PWA precache globber fix (#772) - Test Plan

Field	Value
Branch / PR	fix/offer-moderation-807 (PR #845, theme 2)
Environment	Local build (npm run build -w apps/web); post-deploy check on dev.ourlantern.app
Build flags / config	n/a (root package.json overrides change only)
Build (commit)	fill at run time
Tester	agent
Date	2026-08-10

Background: the blanket "brace-expansion": "2.0.3" audit override starved workbox-build's minimatch@10 (needs ^5), so the precache globber crashed with (0 , brace_expansion_1.expand) is not a function and the service worker silently shipped ~4 precache entries instead of the full app shell. Warning-only, so builds stayed green while offline coverage degraded. Fix: version-ranged override key "brace-expansion@1 || 2": "2.0.3" keeps the audit pin for the vulnerable v1/v2 range while letting ^5 requesters resolve nested v5 copies. (A nested "workbox-build": { "brace-expansion": "^5.0.2" } scope does NOT work: npm lets the global same-name key win, as #772 suspected.)

Summary

#	Scenario	Result	Notes
1	Broken baseline reproduced	[x] pass	4 entries + globber error
2	Fixed build: full precache, no error	[x] pass	39 entries, 3968 KiB
3	Audit pin still applies (v1/v2 consumers)	[x] pass	root 2.0.3, audit green
4	Post-deploy: deployed SW precaches the full shell	[ ] pass [ ] fail [ ] blocked	SCHEDULED: 6-9pm close step

Scenarios

1. Broken baseline reproduced

• Steps: npm run build -w apps/web on origin/dev deps.
• Expected: warning An error occurred when globbing for files. '(0 , brace_expansion_1.expand) is not a function'; precache ~4 entries.

Result:    [x] pass   [ ] fail   [ ] blocked
Actual:    "precache  4 entries (3.75 KiB)" + the exact globbing error, matching #772.
Evidence:  build output 2026-08-10 ~12:10.
Follow-up:

2. Fixed build: full precache, no error

• Steps: apply the ranged override key, npm update brace-expansion (heals the lock in place; hand-editing lock entries corrupts the workbox subtree, do not), rebuild.
• Expected: no globbing error; precache entry count reflects the full app shell.

Result:    [x] pass   [ ] fail   [ ] blocked
Actual:    "precache  39 entries (3968.35 KiB)", zero errors, build exit 0. Lock gains exactly two nested brace-expansion@5.0.9 copies (glob@13 and workbox-build subtrees); root stays 2.0.3.
Evidence:  build output 2026-08-10 ~12:15; lock diff 46 lines.
Follow-up:

3. Audit pin still applies

• Steps: npm ls brace-expansion (no invalid edges, v1/v2 requesters dedupe to root 2.0.3); node tooling/scripts/audit-production.js.
• Expected: no invalid resolutions; audit gate green.

Result:    [x] pass   [ ] fail   [ ] blocked
Actual:    NO invalid resolutions; production audit: "all production vulnerabilities are allowlisted with documented reasoning."
Evidence:  runs 2026-08-10 ~12:15.
Follow-up:

4. Post-deploy: deployed SW precaches the full shell (session-close window)

• Steps (after merge, 6-9pm):
  1. Fetch the deployed service worker (https://dev.ourlantern.app/sw.js) and count its precache manifest entries (or DevTools > Application > Cache Storage on the deployed site).
  2. Expect ~39 entries (matching the local build), not ~4.
• Expected: the deployed build carries the full precache manifest; offline shell coverage restored.

Result:    [ ] pass   [ ] fail   [ ] blocked
Actual:
Evidence:
Follow-up: