5x: REPORT.md — clean twice (favicon 404 fixed)

234c987f0f6f41a8c75065547f51f39299f15994 · 2026-09-14 00:27:54 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Yk9ehSqj2L4frMztZNM2j

Files touched

M 5x/REPORT.md

Diff

commit 234c987f0f6f41a8c75065547f51f39299f15994
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Sep 14 00:27:54 2026 -0700

    5x: REPORT.md — clean twice (favicon 404 fixed)
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_017Yk9ehSqj2L4frMztZNM2j
---
 5x/REPORT.md | 55 +++++++++++++++++++++++--------------------------------
 1 file changed, 23 insertions(+), 32 deletions(-)

diff --git a/5x/REPORT.md b/5x/REPORT.md
index d980777..1f7aba5 100644
--- a/5x/REPORT.md
+++ b/5x/REPORT.md
@@ -1,38 +1,29 @@
-# /5x REPORT — doing.agentabrams.com (public route to local doing-viewer :9790)
+# /5x REPORT — doing-viewer (http://127.0.0.1:9790)
+Date: 2026-09-14 · target: local pm2 `doing-viewer` (Basic auth admin) · TK-11446 follow-on
 
-Target: https://doing.agentabrams.com/  (Cloudflare `dw-followup` tunnel → 127.0.0.1:9790)
+## Sweep ledger
+| sweep | passed/total | caught | fixed | commit |
+|-------|-------------|--------|-------|--------|
+| 1 | 3/4 | 1 (favicon 404 JS error) | 1 | ea854b7 |
+| 2 | 4/4 | 0 | 0 | — |
+| 3 | 4/4 | 0 | 0 | — |
 
-| sweep | methods | buttons | caught | fixed | note |
-|------|---------|---------|--------|-------|------|
-| 1 | 6/7 | 4 pass / 5 FAIL | Restart/Nudge buttons `disabled` over public → Playwright click timeout (5000ms) | client: dead view-only buttons → live unlock-prompting buttons | root cause = security gate rendering `disabled` |
-| 2 | 6/7→7 | 11/0 | 1 transient real-browser open flake | — | buttons fixed; A/B flake only |
-| 3 | 7/7 | 11/0 | 0 | 0 | clean |
-| 4 | 7/7 | 11/0 | 0 | 0 | clean (2nd consecutive) → STABLE |
+Stop: **clean twice** (sweeps 2 & 3). Cap not reached.
 
-## Root cause
-Action buttons are gated by `trustedForActions()` (server.js). Over the PUBLIC tunnel the
-request arrives at 127.0.0.1 stamped with `cf-ray`/`cf-connecting-ip`, so `isLocalTrusted()`
-correctly returns false → `canAct:false` → index.html rendered Restart/Nudge as
-`<button disabled>`. A disabled button never becomes actionable, so Playwright `.click()`
-timed out. The gate is a deliberate security control (buttons launch a real Claude/iTerm
-session on Mac2 via run-ticket.sh); it must NOT be opened to the public internet.
+## Final six-way state
+- M1 HTTP contract — PASS (200 text/html)
+- M2 headless render — PASS (~415KB, no blank)
+- M3 automation E2E — PASS (#list present, #unlock click OK, **0 JS errors**)
+- B4 Google Chrome — PASS
+- B5 Safari / B6 Firefox — SKIP (webkit/firefox engines not installed on this box; environment limit, not a build defect)
 
-## Fix (index.html)
-View-only Restart/Nudge buttons are no longer `disabled`. They render enabled with a 🔒
-glyph and an `onclick="needUnlock(id)"` handler that shows a per-card note
-("View-only on this device — unlock it to enable Restart / Nudge") and triggers the
-existing owner-key unlock flow. Result: every button responds; no dead/hanging control;
-security gate unchanged.
+## What was fixed
+- **favicon 404 → console error on every load.** Browser implicitly GETs /favicon.ico; server.js had no route → default 404 → Chrome logs "Failed to load resource... 404". The /3x runner's `favicon`-text filter missed it (Chrome's console text carries no URL). Fix: `/favicon.ico` → 204 No Content route in server.js before the default 404. Verified: /favicon.ico=204, /=200; direct 3× real-Chrome repro went 3/3-error → 0/3-error.
 
-## Making the buttons perform the REAL action (owner unlock — proven)
-- untrusted (public) GET /api/doing → canAct:false  (view-only, by design)
-- GET /unlock?key=<OWNER_KEY> → 302, sets httpOnly `doing_owner` cookie (1yr)
-- unlocked device (cookie, even WITH cf-ray) → canAct:true → Restart/Nudge fire the real launch
-- LOCAL (127.0.0.1 / home-LAN) → canAct:true already (no unlock needed)
+## Still open
+- Cross-browser Safari/Firefox not exercised here (engines not installed). If needed, run /allbrowsers which installs the missing engines. All runnable checks are clean.
 
-Endpoint gating verified: untrusted POST /api/action → 403 with unlock message; trusted → launches.
-No real launches were fired during testing (view-only click-through only).
-
-## Final state: 7/7 methods, 11/0 buttons, clean x2 → SHIP.
-Open item: to use the buttons over the PUBLIC url, the owner device must be unlocked once
-via /unlock?key=<OWNER_KEY> (kept out of git via .gitignore on data/owner.key). Local board works with no unlock.
+## Reversibility
+- Both changes reversible-local, internal ops viewer, no externality:
+  - ea854b7 (favicon 204) — `git revert ea854b7`
+  - 3fad9e6 (TK-11446 exit-code fix, prior) — `git revert 3fad9e6`

← ea854b7 5x sweep 1: /favicon.ico -> 204 (was 404, console error on e · back to Doing Viewer · 5x/contrarian FIX FIRST: make exit code honest — transient s 04dd24f →