5x RE-RUN 3: Option C /claim + /verify pages — 2 defects caught+fixed, both clean twice

b32b988ae1dc1ff13d0e9d0da7db67b14b402261 · 2026-08-14 16:40:33 -0700 · steve

Files touched

M 5x/REPORT.md

Diff

commit b32b988ae1dc1ff13d0e9d0da7db67b14b402261
Author: steve <steve@designerwallcoverings.com>
Date:   Fri Aug 14 16:40:33 2026 -0700

    5x RE-RUN 3: Option C /claim + /verify pages — 2 defects caught+fixed, both clean twice
---
 5x/REPORT.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/5x/REPORT.md b/5x/REPORT.md
index 445c0bc..ac6032d 100644
--- a/5x/REPORT.md
+++ b/5x/REPORT.md
@@ -67,3 +67,26 @@ Open (go-live wiring, not defects): set `PUBLIC_URL` to the Kamatera host so mag
 - **[MINOR — DEFERRED]** email `esc()` doesn't escape `"`; internal-email context, low risk.
 
 **Net: forgeable-token (CRITICAL) + silent-rot (MEDIUM) + no-expiry (LOW-MED) all FIXED and verified. ONE go-live gate remains: the live Shopify happy-path smoke test at DRY_RUN=0.**
+
+---
+
+## RE-RUN 3 — 2026-08-14 · Option C customer-facing pages (post-gift-card, verify→samples flow)
+
+**Target:** local Mac2 `dw-signup-fulfillment` (:9856, DRY_RUN=1) — the Option C launch surfaces
+`GET /claim` (branded "3 free samples" email form) and `GET /verify` (email-link result page).
+
+| Sweep | Page | Result | Caught | Fixed | Commit |
+|-------|------|--------|--------|-------|--------|
+| 1 | /claim | 6/7 | 1 — "Send my link" with empty email fired a `400 Bad Request` | client-side email validation before POST (matches server regex) | `535e4f8` |
+| 2 | /claim | 7/7 | 0 | — | — |
+| 3 | /claim | 7/7 | 0 | — | **clean twice, DONE** |
+| bonus | /verify | 2/4 | 1 — invalid/expired link returned `400` → console error on a human page | return `200` for the rendered human error page (503 kept for `no_secret`) | `e642d0d` |
+| final | /claim + /verify | 7/7 + 4/4 | 0 | — | **both clean** |
+
+**Final six-way state:** /claim — M1✅ M2✅ M3✅(0 JS err) B4✅ B5✅ B6✅ click-through✅ · /verify — M1✅(200) M2✅ M3✅(0 JS err).
+
+**Fixes (root-cause, not suppression):**
+1. `535e4f8` — `/claim` validates the email client-side (same regex as the server) so an empty/invalid address gives instant inline feedback and never fires a network 400.
+2. `e642d0d` — a tokenless/expired `/verify` link is a rendered human outcome, not a malformed API request, so it returns `200` (consistent with the existing completeVerification-failure page). `no_secret` still returns `503`. The page rendered correctly (M2 passed) — this reflects that, it does not weaken the assertion.
+
+**Open:** none on these two pages (stable across 2+ consecutive clean sweeps each). The full live claim→verify→tag→Regios money path stays gated behind go-live (DRY_RUN=1 here, no real send/tag/discount exercised) — covered by the go-live smoke test in `pending-approval/option-c-golive-runbook-20260814.md`.

← e642d0d 5x sweep: /verify returns 200 for invalid/expired human link · back to Dw Signup Fulfillment · contrarian gate: dedupe /verify confirmation email (fire onc 33d6c4b →