@mohasinac/appkit 4.39.0 → 4.40.0

package/dist/features/tester/seed-data/authored/buying__order-detail-actions.js

@@ -0,0 +1,138 @@
+/*
+ * WHY: Authored six-part procedures for buying/order-detail-actions.
+ * WHAT: 7 cases, keyed by full checklist id.
+ *
+ * 🛑 THE WHOLE POST-PURCHASE MONEY SURFACE. `/user/orders/[id]/` has five
+ * subroutes — cancel, return, track, invoice, payment — and before 2026-09-14
+ * exactly ONE case in the entire 1,188-case catalogue touched any of them.
+ *
+ * 🛑 NO SEEDED ORDER BELONGS TO THE BOT. Measured on production: 0 of 64. So a
+ * case that says "open one of your orders" while signed in as the bot has no
+ * order to open, and answers `null` forever. The positive cases below BUY first;
+ * the seeded ids belonging to other personas are used only as the ownership
+ * negatives — which is the dimension nothing tested at all, and the one where a
+ * mistake is an IDOR rather than a cosmetic bug.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-buying-order-detail-actions-invoice-downloads-for-owner": {
+        roles: ["buyer"],
+        startPage: "/products",
+        steps: [
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123!.",
+            "Open /products, add any in-stock item to the cart, and complete checkout.",
+            "Open /user/orders and find the order you just placed. Write down its id from the row.",
+            "Open the order and use its Invoice action.",
+            "Read what the browser does with the response.",
+        ],
+        expectedBehaviour: "The invoice is generated on demand and streamed by a route that checks the order belongs to the caller. It is not a stored file and has no public URL.",
+        expectedUiState: "A file downloads rather than rendering in the tab, and its name contains the order id. Not a JSON blob and not an error page.",
+        expectedData: { invoiceDownloaded: true },
+        endResult: "The order is unchanged by downloading its invoice; the row still shows the same status after a reload.",
+    },
+    "checklist-buying-order-detail-actions-invoice-refuses-other-buyer": {
+        roles: ["buyer"],
+        startPage: "/user/orders",
+        steps: [
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123!.",
+            "Navigate directly to /api/user/orders/order-1-20260721-11joon/invoice — a seeded order belonging to a different persona.",
+            "Read the response.",
+            "Now navigate to /user/orders/order-1-20260721-11joon.",
+            "Read that page.",
+        ],
+        inputs: { foreignOrderId: "order-1-20260721-11joon" },
+        expectedBehaviour: "An order id is short and guessable, so ownership is checked on every hit rather than relied upon to be secret. Answering 403 instead of 404 would confirm that an order with that id exists, which is a membership oracle over the id space.",
+        expectedUiState: "Neither the invoice nor the order page shows any of that order's contents. No item titles, no address, no amounts.",
+        expectedData: { foreignInvoiceServed: false },
+        endResult: "Nothing about the other buyer's order changes.",
+    },
+    "checklist-buying-order-detail-actions-cancel-page-refuses-delivered-order": {
+        roles: ["buyer"],
+        startPage: "/user/orders",
+        steps: [
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123!.",
+            "Place an order, then open /user/orders and open that order.",
+            "Use the Cancel action and read what the page offers.",
+            "Complete the cancellation.",
+            "Reload the order and read its status.",
+            "Use the Cancel action again on the now-cancelled order.",
+        ],
+        expectedBehaviour: "Cancellation is only offered while it is actually possible, and a second attempt on an already-cancelled order is refused with a reason rather than silently accepted. An endpoint that accepts a second cancel writes a second set of side effects — stock restored twice is the usual shape.",
+        expectedUiState: "The first attempt offers a confirmation and a reason field. After cancelling, the status reads Cancelled and the Cancel action is gone or disabled, with an explanation.",
+        expectedData: { statusAfterCancel: "cancelled" },
+        endResult: "The order stays Cancelled after a reload, and the item's stock is back on its product page.",
+    },
+    "checklist-buying-order-detail-actions-return-request-round-trip": {
+        roles: ["buyer"],
+        startPage: "/user/orders",
+        steps: [
+            "Sign in as vivaan.kapoor@gmail.com / TempPass123! — this persona owns the seeded DELIVERED orders, and a return can only be requested on one.",
+            "Open /user/orders and open order-1-20260721-11joon, which is delivered.",
+            "Use the Return action.",
+            "Give the reason: item not as described.",
+            "Submit the request.",
+            "Reload the order.",
+            "Open /user/returns and look for it.",
+        ],
+        inputs: { orderId: "order-1-20260721-11joon", reason: "item not as described" },
+        expectedBehaviour: "A return request moves the order into Return Requested and appears on the returns surface. That status is deliberately an ACTIVE one — it is the seller's next action item, not a closed state — so the order must not disappear from the active list.",
+        expectedUiState: "The order's status reads Return Requested, and the same order is listed under /user/returns.",
+        expectedData: { statusAfterReturn: "return_requested" },
+        endResult: "After a reload the status and the returns listing both still show it. The reason text is retained.",
+    },
+    "checklist-buying-order-detail-actions-track-shows-real-dates": {
+        roles: ["buyer"],
+        startPage: "/user/orders",
+        steps: [
+            "Sign in as rehan.sheikh@gmail.com / TempPass123! — this persona owns the seeded SHIPPED order.",
+            "Open /user/orders and open order-1-20260718-aevnlw.",
+            "Use the Track action.",
+            "Read every step on the timeline and note which carry a date and which do not.",
+            "Compare the dates shown against the order's own placed and shipped dates.",
+        ],
+        inputs: { orderId: "order-1-20260718-aevnlw" },
+        expectedBehaviour: "Each timeline step shows the date actually recorded for it. A step with no recorded date renders an em-dash rather than a guess — an invented or estimated date is worse than a blank, because it cannot be told apart from a real one.",
+        expectedUiState: "The placed and shipped steps carry dates matching the order. Steps the order has not reached show no date rather than today's.",
+        expectedData: { fabricatedDatesShown: false },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-buying-order-detail-actions-order-subroutes-404-for-other-users-order": {
+        roles: ["buyer"],
+        startPage: "/user/orders",
+        steps: [
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123!, which owns no seeded orders.",
+            "Navigate to /user/orders/order-1-20260721-11joon/track.",
+            "Navigate to /user/orders/order-1-20260721-11joon/invoice.",
+            "Navigate to /user/orders/order-1-20260721-11joon/return.",
+            "Navigate to /user/orders/order-1-20260721-11joon/cancel.",
+            "Navigate to /user/orders/order-1-20260721-11joon/payment.",
+            "Read each page in turn.",
+        ],
+        inputs: { foreignOrderId: "order-1-20260721-11joon" },
+        expectedBehaviour: "Ownership is enforced on EVERY subroute, not only on the order page that links to them. A subroute that checks nothing is reachable by typing a URL, and these five carry the address, the amounts and the payment details.",
+        expectedUiState: "All five show a not-found page. None shows an item title, an address, an amount or a tracking number belonging to that order.",
+        expectedData: { subroutesLeakingData: 0 },
+        endResult: "Nothing about the other buyer's order changes.",
+    },
+    "checklist-buying-order-detail-actions-order-subroutes-redirect-guest": {
+        roles: ["guest"],
+        startPage: "/user/orders",
+        steps: [
+            "Open a private window with no session.",
+            "Navigate to /user/orders/order-1-20260721-11joon/track.",
+            "Read the page.",
+            "Navigate to /user/orders and read that page too.",
+        ],
+        inputs: { foreignOrderId: "order-1-20260721-11joon" },
+        expectedBehaviour: "A signed-out visitor is sent to sign in. Being blocked IS the expected result here — the failure to look for is the page rendering its content for a moment before redirecting, which is enough to read and enough for a crawler to capture.",
+        expectedUiState: "The sign-in page, or the orders page in its signed-out state. At no point does any order content appear, not even briefly.",
+        expectedData: { orderContentVisibleToGuest: false },
+        endResult: "No session is created and nothing is changed.",
+    },
+};

package/dist/features/tester/seed-data/authored/buying__wishlist-history.js

@@ -341,4 +341,34 @@ export const authored = {
         expectedData: { maxEntries: 50, duplicateProducts: 0 },
         endResult: "The account's history holds the merged, de-duplicated set.",
     },
+    /* ── Added 2026-09-14 (F3d) — the SIGNED-OUT wishlist ────────────────────────
+     * 20 cases existed, 2 signed-out, and both were about the login MERGE rather
+     * than about what a guest sees BEFORE logging in.
+     */
+    "checklist-buying-wishlist-history-wishlist-guest-heart-prompts-signin": {
+        roles: ["guest"],
+        startPage: "/products/product-beyblade-burst-valkyrie",
+        steps: [
+            "Open /products/product-beyblade-burst-valkyrie while signed out.",
+            "Note the state of the wishlist heart before touching it.",
+            "Tap the heart.",
+            "Note what appears, and note the heart's state immediately afterwards.",
+            "Dismiss whatever appeared and look at the heart once more.",
+        ],
+        expectedBehaviour: "BEFORE: the heart is empty. Tapping it asks the visitor to sign in. AFTER dismissing that prompt the heart is empty again. It must not fill optimistically before refusing — a filled heart that saved nothing is worse than a plain refusal, because the visitor believes the item is kept and does not come back for it.",
+        expectedUiState: "A sign-in prompt or modal appears naming what signing in will do. The heart is unfilled both before the tap and after the prompt is dismissed.",
+        endResult: "Nothing is saved. Nothing persists.",
+    },
+    "checklist-buying-wishlist-history-wishlist-guest-page-signed-out": {
+        roles: ["guest"],
+        startPage: "/wishlist",
+        steps: [
+            "Open /wishlist directly by URL while signed out.",
+            "Read exactly what the page says.",
+            "Note whether it offers a way to sign in from there.",
+        ],
+        expectedBehaviour: "A signed-out visitor is asked to sign in. They are not shown a generic empty wishlist: an empty state reading 'nothing saved yet' is indistinguishable, to someone who did save things, from a wishlist whose contents were lost.",
+        expectedUiState: "The page states that signing in is required and offers a route to it. The words used are quoted in the answer, because the distinction between this and an ordinary empty state IS the case.",
+        endResult: "Read-only; nothing persists.",
+    },
 };

package/dist/features/tester/seed-data/authored/content-discovery__category-counts-and-rollup.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/content-discovery__category-counts-and-rollup.js

@@ -0,0 +1,145 @@
+/*
+ * WHY: Authored six-part procedures for content-discovery/category-counts-and-rollup.
+ * WHAT: 8 cases, keyed by full checklist id.
+ *
+ * 🛑 THE RULE THESE CASES ENCODE: a category's count is its OWN items plus every
+ * descendant's, and clicking it must LIST exactly those items. With
+ * A → (B, C → D) and own counts A=5, B=5, C=8, D=2, the numbers are D=2, B=5,
+ * C=10 and **A=20** — and opening A lists all twenty.
+ *
+ * Both halves were wrong on 2026-09-14. The nightly reconciler could not express
+ * own-vs-rollup at all — `setMetrics` wrote one number to both fields — so it
+ * OVERWROTE the live trigger's correct values every night: 19 of 65 rows
+ * disagreed with a recount, every one low. And the child chips beneath a
+ * category header rendered the OWN count while the header rendered the rollup,
+ * so a parent reading 20 could sit above chips summing to 5.
+ *
+ * Nothing errored in either case. A wrong number is simply a number, which is
+ * why every case below compares TWO things that must agree rather than checking
+ * that a number is present.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-content-discovery-category-counts-and-rollup-leaf-count-matches-its-listing": {
+        roles: ["guest"],
+        startPage: "/categories",
+        steps: [
+            "Open /categories.",
+            "Open the tile for x-starters — a leaf with no child chips of its own.",
+            "Write down the count shown on its tile.",
+            "Open that category.",
+            "Count the product cards listed, using the pager total rather than counting by eye if there is more than one page.",
+        ],
+        expectedBehaviour: "A count is a promise about a listing. On a leaf there are no descendants, so the number and the listing are the same set and any difference is a stale counter.",
+        expectedUiState: "The number on the tile equals the number of products the category page lists.",
+        expectedData: { tileCountEqualsListingTotal: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-category-counts-and-rollup-parent-count-includes-descendants": {
+        roles: ["guest"],
+        startPage: "/categories",
+        steps: [
+            "Open /categories/x-tops — a parent whose children include x-starters and x-boosters.",
+            "Write down the count on the parent's tile.",
+            "Open the parent and write down the count shown on each of its child chips.",
+            "Add the children's counts together.",
+            "Open the parent's own listing and note whether any product there is filed directly under the parent rather than a child.",
+        ],
+        expectedBehaviour: "The parent's number is its own items plus every descendant's. A parent showing only its own items reports a number smaller than the branch it stands for, and a parent showing only its descendants loses whatever is filed directly under it.",
+        expectedUiState: "The parent's count is greater than or equal to the sum of its children's counts, and equals that sum plus anything filed directly under the parent.",
+        expectedData: { parentCountAtLeastSumOfChildren: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-category-counts-and-rollup-parent-listing-includes-descendant-items": {
+        roles: ["guest"],
+        startPage: "/categories",
+        steps: [
+            "Open /categories/x-tops.",
+            "Open one of its CHILD categories and write down the title of a product listed there.",
+            "Go back to the parent category's own page.",
+            "Search the parent's listing for that same product, paging through if necessary.",
+        ],
+        expectedBehaviour: "The rule governs the LISTING, not only the number. A count that rolls up while the listing does not is worse than both being wrong together: the page then contradicts itself in a way that reads as a pagination problem.",
+        expectedUiState: "The child's product appears in the parent category's listing.",
+        expectedData: { childProductVisibleOnParent: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-category-counts-and-rollup-header-and-child-chips-agree": {
+        roles: ["guest"],
+        startPage: "/categories",
+        steps: [
+            "Open a parent category page that shows a row of child chips.",
+            "Write down the number in the page header.",
+            "Write down the number on each child chip.",
+            "Open one child and compare its own header number to the number its chip showed.",
+        ],
+        expectedBehaviour: "Every number a visitor reads is the same kind of number — the rollup. Showing the rollup in the header and the own-count on the chips answers two different questions with identically-styled figures side by side, and nothing on the screen says which is which.",
+        expectedUiState: "The number on a child's chip equals the number in that child's own page header.",
+        expectedData: { chipMatchesChildHeader: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-category-counts-and-rollup-root-count-is-the-whole-subtree": {
+        roles: ["guest"],
+        startPage: "/categories",
+        steps: [
+            "Open /categories/spinning-tops — a root category.",
+            "Write down its count.",
+            "Open it and write down the count on each of its direct children.",
+            "Open each child in turn and write down its children's counts, until you reach leaves.",
+            "Add up every leaf's count, plus anything filed directly under an intermediate node.",
+        ],
+        expectedBehaviour: "A root's count is the sum over its whole subtree. This is the case that catches a reconciler summing only ONE level of descendants — it produces a number that is plausible, consistently too low, and never flagged.",
+        expectedUiState: "The root's count equals the total counted across the subtree.",
+        expectedData: { rootCountEqualsSubtreeSum: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-category-counts-and-rollup-sibling-isolation": {
+        roles: ["guest"],
+        startPage: "/categories",
+        steps: [
+            "Open /categories/x-tops, which has several children.",
+            "Open the first child and write down a product title from its listing.",
+            "Open the second child's listing.",
+            "Search the second child for that product.",
+            "Compare the two children's counts.",
+        ],
+        expectedBehaviour: "Roll-up goes upward only. A product must not be counted in, or listed under, a sibling branch — the failure that produces is a set of counts that all look slightly too large and still sum plausibly.",
+        expectedUiState: "The first child's product is absent from the second child's listing.",
+        expectedData: { productLeakedToSibling: false },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-category-counts-and-rollup-guest-sees-the-same-counts": {
+        roles: ["guest", "buyer"],
+        startPage: "/categories",
+        steps: [
+            "Open /categories in a private window with no session.",
+            "Write down the counts on the first four category tiles.",
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123!.",
+            "Open /categories again and read the same four tiles.",
+        ],
+        expectedBehaviour: "A category count is a fact about the catalogue, not about the viewer. If the two differ, something viewer-scoped is leaking into a shared number — the likeliest candidate being a filter that hides test fixtures from one audience but is counted for the other.",
+        expectedUiState: "All four numbers are identical in both sessions.",
+        expectedData: { countsDifferBetweenSessions: false },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-category-counts-and-rollup-brand-count-matches-its-listing": {
+        roles: ["guest"],
+        startPage: "/brands",
+        steps: [
+            "Open /brands.",
+            "Write down the product count shown for one brand.",
+            "Open that brand's page.",
+            "Read the total the listing reports.",
+        ],
+        expectedBehaviour: "A brand is a row in the same collection as a category and its count is written by the same trigger — but brands hang off `brandSlug` rather than the category chain, so they are a separate pass and can be missed entirely while every category is correct. Brand rows had no counter writer at all until 2026-09-14.",
+        expectedUiState: "The number on the brand tile equals the number of products the brand page lists.",
+        expectedData: { brandTileMatchesListing: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+};

package/dist/features/tester/seed-data/authored/content-discovery__event-detail-subroutes.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/content-discovery__event-detail-subroutes.js

@@ -0,0 +1,154 @@
+/*
+ * WHY: Authored six-part procedures for content-discovery/event-detail-subroutes.
+ * WHAT: 8 cases, keyed by full checklist id.
+ *
+ * 🛑 ALL 29 EXISTING EVENT CASES STOP AT THE INDEX. `/events/[id]/` has four
+ * subroutes — participate, leaderboard, winner, spin-results — and none of them
+ * had a single case. Several real defects were found on exactly these pages by
+ * hand during the 2026-09 run, which is the ordinary consequence of a surface
+ * nobody has a procedure for.
+ *
+ * Fixtures are named by id because event behaviour is type- and status-specific:
+ * a poll and a raffle share a route and share almost nothing else, and "open an
+ * event" is a different test every run.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-content-discovery-event-detail-subroutes-detail-tabs-match-event-type": {
+        roles: ["guest"],
+        startPage: "/events",
+        steps: [
+            "Open /events/event-favourite-blader-poll — a poll.",
+            "Write down every tab shown.",
+            "Open /events/event-original-series-clearance — a sale.",
+            "Write down its tabs.",
+            "Open /events/event-win-burst-regalia-genesis — a raffle.",
+            "Write down its tabs.",
+        ],
+        inputs: {
+            pollEvent: "event-favourite-blader-poll",
+            saleEvent: "event-original-series-clearance",
+            raffleEvent: "event-win-burst-regalia-genesis",
+        },
+        expectedBehaviour: "The tab bar is derived from the event's type. A tab offered for a type that cannot have it leads to a page with nothing to render — and a blank panel reads as a loading failure rather than as a tab that should not exist.",
+        expectedUiState: "The poll shows no Spin Results and no Winner tab. The sale shows no Leaderboard. The raffle shows a Winner tab.",
+        expectedData: { tabWithNoContentShown: false },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-event-detail-subroutes-participate-records-an-entry": {
+        roles: ["buyer"],
+        startPage: "/events",
+        steps: [
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123!.",
+            "Open /events/event-favourite-blader-poll.",
+            "Open its Participate tab.",
+            "Submit the first available option.",
+            "Reload the page.",
+            "Read what the Participate tab shows now.",
+        ],
+        inputs: { eventId: "event-favourite-blader-poll" },
+        expectedBehaviour: "Participation writes an entry and the page reflects it afterwards. A write that succeeds while the screen keeps offering the form is the classic split between behaviour and UI state — and it leads a user to submit repeatedly.",
+        expectedUiState: "After the reload the tab shows the submitted answer or a 'you have taken part' state, not the blank form again.",
+        expectedData: { entryPersisted: true },
+        endResult: "The entry is still recorded after a second reload.",
+    },
+    "checklist-content-discovery-event-detail-subroutes-participate-twice-is-refused": {
+        roles: ["buyer"],
+        startPage: "/events",
+        steps: [
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123! and open /events/event-favourite-blader-poll.",
+            "Participate once if you have not already.",
+            "Reload, and try to participate a second time with a different option.",
+            "Read what happens.",
+            "Open the Leaderboard tab and read the total entry count.",
+        ],
+        inputs: { eventId: "event-favourite-blader-poll" },
+        expectedBehaviour: "A second entry from the same account is refused with a reason. Silently accepting it doubles that account's weight in the result, which is invisible until somebody reconciles the entry count against the participant count.",
+        expectedUiState: "A clear refusal naming the reason. The entry total does not rise by a second entry from this account.",
+        expectedData: { duplicateEntryAccepted: false },
+        endResult: "Exactly one entry for this account survives a reload.",
+    },
+    "checklist-content-discovery-event-detail-subroutes-leaderboard-ranks-by-a-real-number": {
+        roles: ["guest"],
+        startPage: "/events",
+        steps: [
+            "Open /events/event-tester-sandbox-top-scorers and open its Leaderboard tab.",
+            "Read the score beside each of the first five rows.",
+            "Check that the scores are in descending order.",
+            "Read the total entry count the event reports.",
+            "Count the rows the leaderboard lists, paging if needed.",
+        ],
+        inputs: { eventId: "event-tester-sandbox-top-scorers" },
+        expectedBehaviour: "The leaderboard orders by a stored score and covers the same entries the event counts. A ranking that is merely insertion order looks correct whenever the data happens to arrive sorted, so the descending check has to be explicit.",
+        expectedUiState: "Scores descend down the list, and the number of entries listed matches the count the event reports.",
+        expectedData: { scoresDescending: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-event-detail-subroutes-winner-page-before-draw": {
+        roles: ["guest"],
+        startPage: "/events",
+        steps: [
+            "Open /events/event-win-burst-regalia-genesis — an ACTIVE raffle that has not been drawn.",
+            "Open its Winner tab.",
+            "Read the page.",
+        ],
+        inputs: { eventId: "event-win-burst-regalia-genesis" },
+        expectedBehaviour: "An undrawn raffle has no winner, and the page must say so. A blank panel is indistinguishable from a failed load, and any name shown here before a draw is fabricated — which on a prize event is the worst possible thing to render.",
+        expectedUiState: "A clear statement that the draw has not happened yet, ideally with when it will. No name, no masked name, no empty winner card.",
+        expectedData: { winnerNameShown: false },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-event-detail-subroutes-winner-page-after-draw": {
+        roles: ["guest"],
+        startPage: "/events",
+        steps: [
+            "Open /events/event-won-original-set-raffle — an ENDED raffle with a recorded winner.",
+            "Open its Winner tab.",
+            "Read the winner shown and the prize named.",
+            "Open the event's Overview and compare the prize named there.",
+        ],
+        inputs: { eventId: "event-won-original-set-raffle" },
+        expectedBehaviour: "The winner page reads the winner recorded on the event. The displayed name is masked, as every other public surface masks a user's name.",
+        expectedUiState: "A winner is named in masked form and the prize matches what the Overview describes.",
+        expectedData: { winnerShown: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-event-detail-subroutes-cancelled-event-refuses-participation": {
+        roles: ["buyer"],
+        startPage: "/events",
+        steps: [
+            "Sign in as the bot buyer claude-tester@letitrip.in / TempPass123!.",
+            "Open /events/event-x-launch-raffle-cancelled — a CANCELLED raffle.",
+            "Read the event header for its status.",
+            "Open the Participate tab.",
+            "Try to take part.",
+        ],
+        inputs: { eventId: "event-x-launch-raffle-cancelled" },
+        expectedBehaviour: "A cancelled event accepts nothing. The status is checked server-side as well as hidden in the UI: a Participate tab that merely hides its button still has an endpoint behind it.",
+        expectedUiState: "The header says Cancelled, and the Participate tab explains that the event is closed rather than offering a form.",
+        expectedData: { participationAccepted: false },
+        endResult: "No entry is recorded; the entry count is unchanged after a reload.",
+    },
+    "checklist-content-discovery-event-detail-subroutes-guest-sees-event-but-is-prompted": {
+        roles: ["guest"],
+        startPage: "/events",
+        steps: [
+            "Open a private window with no session.",
+            "Open /events/event-favourite-blader-poll.",
+            "Read the Overview — the title, the description and the dates.",
+            "Open the Participate tab.",
+            "Read what it offers.",
+        ],
+        inputs: { eventId: "event-favourite-blader-poll" },
+        expectedBehaviour: "An event is public reading and gated taking-part. Being prompted to sign in IS the expected result — the failure to look for is a hard redirect off the page, which loses the visitor the content they came for, or a form that submits and fails.",
+        expectedUiState: "The event's own content is readable. Participate shows a sign-in prompt rather than a form, and nothing 404s or bounces to /unauthorized.",
+        expectedData: { eventContentReadableByGuest: true },
+        endResult: "No entry is recorded and no session is created.",
+    },
+};

package/dist/features/tester/seed-data/authored/content-discovery__store-reviews-aggregate.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/content-discovery__store-reviews-aggregate.js

@@ -0,0 +1,88 @@
+/*
+ * WHY: Authored six-part procedures for content-discovery/store-reviews-aggregate.
+ * WHAT: 4 cases, keyed by full checklist id.
+ *
+ * 🛑 THIS TAB ANSWERED 200 WITH ZERO REVIEWS FOR EVERY STORE, for as long as it
+ * had existed, while 79 approved reviews sat in Firestore (Root Cause #100). It
+ * selected "the store's top 20 products by `itemsSold`" and fanned out a review
+ * query per product — and **no product carries `itemsSold`**, so Firestore's
+ * `orderBy` excluded all 95 of them and the endpoint returned nothing.
+ *
+ * The only symptom was "this store has no reviews yet", which reads as a fact
+ * about the store. That is why the first case names a store KNOWN to have
+ * reviews rather than asking whether the tab renders.
+ *
+ * Fixing it then exposed the next layer: the route returned the raw document,
+ * including the reviewer's name as `enc:v1:…` ciphertext and the HMAC blind
+ * index beside it. Hence the privacy case.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-content-discovery-store-reviews-aggregate-reviews-tab-not-empty": {
+        roles: ["guest"],
+        startPage: "/stores/store-beyblade-arena",
+        steps: [
+            "Open /stores/store-beyblade-arena — this store is known to have many approved reviews, which is the point of naming it.",
+            "Open its Reviews tab.",
+            "Wait for the content to finish loading before judging it.",
+            "Read how many reviews are reported and count the cards on the first page.",
+        ],
+        expectedBehaviour: "Reviews are fetched by the store they belong to. Routing the lookup through a sample of the store's products makes the result depend on a field those products may not have — and an ordering field that is absent silently excludes every document, returning an empty list rather than an error.",
+        expectedUiState: "Review cards are listed and a total is shown. NOT 'No reviews yet' and not an empty tab.",
+        expectedData: { totalReviewsAtLeast: 1 },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-store-reviews-aggregate-average-matches-the-rows": {
+        roles: ["guest"],
+        startPage: "/stores/store-beyblade-arena",
+        steps: [
+            "Open the store's Reviews tab and write down the average rating and the total.",
+            "Read the star-distribution breakdown and write down the count beside each star level.",
+            "Add the five distribution counts together.",
+            "Compare that sum with the total.",
+            "Filter to 5-star reviews and compare the number of cards with the 5-star count from the breakdown.",
+        ],
+        expectedBehaviour: "The aggregate covers the whole store, not a sample of it. Computing it from an arbitrary subset of products leaves the average and the distribution quietly wrong — and those two numbers are what a buyer judges a seller on.",
+        expectedUiState: "The distribution counts sum to the total, and the 5-star filter returns as many reviews as the breakdown claims.",
+        expectedData: { distributionSumsToTotal: true },
+        endResult: "Clearing the filter restores the full list.",
+    },
+    "checklist-content-discovery-store-reviews-aggregate-reviewer-name-is-masked": {
+        roles: ["guest"],
+        startPage: "/stores/store-beyblade-arena",
+        steps: [
+            "Open the store's Reviews tab.",
+            "Read the reviewer name shown on the first three cards.",
+            "Open the browser network panel and reload.",
+            "Find the request that fetched the reviews and read its response body.",
+            "Search that body for the text enc:v1 and for the field names userNameIndex, searchTxt and userId.",
+        ],
+        expectedBehaviour: "A reviewer's name is PII, stored encrypted, and shown masked in public. The generic repository returns the document verbatim, so a route that does not go through the reviews repository serves ciphertext — and a payload built by spreading the document also carries the HMAC blind index, which lets a caller confirm a guessed name.",
+        expectedUiState: "Names render masked, for example 'M*** U***'. No card shows a value beginning enc:v1.",
+        expectedData: { ciphertextInResponse: false, blindIndexInResponse: false },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-store-reviews-aggregate-review-search-matches-body-text": {
+        roles: ["guest"],
+        startPage: "/stores/store-beyblade-arena",
+        steps: [
+            "Open the store's Reviews tab and read one review card in full.",
+            "Pick a distinctive word that appears in that review's BODY text but not in its title and not in the product name.",
+            "Type that word into the reviews search box.",
+            "Read the results.",
+            "Clear the box and search for zzzznope.",
+            "Read the results again.",
+        ],
+        inputs: { nonsenseQuery: "zzzznope" },
+        expectedBehaviour: "Search covers the review's body. The stored field for that text is `comment`; a filter reading a differently-named field matches nothing in the body and still returns rows via the title and the product name, so it looks like a working search that is merely strict.",
+        expectedUiState: "The body word returns at least the review it came from. 'zzzznope' returns an empty state rather than the unfiltered list.",
+        expectedData: { nonsenseResultCount: 0 },
+        endResult: "Clearing the box restores the full list.",
+    },
+};

package/dist/features/tester/seed-data/authored/index.js

@@ -130,6 +130,17 @@ import { authored as a_search_and_nav__employee_permissions } from "./search-and
 import { authored as a_search_and_nav__header_search } from "./search-and-nav__header-search";
 import { authored as a_search_and_nav__settings_deep_links } from "./search-and-nav__settings-deep-links";
 import { authored as a_search_and_nav__sidebar_search } from "./search-and-nav__sidebar-search";
+import { authored as a_selling__listing_edit_roundtrip } from "./selling__listing-edit-roundtrip";
+import { authored as a_selling__digital_content_delivery } from "./selling__digital-content-delivery";
+import { authored as a_selling__seller_orders_at_scale } from "./selling__seller-orders-at-scale";
+import { authored as a_content_discovery__category_counts_and_rollup } from "./content-discovery__category-counts-and-rollup";
+import { authored as a_content_discovery__store_reviews_aggregate } from "./content-discovery__store-reviews-aggregate";
+import { authored as a_buying__order_detail_actions } from "./buying__order-detail-actions";
+import { authored as a_admin__admin_detail_round_trips } from "./admin__admin-detail-round-trips";
+import { authored as a_content_discovery__event_detail_subroutes } from "./content-discovery__event-detail-subroutes";
+import { authored as a_public_pages__newly_wired_browse_indexes } from "./public-pages__newly-wired-browse-indexes";
+import { authored as a_public_pages__store_tabs } from "./public-pages__store-tabs";
+import { authored as a_admin__firebase_function_effects } from "./admin__firebase-function-effects";
 export const AUTHORED_CASES = {
     ...a_admin__blog_faqs,
     ...a_admin__bundles,
@@ -240,4 +251,15 @@ export const AUTHORED_CASES = {
     ...a_search_and_nav__header_search,
     ...a_search_and_nav__settings_deep_links,
     ...a_search_and_nav__sidebar_search,
+    ...a_selling__listing_edit_roundtrip,
+    ...a_selling__digital_content_delivery,
+    ...a_selling__seller_orders_at_scale,
+    ...a_content_discovery__category_counts_and_rollup,
+    ...a_content_discovery__store_reviews_aggregate,
+    ...a_buying__order_detail_actions,
+    ...a_admin__admin_detail_round_trips,
+    ...a_content_discovery__event_detail_subroutes,
+    ...a_public_pages__newly_wired_browse_indexes,
+    ...a_public_pages__store_tabs,
+    ...a_admin__firebase_function_effects,
 };