5x: REPORT.md — 2 sweeps, app clean, M3 networkidle proven CDN artifact

10b262d9f0787d00ddec13b82f3697c9e75d17aa · 2026-07-12 11:22:05 -0700 · Steve Abrams

Files touched

A 5x/REPORT.md

Diff

commit 10b262d9f0787d00ddec13b82f3697c9e75d17aa
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Jul 12 11:22:05 2026 -0700

    5x: REPORT.md — 2 sweeps, app clean, M3 networkidle proven CDN artifact
---
 5x/REPORT.md | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/5x/REPORT.md b/5x/REPORT.md
new file mode 100644
index 0000000..2d04155
--- /dev/null
+++ b/5x/REPORT.md
@@ -0,0 +1,46 @@
+# /5x REPORT — https://pitch.designerwallcoverings.com
+
+Target: dw-pitch-followup (pm2 #10, :9768) exposed via cloudflared tunnel `dw-followup`.
+Auth: Basic `admin:DW2024!` (tunnel-proxied requests only; local loopback exempt).
+
+## Sweep ledger
+| Sweep | M1 | M2 | M3 | B4 | B5 | B6 | caught | fixed | commit |
+|-------|----|----|----|----|----|----|--------|-------|--------|
+| 1 | PASS | PASS | FAIL | PASS | PASS | PASS | favicon /favicon.ico 404 (console error every load) | favicon 204 route (auth-exempt) | d29d6ef |
+| 2 | PASS | PASS | FAIL* | PASS | PASS | PASS | 0 real defects | — | — |
+
+\* M3 FAIL is not an app defect — see below.
+
+## Final six-way state
+- **M1 HTTP contract** — 200 text/html ✅
+- **M2 headless render** — real 345KB screenshot ✅
+- **M3 automation E2E** — `page.goto(waitUntil:networkidle)` times out ❌ **(CDN artifact, not an app defect)**
+- **B4 Chrome / B5 Safari / B6 Firefox** — all render ✅
+- **Console errors** — **0** after sweep-1 fix (was: 1× favicon 404) ✅
+- **Load** — 243ms–3.4s over tunnel; 90 cards + 181 buttons render ✅
+- **Endpoints** — `/ /api/lists /api/sent /api/suppress /healthz` all < 0.7s ✅
+
+## The one remaining FAIL, explained (root-caused, not hand-waved)
+M3 uses Playwright `waitUntil: "networkidle"` (no network for 500ms). Captured post-load
+requests over the tunnel:
+```
+/  ,  /api/lists  ,  /cdn-cgi/challenge-platform/scripts/jsd/main.js
+/cdn-cgi/challenge-platform/h/g/scripts/jsd/.../main.js
+/cdn-cgi/challenge-platform/h/g/jsd/oneshot/...
+```
+The `/cdn-cgi/challenge-platform/` requests are **Cloudflare's JS-Detection / bot-challenge
+scripts injected by the edge** — not by the app. They keep the network active past the 15s
+window, so `networkidle` never settles. This is the well-known "networkidle trap" and is
+unfixable at the app level (and desirable — it's bot protection on a public endpoint). The
+app itself loads clean with `waitUntil:"load"` in 243ms, 0 console errors.
+
+## Real fix applied (sweep 1)
+`server.js`: added an auth-exempt `GET /favicon.ico → 204` route + middleware exemption,
+so the browser's automatic favicon request stops 404ing (killed a console error on every
+load; also stops unauthenticated favicon probes returning 401). Verified 204 local + tunnel.
+
+## Verdict
+App is stable and clean. 5/6 automated checks pass; the 6th is a Cloudflare-CDN/networkidle
+artifact, proven not to be an app defect. Stopped at sweep 2 (real-defect count = 0) rather
+than looping to force a green M3 — forcing it would mean weakening the assertion, which the
+skill forbids.

← d29d6ef 5x sweep 1: add auth-exempt /favicon.ico 204 route (kills pe · back to Dw Pitch Followup · contrarian FIX FIRST #1: block /api/send for tunnel-origin r cf2ad96 →