Post-v1 polish smoke checklist

Checklist for the post-v1 polish backlog (W1–W5). Prefer Herd PHP 8.4. Browser MCP optional; otherwise Playwright scripts + Pest + this PO checklist.

Automated (must pass)

cd externa-core
herd php artisan test --compact \
  tests/Feature/Api/CollectionPermissionRulesTest.php \
  tests/Feature/Api/GraphqlCollectionApiTest.php \
  tests/Feature/Collections/AdvancedFiltersTest.php \
  tests/Feature/Collections/CollectionItemAuditFieldsTest.php \
  tests/Feature/Collections/CollectionItemExportTest.php \
  tests/Feature/Collections/WysiwygSanitizeTest.php \
  tests/Feature/Collections/CollectionItemRevisionTest.php \
  tests/Feature/Admin/JobMonitorTest.php \
  tests/Feature/Ai/AiCollectionPermissionEnforcerTest.php

Optional UI smoke (needs externa-core.test + seeded superadmin; Vite or built assets for hydrate):

# Node 18+; Playwright Chromium installed
node scripts/post-v1-polish-smoke.mjs

Products / Articles

• [x] Admin: open Products (or sample collection) items index — columns, filters, pagination (smoke: /collections reachable; seed items link optional)
• [x] Create / edit item; save succeeds (Pest collections + AI enforcer)
• [ ] Articles with blocks / M2A (if seeded): open form, edit block, save (manual / seed-dependent)
• [x] Soft-delete + restore from trashed toggle (Pest collections)

Permissions

• [x] Role with field ACL: unreadable fields absent from API/Inertia payload
• [x] Role with item_filter (e.g. status equals published): list totals/pages match SQL pushdown
• [x] Out-of-filter item show → 404 (API) / blocked (admin)
• [x] Out-of-filter update → 403
• [x] AI item tools honor same field ACL / item_filter as HTTP (AiCollectionPermissionEnforcerTest)

GraphQL

• [x] items(collection: "…") returns only allowed rows with coherent meta.total
• [x] item(…) for filtered-out id denied/hidden

Filters UI

• [x] Title search + Filters popover AND rules hit the same dialect as API (AdvancedFiltersTest)
• [ ] Clear filters resets URL (manual)

Revisions / Jobs / Export / TipTap

• [x] Item History: list, diff, restore (CollectionItemRevisionTest)
• [x] Jobs monitor page loads for permitted role (JobMonitorTest)
• [x] Items index Export → CSV and JSON download (headers X-Export-*)
• [x] Wysiwyg field: TipTap toolbar (bold/italic/lists/link); paste with <script> stripped after save
• [x] Audit: Created by / Updated by visible on item form; selectable as list columns

Private files + webhook

• [x] Public CMS API: effective-private files require file_permissions.read_private; list omit / show 403 / expanders null without leak (PublicFilesApiTest)
• [x] Outbound events webhook: HMAC delivery + flood guard (existing Pest / Playwright)

UX care polish (Fase A–C)

cd externa-core
herd php artisan test --compact --filter='FileWhereUsedTest|ItemRolePreviewTest|HealthBadgeTest|ItemFormFieldGrantsTest'
# Node 20+; Playwright Chromium
node tests/Browser/qa-fase-a.mjs
node tests/Browser/qa-fase-b.mjs
node tests/Browser/qa-fase-c.mjs

Manual spot-checks: file Where used + delete-anyway count; item Preview as… / draft banner / activity strip; Dashboard → Health tab (/dashboard?tab=health).

Sign-off