Update Insight_UX_1.0 with latest changes: add auth, participants, tests, and dev requirements

.gitignore

@@ -16,6 +16,7 @@
 !.gitattributes
 !README.md
 !requirements.txt
+!requirements-dev.txt
 !version.json
 
 !calibrate.py
@@ -25,6 +26,13 @@
 !inference_pipeline.py
 !session_logger.py
 !theme.py
+!auth.py
+!participants.py
+
+!tests/conftest.py
+!tests/test_auth.py
+!tests/test_participants.py
+!tests/test_analysis.py
 
 !packaging/InsightUX.spec
 !packaging/installer.iss
@@ -47,10 +55,15 @@ sessions/              # full-screen screenshots of real browsing — NEVER push
 calibration.pkl        # your personal eye + screen calibration
 baseline_pose.pkl
 insightux_landing.html # regenerated at runtime
+insightux_login.html   # regenerated at runtime
+users.json             # profile records — password hashes, never push
+users/                 # per-profile sessions/calibration/fine-tuned models
+_no_active_profile/    # inert placeholder dir touched only while logged out
 venv/
 test_images/
 test.mp4
 __pycache__/
 *.py[cod]
+.pytest_cache/
 .DS_Store
 Thumbs.db

analysis.py

@@ -19,6 +19,7 @@ import re
 import json
 import bisect
 import base64
+import html as html_escape
 from datetime import datetime
 
 import theme
@@ -299,12 +300,13 @@ def build_screenshot_segments(gaze, dom, session_dir):
             continue
         viewport = ev.get("viewport") or {}
         segments.append({
-            "screenshot": ev["screenshot"],       # relative path — kept only as the join key for build_mouse_screenshot_segments
+            "screenshot": ev["screenshot"],       # relative path — kept for traceability/debugging only, not consumed by the report
             "screenshotData": data_uri,            # what the report's <img>/canvas actually load
             "scrollY": ev.get("scrollY", 0),
             "viewportW": viewport.get("w"),
             "viewportH": viewport.get("h"),
             "points": pts,
+            "stickyRects": ev.get("stickyRects") or [],  # viewport-relative CSS rects of position:fixed/sticky elements at capture time — lets the stitcher paste each one once instead of once per screenshot
             "duration": 0.0,  # filled below
         })
 
@@ -319,56 +321,39 @@ def build_screenshot_segments(gaze, dom, session_dir):
 
 
 # =============================================================================
-# MOUSE HEATMAP DATA (presentation-layer addition only — every point below
-# was already written to mouse_log.jsonl by the existing MOUSE_JS sampling
-# loop and Api.log_mouse_data(); summarize_mouse() above is unchanged and
-# still powers the interests table / click log / click-timeline exactly as
-# before. This function just also surfaces the raw coordinates, bucketed
-# per screenshot, so the report's Mouse/Combined heatmap tabs and the
-# full-session export have something to draw — no new tracking, no new
-# collection. The full-session export reconstructs its whole-page point set
-# from these same per-segment buckets (scrollY-offset per segment) rather
-# than from a flat whole-session list, so it automatically inherits the
-# per-segment url/scrollY grouping and never mixes points from a different
-# page navigation into the same stitched image.)
+# FULL-PAGE HEATMAP DATA (whole-session, not per scroll position). Every
+# point below was already written to mouse_log.jsonl by the existing
+# MOUSE_JS sampling loop and Api.log_mouse_data(); summarize_mouse() above
+# is unchanged and still powers the interests table / click log / click-
+# timeline exactly as before. This just surfaces the raw coordinates so the
+# report's client-side stitcher can plot every mouse point ever recorded
+# onto one continuous full-page image.
 # =============================================================================
 
-def build_mouse_screenshot_segments(segments, dom, session_dir):
-    """Mouse-tracker counterpart to build_screenshot_segments (which is left
-    untouched) — buckets the same already-recorded mouse coordinates against
-    the exact same screenshots that function kept for the gaze heatmap, so
-    the Eye/Mouse/Combined tabs share one scroll-position index. Batches are
-    matched to the nearest screenshot by their own "t" (already written by
-    log_mouse_data), then each point is converted from page-absolute to
-    screen-relative (page_y - scrollY), matching how gaze points are already
-    stored in `segments`."""
-    if not segments:
-        return []
-    kept_names = {s["screenshot"] for s in segments}
-    by_name = {d["screenshot"]: d for d in dom if d.get("screenshot") in kept_names}
-    ordered = [by_name[s["screenshot"]] for s in segments if s["screenshot"] in by_name]
-    if len(ordered) != len(segments):
-        return [{"points": []} for _ in segments]
-
-    shot_times = [d["t"] for d in ordered]
-    buckets = [[] for _ in ordered]
-
+def build_mouse_fullpage_points(session_dir):
+    """Every mouse trail/heatmap/click point recorded this session, in the
+    same page-absolute CSS-pixel space MOUSE_JS already samples them in
+    (clientX/clientY + scrollX/scrollY) — no per-segment bucketing needed,
+    since page-absolute coordinates don't depend on which screenshot was on
+    screen when the point was captured."""
+    points = []
     for b in load_mouse_batches(session_dir):
-        t = b.get("t")
-        if t is None:
-            continue
-        idx = bisect.bisect_right(shot_times, t) - 1
-        if idx < 0:
-            idx = 0
-        scroll_y = ordered[idx].get("scrollY", 0)
         for p in (b.get("trail") or []):
-            buckets[idx].append({"sx": round(p["x"], 1), "sy": round(p["y"] - scroll_y, 1)})
+            points.append({"x": round(p["x"], 1), "y": round(p["y"], 1)})
         for p in (b.get("heatmap") or []):
-            buckets[idx].append({"sx": round(p["x"], 1), "sy": round(p["y"] - scroll_y, 1)})
+            points.append({"x": round(p["x"], 1), "y": round(p["y"], 1)})
         for c in (b.get("click") or []):
-            buckets[idx].append({"sx": round(c["x"], 1), "sy": round(c["y"] - scroll_y, 1), "w": 5})
+            points.append({"x": round(c["x"], 1), "y": round(c["y"], 1), "w": 5})
+    return points
 
-    return [{"points": pts} for pts in buckets]
+
+def full_page_dims(dom):
+    """Largest page width/height seen across every dom snapshot (CSS px) —
+    lets the client size its stitched canvas to the true full page even if
+    the last screenshot captured doesn't reach the page bottom."""
+    w = max(((d.get("page") or {}).get("w") or 0) for d in dom) if dom else 0
+    h = max(((d.get("page") or {}).get("h") or 0) for d in dom) if dom else 0
+    return {"w": w, "h": h}
 
 
 # =============================================================================
@@ -392,7 +377,7 @@ __THEME_CSS__
   .topbar .brand { display: flex; align-items: center; gap: 10px; }
   .topbar .mark {
     width: 34px; height: 34px; border-radius: 10px; background: var(--iux-accent-grad);
-    display: flex; align-items: center; justify-content: center; color: #fff; flex-shrink: 0;
+    display: flex; align-items: center; justify-content: center; color: var(--iux-on-accent); flex-shrink: 0;
   }
   h1 { margin: 0; font-size: 19px; font-weight: 700; }
   .sub { color: var(--iux-text-dim); font-size: 12.5px; margin-top: 2px; }
@@ -405,7 +390,7 @@ __THEME_CSS__
   }
   .stat .icon-badge {
     width: 30px; height: 30px; border-radius: 9px; display: flex; align-items: center; justify-content: center;
-    background: var(--iux-accent-grad); color: #fff; margin-bottom: 10px;
+    background: var(--iux-accent-grad); color: var(--iux-on-accent); margin-bottom: 10px;
   }
   .stat .v { font-size: 21px; font-weight: 700; color: var(--iux-text); }
   .stat .l { font-size: 10.5px; color: var(--iux-text-faint); text-transform: uppercase; letter-spacing: .05em; margin-top: 2px; }
@@ -453,7 +438,7 @@ __THEME_CSS__
     border: none; background: transparent; color: var(--iux-text-dim); padding: 6px 12px; border-radius: 999px;
     font-size: 11.5px; cursor: pointer; font-family: var(--iux-font);
   }
-  .hm-toolbar .seg button.on { background: var(--iux-accent-grad); color: #fff; }
+  .hm-toolbar .seg button.on { background: var(--iux-accent-grad); color: var(--iux-on-accent); }
   .hm-toolbar .slider-mini { display: flex; align-items: center; gap: 6px; font-size: 11px; color: var(--iux-text-faint); }
   .hm-toolbar .slider-mini input { accent-color: var(--iux-primary-light); }
   .hm-toolbar .iux-btn { padding: 7px 10px; font-size: 11.5px; margin-left: auto; }
@@ -462,10 +447,7 @@ __THEME_CSS__
   .shot-wrap:hover { box-shadow: var(--iux-shadow-glow); }
   .shot-wrap img, .shot-wrap canvas { display: block; width: 100%; height: auto; }
   .shot-wrap canvas { position: absolute; top: 0; left: 0; }
-  .shot-nav { display: flex; align-items: center; justify-content: space-between;
-              margin-top: 10px; font-size: 12px; color: var(--iux-text-dim); }
-  .shot-nav .iux-btn { padding: 7px 14px; font-size: 12px; }
-  .shot-nav .iux-btn:disabled { opacity: 0.35; cursor: default; transform:none; }
+  .shot-caption { margin-top: 10px; font-size: 12px; color: var(--iux-text-dim); text-align: center; }
 
   .click-timeline { width: 100%; height: 60px; display: block; margin-top: 8px; }
 
@@ -475,7 +457,7 @@ __THEME_CSS__
   .elem-chart-heading { display: flex; align-items: center; gap: 12px; }
   .elem-chart-heading .icon-badge {
     width: 34px; height: 34px; border-radius: 10px; display: flex; align-items: center; justify-content: center;
-    background: var(--iux-accent-grad); color: #fff; flex-shrink: 0;
+    background: var(--iux-accent-grad); color: var(--iux-on-accent); flex-shrink: 0;
   }
   .elem-chart-heading h2 {
     margin: 0; font-size: 12.5px; color: var(--iux-text-dim); font-weight: 700;
@@ -498,7 +480,7 @@ __THEME_CSS__
     cursor: pointer; text-align: left;
   }
   .elem-view-opt:hover { background: var(--iux-surface); color: var(--iux-text); }
-  .elem-view-opt.on { background: var(--iux-accent-grad); color: #fff; }
+  .elem-view-opt.on { background: var(--iux-accent-grad); color: var(--iux-on-accent); }
 
   .elem-chart-wrap { position: relative; }
   .elem-chart-scroll {
@@ -529,13 +511,13 @@ __THEME_CSS__
   .elem-fullscreen.open { display: flex; }
   .elem-fullscreen-bar {
     display: flex; align-items: center; gap: 14px; padding: 14px 20px; flex-wrap: wrap;
-    background: rgba(18,19,26,0.9); border-bottom: 1px solid rgba(255,255,255,0.1); flex-shrink: 0;
+    background: rgba(27,25,24,0.9); border-bottom: 1px solid rgba(255,255,255,0.1); flex-shrink: 0;
   }
-  .elem-fullscreen-title { color: #f1eefa; font-size: 13px; font-weight: 700; display: flex; align-items: center; gap: 8px; margin-right: auto; }
+  .elem-fullscreen-title { color: #f9f8f3; font-size: 13px; font-weight: 700; display: flex; align-items: center; gap: 8px; margin-right: auto; }
   .elem-fullscreen-controls-slot { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
-  .elem-fullscreen-bar .iux-btn { color: #f1eefa; background: rgba(255,255,255,0.08); border-color: rgba(255,255,255,0.14); }
+  .elem-fullscreen-bar .iux-btn { color: #f9f8f3; background: rgba(255,255,255,0.08); border-color: rgba(255,255,255,0.14); }
   .elem-fullscreen-bar .iux-btn:hover { background: rgba(255,255,255,0.18); }
-  .elem-fullscreen-bar .elem-view-menu { background: #201f2e; }
+  .elem-fullscreen-bar .elem-view-menu { background: #332E2A; }
   .elem-fullscreen-body { flex: 1 1 auto; padding: 24px; overflow: auto; }
   .elem-fullscreen-body .elem-summary-row { max-width: 900px; }
 
@@ -543,34 +525,34 @@ __THEME_CSS__
 
   .iux-viewer {
     position: fixed; inset: 0; z-index: 2000000; display: none; flex-direction: column;
-    background: rgba(10,8,20,0.92); backdrop-filter: blur(6px); -webkit-backdrop-filter: blur(6px);
+    background: rgba(14,12,10,0.92); backdrop-filter: blur(6px); -webkit-backdrop-filter: blur(6px);
   }
   .iux-viewer.open { display: flex; }
   .iv-topbar {
     display: flex; align-items: center; gap: 10px; padding: 12px 18px;
-    background: rgba(18,19,26,0.9); border-bottom: 1px solid rgba(255,255,255,0.1); flex-shrink: 0;
+    background: rgba(27,25,24,0.9); border-bottom: 1px solid rgba(255,255,255,0.1); flex-shrink: 0;
   }
-  .iv-topbar .iux-btn { color: #f1eefa; background: rgba(255,255,255,0.08); border-color: rgba(255,255,255,0.14); }
+  .iv-topbar .iux-btn { color: #f9f8f3; background: rgba(255,255,255,0.08); border-color: rgba(255,255,255,0.14); }
   .iv-topbar .iux-btn:hover { background: rgba(255,255,255,0.18); }
-  .iv-title { color: #f1eefa; font-size: 13px; font-weight: 600; margin-right: auto; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-  .iv-zoom-pct { color: #cabdf0; font-size: 12px; min-width: 44px; text-align: center; flex-shrink: 0; }
+  .iv-title { color: #f9f8f3; font-size: 13px; font-weight: 600; margin-right: auto; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+  .iv-zoom-pct { color: #FFE9A8; font-size: 12px; min-width: 44px; text-align: center; flex-shrink: 0; }
   .iv-stage { flex: 1 1 auto; position: relative; overflow: hidden; cursor: grab; }
   .iv-stage.grabbing { cursor: grabbing; }
   #ivImage { position: absolute; top: 50%; left: 50%; max-width: none; user-select: none; -webkit-user-select: none; }
   .iv-nav {
     position: absolute; top: 50%; transform: translateY(-50%); z-index: 5;
     width: 44px; height: 44px; border-radius: 50%; display: flex; align-items: center; justify-content: center;
-    color: #f1eefa; background: rgba(18,19,26,0.65); border-color: rgba(255,255,255,0.16);
+    color: #f9f8f3; background: rgba(27,25,24,0.65); border-color: rgba(255,255,255,0.16);
   }
-  .iv-nav:hover { background: rgba(139,92,246,0.55); }
+  .iv-nav:hover { background: rgba(255,233,168,0.55); }
   .iv-nav-prev { left: 16px; }
   .iv-nav-next { right: 16px; }
   .iv-nav[disabled] { display: none; }
   .iv-bottombar {
     display: flex; align-items: center; justify-content: center; gap: 8px; padding: 12px 18px;
-    background: rgba(18,19,26,0.9); border-top: 1px solid rgba(255,255,255,0.1); flex-shrink: 0; flex-wrap: wrap;
+    background: rgba(27,25,24,0.9); border-top: 1px solid rgba(255,255,255,0.1); flex-shrink: 0; flex-wrap: wrap;
   }
-  .iv-bottombar .iux-btn { color: #f1eefa; background: rgba(255,255,255,0.08); border-color: rgba(255,255,255,0.14); padding: 7px 12px; font-size: 12px; }
+  .iv-bottombar .iux-btn { color: #f9f8f3; background: rgba(255,255,255,0.08); border-color: rgba(255,255,255,0.14); padding: 7px 12px; font-size: 12px; }
   .iv-bottombar .iux-btn:hover { background: rgba(255,255,255,0.18); }
   .iv-bottombar input[type=range] { accent-color: var(--iux-primary-light); width: 120px; }
 
@@ -591,7 +573,7 @@ __THEME_CSS__
   }
   @page { size: A4; margin: 0; }
   @media print {
-    html, body { background: #12131A !important; }
+    html, body { background: #1B1918 !important; }
     body > .back-nav, body > .topbar, body > .stat-row, body > .grid,
     #iuxViewer, #elemFullscreen, #iuxReportToast { display: none !important; }
     #printReport { position: static !important; left: auto !important; width: auto !important; }
@@ -599,7 +581,7 @@ __THEME_CSS__
 
   .print-page {
     position: relative; width: 794px; height: 1123px;
-    background: #12131A; color: #F1EEFA;
+    background: #1B1918; color: #F9F8F3;
     box-sizing: border-box; overflow: hidden;
     break-after: page; page-break-after: always;
     font-family: var(--iux-font);
@@ -607,71 +589,71 @@ __THEME_CSS__
   .print-page:last-child { break-after: auto; page-break-after: auto; }
 
   .pp-accent { position: absolute; top: 0; left: 0; right: 0; height: 6px;
-    background: linear-gradient(90deg, #6366F1, #8B5CF6 55%, #C084FC); }
+    background: #FFE9A8; }
   .pp-header { position: absolute; top: 16px; left: 46px; right: 46px; height: 20px;
     display: flex; align-items: center; justify-content: space-between; }
-  .pp-header .pp-brand { font-size: 10.5px; font-weight: 700; letter-spacing: 0.08em; color: #F1EEFA; }
-  .pp-header .pp-tag { font-size: 9px; font-weight: 600; letter-spacing: 0.12em; color: #6E6885; text-transform: uppercase; }
+  .pp-header .pp-brand { font-size: 10.5px; font-weight: 700; letter-spacing: 0.08em; color: #F9F8F3; }
+  .pp-header .pp-tag { font-size: 9px; font-weight: 600; letter-spacing: 0.12em; color: #8E8E92; text-transform: uppercase; }
   .pp-body { position: absolute; top: 46px; left: 46px; right: 46px; bottom: 52px; overflow: hidden; }
   .pp-footer { position: absolute; bottom: 0; left: 46px; right: 46px; height: 40px;
     display: flex; align-items: center; justify-content: space-between;
-    border-top: 1px solid rgba(148,138,179,0.16); font-size: 8.5px; color: #6E6885; }
+    border-top: 1px solid rgba(198,188,178,0.16); font-size: 8.5px; color: #8E8E92; }
 
-  .pp-cover-title { font-size: 25px; font-weight: 700; color: #F1EEFA; margin: 8px 0 4px; }
-  .pp-cover-meta { font-size: 10.5px; color: #9B95B3; margin-bottom: 20px; }
+  .pp-cover-title { font-size: 25px; font-weight: 700; color: #F9F8F3; margin: 8px 0 4px; }
+  .pp-cover-meta { font-size: 10.5px; color: #C6BCB2; margin-bottom: 20px; }
 
   .pp-metric-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 12px; margin-bottom: 18px; }
-  .pp-metric { background: #1E2030; border: 1px solid rgba(148,138,179,0.16); border-radius: 12px; padding: 12px 14px; break-inside: avoid; }
-  .pp-metric .pp-m-label { font-size: 8.5px; font-weight: 700; letter-spacing: 0.07em; text-transform: uppercase; color: #6E6885; margin-bottom: 6px; }
-  .pp-metric .pp-m-value { font-size: 19px; font-weight: 700; color: #F1EEFA; }
-  .pp-metric .pp-m-sub { font-size: 8.5px; color: #6E6885; margin-top: 2px; }
-
-  .pp-card { background: #1E2030; border: 1px solid rgba(148,138,179,0.16); border-radius: 12px; padding: 16px 18px; margin-bottom: 14px; break-inside: avoid; }
-  .pp-section-title { font-size: 11.5px; font-weight: 700; letter-spacing: 0.06em; text-transform: uppercase; color: #F1EEFA; margin: 0 0 10px; }
-  .pp-section-sub { font-size: 10px; color: #9B95B3; margin: -6px 0 12px; line-height: 1.5; }
-  .pp-body-text { font-size: 10.5px; color: #B7B2CC; line-height: 1.65; }
-  .pp-body-text b { color: #F1EEFA; }
+  .pp-metric { background: #292522; border: 1px solid rgba(198,188,178,0.16); border-radius: 12px; padding: 12px 14px; break-inside: avoid; }
+  .pp-metric .pp-m-label { font-size: 8.5px; font-weight: 700; letter-spacing: 0.07em; text-transform: uppercase; color: #8E8E92; margin-bottom: 6px; }
+  .pp-metric .pp-m-value { font-size: 19px; font-weight: 700; color: #F9F8F3; }
+  .pp-metric .pp-m-sub { font-size: 8.5px; color: #8E8E92; margin-top: 2px; }
+
+  .pp-card { background: #292522; border: 1px solid rgba(198,188,178,0.16); border-radius: 12px; padding: 16px 18px; margin-bottom: 14px; break-inside: avoid; }
+  .pp-section-title { font-size: 11.5px; font-weight: 700; letter-spacing: 0.06em; text-transform: uppercase; color: #F9F8F3; margin: 0 0 10px; }
+  .pp-section-sub { font-size: 10px; color: #C6BCB2; margin: -6px 0 12px; line-height: 1.5; }
+  .pp-body-text { font-size: 10.5px; color: #D6CFC5; line-height: 1.65; }
+  .pp-body-text b { color: #F9F8F3; }
   .pp-two-col { display: grid; grid-template-columns: 1.35fr 1fr; gap: 14px; }
 
   .pp-table { width: 100%; border-collapse: collapse; font-size: 10px; }
-  .pp-table th { text-align: left; color: #6E6885; font-weight: 700; padding: 6px 8px; font-size: 8.5px;
-    text-transform: uppercase; letter-spacing: 0.04em; border-bottom: 1px solid rgba(148,138,179,0.25); }
-  .pp-table td { padding: 7px 8px; border-bottom: 1px solid rgba(148,138,179,0.12); vertical-align: middle; }
-  .pp-table tr:nth-child(even) td { background: rgba(148,138,179,0.05); }
+  .pp-table th { text-align: left; color: #8E8E92; font-weight: 700; padding: 6px 8px; font-size: 8.5px;
+    text-transform: uppercase; letter-spacing: 0.04em; border-bottom: 1px solid rgba(198,188,178,0.25); }
+  .pp-table td { padding: 7px 8px; border-bottom: 1px solid rgba(198,188,178,0.12); vertical-align: middle; }
+  .pp-table tr:nth-child(even) td { background: rgba(198,188,178,0.05); }
   .pp-table .pp-num { text-align: right; white-space: nowrap; font-variant-numeric: tabular-nums; }
-  .pp-table .pp-rank { color: #6E6885; width: 22px; }
+  .pp-table .pp-rank { color: #8E8E92; width: 22px; }
   .pp-table .pp-el-name { word-break: break-word; }
 
   .pp-snap-item { margin-bottom: 12px; }
-  .pp-snap-item .pp-snap-label { font-size: 8.5px; text-transform: uppercase; letter-spacing: 0.05em; color: #6E6885; margin-bottom: 3px; }
-  .pp-snap-item .pp-snap-value { font-size: 13px; font-weight: 700; color: #F1EEFA; }
+  .pp-snap-item .pp-snap-label { font-size: 8.5px; text-transform: uppercase; letter-spacing: 0.05em; color: #8E8E92; margin-bottom: 3px; }
+  .pp-snap-item .pp-snap-value { font-size: 13px; font-weight: 700; color: #F9F8F3; }
 
-  .pp-shot-frame { width: 100%; border-radius: 10px; overflow: hidden; border: 1px solid rgba(148,138,179,0.2); background: #171923; }
+  .pp-shot-frame { width: 100%; border-radius: 10px; overflow: hidden; border: 1px solid rgba(198,188,178,0.2); background: #221F1D; }
   .pp-shot-frame img { display: block; width: 100%; height: auto; }
-  .pp-shot-label { font-size: 9.5px; color: #9B95B3; margin-bottom: 8px; display: flex; justify-content: space-between; }
+  .pp-shot-label { font-size: 9.5px; color: #C6BCB2; margin-bottom: 8px; display: flex; justify-content: space-between; }
   .pp-shot-row { display: grid; gap: 12px; margin-bottom: 14px; break-inside: avoid; }
   .pp-shot-row.pp-cols-1 { grid-template-columns: 1fr; }
   .pp-shot-row.pp-cols-2 { grid-template-columns: 1fr 1fr; }
 
-  .pp-chart-caption { font-size: 9px; color: #6E6885; margin-top: 8px; text-align: center; }
+  .pp-chart-caption { font-size: 9px; color: #8E8E92; margin-top: 8px; text-align: center; }
 
   .pp-detail-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 10px; }
-  .pp-detail-card { background: #171923; border: 1px solid rgba(148,138,179,0.14); border-radius: 10px; padding: 10px 12px; break-inside: avoid; }
-  .pp-detail-card .pp-d-name { font-size: 10.5px; font-weight: 600; color: #F1EEFA; margin-bottom: 6px; }
-  .pp-detail-card .pp-d-row { display: flex; justify-content: space-between; font-size: 9px; color: #9B95B3; padding: 2px 0; }
-  .pp-detail-card .pp-d-row b { color: #F1EEFA; font-weight: 600; }
+  .pp-detail-card { background: #221F1D; border: 1px solid rgba(198,188,178,0.14); border-radius: 10px; padding: 10px 12px; break-inside: avoid; }
+  .pp-detail-card .pp-d-name { font-size: 10.5px; font-weight: 600; color: #F9F8F3; margin-bottom: 6px; }
+  .pp-detail-card .pp-d-row { display: flex; justify-content: space-between; font-size: 9px; color: #C6BCB2; padding: 2px 0; }
+  .pp-detail-card .pp-d-row b { color: #F9F8F3; font-weight: 600; }
 
-  .pp-click-item { border-bottom: 1px solid rgba(148,138,179,0.12); padding: 7px 0; font-size: 10px; break-inside: avoid; }
-  .pp-click-item .pp-click-time { font-size: 8.5px; color: #6E6885; }
-  .pp-click-item .pp-click-el { font-weight: 600; color: #F1EEFA; }
-  .pp-click-item .pp-click-text { color: #9B95B3; font-size: 9.5px; }
+  .pp-click-item { border-bottom: 1px solid rgba(198,188,178,0.12); padding: 7px 0; font-size: 10px; break-inside: avoid; }
+  .pp-click-item .pp-click-time { font-size: 8.5px; color: #8E8E92; }
+  .pp-click-item .pp-click-el { font-weight: 600; color: #F9F8F3; }
+  .pp-click-item .pp-click-text { color: #C6BCB2; font-size: 9.5px; }
 
   .pp-insight-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
-  .pp-insight-card { background: #1E2030; border: 1px solid rgba(148,138,179,0.16); border-radius: 12px; padding: 16px; break-inside: avoid; }
-  .pp-insight-card .pp-i-label { font-size: 9px; text-transform: uppercase; letter-spacing: 0.06em; color: #6E6885; margin-bottom: 6px; }
-  .pp-insight-card .pp-i-value { font-size: 17px; font-weight: 700; color: #F1EEFA; }
+  .pp-insight-card { background: #292522; border: 1px solid rgba(198,188,178,0.16); border-radius: 12px; padding: 16px; break-inside: avoid; }
+  .pp-insight-card .pp-i-label { font-size: 9px; text-transform: uppercase; letter-spacing: 0.06em; color: #8E8E92; margin-bottom: 6px; }
+  .pp-insight-card .pp-i-value { font-size: 17px; font-weight: 700; color: #F9F8F3; }
 
-  .pp-empty { font-size: 10.5px; color: #6E6885; padding: 10px 0; }
+  .pp-empty { font-size: 10.5px; color: #8E8E92; padding: 10px 0; }
 </style>
 </head>
 <body>
@@ -683,7 +665,7 @@ __THEME_CSS__
     <div class="mark">__EYE_ICON__</div>
     <div>
       <h1>InsightUX Session Report</h1>
-      <div class="sub">__URL__ &nbsp;&middot;&nbsp; __SESSION_TIMESTAMP__ &nbsp;&middot;&nbsp; __DURATION__s &nbsp;&middot;&nbsp; __SAMPLES__ gaze samples</div>
+      <div class="sub">__SUBJECT_LABEL____URL__ &nbsp;&middot;&nbsp; __SESSION_TIMESTAMP__ &nbsp;&middot;&nbsp; __DURATION__s &nbsp;&middot;&nbsp; __SAMPLES__ gaze samples</div>
     </div>
   </div>
   <div class="actions">
@@ -717,10 +699,10 @@ __THEME_CSS__
       <div class="legend-scale">
         <span>Little</span><div class="bar"></div><span>A lot</span>
       </div>
-      <p>Each card is a different scroll position — the report splits
-      the page automatically whenever you scrolled far enough that the view
-      changed meaningfully. Use the full-session export buttons to download
-      one stitched image covering the entire page.</p>
+      <p>This is the entire page stitched into one continuous image from
+      every screenshot captured during the session, so you can see attention
+      across the whole layout at a glance instead of one scroll position at
+      a time. Use the maximize/download buttons above to view or save it.</p>
     </div>
   </div>
   <div class="panel iux-card full iux-fade-in">
@@ -830,7 +812,8 @@ const RANKING  = __RANKING_JSON__;
 const SEGMENTS = __SEGMENTS_JSON__;
 const MOUSE_INTERESTS = __MOUSE_INTERESTS_JSON__;
 const MOUSE_CLICKS = __MOUSE_CLICKS_JSON__;
-const MOUSE_SEGMENTS = __MOUSE_SEGMENTS_JSON__;
+const MOUSE_FULLPAGE = __MOUSE_FULLPAGE_JSON__;
+const PAGE_DIMS = __PAGE_DIMS_JSON__;
 const MAX_ATTENTION_ITEMS = __MAX_ATTENTION_ITEMS__;
 const SESSION = {
   url: __URL_JSON__,
@@ -1071,13 +1054,11 @@ function iconForLabel(label){
     if (MOUSE_CLICKS.length > 1) {
       const times = MOUSE_CLICKS.map(c => { const p = (c.timestamp||'').split(':').map(Number); return (p[0]||0)*3600+(p[1]||0)*60+(p[2]||0); });
       const tmin = Math.min(...times), tmax = Math.max(...times) || tmin + 1;
-      ctx.strokeStyle = 'rgba(139,92,246,0.25)';
+      ctx.strokeStyle = 'rgba(255,233,168,0.25)';
       ctx.beginPath(); ctx.moveTo(0, cv.height - 10); ctx.lineTo(cv.width, cv.height - 10); ctx.stroke();
       times.forEach(function(t){
         const x = ((t - tmin) / (tmax - tmin || 1)) * (cv.width - 12) + 6;
-        const grad = ctx.createLinearGradient(x, 6, x, cv.height - 10);
-        grad.addColorStop(0, '#C084FC'); grad.addColorStop(1, '#6366F1');
-        ctx.fillStyle = grad;
+        ctx.fillStyle = '#FFE9A8';
         ctx.beginPath(); ctx.arc(x, cv.height - 10, 4, 0, 2*Math.PI); ctx.fill();
       });
     }
@@ -1138,9 +1119,9 @@ const EYE_STOPS = [
   [1.00, 255, 45,  0],
 ];
 const MOUSE_STOPS = [
-  [0.00, 99,  102, 241],
-  [0.35, 103, 232, 249],
-  [0.70, 192, 132, 252],
+  [0.00, 201, 138, 46],
+  [0.35, 253, 217, 98],
+  [0.70, 255, 233, 168],
   [1.00, 255, 255, 255],
 ];
 const HEAT_RADIUS = 22;  // was 55/60 — smaller, more precise fixation spots
@@ -1218,7 +1199,102 @@ function showToast(message, isError, onRetry){
   toast._hideTimer = setTimeout(function(){ toast.style.display = 'none'; }, onRetry ? 6000 : 3200);
 }
 
-// ---------- Screenshot-backed heatmaps: Eye / Mouse / Combined tabs, paginated ----------
+// ---------- Full-page stitch: combines every scroll-position screenshot
+// into one continuous canvas, and every gaze/mouse point ever recorded into
+// one flat point list in that same canvas's coordinate space. Shared by the
+// live Attention Heatmaps panel and the print/export report so both show
+// the identical whole-page picture — the result is cached (the screenshots
+// never change after the report is built) so it's only ever stitched once.
+//
+// Mouse/DOM coordinates (scrollY, click/trail x-y) are recorded in CSS
+// pixels by the tracked page itself; gaze sx/sy and the screenshots are
+// physical screen pixels (pyautogui.screenshot()). Those only match 1:1 at
+// 100% OS display scale — dprFromViewport() recovers the real ratio from
+// the screenshot's actual decoded size vs. the CSS viewport width recorded
+// alongside it, so every point lands on the spot it was actually at instead
+// of being compressed toward the top-left on scaled displays.
+// ----------
+function dprFromViewport(vw, img){
+  if (!vw || !img || !img.naturalWidth) return 1;
+  const d = img.naturalWidth / vw;
+  return (isFinite(d) && d > 0) ? d : 1;
+}
+
+let _fullPageStitchPromise = null;
+function buildFullPageStitch(){
+  if (_fullPageStitchPromise) return _fullPageStitchPromise;
+  _fullPageStitchPromise = new Promise(function(resolve, reject){
+    if (!SEGMENTS.length){ reject(new Error('no screenshots to stitch')); return; }
+    const probe = new Image();
+    probe.onload = function(){
+      const dpr = dprFromViewport(SEGMENTS[0].viewportW, probe);
+      let canvasH = Math.round((PAGE_DIMS.h || 0) * dpr);
+      SEGMENTS.forEach(function(s){
+        canvasH = Math.max(canvasH, Math.round(s.scrollY * dpr) + probe.naturalHeight);
+      });
+      const canvasW = probe.naturalWidth;
+
+      // Load every segment's screenshot, then paste each at its recorded
+      // scrollY (converted to canvas px) — in capture order, so the most
+      // recently-seen state of any overlapping band wins, same as any
+      // scroll-and-stitch full-page capture tool.
+      Promise.all(SEGMENTS.map(function(s){
+        return new Promise(function(res){
+          const im = new Image();
+          im.onload = function(){ res({ im: im, scrollY: s.scrollY, stickyRects: s.stickyRects || [] }); };
+          im.onerror = function(){ res(null); };
+          im.src = s.screenshotData;
+        });
+      })).then(function(loaded){
+        const bg = document.createElement('canvas');
+        bg.width = canvasW;
+        bg.height = canvasH;
+        const bgCtx = bg.getContext('2d');
+        loaded.filter(Boolean).forEach(function(item, i){
+          const y = Math.round(item.scrollY * dpr);
+          if (i === 0 || !item.stickyRects.length){
+            bgCtx.drawImage(item.im, 0, y);
+            return;
+          }
+          // Elements with position:fixed/sticky (a floating nav tab, a
+          // persistent CTA) show up at the same on-screen spot in every
+          // screenshot regardless of scroll depth — segment 0 already drew
+          // it once. Clipping it out of every later, overlapping paste (a
+          // rect-with-a-hole clip path, even-odd fill rule) stops each one
+          // from stamping another copy on top, which is what produced the
+          // "duplicated"/ghosted look a naive scroll-and-stitch gets on
+          // pages with fixed UI.
+          bgCtx.save();
+          bgCtx.beginPath();
+          bgCtx.rect(0, y, canvasW, item.im.naturalHeight);
+          item.stickyRects.forEach(function(r){
+            bgCtx.rect(r.x * dpr, y + r.y * dpr, r.w * dpr, r.h * dpr);
+          });
+          bgCtx.clip('evenodd');
+          bgCtx.drawImage(item.im, 0, y);
+          bgCtx.restore();
+        });
+
+        const gazePoints = [];
+        SEGMENTS.forEach(function(s){
+          const offY = Math.round(s.scrollY * dpr);
+          (s.points || []).forEach(function(p){ gazePoints.push({ sx: p.sx, sy: p.sy + offY }); });
+        });
+        const mousePoints = MOUSE_FULLPAGE.map(function(p){
+          return { sx: p.x * dpr, sy: p.y * dpr, w: p.w };
+        });
+
+        resolve({ canvas: bg, width: canvasW, height: canvasH, dpr: dpr, gazePoints: gazePoints, mousePoints: mousePoints });
+      });
+    };
+    probe.onerror = function(){ reject(new Error('could not load a screenshot to stitch')); };
+    probe.src = SEGMENTS[0].screenshotData;
+  });
+  return _fullPageStitchPromise;
+}
+
+// ---------- Attention Heatmaps panel: Eye / Mouse / Combined tabs over one
+// full-page stitched image (built by buildFullPageStitch() above) ----------
 (function(){
   const area = document.getElementById('heatmapArea');
   const toolbar = document.getElementById('hmToolbar');
@@ -1229,7 +1305,6 @@ function showToast(message, isError, onRetry){
   }
   toolbar.style.display = 'flex';
 
-  let cur = 0;
   let mode = 'eye';   // 'eye' | 'mouse' | 'combined'
   const heatState = {
     eye:      { opacity: 0.9, intensity: 0.09 },
@@ -1237,39 +1312,37 @@ function showToast(message, isError, onRetry){
     combined: { opacity: 0.9, intensity: 0.10 },
   };
 
-  // Mouse/DOM coordinates (scrollY, click/trail x-y) are recorded in CSS
-  // pixels by the tracked page itself; gaze sx/sy and the screenshots are
-  // physical screen pixels (pyautogui.screenshot()). Those only match 1:1
-  // at 100% OS display scale — dprFor() recovers the real ratio from the
-  // screenshot's actual decoded size vs. the CSS viewport width recorded
-  // alongside it, so mouse points land on the spot they were actually at
-  // instead of being compressed toward the top-left on scaled displays.
-  let curDpr = 1;
-  function dprFromViewport(vw, img){
-    if (!vw || !img || !img.naturalWidth) return 1;
-    const d = img.naturalWidth / vw;
-    return (isFinite(d) && d > 0) ? d : 1;
-  }
-  function dprFor(i, img){
-    return dprFromViewport((SEGMENTS[i] || {}).viewportW, img);
-  }
-  function pointsFor(kind, i){
-    if (kind === 'eye') return (SEGMENTS[i] || {}).points || [];
-    const pts = (MOUSE_SEGMENTS[i] || {}).points || [];
-    if (curDpr === 1) return pts;
-    return pts.map(function(p){ return { sx: p.sx * curDpr, sy: p.sy * curDpr, w: p.w }; });
-  }
-
-  function paintActive(ctx, w, h){
-    ctx.clearRect(0, 0, w, h);
+  area.innerHTML = `
+    <div class="shot-wrap" id="shotWrap" title="Click to open in viewer">
+      <img id="shotImg" alt="">
+      <canvas id="shotCanvas"></canvas>
+    </div>
+    <div class="shot-caption" id="shotCaption">Stitching the full page&hellip;</div>
+  `;
+
+  const img = document.getElementById('shotImg');
+  const cv  = document.getElementById('shotCanvas');
+  const ctx = cv.getContext('2d');
+  document.getElementById('shotWrap').addEventListener('click', function(){ openFullPageViewer(); });
+
+  let stitch = null;
+
+  function pointsFor(kind){
+    if (!stitch) return [];
+    return kind === 'eye' ? stitch.gazePoints : stitch.mousePoints;
+  }
+
+  function paintActive(){
+    if (!stitch) return;
+    ctx.clearRect(0, 0, cv.width, cv.height);
     const st = heatState[mode];
     if (mode === 'eye'){
-      paintHeatLayer(ctx, w, h, pointsFor('eye', cur), st.intensity, EYE_STOPS, st.opacity);
+      paintHeatLayer(ctx, cv.width, cv.height, pointsFor('eye'), st.intensity, EYE_STOPS, st.opacity);
     } else if (mode === 'mouse'){
-      paintHeatLayer(ctx, w, h, pointsFor('mouse', cur), st.intensity, MOUSE_STOPS, st.opacity);
+      paintHeatLayer(ctx, cv.width, cv.height, pointsFor('mouse'), st.intensity, MOUSE_STOPS, st.opacity);
     } else {
-      paintHeatLayer(ctx, w, h, pointsFor('eye', cur), st.intensity, EYE_STOPS, st.opacity);
-      paintHeatLayer(ctx, w, h, pointsFor('mouse', cur), st.intensity, MOUSE_STOPS, st.opacity, 'lighter');
+      paintHeatLayer(ctx, cv.width, cv.height, pointsFor('eye'), st.intensity, EYE_STOPS, st.opacity);
+      paintHeatLayer(ctx, cv.width, cv.height, pointsFor('mouse'), st.intensity, MOUSE_STOPS, st.opacity, 'lighter');
     }
   }
 
@@ -1279,149 +1352,109 @@ function showToast(message, isError, onRetry){
       document.querySelectorAll('.hm-tab').forEach(b => b.classList.toggle('on', b === btn));
       document.getElementById('hmOpacity').value = Math.round(heatState[mode].opacity * 100);
       document.getElementById('hmIntensity').value = Math.round(heatState[mode].intensity * 33);
-      renderSegment(cur);
+      paintActive();
     });
   });
   document.getElementById('hmOpacity').addEventListener('input', function(e){
     heatState[mode].opacity = e.target.value / 100;
-    renderSegment(cur);
+    paintActive();
   });
   document.getElementById('hmIntensity').addEventListener('input', function(e){
     heatState[mode].intensity = e.target.value / 33;
-    renderSegment(cur);
+    paintActive();
   });
-  // Flattens the visible screenshot + its heat overlay into ONE opaque
+
+  // Flattens the visible full-page image + its heat overlay into ONE opaque
   // canvas. The on-screen view layers a transparent <canvas> on top of an
   // <img> purely via CSS positioning — exporting the heat canvas alone (as
   // earlier code did) produces a mostly-transparent PNG that most viewers
   // render as solid black. This is the single source both the fullscreen
   // viewer and the direct download button use, so both always show the
   // real composited picture.
-  function composeSegmentCanvas(){
-    const shotImg = document.getElementById('shotImg');
-    const heatCv = document.getElementById('shotCanvas');
-    if (!shotImg || !heatCv || !shotImg.complete || !shotImg.naturalWidth) return null;
+  function composeFullPageCanvas(){
+    if (!stitch || !img.complete || !img.naturalWidth) return null;
     const out = document.createElement('canvas');
-    out.width = shotImg.naturalWidth;
-    out.height = shotImg.naturalHeight;
+    out.width = img.naturalWidth;
+    out.height = img.naturalHeight;
     const octx = out.getContext('2d');
     octx.fillStyle = '#ffffff';
     octx.fillRect(0, 0, out.width, out.height);
-    octx.drawImage(shotImg, 0, 0);
-    octx.drawImage(heatCv, 0, 0);
+    octx.drawImage(img, 0, 0);
+    octx.drawImage(cv, 0, 0);
     return out;
   }
 
-  function segmentTitle(i){
-    return 'Scroll segment ' + (i+1) + ' of ' + SEGMENTS.length + ' — ' + mode.charAt(0).toUpperCase() + mode.slice(1) + ' heatmap';
+  function fullPageTitle(){
+    return 'Full Page — ' + mode.charAt(0).toUpperCase() + mode.slice(1) + ' heatmap';
   }
-  function segmentDownloadName(i){
-    return 'insightux-' + mode + '-heatmap-segment-' + (i+1) + '.png';
+  function fullPageDownloadName(){
+    return 'insightux-' + mode + '-heatmap-fullpage.png';
   }
 
-  // Opens (or, if already open, updates in place) the shared viewer for
-  // segment i — used by the maximize button, clicking the screenshot
-  // itself, and the viewer's own Previous/Next controls.
-  function openSegmentViewer(i){
-    if (i < 0 || i >= SEGMENTS.length) return;
-    if (i !== cur) { cur = i; renderSegment(cur); }
-    renderPromise.then(function(){
-      const canvas = composeSegmentCanvas();
-      if (!canvas) {
-        showToast('Could not prepare this screenshot for viewing.', true, function(){ renderSegment(i); openSegmentViewer(i); });
-        return;
-      }
-      Viewer.open({
-        source: canvas,
-        title: segmentTitle(i),
-        downloadName: segmentDownloadName(i),
-        onPrev: i > 0 ? function(){ openSegmentViewer(i - 1); } : null,
-        onNext: i < SEGMENTS.length - 1 ? function(){ openSegmentViewer(i + 1); } : null,
-      });
+  function openFullPageViewer(){
+    const canvas = composeFullPageCanvas();
+    if (!canvas) {
+      showToast('Could not prepare the full-page heatmap for viewing.', true, openFullPageViewer);
+      return;
+    }
+    Viewer.open({
+      source: canvas,
+      title: fullPageTitle(),
+      downloadName: fullPageDownloadName(),
+      onPrev: null,
+      onNext: null,
     });
   }
 
-  document.getElementById('hmFullscreen').addEventListener('click', function(){ openSegmentViewer(cur); });
+  document.getElementById('hmFullscreen').addEventListener('click', openFullPageViewer);
   document.getElementById('hmDownload').addEventListener('click', function(){
-    const theCur = cur;
-    const canvas = composeSegmentCanvas();
+    const canvas = composeFullPageCanvas();
     if (!canvas) {
-      showToast('Could not prepare this screenshot for export.', true, function(){ renderSegment(theCur); });
+      showToast('Could not prepare the full-page heatmap for export.', true);
       return;
     }
     try {
       const a = document.createElement('a');
       a.href = canvas.toDataURL('image/png');
-      a.download = segmentDownloadName(cur);
+      a.download = fullPageDownloadName();
       a.click();
     } catch (err) {
-      console.warn('[insightux-report] segment download failed:', err);
+      console.warn('[insightux-report] full-page download failed:', err);
       showToast('Could not export this image.', true);
     }
   });
 
-  let renderPromise = Promise.resolve();
-
-  // Renders segment i's screenshot + active heat layer(s). `shotImg`'s src
-  // is the data: URI from segment.screenshotData (embedded at report-build
-  // time — see _screenshot_data_uri() in analysis.py) rather than a
-  // file:// path, so later reading the composited canvas back out
-  // (composeSegmentCanvas, for the viewer/download) doesn't hit the
-  // packaged app's file:// canvas-tainting restriction. Returns a promise
-  // that resolves once the image has actually painted, so callers that
-  // need the pixels (the viewer, download) can wait for it instead of
-  // racing it.
-  function renderSegment(i){
-    const seg = SEGMENTS[i];
-    area.innerHTML = `
-      <div class="shot-wrap" id="shotWrap" title="Click to open in viewer">
-        <img id="shotImg" src="${seg.screenshotData}" alt="">
-        <canvas id="shotCanvas"></canvas>
-      </div>
-      <div class="shot-nav">
-        <button class="iux-btn" id="prevBtn" ${i===0?'disabled':''}>${iuxIcon('chevron-left',13)} Earlier</button>
-        <span>Scroll segment ${i+1} of ${SEGMENTS.length} &middot; ~${seg.duration}s of attention here</span>
-        <button class="iux-btn" id="nextBtn" ${i===SEGMENTS.length-1?'disabled':''}>Later ${iuxIcon('chevron-right',13)}</button>
-      </div>
-    `;
-
-    document.getElementById('prevBtn').onclick = () => { if (cur>0){ cur--; renderSegment(cur); } };
-    document.getElementById('nextBtn').onclick = () => { if (cur<SEGMENTS.length-1){ cur++; renderSegment(cur); } };
-    document.getElementById('shotWrap').addEventListener('click', function(){ openSegmentViewer(i); });
-
-    const img = document.getElementById('shotImg');
-    const cv  = document.getElementById('shotCanvas');
-    const ctx = cv.getContext('2d');
-
-    renderPromise = new Promise(function(resolve){
-      function paint(){
-        cv.width = img.naturalWidth;
-        cv.height = img.naturalHeight;
-        curDpr = dprFor(i, img);
-        paintActive(ctx, cv.width, cv.height);
-        resolve();
-      }
-      function fail(){
-        const shotWrap = document.getElementById('shotWrap');
-        if (shotWrap) {
-          shotWrap.innerHTML =
-            '<div class="empty"><span class="ei">' + iuxIcon('info', 26) + '</span>' +
-            'Could not load the screenshot for segment ' + (i+1) + '.<br>' +
-            '<button type="button" class="iux-btn" id="retryShotBtn" style="margin-top:10px;">' +
-            iuxIcon('refresh', 13) + ' Retry</button></div>';
-          shotWrap.removeAttribute('title');
-          const retryBtn = document.getElementById('retryShotBtn');
-          if (retryBtn) retryBtn.addEventListener('click', function(e){ e.stopPropagation(); renderSegment(i); });
-        }
-        resolve();  // let any pending viewer/download callers proceed — composeSegmentCanvas will see no #shotImg and surface its own toast
+  function renderFail(){
+    const shotWrap = document.getElementById('shotWrap');
+    if (shotWrap) {
+      shotWrap.innerHTML =
+        '<div class="empty"><span class="ei">' + iuxIcon('info', 26) + '</span>' +
+        'Could not stitch the full-page heatmap for this session.<br>' +
+        '<button type="button" class="iux-btn" id="retryShotBtn" style="margin-top:10px;">' +
+        iuxIcon('refresh', 13) + ' Retry</button></div>';
+      shotWrap.removeAttribute('title');
+      const retryBtn = document.getElementById('retryShotBtn');
+      if (retryBtn) retryBtn.addEventListener('click', function(e){ e.stopPropagation(); load(); });
+    }
+  }
+
+  function load(){
+    buildFullPageStitch().then(function(result){
+      stitch = result;
+      img.onload = function(){
+        cv.width = stitch.width;
+        cv.height = stitch.height;
+        paintActive();
+      };
+      img.src = stitch.canvas.toDataURL('image/png');
+      const caption = document.getElementById('shotCaption');
+      if (caption) {
+        caption.textContent = SESSION.duration + 's session · ' + SESSION.samples + ' gaze samples · ' + MOUSE_FULLPAGE.length + ' mouse points';
       }
-      if (img.complete && img.naturalWidth) paint();
-      else { img.onload = paint; img.onerror = fail; }
-    });
-    return renderPromise;
+    }).catch(renderFail);
   }
 
-  renderSegment(cur);
+  load();
 })();
 
 // ---------- Element Attention Analysis: plots EVERY row of the already-
@@ -1465,6 +1498,12 @@ function showToast(message, isError, onRetry){
   let hoverIdx = -1;
   let animProgress = 0;
   let raf = null;
+  // Re-read from --iux-indigo/--iux-primary-light on every paint() so the
+  // chart follows the live theme toggle instead of locking in one value —
+  // primary-light in particular differs between dark (bright yellow) and
+  // light (deep goldenrod) so it stays legible against bgAlt either way.
+  let accent = '#FFE9A8';
+  let accentLight = '#FFE9A8';
 
   const MIN_SLOT = 60;  // generous px per element — chart scrolls instead of compressing
 
@@ -1526,8 +1565,8 @@ function showToast(message, isError, onRetry){
       ctx.lineTo(pts[pts.length - 1].x, g.padTop + g.plotH);
       ctx.closePath();
       const areaGrad = ctx.createLinearGradient(0, g.padTop, 0, g.padTop + g.plotH);
-      areaGrad.addColorStop(0, 'rgba(139,92,246,0.30)');
-      areaGrad.addColorStop(1, 'rgba(139,92,246,0)');
+      areaGrad.addColorStop(0, 'rgba(255,233,168,0.30)');
+      areaGrad.addColorStop(1, 'rgba(255,233,168,0)');
       ctx.fillStyle = areaGrad;
       ctx.fill();
     }
@@ -1540,7 +1579,7 @@ function showToast(message, isError, onRetry){
         ctx.quadraticCurveTo(cur.x, cur.y, midX, midY);
       }
       ctx.lineTo(pts[pts.length - 1].x, pts[pts.length - 1].y);
-      ctx.strokeStyle = '#8B5CF6';
+      ctx.strokeStyle = accent;
       ctx.lineWidth = 2.5;
       ctx.lineJoin = 'round';
       ctx.lineCap = 'round';
@@ -1556,8 +1595,8 @@ function showToast(message, isError, onRetry){
       const h = bottom - top;
       if (h <= 0) return;
       const grad = ctx.createLinearGradient(0, top, 0, bottom);
-      grad.addColorStop(0, '#C084FC');
-      grad.addColorStop(1, '#6366F1');
+      grad.addColorStop(0, accentLight);
+      grad.addColorStop(1, accent);
       ctx.fillStyle = grad;
       const r = Math.min(6, barW / 2, h);
       ctx.beginPath();
@@ -1573,11 +1612,13 @@ function showToast(message, isError, onRetry){
   }
 
   function paint(){
-    const dim    = getComputedStyle(document.documentElement).getPropertyValue('--iux-text-dim').trim() || '#9a95b3';
-    const faint  = getComputedStyle(document.documentElement).getPropertyValue('--iux-text-faint').trim() || '#6e6885';
-    const border = getComputedStyle(document.documentElement).getPropertyValue('--iux-border').trim() || 'rgba(148,138,179,0.16)';
-    const bgAlt  = getComputedStyle(document.documentElement).getPropertyValue('--iux-bg-alt').trim() || '#171923';
-    const strong = document.documentElement.getAttribute('data-theme') === 'light' ? '#211D33' : '#F1EEFA';
+    const dim    = getComputedStyle(document.documentElement).getPropertyValue('--iux-text-dim').trim() || '#c6bcb2';
+    const faint  = getComputedStyle(document.documentElement).getPropertyValue('--iux-text-faint').trim() || '#8e8e92';
+    const border = getComputedStyle(document.documentElement).getPropertyValue('--iux-border').trim() || 'rgba(198,188,178,0.16)';
+    const bgAlt  = getComputedStyle(document.documentElement).getPropertyValue('--iux-bg-alt').trim() || '#221F1D';
+    const strong = document.documentElement.getAttribute('data-theme') === 'light' ? '#312F2E' : '#F9F8F3';
+    accent      = getComputedStyle(document.documentElement).getPropertyValue('--iux-indigo').trim() || '#FFE9A8';
+    accentLight = getComputedStyle(document.documentElement).getPropertyValue('--iux-primary-light').trim() || '#FFE9A8';
     const g = geometry();
 
     // Opaque fill first: this canvas is also what Export reads directly,
@@ -1613,7 +1654,7 @@ function showToast(message, isError, onRetry){
       const isHover = i === hoverIdx;
       ctx.beginPath();
       ctx.arc(pt.x, pt.y, isHover ? 6.5 : 4, 0, 2 * Math.PI);
-      ctx.fillStyle = isHover ? '#C084FC' : '#8B5CF6';
+      ctx.fillStyle = isHover ? accentLight : accent;
       ctx.fill();
       ctx.lineWidth = 2;
       ctx.strokeStyle = bgAlt;
@@ -1805,34 +1846,30 @@ function showToast(message, isError, onRetry){
   function fmtS(n){ return (Math.round((n||0)*100)/100).toFixed(2) + 's'; }
   function fmtPct(n){ return (n||0).toFixed(1) + '%'; }
 
-  // Composites each segment's screenshot with its eye-attention heat layer
-  // (the exact same paintHeatLayer()/EYE_STOPS the live Attention Heatmaps
-  // panel uses) into one flattened PNG, so print doesn't depend on a live
-  // canvas repainting correctly inside the print engine.
-  function compositeSegmentImage(seg){
-    return new Promise(function(resolve){
-      const im = new Image();
-      im.onload = function(){
-        const cv = document.createElement('canvas');
-        cv.width = im.naturalWidth || 1;
-        cv.height = im.naturalHeight || 1;
-        const cx = cv.getContext('2d');
-        cx.drawImage(im, 0, 0);
-        try { paintHeatLayer(cx, cv.width, cv.height, seg.points || [], 0.09, EYE_STOPS, 0.9); } catch(e){}
-        let dataUrl = seg.screenshotData;
-        try { dataUrl = cv.toDataURL('image/png'); } catch(e){}
-        resolve({ dataUrl: dataUrl, w: cv.width, h: cv.height });
-      };
-      im.onerror = function(){ resolve({ dataUrl: seg.screenshotData, w: 16, h: 9 }); };
-      im.src = seg.screenshotData;
-    });
-  }
-
-  window.__insightuxPrintReady = Promise.all(SEGMENTS.map(compositeSegmentImage))
+  // Composites the whole-session full-page stitch (buildFullPageStitch(),
+  // shared with the live Attention Heatmaps panel) with its eye-attention
+  // heat layer (the exact same paintHeatLayer()/EYE_STOPS) into one
+  // flattened PNG, so print doesn't depend on a live canvas repainting
+  // correctly inside the print engine.
+  function compositeFullPageImage(){
+    return buildFullPageStitch().then(function(stitch){
+      const cv = document.createElement('canvas');
+      cv.width = stitch.width || 1;
+      cv.height = stitch.height || 1;
+      const cx = cv.getContext('2d');
+      cx.drawImage(stitch.canvas, 0, 0);
+      try { paintHeatLayer(cx, cv.width, cv.height, stitch.gazePoints || [], 0.09, EYE_STOPS, 0.9); } catch(e){}
+      let dataUrl = null;
+      try { dataUrl = cv.toDataURL('image/png'); } catch(e){}
+      return { dataUrl: dataUrl, w: cv.width, h: cv.height };
+    }).catch(function(){ return null; });
+  }
+
+  window.__insightuxPrintReady = compositeFullPageImage()
     .then(buildPrintPages)
     .catch(function(){ /* best-effort — export still works with whatever got built */ });
 
-  function buildPrintPages(composited){
+  function buildPrintPages(fullPage){
     const BODY_BUDGET = 1025; // must match .pp-body's CSS height (1123 - 46 top - 52 bottom)
     const PAGES = [];
     let curBody = null;
@@ -2047,18 +2084,6 @@ function showToast(message, isError, onRetry){
     newPage();
     fitAppend(sectionHeading('Attention Visualization', 'Visual representation of the recorded gaze attention across webpage elements.'));
 
-    if (SEGMENTS.length) {
-      const seg = SEGMENTS[0];
-      const c = composited[0];
-      const shotCard = document.createElement('div');
-      shotCard.className = 'pp-card';
-      shotCard.innerHTML =
-        '<div class="pp-section-title" style="font-size:10.5px;">Session View</div>' +
-        '<div class="pp-shot-label"><span>Scroll segment 1 of ' + SEGMENTS.length + '</span><span>~' + seg.duration + 's of attention here</span></div>' +
-        '<div class="pp-shot-frame"><img width="' + c.w + '" height="' + c.h + '" src="' + c.dataUrl + '" alt=""></div>';
-      fitAppend(shotCard);
-    }
-
     const chartCard = document.createElement('div');
     chartCard.className = 'pp-card';
     const chartTitle = document.createElement('div');
@@ -2105,21 +2130,24 @@ function showToast(message, isError, onRetry){
     newPage();
     fitAppend(sectionHeading('Attention Heatmaps', 'Heatmaps show where visual attention was concentrated within the recorded webpage viewport.'));
 
-    if (SEGMENTS.length) {
-      const perRow = SEGMENTS.length <= 3 ? 1 : 2;
-      for (let i = 0; i < SEGMENTS.length; i += perRow) {
-        const row = document.createElement('div');
-        row.className = 'pp-shot-row pp-cols-' + perRow;
-        for (let j = i; j < Math.min(i + perRow, SEGMENTS.length); j++) {
-          const seg = SEGMENTS[j], c = composited[j];
-          const card = document.createElement('div');
-          card.innerHTML =
-            '<div class="pp-shot-label"><span>Scroll Segment ' + (j + 1) + '</span><span>~' + seg.duration + 's attention</span></div>' +
-            '<div class="pp-shot-frame"><img width="' + c.w + '" height="' + c.h + '" src="' + c.dataUrl + '" alt=""></div>';
-          row.appendChild(card);
-        }
-        fitAppend(row);
-      }
+    if (fullPage && fullPage.dataUrl && fullPage.w && fullPage.h) {
+      // Shrunk to fit within whatever body space is left on this page —
+      // the stitched full-page image is usually far taller than one A4
+      // page, so it's scaled down as a whole (poster-style) rather than
+      // sliced across several pages.
+      const usedH = curBody.scrollHeight;
+      const availW = 702;  // .pp-body content width: 794 - 46*2
+      const availH = Math.max(160, BODY_BUDGET - usedH - 60);
+      const scale = Math.min(availW / fullPage.w, availH / fullPage.h, 1);
+      const dispW = Math.max(1, Math.round(fullPage.w * scale));
+      const dispH = Math.max(1, Math.round(fullPage.h * scale));
+      const shotCard = document.createElement('div');
+      shotCard.className = 'pp-card';
+      shotCard.innerHTML =
+        '<div class="pp-shot-label"><span>Whole page, every screenshot stitched together</span></div>' +
+        '<div class="pp-shot-frame" style="display:flex;justify-content:center;">' +
+        '<img width="' + dispW + '" height="' + dispH + '" style="width:' + dispW + 'px;height:' + dispH + 'px;" src="' + fullPage.dataUrl + '" alt=""></div>';
+      curBody.appendChild(shotCard);
     } else {
       const empty = document.createElement('div');
       empty.className = 'pp-card';
@@ -2253,8 +2281,8 @@ function showToast(message, isError, onRetry){
 
     ctx.clearRect(0, 0, cssW, cssH);
 
-    ctx.strokeStyle = 'rgba(148,138,179,0.16)';
-    ctx.fillStyle = '#6E6885';
+    ctx.strokeStyle = 'rgba(198,188,178,0.16)';
+    ctx.fillStyle = '#8E8E92';
     ctx.font = '9px ' + font;
     ctx.textAlign = 'right';
     ctx.textBaseline = 'middle';
@@ -2270,7 +2298,7 @@ function showToast(message, isError, onRetry){
     const xFor = function(i){ return n > 1 ? padL + i * stepX : padL + plotW / 2; };
     const yFor = function(v){ return padT + plotH - (v / top) * plotH; };
 
-    ctx.strokeStyle = '#8B5CF6';
+    ctx.strokeStyle = '#FFE9A8';
     ctx.lineWidth = 2;
     ctx.beginPath();
     items.forEach(function(r, i){
@@ -2282,12 +2310,10 @@ function showToast(message, isError, onRetry){
     const showValues = n <= 10;
     items.forEach(function(r, i){
       const x = xFor(i), y = yFor(r.seconds);
-      const grad = ctx.createRadialGradient(x, y, 0, x, y, 5);
-      grad.addColorStop(0, '#C084FC'); grad.addColorStop(1, '#6366F1');
-      ctx.fillStyle = grad;
+      ctx.fillStyle = '#FFE9A8';
       ctx.beginPath(); ctx.arc(x, y, 3.5, 0, 2 * Math.PI); ctx.fill();
       if (showValues) {
-        ctx.fillStyle = '#F1EEFA';
+        ctx.fillStyle = '#F9F8F3';
         ctx.font = '600 9px ' + font;
         ctx.textAlign = 'center';
         ctx.textBaseline = 'alphabetic';
@@ -2295,13 +2321,13 @@ function showToast(message, isError, onRetry){
       }
     });
 
-    ctx.fillStyle = '#9B95B3';
+    ctx.fillStyle = '#C6BCB2';
     ctx.font = '8.5px ' + font;
     ctx.textAlign = 'center';
     ctx.textBaseline = 'top';
     items.forEach(function(r, i){ ctx.fillText('#' + (i + 1), xFor(i), padT + plotH + 8); });
 
-    ctx.fillStyle = '#6E6885';
+    ctx.fillStyle = '#8E8E92';
     ctx.font = '700 8px ' + font;
     ctx.textAlign = 'center';
     ctx.fillText('WEBPAGE ELEMENTS', padL + plotW / 2, cssH - 8);
@@ -2327,21 +2353,36 @@ def generate_report(session_dir):
     segments = build_screenshot_segments(gaze, dom, session_dir)
     summary = session_summary(gaze, dom)
     mouse = summarize_mouse(session_dir)
-    mouse_segments = build_mouse_screenshot_segments(segments, dom, session_dir)
+    mouse_fullpage = build_mouse_fullpage_points(session_dir)
+    page_dims = full_page_dims(dom)
 
     top_label = ranking[0]["label"] if ranking else "—"
 
     # session_dir's own folder name is already the session's timestamp
     # (browser_session.py names it that way) — reused here only to print a
-    # human-readable date in the header, same convention _recent_sessions_json()
-    # already parses on the landing page.
+    # human-readable date in the header, same convention _sessions_json()
+    # already parses for the session-history modal.
     try:
         session_ts = datetime.strptime(os.path.basename(session_dir.rstrip("/\\")), "%Y%m%d_%H%M%S")
         session_timestamp = session_ts.strftime("%b %d, %Y — %I:%M %p").replace(" 0", " ")
     except ValueError:
         session_timestamp = "Unknown time"
 
+    # session_meta.json (browser_session.py's Api._write_session_meta())
+    # records who was being tracked — absent on sessions recorded before
+    # participants existed, which is fine, they're just "self" sessions
+    # with nothing to label.
+    subject_label = ""
+    try:
+        with open(os.path.join(session_dir, "session_meta.json"), "r", encoding="utf-8") as f:
+            meta = json.load(f)
+        if meta.get("tracking_mode") == "participant" and meta.get("participant_name"):
+            subject_label = f"Tracking: {html_escape.escape(meta['participant_name'])} &nbsp;&middot;&nbsp; "
+    except (OSError, json.JSONDecodeError):
+        pass
+
     html = _TEMPLATE
+    html = html.replace("__SUBJECT_LABEL__", subject_label)
     html = html.replace("__URL__", summary["url"] or "Unknown page")
     html = html.replace("__URL_JSON__", json.dumps(summary["url"] or ""))
     html = html.replace("__SESSION_TIMESTAMP__", session_timestamp)
@@ -2356,7 +2397,8 @@ def generate_report(session_dir):
     html = html.replace("__SEGMENTS_JSON__", json.dumps(segments))
     html = html.replace("__MOUSE_INTERESTS_JSON__", json.dumps(mouse["interests"]))
     html = html.replace("__MOUSE_CLICKS_JSON__", json.dumps(mouse["clicks"]))
-    html = html.replace("__MOUSE_SEGMENTS_JSON__", json.dumps(mouse_segments))
+    html = html.replace("__MOUSE_FULLPAGE_JSON__", json.dumps(mouse_fullpage))
+    html = html.replace("__PAGE_DIMS_JSON__", json.dumps(page_dims))
 
     html = html.replace("__THEME_CSS__", theme.THEME_CSS)
     html = html.replace("__THEME_JS__", theme.THEME_TOGGLE_JS)

auth.py

@@ -0,0 +1,148 @@
+"""
+auth.py
+Local, file-based multi-profile authentication for InsightUX.
+
+InsightUX is a single-process desktop app with no server and no database —
+this module IS the whole "backend": a JSON file of profiles (users.json,
+one entry per person who has ever used this install) plus salted-hash
+password verification. Plaintext passwords are never stored, logged, or
+returned to the caller.
+
+No heavy imports (stdlib only), so this can be imported cheaply from
+browser_session.py, calibrate.py, and validate.py alike — same reasoning
+theme.py already documents for its own "no cv2/mediapipe" import.
+"""
+
+import os
+import json
+import uuid
+import hmac
+import hashlib
+import secrets
+from datetime import datetime, timezone
+
+PBKDF2_ITERATIONS = 200_000
+_HASH_NAME = "sha256"
+
+
+class AuthError(Exception):
+    """Raised for user-facing auth failures (bad password, duplicate
+    email, missing fields, ...) — callers show str(e) directly as the
+    status message, same pattern as the rest of the app's _set_status calls."""
+
+
+def _hash_password(password, salt=None):
+    """Returns (salt_hex, hash_hex). A fresh random salt is generated
+    unless one is supplied (re-hashing a login attempt for comparison)."""
+    if salt is None:
+        salt = secrets.token_bytes(16)
+    elif isinstance(salt, str):
+        salt = bytes.fromhex(salt)
+    digest = hashlib.pbkdf2_hmac(_HASH_NAME, password.encode("utf-8"), salt, PBKDF2_ITERATIONS)
+    return salt.hex(), digest.hex()
+
+
+def verify_password(password, salt_hex, hash_hex):
+    _, candidate_hex = _hash_password(password, salt_hex)
+    return hmac.compare_digest(candidate_hex, hash_hex)
+
+
+def _users_path(data_dir):
+    return os.path.join(data_dir, "users.json")
+
+
+def load_users(data_dir):
+    """{user_id: {...}} — empty dict if the file doesn't exist yet (first
+    run) or is unreadable, never raises."""
+    path = _users_path(data_dir)
+    if not os.path.exists(path):
+        return {}
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except (json.JSONDecodeError, OSError):
+        return {}
+
+
+def save_users(data_dir, users):
+    os.makedirs(data_dir, exist_ok=True)
+    path = _users_path(data_dir)
+    tmp = path + ".tmp"
+    with open(tmp, "w", encoding="utf-8") as f:
+        json.dump(users, f, indent=2)
+    os.replace(tmp, path)  # atomic on POSIX and Windows -- never leaves users.json half-written
+
+
+def _avatar_initial(name):
+    name = (name or "").strip()
+    return (name[0] if name else "?").upper()
+
+
+def public_profile(record):
+    """Strip salt/hash before this ever reaches JS -- every function that
+    hands profile data back to the frontend routes through this."""
+    return {
+        "id": record["id"],
+        "name": record["name"],
+        "email": record["email"],
+        "avatar": record.get("avatar") or _avatar_initial(record.get("name")),
+        "created_at": record.get("created_at"),
+    }
+
+
+def create_user(data_dir, name, email, password):
+    name = (name or "").strip()
+    email = (email or "").strip().lower()
+    if not name:
+        raise AuthError("Name is required.")
+    if not email or "@" not in email:
+        raise AuthError("A valid email is required.")
+    if not password or len(password) < 6:
+        raise AuthError("Password must be at least 6 characters.")
+
+    users = load_users(data_dir)
+    for existing in users.values():
+        if existing.get("email", "").lower() == email:
+            raise AuthError("A profile with that email already exists.")
+
+    user_id = uuid.uuid4().hex[:12]
+    salt_hex, hash_hex = _hash_password(password)
+    record = {
+        "id": user_id,
+        "name": name,
+        "email": email,
+        "salt": salt_hex,
+        "hash": hash_hex,
+        "avatar": _avatar_initial(name),
+        "created_at": datetime.now(timezone.utc).isoformat(),
+    }
+    users[user_id] = record
+    save_users(data_dir, users)
+    return public_profile(record)
+
+
+def verify_login(data_dir, user_id, password):
+    """Returns the public profile dict on success, raises AuthError
+    (never a KeyError/generic exception) on any failure — bad id, missing
+    password, wrong password all look the same to the caller."""
+    users = load_users(data_dir)
+    record = users.get(user_id)
+    if not record or not password or not verify_password(password, record["salt"], record["hash"]):
+        raise AuthError("Incorrect email/profile or password.")
+    return public_profile(record)
+
+
+def list_profiles(data_dir):
+    """Public profile list for the login/switch-profile picker -- never
+    includes salt/hash. Sorted by name for a stable, predictable picker."""
+    users = load_users(data_dir)
+    profiles = [public_profile(u) for u in users.values()]
+    profiles.sort(key=lambda p: p["name"].lower())
+    return profiles
+
+
+def user_dir(data_dir, user_id):
+    """Every per-user file (sessions/, calibration.pkl, the fine-tuned
+    ONNX) lives under this one root — the single place that maps a user
+    id to a filesystem path."""
+    return os.path.join(data_dir, "users", user_id)

calibrate.py

@@ -30,6 +30,17 @@ else:
     RESOURCE_DIR = os.path.dirname(os.path.abspath(__file__))
     DATA_DIR     = RESOURCE_DIR
 
+# browser_session.py's start_calibration() sets this env var to the active
+# InsightUX profile's own folder before launching this file as a subprocess,
+# so calibration.pkl/baseline_pose.pkl land there instead of the global
+# DATA_DIR above — keeping one user's calibration from overwriting another's.
+# Unset (e.g. running `python calibrate.py` directly for development) means
+# exactly today's behavior: writes go to the global DATA_DIR.
+_USER_DATA_DIR = os.environ.get("INSIGHTUX_USER_DATA_DIR")
+if _USER_DATA_DIR:
+    DATA_DIR = _USER_DATA_DIR
+    os.makedirs(DATA_DIR, exist_ok=True)
+
 from preprocessing.preprocessing_pipeline import (
     create_face_mesh,
     estimate_camera_matrix,
@@ -445,6 +456,26 @@ def filter_unreliable_points(gaze_vectors, screen_points, head_pitches_deg,
 ONNX_PATH = os.path.join(RESOURCE_DIR, "models", "gaze_cnn_v4.onnx")
 CKPT_PATH = os.path.join(RESOURCE_DIR, "checkpoints", "best_model_v4.pt")
 
+# Fine-tuning (below) used to save its adapted model back over ONNX_PATH
+# itself — i.e. it overwrote the one bundled model every profile's live
+# inference loads, so one person calibrating silently changed what every
+# other profile's eye-tracking used. USER_ONNX_OUT_PATH is that same
+# browser_session.py-supplied env var as DATA_DIR above: when set, the
+# fine-tuned model is saved per-profile instead. Unset (standalone/dev
+# runs) reproduces the exact previous behavior — out_onnx_path=ONNX_PATH.
+USER_ONNX_OUT_PATH = os.environ.get("INSIGHTUX_USER_ONNX_OUT") or ONNX_PATH
+
+
+def _current_onnx_path():
+    """Prefer this profile's own previously fine-tuned model, if a prior
+    calibration run produced one, over the stock bundled model — so the
+    live preview during point collection matches what real tracking will
+    actually use. No-op (always ONNX_PATH) when USER_ONNX_OUT_PATH isn't
+    set to a distinct per-user path, i.e. standalone/dev runs."""
+    if USER_ONNX_OUT_PATH != ONNX_PATH and os.path.exists(USER_ONNX_OUT_PATH):
+        return USER_ONNX_OUT_PATH
+    return ONNX_PATH
+
 # --- Fine-tune target geometry -------------------------------------------
 # USE_MEASURED_GEOMETRY=False keeps the original hand-picked constants
 # (k_h=0.6, k_v=0.4). Those are geometrically wrong in the abstract, but the
@@ -508,7 +539,7 @@ def main():
     # MAIN CALIBRATION
     # =============================================================================
 
-    pipeline  = InsightUXPipeline(ONNX_PATH)
+    pipeline  = InsightUXPipeline(_current_onnx_path())
     face_mesh = create_face_mesh(static_image_mode=False)
     cap       = cv2.VideoCapture(0)
 
@@ -807,7 +838,7 @@ def main():
             screen_w      = SCREEN_W,
             screen_h      = SCREEN_H,
             ckpt_path     = CKPT_PATH,
-            out_onnx_path = ONNX_PATH,
+            out_onnx_path = USER_ONNX_OUT_PATH,
             steps         = 200,
             lr            = 1e-4,
             k_h           = K_H,
@@ -832,7 +863,7 @@ def main():
     # makes edges and corners unstable.
     # =============================================================================
     print("\n--- Fitting RBF calibration ---")
-    pipeline = InsightUXPipeline(ONNX_PATH)
+    pipeline = InsightUXPipeline(USER_ONNX_OUT_PATH if finetuned else _current_onnx_path())
 
     adapted_gaze_vectors = []
     adapted_dispersion   = []

models/gaze_cnn_v4.onnx

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f3564b61d6e1ee304a5f56722ae4963b364429924b224581a8e15ded051c0e16
+oid sha256:6c4bdad4b3b438871bf7d3e884e08433069528a8c97dfa4975d1654ea4352c02
 size 17542588

participants.py

@@ -0,0 +1,137 @@
+"""
+participants.py
+Local participant records for InsightUX's multi-participant tracking.
+
+A participant is NOT an InsightUX login/profile (see auth.py) — it's a
+tracking SUBJECT that an owner creates to keep another person's sessions
+separate from their own, e.g. a UX researcher running sessions on Rahul,
+Priya, Aman. Participants never authenticate and always live nested inside
+their owner's own folder (users/<owner_id>/participants/<id>/), not as a
+sibling top-level directory — so a participant's data cannot structurally
+exist outside their owner's folder at all.
+
+One profile.json per participant folder, not a shared index file — a
+participant folder is always a complete, self-contained, movable/deletable
+unit, the same way users/<owner_id>/ already is relative to DATA_DIR.
+
+No heavy imports (stdlib only) — same reasoning as theme.py/auth.py.
+"""
+
+import os
+import json
+import shutil
+import uuid
+from datetime import datetime, timezone
+
+
+class ParticipantError(Exception):
+    """User-facing failures (missing name, not found, ...)."""
+
+
+def participant_dir(owner_dir, participant_id):
+    return os.path.join(owner_dir, "participants", participant_id)
+
+
+def _profile_path(owner_dir, participant_id):
+    return os.path.join(participant_dir(owner_dir, participant_id), "profile.json")
+
+
+def _save_profile(owner_dir, participant_id, record):
+    path = _profile_path(owner_dir, participant_id)
+    os.makedirs(os.path.dirname(path), exist_ok=True)
+    tmp = path + ".tmp"
+    with open(tmp, "w", encoding="utf-8") as f:
+        json.dump(record, f, indent=2)
+    os.replace(tmp, path)  # atomic on POSIX and Windows
+
+
+def create_participant(owner_dir, name, notes=""):
+    name = (name or "").strip()
+    if not name:
+        raise ParticipantError("Name is required.")
+    participant_id = uuid.uuid4().hex[:12]
+    record = {
+        "id": participant_id,
+        "name": name,
+        "notes": (notes or "").strip(),
+        "created_at": datetime.now(timezone.utc).isoformat(),
+        "session_count": 0,
+        "last_session_at": None,
+    }
+    _save_profile(owner_dir, participant_id, record)
+    return record
+
+
+def get_participant(owner_dir, participant_id):
+    if not participant_id:
+        return None
+    path = _profile_path(owner_dir, participant_id)
+    if not os.path.exists(path):
+        return None
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except (json.JSONDecodeError, OSError):
+        return None
+
+
+def list_participants(owner_dir):
+    """Sorted by name — same predictable-picker convention as
+    auth.list_profiles()."""
+    root = os.path.join(owner_dir, "participants")
+    out = []
+    if os.path.isdir(root):
+        for name in os.listdir(root):
+            if not os.path.isdir(os.path.join(root, name)):
+                continue
+            record = get_participant(owner_dir, name)
+            if record:
+                out.append(record)
+    out.sort(key=lambda p: p["name"].lower())
+    return out
+
+
+def update_participant(owner_dir, participant_id, name=None, notes=None):
+    """In-place edit — name/notes are only touched when explicitly passed
+    (None means "leave as-is"), so a caller updating just one field can't
+    accidentally blank out the other. id/created_at/session_count/
+    last_session_at are never touched here; renaming a participant must
+    never look like a new one to anything reading session_count."""
+    record = get_participant(owner_dir, participant_id)
+    if not record:
+        raise ParticipantError("That participant no longer exists.")
+    if name is not None:
+        name = name.strip()
+        if not name:
+            raise ParticipantError("Name is required.")
+        record["name"] = name
+    if notes is not None:
+        record["notes"] = notes.strip()
+    _save_profile(owner_dir, participant_id, record)
+    return record
+
+
+def delete_participant(owner_dir, participant_id):
+    """Removes the participant's entire folder — profile.json, sessions/,
+    calibration.pkl, everything nested under it. Irreversible; the caller
+    (Api.delete_participant()) is expected to have already confirmed with
+    the user and to have refused this while that participant is the
+    active tracking subject mid-session."""
+    if not participant_id:
+        raise ParticipantError("No participant specified.")
+    pdir = participant_dir(owner_dir, participant_id)
+    if not os.path.isdir(pdir):
+        raise ParticipantError("That participant no longer exists.")
+    shutil.rmtree(pdir)
+
+
+def touch_session_stats(owner_dir, participant_id):
+    """Called once a session for this participant actually starts — keeps
+    session_count/last_session_at current without needing to re-scan every
+    session folder just to show them in the picker/details view later."""
+    record = get_participant(owner_dir, participant_id)
+    if not record:
+        return
+    record["session_count"] = record.get("session_count", 0) + 1
+    record["last_session_at"] = datetime.now(timezone.utc).isoformat()
+    _save_profile(owner_dir, participant_id, record)

requirements-dev.txt

@@ -0,0 +1,9 @@
+# =============================================================================
+# InsightUX — dev/test-only dependencies. NOT needed to run the app itself
+# (see requirements.txt for that) — only to run `pytest` against tests/.
+#
+# Install with:
+#     pip install -r requirements-dev.txt
+# =============================================================================
+
+pytest==9.1.1

tests/conftest.py

@@ -0,0 +1,7 @@
+import sys
+import os
+
+# auth.py/participants.py/analysis.py live at the project root, not in a
+# package -- this is the one place that needs to know that, instead of
+# every test file repeating its own sys.path hack.
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

tests/test_analysis.py

@@ -0,0 +1,244 @@
+"""
+Unit tests for analysis.py's pure computation — session loading, AOI
+attribution, dwell ranking, mouse summarization. No cv2/mediapipe needed
+(analysis.py itself only imports stdlib + theme).
+"""
+
+import os
+import json
+
+import analysis
+
+
+# --- _load_jsonl / load_session -------------------------------------------
+
+def test_load_jsonl_missing_file_returns_empty(tmp_path):
+    assert analysis._load_jsonl(str(tmp_path / "nope.jsonl")) == []
+
+
+def test_load_jsonl_skips_malformed_lines(tmp_path):
+    path = tmp_path / "log.jsonl"
+    path.write_text('{"a": 1}\nnot json\n{"b": 2}\n\n', encoding="utf-8")
+    records = analysis._load_jsonl(str(path))
+    assert records == [{"a": 1}, {"b": 2}]
+
+
+def _write_jsonl(path, records):
+    with open(path, "w", encoding="utf-8") as f:
+        for r in records:
+            f.write(json.dumps(r) + "\n")
+
+
+def test_load_session_filters_by_type_and_sorts_by_time(tmp_path):
+    session_dir = tmp_path / "20260101_120000"
+    session_dir.mkdir()
+    _write_jsonl(session_dir / "gaze_log.jsonl", [
+        {"type": "gaze", "t": 2.0, "sx": 10, "sy": 10},
+        {"type": "other", "t": 0.5},
+        {"type": "gaze", "t": 1.0, "sx": 5, "sy": 5},
+    ])
+    _write_jsonl(session_dir / "dom_log.jsonl", [
+        {"type": "dom", "t": 1.5, "url": "https://example.com", "aois": []},
+    ])
+    gaze, dom = analysis.load_session(str(session_dir))
+    assert [g["t"] for g in gaze] == [1.0, 2.0]  # sorted, "other" filtered out
+    assert len(dom) == 1
+    assert dom[0]["url"] == "https://example.com"
+
+
+def test_load_session_handles_missing_files(tmp_path):
+    session_dir = tmp_path / "20260101_120000"
+    session_dir.mkdir()
+    gaze, dom = analysis.load_session(str(session_dir))
+    assert gaze == []
+    assert dom == []
+
+
+# --- session_summary --------------------------------------------------------
+
+def test_session_summary_empty_gaze():
+    summary = analysis.session_summary([], [])
+    assert summary == {"duration": 0.0, "url": None, "samples": 0}
+
+
+def test_session_summary_computes_duration_and_url():
+    gaze = [{"t": 10.0}, {"t": 12.5}, {"t": 15.0}]
+    dom = [{"t": 10.0, "url": "https://a.com"}, {"t": 14.0, "url": "https://b.com"}]
+    summary = analysis.session_summary(gaze, dom)
+    assert summary["duration"] == 5.0
+    assert summary["url"] == "https://b.com"  # most recent dom snapshot
+    assert summary["samples"] == 3
+
+
+def test_session_summary_url_none_without_dom():
+    summary = analysis.session_summary([{"t": 0.0}, {"t": 1.0}], [])
+    assert summary["url"] is None
+
+
+# --- friendly_label -----------------------------------------------------
+
+def test_friendly_label_handles_none_and_empty():
+    assert analysis.friendly_label(None) == "Unlabeled area"
+    assert analysis.friendly_label("") == "Unlabeled area"
+
+
+def test_friendly_label_known_landmarks():
+    assert analysis.friendly_label("navbar") == "Navigation bar"
+    assert analysis.friendly_label("header") == "Page header"
+    assert analysis.friendly_label("footer") == "Page footer"
+    assert analysis.friendly_label("video") == "Video"
+
+
+def test_friendly_label_image():
+    assert analysis.friendly_label("img: logo.png") == "Image — logo.png"
+
+
+def test_friendly_label_headings():
+    assert analysis.friendly_label("h1: Welcome") == 'Main heading — “Welcome”'
+    assert analysis.friendly_label("h2: About") == 'Heading — “About”'
+    assert analysis.friendly_label("h3: Details") == 'Sub-heading — “Details”'
+
+
+def test_friendly_label_paragraph():
+    assert analysis.friendly_label("p (some text)") == 'Text — “some text…”'
+
+
+def test_friendly_label_id_and_class_selectors():
+    assert analysis.friendly_label("#hero") == "Section: hero"
+    assert analysis.friendly_label(".card") == "Block: card"
+
+
+def test_friendly_label_falls_back_to_capitalized_raw():
+    assert analysis.friendly_label("button") == "Button"
+
+
+# --- _find_aoi / attribute_gaze ----------------------------------------
+
+def _aoi(label, x, y, w, h):
+    return {"label": label, "x": x, "y": y, "w": w, "h": h}
+
+
+def test_find_aoi_returns_none_when_no_match():
+    aois = [_aoi("header", 0, 0, 100, 50)]
+    assert analysis._find_aoi(500, 500, aois) is None
+
+
+def test_find_aoi_matches_point_inside_box():
+    aois = [_aoi("header", 0, 0, 100, 50)]
+    assert analysis._find_aoi(50, 25, aois) == "header"
+
+
+def test_find_aoi_respects_padding():
+    aois = [_aoi("header", 100, 100, 50, 50)]
+    # Just outside the box but within PAD_PX (90) of it
+    assert analysis._find_aoi(95, 125, aois) == "header"
+    # Far outside the padded box entirely
+    assert analysis._find_aoi(1000, 1000, aois) is None
+
+
+def test_find_aoi_picks_smallest_area_on_overlap():
+    aois = [
+        _aoi("big", 0, 0, 500, 500),
+        _aoi("small", 100, 100, 20, 20),
+    ]
+    assert analysis._find_aoi(110, 110, aois) == "small"
+
+
+def test_find_aoi_skips_embed_label():
+    aois = [_aoi("embed", 0, 0, 1000, 1000)]
+    assert analysis._find_aoi(500, 500, aois) is None
+
+
+def test_attribute_gaze_all_none_without_dom():
+    gaze = [{"t": 1.0, "sx": 5, "sy": 5}, {"t": 2.0, "sx": 6, "sy": 6}]
+    result = analysis.attribute_gaze(gaze, [])
+    assert result == [(1.0, None), (2.0, None)]
+
+
+def test_attribute_gaze_uses_most_recent_dom_snapshot():
+    gaze = [{"t": 5.0, "sx": 50, "sy": 25}]
+    dom = [
+        {"t": 1.0, "aois": [_aoi("old", 0, 0, 10, 10)]},
+        {"t": 4.0, "aois": [_aoi("header", 0, 0, 100, 50)]},
+    ]
+    result = analysis.attribute_gaze(gaze, dom)
+    assert result == [(5.0, "header")]
+
+
+def test_attribute_gaze_before_first_dom_snapshot_is_none():
+    gaze = [{"t": 0.5, "sx": 50, "sy": 25}]
+    dom = [{"t": 4.0, "aois": [_aoi("header", 0, 0, 100, 50)]}]
+    result = analysis.attribute_gaze(gaze, dom)
+    assert result == [(0.5, None)]
+
+
+# --- compute_dwell_ranking -----------------------------------------------
+
+def test_compute_dwell_ranking_empty_for_fewer_than_two_points():
+    assert analysis.compute_dwell_ranking([]) == []
+    assert analysis.compute_dwell_ranking([(0.0, "header")]) == []
+
+
+def test_compute_dwell_ranking_accumulates_time_per_label():
+    attributed = [
+        (0.0, "header"), (1.0, "header"), (2.0, "footer"), (3.0, "footer"), (4.0, None),
+    ]
+    ranking = analysis.compute_dwell_ranking(attributed)
+    labels = {r["label"]: r for r in ranking}
+    assert "Page header" in labels
+    assert "Page footer" in labels
+    assert labels["Page header"]["seconds"] == 2.0  # (1.0-0.0) + (2.0-1.0)
+    assert labels["Page footer"]["seconds"] == 2.0  # (3.0-2.0) + (4.0-3.0)
+    assert labels["Page header"]["hits"] == 2
+
+
+def test_compute_dwell_ranking_sorted_descending_by_seconds():
+    attributed = [
+        (0.0, "footer"), (1.0, "footer"), (2.0, "header"), (2.5, None),
+    ]
+    ranking = analysis.compute_dwell_ranking(attributed)
+    assert ranking[0]["label"] == "Page footer"
+    assert ranking[0]["seconds"] >= ranking[1]["seconds"]
+
+
+def test_compute_dwell_ranking_pct_sums_to_roughly_100():
+    attributed = [(0.0, "header"), (1.0, "footer"), (2.0, None)]
+    ranking = analysis.compute_dwell_ranking(attributed)
+    assert abs(sum(r["pct"] for r in ranking) - 100.0) < 0.5
+
+
+# --- summarize_mouse ---------------------------------------------------
+
+def test_summarize_mouse_no_file(tmp_path):
+    summary = analysis.summarize_mouse(str(tmp_path))
+    assert summary["click_count"] == 0
+    assert summary["interests"] == []
+    assert summary["trail_points"] == 0
+    assert summary["heatmap_points"] == 0
+
+
+def test_summarize_mouse_aggregates_dwell_and_clicks(tmp_path):
+    _write_jsonl(tmp_path / "mouse_log.jsonl", [
+        {"type": "mouse_batch", "dwell": [{"element": "header", "duration": 1000}],
+         "click": [{"timestamp": "2026-01-01T00:00:01"}], "trail": [1, 2], "heatmap": [1]},
+        {"type": "mouse_batch", "dwell": [{"element": "header", "duration": 500}],
+         "click": [{"timestamp": "2026-01-01T00:00:00"}], "trail": [1], "heatmap": []},
+    ])
+    summary = analysis.summarize_mouse(str(tmp_path))
+    assert summary["click_count"] == 2
+    assert summary["trail_points"] == 3
+    assert summary["heatmap_points"] == 1
+    assert summary["interests"][0]["element"] == "header"
+    assert summary["interests"][0]["seconds"] == 1.5  # (1000+500)ms -> 1.5s
+    # clicks sorted ascending by timestamp
+    assert summary["clicks"][0]["timestamp"] == "2026-01-01T00:00:00"
+
+
+def test_summarize_mouse_caps_clicks_at_fifty(tmp_path):
+    clicks = [{"timestamp": f"2026-01-01T00:{i:02d}:00"} for i in range(60)]
+    _write_jsonl(tmp_path / "mouse_log.jsonl", [
+        {"type": "mouse_batch", "dwell": [], "click": clicks, "trail": [], "heatmap": []},
+    ])
+    summary = analysis.summarize_mouse(str(tmp_path))
+    assert summary["click_count"] == 60
+    assert len(summary["clicks"]) == 50

tests/test_auth.py

@@ -0,0 +1,122 @@
+"""
+Unit tests for auth.py — pure/stdlib-only, no camera or webview needed.
+Every test gets its own tmp_path as data_dir, so nothing here touches the
+real users.json on disk.
+"""
+
+import os
+
+import pytest
+
+import auth
+
+
+# --- password hashing -------------------------------------------------------
+
+def test_hash_password_generates_random_salt():
+    salt1, hash1 = auth._hash_password("hunter2")
+    salt2, hash2 = auth._hash_password("hunter2")
+    assert salt1 != salt2
+    assert hash1 != hash2  # different salt -> different hash for the same password
+
+
+def test_hash_password_reproducible_with_given_salt():
+    salt, hash1 = auth._hash_password("hunter2")
+    _, hash2 = auth._hash_password("hunter2", salt=salt)
+    assert hash1 == hash2
+
+
+def test_verify_password_accepts_correct_password():
+    salt, hash_hex = auth._hash_password("correct horse battery staple")
+    assert auth.verify_password("correct horse battery staple", salt, hash_hex) is True
+
+
+def test_verify_password_rejects_wrong_password():
+    salt, hash_hex = auth._hash_password("correct horse battery staple")
+    assert auth.verify_password("wrong password", salt, hash_hex) is False
+
+
+# --- create_user validation --------------------------------------------------
+
+def test_create_user_rejects_empty_name(tmp_path):
+    with pytest.raises(auth.AuthError):
+        auth.create_user(str(tmp_path), "", "a@b.com", "password123")
+
+
+def test_create_user_rejects_invalid_email(tmp_path):
+    with pytest.raises(auth.AuthError):
+        auth.create_user(str(tmp_path), "Aman", "not-an-email", "password123")
+
+
+def test_create_user_rejects_short_password(tmp_path):
+    with pytest.raises(auth.AuthError):
+        auth.create_user(str(tmp_path), "Aman", "a@b.com", "short")
+
+
+def test_create_user_rejects_duplicate_email_case_insensitive(tmp_path):
+    auth.create_user(str(tmp_path), "Aman", "Aman@Example.com", "password123")
+    with pytest.raises(auth.AuthError):
+        auth.create_user(str(tmp_path), "Someone Else", "aman@example.com", "different123")
+
+
+def test_create_user_returns_public_profile_without_secrets(tmp_path):
+    profile = auth.create_user(str(tmp_path), "Aman", "aman@example.com", "password123")
+    assert profile["name"] == "Aman"
+    assert profile["email"] == "aman@example.com"
+    assert "salt" not in profile
+    assert "hash" not in profile
+    assert "id" in profile
+    assert profile["avatar"] == "A"
+
+
+def test_create_user_persists_across_loads(tmp_path):
+    auth.create_user(str(tmp_path), "Aman", "aman@example.com", "password123")
+    users = auth.load_users(str(tmp_path))
+    assert len(users) == 1
+    record = next(iter(users.values()))
+    assert record["email"] == "aman@example.com"
+    assert "hash" in record  # stored on disk, just never returned to callers
+
+
+# --- login --------------------------------------------------------------
+
+def test_verify_login_succeeds_with_correct_password(tmp_path):
+    created = auth.create_user(str(tmp_path), "Aman", "aman@example.com", "password123")
+    profile = auth.verify_login(str(tmp_path), created["id"], "password123")
+    assert profile["id"] == created["id"]
+
+
+def test_verify_login_fails_with_wrong_password(tmp_path):
+    created = auth.create_user(str(tmp_path), "Aman", "aman@example.com", "password123")
+    with pytest.raises(auth.AuthError):
+        auth.verify_login(str(tmp_path), created["id"], "wrong-password")
+
+
+def test_verify_login_fails_for_unknown_user_id(tmp_path):
+    with pytest.raises(auth.AuthError):
+        auth.verify_login(str(tmp_path), "does-not-exist", "whatever")
+
+
+def test_verify_login_fails_for_empty_password(tmp_path):
+    created = auth.create_user(str(tmp_path), "Aman", "aman@example.com", "password123")
+    with pytest.raises(auth.AuthError):
+        auth.verify_login(str(tmp_path), created["id"], "")
+
+
+# --- list_profiles / user_dir ------------------------------------------------
+
+def test_list_profiles_sorted_by_name_and_excludes_secrets(tmp_path):
+    auth.create_user(str(tmp_path), "Zara", "zara@example.com", "password123")
+    auth.create_user(str(tmp_path), "Aman", "aman@example.com", "password123")
+    profiles = auth.list_profiles(str(tmp_path))
+    assert [p["name"] for p in profiles] == ["Aman", "Zara"]
+    assert all("salt" not in p and "hash" not in p for p in profiles)
+
+
+def test_list_profiles_empty_when_no_users_file(tmp_path):
+    assert auth.list_profiles(str(tmp_path)) == []
+
+
+def test_user_dir_is_nested_under_users(tmp_path):
+    path = auth.user_dir(str(tmp_path), "abc123")
+    assert path == os.path.join(str(tmp_path), "users", "abc123")

tests/test_participants.py

@@ -0,0 +1,139 @@
+"""
+Unit tests for participants.py — pure/stdlib-only, no camera or webview
+needed. Every test gets its own tmp_path as owner_dir.
+"""
+
+import os
+
+import pytest
+
+import participants
+
+
+# --- create_participant -------------------------------------------------
+
+def test_create_participant_rejects_empty_name(tmp_path):
+    with pytest.raises(participants.ParticipantError):
+        participants.create_participant(str(tmp_path), "   ")
+
+
+def test_create_participant_returns_expected_fields(tmp_path):
+    record = participants.create_participant(str(tmp_path), "Rahul", "left-handed")
+    assert record["name"] == "Rahul"
+    assert record["notes"] == "left-handed"
+    assert record["session_count"] == 0
+    assert record["last_session_at"] is None
+    assert "id" in record and "created_at" in record
+
+
+def test_create_participant_strips_whitespace(tmp_path):
+    record = participants.create_participant(str(tmp_path), "  Rahul  ", "  notes  ")
+    assert record["name"] == "Rahul"
+    assert record["notes"] == "notes"
+
+
+def test_create_participant_persists_to_disk(tmp_path):
+    record = participants.create_participant(str(tmp_path), "Rahul")
+    profile_path = os.path.join(str(tmp_path), "participants", record["id"], "profile.json")
+    assert os.path.exists(profile_path)
+
+
+# --- get_participant / list_participants ---------------------------------
+
+def test_get_participant_returns_none_for_missing(tmp_path):
+    assert participants.get_participant(str(tmp_path), "does-not-exist") is None
+
+
+def test_get_participant_returns_none_for_falsy_id(tmp_path):
+    assert participants.get_participant(str(tmp_path), "") is None
+    assert participants.get_participant(str(tmp_path), None) is None
+
+
+def test_get_participant_roundtrips(tmp_path):
+    created = participants.create_participant(str(tmp_path), "Rahul")
+    fetched = participants.get_participant(str(tmp_path), created["id"])
+    assert fetched == created
+
+
+def test_list_participants_sorted_by_name(tmp_path):
+    participants.create_participant(str(tmp_path), "Zara")
+    participants.create_participant(str(tmp_path), "Aman")
+    names = [p["name"] for p in participants.list_participants(str(tmp_path))]
+    assert names == ["Aman", "Zara"]
+
+
+def test_list_participants_empty_when_none_created(tmp_path):
+    assert participants.list_participants(str(tmp_path)) == []
+
+
+# --- update_participant ---------------------------------------------------
+
+def test_update_participant_changes_name_and_notes(tmp_path):
+    created = participants.create_participant(str(tmp_path), "Rahul", "old notes")
+    updated = participants.update_participant(str(tmp_path), created["id"], name="Rahul K", notes="new notes")
+    assert updated["name"] == "Rahul K"
+    assert updated["notes"] == "new notes"
+
+
+def test_update_participant_leaves_untouched_field_when_none(tmp_path):
+    created = participants.create_participant(str(tmp_path), "Rahul", "keep me")
+    updated = participants.update_participant(str(tmp_path), created["id"], name="Rahul K", notes=None)
+    assert updated["name"] == "Rahul K"
+    assert updated["notes"] == "keep me"
+
+
+def test_update_participant_rejects_empty_name(tmp_path):
+    created = participants.create_participant(str(tmp_path), "Rahul")
+    with pytest.raises(participants.ParticipantError):
+        participants.update_participant(str(tmp_path), created["id"], name="   ")
+
+
+def test_update_participant_rejects_missing_participant(tmp_path):
+    with pytest.raises(participants.ParticipantError):
+        participants.update_participant(str(tmp_path), "does-not-exist", name="X")
+
+
+def test_update_participant_preserves_session_stats(tmp_path):
+    created = participants.create_participant(str(tmp_path), "Rahul")
+    participants.touch_session_stats(str(tmp_path), created["id"])
+    updated = participants.update_participant(str(tmp_path), created["id"], name="Rahul K")
+    assert updated["session_count"] == 1
+
+
+# --- delete_participant ---------------------------------------------------
+
+def test_delete_participant_removes_folder(tmp_path):
+    created = participants.create_participant(str(tmp_path), "Rahul")
+    pdir = participants.participant_dir(str(tmp_path), created["id"])
+    assert os.path.isdir(pdir)
+    participants.delete_participant(str(tmp_path), created["id"])
+    assert not os.path.exists(pdir)
+    assert participants.get_participant(str(tmp_path), created["id"]) is None
+
+
+def test_delete_participant_rejects_missing_participant(tmp_path):
+    with pytest.raises(participants.ParticipantError):
+        participants.delete_participant(str(tmp_path), "does-not-exist")
+
+
+def test_delete_participant_rejects_falsy_id(tmp_path):
+    with pytest.raises(participants.ParticipantError):
+        participants.delete_participant(str(tmp_path), "")
+
+
+# --- touch_session_stats ---------------------------------------------------
+
+def test_touch_session_stats_increments_count_and_sets_timestamp(tmp_path):
+    created = participants.create_participant(str(tmp_path), "Rahul")
+    assert created["session_count"] == 0
+    participants.touch_session_stats(str(tmp_path), created["id"])
+    updated = participants.get_participant(str(tmp_path), created["id"])
+    assert updated["session_count"] == 1
+    assert updated["last_session_at"] is not None
+
+
+def test_touch_session_stats_noop_for_missing_participant(tmp_path):
+    # Should not raise -- just silently does nothing, since the caller
+    # (browser_session.py's _write_session_meta) has already committed to
+    # the session by this point and shouldn't crash a session over it.
+    participants.touch_session_stats(str(tmp_path), "does-not-exist")

theme.py

@@ -59,6 +59,11 @@ ICON_PATHS = {
     "menu": '<line x1="4" x2="20" y1="6" y2="6"/><line x1="4" x2="20" y1="12" y2="12"/><line x1="4" x2="20" y1="18" y2="18"/>',
     "bar-chart": '<line x1="12" x2="12" y1="20" y2="10"/><line x1="18" x2="18" y1="20" y2="4"/><line x1="6" x2="6" y1="20" y2="16"/>',
     "trending-up": '<polyline points="22 7 13.5 15.5 8.5 10.5 2 17"/><polyline points="16 7 22 7 22 13"/>',
+    "user": '<path d="M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/>',
+    "users": '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',
+    "log-out": '<path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/><polyline points="16 17 21 12 16 7"/><line x1="21" x2="9" y1="12" y2="12"/>',
+    "more-vertical": '<circle cx="12" cy="12" r="1"/><circle cx="12" cy="5" r="1"/><circle cx="12" cy="19" r="1"/>',
+    "plus": '<path d="M5 12h14"/><path d="M12 5v14"/>',
 }
 
 
@@ -92,51 +97,67 @@ ICONS_JS = (
 
 THEME_CSS = r"""
 :root {
-  --iux-bg: #12131A;
-  --iux-bg-alt: #171923;
-  --iux-surface: #1E2030;
-  --iux-surface-hi: #262940;
-  --iux-border: rgba(148, 138, 179, 0.16);
-  --iux-text: #F1EEFA;
-  --iux-text-dim: #9B95B3;
-  --iux-text-faint: #6E6885;
-
-  --iux-primary: #7C3AED;
-  --iux-primary-light: #8B5CF6;
-  --iux-indigo: #6366F1;
-  --iux-accent-grad: linear-gradient(135deg, #6366F1, #8B5CF6 55%, #C084FC);
-  --iux-cyan: #67E8F9;
-  --iux-lavender: #C4B5FD;
+  --iux-bg: #1B1918;
+  --iux-bg-alt: #221F1D;
+  --iux-surface: #292522;
+  --iux-surface-hi: #332E2A;
+  --iux-border: rgba(198, 188, 178, 0.16);
+  --iux-text: #F9F8F3;
+  --iux-text-dim: #C6BCB2;
+  --iux-text-faint: #8E8E92;
+
+  --iux-primary: #FFE9A8;
+  --iux-primary-light: #FFE9A8;
+  --iux-indigo: #FFE9A8;
+  --iux-accent-grad: #FFE9A8;
+  --iux-cyan: #7FE0C8;
+  --iux-lavender: #FFE9A8;
+  --iux-on-accent: #312F2E;
 
   --iux-success: #34D399;
-  --iux-warning: #FBBF24;
+  --iux-warning: #F59E0B;
   --iux-danger: #FB7185;
   --iux-info: #38BDF8;
 
   --iux-radius-sm: 8px;
   --iux-radius: 14px;
   --iux-radius-lg: 20px;
-  --iux-shadow-sm: 0 2px 10px rgba(0,0,0,0.28);
-  --iux-shadow: 0 10px 34px rgba(10,6,24,0.45);
-  --iux-shadow-glow: 0 0 0 1px rgba(139,92,246,0.35), 0 8px 28px rgba(124,58,237,0.28);
+  --iux-shadow-sm: 0 2px 10px rgba(0,0,0,0.32);
+  --iux-shadow: 0 10px 34px rgba(10,8,4,0.5);
+  --iux-shadow-glow: 0 0 0 1px rgba(198,188,178,0.22), 0 8px 22px rgba(0,0,0,0.35);
   --iux-blur: blur(18px);
   --iux-ease: cubic-bezier(0.22, 1, 0.36, 1);
   --iux-font: -apple-system, BlinkMacSystemFont, 'Inter', 'Segoe UI', 'Manrope', Arial, sans-serif;
+
+  --iux-page-bg:
+    radial-gradient(circle at 18% 10%, color-mix(in srgb, var(--iux-primary-light) 16%, transparent), transparent 42%),
+    radial-gradient(circle at 82% 82%, color-mix(in srgb, var(--iux-indigo) 18%, transparent), transparent 45%),
+    var(--iux-bg);
 }
 
 :root[data-theme="light"] {
-  --iux-bg: #F7F5FB;
-  --iux-bg-alt: #F1EEFA;
-  --iux-surface: #FFFFFF;
-  --iux-surface-hi: #F3F0FA;
-  --iux-border: rgba(99, 79, 150, 0.14);
-  --iux-text: #211D33;
-  --iux-text-dim: #635C7D;
-  --iux-text-faint: #918AA8;
-
-  --iux-shadow-sm: 0 2px 10px rgba(76,60,120,0.08);
-  --iux-shadow: 0 14px 34px rgba(76,60,120,0.14);
-  --iux-shadow-glow: 0 0 0 1px rgba(124,58,237,0.18), 0 8px 24px rgba(124,58,237,0.16);
+  --iux-bg: #FBF7E7;
+  --iux-bg-alt: #F3EBC6;
+  --iux-surface: #F9F8F3;
+  --iux-surface-hi: #E6E7E4;
+  --iux-border: rgba(49, 47, 46, 0.10);
+  --iux-text: #312F2E;
+  --iux-text-dim: #747579;
+  --iux-text-faint: #8E8E92;
+
+  --iux-primary: #D9A400;
+  --iux-primary-light: #D9A400;
+  --iux-indigo: #D9A400;
+  --iux-accent-grad: #D9A400;
+  --iux-lavender: #B8860B;
+
+  --iux-shadow-sm: 0 2px 10px rgba(49,47,46,0.08);
+  --iux-shadow: 0 14px 34px rgba(49,47,46,0.12);
+  --iux-shadow-glow: 0 0 0 1px rgba(49,47,46,0.14), 0 8px 18px rgba(49,47,46,0.10);
+
+  --iux-page-bg:
+    linear-gradient(120deg, #E6E7E4 0%, #F9F8F3 45%, #FBF7E7 75%),
+    radial-gradient(circle at 88% 18%, color-mix(in srgb, #F3EBC6 90%, transparent), transparent 58%);
 }
 
 .iux-icon { display: inline-block; vertical-align: middle; flex-shrink: 0; }
@@ -237,7 +258,7 @@ THEME_TOGGLE_JS = r"""
     try { localStorage.setItem('__iux_prefs__', JSON.stringify(prefs)); } catch (e) {}
   }
   const prefs = readPrefs();
-  const theme = prefs.theme === 'light' ? 'light' : 'dark';
+  const theme = prefs.theme === 'dark' ? 'dark' : 'light';
   document.documentElement.setAttribute('data-theme', theme);
 
   window.insightuxGetPrefs = readPrefs;
@@ -246,7 +267,7 @@ THEME_TOGGLE_JS = r"""
     p[key] = value;
     writePrefs(p);
   };
-  window.insightuxGetTheme = function(){ return readPrefs().theme === 'light' ? 'light' : 'dark'; };
+  window.insightuxGetTheme = function(){ return readPrefs().theme === 'dark' ? 'dark' : 'light'; };
   window.insightuxToggleTheme = function(){
     const next = window.insightuxGetTheme() === 'light' ? 'dark' : 'light';
     document.documentElement.setAttribute('data-theme', next);

validate.py

@@ -43,6 +43,14 @@ else:
     RESOURCE_DIR = os.path.dirname(os.path.abspath(__file__))
     DATA_DIR     = RESOURCE_DIR
 
+# See calibrate.py's identical check — browser_session.py's run_validation()
+# sets this to the active InsightUX profile's own folder so validation reads
+# THAT profile's calibration.pkl, not the global/another profile's. Unset
+# (standalone `python validate.py`) reproduces exactly today's behavior.
+_USER_DATA_DIR = os.environ.get("INSIGHTUX_USER_DATA_DIR")
+if _USER_DATA_DIR:
+    DATA_DIR = _USER_DATA_DIR
+
 from preprocessing.preprocessing_pipeline import (
     create_face_mesh,
     estimate_camera_matrix,
@@ -64,6 +72,14 @@ from inference_pipeline import InsightUXPipeline, GazeAngleSmoother
 ONNX_PATH        = os.path.join(RESOURCE_DIR, "models", "gaze_cnn_v4.onnx")
 CALIBRATION_PATH = os.path.join(DATA_DIR, "calibration.pkl")
 
+# Mirrors calibrate.py's _current_onnx_path()/browser_session.py's
+# _user_onnx_path(): validate against the same model this profile's real
+# tracking would actually use — its own fine-tuned model if it has one,
+# the stock bundled model otherwise.
+_USER_ONNX_OUT_PATH = os.environ.get("INSIGHTUX_USER_ONNX_OUT")
+if _USER_ONNX_OUT_PATH and os.path.exists(_USER_ONNX_OUT_PATH):
+    ONNX_PATH = _USER_ONNX_OUT_PATH
+
 SCREEN_W, SCREEN_H = pyautogui.size()
 PATCH_SOURCE     = "blended"   # MUST match calibrate.py and main_webcam_pipeline.py