@validate.qa/runner 1.0.91 → 1.0.93

package/dist/cli.js

@@ -2038,7 +2038,8 @@ var init_project_key = __esm({
       "reviews",
       "admin",
       "login",
-      "admin-view"
+      "admin-view",
+      "mcp"
     ]);
     PROJECT_KEY_MIN_LENGTH = 2;
     PROJECT_KEY_MAX_LENGTH = 12;
@@ -3129,22 +3130,23 @@ function labelForTarget(target) {
   return nonEmpty2(target?.locatorBundle?.accessibilityId) ?? nonEmpty2(target?.locatorBundle?.text) ?? nonEmpty2(target?.locatorBundle?.contentDesc) ?? nonEmpty2(target?.primary);
 }
 function semanticTarget(label, platform3, base2) {
-  const primary = mobileTextXPath(label, platform3);
+  const textXPath = mobileTextXPath(label, platform3);
+  const primary = nonEmpty2(base2?.primary) ?? textXPath;
   return {
     primary,
     fallbacks: uniq([
+      ...base2?.fallbacks ?? [],
+      textXPath,
       `~${label}`,
-      label,
-      base2?.primary,
-      ...base2?.fallbacks ?? []
+      label
     ]).filter((value) => value !== primary),
     screenName: base2?.screenName ?? "HealedAssertion",
     locatorBundle: {
-      accessibilityId: label,
-      xpath: primary,
-      className: "",
-      text: label,
-      contentDesc: label,
+      accessibilityId: nonEmpty2(base2?.locatorBundle?.accessibilityId) ?? label,
+      xpath: nonEmpty2(base2?.locatorBundle?.xpath) ?? textXPath,
+      className: base2?.locatorBundle?.className ?? "",
+      text: nonEmpty2(base2?.locatorBundle?.text) ?? label,
+      contentDesc: nonEmpty2(base2?.locatorBundle?.contentDesc) ?? label,
       ...base2?.locatorBundle?.resourceId ? { resourceId: base2.locatorBundle.resourceId } : {}
     }
   };
@@ -3322,6 +3324,26 @@ var init_mobile_step_healer = __esm({
 });
 
 // ../shared/dist/mobile-cross-platform.js
+function androidActivityPackageOf(owner) {
+  const lastDot = owner.lastIndexOf(".");
+  if (lastDot <= 0)
+    return null;
+  return /^[A-Z]/.test(owner.slice(lastDot + 1)) ? owner.slice(0, lastDot) : null;
+}
+function mobileScreenOwnerBelongsToApp(owner, targetAppId) {
+  const ownerId = owner.trim();
+  const appId = targetAppId.trim();
+  if (!ownerId || !appId)
+    return false;
+  if (ownerId === appId)
+    return true;
+  if (ownerId.startsWith(`${appId}.`))
+    return true;
+  const activityPackage = androidActivityPackageOf(ownerId);
+  if (activityPackage && appId.startsWith(`${activityPackage}.`))
+    return true;
+  return false;
+}
 function isMobilePlatform(value) {
   return value === "IOS" || value === "ANDROID";
 }
@@ -6574,6 +6596,7 @@ __export(dist_exports, {
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
   mobileLocatorBundleHasIdentity: () => mobileLocatorBundleHasIdentity,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
+  mobileScreenOwnerBelongsToApp: () => mobileScreenOwnerBelongsToApp,
   mobileWanderTraceEnabled: () => mobileWanderTraceEnabled,
   normalizeControlName: () => normalizeControlName,
   normalizeTtsModel: () => normalizeTtsModel,
@@ -8532,6 +8555,127 @@ var require_scrub_credentials = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/google-signin.js
+var require_google_signin = __commonJS({
+  "../runner-core/dist/services/google-signin.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.GOOGLE_SIGNIN_ENV_KEYS = exports2.GOOGLE_SIGNIN_PASSWORD_KEY = void 0;
+    exports2.loadGoogleSignInConfig = loadGoogleSignInConfig;
+    exports2.mergeGoogleSignInSecrets = mergeGoogleSignInSecrets;
+    exports2.googleSignInGuidanceOpts = googleSignInGuidanceOpts;
+    exports2.googleSignInAllowedEmails = googleSignInAllowedEmails;
+    exports2.collectGoogleSignInEnv = collectGoogleSignInEnv;
+    exports2.generateTotp = generateTotp;
+    exports2.buildGoogleSignInPromptSection = buildGoogleSignInPromptSection;
+    var node_crypto_1 = require("crypto");
+    exports2.GOOGLE_SIGNIN_PASSWORD_KEY = "GOOGLE_SIGNIN_PASSWORD";
+    exports2.GOOGLE_SIGNIN_ENV_KEYS = [
+      "GOOGLE_SIGNIN_PASSWORD",
+      "GOOGLE_SIGNIN_EMAIL",
+      "GOOGLE_SIGNIN_TOTP_SECRET"
+    ];
+    function trimEnv(env, name) {
+      const value = env[name]?.trim();
+      return value ? value : void 0;
+    }
+    function loadGoogleSignInConfig(env = process.env) {
+      const password = trimEnv(env, "GOOGLE_SIGNIN_PASSWORD");
+      if (!password)
+        return null;
+      const email = (trimEnv(env, "GOOGLE_SIGNIN_EMAIL") ?? trimEnv(env, "VERIFICATION_INBOX_ADDRESS"))?.toLowerCase();
+      if (!email || !email.includes("@"))
+        return null;
+      const totpSecret = trimEnv(env, "GOOGLE_SIGNIN_TOTP_SECRET");
+      return {
+        email,
+        password,
+        passwordKey: exports2.GOOGLE_SIGNIN_PASSWORD_KEY,
+        totpSecret,
+        totpAvailable: !!totpSecret
+      };
+    }
+    function mergeGoogleSignInSecrets(credentials, env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      if (!cfg)
+        return credentials;
+      if (credentials[exports2.GOOGLE_SIGNIN_PASSWORD_KEY])
+        return credentials;
+      return { ...credentials, [exports2.GOOGLE_SIGNIN_PASSWORD_KEY]: cfg.password };
+    }
+    function googleSignInGuidanceOpts(env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      if (!cfg)
+        return void 0;
+      return {
+        googleEmail: cfg.email,
+        googlePasswordKey: cfg.passwordKey,
+        googleTotpAvailable: cfg.totpAvailable
+      };
+    }
+    function googleSignInAllowedEmails(env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      return cfg ? [cfg.email] : [];
+    }
+    function collectGoogleSignInEnv(env = process.env) {
+      const out = {};
+      for (const key of exports2.GOOGLE_SIGNIN_ENV_KEYS) {
+        const value = env[key]?.trim();
+        if (value)
+          out[key] = value;
+      }
+      return out;
+    }
+    function generateTotp(secret, atMs = Date.now(), stepSeconds = 30, digits = 6) {
+      const key = decodeBase32(secret);
+      const counter = Math.floor(atMs / 1e3 / stepSeconds);
+      const buf = Buffer.alloc(8);
+      buf.writeUInt32BE(Math.floor(counter / 4294967296), 0);
+      buf.writeUInt32BE(counter >>> 0, 4);
+      const hmac = (0, node_crypto_1.createHmac)("sha1", key).update(buf).digest();
+      const offset = hmac[hmac.length - 1] & 15;
+      const bin = (hmac[offset] & 127) << 24 | hmac[offset + 1] << 16 | hmac[offset + 2] << 8 | hmac[offset + 3];
+      const otp = bin % 10 ** digits;
+      return String(otp).padStart(digits, "0");
+    }
+    function decodeBase32(input) {
+      const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+      const cleaned = input.toUpperCase().replace(/[\s=-]+/g, "");
+      let bits = 0;
+      let value = 0;
+      const out = [];
+      for (const ch of cleaned) {
+        const idx = alphabet.indexOf(ch);
+        if (idx < 0)
+          continue;
+        value = value << 5 | idx;
+        bits += 5;
+        if (bits >= 8) {
+          bits -= 8;
+          out.push(value >>> bits & 255);
+        }
+      }
+      return Buffer.from(out);
+    }
+    function buildGoogleSignInPromptSection(opts, variant) {
+      const totpNative = opts.googleTotpAvailable ? " If Google asks for a 2-step / Authenticator code, call `provision_google_totp` and type the 6-digit `code` it returns (do not invent a code)." : " If Google asks for 2-step verification and you have no authenticator code tool, STOP and report Google SSO as BLOCKED (2FA not configured on this runner).";
+      const totpCli = opts.googleTotpAvailable ? " If Google asks for a 2-step / Authenticator code, call `inbox_google_totp` and type the 6-digit `code` it returns." : " If Google asks for 2-step verification, STOP and report Google SSO as BLOCKED (2FA not configured on this runner).";
+      const totp = variant === "cli" ? totpCli : totpNative;
+      const fill = variant === "cli" ? `fill_credential with credentialKey \`${opts.googlePasswordKey}\`` : `\`fill_credential\` (credentialKey \`${opts.googlePasswordKey}\`)`;
+      const plainProvision = variant === "cli" ? "`inbox_provision_identity` with `plain: true`" : "`provision_identity` with `plain: true`";
+      return `
+Google / Gmail SSO fallback (SECOND choice \u2014 email+password signup is FIRST):
+- FIRST follow the email-field playbook above whenever a signup form has an email / username / password field (including after clicking "Sign up with email"). Do NOT click Google if that form exists.
+- ONLY if there is no email+password signup field and the only path is "Continue with Google" / "Sign up with Gmail" / "Sign in with Google": click that button. If a Google popup opens, switch to it (browser tabs).
+- On accounts.google.com, type the BARE Google account email \`${opts.googleEmail}\` (no plus-tag \u2014 Google account login rejects plus-addresses) with browser_type, click Next, then fill the Google password with ${fill}. NEVER type the Google password as text and NEVER use the IMAP app password here.
+- Click Next.${totp}
+- Click Continue / Allow on any consent screen, then return to the app tab.
+- If the app then emails a verification code/link, first call ${plainProvision} (Google SSO uses the bare inbox address, not the +tag), then complete it with the inbox tools as usual.
+- Register / Google-sign-in ONCE per run. If Google says the account is already used on this app, that is success \u2014 continue as the logged-in user.`;
+    }
+  }
+});
+
 // ../runner-core/dist/services/credential-tools.js
 var require_credential_tools = __commonJS({
   "../runner-core/dist/services/credential-tools.js"(exports2) {
@@ -8550,6 +8694,7 @@ var require_credential_tools = __commonJS({
     exports2.mcpResultIsError = mcpResultIsError;
     exports2.aggressiveScrubCredentials = aggressiveScrubCredentials;
     var scrub_credentials_js_1 = require_scrub_credentials();
+    var google_signin_js_1 = require_google_signin();
     exports2.FILL_CREDENTIAL_TOOL = {
       type: "function",
       function: {
@@ -8560,7 +8705,7 @@ var require_credential_tools = __commonJS({
           properties: {
             credentialKey: {
               type: "string",
-              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD", "TEST_ADMIN_EMAIL"). Must be one of the keys listed in the Test Credentials section of the prompt.'
+              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD", "GOOGLE_SIGNIN_PASSWORD"). Must be one of the keys listed in the Test Credentials section of the prompt.'
             },
             element: {
               type: "string",
@@ -8583,7 +8728,7 @@ var require_credential_tools = __commonJS({
       type: "function",
       function: {
         name: "set_credential",
-        description: 'Persist a NEW value for a stored credential after a test has successfully rotated it (e.g. "change password" flow). Call this AFTER you have verified the change succeeded (e.g. the new password actually works for login, or the success toast is visible). The runner updates the project test variable, fires a CREDENTIAL_UPDATED notification, and the new value is used by all subsequent tests. Never call this on a negative test (one that verifies wrong-credential is rejected) and never call it speculatively before submit+verify. The new value you supply MUST be the value you typed into the page \u2014 the runner does not re-read it from the DOM. Only call for keys already present in the Test Credentials section.',
+        description: 'Persist a NEW value for a stored credential after a test has successfully rotated it. REQUIRED after any successful password change OR forgot-password/reset of the STORED test user (the account whose email is TEST_USER_EMAIL) so Test Data stays in sync and later tests do not fail with stale credentials. Also use after in-session "change password" from settings. Call this AFTER you have verified the change succeeded (success toast, re-login with the new value, or confirmed post-reset state). The runner updates the project test variable, fires a CREDENTIAL_UPDATED notification, and the new value is used by all subsequent tests. Never call this on a negative test (one that verifies wrong-credential is rejected) and never call it speculatively before submit+verify. The new value you supply MUST be the value you typed into the page \u2014 the runner does not re-read it from the DOM. Only call for keys already present in the Test Credentials section.',
         parameters: {
           type: "object",
           properties: {
@@ -8597,7 +8742,7 @@ var require_credential_tools = __commonJS({
             },
             reason: {
               type: "string",
-              description: 'Short human-readable explanation of why the credential changed (e.g. "User changed password from settings page"). Surfaced in the notification.'
+              description: 'Short human-readable explanation of why the credential changed (e.g. "User changed password from settings page" or "Password reset completed for stored test user"). Surfaced in the notification.'
             }
           },
           required: ["credentialKey", "newValue"]
@@ -8659,12 +8804,13 @@ SECURITY RULES:
 - NEVER include credential values in \`capture_page\` observations, \`record_journey\` steps, \`record_transition\` triggerLabel, or any summary text. (You can't \u2014 they're not in your context \u2014 but do not invent placeholder values either; describe the action as "Fill email with test credentials".)
 - Registration flows that need a UNIQUE email (e.g. \`testuser-\${Date.now()}@example.com\`) should still use \`browser_type\` with a synthetic value \u2014 \`fill_credential\` is only for stored login credentials.
 ${opts.canRotate ? `
-CREDENTIAL ROTATION (rare \u2014 read this carefully):
-- The ONLY time to call \`set_credential\` is when the test:
-  (1) logs in as the STORED test user (the one whose credential is in the list above \u2014 e.g. logged in via \`fill_credential\` with TEST_USER_EMAIL / TEST_USER_PASSWORD), AND
-  (2) successfully changes THAT SAME user's credential (password change from their settings page, admin resetting their own token, etc.), AND
-  (3) you have proof the change took effect (success toast visible, re-login with the new value works, etc.).
-- DO NOT call \`set_credential\` if the test registered a fresh user (e.g. \`testuser-\${Date.now()}@example.com\`) and changed THAT user's password \u2014 the fresh user is throwaway and not tracked anywhere. The stored credential is unchanged in that case.
+CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read carefully):
+- You MUST call \`set_credential\` when the test successfully changes a secret belonging to the STORED test user (the account whose keys are listed above \u2014 typically TEST_USER_EMAIL / TEST_USER_PASSWORD). Covered flows:
+  (1) **In-session change password** \u2014 log in as the stored user, open settings \u2192 Change Password, submit a new password, verify success; OR
+  (2) **Forgot-password / password-reset of the stored user** \u2014 request reset for the stored email (fill_credential with TEST_USER_EMAIL on the forgot-password form), complete the emailed link/code, set a NEW password on the reset form, and verify success. You do NOT need to log in with the old password first \u2014 a successful reset of the stored account still MUST write the new password back.
+- After either flow succeeds, call \`set_credential\` with credentialKey \`TEST_USER_PASSWORD\` (or the matching stored password key) and newValue = the new password you typed. This updates the Test Data page so every later test uses the correct credentials.
+- Proof required before calling: success toast / confirmed reset state / re-login with the new value works.
+- DO NOT call \`set_credential\` if the test registered a fresh throwaway user (e.g. \`testuser-\${Date.now()}@example.com\` or a provision_identity inbox used only for a one-off signup) and changed THAT user's password \u2014 the stored credential is untouched in that case.
 - DO NOT call \`set_credential\` on a negative test (one that verifies a bad/mismatched password is rejected, or a permission-denied case).
 - DO NOT call it before submit + verify \u2014 a partial failure would corrupt the stored credential.
 - Call it AT MOST ONCE per test, AFTER verification. The \`newValue\` is the value you just typed into the new-password / new-token field; the runner persists it server-side and never echoes it back.
@@ -8825,6 +8971,14 @@ CREDENTIAL ROTATION (rare \u2014 read this carefully):
           didMutate: false
         };
       }
+      if (key === google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY) {
+        return {
+          content: JSON.stringify({
+            error: "set_credential: GOOGLE_SIGNIN_PASSWORD is a runner-operator secret and cannot be persisted to project Test Data"
+          }),
+          didMutate: false
+        };
+      }
       if (!(key in ctx.credentials)) {
         const available = Object.keys(ctx.credentials).filter((k) => ctx.credentials[k]).join(", ") || "(none configured)";
         return {
@@ -74086,7 +74240,7 @@ var require_inbox_tools = __commonJS({
   "../runner-core/dist/services/inbox-tools.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = exports2.INBOX_TOOL_NAMES = exports2.INBOX_TOOLS = exports2.OPEN_VERIFICATION_LINK_TOOL = exports2.GET_VERIFICATION_LINK_TOOL = exports2.EXTRACT_VERIFICATION_CODE_TOOL = exports2.READ_VERIFICATION_EMAIL_TOOL = exports2.WAIT_FOR_VERIFICATION_TOOL = exports2.CHECK_INBOX_TOOL = exports2.PROVISION_IDENTITY_TOOL = void 0;
+    exports2.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = exports2.INBOX_TOOL_NAMES = exports2.INBOX_TOOLS = exports2.PROVISION_GOOGLE_TOTP_TOOL = exports2.OPEN_VERIFICATION_LINK_TOOL = exports2.GET_VERIFICATION_LINK_TOOL = exports2.EXTRACT_VERIFICATION_CODE_TOOL = exports2.READ_VERIFICATION_EMAIL_TOOL = exports2.WAIT_FOR_VERIFICATION_TOOL = exports2.CHECK_INBOX_TOOL = exports2.PROVISION_IDENTITY_TOOL = void 0;
     exports2.createInboxRunState = createInboxRunState;
     exports2.dispatchInboxTool = dispatchInboxTool;
     exports2.isPublicHttpUrl = isPublicHttpUrl;
@@ -74101,6 +74255,7 @@ var require_inbox_tools = __commonJS({
     exports2.clearThrowawayRegisterSeed = clearThrowawayRegisterSeed;
     exports2.buildInboxAgentsGuidance = buildInboxAgentsGuidance;
     var verification_inbox_js_1 = require_verification_inbox();
+    var google_signin_js_1 = require_google_signin();
     function createInboxRunState(config, opts = {}) {
       const baseEmail = config.address;
       const tag = opts.tag !== void 0 ? opts.tag : opts.tagSeed ? (0, verification_inbox_js_1.deriveProjectInboxTag)(opts.tagSeed, opts.projectScope) : null;
@@ -74222,6 +74377,14 @@ var require_inbox_tools = __commonJS({
         }
       }
     };
+    exports2.PROVISION_GOOGLE_TOTP_TOOL = {
+      type: "function",
+      function: {
+        name: "provision_google_totp",
+        description: "Return a one-time 6-digit Authenticator code for the operator Google account. Call this ONLY when Google Sign-In shows a 2-step / Authenticator challenge after you submitted the Google password. Type the returned code into the Google prompt. Do not invent a code.",
+        parameters: { type: "object", properties: {} }
+      }
+    };
     exports2.INBOX_TOOLS = [
       exports2.PROVISION_IDENTITY_TOOL,
       exports2.CHECK_INBOX_TOOL,
@@ -74229,7 +74392,8 @@ var require_inbox_tools = __commonJS({
       exports2.READ_VERIFICATION_EMAIL_TOOL,
       exports2.EXTRACT_VERIFICATION_CODE_TOOL,
       exports2.GET_VERIFICATION_LINK_TOOL,
-      exports2.OPEN_VERIFICATION_LINK_TOOL
+      exports2.OPEN_VERIFICATION_LINK_TOOL,
+      exports2.PROVISION_GOOGLE_TOTP_TOOL
     ];
     exports2.INBOX_TOOL_NAMES = new Set(exports2.INBOX_TOOLS.map((t) => t.function.name));
     var DEFAULT_MAX_RESULT_CHARS = 8e3;
@@ -74241,7 +74405,7 @@ var require_inbox_tools = __commonJS({
     }
     var INBOX_AUTH_DEAD_GUIDANCE = "the inbox authentication is PERMANENTLY rejected (revoked/wrong app password) \u2014 STOP calling inbox tools; none of them can succeed this run. Treat email verification as UNAVAILABLE: hard-stop at any emailed code/link wall, NEVER type a guessed code, and report verification-gated flows as BLOCKED (blockedReason: inbox authentication failed). Continue with publicly reachable coverage.";
     async function dispatchInboxTool(toolName, toolArgs, ctx) {
-      if (ctx.state.authDead) {
+      if (ctx.state.authDead && toolName !== "provision_google_totp") {
         return err(`${toolName} skipped: ${INBOX_AUTH_DEAD_GUIDANCE}`);
       }
       try {
@@ -74260,6 +74424,8 @@ var require_inbox_tools = __commonJS({
             return await handleGetLink(toolArgs, ctx);
           case "open_verification_link":
             return await handleOpenLink(toolArgs, ctx);
+          case "provision_google_totp":
+            return handleProvisionGoogleTotp();
           default:
             return err(`inbox dispatch: unknown tool "${toolName}"`);
         }
@@ -74435,6 +74601,20 @@ var require_inbox_tools = __commonJS({
         didMutate: !failed
       };
     }
+    function handleProvisionGoogleTotp(env = process.env) {
+      const cfg = (0, google_signin_js_1.loadGoogleSignInConfig)(env);
+      if (!cfg) {
+        return err("Google SSO is not configured on this runner (GOOGLE_SIGNIN_PASSWORD unset). Prefer email-field signup, or report Google SSO as BLOCKED.");
+      }
+      if (!cfg.totpSecret) {
+        return err("Google Authenticator 2FA is not configured on this runner (GOOGLE_SIGNIN_TOTP_SECRET unset). STOP and report Google SSO as BLOCKED (2FA not configured).");
+      }
+      return ok({
+        code: (0, google_signin_js_1.generateTotp)(cfg.totpSecret),
+        digits: 6,
+        instructions: "Type this 6-digit code into the Google 2-step / Authenticator prompt. Do not reuse it later \u2014 call this tool again if Google asks for another code."
+      });
+    }
     function requireProvisioned(ctx) {
       if (ctx.state.provisioned)
         return null;
@@ -74569,7 +74749,7 @@ var require_inbox_tools = __commonJS({
 ${where} You register using ONE real, monitored email (\`${opts.email}\`) and can complete email-verification (OTP code or confirmation link) end-to-end. This OVERRIDES the general "do not submit forms" rule for the signup/registration form ONLY.
 
 Steps:
-1. Navigate to the Sign Up / Register page (click the link in the UI).
+1. Navigate to the Sign Up / Register page (click the link in the UI). FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
 2. Call \`provision_identity\` \u2192 it returns the email to register with (\`${opts.email}\`). The \`+\` part is a normal sub-address that still lands in our inbox.
 3. Fill the signup form: type that email into the email field with \`browser_type\` (this generated inbox email is intentionally visible and is allowed for registration); fill the password field with single-field \`fill_credential\` (credentialKey \`${opts.passwordKey}\`); fill any name/other required fields with simple test values. Do NOT use \`fill_credential_form\` for registration.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`provision_identity\` again with \`plain: true\` and use the bare address it returns instead.
@@ -74587,6 +74767,11 @@ Rules:
 - The provisioned email is reused for this project; if signup says it is ALREADY registered, the account already exists \u2014 log in with that email + the \`${opts.passwordKey}\` password instead of registering again.
 - You register ONCE per run. After you submit the signup form in step 4, NEVER submit it again and NEVER create a second account \u2014 even if verification is slow, even if a later login attempt fails. Recover by re-polling \`wait_for_verification\` (and at most one "Resend"), not by re-registering.
 - Only call the verification tools AFTER submitting the signup form, and pass the site as \`senderMatch\` so you read YOUR verification email (the inbox is shared).
+${opts.googleEmail && opts.googlePasswordKey ? (0, google_signin_js_1.buildGoogleSignInPromptSection)({
+        googleEmail: opts.googleEmail,
+        googlePasswordKey: opts.googlePasswordKey,
+        googleTotpAvailable: opts.googleTotpAvailable
+      }, "native") : ""}
 `;
     }
     exports2.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = `## EMAIL VERIFICATION UNAVAILABLE \u2014 FINAL OVERRIDE (supersedes any instruction above)
@@ -74741,11 +74926,12 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       }
       return false;
     }
-    function buildInboxAgentsGuidance(email, passwordKey) {
+    function buildInboxAgentsGuidance(email, passwordKey, google) {
+      const googleBlock = google ? (0, google_signin_js_1.buildGoogleSignInPromptSection)(google, "cli") : "";
       return `## Account registration & email verification (ENABLED)
 This run registers a new account using our ONE real, monitored inbox (the address \`${email}\` \u2014 the "+" part is a normal sub-address that still lands in our inbox) and can complete email verification end-to-end. This overrides any "do not submit forms" guidance for the signup form only.
 
-1. Go to the Sign Up / Register page.
+1. Go to the Sign Up / Register page. FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
 2. Call \`inbox_provision_identity\` \u2192 it returns the email to register with (\`${email}\`). Type that email into the email field.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`inbox_provision_identity\` with \`plain: true\` and use the bare address it returns instead.
 3. Fill the password with the \`${passwordKey}\` credential (use fill_credential). Submit the signup form.
@@ -74756,6 +74942,7 @@ This run registers a new account using our ONE real, monitored inbox (the addres
    - If it returns BOTH, try the code first; if the app insists on the link, open it, then enter the code if the page it lands on asks for one.
    - Otherwise call \`inbox_read_email\` to read the body.
 5. NEVER invent an email address \u2014 always use exactly what \`inbox_provision_identity\` returns. The address is reused for this project; if signup says it is already registered, log in with it + \`${passwordKey}\` instead. Register ONCE per run \u2014 never submit signup twice or make a second account; if verification is slow, re-poll \`inbox_wait_for_verification\` (at most one Resend) instead of re-registering.
+${googleBlock}
 `;
     }
   }
@@ -75739,7 +75926,7 @@ Rules:
 - Register ONCE per run. If signup says the account ALREADY exists, log in with that email + the \`${opts.passwordKey}\` password instead of registering again.
 - Only call the verification tools AFTER submitting the signup form; pass the app as \`senderMatch\` (the inbox is shared).`;
     }
-    function buildSystemPrompt(mode, platform3, enableRecordJourney, maxIterations, appBrief, targetAppId, existingScreens, incremental) {
+    function buildSystemPrompt(mode, platform3, enableRecordJourney, maxIterations, appBrief, targetAppId, existingScreens, incremental, knowledgeContext) {
       const platformLabel = platform3 === "IOS" ? "iOS" : "Android";
       const targetLine = targetAppId ? ` Target app package/bundle: ${targetAppId}.` : "";
       const surveyBody = `You are a mobile QA exploration agent driving a real ${platformLabel} app on a connected device. Your goal: MAP every reachable screen so downstream agents know what to test. You are NOT testing \u2014 you are building a complete screen map.
@@ -75784,12 +75971,18 @@ Max iterations: ${maxIterations}. You will be warned near the end.`;
 ## Application Brief
 ${appBrief}
 Use this to prioritize which screens and flows to cover.` : "";
+      const facts = knowledgeContext?.trim();
+      const knowledgeBlock = facts ? `
+
+## Known Facts (project documents \u2014 optional)
+${facts.slice(0, 4e3)}
+Prioritize exploring surfaces related to these facts when visible. If absent, explore solely from live UI. Never invent screens from facts alone.` : "";
       const existingScreensBlock = mode === "survey" && incremental && existingScreens && existingScreens.length > 0 ? `
 
 ## ALREADY DISCOVERED SCREENS (skip these; find new)
 These screens were mapped in a previous survey. Do NOT re-map them \u2014 use your budget to find NEW screens and flows not listed here. If you land on one of these, move on to something new.
 ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.name}"` : ""}${s.screenType ? ` [${s.screenType}]` : ""}`).join("\n")}` : "";
-      return `${mode === "survey" ? surveyBody : deepBody}${briefBlock}${existingScreensBlock}`;
+      return `${mode === "survey" ? surveyBody : deepBody}${briefBlock}${knowledgeBlock}${existingScreensBlock}`;
     }
     function buildKickoffMessage(mode) {
       return mode === "survey" ? "Start with mobile_snapshot on the launch screen. Driver observations are saved automatically; use capture_screen only to give important stable destinations useful names. Map the entire app: open every tab, menu, and one row per list. Record transitions as you go." : "Start by calling mobile_snapshot on the launch screen and capture_screen it. Then use the features: fill fields, submit forms, open menus, and observe outcomes. Capture each distinct screen and record journeys after meaningful flows.";
@@ -76189,7 +76382,7 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       if (authTracker.required) {
         log2(`Authenticated survey completion gate enabled (${ctx.target?.resetPolicy ?? "AUTO"}): the run must reach a structurally observed product surface before planning.`);
       }
-      const systemPrompt = buildSystemPrompt(mode, platform3, enableRecordJourney, maxIterations, ctx.appBrief, targetAppId, existingScreens, ctx.incremental) + (!registerRequested ? buildMobileCredentialPromptBlock(credentialSecrets) : "") + (inboxEnabled && inboxState ? buildMobileInboxPromptBlock({
+      const systemPrompt = buildSystemPrompt(mode, platform3, enableRecordJourney, maxIterations, ctx.appBrief, targetAppId, existingScreens, ctx.incremental, ctx.knowledgeContext) + (!registerRequested ? buildMobileCredentialPromptBlock(credentialSecrets) : "") + (inboxEnabled && inboxState ? buildMobileInboxPromptBlock({
         email: inboxState.email,
         passwordKey: inboxState.passwordKey ?? "TEST_USER_PASSWORD",
         context: mode
@@ -80357,8 +80550,10 @@ var require_scenario_taxonomy = __commonJS({
     exports2.inferScenarioKind = inferScenarioKind;
     exports2.inferScenarioKinds = inferScenarioKinds;
     exports2.isStrongOracleKind = isStrongOracleKind;
+    exports2.kindRequiresStateDelta = kindRequiresStateDelta;
     exports2.formatRequiredScenarioKindsPrompt = formatRequiredScenarioKindsPrompt;
     exports2.formatCoverageGapLog = formatCoverageGapLog;
+    exports2.synthesizeScenariosForMissingKinds = synthesizeScenariosForMissingKinds;
     exports2.ALL_SCENARIO_KINDS = [
       "smoke_nav",
       "happy_submit",
@@ -80369,7 +80564,9 @@ var require_scenario_taxonomy = __commonJS({
       "auth_session",
       "navigation_integrity",
       "permission_system",
-      "double_submit"
+      "double_submit",
+      "search_filter",
+      "list_refresh"
     ];
     var DELETE_RE = /\b(delete|remove|archive|trash)\b/i;
     var EMAIL_RE = /\b(e-?mail|email address)\b/i;
@@ -80381,7 +80578,12 @@ var require_scenario_taxonomy = __commonJS({
     var BADGE_LABEL_RE = /\b(badge|count|open invoices|unread|notifications?)\b/i;
     var PERMISSION_RE = /\b(camera|microphone|location|photos?|permission|allow access|not now)\b/i;
     var SETTINGS_RE = /\b(settings|preferences|profile|account)\b/i;
-    var TAB_RE = /\b(tab|home|catalog|forms|edges|inbox|feed|dashboard)\b/i;
+    var TAB_RE = /\b(tab|home|inbox|feed|dashboard)\b/i;
+    var SEARCH_RE = /\b(search|filter|find|query)\b/i;
+    var EMPTY_STATE_RE = /\b(no items|nothing here|empty|get started|add first|create first|no results)\b/i;
+    var EMPTY_CTA_RE = /\b(add first|create first|get started|add item|new item)\b/i;
+    var REFRESH_RE = /\b(pull to refresh|pull-to-refresh|refresh|updated:)\b/i;
+    var FAVORITE_RE = /\b(favorite|favourite|heart|bookmark|star|like)\b/i;
     function elementText(el) {
       return [
         el.label ?? "",
@@ -80419,6 +80621,10 @@ var require_scenario_taxonomy = __commonJS({
       let hasPrimarySubmit = false;
       let hasTabOrDrawerNav = false;
       let hasPermissionCopy = false;
+      let hasSearchField = false;
+      let hasEmptyStateCta = false;
+      let hasPullToRefresh = false;
+      let hasFavoriteToggle = false;
       for (const state2 of screens) {
         const labels = state2.elements.map(elementText);
         const blob = [state2.screenName ?? "", state2.screenType ?? "", ...state2.observations ?? [], ...labels].join(" ");
@@ -80450,6 +80656,17 @@ var require_scenario_taxonomy = __commonJS({
         }
         if (PERMISSION_RE.test(blob) || state2.screenType === "PERMISSION")
           hasPermissionCopy = true;
+        if (SEARCH_RE.test(blob) || state2.elements.some((el) => isEditable(el) && SEARCH_RE.test(elementText(el))) || state2.elements.some((el) => el.role === "searchbox" || /SearchView|SearchBar/i.test(el.role ?? ""))) {
+          hasSearchField = true;
+        }
+        if (EMPTY_STATE_RE.test(blob) && (EMPTY_CTA_RE.test(blob) || labels.some((t) => EMPTY_CTA_RE.test(t)))) {
+          hasEmptyStateCta = true;
+        }
+        if (REFRESH_RE.test(blob))
+          hasPullToRefresh = true;
+        if (FAVORITE_RE.test(blob) || state2.elements.some((el) => FAVORITE_RE.test(elementText(el)) && el.actionable !== false)) {
+          hasFavoriteToggle = true;
+        }
       }
       return {
         hasListWithRowActions,
@@ -80461,7 +80678,11 @@ var require_scenario_taxonomy = __commonJS({
         hasDestructiveConfirm,
         hasPrimarySubmit,
         hasTabOrDrawerNav,
-        hasPermissionCopy
+        hasPermissionCopy,
+        hasSearchField,
+        hasEmptyStateCta,
+        hasPullToRefresh,
+        hasFavoriteToggle
       };
     }
     function requiredScenarioKinds(signals) {
@@ -80478,13 +80699,13 @@ var require_scenario_taxonomy = __commonJS({
       if (signals.hasNumericBadge) {
         kinds.add("count_delta");
       }
-      if (signals.hasSettingsToggles) {
+      if (signals.hasSettingsToggles || signals.hasFavoriteToggle) {
         kinds.add("persistence_roundtrip");
       }
       if (signals.hasSignOut) {
         kinds.add("auth_session");
       }
-      if (signals.hasTabOrDrawerNav) {
+      if (signals.hasTabOrDrawerNav || signals.hasEmptyStateCta) {
         kinds.add("navigation_integrity");
       }
       if (signals.hasPermissionCopy) {
@@ -80493,6 +80714,12 @@ var require_scenario_taxonomy = __commonJS({
       if (signals.hasPrimarySubmit && signals.hasFormFields) {
         kinds.add("double_submit");
       }
+      if (signals.hasSearchField) {
+        kinds.add("search_filter");
+      }
+      if (signals.hasPullToRefresh) {
+        kinds.add("list_refresh");
+      }
       return exports2.ALL_SCENARIO_KINDS.filter((k) => kinds.has(k));
     }
     function coverageGaps(signals, plannedKinds) {
@@ -80507,6 +80734,12 @@ var require_scenario_taxonomy = __commonJS({
       if (/\b(delete|remove|wrong row|entity|archive)\b/.test(text) && /\b(list|row|item|record)\b/.test(text)) {
         return "crud_identity";
       }
+      if (/\b(pull.?to.?refresh|refresh list|list refresh|after refresh)\b/.test(text)) {
+        return "list_refresh";
+      }
+      if (/\b(search|filter results|query)\b/.test(text)) {
+        return "search_filter";
+      }
       if (/\b(badge|count|unread|open invoices|\+\d|increment|decrement)\b/.test(text)) {
         return "count_delta";
       }
@@ -80516,7 +80749,7 @@ var require_scenario_taxonomy = __commonJS({
       if (/\b(sign\s*out|log\s*out|session|sign\s*in|remember me|auth)\b/.test(text) || scenario.type === "HAPPY_PATH" && /\b(login|sign in)\b/.test(text)) {
         return "auth_session";
       }
-      if (/\b(tab|navigate|navigation|back|deep link|empty.?state)\b/.test(text)) {
+      if (/\b(tab|navigate|navigation|back|deep link|empty.?state|empty cta|dead route)\b/.test(text)) {
         return "navigation_integrity";
       }
       if (/\b(permission|camera|microphone|location|allow)\b/.test(text)) {
@@ -80539,6 +80772,9 @@ var require_scenario_taxonomy = __commonJS({
     function isStrongOracleKind(kind) {
       return kind !== "smoke_nav" && kind !== "navigation_integrity";
     }
+    function kindRequiresStateDelta(kind) {
+      return kind === "crud_identity" || kind === "count_delta" || kind === "persistence_roundtrip" || kind === "double_submit" || kind === "list_refresh" || kind === "search_filter";
+    }
     function formatRequiredScenarioKindsPrompt(signals) {
       const required = requiredScenarioKinds(signals);
       if (required.length === 0)
@@ -80565,17 +80801,280 @@ var require_scenario_taxonomy = __commonJS({
             return "- permission_system: permission prompt or settings path behaves honestly (allow/deny/settings)";
           case "double_submit":
             return "- double_submit: single user intent must not double-create (assert count +1 not +2, or single confirmation)";
+          case "search_filter":
+            return "- search_filter: type a distinctive query observed on-device, assert the result set filters (row count/labels change); empty query restores or shows empty-state honestly";
+          case "list_refresh":
+            return "- list_refresh: capture list ids/count, pull-to-refresh or tap Refresh, assert list still coherent (not permanently wiped) OR honest empty + recoverable";
           default:
             return `- ${kind}`;
         }
       });
-      return "## Required scenario kinds (from observed UI \u2014 fill each or explain impossibility in reasoning)\nThese kinds are derived ONLY from controls/screens the explorer saw. Plan at least one scenario per kind when evidence supports it.\n" + lines.join("\n");
+      return "## Required scenario kinds (from observed UI \u2014 fill each or explain impossibility in reasoning)\nThese kinds are derived ONLY from controls/screens the explorer saw. Plan at least one scenario per kind when evidence supports it.\nCap pure smoke_nav to ONE scenario per feature. Prefer strong kinds when signals require them.\nAuth credential validation (empty/wrong/malformed login) belongs ONLY on Authentication/Sign-in features \u2014 elsewhere login is setup, not a scenario.\nIf a scenario name claims delete/count/persist/refresh, expectedOutcomes MUST require before/after state proof (capture + delta), not tab chrome.\n" + lines.join("\n");
     }
     function formatCoverageGapLog(gaps) {
       if (gaps.length === 0)
         return "Scenario taxonomy: all required kinds covered by plan";
       return `Scenario taxonomy coverage gaps (required but not planned): ${gaps.join(", ")}`;
     }
+    function synthesizeScenariosForMissingKinds(input) {
+      const feature = input.featureName.trim() || "Feature";
+      const used = input.existingNames ?? /* @__PURE__ */ new Set();
+      const maxNew = Math.max(1, input.maxNew ?? 6);
+      const pages = input.targetPages.length > 0 ? input.targetPages : [input.entryRoute];
+      const entry = input.entryRoute || pages[0] || "";
+      const out = [];
+      for (const kind of input.gaps) {
+        if (out.length >= maxNew)
+          break;
+        if (kind === "smoke_nav")
+          continue;
+        const draft = scenarioStubForKind(kind, feature, entry, pages);
+        if (!draft)
+          continue;
+        let name = draft.name;
+        let n = 2;
+        while (used.has(name.toLowerCase())) {
+          name = `${draft.name} (${n})`;
+          n += 1;
+          if (n > 20)
+            break;
+        }
+        if (used.has(name.toLowerCase()))
+          continue;
+        used.add(name.toLowerCase());
+        out.push({ ...draft, name });
+      }
+      return out;
+    }
+    function scenarioStubForKind(kind, feature, entryRoute, targetPages) {
+      const base2 = {
+        featureGroup: feature,
+        entryRoute,
+        startFromLanding: true,
+        targetPages: [...targetPages],
+        evidence: {
+          observedLocators: [],
+          observedTransitions: []
+        },
+        prerequisites: [],
+        isAISuggested: false
+      };
+      const step = (action, target) => ({ action, target });
+      const outcome = (type, description) => ({ type, description, reliability: "medium" });
+      switch (kind) {
+        case "crud_identity":
+          return {
+            ...base2,
+            name: `${feature} - Delete entity proves identity removed`,
+            type: "HAPPY_PATH",
+            priority: 1,
+            variant: "happy",
+            goal: "Capture list/entity identity, delete or remove that entity, prove the identity set changed (not merely that the list screen is still visible)",
+            steps: [
+              step("Launch the app and sign in if the product requires a session", entryRoute),
+              step(`Navigate to the ${feature} list or collection screen`),
+              step("Capture visible row/entity identifiers into a state bag before mutation"),
+              step("Perform delete/remove/archive on one specific observed entity"),
+              step("Assert state delta: that entity identity is gone or the wrong neighbor was not removed")
+            ],
+            expectedOutcomes: [
+              outcome("element-hidden", "Target entity identity no longer present in the list"),
+              outcome("element-visible", "List or collection still reachable after mutation")
+            ]
+          };
+        case "count_delta":
+          return {
+            ...base2,
+            name: `${feature} - Count or badge changes after action`,
+            type: "HAPPY_PATH",
+            priority: 1,
+            variant: "happy",
+            goal: "Capture a numeric badge or count, perform a product action, assert the number changed as expected",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate to the ${feature} surface showing a count or badge`),
+              step("Capture the numeric count/badge into a state bag"),
+              step("Perform an action that should change the count (add, remove, mark read, complete)"),
+              step("Assert state delta: count increased or decreased as expected")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "Count or badge reflects the post-action value")
+            ]
+          };
+        case "persistence_roundtrip":
+          return {
+            ...base2,
+            name: `${feature} - Change persists after leave and return`,
+            type: "HAPPY_PATH",
+            priority: 1,
+            variant: "happy",
+            goal: "Change a setting, toggle, or favorite; leave the screen; return; prove the value persisted or honestly reset",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate to the ${feature} settings or toggle surface`),
+              step("Capture current field/toggle/favorite state"),
+              step("Change a durable control (toggle, text field, favorite) and save if required"),
+              step("Navigate away to another tab or parent screen"),
+              step("Return to the same surface"),
+              step("Assert state delta: value persisted (or product honestly shows it did not)")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "Changed value is still reflected after round-trip")
+            ]
+          };
+        case "negative_validation":
+          return {
+            ...base2,
+            name: `${feature} - Invalid or empty input is rejected`,
+            type: "EDGE_CASE",
+            priority: 2,
+            variant: "validation",
+            goal: "Submit empty or malformed input and assert error feedback or blocked submit \u2014 never invent success",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate to the ${feature} form`),
+              step("Leave required fields empty or type structurally invalid input (e.g. email-like field without a domain)"),
+              step("Attempt submit"),
+              step("Assert validation error is visible OR submit remains blocked on the form")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "Validation error or blocked submit state is visible")
+            ]
+          };
+        case "happy_submit":
+          return {
+            ...base2,
+            name: `${feature} - Happy path durable submit`,
+            type: "HAPPY_PATH",
+            priority: 1,
+            variant: "happy",
+            goal: "Complete the primary form/action and assert a durable product result (new row, saved state, confirmation that outlives a toast)",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate to the ${feature} form or primary action`),
+              step("Fill required fields with run-scoped values"),
+              step("Submit or save"),
+              step("Assert durable outcome (new row, success state, or persisted values)")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "Durable success result is visible")
+            ]
+          };
+        case "auth_session":
+          return {
+            ...base2,
+            name: `${feature} - Session proof after sign-in or sign-out`,
+            type: "HAPPY_PATH",
+            priority: 1,
+            variant: "happy",
+            goal: "Prove authenticated session (profile/sign-out) or that sign-out leaves only logged-out chrome",
+            steps: [
+              step("Launch the app", entryRoute),
+              step("Sign in with test credentials if not already authenticated"),
+              step("Open account/profile or use a signed-in-only control"),
+              step("Assert Sign out / profile identity is available, or complete sign-out and assert login chrome")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "Signed-in or signed-out durable chrome matches the action")
+            ]
+          };
+        case "navigation_integrity":
+          return {
+            ...base2,
+            name: `${feature} - Navigation reaches intended destination`,
+            type: "USER_JOURNEY",
+            priority: 2,
+            variant: "happy",
+            goal: "Follow in-app navigation (tab, back, empty-state CTA, overflow) and assert the intended product destination \u2014 not hub chrome after wandering",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate into ${feature} via the observed entry path`),
+              step("If an empty-state CTA is present, tap it and assert the destination form/error"),
+              step("Use back/up if nested and assert the parent screen family")
+            ],
+            expectedOutcomes: [
+              outcome("screen-visible", "Intended destination screen family is visible")
+            ]
+          };
+        case "permission_system":
+          return {
+            ...base2,
+            name: `${feature} - Permission prompt behaves honestly`,
+            type: "EDGE_CASE",
+            priority: 2,
+            variant: "happy",
+            goal: "Trigger permission flow and assert allow/deny/settings path is honest",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate to the ${feature} permission-related surface`),
+              step("Trigger the permission request"),
+              step("Assert system or in-app permission UI appears and deny/allow path is reachable")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "Permission or settings path is visible")
+            ]
+          };
+        case "double_submit":
+          return {
+            ...base2,
+            name: `${feature} - Single submit does not double-create`,
+            type: "EDGE_CASE",
+            priority: 2,
+            variant: "bug",
+            goal: "Submit once and assert count +1 (not +2) or a single confirmation",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate to the ${feature} submit flow`),
+              step("Capture pre-submit count or confirmation state"),
+              step("Tap primary submit only once"),
+              step("Assert state delta: single creation (count +1 or one confirmation id)")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "Exactly one durable result from a single submit")
+            ]
+          };
+        case "search_filter":
+          return {
+            ...base2,
+            name: `${feature} - Search filters the visible result set`,
+            type: "HAPPY_PATH",
+            priority: 1,
+            variant: "happy",
+            goal: "Type a distinctive query and assert the result set filters; clear/empty query restores or shows honest empty state",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate to the ${feature} search/filter surface`),
+              step("Capture the unfiltered list identifiers"),
+              step("Type a distinctive query into the search field"),
+              step("Assert state delta: visible results changed (filtered or empty-state)")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "Filtered results or empty-state copy matches the query")
+            ]
+          };
+        case "list_refresh":
+          return {
+            ...base2,
+            name: `${feature} - Pull to refresh keeps list coherent`,
+            type: "HAPPY_PATH",
+            priority: 1,
+            variant: "happy",
+            goal: "Capture list state, pull-to-refresh or tap Refresh, assert list remains coherent (not permanently wiped) or honest empty",
+            steps: [
+              step("Launch the app and sign in if needed", entryRoute),
+              step(`Navigate to the ${feature} list with refresh`),
+              step("Capture list identifiers before refresh"),
+              step("Pull to refresh or activate Refresh"),
+              step("Assert state delta: list still has coherent content or an honest empty state")
+            ],
+            expectedOutcomes: [
+              outcome("element-visible", "List after refresh is coherent (not permanently destroyed without recovery)")
+            ]
+          };
+        default:
+          return null;
+      }
+    }
   }
 });
 
@@ -80664,10 +81163,15 @@ var require_mobile_discovery_prompts = __commonJS({
     var mobile_observation_js_1 = require_mobile_observation();
     var scenario_taxonomy_js_1 = require_scenario_taxonomy();
     var coverage_map_js_1 = require_coverage_map();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     function isTargetAppScreenId(screenId, appId) {
       if (!appId)
         return true;
-      return screenId === appId || screenId.startsWith(`${appId}#`) || screenId.startsWith(`${appId}.`);
+      const hashIndex = screenId.indexOf("#");
+      const owner = (hashIndex >= 0 ? screenId.slice(0, hashIndex) : screenId).trim();
+      if (!owner)
+        return false;
+      return (0, shared_1.mobileScreenOwnerBelongsToApp)(owner, appId);
     }
     function targetAppScreens(graph, appId) {
       return [...graph.screens.values()].filter((state2) => isTargetAppScreenId(state2.screenId, appId));
@@ -80809,12 +81313,19 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     Citing observed labels / accessibility-ids in \`expectedOutcomes\` (per Rule 12) is fine \u2014 that's asserting on stable product signals, not implementation specifics.
 
 ## Coverage Strategy
-- For every form: at least 1 HAPPY_PATH (submit valid data AND verify durable result per rule 12) + 1 EDGE_CASE (empty/invalid submission)
-- For auth flows: sign-in happy path (verify the target screen AND a concrete signed-in/session signal per rule 13) + validation (wrong password, empty fields)
+- For every form: at least 1 HAPPY_PATH (submit valid data AND verify durable result per rule 12) + 1 EDGE_CASE (empty/invalid submission). When email-like fields exist, include ONE weak/malformed value case (structurally invalid input such as missing domain) and assert reject OR honest accept \u2014 never invent error copy not seen in evidence.
+- For auth flows: sign-in happy path (verify the target screen AND a concrete signed-in/session signal per rule 13) + validation (wrong password, empty fields) **only when this deep feature is Authentication / Sign-in / Onboarding / Account**. For every other feature, credentials are setup steps inside product scenarios \u2014 do NOT emit standalone "Sign In - Empty Credentials" / "Wrong Password" scenarios under Home, Inbox, Settings, etc.
 - For credential sign-in flows: only plan credential scenarios when evidence shows the credential path itself \u2014 an email/username field, a password field, and a native Sign In/Login/Submit control on the target screen, or an Explorer-Recorded Journey that typed those fields and submitted them. Do NOT treat Google/Apple/Facebook/SSO buttons, magic-link entry, logout menus, profile menus, or already-signed-in screens as evidence for credential sign-in. If the explorer only observed signed-in menu/logout/session surfaces, plan session/logout scenarios only; surface missing credential coverage as a gap instead of inventing credential sign-in variants.
-- For CRUD: each scenario MUST own the entity it operates on. Read/search/update/delete/cancel-on-existing/view-existing scenarios MUST include a create step earlier in the same scenario (or declare an immutable seed fixture by name). Never assume a record from prior runs or sibling tests exists. When create/delete are tightly coupled, bundle into a single USER_JOURNEY: create \u2192 verify \u2192 delete \u2192 verify removal.
+- For CRUD: each scenario MUST own the entity it operates on. Read/search/update/delete/cancel-on-existing/view-existing scenarios MUST include a create step earlier in the same scenario (or declare an immutable seed fixture by name). Never assume a record from prior runs or sibling tests exists. When create/delete are tightly coupled, bundle into a single USER_JOURNEY: create \u2192 verify \u2192 delete \u2192 verify removal. Delete scenarios MUST capture entity identity BEFORE delete and assert that identity is gone or the wrong neighbor remains (list chrome still visible is NOT enough).
+- For list counts / badges: plan before/after count or badge checks when those numbers were observed \u2014 not "Navigate up is visible".
+- For search/filter fields: plan a filter scenario with a distinctive query and assert the visible result set changes.
+- For pull-to-refresh / Refresh: capture list state, refresh, assert list remains coherent (not permanently wiped) or honest empty.
+- For empty-state CTAs ("Add first\u2026", "Create first\u2026"): tap the CTA and assert the DESTINATION product surface (form, detail, or honest error) \u2014 not hub tab chrome after wandering.
+- For settings/toggles/favorites: change value, leave screen (navigate away), return, assert value persisted or honestly reset.
 - For AI/async features (Generate, Analyze, Process, Import, Sync): happy path MUST complete the flow per rule 12 - never stop at "button tapped" or "sheet opened"
 - For navigation: multi-screen user journeys within the feature scope (do NOT drift into unrelated features)
+- **Smoke budget:** at most ONE pure smoke/navigation-only scenario per feature. Prefer required strong kinds when UI signals support them.
+- **Name = proof:** if the scenario name claims delete/count/persist/refresh/empty-CTA destination, expectedOutcomes and steps must prove that claim. Never name a test after a failure mode the steps do not exercise.
 
 ## Output JSON Schema
 {
@@ -81105,6 +81616,13 @@ Each entry is exactly one of:
       if (context.appBrief) {
         sections.push(`## Application Brief
 ${context.appBrief.slice(0, 500)}`);
+      }
+      const knownFacts = context.knowledgeContext?.trim();
+      if (knownFacts) {
+        sections.push(`## Known Facts
+${knownFacts.slice(0, 8e3)}
+
+These facts come from project documents / knowledge. Prefer scenarios that verify them when the explorer observed related UI. If a fact conflicts with live UI evidence, prefer live evidence. When this section is absent, rely only on explorer evidence.`);
       }
       const targetBits = [];
       if (context.platform)
@@ -81543,14 +82061,46 @@ ${constraints.join("\n")}`);
       }
       return normalized;
     }
+    function buildMobileTaxonomyScenarios(input, gaps) {
+      const orderedScreens = plannableTargetAppScreens(input.graph, input.appId).filter((state2) => state2.visited || state2.firstSeenIteration === 0).sort((a, b) => a.firstSeenIteration - b.firstSeenIteration);
+      if (orderedScreens.length === 0)
+        return [];
+      const entryScreenId = orderedScreens[0].screenId;
+      const targetPages = orderedScreens.slice(0, 8).map((s) => s.screenId);
+      const featureName = input.featureName?.trim() || nonGenericScreenName(orderedScreens[0], input.appId) || inferMobileFeatureGroupName(orderedScreens.slice(0, 3), input.appId) || "App";
+      const signals = (0, scenario_taxonomy_js_1.extractUiSignals)(input.graph, input.appId);
+      const missing = gaps && gaps.length > 0 ? gaps : (0, scenario_taxonomy_js_1.requiredScenarioKinds)(signals).filter((k) => k !== "smoke_nav");
+      if (missing.length === 0) {
+        return (0, scenario_taxonomy_js_1.synthesizeScenariosForMissingKinds)({
+          gaps: ["navigation_integrity", "happy_submit"],
+          featureName,
+          entryRoute: entryScreenId,
+          targetPages,
+          existingNames: new Set((input.existingTestNames ?? []).map((n) => n.toLowerCase())),
+          maxNew: Math.min(3, Math.max(1, input.testBudget || 3))
+        });
+      }
+      return (0, scenario_taxonomy_js_1.synthesizeScenariosForMissingKinds)({
+        gaps: missing,
+        featureName,
+        entryRoute: entryScreenId,
+        targetPages,
+        existingNames: new Set((input.existingTestNames ?? []).map((n) => n.toLowerCase())),
+        maxNew: Math.min(6, Math.max(2, input.testBudget || 6))
+      });
+    }
     function buildMobileFallbackScenarios(input) {
       if (input.mode === "survey")
         return [];
-      if (input.featureName?.trim())
-        return [];
+      if (input.featureName?.trim()) {
+        return buildMobileTaxonomyScenarios(input);
+      }
       const orderedScreens = plannableTargetAppScreens(input.graph, input.appId).filter((state2) => state2.visited || state2.firstSeenIteration === 0).sort((a, b) => a.firstSeenIteration - b.firstSeenIteration);
       if (orderedScreens.length === 0)
         return [];
+      const taxonomy = buildMobileTaxonomyScenarios(input);
+      if (taxonomy.length > 0)
+        return taxonomy;
       const entryScreenId = orderedScreens[0].screenId;
       const usedNames = new Set((input.existingTestNames ?? []).map((name) => name.toLowerCase()));
       const scenarios = [];
@@ -81843,6 +82393,7 @@ ${constraints.join("\n")}`);
         userPromptOverride: formatMobileEvidenceForPlanner(input.graph, {
           mode: input.mode,
           appBrief: input.appBrief,
+          knowledgeContext: input.knowledgeContext,
           appId: input.appId,
           platform: input.platform,
           featureName: input.featureName,
@@ -81875,44 +82426,65 @@ ${constraints.join("\n")}`);
       if (guestWallFilter.dropped > 0) {
         mobileAdaptationLogs.push(`Dropped ${guestWallFilter.dropped} guest-wall scenario(s) \u2014 explore session was authenticated; re-exec would not see sign-in gates`);
       }
-      const plannedScenarios = guestWallFilter.scenarios;
+      let plannedScenarios = guestWallFilter.scenarios;
       let taxonomyGapLogs = [];
       let taxonomyCoverageGaps = result.coverageGaps ?? [];
-      if (input.mode !== "survey" && plannedScenarios.length > 0) {
+      if (input.mode !== "survey" && input.graph.screens.size > 0) {
         const signals = (0, scenario_taxonomy_js_1.extractUiSignals)(input.graph, input.appId);
         const plannedKinds = (0, scenario_taxonomy_js_1.inferScenarioKinds)(plannedScenarios);
-        const gaps = (0, scenario_taxonomy_js_1.coverageGaps)(signals, plannedKinds);
-        const coverageMap = (0, coverage_map_js_1.buildMobileCoverageMap)({
-          graph: input.graph,
-          appId: input.appId,
-          plannedScenarios
-        });
-        taxonomyGapLogs = [(0, scenario_taxonomy_js_1.formatCoverageGapLog)(gaps), coverageMap.summary];
-        if (coverageMap.warnings.length > 0) {
-          taxonomyGapLogs.push(...coverageMap.warnings.slice(0, 12));
+        let gaps = (0, scenario_taxonomy_js_1.coverageGaps)(signals, plannedKinds);
+        if (plannedScenarios.length === 0) {
+          gaps = (0, scenario_taxonomy_js_1.requiredScenarioKinds)(signals).filter((k) => k !== "smoke_nav");
         }
         if (gaps.length > 0) {
-          taxonomyGapLogs.push(`UI signals: listRowActions=${signals.hasListWithRowActions} forms=${signals.hasFormFields} email=${signals.hasEmailField} badge=${signals.hasNumericBadge} toggles=${signals.hasSettingsToggles} signOut=${signals.hasSignOut} tabs=${signals.hasTabOrDrawerNav}`);
-          const detectedAt = (/* @__PURE__ */ new Date()).toISOString();
-          taxonomyCoverageGaps = [
-            ...taxonomyCoverageGaps,
-            ...gaps.map((kind) => ({
-              scenarioName: `[taxonomy] ${kind}`,
-              reason: `Required scenario kind "${kind}" not represented in the planned set`,
-              suggestion: `Add a ${kind} scenario backed by observed controls, or document impossibility`,
-              unmetPrerequisites: [],
-              detectedAt
-            })),
-            ...coverageMap.warnings.filter((w) => /smoke-only|no strong-oracle/i.test(w)).map((w) => ({
-              scenarioName: "[coverage-map] strong-oracle gap",
-              reason: w,
-              suggestion: "Author durable assertStateDelta/assertText outcomes for this kind",
-              unmetPrerequisites: [],
-              detectedAt
-            }))
-          ];
+          const synthesized = buildMobileTaxonomyScenarios(input, gaps);
+          if (synthesized.length > 0) {
+            const before = plannedScenarios.length;
+            plannedScenarios = [...plannedScenarios, ...synthesized];
+            mobileAdaptationLogs.push(`Taxonomy synthesis: added ${synthesized.length} scenario(s) for missing kinds [${gaps.join(", ")}] (plan had ${before})`);
+            gaps = (0, scenario_taxonomy_js_1.coverageGaps)(signals, (0, scenario_taxonomy_js_1.inferScenarioKinds)(plannedScenarios));
+          }
+        }
+        if (plannedScenarios.length > 0) {
+          const coverageMap = (0, coverage_map_js_1.buildMobileCoverageMap)({
+            graph: input.graph,
+            appId: input.appId,
+            plannedScenarios
+          });
+          taxonomyGapLogs = [(0, scenario_taxonomy_js_1.formatCoverageGapLog)(gaps), coverageMap.summary];
+          if (coverageMap.warnings.length > 0) {
+            taxonomyGapLogs.push(...coverageMap.warnings.slice(0, 12));
+          }
+          if (gaps.length > 0 || coverageMap.warnings.length > 0) {
+            taxonomyGapLogs.push(`UI signals: listRowActions=${signals.hasListWithRowActions} forms=${signals.hasFormFields} email=${signals.hasEmailField} badge=${signals.hasNumericBadge} toggles=${signals.hasSettingsToggles} signOut=${signals.hasSignOut} tabs=${signals.hasTabOrDrawerNav} search=${signals.hasSearchField} refresh=${signals.hasPullToRefresh} emptyCta=${signals.hasEmptyStateCta}`);
+            const detectedAt = (/* @__PURE__ */ new Date()).toISOString();
+            taxonomyCoverageGaps = [
+              ...taxonomyCoverageGaps,
+              ...gaps.map((kind) => ({
+                scenarioName: `[taxonomy] ${kind}`,
+                reason: `Required scenario kind "${kind}" not represented in the planned set`,
+                suggestion: `Add a ${kind} scenario backed by observed controls, or document impossibility`,
+                unmetPrerequisites: [],
+                detectedAt
+              })),
+              ...coverageMap.warnings.filter((w) => /smoke-only|no strong-oracle/i.test(w)).map((w) => ({
+                scenarioName: "[coverage-map] strong-oracle gap",
+                reason: w,
+                suggestion: "Author durable assertStateDelta/assertText outcomes for this kind",
+                unmetPrerequisites: [],
+                detectedAt
+              }))
+            ];
+          }
         }
       }
+      if (input.mode !== "survey" && input.featureName?.trim()) {
+        const deepFeature = input.featureName.trim();
+        plannedScenarios = plannedScenarios.map((s) => ({
+          ...s,
+          featureGroup: s.featureGroup?.trim() || deepFeature
+        }));
+      }
       if (input.mode !== "survey" && plannedScenarios.length === 0 && input.graph.screens.size > 0) {
         const fallbackScenarios = buildMobileFallbackScenarios(input);
         if (fallbackScenarios.length > 0) {
@@ -81923,7 +82495,7 @@ ${constraints.join("\n")}`);
             logs: [
               ...result.logs,
               ...mobileAdaptationLogs,
-              `Mobile fallback: synthesized ${fallbackScenarios.length} screen-reachability scenario(s) from the native screen graph`
+              `Mobile fallback: synthesized ${fallbackScenarios.length} taxonomy/bug-capture scenario(s) from native UI signals`
             ],
             fallbackUsed: true,
             fallbackReason: result.fallbackReason ?? "Mobile planner produced no scenarios"
@@ -81967,6 +82539,25 @@ ${constraints.join("\n")}`);
           fallbackReason: result.fallbackReason ?? plannerGroupSelection.reason ?? `Planner omitted ${supplementedSurveyRouteCount} plannable mobile screen(s)`
         };
       }
+      if (mobileFeatureGroups.length === 0 && input.graph.screens.size > 0) {
+        const appId = input.appId?.trim();
+        const owners = [...new Set([...input.graph.screens.values()].map((state2) => {
+          const hashIndex = state2.screenId.indexOf("#");
+          return (hashIndex >= 0 ? state2.screenId.slice(0, hashIndex) : state2.screenId).trim();
+        }).filter(Boolean))];
+        const inAppOwners = appId ? owners.filter((owner) => (0, shared_1.mobileScreenOwnerBelongsToApp)(owner, appId)) : owners;
+        const reason = inAppOwners.length === 0 && appId ? `Mapped ${input.graph.screens.size} screen(s) but none were attributed to app "${appId}" (screen owners seen: ${owners.slice(0, 4).join(", ")}). No features could be created.` : `Mapped ${input.graph.screens.size} screen(s) but none could be grouped into a feature (too few actionable elements, or every screen was filtered as generic/system).`;
+        return {
+          ...result,
+          scenarios: plannedScenarios,
+          featureGroups: mobileFeatureGroups,
+          coverageGaps: taxonomyCoverageGaps.length > 0 ? taxonomyCoverageGaps : result.coverageGaps,
+          logs: [...result.logs, ...mobileAdaptationLogs, ...taxonomyGapLogs, `\u26A0 ${reason}`],
+          warning: result.warning ?? reason,
+          fallbackUsed: true,
+          fallbackReason: result.fallbackReason ?? reason
+        };
+      }
       return {
         ...result,
         scenarios: plannedScenarios,
@@ -82035,6 +82626,7 @@ var require_anr_env = __commonJS({
     exports2.isAnrOrSystemUiEnvironmentFailure = isAnrOrSystemUiEnvironmentFailure;
     exports2.stepLooksLikeAnrChromeAssert = stepLooksLikeAnrChromeAssert;
     var ANR_TEXT_RE = /system\s*ui\s*isn['’]?t\s*responding|app\s*isn['’]?t\s*responding|application\s*not\s*responding|\banr\b|close\s*app|wait\s*and\s*see|isn['’]?t\s*responding/i;
+    var SYSTEM_FREEZE_RE = /system\s*ui\s*isn['’]?t\s*responding|\bsystem\s*ui\b[^.\n]{0,40}\b(froze|frozen|hung|unresponsive|not\s*responding)\b|\b(device|emulator|simulator)\b[^.\n]{0,40}\b(froze|frozen|hung|unresponsive)\b/i;
     function textLooksLikeAnrOrSystemUi(text) {
       if (!text || typeof text !== "string")
         return false;
@@ -82043,7 +82635,7 @@ var require_anr_env = __commonJS({
     function isAnrOrSystemUiEnvironmentFailure(error2, logs2) {
       const blob = `${error2 ?? ""}
 ${logs2 ?? ""}`;
-      if (textLooksLikeAnrOrSystemUi(blob))
+      if (SYSTEM_FREEZE_RE.test(blob))
         return true;
       if (/\bcold-boot\b/i.test(blob) && /\b(froze|hang|anr|unresponsive)\b/i.test(blob))
         return true;
@@ -82065,13 +82657,48 @@ var require_oracle_quality = __commonJS({
   "../runner-core/dist/services/mobile/oracle-quality.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isToastOrAckOutcomeText = isToastOrAckOutcomeText;
+    exports2.isAuthPrimaryFeatureName = isAuthPrimaryFeatureName;
+    exports2.isStandaloneAuthValidationScenario = isStandaloneAuthValidationScenario;
+    exports2.textLooksLikeProductOutcome = textLooksLikeProductOutcome;
+    exports2.textLooksLikeChromeSurface = textLooksLikeChromeSurface;
     exports2.assessStrongOracleQuality = assessStrongOracleQuality;
+    exports2.assessScenarioClaimCoherence = assessScenarioClaimCoherence;
     var anr_env_js_1 = require_anr_env();
+    var scenario_taxonomy_js_1 = require_scenario_taxonomy();
     var CHROME_ONLY_RE = /\b(tab|home tab|catalog tab|forms tab|account tab|back|menu|navigation|nav bar|bottom nav|status bar|query|search field)\b/i;
     var PRODUCT_OUTCOME_TEXT_RE = /\b(error|invalid|required|must|cannot|failed|denied|blocked|empty|missing|deleted|removed|saved|success|created|updated|signed?\s*out|logged?\s*out|wrong|incorrect)\b/i;
+    var TOAST_ACK_EXACT_RE = /^(saved!?|success!?|successfully (saved|deleted|updated|created)!?|deleted!?|removed!?|done!?|ok!?|updated!?|created!?)$/i;
+    function isToastOrAckOutcomeText(text) {
+      const t = text.trim();
+      if (!t)
+        return false;
+      if (TOAST_ACK_EXACT_RE.test(t))
+        return true;
+      const parts = t.split(/\s+/).filter(Boolean);
+      return parts.length > 0 && parts.every((part) => TOAST_ACK_EXACT_RE.test(part));
+    }
+    function isAuthPrimaryFeatureName(name) {
+      const n = (name ?? "").trim();
+      if (!n)
+        return false;
+      return /\b(auth|authentication|sign[\s-]*in|log[\s-]*in|login|session|onboarding|account)\b/i.test(n);
+    }
+    function isStandaloneAuthValidationScenario(scenario) {
+      const text = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.variant ?? ""}`.toLowerCase();
+      if (!/\b(sign\s*in|log\s*in|login|credentials?|password|email)\b/.test(text))
+        return false;
+      return /\b(empty|invalid|wrong password|malformed|required|validation|reject|blocked)\b/.test(text) || scenario.variant === "validation";
+    }
     function stepBlob(step) {
       return [step.description, step.assertion, step.value, step.target?.primary].filter(Boolean).join(" ");
     }
+    function textLooksLikeProductOutcome(text) {
+      return PRODUCT_OUTCOME_TEXT_RE.test(text);
+    }
+    function textLooksLikeChromeSurface(text) {
+      return CHROME_ONLY_RE.test(text);
+    }
     function isChromeOnlyVisible(step) {
       if (step.action !== "assertVisible")
         return false;
@@ -82108,6 +82735,8 @@ var require_oracle_quality = __commonJS({
         if (/^(email|password|username|name|query|search)$/i.test((s.assertion ?? "").trim())) {
           return false;
         }
+        if (isToastOrAckOutcomeText(s.assertion ?? s.value ?? ""))
+          return false;
         return blob.length >= 3;
       });
       const hasStrongValidationVisible = steps.some((s) => {
@@ -82115,7 +82744,12 @@ var require_oracle_quality = __commonJS({
           return false;
         if ((0, anr_env_js_1.stepLooksLikeAnrChromeAssert)(s) || isChromeOnlyVisible(s))
           return false;
-        return PRODUCT_OUTCOME_TEXT_RE.test(stepBlob(s));
+        const blob = stepBlob(s);
+        if (isToastOrAckOutcomeText(s.assertion ?? s.value ?? ""))
+          return false;
+        if (isToastOrAckOutcomeText(blob))
+          return false;
+        return PRODUCT_OUTCOME_TEXT_RE.test(blob);
       });
       const strong = hasStateDelta || hasStrongAssertText || hasStrongValidationVisible;
       let reason;
@@ -82140,6 +82774,70 @@ var require_oracle_quality = __commonJS({
         reason
       };
     }
+    function assessScenarioClaimCoherence(scenario, steps) {
+      const variant = scenario.variant === "happy" || scenario.variant === "validation" || scenario.variant === "bug" ? scenario.variant : void 0;
+      const kind = (0, scenario_taxonomy_js_1.inferScenarioKind)({
+        type: scenario.type || "HAPPY_PATH",
+        variant,
+        name: scenario.name ?? "",
+        goal: scenario.goal ?? ""
+      });
+      const quality = assessStrongOracleQuality(steps);
+      const text = `${scenario.name ?? ""} ${scenario.goal ?? ""}`.toLowerCase();
+      const featureGroup = scenario.featureGroup ?? "";
+      if (isStandaloneAuthValidationScenario(scenario) && featureGroup && !isAuthPrimaryFeatureName(featureGroup)) {
+        return {
+          coherent: false,
+          kind,
+          discard: true,
+          reason: `auth credential validation scenario under non-auth feature "${featureGroup}" \u2014 login is setup only`
+        };
+      }
+      if (quality.anrOnly) {
+        return {
+          coherent: false,
+          kind,
+          discard: true,
+          reason: quality.reason
+        };
+      }
+      if ((0, scenario_taxonomy_js_1.kindRequiresStateDelta)(kind) && !quality.hasStateDelta) {
+        const namesStateClaim = /\b(count|delta|delete|removed|persist|roundtrip|wrong row|entity|double.?submit|fires?:?\s*2|refresh)\b/i.test(text);
+        return {
+          coherent: false,
+          kind,
+          // Discard when the name/kind clearly promised state proof; otherwise demote.
+          discard: namesStateClaim || kind === "crud_identity" || kind === "count_delta" || kind === "list_refresh",
+          reason: `scenario kind ${kind} claims durable state change but steps lack assertStateDelta (${quality.reason})`
+        };
+      }
+      if (/\b(empty.?state|empty cta|dead route|404|not found|broken blank)\b/i.test(text)) {
+        const hasProductDestination = steps.some((s) => {
+          if (s.action !== "assertVisible" && s.action !== "assertText")
+            return false;
+          if ((0, anr_env_js_1.stepLooksLikeAnrChromeAssert)(s))
+            return false;
+          const blob = stepBlob(s);
+          if (CHROME_ONLY_RE.test(blob) && !PRODUCT_OUTCOME_TEXT_RE.test(blob))
+            return false;
+          return PRODUCT_OUTCOME_TEXT_RE.test(blob) || /\b(404|not found|empty|no items|blank|error)\b/i.test(blob);
+        });
+        if (!hasProductDestination && !quality.hasStateDelta) {
+          return {
+            coherent: false,
+            kind,
+            discard: false,
+            reason: "empty-state/dead-route claim without destination or empty-state product assertion"
+          };
+        }
+      }
+      return {
+        coherent: true,
+        kind,
+        discard: false,
+        reason: "scenario claim matches step oracles"
+      };
+    }
   }
 });
 
@@ -82657,7 +83355,18 @@ ${hybridSkeleton.join("\n")}`;
     function hasStableId(element) {
       return !!nonEmpty3(element.accessibilityId) || !!nonEmpty3(element.resourceId);
     }
-    function buildSystemPrompt(platform3, targetAppId, maxIterations = MAX_SCENARIO_ITERATIONS) {
+    function buildKnownFactsPromptBlock(knowledgeContext) {
+      const text = knowledgeContext?.trim();
+      if (!text)
+        return "";
+      return `
+
+## Known Facts (project documents \u2014 optional)
+${text.slice(0, 6e3)}
+
+When facts are present, prefer assertions that prove them if the live UI supports it. If a fact conflicts with what you see on device, prefer live UI. Never invent requirements not in these facts and not visible on screen. When this section is absent, rely only on the scenario + live UI.`;
+    }
+    function buildSystemPrompt(platform3, targetAppId, maxIterations = MAX_SCENARIO_ITERATIONS, knowledgeContext) {
       const platformLabel = platform3 === "IOS" ? "iOS" : "Android";
       const targetLine = targetAppId ? ` Target app package/bundle: ${targetAppId}.` : "";
       return `You are an expert mobile QA agent generating ONE automated test by driving a real ${platformLabel} app on a connected device. The app has just been relaunched into a clean state.
@@ -82681,14 +83390,14 @@ The scenario name + goal + steps describe ONE product behavior from survey/disco
    - For list delete/create or count changes: mobile_capture_state({stateKey, kind}) BEFORE the mutation, then mobile_assert_state_delta({stateKey, expect}) AFTER \u2014 BOTH are required. captureState alone does NOT prove the outcome.
    - Negative validation: leave a required field EMPTY (or type clearly invalid email-like input), submit, assert the app BLOCKS success \u2014 error message / still on form / no navigation to Home. Do NOT fill a valid password-only path and call it "empty email".
    - After sign-in \u2192 signed-in product signal; after like \u2192 liked/unlike control or durable like state; after open Settings \u2192 a settings-specific control.
-   - Do NOT assert bottom-nav tab labels alone, notification badge counts ("N unread"), or one-time empty-state CTAs as the scenario outcome.
+   - Do NOT assert bottom-nav tab labels alone or notification badge counts ("N unread") as the scenario outcome.
    - NEVER assert system freeze chrome ("System UI isn't responding", ANR dialogs, Wait/Close app). If the app freezes, finish_generate with verified:false (environment) \u2014 do NOT write a test whose only proof is the ANR dialog.
 5. Call finish_generate with verified:true ONLY if you completed the goal AND asserted a matching durable outcome. If the app cannot complete the goal, finish with verified:false and explain \u2014 never invent a green path from unrelated screens.
 
 ## Rules
 - Re-snapshot before every assertion so the ref is fresh.
 - Assert the OUTCOME of the flow (the new screen / new content), not the control you just tapped.
-- Assert only DURABLE elements \u2014 screen chrome that exists on every visit (tab labels, headers, nav bars, the entity you just created). NEVER assert one-time / data-dependent UI: empty-state CTAs, first-run or onboarding prompts, or counters \u2014 they vanish as soon as the account has data, and the test then fails forever on a healthy app.
+- Assert only DURABLE product outcomes. Prefer entity identity, form values, validation copy, destination screens after navigation. For empty-state CTA scenarios: tap the CTA and assert the DESTINATION (form, detail, or honest error) \u2014 do NOT treat the CTA label alone as success, and do NOT use empty-state CTAs as proof for unrelated happy paths.
 - Do NOT trigger irreversible or destructive side effects \u2014 real payments; sending messages to others; and ESPECIALLY account/data deletion, deactivation, or any "type DELETE to confirm" gate (the runner hard-blocks destructive taps and confirmation keystrokes). Note them and assert what you safely can.
 - STATE OWNERSHIP for mutation scenarios (edit / rename / archive / remove): CREATE the record first in this same recording, then act on the row YOU created \u2014 never mutate pre-existing data (it may not exist on a clean install, so the replay fails forever, and another test may depend on it). If the app offers no way to create one, do NOT act on someone else's data: assert what you can safely prove and finish with verified:false, explaining why in the description.
 - If the APP itself misbehaves (product error screen, broken validation, wrong entity deleted), assert the product failure and call finish_generate with suspectedBug:true and a concrete bugDescription. If the device shows ANR / "System UI isn't responding" / freeze dialogs, that is ENVIRONMENT \u2014 finish with verified:false and do NOT assert the freeze dialog as the test outcome.
@@ -82701,7 +83410,7 @@ The scenario name + goal + steps describe ONE product behavior from survey/disco
 - Each action must make NEW progress toward the goal. If an action leaves the screen unchanged, do NOT repeat it \u2014 pick a different element or move on.
 - Finish promptly once the outcome is proven: the instant the expected outcome is visible, assert it and call finish_generate. Do not keep exploring after the goal is proven.
 
-Max iterations: ${maxIterations}. You will be warned near the end.`;
+Max iterations: ${maxIterations}. You will be warned near the end.` + buildKnownFactsPromptBlock(knowledgeContext);
     }
     function buildGenerateCredentialPromptBlock(secrets) {
       const keys = Object.keys(secrets).filter((k) => secrets[k] && secrets[k].length > 0);
@@ -82791,7 +83500,7 @@ Start by calling mobile_snapshot, then execute ONLY the steps needed for this go
       }
     }
     async function runScenarioLoop(args) {
-      const { scenario, driver, platform: platform3, maxIterations, agentModel, provider, aiClient, auditGroupId, onAICall, onScreenshot, targetAppId, credentials, redactionCredentials, log: emitLog, allowRelaunch } = args;
+      const { scenario, driver, platform: platform3, maxIterations, agentModel, provider, aiClient, auditGroupId, onAICall, onScreenshot, targetAppId, credentials, redactionCredentials, log: emitLog, allowRelaunch, knowledgeContext } = args;
       const log2 = (line) => emitLog(redactCredentialValues(line, redactionCredentials));
       const actions = [];
       const stateBag = /* @__PURE__ */ new Map();
@@ -83169,7 +83878,7 @@ ${lines.join("\n")}`
         (0, mobile_driver_errors_js_1.rethrowIfTerminalMobileDriverError)(err);
         log2(`  seed snapshot failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
       }
-      const systemPrompt = buildSystemPrompt(platform3, targetAppId, maxIterations) + buildGenerateCredentialPromptBlock(credentials);
+      const systemPrompt = buildSystemPrompt(platform3, targetAppId, maxIterations, knowledgeContext) + buildGenerateCredentialPromptBlock(credentials);
       const kickoff = buildScenarioKickoff(scenario);
       const recentExchanges = [];
       const hasStoredCredentials = Object.values(credentials).some((v) => typeof v === "string" && v.length > 0);
@@ -85118,6 +85827,8 @@ ${statePacket}`, redactionCredentials) },
       const t = text.trim();
       if (!t)
         return false;
+      if ((0, oracle_quality_js_1.isToastOrAckOutcomeText)(t))
+        return true;
       if (/\b\d+\s*(s|sec|secs|second|seconds|m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days|w|wk|wks|week|weeks|mo|mos|month|months|y|yr|yrs|year|years)\s+ago\b/i.test(t)) {
         return true;
       }
@@ -85223,6 +85934,30 @@ ${statePacket}`, redactionCredentials) },
       }
       const ephemeral = modelAsserts.filter((a) => isEphemeralContentAssertText(assertIdentityText(a)));
       const durable = modelAsserts.filter((a) => !isEphemeralContentAssertText(assertIdentityText(a)));
+      const chromeOnlyVisible = (a) => {
+        if (a.type !== "ASSERT_VISIBLE")
+          return false;
+        const blob = assertIdentityText(a);
+        if ((0, oracle_quality_js_1.isToastOrAckOutcomeText)(blob))
+          return true;
+        return /\b(tab|home|settings|back|menu|navigation|nav bar|bottom nav|status bar)\b/i.test(blob) && !/\b(error|invalid|required|failed|deleted|removed|created)\b/i.test(blob);
+      };
+      if (durable.length > 0 && durable.every(chromeOnlyVisible) && !actions.some((a) => a.type === "ASSERT_STATE_DELTA")) {
+        return {
+          ok: false,
+          severity: "downgrade",
+          reason: "only landing/chrome visibility after interaction \u2014 not a durable product outcome",
+          signals: {
+            apiTest: false,
+            interacted: actions.some((a) => a.type === "TAP" || a.type === "TYPE"),
+            mutated: actions.some((a) => a.type === "TYPE" || a.type === "CLEAR" || a.type === "TAP"),
+            navOnly: false,
+            hasOutcomeProof: false,
+            errorBanner: false,
+            terminal: null
+          }
+        };
+      }
       if (ephemeral.length > 0 && durable.length === 0) {
         return {
           ok: false,
@@ -85317,10 +86052,11 @@ ${statePacket}`, redactionCredentials) },
       }
       const baseStrengthVerdict = evaluateMobileAssertionStrength(actions);
       const bugDescription = recording.finish?.bugDescription?.trim() ?? "";
+      const bugWitnessEnabled = (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_BUG_WITNESS_ENABLED, true);
       const bugLooksLikeAnr = (0, anr_env_js_1.textLooksLikeAnrOrSystemUi)(bugDescription);
-      const bugWitnessHonored = process.env.DISCOVERY_BUG_WITNESS_ENABLED === "true" && recording.finish?.suspectedBug === true && bugDescription.length >= 12 && recording.assertCount > 0 && !bugLooksLikeAnr;
+      const bugWitnessHonored = bugWitnessEnabled && recording.finish?.suspectedBug === true && bugDescription.length >= 12 && recording.assertCount > 0 && !bugLooksLikeAnr;
       if (recording.finish?.suspectedBug === true && !bugWitnessHonored) {
-        log2("  suspectedBug declared but NOT honored: " + (bugLooksLikeAnr ? "ANR/System UI freeze is environment noise, not a product bug-witness." : process.env.DISCOVERY_BUG_WITNESS_ENABLED !== "true" ? "bug-witness channel disabled (DISCOVERY_BUG_WITNESS_ENABLED)." : bugDescription.length < 12 ? "bugDescription too short." : "no honored assert backs the observation."));
+        log2("  suspectedBug declared but NOT honored: " + (bugLooksLikeAnr ? "ANR/System UI freeze is environment noise, not a product bug-witness." : !bugWitnessEnabled ? "bug-witness channel disabled (DISCOVERY_BUG_WITNESS_ENABLED)." : bugDescription.length < 12 ? "bugDescription too short." : "no honored assert backs the observation."));
       }
       const strengthVerdict = bugWitnessHonored ? {
         ...baseStrengthVerdict,
@@ -85350,30 +86086,48 @@ ${statePacket}`, redactionCredentials) },
       if (selectorLintEnforced && verified) {
         log2(`  selector-quality lint (enforce): ${selectorQuality.summary.high} high-severity locator issue(s) \u2014 tagging @needs-review.`);
       }
-      const reviewTag = verified && !selectorLintEnforced ? "@verified" : "@needs-review";
+      const strengthBlocked = !strengthVerdict.ok || strengthVerdict.severity === "block" || strengthVerdict.severity === "route-bug" || !verified || coldResetUnavailable;
+      const claimCoherence = (0, oracle_quality_js_1.assessScenarioClaimCoherence)({
+        name: scenario.name,
+        goal: scenario.goal,
+        type: scenario.type,
+        variant: scenario.variant,
+        featureGroup: scenario.featureGroup
+      }, compiled.steps);
+      const oracleQualityEarly = (0, oracle_quality_js_1.assessStrongOracleQuality)(compiled.steps);
+      if (oracleQualityEarly.anrOnly || claimCoherence.discard) {
+        log2(`  discarding incoherent/ANR recording: ${claimCoherence.discard ? claimCoherence.reason : oracleQualityEarly.reason}`);
+        return null;
+      }
+      const reviewTag = verified && !selectorLintEnforced && claimCoherence.coherent ? "@verified" : "@needs-review";
       const tags = ["@discovered", "@mobile", platformTag2, reviewTag];
       if (strengthVerdict.severity === "downgrade")
         tags.push("@smoke");
+      if (strengthVerdict.severity === "route-bug" && !tags.includes("@bug-found")) {
+        tags.push("@bug-found");
+      }
       if (coldResetUnavailable)
         tags.push("@warm-state");
-      const strengthBlocked = !strengthVerdict.ok || strengthVerdict.severity === "block" || strengthVerdict.severity === "route-bug" || !verified || coldResetUnavailable;
       {
         const kind = (0, scenario_taxonomy_js_1.inferScenarioKind)(scenario);
-        const oracleQuality = (0, oracle_quality_js_1.assessStrongOracleQuality)(compiled.steps);
-        if (oracleQuality.anrOnly) {
-          log2(`  discarding ANR-chrome-only recording: ${oracleQuality.reason}`);
-          return null;
-        }
+        const oracleQuality = oracleQualityEarly;
         if (oracleQuality.unpairedCaptures > 0) {
           log2(`  oracle quality: ${oracleQuality.reason}`);
         }
-        const strong = verified && !strengthBlocked && strengthVerdict.severity === "none" && oracleQuality.strong && ((0, scenario_taxonomy_js_1.isStrongOracleKind)(kind) || oracleQuality.hasStateDelta || oracleQuality.hasStrongAssertText);
+        if (!claimCoherence.coherent) {
+          log2(`  scenario claim weak: ${claimCoherence.reason}`);
+          if (!tags.includes("@smoke"))
+            tags.push("@smoke");
+        }
+        const strong = claimCoherence.coherent && verified && !strengthBlocked && strengthVerdict.severity === "none" && oracleQuality.strong && ((0, scenario_taxonomy_js_1.isStrongOracleKind)(kind) || oracleQuality.hasStateDelta || oracleQuality.hasStrongAssertText);
         if (strong)
           tags.push("@strong-oracle");
         else if (!tags.includes("@smoke")) {
           tags.push("@smoke");
           if (!oracleQuality.strong) {
             log2(`  tagged @smoke (not strong-oracle): ${oracleQuality.reason}`);
+          } else if (!claimCoherence.coherent) {
+            log2(`  tagged @smoke (claim incoherent): ${claimCoherence.reason}`);
           }
         }
       }
@@ -85393,11 +86147,9 @@ ${statePacket}`, redactionCredentials) },
         playwrightCode: "",
         verified,
         tags,
-        // Per-test feature label → TestCase.suite. One deep run plans scenarios for
-        // MULTIPLE feature groups (the planner reuses survey feature names), so the
-        // run-level ctx.featureName fallback in /discovery-test would wrongly file
-        // every test under the deep-dived feature. The scenario's own group is the
-        // correct home; the runner forwards it as `suiteName`.
+        // Per-test suite hint. Server deep mode overrides suite to ctx.featureName
+        // so leaf features receive their own tests; full-mode multi-group still uses
+        // featureGroup when present.
         ...scenario.featureGroup?.trim() ? { suiteName: scenario.featureGroup.trim() } : {},
         // Carry the planner scenario identity so incremental/resume can match an
         // already-generated scenario reliably (scenarioRef.name === the plan's
@@ -85564,7 +86316,8 @@ ${statePacket}`, redactionCredentials) },
             credentials: credentialSecrets,
             redactionCredentials: credentialValuesForRedaction,
             log: log2,
-            allowRelaunch: (ctx.target?.resetPolicy ?? "AUTO") !== "PRESERVE_APP_DATA"
+            allowRelaunch: (ctx.target?.resetPolicy ?? "AUTO") !== "PRESERVE_APP_DATA",
+            knowledgeContext: ctx.knowledgeContext
           });
           consecutiveInfraFailures = 0;
           const test = assembleTest({
@@ -85629,13 +86382,23 @@ var require_failure_triage = __commonJS({
   "../runner-core/dist/services/mobile/failure-triage.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isOracleStep = isOracleStep;
     exports2.hasStrongMobileOracle = hasStrongMobileOracle;
     exports2.isStrongOracleStep = isStrongOracleStep;
     exports2.listStrongOracleKinds = listStrongOracleKinds;
     exports2.triageMobileFailure = triageMobileFailure;
     exports2.triageToHealTerminal = triageToHealTerminal;
     var anr_env_js_1 = require_anr_env();
-    var STRONG_ACTIONS = /* @__PURE__ */ new Set(["assertStateDelta", "assertText", "captureState"]);
+    var oracle_quality_js_1 = require_oracle_quality();
+    var STRONG_ACTIONS = /* @__PURE__ */ new Set(["assertStateDelta", "assertText"]);
+    var ORACLE_ACTIONS = /* @__PURE__ */ new Set([
+      "assertVisible",
+      "assertText",
+      "assertStateDelta"
+    ]);
+    function isOracleStep(step) {
+      return ORACLE_ACTIONS.has(step.action);
+    }
     var CHROME_VISIBLE_RE = /\b(tab|home|settings|back|menu|navigation|nav bar|bottom nav|status bar)\b/i;
     function hasStrongMobileOracle(steps) {
       return steps.some(isStrongOracleStep);
@@ -85651,23 +86414,31 @@ var require_failure_triage = __commonJS({
         step.target?.primary ?? "",
         ...step.target?.fallbacks ?? []
       ].join(" ");
-      if (/\b(error|invalid|required|must|cannot|failed|denied|blocked|empty|missing|deleted|removed|saved|success|created|updated)\b/i.test(blob)) {
+      if ((0, anr_env_js_1.stepLooksLikeAnrChromeAssert)(step))
+        return false;
+      if ((0, oracle_quality_js_1.isToastOrAckOutcomeText)(step.assertion ?? step.value ?? ""))
+        return false;
+      if ((0, oracle_quality_js_1.textLooksLikeProductOutcome)(blob))
         return true;
-      }
-      if (CHROME_VISIBLE_RE.test(blob) && blob.length < 80)
+      const anchor = [step.target?.primary ?? "", ...step.target?.fallbacks ?? []].join(" ").trim();
+      if (!anchor)
         return false;
-      return false;
+      if (CHROME_VISIBLE_RE.test(blob) || (0, oracle_quality_js_1.textLooksLikeChromeSurface)(blob))
+        return false;
+      return blob.trim().length >= 3;
     }
     function listStrongOracleKinds(steps) {
       const kinds = /* @__PURE__ */ new Set();
+      const hasDelta = steps.some((s) => s.action === "assertStateDelta");
       for (const step of steps) {
         if (step.action === "assertStateDelta")
           kinds.add("assertStateDelta");
         else if (step.action === "assertText")
           kinds.add("assertText");
-        else if (step.action === "captureState")
-          kinds.add("captureState");
-        else if (isStrongOracleStep(step))
+        else if (step.action === "captureState") {
+          if (hasDelta)
+            kinds.add("captureState");
+        } else if (isStrongOracleStep(step))
           kinds.add(step.action);
       }
       return [...kinds];
@@ -85689,6 +86460,8 @@ ${logs2 ?? ""}`.trim();
         return true;
       if (/Missing mobile test variable/i.test(text))
         return true;
+      if (/entry.?screen drift|screen drift|started on an unexpected screen/i.test(text))
+        return true;
       if (/\b(quota|rate.?limit|429|lockout)\b/i.test(text))
         return true;
       if (/\b(device (?:offline|disconnected|not found)|session (?:not started|terminated|deleted))\b/i.test(text)) {
@@ -85709,7 +86482,10 @@ ${logs2 ?? ""}`.trim();
       return /not found|no such element|No identity locator|unable to locate/i.test(text);
     }
     function looksLikeOracleFailure(text) {
-      return /assertStateDelta/i.test(text) || /expected state/i.test(text) || /expected (?:["'].+["'] )?(?:to be |text|visible|removed|count)/i.test(text) || /assertion failed|Assert .+ (?:visible|shows|contains)/i.test(text);
+      return /assertStateDelta/i.test(text) || /expected state/i.test(text) || /expected (?:["'].+["'] )?(?:to be |text|visible|removed|count)/i.test(text) || /assertion failed|Assert .+ (?:visible|shows|contains)/i.test(text) || /found but not visible/i.test(text);
+    }
+    function looksLikeUnpairedStateDelta(text) {
+      return /assertStateDelta[^\n]*no prior captureState/i.test(text);
     }
     function triageMobileFailure(input) {
       const failureCount = Math.max(1, input.failureCount ?? 1);
@@ -85718,11 +86494,20 @@ ${logs2 ?? ""}`.trim();
       const prefix = leadingPrefix(input.error);
       const strongKinds = listStrongOracleKinds(input.steps);
       const hasStrong = strongKinds.length > 0 || tags.some((t) => t === "@strong-oracle" || t === "strong-oracle");
+      const failureText = (input.error ?? "").trim() || text;
+      const failedStep = typeof input.failedStepOrder === "number" ? input.steps.find((s) => s.order === input.failedStepOrder) : void 0;
+      const failedStepIsOracle = !!failedStep && isOracleStep(failedStep);
+      const postHeal = input.postHeal === true;
+      const locatorDrift = looksLikeLocatorMiss(failureText) && !failedStepIsOracle;
+      const explicitOracleFailure = looksLikeOracleFailure(failureText);
+      const missingOutcome = failedStepIsOracle && looksLikeLocatorMiss(failureText);
       const evidence = {
         hasStrongOracle: hasStrong,
         strongOracleKinds: strongKinds,
         failureCount,
-        errorPrefix: prefix
+        errorPrefix: prefix,
+        ...failedStep ? { failedStepAction: failedStep.action } : {},
+        ...failedStep ? { failedOnOracleStep: failedStepIsOracle } : {}
       };
       if ((0, anr_env_js_1.isAnrOrSystemUiEnvironmentFailure)(input.error, input.logs)) {
         return {
@@ -85787,11 +86572,47 @@ ${logs2 ?? ""}`.trim();
           evidence
         };
       }
-      if (hasStrong && failureCount >= 2 && (looksLikeOracleFailure(text) || !looksLikeLocatorMiss(text))) {
-        if (looksLikeLocatorMiss(text) && failureCount < 3) {
+      if (looksLikeUnpairedStateDelta(failureText)) {
+        return {
+          verdict: "test_invalid",
+          reason: "assertStateDelta has no prior captureState for its key \u2014 the test cannot prove a delta",
+          shouldHeal: false,
+          healVerdict: "test_invalid",
+          evidence
+        };
+      }
+      if (hasStrong && strongKinds.includes("assertStateDelta") && /assertStateDelta/i.test(failureText) && explicitOracleFailure && !locatorDrift) {
+        return {
+          verdict: "app_bug_candidate",
+          reason: "assertStateDelta oracle failed \u2014 durable product state did not match expected outcome",
+          shouldHeal: false,
+          healVerdict: "app_bug",
+          evidence
+        };
+      }
+      if (hasStrong && (strongKinds.includes("assertText") || strongKinds.includes("assertVisible")) && explicitOracleFailure && !locatorDrift) {
+        return {
+          verdict: "app_bug_candidate",
+          reason: `Strong oracle (${strongKinds.join(", ") || "tagged"}) failed with product-shaped error`,
+          shouldHeal: false,
+          healVerdict: "app_bug",
+          evidence
+        };
+      }
+      if (hasStrong && missingOutcome && postHeal) {
+        return {
+          verdict: "app_bug_candidate",
+          reason: `Strong oracle (${strongKinds.join(", ") || "tagged"}) outcome never appeared and heal could not locate it`,
+          shouldHeal: false,
+          healVerdict: "app_bug",
+          evidence
+        };
+      }
+      if (hasStrong && failureCount >= 2) {
+        if ((locatorDrift || missingOutcome) && !postHeal) {
           return {
             verdict: "needs_heal",
-            reason: "Strong oracle present but error looks like a locator miss \u2014 attempt heal",
+            reason: "Strong oracle present but the element was not found \u2014 attempt heal first",
             shouldHeal: true,
             evidence
           };
@@ -85938,7 +86759,7 @@ var require_oracle_protection = __commonJS({
           return `heal patch dropped assertText outcome proof (${before.assertTexts.length} \u2192 ${after.assertTexts.length})`;
         }
         if (lost.length > 0) {
-          const softKept = lost.every((t) => after.assertTexts.some((a) => a.includes(t) || t.includes(a)));
+          const softKept = lost.every((t) => after.assertTexts.some((a) => a === t || a.includes(t)));
           if (!softKept) {
             return `heal patch replaced assertText expectations (${lost.slice(0, 2).join("; ")}) \u2014 outcome must stay`;
           }
@@ -85964,6 +86785,23 @@ var require_oracle_protection = __commonJS({
           return `heal patch downgraded strong oracle "${key.slice(0, 60)}" to assertVisible`;
         }
       }
+      const OUTCOME_LANG = /\b(error|invalid|required|empty|saved|success|created|updated|deleted|removed|failed|missing)\b/i;
+      const CHROME_TARGET = /\b(tab|home|settings|back|menu|navigation|nav bar|bottom nav|status bar)\b/i;
+      for (const orig of original) {
+        if (orig.action !== "assertVisible" || !(0, failure_triage_js_1.isStrongOracleStep)(orig))
+          continue;
+        const origBlob = [orig.assertion, orig.description, orig.target?.primary].filter(Boolean).join(" ");
+        if (!OUTCOME_LANG.test(origBlob))
+          continue;
+        const key = normalizeText(orig.description ?? orig.assertion ?? "");
+        const match = patched.find((p) => p.action === "assertVisible" && normalizeText(p.description ?? p.assertion ?? "") === key);
+        if (!match)
+          continue;
+        const newTarget = match.target?.primary ?? "";
+        if (CHROME_TARGET.test(newTarget) && !OUTCOME_LANG.test(newTarget)) {
+          return `heal patch retargeted outcome assert "${key.slice(0, 60)}" onto chrome`;
+        }
+      }
       return null;
     }
     function oraclesPreserved(original, patched) {
@@ -86054,14 +86892,14 @@ var require_mobile_heal_postprocess = __commonJS({
         isVerifiedFix = false;
       const anrEnv = (0, anr_env_js_1.isAnrOrSystemUiEnvironmentFailure)(heal.healReason ?? args.finalError ?? args.reproduceError, typeof args.finalError === "string" ? args.finalError : void 0);
       const isConfigIssue = heal.verdict === "config_issue" || heal.verdict === "app_bug" && anrEnv;
-      const isAppBug = !anrEnv && (heal.verdict === "app_bug" || Boolean(oracleWeakening && heal.passed));
+      const isAppBug = !anrEnv && heal.verdict === "app_bug";
       const extraTags = new Set((heal.extraTags ?? []).filter((t) => typeof t === "string" && t.length > 0));
       if (secretLeak)
         extraTags.add("@needs-review");
-      if (oracleWeakening && !anrEnv) {
-        extraTags.add("@needs-review");
+      if (isAppBug)
         extraTags.add("@bug-found");
-      }
+      if (oracleWeakening && !anrEnv)
+        extraTags.add("@needs-review");
       if (anrEnv) {
         extraTags.delete("@bug-found");
         extraTags.add("@needs-review");
@@ -86085,7 +86923,7 @@ var require_mobile_heal_postprocess = __commonJS({
       } else if (secretLeak) {
         error2 = `HEAL_SECRET_LEAK: healed steps contained a literal secret (${secretLeak}); patch dropped, tagged @needs-review`;
       } else if (oracleWeakening && !anrEnv) {
-        error2 = `APP_BUG: heal attempted to drop strong oracle (${oracleWeakening}); patch refused`;
+        error2 = `HEAL_ORACLE_REFUSED: heal attempted to weaken a strong oracle (${oracleWeakening}); patch refused, tagged @needs-review`;
       } else if (isConfigIssue) {
         const reason = heal.healReason ?? args.finalError ?? args.reproduceError ?? "environment/rate-limit blocker";
         error2 = anrEnv ? `CONFIG_ISSUE: ANR / System UI freeze (not a product assertion failure) \u2014 ${reason}` : `CONFIG_ISSUE: ${reason}`;
@@ -86542,7 +87380,7 @@ Reason over steps + error + tree + registry and return working healed steps. Do
 1. ERROR: which step failed, on what locator/assertion? "element not found"/"no such element" almost always means a WRONG LOCATOR on a screen that DOES exist \u2014 pick a stronger IDENTITY locator that is actually present in the captured tree: a resource-id, an accessibility-id/content-desc, or an EXACT @text= predicate (never a loose contains()). Do NOT declare a feature absent from one failed locator.
 2. STEP RESULTS: which steps passed before the failure.
 3. TREE: does the current screen match what the failed step expects?
-3b. STALE EMPTY-STATE ASSERT: a failing assert on one-time / data-dependent UI (empty-state CTAs, first-run prompts, onboarding banners) is NOT a locator problem \u2014 the element is gone because the account now has data. REPLACE the assertion with a durable landing-screen anchor (tab label, header, nav bar) that proves the same outcome (verdict fix).
+3b. MISSING PRODUCT OUTCOME: a failing assert on empty-state CTAs, confirmation copy, a created/deleted row, or validation text is a PRODUCT oracle, not a locator problem. If that outcome is absent from a healthy screen, return verdict "app_bug". Do NOT replace outcome asserts with tab / header / nav chrome. Only retarget a locator when the SAME outcome copy is present in the tree.
 3c. ANR / "System UI isn't responding" / freeze dialogs: this is ENVIRONMENT (config_issue), NOT app_bug. Do not quarantine product bugs for device freezes.
 4. EXTERNAL AUTH HANDOFF: if the failure says the foreground app changed outside the target app after a Login / Sign In tap, and the steps never enter email/password credentials, do NOT heal by choosing Google/Apple/Facebook/SSO or another external app. If the test later expects Logout/session state, return test_invalid or prereq_unmet: the recorded test lacks a real credential setup.
 5. ENTRY-SCREEN DRIFT ("unexpected screen"/"screen drift"): the app started on a DIFFERENT screen than recorded; the fix is usually a MISSING NAVIGATION step (e.g. tap the onboarding/welcome CTA present in the tree before the recorded first step). Author it from the tree if you can (verdict fix); if a single static tree is insufficient, return needs_device.
@@ -86793,6 +87631,14 @@ For a fix, return the COMPLETE steps array (not a diff).
     function isIdentityEqualityXpath(value) {
       return /@[A-Za-z_:][-A-Za-z0-9_:.]*\s*=/.test(value) && !/(?:contains|starts-with)\s*\(/i.test(value);
     }
+    var STEP_ACTIONS_NEEDING_ELEMENT = /* @__PURE__ */ new Set([
+      "tap",
+      "type",
+      "clear",
+      "waitForElement",
+      "assertVisible",
+      "assertText"
+    ]);
     function stepLacksIdentityAnchor(step) {
       const metadata = step.metadata;
       if (metadata && (metadata.appContext === "WEBVIEW" || typeof metadata.webCss === "string"))
@@ -86833,7 +87679,7 @@ For a fix, return the COMPLETE steps array (not a diff).
     async function tryIdentityGateStaticRepair(steps, target, ctx, options) {
       if (!ctx.error || !IDENTITY_GATE_ERROR_RE.test(ctx.error))
         return null;
-      const identityless = steps.filter(stepLacksIdentityAnchor);
+      const identityless = steps.filter((step) => STEP_ACTIONS_NEEDING_ELEMENT.has(step.action) && stepLacksIdentityAnchor(step));
       if (identityless.length === 0)
         return null;
       const isAssert = (step) => /^assert/i.test(step.action);
@@ -86844,7 +87690,8 @@ For a fix, return the COMPLETE steps array (not a diff).
           healReason: "identity gate: an action step carries no identity locator (accessibility id / resource id / text); the recording lacks the anchors replay requires \u2014 re-record the step"
         };
       }
-      const pruned = steps.filter((step) => !stepLacksIdentityAnchor(step));
+      const identitylessOrders = new Set(identityless.map((step) => step.order));
+      const pruned = steps.filter((step) => !identitylessOrders.has(step.order));
       if (pruned.length === 0 || !pruned.some(isAssert) || !options.runNativeTest) {
         return {
           passed: false,
@@ -86852,6 +87699,14 @@ For a fix, return the COMPLETE steps array (not a diff).
           healReason: "identity gate: the only assertion(s) carry no identity locator, so the test cannot prove its outcome as recorded \u2014 re-record with an identifiable anchor"
         };
       }
+      const identityOracleRejection = (0, oracle_protection_js_1.rejectOracleWeakeningPatch)(steps, pruned);
+      if (identityOracleRejection) {
+        return {
+          passed: false,
+          verdict: "app_bug",
+          healReason: `identity gate: pruning identity-less asserts would drop product oracles (${identityOracleRejection})`
+        };
+      }
       const reindexed = pruned.map((step, order) => ({ ...step, order }));
       try {
         const verify = await options.runNativeTest({ steps: reindexed, target, testVariables: ctx.testVariables });
@@ -87108,7 +87963,12 @@ ${safeLastError}`);
 ${args.directive}`);
       return parts.join("\n\n");
     }
-    function findFailingStepIndex(steps, error2) {
+    function findFailingStepIndex(steps, error2, failedStepOrder) {
+      if (typeof failedStepOrder === "number") {
+        const exact = steps.findIndex((step) => step.order === failedStepOrder);
+        if (exact >= 0)
+          return exact;
+      }
       const withTarget = steps.map((step, index) => ({ step, index })).filter((entry) => Boolean(entry.step.target?.primary));
       if (withTarget.length === 0)
         return -1;
@@ -87144,9 +88004,13 @@ ${args.directive}`);
       if (!runNativeTest || !options.selectorRegistryContext || !ctx.error)
         return null;
       const candidates = (0, selector_registry_context_js_1.collectMobileRegistryCandidates)(options.selectorRegistryContext);
-      const failingIndex = findFailingStepIndex(steps, ctx.error);
+      const failingIndex = findFailingStepIndex(steps, ctx.error, ctx.failedStepOrder);
       if (failingIndex < 0)
         return null;
+      if ((0, failure_triage_js_1.isOracleStep)(steps[failingIndex])) {
+        options.onProgress?.(`Registry preflight skipped: step ${steps[failingIndex].order} is an oracle (${steps[failingIndex].action}) \u2014 a registry selector cannot stand in for a product outcome`);
+        return null;
+      }
       let tried = 0;
       for (const candidate of candidates) {
         if (tried >= REGISTRY_PREFLIGHT_MAX_CANDIDATES)
@@ -87156,6 +88020,8 @@ ${args.directive}`);
           continue;
         tried += 1;
         const healedSteps = substituteStepTarget(steps, failingIndex, candidate, mapped.locatorBundle);
+        if ((0, oracle_protection_js_1.rejectOracleWeakeningPatch)(steps, healedSteps))
+          continue;
         let verify;
         try {
           verify = await runNativeTest({ steps: healedSteps, target, testVariables: ctx.testVariables });
@@ -87481,6 +88347,41 @@ ${args.directive}`);
     async function executeMobileTestWithHealing2(steps, target, ctx, options) {
       return timed("total", "heal-total", options.onProgress, () => executeMobileTestWithHealingImpl(steps, target, ctx, options));
     }
+    var TERMINAL_HEAL_VERDICTS = /* @__PURE__ */ new Set([
+      "app_bug",
+      "config_issue",
+      "prereq_unmet",
+      "state_stale",
+      "test_invalid",
+      "unhealable_dynamic"
+    ]);
+    function escalateFailedHealToTriage(steps, ctx, lastError) {
+      const post = (0, failure_triage_js_1.triageMobileFailure)({
+        steps,
+        error: lastError ?? ctx.error,
+        logs: ctx.logs,
+        tags: ctx.tags,
+        // Heal already ran and failed. Bump past the locator-miss heal window
+        // so a remaining strong-oracle fail becomes APP_BUG, not silent FAILED.
+        failureCount: Math.max(3, (ctx.failureCount ?? 1) + 1),
+        failedStepOrder: ctx.failedStepOrder,
+        // Heal ran and failed: a still-missing element is no longer "maybe drift".
+        postHeal: true,
+        uiSuccessWithFailedWriteApi: (0, network_oracle_js_1.uiSuccessWithFailedWriteApi)({
+          apiCalls: ctx.apiCalls,
+          uiPathSucceeded: ctx.uiPathSucceeded
+        })
+      });
+      const term = (0, failure_triage_js_1.triageToHealTerminal)(post);
+      if (!term)
+        return null;
+      return {
+        passed: false,
+        verdict: term.verdict,
+        healReason: term.healReason,
+        extraTags: term.extraTags
+      };
+    }
     async function executeMobileTestWithHealingImpl(steps, target, ctx, options) {
       const invalidAuthSetup = detectInvalidMobileAuthSetup(steps, ctx.error);
       if (invalidAuthSetup) {
@@ -87496,6 +88397,7 @@ ${args.directive}`);
         logs: ctx.logs,
         tags: ctx.tags,
         failureCount: ctx.failureCount,
+        failedStepOrder: ctx.failedStepOrder,
         uiSuccessWithFailedWriteApi: networkBug
       });
       options.onProgress?.(`Pre-heal triage: ${triage.verdict} \u2014 ${triage.reason}`);
@@ -87553,6 +88455,17 @@ ${args.directive}`);
           if (live.providerUnavailable) {
             return await tryDeterministicProviderFallback({ steps, target, ctx, options }) ?? live;
           }
+          if (!live.passed && !TERMINAL_HEAL_VERDICTS.has(live.verdict)) {
+            const escalated = escalateFailedHealToTriage(steps, ctx, live.healReason ?? ctx.error);
+            if (escalated) {
+              return {
+                ...live,
+                ...escalated,
+                healedSteps: live.healedSteps,
+                healedAppiumCode: live.healedAppiumCode
+              };
+            }
+          }
           return live;
         } catch {
           return {
@@ -87564,6 +88477,21 @@ ${args.directive}`);
           };
         }
       }
+      if (!script.passed && !TERMINAL_HEAL_VERDICTS.has(script.verdict)) {
+        const escalated = escalateFailedHealToTriage(steps, ctx, script.lastError ?? script.healReason ?? ctx.error);
+        if (escalated) {
+          return {
+            passed: false,
+            verdict: escalated.verdict,
+            healedSteps: script.healedSteps,
+            healedAppiumCode: script.healedAppiumCode,
+            healReason: escalated.healReason,
+            extraTags: escalated.extraTags,
+            confidence: script.confidence,
+            removeTags: script.removeTags
+          };
+        }
+      }
       return {
         passed: script.passed,
         healedSteps: script.healedSteps,
@@ -87584,7 +88512,12 @@ The recorded flow may have expected a DIFFERENT starting screen than the one sho
 1. Compare the recorded first step's expected screen to the LIVE tree.
 2. If they differ, PREPEND the missing navigation step(s), authored from IDENTITY locators (resource-id, accessibility-id, or EXACT @text=) that are PRESENT in the LIVE tree \u2014 never a loose contains().
 3. If a locator is simply wrong, swap it for a stronger identity locator present in the LIVE tree.
-3b. If the failing step ASSERTS one-time / data-dependent UI (an empty-state CTA or first-run prompt) that is absent from the LIVE tree while the screen is otherwise correct, the assert is STALE \u2014 replace it with a durable element of the same screen (tab label, header, nav bar) and keep the rest.
+3b. If the failing step ASSERTS a product outcome (empty-state CTA, confirmation, created/deleted row, validation text) that is absent from a healthy LIVE tree, return verdict "app_bug". Do NOT replace that assert with tab / header / nav chrome. Only retarget a locator when the SAME outcome copy is present in the live tree.
+## Strong oracle protection (non-negotiable)
+- NEVER remove or downgrade assertStateDelta, captureState, or assertText outcome proof to go green.
+- NEVER replace a durable outcome assert with mere assertVisible of a tab/header.
+- You MAY fix locators, waits, and navigation around those oracles.
+- If the app truly violates the oracle on a healthy UI, return verdict "app_bug" instead of stripping the assert.
 4. If the prior failure says the foreground app changed outside the target app after a Login / Sign In tap, and the steps never enter email/password credentials, do NOT observe/tap Google/Apple/Facebook/SSO. For logout/session tests, return test_invalid or prereq_unmet because the recorded test lacks a real credential setup.
 5. If you cannot yet SEE the screen you need, use "observe" to advance ONE step, then you will be re-shown the new live screen.
 ## Response \u2014 STRICT JSON, exactly one verdict:
@@ -87593,7 +88526,7 @@ The recorded flow may have expected a DIFFERENT starting screen than the one sho
 {"verdict":"observe","action":{"type":"back"}}
 {"verdict":"observe","action":{"type":"relaunch"}}
 {"verdict":"observe","action":{"type":"reset"}}   \u2190 clears app data + cold-relaunches: use when the app is in the WRONG STATE for the recorded flow (e.g. signed in when the test expects the cleared first-launch screens, stale onboarding, poisoned local state)
-{"verdict":"app_bug","reason":"app crashed/blank/5xx (NOT rate-limit)"}
+{"verdict":"app_bug","reason":"product defect with durable oracle evidence (wrong entity, validation bypass, wrong count, missing confirmation) \u2014 NOT ANR/System UI"}
 {"verdict":"config_issue","reason":"429/rate limit/lockout/quota"}
 {"verdict":"needs_device","reason":"cannot resolve even with live access"}
 {"verdict":"prereq_unmet","reason":"required entity/state absent for the account"}
@@ -87844,6 +88777,7 @@ var require_browser_config = __commonJS({
     var path_1 = require("path");
     var os_1 = require("os");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
+    var google_signin_js_1 = require_google_signin();
     exports2.IS_CLOUD = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
     exports2.CLOUD_ARGS = [
       "--no-sandbox",
@@ -87949,6 +88883,10 @@ var require_browser_config = __commonJS({
       (document.head || document.documentElement).appendChild(style);
 
       // Layer 2: Web Animations API - make instant (preserves completion callbacks)
+      try {
+        Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+      } catch {}
+
       const origAnimate = Element.prototype.animate;
       Element.prototype.animate = function(keyframes, options) {
         if (typeof options === 'object' && options !== null) {
@@ -88055,6 +88993,20 @@ var require_browser_config = __commonJS({
         return null;
       }
     }
+    function googleSsoCloudLaunch(env = process.env) {
+      if (!(0, shared_1.parseBoolFlag)(env.RUNNER_CLOUD))
+        return null;
+      if (!(0, google_signin_js_1.loadGoogleSignInConfig)(env))
+        return null;
+      const executablePath = getFullChromiumPath();
+      if (!executablePath)
+        return null;
+      return {
+        executablePath,
+        extraArgs: ["--headless=new"],
+        ignoreDefaultArgs: ["--enable-automation"]
+      };
+    }
     function getMCPBrowserConfig2(opts) {
       const userDataDir = opts?.forceIsolated ? null : getTestUserDataDir2();
       const headless = isHeadless2();
@@ -88078,15 +89030,21 @@ var require_browser_config = __commonJS({
         };
       }
       const headlessShellPath = getHeadlessShellPath();
-      const useHeadlessShell = headless && headlessShellPath && !opts?.harPath;
+      const googleLaunch = googleSsoCloudLaunch();
+      const useHeadlessShell = headless && headlessShellPath && !opts?.harPath && !googleLaunch;
+      const cloud = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
+      const args = [
+        ...cloud ? exports2.CLOUD_ARGS : ["--disable-blink-features=AutomationControlled"],
+        ...googleLaunch?.extraArgs ?? []
+      ];
       return {
         browserName: "chromium",
         isolated: true,
         launchOptions: {
-          headless,
-          ...useHeadlessShell ? { executablePath: headlessShellPath } : {},
+          headless: googleLaunch ? false : headless,
+          ...googleLaunch ? { executablePath: googleLaunch.executablePath, ignoreDefaultArgs: googleLaunch.ignoreDefaultArgs } : useHeadlessShell ? { executablePath: headlessShellPath } : {},
           channel: "",
-          args: exports2.IS_CLOUD ? exports2.CLOUD_ARGS : ["--disable-blink-features=AutomationControlled"],
+          args,
           ...slowMo > 0 ? { slowMo } : {}
         },
         contextOptions: {
@@ -88099,15 +89057,21 @@ var require_browser_config = __commonJS({
     function getPlaywrightLaunchOptions2(withProfile = false, extraArgs) {
       const headless = isHeadless2();
       const slowMo = getSlowMoMs();
+      const googleLaunch = googleSsoCloudLaunch();
       const baseArgs = exports2.IS_CLOUD ? exports2.CLOUD_ARGS : [
         "--disable-blink-features=AutomationControlled"
       ];
-      const mergedArgs = extraArgs && extraArgs.length > 0 ? [...baseArgs, ...extraArgs] : [...baseArgs];
+      const mergedArgs = [
+        ...baseArgs,
+        ...googleLaunch?.extraArgs ?? [],
+        ...extraArgs && extraArgs.length > 0 ? extraArgs : []
+      ];
       return {
-        headless,
+        headless: googleLaunch ? false : headless,
         // Use Chrome channel only when a real Chrome user profile is being loaded.
         // In isolated mode, bundled Chromium avoids hard dependency on Chrome installation.
         ...exports2.IS_CLOUD || !withProfile ? {} : { channel: "chrome" },
+        ...googleLaunch ? { executablePath: googleLaunch.executablePath, ignoreDefaultArgs: googleLaunch.ignoreDefaultArgs } : {},
         args: mergedArgs,
         ...slowMo > 0 ? { slowMo } : {}
       };
@@ -91660,7 +92624,7 @@ var require_kill_tree = __commonJS({
     var node_child_process_1 = require("child_process");
     var node_util_1 = require("util");
     var node_fs_1 = require("fs");
-    var execFileAsync4 = (0, node_util_1.promisify)(node_child_process_1.execFile);
+    var execFileAsync5 = (0, node_util_1.promisify)(node_child_process_1.execFile);
     var PS_TIMEOUT_MS = 2e3;
     var PS_BUFFER = 1024 * 1024;
     async function gracefulCloseWithTreeKill(options) {
@@ -91714,7 +92678,7 @@ var require_kill_tree = __commonJS({
       timer.unref?.();
       let stdout;
       try {
-        const result = await execFileAsync4("ps", ["-A", "-o", "pid=,ppid=,command="], {
+        const result = await execFileAsync5("ps", ["-A", "-o", "pid=,ppid=,command="], {
           maxBuffer: PS_BUFFER,
           signal: controller.signal
         });
@@ -91752,7 +92716,7 @@ var require_kill_tree = __commonJS({
       timer.unref?.();
       let stdout;
       try {
-        const result = await execFileAsync4("ps", ["-A", "-o", "pid=,ppid=,command="], {
+        const result = await execFileAsync5("ps", ["-A", "-o", "pid=,ppid=,command="], {
           maxBuffer: PS_BUFFER,
           signal: controller.signal
         });
@@ -91829,7 +92793,7 @@ var require_kill_tree = __commonJS({
       timer.unref?.();
       let stdout;
       try {
-        const result = await execFileAsync4("ps", ["-A", "-o", "pid=,ppid="], {
+        const result = await execFileAsync5("ps", ["-A", "-o", "pid=,ppid="], {
           maxBuffer: PS_BUFFER,
           signal: controller.signal
         });
@@ -101405,13 +102369,12 @@ Every assertion in the generated test must be proven live.
 **Frame**
 - \`import { test, expect } from '@playwright/test'\` with tags [${tagLiteral}].
 - Credentials: \`process.env.TEST_USER_EMAIL!\` / \`process.env.TEST_USER_PASSWORD!\` \u2014 never hardcode. ${emailVerifyArmed ? `Registration uses \`process.env.${test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV}!\` (the fresh real inbox address the runner mints per run \u2014 it RECEIVES the verification email; see the EMAIL VERIFICATION TEST section) with \`process.env.${test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV}!\`. Do NOT register with an \`@example.com\` address \u2014 that domain receives no mail and email verification will hang.` : `Registration uses \`testuser-\${Date.now()}@example.com\`.`}
-- **Credential rotation (rare \u2014 read carefully):** emit \`persistCredential\` ONLY when the scenario:
-  (a) logs in as the STORED test user (the test uses \`process.env.TEST_USER_PASSWORD\` to log in \u2014 i.e. the credential listed under the Browser Credentials section above), AND
-  (b) successfully rotates THAT SAME user's credential (e.g. user opens *their own* settings \u2192 Change Password \u2192 submits \u2192 success toast), AND
-  (c) the test has an assertion proving the change took effect.
-  When all three hold, generate a fresh value into a local const (\`const newPassword = \\\`Pw-\\\${Date.now()}-\\\${Math.random().toString(36).slice(2, 8)}!\\\`\`), fill it into the new-password / confirm fields, submit, verify success, THEN add: \`import { persistCredential } from '../setup/credentials';\` at the top and \`await persistCredential('TEST_USER_PASSWORD', newPassword, 'short reason');\` as the LAST statement in the test body. Also add the tag \`@mutates-credential:TEST_USER_PASSWORD\` to the test options array. Adjust the relative path of the import to match the spec's location (e.g. \`'../../setup/credentials'\` for deeply-nested specs).
-- **Do NOT emit \`persistCredential\` when:** (i) the scenario registers a fresh user (${emailVerifyArmed ? `e.g. the runner-minted \`process.env.${test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV}!\` inbox account` : `e.g. \`testuser-\${Date.now()}@example.com\``}) and rotates THAT user's password \u2014 the fresh user is throwaway, the stored credential is untouched; (ii) the scenario is a negative test verifying a bad-password / mismatched-confirm / empty-field / permission-denied case; (iii) the scenario only fills form validation paths without a successful submit. In all these cases simply omit the call.
-- **Restore-inline is FORBIDDEN for the stored user.** Never "change the stored user's password to a temp value, then change it back to the old one" as plain sequential statements. The change mutates the LIVE account immediately; if any later step (the second navigation, the restore submit, the success assertion) fails, the live password stays at the temp value while \`process.env.TEST_USER_PASSWORD\` still holds the old one \u2014 and every other auth test then fails to log in. The ONLY supported way to mutate the stored user's password is rotate-FORWARD via \`persistCredential\` (above): change it to a fresh value, verify success, and write that SAME final value back as the last statement. Do NOT restore the old password, and do NOT introduce a temp-then-revert sequence.
+- **Credential rotation (REQUIRED when the STORED user's password changes):** emit \`persistCredential\` whenever the scenario successfully changes the password (or other secret) of the STORED test user \u2014 the account identified by \`process.env.TEST_USER_EMAIL!\` / \`process.env.TEST_USER_PASSWORD!\` (the credentials listed under Browser Credentials above). This includes BOTH:
+  (a) **In-session change password** \u2014 log in as the stored user, open *their own* settings \u2192 Change Password \u2192 submit \u2192 success assertion; AND
+  (b) **Forgot-password / password-reset of the stored user** \u2014 request a reset for \`process.env.TEST_USER_EMAIL!\` (logged-out is fine), complete the emailed link/code, set a NEW password on the reset form, and assert success. You do NOT need a prior login with the old password \u2014 a successful reset of the stored account still MUST write the new password back so the Test Data page stays correct and later tests do not fail with stale credentials.
+  When either case holds, generate a fresh value into a local const (\`const newPassword = \\\`Pw-\\\${Date.now()}-\\\${Math.random().toString(36).slice(2, 8)}!\\\`\`), fill it into the new-password / confirm fields, submit, verify success, THEN add: \`import { persistCredential } from '../setup/credentials';\` at the top and \`await persistCredential('TEST_USER_PASSWORD', newPassword, 'short reason');\` as the LAST statement in the test body (after the final assertion is fine only if the assertion does not depend on the write-back; prefer write-back immediately after the success proof). Also add the tag \`@mutates-credential:TEST_USER_PASSWORD\` to the test options array. Adjust the relative path of the import to match the spec's location (e.g. \`'../../setup/credentials'\` for deeply-nested specs).
+- **Do NOT emit \`persistCredential\` when:** (i) the scenario registers a fresh throwaway user (${emailVerifyArmed ? `e.g. the runner-minted \`process.env.${test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV}!\` inbox account` : `e.g. \`testuser-\${Date.now()}@example.com\``}) and rotates THAT user's password \u2014 the fresh user is throwaway, the stored credential is untouched; (ii) the scenario is a negative test verifying a bad-password / mismatched-confirm / empty-field / permission-denied case; (iii) the scenario only fills form validation paths without a successful submit; (iv) the scenario only requests a reset email without completing the reset and setting a new password. In all these cases simply omit the call.
+- **Restore-inline is FORBIDDEN for the stored user.** Never "change the stored user's password to a temp value, then change it back to the old one" as plain sequential statements. The change mutates the LIVE account immediately; if any later step (the second navigation, the restore submit, the success assertion) fails, the live password stays at the temp value while \`process.env.TEST_USER_PASSWORD\` still holds the old one \u2014 and every other auth test then fails to log in. The ONLY supported way to mutate the stored user's password is rotate-FORWARD via \`persistCredential\` (above): change it to a fresh value, verify success, and write that SAME final value back as the last write-back statement. Do NOT restore the old password, and do NOT introduce a temp-then-revert sequence.
 - **Start every test from \`${scenarioEntryRoute}\`.** ${hasVerifiedRecipe ? "Your first body line is the injected `await __vqaLogin(page);` \u2014 login is handled for you. After it, reach feature pages by clicking visible nav or a direct goto to the scenario route." : `First line: \`await page.goto('${scenarioEntryRoute}', { waitUntil: 'domcontentloaded' })\`. You are logged OUT; if the route redirects, that proves you must authenticate FIRST via the visible login flow \u2014 never \`waitForURL\` on a post-login route before submitting credentials.`} Do NOT deep-link to \`/login\` or \`/dashboard/...\` before login; reach feature pages by clicking visible nav (sidebar / topbar / link / button) like a user would.
 - ${hasVerifiedRecipe ? "Auth is proven inside `__vqaLogin` \u2014 do NOT add your own login or auth-proof assertion; focus your assertions on the feature outcome." : tags.includes("@needs-auth") ? "For `@needs-auth` scenarios, add one auth-proof assertion before feature steps: prefer Logout button, then avatar/menu, authenticated sidebar/nav, or a stable post-login heading. Never use user email, time-of-day greetings, display name text, personalized headings, or redirect alone." : "Use stable assertions tied to the current flow \u2014 avoid personalized or account-specific copy when a structural proof exists."}
 - Always \`await\` on \`expect()\`. Never use \`test.tags()\` as a method \u2014 tags go in the options object.
@@ -102025,7 +102988,7 @@ Fix EVERY flagged locator, keep every other line exactly as-is, then submit the
                 }
                 const verifyCallsSinceLastFinish = verifyCallCount - verifyCallsAtLastFinishGenerate;
                 verifyCallsAtLastFinishGenerate = verifyCallCount;
-                const bugWitnessEnabled = (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_BUG_WITNESS_ENABLED);
+                const bugWitnessEnabled = (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_BUG_WITNESS_ENABLED, true);
                 const bugWitnessVerdict = bugWitnessEnabled ? resolveSuspectedBugVerdict(suspectedBugDeclared, bugDescription, verifyCallsSinceLastFinish, strengthVerdict?.signals) : null;
                 if (bugWitnessVerdict) {
                   strengthVerdict = bugWitnessVerdict;
@@ -319450,6 +320413,7 @@ var require_playwright_mcp_config = __commonJS({
     var promises_1 = require("fs/promises");
     var node_path_1 = require("path");
     var browser_config_js_1 = require_browser_config();
+    var google_signin_js_1 = require_google_signin();
     var PLAYWRIGHT_MCP_VERSION = "0.0.68";
     var INBOX_SECRET_ENV_KEYS = [
       "VERIFICATION_INBOX_HOST",
@@ -319459,7 +320423,10 @@ var require_playwright_mcp_config = __commonJS({
       "VERIFICATION_INBOX_PASSWORD",
       "VERIFICATION_INBOX_ADDRESS",
       "VERIFICATION_INBOX_MAILBOX",
-      "VERIFICATION_INBOX_EXTRA_MAILBOXES"
+      "VERIFICATION_INBOX_EXTRA_MAILBOXES",
+      "GOOGLE_SIGNIN_PASSWORD",
+      "GOOGLE_SIGNIN_EMAIL",
+      "GOOGLE_SIGNIN_TOTP_SECRET"
     ];
     function collectInboxSecretEnv() {
       const out = {};
@@ -319500,12 +320467,13 @@ var require_playwright_mcp_config = __commonJS({
       const body = cfg.format === "json" ? buildJsonConfig(cfg) : buildTomlConfig(cfg);
       await (0, promises_1.writeFile)(cfg.configPath, body, { encoding: "utf8", mode: 384 });
       if (!cfg.cdpEndpoint && browser_config_js_1.IS_CLOUD) {
+        const launchOptions = (0, browser_config_js_1.getMCPBrowserConfig)({ forceIsolated: true }).launchOptions ?? {
+          headless: true,
+          args: [...browser_config_js_1.CLOUD_ARGS]
+        };
         const browserConfig = {
           browser: {
-            launchOptions: {
-              headless: true,
-              args: [...browser_config_js_1.CLOUD_ARGS]
-            }
+            launchOptions
           }
         };
         await (0, promises_1.writeFile)(mcpBrowserConfigPath(cfg.configPath), JSON.stringify(browserConfig, null, 2) + "\n", { encoding: "utf8", mode: 384 });
@@ -319529,7 +320497,11 @@ var require_playwright_mcp_config = __commonJS({
       ];
       if (cfg.includeCredentialServer && cfg.cdpEndpoint) {
         const serverJs = (0, node_path_1.join)(__dirname, "credential-mcp-server.js");
-        blocks.push("[mcp_servers.validateqa_credentials]", 'command = "node"', `args = ["${tomlEscape(serverJs)}"]`, "enabled = true", "startup_timeout_sec = 30", "tool_timeout_sec = 60", "", "[mcp_servers.validateqa_credentials.env]", `CDP_ENDPOINT = "${tomlEscape(cfg.cdpEndpoint)}"`, "");
+        blocks.push("[mcp_servers.validateqa_credentials]", 'command = "node"', `args = ["${tomlEscape(serverJs)}"]`, "enabled = true", "startup_timeout_sec = 30", "tool_timeout_sec = 60", "", "[mcp_servers.validateqa_credentials.env]", `CDP_ENDPOINT = "${tomlEscape(cfg.cdpEndpoint)}"`);
+        for (const [k, v] of Object.entries((0, google_signin_js_1.collectGoogleSignInEnv)())) {
+          blocks.push(`${k} = "${tomlEscape(v)}"`);
+        }
+        blocks.push("");
       }
       if (cfg.includeDiscoveryServer) {
         if (!cfg.runDir) {
@@ -319577,7 +320549,7 @@ var require_playwright_mcp_config = __commonJS({
           type: "stdio",
           command: "node",
           args: [serverJs],
-          env: { CDP_ENDPOINT: cfg.cdpEndpoint }
+          env: { CDP_ENDPOINT: cfg.cdpEndpoint, ...(0, google_signin_js_1.collectGoogleSignInEnv)() }
         };
       }
       if (cfg.includeDiscoveryServer) {
@@ -327784,6 +328756,7 @@ var require_discover_explorer = __commonJS({
     var credential_tools_js_1 = require_credential_tools();
     var inbox_tools_js_1 = require_inbox_tools();
     var verification_inbox_js_1 = require_verification_inbox();
+    var google_signin_js_1 = require_google_signin();
     var discover_planner_js_1 = require_discover_planner();
     var exploration_prompt_builder_js_1 = require_exploration_prompt_builder();
     var ai_queue_js_1 = require_ai_queue();
@@ -328188,7 +329161,8 @@ NEVER assert: user-specific text (names, emails), counts/numbers, timestamps, ma
     };
     function buildSystemPrompt(baseUrl, variableContext, existingSiteMap, existingTestNames, options) {
       const browserCredentials = variableContext.allTestVariables ?? variableContext.publicTestVariables;
-      const { secrets: explorerSecretVars, publics: explorerPublicVarsRaw } = (0, credential_tools_js_1.partitionTestVariables)(browserCredentials);
+      const { secrets: explorerSecretVarsRaw, publics: explorerPublicVarsRaw } = (0, credential_tools_js_1.partitionTestVariables)(browserCredentials);
+      const explorerSecretVars = options?.inboxPrompt ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(explorerSecretVarsRaw) : explorerSecretVarsRaw;
       const hasCredentials = Object.keys(explorerSecretVars).length > 0;
       const { DISCOVERY_SHOULD_REGISTER: _omitRegisterFlag, ...explorerPublicVars } = explorerPublicVarsRaw;
       const explorerPublicLines = (0, credential_tools_js_1.renderPublicVariablesBlock)(explorerPublicVars);
@@ -328805,10 +329779,12 @@ ${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}` : ""}`;
       if (emailVerificationUnavailable) {
         logs2.push("Email verification unavailable \u2014 the agent will ATTEMPT registration once; any flow requiring an emailed code/link will be reported BLOCKED.");
       }
+      const googleGuidance = (0, google_signin_js_1.googleSignInGuidanceOpts)();
       const inboxPromptBlock = inboxState ? (0, inbox_tools_js_1.buildInboxPromptBlock)({
         email: inboxState.email,
         passwordKey: inboxState.passwordKey ?? "TEST_USER_PASSWORD",
-        context: options?.mode
+        context: options?.mode,
+        ...googleGuidance
       }) : "";
       try {
         const { tools: mcpTools } = await mcpClient.listTools();
@@ -328829,7 +329805,8 @@ ${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}` : ""}`;
         }
         const browserCredsForTools = variableContext.allTestVariables ?? variableContext.publicTestVariables;
         const { secrets: explorerToolSecrets } = (0, credential_tools_js_1.partitionTestVariables)(browserCredsForTools);
-        if (Object.keys(explorerToolSecrets).length > 0) {
+        const explorerToolSecretsWithGoogle = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(explorerToolSecrets) : explorerToolSecrets;
+        if (Object.keys(explorerToolSecretsWithGoogle).length > 0) {
           openaiTools.push(credential_tools_js_1.FILL_CREDENTIAL_TOOL, credential_tools_js_1.FILL_CREDENTIAL_FORM_TOOL);
           if (options?.onCredentialUpdate) {
             openaiTools.push(credential_tools_js_1.SET_CREDENTIAL_TOOL);
@@ -329469,8 +330446,12 @@ ${currentSummary}`;
           let finishBouncedThisBatch = false;
           let finishStreakCountedThisBatch = false;
           const fullVarMapForGuard = variableContext.allTestVariables ?? variableContext.publicTestVariables;
-          const { secrets: secretsOnlyForGuard } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMapForGuard);
-          const allowedCredentialValues = inboxState ? [inboxState.email] : [];
+          const { secrets: partitionedSecretsForGuard } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMapForGuard);
+          const secretsOnlyForGuard = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(partitionedSecretsForGuard) : partitionedSecretsForGuard;
+          const allowedCredentialValues = [...new Set([
+            ...inboxState ? [inboxState.email, inboxState.baseEmail] : [],
+            ...inboxState ? (0, google_signin_js_1.googleSignInAllowedEmails)() : []
+          ].filter((value) => !!value))];
           const secretsForLogging = Object.fromEntries(Object.entries(secretsOnlyForGuard).filter(([, value]) => !allowedCredentialValues.includes(value)));
           for (const toolCall of assistantMessage.tool_calls) {
             const toolName = toolCall.function.name;
@@ -330321,8 +331302,9 @@ Exploration complete: ${summary}`);
               }
               const fullVarMap = variableContext.allTestVariables ?? variableContext.publicTestVariables;
               const { secrets: dispatchSecrets } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMap);
+              const fillSecrets = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(dispatchSecrets) : dispatchSecrets;
               try {
-                const result = toolName === "fill_credential" ? await (0, credential_tools_js_1.handleFillCredential)(toolArgs, { mcpClient, credentials: dispatchSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS }) : await (0, credential_tools_js_1.handleFillCredentialForm)(toolArgs, { mcpClient, credentials: dispatchSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS });
+                const result = toolName === "fill_credential" ? await (0, credential_tools_js_1.handleFillCredential)(toolArgs, { mcpClient, credentials: fillSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS }) : await (0, credential_tools_js_1.handleFillCredentialForm)(toolArgs, { mcpClient, credentials: fillSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS });
                 if (result.didMutate) {
                   lastSnapshotText = null;
                   const codeLines = (0, exploration_parser_js_1.extractCodeLines)(result.content);
@@ -332362,7 +333344,7 @@ ${keyLines || "- (none provided)"}
 ## EXACTLY what to do
 1. Navigate to ${baseUrl} and take a \`browser_snapshot\`.
 2. Find the Sign Up / Register / Create account affordance (match by PURPOSE, in the app's own language) and open the signup form. If a reveal button hides the fields ("Sign up with Email"), click it first.
-3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit.
+3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit. If there is NO email+password signup field and only "Continue with Google" / "Sign up with Gmail", follow the Google / Gmail SSO fallback in that section (bare Google account email, \`fill_credential\` with \`GOOGLE_SIGNIN_PASSWORD\`, never the IMAP app password).
 4. Complete email verification using the inbox tools (\`wait_for_verification\` \u2192 enter the code or \`open_verification_link\`). Re-poll if the email is slow; resend AT MOST once; NEVER register a second account.
 5. Confirm you are signed in \u2014 a redirect to an authenticated route, or an in-place change to authenticated content. Take a \`browser_snapshot\`.
 6. \`capture_page\` the authenticated landing page in its DEFAULT state, then call \`finish_exploration\`. Do this the MOMENT the account is verified and you are signed in.
@@ -332916,6 +333898,7 @@ var require_grok_survey_runner = __commonJS({
     var grok_cli_js_1 = require_grok_cli();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var exploration_parser_js_1 = require_exploration_parser();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_survey_prompts_js_1 = require_agentic_survey_prompts();
@@ -333440,7 +334423,7 @@ var require_grok_survey_runner = __commonJS({
       };
       const surveyAgentsMd = inboxReg ? `${(0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)()}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)();
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)();
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
@@ -334847,6 +335830,7 @@ var require_grok_discovery_runner = __commonJS({
     var playwright_native_js_1 = require_playwright_native();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var grok_survey_runner_js_1 = require_grok_survey_runner();
     var agentic_discovery_prompts_js_1 = require_agentic_discovery_prompts();
@@ -335140,7 +336124,7 @@ var require_grok_discovery_runner = __commonJS({
         };
         const discoveryAgentsMd = inboxReg ? `${(0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)()}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)();
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)();
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), discoveryAgentsMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -336093,7 +337077,7 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
 
 ---
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxRegV2.email, inboxRegV2.passwordKey)}` : "");
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxRegV2.email, inboxRegV2.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : "");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), agentsMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -337065,6 +338049,7 @@ var require_claude_survey_runner = __commonJS({
     var claude_stream_parser_js_1 = require_claude_stream_parser();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
     var grok_survey_runner_js_1 = require_grok_survey_runner();
@@ -337165,7 +338150,7 @@ ${preview}`);
       };
       const surveyAgentsMd = inboxReg ? `${(0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode })}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode });
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode });
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
@@ -337875,6 +338860,7 @@ var require_claude_discovery_runner = __commonJS({
     var claude_cli_js_1 = require_claude_cli();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var coverage_examples_content_js_1 = require_coverage_examples_content();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
@@ -338043,7 +339029,7 @@ var require_claude_discovery_runner = __commonJS({
         };
         const explorerContractMd = inboxReg ? `${(0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput)}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput);
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput);
         await (0, promises_1.writeFile)(claudeMdPath, explorerContractMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -338915,6 +339901,10 @@ Explore complete: ${explore.exploreStats.pagesDiscovered} screens, ${explore.exp
           appId,
           platform: platform3,
           appBrief: ctx.appBrief,
+          // Optional project docs / knowledge facts — empty is valid; planner
+          // relies on live explorer evidence when absent (bug capture does not
+          // require documents).
+          knowledgeContext: ctx.knowledgeContext,
           featureName: ctx.featureName,
           existingTestNames: ctx.existingTestNames,
           existingFeatureNames: ctx.existingFeatureNames,
@@ -349075,7 +350065,7 @@ var require_update = __commonJS({
 var require_opts_arg = __commonJS({
   "../../node_modules/tar/node_modules/mkdirp/lib/opts-arg.js"(exports2, module2) {
     "use strict";
-    var { promisify: promisify4 } = require("util");
+    var { promisify: promisify5 } = require("util");
     var fs = require("fs");
     var optsArg = (opts) => {
       if (!opts)
@@ -349089,9 +350079,9 @@ var require_opts_arg = __commonJS({
       else
         throw new TypeError("invalid options argument");
       opts.mkdir = opts.mkdir || opts.fs.mkdir || fs.mkdir;
-      opts.mkdirAsync = promisify4(opts.mkdir);
+      opts.mkdirAsync = promisify5(opts.mkdir);
       opts.stat = opts.stat || opts.fs.stat || fs.stat;
-      opts.statAsync = promisify4(opts.stat);
+      opts.statAsync = promisify5(opts.stat);
       opts.statSync = opts.statSync || opts.fs.statSync || fs.statSync;
       opts.mkdirSync = opts.mkdirSync || opts.fs.mkdirSync || fs.mkdirSync;
       return opts;
@@ -353940,7 +354930,7 @@ var require_process_inventory = __commonJS({
     var node_child_process_1 = require("child_process");
     var node_os_1 = __importDefault(require("os"));
     var node_util_1 = require("util");
-    var execFileAsync4 = (0, node_util_1.promisify)(node_child_process_1.execFile);
+    var execFileAsync5 = (0, node_util_1.promisify)(node_child_process_1.execFile);
     var DEFAULT_LIMIT = 60;
     var DEFAULT_TIMEOUT_MS2 = 800;
     var MAX_COMMAND_LENGTH = 320;
@@ -354002,7 +354992,7 @@ var require_process_inventory = __commonJS({
       const timer = setTimeout(() => controller.abort(), timeoutMs);
       timer.unref?.();
       try {
-        const { stdout } = await execFileAsync4(command, args, {
+        const { stdout } = await execFileAsync5(command, args, {
           maxBuffer: 1024 * 1024,
           signal: controller.signal
         });
@@ -355296,7 +356286,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.91",
+      version: "1.0.93",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -356161,11 +357151,7 @@ var SYSTEM_UI_DISMISS_LABELS = [
   "OK",
   "Got it",
   "GOT IT",
-  "Continue",
-  "Close",
   "Dismiss",
-  "I understand",
-  "Accept",
   // Android 15+ / 16 KB page-size compatibility dialog primary action.
   "OK, got it"
 ];
@@ -360092,7 +361078,11 @@ async function executeAssertVisible(sessionId, step, platform3, isCrossPlatform
         tolerateAmbiguity: true
       });
       const result2 = await wdRequest(`${sessionPath}/element/${elementId2}/displayed`);
-      if (!result2?.value) throw new Error(`WEBVIEW element found but not visible: css=${css}`);
+      if (!result2?.value) {
+        throw new Error(
+          `Assertion failed: expected "${css}" to be visible, but the WEBVIEW element resolved and is not displayed`
+        );
+      }
     });
     return;
   }
@@ -360104,7 +361094,9 @@ async function executeAssertVisible(sessionId, step, platform3, isCrossPlatform
   });
   const result = await wdRequest(`/session/${sessionId}/element/${elementId}/displayed`);
   if (!result?.value) {
-    throw new Error(`Element found but not visible: ${step.target?.primary ?? "unknown"}`);
+    throw new Error(
+      `Assertion failed: expected "${step.target?.primary ?? "element"}" to be visible, but it resolved and is not displayed`
+    );
   }
 }
 async function executeAssertText(sessionId, step, platform3, isCrossPlatform = false) {
@@ -362631,8 +363623,28 @@ function getMirrorSessionId(deviceId) {
 }
 
 // src/services/mobile/mobile-bridge-driver.ts
+var import_node_child_process3 = require("child_process");
+var import_node_util3 = require("util");
 var import_runner_core9 = __toESM(require_dist2());
 init_dist();
+var execFileAsync4 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
+async function clearAndroidAppDataViaAdb(deviceId, appId) {
+  const serial = deviceId?.trim();
+  const pkg2 = appId?.trim();
+  if (!serial || !pkg2 || !serial.startsWith("emulator-")) return false;
+  try {
+    const { stdout, stderr } = await execFileAsync4(
+      "adb",
+      ["-s", serial, "shell", "pm", "clear", pkg2],
+      { timeout: 2e4, maxBuffer: 64 * 1024 }
+    );
+    const out = `${stdout ?? ""}
+${stderr ?? ""}`.toLowerCase();
+    return out.includes("success");
+  } catch {
+    return false;
+  }
+}
 var APPIUM_SESSION_ID_PATTERN2 = /^[a-f0-9-]{1,64}$/i;
 function isRecoverableAppiumSessionFailure(err) {
   if (isAppiumDriverDeadError(err)) return true;
@@ -363031,7 +364043,17 @@ var MobileBridgeDriver = class {
             throw new Error(`iOS simulator app-data reset failed: ${wiped.detail}`);
           }
         } else {
-          await this.executeScript("mobile: clearApp", [{ appId: this.appId }]);
+          const adbFirst = await clearAndroidAppDataViaAdb(this.deviceId, this.appId);
+          if (!adbFirst) {
+            try {
+              await this.executeScript("mobile: clearApp", [{ appId: this.appId }]);
+            } catch (clearErr) {
+              const adbCleared = await clearAndroidAppDataViaAdb(this.deviceId, this.appId);
+              if (!adbCleared) {
+                throw clearErr;
+              }
+            }
+          }
         }
         await this.executeScript("mobile: activateApp", [this.appLifecycleArgs()]);
         try {
@@ -364263,10 +365285,28 @@ function truncateAuditRequestBody(body) {
 function isTerminalAuditStatus(status) {
   return status === 400 || status === 404 || status === 409 || status === 413;
 }
+var AuditDrainError = class extends Error {
+  constructor(message, dropped) {
+    super(message);
+    this.dropped = dropped;
+    this.name = "AuditDrainError";
+  }
+};
+function auditDroppedFromDrainFailure(reason) {
+  if (reason instanceof AuditDrainError) return reason.dropped;
+  if (reason && typeof reason === "object" && "dropped" in reason) {
+    const dropped = reason.dropped;
+    if (typeof dropped === "number" && Number.isFinite(dropped)) {
+      return Math.max(0, Math.floor(dropped));
+    }
+  }
+  return 0;
+}
 function createAuditFlusher(url, headers) {
   const entries = [];
   let byteEstimate = 0;
   let flushInFlight = null;
+  let droppedTotal = 0;
   const doFlush = () => {
     if (entries.length === 0) return Promise.resolve();
     if (flushInFlight) return flushInFlight;
@@ -364289,9 +365329,16 @@ function createAuditFlusher(url, headers) {
               body: JSON.stringify({ entries: toSend.map((e) => e.entry) }),
               signal: AbortSignal.timeout(3e4)
             });
-            if (res.ok) continue;
+            if (res.ok) {
+              const ack = await res.json().catch(() => null);
+              if (typeof ack?.dropped === "number" && Number.isFinite(ack.dropped)) {
+                droppedTotal += Math.max(0, Math.floor(ack.dropped));
+              }
+              continue;
+            }
             if (isTerminalAuditStatus(res.status)) {
               console.warn(`[audit-flush] HTTP ${res.status} (terminal) - dropping ${toSend.length} audit entries`);
+              droppedTotal += toSend.length;
               continue;
             }
             entries.unshift(...toSend);
@@ -364331,6 +365378,7 @@ function createAuditFlusher(url, headers) {
         droppedCount++;
       }
       console.warn(`[audit-flush] queue over ${AUDIT_QUEUE_MAX_BYTES} bytes - dropped ${droppedCount} oldest audit entries`);
+      droppedTotal += droppedCount;
     }
     if (entries.length >= AUDIT_FLUSH_COUNT || byteEstimate >= AUDIT_FLUSH_BYTES) {
       void doFlush();
@@ -364339,16 +365387,20 @@ function createAuditFlusher(url, headers) {
   const drain = async () => {
     for (let attempt = 1; attempt <= AUDIT_DRAIN_ATTEMPTS; attempt++) {
       if (flushInFlight) await flushInFlight;
-      if (entries.length === 0) return;
+      if (entries.length === 0) return { dropped: droppedTotal };
       await doFlush();
-      if (entries.length === 0) return;
+      if (entries.length === 0) return { dropped: droppedTotal };
       if (attempt < AUDIT_DRAIN_ATTEMPTS) {
         await new Promise((resolve2) => setTimeout(resolve2, AUDIT_DRAIN_DELAY_MS * attempt));
       }
     }
     if (entries.length > 0) {
-      throw new Error(`audit drain failed after ${AUDIT_DRAIN_ATTEMPTS} attempts - ${entries.length} entries could not be flushed to ${url}`);
+      throw new AuditDrainError(
+        `audit drain failed after ${AUDIT_DRAIN_ATTEMPTS} attempts - ${entries.length} entries could not be flushed to ${url}`,
+        droppedTotal + entries.length
+      );
     }
+    return { dropped: droppedTotal };
   };
   return { push, drain };
 }
@@ -365597,7 +366649,7 @@ ${finalVerifyResult.logs ?? ""}`;
         log.warn("[stream] discovery-plan failed after 3 attempts - plan checkpoint skipped");
       };
       let discoveryResult;
-      const buildFinalBody = (r, overrideError, auditWarning) => {
+      const buildFinalBody = (r, overrideError, auditWarning, auditDroppedCount = 0) => {
         const isNativeDiscovery = ctx.medium === "IOS_NATIVE" || ctx.medium === "ANDROID_NATIVE";
         const { exploreFinalMessages: _exploreFinalMessages, ...rest } = r;
         void _exploreFinalMessages;
@@ -365610,6 +366662,7 @@ ${finalVerifyResult.logs ?? ""}`;
           summary: rest.summary,
           mode: rest.mode,
           error: overrideError ?? rest.error,
+          auditDroppedCount,
           // Resumable-pause checkpoint: native deep generation tripped the AI-overload breaker.
           // Without forwarding these, the server's isDiscoveryPaused is false → the run finalizes
           // COMPLETED/FAILED instead of PAUSED → the Resume affordance never appears for
@@ -365995,12 +367048,13 @@ ${finalVerifyResult.logs ?? ""}`;
           discoveryAuditWarning = `[audit] ${drainErr instanceof Error ? drainErr.message : String(drainErr)}`;
           console.warn(`[runner] ${discoveryAuditWarning}`);
         }
+        const auditDroppedCount = drainOutcome.status === "fulfilled" ? drainOutcome.value.dropped : auditDroppedFromDrainFailure(drainOutcome.reason);
         const harStatus = harOutcome.status === "fulfilled" ? harOutcome.value : null;
         harPosted = decideHarPosted(harStatus !== null ? { status: harStatus } : null);
         if (!harPosted) {
           log.warn("[runner] discovery-har POST failed - final /discovery-result will carry HAR fallback");
         }
-        const finalBody = buildFinalBody(discoveryResult, void 0, discoveryAuditWarning || void 0);
+        const finalBody = buildFinalBody(discoveryResult, void 0, discoveryAuditWarning || void 0, auditDroppedCount);
         let postOk = false;
         for (let attempt = 0; attempt < 3; attempt++) {
           const timeoutMs = attempt === 0 ? 12e4 : 3e4;
@@ -366034,14 +367088,16 @@ ${finalVerifyResult.logs ?? ""}`;
         const msg = err instanceof Error ? err.message : String(err);
         log.fail(`Discovery FAILED: ${msg}`);
         let drainMsg = "";
+        let auditDroppedCount = 0;
         try {
-          await drainAudit();
+          auditDroppedCount = (await drainAudit()).dropped;
         } catch (drainErr) {
+          auditDroppedCount = auditDroppedFromDrainFailure(drainErr);
           drainMsg = `
 [audit] ${drainErr instanceof Error ? drainErr.message : String(drainErr)}`;
           console.warn(`[runner]${drainMsg}`);
         }
-        const errorBody = discoveryResult ? buildFinalBody(discoveryResult, msg, drainMsg || void 0) : prepareDiscoveryResultForPost({
+        const errorBody = discoveryResult ? buildFinalBody(discoveryResult, msg, drainMsg || void 0, auditDroppedCount) : prepareDiscoveryResultForPost({
           ...explorePosted ? {} : { collectedPages: [], collectedTransitions: [] },
           tests: [],
           logs: `Fatal error: ${msg}${drainMsg}`,
@@ -366049,6 +367105,7 @@ ${finalVerifyResult.logs ?? ""}`;
           summary: `Fatal error: ${msg}`,
           exploreStats: { pagesDiscovered: 0, pagesVisited: 0, elementsFound: 0, transitionsFound: 0 },
           duration: (Date.now() - startTime) / 1e3,
+          auditDroppedCount,
           mode: ctx.mode,
           error: msg,
           streamedTestCount: streamedTestKeys.size,
@@ -366414,6 +367471,7 @@ ${finalVerifyResult.logs ?? ""}`;
             status: typeof c.status === "number" ? c.status : void 0
           })) : void 0;
           const uiPathSucceeded = Array.isArray(reproduce.stepResults) && reproduce.stepResults.filter((s) => s.status === "passed").length >= Math.max(1, reproduce.stepResults.length - 1);
+          const failedStepOrder = Array.isArray(reproduce.stepResults) ? reproduce.stepResults.find((s) => s.status === "failed")?.stepOrder : void 0;
           const heal = await (0, import_runner_core14.executeMobileTestWithHealing)(
             mobileSteps,
             healTarget,
@@ -366425,6 +367483,7 @@ ${finalVerifyResult.logs ?? ""}`;
               testName: run2.testName,
               tags: tagList,
               failureCount,
+              failedStepOrder,
               apiCalls: reproduceApiCalls,
               uiPathSucceeded
             },