@mohasinac/appkit 4.42.1 → 4.42.3

package/dist/features/tester/seed-data/authored/search-and-nav__settings-deep-links.js

@@ -13,6 +13,37 @@
  * @tag consumers:seed-data/authored/index.ts
  * @tag sideEffects:none
  */
+/*
+ * Verified on 2026-09-29, and both cases are right, including the detail most
+ * likely to be wrong: the default really IS branding. `activeTab` is
+ *
+  *   useState(() => { if (typeof window === "undefined") return "branding";
+  *                    const requested = new URLSearchParams(...).get("tab");
+  *                    return isSiteSettingsTabId(requested) ? requested : "branding"; })
+ *
+ * so an unknown or empty value falls through to branding with no complaint,
+ * which is exactly what the second case asserts. The tab id is validated
+ * against the union rather than trusted.
+ *
+ * 🛑 DO NOT infer the default from the JSX. `about` is the first
+ * SettingsTabForm in the file, so reading the markup suggests the page opens
+ * there; it does not, because the default is explicit state. The 20 valid ids
+ * in declaration order are:
+ *
+ *   about branding appearance themes announcement seo contact watermark fees
+ *   integrations shipping auction limits legal whatsapp notifications
+ *   procurement emi gst listings
+ *
+ * 🛑 AND THE FIRST PAINT IS ALWAYS BRANDING. The initialiser returns branding
+ * when `window` is undefined, so the server-rendered tab is branding and the
+ * URL's tab is applied on hydration. On a slow load a tester can briefly see
+ * Branding before Fees appears. That is the deep link working, not failing,
+ * and the case now says so rather than leaving it to be reported.
+ *
+ * Note `ADMIN_SETTINGS_TABS` is a DIFFERENT registry {actions, navigation} for
+ * /admin/settings/*. The guard that matters here is `isSiteSettingsTabId` in
+ * site-settings-tabs.ts; chasing the wrong constant leads to a two-tab list.
+*/
 export const authored = {
     "checklist-search-and-nav-settings-deep-links-tab-query-param-opens-that-tab": {
         roles: ["admin"],
@@ -20,7 +51,7 @@ export const authored = {
         steps: [
             "Sign in as admin@letitrip.in / TempPass123!.",
             "Open /admin/site?tab=fees directly in the address bar.",
-            "Read which tab is selected.",
+            "Read which tab is selected, waiting for hydration before judging — the first paint is always Branding.",
             "Open /admin/site?tab=themes directly.",
             "Read which tab is selected.",
             "Open /admin/site with no query parameter.",
@@ -28,8 +59,8 @@ export const authored = {
         ],
         inputs: { tab1: "fees", tab2: "themes" },
         expectedBehaviour: "The open tab is read from the URL, so a deep link — from search, from a guide, from a colleague's message — lands where it says it will. A page that hard-codes its default ignores the URL entirely and every such link arrives on tab one.",
-        expectedUiState: "?tab=fees opens the Fees tab with its fields on screen. ?tab=themes opens Themes. With no parameter the page opens on Branding. Two different parameters producing the same tab means the URL is not being read.",
-        expectedData: { defaultTab: "branding" },
+        expectedUiState: "?tab=fees opens the Fees tab with its fields on screen. ?tab=themes opens Themes. With no parameter the page opens on Branding. Two different parameters producing the same tab means the URL is not being read — but a MOMENT of Branding before the requested tab is hydration, not a failure: the server-rendered default is always Branding because the initialiser cannot read the URL without a window.",
+        expectedData: { defaultTab: "branding", validTabCount: 20 },
         endResult: "Read-only; do not save anything. Nothing persists from opening a tab.",
     },
     "checklist-search-and-nav-settings-deep-links-unknown-tab-falls-back-quietly": {
@@ -43,8 +74,8 @@ export const authored = {
             "Read which tab is selected.",
         ],
         inputs: { unknownTab: "nonsense" },
-        expectedBehaviour: "An unrecognised tab value falls back to the default without complaint. The realistic cause is a stale bookmark from a tab that has since been renamed, and that is not an error condition — it is a page whose shape changed.",
-        expectedUiState: "Both URLs open Branding. No error banner, no toast, no empty tab strip and no blank panel. A rejected value must not look like a broken page.",
+        expectedBehaviour: "An unrecognised tab value falls back to the default without complaint, because the id is validated against the 20-value union rather than trusted. The realistic cause is a stale bookmark from a tab that has since been renamed, and that is not an error condition — it is a page whose shape changed.",
+        expectedUiState: "Both URLs open Branding. No error banner, no toast, no empty tab strip and no blank panel. A rejected value must not look like a broken page. Worth trying one more: ?tab=Fees with a capital F, since the guard is an exact match against the union and so should also fall back rather than open Fees.",
         expectedData: { fallbackTab: "branding" },
         endResult: "Read-only; nothing persists.",
     },

package/dist/features/tester/seed-data/authored/search-and-nav__sidebar-search.js

@@ -13,6 +13,26 @@
  * @tag consumers:seed-data/authored/index.ts
  * @tag sideEffects:none
  */
+/*
+ * Counted against ADMIN_NAV_GROUPS on 2026-09-29, because the case named three
+ * entries and the query returns five, in TWO groups:
+ *
+ *   Trust & Safety   Banned Addresses   keywords: blocklist, fraud, ban
+ *                    Address Clusters   description AND keywords
+ *                    Payment Clusters   keywords: fraud, duplicates, linked accounts
+ *                    Scam Registry      keywords: fraud, blocklist, report
+ *   Guides           Trust & Safety Guide   description AND keywords
+ *
+ * 🛑 The two the case omitted are the ones a tester would have to judge.
+ * Seeing Banned Addresses and a GUIDE come back for 'fraud' looks like
+ * over-matching when the case promised three specific entries, and the honest
+ * reading is the opposite: the guide is a description-and-keyword hit, which is
+ * exactly the behaviour under test. Note Payment METHODS does not match and
+ * Payment CLUSTERS does; they are adjacent in the sidebar and easy to confuse.
+ *
+ * Groups keep their declared order and only their contents narrow, so both
+ * headings stay and Trust & Safety stays above Guides.
+*/
 export const authored = {
     "checklist-search-and-nav-sidebar-search-sidebar-search-matches-description": {
         roles: ["admin"],
@@ -21,15 +41,20 @@ export const authored = {
             "Sign in as admin@letitrip.in / TempPass123!.",
             "Open /admin and read the sidebar's group headings in order.",
             "Type fraud in the sidebar search box.",
-            "Read which entries remain and which groups they sit under.",
+            "Read which entries remain, count them, and note which group heading each sits under.",
             "Clear the box and type zzzznope.",
             "Read the sidebar.",
             "Clear the box and read the group order again.",
         ],
-        inputs: { query: "fraud", nonsenseQuery: "zzzznope" },
+        inputs: {
+            query: "fraud",
+            nonsenseQuery: "zzzznope",
+            expectedMatches: 5,
+            expectedGroups: 2,
+        },
         expectedBehaviour: "The filter matches a screen's description and keywords, not only its label. Matching on the label alone means only a screen with 'fraud' in its name survives the query — and none is named that.",
-        expectedUiState: "'fraud' leaves Scam Registry, Address Clusters and Payment Clusters visible, each still under its own group heading. Groups keep their normal order; only their contents narrow. 'zzzznope' empties the sidebar rather than leaving it unfiltered. Clearing the box restores every group in the original order.",
-        expectedData: { nonsenseVisibleCount: 0 },
+        expectedUiState: "'fraud' leaves FIVE entries across TWO groups: Banned Addresses, Address Clusters, Payment Clusters and Scam Registry under Trust & Safety, and Trust & Safety Guide under Guides. The guide is a legitimate hit — it matches on description and keywords, which is the behaviour under test, not over-matching. Payment Methods must NOT appear; only Payment Clusters carries the keyword, and the two sit next to each other. Groups keep their normal order and only their contents narrow. 'zzzznope' empties the sidebar rather than leaving it unfiltered. Clearing the box restores every group in the original order.",
+        expectedData: { nonsenseVisibleCount: 0, fraudMatchCount: 5, fraudGroupCount: 2 },
         endResult: "Nothing persists; the filter is local to the sidebar and resets on reload.",
     },
 };

package/dist/features/tester/seed-data/authored/selling__become-seller.js

@@ -11,6 +11,29 @@
  * classic half-fix: the seller sees an approved dashboard while every public
  * visibility check reads the store's, so the store never appears anywhere.
  *
+ * 🛑 THIS CHAIN IS ONE-SHOT AND LEAVES karthik.new@gmail.com A SELLER FOREVER.
+ * Read this before running it a second time, because the second run does not
+ * fail — it tests something else while looking the same.
+ *
+ * `users` is PRESERVE tier, so the tester lifecycle never wipes it. `stores` is
+ * SEED_OWNED, so it IS wiped. After one run karthik therefore holds
+ * `role: seller` and a `storeStatus` with NO STORE — a half-state neither
+ * `sell-redirect` (which needs "a buyer with no store") nor `apply-seller`
+ * (which needs someone who has not applied) is written for.
+ *
+ * A users reseed only half-fixes it: the seed declares `role`, so that is
+ * restored — but it does NOT declare `storeStatus`, and `appkit-seed load` is a
+ * merge write that cannot REMOVE a key it does not carry. The leftover status
+ * survives every reseed. Clearing it needs a deliberate field delete.
+ *
+ * So before re-running this page:
+ *   1. delete `storeStatus` (and `storeId`, if set) from user-karthik-new
+ *   2. npx appkit-seed load --collections users   (restores role)
+ *
+ * The honest alternative is a fresh QA signup per run, as
+ * account-auth/signup-login does with its run-stamped address — but that leaks
+ * a permanent account each time, which is its own cost.
+ *
  * @tag domain:tester
  * @tag layer:seed
  * @tag pattern:none

package/dist/features/tester/seed-data/authored/selling__final-sale-authoring.js

@@ -24,13 +24,14 @@ export const authored = {
         startPage: "/store/products/new",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open /store/products/new and find the final-sale control without touching it.",
-            "Read its state.",
-            "Open the auction creation form and read the same control's state.",
-            "Open the pre-order and classified creation forms and read it in each.",
+            "Open /store/products/new and go to the Returns step WITHOUT touching anything. The control is a toggle labelled 'Accept change-of-mind returns' — there is none named 'final sale' — and it stores the INVERSE: toggle OFF means finalSale, which is the default.",
+            "Click 'Show all fields (advanced)' first — the quick form has no Returns step, so the toggle below is not on screen until you switch.",
+            "Read its state. Expect it OFF, meaning final sale is on.",
+            "Open /store/auctions/new and read the same toggle's state.",
+            "Open /store/pre-orders/new and /store/classified/new and read it in each.",
         ],
         expectedBehaviour: "Final sale is on by default on every listing type, so a seller who never opens the setting is protected rather than silently exposed to returns they did not agree to.",
-        expectedUiState: "The control reads as on in every creation form checked, before any interaction. A type whose default differs is the finding, named by type.",
+        expectedUiState: "The 'Accept change-of-mind returns' toggle reads OFF in all four creation forms before any interaction — OFF is what makes the listing final sale. A type whose default differs is the finding, named by type. Remember the polarity when recording: a toggle that reads ON here means returns ARE accepted, which is the opposite of the expected default.",
         expectedData: { defaultFinalSale: true },
         endResult: "Leave every editor without saving. This case cannot distinguish a real default from a field that fails to load — that is what the next case is for.",
     },
@@ -40,11 +41,11 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products and open the editor for 'Beyblade Burst B-01 Valkyrie'.",
-            "Turn the final-sale control OFF.",
+            "Turn final sale OFF. 🛑 THE CONTROL IS INVERTED AND RENAMED: there is no switch labelled 'Final sale'. It is a toggle reading 'Accept change-of-mind returns', in the Returns step, and turning final sale OFF means turning that toggle ON. Its OFF state is the default and stores finalSale as final-sale.",
             "Save and read the confirmation.",
             "RELOAD the editor and read the control's state.",
-            "Open the product's public page and read whether a final-sale badge is shown.",
-            "Turn the control back on, save, and reload to confirm.",
+            "Open /products/product-beyblade-burst-valkyrie and read whether a 'Final Sale' badge is shown — that is the badge's exact label.",
+            "Turn the 'Accept change-of-mind returns' toggle back OFF — restoring final sale, which is the seeded default — then save and reload to confirm.",
         ],
         inputs: { productId: "product-beyblade-burst-valkyrie", finalSale: false },
         expectedBehaviour: "Turning the flag off persists. Off is the only testable direction: a field that never saves reads back as its on default, so a case that only ever turns it ON passes against a completely broken save.",
@@ -58,11 +59,11 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open the editor for 'Beyblade Burst B-01 Valkyrie' and find the return-policy field.",
-            "Turn final sale off so returns are permitted.",
+            "Turn ON the toggle labelled 'Accept change-of-mind returns' in the Returns step — that is what turns final sale off. There is no control named 'final sale'; the switch is deliberately phrased positively so its ON state never means fewer buyer rights.",
             "Type 'QA Return Policy authorable — 7 days, unopened only.' into the policy field and save.",
             "RELOAD the editor and read the field.",
-            "Open the product's public page in a private window and find the return policy.",
-            "Restore the original policy and turn final sale back on.",
+            "Open /products/product-beyblade-burst-valkyrie in a private window and find the return policy.",
+            "Restore the original policy and turn the 'Accept change-of-mind returns' toggle back OFF, which restores final sale.",
         ],
         inputs: {
             productId: "product-beyblade-burst-valkyrie",
@@ -81,8 +82,8 @@ export const authored = {
             "Open /admin/products, open the same product, and turn final sale OFF.",
             "Save and reload the admin editor to confirm.",
             "Sign out and sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open the seller editor for the same product and read the control.",
-            "Open the public page and read whether the badge is shown.",
+            "Open that product's SELLER editor at /store/products/{id}/edit and read the 'Accept change-of-mind returns' toggle — the admin form names the field directly while the seller form inverts and renames it, which is the disagreement this case is for.",
+            "Open that product's public page at /products/{its slug} and read whether the 'Final Sale' badge is shown.",
         ],
         inputs: { productId: "product-beyblade-burst-valkyrie" },
         expectedBehaviour: "An admin override reaches the same stored field the seller edits, so both dashboards and the public page agree afterwards. An override held somewhere else would leave the seller's editor showing one answer and the buyer seeing another — and the buyer's is the one that binds.",

package/dist/features/tester/seed-data/authored/selling__listing-a-product.js

@@ -24,11 +24,12 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and publish with every field empty, reading where the errors land.",
+            "Click 'Show all fields (advanced)' first. 🛑 /store/products/new opens the QUICK form for a standard create: its image control is a single-value field labelled 'Product Image' — no gallery, no multi-select, no crop editor, no video field and no brand. Anything beyond one plain image needs the advanced form.",
             "Type 'QA Product list-standard' as the title and 750 as the price.",
             "Select a category and a brand, set the stock to 5, and write a description.",
             "Upload public/test-media/sample-image.png as the main image.",
             "Publish.",
-            "Open the product's public page and read its title, price, stock badge and images.",
+            "Open the product's public page at /products/{its slug} and read its title, price, stock badge and images.",
         ],
         inputs: { title: "QA Product list-standard", price: 750, stock: 5, image: "public/test-media/sample-image.png" },
         expectedBehaviour: "A standard listing is created and becomes publicly visible. The slug is derived from the title at creation and is then immutable — the update schema does not accept it, which is the deliberate convention across categories, brands and bundles and is what keeps existing links working.",
@@ -40,11 +41,11 @@ export const authored = {
         startPage: "/store/auctions/new",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open the auction creation form and type 'QA Auction list-auction' as the title.",
+            "Open /store/auctions/new and type 'QA Auction list-auction' as the title.",
             "Set the starting bid to 1000, the minimum increment to 100, and an end date two days out.",
             "Upload public/test-media/sample-image.png and fill every other required field.",
             "Publish.",
-            "Open the auction's public page and read the starting bid, increment, countdown and purchase controls.",
+            "Open the auction's public page at /auctions/{its slug} and read the starting bid, increment, countdown and purchase controls.",
             "Delete the auction.",
         ],
         inputs: {
@@ -62,11 +63,11 @@ export const authored = {
         startPage: "/store/pre-orders/new",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open the pre-order creation form and type 'QA Pre-order list-preorder' as the title.",
+            "Open /store/pre-orders/new and type 'QA Pre-order list-preorder' as the title.",
             "Set the price to 1200, the deposit percentage to 25, an estimated delivery date a month out, and the production status.",
             "Upload public/test-media/sample-image.png and fill every other required field.",
             "Publish.",
-            "Open the pre-order's public page and read the price, deposit note, delivery date and status badge.",
+            "Open the pre-order's public page at /pre-orders/{its slug} and read the price, deposit note, delivery date and status badge.",
             "Delete the pre-order.",
         ],
         inputs: {
@@ -89,7 +90,7 @@ export const authored = {
             "Write down every field's current value.",
             "Change the price to 850 and nothing else.",
             "Save, then RELOAD the editor and compare every field against what was written down.",
-            "Open the public page and read the price and everything else.",
+            "Open the public page at /products/{its slug} and read the price and everything else.",
             "Delete the listing.",
         ],
         inputs: { priceBefore: 750, priceAfter: 850 },
@@ -103,8 +104,8 @@ export const authored = {
         startPage: "/store/products/new",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open /store/products/new and publish a listing titled 'QA Product belongs-to-store' at 300.",
-            "Open its public page and read the seller line at the bottom of the info panel.",
+            "Open /store/products/new and publish a listing titled 'QA Product belongs-to-store' at 300, with Category 'Beyblade Burst' and a Product Image — the quick form requires title, category, price AND image, so a publish naming only two of them cannot succeed.",
+            "Open its public page at /products/{its slug} and read the seller line at the bottom of the info panel.",
             "Click the 'Visit Store' link and read where it lands.",
             "Open /stores/store-beyblade-arena and find the listing in the Products tab.",
             "Sign out and sign in as admin@letitrip.in / TempPass123!, a different seller who owns store-letitrip-official.",
@@ -121,7 +122,7 @@ export const authored = {
         startPage: "/store",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open the store's settings and change the store name to 'QA Store rename-updates-cards'.",
+            "Open /store/storefront and change the store name to 'QA Store rename-updates-cards'.",
             "Save and reload to confirm.",
             "Open /products in a private window and find a card from that store.",
             "Read the seller name on the card and on the product's detail page.",
@@ -174,6 +175,7 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and read any stated video duration or size limit.",
+            "Click 'Show all fields (advanced)' first. 🛑 /store/products/new opens the QUICK form for a standard create: its image control is a single-value field labelled 'Product Image' — no gallery, no multi-select, no crop editor, no video field and no brand. Anything beyond one plain image needs the advanced form.",
             "Upload public/test-media/sample-video.mp4 to the video field.",
             "Wait for it to finish and read the preview and any duration shown.",
             "Read whether a poster frame was captured.",
@@ -190,6 +192,7 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and select public/test-media/sample-image.png, sample-image.jpg and sample-image.webp together in one file dialog.",
+            "Click 'Show all fields (advanced)' first. 🛑 /store/products/new opens the QUICK form for a standard create: its image control is a single-value field labelled 'Product Image' — no gallery, no multi-select, no crop editor, no video field and no brand. Anything beyond one plain image needs the advanced form.",
             "Watch the upload progress and read whether each file reports its own.",
             "Read the previews once they finish and count them.",
             "Check each preview shows its own file rather than three copies of one.",
@@ -206,6 +209,7 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and upload sample-image.png, sample-image.jpg and sample-image.webp.",
+            "Click 'Show all fields (advanced)' first. 🛑 /store/products/new opens the QUICK form for a standard create: its image control is a single-value field labelled 'Product Image' — no gallery, no multi-select, no crop editor, no video field and no brand. Anything beyond one plain image needs the advanced form.",
             "Note which image is in which position.",
             "Remove the MIDDLE one and read the remaining previews.",
             "Check the remaining two are the ones expected and are in their original relative order.",
@@ -222,6 +226,7 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and upload public/test-media/sample-image.png as the main image.",
+            "Click 'Show all fields (advanced)' first. 🛑 /store/products/new opens the QUICK form for a standard create: its image control is a single-value field labelled 'Product Image' — no gallery, no multi-select, no crop editor, no video field and no brand. Anything beyond one plain image needs the advanced form.",
             "Open the crop editor and read the aspect-ratio presets offered.",
             "Choose a preset, rotate the image, zoom in, and apply.",
             "Read the resulting preview.",

package/dist/features/tester/seed-data/authored/selling__listing-edit-roundtrip.js

@@ -88,10 +88,26 @@ export const authored = {
         roles: ["seller"],
         startPage: "/store/products",
         steps: [
-            "Sign in as admin@letitrip.in / TempPass123!, who owns store-letitrip-official — a different store from Beyblade Arena.",
+            /*
+             * 🛑 NOT THE ADMIN. `getSellerProductAction` reads
+             * `if (!isAdminUser(profile))` before comparing stores, so an admin is
+             * EXEMPT by design and will open Beyblade Arena's listing successfully.
+             * Signing in as admin@letitrip.in and expecting a 404 tested the
+             * exemption while claiming to test the gate — it would have reported a
+             * working ownership check as broken.
+             *
+             * 🛑 AND THE CONFOUND IS REAL: store-blader-bazaar is PENDING, because
+             * there is no second ACTIVE non-admin seller in the seed (Beyblade Arena
+             * is the only one; Vintage Vault Co. is suspended). So a refusal here may
+             * come from the store's status rather than from ownership, and the step
+             * below says how to tell them apart rather than pretending the fixture is
+             * cleaner than it is.
+             */
+            "Sign in as meera.blader@gmail.com / TempPass123!, who owns store-blader-bazaar — a different store from Beyblade Arena.",
+            "Open /store/products first — if meera's own dashboard is itself blocked, her store's PENDING status is the cause and this case is a null with that reason, not a verdict about ownership.",
             "In a second tab open /products and copy the slug of any listing belonging to Beyblade Arena, e.g. product-beyblade-burst-valkyrie.",
             "Back in the first tab, navigate to /store/products/<that slug>/edit.",
-            "Read what the page shows.",
+            "Read what the page shows, and whether the refusal is about OWNERSHIP or about the store being pending.",
         ],
         expectedBehaviour: "Ownership is checked against the caller's STORE, and a product's `storeId` is the store SLUG rather than the owner's Auth uid. A check comparing `storeId` to a uid compares two different namespaces and can never pass — which returns null for every legitimate seller too, so a page that 404s here must be verified to still open the seller's OWN listing.",
         expectedUiState: "A not-found page, with no editable fields.",
@@ -103,12 +119,23 @@ export const authored = {
         startPage: "/store/products",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open /categories/original-plastic-gen — a tier-3 category whose parent is original-tops and whose root is spinning-tops.",
+            /*
+             * 🛑 The `category-` PREFIX is load-bearing in all three URLs below.
+             *
+             * These steps named /categories/original-plastic-gen, original-tops and
+             * spinning-tops, and every one of them 404s — a category's document id IS
+             * its prefixed slug (§ Slug Prefix System), so the real routes are
+             * /categories/category-original-plastic-gen and so on. Verified 200 on all
+             * three prefixed forms. `audit-tester-checklist-hrefs` did not catch it
+             * because it validates `href` and `startPage`, and these are URLs written
+             * inside step PROSE, which nothing checks.
+             */
+            "Open /categories/category-original-plastic-gen — its parent is category-original-tops and its root is category-spinning-tops.",
             "Open /store/products, pick a published listing, and open its Edit action.",
-            "Change its Category to Original Plastic Gen and press Save.",
-            "Open /categories/original-plastic-gen and look for the listing.",
-            "Open /categories/original-tops and look for the same listing.",
-            "Open /categories/spinning-tops and look for it again.",
+            "Change its Category to Plastic Generation (that is the display name; the id is category-original-plastic-gen) and press Save.",
+            "Open /categories/category-original-plastic-gen and look for the listing.",
+            "Open /categories/category-original-tops and look for the same listing.",
+            "Open /categories/category-spinning-tops and look for it again.",
         ],
         expectedBehaviour: "A product stores the FULL ancestor chain, so it is reachable from its own category and from every ancestor with one query. If only the leaf is stored, the ancestor pages match nothing — and the leaf page can fail too, because the stored field and the field the form sends are not the same one.",
         expectedUiState: "The listing's card appears on all three pages: the deep category, its parent, and its root.",

package/dist/features/tester/seed-data/authored/selling__listing-lifecycle.js

@@ -21,6 +21,16 @@
  * @tag sideEffects:none
  */
 const SIGN_IN_SELLER = "Sign in as tyson@beybladearena.in / TempPass123!.";
+/*
+ * The two MIXED-ROLE cases below list roles [seller, buyer], and identityFor
+ * resolves that to the BUYER session — admin wins if present, then all-seller,
+ * and everything else falls to the buyer. So those batches open as someone who
+ * owns no store, and their first step is a seller action. They say so; the
+ * twelve seller-only cases on this page need no such warning and do not carry
+ * one.
+ */
+const SIGN_IN_SELLER_MIXED = SIGN_IN_SELLER +
+    " 🛑 THIS CASE OPENS AS THE BUYER because its roles are [seller, buyer]. Copy tester/.tester-runs/session-seller.json over session.json and CLOSE THE BROWSER before this step; the MCP reads that file only when the context is created.";
 export const authored = {
     "checklist-selling-listing-lifecycle-standard-create-publish-sell": {
         roles: ["seller", "buyer"],
@@ -44,13 +54,13 @@ export const authored = {
         roles: ["seller", "buyer"],
         startPage: "/store/products",
         steps: [
-            SIGN_IN_SELLER,
+            SIGN_IN_SELLER_MIXED,
             "Create an auction titled 'QA Lifecycle Auction' with a starting bid of 500, an increment of 50 and no reserve, ending within the current test window, and publish it.",
-            "Sign in as rehan.sheikh@gmail.com / TempPass123! and place a bid of 550.",
-            "Sign in as vivaan.kapoor@gmail.com / TempPass123! and place a bid of 600.",
+            "Swap session: copy tester/.tester-runs/session-buyer.json over session.json and CLOSE THE BROWSER before continuing — the MCP reads that file only when the context is created, so swapping over an open browser changes nothing and the next steps run as the previous person. Then sign in as rehan.sheikh@gmail.com / TempPass123! and place a bid of 550.",
+            "Sign out and sign in as vivaan.kapoor@gmail.com / TempPass123! — same browser session file, a different account — and place a bid of 600.",
             "Wait for the auction to end.",
             "Read the auction page for the outcome.",
-            "Sign in as the winning bidder and check the won line is in their cart.",
+            "Sign in as the winning bidder (vivaan, at ₹600) and check the won line is in their cart under the Won Auctions tab.",
         ],
         inputs: { title: "QA Lifecycle Auction", startingBid: 500, increment: 50, bidA: 550, bidB: 600 },
         expectedBehaviour: "The auction closes at its end time and the top bidder wins. A win reaches the buyer as a LOCKED cart line rather than as a ready-made order, because that is the only checkout that knows how to collect an address, charge a method and split per store — an order written directly by settlement had no payment method and no way to pay it at all.",
@@ -114,7 +124,7 @@ export const authored = {
         roles: ["seller", "buyer"],
         startPage: "/store/products",
         steps: [
-            SIGN_IN_SELLER,
+            SIGN_IN_SELLER_MIXED,
             "Create a prize draw titled 'QA Lifecycle Draw' with 3 entries at 100 each and a reveal window inside the current test window, and publish it.",
             "Sign in as rehan.sheikh@gmail.com / TempPass123! and buy two entries.",
             "Sign in as vivaan.kapoor@gmail.com / TempPass123! and buy the last one.",
@@ -169,11 +179,11 @@ export const authored = {
         startPage: "/digital-codes",
         steps: [
             "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
-            "Open /digital-codes on the All scope and find digitalcode-beyblade-x-app-launch-codes-depleted, whose code pool is empty while its stock field still reads 5.",
+            "Open /digital-codes — it REDIRECTS to /products?listingType=digital-code, which is expected: the per-type browse pages were folded into one catalogue with an in-page type filter — then set the All scope and find digitalcode-beyblade-x-app-launch-codes-depleted, whose code pool is empty while its stock field still reads 5.",
             "Open it and read whether it can be bought.",
             "Read its stock number.",
             "Compare that stock number against the pool count.",
-            "Open /digital-codes on the Available scope and check the listing is not there.",
+            "Open /digital-codes — it REDIRECTS to /products?listingType=digital-code, which is expected: the per-type browse pages were folded into one catalogue with an in-page type filter — then set the Available scope and check the listing is not there.",
         ],
         expectedBehaviour: "Availability for this type is the NESTED codes-available count, not the stock field — and the two disagree on purpose in the seed, so a check reading stock alone passes while the listing is unbuyable. The branch that reads the pool once looked at a top-level field the record does not have, so it had never fired even once.",
         expectedUiState: "The listing is not buyable and is absent from the Available scope, even though its stock number is above zero. Finding it buyable is the finding.",

package/dist/features/tester/seed-data/authored/selling__listing-type-fields-roundtrip.js

@@ -26,12 +26,12 @@ export const authored = {
         startPage: "/store/classified/new",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open the classified creation form and type 'QA Classified roundtrip-meetup' as the title.",
+            "Open /store/classified/new and type 'QA Classified roundtrip-meetup' as the title.",
             "Set the city to Mumbai, the contact method to chat, negotiable to on, and accepts-shipping to off.",
             "Type 1500 as the price and fill every other required field.",
             "Save.",
             "RELOAD the editor for that listing and read all four type-specific values.",
-            "Open the listing's public page and read the same four.",
+            "Open the listing's public page at /classified/{its slug} and read the same four.",
             "Delete the listing.",
         ],
         inputs: {
@@ -58,7 +58,7 @@ export const authored = {
             "Upload public/test-media/sample-video.mp4 and type 2000 as the price.",
             "Save.",
             "RELOAD the editor and read every one of those values.",
-            "Open the public page and read the species line and the delivery restrictions.",
+            "Open the public page at /live/{its slug} and read the species line and the delivery restrictions.",
             "Delete the listing.",
         ],
         inputs: {
@@ -80,11 +80,11 @@ export const authored = {
         startPage: "/store/digital-codes/new",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open the digital-code creation form and type 'QA Digital Code roundtrip-delivery' as the title.",
+            "Open /store/digital-codes/new and type 'QA Digital Code roundtrip-delivery' as the title.",
             "Set the delivery mode to auto-claim and type 250 as the price.",
             "Add three codes to the pool and save.",
             "RELOAD the editor and read the delivery mode and the pool count.",
-            "Open the public page and read the availability shown.",
+            "Open the public page at /digital-codes/{its slug} and read the availability shown.",
             "Change the delivery mode to manual email, save, reload and read it again.",
             "Delete the listing.",
         ],
@@ -101,14 +101,14 @@ export const authored = {
     },
     "checklist-selling-listing-type-fields-roundtrip-roundtrip-print-meta": {
         roles: ["seller"],
-        startPage: "/store/products/new",
+        startPage: "/store/art/new",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open the art or sticker creation form and type 'QA Art Print roundtrip-meta' as the title.",
+            "Open /store/art/new — stickers have their own at /store/stickers/new and the same four print fields — and type 'QA Art Print roundtrip-meta' as the title. These per-type routes render the FULL form; /store/products/new would open the six-field quick form, which has none of these fields.",
             "Set the size, the material, the finish and the edition size, noting each value.",
             "Type 800 as the price and save.",
             "RELOAD the editor and read all four print fields.",
-            "Open the public page and read the same four.",
+            "Open the public page at /products/{its slug} — art and stickers deliberately use the STANDARD product route, not a dedicated one — and read the same four.",
             "Delete the listing.",
         ],
         inputs: { title: "QA Art Print roundtrip-meta", price: 800 },
@@ -125,7 +125,7 @@ export const authored = {
             "Read every field the form offers and note which are empty.",
             "Compare each against the public page for that product.",
             "Change nothing and save.",
-            "RELOAD the public page and check nothing has changed — title, price, description, images, category, brand, stock.",
+            "RELOAD the public page and check nothing has changed — title, price, description, images, category, brand, stock AND STATUS. Status is the one to check hardest: a form seeded from an unwrapped result envelope resolves every real field to undefined, and the status ternary then evaluates undefined === 'published' to false and writes 'draft' — which removes a live listing from every public surface while the save reports success and the editor looks merely empty.",
         ],
         inputs: { productId: "product-beyblade-burst-valkyrie" },
         expectedBehaviour: "An edit form opens populated from a read that strips nothing, and a no-op save writes back exactly what was there. This is the single most valuable case on the page: a form seeded from a projection that drops fields will save those drops back, so opening and saving an untouched record quietly deletes data.",

package/dist/features/tester/seed-data/authored/selling__media-limits.js

@@ -25,6 +25,7 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and type 'QA Product media-gallery' as the title.",
+            "Click 'Show all fields (advanced)' before touching any media. 🛑 /store/products/new opens the QUICK form by default for a create of a standard listing, and it has ONE field — 'Product Image' — with no gallery and no video field at all. Every media step below needs the advanced form.",
             "Upload public/test-media/sample-image.png to the gallery.",
             "Upload public/test-media/sample-image.jpg to the gallery.",
             "Upload public/test-media/sample-image.webp to the gallery.",
@@ -46,6 +47,7 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and type 'QA Product media-tenth' as the title.",
+            "Click 'Show all fields (advanced)' before touching any media. 🛑 /store/products/new opens the QUICK form by default for a create of a standard listing, and it has ONE field — 'Product Image' — with no gallery and no video field at all. Every media step below needs the advanced form.",
             "Upload public/test-media/sample-image.png to the gallery nine times, counting the previews after each.",
             "Upload it a tenth time.",
             "Read the preview count and any message about the limit.",
@@ -62,6 +64,7 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and upload public/test-media/sample-image.png ten times.",
+            "Click 'Show all fields (advanced)' before touching any media. 🛑 /store/products/new opens the QUICK form by default for a create of a standard listing, and it has ONE field — 'Product Image' — with no gallery and no video field at all. Every media step below needs the advanced form.",
             "Open the browser's Network panel.",
             "Attempt an eleventh upload of the same file.",
             "Read the message shown and count the previews.",
@@ -79,6 +82,7 @@ export const authored = {
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
             "Open /store/products/new and type 'QA Product media-second-video' as the title.",
+            "Click 'Show all fields (advanced)' before touching any media. 🛑 /store/products/new opens the QUICK form by default for a create of a standard listing, and it has ONE field — 'Product Image' — with no gallery and no video field at all. Every media step below needs the advanced form.",
             "Upload public/test-media/sample-video.mp4 to the video field and wait for its poster frame.",
             "Attempt to upload public/test-media/sample-video.mp4 a second time.",
             "Read the message shown.",
@@ -95,10 +99,11 @@ export const authored = {
         startPage: "/store/products/new",
         steps: [
             "Sign in as tyson@beybladearena.in / TempPass123!.",
-            "Open /store/products/new and read the stated image and video limits.",
-            "Open the auction creation form and read its stated limits.",
-            "Open the pre-order creation form and read its limits.",
-            "Open the classified, digital-code and live-item creation forms and read each.",
+            "Click 'Show all fields (advanced)' before touching any media. 🛑 /store/products/new opens the QUICK form by default for a create of a standard listing, and it has ONE field — 'Product Image' — with no gallery and no video field at all. Every media step below needs the advanced form.",
+            "Read the stated image and video limits on the advanced form.",
+            "Open /store/auctions/new and read its stated limits. These per-type creation routes render the full form directly, so no advanced switch is needed on any of them.",
+            "Open /store/pre-orders/new and read its limits.",
+            "Open /store/classified/new, /store/digital-codes/new and /store/live/new and read each.",
             "Compare all six.",
         ],
         expectedBehaviour: "The caps come from one shared limits module, so every listing type states the same numbers. A type stating a different cap has a local copy, and a local copy is a number that will drift the first time the shared one changes.",

package/dist/features/tester/seed-data/authored/selling__product-upload-details.js

@@ -63,13 +63,13 @@ export const authored = {
             SIGN_IN_SELLER,
             "Open /store/products/new and switch to the advanced form.",
             "Open the Media section and read the size limit stated next to 'Main Image'.",
-            "Choose public/test-media/oversized.png for the Main Image and start a timer. (The batch generates this file — it is >10 MB of incompressible noise and deliberately not committed.)",
+            "Choose public/test-media/oversized.png for the Main Image and start a timer. 🛑 THE BATCH DOES NOT GENERATE THIS FILE — there is no fixture manifest for this page. Run `node tester/scripts/make-media-fixtures.mjs --with-oversized` first; it sizes the fixture by reading the caps out of appkit/src/_internal/shared/media/limits.ts rather than from a remembered number. It is >10 MB of incompressible noise and deliberately not committed.",
             "Read the message that appears and note how long it took.",
             `Open the browser network panel and check whether any request to ${SIGN} was made.`,
         ],
         inputs: { image: "public/test-media/oversized.png", limitMb: 10 },
         expectedBehaviour: "A file over the limit is refused BEFORE any bytes leave the browser. The point is the seller's time: a 12 MB upload that travels, then finalises, then fails validation has taken a minute to tell them something the form already knew when they picked the file. The limit is also stated up front rather than only in the refusal.",
-        expectedUiState: `The refusal is immediate (well under a second) and reads 'File size must be less than 10MB', naming the actual size. No ${SIGN} request appears in the network panel. The field keeps whatever image it had before.`,
+        expectedUiState: `The refusal is immediate (well under a second) and reads 'File size must be less than 10MB (current: …)', naming the actual size — 10 is MAX_IMAGE_BYTES from limits.ts. 🛑 EXPECT 50MB INSTEAD, AND RECORD IT: the gallery field passes maxSizeMB={50} explicitly, which is the VIDEO cap applied to a field accepting image/* and video/* alike, so a 12 MB image is accepted client-side. MediaUploadField's own auto-derived defaults (image 25, video 200, pdf 10) disagree with limits.ts (10, 50, 20) on all three. Report the number the message actually states. No ${SIGN} request appears in the network panel. The field keeps whatever image it had before.`,
         expectedData: { signRequestsMade: 0 },
         endResult: "Leave without saving; nothing was uploaded.",
     },
@@ -121,7 +121,7 @@ export const authored = {
             "Add public/test-media/sample-image-2.png as the first GALLERY image.",
             "Read both previews and confirm they show different pictures.",
             "Publish with Title 'Slot Collision Probe', Description 'Main image and first gallery image must not overwrite each other.', Category 'Beyblade Burst', Price 499.",
-            "Open the product's public page and read the main image and the first gallery thumbnail.",
+            "Open the product's public page at /products/{its slug} and read the main image and the first gallery thumbnail.",
         ],
         inputs: { mainImage: "public/test-media/sample-image.png", firstGalleryImage: "public/test-media/sample-image-2.png", price: 499 },
         expectedBehaviour: "The main image occupies index 1 and the gallery starts at index 2. Filenames here are content-derived with no timestamp, so two uploads that computed the same index would write the same storage path and the second would silently overwrite the first — the seller would see one of their two pictures simply vanish.",