@validate.qa/runner 1.0.59 → 1.0.61

package/dist/cli.js

@@ -2236,6 +2236,16 @@ function selectorForValue(value) {
 function isIdentityMobileXpath(value) {
   return /@[A-Za-z_:][-A-Za-z0-9_:.]*\s*=/.test(value) && !/(?:contains|starts-with)\s*\(/i.test(value);
 }
+function mobileLocatorBundleHasIdentity(bundle) {
+  if (!bundle)
+    return false;
+  if (nonEmpty(bundle.accessibilityId) || nonEmpty(bundle.resourceId))
+    return true;
+  if (nonEmpty(bundle.text) || nonEmpty(bundle.contentDesc))
+    return true;
+  const xpath = nonEmpty(bundle.xpath);
+  return !!xpath && isIdentityMobileXpath(xpath);
+}
 function selectorCandidatesForStep(step) {
   const target = step.target;
   if (!target)
@@ -2571,7 +2581,7 @@ function generateMobileTestFromSession(input) {
   const warnings = [];
   const unrunnable = interactionSteps.length - runnableInteractions.length;
   if (unrunnable > 0) {
-    warnings.push(`${unrunnable} recorded step(s) could not be turned into a runnable action (missing locator/coordinate) and were kept best-effort.`);
+    warnings.push(`${unrunnable} recorded step(s) could not be turned into a runnable action (missing a replayable identity locator or coordinate) and were kept best-effort.`);
   }
   const locatorCoverage = interactionSteps.filter((step) => step.target?.primary).length;
   const assertionCoverage = steps.filter((step) => step.action === "assertVisible" || step.action === "assertText").length;
@@ -2600,10 +2610,29 @@ function generateMobileTestFromSession(input) {
     warnings
   };
 }
+function isGateStepResolvable(step) {
+  const metadata = step.metadata;
+  if (metadata?.appContext === "WEBVIEW") {
+    return selectorCandidatesForStep(step).length > 0;
+  }
+  const target = step.target;
+  if (!target)
+    return false;
+  if (mobileLocatorBundleHasIdentity(target.locatorBundle))
+    return true;
+  return [target.primary, ...target.fallbacks ?? []].some((value) => {
+    const trimmed = nonEmpty(value);
+    if (!trimmed || trimmed.startsWith("css="))
+      return false;
+    if (trimmed.startsWith("/") || trimmed.startsWith("(//"))
+      return isIdentityMobileXpath(trimmed);
+    return true;
+  });
+}
 function isRunnableStep(step) {
   const bounds = step.metadata?.bounds;
   const hasCoord = !!bounds && [bounds.x, bounds.y].every((n) => typeof n === "number" && Number.isFinite(n));
-  const hasLocator = !!nonEmpty(step.target?.primary);
+  const hasExecutableLocator = selectorCandidatesForStep(step).length > 0;
   switch (step.action) {
     case "launchApp":
     case "back":
@@ -2613,18 +2642,18 @@ function isRunnableStep(step) {
       return true;
     case "tap":
     case "clear":
-      return hasLocator || hasCoord;
+      return hasExecutableLocator || hasCoord;
     case "type": {
       const keyboardSubmitOnly = typeof step.value === "string" && /^[\r\n]+$/.test(step.value);
       if (keyboardSubmitOnly)
         return true;
-      return (hasLocator || hasCoord) && !!nonEmpty(step.value ?? void 0);
+      return (hasExecutableLocator || hasCoord) && !!nonEmpty(step.value ?? void 0);
     }
     case "waitForElement":
     case "assertVisible":
-      return hasLocator;
+      return isGateStepResolvable(step);
     case "assertText":
-      return hasLocator && !!nonEmpty(step.assertion ?? void 0);
+      return isGateStepResolvable(step) && !!nonEmpty(step.assertion ?? void 0);
     default:
       return false;
   }
@@ -5897,6 +5926,7 @@ __export(dist_exports, {
   jwtExpiryMs: () => jwtExpiryMs,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
+  mobileLocatorBundleHasIdentity: () => mobileLocatorBundleHasIdentity,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
   normalizeControlName: () => normalizeControlName,
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
@@ -73342,6 +73372,58 @@ var require_verification_inbox = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/brokered-inbox-reader.js
+var require_brokered_inbox_reader = __commonJS({
+  "../runner-core/dist/services/brokered-inbox-reader.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.BrokeredInboxReader = void 0;
+    var BROKERED_WAIT_CHUNK_MS = 55e3;
+    var BrokeredInboxReader = class {
+      transport;
+      constructor(transport) {
+        this.transport = transport;
+      }
+      async getUidWatermark() {
+        const value = await this.transport("getUidWatermark", {});
+        const record = value ?? {};
+        return {
+          uid: typeof record.uid === "number" ? record.uid : 0,
+          uidValidity: typeof record.uidValidity === "number" ? record.uidValidity : 0
+        };
+      }
+      async search(opts) {
+        const value = await this.transport("search", { opts });
+        return Array.isArray(value) ? value : [];
+      }
+      async getLatest(opts) {
+        const value = await this.transport("getLatest", { opts });
+        return value ?? null;
+      }
+      async getById(uid, address, altAddress, freshness) {
+        const value = await this.transport("getById", { uid, address, altAddress, freshness });
+        return value ?? null;
+      }
+      async waitForMessage(opts) {
+        const totalBudgetMs = Math.max(opts.maxWaitMs ?? 9e4, 1e3);
+        const deadline = Date.now() + totalBudgetMs;
+        for (; ; ) {
+          const remaining = deadline - Date.now();
+          if (remaining <= 0)
+            return null;
+          const chunkMs = Math.min(remaining, BROKERED_WAIT_CHUNK_MS);
+          const value = await this.transport("waitForMessage", {
+            opts: { ...opts, maxWaitMs: chunkMs }
+          });
+          if (value)
+            return value;
+        }
+      }
+    };
+    exports2.BrokeredInboxReader = BrokeredInboxReader;
+  }
+});
+
 // ../runner-core/dist/services/inbox-tools.js
 var require_inbox_tools = __commonJS({
   "../runner-core/dist/services/inbox-tools.js"(exports2) {
@@ -74051,6 +74133,7 @@ var require_mobile_explorer = __commonJS({
     var mobile_auth_coverage_js_1 = require_mobile_auth_coverage();
     var mobile_driver_errors_js_1 = require_mobile_driver_errors();
     var verification_inbox_js_1 = require_verification_inbox();
+    var brokered_inbox_reader_js_1 = require_brokered_inbox_reader();
     var inbox_tools_js_1 = require_inbox_tools();
     var mobile_discovery_auth_js_1 = require_mobile_discovery_auth();
     var MAX_MOBILE_ITERATIONS_SURVEY = 40;
@@ -75372,6 +75455,23 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
           log: (line) => log2(line)
         });
         log2("Verification inbox ENABLED for registration \u2014 monitored identity provisioned.");
+      } else if (registerRequested && ctx.inboxBroker?.address && ctx.inboxBrokerRead) {
+        inboxState = (0, inbox_tools_js_1.createInboxRunState)({ address: ctx.inboxBroker.address }, {
+          tagSeed: targetAppId ?? ctx.projectId,
+          projectScope: ctx.projectId
+        });
+        inboxReader = new brokered_inbox_reader_js_1.BrokeredInboxReader(ctx.inboxBrokerRead);
+        await (0, inbox_tools_js_1.applyAndPersistInboxIdentity)({
+          variableContext: ctx.variableContext,
+          registration: {
+            email: inboxState.email,
+            legacyEmail: inboxState.legacyEmail,
+            passwordKey: inboxState.passwordKey ?? "TEST_USER_PASSWORD"
+          },
+          persist: ctx.onCredentialUpdate,
+          log: (line) => log2(line)
+        });
+        log2("Verification inbox ENABLED via server broker \u2014 monitored identity provisioned (IMAP credentials stay server-side).");
       } else if (registerRequested) {
         log2("Registration requested without a verification inbox \u2014 preserving the seeded credential identity and reporting any verification wall as unauthenticated.");
       }
@@ -78193,6 +78293,12 @@ ${creds.join(", ")}`);
 A verified login recipe EXISTS for this app \u2014 the harness automatically signs in (and asserts the signed-in state) before every authenticated test. This SUPERSEDES the "all tests start from the landing page and sign in" rule for the non-auth-flow scenarios described here.
 For a scenario that REQUIRES an authenticated session but is NOT itself exercising the authentication / session lifecycle, you MAY assume the test begins ALREADY SIGNED IN at ${startRoute}. Do NOT author sign-in navigation, sign-in clicks, or credential-entry steps for it \u2014 begin at the first real feature action. BUT if the feature is not already on ${startRoute}, DO still include the in-app navigation from the signed-in landing to the feature page.
 Plan these LOGGED-OUT instead (keep their own establishment steps; do NOT assume a session): any scenario that exercises the auth / session / account-access lifecycle itself \u2014 signing in, signing up / registration, password reset, email / OTP / MFA / 2FA verification, SSO or magic-link sign-in, re-authentication, and SIGNING OUT (which starts signed-in and ends signed-out). Also plan logged-out any journey whose first steps must run without a session (e.g. "register a new account, then use it" \u2014 keep the registration steps).`);
+      }
+      if (context.emailVerifyArmed) {
+        sections.push(`## Verification Inbox Available (runtime email capability)
+This runner CAN read THIS test's verification email at runtime \u2014 a one-time code AND a verification link \u2014 for a fresh throwaway account the harness registers per run. That lets a SIGN-UP email-verification flow RUN TO COMPLETION instead of stopping at the "enter the code" / "check your email" screen (a survey has no inbox, so exploration could only reach that screen). Plan it as a HAPPY_PATH:
+- Sign-up + email verification: register a brand-new account, RETRIEVE the emailed code or link, and submit/open it to complete verification.
+Write "retrieve the emailed code / open the emailed link" as an ordinary plain-language step; the generator supplies the runtime mechanism. This is an exception to Rule 1 ONLY for the ACTION of completing the email step \u2014 it does NOT license inventing an outcome. For the durable assertion, Rule 12 still governs: assert only the post-verification result the evidence supports \u2014 a specific observed control, a confirmation message the explorer actually saw, or a STRUCTURAL signal (the verification screen is replaced, the URL leaves the verify route, the login form is no longer shown). If no concrete signed-in signal was observed, assert the observed transition and NAME the missing signal as a coverage gap in reasoning \u2014 do NOT fabricate a Logout/account control exploration never saw (this app may land on a login page or a confirmation page after verifying, not a signed-in dashboard). Keep it LOGGED-OUT with its own registration steps, and still plan the sign-up / verification negative cases the EVIDENCE supports (e.g. an already-registered email, or an invalid / mismatched verification code) as separate scenarios.`);
       }
       sections.push(`## Constraints
 - Test budget: ${context.testBudget} scenarios maximum`);
@@ -84286,12 +84392,14 @@ ${args.directive}`);
           { role: "user", content: userContent }
         ];
         let content;
+        let finishReason;
         try {
           const response = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
             arm();
             return aiClient.chat.completions.create({ model, messages, max_tokens: 8e3, temperature: 0.1 }, { signal });
           }), { label: `mobile-heal-attempt-${attempt}`, deferTimeoutUntilArmed: true });
           content = response?.choices?.[0]?.message?.content ?? "";
+          finishReason = response?.choices?.[0]?.finish_reason ?? void 0;
         } catch {
           options.onProgress?.(`Phase 1 attempt ${attempt}: model call failed in transport \u2014 granting a recovery turn`);
           markRecoverableTurn();
@@ -84301,7 +84409,7 @@ ${args.directive}`);
         aiResponseCount += 1;
         const parsed = parseHealVerdict(content);
         if (!parsed) {
-          options.onProgress?.(`Phase 1 attempt ${attempt}: response was not a valid verdict \u2014 granting a recovery turn`);
+          options.onProgress?.(`Phase 1 attempt ${attempt}: response was not a valid verdict (${content.length} chars, finish=${finishReason ?? "unknown"}) \u2014 granting a recovery turn`);
           markRecoverableTurn();
           pendingDirective = "Your last response was not valid JSON matching the verdict schema. Return exactly one JSON verdict object.";
           continue;
@@ -94802,6 +94910,7 @@ var require_discover_generator = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.MIN_BUG_DESCRIPTION_LENGTH = exports2.VALID_PLAYWRIGHT_GETBY_METHODS = exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
+    exports2.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
     exports2.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports2.detectScenarioSignals = detectScenarioSignals;
     exports2.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
@@ -94814,6 +94923,7 @@ var require_discover_generator = __commonJS({
     exports2.stripImportDeclarations = stripImportDeclarations;
     exports2.stripStringsAndComments = stripStringsAndComments;
     exports2.gotoBasePathFromBaseUrl = gotoBasePathFromBaseUrl;
+    exports2.repairInboxHelperScalarDestructure = repairInboxHelperScalarDestructure;
     exports2.sanitizeCode = sanitizeCode;
     exports2.validateTests = validateTests;
     exports2.formatEvidenceForLiveGenerate = formatEvidenceForLiveGenerate;
@@ -94860,7 +94970,8 @@ var require_discover_generator = __commonJS({
     var test_inbox_broker_js_1 = require_test_inbox_broker();
     var REGISTER_SCENARIO_RE = /\b(register|registration|sign[\s-]?up|create[\s-]?(a[n]?[\s-]?)?(new[\s-]?)?account|verify[\s-]?(your[\s-]?)?email|email[\s-]?verification|confirm[\s-]?(your[\s-]?)?(email|account)|activate[\s-]?(your[\s-]?)?account|new[\s-]?account)\b/i;
     function scenarioLooksLikeRegistration(scenario) {
-      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
+      const stepText = (scenario.steps ?? []).map((s) => `${s?.action ?? ""} ${s?.target ?? ""}`).join(" ");
+      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")} ${stepText}`;
       return REGISTER_SCENARIO_RE.test(hay);
     }
     function buildEmailVerifyGenBlock(genEmail, genPassword) {
@@ -94883,6 +94994,7 @@ EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway
   - code flow:  \`const code = await __vqaWaitForEmail('code');\`  then type \`code\` into the verification field.
   - link flow:  \`const link = await __vqaWaitForEmail('link');\`  then \`await page.goto(link);\`.
   - if unsure: \`const email = await __vqaWaitForEmail();\` returns \`{ code, link, subject, from }\`.
+  - IMPORTANT: \`__vqaWaitForEmail('code')\` returns the code STRING (and \`('link')\` the link string) \u2014 assign it directly with \`const code = \u2026\`. Do NOT destructure the scalar form (\`const { code } = await __vqaWaitForEmail('code')\` binds \`undefined\`, so \`code.split(...)\` then crashes). ONLY the no-arg \`__vqaWaitForEmail()\` returns an object you can destructure.
 - Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
 - End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
     }
@@ -95982,6 +96094,200 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
         return void 0;
       }
     }
+    function literalPositionMask(code) {
+      const n = code.length;
+      const mask = new Array(n).fill(false);
+      const REGEX_PRECEDING = /[(,=;{}\[!&|?:+\-*%~^<>]$/;
+      const REGEX_PRECEDING_KEYWORD = /\b(?:return|typeof|void|delete|in|of|new|instanceof|throw|await|yield|case)\s*$/;
+      let i = 0;
+      let codeSoFar = "";
+      const isRegexContext = () => {
+        const trimmed = codeSoFar.replace(/\s+$/, "");
+        if (trimmed.length === 0)
+          return true;
+        if (REGEX_PRECEDING.test(trimmed))
+          return true;
+        if (REGEX_PRECEDING_KEYWORD.test(trimmed))
+          return true;
+        if (trimmed.endsWith("=>"))
+          return true;
+        return false;
+      };
+      const scanRegex = () => {
+        i += 1;
+        let inClass = false;
+        while (i < n) {
+          if (code[i] === "\\") {
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === "[") {
+            inClass = true;
+            mask[i] = true;
+            i += 1;
+            continue;
+          }
+          if (code[i] === "]") {
+            inClass = false;
+            mask[i] = true;
+            i += 1;
+            continue;
+          }
+          if (code[i] === "/" && !inClass) {
+            i += 1;
+            break;
+          }
+          if (code[i] === "\n")
+            break;
+          mask[i] = true;
+          i += 1;
+        }
+        while (i < n && /[gimsuydv]/.test(code[i]))
+          i += 1;
+      };
+      const scanQuoted = (quote) => {
+        i += 1;
+        while (i < n) {
+          if (code[i] === "\\") {
+            if (code[i + 1] === "\r" && code[i + 2] === "\n") {
+              mask[i] = true;
+              mask[i + 1] = true;
+              mask[i + 2] = true;
+              i += 3;
+              continue;
+            }
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === quote) {
+            i += 1;
+            break;
+          }
+          if (code[i] === "\n")
+            break;
+          mask[i] = true;
+          i += 1;
+        }
+      };
+      const scanTemplate = () => {
+        while (i < n) {
+          if (code[i] === "\\") {
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === "`") {
+            i += 1;
+            break;
+          }
+          if (code[i] === "$" && code[i + 1] === "{") {
+            i += 2;
+            const savedCodeSoFar = codeSoFar;
+            codeSoFar = "";
+            scanCode(true);
+            codeSoFar = savedCodeSoFar;
+            continue;
+          }
+          mask[i] = true;
+          i += 1;
+        }
+      };
+      function scanCode(stopAtCloseBrace) {
+        let depth = 0;
+        while (i < n) {
+          const c = code[i];
+          const next = i + 1 < n ? code[i + 1] : "";
+          if (stopAtCloseBrace) {
+            if (c === "}" && depth === 0) {
+              i += 1;
+              return;
+            }
+            if (c === "{") {
+              depth += 1;
+              codeSoFar += c;
+              i += 1;
+              continue;
+            }
+            if (c === "}") {
+              depth -= 1;
+              codeSoFar += c;
+              i += 1;
+              continue;
+            }
+          }
+          if (c === "/" && next === "*") {
+            const end = code.indexOf("*/", i + 2);
+            const stop = end < 0 ? n : end + 2;
+            for (let j = i; j < stop; j++)
+              mask[j] = true;
+            i = stop;
+            continue;
+          }
+          if (c === "/" && next === "/") {
+            const end = code.indexOf("\n", i + 2);
+            const stop = end < 0 ? n : end;
+            for (let j = i; j < stop; j++)
+              mask[j] = true;
+            i = stop;
+            continue;
+          }
+          if (c === "/" && isRegexContext()) {
+            scanRegex();
+            codeSoFar += "x";
+            continue;
+          }
+          if (c === "`") {
+            i += 1;
+            scanTemplate();
+            codeSoFar += "x";
+            continue;
+          }
+          if (c === '"' || c === "'") {
+            scanQuoted(c);
+            codeSoFar += "x";
+            continue;
+          }
+          codeSoFar += c;
+          i += 1;
+        }
+      }
+      scanCode(false);
+      return mask;
+    }
+    function atLineStart(code, start) {
+      let j = start - 1;
+      while (j >= 0 && (code[j] === " " || code[j] === "	"))
+        j--;
+      return j < 0 || code[j] === "\n" || code[j] === "\r";
+    }
+    function repairInboxHelperScalarDestructure(code) {
+      if (!code || code.indexOf("__vqaWaitForEmail") === -1)
+        return code;
+      const inLiteral = literalPositionMask(code);
+      const re = /\b(const|let|var)\s*\{\s*([A-Za-z_$][\w$]*)\s*(?::\s*([A-Za-z_$][\w$]*)\s*)?\}\s*=\s*await\s+__vqaWaitForEmail\s*\(\s*(['"`])(code|link)\4\s*\)/g;
+      let out = "";
+      let last = 0;
+      let m;
+      while ((m = re.exec(code)) !== null) {
+        const [full, decl, prop, alias, quote, kind] = m;
+        const start = m.index;
+        if (inLiteral[start] || !atLineStart(code, start) || prop !== kind)
+          continue;
+        out += code.slice(last, start);
+        out += `${decl} ${alias || prop} = await __vqaWaitForEmail(${quote}${kind}${quote})`;
+        last = start + full.length;
+      }
+      out += code.slice(last);
+      return out;
+    }
     function sanitizeCode(code, options) {
       let result = code;
       const isNetworkIdleWaitLine = (line) => /^\s*await page\.waitForLoadState\((['"])networkidle\1\);\s*$/.test(line);
@@ -96072,6 +96378,7 @@ ${testOpen}`;
       if (options?.authStamp) {
         result = (0, auth_recipe_js_1.upsertAuthBlock)(result, options.authStamp);
       }
+      result = repairInboxHelperScalarDestructure(result);
       try {
         result = (0, inbox_stamp_js_1.upsertInboxBlock)(result);
       } catch {
@@ -334533,6 +334840,8 @@ var require_discover_agent = __commonJS({
     var discover_planner_js_1 = require_discover_planner();
     var discover_generator_js_1 = require_discover_generator();
     var discover_ai_planner_js_1 = require_discover_ai_planner();
+    var discovery_lint_flags_js_1 = require_discovery_lint_flags();
+    var verification_inbox_js_1 = require_verification_inbox();
     var sitemap_builder_js_1 = require_sitemap_builder();
     Object.defineProperty(exports2, "buildInMemorySiteMap", { enumerable: true, get: function() {
       return sitemap_builder_js_1.buildInMemorySiteMap;
@@ -334545,6 +334854,13 @@ var require_discover_agent = __commonJS({
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
     var canvas_detector_js_1 = require_canvas_detector();
     var auth_recipe_js_1 = require_auth_recipe();
+    function plannerEmailVerifyArmed(ctx) {
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)())
+        return false;
+      if (ctx.variableContext?.allTestVariables?.DISCOVERY_SHOULD_REGISTER !== "true")
+        return false;
+      return (0, verification_inbox_js_1.isVerificationInboxConfigured)();
+    }
     async function runCanvasPreflight(ctx, sharedBrowser, log2) {
       const cached = ctx.appRenderType ?? null;
       const engine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
@@ -335193,6 +335509,9 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           // instead of authoring landing→login steps (which generate would override).
           authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
           authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+          // Email-verify capability — only for scenario-producing modes; a survey emits
+          // featureGroups (no scenarios), so keep its prompt free of the round-trip block.
+          emailVerifyArmed: mode !== "survey" && plannerEmailVerifyArmed(ctx),
           testBudget
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -335777,6 +336096,12 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             // authenticated state when a verified login recipe is on file for this project.
             authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
             authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+            // Email-verify capability: when armed, let the planner plan the full
+            // register→verify and forgot-password→reset round trips to completion
+            // (see the planner's "## Verification Inbox Available" block). Armed on the
+            // SAME project-level predicate the generator uses (flag + register intent +
+            // configured inbox), so the planner never promises what generation can't do.
+            emailVerifyArmed: plannerEmailVerifyArmed(ctx),
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -349952,7 +350277,7 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.filterLoginCaptureCredentials = exports2.buildLoginCaptureCredentials = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.filterFeatureGroupsToPathScope = exports2.isAuthFlowRoute = exports2.deriveSurveyPathScope = exports2.canonicalizeRoute = exports2.codeUsesInboxHelper = exports2.codeUsesTestInboxIdentity = exports2.codeSelfProvisionsRegistration = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
     exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.validateAuthoredMobileTest = exports2.buildMobileRepoAuthorSystemRules = exports2.buildMobileRepoAuthorKickoff = exports2.buildMobileRepoAuthorContractMd = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.MOBILE_IMPORT_SCHEMA_VERSION = exports2.validateImportedMobileTest = exports2.buildMobileImportSystemRules = exports2.buildMobileImportKickoff = exports2.buildMobileImportContractMd = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = void 0;
-    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = void 0;
+    exports2.BrokeredInboxReader = exports2.applyPlusTag = exports2.deriveProjectInboxTag = exports2.deriveInboxTag = exports2.loadVerificationInboxConfig = exports2.VerificationInboxReader = exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = void 0;
     __exportStar(require_ai_provider(), exports2);
     __exportStar(require_mobile_types(), exports2);
     __exportStar(require_mobile_source_parser(), exports2);
@@ -350374,6 +350699,26 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports2, "UNSUPPORTED_RENDERER_PREFIX", { enumerable: true, get: function() {
       return canvas_detector_js_1.UNSUPPORTED_RENDERER_PREFIX;
     } });
+    var verification_inbox_js_1 = require_verification_inbox();
+    Object.defineProperty(exports2, "VerificationInboxReader", { enumerable: true, get: function() {
+      return verification_inbox_js_1.VerificationInboxReader;
+    } });
+    Object.defineProperty(exports2, "loadVerificationInboxConfig", { enumerable: true, get: function() {
+      return verification_inbox_js_1.loadVerificationInboxConfig;
+    } });
+    Object.defineProperty(exports2, "deriveInboxTag", { enumerable: true, get: function() {
+      return verification_inbox_js_1.deriveInboxTag;
+    } });
+    Object.defineProperty(exports2, "deriveProjectInboxTag", { enumerable: true, get: function() {
+      return verification_inbox_js_1.deriveProjectInboxTag;
+    } });
+    Object.defineProperty(exports2, "applyPlusTag", { enumerable: true, get: function() {
+      return verification_inbox_js_1.applyPlusTag;
+    } });
+    var brokered_inbox_reader_js_1 = require_brokered_inbox_reader();
+    Object.defineProperty(exports2, "BrokeredInboxReader", { enumerable: true, get: function() {
+      return brokered_inbox_reader_js_1.BrokeredInboxReader;
+    } });
   }
 });
 
@@ -350382,7 +350727,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.59",
+      version: "1.0.61",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -355462,7 +355807,13 @@ async function handleHealth(_req, res) {
     },
     devices,
     capabilities,
-    activeSession: state.appiumSessionId
+    activeSession: state.appiumSessionId,
+    // THIS runner's Appium is executing mobile (APPIUM) test run(s) right now.
+    // The web pre-flight reads this to warn before /bridge/session/start would
+    // 409 — it must never be inferred from server-side global run counts, which
+    // include unrelated projects and runners.
+    executorBusy: executorBusyCount > 0,
+    recordingActive: !!state.appiumSessionId && mirrorSessionOwner === "recording"
   });
 }
 function realDeviceCapabilities2(platform3) {
@@ -355537,7 +355888,11 @@ function validateSessionStartBody(body) {
 }
 async function handleDevices(_req, res) {
   const devices = discoverAllDevices({ includeApps: true });
-  sendJSON(res, 200, { devices });
+  sendJSON(res, 200, {
+    devices,
+    executorBusy: executorBusyCount > 0,
+    recordingActive: !!state.appiumSessionId && mirrorSessionOwner === "recording"
+  });
 }
 async function handleSessionStart(req, res) {
   const body = await parseBody(req);
@@ -358915,6 +359270,20 @@ ${finalVerifyResult.logs ?? ""}`;
         { ...input, actor: "ai-explorer" },
         run2.claimEpoch
       );
+      if (ctx.inboxBroker?.address) {
+        ctx.inboxBrokerRead = async (op, payload) => {
+          const res = await fetch(`${opts.serverUrl}/api/runner/inbox/read`, {
+            method: "POST",
+            headers: { ...headers, "Content-Type": "application/json" },
+            body: JSON.stringify({ runId: run2.runId, op, payload })
+          });
+          if (!res.ok) {
+            const detail = await res.text().catch(() => "");
+            throw new Error(`inbox broker ${op} failed: HTTP ${res.status}${detail ? ` \u2014 ${detail.slice(0, 200)}` : ""}`);
+          }
+          return (await res.json()).value ?? null;
+        };
+      }
       log.info(`Discovery (${ctx.mode}) on ${ctx.baseUrl}`);
       const { push: pushAudit, drain: drainAudit } = createAuditFlusher(
         `${opts.serverUrl}/api/runner/runs/${run2.runId}/ai-audit-batch`,

package/dist/cli.mjs

@@ -2241,6 +2241,16 @@ function selectorForValue(value) {
 function isIdentityMobileXpath(value) {
   return /@[A-Za-z_:][-A-Za-z0-9_:.]*\s*=/.test(value) && !/(?:contains|starts-with)\s*\(/i.test(value);
 }
+function mobileLocatorBundleHasIdentity(bundle) {
+  if (!bundle)
+    return false;
+  if (nonEmpty(bundle.accessibilityId) || nonEmpty(bundle.resourceId))
+    return true;
+  if (nonEmpty(bundle.text) || nonEmpty(bundle.contentDesc))
+    return true;
+  const xpath = nonEmpty(bundle.xpath);
+  return !!xpath && isIdentityMobileXpath(xpath);
+}
 function selectorCandidatesForStep(step) {
   const target = step.target;
   if (!target)
@@ -2576,7 +2586,7 @@ function generateMobileTestFromSession(input) {
   const warnings = [];
   const unrunnable = interactionSteps.length - runnableInteractions.length;
   if (unrunnable > 0) {
-    warnings.push(`${unrunnable} recorded step(s) could not be turned into a runnable action (missing locator/coordinate) and were kept best-effort.`);
+    warnings.push(`${unrunnable} recorded step(s) could not be turned into a runnable action (missing a replayable identity locator or coordinate) and were kept best-effort.`);
   }
   const locatorCoverage = interactionSteps.filter((step) => step.target?.primary).length;
   const assertionCoverage = steps.filter((step) => step.action === "assertVisible" || step.action === "assertText").length;
@@ -2605,10 +2615,29 @@ function generateMobileTestFromSession(input) {
     warnings
   };
 }
+function isGateStepResolvable(step) {
+  const metadata = step.metadata;
+  if (metadata?.appContext === "WEBVIEW") {
+    return selectorCandidatesForStep(step).length > 0;
+  }
+  const target = step.target;
+  if (!target)
+    return false;
+  if (mobileLocatorBundleHasIdentity(target.locatorBundle))
+    return true;
+  return [target.primary, ...target.fallbacks ?? []].some((value) => {
+    const trimmed = nonEmpty(value);
+    if (!trimmed || trimmed.startsWith("css="))
+      return false;
+    if (trimmed.startsWith("/") || trimmed.startsWith("(//"))
+      return isIdentityMobileXpath(trimmed);
+    return true;
+  });
+}
 function isRunnableStep(step) {
   const bounds = step.metadata?.bounds;
   const hasCoord = !!bounds && [bounds.x, bounds.y].every((n) => typeof n === "number" && Number.isFinite(n));
-  const hasLocator = !!nonEmpty(step.target?.primary);
+  const hasExecutableLocator = selectorCandidatesForStep(step).length > 0;
   switch (step.action) {
     case "launchApp":
     case "back":
@@ -2618,18 +2647,18 @@ function isRunnableStep(step) {
       return true;
     case "tap":
     case "clear":
-      return hasLocator || hasCoord;
+      return hasExecutableLocator || hasCoord;
     case "type": {
       const keyboardSubmitOnly = typeof step.value === "string" && /^[\r\n]+$/.test(step.value);
       if (keyboardSubmitOnly)
         return true;
-      return (hasLocator || hasCoord) && !!nonEmpty(step.value ?? void 0);
+      return (hasExecutableLocator || hasCoord) && !!nonEmpty(step.value ?? void 0);
     }
     case "waitForElement":
     case "assertVisible":
-      return hasLocator;
+      return isGateStepResolvable(step);
     case "assertText":
-      return hasLocator && !!nonEmpty(step.assertion ?? void 0);
+      return isGateStepResolvable(step) && !!nonEmpty(step.assertion ?? void 0);
     default:
       return false;
   }
@@ -5902,6 +5931,7 @@ __export(dist_exports, {
   jwtExpiryMs: () => jwtExpiryMs,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
+  mobileLocatorBundleHasIdentity: () => mobileLocatorBundleHasIdentity,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
   normalizeControlName: () => normalizeControlName,
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
@@ -73347,6 +73377,58 @@ var require_verification_inbox = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/brokered-inbox-reader.js
+var require_brokered_inbox_reader = __commonJS({
+  "../runner-core/dist/services/brokered-inbox-reader.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.BrokeredInboxReader = void 0;
+    var BROKERED_WAIT_CHUNK_MS = 55e3;
+    var BrokeredInboxReader = class {
+      transport;
+      constructor(transport) {
+        this.transport = transport;
+      }
+      async getUidWatermark() {
+        const value = await this.transport("getUidWatermark", {});
+        const record = value ?? {};
+        return {
+          uid: typeof record.uid === "number" ? record.uid : 0,
+          uidValidity: typeof record.uidValidity === "number" ? record.uidValidity : 0
+        };
+      }
+      async search(opts) {
+        const value = await this.transport("search", { opts });
+        return Array.isArray(value) ? value : [];
+      }
+      async getLatest(opts) {
+        const value = await this.transport("getLatest", { opts });
+        return value ?? null;
+      }
+      async getById(uid, address, altAddress, freshness) {
+        const value = await this.transport("getById", { uid, address, altAddress, freshness });
+        return value ?? null;
+      }
+      async waitForMessage(opts) {
+        const totalBudgetMs = Math.max(opts.maxWaitMs ?? 9e4, 1e3);
+        const deadline = Date.now() + totalBudgetMs;
+        for (; ; ) {
+          const remaining = deadline - Date.now();
+          if (remaining <= 0)
+            return null;
+          const chunkMs = Math.min(remaining, BROKERED_WAIT_CHUNK_MS);
+          const value = await this.transport("waitForMessage", {
+            opts: { ...opts, maxWaitMs: chunkMs }
+          });
+          if (value)
+            return value;
+        }
+      }
+    };
+    exports.BrokeredInboxReader = BrokeredInboxReader;
+  }
+});
+
 // ../runner-core/dist/services/inbox-tools.js
 var require_inbox_tools = __commonJS({
   "../runner-core/dist/services/inbox-tools.js"(exports) {
@@ -74056,6 +74138,7 @@ var require_mobile_explorer = __commonJS({
     var mobile_auth_coverage_js_1 = require_mobile_auth_coverage();
     var mobile_driver_errors_js_1 = require_mobile_driver_errors();
     var verification_inbox_js_1 = require_verification_inbox();
+    var brokered_inbox_reader_js_1 = require_brokered_inbox_reader();
     var inbox_tools_js_1 = require_inbox_tools();
     var mobile_discovery_auth_js_1 = require_mobile_discovery_auth();
     var MAX_MOBILE_ITERATIONS_SURVEY = 40;
@@ -75377,6 +75460,23 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
           log: (line) => log2(line)
         });
         log2("Verification inbox ENABLED for registration \u2014 monitored identity provisioned.");
+      } else if (registerRequested && ctx.inboxBroker?.address && ctx.inboxBrokerRead) {
+        inboxState = (0, inbox_tools_js_1.createInboxRunState)({ address: ctx.inboxBroker.address }, {
+          tagSeed: targetAppId ?? ctx.projectId,
+          projectScope: ctx.projectId
+        });
+        inboxReader = new brokered_inbox_reader_js_1.BrokeredInboxReader(ctx.inboxBrokerRead);
+        await (0, inbox_tools_js_1.applyAndPersistInboxIdentity)({
+          variableContext: ctx.variableContext,
+          registration: {
+            email: inboxState.email,
+            legacyEmail: inboxState.legacyEmail,
+            passwordKey: inboxState.passwordKey ?? "TEST_USER_PASSWORD"
+          },
+          persist: ctx.onCredentialUpdate,
+          log: (line) => log2(line)
+        });
+        log2("Verification inbox ENABLED via server broker \u2014 monitored identity provisioned (IMAP credentials stay server-side).");
       } else if (registerRequested) {
         log2("Registration requested without a verification inbox \u2014 preserving the seeded credential identity and reporting any verification wall as unauthenticated.");
       }
@@ -78198,6 +78298,12 @@ ${creds.join(", ")}`);
 A verified login recipe EXISTS for this app \u2014 the harness automatically signs in (and asserts the signed-in state) before every authenticated test. This SUPERSEDES the "all tests start from the landing page and sign in" rule for the non-auth-flow scenarios described here.
 For a scenario that REQUIRES an authenticated session but is NOT itself exercising the authentication / session lifecycle, you MAY assume the test begins ALREADY SIGNED IN at ${startRoute}. Do NOT author sign-in navigation, sign-in clicks, or credential-entry steps for it \u2014 begin at the first real feature action. BUT if the feature is not already on ${startRoute}, DO still include the in-app navigation from the signed-in landing to the feature page.
 Plan these LOGGED-OUT instead (keep their own establishment steps; do NOT assume a session): any scenario that exercises the auth / session / account-access lifecycle itself \u2014 signing in, signing up / registration, password reset, email / OTP / MFA / 2FA verification, SSO or magic-link sign-in, re-authentication, and SIGNING OUT (which starts signed-in and ends signed-out). Also plan logged-out any journey whose first steps must run without a session (e.g. "register a new account, then use it" \u2014 keep the registration steps).`);
+      }
+      if (context.emailVerifyArmed) {
+        sections.push(`## Verification Inbox Available (runtime email capability)
+This runner CAN read THIS test's verification email at runtime \u2014 a one-time code AND a verification link \u2014 for a fresh throwaway account the harness registers per run. That lets a SIGN-UP email-verification flow RUN TO COMPLETION instead of stopping at the "enter the code" / "check your email" screen (a survey has no inbox, so exploration could only reach that screen). Plan it as a HAPPY_PATH:
+- Sign-up + email verification: register a brand-new account, RETRIEVE the emailed code or link, and submit/open it to complete verification.
+Write "retrieve the emailed code / open the emailed link" as an ordinary plain-language step; the generator supplies the runtime mechanism. This is an exception to Rule 1 ONLY for the ACTION of completing the email step \u2014 it does NOT license inventing an outcome. For the durable assertion, Rule 12 still governs: assert only the post-verification result the evidence supports \u2014 a specific observed control, a confirmation message the explorer actually saw, or a STRUCTURAL signal (the verification screen is replaced, the URL leaves the verify route, the login form is no longer shown). If no concrete signed-in signal was observed, assert the observed transition and NAME the missing signal as a coverage gap in reasoning \u2014 do NOT fabricate a Logout/account control exploration never saw (this app may land on a login page or a confirmation page after verifying, not a signed-in dashboard). Keep it LOGGED-OUT with its own registration steps, and still plan the sign-up / verification negative cases the EVIDENCE supports (e.g. an already-registered email, or an invalid / mismatched verification code) as separate scenarios.`);
       }
       sections.push(`## Constraints
 - Test budget: ${context.testBudget} scenarios maximum`);
@@ -84291,12 +84397,14 @@ ${args.directive}`);
           { role: "user", content: userContent }
         ];
         let content;
+        let finishReason;
         try {
           const response = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
             arm();
             return aiClient.chat.completions.create({ model, messages, max_tokens: 8e3, temperature: 0.1 }, { signal });
           }), { label: `mobile-heal-attempt-${attempt}`, deferTimeoutUntilArmed: true });
           content = response?.choices?.[0]?.message?.content ?? "";
+          finishReason = response?.choices?.[0]?.finish_reason ?? void 0;
         } catch {
           options.onProgress?.(`Phase 1 attempt ${attempt}: model call failed in transport \u2014 granting a recovery turn`);
           markRecoverableTurn();
@@ -84306,7 +84414,7 @@ ${args.directive}`);
         aiResponseCount += 1;
         const parsed = parseHealVerdict(content);
         if (!parsed) {
-          options.onProgress?.(`Phase 1 attempt ${attempt}: response was not a valid verdict \u2014 granting a recovery turn`);
+          options.onProgress?.(`Phase 1 attempt ${attempt}: response was not a valid verdict (${content.length} chars, finish=${finishReason ?? "unknown"}) \u2014 granting a recovery turn`);
           markRecoverableTurn();
           pendingDirective = "Your last response was not valid JSON matching the verdict schema. Return exactly one JSON verdict object.";
           continue;
@@ -94807,6 +94915,7 @@ var require_discover_generator = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.MIN_BUG_DESCRIPTION_LENGTH = exports.VALID_PLAYWRIGHT_GETBY_METHODS = exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
+    exports.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
     exports.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports.detectScenarioSignals = detectScenarioSignals;
     exports.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
@@ -94819,6 +94928,7 @@ var require_discover_generator = __commonJS({
     exports.stripImportDeclarations = stripImportDeclarations;
     exports.stripStringsAndComments = stripStringsAndComments;
     exports.gotoBasePathFromBaseUrl = gotoBasePathFromBaseUrl;
+    exports.repairInboxHelperScalarDestructure = repairInboxHelperScalarDestructure;
     exports.sanitizeCode = sanitizeCode;
     exports.validateTests = validateTests;
     exports.formatEvidenceForLiveGenerate = formatEvidenceForLiveGenerate;
@@ -94865,7 +94975,8 @@ var require_discover_generator = __commonJS({
     var test_inbox_broker_js_1 = require_test_inbox_broker();
     var REGISTER_SCENARIO_RE = /\b(register|registration|sign[\s-]?up|create[\s-]?(a[n]?[\s-]?)?(new[\s-]?)?account|verify[\s-]?(your[\s-]?)?email|email[\s-]?verification|confirm[\s-]?(your[\s-]?)?(email|account)|activate[\s-]?(your[\s-]?)?account|new[\s-]?account)\b/i;
     function scenarioLooksLikeRegistration(scenario) {
-      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
+      const stepText = (scenario.steps ?? []).map((s) => `${s?.action ?? ""} ${s?.target ?? ""}`).join(" ");
+      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")} ${stepText}`;
       return REGISTER_SCENARIO_RE.test(hay);
     }
     function buildEmailVerifyGenBlock(genEmail, genPassword) {
@@ -94888,6 +94999,7 @@ EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway
   - code flow:  \`const code = await __vqaWaitForEmail('code');\`  then type \`code\` into the verification field.
   - link flow:  \`const link = await __vqaWaitForEmail('link');\`  then \`await page.goto(link);\`.
   - if unsure: \`const email = await __vqaWaitForEmail();\` returns \`{ code, link, subject, from }\`.
+  - IMPORTANT: \`__vqaWaitForEmail('code')\` returns the code STRING (and \`('link')\` the link string) \u2014 assign it directly with \`const code = \u2026\`. Do NOT destructure the scalar form (\`const { code } = await __vqaWaitForEmail('code')\` binds \`undefined\`, so \`code.split(...)\` then crashes). ONLY the no-arg \`__vqaWaitForEmail()\` returns an object you can destructure.
 - Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
 - End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
     }
@@ -95987,6 +96099,200 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
         return void 0;
       }
     }
+    function literalPositionMask(code) {
+      const n = code.length;
+      const mask = new Array(n).fill(false);
+      const REGEX_PRECEDING = /[(,=;{}\[!&|?:+\-*%~^<>]$/;
+      const REGEX_PRECEDING_KEYWORD = /\b(?:return|typeof|void|delete|in|of|new|instanceof|throw|await|yield|case)\s*$/;
+      let i = 0;
+      let codeSoFar = "";
+      const isRegexContext = () => {
+        const trimmed = codeSoFar.replace(/\s+$/, "");
+        if (trimmed.length === 0)
+          return true;
+        if (REGEX_PRECEDING.test(trimmed))
+          return true;
+        if (REGEX_PRECEDING_KEYWORD.test(trimmed))
+          return true;
+        if (trimmed.endsWith("=>"))
+          return true;
+        return false;
+      };
+      const scanRegex = () => {
+        i += 1;
+        let inClass = false;
+        while (i < n) {
+          if (code[i] === "\\") {
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === "[") {
+            inClass = true;
+            mask[i] = true;
+            i += 1;
+            continue;
+          }
+          if (code[i] === "]") {
+            inClass = false;
+            mask[i] = true;
+            i += 1;
+            continue;
+          }
+          if (code[i] === "/" && !inClass) {
+            i += 1;
+            break;
+          }
+          if (code[i] === "\n")
+            break;
+          mask[i] = true;
+          i += 1;
+        }
+        while (i < n && /[gimsuydv]/.test(code[i]))
+          i += 1;
+      };
+      const scanQuoted = (quote) => {
+        i += 1;
+        while (i < n) {
+          if (code[i] === "\\") {
+            if (code[i + 1] === "\r" && code[i + 2] === "\n") {
+              mask[i] = true;
+              mask[i + 1] = true;
+              mask[i + 2] = true;
+              i += 3;
+              continue;
+            }
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === quote) {
+            i += 1;
+            break;
+          }
+          if (code[i] === "\n")
+            break;
+          mask[i] = true;
+          i += 1;
+        }
+      };
+      const scanTemplate = () => {
+        while (i < n) {
+          if (code[i] === "\\") {
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === "`") {
+            i += 1;
+            break;
+          }
+          if (code[i] === "$" && code[i + 1] === "{") {
+            i += 2;
+            const savedCodeSoFar = codeSoFar;
+            codeSoFar = "";
+            scanCode(true);
+            codeSoFar = savedCodeSoFar;
+            continue;
+          }
+          mask[i] = true;
+          i += 1;
+        }
+      };
+      function scanCode(stopAtCloseBrace) {
+        let depth = 0;
+        while (i < n) {
+          const c = code[i];
+          const next = i + 1 < n ? code[i + 1] : "";
+          if (stopAtCloseBrace) {
+            if (c === "}" && depth === 0) {
+              i += 1;
+              return;
+            }
+            if (c === "{") {
+              depth += 1;
+              codeSoFar += c;
+              i += 1;
+              continue;
+            }
+            if (c === "}") {
+              depth -= 1;
+              codeSoFar += c;
+              i += 1;
+              continue;
+            }
+          }
+          if (c === "/" && next === "*") {
+            const end = code.indexOf("*/", i + 2);
+            const stop = end < 0 ? n : end + 2;
+            for (let j = i; j < stop; j++)
+              mask[j] = true;
+            i = stop;
+            continue;
+          }
+          if (c === "/" && next === "/") {
+            const end = code.indexOf("\n", i + 2);
+            const stop = end < 0 ? n : end;
+            for (let j = i; j < stop; j++)
+              mask[j] = true;
+            i = stop;
+            continue;
+          }
+          if (c === "/" && isRegexContext()) {
+            scanRegex();
+            codeSoFar += "x";
+            continue;
+          }
+          if (c === "`") {
+            i += 1;
+            scanTemplate();
+            codeSoFar += "x";
+            continue;
+          }
+          if (c === '"' || c === "'") {
+            scanQuoted(c);
+            codeSoFar += "x";
+            continue;
+          }
+          codeSoFar += c;
+          i += 1;
+        }
+      }
+      scanCode(false);
+      return mask;
+    }
+    function atLineStart(code, start) {
+      let j = start - 1;
+      while (j >= 0 && (code[j] === " " || code[j] === "	"))
+        j--;
+      return j < 0 || code[j] === "\n" || code[j] === "\r";
+    }
+    function repairInboxHelperScalarDestructure(code) {
+      if (!code || code.indexOf("__vqaWaitForEmail") === -1)
+        return code;
+      const inLiteral = literalPositionMask(code);
+      const re = /\b(const|let|var)\s*\{\s*([A-Za-z_$][\w$]*)\s*(?::\s*([A-Za-z_$][\w$]*)\s*)?\}\s*=\s*await\s+__vqaWaitForEmail\s*\(\s*(['"`])(code|link)\4\s*\)/g;
+      let out = "";
+      let last = 0;
+      let m;
+      while ((m = re.exec(code)) !== null) {
+        const [full, decl, prop, alias, quote, kind] = m;
+        const start = m.index;
+        if (inLiteral[start] || !atLineStart(code, start) || prop !== kind)
+          continue;
+        out += code.slice(last, start);
+        out += `${decl} ${alias || prop} = await __vqaWaitForEmail(${quote}${kind}${quote})`;
+        last = start + full.length;
+      }
+      out += code.slice(last);
+      return out;
+    }
     function sanitizeCode(code, options) {
       let result = code;
       const isNetworkIdleWaitLine = (line) => /^\s*await page\.waitForLoadState\((['"])networkidle\1\);\s*$/.test(line);
@@ -96077,6 +96383,7 @@ ${testOpen}`;
       if (options?.authStamp) {
         result = (0, auth_recipe_js_1.upsertAuthBlock)(result, options.authStamp);
       }
+      result = repairInboxHelperScalarDestructure(result);
       try {
         result = (0, inbox_stamp_js_1.upsertInboxBlock)(result);
       } catch {
@@ -334538,6 +334845,8 @@ var require_discover_agent = __commonJS({
     var discover_planner_js_1 = require_discover_planner();
     var discover_generator_js_1 = require_discover_generator();
     var discover_ai_planner_js_1 = require_discover_ai_planner();
+    var discovery_lint_flags_js_1 = require_discovery_lint_flags();
+    var verification_inbox_js_1 = require_verification_inbox();
     var sitemap_builder_js_1 = require_sitemap_builder();
     Object.defineProperty(exports, "buildInMemorySiteMap", { enumerable: true, get: function() {
       return sitemap_builder_js_1.buildInMemorySiteMap;
@@ -334550,6 +334859,13 @@ var require_discover_agent = __commonJS({
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
     var canvas_detector_js_1 = require_canvas_detector();
     var auth_recipe_js_1 = require_auth_recipe();
+    function plannerEmailVerifyArmed(ctx) {
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)())
+        return false;
+      if (ctx.variableContext?.allTestVariables?.DISCOVERY_SHOULD_REGISTER !== "true")
+        return false;
+      return (0, verification_inbox_js_1.isVerificationInboxConfigured)();
+    }
     async function runCanvasPreflight(ctx, sharedBrowser, log2) {
       const cached = ctx.appRenderType ?? null;
       const engine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
@@ -335198,6 +335514,9 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           // instead of authoring landing→login steps (which generate would override).
           authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
           authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+          // Email-verify capability — only for scenario-producing modes; a survey emits
+          // featureGroups (no scenarios), so keep its prompt free of the round-trip block.
+          emailVerifyArmed: mode !== "survey" && plannerEmailVerifyArmed(ctx),
           testBudget
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -335782,6 +336101,12 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             // authenticated state when a verified login recipe is on file for this project.
             authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
             authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+            // Email-verify capability: when armed, let the planner plan the full
+            // register→verify and forgot-password→reset round trips to completion
+            // (see the planner's "## Verification Inbox Available" block). Armed on the
+            // SAME project-level predicate the generator uses (flag + register intent +
+            // configured inbox), so the planner never promises what generation can't do.
+            emailVerifyArmed: plannerEmailVerifyArmed(ctx),
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -349957,7 +350282,7 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.resolveRefFromSnapshot = exports.replayAuthRecipeIntoBrowser = exports.runRegisterCaptureRun = exports.runLoginCaptureRun = exports.filterLoginCaptureCredentials = exports.buildLoginCaptureCredentials = exports.isReservedRunnerEnvVar = exports.RESERVED_RUNNER_ENV_VARS = exports.AUTH_MARKER_VERSION = exports.buildHealAuthStamp = exports.extractAuthRegion = exports.upsertAuthBlock = exports.buildAuthRecipe = exports.commandToReplayStep = exports.buildReplayPlan = exports.absoluteRoute = exports.renderReplaySettleArrow = exports.renderReplayClickArrow = exports.renderAuthFn = exports.filterFeatureGroupsToPathScope = exports.isAuthFlowRoute = exports.deriveSurveyPathScope = exports.canonicalizeRoute = exports.codeUsesInboxHelper = exports.codeUsesTestInboxIdentity = exports.codeSelfProvisionsRegistration = exports.executeGrokPerBatchHeal = exports.executeGrokPerTestHeal = exports.headerVal = exports.classifyAuthType = exports.isTextExcerptable = exports.isStaticAssetByExt = exports.isApiCall = exports.buildApiCallSummary = exports.computeMobileHealOutcome = exports.detectMobileStepSecretLeak = exports.redactMobileSecretsFromText = exports.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports.executeMobileLiveHeal = exports.executeMobileTestWithHealing = exports.executeMobileScriptDrivenHeal = exports.prepareMobileScenarioAppState = exports.runMobileGeneratePhase = exports.runMobileAIPlanner = exports.buildMobileSiteMap = exports.formatMobileEvidenceForPlanner = exports.MOBILE_SCENARIO_SYSTEM_PROMPT = exports.MOBILE_SURVEY_SYSTEM_PROMPT = exports.runMobileExplorePhase = void 0;
     exports.MAX_MANIFEST_FILES = exports.toDiffSummary = exports.isLikelyTestFile = exports.sanitizeRepoRelPath = exports.sha256Hex = exports.hashFiles = exports.enumerateTestFiles = exports.buildNextManifest = exports.detectRepoSwitch = exports.classifyImportDiff = exports.parseImportManifest = exports.validateAuthoredMobileTest = exports.buildMobileRepoAuthorSystemRules = exports.buildMobileRepoAuthorKickoff = exports.buildMobileRepoAuthorContractMd = exports.REPO_ANALYSIS_SCHEMA_VERSION = exports.validateSourceEndpoints = exports.validateAuthoredTest = exports.validateRepoMapFile = exports.validateRepoMemoryFile = exports.buildTestingStandardsSection = exports.buildRepoAuthorSystemRules = exports.buildRepoAuthorKickoff = exports.buildRepoAuthorContractMd = exports.buildRepoMapSystemRules = exports.buildRepoMapKickoff = exports.buildRepoMapContractMd = exports.buildRepoMemorySystemRules = exports.buildRepoMemoryKickoff = exports.buildRepoMemoryContractMd = exports.runRepoAnalysisOnRunner = exports.MOBILE_IMPORT_SCHEMA_VERSION = exports.validateImportedMobileTest = exports.buildMobileImportSystemRules = exports.buildMobileImportKickoff = exports.buildMobileImportContractMd = exports.IMPORT_SCHEMA_VERSION = exports.validateImportResultFile = exports.validateImportedTest = exports.buildImportSystemRules = exports.buildImportKickoff = exports.buildImportContractMd = exports.MAX_ARCHIVE_BYTES = exports.isUnsafeEntryName = exports.extractZipSafely = exports.downloadArchiveCapped = exports.detectArchiveKind = exports.acquireRepoForImport = exports.runFrameworkImportOnRunner = exports.getAgenticEngine = void 0;
-    exports.UNSUPPORTED_RENDERER_PREFIX = exports.UnsupportedRendererError = exports.buildCanvasModeAuthoringAddendum = exports.buildUnsupportedRendererMessage = exports.modelSupportsVision = exports.decideCanvasStrategy = exports.decideAppRenderType = exports.detectCanvasApp = exports.detectRateLimitBlock = exports.isSafeCanonicalRedirect = exports.resolveBaseUrlPreflight = exports.checkBaseUrlRedirect = exports.stripJsonFences = exports.scrubCredentials = exports.withAIRetry = exports.snapshotMatchingChildren = exports.findNewChromiumChildPid = exports.killProcessTree = exports.gracefulCloseWithTreeKill = exports.liveBrowserRegistry = exports.REPO_SWITCH_REMOVED_FRACTION = void 0;
+    exports.BrokeredInboxReader = exports.applyPlusTag = exports.deriveProjectInboxTag = exports.deriveInboxTag = exports.loadVerificationInboxConfig = exports.VerificationInboxReader = exports.UNSUPPORTED_RENDERER_PREFIX = exports.UnsupportedRendererError = exports.buildCanvasModeAuthoringAddendum = exports.buildUnsupportedRendererMessage = exports.modelSupportsVision = exports.decideCanvasStrategy = exports.decideAppRenderType = exports.detectCanvasApp = exports.detectRateLimitBlock = exports.isSafeCanonicalRedirect = exports.resolveBaseUrlPreflight = exports.checkBaseUrlRedirect = exports.stripJsonFences = exports.scrubCredentials = exports.withAIRetry = exports.snapshotMatchingChildren = exports.findNewChromiumChildPid = exports.killProcessTree = exports.gracefulCloseWithTreeKill = exports.liveBrowserRegistry = exports.REPO_SWITCH_REMOVED_FRACTION = void 0;
     __exportStar(require_ai_provider(), exports);
     __exportStar(require_mobile_types(), exports);
     __exportStar(require_mobile_source_parser(), exports);
@@ -350379,6 +350704,26 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports, "UNSUPPORTED_RENDERER_PREFIX", { enumerable: true, get: function() {
       return canvas_detector_js_1.UNSUPPORTED_RENDERER_PREFIX;
     } });
+    var verification_inbox_js_1 = require_verification_inbox();
+    Object.defineProperty(exports, "VerificationInboxReader", { enumerable: true, get: function() {
+      return verification_inbox_js_1.VerificationInboxReader;
+    } });
+    Object.defineProperty(exports, "loadVerificationInboxConfig", { enumerable: true, get: function() {
+      return verification_inbox_js_1.loadVerificationInboxConfig;
+    } });
+    Object.defineProperty(exports, "deriveInboxTag", { enumerable: true, get: function() {
+      return verification_inbox_js_1.deriveInboxTag;
+    } });
+    Object.defineProperty(exports, "deriveProjectInboxTag", { enumerable: true, get: function() {
+      return verification_inbox_js_1.deriveProjectInboxTag;
+    } });
+    Object.defineProperty(exports, "applyPlusTag", { enumerable: true, get: function() {
+      return verification_inbox_js_1.applyPlusTag;
+    } });
+    var brokered_inbox_reader_js_1 = require_brokered_inbox_reader();
+    Object.defineProperty(exports, "BrokeredInboxReader", { enumerable: true, get: function() {
+      return brokered_inbox_reader_js_1.BrokeredInboxReader;
+    } });
   }
 });
 
@@ -350387,7 +350732,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.59",
+      version: "1.0.61",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -355470,7 +355815,13 @@ async function handleHealth(_req, res) {
     },
     devices,
     capabilities,
-    activeSession: state.appiumSessionId
+    activeSession: state.appiumSessionId,
+    // THIS runner's Appium is executing mobile (APPIUM) test run(s) right now.
+    // The web pre-flight reads this to warn before /bridge/session/start would
+    // 409 — it must never be inferred from server-side global run counts, which
+    // include unrelated projects and runners.
+    executorBusy: executorBusyCount > 0,
+    recordingActive: !!state.appiumSessionId && mirrorSessionOwner === "recording"
   });
 }
 function realDeviceCapabilities2(platform3) {
@@ -355545,7 +355896,11 @@ function validateSessionStartBody(body) {
 }
 async function handleDevices(_req, res) {
   const devices = discoverAllDevices({ includeApps: true });
-  sendJSON(res, 200, { devices });
+  sendJSON(res, 200, {
+    devices,
+    executorBusy: executorBusyCount > 0,
+    recordingActive: !!state.appiumSessionId && mirrorSessionOwner === "recording"
+  });
 }
 async function handleSessionStart(req, res) {
   const body = await parseBody(req);
@@ -358923,6 +359278,20 @@ ${finalVerifyResult.logs ?? ""}`;
         { ...input, actor: "ai-explorer" },
         run2.claimEpoch
       );
+      if (ctx.inboxBroker?.address) {
+        ctx.inboxBrokerRead = async (op, payload) => {
+          const res = await fetch(`${opts.serverUrl}/api/runner/inbox/read`, {
+            method: "POST",
+            headers: { ...headers, "Content-Type": "application/json" },
+            body: JSON.stringify({ runId: run2.runId, op, payload })
+          });
+          if (!res.ok) {
+            const detail = await res.text().catch(() => "");
+            throw new Error(`inbox broker ${op} failed: HTTP ${res.status}${detail ? ` \u2014 ${detail.slice(0, 200)}` : ""}`);
+          }
+          return (await res.json()).value ?? null;
+        };
+      }
       log.info(`Discovery (${ctx.mode}) on ${ctx.baseUrl}`);
       const { push: pushAudit, drain: drainAudit } = createAuditFlusher(
         `${opts.serverUrl}/api/runner/runs/${run2.runId}/ai-audit-batch`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.59",
+  "version": "1.0.61",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"