@nextcommerce/campaigns-os 1.47.0 → 1.50.0

package/src/gate-actions.mjs

@@ -62,6 +62,14 @@ export const HIDDEN_EAGER_MEDIA_ACTIONS = Object.freeze({
     command: null,
     description: localProofRebuildText(),
   }),
+  // Every mapped page is template stock: capture has no design route, so
+  // neither a recapture nor an authority repair can produce the evidence.
+  map_design_route: Object.freeze({
+    id: "polish.hidden_eager_media.map_design_route",
+    kind: "manual",
+    command: null,
+    description: "Every mapped page is template stock, so polish capture has nothing to measure. Map at least one page to its design source HTML (source_html.pages[].path) and rerun intake, or prove the campaign on the local preview (deploy.target local-serve served from localhost), where this missing evidence is carried forward as a warning.",
+  }),
 });
 
 const PACKET_PLACEHOLDER = "--packet <packet>";

package/src/install-mode.mjs

@@ -282,11 +282,3 @@ export function invocationPrefixFor(root, pkg = null) {
   prefixCache.set(root, prefix);
   return prefix;
 }
-
-// Rewrites every command spelled with the canonical bare `campaigns-os <verb>`
-// into the given prefix. Internal bookkeeping (deviation tracking, gate
-// registries, tests) keeps the canonical spelling; only what is printed or
-// emitted for an operator or agent to copy is rewritten. Skill names such as
-// next-campaigns-os-setup, file names (campaigns-os.mjs), and already-prefixed
-// forms (`npx --no-install campaigns-os`, `npm run campaigns-os --`) are left
-// alone.

package/src/invocation.mjs

@@ -65,7 +65,7 @@ const COMMANDS = frozen({
   theme: { subcommands: ["generate", "inspect", "waive"] },
   checkpoint: { subcommands: ["waive"] },
   polish: { subcommands: ["capture"] },
-  record: { subcommands: ["build", "polish", "setup"] },
+  record: { subcommands: ["build", "deploy", "polish", "setup", "theme"] },
   "validate-assembly-report": {},
   "install-agent-context": { dryRun: true },
   "install-skills": { dryRun: true },
@@ -92,8 +92,10 @@ const SUBCOMMAND_OVERRIDES = frozen({
   "spec derive": { dryRun: true },
   "qa publish": { dryRun: true },
   "record build": { dryRun: true },
+  "record deploy": { dryRun: true },
   "record polish": { dryRun: true },
   "record setup": { dryRun: true },
+  "record theme": { dryRun: true },
   "qa run": { autoEnd: true },
   "run start": { sweepRoot: "session" },
   "run end": { sweepRoot: "session", dryRun: true },

package/src/local-preview-policy.mjs

@@ -0,0 +1,92 @@
+// The local preview policy: one place that decides which missing evidence a
+// localhost preview carries forward as a warning instead of a blocker.
+//
+// The local preview is a packet whose deploy target is `local-serve`, served
+// from a loopback host. There a campaign must still prove its commerce (store
+// and campaign binding, routes, SDK loading, prices, a typed-card order), but
+// evidence that only design work or launch produces may be missing. Missing
+// evidence is reported as missing, never as passed: a carried-forward gate is
+// a warning in doctor, `next` does not stop on it, and QA records it as a
+// `warn` row, so the verdict is at best `ready_with_exceptions`. A hosted
+// preview or production packet never takes this path, and every check not
+// named below keeps its meaning on every path.
+//
+// Doctor and QA apply this to the gates they evaluate; `next` reads doctor's
+// gates. Recording a stage (`record polish`) and the waiver commands keep the
+// strict gates.
+import { isLocalServePacket } from "./local-proof.mjs";
+import { isLoopbackHostname } from "./remit.mjs";
+
+export const LOCAL_PREVIEW_POLICY = "local_preview";
+export const CARRIED_FORWARD = "carried_forward";
+
+// The checks carried forward, one by one. Each is evidence the campaign does
+// not have yet, not evidence that something is wrong:
+// - polish was never recorded for this build;
+// - no page-load capture exists, either because polish capture never ran or
+//   because every mapped page is template stock and there is no design route
+//   to capture.
+const CARRIED_POLISH_CODES = Object.freeze(new Set([
+  "polish.report_missing",
+  "polish.evidence_missing",
+]));
+export const NO_CAPTURABLE_ROUTES_CODE = "polish.hidden_eager_media.no_capturable_routes";
+const MISSING_CAPTURE_CODE = "polish.hidden_eager_media.capture_malformed";
+
+// With no generatable brand theme the starter template is the design, so its
+// palette and chrome are expected on the local preview: residue findings are
+// warnings there, as they are under a waived theme gate.
+const STARTER_IS_THE_DESIGN_THEME_CODE = "theme_gate.nothing_generatable";
+
+function loopbackOrAbsent(url) {
+  if (url === undefined || url === null || url === "") return true;
+  try {
+    return isLoopbackHostname(new URL(String(url)).hostname);
+  } catch {
+    return false;
+  }
+}
+
+export function isLocalPreview(packet, { baseUrl = null } = {}) {
+  return isLocalServePacket(packet)
+    && loopbackOrAbsent(packet?.deploy?.preview_url)
+    && loopbackOrAbsent(baseUrl);
+}
+
+function pageLoadRecorded(report) {
+  return report?.stages?.polish?.evidence?.visual_review?.page_load != null;
+}
+
+function carried(gate) {
+  return {
+    ...gate,
+    status: CARRIED_FORWARD,
+    carried_forward: { policy: LOCAL_PREVIEW_POLICY, from_status: gate.status, evidence: "missing" },
+  };
+}
+
+// The hidden eager-media checkpoint, evaluated on its own.
+export function applyLocalPreviewToCheckpoint(gate, { packet, report, baseUrl = null } = {}) {
+  if (gate?.status !== "blocked" || !isLocalPreview(packet, { baseUrl })) return gate;
+  const missing = gate.code === NO_CAPTURABLE_ROUTES_CODE
+    || (gate.code === MISSING_CAPTURE_CODE && !pageLoadRecorded(report));
+  return missing ? carried(gate) : gate;
+}
+
+// The polish gate folds the checkpoint in, so it is carried forward only when
+// whatever it owns from the checkpoint was carried forward too.
+export function applyLocalPreviewToPolishGate(gate, { packet, checkpointGate = null, baseUrl = null } = {}) {
+  if (gate?.status !== "blocked" || !isLocalPreview(packet, { baseUrl })) return gate;
+  const checkpointCarried = checkpointGate?.status === CARRIED_FORWARD;
+  if (gate.owned_checkpoint_status === "blocked" && !checkpointCarried) return gate;
+  if (gate.owned_checkpoint_only) return checkpointCarried ? carried(gate) : gate;
+  return CARRIED_POLISH_CODES.has(gate.code) ? carried(gate) : gate;
+}
+
+export function starterResidueIsExpected(themeGate, { packet, baseUrl = null } = {}) {
+  return themeGate?.code === STARTER_IS_THE_DESIGN_THEME_CODE && isLocalPreview(packet, { baseUrl });
+}
+
+export function carriedForwardMessage(gate) {
+  return `Carried forward on the local preview: ${gate.reason} This evidence is missing, not passed; a hosted preview or production run requires it.`;
+}

package/src/page-kit-sdk-version.mjs

@@ -92,6 +92,10 @@ export function evaluatePageKitSdkVersion({
   waivers = [],
   required = true,
   now = new Date().toISOString(),
+  // { family, sdk_version } of the selected certified template family, when
+  // the caller knows it: the missing-pin reason names that verified SDK so the
+  // pin is not chosen by searching docs.
+  familyVerification = null,
 } = {}) {
   const pin = resolveSpecSdkPin(spec);
   const { has_canonical: hasCanonical, has_alias: hasAlias } = pin;
@@ -139,7 +143,10 @@ export function evaluatePageKitSdkVersion({
       scope: PAGE_KIT_SDK_VERSION_SCOPE,
       status: "blocked",
       code: "page_kit.sdk_version.spec_missing",
-      reason: "CampaignSpec is missing global_config.sdk_version (and the runtime.sdk_version alias); add an explicit released SDK pin before build or QA.",
+      reason: "CampaignSpec is missing global_config.sdk_version (and the runtime.sdk_version alias); add an explicit released SDK pin before build or QA."
+        + (isReleasedSdkVersion(familyVerification?.sdk_version) && typeof familyVerification?.family === "string"
+          ? ` The "${familyVerification.family}" template family was last verified against ${familyVerification.sdk_version}.`
+          : ""),
       waivable: false,
       subject,
       state: { spec_status: "missing" },

package/src/polish-node.mjs

@@ -1,4 +1,5 @@
 import { campaignIdentitiesMatch, localSpecIdentityFields } from "./spec-source-identity.mjs";
+import { NO_CAPTURABLE_ROUTES_CODE } from "./local-preview-policy.mjs";
 import { createHash } from "node:crypto";
 import { HIDDEN_EAGER_MEDIA_ACTIONS } from "./gate-actions.mjs";
 import { dirname, join, resolve } from "node:path";
@@ -93,6 +94,8 @@ function mappedSpecRoute(value, pageId) {
   return route;
 }
 
+const NO_CAPTURABLE_ROUTES_ERROR = "no_capturable_routes";
+
 export function planPolishCapture({ packet, baseUrl } = {}) {
   if (!isPlainObject(packet) || !Array.isArray(packet?.source_html?.pages) || packet.source_html.pages.length === 0) {
     throw new Error("polish capture requires packet.source_html.pages mappings.");
@@ -129,7 +132,14 @@ export function planPolishCapture({ packet, baseUrl } = {}) {
     });
   }
 
-  if (routes.length === 0) throw new Error("polish capture has no mapped non-skipped routes to capture.");
+  if (routes.length === 0) {
+    const error = new Error(
+      "polish capture has no mapped non-skipped routes to capture: every mapped page is template stock (skip_reason), so there is no design route to compare."
+      + " On a local-serve preview, missing polish evidence is carried forward as a warning; run `next` for the next stage.",
+    );
+    error.code = NO_CAPTURABLE_ROUTES_ERROR;
+    throw error;
+  }
   routes.sort((a, b) => a.requested_route.localeCompare(b.requested_route) || a.page_id.localeCompare(b.page_id));
   for (let index = 1; index < routes.length; index += 1) {
     if (routes[index - 1].requested_route === routes[index].requested_route) {
@@ -189,6 +199,19 @@ function recordedAuthorityBlock({ packet, report, plan = null, now } = {}) {
   };
 }
 
+// Every mapped page is template stock: there is nothing for polish capture to
+// measure, which is missing evidence rather than a malformed packet. It stays
+// a non-waivable block; the local preview policy carries it forward.
+function noCapturableRoutesBlock({ packet, report, now } = {}) {
+  const block = recordedAuthorityBlock({ packet, report, now });
+  return {
+    ...block,
+    code: NO_CAPTURABLE_ROUTES_CODE,
+    reason: "Every mapped page is template stock (skip_reason), so polish capture has no design route to capture and this build has no page-load evidence.",
+    required_actions: [HIDDEN_EAGER_MEDIA_ACTIONS.map_design_route],
+  };
+}
+
 function recordedCheckpointNotApplicable() {
   return {
     id: HIDDEN_EAGER_MEDIA_SCOPE,
@@ -219,7 +242,8 @@ export function evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report, now
   let plan;
   try {
     plan = planPolishCapture({ packet, baseUrl: "https://polish-capture.invalid" });
-  } catch {
+  } catch (error) {
+    if (error?.code === NO_CAPTURABLE_ROUTES_ERROR) return noCapturableRoutesBlock({ packet, report, now });
     return recordedAuthorityBlock({ packet, report, now });
   }
 

package/src/progress-node.mjs

@@ -58,7 +58,11 @@ export function projectProgressObservation({workspace,context,report,doctor,cont
     binding:reportBound&&id(verdict.run_id)&&id(verdict.run_id)===id(report?.stages?.qa?.verdict_run_id)&&build&&qaSource===build&&doctor?.derived?.build_output_fingerprint?.status==='pass'&&hash(verdict.spec_hash)===localHash?'matching':'unconfirmed',
     publish_state:accepted(qaResult?.qa_verdict_publish?.state,['skipped','ok','failed']),
   }:null;
-  const gates=(Array.isArray(continuation?.gates)?continuation.gates:[]).slice(0,PROGRESS_GATE_LIMIT).map(gate=>({id:accepted(gate?.id,PROGRESS_GATE_IDS),state:PROGRESS_GATE_IDS.includes(gate?.id)?accepted(gate?.status,['pass','blocked','waived','not_applicable']):'unknown'}));
+  // The snapshot schema has no carried-forward state: a gate the local preview
+  // policy carried forward does not apply on this path, so it is not_applicable
+  // here (never pass).
+  const gateState=status=>accepted(status==='carried_forward'?'not_applicable':status,['pass','blocked','waived','not_applicable']);
+  const gates=(Array.isArray(continuation?.gates)?continuation.gates:[]).slice(0,PROGRESS_GATE_LIMIT).map(gate=>({id:accepted(gate?.id,PROGRESS_GATE_IDS),state:PROGRESS_GATE_IDS.includes(gate?.id)?gateState(gate?.status):'unknown'}));
   const actions=[...new Set((Array.isArray(continuation?.next_actions)?continuation.next_actions:[]).slice(0,64).map(action=>accepted(action?.id,PROGRESS_ACTION_IDS)))];
   const stage=accepted(continuation?.stage,PROGRESS_CONTINUATIONS);
   const preview=typeof packet?.deploy?.preview_url==='string'&&packet.deploy.preview_url?packet.deploy.preview_url:null;

package/src/qa-binding-evidence.mjs

@@ -5,7 +5,7 @@ import { HTML_NAMESPACE, baseInEffect, documentBases, endsUnclosed, frozenBaseUr
 
 export const BINDING_SCHEMA = 'campaigns-os-page-binding/v0';
 export const BINDING_LIMITS = Object.freeze({ scripts_per_page: 6, scripts_per_run: 24, script_bytes: 262144, timeout_ms: 5000 });
-const SDK = /^https:\/\/cdn\.jsdelivr\.net\/gh\/NextCommerceCo\/campaign-cart@[^/]+\/(?:dist\/index\.js|public\/loader\.js)(?:\?[^#]*)?$/;
+const SDK = /^https:\/\/cdn\.jsdelivr\.net\/gh\/NextCommerceCo\/campaign-cart@[^/]+\/(?:dist\/(?:index|loader)\.js|public\/loader\.js)(?:\?[^#]*)?$/;
 const str = value => typeof value === 'string' && value.length ? value : null;
 
 // The expected credential uses the existing producer resolver. Disagreement
@@ -188,6 +188,27 @@ export async function observeBinding({ source, page, expected, scriptLoader, par
   return result(values[0] === expected.value ? 'match' : 'mismatch', 'credential_comparison');
 }
 
+// The Campaign Cart SDK sends the page's raw key, with no scheme, as
+// `Authorization` on every Campaigns API call, so the browser pass can see the
+// key a page actually uses, whatever its scripts look like. The value is
+// compared as sent: if the SDK ever adds a scheme, every page reads mismatch
+// rather than passing. The API host is matched by its shape,
+// campaigns.apps.<name>.com, without naming it.
+const SDK_API_HOST = /^campaigns\.apps\.[a-z0-9-]+\.com$/;
+export function isSdkApiRequest(url) {
+  try { const parsed = new URL(url); return parsed.protocol === 'https:' && SDK_API_HOST.test(parsed.hostname) && parsed.pathname.startsWith('/api/'); } catch { return false; }
+}
+
+// The keys a page sent are compared here and dropped; only the outcome is
+// kept. With nothing sent, or no single expected key, the static read stands
+// (null).
+export function sentBinding(sentKeys, expected) {
+  if (!sentKeys.length || expected?.conflict || !expected?.value) return null;
+  return { schema_version: BINDING_SCHEMA, observation: 'sdk_request',
+    outcome: sentKeys.every(value => value === expected.value) ? 'match' : 'mismatch',
+    reason: 'credential_comparison', source_kinds: ['sdk_request'], identity: 'not_verified' };
+}
+
 export function bindingAssertion(page, evidence) {
   // No source URLs, values, hashes, masked fragments, or inferred App IDs.
   return { id: `page-binding:${page.page_id}`, family: 'api-metadata', page: page.page_id,

package/src/qa-browser.mjs

@@ -45,6 +45,7 @@ import {
 import { ORDER_BUMP_PROBE_INPUT, orderBumpEvidenceScript } from "./qa-order-bump.mjs";
 import { assessPurchaseDataLayer, expectedOrderReferences, purchaseDataLayerAssertion, purchaseDataLayerProbe } from "./qa-purchase-data-layer.mjs";
 import { isBumpRow } from "./commercial-journey.mjs";
+import { bindingAssertion, isSdkApiRequest, sentBinding } from "./qa-binding-evidence.mjs";
 import {
   RESIDUE_PAGE_TYPES,
   demoAssetConfig,
@@ -962,6 +963,14 @@ async function runPageBrowserChecks(context, page, args, options = {}) {
       failure: request.failure()?.errorText || "request failed",
     });
   });
+  // The key each SDK request carried. It stays in this function: sentBinding
+  // keeps only whether it matched.
+  const sentKeys = [];
+  const keyReads = [];
+  browserPage.on("request", (request) => {
+    if (!isSdkApiRequest(request.url())) return;
+    keyReads.push(request.headerValue("authorization").then((value) => { if (value !== null) sentKeys.push(value); }, () => {}));
+  });
 
   // Measurements describe the existing sequence; readiness never shortens it.
   const observationStarted = performance.now();
@@ -1017,6 +1026,9 @@ async function runPageBrowserChecks(context, page, args, options = {}) {
       assertions.push(runtimeIssueAssertion(page, "browser-console-errors", actionableConsoleErrors));
     }
     observation.failed_requests_sampled_after_ms = elapsedMilliseconds(observationStarted);
+    await Promise.all(keyReads);
+    const sent = sentBinding(sentKeys, options.bindingExpected);
+    if (sent) assertions.push(bindingAssertion(page, sent));
     if (failedRequests.length) {
       assertions.push(assertion({
         id: `browser-request-failures:${page.page_id}`,
@@ -2822,7 +2834,22 @@ async function pricingVisibilityAssertions(browserPage, page, options = {}) {
       selectors.length ? countVisiblePriceRows(browserPage, selectors) : 0,
       countVisiblePriceRows(browserPage, totalSelectors),
     ]);
-    return [checkoutPriceVisibilityAssertion({ page, selectors, visibleCount, totalSelectors, totalVisibleCount })];
+    // Nothing priced is visible. When the checkout also has no package
+    // selection of its own and the SDK reports an empty cart, the cart is
+    // filled on an earlier page (a landing link carrying forcePackageId), and
+    // opening the checkout directly shows a state no shopper reaches. The
+    // test-order path enters that cart from the landing page instead.
+    const emptyEntry = visibleCount === 0 && totalVisibleCount === 0
+      ? await Promise.all([
+        browserPage.evaluate(() => (typeof window.next?.getCartCount === "function" ? window.next.getCartCount() : null)),
+        browserPage.evaluate(checkoutSelectionSurfaceScript()),
+      ]).then(
+        ([cart_count, selection_surface]) => ({ cart_count, selection_surface }),
+        // A failed probe leaves the row failed, and says why on the row.
+        (error) => ({ probe_error: trim(error?.message || String(error)).slice(0, 200) }),
+      )
+      : null;
+    return [checkoutPriceVisibilityAssertion({ page, selectors, visibleCount, totalSelectors, totalVisibleCount, emptyEntry })];
   }
   return [];
 }
@@ -2896,25 +2923,37 @@ function upsellPriceVisibilityAssertion({ page, selectors, visibleCount }) {
 // no `totalSelectors` ran the bundle-row check alone, and the row says so
 // rather than reporting an empty selector list that reads like a check that
 // ran and found nothing.
-function checkoutPriceVisibilityAssertion({ page, selectors, visibleCount, totalSelectors, totalVisibleCount = 0 }) {
+//
+// `emptyEntry` ({ cart_count, selection_surface }, or { probe_error }) is read
+// only when nothing priced is visible. An empty SDK cart (cart_count 0, never
+// null: null means no SDK was read) on a checkout with no package selection of
+// its own is not a price the shopper fails to see: the row is skipped with
+// that reason rather than failed, and only that row carries the probe values.
+function checkoutPriceVisibilityAssertion({ page, selectors, visibleCount, totalSelectors, totalVisibleCount = 0, emptyEntry = null }) {
   const totalChecked = Array.isArray(totalSelectors);
   const ok = visibleCount >= 1 || (totalChecked && totalVisibleCount >= 1);
+  const enteredUpstream = !ok && emptyEntry?.cart_count === 0 && emptyEntry?.selection_surface?.count === 0;
+  const counts = totalChecked
+    ? `${visibleCount} visible price row(s); ${totalVisibleCount} visible cart-summary total(s)`
+    : `${visibleCount} visible price row(s)`;
   return assertion({
     id: "pricing.checkout_price_visible",
     family: "pricing",
     page,
-    status: ok ? STATUS.PASS : STATUS.FAIL,
-    severity: ok ? undefined : SEVERITY.WARN,
+    status: ok ? STATUS.PASS : enteredUpstream ? STATUS.SKIPPED : STATUS.FAIL,
+    severity: ok || enteredUpstream ? undefined : SEVERITY.WARN,
     expected: totalChecked
       ? "at least one visible checkout bundle price row or a visible cart-summary total"
       : "at least one visible checkout bundle price row",
-    actual: totalChecked
-      ? `${visibleCount} visible price row(s); ${totalVisibleCount} visible cart-summary total(s)`
-      : `${visibleCount} visible price row(s)`,
+    actual: enteredUpstream
+      ? `${counts}: opened directly, the checkout has an empty cart and no package selection of its own; its cart is filled on an earlier page, and the test order enters it from there`
+      : counts,
     evidence: {
       selectors,
       visible_count: visibleCount,
       ...(totalChecked ? { total_selectors: totalSelectors, total_visible_count: totalVisibleCount } : {}),
+      ...(enteredUpstream ? { cart_count: emptyEntry.cart_count, checkout_selection_surface: emptyEntry.selection_surface } : {}),
+      ...(emptyEntry?.probe_error ? { empty_cart_probe_error: emptyEntry.probe_error } : {}),
       page_url: page.url,
     },
   });
@@ -4962,10 +5001,7 @@ async function waitForCheckoutResult(page, events = null) {
     if (outcomeUrl.test(String(safePageUrl(page) || ""))) break;
     if (events) {
       const rejected = rejectedOrderCreateResponse(events);
-      if (rejected) {
-        const detail = typeof rejected.body?.detail === "string" ? `: ${trim(rejected.body.detail)}` : "";
-        throw new Error(`order create rejected: HTTP ${rejected.status}${detail}`);
-      }
+      if (rejected) throw new Error(orderCreateRejectionMessage(rejected));
       const failed = failedOrderCreateRequest(events);
       if (failed) throw new Error(`order create request failed: ${failed.failure || "network failure"}`);
     }
@@ -4979,6 +5015,23 @@ async function waitForCheckoutResult(page, events = null) {
 // The MOST RECENT create response decides the outcome: SDKs/platforms retry
 // transient create failures, so [..., 400, 201] means the retry succeeded and
 // the earlier rejection is history, not the result.
+// The platform refuses an order whose customer, items and total match one it
+// accepted or is still processing in the last 30 minutes, and reports it in
+// `payment_details`. QA reuses one test customer, so two runs against the same
+// campaign at once, or a rerun after an attempt that died mid-submit, trip it.
+const DUPLICATE_ORDER_PATTERN = /duplicate order/i;
+const DUPLICATE_ORDER_REMEDY =
+  "duplicate_order: the platform refused an order matching a recent one from the same test customer with the same items and total, " +
+  "for up to 30 minutes. Concurrent QA runs that share a test customer collide. Re-run with a different --test-email-prefix " +
+  "(or --test-email), or wait. The shipping address is not part of the match";
+
+function orderCreateRejectionMessage(rejected) {
+  const body = rejected?.body;
+  const reason = [body?.detail, body?.payment_details].find((value) => typeof value === "string" && value.trim());
+  const base = `order create rejected: HTTP ${rejected?.status}${reason ? `: ${trim(reason)}` : ""}`;
+  return reason && DUPLICATE_ORDER_PATTERN.test(reason) ? `${base} (${DUPLICATE_ORDER_REMEDY})` : base;
+}
+
 function rejectedOrderCreateResponse(events) {
   for (let index = events.responses.length - 1; index >= 0; index -= 1) {
     const response = events.responses[index];
@@ -5444,6 +5497,22 @@ function reconcileOrderAgainstDisplay({ lines = [], display = null, events = nul
   const displayed = new Set(resolved.displayed_package_ids);
   const summaryIds = new Set(resolved.summary_package_ids);
   const matchedSummaryIds = new Set();
+  // A checkout order bump persists with is_upsell: true (the platform's
+  // reporting tag), yet the checkout summary displays it. Such a line charges
+  // a displayed row; an is_upsell line the summary does not show is a
+  // post-purchase upsell, out of scope here, never a stray charge.
+  let bumpLineCount = 0;
+  for (const line of (lines || []).filter((entry) => entry?.is_upsell)) {
+    const resolution = events ? campaignPackageResolutionForLine(events, line, {
+      selected_packages,
+      preferred_refs: resolved.summary_package_ids,
+    }) : null;
+    const ref = resolution?.pkg?.ref_id == null ? null : String(resolution.pkg.ref_id);
+    if (ref && summaryIds.has(ref)) {
+      matchedSummaryIds.add(ref);
+      bumpLineCount += 1;
+    }
+  }
   const extra = [];
   const unresolved = [];
   const matchedQuantities = [];
@@ -5491,6 +5560,7 @@ function reconcileOrderAgainstDisplay({ lines = [], display = null, events = nul
     displayed_package_ids: [...displayed],
     summary_package_ids: [...summaryIds],
     non_upsell_line_count: nonUpsellLines.length,
+    ...(bumpLineCount ? { order_bump_line_count: bumpLineCount } : {}),
     extra,
     missing,
     matched_quantities: matchedQuantities,
@@ -5560,7 +5630,7 @@ function orderDisplayParityAssertion(page, planIdentifier, order) {
     return assertion({
       ...base,
       status: STATUS.PASS,
-      actual: `${reconciliation.non_upsell_line_count} non-upsell line(s) reconciled against ${reconciliation.summary_package_ids.length} displayed package(s)`,
+      actual: `${reconciliation.non_upsell_line_count} non-upsell line(s)${reconciliation.order_bump_line_count ? ` and ${reconciliation.order_bump_line_count} order bump line(s)` : ""} reconciled against ${reconciliation.summary_package_ids.length} displayed package(s)`,
       evidence: reconciliation,
     });
   }
@@ -6393,7 +6463,7 @@ function sanitizedEvents(events) {
     responses: events.responses.slice(-20).map((response) => ({
       status: response.status,
       url: response.url,
-      body: summarizeResponseBody(response.body),
+      body: summarizeResponseBody(response.body, { status: response.status }),
     })),
     failed: events.failed.slice(-20),
     console: events.console.slice(-20),
@@ -6420,7 +6490,7 @@ function summarizeRequestPostData(value) {
   }
 }
 
-function summarizeResponseBody(body) {
+function summarizeResponseBody(body, { status = null } = {}) {
   if (typeof body === "string") return trim(body).slice(0, 1000);
   if (!body || typeof body !== "object" || Array.isArray(body)) return body;
   return {
@@ -6432,6 +6502,12 @@ function summarizeResponseBody(body) {
     ...(body.checkout_url ? { checkout_url: body.checkout_url } : {}),
     ...(Array.isArray(body.lines) ? { lines: extractReceiptLines(body) } : {}),
     ...(body.detail ? { detail: body.detail } : {}),
+    // A rejected request names its reason here (for example the
+    // duplicate-order refusal). Kept only on an error response, so a
+    // successful create never carries payment_details into evidence.
+    ...(Number(status) >= 400 && typeof body.payment_details === "string"
+      ? { payment_details: trim(body.payment_details).slice(0, 300) }
+      : {}),
   };
 }
 
@@ -7789,6 +7865,8 @@ export const __qaBrowserTestHooks = Object.freeze({
   linePriceDeltaEvidence,
   packageMatchesLine,
   rejectedOrderCreateResponse,
+  orderCreateRejectionMessage,
+  summarizeResponseBody,
   failedOrderCreateRequest,
   extractOrderVouchers,
   orderDiscountTotal,

package/src/qa-node.mjs

@@ -1,4 +1,5 @@
 import { campaignSpecIdentity, resolveCampaignIdentity, campaignIdentitiesMatch } from "./spec-source-identity.mjs";
+import { applyLocalPreviewToCheckpoint, applyLocalPreviewToPolishGate, carriedForwardMessage, CARRIED_FORWARD, starterResidueIsExpected } from "./local-preview-policy.mjs";
 import { expectedBinding, createBindingScriptLoader, observeBinding, bindingAssertion, scriptParseAssertion } from './qa-binding-evidence.mjs';
 import { shellToken } from "./shell-token.mjs";
 import { applyQaBuildScope, specForQaScope } from "./qa-build-scope.mjs";
@@ -481,6 +482,8 @@ async function resolveQaInputs(args, {
     packetPath,
     report: checkpointPreflight?.runtimeReport,
     hiddenEagerMediaGate,
+    packet,
+    baseUrl: stringArg(args["base-url"]),
   });
   const qaWaivers = resolveQaWaivers({ packetPath, report: checkpointPreflight?.runtimeReport });
   const qaScope = applyQaBuildScope(topologies, {
@@ -593,7 +596,10 @@ function resolvePacketCheckpointPreflight(args, {
       waivers: report?.waivers,
       required: true,
     }),
-    evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report }),
+    applyLocalPreviewToCheckpoint(
+      evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report }),
+      { packet, report, baseUrl: stringArg(args["base-url"]) },
+    ),
   ];
   const runtimeReport = reportMatchesPacketIdentity(report, packet) ? report : null;
   return {
@@ -692,6 +698,8 @@ function resolvedFromBlockedCheckpointPreflight(preflight, args) {
     packetPath: preflight.packetPath,
     report: preflight.runtimeReport,
     hiddenEagerMediaGate,
+    packet: preflight.packet,
+    baseUrl: stringArg(args["base-url"]),
   });
   return {
     themeGate,
@@ -931,16 +939,18 @@ function resolvePolishGate({
   packetPath,
   report: reportOverride = undefined,
   hiddenEagerMediaGate = undefined,
+  packet = null,
+  baseUrl = null,
 }) {
   const report = reportOverride === undefined
     ? loadRuntimeArtifact(packetPath, "assembly-report.json")
     : reportOverride;
-  const gate = evaluatePolishGate({
+  const gate = applyLocalPreviewToPolishGate(evaluatePolishGate({
     report,
     required: true,
     hiddenEagerMediaGate,
     currentOutputFingerprint: currentBuiltOutputFingerprint(packetPath),
-  });
+  }), { packet, checkpointGate: hiddenEagerMediaGate, baseUrl });
   gate.scope_source = report ? "assembly_report" : "missing_assembly_report";
   return gate;
 }
@@ -1044,6 +1054,18 @@ function polishGateAssertion(gate) {
       },
     });
   }
+  if (gate.status === CARRIED_FORWARD) {
+    return assertion({
+      id: gate.code,
+      family: "polish_gate",
+      page,
+      status: STATUS.WARN,
+      severity: SEVERITY.WARN,
+      expected: "current structured Polish evidence produced by next-campaigns-polish",
+      actual: carriedForwardMessage(gate),
+      evidence: { ...evidence, reason: gate.reason, carried_forward: gate.carried_forward },
+    });
+  }
   if (gate.status === "not_applicable") {
     return assertion({
       id: gate.code,
@@ -1350,6 +1372,9 @@ function hiddenEagerMediaGateAssertion(gate) {
   if (summary.status === "waived") {
     return assertion({ ...common, status: STATUS.WARN, severity: SEVERITY.WARN, waiver: summary.waiver });
   }
+  if (summary.status === CARRIED_FORWARD) {
+    return assertion({ ...common, status: STATUS.WARN, severity: SEVERITY.WARN, actual: `${summary.code}: ${carriedForwardMessage(summary)}` });
+  }
   if (summary.status === "not_applicable") {
     return assertion({ ...common, status: STATUS.SKIPPED });
   }
@@ -2304,11 +2329,23 @@ async function runResolvedQa(args, resolved, { runSessionActive = false, liveCam
     });
   assertions.push(...liveCampaignRefAssertions({ pages: [...livePages.values()], spec: liveSpec, liveCampaign: liveRead }));
   if (args.browser === true) {
-    assertions.push(...await runBrowserChecks(resolved.topologies, args, {
+    const browserAssertions = await runBrowserChecks(resolved.topologies, args, {
       brandContract: resolved.brandContract,
-      residueSeverity: residueSeverityForThemeGate(gate.status),
+      // With no generatable brand theme on the local preview, the starter
+      // template is the design: its residue is a warning (local-preview-policy.mjs).
+      residueSeverity: starterResidueIsExpected(gate, { packet: resolved.packet, baseUrl: resolved.baseUrl })
+        ? SEVERITY.WARN
+        : residueSeverityForThemeGate(gate.status),
       supportedPaymentMethods: supportedPaymentMethodsFromSpec(resolved.spec),
-    }));
+      bindingExpected,
+    });
+    // A page-binding row from the browser is the key the SDK actually sent;
+    // it takes the place of that page's static read.
+    for (const observed of browserAssertions) {
+      const at = observed.id.startsWith("page-binding:") ? assertions.findIndex((entry) => entry.id === observed.id) : -1;
+      if (at >= 0) assertions[at] = observed;
+      else assertions.push(observed);
+    }
   }
 
   const testOrders = await runAnalyticsOrderSequence({ args, resolved, runId, assertions });