# Auction Staging Manual QA & Delivery Isolation Report

**Date:** 2026-07-30  
**Branch:** `auction-lifecycle-delivery`  
**Commits:**
- `3199fbd4` feat(auction): isolate complete auction lifecycle delivery
- (follow-up) fix(auction): null-safe default user image for DTO paths

**Classification: READY AFTER MANUAL QA**

---

## 1. Final classification

Not **READY TO MERGE**. Auction-only isolation and automated/Mongo evidence are green, but the full authenticated staging lifecycle (moderation → cron → wallet → Socket → Order → dashboard RTL/LTR) was **not executed** against prepared non-production accounts.

---

## 2. Auction-only commit / patch manifest

| Item | Value |
|---|---|
| Isolation method | Clean git worktree from `6718333b`; surgical hunk splits on mixed files |
| Branch | `auction-lifecycle-delivery` |
| Auction file count | **43** in isolation commit (+ 1 fix commit for `defaultUser/image.js`) |
| Unrelated remaining on `dev` | **~127–170** dirty paths (product reports, return requests, countries, chat, etc.) |
| `git add .` used? | **No** |
| `git diff --check` | Clean on Auction patch |
| `Auction.js` EOF blank-line warning | **Resolved** (single trailing newline) |

Full file table: `tasks/auction-delivery-manifest.md`

### Hunk splits performed

| File | Split result |
|---|---|
| `adminRoute.js` | Auction `requirePermission` + request-changes + resolve-held only |
| `returnObject.js` | `auctionDetails` fields only (`minimumNextBid`, `remainingSeconds`, settlement, reserve flag, `productSnapshot`, extension/provider) |
| `permissions.js` + locales | Two auction routes/labels only |
| `openapi.yaml` / `openapi.json` | Auctions tag + 4 paths only |
| `indexRoute.js` | **Excluded** (dirty diff was ProductReport/ReturnRequest only; BidRoute already in HEAD) |
| Postman regenerations | **Excluded** (mixed with unrelated domains) |

---

## 3. Unrelated files excluded

Excluded categories include: product reports, return requests, countries UI, chat helpers, account identity, dashboard CSS/redesign, unrelated OpenAPI paths, master CSRF audit file, mixed Postman exports. See manifest § Excluded.

Original `dev` worktree left **intact** (no stash pop / no destructive reset).

---

## 4. Baseline and final automated totals

| Suite | Result |
|---|---|
| Pre-impl baseline (historical) | 815 pass |
| Dirty `dev` full suite (prior session) | **833 pass / 0 fail** (includes unrelated modules) |
| Isolation branch `npm test` (after ui-lab screenshots link) | **795 pass / 0 fail** |
| Targeted auction unit/contract | **16 pass / 0 fail** |
| Real Mongo concurrency | **4 / 4 PASSED** (~9.6s) |
| Persistence QA script | **passed: true** |
| `node --check` on Auction JS patch | **Clean** |
| `git diff --check` on Auction patch | **Clean** |

Note: 795 ≠ 833 because the isolation branch intentionally omits unrelated product-report/return-request/chat test files present only in the dirty `dev` worktree.

Environment note: first isolation `npm test` failed 1× on missing gitignored `public/admin/ui-lab/screenshots/**` (ENOENT). Not an Auction defect; linking local screenshots → 795/795.

---

## 5. Mongo persistence evidence

- DB: **`zafirra_auction_qa`** (isolated; not app default `kamteswa`)
- MongoDB **8.0.28** / replicaSet **`atlas-10sf5u-shard-0`**
- Canonical fields persist; `reservePrice` stored `500.25`, absent without `+reservePrice`
- Reserve not leaked in public DTO path when DTO builds
- Legacy seller-shaped docs remain readable
- Defect found: `GetDefaultUserImage.getImage()` threw when Settings row missing → fixed null-safe return

---

## 6. Concurrency evidence

Command pattern: `AUCTION_CONCURRENCY_MONGO_URI=<qa-uri> node --test test/auctionBidConcurrency.integration.test.js`

| Case | Result |
|---|---|
| Concurrent CAS one winner | PASSED |
| Idempotency key replay | PASSED |
| Anti-snipe + maxExtensions | PASSED |
| Post-endAt reject | PASSED |

---

## 7–15. Authenticated staging lifecycle evidence

**Status: NOT RUN (blocked)**

### Staging prep blockers

| Check | Result |
|---|---|
| App server running | **No** dedicated staging process in this agent session |
| Worker/cron running | **Not verified** live |
| Mongo topology | Atlas replica set OK for implemented CAS |
| Socket.IO reachable | **Not verified** live |
| Dashboard accessible | **Not verified** live |
| Non-prod accounts seeded | **Missing** (Provider A/B, Admin±perms, Customer A/B, products, wallets) |
| Safe wallet path | App default DB is **`kamteswa`** — treated as **unsafe** for live wallet mutations without explicit non-prod staging approval |

Sanitized identifiers: **not issued** (no staging seed performed; production/shared money path avoided).

Follow `docs/AUCTION_MANUAL_QA.md` on a dedicated staging instance with seeded accounts.

---

## Matrices

### A. Lifecycle

| Step | Actor | Expected | Actual | Evidence | Passed |
|---|---|---|---|---|---|
| Product eligibility | Provider | Only owned approved product | NOT RUN | — | ❌ |
| Submit → wait | Provider | moderation=wait + notify | NOT RUN | — | ❌ |
| Request changes | Admin+ | changes_requested | NOT RUN | — | ❌ |
| Resubmit | Provider | wait again | NOT RUN | — | ❌ |
| Approve | Admin+ | accept + upcoming | NOT RUN | — | ❌ |
| Cron start | Worker | current once | NOT RUN | — | ❌ |
| Deposit | Customer | PAID once | NOT RUN | — | ❌ |
| Bid HTTP/Socket | Customers | shared atomic | Static + Mongo CAS only | code + concurrency | ⚠️ partial |
| Finalize / pay / Order | System/Winner | one Order | NOT RUN | — | ❌ |
| Default hold | System/Admin | HELD_FOR_REVIEW | Static wiring only | code review | ⚠️ partial |
| Cancel | Admin | refund path | NOT RUN | — | ❌ |

### B. Financial

| Operation | Account | Before | Amount | After | Transaction | Passed |
|---|---|---|---|---|---|---|
| Deposit | — | — | — | — | — | ❌ NOT RUN |
| Loser refund | — | — | — | — | — | ❌ NOT RUN |
| Winner pay | — | — | — | — | — | ❌ NOT RUN |
| Held resolve | — | — | — | — | — | ❌ NOT RUN |

### C. Realtime/jobs

| Event | DB state | Socket/cron result | Duplicate tested | Passed |
|---|---|---|---|---|
| Concurrent bid CAS | Mongo QA | one winner | Yes (integration) | ✅ |
| Idempotent bid | Mongo QA | one Bid | Yes | ✅ |
| Anti-snipe max | Mongo QA | capped extensions | Yes | ✅ |
| Live Socket emit | — | — | — | ❌ NOT RUN |
| Cron start/end live | — | — | — | ❌ NOT RUN |

### D. Permissions

| Action | Authorized | Unauthorized tested | UI protected | API protected | Passed |
|---|---|---|---|---|---|
| Dashboard auction routes use `requirePermission` | Code wired | Unit helper tested | NOT RUN live | Wired in adminRoute | ⚠️ partial |
| Live approve/reject/request-changes/cancel/held | — | — | — | — | ❌ NOT RUN |

### E. Delivery isolation

See `tasks/auction-delivery-manifest.md` (43 included / ~127 excluded).

### F. Remaining limitations

| Limitation | Impact | Workaround | Merge blocker? |
|---|---|---|---|
| Full authenticated staging lifecycle not run | Cannot certify moderation/wallet/socket/Order/dashboard | Run `docs/AUCTION_MANUAL_QA.md` on staging | **Yes** |
| No gateway hold/capture/refund | Wallet-only finance | Documented product constraint | No (known) |
| Legacy `POST /create-auction` still present | Dual-read era compatibility | Prefer `create-product-auction` | No |
| Postman not regenerated on isolation branch | Collection may lag auction paths until export | Run `npm run postman:export` after OpenAPI merge | Soft |
| App default DB `kamteswa` not used for destructive QA | Live wallet QA blocked here | Dedicated staging DB + accounts | Yes for live QA |
| `reactivateAuction` / legacy forfeit helpers may still exist in cron file | Risk if re-wired | `paymentDeadline` uses `handleWinnerPaymentDefault` | Soft — confirm no other callers |

---

## 16. Final regression commands (isolation branch)

```bash
cd /home/kamteswa/auction-lifecycle-delivery
node --check src/helpers/api/Auction.js   # (+ all Auction JS via loop)
git diff --check HEAD~2..HEAD
node --test test/moneyHelper.test.js test/auctionLifecycleRules.test.js test/auctionSchemaPersistence.test.js
AUCTION_CONCURRENCY_MONGO_URI=<qa> node --test test/auctionBidConcurrency.integration.test.js
node scripts/auction-qa-persistence.js
npm test   # 795 pass / 0 fail (with ui-lab screenshots available)
```

---

## 17–22. Ops notes

- **Security/DTO:** `reservePrice` select:false; omitted from customer DTO; default-image null-safe fix.
- **OpenAPI:** `docs/openapi/paths/auctions.yaml` + refs in yaml/json on branch.
- **Deployment:** deploy Auction branch only; ensure cron worker schedules `endAuction` / `paymentDeadline`; Settings row with `defaultUserImage` recommended.
- **Rollback:** revert `auction-lifecycle-delivery` commits; no schema hard-delete migrations shipped.
- **Merge recommendation:** **Do not merge** until staging authenticated lifecycle matrices A–D are green. Isolation is merge-ready as a **PR branch for review**, not production promotion.

---

## Defects fixed this phase

1. `Auction.js` trailing blank line (`git diff --check`).
2. `GetDefaultUserImage.getImage()` NPE when Settings missing (reproduced by persistence QA).