No preview D1 carries a test account, so every :auth render refuses and signed-in surfaces are unjudgeable

[usirin]

What is wrong

CI seeds a PR's preview D1 with read fixtures and nothing else, so no preview carries a
review-ui test account. .github/workflows/ci.yml has one seeding step, Seed preview D1, and it
runs node packages/preview-seed/src/bin.ts run --database-id "${{ steps.preview.outputs.db }}".
packages/preview-seed/src/seed.ts writes terms, definitions, posts and the two FTS tables — no
user, no session. The sibling command that writes those rows, preview-seed test-account
(packages/preview-seed/src/bin.ts), is invoked by no workflow under .github/.

Triage note: verified at origin/main — the seed step is .github/workflows/ci.yml:1018-1023, and
grepping .github/ at main for test-account returns nothing.

Consequence: every review-ui render of a :auth or :auth-caylak surface refuses on 11 ("the
preview answered the seeded cookie as a visitor"), so a PR whose rendered change lives behind sign-in
ends the rendered gate at CANT-SEE with no route to a verdict. Hit twice in one evening — PR #9276
(lane 9265) and PR #9279 (lane 9273). The --flag path inherits the block, since a forced run names
a tier on every surface.

The fix, proven by hand

A driver cleared it manually, first try: resolve the preview's D1 uuid, then run
preview-seed test-account --database-id <uuid> with the two tier session tokens in the environment.
That provisioned @onizleme-mod at yazar and @onizleme-caylak at çaylak with seven-day sessions,
and the re-fired gate authenticated. No Cloudflare permission beyond the token CI already holds.

So the change is an addition beside Seed preview D1, gated on the same
steps.preview.outputs.skipped != 'true', carrying the same steps.preview.outputs.db and the same
CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID, plus the two tier token variables the verb reads:
PREVIEW_TEST_SESSION_TOKEN (yazar) and PREVIEW_TEST_CAYLAK_SESSION_TOKEN (çaylak).

Prerequisite a builder cannot supply

Those two repo secrets do not exist yet — the repo's secret list holds only ALCHEMY_PASSWORD,
BETTER_AUTH_SECRET, BETTER_AUTH_SECRET_TEST, CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN. The
token value is the whole credential and must be the same string on both sides: the seeding side (CI)
and the capture side, which reads the same variable names from the driver's environment
(packages/fabrika-cli/src/capture/auth.ts). Creating the two repo secrets from the driver's
existing token values is an act for a person holding the repo's keys, not part of the diff. The
workflow change lands and reviews without them; the live proof needs them set.

Out of scope

• The missing user_profile row for the yazar account (preview-seed writes no user_profile row for the yazar test account, so every profile surface it should render is a 404 #9286) — same gate, different defect, inside
  the verb.
• No recipe row for no-preview-render parks (no-preview-render parks have no recipe row, so an unseeded preview costs a human on every auth-gated UI PR #9283).
• NaN new moderates tuple(s) in the verb's report (preview-seed test-account reports NaN moderates tuples against real D1 #7768), seen on the hand run.
• The platform-admin grant the --flag path additionally needs (Preview test accounts hold no platform-admin tuple, so review-ui cannot force a dark-shipped flag #7676).

Triage note: nothing on the board owns the "CI preview seeding" surface — the nearest tickets are the
four above, and each names a different artifact. Filed standalone.

Acceptance criteria

• .github/workflows/ci.yml runs preview-seed test-account against the preview D1 in the same job as Seed preview D1, gated on steps.preview.outputs.skipped != 'true' and passing --database-id "${{ steps.preview.outputs.db }}".
• That step's env carries CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, PREVIEW_TEST_SESSION_TOKEN and PREVIEW_TEST_CAYLAK_SESSION_TOKEN from repo secrets.
• A skipped preview runs neither seeding step, so a PR with no preview is unaffected.
• On this PR's own preview the step's log names both tiers provisioned — @onizleme-mod at yazar, @onizleme-caylak at çaylak — and the job stays green.
• review-ui render of a :auth surface against this PR's preview no longer refuses on 11 with "answered the seeded cookie as a visitor": it captures signed in, or refuses for a reason other than a missing account.
• A comment beside the new step says why the two seeding commands are separate and where the tier token secrets are read on the capture side.

---

Original report (verbatim)

Summary

A pull request's preview is seeded with the sözlük and pano fixtures and with nothing else, so the
two review-ui test accounts exist on no preview. Every review-ui render of a :auth or
:auth-caylak surface therefore refuses on 11, and a PR whose only rendered change lives behind
sign-in ends the rendered gate at CANT-SEE with no path to a verdict from inside the gate.

What I was doing

Running the review-ui gate on PR #9276 (issue #9265). The PR's added state — the profile stat
strip's loading placeholders — paints on /profile alone, which is signed-in only.

What I observed

review-ui render --pr 9276 --surface /profile:auth --surface /u/onizleme-mod:auth refused every
tier-naming surface on 11 with surface "/profile:auth" at desktop did not render signed in (the preview answered the seeded cookie as a visitor), at both viewports. The tier tokens and
BETTER_AUTH_SECRET were all present in the run's environment, so the missing half is the account
and its session row on the preview's own D1, not the credentials.

The bare /u/onizleme-mod surface captured cleanly and shows the "kullanıcı bulunamadı" not-found
composition, which is the same fact from the other side: that account is not on this preview's D1.

The seeding step in .github/workflows/ci.yml ("Seed preview D1") runs
node packages/preview-seed/src/bin.ts run --database-id … and nothing else;
packages/preview-seed/src/seed.ts inserts terms, definitions, posts and the two search tables, and
writes no user, session or user_profile rows. preview-seed test-account, the command the
review-ui contract names as what puts each tier's account and session on a preview's D1, is
invoked nowhere in the workflows.

Why it matters

The :auth axis exists precisely so a signed-in-only composition stops being disclosed as unseen,
and today it cannot succeed on any preview. So every PR whose rendered delta is behind sign-in parks
its lane at CANT-SEE and costs a human — and the failure mode is quiet in the other direction too: a
bare route beside an auth-gated one captures the sign-in wall as a valid PNG, which is a clean-looking
shot of a state the PR did not add. The --flag path inherits the same block, since a forced run must
name a tier on every surface.

Pointers

• .github/workflows/ci.yml — the "Seed preview D1" step
• packages/preview-seed/src/seed.ts, packages/preview-seed/src/test-account.ts,
  packages/preview-seed/src/bin.ts
• claude-plugins/fabrika/skills/review-ui/contract.md — the render verb's tier section and its 11
• PR fix: Profildeki sayaç bölgesinin yenilenmesi problemi #9276, issue Profildeki sayaç bölgesinin yenilenmesi problemi #9265 — where this was hit; the gate's note is on that PR
• Related but not the same observation: review-ui cannot judge localhost-only rendered products #7306 (a product with no preview at all), The /divan raporlar and decisions panes are unreachable by URL, so review-ui can never render them #8776 (routes with
  no URL), review-ui render cannot reach a popover-hosted control, so the account popover's pickers are unjudgeable #7746 (a control behind a popover)

Suggested next step (non-binding)

Extend the same CI step to run preview-seed test-account for both tiers against the preview D1 uuid
the deploy comment already carries, so a preview is seeded with accounts the same way it is seeded
with fixtures. Whether the platform-admin grant the --flag path needs rides along is a separate
call.

---

_{Filed by an agent · session 94113692-2733-4534-9963-c7ae534247d0 · 2026-09-15T23:34:37Z}

[usirin]

Hit a second time, on a different lane, and the remedy is now proven by hand.

Lane 9273 / PR #9279 moves the settings sections above the contribution signal on /profile. Same
shape as #9276: the whole rendered delta is behind sign-in, both :auth and :auth-caylak refused
on 11 at both viewports, and the gate ended CANT-SEE with cause no-preview-render. So this is not
one PR's bad luck — it reproduces on every auth-gated rendered change.

What is new: the driver cleared it by hand and it worked first try. Resolving the preview's D1 uuid
through the Cloudflare D1 list API by the …-db-pr-<n>-… name, then running
preview-seed test-account --database-id <that uuid> with the two tier session tokens already in the
environment, provisioned @onizleme-mod at yazar and @onizleme-caylak at çaylak with sessions
valid seven days out. The re-fired gate then had accounts to authenticate as.

That settles two things the original filing left open. The verb needs no new Cloudflare permission
beyond the token CI already holds, and the whole missing half really is the one command — nothing
else about the preview had to change. So the CI step is a straight addition next to the existing
"Seed preview D1", gated on the same steps.preview.outputs.skipped != 'true', carrying the same
database id plus the two tier session token secrets.

One caveat worth carrying into the fix: the run printed NaN new moderates tuple(s), which is #7768.

[usirin]

[usirin]

Triage note for whoever drives this lane: the two tier token secrets are not on the repo yet. The current secret list is ALCHEMY_PASSWORD, BETTER_AUTH_SECRET, BETTER_AUTH_SECRET_TEST, CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN — no PREVIEW_TEST_SESSION_TOKEN, no PREVIEW_TEST_CAYLAK_SESSION_TOKEN.

The workflow diff is fully buildable without them, and its review does not depend on them. Only the last two acceptance criteria — the live seed log and the :auth render on this PR's own preview — need the secrets set, with the same values the capture side already reads from the driver's environment. Set them before firing the rendered proof, or the lane will re-park on the same CANT-SEE for a different reason.

[usirin]

Third occurrence, and the hand clear worked again.

Lane 8776 / PR #9423 (the /divan raporlar route). The whole rendered delta is two moderator-only
panes, so review-ui render --surface /divan:auth --surface /divan/raporlar:auth --surface /divan/raporlar:auth-caylak refused on 11 for every surface and the gate ended CANT-SEE with
cause no-preview-render. The anonymous control render came back captured, so the preview
deployment itself was live.

The driving operator cleared it exactly as this issue describes: read the preview D1 uuid off the
preview-deploy comment's d1: marker on the PR, then ran preview-seed test-account --database-id <uuid> with both tier tokens already in the environment. Both tiers provisioned,
sessions valid seven days, no extra Cloudflare permission needed.

So the occurrence count on this is #9276, #9279 and now #9423 — three PRs, three hand clears, same
one-line remedy. Nothing about the fix changed; this is a frequency data point.

One thing the run surfaced that is NOT this issue: the verb's own success line printed NaN new moderates tuple(s), so the operator cannot tell from the output whether the moderation tuple was
written. Filed separately.

[usirin]

Hit again on 2026-09-20 driving lane 9602 (PR #9628, a sözlük composer breadcrumb fix). The composer only paints for a signed-in reader, so the whole ticket is unjudgeable anonymously: the ui-review round rendered three undefined slugs at both viewports and got the not-found page every time, then refused on exit 11 with "the preview answered the seeded cookie as a visitor" and parked the lane CANT-SEE / no-preview-render.

New evidence this issue does not yet carry — the hand-clear works, in one call, from an ordinary driver shell:

node packages/preview-seed/src/bin.ts test-account --database-id <the d1 uuid off the PR's preview comment>

That provisioned both tiers on the preview D1 and the lane moved straight back to review:ui. Nothing else was missing: BETTER_AUTH_SECRET, PREVIEW_TEST_SESSION_TOKEN and PREVIEW_TEST_CAYLAK_SESSION_TOKEN were all already set in the ambient environment, and the D1 uuid is already published — deploy.yml emits it as the <!-- d1:<uuid> --> token on the sticky preview comment, which ci.yml line 926 already parses into steps.preview.outputs.db.

So the gap is one step, not a design problem: ci.yml line 1032 runs preview-seed run --database-id "${{ steps.preview.outputs.db }}" and nothing ever runs test-account against that same resolved uuid. Everything the missing step needs is in scope at that point in the job.

Related: #9283 (the park has no recipe row, so each occurrence costs a human) and #9288 (a seeded account still answering as a visitor, which is a different failure from this one — this run's seed did take).