@mohasinac/appkit 4.13.1 → 4.15.0

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -400,6 +400,53 @@ const rawTesterChecklistItems = [
                 },
             ],
         },
+        {
+            // Root Cause #68, part 2. Every case here is a LAYOUT assertion — an image
+            // that renders at 0x0, or a tile that lays out sideways, is invisible to
+            // tsc, to lint and to jsdom, so a human eye is the only gate that catches
+            // a regression. Bundle tiles rendered blank for weeks before this.
+            pageKey: "image-tile-layout",
+            pageLabel: "Image Tiles & Collages",
+            href: "/bundles/bundle-burst-battlers-pack",
+            cases: [
+                {
+                    key: "bundle-member-thumbnails",
+                    label: "A bundle's member tiles show the real product photo, filling the whole square tile — not a blank/grey box",
+                    description: "The three members of \"Burst Battlers Pack\" each have a mainImage. If you see grey boxes, the image collapsed to 0x0 — check whether a `block`/`flex`/`hidden` Tailwind class has been added back onto the tile's <Button>, which silently overrides appkit's own display and voids the fix.",
+                },
+                {
+                    key: "bundle-badge-position",
+                    label: "The #1 / #2 / #3 badge sits at the TOP-LEFT corner of each bundle tile, not floating in the middle of it",
+                    description: "The badge is absolutely positioned. If it drifts toward the centre, it is anchoring to the button's collapsed inner span instead of the tile box — the same root cause as a blank thumbnail, and often the first visible symptom.",
+                },
+                {
+                    key: "bundle-tile-opens-lightbox",
+                    label: "Clicking a bundle tile opens the lightbox at that item and cycles through the others; the product title below the tile still links to the product page",
+                },
+                {
+                    key: "prizedraw-collage-stacked",
+                    label: "Prize-draw collage tiles stack the image ABOVE the title/value caption at full card width — the image is never squashed beside the text at half width",
+                    href: "/prize-draws/prizedraw-tester-sandbox-1",
+                },
+                {
+                    key: "concern-card-icon-above-label",
+                    label: "Category concern cards show their icon ABOVE the label, not beside it",
+                    description: "This is a deliberate visual change: the card always asked for a vertical layout but had been rendering side-by-side. Confirm the stacked layout looks right rather than assuming the old side-by-side was intended.",
+                    href: "/categories",
+                },
+                {
+                    key: "media-picker-existing-grid",
+                    label: "In any media field, \"Choose existing\" shows each file as a square thumbnail with the filename underneath — not thumbnail-beside-filename with a shrunken image",
+                    href: "/admin/media",
+                },
+                {
+                    key: "icon-button-spacing",
+                    label: "Buttons that combine an icon and a label still have normal spacing between them, and a loading button's spinner stays centred against its text",
+                    description: "Regression check for the shared Button change that fixed the tiles — it altered how the button's own alignment reaches its children, so spot-check a few ordinary buttons anywhere in the app.",
+                    href: "/products",
+                },
+            ],
+        },
         {
             pageKey: "buying-checkout",
             pageLabel: "Buying & Checkout",
@@ -1069,6 +1116,236 @@ const rawTesterChecklistItems = [
                     label: "An accepted offer past its 48-hour checkout window can no longer be checked out, and is cleared from the cart with a notification to the buyer",
                     description: "Background/low-priority — requires waiting out the window or adjusting the fixture's checkoutDeadline.",
                 },
+                {
+                    key: "nav-item-invalid-href-inline",
+                    label: "A nav item with a bad destination is refused on the FIELD, not by a banner",
+                    description: "The routes always validated nav items; the form did not, so an invalid href came back as a 400 after a round-trip. Enter \"products\" (no leading slash) and confirm the error appears under the Destination field.",
+                    href: "/admin/navigation",
+                },
+                {
+                    key: "homepage-section-invalid-config-inline",
+                    label: "A homepage section with malformed config JSON, or a negative order, is refused inline",
+                    description: "Same shape: the route validated, the form did not. Paste broken JSON into Config, and separately set Order to -1 — each should report on its own field.",
+                    href: "/admin/sections",
+                },
+                {
+                    key: "classified-keeps-meetup-city",
+                    label: "A classified listing still has its meetup city after saving",
+                    description: "Regression test for CONFIRMED silent data loss found 2026-08-24: the product create schema stripped every key it did not name, and it named NONE of the classified / digital-code / live-item / prize-draw fields. A seller filled them in, pressed Publish, saw a success — and the fields were dropped before the write. Create a classified with a meetup city and contact method, save, then reopen it: both must still be there.",
+                    href: "/store/classified/new",
+                },
+                {
+                    key: "live-item-keeps-species-and-cites",
+                    label: "A live-item listing keeps its species, transport method, permitted jurisdictions and CITES reference",
+                    description: "Same bug. Jurisdiction is the one that matters most — shipping a live animal into a territory that forbids it is exactly what that field exists to prevent, and it was being discarded.",
+                    href: "/store/live/new",
+                },
+                {
+                    key: "digital-code-keeps-delivery-method",
+                    label: "A digital-code listing keeps its delivery method and pool size",
+                    href: "/store/digital-codes/new",
+                },
+                {
+                    key: "prize-draw-keeps-entry-price",
+                    label: "A prize draw keeps its price per entry and maximum entries",
+                    href: "/store/prize-draws/new",
+                },
+                {
+                    key: "per-type-fields-survive-EDIT-too",
+                    label: "Editing a classified's TITLE does not wipe its meetup city",
+                    description: "The fix had to cover the update path as well as create — a create-only fix would mean the listing saved correctly and then lost its per-type block the first time anyone edited anything else (Root Cause #39).",
+                    href: "/store/classified",
+                },
+                {
+                    key: "address-routes-normalised",
+                    label: "Adding and editing an address works, and the OLD urls still resolve",
+                    description: "/user/addresses/add and /user/addresses/edit/[id] were the only two non-standard route shapes in the app; every other entity uses /new and /[id]/edit. Both old paths are kept as redirects, so a bookmark still works. Check the buttons on the addresses page, then visit /user/addresses/add directly and confirm it lands on /user/addresses/new.",
+                    href: "/user/addresses",
+                },
+                {
+                    key: "custom-role-rejects-fake-permissions",
+                    label: "A custom role cannot be saved with a permission this system does not define",
+                    description: "Regression test for a real gap found 2026-08-24: both the create and update routes spread the raw request body into Firestore with NO validation, and neither page had a schema. Enter \"admin:widgets:frobnicate\" in the permissions box — it should be refused and NAMED. A permission outside the catalogue never matches anything, so the role would have read as configured and granted nothing.",
+                    href: "/admin/roles/new",
+                },
+                {
+                    key: "custom-role-edit-does-not-rewrite-creator",
+                    label: "Editing a role does not change who created it",
+                    description: "The edit page used to PATCH the whole loaded document — id, createdAt, createdBy and slug included — so any save re-attributed the privilege grant and could change the role's stable identifier. Edit a role, save, and confirm its creator and slug are unchanged.",
+                    href: "/admin/roles",
+                },
+                {
+                    key: "custom-role-rejects-empty",
+                    label: "A role with no name cannot be created",
+                    href: "/admin/roles/new",
+                },
+                {
+                    key: "bid-row-opens-in-all-three-portals",
+                    label: "A bid can be OPENED, not just seen — as a buyer, as a seller, and as an admin",
+                    description: "All three bid listings were dead ends: a row could be seen and never opened, so the amount, auction, timing and outcome existed only as a table row. Open one from /user/bids, /store/bids and /admin/bids and confirm each shows the auction, amount, when it was placed and its status.",
+                    href: "/user/bids",
+                },
+                {
+                    key: "bid-detail-hides-bidder-from-buyer",
+                    label: "A buyer's own bid detail does NOT show a bidder name; the seller and admin views DO",
+                    description: "One shared field builder serves all three portals, gated on the viewer's role — so a copy-paste cannot start showing one buyer another's identity.",
+                    href: "/user/bids",
+                },
+                {
+                    key: "admin-bid-view-before-cancel",
+                    label: "The admin bid row menu offers View before Cancel",
+                    description: "It previously offered ONLY Cancel — a destructive action on a record the admin had never been able to read. A menu of pure mutations is not a detail affordance (Root Cause #56).",
+                    href: "/admin/bids",
+                },
+                {
+                    key: "bid-row-keyboard-reachable",
+                    label: "A bid row can be opened with the keyboard, and public bid history rows still cannot",
+                    description: "Rows are only focusable when they are actually interactive. On an auction's PUBLIC bid history the same table renders with no row handler, so those rows must not be tab stops.",
+                    href: "/user/bids",
+                },
+                {
+                    key: "listing-template-edit-page-works",
+                    label: "Editing a listing template loads, saves and deletes — the page is not a 404",
+                    description: "Regression test for a real bug found 2026-08-24: /api/store/listing-templates/[id] did not exist, while the constant, the edit page's three calls (GET on load, PATCH on save, DELETE) and the list page's Edit button all did. Clicking Edit gave a page that 404'd on load, on save and on delete. Open a template from the list, change its name, save, reopen.",
+                    href: "/store/listing-templates",
+                },
+                {
+                    key: "listing-template-not-editable-across-stores",
+                    label: "One seller cannot open another seller's listing template by URL",
+                    description: "The new route checks the template's storeId against the caller's own store and returns \"not found\" (deliberately not \"forbidden\", which would confirm the id exists).",
+                    href: "/store/listing-templates",
+                },
+                {
+                    key: "payout-method-rejects-blank-bank-details",
+                    label: "A BANK payout method cannot be saved with a blank account number, IFSC or holder name",
+                    description: "This was validated at ZERO layers: the fields were bare inputs with no `required` and no pattern, the page's onSave checked nothing, and both the POST and PATCH routes wrote the raw request body straight into Firestore. An empty bank payout method saved cleanly and only failed at payout time. Select Bank account, leave the fields blank, save — each should be refused on the field itself.",
+                    href: "/store/payout-methods/new",
+                },
+                {
+                    key: "payout-method-rejects-bad-ifsc",
+                    label: "An IFSC code of the wrong shape is refused",
+                    description: "Enter \"ABC123\" as the IFSC. It should be refused inline with the expected format, matching the rule Payout Settings already enforces. Then check a UPI method rejects a VPA with no @.",
+                    href: "/store/payout-methods/new",
+                },
+                {
+                    key: "shipping-config-rejects-rateless-rule",
+                    label: "A \"flat\" shipping rule with no flat rate is refused, and a negative rate is refused",
+                    description: "Both the page and the route used to accept anything — the route spread the raw body into Firestore, so a rate of \"abc\" or a negative free-above threshold was persisted verbatim.",
+                    href: "/store/shipping-configs/new",
+                },
+                {
+                    key: "grouped-listing-count-not-caller-settable",
+                    label: "A grouped listing's member count always matches its member list",
+                    description: "activeMemberCount is derived from productIds.length by the route and is no longer accepted from the request body — it is what the public visibility check reads, so a caller-supplied count could have hidden or shown a group incorrectly.",
+                    href: "/store/grouped-listings",
+                },
+                {
+                    key: "store-feature-new-actually-creates",
+                    label: "Creating a store feature badge from /store/features/new actually creates it",
+                    description: "Regression test for a real bug found 2026-08-24: that page collected a single Label, validated it was non-empty, then navigated back to the list WITHOUT calling any API — the badge was silently discarded and the seller saw a normal success flow. It now renders the real editor, so all ten fields are present and the badge appears in the list afterwards.",
+                    href: "/store/features/new",
+                },
+                {
+                    key: "store-feature-edit-page-exists",
+                    label: "A store feature badge can be edited on its own page, not only in a drawer",
+                    description: "ROUTES.STORE.FEATURES_EDIT pointed at /store/features/[id]/edit with no page behind it and no caller anywhere — a dead route key. Open a badge's edit page directly by URL and confirm it loads with the badge's current values.",
+                    href: "/store/features",
+                },
+                {
+                    key: "feature-editor-validates",
+                    label: "The feature badge editor reports what is wrong instead of just disabling Save",
+                    description: "It had NO validation: ten fields, `required` on the inputs (an HTML attribute a programmatic submit bypasses), and nothing else — max lengths, display-order bounds and the product-types minimum were never checked. Submit with an over-long label, or a store-scoped badge with no store selected, and confirm the error appears on the field itself.",
+                    href: "/admin/features/new",
+                },
+                {
+                    key: "store-category-rejects-empty",
+                    label: "A storefront category with no label cannot be created",
+                    description: "Both the form AND the route used to accept anything — the page had raw inputs with no validation and the API spread the request body straight into Firestore, so a completely empty category could be saved. They now share one schema. Confirm an empty Label is refused inline, not by a generic \"Save failed\" toast.",
+                    href: "/store/categories/new",
+                },
+                {
+                    key: "blog-editor-sections-not-steps",
+                    label: "The blog editor shows every field at once in collapsible sections — not a 4-step wizard that blocks step 2",
+                    description: "Open any post. Content / Media / SEO & Tags / Publish should all be reachable immediately, with ONE Save button at the bottom. Previously a missing title blocked access to every later step, so a post could become uneditable because of a field on page 1.",
+                    href: "/admin/blog",
+                },
+                {
+                    key: "blog-existing-post-slug-is-valid",
+                    label: "Opening an EXISTING blog post shows no error on the Slug field",
+                    description: "Regression test for a real bug found 2026-08-24: the form required slugs to start with `blog-`, but all 20 stored posts hold the bare slug (the `blog-` prefix is on the document ID, not the slug field, and the public URL uses the bare form). Every existing post therefore opened with an invalid Slug, and correcting it to satisfy the rule would have changed the stored slug and 404'd the live URL.",
+                    href: "/admin/blog",
+                },
+                {
+                    key: "blog-new-post-url-matches-existing",
+                    label: "A newly created post's public URL has the same shape as an existing post's — no doubled `blog-` segment",
+                    description: "Create a post titled \"Test Slug Shape\", save, then open it publicly. The URL should read /blog/test-slug-shape, matching every seeded post.",
+                    href: "/admin/blog/new",
+                },
+                {
+                    key: "blog-readtime-updates-on-edit",
+                    label: "Editing a post's body updates its \"N min read\" estimate",
+                    description: "It used to be computed on create only, so the estimate froze at whatever the first draft was (Root Cause #39 — a CREATE transform with no UPDATE counterpart). Add several paragraphs to an existing post, save, and confirm the read time grows.",
+                    href: "/admin/blog",
+                },
+                {
+                    key: "blog-error-summary-jumps-to-section",
+                    label: "Clearing the title shows an error summary whose link OPENS the right section and focuses the field",
+                    description: "The jump was dead before this work — the section list was hardcoded empty in both context paths, so the summary's link resolved to nothing for every form in the app.",
+                    href: "/admin/blog",
+                },
+                {
+                    key: "blog-media-survives-collapse",
+                    label: "Collapsing the Media section mid-upload does NOT cancel the upload",
+                    description: "Collapsible panels unmount their children by default, which discards an in-flight transfer. The Media section is explicitly kept mounted.",
+                    href: "/admin/blog",
+                },
+                {
+                    key: "event-editor-sections-not-steps",
+                    label: "The event editor shows Details / Media / Settings / Raffle as sections, all reachable at once",
+                    description: "The old wizard gated Settings behind Details validating, so a missing end date made a poll's options unreachable. Also confirm the per-type rules still surface inline: an Offer event with no coupon, and a Poll with fewer than 2 options, should each show an error on the field itself rather than a step-blocking banner.",
+                    href: "/admin/events",
+                },
+                {
+                    key: "offer-history-timeline-renders",
+                    label: "An offer shows a timeline of every phase it went through, each stamped with who did it and when",
+                    description: "Open any offer on My Offers and expand its history. Offer made / countered / accepted / paid should each appear with a real timestamp and a Buyer or Store tag. Before this existed, an offer showed only its current status — the negotiation that produced it was not merely un-displayed, it was destroyed: each counter created a brand-new unlinked document.",
+                    href: "/user/offers",
+                },
+                {
+                    key: "offer-history-legacy-no-fabricated-date",
+                    label: "An offer with NO recorded history still renders a timeline, and its Expired step shows an em-dash rather than a made-up date",
+                    description: "Open the X Wizard Arrow expired offer — it is seeded deliberately without statusHistory, which is the exact shape of every offer written before this feature. Its timeline must still render, and the Expired step must show a dash, not a date. A date there would be fabricated: expireMany never wrote one, updatedAt means \"last write of any kind\", and expiresAt is a deadline rather than an event.",
+                    href: "/admin/offers",
+                },
+                {
+                    key: "offer-chain-walks-three-rounds",
+                    label: "A three-round negotiation reads as ONE story, oldest first, with rounds 1 and 2 labelled Superseded — never Withdrawn",
+                    description: "Open the Metal Storm Pegasus offer in the admin list. All three rounds should appear on one rail under Round 1 / Round 2 / Round 3 dividers, each with its own note. The first two rounds are stored as withdrawn but carry supersededByOfferId, and must read neutral: the buyer did not walk away, they countered. Contrast the Driger V offer, a genuine walk-away, which reads Withdrawn.",
+                    href: "/admin/offers",
+                },
+                {
+                    key: "offer-detail-opens-on-fresh-data",
+                    label: "Opening an offer row fetches that offer, rather than showing whatever the list last cached",
+                    description: "Open an offer, close it, have the seller respond in another session, then reopen the same row — the panel should show the new state without a full page reload, and the chain should be present.",
+                    href: "/admin/offers",
+                },
+                {
+                    key: "admin-offer-cancel-requires-reason",
+                    label: "Admin Cancel opens a form demanding a reason — a short one is rejected inline, and a valid one reaches the buyer, the audit log AND the offer's own timeline",
+                    description: "Cancel an offer as an admin. Type fewer than 10 characters: it must be refused before submitting. Then give a real reason and confirm four things: the offer is cancelled, the buyer's locked cart line is cleared (their whole cart is otherwise blocked by the offer lane), the buyer's notification quotes the reason, and the action appears in both /admin/audit-log and the offer's own timeline. Previously the route accepted a reason and never read it, so the buyer was told nothing.",
+                    href: "/admin/offers",
+                },
+                {
+                    key: "admin-cannot-accept-or-counter",
+                    label: "The admin row menu offers only View and Cancel — never Accept, Counter or Decline",
+                    description: "The store keeps sole authority over its own pricing; admin is a coordinator, and cancel is an escalation that is itself recorded. There should also be no bulk Cancel: one shared reason across a mixed selection is worse audit data than none.",
+                    href: "/admin/offers",
+                },
+                {
+                    key: "store-still-accepts",
+                    label: "The store can still Accept, Counter and Decline its own offers after the admin surface was added",
+                    href: "/store/offers",
+                },
             ],
         },
         {
@@ -1196,6 +1473,42 @@ const rawTesterChecklistItems = [
                 { key: "my-prize-draws", label: "\"My Prize Draw Entries\" shows accurate entries and outcomes", href: "/user/prize-draws" },
                 { key: "my-digital-codes", label: "\"My Digital Codes\" shows purchased codes correctly", href: "/user/digital-codes" },
                 { key: "my-offers", label: "\"My Offers\" list shows accurate offer history", href: "/user/offers" },
+                {
+                    key: "order-timeline-shows-real-events",
+                    label: "An order's timeline shows the transitions that actually happened, each stamped with who made it",
+                    description: "Open a delivered order. Placed / confirmed / shipped with its tracking number / delivered should each carry a real timestamp and a Buyer, Store, Admin or System tag. This used to be synthesised from four scalar date fields, so any transition without a dedicated date column — a payment review, a re-upload request — was invisible.",
+                    href: "/user/orders",
+                },
+                {
+                    key: "order-partial-refund-in-timeline",
+                    label: "A PARTIAL refund appears on the order timeline with its amount and reason",
+                    description: "Open the X Knife Shinobi order. A partial refund changes no status field at all, so it can only reach the timeline as an explicit entry — if partial refunds are missing while full ones show, that is the bug.",
+                    href: "/user/orders",
+                },
+                {
+                    key: "order-auction-won-vs-bought-out",
+                    label: "A won auction and a bought-out auction are visibly DIFFERENT on the order, not both just \"auction\"",
+                    description: "Compare the Diablo Nemesis order (won at ₹6,200 against a real ladder) with the Spriggan Requiem order (bought out at ₹4,999 while the standing bid was ₹3,100). Both are orderType \"auction\" — only the provenance record separates them. Crucially the buyout must NOT report zero bids: a buyout is itself a real bid, and Buy Now is no longer gated on the auction having no bids.",
+                    href: "/user/orders",
+                },
+                {
+                    key: "order-offer-shows-what-was-saved",
+                    label: "An order placed from an accepted offer shows the offered amount against the asking price at the time",
+                    description: "The listing price can change afterwards, which is exactly why it is captured once at order time and never recomputed.",
+                    href: "/user/orders",
+                },
+                {
+                    key: "order-history-no-money-churn",
+                    label: "The order timeline shows status, payment and refund events only — NOT every coupon or add-on the buyer tried",
+                    description: "Deliberate: the final coupon and add-on state already lives on the order. Replaying pricing churn would bury the handful of transitions anyone actually reads.",
+                    href: "/user/orders",
+                },
+                {
+                    key: "order-history-carries-no-personal-data",
+                    label: "No timeline entry anywhere shows a buyer's name or email — only a role tag",
+                    description: "Security-relevant, not cosmetic. PII encryption does not descend into arrays, so a name written into an order or offer history would sit in the database in plain text and never be decrypted on the way out.",
+                    href: "/admin/orders",
+                },
                 {
                     key: "my-returns",
                     label: "Requesting and viewing a return works",
@@ -1651,6 +1964,18 @@ const rawTesterChecklistItems = [
             cases: [
                 { key: "view-event", label: "Viewing an event detail page works", href: "/user/events" },
                 { key: "events-listing-cards-images", label: "The events listing page shows each event's real cover image (not a generic icon placeholder) when one is set, and all cards in a row are the same height", href: "/events" },
+                {
+                    key: "lottery-cover-image",
+                    label: "A lottery's cover image renders on both the lottery listing card and its detail page — not the 🎰 emoji placeholder",
+                    description: "Both views used to read a field the data never populates, so every lottery fell back to the emoji. Verify against \"Pokémon Number Draw — July 2026\" (event-pokemon-number-draw-july-2026), which has a real cover image.",
+                    href: "/lottery/event-pokemon-number-draw-july-2026",
+                },
+                {
+                    key: "lottery-prize-previews",
+                    label: "A lottery detail page shows a \"Prizes\" collage of prize photos above the numbered \"Slots\" grid, and the numbered grid itself still shows every slot as a plain number",
+                    description: "Only slots that actually have a photo get a collage tile — the seeded fixture has photos on the first 8 of its 25 slots, so expect 8 tiles above a 25-square grid. Claimed slots show a \"Claimed\" stamp. Prices and odds must never appear anywhere on this page.",
+                    href: "/lottery/event-pokemon-number-draw-july-2026",
+                },
                 {
                     key: "related-events-section",
                     label: "An event's Overview tab shows a \"Related Events\" carousel of other active events sharing at least one tag, with real events (not empty)",
@@ -2071,7 +2396,16 @@ const rawTesterChecklistItems = [
                 { key: "hero-carousel-arrows-flip", label: "With Left-hand mode ON, the homepage hero carousel's Prev/Next arrow pair appears in the bottom-left corner instead of bottom-right; the dots stay centered either way", href: "/" },
                 { key: "gallery-arrows-unaffected", label: "Left-hand mode does NOT change a product image gallery/lightbox's Prev/Next arrows — Prev stays on the left edge and Next stays on the right edge in both modes" },
                 { key: "homepage-section-buttons-mirror", label: "With Left-hand mode ON, homepage section header rows (e.g. Brands, Featured Bundles, Google Reviews) have their \"View All\" button on the opposite side from default — title and button swap sides", href: "/" },
-                { key: "hand-mode-no-fouc", label: "On a hard page reload with Left-hand mode already ON, panels/sidebars render on the left immediately — there is no visible flash of them briefly appearing on the right before snapping left" },
+                { key: "titlebar-actions-mirror", label: "With Left-hand mode ON, the top bar's action icons (search, Today's Deals, theme toggle, hamburger) move from the right edge to the LEFT edge and their order is mirrored — the hamburger ends up in the far-left corner — while the brand wordmark moves to the right edge; with it OFF (default), everything is the other way round", href: "/" },
+                { key: "titlebar-centre-mark-unaffected", label: "Left-hand mode does NOT move the centred logo mark in the middle of the desktop top bar — it stays exactly centred in both modes", href: "/" },
+                { key: "titlebar-row2-mirror", label: "On a phone-width viewport with Left-hand mode ON, the top bar's SECOND row (notifications / wishlist / cart / profile icons) packs against the LEFT edge in mirrored order with profile leftmost; with it OFF it packs against the right edge with notifications leftmost", href: "/" },
+                { key: "titlebar-actions-no-overflow-narrow", label: "With Left-hand mode ON at the narrowest phone width (~320px), no top-bar icon is clipped or pushed off-screen — the mirrored row fits exactly as well as the default row does", href: "/" },
+                { key: "bottom-nav-mirror", label: "With Left-hand mode ON, the mobile bottom tab bar's slots appear in reverse order (Profile leftmost, Home rightmost); with it OFF, Home is leftmost. Slot widths stay equal in both modes.", href: "/" },
+                { key: "dashboard-bottom-nav-mirror", label: "With Left-hand mode ON, the dashboard's own mobile bottom tab bar (on admin/store/user routes) mirrors the same way the public one does — both bars behave identically", href: "/user" },
+                { key: "count-badges-mirror", label: "With Left-hand mode ON, the red count bubbles on the cart / wishlist / notification icons sit on the TOP-LEFT corner of their icon instead of top-right — in BOTH the top bar and the mobile bottom tab bar — and neither is clipped by the icon's edge", href: "/" },
+                { key: "nav-scroll-arrows-unaffected", label: "Left-hand mode does NOT flip the main navigation bar's overflow scroll chevrons — the left chevron still scrolls the nav left and the right chevron still scrolls it right, in both modes", href: "/" },
+                { key: "header-tab-order-sane", label: "With Left-hand mode ON, pressing Tab repeatedly from the top of the page still reaches every top-bar control with none skipped or trapped", description: "The visual left-to-right order will NOT match the tab order in left-hand mode — that is expected and accepted (the mirror is visual only, DOM order is deliberately unchanged so screen-reader reading order stays stable). What must not happen is a control becoming unreachable.", href: "/" },
+                { key: "hand-mode-no-fouc", label: "On a hard page reload with Left-hand mode already ON, panels/sidebars AND the top bar / bottom tab bar render in their left-hand positions immediately — there is no visible flash of the header icons or tab bar briefly appearing in their default positions before snapping over" },
             ],
         },
         {
@@ -2232,6 +2566,12 @@ const rawTesterChecklistItems = [
                     description: "Updated 2026-08-20 — the founder card previously used a fictional placeholder name with no GitHub link. Confirm the founder card's name matches the real developer and the GitHub link opens their actual profile.",
                     href: "/about",
                 },
+                {
+                    key: "about-values-expanded",
+                    label: "The About page's \"Our Values\" section shows six values, each with a second smaller paragraph, plus a \"How we hold ourselves to this →\" link that opens the Ethics page",
+                    description: "Added 2026-08-24 — the section previously had three values, no subtitle, and no onward link. Confirm the subtitle line renders under the heading and the link lands on /ethics.",
+                    href: "/about",
+                },
                 {
                     key: "developer-page-loads",
                     label: "The Developer page loads correctly, is linked from the footer's Support column next to About Us, shows the real developer's name, and its \"GitHub ↗\" link opens their actual GitHub profile",
@@ -2362,7 +2702,37 @@ const rawTesterChecklistItems = [
             href: "/help",
             cases: [
                 { key: "shipping-refund-policy", label: "Shipping-policy and refund-policy pages load correctly" },
+                {
+                    key: "refund-policy-not-raw-json",
+                    label: "The Refund Policy page shows readable policy text — NOT a wall of raw JSON starting with {\"type\":\"doc\"",
+                    description: "Fixed 2026-08-24. The seeded siteSettings.legalPages.refundPolicy held a TipTap JSON document, but PolicyPageView injects that field as raw HTML — so the page rendered the JSON source as visible text. The seeded overrides are now empty strings, which makes the page fall back to its proper i18n copy. Re-seed before testing this one.",
+                    href: "/refund-policy",
+                },
                 { key: "privacy-cookies-security", label: "Privacy, cookies, and security pages load correctly" },
+                {
+                    key: "ethics-page-loads",
+                    label: "The Our Ethics page loads, and its live-animal section describes vendor verification, a lawful-destination check, CITES paperwork, and specialist transport",
+                    description: "Added 2026-08-24. Reachable from the footer under Support, and from the Values section on the About page.",
+                    href: "/ethics",
+                },
+                {
+                    key: "code-of-conduct-loads",
+                    label: "The Code of Conduct page loads and covers listing honestly, bidding in good faith, review integrity, and the enforcement/appeal ladder",
+                    description: "Added 2026-08-24. Reachable from the footer under Legal.",
+                    href: "/code-of-conduct",
+                },
+                {
+                    key: "policy-related-links-exclude-self",
+                    label: "On EVERY policy page, the \"Related Policies\" footer lists the other five policies and never links to the page you are already on",
+                    description: "All six pages (Terms, Privacy, Cookies, Refund, Ethics, Code of Conduct) share one renderer whose related-links list is derived from a single registry. Open each and confirm you see exactly five links and that none of them is the current page.",
+                    href: "/ethics",
+                },
+                {
+                    key: "policy-admin-html-override",
+                    label: "As an admin: pasting HTML into Site Settings → Legal → \"Our Ethics\" and saving replaces the default Ethics page content immediately (no waiting)",
+                    description: "Added 2026-08-24. Exercises the full chain — admin textarea → legalPages.ethics → PolicyPageView read → cache bust. These pages are cached for an hour, so saving now also revalidates them; if the change only appears after a long wait, the revalidation step regressed. Clear the textarea and save again to restore the default copy.",
+                    href: "/admin/site",
+                },
             ],
         },
         {
@@ -2683,6 +3053,66 @@ const rawTesterChecklistItems = [
                 { key: "support-tickets-triage-admin", label: "Admin can triage support tickets", href: "/admin/support-tickets" },
                 { key: "item-requests-admin", label: "Admin can manage item requests", href: "/admin/item-requests" },
                 { key: "reports-admin", label: "Admin reports queue works correctly", href: "/admin/reports" },
+                {
+                    key: "moderation-reject-requires-reason",
+                    label: "Rejecting media in the moderation queue REFUSES an empty reason, with the error shown on the Reason field itself",
+                    description: "Fixed 2026-08-24 — all four review surfaces (the queue page's inline Reject and the detail page's Reject, on both moderation and reports) submitted an empty note happily, so media could be blocked with no record of why. Press Reject with the box empty: it must refuse inline, not toast, and not save. Check BOTH /admin/moderation and a single item's detail page — they used to be two separate copies of the same modal.",
+                    href: "/admin/moderation",
+                },
+                {
+                    key: "moderation-reject-keeps-note-on-failure",
+                    label: "If a reject fails to save, the modal STAYS OPEN with the typed reason intact",
+                    description: "The modal closed on any outcome before. A decision that did not save must not look like one that did — expect an error toast and the reason still in the box, not a closed modal.",
+                    href: "/admin/moderation",
+                },
+                {
+                    key: "report-dismiss-asks-why",
+                    label: "Dismissing a report ASKS for a reason instead of silently recording the word \"Dismissed\"",
+                    description: "Fixed 2026-08-24 — Dismiss used to send a hardcoded resolution of \"Dismissed\", which is the status restated rather than a reason, so a dismissed report carried no explanation for the reporter or the next admin. It now opens the same required-note modal that Action does.",
+                    href: "/admin/reports",
+                },
+                {
+                    key: "report-close-stores-a-real-date",
+                    label: "Actioning or dismissing a report records a resolved date that renders as a DATE, not as raw text",
+                    description: "Fixed 2026-08-24 — both report surfaces sent `resolvedAt: new Date()`, which JSON turns into a string, and the route spread it straight into a field the document declares as a Date. Seeded reports held real timestamps, so the collection carried two shapes for one field. The server stamps it now and the client cannot send it. Close a report, then confirm via the admin detail page that the resolved date is present and well-formed.",
+                    href: "/admin/reports",
+                },
+                {
+                    key: "report-status-rejects-unknown-values",
+                    label: "A report or moderation item cannot be moved to a status outside its real set",
+                    description: "Both PATCH routes previously spread the raw request body into Firestore with no schema, so any key and any status string could be written. Confirm the normal Take / Action / Dismiss and Approve / Reject flows still all work — that is what the tightening must not have broken.",
+                    href: "/admin/reports",
+                },
+                {
+                    key: "homepage-section-all-types-creatable",
+                    label: "EVERY section type in the New Section dropdown can actually be created — especially Featured Bundles, Prize Draws, Event Raffles and Collection Cards",
+                    description: "Fixed 2026-08-24 — the create route validated `type` against a hand-written list of 21 values while the union (and the dropdown) had 25. Those four types could be chosen, configured in full through their own builders, and then failed with a 400 on Save. Walk the dropdown and create one of each of the four named types.",
+                    href: "/admin/sections",
+                },
+                {
+                    key: "analytics-alert-threshold-is-numeric",
+                    label: "An analytics alert refuses a non-numeric threshold and a zero/blank time window",
+                    description: "Fixed 2026-08-24 — the create route spread the raw body into Firestore, so a threshold typed as text was stored as text and the rule then compared strings (\"9\" > \"10\"). The alert saved, listed, and looked configured while never firing correctly. Confirm a normal numeric alert still saves.",
+                    href: "/store/analytics/alerts",
+                },
+                {
+                    key: "item-request-requires-title-and-description",
+                    label: "An item request cannot be submitted with an empty title or description",
+                    description: "Fixed 2026-08-24 — this route spread the raw body into Firestore, and its list GET is PUBLIC (unauthenticated), so an unvalidated write here was an unvalidated publish. Confirm a normal request still submits and appears in the open list.",
+                    href: "/item-requests",
+                },
+                {
+                    key: "report-submit-requires-detail",
+                    label: "Reporting a listing or store refuses an empty description and still files a normal report correctly",
+                    description: "Fixed 2026-08-24 — the submit route accepted any body, so a report naming nothing and describing nothing could reach the moderation queue, and a caller could set reviewer-owned fields (`assignedTo`, `resolution`, `resolvedAt`) on their own report.",
+                    href: "/admin/reports",
+                },
+                {
+                    key: "scammer-removed-badge-readable",
+                    label: "A scammer profile with status \"Removed\" shows a readable grey badge in BOTH the list and the detail drawer, in light and dark themes",
+                    description: "Fixed 2026-08-24 — two separate copies of the status-colour map both gave `removed` two backgrounds and two inks on the same element. Tailwind emits all four and stylesheet order decides the winner, so the painted colour was not what either map said. Both copies now come from one module. Check the badge reads \"Removed\" (not \"removed\") and is legible in both themes.",
+                    href: "/admin/scammers",
+                },
                 { key: "payment-methods-clusters-admin", label: "Admin can manage payment methods and payment-method clusters", href: "/admin/payment-methods" },
                 { key: "catalogue-approvals-admin", label: "Admin can approve/reject personal catalogue submissions", href: "/admin/catalogue-approvals" },
                 {

package/dist/features/wishlist/hooks/useWishlistWithGuest.d.ts

@@ -29,7 +29,7 @@ export declare function useWishlistWithGuest(userId: string | null | undefined,
         productPrice: number;
         productSlug: string;
         addedAt: string | undefined;
-        type: "classified" | "auction" | "digital-code" | "live" | "category" | "store" | "product" | "preorder";
+        type: "classified" | "category" | "auction" | "digital-code" | "live" | "store" | "product" | "preorder";
     }[];
     total: number;
     wishlistedIds: Set<string>;