@resolveio/server-lib 22.3.108 → 22.3.110

package/util/ai-runner-qa-tools.js

@@ -138,6 +138,10 @@ function buildResolveIORunnerQaEnvScript(options) {
         'if [ "${RESOLVEIO_SUPPORT_CODEX_LANE:-}" = "build" ] || [ "${RESOLVEIO_SUPPORT_CODEX_LANE:-}" = "support_build" ] || [ "${RESOLVEIO_SUPPORT_CODEX_LANE:-}" = "support-build" ]; then',
         '  if [ "${1:-}" = "run" ]; then',
         '    case "${2:-}" in',
+        '      build-dev)',
+        '        echo "ResolveIO support lane guard: refusing npm run build-dev from the 5.3 build lane. Use a finite build-prod/tsc/unit self-gate or return a blocked self-gate." >&2',
+        '        exit 86',
+        '        ;;',
         '      server|client|start|dev|serve|local-qa|qa|qa:*|test:browser|test:e2e|e2e)',
         '        echo "ResolveIO support lane guard: refusing npm run ${2:-} from the 5.3 build lane. Browser/server/client QA belongs to the 5.4 mini QA lane." >&2',
         '        exit 86',
@@ -219,6 +223,63 @@ function buildResolveIORunnerQaEnvScript(options) {
         '  export PATH="$RESOLVEIO_QA_COMMAND_GUARD_BIN:$PATH"',
         '  hash -r 2>/dev/null || true',
         'fi',
+        'export RESOLVEIO_QA_REAL_NODE="${RESOLVEIO_QA_REAL_NODE:-$(resolveio_qa_find_real_command node || true)}"',
+        'if [ -n "$RESOLVEIO_QA_REAL_NODE" ]; then',
+        '  cat > "$RESOLVEIO_QA_COMMAND_GUARD_BIN/node" <<\'RESOLVEIO_QA_NODE_GUARD\'',
+        '#!/usr/bin/env bash',
+        'set -u',
+        'REAL_NODE="${RESOLVEIO_QA_REAL_NODE:-}"',
+        'GUARD_BIN="${RESOLVEIO_QA_COMMAND_GUARD_BIN:-}"',
+        'if [ -z "$REAL_NODE" ] || [ "$REAL_NODE" = "$0" ]; then',
+        '  OLD_IFS="$IFS"',
+        '  IFS=":"',
+        '  for dir in $PATH; do',
+        '    [ -n "$dir" ] || continue',
+        '    [ -n "$GUARD_BIN" ] && [ "$dir" = "$GUARD_BIN" ] && continue',
+        '    if [ -x "$dir/node" ]; then REAL_NODE="$dir/node"; break; fi',
+        '  done',
+        '  IFS="$OLD_IFS"',
+        'fi',
+        'if [ -z "$REAL_NODE" ] || [ ! -x "$REAL_NODE" ]; then',
+        '  echo "ResolveIO QA command guard: unable to locate real node." >&2',
+        '  exit 127',
+        'fi',
+        'resolveio_qa_node_guard_active() {',
+        '  case "${RESOLVEIO_SUPPORT_CODEX_LANE:-}" in qa|support_qa|support-qa) return 0 ;; *) return 1 ;; esac',
+        '}',
+        'resolveio_qa_scan_inline_node_script() {',
+        '  local script_file="$1"',
+        '  [ -f "$script_file" ] || return 0',
+        "  if grep -Eiq \"networkidle0|networkidle2|page\\.waitForTimeout|page\\.waitForEvent|page\\.\\$x|require\\([\\\"']puppeteer[\\\"']\\)|puppeteer browsers install|npx puppeteer|playwright install\" \"$script_file\"; then",
+        '    echo "ResolveIO QA command guard: refusing fragile/forbidden browser QA script. Use the shared QA helpers, domcontentloaded plus concrete DOM assertions, puppeteer-core from staged NODE_PATH, and delay(ms) instead of networkidle*/waitForTimeout/page.\\$x/browser installs." >&2',
+        '    exit 86',
+        '  fi',
+        '}',
+        'if resolveio_qa_node_guard_active; then',
+        '  case "${1:-}" in',
+        '    -)',
+        '      TMP_SCRIPT="${RESOLVEIO_QA_TMP:-/tmp/resolveio-support-qa}/inline-node-guard-$$.js"',
+        '      mkdir -p "$(dirname "$TMP_SCRIPT")"',
+        '      cat > "$TMP_SCRIPT"',
+        '      resolveio_qa_scan_inline_node_script "$TMP_SCRIPT"',
+        '      shift',
+        '      exec "$REAL_NODE" "$TMP_SCRIPT" "$@"',
+        '      ;;',
+        '    -e|--eval)',
+        '      TMP_SCRIPT="${RESOLVEIO_QA_TMP:-/tmp/resolveio-support-qa}/inline-node-guard-$$.js"',
+        '      mkdir -p "$(dirname "$TMP_SCRIPT")"',
+        '      printf "%s\\n" "${2:-}" > "$TMP_SCRIPT"',
+        '      resolveio_qa_scan_inline_node_script "$TMP_SCRIPT"',
+        '      exec "$REAL_NODE" "$@"',
+        '      ;;',
+        '  esac',
+        'fi',
+        'exec "$REAL_NODE" "$@"',
+        'RESOLVEIO_QA_NODE_GUARD',
+        '  chmod +x "$RESOLVEIO_QA_COMMAND_GUARD_BIN/node"',
+        '  export PATH="$RESOLVEIO_QA_COMMAND_GUARD_BIN:$PATH"',
+        '  hash -r 2>/dev/null || true',
+        'fi',
         toolsBinPath ? "export PATH=\"".concat(toolsBinPath, ":$PATH\"") : '',
         'export NODE_ENV=development',
         '# Local QA must start the application HTTP server even when launched from a dedicated support-manager worker.',
@@ -250,9 +311,10 @@ function buildResolveIORunnerQaEnvScript(options) {
         "export ".concat(altKeepaliveVar, "=\"").concat('${' + altKeepaliveVar + ':-${' + keepaliveVar + '}}', "\""),
         "export ".concat(mongoPortVar, "=\"").concat('${' + mongoPortVar + ':-${' + altMongoPortVar + ':-3001}}', "\""),
         "export ".concat(altMongoPortVar, "=\"").concat('${' + altMongoPortVar + ':-${' + mongoPortVar + '}}', "\""),
-        "export ".concat(mongoUrlVar, "=\"").concat('${' + mongoUrlVar + ':-${' + altMongoUrlVar + ':-mongodb://127.0.0.1:${' + mongoPortVar + '}/resolveio?directConnection=true}}', "\""),
-        "export ".concat(altMongoUrlVar, "=\"").concat('${' + altMongoUrlVar + ':-${' + mongoUrlVar + '}}', "\""),
-        "export MONGO_URL=\"".concat('${MONGO_URL:-$' + mongoUrlVar + '}', "\""),
+        'export RESOLVEIO_QA_INHERITED_MONGO_URL="${RESOLVEIO_QA_INHERITED_MONGO_URL:-${MONGO_URL:-}}"',
+        "export ".concat(mongoUrlVar, "=\"mongodb://127.0.0.1:").concat('${' + mongoPortVar + '}', "/resolveio?directConnection=true\""),
+        "export ".concat(altMongoUrlVar, "=\"").concat('${' + mongoUrlVar + '}', "\""),
+        "export MONGO_URL=\"".concat('${' + mongoUrlVar + '}', "\""),
         "export ".concat(usernameVar, "=\"").concat('${' + usernameVar + ':-${' + altUsernameVar + ':-' + username + '}}', "\""),
         "export ".concat(altUsernameVar, "=\"").concat('${' + altUsernameVar + ':-${' + usernameVar + '}}', "\""),
         "export ".concat(passwordVar, "=\"").concat('${' + passwordVar + ':-${' + altPasswordVar + ':-' + password + '}}', "\""),
@@ -273,18 +335,26 @@ function buildResolveIORunnerQaEnvScript(options) {
         "export ".concat(envVar(mode, 'LIVE_DATA_REQUIRED'), "=\"").concat('${' + envVar(mode, 'LIVE_DATA_REQUIRED') + ':-${' + envVar(altMode, 'LIVE_DATA_REQUIRED') + ':-' + qaLiveDataRequired + '}}', "\""),
         "export ".concat(envVar(altMode, 'LIVE_DATA_REQUIRED'), "=\"").concat('${' + envVar(altMode, 'LIVE_DATA_REQUIRED') + ':-${' + envVar(mode, 'LIVE_DATA_REQUIRED') + '}}', "\""),
         "export RESOLVEIO_QA_LIVE_DATA_REQUIRED=\"".concat('${RESOLVEIO_QA_LIVE_DATA_REQUIRED:-$' + envVar(mode, 'LIVE_DATA_REQUIRED') + '}', "\""),
-        'export PUPPETEER_CACHE_DIR="${PUPPETEER_CACHE_DIR:-/var/lib/resolveio/puppeteer}"',
-        'if [ ! -d "$PUPPETEER_CACHE_DIR" ] || [ ! -w "$PUPPETEER_CACHE_DIR" ]; then',
-        '  export PUPPETEER_CACHE_DIR="$RESOLVEIO_QA_TMP/puppeteer"',
-        '  mkdir -p "$PUPPETEER_CACHE_DIR"',
+        'export PUPPETEER_CACHE_DIR="/var/lib/resolveio/puppeteer"',
+        'RESOLVEIO_QA_NODE_PATH_ENTRIES=""',
+        'for RESOLVEIO_QA_NODE_MODULES in "$PWD/node_modules" "$PWD/server/node_modules" "$(cd "$PWD/.." 2>/dev/null && pwd)/node_modules" "$(cd "$PWD/.." 2>/dev/null && pwd)/server/node_modules" /var/app/current/node_modules; do',
+        '  if [ -d "$RESOLVEIO_QA_NODE_MODULES" ]; then',
+        '    if [ -z "$RESOLVEIO_QA_NODE_PATH_ENTRIES" ]; then RESOLVEIO_QA_NODE_PATH_ENTRIES="$RESOLVEIO_QA_NODE_MODULES"; else RESOLVEIO_QA_NODE_PATH_ENTRIES="$RESOLVEIO_QA_NODE_PATH_ENTRIES:$RESOLVEIO_QA_NODE_MODULES"; fi',
+        '  fi',
+        'done',
+        'if [ -n "$RESOLVEIO_QA_NODE_PATH_ENTRIES" ]; then',
+        '  export NODE_PATH="${NODE_PATH:+$NODE_PATH:}$RESOLVEIO_QA_NODE_PATH_ENTRIES"',
         'fi',
+        'unset RESOLVEIO_QA_NODE_MODULES RESOLVEIO_QA_NODE_PATH_ENTRIES',
         'export PLAYWRIGHT_BROWSERS_PATH="${PLAYWRIGHT_BROWSERS_PATH:-$RESOLVEIO_QA_HOME/.cache/ms-playwright}"',
+        '# QA rows should launch their own scoped browser unless the runner explicitly provides a live endpoint later.',
+        'unset RESOLVEIO_RUNNER_QA_BROWSER_URL RESOLVEIO_SUPPORT_QA_BROWSER_URL',
         'if [ -n "${PUPPETEER_EXECUTABLE_PATH:-}" ] && [ -x "$PUPPETEER_EXECUTABLE_PATH" ]; then',
         '  export CHROME_BIN="${CHROME_BIN:-$PUPPETEER_EXECUTABLE_PATH}"',
         'elif [ -n "${CHROME_BIN:-}" ] && [ -x "$CHROME_BIN" ]; then',
         '  export PUPPETEER_EXECUTABLE_PATH="$CHROME_BIN"',
         'else',
-        "  for ".concat(browserLoopVar, " in \"$PUPPETEER_CACHE_DIR\"/chrome-headless-shell/linux-*/chrome-headless-shell-linux64/chrome-headless-shell \"$PUPPETEER_CACHE_DIR\"/chrome/linux-*/chrome-linux64/chrome \"$PLAYWRIGHT_BROWSERS_PATH\"/chromium_headless_shell-*/chrome-headless-shell-linux64/chrome-headless-shell \"$PLAYWRIGHT_BROWSERS_PATH\"/chromium-*/chrome-linux64/chrome /usr/bin/google-chrome-stable /usr/bin/google-chrome /usr/bin/chromium /usr/bin/chromium-browser; do"),
+        "  for ".concat(browserLoopVar, " in /var/lib/resolveio/puppeteer/chrome-headless-shell/linux-*/chrome-headless-shell-linux64/chrome-headless-shell /var/lib/resolveio/puppeteer/chrome/linux-*/chrome-linux64/chrome /usr/bin/google-chrome-stable /usr/bin/google-chrome /usr/bin/chromium /usr/bin/chromium-browser; do"),
         "    if [ -x \"$".concat(browserLoopVar, "\" ]; then"),
         "      export PUPPETEER_EXECUTABLE_PATH=\"$".concat(browserLoopVar, "\""),
         "      export CHROME_BIN=\"$".concat(browserLoopVar, "\""),
@@ -797,7 +867,7 @@ function buildResolveIORunnerLocalQaScript() {
         '  SERVER_REQUIRED=1',
         '  if [ "${RESOLVEIO_QA_PRESTART_MONGO_READY:-}" = "1" ] && [ -x "$PROJECT_ROOT/server/node_modules/gulp/bin/gulp.js" ] && [ -f "$PROJECT_ROOT/server/gulpfile.js" ] && grep -q "mongo-start" "$PROJECT_ROOT/server/gulpfile.js"; then',
         '    echo "ResolveIO AI runner QA using pre-seeded local Mongo; starting server without mongo-start." | tee -a "$ARTIFACT_DIR/runner.log"',
-        '    (cd "$PROJECT_ROOT/server" && source "$TOOLS_DIR/env.sh" && if [ -f "$HOME/.nvm/nvm.sh" ]; then source "$HOME/.nvm/nvm.sh"; nvm use 22 >/dev/null 2>&1 || true; fi; node_modules/gulp/bin/gulp.js 2>&1 | tee "$ARTIFACT_DIR/server.log") &',
+        '    (cd "$PROJECT_ROOT/server" && source "$TOOLS_DIR/env.sh" && if [ -f "$HOME/.nvm/nvm.sh" ]; then source "$HOME/.nvm/nvm.sh"; nvm use 22 >/dev/null 2>&1 || true; fi; { node_modules/gulp/bin/gulp.js compile dotenv methodAndPublicationListGenerator && echo "ResolveIO AI runner QA starting node tmp/index.js" && node --inspect=127.0.0.1:"$INSPECT_PORT" --max_old_space_size=3000 tmp/index.js; } 2>&1 | tee "$ARTIFACT_DIR/server.log") &',
         '  elif node -e "const p=require(process.argv[1]); process.exit(p.scripts&&p.scripts.server?0:1)" "$PROJECT_ROOT/server/package.json" >/dev/null 2>&1; then',
         '    (cd "$PROJECT_ROOT/server" && source "$TOOLS_DIR/env.sh" && npm run server 2>&1 | tee "$ARTIFACT_DIR/server.log") &',
         '  elif [ -x "$PROJECT_ROOT/server/start_server.sh" ]; then',
@@ -814,7 +884,8 @@ function buildResolveIORunnerLocalQaScript() {
         'CLIENT_HOST="${RESOLVEIO_RUNNER_QA_CLIENT_HOST:-${RESOLVEIO_SUPPORT_QA_CLIENT_HOST:-0.0.0.0}}"',
         'if [ -x "$PROJECT_ROOT/node_modules/.bin/ng" ]; then',
         '  prepare_angular_cache_dirs',
-        '  (cd "$PROJECT_ROOT" && source "$TOOLS_DIR/env.sh" && node --max_old_space_size=8048 ./node_modules/.bin/ng serve --watch --configuration local --host "$CLIENT_HOST" --port "$CLIENT_PORT" "${ANGULAR_PREBUNDLE_ARGS[@]}" 2>&1 | tee "$ARTIFACT_DIR/client.log") &',
+        '  ANGULAR_OLD_SPACE="${RESOLVEIO_RUNNER_QA_ANGULAR_OLD_SPACE_MB:-${RESOLVEIO_SUPPORT_QA_ANGULAR_OLD_SPACE_MB:-3072}}"',
+        '  (cd "$PROJECT_ROOT" && source "$TOOLS_DIR/env.sh" && node --max_old_space_size="$ANGULAR_OLD_SPACE" ./node_modules/.bin/ng serve --watch --configuration local --host "$CLIENT_HOST" --port "$CLIENT_PORT" "${ANGULAR_PREBUNDLE_ARGS[@]}" 2>&1 | tee "$ARTIFACT_DIR/client.log") &',
         'elif [ -x "$PROJECT_ROOT/start_client.sh" ]; then',
         '  (cd "$PROJECT_ROOT" && source "$TOOLS_DIR/env.sh" && ./start_client.sh 2>&1 | tee "$ARTIFACT_DIR/client.log") &',
         'elif node -e "const p=require(process.argv[1]); process.exit(p.scripts&&p.scripts.client?0:1)" "$PROJECT_ROOT/package.json" >/dev/null 2>&1; then',
@@ -1014,6 +1085,7 @@ function buildResolveIORunnerQaLiveDataSeederScript() {
         '#!/usr/bin/env node',
         'const fs = require("fs");',
         'const path = require("path");',
+        'const crypto = require("crypto");',
         '',
         'if (isBuildLane()) {',
         '  console.error("ResolveIO support lane guard: live-data seeding is owned by the QA lane, not the 5.3 build lane.");',
@@ -1217,16 +1289,153 @@ function buildResolveIORunnerQaLiveDataSeederScript() {
         '',
         'function unique(values) { return Array.from(new Set((values || []).filter(Boolean).map(String))); }',
         '',
+        'function collectEmailLikeValues(value, out = new Set(), depth = 0) {',
+        '  if (depth > 6 || value == null) return out;',
+        '  if (typeof value === "string") {',
+        '    const matches = value.match(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}/gi) || [];',
+        '    matches.forEach((email) => out.add(String(email || "").trim().toLowerCase()));',
+        '    return out;',
+        '  }',
+        '  if (Array.isArray(value)) { value.forEach((entry) => collectEmailLikeValues(entry, out, depth + 1)); return out; }',
+        '  if (typeof value === "object") { Object.values(value).forEach((entry) => collectEmailLikeValues(entry, out, depth + 1)); }',
+        '  return out;',
+        '}',
+        '',
+        'function readContextJsonFiles() {',
+        '  const files = [',
+        '    path.join(artifactDir, "manual-ticket.metadata.json"),',
+        '    path.join(artifactDir, "email.metadata.json"),',
+        '    path.join(repoRoot, ".resolveio-support-context", "manual-ticket.metadata.json"),',
+        '    path.join(projectRoot, ".resolveio-support-context", "manual-ticket.metadata.json"),',
+        '    path.join(repoRoot, ".resolveio-support-context", "email.metadata.json"),',
+        '    path.join(projectRoot, ".resolveio-support-context", "email.metadata.json"),',
+        '    path.join(repoRoot, ".resolveio-context", "manual-ticket.metadata.json"),',
+        '    path.join(projectRoot, ".resolveio-context", "manual-ticket.metadata.json"),',
+        '    path.join(repoRoot, ".resolveio-context", "email.metadata.json"),',
+        '    path.join(projectRoot, ".resolveio-context", "email.metadata.json")',
+        '  ];',
+        '  return files.map((file) => readJsonIfExists(file)).filter(Boolean);',
+        '}',
+        '',
+        'function extractQaUserHints() {',
+        '  const affected = unique([',
+        '    process.env.RESOLVEIO_QA_AFFECTED_USER_EMAIL,',
+        '    process.env.RESOLVEIO_SUPPORT_QA_AFFECTED_USER_EMAIL,',
+        '    process.env.RESOLVEIO_RUNNER_QA_AFFECTED_USER_EMAIL',
+        '  ].map((value) => String(value || "").trim().toLowerCase()).filter(Boolean));',
+        '  const reporter = unique([',
+        '    process.env.RESOLVEIO_QA_TICKET_REPORTER_EMAIL,',
+        '    process.env.RESOLVEIO_SUPPORT_QA_TICKET_REPORTER_EMAIL,',
+        '    process.env.RESOLVEIO_RUNNER_QA_TICKET_REPORTER_EMAIL',
+        '  ].map((value) => String(value || "").trim().toLowerCase()).filter(Boolean));',
+        '  const explicitQa = unique([',
+        '    process.env.RESOLVEIO_QA_USERNAME,',
+        '    process.env.RESOLVEIO_SUPPORT_QA_USERNAME,',
+        '    process.env.RESOLVEIO_RUNNER_QA_USERNAME',
+        '  ].map((value) => String(value || "").trim().toLowerCase()).filter((value) => value && !/^(admin|dev@resolveio\\.com)$/i.test(value)));',
+        '  const contextEmails = new Set();',
+        '  readContextJsonFiles().forEach((json) => collectEmailLikeValues(json, contextEmails));',
+        '  collectEmailLikeValues(readSeedHintText(), contextEmails);',
+        '  const candidates = unique([...affected, ...reporter, ...explicitQa, ...Array.from(contextEmails)]);',
+        '  return { affected, reporter, explicitQa, candidates: candidates.slice(0, 12) };',
+        '}',
+        '',
+        'function qaUserLookupQuery(candidates) {',
+        '  const ors = [];',
+        '  for (const candidate of candidates || []) {',
+        '    const value = String(candidate || "").trim();',
+        '    if (!value) continue;',
+        '    ors.push({ username: value }, { email: value }, { "emails.address": value });',
+        '  }',
+        '  return ors.length ? { $or: ors } : null;',
+        '}',
+        '',
+        'function normalizeSeededQaUser(doc, password) {',
+        '  const now = new Date();',
+        '  const next = { ...(doc || {}) };',
+        '  const other = next.other && typeof next.other === "object" ? next.other : {};',
+        '  const settings = next.settings && typeof next.settings === "object" ? next.settings : {};',
+        '  next.active = true;',
+        '  next.readonly = false;',
+        '  next.other = { ...other, tour_completed: true, took_tour: true, core_tour_completed: true, welcome_tour_completed: true, top_navigation_tour_completed: true, user_settings_tour_completed: true };',
+        '  next.settings = { ...settings, collapsable_menu: false };',
+        '  next.updatedAt = now;',
+        '  if (password) {',
+        '    const salt = crypto.randomBytes(32).toString("hex");',
+        '    next.salt = salt;',
+        '    next.hash = crypto.pbkdf2Sync(password, salt, 25000, 512, "sha256").toString("hex");',
+        '    if (next.services && typeof next.services === "object" && next.services.password) delete next.services.password;',
+        '    next.attempts = 0;',
+        '  }',
+        '  return next;',
+        '}',
+        '',
+        'async function copyQaIdentityUsers(sourceDb, targetDb, summary) {',
+        '  const hints = extractQaUserHints();',
+        '  summary.selected.qa_user_hints = hints;',
+        '  const query = qaUserLookupQuery(hints.candidates);',
+        '  if (!query) return [];',
+        '  const users = await sourceDb.collection("users").find(query).limit(8).toArray();',
+        '  if (!users.length) {',
+        '    summary.notes.push(`No live user matched QA identity hints: ${hints.candidates.join(", ")}`);',
+        '    return [];',
+        '  }',
+        '  const password = process.env.RESOLVEIO_RUNNER_QA_PASSWORD || process.env.RESOLVEIO_SUPPORT_QA_PASSWORD || "";',
+        '  for (const user of users) {',
+        '    const normalized = normalizeSeededQaUser(user, password);',
+        '    await targetDb.collection("users").replaceOne({ _id: normalized._id }, normalized, { upsert: true });',
+        '  }',
+        '  summary.collections.users = (summary.collections.users || 0) + users.length;',
+        '  const preferred = users.find((user) => hints.affected.includes(String(user.email || user.username || "").toLowerCase()))',
+        '    || users.find((user) => hints.reporter.includes(String(user.email || user.username || "").toLowerCase()))',
+        '    || users[0];',
+        '  summary.selected.qa_user_context = {',
+        '    preferred_username: String(preferred && (preferred.email || preferred.username) || "").trim(),',
+        '    preferred_email: String(preferred && preferred.email || "").trim(),',
+        '    preferred_user_id: String(preferred && preferred._id || "").trim(),',
+        '    affected_user_email: hints.affected[0] || "",',
+        '    reporter_email: hints.reporter[0] || "",',
+        '    copied_user_ids: users.map((user) => String(user && user._id || "")).filter(Boolean),',
+        '    reason: hints.affected.length ? "affected_user" : (hints.reporter.length ? "ticket_reporter" : "context_email")',
+        '  };',
+        '  summary.notes.push(`Seeded ${users.length} live QA identity user(s); preferred browser QA user is ${summary.selected.qa_user_context.preferred_username || summary.selected.qa_user_context.preferred_user_id}.`);',
+        '  return users;',
+        '}',
+        '',
         'function readSeedHintText() {',
-        '  const chunks = [process.env.RESOLVEIO_QA_SEED_HINTS || "", process.env.RESOLVEIO_SUPPORT_QA_SEED_HINTS || "", process.env.RESOLVEIO_RUNNER_QA_SEED_HINTS || ""];',
+        '  const chunks = [',
+        '    process.env.RESOLVEIO_SUPPORT_QA_ROW_FILTER || "",',
+        '    process.env.RESOLVEIO_SUPPORT_QA_CURRENT_ROW_WORKFLOW || "",',
+        '    process.env.RESOLVEIO_SUPPORT_QA_CURRENT_ROW_ASSERTION || "",',
+        '    process.env.RESOLVEIO_RUNNER_QA_ROW_FILTER || "",',
+        '    process.env.RESOLVEIO_RUNNER_QA_CURRENT_ROW_WORKFLOW || "",',
+        '    process.env.RESOLVEIO_RUNNER_QA_CURRENT_ROW_ASSERTION || "",',
+        '    process.env.RESOLVEIO_QA_SEED_HINTS || "",',
+        '    process.env.RESOLVEIO_SUPPORT_QA_SEED_HINTS || "",',
+        '    process.env.RESOLVEIO_RUNNER_QA_SEED_HINTS || ""',
+        '  ];',
         '  const candidates = [',
+        '    path.join(artifactDir, "qa-coverage-matrix.json"),',
+        '    path.join(artifactDir, "qa-row-lock.json"),',
         '    path.join(repoRoot, ".resolveio-support-context", "manual-ticket.request.txt"),',
         '    path.join(projectRoot, ".resolveio-support-context", "manual-ticket.request.txt"),',
         '    path.join(repoRoot, ".resolveio-context", "manual-ticket.request.txt"),',
         '    path.join(projectRoot, ".resolveio-context", "manual-ticket.request.txt")',
         '  ];',
         '  for (const candidate of candidates) {',
-        '    try { chunks.push(fs.readFileSync(candidate, "utf8")); } catch (error) {}',
+        '    try {',
+        '      const raw = fs.readFileSync(candidate, "utf8");',
+        '      chunks.push(raw);',
+        '      if (/qa-coverage-matrix\\.json$/.test(candidate)) {',
+        '        const matrix = JSON.parse(raw);',
+        '        const rows = Array.isArray(matrix && matrix.rows) ? matrix.rows : [];',
+        '        for (const row of rows) chunks.push([row.workflow, row.route, row.assertion, row.required_proof, row.data_id, row.data_name, row.blocker, row.evidence, row.caption].filter(Boolean).join("\\n"));',
+        '      }',
+        '      if (/qa-row-lock\\.json$/.test(candidate)) {',
+        '        const lock = JSON.parse(raw);',
+        '        chunks.push([lock.workflow, lock.route, lock.assertion, lock.required_proof, lock.rowFilter, lock.blocker].filter(Boolean).join("\\n"));',
+        '      }',
+        '    } catch (error) {}',
         '  }',
         '  return chunks.filter(Boolean).join("\\n");',
         '}',
@@ -1275,6 +1484,11 @@ function buildResolveIORunnerQaLiveDataSeederScript() {
         '    const value = String(match[1] || "").trim();',
         '    if (isUsefulSeedIdentifier(value)) identifiers.add(value);',
         '  }',
+        '  const typedUnit = /\\b(?:truck|trailer|unit|asset)\\s+([A-Z0-9][A-Z0-9._-]{1,})\\b/gi;',
+        '  while ((match = typedUnit.exec(text)) !== null) {',
+        '    const value = String(match[1] || "").trim();',
+        '    if (isUsefulSeedIdentifier(value)) identifiers.add(value);',
+        '  }',
         '  if (shouldAutoDiscoverAssetContext()) extractSeedIdentifiers().forEach((value) => identifiers.add(value));',
         '  return Array.from(identifiers).slice(0, 20);',
         '}',
@@ -1297,7 +1511,9 @@ function buildResolveIORunnerQaLiveDataSeederScript() {
         '  const explicit = /\\b(?:invoice|inv|bol|order|pso|ticket|wo|work\\s*order|delivery|treatment)\\s*(?:#|no\\.?|number|num)?\\s*[:#-]?\\s*([A-Z0-9][A-Z0-9._-]{2,})\\b/gi;',
         '  let match;',
         '  while ((match = explicit.exec(text)) !== null) identifiers.add(match[1]);',
-        '  const numeric = /\\b\\d{4,}\\b/g;',
+        '  const typedUnit = /\\b(?:truck|trailer|asset|unit)\\s+([A-Z0-9][A-Z0-9._-]{1,})\\b/gi;',
+        '  while ((match = typedUnit.exec(text)) !== null) identifiers.add(match[1]);',
+        '  const numeric = /\\b\\d{3,}\\b/g;',
         '  while ((match = numeric.exec(text)) !== null) identifiers.add(match[0]);',
         '  return Array.from(identifiers)',
         '    .map((value) => String(value || "").trim())',
@@ -1772,6 +1988,7 @@ function buildResolveIORunnerQaLiveDataSeederScript() {
         '  const summary = { profile: includeBillingFixtures ? "billing_inventory" : "live_context", collections: {}, selected: {}, notes: [] };',
         '  const identifiers = extractSeedIdentifiers();',
         '  summary.selected.seed_identifiers = identifiers;',
+        '  const qaIdentityUsers = await copyQaIdentityUsers(sourceDb, targetDb, summary);',
         '  const truckTreatingBolContextDocs = await copyTruckTreatingBolContext(sourceDb, targetDb, summary);',
         '  const ticketAssetContextDocs = await copyTicketAssetContext(sourceDb, targetDb, summary);',
         '  const productionInterchangeablesContextDocs = await copyProductionInterchangeablesContext(sourceDb, targetDb, summary);',
@@ -1813,7 +2030,7 @@ function buildResolveIORunnerQaLiveDataSeederScript() {
         '    summary.notes.push("No live billable delivery or truck-treatment records matched the Billing Dashboard awaiting-invoice filters.");',
         '  }',
         '',
-        '  const sourceDocs = [...truckTreatingBolContextDocs, ...ticketAssetContextDocs, ...productionInterchangeablesContextDocs, ...productionDeliveries, ...truckTreatingDeliveries];',
+        '  const sourceDocs = [...qaIdentityUsers, ...truckTreatingBolContextDocs, ...ticketAssetContextDocs, ...productionInterchangeablesContextDocs, ...productionDeliveries, ...truckTreatingDeliveries];',
         '  const customerIds = idValues(sourceDocs, ["id_customer"]);',
         '  const locationIds = idValues(sourceDocs, ["id_location"]);',
         '  const wellGroupIds = idValues(sourceDocs, ["id_well_group"]);',
@@ -2234,9 +2451,52 @@ function buildResolveIORunnerQaWorkflowProbeScript() {
         'async function pageSummary(page) {',
         '	return page.evaluate(() => {',
         '		const bodyText = (document.body && document.body.innerText || "").replace(/\\s+/g, " ").trim();',
-        '		return { url: location.href, title: document.title, bodyTextSnippet: bodyText.slice(0, 1200), hasLoginText: /Employee\\/Customer Login|Employee Sign In|Customer Access|Unable to sign in/i.test(bodyText), hasOfflineModeText: bodyText.includes("*** OFFLINE MODE ***") };',
+        '		const rows = Array.from(document.querySelectorAll("tr")).map(row => (row.innerText || "").replace(/\\s+/g, " ").trim()).filter(Boolean);',
+        '		return { url: location.href, title: document.title, bodyTextSnippet: bodyText.slice(0, 1200), rowCount: rows.length, rows: rows.slice(0, 8), hasLoginText: /Employee\\/Customer Login|Employee Sign In|Customer Access|Unable to sign in/i.test(bodyText), hasOfflineModeText: bodyText.includes("*** OFFLINE MODE ***"), storageState: { hasRefreshToken: !!localStorage.getItem("refreshToken"), hasAccessToken: !!localStorage.getItem("accessToken"), hasUser: !!localStorage.getItem("user") } };',
         '	});',
         '}',
+        'function pathMatchesRoute(currentUrl, expectedRoute) {',
+        '	try {',
+        '		const current = new URL(currentUrl);',
+        '		const expected = new URL(expectedRoute, clientUrl);',
+        '		return current.pathname.replace(/\\/+$/, "") === expected.pathname.replace(/\\/+$/, "");',
+        '	} catch (error) {',
+        '		return false;',
+        '	}',
+        '}',
+        'async function waitForAuthenticatedApp(page) {',
+        '	await page.goto(`${clientUrl}/home`, { waitUntil: "domcontentloaded", timeout: 60000 });',
+        '	const deadline = Date.now() + Number(process.env.RESOLVEIO_RUNNER_QA_AUTH_WARMUP_TIMEOUT_MS || process.env.RESOLVEIO_SUPPORT_QA_AUTH_WARMUP_TIMEOUT_MS || 45000);',
+        '	let summary = await pageSummary(page);',
+        '	while (Date.now() < deadline) {',
+        '		summary = await pageSummary(page);',
+        '		if (!summary.hasLoginText && !summary.hasOfflineModeText && summary.storageState.hasRefreshToken && summary.storageState.hasAccessToken && summary.storageState.hasUser) {',
+        '			await delay(Number(process.env.RESOLVEIO_RUNNER_QA_POST_AUTH_SETTLE_MS || process.env.RESOLVEIO_SUPPORT_QA_POST_AUTH_SETTLE_MS || 2500));',
+        '			return await pageSummary(page);',
+        '		}',
+        '		await delay(1000);',
+        '	}',
+        '	throw new Error(`QA auth warmup failed before target route. Page summary: ${JSON.stringify(summary).slice(0, 1000)}`);',
+        '}',
+        'async function waitForHydratedTargetRoute(page) {',
+        '	const deadline = Date.now() + Number(process.env.RESOLVEIO_RUNNER_QA_ROUTE_HYDRATION_TIMEOUT_MS || process.env.RESOLVEIO_SUPPORT_QA_ROUTE_HYDRATION_TIMEOUT_MS || 45000);',
+        '	let summary = await pageSummary(page);',
+        '	while (Date.now() < deadline) {',
+        '		summary = await pageSummary(page);',
+        '		const routeOk = pathMatchesRoute(summary.url, targetRoute);',
+        '		const shellOnly = !summary.bodyTextSnippet || /^(Home|MENU|Logout|\\u00A9|The All-in-One Software)\\b/i.test(summary.bodyTextSnippet);',
+        '		if (routeOk && !summary.hasLoginText && !summary.hasOfflineModeText && !shellOnly) {',
+        '			return summary;',
+        '		}',
+        '		if (summary.hasLoginText || summary.hasOfflineModeText || !routeOk || shellOnly) {',
+        '			await delay(1500);',
+        '			await page.goto(new URL(targetRoute, clientUrl).href, { waitUntil: "domcontentloaded", timeout: 60000 }).catch(() => null);',
+        '		} else {',
+        '			await delay(1500);',
+        '		}',
+        '	}',
+        '	throw new Error(`QA route hydration failed for ${targetRoute}. Page summary: ${JSON.stringify(summary).slice(0, 1000)}`);',
+        '}',
         'function billingDashboardHasVisibleWork(text) {',
         '	const value = String(text || "");',
         '	const patterns = [',
@@ -2292,10 +2552,10 @@ function buildResolveIORunnerQaWorkflowProbeScript() {
         '		await page.setViewport({ width: viewportWidth, height: viewportHeight });',
         '		const auth = await login();',
         '		await seedAuth(page, auth);',
+        '		await waitForAuthenticatedApp(page);',
         '		await page.goto(`${clientUrl}${targetRoute}`, { waitUntil: "domcontentloaded", timeout: 60000 });',
         '		await page.waitForSelector("body", { timeout: 30000 });',
-        '		await delay(2500);',
-        '		let summary = await pageSummary(page);',
+        '		let summary = await waitForHydratedTargetRoute(page);',
         '		if (summary.hasLoginText || summary.hasOfflineModeText || !summary.bodyTextSnippet) throw new Error(`Workflow route did not reach authenticated app: ${JSON.stringify(summary).slice(0, 1000)}`);',
         '		summary = await waitForBillingDashboardWork(page) || summary;',
         '		const caption = `Workflow route ready: ${targetRoute} loaded in authenticated local QA with live seeded data available.`;',
@@ -2353,8 +2613,14 @@ function buildResolveIORunnerQaToolsReadme(options) {
         'Do not use version-fragile browser helpers such as `page.$x` or `page.waitForTimeout`; use DOM traversal/locator-compatible helpers and a local `delay(ms)` promise helper, then rerun the same matrix row if the QA script itself fails.',
         'Do not run `npm run build-dev`, `ng build`, or another Angular compile while keepalive `ng serve` is running. If a full Angular build is required after browser QA, first run the staged `stop-local-qa.sh`, then build, then restart `run-local-qa.sh` for final browser proof.',
         'Use desktop screenshots at 1920x1080 by default unless the task is explicitly mobile/responsive. Every screenshot must have a customer-facing caption.',
+        'For From/To, source/target, dropdown, combobox, rio-select, filter, item, customer, yard, chemical, or treatment-plan selection workflows, capture pass screenshots only after the selected values are visible in the controls/chips/labels. The QA matrix data/assertion/caption must name the selected values; empty controls, placeholder text, or route-load screenshots are blocker evidence, not pass evidence.',
         'For import/export/form-submit/data workflows, prove before/action/after with representative data and a concrete row/count/value assertion.',
+        'For pricing import/upload bugs, drive the actual Manage Pricing browser import for the attached/template variants and assert localhost Mongo pricing row/count/value changes. Validator-only proof must fail.',
+        'For asset location/current-yard bugs, prove the exact asset/unit on list, detail, and edit/save screens, with a joined/canonical yard assertion and stale yard name absence proof.',
+        'For Update Interchangeables/Mass Update chemical bugs, select the real source and target chemicals, run the update, and assert before/after treatment-plan/tank document counts or ids in localhost Mongo. Route-load or dropdown-only proof must fail.',
         'For data-backed workflows, run `qa-live-data-seed.js` after the local app is ready and before browser clickthrough. It reads a bounded live-data slice from `RESOLVEIO_QA_LIVE_MONGO_URL` or staged mongo context, writes only to localhost QA Mongo, prefers ticket-mentioned invoice/BOL/order/ticket identifiers, and records `qa-artifacts/qa-live-data-seed-result.json`.',
+        'For support-ticket QA, use the ticket reporter or named affected user when the live seed can identify/copy that user. `qa-live-data-seed-result.json.selected.qa_user_context` and `auth-bootstrap-result.json.user` must agree, or the row is not ready to pass.',
+        'For customer-reported data bugs, QA must seed and prove the exact named production records in local QA. If the exact unit/BOL/invoice/chemical/customer/yard/user is missing, fail with a seed/query blocker instead of switching to a representative record.',
         'For bug fixes, use `bugfix-comparison-qa.sh` so baseline/master runs the exact same repro before the candidate/PR run. A passing candidate is not enough unless the comparison result shows baseline failed or the report explicitly explains why the baseline failure could not be reproduced.',
         "Use `$".concat(usernameVar, "` and `$").concat(passwordVar, "` for the local fixture admin account unless ticket/app-specific credentials are provided."),
         'The env file reuses `/var/lib/resolveio/puppeteer`, npm cache, worker-safe Browserslist settings, and Angular cache prep so QA should not download a browser or rebuild cold caches unnecessarily.',