accelerator: estimate-instant contrarian handoff (yielded to concurrent session; 5 open fixes + verify notes)

3e77ec3b9baaa8b8c589ed6abb9808c8d3128996 · 2026-07-16 07:50:31 -0700 · Steve

Files touched

A clients/estimate-instant-contrarian-handoff.md

Diff

commit 3e77ec3b9baaa8b8c589ed6abb9808c8d3128996
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jul 16 07:50:31 2026 -0700

    accelerator: estimate-instant contrarian handoff (yielded to concurrent session; 5 open fixes + verify notes)
---
 clients/estimate-instant-contrarian-handoff.md | 51 ++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/clients/estimate-instant-contrarian-handoff.md b/clients/estimate-instant-contrarian-handoff.md
new file mode 100644
index 0000000..faa7930
--- /dev/null
+++ b/clients/estimate-instant-contrarian-handoff.md
@@ -0,0 +1,51 @@
+# estimate-instant — contrarian handoff (from the yielded accelerator session)
+
+Two Claude sessions built `estimate-instant` concurrently on 2026-07-15/16. This
+session **yielded** to the active one (Steve's call) after running the playbook's
+verify + contrarian gate. Captured here so the fixes aren't lost. Checked against
+the active session's HEAD `646c3eb` — **all 5 remain open**.
+
+## Verified working (this session, hand-checked)
+- Roll-math `estimate()`: 120"×96" Heirloom Damask → 2 rolls / $192 / 26% waste ✓;
+  grasscloth 200"×108" → 3 rolls / $384 / 25% ✓; too-tall + zero-input guards fire ✓.
+- Embeddable widget `embed.js` (iframe + auto-height postMessage) — shipped, matches
+  the brief's 200+-site embed thesis.
+
+## Contrarian verdict: FIX FIRST — 5 open items (highest leverage first)
+
+1. **Leads PII exposed in public mode** — `server.js:57` `if (!BASIC_AUTH) return true`.
+   `/api/leads` + `/admin` are gated only when `BASIC_AUTH` is set. On any embed host
+   that runs the estimator open (the whole point of the widget), the leads store is
+   world-readable. Fix: a separate always-on `ADMIN_AUTH` (default `admin:DW2024!`)
+   that gates `/api/leads` + `/admin` independent of the public-preview `BASIC_AUTH`.
+
+2. **postMessage targets `'*'`** — `public/index.html:165`. Send height to the known
+   host origin instead. Pass it in: embed.js `f.src = origin + '/?embed=1&host=' +
+   encodeURIComponent(location.origin)`; index reads `host` and targets it.
+
+3. **Unit toggle silently mis-scales** — `public/index.html:128` only relabels ft/in;
+   the typed value is unchanged, so toggling ft→in feeds e.g. `12` back through the
+   inch path. Fix: convert the current `#w`/`#h` values in place on toggle (×12 / ÷12),
+   or clear them.
+
+4. **Half-drop math is an approximation stated with false confidence** —
+   `server.js:96` docks `repeat/2` from usable roll length. The defensible
+   never-short model is per-strip: `cutLen += repeat/2` before rounding up to the
+   full repeat. Minimum honest fix if not reworking: say so in the disclaimer
+   ("half-drop / large-repeat patterns — add ~10–15%").
+
+5. **Single "wall width" invites under-ordering a room** — `public/index.html:70`.
+   Add a hint: "total width of all walls to cover (linear footage)". One sentence
+   prevents every non-trade user from ordering for their widest wall only.
+
+## New surface to gate (added by the active session, needs its own review)
+- Shopify **"Buy N rolls" checkout CTA** hands off to the **live** Shopify checkout
+  (TEST banner + stand-in-variant logic present). Live checkout = customer-facing /
+  money → verify the variant mapping and keep it Steve-gated before any public embed.
+
+## Data note (already handled by the active session)
+- Real roll specs now pull via `scripts/pull-rollspecs.sql` from `dw_unified`. Seed
+  `data/rolls.json` remains the labeled-representative fallback. `dw_unified`
+  wallcovering roll metafields are messy free-text (e.g. `length:"Sisal"`,
+  `width:"36 inches (trim to 34\")"`) — the SQL must normalize width/length/repeat,
+  not trust the raw metafield strings.

← 1be34c6 shopify: read-only catalog puller + normalize sample variant · back to Claude Webdev Accelerator · preview: env-overridable gate cred (PREVIEW_GATE) per contra 9affadd →