5x: contrarian gate — correct overclaim, record 3 real defects found+fixed+verified

4f27d5d590cfd133c175e3e92aede512002618c3 · 2026-07-06 10:47:19 -0700 · Steve
Files touched

M 5x/REPORT.md
Diff

commit 4f27d5d590cfd133c175e3e92aede512002618c3
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Jul 6 10:47:19 2026 -0700

    5x: contrarian gate — correct overclaim, record 3 real defects found+fixed+verified
---
 5x/REPORT.md | 46 +++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 43 insertions(+), 3 deletions(-)

diff --git a/5x/REPORT.md b/5x/REPORT.md
index 488d7d4..9224693 100644
--- a/5x/REPORT.md
+++ b/5x/REPORT.md
@@ -42,7 +42,47 @@ the only two non-passes are non-defects that repeat identically and cannot be ho
 - None to PDL application code (there were no real defects to fix).
 - Environmental: Playwright firefox engine installed (did not resolve B6 — see note above).
 
+## CONTRARIAN GATE — VERDICT: FIX FIRST (fixes applied 2026-07-06)
+The /contrarian panel (Engineer + User lenses; Designer/Strategist hit the API session
+limit, Skeptic errored) gated this report and it was RIGHT — the "2 sweeps, 0 defects,
+clean" conclusion was too generous. Corrections + fixes:
+
+### Where THIS report was wrong (owned)
+- **"All 15 clickthrough failures are harness artifacts" was an overclaim.** Only the
+  facet-button failures were stale-handle re-render artifacts. Three were something else:
+  - `switch to Board` and `Next →`/`← Prev` are **phantom features** — not in index.html
+    at all (only a "Load more" button exists). You can't get a stale handle on a node that
+    was never rendered. These are missing-feature/product gaps, not harness noise.
+  - the `search "recolor"` fill-timeout was **masking a real UX bug** (search desync), not
+    just a handle detachment.
+- **"Security hardening intact" conflated "no regression" with "verified."** The three
+  security features only fire under conditions the sweep never exercised (PUBLIC=1 / a
+  designer login). They are NOW actually verified (below).
+
+### Real defects the panel found — all fixed + verified, committed local
+1. **CRITICAL (was live): `/api/designers/:slug` leaked `password_hash` + `email`** (raw
+   `SELECT *` row returned; `publicDesigner()` applied everywhere but here). Fixed → inline
+   strip of hash+email. Verified: `GET /api/designers/house-of-jill` returns neither. `2ae1f2e`
+2. **HIGH: `/api/admin/*` had no auth under `PUBLIC=1`** (global basic-auth steps aside in
+   public mode; admin routes relied on it). Fixed → `requireAdmin` re-checks creds. Verified
+   on a throwaway `PUBLIC=1` instance: admin endpoints → 401 without creds, 200 with. `2ae1f2e`
+3. **UX: search text dropped when typing then clicking a filter** (`state.q` only set on
+   form submit; `toggleFacet`/`setSeamless` called `load()` without flushing `#q`). Fixed →
+   `load()` now flushes `#q` into `state.q`. Verified served + M1/M2/M3 pass, 0 JS errors. `20e53ca`
+
+### Security behaviors NOW verified end-to-end (the /5x sweep never did this)
+- Fail-closed JWT: `PUBLIC=1` + no `PDL_JWT_SECRET` → `FATAL … refusing to boot`, non-zero exit. ✓
+- Admin auth under `PUBLIC=1`: 401 without creds. ✓
+- Raster-only upload: `ALLOWED_IMG` = png/jpg/webp/gif; `fileFilter` rejects `image/svg+xml`;
+  ext derived from validated mimetype (server.js:44,55,49). ✓ code-verified.
+- Secure cookie: `secure: PUBLIC` (server.js:224) — true when public. ✓ code-verified.
+
 ## Open items for Steve
-- Want true 3-browser coverage? `brew install --cask firefox` then re-run /5x — B6 will go green.
-- The clickthrough agent's stale-handle behavior is a /3x-runner limitation, not PDL's;
-  consider a runner improvement (re-query locators per action) if this noise recurs on other apps.
+- **Product decisions (not bugs):** the marketplace has Load-more-only pagination and no
+  "Board" view — the test spec expected Next/Prev + Board. Add them or drop them from spec.
+- **Full SVG-upload e2e** needs a seeded designer login+cookie (logic is code-verified above).
+- Before `PUBLIC=1` go-live: set `PDL_JWT_SECRET` + `PDL_PASS` (the fail-closed guard now
+  enforces the JWT one).
+- Want true 3-browser coverage? `brew install --cask firefox` then re-run /5x — B6 goes green.
+  (Note: my sweep-1 `playwright install firefox` was a mis-fix — installed the engine, not
+  the system app; it did NOT resolve B6.)
← 20e53ca fix: flush search box into state.q on every load() so typing · back to Patterndesignlab · 5x re-verify: app clean (0 real defects), B6 Firefox fixed v 1a53e09 →