Live production logs two console errors on every route that mounts Cloudflare Turnstile:
%c%d font-size:0;color:transparent NaN (x2)
Confirmed on scripthammer.com at 134f94e:
| route |
console errors |
mounts Turnstile |
/sign-in/ |
2 |
yes |
/sign-up/ |
2 |
yes |
/payment-demo/ |
2 |
yes |
/, /contact/, /blog/, /docs/, /status/, /privacy/, /cookies/, /comment-policy/, /accessibility/, /privacy-controls/ |
0 |
no |
Perfectly correlated with Turnstile and nothing else, so it is very likely the widget's own instrumentation rather than app code. Worth confirming rather than assuming: %c%d with a NaN argument means something is formatting an undefined number, and if that turns out to be ours it is a real bug with a trivial fix.
Two credential pages and the payment demo are not where you want unexplained console noise, and it makes a console-based smoke check noisier for everyone who comes after.
Why this is filed separately
It was originally one half of #466, whose other half — a React #418 hydration mismatch on /contact — is fixed and verified on production. Closing #466 for that fix would have closed this finding with it, leaving a resolved issue whose body still described an unresolved problem. That is the failure mode CLAUDE.md's issue-hygiene section is about, so the surviving half gets its own ticket.
How to check
docker compose exec -T scripthammer node .pay-verify/prodcheck.mjs # render gate, exit 0
then load /sign-in/ with a console listener — .pay-verify/prod.mjs already prints per-route console errors. Note the container cannot resolve scripthammer.com (WSL2 resolver); Chromium needs --host-resolver-rules=MAP scripthammer.com 185.199.108.153.
Related: #442 (Turnstile is live on those forms with no privacy-policy disclosure, which blocks the remaining half of #374).
Live production logs two console errors on every route that mounts Cloudflare Turnstile:
Confirmed on
scripthammer.comat134f94e:/sign-in//sign-up//payment-demo//,/contact/,/blog/,/docs/,/status/,/privacy/,/cookies/,/comment-policy/,/accessibility/,/privacy-controls/Perfectly correlated with Turnstile and nothing else, so it is very likely the widget's own instrumentation rather than app code. Worth confirming rather than assuming:
%c%dwith aNaNargument means something is formatting an undefined number, and if that turns out to be ours it is a real bug with a trivial fix.Two credential pages and the payment demo are not where you want unexplained console noise, and it makes a console-based smoke check noisier for everyone who comes after.
Why this is filed separately
It was originally one half of #466, whose other half — a React #418 hydration mismatch on
/contact— is fixed and verified on production. Closing #466 for that fix would have closed this finding with it, leaving a resolved issue whose body still described an unresolved problem. That is the failure mode CLAUDE.md's issue-hygiene section is about, so the surviving half gets its own ticket.How to check
then load
/sign-in/with a console listener —.pay-verify/prod.mjsalready prints per-route console errors. Note the container cannot resolvescripthammer.com(WSL2 resolver); Chromium needs--host-resolver-rules=MAP scripthammer.com 185.199.108.153.Related: #442 (Turnstile is live on those forms with no privacy-policy disclosure, which blocks the remaining half of #374).