@nextcommerce/campaigns-os 1.50.0 → 1.53.0

package/src/qa-browser.mjs

@@ -6,13 +6,18 @@ const PACKAGE_ROOT = installModeResolve(installModeDirname(installModeFileUrl(im
 import { createHash } from "node:crypto";
 import { runWithDeadline } from "./deadline.mjs";
 import { PLACEHOLDER_TEXT_ASSERTION_SUFFIX, SEVERITY, STATUS } from "./qa-verdict.mjs";
+import { contrastToolkit } from "./contrast.mjs";
+import { generatedTextRenders } from "./polish-readability.mjs";
 import {
   analyticsCaptureError,
   projectAnalyticsCaptureError,
 } from "./qa-analytics-errors.mjs";
 import { attachAnalyticsCapture, diffAnalyticsParity } from "./qa-analytics-parity.mjs";
 import { assessAnalyticsInventory } from "./qa-analytics-correctness.mjs";
-import { redactUrlQuery } from "./qa-url-privacy.mjs";
+import { redactPersisted, redactUrlQueriesInText, redactUrlQuery } from "./qa-url-privacy.mjs";
+import { TRACKING_ADDED_BOUND_MS, TRACKING_OBSERVATION, createTrackingRun, trackingQaAssertion } from "./qa-tracking-params.mjs";
+import { runContentParamChecks } from "./qa-content-params.mjs";
+import { createPolicyLinkBudget, hasPolicyLinkFields, readPageAnchors, runPolicyLinkChecks } from "./qa-policy-links.mjs";
 import {
   canonicalHttpUrl,
   commonTestOrderPaths,
@@ -44,7 +49,7 @@ import {
 } from "./qa-cart-entry.mjs";
 import { ORDER_BUMP_PROBE_INPUT, orderBumpEvidenceScript } from "./qa-order-bump.mjs";
 import { assessPurchaseDataLayer, expectedOrderReferences, purchaseDataLayerAssertion, purchaseDataLayerProbe } from "./qa-purchase-data-layer.mjs";
-import { isBumpRow } from "./commercial-journey.mjs";
+import { declaredOrderBumps, declaredSelectorTiers } from "./commercial-journey.mjs";
 import { bindingAssertion, isSdkApiRequest, sentBinding } from "./qa-binding-evidence.mjs";
 import {
   RESIDUE_PAGE_TYPES,
@@ -118,18 +123,45 @@ const CART_CREATE_RESPONSE_PATTERN = /\/api\/v1\/carts\/?(?:[?#].*)?$/i;
 
 export async function runBrowserChecks(topologies, args = {}, options = {}) {
   const browser = await launchChromium(args);
-  const context = await browser.newContext({
+  const contextOptions = {
     viewport: viewportFromArgs(args),
     extraHTTPHeaders: args["auth-cookie"] ? { Cookie: String(args["auth-cookie"]) } : undefined,
-  });
+  };
+  const context = await browser.newContext(contextOptions);
 
   try {
     const assertions = [];
+    // Policy links (options.spec campaign.store_*): one {read, anchors} entry
+    // per page visit, filled by the page checks, and the one run budget every
+    // anchor read and the probes draw on.
+    const policyLinks = Array.isArray(options.qcResults) && hasPolicyLinkFields(options.spec) ? { pages: [], budget: createPolicyLinkBudget() } : null;
     for (const topology of topologies) {
       for (const page of topology.pages) {
-        assertions.push(...await runPageBrowserChecks(context, page, args, options));
+        assertions.push(...await runPageBrowserChecks(context, page, args, options, policyLinks));
       }
     }
+    // Content parameters (options.spec analytics.params.content), after the
+    // page checks: every load in its own fresh context with the same options,
+    // closed after the load. The rows go to options.qcResults; their verdict
+    // assertions join the page checks'.
+    if (Array.isArray(options.qcResults)) {
+      const contentParams = await runContentParamChecks({
+        topologies,
+        spec: options.spec,
+        newContext: () => browser.newContext(contextOptions),
+        withQueryParam,
+      });
+      options.qcResults.push(...contentParams.rows);
+      assertions.push(...contentParams.assertions);
+    }
+    // Policy links, after the page checks: presence from the anchors each
+    // visit read, availability from one header-only probe per distinct
+    // configured URL.
+    if (policyLinks) {
+      const policyLinkResults = await runPolicyLinkChecks({ spec: options.spec, pages: policyLinks.pages, budget: policyLinks.budget });
+      options.qcResults.push(...policyLinkResults.rows);
+      assertions.push(...policyLinkResults.assertions);
+    }
     return assertions;
   } finally {
     await context.close().catch(() => {});
@@ -165,6 +197,10 @@ export async function runBrowserTestOrders(topologies, args = {}, runId = "local
   const orderPathPlan = isCommonTestOrderMode(args["test-order"]) ? commonOrderPathPlan(topologies, args) : null;
   if (orderPathPlan) (options.warn || ((line) => process.stderr.write(`${line}\n`)))(describeCommonOrderPathPlan(orderPathPlan));
   const creationBudget = createOrderCreationBudget({ plans, args });
+  // Synthetic tracking seeds for this run's attempts (options.spec carries
+  // analytics.params.tracking.preserve; trackingTestHooks is an in-process
+  // test seam only).
+  const tracking = createTrackingRun({ runId, spec: options.spec || null, hooks: options.trackingTestHooks || null });
 
   const browser = await launchChromium(args);
   const context = await browser.newContext({
@@ -181,13 +217,18 @@ export async function runBrowserTestOrders(topologies, args = {}, runId = "local
       runId,
       // The topologies travel with the options so each attempt can resolve the
       // funnel's cart-entry page for the checkout it drives (campaigns-os#206).
-      options: { ...options, creationBudget, topologies, orderPathPlan },
+      options: { ...options, creationBudget, topologies, orderPathPlan, tracking },
     });
     return {
-      orders: dispatched.orders,
-      assertions: dispatched.assertions,
+      // The persisted exit: order URLs leave as origin+path. The in-memory
+      // orders stay raw, because recovery reloads the recorded receipt URL.
+      // Assertions and QC rows leave through the one persisted projection,
+      // so each qc.* assertion and its QC row stay identical.
+      orders: dispatched.orders.map(persistedTestOrder),
+      assertions: dispatched.assertions.map(redactPersisted),
       receiptAnalytics: dispatched.receiptAnalytics,
       journeyAnalytics: dispatched.journeyAnalytics,
+      qc_results: (dispatched.qcResults || []).map(redactPersisted),
     };
   } finally {
     await context.close().catch(() => {});
@@ -221,6 +262,7 @@ async function dispatchTestOrderPlans({ context, plans, checkoutPage, args = {},
 
   const assertions = [];
   const orders = [];
+  const qcResults = [];
   // The plan behind each entry in `orders`, index for index, so the upsell
   // coverage row can tell which funnel an order ran through.
   const orderPlans = [];
@@ -387,6 +429,19 @@ async function dispatchTestOrderPlans({ context, plans, checkoutPage, args = {},
       if (renderedReceiptAssertion) assertions.push(renderedReceiptAssertion);
       const dataLayerAssertion = purchaseDataLayerAssertion(pageForPlan, identifier, result.order);
       if (dataLayerAssertion) assertions.push(dataLayerAssertion);
+      // Tracking parameter rows for this plan. They never decide the order's
+      // own assertion, and a failure here never breaks the run.
+      try {
+        const trackingRows = options.tracking
+          ? options.tracking.rowsFor({ attempts: attemptsForPlan, recoveredAttempt: creationRecord?.action === "recovered" ? firstAttempt : null })
+          : [];
+        for (const row of trackingRows) {
+          qcResults.push(row);
+          assertions.push(trackingQaAssertion(row));
+        }
+      } catch {
+        // No row is recorded; the QC handoff lists the check as not captured.
+      }
     }
   } catch (error) {
     // Convert runner-level surprises into a blocker assertion so the run still
@@ -412,7 +467,7 @@ async function dispatchTestOrderPlans({ context, plans, checkoutPage, args = {},
   });
   if (coverage) assertions.push(coverage);
 
-  return { orders, assertions, receiptAnalytics, journeyAnalytics, creationBudget };
+  return { orders, assertions, receiptAnalytics, journeyAnalytics, creationBudget, qcResults };
 }
 
 // Analytics-parity leg: capture the live dataLayer event stream + GTM/pixel
@@ -930,8 +985,11 @@ export async function captureAnalyticsForUrls(urls = {}, args = {}) {
   }
 }
 
-async function runPageBrowserChecks(context, page, args, options = {}) {
+async function runPageBrowserChecks(context, page, args, options = {}, policyLinks = null) {
   const assertions = [];
+  // This visit's policy link read; it stays unread unless its anchors are read.
+  const policyLinkRead = { read: false, anchors: null };
+  policyLinks?.pages.push(policyLinkRead);
   if (!page.url) {
     assertions.push(assertion({
       id: `browser-load:${page.page_id}`,
@@ -983,6 +1041,12 @@ async function runPageBrowserChecks(context, page, args, options = {}) {
     await browserPage.waitForLoadState("networkidle", { timeout: DEFAULT_SETTLE_TIMEOUT_MS }).catch(() => {});
     observation.settle_ms = elapsedMilliseconds(settleStarted);
     const status = response?.status() ?? null;
+    // One read of the rendered anchors, from an isolated world. A page that
+    // was not served is not read.
+    if (policyLinks && !(status && status >= 400)) {
+      const anchors = await readPageAnchors(context, browserPage, { spec: options.spec, budget: policyLinks.budget });
+      if (anchors) Object.assign(policyLinkRead, { read: true, anchors });
+    }
     const title = await browserPage.title().catch(() => "");
     const bodyPresent = await browserPage.locator("body").count().then((count) => count > 0).catch(() => false);
 
@@ -1238,9 +1302,7 @@ async function primaryCtaVisualAssertions(browserPage, page) {
 }
 
 function primaryCtaCheckEligible(page) {
-  if (!page?.expected_next_url) return false;
-  const pageType = String(page.page_type || "").toLowerCase();
-  return !["checkout", "upsell", "downsell", "thankyou", "receipt"].includes(pageType);
+  return Boolean(page?.expected_next_url);
 }
 
 // Candidate CTAs: anything clickable, plus every SDK action control and the
@@ -1252,10 +1314,12 @@ const PRIMARY_CTA_SELECTOR = ["a[href]", "button", "[role='button']", "[data-nex
 
 // The in-page half of the primary-CTA inspection, as the source text the
 // page evaluates. The route rule it needs (cartEntryHrefFor, unit-tested in
-// qa-cart-entry) is handed in as a function value rather than closed over, so
-// both function bodies must stay free of module-scope references: the text is
-// run in a fresh context by a test (primary-CTA inspection script is
-// self-contained) that would surface a leaked identifier as a ReferenceError.
+// qa-cart-entry), the shared contrast helper (contrastToolkit) and the
+// generated-text rule Polish reads (generatedTextRenders) are handed in as
+// function values rather than closed over, so every function body must
+// stay free of module-scope references: the text is run in a fresh context by
+// a test (primary-CTA inspection script is self-contained) that would surface
+// a leaked identifier as a ReferenceError.
 function primaryCtaInspectionScript(expectedUrl) {
   const args = {
     routeUrl: expectedUrl,
@@ -1264,7 +1328,7 @@ function primaryCtaInspectionScript(expectedUrl) {
     cartEntryRouteAttribute: CART_ENTRY_ROUTE_ATTRIBUTE,
     ignoredRouteAttributes: [...UNDECLARED_ROUTE_ATTRIBUTES],
   };
-  return `(${inspectPrimaryCtaScript.toString()})(${JSON.stringify(args)}, ${cartEntryHrefFor.toString()})`;
+  return `(${inspectPrimaryCtaScript.toString()})(${JSON.stringify(args)}, ${cartEntryHrefFor.toString()}, ${contrastToolkit.toString()}, ${generatedTextRenders.toString()})`;
 }
 
 async function inspectPrimaryCta(browserPage, expectedUrl) {
@@ -1278,8 +1342,9 @@ async function inspectPrimaryCta(browserPage, expectedUrl) {
   }));
 }
 
-function inspectPrimaryCtaScript({ routeUrl, ctaSelector, cartEntrySelector, cartEntryRouteAttribute, ignoredRouteAttributes }, hrefForImpl) {
+function inspectPrimaryCtaScript({ routeUrl, ctaSelector, cartEntrySelector, cartEntryRouteAttribute, ignoredRouteAttributes }, hrefForImpl, contrastToolkitImpl, generatedTextImpl) {
   const CTA_SELECTOR = ctaSelector;
+  const toolkit = contrastToolkitImpl();
 
   const trim = (value) => String(value || "").replace(/\s+/g, " ").trim();
   const compactPath = (value) => String(value || "").replace(/\/+$/, "") || "/";
@@ -1290,42 +1355,6 @@ function inspectPrimaryCtaScript({ routeUrl, ctaSelector, cartEntrySelector, car
       return null;
     }
   })();
-  const parseColor = (value) => {
-    const raw = String(value || "").trim().toLowerCase();
-    if (!raw || raw === "transparent") return null;
-    const rgb = raw.match(/^rgba?\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})(?:\s*,\s*(\d?(?:\.\d+)?|1(?:\.0+)?))?\s*\)$/);
-    if (!rgb) return null;
-    const parts = rgb.slice(1, 4).map((part) => Number(part));
-    if (parts.some((part) => !Number.isFinite(part) || part < 0 || part > 255)) return null;
-    const alpha = rgb[4] === undefined ? 1 : Number(rgb[4]);
-    return { r: parts[0], g: parts[1], b: parts[2], a: Number.isFinite(alpha) ? alpha : 1 };
-  };
-  const hex = (color) => color ? `#${[color.r, color.g, color.b].map((part) => Math.round(part).toString(16).padStart(2, "0")).join("")}` : null;
-  const luminance = (color) => {
-    const channel = (value) => {
-      const normalized = value / 255;
-      return normalized <= 0.03928 ? normalized / 12.92 : ((normalized + 0.055) / 1.055) ** 2.4;
-    };
-    return 0.2126 * channel(color.r) + 0.7152 * channel(color.g) + 0.0722 * channel(color.b);
-  };
-  const contrast = (a, b) => {
-    if (!a || !b) return null;
-    const light = Math.max(luminance(a), luminance(b));
-    const dark = Math.min(luminance(a), luminance(b));
-    return Math.round(((light + 0.05) / (dark + 0.05)) * 100) / 100;
-  };
-  const effectiveBackground = (element) => {
-    let current = element;
-    while (current && current.nodeType === Node.ELEMENT_NODE) {
-      const style = getComputedStyle(current);
-      const color = parseColor(style.backgroundColor);
-      if (color && color.a > 0.05) {
-        return { color, source: current === element ? "element" : current.tagName.toLowerCase() };
-      }
-      current = current.parentElement;
-    }
-    return { color: { r: 255, g: 255, b: 255, a: 1 }, source: "assumed_canvas" };
-  };
   const isVisible = (element) => {
     const rect = element.getBoundingClientRect();
     const style = getComputedStyle(element);
@@ -1378,56 +1407,124 @@ function inspectPrimaryCtaScript({ routeUrl, ctaSelector, cartEntrySelector, car
   // per-element detail for the listed candidates only.
   const ignoredAttributes = Array.from(new Set(visibleElements.flatMap(ignoredAttributesOn))).sort();
 
-  const candidates = visibleElements
+  // A route candidate's text, read through the shared contrast helper: each
+  // text-bearing element inside it is compared, unrounded, with the
+  // requirement for its own size. An element with a review trigger (or with
+  // no ratio to compare) is a review member and is not compared; an element
+  // whose control is disabled or loading has no colours read. Text whose
+  // control is disabled is inactive: it is not rendered text the check can
+  // read, so it never counts toward text_rendered or toward a pass. A
+  // disabled candidate is not measured at all, whatever text it generates,
+  // and never counts toward a pass. In an enabled candidate, text an element
+  // inside it generates through ::before or ::after (generatedTextImpl) is
+  // never measured, so the candidate is reviewed, never passed on its other
+  // text.
+  const measureCandidate = (element) => {
+    if (element.matches(":disabled, [aria-disabled=\"true\"]")) {
+      return { disabled: true, text_rendered: null, control_loading: null, contrast_ratio: null, elements: [], below: false, review: false, measured: false, inactive: false };
+    }
+    // Every element the page renders inside the candidate: its own subtree,
+    // open shadow roots included.
+    const subtree = toolkit.flatSubtree(element);
+    const reads = subtree
+      .filter((node) => toolkit.isTextBearing(node, window))
+      .map((node) => toolkit.measureTextElement(node, window));
+    const compared = [];
+    let review = subtree.some((node) => generatedTextImpl(node, window));
+    for (const read of reads) {
+      if (read.disabled || read.control_loading) continue;
+      if (read.review_reason !== null || typeof read.ratio !== "number") review = true;
+      else compared.push(read);
+    }
+    const ratios = compared.map((read) => read.ratio);
+    return {
+      disabled: false,
+      text_rendered: reads.some((read) => !read.disabled),
+      control_loading: reads.some((read) => read.control_loading),
+      contrast_ratio: ratios.length ? toolkit.displayRatio(Math.min(...ratios)) : null,
+      elements: reads.map((read) => ({
+        selector_path: read.selector_path,
+        contrast_ratio_exact: read.ratio,
+        required_ratio: read.required,
+        size_class: read.size_class,
+        review_reason: read.review_reason,
+      })),
+      below: compared.some((read) => !toolkit.meetsRequirement(read.ratio, read.required)),
+      review,
+      measured: compared.length > 0,
+      inactive: reads.some((read) => read.disabled),
+    };
+  };
+
+  // Route candidates carry their measurement; other rows are listed for the
+  // route-recognition view only and are not measured.
+  const verdicts = new Map();
+  const rows = visibleElements
     .map((element) => {
       const rect = element.getBoundingClientRect();
-      const style = getComputedStyle(element);
-      const fg = parseColor(style.color);
-      const bg = effectiveBackground(element);
-      const ratio = contrast(fg, bg.color);
       const href = hrefFor(element);
       const label = trim(element.innerText || element.textContent || element.getAttribute("aria-label"));
       return {
-        selector: selectorFor(element),
-        text: label.slice(0, 120),
-        href,
-        route_matches: routeMatches(href),
-        ignored_attributes: ignoredAttributesOn(element),
-        width: Math.round(rect.width),
-        height: Math.round(rect.height),
-        foreground: hex(fg),
-        background: hex(bg.color),
-        background_source: bg.source,
-        contrast_ratio: ratio,
-        readable: typeof ratio === "number" && ratio >= 4.5,
-        size_ok: rect.width >= 40 && rect.height >= 20,
+        element,
+        row: {
+          selector: selectorFor(element),
+          text: label.slice(0, 120),
+          href,
+          route_matches: routeMatches(href),
+          ignored_attributes: ignoredAttributesOn(element),
+          width: Math.round(rect.width),
+          height: Math.round(rect.height),
+          size_ok: rect.width >= 40 && rect.height >= 20,
+        },
       };
     })
-    .filter((candidate) => candidate.text || candidate.href);
-
-  const routeCandidates = candidates
-    .filter((candidate) => candidate.route_matches)
-    .sort((a, b) => {
-      if (a.readable !== b.readable) return a.readable ? -1 : 1;
-      if (a.size_ok !== b.size_ok) return a.size_ok ? -1 : 1;
-      return (b.contrast_ratio || 0) - (a.contrast_ratio || 0);
+    .filter(({ row }) => row.text || row.href)
+    .map(({ element, row }) => {
+      if (!row.route_matches) return { ...row, disabled: null, text_rendered: null, control_loading: null, contrast_ratio: null, elements: null };
+      const { below, review, measured, inactive, ...read } = measureCandidate(element);
+      const candidate = { ...row, ...read };
+      verdicts.set(candidate, { below, review, measured, inactive });
+      return candidate;
     });
-  const primary = routeCandidates[0] || null;
-  const ok = Boolean(primary?.readable && primary?.size_ok);
-  const reason = ok
-    ? "ok"
-    : !routeCandidates.length
-      ? "missing_route_cta"
-      : primary?.size_ok === false
-        ? "cta_too_small"
-        : "low_contrast";
+
+  // Every route candidate counts, in document order; none is preferred.
+  // The page outcome is the first that applies. An enabled candidate whose
+  // only text is inactive (its control is disabled) has no rendered text;
+  // cta_disabled is only for every candidate disabled. The page passes only
+  // when every enabled candidate had at least one element compared, so text
+  // that was skipped never stands in for a measurement.
+  const routeCandidates = rows.filter((candidate) => candidate.route_matches);
+  const enabled = routeCandidates.filter((candidate) => !candidate.disabled);
+  const measurability = routeCandidates.length ? toolkit.documentMeasurability(document) : { measurable: true };
+  const reason = !routeCandidates.length
+    ? "missing_route_cta"
+    : !measurability.measurable
+      ? measurability.reason
+      : enabled.some((candidate) => verdicts.get(candidate).below)
+        ? "low_contrast"
+        : !routeCandidates.some((candidate) => candidate.size_ok)
+          ? "cta_too_small"
+          : enabled.some((candidate) => !candidate.text_rendered)
+            ? "text_not_rendered"
+            : enabled.some((candidate) => candidate.control_loading)
+              ? "control_loading"
+              : enabled.some((candidate) => verdicts.get(candidate).review)
+                ? "contrast_review"
+                : !enabled.length || enabled.some((candidate) => !verdicts.get(candidate).measured)
+                  ? "cta_disabled"
+                  : "ok";
+
+  // Rows are capped at eight, except that every route candidate is listed.
+  const listed = [];
+  for (const row of rows) if (row.route_matches || listed.length < 8) listed.push(row);
 
   return {
-    ok,
+    ok: reason === "ok",
     reason,
     expected_url: routeUrl,
-    primary,
-    candidates: candidates.slice(0, 8),
+    // The first route candidate in document order, for display only.
+    primary: routeCandidates[0] || null,
+    candidates: listed,
     // Every route-shaped attribute seen on a visible CTA-shaped element and
     // not consulted (see above), so a missing-route verdict on a page spelled
     // that way reads as a vocabulary gap, not as a removed CTA.
@@ -1435,8 +1532,20 @@ function inspectPrimaryCtaScript({ routeUrl, ctaSelector, cartEntrySelector, car
   };
 }
 
+// The outcomes the page itself earns as a failure. Every other outcome that
+// is not a pass could not be observed completely (the page was not
+// measurable, text or a control was not ready, a review trigger, every CTA
+// disabled, or an inspection the page rejected): manual review, never a pass
+// and never a contrast failure.
+const PRIMARY_CTA_FAIL_REASONS = Object.freeze([
+  "missing_route_cta",
+  "low_contrast",
+  "cta_too_small",
+]);
+
 function primaryCtaAssertionFromEvidence(page, evidence) {
   const ok = evidence?.ok === true;
+  const review = !ok && !PRIMARY_CTA_FAIL_REASONS.includes(evidence?.reason);
   const ignored = Array.isArray(evidence?.ignored_attributes) ? evidence.ignored_attributes.filter(Boolean) : [];
   // Named on every verdict the page earns, passing or not: a passing page
   // spelled with an undeclared route attribute is still one an operator
@@ -1447,7 +1556,7 @@ function primaryCtaAssertionFromEvidence(page, evidence) {
     id: `browser-primary-cta:${page.page_id}`,
     family: "browser-runtime",
     page,
-    status: ok ? STATUS.PASS : STATUS.FAIL,
+    status: ok ? STATUS.PASS : review ? STATUS.MANUAL_REVIEW : STATUS.FAIL,
     severity: ok ? undefined : SEVERITY.WARN,
     expected: "visible readable primary CTA linked to the expected next route",
     actual: ok
@@ -3493,6 +3602,12 @@ async function runSingleBrowserTestOrder(context, checkoutPage, plan, args, runI
   let events = { requests: [], responses: [], failed: [], console: [], pageErrors: [] };
   const email = testEmail(planArgs);
   const entryPage = resolveCartEntryPage(options.topologies, checkoutPage);
+  let tracking = null;
+  try {
+    tracking = options.tracking ? options.tracking.observe(planId(normalizedPlan)) : null;
+  } catch {
+    tracking = null;
+  }
   // Reserved immediately before the submit click, never reconciled afterwards:
   // an accounting check that runs after the purchase is not a budget. The same
   // call records that this attempt did submit, which is what lets a later
@@ -3567,6 +3682,13 @@ async function runSingleBrowserTestOrder(context, checkoutPage, plan, args, runI
       // hand. Everything the result carries onwards has been through
       // `sanitizedEvents`, which keeps the last 20 entries per stream.
       result.order_creates = summarizeOrderCreateActivity(events);
+      if (tracking) {
+        try {
+          result[TRACKING_OBSERVATION] = await tracking.finalize({ createActivity: result.order_creates });
+        } catch {
+          // The attempt gets no tracking rows; the order result is unchanged.
+        }
+      }
     }
     return stampTestOrderPlan(result, normalizedPlan);
   };
@@ -3588,7 +3710,7 @@ async function runSingleBrowserTestOrder(context, checkoutPage, plan, args, runI
       }
     }
     page.setDefaultTimeout(numberArg(planArgs["browser-timeout"], DEFAULT_BROWSER_TIMEOUT_MS));
-    events = captureCheckoutEvents(page);
+    events = captureCheckoutEvents(page, tracking);
     // The outer race is the hard guarantee: whatever hangs inside the path,
     // this returns and the run writes a verdict instead of dying with nothing.
     orderDeadline = Date.now() + orderTimeoutMs;
@@ -3606,6 +3728,7 @@ async function runSingleBrowserTestOrder(context, checkoutPage, plan, args, runI
         deadline: orderDeadline,
         reserveOrderCreation,
         selectorProbeCache: options.selectorProbeCache,
+        tracking,
       }),
       orderTimeoutMs + ORDER_TIMEOUT_GRACE_MS,
       `order-path:${planId(normalizedPlan)}`,
@@ -3684,7 +3807,7 @@ function stablePrivateCaptureError(value) {
   return projectAnalyticsCaptureError(value, { fallbackKind: "unreadable" });
 }
 
-async function executeTestOrderPath({ page, events, email, ladder, checkoutPage, entryPage = null, topologyPlan, path, args, deadline, reserveOrderCreation = null, selectorProbeCache = null }) {
+async function executeTestOrderPath({ page, events, email, ladder, checkoutPage, entryPage = null, topologyPlan, path, args, deadline, reserveOrderCreation = null, selectorProbeCache = null, tracking = null }) {
   const stepTimeoutMs = numberArg(args["step-timeout-ms"], DEFAULT_STEP_TIMEOUT_MS);
   const budget = () => Math.min(stepTimeoutMs, deadline - Date.now());
   const hostedNow = () => hostedRedirectInfo(safePageUrl(page), checkoutPage.url);
@@ -3704,7 +3827,7 @@ async function executeTestOrderPath({ page, events, email, ladder, checkoutPage,
   // page the probe left there rather than loading the same URL a second time,
   // which would fire the SDK's page-view events twice into the same capture.
   const entry = await ladder.run(CART_ENTRY_STEP, () => enterCartViaLanding({
-    page, checkoutPage, entryPage, selectedPackages, args, budget, selectorProbeCache,
+    page, checkoutPage, entryPage, selectedPackages, args, budget, selectorProbeCache, tracking,
   }), { timeoutMs: budget() });
   const enteredViaLanding = Boolean(entry && typeof entry === "object" && entry.entered);
   // Responses captured from here on belong to the checkout the ladder drives.
@@ -3712,7 +3835,7 @@ async function executeTestOrderPath({ page, events, email, ladder, checkoutPage,
   // made before the hand-off.
   const checkoutResponseOffset = events.responses.length;
 
-  await ladder.run("opened_checkout", () => openCheckoutForPath({ page, checkoutPage, entry, args }), { timeoutMs: budget() });
+  await ladder.run("opened_checkout", () => openCheckoutForPath({ page, checkoutPage, entry, args, tracking }), { timeoutMs: budget() });
   await ladder.run("selected_bundle", async () => {
     // The requested package was selected on the entry page, where the cards
     // live; checkout renders none, so re-running strict selection here would
@@ -3765,6 +3888,9 @@ async function executeTestOrderPath({ page, events, email, ladder, checkoutPage,
       // runs BEFORE the reservation: nothing is clicked, nothing is spent, and
       // the classifier reads the failure as `not_created`.
       cartBeforeSubmit = await cartStateBeforeSubmit(page, events, { responseOffset: checkoutResponseOffset, budget });
+      // The checkout's declared tags and inline page script, read after the
+      // SDK is ready (bounded; never throws).
+      await tracking?.readDocument(page);
       if (cartBeforeSubmit.empty) {
         throw codedError(CART_ENTRY_CODES.CART_EMPTY_BEFORE_SUBMIT, cartEmptyMessage(cartBeforeSubmit));
       }
@@ -3994,7 +4120,7 @@ function createSelectorProbeCache() {
 // loaded it and found a selection surface; either way a second load of the
 // same URL is what is avoided. Anywhere else (a cached probe answer skipped the
 // load; a fresh page) the checkout is opened here, once.
-async function openCheckoutForPath({ page, checkoutPage, entry, args }) {
+async function openCheckoutForPath({ page, checkoutPage, entry, args, tracking = null }) {
   const enteredViaLanding = Boolean(entry && typeof entry === "object" && entry.entered);
   if (enteredViaLanding) {
     await page.waitForLoadState("networkidle", { timeout: DEFAULT_SETTLE_TIMEOUT_MS }).catch(() => {});
@@ -4003,14 +4129,14 @@ async function openCheckoutForPath({ page, checkoutPage, entry, args }) {
   if (checkoutUrlPredicate(checkoutPage.url)(safePageUrl(page))) {
     return "already on checkout from the selector probe; not re-opened";
   }
-  await gotoAndSettle(page, checkoutPage.url, args);
+  await gotoAndSettle(page, checkoutPage.url, args, tracking);
   return null;
 }
 
 // The entry step body. Resolves to `{ skip }` when the checkout selects for
 // itself, to `{ entered: true, ... }` when the runner came in through the entry
 // page, and throws a coded error (never a bare timeout) when it cannot.
-async function enterCartViaLanding({ page, checkoutPage, entryPage, selectedPackages, args, budget, selectorProbeCache = null }) {
+async function enterCartViaLanding({ page, checkoutPage, entryPage, selectedPackages, args, budget, selectorProbeCache = null, tracking = null }) {
   // Probe the checkout first: whether it carries a selection surface is a fact
   // about the rendered page, not about the spec (the spec cannot say it yet —
   // that is the design half of #206). The probe's load is the checkout's only
@@ -4027,7 +4153,7 @@ async function enterCartViaLanding({ page, checkoutPage, entryPage, selectedPack
   let probe = cached ? "reused" : "loaded";
   let probeError = null;
   if (!surface) {
-    await gotoAndSettle(page, checkoutPage.url, args);
+    await gotoAndSettle(page, checkoutPage.url, args, tracking);
     const probed = await page.evaluate(checkoutSelectionSurfaceScript())
       .then((value) => ({ value }), (error) => ({ value: null, error: error?.message || String(error) }));
     if (probed.value) {
@@ -4053,8 +4179,9 @@ async function enterCartViaLanding({ page, checkoutPage, entryPage, selectedPack
     );
   }
 
-  await gotoAndSettle(page, entryPage.url, args);
+  await gotoAndSettle(page, entryPage.url, args, tracking);
   const sdkReady = await waitForSdkReady(page, Math.min(budget(), DEFAULT_SETTLE_TIMEOUT_MS));
+  await tracking?.readDocument(page);
   const controls = await page.evaluate(cartEntryControlsScript(), { selector: CART_ENTRY_CONTROL_SELECTOR, checkoutUrl: checkoutPage.url }).catch(() => []);
   const choice = chooseCartEntryControl(controls, selectedPackages);
   if (!choice.control) {
@@ -4348,8 +4475,11 @@ function assessReceiptRendering(persistedLineCount, evidence = {}) {
   };
 }
 
-async function gotoAndSettle(page, url, args) {
-  await page.goto(url, { waitUntil: "domcontentloaded", timeout: numberArg(args["browser-timeout"], DEFAULT_BROWSER_TIMEOUT_MS) });
+// With a tracking observer, the load is a runner navigation: before the
+// attempt's first page-initiated hop it carries the run's synthetic seeds.
+async function gotoAndSettle(page, url, args, tracking = null) {
+  const target = tracking ? tracking.runnerUrl(url, withQueryParam) : url;
+  await page.goto(target, { waitUntil: "domcontentloaded", timeout: numberArg(args["browser-timeout"], DEFAULT_BROWSER_TIMEOUT_MS) });
   await page.waitForLoadState("networkidle", { timeout: DEFAULT_SETTLE_TIMEOUT_MS }).catch(() => {});
   await page.waitForTimeout(750);
 }
@@ -5219,11 +5349,30 @@ async function clickControl(locator, { timeout, forceFallback = true, perpetual
   }
 }
 
+// The control a shopper would click. A page may keep the SDK action hidden in
+// the offer and show a data-upsell-proxy button elsewhere that forwards its
+// click to it (the starter templates' closing-card decline on a box-style
+// single offer). Clicking the hidden action fails as not visible, so the
+// visible proxy is clicked instead, but only while the offer holds an SDK action
+// for it to forward to: otherwise the hidden action is clicked and fails as before.
+async function shopperUpsellControl(page, action) {
+  const actions = page.locator(`[data-next-upsell-action="${action}"]`);
+  if (!await actions.count().catch(() => 0)) return actions.first();
+  const visibleAction = actions.filter({ visible: true }).first();
+  if (await visibleAction.count().catch(() => 0)) return visibleAction;
+  // The proxy forwards to `[data-next-upsell="offer"] [data-next-upsell-action]`
+  // (upsells.js), so only an action inside the offer is a target.
+  const inOffer = page.locator(`[data-next-upsell="offer"] [data-next-upsell-action="${action}"]`);
+  const proxy = page.locator(`[data-upsell-proxy="${action}"]`).filter({ visible: true }).first();
+  if (await inOffer.count().catch(() => 0) && await proxy.count().catch(() => 0)) return proxy;
+  return actions.first();
+}
+
 async function clickUpsellPath(page, path, { trace = null } = {}) {
   const offerUrl = safePageUrl(page);
   const action = path === "accept" ? "add" : "skip";
   const selector = `[data-next-upsell-action="${action}"]`;
-  const control = page.locator(selector).first();
+  const control = await shopperUpsellControl(page, action);
   if (!await control.count().catch(() => 0)) {
     return { path, clicked: false, error: `Missing upsell control ${selector}` };
   }
@@ -6197,7 +6346,7 @@ function testOrderAssertion(page, plan, result, firstAttempt = null, creationRec
         ...retry,
         ...creation,
         hosted_checkout_url: result.order?.hosted_checkout_url || null,
-        final_url: result.order?.final_url,
+        final_url: redactUrlQuery(result.order?.final_url),
         steps: result.order?.evidence?.steps,
         note: "Hosted checkout flow is platform-owned; verify the hosted completion manually.",
       },
@@ -6244,13 +6393,13 @@ function testOrderAssertion(page, plan, result, firstAttempt = null, creationRec
           ...recovery,
           ref_id: result.order.ref_id,
           order_number: result.order.next_order_id,
-          final_url: result.order.final_url,
+          final_url: redactUrlQuery(result.order.final_url),
           is_test: result.order.is_test,
           line_count: result.order.receipt_line_items.length,
           ...(receiptProofEvidence(result.order) ? { receipt_proof: receiptProofEvidence(result.order) } : {}),
           ...(path === "accept" ? { accepted_upsell_line_present: result.order.verification?.accepted_upsell_line_present } : {}),
           ...(upsellUnverified ? { upsell_unverified: upsellUnverified } : {}),
-          ...(result.order.upsell ? { upsell_clicked: result.order.upsell.clicked, upsell_final_url: result.order.upsell.final_url } : {}),
+          ...(result.order.upsell ? { upsell_clicked: result.order.upsell.clicked, upsell_final_url: redactUrlQuery(result.order.upsell.final_url) } : {}),
           ...(result.order.upsell_steps ? { upsell_steps: result.order.upsell_steps.map(summarizeUpsellStep) } : {}),
           ...(result.order.verification?.accepted_upsell_matches ? { accepted_upsell_matches: result.order.verification.accepted_upsell_matches } : {}),
           ...(result.order.verification?.coupon ? { coupon: result.order.verification.coupon } : {}),
@@ -6261,7 +6410,7 @@ function testOrderAssertion(page, plan, result, firstAttempt = null, creationRec
           ...retry,
           ...creation,
           ...recovery,
-          final_url: result.order?.final_url,
+          final_url: redactUrlQuery(result.order?.final_url),
           steps: result.order?.evidence?.steps,
           ...(receiptProofEvidence(result.order) ? { receipt_proof: receiptProofEvidence(result.order) } : {}),
           ...(result.order?.verification?.coupon ? { coupon: result.order.verification.coupon } : {}),
@@ -6338,11 +6487,20 @@ function responseRequestStartedAt(response) {
   }
 }
 
-function captureCheckoutEvents(page) {
+function captureCheckoutEvents(page, tracking = null) {
   const events = { requests: [], responses: [], failed: [], console: [], pageErrors: [], navigations: [] };
   const interesting = /\/api\/v1\/(?:orders|upsells|carts)\/?|\/transactions|spreedly|campaigns\.apps/i;
+  const isMainFrame = (frame) => typeof page.mainFrame !== "function" || frame === page.mainFrame();
   page.on("request", (request) => {
     if (!interesting.test(request.url())) return;
+    // Tracking equality reads the create body before it is summarized below.
+    if (tracking && ORDER_CREATE_RESPONSE_PATTERN.test(request.url()) && request.method() === "POST") {
+      try {
+        tracking.onCreateRequest(() => request.postData());
+      } catch {
+        // The order is never held up by a tracking read.
+      }
+    }
     events.requests.push({
       method: request.method(),
       url: request.url(),
@@ -6360,15 +6518,47 @@ function captureCheckoutEvents(page) {
     const request = responseRequest(response);
     let chainUrl = null;
     try { chainUrl = request?.url() ?? null; } catch { /* identity only */ }
+    // Tracking: a script the page received is scanned for page-script
+    // attribution calls, and an accepted create marks the post-order point.
+    let orderSource = null;
+    if (tracking) {
+      try {
+        const method = response.request().method();
+        if (response.request().resourceType() === "script") tracking.onScriptResponse(response);
+        if (method === "POST" && ORDER_CREATE_RESPONSE_PATTERN.test(response.url())) {
+          tracking.onCreateResponseStatus(response.status());
+          orderSource = "create_response";
+        } else if (method === "GET" && ORDER_DETAIL_RESPONSE_PATTERN.test(response.url())) {
+          orderSource = "readback";
+        }
+        if (orderSource && !(response.status() >= 200 && response.status() < 300)) orderSource = null;
+      } catch {
+        orderSource = null;
+        try { tracking.onListenerError("response"); } catch { /* never breaks the order */ }
+      }
+    }
     if (!interesting.test(response.url()) && !(chainUrl && interesting.test(chainUrl))) return;
     // Taken before the body read: an entry lands in the log when its body
     // finishes, so its position says nothing about when it was requested.
     const requestStartedAt = responseRequestStartedAt(response);
+    // Equality on the in-memory body, before summarizeResponseBody. For an
+    // order response the observer starts the read itself (through its
+    // observeRead) before anything awaits it, so a body still in flight when
+    // the attempt's observation is taken is a failed extractor there, never a
+    // pass. The log entry awaits that same read.
+    let bodyRead = null;
+    const readBody = () => {
+      bodyRead ??= readJsonResponseBodyWhenLoaded(response);
+      return bodyRead;
+    };
+    if (orderSource) {
+      try { tracking.orderResponseBody(orderSource, readBody); } catch { /* never breaks the order */ }
+    }
     const entry = {
       status: response.status(),
       url: response.url(),
       request_started_at: requestStartedAt,
-      body: await readJsonResponseBodyWhenLoaded(response),
+      body: await readBody(),
     };
     if (request) entry[REQUEST_IDENTITY] = request;
     events.responses.push(entry);
@@ -6385,6 +6575,42 @@ function captureCheckoutEvents(page) {
       // Navigation evidence is diagnostic only; never break the order path.
     }
   });
+  if (tracking) {
+    // Tracking hops: a second listener beside the one above. Whether a hop
+    // committed a new document is read only from the browser itself:
+    // Playwright's main frame emits "navigated" with `newDocument` for a
+    // document commit and without it for a same-document one, synchronously
+    // just before "framenavigated" (pinned against the installed Playwright
+    // in qa-tracking-params-hardening.test.mjs). It is an internal emitter;
+    // where a page has none, every hop reads history. The signal is only held
+    // here and handed to the observer with its hop.
+    let commit = null;
+    try {
+      const emitter = typeof page.mainFrame === "function" ? page.mainFrame()?._eventEmitter : null;
+      if (emitter && typeof emitter.on === "function") {
+        emitter.on("navigated", (event) => {
+          commit = event && !event.error ? { url: String(event.url), newDocument: Boolean(event.newDocument) } : null;
+        });
+      }
+    } catch {
+      // No signal: every hop reads history.
+    }
+    page.on("framenavigated", (frame) => {
+      try {
+        if (!isMainFrame(frame)) return;
+        const signal = commit;
+        commit = null;
+        tracking.onFrameNavigated(frame.url(), signal);
+      } catch {
+        // The observer records the missed hop as a gap.
+        try { tracking.onListenerError("hop"); } catch { /* never breaks the order */ }
+      }
+    });
+    page.on("domcontentloaded", () => {
+      try { tracking.readDocument(page, { awaited: false }); } catch { /* never breaks the order */ }
+    });
+    attachCreateResponseTap(page, tracking);
+  }
   page.on("console", (message) => {
     if (["error", "warning"].includes(message.type())) events.console.push({ type: message.type(), text: trim(message.text()) });
   });
@@ -6392,6 +6618,58 @@ function captureCheckoutEvents(page) {
   return events;
 }
 
+// The order create's response body for the tracking echo, read in memory
+// before the page can leave it: the SDK navigates as soon as the create
+// answers, and a body read after that navigation finds nothing. Only order
+// responses are paused, at the response stage, and every one is continued
+// unchanged; no request is added and nothing is persisted from the body.
+// An accepted create is held at most TRACKING_ADDED_BOUND_MS, whatever the
+// body read does: the observer's read is itself bounded by the attempt's
+// remaining tracking budget (an overrun records the extractor as failed),
+// and the timer here continues the response even if that bound misbehaves.
+function attachCreateResponseTap(page, tracking) {
+  let session = null;
+  const onPaused = (event) => {
+    let continued = false;
+    let timer = null;
+    const proceed = () => {
+      if (continued) return;
+      continued = true;
+      clearTimeout(timer);
+      session.send("Fetch.continueRequest", { requestId: event.requestId }).catch(() => {});
+    };
+    try {
+      const status = Number(event.responseStatusCode);
+      const isAcceptedCreate = event.request?.method === "POST"
+        && ORDER_CREATE_RESPONSE_PATTERN.test(String(event.request?.url || ""))
+        && status >= 200 && status < 300;
+      if (!isAcceptedCreate) {
+        proceed();
+        return;
+      }
+      timer = setTimeout(proceed, TRACKING_ADDED_BOUND_MS);
+      const readBody = () => session.send("Fetch.getResponseBody", { requestId: event.requestId }).then((read) => {
+        const text = read?.base64Encoded ? Buffer.from(String(read.body || ""), "base64").toString("utf8") : read?.body;
+        return parseMaybeJson(redactSensitive(text));
+      });
+      Promise.resolve(tracking.tapCreateResponse(readBody)).catch(() => {}).finally(proceed);
+    } catch {
+      proceed();
+    }
+  };
+  // The session setup is itself a read the observer holds, like every other
+  // asynchronous step that feeds a tracking row.
+  try {
+    return tracking.attachTap(async () => {
+      session = await page.context().newCDPSession(page);
+      session.on("Fetch.requestPaused", onPaused);
+      await session.send("Fetch.enable", { patterns: [{ urlPattern: "*/api/v1/orders*", requestStage: "Response" }] });
+    });
+  } catch {
+    return Promise.resolve();
+  }
+}
+
 // Playwright's response.text() waits for the body to finish loading. A page
 // that navigates away as soon as the headers land (an SDK that reads only the
 // status before redirecting) can leave that wait pending forever. Only a
@@ -6457,21 +6735,24 @@ function lastJsonResponse(events, pattern) {
   return null;
 }
 
+// A persisted exit: every URL is origin+path; bodies are summarized; then
+// every string and key goes through the persisted-value projection.
 function sanitizedEvents(events) {
-  return {
-    requests: events.requests.slice(-20),
+  return redactPersisted({
+    requests: events.requests.slice(-20).map((request) => ({ ...request, url: redactUrlQuery(request.url) })),
     responses: events.responses.slice(-20).map((response) => ({
       status: response.status,
-      url: response.url,
+      url: redactUrlQuery(response.url),
       body: summarizeResponseBody(response.body, { status: response.status }),
     })),
-    failed: events.failed.slice(-20),
-    console: events.console.slice(-20),
-    pageErrors: events.pageErrors.slice(-20),
+    failed: events.failed.slice(-20).map((failure) => ({ ...failure, url: redactUrlQuery(failure.url), failure: redactUrlQueriesInText(failure.failure) })),
+    // Console and page-error text can quote URLs; their queries are dropped.
+    console: events.console.slice(-20).map((entry) => ({ ...entry, text: redactUrlQueriesInText(entry.text) })),
+    pageErrors: events.pageErrors.slice(-20).map((text) => redactUrlQueriesInText(text)),
     navigations: (events.navigations || []).slice(-20).map((navigation) => ({
       url: redactUrlQuery(navigation.url),
     })),
-  };
+  });
 }
 
 function summarizeRequestPostData(value) {
@@ -6490,23 +6771,26 @@ function summarizeRequestPostData(value) {
   }
 }
 
+const RESPONSE_BODY_MARKER = "[redacted-response-body]";
+
 function summarizeResponseBody(body, { status = null } = {}) {
-  if (typeof body === "string") return trim(body).slice(0, 1000);
-  if (!body || typeof body !== "object" || Array.isArray(body)) return body;
+  if (body === null || body === undefined) return null;
+  // Raw body content (text, an array, a bare scalar) is never persisted.
+  if (typeof body !== "object" || Array.isArray(body)) return RESPONSE_BODY_MARKER;
   return {
     ...(body.number ? { number: body.number } : {}),
     ...(body.ref_id ? { ref_id: body.ref_id } : {}),
     ...(body.is_test !== undefined ? { is_test: body.is_test } : {}),
     ...(body.total_incl_tax ? { total_incl_tax: body.total_incl_tax } : {}),
     ...(body.currency ? { currency: body.currency } : {}),
-    ...(body.checkout_url ? { checkout_url: body.checkout_url } : {}),
+    ...(body.checkout_url ? { checkout_url: redactUrlQuery(body.checkout_url) } : {}),
     ...(Array.isArray(body.lines) ? { lines: extractReceiptLines(body) } : {}),
-    ...(body.detail ? { detail: body.detail } : {}),
+    ...(body.detail ? { detail: redactPersisted(body.detail) } : {}),
     // A rejected request names its reason here (for example the
     // duplicate-order refusal). Kept only on an error response, so a
     // successful create never carries payment_details into evidence.
     ...(Number(status) >= 400 && typeof body.payment_details === "string"
-      ? { payment_details: trim(body.payment_details).slice(0, 300) }
+      ? { payment_details: redactUrlQueriesInText(trim(body.payment_details).slice(0, 300)) }
       : {}),
   };
 }
@@ -6750,7 +7034,7 @@ function specTierPlans(topologies, args, variant, { warn = (line) => process.std
     const declaredTiers = declaredSelectorTiers(checkoutPage);
     const bumps = declaredOrderBumps(checkoutPage);
     if (bumps.length) {
-      warn(`[qa:test-order] checkout page "${checkoutPage.page_id || checkoutPage.label || "(unnamed)"}" declares order bump package(s) ${bumps.join(", ")} (is_upsell) — not planned as selector tiers; bump coverage comes from --cart.`);
+      warn(`[qa:test-order] checkout page "${checkoutPage.page_id || checkoutPage.label || "(unnamed)"}" declares order bump package(s) ${bumps.join(", ")} (is_order_bump or is_upsell) — not planned as selector tiers; bump coverage comes from --cart.`);
     }
     for (const tier of declaredTiers) declaredIdentities.add(selectorTierIdentity(tier));
     for (const ref of bumps) bumpRefs.add(ref);
@@ -6830,7 +7114,7 @@ function specTierPlans(topologies, args, variant, { warn = (line) => process.std
     const namedBumps = unmatched.filter((identity) => bumpRefs.has(identity.split(":")[0]));
     throw new Error([
       `--select-package ${unmatched.join(",")}: ${unmatched.length === 1 ? "is not a selector tier" : "are not selector tiers"} the CampaignSpec declares${declaredIdentities.size ? ` (declared tiers: ${[...declaredIdentities].join(", ")}` : " (no tiers declared"}${bumpRefs.size ? `; order bump ref(s) excluded from tiers: ${[...bumpRefs].join(", ")}` : ""}).`,
-      ...(namedBumps.length ? [`${namedBumps.join(",")} ${namedBumps.length === 1 ? "is an order bump (is_upsell)" : "are order bumps (is_upsell)"}, an add-on to a selected tier, not a tier; bump coverage comes from --cart.`] : []),
+      ...(namedBumps.length ? [`${namedBumps.join(",")} ${namedBumps.length === 1 ? "is an order bump (is_order_bump or is_upsell)" : "are order bumps (is_order_bump or is_upsell)"}, an add-on to a selected tier, not a tier; bump coverage comes from --cart.`] : []),
       "Name declared tiers only, as ref or ref:qty, or drop --select-package to iterate every tier.",
     ].join(" "));
   }
@@ -6874,59 +7158,6 @@ function selectorTierNarrowing(value) {
   return identities.length ? new Set(identities) : null;
 }
 
-// Order bumps declared on the checkout page (`is_upsell: true` rows — the
-// same marker the commercial-journey planner reads). They are add-ons to a
-// selected tier, not tiers, so the tier planner reports and skips them.
-function declaredOrderBumps(checkoutPage) {
-  const refs = [];
-  for (const pkg of Array.isArray(checkoutPage?.packages) ? checkoutPage.packages : []) {
-    if (!pkg || typeof pkg !== "object" || !isBumpRow(pkg)) continue;
-    const ref = [pkg.ref_id, pkg.package_id, pkg.id]
-      .map((value) => (value == null ? "" : String(value).trim()))
-      .find(Boolean);
-    if (ref && !refs.includes(ref)) refs.push(ref);
-  }
-  return refs;
-}
-
-// Selector tiers are the packages the spec declares on the checkout page —
-// same ref tolerance as the doctor's specPackageRecords (ref_id/package_id/id).
-// Order-bump rows (`is_upsell: true`) are add-ons offered alongside the
-// selected tier, not tiers of their own: they never become a plan.
-function declaredSelectorTiers(checkoutPage) {
-  const records = [];
-  const quantitiesByRef = new Map();
-  for (const pkg of Array.isArray(checkoutPage?.packages) ? checkoutPage.packages : []) {
-    if (!pkg || typeof pkg !== "object" || isBumpRow(pkg)) continue;
-    const ref = [pkg.ref_id, pkg.package_id, pkg.id]
-      .map((value) => (value == null ? "" : String(value).trim()))
-      .find(Boolean);
-    const declaredQuantity = Number(pkg.qty ?? pkg.quantity ?? 1);
-    if (!ref || !Number.isInteger(declaredQuantity) || declaredQuantity < 1) continue;
-    records.push({ pkg, ref, declaredQuantity });
-    if (!quantitiesByRef.has(ref)) quantitiesByRef.set(ref, new Set());
-    quantitiesByRef.get(ref).add(declaredQuantity);
-  }
-
-  const tiers = [];
-  const seen = new Set();
-  for (const { pkg, ref, declaredQuantity } of records) {
-    // A unique ref is a catalog package bought once, even when that package's
-    // own composition is 3x. Only repeated declarations of the SAME ref at
-    // different quantities express shopper purchase multipliers (Keer 1x/2x).
-    const quantity = quantitiesByRef.get(ref).size > 1 ? declaredQuantity : 1;
-    const identity = `${ref}:${quantity}`;
-    if (seen.has(identity)) continue;
-    seen.add(identity);
-    tiers.push({
-      ref,
-      quantity,
-      declared_by: stringArg(pkg.name) || stringArg(pkg.title) || undefined,
-    });
-  }
-  return tiers;
-}
-
 // Declared coupons follow the repo's offer-surface rule (build-brief, cli
 // exit-pop gates): a surface counts only when `enabled === true` and it maps
 // an offer_code. Both surfaces mapping the same code collapse into one plan.
@@ -7678,7 +7909,7 @@ function summarizeUpsellStep(step) {
   return {
     path: step.path,
     clicked: step.clicked,
-    final_url: step.final_url,
+    final_url: redactUrlQuery(step.final_url),
     expected_items: step.expected_items,
     api_response_seen: step.api_response_seen,
     api_response_status: step.api_response_status,
@@ -7721,6 +7952,30 @@ function withQueryParam(value, key, paramValue) {
   }
 }
 
+// A test order as it is persisted: its URLs as origin+path, an upsell's raw
+// response body as its summary, and no URL query in any string or key (the
+// one persisted-value projection, redactPersisted). The order events were
+// already summarized where they were captured.
+function persistedTestOrder(order) {
+  if (!order || typeof order !== "object") return order;
+  const projected = { ...order };
+  if (Object.hasOwn(order, "checkout_url")) projected.checkout_url = redactUrlQuery(order.checkout_url);
+  if (Object.hasOwn(order, "final_url")) projected.final_url = redactUrlQuery(order.final_url);
+  if (order.upsell && typeof order.upsell === "object") projected.upsell = persistedUpsellStep(order.upsell);
+  if (Array.isArray(order.upsell_steps)) projected.upsell_steps = order.upsell_steps.map(persistedUpsellStep);
+  return redactPersisted(projected);
+}
+
+function persistedUpsellStep(step) {
+  if (!step || typeof step !== "object") return step;
+  const projected = { ...step };
+  for (const field of ["offer_url", "final_url", "api_response_url"]) {
+    if (Object.hasOwn(step, field)) projected[field] = redactUrlQuery(step[field]);
+  }
+  if (Object.hasOwn(step, "api_response_order_body")) projected.api_response_order_body = summarizeResponseBody(step.api_response_order_body);
+  return projected;
+}
+
 function findPage(topologies, type) {
   for (const topology of topologies || []) {
     const page = (topology.pages || []).find((candidate) => candidate.page_type === type);
@@ -7929,6 +8184,10 @@ export const __qaBrowserTestHooks = Object.freeze({
   createOrderCreationBudget,
   dispatchTestOrderPlans,
   recoverCreatedOrder,
+  persistedTestOrder,
+  sanitizedEvents,
+  summarizeResponseBody,
+  attachCreateResponseTap,
   extractReceiptLines,
   EXIT_INTENT_SURFACE_SELECTORS,
   COUPON_INPUT_SELECTORS,