata source (`source.ts`)
- *   apps/<id>/run-record.json         the run record, the work directory redacted
+ *   apps/<id>/run-record.json         the run record, the work directories redacted (`workDirsOf`)
  *   apps/<id>/scorecard.json|.md      the per-half scorecard
  *   apps/<id>/transcript.json|.md     the per-persona 问数 transcript
  *   apps/<id>/screenshots/<kind>.png  list, kanban/calendar, record, dashboard
@@ -31,10 +31,16 @@
  * is gone or not generic, its project is gone — is deleted and leaves the
  * index; the summary names why. A directory under `apps/` the index never
  * listed is not the exporter's and is left alone (and named). Nothing is
- * deleted when the previous index does not validate.
+ * touched when the previous index does not validate, or when the runs
+ * directory holds no scenario record while the index lists apps (a wrong
+ * `--runs`, never "every app gone").
+ *
+ * An export without screenshots (`screenshots: false`) never replaces an app
+ * whose previous export had them: the old directory and entry are kept, and
+ * the summary says so (`kept`). It still removes an app that no longer passes.
  */
 
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 import type { LoadedScenario } from '../loader.js';
@@ -95,6 +101,11 @@ export interface ExportSummary {
   refused: Array<{ id: string; reasons: string[] }>;
   /** Apps the previous index listed that this export deleted. */
   removed: Array<{ id: string; why: string }>;
+  /**
+   * Apps that would have exported, kept as the previous export left them
+   * instead: an export without screenshots never replaces one that had them.
+   */
+  kept: Array<{ id: string; why: string }>;
   /** Directories under `apps/` the exporter does not own, left as they were. */
   unowned: string[];
   /** JSON files in the runs directory that are not scenario-runner records. */
@@ -155,6 +166,25 @@ function writeTree(dir: string, files: Iterable<[string, string | Buffer]>): voi
   }
 }
 
+/**
+ * Every absolute directory that names this run's work directory: the record's
+ * own `evidenceDir` (the machine that ran it — every build tail and error text
+ * names it), `--work` when the projects are read elsewhere, and the real path
+ * of each that exists here (a symbolic-linked temp directory). Each is redacted
+ * from everything the gallery receives.
+ */
+export function workDirsOf(recordEvidenceDir: string, workDir: string | undefined): string[] {
+  const dirs = [recordEvidenceDir, ...(workDir !== undefined ? [workDir] : [])];
+  for (const d of [...dirs]) {
+    try {
+      dirs.push(realpathSync(d));
+    } catch {
+      // not on this machine: the record's directory, moved off it
+    }
+  }
+  return [...new Set(dirs)];
+}
+
 export async function exportGallery(opts: ExportOptions): Promise<ExportSummary> {
   const isGeneric = opts.isGeneric ?? NO_GENERIC_MARKER;
   const appsDir = join(opts.outDir, 'apps');
@@ -171,10 +201,17 @@ export async function exportGallery(opts: ExportOptions): Promise<ExportSummary>
     }
   }
   const { newest, ignored } = readRunRecords(opts.runsDir);
+  // An empty or wrong `--runs` would otherwise read as "every app lost its record" and delete the gallery.
+  if (newest.size === 0 && (previous?.apps.length ?? 0) > 0) {
+    throw new Error(
+      `${opts.runsDir} holds no scenario run record, and ${indexFile} lists ${previous!.apps.length} app(s), so nothing is touched: a runs directory with no record is read as a wrong --runs, never as every app gone`,
+    );
+  }
+  const previousById = new Map((previous?.apps ?? []).map((a) => [a.id, a]));
   const turns = mergeRecordings(opts.recordings);
   const cards = new Map(opts.cards.map((s) => [s.card.id, s]));
 
-  const summary: ExportSummary = { exported: [], refused: [], removed: [], unowned: [], ignoredFiles: ignored, indexChanged: false };
+  const summary: ExportSummary = { exported: [], refused: [], removed: [], kept: [], unowned: [], ignoredFiles: ignored, indexChanged: false };
   const entries: GalleryApp[] = [];
   mkdirSync(appsDir, { recursive: true });
 
@@ -184,6 +221,14 @@ export async function exportGallery(opts: ExportOptions): Promise<ExportSummary>
     rmSync(staging, { recursive: true, force: true });
     try {
       const done = await exportOne(id, rf, cards.get(id), staging, isGeneric, turns, opts);
+      const old = previousById.get(id);
+      if (opts.screenshots === false && old && old.screenshots.length > 0 && existsSync(join(appsDir, id))) {
+        // It still passes, but this export has no screenshots: the old directory and entry stand, shots and all.
+        rmSync(staging, { recursive: true, force: true });
+        entries.push(old);
+        summary.kept.push({ id, why: `exported without screenshots, and the previous export has ${old.screenshots.length}: it is kept as it was, and not replaced by an entry with none` });
+        continue;
+      }
       rmSync(join(appsDir, id), { recursive: true, force: true });
       renameSync(staging, join(appsDir, id));
       entries.push(done.entry);
@@ -194,7 +239,7 @@ export async function exportGallery(opts: ExportOptions): Promise<ExportSummary>
     }
   }
 
-  const exported = new Set(entries.map((e) => e.id));
+  const exported = new Set(entries.map((e) => e.id)); // written or kept
   const refusedWhy = new Map(summary.refused.map((r) => [r.id, r.reasons.join('; ')]));
   for (const old of previous?.apps ?? []) {
     if (exported.has(old.id)) continue;
@@ -237,7 +282,8 @@ async function exportOne(
   if (artifact === undefined) throw new Refused([`${projectDir} holds no dist/objectstack.json`]);
   const source = readAuthoredSource(projectDir);
   const frameworkVersion = projectFrameworkVersion(projectDir);
-  const transcript = redactWorkDir(buildTranscript(scenario, record, turns), workDir);
+  const redact = <T,>(v: T): T => redactWorkDir(v, workDirsOf(record.evidenceDir, opts.workDir));
+  const transcript = redact(buildTranscript(scenario, record, turns));
 
   let shots: PlannedShot[] = [];
   let skipped: SkippedShot[] = [];
@@ -247,7 +293,7 @@ async function exportOne(
     skipped = taken.skipped;
   }
 
-  const scorecard = redactWorkDir(record.scorecard as unknown as CardScorecard, workDir);
+  const scorecard = redact(record.scorecard as unknown as CardScorecard);
   const entry: GalleryApp = {
     id,
     code: card.code,
@@ -267,12 +313,12 @@ async function exportOne(
 
   writeTree(join(staging, APP_LAYOUT.source), source.files);
   writeTree(staging, [
-    [APP_LAYOUT.runRecord, json(redactWorkDir(rf.raw, workDir))],
+    [APP_LAYOUT.runRecord, json(redact(rf.raw))],
     [APP_LAYOUT.scorecardJson, json(scorecard)],
     [APP_LAYOUT.scorecardMd, `${renderScorecard(scorecard)}\n`],
     [APP_LAYOUT.transcriptJson, json(transcript)],
     [APP_LAYOUT.transcriptMd, renderTranscript(transcript, card.title)],
-    [APP_LAYOUT.readme, appReadme(scenario, entry, judgement, scorecard, shots, skipped)],
+    [APP_LAYOUT.readme, redact(appReadme(scenario, entry, judgement, scorecard, shots, skipped))],
   ]);
   return { entry, shots, skipped };
 }
@@ -123,11 +123,33 @@ export function readRunRecords(runsDir: string): ReadRecordsResult {
   return { newest, ignored };
 }
 
-/** Every string in `value` with the run's local work directory replaced by `$WORK`: a local path is not gallery content. */
-export function redactWorkDir<T>(value: T, workDir: string): T {
-  if (workDir.replace(/\/+$/, '') === '') return value; // `/` names no run of its own
+/**
+ * A work directory is only that directory where it is not part of a longer
+ * name: not preceded by a path-name character or `/` (`/x/tmp` is not `/tmp`),
+ * and not followed by one (`/tmpfoo`) — a `.` that ends a sentence does not
+ * lengthen it, a `.` that starts a suffix (`/tmp.d`) does.
+ */
+const BEFORE = '(?<![A-Za-z0-9._~/-])';
+const AFTER = '(?![A-Za-z0-9_~-]|\\.[A-Za-z0-9._~-])';
+
+/**
+ * Every string in `value` with each of the run's local work directories
+ * replaced by `$WORK`: a local path is not gallery content.
+ *
+ * More than one directory can name the same run. The record carries the
+ * directory of the machine that ran it (`evidenceDir`, and every build tail and
+ * error text that names it), and `--work` names where the projects are read on
+ * this one. Each is replaced, longest first so one that contains another is
+ * replaced whole, and only at a path-name boundary, so `/tmp` never rewrites
+ * `/tmpfoo`. `/` (or an empty string) names no run of its own and is skipped.
+ */
+export function redactWorkDir<T>(value: T, workDirs: string | readonly string[]): T {
+  const dirs = [...new Set((typeof workDirs === 'string' ? [workDirs] : workDirs).map((d) => d.replace(/\/+$/, '')).filter((d) => d !== ''))].sort((x, y) => y.length - x.length);
+  if (dirs.length === 0) return value;
+  const escape = (d: string) => d.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const re = new RegExp(`${BEFORE}(?:${dirs.map(escape).join('|')})${AFTER}`, 'g');
   const walk = (v: unknown): unknown => {
-    if (typeof v === 'string') return v.split(workDir).join('$WORK');
+    if (typeof v === 'string') return v.replace(re, '$$WORK');
     if (Array.isArray(v)) return v.map(walk);
     if (typeof v === 'object' && v !== null) return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x)]));
     return v;
 
@@ -24,13 +24,19 @@
  *   - `dashboard`: a dashboard the card expects, else the build's first —
  *     `apps/<app>/dashboard/<name>`; skipped when the build declares none.
  *
+ * A page the Console did not show is never proof: a navigation that answers
+ * no response or a status outside 2xx (304, a revalidation, is the page), or a page that draws one of the
+ * Console's own not-found views ({@link CONSOLE_NOT_FOUND}), refuses that shot
+ * ({@link pageRefusal}). It is reported as a skipped shot with the reason, and
+ * no file of it is kept.
+ *
  * The browser is a seam ({@link ScreenshotBrowser}): {@link playwrightBrowser}
  * drives Chromium through `playwright-core`; the exporter's tests pass a
  * double. The exporter runs this step only when asked (`--no-screenshots`
  * skips it), so everything else is testable without a browser.
  */
 
-import { existsSync, mkdirSync } from 'node:fs';
+import { existsSync, mkdirSync, rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 import { resolveStackCollection } from '@objectstack/core';
@@ -148,10 +154,44 @@ export function planShots(original: LoadedScenario, artifact: unknown): ShotPlan
 
 // ── Capture ─────────────────────────────────────────────────────────────────
 
+/**
+ * The Console's own "nothing here" views, as a page shows them: the
+ * `data-testid`s of the object, record and form not-found states, and the
+ * title the app router's catch-all route draws (in the `en-US` locale the
+ * browser runs in). Read from the Console source (`ui/packages/app-shell`,
+ * `ui/apps/console`); a Console that drew a new one under another name would
+ * pass this check, so the HTTP status is checked first and alone suffices for
+ * a server error.
+ */
+export const CONSOLE_NOT_FOUND = {
+  testIds: ['object-not-found', 'object-package-disabled', 'record-page-not-found', 'form-not-found'],
+  titles: ['Page not found'],
+} as const;
+
+/** What a page showed, as {@link pageRefusal} judges it. */
+export interface PageReading {
+  /** The navigation's HTTP status; `null` when the navigation answered no response. */
+  status: number | null;
+  /** Which of {@link CONSOLE_NOT_FOUND}'s test ids and titles the page draws. */
+  notFound: string[];
+}
+
+/** Why a page is not a screenshot of the app, or `undefined` when it is one. */
+export function pageRefusal(page: PageReading): string | undefined {
+  if (page.status === null) return 'the navigation answered no response';
+  // 304: the browser revalidated a page it holds (each shot's page is visited twice), which is the page shown.
+  if ((page.status < 200 || page.status > 299) && page.status !== 304) return `the navigation answered HTTP ${page.status}`;
+  if (page.notFound.length > 0) return `the Console drew its not-found view (${page.notFound.join(', ')})`;
+  return undefined;
+}
+
+/** A capture's outcome: the page was shot, or it was not the app and nothing of it is proof. */
+export type CaptureOutcome = { shown: true } | { shown: false; reason: string };
+
 /** One signed-in browser page against a booted app. */
 export interface ScreenshotSession {
-  /** Open `path` under the app's origin and write a PNG to `file`. */
-  capture(path: string, file: string): Promise<void>;
+  /** Open `path` under the app's origin; when the page is the app ({@link pageRefusal}), write a PNG to `file`. */
+  capture(path: string, file: string): Promise<CaptureOutcome>;
   close(): Promise<void>;
 }
 
@@ -203,10 +243,16 @@ export async function captureScreenshots(input: CaptureInput, deps: CaptureDeps)
     }
     const session = await deps.browser.open(booted.url, deps.admin);
     try {
-      for (const shot of shots) {
+      for (const shot of [...shots]) {
         const file = join(input.dir, shot.file);
         mkdirSync(dirname(file), { recursive: true });
-        await session.capture(shot.path, file);
+        const outcome = await session.capture(shot.path, file);
+        if (!outcome.shown) {
+          rmSync(file, { force: true });
+          shots.splice(shots.indexOf(shot), 1);
+          skipped.push({ kind: shot.kind, reason: `the Console did not show ${shot.path}: ${outcome.reason}` });
+          continue;
+        }
         if (!existsSync(file)) throw new Error(`the browser wrote no screenshot for ${shot.kind} (${shot.path})`);
       }
     } finally {
@@ -241,11 +287,15 @@ export function playwrightBrowser(opts: PlaywrightBrowserOptions = {}): Screensh
         const signIn = await context.request.post(`${baseUrl}/api/v1/auth/sign-in/email`, { data: admin });
         if (!signIn.ok()) throw new Error(`the browser's admin sign-in was refused: ${signIn.status()}`);
         const page = await context.newPage();
-        const visit = async (path: string) => {
-          await page.goto(`${baseUrl}${path}`, { waitUntil: 'load' });
+        const visit = async (path: string): Promise<PageReading> => {
+          const response = await page.goto(`${baseUrl}${path}`, { waitUntil: 'load' });
           // A page that never goes quiet (a stream, a poll) is shot after the budget, not skipped.
           await page.waitForLoadState('networkidle', { timeout: opts.settleTimeoutMs ?? 30_000 }).catch(() => undefined);
           await page.waitForTimeout(1_000);
+          const notFound: string[] = [];
+          for (const id of CONSOLE_NOT_FOUND.testIds) if ((await page.locator(`[data-testid="${id}"]`).count()) > 0) notFound.push(id);
+          for (const title of CONSOLE_NOT_FOUND.titles) if ((await page.getByText(title, { exact: true }).count()) > 0) notFound.push(`"${title}"`);
+          return { status: response ? response.status() : null, notFound };
         };
         // An administrator's first visit to an app page can open first-run UI over it (measured on
         // 18.3: a default-currency dialog over the first app page, once per browser session; the
@@ -258,8 +308,10 @@ export function playwrightBrowser(opts: PlaywrightBrowserOptions = {}): Screensh
               await visit(path);
               warmed = true;
             }
-            await visit(path);
+            const refusal = pageRefusal(await visit(path));
+            if (refusal !== undefined) return { shown: false, reason: refusal };
             await page.screenshot({ path: file });
+            return { shown: true };
           },
           close: () => browser.close(),
         };