Nothing renders the site on a device, so breakpoint defects reach production #241

New Issue

Closed

opened 2026-09-10 07:07:23 -05:00 by null · 0 comments

null commented

2026-09-10 07:07:23 -05:00

Owner

Found while fixing the three defects above, all of which had passed Batch 11 and Batch 16.

Two blind spots let them through, and both are properties of the instrument rather than of anyone's care:

A desktop window sized to 768 is not 768. It has a scrollbar, so the layout viewport is about 753 and the md breakpoint never engages. qa-browser.mjs calls setViewportSize, which has the same effect in reverse: it varies width in one desktop context, so deviceScaleFactor, isMobile and hasTouch are never real and hover media queries never change.
document.scrollWidth is not evidence of fitting. This site's body carries overflow-x: hidden, so content sliced off the right edge leaves scrollWidth === innerWidth and no scrollbar.

scripts/device-sweep.mjs renders every sitemap page plus a 404 across ten real Playwright device profiles, portrait and landscape, and evaluates scripts/lib/css-audit.js in the page. That engine compares every box against its nearest clipping ancestor and reports eight kinds: clipped, past_viewport, document_scrolls, media_overflow, sticky_occluded, active_tab_offscreen, tiny_text, touch_target.

Not wired into verify.sh, deliberately. Playwright is a global install on this machine rather than a project dependency, and the sweep needs something already serving the build. A guard that cannot run on a clean clone is a guard that gets skipped, and verify.sh treating a skip as a pass is the failure mode GUARDS.md exists to prevent. It is documented in docs/TOOLS.md under the checks that are run by hand, alongside qa-browser.mjs.

The engine is a copy of the Privacy LLC site's scripts/css-qc.mjs, not a shared module: the two repositories have no common package, so a threshold changed in one does not change in the other. Its provenance and that caveat are in the file header.

Verify: exit 0 on a clean build; exit 1 naming the element when a defect is re-introduced; exit 2 for an unreachable origin and for an unknown --devices name, because "nothing was swept" must never read as "nothing was wrong".

Found while fixing the three defects above, all of which had passed Batch 11 and Batch 16. Two blind spots let them through, and both are properties of the instrument rather than of anyone's care: 1. **A desktop window sized to 768 is not 768.** It has a scrollbar, so the layout viewport is about 753 and the `md` breakpoint never engages. `qa-browser.mjs` calls `setViewportSize`, which has the same effect in reverse: it varies width in one desktop context, so `deviceScaleFactor`, `isMobile` and `hasTouch` are never real and hover media queries never change. 2. **`document.scrollWidth` is not evidence of fitting.** This site's `body` carries `overflow-x: hidden`, so content sliced off the right edge leaves `scrollWidth === innerWidth` and no scrollbar. `scripts/device-sweep.mjs` renders every sitemap page plus a 404 across ten real Playwright device profiles, portrait and landscape, and evaluates `scripts/lib/css-audit.js` in the page. That engine compares every box against its nearest **clipping** ancestor and reports eight kinds: `clipped`, `past_viewport`, `document_scrolls`, `media_overflow`, `sticky_occluded`, `active_tab_offscreen`, `tiny_text`, `touch_target`. **Not wired into `verify.sh`, deliberately.** Playwright is a global install on this machine rather than a project dependency, and the sweep needs something already serving the build. A guard that cannot run on a clean clone is a guard that gets skipped, and `verify.sh` treating a skip as a pass is the failure mode GUARDS.md exists to prevent. It is documented in `docs/TOOLS.md` under the checks that are run by hand, alongside `qa-browser.mjs`. The engine is a copy of the Privacy LLC site's `scripts/css-qc.mjs`, not a shared module: the two repositories have no common package, so a threshold changed in one does not change in the other. Its provenance and that caveat are in the file header. Verify: exit 0 on a clean build; exit 1 naming the element when a defect is re-introduced; exit 2 for an unreachable origin and for an unknown `--devices` name, because "nothing was swept" must never read as "nothing was wrong".