`scripts/tk11470-sort-proof/README.md`

45 lines

# TK-11470 — catalog sort proof harness

Negative-tested cross-engine proof that the `/catalog` sort control works.
Same harness scores **0 PASS / 40 FAIL** on the pre-fix baseline and **40 PASS / 0 FAIL**
on the fix, so a green here is earned rather than assumed.

## Run

```sh
# 1. boot the site you want to prove
SITE=grassclothwallcovering PORT=18471 node server.js &

# 2. front it with HTTPS — REQUIRED. The CSP sets upgrade-insecure-requests, and WebKit
# honours it on loopback, so a form GET over plain http fails TLS and every sort check
# fails for a reason that has nothing to do with the product.
UP=127.0.0.1:18471 TLS_PORT=18472 node scripts/tk11470-sort-proof/tlsfront.cjs &

# 3. capture server-side truth, then assert the browser reproduces it
MODES=$(for s in newest color light-dark dark-light style sku title price-asc price-desc; do :; done; cat scripts/tk11470-sort-proof/modes.json) \
BASE=https://127.0.0.1:18472 node scripts/tk11470-sort-proof/proof2.cjs
```

`modes.json` maps each sort mode to the first SKU that mode *should* render. It is
data-dependent — **re-capture it whenever `data/catalog.json` changes**, or modes whose
leader moved will fail for a data reason, not a code reason:

```sh
for s in newest color light-dark dark-light style sku title price-asc price-desc; do
curl -sk "https://127.0.0.1:18472/catalog?sort=$s" | grep -oE 'data-sku="[^"]*"' | head -1
done
```

## What it asserts (×2 engines)

9 sort modes drive a real navigation AND produce the real server ordering · search query
retained · page resets to 1 · sort is NOT remembered · dropdown can never label an ordering
the grid isn't in · no redirect on a bare visit · Back undoes a sort (grid *and* dropdown) ·
density clamp (two-sided: valid applies, out-of-range rejected) · DOM-clobber via params
named `submit`/`appendChild` · denied localStorage · zero CSP violations · works with
`requestSubmit` deleted (old-Safari simulation).

## To prove it still detects

Point `BASE` at a server running `git show b4b8158^:shared/render.js`. Expect 0/40.