5x: verify security-hardened PDL — 2 clean sweeps, 0 real defects (B6=env, clickthrough=harness)

d5dbf02a05fb9eec14d7198dac2ba1a12b6b7ccf · 2026-07-06 10:23:03 -0700 · Steve
Files touched

A 5x/REPORT.md
Diff

commit d5dbf02a05fb9eec14d7198dac2ba1a12b6b7ccf
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Jul 6 10:23:03 2026 -0700

    5x: verify security-hardened PDL — 2 clean sweeps, 0 real defects (B6=env, clickthrough=harness)
---
 5x/REPORT.md | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/5x/REPORT.md b/5x/REPORT.md
new file mode 100644
index 0000000..488d7d4
--- /dev/null
+++ b/5x/REPORT.md
@@ -0,0 +1,48 @@
+# /5x REPORT — patterndesignlab (http://127.0.0.1:9781)
+
+Date: 2026-07-06 · Target: running pm2 `patterndesignlab` (:9781), basic-auth admin/DW2024!
+Context: verification pass AFTER the security hardening commit `2e4f761` (fail-closed JWT,
+raster-only upload, secure cookie, clean multer errors).
+
+## Sweep ledger
+| Sweep | M1 HTTP | M2 render | M3 E2E | B4 Chrome | B5 Safari | B6 Firefox | Clickthrough | Real defects |
+|------:|:-------:|:---------:|:------:|:---------:|:---------:|:----------:|:------------:|:------------:|
+| 1 | PASS | PASS | PASS (0 JS err) | PASS | PASS | FAIL (env) | 7/22 (harness) | 0 |
+| 2 | PASS | PASS | PASS (0 JS err) | PASS | PASS | FAIL (env) | 7/22 (harness) | 0 |
+
+Two consecutive sweeps, **zero real application defects**. Stopped at 2 (no-progress guard:
+the only two non-passes are non-defects that repeat identically and cannot be honestly
+"fixed" in PDL code).
+
+## The core app is clean
+- **M1/M2/M3**: HTTP 200, headless render OK, Playwright E2E found `#filters` with **0 JS errors**.
+- **B4 Chrome / B5 Safari**: cross-browser render OK.
+- **Sorts**: all 6 pass (newest, color, style, sku_az, title_az, price_up).
+- **Search**: confirmed working at the API layer — `GET /api/designs?q=recolor` returns real
+  full-text results (`search_tsv @@ plainto_tsquery`).
+- **Security hardening intact**: app boots, renders, and behaves with the fail-closed JWT +
+  raster-only upload + secure-cookie changes in place. No regression introduced.
+
+## The two non-passes are NOT PDL bugs (escalated, not fake-fixed)
+1. **B6 Firefox — environmental.** Phase B opens the real system browser via `open -a Firefox`;
+   there is no `/Applications/Firefox.app` on this Mac, so it "failed to launch." This is a
+   missing local browser, not a PDL defect.
+   - NOTE ON A MIS-FIX: during sweep 1 I ran `npx playwright install firefox` (installed the
+     Playwright *engine* `firefox-1532`). That does NOT create the system Firefox.app, so it
+     did **not** resolve B6. Recorded honestly. Real fix (Steve's call): `brew install --cask firefox`.
+2. **Clickthrough (15 "failures") — test-harness fragility, not a bug.** All failures are
+   `Element is not attached to the DOM` or 30s timeouts. Root cause: the clickthrough agent
+   captures element handles up front, then PDL re-renders its filter bar on the first filter
+   click, detaching the cached nodes. Proven not-a-bug by three independent green signals:
+   M3 automation (0 JS errors), all 6 sorts passing, and the search API returning results.
+   A real user clicking one control at a time is unaffected. Fixing PDL code to satisfy the
+   agent's snapshot-then-click pattern would be papering over a test limitation — declined.
+
+## Fixes committed this run
+- None to PDL application code (there were no real defects to fix).
+- Environmental: Playwright firefox engine installed (did not resolve B6 — see note above).
+
+## Open items for Steve
+- Want true 3-browser coverage? `brew install --cask firefox` then re-run /5x — B6 will go green.
+- The clickthrough agent's stale-handle behavior is a /3x-runner limitation, not PDL's;
+  consider a runner improvement (re-query locators per action) if this noise recurs on other apps.
← 2e4f761 security: harden designer auth + upload · back to Patterndesignlab · security: stop /api/designers/:slug leaking password_hash+em 2ae1f2e →