57702bf2026-05-25wire api-vendor-redact middleware (above all route registration; strips vendor field + vendors facet + ?vendor= query for /api/* responses)
6367dcb2026-05-25rail-card meta: render Designer Wallcoverings instead of p.vendor (last customer-facing vendor leak on this site)
c56bed82026-05-25noopener,noreferrer on window.open() sister-site jump (prevents new tab from accessing window.opener + leaking Referer)
da468792026-05-25404-guard .bak/.pre-* paths (defense-in-depth above .gitignore; nothing currently tracked but tracked-in-future would otherwise leak via express.static)
b6cf30f2026-05-25/api/facets: count FILTERED list (honor q + aesthetic) instead of always returning unfiltered totals
6b2e7802026-05-25hydrate saved sort BEFORE first grid load (was applied only on late select wire, missing initial fetch)
e0011962026-05-25retag aesthetic from PG: 516 rows updated
27326d22026-05-20add: pre-stage Meta Pixel snippet (placeholder; flip via _dw-batch set-fb-pixel.sh)
0d1bcd12026-05-20fix: /about → history.html alias (was 404)
b8a537a2026-05-13remove stray contact modal markup that was rendering inline on the page
887b4492026-05-13header: remove duplicate <header> with dwmOpen-contact (was overlapping ns-header) + add display:none default to .ns-modal so How-can-we-help only opens on click. Restores canonical logo-UL + hamburger-UR layout per MEMORY rule.
Commits with substantial prose (≥120 chars) — the rationale behind each move.
8e1d3e3 · 2026-05-30 · fix: block .bak-<timestamp> files from being served; rm leaked public/index.html.bak-20260526152130
Regex in the .bak guard did not match the `.bak-YYYYMMDDHHMMSS` filename
pattern (hyphen after bak), so express.static served the backup publicly.
Widened the regex to cover `.bak-*` variants and deleted the physical file.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Default: theme1, toggle hidden. Opt-in via ?theme=2 or localStorage
('wallco-page-theme' key shared across the fleet). Same gate pattern
as dw-domain-fleet productPage.
Fleet rails sweep A3 — adds the canonical DW rail-sections pattern from
retrowalls (per LEDGER 2026-05-26 correction note). Renders rails from
/api/sliders ABOVE the flat grid on the unfiltered '/' home view; hides
itself when state.q or state.facet !== 'all'. Clicking 'View all -> on a
rail title calls state.facet=aes + resetGrid + scrollIntoView('#shop')
which is the canonical jumpToFacet behavior. Patch is 3 pieces:
(1) <div id='rails' style='display:none'></div> before <div id='grid'>
(2) .rail-section/.rail-head/.rail-all/.grid.rail-grid CSS
(3) async renderRailSections() fn + startup call right after loadGridPage().
Coexists cleanly with the existing 2-rail Ideas block above (which renders
'New this week' + 'Curated picks' from /api/products and survives in any
filter state).
