@reddoorla/maintenance 0.94.0 → 0.95.0

package/dist/chunk-6VKYQATC.js

@@ -0,0 +1,1708 @@
+import {
+  PRETTIER_FLAG_NOTE,
+  formatWithPrettier,
+  resolveTargetPrettier
+} from "./chunk-R53VL3RI.js";
+import {
+  withRecipe
+} from "./chunk-ZQV7UQNE.js";
+import {
+  defaultSpawn
+} from "./chunk-LBYOLBW7.js";
+import {
+  ignoreRulesFor,
+  pathsMissingFromHead
+} from "./chunk-AVEQUR44.js";
+
+// src/recipes/match-harness/index.ts
+import { mkdir, readFile, rm, rmdir, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+
+// src/recipes/match-harness/template.ts
+var HARNESS_MJS_RELATIVE = "matching/harness.mjs";
+var HARNESS_MJS_TEMPLATE = `// The single source for everything the matching gates need to know about this
+// site. DATA lives in matching/harness.json (site-edited); this file is the
+// READ LAYER \u2014 edit harness.json, not this. (It is installed and upgraded by
+// the \`reddoor-maint match-harness\` recipe, which owns these bytes: a hand
+// edit here is flagged on the next run and never silently overwritten.)
+//
+// It exists because the page table, the two hosts, the matrix, the threshold
+// and the skill path were hand-copied all over matching/. Re-measured
+// 2026-09-09 AFTER the six-probe conversion, over the 216 tracked scripts under
+// matching/ (214 top-level \u2014 212 .mjs + 2 .sh \u2014 plus 2 in states/):
+//
+//   \u2022 a hand-typed copy of the page table (three or more gate keys sitting next
+//     to their route): 8 files. Exactly ONE of them, probe-chrome-count.mjs,
+//     still carries all nine rows; probe-anchors.mjs carries five; the other
+//     six are three-row detail triples (team/svc/qa).
+//   \u2022 the skill path (~/.claude/skills/matching-a-page): 193 copies
+//   \u2022 the viewport matrix (1440/834/390): 51 copies
+//   \u2022 REF pointed at a host listed in selfHosts \u2014 i.e. comparing the candidate
+//     with itself: 12 scripts, one of which (probe-chrome-count.mjs) is also
+//     the last nine-row table carrier
+//
+// The first bullet read "the nine-row page table: 5 copies \u2014 gate.sh,
+// probe-anchor-parity.mjs, sweep-all10.sh, sweep-all16.sh, sweep-final.sh" when
+// it was written here at 922dde3. It was wrong within the hour and wrong on two
+// counts: 4e2cd7b took the table out of gate.sh, and the list never named
+// states/index.mjs or probe-chrome-count.mjs, which were both carrying nine-row
+// copies at the time. A census is a claim about code; it has to be measured
+// against the tree, not recalled.
+//
+//   node matching/harness.mjs --env        shell-safe KEY='value' lines
+//   node matching/harness.mjs --table      key<TAB>ref<TAB>cand<TAB>anchors
+//   node matching/harness.mjs --check-ref  the D11 preflight; exit 2 on failure
+import { readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// fileURLToPath, not URL#pathname: pathname is percent-encoded, so a checkout
+// under a directory with a space in it would resolve to a path that does not
+// exist.
+const DIR = fileURLToPath(new URL(".", import.meta.url));
+const CFG = JSON.parse(readFileSync(join(DIR, "harness.json"), "utf8"));
+
+// Env overrides exist for one-off probes only. They are NOT how a site is
+// configured \u2014 harness.json is, so that what a gate ran against is committed.
+export const REF = process.env.MATCH_REF ?? CFG.ref;
+export const CAND = process.env.MATCH_CAND ?? process.env.CAND_BASE ?? CFG.cand;
+export const MATRIX = CFG.matrix;
+export const THRESHOLD = CFG.threshold;
+export const MAX_HEIGHT_DELTA = CFG.maxHeightDelta;
+export const REF_MARK = CFG.refMark;
+export const CAND_MARK = CFG.candMark;
+export const SELF_HOSTS = CFG.selfHosts ?? [];
+
+/** One record per gated page, in harness.json order. \`key\` is the gate key
+ *  (out-<TAG>-<key>, the SPEC heading, spec-sections/<key>.md); \`uid\` is the
+ *  Prismic uid or null where the page has no /dev/match twin. */
+export const PAGES = Object.entries(CFG.pages).map(([key, p]) => ({ key, ...p }));
+export const byKey = Object.fromEntries(PAGES.map((p) => [p.key, p]));
+
+// DERIVED, never hand-typed: page-diff cuts one region before the first anchor
+// ("top") plus one per anchor, at every viewport. The old hand-written map went
+// stale the moment an anchor list changed, and a wrong denominator makes the
+// score a lie in the flattering direction.
+export const TOTALS = Object.fromEntries(
+  PAGES.map((p) => [p.key, (p.anchors.length + 1) * MATRIX.length]),
+);
+
+/** The SPEC.md heading predicate, shared by gate.sh's preflight and
+ *  build-spec.mjs so a section can never build fine and then refuse at the
+ *  gate. Matches the key followed by any non-key character (\`## team\` matches,
+ *  \`## teamfoo\` does not, \`## our-team\` cannot match \`team\`). */
+export const specHeadingRe = (key) => new RegExp(\`^##+ +\${key}([^A-Za-z0-9_-]|$)\`, "m");
+
+export const SKILL_DIR =
+  process.env.MATCHING_SKILL_DIR ?? join(homedir(), ".claude/skills/matching-a-page");
+export const PD = join(SKILL_DIR, "page-diff.mjs");
+export const SC = join(SKILL_DIR, "style-census.mjs");
+export const PLAYWRIGHT = pathToFileURL(join(SKILL_DIR, "node_modules/playwright/index.mjs")).href;
+
+/** The report format this site's scripts can read, so gate.sh can compare it
+ *  with \`page-diff --version\` before spending a run and next.mjs can refuse
+ *  rather than quietly drop a page whose newest report came from another
+ *  schema. Both do that now \u2014 gate.sh preflights \`page-diff --version\` against
+ *  this value before spending a run, and next.mjs counts a foreign-schema
+ *  report as MISSING rather than skipping it. (This said "neither does that
+ *  yet" \u2014 true at 922dde3 where it was written, false from 4e2cd7b, which
+ *  gave gate.sh the preflight and did not come back here.) Checked 2026-09-09
+ *  against the installed skill: \`page-diff --version\` \u2192 \`page-diff 0.1.0
+ *  report-schema 1\`. */
+export const REPORT_SCHEMA = 1;
+
+/**
+ * Fail-closed reference preflight. A 200 is NOT evidence: a host that has been
+ * repointed at our own build answers 200, and so does a staging host serving a
+ * 404 page. Both have happened on a real site \u2014 see the dated measurement in
+ * LEDGER.md. A pass here requires an artefact only the reference produces.
+ */
+export async function checkRef() {
+  if (!REF_MARK) {
+    return {
+      ok: false,
+      why: "harness.json refMark is empty \u2014 set it to a string only the reference serves (a Webflow site id, a build hash). A 200 is not evidence.",
+    };
+  }
+  const host = new URL(REF).host;
+  if (SELF_HOSTS.includes(host)) return { ok: false, why: \`REF host \${host} is in selfHosts\` };
+  if (host === new URL(CAND).host) return { ok: false, why: \`REF host \${host} equals CAND's host\` };
+  let res;
+  try {
+    res = await fetch(\`\${REF}/\`, { redirect: "manual" });
+  } catch (e) {
+    return { ok: false, why: \`GET \${REF}/ failed: \${e.message}\` };
+  }
+  if (res.status !== 200)
+    return { ok: false, why: \`GET \${REF}/ \u2192 HTTP \${res.status}, expected 200\` };
+  const loc = res.headers.get("location");
+  if (loc) return { ok: false, why: \`GET \${REF}/ \u2192 \${res.status} redirect to \${loc}\` };
+  const body = await res.text();
+  if (!body.includes(REF_MARK))
+    return {
+      ok: false,
+      why: \`\${REF}/ served 200 but WITHOUT refMark \${JSON.stringify(REF_MARK)} \u2014 that is not the reference\`,
+    };
+  if (CAND_MARK && body.includes(CAND_MARK))
+    return {
+      ok: false,
+      why: \`\${REF}/ contains candMark \${JSON.stringify(CAND_MARK)} \u2014 REF is serving OUR build\`,
+    };
+  return { ok: true, why: \`\${REF}/ \u2192 200, no redirect, refMark present, candMark absent\` };
+}
+
+// CLI. Both sides go through realpathSync. \`import.meta.url\` is ALREADY the
+// resolved real path (node resolves symlinks unless --preserve-symlinks) while
+// process.argv[1] is the path as typed, so a plain pathToFileURL compare goes
+// false the moment any component of the invoked path is a symlink \u2014 and then
+// the CLI prints nothing and exits 0, which every caller reads as success.
+// page-diff.mjs:184-189 records exactly that defect and the same fix: "The
+// pathToFileURL compare that replaced the old template string is still false
+// whenever ANY component of the invoked path is a symlink \u2014 which is how this
+// skill is installed now (~/.claude/skills/matching-a-page -> the claude-skills
+// checkout). isMain() resolves the real path on both sides."
+const isMain = () => {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+};
+
+if (isMain()) {
+  const mode = process.argv[2];
+  const q = (v) => \`'\${String(v).replace(/'/g, \`'\\\\''\`)}'\`;
+  if (mode === "--env") {
+    const pairs = [
+      ["REF", REF],
+      ["CAND", CAND],
+      ["MATRIX", MATRIX.join(",")],
+      ["VIEWPORTS_SP", MATRIX.join(" ")],
+      ["THRESHOLD", THRESHOLD],
+      ["MAX_HEIGHT_DELTA", MAX_HEIGHT_DELTA],
+      ["PD", PD],
+      ["SC", SC],
+      ["REPORT_SCHEMA", REPORT_SCHEMA],
+    ];
+    for (const [k, v] of pairs) console.log(\`\${k}=\${q(v)}\`);
+  } else if (mode === "--table") {
+    for (const p of PAGES) console.log([p.key, p.ref, p.cand, p.anchors.join(",")].join("\\t"));
+  } else if (mode === "--check-ref") {
+    const r = await checkRef();
+    console.log(\`\${r.ok ? "REF OK" : "REF REFUSED"} \u2014 \${r.why}\`);
+    process.exit(r.ok ? 0 : 2);
+  } else {
+    console.error("usage: harness.mjs --env | --table | --check-ref");
+    process.exit(2);
+  }
+}
+`;
+var GATE_SH_RELATIVE = "matching/gate.sh";
+var GATE_SH_TEMPLATE = `#!/usr/bin/env bash
+# The matching gate. This file is generic \u2014 everything specific to a site lives
+# in matching/harness.json (the data) and matching/LEDGER.md (the why). It is
+# installed and upgraded by the \`reddoor-maint match-harness\` recipe, which
+# owns these bytes: a hand edit here is flagged on the next run, never
+# silently overwritten.
+#
+#   bash matching/gate.sh <round-tag> [page ...]
+#
+# Runs page-diff for every page in the table (or just the named ones) at the
+# full breakpoint matrix and writes matching/out-<round-tag>-<page>/.
+#
+# The matrix, the anchor lists, the reference and the candidate are DATA. Why a
+# site chose them \u2014 which live breakpoint band hid what, why an anchor is a
+# heading and not a button label \u2014 belongs in matching/LEDGER.md, which is dated
+# and append-only, because JSON holds no comments.
+#
+# NO MASKS and the threshold from harness.json everywhere: the numbers stay
+# honest and a known floor stays visible as its own region. A media-neutralised
+# secondary read is \`node "$PD" ... --neutralize-media\`; next.mjs ignores such
+# runs on purpose (next.mjs:57-64).
+#
+# PREFLIGHT (see the matching rules in CLAUDE.md): a page with no section in
+# matching/SPEC.md has not had Phase 1 done, and its geometry must not be
+# touched. Skipping the spec is how a reference's root-font ladder and its
+# per-component height ladders get found reactively, after the region has
+# already failed several rounds. This refuses the run instead of trusting anyone
+# to remember.
+set -u
+# Everything configurable lives in matching/harness.json; harness.mjs is the one
+# reader. --env emits shell-safe assignments (REF, CAND, MATRIX, VIEWPORTS_SP,
+# THRESHOLD, MAX_HEIGHT_DELTA, PD, SC, REPORT_SCHEMA).
+eval "$(node "$(dirname "$0")/harness.mjs" --env)"
+
+# The skill must be able to write reports this site's scripts can read. Cheap,
+# local, and it fails before any browser starts.
+PD_SCHEMA="$(node "$PD" --version 2>/dev/null | awk '{print $4}')"
+if [ "$PD_SCHEMA" != "$REPORT_SCHEMA" ]; then
+  echo "gate.sh: page-diff writes report schema '\${PD_SCHEMA:-none}', this harness reads $REPORT_SCHEMA." >&2
+  echo "         Update matching/harness.mjs REPORT_SCHEMA or the matching-a-page skill." >&2
+  exit 2
+fi
+SPEC="$(dirname "$0")/SPEC.md"
+TAG="\${1:?usage: gate.sh <round-tag> [page ...]}"
+# The tag must not contain a hyphen. Output dirs are "out-<TAG>-<page>", and
+# next.mjs recovers the page with /^out-[^-]+-(.+)$/ \u2014 it splits on the FIRST
+# hyphen, so a tag like "r-forms-2026-08-07" yields the page key
+# "forms-2026-08-07-yfv" and that run is silently never counted. It cannot split
+# on the last hyphen instead, because page keys have hyphens of their own
+# ("our-team", "ask-the-doctor"). Failing here is the cheap end of that: a
+# mis-tagged round otherwise LOOKS green because next.mjs keeps reading an older
+# report for the page you just changed. (Cost this once, 2026-08-07.)
+case "$TAG" in
+  *-*)
+    echo "gate.sh: round tag must not contain a hyphen (got '$TAG')." >&2
+    echo "         out-<TAG>-<page> is parsed on the first hyphen, so a" >&2
+    echo "         hyphenated tag hides the run from next.mjs. Try '\${TAG//-/}'." >&2
+    exit 2
+    ;;
+esac
+shift || true
+WANT=("$@")
+
+# Fail closed on the reference before spending a single run. A 200 is NOT
+# evidence: a production host that has cut over to OUR build answers 200, and
+# every region then scores near zero against itself. --check-ref requires an
+# artefact only the reference serves (harness.json refMark) and refuses a
+# redirect, a host listed in selfHosts, and a body carrying candMark. Measured
+# on the site this harness was cut from, 2026-09-09 AFTER the consolidation:
+# 12 of its 214 top-level matching scripts still assign REF a host listed in
+# selfHosts \u2014 i.e. compare the candidate with itself. It was 33 of 229 before.
+# (This comment read "33 of its 230" while sitting in the post-consolidation
+# tree, contradicting harness.mjs's 12 three files away.)
+if ! node "$(dirname "$0")/harness.mjs" --check-ref; then
+  echo "gate.sh: refusing to gate against an unverified reference." >&2
+  exit 2
+fi
+
+# Set SPEC_OPTIONAL=1 only for a read-only baseline sweep of pages you are not
+# about to edit. It is recorded in the round tag so the exemption is visible.
+SPEC_OPTIONAL="\${SPEC_OPTIONAL:-0}"
+
+has_spec() { # page
+  # NB: the obvious \`( |$|\\b)\` guard is rejected by ugrep as an empty
+  # subexpression, and a preflight that errors out fails CLOSED \u2014 it refused all
+  # 9 pages while SPEC.md was complete. Match the page key followed by any
+  # non-key character (so \`## team\` matches but \`## teamfoo\` does not; \`##
+  # our-team\` cannot match \`team\` because the key must follow the spaces).
+  [ -f "$SPEC" ] && grep -qE "^##+ +$1([^A-Za-z0-9_-]|$)" "$SPEC"
+}
+
+run() { # tag refpath candpath sections
+  local page="$1" refpath="$2" candpath="$3" sections="$4"
+  if [ \${#WANT[@]} -gt 0 ]; then
+    local hit=0
+    for w in "\${WANT[@]}"; do [ "$w" = "$page" ] && hit=1; done
+    [ $hit -eq 1 ] || return 0
+  fi
+  if ! has_spec "$page"; then
+    if [ "$SPEC_OPTIONAL" = "1" ]; then
+      echo "########## $page ##########"
+      echo "WARNING: no '## $page' section in matching/SPEC.md \u2014 Phase 1 not done."
+      echo "         Running anyway because SPEC_OPTIONAL=1 (baseline read only)."
+      echo "         Do NOT apply geometry fixes off this run."
+    else
+      echo "########## $page ##########"
+      echo "REFUSED: no '## $page' section in matching/SPEC.md."
+      echo "         Phase 1 (section census + per-section spec, read from"
+      echo "         matching/spec/) comes before geometry."
+      echo "         See CLAUDE.md rule 2. SPEC_OPTIONAL=1 for a baseline read."
+      FAILED_PREFLIGHT=1
+      return 0
+    fi
+  fi
+  echo "########## $page ##########"
+  node "$PD" --ref "$REF$refpath" --cand "$CAND$candpath" \\
+    --viewports "$MATRIX" --threshold "$THRESHOLD" \\
+    --sections "$sections" --out "matching/out-$TAG-$page" \\
+    > "matching/out-$TAG-$page.log" 2>&1
+  echo "$page exit=$?"
+}
+
+# The page table is matching/harness.json. Process substitution, NOT a pipe:
+# a pipe would run this loop in a subshell and FAILED_PREFLIGHT would not
+# survive to the check below, so a refused page would exit 0.
+while IFS=$'\\t' read -r key refpath candpath anchors; do
+  run "$key" "$refpath" "$candpath" "$anchors"
+done < <(node "$(dirname "$0")/harness.mjs" --table)
+
+if [ "\${FAILED_PREFLIGHT:-0}" = "1" ]; then
+  echo
+  echo "GATE INCOMPLETE ($TAG) \u2014 one or more pages were refused for a missing"
+  echo "SPEC.md section. Those pages have NOT been measured; do not report a"
+  echo "score for them."
+  exit 2
+fi
+echo "ALL DONE ($TAG)"
+`;
+var CENSUS_SH_RELATIVE = "matching/census.sh";
+var CENSUS_SH_TEMPLATE = `#!/usr/bin/env bash
+# Phase 3 style gate \u2014 the mechanical net for the type spec.
+#
+#   bash matching/census.sh            # all 9 pages, all 3 viewports
+#   bash matching/census.sh home yfv   # just these
+#
+# style-census diffs the computed type tuple (family, weight, size,
+# line-height, letter-spacing, transform, colour) of every text snippet present
+# on BOTH pages. It is the only gate that catches the 11px footer line and the
+# cyan-vs-teal link that page-diff is structurally blind to \u2014 a region can be
+# pixel-clean at 0.10 and still be wearing the wrong colour on small text.
+#
+# Prints a per-page/per-viewport mismatch count and leaves the full runs in
+# matching/census-<page>-<vw>.log. Exits 1 while any count is non-zero, and 2
+# when it cannot honestly report a count at all.
+#
+# EVIDENCE \u2014 read before adding a guard here, or removing one. A green here
+# has to be produced by a census that RAN. It was not: with style-census.mjs
+# absent this gate printed "Phase 3 CLEAN \u2014 0 undeclared type mismatches" and
+# exited 0. Every run died on module resolution, census-count.mjs read each
+# crash log as "0 0 0" (it counts \`  y=\` rows and a stack trace has none \u2014
+# census-count.mjs:35-56), and no rows was reported as no mismatches. Measured
+# again with style-census.mjs PRESENT and the candidate host down: identical
+# output, because style-census exits 1 both when it finds mismatches
+# (style-census.mjs:187) and when it dies before it looks \u2014 so the exit status
+# cannot tell a finding from a crash and may not grant a green either.
+#
+# The guards below are what next.mjs:83-89 (no parseable gate run \u2014 refusing to
+# report a score), strikes.mjs:87-97 (refusing to report "clear") and
+# gate.sh:37-42 (preflight page-diff before spending a run) already do. Each
+# demands an artefact only a working census produces; none of them can turn a
+# red green.
+set -uo pipefail
+# Resolved BEFORE the cd. $0 is the path as TYPED, so a relatively invoked
+# census.sh that resolved the harness afterwards would look for it under
+# whatever root the cd landed on.
+HARNESS="$(cd "$(dirname "$0")" && pwd)/harness.mjs"
+cd "$(dirname "$0")/.."
+
+# Everything configurable lives in matching/harness.json; harness.mjs is the one
+# reader. --env supplies REF, CAND, SC and VIEWPORTS_SP \u2014 this gate held its own
+# copy of all four, and its REF went stale when production cut over to our own
+# build (LEDGER "REFERENCE MOVED", verified 2026-08-10) while gate.sh's was
+# repointed the same day.
+eval "$(node "$HARNESS" --env)"
+NODE="\${NODE:-node}"
+
+# The matrix is DATA, read as VIEWPORTS_SP, the way gate.sh reads MATRIX. The
+# old VIEWPORTS override is retired rather than silently ignored: a census run
+# over a matrix harness.json does not name is a column set the pixel gate never
+# measured, and it would look exactly like a clean one.
+if [ -n "\${VIEWPORTS:-}" ]; then
+  echo "census.sh: the VIEWPORTS override is retired \u2014 the matrix is data now." >&2
+  echo "           Edit \\"matrix\\" in matching/harness.json, then unset it." >&2
+  exit 2
+fi
+
+# GUARD 1 \u2014 the tool is there and it starts. gate.sh compares \`page-diff
+# --version\` with the harness's REPORT_SCHEMA before spending a run
+# (gate.sh:37-42); style-census has no --version to compare (page-diff.mjs
+# defines one at 191-195; nothing in style-census.mjs writes one), so the
+# artefact demanded here is the other one only it produces: the usage banner it
+# prints on exit 2 when --ref/--cand are missing (style-census.mjs:151-157).
+# That banner is not free \u2014 \`import { chromium } from "playwright"\` runs first
+# (style-census.mjs:19) \u2014 so a skill directory with no playwright installed
+# fails HERE, once, instead of writing one crash log per page per viewport that
+# every reader downstream counts as zero.
+if [ ! -f "$SC" ]; then
+  echo "census.sh: no style-census at $SC \u2014 refusing to report a count." >&2
+  echo "           Install the matching-a-page skill, or point MATCHING_SKILL_DIR" >&2
+  echo "           at a checkout that has style-census.mjs." >&2
+  exit 2
+fi
+SC_USAGE="$("$NODE" "$SC" 2>&1)"
+case "$SC_USAGE" in
+  *"style-census"*"--ref"*"--cand"*"--vw"*) ;;
+  *)
+    echo "census.sh: $SC did not answer with a style-census --ref/--cand/--vw usage" >&2
+    echo "           banner \u2014 refusing to report a count. It printed:" >&2
+    echo "           \${SC_USAGE:-(nothing at all)}" >&2
+    exit 2
+    ;;
+esac
+
+declare -a WANT=("$@")
+
+# page -> "refpath candpath": the same table gate.sh drives, from the same file.
+# cut drops the anchors column, which the style census has no argument for
+# (style-census.mjs: --ref <url> --cand <url> [--vw 1440]).
+pages() { node "$HARNESS" --table | cut -f1-3; }
+
+TOTAL=0
+AMB=0
+DECL=0
+ROWS=0
+RUNS=0
+BROKEN=0
+SEEN=""
+# One column per viewport, from the matrix. Flush with the data rows below, at
+# last: the old header hardcoded four fixed fields separated by a literal space,
+# which the rows do not have, so its labels sat 1/2/3 columns right of them.
+printf '%-10s' page
+for vw in $VIEWPORTS_SP; do printf '%8s' "$vw"; done
+printf '\\n'
+while read -r page refpath candpath; do
+  [ -z "$page" ] && continue
+  SEEN="$SEEN $page"
+  if [ \${#WANT[@]} -gt 0 ]; then
+    hit=0
+    for w in "\${WANT[@]}"; do [ "$w" = "$page" ] && hit=1; done
+    [ $hit -eq 1 ] || continue
+  fi
+  ROWS=$((ROWS + 1))
+  line=$(printf '%-10s' "$page")
+  for vw in $VIEWPORTS_SP; do
+    log="matching/census-$page-$vw.log"
+    RUNS=$((RUNS + 1))
+    "$NODE" "$SC" --ref "$REF$refpath" --cand "$CAND$candpath" --vw "$vw" >"$log" 2>&1
+    # GUARD 2 \u2014 this run produced a census. The header and the counts line are
+    # written together at style-census.mjs:166-169 and only after both pages
+    # have been walked, so they are the artefact a completed run leaves and a
+    # crashed one cannot. The viewport is read back out of the header because a
+    # --vw that did not take would otherwise fill three differently named logs
+    # with the same 1440 census. \`ref runs\`/\`cand runs\` must be non-zero: two
+    # pages that rendered no text at all agree perfectly and mean nothing.
+    if ! grep -qE "^=== style census, viewport $vw ===\\$" "$log" ||
+      ! grep -qE "^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+\\$" "$log"; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: $page @$vw produced no usable census \u2014 see $log" >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    # census-count splits the log three ways: REAL mismatches, AMBIGUOUS
+    # same-text collisions (style-census's own split), and DECLARED rows the
+    # operator has already ruled on (matching/census-deviations.mjs, the same
+    # contract as floors.mjs). Only the first is outstanding work \u2014 without the
+    # third, this gate can never reach zero and its number means nothing.
+    read -r n a d <<<"$("$NODE" matching/census-count.mjs "$log")"
+    # GUARD 2b \u2014 three integers, or the counter did not count. census-count.mjs
+    # is the reader that turned a stack trace into "0 0 0"; a run of it that
+    # dies (a broken census-deviations.mjs, a bad path) prints nothing at all,
+    # and bash reads an empty $n as zero in the arithmetic below.
+    counted=1
+    for v in "\${n:-}" "\${a:-}" "\${d:-}"; do
+      case "$v" in "" | *[!0-9]*) counted=0 ;; esac
+    done
+    if [ "$counted" -eq 0 ]; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: census-count.mjs did not return three counts for $log" >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    # GUARD 2c \u2014 the number reported is the number the census MEASURED. GUARD 2
+    # matched the counts line for PRESENCE and threw its numbers away, so the
+    # count printed below came from census-count's row parse and nothing ever
+    # compared the two. Measured 2026-09-09: a COMPLETE census whose counts line
+    # said "mismatches: 3", whose \`y=\` rows carried one leading space instead of
+    # two (census-count.mjs:39 matches /^ {2}y=/), was reported as 0 and this
+    # gate printed "Phase 3 CLEAN \u2014 0 undeclared type mismatches", exit 0. The
+    # printer lives in the SKILL (style-census.mjs:171-173) and the parser is
+    # copied into every site, so the two version independently and drift needs
+    # nobody to touch either repo.
+    #
+    # The identity is exact for mismatches: style-census prints at most 100 rows
+    # and states the remainder on its own line (style-census.mjs:175-177), so
+    # parsed + remainder == reported. Ambiguous rows are capped the same way
+    # (:184) but the remainder is NOT stated, so only a floor is checkable
+    # there \u2014 any is not none, and the parse may never exceed the report.
+    counts=$(grep -E "^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+$" "$log" | tail -1)
+    said_m=\${counts##*mismatches: }
+    said_m=\${said_m%% *}
+    said_a=\${counts##*ambiguous: }
+    more=$(sed -n 's/^ *\u2026 and \\([0-9][0-9]*\\) more (truncated print, all counted)$/\\1/p' "$log" | tail -1)
+    if [ $((n + d + \${more:-0})) -ne "$said_m" ] ||
+      [ "$a" -gt "$said_a" ] ||
+      { [ "$said_a" -gt 0 ] && [ "$a" -eq 0 ]; }; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: $log reports mismatches: $said_m ambiguous: $said_a, but" >&2
+      echo "           census-count.mjs read $((n + d)) mismatch row(s)\${more:+ (+ $more truncated)} and $a ambiguous." >&2
+      echo "           The census and its reader disagree; there is no count to report." >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    AMB=$((AMB + a))
+    DECL=$((DECL + d))
+    TOTAL=$((TOTAL + n))
+    line="$line$(printf '%8s' "$n")"
+  done
+  echo "$line"
+done < <(pages)
+
+echo
+# GUARD 3 \u2014 something was actually censused. Process substitution above, NOT a
+# pipe: a pipe runs the loop in a subshell and every counter here would still
+# read 0, which is exactly the green this file exists to stop (gate.sh:123-125
+# records the same trap for FAILED_PREFLIGHT). A page name that matches nothing
+# must not report CLEAN either \u2014 strikes.mjs:147-156 is the same refusal, and
+# it was written because a typo silently greened rule 3 on six of nine pages.
+if [ "$ROWS" -eq 0 ]; then
+  if [ -n "$SEEN" ]; then
+    echo "census.sh: \\"\${WANT[*]:-}\\" matches no page \u2014 refusing to report CLEAN." >&2
+    echo "           known pages:$SEEN" >&2
+  else
+    echo "census.sh: the page table is empty \u2014 refusing to report CLEAN." >&2
+    echo "           node matching/harness.mjs --table printed no rows; check" >&2
+    echo "           \\"pages\\" in matching/harness.json." >&2
+  fi
+  exit 2
+fi
+if [ "$BROKEN" -gt 0 ]; then
+  echo "CENSUS INCOMPLETE \u2014 $BROKEN of $RUNS run(s) produced no usable census (marked !!)."
+  echo "Those page/viewport pairs have NOT been measured; there is no count to"
+  echo "report for them, and the totals below would be a floor, not a score."
+  echo "Full runs: matching/census-<page>-<vw>.log"
+  exit 2
+fi
+if [ "$TOTAL" -eq 0 ]; then
+  echo "Phase 3 CLEAN \u2014 0 undeclared type mismatches ($DECL declared, $AMB ambiguous)."
+  echo "($RUNS censused run(s) over $ROWS page(s), each one counted.)"
+  [ "$AMB" -gt 0 ] && echo "($AMB ambiguous same-text rows remain: each needs ADJUDICATING," &&
+    echo " not fixing \u2014 our element matches, another sharing its text does not.)"
+  exit 0
+fi
+echo "$TOTAL type mismatch(es) remain (+ $AMB ambiguous, $DECL declared)."
+echo "Full runs: matching/census-<page>-<vw>.log"
+echo "A mismatch is a defect or a ledgered deviation. An ambiguous row is neither"
+echo "until you look: the census keys on TEXT, so two different elements sharing a"
+echo "string land under one key and only one of them may be wrong."
+exit 1
+`;
+var NEXT_MJS_RELATIVE = "matching/next.mjs";
+var NEXT_MJS_TEMPLATE = `// What is still broken, ranked. Exits 1 while work remains.
+//
+//   node matching/next.mjs
+//
+// Round protocol step 0 (repo CLAUDE.md rule 5). A commit is a CHECKPOINT, not
+// a stopping point: after committing, run this. If it exits 1 there is a named
+// next action and the round continues without handing control back.
+//
+// Reads the most recent gate log per page rather than the whole corpus, so it
+// reflects HEAD rather than history (that is strikes.mjs's job).
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+const DIR = new URL(".", import.meta.url).pathname;
+
+// PAUSE SWITCH. While matching/PAUSED exists this hands out no agenda and
+// exits 0. It is deliberately the FIRST thing that runs: no report is read, no
+// score is printed, nothing tempting is put on screen to argue with.
+//
+// Why an exit code and not a note somewhere: rule 5 is a LOOP \u2014 "after
+// committing, run next.mjs; while it exits 1 there is a named next action and
+// the round continues". A pause written as prose loses to that loop, because
+// the loop is mechanical and the prose is not. Exiting 0 satisfies rule 5
+// truthfully rather than suspending it: there is no next action.
+const PAUSE = join(DIR, "PAUSED");
+if (existsSync(PAUSE)) {
+  console.log("MATCHING PAUSED \u2014 no agenda, and none is to be inferred.\\n");
+  console.log(readFileSync(PAUSE, "utf8").trimEnd());
+  process.exit(0);
+}
+
+import { FLOORS, ACCEPTED } from "./floors.mjs";
+import { TOTALS, THRESHOLD, MAX_HEIGHT_DELTA, REPORT_SCHEMA } from "./harness.mjs";
+
+// Reports written by a different page-diff, by page key. Kept rather than
+// dropped: silently ignoring them is how a page vanishes from the score.
+const schemaMismatch = new Set();
+
+const latest = new Map();
+for (const d of readdirSync(DIR).filter((d) => d.startsWith("out-"))) {
+  const m = /^out-[^-]+-(.+)$/.exec(d);
+  if (!m || !TOTALS[m[1]]) continue;
+  let report, mtime;
+  try {
+    const p = join(DIR, d, "report.json");
+    report = JSON.parse(readFileSync(p, "utf8"));
+    mtime = statSync(p).mtimeMs;
+  } catch {
+    continue;
+  }
+  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the
+  // page. Picking one up as "latest" silently reports scores nobody can ship \u2014
+  // it happened immediately: an --mask-photos probe of yfv made \`top\` @834 read
+  // 43.9% here while the real gate had it passing at 1.3%.
+  const meta = report.meta ?? {};
+  // Missing schemaVersion means "written before the field existed" = 0. It is
+  // not an error on its own; it is only fatal when it would blank a page.
+  if ((meta.schemaVersion ?? 0) !== REPORT_SCHEMA) {
+    schemaMismatch.add(m[1]);
+    continue;
+  }
+  if (
+    (meta.mask?.length ?? 0) > 0 ||
+    meta.neutralizeMedia ||
+    meta.maskPhotos ||
+    meta.truncated
+  )
+    continue;
+  if (meta.threshold !== THRESHOLD) continue;
+  const prev = latest.get(m[1]);
+  if (!prev || mtime > prev.mtime) latest.set(m[1], { dir: d, mtime, report });
+}
+
+const blanked = [...schemaMismatch].filter((p) => !latest.has(p));
+if (blanked.length) {
+  console.error(
+    \`next: \${blanked.length} page(s) have no run at report schema \${REPORT_SCHEMA} \u2014 \` +
+      \`their newest reports came from a different page-diff (\${blanked.sort().join(", ")}).\\n\` +
+      \`      Re-run: bash matching/gate.sh <tag> \${blanked.sort().join(" ")}\`,
+  );
+  process.exit(2);
+}
+if (latest.size === 0) {
+  console.error(
+    "next: no parseable gate run under matching/ \u2014 refusing to report a score.\\n" +
+      "      Run bash matching/gate.sh <tag> first.",
+  );
+  process.exit(2);
+}
+
+const rows = [];
+const accepted = [];
+let openTotal = 0;
+let floorTotal = 0;
+for (const [page, { dir, report }] of latest) {
+  const fails = report.regions.filter((r) => !r.pass);
+  for (const f of fails) {
+    const floor = FLOORS.find((fl) => fl.match(f, page));
+    if (floor) {
+      floorTotal++;
+      continue;
+    }
+    const ack = ACCEPTED.find((a) => a.match(f, page));
+    if (ack) {
+      accepted.push({ page, vw: f.viewport, label: f.label, why: ack.why });
+      continue;
+    }
+    openTotal++;
+    rows.push({
+      page,
+      vw: f.viewport,
+      label: f.label,
+      mm: f.mismatchFraction,
+      dh: f.heightDeltaFraction ?? 0,
+      dir,
+    });
+  }
+}
+
+const scored = [...latest.entries()]
+  .map(([p, v]) => ({
+    p,
+    pass: v.report.regions.filter((r) => r.pass).length,
+    total: TOTALS[p],
+  }))
+  .sort((a, b) => a.pass / a.total - b.pass / b.total);
+
+const sum = scored.reduce((a, s) => a + s.pass, 0);
+const max = scored.reduce((a, s) => a + s.total, 0);
+console.log(\`SCORE \${sum}/\${max} regions passing\\n\`);
+console.log(
+  scored
+    .map((s) => \`  \${s.p.padEnd(9)} \${String(s.pass).padStart(2)}/\${s.total}\`)
+    .join("\\n"),
+);
+
+if (accepted.length) {
+  console.log(\`\\nOperator-ACCEPTED failures (left failing on purpose):\`);
+  for (const a of accepted)
+    console.log(\`  \${a.page} @\${a.vw} "\${a.label}" \u2014 \${a.why.slice(0, 96)}\u2026\`);
+}
+
+if (!rows.length) {
+  console.log(
+    \`\\nNo open geometry failures. \${floorTotal} declared floor(s) remain.\`,
+  );
+  console.log(
+    "Backlog is empty \u2014 Phases 5 (states) and 6 (adversarial review) are what is left.",
+  );
+  process.exit(0);
+}
+
+// Worst page first, then worst region inside it: fix where the model is most wrong.
+const worst = scored[0].p;
+rows.sort(
+  (a, b) =>
+    (a.page === worst ? -1 : 0) - (b.page === worst ? -1 : 0) || b.mm - a.mm,
+);
+
+console.log(
+  \`\\n\${openTotal} open failure(s) + \${floorTotal} declared floor(s).\`,
+);
+console.log(\`\\nNEXT: \${worst} \u2014 worst page. Its open regions:\\n\`);
+for (const r of rows.filter((r) => r.page === worst)) {
+  const why = [];
+  if (r.mm > THRESHOLD) why.push(\`pixels \${(r.mm * 100).toFixed(1)}%\`);
+  if (Math.abs(r.dh) > MAX_HEIGHT_DELTA)
+    why.push(\`height \${(r.dh * 100).toFixed(1)}%\`);
+  console.log(
+    \`  @\${String(r.vw).padEnd(5)} \${r.label.slice(0, 44).padEnd(45)} \${why.join(" + ")}\`,
+  );
+}
+console.log(\`\\nBefore treating any of these as geometry:\`);
+console.log(
+  \`  node matching/probe-anchor-parity.mjs \${worst}   # is the gate cutting comparably?\`,
+);
+console.log(
+  \`  node matching/strikes.mjs \${worst}               # has it stalled? then change the MODEL\`,
+);
+console.log(
+  \`\\nRound continues. Do not hand back control with work outstanding.\`,
+);
+process.exit(1);
+`;
+var STRIKES_MJS_RELATIVE = "matching/strikes.mjs";
+var STRIKES_MJS_TEMPLATE = `// The 3-strike rule, made countable.
+//
+//   node matching/strikes.mjs [page]
+//
+// The matching skill says: "A region that has not improved after 3 fix ->
+// re-run cycles: stop. Present the three attempts. Do not widen the threshold,
+// mask it, or reclassify it \u2014 a stuck region means your model of it is wrong."
+//
+// That rule was blown twice on this project (services \`top\`, yfv \`top\`) purely
+// because nobody was counting. This reads every matching/out-*/report.json,
+// reconstructs each region's history in chronological order, and prints the
+// regions that are OUT OF STRIKES. Exit 1 when any exist, so a round that
+// starts by running this cannot quietly attempt a fourth cycle.
+//
+// WHAT THIS ACTUALLY MEASURES (read before trusting a number): report.json
+// cannot record INTENT, so a "cycle" here is any completed gate run in which
+// the region was still failing and did not improve by IMPROVE_PP. Runs aimed at
+// a different region on the same page therefore count too. That makes this a
+// STALL detector, not a literal attempt counter \u2014 "this has been failing,
+// unchanged, across N gate runs while you were working on this page." That is
+// the more useful discipline number anyway, and it is honest about being an
+// upper bound. Improvement resets the count: real progress earns a fresh start.
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { FLOORS } from "./floors.mjs";
+import {
+  PAGES,
+  THRESHOLD,
+  MAX_HEIGHT_DELTA,
+  REPORT_SCHEMA,
+} from "./harness.mjs";
+
+// PAUSE SWITCH \u2014 see matching/next.mjs for why this is an exit code. Round
+// protocol step 1 is "run strikes.mjs; the stalled regions are the agenda", so
+// this is the second door into the backlog and has to be shut too. Exits 0:
+// there are no strikes to spend when no round is being played.
+const PAUSED = join(new URL(".", import.meta.url).pathname, "PAUSED");
+if (existsSync(PAUSED)) {
+  console.log("MATCHING PAUSED \u2014 no agenda, and none is to be inferred.\\n");
+  console.log(readFileSync(PAUSED, "utf8").trimEnd());
+  process.exit(0);
+}
+
+const IMPROVE_PP = 0.01; // 1 percentage point = the smallest move worth calling progress
+const MAX_STRIKES = 3;
+const ROOT = new URL(".", import.meta.url).pathname;
+const only = process.argv[2] ?? null;
+
+// The gate key for a report, from its ref path. Deriving it by string surgery
+// disagreed with the gate on exactly six of the nine rows \u2014 yfv, contact, atd,
+// svc, qa and team (measured 2026-09-09 against harness.json); the table knows.
+// keyOf (below) stays as the fallback for a run whose ref was rewritten.
+const pageOf = (ref) => {
+  const path = new URL(ref).pathname.replace(/\\/$/, "") || "/";
+  return PAGES.find((p) => p.ref === path)?.key ?? null;
+};
+
+const runs = [];
+const unreadable = [];
+for (const dir of readdirSync(ROOT).filter((d) => d.startsWith("out-"))) {
+  let report;
+  try {
+    report = JSON.parse(readFileSync(join(ROOT, dir, "report.json"), "utf8"));
+  } catch {
+    continue; // not a completed run dir
+  }
+  if (!report.meta?.ref || !Array.isArray(report.regions)) continue;
+  // A report from another schema is still usable for a STALL count as long as
+  // it carries the two fields this reads. Anything else is counted and named,
+  // never silently dropped \u2014 an under-counted history reads as "clear".
+  const usable = report.regions.every(
+    (r) =>
+      typeof r.mismatchFraction === "number" && typeof r.pass === "boolean",
+  );
+  if (!usable) {
+    unreadable.push(\`\${dir} (schema \${report.meta.schemaVersion ?? 0})\`);
+    continue;
+  }
+  runs.push({
+    dir,
+    at: report.meta.generatedAt,
+    meta: report.meta,
+    regions: report.regions,
+  });
+}
+
+// The failure mode of a stall detector is always "clear", which is exactly the
+// answer that stops nobody. A corpus this could not read is not a clean one.
+if (runs.length === 0) {
+  console.error(
+    \`strikes: no parseable gate run under matching/ \u2014 refusing to report "clear".\` +
+      (unreadable.length
+        ? \`\\n         \${unreadable.length} report(s) unreadable at schema \${REPORT_SCHEMA}: \${unreadable.slice(0, 5).join(", ")}\`
+        : ""),
+  );
+  process.exit(2);
+}
+if (unreadable.length) {
+  console.error(
+    \`strikes: ignored \${unreadable.length} unreadable report(s) \u2014 the history below is incomplete.\` +
+      \`\\n         \${unreadable.slice(0, 5).join(", ")}\`,
+  );
+}
+
+runs.sort((a, b) => a.at.localeCompare(b.at));
+
+// The gate page KEY, recovered from the run dir the way next.mjs does it
+// (out-<TAG>-<page>, split on the first hyphen \u2014 the tag is hyphen-free by
+// gate.sh's own preflight). \`pageOf\` now returns that same key off the table,
+// so the two vocabularies agree and the round protocol in CLAUDE.md \u2014 "run
+// \`strikes.mjs <page>\` with the key you just passed to gate.sh", which until
+// 2026-08-13 silently matched nothing \u2014 works either way. This stays because
+// a dir key is not always a gate key: 69 of this corpus's 377 run dirs are
+// hand-named probes (out-band3, out-390masked), and FLOORS matches on it.
+const keyOf = (dir) => /^out-[^-]+-(.+)$/.exec(dir)?.[1] ?? null;
+
+// key -> chronological list of {dir, at, mm, pass, masked}
+const history = new Map();
+const seenNames = new Set();
+for (const run of runs) {
+  const page = pageOf(run.meta.ref) ?? keyOf(run.dir) ?? "unknown";
+  const gateKey = keyOf(run.dir);
+  seenNames.add(page);
+  if (gateKey) seenNames.add(gateKey);
+  if (only && page !== only && gateKey !== only) continue;
+  for (const r of run.regions) {
+    // A DECLARED FLOOR is flat by definition \u2014 reporting it as stalled is noise
+    // that hides a real stall. It stays in the LEDGER; it does not belong here.
+    if (FLOORS.some((fl) => fl.match(r, gateKey || page))) continue;
+    const key = \`\${page}|\${r.viewport}|\${r.label}\`;
+    if (!history.has(key)) history.set(key, []);
+    history.get(key).push({
+      dir: run.dir,
+      at: run.at,
+      mm: r.mismatchFraction,
+      dh: r.heightDeltaFraction,
+      pass: r.pass,
+      // a run with masks/neutralised media is not comparable to a clean one
+      dirty:
+        (run.meta.mask?.length ?? 0) > 0 ||
+        run.meta.neutralizeMedia ||
+        run.meta.maskPhotos,
+    });
+  }
+}
+
+// A name that matches no run must NOT report "clear". This check exists to stop
+// work on a stalled region, so failing open is the one thing it may never do \u2014
+// a typo'd or wrong-vocabulary page silently greened rule 3 for six of the nine
+// pages. Fail loud instead, and say what the vocabulary is.
+if (only && history.size === 0) {
+  console.error(
+    \`strikes: "\${only}" matches no gate run \u2014 refusing to report "clear".\\n\` +
+      \`         known pages: \${[...seenNames].sort().join(", ")}\`,
+  );
+  process.exit(2);
+}
+
+const stuck = [];
+for (const [key, all] of history) {
+  const h = all.filter((e) => !e.dirty); // compare like with like
+  if (h.length === 0) continue;
+  const last = h[h.length - 1];
+  if (last.pass) continue;
+
+  let best = Infinity;
+  let strikes = 0;
+  let sinceIdx = 0;
+  for (let i = 0; i < h.length; i++) {
+    if (h[i].mm < best - IMPROVE_PP) {
+      best = Math.min(best, h[i].mm);
+      strikes = 0;
+      sinceIdx = i;
+    } else {
+      best = Math.min(best, h[i].mm);
+      strikes++;
+    }
+  }
+  if (strikes >= MAX_STRIKES) stuck.push({ key, strikes, h, sinceIdx, last });
+}
+
+// Triage order: the worst-matching region that has never moved is the one whose
+// model is most wrong. Sorting by strike count instead would put a 0.3% region
+// that only fails on height above a 76% region that fails on everything.
+stuck.sort((a, b) => b.last.mm - a.last.mm);
+
+if (stuck.length === 0) {
+  console.log(
+    \`strikes: clear \u2014 no failing region has stalled for \${MAX_STRIKES}+ gate runs\` +
+      (only ? \` on \${only}\` : "") +
+      ".",
+  );
+  process.exit(0);
+}
+
+const why = (e) => {
+  const reasons = [];
+  if (e.mm > THRESHOLD) reasons.push(\`pixels \${(e.mm * 100).toFixed(1)}%\`);
+  if (Math.abs(e.dh ?? 0) > MAX_HEIGHT_DELTA)
+    reasons.push(\`height \${((e.dh ?? 0) * 100).toFixed(1)}%\`);
+  return reasons.join(" + ") || "marginal";
+};
+
+console.log(
+  \`STALLED \u2014 \${stuck.length} failing region(s) have not moved in \${MAX_STRIKES}+ gate runs.\\n\` +
+    \`These need a new model or the operator, not another attempt. Worst first:\\n\`,
+);
+for (const { key, strikes, h, sinceIdx, last } of stuck.slice(0, 20)) {
+  const [page, vw, label] = key.split("|");
+  console.log(
+    \`\${page} @\${vw}  "\${label}"  \u2014 \${why(last)}, flat across \${strikes} runs\`,
+  );
+  const window = h.slice(Math.max(0, sinceIdx));
+  const shown = window.length > 4 ? [window[0], ...window.slice(-3)] : window;
+  for (const [i, e] of shown.entries()) {
+    const gap =
+      window.length > 4 && i === 1
+        ? \`    ... \${window.length - 4} more ...\\n\`
+        : "";
+    console.log(
+      gap +
+        \`    \${(e.mm * 100).toFixed(1).padStart(5)}%  \${e.at.slice(0, 16).replace("T", " ")}  \${e.dir}\`,
+    );
+  }
+  console.log();
+}
+if (stuck.length > 20) console.log(\`... and \${stuck.length - 20} more.\\n\`);
+console.log(
+  "Per the matching skill: present the attempts to the operator.\\n" +
+    "Do NOT widen the threshold, add a mask, or reclassify them as a floor.",
+);
+process.exit(1);
+`;
+var BUILD_SPEC_MJS_RELATIVE = "matching/build-spec.mjs";
+var BUILD_SPEC_MJS_TEMPLATE = `// Assemble matching/SPEC.md from the per-page sections in spec-sections/.
+//
+//   node matching/build-spec.mjs
+//
+// SPEC.md is the Phase 1 deliverable and the thing matching/gate.sh preflights
+// against, so it is GENERATED rather than hand-maintained: edit the section
+// file, rebuild. The page list comes from matching/harness.mjs (the same
+// reader gate.sh's \`--table\` loop uses) and the heading test from its
+// specHeadingRe, whose pattern is has_spec's grep verbatim \u2014 so a section can
+// no longer build fine here and then re-block its own page at the gate.
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { PAGES, specHeadingRe } from "./harness.mjs";
+
+const DIR = new URL(".", import.meta.url).pathname;
+const SECTIONS = join(DIR, "spec-sections");
+
+// Order = live's nav order, then the detail templates. Both fall out of the
+// table's own order within each group, so this is not a second list to keep.
+const KEYS = [
+  ...PAGES.filter((p) => p.group === "nav"),
+  ...PAGES.filter((p) => p.group !== "nav"),
+].map((p) => p.spec ?? p.key);
+
+const parts = [];
+const missing = [];
+
+const chrome = join(SECTIONS, "_chrome.md");
+if (existsSync(chrome)) parts.push(readFileSync(chrome, "utf8").trim());
+else missing.push("_chrome");
+
+for (const page of KEYS) {
+  const file = join(SECTIONS, \`\${page}.md\`);
+  if (!existsSync(file)) {
+    missing.push(page);
+    continue;
+  }
+  const body = readFileSync(file, "utf8").trim();
+  // The preflight greps \`^##+ +<page>\`; a section that does not open with its
+  // own key would build fine here and then refuse at the gate, which is the
+  // most confusing possible failure. Catch it now.
+  if (!specHeadingRe(page).test(body)) {
+    console.error(
+      \`WARNING: \${page}.md does not open with a '## \${page}' heading \u2014 gate.sh will still refuse this page.\`,
+    );
+  }
+  parts.push(body);
+}
+
+// The header is a spec-section like any other, so a site can say what a
+// citation looks like there and what its own ladders are. DEFAULT_HEADER is
+// what a site gets before it writes one: the two paragraphs that are true of
+// every project, and nothing that is not.
+const DEFAULT_HEADER = \`# Reference spec
+
+GENERATED by \\\`node matching/build-spec.mjs\\\` from \\\`matching/spec-sections/\\\`.
+Edit the section files, not this one.
+
+This is the Phase 1 deliverable of the \\\`matching-a-page\\\` skill and the
+precondition \\\`matching/gate.sh\\\` enforces: a page with no section here does not
+get a geometry round (see the matching rules in CLAUDE.md).
+
+\`;
+const headerFile = join(SECTIONS, "_header.md");
+const header = existsSync(headerFile)
+  ? readFileSync(headerFile, "utf8").trimEnd() + "\\n\\n"
+  : DEFAULT_HEADER;
+
+writeFileSync(join(DIR, "SPEC.md"), header + parts.join("\\n\\n---\\n\\n") + "\\n");
+
+const built = KEYS.length - missing.filter((m) => m !== "_chrome").length;
+console.log(
+  \`SPEC.md built \u2014 \${built}/\${KEYS.length} pages\${missing.length ? \`, MISSING: \${missing.join(", ")}\` : ""}\`,
+);
+process.exit(missing.length ? 1 : 0);
+`;
+var CENSUS_COUNT_MJS_RELATIVE = "matching/census-count.mjs";
+var CENSUS_COUNT_MJS_TEMPLATE = `// Count one style-census log, splitting declared deviations out of the total.
+//
+//   node matching/census-count.mjs matching/census-home-1440.log
+//   -> "<real> <ambiguous> <declared>"
+//
+// census.sh calls this per page/viewport. Parsing the log rather than importing
+// style-census keeps the project's declared-deviation policy out of the shared
+// skill \u2014 the skill reports what it sees; the project decides what it has
+// already agreed to.
+import { readFileSync } from "node:fs";
+import { DECLARED } from "./census-deviations.mjs";
+
+const path = process.argv[2];
+if (!path) {
+  console.error("usage: census-count.mjs <census log>");
+  process.exit(2);
+}
+
+// A log that cannot be READ is not a log with nothing IN it. This printed
+// "0 0 0" and exited 0, and census.sh added that to its total \u2014 the same green
+// it used to grant for a style-census that never ran. There is no count to
+// give here; say so and let the caller decide, which is never zero.
+let text = "";
+try {
+  text = readFileSync(path, "utf8");
+} catch (e) {
+  console.error(\`census-count: cannot read \${path} \u2014 \${e.message}\`);
+  console.error("              a missing log is not a census with no findings.");
+  process.exit(2);
+}
+
+const [head, tail = ""] = text.split("--- AMBIGUOUS");
+
+/** Pull \`{label, ref, cand}\` rows out of a census section. */
+function rows(section) {
+  const out = [];
+  const lines = section.split("\\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^ {2}y=/.test(lines[i])) continue;
+    const label = lines[i].replace(/^\\s*y=\\s*\\d+\\s*/, "").trim();
+    const refs = [];
+    const cands = [];
+    for (
+      let j = i + 1;
+      j < lines.length && /^ {4}(ref|cand):/.test(lines[j]);
+      j++
+    ) {
+      const v = lines[j].replace(/^\\s*(ref|cand):\\s*/, "").trim();
+      (lines[j].trim().startsWith("ref:") ? refs : cands).push(v);
+    }
+    if (refs.length && cands.length)
+      out.push({ label, ref: refs[0], cand: cands[0] });
+    else out.push({ label, ref: refs[0] ?? "", cand: cands[0] ?? "" });
+  }
+  return out;
+}
+
+const mism = rows(head);
+const amb = rows(tail);
+const declared = mism.filter((r) => DECLARED.some((d) => d.match(r)));
+console.log(
+  \`\${mism.length - declared.length} \${amb.length} \${declared.length}\`,
+);
+`;
+var HARNESS_JSON_RELATIVE = "matching/harness.json";
+var HARNESS_JSON_TEMPLATE = `{
+  "ref": "__REF__",
+  "cand": "http://localhost:5173",
+  "matrix": [
+    1440,
+    834,
+    390
+  ],
+  "threshold": 0.1,
+  "maxHeightDelta": 0.05,
+  "refMark": "",
+  "candMark": "_app/immutable",
+  "selfHosts": [],
+  "pages": {
+    "home": {
+      "uid": "home",
+      "ref": "/",
+      "cand": "/dev/match/home",
+      "published": "/",
+      "anchors": [],
+      "spec": "home",
+      "group": "nav"
+    }
+  }
+}
+`;
+var FLOORS_MJS_RELATIVE = "matching/floors.mjs";
+var FLOORS_MJS_TEMPLATE = `// The failures we have already established are NOT geometry. Shared by
+// next.mjs (which reports them separately from the backlog) and strikes.mjs
+// (which must not report them as stalled \u2014 a region that cannot move is flat
+// by definition, and three strikes on one is noise that hides a real stall).
+// Every entry needs a matching LEDGER entry to stay honest.
+//
+// NOTE the second matcher argument. Region records carry \`label\` and
+// \`viewport\` but not the page, so an entry keyed on label+viewport alone is
+// safe only where the label is unique site-wide. "top" is not \u2014 every page has
+// one \u2014 so such an entry would silently accept the \`top\` failure on EVERY page
+// and hide every real one. next.mjs and strikes.mjs pass the page key as the
+// second argument: take \`(r, page)\` unless you have checked the label.
+
+/** Reference behaviour we cannot reproduce (declared floors). */
+export const FLOORS = [];
+
+/** Regions the OPERATOR has looked at and chosen to leave failing. These are
+ *  not floors and are not silently dropped: next.mjs prints them under their
+ *  own heading with the decision, so the number never quietly improves. */
+export const ACCEPTED = [];
+`;
+var CENSUS_DEVIATIONS_MJS_RELATIVE = "matching/census-deviations.mjs";
+var CENSUS_DEVIATIONS_MJS_TEMPLATE = `// Style-census rows the OPERATOR has looked at and chosen to keep. Same
+// contract as matching/floors.mjs: nothing is hidden, everything is counted
+// under its own heading, and every entry needs a LEDGER entry to stay honest.
+//
+//   node matching/census-count.mjs <log>   -> "<real> <ambiguous> <declared>"
+//
+// Without this, \`census.sh\` can never reach zero and an "N remaining" figure
+// says nothing about how much work is left \u2014 one permanent decision is counted
+// once per page per viewport, so a single ACK can account for dozens of rows.
+
+/** A row is \`{ label, ref, cand }\`, each of ref/cand a "fam | wt | size | lh |
+ *  ls | transform | colour" tuple string. */
+export const DECLARED = [];
+`;
+var SPEC_CHROME_MD_RELATIVE = "matching/spec-sections/_chrome.md";
+var SPEC_CHROME_MD_TEMPLATE = `## shared chrome
+
+Site-wide furniture that renders identically on every page \u2014 header, footer, and
+anything else the per-page sections would otherwise restate. Phase 1 of the
+\`matching-a-page\` skill fills this in; until it does, this section is a
+placeholder and \`matching/SPEC.md\` has no shared-chrome contract to cite.
+`;
+var SPEC_HEADER_MD_RELATIVE = "matching/spec-sections/_header.md";
+var SPEC_HEADER_MD_TEMPLATE = `# Reference spec
+
+GENERATED by \`node matching/build-spec.mjs\` from \`matching/spec-sections/\`.
+Edit the section files, not this one.
+
+This is the Phase 1 deliverable of the \`matching-a-page\` skill and the
+precondition \`matching/gate.sh\` enforces: a page with no section here does not
+get a geometry round (see the matching rules in CLAUDE.md).
+`;
+var LEDGER_MD_RELATIVE = "matching/LEDGER.md";
+var LEDGER_MD_TEMPLATE = `# Deviations / masks / floors ledger
+
+Append-only, and written at the moment a decision is made \u2014 not reconstructed at
+the end of a round, when the reason has already been lost. An entry is never
+edited to be right: a later entry corrects an earlier one and says which.
+
+Every entry in \`matching/floors.mjs\` and \`matching/census-deviations.mjs\`, and
+every mask in \`matching/harness.json\`, needs a line here. Without one the gate
+has been quietly widened and nothing records who widened it, or why.
+
+- [deviation | floor | mask | a11y] \`<region or selector>\` \u2014 what differs, why
+  it is accepted, and the evidence: a spec citation, a census row, a gate run.
+`;
+var MATCH_ROUTE_SERVER_RELATIVE = "src/routes/dev/match/[uid]/+page.server.ts";
+var MATCH_ROUTE_SERVER_TEMPLATE = `import { error } from "@sveltejs/kit";
+import { dev } from "$app/environment";
+import { documents } from "$lib/site-pages.js";
+
+// Local matching surface: renders the EXACT assembly \`reddoor-maint
+// prismic-seed\` publishes, from the same module, so a fix made to pass a gate
+// is a fix to what ships. Not prerendered, SSR-on-demand, dev-only.
+export const prerender = false;
+
+// The seed resolves images to asset ids; here they only need a URL. Dimensions
+// are nominal \u2014 slices size their own image boxes in CSS.
+const devImg = (u: string) => ({
+  url: u,
+  alt: null,
+  copyright: null,
+  dimensions: { width: 1600, height: 1067 },
+  edit: { x: 0, y: 0, zoom: 1, background: "transparent" },
+  id: u,
+});
+
+export async function load({ params }) {
+  // FIRST statement: everything below reads fixtures that must not be reachable
+  // from a production build. The launch recipe asserts this route 404s on the
+  // deployed URL, with /dev/a11y-fixtures as the 200 control.
+  if (!dev) error(404, { message: "Not found" });
+
+  const docs = documents(devImg) as Array<{ uid: string; data: { slices?: unknown[] } }>;
+  const doc = docs.find((d) => d.uid === params.uid);
+  if (!doc)
+    error(404, {
+      message: \`no assembly for "\${params.uid}" (have: \${docs.map((d) => d.uid).join(", ") || "none"})\`,
+    });
+
+  return { uid: params.uid, slices: doc.data.slices ?? [] };
+}
+`;
+var MATCH_ROUTE_PAGE_RELATIVE = "src/routes/dev/match/[uid]/+page.svelte";
+var MATCH_ROUTE_PAGE_TEMPLATE = `<script lang="ts">
+  import { SliceZone } from "@prismicio/svelte";
+  import { components } from "$lib/slices";
+
+  let { data } = $props();
+</script>
+
+<SliceZone slices={data.slices as never} {components} />
+`;
+var SITE_PAGES_JS_RELATIVE = "src/lib/site-pages.js";
+var SITE_PAGES_JS_TEMPLATE = `// The page assemblies for this site \u2014 the SINGLE source of truth for both
+// consumers: \`reddoor-maint prismic-seed\`, which publishes them through the
+// Migration API, and src/routes/dev/match/[uid], the local matching surface.
+// Because both read from here, any fix made to pass a gate is a fix to what
+// ships.
+//
+// THE MIGRATION API DROPS SILENTLY. It validates against the slice models
+// registered in Prismic and discards every field the model does not declare \u2014
+// HTTP 200, no warning. A fixture field with no model behind it renders here and
+// vanishes on the published route. src/lib/site-pages.test.ts is the mechanical
+// check; run it before every seed.
+//
+// PURE by contract: no node:*, no fetch, no token, no side effects at import,
+// so Vite can bundle it into the dev route and node can import it into the seed.
+
+export const lang = "en-us";
+
+/**
+ * @param {(url: string) => unknown} img resolves an image URL to whatever the
+ *   caller needs \u2014 an asset \`{id}\` for the seed, a \`{url}\` for the dev route.
+ * @returns {Array<{type: string, uid: string, title: string, data: Record<string, unknown>}>}
+ */
+export function documents(img) {
+  void img;
+  return [];
+}
+`;
+var SITE_PAGES_TEST_RELATIVE = "src/lib/site-pages.test.ts";
+var SITE_PAGES_TEST_TEMPLATE = `// The page assemblies in src/lib/site-pages.js are the SINGLE source of truth
+// shared by two consumers: the local matching route (src/routes/dev/match/[uid])
+// and \`reddoor-maint prismic-seed\`, which publishes them to Prismic.
+//
+// Those two consumers do NOT validate the same way. The dev route hands the
+// object straight to the slice components, so any field a fixture sets is
+// simply there. The Migration API validates against the slice models registered
+// in Prismic and SILENTLY DROPS every field the model does not declare \u2014 no
+// error, no warning, a 200. A page can gate green locally and publish wrong.
+//
+// This test is the mechanical check. It fails the moment a fixture carries a
+// field its slice model does not declare \u2014 before the seed runs, not after the
+// content is published. Run it before every seed.
+import { describe, expect, it } from "vitest";
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { documents } from "./site-pages.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SLICES = join(HERE, "slices");
+
+type Variation = { primary: string[]; items: string[] };
+type Slice = {
+  slice_type: string;
+  variation: string;
+  primary?: Record<string, unknown>;
+  items?: Array<Record<string, unknown>>;
+};
+
+/** Every slice model in src/lib/slices, indexed by its Prismic slice id. */
+function loadModels(): Record<string, Record<string, Variation>> {
+  const out: Record<string, Record<string, Variation>> = {};
+  if (!existsSync(SLICES)) return out;
+  for (const dir of readdirSync(SLICES)) {
+    const file = join(SLICES, dir, "model.json");
+    if (!existsSync(file)) continue;
+    const model = JSON.parse(readFileSync(file, "utf8"));
+    out[model.id] = Object.fromEntries(
+      (model.variations ?? []).map((v: Record<string, unknown>) => [
+        v.id,
+        {
+          primary: Object.keys((v.primary as object) ?? {}),
+          items: Object.keys((v.items as object) ?? {}),
+        },
+      ]),
+    );
+  }
+  return out;
+}
+
+/** Image resolver stub \u2014 shape only; this test never reads image values. */
+const stubImg = () => ({ url: "https://example.test/x.jpg" });
+
+describe("site-pages documents vs slice models", () => {
+  const models = loadModels();
+  const docs = documents(stubImg) as Array<{ uid: string; data: { slices?: Slice[] } }>;
+  const pages: Array<[string, Slice[]]> = docs.map((d) => [d.uid, d.data.slices ?? []]);
+
+  it("declares every slice type the documents use", () => {
+    const missing = new Set<string>();
+    for (const [, slices] of pages)
+      for (const s of slices) if (!models[s.slice_type]) missing.add(s.slice_type);
+    expect([...missing]).toEqual([]);
+  });
+
+  it("declares every variation the documents use", () => {
+    const missing: string[] = [];
+    for (const [uid, slices] of pages)
+      for (const s of slices) {
+        const model = models[s.slice_type];
+        if (model && !model[s.variation]) missing.push(\`\${uid}: \${s.slice_type}/\${s.variation}\`);
+      }
+    expect(missing).toEqual([]);
+  });
+
+  // The one that catches a silent Migration-API drop.
+  it("declares every field the documents set, so Prismic strips nothing", () => {
+    const stripped: string[] = [];
+    for (const [uid, slices] of pages)
+      for (const s of slices) {
+        const variation = models[s.slice_type]?.[s.variation];
+        if (!variation) continue;
+        for (const key of Object.keys(s.primary ?? {}))
+          if (!variation.primary.includes(key))
+            stripped.push(\`\${uid} \${s.slice_type}/\${s.variation} primary.\${key}\`);
+        const itemKeys = new Set((s.items ?? []).flatMap((i) => Object.keys(i)));
+        for (const key of itemKeys)
+          if (!variation.items.includes(key))
+            stripped.push(\`\${uid} \${s.slice_type}/\${s.variation} items.\${key}\`);
+      }
+    expect(stripped).toEqual([]);
+  });
+});
+`;
+var MATCH_HARNESS_FILES = [
+  { rel: HARNESS_MJS_RELATIVE, template: HARNESS_MJS_TEMPLATE, owner: "recipe" },
+  { rel: GATE_SH_RELATIVE, template: GATE_SH_TEMPLATE, owner: "recipe" },
+  { rel: CENSUS_SH_RELATIVE, template: CENSUS_SH_TEMPLATE, owner: "recipe" },
+  { rel: NEXT_MJS_RELATIVE, template: NEXT_MJS_TEMPLATE, owner: "recipe" },
+  { rel: STRIKES_MJS_RELATIVE, template: STRIKES_MJS_TEMPLATE, owner: "recipe" },
+  { rel: BUILD_SPEC_MJS_RELATIVE, template: BUILD_SPEC_MJS_TEMPLATE, owner: "recipe" },
+  { rel: CENSUS_COUNT_MJS_RELATIVE, template: CENSUS_COUNT_MJS_TEMPLATE, owner: "recipe" },
+  { rel: HARNESS_JSON_RELATIVE, template: HARNESS_JSON_TEMPLATE, owner: "site" },
+  { rel: FLOORS_MJS_RELATIVE, template: FLOORS_MJS_TEMPLATE, owner: "site" },
+  { rel: CENSUS_DEVIATIONS_MJS_RELATIVE, template: CENSUS_DEVIATIONS_MJS_TEMPLATE, owner: "site" },
+  { rel: SPEC_CHROME_MD_RELATIVE, template: SPEC_CHROME_MD_TEMPLATE, owner: "site" },
+  { rel: SPEC_HEADER_MD_RELATIVE, template: SPEC_HEADER_MD_TEMPLATE, owner: "site" },
+  { rel: LEDGER_MD_RELATIVE, template: LEDGER_MD_TEMPLATE, owner: "site" },
+  { rel: MATCH_ROUTE_SERVER_RELATIVE, template: MATCH_ROUTE_SERVER_TEMPLATE, owner: "recipe" },
+  { rel: MATCH_ROUTE_PAGE_RELATIVE, template: MATCH_ROUTE_PAGE_TEMPLATE, owner: "recipe" },
+  { rel: SITE_PAGES_JS_RELATIVE, template: SITE_PAGES_JS_TEMPLATE, owner: "site" },
+  { rel: SITE_PAGES_TEST_RELATIVE, template: SITE_PAGES_TEST_TEMPLATE, owner: "recipe" }
+];
+var MATCH_HARNESS_PREVIOUS = {};
+var GITIGNORE_MARKER = "# reddoor-maint match-harness: scripts + records tracked, workspace ignored";
+var GITIGNORE_BLOCK = `scratch-diff*/
+matching/*
+!matching/*.sh
+!matching/*.mjs
+!matching/*.md
+# The pause switch. Extensionless on purpose (it is a sentinel, not a doc), so
+# the whitelist above misses it \u2014 and an ignored switch is not a switch: it
+# would work on one machine and be absent from every fresh clone, CI run and
+# agent that most needs to see it.
+!matching/PAUSED
+!matching/spec-sections/
+!matching/states/
+matching/states/*
+!matching/states/*.mjs
+# derived artefacts, even where the extensions above would catch them
+matching/*.log
+matching/*.json
+# ...except the page table itself, which is the harness's configuration and the
+# one thing a fresh clone cannot reconstruct.
+!matching/harness.json
+matching/*.png
+`;
+var PRETTIERIGNORE_MARKER = "# reddoor-maint match-harness";
+var PRETTIERIGNORE_BLOCK = `# Matching harness \u2014 every file the \`match-harness\` recipe OWNS. It installs
+# them byte-for-byte and byte-compares them on the next install, so a site whose
+# prettier config differs must not reformat them: a reformatted file is
+# indistinguishable from a hand edit, and the recipe refuses to overwrite a hand
+# edit. Measured on a \`useTabs\`/\`singleQuote\` site, all three src/ entries
+# below are rewritten by \`prettier --write .\`, and the next upgrade is refused
+# for all three.
+#
+# The bracketed route segment MUST stay backslash-escaped. This file is
+# gitignore glob syntax, in which \`[uid]\` is a CHARACTER CLASS matching one of
+# \`u\`, \`i\`, \`d\` \u2014 an unescaped entry silently ignores nothing at all.
+#
+# \`matching/*.mjs\` also catches two SITE-owned records (floors.mjs,
+# census-deviations.mjs). Accepted, not overlooked: eslint lints .mjs, so those
+# two keep a style check either way, and naming seven scripts instead of one
+# glob goes stale on the next script the harness gains.
+#
+# harness.json is here because it is a TABLE, not prose: it carries a
+# hand-chosen row layout that prettier reflows.
+#
+# Everything else under matching/ (SPEC.md, LEDGER.md, spec-sections/,
+# states/*.mjs) stays inside \`prettier --check .\`. That is deliberately narrow:
+# eslint does not lint Markdown, so for the records prettier is the ONLY style
+# check there is, and a blanket \`matching/\` entry would leave them with none.
+matching/*.mjs
+matching/*.sh
+matching/harness.json
+src/routes/dev/match/\\[uid\\]/+page.server.ts
+src/routes/dev/match/\\[uid\\]/+page.svelte
+src/lib/site-pages.test.ts
+`;
+var CLAUDE_MD_MARKER = "## Matching rules (installed by reddoor-maint match-harness)";
+var CLAUDE_MD_BLOCK = `
+The \`matching-a-page\` skill governs a live-reference rebuild. These five rules
+exist because the skill alone did not hold on the project this harness came
+from \u2014 each one is a drift that actually happened, with the mechanical check
+that now catches it. \`matching/harness.json\` is this site's configuration;
+\`matching/LEDGER.md\` is the dated record of every deviation, floor and mask.
+
+### 1. Source prescribes, rects only verify
+
+Every geometry fix must cite the rule it came from: a line in the captured
+reference stylesheet under \`matching/spec/\`, or the reference's HTML. "The probe
+says the gap is 40px" is not a source. If you cannot name the line you are
+guessing \u2014 go read the stylesheet first.
+
+**Check:** the commit body must name the file:line for each fix.
+**Operator's challenge:** _"which line of the reference stylesheet says that?"_
+
+### 2. Phase 1 before Phase 4
+
+A page gets its section census and per-section spec in \`matching/SPEC.md\` BEFORE
+its geometry is touched. No SPEC section, no geometry round. The census is the
+coverage denominator; skipping it is how a reference's root-font ladder and its
+per-component height ladders get discovered reactively, after the region has
+already failed several rounds.
+
+**Check:** \`matching/gate.sh\` refuses to run a page with no \`SPEC.md\` section.
+**Operator's challenge:** _"show me the SPEC section for that region."_
+
+### 3. Three strikes, then stop
+
+A failing region that has not improved across 3+ gate runs does not get a fourth
+attempt. Present the attempts. Never widen the threshold, add a mask, or
+reclassify it as a floor to make it go away.
+
+**Check:** \`node matching/strikes.mjs <page>\` \u2014 exits 1 while any region is
+stalled, and is the first thing a geometry round runs.
+**Operator's challenge:** _"how many runs has that region been flat?"_
+
+### 4. A gate closes an item, nothing else
+
+No fix is "done" because the code changed. Paste the gate header \u2014 it is
+self-describing, so a nonstandard threshold or an undisclosed mask is visible.
+The threshold and the matrix are whatever \`matching/harness.json\` says, on every
+page, never a subset.
+
+**Operator's challenge:** _"paste the gate header."_
+
+### 5. A commit is a checkpoint, not a stopping point
+
+Do not hand control back between rounds. After committing, run
+\`node matching/next.mjs\`: while it exits 1 there is a named next action, and the
+round continues. Report when the backlog is empty, when a decision is genuinely
+the operator's (three strikes, a novel floor, a threshold change), or when
+asked \u2014 not because a commit felt like a natural place to summarise.
+
+This exists because the failure was habitual, not deliberate: a turn ends when
+user-facing prose gets written, and "I just committed something good" is the
+moment that invites writing it. The gate stops incorrect work; this stops
+premature stopping.
+
+**Pausing:** create \`matching/PAUSED\` holding a note that says what the pause
+means; \`next.mjs\` and \`strikes.mjs\` then exit 0 while it exists. This rule says
+"do not stop while work is named"; it never said "find work to name". An empty
+agenda and a paused one end the round the same way. Deleting the switch is the
+operator's call.
+
+**Check:** \`node matching/next.mjs\` \u2014 exits 1 while any non-floor region fails.
+**Operator's challenge:** _"what does next.mjs say?"_
+
+### Round protocol
+
+1. \`node matching/strikes.mjs <page>\` \u2014 if it exits 1, the stalled regions are
+   the agenda, and stalled ones get escalated rather than re-attempted.
+2. Confirm the page has a \`matching/SPEC.md\` section; write
+   \`matching/spec-sections/<page>.md\` and run \`node matching/build-spec.mjs\` if
+   not.
+3. Fix, each change citing its source line.
+4. \`bash matching/gate.sh <tag> <page>\` \u2014 paste the header.
+5. Append to \`matching/LEDGER.md\` at the moment a deviation, floor or mask is
+   decided, not reconstructed at the end.
+6. \`pnpm verify\`, then commit and push.
+`;
+
+// src/recipes/match-harness/index.ts
+var PRETTIER_TIMEOUT_MS = 6e4;
+async function readIfExists(path) {
+  try {
+    return await readFile(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function normalize(s) {
+  return s.replace(/\r\n/g, "\n").replace(/[ \t]+$/gm, "").trim();
+}
+function mergeBlock(existing, marker, block) {
+  if (existing === null) return `${marker}
+${block}`;
+  if (existing.includes(marker)) return null;
+  const base = existing.endsWith("\n") ? existing : `${existing}
+`;
+  return `${base}
+${marker}
+${block}`;
+}
+function planFileWrite(existing, template, owner, previous) {
+  if (existing === null) return "write";
+  if (normalize(existing) === normalize(template)) return "skip";
+  if (owner === "site") return "skip";
+  if (previous.some((p) => normalize(existing) === normalize(p))) return "replace";
+  return "flag";
+}
+var APPENDED_BLOCKS = [
+  [".gitignore", GITIGNORE_MARKER, GITIGNORE_BLOCK],
+  [".prettierignore", PRETTIERIGNORE_MARKER, PRETTIERIGNORE_BLOCK],
+  ["CLAUDE.md", CLAUDE_MD_MARKER, CLAUDE_MD_BLOCK]
+];
+var MATCH_HARNESS_INSTALLED_PATHS = [
+  ...MATCH_HARNESS_FILES.map((f) => f.rel),
+  ...APPENDED_BLOCKS.map(([rel]) => rel)
+];
+async function matchHarness(site, opts, deps = { spawn: defaultSpawn }) {
+  return withRecipe({
+    name: "match-harness",
+    site,
+    plan: async () => {
+      if (!opts.ref || !/^https?:\/\//.test(opts.ref)) {
+        return {
+          kind: "failed",
+          notes: "--ref <url> is required: the harness gates against a live reference, and a harness with no reference can only ever report an absence of errors"
+        };
+      }
+      return {
+        kind: "apply",
+        plan: {
+          ref: opts.ref.replace(/\/$/, ""),
+          cand: opts.cand ?? "http://localhost:5173",
+          matrix: opts.matrix ?? [1440, 834, 390]
+        }
+      };
+    },
+    apply: async (planned, { commit, cwd }) => {
+      const notes = [];
+      const written = [];
+      const before = /* @__PURE__ */ new Map();
+      const previousAll = deps.previous ?? MATCH_HARNESS_PREVIOUS;
+      for (const f of MATCH_HARNESS_FILES) {
+        const target = join(cwd, f.rel);
+        let template = f.template;
+        if (f.rel === HARNESS_JSON_RELATIVE) {
+          const seed = JSON.parse(template);
+          seed.ref = planned.ref;
+          seed.cand = planned.cand;
+          seed.matrix = planned.matrix;
+          template = JSON.stringify(seed, null, 2) + "\n";
+        }
+        const existing = await readIfExists(target);
+        const action = planFileWrite(existing, template, f.owner, previousAll[f.rel] ?? []);
+        if (action === "flag") {
+          notes.push(
+            `${f.rel} differs from the shipped template and was left alone (hand-edited?)`
+          );
+          continue;
+        }
+        if (action === "skip") continue;
+        await mkdir(dirname(target), { recursive: true });
+        before.set(f.rel, existing);
+        await writeFile(target, template, "utf-8");
+        written.push(f.rel);
+        if (action === "replace") notes.push(`${f.rel} upgraded from a previous version`);
+      }
+      for (const [rel, marker, block] of APPENDED_BLOCKS) {
+        const path = join(cwd, rel);
+        const existing = await readIfExists(path);
+        const merged = mergeBlock(existing, marker, block);
+        if (merged !== null) {
+          before.set(rel, existing);
+          await writeFile(path, merged, "utf-8");
+          written.push(rel);
+        }
+      }
+      const siteOwned = new Set(
+        MATCH_HARNESS_FILES.filter((f) => f.owner === "site").map((f) => f.rel)
+      );
+      const toFormat = written.filter((p) => siteOwned.has(p) || p === "CLAUDE.md");
+      if (toFormat.length > 0) {
+        const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(cwd);
+        if (bin === null) {
+          notes.push(PRETTIER_FLAG_NOTE);
+        } else if (!await formatWithPrettier(deps.spawn, cwd, toFormat, {
+          bin,
+          timeoutMs: PRETTIER_TIMEOUT_MS
+        })) {
+          notes.push(PRETTIER_FLAG_NOTE);
+        }
+      }
+      await commit(
+        "feat: install the matching harness (/dev/match route + matching/ gate scripts)"
+      );
+      const missing = await pathsMissingFromHead(cwd, MATCH_HARNESS_INSTALLED_PATHS);
+      if (missing.length > 0) {
+        const rules = await ignoreRulesFor(cwd, missing);
+        const sources = [...new Set(rules.map((r) => r.split("	")[0]))];
+        const explained = new Set(rules.map((r) => r.split("	")[1] ?? ""));
+        const unexplained = missing.filter((p) => !explained.has(p));
+        const removed = [];
+        for (const rel of written.filter((p) => missing.includes(p))) {
+          const prev = before.get(rel);
+          if (prev === void 0) continue;
+          if (prev === null) {
+            await rm(join(cwd, rel), { force: true });
+            removed.push(rel);
+          } else {
+            await writeFile(join(cwd, rel), prev, "utf-8");
+          }
+        }
+        for (const d of [...new Set(removed.map(dirname))].sort((a, b) => b.length - a.length)) {
+          if (d !== ".") await rmdir(join(cwd, d)).catch(() => void 0);
+        }
+        return {
+          kind: "failed",
+          notes: `the harness was NOT installed: ${missing.length} of ${MATCH_HARNESS_INSTALLED_PATHS.length} paths git refused to track, so a fresh clone, CI and the next agent get a harness that does not exist. Absent from the commit: ${missing.join(", ")}. ` + (sources.length > 0 ? `Excluded by ${sources.join(", ")} \u2014 narrow or remove those rules and re-run. ` : "") + (unexplained.length > 0 ? `No ignore rule matched ${unexplained.join(", ")} \u2014 check .git/info/exclude, core.excludesFile, and whether the directory is a nested repository. ` : "") + "Everything this run wrote to those paths has been put back as it was."
+        };
+      }
+      return notes.length > 0 ? { kind: "ok", notes: notes.join("; ") } : { kind: "ok" };
+    }
+  });
+}
+
+export {
+  matchHarness
+};
+//# sourceMappingURL=chunk-6VKYQATC.js.map