@validate.qa/runner 1.0.28 → 1.0.30

package/dist/cli.mjs

@@ -1589,7 +1589,11 @@ function buildStepTarget(metadata, selector) {
   };
 }
 function labelForAction(action, metadata) {
-  return nonEmpty(metadata.targetLabel) ?? nonEmpty(metadata.locatorBundle?.accessibilityId) ?? nonEmpty(metadata.locatorBundle?.resourceId) ?? nonEmpty(metadata.locatorBundle?.text) ?? nonEmpty(action.selector) ?? nonEmpty(action.url) ?? "element";
+  const editable = isEditableMobileClassName(metadata.locatorBundle?.className);
+  const locatorText = nonEmpty(metadata.locatorBundle?.text);
+  const targetLabel = nonEmpty(metadata.targetLabel);
+  const targetLabelIsEditableValue = editable && targetLabel !== void 0 && locatorText !== void 0 && targetLabel === locatorText;
+  return (targetLabelIsEditableValue ? void 0 : targetLabel) ?? nonEmpty(metadata.locatorBundle?.accessibilityId) ?? nonEmpty(metadata.locatorBundle?.resourceId) ?? (editable ? void 0 : locatorText) ?? nonEmpty(action.selector) ?? nonEmpty(action.url) ?? "element";
 }
 function descriptionForStep(action, stepAction, metadata) {
   const label = labelForAction(action, metadata);
@@ -2042,6 +2046,9 @@ function resolvePlatformLocatorBundle(target, platform3) {
 function hasPlatformLocator(target, platform3) {
   return Boolean(target?.platformLocators?.[platform3]);
 }
+function isLocatorRequiringAction(action) {
+  return LOCATOR_REQUIRING_ACTIONS.has(action);
+}
 function hasCrossPlatformIdentity(bundle) {
   if (!bundle)
     return false;
@@ -2089,6 +2096,115 @@ function isTestReadyForPlatform(steps, authoringPlatform, runPlatform) {
     return true;
   return stepsMissingPlatformLocators(steps, runPlatform).length === 0 && stepsNeedingReviewForPlatform(steps, runPlatform).length === 0;
 }
+function summarizeMobileReadiness(steps, authoringPlatform) {
+  return MOBILE_PLATFORMS.map((platform3) => {
+    const locatorSteps = steps.filter((step) => isLocatorRequiringAction(step.action) && stepAppliesToPlatform(step, platform3)).length;
+    const executableSteps = steps.filter((step) => stepAppliesToPlatform(step, platform3)).length;
+    if (authoringPlatform === platform3) {
+      return {
+        platform: platform3,
+        authoringPlatform,
+        ready: true,
+        status: "ready",
+        locatorSteps,
+        executableSteps,
+        missingLocators: 0,
+        needsReview: 0
+      };
+    }
+    const missingLocators = stepsMissingPlatformLocators(steps, platform3).length;
+    const needsReview = stepsNeedingReviewForPlatform(steps, platform3).length;
+    const ready = missingLocators === 0 && needsReview === 0;
+    return {
+      platform: platform3,
+      ...authoringPlatform ? { authoringPlatform } : {},
+      ready,
+      status: ready ? "ready" : needsReview > 0 ? "needs_review" : "needs_locator_discovery",
+      locatorSteps,
+      executableSteps,
+      missingLocators,
+      needsReview
+    };
+  });
+}
+function hasStableNativeIdentity(bundle) {
+  if (!bundle)
+    return false;
+  return Boolean(bundle.accessibilityId?.trim() || bundle.resourceId?.trim() || bundle.text?.trim() || bundle.contentDesc?.trim() || bundle.xpath?.trim() && /@\w+\s*=/.test(bundle.xpath) && !/(?:contains|starts-with)\s*\(/i.test(bundle.xpath));
+}
+function isPositionalXpath(xpath) {
+  const value = xpath?.trim();
+  if (!value)
+    return false;
+  return value.startsWith("/") && !/@\w+\s*=/.test(value);
+}
+function addSelectorIssue(issues, step, severity, reason) {
+  issues.push({
+    order: step.order,
+    action: step.action,
+    severity,
+    reason,
+    ...step.target?.primary ? { targetLabel: step.target.primary } : {},
+    ...step.target?.screenName ? { screenName: step.target.screenName } : {}
+  });
+}
+function analyzeMobileSelectorQuality(steps) {
+  const issues = [];
+  let locatorSteps = 0;
+  let stableLocatorSteps = 0;
+  let crossPlatformIdentitySteps = 0;
+  let coordinateFallbackSteps = 0;
+  let missingLocatorSteps = 0;
+  let positionalXpathSteps = 0;
+  let classOnlySteps = 0;
+  for (const step of steps) {
+    if (!isLocatorRequiringAction(step.action))
+      continue;
+    locatorSteps += 1;
+    const target = step.target;
+    const bundle = target?.locatorBundle;
+    if (!target || !bundle) {
+      missingLocatorSteps += 1;
+      addSelectorIssue(issues, step, "high", "No native locator bundle is stored for this element step.");
+      continue;
+    }
+    if (hasStableNativeIdentity(bundle))
+      stableLocatorSteps += 1;
+    if (hasCrossPlatformIdentity(bundle))
+      crossPlatformIdentitySteps += 1;
+    if (target.bounds && !hasStableNativeIdentity(bundle)) {
+      coordinateFallbackSteps += 1;
+      addSelectorIssue(issues, step, "medium", "Step may replay by coordinates because the locator bundle has no stable native identity.");
+    }
+    if (isPositionalXpath(bundle.xpath)) {
+      positionalXpathSteps += 1;
+      addSelectorIssue(issues, step, "medium", "Locator relies on a positional XPath, which is brittle across app versions and platforms.");
+    }
+    if (bundle.className?.trim() && !hasStableNativeIdentity(bundle)) {
+      classOnlySteps += 1;
+      addSelectorIssue(issues, step, "medium", "Locator is class-only with no accessibility id, resource id, text, or content description.");
+    }
+    if (!hasCrossPlatformIdentity(bundle)) {
+      addSelectorIssue(issues, step, "low", "No cross-platform identity signal is available; iOS/Android reuse may need locator discovery or manual review.");
+    }
+  }
+  const high = issues.filter((issue) => issue.severity === "high").length;
+  const medium = issues.filter((issue) => issue.severity === "medium").length;
+  const low = issues.filter((issue) => issue.severity === "low").length;
+  const score = Math.max(0, Math.min(100, 100 - high * 25 - medium * 10 - low * 3));
+  return {
+    totalSteps: steps.length,
+    locatorSteps,
+    stableLocatorSteps,
+    crossPlatformIdentitySteps,
+    coordinateFallbackSteps,
+    missingLocatorSteps,
+    positionalXpathSteps,
+    classOnlySteps,
+    issues,
+    summary: { high, medium, low, score }
+  };
+}
 var MOBILE_PLATFORMS, LOCATOR_REQUIRING_ACTIONS;
 var init_mobile_cross_platform = __esm({
   "../shared/dist/mobile-cross-platform.js"() {
@@ -2297,12 +2413,12 @@ var init_plans = __esm({
         billingModel: "free",
         summary: "For curious developers. Get the full platform - MCP, Discovery, Voice, self-heal - with enough headroom for one real project.",
         maxProjects: 1,
-        maxTestsPerProject: 10,
+        maxTestsPerProject: 100,
         maxSuiteRunsPerDay: 1,
-        maxTestExecutionsPerDay: 20,
-        // 10 regression / 10 manual at the default 50/50 split
-        maxDiscoveryRunsPerDay: 5,
-        // ONE-TIME total budget for trial
+        maxTestExecutionsPerDay: 50,
+        // 25 regression / 25 manual at the default 50/50 split
+        maxDiscoveryRunsPerDay: 1,
+        // Per day
         maxConcurrentDiscoveries: 1,
         maxHealsPerDay: 5,
         maxRegenerationsPerDay: 2,
@@ -2314,8 +2430,8 @@ var init_plans = __esm({
       standard_plus: {
         code: "standard_plus",
         label: "Standard +",
-        priceLabel: "$19.99 / month",
-        monthlyPriceUsd: 19.99,
+        priceLabel: "$99.99 / month",
+        monthlyPriceUsd: 99.99,
         billingModel: "subscription",
         summary: "For solo devs and small teams shipping weekly. 200 tests, 100 test runs/day, full MCP. The plan most teams stay on.",
         maxProjects: 1,
@@ -2380,7 +2496,7 @@ var init_plans = __esm({
         requiresContact: true
       }
     };
-    TRIAL_DURATION_DAYS = 14;
+    TRIAL_DURATION_DAYS = 30;
     CREDIT_PRICES_CENTS = {
       discovery_run: 50,
       // $0.50
@@ -3796,6 +3912,7 @@ __export(dist_exports, {
   UI_VARIANTS: () => UI_VARIANTS,
   accumulateStatements: () => accumulateStatements,
   aiCostToCreditCents: () => aiCostToCreditCents,
+  analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
   bugFoundQuarantineWhere: () => bugFoundQuarantineWhere,
   buildAppiumCode: () => buildAppiumCode,
   buildLaunchStep: () => buildLaunchStep,
@@ -3882,6 +3999,7 @@ __export(dist_exports, {
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
   summarizeHealth: () => summarizeHealth,
+  summarizeMobileReadiness: () => summarizeMobileReadiness,
   summarizeRunHealth: () => summarizeRunHealth,
   toDbPricingPlan: () => toDbPricingPlan,
   validateAssertionStrength: () => validateAssertionStrength
@@ -62159,7 +62277,7 @@ var require_mobile_explorer = __commonJS({
       }
       sections.push("");
       if (mode === "survey") {
-        sections.push(`**Mission:** Map every reachable screen. For each new screen: mobile_snapshot -> capture_screen -> record_transition. Get PAST the entry gate into the app's real main content \u2014 the login/landing screens are the ENTRANCE, not the app. If test credentials are provided (see the Test Credentials section), SIGN IN with them FIRST and map the authenticated app; that is the real product surface. Use a guest/demo/skip entry (e.g. "See Demo Profile", "Continue as guest") ONLY as a fallback when no credentials are available or login cannot be completed \u2014 demo mode is a limited sandbox, not the authenticated app. Do NOT submit forms with junk data or mutate real data. Call finish_exploration ONLY when every reachable screen \u2014 including the authenticated content \u2014 has been captured and no unvisited frontier screens remain.`);
+        sections.push("**Mission:** Map every reachable screen. For each new screen: mobile_snapshot -> capture_screen -> record_transition. Get PAST the entry gate into the app's real main content \u2014 the login/landing screens are the ENTRANCE, not the app. If test credentials are provided (see the Test Credentials section), SIGN IN with them FIRST and map the authenticated app; that is the real product surface. Prefer a real login when credentials are provided; only if login genuinely cannot be completed after honest attempts (persistent error, the form will not accept the credential, no valid account) fall back to any guest/demo/skip entry the app offers and map the app fully from there \u2014 reaching the real feature surface that way is far better coverage than getting stuck on the login wall. Do NOT submit forms with junk data or mutate real data. Call finish_exploration ONLY when every reachable screen \u2014 including the authenticated content \u2014 has been captured and no unvisited frontier screens remain.");
       } else {
         sections.push("**Mission:** Use the focus features like a real user. Tap, type, submit, and observe outcomes. After a meaningful flow, call record_journey. Call finish_exploration when the flows are covered.");
       }
@@ -62224,7 +62342,7 @@ LOG IN FIRST \u2014 before broad exploration. The authenticated app is the real
 4. VERIFY you are actually signed in: re-snapshot and confirm an authenticated signal appeared (a home/feed/dashboard with real content, an account/profile tab, a "Sign out" option, or your user identity). If you are still on the login form, the login failed \u2014 check for an error, re-enter, and submit again (up to 2 attempts).
 5. Only AFTER you have confirmed you are signed in, map the authenticated app.
 
-PREFER real login over any "demo"/"guest"/"skip" entry: those give a limited sandbox, NOT the authenticated app. Use them only if login is impossible.
+TRY THE REAL LOGIN FIRST (above). It is the preferred entry. BUT your #1 job is to get INTO the app and map its real content \u2014 an empty survey that only maps the login/landing screens is the worst outcome. So: if the real login does not clearly succeed within 2 honest attempts (you fill + submit and are still on the login form / see an error / the form will not accept the credential), DO NOT get stuck \u2014 take any guest/demo/skip entry the app offers (e.g. "Continue as guest", "Skip", "Try it out", a demo/preview mode) instead and map the app fully from there. A guest/demo session that reveals the real feature surface (feed, tabs, settings, profile) is FAR better coverage than a handful of pre-login screens. Prefer authenticated content when you can reach it; never abandon the survey on the login wall when a demo/guest door is open.
 
 SECURITY RULES:
 - NEVER call \`mobile_type\` with an email, password, or token value \u2014 the runner will REJECT the call and you lose an iteration. Use \`mobile_fill_credential\` for every credential field.
@@ -62270,7 +62388,7 @@ Rules:
 **Phase 2 \u2014 Logged-in breadth first (~35% of budget).** Once signed in, find the primary navigation (bottom tab bar, drawer, or menu) and visit EVERY top-level destination ONCE, capturing each screen, BEFORE drilling into any of them. A survey that maps one tab deeply but never opens the other tabs has failed \u2014 breadth across all tabs/drawer entries is mandatory.
 **Phase 3 \u2014 Depth (remaining budget).** Return to each captured tab and explore its sub-screens: open ONE list row per list (rows share a template), open menus/sheets/dialogs, capture detail screens, and mobile_swipe up/down to reveal off-screen content. record_transition whenever you move between screens.
 
-Rules that apply throughout: capture_screen every new screen (name + type \u2014 use type "onboarding"/"landing" for pre-login screens, "auth" for sign-in/sign-up); record_transition on every move; mobile_back to return; mobile_relaunch only for a clean restart between episodes. When no new screens remain, call finish_exploration.
+Rules that apply throughout: capture_screen every new screen (name + type \u2014 use screenType "LANDING" for welcome/onboarding/intro screens and "AUTH" for sign-in/sign-up); record_transition on every move; mobile_back to return; mobile_relaunch only for a clean restart between episodes. When no new screens remain, call finish_exploration.
 
 ## Boundaries (survey = map, do not mutate)
 - Do NOT submit forms, save, delete, purchase, or send anything. You MAY open modals/menus to catalog them, then dismiss.
@@ -65783,7 +65901,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 Return ONLY one valid JSON object matching the schema below. Do NOT include <think> blocks, markdown fences, analysis, prose, or any text outside the JSON object. Put any brief explanation only in the JSON "reasoning" field.
 
 ## Planning Principles
-1. **Evidence-backed only** - only plan tests for flows the explorer actually observed. EXCEPTION: for async/generative/long-running features (see rule 11), the explorer may have only observed the trigger state and not the successful completion state (because the flow was blocked by a prerequisite, rate limit, slow third party, or the iteration budget ran out). In that case you MAY script the durable-outcome verification step using STRUCTURAL signals only (a new row with a self-created identifier appears in the list, a status badge transitions to a known-observed value, the sheet/dialog dismisses, the input clears). Mark such scenarios with \`"evidenceLevel": "trigger-only"\`. **You MUST NOT assert specific text the explorer never observed** \u2014 phrases like "No results match your search", "Successfully saved", "Operation complete" are FORBIDDEN unless that exact text appears verbatim in evidence.observations or recordedJourneys[*].expectedOutcome. If the only viable verification is text you didn't see, downgrade the assertion to a structural one (the list is empty / the item count dropped to 0 / the input cleared) instead of inventing copy.
+1. **Evidence-backed only** - only plan tests for flows the explorer actually observed. EXCEPTION: for async/generative/long-running features (see rule 12), the explorer may have only observed the trigger state and not the successful completion state (because the flow was blocked by a prerequisite, rate limit, slow third party, or the iteration budget ran out). In that case you MAY script the durable-outcome verification step using STRUCTURAL signals only (a new row with a self-created identifier appears in the list, a status badge transitions to a known-observed value, the sheet/dialog dismisses, the input clears). Mark such scenarios with \`"evidenceLevel": "trigger-only"\`. **You MUST NOT assert specific text the explorer never observed** \u2014 phrases like "No results match your search", "Successfully saved", "Operation complete" are FORBIDDEN unless that exact text appears verbatim in evidence.observations or recordedJourneys[*].expectedOutcome. If the only viable verification is text you didn't see, downgrade the assertion to a structural one (the list is empty / the item count dropped to 0 / the input cleared) instead of inventing copy.
 2. **One purpose per scenario** - each scenario tests ONE thing (happy path, validation, journey, or bug)
 3. **Happy paths first** - then pair edge cases to the same form/flow
 4. **Multi-screen journeys** - only when screen transitions were actually observed. When an observed target element sits below the fold, include an explicit swipe step to scroll it into view before the tap (mobile elements off-screen are not hittable until revealed)
@@ -65792,23 +65910,23 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 7. **Expected outcomes are plain-English success criteria** - describe the user-visible product result, not the controls touched along the way. Steps already cover buttons, inputs, tabs, sheets, and menus. Expected outcomes should say what the user can now do or rely on (record saved, message sent, search results filtered, validation explained, home screen reached). Name the target screen or exact copy only when it is the real product outcome; do NOT list "heading visible", "button visible", or similar element inventory unless that exact control is the behavior under test.
 8. **Auth-aware** - mark scenarios that need a signed-in session. Use process.env.TEST_USER_EMAIL / PASSWORD
 9. **No duplicates** - check existing test names before adding
-10. **All tests start from a hermetic app launch** - every generated test relaunches the app (terminate + activate, a clean cold start) and uses the app's own in-app navigation (tapping tabs / links / buttons) to reach the target screen. Steps must reflect this: say "Relaunch the app and tap Sign In" not "deep-link to the login screen". Do NOT navigate by deep-link; the app's launch + tab/drawer navigation is the only entry path. \`targetPages\` lists the screen-ids involved in the flow.
-12. **targetPages must be copied CHARACTER-FOR-CHARACTER from the screen-ids in the evidence** (they look like \`com.example.app.MainActivity#ab12cd34\`). NEVER invent, prettify, or abbreviate them \u2014 no "Landing", "AUTH", "Home Screen", or any name that is not literally in the provided screens. A scenario whose targetPages contains even ONE id not present in the evidence is REJECTED WHOLESALE by the validator, so a single made-up route silently destroys the entire scenario. If you are unsure which screen-id a step touches, use the screen-id of the screen where the flow STARTS.
-11. **Happy paths must verify the DURABLE OUTCOME, not just the trigger.** A HAPPY_PATH is NOT complete until it verifies the feature's real output. "Button tapped" / "Sheet opened" / "Spinner appeared" is NOT a happy path - that is a UI interaction test. Apply this to any feature where an action produces a result the user then sees or uses: CRUD creates, photo/file uploads, searches that return results, imports, exports, payments, messages sent, AI/ML outputs, generated documents, sync runs, analysis runs, conversion, data processing. The scenario MUST include:
+10. **All tests start from the app launch entry** - every generated test starts by launching the target app. The runner clears app data when the device/reset policy safely supports it; otherwise it performs a terminate + activate relaunch, which can preserve app session data. Therefore scenarios MUST navigate through the app's own UI from whatever launch state is valid, and MUST NOT rely on mutable data from a prior scenario disappearing. Steps must reflect this: say "Launch the app and tap Sign In" not "deep-link to the login screen". Do NOT navigate by deep-link; the app's launch + tab/drawer navigation is the only entry path. \`targetPages\` lists the screen-ids involved in the flow.
+11. **targetPages must be copied CHARACTER-FOR-CHARACTER from the screen-ids in the evidence** (they look like \`com.example.app.MainActivity#ab12cd34\`). NEVER invent, prettify, or abbreviate them \u2014 no "Landing", "AUTH", "Home Screen", or any name that is not literally in the provided screens. A scenario whose targetPages contains even ONE id not present in the evidence is REJECTED WHOLESALE by the validator, so a single made-up route silently destroys the entire scenario. If you are unsure which screen-id a step touches, use the screen-id of the screen where the flow STARTS.
+12. **Happy paths must verify the DURABLE OUTCOME, not just the trigger.** A HAPPY_PATH is NOT complete until it verifies the feature's real output. "Button tapped" / "Sheet opened" / "Spinner appeared" is NOT a happy path - that is a UI interaction test. Apply this to any feature where an action produces a result the user then sees or uses: CRUD creates, photo/file uploads, searches that return results, imports, exports, payments, messages sent, AI/ML outputs, generated documents, sync runs, analysis runs, conversion, data processing. The scenario MUST include:
     - The trigger step (Tap Submit / Generate / Send / Upload / Run / Analyze / Save / Pay / etc.)
     - A wait step for the operation to complete. Phrase it by SIGNAL, not wall-clock ("Wait for the result to appear - up to 60 seconds"). Prefer signals the app actually uses: spinner disappears, status badge flips to a success state, a new row appears, an item count increments, a success toast/snackbar shows, the screen transitions to a result screen.
     - A verification step on the DURABLE RESULT - the thing that outlives the transient UI: a new list row, a persisted record, a received message, a committed state change, visible output text. Do NOT assert on the spinner disappearing alone; assert on what replaced it.
     - Where the feature exposes follow-up actions on the result (View / Open / Copy / Share / Delete), include at least one to prove the result is real and usable.
     DO NOT verify subjective qualities of generated content ("relevant to the input", "high quality") - those are not deterministic. Verify structural/existence properties: non-empty, contains a known input value, matches an expected field, row count increased, status = completed.
-    Example - BAD happy path: \`["Relaunch app", "Tap Create", "Verify sheet opens"]\` \u2192 only tests the trigger.
-    Example - GOOD happy path (generic, async): \`["Relaunch app and sign in", "Navigate to the feature screen", "Note the current count of rows in the list", "Tap the primary action button", "Fill required inputs and submit", "Wait for completion signal (up to 60s)", "Verify the row count increased by 1", "Open the newly created row", "Verify its content is non-empty and contains the input I provided"]\`
-    Example - GOOD happy path (sync CRUD): \`["Relaunch app and sign in", "Navigate to the list screen", "Tap New", "Fill required fields", "Tap Save", "Verify the new record appears in the list", "Tap the record and verify its detail screen shows the values I entered"]\`
-12. **Auth happy paths require concrete session proof.** A sign-in HAPPY_PATH is incomplete if it only proves "user reaches the home screen" or "an authenticated screen is visible." It MUST verify at least one durable signed-in signal that was observed in the evidence: the account/profile tab opens, Sign out is available, the observed display name/email/avatar is present, an authenticated screen remains reachable after a relaunch with the session restored, or another app-specific session control is usable. Prefer concrete observed labels from the evidence (for example "Sign out", "Demo User", "Account", "Profile") over generic phrases like "personalized content." If the explorer only observed a screen transition and no signed-in signal, keep the screen outcome but mark the session-proof outcome reliability "low" and state what concrete signal was missing.
-13. **Independent execution contract.** Every scenario MUST pass when run alone, first, last, in random order, and against an app whose session was relaunched fresh with no relevant feature data except explicitly guaranteed immutable fixtures. A scenario that depends on a sibling scenario's side effects (e.g. "delete the conversation that another test created") is invalid. If two flows are inherently coupled, bundle them as a single USER_JOURNEY scenario. (Sessions are noReset=true, so a \`mobile_relaunch\` between scenarios is the hermetic reset \u2014 assume it ran.)
-14. **Scenario-owned state.** If a scenario reads, searches, opens, updates, messages, cancels, or deletes an entity, that scenario MUST create or seed the entity in its own setup steps. "Use an existing record" / "the conversation in the demo account" / "the existing user named X" are forbidden phrasings \u2014 they assume mutable pre-existing app data. Carve-out: baseline observations (current count, list length, "the home screen header is visible") are allowed as prerequisite reads ONLY when the durable assertion targets a self-created entity. Phrase setup as: "Tap New, fill required fields with run-scoped values, submit and verify the new record appears, THEN proceed to <feature under test>."
-15. **Run-scoped test data.** Generated entities MUST use unique, run-scoped identifiers \u2014 phrase as "test message <Date.now()>" or "QA-<unique id>" in steps. Subsequent assertions MUST target that unique identifier, not "the first row", "the latest message", "the last cell", or any visible display name observed during exploration. Hardcoding any specific display name, username, email, conversation title, or other identifier observed in the explorer's snapshot is forbidden \u2014 that data is incidental, not a stable contract. The same identifiers will not exist (or will look different) when the test runs against a fresh session or a different account.
-16. **Setup is plumbing, not purpose.** Sign-in + create-prereq + navigate steps DO NOT violate "one purpose per scenario" (rule 2). The scenario's purpose is its primary user goal and the durable assertion that proves it. Treat setup as scaffolding and write it inline; do not split a delete-confirm scenario into "sign in \u2192 create" and "delete \u2192 assert removed" \u2014 they belong in one scenario.
-17. **Prerequisites \u2014 declare every state assumption, AND prefer rewriting to declaring.** Every scenario MUST list its state prerequisites in the \`prerequisites\` array. The four kinds are \`self_owned\`, \`seed_fixture\`, \`external_relationship\`, and \`clean_initial_state\`.
+    Example - BAD happy path: \`["Launch app", "Tap Create", "Verify sheet opens"]\` \u2192 only tests the trigger.
+    Example - GOOD happy path (generic, async): \`["Launch app and sign in if needed", "Navigate to the feature screen", "Note the current count of rows in the list", "Tap the primary action button", "Fill required inputs and submit", "Wait for completion signal (up to 60s)", "Verify the row count increased by 1", "Open the newly created row", "Verify its content is non-empty and contains the input I provided"]\`
+    Example - GOOD happy path (sync CRUD): \`["Launch app and sign in if needed", "Navigate to the list screen", "Tap New", "Fill required fields", "Tap Save", "Verify the new record appears in the list", "Tap the record and verify its detail screen shows the values I entered"]\`
+13. **Auth happy paths require concrete session proof.** A sign-in HAPPY_PATH is incomplete if it only proves "user reaches the home screen" or "an authenticated screen is visible." It MUST verify at least one durable signed-in signal that was observed in the evidence: the account/profile tab opens, Sign out is available, the observed display name/email/avatar is present, an authenticated screen remains reachable after a relaunch with the session restored, or another app-specific session control is usable. Prefer concrete observed labels from the evidence (for example "Sign out", "Account", "Profile", or the user's own displayed name/email) over generic phrases like "personalized content." If the explorer only observed a screen transition and no signed-in signal, keep the screen outcome but mark the session-proof outcome reliability "low" and state what concrete signal was missing.
+14. **Independent execution contract.** Every scenario MUST pass when run alone, first, last, in random order, and against an app launch state that may be freshly cleared OR may preserve a previous session depending on the device/reset policy. A scenario that depends on a sibling scenario's side effects (e.g. "delete the conversation that another test created") is invalid. If two flows are inherently coupled, bundle them as a single USER_JOURNEY scenario.
+15. **Scenario-owned state.** If a scenario reads, searches, opens, updates, messages, cancels, or deletes an entity, that scenario MUST create or seed the entity in its own setup steps. "Use an existing record" / "the conversation already in the account" / "the existing user named X" are forbidden phrasings \u2014 they assume mutable pre-existing app data. Carve-out: baseline observations (current count, list length, "the home screen header is visible") are allowed as prerequisite reads ONLY when the durable assertion targets a self-created entity. Phrase setup as: "Tap New, fill required fields with run-scoped values, submit and verify the new record appears, THEN proceed to <feature under test>."
+16. **Run-scoped test data.** Generated entities MUST use unique, run-scoped identifiers \u2014 phrase as "test message <Date.now()>" or "QA-<unique id>" in steps. Subsequent assertions MUST target that unique identifier, not "the first row", "the latest message", "the last cell", or any visible display name observed during exploration. Hardcoding any specific display name, username, email, conversation title, or other identifier observed in the explorer's snapshot is forbidden \u2014 that data is incidental, not a stable contract. The same identifiers will not exist (or will look different) when the test runs against a fresh session or a different account.
+17. **Setup is plumbing, not purpose.** Sign-in + create-prereq + navigate steps DO NOT violate "one purpose per scenario" (rule 2). The scenario's purpose is its primary user goal and the durable assertion that proves it. Treat setup as scaffolding and write it inline; do not split a delete-confirm scenario into "sign in \u2192 create" and "delete \u2192 assert removed" \u2014 they belong in one scenario.
+18. **Prerequisites \u2014 declare every state assumption, AND prefer rewriting to declaring.** Every scenario MUST list its state prerequisites in the \`prerequisites\` array. The four kinds are \`self_owned\`, \`seed_fixture\`, \`external_relationship\`, and \`clean_initial_state\`.
 
     **Before declaring a prereq as anything other than \`self_owned\`, attempt these IN ORDER:**
 
@@ -65831,7 +65949,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     - \`clean_initial_state\`: never use.
 
     If your scenario has NO state assumptions (pure navigation, public screen, validation scenarios where ANY state passes), use \`prerequisites: []\`. An empty array is the correct declaration for self-contained scenarios.
-18. **Planner emits design, not implementation.** Live-generate handles execution against a real device snapshot.
+19. **Planner emits design, not implementation.** Live-generate handles execution against a real device snapshot.
 
     **YOUR responsibility:**
     - Scenario \`name\`, \`type\`, \`goal\`, \`prerequisites\`
@@ -65857,10 +65975,10 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     Citing observed labels / accessibility-ids in \`expectedOutcomes\` (per Rule 12) is fine \u2014 that's asserting on stable product signals, not implementation specifics.
 
 ## Coverage Strategy
-- For every form: at least 1 HAPPY_PATH (submit valid data AND verify durable result per rule 11) + 1 EDGE_CASE (empty/invalid submission)
-- For auth flows: sign-in happy path (verify the target screen AND a concrete signed-in/session signal per rule 12) + validation (wrong password, empty fields)
+- For every form: at least 1 HAPPY_PATH (submit valid data AND verify durable result per rule 12) + 1 EDGE_CASE (empty/invalid submission)
+- For auth flows: sign-in happy path (verify the target screen AND a concrete signed-in/session signal per rule 13) + validation (wrong password, empty fields)
 - For CRUD: each scenario MUST own the entity it operates on. Read/search/update/delete/cancel-on-existing/view-existing scenarios MUST include a create step earlier in the same scenario (or declare an immutable seed fixture by name). Never assume a record from prior runs or sibling tests exists. When create/delete are tightly coupled, bundle into a single USER_JOURNEY: create \u2192 verify \u2192 delete \u2192 verify removal.
-- For AI/async features (Generate, Analyze, Process, Import, Sync): happy path MUST complete the flow per rule 11 - never stop at "button tapped" or "sheet opened"
+- For AI/async features (Generate, Analyze, Process, Import, Sync): happy path MUST complete the flow per rule 12 - never stop at "button tapped" or "sheet opened"
 - For navigation: multi-screen user journeys within the feature scope (do NOT drift into unrelated features)
 
 ## Output JSON Schema
@@ -65882,7 +66000,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
       "featureGroup": "Authentication",
       "goal": "User can sign in with valid credentials and reach the home screen",
       "steps": [
-        { "action": "Relaunch the app and tap Sign In to reach the sign-in screen" },
+        { "action": "Launch the app and tap Sign In to reach the sign-in screen" },
         { "action": "Type test credentials into the email field" },
         { "action": "Type test credentials into the password field" },
         { "action": "Tap the Sign In button" },
@@ -65955,6 +66073,59 @@ Each entry is exactly one of:
     function screenDisplayName(state2) {
       return state2.screenName?.trim() || state2.screenId;
     }
+    function isOpaqueMobileScreenName(value, appId) {
+      const trimmed = value.trim();
+      if (!trimmed)
+        return false;
+      if (appId && (trimmed === appId || trimmed.startsWith(`${appId}#`) || trimmed.startsWith(`${appId}.`))) {
+        return true;
+      }
+      return /^[A-Za-z][\w$]*(?:\.[A-Za-z][\w$]*)+(?:#[A-Za-z0-9_-]+)?$/.test(trimmed);
+    }
+    function humanizeToken(token) {
+      const spaced = token.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim();
+      if (!spaced)
+        return "";
+      return spaced.split(/\s+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+    }
+    function mobileAppDisplayName(appId) {
+      const parts = (appId ?? "").split(".").map((part) => part.trim()).filter(Boolean).filter((part) => !/^(com|org|net|io|app|mobile|android|ios)$/i.test(part));
+      const token = parts.length > 0 ? parts[parts.length - 1] : "";
+      const human = humanizeToken(token);
+      return human || "Mobile App";
+    }
+    function nonGenericScreenName(state2, appId) {
+      const raw = state2.screenName?.trim();
+      if (!raw || isOpaqueMobileScreenName(raw, appId))
+        return null;
+      const human = humanizeToken(raw.replace(/(?:Activity|ViewController|Fragment|Screen|Page)$/i, ""));
+      if (!human || /^(main|root|launch|screen|page|activity|view controller)$/i.test(human))
+        return null;
+      return human;
+    }
+    function inferMobileFeatureGroupName(states, appId) {
+      const usable = states.filter((state2) => state2.screenType?.toLowerCase() !== "error");
+      const screenTypes = usable.map((state2) => state2.screenType?.toLowerCase()).filter(Boolean);
+      if (screenTypes.length > 0 && screenTypes.every((type) => type === "auth"))
+        return "Authentication";
+      if (screenTypes.length > 0 && screenTypes.every((type) => type === "onboarding" || type === "landing" || type === "splash")) {
+        return "Onboarding";
+      }
+      const named = usable.map((state2) => nonGenericScreenName(state2, appId)).find((name) => Boolean(name));
+      return named ?? `${mobileAppDisplayName(appId)} App`;
+    }
+    function mobileFeatureCanonicalKey(name) {
+      const normalized = name.trim().toLowerCase().replace(/['’]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+      if (!normalized)
+        return "mobile-app";
+      if (/(^|-)(auth|authentication|login|log-in|signin|sign-in|signup|sign-up)($|-)/.test(normalized)) {
+        return "authentication";
+      }
+      if (/(^|-)(onboarding|welcome|landing|splash|intro|walkthrough)($|-)/.test(normalized)) {
+        return "onboarding";
+      }
+      return normalized.replace(/-(app|screen|screens|flow|feature)$/g, "") || normalized;
+    }
     function formatMobileEvidenceForPlanner(graph, context = {}) {
       const sections = [];
       if (context.appBrief) {
@@ -66146,9 +66317,10 @@ ${constraints.join("\n")}`);
       const includedScreenIds = new Set(orderedScreens.map((state2) => state2.screenId));
       for (const state2 of orderedScreens) {
         const screenTypeLower = state2.screenType?.toLowerCase();
-        const groupName = screenTypeLower === "auth" ? "Authentication" : screenTypeLower === "onboarding" || screenTypeLower === "landing" || screenTypeLower === "splash" ? "Onboarding" : screenDisplayName(state2);
+        const groupName = screenTypeLower === "auth" ? "Authentication" : screenTypeLower === "onboarding" || screenTypeLower === "landing" || screenTypeLower === "splash" ? "Onboarding" : inferMobileFeatureGroupName([state2], appId);
         const group = groups.get(groupName) ?? {
           name: groupName,
+          canonicalKey: mobileFeatureCanonicalKey(groupName),
           description: `Native mobile screens related to ${groupName}.`,
           routes: [],
           criticality: state2.screenType?.toLowerCase() === "auth" ? "critical" : "medium",
@@ -66174,7 +66346,7 @@ ${constraints.join("\n")}`);
         const to = graph.screens.get(transition.toScreenId);
         if (!from || !to)
           continue;
-        const groupName = from.screenType?.toLowerCase() === "auth" ? "Authentication" : screenDisplayName(from);
+        const groupName = from.screenType?.toLowerCase() === "auth" ? "Authentication" : inferMobileFeatureGroupName([from], appId);
         const group = groups.get(groupName);
         if (!group)
           continue;
@@ -66198,7 +66370,7 @@ ${constraints.join("\n")}`);
       for (const state2 of orderedScreens) {
         if (scenarios.length >= budget)
           break;
-        const screenName = screenDisplayName(state2);
+        const screenName = nonGenericScreenName(state2, input.appId) ?? inferMobileFeatureGroupName([state2], input.appId);
         const baseName = `${screenName} - Screen Reachability`;
         const name = usedNames.has(baseName.toLowerCase()) ? `${baseName} ${state2.firstSeenIteration + 1}` : baseName;
         if (usedNames.has(name.toLowerCase()))
@@ -66206,7 +66378,7 @@ ${constraints.join("\n")}`);
         usedNames.add(name.toLowerCase());
         const actionableLabels = state2.elements.filter((el) => el.actionable).map((el) => el.label?.trim() || el.text?.trim() || el.accessibilityId || shortResourceId(el.resourceId ?? "") || compactRole(el.role)).filter((label) => Boolean(label)).slice(0, 3);
         const steps = [
-          { action: "Relaunch the app from a clean state", target: entryScreenId },
+          { action: "Launch the app and start from the current launch entry", target: entryScreenId },
           {
             action: state2.screenId === entryScreenId ? `Verify the launch screen is ${screenName}` : `Navigate through the app until the ${screenName} screen is visible`,
             target: state2.screenId
@@ -66257,16 +66429,27 @@ ${constraints.join("\n")}`);
       }
       return filtered;
     }
-    function filterFeatureGroupsToSiteMap(groups, siteMap) {
+    function filterFeatureGroupsToSiteMap(groups, siteMap, graph, appId) {
       if (groups.length === 0)
         return [];
       const validRoutes = new Set(siteMap.pages.map((page) => page.route));
+      const usedNames = /* @__PURE__ */ new Map();
       return groups.flatMap((group) => {
         const routes = group.routes.filter((route2) => validRoutes.has(route2));
         if (routes.length === 0)
           return [];
+        const routeStates = routes.map((route2) => graph?.screens.get(route2)).filter((state2) => Boolean(state2));
+        const rawName = group.name?.trim() || "";
+        const inferredName = rawName && !isOpaqueMobileScreenName(rawName, appId) ? rawName : inferMobileFeatureGroupName(routeStates, appId);
+        const count = usedNames.get(inferredName) ?? 0;
+        usedNames.set(inferredName, count + 1);
+        const name = count === 0 ? inferredName : `${inferredName} ${count + 1}`;
+        const canonicalKey = group.canonicalKey?.trim() || mobileFeatureCanonicalKey(inferredName);
         return [{
           ...group,
+          name,
+          canonicalKey,
+          description: group.description?.trim() || `Native mobile screens related to ${name}.`,
           routes,
           pages: group.pages?.filter((page) => validRoutes.has(page.route))
         }];
@@ -66318,7 +66501,7 @@ ${constraints.join("\n")}`);
           incremental: input.incremental
         })
       });
-      const plannerFeatureGroups = filterFeatureGroupsToSiteMap(result.featureGroups, siteMap);
+      const plannerFeatureGroups = filterFeatureGroupsToSiteMap(result.featureGroups, siteMap, input.graph, input.appId);
       const mobileFeatureGroups = plannerFeatureGroups.length > 0 ? plannerFeatureGroups : buildMobileFeatureGroupsFromGraph(input.graph, input.appId);
       if (input.mode !== "survey" && result.scenarios.length === 0 && input.graph.screens.size > 0) {
         const fallbackScenarios = buildMobileFallbackScenarios(input);
@@ -66565,7 +66748,15 @@ var require_mobile_generator = __commonJS({
       return { screen, signal, refMap, observation };
     }
     function labelForElement(element) {
-      return nonEmpty2(element.label) ?? nonEmpty2(element.accessibilityId) ?? nonEmpty2(element.resourceId) ?? nonEmpty2(element.text) ?? "element";
+      const editable = isEditableMobileElement(element);
+      const label = nonEmpty2(element.label);
+      const text = nonEmpty2(element.text);
+      const labelIsEditableValue = editable && label !== void 0 && text !== void 0 && label === text;
+      return (labelIsEditableValue ? void 0 : label) ?? nonEmpty2(element.accessibilityId) ?? nonEmpty2(element.resourceId) ?? (editable ? void 0 : text) ?? "element";
+    }
+    var EDITABLE_ELEMENT_ROLE_RE = /(EditText|AutoCompleteTextView|XCUIElementTypeTextField|XCUIElementTypeSecureTextField|XCUIElementTypeSearchField|XCUIElementTypeTextView)$/;
+    function isEditableMobileElement(element) {
+      return EDITABLE_ELEMENT_ROLE_RE.test(element.role.trim());
     }
     function nonEmpty2(value) {
       if (typeof value !== "string")
@@ -66597,17 +66788,21 @@ var require_mobile_generator = __commonJS({
 ## Your job
 1. mobile_snapshot the current screen.
 2. Execute the scenario's steps using the real UI: tap buttons, fill fields (mobile_type), submit, navigate.
-3. When you reach the target screen / complete the flow, PROVE the outcome with an assert tool:
+3. COMPLETE THE ACTION the scenario is about \u2014 do not stop half-way. If the scenario submits a form (sign in, sign up, search, create), you MUST tap the submit/primary button; filling fields is NOT the behavior under test. If it navigates, you MUST land on the destination. A "happy path" that fills a login form but never taps "Sign In" is WRONG.
+4. When you reach the target screen / complete the flow, PROVE the outcome with an assert tool:
    - mobile_assert_visible({ref}) \u2014 the target screen's stable element is on screen.
    - mobile_assert_text({ref, expected}) \u2014 an element contains expected text (only durable when the element has a stable accessibility-id / resource-id).
-4. Call finish_generate with verified:true ONLY if you asserted the outcome with an assert tool.
+   - Assert the REAL post-action outcome: after a sign-in, assert a signed-in signal (dashboard/feed content, account tab, "Sign out"); after an invalid submit, assert the error message; after navigation, assert an element unique to the destination screen. Do NOT assert an opaque internal id ("step-1", "step-2") as the outcome \u2014 pick a human-meaningful element.
+5. Call finish_generate with verified:true ONLY if you asserted the outcome with an assert tool.
 
 ## Rules
 - Re-snapshot before every assertion so the ref is fresh.
 - Assert the OUTCOME of the flow (the new screen / new content), not the control you just tapped.
-- Assert only DURABLE elements \u2014 screen chrome that exists on every visit (tab labels, headers, nav bars, the entity you just created). NEVER assert one-time / data-dependent UI: empty-state CTAs ("Add Your First \u2026", "Get Started", "No items yet"), onboarding banners, or counters \u2014 they vanish as soon as the account has data, and the test then fails forever on a healthy app.
+- Assert only DURABLE elements \u2014 screen chrome that exists on every visit (tab labels, headers, nav bars, the entity you just created). NEVER assert one-time / data-dependent UI: empty-state CTAs, first-run or onboarding prompts, or counters \u2014 they vanish as soon as the account has data, and the test then fails forever on a healthy app.
 - Do NOT trigger irreversible side effects (real payments, sending messages to others) \u2014 note them and assert what you safely can.
 - Stay inside this app.${targetLine} Do not open or use app stores, browsers, email apps, settings, or any other app. If an action leaves the target app, the runner will relaunch the target app and reject that action.
+- NEVER tap the phone's home screen / launcher (app icons, "Predicted app" chips, search bars, widgets). Those are NOT part of the app under test \u2014 tapping them is junk that poisons the test. If the app ever backgrounds or you find yourself on the launcher, use mobile_relaunch to cold-start the app; do NOT tap a launcher icon or app-prediction to get back in.
+- Do NOT re-do a sequence you already completed. If you filled a form then navigated away, do NOT come back and fill it again \u2014 the scenario needs ONE clean pass. Filling the login form, going back, and re-filling it is exactly the kind of wandering that produces a bloated, broken test.
 - Do ONLY the actions this scenario needs. Do NOT re-open a menu you already opened, re-select an option that is already selected, toggle a setting back and forth, or repeat a step that already succeeded \u2014 EVERY action you take is baked into the generated test verbatim, so each extra action becomes a permanent junk step.
 - Each action must make NEW progress toward the goal. If an action leaves the screen unchanged, do NOT repeat it \u2014 pick a different element or move on.
 - Finish promptly once the outcome is proven: the instant the expected outcome is visible, assert it and call finish_generate. Do not keep exploring after the goal is proven.
@@ -67175,6 +67370,13 @@ ${statePacket}` },
       const { resolveRef, screenName, platform: platform3, recordAction } = ctx;
       const element = resolveRef(toolArgs.ref);
       if (element) {
+        const weakReason = weakAssertionTargetReason(element);
+        if (weakReason) {
+          return {
+            ok: false,
+            error: `Ref ${element.ref} is not a durable assertion target (${weakReason}). Re-snapshot and assert a human-visible label, text, or stable control that proves the screen outcome.`
+          };
+        }
         const metadata = metadataForElement(element, screenName(), platform3);
         recordAction({ type: "ASSERT_VISIBLE", selector: (0, mobile_source_parser_js_2.preferredLocator)(element), metadata });
         return { ok: true, label: metadata.targetLabel ?? "element" };
@@ -67184,6 +67386,13 @@ ${statePacket}` },
       if (!accessibilityId && !text) {
         return { ok: false, error: "mobile_assert_visible needs a ref (preferred), accessibilityId, or text." };
       }
+      const directTarget = accessibilityId ?? text;
+      if (directTarget && isStructuralAssertionIdentity(directTarget)) {
+        return {
+          ok: false,
+          error: `"${directTarget}" looks like a structural/internal container id, not a user-visible outcome. Assert a visible label, message, or stable product control instead.`
+        };
+      }
       const screen = screenName();
       if (accessibilityId) {
         const bundle2 = { xpath: `//*[@content-desc=${xpathLiteral2(accessibilityId)} or @name=${xpathLiteral2(accessibilityId)}]`, className: "", accessibilityId };
@@ -67207,7 +67416,7 @@ ${statePacket}` },
       if (!snapshot || snapshot.screen.elements.length === 0)
         return null;
       const elements = snapshot.screen.elements;
-      const stableAnchors = elements.filter((el) => hasStableId(el) && !isAlwaysPresentContainer(el));
+      const stableAnchors = elements.filter((el) => hasStableId(el) && !weakAssertionTargetReason(el));
       stableAnchors.sort((a, b) => {
         const labelled2 = (el) => nonEmpty2(el.text) || nonEmpty2(el.label) ? 0 : 1;
         return labelled2(a) - labelled2(b);
@@ -67220,8 +67429,8 @@ ${statePacket}` },
         return nonButton;
       if (stableAnchors.length > 0)
         return stableAnchors[0];
-      const labelled = elements.find((el) => !isAlwaysPresentContainer(el) && (nonEmpty2(el.label) || nonEmpty2(el.text)));
-      return labelled ?? elements.find((el) => !isAlwaysPresentContainer(el)) ?? elements[0];
+      const labelled = elements.find((el) => !weakAssertionTargetReason(el) && (nonEmpty2(el.label) || nonEmpty2(el.text)));
+      return labelled ?? elements.find((el) => !weakAssertionTargetReason(el)) ?? null;
     }
     var ALWAYS_PRESENT_CONTAINER_ROLES = /^(XCUIElementTypeApplication|XCUIElementTypeWindow)$/;
     var ALWAYS_PRESENT_CONTAINER_ID_NAMES = /* @__PURE__ */ new Set([
@@ -67233,9 +67442,9 @@ ${statePacket}` },
       "navigationBarBackground",
       // WebView hybrid apps (React/Vue/etc. rendered inside android.webkit.WebView)
       // expose their framework ROOT container's DOM id as the element id — present on
-      // EVERY in-app screen, so the floor must not anchor to it (observed live on
-      // ThoughtStream: `main-content` produced a screen-agnostic assertion that then
-      // never matched via the text-contains fallback).
+      // EVERY in-app screen, so the floor must not anchor to it (observed live: a
+      // framework root id like `main-content` produced a screen-agnostic assertion
+      // that then never matched via the text-contains fallback).
       "main-content",
       "root",
       "app",
@@ -67244,18 +67453,53 @@ ${statePacket}` },
       "react-root",
       "application"
     ]);
+    var STRUCTURAL_ASSERT_ID_RE = /^(?:step[-_]\d+|(?:auth|form|wizard)[-_]?step(?:[-_]\d+)?|(?:main[-_]?content|root|app[-_]?root|__next|react[-_]?root|application|content|container|wrapper|webview|layout|view|screen|page)(?:[-_]\d+)?)$/i;
+    function locatorLocalName(value) {
+      const trimmed = value.trim();
+      const withoutStrategy = trimmed.startsWith("id=") ? trimmed.slice(3) : trimmed.startsWith("~") ? trimmed.slice(1) : trimmed;
+      const slashIdx = withoutStrategy.indexOf("/");
+      return slashIdx >= 0 ? withoutStrategy.slice(slashIdx + 1) : withoutStrategy;
+    }
+    function isStructuralAssertionIdentity(value) {
+      const trimmed = nonEmpty2(value);
+      if (!trimmed)
+        return false;
+      const localName = locatorLocalName(trimmed);
+      return ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(localName) || STRUCTURAL_ASSERT_ID_RE.test(localName);
+    }
+    function hasHumanAssertionSignal(element) {
+      const label = nonEmpty2(element.label);
+      const text = nonEmpty2(element.text);
+      const accessibilityId = nonEmpty2(element.accessibilityId);
+      return Boolean(label && !isStructuralAssertionIdentity(label) || text && !isEditableMobileElement(element) && !isStructuralAssertionIdentity(text) || accessibilityId && !isStructuralAssertionIdentity(accessibilityId));
+    }
+    function weakAssertionTargetReason(element) {
+      if (isAlwaysPresentContainer(element))
+        return "always-present app/system container";
+      const structuralIdentity = [
+        element.accessibilityId,
+        element.resourceId,
+        element.label,
+        element.text
+      ].some(isStructuralAssertionIdentity);
+      const containerishClass = BARE_CONTAINER_CLASS_RE.test(element.role);
+      const humanSignal = hasHumanAssertionSignal(element);
+      if (structuralIdentity && (containerishClass || !humanSignal))
+        return "structural/internal container id";
+      if (containerishClass && !humanSignal)
+        return "generic container with no visible product signal";
+      return null;
+    }
     function isAlwaysPresentContainer(element) {
       if (ALWAYS_PRESENT_CONTAINER_ROLES.test(element.role))
         return true;
       const resourceId = element.resourceId?.trim();
       if (resourceId) {
-        const slashIdx = resourceId.indexOf("/");
-        const localName = slashIdx >= 0 ? resourceId.slice(slashIdx + 1) : resourceId;
-        if (ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(localName))
+        if (ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(locatorLocalName(resourceId)))
           return true;
       }
       const accessibilityId = element.accessibilityId?.trim();
-      if (accessibilityId && ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(accessibilityId))
+      if (accessibilityId && ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(locatorLocalName(accessibilityId)))
         return true;
       return false;
     }
@@ -67270,7 +67514,7 @@ ${statePacket}` },
       if (hasIdentity)
         return false;
       const resourceId = bundle.resourceId?.trim() ?? "";
-      const localName = resourceId.includes("/") ? resourceId.slice(resourceId.indexOf("/") + 1) : resourceId;
+      const localName = locatorLocalName(resourceId);
       const containerishId = localName !== "" && (localName === "webview" || ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(localName));
       const containerishClass = BARE_CONTAINER_CLASS_RE.test(bundle.className ?? "");
       if (containerishId)
@@ -67312,6 +67556,22 @@ ${statePacket}` },
             break;
           }
         }
+        for (let window2 = Math.min(MAX_RETRY_CYCLE_LENGTH, Math.floor((out.length - 1) / 2)); window2 >= 2 && !changed; window2--) {
+          for (let i = 0; i + 2 * window2 + 1 <= out.length; i++) {
+            const first = out.slice(i, i + window2);
+            if (first.some((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT"))
+              continue;
+            const back = out[i + window2];
+            if (back.type !== "BACK")
+              continue;
+            const second = out.slice(i + window2 + 1, i + window2 + 1 + window2);
+            if (!first.every((a, k) => actionCycleKey(a) === actionCycleKey(second[k])))
+              continue;
+            out.splice(i, window2 + 1);
+            changed = true;
+            break;
+          }
+        }
       }
       return out;
     }
@@ -67348,6 +67608,10 @@ ${statePacket}` },
         log2(`  compile failed: ${err instanceof Error ? err.message : String(err)}`);
         return null;
       }
+      const selectorQuality = (0, shared_1.analyzeMobileSelectorQuality)(compiled.steps);
+      if (selectorQuality.summary.high > 0 || selectorQuality.summary.medium > 0) {
+        log2(`  selector quality: score ${selectorQuality.summary.score}/100 (${selectorQuality.summary.high} high, ${selectorQuality.summary.medium} medium issue(s)).`);
+      }
       const claimedVerified = recording.finish?.verified ?? false;
       const verified = claimedVerified && recording.assertCount > 0;
       if (claimedVerified && !verified) {
@@ -67389,6 +67653,7 @@ ${statePacket}` },
             targetPages: [...scenario.targetPages]
           },
           evidence: { observedLocators: [], observedTransitions: [] },
+          mobileSelectorQuality: selectorQuality,
           // Assertion-strength marker for the server promote-seam
           // (resolveStabilityTransition): an UNVERIFIED recording proves none of the
           // scenario's outcomes — only the hybrid floor's landing-screen visibility —
@@ -67413,6 +67678,25 @@ ${statePacket}` },
       };
       return test;
     }
+    async function prepareMobileScenarioAppState(driver, target, log2) {
+      const resetPolicy = target?.resetPolicy ?? "AUTO";
+      if (resetPolicy === "PRESERVE_APP_DATA") {
+        await driver.relaunch();
+        log2("  app data reset skipped by policy \u2014 scenario records after relaunch with preserved data.");
+        return false;
+      }
+      const appDataCleared = await driver.resetAppState?.().catch((err) => {
+        log2(`  app-data reset failed: ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+      }) ?? false;
+      if (appDataCleared)
+        return true;
+      if (resetPolicy === "CLEAR_APP_DATA") {
+        log2("  CLEAR_APP_DATA requested but app-data reset was unavailable; falling back to relaunch.");
+      }
+      await driver.relaunch();
+      return false;
+    }
     async function runMobileGeneratePhase(args) {
       const { scenarios: allScenarios, driver, ctx, config, onLog, onAICall, onTestGenerated, onScreenshot, skipScenarioNames, onInfraStop } = args;
       const log2 = (line) => {
@@ -67445,11 +67729,9 @@ ${statePacket}` },
         log2(`
 -- Generating scenario ${i + 1}/${scenarios.length}: "${scenario.name}" --`);
         try {
-          const appDataCleared = await driver.resetAppState?.().catch(() => false) ?? false;
+          const appDataCleared = await prepareMobileScenarioAppState(driver, ctx.target, log2);
           if (appDataCleared) {
             log2("  app data cleared \u2014 scenario records from a deterministic cold (logged-out) state.");
-          } else {
-            await driver.relaunch();
           }
           const recording = await runScenarioLoop({
             scenario,
@@ -68000,8 +68282,8 @@ Reason over steps + error + tree + registry and return working healed steps. Do
 1. ERROR: which step failed, on what locator/assertion? "element not found"/"no such element" almost always means a WRONG LOCATOR on a screen that DOES exist \u2014 pick a stronger IDENTITY locator that is actually present in the captured tree: a resource-id, an accessibility-id/content-desc, or an EXACT @text= predicate (never a loose contains()). Do NOT declare a feature absent from one failed locator.
 2. STEP RESULTS: which steps passed before the failure.
 3. TREE: does the current screen match what the failed step expects?
-3b. STALE EMPTY-STATE ASSERT: a failing assert on one-time / data-dependent UI (empty-state CTAs like "Add Your First \u2026", "No items yet", onboarding banners) is NOT a locator problem \u2014 the element is gone because the account now has data. REPLACE the assertion with a durable landing-screen anchor (tab label, header, nav bar) that proves the same outcome (verdict fix).
-4. ENTRY-SCREEN DRIFT ("unexpected screen"/"screen drift"): the app started on a DIFFERENT screen than recorded; the fix is usually a MISSING NAVIGATION step (e.g. tap "Get Started" before the recorded first step). Author it from the tree if you can (verdict fix); if a single static tree is insufficient, return needs_device.
+3b. STALE EMPTY-STATE ASSERT: a failing assert on one-time / data-dependent UI (empty-state CTAs, first-run prompts, onboarding banners) is NOT a locator problem \u2014 the element is gone because the account now has data. REPLACE the assertion with a durable landing-screen anchor (tab label, header, nav bar) that proves the same outcome (verdict fix).
+4. ENTRY-SCREEN DRIFT ("unexpected screen"/"screen drift"): the app started on a DIFFERENT screen than recorded; the fix is usually a MISSING NAVIGATION step (e.g. tap the onboarding/welcome CTA present in the tree before the recorded first step). Author it from the tree if you can (verdict fix); if a single static tree is insufficient, return needs_device.
 ## Response \u2014 STRICT JSON, exactly one verdict:
 {"verdict":"fix","steps":[<FULL healed MobileTestStep array, all steps, your changes applied, order/metadata preserved>],"reason":"what changed and why","confidence":0.0-1.0}
 {"verdict":"app_bug","reason":"app crashed/blank/5xx (NOT rate-limit)"}
@@ -68504,16 +68786,16 @@ ${args.directive}`);
     var DEFAULT_PHASE2_MAX_PASSES = 6;
     exports.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = `You are a QA engineer fixing a failing Appium (mobile UI automation) test with LIVE device access (Phase 2). You receive: the failing test STEPS as JSON, the PRIOR failure error, and the LIVE current screen accessibility tree observed on-device RIGHT NOW. Unlike a frozen failure snapshot, this LIVE tree is the REAL screen the app is on this instant.
 ## Key insight \u2014 ENTRY-SCREEN DRIFT
-The recorded flow may have expected a DIFFERENT starting screen than the one shown. When the LIVE screen is an earlier/other screen (e.g. an onboarding or "Get Started" screen), the fix is almost always a MISSING NAVIGATION step: AUTHOR the leading step(s) (e.g. a tap on "Get Started") that reach the recorded first screen, then keep the recorded steps. This is exactly what a static failing-source cannot reveal but a LIVE screen can.
+The recorded flow may have expected a DIFFERENT starting screen than the one shown. When the LIVE screen is an earlier/other screen (e.g. an onboarding / welcome / splash screen), the fix is almost always a MISSING NAVIGATION step: AUTHOR the leading step(s) (e.g. a tap on the onboarding CTA present in the tree) that reach the recorded first screen, then keep the recorded steps. This is exactly what a static failing-source cannot reveal but a LIVE screen can.
 ## Analyze
 1. Compare the recorded first step's expected screen to the LIVE tree.
 2. If they differ, PREPEND the missing navigation step(s), authored from IDENTITY locators (resource-id, accessibility-id, or EXACT @text=) that are PRESENT in the LIVE tree \u2014 never a loose contains().
 3. If a locator is simply wrong, swap it for a stronger identity locator present in the LIVE tree.
-3b. If the failing step ASSERTS one-time / data-dependent UI (an empty-state CTA like "Add Your First \u2026") that is absent from the LIVE tree while the screen is otherwise correct, the assert is STALE \u2014 replace it with a durable element of the same screen (tab label, header, nav bar) and keep the rest.
+3b. If the failing step ASSERTS one-time / data-dependent UI (an empty-state CTA or first-run prompt) that is absent from the LIVE tree while the screen is otherwise correct, the assert is STALE \u2014 replace it with a durable element of the same screen (tab label, header, nav bar) and keep the rest.
 4. If you cannot yet SEE the screen you need, use "observe" to advance ONE step, then you will be re-shown the new live screen.
 ## Response \u2014 STRICT JSON, exactly one verdict:
 {"verdict":"fix","steps":[<FULL healed MobileTestStep array, all steps incl. any prepended navigation, order/metadata coherent>],"reason":"what changed and why","confidence":0.0-1.0}
-{"verdict":"observe","action":{"type":"tap","target":"mobile.text('Get Started')"}}
+{"verdict":"observe","action":{"type":"tap","target":"mobile.text('<exact label visible in the live tree>')"}}
 {"verdict":"observe","action":{"type":"back"}}
 {"verdict":"observe","action":{"type":"relaunch"}}
 {"verdict":"observe","action":{"type":"reset"}}   \u2190 clears app data + cold-relaunches: use when the app is in the WRONG STATE for the recorded flow (e.g. signed in when the test expects the cleared first-launch screens, stale onboarding, poisoned local state)
@@ -73652,6 +73934,7 @@ var require_auth_recipe = __commonJS({
     exports.computeRecipeHash = computeRecipeHash;
     exports.buildAuthRecipe = buildAuthRecipe;
     exports.authProofLocator = authProofLocator;
+    exports.urlProofPredicateExpr = urlProofPredicateExpr;
     exports.renderAuthProofAssertion = renderAuthProofAssertion;
     exports.renderAuthFn = renderAuthFn;
     exports.absoluteRoute = absoluteRoute;
@@ -73706,6 +73989,9 @@ var require_auth_recipe = __commonJS({
       };
     }
     function authProofLocator(proof) {
+      if (proof.kind === "url") {
+        throw new Error("authProofLocator: url proof has no element locator; callers must branch on proof.kind");
+      }
       if (proof.kind === "testid") {
         return `page.getByTestId(${JSON.stringify(proof.testId)})`;
       }
@@ -73714,7 +74000,14 @@ var require_auth_recipe = __commonJS({
       }
       return `page.getByRole(${JSON.stringify(proof.role)}).first()`;
     }
+    function urlProofPredicateExpr(route2) {
+      const r = JSON.stringify(route2);
+      return `(u) => u.pathname === ${r} || u.pathname.startsWith(${r} + '/')`;
+    }
     function renderAuthProofAssertion(proof) {
+      if (proof.kind === "url") {
+        return `await page.waitForURL(${urlProofPredicateExpr(proof.route)}, { timeout: 15000 });`;
+      }
       return `await expect(${authProofLocator(proof)}).toBeVisible({ timeout: 15000 });`;
     }
     function normalizeCmd(cmd) {
@@ -73728,9 +74021,16 @@ var require_auth_recipe = __commonJS({
       lines.push(START_MARKER);
       lines.push(`async function __vqaLogin(page) {`);
       if (opts?.warmGuard) {
-        const warmLanding = recipe.redirectRoute ?? recipe.preNavRoute;
+        const warmLanding = recipe.redirectRoute ?? (recipe.authProof.kind === "url" ? recipe.authProof.route : recipe.preNavRoute);
+        const loginRoute = recipe.route ?? recipe.preNavRoute;
         lines.push(`  await page.goto(${JSON.stringify(warmLanding)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
-        lines.push(`  if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
+        if (recipe.authProof.kind === "url") {
+          lines.push(`  if ((${urlProofPredicateExpr(recipe.authProof.route)})(new URL(page.url()))) return;`);
+        } else if (loginRoute) {
+          lines.push(`  if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
+        } else {
+          lines.push(`  if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
+        }
       }
       lines.push(`  await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' });`);
       for (const cmd of recipe.preNavCmds)
@@ -73779,6 +74079,11 @@ var require_auth_recipe = __commonJS({
 }`;
     }
     function renderReplaySettleArrow(proof) {
+      if (proof.kind === "url") {
+        return `async (page) => {
+  await page.waitForURL(${urlProofPredicateExpr(proof.route)}, { timeout: 15000 });
+}`;
+      }
       return `async (page) => {
   await ${authProofLocator(proof)}.waitFor({ state: 'visible', timeout: 15000 });
 }`;
@@ -307869,7 +308174,7 @@ ${keyLines || "- (none provided)"}
 3. If the email/password fields are hidden behind a reveal button (e.g. "Sign in with Email", "Continue with Email"), click it first.
 4. Fill the credentials with \`fill_credential\` \u2014 ONE call per field (email first, then password), referencing the credential KEYS above. Never type real values with browser_type. (PREFER per-field \`fill_credential\`; \`fill_credential_form\` is less reliable and a misfire wastes a scarce iteration.)
 5. Submit the login form.
-6. Confirm you are authenticated WITHOUT opening any menu or dropdown: wait until you are signed in \u2014 this may be a REDIRECT to a new route, OR an in-place change on the SAME route (a login modal closing, the page swapping to authenticated content). Then take a \`browser_snapshot\`. The signed-in signal MUST be visible by DEFAULT on the resulting page \u2014 do NOT click an avatar / hamburger / account menu to hunt for a hidden "Logout" link, because the generated test asserts this proof WITHOUT opening any menu, so a menu-hidden control would fail. Any default-visible signal works: a Logout / Sign out control that is already shown, an account / avatar button, a persistent authenticated nav or sidebar item, or a stable post-login heading.
+6. Confirm you are authenticated WITHOUT opening any menu or dropdown: wait until you are signed in \u2014 this may be a REDIRECT to a new route, OR an in-place change on the SAME route (a login modal closing, the page swapping to authenticated content). Then take a \`browser_snapshot\`. The signed-in signal MUST be visible by DEFAULT on the resulting page \u2014 do NOT click an avatar / hamburger / account menu to hunt for a hidden "Logout" link, because the generated test asserts this proof WITHOUT opening any menu, so a menu-hidden control would fail. PREFER a default-visible signal with a STABLE, identity-invariant label: a Logout / Sign out control that is already shown, a persistent authenticated nav or sidebar item (e.g. a Dashboard / Settings link), or a stable post-login heading. An avatar / account button whose ONLY label is the signed-in user's initials or name (e.g. "QT", "JS") is a WEAK signal \u2014 it changes per user/session, so do NOT rely on it; if that is the only signed-in signal on the page, still capture the page and finish (the system falls back to a durable route-based proof automatically).
 7. Call \`capture_page\` for the login route ONCE (so its successful proven commands are saved), then call \`capture_page\` for the authenticated landing page IN ITS DEFAULT STATE (do not open any menu first) so the durable, default-visible auth-proof element is recorded.
 8. The MOMENT an authenticated page is visible, your TOP PRIORITY is to \`capture_page\` that authenticated landing (step 7) and then call \`finish_exploration\` \u2014 do this IMMEDIATELY, before anything else, because your iteration budget is tight. Do NOT take extra browser_snapshots, do NOT explore features, do NOT click around the authenticated app, do NOT test validation or wrong-password flows. Capturing the authed landing + finishing is the whole job.
 
@@ -307929,7 +308234,11 @@ ${keyLines || "- (none provided)"}
         if (el.testId)
           testIdFreq.set(el.testId, (testIdFreq.get(el.testId) ?? 0) + 1);
       }
-      const isPersonalized = (name) => !name || GREETING_RE.test(name) || name.includes("@") || findCredentialLiteralLeaks(name, credentials).length > 0;
+      const isInitialsLike = (name) => {
+        const t = name.trim();
+        return /^[A-Za-z]{1,3}$/.test(t) && t === t.toUpperCase();
+      };
+      const isPersonalized = (name) => !name || GREETING_RE.test(name) || name.includes("@") || findCredentialLiteralLeaks(name, credentials).length > 0 || isInitialsLike(name);
       const absentOnLogin = (roleNameKey, testId) => {
         if (testId && loginTestIds.has(testId))
           return false;
@@ -307964,7 +308273,12 @@ ${keyLines || "- (none provided)"}
         }
       }
       if (ranked.length === 0) {
-        logs2("  \u26A0 auth-proof: no durable, login-absent signed-in element found on the authenticated landing page \u2014 falling back to model-authored login (no blind navigation default)");
+        const urlRoute = redirectRoute && redirectRoute !== "/" && !isLoginPage(redirectRoute) ? redirectRoute : landing.route !== "/" && !isLoginPage(landing.route) ? landing.route : null;
+        if (urlRoute) {
+          logs2(`  \u2713 url auth-proof: authenticated landing route ${urlRoute} (no durable element proof on the default-state page)`);
+          return { kind: "url", route: urlRoute };
+        }
+        logs2("  \u26A0 auth-proof: no durable element proof and no concrete authed landing route \u2014 falling back to model-authored login (no blind navigation default)");
         return null;
       }
       ranked.sort((a, b) => a.tier - b.tier);
@@ -308115,7 +308429,7 @@ ${keyLines || "- (none provided)"}
           logs2("  \u26A0 auth unverified (live-verify replay failed \u2014 fleet-config drift) \u2014 falling back to model-authored login");
           return null;
         }
-        const proofDesc = authProof.kind === "role" ? `role:${authProof.role}${authProof.name ? `(${authProof.name})` : ""}` : `testid:${authProof.testId}`;
+        const proofDesc = authProof.kind === "role" ? `role:${authProof.role}${authProof.name ? `(${authProof.name})` : ""}` : authProof.kind === "testid" ? `testid:${authProof.testId}` : `url:${authProof.route}`;
         logs2(`  \u2713 auth recipe verified (hash ${candidate.recipeHash}, proof ${proofDesc}, ${(candidate.replayPlan ?? []).length} replay steps) \u2014 stamping into @needs-auth tests`);
         return candidate;
       } catch (err) {
@@ -314808,13 +315122,13 @@ var require_mobile_discovery_agent = __commonJS({
             exploreStats: { pagesDiscovered: 0, pagesVisited: 0, elementsFound: 0, transitionsFound: 0 },
             duration: duration2,
             mode,
-            ...paused ? { paused: true, pauseReason, remainingScenarios } : {}
+            ...paused ? { paused: true, pauseReason, pausePhase: "generate", remainingScenarios } : {}
             // apiCalls intentionally UNSET — CHUNK K (runner.ts) merges them.
           };
         }
         log2("\n\u2500\u2500 Phase 1: EXPLORE \u2500\u2500");
-        const exploreAppDataCleared = await driver.resetAppState?.().catch(() => false) ?? false;
-        log2(exploreAppDataCleared ? "App data cleared \u2014 exploring from a deterministic cold (logged-out) state." : "App data reset unavailable (platform/device policy) \u2014 exploring the app in its current state.");
+        const exploreAppDataCleared = await prepareMobileAppStateForDiscovery(driver, target, "explore", log2);
+        log2(exploreAppDataCleared ? "App data cleared \u2014 exploring from a deterministic cold (logged-out) state." : target?.resetPolicy === "PRESERVE_APP_DATA" ? "App data reset skipped by policy \u2014 exploring with preserved app data." : "App data reset unavailable (platform/device policy) \u2014 exploring the app in its current state.");
         const state2 = new mobile_exploration_state_js_1.MobileExplorationState();
         const maxIterations = getMobileExploreBudget(mode, ctx.incremental);
         const existingScreens = isSurvey && ctx.incremental ? compactExistingScreens(ctx.existingSiteMap) : void 0;
@@ -314849,6 +315163,32 @@ Explore complete: ${explore.exploreStats.pagesDiscovered} screens, ${explore.exp
             log2(`[stream] explore-complete callback failed: ${err instanceof Error ? err.message : String(err)}`);
           });
         }
+        if (!isSurvey && shouldPauseAfterTruncatedExplore(explore)) {
+          const duration2 = (Date.now() - startTime) / 1e3;
+          const pauseReason = explore.truncatedReason === "timeout" ? "ai_timeout" : "ai_rate_limit";
+          const summary2 = `Mobile discovery paused after exploration: mapped ${explore.exploreStats.pagesDiscovered} screen(s) before ${explore.truncatedReason ?? "AI"} interruption in ${duration2.toFixed(1)}s.`;
+          log2(summary2);
+          return {
+            collectedPages: explore.collectedPages,
+            collectedTransitions,
+            tests: [],
+            plans: [],
+            logs: logs2.join("\n"),
+            screenshots,
+            pageScreenshots: explore.pageScreenshots,
+            summary: summary2,
+            warning: mergeWarning(void 0, explore),
+            healthObservations: explore.healthObservations,
+            exploreTruncated: true,
+            exploreTruncatedReason: explore.truncatedReason,
+            exploreStats: explore.exploreStats,
+            duration: duration2,
+            mode,
+            paused: true,
+            pauseReason,
+            pausePhase: "explore"
+          };
+        }
         log2("\nRelaunching app for a clean state before planning/generation...");
         await driver.relaunch();
         log2("\n\u2500\u2500 Phase 2: PLAN \u2500\u2500");
@@ -315001,7 +315341,7 @@ Generation complete: ${tests.length} tests generated (${generateElapsed}s elapse
           // D-D4 — a circuit-breaker trip PAUSES the run (resumable) instead of
           // finalizing COMPLETED/FAILED. The server's isDiscoveryPaused reads these
           // (forwarded by runner.ts buildFinalBody, byte-identical to the web path).
-          ...generatePaused ? { paused: true, pauseReason: generatePauseReason, remainingScenarios: generateRemainingScenarios } : {}
+          ...generatePaused ? { paused: true, pauseReason: generatePauseReason, pausePhase: "generate", remainingScenarios: generateRemainingScenarios } : {}
           // apiCalls intentionally UNSET — CHUNK K (runner.ts) merges them.
         };
       } catch (fatalErr) {
@@ -315030,6 +315370,29 @@ Fatal error: ${msg}`);
         };
       }
     }
+    async function prepareMobileAppStateForDiscovery(driver, target, phase, log2) {
+      void phase;
+      const resetPolicy = target?.resetPolicy ?? "AUTO";
+      if (resetPolicy === "PRESERVE_APP_DATA") {
+        try {
+          await driver.relaunch();
+        } catch (err) {
+          log2(`App relaunch failed while preserving app data: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return false;
+      }
+      const cleared = await driver.resetAppState?.().catch((err) => {
+        log2(`App-data reset failed: ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+      }) ?? false;
+      if (!cleared && resetPolicy === "CLEAR_APP_DATA") {
+        log2("CLEAR_APP_DATA requested but app-data reset was unavailable; continuing without clearing app data.");
+      }
+      return cleared;
+    }
+    function shouldPauseAfterTruncatedExplore(explore) {
+      return explore.truncated === true && (explore.truncatedReason === "rate_limit" || explore.truncatedReason === "timeout");
+    }
     function mergeWarning(plannerWarning, explore) {
       if (!explore.truncated)
         return plannerWarning;
@@ -329531,7 +329894,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.28",
+      version: "1.0.30",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -330673,6 +331036,15 @@ var MitmProxy = class {
     }
     return this.tlsFailureReason;
   }
+  get passthroughCount() {
+    return this.tlsPassthroughCount;
+  }
+  get capturedCallCounts() {
+    return {
+      callCount: this.calls.length,
+      apiCallCount: this.calls.filter((call) => (0, import_runner_core7.isApiCall)(call.url, call.responseContentType)).length
+    };
+  }
   async close() {
     const server3 = this.server;
     this.server = null;
@@ -331259,6 +331631,35 @@ async function startMobileNetworkCapture(options) {
     const reason = proxy.interceptionReason ?? wiringReason;
     return reason ? { intercepting: false, reason } : { intercepting: false };
   };
+  const health = () => {
+    const capabilities = getCapabilities();
+    const counts = stopped ? {
+      callCount: finalCalls.length,
+      apiCallCount: finalCalls.filter((call) => call.isApi).length
+    } : proxy.capturedCallCounts;
+    const warnings = [];
+    if (!capabilities.intercepting && capabilities.reason) {
+      warnings.push(capabilities.reason);
+    }
+    if (stopped && counts.callCount === 0) {
+      warnings.push("No mobile network calls were captured. The app may not have generated traffic, the device proxy may be blocked, or the app may bypass system proxy settings.");
+    }
+    return {
+      enabled: true,
+      active: !stopped,
+      platform: platform3,
+      deviceId,
+      appId: options.appId,
+      proxyHost,
+      proxyPort,
+      intercepting: capabilities.intercepting,
+      ...capabilities.reason ? { reason: capabilities.reason } : {},
+      callCount: counts.callCount,
+      apiCallCount: counts.apiCallCount,
+      tlsPassthroughCount: proxy.passthroughCount,
+      warnings
+    };
+  };
   const stop = async () => {
     if (stopped) return finalCalls;
     stopped = true;
@@ -331297,6 +331698,7 @@ async function startMobileNetworkCapture(options) {
     proxyHost,
     caCertPath: capturedCaCertPath,
     getCapabilities,
+    health,
     stop
   };
 }
@@ -331777,6 +332179,32 @@ function readStepTimeout(step) {
   }
   return void 0;
 }
+async function revealLikelyOffscreenElement(sessionId) {
+  const windowSize = await getWindowSize2(sessionId);
+  const { startX, startY, endX, endY } = computeMobileSwipePointers(
+    windowSize.width,
+    windowSize.height,
+    "up",
+    clampMobileSwipeDistance(void 0)
+  );
+  await wdRequest(`/session/${sessionId}/actions`, {
+    method: "POST",
+    body: JSON.stringify({
+      actions: [{
+        type: "pointer",
+        id: "finger-reveal",
+        parameters: { pointerType: "touch" },
+        actions: [
+          { type: "pointerMove", duration: 0, x: startX, y: startY },
+          { type: "pointerDown", button: 0 },
+          { type: "pointerMove", duration: 300, x: endX, y: endY },
+          { type: "pointerUp", button: 0 }
+        ]
+      }]
+    })
+  });
+  await new Promise((resolve) => setTimeout(resolve, 250));
+}
 async function findElement(sessionId, target, timeoutMs = DEFAULT_STEP_TIMEOUT_MS, opts) {
   const strategies = opts?.identityOnly ? buildIdentityLocatorStrategies(target, opts?.platform) : buildLocatorStrategies(target, opts?.platform);
   if (strategies.length === 0) {
@@ -331786,6 +332214,7 @@ async function findElement(sessionId, target, timeoutMs = DEFAULT_STEP_TIMEOUT_M
   }
   const startTime = Date.now();
   let lastError = "";
+  let revealAttempted = false;
   while (Date.now() - startTime < timeoutMs) {
     for (const strategy of strategies) {
       try {
@@ -331800,9 +332229,18 @@ async function findElement(sessionId, target, timeoutMs = DEFAULT_STEP_TIMEOUT_M
         lastError = err instanceof Error ? err.message : String(err);
       }
     }
+    if (!opts?.identityOnly && !revealAttempted && Date.now() - startTime > Math.min(1500, timeoutMs / 3)) {
+      revealAttempted = true;
+      try {
+        await revealLikelyOffscreenElement(sessionId);
+      } catch (err) {
+        if (isTransportError(err)) throw err;
+        lastError = `reveal scroll failed: ${err instanceof Error ? err.message : String(err)}`;
+      }
+    }
     await new Promise((resolve) => setTimeout(resolve, 500));
   }
-  throw new Error(`Element not found after ${timeoutMs}ms. Tried ${strategies.length} strategies. Last error: ${lastError}`);
+  throw new Error(`Element not found after ${timeoutMs}ms. Tried ${strategies.length} strategies${revealAttempted ? " plus one reveal scroll" : ""}. Last error: ${lastError}`);
 }
 async function tapCoordinates(sessionId, bounds) {
   const tapX = Math.round(bounds.x + bounds.width / 2);
@@ -332226,21 +332664,29 @@ async function executeMobileTest(options) {
     recordingStarted = await startScreenRecording(sessionId, options.target.platform, log2);
     const launchStepForReset = runSteps.find((s) => s.action === "launchApp");
     const recordedFromClearedState = launchStepForReset?.metadata?.appReset === "cleared";
-    if (recordedFromClearedState) {
+    const resetPolicy = options.target.resetPolicy ?? "AUTO";
+    const shouldClearAppData = resetPolicy === "CLEAR_APP_DATA" || resetPolicy === "AUTO" && recordedFromClearedState;
+    let clearedAppDataBeforeLaunch = false;
+    if (shouldClearAppData) {
       if (shouldResetMobileAppData(options.target.platform, selectedDevice.id)) {
         try {
           await executeMobileScript(sessionId, "mobile: clearApp", [{ appId: options.target.appId }]);
-          log2("App data cleared before launch (test was recorded from a cold logged-out state).");
+          clearedAppDataBeforeLaunch = true;
+          log2(resetPolicy === "CLEAR_APP_DATA" ? "App data cleared before launch (target resetPolicy=CLEAR_APP_DATA)." : "App data cleared before launch (test was recorded from a cold logged-out state).");
         } catch (err) {
           log2(`App-data clear failed (continuing with plain fresh launch): ${err instanceof Error ? err.message : String(err)}`);
         }
+      } else if (resetPolicy === "CLEAR_APP_DATA") {
+        log2("target.resetPolicy=CLEAR_APP_DATA requested, but app-data reset is disabled by device policy (physical device / VALIDATEQA_MOBILE_APP_RESET=never) \u2014 replaying against preserved data.");
       } else {
         log2("Test expects a cleared app state, but app-data reset is disabled by policy (physical device / VALIDATEQA_MOBILE_APP_RESET=never) \u2014 replaying against the current app state.");
       }
+    } else if (recordedFromClearedState && resetPolicy === "PRESERVE_APP_DATA") {
+      log2("Test was recorded from a cleared state, but target.resetPolicy=PRESERVE_APP_DATA \u2014 replaying against preserved app data.");
     }
     log2("Opening a fresh app instance for the test...");
     await freshLaunchTargetApp(sessionId, options.target.platform, options.target.appId, log2);
-    if (recordedFromClearedState) {
+    if (clearedAppDataBeforeLaunch) {
       await waitForColdBootContent(sessionId, log2);
     }
     if (options.target.launchMode === "DEEP_LINK" && options.target.deeplink) {
@@ -334486,8 +334932,9 @@ function envInt(name, fallback) {
 var MOBILE_DEVICE_CEILING = Math.max(0, envInt("MOBILE_DEVICE_CEILING", 0));
 var MOBILE_HEAL_HOLD_MS = Math.max(0, envInt("MOBILE_HEAL_HOLD_MS", 2e4));
 function scrubAuditMessages(messages, testVariables) {
+  if (messages === void 0 || messages === null) return messages;
   const compacted = compactForAudit(messages);
-  const secretValues = Object.values(testVariables).filter((v) => typeof v === "string" && v.length >= 4).sort((a, b) => b.length - a.length);
+  const secretValues = Object.values(testVariables ?? {}).filter((v) => typeof v === "string" && v.length >= 4).sort((a, b) => b.length - a.length);
   if (secretValues.length === 0) return compacted;
   let json = JSON.stringify(compacted);
   if (typeof json !== "string") return compacted;
@@ -334802,6 +335249,9 @@ var AUDIT_FLUSH_COUNT = 10;
 var AUDIT_FLUSH_BYTES = 2 * 1024 * 1024;
 var AUDIT_DRAIN_ATTEMPTS = 3;
 var AUDIT_DRAIN_DELAY_MS = 1e3;
+var AUDIT_POST_MAX_BYTES = 4 * 1024 * 1024;
+var AUDIT_POST_MAX_ENTRIES = 50;
+var AUDIT_QUEUE_MAX_BYTES = 32 * 1024 * 1024;
 var AUDIT_BODY_MAX_BYTES = 1024 * 1024;
 var AUDIT_MAX_STRING_CHARS = 5e4;
 var AUDIT_MAX_ARRAY_ITEMS = 50;
@@ -334852,7 +335302,7 @@ function compactForAudit(value, depth = 0, seen = /* @__PURE__ */ new WeakSet())
 }
 function scrubAuditText(text, testVariables) {
   let out = text;
-  for (const [key, value] of Object.entries(testVariables).sort((a, b) => b[1].length - a[1].length)) {
+  for (const [key, value] of Object.entries(testVariables ?? {}).sort((a, b) => b[1].length - a[1].length)) {
     if (!value || value.length < 3) continue;
     const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const replacement = SECRET_VAR_PATTERN.test(key) ? "[REDACTED]" : `[TEST_VARIABLE:${key}]`;
@@ -334971,6 +335421,9 @@ function truncateAuditRequestBody(body) {
   if (byteLen <= AUDIT_BODY_MAX_BYTES) return compacted;
   return { _truncated: true, _originalLength: byteLen, preview: serialized.slice(0, 1e3) };
 }
+function isTerminalAuditStatus(status) {
+  return status === 400 || status === 404 || status === 409 || status === 413;
+}
 function createAuditFlusher(url, headers) {
   const entries = [];
   let byteEstimate = 0;
@@ -334978,26 +335431,41 @@ function createAuditFlusher(url, headers) {
   const doFlush = () => {
     if (entries.length === 0) return Promise.resolve();
     if (flushInFlight) return flushInFlight;
-    const toSend = entries.splice(0);
-    const savedBytes = byteEstimate;
-    byteEstimate = 0;
     const attempt = async () => {
       try {
-        const res = await fetch(url, {
-          method: "POST",
-          headers: { ...headers, "Content-Type": "application/json" },
-          body: JSON.stringify({ entries: toSend }),
-          signal: AbortSignal.timeout(3e4)
-        });
-        if (!res.ok) {
-          entries.unshift(...toSend);
-          byteEstimate += savedBytes;
-          console.warn(`[audit-flush] HTTP ${res.status} - ${toSend.length} entries requeued`);
+        while (entries.length > 0) {
+          const toSend = [];
+          let sendBytes = 0;
+          while (entries.length > 0 && toSend.length < AUDIT_POST_MAX_ENTRIES) {
+            const next = entries[0];
+            if (toSend.length > 0 && sendBytes + next.bytes > AUDIT_POST_MAX_BYTES) break;
+            toSend.push(entries.shift());
+            sendBytes += next.bytes;
+          }
+          byteEstimate = Math.max(0, byteEstimate - sendBytes);
+          try {
+            const res = await fetch(url, {
+              method: "POST",
+              headers: { ...headers, "Content-Type": "application/json" },
+              body: JSON.stringify({ entries: toSend.map((e) => e.entry) }),
+              signal: AbortSignal.timeout(3e4)
+            });
+            if (res.ok) continue;
+            if (isTerminalAuditStatus(res.status)) {
+              console.warn(`[audit-flush] HTTP ${res.status} (terminal) - dropping ${toSend.length} audit entries`);
+              continue;
+            }
+            entries.unshift(...toSend);
+            byteEstimate += sendBytes;
+            console.warn(`[audit-flush] HTTP ${res.status} - ${toSend.length} entries requeued`);
+            return;
+          } catch (err) {
+            entries.unshift(...toSend);
+            byteEstimate += sendBytes;
+            console.warn(`[audit-flush] Failed: ${err instanceof Error ? err.message : String(err)} - ${toSend.length} entries requeued`);
+            return;
+          }
         }
-      } catch (err) {
-        entries.unshift(...toSend);
-        byteEstimate += savedBytes;
-        console.warn(`[audit-flush] Failed: ${err instanceof Error ? err.message : String(err)} - ${toSend.length} entries requeued`);
       } finally {
         flushInFlight = null;
       }
@@ -335013,8 +335481,18 @@ function createAuditFlusher(url, headers) {
     if ("responseBody" in safeEntry && safeEntry.responseBody != null) {
       safeEntry = { ...safeEntry, responseBody: truncateAuditRequestBody(safeEntry.responseBody) };
     }
-    entries.push(safeEntry);
-    byteEstimate += safeJsonByteLength(safeEntry);
+    const bytes = safeJsonByteLength(safeEntry);
+    entries.push({ entry: safeEntry, bytes });
+    byteEstimate += bytes;
+    if (byteEstimate > AUDIT_QUEUE_MAX_BYTES) {
+      let droppedCount = 0;
+      while (entries.length > 1 && byteEstimate > AUDIT_QUEUE_MAX_BYTES) {
+        const dropped = entries.shift();
+        byteEstimate -= dropped.bytes;
+        droppedCount++;
+      }
+      console.warn(`[audit-flush] queue over ${AUDIT_QUEUE_MAX_BYTES} bytes - dropped ${droppedCount} oldest audit entries`);
+    }
     if (entries.length >= AUDIT_FLUSH_COUNT || byteEstimate >= AUDIT_FLUSH_BYTES) {
       void doFlush();
     }
@@ -335858,6 +336336,7 @@ ${finalVerifyResult.logs ?? ""}`;
               platformVersion: harvestTarget.platformVersion,
               recordedDeviceId: harvestTarget.recordedDeviceId,
               assignedDeviceId,
+              resetPolicy: harvestTarget.resetPolicy,
               launchMode: harvestTarget.launchMode,
               deeplink: harvestTarget.deeplink
             },
@@ -336134,6 +336613,7 @@ ${finalVerifyResult.logs ?? ""}`;
           // local-runner projects. Mirrors the Fargate host forward in execute-run.ts.
           paused: rest.paused,
           pauseReason: rest.pauseReason,
+          pausePhase: rest.pausePhase,
           remainingScenarios: rest.remainingScenarios,
           // Operator/UX signals the server persists to DiscoveryRun (Fargate parity).
           coverageGaps: rest.coverageGaps,
@@ -336247,6 +336727,7 @@ ${finalVerifyResult.logs ?? ""}`;
               platformVersion: mobileTarget.platformVersion,
               recordedDeviceId: mobileTarget.recordedDeviceId,
               assignedDeviceId,
+              resetPolicy: mobileTarget.resetPolicy,
               launchMode: mobileTarget.launchMode,
               deeplink: mobileTarget.deeplink
             }, {
@@ -336278,7 +336759,7 @@ ${finalVerifyResult.logs ?? ""}`;
               // Deterministic-state authorization: Android emulators only by
               // default (VALIDATEQA_MOBILE_APP_RESET overrides) — a personal
               // physical device must never have its app data wiped.
-              allowAppReset: shouldResetMobileAppData(platform3, session.deviceId)
+              allowAppReset: mobileTarget.resetPolicy !== "PRESERVE_APP_DATA" && shouldResetMobileAppData(platform3, session.deviceId)
             });
             discoveryResult = await (0, import_runner_core4.runMobileDiscoveryOnRunner)(ctx, driver, {
               onLog: mobileOnLog,
@@ -336310,8 +336791,13 @@ ${finalVerifyResult.logs ?? ""}`;
             if (activeCapture) {
               try {
                 const apiCalls = await activeCapture.stop();
+                const captureHealth = activeCapture.health();
                 if (discoveryResult) {
                   discoveryResult.apiCalls = apiCalls.length ? attachMobileDiscoveryNetworkContext(apiCalls, discoveryResult, session?.appId ?? mobileTarget.appId) : void 0;
+                  const priorHealth = discoveryResult.healthObservations;
+                  const healthObject = priorHealth && typeof priorHealth === "object" && !Array.isArray(priorHealth) ? { ...priorHealth } : {};
+                  healthObject.mobileNetworkCapture = captureHealth;
+                  discoveryResult.healthObservations = healthObject;
                 }
               } catch (capErr) {
                 mobileOnLog(`[mobile-net] capture stop failed: ${capErr instanceof Error ? capErr.message : String(capErr)}`);
@@ -336628,6 +337114,7 @@ ${finalVerifyResult.logs ?? ""}`;
           platformVersion: target.platformVersion,
           recordedDeviceId: target.recordedDeviceId,
           assignedDeviceId,
+          resetPolicy: target.resetPolicy,
           launchMode: target.launchMode,
           deeplink: target.deeplink,
           authoringPlatform: mobilePlatformFromMedium(run2.authoringMedium) ?? void 0
@@ -336642,6 +337129,7 @@ ${finalVerifyResult.logs ?? ""}`;
               platformVersion: t.platformVersion,
               recordedDeviceId: t.recordedDeviceId,
               assignedDeviceId: t.assignedDeviceId,
+              resetPolicy: t.resetPolicy,
               launchMode: narrowMobileLaunchMode(t.launchMode),
               deeplink: t.deeplink,
               authoringPlatform: t.authoringPlatform
@@ -336704,6 +337192,7 @@ ${finalVerifyResult.logs ?? ""}`;
                   platformVersion: target.platformVersion,
                   recordedDeviceId: target.recordedDeviceId,
                   assignedDeviceId,
+                  resetPolicy: target.resetPolicy,
                   launchMode: target.launchMode,
                   deeplink: target.deeplink
                 });
@@ -336712,7 +337201,7 @@ ${finalVerifyResult.logs ?? ""}`;
                   sessionId: liveSession.sessionId,
                   platform: target.platform,
                   appId: liveSession.appId,
-                  allowAppReset: shouldResetMobileAppData(target.platform, liveSession.deviceId)
+                  allowAppReset: target.resetPolicy !== "PRESERVE_APP_DATA" && shouldResetMobileAppData(target.platform, liveSession.deviceId)
                 });
                 const liveDriver = {
                   snapshot: async () => {
@@ -336740,7 +337229,7 @@ ${finalVerifyResult.logs ?? ""}`;
                   relaunch: async () => {
                     await bridgeDriver.relaunch();
                   },
-                  resetAppState: async () => bridgeDriver.resetAppState()
+                  resetAppState: async () => target.resetPolicy === "PRESERVE_APP_DATA" ? false : bridgeDriver.resetAppState()
                 };
                 return await (0, import_runner_core13.executeMobileLiveHeal)({
                   steps: a.steps,
@@ -336841,6 +337330,7 @@ ${finalVerifyResult.logs ?? ""}`;
               platformVersion: target.platformVersion,
               recordedDeviceId: target.recordedDeviceId,
               assignedDeviceId,
+              resetPolicy: target.resetPolicy,
               launchMode: target.launchMode,
               deeplink: target.deeplink,
               // Authoring platform (test's session medium). When it differs from