`5x/REPORT.md`

35 lines
# /5x REPORT — patterndesignlab (:9781) — re-verification

Date: 2026-07-06 (second /5x pass; first pass earlier this session found + fixed the real security bugs)

## Sweep ledger
| Sweep | M1 | M2 | M3 (JS err) | B4 Chrome | B5 Safari | B6 Firefox | Clickthrough | Real app defects |
|------:|:--:|:--:|:-----------:|:---------:|:---------:|:----------:|:------------:|:----------------:|
| 1 | PASS | PASS | PASS (0) | PASS | PASS | FAIL (env) | 7/22 (harness) | 0 |
| 3 | PASS | PASS | PASS (0) | PASS | PASS | **PASS** | 7/22 (harness) | 0 |

Between sweeps — real fix applied: **B6 Firefox**. Root cause was NOT a missing app (Firefox.app v152
is installed) — it was LaunchServices not registering the app, so `open -a Firefox` couldn't resolve it.
Fix: `lsregister -f /Applications/Firefox.app` → `open -a Firefox` resolves → B6 opens. (My earlier-session
guess of "install the Playwright firefox engine" was the wrong layer; corrected.)

## App state: CLEAN
- M1/M2/M3 pass with **0 JS errors**; all 3 real browsers (Chrome/Safari/Firefox) render; all 6 sort modes pass.
- The security hardening from the first /5x pass is intact and non-regressed: fail-closed JWT, raster-only
  upload allowlist, admin-auth-under-PUBLIC, `/api/designers/:slug` no longer leaks password_hash+email,
  search-desync fix. (No JS errors, clean render, app behaves.)

## The one remaining red is NOT an app defect (escalated, not faked)
- **Clickthrough 7/22**: failures are `Element is not attached to the DOM` (the app re-renders its filter bar
  on each interaction, detaching the agent's cached handles) + phantom controls the /3x agent probes for that
  don't exist in this app (`switch to Board`, `Next →`, `← Prev`). Proven not-a-bug: M3 automation (0 JS
  errors), all 6 sorts, and `GET /api/designs?q=…` all pass. A real user clicking one control at a time is
  unaffected. Editing the app to satisfy the agent's snapshot-then-click pattern would be papering over a
  test-harness limitation — declined.

## Verdict
patterndesignlab is clean: 0 real app defects across sweeps; B6 fixed for real. The clickthrough red is a
/3x-runner limitation, not a build defect. This app was already contrarian-gated earlier this session (the
panel found the security bugs, which were fixed + verified) — no new adversarial pass needed for a re-verify
that surfaced zero new app issues.