wrongmove: round-3 fix sweep — scrape pipeline, BUY tab, filter URL state, render hygiene, map polish

Coordinated fix across 31 bugs found in a parallel QA pass. Findings docs at /tmp/wrongmove-bugs/qa-round-3/qa{1,2,3,4}-*.md.

## Backend / scrape (Fix-1) — 8 bugs

- B1 [P0] Scrape totally broken on prod: pod UID 100 vs NFS dir 1000:1000 mode 775 → PermissionError on every never-seen listing. Switched Dockerfile to explicit `useradd --uid 1000 --gid 1000`; added securityContext + chown initContainer to k8s/{api,celery-beat}-deployment.yaml. Celery worker manifest lives outside this repo — Dockerfile UID change is the load-bearing fix.
- B4 [P1] Celery broker reaped every ~30s by Redis HAProxy idle timeout. Added `broker_transport_options` / `result_backend_transport_options` with `socket_keepalive=True, health_check_interval=25` in celery_app.py + same kwargs on every redis.from_url/Redis call across services/, utils/redis_lock.py, redis_repository.py.
- B5 [P1] dump_listings_task never published terminal FAILURE to the task_progress pub/sub channel — UI polled forever. Wrap body in try/except that publishes FAILURE before re-raising.
- B6 [P1] _process_worker had no per-listing exception handler — one bad listing killed the whole scrape via asyncio.gather. Wrap loop body in try/except Exception (re-raises CancelledError).
- B20 [P2] dump_listings_task gained time_limit=3600, soft_time_limit=3500, acks_late=True.
- B21 [P2] RedisRepository moved off shared db0 (was alongside paperless-ngx) to db3 via REDIS_USER_DB env var; keys prefixed `wrongmove:user:`.
- B32 [P3] redis_lock now uses uuid4() owner token + Lua compare-and-delete.
- B33 [P3] Slack notify in refresh_listings → asyncio.create_task (fire-and-forget).

## Frontend filter system (Fix-2) — 7 bugs

- B2 [P0] BUY tab click triggered "Maximum update depth exceeded" → ErrorBoundary. Replaced the three mutually-triggering useEffects in FilterBar with a single one-way controlled-value flow (URL → parent state → form), guarded by previousListingTypeRef so price-defaults fires once per real transition.
- B3 [P0] Filter values never reached the URL. Wired useFilterParams.setFilterValues into FilterBar/FilterPanel onSubmit + handleRemoveChip + new handleResetAllFilters; fed parsed filterValues into both forms' defaultValues; added URL→form sync via form.reset on browser back/forward.
- B8 [P1] Chip removal now resets form state via new FilterBar onFormReady callback — More badge no longer sticks.
- B12 [P2] Desktop swipe-review FAB added next to header (mobile FAB unchanged).
- B17 [P2] "Reset all" affordance on chip strip.
- B22 [P2] formatPrice precision: 1500 → £1.5k, 2500 → £2.5k (no longer collides with £2k/£3k defaults).
- B30 [P3] last_seen_days input gained min={0}.

## Frontend render hygiene + data integrity (Fix-3) — 8 bugs

- B7 [P1] streamingService bails on first non-NDJSON chunk (HTML response = backend down) and throws StreamParseError so the existing AlertError dialog surfaces a single user-visible error instead of 18× console.error spam.
- B9 [P1] formatDuration widened to (null|undefined|number): returns "—" for non-finite or negative, caps implausibly large values.
- B10 [P1] PropertyCard / PropertyCardCompact / SwipeCard JSX leaves render "—" for null total_price/qm/qmprice (was "£0/0 m²/£0/m²" — looked like free listings).
- B13 [P2] hexgrid worker reduceAverage uses Number.isFinite filter instead of !isNaN (which incorrectly accepted null → 0, biasing per-hex averages low).
- B14 [P2] ListingDetail Overview wraps agency in "Listed by" labelled block so it can't collapse to a bare agency name.
- B15 [P2] Compact POIDistanceBadges iterates all three travel modes with "—" for missing, matching the detail-sheet Travel table.
- B24 [P3] Drawer.Description (sr-only) added to ListingDetailSheet + MobileBottomSheet to silence Radix a11y warning.
- B25 [P3] lastSeenDays clamped to ≥0 so future timestamps don't render as "-7d ago".

## Frontend map / carousel / tasks polish (Fix-4) — 8 bugs

- B11 [P2] HexgridHeatmapClient destroy race: Map.tsx adds .catch() + ref guard so post-destroy promise rejections are silent no-ops. Verified by browser smoke (24 rapid Map↔List toggles → 0 pageErrors).
- B16 [P2] PhotoCarousel + inner CardCarousel gained keyboard nav (Arrow keys).
- B18 [P2] Default map center moved from Czech Republic to London (zoom 10).
- B19+B29 [P2/P3] Mapbox token: no longer hard-coded fallback; reads env-only and shows a clear "Map unavailable — set VITE_MAPBOX_TOKEN" banner when missing.
- B23 [P3] PhotoCarousel suppresses "1/1" counter for single-photo listings; added onError fallback for broken URLs.
- B26 [P3] PhotoCarousel only enables loop when photos.length > 1.
- B27 [P3] TaskIndicator cancel/clear-all buttons gained aria-label + data-testid.
- B28 [P3] useTaskProgress strips terminal-local task IDs from the polling union — no more forever-poll on completed tasks.

## Tests

74 new vitest tests + 18 new pytest tests. Local: tsc clean, 201 vitest tests pass, 633 pytest tests pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/services/__tests__/streamingService.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { mockUser, createMockFeature } from '@/__tests__/helpers';
-import { streamListingGeoJSON } from '@/services/streamingService';
+import { streamListingGeoJSON, StreamParseError } from '@/services/streamingService';
 import { ApiError } from '@/types';
 import type { ParameterValues } from '@/components/FilterPanel';
 
@@ -211,4 +211,46 @@ describe('streamingService', () => {
       for await (const _ of streamListingGeoJSON(mockUser(), defaultParams)) { /* drain */ }
     }).rejects.toThrow('No response body');
   });
+
+  // B7 regression: HTML response (e.g. proxy SPA fallback when backend is down)
+  // should bail on the first parse error instead of looping 18× per stream.
+  it('throws StreamParseError on the first unparseable line when nothing has parsed yet', async () => {
+    const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const htmlLines = [
+      '<!doctype html>',
+      '<html>',
+      '  <head><title>App</title></head>',
+      '  <body><div id="root"></div></body>',
+      '</html>',
+    ];
+    globalThis.fetch = vi.fn().mockResolvedValue(createMockResponse(htmlLines));
+
+    let caught: unknown = null;
+    try {
+      for await (const _ of streamListingGeoJSON(mockUser(), defaultParams)) { /* drain */ }
+    } catch (e) {
+      caught = e;
+    }
+
+    expect(caught).toBeInstanceOf(StreamParseError);
+    // Critical: no console.error spam — bail immediately on first failure.
+    expect(consoleSpy).not.toHaveBeenCalled();
+    consoleSpy.mockRestore();
+  });
+
+  it('StreamParseError captures a snippet of the offending input', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(
+      createMockResponse(['<!doctype html><html><head>...</head>']),
+    );
+
+    let caught: StreamParseError | null = null;
+    try {
+      for await (const _ of streamListingGeoJSON(mockUser(), defaultParams)) { /* drain */ }
+    } catch (e) {
+      caught = e as StreamParseError;
+    }
+
+    expect(caught).toBeInstanceOf(StreamParseError);
+    expect(caught?.snippet).toContain('<!doctype html>');
+  });
 });

frontend/src/services/index.ts

@@ -1,7 +1,7 @@
 // Re-export all services
 export { apiRequest } from './apiClient';
 export { fetchListingGeoJSON, refreshListings } from './listingService';
-export { streamListingGeoJSON, type StreamingProgress } from './streamingService';
+export { streamListingGeoJSON, StreamParseError, type StreamingProgress } from './streamingService';
 export { fetchTasksForUser, fetchTaskStatus, cancelTask, clearAllTasks, type CancelTaskResponse, type ClearAllTasksResponse } from './taskService';
 export { checkBackendHealth, type HealthStatus, type HealthCheckResult } from './healthService';
 export { fetchUserPOIs, createPOI, updatePOI, deletePOI, triggerPOICalculation, fetchPOIDistances, fetchBulkPOIDistances } from './poiService';

frontend/src/services/streamingService.ts

@@ -8,6 +8,22 @@ import { API_ENDPOINTS } from '@/constants';
 import { fireUnauthorized } from './apiClient';
 import { record as recordPerf } from './perfCollector';
 
+/**
+ * Thrown when the stream endpoint returns a response that isn't NDJSON (e.g. HTML
+ * because the backend is down and a proxy served the SPA fallback, or an auth
+ * redirect). Surfacing this as a typed error lets `loadListings` show a single
+ * user-visible error dialog instead of dribbling out one console.error per line.
+ */
+export class StreamParseError extends Error {
+  constructor(public readonly snippet: string) {
+    super(
+      `Server returned non-streaming response (expected NDJSON). ` +
+        `First bytes: ${snippet.slice(0, 80)}${snippet.length > 80 ? '…' : ''}`,
+    );
+    this.name = 'StreamParseError';
+  }
+}
+
 /**
  * Build query string from parameters object
  */
@@ -102,6 +118,11 @@ export async function* streamListingGeoJSON(
   let totalCount = 0;
   let streamStart = performance.now();
   let firstBatchRecorded = false;
+  // Track whether we've successfully parsed at least one NDJSON message. If the
+  // very first non-empty line fails to parse, the server almost certainly returned
+  // HTML (proxy SPA fallback, login redirect, etc) — bail with a typed error
+  // instead of spamming console for every line.
+  let parsedAny = false;
 
   while (true) {
     if (options?.signal?.aborted) {
@@ -120,6 +141,7 @@ export async function* streamListingGeoJSON(
 
       try {
         const message: StreamMessage = JSON.parse(line);
+        parsedAny = true;
 
         if (message.type === 'metadata') {
           onProgress?.({ count: 0, total: message.total_expected });
@@ -135,6 +157,15 @@ export async function* streamListingGeoJSON(
           onProgress?.({ count: message.total ?? totalCount, total: message.total });
         }
       } catch (e) {
+        if (!parsedAny) {
+          // First line was unparseable — assume the entire response is non-NDJSON
+          // (e.g. HTML). Cancel the reader so we stop consuming the body and
+          // surface a typed error to the caller.
+          await reader.cancel().catch(() => {});
+          throw new StreamParseError(line);
+        }
+        // A mid-stream parse hiccup after we've already received valid messages
+        // — log and continue (matches the prior tolerant behaviour).
         console.error('Failed to parse streaming message:', e);
       }
     }
@@ -144,10 +175,14 @@ export async function* streamListingGeoJSON(
   if (buffer.trim()) {
     try {
       const message: StreamMessage = JSON.parse(buffer);
+      parsedAny = true;
       if (message.type === 'batch' && message.features) {
         yield message.features;
       }
     } catch (e) {
+      if (!parsedAny) {
+        throw new StreamParseError(buffer);
+      }
       console.error('Failed to parse final streaming message:', e);
     }
   }