@sun-asterisk/sungen 3.2.34 → 3.2.35

package/src/harness/defects.ts

@@ -0,0 +1,94 @@
+/**
+ * Defect records — `qa/defects/DEF-NNN-<slug>.md`, one project-wide folder. A scenario points at a
+ * record with `@known-defect:DEF-NNN`; the record points back at units, scenarios, claims and legacy
+ * TCs in its frontmatter. This module reads the records and checks both directions of that link.
+ * Drafting a record from a triage row lives in defect-draft.ts.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { parse as parseYaml } from 'yaml';
+
+export const DEFECT_STATUSES = ['open', 'fixed', 'verified', 'closed', 'wont-fix'] as const;
+export type DefectStatus = typeof DEFECT_STATUSES[number];
+
+export interface DefectRecord {
+  id: string;
+  title: string;
+  severity: string;
+  status: string;
+  units: string[];
+  scenarios: string[];
+  /** Project-relative path of the record file. */
+  file: string;
+}
+
+const DEF_FILE = /^(DEF-(\d+))-.*\.md$/;
+const KNOWN_DEFECT_TAG = /@known-defect:(DEF-\d+)\b/g;
+
+export function defectsDir(cwd: string): string {
+  return path.join(cwd, 'qa', 'defects');
+}
+
+function defectFiles(cwd: string): string[] {
+  const dir = defectsDir(cwd);
+  return fs.existsSync(dir) ? fs.readdirSync(dir).filter((f) => DEF_FILE.test(f)).sort() : [];
+}
+
+/** The next free id: one above the highest number on disk, zero-padded to 3. */
+export function nextDefectId(cwd: string): string {
+  const max = defectFiles(cwd).reduce((m, f) => Math.max(m, Number(f.match(DEF_FILE)![2])), 0);
+  return `DEF-${String(max + 1).padStart(3, '0')}`;
+}
+
+const list = (v: unknown): string[] => (Array.isArray(v) ? v.map(String) : []);
+
+/** Every record whose frontmatter parses; a malformed file is skipped, never thrown on. */
+export function readDefects(cwd: string): DefectRecord[] {
+  const out: DefectRecord[] = [];
+  for (const f of defectFiles(cwd)) {
+    const file = path.join(defectsDir(cwd), f);
+    try {
+      const fm = parseYaml(fs.readFileSync(file, 'utf-8').split(/^---\s*$/m)[1] ?? '') as Record<string, unknown> | null;
+      if (!fm || typeof fm !== 'object') continue;
+      out.push({
+        id: String(fm.id ?? f.match(DEF_FILE)![1]),
+        title: String(fm.title ?? ''),
+        severity: String(fm.severity ?? ''),
+        status: String(fm.status ?? ''),
+        units: list(fm.units),
+        scenarios: list(fm.scenarios),
+        file: path.relative(cwd, file),
+      });
+    } catch {
+      // unreadable frontmatter: not a record we can reason about
+    }
+  }
+  return out;
+}
+
+/**
+ * Advisory audit findings for one unit (never scored):
+ *   DEFECT-REF-MISSING     a `@known-defect:DEF-NNN` tag with no record file.
+ *   DEFECT-ORPHAN (info)   an OPEN record of this unit names a scenario the unit no longer has.
+ */
+export function defectLinkFindings(cwd: string, unitId: string, featureText: string, scenarioNames: string[]): string[] {
+  const records = readDefects(cwd);
+  const findings: string[] = [];
+  const known = new Set(records.map((r) => r.id));
+  const tagged = new Set([...featureText.matchAll(KNOWN_DEFECT_TAG)].map((m) => m[1]));
+  for (const id of tagged) {
+    if (!known.has(id)) {
+      findings.push(`DEFECT-REF-MISSING: \`@known-defect:${id}\` has no record in qa/defects/ — draft it with \`sungen defect draft --screen ${unitId}\`, or correct the id.`);
+    }
+  }
+  const names = new Set(scenarioNames);
+  for (const r of records) {
+    if (r.status !== 'open' || !r.units.includes(unitId)) continue;
+    for (const s of r.scenarios) {
+      if (!names.has(s)) {
+        findings.push(`DEFECT-ORPHAN (info): ${r.id} is open and names scenario "${s}", which ${unitId} no longer has — update the record's scenarios, or close it.`);
+      }
+    }
+  }
+  return findings;
+}

package/src/harness/manifest.ts

@@ -13,6 +13,7 @@ import * as path from 'path';
 import { createHash } from 'crypto';
 import { featureFilesFor, reportSlug } from './unit-paths';
 import { readTextFile } from './read-text';
+import { vpCodeOf } from './parse';
 
 export interface SpecSection { name: string; hash: string }
 export interface ManifestEntry { scenario: string; vpCode?: string; section: string; specHash: string }
@@ -90,8 +91,7 @@ function parseFeatureSections(featurePath: string): { scenario: string; vpCode?:
     const s = line.match(/^Scenario:\s*(.*)$/);
     if (s) {
       const name = s[1].trim();
-      const code = name.match(/\bVP-[A-Z]+-\d+/i)?.[0];
-      out.push({ scenario: name, vpCode: code, section });
+      out.push({ scenario: name, vpCode: vpCodeOf(name).vpCode, section });
     }
   }
   return out;

package/src/harness/next-step.ts

@@ -16,6 +16,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import { parse as parseYaml } from 'yaml';
 import { reportSlug, featureFilesFor } from './unit-paths';
 import { readTextFile } from './read-text';
 import { checkAssetsDrift } from '../orchestrator/assets-drift';
@@ -87,6 +88,29 @@ function countScenarios(unitDir: string, unit: string): number {
  * Everything the resolver needs, read from disk. `unitId` is the catalog id
  * (`<screen>` · `flows/<f>` · `api/<a>`); `unitDir` is its directory.
  */
+const RESULT_FILE = /-test-result(?:\.[^.]+)*\.json$/;
+
+/**
+ * Does the selector text resolve at least one element? A scaffold resolves none: the web one holds
+ * only the `page` route, the mobile one only header comments. Matching the WORD "placeholder" was
+ * wrong both ways (#868): it flagged a real file whose key names an input's placeholder text, and
+ * missed both scaffolds, which never contain it.
+ */
+function hasResolvedSelector(selectorText: string): boolean {
+  let doc: unknown;
+  try { doc = parseYaml(selectorText); } catch { return selectorText.trim().length >= 40; }
+  if (!doc || typeof doc !== 'object') return false;
+  // A real cell, not a marker left to be filled in. Numbers count (an id or index can be numeric).
+  const real = (v: unknown): boolean => (typeof v === 'string' || typeof v === 'number')
+    && String(v).trim() !== '' && !/^(?:todo|tbd|placeholder|replace me)$/i.test(String(v).trim());
+  return Object.values(doc as Record<string, unknown>).some((e) => {
+    if (!e || typeof e !== 'object') return false;
+    const { type, value, name, locator } = e as { type?: unknown; value?: unknown; name?: unknown; locator?: unknown };
+    // Every SelectorEntry shape: a CSS `locator`, or a non-page `type` with a value or a role name.
+    return real(locator) || (typeof type === 'string' && type !== 'page' && (real(value) || real(name)));
+  });
+}
+
 export function readUnitState(
   projectRoot: string, unitDir: string, unit: string, kind: UnitState['kind'],
 ): UnitState {
@@ -101,7 +125,7 @@ export function readUnitState(
   // `readTextFile` throws on a missing file, and every path here is legitimately absent at some
   // point in a unit's life — the resolver exists to report exactly that, so it must not crash on it.
   const read = (p: string): string => (fs.existsSync(p) ? readTextFile(p) : '');
-  const selectorText = selectorFiles.map((f) => read(path.join(selectorsDir, f))).join('\n');
+  const selectorTexts = selectorFiles.map((f) => read(path.join(selectorsDir, f)));
   const contractPath = path.join(req, 'flow-contract.yaml');
   const contractText = read(contractPath);
 
@@ -116,7 +140,9 @@ export function readUnitState(
   });
   const hasResults = specDirs.some((d) => {
     try {
-      return fs.readdirSync(d).some((f) => f.endsWith('-test-result.json'));
+      // `<f>-test-result[.<os>][.<env>].json` — a mobile run writes the OS into the name, an env
+      // run (SUNGEN_ENV=staging) the env; both are runs (#868).
+      return fs.readdirSync(d).some((f) => RESULT_FILE.test(f));
     } catch { return false; }
   });
   let hasDeliverable = false;
@@ -139,8 +165,7 @@ export function readUnitState(
     hasSelectors: selectorFiles.length > 0,
     // A scaffolded selector file exists but resolves nothing; treating it as "done" is what
     // makes a run look further along than it is.
-    selectorsArePlaceholder: selectorFiles.length > 0
-      && (/TODO|PLACEHOLDER|REPLACE ME/i.test(selectorText) || selectorText.trim().length < 40),
+    selectorsArePlaceholder: selectorFiles.length > 0 && !selectorTexts.some(hasResolvedSelector),
     compiled, hasResults, hasDeliverable,
     assetsDrift: (() => {
       const d = checkAssetsDrift(projectRoot);

package/src/harness/parse.ts

@@ -285,6 +285,25 @@ function withBackground(sc: ParsedScenario, background?: ParsedScenario): Parsed
   return { ...sc, steps: [...bg, ...((sc.steps as ParsedStep[]) || [])] } as ParsedScenario;
 }
 
+/**
+ * The `VP-<CATEGORY>-<n>` / `FL-<PHASE>-<n>` code in a scenario title, and its category — the ONE
+ * reading of it; the manifest kept an older copy of this regex and recorded no code for
+ * VP-I18N-001, VP-LIST-DISPLAY-01, VP-AF02-01 or any FL- id (#889).
+ *
+ * Category is everything between `VP-` and the final `-<sequence>` — INCLUDING hyphens, so
+ * compound categories (VP-LIST-DISPLAY-01, VP-ADD-TO-CART-03, VP-PRODUCT-DISCOVERY-02) parse,
+ * not just single-word ones. A single-word category (VP-CART-001) still works. (H1)
+ * Flows use journey-phase ids (FL-HP-001 / FL-ER-002) — the VP- anchor rejected them, so every
+ * flow scenario had NO category and the whole suite bucketed `other` (taxonomy=0%, #569).
+ * Segments may carry digits: the use-case framework numbers its flows (VP-AF02-01,
+ * VP-EF11-01 — one id per Alternate/Exception Flow), and `[A-Z]+` also silently truncated
+ * VP-I18N-001 to no category at all (the `18` broke the class mid-segment).
+ */
+export function vpCodeOf(title: string): { vpCode?: string; category?: string } {
+  const m = title.match(/\b(?:VP|FL)-([A-Z][A-Z0-9]*(?:-[A-Z0-9]+)*)-\d+/i);
+  return m ? { vpCode: m[0].toUpperCase(), category: m[1].toUpperCase() } : {};
+}
+
 function classifyScenario(sc: ParsedScenario): ScenarioInfo {
   const tags = sc.tags || [];
   const deferredToFlow = tags.includes('@deferred:flow');
@@ -310,17 +329,7 @@ function classifyScenario(sc: ParsedScenario): ScenarioInfo {
   let priority: Priority = 'unknown';
   for (const t of tags) if (PRIORITY_TAGS[t]) priority = PRIORITY_TAGS[t];
 
-  // Category is everything between `VP-` and the final `-<sequence>` — INCLUDING hyphens, so
-  // compound categories (VP-LIST-DISPLAY-01, VP-ADD-TO-CART-03, VP-PRODUCT-DISCOVERY-02) parse,
-  // not just single-word ones. A single-word category (VP-CART-001) still works. (H1)
-  // Flows use journey-phase ids (FL-HP-001 / FL-ER-002) — the VP- anchor rejected them, so every
-  // flow scenario had NO category and the whole suite bucketed `other` (taxonomy=0%, #569).
-  // Segments may carry digits: the use-case framework numbers its flows (VP-AF02-01,
-  // VP-EF11-01 — one id per Alternate/Exception Flow), and `[A-Z]+` also silently truncated
-  // VP-I18N-001 to no category at all (the `18` broke the class mid-segment).
-  const codeMatch = sc.name.match(/\b(?:VP|FL)-([A-Z][A-Z0-9]*(?:-[A-Z0-9]+)*)-\d+/i);
-  const vpCode = codeMatch ? codeMatch[0].toUpperCase() : undefined;
-  const category = codeMatch ? codeMatch[1].toUpperCase() : undefined;
+  const { vpCode, category } = vpCodeOf(sc.name);
   // Project-scheme ID: the leading token of the title (VP0-001 / MS-HP-001 / VP-LIST-001).
   const leadMatch = sc.name.match(/^\s*([A-Za-z][A-Za-z0-9.-]*)/);
   const vpId = leadMatch && isIdLike(leadMatch[1]) ? leadMatch[1].toUpperCase() : undefined;

package/src/harness/script-check.ts

@@ -107,6 +107,12 @@ const ASSERTION_STEP_COMMENT = /^\s*\/\/\s*Assert\b/;
 // but as a bare substring it would also exempt a genuinely hollow step whose test-data or step
 // text happened to contain it.
 const NOOP_STEP_MARKER = /^\s*\/\/\s*App launched via wdio capabilities/;
+// The same kind of step on the web adapter, where the explanation IS the step comment: the
+// step-mapper compiles `Given User is on [Edit] dialog` (and its exit) to `// Enter dialog scope:
+// Edit` and no code, because it only re-roots the steps after it — the next assertion runs as
+// `page.getByRole('dialog', …).getByRole(…)`. A field unit reported 13 BYPASS, every one of them
+// this comment, and exited 2 on a correct suite (#881). Anchored to the whole marker line.
+const SCOPE_STEP_MARKER = /^\s*\/\/\s*(?:Enter|Exit) dialog scope(?::\s*.*)?$/;
 
 /** A spec comment line reduced to its text, for comparison against a compiler step comment. */
 const commentText = (line: string): string => line.trim().replace(/^\/\/\s?/, '').trim();
@@ -241,7 +247,7 @@ export function analyzeFaithfulness(
       const hasCode = region.some((l) => !isComment(l) && CODE_LINE.test(l));
       // A documented no-op emits its explanation INTO the step's region, so read the region
       // (not just the marker line) for it — see NOOP_STEP_MARKER.
-      if (hasCode || region.some((l) => NOOP_STEP_MARKER.test(l))) continue;
+      if (hasCode || region.some((l) => NOOP_STEP_MARKER.test(l)) || SCOPE_STEP_MARKER.test(body[markers[s]])) continue;
       if (tailAmbiguous && s === markers.length - 1) continue;
       hollowSteps.push({ test: title, step: body[markers[s]].trim().slice(0, 70) });
     }

package/src/harness/sensors.ts

@@ -12,6 +12,7 @@ import { parse as parseYaml } from 'yaml';
 import { ScenarioInfo, ViewpointEntry, idPrefix } from './parse';
 import { readTextFile } from './read-text';
 import { keywordHit, hasKeyword } from './keyword-match';
+import { countedAssertions } from './counted-assertions';
 
 // Business-critical category keywords (matched by CONTAINMENT against the VP category, so a
 // compound category like LIST-DISPLAY / ADD-TO-CART / PRODUCT-DISCOVERY classifies correctly).
@@ -947,7 +948,14 @@ export interface TaxonomyResult {
 
 const TAXONOMY_KNOWN = new Set(['LIST', 'PRODUCT', 'CART', 'FILTER', 'NAV', 'VAL', 'SEC']);
 
-const CATEGORY_SIGNALS: { cat: string; re: RegExp }[] = [
+/**
+ * Words of ACCESS — a title about who may reach something. They make the robustness/routing words
+ * below security evidence ("deep link without authentication"); alone those words describe routing.
+ */
+const ACCESS_CONTEXT = /\b(xss|sql|injection|without authentication|unauthenticated|unauthori[sz]ed|without an? (?:authenticated|valid|active) \w+|without (?:permission|login|logging in|signing in|an? account|access)|not (?:logged|signed) in|logged[- ]out|direct(?:ly)? access\w*|auth[- ]?guard|forbidden|\b403\b|(?:no|insufficient|missing) permissions?|permission required|session expired|expired session|tamper\w*)\b/;
+
+/** `requires`: the signal counts only when the title ALSO matches it (#888). */
+const CATEGORY_SIGNALS: { cat: string; re: RegExp; requires?: RegExp }[] = [
   { cat: 'FILTER', re: /\b(categor(y|ies)|sub-?categor\w*|expand\w*|collaps\w*|\bfacet\b|filter\w*|belongs? to)\b/ },
   { cat: 'CART', re: /\b(add(ed|ing)? to cart|added (dialog|modal|message|confirmation)|cart (page|table|line|item)|view cart|continue shopping|quantit)\b/ },
   { cat: 'PRODUCT', re: /\b(product detail|product-detail|view product|product page|same product|product name and price|product identity|detail product)\b/ },
@@ -959,9 +967,16 @@ const CATEGORY_SIGNALS: { cat: string; re: RegExp }[] = [
 // SEC, so the linter told QA to re-tag genuine auth-gate tests as navigation — diluting the
 // visibility of the security suite (QA field report, 3.2.23). The guard vocabulary below is
 // what makes the INTENT matchable, and GUARD_INTENT then wins over a mere observable.
-  { cat: 'SEC', re: /\b(xss|sql|injection|payload|without authentication|unauthenticated|without an? (?:authenticated|valid|active) \w+|direct(?:ly)? access\w*|deep[- ]link\w*|auth[- ]?guard|not skippable|without having (?:completed|submitted|logged)|remains? unauthenticated|\binert\b|tamper\w*|malformed|url parameter|query param\w*|falls? back|gracefull?y|without a crash|not[- ]found|\b404\b|special character|abuse)\b/ },
+  { cat: 'SEC', re: /\b(xss|sql|injection|payload|without authentication|unauthenticated|without an? (?:authenticated|valid|active) \w+|direct(?:ly)? access\w*|auth[- ]?guard|not skippable|without having (?:completed|submitted|logged)|remains? unauthenticated|\binert\b|tamper\w*|malformed|special character|abuse)\b/ },
+  // Robustness and routing words are SEC evidence only beside an ACCESS word. Alone they describe
+  // routing — "Unknown route shows the 404 page", "Deep link opens the item", "the tab from the url
+  // parameter" — and the linter told QA to re-tag those navigation tests as VP-SEC (#888).
+  { cat: 'SEC', re: /\b(deep[- ]link\w*|url parameter|query param\w*|falls? back|gracefull?y|without a crash|not[- ]found|\b404\b)\b/, requires: ACCESS_CONTEXT },
 ];
 
+const signalMatches = (c: { re: RegExp; requires?: RegExp }, title: string): boolean =>
+  c.re.test(title) && (!c.requires || c.requires.test(title));
+
 /**
  * Categories whose signal describes the test's INTENT/risk rather than the observable action.
  * When one of these matches, a competing observable-only category (NAV: "redirects", "navigates")
@@ -979,14 +994,19 @@ export function taxonomyLint(scenarios: ScenarioInfo[]): TaxonomyResult {
     if (!cat || !TAXONOMY_KNOWN.has(cat)) continue;
     checked++;
     const title = s.name.toLowerCase();
-    const matched = [...new Set(CATEGORY_SIGNALS.filter((c) => c.re.test(title)).map((c) => c.cat))];
+    const matched = [...new Set(CATEGORY_SIGNALS.filter((c) => signalMatches(c, title)).map((c) => c.cat))];
     if (matched.includes(cat)) continue;             // title supports its own category → fine
+    // A gate (`requires`) only stops a word from SUGGESTING its category. An author who already
+    // chose that category is supported by the word alone: a VP-SEC "Deep link to the filtered
+    // list …" stays SEC instead of being pushed toward FILTER (#888 review).
+    if (CATEGORY_SIGNALS.some((c) => c.cat === cat && c.requires && c.re.test(title))) continue;
     // The declared category may be an INTENT category whose signal this title spells
     // differently; never "correct" it toward a category that only names the observable.
     const suppressed = INTENT_OVER_OBSERVABLE[cat];
     const others = matched.filter((c) => c !== cat && !(suppressed && suppressed.has(c)));
     if (others.length === 1) {                        // unambiguous mismatch
-      const sig = CATEGORY_SIGNALS.find((c) => c.cat === others[0])!;
+      // The entry that MATCHED — a category can have several (SEC: guard words, gated robustness words).
+      const sig = CATEGORY_SIGNALS.find((c) => c.cat === others[0] && signalMatches(c, title))!;
       const m = title.match(sig.re);
       mislabeled.push({ name: s.name, current: cat, suggested: others[0], signal: m ? m[0] : others[0] });
     }
@@ -1058,9 +1078,8 @@ export function numericClaimGaps(scenarios: ScenarioInfo[]): Array<{ name: strin
     if (!m) continue;
     const claimed = NUMBER_WORDS[m[1]] ?? Number(m[1]);
     if (!Number.isFinite(claimed) || claimed < 2) continue;
-    // Only value-bearing assertions count: `see [X] … with/contains {{v}}`. A visibility check
-    // does not demonstrate one of N values.
-    const asserted = (s.stepsText.match(/\bsee \[[^\]]+\][^|]*?\b(?:with|contains) \{\{/g) ?? []).length;
+    // Values, positive states and indicator presence count; plain text visibility does not (#866).
+    const asserted = countedAssertions(s.stepsText);
     if (asserted > 0 && asserted < claimed) out.push({ name: s.name, claimed, asserted, noun: m[2] });
   }
   return out;

package/src/harness/triage-signals.ts

@@ -0,0 +1,46 @@
+/**
+ * Triage signal library — the ordered message patterns `sungen triage` matches a red scenario's
+ * error against. Seeded from the repair rules (`harness/repair.ts`, driver-mobile `mobile-repair.ts`);
+ * the patterns are COPIED, not imported, because core never loads a driver at runtime. The parity
+ * check in tests/harness/triage-classification.run.ts keeps the environment rules in step.
+ *
+ * Order matters and is the classification order: environment first (nothing about the test or the
+ * app can be judged when the session never started), then test defects (the test never reached the
+ * app). Assertions are decided in triage.ts from the parsed Expected/Received, not here.
+ */
+export type SignalClass = 'environment' | 'test-defect';
+
+export interface TriageSignal {
+  id: string;
+  class: SignalClass;
+  match: RegExp;
+}
+
+export const TRIAGE_SIGNALS: TriageSignal[] = [
+  // --- environment: the run could not reach a usable app/session -----------------------------------
+  { id: 'env-network', class: 'environment', match: /net::ERR_[A-Z_]+|\bECONNREFUSED\b|\bENOTFOUND\b|\bEAI_AGAIN\b|\bETIMEDOUT\b/ },
+  // mirrors mobile-session-not-created
+  { id: 'env-session-not-created', class: 'environment', match: /A new session could not be created|session not created/i },
+  // mirrors mobile-driver-proxy-lost
+  { id: 'env-driver-proxy-lost', class: 'environment', match: /Could not proxy command to (?:the )?remote server|socket hang up|ECONNRESET/ },
+  // mirrors mobile-instrumentation-failed
+  { id: 'env-instrumentation-failed', class: 'environment', match: /instrumentation process (?:cannot|could not) be (?:initialized|started)|Cannot start the instrumentation process/ },
+  // mirrors mobile-chromedriver-mismatch
+  { id: 'env-chromedriver-mismatch', class: 'environment', match: /No Chromedriver found|chromedriver.*(?:version|mismatch)|Chrome version must be/i },
+  // mirrors mobile-webview-context-absent
+  { id: 'env-webview-context-absent', class: 'environment', match: /no WEBVIEW\/CHROMIUM context appeared within/ },
+  { id: 'env-auth-state-missing', class: 'environment', match: /storageState|\.auth\/[\w.-]+\.json|ENOENT[^\n]*\.auth/ },
+  { id: 'env-base-url-unresolved', class: 'environment', match: /Cannot navigate to invalid URL|baseURL (?:is )?(?:not set|undefined)|Invalid URL/ },
+  { id: 'env-browser-closed', class: 'environment', match: /Target page, context or browser has been closed|browserType\.launch/ },
+
+  // --- test defect: the test could not reach the element or its data -------------------------------
+  { id: 'test-strict-mode', class: 'test-defect', match: /strict mode violation/ },
+  { id: 'test-locator-unresolved', class: 'test-defect', match: /locator\.\w+: [^\n]*(?:Timeout|timeout)[^\n]*exceeded[\s\S]*waiting for |resolved to 0 elements/ },
+  { id: 'test-element-absent', class: 'test-defect', match: /no such element|Element not found:|An element could not be located/ },
+  { id: 'test-data-missing', class: 'test-defect', match: /Test data key not found:|@cases dataset "[^"]+" not found/ },
+  { id: 'test-step-unmatched', class: 'test-defect', match: /\[sungen\] step "[^"]*" matched no pattern|\bSG\d{3}\b/ },
+  { id: 'test-tap-intercepted', class: 'test-defect', match: /element click intercepted|is not clickable at point|element is obscured|intercepts pointer events/i },
+];
+
+/** A failure that is only Playwright's test-level timeout — no locator, no assertion detail (→ unclassified). */
+export const BARE_TIMEOUT = /^(?:Error:\s*)?Test timeout of \d+ms exceeded\.?$/;

package/src/harness/triage-unit.ts

@@ -0,0 +1,113 @@
+/**
+ * `sungen triage` IO: find a unit's feature(s) and result file(s), join them on the same seam
+ * delivery and the dashboard use (`mergeFeatureAndSpec` + `resolveResultVariants`), classify each
+ * scenario, and persist `.sungen/triage/<unit>.json`. Read-only apart from that one report file.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { parseFeatureMetadata } from '../exporters/feature-parser';
+import { loadPlaywrightReport, resolveResultsPath } from '../exporters/playwright-report-parser';
+import { collectQaEnvSecretDenylist } from '../exporters/qa-env-secret-denylist';
+import { isSensitiveKey } from '../exporters/sensitive-key';
+import { resolveResultVariants } from '../exporters/result-variants';
+import { mergeFeatureAndSpec } from '../exporters/scenario-merger';
+import { parseSpecFile } from '../exporters/spec-parser';
+import { loadTestData } from '../exporters/test-data-resolver';
+import type { ResolvedUnit } from '../cli/resolve-unit';
+import { classifyScenario, TriageClass, TriageRow } from './triage';
+
+export interface TriageReport {
+  unit: string;
+  generatedAt: string;
+  /** Result files read, relative to the project root. Empty → nothing has run yet. */
+  resultFiles: string[];
+  counts: Partial<Record<TriageClass, number>>;
+  rows: TriageRow[];
+}
+
+/**
+ * Values that must never reach a triage evidence line or a defect record: the resolved `${QA_*}`
+ * secrets AND the literal values of credential-named test-data keys — an assertion on a password
+ * field prints that value in its Expected/Received.
+ */
+export function unitSecrets(testData: Record<string, string>, cwd: string): string[] {
+  const literal = Object.entries(testData)
+    .filter(([k, v]) => isSensitiveKey(k) && typeof v === 'string' && v.length >= 3 && !v.includes('${'))
+    .map(([, v]) => String(v));
+  return [...new Set([...collectQaEnvSecretDenylist(testData, cwd).values, ...literal])].sort((a, b) => b.length - a.length);
+}
+
+function generatedDir(cwd: string, u: ResolvedUnit): string {
+  return path.join(cwd, 'specs', 'generated', u.unitId);
+}
+
+/**
+ * Every result file of one feature, labelled by variant: `<base>-test-result.json` (no label),
+ * `<base>-test-result.<os|env>[.<env>].json` (label = the middle part). A mobile unit has only
+ * per-OS files, so all of them are read rather than the first one found. Falls back to the shared
+ * lookup (incl. `test-results/results.json`) when the generated dir holds none.
+ */
+function resultFilesFor(cwd: string, genDir: string, base: string): Array<{ file: string; variant?: string }> {
+  const prefix = `${base}-test-result`;
+  const own = fs.existsSync(genDir)
+    ? fs.readdirSync(genDir).filter((f) => f.startsWith(prefix) && f.endsWith('.json')).sort()
+    : [];
+  if (own.length > 0) {
+    return own.map((f) => {
+      const variant = f.slice(prefix.length, -'.json'.length).replace(/^\./, '');
+      return { file: path.join(genDir, f), ...(variant ? { variant } : {}) };
+    });
+  }
+  const shared = resolveResultsPath(cwd, genDir, base);
+  return shared ? [{ file: shared }] : [];
+}
+
+export function triageUnit(cwd: string, u: ResolvedUnit): TriageReport {
+  const genDir = generatedDir(cwd, u);
+  const featuresDir = path.join(u.dir, 'features');
+  const features = fs.existsSync(featuresDir) ? fs.readdirSync(featuresDir).filter((f) => f.endsWith('.feature')).sort() : [];
+  const rows: TriageRow[] = [];
+  const resultFiles: string[] = [];
+
+  for (const f of features) {
+    const base = f.replace(/\.feature$/, '');
+    const files = resultFilesFor(cwd, genDir, base);
+    if (files.length === 0) continue;
+    const merged = mergeFeatureAndSpec(parseFeatureMetadata(path.join(featuresDir, f)), parseSpecFile(path.join(genDir, `${base}.spec.ts`)));
+    const dataFile = path.join(u.dir, 'test-data', `${base}.yaml`);
+    const testData = fs.existsSync(dataFile) ? loadTestData(dataFile) : {};
+    const secrets = unitSecrets(testData, cwd);
+
+    for (const { file, variant } of files) {
+      resultFiles.push(path.relative(cwd, file));
+      const results = loadPlaywrightReport(file);
+      for (const m of merged) {
+        for (const v of resolveResultVariants(m, results, testData)) {
+          const r = classifyScenario({ unit: u.unitId, title: `${m.feature.name}${v.nameSuffix}`, tags: m.feature.tags, result: v.result, variant }, secrets);
+          if (r) rows.push(r);
+        }
+      }
+    }
+  }
+
+  const counts: Partial<Record<TriageClass, number>> = {};
+  for (const r of rows) counts[r.class] = (counts[r.class] ?? 0) + 1;
+  return { unit: u.unitId, generatedAt: new Date().toISOString(), resultFiles, counts, rows };
+}
+
+export function triageReportPath(cwd: string, unitId: string): string {
+  return path.join(cwd, '.sungen', 'triage', `${unitId.replace(/\//g, '-')}.json`);
+}
+
+/** The last triage of a unit, or null when `sungen triage` has not run for it. */
+export function readTriageReport(cwd: string, unitId: string): TriageReport | null {
+  try { return JSON.parse(fs.readFileSync(triageReportPath(cwd, unitId), 'utf-8')) as TriageReport; } catch { return null; }
+}
+
+/** Persist under `.sungen/triage/<unit>.json` (a flow `flows/x` → `flows-x.json`); returns the path. */
+export function writeTriageReport(cwd: string, report: TriageReport): string {
+  const out = triageReportPath(cwd, report.unit);
+  fs.mkdirSync(path.dirname(out), { recursive: true });
+  fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`, 'utf-8');
+  return out;
+}

package/src/harness/triage.ts

@@ -0,0 +1,127 @@
+/**
+ * `sungen triage` — classify each red or flaky scenario of a run into exactly one class, with the
+ * rule that fired and one evidence line. Deterministic and read-only; it reports, it never gates.
+ *
+ * Order (first match wins):
+ *   1. known-defect        `@known-defect` / `@known-defect:<id>` — an expected red.
+ *   2. blocked-capability  `@manual:*` / `@requires:*`, or skipped by design.
+ *   3. environment         the session or network never gave the test a usable app.
+ *   4. test-defect         the test could not reach its element or data.
+ *   5. product-candidate   an assertion whose Expected and Received both exist and differ.
+ *   6. unclassified        anything else — left for the agent or QA, with the raw first message.
+ * A `passed` scenario that needed a retry is `flaky` (green, listed separately).
+ *
+ * 5 is tested before 3 and 4 in code: a parsed Expected/Received pair that differs means the app
+ * answered, which outranks any wrapper text (a test timeout around the assertion included).
+ *
+ * A bare test timeout (no locator, no assertion) is `unclassified` too: a slow environment, a page
+ * that hangs on a product bug and a test waiting on the wrong thing all print the same line.
+ *
+ * An assertion on an element that never appeared (`Received: <element(s) not found>`) is NOT a test
+ * defect: a wrong selector and a missing message look identical, so it is left for judgment rather
+ * than hiding a possible product bug behind "fix the selector".
+ */
+import { redactSecrets } from '../exporters/api-testcase-formatter';
+import { parseExpectedReceived } from '../exporters/playwright-report-parser';
+import type { PlaywrightResult } from '../exporters/types';
+import { BARE_TIMEOUT, TRIAGE_SIGNALS } from './triage-signals';
+
+export type TriageClass =
+  | 'known-defect' | 'blocked-capability' | 'environment' | 'test-defect' | 'product-candidate' | 'unclassified' | 'flaky';
+
+export interface TriageInput {
+  unit: string;
+  title: string;
+  tags: string[];
+  result?: PlaywrightResult;
+  /** Result-file variant (`android`, `ios`, an env name) when the unit has several. */
+  variant?: string;
+}
+
+export interface TriageRow {
+  unit: string;
+  scenario: string;
+  variant?: string;
+  class: TriageClass;
+  ruleId: string;
+  evidence: string;
+  ids: string[];
+  legacy: string[];
+  defectId?: string;
+  tracePath?: string;
+  /** product-candidate only: the two halves of the assertion, for a defect draft. */
+  expected?: string;
+  received?: string;
+}
+
+const EVIDENCE_MAX = 200;
+const VIEWPOINT_ID = /\b(?:VP|FL)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi;
+const ELEMENT_ABSENT = /Received:\s*<element\(s\) not found>/;
+
+/** The part of a message the run itself wrote: before `Call log:`, without `Locator:` echo lines. */
+const runHead = (m: string): string => m.split(/\n\s*Call log:/)[0].replace(/^\s*Locator:.*$/gm, '');
+
+/** Every failure message, stack frames and a leading `Error:` dropped. */
+function messagesOf(result: PlaywrightResult): string[] {
+  const raw = result.errorMessages?.length ? result.errorMessages : [result.error ?? ''];
+  return raw.map((m) => m.split(/\n\s*at\s/)[0].replace(/^Error:\s*/i, '').trim()).filter(Boolean);
+}
+
+function evidenceLine(text: string, secrets: string[]): string {
+  const flat = redactSecrets(text, secrets).replace(/\s+/g, ' ').trim();
+  return flat.length > EVIDENCE_MAX ? `${flat.slice(0, EVIDENCE_MAX - 1)}…` : flat;
+}
+
+/** Classify one scenario. Null when it needs no triage (clean pass, or never ran). */
+export function classifyScenario(input: TriageInput, secrets: string[] = []): TriageRow | null {
+  const { result, tags } = input;
+  if (!result) return null;
+  const base = {
+    unit: input.unit,
+    scenario: input.title,
+    ...(input.variant ? { variant: input.variant } : {}),
+    ids: [...new Set([input.title, ...tags].join(' ').match(VIEWPOINT_ID) ?? [])],
+    legacy: tags.filter((t) => t.startsWith('@legacy:')).map((t) => t.slice('@legacy:'.length)),
+    ...(result.tracePath ? { tracePath: result.tracePath } : {}),
+  };
+  const row = (cls: TriageClass, ruleId: string, evidence: string): TriageRow =>
+    ({ ...base, class: cls, ruleId, evidence: evidenceLine(evidence, secrets) });
+
+  if (result.status === 'passed') {
+    return (result.attempts ?? 1) > 1 ? row('flaky', 'passed-after-retry', `passed on attempt ${result.attempts}`) : null;
+  }
+  const messages = messagesOf(result);
+  const first = messages[0] ?? result.status;
+
+  const known = tags.find((t) => t === '@known-defect' || t.startsWith('@known-defect:'));
+  if (known) {
+    const r = row('known-defect', 'tag-known-defect', first);
+    const id = known.split(':')[1];
+    return id ? { ...r, defectId: id } : r;
+  }
+  if (tags.some((t) => t.startsWith('@manual'))) return row('blocked-capability', 'tag-manual', `${tags.find((t) => t.startsWith('@manual'))} — ${first}`);
+  if (tags.some((t) => t.startsWith('@requires:'))) return row('blocked-capability', 'tag-requires', `${tags.find((t) => t.startsWith('@requires:'))} — ${first}`);
+  if (result.status === 'skipped') return row('blocked-capability', 'status-skipped', 'skipped');
+
+  // An assertion with both halves decides the case even when a timeout wraps it.
+  for (const m of messages) {
+    const { expected, received } = parseExpectedReceived(m);
+    if (expected && received && !ELEMENT_ABSENT.test(m) && expected !== received) {
+      return { ...row('product-candidate', 'assertion-mismatch', `Expected ${expected} · Received ${received}`),
+        expected: evidenceLine(expected, secrets), received: evidenceLine(received, secrets) };
+    }
+  }
+  for (const s of TRIAGE_SIGNALS) {
+    // Environment signals read only what the RUN said, never the test's own selector text that a
+    // message echoes in `Locator:` / `Call log:` — `getByText('Invalid URL')` is a missing message,
+    // not a bad base URL. Test-defect signals need the call log (`waiting for …`), so they read it all.
+    const hit = messages.find((m) => s.match.test(s.class === 'environment' ? runHead(m) : m));
+    if (hit) return row(s.class, s.id, hit);
+  }
+  const absent = messages.find((m) => ELEMENT_ABSENT.test(m));
+  if (absent) return row('unclassified', 'assertion-element-absent', absent);
+  if (messages.length > 0 && messages.every((m) => BARE_TIMEOUT.test(m))) {
+    return row('unclassified', 'bare-timeout', `${first} No locator or assertion detail: a slow environment, a hanging page, or a wait in the test. Re-run once, then read the trace's last action.`);
+  }
+  return row('unclassified', 'no-signal', first);
+}

package/src/harness/viewpoint-ledger.ts

@@ -12,6 +12,7 @@ import * as fs from 'fs';
 import { NON_DECLARATION_SECTION, PRIORITY_WORDS, ScenarioInfo } from './parse';
 import { readViewpointText } from './read-text';
 import { keywordHit } from './keyword-match';
+import { countedAssertions } from './counted-assertions';
 
 export interface LedgerItem { id?: string; text: string; covered: boolean }
 
@@ -238,8 +239,7 @@ export function viewpointLedger(viewpointPath: string, scenarios: ScenarioInfo[]
         const n = claimedCount(item.text);
         const auto = carriers.filter((s) => !s.manual);
         if (n !== null && auto.length > 0 && !auto.some((s) => /\bsee all\b/.test(s.stepsText))) {
-          const asserted = Math.max(...auto.map((s) =>
-            (s.stepsText.match(/\bsee \[[^\]]+\][^|]*?\b(?:with|contains) \{\{/g) ?? []).length));
+          const asserted = Math.max(...auto.map((s) => countedAssertions(s.stepsText)));
           if (asserted > 0 && asserted < n) partial.push({ id: item.id, text: item.text, claimed: n, asserted });
         }
       }

package/src/index.ts

@@ -20,7 +20,8 @@ export type { ResolvedAppProfile } from './generators/test-generator/app-profile
 export type { MappedStep } from './generators/test-generator/step-mapper';
 // The shared "nothing honest to compile" step body. Exported for the driver SPI: a pattern that
 // must refuse (SG-W017 and siblings) emits THIS rather than shipping a one-sided refusal template,
-// which would fail the adapter-parity gate and push playwright off its refusal-only floor of 0.
+// which would fail the adapter-parity gate and push playwright off its refusal-only floor (1 — the
+// `date-picker-unsupported` refusal both adapters ship for the resolver-based fill-input pattern, #907).
 export { unsupportedStepCode } from './generators/test-generator/patterns/unsupported-step-code';
 export type { ParsedStep } from './generators/gherkin-parser';
 export { getPathCode, inferPath, resolvePathVariables } from './generators/test-generator/utils/path-inference';