If `captureRuntimeSnapshotAfterAction` throws (e.g., `describe-ui` transiently fails), the catch block returns `createUiActionFailureResult` even though the batch steps already executed successfully. When `preserveSnapshot` is false, `clearRuntimeSnapshot` has already run at that point, so the caller loses both the old snapshot and receives a misleading failure result for an action that actually completed.

If `captureRuntimeSnapshotAfterAction` throws (e.g., `describe-ui` transiently fails), the catch block returns `createUiActionFailureResult` even though the batch steps already executed successfully. When `preserveSnapshot` is false, `clearRuntimeSnapshot` has already run at that point, so the caller loses both the old snapshot and receives a misleading failure result for an action that actually completed.

If `captureRuntimeSnapshotAfterAction` throws (e.g., `describe-ui` transiently fails), the catch block returns `createUiActionFailureResult` even though the batch steps already executed successfully. When `preserveSnapshot` is false, `clearRuntimeSnapshot` has already run at that point, so the caller loses both the old snapshot and receives a misleading failure result for an action that actually completed.

If `captureRuntimeSnapshotAfterAction` throws (e.g., `describe-ui` transiently fails), the catch block returns `createUiActionFailureResult` even though the batch steps already executed successfully. When `preserveSnapshot` is false, `clearRuntimeSnapshot` has already run at that point, so the caller loses both the old snapshot and receives a misleading failure result for an action that actually completed.

If `captureRuntimeSnapshotAfterAction` throws (e.g., `describe-ui` transiently fails), the catch block returns `createUiActionFailureResult` even though the batch steps already executed successfully. When `preserveSnapshot` is false, `clearRuntimeSnapshot` has already run at that point, so the caller loses both the old snapshot and receives a misleading failure result for an action that actually completed.

If `captureRuntimeSnapshotAfterAction` throws (e.g., `describe-ui` transiently fails), the catch block returns `createUiActionFailureResult` even though the batch steps already executed successfully. When `preserveSnapshot` is false, `clearRuntimeSnapshot` has already run at that point, so the caller loses both the old snapshot and receives a misleading failure result for an action that actually completed.

In `createRuntimeSnapshotNextSteps`, `batchElements` is declared as `const batchElements: typeof tapElements = []` (line 349) and never populated. As a result, `batchElements.length >= 2` is always false, so the 'Batch same-screen taps' next-step branch (lines 391–402) is unreachable. The JSDoc explicitly lists batch as a supported guidance type and the PR introduces batch flow handling, so this looks like an incomplete implementation rather than intentional. Secondary effects: `!batchElements.length` in `shouldPrioritizeScroll` is always true (currently a no-op), and the `batchElements.length >= 2` clause in `hasUsefulRuntimeGuidance` never contributes. Net impact is a silently missing feature, not a runtime error — hence medium severity. Consider either populating `batchElements` by selecting additional same-screen tap candidates from `tapElements`, or removing the dead branches until the batch heuristic is ready.

In `createRuntimeSnapshotNextSteps`, `batchElements` is declared as `const batchElements: typeof tapElements = []` (line 349) and never populated. As a result, `batchElements.length >= 2` is always false, so the 'Batch same-screen taps' next-step branch (lines 391–402) is unreachable. The JSDoc explicitly lists batch as a supported guidance type and the PR introduces batch flow handling, so this looks like an incomplete implementation rather than intentional. Secondary effects: `!batchElements.length` in `shouldPrioritizeScroll` is always true (currently a no-op), and the `batchElements.length >= 2` clause in `hasUsefulRuntimeGuidance` never contributes. Net impact is a silently missing feature, not a runtime error — hence medium severity. Consider either populating `batchElements` by selecting additional same-screen tap candidates from `tapElements`, or removing the dead branches until the batch heuristic is ready.

For every record in `records`, `records.filter(...)` scans all n records, producing an O(n²) build step; for deep AX snapshots with hundreds of elements this can become noticeably slow on each UI action.

For every record in `records`, `records.filter(...)` scans all n records, producing an O(n²) build step; for deep AX snapshots with hundreds of elements this can become noticeably slow on each UI action.

For every record in `records`, `records.filter(...)` scans all n records, producing an O(n²) build step; for deep AX snapshots with hundreds of elements this can become noticeably slow on each UI action.

The pattern `/tab/.test(roleText)` matches any string containing the substring "tab", so accessibility nodes with roles like "AXTable" (normalized to "axtable") will return `'tab'` instead of `'list'`, causing them to gain a `'tap'` action and lose the `'swipeWithin'` action that `deriveActions` grants to `'list'` and `'scroll-view'` roles.