@sun-asterisk/sungen 3.2.30 → 3.2.32

package/src/generators/test-generator/adapters/playwright/templates/steps/partials/locator-base.hbs

@@ -5,8 +5,8 @@
   {{~#case 'label'}}getByLabel('{{escapeQuotes value}}'{{#if exact}}, { exact: true }{{/if}}){{/case~}}
   {{~#case 'text'}}getByText('{{escapeQuotes value}}'{{#if exact}}, { exact: true }{{/if}}){{/case~}}
   {{~#case 'locator'}}locator('{{escapeQuotes value}}'){{/case~}}
-  {{~#case 'id'}}locator('{{escapeQuotes value}}'){{/case~}}
-  {{~#default}}locator('{{escapeQuotes value}}'){{/default~}}
+  {{~#case 'id'}}locator('{{escapeQuotes (cssIdSelector locator value)}}'){{/case~}}
+  {{~#default}}locator('{{#if locator}}{{escapeQuotes locator}}{{else}}{{escapeQuotes value}}{{/if}}'){{/default~}}
 {{~/switch}}{{else~}}
 {{#if scope}}{{#if (eq scope "dialog")}}{{pageRoot}}.{{else}}{{pageRoot}}.getByLabel('{{escapeQuotes scope}}').{{/if}}{{#switch strategy~}}
   {{~#case 'testid'}}getByTestId('{{escapeQuotes value}}'){{/case~}}
@@ -15,8 +15,8 @@
   {{~#case 'label'}}getByLabel('{{escapeQuotes value}}'{{#if exact}}, { exact: true }{{/if}}){{/case~}}
   {{~#case 'text'}}getByText('{{escapeQuotes value}}'{{#if exact}}, { exact: true }{{/if}}){{/case~}}
   {{~#case 'locator'}}locator('{{escapeQuotes value}}'){{/case~}}
-  {{~#case 'id'}}locator('{{escapeQuotes value}}'){{/case~}}
-  {{~#default}}locator('{{escapeQuotes value}}'){{/default~}}
+  {{~#case 'id'}}locator('{{escapeQuotes (cssIdSelector locator value)}}'){{/case~}}
+  {{~#default}}locator('{{#if locator}}{{escapeQuotes locator}}{{else}}{{escapeQuotes value}}{{/if}}'){{/default~}}
 {{~/switch}}{{else}}{{#switch strategy~}}
   {{~#case 'testid'}}{{> locator-strategies/testid}}{{/case~}}
   {{~#case 'role'}}{{> locator-strategies/role}}{{/case~}}

package/src/generators/test-generator/adapters/playwright/templates/steps/partials/locator-strategies/default.hbs

@@ -1 +1 @@
-page.locator('{{escapeQuotes selector}}')
+{{pageRoot}}.locator('{{#if locator}}{{escapeQuotes locator}}{{else}}{{escapeQuotes value}}{{/if}}')

package/src/generators/test-generator/adapters/playwright/templates/steps/partials/locator-strategies/id.hbs

@@ -1 +1 @@
-page.locator('{{escapeQuotes selector}}')
+{{pageRoot}}.locator('{{escapeQuotes (cssIdSelector locator value)}}')

package/src/generators/test-generator/adapters/playwright/templates/steps/partials/locator.hbs

@@ -5,8 +5,8 @@
   {{~#case 'label'}}getByLabel('{{escapeQuotes value}}'{{#if exact}}, { exact: true }{{/if}}){{/case~}}
   {{~#case 'text'}}getByText('{{escapeQuotes value}}'{{#if exact}}, { exact: true }{{/if}}){{/case~}}
   {{~#case 'locator'}}locator('{{escapeQuotes value}}'){{/case~}}
-  {{~#case 'id'}}locator('{{escapeQuotes value}}'){{/case~}}
-  {{~#default}}locator('{{escapeQuotes value}}'){{/default~}}
+  {{~#case 'id'}}locator('{{escapeQuotes (cssIdSelector locator value)}}'){{/case~}}
+  {{~#default}}locator('{{#if locator}}{{escapeQuotes locator}}{{else}}{{escapeQuotes value}}{{/if}}'){{/default~}}
 {{~/switch}}{{> locator-nth}}{{else~}}
 {{#if scope}}{{#if (eq scope "dialog")}}{{pageRoot}}.{{else}}{{pageRoot}}.getByLabel('{{escapeQuotes scope}}').{{/if}}{{#switch strategy~}}
   {{~#case 'testid'}}getByTestId('{{escapeQuotes value}}'){{/case~}}
@@ -15,8 +15,8 @@
   {{~#case 'label'}}getByLabel('{{escapeQuotes value}}'{{#if exact}}, { exact: true }{{/if}}){{/case~}}
   {{~#case 'text'}}getByText('{{escapeQuotes value}}'{{#if exact}}, { exact: true }{{/if}}){{/case~}}
   {{~#case 'locator'}}locator('{{escapeQuotes value}}'){{/case~}}
-  {{~#case 'id'}}locator('{{escapeQuotes value}}'){{/case~}}
-  {{~#default}}locator('{{escapeQuotes value}}'){{/default~}}
+  {{~#case 'id'}}locator('{{escapeQuotes (cssIdSelector locator value)}}'){{/case~}}
+  {{~#default}}locator('{{#if locator}}{{escapeQuotes locator}}{{else}}{{escapeQuotes value}}{{/if}}'){{/default~}}
 {{~/switch}}{{> locator-nth}}{{else}}{{#switch strategy~}}
   {{~#case 'testid'}}{{> locator-strategies/testid}}{{/case~}}
   {{~#case 'role'}}{{> locator-strategies/role}}{{/case~}}

package/src/generators/test-generator/adapters/playwright/templates/steps/partials/url-assertion.hbs

@@ -15,5 +15,16 @@
 
       `expectPage`, not a bare `toHaveURL`: a polling URL assertion passes on the first transient
       match, before a route guard has bounced the user away (#662). The helper arrives, lets the
-      page settle, holds, and re-asserts — read specs/url-assert.ts. --}}
-await expectPage(page, { pathname: /^{{pathRegex}}\/?$/{{#if query}}, dataRef: '{{escapeQuotes dataRef}}', declared: '{{escapeQuotes query}}'{{/if}} });
+      page settle, holds, and re-asserts — read specs/url-assert.ts.
+
+      `hostname` rides separately and only for an absolute page value, exactly as in the
+      `wait-for-page` twin: it is read off `u.hostname`, which never appears in `u.pathname`, so
+      one concatenated regex cannot carry both. Without it a page declared as
+      `https://admin.example.com/jobs` asserted the PATH on any host, and the public site's /jobs
+      satisfied it.
+
+      The declared-value half is gated on `dataRef`, not on `query`. The step wrote `with {{v}}`
+      either way; gating on the resolved VALUE meant an empty test-data entry silently dropped the
+      whole check and fell back to the bare-page rule, which is the one case specs/url-assert.ts
+      exists to throw on. --}}
+await expectPage(page, { pathname: /^{{pathRegex}}\/?$/{{#if hostRegex}}, hostname: /^{{hostRegex}}$/{{/if}}{{#if dataRef}}, dataRef: '{{escapeQuotes dataRef}}', declared: '{{escapeQuotes query}}'{{/if}} });

package/src/generators/test-generator/adapters/playwright/templates/test-file.hbs

@@ -49,6 +49,20 @@ test.describe('{{featureName}}', () => {
 {{#each scenarios}}
 {{indent this 2}}
 
+{{/each}}
+  });
+
+{{else if noAuth}}
+{{!-- @no-auth demands an EMPTY session (#735). Leaving the group bare inherits whatever
+     playwright.config.ts set through `use.storageState`, so "an anonymous visitor is redirected to
+     sign-in" ran signed in and passed for the wrong reason. Omitting storageState inherits it —
+     an inline empty state is the only way to say "no session". --}}
+  test.describe('no-auth', () => {
+    test.use({ storageState: { cookies: [], origins: [] } });
+
+{{#each scenarios}}
+{{indent this 2}}
+
 {{/each}}
   });
 

package/src/generators/test-generator/code-generator.ts

@@ -167,23 +167,51 @@ function extractAuthRole(tags: string[]): string | undefined {
  * Precedence: Scenario > Feature > None
  */
 function getEffectiveAuthRole(
-  scenarioTags: string[], 
+  scenarioTags: string[],
   featureTags: string[]
 ): string | undefined {
   // Check for explicit @no-auth override
   if (scenarioTags.some(tag => tag === '@no-auth')) {
     return undefined;
   }
-  
+
   // Scenario-level takes precedence
   const scenarioRole = extractAuthRole(scenarioTags);
   if (scenarioRole) return scenarioRole;
-  
+
   // Fall back to feature-level
   const featureRole = extractAuthRole(featureTags);
   return featureRole;
 }
 
+/**
+ * The three auth states a scenario can be in — they are NOT two (#735).
+ *
+ * `@no-auth` and "no auth tag at all" both leave `getEffectiveAuthRole` undefined, but they mean
+ * opposite things: the first demands an EMPTY session, the second inherits whatever
+ * `playwright.config.ts` set via `use.storageState`. Collapsing them put both in one group, so a
+ * scenario written to prove "an anonymous visitor is bounced to sign-in" ran signed in and passed
+ * for the wrong reason — while the exported test case still printed "Not authenticated".
+ *
+ * Returned as a flag beside the role rather than a tagged union so every existing `authRole` reader
+ * keeps working unchanged; only the grouping and the template consult `noAuth`.
+ */
+function getAuthMode(
+  scenarioTags: string[],
+  featureTags: string[],
+): { noAuth: boolean; authRole: string | undefined } {
+  if (scenarioTags.some(tag => tag === '@no-auth')) {
+    return { noAuth: true, authRole: undefined };
+  }
+  return { noAuth: false, authRole: getEffectiveAuthRole(scenarioTags, featureTags) };
+}
+
+/**
+ * Grouping key for the anonymous bucket. A literal that no `@auth:<role>` can produce, so an
+ * imaginative role name can never land in the same group as `@no-auth`.
+ */
+const NO_AUTH_GROUP_KEY = 'no-auth';
+
 
 /**
  * True when the scenario has at least one step in the Then bucket —
@@ -699,7 +727,7 @@ export class CodeGenerator {
     // absent compiles to a skip stub instead of a real test (read once per feature).
     const enabledCaps = new Set<string>(readCapabilities(process.cwd()).enabled.map(d => d.toLowerCase()));
 
-    const renderedScenarios: Array<{ code: string; authRole?: string }> = [];
+    const renderedScenarios: Array<{ code: string; authRole?: string; noAuth?: boolean }> = [];
     for (const scenario of feature.scenarios) {
       if (isManual(scenario.tags)) {
         // SG-W008 — two-direction rule for @manual scenarios:
@@ -758,7 +786,14 @@ export class CodeGenerator {
       const reqAbsent = requiresCaps(scenario.tags).filter(c => !enabledCaps.has(c));
       if (reqAbsent.length) {
         if (this.options.verbose) console.log(`  ⏸ Pending capability (${reqAbsent.join(', ')}): ${scenario.name}`);
-        renderedScenarios.push({ code: this.generateRequiresSkipStub(scenario.name, reqAbsent), authRole: undefined });
+        // Carries its `@no-auth` tag like any other scenario so the stub lands in the group the
+        // author declared — a skipped test that reappears once the capability is enabled must not
+        // quietly change auth bucket.
+        renderedScenarios.push({
+          code: this.generateRequiresSkipStub(scenario.name, reqAbsent),
+          authRole: undefined,
+          noAuth: scenario.tags.includes('@no-auth'),
+        });
         continue;
       }
 
@@ -770,7 +805,7 @@ export class CodeGenerator {
           authFeatureTags = [...baseScenario.tags, ...authFeatureTags];
         }
       }
-      const authRole = getEffectiveAuthRole(scenario.tags, authFeatureTags);
+      const { authRole, noAuth } = getAuthMode(scenario.tags, authFeatureTags);
 
       const code = await this.generateScenario(
         scenario,
@@ -778,15 +813,16 @@ export class CodeGenerator {
         feature.tags || [],
         isParallel
       );
-      renderedScenarios.push({ code, authRole });
+      renderedScenarios.push({ code, authRole, noAuth });
     }
 
     // Group scenarios by auth role for nested test.describe blocks
-    // This ensures test.use({ storageState }) only applies to its group
+    // This ensures test.use({ storageState }) only applies to its group. `@no-auth` gets its OWN
+    // bucket (#735) — it is a demand for an empty session, not the absence of a demand.
     const authGroupMap = new Map<string, string[]>();
     const groupOrder: string[] = [];
-    for (const { code, authRole } of renderedScenarios) {
-      const key = authRole || '';
+    for (const { code, authRole, noAuth } of renderedScenarios) {
+      const key = noAuth ? NO_AUTH_GROUP_KEY : (authRole || '');
       if (!authGroupMap.has(key)) {
         authGroupMap.set(key, []);
         groupOrder.push(key);
@@ -795,7 +831,8 @@ export class CodeGenerator {
     }
 
     const authGroups = groupOrder.map(key => ({
-      authRole: key || undefined,
+      authRole: key === NO_AUTH_GROUP_KEY ? undefined : (key || undefined),
+      noAuth: key === NO_AUTH_GROUP_KEY,
       scenarios: authGroupMap.get(key)!,
     }));
 
@@ -804,6 +841,15 @@ export class CodeGenerator {
     // - Multiple groups: nested describes per auth role
     const needsGrouping = authGroups.length > 1;
 
+    // Rendering the per-group blocks is a SEPARATE question from the guards below (#735). A lone
+    // `@no-auth` group is one group — `needsGrouping` is false — yet it still has to emit its empty
+    // storageState, or an all-anonymous feature silently runs on the config's session. Keeping the
+    // guards keyed on `needsGrouping` means this never trips the appium/serial errors, which are
+    // about MIXING roles. Serial is excluded because its layout builds the context by hand with
+    // `browser.newContext()`, which never picks up `use.storageState` — already anonymous, and a
+    // `test.use` there would apply to nothing.
+    const renderAuthBlocks = needsGrouping || (isParallel && authGroups.some(g => g.noAuth));
+
     // D6 — the Appium test-file template has no per-group before-hook (only `singleAuthRole` runs
     // `__ensureAuth`); >1 auth group would render every group's scenarios with NO authentication at
     // all, silently. Mirrors the web `@parallel` guard below, but unconditional (isParallel has no
@@ -819,15 +865,18 @@ export class CodeGenerator {
 
     if (needsGrouping && !isParallel) {
       throw new Error(
-        `Feature "${feature.name}" has multiple auth groups but no @parallel tag.\n` +
+        `Feature "${feature.name}" has multiple auth groups but runs serially.\n` +
         `Serial mode uses a shared browser context — it cannot mix different auth roles.\n` +
-        `Fix: add @parallel tag to the feature.`
+        `Fix: remove the @serial tag (features are parallel by default), or split "${feature.name}" ` +
+        `into one feature file per auth role.`
       );
     }
     const scenarios = renderedScenarios.map(s => s.code);
 
-    // For single group, extract the auth role to put test.use at describe level
-    const singleAuthRole = !needsGrouping && authGroups.length === 1
+    // For single group, extract the auth role to put test.use at describe level. Keyed on
+    // `renderAuthBlocks`, not `needsGrouping`: a lone `@no-auth` group now renders its own block, so
+    // hoisting anything to the feature describe would double up. Its authRole is undefined anyway.
+    const singleAuthRole = !renderAuthBlocks && authGroups.length === 1
       ? authGroups[0].authRole
       : undefined;
 
@@ -932,8 +981,8 @@ export class CodeGenerator {
       platform,
       cleanup,
       backgroundSteps,
-      scenarios: needsGrouping ? [] : scenarios,
-      authGroups: needsGrouping ? authGroups : undefined,
+      scenarios: renderAuthBlocks ? [] : scenarios,
+      authGroups: renderAuthBlocks ? authGroups : undefined,
       singleAuthRole,
       appPackage,
       iosBundleId,

package/src/generators/test-generator/diagnostics.ts

@@ -218,9 +218,46 @@
  *             signal (SG-W030) it is not dropped-and-warned: with no signal the step is back on the
  *             failure the declaration exists to fix. Recorded here AND thrown, so a pattern that
  *             resolves selectors inside a `catch` cannot swallow it silently
+ *   SG-W032 — a step carries the row filter `in [T] table with {{v}}` but the pattern that won it
+ *             dropped the clause, so the generated code runs against the WHOLE table. Reproduced
+ *             live: `Then User see [Status] text in [Job Table] table with {{v}}` asserts on every
+ *             `.status` in the table and passes on a row the sentence never named. Judged on the
+ *             emitted code — row scoping compiles to `.filter(` on every path that honours it — so
+ *             the `table-*` family (which resolves the container itself, positioned rows included)
+ *             and steps already refused elsewhere are excluded, as is the two-`with` form, which
+ *             binds its tail to the parent and is the rewrite this message points at. A step that
+ *             WRITES is excluded too: a write needs a value, so its `with {{v}}` IS that value and
+ *             cannot also be a row filter — `fill [Search] field in [T] table with {{v}}` is an
+ *             ordinary container-scoped write
+ *   SG-W034 — a `see [X] column with {{v}}` step runs inside a table whose rows are declared with a
+ *             `rows:` SHAPE, so the row is not an ARIA row and holds no ARIA cells — yet the
+ *             assertion's only other way to reach a cell is `getByRole('cell')`, which matches
+ *             nothing there. `columns.<col>.index` cannot rescue it either: it indexes that same
+ *             empty set. Silent before this, and silent in the worst way — `toBeVisible()` on an
+ *             empty locator fails as a timeout blaming the app. The message names the
+ *             `columns.<col>.elements.cell` declaration that resolves the cell directly. Scoped to
+ *             the `rows:` case on purpose: on a real <table> the role fallback is correct, and a
+ *             diagnostic that fires on the correct spelling gets muted along with the real ones
+ *   SG-E035 — `table match data:` on a table whose rows are declared with a `rows:` SHAPE and whose
+ *             columns are not declared (or do not cover every column of the DataTable). The
+ *             assertion reads the header row from `thead tr` and addresses cells as `td, th`;
+ *             a list built from <div>s has neither, forever — not a render race — so the step can
+ *             only wait out every timeout and fail on an empty header row. Refused at compile time
+ *             instead, naming the `columns:` entries it needs. Declaring them replaces the runtime
+ *             header read entirely: the index is known at compile time, and a column that names
+ *             its own `elements.cell` addresses the cell without any table role at all
+ *   SG-W036 — a `remember [X] … as {{v}}` capture whose entry selects by SHAPE (`locator`/`css`)
+ *             and pins no `nth:`. A capture reads ONE element and the template takes the first
+ *             match — the right default, and exactly what the documented `nth: 0` workaround asked
+ *             for after Playwright's strict mode turned a list-shaped selector into a hard failure
+ *             naming the count instead of the step. But "the first of many" is a decision: if the
+ *             selector describes every item in a list, the captured value is the first row's rather
+ *             than the one the scenario means, and nothing else would ever say so. Not reported for
+ *             testid/label/placeholder/role+name/text entries, which name a particular thing —
+ *             warning there would fire on nearly every capture in a suite
  * Diagnostics never change the EXIT CODE by themselves; `sungen generate --strict` turns any
  * collected diagnostic into a non-zero exit. They are not all inert, though: SG-W001, SG-W011,
- * SG-E020, SG-E021, SG-W020, SG-E023, SG-E024, SG-E025, SG-E026 and SG-E027 additionally compile
+ * SG-E020, SG-E021, SG-W020, SG-E023, SG-E024, SG-E025, SG-E026, SG-E027 and SG-E035 additionally compile
  * the offending step to a runtime `throw` — a step that reads as a check and silently checks
  * nothing is worse than one that fails loudly — and SG-E031 refuses the file outright. (SG-E022 is
  * the one exception to the "blame the Gherkin" rule and throws nothing: the file is still written
@@ -228,7 +265,7 @@
  * Generation always COMPLETES — the rest of the scenario and the rest of the file still compile.
  */
 
-export type DiagnosticCode = 'SG-W001' | 'SG-W002' | 'SG-W003' | 'SG-W004' | 'SG-W005' | 'SG-W006' | 'SG-W007' | 'SG-W008' | 'SG-W009' | 'SG-W010' | 'SG-W011' | 'SG-W012' | 'SG-W013' | 'SG-W014' | 'SG-W015' | 'SG-W016' | 'SG-W017' | 'SG-W018' | 'SG-E020' | 'SG-E021' | 'SG-W020' | 'SG-W021' | 'SG-W022' | 'SG-W023' | 'SG-W024' | 'SG-W026' | 'SG-E025' | 'SG-E026' | 'SG-E022' | 'SG-E023' | 'SG-E024' | 'SG-E027' | 'SG-W028' | 'SG-W029' | 'SG-W030' | 'SG-E031';
+export type DiagnosticCode = 'SG-W001' | 'SG-W002' | 'SG-W003' | 'SG-W004' | 'SG-W005' | 'SG-W006' | 'SG-W007' | 'SG-W008' | 'SG-W009' | 'SG-W010' | 'SG-W011' | 'SG-W012' | 'SG-W013' | 'SG-W014' | 'SG-W015' | 'SG-W016' | 'SG-W017' | 'SG-W018' | 'SG-E020' | 'SG-E021' | 'SG-W020' | 'SG-W021' | 'SG-W022' | 'SG-W023' | 'SG-W024' | 'SG-W026' | 'SG-E025' | 'SG-E026' | 'SG-E022' | 'SG-E023' | 'SG-E024' | 'SG-E027' | 'SG-W028' | 'SG-W029' | 'SG-W030' | 'SG-E031' | 'SG-W032' | 'SG-W034' | 'SG-E035' | 'SG-W036';
 
 export interface Diagnostic {
   code: DiagnosticCode;

package/src/generators/test-generator/patterns/index.ts

@@ -48,7 +48,7 @@ const TAP_GESTURE_FORMS = /\bdouble[-\s]?tap|\btap(?:s)?\b[^.]*\b(?:top of|at th
  *      one of the two mobile patterns that must stay UNDECLARED.
  *   2. Both vocabularies then see their own verb, and ordinary PRIORITY decides the winner —
  *      no matcher has to learn about the other. `tap … and accept alert` reaches
- *      `click-with-alert` (21); `tap … in [T] table row 2` reaches `table-action-in-row-nth` (19);
+ *      `click-with-alert` (21); `tap … in [T] table row 2` reaches `table-action-in-row-nth` (18);
  *      a plain `tap` still lands on `mobile-tap` (15) ahead of `click-element` (10).
  *
  * Safe because every click-keyed matcher in the vocabulary is a word-boundary test (`\bclick(s)?\b`

package/src/generators/test-generator/step-mapper.ts

@@ -3,7 +3,7 @@ import { PARENT_CONTAINER_TYPES } from '../gherkin-parser/parent-scope-clause';
 import { TemplateEngine } from './template-engine';
 import { adapterRegistry } from './adapters';
 import { PatternRegistry, PatternContext, Platform } from './patterns';
-import { SelectorResolver } from './utils/selector-resolver';
+import { SelectorResolver, type ResolvedSelector } from './utils/selector-resolver';
 import { DataResolver } from './utils/data-resolver';
 import { locatorIdentityKey } from './utils/dialog-scope-identity';
 import { DiagnosticsCollector } from './diagnostics';
@@ -470,6 +470,8 @@ export class StepMapper {
       if (positionDropped) return positionDropped;
       const swallowed = this.checkAssertionClauseSwallowed(step, mappedStep);
       if (swallowed) return swallowed;
+      const rowFilterDropped = this.checkRowFilterClauseDropped(step, mappedStep);
+      if (rowFilterDropped) return rowFilterDropped;
       const badType = this.checkUnknownSelectorType(step, mappedStep);
       if (badType) return badType;
       return mappedStep;
@@ -680,6 +682,69 @@ export class StepMapper {
     };
   }
 
+  /**
+   * The `in [T] table with {{v}}` row filter is the sentence's narrowest claim — it names ONE row.
+   * A pattern that does not consume it leaves the step running against the WHOLE table, and the
+   * author cannot see that from the Gherkin.
+   *
+   * Judged on the emitted code, not on which pattern won: `.filter(` is what row scoping compiles
+   * to on every path that honours the clause, so its absence is the fact. Three exclusions, each
+   * measured rather than assumed:
+   *   - the `table-*` family resolves the container from the step text itself; its positioned-row
+   *     form emits `toHaveCount(1)` + `toContainText` with no filter at all and is CORRECT;
+   *   - a step already refused elsewhere compiles to a `throw`, and a second opinion on top of the
+   *     refusal (an off-platform table step already gets SG-W020) is two contradictory messages
+   *     about one step;
+   *   - the two-`with` form binds its tail to the PARENT, which does compile to a filter — it is
+   *     the shape this diagnostic points people at, so it must never be flagged.
+   *
+   * A step that WRITES is exempt rather than escalated — see ROW_FILTER_WRITE_CALL. It stays a
+   * WARNING for the rest, in line with the repo's rule that a diagnostic which cries wolf gets muted
+   * wholesale: the single-`with` sentence is genuinely ambiguous, and reading the value as the
+   * expected text is a legitimate compilation of it, just not the one most authors mean.
+   */
+  private static readonly ROW_FILTER_CLAUSE = /\bin\s+\[[^\]]+\]\s+table\s+with\b/i;
+
+  /**
+   * Calls that WRITE through the scoped locator, as opposed to reading it. Both adapters are listed:
+   * the mobile spelling of a fill is `setValue`/`addValue`.
+   *
+   * A write is EXEMPT, not escalated. A step that writes needs a value, so its `with {{v}}` is that
+   * value and cannot also be a row filter — `fill [Search] field in [Job Table] table with {{v}}` is
+   * an ordinary container-scoped write, and a toolbar search box inside a table is exactly that. The
+   * danger an earlier reading claimed for it does not exist either: on a multi-row table a
+   * mis-scoped write is a loud strict-mode failure, and on a single-row table there is only one
+   * field to write to.
+   */
+  private static readonly ROW_FILTER_WRITE_CALL =
+    /\.(?:fill|type|setInputFiles|selectOption|clear|check|uncheck|press|setValue|addValue|clearValue)\(/;
+
+  private checkRowFilterClauseDropped(step: ParsedStep, mapped: MappedStep): MappedStep | null {
+    const code = mapped.code || '';
+    if (!StepMapper.ROW_FILTER_CLAUSE.test(step.text)) return null;
+    // Bound to the parent instead of the target — that IS the scoped form.
+    if (step.parentValueRef || step.parentValueText) return null;
+    if (mapped.pattern?.startsWith('table-')) return null;
+    if (code.startsWith('throw new Error(')) return null;
+    if (/\.filter\(/.test(code)) return null;
+
+    if (StepMapper.ROW_FILTER_WRITE_CALL.test(code)) return null;
+
+    const table = step.parentRef ?? 'Table';
+    const target = step.selectorRef ?? 'X';
+    const type = step.elementType ?? 'text';
+    const filter = step.dataRef ? `{{${step.dataRef}}}` : 'the row value';
+    const rewrite = `User see [${target}] ${type} with <expected> in [<Row Entry>] row with ${filter}`;
+    this.diagnostics?.add('SG-W032',
+      `step "${step.text}" reads "with ${filter}" as the EXPECTED VALUE, not as a row filter — the `
+      + `sentence names a row but the assertion runs against the whole [${table}] table, so it can `
+      + `pass on a row the sentence never named. To scope the row, use the two-"with" form: `
+      + `"${rewrite}". Point that second \`[…]\` at a ROW entry, not at the table entry — a filter `
+      + `applied to the table narrows nothing and the assertion stays as weak as it is now.`,
+      { feature: this.featureName, step: step.text });
+    return null;
+  }
+
   private checkAssertionClauseSwallowed(step: ParsedStep, mapped: MappedStep): MappedStep | null {
     const code = mapped.code || '';
     // Bare visibility: nothing but a visible/displayed assertion on one locator.
@@ -804,21 +869,57 @@ export class StepMapper {
 
     // Try to find column index from table's columns config
     let columnIndex: number | undefined;
+    // The CELL, when the table declares one. `getByRole('cell')` below is the only other way this
+    // template can reach a cell, and a row shape built from <div>s has no cell role anywhere in it
+    // — the assertion then matches zero elements on a list that renders perfectly well. A
+    // `columns.<col>.elements.cell` entry names the cell directly and sidesteps the role entirely.
+    // `columns.<col>.index` cannot help there: it indexes the very getByRole('cell') set that is
+    // empty.
+    let cellLocator: string | undefined;
     if (this.rowScopeTable) {
+      // Only the table LOOKUP is guarded. Widening the catch to cover the cell resolution below
+      // would swallow a broken `elements.cell` declaration under a comment about a missing table,
+      // and silently serve the ARIA fallback with no diagnostic at all.
+      let tableResolved: ResolvedSelector | undefined;
       try {
-        const tableResolved = this.selectorResolver.resolveSelector(
+        tableResolved = this.selectorResolver.resolveSelector(
           this.rowScopeTable, this.featureName, 'table', 0
         );
-        const columnKey = columnRef.toLowerCase().normalize('NFC');
-        columnIndex = tableResolved.columns?.[columnKey]?.index;
       } catch {
         // Table not found — fallback to filter
       }
+      if (tableResolved) {
+        const columnKey = columnRef.toLowerCase().normalize('NFC');
+        const column = tableResolved.columns?.[columnKey];
+        columnIndex = column?.index;
+        const cellEntry = column?.elements?.cell;
+        // A shape that still selects <tr> keeps its ARIA rows and cells, so the role fallback below
+        // serves it exactly as before. Only a shape built from something else loses them.
+        const shapeHidesTableRoles = !!tableResolved.rows
+          && !/(^|[\s>+~,(])tr\b/i.test(tableResolved.rows);
+        if (cellEntry) {
+          cellLocator = this.templateEngine.renderStep('locator', {
+            ...this.selectorResolver.resolveNestedEntry(cellEntry, columnRef),
+            parentLocator: 'tableRow',
+          });
+        } else if (shapeHidesTableRoles) {
+          // The rows are not ARIA rows, so their children are not ARIA cells either. Warned only in
+          // that case: on a real <table> — including one that pins its row universe with
+          // `rows: 'tbody tr'` — the role fallback is correct, and a diagnostic that fires on the
+          // correct spelling gets muted along with the real ones.
+          this.diagnostics?.add('SG-W034',
+            `column "[${columnRef}]" is asserted inside a table whose rows are declared with a "rows:" `
+            + `shape, so the row is not an ARIA row and holds no ARIA cells — this step falls back to `
+            + `getByRole('cell'), which matches nothing there. Name the cell on the column, e.g. `
+            + `"${this.rowScopeTable.toLowerCase()}:\\n  columns:\\n    ${columnKey}:\\n      index: 0\\n      header: '${columnRef}'\\n      elements:\\n        cell:\\n          type: locator\\n          value: '.your-cell-class'"`,
+            { feature: this.featureName, step: step.text });
+        }
+      }
     }
 
     const isGiven = this.lastPrimaryKeyword === 'Given';
     const code = this.templateEngine.renderStep('row-scoped-column-assertion', {
-      columnIndex, cellValue, isGiven,
+      columnIndex, cellValue, isGiven, cellLocator,
     });
 
     return {

package/src/generators/test-generator/template-engine.ts

@@ -53,6 +53,24 @@ export class TemplateEngine {
         .replace(/\u2029/g, '\\u2029');
     });
 
+    // The CSS selector behind an `id` strategy, from whichever field carries it.
+    //
+    // Two shapes reach this with two different conventions. A new-format entry (`type: id`) keeps
+    // whatever the author wrote in `value`; the legacy `resolveByPriority` path STRIPS the hash,
+    // returning `value: 'submit-btn'` with the full `#submit-btn` in `locator`. Reading `value`
+    // alone would therefore compile `#submit-btn` down to `page.locator('submit-btn')` — a type
+    // selector that matches nothing, which an `is hidden` assertion then passes forever.
+    //
+    // A bare word gets its `#` back for the same reason: `id` is also a mobile strategy, where the
+    // convention IS bare ("bottom_bar"), so an entry copied across platforms would otherwise be a
+    // silent no-match on web. Anything already carrying selector syntax is passed through untouched.
+    Handlebars.registerHelper('cssIdSelector', function(locator: any, value: any) {
+      const raw = (typeof locator === 'string' && locator) ? locator : (value ?? '');
+      const text = String(raw);
+      if (!text) return '';
+      return /[#.\[\]:>~+ ]/.test(text) ? text : `#${text}`;
+    });
+
     Handlebars.registerHelper('includes', function(text: string, search: string) {
       return typeof text === 'string' && text.includes(search);
     });

package/src/generators/test-generator/utils/selector-resolver.ts

@@ -751,6 +751,15 @@ export class SelectorResolver {
     return out.class || out.attribute ? out : undefined;
   }
 
+  /**
+   * Resolve a selectors.yaml entry that is NOT reachable by key — a `columns.<col>.elements.cell`
+   * declaration, which lives nested under a table entry. Public for that one caller; everything
+   * addressable by name goes through `resolveSelector`.
+   */
+  resolveNestedEntry(entry: SelectorEntry, originalLabel: string): ResolvedSelector {
+    return this.resolveFromEntry(entry, originalLabel);
+  }
+
   private resolveFromEntry(entry: SelectorEntry, originalLabel: string): ResolvedSelector {
     // Default values
     const locator = entry.locator || '';
@@ -971,9 +980,15 @@ export class SelectorResolver {
           exact,
         });
 
-      // Mobile (Appium) native strategies — pass through unchanged; the appium adapter's
-      // `appium-selector` switch renders the right WDIO selector (`~` / raw xpath / `android=` /
-      // `-ios predicate string:` / `id=`). On web these types never appear. See issue #392.
+      // Native strategies — pass through unchanged; the appium adapter's `appium-selector` switch
+      // renders the right WDIO selector (`~` / raw xpath / `android=` / `-ios predicate string:` /
+      // `id=`). See issue #392.
+      //
+      // `id` is NOT mobile-only, whatever this comment used to claim: the legacy branch at the
+      // bottom of resolveByPriority extracts `#id` out of a web `locator:` and returns
+      // `strategy: 'id'`, and the playwright adapter ships an `id` partial to serve it. The two
+      // paths disagree on whether `value` carries the hash, which is why the partial reads the
+      // selector through `cssIdSelector` rather than off `value` directly.
       case 'accessibility-id':
       case 'xpath':
       case 'android-uiautomator':

package/src/harness/audit.ts

@@ -27,7 +27,7 @@ import { specCoverage, SpecCoverageResult, parseSpecClauses, restatedRequirement
 import { downstreamScope, manualOracle, readText, DownstreamResult, ManualOracleResult,
   negativeSideEffect, sourceBacked, crossArtifactOwnership, isolationRisk, serialCascadeRisk } from './quality-gates';
 import { viewpointLedger, parseViewpointItems, browserGestureSubstitutions, substitutionRemedy, viewpointIntegrity, LedgerResult } from './viewpoint-ledger';
-import { specBranches, unenumeratedBranches, sameOracleClusters, permissionPairGaps, awaitingSeedData, unconsideredRisks, MULTI_SCREEN_RISKS } from './spec-branches';
+import { specBranches, unenumeratedBranches, sameOracleClusters, visibilityPairGaps, awaitingSeedData, unconsideredRisks, MULTI_SCREEN_RISKS } from './spec-branches';
 const MULTI_SCREEN_RISK_COUNT = MULTI_SCREEN_RISKS.length;
 import { capabilityRegistry } from '../capabilities/registry';
 import { discoverAndRegisterCapabilities } from '../capabilities/discover';
@@ -243,7 +243,18 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   const downstream = downstreamScope(readText(specPath), scenarios, featureText);
   const manualOracleResult = manualOracle(featureText);
   const autoManual = automatableManual(scenarios); // TQ-2 — @manual that is really automatable
-  const ledger = viewpointLedger(viewpointPath, scenarios, featureText);
+  // The ledger decides "covered" by looking the claim's id up in the feature TEXT, and a comment
+  // is text: a file whose header comment merely mentions VP-74 scored it covered while no scenario
+  // implemented it. That is a false GREEN on a critical axis — the one kind of wrong answer an
+  // audit must not give. Comments live on their own lines in Gherkin, so dropping those lines is
+  // the whole fix; no parser is needed.
+  //
+  // Stripped HERE and nowhere else. The shared `featureText` above feeds twelve other readers, one
+  // of which (`manualOracle`) reads `#` lines ON PURPOSE — a `@manual` scenario with no steps
+  // carries its entire procedure in comments — so stripping at the source would delete that
+  // oracle's only input.
+  const ledgerFeatureText = featureText.split('\n').filter((l) => !/^\s*#/.test(l)).join('\n');
+  const ledger = viewpointLedger(viewpointPath, scenarios, ledgerFeatureText);
   const negSideEffect = negativeSideEffect(scenarios);
   const ownership = crossArtifactOwnership(screenDir, scenarios);
   // @exploration scenarios are probes outside the official suite — the finding's own fix
@@ -646,6 +657,11 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
   for (const u of spec.uncoveredMust) {
     findings.push(`SPEC-UNCOVERED: ${u.id} (MUST) has no covering scenario — "${u.text}" → add a scenario or tag one @spec:${u.id}.`);
   }
+  // #679 — a requirement that states both directions is two requirements wearing one id. Citing
+  // the id closes the id, not the clause the suite never asserts.
+  for (const c of spec.clauseGaps) {
+    findings.push(`SPEC-CLAUSE-UNCOVERED: ${c.id} states both directions and only one is proved — nothing asserts its ${c.polarity === 'negate' ? 'MUST NOT' : 'MUST'} clause ("${c.text}"). One scenario tagged @spec:${c.id} cannot demonstrate a rule and its opposite: the states are mutually exclusive, so each needs its own case. Write the ${c.polarity === 'negate' ? 'negative' : 'positive'} case, or narrow the requirement to the direction the suite actually covers.`);
+  }
   if (spec.inferredOnly.length > 0) {
     // Covered, but only by keyword inference — no scenario cites the id. Delivery's
     // requirement table (and any later refactor) cannot follow an inferred link, so
@@ -742,9 +758,12 @@ export function runAudit(screenDir: string, screenName: string): AuditReport {
     }
   }
   // #630 — a deny-side security case with no allow-side counterpart cannot tell a working guard
-  // from a feature that is broken for everyone.
-  for (const g of permissionPairGaps(scenarios).slice(0, 4)) {
-    findings.push(`PERMISSION-PAIR-MISSING: "${g.scenario}" proves the content is hidden when permission is denied, but no scenario proves it is SHOWN when permission is granted. If the code hid it unconditionally this would still pass — the pair is the test, the way min-1/min/max/max+1 is the test for a boundary. Add the allow-side case${g.subject.length ? ` for [${g.subject.join(', ')}]` : ''}.`);
+  // from a feature that is broken for everyone. #679 — the same reasoning holds for any condition,
+  // so the trigger is the ELEMENT proved absent and never proved present, not permission wording.
+  for (const g of visibilityPairGaps(scenarios).slice(0, 4)) {
+    findings.push(g.kind === 'permission'
+      ? `PERMISSION-PAIR-MISSING: "${g.scenario}" proves ${g.element ? `[${g.element}]` : 'the content'} is hidden when permission is denied, but no scenario proves it is SHOWN when permission is granted. If the code hid it unconditionally this would still pass — the pair is the test, the way min-1/min/max/max+1 is the test for a boundary. Add the allow-side case${g.subject.length ? ` for [${g.subject.join(', ')}]` : ''}.`
+      : `VISIBILITY-PAIR-MISSING: "${g.scenario}" proves [${g.element}] is ABSENT, and no scenario in this unit proves it is ever SHOWN. "Show A or B, never both" is the defect this misses — and a selector that matches nothing passes \`is hidden\` forever, so a one-sided assertion can be vacuous. Add the counterpart case under the opposite condition (the state where [${g.element}] must appear).`);
   }
   // #630 — a scenario blocked on unseeded data is a DATA task, not unfinished test design.
   {

package/src/harness/next-step.ts

@@ -167,7 +167,8 @@ const REPAIRABLE = [
   'FLOW-CONTRACT-MISSING', 'FLOW-INVENTORY-MISSING', 'FLOW-UNCOVERED', 'FLOW-UNDECLARED',
   'FLOW-PHASE-MISFILED', 'FLOW-GUARANTEE-MISSING', 'FLOW-OUTCOME-UNPROVEN', 'CONTINUITY-ONE-SIDED',
   'ORACLE-URL-ONLY',
-  'SPEC-RESTATED-UNVERIFIED', 'VIEWPOINT-GESTURE-SUBSTITUTED', 'SPEC-UNCOVERED', 'TRIGGER-UNCOVERED',
+  'SPEC-RESTATED-UNVERIFIED', 'VIEWPOINT-GESTURE-SUBSTITUTED', 'SPEC-UNCOVERED', 'SPEC-CLAUSE-UNCOVERED',
+  'TRIGGER-UNCOVERED', 'PERMISSION-PAIR-MISSING', 'VISIBILITY-PAIR-MISSING',
   'VIEWPOINT-ITEM-MISSING', 'MANUAL-CODE-MISSING', 'MANUAL-AUTOMATABLE', 'DEPTH-DEFERRED',
 ];