…hyphenless tags

SKILL.md still taught the pre-ruling model (shared feature tests in
lib/pkp/playwright) - now: feature suites always in the app's own repo,
lib/pkp/playwright keeps infrastructure only. patterns.md tag convention
recommended hyphenated tags its own lesson 10 forbids for search assertions;
now single hyphenless alphanumeric tokens.

…rlay + Playwright wiring

OJS overlays for the shared test API (JournalScenarioController: sections/
issues/ISSN context keys, users[].sections via SubEditorsDAO::insertEditor,
sendExternalReview as the review-promoting decision), TestBootstrapController,
site-level _test dispatcher. tools/installTest.php (self-healing from empty
or partial DB, --recreate-db, non-zero exit on failure) + tools/testServer.sh.

Playwright wiring: config (port 8000), app.context.js (APP-GLOSSARY
capabilities + 18-archetype actor map), bootstrap fixture (journal, roster,
ART/REV w/ section editors, category tree, both issues, enriched defaults),
fixtures.js, .env.playwright.example, nine test:e2e:* scripts,
@playwright/test devDependency. Verified: empty DB -> setup green in one go;
login smoke green twice at 2 and 4 workers (per-worker php -S servers).

…t, restart step 2)

Banners and structure updated to the rebuilt harness: step-2 scenario schema
marked live vs recorded-future, scenarios/context route, four Playwright
projects + per-worker php -S servers, corrected auth liveness probe
(follow redirects, judge by where the request ends), LoginPage maxlength
handling, self-healing installTest, per-app roster enrolment facts (OMP
reviewer split, OPS moderators + visibility control).

… test layer

A test result that contradicts the spec about who is allowed to do what is
reported to the orchestrator (RUNBOOK step 7 hands it to verification), never
parked as a skipped/fixme test or a 'not covered' header note.

…line

…ng 2026-07-28)

… construct retired)

One test per common canonical scenario, plus three POMs kept in the app
repo (UsersAndRolesPage, InviteUserWizardPage, AcceptInvitationPage) so the
three fleets don't collide in the shared submodule.

InviteUserWizardPage addresses role rows structurally and their fields by
form name: the wizard gives every row the same control identifiers, so
getByRole/getByLabel cannot reach rows two and up. That defect is a product
finding (register A18), recorded here only as the workaround it forced —
see docs/e2e/app-changes.md row 13.

Skill: `invitations[]` seed key reference, corrected OPS roster (Editorial
Board Member is its only assistant-slot group; role keys carry no `funding`,
and the reviewer key is externalReviewer), and the 127.0.0.1 host fact —
all three fleets pin allowed_hosts, so page requests via localhost 400 while
the test API answers on either host.

…ist on this install

users[].roles now takes 'siteAdmin' to seed a throwaway site administrator (the
only way to get a second one: no screen grants the role). Documented in
scenarios.md and users.md alongside the existing keys.

Also replaces every 'scope by recipient + the per-app tag' instruction with the
technique that is actually available - unique throwaway recipient addresses plus
a positive control for silence. GET /api/v1/tags returns [] and every message
carries Tags: []; find()'s 'contains' is a subject/body content marker, not a
tag.

One test per canonical scenario. UsersAndRolesPage extended rather than
duplicated (search, count, row menu, row actions, disabled mark), with a
settle() that pins the "Current Users" heading to the users API's own
answer — the count reads (0) until that call returns.

Every account a test acts on is one the test created in its own scratch
journal: these scenarios disable, remove roles and merge, and merging
deletes an account permanently. Verified after both runs that all 18
seeded accounts survive, none disabled, and admin keeps its role.

The row menu is not portalled and stays open when another row's is
opened; locators are scoped to the row. Recorded in the POM header.