@mohasinac/appkit 4.35.4 → 4.37.0

package/dist/_internal/server/features/site-settings/adapters.d.ts

@@ -37,9 +37,9 @@ import type { PublicSiteSettings } from "../../../shared/features/site-settings/
  * was traced to a call site; anything without one belongs in the private list,
  * because an unused public field is pure attack surface.
  */
-export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark"];
+export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark", "disabledRoutes"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "disabledRoutes", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults", "messaging"];
+export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults", "messaging"];
 export interface ToPublicSiteSettingsOptions {
     /**
      * The resolved marker → wordmark → text watermark chain. Injected because

package/dist/_internal/server/features/site-settings/adapters.js

@@ -13,6 +13,26 @@ export const PUBLIC_SITE_SETTINGS_FIELDS = [
     "actionConfig", // useAuthGate
     "background", // DashboardLayoutClient (background.light / .dark)
     "watermark", // MediaVideo, as the fallback behind effectiveWatermark
+    /*
+     * src/proxy.ts — the admin "disable a nav item and that route 404s" gate.
+     *
+     * 🛑 It was PRIVATE until 2026-09-13, justified by "read by
+     * app/[locale]/layout.tsx (RSC)". That was true once and stopped being true in
+     * Root Cause #82, which moved the gate OUT of the root layout (a dynamic API
+     * there made every page on the site uncacheable) and into the proxy. The
+     * proxy cannot do a Firestore read on the Edge, so it fetches
+     * /api/site-settings over HTTP — where a private field simply does not exist.
+     *
+     * The gate has therefore been a silent no-op ever since: getDisabledRoutes()
+     * reads `body.data.disabledRoutes`, gets undefined, and returns []. It fails
+     * OPEN, so nothing 404s that should not; the admin capability just does
+     * nothing. The stale comment on the private entry was the only trace.
+     *
+     * Publishing it is the right call rather than reverting the move: it is a
+     * list of route paths an admin has switched off, not a secret, and the
+     * alternative is putting a per-request Firestore read back on the Edge.
+     */
+    "disabledRoutes",
 ];
 /** Everything else, with the reason it stays server-side. */
 export const PRIVATE_SITE_SETTINGS_FIELDS = [
@@ -30,7 +50,6 @@ export const PRIVATE_SITE_SETTINGS_FIELDS = [
     "integrations", // analytics/tag IDs are injected server-side into markup, not fetched by the client
     "platformLimits", // server-enforced caps; no client reader
     "auctionConfig", // read by AuctionDetailPageView, a Server Component doing its own settings read
-    "disabledRoutes", // read by app/[locale]/layout.tsx (RSC) to gate routing
     "siteName", // delivered as an SSR prop / rendered server-side
     "tagline", // admin chrome only
     "motto", // rendered server-side
@@ -81,6 +100,11 @@ export function toPublicSiteSettings(doc, opts) {
         actionConfig: doc.actionConfig,
         background: doc.background,
         watermark: doc.watermark,
+        // Defaulted to [] rather than passed through: src/proxy.ts fails OPEN on a
+        // missing value, so an absent field and an empty list already behave the
+        // same — but emitting `undefined` would drop the key from the JSON entirely
+        // and leave the next person wondering whether the projection ran at all.
+        disabledRoutes: doc.disabledRoutes ?? [],
         effectiveWatermark: opts?.effectiveWatermark,
     };
 }

package/dist/_internal/server/jobs/handlers/onShipmentAllocationSync.js

@@ -1,5 +1,59 @@
 import { allocateShipmentCosts } from "../../../../features/shipments/utils/cost-allocation";
 const DEFAULT_MAX_HOURS_PER_DAY = 4;
+/*
+ * 🛑 THIS COMPARISON IS LOAD-BEARING. GETTING IT WRONG IS AN INFINITE LOOP THAT
+ * COSTS REAL MONEY, AND IT ALREADY DID.
+ *
+ * `onShipmentHeaderWrite` watches `procurementShipments/{shipmentId}` on
+ * documentWritten and writes BACK to that same document. The only thing stopping
+ * that from recurring forever is this equality check, so a false "changed" is not
+ * a wasted write — it is a permanent, self-sustaining cascade.
+ *
+ * It was `JSON.stringify(shipment.totals ?? {}) === JSON.stringify(totals)`.
+ * That is key-ORDER sensitive, and the two sides can never agree:
+ *
+ *   computed  — construction order from allocateShipmentCosts():
+ *               lotsCost, customsTotal, shippingTotal, laborCost, …
+ *   stored    — Firestore returns map fields with keys sorted ALPHABETICALLY:
+ *               customsTotal, estimatedProcessingDays, laborCost, lotCount, …
+ *
+ * So `totalsUnchanged` was ALWAYS false, every invocation wrote, and every write
+ * re-triggered the function. Measured 2026-09-11 in the Firebase console:
+ * `onShipmentHeaderWrite` 1,017,548 and `onShipmentDeleted` 1,017,372 invocations
+ * in 24 HOURS — 12M for the month against a 2M/month free quota, exceeded by
+ * 9.7M, while every other function in the project sat between 0 and 95.
+ *
+ * `onShipmentDeleted` was pure collateral: it is correctly guarded
+ * (`if (event.after) return`) but is bound to the same path, so it woke up a
+ * million times a day just to return.
+ *
+ * Two properties this replacement needs, and the old one had neither:
+ *   1. KEY ORDER MUST NOT MATTER — compare by key, never by serialised form.
+ *   2. FLOATS NEED TOLERANCE. `projectedMarginPercent` and `projectedRoiPercent`
+ *      are unrounded divisions, and a Firestore round-trip can return a value
+ *      that differs in the last bit. Exact `!==` on those is another way to make
+ *      "unchanged" unreachable — the same bug with a different mechanism.
+ */
+const MONEY_EPSILON = 0.005; // half a paisa: below anything that can be displayed
+function numbersEqual(a, b) {
+    const x = typeof a === "number" ? a : Number.NaN;
+    const y = typeof b === "number" ? b : Number.NaN;
+    if (Number.isNaN(x) && Number.isNaN(y))
+        return a === b; // both non-numeric: identity
+    return Math.abs(x - y) < MONEY_EPSILON;
+}
+/** Value equality over a flat numeric map, independent of key order. */
+function totalsEqual(stored, computed) {
+    if (!stored || typeof stored !== "object" || Array.isArray(stored))
+        return false;
+    const a = stored;
+    const keys = new Set([...Object.keys(a), ...Object.keys(computed)]);
+    for (const k of keys) {
+        if (!numbersEqual(a[k], computed[k]))
+            return false;
+    }
+    return true;
+}
 async function recomputeShipmentAllocation(shipmentId, ctx) {
     const shipmentRef = ctx.db.collection("procurementShipments").doc(shipmentId);
     const shipmentSnap = await shipmentRef.get();
@@ -34,11 +88,17 @@ async function recomputeShipmentAllocation(shipmentId, ctx) {
     for (const lot of lots) {
         const computed = perLot[lot.id];
         const statusChanged = lot.shipmentStatus !== shipment.status;
-        const valuesChanged = lot.customsAllocated !== computed.customsAllocated ||
-            lot.shippingAllocated !== computed.shippingAllocated ||
-            lot.totalLandedCost !== computed.totalLandedCost ||
-            lot.projectedRevenue !== computed.projectedRevenue ||
-            lot.projectedProfit !== computed.projectedProfit;
+        /*
+         * Same tolerance as the totals check, for the same reason: a lot write fires
+         * `onShipmentLotWrite`, which calls straight back into this function. Exact
+         * `!==` on a float that has round-tripped through Firestore is a second,
+         * independent path to the same infinite cascade.
+         */
+        const valuesChanged = !numbersEqual(lot.customsAllocated, computed.customsAllocated) ||
+            !numbersEqual(lot.shippingAllocated, computed.shippingAllocated) ||
+            !numbersEqual(lot.totalLandedCost, computed.totalLandedCost) ||
+            !numbersEqual(lot.projectedRevenue, computed.projectedRevenue) ||
+            !numbersEqual(lot.projectedProfit, computed.projectedProfit);
         if (statusChanged || valuesChanged) {
             anyLotChanged = true;
             batch.update(ctx.db.collection("shipmentLots").doc(lot.id), {
@@ -48,8 +108,15 @@ async function recomputeShipmentAllocation(shipmentId, ctx) {
             });
         }
     }
-    const totalsUnchanged = JSON.stringify(shipment.totals ?? {}) === JSON.stringify(totals);
+    const totalsUnchanged = totalsEqual(shipment.totals, totals);
     if (!totalsUnchanged) {
+        // trigger-self-write-ok: this writes to the collection onShipmentHeaderWrite
+        // watches, so it re-triggers itself — ONCE. The second pass recomputes the
+        // same `totals` from unchanged inputs, totalsEqual() reports them identical
+        // (by key, with a float tolerance — NOT by JSON.stringify, which is key-order
+        // sensitive and is what made this loop run 1,017,548 times in 24h), so no
+        // write happens and the cascade stops. Pinned by
+        // scripts/verify-shipment-allocation-guard.mjs.
         batch.update(shipmentRef, { totals, totalsComputedAt: ctx.now, updatedAt: ctx.now });
     }
     if (anyLotChanged || !totalsUnchanged) {

package/dist/_internal/shared/features/site-settings/types.d.ts

@@ -44,6 +44,18 @@ export interface PublicSiteSettings {
     actionConfig?: SiteSettingsDocument["actionConfig"];
     background?: SiteSettingsDocument["background"];
     watermark?: SiteSettingsDocument["watermark"];
+    /**
+     * Routes an admin has switched off. Read by `src/proxy.ts`, which rewrites a
+     * disabled path to the 404 page.
+     *
+     * 🛑 Not optional, and always emitted (defaulted to `[]`). The proxy fetches
+     * this over HTTP and fails OPEN on a missing value, so the difference between
+     * "no routes disabled" and "the field never arrived" is invisible at runtime —
+     * which is exactly how this capability sat dead after Root Cause #82 moved the
+     * gate out of the root layout. A key that is always present makes the two
+     * distinguishable from the wire alone.
+     */
+    disabledRoutes: string[];
     /** Derived, not a stored field — the resolved marker → wordmark → text chain. */
     effectiveWatermark?: MediaVideoWatermark;
 }

package/dist/features/tester/schemas/firestore.d.ts

@@ -108,6 +108,35 @@ export interface TesterChecklistItemDocument extends BaseDocument {
      * field to mean two different things.
      */
     endResult?: string;
+    /**
+     * The case's own author was unsure of its intent — the report flags the verdict
+     * so nobody reads it with more confidence than it earned.
+     *
+     * 🛑 These were UNDECLARED here until 2026-09-13, which is why the flag had
+     * never once fired: `fetch-cases.mjs` read them off the document, SKILL.md
+     * documented them and `record-verdicts.mjs` had a line to render them, but
+     * `group()` did not forward them and this interface did not admit them. Four
+     * hops right, two hops missing, and not one error anywhere. Root Cause #38.
+     */
+    needsReview?: boolean;
+    reviewNote?: string;
+    /**
+     * The case needs a channel an automated browser does not have — a real email
+     * inbox, or an interactive Google account. Always `null` in an automated run,
+     * by nature rather than by fault.
+     *
+     * 🛑 A PERMANENT FLOOR, not a backlog. Unflagged, these sit in the same
+     * "blocked" bucket as a case blocked by a genuine defect, so a raw blocked
+     * count mixes a constant with a signal and every run re-triages the same
+     * thirteen to rediscover none is a bug. Flagged, the report subtracts them.
+     *
+     * Never use it for a case that is merely hard, flaky or currently failing —
+     * that converts a defect into a documented non-test. See the three-kinds-of-
+     * null table in docs/TESTING-RIG-NOTES.md.
+     */
+    requiresHumanChannel?: boolean;
+    /** Which channel is missing, e.g. "real email inbox". Rendered in the report. */
+    humanChannelReason?: string;
     href?: string;
     order: number;
     phase: number;

package/dist/features/tester/seed-data/_money-flows.js

@@ -155,16 +155,24 @@ export const moneyFlowsPages = [
     {
         pageKey: "auction-win-to-payment",
         pageLabel: "Win an auction → get notified → pay",
-        href: "/auctions/auction-tester-sandbox-cycle-1",
+        href: "/auctions/auction-money-flows-closing",
         cases: [
             {
                 key: "winning-bid-recorded",
                 label: "Placing the highest bid on a closing auction records you as the winner",
                 roles: ["buyer"],
-                startPage: "/auctions/auction-tester-sandbox-cycle-1",
+                // Batch-scoped fixture, seeded by
+                // seed-data/fixtures/money-flows__auction-win-to-payment.mjs and closing
+                // ~3 minutes after this batch starts.
+                //
+                // It used to cite auction-tester-sandbox-cycle-1, which 46 OTHER
+                // citations need LIVE — one fixture with two contradictory
+                // requirements, so this case could never pass its final step and the
+                // rig notes recorded it as unpassable-by-design.
+                startPage: "/auctions/auction-money-flows-closing",
                 steps: [
                     STEP_SIGNIN_BUYER,
-                    "Open /auctions/auction-tester-sandbox-cycle-1, which starts at ₹15,000 with a ₹1,000 increment.",
+                    "Open /auctions/auction-money-flows-closing, which starts at ₹15,000 with a ₹1,000 increment and closes about three minutes from now.",
                     "Note the current bid and the end time.",
                     "Enter 16000 as the bid amount.",
                     "Click 'Place Bid'.",
@@ -180,7 +188,7 @@ export const moneyFlowsPages = [
                 roles: ["buyer"],
                 startPage: "/user/notifications",
                 steps: [
-                    "Sign in as the buyer who won auction-tester-sandbox-cycle-1.",
+                    "Sign in as the buyer who won auction-money-flows-closing.",
                     "Open the notifications bell in the header.",
                     "Find the auction-won notification.",
                     "Read its text.",
@@ -197,7 +205,7 @@ export const moneyFlowsPages = [
                 roles: ["buyer"],
                 startPage: "/user/orders",
                 steps: [
-                    "Sign in as the buyer who won auction-tester-sandbox-cycle-1.",
+                    "Sign in as the buyer who won auction-money-flows-closing.",
                     "Open /user/orders.",
                     "Locate the won auction.",
                     "Click its payment call to action.",

package/dist/features/tester/seed-data/authored/_types.d.ts

@@ -30,4 +30,28 @@ export interface AuthoredCase {
      */
     needsReview?: boolean;
     reviewNote?: string;
+    /**
+     * The case needs a channel an automated browser does not have — a real email
+     * inbox, or an interactive Google account. It is correct, it is worth keeping,
+     * and an automated run can never do anything with it but abstain.
+     *
+     * 🛑 This is a PERMANENT FLOOR, not a backlog. Without the flag those ~13 cases
+     * report `null` in every run forever and land in the same "blocked" bucket as a
+     * case blocked by a real defect — so a raw blocked count mixes a constant with
+     * a signal, and each run re-triages the same thirteen to rediscover that none
+     * of them is a bug. Flagged, the report can subtract them and say so.
+     *
+     * Deliberately distinct from the other two reasons a case yields no verdict —
+     * see the three-kinds-of-null table in docs/TESTING-RIG-NOTES.md. A missing
+     * fixture is a RIG fault and must be fixed; a case blocked by another defect is
+     * a PRODUCT fault and disappears when its cause does. Only this one is a
+     * permanent property of running headlessly, and collapsing the three is how a
+     * fixable gap hides inside an unfixable one.
+     *
+     * It must NEVER be used to excuse a case that is merely hard, flaky, or
+     * currently failing: that converts a defect into a documented non-test.
+     */
+    requiresHumanChannel?: boolean;
+    /** Which channel is missing, e.g. "real email inbox" / "interactive Google account". */
+    humanChannelReason?: string;
 }

package/dist/features/tester/seed-data/authored/account-auth__profile-settings.js

@@ -148,6 +148,8 @@ export const authored = {
         endResult: "All three links reach the same page. Set profile visibility back to Public afterwards, since other cases read this profile as another user.",
     },
     "checklist-account-auth-profile-settings-password-change-reset-link": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["buyer"],
         startPage: "/user/settings",
         steps: [

package/dist/features/tester/seed-data/authored/account-auth__signup-login.js

@@ -28,6 +28,8 @@
  */
 export const authored = {
     "checklist-account-auth-signup-login-auth-email-links-single-use": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["guest"],
         startPage: "/auth/forgot-password",
         steps: [
@@ -51,6 +53,8 @@ export const authored = {
         endResult: "Account state after the second click is identical to after the first. divya.funko@gmail.com is back on TempPass123! by the final step — skipping that restore leaves the account unusable by every later case, since the seeder never resets an existing password.",
     },
     "checklist-account-auth-signup-login-auth-emails-sender-identity-and-inbox": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["guest"],
         startPage: "/auth/register",
         steps: [
@@ -92,6 +96,8 @@ export const authored = {
         endResult: "Reloading /user shows 'QA Signup Tester' and the address used. The account persists — this case creates a real row that a later teardown does not remove, which is why the address is numbered rather than fixed.",
     },
     "checklist-account-auth-signup-login-email-verify": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["guest"],
         startPage: "/auth/register",
         steps: [
@@ -124,6 +130,8 @@ export const authored = {
         endResult: "No email arrives for nobody-here-12345@example.com. The two on-screen responses were indistinguishable, which is the whole point — a difference of any kind is an account-enumeration leak.",
     },
     "checklist-account-auth-signup-login-google-link-confirmation-shown": {
+        requiresHumanChannel: true,
+        humanChannelReason: "interactive Google account",
         roles: ["buyer"],
         startPage: "/user",
         steps: [
@@ -137,6 +145,8 @@ export const authored = {
         endResult: "After reload the green confirmation is still there and the blue prompt has not returned. Needs a Google account to reach — answer null with that reason rather than guessing if none is available.",
     },
     "checklist-account-auth-signup-login-google-link-conflict-rejected": {
+        requiresHumanChannel: true,
+        humanChannelReason: "interactive Google account",
         roles: ["buyer"],
         startPage: "/user/settings",
         steps: [
@@ -156,6 +166,8 @@ export const authored = {
         endResult: "After reload vivaan.kapoor@gmail.com has no Google link and rehan.sheikh@gmail.com still has G. Unlink G from rehan.sheikh@gmail.com afterwards. Needs a real Google account — answer null if none is available.",
     },
     "checklist-account-auth-signup-login-google-link-different-email": {
+        requiresHumanChannel: true,
+        humanChannelReason: "interactive Google account",
         roles: ["buyer"],
         startPage: "/user/settings",
         steps: [
@@ -174,6 +186,8 @@ export const authored = {
         endResult: "After reload the link persists and the primary email is still vivaan.kapoor@gmail.com. Unlink afterwards. Needs a second Google account — answer null if none is available.",
     },
     "checklist-account-auth-signup-login-google-link-existing": {
+        requiresHumanChannel: true,
+        humanChannelReason: "interactive Google account",
         roles: ["guest"],
         startPage: "/auth/register",
         steps: [
@@ -194,6 +208,8 @@ export const authored = {
         endResult: "One account exists for that email, not two, and it kept its wishlist. Needs a Google account whose address you can also register with — answer null if none is available.",
     },
     "checklist-account-auth-signup-login-google-oauth": {
+        requiresHumanChannel: true,
+        humanChannelReason: "interactive Google account",
         roles: ["guest"],
         startPage: "/auth/login",
         steps: [
@@ -208,6 +224,8 @@ export const authored = {
         endResult: "Reloading /user keeps the session. Needs a Google account — answer null with that reason if none is available.",
     },
     "checklist-account-auth-signup-login-google-popup-blocked-fallback": {
+        requiresHumanChannel: true,
+        humanChannelReason: "interactive Google account",
         roles: ["guest"],
         startPage: "/auth/login",
         steps: [
@@ -253,6 +271,8 @@ export const authored = {
         endResult: "Navigating to /user lands on /auth/login and no data for Vivaan Kapoor is rendered at any point. A back-button press does not restore the dashboard.",
     },
     "checklist-account-auth-signup-login-password-reset": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["guest"],
         startPage: "/auth/login",
         steps: [
@@ -276,6 +296,8 @@ export const authored = {
         endResult: "The password is back at TempPass123! by the final step. That restore is mandatory: the seeder never resets an existing password, so skipping it leaves this account permanently signed out of every later case.",
     },
     "checklist-account-auth-signup-login-signup-verification-email-arrives": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["guest"],
         startPage: "/auth/register",
         steps: [

package/dist/features/tester/seed-data/authored/admin__bug-hunter-rewards.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/admin__bug-hunter-rewards.js

@@ -0,0 +1,106 @@
+/*
+ * WHY: Authored six-part procedures for the admin/bug-hunter-rewards page.
+ * WHAT: 4 case(s), keyed by full checklist id.
+ *
+ * 🛑 THE LAST UNAUTHORED PAGE IN THE CATALOGUE. It was the sole remaining entry in
+ * R5's `UNAUTHORED_PAGES` ratchet (audit-tester-plugin-wiring.mjs), whose own
+ * header says the ratchet exists to be emptied. With this file it is.
+ *
+ * This page is awkward to test for a reason worth stating: confirming a bug
+ * DISABLES the case it was reported against, and credit is awarded to exactly one
+ * tester. Both effects are visible to every other tester, and the credit cannot be
+ * silently reassigned. So the cases below deliberately operate on the seeded demo
+ * fixture pair (v1 disabled + credited, v2 active) rather than on a live report:
+ *
+ *   checklist-admin-bug-hunter-rewards-demo-fixture      v1, isActive:false,
+ *                                                        bugConfirmed, credited to
+ *                                                        "Mock User 18"
+ *   checklist-admin-bug-hunter-rewards-demo-fixture-v2   v2, isActive:true
+ *
+ * That pair exists precisely so this flow can be read without spending a real
+ * tester's report on it. Where a case must perform the irreversible half —
+ * confirming a bug — it does so against v2, which is the fixture reopened for
+ * exactly that purpose.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+const SIGN_IN_ADMIN = "Sign in as admin@letitrip.in / TempPass123!.";
+export const authored = {
+    "checklist-admin-bug-hunter-rewards-confirm-bug": {
+        roles: ["admin"],
+        startPage: "/admin/tester-feedback",
+        steps: [
+            SIGN_IN_ADMIN,
+            "Open /admin/tester-feedback and select the Main Issues tab.",
+            "Find the row for the case 'Demo fixture — reported bug, already confirmed and reopened (v2, active)' and read the tester name on it.",
+            "Click 'Mark as Bug' on that row.",
+            "Read the confirmation dialog in full before accepting, then accept it.",
+            "Read the badge that appears on the row afterwards.",
+            "Open /admin/tester-checklist, set the Status filter to 'All', and read the Status of that same case.",
+        ],
+        inputs: { caseId: "checklist-admin-bug-hunter-rewards-demo-fixture-v2" },
+        expectedBehaviour: "Confirming a bug does two things at once and both are irreversible from this screen: it credits exactly one tester, and it takes the case out of circulation so no second tester can answer it. A confirmation dialog must stand in front of it — an accidental click here spends a credit on the wrong person and silently shrinks the catalogue.",
+        expectedUiState: "A dialog appears BEFORE anything commits. After accepting, the row shows a confirmed-bug badge naming the crediting tester — the same name that was on the row beforehand, not a different one. In the catalog the case's Status reads as bug-confirmed rather than Active.",
+        expectedData: { creditedTesterUnchanged: true },
+        endResult: "Survives a reload: the badge and the credited name are still there, and the case is still out of the Active view.",
+    },
+    "checklist-admin-bug-hunter-rewards-confirm-bug-idempotent": {
+        roles: ["admin"],
+        startPage: "/admin/tester-feedback",
+        steps: [
+            SIGN_IN_ADMIN,
+            "Open /admin/tester-feedback and select the All Submissions tab.",
+            "Find a row whose case is ALREADY bug-confirmed — the demo fixture 'reported bug, already confirmed and reopened (v1, disabled)' is credited to Mock User 18.",
+            "Read the tester name currently credited on it.",
+            "Attempt 'Mark as Bug' on that row.",
+            "Read whatever the screen says in response.",
+            "Read the credited tester name again and compare it against the one noted earlier.",
+        ],
+        inputs: { caseId: "checklist-admin-bug-hunter-rewards-demo-fixture", creditedTo: "Mock User 18" },
+        expectedBehaviour: "A second confirmation on an already-confirmed case is REFUSED, and refused loudly. The failure mode this guards is silent re-crediting: two testers report the same case, an admin confirms twice, and the second confirmation quietly moves the credit off the person who actually found it. Nothing about that is visible unless the screen says so.",
+        expectedUiState: "Either the action is absent/disabled on an already-confirmed row, or it is refused with a message naming the existing credit. What must NOT happen is a success message. The credited name is byte-identical to the one read at the start.",
+        expectedData: { creditedTo: "Mock User 18" },
+        endResult: "Reload the page: the credit still reads Mock User 18, and the case has not gained a second confirmation.",
+    },
+    "checklist-admin-bug-hunter-rewards-reopen-case": {
+        roles: ["admin"],
+        startPage: "/admin/tester-checklist",
+        steps: [
+            SIGN_IN_ADMIN,
+            "Open /admin/tester-checklist and set the Status filter to 'Inactive' (or set Bug status to 'Bug Confirmed').",
+            "Find 'Demo fixture — reported bug, already confirmed and reopened (v1, disabled)' and read its Status and its bug-hunter credit.",
+            "Use its 'Reopen as New Test Case' row action.",
+            "Read the new case that appears — its label, its Status, and its version.",
+            "Go back to the v1 case and read its Status and credit again.",
+            "Open the Tester Hub as the tester and search for the new case.",
+        ],
+        inputs: { v1Id: "checklist-admin-bug-hunter-rewards-demo-fixture" },
+        expectedBehaviour: "Reopening creates a NEW version rather than resurrecting the old one. The original must keep both its disabled state and its bug-hunter credit — that credit is a record of who found the defect, and a retest of the same behaviour does not undo the finding. Mutating v1 in place would erase the history the whole feature exists to keep.",
+        expectedUiState: "Two rows exist afterwards: the old one still disabled and still credited, and a new active one answerable from the Tester Hub. The new case does NOT carry the old case's bug-hunter credit.",
+        expectedData: { originalStaysDisabled: true, originalKeepsCredit: true },
+        endResult: "Survives a reload: v1 disabled with its credit, the reopened version active and answerable.",
+    },
+    "checklist-admin-bug-hunter-rewards-catalog-default-active-filter": {
+        roles: ["admin"],
+        startPage: "/admin/tester-checklist",
+        steps: [
+            SIGN_IN_ADMIN,
+            "Open /admin/tester-checklist without touching any filter and read the total count shown.",
+            "Search for 'Demo fixture — reported bug' and read how many rows match.",
+            "Switch the Status filter to 'All' and read the total count and the matching rows again.",
+            "Switch the Status filter to 'Inactive' and read which of the two demo fixtures appears.",
+            "Set Status back to its default and set 'Bug status' to 'Bug Confirmed'.",
+            "Read which rows appear under that filter.",
+        ],
+        inputs: { search: "Demo fixture — reported bug" },
+        expectedBehaviour: "The default view is the answerable catalogue, not everything ever written. A bug-confirmed case is deliberately out of circulation, so showing it by default would invite an admin to treat a closed finding as open work. Switching the filter must reveal it — hidden is not the same as gone.",
+        expectedUiState: "On the default view only the v2 (active) demo fixture matches the search. Under Status 'All' both appear and the total is higher. Under 'Inactive' the v1 disabled one appears. Under Bug status 'Bug Confirmed' the v1 one appears. The counts move in the direction the filter implies.",
+        expectedData: { defaultViewHidesBugConfirmed: true },
+        endResult: "Read-only — no case is modified.",
+    },
+};

package/dist/features/tester/seed-data/authored/admin__site-system.js

@@ -211,6 +211,8 @@ export const authored = {
         endResult: "Read-only; send nothing.",
     },
     "checklist-admin-site-system-daily-digest-email-content": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["admin"],
         startPage: "/admin/site",
         steps: [

package/dist/features/tester/seed-data/authored/buying__my-orders.js

@@ -239,6 +239,8 @@ export const authored = {
         endResult: "Read-only. If no rejected order exists, answer null rather than creating one — rejecting as fraud bans a real account for seven days.",
     },
     "checklist-buying-my-orders-order-lifecycle-emails-arrive": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["buyer"],
         startPage: "/user/orders",
         steps: [

package/dist/features/tester/seed-data/authored/buying__offers.js

@@ -384,6 +384,8 @@ export const authored = {
         endResult: "All four listings keep their type-specific fields. Restore any title that was changed.",
     },
     "checklist-buying-offers-notification-email-is-a-real-email": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["buyer"],
         startPage: "/user/settings",
         steps: [

package/dist/features/tester/seed-data/authored/content-discovery__notifications.js

@@ -96,6 +96,8 @@ export const authored = {
         endResult: "Read-only; nothing persists beyond the URL.",
     },
     "checklist-content-discovery-notifications-notification-email-actually-arrives": {
+        requiresHumanChannel: true,
+        humanChannelReason: "real email inbox",
         roles: ["buyer"],
         startPage: "/user/settings",
         steps: [