@mohasinac/appkit 4.53.0 → 4.53.1

package/dist/features/tester/seed-data/authored/content-discovery__authenticity-checker.js

@@ -1,14 +1,15 @@
 /*
  * WHY: Authored six-part procedures for content-discovery/authenticity-checker.
- * WHAT: 13 cases, keyed by full checklist id.
+ * WHAT: 16 cases, keyed by full checklist id.
  *
  * 🛑 EVERY CASE IS WRITTEN AS BEFORE → AFTER, because this feature's whole
  * failure mode is a confident, plausible, wrong answer returned with HTTP 200. A
  * case reading "check the authenticity tool works" passes against all of these:
  *
- *   1. A two-state sign-in gate. `SessionProvider` mounts `initialUser={null}`,
- *      so `loading` starts true for SIGNED-IN users too — the page flashed "sign
- *      in to run a lookup" at an authenticated collector on every hard load.
+ *   1. A sign-in wall on the one surface whose whole purpose is being consulted
+ *      while standing in front of the item — and before that, a two-state gate
+ *      that flashed "sign in to run a lookup" at collectors who WERE signed in,
+ *      because `SessionProvider` mounts `initialUser={null}`.
  *   2. A verdict with no hedge. The engine can match a midfake batch code; the
  *      wrong version of that screen reads as an accusation against the seller.
  *   3. One date printed as fact. Two decodings of a Metal Fight box code
@@ -20,8 +21,12 @@
  *      line as "Pegasis" while Hasbro prints "Pegasus", and an earlier draft of
  *      the checker flagged the TT spelling as trademark evasion.
  *   7. Calling Funskool a fake. It is a licensed Indian importer.
- *   8. A sign-in wall with no public content, which is thin content to a crawler
- *      and useless to someone who arrived from search.
+ *   8. Picking a side on a code two compilations flatly disagree about, where
+ *      either answer costs a real person money.
+ *   9. Reporting a code its own source calls authentic as a reproduction,
+ *      because it appears in a list whose subject is a TYPEFACE.
+ *  10. Grading a Burst bey against the Metal Fight checklist in silence,
+ *      because the generation selector arrives pre-set and nobody touched it.
  *
  * So each case names what the wrong answer LOOKED like, and several assert the
  * presence of a hedge rather than the presence of a result.
@@ -39,13 +44,16 @@ export const authored = {
         startPage: "/tools/authenticity",
         steps: [
             "Open /tools/authenticity signed out.",
-            "Confirm there is exactly ONE sign-in box, and it sits where the lookup form would be.",
+            "Confirm the LOOKUP FORM itself is there and usable — Model name, Code on the box, Brand, Generation, How it was sold, and a 'Check it' button.",
+            "Confirm there is no sign-in card and no 'Sign in to run a lookup' text anywhere on the page.",
+            "Enter A0813 as the code and submit, still signed out.",
+            "Confirm a real assessment comes back rather than an error or a prompt to sign in.",
             "Scroll past it and confirm the generation table renders — six rows, each naming years, code prefixes and licensed marques.",
-            "Confirm the 'Checks that apply whatever the generation' list renders with real text in each row.",
-            "Answer no if the page is only a sign-in prompt, or if the reference content is missing.",
+            "Answer no if any part of the lookup asks for an account.",
         ],
-        expectedBehaviour: "BEFORE: gating the page would have meant a signed-out visitor — and a crawler — getting nothing but 'please sign in', which is thin content and throws away the highest-intent query this site can answer. AFTER: only the LOOKUP is gated. The generation table, the box-code explanation, the universal checks and the licensed-marque list are server-rendered and public, identical for crawlers and humans.",
-        expectedUiState: "One sign-in card reading 'Sign in to run a lookup', followed by the heading 'Which generation is it, and what does the box code mean' and six generation rows, then the universal checks, then 'Who is actually licensed'.",
+        inputs: { code: "A0813" },
+        expectedBehaviour: "BEFORE: the lookup required an account, so a buyer standing in a shop with the box in their hand was asked to register first — on the one surface whose whole purpose is being consulted at that moment, and the person most in need of it is the one least likely to have an account. AFTER: the entire page is public. What makes that safe is the shape of the output, not a gate: there is no 'counterfeit' verdict, the harshest outcome is 'likely reproduction', and every claim is about a production batch or a named brand rather than about a seller.",
+        expectedUiState: "The form, then (after submitting) a verdict block, then the heading 'Which generation is it, and what does the box code mean' with six generation rows, then the universal checks, then 'Who is actually licensed'. No sign-in card at any point.",
         expectedData: { generationRows: 6 },
         endResult: "Nothing is changed; this case only reads.",
     },
@@ -56,18 +64,18 @@ export const authored = {
             "Sign in as a buyer.",
             "Hard-reload /tools/authenticity (Ctrl+F5, not a soft navigation).",
             "Watch the lookup area through the first second of the load.",
-            "Answer no if the words 'Sign in to run a lookup' appear at any point.",
+            "Answer no if the words 'Sign in to run a lookup' or 'Checking your session…' appear at any point, or if the form is not usable immediately.",
         ],
-        expectedBehaviour: "BEFORE: a two-state gate (`!user` → prompt) showed the sign-in card to signed-in users on every hard load, because the session provider mounts with a null user and resolves asynchronously. AFTER: three states — while `loading` is true the area shows 'Checking your session…', and the prompt is reachable only once the session has resolved to no user.",
-        expectedUiState: "Either 'Checking your session…' briefly, then the form. Never the sign-in card.",
+        expectedBehaviour: "BEFORE: a two-state gate (`!user` → prompt) showed the sign-in card to signed-in users on every hard load, because the session provider mounts with a null user and resolves asynchronously; a three-state gate with a 'Checking your session…' placeholder fixed the flash. AFTER: the component reads no session at all, so neither string exists and there is nothing to resolve — the form is interactive on first paint.",
+        expectedUiState: "The form, immediately. No session placeholder, no sign-in card.",
         endResult: "The form is present after reload. Nothing persists.",
     },
     "checklist-content-discovery-authenticity-checker-midfake-code-reads-as-batch-not-accusation": {
         roles: ["buyer"],
         startPage: "/tools/authenticity",
         steps: [
-            "Sign in and open /tools/authenticity.",
-            "Enter A0813 in 'Code on the box' and leave everything else empty.",
+            "Open /tools/authenticity (no account needed).",
+            "Enter A0813 in 'Code on the box' and leave the other fields as they are.",
             "Submit.",
             "Read the verdict block and the caveat directly beneath it.",
             "Answer no if the screen anywhere calls the item counterfeit, or accuses the seller, or omits the caveat.",
@@ -115,12 +123,12 @@ export const authored = {
             "Enter 'Storm Pegasus' as the model name and BB-105 as the code. Submit.",
             "Confirm the verdict is 'Discrepancy found' and a signal explains that Storm Pegasus is BB-28 while BB-105 is a different release.",
             "Confirm the signal tells you a Random Booster or multi-pack is an innocent explanation.",
-            "Now tick 'This came in a Random Booster or a multi-pack' and submit again.",
+            "Now set 'How it was sold' to 'In a Random Booster or a multi-pack' and submit again.",
             "Confirm the verdict is no longer a discrepancy and a signal says a mismatch is EXPECTED for a Random Booster.",
             "Answer no if the second submission still reports a discrepancy.",
         ],
         inputs: { name: "Storm Pegasus", code: "BB-105", randomBooster: true },
-        expectedBehaviour: "BEFORE: flagging every name/code mismatch would flag a large class of genuine product, because a Random Booster box carries the BOOSTER's code and not the code of the bey inside — the reference table records several, e.g. Pisces DF145BS under F2810 marked 'Random Booster TT'. AFTER: the mismatch is reported as a question with the Random Booster explanation offered, and ticking the box re-reads it as expected rather than suspicious.",
+        expectedBehaviour: "BEFORE: flagging every name/code mismatch would flag a large class of genuine product, because a Random Booster box carries the BOOSTER's code and not the code of the bey inside — the reference table records several, e.g. Pisces DF145BS under F2810 marked 'Random Booster TT'. AFTER: the mismatch is reported as a question with the Random Booster explanation offered, and answering 'How it was sold' re-reads it as expected rather than suspicious. 🛑 That control is a THREE-option dropdown, not the checkbox it used to be: a checkbox could only express 'yes' and silence, and silence was read as a firm 'no' from a buyer who may simply not have the box in front of them.",
         expectedUiState: "First submission: 'Discrepancy found' plus a row naming both codes. Second: not a discrepancy, plus a row reading 'Code does not match the model — but you said this is a Random Booster'.",
         expectedData: { firstVerdict: "discrepancy-found", secondVerdict: "inconclusive" },
         endResult: "Nothing is written either time.",
@@ -177,15 +185,15 @@ export const authored = {
         roles: ["buyer"],
         startPage: "/tools/authenticity",
         steps: [
-            "Enter L9999 as the code and submit.",
-            "If asked which generation, choose Metal Fight.",
+            "Enter L9999 as the code and submit (Generation is already on Metal Fight).",
             "Read the signal about the code.",
             "Confirm it says the code is NOT RECORDED and explicitly that this does not mean fake.",
+            "Confirm it also states the size of the tables it searched, so 'not recorded' is reported against a known coverage rather than as a bare miss.",
             "Answer no if an unrecorded code is presented as evidence of a fake.",
         ],
         inputs: { code: "L9999", generation: "mfb" },
-        expectedBehaviour: "BEFORE: an absent lookup result reads as a negative result. The reference table is 90 distinct codes compiled by collectors from boxes they personally held, so it was never complete and new genuine codes surface regularly. AFTER: an unmatched code produces a neutral signal saying 'not recorded', with that reasoning stated.",
-        expectedUiState: "A neutral signal row saying L9999 is not in either table and that an absent code means 'not recorded', not 'fake'. The verdict is 'Inconclusive', never 'Likely reproduction'.",
+        expectedBehaviour: "BEFORE: an absent lookup result reads as a negative result. The tables are collectors' compilations from boxes they personally held — thorough at 495 original and 18 midfake codes across 45 models and 6 regions, and still not complete; new genuine codes surface regularly and an unphotographed regional batch is simply missing. AFTER: an unmatched code produces a neutral signal saying 'not recorded', with that reasoning and the coverage stated.",
+        expectedUiState: "A neutral signal row saying L9999 is not in any of the tables, naming how many codes were searched, and saying an absent code means 'not recorded', not 'fake'. The verdict is 'Inconclusive', never 'Likely reproduction'.",
         expectedData: { verdict: "inconclusive" },
         endResult: "Nothing is changed.",
     },
@@ -193,15 +201,16 @@ export const authored = {
         roles: ["buyer"],
         startPage: "/tools/authenticity",
         steps: [
-            "Submit the form with every field empty.",
-            "Confirm the tool asks for something rather than returning a verdict.",
-            "Now enter a name that matches nothing — 'zzzznope' — and submit.",
+            "Submit the form with every text field empty, leaving Generation on its Metal Fight default.",
+            "Confirm the tool asks you to say what you are looking at rather than returning a verdict about an item it knows nothing about.",
+            "Confirm it still shows the Metal Fight checklist, since that much IS known.",
+            "Now set Generation to 'Not sure / something else', enter a name that matches nothing — 'zzzznope' — and submit.",
             "Confirm a question appears asking which generation it is, with six options each naming years and example code prefixes.",
-            "Answer no if the tool returns any verdict at all without being able to establish a generation.",
+            "Answer no if an empty submission returns a verdict such as 'Nothing contradicts it', or if the generation question never appears when no generation is set.",
         ],
         inputs: { name: "zzzznope" },
-        expectedBehaviour: "BEFORE: guessing a generation hands the user a confidently wrong checklist — tri-wing screws mean something on Burst and nothing on a 2001 plastic bey, and the box date-code table only covers the Metal series. AFTER: with no generation established the verdict is 'Need a bit more' and a question is asked, with the reason for asking stated.",
-        expectedUiState: "A 'Need a bit more' badge and a question headed 'Which generation is it?' with six buttons, each labelled with the generation, its years and an example code shape.",
+        expectedBehaviour: "BEFORE: guessing a generation hands the user a confidently wrong checklist — tri-wing screws mean something on Burst and nothing on a 2001 plastic bey, and the box date-code table only covers the Metal series. 🛑 And once the selector gained a Metal Fight default, every empty submission carried a generation, which was briefly enough to escape the 'nothing to go on' branch — so pressing Check with nothing typed answered 'Nothing contradicts it, and nothing confirms it either': a verdict, about no item, phrased as reassurance. AFTER: a generation alone is still nothing to go on, and the branch uses it for the checklist instead of treating it as an answer.",
+        expectedUiState: "Empty submission → a 'Need a bit more' badge, 'Tell me what you are looking at.', and the Metal Fight checks. With Generation cleared and an unmatched name → a question headed 'Which generation is it?' with six buttons.",
         expectedData: { verdict: "needs-input" },
         endResult: "Nothing is changed.",
     },
@@ -213,31 +222,257 @@ export const authored = {
             // A tester step is prose a human types into a devtools console: it cannot
             // import a constant, and calling the real URL signed out IS the case.
             // audit-hardcoded-api-routes-ok: literal URL inside a manual test procedure
-            "Run: await fetch('/api/tools/authenticity', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ code: 'A0813' }) }).then(r => r.status)",
-            "Confirm the status is 401 (or 403) and not 200.",
-            "Confirm the response body contains no assessment — no verdict, no signals.",
-            "Answer no if a signed-out call returns an assessment.",
+            "Run: await fetch('/api/tools/authenticity', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ code: 'A0813' }) }).then(r => r.json())",
+            "Confirm the response is a real assessment — it has a verdict and signals — and not a 401.",
+            // audit-hardcoded-api-routes-ok: literal URL inside a manual test procedure
+            "Now run the same fetch with an extra key the schema does not declare, e.g. body: JSON.stringify({ code: 'A0813', listingId: 'x' }), and read r.status.",
+            "Confirm THAT one is refused with a 400 rather than quietly ignoring the unknown key.",
+            "Answer no if the plain call is refused, or if the unknown-key call succeeds.",
         ],
         inputs: { code: "A0813" },
-        expectedBehaviour: "BEFORE: gating only the UI leaves the endpoint open, and the endpoint is where the output actually comes from — 'this matches a batch recorded as a midfake' read off an anonymous API is a quotable claim with no account behind it. AFTER: `auth: true` on the route refuses the call before the engine runs.",
-        expectedUiState: "The console shows 401 or 403. No verdict text appears anywhere in the response.",
-        expectedData: { status: 401 },
-        endResult: "Nothing is written; no assessment is produced.",
+        expectedBehaviour: "BEFORE: the route required `auth: true`, so the endpoint refused an anonymous caller. The reasoning was that 'this matches a batch recorded as a midfake' is a quotable claim that should have an account behind it; in practice it put a registration wall in front of someone standing in a shop. AFTER: the route is public and the protection is in the output's shape instead — no 'counterfeit' rung, nothing said about a seller. The `.strict()` schema is still enforced, so an undeclared key is a 400 and never a confident assessment of a different, emptier question.",
+        expectedUiState: "The console shows an object with a verdict and a signals array for the first call, and status 400 for the second.",
+        expectedData: { status: 200 },
+        endResult: "Nothing is written; the engine does zero I/O.",
     },
-    "checklist-content-discovery-authenticity-checker-json-ld-declares-the-gate": {
+    "checklist-content-discovery-authenticity-checker-json-ld-declares-no-false-gate": {
         roles: ["guest"],
         startPage: "/tools/authenticity",
         steps: [
             "Signed out, view source on /tools/authenticity (Ctrl+U, not devtools' rendered DOM).",
             "Find the application/ld+json block with \"@type\": \"WebApplication\".",
-            "Confirm it carries isAccessibleForFree true at the top level and a hasPart entry with isAccessibleForFree FALSE and a cssSelector.",
-            "Copy that cssSelector value and run document.querySelectorAll(<selector>).length in the console.",
-            "Confirm the count is 1 — the selector matches a real element on the page.",
-            "Answer no if the selector matches nothing, or if the gate is undeclared.",
-        ],
-        expectedBehaviour: "BEFORE: a page with gated content and no declaration is a structured-data mismatch — and the alternative mistake, serving the reference content only to crawler user-agents, is cloaking. AFTER: the page declares the gate exactly as the guest-price gate does: the free reference content is marked free, and the lookup region is carved out by selector as not free. 🛑 Root Cause #93 is the record of the failure this case exists to catch — a class name and a selector living as two literals in two files, where a rename points the crawler at a selector matching nothing and looks identical to making no declaration at all.",
-        expectedUiState: "A WebApplication JSON-LD block naming the tool, plus a breadcrumb block. The hasPart cssSelector resolves to exactly one element in the live DOM.",
-        expectedData: { gatedSelectorMatches: 1 },
+            "Confirm it carries isAccessibleForFree true.",
+            "Confirm there is NO hasPart entry, and no isAccessibleForFree false anywhere in the block.",
+            "Search the page source for 'authenticity-gated-tool' and confirm it does not appear.",
+            "Answer no if the markup still declares a paywalled region.",
+        ],
+        expectedBehaviour: "BEFORE: the lookup needed an account, and the page declared that honestly — `isAccessibleForFree: true` overall plus a `hasPart` node carving out the lookup by cssSelector as not free (the same pattern the guest-price gate uses). AFTER: the gate is gone, so the declaration had to go with it. A paywall node a crawler can see is false is worse than no node at all, and the class it named was deleted rather than left in the DOM as a selector nothing references — 🛑 Root Cause #93 is exactly that pair drifting apart.",
+        expectedUiState: "A WebApplication JSON-LD block naming the tool with isAccessibleForFree true and no hasPart, plus a breadcrumb block.",
+        expectedData: { hasPartNodes: 0 },
         endResult: "Nothing is changed; this case only reads.",
     },
+    "checklist-content-discovery-authenticity-checker-defaults-to-metal-fight": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Open /tools/authenticity.",
+            "Read the Generation control WITHOUT touching it — confirm it already shows Metal Fight.",
+            "Enter L9999 as the code and submit without changing anything.",
+            "Confirm the result is produced immediately and is NOT a 'Which generation is it?' question.",
+            "Now enter B-174 as the code, leave Generation on Metal Fight, and submit.",
+            "Confirm a signal appears saying Metal Fight is selected but this looks like Burst, and that it tells you to change the selector.",
+            "Answer no if the default is absent, or if a Burst code is silently graded against the Metal Fight checklist with no mention of the mismatch.",
+        ],
+        inputs: { code: "B-174" },
+        expectedBehaviour: "BEFORE: the tool opened with no generation and asked for one before it would say anything, which made the commonest question — 'what does this code on my Metal Fight box mean' — cost a selection first. Everything the box-code tables know is Metal-series. AFTER: the selector is pre-set to Metal Fight. 🛑 The risk a pre-set default creates is handled rather than ignored: a supplied generation still wins, because the user can see the box and the engine cannot, but a code or name implying a different generation raises a `generation-mismatch` signal naming both. A default that cannot be questioned is the thing to avoid.",
+        expectedUiState: "The Generation control reads 'Metal Fight (Metal Fusion / Masters / Fury) — 2008–2012' on load. With B-174 submitted, a neutral signal headed 'You have Metal Fight … selected, but this looks like Burst'.",
+        expectedData: { defaultGeneration: "mfb" },
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-contested-code-reports-the-disagreement": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter I2211 as the code and submit.",
+            "Confirm the verdict badge reads 'Discrepancy found' and NOT 'Likely reproduction' and NOT 'Consistent with an original'.",
+            "Confirm the headline says the sources contradict each other about this code.",
+            "Confirm a signal names BOTH sides — which compilation records it on genuine boxes and which lists it as a midfake.",
+            "Answer no if the screen picks a side, or presents either reading as the answer.",
+        ],
+        inputs: { code: "I2211" },
+        expectedBehaviour: "BEFORE: merging three code compilations put four codes (I0511, I2211, I2611, J2712) in two tables at once, and whichever table the lookup scanned first would have won. That is a coin flip with a person's money on it in both directions — the midfake reading accuses whoever is holding a genuine box, the original reading reassures whoever is holding a fake. AFTER: contested codes live in their own table, are checked before the precedence scan, and are reported as the disagreement they are.",
+        expectedUiState: "A 'Discrepancy found' badge, the headline 'My sources contradict each other about this exact code.', and a signal row naming the model-by-model list and the 2021 reference post on one side and the midfake list on the other.",
+        expectedData: { verdict: "discrepancy-found" },
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-font-midfake-does-not-accuse": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter D0511 as the code and submit.",
+            "Confirm the verdict is 'Discrepancy found' — NOT 'Likely reproduction'.",
+            "Read the midfake signal and confirm it says the point is the TYPEFACE and that the source considers the code itself authentic.",
+            "Now enter H3011 instead and submit.",
+            "Confirm THAT one does reach 'Likely reproduction' and names the high-quality Sonokong fakes.",
+            "Answer no if D0511 is reported as a reproduction, or if H3011 is not.",
+        ],
+        inputs: { code: "D0511" },
+        expectedBehaviour: "BEFORE: every row in the midfake table drove the harshest verdict the engine has. Three of the Chinese rows carry their own author's words that *the code itself should be authentic* and only the printed font differs, so that verdict would have been the engine asserting something no source did, about someone's property, in the worst available direction. AFTER: a midfake row the source hedged on is still a concern — it lands on 'resolve this before you pay' with the font comparison spelled out — but only an unhedged row reaches 'likely reproduction'.",
+        expectedUiState: "D0511 → 'Discrepancy found', with a signal explaining the typeface comparison. H3011 → 'Likely reproduction', with a signal about Korean boxes reproducing the importer panel and a Safety block.",
+        expectedData: { d0511Verdict: "discrepancy-found", h3011Verdict: "likely-reproduction" },
+        endResult: "Nothing is written either time.",
+    },
+    "checklist-content-discovery-authenticity-checker-regional-code-reads-as-regional": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter C2811 as the code and submit.",
+            "Confirm the signal names the regions the code is recorded in, and that Korea (Sonokong) is among them.",
+            "Now enter K2510 and submit.",
+            "Confirm that one names Middle East (NewBoy), and that its source note says the 2021 post could only call it 'seems legit' while the later list records it as a genuine New Boy release.",
+            "Answer no if a regional code comes back with no region, or is presented as unrecorded.",
+        ],
+        inputs: { code: "C2811" },
+        expectedBehaviour: "BEFORE: the table was 90 Japanese-centric codes with no region data, so a buyer holding a Korean Sonokong or Middle-East New Boy box got 'not recorded' — which reads as a warning about a perfectly genuine regional release. AFTER: 495 codes across 45 models and 6 regions, and the signal says which region the code is recorded in. The five New Boy codes the 2021 post could only hedge about are resolved by the later list, carrying that history in their notes rather than being quietly upgraded.",
+        expectedUiState: "C2811 → a supporting signal reading 'Recorded on … releases' naming Korea (Sonokong). K2510 → the same shape naming Middle East (NewBoy), plus the 'seems legit' history.",
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-series-window-names-the-production-run": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter C2312 as the code and submit (Generation stays on Metal Fight).",
+            "Confirm a signal says the date falls inside a NAMED production window, and names it 'Metal Fury' with a start and end date.",
+            "Confirm the signal says this is about the CALENDAR DATE, not about the code itself.",
+            "Now enter A0813 instead and submit.",
+            "Confirm there is NO series-window signal for A0813 — its derived date (8 January 2013) is after every window the source states ends (Shogun Steel, 23 December 2012).",
+            "Answer no if the window signal is missing for C2312, or present for A0813.",
+        ],
+        inputs: { code: "C2312" },
+        expectedBehaviour: "BEFORE: the reference post's own 'Additional Information' section — the only place any source states a MANUFACTURING WINDOW rather than one code's date (Metal Fusion/Masters/Fury, Shogun Steel) — was parsed for nothing; the tool could only ever say what a specific code decoded to. AFTER: every derivable date is checked against those four windows and named when it falls inside one. This is a fact about the calendar, so it fires even for C2312, which matches no code in any table.",
+        expectedUiState: "C2312 → a signal reading 'Falls inside the Metal Fury production window', naming '3 April 2011 – 1 April 2012'. A0813 → no such signal at all.",
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-temporal-context-for-an-unmatched-code": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter C2312 as the code and submit.",
+            "Confirm the main 'not in any of the tables' signal is still present and still says not-recorded is not fake.",
+            "Find a SEPARATE signal headed 'What the tables record from March 2012'.",
+            "Confirm it lists several genuine releases from that month BY NAME, and explicitly says 'Midfake batches: none recorded' rather than omitting that half.",
+            "Confirm the detail text explicitly says this is NOT a match for the code and your item matching none of the names is NOT evidence of anything.",
+            "Answer no if the month-context signal is missing, or if it reads as though it identifies the item.",
+        ],
+        inputs: { code: "C2312" },
+        expectedBehaviour: "BEFORE: a code that matched nothing got exactly one sentence — 'not recorded, not fake' — and nothing else, even though the tables know a great deal about what else was moving through production the same month. AFTER: for a well-formed code that matches no table row, the engine also reports every genuine and midfake product name recorded from the SAME CALENDAR MONTH, explicitly framed as context rather than a match. 🛑 This only fires for an UNMATCHED code — a code that DID match something already has its own, richer product list, and piling month-context on top of that would dilute the one thing that actually matters (the match itself, or for a contested code, the disagreement).",
+        expectedUiState: "A signal titled 'What the tables record from March 2012' listing names like Diablo Nemesis X:D, Fang Leone 130W²D, Kreis Cygnus, Phantom Orion and others, ending '… and N more', followed by 'Midfake batches: none recorded.' and the context/not-evidence sentence.",
+        endResult: "Nothing is changed.",
+    },
+};
+/*
+ * ── Guards for the near-miss work (2026-10-19) ──────────────────────────
+ *
+ * 🛑 All four protect behaviour that is ALREADY CORRECT, and that is the
+ * point of them. A "did you mean" affordance is precisely the change that
+ * could turn an absent code into an accusation, and this tool's third rule
+ * is that a false counterfeit accusation against a real seller is worse
+ * than a missed one.
+ *
+ * Appended as a second export rather than merged into the map above, so the
+ * diff shows what the near-miss change added and the original 21 cases stay
+ * byte-identical.
+ */
+export const authoredNearMiss = {
+    "checklist-content-discovery-authenticity-checker-authenticity-unknown-code-is-not-fake": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Open /tools/authenticity.",
+            "Leave the model name empty.",
+            "Enter Z9999 in the box-code field — well-formed (one letter, four digits) but in no table.",
+            "Pick any generation.",
+            "Run the check.",
+            "Read the verdict chip, the headline and the caveat word for word.",
+            "Read every row under 'What I checked' and note each row's direction.",
+        ],
+        inputs: { code: "Z9999" },
+        expectedBehaviour: "An unmatched code is NOT evidence in either direction. New genuine codes appear regularly, and counterfeiters use real codes anyway — this project's own crawl found 516 real B-xx codes on one counterfeit catalogue.",
+        expectedUiState: "The verdict is 'Inconclusive'. The code signal reads NEUTRAL, and its text says the code is not recorded rather than that the item is fake. No wording anywhere implies counterfeit, and no verdict more severe than inconclusive appears. Either of those is the failure.",
+        endResult: "Read-only; nothing persists.",
+    },
+    "checklist-content-discovery-authenticity-checker-authenticity-near-miss-suggests": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Open /tools/authenticity.",
+            "Find a code the tool recognises — A0813 is a known one.",
+            "Enter A0831 instead: the same characters with one pair transposed.",
+            "Run the check.",
+            "Read the suggestion line and note where on the page it sits.",
+            "Read every row under 'What I checked'.",
+            "Write down the verdict.",
+            "Run the check again with the transposition removed and compare the verdict.",
+        ],
+        inputs: { nearMiss: "A0831", realCode: "A0813" },
+        expectedBehaviour: "A near-miss is INPUT CORRECTION, never evidence. It is ambiguous between a typo and a batch deliberately mimicking a real code, and an ambiguous signal must not become an accusation.",
+        expectedUiState: "A neutral line offers 'did you mean A0813?'. It sits OUTSIDE the 'What I checked' list and does NOT appear as a signal row. No evasion or counterfeit warning fires. The verdict is identical to what the same input produced before the suggestion existed.",
+        endResult: "Read-only; nothing persists.",
+    },
+    "checklist-content-discovery-authenticity-checker-authenticity-inconclusive-asks-for-more": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Open /tools/authenticity.",
+            "Leave the model name EMPTY.",
+            "Enter a plausible box code and pick a generation.",
+            "Run the check.",
+            "Read the caveat under the verdict word for word.",
+            "Now fill in a model name as well and run it again.",
+            "Compare the two caveats.",
+        ],
+        expectedBehaviour: "Name-against-code agreement is one of the engine's strongest signals and cannot be computed with only one of the two. The tool already asks which generation and already asks which model on an ambiguous name; asking for the missing half is the same mechanism one input over.",
+        expectedUiState: "With no name, the caveat says that supplying the model name lets the tool cross-check it against the code, and offers asking the seller for a photo of the box bottom and the screws. With the name supplied, that prompt is gone. The VERDICT is 'Inconclusive' in both cases — only the caveat differs.",
+        endResult: "Read-only; nothing persists.",
+    },
+    "checklist-content-discovery-authenticity-checker-authenticity-evasion-warning-survives": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Open /tools/authenticity.",
+            "Type Pegasis in the model name field — note the spelling, 'sis' not 'sus'.",
+            "If a typeahead offers canonical names, read them but do NOT pick one yet.",
+            "Run the check and read every row under 'What I checked'.",
+            "Note whether a trademark-evasion or fuzzy-spelling signal fired.",
+            "Now clear the field, type Pegasis again, and this time PICK 'Storm Pegasus' from the typeahead.",
+            "Run the check again and compare the signals.",
+        ],
+        inputs: { evasionSpelling: "Pegasis", canonical: "Storm Pegasus" },
+        expectedBehaviour: "This is the hazard the whole separation exists for. The site search matcher deliberately treats 'Pegasis' as a match for 'Storm Pegasus' — its alias table is derived FROM a counterfeit seller's 1,277 titles, on the insight that an evasion spelling is the same string a buyer mistypes. This tool treats that same spelling as EVIDENCE. If picking a canonical name replaced what the user typed, the warning would be silenced by construction and the tool would confirm a fake using the exact spelling that indicates one.",
+        expectedUiState: "The evasion/fuzzy signal fires in BOTH runs. A case asserting only 'the typeahead found it' would pass against precisely the bug this guards, so the second run is the one that matters.",
+        endResult: "Read-only; nothing persists.",
+    },
+};
+/*
+ * ── The name typeahead (2026-10-19) ──────────────────────────────────────
+ *
+ * `EntityTypeahead` is wired into the model-name field with
+ * `fillOnPick={false}` for exactly the reason `authenticity-name-typeahead`
+ * below checks: picking a suggestion must never replace what the engine
+ * analyses, or the evasion signal `authenticity-evasion-warning-survives`
+ * guards would be silenced by the very feature meant to help discovery.
+ */
+export const authoredTypeahead = {
+    "checklist-content-discovery-authenticity-checker-authenticity-name-typeahead": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Open /tools/authenticity.",
+            "Type a partial model name into the model-name field, e.g. Drago.",
+            "Read the suggestions offered beneath the field.",
+            "Click one of the suggestions.",
+            "Read the model-name field's actual text after clicking.",
+            "Read any confirmation line that appeared.",
+            "Run the check and read the result.",
+        ],
+        inputs: { partial: "Drago" },
+        expectedBehaviour: "The typeahead is discovery only. Clicking a suggestion must NOT overwrite the field — if it did, the engine would analyse the canonical name instead of what the user actually typed, which is the mechanism `authenticity-evasion-warning-survives` exists to catch happening the other way.",
+        expectedUiState: "Canonical releases appear as the user types. After clicking one, the field still shows exactly what was typed (e.g. 'Drago'), and a muted confirmation line names the matched release separately. The check result is consistent with the typed text, not the clicked suggestion.",
+        endResult: "Read-only; nothing persists.",
+    },
+    "checklist-content-discovery-authenticity-checker-authenticity-box-code-still-instant": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Open /tools/authenticity and open DevTools → Network.",
+            "Clear the network log.",
+            "Enter a known box date code (e.g. A0813) in the code field, leaving the name field empty.",
+            "Run the check.",
+            "Read the network log for any request to a search endpoint or the search artifact.",
+        ],
+        inputs: { code: "A0813" },
+        expectedBehaviour: "GUARD CASE. The box date-code table is bundled locally and resolves with zero network requests — this was true before the typeahead work and must stay true, because the two code paths (date-code lookup vs. name typeahead) are independent.",
+        expectedUiState: "The result renders immediately. The network log shows no fetch to the search artifact or any /api/search* endpoint.",
+        endResult: "Read-only; nothing persists.",
+    },
 };

package/dist/features/tester/seed-data/authored/content-discovery__category-tabs-franchise-bundles.js

@@ -1,7 +1,7 @@
 /*
  * WHY: Authored six-part procedures for the categories-index tabs, the
  *      franchise unit and the bundle collage (2026-10-14).
- * WHAT: 8 cases, keyed by full checklist id.
+ * WHAT: 9 cases, keyed by full checklist id.
  *
  * 🛑 EVERY CASE IS BEFORE → AFTER, because every defect this work produced
  * rendered a page that looked fine:
@@ -9,17 +9,19 @@
  *   1. The index rendered all 1,185 rows flat — six roots buried under 752
  *      part leaves. A case reading "the categories page loads" passes against
  *      that.
- *   2. The Parts tab first returned 772, catching the 20 classification NODES
- *      as well as the leaves, because their own `parentIds` also pass through
- *      a `*-parts` node. A list mixing "Attack Rings" with attack rings is not
- *      visibly wrong.
- *   3. Seven franchises have no stock. Active, each is a card opening an empty
+ *   2. Seven franchises have no stock. Active, each is a card opening an empty
  *      shop; absent, seventeen `CharacterHotspot` links stay 404. Both look
  *      correct from any single page — which is why two cases here check the
  *      index and the detail page SEPARATELY.
- *   4. Every bundle also carries a placeholder cover, so a collage tested
+ *   3. Every bundle also carries a placeholder cover, so a collage tested
  *      after the cover never renders — and one grey tile is not "broken".
  *
+ * 🛑 A fifth PARTS tab was removed 2026-10-20 and its case deleted with it.
+ * Parts live at `/parts/[classification]/[code]` and in the spares listing
+ * type; a flat tab over 752 leaves was the worse half of both. The
+ * product-detail Parts COMPOSITION tab is unrelated and still covered, on the
+ * `parts-database` page.
+ *
  * So each case counts an exact number or compares two surfaces. Several carry
  * a nonsense control, because a filter that returns everything looks identical
  * to a filter that works.
@@ -47,49 +49,36 @@ export const authored = {
         expectedData: { rootCards: 6 },
         endResult: "Nothing is changed; this case only reads.",
     },
-    "checklist-content-discovery-category-tabs-franchise-bundles-five-tabs-no-all": {
+    "checklist-content-discovery-category-tabs-franchise-bundles-four-tabs-no-all-no-parts": {
         roles: ["guest"],
         startPage: "/categories",
         steps: [
             "Open /categories.",
             "Read the tab bar.",
-            "Confirm there are exactly five tabs: Categories, Brands, Franchises, Parts, Bundles.",
+            "Confirm there are exactly four tabs: Categories, Brands, Franchises, Bundles.",
             "Answer no if a tab labelled 'All' is present.",
+            "Answer no if a tab labelled 'Parts' is present.",
+            "Open a product detail page for a named-model Beyblade — for example /categories/category-ace-dragon-sting-charge-zan reached through Spinning Tops, or any complete-top listing — and confirm its own 'Parts' / 'What it is made of' composition section is STILL there. That is a different tab on a different surface and must not have been removed.",
         ],
-        expectedBehaviour: "BEFORE: the tabs were All / Categories / Brands, and 'All' was the DEFAULT — it is what rendered the 1,185 rows. AFTER: five tabs, no 'All'. Every tab answers a question ('which parts do you have?'); 'all' answered none of them, which is why it was removed rather than reordered.",
-        expectedUiState: "Five tabs, named exactly as above, with no 'All'.",
-        expectedData: { tabCount: 5, hasAllTab: false },
-        endResult: "Nothing is changed; this case only reads.",
-    },
-    "checklist-content-discovery-category-tabs-franchise-bundles-parts-tab-is-leaves-only": {
-        roles: ["guest"],
-        startPage: "/categories",
-        steps: [
-            "Open /categories and click the Parts tab.",
-            "Read the total the pager reports.",
-            "Confirm it reads 752 and not 772.",
-            "Scan the first page and confirm every card is an individual PART — '1B', 'Ten Heavy', 'Neo Right SG'.",
-            "Answer no if a classification GROUP appears as a card: 'Attack Rings', 'Weight Disks', 'Performance Tips', 'Bit Chips'.",
-        ],
-        expectedBehaviour: "BEFORE: the tab returned 772, because the predicate matched any row whose ancestry passes a `*-parts` node — which is true of the 20 classification NODES as well as the leaves beneath them. The list mixed groups with their own contents and was not visibly wrong. AFTER: leaves only, 752. A part is a leaf by itself; a classification is a branch you reach by drilling down.",
-        expectedUiState: "752 parts reported. Every card is a single part; no classification group appears.",
-        expectedData: { partsTotal: 752, classificationNodesShown: 0 },
+        expectedBehaviour: "BEFORE the first fix: the tabs were All / Categories / Brands, and 'All' was the DEFAULT — it is what rendered the 1,185 rows. BEFORE this one: a fifth 'Parts' tab listed all 752 part leaves flat, duplicating /parts and the spares listing type with a worse version of both. AFTER: four tabs, no 'All' and no 'Parts'. The part leaves still exist and are still reached by drilling into a `*-parts` node; only the flat shortcut tab is gone. The product-level composition tab is untouched — removing that would have deleted the part database's own reason to exist.",
+        expectedUiState: "Four tabs, named exactly as above. No 'All', no 'Parts'. A model listing still shows its composition section.",
+        expectedData: { tabCount: 4, hasAllTab: false, hasPartsTab: false },
         endResult: "Nothing is changed; this case only reads.",
     },
     "checklist-content-discovery-category-tabs-franchise-bundles-tabs-do-not-overlap": {
         roles: ["guest"],
         startPage: "/categories",
         steps: [
-            "Open /categories and note the total each of the five tabs reports: Categories, Brands, Franchises, Parts, Bundles.",
-            "Expect 6, 28, 8, 752, 5.",
+            "Open /categories and note the total each of the four tabs reports: Categories, Brands, Franchises, Bundles.",
+            "Expect 6, 28, 8, 5.",
             "Pick one brand by name on the Brands tab — for example Takara-Tomy.",
-            "Open each of the other four tabs and search for that same name.",
+            "Open each of the other three tabs and search for that same name.",
             "Answer no if it appears on any tab other than Brands.",
             "Repeat once with a bundle name taken from the Bundles tab.",
         ],
         expectedBehaviour: "Brands, franchises and bundles are all tier-0 rows, so a predicate that tested the tier before the discriminator would list every one of them under Categories as well. The type check has to come first. A row on two tabs double-counts the catalogue and makes the totals unreadable.",
-        expectedUiState: "Tab totals read 6 / 28 / 8 / 752 / 5. The sampled brand and bundle each appear on exactly one tab.",
-        expectedData: { categories: 6, brands: 28, franchises: 8, parts: 752, bundles: 5 },
+        expectedUiState: "Tab totals read 6 / 28 / 8 / 5. The sampled brand and bundle each appear on exactly one tab.",
+        expectedData: { categories: 6, brands: 28, franchises: 8, bundles: 5 },
         endResult: "Nothing is changed; this case only reads.",
     },
     "checklist-content-discovery-category-tabs-franchise-bundles-franchise-index-hides-unstocked": {
@@ -149,4 +138,37 @@ export const authored = {
         expectedData: { bundleCards: 5, cardsWithCollage: 5 },
         endResult: "Nothing is changed; this case only reads.",
     },
+    "checklist-content-discovery-category-tabs-franchise-bundles-tabs-collapse-on-narrow-viewport": {
+        roles: ["guest"],
+        startPage: "/categories",
+        steps: [
+            "Resize the viewport to a phone width, around 390px.",
+            "Open /categories.",
+            "Look at the tab row reading Categories / Brands / Franchises / Bundles.",
+            "BEFORE a fix landed 2026-10-19: this was a plain row of `<Button variant=\"ghost\">`s with a hand-written underline — no `role=\"tablist\"`, no overflow handling, and on a narrow viewport the later tabs ran past the right edge with no scrollbar and no visible way to reach them.",
+            "AFTER: the row is `<OverflowRow>`. Confirm it has collapsed into a single trigger button showing the active tab's name plus a chevron.",
+            "Click the trigger. Confirm a searchable dropdown opens listing all four tabs.",
+            "Pick a different tab from the dropdown and confirm the page re-filters to it.",
+        ],
+        expectedBehaviour: "A row of controls that does not fit its container must become a trigger that opens a searchable list, not a row the visitor has to discover can be scrolled. `<OverflowRow>` is the one primitive this project built for exactly this shape (see CLAUDE.md § Overflowing Pill & Tab Rows) — the old row predates it and was never migrated. 🛑 Four tabs can still overflow 390px: the threshold is MEASURED width, never a count (that is why `TabsList`'s old `items.length > 5` rule was deleted), so dropping the fifth tab does not retire this case.",
+        expectedUiState: "At 390px: one trigger button, not four separate tab buttons. Opening it shows all four tabs in a dropdown, each clickable, with the active one marked.",
+        expectedData: { tabsVisibleAsRowAt390px: false, collapsedTriggerPresent: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-category-tabs-franchise-bundles-tabs-hover-changes-ink": {
+        roles: ["guest"],
+        startPage: "/categories",
+        steps: [
+            "Open /categories on a desktop-width viewport (at least 1024px, so the tabs render as a row rather than a collapsed trigger).",
+            "Pick a tab that is NOT currently active.",
+            "BEFORE a fix landed 2026-10-19: this row (and several others — the notification bell, the admin sidebar/nav/header, the mobile bottom-nav item) carried two competing `hover:text-*` classes on one element, one of which resolved to the element's own RESTING colour. Hovering therefore changed nothing, which reads as 'hover is broken' rather than as a styling bug.",
+            "Hover the mouse pointer over the inactive tab's label without clicking.",
+            "Compare its text colour before and during the hover.",
+            "Move the pointer away and confirm the colour returns to the resting shade.",
+        ],
+        expectedBehaviour: "Every hover state must visibly differ from the resting state. A hover ink that equals the resting ink is indistinguishable from no hover handler at all.",
+        expectedUiState: "The inactive tab's text colour visibly changes while hovered, and reverts when the pointer leaves.",
+        expectedData: { hoverChangesTextColor: true },
+        endResult: "Nothing is changed; this case only reads.",
+    },
 };

package/dist/features/tester/seed-data/authored/content-discovery__parts-database.js

@@ -36,12 +36,13 @@ export const authored = {
         startPage: "/parts",
         steps: [
             "Open /parts.",
+            "Confirm the page heading reads 'Beyblade parts gallery'.",
             "Count the classification tiles.",
             "Confirm every tile reads as a part NAME in sentence case — 'Performance Tip', 'Fusion Wheel', 'Bit Chip' — and not as a URL slug like 'performance-tip' or 'bit-chip'.",
             "Open any one tile and confirm it loads a page rather than 404ing.",
         ],
-        expectedBehaviour: "BEFORE: there was no parts database at all, so a buyer reading '105RF' on a listing had nowhere to learn that 105 is a spin-track height and RF is a rubber flat tip. AFTER: 20 classifications, each a real page. The labels come from a compile-checked map rather than being title-cased from the slug, because 'Bit Chip' is not 'bit-chip' title-cased and 'Armour' is not 'armour'.",
-        expectedUiState: "Exactly 20 tiles, each labelled in sentence case, each a working link.",
+        expectedBehaviour: "BEFORE: there was no parts reference at all, so a buyer reading '105RF' on a listing had nowhere to learn that 105 is a spin-track height and RF is a rubber flat tip. AFTER: 20 classifications, each a real page, under the heading 'Beyblade parts gallery'. The labels come from a compile-checked map rather than being title-cased from the slug, because 'Bit Chip' is not 'bit-chip' title-cased and 'Armour' is not 'armour'.",
+        expectedUiState: "The heading reads 'Beyblade parts gallery'. Exactly 20 tiles, each labelled in sentence case, each a working link.",
         expectedData: { classificationTiles: 20 },
         endResult: "Nothing is changed; this case only reads.",
     },

package/dist/features/tester/seed-data/authored/content-discovery__price-index-and-compare.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;