MotorSignal-App/docs/qa-2026-10-01/browser.md

Browser verification and coverage reconciliation — 2026-10-01

Current evidence

• Exclusive browser owner: Codex browser subagent. Browser tool: mcp__cua_repl, Codex in-app browser; available Edge extension was not used.
• Public production showcase was opened through an actual browser. Clicking Track Pace removed four cards, leaving Bay Area Dawn Patrol. This verifies public sample filtering only; it does not establish persisted group rides or authenticated workflows.
• The in-app browser unexpectedly inherited a personal production Firebase session after page hydration. No production account, ride, membership, entitlement, or admin mutations were performed. Authenticated production exploration stopped; isolated localhost testing uses a separately named Firebase app.
• Live read-only HTTPS /api/version returned 9bc16329ef539371e62cea175c89df8de6accd8f, short 9bc16329ef53. Verified using Node HTTPS fetch after Windows Schannel clients failed and browser API navigation was blocked by client. Certificate checking was not disabled.
• git log -1 --format='%H %s' -- website returned 71cd994b2f177417e1d67d62a95125b496d35f32. This is the latest commit touching website files, not the deployed revision and not a claim that the repository HEAD equals that commit.

Prior report arithmetic and classification corrections

The old section 4 matrix has 44 distinct IDs, not 41. Its recorded labels comprise 32 runtime-emulator rows, 5 runtime-browser rows, 3 automated-web rows, and 4 hardware rows. These are counts of claims, not independently verified current passes.

The summary's emulator ranges total 30, not 24: DASH 5 + PERF 2 + MAP 3 + GAR 5 + SOC 5 + AUTH 2 + SET 3 + ACT 5. The matrix additionally contains SOC-06 and SOC-07, bringing its emulator rows to 32. GRP-01, CLB-01, and CLB-02 occur in the summary but have no matrix rows. They cannot be added silently to the matrix total.

OPS-02, OPS-03, and OPS-04 cite automated test files, so their evidence supports automated checks rather than actual browser execution. WEB-03 and WEB-04 describe guest barriers, not authenticated Group Ride Hub, club, rider-account, or replay success. OPS-01 establishes only a guest barrier. SOC-02 and SOC-03 verify navigation retention, not process-restart persistence or cross-account backend visibility. ACT-04 establishes an existing GPX artifact and CSV paywall; it does not establish an executed entitled CSV export. The start/stop evidence does not execute pause/resume/cancel domain paths. The ANR contradiction requires separate diagnostics and is not resolved by the prior PASS label.

Isolated client wiring

An explicit NEXT_PUBLIC_FIREBASE_EMULATORS=true opt-in requires NEXT_PUBLIC_FIREBASE_QA_PROJECT_ID starting with demo- and a loopback website origin. It creates the separately named motorsignal-local-qa app and connects Auth to 127.0.0.1:9099 and Firestore to 127.0.0.1:8088. Defaults retain the production Firebase configuration. The server must separately use matching FIREBASE_PROJECT_ID, FIREBASE_AUTH_EMULATOR_HOST, and FIRESTORE_EMULATOR_HOST. No production configuration was changed.

Focused regression checks: website/tests/firebase-client-emulator.test.ts, 4 passed, covering unchanged defaults, rejecting a production project, both loopback connections, and module reload reuse. Vitest emitted its existing future config-loader warning.

Isolated browser runtime — root QA session

• Exclusive owner: root; Playwright CLI session motorsignal-qa; local website at http://localhost:3100; isolated Firebase project demo-motorsignal-qa only. Screenshots: Group Rides public showcase and signed-out login after sign-out.
• Google provider popup created qa-web-rider@motorsignal.example in the Auth emulator. Firebase accounts:signInWithIdp and lookup returned 200, and /account rendered “Welcome back” with the email. This proves isolated Firebase client sign-in only. UI copy showed “Pro Telemetry Tier,” but no verified purchase or entitlement existed; do not treat that label as Pro evidence.
• Website server exchange POST /api/auth/firebase-login returned 401; email login POST /api/auth/login returned 401 three times; /api/account/sessions returned 401. These exact local route failures prevent authenticated server-backed workflows. The new Auth account had no MotorSignal role fixture. We do not classify valid Firebase credentials as invalid.
• Authenticated Group Ride Hub opened at /group-rides; it showed “0 Squads,” “My Pack Runs (0),” “Explore Community Rides (0),” and an empty-view prompt. It did not show SDK-seeded rides, so authenticated discovery, create/join, approvals, role management, visibility and persistence remain blocked. Public /group-rides/showcase was separately opened and labeled public showcase.
• Sign out returned the browser to /login and issued local POST /api/auth/logout 204. Browser closed before emulator cleanup. Dev server and loopback emulators stopped; Auth and Firestore cleanup endpoints both returned 200 (auth.cleanup-results.json).
• Local account/hub console showed two errors and one warning; server logs identify the 401 routes above. Public showcase had zero errors and one warning. No production account interaction or write occurred during isolated browser testing.