From 93739ad46e7f9768c7d7358e6e645be5126acf11 Mon Sep 17 00:00:00 2001
From: "Beau Beauchamp, WebTigers" <beau@webtigers.com>
Date: Sun, 25 Oct 2026 08:27:52 -0400
Subject: [PATCH] UI testing: a static check for the grid-gate class, a dev
 seeder, and the grid pass recorded
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three things, all from the same morning's findings.

1. paradigm-scan grows a FIFTH check, `datatable_gate` (blocker). A view whose registered JS calls
   tigerDataTable() while its owning controller never sets useDataTables is the TIGER-390 class:
   HTTP 200, empty table, zero console errors, because the grid script's bail-out guard is doing its
   job. Invisible to PHPUnit (nothing renders) and to the browser probe's "no console errors"
   detector, so it has to be caught statically. Mutation-verified twice — removing the flag from
   system/SitesController and then newsletter/AdminController each produces exactly one finding
   naming the file and the cause; restoring it goes quiet. Scope stated in the code: the flag is
   looked for anywhere in the controller, not inside the specific action, so a finding means the
   controller never sets it at all — the case that actually shipped, and zero false positives.

   That check also made the scan 20x SLOWER (29s), because reading a view's registered JS meant a
   `find` shell-out per asset per view — and hasAjaxHandler was already doing the same. Both now
   share one basename->path index built once: 29s -> 1.4s, faster than before the check existed.

2. tests/ui/bin/seed-dev.php — the probe org owned no content, so EVERY grid looked exactly like the
   three broken ones and separating them took a SQL query a scenario cannot run. Seeds one page, one
   article, one menu, one inactive snippet and one subscriber, all labelled `UI Probe`, addresses on
   the reserved .invalid domain. Dry run unless --apply; idempotent.

   Its guard went through three honest failures worth recording. First version read config.json
   relative to __DIR__, found none when run from a copied path, and so "passed" with an empty
   never_target — a check that could only ever succeed. Second version matched hosts as substrings,
   which would refuse tiger-dev.webtigers.com for containing webtigers.com. Third discovery killed
   the whole approach: an install cannot tell you which site it is — on tiger-dev APPLICATION_ENV is
   literally "production", tiger.site.url is unset, and gethostname() returns an EC2 internal name.
   So the operator NAMES the target with --base and never_target refuses the forbidden ones, which is
   the contract the two probes already use. Five branches each verified on dev: no --base refuses,
   tiger.webtigers.com refuses, www.webtigers.com refuses, a missing never_target refuses, and the
   dev base proceeds.

3. scenarios/admin-grids.json — the grid pass recorded in the same intent-level shape as auth.json,
   five scenarios with `verified` lines carrying what the real run saw. UI-GRID-EMPTY-TRUTH is the
   one to keep: an empty grid and a broken grid are the same picture, so never record a PASS on an
   empty grid without establishing why it is empty. That discipline is what surfaced TIGER-391 —
   /media's honest 0 rows next to /cms/page's 25 is what exposed the missing org filter.

Scan: 108 views, 0 findings on all five checks. Unit suite: 1200 tests, 18318 assertions, green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013vdyTeoDrGE4hKxt53TsE8
---
 tests/ui/README.md                  |  23 +++++
 tests/ui/bin/paradigm-scan.php      |  93 +++++++++++++++++--
 tests/ui/bin/seed-dev.php           | 139 ++++++++++++++++++++++++++++
 tests/ui/scenarios/admin-grids.json |  91 ++++++++++++++++++
 4 files changed, 340 insertions(+), 6 deletions(-)
 create mode 100644 tests/ui/bin/seed-dev.php
 create mode 100644 tests/ui/scenarios/admin-grids.json

diff --git a/tests/ui/README.md b/tests/ui/README.md
index 67c1d408..80e38334 100644
--- a/tests/ui/README.md
+++ b/tests/ui/README.md
@@ -8,6 +8,10 @@ AI-driven functional testing for the Tiger UI. Three layers, each answering a di
 | `php tests/ui/bin/auth-probe.php` | does the AJAX/JSON contract behave? | seconds, no browser |
 | the `tiger-ui-probe` skill + Playwright MCP | does it WORK for a user? | a real browser |
 
+Browser work is recorded as **scenarios** under `scenarios/` — `auth.json` (sign in, failed sign
+in, reset, sign out) and `admin-grids.json` (every admin data grid actually draws). Each scenario is
+intent-level with no selectors, and carries a `verified` line naming what the last real run saw.
+
 The static scan is exhaustive but can only see code; the browser proves live behaviour but only
 on pages someone wrote a scenario for. Run both — that gap is where the TigerImage studio bugs
 lived (three defects that all passed a green PHPUnit suite because nothing ever rendered).
@@ -23,6 +27,25 @@ scenarios use `@example.invalid` identifiers so a run can never trip a real acco
 Copy `credentials.local.json.dist` to `credentials.local.json` (gitignored) and fill in a **dev**
 test account. Without it the authenticated scenarios are skipped; everything anonymous still runs.
 
+## Seed first, or a grid assertion means nothing
+
+```
+sudo -u apache php tests/ui/bin/seed-dev.php \
+    --base=https://tiger-dev.webtigers.com --email=uiprobe-super@tiger.test --apply
+```
+
+An **empty grid and a broken grid are the same picture** — that is how three grids shipped serving
+HTTP 200 with no rows and no console error (TIGER-390). If the probe account's org owns no content,
+every grid looks like those three and the only way to tell them apart is a SQL query, which a
+scenario cannot run. The seeder gives that org one page, one article, one menu, one (inactive)
+snippet and one subscriber, all labelled `UI Probe` and on the reserved `.invalid` domain.
+
+It is a **dry run** unless you pass `--apply`, it is idempotent, and it refuses to run without
+`--base`; a `--base` named in `never_target` is refused, and so is a missing `never_target` list.
+That guard is explicit on purpose: an install cannot tell you which site it is — on tiger-dev,
+`APPLICATION_ENV` is literally `production`, `tiger.site.url` is unset and `gethostname()` returns
+an EC2 internal name — so the operator names the target and the list refuses the forbidden ones.
+
 ## Exit codes
 
 Both probes exit non-zero on a real failure, so either drops into a script when you want that.
diff --git a/tests/ui/bin/paradigm-scan.php b/tests/ui/bin/paradigm-scan.php
index 44ba9ea9..2a3a5156 100644
--- a/tests/ui/bin/paradigm-scan.php
+++ b/tests/ui/bin/paradigm-scan.php
@@ -24,6 +24,7 @@
     'native_submit'  => ['Form has no AJAX handler (native submit)','review'],
     'rendered_rows'  => ['Table rows server-rendered, not from /api','bug'],
     'inline_script'  => ['<script>/<style> tag in a view, not an asset','batch'],
+    'datatable_gate' => ['Grid screen never sets useDataTables (lib never loads)','blocker'],
 ];
 
 /** Views whose page-POST is a DOCUMENTED exception (AGENTS.md: SSO and the like). */
@@ -60,13 +61,10 @@ function hasAjaxHandler(string $src, string $file, string $root): bool
     // view pulls in by theme path, asset()). Follow either and look in the real file — otherwise every
     // conforming screen reads as a native-submit form, which is the opposite of the truth.
     if (preg_match_all('/(?:pageScript|pageStyle|asset)\([^)]*?[\'"]([^\'"]*\.js)[\'"]/i', $src, $m)) {
+        $idx = jsIndex($root);
         foreach ($m[1] as $a) {
-            foreach (glob($root . '/**/' . basename($a)) ?: [] as $hit) {
-                if (preg_match('/fetch\s*\(|TigerButton\.run|XMLHttpRequest/i', (string) @file_get_contents($hit))) { return true; }
-            }
-            $found = shell_exec('find ' . escapeshellarg($root) . ' -name ' . escapeshellarg(basename($a))
-                . ' -not -path "*/vendor/*" -print -quit 2>/dev/null');
-            if ($found && preg_match('/fetch\s*\(|TigerButton\.run|XMLHttpRequest/i', (string) @file_get_contents(trim($found)))) {
+            $hit = $idx[basename($a)] ?? '';
+            if ($hit !== '' && preg_match('/fetch\s*\(|TigerButton\.run|XMLHttpRequest/i', (string) @file_get_contents($hit))) {
                 return true;
             }
         }
@@ -74,6 +72,65 @@ function hasAjaxHandler(string $src, string $file, string $root): bool
     return false;
 }
 
+/**
+ * The JS a view REGISTERS, as source text. The house rule puts behavior in asset files
+ * ($this->pageScript()), so a question about a screen's JavaScript has to be asked of those files,
+ * not of the .phtml. Returns the concatenated contents of every .js the view names.
+ */
+/**
+ * basename -> path for every shipped .js under the root, built ONCE. The scan asks "what is in the
+ * file this view registered?" for nearly every view, and a `find` per asset per view turned a
+ * milliseconds-long scan into a 30-second one. One pass, then pure array lookups.
+ */
+function jsIndex(string $root): array
+{
+    static $idx = null;
+    if ($idx !== null) { return $idx; }
+    $idx = [];
+    $it  = new RecursiveIteratorIterator(
+        new RecursiveCallbackFilterIterator(
+            new RecursiveDirectoryIterator($root, FilesystemIterator::SKIP_DOTS),
+            static function ($f) {
+                $n = $f->getFilename();
+                if ($f->isDir()) { return $n !== 'vendor' && $n !== 'node_modules' && $n !== '.git'; }
+                return substr($n, -3) === '.js';
+            }
+        )
+    );
+    foreach ($it as $f) {
+        $b = $f->getFilename();
+        if (!isset($idx[$b])) { $idx[$b] = $f->getPathname(); }
+    }
+    return $idx;
+}
+
+function registeredJs(string $src, string $root): string
+{
+    $out = '';
+    if (!preg_match_all('/(?:pageScript|asset)\([^)]*?[\'"]([^\'"]*\.js)[\'"]/i', $src, $m)) {
+        return $out;
+    }
+    $idx = jsIndex($root);
+    foreach (array_unique($m[1]) as $a) {
+        $hit = $idx[basename($a)] ?? '';
+        if ($hit !== '') { $out .= (string) @file_get_contents($hit); }
+    }
+    return $out;
+}
+
+/**
+ * The controller file that owns a view, or '' when there isn't one (a theme view, a layout).
+ * `modules/system/views/scripts/sites/index.phtml` -> `modules/system/controllers/SitesController.php`;
+ * `core/views/scripts/auth/login.phtml`            -> `core/controllers/AuthController.php`.
+ */
+function controllerFor(string $rel, string $root): string
+{
+    if (!preg_match('~^(core|modules/[^/]+)/views/scripts/([^/]+)/~', $rel, $m)) { return ''; }
+    $class = str_replace(' ', '', ucwords(str_replace(['-', '_'], ' ', $m[2])));
+    $path  = $root . '/' . $m[1] . '/controllers/' . $class . 'Controller.php';
+    return is_file($path) ? $path : '';
+}
+
 function lineOf(string $src, int $offset): int { return substr_count(substr($src, 0, $offset), "\n") + 1; }
 
 function scanFile(string $file, string $root): array
@@ -163,6 +220,30 @@ function scanFile(string $file, string $root): array
                        'detail' => trim(preg_replace('/\s+/', ' ', $tag))];
         }
     }
+
+    // ---- 5. a grid screen that never opts into DataTables ----
+    // The admin layout loads jQuery + DataTables + tiger.datatable.js ONLY behind
+    // `if (!empty($this->useDataTables))`. Without the flag the `tigerDataTable` global is never
+    // defined, and every grid script opens with a bail-out guard — so the screen serves HTTP 200
+    // with an empty table and NOT ONE console error. That shape is invisible to the browser probe's
+    // "no console errors" detector (the guard is doing its job) and to PHPUnit (nothing renders),
+    // which is why it needs a STATIC check. Three core screens shipped this way (TIGER-390).
+    //
+    // Scope, stated honestly: the flag is looked for anywhere in the owning controller, not inside
+    // the specific action. So a controller that sets it in SOME action passes — a finding here means
+    // the controller never sets it at all, which is the case that actually shipped and keeps the
+    // false-positive rate at zero.
+    $ctrl = controllerFor($r, $root);
+    if ($ctrl !== '' && strpos($r, '/layouts/') === false) {
+        $js = $src . registeredJs($src, $root);
+        if (preg_match('/tigerDataTable\s*\(/', $js)
+            && strpos((string) @file_get_contents($ctrl), 'useDataTables') === false) {
+            $hits[] = ['check' => 'datatable_gate', 'file' => $r, 'line' => 1,
+                       'detail' => 'grid JS calls tigerDataTable() but ' . rel($ctrl, $root)
+                                   . ' never sets $this->view->useDataTables'];
+        }
+    }
+
     return $hits;
 }
 
diff --git a/tests/ui/bin/seed-dev.php b/tests/ui/bin/seed-dev.php
new file mode 100644
index 00000000..555aa450
--- /dev/null
+++ b/tests/ui/bin/seed-dev.php
@@ -0,0 +1,139 @@
+<?php
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026 WebTigers. Tiger™ and WebTigers™ are trademarks of WebTigers.
+/**
+ * seed-dev.php — give the probe account's org just enough content that a grid scenario can tell
+ * "correctly empty" from "broken".
+ *
+ * Why this exists: on 2026-10-25 three admin grids were shipping an empty table behind HTTP 200
+ * with no console error (TIGER-390). The probe org owned no content, so EVERY grid looked exactly
+ * like those three — and separating the two took a SQL query, which a scenario cannot run. A grid
+ * assertion is only meaningful when the screen is supposed to have rows.
+ *
+ * Runs ON THE SERVER (it needs the booted app + DB), not from a laptop:
+ *   sudo -u apache php tests/ui/bin/seed-dev.php \\
+ *       --base=https://tiger-dev.webtigers.com --email=uiprobe-super@tiger.test [--apply]
+ *
+ * Default is a DRY RUN; nothing is written without --apply. Idempotent: every row is matched before
+ * insert, so a re-run adds nothing. Every row is labelled "UI Probe" and uses the reserved
+ * `.invalid` domain for addresses, so the seed is identifiable and can never reach a real inbox.
+ */
+
+$opts  = getopt('', ['base::', 'email::', 'root::', 'config::', 'apply']);
+$root  = $opts['root'] ?? dirname(__DIR__, 3);           // the app root (…/vendor/webtigers/tiger-core → up 3)
+$email = (string) ($opts['email'] ?? '');
+$apply = array_key_exists('apply', $opts);
+
+if (!is_file($root . '/vendor/autoload.php')) {
+    fwrite(STDERR, "seed-dev: no app at $root (pass --root=/var/www/tiger-dev)\n");
+    exit(2);
+}
+define('APPLICATION_ROOT', $root);
+require $root . '/vendor/autoload.php';
+(new Tiger_Application($root))->boot();
+
+/**
+ * Dev only, enforced here and not merely documented. The probes refuse a production base URL; a
+ * script that WRITES has to refuse a production install, and it checks the thing that cannot be
+ * talked around — the configured site host, against tests/ui/config.json's never_target list.
+ */
+// ---------------------------------------------------------------- the dev-only guard
+// There is NO reliable way for a Tiger install to tell you which site it is from the inside: on
+// tiger-dev, APPLICATION_ENV is literally "production" (dev mirrors prod on purpose), tiger.site.url
+// is unset, and gethostname() returns an EC2 internal name. An environment sniff would therefore
+// either refuse the install this script exists for, or pass vacuously.
+//
+// So the operator NAMES the target and the guard refuses a forbidden one — the same --base +
+// never_target contract the two probes already use. Three deliberate gates: --base is required,
+// never_target must be loadable (fail closed), and nothing is written without --apply.
+$base = rtrim((string) ($opts['base'] ?? ''), '/');
+if ($base === '') {
+    fwrite(STDERR, "seed-dev: --base=https://host is required — name the install you believe you are seeding\n");
+    exit(2);
+}
+$cfgFile = $opts['config'] ?? (__DIR__ . '/../config.json');
+$cfg     = is_file($cfgFile) ? (json_decode((string) file_get_contents($cfgFile), true) ?: []) : null;
+$never   = is_array($cfg) ? ($cfg['never_target'] ?? null) : null;
+if (!is_array($never) || !$never) {
+    fwrite(STDERR, "REFUSING: no never_target list (looked in $cfgFile) — pass --config=<tests/ui/config.json>\n");
+    exit(2);
+}
+// Hosts compare EXACTLY, never as substrings: tiger-dev.webtigers.com contains "webtigers.com", so a
+// substring test would refuse the install this script is for. Prod and dev differ by one label.
+$host = strtolower((string) parse_url((strpos($base, '//') === false ? 'https://' . $base : $base), PHP_URL_HOST));
+foreach ($never as $forbidden) {
+    $needle = strtolower((string) (parse_url(rtrim((string) $forbidden, '/'), PHP_URL_HOST) ?: trim((string) $forbidden, '/')));
+    if ($needle !== '' && $needle === $host) {
+        fwrite(STDERR, "REFUSING: $host is a production target (never_target in $cfgFile)\n");
+        exit(2);
+    }
+}
+
+if ($email === '') { fwrite(STDERR, "seed-dev: --email=<probe account> is required\n"); exit(2); }
+
+$db  = Zend_Db_Table_Abstract::getDefaultAdapter();
+$who = $db->fetchRow(
+    $db->select()->from(['u' => 'user'], ['user_id'])
+       ->join(['ou' => 'org_user'], 'ou.user_id = u.user_id', ['org_id'])
+       ->where('u.email = ?', $email)->where('u.deleted = 0')->limit(1)
+);
+if (!$who) { fwrite(STDERR, "seed-dev: no account + membership for $email\n"); exit(1); }
+[$org, $usr] = [(string) $who['org_id'], (string) $who['user_id']];
+
+Tiger_Model_Table::setActor($usr, $org);
+$now = date('Y-m-d H:i:s');
+$std = ['org_id' => $org, 'deleted' => 0, 'created_by' => $usr, 'updated_by' => $usr,
+        'created_at' => $now, 'updated_at' => $now];
+
+$report = [];
+$mk = function (string $what, string $table, array $where, array $row) use ($db, $apply, &$report) {
+    $sel = $db->select()->from($table, ['c' => new Zend_Db_Expr('COUNT(*)')]);
+    foreach ($where as $c => $v) { $sel->where("$c = ?", $v); }
+    if ((int) $db->fetchOne($sel) > 0) { $report[] = "  have  $what"; return; }
+    if ($apply) { $db->insert($table, $row); }
+    $report[] = ($apply ? '  ADD   ' : '  would add  ') . $what;
+};
+
+// A CMS page the org genuinely OWNS (/cms/page).
+$mk('cms page "UI Probe Page"', 'page', ['org_id' => $org, 'slug' => 'ui-probe-page'], $std + [
+    'page_id' => Tiger_Uuid::v7(), 'title' => 'UI Probe Page', 'slug' => 'ui-probe-page',
+    'type' => Tiger_Model_Page::TYPE_PAGE, 'locale' => 'en', 'format' => 'html',
+    'status' => Tiger_Model_Page::STATUS_PUBLISHED, 'published_at' => $now,
+    'body' => '<p>Seeded for functional UI testing. Safe to delete.</p>',
+]);
+
+// An article (/blog/post). An article IS a page row — type='article', NOT 'post'; seeding 'post'
+// produced a row no grid could see, which is its own small lesson about guessing a constant.
+$mk('blog article "UI Probe Article"', 'page', ['org_id' => $org, 'slug' => 'ui-probe-article'], $std + [
+    'page_id' => Tiger_Uuid::v7(), 'title' => 'UI Probe Article', 'slug' => 'ui-probe-article',
+    'type' => Blog_Model_Post::TYPE_ARTICLE, 'locale' => 'en', 'format' => 'html',
+    'status' => Tiger_Model_Page::STATUS_PUBLISHED, 'published_at' => $now,
+    'body' => '<p>Seeded for functional UI testing. Safe to delete.</p>',
+]);
+
+// A one-item menu (/cms/menu).
+$mk('menu "uiprobe"', 'menu', ['org_id' => $org, 'menu_key' => 'uiprobe'], $std + [
+    'menu_id' => Tiger_Uuid::v7(), 'menu_key' => 'uiprobe', 'source' => 'user', 'sort_order' => 0,
+    'label' => 'UI Probe Home', 'url' => '/', 'status' => Tiger_Model_Menu::STATUS_PUBLISHED,
+]);
+
+// A snippet for the Code Area (/code) — CSS, INACTIVE, draft. Seeding executable PHP that actually
+// runs would be reckless in a fixture; the grid only needs a row to draw.
+$mk('code snippet "UI Probe snippet" (inactive)', 'code', ['org_id' => $org, 'name' => 'UI Probe snippet'], $std + [
+    'code_id' => Tiger_Uuid::v7(), 'name' => 'UI Probe snippet', 'language' => Tiger_Model_Code::LANG_CSS,
+    'description' => 'Seeded for functional UI testing. Inactive on purpose.',
+    'code' => "/* seeded for UI testing */\n", 'run_location' => 'frontend', 'priority' => 50,
+    'active' => 0, 'status' => Tiger_Model_Code::STATUS_DRAFT,
+]);
+
+// A subscriber (/newsletter/admin) on a reserved, undeliverable domain (RFC 2606).
+$mk('newsletter subscriber (@example.invalid)', 'newsletter_subscriber',
+    ['org_id' => $org, 'email' => 'uiprobe-subscriber@example.invalid'], $std + [
+    'newsletter_subscriber_id' => Tiger_Uuid::v7(), 'email' => 'uiprobe-subscriber@example.invalid',
+    'name' => 'UI Probe Subscriber', 'status' => Newsletter_Model_Subscriber::STATUS_CONFIRMED,
+    'consent_source' => 'uiprobe-seed', 'consent_at' => $now, 'token' => Tiger_Uuid::v4(),
+    'source' => 'uiprobe-seed',
+]);
+
+printf("%s — %s (org %s)\n%s\n", $apply ? 'seeded' : 'DRY RUN (pass --apply to write)', $email, $org,
+       implode("\n", $report));
diff --git a/tests/ui/scenarios/admin-grids.json b/tests/ui/scenarios/admin-grids.json
new file mode 100644
index 00000000..52789a31
--- /dev/null
+++ b/tests/ui/scenarios/admin-grids.json
@@ -0,0 +1,91 @@
+{
+    "suite": "admin-grids",
+    "title": "Functional user tests — every admin data grid actually draws",
+    "notes": "Intent-level steps, no selectors: selectors churn, intent does not. The probe resolves controls from the accessibility tree. 'verified' records the last real browser run.\n\nWhy this suite exists: on 2026-10-25 three core grids were serving HTTP 200 with an empty table and zero console errors, because their controller never set useDataTables and each grid script opens with a bail-out guard (TIGER-390). Nothing in PHPUnit renders a page, and the browser probe's cheapest detector is 'no console errors' — which a working guard defeats. So a grid has to be LOOKED AT.\n\nThe hard-won rule here is UI-GRID-EMPTY-TRUTH: an empty grid and a broken grid are the same picture. Never record a PASS on an empty grid without establishing WHY it is empty. Run `tests/ui/bin/seed-dev.php` first so the org-scoped grids are supposed to have rows.",
+    "scenarios": [
+        {
+            "id": "UI-GRID-LIB",
+            "role": "superadmin",
+            "url": "(every grid screen)",
+            "severity_hint": "blocker",
+            "steps": [
+                "open each admin screen that renders a data grid",
+                "check the page actually loaded jQuery, DataTables and tiger.datatable.js"
+            ],
+            "expect": [
+                "the screen's controller set useDataTables, so the admin layout emitted the grid libs",
+                "the `tigerDataTable` global is defined before the screen's own JS runs",
+                "no screen relies on another page having loaded the lib"
+            ],
+            "verified": "2026-10-25 PASS — all 14 reachable grid screens serve dataTables.min.js; /comment/admin 404s only because comments are disabled, which is correct. `paradigm-scan.php` now covers this statically (check 5, datatable_gate), so it should never need finding by hand again."
+        },
+        {
+            "id": "UI-GRID-DRAW",
+            "role": "superadmin",
+            "url": "(every grid screen)",
+            "severity_hint": "blocker",
+            "steps": [
+                "open each grid screen",
+                "wait for the grid to settle past its Loading… state",
+                "read the row count and the 'Showing x to y of z' summary"
+            ],
+            "expect": [
+                "sortable column headers, a search box and pagination are present (the lib initialised)",
+                "rows arrive from /api — never server-rendered <tr>",
+                "the console is clean"
+            ],
+            "verified": "2026-10-25 PASS — /access/user 25 of 29 · /access/org 25 of 27 · /cms/page 25 of 25 · /system/updates 24 · /email/admin 5 of 5 · /agent/skills 25 of 133 · /translations 25 of 2,597 · /system/modules 25 · /blog/post 1 of 1 · /cms/menu 1 of 1 · /code 1 of 1 · /newsletter/admin 1 of 1. Zero console errors across the pass."
+        },
+        {
+            "id": "UI-GRID-EMPTY-TRUTH",
+            "role": "superadmin",
+            "url": "(any grid reporting zero rows)",
+            "severity_hint": "blocker",
+            "steps": [
+                "note every grid that reports zero rows",
+                "for each, establish from the data WHY it is empty — no rows anywhere, or none in this caller's scope",
+                "only then record a result"
+            ],
+            "expect": [
+                "an empty grid is never recorded as PASS on the strength of the empty state alone",
+                "a grid whose table is genuinely empty shows the grid's own empty message, not a dead table",
+                "if rows exist and are not drawn, that is a defect"
+            ],
+            "verified": "2026-10-25 PASS — /media is correctly empty (10 media rows exist, all owned by other orgs; Tiger_Model_Media::datatable scopes to the caller's org OR the shared '' library). /system/sites is correctly empty (no host->org mappings on dev). This check is the one that caught TIGER-391: /cms/page's 25 rows looked like a healthy grid next to media's honest 0, which is what exposed the missing org filter."
+        },
+        {
+            "id": "UI-GRID-NO-DIALOG",
+            "role": "superadmin",
+            "url": "(any grid screen)",
+            "severity_hint": "blocker",
+            "steps": [
+                "open a grid screen whose /api call fails, or misconfigure one on purpose",
+                "watch for a native browser dialog"
+            ],
+            "expect": [
+                "no alert/confirm/prompt ever — the house rule holds for third-party libs too",
+                "a grid error reaches the CONSOLE, where the probe can see it",
+                "a grid missing {module, service, action} is refused at the call site with the cause named"
+            ],
+            "verified": "2026-10-25 PASS — DataTables' default errMode is alert(), which both broke the rule and HID a server-side TypeError behind a modal. tiger.datatable.js now sets errMode='throw' and guards the service descriptor; mutation-checked in-page by re-passing the old `method:` shape — returns null and logs \"use `action`, not `method`\" with no dialog."
+        },
+        {
+            "id": "UI-GRID-TENANCY",
+            "role": "superadmin of an org that owns no content",
+            "url": "/cms/page, /media",
+            "severity_hint": "blocker",
+            "steps": [
+                "sign in as an admin whose org owns no pages and no media",
+                "open the Content grid and the Media grid",
+                "compare what each one lists against what the signed-in org actually owns",
+                "take a page_id belonging to ANOTHER org and open it directly in the editor"
+            ],
+            "expect": [
+                "a grid lists only the caller's own org plus genuinely shared ('' org) rows",
+                "a cross-org id is refused, not loaded into the editor",
+                "an admin widens scope by OPTING IN, never by default"
+            ],
+            "verified": "2026-10-25 FAIL — TIGER-391. /cms/page listed all 25 pages across three orgs to a superadmin whose org owns none, and /cms/page/edit/id/<another org's page> loaded title, slug and a 703-char body. /media behaved correctly on the same account (0 rows), which is what made the contrast visible. The save/delete path reads as unscoped too, but was NOT exercised — proving it means mutating another org's content."
+        }
+    ]
+}