harden(deals/closings): Cody gate — word-boundary match for short firm codes so a party drill on 'CT'/'PRI' stops hitting substrings ('ct' in transaction = 1611 deals → 13 real); JLL/CBRE/Cushman drills unchanged. Cody's >=4 length guard rejected (would revert legit 3-char firms JLL/IPA)

10ac233dbeaa4a02548ce89a00a3a3fe3c6495ce · 2026-08-06 09:03:06 -0700 · Steve

Files touched

M public/closings.html
M public/deals.html

Diff

commit 10ac233dbeaa4a02548ce89a00a3a3fe3c6495ce
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Aug 6 09:03:06 2026 -0700

    harden(deals/closings): Cody gate — word-boundary match for short firm codes so a party drill on 'CT'/'PRI' stops hitting substrings ('ct' in transaction = 1611 deals → 13 real); JLL/CBRE/Cushman drills unchanged. Cody's >=4 length guard rejected (would revert legit 3-char firms JLL/IPA)
---
 public/closings.html | 6 +++++-
 public/deals.html    | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/public/closings.html b/public/closings.html
index ed8f0a95..4d18695c 100644
--- a/public/closings.html
+++ b/public/closings.html
@@ -207,6 +207,10 @@ const fmtDateTime=v=>{if(!v)return'';const s=String(v);
 // Party drill filters by the FIRM (strip a "(agent, agent…)" roster) so clicking a broker/party chip
 // finds the firm's OTHER deals, not just this one — the full-string value matched only itself (1 deal).
 const firmKey=v=>{const t=String(v||'').split('(')[0].trim().replace(/[,;]\s*$/,'');return t||String(v||'');};
+// Match a SHORT firm code (CT/JLL/PRI) as a WHOLE WORD so a party drill doesn't hit substrings — "ct"
+// inside "transaction" matched 1,611 deals (36%); \bct\b matches only the real CT parties, while
+// \bjll\b still finds all JLL deals. Longer queries keep plain substring search.
+const matchQ=(hay,q)=>{ if(!q)return true; if(q.length<=4&&/^[a-z0-9&]+$/.test(q))return new RegExp('\\b'+q.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')+'\\b').test(hay); return hay.includes(q); };
 const isManual=d=>d._manual||String(d.id||'').startsWith('mc');
 
 function pills(){
@@ -227,7 +231,7 @@ function sorted(list){
 }
 function render(){
   let rows=ALL.filter(d=>(!fType||d.property_type===fType)&&(!fQ||
-    `${d.address} ${d.title} ${d.city} ${d.state} ${d.property_type} ${d.buyer} ${d.seller} ${d.broker} ${d.summary}`.toLowerCase().includes(fQ)));
+    matchQ(`${d.address} ${d.title} ${d.city} ${d.state} ${d.property_type} ${d.buyer} ${d.seller} ${d.broker} ${d.summary}`.toLowerCase(),fQ)));
   rows=sorted(rows);
   document.documentElement.style.setProperty('--cols',dens);
   const manC=ALL.filter(isManual).length, hidC=ALL.filter(d=>d._hidden).length;
diff --git a/public/deals.html b/public/deals.html
index 218f45d4..dede2468 100644
--- a/public/deals.html
+++ b/public/deals.html
@@ -225,6 +225,10 @@ const fmtDateTime=v=>{if(!v)return'';const s=String(v);
 // Party drill filters by the FIRM (strip a "(agent, agent…)" roster) so clicking a broker/party chip
 // finds the firm's OTHER deals, not just this one — the full-string value matched only itself (1 deal).
 const firmKey=v=>{const t=String(v||'').split('(')[0].trim().replace(/[,;]\s*$/,'');return t||String(v||'');};
+// Match a SHORT firm code (CT/JLL/PRI) as a WHOLE WORD so a party drill doesn't hit substrings — "ct"
+// inside "transaction" matched 1,611 deals (36%); \bct\b matches only the 13 real CT parties, while
+// \bjll\b still finds all 406 JLL deals. Longer queries keep plain substring search.
+const matchQ=(hay,q)=>{ if(!q)return true; if(q.length<=4&&/^[a-z0-9&]+$/.test(q))return new RegExp('\\b'+q.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')+'\\b').test(hay); return hay.includes(q); };
 const isManual=d=>d._manual||String(d.id||'').startsWith('md');
 
 function pillRow(hostId,list,cur,pick){
@@ -250,7 +254,7 @@ function render(){
   let rows=ALL.filter(d=>
     (!fTxn||d.txn_type===fTxn)&&
     (!fType||d.property_type===fType)&&
-    (!fQ||`${d.address} ${d.title} ${d.city} ${d.state} ${d.property_type} ${d.buyer} ${d.seller} ${d.broker} ${d.summary}`.toLowerCase().includes(fQ))
+    matchQ(`${d.address} ${d.title} ${d.city} ${d.state} ${d.property_type} ${d.buyer} ${d.seller} ${d.broker} ${d.summary}`.toLowerCase(),fQ)
   );
   rows=sorted(rows);
   document.documentElement.style.setProperty('--cols',dens);

← 0e3b12bc PR intel: self-service login + credentials pages (Gmail inte · back to Rentv 2026 · News map: add From/To year-range filter (2015-present) 7ac0a3d5 →