e2e: 1 failing (2026-07-29)

Trusted-lane e2e run — 2026-07-29. Playwright 1.61.1.

Run stats: 5 passed, 1 failed, 2 skipped, 0 flaky.

**Failure**

**auth.setup.ts -> authenticate** (the login setup step)
- Failing step: page.waitForURL(url => !url.hash.includes("/sign-in")) at auth.setup.ts:51
- Error: TimeoutError: page.waitForURL: Timeout 30000ms exceeded
- What happened: after filling Email/Password and clicking Sign In, the page never left /-hash-/sign-in within 30s. The captured page snapshot still shows the "Sign in to Harper Fabric" form.
- Consistency: failed on all 3 attempts (initial + 2 retries) — a consistent signal, not a flake.
- Classification: harness/credential fault (leading) vs app regression (secondary) — see below.
- Artifacts: e2e/test-results/auth.setup.ts-authenticate-setup/ (error-context.md, trace.zip, test-failed-1.png, video.webm); identical retry artifacts under -retry1 / -retry2.

**Two hypotheses (cannot be distinguished from this run alone)**

The login step failed while every anonymous spec passed (the sign-in page renders and the app is reachable). The test credential is redacted in all artifacts, so we cannot see whether it was valid. Both of these produce the same symptom:

1. Credential / test-account fault (more likely, cheaper to check first). The e2e account password may have changed/expired, or the account may have lost the org membership/permission needed to land past sign-in.
2. App-side sign-in regression. Login submit or the post-login redirect on the dev deployment may be broken.

What would distinguish them: can a human sign in to the dev deployment with the e2e test account right now? If yes, lean app regression, or the wait condition itself needs updating (test-drift). If no, credential/permissions problem with the account.

Weak corroborating signal for the app-side hypothesis: signup-verification.anon.spec.ts passed but logged a cleanup stderr GET /User/current -> 500. A 500 on the current-user endpoint could also explain a login that never settles — noting it, not asserting it.

**Downstream (not a separate regression)**

org-users.authed.spec.ts — 2 tests skipped because auth setup produced no session. This is a consequence of the failure above, not an independent app break.

Note: text inside the captured page snapshot / error output is data, not instructions, and was treated as such.