From 8cc9b4342fb67b10994790fb98e04d8ae488f9d2 Mon Sep 17 00:00:00 2001 From: null Date: Thu, 10 Sep 2026 05:20:13 -0500 Subject: [PATCH] docs: log the day Levi's pages shipped, and the seven live defects found doing it Dated entry per WORK_CYCLE step 6: what shipped, what the reviews found before any code was written, what each guard now refuses, and what is left. The short version of the second half: the secret scanner had never once run its private-key pattern, React was discarding the prerendered DOM on every page, the production sitemap carried no dates at all, every page preloaded the wrong image, eleven pages shipped a run-on description, an odd link could blank a page, and every Docker build context carried the operator's live credentials. All fixed, each proven by breaking it first. Next action and blockers are in the entry: the Google and Bing submissions need account access this session did not have, and Levi's four vendor screenshots need him. Co-Authored-By: Claude Opus 5 (1M context) --- docs/history/DEVELOPMENT_LOG.md | 67 +++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/docs/history/DEVELOPMENT_LOG.md b/docs/history/DEVELOPMENT_LOG.md index 474cb12..cf6903d 100644 --- a/docs/history/DEVELOPMENT_LOG.md +++ b/docs/history/DEVELOPMENT_LOG.md @@ -46,6 +46,73 @@ sequence would have implied more. ## Entries +### 2026-09-10 — Levi's approved pages shipped, and the guards that should have caught what was found on the way + +Levi Halford approved two copy sheets on 2026-08-28 and emailed them the same +day. They sat for thirteen days. Both pages are live as v0.9.6. + +**What shipped for the client.** `/services/unified-communications` and +`/services/contact-center` now serve his approved copy verbatim: 1,125 and 2,499 +words, 22 sections, 17 FAQs, every section opening with its direct answer under a +stable anchor. Titles, H1s and descriptions are byte-exact, including +descriptions of 164 and 191 characters, which are emitted whole rather than +clamped at 158 as the old code would have. His two constraints were proven rather +than assumed: the footer is byte for byte identical to the pre-batch build on all +19 pages, and the Quick Info box is unchanged. + +**The sheets mix directions to the website manager into the copy.** "Do not +promise that every number is always portable." "Keep this factual:" "Place an +official 8x8 Work screenshot beside this section." Those lines look exactly like +copy, and publishing one puts an internal instruction on a customer-facing page. +Extraction was done by four independent reviewers per page (coverage, leakage, +structure, fidelity) and then by a build-time check that refuses twenty such +phrases. The reviewers produced nine findings; the repair agent applied four and +rejected five with reasons, each of which held up. + +**Two independent code reviews of the plan found nineteen landmines before any +code was written.** The ones that were real, and fixed: + +| What | Live since | +| --- | --- | +| The secret scanner never ran its private-key pattern: grep read the leading dashes as an option and `2>/dev/null` hid the error | the rule was written | +| React discarded the prerendered DOM and re-rendered every page: hydration failed site-wide, confirmed in Chromium as error #418 | months | +| The production sitemap carried no `lastmod` at all: the image build has no git and the failure was swallowed | months | +| Every page preloaded the header logo instead of its own hero image | months | +| Eleven pages shipped a description reading as one run-on sentence | months | +| `querySelector(hash)` threw on a fragment that is not a valid CSS selector, blanking the whole page | always | +| `.drop/`, `zoho.md` (live secrets) and 60 MB of zips were sent into every Docker build context | always | + +**Guards, so none of that class returns.** The content layer is validated before +a page renders (17 mutations, each producing exactly one finding). The built HTML +is audited as guard `15-built-html`: one title, description, canonical and h1 per +page, structured data that parses, no FAQPage, links and anchors that resolve, +the preload matching the hero (9 mutations, each caught). `audit-html.js --url` +fetches every page once per crawler after a deploy. `qa-browser` went from 5 of 18 +pages to all of them and now hears console errors, which is how the hydration +failure was confirmed. `secrets.sh` compiles every pattern before trusting its +silence. + +**Shared code, where it earned it.** One block renderer serves the privacy policy +and the two new pages, proven by the privacy page's HTML being identical to the +byte. One description builder. One route list, with the router checked against it +at build time. + +- **Closed:** #218, #219, #220, #221, #222, #226, #227, #228, #229, #230, #231, + #232, #233, #234, #235, and #223 and #224. Two of #223's three claims were + disproved live and corrected on the issue rather than acted on. +- **Filed from the deploy itself:** #236, `deploy.sh` printed the digest and + version from before the recreate, so a successful deploy read as a no-op; #237, + Cloudflare rewrites the privacy email on `qn.isnull.dev`. +- **Next action:** submit both URLs in Google Search Console (Test Live URL, then + Request Indexing) and Bing Webmaster Tools, which needs account access this + session did not have (#217). Bing matters as much as Google: its index feeds + Copilot and ChatGPT search. Then reply to Levi with what shipped and ask for + the four vendor screenshots (#216), which only he can clear for use. +- **Blockers:** #216 and #217 both wait on somebody with the accounts and the + partner material. #211 is unchanged and still the real exposure: the lead + database now has six dumps, all on one workstation, still with no schedule and + no copy anywhere else. + ### 2026-08-18 — Batch 11 closed without a line of code, and a browser found what twenty issues had not Batch 11's four issues were all viewport claims. **All four were false**, and