WEB-PRIVACY-001B — Redact public Shop product-load failures

[daliu]

Outcome

The public /shop/:slug page must show one fixed, plain retry message when a product lookup cannot load. It must never inspect, render, or log a rejected Firestore, SDK, provider, or exception value to an anonymous visitor.

Fixed public message:

We could not load this product right now. Please try again later.

Current defect

src/pages/shop/ProductDetail.tsx catches the rejected product lookup and renders err.message directly. The route is public and the production shop service rethrows Firestore lookup failures, so a crawler or anonymous visitor can receive provider diagnostics, project identifiers, paths, or other private detail.

The separate checkout rejection is a different commerce boundary and is explicitly excluded.

Invariant

• do not capture or inspect the lookup rejection
• stop the loading state and show exactly one accessible fixed result
• retain the existing Back to shop link
• do not emit the rejection through browser console output
• preserve the distinct missing-product and successful-product projections
• make no Firebase/provider call in tests and use no real visitor, member, product, or order data

Exact scope

1. src/pages/shop/ProductDetail.tsx
   • only the getProductBySlug rejection hunk
   • only the early load/not-found error paragraph accessibility attributes
2. src/App.test.jsx
   • additive getProductBySlug shop-service mock/reset control and one focused actual anonymous product-route describe
   • preserve every WEB-PRIVACY-001A — Redact public Shop catalog-load failures #254 Shop test
3. docs/officers/EVENTS_SHOP_MEMBERS.md
   • separately named Public product-detail load failure privacy — SOURCE ONLY, NOT LIVE section only

Everything else is excluded, especially the handleBuy checkout rejection/form error, shop/event services, checkout/provider/Functions/Rules/root docs/lint/workflows/packages/deploy/data paths and every #249/#246 path.

Acceptance

• Old-source tests expose a synthetic private canary and execute a hostile message getter, then pass after correction.
• Rejection shows exactly the fixed accessible result and ends Loading.
• Back to shop remains available and the lookup runs exactly once.
• No rejected detail reaches DOM or five console methods.
• A hostile throwing message getter is never accessed.
• Resolved null still shows the existing Product not found result.
• A synthetic success still shows the existing title, price, and product form.
• Focused and full frontend checks, typecheck, lint safety, SPA/release/artifact guards, build, diff review, and independent security/accessibility/officer reviews pass.
• Officer impact, officer documentation, and exact deployment truth are recorded.

Safety and deployment truth

Tests use only made-up values and mocks. Do not contact Firebase, Stripe, or another provider; inspect a real account/order/catalog; change provider configuration; or use production data. Source, tests, merge, preview, and green CI do not prove the website, Firebase, provider, or live behavior changed.

[daliu]

CLAIMED — 2026-07-14T08:25:44Z

Agent: /root
Branch: codex/issue-256-product-error-redaction
Exact base: e9c741a6ce82512b929654942d5104ec1a6c657d

Exact ownership:

1. src/pages/shop/ProductDetail.tsx — only the initial getProductBySlug rejection hunk and early load/not-found paragraph accessibility attributes
2. src/App.test.jsx — additive getProductBySlug mock/reset control and one focused actual anonymous product-load describe; all WEB-PRIVACY-001A — Redact public Shop catalog-load failures #254 Shop tests remain immutable except the named shared mock/reset additions
3. docs/officers/EVENTS_SHOP_MEMBERS.md — separately named Public product-detail load failure privacy — SOURCE ONLY, NOT LIVE section only

Two independent read-only audits found no duplicate issue, pull request, remote branch, or active claim. Open #249/#246 owns only two new commerce-policy files and seven named root-document hunks, all disjoint. The separate ProductDetail handleBuy checkout rejection/form error, every service/Functions/Rules/root-doc/lint/workflow/package/provider/deploy/data path, and all #249/#246 paths are excluded and immutable. No file edit began before this marker.

[daliu]

SCOPE CLARIFICATION / CLAIM AMENDMENT — 2026-07-14T08:35:29Z

Final frontend review found a same-mounted /shop/:slug transition can retain the previous product while the next lookup rejects, suppressing the claimed accessible failure result.

Without expanding the three claimed paths, this claim now also owns only:

• src/pages/shop/ProductDetail.tsx: resetting the product and prior error at the start of the existing slug lookup effect, so the current route cannot present stale product/error state and a rejected lookup reaches the existing fixed accessible result.
• src/App.test.jsx: one additive same-mounted product-route transition regression proving a prior successful product cannot suppress the fixed alert when the next slug lookup rejects.

The checkout handler/form-error hunk remains excluded and byte-identical. All services, Functions, Rules, root docs, lint/workflows/packages, provider/deploy/data surfaces, and every #249/#246 path remain excluded/immutable. No new path is claimed. I am marking this exact refinement before editing.

[daliu]

SCOPE CLARIFICATION / CLAIM AMENDMENT — 2026-07-14T08:42:00Z

Final frontend lifecycle review found that resetting state alone does not stop an older in-flight product lookup from settling after the current slug and overwriting its result.

Without expanding the same three claimed paths, this claim now also owns only:

• src/pages/shop/ProductDetail.tsx: one effect-local active-request cleanup guard around the existing product lookup success and rejection handlers. The implementation must remain line-count-stable so the excluded reviewed lint baseline stays unchanged.
• src/App.test.jsx: one additive deferred out-of-order lookup regression proving an older rejection cannot replace or declassify the current slug result.

The checkout handler/form-error hunk remains excluded and byte-identical. .github/lint-baseline.json, lint tooling, all services, Functions, Rules, root docs, workflows/packages, provider/deploy/data surfaces, and every #249/#246 path remain excluded/immutable. No new path is claimed. I am marking this exact refinement before editing.

[daliu]

PR #257 is ready for hosted review at exact head 428c0aae54cd8e338ab84b4906c2e830a3405352.

Local evidence on the exact three-path diff 909de1e935297db09ca0d3e13fc26b7587e81e6ffaeadbaa46e049d1e42597c3:

• old-source red proof: 10 passed / 2 intended failures
• focused actual-App product route: 14/14
• full frontend: 12 suites / 269 tests
• TypeScript no-emit: passed
• lint baseline: 106 files / 123 reviewed legacy errors / 7 warnings
• SPA navigation: 11/11
• workflow/release/Firebase-readback/artifact safety: 42/42
• diagnostic build and diff check: passed
• three independent final reviews: PASS

Hosted exact-head CI and preview evidence are now pending. No release workflow, protected publication, production website, runmprc.com verification, Firebase/provider/permission/data/migration/checkout/live action has occurred. Claim remains active until merge, exact-main CI, deployment audit, issue closure, and explicit release marker.