@sun-asterisk/sungen 3.2.24-beta.6 → 3.2.25

package/src/exporters/json-exporter.ts

@@ -16,7 +16,7 @@ import {
 } from './feature-parser';
 import { formatPrecondition, groupExpectedByAnchor, keepActor, stripActor } from './step-formatter';
 import { formatTestData, substituteTestDataVars } from './test-data-resolver';
-import { collectSecretValues, formatApiExpected, formatApiRequest, hasApiCalls, redactSecrets } from './api-testcase-formatter';
+import { collectSecretValues, formatApiCallSummaryLines, formatApiExpected, formatApiRequest, hasApiCalls, redactSecrets } from './api-testcase-formatter';
 import {
   formatExecutedDate,
   statusToTestResult,
@@ -99,9 +99,14 @@ export function buildScreenSnapshot(input: BuildScreenSnapshotInput): ScreenSnap
     };
     const formatStep = (s: { text: string; bucket: 'given' | 'when' | 'then' }) =>
       localize(s.bucket === 'given' ? keepActor(s.text) : stripActor(s.text));
+    // Same `@api:` precondition lines as csv-exporter's buildTestCaseRows — the
+    // dashboard and the delivery CSV must not disagree about what a row does.
+    const apiCallLines = (input.kind === 'screen' || input.kind === 'flow') && input.apiCatalog && hasApiCalls(m.feature.tags)
+      ? formatApiCallSummaryLines(m.feature.tags, input.apiCatalog)
+      : [];
     const precondition = formatPrecondition(
       authRole,
-      (m.resolvedBackgroundSteps ?? []).map(formatStep).filter(Boolean)
+      [...(m.resolvedBackgroundSteps ?? []).map(formatStep).filter(Boolean), ...apiCallLines]
     );
     let steps = m.resolvedSteps.map(formatStep).filter(Boolean);
     // Same anchor rule as csv-exporter (shared groupExpectedByAnchor) so the

package/src/exporters/matrix/build.ts

@@ -7,6 +7,7 @@
 
 import { ApiCatalogEntry, FeatureMetadata, PlaywrightResult } from '../types';
 import { formatApiCallLines, parseApiCalls } from '../api-testcase-formatter';
+import { collectQaEnvSecretDenylist } from '../qa-env-secret-denylist';
 import { bucketTexts } from './step-buckets';
 import { MergedScenario } from '../scenario-merger';
 import {
@@ -140,6 +141,10 @@ export function deriveVariants(inputs: Pick<BuildInputs, 'feature' | 'merged' |
     const { vpId, category1 } = splitVpAndName(m.feature.name);
     if (!vpId) continue; // Gate A reports it — no variant can be addressed without a VP-id
     const tags = m.feature.tags;
+    // @exploration probes live outside the official suite (the same contract the audit's
+    // source-tracing exemption follows) — they never become deliverable coverage variants,
+    // so the gates and the map never ask for them.
+    if (tags.some((t) => /^@exploration\b/i.test(t))) continue;
     const mode = extractTestcaseType(tags) === 'Manual' ? 'manual' : 'auto';
     const authRole = extractAuthRole(tags);
     // Category segment of the id, whatever the project's scheme:
@@ -513,6 +518,9 @@ export function expandMapRef(ref: string, variantsByVp: Map<string, CoverageVari
 export function buildMatrix(inputs: BuildInputs): MatrixModel {
   const { unit, map, transformerVersion } = inputs;
   const variants = deriveVariants(inputs);
+  // Same denylist the testcases CSV applies to its Note column — the matrix error
+  // cells render the same failure messages and go into the same client hand-off.
+  const secretValues = inputs.testData ? collectQaEnvSecretDenylist(inputs.testData).values : [];
 
   const variantsByVp = new Map<string, CoverageVariant[]>();
   for (const v of variants) {
@@ -612,6 +620,7 @@ export function buildMatrix(inputs: BuildInputs): MatrixModel {
     dispositions,
     requirements,
     findings,
+    secretValues,
     manifest: {
       unit,
       transformerVersion,

package/src/exporters/matrix/export.ts

@@ -53,7 +53,7 @@ function readSpecText(paths: MatrixTargetPaths): string {
     : '';
 }
 
-/** apis.yaml endpoint catalog for an api unit ({} for screen/flow — loader no-ops). */
+/** apis.yaml endpoint catalog — resolved for EVERY kind (screen/flow read their unit-scoped catalog + the shared one), so hybrid @api preconditions render their real request contract. */
 function catalogFor(paths: MatrixTargetPaths): Record<string, ApiCatalogEntry> {
   return loadApiCatalog(paths.cwd, paths.kind ?? 'screen', paths.area ?? paths.unit);
 }

package/src/exporters/matrix/render-csv.ts

@@ -5,6 +5,8 @@
  * and result), so downstream pipelines can re-derive both views from one file.
  */
 
+import { redactSecrets } from '../api-testcase-formatter';
+import { clipNoteField } from '../playwright-report-parser';
 import { variantState } from './build';
 import { coverageSummary, itemModeLabel, itemResultLabel } from './render-xlsx';
 import { MatrixModel } from './types';
@@ -75,7 +77,9 @@ export function renderMatrixCsv(model: MatrixModel): string {
         v.traces.join(' '),
         variantState(v),
         isoDate(v.result?.startTime),
-        v.result?.error ? String(v.result.error).slice(0, 200) : '',
+        // Redact BEFORE clipping — a clip boundary must never split a secret in
+        // a way that lets its prefix through. Same denylist as the Note column.
+        v.result?.error ? clipNoteField(redactSecrets(String(v.result.error), model.secretValues)) : '',
         '',
       ].map(esc).join(','));
     }

package/src/exporters/matrix/render-xlsx.ts

@@ -27,6 +27,8 @@ import {
   BLACK,
   LAVENDER,
 } from '../xlsx-report-builder';
+import { redactSecrets } from '../api-testcase-formatter';
+import { clipNoteField } from '../playwright-report-parser';
 import { variantState } from './build';
 import { DeliveryItem, MatrixModel, MapCategory } from './types';
 
@@ -229,7 +231,8 @@ function addMatrixSheet(wb: ExcelJS.Workbook, model: MatrixModel, sungenVersion?
         variantState(v),
         isoDate(v.result?.startTime),
         '',
-        v.result?.error ? String(v.result.error).slice(0, 200) : '',
+        // Redact BEFORE clipping — same denylist as the testcases CSV Note column.
+        v.result?.error ? clipNoteField(redactSecrets(String(v.result.error), model.secretValues)) : '',
         '',
       ];
       vValues.forEach((val, i) => dataCell(vr.getCell(2 + i), val, { center: i === 9 }));

package/src/exporters/matrix/types.ts

@@ -235,6 +235,13 @@ export interface MatrixModel {
   manifest: MatrixManifest;
   /** Perf verdict (#569) — present when qa/perf.yaml sets a budget AND the run produced durations. */
   perf?: import('../../harness/perf').PerfVerdict | null;
+  /**
+   * Resolved ${QA_*} secret values referenced by this unit's test data. Failure
+   * messages quote runtime values (a Received: line can echo a typed password),
+   * so every error cell the renderers emit must be redacted against this list —
+   * the deliverable ships to the client.
+   */
+  secretValues: string[];
 }
 
 /** Complexity warning threshold (rules draft Gate I; raised for compact grouping) — echoed in the manifest. */

package/src/exporters/playwright-report-parser.ts

@@ -16,14 +16,22 @@ import { PlaywrightResult } from './types';
  * Candidate order (first existing wins):
  *   1. <genDir>/<featureBaseName>-test-result.<SUNGEN_ENV>.json  (env runs)
  *   2. <genDir>/<featureBaseName>-test-result.json               (per-feature reporter)
- *   3. <cwd>/test-results/results.<SUNGEN_ENV>.json
- *   4. <cwd>/test-results/results.json                           (playwright default)
+ *   3. <genDir>/<featureBaseName>-test-result.<os>[.<SUNGEN_ENV>].json — mobile per-OS
+ *      reporter files (wdio writes one per capability; a mobile project has NO base file).
+ *      MOBILE_PLATFORM picks the OS explicitly; otherwise android, then ios.
+ *   4. <cwd>/test-results/results.<SUNGEN_ENV>.json
+ *   5. <cwd>/test-results/results.json                           (playwright default)
  */
 export function resolveResultsPath(cwd: string, genDir: string, featureBaseName: string): string | null {
   const env = process.env.SUNGEN_ENV;
   const candidates: string[] = [];
   if (env) candidates.push(path.join(genDir, `${featureBaseName}-test-result.${env}.json`));
   candidates.push(path.join(genDir, `${featureBaseName}-test-result.json`));
+  const mobileOs = (process.env.MOBILE_PLATFORM || '').toLowerCase();
+  for (const os of mobileOs === 'android' || mobileOs === 'ios' ? [mobileOs] : ['android', 'ios']) {
+    if (env) candidates.push(path.join(genDir, `${featureBaseName}-test-result.${os}.${env}.json`));
+    candidates.push(path.join(genDir, `${featureBaseName}-test-result.${os}.json`));
+  }
   if (env) candidates.push(path.join(cwd, 'test-results', `results.${env}.json`));
   candidates.push(path.join(cwd, 'test-results', 'results.json'));
   for (const c of candidates) {
@@ -57,6 +65,9 @@ interface PlaywrightSpec {
       duration?: number;         // ms — Playwright emits this on every result (#569 perf budgets)
       startTime?: string;
       error?: { message?: string; stack?: string };
+      // ALL errors of the attempt. `error` above is only the first one — when a
+      // timeout interrupts an assertion, the assertion detail is errors[1+].
+      errors?: Array<{ message?: string; stack?: string }>;
       attachments?: Array<{ name?: string; path?: string; contentType?: string }>;
     }>;
   }>;
@@ -110,7 +121,30 @@ export function loadPlaywrightReport(reportPath: string): Map<string, Playwright
     const results = test?.results || [];
     const res = results[results.length - 1];
     const status = normalizeStatus(res?.status);
-    const errorMsg = stripAnsi(res?.error?.message || '');
+    // Collect EVERY failure message of the attempt, not just the first: a test
+    // timeout wraps the real assertion failure, so `error` alone holds only
+    // "Test timeout of 15000ms exceeded." while the Locator/Expected/Received
+    // detail QA needs sits in errors[1+]. Stack frames are stripped PER message
+    // before joining — otherwise the first message's stack swallows the rest
+    // when downstream consumers cut at the first "at " frame.
+    const rawMessages = (res?.errors?.length ? res.errors.map((e) => e.message) : [res?.error?.message])
+      .map((m) => stripAnsi(m || ''))
+      .filter(Boolean);
+    const distinct: string[] = [];
+    const seenKeys = new Set<string>();
+    for (const m of rawMessages) {
+      const stripped = m.split(/\n\s*at\s/)[0].trim();
+      // Key ignores a leading `Error:` — "Error: page closed" and "page closed"
+      // are the same failure and must not render as two Note bullets.
+      const key = stripped.replace(/^Error:\s*/i, '');
+      if (!key || seenKeys.has(key)) continue;
+      seenKeys.add(key);
+      distinct.push(stripped);
+    }
+    // Single message: keep the legacy shape (stack intact) so every existing
+    // consumer renders byte-identical output. Multiple: join the stack-stripped
+    // distinct messages so none can hide behind another's stack.
+    const errorMsg = distinct.length > 1 ? distinct.join('\n') : stripAnsi(res?.error?.message || rawMessages[0] || '');
     const trace = res?.attachments?.find((a) => a.name === 'trace' || a.contentType === 'application/zip')?.path;
 
     // Strip the leading file-path suite title if present.
@@ -124,6 +158,7 @@ export function loadPlaywrightReport(reportPath: string): Map<string, Playwright
       duration: typeof res?.duration === 'number' ? res.duration : undefined,
       startTime: res?.startTime,
       error: errorMsg,
+      errorMessages: distinct.length > 0 ? distinct : undefined,
       tracePath: trace,
       projectName: test?.projectName,
     });
@@ -178,7 +213,7 @@ function normalizeStatus(s: string | undefined): PlaywrightResult['status'] {
  * "specs/generated/kudos/kudos.spec.ts > Feature Name > ...",
  * strip that leading segment so matching works against "Feature Name > ...".
  */
-function stripLeadingFilePathSuite(fullTitle: string): string {
+export function stripLeadingFilePathSuite(fullTitle: string): string {
   const parts = fullTitle.split(' > ');
   if (parts.length > 1 && /\.spec\.ts$/i.test(parts[0])) {
     return parts.slice(1).join(' > ');
@@ -256,11 +291,23 @@ export function parseExpectedReceived(raw: string): { expected?: string; receive
 export function formatNote(result: PlaywrightResult | undefined, expectedFallback = ''): string {
   if (!result) return '';
   if (result.status !== 'failed' && result.status !== 'timedOut') return '';
-  // Full assertion message with stack frames dropped (frames start with "at ") + a leading `Error:`
-  // stripped. Keep newlines here so parseExpectedReceived can delimit the Expected/Received lines.
-  const raw = (result.error || '').split(/\n\s*at\s/)[0].replace(/^Error:\s*/i, '').trim();
-  const { expected, received } = parseExpectedReceived(raw);
-  const actual = received || clip(raw); // received value, else the raw error
+  // Per-message: stack frames dropped (frames start with "at ") + a leading `Error:` stripped.
+  // Keep newlines inside each message so parseExpectedReceived can delimit Expected/Received.
+  const messages = (result.errorMessages?.length ? result.errorMessages : [result.error || ''])
+    .map((m) => m.split(/\n\s*at\s/)[0].replace(/^Error:\s*/i, '').trim())
+    .filter(Boolean);
+  // The message that carries the assertion detail drives Expected/Actual; the other
+  // messages (e.g. the "Test timeout of 15000ms exceeded." wrapper) must still be
+  // shown — a real assertion failure rendered as a bare timeout reads as flaky.
+  // Prefer a message carrying BOTH halves: a half-match (Expected in one message,
+  // Received in another) would otherwise put the wrong text in Actual. With
+  // expect.soft the first assertion drives the split and the later assertion
+  // messages render as `• Error:` bullets — content preserved, columns describe #1.
+  const halves = (m: string): number => { const er = parseExpectedReceived(m); return (er.expected ? 1 : 0) + (er.received ? 1 : 0); };
+  const assertion = messages.find((m) => halves(m) === 2) ?? messages.find((m) => halves(m) >= 1) ?? messages[0] ?? '';
+  const wrappers = messages.filter((m) => m !== assertion);
+  const { expected, received } = parseExpectedReceived(assertion);
+  const actual = received || clip(assertion); // received value, else the raw error
 
   // Newline-separated bullets so each field lands on its own row when the cell wraps — matches the
   // Test Data column's `• key: value` formatting. Excel/CSV honour `\n` inside quoted cells; the
@@ -276,6 +323,18 @@ export function formatNote(result: PlaywrightResult | undefined, expectedFallbac
     else if (lines.length > 1) parts.push(`• Expected result:\n${lines.map((l) => `   ${l}`).join('\n')}`);
   }
   if (actual)           parts.push(`• Actual result: ${actual}`);
+  // Non-assertion companions of an assertion failure (timeout wrapper etc.), one
+  // clipped bullet each so no cell field can blow past the XLSX-safe cap.
+  for (const w of wrappers) parts.push(`• Error: ${clip(w)}`);
   if (result.tracePath) parts.push(`• Trace: ${result.tracePath}`);
   return parts.join('\n');
 }
+
+/**
+ * One-cell error rendering for the matrix deliverable: newlines collapsed and
+ * clipped to the same cap as Note fields. Replaces ad-hoc `slice(0, 200)` calls
+ * that could cut a joined multi-error message mid-assertion.
+ */
+export function clipNoteField(s: string): string {
+  return clip(s);
+}

package/src/exporters/results-merge.ts

@@ -0,0 +1,150 @@
+/**
+ * Merge two Playwright JSON reports by FULL TEST TITLE — the fix for subset
+ * re-runs: Playwright's JSON reporter overwrites the per-target result file,
+ * so re-running the 3 failed cases of a 100-case screen used to throw away
+ * the 97 passing results (QA then re-ran everything, or asked an AI to merge
+ * by hand — non-deterministic).
+ *
+ * Semantics (deterministic):
+ *   - same title in both → the NEW spec wins wholesale (its results, its
+ *     attempts, its timing);
+ *   - title only in base → kept as-is;
+ *   - title only in new → appended (its suite structure preserved).
+ * Titles compare AFTER stripping the leading file-path suite segment, so a
+ * base and a new report generated from different cwd/suite paths still match.
+ * `@cases` rows carry a ` — <label>` title suffix and merge as independent
+ * entries — re-running one dataset row keeps the other rows.
+ *
+ * The merge never deletes: a base title missing from the current spec (a
+ * scenario renamed by a spec edit) is a GHOST the caller may WARN about, but
+ * pruning is not this function's job — the delivery builds rows from the
+ * feature, so ghosts never render; only the dead `stats` block would drift,
+ * and it is recomputed below.
+ *
+ * Everything outside suites/specs/tests is passed through untouched from the
+ * BASE report (config, metadata, unknown future fields) — tolerance over
+ * strictness, the shape belongs to Playwright.
+ */
+
+import { stripLeadingFilePathSuite } from './playwright-report-parser';
+
+interface SpecRef {
+  title: string;            // stripped full title
+  parent: any[];            // the specs array holding the node
+  index: number;
+  node: any;
+}
+
+export interface MergeOutcome {
+  merged: any;
+  replaced: string[];       // titles taken from the new report over the base
+  added: string[];          // titles only in the new report (appended)
+  kept: string[];           // titles only in the base (untouched)
+}
+
+/** Collect every spec node with its stripped full title and parent array. */
+function collectSpecs(report: any): SpecRef[] {
+  const out: SpecRef[] = [];
+  const walk = (suites: any[] | undefined, stack: string[]): void => {
+    if (!Array.isArray(suites)) return;
+    for (const suite of suites) {
+      if (!suite || typeof suite !== 'object') continue;
+      const nextStack = typeof suite.title === 'string' && suite.title ? [...stack, suite.title] : stack;
+      if (Array.isArray(suite.specs)) {
+        suite.specs.forEach((spec: any, index: number) => {
+          if (!spec || typeof spec.title !== 'string') return;
+          const fullTitle = stripLeadingFilePathSuite([...nextStack, spec.title].join(' > '));
+          out.push({ title: fullTitle, parent: suite.specs, index, node: spec });
+        });
+      }
+      walk(suite.suites, nextStack);
+    }
+  };
+  walk(report?.suites, []);
+  return out;
+}
+
+/** Drop consumed specs from a suite tree; prune suites left with nothing. */
+function pruneConsumed(suites: any[], consumed: Set<any>): any[] {
+  const kept: any[] = [];
+  for (const suite of suites) {
+    if (!suite || typeof suite !== 'object') continue;
+    if (Array.isArray(suite.specs)) suite.specs = suite.specs.filter((s: any) => !consumed.has(s));
+    if (Array.isArray(suite.suites)) suite.suites = pruneConsumed(suite.suites, consumed);
+    const hasSpecs = Array.isArray(suite.specs) && suite.specs.length > 0;
+    const hasSuites = Array.isArray(suite.suites) && suite.suites.length > 0;
+    if (hasSpecs || hasSuites) kept.push(suite);
+  }
+  return kept;
+}
+
+/** Recompute the report-level stats counters from the merged tree's final attempts. */
+function recomputeStats(merged: any): void {
+  if (!merged.stats || typeof merged.stats !== 'object') return;
+  let expected = 0, unexpected = 0, skipped = 0, flaky = 0;
+  for (const ref of collectSpecs(merged)) {
+    for (const test of ref.node.tests ?? []) {
+      const results = test?.results ?? [];
+      const last = results[results.length - 1];
+      const status = last?.status;
+      if (status === 'passed') { if (results.some((r: any) => r?.status === 'failed' || r?.status === 'timedOut')) flaky++; else expected++; }
+      else if (status === 'skipped') skipped++;
+      else if (status) unexpected++;
+    }
+  }
+  merged.stats = { ...merged.stats, expected, unexpected, skipped, flaky };
+}
+
+/**
+ * Merge `next` into a DEEP COPY of `base` (neither input is mutated).
+ * Throws on inputs that are not report-shaped objects.
+ */
+export function mergeResultsReports(base: any, next: any): MergeOutcome {
+  for (const [label, r] of [['base', base], ['new', next]] as const) {
+    if (!r || typeof r !== 'object' || Array.isArray(r)) {
+      throw new Error(`results merge: the ${label} report is not a JSON object.`);
+    }
+  }
+  const merged = JSON.parse(JSON.stringify(base));
+  const nextCopy = JSON.parse(JSON.stringify(next));
+
+  // Last occurrence wins within one report — the same tie-break walkSuites uses.
+  const newByTitle = new Map<string, SpecRef>();
+  for (const ref of collectSpecs(nextCopy)) newByTitle.set(ref.title, ref);
+
+  const replaced: string[] = [];
+  const kept: string[] = [];
+  const consumed = new Set<any>();
+  for (const ref of collectSpecs(merged)) {
+    const incoming = newByTitle.get(ref.title);
+    if (incoming) {
+      ref.parent[ref.index] = incoming.node; // the new spec wins wholesale
+      consumed.add(incoming.node);
+      replaced.push(ref.title);
+    } else {
+      kept.push(ref.title);
+    }
+  }
+
+  const added: string[] = [];
+  for (const [title, ref] of newByTitle) {
+    if (!consumed.has(ref.node)) added.push(title);
+  }
+  if (added.length > 0 && Array.isArray(nextCopy.suites)) {
+    merged.suites = [...(Array.isArray(merged.suites) ? merged.suites : []), ...pruneConsumed(nextCopy.suites, consumed)];
+  }
+
+  recomputeStats(merged);
+  return { merged, replaced, added, kept };
+}
+
+/**
+ * Ghost detection for the WARN (never a prune): base-kept titles that no
+ * longer correspond to a CURRENT spec title. A `@cases` report title carries
+ * a ` — <label>` suffix while the spec title is the base form, so a ghost is
+ * a title that neither equals a spec title nor extends one with that suffix.
+ */
+export function findGhostTitles(keptTitles: string[], specTitles: string[]): string[] {
+  return keptTitles.filter((title) =>
+    !specTitles.some((spec) => title === spec || title.startsWith(`${spec} — `)));
+}

package/src/exporters/selector-key-resolver.ts

@@ -18,6 +18,10 @@
  *   • `value` for `type: 'role'` (role name like 'button', not display)
  *   • Entries with no `name` and no usable `value`
  *   • Composite templates with 2+ vars (ambiguous which to use)
+ *   • Locators whose single var is SCOPE text — inside `:has(...)`/`:not(...)`,
+ *     in a non-final segment, or in an XPath nested predicate / pre-step
+ *     position (see locatorVarIsScopeText) — substituting those renames the
+ *     ref to text of a DIFFERENT element (a column header naming a table)
  */
 
 import * as fs from 'fs';
@@ -90,13 +94,89 @@ function resolveField(value: string, isLocator: boolean): SelectorResolution | n
   }
   if (vars.length === 1) {
     // Sole `{{var}}` or composite like `has-text("{{var}}")`. Both resolve
-    // to the same var's locale-specific display text.
+    // to the same var's locale-specific display text — but ONLY when the var
+    // is the target element's OWN text. A var inside a `:has(...)` argument
+    // or in an ancestor segment names a DIFFERENT element (a column header
+    // scoping a table), and substituting it renames the ref to unrelated text.
+    if (isLocator && locatorVarIsScopeText(value)) return null;
     return { varName: vars[0] };
   }
   // 2+ vars in one template — ambiguous which to use; skip rather than guess.
   return null;
 }
 
+/**
+ * True when a locator's single `{{var}}` (FIRST occurrence — repeats of the
+ * same var judge by that one, erring toward fidelity) belongs to a SCOPE
+ * rather than the target element's own display text.
+ *
+ * CSS / Playwright engines:
+ *   - inside a `:has(...)` or `:not(...)` argument at any depth — that text
+ *     describes ANOTHER element (or the text this one must NOT contain);
+ *     `:has-text(...)` / `:text(...)` ARE the element's own text and pass;
+ *   - in a non-final segment — a combinator (space, `>`, `>>`, `+`, `~`) at
+ *     top level (outside parens, brackets and quotes) follows the var with a
+ *     real selector after it. A bare trailing match flag (`"{{x}}" i`) or an
+ *     attribute-internal space (`[name="{{x}}" i]`) is NOT a combinator.
+ *
+ * XPath (`xpath=` / `//…`):
+ *   - the var sits in a NESTED predicate (bracket depth ≥ 2, e.g.
+ *     `//table[.//th[text()="{{col}}"]]` — the th labels the table); or
+ *   - a location step (`/`) follows the var at top level
+ *     (`//th[text()="{{col}}"]/ancestor::table`).
+ *
+ * One left-to-right scan tracking quote state (with backslash-run counting so
+ * a literal trailing `\\` can't wedge the scanner in "quoted"), paren frames,
+ * and bracket depth.
+ */
+function locatorVarIsScopeText(locator: string): boolean {
+  const m = varPattern().exec(locator);
+  if (!m) return false;
+  const varIndex = m.index;
+  const isXpath = /^\s*(?:xpath=|\(*\/\/)/i.test(locator);
+  let quote: string | null = null;
+  const scopeFrames: boolean[] = []; // one entry per open paren: is it a :has(/:not( frame?
+  let bracketDepth = 0;
+  let passedVar = false;
+  const escaped = (i: number): boolean => {
+    let n = 0;
+    for (let j = i - 1; j >= 0 && locator[j] === '\\'; j--) n++;
+    return n % 2 === 1;
+  };
+  for (let i = 0; i < locator.length; i++) {
+    if (i === varIndex) {
+      passedVar = true;
+      if (!isXpath && scopeFrames.some(Boolean)) return true;
+      if (isXpath && bracketDepth >= 2) return true;
+    }
+    const c = locator[i];
+    if (quote) {
+      if (c === quote && !escaped(i)) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") { quote = c; continue; }
+    if (c === '(') {
+      const pseudo = locator.slice(Math.max(0, i - 4), i).toLowerCase();
+      scopeFrames.push(!isXpath && (pseudo === ':has' || pseudo === ':not'));
+      continue;
+    }
+    if (c === ')') { scopeFrames.pop(); continue; }
+    if (c === '[') { bracketDepth++; continue; }
+    if (c === ']') { bracketDepth = Math.max(0, bracketDepth - 1); continue; }
+    if (!passedVar || scopeFrames.length > 0 || bracketDepth > 0) continue;
+    if (isXpath) {
+      if (c === '/') return true; // a location step after the var → the target comes later
+      continue;
+    }
+    if (c === ' ' || c === '>' || c === '+' || c === '~') {
+      const rest = locator.slice(i).replace(/^[\s>+~]+/, '');
+      // Bare Playwright match flags after a quoted value are not a new segment.
+      if (rest.length > 0 && !/^[is](?:\s|$)/.test(rest)) return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Build the SelectorKey → resolution map from a selectors YAML file.
  * Returns an empty map when the file is missing or malformed.

package/src/exporters/types.ts

@@ -125,6 +125,13 @@ export interface PlaywrightResult {
   duration?: number;
   startTime?: string;
   error?: string;
+  /**
+   * Every distinct failure message of the final attempt (ANSI/stack stripped).
+   * Playwright's top-level `error` is only the FIRST error — when a timeout
+   * wraps an assertion, the assertion detail (Locator/Expected/Received) lives
+   * in `results[].errors[1+]` and would otherwise never reach the deliverable.
+   */
+  errorMessages?: string[];
   tracePath?: string;
   projectName?: string;
 }
@@ -179,7 +186,7 @@ export interface ApiCatalogEntry {
   /** Request-body wire format — decides the Content-Type the request sends.
    *  Absent/`json` → application/json, `form` → application/x-www-form-urlencoded,
    *  `multipart` → multipart/form-data. */
-  encoding?: 'json' | 'form' | 'multipart';
+  encoding?: 'json' | 'form' | 'multipart' | 'xml';
   /** Multipart file parts (multipart/form-data). A field value may be a single file spec, its string
    *  shorthand, or an array of specs (multiple files under one field name). Typed loosely — guard before use. */
   files?: Record<string, unknown>;

package/src/exporters/xlsx-report-builder.ts

@@ -640,10 +640,11 @@ export function buildApiDetailRows(
     const uniqueAuth = [...new Set(authTags.map((t) => t.slice('@auth:'.length)))];
     const authDatasource = [datasource, ...uniqueAuth].filter(Boolean).join('; ');
 
-    // Request shape: compose from body + params + encoding.
-    const bodyStr = entry.body
-      ? `body: ${typeof entry.body === 'string' ? entry.body : JSON.stringify(entry.body)}`
-      : '';
+    // Request shape: compose from body + params + encoding. A raw XML template can
+    // run long — cap the cell so one entry can't blow up the sheet's row height.
+    const rawBody = entry.body ? (typeof entry.body === 'string' ? entry.body : JSON.stringify(entry.body)) : '';
+    const cappedBody = rawBody.length > 500 ? `${rawBody.slice(0, 499)}…` : rawBody;
+    const bodyStr = cappedBody ? `body: ${cappedBody}` : '';
     const paramsArr = Array.isArray(entry.params) ? entry.params as string[] : [];
     const paramsStr = paramsArr.length > 0 ? `params: [${paramsArr.join(', ')}]` : '';
     const requestShape = [bodyStr, paramsStr].filter(Boolean).join('; ') || '—';

package/src/generators/gherkin-parser/index.ts

@@ -4,6 +4,51 @@ import * as Messages from '@cucumber/messages';
 import fs from 'fs';
 import path from 'path';
 import { SelectorResolver } from '../test-generator/utils/selector-resolver';
+import { maskRefsForMatching } from '../test-generator/utils/mask-refs-for-matching';
+import type { StateClause } from '../test-generator/patterns/types';
+
+/**
+ * Canonical state clauses, longest-first. Order is load-bearing twice over: `sorted ascending` must
+ * be tried before any bare word so it is not split, and `unchecked` before `checked` so the
+ * substring never misclassifies — the same hazard, and the same fix, as `qualifiedState()` in
+ * driver-ui's assertion-patterns.
+ */
+const STATE_CLAUSES: ReadonlyArray<StateClause> = [
+  'sorted ascending', 'sorted descending',
+  'unchecked', 'checked',
+  'hidden', 'visible', 'disabled', 'enabled', 'focused', 'empty', 'loading', 'selected',
+];
+
+/**
+ * Lift a trailing state clause out of a step sentence so the pattern layer can tell whether the
+ * pattern that won actually asserts it (SG-E021). Before this the clause lived ONLY inside
+ * `step.text`, every pattern re-regexed it privately, and a clause swallowed by a higher-priority
+ * pattern was undetectable by construction.
+ *
+ * Narrow on purpose — everything this rejects is a step that must keep compiling exactly as it does
+ * today:
+ *   - requires the literal `is` — `wait for [X] to be hidden` is a wait, not a state assertion;
+ *   - requires TRAILING position — `… is hidden after the modal closes` is prose, not a clause;
+ *   - rejects `is not <state>` — `in local storage is not empty` is a real storage grammar (D5);
+ *   - masks `[Ref]` and `{{data}}` CONTENT first, so `[Sorted Ascending]` (a button) and
+ *     `{{is_empty}}` (a variable) are not read as states.
+ */
+function extractStateClause(text: string): StateClause | undefined {
+  // Collapse runs of whitespace and drop a trailing period, so `… is  hidden .` reads the same as
+  // `… is hidden`. Compared as a plain string tail rather than a built regex: the clause list holds
+  // a two-word member (`sorted ascending`), and interpolating it into a RegExp means escaping the
+  // separator, which is exactly the kind of quiet breakage `\b`-in-a-template-literal already is.
+  const tail = maskRefsForMatching(text)
+    .replace(/\s+/g, ' ')
+    .replace(/ ?\.$/, '')
+    .toLowerCase();
+  // ` is ` must sit IMMEDIATELY before the clause. That single space is what excludes `is not empty`
+  // — the storage grammar — without a negative lookbehind.
+  for (const state of STATE_CLAUSES) {
+    if (tail.endsWith(` is ${state}`)) return state;
+  }
+  return undefined;
+}
 
 export interface DataTableRow {
   cells: string[]; // Cell values in order
@@ -28,6 +73,7 @@ export interface ParsedStep {
   parentRef?: string; // Parent scope reference: "in [Parent Name] parentType" → parentRef = "Parent Name"
   parentType?: string; // Parent scope type: table, list, section, dialog, form
   dataTable?: ParsedDataTable; // Inline data table (Cucumber DataTable syntax)
+  state?: StateClause; // Trailing canonical state clause, e.g. "hidden" from "… is hidden" (drives SG-E021)
 }
 
 export interface ParsedScenario {
@@ -204,7 +250,14 @@ export class GherkinParser {
     const selectorRef = selectorMatch ? selectorMatch[1] : undefined;
 
     // Extract data reference: {{login.email.valid}} or <valid_user.email> (legacy)
-    const dataMatch = text.match(/\{\{([a-z0-9\-\.\_]+)\}\}|<([^>]+)>/i);
+    // A `{{var}}` inside a [Reference] is NEVER the step's data ref: a bracket carries a
+    // selectors.yaml key or a browser-storage key, both matched verbatim. Blank the brackets
+    // out first — the match is un-anchored and takes the FIRST hit, so a step with braces on
+    // both sides (`see [{{code}}_TOKEN] in session storage has length {{n}}`, or
+    // `remember [X] text as {{v}}` written with a bracket var) would otherwise bind the
+    // bracket's variable and silently lose the real ref.
+    const textOutsideRefs = text.replace(/\[[^\]]*\]/g, '');
+    const dataMatch = textOutsideRefs.match(/\{\{([a-z0-9\-\.\_]+)\}\}|<([^>]+)>/i);
     const dataRef = dataMatch ? (dataMatch[1] || dataMatch[2]) : undefined;
 
     // Extract quoted value: "Hello, how are you?"
@@ -269,6 +322,7 @@ export class GherkinParser {
       parentRef,
       parentType,
       dataTable,
+      state: extractStateClause(step.text),
     };
   }