@sun-asterisk/sungen 3.2.32 → 3.2.34

package/src/generators/gherkin-parser/index.ts

@@ -154,11 +154,18 @@ export class GherkinParser {
   }
 
   /**
-   * Range-attach top-level Gherkin comments to the scenario whose body contains them.
-   * A comment belongs to scenario i when its line is after scenario i's `Scenario:` line
-   * and before scenario i+1's header (its first tag line, or its `Scenario:` line). The
-   * leading `# ` is stripped. Used to surface a @manual scenario's tester-procedure comments
+   * Attach top-level Gherkin comments to the scenario they describe. The leading `# ` is
+   * stripped. Used to surface a @manual scenario's tester procedure and `# MANUAL:` reason
    * (its only "steps") in the delivery report.
+   *
+   * A scenario owns:
+   *   • its LEADING block — the comment lines directly above its header with no blank line in
+   *     between (and any comment between its tag lines and `Scenario:`), as long as they sit
+   *     after the previous scenario's last step. `# MANUAL (…): reason` written above the tags
+   *     belongs to the scenario below it; it used to range onto the scenario ABOVE, where the
+   *     manual parser appended it to that scenario's last oracle line (#810);
+   *   • its BODY — every other comment after its `Scenario:` line and before the next
+   *     scenario's leading block / header.
    */
   private attachScenarioComments(
     doc: Messages.GherkinDocument,
@@ -167,22 +174,32 @@ export class GherkinParser {
   ): void {
     const comments = doc.comments || [];
     if (!comments.length) return;
-    const scenChildren = feature.children
-      .filter((c) => c.scenario)
-      .map((c) => c.scenario!);
+    const lineOf = new Map<number, string>(
+      comments.map((cm) => [cm.location.line, cm.text.replace(/^\s*#\s?/, '').replace(/\s+$/, '')]),
+    );
     // Same filter/order as parseScenarios → indices line up with `scenarios`.
+    const scenChildren = feature.children.filter((c) => c.scenario).map((c) => c.scenario!);
+    const background = feature.children.find((c) => c.background)?.background;
+    const headerLine = (sc: Messages.Scenario): number =>
+      Math.min(sc.location.line, ...(sc.tags || []).map((t) => t.location.line));
+
+    // Leading block of scenario i: [firstLeading, sc.location.line).
+    const leadingStart = scenChildren.map((sc, i) => {
+      const prevEnd = i > 0 ? bodyEndLine(scenChildren[i - 1]) : background ? bodyEndLine(background) : feature.location.line;
+      let first = headerLine(sc);
+      while (lineOf.has(first - 1) && first - 1 > prevEnd) first--;
+      return first;
+    });
+
     for (let i = 0; i < scenChildren.length && i < scenarios.length; i++) {
-      const startLine = scenChildren[i].location.line;
-      const next = scenChildren[i + 1];
-      let endLine = Number.POSITIVE_INFINITY;
-      if (next) {
-        const tagLines = (next.tags || []).map((t) => t.location.line);
-        endLine = Math.min(next.location.line, ...(tagLines.length ? tagLines : [next.location.line]));
-      }
-      const body = comments
-        .filter((cm) => cm.location.line > startLine && cm.location.line < endLine)
-        .map((cm) => cm.text.replace(/^\s*#\s?/, '').replace(/\s+$/, ''));
-      if (body.length) scenarios[i].comments = body;
+      const from = leadingStart[i];
+      const to = i + 1 < scenChildren.length ? leadingStart[i + 1] : Number.POSITIVE_INFINITY;
+      const own = comments
+        .map((cm) => cm.location.line)
+        .filter((line) => line >= from && line < to)
+        .sort((a, b) => a - b)
+        .map((line) => lineOf.get(line)!);
+      if (own.length) scenarios[i].comments = own;
     }
   }
 
@@ -360,3 +377,18 @@ export class GherkinParser {
     return files;
   }
 }
+
+/** Last source line a scenario/background occupies: its steps, their data tables/doc strings, examples. */
+function bodyEndLine(block: Messages.Scenario | Messages.Background): number {
+  let end = block.location.line;
+  for (const step of block.steps) {
+    end = Math.max(end, step.location.line);
+    for (const row of step.dataTable?.rows ?? []) end = Math.max(end, row.location.line);
+    if (step.docString) end = Math.max(end, step.docString.location.line + step.docString.content.split('\n').length + 1);
+  }
+  for (const ex of ('examples' in block ? block.examples : [])) {
+    end = Math.max(end, ex.location.line);
+    for (const row of [...(ex.tableHeader ? [ex.tableHeader] : []), ...ex.tableBody]) end = Math.max(end, row.location.line);
+  }
+  return end;
+}

package/src/generators/test-generator/adapters/adapter-interface.ts

@@ -5,7 +5,11 @@
 
 export interface AuthGroup {
   authRole?: string;
+  noAuth?: boolean;
   scenarios: string[];
+  /** The feature's `@afterEach`, scoped to this group — set when the feature mixes `@no-auth` with
+   *  other groups, so the hook never runs on an anonymous test's empty session (#815). */
+  afterEach?: string;
 }
 
 /**
@@ -42,7 +46,7 @@ export interface TestFileData {
   runtimeData?: boolean; // --runtime-data flag: testData.get() instead of hardcoded values
   screenName?: string; // Screen name for TestDataLoader.load()
   featureFileName?: string; // Feature file name for TestDataLoader.load()
-  isParallel?: boolean; // @parallel tag: fresh page per test (opt-out from serial default)
+  isParallel?: boolean; // !@serial: fresh page per test. Parallel is the default; @parallel only names it
   flowMode?: boolean;   // flow: cross-screen → longer per-test timeout (bug #243)
   platform?: string;    // mobile @platform:* value (mobile|android|ios) → `// sungen:platform=` marker for wdio per-OS routing
   cleanup?: { overlay?: boolean; forms?: boolean; scroll?: boolean; storage?: boolean };
@@ -65,7 +69,7 @@ export interface ScenarioData {
   scenarioName: string;
   steps: Array<{ comment?: string; code: string }>;
   authRole?: string; // Auth role for storage state
-  isParallel?: boolean; // @parallel: use fresh page from fixture
+  isParallel?: boolean; // !@serial: use fresh page from fixture
   tags?: string; // Pass-through tags for Playwright { tag: [...] }, e.g. "'@smoke', '@high'"
   casesDataset?: string; // @cases:<dataset> — emit one test() per row of the runtime dataset
   resetTier?: string; // Mobile (appium): scenario-level `@reset:` override; raises (never lowers) the feature tier for this scenario only

package/src/generators/test-generator/adapters/appium/templates/steps/actions/reinstall-app-action.hbs

@@ -2,8 +2,8 @@
 // Persistence oracles (dismissals, pins) hinge on what survives a reinstall.
 await (async () => {
   const __pkg = __resolveAppId();
-  const __caps = (driver.requestedCapabilities || {}) as Record<string, string>;
-  const __appPath = __caps['appium:app'] || __caps['app'];
+  // Same reader the reset tiers use — one place decides what "the session has a build file" means.
+  const __appPath = __appBuildPath();
   if (!__appPath) {
     throw new Error('reinstall the app: the session must install from a build file — set APP_APK (Android) / IOS_APP (iOS) so the appium:app capability is present.');
   }

package/src/generators/test-generator/adapters/appium/templates/steps/assertions/label-value-assertion.hbs

@@ -9,12 +9,18 @@
       Flutter screen; UiSelector has no OR, hence the xpath. iOS scatters it across
       label/value, which the predicate already ORs.
 
+      SCOPE (#747): an `in [Parent] <type>` clause chains this under the parent element. The android
+      xpath must go RELATIVE (`.//`) to do so — a child xpath beginning with `//` is ABSOLUTE in
+      Appium even when chained, so keeping it would emit code that LOOKS scoped and searches the whole
+      screen, which is the same silent widening the scope clause exists to prevent. The iOS predicate
+      carries no such trap and chains as written.
+
       The expected value must stay a standalone quoted literal so the runtime-data transform
       can swap it for testData.get(...). --}}
 {
   const __expected = String('{{escapeQuotes dataValue}}').trim();
   const __sel = driver.isIOS
     ? `-ios predicate string:label == "${__expected}" OR value == "${__expected}"`
-    : `//*[@text="${__expected}" or @content-desc="${__expected}"]`;
-  await expect($(__sel)).toBeDisplayed();
+    : `{{#if parentLocator}}.{{/if}}//*[@text="${__expected}" or @content-desc="${__expected}"]`;
+  await expect({{#if parentLocator}}{{parentLocator}}.$(__sel){{else}}$(__sel){{/if}}).toBeDisplayed();
 }

package/src/generators/test-generator/adapters/appium/templates/steps/assertions/visible-with-role-variable-assertion.hbs

@@ -1,13 +1,17 @@
 {{!-- Role variable, visible (mobile best-effort): ARIA role has no native-mobile analog — reuse
       the role→accessibility-id mapping in appium-selector.hbs (`~name`) when a static name
       exists; the resolver already folds dataValue into name when there is none, so this is only
-      the fallback for a caller that omits both. --}}
+      the fallback for a caller that omits both.
+
+      SCOPE (#747): an `in [Parent] <type>` clause chains this under the parent element. Both
+      branches locate by accessibility id / predicate, neither of which carries the absolute-xpath
+      trap the label-value twin has to work around. --}}
 {{#if name}}
-await expect($('~{{escapeQuotes name}}')).toBeDisplayed();
+await expect({{#if parentLocator}}{{parentLocator}}.$('~{{escapeQuotes name}}'){{else}}$('~{{escapeQuotes name}}'){{/if}}).toBeDisplayed();
 {{else}}
 {
   const __expected = String('{{escapeQuotes dataValue}}').trim();
   const __sel = driver.isIOS ? `-ios predicate string:label == "${__expected}" OR value == "${__expected}"` : `android=new UiSelector().text("${__expected}")`;
-  await expect($(__sel)).toBeDisplayed();
+  await expect({{#if parentLocator}}{{parentLocator}}.$(__sel){{else}}$(__sel){{/if}}).toBeDisplayed();
 }
 {{/if}}

package/src/generators/test-generator/adapters/appium/templates/test-file.hbs

@@ -502,9 +502,36 @@ describe('{{featureName}}', () => {
   // lose the escalation between them — SG-W024 already reports that shape when tiers are involved.)
   let __escalateAfter: string | null = null;
 
+  // `@known-defect` marks a scenario that is EXPECTED to be red — it asserts a live defect. The
+  // scaffolded /sungen:run-test command tells authors exactly that ("expected-red scenarios stay red;
+  // never 'fix' them"), so the ladder honours it here: such a failure is the suite working as
+  // designed, not evidence of leftover state. Arming escalation off it would make the NEXT scenario
+  // pay a harder reset for nothing — on every run, forever, because the defect is known.
+  //
+  // Read off the TITLE because `@known-defect` is a pass-through tag: appium appends it there as the
+  // `[@a @b]` suffix (which is what keeps it greppable via `--grep`), and that is how the field
+  // report shows it. Anchored to that trailing group, so a scenario merely NAMED `… known-defect …`
+  // cannot exempt itself — the same reason __tierFor refuses to strip a trailing `[Selector]` ref.
+  //
+  // Matched as a whole TAG TOKEN, never as a substring. `@known-defect-list` is a DIFFERENT tag, and
+  // reading it as this one would silently stop the next scenario's real dirty-state failure from
+  // getting the escalated reset it needs — with no log line at all, because "never armed" is not the
+  // "capped" path and prints nothing. The `:<ref>` parameter form is accepted because that is what
+  // the rest of the vocabulary does (`@manual:M10`, `@reset:data`).
+  //
+  // Caveat, inherited rather than introduced: a @cases scenario builds its title at runtime as
+  // `name — <row label>`, so a row LABEL that itself ends in `[@…]` would be read as the tag group.
+  // Same trailing-bracket ambiguity __tierFor accepts for a `[Selector]` ref.
+  function __isExpectedFail(title: string): boolean {
+    const tagGroup = title.match(/ \[@[^\]]*\]$/);
+    if (!tagGroup) return false;
+    return tagGroup[0].slice(2, -1).split(/\s+/)
+      .some((t) => t === '@known-defect' || t.startsWith('@known-defect:'));
+  }
+
   // Registered BEFORE any user @afterEach block so a throwing user hook cannot skip the bookkeeping.
   afterEach(async function () {
-    __escalateAfter = this.currentTest?.state === 'failed' ? (this.currentTest?.title ?? '') : null;
+    __escalateAfter = this.currentTest?.state === 'failed' && !__isExpectedFail(this.currentTest?.title ?? '') ? (this.currentTest?.title ?? '') : null;
   });
 
 {{#if scenarioResetTiers}}
@@ -583,9 +610,31 @@ describe('{{featureName}}', () => {
     await driver.execute('mobile: clearApp', { appId: pkg });
   }
 
-  async function __reinstallApp(pkg: string): Promise<void> {
+  /** The app's build file, when the session was given one. Absent when the app was attached BY PACKAGE. */
+  function __appBuildPath(): string | undefined {
     const caps = (driver.requestedCapabilities || {}) as Record<string, string>;
-    const appPath = caps['appium:app'] || caps['app'];
+    return caps['appium:app'] || caps['app'];
+  }
+
+  /**
+   * The strongest tier THIS SESSION can actually carry out.
+   *
+   * Reinstalling needs the app's build file, and `data` on iOS IS a reinstall (no `mobile: clearApp`
+   * outside UiAutomator2). Attaching the app by package — the common local setup — leaves no build
+   * file, so those tiers cannot run at all.
+   *
+   * This exists so ESCALATION can cap itself. Escalation is a recovery the runner CHOSE; nothing
+   * asked for it. Escalating into a tier that throws turns one failed scenario into a dead spec file,
+   * because the throw lands in `beforeEach` and mocha then skips every remaining test in the file.
+   * A DECLARED tier is never capped — that is an unmet contract and must still throw by name.
+   */
+  function __performableTier(): string {
+    if (__appBuildPath()) return 'full';
+    return driver.isIOS ? 'soft' : 'data';
+  }
+
+  async function __reinstallApp(pkg: string): Promise<void> {
+    const appPath = __appBuildPath();
     if (!appPath) {
       throw new Error(
         `reset tier needs the app's build file to reinstall — set APP_APK (Android) / IOS_APP (iOS) so the appium:app capability is present, or drop to @reset:soft.`,
@@ -637,9 +686,24 @@ describe('{{featureName}}', () => {
     // Same title ⟹ this is a retry of the scenario that just failed: keep its declared tier so a real
     // failure fails both attempts (see __escalateAfter above).
     const __escalate = __escalateAfter !== null && __escalateAfter !== (this.currentTest?.title ?? '');
-    const __tier = __escalate ? __ESCALATE[__base] : __base;
+    // Escalation caps at what this session can perform, with the DECLARED tier as the FLOOR.
+    // The cap stops a tier NOBODY ASKED FOR from throwing in this hook and taking the rest of the
+    // spec file with it. The floor stops the cap from silently WEAKENING what the feature declared:
+    // a declared tier this session cannot perform still reaches __resetApp and still throws by name,
+    // because that one IS an unmet contract.
+    const __want = __escalate ? __ESCALATE[__base] : __base;
+    const __tier = __escalate
+      ? __TIER_ORDER[Math.max(
+          __TIER_ORDER.indexOf(__base),
+          Math.min(__TIER_ORDER.indexOf(__want), __TIER_ORDER.indexOf(__performableTier())),
+        )]
+      : __want;
     if (__tier !== __base) {
       console.log(`  \u2191 reset escalated ${__base} \u2192 ${__tier} (previous scenario failed: "${__escalateAfter}")`);
+    } else if (__want !== __base) {
+      // Said per occurrence, not once per run: this names the scenario that did NOT get the stronger
+      // reset it was owed, which is a fact about THIS scenario, not just about the session.
+      console.warn(`  ! reset could not escalate ${__base} \u2192 ${__want} — this session has no app build file to reinstall from (the app was attached by package). Staying at ${__base}; set APP_APK (Android) / IOS_APP (iOS) to enable the stronger reset.`);
     }
     await __resetApp(__tier);
 {{#if backgroundSteps}}

package/src/generators/test-generator/adapters/playwright/templates/steps/actions/click-select-action.hbs

@@ -1,2 +1,2 @@
 await {{> locator}}.click();
-await page.getByText('{{selectValue}}', { exact: true }).first().click();
+{{> pick-option}}

package/src/generators/test-generator/adapters/playwright/templates/steps/actions/select-action.hbs

@@ -9,7 +9,7 @@ if ((await el.evaluate((n) => n.tagName.toLowerCase())) === 'select') {
 await el.selectOption('{{selectValue}}');
 } else {
 await el.click();
-await page.getByText('{{selectValue}}', { exact: true }).first().click();
+{{> pick-option}}
 }
 }
 {{~else~}}

package/src/generators/test-generator/adapters/playwright/templates/steps/assertions/label-value-assertion.hbs

@@ -1 +1,7 @@
-await expect(page.getByText(/{{#if label}}{{escapeRegex label}}\s*{{else}}(?:^|\s){{/if}}{{escapeRegex dataValue}}$/)).toBeVisible();
+{{!-- Caption+value read: the ref names on-screen TEXT ("学科 -"), not an element, so the locator is
+      built inline from the caption rather than through the `locator` partial. That is why the scope
+      clause needs its own slot here — the partial's `parentLocator` handling never runs (#747).
+      Unscoped, `… in [Education Card 6] card` compiled away to nothing: on a screen repeating ten
+      学歴・職歴 cards the assertion strict-mode-failed where the caption repeats, and where it
+      happened to be unique elsewhere it passed having read a DIFFERENT card than the sentence names. --}}
+await expect({{#if parentLocator}}{{parentLocator}}{{else}}page{{/if}}.getByText(/{{#if label}}{{escapeRegex label}}\s*{{else}}(?:^|\s){{/if}}{{escapeRegex dataValue}}$/)).toBeVisible();

package/src/generators/test-generator/adapters/playwright/templates/steps/assertions/visible-with-role-variable-assertion.hbs

@@ -1,9 +1,13 @@
+{{!-- `getByRole` is built inline from role/name rather than through the `locator` partial, so the
+      scope clause needs its own slot here exactly as in label-value-assertion — the label branch's
+      twin (#747). `see [Logo] image with {{alt}} in [Product Card 3] card` searched every card on
+      the page before this. --}}
 {{#if name}}
 {{#if dataValue}}
-await expect(page.getByRole('{{role}}', { name: '{{escapeQuotes name}}'{{#if exact}}, exact: true{{/if}} }).filter({ hasText: /^{{escapeRegex dataValue}}$/ }){{> locator-nth}}).toBeVisible();
+await expect({{#if parentLocator}}{{parentLocator}}{{else}}page{{/if}}.getByRole('{{role}}', { name: '{{escapeQuotes name}}'{{#if exact}}, exact: true{{/if}} }).filter({ hasText: /^{{escapeRegex dataValue}}$/ }){{> locator-nth}}).toBeVisible();
 {{else}}
-await expect(page.getByRole('{{role}}', { name: '{{escapeQuotes name}}'{{#if exact}}, exact: true{{/if}} }){{> locator-nth}}).toBeVisible();
+await expect({{#if parentLocator}}{{parentLocator}}{{else}}page{{/if}}.getByRole('{{role}}', { name: '{{escapeQuotes name}}'{{#if exact}}, exact: true{{/if}} }){{> locator-nth}}).toBeVisible();
 {{/if}}
 {{else}}
-await expect(page.getByRole('{{role}}'{{#if exact}}, { exact: true }{{/if}}).filter({ hasText: /^{{escapeRegex dataValue}}$/ }){{> locator-nth}}).toBeVisible();
-{{/if}}
+await expect({{#if parentLocator}}{{parentLocator}}{{else}}page{{/if}}.getByRole('{{role}}'{{#if exact}}, { exact: true }{{/if}}).filter({ hasText: /^{{escapeRegex dataValue}}$/ }){{> locator-nth}}).toBeVisible();
+{{/if}}

package/src/generators/test-generator/adapters/playwright/templates/steps/partials/pick-option.hbs

@@ -0,0 +1,13 @@
+{{!-- #847 — pick the value in an OPENED custom listbox (Radix/shadcn, MUI, Headless UI).
+      The popup portals to the end of <body>, so a page-wide getByText(…).first() resolved to
+      any EARLIER element with the same text (a badge showing the current choice, a result
+      card) — and the open popup blocks clicks outside it, so the step timed out every time,
+      looking like a race. The ARIA option lives only in the open listbox: wait briefly for it
+      (a count() right after opening would race the popup animation), and fall back to the old
+      text match only for a widget that exposes no listbox roles. --}}
+{ const __opt = page.getByRole('option', { name: '{{selectValue}}', exact: true }).first();
+if (await __opt.waitFor({ state: 'visible', timeout: 3000 }).then(() => true, () => false)) {
+await __opt.click();
+} else {
+await page.getByText('{{selectValue}}', { exact: true }).first().click();
+} }

package/src/generators/test-generator/adapters/playwright/templates/steps/partials/url-assertion.hbs

@@ -23,8 +23,12 @@
       `https://admin.example.com/jobs` asserted the PATH on any host, and the public site's /jobs
       satisfied it.
 
+      `ignoreQuery` comes from the page ENTRY's `query: any`, not from the step, because it is a fact
+      about the page rather than about one assertion (#748). It relaxes only the bare-page rule; the
+      declared-value half below is untouched, so the two compose rather than override each other.
+
       The declared-value half is gated on `dataRef`, not on `query`. The step wrote `with {{v}}`
       either way; gating on the resolved VALUE meant an empty test-data entry silently dropped the
       whole check and fell back to the bare-page rule, which is the one case specs/url-assert.ts
       exists to throw on. --}}
-await expectPage(page, { pathname: /^{{pathRegex}}\/?$/{{#if hostRegex}}, hostname: /^{{hostRegex}}$/{{/if}}{{#if dataRef}}, dataRef: '{{escapeQuotes dataRef}}', declared: '{{escapeQuotes query}}'{{/if}} });
+await expectPage(page, { pathname: /^{{pathRegex}}\/?$/{{#if hostRegex}}, hostname: /^{{hostRegex}}$/{{/if}}{{#if ignoreQuery}}, ignoreQuery: true{{/if}}{{#if dataRef}}, dataRef: '{{escapeQuotes dataRef}}', declared: '{{escapeQuotes query}}'{{/if}} });

package/src/generators/test-generator/adapters/playwright/templates/test-file.hbs

@@ -46,6 +46,10 @@ test.describe('{{featureName}}', () => {
   test.describe('{{authRole}}', () => {
     test.use({ storageState: 'specs/.auth/{{authRole}}.json' });
 
+{{#if afterEach}}
+{{indent afterEach 2}}
+
+{{/if}}
 {{#each scenarios}}
 {{indent this 2}}
 
@@ -63,6 +67,18 @@ test.describe('{{featureName}}', () => {
 {{#each scenarios}}
 {{indent this 2}}
 
+{{/each}}
+  });
+
+{{else if afterEach}}
+{{!-- The un-tagged group next to a `@no-auth` one (#815): an ANONYMOUS describe scopes the hook to
+     these tests without adding a title segment, so test titles (and delivery fingerprints) stay put. --}}
+  test.describe(() => {
+{{indent afterEach 2}}
+
+{{#each scenarios}}
+{{indent this 2}}
+
 {{/each}}
   });
 

package/src/generators/test-generator/code-generator.ts

@@ -10,6 +10,7 @@ import { capabilityRegistry } from '../../capabilities/registry';
 import { discoverAndRegisterCapabilities } from '../../capabilities/discover';
 import { readCapabilities } from '../../harness/capability';
 import { parseManualComments } from '../../exporters/scenario-merger';
+import { isPresencePlaceholderHybrid } from '../../exporters/manual-hybrid-oracle';
 import { findSyntaxError } from './utils/spec-syntax-check';
 
 /** One capability-injected precondition statement (`@api:`/`@query:` → `testData.bind(name, …)`). */
@@ -210,7 +211,7 @@ function getAuthMode(
  * Grouping key for the anonymous bucket. A literal that no `@auth:<role>` can produce, so an
  * imaginative role name can never land in the same group as `@no-auth`.
  */
-const NO_AUTH_GROUP_KEY = 'no-auth';
+const NO_AUTH_GROUP_KEY = '\0no-auth';
 
 
 /**
@@ -266,6 +267,56 @@ function warnMultipleAuthTags(tags: string[], context: string): void {
   }
 }
 
+/**
+ * Drop the YAML comment from ONE line: a `#` at line start or preceded by whitespace,
+ * and not inside a quoted scalar. Line-level only — see `yamlWithoutComments` for the
+ * block-scalar case, which this function cannot see from a single line.
+ */
+function stripYamlComment(line: string): string {
+  let quote: string | null = null;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (quote) {
+      if (quote === '"' && c === '\\') { i++; continue; }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") { quote = c; continue; }
+    if (c === '#' && (i === 0 || /\s/.test(line[i - 1]))) return line.slice(0, i);
+  }
+  return line;
+}
+
+/**
+ * The YAML text a `${QA_*}` scan may look at: comments removed, block scalars kept whole.
+ *
+ * SG-W009's reference scan used to run over the whole raw file, so a `${QA_*}` that only ever
+ * appeared in a `#` comment counted as a live reference — including the one sungen's own
+ * scaffolded "HOW TO FILL VALUES" block writes into every test-data file. The declared side has
+ * always been line-wise; this brings the reference side to the same footing.
+ *
+ * Inside a `|`/`>` block scalar every character is literal content, `#` included, so those lines
+ * pass through untouched. Stripping them would send the check the other way — a real, undeclared
+ * `${QA_*}` written after a `#` in a block scalar would go unreported, and the run would only fail
+ * later with "environment variable not set". A missed warning is worse than a noisy one.
+ */
+function yamlWithoutComments(text: string): string {
+  const out: string[] = [];
+  let blockIndent: number | null = null;
+  for (const line of text.split('\n')) {
+    if (blockIndent !== null) {
+      const indent = line.search(/\S/);
+      // blank lines and anything indented deeper than the key stay inside the scalar
+      if (indent === -1 || indent > blockIndent) { out.push(line); continue; }
+      blockIndent = null;
+    }
+    const block = /^(\s*)[^#\s][^:]*:\s*[|>][+-]?\d*[+-]?\s*$/.exec(line);
+    if (block) { blockIndent = block[1].length; out.push(line); continue; }
+    out.push(stripYamlComment(line));
+  }
+  return out.join('\n');
+}
+
 /**
  * Result of test generation for a single feature file
  */
@@ -740,11 +791,18 @@ export class CodeGenerator {
         //    labeled `Observable:`/`Oracle:`/`Expected:` line (parseManualComments — the
         //    SAME parser delivery uses). Field finding (student-site, 87 scenarios): prose
         //    paragraphs and rationale-only comments exported EMPTY Steps + Expected cells.
+        //  • HAS a Then, but every assertion is a bare presence placeholder while the real oracle
+        //    sits in the comments (#810) — the same banned hybrid wearing a Then: the deliverable
+        //    reads "See [X] table" and a tester ticking it Passed records a check nobody made.
         const isStructured = scenario.steps.length > 0;
         if (isStructured && !hasThenStep(scenario)) {
           this.diagnostics.add('SG-W008',
             `@manual scenario "${scenario.name}" has Gherkin steps but no Then — a When without Then is invalid Gherkin. Add the Then step, or remove the steps and write the full procedure (action steps, then "Observable:"/"Oracle:" lines) in its \`# Tester verifies:\` block`,
             { feature: feature.name, step: scenario.name });
+        } else if (isStructured && isPresencePlaceholderHybrid(scenario.steps, scenario.comments ?? [])) {
+          this.diagnostics.add('SG-W008',
+            `@manual scenario "${scenario.name}" asserts only presence (e.g. "User see [X] table") while its real oracle sits in the \`# Tester verifies:\` comment — the deliverable's Expected would not say what the case checks. Write the oracle as the Then step (e.g. \`table match data:\`), or remove the steps and write the full numbered procedure ("1. <action>" … "N. Observable: <what>")`,
+            { feature: feature.name, step: scenario.name });
         } else if (!isStructured) {
           const parsed = parseManualComments(scenario.comments ?? []);
           if (!parsed.steps.length || !parsed.expected.length) {
@@ -830,7 +888,7 @@ export class CodeGenerator {
       authGroupMap.get(key)!.push(code);
     }
 
-    const authGroups = groupOrder.map(key => ({
+    const authGroups = groupOrder.map((key): { authRole?: string; noAuth: boolean; scenarios: string[]; afterEach?: string } => ({
       authRole: key === NO_AUTH_GROUP_KEY ? undefined : (key || undefined),
       noAuth: key === NO_AUTH_GROUP_KEY,
       scenarios: authGroupMap.get(key)!,
@@ -873,6 +931,19 @@ export class CodeGenerator {
     }
     const scenarios = renderedScenarios.map(s => s.code);
 
+    // #815 — a feature-level `@afterEach` used to sit in the outermost describe, so it also ran after
+    // every `@no-auth` test, on an EMPTY session: a hook that needs the signed-in page (`Given User is
+    // on [probe] page` → redirected to /login) failed an anonymous test whose own steps passed. When
+    // the feature mixes `@no-auth` with any other group, the hook moves INTO each other group and the
+    // no-auth group runs without it. A feature that is anonymous throughout keeps the hook — it was
+    // written for those tests.
+    // (A no-auth group beside another one means ≥2 groups, so `renderAuthBlocks` is already true.)
+    const afterEachInGroups = !!afterEach
+      && authGroups.some(g => g.noAuth) && authGroups.some(g => !g.noAuth);
+    if (afterEachInGroups) {
+      for (const g of authGroups) if (!g.noAuth) g.afterEach = afterEach;
+    }
+
     // For single group, extract the auth role to put test.use at describe level. Keyed on
     // `renderAuthBlocks`, not `needsGrouping`: a lone `@no-auth` group now renders its own block, so
     // hoisting anything to the feature describe would double up. Its authRole is undefined anyway.
@@ -969,7 +1040,7 @@ export class CodeGenerator {
       featureDescription: feature.description,
       background,
       beforeAll,
-      afterEach,
+      afterEach: afterEachInGroups ? undefined : afterEach,
       afterAll,
       cleanupConfig,
       screenshotOnFailure,
@@ -1314,7 +1385,8 @@ export class CodeGenerator {
    * a name in the committed .env.qa.example. An undeclared ref means the test throws
    * "environment variable not set" the moment the key is used — surface it at compile
    * time instead. Only the `${QA_*}` shape is checked: any other `${...}` text is
-   * ordinary literal data by design (never resolved, never warned about).
+   * ordinary literal data by design (never resolved, never warned about). A `${QA_*}`
+   * that appears only inside a `#` comment is prose, not a reference, and is ignored.
    */
   private reportedEnvRefs = new Set<string>();
   private checkEnvSecretRefs(featureFile: string): void {
@@ -1322,7 +1394,7 @@ export class CodeGenerator {
     if (!fs.existsSync(testDataDir)) return;
     const referenced = new Set<string>();
     for (const f of fs.readdirSync(testDataDir).filter((x) => x.endsWith('.yaml') || x.endsWith('.yml'))) {
-      const text = fs.readFileSync(path.join(testDataDir, f), 'utf-8');
+      const text = yamlWithoutComments(fs.readFileSync(path.join(testDataDir, f), 'utf-8'));
       for (const m of text.matchAll(/\$\{(QA_[A-Z0-9_]+)\}/g)) referenced.add(m[1]);
     }
     if (!referenced.size) return;

package/src/generators/test-generator/diagnostics.ts

@@ -24,7 +24,9 @@
  *   SG-W008 — @manual scenario is incomplete in either direction: Gherkin steps without a
  *             Then (invalid Gherkin; comments cannot substitute), or a documentation-style
  *             manual (no steps) whose comments lack the extractable procedure — ≥1 numbered
- *             action line + ≥1 labeled Observable:/Oracle:/Expected: line
+ *             action line + ≥1 labeled Observable:/Oracle:/Expected: line — or a Then that
+ *             asserts only presence while the real oracle sits in a `# Tester verifies:`
+ *             comment (#810)
  *   SG-W009 — test-data references a `${QA_*}` secret that is declared in neither .env.qa
  *             nor .env.qa.example — the test will throw "not set" the moment the key is used
  *   SG-W010 — a row step's [Ref] looks POSITIONAL (First/Last/Top/…) but has no selectors.yaml
@@ -186,12 +188,29 @@
  *             build names itself at generate time instead of one step further downstream
  *
  *   SG-W028 — a step's trailing scope clause was DROPPED, so the step runs against more of the page
- *             than its sentence names. Two causes, one code: the `<word>` after `in [X]` is not a
+ *             than its sentence names. Three causes, one code: the `<word>` after `in [X]` is not a
  *             container type (a typo, or a leaf element used as a parent), or the by-content form
  *             `in [X] <type> with {{v}}` was written for the mobile adapter, which chains a parent
  *             element and has no content filter. Before this, both compiled clean and silently
  *             widened the assertion to the whole screen — the failure mode that only a diff of the
- *             generated spec against the Gherkin could reveal (#667)
+ *             generated spec against the Gherkin could reveal (#667).
+ *             The third is the RENDER-time half #667 could not reach: the clause parsed and the
+ *             container resolved, but the step form that won the sentence emits a locator built
+ *             inline and never applies it. Judged on the emitted code — every path that honours a
+ *             scope emits the resolved container locator verbatim, so its absence IS the drop —
+ *             which makes the check total rather than a list of templates to keep in sync. Found
+ *             via `see [学科] label with {{v}} in [Education Card 6] card` compiling to a page-wide
+ *             `getByText` on a screen repeating ten identical cards (#747)
+ *   SG-W037 — a `type: page` entry says something about the QUERY that the compiler cannot use.
+ *             Two causes, one code, and the same root confusion behind both: a bare `see [X] page`
+ *             asserts the URL carries NO query (#464), which is unsatisfiable for a page keyed by
+ *             one (`/admins/detail?id=5`, where the id comes from the row just clicked). Either the
+ *             entry's `value` carries a `?`/`#` — dropped, because a page value is the path only and
+ *             the pattern is matched against `u.pathname`, which never holds a query — or `query:`
+ *             declares something other than `any`, which is ignored rather than read as permissive,
+ *             since a typo must never quietly switch off the #464 assertion. Both used to be silent,
+ *             and the first is how #748 was misdiagnosed in the field as a regex-escaping bug: the
+ *             obvious workaround produced byte-identical output and no hint why
  *   SG-W029 — a mobile (appium) feature compiled with NO usable app-package `Path:` — either the line
  *             is missing outright, or it holds a web-style route (`Path: /applied-jobs`) that the
  *             package guard rejects. Both used to be silent, and both cost the same two things: the
@@ -255,9 +274,21 @@
  *             than the one the scenario means, and nothing else would ever say so. Not reported for
  *             testid/label/placeholder/role+name/text entries, which name a particular thing —
  *             warning there would fire on nearly every capture in a suite
+ *   SG-E038 — a `{{var}}` the compiler cannot resolve: no test-data file for the feature, no such
+ *             key, or a key holding a list/map where a value was needed. Twenty-four step patterns
+ *             used to catch this and emit the PLACEHOLDER TEXT as the value — `fill [ID] with
+ *             {{valid_partner_id}}` compiled to `fill('${valid_partner_id}')`, generate exited 0,
+ *             and the literal 20 characters were typed into the app. The field under test applied
+ *             no format validation, so the string was accepted, the server saw an unknown user, and
+ *             the scenario failed at the assertion it was written to fail at, for the reason it was
+ *             written to fail: a suite that looked exactly right while feeding the system garbage.
+ *             Worse than one wrong value — every run shared the SAME literal id, so a scenario
+ *             needing a fresh user silently reused one and its state leaked between runs (#781).
+ *             Note a feature resolves `{{var}}` against a data file named after ITSELF, so the
+ *             second `.feature` in a screen directory starts life with no data file at all
  * Diagnostics never change the EXIT CODE by themselves; `sungen generate --strict` turns any
  * collected diagnostic into a non-zero exit. They are not all inert, though: SG-W001, SG-W011,
- * SG-E020, SG-E021, SG-W020, SG-E023, SG-E024, SG-E025, SG-E026, SG-E027 and SG-E035 additionally compile
+ * SG-E020, SG-E021, SG-W020, SG-E023, SG-E024, SG-E025, SG-E026, SG-E027, SG-E035 and SG-E038 additionally compile
  * the offending step to a runtime `throw` — a step that reads as a check and silently checks
  * nothing is worse than one that fails loudly — and SG-E031 refuses the file outright. (SG-E022 is
  * the one exception to the "blame the Gherkin" rule and throws nothing: the file is still written
@@ -265,7 +296,7 @@
  * Generation always COMPLETES — the rest of the scenario and the rest of the file still compile.
  */
 
-export type DiagnosticCode = 'SG-W001' | 'SG-W002' | 'SG-W003' | 'SG-W004' | 'SG-W005' | 'SG-W006' | 'SG-W007' | 'SG-W008' | 'SG-W009' | 'SG-W010' | 'SG-W011' | 'SG-W012' | 'SG-W013' | 'SG-W014' | 'SG-W015' | 'SG-W016' | 'SG-W017' | 'SG-W018' | 'SG-E020' | 'SG-E021' | 'SG-W020' | 'SG-W021' | 'SG-W022' | 'SG-W023' | 'SG-W024' | 'SG-W026' | 'SG-E025' | 'SG-E026' | 'SG-E022' | 'SG-E023' | 'SG-E024' | 'SG-E027' | 'SG-W028' | 'SG-W029' | 'SG-W030' | 'SG-E031' | 'SG-W032' | 'SG-W034' | 'SG-E035' | 'SG-W036';
+export type DiagnosticCode = 'SG-W001' | 'SG-W002' | 'SG-W003' | 'SG-W004' | 'SG-W005' | 'SG-W006' | 'SG-W007' | 'SG-W008' | 'SG-W009' | 'SG-W010' | 'SG-W011' | 'SG-W012' | 'SG-W013' | 'SG-W014' | 'SG-W015' | 'SG-W016' | 'SG-W017' | 'SG-W018' | 'SG-E020' | 'SG-E021' | 'SG-W020' | 'SG-W021' | 'SG-W022' | 'SG-W023' | 'SG-W024' | 'SG-W026' | 'SG-E025' | 'SG-E026' | 'SG-E022' | 'SG-E023' | 'SG-E024' | 'SG-E027' | 'SG-W028' | 'SG-W029' | 'SG-W030' | 'SG-E031' | 'SG-W032' | 'SG-W034' | 'SG-E035' | 'SG-W036' | 'SG-W037' | 'SG-E038';
 
 export interface Diagnostic {
   code: DiagnosticCode;