Queue-North-Website/docs/qa/ClaudeQACoverage.md

Claude QA Coverage — Queue North Website

Status: Current
Owner: _null
Last reviewed: 2026-08-18
Governs: what each QA pass actually reached
Review trigger: Any QA round run

Pass by pass, what was reached and what was not. The point of this file is the Blocked and Not run rows: a pass left out of a report reads exactly like a pass that succeeded, and that is how untested code ships believing it was tested.

Round 0 — 2026-08-18 at ac6f5d1

Not a round. The table is filled in on the day the template was adopted so that the honest state is written down rather than absent, because an absent table reads as one nobody got to and this one is a decision.

Pass	Result	Notes
A — First run	Not run	Nobody has walked a cold first visit on a real device under a plan
B — Core flow	Not run	The two form paths — contact and support — end to end into Zoho. This is the product's entire purpose and it has never been verified from outside
C — Failure paths	Not run	Zoho unreachable, reCAPTCHA failing, a duplicate email hitting the 409, an oversized body hitting the 413
D — Persistence	Not run	Container restart with the named volume intact; SQLite surviving it
E — End of loop	Not run	A submitted lead actually appearing in the Zoho CRM UI. Nothing on this side can observe that
F — Accessibility	Not run	Six known defects are already filed from review rather than testing — #189 to #194
G — Performance	Not run	No numbers exist. Prerendering every route landed at 0.9.3 and its effect has not been measured
H — Abuse and what a stranger can reach	Not run	See below — this pass is rewritten for this project

Pass H, as it applies here

The template's pass H is written for a product with accounts. This one has none: no login, no session, no roles, no per-user data. Deleting the pass would have been wrong anyway, because the other half of it — what a stranger can reach and exhaust — is the most exposed surface this project has. Rewritten, it is:

• Both POST endpoints called directly, off the form, with hand-made payloads
• The rate limiter actually exercised past RATE_LIMIT_PER_MINUTE and the 429 body checked
• The honeypot field and the reCAPTCHA score path bypassed deliberately
• dist/ inspected for anything secret — VITE_RECAPTCHA_SITE_KEY is inlined there by design and must be the site key, never the secret one
• The 1 MB body limit and the 30 s request timeout tripped on purpose

scripts/preflight.sh covers the headers-and-TLS fraction of this and nothing else. Its --auth checks are deliberately not used: there is no login to rate-limit and no account to enumerate.

Pass I — money flowing backwards — was deleted from the plan, not skipped. No money moves through this site. Carrying it as a permanently skipped row is the lie this file exists to prevent.

Standing gaps

Things no round has ever covered, carried forward until they are. This list existing is not a failure; it not existing while the gaps do is.

• There is no automated test suite at all, and no typecheck. No test runner is installed, package.json has no test script, and the project is plain .jsx with no TypeScript. npm run build is the only gate, and a build proves the imports resolve and nothing else. Closing this gap is not currently filed as an issue — deliberately, because nobody has decided to do it and filing it would put invented work into the denominator. It is recorded here instead, which is where a gap nobody has chosen to close belongs.
• Nothing has ever verified a lead reaching Zoho end to end. The forward is fire-and-forget by design, so a total failure of it is silent by construction: the visitor sees success, SQLite has the row, and the CRM has nothing. The only way to catch that is pass E, and pass E needs somebody with a Zoho login.
• The lead database has never been backed up or restored. backup.sh and restore-check.sh exist as of 2026-08-18 and neither has been run against production. Filed as an issue in Batch 15.
• No accessibility testing has ever been done with a screen reader or by keyboard alone. The six filed defects came from reading the markup.
• No performance numbers exist for any build, ever.