@mohasinac/appkit 4.52.5 → 4.53.0

package/dist/features/tester/seed-data/authored/tools__sticker-tracer.js

@@ -0,0 +1,283 @@
+/*
+ * WHY: Authored six-part procedures for the sticker-sheet kiss-cut tracer.
+ * WHAT: 16 case(s), keyed by full checklist id.
+ *
+ * 🛑 EVERY CASE IS AN EXPLICIT BEFORE → AFTER, because almost every defect this
+ * feature can have returns HTTP 200 with plausible content. A case reading
+ * "check the tracer works" would pass against the bug. The first three restate
+ * the two failures that caused this feature to be built, as assertions.
+ *
+ * 🛑 THE FIXTURE IS /test-media/sticker-sheet-fixture.jpg AND ITS SIZE IS
+ * LOAD-BEARING. It is the real 5024x3024 scan, and shrinking it was measured
+ * and rejected: a 145 KB WebP traces into 237 fragments where the original
+ * gives 15 (public/test-media/README.md carries the table). A case asserting a
+ * part count against a shrunken fixture would fail for a reason that is not a
+ * bug. Do not "optimise" it.
+ *
+ * 🛑 PART COUNTS ARE DELIBERATELY NOT ASSERTED AS EXACT NUMBERS. The probe
+ * measured 15 at draft tier on this machine, but the count moves with tier and
+ * with any tuning of the ridge thresholds — so the cases assert RELATIONS
+ * ("more than one", "the same count twice", "fewer after raising the minimum")
+ * which stay true across tuning. An exact number here would be a case that
+ * fails every time somebody improves the detector.
+ *
+ * 🛑 The tracer is ADMIN-ONLY and /tools/sticker-tracer is server-gated, so the
+ * buyer and guest cases assert the redirect rather than a hidden control.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+const ADMIN_SIGNIN = "Sign in as admin@letitrip.in / TempPass123!.";
+const FIXTURE = "/test-media/sticker-sheet-fixture.jpg";
+export const authored = {
+    /* ---- the two reported failures, restated as assertions ---------------- */
+    "checklist-tools-sticker-tracer-enclosed-region-opaque": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            `Download ${FIXTURE} and choose it with "Choose a scan".`,
+            "Wait for the outlines to draw over the preview.",
+            "Find a sticker that contains an enclosed area the same colour as the paper around the sheet — on the Driger G sheet the lighter interior panels.",
+            "Zoom the browser to 200% and look at whether that interior area is covered by the outline or cut out of it.",
+        ],
+        expectedBehaviour: "Opacity is decided by REACHABILITY from the sheet border, not by colour. The flood fills inward from the edge and a sticker is whatever the flood could not reach — so an enclosed region is inside the outline no matter what colour it is.",
+        expectedUiState: "The magenta outline runs around the sticker's silhouette only. It does not loop around interior light-coloured areas, and no interior region is excluded from the shape.",
+        endResult: "BEFORE: the prior Python attempt thresholded colour, so a region matching the background was made transparent even inside a sticker. AFTER: interior regions stay part of the sticker. Nothing is persisted — this is the in-browser tuner.",
+    },
+    "checklist-tools-sticker-tracer-white-on-white-edge": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            `Choose ${FIXTURE}.`,
+            "Find the winder sticker — the one whose top edge is near-white against the near-white paper.",
+            "Zoom to 200% and check whether that top edge carries an outline.",
+            "Read the Result card's part count.",
+        ],
+        expectedBehaviour: "The cut line is found from the EMBOSS RIDGE, which the plan measured at 10-20x above noise precisely where colour carries none. No per-sticker parameter is involved.",
+        expectedUiState: "The white top edge has a magenta outline following it. The Result card shows more than one part.",
+        endResult: "BEFORE: a colour threshold ate that edge, and the old script needed a hand-authored --cap flag naming one sticker's coordinates on one sheet. AFTER: it is found with the default parameters and no per-sticker tuning.",
+    },
+    "checklist-tools-sticker-tracer-background-model-named": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            `Choose ${FIXTURE}.`,
+            "Read the line under the Result heading that begins 'background:'.",
+            "Change 'Paper tolerance' from its default to 60 and watch the part count.",
+            "Set it back to its default.",
+        ],
+        expectedBehaviour: "The tool states which of the two segmentation models ran. Paper floods inward from the sheet edge; art partitions on cut lines because there is no background to flood. Paper tolerance only affects the paper model, which is why knowing which ran is the difference between a parameter that does nothing and one that is simply set wrong.",
+        expectedUiState: "The Result card reads 'background: paper' for this scan. Changing Paper tolerance changes the part count.",
+        endResult: "BEFORE: there was no way to tell which model ran, so an operator adjusting paper tolerance on an art sheet saw no effect and no explanation. AFTER: the model is named on screen.",
+    },
+    /* ---- the mandatory name ---------------------------------------------- */
+    "checklist-tools-sticker-tracer-name-required": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            `Choose ${FIXTURE} and scroll to "Commit this as a run".`,
+            "Leave 'Name this sheet' EMPTY and try to press 'Upload and run'.",
+            "Type a single space into the name and try again.",
+            "Type 'QA tracer run 1' and press 'Upload and run'.",
+        ],
+        inputs: { name: "QA tracer run 1" },
+        expectedBehaviour: "A name is mandatory and is enforced in three places — the disabled button, the route's schema, and requireName in the action. No sheet document and no Storage object is created while the name is empty.",
+        expectedUiState: "'Upload and run' is disabled with the name empty and with a single space. It enables once real text is entered, then reads 'Uploading and starting…'.",
+        expectedData: { sheetsCreatedWhileNameEmpty: 0 },
+        endResult: "BEFORE: nothing stopped an unnamed attempt, and the whole point of keeping every run is being able to tell them apart later. AFTER: a run cannot exist without a name. The named run persists and appears under Attempts after a reload.",
+    },
+    /* ---- watermark + originals ------------------------------------------- */
+    "checklist-tools-sticker-tracer-no-watermark-on-original": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "Open a sheet whose run has finished and been accepted.",
+            "In Attempts, press 'Preview' on the accepted run — it opens a new tab.",
+            "Look at the opened image for a watermark, and copy its URL.",
+            "Check the URL's host: it should be a storage.googleapis.com signed link, NOT a /media/ path on this site.",
+        ],
+        expectedBehaviour: "Tracer artifacts live under private/sticker-sheets/ and are served by 5-minute signed GCS URLs, which bypass /api/media/[...slug] — the proxy that always watermarks. The printable original must stay clean or the cut-out is ruined.",
+        expectedUiState: "The opened image carries NO watermark. Its URL is on storage.googleapis.com with query parameters, not /media/<slug>.",
+        endResult: "BEFORE: every image through the media proxy was watermarked, which would ruin a cut-out and the printed mosaic. AFTER: originals are unwatermarked and reachable only through a short-lived signed link.",
+    },
+    /* ---- live progress ---------------------------------------------------- */
+    "checklist-tools-sticker-tracer-progress-names-stage": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            `Choose ${FIXTURE}, name the run 'QA progress', pick tier Standard and press 'Upload and run'.`,
+            "Watch the card titled 'Running' without reloading.",
+            "Write down two different stage names you see.",
+        ],
+        expectedBehaviour: "Progress is pushed over the run's own RTDB channel, not polled. The label names the STAGE because that is what distinguishes a halftone scan stuck in the detector from one stuck in the upload.",
+        expectedUiState: "A 'Running' card shows text like 'ridge 22%' or 'parts 4/15' and ADVANCES. It is never a bare spinner and never only a percentage.",
+        endResult: "BEFORE: a trace took minutes with nothing to look at. AFTER: the current stage is visible throughout. The card disappears when the run ends; the outcome persists in Attempts.",
+    },
+    "checklist-tools-sticker-tracer-failure-names-stage": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "Find a sheet with a FAILED run in Attempts. If none exists, create one: commit a run with 'Minimum part area' set to 100000, which leaves nothing above the threshold.",
+            "Read the failed row.",
+            "Reload the page and read it again.",
+        ],
+        inputs: { minPartAreaMm2: 100000 },
+        expectedBehaviour: "A failure records the stage it died in and a user-safe message, and the row survives. The requirement was 'even if we fail we know'.",
+        expectedUiState: "The row shows a red 'failed' badge and a line beginning 'Failed at <stage>' with a readable message — never 'Something went wrong', and never a raw server error or a stack trace.",
+        endResult: "BEFORE: a failed trace was indistinguishable from a hang. AFTER: the stage is named and the failed attempt stays in history after a reload.",
+    },
+    /* ---- history ---------------------------------------------------------- */
+    "checklist-tools-sticker-tracer-runs-never-overwrite": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            `Choose ${FIXTURE}, name the run 'QA attempt A', tier Standard, and commit it.`,
+            "Wait for it to finish.",
+            "Commit a SECOND run on the same sheet named 'QA attempt B' at tier Precise.",
+            "Reload the page and read the Attempts list.",
+        ],
+        inputs: { runA: "QA attempt A", runB: "QA attempt B" },
+        expectedBehaviour: "A retry or a second run creates a NEW run document. Nothing overwrites an earlier attempt, which is what makes comparing tiers on one sheet possible weeks later.",
+        expectedUiState: "Both 'QA attempt A' and 'QA attempt B' appear, newest first, each with its own tier label and its own part count. Both are still openable.",
+        endResult: "BEFORE: there was nothing listing runs at all — the documents existed with no reader. AFTER: every attempt is listed by the name that was typed, and both survive a reload.",
+    },
+    "checklist-tools-sticker-tracer-accepted-differs-from-succeeded": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "On a sheet with two successful runs, read the badges on both rows.",
+            "Press 'Accept & render' on the one that is not currently accepted.",
+            "Reload and read both rows again.",
+        ],
+        expectedBehaviour: "'succeeded' and 'accepted' are different facts: a run can succeed without being the sheet's current result, which is normal once three tiers have been tried. Accepting one moves the badge and starts the full-resolution render.",
+        expectedUiState: "Both rows show a green 'succeeded' badge; exactly ONE shows 'accepted'. After accepting the other, exactly one still shows 'accepted' and it is the one just pressed.",
+        expectedData: { acceptedRunsPerSheet: 1 },
+        endResult: "BEFORE: isPromoted and activeRunId were read by the UI and written by nothing — promoteRun had zero callers. AFTER: accepting a run is a real action and the badge reflects it after a reload.",
+    },
+    /* ---- promote gates full-res ------------------------------------------- */
+    "checklist-tools-sticker-tracer-fullres-only-after-accept": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "Commit a fresh run and wait for it to succeed WITHOUT accepting it.",
+            "Look for a 'Print & export' card on the page.",
+            "Press 'Accept & render' on that run.",
+            "Wait for the render, reload, and look again.",
+        ],
+        expectedBehaviour: "Full-resolution parts and the export surface exist only for an ACCEPTED run. An exploratory run costs about 1 MB; rendering full-res parts on every attempt costs roughly 500 MB a sheet — the difference between about 52 sheets inside 5 GB and about 8.",
+        expectedUiState: "No 'Print & export' card before accepting. After accepting it appears, with a machine and page picker.",
+        endResult: "BEFORE: nothing rendered full-resolution parts at all — the mode:\"full\" path had no caller. AFTER: they are rendered once, for the run actually chosen, and the export surface follows.",
+    },
+    /* ---- DPI honesty ------------------------------------------------------ */
+    "checklist-tools-sticker-tracer-no-dpi-no-mm": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "Open an accepted sheet whose scan declares no usable DPI — upload a screenshot or a web-saved image if none exists, since those declare 72 or 96.",
+            "Open 'Print & export' and read what it says.",
+            "Try to press 'Download cut file'.",
+        ],
+        expectedBehaviour: "Millimetres are WITHHELD when the DPI cannot be trusted. A cut file must be millimetre-true, so the export refuses rather than inventing a scale — a fabricated millimetre on a cut file is a physical production error, not a cosmetic one.",
+        expectedUiState: "A warning reading that the scan has no confirmed DPI and that confirming it makes the export available. The download buttons are DISABLED. No plausible-looking millimetre figure appears anywhere.",
+        endResult: "BEFORE: nothing distinguished a real DPI from the 72 that five of nine reference scans falsely declare. AFTER: the tool says so and refuses, naming the fix.",
+    },
+    /* ---- export refusals before download ---------------------------------- */
+    "checklist-tools-sticker-tracer-oversized-named-not-scaled": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "Open an accepted sheet with a confirmed DPI and scroll to 'Print & export'.",
+            "Set Machine to 'Cricut Joy 2 — Print Then Cut' and Page to A4.",
+            "Read the warning block listing parts.",
+            "Switch Machine to 'Print shop (Roland / Graphtec)' and read the same area again.",
+        ],
+        expectedBehaviour: "A part wider than the machine's cut area is NAMED before export, never scaled. The Joy 2's A4 Print-Then-Cut area is a column about 78 mm wide, and several stickers on a typical sheet exceed it. Scaling would produce a cut file that looks correct and yields stickers the wrong physical size.",
+        expectedUiState: "Under the Cricut PTC profile, a warning lists parts BY NAME with their measured width and a reason mentioning the cut width. Under the print-shop profile that warning is gone, because it has no width limit.",
+        endResult: "BEFORE: there was no way to learn a part was too wide except by cutting it. AFTER: the refusal is on screen before the download, and the print-shop profile is offered as the alternative.",
+    },
+    "checklist-tools-sticker-tracer-node-budget-reported": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "In 'Print & export', set Machine to a Cricut profile and read the badges under the pickers.",
+            "Switch to 'Print shop' and read them again.",
+        ],
+        expectedBehaviour: "Export simplification is a SEPARATE budget from the trace's. A Cricut profile re-simplifies to its node ceiling and reports the resulting deviation in millimetres; the print-shop profile has no ceiling and so does not simplify.",
+        expectedUiState: "A node-count badge is shown. Under a Cricut profile, when simplification occurred, a line reads 'Simplified from N nodes…' and states a worst-case deviation in mm. Under the print shop no deviation is claimed.",
+        endResult: "BEFORE: a max-tier trace could silently produce a file Design Space cannot open. AFTER: the node count and the cost of fitting it are both on screen before export.",
+    },
+    /* ---- retry clamp ------------------------------------------------------ */
+    "checklist-tools-sticker-tracer-retry-shows-clamp": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "In Attempts, press 'Retry from this' on any finished run.",
+            "In the retry form, open 'Where it restarts' and set 'Resume from' to 'parts'.",
+            "Change Tier to a different one — this changes ridge parameters, which belong to an earlier stage.",
+            "Read the message that appears in that section before submitting.",
+        ],
+        expectedBehaviour: "The resume point is clamped forward to the earliest stage whose parameters changed, and the clamp is SHOWN. Without it, a run resumed from 'parts' would carry artifacts generated under different parameters than the run records, with nothing anywhere contradicting it.",
+        expectedUiState: "A warning reading that a parameter from an earlier stage changed, so the run restarts from that stage rather than resuming from 'parts'. It names both stages.",
+        endResult: "BEFORE: explainResume() returned that sentence and nothing rendered it. AFTER: the operator sees the clamp before submitting, and the server applies the same decision.",
+    },
+    /* ---- access control ---------------------------------------------------- */
+    "checklist-tools-sticker-tracer-buyer-redirected": {
+        roles: ["buyer"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            "Sign in as a normal buyer account (not admin).",
+            "Navigate directly to /tools/sticker-tracer by typing the URL.",
+            "Open the Tools entry in the main navigation and read its children.",
+            "Visit /tools and read the cards.",
+        ],
+        expectedBehaviour: "The guard is the layout's server-side session read, so a non-admin is redirected before any HTML is produced. The nav child is filtered out client-side, which is presentation only — the redirect is the real boundary.",
+        expectedUiState: "The tracer URL does not render; the browser lands elsewhere. The Tools dropdown does not list 'Sticker sheet tracer'. /tools itself renders normally with its other cards.",
+        endResult: "BEFORE/AFTER is unchanged for a buyer — this case exists to prove the gate holds. Nothing is created or persisted.",
+    },
+    "checklist-tools-sticker-tracer-guest-redirected": {
+        roles: ["guest"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            "Sign out completely, or use a private window.",
+            "Navigate directly to /tools/sticker-tracer.",
+            "Then visit /tools.",
+            "View source on /tools/sticker-tracer's response and search for 'Choose a scan'.",
+        ],
+        expectedBehaviour: "A signed-out visitor is redirected to login. No part of the tracer UI is sent to the browser, because the layout redirects before rendering rather than hiding controls after.",
+        expectedUiState: "The login page, with a redirect back to the tracer. /tools renders normally and is unaffected. The phrase 'Choose a scan' appears nowhere in the response body.",
+        endResult: "BEFORE/AFTER unchanged for a guest — this proves the gate is server-side rather than a hidden control. Nothing is persisted.",
+    },
+    "checklist-tools-sticker-tracer-storage-meter-honest": {
+        roles: ["admin"],
+        startPage: "/tools/sticker-tracer",
+        steps: [
+            ADMIN_SIGNIN,
+            "Call GET /api/admin/sticker-sheets/usage in the browser address bar.",
+            "Read the per-sheet rows: each carries bytes AND an object count.",
+            "Compare the biggest sheet's byte figure against the number of runs it has.",
+            "Check whether the response carries a 'truncated' field and what it says.",
+        ],
+        expectedBehaviour: "The meter reports object COUNT beside bytes, because GCS meters them separately — which is the entire reason review thumbnails are one sprite atlas rather than sixty files. It measures at most 25 sheets per call and says when it truncated.",
+        expectedUiState: "JSON with rows sorted biggest-first, each having bytes and objects, plus totalBytes, totalObjects, measured and truncated.",
+        expectedData: { truncatedReportedExplicitly: true },
+        endResult: "BEFORE: storage cost was discoverable only in the GCP console, which is how the project was paused once before. AFTER: it is a route an operator can read, and a partial measurement says it is partial rather than understating the total.",
+    },
+};

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -18,6 +18,7 @@
  * @tag consumers:seed/index.ts,seed/runner.ts
  * @tag sideEffects:none
  */
+import { PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, } from "../../../_internal/shared/media/limits.js";
 import { assignDefaultPhases } from "../utils/phases.js";
 import { happyPathPages } from "./_happy-path.js";
 import { moneyFlowsPages } from "./_money-flows.js";
@@ -2314,20 +2315,21 @@ const rawTesterChecklistItems = [
                 /*
                  * REMOVED 2026-09-11 — `media-upload-images-capped-at-5`.
                  *
-                 * It asserted the gallery caps at "5 images (not 10)". The cap was
-                 * raised to 10 (`PRODUCT_MAX_IMAGES`, shared/media/limits.ts:37) and the
-                 * `selling/media-limits` page asserts the opposite in its own label:
-                 * "The 10th gallery image uploads — the 5th used to fail with a 400".
-                 *
-                 * So this case documented the OLD behaviour as the expectation. It
-                 * would fail against correct code, and anyone "fixing" the product to
-                 * satisfy it would re-break ten-image support. Its id encoded the wrong
-                 * number too, so correcting the label alone would still mislead.
+                 * It asserted the gallery caps at "5 images (not 10)". The cap had been
+                 * raised (`PRODUCT_MAX_IMAGES`), so the case documented the OLD
+                 * behaviour as the expectation: it would fail against correct code, and
+                 * anyone "fixing" the product to satisfy it would re-break multi-image
+                 * support. Its id encoded the wrong number too, so correcting the label
+                 * alone would still mislead.
                  *
                  * The invariant it really tested — the stated limit equals the enforced
-                 * limit — survives in `media-eleventh-image-refused-client-side`, which
-                 * requires the refusal to name the limit ("You can upload up to 10
-                 * images."). Nothing was lost.
+                 * limit — survives in `media-over-cap-image-refused-client-side`, which
+                 * requires the refusal to NAME the limit. Nothing was lost.
+                 *
+                 * 🛑 And the lesson got applied rather than just recorded: the cap moved
+                 * again on 2026-10-19 (10 -> 24), and the two cases that would have gone
+                 * stale now interpolate `PRODUCT_MAX_IMAGES` and carry no number in
+                 * their ids. See the note on the `media-limits` page below.
                  */
                 {
                     key: "media-upload-video-duration",
@@ -2903,25 +2905,44 @@ const rawTesterChecklistItems = [
         },
         {
             pageKey: "media-limits",
-            pageLabel: "Media \u2014 ten images and one video, on every listing type",
+            pageLabel: `Media \u2014 ${PRODUCT_MAX_IMAGES} images and ${PRODUCT_MAX_VIDEOS} video, on every listing type`,
             href: "/store/products/new",
             cases: [
                 {
                     key: "media-gallery-accepts-images-and-video",
                     label: "The gallery takes BOTH images and a video, and shows a live per-type count",
-                    description: "Changed 2026-09-04. BEFORE the single-media control on the listing form was video-only (`kind=\"video\"`), so the one \"add media\" affordance a seller saw refused photos. AFTER: the gallery accepts image files and a video file in the same control, and a counter under it reads \"N/10 images \u00b7 N/1 video\" as you add them.",
+                    description: `Changed 2026-09-04. BEFORE the single-media control on the listing form was video-only (\`kind="video"\`), so the one "add media" affordance a seller saw refused photos. AFTER: the gallery accepts image files and a video file in the same control, and a counter under it reads "N/${PRODUCT_MAX_IMAGES} images \u00b7 N/${PRODUCT_MAX_VIDEOS} video" as you add them.`,
                     href: "/store/products/new",
                 },
+                /*
+                 * \ud83d\uded1 These two cases state the cap by INTERPOLATING `PRODUCT_MAX_IMAGES`,
+                 * and their keys no longer encode a number.
+                 *
+                 * The pair they replace (`media-tenth-image-uploads`,
+                 * `media-eleventh-image-refused-client-side`) hard-coded 10 in the key,
+                 * the label, the description and the authored procedure's `inputs` \u2014
+                 * so raising the cap to 24 on 2026-10-19 would have left four cases
+                 * asserting the OLD number and failing against correct code. That is
+                 * exactly what the removal note above this page records happening the
+                 * last time the cap moved, including its warning that "its id encoded
+                 * the wrong number too, so correcting the label alone would still
+                 * mislead".
+                 *
+                 * What is actually under test is the BOUNDARY, not the number: that the
+                 * last allowed image succeeds (the off-by-one), and that the first one
+                 * over is refused client-side. Both are stated cap-agnostically, so the
+                 * next change to the cap needs no edit here at all.
+                 */
                 {
-                    key: "media-tenth-image-uploads",
-                    label: "The 10th gallery image uploads \u2014 the 5th used to fail with a 400",
-                    description: "BEFORE: the gallery was capped at 5 and sent its Nth image as index N+1, while the server's signed-URL guard rejected any index above 5 \u2014 so the LAST slot of every product form returned a 400 that read as a random upload failure. AFTER: add ten images one at a time. All ten must succeed, including the tenth.",
+                    key: "media-last-allowed-image-uploads",
+                    label: "The LAST allowed gallery image uploads \u2014 the cap is inclusive of its own number",
+                    description: `Add images one at a time, counting previews, until the control refuses one. BEFORE: the gallery sent its Nth image as index N+1 while the server's signed-URL guard rejected any index above the cap \u2014 so the LAST slot of every product form returned a 400 that read as a random upload failure. AFTER: the count you reach before any refusal must be exactly ${PRODUCT_MAX_IMAGES}, not ${PRODUCT_MAX_IMAGES - 1}. An off-by-one here is the most likely error and the least likely to be noticed, because one short of the cap still looks like plenty.`,
                     href: "/store/products/new",
                 },
                 {
-                    key: "media-eleventh-image-refused-client-side",
-                    label: "The 11th image is refused by the FORM with a clear message, not by the server",
-                    description: "Try to add an 11th image. The control must refuse it before uploading, naming the limit (\"You can upload up to 10 images.\"). A server-side 400 arriving after the bytes have gone up is the wrong behaviour \u2014 the user has already waited.",
+                    key: "media-over-cap-image-refused-client-side",
+                    label: "The first image OVER the cap is refused by the FORM, not by the server",
+                    description: `With ${PRODUCT_MAX_IMAGES} images already added, attempt one more with the browser's Network panel open. The control must refuse it before requesting a signed URL, and the message must NAME the limit ("You can upload up to ${PRODUCT_MAX_IMAGES} images."). A server-side 400 arriving after the bytes have gone up is the wrong behaviour twice over \u2014 the seller has already waited, and an orphaned object is left in storage.`,
                     href: "/store/products/new",
                 },
                 {
@@ -2932,8 +2953,8 @@ const rawTesterChecklistItems = [
                 },
                 {
                     key: "media-caps-flat-across-types",
-                    label: "The same 10 + 1 applies to an auction and a pre-order \u2014 there is no per-type table",
-                    description: "Repeat the ten-image check on /store/auctions/new and /store/pre-orders/new. Both must allow ten. BEFORE the server carried separate AUCTION_IMAGE_MAX and PREORDER_IMAGE_MAX constants, both 5, disagreeing with everything else.",
+                    label: `The same ${PRODUCT_MAX_IMAGES} + ${PRODUCT_MAX_VIDEOS} applies to an auction and a pre-order \u2014 there is no per-type table`,
+                    description: `Repeat the boundary check on /store/auctions/new and /store/pre-orders/new. Both must allow ${PRODUCT_MAX_IMAGES}. BEFORE the server carried separate AUCTION_IMAGE_MAX and PREORDER_IMAGE_MAX constants, both 5, disagreeing with everything else.`,
                     href: "/store/auctions/new",
                 },
                 {
@@ -3091,6 +3112,72 @@ const rawTesterChecklistItems = [
                 { key: "brand-count-matches-its-listing", label: "A brand page's count equals what that brand page lists" },
             ],
         },
+        {
+            /*
+             * Overflowing pill and tab rows — 2026-10-18.
+             *
+             * 🛑 Every case here is written as an explicit BEFORE → AFTER, because
+             * the defect's symptom is not an error: a row that overflows renders
+             * perfectly, returns HTTP 200, and simply puts some of its items past
+             * the right edge where nothing indicates they exist. A case reading
+             * "check the subcategories show" PASSES against the bug.
+             *
+             * The reported instance had 12 subcategory pills on a 1440px viewport
+             * with the last four unreachable — no scrollbar, no arrow, no hint.
+             *
+             * Width is the thing under test, so every case NAMES A VIEWPORT. A run
+             * at an unstated width cannot distinguish "collapsed correctly" from
+             * "collapsed when it had room", which are opposite defects.
+             */
+            pageKey: "overflowing-pill-rows",
+            pageLabel: "Pill and tab rows that do not fit collapse into a searchable dropdown",
+            href: "/categories",
+            cases: [
+                { key: "wide-row-stays-pills", label: "A subcategory row that FITS still renders as pills, not a dropdown" },
+                { key: "narrow-row-collapses", label: "The same row at a phone width collapses to one dropdown trigger" },
+                { key: "collapsed-dropdown-is-searchable", label: "The collapsed dropdown has a search box that filters as you type" },
+                { key: "collapsed-dropdown-keyboard", label: "Arrow keys and Enter pick an item without touching the mouse" },
+                { key: "every-item-reachable-when-collapsed", label: "Every subcategory is reachable from the dropdown, including ones that used to be off-screen" },
+                { key: "pills-carry-a-leading-image", label: "Subcategory pills and dropdown rows show the category's own cover image" },
+                { key: "missing-image-falls-back-to-initial", label: "A subcategory with no cover image shows an initial, not a blank box or a broken image" },
+                { key: "widening-restores-the-pills", label: "Widening the window back expands the dropdown into pills again" },
+                { key: "subcategory-click-is-client-side", label: "Clicking a subcategory navigates without a full page reload" },
+                { key: "tabs-collapse-by-width-not-count", label: "A tab bar with six short tabs stays a row on desktop instead of collapsing on a count" },
+                { key: "event-tabs-do-not-jump-to-top", label: "Switching event tabs does not scroll the page back to the top" },
+            ],
+        },
+        {
+            /*
+             * The authenticity checker — 2026-10-18.
+             *
+             * 🛑 Every case here asserts the presence of a HEDGE, or compares two
+             * inputs, because this tool's failure mode is not a crash: it is a
+             * confident, plausible, wrong answer served with HTTP 200. Code-matching
+             * alone cannot detect a counterfeit (one crawled counterfeit catalogue
+             * printed 900+ genuine Takara Tomy codes), the Metal Fight date-code
+             * decoding is disputed with no manufacturer statement, and two of the
+             * spellings a naive build would flag as fake tells are Takara Tomy's own
+             * romanisation and a licensed Indian importer's name.
+             */
+            pageKey: "authenticity-checker",
+            pageLabel: "Authenticity checker — box codes, per-generation checks and the sign-in gate",
+            href: "/tools/authenticity",
+            cases: [
+                { key: "guest-sees-reference-not-a-wall", label: "Signed out, the generation table and universal checks still render — only the lookup is gated" },
+                { key: "no-signin-flash-when-authenticated", label: "A signed-in user never sees 'Sign in to run a lookup' during a hard reload" },
+                { key: "midfake-code-reads-as-batch-not-accusation", label: "A matched midfake code reports a batch, never a counterfeit accusation against the seller" },
+                { key: "date-code-shows-both-readings", label: "A box date code shows BOTH circulating readings and says neither is official" },
+                { key: "real-product-code-is-not-evidence", label: "A well-formed product code is marked neutral and states that real codes appear on fakes" },
+                { key: "name-code-mismatch-asks-rather-than-accuses", label: "A name/code mismatch is a question, and ticking Random Booster re-reads it as expected" },
+                { key: "ambiguous-name-asks-which-model", label: "An ambiguous name asks which release instead of confidently naming one" },
+                { key: "takara-spelling-is-not-flagged", label: "'Storm Pegasis' (the Takara Tomy spelling) is not flagged, while 'Scythee' is" },
+                { key: "funskool-is-not-a-fake-signal", label: "Funskool reads as a licensed importer; Rapidity reads as an unlicensed producer" },
+                { key: "unknown-code-is-not-called-fake", label: "An unrecorded code says 'not recorded' and explicitly not 'fake'" },
+                { key: "asks-generation-when-nothing-inferable", label: "With no generation inferable the tool asks instead of returning a verdict" },
+                { key: "api-refuses-signed-out", label: "POST /api/tools/authenticity returns 401/403 signed out and leaks no assessment" },
+                { key: "json-ld-declares-the-gate", label: "The WebApplication JSON-LD declares the gated region, and its cssSelector matches a real element" },
+            ],
+        },
         {
             /*
              * D12 — the parts database, the composition panel, and the part line in a
@@ -3935,6 +4022,49 @@ const rawTesterChecklistItems = [
                 },
             ],
         },
+        {
+            pageKey: "header-brand-mark-centring",
+            pageLabel: "Header — Centred Brand Mark Never Collides With the Icons",
+            href: "/products",
+            cases: [
+                {
+                    key: "mark-clear-of-icons-across-the-lg-band",
+                    label: "Sweeping the window from 1024px to 1280px, the centred leaf mark never overlaps the notification, messages, wishlist or cart icons",
+                    description: "Fixed 2026-10-19. BEFORE: the mark was `position: absolute; left: 50%` inside the title row, so the row's `justify-between` reserved no space for it and the right-hand cluster grew leftward straight over it. The mark reveals at md (768px) and those four icons reveal at lg (1024px), so from 1024px to roughly 1150px the cluster's left edge crossed the row midpoint and the leaf painted across the bell and the heart. AFTER: resize in ~32px steps from 1024px to 1280px and watch the gap between the wordmark and the first icon. The leaf must sit in clear space at every single step — no part of it may touch an icon's 44px box.",
+                    href: "/products",
+                },
+                {
+                    key: "mark-clear-signed-out-worst-case",
+                    label: "SIGNED OUT at ~1100px — where 'Sign in' and 'Register' make the cluster widest — the mark is still clear of everything",
+                    description: "Signed out is the worst case, not the easiest: the two auth buttons (~160px together) stand in for a single 44px avatar, so the cluster reaches ~120px further left than it does signed in. This is the exact width and session the original screenshot was taken at. Compare the same width signed in and signed out; both must be clean, and if only one fails say which.",
+                    href: "/products",
+                },
+                {
+                    key: "mark-shifts-rather-than-overlapping",
+                    label: "When the cluster is too wide to leave room, the mark moves off-centre — it never ends up underneath an icon, and no control is clipped at the window edge",
+                    description: "The mark is now one of three in-flow tracks, so a crowded row makes it YIELD. Narrow past the point where a perfectly centred mark would no longer fit and confirm the degradation: the leaf slides toward the wordmark and stays fully visible, the icons keep their full 44px boxes, and nothing is cut off at the right edge. A leaf that vanishes under an icon, or a hamburger sliced by the edge, are both failures — record which.",
+                    href: "/products",
+                },
+                {
+                    key: "mark-centred-at-wide-widths",
+                    label: "At 1440px and wider the leaf is centred in the header, not nudged to one side",
+                    description: "With room to spare the two side tracks split the free space evenly, which should put the leaf on the header's midpoint. Maximise the window and eyeball it against the centre of the page — a mark that is visibly off-centre at a wide width means the tracks are no longer balanced, which is a different fault from the collision and should be reported separately.",
+                    href: "/products",
+                },
+                {
+                    key: "mark-absent-below-md",
+                    label: "At 767px and below there is no centred leaf, the wordmark keeps its own small leaf prefix, and the header has no odd empty gap",
+                    description: "The centred mark is `hidden` below md, which removes it as a layout item entirely — so the header should look exactly as it always has on mobile. Check 767px, 640px and 320px: no centred leaf, a small leaf immediately left of the 'LetItRip' wordmark, the action cluster still flush to the right edge with no stray gap, and the hamburger fully visible and tappable at 320px.",
+                    href: "/products",
+                },
+                {
+                    key: "mark-centred-in-left-hand-mode",
+                    label: "In left-hand mode the wordmark and the icons swap sides, the leaf stays centred, and it still overlaps nothing",
+                    description: "Hand mode mirrors the row, so this is where a layout fix most easily half-works. Turn on left-hand mode, then repeat the 1024px–1280px sweep: the wordmark must sit flush against the RIGHT edge with no gap, the icon cluster flush against the LEFT edge with the hamburger outermost, and the leaf still centred and untouched. A wordmark floating away from its edge means a side track lost its mirrored alignment.",
+                    href: "/products",
+                },
+            ],
+        },
         {
             pageKey: "nav-reachability",
             pageLabel: "Navigation — Every Item Reachable at Every Width",
@@ -6711,6 +6841,46 @@ const rawTesterChecklistItems = [
      * tester reporting "I did the actions" as if it were "the outcome was right".
      * ══════════════════════════════════════════════════════════════════════════ */
     ...group("money-flows", "Money Flows (end to end)", moneyFlowsPages),
+    /*
+     * The sticker-sheet kiss-cut tracer. Admin-only, under a PUBLIC prefix.
+     *
+     * 🛑 `adminOnly` is a presentation flag for the checklist, not the gate. The
+     * real boundary is the layout's server-side session read, which redirects a
+     * non-admin before any HTML exists — which is exactly what the buyer and
+     * guest cases below assert. Marking it admin-only here only keeps it out of a
+     * non-admin tester's list.
+     *
+     * Every case is an explicit BEFORE -> AFTER, because almost every defect this
+     * feature can have returns 200 with plausible content: a wrong part count, a
+     * watermarked original, a millimetre derived from a DPI nobody confirmed. A
+     * case reading "check the tracer works" would pass against all three.
+     */
+    ...group("tools", "Tools", [
+        {
+            pageKey: "sticker-tracer",
+            pageLabel: "Sticker sheet tracer",
+            href: "/tools/sticker-tracer",
+            cases: [
+                { key: "enclosed-region-opaque", label: "An enclosed region matching the paper colour stays OPAQUE inside its sticker" },
+                { key: "white-on-white-edge", label: "A white sticker edge on white paper is found with no per-sticker parameter" },
+                { key: "background-model-named", label: "The result names which background model ran (paper vs art)" },
+                { key: "name-required", label: "A run cannot be committed without a name" },
+                { key: "no-watermark-on-original", label: "A downloaded original carries NO watermark and comes from a signed GCS URL" },
+                { key: "progress-names-stage", label: "Live progress names the current STAGE, not just a percentage" },
+                { key: "failure-names-stage", label: "A failed run names the stage it died in and survives a reload" },
+                { key: "runs-never-overwrite", label: "A second run never overwrites the first — both stay in history" },
+                { key: "accepted-differs-from-succeeded", label: "'accepted' and 'succeeded' are distinct, and exactly one run is accepted" },
+                { key: "fullres-only-after-accept", label: "Full-resolution parts and the export surface appear only after accepting" },
+                { key: "no-dpi-no-mm", label: "With no confirmed DPI the export REFUSES rather than inventing a scale" },
+                { key: "oversized-named-not-scaled", label: "A part too wide for the machine is NAMED before export, never scaled" },
+                { key: "node-budget-reported", label: "The export node budget reports its cost in millimetres of deviation" },
+                { key: "retry-shows-clamp", label: "A retry SHOWS the resume clamp before it is applied" },
+                { key: "buyer-redirected", label: "A signed-in buyer is redirected and sees no Tools entry for it" },
+                { key: "guest-redirected", label: "A signed-out visitor is redirected; /tools itself is unaffected" },
+                { key: "storage-meter-honest", label: "The storage meter reports object COUNT beside bytes, and says when it truncated" },
+            ],
+        },
+    ], { adminOnly: true }),
 ];
 const defaultPhases = assignDefaultPhases(rawTesterChecklistItems);
 export const testerChecklistSeedData = rawTesterChecklistItems.map((item, index) => ({