`5x/REPORT-live-console.md`

50 lines
# /5x REPORT — RENTV Live Console (`/live` + `/api/live/*`, TK-10542)

Target: `http://localhost:9704/live` (local rentv, OPEN=1=admin). Feature = the folded-in
RENTV Live Console: Google-Sheets ↔ browser editor + local-Ollama draft polish.
(Separate from `5x/REPORT.md`, which is the earlier CRM/LABJ2026 run — not overwritten.)

## Verify method (env-adapted, honest)
The `/3x` six-way HEADLESS runner could NOT run here: it auto-invokes
`playwright install chromium-headless-shell`, whose download/extract is broken on this Mac2
(documented across prior attempts). The Playwright MCP (system Chrome) was **peer-owned** by
another live session, so I did not commandeer it. I therefore verified via an
**endpoint + static suite** (authenticated curl over every route + HTML/asset checks). This
catches backend defects (broken routes, bad parsing, crashes, hangs). NOT covered in this env
and explicitly NOT claimed: in-browser console-error capture, click-handler execution, and
cross-engine (WebKit/Firefox) render parity — those need a browser this box can't launch.

## Sweeps
| Sweep | Passed | Caught | Fixed | Commit |
|------:|:------:|:------:|:------|:-------|
| 1 | 13/14 | 1 — `/api/live/enhance` hung >25s | qwen3:14b runs a hidden `thinking` pass (~16s warm, longer cold). Added `think:false` (→0.53s, 30×) + tightened abort 60s→30s for graceful degradation | `2a7f90c` |
| 2 | 14/14 | 0 | fix held; enhance returns `{ok:true}` fast, no regressions | — |
| 3 | 14/14 | 0 | stable | — |

Stop condition: **clean twice consecutively** (sweeps 2 & 3). DONE at sweep 3 of 5.

## Final state — 14 checks green
- `/live` 200; title present; UI fetches repointed to `/api/live/*`; no stale `/api/meta` ref.
- `nav-agent.css` / `nav-agent.js` 200.
- `/api/live/meta` 200 → 20-tab array; `/api/live/tab` 200 → `{headers,rows}`;
  `/api/live/format` 200 → `{green:[]}`.
- Bad gid handled cleanly (500 `{"error":"No tab with gid=…"}`, no crash — not a hang).
- `/api/live/enhance` 200 `{ok:true,text:…}` fast (think pass disabled).

## Security posture (same as /api/crm, per the sibling REPORT.md)
`/api/live/*` serve Steve's CRE-contacts sheet. Under local `OPEN=1`, `adminOnly` is a no-op —
loopback-only, so acceptable locally. On PROD the whole app sits behind an **nginx HTTP Basic-Auth
edge wall**: verified earlier this session — anon `https://rentv.agentabrams.com/api/live/meta`
→ **401** (nginx), and only `-u admin:DW2024!` reaches Express (→ 200 tab array). So the contact
data is not publicly reachable. Residual (defense-in-depth, not a live hole): confirming `OPEN=1`
is absent behind the nginx gate needs an SSH read of prod env — Steve-gated.

## Open / not-in-scope
- Browser-layer verification (console errors, click handlers, WebKit/Firefox parity) unrun —
  env can't launch a headless browser and the MCP Chrome was peer-owned. Re-run `/cta` or the
  `/3x` runner on a box with a working browser to close this.
- Live `/api/live/write` was NOT exercised (ADD-only writes to Steve's real CRE-contacts sheet;
  won't mutate live data in a test loop). Read path + faithful `batchFill` port stand in for it.
- Each sweep commit auto-deploys to prod via the repo post-commit hook; fixes are verified
  locally BEFORE commit, so only verified state ships.