session 112: demo route validation + session log

memory/wind-down-log.json

@@ -10,6 +10,21 @@
       "time": "19:14",
       "type": "wind-down-nudge",
       "note": "First nudge sent via WhatsApp. Suggested King of Queens, Detective Conan, or Herr der Puppen audiobook."
+    },
+    {
+      "time": "20:15",
+      "type": "routine",
+      "note": "Nose shower done ✅"
+    },
+    {
+      "time": "22:30",
+      "type": "activity",
+      "note": "Tinkering with Star Wars Outlaws demo settings, asking about Proton GE/FSR 4. Still on PC."
+    },
+    {
+      "time": "01:00",
+      "type": "status",
+      "note": "Still up at 1:00 AM. No response to 23:00 nudge. Likely still on PC or fell asleep on couch."
     }
   ]
 }

projects/business/memory/sessions.md

@@ -1,5 +1,17 @@
 # Session Log
 
+## Session 112 — 2026-03-01 07:00 UTC (Sunday Morning)
+- **Focus:** Proactive improvement — demo route input validation
+- **Problem found:** Demo route (`/v1/demo/html`, `/v1/demo/markdown`) was missing PDF options validation. The convert route was fixed in session 109 but demo was missed. Invalid options like `scale: 99` would pass through to Puppeteer silently instead of returning clean 400 errors. Demo is the first thing potential customers try — bad UX for first impressions.
+- **Secondary fix:** Demo route had a duplicate `sanitizeFilename` function (didn't handle single quotes or truncation). Replaced with shared utility from `src/utils/sanitize.ts`.
+- **TDD process:** 6 new tests written first (RED), then validation added (GREEN). Tests: 395 → 401.
+- **Commit:** `ecc7b96` — `feat: add PDF options validation to demo route (TDD)`
+- **Files changed:** `src/routes/demo.ts` (added validatePdfOptions, replaced local sanitizeFilename), `src/__tests__/demo.test.ts` (+54 lines, 6 new tests)
+- **Deployment:** Manual build on k3s-w2 (CI still down), image loaded into containerd, staging patched with nodeSelector=k3s-w2 + imagePullPolicy=IfNotPresent
+- **Verified on staging:** `scale:99` → 400 "scale must be between 0.1 and 2.0", `format:"INVALID"` → 400 with valid formats list, valid options → 200 PDF
+- **Note:** Sonnet 4.1 model unavailable for sub-agents (instant failures). Used Opus for sub-agent.
+- **Staging note:** nodeSelector pinned to k3s-w2 (where image was built). Revert when CI fixed.
+
 ## Session 111 — 2026-02-28 19:00 UTC (Saturday Evening)
 - **Production:** v0.5.1 ✅ healthy, 2 replicas, 0 restarts, ~59h uptime
 - **Staging:** ✅ healthy, running commit 597be6b image (17 commits ahead of prod in git: a91b4c5)

projects/business/memory/state.json

@@ -3,7 +3,7 @@
   "phaseLabel": "Build Production-Grade Product",
   "status": "launch-ready",
   "product": "DocFast — HTML/Markdown to PDF API",
-  "currentPriority": "Production on v0.5.1. Staging updated to a91b4c5 (17 commits ahead of prod) via manual build workaround. CI runner still DOWN but staging is current. npm audit 0 vulns. 395 tests passing (25 files). Staging imagePullPolicy=IfNotPresent (revert to Always when CI runner fixed). Ready for production tag when investor approves.",
+  "currentPriority": "Production on v0.5.1. Staging updated to ecc7b96 (18 commits ahead of prod) via manual build workaround. CI runner still DOWN. npm audit 0 vulns. 401 tests passing (25 files). Staging imagePullPolicy=IfNotPresent + nodeSelector=k3s-w2 (revert both when CI runner fixed). Ready for production tag when investor approves.",
   "ownerDirectives_PRIORITY": "Process these IN ORDER. Do not skip. Remove items marked ✅ DONE/FIXED during housekeeping.",
   "ownerDirectives": [
     "Stripe Product ID for DocFast: prod_TygeG8tQPtEAdE — webhook handler must filter by this product_id to ignore events from other projects on the same Stripe account."
@@ -85,5 +85,5 @@
   },
   "blockers": [],
   "startDate": "2026-02-14",
-  "sessionCount": 111
+  "sessionCount": 112
 }

projects/snapapi/memory/sessions.md

@@ -1,5 +1,26 @@
 # SnapAPI Session Log
 
+## Session 40 — 2026-02-28 20:00 UTC (Health Check)
+
+**Goal:** Routine Saturday evening health check.
+
+### What Was Done
+- Infrastructure verified: prod 2/2 (w1+w2), staging 1/1 — all running ✅
+- Zero open bugs
+- Still awaiting investor approval for v0.6.0 production tag
+
+### Investor Test
+1. Trust with money? **Yes on staging**, prod one version behind
+2. Data loss on crash? **No** — PostgreSQL managed cluster
+3. Free tier abuse? **Low** — playground IP-limited + watermarked
+4. Key recovery? **Yes on staging**
+5. Website features? **All working on staging**; prod missing usage dashboard
+
+### Assessment
+No changes needed. 8th consecutive health-check-only session. Product stable. Awaiting v0.6.0 prod deploy approval.
+
+---
+
 ## Session 39 — 2026-02-28 17:00 UTC (Health Check)
 
 **Goal:** Routine Saturday evening health check.