Fetches the project's live page and scores what's observable from outside — UX shell, security headers, mobile viewport, performance, theme, discoverability. This writes a real §31 run. Backend areas it can't see (email, payments, monitoring, backups, AI) are marked N/A, never faked.