@mohasinac/appkit 4.39.1 → 4.40.0

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -221,6 +221,31 @@ const rawTesterChecklistItems = [
         },
     ]),
     ...group("buying", "Buying", [
+        {
+            /*
+             * The post-purchase money surface. `/user/orders/[id]/` has five
+             * subroutes — cancel, return, track, invoice, payment — and before
+             * 2026-09-14 only `track` had a single case anywhere in the catalogue.
+             *
+             * 🛑 NO SEEDED ORDER BELONGS TO THE BOT (measured: 0 of 64). That is why
+             * the positive cases buy something first and the borrowed fixture ids are
+             * used only as the ownership NEGATIVES — which is the dimension nothing
+             * tested at all, and the one where a mistake is an IDOR rather than a
+             * cosmetic bug.
+             */
+            pageKey: "order-detail-actions",
+            pageLabel: "Order detail — cancel, return, track, invoice, payment",
+            href: "/user/orders",
+            cases: [
+                { key: "invoice-downloads-for-owner", label: "The buyer can download the invoice for their own order, and it is a real PDF" },
+                { key: "invoice-refuses-other-buyer", label: "The invoice URL for somebody else's order is refused, not served" },
+                { key: "cancel-page-refuses-delivered-order", label: "The cancel page refuses an order that is already delivered, and says why" },
+                { key: "return-request-round-trip", label: "Requesting a return moves the order to Return Requested and survives a reload" },
+                { key: "track-shows-real-dates", label: "The tracking timeline shows the order's REAL dates, not invented or blank ones" },
+                { key: "order-subroutes-404-for-other-users-order", label: "Every /user/orders/[id]/* subroute 404s for an order the signed-in user does not own" },
+                { key: "order-subroutes-redirect-guest", label: "A signed-out visitor hitting an order subroute is sent to sign in, never shown the order" },
+            ],
+        },
         {
             pageKey: "browsing-search",
             pageLabel: "Browsing & Search",
@@ -699,6 +724,24 @@ const rawTesterChecklistItems = [
                     description: "Fixed 2026-08-20 — the Razorpay pre-charge amount (computed before opening the payment modal) omitted the seller's shipping fee entirely, while the order created afterward recorded a higher total that included it, so the buyer was silently charged less via the gateway than what got recorded as owed. Only testable when Site Settings → Payments → Razorpay is enabled and the seller has a configured shipping fee. Compare the amount shown in the Razorpay modal against the order's Total on the confirmation page — they should match exactly.",
                     href: "/checkout",
                 },
+                /*
+                 * SIGNED-OUT checkout. 30 cases existed and NONE was signed-out, so the
+                 * refusal path — the single most important thing checkout does for a guest
+                 * — had no coverage at all. Only roles exactly ["guest"] reaches the guest
+                 * identity slice.
+                 */
+                {
+                    key: "checkout-guest-redirected-to-signin",
+                    label: "A signed-out visitor opening /checkout directly is sent to sign in, and is not shown a checkout form",
+                    description: "The failure to look for is a checkout that renders its steps for a signed-out visitor and only refuses at the end, after they have typed an address.",
+                    href: "/checkout",
+                },
+                {
+                    key: "checkout-guest-returns-after-signin",
+                    label: "After signing in from that prompt the visitor lands back on checkout with their cart intact, not on the homepage with an empty cart",
+                    description: "A redirect that forgets where it came from is the same as losing the sale. The guest cart must have merged into the account cart by this point.",
+                    href: "/checkout",
+                },
             ],
         },
         {
@@ -919,6 +962,22 @@ const rawTesterChecklistItems = [
                 { key: "history-revisit-reorders", label: "Re-visiting a product already in history removes the old entry and moves it to the front, rather than duplicating it" },
                 { key: "history-fifo-cap", label: "History silently evicts the oldest entry once more than 50 items have been viewed (no error shown to the user)" },
                 { key: "history-guest-merge-on-login", label: "Guest browsing history (localStorage) merges correctly with the account's history after login, deduplicated by product" },
+                /*
+                 * SIGNED-OUT wishlist. 20 cases existed, 2 signed-out, and both were about
+                 * the login MERGE rather than about what a guest sees before logging in.
+                 */
+                {
+                    key: "wishlist-guest-heart-prompts-signin",
+                    label: "A signed-out visitor tapping the heart on product-beyblade-burst-valkyrie is asked to sign in, and the heart does not appear to have saved",
+                    description: "The gate must not optimistically fill the heart before refusing — a filled heart that saved nothing is worse than a refusal, because the visitor believes the item is kept.",
+                    href: "/products/product-beyblade-burst-valkyrie",
+                },
+                {
+                    key: "wishlist-guest-page-signed-out",
+                    label: "A signed-out visitor opening /wishlist is asked to sign in rather than shown a permanently empty wishlist",
+                    description: "An empty-state that reads \"nothing saved yet\" to a signed-out visitor is indistinguishable from a wishlist whose contents were lost.",
+                    href: "/wishlist",
+                },
             ],
         },
         {
@@ -1292,6 +1351,35 @@ const rawTesterChecklistItems = [
                     description: "Hardened 2026-08-21. The add-on booleans used to be accepted in the checkout request body as well as being stored per-store on the cart, so two sources could disagree about what the buyer had actually selected — and the cart's selection is the only one the buyer ever saw. The request body no longer carries them at all. To test: tick gift wrap for seller A only, go to checkout and note the Total, press Back to the cart, then return to checkout — the same single gift-wrap fee must still be there, for seller A only, with an unchanged Total. Repeat having ticked nothing and confirm no add-on line ever appears.",
                     href: "/cart",
                 },
+                /*
+                 * SIGNED-OUT cart. Only a case whose `roles` is exactly ["guest"] is routed
+                 * into the guest identity slice, which copies an EMPTY storage state over
+                 * session.json — a two-role case runs signed in and therefore cannot test
+                 * any of this. 71 cart cases existed and 3 were signed-out.
+                 */
+                {
+                    key: "cart-guest-add-and-persist",
+                    label: "A signed-out visitor can add product-beyblade-burst-valkyrie to the cart, and it survives a full page reload",
+                    description: "The guest cart is localStorage-backed. If it does not survive a reload the visitor loses the cart between any two navigations, which is invisible to a signed-in tester.",
+                    href: "/cart",
+                },
+                {
+                    key: "cart-guest-prices-gated",
+                    label: "A signed-out visitor sees \"Sign in to see price\" rather than an amount on the cart line and in the summary",
+                    description: "Prices are gated for guests. The gate has three states and the middle one is a neutral placeholder, so the failure to look for is a FLASH of the sign-in prompt at a signed-in buyer, and a permanent amount for a signed-out one.",
+                    href: "/cart",
+                },
+                {
+                    key: "cart-guest-checkout-prompts-signin",
+                    label: "A signed-out visitor pressing the cart's checkout CTA is asked to sign in rather than being dropped on an empty checkout",
+                    href: "/cart",
+                },
+                {
+                    key: "cart-guest-group-line-refused",
+                    label: "A signed-out visitor is told to sign in when adding a grouped/bundle line, rather than the line half-appearing",
+                    description: "Group lines cannot exist in the guest cart — it is keyed {productId, quantity} only and a group line could not survive the login merge. The refusal must be explicit.",
+                    href: "/cart",
+                },
             ],
         },
         {
@@ -2100,6 +2188,62 @@ const rawTesterChecklistItems = [
         },
     ]),
     ...group("selling", "Selling", [
+        {
+            /*
+             * The UPDATE path. The create path has 57 cases on /store/products/new
+             * alone and this had ZERO — which is precisely where the 2026-09-14
+             * data-loss bug lived (Root Cause #98): nine editors spread an
+             * ActionResult envelope as a product, so the form opened blank and Save
+             * wrote "draft" over a live listing.
+             */
+            pageKey: "listing-edit-roundtrip",
+            pageLabel: "Editing an Existing Listing (round-trip)",
+            href: "/store/products",
+            cases: [
+                { key: "edit-opens-populated", label: "Opening a published listing for edit shows its REAL saved values, not an empty form" },
+                { key: "edit-category-preselected", label: "The Category field is pre-selected with the listing's actual category, not blank" },
+                { key: "edit-save-keeps-published", label: "Saving an edit to a PUBLISHED listing leaves it published — it must not drop to draft" },
+                { key: "edit-missing-id-404s", label: "Opening an edit URL for a listing id that does not exist shows 404, not a blank form" },
+                { key: "edit-other-sellers-listing-404s", label: "Opening another seller's listing id for edit shows 404" },
+                { key: "edit-ancestor-pages-after-recategorise", label: "Re-categorising a listing makes it appear on the new category's page AND on every ancestor of it" },
+            ],
+        },
+        {
+            /*
+             * The digital-content pool. Zero cases before 2026-09-14, and the pool's
+             * only writer answered 501 — so every digital-code purchase delivered
+             * nothing, silently, with the order completing normally (Root Cause #103).
+             */
+            pageKey: "digital-content-delivery",
+            pageLabel: "Digital Content — codes, QR images and files",
+            href: "/store/digital-codes",
+            cases: [
+                { key: "pool-empty-by-default", label: "A new digital-code listing shows an EMPTY pool, and warns that an empty pool delivers nothing" },
+                { key: "add-codes-bulk", label: "Pasting several codes adds them all, de-duplicates the paste, and updates the available count" },
+                { key: "buy-then-reveal-code", label: "Buying a digital-code listing and clicking Reveal shows a real code from the pool" },
+                { key: "available-count-drops-after-purchase", label: "The listing's available count DROPS by one after a purchase" },
+                { key: "claimed-entry-cannot-be-removed", label: "An entry already delivered to a buyer has no Remove button, and the API refuses to delete it" },
+                { key: "asset-download-requires-ownership", label: "The delivered asset URL refuses a guest and a non-buyer, and serves the buyer" },
+                { key: "seller-cannot-upload-non-image", label: "A seller may attach a QR image but not an arbitrary file; an admin may attach either" },
+                { key: "pool-list-never-shows-the-code", label: "The seller's pool list shows status and kind but never the code itself" },
+            ],
+        },
+        {
+            /*
+             * The seller's own order list, at a store large enough to break it. It
+             * queried `productId in [...]` against Firestore's 30-value cap, so it
+             * was a permanent 500 for the only real seller (65 products) and fine for
+             * every small store — which is why it survived.
+             */
+            pageKey: "seller-orders-at-scale",
+            pageLabel: "Seller orders — at a store with many listings",
+            href: "/store/orders",
+            cases: [
+                { key: "orders-list-loads-for-large-store", label: "The order list loads for a store with more than 30 listings" },
+                { key: "dashboard-revenue-not-zero", label: "The store dashboard shows real order counts and revenue, not zeros" },
+                { key: "orders-only-this-store", label: "The list contains only this store's orders" },
+            ],
+        },
         {
             pageKey: "become-seller",
             pageLabel: "Become a Seller & Store Setup",
@@ -2862,6 +3006,67 @@ const rawTesterChecklistItems = [
         },
     ]),
     ...group("content-discovery", "Content & Discovery", [
+        {
+            /*
+             * Event DETAIL. All 29 existing event cases stop at the index, while
+             * /events/[id]/ has four subroutes — participate, leaderboard, winner,
+             * spin-results — with none at all. Several real bugs were found on these
+             * pages by hand during the 2026-09 run, which is the usual consequence of
+             * a surface nobody has a procedure for.
+             */
+            pageKey: "event-detail-subroutes",
+            pageLabel: "Event detail — participate, leaderboard, winner, spin results",
+            href: "/events",
+            cases: [
+                { key: "detail-tabs-match-event-type", label: "An event's tabs match its TYPE — a poll shows no spin results, a sale shows no leaderboard" },
+                { key: "participate-records-an-entry", label: "Participating records an entry that is still there after a reload" },
+                { key: "participate-twice-is-refused", label: "Participating a second time is refused with a reason, not silently duplicated" },
+                { key: "leaderboard-ranks-by-a-real-number", label: "The leaderboard ranks by a real score and shows the same entry count the event reports" },
+                { key: "winner-page-before-draw", label: "The winner page on an undrawn event says so — it must not show a blank or a fabricated winner" },
+                { key: "winner-page-after-draw", label: "An ended raffle's winner page names the real winner recorded on the event" },
+                { key: "cancelled-event-refuses-participation", label: "A cancelled event cannot be participated in, and says why" },
+                { key: "guest-sees-event-but-is-prompted", label: "A signed-out visitor can read an event but is prompted to sign in to take part" },
+            ],
+        },
+        {
+            /*
+             * Category counts and the LISTING they promise. A category's number is its
+             * own items plus every descendant's, and clicking it must list exactly
+             * those items. Both halves were wrong: the nightly reconciler could not
+             * express own-vs-rollup (Root Cause #102), and the chips showed own while
+             * the header showed rollup.
+             */
+            pageKey: "category-counts-and-rollup",
+            pageLabel: "Category counts and the listing they promise",
+            href: "/categories",
+            cases: [
+                { key: "leaf-count-matches-its-listing", label: "A leaf category's count equals the number of products its own page lists" },
+                { key: "parent-count-includes-descendants", label: "A parent's count is its own items PLUS every descendant's, not just its own" },
+                { key: "parent-listing-includes-descendant-items", label: "Opening a parent category LISTS the descendants' items too, not only its own" },
+                { key: "header-and-child-chips-agree", label: "The header count and the child chips beneath it are the same kind of number and compose" },
+                { key: "root-count-is-the-whole-subtree", label: "A root category's count equals the sum over its whole subtree" },
+                { key: "sibling-isolation", label: "A sibling branch's items are NOT counted in the other sibling" },
+                { key: "guest-sees-the-same-counts", label: "A signed-out visitor sees the same category counts as a signed-in one" },
+                { key: "brand-count-matches-its-listing", label: "A brand page's count equals what that brand page lists" },
+            ],
+        },
+        {
+            /*
+             * Store reviews. The endpoint answered 200 with zero reviews for EVERY
+             * store while 79 approved ones existed, because it ordered products by a
+             * field no product has (Root Cause #100) — and once it returned rows it
+             * returned the raw document, ciphertext name and all.
+             */
+            pageKey: "store-reviews-aggregate",
+            pageLabel: "Store reviews tab — aggregate and privacy",
+            href: "/stores",
+            cases: [
+                { key: "reviews-tab-not-empty", label: "A store with reviews shows them on its Reviews tab — the tab must not read as empty" },
+                { key: "average-matches-the-rows", label: "The average rating and the star distribution agree with the reviews listed" },
+                { key: "reviewer-name-is-masked", label: "A reviewer's name is masked, and no encrypted value or internal field is visible" },
+                { key: "review-search-matches-body-text", label: "Searching the reviews matches a word from a review's BODY, and a nonsense term returns none" },
+            ],
+        },
         {
             pageKey: "blog",
             pageLabel: "Blog",
@@ -3928,6 +4133,53 @@ const rawTesterChecklistItems = [
         },
     ]),
     ...group("public-pages", "Public & Marketing Pages", [
+        {
+            /*
+             * The six browse pages wired into the footer on 2026-09-14. Each shipped
+             * with a real page and a real ROUTES.PUBLIC constant and NO link from
+             * anywhere — reachable only by typing the URL — so none has ever had a
+             * case (Root Cause #37).
+             *
+             * Every one gets a guest case: a signed-out visitor is their commonest
+             * caller, and /products' own scoping rules mean an out-of-span type chip
+             * silently WIDENS results rather than narrowing them.
+             */
+            pageKey: "newly-wired-browse-indexes",
+            pageLabel: "Classifieds, Digital Codes, Live, Lotteries, Brands, Sellers",
+            href: "/classified",
+            cases: [
+                { key: "all-six-reachable-from-footer", label: "All six pages are reachable by clicking the footer, not only by typing the URL" },
+                { key: "classified-lists-only-classifieds", label: "/classified lists classified listings and nothing of another type" },
+                { key: "digital-codes-lists-only-digital", label: "/digital-codes lists digital-code listings and nothing of another type" },
+                { key: "live-lists-only-live", label: "/live lists live-item listings and nothing of another type" },
+                { key: "lottery-lists-active-lotteries", label: "/lottery lists active lottery events with their slot counts" },
+                { key: "brands-tiles-open-their-brand", label: "Each /brands tile opens that brand's page and lists that brand's products" },
+                { key: "sellers-is-not-a-copy-of-stores", label: "/sellers shows verified sellers and is visibly a different page from /stores" },
+                { key: "guest-can-browse-all-six", label: "A signed-out visitor can browse all six, with prices gated rather than the page broken" },
+            ],
+        },
+        {
+            /*
+             * The store's own tabs. Nine of them are untested, starting with
+             * `products` — which is the DEFAULT tab, i.e. the first thing anyone sees
+             * after clicking a store.
+             *
+             * The reviews tab is deliberately included: it answered 200 with zero
+             * reviews for every store until 2026-09-14 (Root Cause #100), and the
+             * only symptom was a sentence that reads as a fact about the store.
+             */
+            pageKey: "store-tabs",
+            pageLabel: "Store page tabs — products, reviews, and the per-type tabs",
+            href: "/stores/store-beyblade-arena",
+            cases: [
+                { key: "default-tab-lists-products", label: "Opening a store lands on Products and lists that store's listings" },
+                { key: "each-tab-lists-only-its-type", label: "Each per-type tab lists only that listing type" },
+                { key: "empty-tab-says-empty", label: "A tab with nothing in it shows an empty state, not a spinner or a blank panel" },
+                { key: "tab-survives-a-reload", label: "Reloading on a tab stays on that tab rather than bouncing to Products" },
+                { key: "store-tabs-hide-other-stores-items", label: "No tab shows a listing belonging to a different store" },
+                { key: "coupons-tab-shows-this-stores-coupons", label: "The Coupons tab shows this store's coupons and not the platform-wide ones" },
+            ],
+        },
         {
             pageKey: "core-listing-pages",
             pageLabel: "Homepage & Core Listing Pages",
@@ -4081,6 +4333,60 @@ const rawTesterChecklistItems = [
                     href: "/how-emi-works",
                 },
                 { key: "fees-page", label: "The fees page loads correctly", href: "/fees" },
+                /*
+                 * The blanket case above asserts all seven how-it-works pages LOAD. These
+                 * seven assert each one is TRUE — the guide is read, then the feature it
+                 * describes is opened and compared. A guide is documentation with no
+                 * compiler behind it, so the only thing that catches drift is someone
+                 * doing both halves in one sitting; "it loads" passes against every stale
+                 * sentence on it.
+                 */
+                {
+                    key: "how-auctions-work-matches-product",
+                    label: "What /how-auctions-work says about bidding, increments and what happens at the end matches a real auction page",
+                    description: "Compare against auction-beyblade-original-dragoon-storm. Anti-snipe, minimum increment and reserve behaviour are the three the guide is most likely to have stale.",
+                    href: "/how-auctions-work",
+                },
+                {
+                    key: "how-checkout-works-matches-product",
+                    label: "What /how-checkout-works describes as the checkout steps matches the steps checkout actually presents",
+                    description: "Checkout is Address -> Add-ons & fees -> Payment. A guide still describing a two-step checkout sends a buyer looking for a screen that is not there.",
+                    href: "/how-checkout-works",
+                },
+                {
+                    key: "how-offers-work-matches-product",
+                    label: "What /how-offers-work says about making, countering and accepting an offer matches the offer flow on a real listing",
+                    description: "The guide must not promise the seller can counter more rounds than the product allows, and must name the same expiry behaviour the offer actually has.",
+                    href: "/how-offers-work",
+                },
+                {
+                    key: "how-orders-work-matches-product",
+                    label: "The order statuses named on /how-orders-work are the statuses an order can actually hold",
+                    description: "A status named in the guide that the product never sets is the tell. Compare against the status filter chips on /user/orders.",
+                    href: "/how-orders-work",
+                },
+                {
+                    key: "how-payouts-work-matches-product",
+                    label: "The payout schedule and deductions described on /how-payouts-work match what a seller's payouts page shows",
+                    href: "/how-payouts-work",
+                },
+                {
+                    key: "how-pre-orders-work-matches-product",
+                    label: "What /how-pre-orders-work says about deposits and cancellation matches a real pre-order listing",
+                    description: "Compare against preorder-beyblade-x-bx-08-wave. Deposit wording and cancellability are the two that drift.",
+                    href: "/how-pre-orders-work",
+                },
+                {
+                    key: "how-reviews-work-matches-product",
+                    label: "What /how-reviews-work says about who may review and when matches what the review form actually enforces",
+                    href: "/how-reviews-work",
+                },
+                {
+                    key: "track-order-page-works",
+                    label: "The order-tracking page at /track is reachable from the footer and does something useful for both a real order id and a nonsense one",
+                    description: "Linked from the footer's Support group and has no checklist coverage at all. The nonsense id is the control: a page that reports 'found' for every input is not looking anything up.",
+                    href: "/track",
+                },
             ],
         },
         {
@@ -4221,6 +4527,45 @@ const rawTesterChecklistItems = [
                     label: "Opening the new-item-request page directly shows the form already open, and a submitted request appears in the item-requests list",
                     href: "/item-requests/new",
                 },
+                /*
+                 * The three blanket cases above cover the four help sub-pages as a set —
+                 * they load, they are linked both ways, their content differs from the
+                 * parent's. These four address each page on its own terms and against the
+                 * feature it documents, which is the half no "does it load" case reaches.
+                 */
+                {
+                    key: "help-account-matches-product",
+                    label: "What /help/account says about changing a password, an email and closing an account matches what /user/settings actually offers",
+                    description: "Password change is a Firebase reset LINK, not an in-page form. A help page describing an in-page form sends the user hunting for a control that does not exist.",
+                    href: "/help/account",
+                },
+                {
+                    key: "help-auctions-matches-product",
+                    label: "What /help/auctions tells a buyer about bidding and losing matches what an auction page and /user/bids actually do",
+                    href: "/help/auctions",
+                },
+                {
+                    key: "help-orders-matches-product",
+                    label: "What /help/orders says about cancelling, returning and tracking matches the actions on a real order's page",
+                    description: "Compare against the row actions on /user/orders. An action the help page names but the order page does not offer is the finding.",
+                    href: "/help/orders",
+                },
+                {
+                    key: "help-shopping-matches-product",
+                    label: "What /help/shopping says about carts, wishlists and coupons matches what those surfaces do for a signed-in buyer",
+                    href: "/help/shopping",
+                },
+                {
+                    key: "seller-guide-bundles-matches-product",
+                    label: "What /seller-guide/bundles promises matches what the seller bundle editor actually allows",
+                    description: "A bundle's members must all belong to one store — that is refused at save time. A guide that does not say so invites a seller to build a bundle that cannot be saved.",
+                    href: "/seller-guide/bundles",
+                },
+                {
+                    key: "seller-guide-prize-draws-matches-product",
+                    label: "What /seller-guide/prize-draws promises about entries, reveal and refunds matches the prize-draw a seller can actually create",
+                    href: "/seller-guide/prize-draws",
+                },
             ],
         },
         {
@@ -4412,6 +4757,30 @@ const rawTesterChecklistItems = [
         },
     ]),
     ...group("admin", ADMIN_TESTING_GROUP_LABEL, [
+        {
+            /*
+             * Admin detail routes. 33 `[id]` directories under admin/ and almost all
+             * of them sit at zero.
+             *
+             * Written as ROUND TRIPS — open, change one field, save, RELOAD, then
+             * check the fields you did NOT touch. That shape is what catches an
+             * editor seeded from the wrong object: a form that opens blank and saves
+             * its own emptiness passes any case that only asks whether the page
+             * loads (Root Cause #98).
+             */
+            pageKey: "admin-detail-round-trips",
+            pageLabel: "Admin detail pages — view and edit round-trips",
+            href: "/admin/products",
+            cases: [
+                { key: "coupon-edit-round-trip", label: "Editing one field of a coupon saves it and leaves every other field intact after a reload" },
+                { key: "faq-edit-preserves-answer-shape", label: "Editing an FAQ's answer keeps it rendering as rich text, not as raw markup or a blank" },
+                { key: "category-edit-keeps-hierarchy", label: "Renaming a category leaves its parent, its children and its product count unchanged" },
+                { key: "user-edit-keeps-tester-flags", label: "Saving an unrelated field on a tester account does NOT clear its tester flags" },
+                { key: "store-edit-keeps-verified", label: "Saving an unrelated field on a verified store does NOT un-verify it" },
+                { key: "order-view-matches-drawer", label: "An order's full page shows the same items, address, payment and status as its row drawer" },
+                { key: "admin-detail-missing-id-404s", label: "An admin detail URL for an id that does not exist shows 404, not an empty editor" },
+            ],
+        },
         {
             pageKey: "catalog-listings",
             pageLabel: "Catalog & Listings",
@@ -5423,6 +5792,108 @@ const rawTesterChecklistItems = [
                 },
             ],
         },
+        {
+            /*
+             * Step H. 55 Firebase functions — 28 scheduled, 20 Firestore triggers,
+             * 7 HTTPS — and no checklist coverage at all.
+             *
+             * Every case here tests an EFFECT, never a function. A case that says
+             * "wait for the cron" is untestable in a session and will be answered
+             * null forever; a case that reads the document the cron is supposed to
+             * have written is answerable in seconds. The functions are deployed
+             * infrastructure, so the only honest question a tester can ask is
+             * "did the thing it is responsible for actually happen".
+             */
+            pageKey: "firebase-function-effects",
+            pageLabel: "Firebase Functions — observable effects",
+            href: "/admin/maintenance",
+            cases: [
+                {
+                    key: "function-invocation-health-per-function",
+                    label: "The Firebase console's per-function invocation counts show no single function running away from the rest",
+                    description: "This is the case that would have caught Root Cause #92: onShipmentHeaderWrite self-triggered 1,017,548 times in 24h against a 2M/month free quota, while every other function sat at 0-95. The AGGREGATE number never names the culprit — read the PER-FUNCTION breakdown, sort by invocations, and compare the top entry against the rest.",
+                    href: "/admin/maintenance",
+                },
+                {
+                    key: "function-errors-page-has-no-producer",
+                    label: "The function-errors page is EMPTY, and that is a known gap rather than a clean bill of health",
+                    description: "BEFORE: /admin/maintenance/function-errors renders a list. AFTER: it is empty — and it will be empty no matter what breaks, because nothing in production writes a serverErrors row with source:\"function\". wrapJobHandler is the only producer and it is referenced solely by its own test. Answer NO with that reasoning: a case reading \"check errors appear here\" would pass vacuously against a surface that can never populate.",
+                    href: "/admin/maintenance/function-errors",
+                },
+                {
+                    key: "https-function-401-is-healthy-500-is-not",
+                    label: "Each deployed HTTPS function answers 401 unauthenticated, never 500",
+                    description: "There are 7: adminAnalytics, storeAnalytics, promotionsApi, listingProcessor, triggerEventRaffle, assignSpinPrize, gateway. A 401 means the module loaded and the auth gate ran — that is HEALTHY. A 500 means the module failed to load at cold start, which is how Root Cause #69 took every route down while the build was green.",
+                    href: "/admin/maintenance",
+                },
+                {
+                    key: "counters-reconcile-effect-category-counts",
+                    label: "Category product counts on /categories agree with a recount of the products actually filed under each",
+                    description: "countersReconcile runs nightly and is what keeps metrics.productCount (own) and metrics.totalProductCount (own + descendants) honest. Root Cause 102: it could not express the two separately and wrote one number to both, so 19 of 65 rows disagreed with a recount, every one low. Pick the root category and one leaf, count the listings each actually shows, and compare against the displayed count.",
+                    href: "/categories",
+                },
+                {
+                    key: "revenue-rollup-effect-dashboard-reads-one-doc",
+                    label: "The admin dashboard's revenue figures are present and plausible without the page scanning every order",
+                    description: "revenueRollup pre-aggregates nightly into a singleton so the dashboard is a single-doc read rather than a full-collection scan — that is the pattern protecting the 50K/day Firestore read quota. A dashboard showing zero revenue while real delivered orders exist means the rollup did not run or wrote the wrong shape.",
+                    href: "/admin",
+                },
+                {
+                    key: "auction-settlement-effect-winner-gets-payable-line",
+                    label: "A settled auction produces a winner who can actually pay — a locked cart line, not an unpayable order",
+                    description: "Root Cause #60: auctionSettlement used to write a document to the orders collection that was not an OrderDocument, so the win rendered nowhere and no checkout would accept it — there was no way in the product for a winner to pay. The effect to check is a LOCKED line in the winner's cart that reaches checkout via the auction lane.",
+                    href: "/user/orders",
+                },
+                {
+                    key: "offer-expiry-effect-lapsed-offer-frees-the-cart",
+                    label: "An offer past its deadline is no longer actionable, and its lapse does not leave a locked line blocking the buyer's cart",
+                    description: "runOfferExpiry sweeps three things in one pass — pending offers past expiresAt, ACCEPTED offers past checkoutDeadline, and unpaid auction wins. The offer lane outranks the standard lane, so a leftover locked line blocks the buyer's ENTIRE cart, not just that offer.",
+                    href: "/user/offers",
+                },
+                {
+                    key: "payment-window-timeout-effect-expired-proof-window",
+                    label: "A manual-payment order left past its 15-minute window is resolved by the sweep rather than sitting pending forever",
+                    description: "paymentWindowTimeout and paymentReviewAutoApprove are the two sweeps that stop a manual payment stalling indefinitely. The observable effect is the order's own status and its payment panel — check one that is past its deadline.",
+                    href: "/admin/orders",
+                },
+                {
+                    key: "rtdb-event-channels-are-pruned",
+                    label: "The realtime event channels are not accumulating — auth, payment and bulk event nodes are pruned",
+                    description: "cleanupRtdbEvents prunes auth_events/payment_events/bulk_events at 3/15/15 minutes and email_events at 1 hour. The email one is deliberately longest because a batch can take ten minutes between triggering a send and asserting on it, and a ping deleted mid-batch reads as \"no email was sent\".",
+                    href: "/admin/maintenance",
+                },
+                {
+                    key: "media-tmp-cleanup-effect-aborted-uploads-removed",
+                    label: "An aborted media upload does not leave a permanent orphan under the tmp/ prefix",
+                    description: "Uploads land in tmp/ and are moved to a permanent path by finalize; mediaTmpCleanup removes whatever never finalised. Start an upload, abandon it before finalize, and confirm nothing renders it as a real asset.",
+                    href: "/admin/media",
+                },
+                {
+                    key: "product-write-trigger-effect-stock-and-groups",
+                    label: "Changing a product's stock updates its listing availability and any grouped listing it belongs to, without a manual refresh elsewhere",
+                    description: "onProductWrite / onProductStockChange recompute derived state — a grouped listing's activeMemberCount and visibilityStatus, and bundle sync. The effect is visible on the group or bundle, not on the product you edited.",
+                    href: "/admin/products",
+                },
+                {
+                    key: "order-create-trigger-effect-staff-signal",
+                    label: "A newly created order produces a staff-visible signal rather than only a row in the orders table",
+                    description: "onOrderCreate is expected to leave something an operator can notice. Staff signal is a durable record read by the admin inbox and counted by the daily digest — one row, not a personal notification per employee.",
+                    href: "/admin/orders",
+                },
+                {
+                    key: "shipment-trigger-no-op-guard-holds",
+                    label: "Saving a procurement shipment twice with no change does NOT produce a second recomputation",
+                    description: "This is Root Cause #92's exact mechanism. onShipmentHeaderWrite writes back to the collection it watches; its only brake is a no-op guard, and that guard compared with JSON.stringify — which is key-order sensitive, while Firestore returns map fields alphabetically. The strings could never match, so every write re-triggered. Save an unchanged shipment and confirm totalsComputedAt does not move.",
+                    href: "/admin/shipments",
+                },
+                {
+                    key: "scheduled-job-count-matches-registry",
+                    label: "The number of Cloud Scheduler jobs matches the number of scheduled functions actually defined",
+                    description: "28 scheduled functions means 28 Scheduler jobs, billed per registered job. This count has drifted four separate times, so RECOUNT rather than quoting a number: a job in Scheduler with no matching function is paid-for and dead, and a function with no job never runs.",
+                    href: "/admin/maintenance",
+                },
+            ],
+        },
     ], { adminOnly: true }),
     // Demo fixture pair — deliberately outside group() since these two items
     // exercise the confirm-bug → reopen-as-new-version lifecycle directly