@nextcommerce/campaigns-os 1.47.0 → 1.48.0

package/src/doctor/checks.mjs

@@ -363,7 +363,7 @@ const SPEC_DOCTOR_CHECKS = createDoctorCheckRegistry([
   {
     id: PAGE_KIT_SDK_VERSION_SCOPE,
     phase: "target",
-    run: ({ spec, errors, warnings, ready, derived, buildState }) => validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState),
+    run: ({ spec, packet, errors, warnings, ready, derived, buildState }) => validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState, packet),
   },
   {
     id: PAGE_KIT_STORE_PROFILE_SCOPE,
@@ -1159,17 +1159,22 @@ function validateLocalProof(packet, report, errors, warnings, ready) {
   addIssue(errors, LOCAL_PROOF_PARITY_SCOPE, `Production parity FAILED${difference ? ` — first non-gated difference: ${singleLineField(String(difference.kind))} at ${singleLineField(String(difference.route))}${difference.line ? ` line ${difference.line}` : ""}: ${singleLineField(String(difference.detail || ""))}` : `: ${singleLineField(String(parity.summary || ""))}`}. Rebuild in development, re-prove, and run ${parityCommand} again. ${LOCAL_PROOF_NEVER_EDIT_RULE}`, difference ? { first_difference: difference } : undefined);
 }
 
-function validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState) {
+function validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState, packet = null) {
   const report = buildState?.report || null;
   const required = stageIsTerminal(report?.stages?.setup?.status)
     || stageIsTerminal(report?.stages?.assembly?.status)
     || derived.scaffold_required !== true;
+  const family = packet?.assembly?.template_family;
+  const verified = isNonEmptyString(family) && isCertifiedTemplateFamily(family)
+    ? assessTemplateFreshness({ family, catalog: resolveCommerceCatalog(), sdkSupportPolicy: defaultSdkSupportPolicy() }).verified_sdk_version
+    : null;
   const gate = evaluatePageKitSdkVersion({
     spec,
     specStatus: buildState?.specStatus || "ok",
     targetLoad: buildState?.pageKitCampaignConfig,
     waivers: report?.waivers,
     required,
+    familyVerification: verified ? { family, sdk_version: verified } : null,
   });
   derived.checkpoint_gates.push(gate);
 
@@ -3199,7 +3204,7 @@ function validateSourceCoverage(packet, packetPath, spec, errors, warnings, read
             addIssue(
               warnings,
               "source_html.pages.source_hash",
-              `Source page "${page.page_id}" hash mismatch — file at ${page.path} has changed since the manifest was written (manifest sha256=${expectedHash.slice(0, 12)}…, on-disk sha256=${actualHash.slice(0, 12)}…). Re-run the producer to refresh the manifest, or accept the local edits.`,
+              `Source page "${page.page_id}" hash mismatch — file at ${page.path} has changed since intake recorded it in the Build Packet (recorded sha256=${expectedHash.slice(0, 12)}…, on-disk sha256=${actualHash.slice(0, 12)}…). This warning does not block. Re-running start or prepare-build with --force records the current file and clears recorded stage evidence; editing the source-html manifest alone does not change the hash the packet holds.`,
             );
           }
         }
@@ -4018,11 +4023,11 @@ function collectPlaceholderTextResidueMatches(root, terms) {
 }
 
 // Rendered-output content-residue scan (assembly-surfaces prototype): scans
-// BUILT pages for the needs-merchant-input marker and urgency chrome rendered
-// without verified offer urgency (blockers), plus demo/placeholder residue and
-// generic content anti-pattern hits (warnings feeding the review/attestation
-// queue). Scans _site output, not frontmatter — layout/script-rendered chrome
-// only exists after the build.
+// BUILT pages for the needs-merchant-input marker and, on a brief-backed
+// build, starter countdown chrome the brief does not verify (blockers), plus
+// template demo/placeholder residue (warnings). The merchant's own proof and
+// urgency copy is not scanned. Scans _site output, not frontmatter —
+// layout/script-rendered chrome only exists after the build.
 export function validateBuiltContentResidue(packet, errors, warnings, ready, derived, buildState = {}) {
   if (!isStageComplete(buildState.report, "assembly")) return;
   // Scan the RENDERED _site output, not the campaign source dir: the Liquid
@@ -4035,7 +4040,7 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
   const urgencyVerified = briefUrgencyVerified(brief?.payload);
   const findings = scanBuiltOutputContentResidue(siteRoot, { urgencyVerified });
   if (!findings.length) {
-    ready.push("Built output carries no needs-input markers, unverified urgency chrome, or content-residue hits");
+    ready.push("Built output carries no needs-input markers, unverified urgency chrome, or template demo residue");
     return;
   }
   // One issue per finding id, carrying the FULL file inventory: the id keeps
@@ -4068,9 +4073,8 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
       );
     } else if (id === "unverified_urgency_countdown") {
       // The scanner emits this only when the brief does not verify urgency
-      // (urgencyVerified=false). Severity keys on the path: with a readable
-      // brief payload (AI-assembled) it blocks; a designed-source campaign
-      // with no brief payload may carry an intentional countdown — warning.
+      // (urgencyVerified=false). Only a readable brief payload (AI-assembled)
+      // makes it a finding.
       if (briefReadable) {
         addIssue(
           errors,
@@ -4078,30 +4082,18 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
           `Built output renders countdown chrome without verified offer urgency (${where}). Set offer.urgency.verified in ${BRIEF_PAYLOAD_REL_PATH} from a real promotion window, or blank the urgency slots.`,
         );
       } else if (brief?.error) {
-        // Unreadable brief payload: the run is already blocked by
-        // proof_attestation.unreadable with the right remediation (repair the
-        // brief). Urgency is re-evaluated on the next doctor run once the
-        // brief parses — "confirm the urgency is real" copy here would point
-        // the operator at the wrong fix.
-      } else {
-        addIssue(
-          warnings,
-          "content_residue.urgency_unattested",
-          `Built output renders countdown chrome and no brief payload attests the promotion window (${where}). Confirm the urgency is real (a genuine offer window or live inventory) before launch.`,
-        );
+        // Deliberately nothing: an unreadable brief payload already blocks
+        // through proof_attestation.unreadable (validateProofAttestation),
+        // and urgency is re-evaluated once the brief parses.
       }
+      // No brief payload at all: the countdown is the merchant's content and
+      // is not ours to question.
     } else if (id === "demo_residue_term" || id === "bracket_placeholder_stub") {
       addIssue(
         warnings,
         "content_residue.demo_residue",
         `Built output carries template demo/placeholder residue (${where}; e.g. "${finding.excerpt}"). Fill or blank the slot — demo values must never ship.`,
       );
-    } else {
-      addIssue(
-        warnings,
-        "content_residue.anti_pattern",
-        `Built output matches content anti-pattern "${id}" (${where}; e.g. "${finding.excerpt}"). ${finding.rule || "Remove it or route it through brief-sourced proof."} This is a review warning and nothing downstream blocks on it: the claim is the operator's and the client's responsibility — remove or evidence it, never make it more plausible.`,
-      );
     }
   }
 }

package/src/doctor/inspect.mjs

@@ -1,5 +1,6 @@
 // Doctor entry points: the doctor command, packet inspection and built-output inspection.
 import { resolveCampaignIdentity } from "../spec-source-identity.mjs";
+import { applyLocalPreviewToCheckpoint, applyLocalPreviewToPolishGate, carriedForwardMessage, CARRIED_FORWARD } from "../local-preview-policy.mjs";
 import { withHtmlScanSnapshot } from "../html-scan.mjs";
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
@@ -506,16 +507,23 @@ function inspectDoctorPacket(packetPath, { contextPath = undefined, reportPath =
   }
   runPricingCssHideCheck({ packet, derived, warnings, ready, report });
 
-  const polishCheckpointGate = evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report });
+  // The local preview policy (local-preview-policy.mjs) carries missing
+  // polish and page-load evidence forward as warnings on a local-serve packet.
+  const polishCheckpointGate = applyLocalPreviewToCheckpoint(
+    evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report }),
+    { packet, report },
+  );
   derived.polish_checkpoint_gate = polishCheckpointGate;
-  const polishGate = evaluatePolishGate({
+  const polishGate = applyLocalPreviewToPolishGate(evaluatePolishGate({
     report,
     hiddenEagerMediaGate: polishCheckpointGate,
     currentOutputFingerprint: derived.build_output_fingerprint?.value || null,
-  });
+  }), { packet, checkpointGate: polishCheckpointGate });
   derived.polish_gate = polishGate;
   if (polishGate.status === "blocked" && !polishGate.owned_checkpoint_only) {
     pushGateIssue({ errors, warnings }, gateIssue("polish_gate", polishGate));
+  } else if (polishGate.status === CARRIED_FORWARD && !polishGate.owned_checkpoint_only) {
+    addIssue(warnings, polishGate.code, carriedForwardMessage(polishGate), { polish_gate: polishGate });
   } else if (polishGate.status === "waived" && !polishGate.owned_checkpoint_only) {
     ready.push(`Polish gate passed under waiver: ${polishGate.waiver?.reason || "(no reason recorded)"}`);
   } else if (polishGate.status === "pass") {
@@ -524,6 +532,8 @@ function inspectDoctorPacket(packetPath, { contextPath = undefined, reportPath =
 
   if (polishCheckpointGate.status === "blocked") {
     pushGateIssue({ errors, warnings }, gateIssue("polish_checkpoint_gate", polishCheckpointGate));
+  } else if (polishCheckpointGate.status === CARRIED_FORWARD) {
+    addIssue(warnings, polishCheckpointGate.code, carriedForwardMessage(polishCheckpointGate), { polish_checkpoint_gate: polishCheckpointGate });
   } else if (polishCheckpointGate.status === "waived") {
     addIssue(
       warnings,

package/src/doctor/next-step.mjs

@@ -1,5 +1,6 @@
 // The next step doctor recommends, and the gate issues `next` reads from doctor.
 import { campaignIdentitiesMatch } from "../spec-source-identity.mjs";
+import { CARRIED_FORWARD } from "../local-preview-policy.mjs";
 import { resolve } from "node:path";
 import { orderPathDepthDriftText } from "../proof-policy.mjs";
 import { anyAssemblyReportStageBlocked } from "../stage-ledger.mjs";
@@ -462,6 +463,9 @@ function pickNextStage(report, { errors = [], derived = null }, prepareBuildGate
   }
 
   for (const cliStage of NEXT_STAGE_ORDER) {
+    // On the local preview, missing polish is carried forward as a warning
+    // (local-preview-policy.mjs): the ladder moves on to deploy and QA.
+    if (cliStage === "polish" && polishGate.status === CARRIED_FORWARD) continue;
     const reportKey = reportKeyForCliStage(cliStage);
     const stage = report.stages[reportKey];
     if (!stage) {

package/src/gate-actions.mjs

@@ -62,6 +62,14 @@ export const HIDDEN_EAGER_MEDIA_ACTIONS = Object.freeze({
     command: null,
     description: localProofRebuildText(),
   }),
+  // Every mapped page is template stock: capture has no design route, so
+  // neither a recapture nor an authority repair can produce the evidence.
+  map_design_route: Object.freeze({
+    id: "polish.hidden_eager_media.map_design_route",
+    kind: "manual",
+    command: null,
+    description: "Every mapped page is template stock, so polish capture has nothing to measure. Map at least one page to its design source HTML (source_html.pages[].path) and rerun intake, or prove the campaign on the local preview (deploy.target local-serve served from localhost), where this missing evidence is carried forward as a warning.",
+  }),
 });
 
 const PACKET_PLACEHOLDER = "--packet <packet>";

package/src/local-preview-policy.mjs

@@ -0,0 +1,92 @@
+// The local preview policy: one place that decides which missing evidence a
+// localhost preview carries forward as a warning instead of a blocker.
+//
+// The local preview is a packet whose deploy target is `local-serve`, served
+// from a loopback host. There a campaign must still prove its commerce (store
+// and campaign binding, routes, SDK loading, prices, a typed-card order), but
+// evidence that only design work or launch produces may be missing. Missing
+// evidence is reported as missing, never as passed: a carried-forward gate is
+// a warning in doctor, `next` does not stop on it, and QA records it as a
+// `warn` row, so the verdict is at best `ready_with_exceptions`. A hosted
+// preview or production packet never takes this path, and every check not
+// named below keeps its meaning on every path.
+//
+// Doctor and QA apply this to the gates they evaluate; `next` reads doctor's
+// gates. Recording a stage (`record polish`) and the waiver commands keep the
+// strict gates.
+import { isLocalServePacket } from "./local-proof.mjs";
+import { isLoopbackHostname } from "./remit.mjs";
+
+export const LOCAL_PREVIEW_POLICY = "local_preview";
+export const CARRIED_FORWARD = "carried_forward";
+
+// The checks carried forward, one by one. Each is evidence the campaign does
+// not have yet, not evidence that something is wrong:
+// - polish was never recorded for this build;
+// - no page-load capture exists, either because polish capture never ran or
+//   because every mapped page is template stock and there is no design route
+//   to capture.
+const CARRIED_POLISH_CODES = Object.freeze(new Set([
+  "polish.report_missing",
+  "polish.evidence_missing",
+]));
+export const NO_CAPTURABLE_ROUTES_CODE = "polish.hidden_eager_media.no_capturable_routes";
+const MISSING_CAPTURE_CODE = "polish.hidden_eager_media.capture_malformed";
+
+// With no generatable brand theme the starter template is the design, so its
+// palette and chrome are expected on the local preview: residue findings are
+// warnings there, as they are under a waived theme gate.
+const STARTER_IS_THE_DESIGN_THEME_CODE = "theme_gate.nothing_generatable";
+
+function loopbackOrAbsent(url) {
+  if (url === undefined || url === null || url === "") return true;
+  try {
+    return isLoopbackHostname(new URL(String(url)).hostname);
+  } catch {
+    return false;
+  }
+}
+
+export function isLocalPreview(packet, { baseUrl = null } = {}) {
+  return isLocalServePacket(packet)
+    && loopbackOrAbsent(packet?.deploy?.preview_url)
+    && loopbackOrAbsent(baseUrl);
+}
+
+function pageLoadRecorded(report) {
+  return report?.stages?.polish?.evidence?.visual_review?.page_load != null;
+}
+
+function carried(gate) {
+  return {
+    ...gate,
+    status: CARRIED_FORWARD,
+    carried_forward: { policy: LOCAL_PREVIEW_POLICY, from_status: gate.status, evidence: "missing" },
+  };
+}
+
+// The hidden eager-media checkpoint, evaluated on its own.
+export function applyLocalPreviewToCheckpoint(gate, { packet, report, baseUrl = null } = {}) {
+  if (gate?.status !== "blocked" || !isLocalPreview(packet, { baseUrl })) return gate;
+  const missing = gate.code === NO_CAPTURABLE_ROUTES_CODE
+    || (gate.code === MISSING_CAPTURE_CODE && !pageLoadRecorded(report));
+  return missing ? carried(gate) : gate;
+}
+
+// The polish gate folds the checkpoint in, so it is carried forward only when
+// whatever it owns from the checkpoint was carried forward too.
+export function applyLocalPreviewToPolishGate(gate, { packet, checkpointGate = null, baseUrl = null } = {}) {
+  if (gate?.status !== "blocked" || !isLocalPreview(packet, { baseUrl })) return gate;
+  const checkpointCarried = checkpointGate?.status === CARRIED_FORWARD;
+  if (gate.owned_checkpoint_status === "blocked" && !checkpointCarried) return gate;
+  if (gate.owned_checkpoint_only) return checkpointCarried ? carried(gate) : gate;
+  return CARRIED_POLISH_CODES.has(gate.code) ? carried(gate) : gate;
+}
+
+export function starterResidueIsExpected(themeGate, { packet, baseUrl = null } = {}) {
+  return themeGate?.code === STARTER_IS_THE_DESIGN_THEME_CODE && isLocalPreview(packet, { baseUrl });
+}
+
+export function carriedForwardMessage(gate) {
+  return `Carried forward on the local preview: ${gate.reason} This evidence is missing, not passed; a hosted preview or production run requires it.`;
+}

package/src/page-kit-sdk-version.mjs

@@ -92,6 +92,10 @@ export function evaluatePageKitSdkVersion({
   waivers = [],
   required = true,
   now = new Date().toISOString(),
+  // { family, sdk_version } of the selected certified template family, when
+  // the caller knows it: the missing-pin reason names that verified SDK so the
+  // pin is not chosen by searching docs.
+  familyVerification = null,
 } = {}) {
   const pin = resolveSpecSdkPin(spec);
   const { has_canonical: hasCanonical, has_alias: hasAlias } = pin;
@@ -139,7 +143,10 @@ export function evaluatePageKitSdkVersion({
       scope: PAGE_KIT_SDK_VERSION_SCOPE,
       status: "blocked",
       code: "page_kit.sdk_version.spec_missing",
-      reason: "CampaignSpec is missing global_config.sdk_version (and the runtime.sdk_version alias); add an explicit released SDK pin before build or QA.",
+      reason: "CampaignSpec is missing global_config.sdk_version (and the runtime.sdk_version alias); add an explicit released SDK pin before build or QA."
+        + (isReleasedSdkVersion(familyVerification?.sdk_version) && typeof familyVerification?.family === "string"
+          ? ` The "${familyVerification.family}" template family was last verified against ${familyVerification.sdk_version}.`
+          : ""),
       waivable: false,
       subject,
       state: { spec_status: "missing" },

package/src/polish-node.mjs

@@ -1,4 +1,5 @@
 import { campaignIdentitiesMatch, localSpecIdentityFields } from "./spec-source-identity.mjs";
+import { NO_CAPTURABLE_ROUTES_CODE } from "./local-preview-policy.mjs";
 import { createHash } from "node:crypto";
 import { HIDDEN_EAGER_MEDIA_ACTIONS } from "./gate-actions.mjs";
 import { dirname, join, resolve } from "node:path";
@@ -93,6 +94,8 @@ function mappedSpecRoute(value, pageId) {
   return route;
 }
 
+const NO_CAPTURABLE_ROUTES_ERROR = "no_capturable_routes";
+
 export function planPolishCapture({ packet, baseUrl } = {}) {
   if (!isPlainObject(packet) || !Array.isArray(packet?.source_html?.pages) || packet.source_html.pages.length === 0) {
     throw new Error("polish capture requires packet.source_html.pages mappings.");
@@ -129,7 +132,14 @@ export function planPolishCapture({ packet, baseUrl } = {}) {
     });
   }
 
-  if (routes.length === 0) throw new Error("polish capture has no mapped non-skipped routes to capture.");
+  if (routes.length === 0) {
+    const error = new Error(
+      "polish capture has no mapped non-skipped routes to capture: every mapped page is template stock (skip_reason), so there is no design route to compare."
+      + " On a local-serve preview, missing polish evidence is carried forward as a warning; run `next` for the next stage.",
+    );
+    error.code = NO_CAPTURABLE_ROUTES_ERROR;
+    throw error;
+  }
   routes.sort((a, b) => a.requested_route.localeCompare(b.requested_route) || a.page_id.localeCompare(b.page_id));
   for (let index = 1; index < routes.length; index += 1) {
     if (routes[index - 1].requested_route === routes[index].requested_route) {
@@ -189,6 +199,19 @@ function recordedAuthorityBlock({ packet, report, plan = null, now } = {}) {
   };
 }
 
+// Every mapped page is template stock: there is nothing for polish capture to
+// measure, which is missing evidence rather than a malformed packet. It stays
+// a non-waivable block; the local preview policy carries it forward.
+function noCapturableRoutesBlock({ packet, report, now } = {}) {
+  const block = recordedAuthorityBlock({ packet, report, now });
+  return {
+    ...block,
+    code: NO_CAPTURABLE_ROUTES_CODE,
+    reason: "Every mapped page is template stock (skip_reason), so polish capture has no design route to capture and this build has no page-load evidence.",
+    required_actions: [HIDDEN_EAGER_MEDIA_ACTIONS.map_design_route],
+  };
+}
+
 function recordedCheckpointNotApplicable() {
   return {
     id: HIDDEN_EAGER_MEDIA_SCOPE,
@@ -219,7 +242,8 @@ export function evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report, now
   let plan;
   try {
     plan = planPolishCapture({ packet, baseUrl: "https://polish-capture.invalid" });
-  } catch {
+  } catch (error) {
+    if (error?.code === NO_CAPTURABLE_ROUTES_ERROR) return noCapturableRoutesBlock({ packet, report, now });
     return recordedAuthorityBlock({ packet, report, now });
   }
 

package/src/progress-node.mjs

@@ -58,7 +58,11 @@ export function projectProgressObservation({workspace,context,report,doctor,cont
     binding:reportBound&&id(verdict.run_id)&&id(verdict.run_id)===id(report?.stages?.qa?.verdict_run_id)&&build&&qaSource===build&&doctor?.derived?.build_output_fingerprint?.status==='pass'&&hash(verdict.spec_hash)===localHash?'matching':'unconfirmed',
     publish_state:accepted(qaResult?.qa_verdict_publish?.state,['skipped','ok','failed']),
   }:null;
-  const gates=(Array.isArray(continuation?.gates)?continuation.gates:[]).slice(0,PROGRESS_GATE_LIMIT).map(gate=>({id:accepted(gate?.id,PROGRESS_GATE_IDS),state:PROGRESS_GATE_IDS.includes(gate?.id)?accepted(gate?.status,['pass','blocked','waived','not_applicable']):'unknown'}));
+  // The snapshot schema has no carried-forward state: a gate the local preview
+  // policy carried forward does not apply on this path, so it is not_applicable
+  // here (never pass).
+  const gateState=status=>accepted(status==='carried_forward'?'not_applicable':status,['pass','blocked','waived','not_applicable']);
+  const gates=(Array.isArray(continuation?.gates)?continuation.gates:[]).slice(0,PROGRESS_GATE_LIMIT).map(gate=>({id:accepted(gate?.id,PROGRESS_GATE_IDS),state:PROGRESS_GATE_IDS.includes(gate?.id)?gateState(gate?.status):'unknown'}));
   const actions=[...new Set((Array.isArray(continuation?.next_actions)?continuation.next_actions:[]).slice(0,64).map(action=>accepted(action?.id,PROGRESS_ACTION_IDS)))];
   const stage=accepted(continuation?.stage,PROGRESS_CONTINUATIONS);
   const preview=typeof packet?.deploy?.preview_url==='string'&&packet.deploy.preview_url?packet.deploy.preview_url:null;

package/src/qa-binding-evidence.mjs

@@ -5,7 +5,7 @@ import { HTML_NAMESPACE, baseInEffect, documentBases, endsUnclosed, frozenBaseUr
 
 export const BINDING_SCHEMA = 'campaigns-os-page-binding/v0';
 export const BINDING_LIMITS = Object.freeze({ scripts_per_page: 6, scripts_per_run: 24, script_bytes: 262144, timeout_ms: 5000 });
-const SDK = /^https:\/\/cdn\.jsdelivr\.net\/gh\/NextCommerceCo\/campaign-cart@[^/]+\/(?:dist\/index\.js|public\/loader\.js)(?:\?[^#]*)?$/;
+const SDK = /^https:\/\/cdn\.jsdelivr\.net\/gh\/NextCommerceCo\/campaign-cart@[^/]+\/(?:dist\/(?:index|loader)\.js|public\/loader\.js)(?:\?[^#]*)?$/;
 const str = value => typeof value === 'string' && value.length ? value : null;
 
 // The expected credential uses the existing producer resolver. Disagreement

package/src/qa-browser.mjs

@@ -2822,7 +2822,22 @@ async function pricingVisibilityAssertions(browserPage, page, options = {}) {
       selectors.length ? countVisiblePriceRows(browserPage, selectors) : 0,
       countVisiblePriceRows(browserPage, totalSelectors),
     ]);
-    return [checkoutPriceVisibilityAssertion({ page, selectors, visibleCount, totalSelectors, totalVisibleCount })];
+    // Nothing priced is visible. When the checkout also has no package
+    // selection of its own and the SDK reports an empty cart, the cart is
+    // filled on an earlier page (a landing link carrying forcePackageId), and
+    // opening the checkout directly shows a state no shopper reaches. The
+    // test-order path enters that cart from the landing page instead.
+    const emptyEntry = visibleCount === 0 && totalVisibleCount === 0
+      ? await Promise.all([
+        browserPage.evaluate(() => (typeof window.next?.getCartCount === "function" ? window.next.getCartCount() : null)),
+        browserPage.evaluate(checkoutSelectionSurfaceScript()),
+      ]).then(
+        ([cart_count, selection_surface]) => ({ cart_count, selection_surface }),
+        // A failed probe leaves the row failed, and says why on the row.
+        (error) => ({ probe_error: trim(error?.message || String(error)).slice(0, 200) }),
+      )
+      : null;
+    return [checkoutPriceVisibilityAssertion({ page, selectors, visibleCount, totalSelectors, totalVisibleCount, emptyEntry })];
   }
   return [];
 }
@@ -2896,25 +2911,37 @@ function upsellPriceVisibilityAssertion({ page, selectors, visibleCount }) {
 // no `totalSelectors` ran the bundle-row check alone, and the row says so
 // rather than reporting an empty selector list that reads like a check that
 // ran and found nothing.
-function checkoutPriceVisibilityAssertion({ page, selectors, visibleCount, totalSelectors, totalVisibleCount = 0 }) {
+//
+// `emptyEntry` ({ cart_count, selection_surface }, or { probe_error }) is read
+// only when nothing priced is visible. An empty SDK cart (cart_count 0, never
+// null: null means no SDK was read) on a checkout with no package selection of
+// its own is not a price the shopper fails to see: the row is skipped with
+// that reason rather than failed, and only that row carries the probe values.
+function checkoutPriceVisibilityAssertion({ page, selectors, visibleCount, totalSelectors, totalVisibleCount = 0, emptyEntry = null }) {
   const totalChecked = Array.isArray(totalSelectors);
   const ok = visibleCount >= 1 || (totalChecked && totalVisibleCount >= 1);
+  const enteredUpstream = !ok && emptyEntry?.cart_count === 0 && emptyEntry?.selection_surface?.count === 0;
+  const counts = totalChecked
+    ? `${visibleCount} visible price row(s); ${totalVisibleCount} visible cart-summary total(s)`
+    : `${visibleCount} visible price row(s)`;
   return assertion({
     id: "pricing.checkout_price_visible",
     family: "pricing",
     page,
-    status: ok ? STATUS.PASS : STATUS.FAIL,
-    severity: ok ? undefined : SEVERITY.WARN,
+    status: ok ? STATUS.PASS : enteredUpstream ? STATUS.SKIPPED : STATUS.FAIL,
+    severity: ok || enteredUpstream ? undefined : SEVERITY.WARN,
     expected: totalChecked
       ? "at least one visible checkout bundle price row or a visible cart-summary total"
       : "at least one visible checkout bundle price row",
-    actual: totalChecked
-      ? `${visibleCount} visible price row(s); ${totalVisibleCount} visible cart-summary total(s)`
-      : `${visibleCount} visible price row(s)`,
+    actual: enteredUpstream
+      ? `${counts}: opened directly, the checkout has an empty cart and no package selection of its own; its cart is filled on an earlier page, and the test order enters it from there`
+      : counts,
     evidence: {
       selectors,
       visible_count: visibleCount,
       ...(totalChecked ? { total_selectors: totalSelectors, total_visible_count: totalVisibleCount } : {}),
+      ...(enteredUpstream ? { cart_count: emptyEntry.cart_count, checkout_selection_surface: emptyEntry.selection_surface } : {}),
+      ...(emptyEntry?.probe_error ? { empty_cart_probe_error: emptyEntry.probe_error } : {}),
       page_url: page.url,
     },
   });
@@ -4962,10 +4989,7 @@ async function waitForCheckoutResult(page, events = null) {
     if (outcomeUrl.test(String(safePageUrl(page) || ""))) break;
     if (events) {
       const rejected = rejectedOrderCreateResponse(events);
-      if (rejected) {
-        const detail = typeof rejected.body?.detail === "string" ? `: ${trim(rejected.body.detail)}` : "";
-        throw new Error(`order create rejected: HTTP ${rejected.status}${detail}`);
-      }
+      if (rejected) throw new Error(orderCreateRejectionMessage(rejected));
       const failed = failedOrderCreateRequest(events);
       if (failed) throw new Error(`order create request failed: ${failed.failure || "network failure"}`);
     }
@@ -4979,6 +5003,23 @@ async function waitForCheckoutResult(page, events = null) {
 // The MOST RECENT create response decides the outcome: SDKs/platforms retry
 // transient create failures, so [..., 400, 201] means the retry succeeded and
 // the earlier rejection is history, not the result.
+// The platform refuses an order whose customer, items and total match one it
+// accepted or is still processing in the last 30 minutes, and reports it in
+// `payment_details`. QA reuses one test customer, so two runs against the same
+// campaign at once, or a rerun after an attempt that died mid-submit, trip it.
+const DUPLICATE_ORDER_PATTERN = /duplicate order/i;
+const DUPLICATE_ORDER_REMEDY =
+  "duplicate_order: the platform refused an order matching a recent one from the same test customer with the same items and total, " +
+  "for up to 30 minutes. Concurrent QA runs that share a test customer collide. Re-run with a different --test-email-prefix " +
+  "(or --test-email), or wait. The shipping address is not part of the match";
+
+function orderCreateRejectionMessage(rejected) {
+  const body = rejected?.body;
+  const reason = [body?.detail, body?.payment_details].find((value) => typeof value === "string" && value.trim());
+  const base = `order create rejected: HTTP ${rejected?.status}${reason ? `: ${trim(reason)}` : ""}`;
+  return reason && DUPLICATE_ORDER_PATTERN.test(reason) ? `${base} (${DUPLICATE_ORDER_REMEDY})` : base;
+}
+
 function rejectedOrderCreateResponse(events) {
   for (let index = events.responses.length - 1; index >= 0; index -= 1) {
     const response = events.responses[index];
@@ -6393,7 +6434,7 @@ function sanitizedEvents(events) {
     responses: events.responses.slice(-20).map((response) => ({
       status: response.status,
       url: response.url,
-      body: summarizeResponseBody(response.body),
+      body: summarizeResponseBody(response.body, { status: response.status }),
     })),
     failed: events.failed.slice(-20),
     console: events.console.slice(-20),
@@ -6420,7 +6461,7 @@ function summarizeRequestPostData(value) {
   }
 }
 
-function summarizeResponseBody(body) {
+function summarizeResponseBody(body, { status = null } = {}) {
   if (typeof body === "string") return trim(body).slice(0, 1000);
   if (!body || typeof body !== "object" || Array.isArray(body)) return body;
   return {
@@ -6432,6 +6473,12 @@ function summarizeResponseBody(body) {
     ...(body.checkout_url ? { checkout_url: body.checkout_url } : {}),
     ...(Array.isArray(body.lines) ? { lines: extractReceiptLines(body) } : {}),
     ...(body.detail ? { detail: body.detail } : {}),
+    // A rejected request names its reason here (for example the
+    // duplicate-order refusal). Kept only on an error response, so a
+    // successful create never carries payment_details into evidence.
+    ...(Number(status) >= 400 && typeof body.payment_details === "string"
+      ? { payment_details: trim(body.payment_details).slice(0, 300) }
+      : {}),
   };
 }
 
@@ -7789,6 +7836,8 @@ export const __qaBrowserTestHooks = Object.freeze({
   linePriceDeltaEvidence,
   packageMatchesLine,
   rejectedOrderCreateResponse,
+  orderCreateRejectionMessage,
+  summarizeResponseBody,
   failedOrderCreateRequest,
   extractOrderVouchers,
   orderDiscountTotal,

package/src/qa-node.mjs

@@ -1,4 +1,5 @@
 import { campaignSpecIdentity, resolveCampaignIdentity, campaignIdentitiesMatch } from "./spec-source-identity.mjs";
+import { applyLocalPreviewToCheckpoint, applyLocalPreviewToPolishGate, carriedForwardMessage, CARRIED_FORWARD, starterResidueIsExpected } from "./local-preview-policy.mjs";
 import { expectedBinding, createBindingScriptLoader, observeBinding, bindingAssertion, scriptParseAssertion } from './qa-binding-evidence.mjs';
 import { shellToken } from "./shell-token.mjs";
 import { applyQaBuildScope, specForQaScope } from "./qa-build-scope.mjs";
@@ -481,6 +482,8 @@ async function resolveQaInputs(args, {
     packetPath,
     report: checkpointPreflight?.runtimeReport,
     hiddenEagerMediaGate,
+    packet,
+    baseUrl: stringArg(args["base-url"]),
   });
   const qaWaivers = resolveQaWaivers({ packetPath, report: checkpointPreflight?.runtimeReport });
   const qaScope = applyQaBuildScope(topologies, {
@@ -593,7 +596,10 @@ function resolvePacketCheckpointPreflight(args, {
       waivers: report?.waivers,
       required: true,
     }),
-    evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report }),
+    applyLocalPreviewToCheckpoint(
+      evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report }),
+      { packet, report, baseUrl: stringArg(args["base-url"]) },
+    ),
   ];
   const runtimeReport = reportMatchesPacketIdentity(report, packet) ? report : null;
   return {
@@ -692,6 +698,8 @@ function resolvedFromBlockedCheckpointPreflight(preflight, args) {
     packetPath: preflight.packetPath,
     report: preflight.runtimeReport,
     hiddenEagerMediaGate,
+    packet: preflight.packet,
+    baseUrl: stringArg(args["base-url"]),
   });
   return {
     themeGate,
@@ -931,16 +939,18 @@ function resolvePolishGate({
   packetPath,
   report: reportOverride = undefined,
   hiddenEagerMediaGate = undefined,
+  packet = null,
+  baseUrl = null,
 }) {
   const report = reportOverride === undefined
     ? loadRuntimeArtifact(packetPath, "assembly-report.json")
     : reportOverride;
-  const gate = evaluatePolishGate({
+  const gate = applyLocalPreviewToPolishGate(evaluatePolishGate({
     report,
     required: true,
     hiddenEagerMediaGate,
     currentOutputFingerprint: currentBuiltOutputFingerprint(packetPath),
-  });
+  }), { packet, checkpointGate: hiddenEagerMediaGate, baseUrl });
   gate.scope_source = report ? "assembly_report" : "missing_assembly_report";
   return gate;
 }
@@ -1044,6 +1054,18 @@ function polishGateAssertion(gate) {
       },
     });
   }
+  if (gate.status === CARRIED_FORWARD) {
+    return assertion({
+      id: gate.code,
+      family: "polish_gate",
+      page,
+      status: STATUS.WARN,
+      severity: SEVERITY.WARN,
+      expected: "current structured Polish evidence produced by next-campaigns-polish",
+      actual: carriedForwardMessage(gate),
+      evidence: { ...evidence, reason: gate.reason, carried_forward: gate.carried_forward },
+    });
+  }
   if (gate.status === "not_applicable") {
     return assertion({
       id: gate.code,
@@ -1350,6 +1372,9 @@ function hiddenEagerMediaGateAssertion(gate) {
   if (summary.status === "waived") {
     return assertion({ ...common, status: STATUS.WARN, severity: SEVERITY.WARN, waiver: summary.waiver });
   }
+  if (summary.status === CARRIED_FORWARD) {
+    return assertion({ ...common, status: STATUS.WARN, severity: SEVERITY.WARN, actual: `${summary.code}: ${carriedForwardMessage(summary)}` });
+  }
   if (summary.status === "not_applicable") {
     return assertion({ ...common, status: STATUS.SKIPPED });
   }
@@ -2306,7 +2331,11 @@ async function runResolvedQa(args, resolved, { runSessionActive = false, liveCam
   if (args.browser === true) {
     assertions.push(...await runBrowserChecks(resolved.topologies, args, {
       brandContract: resolved.brandContract,
-      residueSeverity: residueSeverityForThemeGate(gate.status),
+      // With no generatable brand theme on the local preview, the starter
+      // template is the design: its residue is a warning (local-preview-policy.mjs).
+      residueSeverity: starterResidueIsExpected(gate, { packet: resolved.packet, baseUrl: resolved.baseUrl })
+        ? SEVERITY.WARN
+        : residueSeverityForThemeGate(gate.status),
       supportedPaymentMethods: supportedPaymentMethodsFromSpec(resolved.spec),
     }));
   }