@reddoorla/maintenance 0.95.0 → 0.95.1

package/dist/chunk-ZCL7C5LH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipes/match-harness/index.ts","../src/recipes/match-harness/template.ts","../src/recipes/match-harness/previous.ts"],"sourcesContent":["import { mkdir, readFile, rm, rmdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { withRecipe } from \"../_with-recipe.js\";\nimport { ignoreRulesFor, pathsMissingFromHead } from \"../../util/git.js\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { formatWithPrettier, resolveTargetPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport {\n  MATCH_HARNESS_FILES,\n  MATCH_HARNESS_PREVIOUS,\n  MATCH_HARNESS_COUPLED,\n  HARNESS_JSON_RELATIVE,\n  GITIGNORE_MARKER,\n  GITIGNORE_BLOCK,\n  PRETTIERIGNORE_MARKER,\n  PRETTIERIGNORE_BLOCK,\n  CLAUDE_MD_MARKER,\n  CLAUDE_MD_BLOCK,\n} from \"./template.js\";\nimport { MATCH_HARNESS_BLOCK_PREVIOUS } from \"./previous.js\";\n\n/** How long the target's own prettier gets. Also what makes the fleet's default\n *  spawn detach the child, so the kill reaches prettier and not just a wrapper.\n *  Same budget as `prismic-ci` and the Prismic pull-down path. */\nconst PRETTIER_TIMEOUT_MS = 60_000;\n\nexport type MatchHarnessOptions = {\n  /** The live reference URL the harness gates against. Required — a harness\n   *  with no reference cannot produce evidence, only an absence of errors. */\n  ref: string;\n  /** Candidate origin. Defaults to the SvelteKit dev server. */\n  cand?: string;\n  /** Breakpoint matrix. Defaults to the fleet's 1440 / 834 / 390. */\n  matrix?: number[];\n};\n\nexport type MatchHarnessDeps = {\n  spawn: SpawnFn;\n  /** Previously shipped renders per relative path; injectable so the\n   *  safe-replace path is testable before a second version exists. */\n  previous?: Readonly<Record<string, readonly string[]>>;\n  /** Previously shipped BLOCK bodies per target file; injectable for the same\n   *  reason, and empty in the shipped table until a body is superseded. */\n  blockPrevious?: Readonly<Record<string, readonly string[]>>;\n  /** Resolve the TARGET repo's own prettier. Injected so a test can assert the\n   *  absolute-path spawn without a populated `node_modules`. */\n  resolvePrettier?: (repoRoot: string) => Promise<string | null>;\n};\n\ntype Plan = { ref: string; cand: string; matrix: number[] };\n\nasync function readIfExists(path: string): Promise<string | null> {\n  try {\n    return await readFile(path, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\n/** CRLF and trailing whitespace are the only differences a site's formatter is\n *  allowed to introduce before a file stops counting as \"ours\". */\nfunction normalize(s: string): string {\n  return s\n    .replace(/\\r\\n/g, \"\\n\")\n    .replace(/[ \\t]+$/gm, \"\")\n    .trim();\n}\n\n/** What to do with one marked block region. `flag` and `skip` never write.\n *  One member per action, so `content` narrows on the discriminant alone. */\nexport type BlockPlan =\n  | { action: \"write\"; content: string }\n  | { action: \"replace\"; content: string }\n  | { action: \"terminate\"; content: string }\n  | { action: \"skip\" }\n  | { action: \"flag\" };\n\n/**\n * Plan one marked block region. The only append-to-existing-file idiom in this\n * repo is mergeGitignore, and it cannot express a negated whitelist\n * (`matching/*` then `!matching/*.sh`) as one unit: it compares entries by\n * normalized presence, so the ordering that makes the block work would be lost.\n * So the block is kept whole — and, being whole, it needs an END as well as a\n * start if it is ever to be CORRECTED rather than only appended.\n *\n * That was #739. The predecessor returned \"already done\" the instant the marker\n * was present, which is right for \"never append twice\" and wrong for everything\n * else: the block's CONTENTS could then never change on a site that had already\n * installed. On `.gitignore` that is not staleness but a brick — the block is a\n * negated whitelist, so a harness file at a path it does not re-include is\n * absent from the commit, `pathsMissingFromHead` refuses the install, and the\n * remedy (widen the whitelist) is the one edit that cannot land.\n *\n * Four states, and the third is the one that made this worth doing properly:\n *\n * - No marker: append the region, terminator included.\n * - Marker AND terminator: the extent is KNOWN. Body still current -> skip.\n *   Body byte-matches something we shipped before -> replace IN PLACE, keeping\n *   everything before and after the region. Anything else -> flag, write\n *   nothing.\n * - Marker, NO terminator — every site installed from 0.95.0: the extent is not\n *   known, so it is never guessed. A candidate qualifies only by matching\n *   EXACTLY, byte-for-byte, at the exact offset the body starts; what follows\n *   is the site's own and is preserved verbatim. Guessing end-of-file instead\n *   would eat whatever mergeGitignore appended after us.\n * - Anything unrecognised: flag. Anchoring is on the FIRST occurrence of the\n *   marker, so a marker quoted in the site's own prose mis-anchors into text\n *   that matches no candidate — which degrades to a flag, never to a write.\n */\nexport function planBlockWrite(\n  existing: string | null,\n  marker: string,\n  endMarker: string,\n  block: string,\n  previous: readonly string[],\n): BlockPlan {\n  const region = `${marker}\\n${block}\\n${endMarker}`;\n  if (existing === null) return { action: \"write\", content: `${region}\\n` };\n\n  const start = existing.indexOf(marker);\n  if (start === -1) {\n    const base = existing.endsWith(\"\\n\") ? existing : `${existing}\\n`;\n    return { action: \"write\", content: `${base}\\n${region}\\n` };\n  }\n\n  const head = existing.slice(0, start);\n  const bodyStart = start + marker.length + 1;\n\n  const endAt = existing.indexOf(endMarker, bodyStart);\n  if (endAt !== -1) {\n    const body = existing.slice(bodyStart, endAt);\n    if (normalize(body) === normalize(block)) return { action: \"skip\" };\n    if (previous.some((p) => normalize(body) === normalize(p)))\n      return {\n        action: \"replace\",\n        content: head + region + existing.slice(endAt + endMarker.length),\n      };\n    return { action: \"flag\" };\n  }\n\n  for (const candidate of [block, ...previous]) {\n    if (!existing.startsWith(candidate, bodyStart)) continue;\n    const content = `${head}${region}\\n${existing.slice(bodyStart + candidate.length)}`;\n    // Matching the CURRENT block means the bytes do not change at all and only\n    // the terminator is added — the migration write is content-neutral.\n    return candidate === block ? { action: \"terminate\", content } : { action: \"replace\", content };\n  }\n  return { action: \"flag\" };\n}\n\n/** What to do with one installed file. `flag` never writes. */\nexport function planFileWrite(\n  existing: string | null,\n  template: string,\n  owner: \"recipe\" | \"site\",\n  previous: readonly string[],\n): \"write\" | \"replace\" | \"skip\" | \"flag\" {\n  if (existing === null) return \"write\";\n  if (normalize(existing) === normalize(template)) return \"skip\";\n  if (owner === \"site\") return \"skip\"; // records are never touched again\n  if (previous.some((p) => normalize(existing) === normalize(p))) return \"replace\";\n  return \"flag\";\n}\n\n/**\n * Where each block region ENDS. Deliberately NOT in template.ts beside the\n * start markers, and the split is a real smell being paid for on purpose:\n * template.ts is GENERATED, and regenerating it today drags in undeclared drift\n * from the source site and would flag three already-installed scripts forever.\n * Reuniting them belongs to #753, which makes the generator's\n * `MATCH_HARNESS_PREVIOUS` emission trustworthy enough to regenerate against.\n * That table stays in template.ts and stays POPULATED in the meantime: it is\n * what upgrades an installed site's gate.sh past #744, so pointing this recipe\n * at an empty one un-ships that fix to every site already carrying the v1 gate.\n *\n * None of the three contains its own start marker as a substring — `# end\n * reddoor-maint …` never yields `# reddoor-maint …` — which is what keeps\n * `indexOf(marker)` from anchoring the region on its own terminator. A test\n * asserts it in both directions.\n */\nexport const GITIGNORE_END_MARKER = \"# end reddoor-maint match-harness\";\nexport const PRETTIERIGNORE_END_MARKER = \"# end reddoor-maint match-harness\";\nexport const CLAUDE_MD_END_MARKER = \"<!-- end reddoor-maint match-harness -->\";\n\n/** The three files the recipe APPENDS a marked block to rather than writing whole. */\nconst APPENDED_BLOCKS = [\n  [\".gitignore\", GITIGNORE_MARKER, GITIGNORE_END_MARKER, GITIGNORE_BLOCK],\n  [\".prettierignore\", PRETTIERIGNORE_MARKER, PRETTIERIGNORE_END_MARKER, PRETTIERIGNORE_BLOCK],\n  [\"CLAUDE.md\", CLAUDE_MD_MARKER, CLAUDE_MD_END_MARKER, CLAUDE_MD_BLOCK],\n] as const;\n\n/**\n * Every path the installed harness requires to be IN THE COMMIT — deliberately\n * the whole manifest, NOT the paths written on this run. A re-run skips every\n * file already byte-correct on disk, so a check over the written delta would\n * find nothing missing and report a second hollow \"applied\" over the same\n * half-install.\n */\nexport const MATCH_HARNESS_INSTALLED_PATHS: readonly string[] = [\n  ...MATCH_HARNESS_FILES.map((f) => f.rel),\n  ...APPENDED_BLOCKS.map(([rel]) => rel),\n];\n\n/**\n * Installs the matching harness into a site: the dev-guarded `/dev/match/[uid]`\n * route, a `site-pages.js` scaffold and its fixture-vs-model test,\n * `matching/harness.json` + the read layer, the round scripts, the site records,\n * and the `.gitignore` / `.prettierignore` / `CLAUDE.md` blocks.\n *\n * Install-if-absent throughout. Files a site edits are never rewritten. A\n * recipe-owned script that matches a previously shipped render is safe-replaced;\n * one that has been hand-edited is FLAGGED in the notes and left alone.\n *\n * ONE EXCEPTION TO PER-FILE INDEPENDENCE: the scripts in MATCH_HARNESS_COUPLED\n * upgrade as a SET. If any one of them is hand-edited, none of them is written,\n * because gate.sh calls `harness.mjs --check-run` and next.mjs imports from\n * harness.mjs — upgrading the others around a pinned one leaves a harness that\n * cannot run at all. See the measurement on MATCH_HARNESS_COUPLED.\n */\nexport async function matchHarness(\n  site: Site,\n  opts: MatchHarnessOptions,\n  deps: MatchHarnessDeps = { spawn: defaultSpawn },\n): Promise<RecipeResult> {\n  return withRecipe<Plan>({\n    name: \"match-harness\",\n    site,\n    plan: async () => {\n      if (!opts.ref || !/^https?:\\/\\//.test(opts.ref)) {\n        return {\n          kind: \"failed\",\n          notes:\n            \"--ref <url> is required: the harness gates against a live reference, and a harness with no reference can only ever report an absence of errors\",\n        };\n      }\n      return {\n        kind: \"apply\",\n        plan: {\n          ref: opts.ref.replace(/\\/$/, \"\"),\n          cand: opts.cand ?? \"http://localhost:5173\",\n          matrix: opts.matrix ?? [1440, 834, 390],\n        },\n      };\n    },\n    apply: async (planned, { commit, cwd }) => {\n      const notes: string[] = [];\n      const written: string[] = [];\n      /** For every path this run writes: what was there BEFORE (null = the file\n       *  did not exist). The refusal below restores from this, so a refused run\n       *  leaves the checkout byte-identical to how it found it. */\n      const before = new Map<string, string | null>();\n      const previousAll = deps.previous ?? MATCH_HARNESS_PREVIOUS;\n      const blockPreviousAll = deps.blockPrevious ?? MATCH_HARNESS_BLOCK_PREVIOUS;\n\n      // PASS 1 — decide everything, write nothing. The coupled-set demotion\n      // below needs the whole picture before the first byte is written.\n      type Planned = {\n        f: (typeof MATCH_HARNESS_FILES)[number];\n        template: string;\n        existing: string | null;\n        action: ReturnType<typeof planFileWrite>;\n      };\n      const plans: Planned[] = [];\n      for (const f of MATCH_HARNESS_FILES) {\n        const target = join(cwd, f.rel);\n        let template = f.template;\n        if (f.rel === HARNESS_JSON_RELATIVE) {\n          // Patch the PARSED object, never the text. The seed is pretty-printed\n          // two-space JSON, so `matrix` renders as a four-line exploded array\n          // and the literal \"[1440, 834, 390]\" does not occur — a string\n          // replace on it is a no-op that drops --matrix with no error.\n          const seed = JSON.parse(template) as Record<string, unknown>;\n          seed.ref = planned.ref;\n          seed.cand = planned.cand;\n          seed.matrix = planned.matrix;\n          template = JSON.stringify(seed, null, 2) + \"\\n\";\n        }\n        const existing = await readIfExists(target);\n        plans.push({\n          f,\n          template,\n          existing,\n          action: planFileWrite(existing, template, f.owner, previousAll[f.rel] ?? []),\n        });\n      }\n\n      // The coupled set moves together or not at all. Two deliberate limits,\n      // both of them the difference between a guard and an outage:\n      //\n      // ONLY `flag` demotes. `skip` means the file is already byte-correct, and\n      // treating that as a flag would make every re-run refuse itself and the\n      // recipe permanently inert — the demotion's own failure mode is\n      // OVER-refusal, so its test has to GRANT an upgrade, not merely deny one.\n      //\n      // ONLY `replace` is demoted. A file that is ABSENT cannot be \"left\n      // alone\": there is nothing to preserve, and skipping the write leaves the\n      // site with no harness at all rather than an old one. The hazard being\n      // guarded is upgrading HALF of an installed set past a pinned member;\n      // writing a missing file is the only action that makes the set exist.\n      // (Measured: demoting `write` too broke a fresh install alongside one\n      // hand-edited script — 16 files silently unwritten, then a failed run.)\n      const coupled = new Set(MATCH_HARNESS_COUPLED);\n      const blockedBy = plans\n        .filter((p) => coupled.has(p.f.rel) && p.action === \"flag\")\n        .map((p) => p.f.rel);\n      const demoted = plans.filter(\n        (p) => coupled.has(p.f.rel) && p.action === \"replace\" && !blockedBy.includes(p.f.rel),\n      );\n      if (blockedBy.length > 0 && demoted.length > 0) {\n        for (const p of demoted) p.action = \"flag\";\n        notes.push(\n          `${blockedBy.join(\", \")} differs from the shipped template, so the whole coupled set ` +\n            `was left alone: ${MATCH_HARNESS_COUPLED.join(\", \")} upgrade together. ` +\n            `matching/gate.sh calls \\`harness.mjs --check-run\\` and matching/next.mjs imports from ` +\n            `harness.mjs, so upgrading one without the others leaves a harness that cannot run.`,\n        );\n      }\n\n      // PASS 2 — write.\n      const demotedRels = new Set(demoted.map((p) => p.f.rel));\n      for (const { f, template, existing, action } of plans) {\n        if (action === \"flag\") {\n          if (demotedRels.has(f.rel)) continue; // named in the set note above\n          notes.push(\n            `${f.rel} differs from the shipped template and was left alone (hand-edited?)`,\n          );\n          continue;\n        }\n        if (action === \"skip\") continue;\n        const target = join(cwd, f.rel);\n        await mkdir(dirname(target), { recursive: true });\n        before.set(f.rel, existing);\n        await writeFile(target, template, \"utf-8\");\n        written.push(f.rel);\n        if (action === \"replace\") notes.push(`${f.rel} upgraded from a previous version`);\n      }\n\n      // Three appended blocks, each a delimited region that is replaced in\n      // place when its body is one this recipe shipped, and flagged — never\n      // overwritten — when it is anything else.\n      for (const [rel, marker, endMarker, block] of APPENDED_BLOCKS) {\n        const path = join(cwd, rel);\n        const existing = await readIfExists(path);\n        const plan = planBlockWrite(\n          existing,\n          marker,\n          endMarker,\n          block,\n          blockPreviousAll[rel] ?? [],\n        );\n        if (plan.action === \"skip\") continue;\n        if (plan.action === \"flag\") {\n          // Never enters `written`: not formatted, and not restored by the\n          // refusal path below, because this run did not touch it.\n          notes.push(\n            `${rel} carries a match-harness block that differs from every block this recipe has shipped, and was left alone (hand-edited?)`,\n          );\n          continue;\n        }\n        before.set(rel, existing);\n        await writeFile(path, plan.content, \"utf-8\");\n        written.push(rel);\n        if (plan.action === \"replace\")\n          notes.push(`${rel}'s match-harness block upgraded from a previous version`);\n        if (plan.action === \"terminate\")\n          notes.push(\n            `${rel}'s match-harness block region was terminated so a future version can update it`,\n          );\n      }\n\n      // Format only what the SITE owns, decided by OWNERSHIP and never by path.\n      // A recipe-owned file that a site's prettier reformats is indistinguishable\n      // from a hand edit on the next install, so planFileWrite flags it and the\n      // recipe can never upgrade it again. A path prefix cannot express that:\n      // three recipe-owned files live under src/. This is an ALLOW-list on\n      // purpose — a file added to MATCH_HARNESS_FILES is not formatted until its\n      // owner says \"site\", because the unsafe default is silent and permanent.\n      // The same files are in the .prettierignore block written above, which\n      // stops the site's OWN `prettier --write .` from doing the identical\n      // damage; that block and this filter must agree, and a test asserts it.\n      // CLAUDE.md is not in the file table — it is an append into a file the\n      // site owns — so it is named here.\n      const siteOwned = new Set(\n        MATCH_HARNESS_FILES.filter((f) => f.owner === \"site\").map((f) => f.rel),\n      );\n      const toFormat = written.filter((p) => siteOwned.has(p) || p === \"CLAUDE.md\");\n\n      // Run the SITE's own prettier, resolved POSITIVELY and invoked by absolute\n      // path. `pnpm exec prettier` here would first run a full, unbounded\n      // `pnpm install` in the client's checkout — which on `--fleet` is the\n      // NORMAL path, because `prepareFleetSites` clones and never installs — and\n      // would then, in a repo whose install left no prettier of its own, fall\n      // through to the CALLING repo's binary and exit 0, reporting success for a\n      // format the target never did. A `true` from here must mean the target's\n      // own prettier ran, so nothing about which binary runs is left to\n      // resolution.\n      if (toFormat.length > 0) {\n        const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(cwd);\n        if (bin === null) {\n          notes.push(PRETTIER_FLAG_NOTE);\n        } else if (\n          !(await formatWithPrettier(deps.spawn, cwd, toFormat, {\n            bin,\n            timeoutMs: PRETTIER_TIMEOUT_MS,\n          }))\n        ) {\n          notes.push(PRETTIER_FLAG_NOTE);\n        }\n      }\n\n      await commit(\n        \"feat: install the matching harness (/dev/match route + matching/ gate scripts)\",\n      );\n\n      // POSITIVE EVIDENCE that the install is real: every installed path is\n      // FOUND in HEAD's tree. `git add -A` honours the site's .gitignore and\n      // exits 0 either way, and git cannot re-include a file whose PARENT\n      // DIRECTORY is excluded — so a site that already ignores `matching/`\n      // (or `**/matching/`, `/matching`, `src/lib/site-pages.js`, …) gets the\n      // files on disk, nothing in the commit, and — before this check — a\n      // result of \"applied\", plus 83 lines of CLAUDE.md rules naming scripts\n      // that exist on no other machine.\n      const missing = await pathsMissingFromHead(cwd, MATCH_HARNESS_INSTALLED_PATHS);\n      if (missing.length > 0) {\n        const rules = await ignoreRulesFor(cwd, missing);\n        const sources = [...new Set(rules.map((r) => r.split(\"\\t\")[0]!))];\n        const explained = new Set(rules.map((r) => r.split(\"\\t\")[1] ?? \"\"));\n        const unexplained = missing.filter((p) => !explained.has(p));\n\n        // Put the checkout back exactly as we found it. Only paths THIS RUN\n        // wrote and git then refused are touched: one that reached the commit\n        // is left to withRecipe's force-checkout, and one we never wrote is\n        // never ours. `git checkout -f` cannot do this job — these paths are\n        // ignored, so git does not know they exist.\n        const removed: string[] = [];\n        for (const rel of written.filter((p) => missing.includes(p))) {\n          const prev = before.get(rel);\n          if (prev === undefined) continue;\n          if (prev === null) {\n            await rm(join(cwd, rel), { force: true });\n            removed.push(rel);\n          } else {\n            await writeFile(join(cwd, rel), prev, \"utf-8\");\n          }\n        }\n        // Deepest-first, so `matching/spec-sections` goes before `matching`.\n        // rmdir refuses a non-empty directory, which is exactly the guard wanted.\n        for (const d of [...new Set(removed.map(dirname))].sort((a, b) => b.length - a.length)) {\n          if (d !== \".\") await rmdir(join(cwd, d)).catch(() => undefined);\n        }\n\n        return {\n          kind: \"failed\",\n          notes:\n            `the harness was NOT installed: ${missing.length} of ${MATCH_HARNESS_INSTALLED_PATHS.length} paths git refused to track, so a fresh clone, CI and the next agent get a harness that does not exist. ` +\n            `Absent from the commit: ${missing.join(\", \")}. ` +\n            (sources.length > 0\n              ? `Excluded by ${sources.join(\", \")} — narrow or remove those rules and re-run. `\n              : \"\") +\n            (unexplained.length > 0\n              ? `No ignore rule matched ${unexplained.join(\", \")} — check .git/info/exclude, core.excludesFile, and whether the directory is a nested repository. `\n              : \"\") +\n            \"Everything this run wrote to those paths has been put back as it was.\",\n        };\n      }\n\n      return notes.length > 0 ? { kind: \"ok\", notes: notes.join(\"; \") } : { kind: \"ok\" };\n    },\n  });\n}\n","// GENERATED by scripts/gen-match-harness-template.mjs. Do NOT hand-edit the\n// string bodies — regenerate. Seven constants are byte-copies of a site with\n// the consolidated harness; the rest are stubs authored in the generator.\n\nexport type OwnedBy = \"recipe\" | \"site\";\nexport type HarnessFile = { rel: string; template: string; owner: OwnedBy };\n\nexport const HARNESS_MJS_RELATIVE = \"matching/harness.mjs\";\nexport const HARNESS_MJS_TEMPLATE = `// The single source for everything the matching gates need to know about this\n// site. DATA lives in matching/harness.json (site-edited); this file is the\n// READ LAYER — edit harness.json, not this. (It is installed and upgraded by\n// the \\`reddoor-maint match-harness\\` recipe, which owns these bytes: a hand\n// edit here is flagged on the next run and never silently overwritten.)\n//\n// It exists because the page table, the two hosts, the matrix, the threshold\n// and the skill path were hand-copied all over matching/. Re-measured\n// 2026-09-09 AFTER the six-probe conversion, over the 216 tracked scripts under\n// matching/ (214 top-level — 212 .mjs + 2 .sh — plus 2 in states/):\n//\n//   • a hand-typed copy of the page table (three or more gate keys sitting next\n//     to their route): 8 files. Exactly ONE of them, probe-chrome-count.mjs,\n//     still carries all nine rows; probe-anchors.mjs carries five; the other\n//     six are three-row detail triples (team/svc/qa).\n//   • the skill path (~/.claude/skills/matching-a-page): 193 copies\n//   • the viewport matrix (1440/834/390): 51 copies\n//   • REF pointed at a host listed in selfHosts — i.e. comparing the candidate\n//     with itself: 12 scripts, one of which (probe-chrome-count.mjs) is also\n//     the last nine-row table carrier\n//\n// The first bullet read \"the nine-row page table: 5 copies — gate.sh,\n// probe-anchor-parity.mjs, sweep-all10.sh, sweep-all16.sh, sweep-final.sh\" when\n// it was written here at 922dde3. It was wrong within the hour and wrong on two\n// counts: 4e2cd7b took the table out of gate.sh, and the list never named\n// states/index.mjs or probe-chrome-count.mjs, which were both carrying nine-row\n// copies at the time. A census is a claim about code; it has to be measured\n// against the tree, not recalled.\n//\n//   node matching/harness.mjs --env        shell-safe KEY='value' lines\n//   node matching/harness.mjs --table      key<TAB>ref<TAB>cand<TAB>anchors\n//   node matching/harness.mjs --check-ref  the D11 preflight; exit 2 on failure\n//   node matching/harness.mjs --check-run <page> <out-dir> <startedAt-iso>\n//                                         did THIS run leave a countable report?\n//                                         exit 2 when it did not\nimport { readFileSync, realpathSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\n\n// fileURLToPath, not URL#pathname: pathname is percent-encoded, so a checkout\n// under a directory with a space in it would resolve to a path that does not\n// exist.\nconst DIR = fileURLToPath(new URL(\".\", import.meta.url));\nconst CFG = JSON.parse(readFileSync(join(DIR, \"harness.json\"), \"utf8\"));\n\n// Env overrides exist for one-off probes only. They are NOT how a site is\n// configured — harness.json is, so that what a gate ran against is committed.\nexport const REF = process.env.MATCH_REF ?? CFG.ref;\nexport const CAND = process.env.MATCH_CAND ?? process.env.CAND_BASE ?? CFG.cand;\nexport const MATRIX = CFG.matrix;\nexport const THRESHOLD = CFG.threshold;\nexport const MAX_HEIGHT_DELTA = CFG.maxHeightDelta;\nexport const REF_MARK = CFG.refMark;\nexport const CAND_MARK = CFG.candMark;\nexport const SELF_HOSTS = CFG.selfHosts ?? [];\n\n/** One record per gated page, in harness.json order. \\`key\\` is the gate key\n *  (out-<TAG>-<key>, the SPEC heading, spec-sections/<key>.md); \\`uid\\` is the\n *  Prismic uid or null where the page has no /dev/match twin. */\nexport const PAGES = Object.entries(CFG.pages).map(([key, p]) => ({ key, ...p }));\nexport const byKey = Object.fromEntries(PAGES.map((p) => [p.key, p]));\n\n/** Can this page's region count be PREDICTED at all? It needs anchors — see\n *  TOTALS below — AND a matrix to measure them at. Exported beside TOTALS\n *  rather than left for each consumer to re-derive, because \"remember to ask\n *  first\" is exactly what failed: checkRun remembered, next.mjs did not, for\n *  two releases.\n *\n *  \\`MATRIX.length > 0\\` is not defensive padding. TOTALS is\n *  \\`(anchors + 1) * MATRIX.length\\`, so an ANCHORED page with \\`matrix: []\\`\n *  yields 0 — truthy-adjacent, arithmetically fatal. Measured on a page with 3\n *  anchors, an empty matrix and 8 passing regions: without this clause the\n *  scorer printed \\`SCORE 8/0 regions passing\\` and \\`Backlog is empty — Phases 5\n *  and 6 are what is left\\`, exit 0. The absurd fraction would be questioned;\n *  the sentence would not. \\`pass/0\\` is also Infinity, so such a page sorts\n *  BEST and can never be named \\`worst\\` — the same ranking bug this change set\n *  removed for unanchored pages, one input along. */\nexport const scorable = (key) =>\n  (byKey[key]?.anchors?.length ?? 0) > 0 && MATRIX.length > 0;\n\n/** WHY a page is not scorable, in the words of the thing that is actually\n *  missing. A refusal that states a cause it did not check is the shape\n *  CLAUDE.md names: a field must never be named after something it cannot\n *  observe. \"no anchors\" printed for a page carrying three of them sends the\n *  operator to edit the one part of harness.json that was already right. */\nexport const unscorableWhy = (key) =>\n  (byKey[key]?.anchors?.length ?? 0) === 0\n    ? \"no anchors\"\n    : MATRIX.length === 0\n      ? \"matrix is empty\"\n      : null;\n\n// DERIVED, never hand-typed: page-diff cuts one region before the first anchor\n// (\"top\") plus one per anchor, at every viewport. The old hand-written map went\n// stale the moment an anchor list changed, and a wrong denominator makes the\n// score a lie in the flattering direction.\n//\n// THAT IDENTITY HOLDS ONLY WITH ANCHORS. \\`splitRegions\\` (page-diff.mjs:103-110)\n// only cuts by anchor when there are anchors to cut by; with none it falls back\n// to the page's own <section> boxes, and with none of those to an even four-row\n// grid (lib/regions.mjs:27-35, gridRows = 4, labels \\`grid-<r>-<c>\\`). So the\n// count is DATA-DEPENDENT, the two pages need not even agree, and no formula\n// over anchors can predict it.\n//\n// \\`checkRun\\` below already reaches this conclusion — its \\`if (secs.length)\\`\n// guard declines to assert a region count without anchors, and says why. That\n// fix was applied to the VALIDATOR and never carried to the DENOMINATOR, so\n// next.mjs went on dividing a real pass count by an imaginary total. Measured\n// 2026-09-09 on a seed harness (anchors: [], matrix of 3): page-diff produced\n// 12 grid regions, all passing, and next.mjs printed \\`SCORE 12/3 regions\n// passing\\` followed by \"Backlog is empty — Phases 5 and 6 are what is left\",\n// exit 0. On a matrix of 4 the same seed prints \\`SCORE 16/4\\`. The absurd\n// fraction would have been questioned; the sentence would not.\n//\n// So an unpredictable page gets NO NUMBER — \\`null\\`, not a plausible-looking\n// integer. That is a SIGNAL, not a barrier: \\`a + null\\` is \\`a\\`, so a consumer\n// that sums TOTALS without asking \\`scorable()\\` still gets a too-small\n// denominator. The barrier is \\`scorable()\\` plus next.mjs's exit-2 refusal.\nexport const TOTALS = Object.fromEntries(\n  PAGES.map((p) => [p.key, scorable(p.key) ? (p.anchors.length + 1) * MATRIX.length : null]),\n);\n\n/** The SPEC.md heading predicate, shared by gate.sh's preflight and\n *  build-spec.mjs so a section can never build fine and then refuse at the\n *  gate. Matches the key followed by any non-key character (\\`## team\\` matches,\n *  \\`## teamfoo\\` does not, \\`## our-team\\` cannot match \\`team\\`). */\nexport const specHeadingRe = (key) => new RegExp(\\`^##+ +\\${key}([^A-Za-z0-9_-]|$)\\`, \"m\");\n\nexport const SKILL_DIR =\n  process.env.MATCHING_SKILL_DIR ?? join(homedir(), \".claude/skills/matching-a-page\");\nexport const PD = join(SKILL_DIR, \"page-diff.mjs\");\nexport const SC = join(SKILL_DIR, \"style-census.mjs\");\nexport const PLAYWRIGHT = pathToFileURL(join(SKILL_DIR, \"node_modules/playwright/index.mjs\")).href;\n\n/** The report format this site's scripts can read, so gate.sh can compare it\n *  with \\`page-diff --version\\` before spending a run and next.mjs can refuse\n *  rather than quietly drop a page whose newest report came from another\n *  schema. Both do that now — gate.sh preflights \\`page-diff --version\\` against\n *  this value before spending a run, and next.mjs counts a foreign-schema\n *  report as MISSING rather than skipping it. (This said \"neither does that\n *  yet\" — true at 922dde3 where it was written, false from 4e2cd7b, which\n *  gave gate.sh the preflight and did not come back here.) Checked 2026-09-09\n *  against the installed skill: \\`page-diff --version\\` → \\`page-diff 0.1.0\n *  report-schema 1\\`. */\nexport const REPORT_SCHEMA = 1;\n\n/**\n * Fail-closed reference preflight. A 200 is NOT evidence: a host that has been\n * repointed at our own build answers 200, and so does a staging host serving a\n * 404 page. Both have happened on a real site — see the dated measurement in\n * LEDGER.md. A pass here requires an artefact only the reference produces.\n */\nexport async function checkRef() {\n  if (!REF_MARK) {\n    return {\n      ok: false,\n      why: \"harness.json refMark is empty — set it to a string only the reference serves (a Webflow site id, a build hash). A 200 is not evidence.\",\n    };\n  }\n  const host = new URL(REF).host;\n  if (SELF_HOSTS.includes(host)) return { ok: false, why: \\`REF host \\${host} is in selfHosts\\` };\n  if (host === new URL(CAND).host) return { ok: false, why: \\`REF host \\${host} equals CAND's host\\` };\n  let res;\n  try {\n    res = await fetch(\\`\\${REF}/\\`, { redirect: \"manual\" });\n  } catch (e) {\n    return { ok: false, why: \\`GET \\${REF}/ failed: \\${e.message}\\` };\n  }\n  if (res.status !== 200)\n    return { ok: false, why: \\`GET \\${REF}/ → HTTP \\${res.status}, expected 200\\` };\n  const loc = res.headers.get(\"location\");\n  if (loc) return { ok: false, why: \\`GET \\${REF}/ → \\${res.status} redirect to \\${loc}\\` };\n  const body = await res.text();\n  if (!body.includes(REF_MARK))\n    return {\n      ok: false,\n      why: \\`\\${REF}/ served 200 but WITHOUT refMark \\${JSON.stringify(REF_MARK)} — that is not the reference\\`,\n    };\n  if (CAND_MARK && body.includes(CAND_MARK))\n    return {\n      ok: false,\n      why: \\`\\${REF}/ contains candMark \\${JSON.stringify(CAND_MARK)} — REF is serving OUR build\\`,\n    };\n  return { ok: true, why: \\`\\${REF}/ → 200, no redirect, refMark present, candMark absent\\` };\n}\n\n/**\n * Would next.mjs COUNT a run with this meta? Returns the reason it would not,\n * as a string, or null when it would.\n *\n * A reason string and not a boolean, because the two callers must tell the\n * cases apart: next.mjs treats \"schema\" as a page BLANKED (it has its own\n * message and its own exit) and merely skips the rest of the diagnostics,\n * while gate.sh prints whatever this says.\n *\n * It lives HERE rather than inside next.mjs because gate.sh now asks the same\n * question, and a question asked twice drifts: a gate that greens a run\n * next.mjs then drops is the same false green one step along. census.sh's\n * GUARD 2c (census.sh:153-168) records exactly that drift between\n * style-census's printer and census-count.mjs's parser — a COMPLETE census\n * reported as 0 mismatches because the two had versioned apart.\n */\nexport function uncountable(m) {\n  // Missing schemaVersion means \"written before the field existed\" = 0. It is\n  // not an error on its own; it is only fatal when it would blank a page,\n  // which is next.mjs's call to make, not this predicate's.\n  if ((m.schemaVersion ?? 0) !== REPORT_SCHEMA) return \"schema\";\n  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the\n  // page. An --mask-photos probe of yfv made \\`top\\` @834 read 43.9% while the\n  // real gate had it passing at 1.3%.\n  if ((m.mask?.length ?? 0) > 0) return \\`mask=[\\${m.mask.join(\", \")}]\\`;\n  if (m.neutralizeMedia) return \"neutralize-media\";\n  if (m.maskPhotos) return \"mask-photos\";\n  if (m.truncated) return \"truncated\";\n  if (m.threshold !== THRESHOLD) return \\`threshold \\${m.threshold} != \\${THRESHOLD}\\`;\n  return null;\n}\n\n/**\n * Did THIS run of page-diff leave a report the scorer will actually count?\n *\n * gate.sh cannot use page-diff's exit status for this. page-diff exits 1 for a\n * region that legitimately FAILED (page-diff.mjs:227) and node exits 1 for the\n * bare \\`throw e\\` one line below it, so the status cannot tell a finding from a\n * crash-before-looking — census.sh:17-32 records the same shape for\n * style-census. Measured on 29 Navy with the reference alive and no dev\n * server: every page-diff died in \\`page.goto\\`, the gate printed \\`home exit=1\\`\n * and \\`ALL DONE\\`, exited 0, and wrote no report at all.\n *\n * So the evidence is the artefact only a completed run leaves: the report\n * next.mjs will read, fresh, over the matrix and anchors the table declares.\n * Cheapest and most specific arm first.\n */\nexport function checkRun(page, dir, startedAt) {\n  const path = join(dir, \"report.json\");\n  let report;\n  try {\n    report = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch (e) {\n    if (e.code === \"ENOENT\")\n      return { ok: false, why: \\`\\${path}: no report.json — the run wrote nothing\\` };\n    return { ok: false, why: \\`\\${path}: \\${e.message}\\` };\n  }\n  const meta = report.meta ?? {};\n\n  const uncount = uncountable(meta);\n  if (uncount)\n    return { ok: false, why: \\`\\${path}: next.mjs would not count this run (\\${uncount})\\` };\n\n  // FRESHNESS. lib/report.mjs:45 is \\`mkdirSync(outDir, {recursive:true})\\` and\n  // nothing ever clears the directory, so a crashed re-run under a tag used\n  // before leaves the PREVIOUS round's report exactly where it was — measured\n  // 2026-09-09, sha unchanged across the crash. Requiring report.json without\n  // this arm reproduces the green one step along. meta.generatedAt is built\n  // after \\`finally { await browser.close() }\\` (page-diff.mjs:163-176), so it\n  // is an artefact of the run that wrote it and not of the file's mtime.\n  const since = Date.parse(startedAt);\n  // NOT skipped when startedAt is unusable: a fail-open default is the exact\n  // shape this guard exists to stop.\n  if (!Number.isFinite(since))\n    return {\n      ok: false,\n      why: \\`startedAt \\${JSON.stringify(startedAt)} is not a timestamp — cannot tell this run's report from a previous round's\\`,\n    };\n  const at = Date.parse(meta.generatedAt ?? \"\");\n  if (!Number.isFinite(at))\n    return {\n      ok: false,\n      why: \\`\\${path}: no usable meta.generatedAt — cannot tell this run's report from a previous round's\\`,\n    };\n  if (at < since)\n    return {\n      ok: false,\n      why: \\`\\${path}: STALE — written \\${meta.generatedAt}, this run started \\${startedAt}. page-diff never cleared the directory.\\`,\n    };\n\n  // COVERAGE — what the run was ASKED for, against the table.\n  const vws = meta.viewports ?? [];\n  if (vws.join(\",\") !== MATRIX.join(\",\"))\n    return {\n      ok: false,\n      why: \\`\\${path}: ran viewports [\\${vws.join(\",\")}], harness.json matrix is [\\${MATRIX.join(\",\")}]\\`,\n    };\n  const secs = meta.sections ?? [];\n  const want = byKey[page]?.anchors ?? [];\n  if (secs.join(\"\\\\0\") !== want.join(\"\\\\0\"))\n    return {\n      ok: false,\n      why: \\`\\${path}: ran sections [\\${secs.join(\" | \")}], harness.json anchors are [\\${want.join(\" | \")}]\\`,\n    };\n\n  // ...and what it actually PRODUCED. Every viewport the run says it covered\n  // has to appear in the regions. Deliberately compared against the run's own\n  // meta.viewports and not against MATRIX: the arm above owns \"the run used the\n  // wrong matrix\", and folding the two together would make either one\n  // unfalsifiable on its own.\n  if (!Array.isArray(report.regions) || report.regions.length === 0)\n    return { ok: false, why: \\`\\${path}: no regions — nothing was compared\\` };\n  const seen = new Set(report.regions.map((r) => r.viewport));\n  const missing = vws.filter((v) => !seen.has(v));\n  if (missing.length)\n    return {\n      ok: false,\n      why: \\`\\${path}: no region at viewport(s) [\\${missing.join(\",\")}] — the run covered [\\${[...seen].join(\",\")}]\\`,\n    };\n\n  // With anchors the region count is an exact identity: page-diff cuts one\n  // region before the first anchor plus one per anchor, at every viewport\n  // (regionsFromAnchors, page-diff.mjs:105-109). Measured over the 298 clean\n  // gate-shaped runs in the corpus this harness was cut from, all of them\n  // anchored: regions.length === (sections + 1) * viewports holds 298/298,\n  // while regions.length === TOTALS[page] holds only 260/298 — the 38 are\n  // legitimately narrower HAND rounds. So the identity is checked against the\n  // run's OWN meta and the matrix/anchors are checked against the table above.\n  //\n  // WITHOUT anchors there is no such identity, and asserting one is a FALSE\n  // REFUSAL of the shape every new site starts in. page-diff falls back to each\n  // page's own <section> boxes and, with none, an even four-row grid\n  // (splitRegions, page-diff.mjs:103-110), so the count is data-dependent and\n  // the two pages need not even agree. Measured 2026-09-09 against the real\n  // page-diff on a seed harness (anchors: [], matrix of 4): 16 regions labelled\n  // grid-0-0 … grid-3-0, not the 4 this identity predicted. The 298/298 above\n  // was measured over anchored runs only and never covered this case.\n  if (secs.length) {\n    const expected = (secs.length + 1) * vws.length;\n    if (report.regions.length !== expected)\n      return {\n        ok: false,\n        why: \\`\\${path}: \\${report.regions.length} region(s), expected \\${expected} = (\\${secs.length} anchors + 1) x \\${vws.length} viewport(s)\\`,\n      };\n  }\n\n  // A green that STATES what it is made of, so a green over nothing reads\n  // differently from a green over the matrix (census.sh:219's habit).\n  return {\n    ok: true,\n    why: \\`\\${report.regions.length} region(s) over \\${vws.length} viewport(s), written \\${meta.generatedAt}\\`,\n  };\n}\n\n// CLI. Both sides go through realpathSync. \\`import.meta.url\\` is ALREADY the\n// resolved real path (node resolves symlinks unless --preserve-symlinks) while\n// process.argv[1] is the path as typed, so a plain pathToFileURL compare goes\n// false the moment any component of the invoked path is a symlink — and then\n// the CLI prints nothing and exits 0, which every caller reads as success.\n// page-diff.mjs:184-189 records exactly that defect and the same fix: \"The\n// pathToFileURL compare that replaced the old template string is still false\n// whenever ANY component of the invoked path is a symlink — which is how this\n// skill is installed now (~/.claude/skills/matching-a-page -> the claude-skills\n// checkout). isMain() resolves the real path on both sides.\"\nconst isMain = () => {\n  if (!process.argv[1]) return false;\n  try {\n    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);\n  } catch {\n    return false;\n  }\n};\n\nif (isMain()) {\n  const mode = process.argv[2];\n  const q = (v) => \\`'\\${String(v).replace(/'/g, \\`'\\\\\\\\''\\`)}'\\`;\n  if (mode === \"--env\") {\n    const pairs = [\n      [\"REF\", REF],\n      [\"CAND\", CAND],\n      [\"MATRIX\", MATRIX.join(\",\")],\n      [\"VIEWPORTS_SP\", MATRIX.join(\" \")],\n      [\"THRESHOLD\", THRESHOLD],\n      [\"MAX_HEIGHT_DELTA\", MAX_HEIGHT_DELTA],\n      [\"PD\", PD],\n      [\"SC\", SC],\n      [\"REPORT_SCHEMA\", REPORT_SCHEMA],\n    ];\n    for (const [k, v] of pairs) console.log(\\`\\${k}=\\${q(v)}\\`);\n  } else if (mode === \"--table\") {\n    for (const p of PAGES) console.log([p.key, p.ref, p.cand, p.anchors.join(\",\")].join(\"\\\\t\"));\n  } else if (mode === \"--check-ref\") {\n    const r = await checkRef();\n    console.log(\\`\\${r.ok ? \"REF OK\" : \"REF REFUSED\"} — \\${r.why}\\`);\n    process.exit(r.ok ? 0 : 2);\n  } else if (mode === \"--check-run\") {\n    // startedAt is REQUIRED, never defaulted: an optional one is a fail-open\n    // door in the one guard that decides whether a page was measured at all.\n    const [page, dir, startedAt] = process.argv.slice(3);\n    if (!page || !dir || !startedAt) {\n      console.error(\"usage: harness.mjs --check-run <page> <out-dir> <startedAt-iso>\");\n      process.exit(2);\n    }\n    const r = checkRun(page, dir, startedAt);\n    console.log(\\`\\${r.ok ? \"RUN OK\" : \"NO RUN\"} — \\${r.why}\\`);\n    process.exit(r.ok ? 0 : 2);\n  } else {\n    console.error(\"usage: harness.mjs --env | --table | --check-ref | --check-run\");\n    process.exit(2);\n  }\n}\n`;\n\nexport const GATE_SH_RELATIVE = \"matching/gate.sh\";\nexport const GATE_SH_TEMPLATE = `#!/usr/bin/env bash\n# The matching gate. This file is generic — everything specific to a site lives\n# in matching/harness.json (the data) and matching/LEDGER.md (the why). It is\n# installed and upgraded by the \\`reddoor-maint match-harness\\` recipe, which\n# owns these bytes: a hand edit here is flagged on the next run, never\n# silently overwritten.\n#\n#   bash matching/gate.sh <round-tag> [page ...]\n#\n# Runs page-diff for every page in the table (or just the named ones) at the\n# full breakpoint matrix and writes matching/out-<round-tag>-<page>/.\n#\n# The matrix, the anchor lists, the reference and the candidate are DATA. Why a\n# site chose them — which live breakpoint band hid what, why an anchor is a\n# heading and not a button label — belongs in matching/LEDGER.md, which is dated\n# and append-only, because JSON holds no comments.\n#\n# NO MASKS and the threshold from harness.json everywhere: the numbers stay\n# honest and a known floor stays visible as its own region. A media-neutralised\n# secondary read is \\`node \"$PD\" ... --neutralize-media\\`; next.mjs ignores such\n# runs on purpose (next.mjs:57-64).\n#\n# PREFLIGHT (see the matching rules in CLAUDE.md): a page with no section in\n# matching/SPEC.md has not had Phase 1 done, and its geometry must not be\n# touched. Skipping the spec is how a reference's root-font ladder and its\n# per-component height ladders get found reactively, after the region has\n# already failed several rounds. This refuses the run instead of trusting anyone\n# to remember.\nset -u\n# Everything configurable lives in matching/harness.json; harness.mjs is the one\n# reader. --env emits shell-safe assignments (REF, CAND, MATRIX, VIEWPORTS_SP,\n# THRESHOLD, MAX_HEIGHT_DELTA, PD, SC, REPORT_SCHEMA).\neval \"$(node \"$(dirname \"$0\")/harness.mjs\" --env)\"\n\n# The skill must be able to write reports this site's scripts can read. Cheap,\n# local, and it fails before any browser starts.\nPD_SCHEMA=\"$(node \"$PD\" --version 2>/dev/null | awk '{print $4}')\"\nif [ \"$PD_SCHEMA\" != \"$REPORT_SCHEMA\" ]; then\n  echo \"gate.sh: page-diff writes report schema '\\${PD_SCHEMA:-none}', this harness reads $REPORT_SCHEMA.\" >&2\n  echo \"         Update matching/harness.mjs REPORT_SCHEMA or the matching-a-page skill.\" >&2\n  exit 2\nfi\nSPEC=\"$(dirname \"$0\")/SPEC.md\"\nTAG=\"\\${1:?usage: gate.sh <round-tag> [page ...]}\"\n# The tag must not contain a hyphen. Output dirs are \"out-<TAG>-<page>\", and\n# next.mjs recovers the page with /^out-[^-]+-(.+)$/ — it splits on the FIRST\n# hyphen, so a tag like \"r-forms-2026-08-07\" yields the page key\n# \"forms-2026-08-07-yfv\" and that run is silently never counted. It cannot split\n# on the last hyphen instead, because page keys have hyphens of their own\n# (\"our-team\", \"ask-the-doctor\"). Failing here is the cheap end of that: a\n# mis-tagged round otherwise LOOKS green because next.mjs keeps reading an older\n# report for the page you just changed. (Cost this once, 2026-08-07.)\ncase \"$TAG\" in\n  *-*)\n    echo \"gate.sh: round tag must not contain a hyphen (got '$TAG').\" >&2\n    echo \"         out-<TAG>-<page> is parsed on the first hyphen, so a\" >&2\n    echo \"         hyphenated tag hides the run from next.mjs. Try '\\${TAG//-/}'.\" >&2\n    exit 2\n    ;;\nesac\nshift || true\nWANT=(\"$@\")\n\n# What this round actually measured. These are read by the terminal block far\n# below, and the page loop is \\`done < <(...)\\` — process substitution, NOT a\n# pipe — precisely so they survive it (gate.sh's own note at the loop, and\n# census.sh:193-198, record the same trap). Converting that loop to a pipe\n# would leave every counter here reading 0, which is the green this file now\n# exists to stop.\nMEASURED=0\nATTEMPTED=0\nUNMEASURED=\"\"\nSEEN=\"\"\n\n# Fail closed on the reference before spending a single run. A 200 is NOT\n# evidence: a production host that has cut over to OUR build answers 200, and\n# every region then scores near zero against itself. --check-ref requires an\n# artefact only the reference serves (harness.json refMark) and refuses a\n# redirect, a host listed in selfHosts, and a body carrying candMark. Measured\n# on the site this harness was cut from, 2026-09-09 AFTER the consolidation:\n# 12 of its 214 top-level matching scripts still assign REF a host listed in\n# selfHosts — i.e. compare the candidate with itself. It was 33 of 229 before.\n# (This comment read \"33 of its 230\" while sitting in the post-consolidation\n# tree, contradicting harness.mjs's 12 three files away.)\nif ! node \"$(dirname \"$0\")/harness.mjs\" --check-ref; then\n  echo \"gate.sh: refusing to gate against an unverified reference.\" >&2\n  exit 2\nfi\n\n# Set SPEC_OPTIONAL=1 only for a read-only baseline sweep of pages you are not\n# about to edit. It is recorded in the round tag so the exemption is visible.\nSPEC_OPTIONAL=\"\\${SPEC_OPTIONAL:-0}\"\n\nhas_spec() { # page\n  # NB: the obvious \\`( |$|\\\\b)\\` guard is rejected by ugrep as an empty\n  # subexpression, and a preflight that errors out fails CLOSED — it refused all\n  # 9 pages while SPEC.md was complete. Match the page key followed by any\n  # non-key character (so \\`## team\\` matches but \\`## teamfoo\\` does not; \\`##\n  # our-team\\` cannot match \\`team\\` because the key must follow the spaces).\n  [ -f \"$SPEC\" ] && grep -qE \"^##+ +$1([^A-Za-z0-9_-]|$)\" \"$SPEC\"\n}\n\nrun() { # tag refpath candpath sections\n  local page=\"$1\" refpath=\"$2\" candpath=\"$3\" sections=\"$4\"\n  # BEFORE the WANT filter, so the known-page list stays complete even when\n  # WANT matches nothing and there is a typo to name. Mirrors census.sh:107.\n  SEEN=\"$SEEN $page\"\n  if [ \\${#WANT[@]} -gt 0 ]; then\n    local hit=0\n    for w in \"\\${WANT[@]}\"; do [ \"$w\" = \"$page\" ] && hit=1; done\n    [ $hit -eq 1 ] || return 0\n  fi\n  if ! has_spec \"$page\"; then\n    if [ \"$SPEC_OPTIONAL\" = \"1\" ]; then\n      echo \"########## $page ##########\"\n      echo \"WARNING: no '## $page' section in matching/SPEC.md — Phase 1 not done.\"\n      echo \"         Running anyway because SPEC_OPTIONAL=1 (baseline read only).\"\n      echo \"         Do NOT apply geometry fixes off this run.\"\n    else\n      echo \"########## $page ##########\"\n      echo \"REFUSED: no '## $page' section in matching/SPEC.md.\"\n      echo \"         Phase 1 (section census + per-section spec, read from\"\n      echo \"         matching/spec/) comes before geometry.\"\n      echo \"         See CLAUDE.md rule 2. SPEC_OPTIONAL=1 for a baseline read.\"\n      FAILED_PREFLIGHT=1\n      return 0\n    fi\n  fi\n  echo \"########## $page ##########\"\n  # Same clock source and same format as page-diff's own meta.generatedAt, so\n  # the freshness comparison below is between two ISO strings from one clock.\n  local started\n  started=\"$(node -e 'process.stdout.write(new Date().toISOString())')\"\n  node \"$PD\" --ref \"$REF$refpath\" --cand \"$CAND$candpath\" \\\\\n    --viewports \"$MATRIX\" --threshold \"$THRESHOLD\" \\\\\n    --sections \"$sections\" --out \"matching/out-$TAG-$page\" \\\\\n    > \"matching/out-$TAG-$page.log\" 2>&1\n  # IMMEDIATELY after the invocation. Any command in between — the echo\n  # included — destroys $?.\n  local status=$?\n  echo \"$page exit=$status\"\n  ATTEMPTED=$((ATTEMPTED + 1))\n  # $status may DENY a green; it may never GRANT one, and here it does neither.\n  # page-diff exits 1 for a region that legitimately FAILED (page-diff.mjs:227)\n  # and node exits 1 for the bare \\`throw e\\` below it, so the status cannot tell\n  # a finding from a crash before it looked — and a matching round's steady\n  # state IS a failing gate, so denying on it would break every normal round.\n  # Measured on 29 Navy with the reference alive and no dev server: \\`home\n  # exit=1\\`, \\`ALL DONE\\`, exit 0, and no matching/out-*-home/ written at all.\n  # What only a completed run leaves is the report next.mjs will count.\n  # census.sh:17-32 is the same argument for style-census.\n  local evidence\n  if evidence=\"$(node \"$(dirname \"$0\")/harness.mjs\" --check-run \"$page\" \"matching/out-$TAG-$page\" \"$started\" 2>&1)\"; then\n    MEASURED=$((MEASURED + 1))\n  else\n    UNMEASURED=\"$UNMEASURED $page\"\n    echo \"  NOT MEASURED: $evidence\"\n  fi\n}\n\n# The page table is matching/harness.json. Process substitution, NOT a pipe:\n# a pipe would run this loop in a subshell and FAILED_PREFLIGHT would not\n# survive to the check below, so a refused page would exit 0.\nwhile IFS=$'\\\\t' read -r key refpath candpath anchors; do\n  run \"$key\" \"$refpath\" \"$candpath\" \"$anchors\"\ndone < <(node \"$(dirname \"$0\")/harness.mjs\" --table)\n\n# BOTH kinds of incompleteness are reported in one run: a page refused before\n# it ran, and a page that ran and left nothing countable. Exiting on the first\n# would hide the second from an operator who then fixes only what was printed.\nINCOMPLETE=0\nif [ -n \"$UNMEASURED\" ]; then\n  echo\n  echo \"GATE INCOMPLETE ($TAG) — $((ATTEMPTED - MEASURED)) of $ATTEMPTED page(s) produced no\"\n  echo \"countable report:$UNMEASURED\"\n  echo \"Those pages have NOT been measured. next.mjs drops an unreported page from\"\n  echo \"BOTH sides of the score, so the pages that did report would read as the\"\n  echo \"whole site. Full runs: matching/out-$TAG-<page>.log\"\n  INCOMPLETE=1\nfi\nif [ \"\\${FAILED_PREFLIGHT:-0}\" = \"1\" ]; then\n  echo\n  echo \"GATE INCOMPLETE ($TAG) — one or more pages were refused for a missing\"\n  echo \"SPEC.md section. Those pages have NOT been measured; do not report a\"\n  echo \"score for them.\"\n  INCOMPLETE=1\nfi\nif [ \"$INCOMPLETE\" = \"1\" ]; then\n  exit 2\nfi\n# A green over ZERO pages is still a green. Measured: \\`gate.sh nosuch\n# nosuchpage\\` printed ALL DONE and exited 0 having run nothing and printed no\n# page header at all. census.sh:199-209 refuses exactly this shape, and\n# strikes.mjs:147-156 was written because a typo silently greened rule 3 on six\n# of nine pages.\nif [ \"$ATTEMPTED\" -eq 0 ]; then\n  if [ -n \"$SEEN\" ]; then\n    echo \"gate.sh: \\\\\"\\${WANT[*]:-}\\\\\" matches no page — refusing to report ALL DONE.\" >&2\n    echo \"         known pages:$SEEN\" >&2\n  else\n    echo \"gate.sh: the page table is empty — refusing to report ALL DONE.\" >&2\n    echo \"         node matching/harness.mjs --table printed no rows; check\" >&2\n    echo \"         \\\\\"pages\\\\\" in matching/harness.json.\" >&2\n  fi\n  exit 2\nfi\n# A green that STATES what it is made of (census.sh:219), so a green over\n# nothing cannot read like a green over the table.\necho \"ALL DONE ($TAG) — $MEASURED of $ATTEMPTED page(s) measured, each one counted.\"\n`;\n\nexport const CENSUS_SH_RELATIVE = \"matching/census.sh\";\nexport const CENSUS_SH_TEMPLATE = `#!/usr/bin/env bash\n# Phase 3 style gate — the mechanical net for the type spec.\n#\n#   bash matching/census.sh            # all 9 pages, all 3 viewports\n#   bash matching/census.sh home yfv   # just these\n#\n# style-census diffs the computed type tuple (family, weight, size,\n# line-height, letter-spacing, transform, colour) of every text snippet present\n# on BOTH pages. It is the only gate that catches the 11px footer line and the\n# cyan-vs-teal link that page-diff is structurally blind to — a region can be\n# pixel-clean at 0.10 and still be wearing the wrong colour on small text.\n#\n# Prints a per-page/per-viewport mismatch count and leaves the full runs in\n# matching/census-<page>-<vw>.log. Exits 1 while any count is non-zero, and 2\n# when it cannot honestly report a count at all.\n#\n# EVIDENCE — read before adding a guard here, or removing one. A green here\n# has to be produced by a census that RAN. It was not: with style-census.mjs\n# absent this gate printed \"Phase 3 CLEAN — 0 undeclared type mismatches\" and\n# exited 0. Every run died on module resolution, census-count.mjs read each\n# crash log as \"0 0 0\" (it counts \\`  y=\\` rows and a stack trace has none —\n# census-count.mjs:35-56), and no rows was reported as no mismatches. Measured\n# again with style-census.mjs PRESENT and the candidate host down: identical\n# output, because style-census exits 1 both when it finds mismatches\n# (style-census.mjs:187) and when it dies before it looks — so the exit status\n# cannot tell a finding from a crash and may not grant a green either.\n#\n# The guards below are what next.mjs:83-89 (no parseable gate run — refusing to\n# report a score), strikes.mjs:87-97 (refusing to report \"clear\") and\n# gate.sh:37-42 (preflight page-diff before spending a run) already do. Each\n# demands an artefact only a working census produces; none of them can turn a\n# red green.\nset -uo pipefail\n# Resolved BEFORE the cd. $0 is the path as TYPED, so a relatively invoked\n# census.sh that resolved the harness afterwards would look for it under\n# whatever root the cd landed on.\nHARNESS=\"$(cd \"$(dirname \"$0\")\" && pwd)/harness.mjs\"\ncd \"$(dirname \"$0\")/..\"\n\n# Everything configurable lives in matching/harness.json; harness.mjs is the one\n# reader. --env supplies REF, CAND, SC and VIEWPORTS_SP — this gate held its own\n# copy of all four, and its REF went stale when production cut over to our own\n# build (LEDGER \"REFERENCE MOVED\", verified 2026-08-10) while gate.sh's was\n# repointed the same day.\neval \"$(node \"$HARNESS\" --env)\"\nNODE=\"\\${NODE:-node}\"\n\n# The matrix is DATA, read as VIEWPORTS_SP, the way gate.sh reads MATRIX. The\n# old VIEWPORTS override is retired rather than silently ignored: a census run\n# over a matrix harness.json does not name is a column set the pixel gate never\n# measured, and it would look exactly like a clean one.\nif [ -n \"\\${VIEWPORTS:-}\" ]; then\n  echo \"census.sh: the VIEWPORTS override is retired — the matrix is data now.\" >&2\n  echo \"           Edit \\\\\"matrix\\\\\" in matching/harness.json, then unset it.\" >&2\n  exit 2\nfi\n\n# GUARD 1 — the tool is there and it starts. gate.sh compares \\`page-diff\n# --version\\` with the harness's REPORT_SCHEMA before spending a run\n# (gate.sh:37-42); style-census has no --version to compare (page-diff.mjs\n# defines one at 191-195; nothing in style-census.mjs writes one), so the\n# artefact demanded here is the other one only it produces: the usage banner it\n# prints on exit 2 when --ref/--cand are missing (style-census.mjs:151-157).\n# That banner is not free — \\`import { chromium } from \"playwright\"\\` runs first\n# (style-census.mjs:19) — so a skill directory with no playwright installed\n# fails HERE, once, instead of writing one crash log per page per viewport that\n# every reader downstream counts as zero.\nif [ ! -f \"$SC\" ]; then\n  echo \"census.sh: no style-census at $SC — refusing to report a count.\" >&2\n  echo \"           Install the matching-a-page skill, or point MATCHING_SKILL_DIR\" >&2\n  echo \"           at a checkout that has style-census.mjs.\" >&2\n  exit 2\nfi\nSC_USAGE=\"$(\"$NODE\" \"$SC\" 2>&1)\"\ncase \"$SC_USAGE\" in\n  *\"style-census\"*\"--ref\"*\"--cand\"*\"--vw\"*) ;;\n  *)\n    echo \"census.sh: $SC did not answer with a style-census --ref/--cand/--vw usage\" >&2\n    echo \"           banner — refusing to report a count. It printed:\" >&2\n    echo \"           \\${SC_USAGE:-(nothing at all)}\" >&2\n    exit 2\n    ;;\nesac\n\ndeclare -a WANT=(\"$@\")\n\n# page -> \"refpath candpath\": the same table gate.sh drives, from the same file.\n# cut drops the anchors column, which the style census has no argument for\n# (style-census.mjs: --ref <url> --cand <url> [--vw 1440]).\npages() { node \"$HARNESS\" --table | cut -f1-3; }\n\nTOTAL=0\nAMB=0\nDECL=0\nROWS=0\nRUNS=0\nBROKEN=0\nSEEN=\"\"\n# One column per viewport, from the matrix. Flush with the data rows below, at\n# last: the old header hardcoded four fixed fields separated by a literal space,\n# which the rows do not have, so its labels sat 1/2/3 columns right of them.\nprintf '%-10s' page\nfor vw in $VIEWPORTS_SP; do printf '%8s' \"$vw\"; done\nprintf '\\\\n'\nwhile read -r page refpath candpath; do\n  [ -z \"$page\" ] && continue\n  SEEN=\"$SEEN $page\"\n  if [ \\${#WANT[@]} -gt 0 ]; then\n    hit=0\n    for w in \"\\${WANT[@]}\"; do [ \"$w\" = \"$page\" ] && hit=1; done\n    [ $hit -eq 1 ] || continue\n  fi\n  ROWS=$((ROWS + 1))\n  line=$(printf '%-10s' \"$page\")\n  for vw in $VIEWPORTS_SP; do\n    log=\"matching/census-$page-$vw.log\"\n    RUNS=$((RUNS + 1))\n    \"$NODE\" \"$SC\" --ref \"$REF$refpath\" --cand \"$CAND$candpath\" --vw \"$vw\" >\"$log\" 2>&1\n    # GUARD 2 — this run produced a census. The header and the counts line are\n    # written together at style-census.mjs:166-169 and only after both pages\n    # have been walked, so they are the artefact a completed run leaves and a\n    # crashed one cannot. The viewport is read back out of the header because a\n    # --vw that did not take would otherwise fill three differently named logs\n    # with the same 1440 census. \\`ref runs\\`/\\`cand runs\\` must be non-zero: two\n    # pages that rendered no text at all agree perfectly and mean nothing.\n    if ! grep -qE \"^=== style census, viewport $vw ===\\\\$\" \"$log\" ||\n      ! grep -qE \"^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+\\\\$\" \"$log\"; then\n      BROKEN=$((BROKEN + 1))\n      echo \"census.sh: $page @$vw produced no usable census — see $log\" >&2\n      line=\"$line$(printf '%8s' '!!')\"\n      continue\n    fi\n    # census-count splits the log three ways: REAL mismatches, AMBIGUOUS\n    # same-text collisions (style-census's own split), and DECLARED rows the\n    # operator has already ruled on (matching/census-deviations.mjs, the same\n    # contract as floors.mjs). Only the first is outstanding work — without the\n    # third, this gate can never reach zero and its number means nothing.\n    read -r n a d <<<\"$(\"$NODE\" matching/census-count.mjs \"$log\")\"\n    # GUARD 2b — three integers, or the counter did not count. census-count.mjs\n    # is the reader that turned a stack trace into \"0 0 0\"; a run of it that\n    # dies (a broken census-deviations.mjs, a bad path) prints nothing at all,\n    # and bash reads an empty $n as zero in the arithmetic below.\n    counted=1\n    for v in \"\\${n:-}\" \"\\${a:-}\" \"\\${d:-}\"; do\n      case \"$v\" in \"\" | *[!0-9]*) counted=0 ;; esac\n    done\n    if [ \"$counted\" -eq 0 ]; then\n      BROKEN=$((BROKEN + 1))\n      echo \"census.sh: census-count.mjs did not return three counts for $log\" >&2\n      line=\"$line$(printf '%8s' '!!')\"\n      continue\n    fi\n    # GUARD 2c — the number reported is the number the census MEASURED. GUARD 2\n    # matched the counts line for PRESENCE and threw its numbers away, so the\n    # count printed below came from census-count's row parse and nothing ever\n    # compared the two. Measured 2026-09-09: a COMPLETE census whose counts line\n    # said \"mismatches: 3\", whose \\`y=\\` rows carried one leading space instead of\n    # two (census-count.mjs:39 matches /^ {2}y=/), was reported as 0 and this\n    # gate printed \"Phase 3 CLEAN — 0 undeclared type mismatches\", exit 0. The\n    # printer lives in the SKILL (style-census.mjs:171-173) and the parser is\n    # copied into every site, so the two version independently and drift needs\n    # nobody to touch either repo.\n    #\n    # The identity is exact for mismatches: style-census prints at most 100 rows\n    # and states the remainder on its own line (style-census.mjs:175-177), so\n    # parsed + remainder == reported. Ambiguous rows are capped the same way\n    # (:184) but the remainder is NOT stated, so only a floor is checkable\n    # there — any is not none, and the parse may never exceed the report.\n    counts=$(grep -E \"^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+$\" \"$log\" | tail -1)\n    said_m=\\${counts##*mismatches: }\n    said_m=\\${said_m%% *}\n    said_a=\\${counts##*ambiguous: }\n    more=$(sed -n 's/^ *… and \\\\([0-9][0-9]*\\\\) more (truncated print, all counted)$/\\\\1/p' \"$log\" | tail -1)\n    if [ $((n + d + \\${more:-0})) -ne \"$said_m\" ] ||\n      [ \"$a\" -gt \"$said_a\" ] ||\n      { [ \"$said_a\" -gt 0 ] && [ \"$a\" -eq 0 ]; }; then\n      BROKEN=$((BROKEN + 1))\n      echo \"census.sh: $log reports mismatches: $said_m ambiguous: $said_a, but\" >&2\n      echo \"           census-count.mjs read $((n + d)) mismatch row(s)\\${more:+ (+ $more truncated)} and $a ambiguous.\" >&2\n      echo \"           The census and its reader disagree; there is no count to report.\" >&2\n      line=\"$line$(printf '%8s' '!!')\"\n      continue\n    fi\n    AMB=$((AMB + a))\n    DECL=$((DECL + d))\n    TOTAL=$((TOTAL + n))\n    line=\"$line$(printf '%8s' \"$n\")\"\n  done\n  echo \"$line\"\ndone < <(pages)\n\necho\n# GUARD 3 — something was actually censused. Process substitution above, NOT a\n# pipe: a pipe runs the loop in a subshell and every counter here would still\n# read 0, which is exactly the green this file exists to stop (gate.sh:123-125\n# records the same trap for FAILED_PREFLIGHT). A page name that matches nothing\n# must not report CLEAN either — strikes.mjs:147-156 is the same refusal, and\n# it was written because a typo silently greened rule 3 on six of nine pages.\nif [ \"$ROWS\" -eq 0 ]; then\n  if [ -n \"$SEEN\" ]; then\n    echo \"census.sh: \\\\\"\\${WANT[*]:-}\\\\\" matches no page — refusing to report CLEAN.\" >&2\n    echo \"           known pages:$SEEN\" >&2\n  else\n    echo \"census.sh: the page table is empty — refusing to report CLEAN.\" >&2\n    echo \"           node matching/harness.mjs --table printed no rows; check\" >&2\n    echo \"           \\\\\"pages\\\\\" in matching/harness.json.\" >&2\n  fi\n  exit 2\nfi\nif [ \"$BROKEN\" -gt 0 ]; then\n  echo \"CENSUS INCOMPLETE — $BROKEN of $RUNS run(s) produced no usable census (marked !!).\"\n  echo \"Those page/viewport pairs have NOT been measured; there is no count to\"\n  echo \"report for them, and the totals below would be a floor, not a score.\"\n  echo \"Full runs: matching/census-<page>-<vw>.log\"\n  exit 2\nfi\nif [ \"$TOTAL\" -eq 0 ]; then\n  echo \"Phase 3 CLEAN — 0 undeclared type mismatches ($DECL declared, $AMB ambiguous).\"\n  echo \"($RUNS censused run(s) over $ROWS page(s), each one counted.)\"\n  [ \"$AMB\" -gt 0 ] && echo \"($AMB ambiguous same-text rows remain: each needs ADJUDICATING,\" &&\n    echo \" not fixing — our element matches, another sharing its text does not.)\"\n  exit 0\nfi\necho \"$TOTAL type mismatch(es) remain (+ $AMB ambiguous, $DECL declared).\"\necho \"Full runs: matching/census-<page>-<vw>.log\"\necho \"A mismatch is a defect or a ledgered deviation. An ambiguous row is neither\"\necho \"until you look: the census keys on TEXT, so two different elements sharing a\"\necho \"string land under one key and only one of them may be wrong.\"\nexit 1\n`;\n\nexport const NEXT_MJS_RELATIVE = \"matching/next.mjs\";\nexport const NEXT_MJS_TEMPLATE = `// What is still broken, ranked. Exits 1 while work remains.\n//\n//   node matching/next.mjs\n//\n// Round protocol step 0 (repo CLAUDE.md rule 5). A commit is a CHECKPOINT, not\n// a stopping point: after committing, run this. If it exits 1 there is a named\n// next action and the round continues without handing control back.\n//\n// Reads the most recent gate log per page rather than the whole corpus, so it\n// reflects HEAD rather than history (that is strikes.mjs's job).\nimport { existsSync, readdirSync, readFileSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nconst DIR = new URL(\".\", import.meta.url).pathname;\n\n// PAUSE SWITCH. While matching/PAUSED exists this hands out no agenda and\n// exits 0. It is deliberately the FIRST thing that runs: no report is read, no\n// score is printed, nothing tempting is put on screen to argue with.\n//\n// Why an exit code and not a note somewhere: rule 5 is a LOOP — \"after\n// committing, run next.mjs; while it exits 1 there is a named next action and\n// the round continues\". A pause written as prose loses to that loop, because\n// the loop is mechanical and the prose is not. Exiting 0 satisfies rule 5\n// truthfully rather than suspending it: there is no next action.\nconst PAUSE = join(DIR, \"PAUSED\");\nif (existsSync(PAUSE)) {\n  console.log(\"MATCHING PAUSED — no agenda, and none is to be inferred.\\\\n\");\n  console.log(readFileSync(PAUSE, \"utf8\").trimEnd());\n  process.exit(0);\n}\n\nimport { FLOORS, ACCEPTED } from \"./floors.mjs\";\nimport {\n  TOTALS,\n  THRESHOLD,\n  MAX_HEIGHT_DELTA,\n  REPORT_SCHEMA,\n  uncountable,\n  scorable,\n  unscorableWhy,\n  byKey,\n} from \"./harness.mjs\";\n\n// Reports written by a different page-diff, by page key. Kept rather than\n// dropped: silently ignoring them is how a page vanishes from the score.\nconst schemaMismatch = new Set();\n\nconst latest = new Map();\nfor (const d of readdirSync(DIR).filter((d) => d.startsWith(\"out-\"))) {\n  const m = /^out-[^-]+-(.+)$/.exec(d);\n  // Membership in the page table is asked of the TABLE. \\`!TOTALS[m[1]]\\` was a\n  // NUMBER standing in for a fact: it is null for an unanchored page and 0 for\n  // an empty matrix, and either dropped the page out of \\`latest\\` while\n  // \\`Object.keys(TOTALS)\\` still listed it — so a gate run that had just\n  // SUCCEEDED came back as \"no countable gate run\".\n  if (!m || !byKey[m[1]]) continue;\n  let report, mtime;\n  try {\n    const p = join(DIR, d, \"report.json\");\n    report = JSON.parse(readFileSync(p, \"utf8\"));\n    mtime = statSync(p).mtimeMs;\n  } catch {\n    continue;\n  }\n  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the\n  // page. Picking one up as \"latest\" silently reports scores nobody can ship —\n  // it happened immediately: an --mask-photos probe of yfv made \\`top\\` @834 read\n  // 43.9% here while the real gate had it passing at 1.3%. Missing\n  // schemaVersion means \"written before the field existed\" = 0; it is not an\n  // error on its own, only when it would blank a page.\n  //\n  // The predicate itself lives in harness.mjs now, because gate.sh asks the\n  // same question per run and two copies of one question drift — a gate that\n  // greens a run this file then drops is the same false green one step along.\n  const why = uncountable(report.meta ?? {});\n  if (why === \"schema\") {\n    schemaMismatch.add(m[1]);\n    continue;\n  }\n  if (why) continue;\n  const prev = latest.get(m[1]);\n  if (!prev || mtime > prev.mtime) latest.set(m[1], { dir: d, mtime, report });\n}\n\nconst blanked = [...schemaMismatch].filter((p) => !latest.has(p));\nif (blanked.length) {\n  console.error(\n    \\`next: \\${blanked.length} page(s) have no run at report schema \\${REPORT_SCHEMA} — \\` +\n      \\`their newest reports came from a different page-diff (\\${blanked.sort().join(\", \")}).\\\\n\\` +\n      \\`      Re-run: bash matching/gate.sh <tag> \\${blanked.sort().join(\" \")}\\`,\n  );\n  process.exit(2);\n}\nif (latest.size === 0) {\n  console.error(\n    \"next: no parseable gate run under matching/ — refusing to report a score.\\\\n\" +\n      \"      Run bash matching/gate.sh <tag> first.\",\n  );\n  process.exit(2);\n}\n\nconst rows = [];\nconst accepted = [];\nlet openTotal = 0;\nlet floorTotal = 0;\nfor (const [page, { dir, report }] of latest) {\n  const fails = report.regions.filter((r) => !r.pass);\n  for (const f of fails) {\n    const floor = FLOORS.find((fl) => fl.match(f, page));\n    if (floor) {\n      floorTotal++;\n      continue;\n    }\n    const ack = ACCEPTED.find((a) => a.match(f, page));\n    if (ack) {\n      accepted.push({ page, vw: f.viewport, label: f.label, why: ack.why });\n      continue;\n    }\n    openTotal++;\n    rows.push({\n      page,\n      vw: f.viewport,\n      label: f.label,\n      mm: f.mismatchFraction,\n      dh: f.heightDeltaFraction ?? 0,\n      dir,\n    });\n  }\n}\n\n// Pages that REPORTED but cannot be scored: no anchors, so their regions are\n// whatever page-diff's fallback cut and there is no model for one to be right\n// against. Kept separate from \\`scored\\` and never ranked with it.\nconst unscorable = [...latest.entries()]\n  .filter(([p]) => !scorable(p))\n  .map(([p, v]) => ({ p, regions: v.report.regions.length }))\n  .sort((a, b) => a.p.localeCompare(b.p));\n\n// \\`.filter(scorable)\\` before \\`.map\\`, because the sort below divides by \\`total\\`\n// and an unanchored page's ratio is NOT BOUNDED BY 1. A passing one scored\n// 16/4 = 4.0 and sorted LAST, i.e. best, so \\`worst\\` could never name the one\n// page whose Phase 1 was not done; a failing one scored 0/4 = 0.0, sorted\n// FIRST, and put \\`grid-0-0\\`, \\`grid-1-0\\` … on the agenda — an instruction to fix\n// geometry against regions page-diff invented.\nconst scored = [...latest.entries()]\n  .filter(([p]) => scorable(p))\n  .map(([p, v]) => ({\n    p,\n    pass: v.report.regions.filter((r) => r.pass).length,\n    total: TOTALS[p],\n  }))\n  .sort((a, b) => a.pass / a.total - b.pass / b.total);\n\n// The denominator is the DECLARED site, not the pages that happened to report.\n// Summed over \\`scored\\` it shrank to match the numerator: 8 of 9 pages reporting\n// read SCORE 160/160 while the ninth, whose page-diff had crashed, was in\n// neither the numerator nor the denominator nor the list below. harness.mjs:61-67\n// already gives the reason — \"a wrong denominator makes the score a lie in the\n// flattering direction\" — and that fix was applied per REGION (\\`total:\n// TOTALS[p]\\`) and never per PAGE.\nconst unmeasured = Object.keys(TOTALS)\n  .filter((p) => !latest.has(p))\n  .sort();\nconst sum = scored.reduce((a, s) => a + s.pass, 0);\n// Summed EXPLICITLY over the scorable pages rather than over TOTALS' values:\n// \\`a + null\\` is silently \\`a\\`, and a denominator that is right only because of a\n// coercion is the same lie one refactor away.\nconst pagesAll = Object.keys(TOTALS).length;\nconst pagesScorable = Object.keys(TOTALS).filter((p) => scorable(p)).length;\nconst max = Object.keys(TOTALS).reduce((a, p) => a + (scorable(p) ? TOTALS[p] : 0), 0);\n\n// A score is printed only if SOMETHING can carry one. \\`SCORE 0/0\\` is a third\n// lie and the one that reads best of all, so it is never printed: with nothing\n// scorable the line says so in words and gives no fraction to quote.\nconsole.log(\n  (pagesScorable === 0\n    ? \\`NO SCORE — 0 of \\${pagesAll} page(s) can carry one.\\`\n    : \\`SCORE \\${sum}/\\${max} regions passing over \\${pagesScorable} of \\${pagesAll} page(s)\\` +\n      (unmeasured.length ? \\` — \\${unmeasured.length} page(s) NOT MEASURED\\` : \"\")) + \"\\\\n\",\n);\nconsole.log(\n  [\n    ...scored.map((s) => \\`  \\${s.p.padEnd(9)} \\${String(s.pass).padStart(2)}/\\${s.total}\\`),\n    // The run's OWN region count, as EVIDENCE FOR THE REFUSAL — it proves a run\n    // happened and explains why it cannot be scored, so a refusal is not\n    // mistaken for a crash. The pass FRACTION is deliberately withheld: it is\n    // the number with no referent, and the number that gets quoted.\n    ...unscorable.map(\n      (u) =>\n        \\`  \\${u.p.padEnd(9)} \\${String(u.regions).padStart(2)} region(s)  NOT SCORABLE — \\${unscorableWhy(u.p)}\\`,\n    ),\n    // \\`?/N\\`, never \\`0/N\\`: an unmeasured page is not a page that scored zero,\n    // and printing zero would be a different lie. \\`?/?\\` when the page is ALSO\n    // unanchored — \\`?/null\\` would name the denominator \"null\", which is worse\n    // than the number it replaced.\n    ...unmeasured.map((p) => \\`  \\${p.padEnd(9)}  ?/\\${TOTALS[p] ?? \"?\"}   NOT MEASURED\\`),\n  ].join(\"\\\\n\"),\n);\n\nif (accepted.length) {\n  console.log(\\`\\\\nOperator-ACCEPTED failures (left failing on purpose):\\`);\n  for (const a of accepted)\n    console.log(\\`  \\${a.page} @\\${a.vw} \"\\${a.label}\" — \\${a.why.slice(0, 96)}…\\`);\n}\n\n// BEFORE the \\`!rows.length\\` branch, and deliberately so: an unmeasured page\n// contributes no failing region, so that branch would print \"Backlog is empty\"\n// and exit 0 over a page nobody had looked at. Exit 2 matches the two guards\n// above (\\`blanked\\`, \\`latest.size === 0\\`) — neither \"clean\" nor \"work remains\"\n// but \"this cannot be scored\", the one answer rule 5's while-it-exits-1 loop\n// cannot swallow. The score print stays above it so the partial state is still\n// visible.\n// A page with no anchors has not finished Phase 1, so a score has no referent\n// and this refuses to invent one — the same answer \\`refMark: \"\"\\` gets from\n// checkRef and an absent \\`## <page>\\` SPEC section gets from gate.sh. All three\n// are seed sentinels, and this was the one that failed OPEN. Repo CLAUDE.md\n// rule 1's corollary is the whole argument: a field that can only observe\n// configuration must never be named after the thing it cannot observe, and\n// \"12 of 12 grid rows passed\" observes a screenshot cut into quarters, not a\n// design anyone specced.\n//\n// PRINTED here, EXITED below: \\`unmeasured\\` and \\`unscorable\\` are different pages\n// with different remedies, and exiting inside the first block would hide the\n// second from an operator who then fixes only what was printed.\nif (unscorable.length) {\n  console.error(\n    \\`\\\\nnext: \\${unscorable.length} page(s) have no anchors, so their regions are page-diff's own\\\\n\\` +\n      \\`      fallback cut and cannot be scored — \\` +\n      unscorable.map((u) => \\`\\${u.p} (\\${u.regions} region(s))\\`).join(\", \") +\n      \\`.\\\\n      Set \"anchors\" for them in matching/harness.json to section texts that exist on\\\\n\\` +\n      \\`      BOTH the reference and the candidate, then re-run: bash matching/gate.sh <tag> \\` +\n      unscorable.map((u) => u.p).join(\" \"),\n  );\n}\n\nif (unmeasured.length) {\n  console.error(\n    \\`\\\\nnext: \\${unmeasured.length} page(s) have no countable gate run — \\${unmeasured.join(\", \")}.\\\\n\\` +\n      \\`      Re-run: bash matching/gate.sh <tag> \\${unmeasured.join(\" \")}\\`,\n  );\n  process.exit(2);\n}\n\n// See above: deliberately a second statement, not an \\`else\\`.\nif (unscorable.length) process.exit(2);\n\nif (!rows.length) {\n  console.log(\n    \\`\\\\nNo open geometry failures. \\${floorTotal} declared floor(s) remain.\\`,\n  );\n  console.log(\n    \"Backlog is empty — Phases 5 (states) and 6 (adversarial review) are what is left.\",\n  );\n  process.exit(0);\n}\n\n// Worst page first, then worst region inside it: fix where the model is most wrong.\n//\n// INVARIANT, documented rather than guarded because no test could redden a\n// guard here: \\`scored[0]\\` is safe because \\`scored\\` is empty only when every\n// page in \\`latest\\` is unanchored — and that means \\`unscorable.length > 0\\`, so\n// the exit above already fired. (\\`latest\\` being empty is caught further up.)\n// \\`rows\\` likewise still contains unanchored pages' failing regions; they are\n// never printed because that same exit fires first. Both facts depend on the\n// exit staying ABOVE this line — a second filter here would be a second place\n// to keep in sync, which is how checkRun and next.mjs drifted apart to begin\n// with. If that exit ever moves, this becomes a TypeError.\nconst worst = scored[0].p;\nrows.sort(\n  (a, b) =>\n    (a.page === worst ? -1 : 0) - (b.page === worst ? -1 : 0) || b.mm - a.mm,\n);\n\nconsole.log(\n  \\`\\\\n\\${openTotal} open failure(s) + \\${floorTotal} declared floor(s).\\`,\n);\nconsole.log(\\`\\\\nNEXT: \\${worst} — worst page. Its open regions:\\\\n\\`);\nfor (const r of rows.filter((r) => r.page === worst)) {\n  const why = [];\n  if (r.mm > THRESHOLD) why.push(\\`pixels \\${(r.mm * 100).toFixed(1)}%\\`);\n  if (Math.abs(r.dh) > MAX_HEIGHT_DELTA)\n    why.push(\\`height \\${(r.dh * 100).toFixed(1)}%\\`);\n  console.log(\n    \\`  @\\${String(r.vw).padEnd(5)} \\${r.label.slice(0, 44).padEnd(45)} \\${why.join(\" + \")}\\`,\n  );\n}\nconsole.log(\\`\\\\nBefore treating any of these as geometry:\\`);\nconsole.log(\n  \\`  node matching/probe-anchor-parity.mjs \\${worst}   # is the gate cutting comparably?\\`,\n);\nconsole.log(\n  \\`  node matching/strikes.mjs \\${worst}               # has it stalled? then change the MODEL\\`,\n);\nconsole.log(\n  \\`\\\\nRound continues. Do not hand back control with work outstanding.\\`,\n);\nprocess.exit(1);\n`;\n\nexport const STRIKES_MJS_RELATIVE = \"matching/strikes.mjs\";\nexport const STRIKES_MJS_TEMPLATE = `// The 3-strike rule, made countable.\n//\n//   node matching/strikes.mjs [page]\n//\n// The matching skill says: \"A region that has not improved after 3 fix ->\n// re-run cycles: stop. Present the three attempts. Do not widen the threshold,\n// mask it, or reclassify it — a stuck region means your model of it is wrong.\"\n//\n// That rule was blown twice on this project (services \\`top\\`, yfv \\`top\\`) purely\n// because nobody was counting. This reads every matching/out-*/report.json,\n// reconstructs each region's history in chronological order, and prints the\n// regions that are OUT OF STRIKES. Exit 1 when any exist, so a round that\n// starts by running this cannot quietly attempt a fourth cycle.\n//\n// WHAT THIS ACTUALLY MEASURES (read before trusting a number): report.json\n// cannot record INTENT, so a \"cycle\" here is any completed gate run in which\n// the region was still failing and did not improve by IMPROVE_PP. Runs aimed at\n// a different region on the same page therefore count too. That makes this a\n// STALL detector, not a literal attempt counter — \"this has been failing,\n// unchanged, across N gate runs while you were working on this page.\" That is\n// the more useful discipline number anyway, and it is honest about being an\n// upper bound. Improvement resets the count: real progress earns a fresh start.\nimport { existsSync, readdirSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { FLOORS } from \"./floors.mjs\";\nimport {\n  PAGES,\n  THRESHOLD,\n  MAX_HEIGHT_DELTA,\n  REPORT_SCHEMA,\n} from \"./harness.mjs\";\n\n// PAUSE SWITCH — see matching/next.mjs for why this is an exit code. Round\n// protocol step 1 is \"run strikes.mjs; the stalled regions are the agenda\", so\n// this is the second door into the backlog and has to be shut too. Exits 0:\n// there are no strikes to spend when no round is being played.\nconst PAUSED = join(new URL(\".\", import.meta.url).pathname, \"PAUSED\");\nif (existsSync(PAUSED)) {\n  console.log(\"MATCHING PAUSED — no agenda, and none is to be inferred.\\\\n\");\n  console.log(readFileSync(PAUSED, \"utf8\").trimEnd());\n  process.exit(0);\n}\n\nconst IMPROVE_PP = 0.01; // 1 percentage point = the smallest move worth calling progress\nconst MAX_STRIKES = 3;\nconst ROOT = new URL(\".\", import.meta.url).pathname;\nconst only = process.argv[2] ?? null;\n\n// The gate key for a report, from its ref path. Deriving it by string surgery\n// disagreed with the gate on exactly six of the nine rows — yfv, contact, atd,\n// svc, qa and team (measured 2026-09-09 against harness.json); the table knows.\n// keyOf (below) stays as the fallback for a run whose ref was rewritten.\nconst pageOf = (ref) => {\n  const path = new URL(ref).pathname.replace(/\\\\/$/, \"\") || \"/\";\n  return PAGES.find((p) => p.ref === path)?.key ?? null;\n};\n\nconst runs = [];\nconst unreadable = [];\nfor (const dir of readdirSync(ROOT).filter((d) => d.startsWith(\"out-\"))) {\n  let report;\n  try {\n    report = JSON.parse(readFileSync(join(ROOT, dir, \"report.json\"), \"utf8\"));\n  } catch {\n    continue; // not a completed run dir\n  }\n  if (!report.meta?.ref || !Array.isArray(report.regions)) continue;\n  // A report from another schema is still usable for a STALL count as long as\n  // it carries the two fields this reads. Anything else is counted and named,\n  // never silently dropped — an under-counted history reads as \"clear\".\n  const usable = report.regions.every(\n    (r) =>\n      typeof r.mismatchFraction === \"number\" && typeof r.pass === \"boolean\",\n  );\n  if (!usable) {\n    unreadable.push(\\`\\${dir} (schema \\${report.meta.schemaVersion ?? 0})\\`);\n    continue;\n  }\n  runs.push({\n    dir,\n    at: report.meta.generatedAt,\n    meta: report.meta,\n    regions: report.regions,\n  });\n}\n\n// The failure mode of a stall detector is always \"clear\", which is exactly the\n// answer that stops nobody. A corpus this could not read is not a clean one.\nif (runs.length === 0) {\n  console.error(\n    \\`strikes: no parseable gate run under matching/ — refusing to report \"clear\".\\` +\n      (unreadable.length\n        ? \\`\\\\n         \\${unreadable.length} report(s) unreadable at schema \\${REPORT_SCHEMA}: \\${unreadable.slice(0, 5).join(\", \")}\\`\n        : \"\"),\n  );\n  process.exit(2);\n}\nif (unreadable.length) {\n  console.error(\n    \\`strikes: ignored \\${unreadable.length} unreadable report(s) — the history below is incomplete.\\` +\n      \\`\\\\n         \\${unreadable.slice(0, 5).join(\", \")}\\`,\n  );\n}\n\nruns.sort((a, b) => a.at.localeCompare(b.at));\n\n// The gate page KEY, recovered from the run dir the way next.mjs does it\n// (out-<TAG>-<page>, split on the first hyphen — the tag is hyphen-free by\n// gate.sh's own preflight). \\`pageOf\\` now returns that same key off the table,\n// so the two vocabularies agree and the round protocol in CLAUDE.md — \"run\n// \\`strikes.mjs <page>\\` with the key you just passed to gate.sh\", which until\n// 2026-08-13 silently matched nothing — works either way. This stays because\n// a dir key is not always a gate key: 69 of this corpus's 377 run dirs are\n// hand-named probes (out-band3, out-390masked), and FLOORS matches on it.\nconst keyOf = (dir) => /^out-[^-]+-(.+)$/.exec(dir)?.[1] ?? null;\n\n// key -> chronological list of {dir, at, mm, pass, masked}\nconst history = new Map();\nconst seenNames = new Set();\nfor (const run of runs) {\n  const page = pageOf(run.meta.ref) ?? keyOf(run.dir) ?? \"unknown\";\n  const gateKey = keyOf(run.dir);\n  seenNames.add(page);\n  if (gateKey) seenNames.add(gateKey);\n  if (only && page !== only && gateKey !== only) continue;\n  for (const r of run.regions) {\n    // A DECLARED FLOOR is flat by definition — reporting it as stalled is noise\n    // that hides a real stall. It stays in the LEDGER; it does not belong here.\n    if (FLOORS.some((fl) => fl.match(r, gateKey || page))) continue;\n    const key = \\`\\${page}|\\${r.viewport}|\\${r.label}\\`;\n    if (!history.has(key)) history.set(key, []);\n    history.get(key).push({\n      dir: run.dir,\n      at: run.at,\n      mm: r.mismatchFraction,\n      dh: r.heightDeltaFraction,\n      pass: r.pass,\n      // a run with masks/neutralised media is not comparable to a clean one\n      dirty:\n        (run.meta.mask?.length ?? 0) > 0 ||\n        run.meta.neutralizeMedia ||\n        run.meta.maskPhotos,\n    });\n  }\n}\n\n// A name that matches no run must NOT report \"clear\". This check exists to stop\n// work on a stalled region, so failing open is the one thing it may never do —\n// a typo'd or wrong-vocabulary page silently greened rule 3 for six of the nine\n// pages. Fail loud instead, and say what the vocabulary is.\nif (only && history.size === 0) {\n  console.error(\n    \\`strikes: \"\\${only}\" matches no gate run — refusing to report \"clear\".\\\\n\\` +\n      \\`         known pages: \\${[...seenNames].sort().join(\", \")}\\`,\n  );\n  process.exit(2);\n}\n\nconst stuck = [];\nfor (const [key, all] of history) {\n  const h = all.filter((e) => !e.dirty); // compare like with like\n  if (h.length === 0) continue;\n  const last = h[h.length - 1];\n  if (last.pass) continue;\n\n  let best = Infinity;\n  let strikes = 0;\n  let sinceIdx = 0;\n  for (let i = 0; i < h.length; i++) {\n    if (h[i].mm < best - IMPROVE_PP) {\n      best = Math.min(best, h[i].mm);\n      strikes = 0;\n      sinceIdx = i;\n    } else {\n      best = Math.min(best, h[i].mm);\n      strikes++;\n    }\n  }\n  if (strikes >= MAX_STRIKES) stuck.push({ key, strikes, h, sinceIdx, last });\n}\n\n// Triage order: the worst-matching region that has never moved is the one whose\n// model is most wrong. Sorting by strike count instead would put a 0.3% region\n// that only fails on height above a 76% region that fails on everything.\nstuck.sort((a, b) => b.last.mm - a.last.mm);\n\nif (stuck.length === 0) {\n  console.log(\n    \\`strikes: clear — no failing region has stalled for \\${MAX_STRIKES}+ gate runs\\` +\n      (only ? \\` on \\${only}\\` : \"\") +\n      \".\",\n  );\n  process.exit(0);\n}\n\nconst why = (e) => {\n  const reasons = [];\n  if (e.mm > THRESHOLD) reasons.push(\\`pixels \\${(e.mm * 100).toFixed(1)}%\\`);\n  if (Math.abs(e.dh ?? 0) > MAX_HEIGHT_DELTA)\n    reasons.push(\\`height \\${((e.dh ?? 0) * 100).toFixed(1)}%\\`);\n  return reasons.join(\" + \") || \"marginal\";\n};\n\nconsole.log(\n  \\`STALLED — \\${stuck.length} failing region(s) have not moved in \\${MAX_STRIKES}+ gate runs.\\\\n\\` +\n    \\`These need a new model or the operator, not another attempt. Worst first:\\\\n\\`,\n);\nfor (const { key, strikes, h, sinceIdx, last } of stuck.slice(0, 20)) {\n  const [page, vw, label] = key.split(\"|\");\n  console.log(\n    \\`\\${page} @\\${vw}  \"\\${label}\"  — \\${why(last)}, flat across \\${strikes} runs\\`,\n  );\n  const window = h.slice(Math.max(0, sinceIdx));\n  const shown = window.length > 4 ? [window[0], ...window.slice(-3)] : window;\n  for (const [i, e] of shown.entries()) {\n    const gap =\n      window.length > 4 && i === 1\n        ? \\`    ... \\${window.length - 4} more ...\\\\n\\`\n        : \"\";\n    console.log(\n      gap +\n        \\`    \\${(e.mm * 100).toFixed(1).padStart(5)}%  \\${e.at.slice(0, 16).replace(\"T\", \" \")}  \\${e.dir}\\`,\n    );\n  }\n  console.log();\n}\nif (stuck.length > 20) console.log(\\`... and \\${stuck.length - 20} more.\\\\n\\`);\nconsole.log(\n  \"Per the matching skill: present the attempts to the operator.\\\\n\" +\n    \"Do NOT widen the threshold, add a mask, or reclassify them as a floor.\",\n);\nprocess.exit(1);\n`;\n\nexport const BUILD_SPEC_MJS_RELATIVE = \"matching/build-spec.mjs\";\nexport const BUILD_SPEC_MJS_TEMPLATE = `// Assemble matching/SPEC.md from the per-page sections in spec-sections/.\n//\n//   node matching/build-spec.mjs\n//\n// SPEC.md is the Phase 1 deliverable and the thing matching/gate.sh preflights\n// against, so it is GENERATED rather than hand-maintained: edit the section\n// file, rebuild. The page list comes from matching/harness.mjs (the same\n// reader gate.sh's \\`--table\\` loop uses) and the heading test from its\n// specHeadingRe, whose pattern is has_spec's grep verbatim — so a section can\n// no longer build fine here and then re-block its own page at the gate.\nimport { readFileSync, writeFileSync, existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { PAGES, specHeadingRe } from \"./harness.mjs\";\n\nconst DIR = new URL(\".\", import.meta.url).pathname;\nconst SECTIONS = join(DIR, \"spec-sections\");\n\n// Order = live's nav order, then the detail templates. Both fall out of the\n// table's own order within each group, so this is not a second list to keep.\nconst KEYS = [\n  ...PAGES.filter((p) => p.group === \"nav\"),\n  ...PAGES.filter((p) => p.group !== \"nav\"),\n].map((p) => p.spec ?? p.key);\n\nconst parts = [];\nconst missing = [];\n\nconst chrome = join(SECTIONS, \"_chrome.md\");\nif (existsSync(chrome)) parts.push(readFileSync(chrome, \"utf8\").trim());\nelse missing.push(\"_chrome\");\n\nfor (const page of KEYS) {\n  const file = join(SECTIONS, \\`\\${page}.md\\`);\n  if (!existsSync(file)) {\n    missing.push(page);\n    continue;\n  }\n  const body = readFileSync(file, \"utf8\").trim();\n  // The preflight greps \\`^##+ +<page>\\`; a section that does not open with its\n  // own key would build fine here and then refuse at the gate, which is the\n  // most confusing possible failure. Catch it now.\n  if (!specHeadingRe(page).test(body)) {\n    console.error(\n      \\`WARNING: \\${page}.md does not open with a '## \\${page}' heading — gate.sh will still refuse this page.\\`,\n    );\n  }\n  parts.push(body);\n}\n\n// The header is a spec-section like any other, so a site can say what a\n// citation looks like there and what its own ladders are. DEFAULT_HEADER is\n// what a site gets before it writes one: the two paragraphs that are true of\n// every project, and nothing that is not.\nconst DEFAULT_HEADER = \\`# Reference spec\n\nGENERATED by \\\\\\`node matching/build-spec.mjs\\\\\\` from \\\\\\`matching/spec-sections/\\\\\\`.\nEdit the section files, not this one.\n\nThis is the Phase 1 deliverable of the \\\\\\`matching-a-page\\\\\\` skill and the\nprecondition \\\\\\`matching/gate.sh\\\\\\` enforces: a page with no section here does not\nget a geometry round (see the matching rules in CLAUDE.md).\n\n\\`;\nconst headerFile = join(SECTIONS, \"_header.md\");\nconst header = existsSync(headerFile)\n  ? readFileSync(headerFile, \"utf8\").trimEnd() + \"\\\\n\\\\n\"\n  : DEFAULT_HEADER;\n\nwriteFileSync(join(DIR, \"SPEC.md\"), header + parts.join(\"\\\\n\\\\n---\\\\n\\\\n\") + \"\\\\n\");\n\nconst built = KEYS.length - missing.filter((m) => m !== \"_chrome\").length;\nconsole.log(\n  \\`SPEC.md built — \\${built}/\\${KEYS.length} pages\\${missing.length ? \\`, MISSING: \\${missing.join(\", \")}\\` : \"\"}\\`,\n);\nprocess.exit(missing.length ? 1 : 0);\n`;\n\nexport const CENSUS_COUNT_MJS_RELATIVE = \"matching/census-count.mjs\";\nexport const CENSUS_COUNT_MJS_TEMPLATE = `// Count one style-census log, splitting declared deviations out of the total.\n//\n//   node matching/census-count.mjs matching/census-home-1440.log\n//   -> \"<real> <ambiguous> <declared>\"\n//\n// census.sh calls this per page/viewport. Parsing the log rather than importing\n// style-census keeps the project's declared-deviation policy out of the shared\n// skill — the skill reports what it sees; the project decides what it has\n// already agreed to.\nimport { readFileSync } from \"node:fs\";\nimport { DECLARED } from \"./census-deviations.mjs\";\n\nconst path = process.argv[2];\nif (!path) {\n  console.error(\"usage: census-count.mjs <census log>\");\n  process.exit(2);\n}\n\n// A log that cannot be READ is not a log with nothing IN it. This printed\n// \"0 0 0\" and exited 0, and census.sh added that to its total — the same green\n// it used to grant for a style-census that never ran. There is no count to\n// give here; say so and let the caller decide, which is never zero.\nlet text = \"\";\ntry {\n  text = readFileSync(path, \"utf8\");\n} catch (e) {\n  console.error(\\`census-count: cannot read \\${path} — \\${e.message}\\`);\n  console.error(\"              a missing log is not a census with no findings.\");\n  process.exit(2);\n}\n\nconst [head, tail = \"\"] = text.split(\"--- AMBIGUOUS\");\n\n/** Pull \\`{label, ref, cand}\\` rows out of a census section. */\nfunction rows(section) {\n  const out = [];\n  const lines = section.split(\"\\\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    if (!/^ {2}y=/.test(lines[i])) continue;\n    const label = lines[i].replace(/^\\\\s*y=\\\\s*\\\\d+\\\\s*/, \"\").trim();\n    const refs = [];\n    const cands = [];\n    for (\n      let j = i + 1;\n      j < lines.length && /^ {4}(ref|cand):/.test(lines[j]);\n      j++\n    ) {\n      const v = lines[j].replace(/^\\\\s*(ref|cand):\\\\s*/, \"\").trim();\n      (lines[j].trim().startsWith(\"ref:\") ? refs : cands).push(v);\n    }\n    if (refs.length && cands.length)\n      out.push({ label, ref: refs[0], cand: cands[0] });\n    else out.push({ label, ref: refs[0] ?? \"\", cand: cands[0] ?? \"\" });\n  }\n  return out;\n}\n\nconst mism = rows(head);\nconst amb = rows(tail);\nconst declared = mism.filter((r) => DECLARED.some((d) => d.match(r)));\nconsole.log(\n  \\`\\${mism.length - declared.length} \\${amb.length} \\${declared.length}\\`,\n);\n`;\n\nexport const HARNESS_JSON_RELATIVE = \"matching/harness.json\";\nexport const HARNESS_JSON_TEMPLATE = `{\n  \"ref\": \"__REF__\",\n  \"cand\": \"http://localhost:5173\",\n  \"matrix\": [\n    1440,\n    834,\n    390\n  ],\n  \"threshold\": 0.1,\n  \"maxHeightDelta\": 0.05,\n  \"refMark\": \"\",\n  \"candMark\": \"_app/immutable\",\n  \"selfHosts\": [],\n  \"pages\": {\n    \"home\": {\n      \"uid\": \"home\",\n      \"ref\": \"/\",\n      \"cand\": \"/dev/match/home\",\n      \"published\": \"/\",\n      \"anchors\": [],\n      \"spec\": \"home\",\n      \"group\": \"nav\"\n    }\n  }\n}\n`;\n\nexport const FLOORS_MJS_RELATIVE = \"matching/floors.mjs\";\nexport const FLOORS_MJS_TEMPLATE = `// The failures we have already established are NOT geometry. Shared by\n// next.mjs (which reports them separately from the backlog) and strikes.mjs\n// (which must not report them as stalled — a region that cannot move is flat\n// by definition, and three strikes on one is noise that hides a real stall).\n// Every entry needs a matching LEDGER entry to stay honest.\n//\n// NOTE the second matcher argument. Region records carry \\`label\\` and\n// \\`viewport\\` but not the page, so an entry keyed on label+viewport alone is\n// safe only where the label is unique site-wide. \"top\" is not — every page has\n// one — so such an entry would silently accept the \\`top\\` failure on EVERY page\n// and hide every real one. next.mjs and strikes.mjs pass the page key as the\n// second argument: take \\`(r, page)\\` unless you have checked the label.\n\n/** Reference behaviour we cannot reproduce (declared floors). */\nexport const FLOORS = [];\n\n/** Regions the OPERATOR has looked at and chosen to leave failing. These are\n *  not floors and are not silently dropped: next.mjs prints them under their\n *  own heading with the decision, so the number never quietly improves. */\nexport const ACCEPTED = [];\n`;\n\nexport const CENSUS_DEVIATIONS_MJS_RELATIVE = \"matching/census-deviations.mjs\";\nexport const CENSUS_DEVIATIONS_MJS_TEMPLATE = `// Style-census rows the OPERATOR has looked at and chosen to keep. Same\n// contract as matching/floors.mjs: nothing is hidden, everything is counted\n// under its own heading, and every entry needs a LEDGER entry to stay honest.\n//\n//   node matching/census-count.mjs <log>   -> \"<real> <ambiguous> <declared>\"\n//\n// Without this, \\`census.sh\\` can never reach zero and an \"N remaining\" figure\n// says nothing about how much work is left — one permanent decision is counted\n// once per page per viewport, so a single ACK can account for dozens of rows.\n\n/** A row is \\`{ label, ref, cand }\\`, each of ref/cand a \"fam | wt | size | lh |\n *  ls | transform | colour\" tuple string. */\nexport const DECLARED = [];\n`;\n\nexport const SPEC_CHROME_MD_RELATIVE = \"matching/spec-sections/_chrome.md\";\nexport const SPEC_CHROME_MD_TEMPLATE = `## shared chrome\n\nSite-wide furniture that renders identically on every page — header, footer, and\nanything else the per-page sections would otherwise restate. Phase 1 of the\n\\`matching-a-page\\` skill fills this in; until it does, this section is a\nplaceholder and \\`matching/SPEC.md\\` has no shared-chrome contract to cite.\n`;\n\nexport const SPEC_HEADER_MD_RELATIVE = \"matching/spec-sections/_header.md\";\nexport const SPEC_HEADER_MD_TEMPLATE = `# Reference spec\n\nGENERATED by \\`node matching/build-spec.mjs\\` from \\`matching/spec-sections/\\`.\nEdit the section files, not this one.\n\nThis is the Phase 1 deliverable of the \\`matching-a-page\\` skill and the\nprecondition \\`matching/gate.sh\\` enforces: a page with no section here does not\nget a geometry round (see the matching rules in CLAUDE.md).\n`;\n\nexport const LEDGER_MD_RELATIVE = \"matching/LEDGER.md\";\nexport const LEDGER_MD_TEMPLATE = `# Deviations / masks / floors ledger\n\nAppend-only, and written at the moment a decision is made — not reconstructed at\nthe end of a round, when the reason has already been lost. An entry is never\nedited to be right: a later entry corrects an earlier one and says which.\n\nEvery entry in \\`matching/floors.mjs\\` and \\`matching/census-deviations.mjs\\`, and\nevery mask in \\`matching/harness.json\\`, needs a line here. Without one the gate\nhas been quietly widened and nothing records who widened it, or why.\n\n- [deviation | floor | mask | a11y] \\`<region or selector>\\` — what differs, why\n  it is accepted, and the evidence: a spec citation, a census row, a gate run.\n`;\n\nexport const MATCH_ROUTE_SERVER_RELATIVE = \"src/routes/dev/match/[uid]/+page.server.ts\";\nexport const MATCH_ROUTE_SERVER_TEMPLATE = `import { error } from \"@sveltejs/kit\";\nimport { dev } from \"$app/environment\";\nimport { documents } from \"$lib/site-pages.js\";\n\n// Local matching surface: renders the EXACT assembly \\`reddoor-maint\n// prismic-seed\\` publishes, from the same module, so a fix made to pass a gate\n// is a fix to what ships. Not prerendered, SSR-on-demand, dev-only.\nexport const prerender = false;\n\n// The seed resolves images to asset ids; here they only need a URL. Dimensions\n// are nominal — slices size their own image boxes in CSS.\nconst devImg = (u: string) => ({\n  url: u,\n  alt: null,\n  copyright: null,\n  dimensions: { width: 1600, height: 1067 },\n  edit: { x: 0, y: 0, zoom: 1, background: \"transparent\" },\n  id: u,\n});\n\nexport async function load({ params }) {\n  // FIRST statement: everything below reads fixtures that must not be reachable\n  // from a production build. The launch recipe asserts this route 404s on the\n  // deployed URL, with /dev/a11y-fixtures as the 200 control.\n  if (!dev) error(404, { message: \"Not found\" });\n\n  const docs = documents(devImg) as Array<{ uid: string; data: { slices?: unknown[] } }>;\n  const doc = docs.find((d) => d.uid === params.uid);\n  if (!doc)\n    error(404, {\n      message: \\`no assembly for \"\\${params.uid}\" (have: \\${docs.map((d) => d.uid).join(\", \") || \"none\"})\\`,\n    });\n\n  return { uid: params.uid, slices: doc.data.slices ?? [] };\n}\n`;\n\nexport const MATCH_ROUTE_PAGE_RELATIVE = \"src/routes/dev/match/[uid]/+page.svelte\";\nexport const MATCH_ROUTE_PAGE_TEMPLATE = `<script lang=\"ts\">\n  import { SliceZone } from \"@prismicio/svelte\";\n  import { components } from \"$lib/slices\";\n\n  let { data } = $props();\n</script>\n\n<SliceZone slices={data.slices as never} {components} />\n`;\n\nexport const SITE_PAGES_JS_RELATIVE = \"src/lib/site-pages.js\";\nexport const SITE_PAGES_JS_TEMPLATE = `// The page assemblies for this site — the SINGLE source of truth for both\n// consumers: \\`reddoor-maint prismic-seed\\`, which publishes them through the\n// Migration API, and src/routes/dev/match/[uid], the local matching surface.\n// Because both read from here, any fix made to pass a gate is a fix to what\n// ships.\n//\n// THE MIGRATION API DROPS SILENTLY. It validates against the slice models\n// registered in Prismic and discards every field the model does not declare —\n// HTTP 200, no warning. A fixture field with no model behind it renders here and\n// vanishes on the published route. src/lib/site-pages.test.ts is the mechanical\n// check; run it before every seed.\n//\n// PURE by contract: no node:*, no fetch, no token, no side effects at import,\n// so Vite can bundle it into the dev route and node can import it into the seed.\n\nexport const lang = \"en-us\";\n\n/**\n * @param {(url: string) => unknown} img resolves an image URL to whatever the\n *   caller needs — an asset \\`{id}\\` for the seed, a \\`{url}\\` for the dev route.\n * @returns {Array<{type: string, uid: string, title: string, data: Record<string, unknown>}>}\n */\nexport function documents(img) {\n  void img;\n  return [];\n}\n`;\n\nexport const SITE_PAGES_TEST_RELATIVE = \"src/lib/site-pages.test.ts\";\nexport const SITE_PAGES_TEST_TEMPLATE = `// The page assemblies in src/lib/site-pages.js are the SINGLE source of truth\n// shared by two consumers: the local matching route (src/routes/dev/match/[uid])\n// and \\`reddoor-maint prismic-seed\\`, which publishes them to Prismic.\n//\n// Those two consumers do NOT validate the same way. The dev route hands the\n// object straight to the slice components, so any field a fixture sets is\n// simply there. The Migration API validates against the slice models registered\n// in Prismic and SILENTLY DROPS every field the model does not declare — no\n// error, no warning, a 200. A page can gate green locally and publish wrong.\n//\n// This test is the mechanical check. It fails the moment a fixture carries a\n// field its slice model does not declare — before the seed runs, not after the\n// content is published. Run it before every seed.\nimport { describe, expect, it } from \"vitest\";\nimport { readFileSync, readdirSync, existsSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, join } from \"node:path\";\nimport { documents } from \"./site-pages.js\";\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst SLICES = join(HERE, \"slices\");\n\ntype Variation = { primary: string[]; items: string[] };\ntype Slice = {\n  slice_type: string;\n  variation: string;\n  primary?: Record<string, unknown>;\n  items?: Array<Record<string, unknown>>;\n};\n\n/** Every slice model in src/lib/slices, indexed by its Prismic slice id. */\nfunction loadModels(): Record<string, Record<string, Variation>> {\n  const out: Record<string, Record<string, Variation>> = {};\n  if (!existsSync(SLICES)) return out;\n  for (const dir of readdirSync(SLICES)) {\n    const file = join(SLICES, dir, \"model.json\");\n    if (!existsSync(file)) continue;\n    const model = JSON.parse(readFileSync(file, \"utf8\"));\n    out[model.id] = Object.fromEntries(\n      (model.variations ?? []).map((v: Record<string, unknown>) => [\n        v.id,\n        {\n          primary: Object.keys((v.primary as object) ?? {}),\n          items: Object.keys((v.items as object) ?? {}),\n        },\n      ]),\n    );\n  }\n  return out;\n}\n\n/** Image resolver stub — shape only; this test never reads image values. */\nconst stubImg = () => ({ url: \"https://example.test/x.jpg\" });\n\ndescribe(\"site-pages documents vs slice models\", () => {\n  const models = loadModels();\n  const docs = documents(stubImg) as Array<{ uid: string; data: { slices?: Slice[] } }>;\n  const pages: Array<[string, Slice[]]> = docs.map((d) => [d.uid, d.data.slices ?? []]);\n\n  it(\"declares every slice type the documents use\", () => {\n    const missing = new Set<string>();\n    for (const [, slices] of pages)\n      for (const s of slices) if (!models[s.slice_type]) missing.add(s.slice_type);\n    expect([...missing]).toEqual([]);\n  });\n\n  it(\"declares every variation the documents use\", () => {\n    const missing: string[] = [];\n    for (const [uid, slices] of pages)\n      for (const s of slices) {\n        const model = models[s.slice_type];\n        if (model && !model[s.variation]) missing.push(\\`\\${uid}: \\${s.slice_type}/\\${s.variation}\\`);\n      }\n    expect(missing).toEqual([]);\n  });\n\n  // The one that catches a silent Migration-API drop.\n  it(\"declares every field the documents set, so Prismic strips nothing\", () => {\n    const stripped: string[] = [];\n    for (const [uid, slices] of pages)\n      for (const s of slices) {\n        const variation = models[s.slice_type]?.[s.variation];\n        if (!variation) continue;\n        for (const key of Object.keys(s.primary ?? {}))\n          if (!variation.primary.includes(key))\n            stripped.push(\\`\\${uid} \\${s.slice_type}/\\${s.variation} primary.\\${key}\\`);\n        const itemKeys = new Set((s.items ?? []).flatMap((i) => Object.keys(i)));\n        for (const key of itemKeys)\n          if (!variation.items.includes(key))\n            stripped.push(\\`\\${uid} \\${s.slice_type}/\\${s.variation} items.\\${key}\\`);\n      }\n    expect(stripped).toEqual([]);\n  });\n});\n`;\n\nexport const MATCH_HARNESS_FILES: readonly HarnessFile[] = [\n  { rel: HARNESS_MJS_RELATIVE, template: HARNESS_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: GATE_SH_RELATIVE, template: GATE_SH_TEMPLATE, owner: \"recipe\" },\n  { rel: CENSUS_SH_RELATIVE, template: CENSUS_SH_TEMPLATE, owner: \"recipe\" },\n  { rel: NEXT_MJS_RELATIVE, template: NEXT_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: STRIKES_MJS_RELATIVE, template: STRIKES_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: BUILD_SPEC_MJS_RELATIVE, template: BUILD_SPEC_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: CENSUS_COUNT_MJS_RELATIVE, template: CENSUS_COUNT_MJS_TEMPLATE, owner: \"recipe\" },\n  { rel: HARNESS_JSON_RELATIVE, template: HARNESS_JSON_TEMPLATE, owner: \"site\" },\n  { rel: FLOORS_MJS_RELATIVE, template: FLOORS_MJS_TEMPLATE, owner: \"site\" },\n  { rel: CENSUS_DEVIATIONS_MJS_RELATIVE, template: CENSUS_DEVIATIONS_MJS_TEMPLATE, owner: \"site\" },\n  { rel: SPEC_CHROME_MD_RELATIVE, template: SPEC_CHROME_MD_TEMPLATE, owner: \"site\" },\n  { rel: SPEC_HEADER_MD_RELATIVE, template: SPEC_HEADER_MD_TEMPLATE, owner: \"site\" },\n  { rel: LEDGER_MD_RELATIVE, template: LEDGER_MD_TEMPLATE, owner: \"site\" },\n  { rel: MATCH_ROUTE_SERVER_RELATIVE, template: MATCH_ROUTE_SERVER_TEMPLATE, owner: \"recipe\" },\n  { rel: MATCH_ROUTE_PAGE_RELATIVE, template: MATCH_ROUTE_PAGE_TEMPLATE, owner: \"recipe\" },\n  { rel: SITE_PAGES_JS_RELATIVE, template: SITE_PAGES_JS_TEMPLATE, owner: \"site\" },\n  { rel: SITE_PAGES_TEST_RELATIVE, template: SITE_PAGES_TEST_TEMPLATE, owner: \"recipe\" },\n];\n\nconst HARNESS_MJS_PREV_0_95_0 = `// The single source for everything the matching gates need to know about this\n// site. DATA lives in matching/harness.json (site-edited); this file is the\n// READ LAYER — edit harness.json, not this. (It is installed and upgraded by\n// the \\`reddoor-maint match-harness\\` recipe, which owns these bytes: a hand\n// edit here is flagged on the next run and never silently overwritten.)\n//\n// It exists because the page table, the two hosts, the matrix, the threshold\n// and the skill path were hand-copied all over matching/. Re-measured\n// 2026-09-09 AFTER the six-probe conversion, over the 216 tracked scripts under\n// matching/ (214 top-level — 212 .mjs + 2 .sh — plus 2 in states/):\n//\n//   • a hand-typed copy of the page table (three or more gate keys sitting next\n//     to their route): 8 files. Exactly ONE of them, probe-chrome-count.mjs,\n//     still carries all nine rows; probe-anchors.mjs carries five; the other\n//     six are three-row detail triples (team/svc/qa).\n//   • the skill path (~/.claude/skills/matching-a-page): 193 copies\n//   • the viewport matrix (1440/834/390): 51 copies\n//   • REF pointed at a host listed in selfHosts — i.e. comparing the candidate\n//     with itself: 12 scripts, one of which (probe-chrome-count.mjs) is also\n//     the last nine-row table carrier\n//\n// The first bullet read \"the nine-row page table: 5 copies — gate.sh,\n// probe-anchor-parity.mjs, sweep-all10.sh, sweep-all16.sh, sweep-final.sh\" when\n// it was written here at 922dde3. It was wrong within the hour and wrong on two\n// counts: 4e2cd7b took the table out of gate.sh, and the list never named\n// states/index.mjs or probe-chrome-count.mjs, which were both carrying nine-row\n// copies at the time. A census is a claim about code; it has to be measured\n// against the tree, not recalled.\n//\n//   node matching/harness.mjs --env        shell-safe KEY='value' lines\n//   node matching/harness.mjs --table      key<TAB>ref<TAB>cand<TAB>anchors\n//   node matching/harness.mjs --check-ref  the D11 preflight; exit 2 on failure\nimport { readFileSync, realpathSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\n\n// fileURLToPath, not URL#pathname: pathname is percent-encoded, so a checkout\n// under a directory with a space in it would resolve to a path that does not\n// exist.\nconst DIR = fileURLToPath(new URL(\".\", import.meta.url));\nconst CFG = JSON.parse(readFileSync(join(DIR, \"harness.json\"), \"utf8\"));\n\n// Env overrides exist for one-off probes only. They are NOT how a site is\n// configured — harness.json is, so that what a gate ran against is committed.\nexport const REF = process.env.MATCH_REF ?? CFG.ref;\nexport const CAND = process.env.MATCH_CAND ?? process.env.CAND_BASE ?? CFG.cand;\nexport const MATRIX = CFG.matrix;\nexport const THRESHOLD = CFG.threshold;\nexport const MAX_HEIGHT_DELTA = CFG.maxHeightDelta;\nexport const REF_MARK = CFG.refMark;\nexport const CAND_MARK = CFG.candMark;\nexport const SELF_HOSTS = CFG.selfHosts ?? [];\n\n/** One record per gated page, in harness.json order. \\`key\\` is the gate key\n *  (out-<TAG>-<key>, the SPEC heading, spec-sections/<key>.md); \\`uid\\` is the\n *  Prismic uid or null where the page has no /dev/match twin. */\nexport const PAGES = Object.entries(CFG.pages).map(([key, p]) => ({ key, ...p }));\nexport const byKey = Object.fromEntries(PAGES.map((p) => [p.key, p]));\n\n// DERIVED, never hand-typed: page-diff cuts one region before the first anchor\n// (\"top\") plus one per anchor, at every viewport. The old hand-written map went\n// stale the moment an anchor list changed, and a wrong denominator makes the\n// score a lie in the flattering direction.\nexport const TOTALS = Object.fromEntries(\n  PAGES.map((p) => [p.key, (p.anchors.length + 1) * MATRIX.length]),\n);\n\n/** The SPEC.md heading predicate, shared by gate.sh's preflight and\n *  build-spec.mjs so a section can never build fine and then refuse at the\n *  gate. Matches the key followed by any non-key character (\\`## team\\` matches,\n *  \\`## teamfoo\\` does not, \\`## our-team\\` cannot match \\`team\\`). */\nexport const specHeadingRe = (key) => new RegExp(\\`^##+ +\\${key}([^A-Za-z0-9_-]|$)\\`, \"m\");\n\nexport const SKILL_DIR =\n  process.env.MATCHING_SKILL_DIR ?? join(homedir(), \".claude/skills/matching-a-page\");\nexport const PD = join(SKILL_DIR, \"page-diff.mjs\");\nexport const SC = join(SKILL_DIR, \"style-census.mjs\");\nexport const PLAYWRIGHT = pathToFileURL(join(SKILL_DIR, \"node_modules/playwright/index.mjs\")).href;\n\n/** The report format this site's scripts can read, so gate.sh can compare it\n *  with \\`page-diff --version\\` before spending a run and next.mjs can refuse\n *  rather than quietly drop a page whose newest report came from another\n *  schema. Both do that now — gate.sh preflights \\`page-diff --version\\` against\n *  this value before spending a run, and next.mjs counts a foreign-schema\n *  report as MISSING rather than skipping it. (This said \"neither does that\n *  yet\" — true at 922dde3 where it was written, false from 4e2cd7b, which\n *  gave gate.sh the preflight and did not come back here.) Checked 2026-09-09\n *  against the installed skill: \\`page-diff --version\\` → \\`page-diff 0.1.0\n *  report-schema 1\\`. */\nexport const REPORT_SCHEMA = 1;\n\n/**\n * Fail-closed reference preflight. A 200 is NOT evidence: a host that has been\n * repointed at our own build answers 200, and so does a staging host serving a\n * 404 page. Both have happened on a real site — see the dated measurement in\n * LEDGER.md. A pass here requires an artefact only the reference produces.\n */\nexport async function checkRef() {\n  if (!REF_MARK) {\n    return {\n      ok: false,\n      why: \"harness.json refMark is empty — set it to a string only the reference serves (a Webflow site id, a build hash). A 200 is not evidence.\",\n    };\n  }\n  const host = new URL(REF).host;\n  if (SELF_HOSTS.includes(host)) return { ok: false, why: \\`REF host \\${host} is in selfHosts\\` };\n  if (host === new URL(CAND).host) return { ok: false, why: \\`REF host \\${host} equals CAND's host\\` };\n  let res;\n  try {\n    res = await fetch(\\`\\${REF}/\\`, { redirect: \"manual\" });\n  } catch (e) {\n    return { ok: false, why: \\`GET \\${REF}/ failed: \\${e.message}\\` };\n  }\n  if (res.status !== 200)\n    return { ok: false, why: \\`GET \\${REF}/ → HTTP \\${res.status}, expected 200\\` };\n  const loc = res.headers.get(\"location\");\n  if (loc) return { ok: false, why: \\`GET \\${REF}/ → \\${res.status} redirect to \\${loc}\\` };\n  const body = await res.text();\n  if (!body.includes(REF_MARK))\n    return {\n      ok: false,\n      why: \\`\\${REF}/ served 200 but WITHOUT refMark \\${JSON.stringify(REF_MARK)} — that is not the reference\\`,\n    };\n  if (CAND_MARK && body.includes(CAND_MARK))\n    return {\n      ok: false,\n      why: \\`\\${REF}/ contains candMark \\${JSON.stringify(CAND_MARK)} — REF is serving OUR build\\`,\n    };\n  return { ok: true, why: \\`\\${REF}/ → 200, no redirect, refMark present, candMark absent\\` };\n}\n\n// CLI. Both sides go through realpathSync. \\`import.meta.url\\` is ALREADY the\n// resolved real path (node resolves symlinks unless --preserve-symlinks) while\n// process.argv[1] is the path as typed, so a plain pathToFileURL compare goes\n// false the moment any component of the invoked path is a symlink — and then\n// the CLI prints nothing and exits 0, which every caller reads as success.\n// page-diff.mjs:184-189 records exactly that defect and the same fix: \"The\n// pathToFileURL compare that replaced the old template string is still false\n// whenever ANY component of the invoked path is a symlink — which is how this\n// skill is installed now (~/.claude/skills/matching-a-page -> the claude-skills\n// checkout). isMain() resolves the real path on both sides.\"\nconst isMain = () => {\n  if (!process.argv[1]) return false;\n  try {\n    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);\n  } catch {\n    return false;\n  }\n};\n\nif (isMain()) {\n  const mode = process.argv[2];\n  const q = (v) => \\`'\\${String(v).replace(/'/g, \\`'\\\\\\\\''\\`)}'\\`;\n  if (mode === \"--env\") {\n    const pairs = [\n      [\"REF\", REF],\n      [\"CAND\", CAND],\n      [\"MATRIX\", MATRIX.join(\",\")],\n      [\"VIEWPORTS_SP\", MATRIX.join(\" \")],\n      [\"THRESHOLD\", THRESHOLD],\n      [\"MAX_HEIGHT_DELTA\", MAX_HEIGHT_DELTA],\n      [\"PD\", PD],\n      [\"SC\", SC],\n      [\"REPORT_SCHEMA\", REPORT_SCHEMA],\n    ];\n    for (const [k, v] of pairs) console.log(\\`\\${k}=\\${q(v)}\\`);\n  } else if (mode === \"--table\") {\n    for (const p of PAGES) console.log([p.key, p.ref, p.cand, p.anchors.join(\",\")].join(\"\\\\t\"));\n  } else if (mode === \"--check-ref\") {\n    const r = await checkRef();\n    console.log(\\`\\${r.ok ? \"REF OK\" : \"REF REFUSED\"} — \\${r.why}\\`);\n    process.exit(r.ok ? 0 : 2);\n  } else {\n    console.error(\"usage: harness.mjs --env | --table | --check-ref\");\n    process.exit(2);\n  }\n}\n`;\n\nconst GATE_SH_PREV_0_95_0 = `#!/usr/bin/env bash\n# The matching gate. This file is generic — everything specific to a site lives\n# in matching/harness.json (the data) and matching/LEDGER.md (the why). It is\n# installed and upgraded by the \\`reddoor-maint match-harness\\` recipe, which\n# owns these bytes: a hand edit here is flagged on the next run, never\n# silently overwritten.\n#\n#   bash matching/gate.sh <round-tag> [page ...]\n#\n# Runs page-diff for every page in the table (or just the named ones) at the\n# full breakpoint matrix and writes matching/out-<round-tag>-<page>/.\n#\n# The matrix, the anchor lists, the reference and the candidate are DATA. Why a\n# site chose them — which live breakpoint band hid what, why an anchor is a\n# heading and not a button label — belongs in matching/LEDGER.md, which is dated\n# and append-only, because JSON holds no comments.\n#\n# NO MASKS and the threshold from harness.json everywhere: the numbers stay\n# honest and a known floor stays visible as its own region. A media-neutralised\n# secondary read is \\`node \"$PD\" ... --neutralize-media\\`; next.mjs ignores such\n# runs on purpose (next.mjs:57-64).\n#\n# PREFLIGHT (see the matching rules in CLAUDE.md): a page with no section in\n# matching/SPEC.md has not had Phase 1 done, and its geometry must not be\n# touched. Skipping the spec is how a reference's root-font ladder and its\n# per-component height ladders get found reactively, after the region has\n# already failed several rounds. This refuses the run instead of trusting anyone\n# to remember.\nset -u\n# Everything configurable lives in matching/harness.json; harness.mjs is the one\n# reader. --env emits shell-safe assignments (REF, CAND, MATRIX, VIEWPORTS_SP,\n# THRESHOLD, MAX_HEIGHT_DELTA, PD, SC, REPORT_SCHEMA).\neval \"$(node \"$(dirname \"$0\")/harness.mjs\" --env)\"\n\n# The skill must be able to write reports this site's scripts can read. Cheap,\n# local, and it fails before any browser starts.\nPD_SCHEMA=\"$(node \"$PD\" --version 2>/dev/null | awk '{print $4}')\"\nif [ \"$PD_SCHEMA\" != \"$REPORT_SCHEMA\" ]; then\n  echo \"gate.sh: page-diff writes report schema '\\${PD_SCHEMA:-none}', this harness reads $REPORT_SCHEMA.\" >&2\n  echo \"         Update matching/harness.mjs REPORT_SCHEMA or the matching-a-page skill.\" >&2\n  exit 2\nfi\nSPEC=\"$(dirname \"$0\")/SPEC.md\"\nTAG=\"\\${1:?usage: gate.sh <round-tag> [page ...]}\"\n# The tag must not contain a hyphen. Output dirs are \"out-<TAG>-<page>\", and\n# next.mjs recovers the page with /^out-[^-]+-(.+)$/ — it splits on the FIRST\n# hyphen, so a tag like \"r-forms-2026-08-07\" yields the page key\n# \"forms-2026-08-07-yfv\" and that run is silently never counted. It cannot split\n# on the last hyphen instead, because page keys have hyphens of their own\n# (\"our-team\", \"ask-the-doctor\"). Failing here is the cheap end of that: a\n# mis-tagged round otherwise LOOKS green because next.mjs keeps reading an older\n# report for the page you just changed. (Cost this once, 2026-08-07.)\ncase \"$TAG\" in\n  *-*)\n    echo \"gate.sh: round tag must not contain a hyphen (got '$TAG').\" >&2\n    echo \"         out-<TAG>-<page> is parsed on the first hyphen, so a\" >&2\n    echo \"         hyphenated tag hides the run from next.mjs. Try '\\${TAG//-/}'.\" >&2\n    exit 2\n    ;;\nesac\nshift || true\nWANT=(\"$@\")\n\n# Fail closed on the reference before spending a single run. A 200 is NOT\n# evidence: a production host that has cut over to OUR build answers 200, and\n# every region then scores near zero against itself. --check-ref requires an\n# artefact only the reference serves (harness.json refMark) and refuses a\n# redirect, a host listed in selfHosts, and a body carrying candMark. Measured\n# on the site this harness was cut from, 2026-09-09 AFTER the consolidation:\n# 12 of its 214 top-level matching scripts still assign REF a host listed in\n# selfHosts — i.e. compare the candidate with itself. It was 33 of 229 before.\n# (This comment read \"33 of its 230\" while sitting in the post-consolidation\n# tree, contradicting harness.mjs's 12 three files away.)\nif ! node \"$(dirname \"$0\")/harness.mjs\" --check-ref; then\n  echo \"gate.sh: refusing to gate against an unverified reference.\" >&2\n  exit 2\nfi\n\n# Set SPEC_OPTIONAL=1 only for a read-only baseline sweep of pages you are not\n# about to edit. It is recorded in the round tag so the exemption is visible.\nSPEC_OPTIONAL=\"\\${SPEC_OPTIONAL:-0}\"\n\nhas_spec() { # page\n  # NB: the obvious \\`( |$|\\\\b)\\` guard is rejected by ugrep as an empty\n  # subexpression, and a preflight that errors out fails CLOSED — it refused all\n  # 9 pages while SPEC.md was complete. Match the page key followed by any\n  # non-key character (so \\`## team\\` matches but \\`## teamfoo\\` does not; \\`##\n  # our-team\\` cannot match \\`team\\` because the key must follow the spaces).\n  [ -f \"$SPEC\" ] && grep -qE \"^##+ +$1([^A-Za-z0-9_-]|$)\" \"$SPEC\"\n}\n\nrun() { # tag refpath candpath sections\n  local page=\"$1\" refpath=\"$2\" candpath=\"$3\" sections=\"$4\"\n  if [ \\${#WANT[@]} -gt 0 ]; then\n    local hit=0\n    for w in \"\\${WANT[@]}\"; do [ \"$w\" = \"$page\" ] && hit=1; done\n    [ $hit -eq 1 ] || return 0\n  fi\n  if ! has_spec \"$page\"; then\n    if [ \"$SPEC_OPTIONAL\" = \"1\" ]; then\n      echo \"########## $page ##########\"\n      echo \"WARNING: no '## $page' section in matching/SPEC.md — Phase 1 not done.\"\n      echo \"         Running anyway because SPEC_OPTIONAL=1 (baseline read only).\"\n      echo \"         Do NOT apply geometry fixes off this run.\"\n    else\n      echo \"########## $page ##########\"\n      echo \"REFUSED: no '## $page' section in matching/SPEC.md.\"\n      echo \"         Phase 1 (section census + per-section spec, read from\"\n      echo \"         matching/spec/) comes before geometry.\"\n      echo \"         See CLAUDE.md rule 2. SPEC_OPTIONAL=1 for a baseline read.\"\n      FAILED_PREFLIGHT=1\n      return 0\n    fi\n  fi\n  echo \"########## $page ##########\"\n  node \"$PD\" --ref \"$REF$refpath\" --cand \"$CAND$candpath\" \\\\\n    --viewports \"$MATRIX\" --threshold \"$THRESHOLD\" \\\\\n    --sections \"$sections\" --out \"matching/out-$TAG-$page\" \\\\\n    > \"matching/out-$TAG-$page.log\" 2>&1\n  echo \"$page exit=$?\"\n}\n\n# The page table is matching/harness.json. Process substitution, NOT a pipe:\n# a pipe would run this loop in a subshell and FAILED_PREFLIGHT would not\n# survive to the check below, so a refused page would exit 0.\nwhile IFS=$'\\\\t' read -r key refpath candpath anchors; do\n  run \"$key\" \"$refpath\" \"$candpath\" \"$anchors\"\ndone < <(node \"$(dirname \"$0\")/harness.mjs\" --table)\n\nif [ \"\\${FAILED_PREFLIGHT:-0}\" = \"1\" ]; then\n  echo\n  echo \"GATE INCOMPLETE ($TAG) — one or more pages were refused for a missing\"\n  echo \"SPEC.md section. Those pages have NOT been measured; do not report a\"\n  echo \"score for them.\"\n  exit 2\nfi\necho \"ALL DONE ($TAG)\"\n`;\n\nconst NEXT_MJS_PREV_0_95_0 = `// What is still broken, ranked. Exits 1 while work remains.\n//\n//   node matching/next.mjs\n//\n// Round protocol step 0 (repo CLAUDE.md rule 5). A commit is a CHECKPOINT, not\n// a stopping point: after committing, run this. If it exits 1 there is a named\n// next action and the round continues without handing control back.\n//\n// Reads the most recent gate log per page rather than the whole corpus, so it\n// reflects HEAD rather than history (that is strikes.mjs's job).\nimport { existsSync, readdirSync, readFileSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nconst DIR = new URL(\".\", import.meta.url).pathname;\n\n// PAUSE SWITCH. While matching/PAUSED exists this hands out no agenda and\n// exits 0. It is deliberately the FIRST thing that runs: no report is read, no\n// score is printed, nothing tempting is put on screen to argue with.\n//\n// Why an exit code and not a note somewhere: rule 5 is a LOOP — \"after\n// committing, run next.mjs; while it exits 1 there is a named next action and\n// the round continues\". A pause written as prose loses to that loop, because\n// the loop is mechanical and the prose is not. Exiting 0 satisfies rule 5\n// truthfully rather than suspending it: there is no next action.\nconst PAUSE = join(DIR, \"PAUSED\");\nif (existsSync(PAUSE)) {\n  console.log(\"MATCHING PAUSED — no agenda, and none is to be inferred.\\\\n\");\n  console.log(readFileSync(PAUSE, \"utf8\").trimEnd());\n  process.exit(0);\n}\n\nimport { FLOORS, ACCEPTED } from \"./floors.mjs\";\nimport { TOTALS, THRESHOLD, MAX_HEIGHT_DELTA, REPORT_SCHEMA } from \"./harness.mjs\";\n\n// Reports written by a different page-diff, by page key. Kept rather than\n// dropped: silently ignoring them is how a page vanishes from the score.\nconst schemaMismatch = new Set();\n\nconst latest = new Map();\nfor (const d of readdirSync(DIR).filter((d) => d.startsWith(\"out-\"))) {\n  const m = /^out-[^-]+-(.+)$/.exec(d);\n  if (!m || !TOTALS[m[1]]) continue;\n  let report, mtime;\n  try {\n    const p = join(DIR, d, \"report.json\");\n    report = JSON.parse(readFileSync(p, \"utf8\"));\n    mtime = statSync(p).mtimeMs;\n  } catch {\n    continue;\n  }\n  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the\n  // page. Picking one up as \"latest\" silently reports scores nobody can ship —\n  // it happened immediately: an --mask-photos probe of yfv made \\`top\\` @834 read\n  // 43.9% here while the real gate had it passing at 1.3%.\n  const meta = report.meta ?? {};\n  // Missing schemaVersion means \"written before the field existed\" = 0. It is\n  // not an error on its own; it is only fatal when it would blank a page.\n  if ((meta.schemaVersion ?? 0) !== REPORT_SCHEMA) {\n    schemaMismatch.add(m[1]);\n    continue;\n  }\n  if (\n    (meta.mask?.length ?? 0) > 0 ||\n    meta.neutralizeMedia ||\n    meta.maskPhotos ||\n    meta.truncated\n  )\n    continue;\n  if (meta.threshold !== THRESHOLD) continue;\n  const prev = latest.get(m[1]);\n  if (!prev || mtime > prev.mtime) latest.set(m[1], { dir: d, mtime, report });\n}\n\nconst blanked = [...schemaMismatch].filter((p) => !latest.has(p));\nif (blanked.length) {\n  console.error(\n    \\`next: \\${blanked.length} page(s) have no run at report schema \\${REPORT_SCHEMA} — \\` +\n      \\`their newest reports came from a different page-diff (\\${blanked.sort().join(\", \")}).\\\\n\\` +\n      \\`      Re-run: bash matching/gate.sh <tag> \\${blanked.sort().join(\" \")}\\`,\n  );\n  process.exit(2);\n}\nif (latest.size === 0) {\n  console.error(\n    \"next: no parseable gate run under matching/ — refusing to report a score.\\\\n\" +\n      \"      Run bash matching/gate.sh <tag> first.\",\n  );\n  process.exit(2);\n}\n\nconst rows = [];\nconst accepted = [];\nlet openTotal = 0;\nlet floorTotal = 0;\nfor (const [page, { dir, report }] of latest) {\n  const fails = report.regions.filter((r) => !r.pass);\n  for (const f of fails) {\n    const floor = FLOORS.find((fl) => fl.match(f, page));\n    if (floor) {\n      floorTotal++;\n      continue;\n    }\n    const ack = ACCEPTED.find((a) => a.match(f, page));\n    if (ack) {\n      accepted.push({ page, vw: f.viewport, label: f.label, why: ack.why });\n      continue;\n    }\n    openTotal++;\n    rows.push({\n      page,\n      vw: f.viewport,\n      label: f.label,\n      mm: f.mismatchFraction,\n      dh: f.heightDeltaFraction ?? 0,\n      dir,\n    });\n  }\n}\n\nconst scored = [...latest.entries()]\n  .map(([p, v]) => ({\n    p,\n    pass: v.report.regions.filter((r) => r.pass).length,\n    total: TOTALS[p],\n  }))\n  .sort((a, b) => a.pass / a.total - b.pass / b.total);\n\nconst sum = scored.reduce((a, s) => a + s.pass, 0);\nconst max = scored.reduce((a, s) => a + s.total, 0);\nconsole.log(\\`SCORE \\${sum}/\\${max} regions passing\\\\n\\`);\nconsole.log(\n  scored\n    .map((s) => \\`  \\${s.p.padEnd(9)} \\${String(s.pass).padStart(2)}/\\${s.total}\\`)\n    .join(\"\\\\n\"),\n);\n\nif (accepted.length) {\n  console.log(\\`\\\\nOperator-ACCEPTED failures (left failing on purpose):\\`);\n  for (const a of accepted)\n    console.log(\\`  \\${a.page} @\\${a.vw} \"\\${a.label}\" — \\${a.why.slice(0, 96)}…\\`);\n}\n\nif (!rows.length) {\n  console.log(\n    \\`\\\\nNo open geometry failures. \\${floorTotal} declared floor(s) remain.\\`,\n  );\n  console.log(\n    \"Backlog is empty — Phases 5 (states) and 6 (adversarial review) are what is left.\",\n  );\n  process.exit(0);\n}\n\n// Worst page first, then worst region inside it: fix where the model is most wrong.\nconst worst = scored[0].p;\nrows.sort(\n  (a, b) =>\n    (a.page === worst ? -1 : 0) - (b.page === worst ? -1 : 0) || b.mm - a.mm,\n);\n\nconsole.log(\n  \\`\\\\n\\${openTotal} open failure(s) + \\${floorTotal} declared floor(s).\\`,\n);\nconsole.log(\\`\\\\nNEXT: \\${worst} — worst page. Its open regions:\\\\n\\`);\nfor (const r of rows.filter((r) => r.page === worst)) {\n  const why = [];\n  if (r.mm > THRESHOLD) why.push(\\`pixels \\${(r.mm * 100).toFixed(1)}%\\`);\n  if (Math.abs(r.dh) > MAX_HEIGHT_DELTA)\n    why.push(\\`height \\${(r.dh * 100).toFixed(1)}%\\`);\n  console.log(\n    \\`  @\\${String(r.vw).padEnd(5)} \\${r.label.slice(0, 44).padEnd(45)} \\${why.join(\" + \")}\\`,\n  );\n}\nconsole.log(\\`\\\\nBefore treating any of these as geometry:\\`);\nconsole.log(\n  \\`  node matching/probe-anchor-parity.mjs \\${worst}   # is the gate cutting comparably?\\`,\n);\nconsole.log(\n  \\`  node matching/strikes.mjs \\${worst}               # has it stalled? then change the MODEL\\`,\n);\nconsole.log(\n  \\`\\\\nRound continues. Do not hand back control with work outstanding.\\`,\n);\nprocess.exit(1);\n`;\n\n/** Renders previously shipped by this recipe, per relative path. A file that\n *  byte-matches one of these is SAFE-REPLACED on re-run; anything else that\n *  differs is flagged, never overwritten.\n *\n *  Sourced from scripts/match-harness-previous/<version>/ — the TAGGED\n *  release bodies, never re-derived from the source site. */\nexport const MATCH_HARNESS_PREVIOUS: Readonly<Record<string, readonly string[]>> = {\n  \"matching/harness.mjs\": [HARNESS_MJS_PREV_0_95_0],\n  \"matching/gate.sh\": [GATE_SH_PREV_0_95_0],\n  \"matching/next.mjs\": [NEXT_MJS_PREV_0_95_0],\n};\n\n/** Scripts that must upgrade TOGETHER or not at all. Measured, both ways:\n *  a new next.mjs against an old harness.mjs dies with \"does not provide an\n *  export named 'uncountable'\" — it does not degrade, it does not load; and\n *  an old harness.mjs given a new gate.sh's `--check-run` prints its usage\n *  banner and exits 2, which gate.sh reads as NOT MEASURED for every page\n *  before printing GATE INCOMPLETE. So one hand-edited file in the set, with\n *  per-file independence, upgrades the others around it into a harness that\n *  cannot run — and a bricked harness is worse than an un-upgraded one.\n *\n *  Derived by grep: every copied script except census-count.mjs depends on\n *  harness.mjs, by ESM import (next, strikes, build-spec) or CLI (gate,\n *  census). */\nexport const MATCH_HARNESS_COUPLED: readonly string[] = [\n  \"matching/harness.mjs\",\n  \"matching/gate.sh\",\n  \"matching/census.sh\",\n  \"matching/next.mjs\",\n  \"matching/strikes.mjs\",\n  \"matching/build-spec.mjs\",\n];\n\nexport const GITIGNORE_MARKER =\n  \"# reddoor-maint match-harness: scripts + records tracked, workspace ignored\";\nexport const GITIGNORE_BLOCK = `scratch-diff*/\nmatching/*\n!matching/*.sh\n!matching/*.mjs\n!matching/*.md\n# The pause switch. Extensionless on purpose (it is a sentinel, not a doc), so\n# the whitelist above misses it — and an ignored switch is not a switch: it\n# would work on one machine and be absent from every fresh clone, CI run and\n# agent that most needs to see it.\n!matching/PAUSED\n!matching/spec-sections/\n!matching/states/\nmatching/states/*\n!matching/states/*.mjs\n# derived artefacts, even where the extensions above would catch them\nmatching/*.log\nmatching/*.json\n# ...except the page table itself, which is the harness's configuration and the\n# one thing a fresh clone cannot reconstruct.\n!matching/harness.json\nmatching/*.png\n`;\n\nexport const PRETTIERIGNORE_MARKER = \"# reddoor-maint match-harness\";\nexport const PRETTIERIGNORE_BLOCK = `# Matching harness — every file the \\`match-harness\\` recipe OWNS. It installs\n# them byte-for-byte and byte-compares them on the next install, so a site whose\n# prettier config differs must not reformat them: a reformatted file is\n# indistinguishable from a hand edit, and the recipe refuses to overwrite a hand\n# edit. Measured on a \\`useTabs\\`/\\`singleQuote\\` site, all three src/ entries\n# below are rewritten by \\`prettier --write .\\`, and the next upgrade is refused\n# for all three.\n#\n# The bracketed route segment MUST stay backslash-escaped. This file is\n# gitignore glob syntax, in which \\`[uid]\\` is a CHARACTER CLASS matching one of\n# \\`u\\`, \\`i\\`, \\`d\\` — an unescaped entry silently ignores nothing at all.\n#\n# \\`matching/*.mjs\\` also catches two SITE-owned records (floors.mjs,\n# census-deviations.mjs). Accepted, not overlooked: eslint lints .mjs, so those\n# two keep a style check either way, and naming seven scripts instead of one\n# glob goes stale on the next script the harness gains.\n#\n# harness.json is here because it is a TABLE, not prose: it carries a\n# hand-chosen row layout that prettier reflows.\n#\n# Everything else under matching/ (SPEC.md, LEDGER.md, spec-sections/,\n# states/*.mjs) stays inside \\`prettier --check .\\`. That is deliberately narrow:\n# eslint does not lint Markdown, so for the records prettier is the ONLY style\n# check there is, and a blanket \\`matching/\\` entry would leave them with none.\nmatching/*.mjs\nmatching/*.sh\nmatching/harness.json\nsrc/routes/dev/match/\\\\[uid\\\\]/+page.server.ts\nsrc/routes/dev/match/\\\\[uid\\\\]/+page.svelte\nsrc/lib/site-pages.test.ts\n`;\n\nexport const CLAUDE_MD_MARKER = \"## Matching rules (installed by reddoor-maint match-harness)\";\nexport const CLAUDE_MD_BLOCK = `\nThe \\`matching-a-page\\` skill governs a live-reference rebuild. These five rules\nexist because the skill alone did not hold on the project this harness came\nfrom — each one is a drift that actually happened, with the mechanical check\nthat now catches it. \\`matching/harness.json\\` is this site's configuration;\n\\`matching/LEDGER.md\\` is the dated record of every deviation, floor and mask.\n\n### 1. Source prescribes, rects only verify\n\nEvery geometry fix must cite the rule it came from: a line in the captured\nreference stylesheet under \\`matching/spec/\\`, or the reference's HTML. \"The probe\nsays the gap is 40px\" is not a source. If you cannot name the line you are\nguessing — go read the stylesheet first.\n\n**Check:** the commit body must name the file:line for each fix.\n**Operator's challenge:** _\"which line of the reference stylesheet says that?\"_\n\n### 2. Phase 1 before Phase 4\n\nA page gets its section census and per-section spec in \\`matching/SPEC.md\\` BEFORE\nits geometry is touched. No SPEC section, no geometry round. The census is the\ncoverage denominator; skipping it is how a reference's root-font ladder and its\nper-component height ladders get discovered reactively, after the region has\nalready failed several rounds.\n\n**Check:** \\`matching/gate.sh\\` refuses to run a page with no \\`SPEC.md\\` section.\n**Operator's challenge:** _\"show me the SPEC section for that region.\"_\n\n### 3. Three strikes, then stop\n\nA failing region that has not improved across 3+ gate runs does not get a fourth\nattempt. Present the attempts. Never widen the threshold, add a mask, or\nreclassify it as a floor to make it go away.\n\n**Check:** \\`node matching/strikes.mjs <page>\\` — exits 1 while any region is\nstalled, and is the first thing a geometry round runs.\n**Operator's challenge:** _\"how many runs has that region been flat?\"_\n\n### 4. A gate closes an item, nothing else\n\nNo fix is \"done\" because the code changed. Paste the gate header — it is\nself-describing, so a nonstandard threshold or an undisclosed mask is visible.\nThe threshold and the matrix are whatever \\`matching/harness.json\\` says, on every\npage, never a subset.\n\n**Operator's challenge:** _\"paste the gate header.\"_\n\n### 5. A commit is a checkpoint, not a stopping point\n\nDo not hand control back between rounds. After committing, run\n\\`node matching/next.mjs\\`: while it exits 1 there is a named next action, and the\nround continues. Report when the backlog is empty, when a decision is genuinely\nthe operator's (three strikes, a novel floor, a threshold change), or when\nasked — not because a commit felt like a natural place to summarise.\n\nThis exists because the failure was habitual, not deliberate: a turn ends when\nuser-facing prose gets written, and \"I just committed something good\" is the\nmoment that invites writing it. The gate stops incorrect work; this stops\npremature stopping.\n\n**Pausing:** create \\`matching/PAUSED\\` holding a note that says what the pause\nmeans; \\`next.mjs\\` and \\`strikes.mjs\\` then exit 0 while it exists. This rule says\n\"do not stop while work is named\"; it never said \"find work to name\". An empty\nagenda and a paused one end the round the same way. Deleting the switch is the\noperator's call.\n\n**Check:** \\`node matching/next.mjs\\` — exits 1 while any non-floor region fails.\n**Operator's challenge:** _\"what does next.mjs say?\"_\n\n### Round protocol\n\n1. \\`node matching/strikes.mjs <page>\\` — if it exits 1, the stalled regions are\n   the agenda, and stalled ones get escalated rather than re-attempted.\n2. Confirm the page has a \\`matching/SPEC.md\\` section; write\n   \\`matching/spec-sections/<page>.md\\` and run \\`node matching/build-spec.mjs\\` if\n   not.\n3. Fix, each change citing its source line.\n4. \\`bash matching/gate.sh <tag> <page>\\` — paste the header.\n5. Append to \\`matching/LEDGER.md\\` at the moment a deviation, floor or mask is\n   decided, not reconstructed at the end.\n6. \\`pnpm verify\\`, then commit and push.\n`;\n","/**\n * Block BODIES this recipe has previously shipped — the block half of what lets\n * it tell \"stale, but ours\" from \"hand-edited by the site\". `planBlockWrite`\n * flags every region it cannot recognise, so without a record of what was\n * shipped, install-once is install-forever for the three marked regions.\n *\n * The whole-FILE table is NOT here. It lives in the generated `template.ts` as\n * `MATCH_HARNESS_PREVIOUS`, it is POPULATED, and it is what upgrades an\n * installed site's `matching/gate.sh` to the one that stopped saying ALL DONE\n * over failed runs (#744). Re-pointing that import at an empty table here would\n * silently un-ship that fix to every site already carrying the v1 gate — which\n * is exactly what this file did on its first draft, and what\n * `tests/recipes/match-harness.test.ts`'s \"UPGRADES a site running the shipped\n * v1 gate.sh rather than flagging it\" caught. The deprecation note and the\n * import switch were written together; the data migration they both depend on\n * is #753, and had not happened. Whatever replaces the generated table has to\n * carry the bodies across in the same commit that moves the import.\n *\n * Two rules for what goes below, and they are why this table is HAND-AUTHORED:\n *\n * 1. An entry is added ONLY when a block body has been SUPERSEDED — at the\n *    moment the shipped body changes, in the same commit that changes it.\n *    Recording a body that is still current makes the table lie in the one\n *    direction that matters: it would let a stale render be replaced by itself.\n *\n * 2. A body's source is a PUBLISHED GIT TAG — `git show v0.95.0:<path>` — never\n *    the working tree. Reading the tree is how a mutant gets banked as a\n *    legitimate prior release: mutate, regenerate, revert, and the mutation is\n *    now a body this recipe will happily install over a real site. Measured on\n *    this branch: one mutate/regenerate/revert cycle added 693 lines and two\n *    copies of the same predicate.\n *\n * EMPTY at 0.95.1 on purpose. 0.95.1 changes no block body at all: its whole\n * job is to install the region terminators, which is what makes the first\n * exercise of the block replace path provably content-neutral.\n */\n\n/** Block BODIES previously shipped per target file, for the three marked\n *  regions in `.gitignore`, `.prettierignore` and `CLAUDE.md`. */\nexport const MATCH_HARNESS_BLOCK_PREVIOUS: Readonly<Record<string, readonly string[]>> = {};\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,UAAU,IAAI,OAAO,iBAAiB;AACtD,SAAS,SAAS,YAAY;;;ACMvB,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgZ7B,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmNzB,IAAM,qBAAqB;AAC3B,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuO3B,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2S1B,IAAM,uBAAuB;AAC7B,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0O7B,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6EhC,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiElC,IAAM,wBAAwB;AAC9B,IAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2B9B,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsB5B,IAAM,iCAAiC;AACvC,IAAM,iCAAiC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAevC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQhC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUhC,IAAM,qBAAqB;AAC3B,IAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAc3B,IAAM,8BAA8B;AACpC,IAAM,8BAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqCpC,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUlC,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4B/B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgGjC,IAAM,sBAA8C;AAAA,EACzD,EAAE,KAAK,sBAAsB,UAAU,sBAAsB,OAAO,SAAS;AAAA,EAC7E,EAAE,KAAK,kBAAkB,UAAU,kBAAkB,OAAO,SAAS;AAAA,EACrE,EAAE,KAAK,oBAAoB,UAAU,oBAAoB,OAAO,SAAS;AAAA,EACzE,EAAE,KAAK,mBAAmB,UAAU,mBAAmB,OAAO,SAAS;AAAA,EACvE,EAAE,KAAK,sBAAsB,UAAU,sBAAsB,OAAO,SAAS;AAAA,EAC7E,EAAE,KAAK,yBAAyB,UAAU,yBAAyB,OAAO,SAAS;AAAA,EACnF,EAAE,KAAK,2BAA2B,UAAU,2BAA2B,OAAO,SAAS;AAAA,EACvF,EAAE,KAAK,uBAAuB,UAAU,uBAAuB,OAAO,OAAO;AAAA,EAC7E,EAAE,KAAK,qBAAqB,UAAU,qBAAqB,OAAO,OAAO;AAAA,EACzE,EAAE,KAAK,gCAAgC,UAAU,gCAAgC,OAAO,OAAO;AAAA,EAC/F,EAAE,KAAK,yBAAyB,UAAU,yBAAyB,OAAO,OAAO;AAAA,EACjF,EAAE,KAAK,yBAAyB,UAAU,yBAAyB,OAAO,OAAO;AAAA,EACjF,EAAE,KAAK,oBAAoB,UAAU,oBAAoB,OAAO,OAAO;AAAA,EACvE,EAAE,KAAK,6BAA6B,UAAU,6BAA6B,OAAO,SAAS;AAAA,EAC3F,EAAE,KAAK,2BAA2B,UAAU,2BAA2B,OAAO,SAAS;AAAA,EACvF,EAAE,KAAK,wBAAwB,UAAU,wBAAwB,OAAO,OAAO;AAAA,EAC/E,EAAE,KAAK,0BAA0B,UAAU,0BAA0B,OAAO,SAAS;AACvF;AAEA,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoLhC,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2I5B,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+LtB,IAAM,yBAAsE;AAAA,EACjF,wBAAwB,CAAC,uBAAuB;AAAA,EAChD,oBAAoB,CAAC,mBAAmB;AAAA,EACxC,qBAAqB,CAAC,oBAAoB;AAC5C;AAcO,IAAM,wBAA2C;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,mBACX;AACK,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBxB,IAAM,wBAAwB;AAC9B,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgC7B,IAAM,mBAAmB;AACzB,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACj1ExB,IAAM,+BAA4E,CAAC;;;AFf1F,IAAM,sBAAsB;AA2B5B,eAAe,aAAa,MAAsC;AAChE,MAAI;AACF,WAAO,MAAM,SAAS,MAAM,OAAO;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,SAAS,UAAU,GAAmB;AACpC,SAAO,EACJ,QAAQ,SAAS,IAAI,EACrB,QAAQ,aAAa,EAAE,EACvB,KAAK;AACV;AA2CO,SAAS,eACd,UACA,QACA,WACA,OACA,UACW;AACX,QAAM,SAAS,GAAG,MAAM;AAAA,EAAK,KAAK;AAAA,EAAK,SAAS;AAChD,MAAI,aAAa,KAAM,QAAO,EAAE,QAAQ,SAAS,SAAS,GAAG,MAAM;AAAA,EAAK;AAExE,QAAM,QAAQ,SAAS,QAAQ,MAAM;AACrC,MAAI,UAAU,IAAI;AAChB,UAAM,OAAO,SAAS,SAAS,IAAI,IAAI,WAAW,GAAG,QAAQ;AAAA;AAC7D,WAAO,EAAE,QAAQ,SAAS,SAAS,GAAG,IAAI;AAAA,EAAK,MAAM;AAAA,EAAK;AAAA,EAC5D;AAEA,QAAM,OAAO,SAAS,MAAM,GAAG,KAAK;AACpC,QAAM,YAAY,QAAQ,OAAO,SAAS;AAE1C,QAAM,QAAQ,SAAS,QAAQ,WAAW,SAAS;AACnD,MAAI,UAAU,IAAI;AAChB,UAAM,OAAO,SAAS,MAAM,WAAW,KAAK;AAC5C,QAAI,UAAU,IAAI,MAAM,UAAU,KAAK,EAAG,QAAO,EAAE,QAAQ,OAAO;AAClE,QAAI,SAAS,KAAK,CAAC,MAAM,UAAU,IAAI,MAAM,UAAU,CAAC,CAAC;AACvD,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,OAAO,SAAS,SAAS,MAAM,QAAQ,UAAU,MAAM;AAAA,MAClE;AACF,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AAEA,aAAW,aAAa,CAAC,OAAO,GAAG,QAAQ,GAAG;AAC5C,QAAI,CAAC,SAAS,WAAW,WAAW,SAAS,EAAG;AAChD,UAAM,UAAU,GAAG,IAAI,GAAG,MAAM;AAAA,EAAK,SAAS,MAAM,YAAY,UAAU,MAAM,CAAC;AAGjF,WAAO,cAAc,QAAQ,EAAE,QAAQ,aAAa,QAAQ,IAAI,EAAE,QAAQ,WAAW,QAAQ;AAAA,EAC/F;AACA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAGO,SAAS,cACd,UACA,UACA,OACA,UACuC;AACvC,MAAI,aAAa,KAAM,QAAO;AAC9B,MAAI,UAAU,QAAQ,MAAM,UAAU,QAAQ,EAAG,QAAO;AACxD,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,SAAS,KAAK,CAAC,MAAM,UAAU,QAAQ,MAAM,UAAU,CAAC,CAAC,EAAG,QAAO;AACvE,SAAO;AACT;AAkBO,IAAM,uBAAuB;AAC7B,IAAM,4BAA4B;AAClC,IAAM,uBAAuB;AAGpC,IAAM,kBAAkB;AAAA,EACtB,CAAC,cAAc,kBAAkB,sBAAsB,eAAe;AAAA,EACtE,CAAC,mBAAmB,uBAAuB,2BAA2B,oBAAoB;AAAA,EAC1F,CAAC,aAAa,kBAAkB,sBAAsB,eAAe;AACvE;AASO,IAAM,gCAAmD;AAAA,EAC9D,GAAG,oBAAoB,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,EACvC,GAAG,gBAAgB,IAAI,CAAC,CAAC,GAAG,MAAM,GAAG;AACvC;AAkBA,eAAsB,aACpB,MACA,MACA,OAAyB,EAAE,OAAO,aAAa,GACxB;AACvB,SAAO,WAAiB;AAAA,IACtB,MAAM;AAAA,IACN;AAAA,IACA,MAAM,YAAY;AAChB,UAAI,CAAC,KAAK,OAAO,CAAC,eAAe,KAAK,KAAK,GAAG,GAAG;AAC/C,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OACE;AAAA,QACJ;AAAA,MACF;AACA,aAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,UACJ,KAAK,KAAK,IAAI,QAAQ,OAAO,EAAE;AAAA,UAC/B,MAAM,KAAK,QAAQ;AAAA,UACnB,QAAQ,KAAK,UAAU,CAAC,MAAM,KAAK,GAAG;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO,OAAO,SAAS,EAAE,QAAQ,IAAI,MAAM;AACzC,YAAM,QAAkB,CAAC;AACzB,YAAM,UAAoB,CAAC;AAI3B,YAAM,SAAS,oBAAI,IAA2B;AAC9C,YAAM,cAAc,KAAK,YAAY;AACrC,YAAM,mBAAmB,KAAK,iBAAiB;AAU/C,YAAM,QAAmB,CAAC;AAC1B,iBAAW,KAAK,qBAAqB;AACnC,cAAM,SAAS,KAAK,KAAK,EAAE,GAAG;AAC9B,YAAI,WAAW,EAAE;AACjB,YAAI,EAAE,QAAQ,uBAAuB;AAKnC,gBAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,eAAK,MAAM,QAAQ;AACnB,eAAK,OAAO,QAAQ;AACpB,eAAK,SAAS,QAAQ;AACtB,qBAAW,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI;AAAA,QAC7C;AACA,cAAM,WAAW,MAAM,aAAa,MAAM;AAC1C,cAAM,KAAK;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,cAAc,UAAU,UAAU,EAAE,OAAO,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC;AAAA,QAC7E,CAAC;AAAA,MACH;AAiBA,YAAM,UAAU,IAAI,IAAI,qBAAqB;AAC7C,YAAM,YAAY,MACf,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,WAAW,MAAM,EACzD,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG;AACrB,YAAM,UAAU,MAAM;AAAA,QACpB,CAAC,MAAM,QAAQ,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,WAAW,aAAa,CAAC,UAAU,SAAS,EAAE,EAAE,GAAG;AAAA,MACtF;AACA,UAAI,UAAU,SAAS,KAAK,QAAQ,SAAS,GAAG;AAC9C,mBAAW,KAAK,QAAS,GAAE,SAAS;AACpC,cAAM;AAAA,UACJ,GAAG,UAAU,KAAK,IAAI,CAAC,gFACF,sBAAsB,KAAK,IAAI,CAAC;AAAA,QAGvD;AAAA,MACF;AAGA,YAAM,cAAc,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC;AACvD,iBAAW,EAAE,GAAG,UAAU,UAAU,OAAO,KAAK,OAAO;AACrD,YAAI,WAAW,QAAQ;AACrB,cAAI,YAAY,IAAI,EAAE,GAAG,EAAG;AAC5B,gBAAM;AAAA,YACJ,GAAG,EAAE,GAAG;AAAA,UACV;AACA;AAAA,QACF;AACA,YAAI,WAAW,OAAQ;AACvB,cAAM,SAAS,KAAK,KAAK,EAAE,GAAG;AAC9B,cAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,eAAO,IAAI,EAAE,KAAK,QAAQ;AAC1B,cAAM,UAAU,QAAQ,UAAU,OAAO;AACzC,gBAAQ,KAAK,EAAE,GAAG;AAClB,YAAI,WAAW,UAAW,OAAM,KAAK,GAAG,EAAE,GAAG,mCAAmC;AAAA,MAClF;AAKA,iBAAW,CAAC,KAAK,QAAQ,WAAW,KAAK,KAAK,iBAAiB;AAC7D,cAAM,OAAO,KAAK,KAAK,GAAG;AAC1B,cAAM,WAAW,MAAM,aAAa,IAAI;AACxC,cAAM,OAAO;AAAA,UACX;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,iBAAiB,GAAG,KAAK,CAAC;AAAA,QAC5B;AACA,YAAI,KAAK,WAAW,OAAQ;AAC5B,YAAI,KAAK,WAAW,QAAQ;AAG1B,gBAAM;AAAA,YACJ,GAAG,GAAG;AAAA,UACR;AACA;AAAA,QACF;AACA,eAAO,IAAI,KAAK,QAAQ;AACxB,cAAM,UAAU,MAAM,KAAK,SAAS,OAAO;AAC3C,gBAAQ,KAAK,GAAG;AAChB,YAAI,KAAK,WAAW;AAClB,gBAAM,KAAK,GAAG,GAAG,yDAAyD;AAC5E,YAAI,KAAK,WAAW;AAClB,gBAAM;AAAA,YACJ,GAAG,GAAG;AAAA,UACR;AAAA,MACJ;AAcA,YAAM,YAAY,IAAI;AAAA,QACpB,oBAAoB,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,MACxE;AACA,YAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,UAAU,IAAI,CAAC,KAAK,MAAM,WAAW;AAW5E,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,MAAM,OAAO,KAAK,mBAAmB,uBAAuB,GAAG;AACrE,YAAI,QAAQ,MAAM;AAChB,gBAAM,KAAK,kBAAkB;AAAA,QAC/B,WACE,CAAE,MAAM,mBAAmB,KAAK,OAAO,KAAK,UAAU;AAAA,UACpD;AAAA,UACA,WAAW;AAAA,QACb,CAAC,GACD;AACA,gBAAM,KAAK,kBAAkB;AAAA,QAC/B;AAAA,MACF;AAEA,YAAM;AAAA,QACJ;AAAA,MACF;AAUA,YAAM,UAAU,MAAM,qBAAqB,KAAK,6BAA6B;AAC7E,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,QAAQ,MAAM,eAAe,KAAK,OAAO;AAC/C,cAAM,UAAU,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAI,EAAE,CAAC,CAAE,CAAC,CAAC;AAChE,cAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AAClE,cAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;AAO3D,cAAM,UAAoB,CAAC;AAC3B,mBAAW,OAAO,QAAQ,OAAO,CAAC,MAAM,QAAQ,SAAS,CAAC,CAAC,GAAG;AAC5D,gBAAM,OAAO,OAAO,IAAI,GAAG;AAC3B,cAAI,SAAS,OAAW;AACxB,cAAI,SAAS,MAAM;AACjB,kBAAM,GAAG,KAAK,KAAK,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxC,oBAAQ,KAAK,GAAG;AAAA,UAClB,OAAO;AACL,kBAAM,UAAU,KAAK,KAAK,GAAG,GAAG,MAAM,OAAO;AAAA,UAC/C;AAAA,QACF;AAGA,mBAAW,KAAK,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;AACtF,cAAI,MAAM,IAAK,OAAM,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,QAChE;AAEA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OACE,kCAAkC,QAAQ,MAAM,OAAO,8BAA8B,MAAM,mIAChE,QAAQ,KAAK,IAAI,CAAC,QAC5C,QAAQ,SAAS,IACd,eAAe,QAAQ,KAAK,IAAI,CAAC,sDACjC,OACH,YAAY,SAAS,IAClB,0BAA0B,YAAY,KAAK,IAAI,CAAC,2GAChD,MACJ;AAAA,QACJ;AAAA,MACF;AAEA,aAAO,MAAM,SAAS,IAAI,EAAE,MAAM,MAAM,OAAO,MAAM,KAAK,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK;AAAA,IACnF;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/cli/bin.js

@@ -154,7 +154,7 @@ cli.command(
   "Write the report to this file (the CI workflow posts it as a PR comment)"
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../prismic-models-W6CNLTWH.js")).runPrismicModelsCommand(site, opts),
+    async () => (await import("../prismic-models-P6FWWVRS.js")).runPrismicModelsCommand(site, opts),
     opts
   )
 );
@@ -208,7 +208,7 @@ cli.command(
   'Inventory file (.json or .mjs/.js), or "airtable" to read from Websites table'
 ).option("--workdir <path>", "Clone target for fleet mode (default ~/.reddoor-maint/sites)").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../match-harness-2Q6ISEES.js")).runMatchHarnessCommand(site, opts),
+    async () => (await import("../match-harness-QRG6XZAR.js")).runMatchHarnessCommand(site, opts),
     opts
   )
 );
@@ -250,13 +250,13 @@ cli.command(
   "Bootstrap + first-audit a site, then draft its launch email for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../launch-4RVWPZGI.js")).runLaunchCommand(site, opts),
+    async () => (await import("../launch-UD36AHUN.js")).runLaunchCommand(site, opts),
     opts
   )
 );
 cli.command("header-image [site]", "Generate a site's report header image from its live homepage.").option("--all", "Every live site with no Header image yet (backfill)").option("--force", "With --all, regenerate sites that already have one").option("--write-airtable", "Upload to the Websites row instead of writing a local file").option("--out-dir <path>", "Directory for local output (default: reports/)").option("--settle-ms <ms>", "Override the post-load settle delay for slow/animated homepages").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../header-image-YN3AQRY3.js")).runHeaderImageCommand(site, opts),
+    async () => (await import("../header-image-PSPT7CUM.js")).runHeaderImageCommand(site, opts),
     opts
   )
 );
@@ -265,7 +265,7 @@ cli.command(
   "Draft the monthly-report announcement email for maintenance sites (all, or one) for approval."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../announce-PGT4SZZB.js")).runAnnounceCommand(site, opts),
+    async () => (await import("../announce-CLQYX5I4.js")).runAnnounceCommand(site, opts),
     opts
   )
 );
@@ -274,7 +274,7 @@ cli.command(
   "Show who a form submission would email, and optionally flip the pre-launch guard (read-back confirmed)."
 ).option("--set <on|off>", "Flip the guard: on = route to operator, off = restore.").option("--restore <status>", "Status to restore with --set off. Required; never inferred.").action(
   async (site, opts) => runOrExit(
-    async () => (await import("../forms-notify-target-2LWF5C5B.js")).runFormsNotifyTargetCommand(
+    async () => (await import("../forms-notify-target-UC6PF3AE.js")).runFormsNotifyTargetCommand(
       site,
       opts
     ),
@@ -286,7 +286,7 @@ cli.command(
   "Operator self-tests. kind=email: preview a report email for a site (or --all) to yourself."
 ).option("--type <type>", "Report type: announcement (default) | maintenance | testing | launch").option("--to <addr>", "Recipient(s), comma-separated. Default: OPERATOR_EMAIL.").option("--all", "Send a preview for every maintenance site (to --to/operator).").option("--dry-run", "Render only; write reports/<slug>/selftest-<type>.html; do not send.").action(
   async (kind, site, opts) => runOrExit(
-    async () => (await import("../selftest-MAB2PBXQ.js")).runSelftestCommand(kind, site, opts),
+    async () => (await import("../selftest-VXTHRPRN.js")).runSelftestCommand(kind, site, opts),
     opts
   )
 );
@@ -298,13 +298,13 @@ cli.command(
   "Fleet mode: announcement\u2192maintenance sites; maintenance/testing\u2192all schedulable sites."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../preflight-4VQP7JJL.js")).runPreflightCommand(site, opts),
+    async () => (await import("../preflight-RYIP54NY.js")).runPreflightCommand(site, opts),
     opts
   )
 );
 cli.command("ensure-site <slug>", "Create/verify the Airtable Websites row for a new site.").option("--name <display name>", "Human Name for the row (client-facing copy uses it verbatim).").option("--url <url>", "Deployed URL (e.g. the Netlify site URL).").option("--contact <email>", "point of contact \u2014 the client address reports resolve to.").option("--git-repo <owner/repo>", "GitHub identity. Default on create: reddoorla/<slug>.").action(
   async (slug, opts) => runOrExit(
-    async () => (await import("../ensure-site-WIDO6LGU.js")).runEnsureSiteCommand(slug, opts),
+    async () => (await import("../ensure-site-OAAE5YE2.js")).runEnsureSiteCommand(slug, opts),
     opts
   )
 );
@@ -325,7 +325,7 @@ cli.command(
   "Email the internal sheet (scores, what wasn't measured, top fixes, the link) to PROSPECT_AUDIT_RECIPIENTS."
 ).action(
   async (url, opts) => runOrExit(
-    async () => (await import("../prospect-audit-X4Z67LWW.js")).runProspectAuditCommand(url, opts),
+    async () => (await import("../prospect-audit-PRHU53HS.js")).runProspectAuditCommand(url, opts),
     opts
   )
 );
@@ -346,7 +346,7 @@ cli.command("report [site]", "Draft or send maintenance/testing reports.").optio
   "Regenerate one UNSENT report's stored HTML from its current row, so the console preview shows edited commentary. Refuses a sent report."
 ).action(
   async (site, opts) => runOrExit(
-    async () => (await import("../report-4GFD4MW2.js")).runReportCommand(site, opts),
+    async () => (await import("../report-LQS4ECTM.js")).runReportCommand(site, opts),
     opts
   )
 );
@@ -355,7 +355,7 @@ cli.command(
   "Sweep the fleet for GitHub signals (Renovate-failing/CI/last-commit) and write Airtable."
 ).option("--fleet", "Run across every site in the Airtable inventory.").option("--write-airtable", "Write each site's signals back to its Websites row.").action(
   async (opts) => runOrExit(
-    async () => (await import("../github-signals-GAHNOAHS.js")).runGitHubSignalsCommand({
+    async () => (await import("../github-signals-TX5FPYP6.js")).runGitHubSignalsCommand({
       fleet: opts.fleet,
       writeAirtable: opts.writeAirtable
     }),
@@ -386,7 +386,7 @@ cli.command(
   "--force",
   "import-airtable / sync: run despite the freeze (#643) \u2014 a deliberate rollback-window converge from the frozen Airtable shadow. Without it both refuse while Turso is authoritative, because an import overwrites authoritative rows."
 ).action(
-  async (action, opts) => runOrExit(async () => (await import("../db-BBEM7CBX.js")).runDbCommand(action, opts), opts)
+  async (action, opts) => runOrExit(async () => (await import("../db-XKZYDCKM.js")).runDbCommand(action, opts), opts)
 );
 cli.command(
   "submissions <action>",
@@ -396,7 +396,7 @@ cli.command(
   "Write the re-buckets: status \u2192 spam_auto, spam_score/spam_reason replaced with the new verdict + 'retro-rescore' marker."
 ).action(
   async (action, opts) => runOrExit(
-    async () => (await import("../submissions-5GKJPCIH.js")).runSubmissionsCommand(action, opts),
+    async () => (await import("../submissions-OVZPVBYG.js")).runSubmissionsCommand(action, opts),
     opts
   )
 );
@@ -408,7 +408,7 @@ cli.command(
     async () => (await import("../renovate-dispatch-U5Q52SKT.js")).runRenovateDispatchCommand({
       fleet: opts.fleet,
       // #539 Phase 5: mirror the auto-fix counter into site_health.
-      siteMirror: await (await import("../site-mirror-UKHREAD6.js")).makeSiteMirror()
+      siteMirror: await (await import("../site-mirror-WON4FTJ2.js")).makeSiteMirror()
     }),
     opts
   )

package/dist/cli/commands/audit.js

@@ -19,9 +19,9 @@ import "../../chunk-XHHMM5HX.js";
 import "../../chunk-Z3JXLULD.js";
 import {
   recordFleetEventsBestEffort
-} from "../../chunk-DMPHP7UP.js";
-import "../../chunk-22GKJO5F.js";
-import "../../chunk-OCNSIBMP.js";
+} from "../../chunk-BI2VI6EM.js";
+import "../../chunk-VSGMCCGQ.js";
+import "../../chunk-C3IQQKXL.js";
 import "../../chunk-2NQUCS7O.js";
 import "../../chunk-UDRHAQT7.js";
 import "../../chunk-PTDMVGKL.js";
@@ -267,7 +267,7 @@ ${wb.summary}`;
               task.output = "writing scores\u2026";
               writeSummary = await writeAuditsToAirtable({ base, websites, slug, results });
               if (writeSummary.siteId && writeSummary.fields) {
-                const { makeSiteMirror } = await import("../../site-mirror-UKHREAD6.js");
+                const { makeSiteMirror } = await import("../../site-mirror-WON4FTJ2.js");
                 await (await makeSiteMirror()).health(writeSummary.siteId, writeSummary.fields);
               }
               task.title = `Wrote to Websites[${writeSummary.siteName}] (${writeSummary.writes.length} audit type${writeSummary.writes.length === 1 ? "" : "s"})`;
@@ -304,7 +304,7 @@ async function runFleetWriteBack(args) {
   const { listWebsites } = await import("../../websites-TB4TCAWM.js");
   const websites = await listWebsites(base);
   const makeMirror = deps.makeMirror ?? (async () => {
-    const { makeHealthMirrorBestEffort } = await import("../../health-mirror-EB76EERV.js");
+    const { makeHealthMirrorBestEffort } = await import("../../health-mirror-XJAKA3EY.js");
     return makeHealthMirrorBestEffort();
   });
   const mirror = await makeMirror();

package/dist/client-G2WGWPCA.js

@@ -0,0 +1,11 @@
+import {
+  openDb,
+  readDbConfig
+} from "./chunk-VSGMCCGQ.js";
+import "./chunk-C3IQQKXL.js";
+import "./chunk-6VAL7XJT.js";
+export {
+  openDb,
+  readDbConfig
+};
+//# sourceMappingURL=client-G2WGWPCA.js.map