@keber/qa-framework 1.4.0-0 → 1.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keber/qa-framework",
-  "version": "1.4.0-0",
+  "version": "1.5.1",
   "description": "Reusable spec-driven QA framework for IDE-agent-assisted automated testing. Installable as an npm package. Provides structure, templates, agent instructions, and optional integrations for Playwright and Azure DevOps.",
   "keywords": [
     "qa",

package/scripts/init.js

@@ -288,7 +288,10 @@ This project uses \`@keber/qa-framework\` v${config.frameworkVersion ?? '1.0.0'}
 5. Read previous test suites code in \`qa/07-automation/e2e/tests/\` if available before writing new automation to maintain consistency in style and approach
 6. Project QA config is at \`qa/qa-framework.config.json\`
 7. Save learnings in \`qa/memory/\` with proper naming and metadata. Always update \`qa/memory/INDEX.md\` after adding or updating any memory file.
-8. **On module/sprint completion** (all TCs passing): (1) update the module status row in \`qa/README.md\`; (2) move the completed sprint checklist from \`AGENT-NEXT-STEPS.md\` to the \`## Sprint History\` section of \`qa/README.md\`; (3) trim \`AGENT-NEXT-STEPS.md\` so it contains only the next sprint — never let it accumulate more than one active sprint.
+8. **Sprint/module completion criteria:** A sprint or module is complete when every TC in scope has one of these three valid states - and no other: (a) \`test()\` passing: the app meets the spec; (b) \`test.fail()\`: the app violates the spec **and** a file \`qa/06-defects/open/DEF-SIS-NNN_*.md\` exists documenting which business rule is violated and what the app actually does; (c) \`test.skip()\`: the TC is not yet executable, annotated with \`PENDING-CODE\` and a linked issue. A sprint is **not** complete if any TC is failing without \`test.fail()\`, or has \`test.fail()\` without a defect file, or has \`test.skip()\` without a \`PENDING-CODE\` reason.
+9. **On sprint/module completion:** (1) update the module status row in \`qa/README.md\`; (2) move the completed sprint checklist from \`AGENT-NEXT-STEPS.md\` to the \`## Sprint History\` section of \`qa/README.md\`; (3) trim \`AGENT-NEXT-STEPS.md\` so it contains only the next sprint — never let it accumulate more than one active sprint.
+10. **Assertion polarity rule (BLOCKING):** A test must assert what the **spec** requires, not what the app currently does. If the app fails to meet the spec, use \`test.fail()\` + correct assertion to document the defect — **never invert or weaken an assertion to make a test go green.** A failing test that exposes a real defect is always more valuable than a passing test that hides one.
+11. **Character encoding safety (BLOCKING):** In ALL generated content (markdown, scripts, test titles, ADO fields, config files), never use characters at these Unicode code points: em-dash (U+2014), en-dash (U+2013), horizontal ellipsis (U+2026), smart/curly quotes (U+201C, U+201D, U+2018, U+2019), or directional arrows (U+2190-U+21FF). Use ASCII equivalents instead: \` - \` (hyphen with surrounding spaces) for dashes, \`...\` for ellipsis, \`"\` and \`'\` for quotes, \`->\` and \`<-\` for arrows. Exception: Latin Extended characters (U+00C0-U+024F) are always permitted - this covers Spanish vowels with accents (U+00E0-U+00FA), n with tilde (U+00F1/U+00D1), and u/o with umlaut (U+00FC/U+00DC, U+00F6/U+00D6).
 
 ## Formatting rules for generated content
 1. Generate the output in \`UTF-8\` encoding without BOM (\`UTF-8\`, no signature).

package/skills/qa-automation/SKILL.md

@@ -27,11 +27,38 @@ description: >
 2. `qa/07-automation/playwright.config.ts` — confirm project name maps to submodule tag
 3. `qa/07-automation/fixtures/auth.ts` — identify available auth fixtures
 4. TC list (from test plan or Stage 4) — defines which TCs to automate in this session
+5. `qa/qa-framework.config.json` → screenshotPath, automationRoot
 
 ---
 
 ## Process
 
+### Step 0 — Pre-inspection (MANDATORY before writing any test code)
+
+For every new submodule, run a dedicated inspection script before writing tests.
+**Template**: `references/dom-inspection-template.js` — copy, set the 4 constants at the top, run.
+
+1. Copy `references/dom-inspection-template.js` → `qa/07-automation/_inspect-{submodule}.js`
+2. Set the 4 constants at the top of the script:
+   - `MODULE_ROUTE` — the submodule's URL path (e.g. `'/Users'`, `'/Products/list'`)
+   - `APP_SHELL_SEL` — a selector that confirms the SPA has loaded (nav, sidebar, app shell)
+   - `CREATE_BTN` — regex matching the create/new button label in this app
+   - `BASE_URL` — already read from `process.env.QA_BASE_URL`
+3. Run: `QA_BASE_URL=<env> node _inspect-{submodule}.js`
+4. Paste key findings as a comment block at the **top of the `.spec.ts` file** before writing any test:
+   ```
+   // INSPECTION: {date}
+   // Grid headers: [...]
+   // Create form: inputs[0]=Name(maxLen=100), dd[0]=Category(lazy=true)
+   // Validation msg: "El campo Nombre es obligatorio."
+   // API: POST /api/{Entity} { pageNumber, pageSize }
+   ```
+
+The template covers 5 inspection areas automatically: SPA warmup, list view (grid headers + seed row + buttons), create form (all input types, tabs, validation messages), unauth redirect, and API call interception. Adapt the script for tabs or nested forms by adding steps after the create form section.
+
+**Never skip this step for submodules inside complex forms (tabs, dialogs, nested entities).
+The cost of one inspection run is far lower than 10+ debugging iterations.**
+
 ### Step 1 — Scan for blockers
 
 Before writing a line of code:
@@ -39,13 +66,24 @@ Before writing a line of code:
 - Confirm `playwright.config.ts` exists; scaffold it if missing using `references/config-checklist.md`
 - Verify `fixtures/auth.ts` has the roles required by this submodule
 
+### Step 1b — Decide POM vs inline locators
+
+Create a Page Object in `qa/07-automation/e2e/page-objects/{SubmoduleName}Page.ts` when ANY of these is true:
+- The submodule has a form with 5+ fields (locators will be reused across P0 + P1 suites)
+- The submodule is referenced as a precondition by another submodule (BP, tabs, modals)
+- The submodule requires navigation to 2+ distinct URLs (list + create + edit)
+
+Otherwise, inline locators are acceptable for simple catalog submodules (single URL, < 5 fields).
+
+POM template: `references/pom-template.md`
+
 ### Step 2 — Scaffold spec file
 
 Full spec file template and 7 implementation patterns: `references/patterns.md`
 
 Required scaffold elements:
 - `import { test, expect } from '@playwright/test'`
-- `const EXEC_IDX = process.env.EXEC_IDX ?? '0'` (prevents DB conflicts in parallel runs)
+- `const EXEC_IDX = Math.floor(Date.now() / 60_000) % 100_000` (prevents DB conflicts in parallel runs)
 - `test.describe('{Submodule Name}', () => { ... })`
 - Use fixture-based auth (never hardcode credentials)
 
@@ -66,6 +104,20 @@ For each TC:
 - Locators attached to dynamic data must use `EXEC_IDX` suffix
 - All test data cleared in `afterAll` — never leave residue
 
+### Step 4b — Assertion polarity check (MANDATORY before committing any test)
+
+Every assertion must be verified against the spec, not against the app's 
+observed output.
+
+**Rule**: if the app does X but the spec requires NOT X, use `test.fail()` 
+with the correct assertion — do not adapt the assertion to match the app.
+
+Red flags that require review before proceeding:
+- `expect(X).toBe(false)` where the spec describes a positive condition
+- Assertions with `|| fallback`, `?.`, or `Math.max(a, b)` to avoid zero/falsy
+- Assertions inside an `if (condition)` that only execute on the happy path
+- A test that starts passing after a refactor without a clear spec justification
+
 ### Step 5 — Module Completion Checklist
 
 Before marking the submodule as ✅ Automation Complete:
@@ -84,11 +136,13 @@ Before marking the submodule as ✅ Automation Complete:
 |---|---|
 | `EXEC_IDX` | Any TC that creates persistent data |
 | `auth-fixture` | All authenticated TCs |
-| `fast-fail` | P0 TCs — skip P1+ if P0 fails |
+| `fast-fail` | Element state checks where the default timeout would cause silent hangs |
 | `email-intercept` | Email verification flows |
-| `skip-conditional` | Scenarios blocked by PENDING-CODE |
+| `skip-conditional` | TCs blocked by a known app defect (DEF-xxx) |
 | `beforeAll-setup` | Shared precondition across TC group |
 | `password-env` | Any credential usage |
+| `afterAll-cleanup` | When a test assigns, creates, or modifies persistent data |
+| `debug-screenshots` | beforeAll warmup verification, catch blocks in setup, and inspection scripts |
 
 See `references/patterns.md` for full TypeScript implementations.
 
@@ -97,5 +151,6 @@ See `references/patterns.md` for full TypeScript implementations.
 ## Outputs
 
 - `qa/07-automation/e2e/{module}/{submodule}.spec.ts`
+- `qa/07-automation/e2e/page-objects/{SubmoduleName}Page.ts`  (when POM criteria met)
 - `qa/07-automation/playwright.config.ts` (updated or confirmed)
 - `qa/README.md` automation status updated

package/skills/qa-automation/references/dom-inspection-template.js

@@ -0,0 +1,245 @@
+/**
+ * DOM / API Inspection Script — {SUBMODULE_DISPLAY_NAME}
+ *
+ * Purpose: Capture real UI structure before writing automation specs.
+ *          Run ONCE per submodule. Output drives selector and fixture decisions.
+ *
+ * Usage:
+ *   QA_BASE_URL=https://your-qa-env.example.com node _inspect-{submodule}.js
+ *
+ * Pre-requisites:
+ *   - Valid storageState in .auth/user-default.json  (run global-setup first)
+ *   - playwright installed: npm install @playwright/test
+ *
+ * ─── What to do with the output ─────────────────────────────────────────────
+ * Paste key findings as a comment block at the top of the generated .spec.ts:
+ *
+ *   // INSPECTION: {YYYY-MM-DD}
+ *   // Grid headers: ["Col1", "Col2", ...]
+ *   // Create form: inputs[0]=Name(maxLen=100), dd[0]=Category(lazy=true)
+ *   // Validation msg: "El campo Nombre es obligatorio."
+ *   // API: POST /api/{Entity} { pageNumber, pageSize }
+ *
+ * ── For tabbed/nested forms, add steps after [3] following this pattern: ────
+ *   await page.getByRole('tab', { name: /tab name/i }).click();
+ *   await page.waitForTimeout(1_000);
+ *   // then re-run the inputs/dropdowns/buttons queries inside the panel
+ * ─────────────────────────────────────────────────────────────────────────────
+ */
+
+'use strict';
+
+const { chromium } = require('@playwright/test');
+const path = require('path');
+
+// ── Configuration — edit these 4 constants, leave the rest ───────────────────
+const STATE_FILE    = path.resolve(__dirname, '.auth/user-default.json');
+const BASE_URL      = process.env.QA_BASE_URL || '';
+const MODULE_ROUTE  = '/{EntityRoute}';                          // e.g. '/Users', '/Orders/list'
+const APP_SHELL_SEL = 'nav, [role="navigation"], .sidebar';      // selector that confirms SPA loaded
+const CREATE_BTN    = /new|nuevo|agregar|add/i;                  // regex matching your app's create button
+// ─────────────────────────────────────────────────────────────────────────────
+
+async function run() {
+  if (!BASE_URL) {
+    console.error('ERROR: QA_BASE_URL is not set. Run with: QA_BASE_URL=https://... node _inspect-{submodule}.js');
+    process.exit(1);
+  }
+
+  const browser = await chromium.launch({ headless: true });
+  const ctx     = await browser.newContext({ storageState: STATE_FILE, baseURL: BASE_URL });
+  ctx.setDefaultNavigationTimeout(120_000);
+  const page    = await ctx.newPage();
+
+  console.log('BASE_URL:', BASE_URL);
+  console.log('MODULE_ROUTE:', MODULE_ROUTE);
+
+  // ── 0. Intercept API calls — runs passively throughout the entire session ──
+  const apiCalls = [];
+  page.on('request', req => {
+    try {
+      if (!req.url().includes(new URL(BASE_URL).hostname)) return;
+    } catch { return; }
+    const method = req.method();
+    if (['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
+      apiCalls.push({
+        method,
+        url:  req.url().replace(BASE_URL, ''),
+        body: req.postData()?.substring(0, 200) ?? null,
+      });
+    }
+  });
+
+  // ── 1. SPA / WASM warmup ──────────────────────────────────────────────────
+  console.log('\n[STEP 1] SPA warmup...');
+  await page.goto('/');
+  try {
+    await page.waitForSelector(APP_SHELL_SEL, { timeout: 120_000 });
+    console.log('  App shell visible');
+  } catch {
+    console.log('  App shell not found with selector:', APP_SHELL_SEL);
+    console.log('  Update APP_SHELL_SEL. Body text (200 chars):',
+      await page.$eval('body', b => b.innerText.substring(0, 200)).catch(() => 'N/A'));
+  }
+
+  // ── 2. List view ──────────────────────────────────────────────────────────
+  console.log('\n[STEP 2] List view:', MODULE_ROUTE);
+  await page.goto(MODULE_ROUTE);
+  await page.waitForSelector('[role="columnheader"], th, table', { timeout: 30_000 }).catch(() => null);
+  await page.waitForTimeout(1_500);
+
+  console.log('  URL:', page.url());
+  console.log('  Title:', await page.title());
+
+  const headers = await page.$$eval(
+    '[role="columnheader"], th',
+    ths => ths.map(th => th.innerText.trim()).filter(t => t && t.length < 80)
+  ).catch(() => []);
+  console.log('  Grid headers:', JSON.stringify(headers));
+
+  const firstRow = await page.$$eval(
+    'table tbody tr:first-child td',
+    tds => tds.map(td => td.innerText.trim()).filter(t => t).slice(0, 8)
+  ).catch(() => []);
+  console.log('  First row (seed data):', JSON.stringify(firstRow));
+
+  const allBtns = await page.$$eval(
+    'button',
+    btns => [...new Set(btns.map(b => b.innerText.trim()).filter(t => t && t.length < 60))]
+  ).catch(() => []);
+  console.log('  Buttons on list page:', JSON.stringify(allBtns));
+
+  // ── 3. Create form ────────────────────────────────────────────────────────
+  console.log('\n[STEP 3] Create form...');
+  const newBtn = page.getByRole('button', { name: CREATE_BTN });
+  const newBtnVisible = await newBtn.isVisible({ timeout: 5_000 }).catch(() => false);
+
+  if (newBtnVisible) {
+    await newBtn.click();
+    await page.waitForLoadState('domcontentloaded');
+    await page.waitForTimeout(2_000);
+    console.log('  Form URL:', page.url());
+
+    // Text inputs (all types)
+    const textInputs = await page.$$eval(
+      'input[type="text"], input[type="email"], input[type="number"], input[type="date"], textarea',
+      inps => inps.map((inp, i) => ({
+        nth:         i,
+        type:        inp.type,
+        placeholder: inp.placeholder || null,
+        maxLength:   inp.maxLength > 0 ? inp.maxLength : null,
+        required:    inp.required,
+        disabled:    inp.disabled,
+        name:        inp.name || inp.id || null,
+      }))
+    ).catch(() => []);
+    console.log('\n  Text inputs:', JSON.stringify(textInputs, null, 2));
+
+    // Native <select> elements
+    const selects = await page.$$eval(
+      'select',
+      sels => sels.map((sel, i) => ({
+        nth:      i,
+        name:     sel.name || sel.id || null,
+        required: sel.required,
+        disabled: sel.disabled,
+        options:  Array.from(sel.options).map(o => o.text).slice(0, 15),
+      }))
+    ).catch(() => []);
+    console.log('  <select> elements:', JSON.stringify(selects, null, 2));
+
+    // Custom dropdowns — uses ARIA roles (framework-agnostic)
+    const customDDs = await page.$$eval(
+      '[role="combobox"], [role="listbox"], [aria-haspopup="listbox"]',
+      dds => dds.map((dd, i) => ({
+        nth:      i,
+        role:     dd.getAttribute('role'),
+        text:     dd.innerText.trim().substring(0, 80),
+        disabled: dd.getAttribute('aria-disabled') === 'true',
+        expanded: dd.getAttribute('aria-expanded') === 'true',
+      }))
+    ).catch(() => []);
+    console.log('  Custom dropdowns (ARIA):', JSON.stringify(customDDs, null, 2));
+
+    // Checkboxes and radio buttons
+    const checkboxes = await page.$$eval(
+      'input[type="checkbox"], input[type="radio"]',
+      els => els.map((el, i) => ({
+        nth:     i,
+        type:    el.type,
+        checked: el.checked,
+        name:    el.name || el.id || null,
+        label:   el.labels?.[0]?.innerText?.trim() ?? null,
+      }))
+    ).catch(() => []);
+    console.log('  Checkboxes/radios:', JSON.stringify(checkboxes, null, 2));
+
+    // Tabs (if the form is tabbed)
+    const tabs = await page.$$eval(
+      '[role="tab"]',
+      tabs => tabs.map((t, i) => ({ nth: i, text: t.innerText.trim() }))
+    ).catch(() => []);
+    if (tabs.length > 0) console.log('  Tabs:', JSON.stringify(tabs));
+
+    // Validation — submit empty form to capture required-field messages
+    const saveBtn = page.getByRole('button', { name: /guardar|save|submit|crear|create/i }).first();
+    if (await saveBtn.isVisible({ timeout: 3_000 }).catch(() => false)) {
+      await saveBtn.click();
+      await page.waitForTimeout(1_500);
+      const msgs = await page.$$eval(
+        '[class*="validation"], [class*="error"], [class*="invalid"], [aria-live="polite"], [aria-live="assertive"]',
+        els => els.map(el => el.innerText.trim()).filter(t => t && t.length < 200)
+      ).catch(() => []);
+      console.log('\n  Validation messages (empty submit):', JSON.stringify(msgs));
+    }
+
+    // ── ADD EXTRA STEPS HERE for tabbed/nested forms ──────────────────────
+    // Example — inspect a specific tab:
+    //   await page.getByRole('tab', { name: /identif/i }).click();
+    //   await page.waitForTimeout(1_000);
+    //   const tabDDs = await page.locator('[role="tab"][aria-selected="true"] + ... .rz-dropdown')...
+    // ─────────────────────────────────────────────────────────────────────
+
+  } else {
+    console.log('  Create button NOT found. Searched for:', CREATE_BTN.toString());
+    console.log('  Buttons visible:', allBtns);
+  }
+
+  // ── 4. Unauth redirect check ──────────────────────────────────────────────
+  console.log('\n[STEP 4] Unauth redirect check...');
+  const page2 = await ctx.newPage();
+  await page2.goto('/');
+  await page2.evaluate(() => {
+    localStorage.clear();
+    sessionStorage.clear();
+  });
+  await page2.reload({ waitUntil: 'domcontentloaded' });
+  await page2.goto(MODULE_ROUTE);
+  await page2.waitForTimeout(3_000);
+  const loginVisible = await page2.locator(
+    'input[type="password"], [id*="login"], form[action*="login"]'
+  ).first().isVisible({ timeout: 5_000 }).catch(() => false);
+  console.log('  Login form visible without auth:', loginVisible);
+  console.log('  URL after clearing session:', page2.url());
+  await page2.close();
+
+  // ── 5. API calls summary ──────────────────────────────────────────────────
+  console.log('\n[STEP 5] API calls captured during session:');
+  const unique = [...new Map(apiCalls.map(c => [`${c.method} ${c.url}`, c])).values()];
+  if (unique.length === 0) {
+    console.log('  (none captured — app may use WASM-level data, not REST calls)');
+  } else {
+    unique.forEach(c => {
+      console.log(`  ${c.method} ${c.url}`);
+      if (c.body) console.log(`    body: ${c.body}`);
+    });
+  }
+
+  await browser.close();
+  console.log('\n[DONE] Paste key findings into a comment block at the top of the .spec.ts file.');
+}
+
+run().catch(err => {
+  console.error('FATAL:', err);
+  process.exit(1);
+});

package/skills/qa-automation/references/patterns.md

@@ -165,6 +165,58 @@ await page.evaluate(
 
 ---
 
+## Pattern 8: afterAll Cleanup for Data-Mutating Tests
+
+When a test assigns, creates, or modifies persistent data (e.g., assigning a role, linking a record),
+always implement `afterAll` cleanup — otherwise the second run finds a different state and fails.
+
+```typescript
+afterAll(async () => {
+  // Restore fixture to pre-test state via direct API call
+  const token = await getFixtureToken(); // from storageState
+  const resp = await fetch(`${API_BASE}/api/{Entity}/Edit`, {
+    method: 'PUT',
+    headers: { 'Authorization': Bearer ${token}, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ /* original state without the assigned record */ }),
+  });
+  console.log(`[afterAll] Cleanup: ${resp.status}`);
+});
+```
+
+Rule: if beforeAll sets up a fixture by reading state from the API, afterAll must restore that same state.
+Design cleanup from the start — retrofitting it costs as many runs as the test itself.
+
+---
+
+### Pattern 9: Debug Screenshots — Path-bound Artifacts
+
+Screenshots MUST always be saved to `agentSettings.screenshotPath` defined in `qa/qa-framework.config.json`. Never save to the workspace root or any ad-hoc path.
+
+```typescript
+// Read screenshotPath from config or use default
+const DIAG_DIR = 'qa/07-automation/e2e/diagnosis';
+
+// On test failure — capture state for diagnosis:
+await page.screenshot({ path: `${DIAG_DIR}/${SUBMODULE}-${tcId}-fail-${Date.now()}.png` });
+
+// In beforeAll for warm-up verification:
+await page.screenshot({ path: `${DIAG_DIR}/{submodule}-warmup.png` });
+
+// In inspection scripts (_inspect-*.js) — always use the same dir:
+await page.screenshot({ path: `${DIAG_DIR}/_inspect-${SUBMODULE}.png`, fullPage: true });
+```
+
+Naming convention: {submodule}-{context}-{optional-timestamp}.png
+When to capture:
+
+* End of beforeAll warmup — confirms the app state before tests run
+* Inside catch blocks in beforeAll/beforeEach — documents the failure condition
+* Inside inspection scripts — captures the rendered UI state at each navigation step
+* Never inside individual test() bodies — Playwright's built-in trace (--trace on) already captures this
+* Enforcement: The diagnosis/ folder is gitignored. Screenshots are local-only artifacts, never committed to the repo.
+
+---
+
 ## Coverage Mapping Template
 
 Create `COVERAGE-MAPPING.md` in the test directory after automation is complete:

package/skills/qa-test-stabilization/SKILL.md

@@ -52,7 +52,9 @@ Category summary:
 - **F — Network dependency**: external call not mocked; add mock or skip
 - **G — Environment**: missing env var or wrong base URL; fix config
 - **H — CI environment**: OS/browser difference; add retry or tag as `@ci-skip`
-- **I — Logic error**: test assertion is wrong; fix assertion to match spec
+- **I — Logic error**: test assertion does not match the spec; fix assertion 
+  to match spec — **not** to match wrong app behavior. If the app is at fault, 
+  use `test.fail()` instead of correcting the assertion direction.
 
 ### Step 3 — Apply fixes in priority order
 
@@ -64,6 +66,14 @@ For each fix:
 3. Re-run the full describe block to verify no regression
 4. Note confidence score (0-100) for each fix
 
+**Category I special rule — assertion polarity:**  
+Before flipping or weakening an assertion, confirm its direction against the 
+spec. If the spec says the condition should hold and the app violates it → 
+the original assertion was *correct* and the app is broken → use `test.fail()` 
++ open a defect. Do NOT invert the assertion.  
+A test flipped from failing to passing by inverting its assertion is masking 
+a defect - which is worse than a failing test.
+
 ### Step 4 — Confidence scoring
 
 Calculate composite confidence:

package/skills/qa-test-stabilization/references/classification-protocol.md

@@ -58,6 +58,25 @@ await expect(page.locator('.toast')).toHaveText('TEXTO_QUE_NO_EXISTE');
 
 ---
 
+### Persistence check (for tests that write data)
+
+For tests that create, update, or delete records: do not rely solely on a success toast.
+Verify persistence with a follow-up API call or page reload:
+
+```typescript
+// After clicking Guardar:
+await expect(page.locator('.toast')).toHaveText('Guardado exitosamente');
+// Verify via API — a passing toast is a false positive if the save failed silently
+const resp = await page.request.get(`${API_BASE}/api/{Entity}/{id}`);
+const data = await resp.json();
+expect(data.fieldChanged).toBe(expectedValue);
+```
+
+A test that only checks the UI toast is Category B (Wrong assertion) if the spec requires
+verifying the change was persisted.
+
+---
+
 ## Confidence Scoring
 
 | Level | Criteria |