[masarray]

P4 Website real browser QA — headless Chromium

Closes only the automated browser-smoke subset of #750. Existing source validators already check 62 pages, sitemap, links and image metadata.

• Playwright Chromium smoke on EN/ID Home, Download, Quick Start, Demo, FAQ and Compatibility, widths 360/390/768/1280/1920px.
• Assert no horizontal overflow, correct page locale, one main/H1 and Skip link, mobile menu ARIA labels, Escape, and nested localized navigation clicks.
• Save JSON/Markdown findings plus EN/ID mobile/desktop screenshots to GitHub Actions artifacts.
• Build exact website with canonical v1.6.42 evidence. No application, engine, installer, binary, version ledger or release tag changes.

Important limitations: headless Chromium is not real-device iOS/Android, screen-reader QA, certified WCAG, Lighthouse or real CrUX Core Web Vitals. Issue #750 stays open for remaining physical/device QA.

Image disclosure #745, current Add-IED and Smart IP captures #747, repository About/topics #749 and gated source PR #729 remain separate and cannot be auto-closed.

Merge only if new Chromium CI and existing required application/site exact-head checks are green.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T12:56:57.418068Z	0b2cdbd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0b2cdbd00b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Assert nested-click menu closure before leaving the document

If the nested-label click handler in landing/app.js regresses or is removed, this check still passes: the link navigates to features.html, and the subsequent locator reads the new document's toggle, whose initial markup already has aria-expanded="false" in landing/partials/header.html. Consequently, the reported nested-click regression coverage never verifies that the originating menu actually closed. Prevent the default navigation for this interaction check and assert closure on the original document, then test the destination separately. This is the exact interaction behavior that the repository's regression guidance requires protecting.

AGENTS.md reference: AGENTS.md:L176-L180

Useful? React with 👍 / 👎.

[masarray]

FINAL P4/P6 public-product implementation checkpoint — 2026-10-25 (after real deployment)

PR #751 MERGED into main as 326bb8c3f0ae660cf0f5df5569bbf1d1c6a91c4c, exact tested PR head 0a22452388c0f029da574e2fbb62a09b06c0ea5d.

• 15/15 exact-head PR workflows passed, including CI P0 workflow integrity, Windows native/app/regression, website source/Pages, production health, and integrated headless Chromium.
• CI Chromium tests: 36/36 EN/ID page-width scenarios successful at 360/390/768/1280/1920px. Validated mobile menu localized controls, Escape, nested-text links, HTML landmarks, scroll overflow, basic runtime JS. Scope is headless lab testing, not real device/WCAG certification.
• Confirmed and fixed actual bug: EN+ID Download overflow at 360/390px (min-content source commit hash and 3 supply-chain cards forced 399px width). landing/adoption.css now bounds mobile cards and allows word wrapping; landing/download.css wraps hash display without hiding text.
• Preserved CI workflow budget 31/31 max by integrating Playwright test into pre-existing .github/workflows/site-measurement.yml; temporary extra workflow removed before merge; CI integrity green.
• Production GitHub Pages run 40196394355: source validation, deployment and public attestation SUCCESS. Live build-info.json attests exact website source head 0a22452388c0f029da574e2fbb62a09b06c0ea5d, sourceRef=refs/heads/main, workflow run 40196394355, stable release 1.6.42. Live EN/ID Download pages serve stable v1.6.42.
• Image disclosure P2B: perform human sanitization review of 8 public v1.6.42 screenshots #745 advanced: all 8 PNG + all 8 WebP manually inspected, SHA identities in issue comments. Visible endpoints, IED and GOOSE MAC identifiers remain unapproved for independent public-disclosure; no secret was knowingly redacted and no original capture was mutated.

Still open, not claimed closed: #745 owner network-data disclosure decision, #747 authentic v1.6.42 Add IED/Smart IP screenshots, #749 repository About/topics admin edit (no connector write), #750 actual device + screen reader + measured field Core Web Vitals signoff, and independent physical R7/R10 on draft #729 app source-promotion. Do NOT weaken guards, repoint tag or overwrite binary assets to make a progress report look fully closed.

This branch is finished, merged, deployed, and CI-qualified within its defined website engineering scope; further work should use main + existing tracking issues.