`5x/REPORT.md`

18 lines
# /5x REPORT — '67 Corvette Catalog Console (http://127.0.0.1:9797/)

Stop condition: CLEAN TWICE (sweeps 4 & 5). 2 real defects found + fixed.

| Sweep | 3x result | Extended 8s capture | Caught | Fixed | Commit |
|-------|-----------|---------------------|--------|-------|--------|
| 1 | 6/7 (M3 fail) | — | live-ticker image 404 (dead cdn.shopify.com asset → console 404) | /img proxy: SSRF-guarded, placeholder(200) on dead asset | 5539a5c |
| 2 | 7/7 | — | (favicon 404 present but M3 window missed it) | — | — |
| 3 | 7/7 | 404 caught (no >=400 resp) | /favicon.ico 404 (no favicon declared → browser auto-requests it) | inline data-URI SVG favicon | dcde435 |
| 4 | 7/7 | 0 errors / 0 bad | — clean — | — | — |
| 5 | 7/7 (+#feedHead click) | 0 errors / 0 bad | — clean — | — | — |

Extra assertions (sweep 5): glovebox feed toggle collapsed→expanded verified (caret ▸→▾); /img proxy real→200 jpeg, dead→200 placeholder, SSRF(169.254.169.254)→200 placeholder (not fetched).

Final state: 6-way green (M1 HTTP / M2 render / M3 E2E / Chrome / Safari / Firefox), 0 console errors over an 8s multi-refresh window, live ticker + gauges + collapsed feed all functional.

Root-cause note: both defects were 404 console errors invisible to a short M3 window because they're timing-dependent (rotating dead image; browser-level favicon fetch). The extended real-Chrome capture is what surfaced them — a plain /3x would have declared sweep 2 "clean" and shipped both.