5x: REPORT.md — two consecutive clean sweeps; admin Approve click-through verified

38fc598461fa25504fe5174e432ab85f63fd6640 · 2026-07-28 09:43:51 -0700 · Steve

Files touched

A 5x/REPORT.md

Diff

commit 38fc598461fa25504fe5174e432ab85f63fd6640
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Jul 28 09:43:51 2026 -0700

    5x: REPORT.md — two consecutive clean sweeps; admin Approve click-through verified
---
 5x/REPORT.md | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/5x/REPORT.md b/5x/REPORT.md
new file mode 100644
index 0000000..e41fd08
--- /dev/null
+++ b/5x/REPORT.md
@@ -0,0 +1,31 @@
+# /5x REPORT — dw-signup-fulfillment (dry-run, http://127.0.0.1:9856)
+
+Ticket TK-10006 · 2026-07-28 · verify-and-fix loop, fixing on every sweep.
+
+## Sweep ledger
+
+| Sweep | Passed | Caught | Fixed | Commit |
+|-------|--------|--------|-------|--------|
+| 1 | 5/7 | 2 — base `/` 404 (M1 expected auth; M3 JS error on 404 page) + generic clickthrough selectors N/A | added open `GET /` status page | (folded into 73e3ebf) |
+| 2 | 6/7 | 1 — M3 "1 JS error" on root (phantom: favicon request in runner context) | added `GET /favicon.ico → 204` | (folded into 73e3ebf) |
+| 3 | CLEAN | 0 | — real admin click-through added (Approve) | 73e3ebf |
+| 4 | CLEAN | 0 | — | — |
+
+Stop condition met: **two consecutive clean sweeps (3 + 4)**.
+
+## Final six-way state
+- **M1 HTTP contract** — 200 text/html at base (open surface, by design; `/admin/*` gated separately).
+- **M2 headless render** — 44KB screenshot, renders.
+- **M3 automation E2E** — 1×body, **0 JS errors**.
+- **B4 Chrome / B5 Safari / B6 Firefox** — cross-browser render OK (B5/B6 verified in the auth'd sweep).
+- **Auth gate** — `/admin/trade` → 401 no-auth, 200 with `admin:DW2024!` (verified independently).
+
+## Real click-through (the generic runner's selectors don't match this app, so done directly)
+- `/admin/trade` renders trade-application cards **with the created date+time chip** (`🕓 Jul 28, 2026, 9:36 AM`) per Steve's admin-card rule.
+- Clicking **Approve** on a card fired the moderated flow end-to-end → `{ ok:true, status:"approved", rep:{ id:"dw-house", name:"DW House Account" } }` (dry-run: WOULD tag `trade` + set `custom.assigned_rep` + email house account + applicant).
+- Root page + favicon: zero errors / zero failed requests / zero 4xx (independent Playwright check).
+
+## Notes / open
+- All DRY_RUN — no Shopify writes, no emails sent during verification.
+- The generic `/3x` clickthrough skips 10 controls (its selectors are hardcoded for a different app); real control coverage was done with a dedicated Playwright pass (Approve button), which passed.
+- Retail path (gift card) + webhook HMAC accept/reject + house-account round covered by `scripts/selftest.js` (ALL CHECKS PASSED).

← 73e3ebf 5x: add open root status page + favicon 204 (clean base URL, · back to Dw Signup Fulfillment · theme proposal: returning sign-in front-and-center (email co 26d014b →