Bug log

Every entry has a command under it. If I could not produce one, the entry is not here.

Confirmed and fixed

qr-forge served a 404 on /favicons/og-image.jpg after its share-image and icon set merged. The set was corrected and re-verified, and the path now returns 200. (F-1, source: app-inventory sheet, qr-forge row notes, verified 2026-09-21)

Found during the host verification pass on 2026-09-19. On 2026-09-19 I ran a host verification pass on qr.bryancalabro.com, which is where the share-image 404 was found and fixed. (T-2, source: app-inventory sheet, qr-forge row notes, verified 2026-09-21)

curl -sS -o /dev/null -w '%{http_code}\n' https://qr.bryancalabro.com/favicons/og-image.jpg

Expected 200. Before the fix this returned 404, which means every share of that link rendered without a preview image. The share image is the part of a page that nobody tests, because it is the part nobody sees while building it.

This is the bug that made me write the network sweep. One host, one missing file, found by hand. There are dozens of hosts.

Open, fix not confirmed

A second finding on the same qr-forge merge, relative Open Graph URLs and an under-wired apple-touch icon, is recorded as noted. Its fix is not confirmed. (F-2, source: app-inventory sheet, qr-forge row notes, verified 2026-09-21)

This one is honest about its own status: the sheet records it as noted, with no fix confirmation of the kind the 404 above got. I am not going to write "fixed" on this desk because it is probably fine.

curl -sS https://qr.bryancalabro.com/ | grep -iE 'og:image|apple-touch-icon'

A share image declared with a relative path resolves differently depending on which crawler reads it. Some resolve it against the page, some against nothing at all. The fix is an absolute URL, and confirming the fix means reading that grep output and seeing one.

What is not in this log

Findings I cannot reproduce. During development the environment this desk was built in returned 403 on every outbound request to a bryancalabro.com host:

curl -sS -o /dev/null -w '%{http_code}\n' https://bryancalabro.com/
# curl: (56) CONNECT tunnel failed, response 403

Taken at face value, that is every one of the 74 hosts the sheet listed as live on 2026-09-21, all down at once. Taken correctly, it is one proxy saying no.

Nothing from that run was published, and the report file it produced was deleted rather than committed. A bug log that records the network between you and the thing is not a bug log.

Test strategy

The gates every first-party repo runs before anything ships:

npx tsc --noEmit    # types
npm run lint        # lint, zero warnings allowed
npm test            # unit tests over the pure logic
npm run build       # the build the host will serve
npm run audit       # the house audit, zero failures allowed

The tests cover the logic that produces a number: parsing, grading, arithmetic, export formats. They do not cover whether a button looks right, and I do not pretend otherwise. There is no browser automation in any of these repos, by rule, so a visual regression is caught by a person or it is not caught.

That is a real gap and it is written down here rather than left for someone to discover.

The flake budget

Covered on its own page: the flake budget.