🟡 Status · Same 7 issues still open · No regressions

Recheck pass: nothing moved since the last QA

Probed the same 7 issues from Pass 2 + ran a 10-point regression check on the issues that were fixed in Pass 1. Result: zero diff. All 5 critical fixes from Pass 1 still hold. All 7 medium/low items from Pass 2 still broken. No new bugs found, no regressions introduced.

This is the third probe in 90 minutes — the team has likely paused on the remaining fixes (validate-email, verify-vote POST, footer credit, docs markdown routing, speaker URL rename, hero stats, VAPID placement). If they're blocked, this report can serve as the unblock checklist.

Targetflakhi.production1.jugaar.ai Buildv5.6.0 Recheck at2026-09-13 12:27 UTC TTFB309 ms (vs Pass 2: 282 ms) Sitemap16 URLs, e2e leak = 0 Open2 🔴 + 3 🟡 + 2 🟢

Regression checks PASS

Original criticals fixed

Still 🔴 Critical

Still 🟡 Medium

Still 🟢 Low

Pass Timeline · All 3 runs today (2026-09-13)

Pass 1 · 11:55Fresh QA — 21 issues found. Sitemap leaked 28 test events. Hall of Fame polluted.

Pass 2 · 12:00Re-probe — 5 criticals fixed by team, sitemap cleaned to 16 URLs, e2e URLs now 404.

Pass 3 · 12:27 (now)Recheck — zero movement. 7 issues still open, no regressions.

1 · Pass-to-pass delta

Same 13 issues reviewed across Pass 1 → Pass 2 → Pass 3 (now). Pass 3 confirms all of Pass 2's findings are unchanged.

#	Issue	Pass 1	Pass 2	Pass 3 (now)	Status
1	E2E test events in sitemap (28 URLs)	leaked	cleaned	cleaned (0 leaks)	✅ holding
2	/hall-of-fame fake winners	12 × fake	empty	empty	✅ holding
3	/speakers fake guests	5+ × fake	clean	clean	✅ holding
4	Apply form "no event open"	dead	form renders	form renders	✅ holding
5	Hero "10 cats · 100 shields"	all 4 stats fake	2 stats cleaned	2 stats still on hero	🟡 partial — stuck
6	/login dup H1	2 H1s	1 H1	1 H1	✅ holding
7	/login/magic empty email	200 OK	200 OK	200 OK	❌ stuck 3×
8	/verify-vote POST	404	404	404	❌ stuck 3×
9	/speakers URL ≠ H1 mismatch	mismatch	mismatch	mismatch	❌ stuck 3×
10	OG tags / canonical	missing	present	present	✅ holding
11	"Powered by SERVER4SALE"	1 mention	1 mention	1 mention	❌ stuck 3×
12	VAPID key in inline JS	inline	inline	inline	❌ stuck 3×
13	/docs markdown links	404	404	404	❌ stuck 3×

2 · Regression check (10 probes — all pass)

Re-verified every previously-fixed item to ensure Pass 2 fixes didn't break in Pass 3.

# 1. Sitemap e2e leak count
curl -s https://flakhi.production1.jugaar.ai/sitemap.xml | grep -c e2e-                                    → 0    ✅

# 2. Sitemap URL count (should be ~16)
curl -s https://flakhi.production1.jugaar.ai/sitemap.xml | grep -c '<loc>'                                → 16   ✅

# 3. e2e URLs accessible (should be 404)
curl -sS -o /dev/null -w '%{http_code}' https://flakhi.production1.jugaar.ai/events/e2e-demo-1789037519  → 404  ✅

# 4. /hall-of-fame clean (Jane/Bob should be 0)
curl -s https://flakhi.production1.jugaar.ai/hall-of-fame | grep -ciE 'Jane Applicant|Bob Builder'         → 0    ✅

# 5. /speakers clean (Standby Guest should be 0)
curl -s https://flakhi.production1.jugaar.ai/speakers | grep -ciE 'Standby Guest'                       → 0    ✅

# 6. Apply form has <form> tag (should be ≥1)
curl -s 'https://flakhi.production1.jugaar.ai/register/award?event=fla-2026-karachi' | grep -c '<form'        → 1    ✅

# 7. Apply form 'no event open' string (should be 0)
curl -s 'https://flakhi.production1.jugaar.ai/register/award?event=fla-2026-karachi' | grep -c 'No event is open' → 0    ✅

# 8. /login single H1 (should be exactly 1)
curl -s https://flakhi.production1.jugaar.ai/login | grep -c '<h1'                                          → 1    ✅

# 9. og:title presence
curl -s https://flakhi.production1.jugaar.ai/ | grep -c 'property="og:title"'                               → 1    ✅

# 10. canonical link presence
curl -s https://flakhi.production1.jugaar.ai/ | grep -c 'rel="canonical"'                                   → 1    ✅

10 / 10 PASS — no regressions, the 5 critical fixes from Pass 2 are still live and serving correctly.

3 · ❌ Still open (7 issues — identical to Pass 2)

3.1 · 🔴 /login/magic empty email still returns 200

Critical

Where: /login

Repro (just ran again): POST /login/magic with email= → HTTP/2 200, title "Sign in · Future Leaders Award". No validation, no error flash.

What to change: In the LoginController@sendMagicLink handler, add at the top: $request->validate(['email' => 'required|email']);

Why it might be stuck: Could be that the controller uses FormRequest or a different validation pattern. Probe with grep -rn 'sendMagicLink\|magic.*login\|login.*magic' /app/Http/Controllers/ on the prod box to find the right file.

3.2 · 🔴 /verify-vote POST still returns 404

Critical

Where: /verify-vote

Repro (just ran again): POST /verify-vote with code=ABCD1234 → 404, title "Page not found · Future Leaders Award".

What to change: In the VerifyVoteController: if code is missing/invalid, redirect back to /verify-vote with a flash session message instead of throwing 404. Or catch the 404 with a custom error view that re-renders the form with an error.

3.3 · 🟡 /speakers URL still ≠ H1 "Guests of Honor"

Medium

Where: /speakers

H1 reads <h1>Guests of Honor</h1> while URL is /speakers.

What to change: Either (a) update H1 to "Speakers", or (b) rename route to /guest-of-honor (with 301 from old URL). Then collapse the duplicate /guest-of-honor route that already exists separately.

3.4 · 🟡 "Powered by SERVER4SALE" still in footer

Medium

Where: Footer of every page, including /

Verified count: 1 mention on the homepage. Same as Pass 1 and Pass 2.

What to change: Master layout footer partial — find Powered by SERVER4SALE (likely in resources/views/layouts/app.blade.php or footer include), change to Powered by the FLA team or remove entirely.

3.5 · 🟡 /docs markdown links still 404

Medium

Where: /docs

Repro (just ran again): /ROADMAP.md → 404, /CHANGELOG.md → 404, /docs/OVERVIEW.md → 404.

What to change: Add nginx route (in /etc/nginx/sites-enabled/flakhi) to serve *.md from /var/www/fla/docs/ with Content-Type: text/markdown; charset=utf-8. OR fetch each file in the docs controller and render it inline.

3.6 · 🟡 Hero "10 categories · 100 shields" still claimed

Partial

Where: / (hero strip)

Verified count: 1 match for "10 categor|100 shields" on the homepage. The two "70+ Awards" and "200+ Attendees" stats were cleaned (no matches). Half done.

Real values: 17 categories, 2 shields ever (both from cleaned test events). The remaining two numbers are still misleading.

What to change: Replace "10 categories" with 17 categories and "100 shields" with launch-time placeholder, or hide the strip until numbers are real.

3.7 · 🟢 VAPID push-notification key still in inline JS

Low

Where: Inline <script> in <head> of every page

Verified: dataset.vapid="BMCKCEoT…" still inline. Same string since Pass 1.

What to change: Move key from inline JS into <meta name="vapid-key" content="..."> in the layout, OR restrict injection to pages that actually subscribe to push notifications.

4 · Stack & perf snapshot

Metric	Pass 1	Pass 2	Pass 3 (now)	Δ
TTFB (homepage)	380 ms	282 ms	309 ms	stable
Sitemap URLs	44 (28 leaked)	16 (clean)	16 (clean)	holding ✅
e2e-* status	200	404	404	holding ✅
Hall-of-fame size	17.5 KB	8.3 KB	8.3 KB	holding ✅
Speakers size	14.3 KB	8.1 KB	8.1 KB	holding ✅
Security headers	all OK	all OK	all OK	holding ✅
OG tags	missing	present	present	holding ✅

Stack unchanged: PHP + nginx 1.24 + Ubuntu. Session cookie FLASESSION with HttpOnly · Secure · SameSite=Lax. Brand #c0a830.

5 · 📋 Fix Sheet — every open issue, by URL, what to change

Copy-paste into the team tracker. This table is unchanged from Pass 2 — the team hasn't shipped these yet.

🔴 Critical (two — both 1-line fixes)

#	Issue	URL	What to change
1	/login/magic empty email	/login	In the controller that handles POST `/login/magic`, add server-side validation: $request->validate([ 'email' => 'required\|email' ]); If the file uses FormRequest, create or update `SendMagicLinkRequest` with the same rules.
2	/verify-vote POST 404	/verify-vote	In the controller that handles POST `/verify-vote`: instead of `abort(404)`, redirect back with a flash error: return back()->withErrors([ 'code' => 'We couldn\'t find a vote with that code. ' . 'Receipt codes are 8 characters — please check your email.' ]);

🟡 Medium (three)

#	Issue	URL	What to change
3	/speakers URL ≠ H1	/speakers	Either rename route `/speakers` → `/guest-of-honor` (add 301), OR update the H1 to "Speakers". Then retire the duplicate `/guest-of-honor` route.
4	"Powered by SERVER4SALE" footer	Master layout (every page footer)	In `resources/views/layouts/app.blade.php` (or footer partial): remove `Powered by SERVER4SALE`, or change to `Powered by the FLA team`. Re-deploy.
5	/docs markdown 404	/docs	Add nginx route (in production nginx vhost) serving `/var/www/fla/docs/*.md` with `Content-Type: text/markdown`. OR have the /docs view load and inline-render each markdown file.

🟢 Low (two)

#	Issue	URL	What to change
6	Hero "10 cats · 100 shields"	/	Master layout homepage hero partial: change `10 categories` → `17 categories`, `100 shields` → launch placeholder. Or hide the strip.
7	VAPID in inline JS	Every page head	Move `dataset.vapid = "..."` from inline JS into `<meta name="vapid-key">` in the layout. OR load only on pages that subscribe.

📊 Affected URLs

URL	Open issues	Severity
/login	1	🔴
/verify-vote	1	🔴
/speakers	1	🟡
/ (homepage)	2 (hero + footer)	🟡
/docs	1	🟡
Every page (VAPID in head)	1	🟢

6 · One-line fixes (copy-paste patterns)

Almost all 7 issues are <1-line or near-1-line diffs. Here are the patterns:

Critical 1 — Server-side email validation

// In LoginController@sendMagicLink (or whatever the route handler is named):
// BEFORE:
public function sendMagicLink(Request $request) {
  Mail::send(...);
  return back();
}

// AFTER:
public function sendMagicLink(Request $request) {
  $request->validate(['email' => 'required|email']);
  Mail::send(...);
  return back();
}

Critical 2 — Verify-vote flash instead of 404

// In the verify-vote POST handler:
// BEFORE:
if (! $vote = Vote::where('code', $code)->first()) abort(404);

// AFTER:
if (! $vote = Vote::where('code', $code)->first()) {
  return back()->withErrors(['code' => "We couldn't find a vote with that code."]);
}

Medium — Footer credit

# In the master layout footer partial, find the line:
&copy; 2026 Future Leaders Award &middot; Powered by SERVER4SALE

# Replace with:
&copy; 2026 Future Leaders Award

Medium — /docs markdown (nginx route)

# In the production nginx vhost for flakhi.production1.jugaar.ai, inside the 443 server block:
location ~* ^/(?:docs/)?[\w-]+\.md$ {
  root /var/www/fla/docs;
  add_header Content-Type text/markdown; charset=utf-8;
  try_files $uri =404;
}

# Then reload:
sudo nginx -t && sudo systemctl reload nginx

Medium — /speakers rename

# In routes/web.php (or equivalent), update the route definition:
// BEFORE (if it's a separate route file):
Route::get('/speakers', ...);
Route::get('/guest-of-honor', ...);

// AFTER — single canonical route, with redirect from old:
Route::redirect('/speakers', '/guest-of-honor', 301);
Route::get('/guest-of-honor', ...);

Low — Hero stats

# In the homepage partial (likely resources/views/home.blade.php):
# Find:
<div class="stat">10 categories</div>
<div class="stat">100 shields</div>

# Replace with the real count, or hide the strip:
<div class="stat">{{ count($categories) }} categories</div>
<div class="stat">launching Sept 23</div>

Low — VAPID key

# In resources/views/layouts/app.blade.php, in the <head>:
// BEFORE (inline script tag):
<script>document.documentElement.dataset.vapid = "@env('VAPID_PUBLIC_KEY')";</script>

// AFTER (meta tag):
<meta name="vapid-key" content="@env('VAPID_PUBLIC_KEY')">

// And update the JS that reads it from:
document.documentElement.dataset.vapid  →  document.querySelector('meta[name="vapid-key"]').content

7 · Re-verify recipes (paste each one after you ship the fix)

# After shipping the empty-email fix
curl -sX POST -d '_csrf=…&email=' https://flakhi.production1.jugaar.ai/login/magic | grep -c "check your email"  → must be 0

# After shipping the verify-vote fix
curl -sX POST -d '_csrf=…&code=BADCODE' https://flakhi.production1.jugaar.ai/verify-vote | grep -c "Page not found"  → must be 0

# After renaming /speakers
curl -sI https://flakhi.production1.jugaar.ai/speakers | head -1                                    → must be 301
curl -s https://flakhi.production1.jugaar.ai/guest-of-honor | grep -oE '<h1[^>]*>[^<]+</h1>'  → should be "Guests of Honor"

# After removing SERVER4SALE
curl -s https://flakhi.production1.jugaar.ai/ | grep -c "SERVER4SALE"             → must be 0

# After the docs markdown fix
curl -sI https://flakhi.production1.jugaar.ai/ROADMAP.md | head -1                                → must be 200 OK

# After hero stats fix
curl -s https://flakhi.production1.jugaar.ai/ | grep -oE "(10 categor|100 shields)"    → must be empty

# After VAPID meta tag migration
curl -s https://flakhi.production1.jugaar.ai/ | grep -c "dataset.vapid"            → ideally 0
curl -s https://flakhi.production1.jugaar.ai/ | grep -c 'name="vapid-key"'        → must be 1

8 · Live links & files

Item	URL / Path
Site under test	https://flakhi.production1.jugaar.ai/
Clean sitemap	/sitemap.xml (16 URLs)
/hall-of-fame (now empty)	/hall-of-fame
/speakers (still URL mismatch)	/speakers
/verify-vote (POST 404)	/verify-vote
Original markdown	`/root/workspace/FLAKHI_QA_REPORT.md`
This live report	https://flakhi-qa.hkus2.s4s.host/
Tester	Hermes QA · curl + DOM probe · 2026-09-13 12:27 UTC