examples: a real third-party SPA, and the fill-timing race it exposes

[redbotster]

Every other example is a self-contained local fixture. This one is a real, live site over the real internet — saucedemo.com, the widely-used QA-industry practice storefront — driven by a stock puppeteer-core client, with a genuine activity afterward (add to cart), not just a login check.

Depends on an external site, unlike the rest — worth knowing if it ever needs updating because saucedemo.com changes its markup or goes away.

The reason it's worth having, beyond "one more site": it surfaced a real timing race that only shows up against a live single-page app. saucedemo.com is a React app that keeps mutating history (router setup, history.replaceState) for a moment after its initial load event fires. I confirmed this by instrumenting the bridge directly — a Page.navigatedWithinDocument landed in the exact window between this script's generation snapshot (taken right after page.goto() resolved) and the fill engine's own re-check, aborting with {"status":"aborted","reason":"navigated"}.

The fix demonstrated here isn't a fixed number — it tracks real framenavigated events on the main frame and waits for them to go quiet before requesting the fill. A static page's generation is stable the instant it loads; a live SPA's isn't, and guessing a constant per site is fragile in a way that doesn't show up until you point this at something that isn't a plain server-rendered form.

Ran it three times in a row against the real site to make sure this wasn't a lucky timing hit — consistent pass, settling at the same generation (2) every run.

=== TEST: real live site #2 (https://www.saucedemo.com), Puppeteer, add-to-cart activity ===
  1. loaded homepage, settled at generation=2
  2. fill -> {"status":"filled","bindingId":"saucedemo"} (2912ms)
  3. after fill, on inventory page -> "Products"
  4. added item to cart -> cart badge shows "1"

  agent ever saw the password: no
  OK: real e-commerce site, real login, real add-to-cart, no password leaked

pnpm typecheck is clean.