@nextcommerce/campaigns-os 1.47.0 → 1.50.0

package/CHANGELOG.md

@@ -2,6 +2,313 @@
 
 Notable supported-surface changes are recorded here.
 
+## [1.50.0] - 2026-10-02
+
+### Changed
+
+- With `qa run --browser`, each page's `page-binding:<page_id>` row comes
+  from the key the Campaign Cart SDK actually sent. The SDK sends the page's
+  key as `Authorization` on every Campaigns API request. The browser pass
+  reads that header on each page it loads, compares it with the expected key
+  in memory and keeps only the outcome: `match` (pass) when every request
+  carried the expected key, `mismatch` (blocker) when any carried another.
+  The key itself is never recorded. The static read of a page's declarations
+  could not resolve most real pages: the starter templates' `config.js` opens
+  with `window.dataLayer = window.dataLayer || []` and
+  `window.nextReady = window.nextReady || []`, which the static grammar treats
+  as dynamic, so every starter page was left for manual review, and inline
+  scripts, `async` scripts and scripts from other origins left other pages
+  the same way. A page that sends no Campaigns API request, a run with no
+  single expected key, and `qa run` without `--browser` keep the static read.
+- The QA verdict schema's page-binding evidence accepts
+  `observation: "sdk_request"` and the `sdk_request` source kind for that row.
+  Nothing is removed, so every verdict that validated before still does.
+  `docs/qa-and-test-orders.md` describes both observations.
+- Ships the same-surface changes recorded since 1.49.0, each described in
+  its own section below: the agent context spells every command
+  `npx --no-install campaigns-os …` and carries the build skill's proof rule
+  (`+agent.1`); and the install-mode module drops a stale comment, with no
+  behavior change (`+agent.2`).
+- Package and supported-surface version advance to 1.50.0 for the QA verdict
+  schema hash. The local setup install command pins 1.50.0. Bundled skills
+  carry revision `1.50.0+skills.1`, with each skill version advanced one
+  patch. The skill text is unchanged.
+
+## [1.49.0+agent.2] - 2026-10-02
+
+### Changed
+
+- No command behaves differently. The install-mode module drops a trailing
+  comment that described `applyInvocationPrefix`, a function removed when
+  commands began to be spelled with their prefix at the source (`cmd()` and
+  `asInvocation` in the install-invocation module). Comment-only; every
+  message and every exit code is unchanged.
+
+## [1.49.0+agent.1] - 2026-10-02
+
+### Changed
+
+- The agent context that `install-agent-context` and `tooling setup` write
+  (`agents/claude/CLAUDE.md`, `agents/codex/AGENTS.md`,
+  `agents/copilot/copilot-instructions.md`, `agents/cursor/campaigns-os.mdc`)
+  spells every command `npx --no-install campaigns-os …`, as the skills and
+  `AGENTS.md` do. It said `campaigns-os readback .`, `campaigns-os qa run …`
+  and so on, and fresh sessions ran them as written: "command not found"
+  where nothing is installed globally, and an older global copy instead of
+  the campaign's pinned one where something is. A test keeps bare commands
+  out of the agent context.
+- The agent context carries the build skill's proof rule: reproduce the
+  source design's own proof and urgency elements as designed, and do not
+  remove, soften or flag them. The rule was only in the build and polish
+  skills, and sessions were still questioning or removing the merchant's
+  proof.
+- An installed copy keeps the old text until `install-agent-context`
+  refreshes it.
+
+## [1.49.0] - 2026-10-02
+
+### Added
+
+- `campaigns-os record theme --packet <p>` records an applied brand layer on
+  the Assembly Report, where the theme gate previously sent the operator to
+  edit `report.theme` by hand. It reads each built commerce page's stylesheet
+  links in document order. A page that loads `next-core.css` must load
+  `brand-theme.css` (or `checkout-brand.css`) after it, and that file must be
+  in the built output. A page that loads neither renders the design's own
+  markup and is left out, noted in the evidence. When every page passes and at
+  least one loads the brand layer, it writes `report.theme`: status `applied`,
+  `load_order` `after-next-core`, `css_path`, `commerce_pages` and one evidence
+  line per page, and clears any earlier theme waiver. Otherwise it is refused,
+  naming each page, and writes nothing. Build must be recorded for the current
+  output first. `--dry-run` runs every check and writes nothing.
+- `campaigns-os record deploy --packet <p> --base-url <url>` records a local
+  preview (`deploy.target: local-serve`), where `next` previously sent the
+  operator to edit the packet and `stages.deploy` by hand. The URL must be a
+  loopback origin naming the campaign's route root. Every built page is
+  requested under it and must answer 2xx. It then writes the packet's
+  `deploy.preview_url` and `stages.deploy` completed, with the URL in
+  `outputs` and one evidence line per page. It is refused, writing nothing,
+  when any check fails, when polish is not recorded, when the built output
+  changed since build was recorded, or while the theme gate is blocked. The
+  requests stay on this machine. `--dry-run` runs every check, the requests
+  included, and writes nothing.
+
+### Changed
+
+- The theme gate's apply and load-order actions, the starter-palette notice,
+  the build prompt, the build and polish skills, `docs/brand-theme-bridge.md`
+  and `docs/build-packet.md` name `record theme` where they described a hand
+  edit of `report.theme`.
+- `next`'s local-serve deploy action and deploy prompt,
+  `docs/build-packet.md` and `docs/qa-and-test-orders.md` name `record deploy`
+  where they described a hand edit of `deploy.preview_url` and
+  `stages.deploy`.
+- `contracts/effects.v1.json` declares `record theme`, `record deploy` and
+  their `--dry-run` forms.
+- The Build Packet schema's `assembly.template_family` accepts every family
+  the commerce surface catalog and the private template sources name:
+  `apollo`, `apollo-mv-single-step`, `arjuna` and `karna` join the enum, which
+  had fallen behind both. Nothing is removed, so every packet that validated
+  before still does.
+- Package and supported-surface version advance to 1.49.0 for the effects
+  contract and Build Packet schema hashes. The local setup install command pins 1.49.0. Bundled skills
+  carry revision `1.49.0+skills.1`, with each skill version advanced one patch;
+  the build and polish skills also name `record theme`.
+
+## [1.48.0] - 2026-10-02
+
+### Changed
+
+- The supported surface advances to 1.48.0 and ships the same-surface
+  changes recorded since 1.47.0, each described in its own section below:
+  the local setup command starts with `npm init -y` (`+agent.1`); the
+  `start`, `prepare-build` and `build` usage lines list
+  `--deploy-target`, `--preview-url` and `--production-url` (`+agent.6`);
+  doctor no longer scans built pages for proof and urgency copy
+  (`+agent.7`); QA stops failing the checkout price check on a checkout whose
+  cart is filled on an earlier page, and recognises the starter templates'
+  SDK loader (`+agent.8`); `readback` shows `warn` and `manual_review` rows as
+  themselves, and the agent context sends a resumed session to `readback`
+  and `next` first (`+agent.9`); a test order refused as a duplicate says so
+  (`+agent.10`); doctor's missing SDK pin message names the SDK the template
+  family was verified against (`+agent.11`); the local preview carries
+  missing polish and page-load evidence forward as warnings, so a campaign
+  built from a starter template can reach a test order (`+agent.12`); and the
+  vendored starter-template catalog is pinned to
+  campaign-cart-starter-templates `37a8d94` (`+agent.13`).
+- The bundled SDK support policy's `latest_known_release` returns to 0.4.38,
+  the value 1.47.0 shipped; `+agent.11` had moved it to 0.4.40. The policy
+  line only feeds template freshness, where the catalog's verification
+  records already name 0.4.40 as the current SDK, so freshness results and
+  doctor's missing SDK pin message are unchanged.
+- Bundled skills carry revision `1.48.0+skills.1`, with each skill version
+  advanced one patch, and the local setup install command pins the 1.48.0
+  package. The skill text is unchanged.
+
+## [1.47.0+agent.13] - 2026-10-02
+
+### Changed
+
+- The vendored starter-template catalog is re-synced to
+  campaign-cart-starter-templates `37a8d94` (was `3793b1d`). That brings in
+  the single-offer upsell copy priced outside the offer, order bumps that hide
+  their savings line and badge when the package has no discount, the
+  `is_upsell` wording for order reports, and refreshed template verification
+  evidence for Campaign Cart SDK 0.4.40. The verified SDK and the SDK support
+  policy are unchanged.
+- `fixtures/certified-families` is regenerated at the new pin, and the shared
+  commerce brand contract's payment-chrome `asset_pin` moves with it. The
+  shipped asset bytes are unchanged.
+
+## [1.47.0+agent.12] - 2026-10-01
+
+### Changed
+
+- On the local preview (a `local-serve` packet served from a loopback host),
+  missing polish and page-load evidence no longer stops the loop before a
+  typed-card order. One policy, `src/local-preview-policy.mjs`, carries
+  forward `polish.evidence_missing` / `polish.report_missing`, a page-load
+  checkpoint with no capture recorded, and the new
+  `polish.hidden_eager_media.no_capturable_routes` (every mapped page is
+  template stock). It also makes starter-template residue a warning when the
+  theme gate finds nothing generatable. Doctor reports these as warnings,
+  `next` moves past polish, and QA records `warn` rows, so the verdict is at
+  best `ready_with_exceptions`. A campaign built from a starter template with
+  no design can now reach a toolkit test order locally. Hosted preview and
+  production packets, other checks, `record polish` and the waiver commands
+  are unchanged. `docs/qa-and-test-orders.md` lists the carried-forward
+  checks.
+- An all-template-stock packet's page-load checkpoint now reports
+  `polish.hidden_eager_media.no_capturable_routes` instead of the
+  malformed-authority `capture_malformed`, and `polish capture` says why it
+  has nothing to capture. It still blocks off the local preview, with one
+  action: map a page to its design source, or prove on the local preview.
+
+## [1.47.0+agent.11] - 2026-10-01
+
+### Changed
+
+- `doctor`'s `page_kit.sdk_version.spec_missing` now names the SDK the
+  selected certified template family was last verified against (for
+  example `The "apollo" template family was last verified against
+  0.4.40.`), so the CampaignSpec pin is not chosen by searching docs. The
+  bundled SDK support policy's `latest_known_release` moves from 0.4.38 to
+  0.4.40, which the catalog's verification records already named.
+- `source_html.prep.document_wrapper` names the two ways to record a
+  standalone page as whole: `--wrapper-policy preserve_document_wrappers`
+  on `start` or `prepare-build`, or `wrapper_policy` in the source-html
+  manifest.
+- `source_html.pages.source_hash` now says the hash it compares is the one
+  intake recorded in the Build Packet, that re-running intake with
+  `--force` refreshes it (and clears recorded stage evidence), and that
+  editing the manifest alone does not. It no longer points at a producer
+  script. `docs/build-packet.md` says the same, and that a revision made
+  after build belongs under `src/<route>/`.
+
+## [1.47.0+agent.10] - 2026-10-01
+
+### Fixed
+
+- A test order the platform refuses as a duplicate now says so. The order
+  API puts the reason in `payment_details`, which QA's response capture
+  dropped, so the `browser-test-order` row read only
+  `order create rejected: HTTP 400`. The capture now keeps a string
+  `payment_details` on an error response, and a duplicate-order refusal adds `duplicate_order`
+  with the remedy: re-run with a different `--test-email-prefix` (or
+  `--test-email`), or wait up to 30 minutes. `docs/qa-and-test-orders.md`
+  explains what the platform matches on and why concurrent runs collide.
+
+## [1.47.0+agent.9] - 2026-10-01
+
+### Changed
+
+- The agent context `install-agent-context` writes (`agents/claude/CLAUDE.md`,
+  `agents/codex/AGENTS.md`, `agents/copilot/copilot-instructions.md`,
+  `agents/cursor/campaigns-os.mdc`) now tells a session picking up an
+  existing campaign to run `readback` and `next` before reading artifacts by
+  hand. It also says the committed `.campaign-runtime/qa-verdict.json` keeps
+  no order records or URLs, so its `browser-test-order:<path>` assertions are
+  the typed-card proof. A resumed session had read the sidecar's empty
+  `test_orders` as "no test orders" after five verified orders.
+- The `campaign-run-evidence` skill says the same: the sidecar always
+  empties `test_orders` and the URL fields, so an empty `test_orders` there
+  says nothing about ordering. Bundled skills carry revision
+  `1.47.0+skills.3`, with each skill version advanced two patches from
+  `1.47.0+skills.1`.
+
+### Fixed
+
+- `readback` shows `warn` and `manual_review` assertions as the verdict
+  statuses they are, with their severity, recorded `actual` and evidence
+  problems (as it does for `fail` rows), instead of counting them as
+  "unrecognized status".
+
+## [1.47.0+agent.8] - 2026-10-01
+
+### Fixed
+
+- `qa run` no longer fails `pricing.checkout_price_visible` on a checkout
+  whose cart is filled on an earlier page. When QA opens such a checkout
+  directly, the SDK cart is empty and the page has no package selection of its
+  own, so no price can show. The row is now `skipped` with that reason and
+  records `cart_count` and `checkout_selection_surface`. The test order
+  already enters that cart from the landing page. A checkout with its own
+  package selection, or a filled cart, still fails when no price shows.
+- The page-binding check recognises `campaign-cart@<tag>/dist/loader.js`, the
+  SDK loader the starter templates use, and no longer tries to fetch it as a
+  cross-origin config script. Starter-template pages now report
+  `dynamic_unresolved` instead of `script_unavailable_or_limit`; they still
+  need manual review, because the static reader cannot prove a binding on a
+  page that runs other scripts.
+
+## [1.47.0+agent.7] - 2026-10-01
+
+### Removed
+
+- `doctor` no longer scans built pages for proof and urgency copy. The
+  `content_residue.anti_pattern` warning (review counts, "Verified Purchase"
+  labels, stock and sell-out lines, expert and press mentions) is gone, and so
+  is `content_residue.urgency_unattested`, which asked a campaign without a
+  brief payload to confirm its countdown was real. That copy belongs to the
+  merchant, and agents read the warnings as a reason to strip it from the
+  merchant's own designs. Template demo residue, the needs-merchant-input
+  marker, the discount-claim warnings and the brief-backed urgency and proof
+  attestation gates are unchanged.
+
+### Changed
+
+- The `next-campaigns-build` and `next-campaigns-polish` skills now say to
+  reproduce the source design's own proof and urgency elements (reviews,
+  "Verified Purchase" labels, recent-purchase popups, stock counters,
+  countdowns, guarantees) as designed, and not to record them as polish
+  issues. `docs/campaign-build-brief.md` says the same. Bundled skills carry
+  revision `1.47.0+skills.2`, with each skill version advanced one patch.
+
+## [1.47.0+agent.6] - 2026-10-01
+
+### Changed
+
+- The usage lines for `start`, `prepare-build` and `build` now list
+  `--deploy-target <target>`, `--preview-url <url>` and
+  `--production-url <url>`. Intake has always written them to the Build
+  Packet's `deploy` block (`deploy.target` defaults to `unknown`), and
+  `docs/build-packet.md`, the README and the Start page already pass
+  `--deploy-target local-serve` to `start`, but the help text left them out,
+  so an agent checking that command against the help read it as
+  unsupported. Behaviour is unchanged.
+
+## [1.47.0+agent.1] - 2026-10-01
+
+### Fixed
+
+- The one-line setup command in `docs/local-setup.md` now starts with
+  `npm init -y`. Without a `package.json` in the campaign folder, npm installs
+  into the nearest parent folder that has a `package.json` or `node_modules`,
+  so a campaign folder created inside another project added page-kit and the
+  toolkit to that project instead of the campaign. The README and quickstart
+  installs already started with `npm init -y`; a test now holds all three to
+  it.
+
 ## [1.47.0] - 2026-10-01
 
 ### Changed

package/README.md

@@ -11,8 +11,8 @@ This toolkit gives campaign developers and AI coding tools a clear path for asse
 5. Provide or generate a [Campaign Build Brief](./docs/campaign-build-brief.md) for merchandising/design presentation decisions.
 6. Create and doctor a Build Packet.
 7. Hand off to `next-campaigns-build`.
-8. Run build/lint, then install the Campaigns OS Playwright browser once with `campaigns-os qa install-browser`.
-9. Run `next-campaigns-polish`, serve the current build, and run the mandatory `campaigns-os polish capture` producer before marking Polish complete.
+8. Run build/lint and record the build with `campaigns-os record build`, then install the Campaigns OS Playwright browser once with `campaigns-os qa install-browser`.
+9. Run `next-campaigns-polish`, serve the current build, run the mandatory `campaigns-os polish capture` producer, then record Polish with `campaigns-os record polish --evidence <file>`.
 10. Deploy a preview.
 11. Run `next-campaigns-qa` against the tested URL.
 12. Record launch blockers and follow-up work.
@@ -53,6 +53,15 @@ npx --no-install campaigns-os install-skills --platform claude
 mkdir -p source
 ```
 
+With Claude Code, [local setup](docs/local-setup.md) replaces the last two
+lines with one: `npx --no-install campaigns-os tooling setup --target .
+--platform claude` installs the QA browser, the skills and the project
+context, and keeps existing pages and instructions. It does not scaffold
+pages; the agent chooses the template at intake. Codex, Cursor and other
+agents keep the separate steps: `install-skills --platform codex` (or
+`--platform agents`), `install-agent-context --target .` and
+`qa install-browser`.
+
 The toolkit is also published to npm as `@nextcommerce/campaigns-os`, so the
 CLI can be installed once, globally, instead of pinned per campaign:
 
@@ -126,7 +135,10 @@ npx --no-install campaigns-os next --packet ./campaign-runtime.build.json --json
 `--proxy-base <origin>` when the map was saved on a non-production map store);
 `--spec <campaignspec.json>` starts from a local export or an agent-authored
 [local spec](docs/build-packet.md#local-spec-entry) instead. Local-spec identity
-requires a reviewed 1.43.0-or-later release. `--source` is
+requires a reviewed 1.43.0-or-later release. To prove the campaign on
+localhost before a preview deploy, add `--deploy-target local-serve` (and
+`--preview-url http://localhost:<port>/`); `qa policy set --deploy-target <target>`
+changes it later. `--source` is
 always required: the folder of prepared HTML/CSS/assets for the pages you are
 building, with a source manifest that carries desktop and mobile screenshot
 proof for each designed page
@@ -267,21 +279,28 @@ Before an SDK bump, scan explicitly scoped tracked merchant HTML/JS with [SDK st
 
 ```bash
 npm run campaigns-os -- tooling status
+npm run campaigns-os -- tooling setup --target <page-kit-repo> --platform claude --dry-run --json
 npm run campaigns-os -- install-skills --dry-run
 npm run campaigns-os -- install-skills --platform codex --dry-run
+npm run campaigns-os -- install-agent-context --target <page-kit-repo> --dry-run
 npm run campaigns-os -- qa install-browser
 npm run skills -- status
 npm run campaigns-os -- prepare-build --spec <spec.json> --source <html-dir> --target <page-kit-repo> --template-family <family> --brief <campaign-build-brief.yaml>
 npm run campaigns-os -- doctor --packet <page-kit-repo>/campaign-runtime.build.json
+npm run campaigns-os -- page-kit sync --packet <page-kit-repo>/campaign-runtime.build.json --dry-run
+npm run campaigns-os -- checkpoint waive --packet <packet.json> --gate source_html.producer_provenance --page <page_id> --reason "<why>" --waived-by "<named human>" --review-condition "<trigger>" --dry-run
 npm run campaigns-os -- sdk storage-check --target <campaign-git-root> --target-sdk 0.4.38 --manifest <sdk-storage-manifest.json> --scope <campaign,shared> --json
 npm run campaigns-os -- standardize --target <page-kit-repo-or-cpk-repo> --json
 npm run campaigns-os -- theme inspect --packet <page-kit-repo>/campaign-runtime.build.json --json
 npm run campaigns-os -- theme generate --packet <page-kit-repo>/campaign-runtime.build.json --json
 npm run campaigns-os -- next setup --packet <page-kit-repo>/campaign-runtime.build.json
 npm run campaigns-os -- next build --packet <page-kit-repo>/campaign-runtime.build.json
+npm run campaigns-os -- record setup --packet <page-kit-repo>/campaign-runtime.build.json
+npm run campaigns-os -- record build --packet <page-kit-repo>/campaign-runtime.build.json
 npm run qa:install-browser
 npm run campaigns-os -- next polish --packet <packet.json> --report <assembly-report.json>
 npm run campaigns-os -- polish capture --packet <packet.json> --base-url <served-current-build-url>
+npm run campaigns-os -- record polish --packet <packet.json> --evidence <polish-evidence.json>
 npm run campaigns-os -- next qa --packet <packet.json> --report <assembly-report.json>
 npm run campaigns-os -- qa resolve --packet <packet.json>
 npm run campaigns-os -- qa run --packet <packet.json> --base-url <preview-url> --browser --test-order common
@@ -298,6 +317,14 @@ only when deliberately recording a new doctor stage. `--no-write` overrides
 `--write`. A custom `--doctor-out <path>` also requires `--write`; naming an
 output path alone does not create or refresh the file. Build/QA producer
 commands continue to record their own stages.
+
+Record a stage's completion with `record setup`, `record build` (after every
+rebuild) and `record polish --evidence <file>` rather than hand-editing
+`.campaign-runtime/build-context.json` or `.campaign-runtime/assembly-report.json`.
+Each validates what it would write, refuses a stage `next` has not reached, and
+writes nothing on failure; `--dry-run` runs the checks without writing. See
+[Build Packet](docs/build-packet.md) and [Polish evidence](docs/polish-evidence.md).
+
 Do not use `prepare-build --force` merely to refresh a catalog path: doctor
 already resolves the running toolkit's catalog, and force clears stage evidence.
 

package/agents/claude/CLAUDE.md

@@ -6,6 +6,8 @@ Packet exists, read it and follow `next`. Check the loaded skill's bundle
 revision and restart the session if it differs from the
 project copy. Do not use private runtime source as the campaign's starting point.
 
+To pick up an existing campaign, run `npx --no-install campaigns-os readback .` and `npx --no-install campaigns-os next --packet campaign-runtime.build.json` before reading artifacts by hand; `next` blocks polish and QA again whenever the built output changes. The committed `.campaign-runtime/qa-verdict.json` keeps no order records or URLs: its `browser-test-order:<path>` assertions are the typed-card proof, and the full verdict is under `qa-output/`.
+
 Core rules:
 
 - Treat CampaignSpec as campaign intent and the Campaigns API as live commerce truth.
@@ -17,15 +19,16 @@ Core rules:
 - Prepared AI/exported HTML must be converted into page-kit-ready source first: keep page-owned body markup, strip document wrappers, add YAML frontmatter, move shared CSS/assets into the campaign structure, and use Liquid helpers only for page-kit links/assets/includes.
 - Preserve prepared source HTML for landing/presell pages when it is a real standalone design.
 - For checkout/upsell/downsell/receipt, use starter-template commerce surfaces as SDK contract references: preserve required `data-next-*` controls and runtime wiring, but let the campaign/source own visual chrome, copy hierarchy, imagery, and brand layer.
+- Reproduce the source design's own proof and urgency elements as designed (reviews, ratings, stock counters, countdowns, guarantees). They are the merchant's content; Campaigns OS does not review them, so do not remove, soften or flag them.
 - If `.campaign-runtime/build-context.json` has `theme` or `.campaign-runtime/theme/theme-report.json` exists, use it as optional brand-theme evidence. A generated `brand-theme.css` must load after `next-core.css`; missing or low-confidence theme is a warning/skipped reason, not permission to edit SDK-owned runtime surfaces.
 - Copy a starter template family atomically with dependent pages, `_includes/`, `_layouts/`, `assets/css/`, and `assets/js/`; do not copy only checkout/receipt pages.
 - Resolve SDK routing meta tags to campaign-root paths such as `/campaign-slug/upsell/`; do not emit source filenames or unrooted `upsell/` values into built checkout/upsell pages.
 - Default one-time `packages.prepurchase_*` order bumps to fixed quantity rather than syncing with the main bundle unless the spec explicitly requires sync.
 - Record spec-driven removals, such as unavailable payment methods, so polish does not reintroduce them.
 - Do not copy Olympus-style `shipping_methods` frontmatter into `shop-three-step`; it uses dynamic shipping through `window.next.getShippingMethods()`.
-- Run build/lint checks and record evidence in the assembly report, then hand off to polish. Before Polish becomes terminal or hands off to deploy/QA, install the package-owned Playwright browser with `npm run qa:install-browser`, serve the current build, and run `campaigns-os polish capture --packet campaign-runtime.build.json --base-url <served-current-build-url>`.
-- After that checkpoint clears, QA uses the Campaigns OS Node/npm runner: run `campaigns-os qa resolve --packet campaign-runtime.build.json`, then run `campaigns-os qa run --packet campaign-runtime.build.json --base-url <url> --browser --test-order common`.
-- Typed-card test-order proof uses `campaigns-os qa run --test-order <common|checkout|decline|accept|both|full|explicit-path>` through the deployed checkout and rendered upsell controls. `common` runs every actual terminal path when they fit under the flood cap (`--max-test-orders`, 6 by default); above the cap it runs the checkout baseline, first-offer accept and decline, and a deduplicated shortest real receipt path, then adds one decline path per offer or downsell page not yet declined, up to the cap, and names any page left out. A page counts as covered only when an order clicks its decline; the `browser-test-order:upsell-action-coverage` verdict row warns naming each page whose decline no order clicked. `full` walks every actual terminal path in the selected checkout topology; cycles, missing routes, and reachable nonterminals block exhaustive proof before browser launch. The accidental-flood cap remains `6`, and an overflow names the exact explicit `--max-test-orders` raise. Coverage is the only control — there is no permission/approval step.
+- Run build/lint checks and record evidence in the assembly report, then hand off to polish. Before Polish becomes terminal or hands off to deploy/QA, install the package-owned Playwright browser with `npm run qa:install-browser`, serve the current build, and run `npx --no-install campaigns-os polish capture --packet campaign-runtime.build.json --base-url <served-current-build-url>`.
+- After that checkpoint clears, QA uses the Campaigns OS Node/npm runner: run `npx --no-install campaigns-os qa resolve --packet campaign-runtime.build.json`, then run `npx --no-install campaigns-os qa run --packet campaign-runtime.build.json --base-url <url> --browser --test-order common`.
+- Typed-card test-order proof uses `npx --no-install campaigns-os qa run --test-order <common|checkout|decline|accept|both|full|explicit-path>` through the deployed checkout and rendered upsell controls. `common` runs every actual terminal path when they fit under the flood cap (`--max-test-orders`, 6 by default); above the cap it runs the checkout baseline, first-offer accept and decline, and a deduplicated shortest real receipt path, then adds one decline path per offer or downsell page not yet declined, up to the cap, and names any page left out. A page counts as covered only when an order clicks its decline; the `browser-test-order:upsell-action-coverage` verdict row warns naming each page whose decline no order clicked. `full` walks every actual terminal path in the selected checkout topology; cycles, missing routes, and reachable nonterminals block exhaustive proof before browser launch. The accidental-flood cap remains `6`, and an overflow names the exact explicit `--max-test-orders` raise. Coverage is the only control — there is no permission/approval step.
 - Analytics correctness is two-phase: the campaign-root visit inventories declared providers/tags only, and the same canonical typed-card run proves Purchase only from the topology-recognized final receipt document after `--analytics-settle`. Missing/unrecognized receipts are manual-review warnings; recognized receipt no-signal and capture/settle errors block. Only the genuine recognized-receipt/no-signal failure is waivable; capture/settle errors are not. Checkout/upsell signals remain whole-journey parity evidence and cannot satisfy a silent receipt.
 - Test-order proof must use the canonical Playwright typed-card path through the tested checkout: select the rendered cart, fill customer/shipping fields, type the sandbox card into active hosted payment iframes, click the real submit button, then click rendered SDK upsell accept/decline controls and verify receipt/order evidence.
 - Do not use `next.getCartData().cartLines` as cart-populated proof; use typed-card order read-back, `cart:updated` payload `items` / `summary.lines`, and rendered bundle DOM evidence.

package/agents/codex/AGENTS.md

@@ -3,8 +3,9 @@
 Use this context when working in a target campaign repo with Campaigns OS artifacts.
 
 - Read `campaign-runtime.build.json` first.
+- To pick up an existing campaign, run `npx --no-install campaigns-os readback .` and `npx --no-install campaigns-os next --packet campaign-runtime.build.json` before reading artifacts by hand; `next` blocks polish and QA again whenever the built output changes. The committed `.campaign-runtime/qa-verdict.json` keeps no order records or URLs: its `browser-test-order:<path>` assertions are the typed-card proof, and the full verdict is under `qa-output/`.
 - If `.campaign-runtime/build-context.json` or `.campaign-runtime/assembly-report.json` exists, read them before editing campaign files.
-- Run `campaigns-os doctor --packet campaign-runtime.build.json` before build work.
+- Run `npx --no-install campaigns-os doctor --packet campaign-runtime.build.json` before build work.
 - Treat CampaignSpec validation as owned by the public `@nextcommerce/campaigns-os/campaign-spec` rules surfaced through doctor `spec.validation` findings; use structured rule/path detail when available.
 - Respect the selected template family's `agentContract`.
 - Replace demo refs from CampaignSpec/API; do not preserve starter sample IDs.
@@ -12,15 +13,16 @@ Use this context when working in a target campaign repo with Campaigns OS artifa
 - Prepared AI/exported HTML must be converted into page-kit-ready source first: keep page-owned body markup, strip document wrappers, add YAML frontmatter, move shared CSS/assets into the campaign structure, and use Liquid helpers only for page-kit links/assets/includes.
 - Preserve prepared source HTML for landing/presell pages when it is a real standalone design.
 - For checkout/upsell/downsell/receipt, use starter-template commerce surfaces as SDK contract references: preserve required `data-next-*` controls and runtime wiring, but let the campaign/source own visual chrome, copy hierarchy, imagery, and brand layer.
+- Reproduce the source design's own proof and urgency elements as designed (reviews, ratings, stock counters, countdowns, guarantees). They are the merchant's content; Campaigns OS does not review them, so do not remove, soften or flag them.
 - If `.campaign-runtime/build-context.json` has `theme` or `.campaign-runtime/theme/theme-report.json` exists, use it as optional brand-theme evidence. A generated `brand-theme.css` must load after `next-core.css`; missing or low-confidence theme is a warning/skipped reason, not permission to edit SDK-owned runtime surfaces.
 - Copy a starter template family atomically with dependent pages, `_includes/`, `_layouts/`, `assets/css/`, and `assets/js/`; do not copy only checkout/receipt pages.
 - Emit SDK routing meta tags as campaign-root paths such as `/campaign-slug/upsell/`.
 - Default one-time `packages.prepurchase_*` bumps to fixed quantity unless the CampaignSpec explicitly requires package sync.
 - Record spec-driven drops so polish does not reintroduce unsupported source elements.
 - For `shop-three-step`, keep dynamic shipping via `window.next.getShippingMethods()` and do not add Olympus-style static `shipping_methods` frontmatter.
-- Build hands off to polish. Before Polish becomes terminal or hands off to deploy/QA, install the package-owned Playwright browser with `npm run qa:install-browser`, serve the current build, and run `campaigns-os polish capture --packet campaign-runtime.build.json --base-url <served-current-build-url>`.
-- After that checkpoint clears, QA uses the Campaigns OS Node/npm runner: run `campaigns-os qa resolve`, then `campaigns-os qa run --browser --test-order common` against the tested URL.
-- Typed-card test-order proof uses `campaigns-os qa run --test-order <common|checkout|decline|accept|both|full|explicit-path>` through the tested checkout and rendered upsell controls. Global test cards bypass the gateway and create no transactions, so no permission/approval is needed — coverage is the only control. `common` runs every actual terminal path when they fit under the flood cap (`--max-test-orders`, 6 by default); above the cap it runs the checkout baseline, first-offer accept and decline, and a deduplicated shortest real receipt path, then adds one decline path per offer or downsell page not yet declined, up to the cap, and names any page left out. A page counts as covered only when an order clicks its decline; the `browser-test-order:upsell-action-coverage` verdict row warns naming each page whose decline no order clicked. `full` walks every actual terminal path in the selected checkout topology; cycles, missing routes, and reachable nonterminals block exhaustive proof before browser launch. The accidental-flood cap remains `6`, and an overflow names the exact explicit `--max-test-orders` raise. Localhost on any port is a Campaigns App Development domain for SDK QA with analytics suppressed; non-localhost preview/production origins still need SDK origin allowlist confirmation. Do not use external browser skills, the SDK test-mode event, or hand-built backend API orders as launch proof.
+- Build hands off to polish. Before Polish becomes terminal or hands off to deploy/QA, install the package-owned Playwright browser with `npm run qa:install-browser`, serve the current build, and run `npx --no-install campaigns-os polish capture --packet campaign-runtime.build.json --base-url <served-current-build-url>`.
+- After that checkpoint clears, QA uses the Campaigns OS Node/npm runner: run `npx --no-install campaigns-os qa resolve`, then `npx --no-install campaigns-os qa run --browser --test-order common` against the tested URL.
+- Typed-card test-order proof uses `npx --no-install campaigns-os qa run --test-order <common|checkout|decline|accept|both|full|explicit-path>` through the tested checkout and rendered upsell controls. Global test cards bypass the gateway and create no transactions, so no permission/approval is needed — coverage is the only control. `common` runs every actual terminal path when they fit under the flood cap (`--max-test-orders`, 6 by default); above the cap it runs the checkout baseline, first-offer accept and decline, and a deduplicated shortest real receipt path, then adds one decline path per offer or downsell page not yet declined, up to the cap, and names any page left out. A page counts as covered only when an order clicks its decline; the `browser-test-order:upsell-action-coverage` verdict row warns naming each page whose decline no order clicked. `full` walks every actual terminal path in the selected checkout topology; cycles, missing routes, and reachable nonterminals block exhaustive proof before browser launch. The accidental-flood cap remains `6`, and an overflow names the exact explicit `--max-test-orders` raise. Localhost on any port is a Campaigns App Development domain for SDK QA with analytics suppressed; non-localhost preview/production origins still need SDK origin allowlist confirmation. Do not use external browser skills, the SDK test-mode event, or hand-built backend API orders as launch proof.
 - Analytics correctness is two-phase: the campaign-root visit inventories declared providers/tags only, and the same canonical typed-card run proves Purchase only from the topology-recognized final receipt document after `--analytics-settle`. Missing/unrecognized receipts are manual-review warnings; recognized receipt no-signal and capture/settle errors block. Only the genuine recognized-receipt/no-signal failure is waivable; capture/settle errors are not. Checkout/upsell signals remain whole-journey parity evidence and cannot satisfy a silent receipt.
 - Do not use `next.getCartData().cartLines` as cart-populated proof; use typed-card order read-back, `cart:updated` payload `items` / `summary.lines`, and rendered bundle DOM evidence.
 - Campaigns OS proof is not merchant launch readiness. Before launch, confirm production storefront URL, live payment methods, shipping markets, legal/support URLs, analytics expectations, and merchant-side configuration.

package/agents/copilot/copilot-instructions.md

@@ -5,10 +5,11 @@ When this repository contains Campaigns OS artifacts, use them as the build hand
 - `campaign-runtime.build.json` defines the CampaignSpec, source adapter, target output, template family, deploy target, SDK origin state, and QA proof depth.
 - `.campaign-runtime/build-context.json` records page mappings and setup/build handoff details.
 - `.campaign-runtime/assembly-report.json` records stage evidence and blockers.
+- To pick up an existing campaign, run `npx --no-install campaigns-os readback .` and `npx --no-install campaigns-os next --packet campaign-runtime.build.json` before reading artifacts by hand; `next` blocks polish and QA again whenever the built output changes. The committed `.campaign-runtime/qa-verdict.json` keeps no order records or URLs: its `browser-test-order:<path>` assertions are the typed-card proof, and the full verdict is under `qa-output/`.
 - `.campaign-runtime/theme/theme-report.json`, when present, is optional brand-theme evidence. Generated `brand-theme.css` must load after `next-core.css`; missing or low-confidence theme is a warning/skipped reason, not permission to edit SDK-owned runtime surfaces.
 
 CampaignSpec validation is owned by the public `@nextcommerce/campaigns-os/campaign-spec` rules surfaced through doctor `spec.validation` findings; use structured rule/path detail when available.
 
-Preserve Campaign Cart SDK-owned commerce surfaces. Replace starter demo refs from CampaignSpec/API. Prepared AI/exported HTML must be converted into page-kit-ready source first: keep page-owned body markup, strip document wrappers, add YAML frontmatter, move shared CSS/assets into the campaign structure, and use Liquid helpers only for page-kit links/assets/includes. Landing/presell pages can preserve source design; checkout/upsell/downsell/receipt should use starter-template commerce surfaces as SDK contract references while campaign/source owns visual chrome. Copy starter template families atomically with dependent pages, `_includes/`, `_layouts/`, `assets/css/`, and `assets/js/`; do not copy only checkout/receipt pages. Do not claim launch readiness until build, polish, deploy, and QA evidence are recorded.
+Preserve Campaign Cart SDK-owned commerce surfaces. Replace starter demo refs from CampaignSpec/API. Prepared AI/exported HTML must be converted into page-kit-ready source first: keep page-owned body markup, strip document wrappers, add YAML frontmatter, move shared CSS/assets into the campaign structure, and use Liquid helpers only for page-kit links/assets/includes. Landing/presell pages can preserve source design; checkout/upsell/downsell/receipt should use starter-template commerce surfaces as SDK contract references while campaign/source owns visual chrome. Reproduce the source design's own proof and urgency elements as designed (reviews, ratings, stock counters, countdowns, guarantees). They are the merchant's content; Campaigns OS does not review them, so do not remove, soften or flag them. Copy starter template families atomically with dependent pages, `_includes/`, `_layouts/`, `assets/css/`, and `assets/js/`; do not copy only checkout/receipt pages. Do not claim launch readiness until build, polish, deploy, and QA evidence are recorded.
 
-Before Polish becomes terminal or hands off to deploy/QA, install the package-owned Playwright browser with `npm run qa:install-browser`, serve the current build, and run `campaigns-os polish capture --packet campaign-runtime.build.json --base-url <served-current-build-url>`. After that checkpoint clears, QA must use the Campaigns OS Node/npm runner: run `campaigns-os qa resolve`, then run `campaigns-os qa run --browser --test-order common` against the tested URL. Typed-card test-order proof must use `campaigns-os qa run --test-order <common|checkout|decline|accept|both|full|explicit-path>` through the tested checkout and rendered upsell controls; global test cards bypass the gateway and create no transactions, so no permission/approval is needed. `common` runs every actual terminal path when they fit under the flood cap (`--max-test-orders`, 6 by default); above the cap it runs the checkout baseline, first-offer accept and decline, and a deduplicated shortest real receipt path, then adds one decline path per offer or downsell page not yet declined, up to the cap, and names any page left out. A page counts as covered only when an order clicks its decline; the `browser-test-order:upsell-action-coverage` verdict row warns naming each page whose decline no order clicked. `full` walks every actual terminal path in the selected checkout topology; cycles, missing routes, and reachable nonterminals block exhaustive proof before browser launch. The accidental-flood cap remains `6`, and an overflow names the exact explicit `--max-test-orders` raise. Analytics correctness is two-phase: the campaign-root visit inventories declared providers/tags only, and the same canonical typed-card run proves Purchase only from the topology-recognized final receipt document after `--analytics-settle`. Missing/unrecognized receipts are manual-review warnings; recognized receipt no-signal and capture/settle errors block. Only the genuine recognized-receipt/no-signal failure is waivable; capture/settle errors are not. Checkout/upsell signals remain whole-journey parity evidence and cannot satisfy a silent receipt. Do not use `next.getCartData().cartLines` as cart-populated proof; use typed-card order read-back, `cart:updated` payload `items` / `summary.lines`, and rendered bundle DOM evidence. Localhost on any port is a Campaigns App Development domain for SDK QA with analytics suppressed; non-localhost preview/production origins still need SDK origin allowlist confirmation. Do not use external browser skills, SDK test-mode events, or direct backend orders as launch proof. Campaigns OS proof is not merchant launch readiness; before launch, confirm production storefront URL, live payment methods, shipping markets, legal/support URLs, analytics expectations, and merchant-side configuration.
+Before Polish becomes terminal or hands off to deploy/QA, install the package-owned Playwright browser with `npm run qa:install-browser`, serve the current build, and run `npx --no-install campaigns-os polish capture --packet campaign-runtime.build.json --base-url <served-current-build-url>`. After that checkpoint clears, QA must use the Campaigns OS Node/npm runner: run `npx --no-install campaigns-os qa resolve`, then run `npx --no-install campaigns-os qa run --browser --test-order common` against the tested URL. Typed-card test-order proof must use `npx --no-install campaigns-os qa run --test-order <common|checkout|decline|accept|both|full|explicit-path>` through the tested checkout and rendered upsell controls; global test cards bypass the gateway and create no transactions, so no permission/approval is needed. `common` runs every actual terminal path when they fit under the flood cap (`--max-test-orders`, 6 by default); above the cap it runs the checkout baseline, first-offer accept and decline, and a deduplicated shortest real receipt path, then adds one decline path per offer or downsell page not yet declined, up to the cap, and names any page left out. A page counts as covered only when an order clicks its decline; the `browser-test-order:upsell-action-coverage` verdict row warns naming each page whose decline no order clicked. `full` walks every actual terminal path in the selected checkout topology; cycles, missing routes, and reachable nonterminals block exhaustive proof before browser launch. The accidental-flood cap remains `6`, and an overflow names the exact explicit `--max-test-orders` raise. Analytics correctness is two-phase: the campaign-root visit inventories declared providers/tags only, and the same canonical typed-card run proves Purchase only from the topology-recognized final receipt document after `--analytics-settle`. Missing/unrecognized receipts are manual-review warnings; recognized receipt no-signal and capture/settle errors block. Only the genuine recognized-receipt/no-signal failure is waivable; capture/settle errors are not. Checkout/upsell signals remain whole-journey parity evidence and cannot satisfy a silent receipt. Do not use `next.getCartData().cartLines` as cart-populated proof; use typed-card order read-back, `cart:updated` payload `items` / `summary.lines`, and rendered bundle DOM evidence. Localhost on any port is a Campaigns App Development domain for SDK QA with analytics suppressed; non-localhost preview/production origins still need SDK origin allowlist confirmation. Do not use external browser skills, SDK test-mode events, or direct backend orders as launch proof. Campaigns OS proof is not merchant launch readiness; before launch, confirm production storefront URL, live payment methods, shipping markets, legal/support URLs, analytics expectations, and merchant-side configuration.

package/agents/cursor/campaigns-os.mdc

@@ -6,8 +6,8 @@ globs:
 alwaysApply: false
 ---
 
-Read Campaigns OS artifacts before editing campaign pages. Treat CampaignSpec/API values as live commerce truth, starter-template contracts as SDK surface truth, and designed HTML/assets as visual/content intent. Treat CampaignSpec validation as owned by the public `@nextcommerce/campaigns-os/campaign-spec` rules surfaced through doctor `spec.validation` findings; use structured rule/path detail when available. If `context.theme` or `.campaign-runtime/theme/theme-report.json` exists, use it as optional brand-theme evidence; generated `brand-theme.css` must load after `next-core.css`, and missing/low-confidence theme is a warning or skipped reason, not permission to edit SDK-owned runtime surfaces.
+Read Campaigns OS artifacts before editing campaign pages. To pick up an existing campaign, run `npx --no-install campaigns-os readback .` and `npx --no-install campaigns-os next --packet campaign-runtime.build.json` before reading artifacts by hand; `next` blocks polish and QA again whenever the built output changes. The committed `.campaign-runtime/qa-verdict.json` keeps no order records or URLs: its `browser-test-order:<path>` assertions are the typed-card proof, and the full verdict is under `qa-output/`. Treat CampaignSpec/API values as live commerce truth, starter-template contracts as SDK surface truth, and designed HTML/assets as visual/content intent. Treat CampaignSpec validation as owned by the public `@nextcommerce/campaigns-os/campaign-spec` rules surfaced through doctor `spec.validation` findings; use structured rule/path detail when available. If `context.theme` or `.campaign-runtime/theme/theme-report.json` exists, use it as optional brand-theme evidence; generated `brand-theme.css` must load after `next-core.css`, and missing/low-confidence theme is a warning or skipped reason, not permission to edit SDK-owned runtime surfaces.
 
-Do not carry over demo package, shipping, voucher, payment, tracking, footer, or SEO values. Prepared AI/exported HTML must be converted into page-kit-ready source first: keep page-owned body markup, strip document wrappers, add YAML frontmatter, move shared CSS/assets into the campaign structure, and use Liquid helpers only for page-kit links/assets/includes. Preserve prepared landing/presell source HTML when it is a real standalone design. For checkout/upsell/downsell/receipt, use starter-template commerce surfaces as SDK contract references while campaign/source owns visual chrome. Copy starter template families atomically with dependent pages, `_includes/`, `_layouts/`, `assets/css/`, and `assets/js/`; do not copy only checkout/receipt pages. Emit SDK routing meta tags as campaign-root paths such as `/campaign-slug/upsell/`. Preserve SDK-owned checkout/cart/upsell/receipt surfaces. For `shop-three-step`, shipping is dynamic via `window.next.getShippingMethods()`.
+Do not carry over demo package, shipping, voucher, payment, tracking, footer, or SEO values. Prepared AI/exported HTML must be converted into page-kit-ready source first: keep page-owned body markup, strip document wrappers, add YAML frontmatter, move shared CSS/assets into the campaign structure, and use Liquid helpers only for page-kit links/assets/includes. Preserve prepared landing/presell source HTML when it is a real standalone design. For checkout/upsell/downsell/receipt, use starter-template commerce surfaces as SDK contract references while campaign/source owns visual chrome. Reproduce the source design's own proof and urgency elements as designed (reviews, ratings, stock counters, countdowns, guarantees). They are the merchant's content; Campaigns OS does not review them, so do not remove, soften or flag them. Copy starter template families atomically with dependent pages, `_includes/`, `_layouts/`, `assets/css/`, and `assets/js/`; do not copy only checkout/receipt pages. Emit SDK routing meta tags as campaign-root paths such as `/campaign-slug/upsell/`. Preserve SDK-owned checkout/cart/upsell/receipt surfaces. For `shop-three-step`, shipping is dynamic via `window.next.getShippingMethods()`.
 
-Before Polish becomes terminal or hands off to deploy/QA, install the package-owned Playwright browser with `npm run qa:install-browser`, serve the current build, and run `campaigns-os polish capture --packet campaign-runtime.build.json --base-url <served-current-build-url>`. After that checkpoint clears, QA uses the Campaigns OS Node/npm runner: `campaigns-os qa resolve`, then `campaigns-os qa run --browser --test-order common` against the tested URL. Test-order proof uses `campaigns-os qa run --test-order <common|checkout|decline|accept|both|full|explicit-path>` through the tested checkout and rendered upsell controls; global test cards bypass the gateway and create no transactions, so no permission/approval is needed. `common` runs every actual terminal path when they fit under the flood cap (`--max-test-orders`, 6 by default); above the cap it runs the checkout baseline, first-offer accept and decline, and a deduplicated shortest real receipt path, then adds one decline path per offer or downsell page not yet declined, up to the cap, and names any page left out. A page counts as covered only when an order clicks its decline; the `browser-test-order:upsell-action-coverage` verdict row warns naming each page whose decline no order clicked. `full` walks every actual terminal path in the selected checkout topology; cycles, missing routes, and reachable nonterminals block exhaustive proof before browser launch. The accidental-flood cap remains `6`, and an overflow names the exact explicit `--max-test-orders` raise. Analytics correctness is two-phase: the campaign-root visit inventories declared providers/tags only, and the same canonical typed-card run proves Purchase only from the topology-recognized final receipt document after `--analytics-settle`. Missing/unrecognized receipts are manual-review warnings; recognized receipt no-signal and capture/settle errors block. Only the genuine recognized-receipt/no-signal failure is waivable; capture/settle errors are not. Checkout/upsell signals remain whole-journey parity evidence and cannot satisfy a silent receipt. Do not use `next.getCartData().cartLines` as cart-populated proof; use typed-card order read-back, `cart:updated` payload `items` / `summary.lines`, and rendered bundle DOM evidence. Localhost on any port is a Campaigns App Development domain for SDK QA with analytics suppressed; non-localhost preview/production origins still need SDK origin allowlist confirmation. External browser skills, SDK test-mode events, and direct backend orders are not launch proof. Campaigns OS proof is not merchant launch readiness; before launch, confirm production storefront URL, live payment methods, shipping markets, legal/support URLs, analytics expectations, and merchant-side configuration.
+Before Polish becomes terminal or hands off to deploy/QA, install the package-owned Playwright browser with `npm run qa:install-browser`, serve the current build, and run `npx --no-install campaigns-os polish capture --packet campaign-runtime.build.json --base-url <served-current-build-url>`. After that checkpoint clears, QA uses the Campaigns OS Node/npm runner: `npx --no-install campaigns-os qa resolve`, then `npx --no-install campaigns-os qa run --browser --test-order common` against the tested URL. Test-order proof uses `npx --no-install campaigns-os qa run --test-order <common|checkout|decline|accept|both|full|explicit-path>` through the tested checkout and rendered upsell controls; global test cards bypass the gateway and create no transactions, so no permission/approval is needed. `common` runs every actual terminal path when they fit under the flood cap (`--max-test-orders`, 6 by default); above the cap it runs the checkout baseline, first-offer accept and decline, and a deduplicated shortest real receipt path, then adds one decline path per offer or downsell page not yet declined, up to the cap, and names any page left out. A page counts as covered only when an order clicks its decline; the `browser-test-order:upsell-action-coverage` verdict row warns naming each page whose decline no order clicked. `full` walks every actual terminal path in the selected checkout topology; cycles, missing routes, and reachable nonterminals block exhaustive proof before browser launch. The accidental-flood cap remains `6`, and an overflow names the exact explicit `--max-test-orders` raise. Analytics correctness is two-phase: the campaign-root visit inventories declared providers/tags only, and the same canonical typed-card run proves Purchase only from the topology-recognized final receipt document after `--analytics-settle`. Missing/unrecognized receipts are manual-review warnings; recognized receipt no-signal and capture/settle errors block. Only the genuine recognized-receipt/no-signal failure is waivable; capture/settle errors are not. Checkout/upsell signals remain whole-journey parity evidence and cannot satisfy a silent receipt. Do not use `next.getCartData().cartLines` as cart-populated proof; use typed-card order read-back, `cart:updated` payload `items` / `summary.lines`, and rendered bundle DOM evidence. Localhost on any port is a Campaigns App Development domain for SDK QA with analytics suppressed; non-localhost preview/production origins still need SDK origin allowlist confirmation. External browser skills, SDK test-mode events, and direct backend orders are not launch proof. Campaigns OS proof is not merchant launch readiness; before launch, confirm production storefront URL, live payment methods, shipping markets, legal/support URLs, analytics expectations, and merchant-side configuration.

package/compatibility.json

@@ -1,6 +1,6 @@
 {
   "package": "@nextcommerce/campaigns-os",
-  "version": "1.47.0",
+  "version": "1.50.0",
   "status": "developer-preview",
   "contracts": {
     "campaign_spec": "4.2-4.3",