WEB-PRIVACY-001A — Redact public Shop catalog-load failures

[daliu]

Outcome

The public /shop page must show one fixed, plain retry message when its product catalog cannot load. It must never inspect, render, or log a rejected Firestore, SDK, provider, or exception value to an anonymous visitor.

Fixed public message:

We could not load the shop right now. Please try again later.

Current defect

src/pages/shop/Shop.tsx catches the rejected catalog request and renders err.message directly. The route is public, so a crawler or anonymous visitor can receive provider diagnostics, project identifiers, paths, or other private detail.

Invariant

• do not capture or inspect the rejection
• stop the loading state and show exactly one accessible fixed result
• do not emit the rejection through browser console output
• preserve the existing empty-catalog and successful product projections
• make no Firebase/provider call in tests and use no real visitor, member, product, or order data

Exact scope

1. src/pages/shop/Shop.tsx
   • only the catalog rejection hunk and error paragraph accessibility attributes
2. src/App.test.jsx
   • additive Shop imports/mocks, service-locator mock control, and one focused actual-Shop describe
3. docs/officers/EVENTS_SHOP_MEMBERS.md
   • separately named Public Shop catalog failure privacy — SOURCE ONLY, NOT LIVE section only

Everything else is excluded, including shop service/product/checkout/Functions/Rules/root docs/lint/workflows/packages/provider/deploy/data paths and all #249/#246 commerce paths.

Acceptance

• Old-source test exposes a synthetic private canary, then passes after correction.
• Rejection shows exactly the fixed accessible result and ends Loading.
• No rejected detail reaches DOM or five console methods.
• A hostile throwing message getter is never accessed.
• Empty synthetic catalog still shows the existing no-items sentence.
• Synthetic success still shows the existing product link and formatted price.
• Focused and full frontend checks, typecheck, lint safety, SPA/release/artifact guards, build, diff review, and independent security/accessibility/officer reviews pass.
• Officer impact, officer documentation, and exact deployment truth are recorded.

Safety and deployment truth

Tests use only made-up values and mocks. Do not contact Firebase, Stripe, or another provider; inspect a real account/order/catalog; change provider configuration; or use production data. Source, tests, merge, preview, and green CI do not prove the website, Firebase, provider, or live behavior changed.

[daliu]

CLAIMED — 2026-07-14T08:07:53Z

Agent: /root
Branch: codex/issue-254-shop-error-redaction
Exact base: 81093e06c2845a83323f8a491757c0ceae66ff79

Exact ownership:

1. src/pages/shop/Shop.tsx — only the catalog rejection hunk and error paragraph accessibility attributes
2. src/App.test.jsx — additive actual-Shop imports/mocks, service-locator mock control, and one focused Shop failure/success describe
3. docs/officers/EVENTS_SHOP_MEMBERS.md — separately named Public Shop catalog failure privacy — SOURCE ONLY, NOT LIVE section only

The live audit found only open PR #249/#246, whose new commerce-policy files and seven named root-doc hunks are disjoint; it explicitly excludes officer paths. No duplicate Shop/catalog browser-error issue or branch exists. All shop service/product-detail/checkout/Functions/Rules/root-doc/lint/workflow/package/provider/deploy/data paths and every #249/#246 path are excluded and immutable. No file edit began before this marker.

[daliu]

PR #255 is published from exact reviewed head 04a0faf921e3d0856963f13e03bf87b2b63c0d95, base 81093e06c2845a83323f8a491757c0ceae66ff79. Final exact three-path diff SHA-256 is b86151e38c269d0b5f2b1f741a225abe95164e90d0d1eefb54751c10354d0eaf.

Local proof: old-source red 6 pass / 2 intended failures; green focused 8/8, full frontend 263, typecheck, unchanged lint 106/123/7, SPA 11/11, workflow/release/readback/artifact 42/42, build, diff check; three independent final PASS reviews.

Hosted exact-head CI is now required. No merge, release, production website, runmprc.com, Firebase, permission, provider, production-data, migration, or live-behavior action has occurred.

[daliu]

COMPLETE / CLAIM RELEASED — 2026-07-14T08:20:11Z

Outcome: the public Shop source now discards every catalog rejection and shows exactly We could not load the shop right now. Please try again later. in an assertive atomic alert. It never binds, inspects, renders, stores, or logs the rejected value. Loading ends, while genuine empty and successful catalogs remain unchanged.

Reviewed head: 04a0faf921e3d0856963f13e03bf87b2b63c0d95
Exact main / squash-merge SHA: e9c741a6ce82512b929654942d5104ec1a6c657d
Final exact three-path diff SHA-256: b86151e38c269d0b5f2b1f741a225abe95164e90d0d1eefb54751c10354d0eaf
Pull request: #255

Verification:

• old-source red proof: 6 passed / 2 intended failures; raw private canary rendered and hostile message getter executed
• focused actual-App Shop route: 8/8
• full frontend: 12 suites / 263 tests
• TypeScript no-emit: passed
• lint safety: unchanged at 106 files / 123 reviewed legacy errors / 7 warnings
• SPA navigation: 11/11
• workflow, release, Firebase-readback, and artifact safety: 42/42
• diagnostic production build: passed
• diff check: passed
• three independent security/privacy, frontend/accessibility, and officer/scope reviews: PASS
• PR exact-head CI 29317358108: all five required jobs passed
• post-merge CI 29317500973 on exact main: all five required jobs passed

Officer impact: Visitors and officers receive one plain retry-later instruction without database, provider, account, endpoint, or technical detail.
Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md, section Public Shop catalog failure privacy — SOURCE ONLY, NOT LIVE.
Deployment evidence: the pull request had a Netlify deploy preview only. For exact main e9c741a, GitHub reports zero deployment records and only the CI workflow ran. No protected release workflow, production website publication, runmprc.com verification, Firebase deployment, database-permission change, provider configuration, production-data action, migration, or live-behavior verification occurred. This is merged source/test/documentation evidence only.

All exact #254 paths and hunks are now RELEASED.