`POKE_APPLY_PROMPT.txt`

35 lines
You are doing a ROUND-3 deep investigation + fix for this project after two prior fix rounds. Read these files in this directory in order:

- `CODEX_REVIEW.md` — original P0/P1/P2 review
- `CODEX_CHANGES.md` — what round-1 fix applied
- `CODEX_REREVIEW.md` — what codex flagged about its own round-1 patches (regressions, missed call-sites)
- `CODEX_CHANGES2.md` — what round-2 fix applied

Your job:

1. Identify what's STILL broken or recently regressed. Walk the deferred list and re-evaluate which items are now safe enough to apply, given two prior rounds of cleanup have landed.
2. Apply ONLY surgical fixes that are clearly safe. Same safety whitelist as before:
   - hardcoded-secret-fallback removal (move to env-only with fail-fast)
   - bind 0.0.0.0+debug=True → 127.0.0.1+debug=False for clearly local-only tools
   - hardcoded /Users/<other-user>/ or /root/<not-this-machine>/ paths → derive from __file__
   - try/finally around browser/pool lifecycle that's still missing
   - request.json/req.body null guards on routes that still 500
   - innerHTML XSS escaped
   - CLI password argv → env/stdin
   - non-dict-JSON .get() guards (per resize-it pattern)
   - missed-call-sites of fixes already applied elsewhere in the project (e.g., body guard added at one route, missing at sibling)

3. DO NOT touch:
   - DB schema/migrations, dw_unified, Designer-Wallcoverings/shopify, DNS/Cloudflare/nginx/certbot, pm2 ecosystem files, cron specs, node_modules/venv/.next/dist, package version bumps, public-facing customer-visible HTML/CSS, real-secret rotation.

4. WRITE `CHANGES3.md` to this directory with two sections:
   - `## Round 3 Applied` — bullet list of `file:line — what changed — why (cite which prior round mentioned it)`
   - `## Still Deferred` — bullet list with severity + reason

CONSTRAINTS:
- Cap at ~8 file edits.
- Surgical only — no rewrites.
- No git, no installs, no tests.
- Cap CHANGES3.md at ~400 words.
- If nothing safe to apply, write `## Round 3 Applied\nNone — round-2 fix already addressed the safe items.\n## Still Deferred\n<bullet the remaining for Steve>`.