@sun-asterisk/sungen 3.2.24 → 3.2.26

package/src/exporters/api-testcase-formatter.ts

@@ -98,7 +98,7 @@ function callBlockLines(call: ApiCall, entry: ApiCatalogEntry, localize: (text:
   const filesStr = formatFiles(entry.files, call.args, localize);
   const bodyFileStr = formatBodyFile(entry.bodyFile, call.args, localize);
   // Body is scalar fields; a pure file upload may have none → still show `Body: —` for a stable shape.
-  lines.push(`Body: ${formatBody(entry.body, call.args, localize)}`);
+  lines.push(`Body: ${formatBody(entry.body, call.args, localize, entry)}`);
   if (filesStr) lines.push(`Files: ${filesStr}`);
   if (bodyFileStr) lines.push(`Body file: ${bodyFileStr}`);
   return lines;
@@ -111,6 +111,24 @@ function callBlockLines(call: ApiCall, entry: ApiCatalogEntry, localize: (text:
  * has more than one call — same style as formatApiRequest — which also keeps a
  * deliberately repeated call distinct through the matrix's precondition Set-dedup.
  */
+/**
+ * Terse one-line-per-call summary for a screen/flow row's PRE-CONDITION cell:
+ * `Call API <name> — <METHOD> <path>`. Built on the strict parseApiCalls so the
+ * deliverable never documents a call the runtime silently dropped (a malformed
+ * tag never runs). Only name/method/path from the catalog render — tag args
+ * carry runtime values. A missing endpoint is loud; a present entry missing a
+ * field shows `—` for that field instead of blaming the wrong file.
+ */
+export function formatApiCallSummaryLines(tags: string[], catalog: Record<string, ApiCatalogEntry>): string[] {
+  return parseApiCalls(tags).map(({ name }) => {
+    const entry = catalog[name];
+    if (!entry) return `Call API ${name} — (endpoint not in apis.yaml)`;
+    const method = typeof entry.method === 'string' && entry.method ? entry.method.toUpperCase() : '—';
+    const apiPath = typeof entry.path === 'string' && entry.path ? entry.path : '—';
+    return `Call API ${name} — ${method} ${apiPath}`;
+  });
+}
+
 export function formatApiCallLines(
   calls: ApiCall[],
   catalog: Record<string, ApiCatalogEntry>,
@@ -185,6 +203,38 @@ function bindParams(raw: string, args: Record<string, string>): string {
   });
 }
 
+/**
+ * Whitelist variant for XML string bodies: bind ONLY the declared param names
+ * (longest first, word-boundary guarded) — the generic `:word` scan above would
+ * rewrite namespace prefixes (soapenv:Envelope) into garbage cells. Mirrors the
+ * runtime's whitelist binding.
+ */
+function bindXmlParamsForCell(raw: string, args: Record<string, string>, paramNames: string[]): string {
+  let out = raw;
+  for (const p of [...paramNames].sort((a, b) => b.length - a.length)) {
+    const expr = p in args ? args[p] : `{{${p}}}`;
+    out = out.replace(new RegExp(`:${p}(?![A-Za-z0-9_])`, 'g'), () => unquoteExpr(expr));
+  }
+  return out;
+}
+
+/**
+ * Mask the value of credential-named ELEMENTS inside an XML string body
+ * (`<signature>…</signature>` → `<signature>***</signature>`). The object-body
+ * masking below never sees a string template, so without this the raw signature
+ * from the catalog example would print verbatim in the client's API detail sheet.
+ */
+function maskXmlSensitiveElements(xml: string): string {
+  // The open tag may carry attributes (<signature type="hmac">) and the value may
+  // be a CDATA section — both are common spellings for exactly the credential
+  // elements this masks, so the pattern must accept them or the secret prints raw.
+  return xml.replace(
+    /(<([A-Za-z0-9_.:-]+)(?:\s[^>]*)?>)((?:<!\[CDATA\[[\s\S]*?\]\]>|[^<])*)(<\/\2>)/g,
+    (whole, open: string, tag: string, _value: string, close: string) =>
+      SENSITIVE_NAME.test(tag) ? `${open}***${close}` : whole,
+  );
+}
+
 /** Strip a matching pair of surrounding quotes from a tag-arg literal (`"x"` → `x`). */
 function unquoteExpr(e: string): string {
   const m = e.match(/^"(.*)"$/) || e.match(/^'(.*)'$/);
@@ -230,6 +280,7 @@ function formatHeaders(
 function contentTypeFor(encoding?: string): string {
   if (encoding === 'form') return 'application/x-www-form-urlencoded';
   if (encoding === 'multipart') return 'multipart/form-data';
+  if (encoding === 'xml') return 'application/xml';
   return 'application/json';
 }
 
@@ -247,8 +298,13 @@ function uploadContentType(entry: ApiCatalogEntry): string {
  * that field can be replaced with `***`; otherwise the body resolves wholesale
  * (preserving numbers/nesting exactly as before).
  */
-function formatBody(body: unknown, args: Record<string, string>, localize: (text: string) => string): string {
+function formatBody(body: unknown, args: Record<string, string>, localize: (text: string) => string, entry?: ApiCatalogEntry): string {
   if (body === undefined || body === null) return '—';
+  // XML string template: whitelist-bind declared params, then mask credential elements.
+  if (entry?.encoding === 'xml' && typeof body === 'string') {
+    const names = Array.isArray(entry.params) ? (entry.params as string[]) : [];
+    return localize(maskXmlSensitiveElements(bindXmlParamsForCell(body, args, names)));
+  }
   if (isPlainObject(body)) {
     const obj = body as Record<string, unknown>;
     if (Object.keys(obj).some(isSensitiveField)) {
@@ -321,7 +377,7 @@ function formatBodyFile(bodyFile: unknown, args: Record<string, string>, localiz
  * test-data keys — catches variants like confirmPassword / new_password /
  * password_confirmation / access_token / client_secret / otp / passcode.
  */
-export const SENSITIVE_NAME = /pass(word|code)?|passwd|pwd|secret|token|otp|api[-_]?key|apikey|credential|authorization/i;
+export const SENSITIVE_NAME = /pass(word|code)?|passwd|pwd|secret|token|otp|api[-_]?key|apikey|credential|authorization|signature/i;
 function isSensitiveField(key: string): boolean {
   return SENSITIVE_NAME.test(key);
 }

package/src/exporters/csv-exporter.ts

@@ -23,7 +23,7 @@ import {
   statusToTestResult,
 } from './playwright-report-parser';
 import { ApiCatalogEntry, EnvironmentInfo, PlaywrightResult, ScreenSummary, TestCaseRow } from './types';
-import { collectSecretValues, formatApiExpected, formatApiRequest, hasApiCalls, redactSecrets } from './api-testcase-formatter';
+import { collectSecretValues, formatApiCallSummaryLines, formatApiExpected, formatApiRequest, hasApiCalls, redactSecrets } from './api-testcase-formatter';
 import { SelectorKeyMap, substituteSelectorKeysInStep } from './selector-key-resolver';
 import { formatVariantRow, resolveResultVariants } from './result-variants';
 import { collectQaEnvSecretDenylist, warnIfRedactionIncomplete } from './qa-env-secret-denylist';
@@ -103,9 +103,18 @@ export function buildTestCaseRows(input: BuildCsvInput): TestCaseRow[] {
     };
     const formatStep = (s: { text: string; bucket: 'given' | 'when' | 'then' }) =>
       localize(s.bucket === 'given' ? keepActor(s.text) : stripActor(s.text));
+    // `@api:` preconditions on a screen/flow scenario run before its UI steps —
+    // without these lines the deliverable never names the real endpoint (QA
+    // post-processed every export to add them back). They belong in the
+    // PRE-CONDITION cell, the same home Background moved to: inlining setup in
+    // Steps shifts the numbering and every `— after step N` anchor with it.
+    // kind:api keeps its own richer request-block rendering below.
+    const apiCallLines = (input.kind === 'screen' || input.kind === 'flow') && input.apiCatalog && hasApiCalls(m.feature.tags)
+      ? formatApiCallSummaryLines(m.feature.tags, input.apiCatalog)
+      : [];
     const precondition = formatPrecondition(
       authRole,
-      (m.resolvedBackgroundSteps ?? []).map(formatStep).filter(Boolean)
+      [...(m.resolvedBackgroundSteps ?? []).map(formatStep).filter(Boolean), ...apiCallLines]
     );
     const stepLines = m.resolvedSteps.map(formatStep).filter(Boolean);
     // Scenarios whose assertions verify different moments render Expected as

package/src/exporters/json-exporter.ts

@@ -16,7 +16,7 @@ import {
 } from './feature-parser';
 import { formatPrecondition, groupExpectedByAnchor, keepActor, stripActor } from './step-formatter';
 import { formatTestData, substituteTestDataVars } from './test-data-resolver';
-import { collectSecretValues, formatApiExpected, formatApiRequest, hasApiCalls, redactSecrets } from './api-testcase-formatter';
+import { collectSecretValues, formatApiCallSummaryLines, formatApiExpected, formatApiRequest, hasApiCalls, redactSecrets } from './api-testcase-formatter';
 import {
   formatExecutedDate,
   statusToTestResult,
@@ -99,9 +99,14 @@ export function buildScreenSnapshot(input: BuildScreenSnapshotInput): ScreenSnap
     };
     const formatStep = (s: { text: string; bucket: 'given' | 'when' | 'then' }) =>
       localize(s.bucket === 'given' ? keepActor(s.text) : stripActor(s.text));
+    // Same `@api:` precondition lines as csv-exporter's buildTestCaseRows — the
+    // dashboard and the delivery CSV must not disagree about what a row does.
+    const apiCallLines = (input.kind === 'screen' || input.kind === 'flow') && input.apiCatalog && hasApiCalls(m.feature.tags)
+      ? formatApiCallSummaryLines(m.feature.tags, input.apiCatalog)
+      : [];
     const precondition = formatPrecondition(
       authRole,
-      (m.resolvedBackgroundSteps ?? []).map(formatStep).filter(Boolean)
+      [...(m.resolvedBackgroundSteps ?? []).map(formatStep).filter(Boolean), ...apiCallLines]
     );
     let steps = m.resolvedSteps.map(formatStep).filter(Boolean);
     // Same anchor rule as csv-exporter (shared groupExpectedByAnchor) so the

package/src/exporters/matrix/build.ts

@@ -7,6 +7,7 @@
 
 import { ApiCatalogEntry, FeatureMetadata, PlaywrightResult } from '../types';
 import { formatApiCallLines, parseApiCalls } from '../api-testcase-formatter';
+import { collectQaEnvSecretDenylist } from '../qa-env-secret-denylist';
 import { bucketTexts } from './step-buckets';
 import { MergedScenario } from '../scenario-merger';
 import {
@@ -140,6 +141,10 @@ export function deriveVariants(inputs: Pick<BuildInputs, 'feature' | 'merged' |
     const { vpId, category1 } = splitVpAndName(m.feature.name);
     if (!vpId) continue; // Gate A reports it — no variant can be addressed without a VP-id
     const tags = m.feature.tags;
+    // @exploration probes live outside the official suite (the same contract the audit's
+    // source-tracing exemption follows) — they never become deliverable coverage variants,
+    // so the gates and the map never ask for them.
+    if (tags.some((t) => /^@exploration\b/i.test(t))) continue;
     const mode = extractTestcaseType(tags) === 'Manual' ? 'manual' : 'auto';
     const authRole = extractAuthRole(tags);
     // Category segment of the id, whatever the project's scheme:
@@ -513,6 +518,9 @@ export function expandMapRef(ref: string, variantsByVp: Map<string, CoverageVari
 export function buildMatrix(inputs: BuildInputs): MatrixModel {
   const { unit, map, transformerVersion } = inputs;
   const variants = deriveVariants(inputs);
+  // Same denylist the testcases CSV applies to its Note column — the matrix error
+  // cells render the same failure messages and go into the same client hand-off.
+  const secretValues = inputs.testData ? collectQaEnvSecretDenylist(inputs.testData).values : [];
 
   const variantsByVp = new Map<string, CoverageVariant[]>();
   for (const v of variants) {
@@ -551,7 +559,10 @@ export function buildMatrix(inputs: BuildInputs): MatrixModel {
       priority,
       mode: modes.size > 1 ? 'mixed' : (first?.mode ?? 'auto'),
       layers: Array.from(new Set(groupVariants.flatMap((v) => v.layers))),
-      traces: Array.from(new Set(groupVariants.flatMap((v) => v.traces))),
+      // The map's own `trace:` codes join the scenarios' `@spec:` ids on the SAME column: a
+      // reviewer wants one place to see what an item traces to, whether the id came from the spec
+      // or from the analysis. Map codes lead, because they are the ones a person chose for it.
+      traces: Array.from(new Set([...(g.trace ?? []), ...groupVariants.flatMap((v) => v.traces)])),
       dimensions: g.dimensions,
       // Only the preconditions COMMON to every variant belong on the parent —
       // copying the first variant's setup mis-states the start state of the
@@ -612,6 +623,7 @@ export function buildMatrix(inputs: BuildInputs): MatrixModel {
     dispositions,
     requirements,
     findings,
+    secretValues,
     manifest: {
       unit,
       transformerVersion,

package/src/exporters/matrix/export.ts

@@ -53,7 +53,7 @@ function readSpecText(paths: MatrixTargetPaths): string {
     : '';
 }
 
-/** apis.yaml endpoint catalog for an api unit ({} for screen/flow — loader no-ops). */
+/** apis.yaml endpoint catalog — resolved for EVERY kind (screen/flow read their unit-scoped catalog + the shared one), so hybrid @api preconditions render their real request contract. */
 function catalogFor(paths: MatrixTargetPaths): Record<string, ApiCatalogEntry> {
   return loadApiCatalog(paths.cwd, paths.kind ?? 'screen', paths.area ?? paths.unit);
 }

package/src/exporters/matrix/map-loader.ts

@@ -79,6 +79,10 @@ export function loadDeliveryMap(file: string): MapLoadResult {
         intent: String(grp.intent ?? ''),
         oracle: String(grp.oracle ?? ''),
         ...(grp.dimensions !== undefined ? { dimensions: String(grp.dimensions) } : {}),
+        // Free-form by design: these are the project's own analysis codes, not a fixed scheme.
+        ...(Array.isArray(grp.trace) && grp.trace.length
+          ? { trace: (grp.trace as unknown[]).map((t) => String(t).trim()).filter(Boolean) }
+          : {}),
         category: grp.category as MapCategory,
         review,
         variants: Array.isArray(variants) ? variants.map(String) : [],
@@ -150,6 +154,7 @@ export function writeDeliveryMap(file: string, map: DeliveryMap): void {
       intent: g.intent,
       oracle: g.oracle,
       ...(g.dimensions !== undefined ? { dimensions: g.dimensions } : {}),
+      ...(g.trace && g.trace.length ? { trace: g.trace } : {}),
       category: g.category,
       review: g.review,
       variants: g.variants,

package/src/exporters/matrix/render-csv.ts

@@ -5,6 +5,8 @@
  * and result), so downstream pipelines can re-derive both views from one file.
  */
 
+import { redactSecrets } from '../api-testcase-formatter';
+import { clipNoteField } from '../playwright-report-parser';
 import { variantState } from './build';
 import { coverageSummary, itemModeLabel, itemResultLabel } from './render-xlsx';
 import { MatrixModel } from './types';
@@ -75,7 +77,9 @@ export function renderMatrixCsv(model: MatrixModel): string {
         v.traces.join(' '),
         variantState(v),
         isoDate(v.result?.startTime),
-        v.result?.error ? String(v.result.error).slice(0, 200) : '',
+        // Redact BEFORE clipping — a clip boundary must never split a secret in
+        // a way that lets its prefix through. Same denylist as the Note column.
+        v.result?.error ? clipNoteField(redactSecrets(String(v.result.error), model.secretValues)) : '',
         '',
       ].map(esc).join(','));
     }

package/src/exporters/matrix/render-xlsx.ts

@@ -27,6 +27,8 @@ import {
   BLACK,
   LAVENDER,
 } from '../xlsx-report-builder';
+import { redactSecrets } from '../api-testcase-formatter';
+import { clipNoteField } from '../playwright-report-parser';
 import { variantState } from './build';
 import { DeliveryItem, MatrixModel, MapCategory } from './types';
 
@@ -229,7 +231,8 @@ function addMatrixSheet(wb: ExcelJS.Workbook, model: MatrixModel, sungenVersion?
         variantState(v),
         isoDate(v.result?.startTime),
         '',
-        v.result?.error ? String(v.result.error).slice(0, 200) : '',
+        // Redact BEFORE clipping — same denylist as the testcases CSV Note column.
+        v.result?.error ? clipNoteField(redactSecrets(String(v.result.error), model.secretValues)) : '',
         '',
       ];
       vValues.forEach((val, i) => dataCell(vr.getCell(2 + i), val, { center: i === 9 }));

package/src/exporters/matrix/types.ts

@@ -33,6 +33,17 @@ export interface MapGroup {
    *  (e.g. "required ×3 · format ×9 · full-width ×2"). Rendered on the parent row
    *  instead of concatenating every variant's title — the compact review view. */
   dimensions?: string;
+  /**
+   * Domain-logic reference ids this item traces to — a decision table, an algorithm, an internal
+   * business rule (`DEC-003`, `ALG-002`, `DISC-002`, `BR-001`).
+   *
+   * `requirements:` already traces to the FR/TR/NFR ids in `requirements/spec.md`. The codes a QA
+   * assigns while ANALYSING — which mechanism a case actually exercises — had no field, so they
+   * lived as comments in the `.feature` and never reached the Coverage sheet handed to the
+   * reviewer: the Trace column came out blank for exactly the items whose traceability mattered
+   * most (#651). Optional, and free-form on purpose: these ids are the project's own vocabulary.
+   */
+  trace?: string[];
   /** Variant refs: `VP-ID` (all @cases rows when the scenario has a dataset) or `VP-ID#label`. */
   variants: string[];
 }
@@ -235,6 +246,13 @@ export interface MatrixModel {
   manifest: MatrixManifest;
   /** Perf verdict (#569) — present when qa/perf.yaml sets a budget AND the run produced durations. */
   perf?: import('../../harness/perf').PerfVerdict | null;
+  /**
+   * Resolved ${QA_*} secret values referenced by this unit's test data. Failure
+   * messages quote runtime values (a Received: line can echo a typed password),
+   * so every error cell the renderers emit must be redacted against this list —
+   * the deliverable ships to the client.
+   */
+  secretValues: string[];
 }
 
 /** Complexity warning threshold (rules draft Gate I; raised for compact grouping) — echoed in the manifest. */

package/src/exporters/playwright-report-parser.ts

@@ -16,14 +16,22 @@ import { PlaywrightResult } from './types';
  * Candidate order (first existing wins):
  *   1. <genDir>/<featureBaseName>-test-result.<SUNGEN_ENV>.json  (env runs)
  *   2. <genDir>/<featureBaseName>-test-result.json               (per-feature reporter)
- *   3. <cwd>/test-results/results.<SUNGEN_ENV>.json
- *   4. <cwd>/test-results/results.json                           (playwright default)
+ *   3. <genDir>/<featureBaseName>-test-result.<os>[.<SUNGEN_ENV>].json — mobile per-OS
+ *      reporter files (wdio writes one per capability; a mobile project has NO base file).
+ *      MOBILE_PLATFORM picks the OS explicitly; otherwise android, then ios.
+ *   4. <cwd>/test-results/results.<SUNGEN_ENV>.json
+ *   5. <cwd>/test-results/results.json                           (playwright default)
  */
 export function resolveResultsPath(cwd: string, genDir: string, featureBaseName: string): string | null {
   const env = process.env.SUNGEN_ENV;
   const candidates: string[] = [];
   if (env) candidates.push(path.join(genDir, `${featureBaseName}-test-result.${env}.json`));
   candidates.push(path.join(genDir, `${featureBaseName}-test-result.json`));
+  const mobileOs = (process.env.MOBILE_PLATFORM || '').toLowerCase();
+  for (const os of mobileOs === 'android' || mobileOs === 'ios' ? [mobileOs] : ['android', 'ios']) {
+    if (env) candidates.push(path.join(genDir, `${featureBaseName}-test-result.${os}.${env}.json`));
+    candidates.push(path.join(genDir, `${featureBaseName}-test-result.${os}.json`));
+  }
   if (env) candidates.push(path.join(cwd, 'test-results', `results.${env}.json`));
   candidates.push(path.join(cwd, 'test-results', 'results.json'));
   for (const c of candidates) {
@@ -57,6 +65,9 @@ interface PlaywrightSpec {
       duration?: number;         // ms — Playwright emits this on every result (#569 perf budgets)
       startTime?: string;
       error?: { message?: string; stack?: string };
+      // ALL errors of the attempt. `error` above is only the first one — when a
+      // timeout interrupts an assertion, the assertion detail is errors[1+].
+      errors?: Array<{ message?: string; stack?: string }>;
       attachments?: Array<{ name?: string; path?: string; contentType?: string }>;
     }>;
   }>;
@@ -110,7 +121,30 @@ export function loadPlaywrightReport(reportPath: string): Map<string, Playwright
     const results = test?.results || [];
     const res = results[results.length - 1];
     const status = normalizeStatus(res?.status);
-    const errorMsg = stripAnsi(res?.error?.message || '');
+    // Collect EVERY failure message of the attempt, not just the first: a test
+    // timeout wraps the real assertion failure, so `error` alone holds only
+    // "Test timeout of 15000ms exceeded." while the Locator/Expected/Received
+    // detail QA needs sits in errors[1+]. Stack frames are stripped PER message
+    // before joining — otherwise the first message's stack swallows the rest
+    // when downstream consumers cut at the first "at " frame.
+    const rawMessages = (res?.errors?.length ? res.errors.map((e) => e.message) : [res?.error?.message])
+      .map((m) => stripAnsi(m || ''))
+      .filter(Boolean);
+    const distinct: string[] = [];
+    const seenKeys = new Set<string>();
+    for (const m of rawMessages) {
+      const stripped = m.split(/\n\s*at\s/)[0].trim();
+      // Key ignores a leading `Error:` — "Error: page closed" and "page closed"
+      // are the same failure and must not render as two Note bullets.
+      const key = stripped.replace(/^Error:\s*/i, '');
+      if (!key || seenKeys.has(key)) continue;
+      seenKeys.add(key);
+      distinct.push(stripped);
+    }
+    // Single message: keep the legacy shape (stack intact) so every existing
+    // consumer renders byte-identical output. Multiple: join the stack-stripped
+    // distinct messages so none can hide behind another's stack.
+    const errorMsg = distinct.length > 1 ? distinct.join('\n') : stripAnsi(res?.error?.message || rawMessages[0] || '');
     const trace = res?.attachments?.find((a) => a.name === 'trace' || a.contentType === 'application/zip')?.path;
 
     // Strip the leading file-path suite title if present.
@@ -124,6 +158,7 @@ export function loadPlaywrightReport(reportPath: string): Map<string, Playwright
       duration: typeof res?.duration === 'number' ? res.duration : undefined,
       startTime: res?.startTime,
       error: errorMsg,
+      errorMessages: distinct.length > 0 ? distinct : undefined,
       tracePath: trace,
       projectName: test?.projectName,
     });
@@ -178,7 +213,7 @@ function normalizeStatus(s: string | undefined): PlaywrightResult['status'] {
  * "specs/generated/kudos/kudos.spec.ts > Feature Name > ...",
  * strip that leading segment so matching works against "Feature Name > ...".
  */
-function stripLeadingFilePathSuite(fullTitle: string): string {
+export function stripLeadingFilePathSuite(fullTitle: string): string {
   const parts = fullTitle.split(' > ');
   if (parts.length > 1 && /\.spec\.ts$/i.test(parts[0])) {
     return parts.slice(1).join(' > ');
@@ -256,11 +291,23 @@ export function parseExpectedReceived(raw: string): { expected?: string; receive
 export function formatNote(result: PlaywrightResult | undefined, expectedFallback = ''): string {
   if (!result) return '';
   if (result.status !== 'failed' && result.status !== 'timedOut') return '';
-  // Full assertion message with stack frames dropped (frames start with "at ") + a leading `Error:`
-  // stripped. Keep newlines here so parseExpectedReceived can delimit the Expected/Received lines.
-  const raw = (result.error || '').split(/\n\s*at\s/)[0].replace(/^Error:\s*/i, '').trim();
-  const { expected, received } = parseExpectedReceived(raw);
-  const actual = received || clip(raw); // received value, else the raw error
+  // Per-message: stack frames dropped (frames start with "at ") + a leading `Error:` stripped.
+  // Keep newlines inside each message so parseExpectedReceived can delimit Expected/Received.
+  const messages = (result.errorMessages?.length ? result.errorMessages : [result.error || ''])
+    .map((m) => m.split(/\n\s*at\s/)[0].replace(/^Error:\s*/i, '').trim())
+    .filter(Boolean);
+  // The message that carries the assertion detail drives Expected/Actual; the other
+  // messages (e.g. the "Test timeout of 15000ms exceeded." wrapper) must still be
+  // shown — a real assertion failure rendered as a bare timeout reads as flaky.
+  // Prefer a message carrying BOTH halves: a half-match (Expected in one message,
+  // Received in another) would otherwise put the wrong text in Actual. With
+  // expect.soft the first assertion drives the split and the later assertion
+  // messages render as `• Error:` bullets — content preserved, columns describe #1.
+  const halves = (m: string): number => { const er = parseExpectedReceived(m); return (er.expected ? 1 : 0) + (er.received ? 1 : 0); };
+  const assertion = messages.find((m) => halves(m) === 2) ?? messages.find((m) => halves(m) >= 1) ?? messages[0] ?? '';
+  const wrappers = messages.filter((m) => m !== assertion);
+  const { expected, received } = parseExpectedReceived(assertion);
+  const actual = received || clip(assertion); // received value, else the raw error
 
   // Newline-separated bullets so each field lands on its own row when the cell wraps — matches the
   // Test Data column's `• key: value` formatting. Excel/CSV honour `\n` inside quoted cells; the
@@ -276,6 +323,18 @@ export function formatNote(result: PlaywrightResult | undefined, expectedFallbac
     else if (lines.length > 1) parts.push(`• Expected result:\n${lines.map((l) => `   ${l}`).join('\n')}`);
   }
   if (actual)           parts.push(`• Actual result: ${actual}`);
+  // Non-assertion companions of an assertion failure (timeout wrapper etc.), one
+  // clipped bullet each so no cell field can blow past the XLSX-safe cap.
+  for (const w of wrappers) parts.push(`• Error: ${clip(w)}`);
   if (result.tracePath) parts.push(`• Trace: ${result.tracePath}`);
   return parts.join('\n');
 }
+
+/**
+ * One-cell error rendering for the matrix deliverable: newlines collapsed and
+ * clipped to the same cap as Note fields. Replaces ad-hoc `slice(0, 200)` calls
+ * that could cut a joined multi-error message mid-assertion.
+ */
+export function clipNoteField(s: string): string {
+  return clip(s);
+}

package/src/exporters/results-merge.ts

@@ -0,0 +1,150 @@
+/**
+ * Merge two Playwright JSON reports by FULL TEST TITLE — the fix for subset
+ * re-runs: Playwright's JSON reporter overwrites the per-target result file,
+ * so re-running the 3 failed cases of a 100-case screen used to throw away
+ * the 97 passing results (QA then re-ran everything, or asked an AI to merge
+ * by hand — non-deterministic).
+ *
+ * Semantics (deterministic):
+ *   - same title in both → the NEW spec wins wholesale (its results, its
+ *     attempts, its timing);
+ *   - title only in base → kept as-is;
+ *   - title only in new → appended (its suite structure preserved).
+ * Titles compare AFTER stripping the leading file-path suite segment, so a
+ * base and a new report generated from different cwd/suite paths still match.
+ * `@cases` rows carry a ` — <label>` title suffix and merge as independent
+ * entries — re-running one dataset row keeps the other rows.
+ *
+ * The merge never deletes: a base title missing from the current spec (a
+ * scenario renamed by a spec edit) is a GHOST the caller may WARN about, but
+ * pruning is not this function's job — the delivery builds rows from the
+ * feature, so ghosts never render; only the dead `stats` block would drift,
+ * and it is recomputed below.
+ *
+ * Everything outside suites/specs/tests is passed through untouched from the
+ * BASE report (config, metadata, unknown future fields) — tolerance over
+ * strictness, the shape belongs to Playwright.
+ */
+
+import { stripLeadingFilePathSuite } from './playwright-report-parser';
+
+interface SpecRef {
+  title: string;            // stripped full title
+  parent: any[];            // the specs array holding the node
+  index: number;
+  node: any;
+}
+
+export interface MergeOutcome {
+  merged: any;
+  replaced: string[];       // titles taken from the new report over the base
+  added: string[];          // titles only in the new report (appended)
+  kept: string[];           // titles only in the base (untouched)
+}
+
+/** Collect every spec node with its stripped full title and parent array. */
+function collectSpecs(report: any): SpecRef[] {
+  const out: SpecRef[] = [];
+  const walk = (suites: any[] | undefined, stack: string[]): void => {
+    if (!Array.isArray(suites)) return;
+    for (const suite of suites) {
+      if (!suite || typeof suite !== 'object') continue;
+      const nextStack = typeof suite.title === 'string' && suite.title ? [...stack, suite.title] : stack;
+      if (Array.isArray(suite.specs)) {
+        suite.specs.forEach((spec: any, index: number) => {
+          if (!spec || typeof spec.title !== 'string') return;
+          const fullTitle = stripLeadingFilePathSuite([...nextStack, spec.title].join(' > '));
+          out.push({ title: fullTitle, parent: suite.specs, index, node: spec });
+        });
+      }
+      walk(suite.suites, nextStack);
+    }
+  };
+  walk(report?.suites, []);
+  return out;
+}
+
+/** Drop consumed specs from a suite tree; prune suites left with nothing. */
+function pruneConsumed(suites: any[], consumed: Set<any>): any[] {
+  const kept: any[] = [];
+  for (const suite of suites) {
+    if (!suite || typeof suite !== 'object') continue;
+    if (Array.isArray(suite.specs)) suite.specs = suite.specs.filter((s: any) => !consumed.has(s));
+    if (Array.isArray(suite.suites)) suite.suites = pruneConsumed(suite.suites, consumed);
+    const hasSpecs = Array.isArray(suite.specs) && suite.specs.length > 0;
+    const hasSuites = Array.isArray(suite.suites) && suite.suites.length > 0;
+    if (hasSpecs || hasSuites) kept.push(suite);
+  }
+  return kept;
+}
+
+/** Recompute the report-level stats counters from the merged tree's final attempts. */
+function recomputeStats(merged: any): void {
+  if (!merged.stats || typeof merged.stats !== 'object') return;
+  let expected = 0, unexpected = 0, skipped = 0, flaky = 0;
+  for (const ref of collectSpecs(merged)) {
+    for (const test of ref.node.tests ?? []) {
+      const results = test?.results ?? [];
+      const last = results[results.length - 1];
+      const status = last?.status;
+      if (status === 'passed') { if (results.some((r: any) => r?.status === 'failed' || r?.status === 'timedOut')) flaky++; else expected++; }
+      else if (status === 'skipped') skipped++;
+      else if (status) unexpected++;
+    }
+  }
+  merged.stats = { ...merged.stats, expected, unexpected, skipped, flaky };
+}
+
+/**
+ * Merge `next` into a DEEP COPY of `base` (neither input is mutated).
+ * Throws on inputs that are not report-shaped objects.
+ */
+export function mergeResultsReports(base: any, next: any): MergeOutcome {
+  for (const [label, r] of [['base', base], ['new', next]] as const) {
+    if (!r || typeof r !== 'object' || Array.isArray(r)) {
+      throw new Error(`results merge: the ${label} report is not a JSON object.`);
+    }
+  }
+  const merged = JSON.parse(JSON.stringify(base));
+  const nextCopy = JSON.parse(JSON.stringify(next));
+
+  // Last occurrence wins within one report — the same tie-break walkSuites uses.
+  const newByTitle = new Map<string, SpecRef>();
+  for (const ref of collectSpecs(nextCopy)) newByTitle.set(ref.title, ref);
+
+  const replaced: string[] = [];
+  const kept: string[] = [];
+  const consumed = new Set<any>();
+  for (const ref of collectSpecs(merged)) {
+    const incoming = newByTitle.get(ref.title);
+    if (incoming) {
+      ref.parent[ref.index] = incoming.node; // the new spec wins wholesale
+      consumed.add(incoming.node);
+      replaced.push(ref.title);
+    } else {
+      kept.push(ref.title);
+    }
+  }
+
+  const added: string[] = [];
+  for (const [title, ref] of newByTitle) {
+    if (!consumed.has(ref.node)) added.push(title);
+  }
+  if (added.length > 0 && Array.isArray(nextCopy.suites)) {
+    merged.suites = [...(Array.isArray(merged.suites) ? merged.suites : []), ...pruneConsumed(nextCopy.suites, consumed)];
+  }
+
+  recomputeStats(merged);
+  return { merged, replaced, added, kept };
+}
+
+/**
+ * Ghost detection for the WARN (never a prune): base-kept titles that no
+ * longer correspond to a CURRENT spec title. A `@cases` report title carries
+ * a ` — <label>` suffix while the spec title is the base form, so a ghost is
+ * a title that neither equals a spec title nor extends one with that suffix.
+ */
+export function findGhostTitles(keptTitles: string[], specTitles: string[]): string[] {
+  return keptTitles.filter((title) =>
+    !specTitles.some((spec) => title === spec || title.startsWith(`${spec} — `)));
+}