docs(Gate B): add mill-owner RESULTS.md report for 2026-09-07 test pass

17 pass, 1 fail (D-1, #29 python-multipart), 1 not run (OPS-1, HTTPS broken).
No walkable UI, no HTTPS, no E2E, no real draft create.

test-results/gate-b-2026-09-07/RESULTS.md

@@ -0,0 +1,50 @@
+# Gate B Results — 2026-09-07
+
+Evidence branch: `gate-b` · tip `b3e2faf`
+
+---
+
+## Results
+
+Every Gate B test case from `docs/TEST-SPEC.md`, stated in plain English for the mill owner.
+
+| Case | What this proves for the mill product | Result | Evidence | Blocker |
+|---|---|---|---|---|
+| **TV-1** | Green-background photos: the slab interior stays visible after the green sheet is removed. | pass | `test-results/gate-b-2026-09-07/vitest.txt:25-26` | — |
+| **TV-2** | Black-background photos: the slab interior stays visible after the black sheet is removed; only border-connected dark pixels are cut out. | pass | `test-results/gate-b-2026-09-07/vitest.txt:27-28` | — |
+| **TV-3** | Board feet math is correct: bdft = sqft × thickness (no divide-by-12). 1 sqft at 1 inch thick = 1 bdft. | pass | `test-results/gate-b-2026-09-07/vitest.txt:15-16` | — |
+| **TV-4** | Width samples measured at every 6 inches along the length axis report min, max, and average correctly. | pass | `test-results/gate-b-2026-09-07/vitest.txt:21-24` | — |
+| **TV-5** | Slabs with one angled end: the length axis follows the full length, and widths stay perpendicular. | pass | `test-results/gate-b-2026-09-07/vitest.txt:25-26` | — |
+| **TV-6** | Output photos are cropped to 3:4 ratio, slab fills 80% of the frame, shorter side ≥ 1600 px, saved as transparent PNG. | pass | `test-results/gate-b-2026-09-07/vitest.txt:123-127` | — |
+| **TV-7** | If the source photo is too small to make a good output, the system warns and refuses to upscale — requires a retake. | pass | `test-results/gate-b-2026-09-07/vitest.txt:128-132` | — |
+| **TV-8** | Pricing: recommended price = bdft × price-per-bdft; user overrides are stored and rounded correctly. | pass | `test-results/gate-b-2026-09-07/vitest.txt:6-11` | — |
+| **TV-9** | Thickness in inches maps to the right WooCommerce range label (e.g. 1" rounds up to "1"–1 1/2""). | pass | `test-results/gate-b-2026-09-07/vitest.txt:12-14` | — |
+| **TV-10** | All numbers round half-up to 2 decimals (length, sqft, bdft, price). | pass | `test-results/gate-b-2026-09-07/vitest.txt:15-16` | — |
+| **V-1** | SKU must be 3–24 characters, uppercase letters, digits, and hyphens only. Valid SKUs accepted; invalid ones rejected. | pass | `test-results/gate-b-2026-09-07/vitest.txt:36-57` | — |
+| **V-2** | Title, short title, and description have WooCommerce character limits enforced. | pass | `test-results/gate-b-2026-09-07/vitest.txt:66-87` | — |
+| **V-3** | The validation module version hash works: the server returns a fresh module when the client's cached version is stale. | pass | `test-results/gate-b-2026-09-07/vitest.txt:88-95` | — |
+| **AES-1** | WooCommerce credentials are encrypted at rest and decrypt back to the original values; ciphertext never leaks in settings responses. | pass | `test-results/gate-b-2026-09-07/pytest.txt:36-43` | — |
+| **AES-2** | Without the AES key, the app refuses to start — no fallback to storing secrets in plain text. | pass | `test-results/gate-b-2026-09-07/pytest.txt:51-52` | — |
+| **H-1** | Health endpoint returns OK with version and `woo_reachable: false` when no store is configured. | pass | `test-results/gate-b-2026-09-07/pytest.txt:5-9` | — |
+| **D-1** | Creating a slab draft via the API (multipart upload with data, files, metadata) returns 201, sets status to calibrated, and returns server revision. | fail | `test-results/gate-b-2026-09-07/pytest.txt:11-35` | [#29](https://gitea.vps1.afterthedemo.com/Ty_Tech/SlabUploader/issues/29) — `python-multipart` not installed |
+| **OPS-1** | After deploying Docker Compose, `GET https://APP_HOSTNAME/api/health` returns OK. | not run | `test-results/gate-b-2026-09-07/health.txt:15-47` | HTTPS path broken: `slab.local` unresolved; ports 443/18443 refused. HTTP `:18081` health returned 200 (interim only). |
+| **GC-5** | The app refuses to start without `WOO_BASE_URL` or with an `http://` URL. The store URL is read-only in settings. | pass | `test-results/gate-b-2026-09-07/pytest.txt:22-28` | — |
+
+---
+
+## Summary
+
+17 pass · 1 fail · 1 not run
+
+---
+
+## Unproven
+
+The following are not covered by any passing test or evidence at this gate:
+
+- **Walkable UI / phone capture** — The frontend on the host is a stub. No phone or desktop browser flow has been exercised end to end (capture → mask → axis → numbers → review → publish).
+- **HTTPS deployment** — OPS-1 was not run. The HTTPS path to the deployed app is not working. HTTP-only health on port 18081 returned OK but is not the specified deployment path.
+- **Real draft create on the deployed stack** — D-1 failed because `python-multipart` is missing. The API cannot accept multipart form data (the format used to upload slab photos and metadata). Issue #29 tracks this blocker.
+- **End-to-end browser flows** — No Playwright or browser-based tests have been executed. All passing tests are isolated unit or API contract tests against synthetic fixtures, not real browser sessions.
+
+Gate B is not green. UAT is not ready.