@nextcommerce/campaigns-os 1.48.0 → 1.52.0

package/src/qa-browser.mjs

@@ -12,7 +12,10 @@ import {
 } from "./qa-analytics-errors.mjs";
 import { attachAnalyticsCapture, diffAnalyticsParity } from "./qa-analytics-parity.mjs";
 import { assessAnalyticsInventory } from "./qa-analytics-correctness.mjs";
-import { redactUrlQuery } from "./qa-url-privacy.mjs";
+import { redactPersisted, redactUrlQueriesInText, redactUrlQuery } from "./qa-url-privacy.mjs";
+import { TRACKING_ADDED_BOUND_MS, TRACKING_OBSERVATION, createTrackingRun, trackingQaAssertion } from "./qa-tracking-params.mjs";
+import { runContentParamChecks } from "./qa-content-params.mjs";
+import { createPolicyLinkBudget, hasPolicyLinkFields, readPageAnchors, runPolicyLinkChecks } from "./qa-policy-links.mjs";
 import {
   canonicalHttpUrl,
   commonTestOrderPaths,
@@ -44,7 +47,8 @@ import {
 } from "./qa-cart-entry.mjs";
 import { ORDER_BUMP_PROBE_INPUT, orderBumpEvidenceScript } from "./qa-order-bump.mjs";
 import { assessPurchaseDataLayer, expectedOrderReferences, purchaseDataLayerAssertion, purchaseDataLayerProbe } from "./qa-purchase-data-layer.mjs";
-import { isBumpRow } from "./commercial-journey.mjs";
+import { declaredOrderBumps, declaredSelectorTiers } from "./commercial-journey.mjs";
+import { bindingAssertion, isSdkApiRequest, sentBinding } from "./qa-binding-evidence.mjs";
 import {
   RESIDUE_PAGE_TYPES,
   demoAssetConfig,
@@ -117,18 +121,45 @@ const CART_CREATE_RESPONSE_PATTERN = /\/api\/v1\/carts\/?(?:[?#].*)?$/i;
 
 export async function runBrowserChecks(topologies, args = {}, options = {}) {
   const browser = await launchChromium(args);
-  const context = await browser.newContext({
+  const contextOptions = {
     viewport: viewportFromArgs(args),
     extraHTTPHeaders: args["auth-cookie"] ? { Cookie: String(args["auth-cookie"]) } : undefined,
-  });
+  };
+  const context = await browser.newContext(contextOptions);
 
   try {
     const assertions = [];
+    // Policy links (options.spec campaign.store_*): one {read, anchors} entry
+    // per page visit, filled by the page checks, and the one run budget every
+    // anchor read and the probes draw on.
+    const policyLinks = Array.isArray(options.qcResults) && hasPolicyLinkFields(options.spec) ? { pages: [], budget: createPolicyLinkBudget() } : null;
     for (const topology of topologies) {
       for (const page of topology.pages) {
-        assertions.push(...await runPageBrowserChecks(context, page, args, options));
+        assertions.push(...await runPageBrowserChecks(context, page, args, options, policyLinks));
       }
     }
+    // Content parameters (options.spec analytics.params.content), after the
+    // page checks: every load in its own fresh context with the same options,
+    // closed after the load. The rows go to options.qcResults; their verdict
+    // assertions join the page checks'.
+    if (Array.isArray(options.qcResults)) {
+      const contentParams = await runContentParamChecks({
+        topologies,
+        spec: options.spec,
+        newContext: () => browser.newContext(contextOptions),
+        withQueryParam,
+      });
+      options.qcResults.push(...contentParams.rows);
+      assertions.push(...contentParams.assertions);
+    }
+    // Policy links, after the page checks: presence from the anchors each
+    // visit read, availability from one header-only probe per distinct
+    // configured URL.
+    if (policyLinks) {
+      const policyLinkResults = await runPolicyLinkChecks({ spec: options.spec, pages: policyLinks.pages, budget: policyLinks.budget });
+      options.qcResults.push(...policyLinkResults.rows);
+      assertions.push(...policyLinkResults.assertions);
+    }
     return assertions;
   } finally {
     await context.close().catch(() => {});
@@ -164,6 +195,10 @@ export async function runBrowserTestOrders(topologies, args = {}, runId = "local
   const orderPathPlan = isCommonTestOrderMode(args["test-order"]) ? commonOrderPathPlan(topologies, args) : null;
   if (orderPathPlan) (options.warn || ((line) => process.stderr.write(`${line}\n`)))(describeCommonOrderPathPlan(orderPathPlan));
   const creationBudget = createOrderCreationBudget({ plans, args });
+  // Synthetic tracking seeds for this run's attempts (options.spec carries
+  // analytics.params.tracking.preserve; trackingTestHooks is an in-process
+  // test seam only).
+  const tracking = createTrackingRun({ runId, spec: options.spec || null, hooks: options.trackingTestHooks || null });
 
   const browser = await launchChromium(args);
   const context = await browser.newContext({
@@ -180,13 +215,18 @@ export async function runBrowserTestOrders(topologies, args = {}, runId = "local
       runId,
       // The topologies travel with the options so each attempt can resolve the
       // funnel's cart-entry page for the checkout it drives (campaigns-os#206).
-      options: { ...options, creationBudget, topologies, orderPathPlan },
+      options: { ...options, creationBudget, topologies, orderPathPlan, tracking },
     });
     return {
-      orders: dispatched.orders,
-      assertions: dispatched.assertions,
+      // The persisted exit: order URLs leave as origin+path. The in-memory
+      // orders stay raw, because recovery reloads the recorded receipt URL.
+      // Assertions and QC rows leave through the one persisted projection,
+      // so each qc.* assertion and its QC row stay identical.
+      orders: dispatched.orders.map(persistedTestOrder),
+      assertions: dispatched.assertions.map(redactPersisted),
       receiptAnalytics: dispatched.receiptAnalytics,
       journeyAnalytics: dispatched.journeyAnalytics,
+      qc_results: (dispatched.qcResults || []).map(redactPersisted),
     };
   } finally {
     await context.close().catch(() => {});
@@ -220,6 +260,7 @@ async function dispatchTestOrderPlans({ context, plans, checkoutPage, args = {},
 
   const assertions = [];
   const orders = [];
+  const qcResults = [];
   // The plan behind each entry in `orders`, index for index, so the upsell
   // coverage row can tell which funnel an order ran through.
   const orderPlans = [];
@@ -386,6 +427,19 @@ async function dispatchTestOrderPlans({ context, plans, checkoutPage, args = {},
       if (renderedReceiptAssertion) assertions.push(renderedReceiptAssertion);
       const dataLayerAssertion = purchaseDataLayerAssertion(pageForPlan, identifier, result.order);
       if (dataLayerAssertion) assertions.push(dataLayerAssertion);
+      // Tracking parameter rows for this plan. They never decide the order's
+      // own assertion, and a failure here never breaks the run.
+      try {
+        const trackingRows = options.tracking
+          ? options.tracking.rowsFor({ attempts: attemptsForPlan, recoveredAttempt: creationRecord?.action === "recovered" ? firstAttempt : null })
+          : [];
+        for (const row of trackingRows) {
+          qcResults.push(row);
+          assertions.push(trackingQaAssertion(row));
+        }
+      } catch {
+        // No row is recorded; the QC handoff lists the check as not captured.
+      }
     }
   } catch (error) {
     // Convert runner-level surprises into a blocker assertion so the run still
@@ -411,7 +465,7 @@ async function dispatchTestOrderPlans({ context, plans, checkoutPage, args = {},
   });
   if (coverage) assertions.push(coverage);
 
-  return { orders, assertions, receiptAnalytics, journeyAnalytics, creationBudget };
+  return { orders, assertions, receiptAnalytics, journeyAnalytics, creationBudget, qcResults };
 }
 
 // Analytics-parity leg: capture the live dataLayer event stream + GTM/pixel
@@ -929,8 +983,11 @@ export async function captureAnalyticsForUrls(urls = {}, args = {}) {
   }
 }
 
-async function runPageBrowserChecks(context, page, args, options = {}) {
+async function runPageBrowserChecks(context, page, args, options = {}, policyLinks = null) {
   const assertions = [];
+  // This visit's policy link read; it stays unread unless its anchors are read.
+  const policyLinkRead = { read: false, anchors: null };
+  policyLinks?.pages.push(policyLinkRead);
   if (!page.url) {
     assertions.push(assertion({
       id: `browser-load:${page.page_id}`,
@@ -962,6 +1019,14 @@ async function runPageBrowserChecks(context, page, args, options = {}) {
       failure: request.failure()?.errorText || "request failed",
     });
   });
+  // The key each SDK request carried. It stays in this function: sentBinding
+  // keeps only whether it matched.
+  const sentKeys = [];
+  const keyReads = [];
+  browserPage.on("request", (request) => {
+    if (!isSdkApiRequest(request.url())) return;
+    keyReads.push(request.headerValue("authorization").then((value) => { if (value !== null) sentKeys.push(value); }, () => {}));
+  });
 
   // Measurements describe the existing sequence; readiness never shortens it.
   const observationStarted = performance.now();
@@ -974,6 +1039,12 @@ async function runPageBrowserChecks(context, page, args, options = {}) {
     await browserPage.waitForLoadState("networkidle", { timeout: DEFAULT_SETTLE_TIMEOUT_MS }).catch(() => {});
     observation.settle_ms = elapsedMilliseconds(settleStarted);
     const status = response?.status() ?? null;
+    // One read of the rendered anchors, from an isolated world. A page that
+    // was not served is not read.
+    if (policyLinks && !(status && status >= 400)) {
+      const anchors = await readPageAnchors(context, browserPage, { spec: options.spec, budget: policyLinks.budget });
+      if (anchors) Object.assign(policyLinkRead, { read: true, anchors });
+    }
     const title = await browserPage.title().catch(() => "");
     const bodyPresent = await browserPage.locator("body").count().then((count) => count > 0).catch(() => false);
 
@@ -1017,6 +1088,9 @@ async function runPageBrowserChecks(context, page, args, options = {}) {
       assertions.push(runtimeIssueAssertion(page, "browser-console-errors", actionableConsoleErrors));
     }
     observation.failed_requests_sampled_after_ms = elapsedMilliseconds(observationStarted);
+    await Promise.all(keyReads);
+    const sent = sentBinding(sentKeys, options.bindingExpected);
+    if (sent) assertions.push(bindingAssertion(page, sent));
     if (failedRequests.length) {
       assertions.push(assertion({
         id: `browser-request-failures:${page.page_id}`,
@@ -3481,6 +3555,12 @@ async function runSingleBrowserTestOrder(context, checkoutPage, plan, args, runI
   let events = { requests: [], responses: [], failed: [], console: [], pageErrors: [] };
   const email = testEmail(planArgs);
   const entryPage = resolveCartEntryPage(options.topologies, checkoutPage);
+  let tracking = null;
+  try {
+    tracking = options.tracking ? options.tracking.observe(planId(normalizedPlan)) : null;
+  } catch {
+    tracking = null;
+  }
   // Reserved immediately before the submit click, never reconciled afterwards:
   // an accounting check that runs after the purchase is not a budget. The same
   // call records that this attempt did submit, which is what lets a later
@@ -3555,6 +3635,13 @@ async function runSingleBrowserTestOrder(context, checkoutPage, plan, args, runI
       // hand. Everything the result carries onwards has been through
       // `sanitizedEvents`, which keeps the last 20 entries per stream.
       result.order_creates = summarizeOrderCreateActivity(events);
+      if (tracking) {
+        try {
+          result[TRACKING_OBSERVATION] = await tracking.finalize({ createActivity: result.order_creates });
+        } catch {
+          // The attempt gets no tracking rows; the order result is unchanged.
+        }
+      }
     }
     return stampTestOrderPlan(result, normalizedPlan);
   };
@@ -3576,7 +3663,7 @@ async function runSingleBrowserTestOrder(context, checkoutPage, plan, args, runI
       }
     }
     page.setDefaultTimeout(numberArg(planArgs["browser-timeout"], DEFAULT_BROWSER_TIMEOUT_MS));
-    events = captureCheckoutEvents(page);
+    events = captureCheckoutEvents(page, tracking);
     // The outer race is the hard guarantee: whatever hangs inside the path,
     // this returns and the run writes a verdict instead of dying with nothing.
     orderDeadline = Date.now() + orderTimeoutMs;
@@ -3594,6 +3681,7 @@ async function runSingleBrowserTestOrder(context, checkoutPage, plan, args, runI
         deadline: orderDeadline,
         reserveOrderCreation,
         selectorProbeCache: options.selectorProbeCache,
+        tracking,
       }),
       orderTimeoutMs + ORDER_TIMEOUT_GRACE_MS,
       `order-path:${planId(normalizedPlan)}`,
@@ -3672,7 +3760,7 @@ function stablePrivateCaptureError(value) {
   return projectAnalyticsCaptureError(value, { fallbackKind: "unreadable" });
 }
 
-async function executeTestOrderPath({ page, events, email, ladder, checkoutPage, entryPage = null, topologyPlan, path, args, deadline, reserveOrderCreation = null, selectorProbeCache = null }) {
+async function executeTestOrderPath({ page, events, email, ladder, checkoutPage, entryPage = null, topologyPlan, path, args, deadline, reserveOrderCreation = null, selectorProbeCache = null, tracking = null }) {
   const stepTimeoutMs = numberArg(args["step-timeout-ms"], DEFAULT_STEP_TIMEOUT_MS);
   const budget = () => Math.min(stepTimeoutMs, deadline - Date.now());
   const hostedNow = () => hostedRedirectInfo(safePageUrl(page), checkoutPage.url);
@@ -3692,7 +3780,7 @@ async function executeTestOrderPath({ page, events, email, ladder, checkoutPage,
   // page the probe left there rather than loading the same URL a second time,
   // which would fire the SDK's page-view events twice into the same capture.
   const entry = await ladder.run(CART_ENTRY_STEP, () => enterCartViaLanding({
-    page, checkoutPage, entryPage, selectedPackages, args, budget, selectorProbeCache,
+    page, checkoutPage, entryPage, selectedPackages, args, budget, selectorProbeCache, tracking,
   }), { timeoutMs: budget() });
   const enteredViaLanding = Boolean(entry && typeof entry === "object" && entry.entered);
   // Responses captured from here on belong to the checkout the ladder drives.
@@ -3700,7 +3788,7 @@ async function executeTestOrderPath({ page, events, email, ladder, checkoutPage,
   // made before the hand-off.
   const checkoutResponseOffset = events.responses.length;
 
-  await ladder.run("opened_checkout", () => openCheckoutForPath({ page, checkoutPage, entry, args }), { timeoutMs: budget() });
+  await ladder.run("opened_checkout", () => openCheckoutForPath({ page, checkoutPage, entry, args, tracking }), { timeoutMs: budget() });
   await ladder.run("selected_bundle", async () => {
     // The requested package was selected on the entry page, where the cards
     // live; checkout renders none, so re-running strict selection here would
@@ -3753,6 +3841,9 @@ async function executeTestOrderPath({ page, events, email, ladder, checkoutPage,
       // runs BEFORE the reservation: nothing is clicked, nothing is spent, and
       // the classifier reads the failure as `not_created`.
       cartBeforeSubmit = await cartStateBeforeSubmit(page, events, { responseOffset: checkoutResponseOffset, budget });
+      // The checkout's declared tags and inline page script, read after the
+      // SDK is ready (bounded; never throws).
+      await tracking?.readDocument(page);
       if (cartBeforeSubmit.empty) {
         throw codedError(CART_ENTRY_CODES.CART_EMPTY_BEFORE_SUBMIT, cartEmptyMessage(cartBeforeSubmit));
       }
@@ -3982,7 +4073,7 @@ function createSelectorProbeCache() {
 // loaded it and found a selection surface; either way a second load of the
 // same URL is what is avoided. Anywhere else (a cached probe answer skipped the
 // load; a fresh page) the checkout is opened here, once.
-async function openCheckoutForPath({ page, checkoutPage, entry, args }) {
+async function openCheckoutForPath({ page, checkoutPage, entry, args, tracking = null }) {
   const enteredViaLanding = Boolean(entry && typeof entry === "object" && entry.entered);
   if (enteredViaLanding) {
     await page.waitForLoadState("networkidle", { timeout: DEFAULT_SETTLE_TIMEOUT_MS }).catch(() => {});
@@ -3991,14 +4082,14 @@ async function openCheckoutForPath({ page, checkoutPage, entry, args }) {
   if (checkoutUrlPredicate(checkoutPage.url)(safePageUrl(page))) {
     return "already on checkout from the selector probe; not re-opened";
   }
-  await gotoAndSettle(page, checkoutPage.url, args);
+  await gotoAndSettle(page, checkoutPage.url, args, tracking);
   return null;
 }
 
 // The entry step body. Resolves to `{ skip }` when the checkout selects for
 // itself, to `{ entered: true, ... }` when the runner came in through the entry
 // page, and throws a coded error (never a bare timeout) when it cannot.
-async function enterCartViaLanding({ page, checkoutPage, entryPage, selectedPackages, args, budget, selectorProbeCache = null }) {
+async function enterCartViaLanding({ page, checkoutPage, entryPage, selectedPackages, args, budget, selectorProbeCache = null, tracking = null }) {
   // Probe the checkout first: whether it carries a selection surface is a fact
   // about the rendered page, not about the spec (the spec cannot say it yet —
   // that is the design half of #206). The probe's load is the checkout's only
@@ -4015,7 +4106,7 @@ async function enterCartViaLanding({ page, checkoutPage, entryPage, selectedPack
   let probe = cached ? "reused" : "loaded";
   let probeError = null;
   if (!surface) {
-    await gotoAndSettle(page, checkoutPage.url, args);
+    await gotoAndSettle(page, checkoutPage.url, args, tracking);
     const probed = await page.evaluate(checkoutSelectionSurfaceScript())
       .then((value) => ({ value }), (error) => ({ value: null, error: error?.message || String(error) }));
     if (probed.value) {
@@ -4041,8 +4132,9 @@ async function enterCartViaLanding({ page, checkoutPage, entryPage, selectedPack
     );
   }
 
-  await gotoAndSettle(page, entryPage.url, args);
+  await gotoAndSettle(page, entryPage.url, args, tracking);
   const sdkReady = await waitForSdkReady(page, Math.min(budget(), DEFAULT_SETTLE_TIMEOUT_MS));
+  await tracking?.readDocument(page);
   const controls = await page.evaluate(cartEntryControlsScript(), { selector: CART_ENTRY_CONTROL_SELECTOR, checkoutUrl: checkoutPage.url }).catch(() => []);
   const choice = chooseCartEntryControl(controls, selectedPackages);
   if (!choice.control) {
@@ -4336,8 +4428,11 @@ function assessReceiptRendering(persistedLineCount, evidence = {}) {
   };
 }
 
-async function gotoAndSettle(page, url, args) {
-  await page.goto(url, { waitUntil: "domcontentloaded", timeout: numberArg(args["browser-timeout"], DEFAULT_BROWSER_TIMEOUT_MS) });
+// With a tracking observer, the load is a runner navigation: before the
+// attempt's first page-initiated hop it carries the run's synthetic seeds.
+async function gotoAndSettle(page, url, args, tracking = null) {
+  const target = tracking ? tracking.runnerUrl(url, withQueryParam) : url;
+  await page.goto(target, { waitUntil: "domcontentloaded", timeout: numberArg(args["browser-timeout"], DEFAULT_BROWSER_TIMEOUT_MS) });
   await page.waitForLoadState("networkidle", { timeout: DEFAULT_SETTLE_TIMEOUT_MS }).catch(() => {});
   await page.waitForTimeout(750);
 }
@@ -5207,11 +5302,30 @@ async function clickControl(locator, { timeout, forceFallback = true, perpetual
   }
 }
 
+// The control a shopper would click. A page may keep the SDK action hidden in
+// the offer and show a data-upsell-proxy button elsewhere that forwards its
+// click to it (the starter templates' closing-card decline on a box-style
+// single offer). Clicking the hidden action fails as not visible, so the
+// visible proxy is clicked instead, but only while the offer holds an SDK action
+// for it to forward to: otherwise the hidden action is clicked and fails as before.
+async function shopperUpsellControl(page, action) {
+  const actions = page.locator(`[data-next-upsell-action="${action}"]`);
+  if (!await actions.count().catch(() => 0)) return actions.first();
+  const visibleAction = actions.filter({ visible: true }).first();
+  if (await visibleAction.count().catch(() => 0)) return visibleAction;
+  // The proxy forwards to `[data-next-upsell="offer"] [data-next-upsell-action]`
+  // (upsells.js), so only an action inside the offer is a target.
+  const inOffer = page.locator(`[data-next-upsell="offer"] [data-next-upsell-action="${action}"]`);
+  const proxy = page.locator(`[data-upsell-proxy="${action}"]`).filter({ visible: true }).first();
+  if (await inOffer.count().catch(() => 0) && await proxy.count().catch(() => 0)) return proxy;
+  return actions.first();
+}
+
 async function clickUpsellPath(page, path, { trace = null } = {}) {
   const offerUrl = safePageUrl(page);
   const action = path === "accept" ? "add" : "skip";
   const selector = `[data-next-upsell-action="${action}"]`;
-  const control = page.locator(selector).first();
+  const control = await shopperUpsellControl(page, action);
   if (!await control.count().catch(() => 0)) {
     return { path, clicked: false, error: `Missing upsell control ${selector}` };
   }
@@ -5485,6 +5599,22 @@ function reconcileOrderAgainstDisplay({ lines = [], display = null, events = nul
   const displayed = new Set(resolved.displayed_package_ids);
   const summaryIds = new Set(resolved.summary_package_ids);
   const matchedSummaryIds = new Set();
+  // A checkout order bump persists with is_upsell: true (the platform's
+  // reporting tag), yet the checkout summary displays it. Such a line charges
+  // a displayed row; an is_upsell line the summary does not show is a
+  // post-purchase upsell, out of scope here, never a stray charge.
+  let bumpLineCount = 0;
+  for (const line of (lines || []).filter((entry) => entry?.is_upsell)) {
+    const resolution = events ? campaignPackageResolutionForLine(events, line, {
+      selected_packages,
+      preferred_refs: resolved.summary_package_ids,
+    }) : null;
+    const ref = resolution?.pkg?.ref_id == null ? null : String(resolution.pkg.ref_id);
+    if (ref && summaryIds.has(ref)) {
+      matchedSummaryIds.add(ref);
+      bumpLineCount += 1;
+    }
+  }
   const extra = [];
   const unresolved = [];
   const matchedQuantities = [];
@@ -5532,6 +5662,7 @@ function reconcileOrderAgainstDisplay({ lines = [], display = null, events = nul
     displayed_package_ids: [...displayed],
     summary_package_ids: [...summaryIds],
     non_upsell_line_count: nonUpsellLines.length,
+    ...(bumpLineCount ? { order_bump_line_count: bumpLineCount } : {}),
     extra,
     missing,
     matched_quantities: matchedQuantities,
@@ -5601,7 +5732,7 @@ function orderDisplayParityAssertion(page, planIdentifier, order) {
     return assertion({
       ...base,
       status: STATUS.PASS,
-      actual: `${reconciliation.non_upsell_line_count} non-upsell line(s) reconciled against ${reconciliation.summary_package_ids.length} displayed package(s)`,
+      actual: `${reconciliation.non_upsell_line_count} non-upsell line(s)${reconciliation.order_bump_line_count ? ` and ${reconciliation.order_bump_line_count} order bump line(s)` : ""} reconciled against ${reconciliation.summary_package_ids.length} displayed package(s)`,
       evidence: reconciliation,
     });
   }
@@ -6168,7 +6299,7 @@ function testOrderAssertion(page, plan, result, firstAttempt = null, creationRec
         ...retry,
         ...creation,
         hosted_checkout_url: result.order?.hosted_checkout_url || null,
-        final_url: result.order?.final_url,
+        final_url: redactUrlQuery(result.order?.final_url),
         steps: result.order?.evidence?.steps,
         note: "Hosted checkout flow is platform-owned; verify the hosted completion manually.",
       },
@@ -6215,13 +6346,13 @@ function testOrderAssertion(page, plan, result, firstAttempt = null, creationRec
           ...recovery,
           ref_id: result.order.ref_id,
           order_number: result.order.next_order_id,
-          final_url: result.order.final_url,
+          final_url: redactUrlQuery(result.order.final_url),
           is_test: result.order.is_test,
           line_count: result.order.receipt_line_items.length,
           ...(receiptProofEvidence(result.order) ? { receipt_proof: receiptProofEvidence(result.order) } : {}),
           ...(path === "accept" ? { accepted_upsell_line_present: result.order.verification?.accepted_upsell_line_present } : {}),
           ...(upsellUnverified ? { upsell_unverified: upsellUnverified } : {}),
-          ...(result.order.upsell ? { upsell_clicked: result.order.upsell.clicked, upsell_final_url: result.order.upsell.final_url } : {}),
+          ...(result.order.upsell ? { upsell_clicked: result.order.upsell.clicked, upsell_final_url: redactUrlQuery(result.order.upsell.final_url) } : {}),
           ...(result.order.upsell_steps ? { upsell_steps: result.order.upsell_steps.map(summarizeUpsellStep) } : {}),
           ...(result.order.verification?.accepted_upsell_matches ? { accepted_upsell_matches: result.order.verification.accepted_upsell_matches } : {}),
           ...(result.order.verification?.coupon ? { coupon: result.order.verification.coupon } : {}),
@@ -6232,7 +6363,7 @@ function testOrderAssertion(page, plan, result, firstAttempt = null, creationRec
           ...retry,
           ...creation,
           ...recovery,
-          final_url: result.order?.final_url,
+          final_url: redactUrlQuery(result.order?.final_url),
           steps: result.order?.evidence?.steps,
           ...(receiptProofEvidence(result.order) ? { receipt_proof: receiptProofEvidence(result.order) } : {}),
           ...(result.order?.verification?.coupon ? { coupon: result.order.verification.coupon } : {}),
@@ -6309,11 +6440,20 @@ function responseRequestStartedAt(response) {
   }
 }
 
-function captureCheckoutEvents(page) {
+function captureCheckoutEvents(page, tracking = null) {
   const events = { requests: [], responses: [], failed: [], console: [], pageErrors: [], navigations: [] };
   const interesting = /\/api\/v1\/(?:orders|upsells|carts)\/?|\/transactions|spreedly|campaigns\.apps/i;
+  const isMainFrame = (frame) => typeof page.mainFrame !== "function" || frame === page.mainFrame();
   page.on("request", (request) => {
     if (!interesting.test(request.url())) return;
+    // Tracking equality reads the create body before it is summarized below.
+    if (tracking && ORDER_CREATE_RESPONSE_PATTERN.test(request.url()) && request.method() === "POST") {
+      try {
+        tracking.onCreateRequest(() => request.postData());
+      } catch {
+        // The order is never held up by a tracking read.
+      }
+    }
     events.requests.push({
       method: request.method(),
       url: request.url(),
@@ -6331,15 +6471,47 @@ function captureCheckoutEvents(page) {
     const request = responseRequest(response);
     let chainUrl = null;
     try { chainUrl = request?.url() ?? null; } catch { /* identity only */ }
+    // Tracking: a script the page received is scanned for page-script
+    // attribution calls, and an accepted create marks the post-order point.
+    let orderSource = null;
+    if (tracking) {
+      try {
+        const method = response.request().method();
+        if (response.request().resourceType() === "script") tracking.onScriptResponse(response);
+        if (method === "POST" && ORDER_CREATE_RESPONSE_PATTERN.test(response.url())) {
+          tracking.onCreateResponseStatus(response.status());
+          orderSource = "create_response";
+        } else if (method === "GET" && ORDER_DETAIL_RESPONSE_PATTERN.test(response.url())) {
+          orderSource = "readback";
+        }
+        if (orderSource && !(response.status() >= 200 && response.status() < 300)) orderSource = null;
+      } catch {
+        orderSource = null;
+        try { tracking.onListenerError("response"); } catch { /* never breaks the order */ }
+      }
+    }
     if (!interesting.test(response.url()) && !(chainUrl && interesting.test(chainUrl))) return;
     // Taken before the body read: an entry lands in the log when its body
     // finishes, so its position says nothing about when it was requested.
     const requestStartedAt = responseRequestStartedAt(response);
+    // Equality on the in-memory body, before summarizeResponseBody. For an
+    // order response the observer starts the read itself (through its
+    // observeRead) before anything awaits it, so a body still in flight when
+    // the attempt's observation is taken is a failed extractor there, never a
+    // pass. The log entry awaits that same read.
+    let bodyRead = null;
+    const readBody = () => {
+      bodyRead ??= readJsonResponseBodyWhenLoaded(response);
+      return bodyRead;
+    };
+    if (orderSource) {
+      try { tracking.orderResponseBody(orderSource, readBody); } catch { /* never breaks the order */ }
+    }
     const entry = {
       status: response.status(),
       url: response.url(),
       request_started_at: requestStartedAt,
-      body: await readJsonResponseBodyWhenLoaded(response),
+      body: await readBody(),
     };
     if (request) entry[REQUEST_IDENTITY] = request;
     events.responses.push(entry);
@@ -6356,6 +6528,42 @@ function captureCheckoutEvents(page) {
       // Navigation evidence is diagnostic only; never break the order path.
     }
   });
+  if (tracking) {
+    // Tracking hops: a second listener beside the one above. Whether a hop
+    // committed a new document is read only from the browser itself:
+    // Playwright's main frame emits "navigated" with `newDocument` for a
+    // document commit and without it for a same-document one, synchronously
+    // just before "framenavigated" (pinned against the installed Playwright
+    // in qa-tracking-params-hardening.test.mjs). It is an internal emitter;
+    // where a page has none, every hop reads history. The signal is only held
+    // here and handed to the observer with its hop.
+    let commit = null;
+    try {
+      const emitter = typeof page.mainFrame === "function" ? page.mainFrame()?._eventEmitter : null;
+      if (emitter && typeof emitter.on === "function") {
+        emitter.on("navigated", (event) => {
+          commit = event && !event.error ? { url: String(event.url), newDocument: Boolean(event.newDocument) } : null;
+        });
+      }
+    } catch {
+      // No signal: every hop reads history.
+    }
+    page.on("framenavigated", (frame) => {
+      try {
+        if (!isMainFrame(frame)) return;
+        const signal = commit;
+        commit = null;
+        tracking.onFrameNavigated(frame.url(), signal);
+      } catch {
+        // The observer records the missed hop as a gap.
+        try { tracking.onListenerError("hop"); } catch { /* never breaks the order */ }
+      }
+    });
+    page.on("domcontentloaded", () => {
+      try { tracking.readDocument(page, { awaited: false }); } catch { /* never breaks the order */ }
+    });
+    attachCreateResponseTap(page, tracking);
+  }
   page.on("console", (message) => {
     if (["error", "warning"].includes(message.type())) events.console.push({ type: message.type(), text: trim(message.text()) });
   });
@@ -6363,6 +6571,58 @@ function captureCheckoutEvents(page) {
   return events;
 }
 
+// The order create's response body for the tracking echo, read in memory
+// before the page can leave it: the SDK navigates as soon as the create
+// answers, and a body read after that navigation finds nothing. Only order
+// responses are paused, at the response stage, and every one is continued
+// unchanged; no request is added and nothing is persisted from the body.
+// An accepted create is held at most TRACKING_ADDED_BOUND_MS, whatever the
+// body read does: the observer's read is itself bounded by the attempt's
+// remaining tracking budget (an overrun records the extractor as failed),
+// and the timer here continues the response even if that bound misbehaves.
+function attachCreateResponseTap(page, tracking) {
+  let session = null;
+  const onPaused = (event) => {
+    let continued = false;
+    let timer = null;
+    const proceed = () => {
+      if (continued) return;
+      continued = true;
+      clearTimeout(timer);
+      session.send("Fetch.continueRequest", { requestId: event.requestId }).catch(() => {});
+    };
+    try {
+      const status = Number(event.responseStatusCode);
+      const isAcceptedCreate = event.request?.method === "POST"
+        && ORDER_CREATE_RESPONSE_PATTERN.test(String(event.request?.url || ""))
+        && status >= 200 && status < 300;
+      if (!isAcceptedCreate) {
+        proceed();
+        return;
+      }
+      timer = setTimeout(proceed, TRACKING_ADDED_BOUND_MS);
+      const readBody = () => session.send("Fetch.getResponseBody", { requestId: event.requestId }).then((read) => {
+        const text = read?.base64Encoded ? Buffer.from(String(read.body || ""), "base64").toString("utf8") : read?.body;
+        return parseMaybeJson(redactSensitive(text));
+      });
+      Promise.resolve(tracking.tapCreateResponse(readBody)).catch(() => {}).finally(proceed);
+    } catch {
+      proceed();
+    }
+  };
+  // The session setup is itself a read the observer holds, like every other
+  // asynchronous step that feeds a tracking row.
+  try {
+    return tracking.attachTap(async () => {
+      session = await page.context().newCDPSession(page);
+      session.on("Fetch.requestPaused", onPaused);
+      await session.send("Fetch.enable", { patterns: [{ urlPattern: "*/api/v1/orders*", requestStage: "Response" }] });
+    });
+  } catch {
+    return Promise.resolve();
+  }
+}
+
 // Playwright's response.text() waits for the body to finish loading. A page
 // that navigates away as soon as the headers land (an SDK that reads only the
 // status before redirecting) can leave that wait pending forever. Only a
@@ -6428,21 +6688,24 @@ function lastJsonResponse(events, pattern) {
   return null;
 }
 
+// A persisted exit: every URL is origin+path; bodies are summarized; then
+// every string and key goes through the persisted-value projection.
 function sanitizedEvents(events) {
-  return {
-    requests: events.requests.slice(-20),
+  return redactPersisted({
+    requests: events.requests.slice(-20).map((request) => ({ ...request, url: redactUrlQuery(request.url) })),
     responses: events.responses.slice(-20).map((response) => ({
       status: response.status,
-      url: response.url,
+      url: redactUrlQuery(response.url),
       body: summarizeResponseBody(response.body, { status: response.status }),
     })),
-    failed: events.failed.slice(-20),
-    console: events.console.slice(-20),
-    pageErrors: events.pageErrors.slice(-20),
+    failed: events.failed.slice(-20).map((failure) => ({ ...failure, url: redactUrlQuery(failure.url), failure: redactUrlQueriesInText(failure.failure) })),
+    // Console and page-error text can quote URLs; their queries are dropped.
+    console: events.console.slice(-20).map((entry) => ({ ...entry, text: redactUrlQueriesInText(entry.text) })),
+    pageErrors: events.pageErrors.slice(-20).map((text) => redactUrlQueriesInText(text)),
     navigations: (events.navigations || []).slice(-20).map((navigation) => ({
       url: redactUrlQuery(navigation.url),
     })),
-  };
+  });
 }
 
 function summarizeRequestPostData(value) {
@@ -6461,23 +6724,26 @@ function summarizeRequestPostData(value) {
   }
 }
 
+const RESPONSE_BODY_MARKER = "[redacted-response-body]";
+
 function summarizeResponseBody(body, { status = null } = {}) {
-  if (typeof body === "string") return trim(body).slice(0, 1000);
-  if (!body || typeof body !== "object" || Array.isArray(body)) return body;
+  if (body === null || body === undefined) return null;
+  // Raw body content (text, an array, a bare scalar) is never persisted.
+  if (typeof body !== "object" || Array.isArray(body)) return RESPONSE_BODY_MARKER;
   return {
     ...(body.number ? { number: body.number } : {}),
     ...(body.ref_id ? { ref_id: body.ref_id } : {}),
     ...(body.is_test !== undefined ? { is_test: body.is_test } : {}),
     ...(body.total_incl_tax ? { total_incl_tax: body.total_incl_tax } : {}),
     ...(body.currency ? { currency: body.currency } : {}),
-    ...(body.checkout_url ? { checkout_url: body.checkout_url } : {}),
+    ...(body.checkout_url ? { checkout_url: redactUrlQuery(body.checkout_url) } : {}),
     ...(Array.isArray(body.lines) ? { lines: extractReceiptLines(body) } : {}),
-    ...(body.detail ? { detail: body.detail } : {}),
+    ...(body.detail ? { detail: redactPersisted(body.detail) } : {}),
     // A rejected request names its reason here (for example the
     // duplicate-order refusal). Kept only on an error response, so a
     // successful create never carries payment_details into evidence.
     ...(Number(status) >= 400 && typeof body.payment_details === "string"
-      ? { payment_details: trim(body.payment_details).slice(0, 300) }
+      ? { payment_details: redactUrlQueriesInText(trim(body.payment_details).slice(0, 300)) }
       : {}),
   };
 }
@@ -6721,7 +6987,7 @@ function specTierPlans(topologies, args, variant, { warn = (line) => process.std
     const declaredTiers = declaredSelectorTiers(checkoutPage);
     const bumps = declaredOrderBumps(checkoutPage);
     if (bumps.length) {
-      warn(`[qa:test-order] checkout page "${checkoutPage.page_id || checkoutPage.label || "(unnamed)"}" declares order bump package(s) ${bumps.join(", ")} (is_upsell) — not planned as selector tiers; bump coverage comes from --cart.`);
+      warn(`[qa:test-order] checkout page "${checkoutPage.page_id || checkoutPage.label || "(unnamed)"}" declares order bump package(s) ${bumps.join(", ")} (is_order_bump or is_upsell) — not planned as selector tiers; bump coverage comes from --cart.`);
     }
     for (const tier of declaredTiers) declaredIdentities.add(selectorTierIdentity(tier));
     for (const ref of bumps) bumpRefs.add(ref);
@@ -6801,7 +7067,7 @@ function specTierPlans(topologies, args, variant, { warn = (line) => process.std
     const namedBumps = unmatched.filter((identity) => bumpRefs.has(identity.split(":")[0]));
     throw new Error([
       `--select-package ${unmatched.join(",")}: ${unmatched.length === 1 ? "is not a selector tier" : "are not selector tiers"} the CampaignSpec declares${declaredIdentities.size ? ` (declared tiers: ${[...declaredIdentities].join(", ")}` : " (no tiers declared"}${bumpRefs.size ? `; order bump ref(s) excluded from tiers: ${[...bumpRefs].join(", ")}` : ""}).`,
-      ...(namedBumps.length ? [`${namedBumps.join(",")} ${namedBumps.length === 1 ? "is an order bump (is_upsell)" : "are order bumps (is_upsell)"}, an add-on to a selected tier, not a tier; bump coverage comes from --cart.`] : []),
+      ...(namedBumps.length ? [`${namedBumps.join(",")} ${namedBumps.length === 1 ? "is an order bump (is_order_bump or is_upsell)" : "are order bumps (is_order_bump or is_upsell)"}, an add-on to a selected tier, not a tier; bump coverage comes from --cart.`] : []),
       "Name declared tiers only, as ref or ref:qty, or drop --select-package to iterate every tier.",
     ].join(" "));
   }
@@ -6845,59 +7111,6 @@ function selectorTierNarrowing(value) {
   return identities.length ? new Set(identities) : null;
 }
 
-// Order bumps declared on the checkout page (`is_upsell: true` rows — the
-// same marker the commercial-journey planner reads). They are add-ons to a
-// selected tier, not tiers, so the tier planner reports and skips them.
-function declaredOrderBumps(checkoutPage) {
-  const refs = [];
-  for (const pkg of Array.isArray(checkoutPage?.packages) ? checkoutPage.packages : []) {
-    if (!pkg || typeof pkg !== "object" || !isBumpRow(pkg)) continue;
-    const ref = [pkg.ref_id, pkg.package_id, pkg.id]
-      .map((value) => (value == null ? "" : String(value).trim()))
-      .find(Boolean);
-    if (ref && !refs.includes(ref)) refs.push(ref);
-  }
-  return refs;
-}
-
-// Selector tiers are the packages the spec declares on the checkout page —
-// same ref tolerance as the doctor's specPackageRecords (ref_id/package_id/id).
-// Order-bump rows (`is_upsell: true`) are add-ons offered alongside the
-// selected tier, not tiers of their own: they never become a plan.
-function declaredSelectorTiers(checkoutPage) {
-  const records = [];
-  const quantitiesByRef = new Map();
-  for (const pkg of Array.isArray(checkoutPage?.packages) ? checkoutPage.packages : []) {
-    if (!pkg || typeof pkg !== "object" || isBumpRow(pkg)) continue;
-    const ref = [pkg.ref_id, pkg.package_id, pkg.id]
-      .map((value) => (value == null ? "" : String(value).trim()))
-      .find(Boolean);
-    const declaredQuantity = Number(pkg.qty ?? pkg.quantity ?? 1);
-    if (!ref || !Number.isInteger(declaredQuantity) || declaredQuantity < 1) continue;
-    records.push({ pkg, ref, declaredQuantity });
-    if (!quantitiesByRef.has(ref)) quantitiesByRef.set(ref, new Set());
-    quantitiesByRef.get(ref).add(declaredQuantity);
-  }
-
-  const tiers = [];
-  const seen = new Set();
-  for (const { pkg, ref, declaredQuantity } of records) {
-    // A unique ref is a catalog package bought once, even when that package's
-    // own composition is 3x. Only repeated declarations of the SAME ref at
-    // different quantities express shopper purchase multipliers (Keer 1x/2x).
-    const quantity = quantitiesByRef.get(ref).size > 1 ? declaredQuantity : 1;
-    const identity = `${ref}:${quantity}`;
-    if (seen.has(identity)) continue;
-    seen.add(identity);
-    tiers.push({
-      ref,
-      quantity,
-      declared_by: stringArg(pkg.name) || stringArg(pkg.title) || undefined,
-    });
-  }
-  return tiers;
-}
-
 // Declared coupons follow the repo's offer-surface rule (build-brief, cli
 // exit-pop gates): a surface counts only when `enabled === true` and it maps
 // an offer_code. Both surfaces mapping the same code collapse into one plan.
@@ -7649,7 +7862,7 @@ function summarizeUpsellStep(step) {
   return {
     path: step.path,
     clicked: step.clicked,
-    final_url: step.final_url,
+    final_url: redactUrlQuery(step.final_url),
     expected_items: step.expected_items,
     api_response_seen: step.api_response_seen,
     api_response_status: step.api_response_status,
@@ -7692,6 +7905,30 @@ function withQueryParam(value, key, paramValue) {
   }
 }
 
+// A test order as it is persisted: its URLs as origin+path, an upsell's raw
+// response body as its summary, and no URL query in any string or key (the
+// one persisted-value projection, redactPersisted). The order events were
+// already summarized where they were captured.
+function persistedTestOrder(order) {
+  if (!order || typeof order !== "object") return order;
+  const projected = { ...order };
+  if (Object.hasOwn(order, "checkout_url")) projected.checkout_url = redactUrlQuery(order.checkout_url);
+  if (Object.hasOwn(order, "final_url")) projected.final_url = redactUrlQuery(order.final_url);
+  if (order.upsell && typeof order.upsell === "object") projected.upsell = persistedUpsellStep(order.upsell);
+  if (Array.isArray(order.upsell_steps)) projected.upsell_steps = order.upsell_steps.map(persistedUpsellStep);
+  return redactPersisted(projected);
+}
+
+function persistedUpsellStep(step) {
+  if (!step || typeof step !== "object") return step;
+  const projected = { ...step };
+  for (const field of ["offer_url", "final_url", "api_response_url"]) {
+    if (Object.hasOwn(step, field)) projected[field] = redactUrlQuery(step[field]);
+  }
+  if (Object.hasOwn(step, "api_response_order_body")) projected.api_response_order_body = summarizeResponseBody(step.api_response_order_body);
+  return projected;
+}
+
 function findPage(topologies, type) {
   for (const topology of topologies || []) {
     const page = (topology.pages || []).find((candidate) => candidate.page_type === type);
@@ -7900,6 +8137,10 @@ export const __qaBrowserTestHooks = Object.freeze({
   createOrderCreationBudget,
   dispatchTestOrderPlans,
   recoverCreatedOrder,
+  persistedTestOrder,
+  sanitizedEvents,
+  summarizeResponseBody,
+  attachCreateResponseTap,
   extractReceiptLines,
   EXIT_INTENT_SURFACE_SELECTORS,
   COUPON_INPUT_SELECTORS,