qa-copilot-lab 0.1.0

package/src/db.js

@@ -0,0 +1,97 @@
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const Database = require('better-sqlite3');
+const { products, reviews, faqs, demoUser, demoOrders } = require('./seed');
+
+const DB_DIR = path.join(os.homedir(), '.qa-copilot-lab');
+const DB_PATH = path.join(DB_DIR, 'data.db');
+
+function migrate(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS products (
+      id INTEGER PRIMARY KEY,
+      name TEXT NOT NULL,
+      category TEXT NOT NULL,
+      price REAL NOT NULL,
+      stock INTEGER NOT NULL,
+      color TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS reviews (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      product_id INTEGER NOT NULL,
+      author TEXT NOT NULL,
+      rating INTEGER NOT NULL,
+      body TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS faqs (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      question TEXT NOT NULL,
+      answer TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS users (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      username TEXT UNIQUE NOT NULL,
+      password TEXT NOT NULL,
+      email TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS orders (
+      id TEXT PRIMARY KEY,
+      username TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      item TEXT NOT NULL,
+      qty INTEGER NOT NULL,
+      total REAL NOT NULL,
+      status TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS wishlist (
+      username TEXT NOT NULL,
+      product_id INTEGER NOT NULL,
+      position INTEGER NOT NULL
+    );
+  `);
+}
+
+function seedIfEmpty(db) {
+  const { count } = db.prepare('SELECT COUNT(*) AS count FROM products').get();
+  if (count > 0) return;
+
+  const insertProduct = db.prepare(
+    'INSERT INTO products (id, name, category, price, stock, color) VALUES (@id, @name, @category, @price, @stock, @color)'
+  );
+  const insertReview = db.prepare(
+    'INSERT INTO reviews (product_id, author, rating, body) VALUES (@product_id, @author, @rating, @body)'
+  );
+  const insertFaq = db.prepare('INSERT INTO faqs (question, answer) VALUES (@question, @answer)');
+  const insertUser = db.prepare('INSERT INTO users (username, password, email) VALUES (@username, @password, @email)');
+  const insertOrder = db.prepare(
+    'INSERT INTO orders (id, username, created_at, item, qty, total, status) VALUES (@id, @username, @created_at, @item, @qty, @total, @status)'
+  );
+
+  const seedAll = db.transaction(() => {
+    for (const p of products) insertProduct.run(p);
+    for (const r of reviews) insertReview.run(r);
+    for (const f of faqs) insertFaq.run(f);
+    insertUser.run(demoUser);
+    for (const o of demoOrders) insertOrder.run(o);
+  });
+  seedAll();
+}
+
+function openDb({ fresh = false } = {}) {
+  fs.mkdirSync(DB_DIR, { recursive: true });
+  if (fresh && fs.existsSync(DB_PATH)) fs.rmSync(DB_PATH);
+
+  const db = new Database(DB_PATH);
+  db.pragma('journal_mode = WAL');
+  migrate(db);
+  seedIfEmpty(db);
+  return db;
+}
+
+function resetData(db) {
+  db.exec('DELETE FROM products; DELETE FROM reviews; DELETE FROM faqs; DELETE FROM users; DELETE FROM orders; DELETE FROM wishlist;');
+  seedIfEmpty(db);
+}
+
+module.exports = { openDb, resetData, DB_PATH };

package/src/middleware/session.js

@@ -0,0 +1,16 @@
+const crypto = require('crypto');
+
+// Sandbox-simple session: a random id in a cookie, cart looked up by that id.
+// No auth token here — logged-in username lives in its own cookie, set by /login.
+function sessionMiddleware(req, res, next) {
+  let sid = req.cookies.sid;
+  if (!sid) {
+    sid = crypto.randomUUID();
+    res.cookie('sid', sid, { httpOnly: true });
+  }
+  req.sid = sid;
+  req.username = req.cookies.username || null;
+  next();
+}
+
+module.exports = sessionMiddleware;

package/src/routes/api.js

@@ -0,0 +1,136 @@
+const path = require('path');
+const fs = require('fs');
+const express = require('express');
+const state = require('../state');
+
+const PRODUCT_PHOTO_DIR = path.join(__dirname, '..', '..', 'public', 'images', 'products');
+
+function initials(name) {
+  return name
+    .split(' ')
+    .map((w) => w[0])
+    .slice(0, 2)
+    .join('')
+    .toUpperCase();
+}
+
+function apiRouter(db) {
+  const router = express.Router();
+
+  // Real product photo if one was dropped in public/images/products/<id>.jpg,
+  // otherwise fall back to placeholder art generated as inline SVG — either way
+  // every product gets a real <img alt="..."> to practice getByAltText on.
+  router.get('/img/:id', (req, res) => {
+    const product = db.prepare('SELECT * FROM products WHERE id = ?').get(req.params.id);
+    if (!product) return res.status(404).end();
+
+    const photoPath = path.join(PRODUCT_PHOTO_DIR, `${product.id}.jpg`);
+    if (fs.existsSync(photoPath)) return res.type('image/jpeg').sendFile(photoPath);
+
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="320" height="220">
+      <rect width="320" height="220" fill="#${product.color}"/>
+      <text x="160" y="118" font-family="monospace" font-size="42" fill="#ffffff" text-anchor="middle">${initials(product.name)}</text>
+    </svg>`;
+    res.type('image/svg+xml').send(svg);
+  });
+
+  router.get('/products', (req, res) => {
+    const { category, maxPrice } = req.query;
+    let sql = 'SELECT * FROM products WHERE 1=1';
+    const params = [];
+    if (category) {
+      sql += ' AND category = ?';
+      params.push(category);
+    }
+    if (maxPrice) {
+      sql += ' AND price <= ?';
+      params.push(Number(maxPrice));
+    }
+    res.json(db.prepare(sql).all(...params));
+  });
+
+  router.get('/products/:id', (req, res) => {
+    const product = db.prepare('SELECT * FROM products WHERE id = ?').get(req.params.id);
+    if (!product) return res.status(404).json({ error: 'not found' });
+    res.json(product);
+  });
+
+  router.get('/cart', (req, res) => {
+    res.json(hydrateCart(db, state.getCart(req.sid)));
+  });
+
+  router.post('/cart', express.json(), (req, res) => {
+    const { productId, qty = 1 } = req.body;
+    const cart = state.getCart(req.sid);
+    const existing = cart.find((line) => line.productId === Number(productId));
+    if (existing && state.getBugSet() !== 2) {
+      existing.qty += Number(qty);
+    } else {
+      cart.push({ productId: Number(productId), qty: Number(qty) });
+    }
+    res.status(201).json(hydrateCart(db, cart));
+  });
+
+  router.patch('/cart/:productId', express.json(), (req, res) => {
+    const cart = state.getCart(req.sid);
+    const line = cart.find((l) => l.productId === Number(req.params.productId));
+    if (!line) return res.status(404).json({ error: 'not in cart' });
+    line.qty = Math.max(1, Number(req.body.qty));
+    res.json(hydrateCart(db, cart));
+  });
+
+  router.delete('/cart/:productId', (req, res) => {
+    const cart = state.getCart(req.sid);
+    const next = cart.filter((l) => l.productId !== Number(req.params.productId));
+    state.getCart(req.sid).length = 0;
+    state.getCart(req.sid).push(...next);
+    res.json(hydrateCart(db, next));
+  });
+
+  router.post('/orders', express.json(), async (req, res) => {
+    if (!req.username) return res.status(401).json({ error: 'login required' });
+    const cart = state.getCart(req.sid);
+    if (cart.length === 0) return res.status(400).json({ error: 'cart is empty' });
+
+    const hydrated = hydrateCart(db, cart);
+    const total = hydrated.items.reduce((sum, l) => sum + l.price * l.qty, 0);
+    const qty = hydrated.items.reduce((n, l) => n + l.qty, 0);
+    const itemSummary = hydrated.items.map((l) => `${l.name} x${l.qty}`).join(', ');
+
+    // Flaky mode: a payment-gateway-style delay opens a real await gap, so a
+    // rapid double-click on "Place order" reads the same cart snapshot twice
+    // and creates two orders — a genuine race, not a scripted one.
+    if (state.getFlaky()) {
+      await new Promise((resolve) => setTimeout(resolve, 300 + Math.random() * 900));
+      if (Math.random() < 0.25) {
+        return res.status(500).json({ error: 'Payment gateway timed out. Please try again.' });
+      }
+    }
+
+    const id = `SKU-${1100 + Math.floor(Math.random() * 900)}`;
+    db.prepare(
+      'INSERT INTO orders (id, username, created_at, item, qty, total, status) VALUES (?, ?, date(?), ?, ?, ?, ?)'
+    ).run(id, req.username, 'now', itemSummary, qty, total, 'Processing');
+
+    cart.length = 0;
+    res.status(201).json({ id, total });
+  });
+
+  router.get('/orders', (req, res) => {
+    if (!req.username) return res.status(401).json({ error: 'login required' });
+    res.json(db.prepare('SELECT * FROM orders WHERE username = ? ORDER BY created_at DESC').all(req.username));
+  });
+
+  return router;
+}
+
+function hydrateCart(db, cart) {
+  const items = cart.map((line) => {
+    const product = db.prepare('SELECT * FROM products WHERE id = ?').get(line.productId);
+    return { ...line, name: product.name, price: product.price, stock: product.stock };
+  });
+  const count = items.reduce((n, l) => n + l.qty, 0);
+  return { items, count };
+}
+
+module.exports = { apiRouter, hydrateCart };

package/src/routes/auth.js

@@ -0,0 +1,45 @@
+const express = require('express');
+
+// Sandbox auth: plaintext compare against a local SQLite table. This app never
+// leaves the student's machine and holds no real user data, so there is no
+// hashing/session-store machinery to teach around here on purpose.
+function authRouter(db) {
+  const router = express.Router();
+
+  router.post('/login', express.urlencoded({ extended: false }), (req, res) => {
+    const { username, password } = req.body;
+    const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
+    if (!user || user.password !== password) {
+      return res.redirect('/login?error=invalid');
+    }
+    res.cookie('username', user.username, { httpOnly: true });
+    res.redirect('/account');
+  });
+
+  router.post('/register', express.urlencoded({ extended: false }), (req, res) => {
+    const { username, password, email } = req.body;
+    if (!username || !password || !email) return res.redirect('/register?error=missing');
+    try {
+      db.prepare('INSERT INTO users (username, password, email) VALUES (?, ?, ?)').run(username, password, email);
+    } catch (e) {
+      return res.redirect('/register?error=taken');
+    }
+    res.cookie('username', username, { httpOnly: true });
+    res.redirect('/account');
+  });
+
+  router.post('/logout', (req, res) => {
+    res.clearCookie('username');
+    res.redirect('/');
+  });
+
+  router.post('/account/delete', (req, res) => {
+    if (req.username) db.prepare('DELETE FROM users WHERE username = ?').run(req.username);
+    res.clearCookie('username');
+    res.redirect('/');
+  });
+
+  return router;
+}
+
+module.exports = { authRouter };

package/src/routes/devApi.js

@@ -0,0 +1,56 @@
+const express = require('express');
+const state = require('../state');
+const { resetData } = require('../db');
+
+const BUG_SETS = {
+  1: 'Checkout button stays disabled even once the cart has items.',
+  2: 'Adding the same product twice creates a duplicate line instead of incrementing quantity.',
+};
+
+function devApiRouter(db) {
+  const router = express.Router();
+
+  router.get('/__health', (req, res) => {
+    res.json({ ok: true, chaos: state.getChaosMode(), bugSet: state.getBugSet(), flaky: state.getFlaky() });
+  });
+
+  router.post('/__reset', (req, res) => {
+    resetData(db);
+    state.getCart(req.sid).length = 0;
+    state.setChaos('off');
+    state.setBugSet(null);
+    state.setFlaky(false);
+    res.json({ ok: true });
+  });
+
+  router.post('/__chaos/:mode', (req, res) => {
+    const { mode } = req.params;
+    if (!['off', 'mild', 'aggressive'].includes(mode)) {
+      return res.status(400).json({ error: 'mode must be off, mild, or aggressive' });
+    }
+    state.setChaos(mode);
+    res.json({ ok: true, chaos: mode });
+  });
+
+  router.post('/__seed-bugs/:setId', (req, res) => {
+    const setId = req.params.setId === 'off' ? null : Number(req.params.setId);
+    if (setId !== null && !BUG_SETS[setId]) {
+      return res.status(400).json({ error: `unknown bug set, known sets: ${Object.keys(BUG_SETS).join(', ')}` });
+    }
+    state.setBugSet(setId);
+    res.json({ ok: true, bugSet: setId, answerKey: setId ? BUG_SETS[setId] : null });
+  });
+
+  router.post('/__flaky/:mode', (req, res) => {
+    const { mode } = req.params;
+    if (!['on', 'off'].includes(mode)) {
+      return res.status(400).json({ error: 'mode must be on or off' });
+    }
+    state.setFlaky(mode === 'on');
+    res.json({ ok: true, flaky: mode === 'on' });
+  });
+
+  return router;
+}
+
+module.exports = { devApiRouter, BUG_SETS };

package/src/routes/pages.js

@@ -0,0 +1,125 @@
+const express = require('express');
+const state = require('../state');
+const { hydrateCart } = require('./api');
+
+const CATEGORIES = ['Peripherals', 'Audio', 'Storage', 'Networking', 'Accessories'];
+const PAGE_SIZE = 6;
+
+function pagesRouter(db) {
+  const router = express.Router();
+
+  router.get('/', (req, res) => {
+    const featured = db.prepare('SELECT * FROM products ORDER BY id LIMIT 4').all();
+    const faqs = db.prepare('SELECT * FROM faqs').all();
+    res.render('home', { featured, faqs });
+  });
+
+  router.get('/catalog', (req, res) => {
+    const category = req.query.category || '';
+    const maxPrice = req.query.maxPrice ? Number(req.query.maxPrice) : null;
+    const q = req.query.q || '';
+    const page = Math.max(1, Number(req.query.page) || 1);
+
+    let sql = 'SELECT * FROM products WHERE 1=1';
+    const params = [];
+    if (category) {
+      sql += ' AND category = ?';
+      params.push(category);
+    }
+    if (maxPrice) {
+      sql += ' AND price <= ?';
+      params.push(maxPrice);
+    }
+    if (q) {
+      sql += ' AND name LIKE ?';
+      params.push(`%${q}%`);
+    }
+    const all = db.prepare(sql).all(...params);
+    const totalPages = Math.max(1, Math.ceil(all.length / PAGE_SIZE));
+    const products = all.slice((page - 1) * PAGE_SIZE, page * PAGE_SIZE);
+
+    res.render('catalog', { products, categories: CATEGORIES, category, maxPrice, q, page, totalPages });
+  });
+
+  router.get('/product/:id', (req, res) => {
+    const product = db.prepare('SELECT * FROM products WHERE id = ?').get(req.params.id);
+    if (!product) return res.status(404).render('404');
+    const productReviews = db.prepare('SELECT * FROM reviews WHERE product_id = ?').all(product.id);
+    res.render('product', { product, reviews: productReviews });
+  });
+
+  router.get('/cart', (req, res) => {
+    const cart = hydrateCart(db, state.getCart(req.sid));
+    res.render('cart', { cart, bugSet: state.getBugSet() });
+  });
+
+  router.get('/checkout', (req, res) => {
+    const cart = hydrateCart(db, state.getCart(req.sid));
+    if (cart.items.length === 0) return res.redirect('/cart');
+    res.render('checkout', { cart });
+  });
+
+  router.get('/payment-frame', (req, res) => {
+    res.render('payment-frame', { layout: false });
+  });
+
+  router.get('/login', (req, res) => {
+    res.render('login', { error: req.query.error || null });
+  });
+
+  router.get('/register', (req, res) => {
+    res.render('register', { error: req.query.error || null });
+  });
+
+  router.get('/account', (req, res) => {
+    if (!req.username) return res.redirect('/login');
+    const user = db.prepare('SELECT * FROM users WHERE username = ?').get(req.username);
+    const wishlist = db
+      .prepare(
+        `SELECT wishlist.product_id AS id, products.name, products.price
+         FROM wishlist JOIN products ON products.id = wishlist.product_id
+         WHERE wishlist.username = ? ORDER BY wishlist.position`
+      )
+      .all(req.username);
+    res.render('account', { user, wishlist });
+  });
+
+  router.get('/account/orders', (req, res) => {
+    if (!req.username) return res.redirect('/login');
+    const orders = db.prepare('SELECT * FROM orders WHERE username = ? ORDER BY created_at DESC').all(req.username);
+    res.render('orders', { orders });
+  });
+
+  router.get('/account/orders/:id/invoice', (req, res) => {
+    if (!req.username) return res.redirect('/login');
+    const order = db.prepare('SELECT * FROM orders WHERE id = ? AND username = ?').get(req.params.id, req.username);
+    if (!order) return res.status(404).render('404');
+    res.render('invoice', { order, layout: false });
+  });
+
+  router.post('/wishlist', express.urlencoded({ extended: false }), (req, res) => {
+    if (!req.username) return res.redirect('/login');
+    const { productId, order } = req.body;
+    if (order) {
+      const ids = order.split(',').map(Number);
+      const update = db.prepare('UPDATE wishlist SET position = ? WHERE username = ? AND product_id = ?');
+      ids.forEach((id, i) => update.run(i, req.username, id));
+    } else if (productId) {
+      const { count } = db.prepare('SELECT COUNT(*) AS count FROM wishlist WHERE username = ?').get(req.username);
+      db.prepare('INSERT INTO wishlist (username, product_id, position) VALUES (?, ?, ?)').run(
+        req.username,
+        Number(productId),
+        count
+      );
+    }
+    res.redirect('/account');
+  });
+
+  router.get('/locators', (req, res) => {
+    res.render('locators');
+  });
+
+  return router;
+}
+
+module.exports = { pagesRouter };

package/src/seed.js

@@ -0,0 +1,43 @@
+const products = [
+  { id: 1, name: 'Wireless Mouse', category: 'Peripherals', price: 19.99, stock: 25, color: '2b6ca3' },
+  { id: 2, name: 'Mechanical Keyboard', category: 'Peripherals', price: 89.0, stock: 0, color: '1f7a5c' },
+  { id: 3, name: 'USB-C Hub (7-in-1)', category: 'Accessories', price: 34.5, stock: 40, color: 'b85c2c' },
+  { id: 4, name: 'Noise Cancelling Headphones', category: 'Audio', price: 129.0, stock: 12, color: '6c4fa1' },
+  { id: 5, name: '1TB External SSD', category: 'Storage', price: 79.99, stock: 8, color: '2b6ca3' },
+  { id: 6, name: 'Webcam 1080p', category: 'Peripherals', price: 45.0, stock: 15, color: '1f7a5c' },
+  { id: 7, name: 'Wi-Fi 6 Router', category: 'Networking', price: 99.0, stock: 5, color: 'b85c2c' },
+  { id: 8, name: 'Laptop Stand', category: 'Accessories', price: 29.0, stock: 0, color: '6c4fa1' },
+  { id: 9, name: 'Bluetooth Speaker', category: 'Audio', price: 59.0, stock: 20, color: '2b6ca3' },
+  { id: 10, name: 'Ethernet Cable 3m', category: 'Networking', price: 8.0, stock: 100, color: '1f7a5c' },
+];
+
+const reviews = [
+  { product_id: 1, author: 'Nok', rating: 5, body: 'Tracks perfectly, battery lasts weeks.' },
+  { product_id: 1, author: 'Ploy', rating: 4, body: 'Comfortable grip, a bit light for my taste.' },
+  { product_id: 1, author: 'Beam', rating: 5, body: 'Silent clicks, great for open offices.' },
+  { product_id: 1, author: 'Fah', rating: 3, body: 'Scroll wheel feels loose after a month.' },
+  { product_id: 1, author: 'Ann', rating: 5, body: 'Best budget mouse I have used.' },
+  { product_id: 1, author: 'Kong', rating: 4, body: 'Pairs instantly with my laptop every time.' },
+  { product_id: 1, author: 'Mai', rating: 2, body: 'One arrived with a dead scroll click.' },
+  { product_id: 1, author: 'Toon', rating: 5, body: 'Exactly as described, fast shipping.' },
+  { product_id: 4, author: 'Gift', rating: 5, body: 'Cancels office chatter almost completely.' },
+  { product_id: 4, author: 'Ohm', rating: 4, body: 'Great sound, ear cups run warm after hours.' },
+];
+
+const faqs = [
+  { question: 'How long is shipping?', answer: 'Orders ship within 2 business days and arrive in 3-5 days domestically.' },
+  { question: 'Can I return an item?', answer: 'Yes, unopened items can be returned within 30 days of delivery.' },
+  { question: 'Do you ship internationally?', answer: 'Currently we only ship within the country used at checkout.' },
+  { question: 'Is my payment information stored?', answer: 'No, card details are handled entirely by the payment step and never saved.' },
+];
+
+const demoUser = { username: 'qa_student', password: 'Passw0rd!', email: 'qa_student@example.test' };
+
+const demoOrders = [
+  { id: 'SKU-1027', username: 'qa_student', created_at: '2026-07-02', item: 'Wireless Mouse', qty: 1, total: 19.99, status: 'Delivered' },
+  { id: 'SKU-1029', username: 'qa_student', created_at: '2026-07-18', item: 'USB-C Hub (7-in-1)', qty: 2, total: 69.0, status: 'Delivered' },
+  { id: 'SKU-1041', username: 'qa_student', created_at: '2026-08-05', item: 'Noise Cancelling Headphones', qty: 1, total: 129.0, status: 'Shipped' },
+  { id: 'SKU-1052', username: 'qa_student', created_at: '2026-08-30', item: 'Bluetooth Speaker', qty: 1, total: 59.0, status: 'Processing' },
+];
+
+module.exports = { products, reviews, faqs, demoUser, demoOrders };

package/src/server.js

@@ -0,0 +1,71 @@
+const path = require('path');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+
+const { openDb, DB_PATH } = require('./db');
+const state = require('./state');
+const { cx, testId } = require('./chaos');
+const sessionMiddleware = require('./middleware/session');
+const { apiRouter, hydrateCart } = require('./routes/api');
+const { pagesRouter } = require('./routes/pages');
+const { authRouter } = require('./routes/auth');
+const { devApiRouter } = require('./routes/devApi');
+
+function createApp(db) {
+  const app = express();
+
+  app.set('view engine', 'ejs');
+  app.set('views', path.join(__dirname, '..', 'views'));
+
+  app.use(express.static(path.join(__dirname, '..', 'public')));
+  app.use(cookieParser());
+  app.use(sessionMiddleware);
+
+  // Every EJS view gets these without asking — locators sprinkled through the
+  // markup (data-testid, chaos-mode class names) read from one shared source.
+  app.use((req, res, next) => {
+    res.locals.username = req.username;
+    res.locals.cartCount = hydrateCart(db, state.getCart(req.sid)).count;
+    res.locals.chaosMode = state.getChaosMode();
+    res.locals.bugSet = state.getBugSet();
+    res.locals.cx = cx;
+    res.locals.tid = testId;
+    next();
+  });
+
+  app.use('/api', apiRouter(db));
+  app.use('/api', devApiRouter(db));
+  app.use(authRouter(db));
+  app.use(pagesRouter(db));
+
+  app.use((req, res) => {
+    res.status(404).render('404');
+  });
+
+  return app;
+}
+
+function startServer({ port = 4173, fresh = false, host = '127.0.0.1' } = {}) {
+  const db = openDb({ fresh });
+  const app = createApp(db);
+
+  app.listen(port, host, () => {
+    const displayHost = host === '0.0.0.0' ? 'localhost' : host;
+    console.log('');
+    console.log(`  QA Copilot Lab running at http://${displayHost}:${port}`);
+    if (host === '0.0.0.0') {
+      console.log(`  bound to 0.0.0.0 — reachable from other devices on this network too`);
+    }
+    console.log(`  seeded login:  qa_student / Passw0rd!`);
+    console.log(`  data stored at ${DB_PATH}`);
+    console.log(`  reset:         POST /api/__reset`);
+    console.log(`  chaos mode:    POST /api/__chaos/mild | aggressive | off`);
+    console.log(`  seed bugs:     POST /api/__seed-bugs/1 | 2 | off`);
+    console.log(`  flaky mode:    POST /api/__flaky/on | off`);
+    console.log('');
+  });
+
+  return app;
+}
+
+module.exports = { createApp, startServer };

package/src/state.js

@@ -0,0 +1,33 @@
+// Runtime-only state for exercises: intentionally NOT persisted to SQLite.
+// Every restart starts clean (chaos off, no seeded bugs) — students opt in on purpose.
+const carts = new Map(); // sid -> [{ productId, qty }]
+
+let chaosMode = 'off'; // 'off' | 'mild' | 'aggressive'
+let chaosSeed = 'stable';
+let activeBugSet = null; // null | 1 | 2
+let flakyMode = false; // checkout endpoint gains latency, occasional 500s, and a real race window
+
+function getCart(sid) {
+  if (!carts.has(sid)) carts.set(sid, []);
+  return carts.get(sid);
+}
+
+function setChaos(mode) {
+  chaosMode = mode;
+  chaosSeed = Math.random().toString(36).slice(2, 8);
+}
+
+module.exports = {
+  getCart,
+  getChaosMode: () => chaosMode,
+  getChaosSeed: () => chaosSeed,
+  setChaos,
+  getBugSet: () => activeBugSet,
+  setBugSet: (id) => {
+    activeBugSet = id;
+  },
+  getFlaky: () => flakyMode,
+  setFlaky: (on) => {
+    flakyMode = on;
+  },
+};

package/views/404.ejs

@@ -0,0 +1,7 @@
+<%- include('partials/head', { title: 'Not found' }) %>
+<%- include('partials/header') %>
+
+  <h1>404 — page not found</h1>
+  <p><a href="/">Back to home</a></p>
+
+<%- include('partials/footer') %>

package/views/account.ejs

@@ -0,0 +1,42 @@
+<%- include('partials/head', { title: 'Account' }) %>
+<%- include('partials/header') %>
+
+  <h1>Account</h1>
+  <p>Username: <strong><%= user.username %></strong></p>
+  <p>Email: <strong><%= user.email %></strong></p>
+
+  <section class="section">
+    <h2>Profile photo</h2>
+    <form class="upload-form" onsubmit="event.preventDefault(); window.toast('Photo received (nothing is actually stored in this sandbox)');">
+      <label for="profile-photo">Upload a photo</label>
+      <input type="file" id="profile-photo" name="photo" accept="image/*">
+      <button type="submit" class="btn btn-secondary">Upload</button>
+    </form>
+  </section>
+
+  <section class="section">
+    <h2>Wishlist</h2>
+    <p class="hint-text">Drag to reorder — the new order is saved automatically.</p>
+    <ul class="wishlist" id="wishlist-list" data-component="drag-drop">
+      <% wishlist.forEach(function(w) { %>
+        <li draggable="true" data-product-id="<%= w.id %>" class="wishlist-item" data-testid="<%= tid('wishlist-item-' + w.id) %>">
+          <span class="drag-handle" aria-hidden="true">⠿</span>
+          <%= w.name %> — <%= w.price.toFixed(2) %> USD
+        </li>
+      <% }); %>
+      <% if (wishlist.length === 0) { %>
+        <li class="wishlist-empty">Nothing saved yet — add items from any product page.</li>
+      <% } %>
+    </ul>
+  </section>
+
+  <section class="section">
+    <h2>Danger zone</h2>
+    <form action="/account/delete" method="post" id="delete-account-form">
+      <button type="submit" class="btn btn-danger" id="delete-account-btn" data-testid="<%= tid('delete-account-button') %>">
+        Delete account
+      </button>
+    </form>
+  </section>
+
+<%- include('partials/footer') %>