enforce Red/Green TDD in CEO base prompt for all products

projects/snapapi/memory/bugs.md

@@ -69,3 +69,10 @@
 - **Fix:** Staggered initial `lastRestartTime` per browser + one-at-a-time restart guard in `acquirePage()`
 - **Deployed to staging:** Yes (commit e49c4073). Verified playground returns 200.
 - **Production:** Awaiting investor approval for v* tag
+
+### BUG-011: No URL length limit (HIGH) — FIXED (staging)
+- **Found:** Session 17 QA
+- **Impact:** Extremely long URLs could waste server resources
+- **Fix:** Added 2048 character URL length limit in SSRF validation (returns 400)
+- **Deployed to staging:** Yes (commit 5ec8c92). Verified: 2100-char URL returns 400, normal URL returns 200.
+- **Production:** Awaiting investor approval for v* tag

projects/snapapi/memory/sessions.md

@@ -1,5 +1,35 @@
 # SnapAPI Session Log
 
+## Session 18 — 2026-02-24 11:00 UTC (QA + BUG-011 Fix)
+
+**Goal:** Production QA, fix bugs found.
+
+### What Was Done
+
+1. **Full QA on production** (snapapi-qa-1):
+   - 15 tests across desktop, mobile, all links, playground, legal pages, docs, security
+   - Confirmed all previous bug fixes working in production
+   - Zero console errors
+   - 1 new bug found: BUG-011 (no URL length limit)
+
+2. **Fixed BUG-011** — URL length limit:
+   - Added 2048-char limit in SSRF validation
+   - Returns 400 with clear error message
+   - Commit 5ec8c92, deployed to staging, verified
+
+### Investor Test — Session 18
+1. Trust? **Yes** — QA confirmed core flows work
+2. Data loss on crash? **No**
+3. Free tier abuse? **Low** — 5/hr IP limit + watermark + now URL length limit
+4. Key recovery? **Not yet** (needs Stripe portal)
+5. Website features work? **Yes** — QA verified all 15 test areas
+
+### QA Summary
+- 15 tests passed, 1 new bug found and fixed (staging)
+- Overall: CONDITIONALLY READY (pending prod deploy of accumulated fixes)
+
+---
+
 ## Session 17 — 2026-02-24 08:00 UTC (GET Endpoint + Response Caching)
 
 **Goal:** Add competitive features — GET endpoint for image embedding, response caching.

projects/snapapi/memory/state.json

@@ -76,6 +76,6 @@
       "priceId": "price_1T2XHpRtlDv9c8GoThHfd8kS"
     }
   },
-  "lastSession": "2026-02-24T08:00:00Z",
+  "lastSession": "2026-02-24T11:00:00Z",
   "codeLocation": "Forgejo repo openclawd/SnapAPI. Clone: git clone forgejo-snapapi:openclawd/SnapAPI.git"
 }