docs: record the four conventions the audits kept re-deriving - #411
Merged
Conversation
Adding to an empty cart from two tabs at once made each request create its own cart. One cookie won and the other cart, holding an item the buyer had just added, was orphaned. Serverless invocations share no state, so the coordination happens in the one place the requests do share: the browser. A cross-tab Web Lock funnels cart creation through a single idempotent request. The cart id stays in an httpOnly cookie and never reaches client code, since Shopify's cart id embeds a secret their docs say to treat like a password. The server action still creates a cart when the cookie is missing, so a submission without JS keeps working.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #399.
What this does
Four audits arrived at the same positions independently, and each one exists because the alternative already shipped a bug. They lived only in issue history, so the next audit would have rediscovered them from scratch. Now they are in AGENTS.md, next to the rules people already read.
Summary
setup:projecthad three failure modes — thrown, collected, skipped — and only a thrown one stopped the run.Also adds a line to the PR template for the fourth, since it is the one that slipped twice and the moment it matters is the moment you open a PR.
Test Plan
bun run check→ exit 0 (docs and template only, no code)