@reddoorla/maintenance 0.95.0 → 0.96.0

package/dist/chunk-Y6FCXRIC.js

@@ -0,0 +1,3972 @@
+// src/recipes/match-harness/template.ts
+var HARNESS_MJS_RELATIVE = "matching/harness.mjs";
+var HARNESS_MJS_TEMPLATE = `// The single source for everything the matching gates need to know about this
+// site. DATA lives in matching/harness.json (site-edited); this file is the
+// READ LAYER \u2014 edit harness.json, not this. (It is installed and upgraded by
+// the \`reddoor-maint match-harness\` recipe, which owns these bytes: a hand
+// edit here is flagged on the next run and never silently overwritten.)
+//
+// It exists because the page table, the two hosts, the matrix, the threshold
+// and the skill path were hand-copied all over matching/. Re-measured
+// 2026-09-09 AFTER the six-probe conversion, over the 216 tracked scripts under
+// matching/ (214 top-level \u2014 212 .mjs + 2 .sh \u2014 plus 2 in states/):
+//
+//   \u2022 a hand-typed copy of the page table (three or more gate keys sitting next
+//     to their route): 8 files. Exactly ONE of them, probe-chrome-count.mjs,
+//     still carries all nine rows; probe-anchors.mjs carries five; the other
+//     six are three-row detail triples (team/svc/qa).
+//   \u2022 the skill path (~/.claude/skills/matching-a-page): 193 copies
+//   \u2022 the viewport matrix (1440/834/390): 51 copies
+//   \u2022 REF pointed at a host listed in selfHosts \u2014 i.e. comparing the candidate
+//     with itself: 12 scripts, one of which (probe-chrome-count.mjs) is also
+//     the last nine-row table carrier
+//
+// The first bullet read "the nine-row page table: 5 copies \u2014 gate.sh,
+// probe-anchor-parity.mjs, sweep-all10.sh, sweep-all16.sh, sweep-final.sh" when
+// it was written here at 922dde3. It was wrong within the hour and wrong on two
+// counts: 4e2cd7b took the table out of gate.sh, and the list never named
+// states/index.mjs or probe-chrome-count.mjs, which were both carrying nine-row
+// copies at the time. A census is a claim about code; it has to be measured
+// against the tree, not recalled.
+//
+//   node matching/harness.mjs --env        shell-safe KEY='value' lines
+//   node matching/harness.mjs --table      key<TAB>ref<TAB>cand<TAB>anchors
+//   node matching/harness.mjs --check-ref  the D11 preflight; exit 2 on failure
+//   node matching/harness.mjs --check-run <page> <out-dir> <startedAt-iso>
+//                                         did THIS run leave a countable report?
+//                                         exit 2 when it did not
+import { readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// fileURLToPath, not URL#pathname: pathname is percent-encoded, so a checkout
+// under a directory with a space in it would resolve to a path that does not
+// exist. EXPORTED so next.mjs, strikes.mjs and build-spec.mjs take the resolved
+// directory from here instead of each recomputing it \u2014 three of them did, all
+// with the rejected form, and the one with teeth was strikes.mjs's PAUSED path:
+// under a percent-encoding checkout \`existsSync\` said false and the pause
+// switch failed OPEN (#47).
+export const DIR = fileURLToPath(new URL(".", import.meta.url));
+const CFG = JSON.parse(readFileSync(join(DIR, "harness.json"), "utf8"));
+
+// A page key is interpolated into a RegExp (specHeadingRe, below) and into
+// gate.sh's \`grep -qE\` \u2014 unescaped, in both. Measured: \`specHeadingRe("a.c")\`
+// matched \`## abc\` (a WRONG page's section satisfies the check) and
+// \`specHeadingRe("a(b")\` threw. So the vocabulary is refused ONCE, here, where
+// every consumer reads the table \u2014 including gate.sh, which only ever sees keys
+// through \`--table\` \u2014 and a bad key is a load-time error naming itself rather
+// than a fail-open pattern three files away (#50). The set is what a gate key
+// already has to be: it names a run dir, a SPEC heading and a spec-sections
+// file.
+const KEY_RE = /^[a-z0-9-]+$/;
+for (const key of Object.keys(CFG.pages ?? {})) {
+  if (!KEY_RE.test(key))
+    throw new Error(
+      \`harness.json: page key \${JSON.stringify(key)} must match \${KEY_RE} \u2014 keys are interpolated unescaped into specHeadingRe and gate.sh's grep\`,
+    );
+}
+
+// Env overrides exist for one-off probes only. They are NOT how a site is
+// configured \u2014 harness.json is, so that what a gate ran against is committed.
+export const REF = process.env.MATCH_REF ?? CFG.ref;
+export const CAND = process.env.MATCH_CAND ?? process.env.CAND_BASE ?? CFG.cand;
+export const MATRIX = CFG.matrix;
+export const THRESHOLD = CFG.threshold;
+export const MAX_HEIGHT_DELTA = CFG.maxHeightDelta;
+export const REF_MARK = CFG.refMark;
+export const CAND_MARK = CFG.candMark;
+export const SELF_HOSTS = CFG.selfHosts ?? [];
+
+/** One record per gated page, in harness.json order. \`key\` is the gate key
+ *  (out-<TAG>-<key>, the SPEC heading, spec-sections/<key>.md); \`uid\` is the
+ *  Prismic uid or null where the page has no /dev/match twin. */
+export const PAGES = Object.entries(CFG.pages).map(([key, p]) => ({ key, ...p }));
+export const byKey = Object.fromEntries(PAGES.map((p) => [p.key, p]));
+
+/** Can this page's region count be PREDICTED at all? It needs anchors \u2014 see
+ *  TOTALS below \u2014 AND a matrix to measure them at. Exported beside TOTALS
+ *  rather than left for each consumer to re-derive, because "remember to ask
+ *  first" is exactly what failed: checkRun remembered, next.mjs did not, for
+ *  two releases.
+ *
+ *  \`MATRIX.length > 0\` is not defensive padding. TOTALS is
+ *  \`(anchors + 1) * MATRIX.length\`, so an ANCHORED page with \`matrix: []\`
+ *  yields 0 \u2014 truthy-adjacent, arithmetically fatal. Measured on a page with 3
+ *  anchors, an empty matrix and 8 passing regions: without this clause the
+ *  scorer printed \`SCORE 8/0 regions passing\` and \`Backlog is empty \u2014 Phases 5
+ *  and 6 are what is left\`, exit 0. The absurd fraction would be questioned;
+ *  the sentence would not. \`pass/0\` is also Infinity, so such a page sorts
+ *  BEST and can never be named \`worst\` \u2014 the same ranking bug this change set
+ *  removed for unanchored pages, one input along. */
+export const scorable = (key) =>
+  (byKey[key]?.anchors?.length ?? 0) > 0 && MATRIX.length > 0;
+
+/** WHY a page is not scorable, in the words of the thing that is actually
+ *  missing. A refusal that states a cause it did not check is the shape
+ *  CLAUDE.md names: a field must never be named after something it cannot
+ *  observe. "no anchors" printed for a page carrying three of them sends the
+ *  operator to edit the one part of harness.json that was already right. */
+export const unscorableWhy = (key) =>
+  (byKey[key]?.anchors?.length ?? 0) === 0
+    ? "no anchors"
+    : MATRIX.length === 0
+      ? "matrix is empty"
+      : null;
+
+// DERIVED, never hand-typed: page-diff cuts one region before the first anchor
+// ("top") plus one per anchor, at every viewport. The old hand-written map went
+// stale the moment an anchor list changed, and a wrong denominator makes the
+// score a lie in the flattering direction.
+//
+// THAT IDENTITY HOLDS ONLY WITH ANCHORS. \`splitRegions\` (page-diff.mjs:103-110)
+// only cuts by anchor when there are anchors to cut by; with none it falls back
+// to the page's own <section> boxes, and with none of those to an even four-row
+// grid (lib/regions.mjs:27-35, gridRows = 4, labels \`grid-<r>-<c>\`). So the
+// count is DATA-DEPENDENT, the two pages need not even agree, and no formula
+// over anchors can predict it.
+//
+// \`checkRun\` below already reaches this conclusion \u2014 its \`if (secs.length)\`
+// guard declines to assert a region count without anchors, and says why. That
+// fix was applied to the VALIDATOR and never carried to the DENOMINATOR, so
+// next.mjs went on dividing a real pass count by an imaginary total. Measured
+// 2026-09-09 on a seed harness (anchors: [], matrix of 3): page-diff produced
+// 12 grid regions, all passing, and next.mjs printed \`SCORE 12/3 regions
+// passing\` followed by "Backlog is empty \u2014 Phases 5 and 6 are what is left",
+// exit 0. On a matrix of 4 the same seed prints \`SCORE 16/4\`. The absurd
+// fraction would have been questioned; the sentence would not.
+//
+// So an unpredictable page gets NO NUMBER \u2014 \`null\`, not a plausible-looking
+// integer. That is a SIGNAL, not a barrier: \`a + null\` is \`a\`, so a consumer
+// that sums TOTALS without asking \`scorable()\` still gets a too-small
+// denominator. The barrier is \`scorable()\` plus next.mjs's exit-2 refusal.
+export const TOTALS = Object.fromEntries(
+  PAGES.map((p) => [p.key, scorable(p.key) ? (p.anchors.length + 1) * MATRIX.length : null]),
+);
+
+/** WHY a report's region count is not the one TOTALS predicts for \`page\` \u2014
+ *  as a string \u2014 or null when it is, or when the page is not scorable and so
+ *  has no identity to hold (an unanchored page's count is page-diff's own;
+ *  see TOTALS).
+ *
+ *  ONE predicate for two callers, because the identity lived only in checkRun
+ *  and only \`gate.sh --check-run\` asked it: next.mjs gated a report through
+ *  \`uncountable(meta)\` alone, none of whose arms looks at how many regions a
+ *  report carries, so a page whose report came up SHORT \u2014 an anchor whose text
+ *  had gone from the rendered page, the ordinary way, is what a slice rename
+ *  does \u2014 contributed no failing region, fell through to "Backlog is empty" and
+ *  exited 0 over three regions nobody measured. Same sentence as the
+ *  \`unmeasured\` guard beside it, one level down (#756). */
+export function regionCountWhy(page, report) {
+  const expected = TOTALS[page];
+  if (expected == null) return null;
+  const n = Array.isArray(report?.regions) ? report.regions.length : 0;
+  if (n === expected) return null;
+  return \`\${n} region(s), expected \${expected} = (\${byKey[page].anchors.length} anchors + 1) x \${MATRIX.length} viewport(s)\`;
+}
+
+/** The SPEC.md heading predicate, shared by gate.sh's preflight and
+ *  build-spec.mjs so a section can never build fine and then refuse at the
+ *  gate. Matches the key followed by any non-key character (\`## team\` matches,
+ *  \`## teamfoo\` does not, \`## our-team\` cannot match \`team\`). */
+export const specHeadingRe = (key) => new RegExp(\`^##+ +\${key}([^A-Za-z0-9_-]|$)\`, "m");
+
+export const SKILL_DIR =
+  process.env.MATCHING_SKILL_DIR ?? join(homedir(), ".claude/skills/matching-a-page");
+export const PD = join(SKILL_DIR, "page-diff.mjs");
+export const SC = join(SKILL_DIR, "style-census.mjs");
+export const PLAYWRIGHT = pathToFileURL(join(SKILL_DIR, "node_modules/playwright/index.mjs")).href;
+
+/** The report format this site's scripts can read, so gate.sh can compare it
+ *  with \`page-diff --version\` before spending a run and next.mjs can refuse
+ *  rather than quietly drop a page whose newest report came from another
+ *  schema. Both do that now \u2014 gate.sh preflights \`page-diff --version\` against
+ *  this value before spending a run, and next.mjs counts a foreign-schema
+ *  report as MISSING rather than skipping it. (This said "neither does that
+ *  yet" \u2014 true at 922dde3 where it was written, false from 4e2cd7b, which
+ *  gave gate.sh the preflight and did not come back here.) Checked 2026-09-09
+ *  against the installed skill: \`page-diff --version\` \u2192 \`page-diff 0.1.0
+ *  report-schema 1\`. */
+export const REPORT_SCHEMA = 1;
+
+/**
+ * Fail-closed reference preflight. A 200 is NOT evidence: a host that has been
+ * repointed at our own build answers 200, and so does a staging host serving a
+ * 404 page. Both have happened on a real site \u2014 see the dated measurement in
+ * LEDGER.md. A pass here requires an artefact only the reference produces.
+ */
+export async function checkRef() {
+  if (!REF_MARK) {
+    return {
+      ok: false,
+      why: "harness.json refMark is empty \u2014 set it to a string only the reference serves (a Webflow site id, a build hash). A 200 is not evidence.",
+    };
+  }
+  const host = new URL(REF).host;
+  if (SELF_HOSTS.includes(host)) return { ok: false, why: \`REF host \${host} is in selfHosts\` };
+  if (host === new URL(CAND).host) return { ok: false, why: \`REF host \${host} equals CAND's host\` };
+  let res;
+  try {
+    res = await fetch(\`\${REF}/\`, { redirect: "manual" });
+  } catch (e) {
+    return { ok: false, why: \`GET \${REF}/ failed: \${e.message}\` };
+  }
+  if (res.status !== 200)
+    return { ok: false, why: \`GET \${REF}/ \u2192 HTTP \${res.status}, expected 200\` };
+  const loc = res.headers.get("location");
+  if (loc) return { ok: false, why: \`GET \${REF}/ \u2192 \${res.status} redirect to \${loc}\` };
+  const body = await res.text();
+  if (!body.includes(REF_MARK))
+    return {
+      ok: false,
+      why: \`\${REF}/ served 200 but WITHOUT refMark \${JSON.stringify(REF_MARK)} \u2014 that is not the reference\`,
+    };
+  if (CAND_MARK && body.includes(CAND_MARK))
+    return {
+      ok: false,
+      why: \`\${REF}/ contains candMark \${JSON.stringify(CAND_MARK)} \u2014 REF is serving OUR build\`,
+    };
+  return { ok: true, why: \`\${REF}/ \u2192 200, no redirect, refMark present, candMark absent\` };
+}
+
+/**
+ * Would next.mjs COUNT a run with this meta? Returns the reason it would not,
+ * as a string, or null when it would.
+ *
+ * A reason string and not a boolean, because the two callers must tell the
+ * cases apart: next.mjs treats "schema" as a page BLANKED (it has its own
+ * message and its own exit) and merely skips the rest of the diagnostics,
+ * while gate.sh prints whatever this says.
+ *
+ * It lives HERE rather than inside next.mjs because gate.sh now asks the same
+ * question, and a question asked twice drifts: a gate that greens a run
+ * next.mjs then drops is the same false green one step along. census.sh's
+ * GUARD 2c (census.sh:153-168) records exactly that drift between
+ * style-census's printer and census-count.mjs's parser \u2014 a COMPLETE census
+ * reported as 0 mismatches because the two had versioned apart.
+ */
+export function uncountable(m) {
+  // Missing schemaVersion means "written before the field existed" = 0. It is
+  // not an error on its own; it is only fatal when it would blank a page,
+  // which is next.mjs's call to make, not this predicate's.
+  if ((m.schemaVersion ?? 0) !== REPORT_SCHEMA) return "schema";
+  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the
+  // page. An --mask-photos probe of yfv made \`top\` @834 read 43.9% while the
+  // real gate had it passing at 1.3%.
+  if ((m.mask?.length ?? 0) > 0) return \`mask=[\${m.mask.join(", ")}]\`;
+  if (m.neutralizeMedia) return "neutralize-media";
+  if (m.maskPhotos) return "mask-photos";
+  if (m.truncated) return "truncated";
+  if (m.threshold !== THRESHOLD) return \`threshold \${m.threshold} != \${THRESHOLD}\`;
+  return null;
+}
+
+/**
+ * Did THIS run of page-diff leave a report the scorer will actually count?
+ *
+ * gate.sh cannot use page-diff's exit status for this. page-diff exits 1 for a
+ * region that legitimately FAILED (page-diff.mjs:227) and node exits 1 for the
+ * bare \`throw e\` one line below it, so the status cannot tell a finding from a
+ * crash-before-looking \u2014 census.sh:17-32 records the same shape for
+ * style-census. Measured on 29 Navy with the reference alive and no dev
+ * server: every page-diff died in \`page.goto\`, the gate printed \`home exit=1\`
+ * and \`ALL DONE\`, exited 0, and wrote no report at all.
+ *
+ * So the evidence is the artefact only a completed run leaves: the report
+ * next.mjs will read, fresh, over the matrix and anchors the table declares.
+ * Cheapest and most specific arm first.
+ */
+export function checkRun(page, dir, startedAt) {
+  const path = join(dir, "report.json");
+  let report;
+  try {
+    report = JSON.parse(readFileSync(path, "utf8"));
+  } catch (e) {
+    if (e.code === "ENOENT")
+      return { ok: false, why: \`\${path}: no report.json \u2014 the run wrote nothing\` };
+    return { ok: false, why: \`\${path}: \${e.message}\` };
+  }
+  const meta = report.meta ?? {};
+
+  const uncount = uncountable(meta);
+  if (uncount)
+    return { ok: false, why: \`\${path}: next.mjs would not count this run (\${uncount})\` };
+
+  // FRESHNESS. lib/report.mjs:45 is \`mkdirSync(outDir, {recursive:true})\` and
+  // nothing ever clears the directory, so a crashed re-run under a tag used
+  // before leaves the PREVIOUS round's report exactly where it was \u2014 measured
+  // 2026-09-09, sha unchanged across the crash. Requiring report.json without
+  // this arm reproduces the green one step along. meta.generatedAt is built
+  // after \`finally { await browser.close() }\` (page-diff.mjs:163-176), so it
+  // is an artefact of the run that wrote it and not of the file's mtime.
+  const since = Date.parse(startedAt);
+  // NOT skipped when startedAt is unusable: a fail-open default is the exact
+  // shape this guard exists to stop.
+  if (!Number.isFinite(since))
+    return {
+      ok: false,
+      why: \`startedAt \${JSON.stringify(startedAt)} is not a timestamp \u2014 cannot tell this run's report from a previous round's\`,
+    };
+  const at = Date.parse(meta.generatedAt ?? "");
+  if (!Number.isFinite(at))
+    return {
+      ok: false,
+      why: \`\${path}: no usable meta.generatedAt \u2014 cannot tell this run's report from a previous round's\`,
+    };
+  if (at < since)
+    return {
+      ok: false,
+      why: \`\${path}: STALE \u2014 written \${meta.generatedAt}, this run started \${startedAt}. page-diff never cleared the directory.\`,
+    };
+
+  // COVERAGE \u2014 what the run was ASKED for, against the table.
+  const vws = meta.viewports ?? [];
+  if (vws.join(",") !== MATRIX.join(","))
+    return {
+      ok: false,
+      why: \`\${path}: ran viewports [\${vws.join(",")}], harness.json matrix is [\${MATRIX.join(",")}]\`,
+    };
+  const secs = meta.sections ?? [];
+  const want = byKey[page]?.anchors ?? [];
+  if (secs.join("\\0") !== want.join("\\0"))
+    return {
+      ok: false,
+      why: \`\${path}: ran sections [\${secs.join(" | ")}], harness.json anchors are [\${want.join(" | ")}]\`,
+    };
+
+  // ...and what it actually PRODUCED. Every viewport the run says it covered
+  // has to appear in the regions. Deliberately compared against the run's own
+  // meta.viewports and not against MATRIX: the arm above owns "the run used the
+  // wrong matrix", and folding the two together would make either one
+  // unfalsifiable on its own.
+  if (!Array.isArray(report.regions) || report.regions.length === 0)
+    return { ok: false, why: \`\${path}: no regions \u2014 nothing was compared\` };
+  const seen = new Set(report.regions.map((r) => r.viewport));
+  const missing = vws.filter((v) => !seen.has(v));
+  if (missing.length)
+    return {
+      ok: false,
+      why: \`\${path}: no region at viewport(s) [\${missing.join(",")}] \u2014 the run covered [\${[...seen].join(",")}]\`,
+    };
+
+  // With anchors the region count is an exact identity: page-diff cuts one
+  // region before the first anchor plus one per anchor, at every viewport
+  // (regionsFromAnchors, page-diff.mjs:105-109). Measured over the 298 clean
+  // gate-shaped runs in the corpus this harness was cut from, all of them
+  // anchored: regions.length === (sections + 1) * viewports holds 298/298,
+  // while regions.length === TOTALS[page] holds only 260/298 \u2014 the 38 are
+  // legitimately narrower HAND rounds. So the two arms ABOVE hold the run's own
+  // matrix and anchors to the table, and only then is the count asked of
+  // regionCountWhy, whose prediction is the table's: at this point the two
+  // derivations are the same number, and a HAND round has already been refused
+  // by name for its narrower matrix or anchors, not for the count that follows.
+  //
+  // WITHOUT anchors there is no such identity, and asserting one is a FALSE
+  // REFUSAL of the shape every new site starts in. page-diff falls back to each
+  // page's own <section> boxes and, with none, an even four-row grid
+  // (splitRegions, page-diff.mjs:103-110), so the count is data-dependent and
+  // the two pages need not even agree. Measured 2026-09-09 against the real
+  // page-diff on a seed harness (anchors: [], matrix of 4): 16 regions labelled
+  // grid-0-0 \u2026 grid-3-0, not the 4 this identity predicted. The 298/298 above
+  // was measured over anchored runs only and never covered this case.
+  // regionCountWhy returns null for such a page (TOTALS is null there), which
+  // is the \`if (secs.length)\` guard this used to carry, kept in one place.
+  const count = regionCountWhy(page, report);
+  if (count) return { ok: false, why: \`\${path}: \${count}\` };
+
+  // A green that STATES what it is made of, so a green over nothing reads
+  // differently from a green over the matrix (census.sh:219's habit).
+  return {
+    ok: true,
+    why: \`\${report.regions.length} region(s) over \${vws.length} viewport(s), written \${meta.generatedAt}\`,
+  };
+}
+
+// CLI. Both sides go through realpathSync. \`import.meta.url\` is ALREADY the
+// resolved real path (node resolves symlinks unless --preserve-symlinks) while
+// process.argv[1] is the path as typed, so a plain pathToFileURL compare goes
+// false the moment any component of the invoked path is a symlink \u2014 and then
+// the CLI prints nothing and exits 0, which every caller reads as success.
+// page-diff.mjs:184-189 records exactly that defect and the same fix: "The
+// pathToFileURL compare that replaced the old template string is still false
+// whenever ANY component of the invoked path is a symlink \u2014 which is how this
+// skill is installed now (~/.claude/skills/matching-a-page -> the claude-skills
+// checkout). isMain() resolves the real path on both sides."
+const isMain = () => {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+};
+
+if (isMain()) {
+  const mode = process.argv[2];
+  const q = (v) => \`'\${String(v).replace(/'/g, \`'\\\\''\`)}'\`;
+  if (mode === "--env") {
+    const pairs = [
+      ["REF", REF],
+      ["CAND", CAND],
+      ["MATRIX", MATRIX.join(",")],
+      ["VIEWPORTS_SP", MATRIX.join(" ")],
+      ["THRESHOLD", THRESHOLD],
+      ["MAX_HEIGHT_DELTA", MAX_HEIGHT_DELTA],
+      ["PD", PD],
+      ["SC", SC],
+      ["REPORT_SCHEMA", REPORT_SCHEMA],
+    ];
+    for (const [k, v] of pairs) console.log(\`\${k}=\${q(v)}\`);
+  } else if (mode === "--table") {
+    for (const p of PAGES) console.log([p.key, p.ref, p.cand, p.anchors.join(",")].join("\\t"));
+  } else if (mode === "--check-ref") {
+    const r = await checkRef();
+    console.log(\`\${r.ok ? "REF OK" : "REF REFUSED"} \u2014 \${r.why}\`);
+    process.exit(r.ok ? 0 : 2);
+  } else if (mode === "--check-run") {
+    // startedAt is REQUIRED, never defaulted: an optional one is a fail-open
+    // door in the one guard that decides whether a page was measured at all.
+    const [page, dir, startedAt] = process.argv.slice(3);
+    if (!page || !dir || !startedAt) {
+      console.error("usage: harness.mjs --check-run <page> <out-dir> <startedAt-iso>");
+      process.exit(2);
+    }
+    const r = checkRun(page, dir, startedAt);
+    console.log(\`\${r.ok ? "RUN OK" : "NO RUN"} \u2014 \${r.why}\`);
+    process.exit(r.ok ? 0 : 2);
+  } else {
+    console.error("usage: harness.mjs --env | --table | --check-ref | --check-run");
+    process.exit(2);
+  }
+}
+`;
+var GATE_SH_RELATIVE = "matching/gate.sh";
+var GATE_SH_TEMPLATE = `#!/usr/bin/env bash
+# The matching gate. This file is generic \u2014 everything specific to a site lives
+# in matching/harness.json (the data) and matching/LEDGER.md (the why). It is
+# installed and upgraded by the \`reddoor-maint match-harness\` recipe, which
+# owns these bytes: a hand edit here is flagged on the next run, never
+# silently overwritten.
+#
+#   bash matching/gate.sh <round-tag> [page ...]
+#
+# Runs page-diff for every page in the table (or just the named ones) at the
+# full breakpoint matrix and writes matching/out-<round-tag>-<page>/.
+#
+# The matrix, the anchor lists, the reference and the candidate are DATA. Why a
+# site chose them \u2014 which live breakpoint band hid what, why an anchor is a
+# heading and not a button label \u2014 belongs in matching/LEDGER.md, which is dated
+# and append-only, because JSON holds no comments.
+#
+# NO MASKS and the threshold from harness.json everywhere: the numbers stay
+# honest and a known floor stays visible as its own region. A media-neutralised
+# secondary read is \`node "$PD" ... --neutralize-media\`; next.mjs ignores such
+# runs on purpose (next.mjs:57-64).
+#
+# PREFLIGHT (see the matching rules in CLAUDE.md): a page with no section in
+# matching/SPEC.md has not had Phase 1 done, and its geometry must not be
+# touched. Skipping the spec is how a reference's root-font ladder and its
+# per-component height ladders get found reactively, after the region has
+# already failed several rounds. This refuses the run instead of trusting anyone
+# to remember.
+set -u
+# Everything configurable lives in matching/harness.json; harness.mjs is the one
+# reader. --env emits shell-safe assignments (REF, CAND, MATRIX, VIEWPORTS_SP,
+# THRESHOLD, MAX_HEIGHT_DELTA, PD, SC, REPORT_SCHEMA).
+eval "$(node "$(dirname "$0")/harness.mjs" --env)"
+
+# The skill must be able to write reports this site's scripts can read. Cheap,
+# local, and it fails before any browser starts.
+PD_SCHEMA="$(node "$PD" --version 2>/dev/null | awk '{print $4}')"
+if [ "$PD_SCHEMA" != "$REPORT_SCHEMA" ]; then
+  echo "gate.sh: page-diff writes report schema '\${PD_SCHEMA:-none}', this harness reads $REPORT_SCHEMA." >&2
+  echo "         Update matching/harness.mjs REPORT_SCHEMA or the matching-a-page skill." >&2
+  exit 2
+fi
+SPEC="$(dirname "$0")/SPEC.md"
+TAG="\${1:?usage: gate.sh <round-tag> [page ...]}"
+# The tag must not contain a hyphen. Output dirs are "out-<TAG>-<page>", and
+# next.mjs recovers the page with /^out-[^-]+-(.+)$/ \u2014 it splits on the FIRST
+# hyphen, so a tag like "r-forms-2026-08-07" yields the page key
+# "forms-2026-08-07-yfv" and that run is silently never counted. It cannot split
+# on the last hyphen instead, because page keys have hyphens of their own
+# ("our-team", "ask-the-doctor"). Failing here is the cheap end of that: a
+# mis-tagged round otherwise LOOKS green because next.mjs keeps reading an older
+# report for the page you just changed. (Cost this once, 2026-08-07.)
+case "$TAG" in
+  *-*)
+    echo "gate.sh: round tag must not contain a hyphen (got '$TAG')." >&2
+    echo "         out-<TAG>-<page> is parsed on the first hyphen, so a" >&2
+    echo "         hyphenated tag hides the run from next.mjs. Try '\${TAG//-/}'." >&2
+    exit 2
+    ;;
+esac
+shift || true
+WANT=("$@")
+
+# What this round actually measured. These are read by the terminal block far
+# below, and the page loop is \`done < <(...)\` \u2014 process substitution, NOT a
+# pipe \u2014 precisely so they survive it (gate.sh's own note at the loop, and
+# census.sh:193-198, record the same trap). Converting that loop to a pipe
+# would leave every counter here reading 0, which is the green this file now
+# exists to stop.
+MEASURED=0
+ATTEMPTED=0
+UNMEASURED=""
+SEEN=""
+
+# Fail closed on the reference before spending a single run. A 200 is NOT
+# evidence: a production host that has cut over to OUR build answers 200, and
+# every region then scores near zero against itself. --check-ref requires an
+# artefact only the reference serves (harness.json refMark) and refuses a
+# redirect, a host listed in selfHosts, and a body carrying candMark. Measured
+# on the site this harness was cut from, 2026-09-09 AFTER the consolidation:
+# 12 of its 214 top-level matching scripts still assign REF a host listed in
+# selfHosts \u2014 i.e. compare the candidate with itself. It was 33 of 229 before.
+# (This comment read "33 of its 230" while sitting in the post-consolidation
+# tree, contradicting harness.mjs's 12 three files away.)
+if ! node "$(dirname "$0")/harness.mjs" --check-ref; then
+  echo "gate.sh: refusing to gate against an unverified reference." >&2
+  exit 2
+fi
+
+# Set SPEC_OPTIONAL=1 only for a read-only baseline sweep of pages you are not
+# about to edit. It is recorded in the round tag so the exemption is visible.
+SPEC_OPTIONAL="\${SPEC_OPTIONAL:-0}"
+
+has_spec() { # page
+  # NB: the obvious \`( |$|\\b)\` guard is rejected by ugrep as an empty
+  # subexpression, and a preflight that errors out fails CLOSED \u2014 it refused all
+  # 9 pages while SPEC.md was complete. Match the page key followed by any
+  # non-key character (so \`## team\` matches but \`## teamfoo\` does not; \`##
+  # our-team\` cannot match \`team\` because the key must follow the spaces).
+  [ -f "$SPEC" ] && grep -qE "^##+ +$1([^A-Za-z0-9_-]|$)" "$SPEC"
+}
+
+run() { # tag refpath candpath sections
+  local page="$1" refpath="$2" candpath="$3" sections="$4"
+  # BEFORE the WANT filter, so the known-page list stays complete even when
+  # WANT matches nothing and there is a typo to name. Mirrors census.sh:107.
+  SEEN="$SEEN $page"
+  if [ \${#WANT[@]} -gt 0 ]; then
+    local hit=0
+    for w in "\${WANT[@]}"; do [ "$w" = "$page" ] && hit=1; done
+    [ $hit -eq 1 ] || return 0
+  fi
+  if ! has_spec "$page"; then
+    if [ "$SPEC_OPTIONAL" = "1" ]; then
+      echo "########## $page ##########"
+      echo "WARNING: no '## $page' section in matching/SPEC.md \u2014 Phase 1 not done."
+      echo "         Running anyway because SPEC_OPTIONAL=1 (baseline read only)."
+      echo "         Do NOT apply geometry fixes off this run."
+    else
+      echo "########## $page ##########"
+      echo "REFUSED: no '## $page' section in matching/SPEC.md."
+      echo "         Phase 1 (section census + per-section spec, read from"
+      echo "         matching/spec/) comes before geometry."
+      echo "         See CLAUDE.md rule 2. SPEC_OPTIONAL=1 for a baseline read."
+      FAILED_PREFLIGHT=1
+      return 0
+    fi
+  fi
+  echo "########## $page ##########"
+  # Same clock source and same format as page-diff's own meta.generatedAt, so
+  # the freshness comparison below is between two ISO strings from one clock.
+  local started
+  started="$(node -e 'process.stdout.write(new Date().toISOString())')"
+  node "$PD" --ref "$REF$refpath" --cand "$CAND$candpath" \\
+    --viewports "$MATRIX" --threshold "$THRESHOLD" \\
+    --sections "$sections" --out "matching/out-$TAG-$page" \\
+    > "matching/out-$TAG-$page.log" 2>&1
+  # IMMEDIATELY after the invocation. Any command in between \u2014 the echo
+  # included \u2014 destroys $?.
+  local status=$?
+  echo "$page exit=$status"
+  ATTEMPTED=$((ATTEMPTED + 1))
+  # $status may DENY a green; it may never GRANT one, and here it does neither.
+  # page-diff exits 1 for a region that legitimately FAILED (page-diff.mjs:227)
+  # and node exits 1 for the bare \`throw e\` below it, so the status cannot tell
+  # a finding from a crash before it looked \u2014 and a matching round's steady
+  # state IS a failing gate, so denying on it would break every normal round.
+  # Measured on 29 Navy with the reference alive and no dev server: \`home
+  # exit=1\`, \`ALL DONE\`, exit 0, and no matching/out-*-home/ written at all.
+  # What only a completed run leaves is the report next.mjs will count.
+  # census.sh:17-32 is the same argument for style-census.
+  local evidence
+  if evidence="$(node "$(dirname "$0")/harness.mjs" --check-run "$page" "matching/out-$TAG-$page" "$started" 2>&1)"; then
+    MEASURED=$((MEASURED + 1))
+  else
+    UNMEASURED="$UNMEASURED $page"
+    echo "  NOT MEASURED: $evidence"
+  fi
+}
+
+# The page table is matching/harness.json. Process substitution, NOT a pipe:
+# a pipe would run this loop in a subshell and FAILED_PREFLIGHT would not
+# survive to the check below, so a refused page would exit 0.
+while IFS=$'\\t' read -r key refpath candpath anchors; do
+  run "$key" "$refpath" "$candpath" "$anchors"
+done < <(node "$(dirname "$0")/harness.mjs" --table)
+
+# BOTH kinds of incompleteness are reported in one run: a page refused before
+# it ran, and a page that ran and left nothing countable. Exiting on the first
+# would hide the second from an operator who then fixes only what was printed.
+INCOMPLETE=0
+if [ -n "$UNMEASURED" ]; then
+  echo
+  echo "GATE INCOMPLETE ($TAG) \u2014 $((ATTEMPTED - MEASURED)) of $ATTEMPTED page(s) produced no"
+  echo "countable report:$UNMEASURED"
+  echo "Those pages have NOT been measured. next.mjs drops an unreported page from"
+  echo "BOTH sides of the score, so the pages that did report would read as the"
+  echo "whole site. Full runs: matching/out-$TAG-<page>.log"
+  INCOMPLETE=1
+fi
+if [ "\${FAILED_PREFLIGHT:-0}" = "1" ]; then
+  echo
+  echo "GATE INCOMPLETE ($TAG) \u2014 one or more pages were refused for a missing"
+  echo "SPEC.md section. Those pages have NOT been measured; do not report a"
+  echo "score for them."
+  INCOMPLETE=1
+fi
+if [ "$INCOMPLETE" = "1" ]; then
+  exit 2
+fi
+# A green over ZERO pages is still a green. Measured: \`gate.sh nosuch
+# nosuchpage\` printed ALL DONE and exited 0 having run nothing and printed no
+# page header at all. census.sh:199-209 refuses exactly this shape, and
+# strikes.mjs:147-156 was written because a typo silently greened rule 3 on six
+# of nine pages.
+if [ "$ATTEMPTED" -eq 0 ]; then
+  if [ -n "$SEEN" ]; then
+    echo "gate.sh: \\"\${WANT[*]:-}\\" matches no page \u2014 refusing to report ALL DONE." >&2
+    echo "         known pages:$SEEN" >&2
+  else
+    echo "gate.sh: the page table is empty \u2014 refusing to report ALL DONE." >&2
+    echo "         node matching/harness.mjs --table printed no rows; check" >&2
+    echo "         \\"pages\\" in matching/harness.json." >&2
+  fi
+  exit 2
+fi
+# A green that STATES what it is made of (census.sh:219), so a green over
+# nothing cannot read like a green over the table.
+echo "ALL DONE ($TAG) \u2014 $MEASURED of $ATTEMPTED page(s) measured, each one counted."
+`;
+var CENSUS_SH_RELATIVE = "matching/census.sh";
+var CENSUS_SH_TEMPLATE = `#!/usr/bin/env bash
+# Phase 3 style gate \u2014 the mechanical net for the type spec.
+#
+#   bash matching/census.sh            # all 9 pages, all 3 viewports
+#   bash matching/census.sh home yfv   # just these
+#
+# style-census diffs the computed type tuple (family, weight, size,
+# line-height, letter-spacing, transform, colour) of every text snippet present
+# on BOTH pages. It is the only gate that catches the 11px footer line and the
+# cyan-vs-teal link that page-diff is structurally blind to \u2014 a region can be
+# pixel-clean at 0.10 and still be wearing the wrong colour on small text.
+#
+# Prints a per-page/per-viewport mismatch count and leaves the full runs in
+# matching/census-<page>-<vw>.log. Exits 1 while any count is non-zero, and 2
+# when it cannot honestly report a count at all.
+#
+# EVIDENCE \u2014 read before adding a guard here, or removing one. A green here
+# has to be produced by a census that RAN. It was not: with style-census.mjs
+# absent this gate printed "Phase 3 CLEAN \u2014 0 undeclared type mismatches" and
+# exited 0. Every run died on module resolution, census-count.mjs read each
+# crash log as "0 0 0" (it counts \`  y=\` rows and a stack trace has none \u2014
+# census-count.mjs:35-56), and no rows was reported as no mismatches. Measured
+# again with style-census.mjs PRESENT and the candidate host down: identical
+# output, because style-census exits 1 both when it finds mismatches
+# (style-census.mjs:187) and when it dies before it looks \u2014 so the exit status
+# cannot tell a finding from a crash and may not grant a green either.
+#
+# The guards below are what next.mjs:83-89 (no parseable gate run \u2014 refusing to
+# report a score), strikes.mjs:87-97 (refusing to report "clear") and
+# gate.sh:37-42 (preflight page-diff before spending a run) already do. Each
+# demands an artefact only a working census produces; none of them can turn a
+# red green.
+set -uo pipefail
+
+# PAUSE SWITCH \u2014 the same early exit next.mjs and strikes.mjs take, for the same
+# reason (see next.mjs). This gate is the third door into a round: measured on
+# the site this was cut from, PAUSED since 2026-09-01, a run here would have
+# spent 27 browser pairs against the live reference during a declared pause. A
+# switch two of three gates honour is not a switch
+# (reddoorla/reddoor-maintenance#735).
+if [ -f "$(dirname "$0")/PAUSED" ]; then
+  echo "MATCHING PAUSED \u2014 no agenda, and none is to be inferred."
+  echo
+  cat "$(dirname "$0")/PAUSED"
+  exit 0
+fi
+
+# Resolved BEFORE the cd. $0 is the path as TYPED, so a relatively invoked
+# census.sh that resolved the harness afterwards would look for it under
+# whatever root the cd landed on.
+HARNESS="$(cd "$(dirname "$0")" && pwd)/harness.mjs"
+cd "$(dirname "$0")/.."
+
+# Everything configurable lives in matching/harness.json; harness.mjs is the one
+# reader. --env supplies REF, CAND, SC and VIEWPORTS_SP \u2014 this gate held its own
+# copy of all four, and its REF went stale when production cut over to our own
+# build (LEDGER "REFERENCE MOVED", verified 2026-08-10) while gate.sh's was
+# repointed the same day.
+eval "$(node "$HARNESS" --env)"
+NODE="\${NODE:-node}"
+
+# The matrix is DATA, read as VIEWPORTS_SP, the way gate.sh reads MATRIX. The
+# old VIEWPORTS override is retired rather than silently ignored: a census run
+# over a matrix harness.json does not name is a column set the pixel gate never
+# measured, and it would look exactly like a clean one.
+if [ -n "\${VIEWPORTS:-}" ]; then
+  echo "census.sh: the VIEWPORTS override is retired \u2014 the matrix is data now." >&2
+  echo "           Edit \\"matrix\\" in matching/harness.json, then unset it." >&2
+  exit 2
+fi
+
+# GUARD 1 \u2014 the tool is there and it starts. gate.sh compares \`page-diff
+# --version\` with the harness's REPORT_SCHEMA before spending a run
+# (gate.sh:37-42); style-census has no --version to compare (page-diff.mjs
+# defines one at 191-195; nothing in style-census.mjs writes one), so the
+# artefact demanded here is the other one only it produces: the usage banner it
+# prints on exit 2 when --ref/--cand are missing (style-census.mjs:151-157).
+# That banner is not free \u2014 \`import { chromium } from "playwright"\` runs first
+# (style-census.mjs:19) \u2014 so a skill directory with no playwright installed
+# fails HERE, once, instead of writing one crash log per page per viewport that
+# every reader downstream counts as zero.
+if [ ! -f "$SC" ]; then
+  echo "census.sh: no style-census at $SC \u2014 refusing to report a count." >&2
+  echo "           Install the matching-a-page skill, or point MATCHING_SKILL_DIR" >&2
+  echo "           at a checkout that has style-census.mjs." >&2
+  exit 2
+fi
+SC_USAGE="$("$NODE" "$SC" 2>&1)"
+case "$SC_USAGE" in
+  *"style-census"*"--ref"*"--cand"*"--vw"*) ;;
+  *)
+    echo "census.sh: $SC did not answer with a style-census --ref/--cand/--vw usage" >&2
+    echo "           banner \u2014 refusing to report a count. It printed:" >&2
+    echo "           \${SC_USAGE:-(nothing at all)}" >&2
+    exit 2
+    ;;
+esac
+
+declare -a WANT=("$@")
+
+# page -> "refpath candpath": the same table gate.sh drives, from the same file.
+# cut drops the anchors column, which the style census has no argument for
+# (style-census.mjs: --ref <url> --cand <url> [--vw 1440]).
+pages() { node "$HARNESS" --table | cut -f1-3; }
+
+TOTAL=0
+AMB=0
+DECL=0
+ROWS=0
+RUNS=0
+BROKEN=0
+SEEN=""
+# One column per viewport, from the matrix. Flush with the data rows below, at
+# last: the old header hardcoded four fixed fields separated by a literal space,
+# which the rows do not have, so its labels sat 1/2/3 columns right of them.
+printf '%-10s' page
+for vw in $VIEWPORTS_SP; do printf '%8s' "$vw"; done
+printf '\\n'
+while read -r page refpath candpath; do
+  [ -z "$page" ] && continue
+  SEEN="$SEEN $page"
+  if [ \${#WANT[@]} -gt 0 ]; then
+    hit=0
+    for w in "\${WANT[@]}"; do [ "$w" = "$page" ] && hit=1; done
+    [ $hit -eq 1 ] || continue
+  fi
+  ROWS=$((ROWS + 1))
+  line=$(printf '%-10s' "$page")
+  for vw in $VIEWPORTS_SP; do
+    log="matching/census-$page-$vw.log"
+    RUNS=$((RUNS + 1))
+    "$NODE" "$SC" --ref "$REF$refpath" --cand "$CAND$candpath" --vw "$vw" >"$log" 2>&1
+    # GUARD 2 \u2014 this run produced a census. The header and the counts line are
+    # written together at style-census.mjs:166-169 and only after both pages
+    # have been walked, so they are the artefact a completed run leaves and a
+    # crashed one cannot. The viewport is read back out of the header because a
+    # --vw that did not take would otherwise fill three differently named logs
+    # with the same 1440 census. \`ref runs\`/\`cand runs\` must be non-zero: two
+    # pages that rendered no text at all agree perfectly and mean nothing.
+    if ! grep -qE "^=== style census, viewport $vw ===\\$" "$log" ||
+      ! grep -qE "^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+\\$" "$log"; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: $page @$vw produced no usable census \u2014 see $log" >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    # census-count splits the log three ways: REAL mismatches, AMBIGUOUS
+    # same-text collisions (style-census's own split), and DECLARED rows the
+    # operator has already ruled on (matching/census-deviations.mjs, the same
+    # contract as floors.mjs). Only the first is outstanding work \u2014 without the
+    # third, this gate can never reach zero and its number means nothing.
+    read -r n a d <<<"$("$NODE" matching/census-count.mjs "$log")"
+    # GUARD 2b \u2014 three integers, or the counter did not count. census-count.mjs
+    # is the reader that turned a stack trace into "0 0 0"; a run of it that
+    # dies (a broken census-deviations.mjs, a bad path) prints nothing at all,
+    # and bash reads an empty $n as zero in the arithmetic below.
+    counted=1
+    for v in "\${n:-}" "\${a:-}" "\${d:-}"; do
+      case "$v" in "" | *[!0-9]*) counted=0 ;; esac
+    done
+    if [ "$counted" -eq 0 ]; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: census-count.mjs did not return three counts for $log" >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    # GUARD 2c \u2014 the number reported is the number the census MEASURED. GUARD 2
+    # matched the counts line for PRESENCE and threw its numbers away, so the
+    # count printed below came from census-count's row parse and nothing ever
+    # compared the two. Measured 2026-09-09: a COMPLETE census whose counts line
+    # said "mismatches: 3", whose \`y=\` rows carried one leading space instead of
+    # two (census-count.mjs:39 matches /^ {2}y=/), was reported as 0 and this
+    # gate printed "Phase 3 CLEAN \u2014 0 undeclared type mismatches", exit 0. The
+    # printer lives in the SKILL (style-census.mjs:171-173) and the parser is
+    # copied into every site, so the two version independently and drift needs
+    # nobody to touch either repo.
+    #
+    # The identity is exact for mismatches: style-census prints at most 100 rows
+    # and states the remainder on its own line (style-census.mjs:175-177), so
+    # parsed + remainder == reported. Ambiguous rows are capped the same way
+    # (:184) but the remainder is NOT stated, so only a floor is checkable
+    # there \u2014 any is not none, and the parse may never exceed the report.
+    counts=$(grep -E "^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+$" "$log" | tail -1)
+    said_m=\${counts##*mismatches: }
+    said_m=\${said_m%% *}
+    said_a=\${counts##*ambiguous: }
+    more=$(sed -n 's/^ *\u2026 and \\([0-9][0-9]*\\) more (truncated print, all counted)$/\\1/p' "$log" | tail -1)
+    if [ $((n + d + \${more:-0})) -ne "$said_m" ] ||
+      [ "$a" -gt "$said_a" ] ||
+      { [ "$said_a" -gt 0 ] && [ "$a" -eq 0 ]; }; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: $log reports mismatches: $said_m ambiguous: $said_a, but" >&2
+      echo "           census-count.mjs read $((n + d)) mismatch row(s)\${more:+ (+ $more truncated)} and $a ambiguous." >&2
+      echo "           The census and its reader disagree; there is no count to report." >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    AMB=$((AMB + a))
+    DECL=$((DECL + d))
+    TOTAL=$((TOTAL + n))
+    line="$line$(printf '%8s' "$n")"
+  done
+  echo "$line"
+done < <(pages)
+
+echo
+# GUARD 3 \u2014 something was actually censused. Process substitution above, NOT a
+# pipe: a pipe runs the loop in a subshell and every counter here would still
+# read 0, which is exactly the green this file exists to stop (gate.sh:123-125
+# records the same trap for FAILED_PREFLIGHT). A page name that matches nothing
+# must not report CLEAN either \u2014 strikes.mjs:147-156 is the same refusal, and
+# it was written because a typo silently greened rule 3 on six of nine pages.
+if [ "$ROWS" -eq 0 ]; then
+  if [ -n "$SEEN" ]; then
+    echo "census.sh: \\"\${WANT[*]:-}\\" matches no page \u2014 refusing to report CLEAN." >&2
+    echo "           known pages:$SEEN" >&2
+  else
+    echo "census.sh: the page table is empty \u2014 refusing to report CLEAN." >&2
+    echo "           node matching/harness.mjs --table printed no rows; check" >&2
+    echo "           \\"pages\\" in matching/harness.json." >&2
+  fi
+  exit 2
+fi
+if [ "$BROKEN" -gt 0 ]; then
+  echo "CENSUS INCOMPLETE \u2014 $BROKEN of $RUNS run(s) produced no usable census (marked !!)."
+  echo "Those page/viewport pairs have NOT been measured; there is no count to"
+  echo "report for them, and the totals below would be a floor, not a score."
+  echo "Full runs: matching/census-<page>-<vw>.log"
+  exit 2
+fi
+if [ "$TOTAL" -eq 0 ]; then
+  echo "Phase 3 CLEAN \u2014 0 undeclared type mismatches ($DECL declared, $AMB ambiguous)."
+  echo "($RUNS censused run(s) over $ROWS page(s), each one counted.)"
+  [ "$AMB" -gt 0 ] && echo "($AMB ambiguous same-text rows remain: each needs ADJUDICATING," &&
+    echo " not fixing \u2014 our element matches, another sharing its text does not.)"
+  exit 0
+fi
+echo "$TOTAL type mismatch(es) remain (+ $AMB ambiguous, $DECL declared)."
+echo "Full runs: matching/census-<page>-<vw>.log"
+echo "A mismatch is a defect or a ledgered deviation. An ambiguous row is neither"
+echo "until you look: the census keys on TEXT, so two different elements sharing a"
+echo "string land under one key and only one of them may be wrong."
+exit 1
+`;
+var NEXT_MJS_RELATIVE = "matching/next.mjs";
+var NEXT_MJS_TEMPLATE = `// What is still broken, ranked. Exits 1 while work remains.
+//
+//   node matching/next.mjs
+//
+// Round protocol step 0 (repo CLAUDE.md rule 5). A commit is a CHECKPOINT, not
+// a stopping point: after committing, run this. If it exits 1 there is a named
+// next action and the round continues without handing control back.
+//
+// Reads the most recent gate log per page rather than the whole corpus, so it
+// reflects HEAD rather than history (that is strikes.mjs's job).
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+// DIR comes from harness.mjs (imported below \u2014 ESM hoists it, so it is bound
+// before the pause check runs). It was \`new URL(".", import.meta.url).pathname\`
+// here, which percent-encodes, so under a checkout path with a space in it this
+// read a directory that does not exist (#47).
+
+// PAUSE SWITCH. While matching/PAUSED exists this hands out no agenda and
+// exits 0. It is deliberately the FIRST thing that runs: no report is read, no
+// score is printed, nothing tempting is put on screen to argue with.
+//
+// Why an exit code and not a note somewhere: rule 5 is a LOOP \u2014 "after
+// committing, run next.mjs; while it exits 1 there is a named next action and
+// the round continues". A pause written as prose loses to that loop, because
+// the loop is mechanical and the prose is not. Exiting 0 satisfies rule 5
+// truthfully rather than suspending it: there is no next action.
+const PAUSE = join(DIR, "PAUSED");
+if (existsSync(PAUSE)) {
+  console.log("MATCHING PAUSED \u2014 no agenda, and none is to be inferred.\\n");
+  console.log(readFileSync(PAUSE, "utf8").trimEnd());
+  process.exit(0);
+}
+
+import { FLOORS, ACCEPTED } from "./floors.mjs";
+import {
+  DIR,
+  TOTALS,
+  THRESHOLD,
+  MAX_HEIGHT_DELTA,
+  REPORT_SCHEMA,
+  uncountable,
+  scorable,
+  unscorableWhy,
+  regionCountWhy,
+  byKey,
+} from "./harness.mjs";
+
+// Reports written by a different page-diff, by page key. Kept rather than
+// dropped: silently ignoring them is how a page vanishes from the score.
+const schemaMismatch = new Set();
+
+const latest = new Map();
+for (const d of readdirSync(DIR).filter((d) => d.startsWith("out-"))) {
+  const m = /^out-[^-]+-(.+)$/.exec(d);
+  // Membership in the page table is asked of the TABLE. \`!TOTALS[m[1]]\` was a
+  // NUMBER standing in for a fact: it is null for an unanchored page and 0 for
+  // an empty matrix, and either dropped the page out of \`latest\` while
+  // \`Object.keys(TOTALS)\` still listed it \u2014 so a gate run that had just
+  // SUCCEEDED came back as "no countable gate run".
+  if (!m || !byKey[m[1]]) continue;
+  let report, mtime;
+  try {
+    const p = join(DIR, d, "report.json");
+    report = JSON.parse(readFileSync(p, "utf8"));
+    mtime = statSync(p).mtimeMs;
+  } catch {
+    continue;
+  }
+  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the
+  // page. Picking one up as "latest" silently reports scores nobody can ship \u2014
+  // it happened immediately: an --mask-photos probe of yfv made \`top\` @834 read
+  // 43.9% here while the real gate had it passing at 1.3%. Missing
+  // schemaVersion means "written before the field existed" = 0; it is not an
+  // error on its own, only when it would blank a page.
+  //
+  // The predicate itself lives in harness.mjs now, because gate.sh asks the
+  // same question per run and two copies of one question drift \u2014 a gate that
+  // greens a run this file then drops is the same false green one step along.
+  const why = uncountable(report.meta ?? {});
+  if (why === "schema") {
+    schemaMismatch.add(m[1]);
+    continue;
+  }
+  if (why) continue;
+  const prev = latest.get(m[1]);
+  if (!prev || mtime > prev.mtime) latest.set(m[1], { dir: d, mtime, report });
+}
+
+const blanked = [...schemaMismatch].filter((p) => !latest.has(p));
+if (blanked.length) {
+  console.error(
+    \`next: \${blanked.length} page(s) have no run at report schema \${REPORT_SCHEMA} \u2014 \` +
+      \`their newest reports came from a different page-diff (\${blanked.sort().join(", ")}).\\n\` +
+      \`      Re-run: bash matching/gate.sh <tag> \${blanked.sort().join(" ")}\`,
+  );
+  process.exit(2);
+}
+if (latest.size === 0) {
+  console.error(
+    "next: no parseable gate run under matching/ \u2014 refusing to report a score.\\n" +
+      "      Run bash matching/gate.sh <tag> first.",
+  );
+  process.exit(2);
+}
+
+const rows = [];
+const accepted = [];
+let openTotal = 0;
+let floorTotal = 0;
+for (const [page, { dir, report }] of latest) {
+  const fails = report.regions.filter((r) => !r.pass);
+  for (const f of fails) {
+    const floor = FLOORS.find((fl) => fl.match(f, page));
+    if (floor) {
+      floorTotal++;
+      continue;
+    }
+    const ack = ACCEPTED.find((a) => a.match(f, page));
+    if (ack) {
+      accepted.push({ page, vw: f.viewport, label: f.label, why: ack.why });
+      continue;
+    }
+    openTotal++;
+    rows.push({
+      page,
+      vw: f.viewport,
+      label: f.label,
+      mm: f.mismatchFraction,
+      dh: f.heightDeltaFraction ?? 0,
+      dir,
+    });
+  }
+}
+
+// Pages that REPORTED but cannot be scored: no anchors, so their regions are
+// whatever page-diff's fallback cut and there is no model for one to be right
+// against. Kept separate from \`scored\` and never ranked with it.
+const unscorable = [...latest.entries()]
+  .filter(([p]) => !scorable(p))
+  .map(([p, v]) => ({ p, regions: v.report.regions.length }))
+  .sort((a, b) => a.p.localeCompare(b.p));
+
+// \`.filter(scorable)\` before \`.map\`, because the sort below divides by \`total\`
+// and an unanchored page's ratio is NOT BOUNDED BY 1. A passing one scored
+// 16/4 = 4.0 and sorted LAST, i.e. best, so \`worst\` could never name the one
+// page whose Phase 1 was not done; a failing one scored 0/4 = 0.0, sorted
+// FIRST, and put \`grid-0-0\`, \`grid-1-0\` \u2026 on the agenda \u2014 an instruction to fix
+// geometry against regions page-diff invented.
+const scored = [...latest.entries()]
+  .filter(([p]) => scorable(p))
+  .map(([p, v]) => ({
+    p,
+    pass: v.report.regions.filter((r) => r.pass).length,
+    total: TOTALS[p],
+  }))
+  .sort((a, b) => a.pass / a.total - b.pass / b.total);
+
+// The denominator is the DECLARED site, not the pages that happened to report.
+// Summed over \`scored\` it shrank to match the numerator: 8 of 9 pages reporting
+// read SCORE 160/160 while the ninth, whose page-diff had crashed, was in
+// neither the numerator nor the denominator nor the list below. harness.mjs:61-67
+// already gives the reason \u2014 "a wrong denominator makes the score a lie in the
+// flattering direction" \u2014 and that fix was applied per REGION (\`total:
+// TOTALS[p]\`) and never per PAGE.
+const unmeasured = Object.keys(TOTALS)
+  .filter((p) => !latest.has(p))
+  .sort();
+
+// Pages that REPORTED, are scorable, and whose newest report carries FEWER
+// regions than TOTALS predicts. \`uncountable()\` cannot see this \u2014 none of its
+// arms counts regions \u2014 so a short report was fully countable, contributed no
+// failing region, and fell through to "Backlog is empty", exit 0, over regions
+// nobody had measured. The score line stayed honest (\`3/6\`), which is what made
+// it easy to walk past. The identity is harness.mjs's regionCountWhy, the same
+// one gate.sh's --check-run refuses a run with \u2014 asked here of the report being
+// SCORED, because a report can reach \`latest\` without ever passing through the
+// gate (#756).
+const short = scored
+  .map((s) => ({ p: s.p, why: regionCountWhy(s.p, latest.get(s.p).report) }))
+  .filter((s) => s.why)
+  .sort((a, b) => a.p.localeCompare(b.p));
+const sum = scored.reduce((a, s) => a + s.pass, 0);
+// Summed EXPLICITLY over the scorable pages rather than over TOTALS' values:
+// \`a + null\` is silently \`a\`, and a denominator that is right only because of a
+// coercion is the same lie one refactor away.
+const pagesAll = Object.keys(TOTALS).length;
+const pagesScorable = Object.keys(TOTALS).filter((p) => scorable(p)).length;
+const max = Object.keys(TOTALS).reduce((a, p) => a + (scorable(p) ? TOTALS[p] : 0), 0);
+
+// A score is printed only if SOMETHING can carry one. \`SCORE 0/0\` is a third
+// lie and the one that reads best of all, so it is never printed: with nothing
+// scorable the line says so in words and gives no fraction to quote.
+console.log(
+  (pagesScorable === 0
+    ? \`NO SCORE \u2014 0 of \${pagesAll} page(s) can carry one.\`
+    : \`SCORE \${sum}/\${max} regions passing over \${pagesScorable} of \${pagesAll} page(s)\` +
+      (unmeasured.length ? \` \u2014 \${unmeasured.length} page(s) NOT MEASURED\` : "")) + "\\n",
+);
+console.log(
+  [
+    ...scored.map((s) => \`  \${s.p.padEnd(9)} \${String(s.pass).padStart(2)}/\${s.total}\`),
+    // The run's OWN region count, as EVIDENCE FOR THE REFUSAL \u2014 it proves a run
+    // happened and explains why it cannot be scored, so a refusal is not
+    // mistaken for a crash. The pass FRACTION is deliberately withheld: it is
+    // the number with no referent, and the number that gets quoted.
+    ...unscorable.map(
+      (u) =>
+        \`  \${u.p.padEnd(9)} \${String(u.regions).padStart(2)} region(s)  NOT SCORABLE \u2014 \${unscorableWhy(u.p)}\`,
+    ),
+    // \`?/N\`, never \`0/N\`: an unmeasured page is not a page that scored zero,
+    // and printing zero would be a different lie. \`?/?\` when the page is ALSO
+    // unanchored \u2014 \`?/null\` would name the denominator "null", which is worse
+    // than the number it replaced.
+    ...unmeasured.map((p) => \`  \${p.padEnd(9)}  ?/\${TOTALS[p] ?? "?"}   NOT MEASURED\`),
+  ].join("\\n"),
+);
+
+if (accepted.length) {
+  console.log(\`\\nOperator-ACCEPTED failures (left failing on purpose):\`);
+  for (const a of accepted)
+    console.log(\`  \${a.page} @\${a.vw} "\${a.label}" \u2014 \${a.why.slice(0, 96)}\u2026\`);
+}
+
+// BEFORE the \`!rows.length\` branch, and deliberately so: an unmeasured page
+// contributes no failing region, so that branch would print "Backlog is empty"
+// and exit 0 over a page nobody had looked at. Exit 2 matches the two guards
+// above (\`blanked\`, \`latest.size === 0\`) \u2014 neither "clean" nor "work remains"
+// but "this cannot be scored", the one answer rule 5's while-it-exits-1 loop
+// cannot swallow. The score print stays above it so the partial state is still
+// visible.
+// A page with no anchors has not finished Phase 1, so a score has no referent
+// and this refuses to invent one \u2014 the same answer \`refMark: ""\` gets from
+// checkRef and an absent \`## <page>\` SPEC section gets from gate.sh. All three
+// are seed sentinels, and this was the one that failed OPEN. Repo CLAUDE.md
+// rule 1's corollary is the whole argument: a field that can only observe
+// configuration must never be named after the thing it cannot observe, and
+// "12 of 12 grid rows passed" observes a screenshot cut into quarters, not a
+// design anyone specced.
+//
+// PRINTED here, EXITED below: \`unmeasured\` and \`unscorable\` are different pages
+// with different remedies, and exiting inside the first block would hide the
+// second from an operator who then fixes only what was printed.
+if (unscorable.length) {
+  console.error(
+    \`\\nnext: \${unscorable.length} page(s) have no anchors, so their regions are page-diff's own\\n\` +
+      \`      fallback cut and cannot be scored \u2014 \` +
+      unscorable.map((u) => \`\${u.p} (\${u.regions} region(s))\`).join(", ") +
+      \`.\\n      Set "anchors" for them in matching/harness.json to section texts that exist on\\n\` +
+      \`      BOTH the reference and the candidate, then re-run: bash matching/gate.sh <tag> \` +
+      unscorable.map((u) => u.p).join(" "),
+  );
+}
+
+if (short.length) {
+  console.error(
+    \`\\nnext: \${short.length} page(s) reported fewer regions than their anchors predict, so their\\n\` +
+      \`      score has regions nobody measured \u2014 \` +
+      short.map((s) => \`\${s.p}: \${s.why}\`).join("; ") +
+      \`.\\n      An anchor whose text is no longer on the page cuts no region: check the anchors in\\n\` +
+      \`      matching/harness.json against BOTH renders, then re-run: bash matching/gate.sh <tag> \` +
+      short.map((s) => s.p).join(" "),
+  );
+}
+
+if (unmeasured.length) {
+  console.error(
+    \`\\nnext: \${unmeasured.length} page(s) have no countable gate run \u2014 \${unmeasured.join(", ")}.\\n\` +
+      \`      Re-run: bash matching/gate.sh <tag> \${unmeasured.join(" ")}\`,
+  );
+  process.exit(2);
+}
+
+// See above: deliberately separate statements, not an \`else\` chain \u2014 every
+// refusal is PRINTED before the first one EXITS.
+if (unscorable.length) process.exit(2);
+if (short.length) process.exit(2);
+
+if (!rows.length) {
+  console.log(
+    \`\\nNo open geometry failures. \${floorTotal} declared floor(s) remain.\`,
+  );
+  console.log(
+    "Backlog is empty \u2014 Phases 5 (states) and 6 (adversarial review) are what is left.",
+  );
+  process.exit(0);
+}
+
+// Worst page first, then worst region inside it: fix where the model is most wrong.
+//
+// INVARIANT, documented rather than guarded because no test could redden a
+// guard here: \`scored[0]\` is safe because \`scored\` is empty only when every
+// page in \`latest\` is unanchored \u2014 and that means \`unscorable.length > 0\`, so
+// the exit above already fired. (\`latest\` being empty is caught further up.)
+// \`rows\` likewise still contains unanchored pages' failing regions; they are
+// never printed because that same exit fires first. Both facts depend on the
+// exit staying ABOVE this line \u2014 a second filter here would be a second place
+// to keep in sync, which is how checkRun and next.mjs drifted apart to begin
+// with. If that exit ever moves, this becomes a TypeError.
+const worst = scored[0].p;
+rows.sort(
+  (a, b) =>
+    (a.page === worst ? -1 : 0) - (b.page === worst ? -1 : 0) || b.mm - a.mm,
+);
+
+console.log(
+  \`\\n\${openTotal} open failure(s) + \${floorTotal} declared floor(s).\`,
+);
+console.log(\`\\nNEXT: \${worst} \u2014 worst page. Its open regions:\\n\`);
+for (const r of rows.filter((r) => r.page === worst)) {
+  const why = [];
+  if (r.mm > THRESHOLD) why.push(\`pixels \${(r.mm * 100).toFixed(1)}%\`);
+  if (Math.abs(r.dh) > MAX_HEIGHT_DELTA)
+    why.push(\`height \${(r.dh * 100).toFixed(1)}%\`);
+  console.log(
+    \`  @\${String(r.vw).padEnd(5)} \${r.label.slice(0, 44).padEnd(45)} \${why.join(" + ")}\`,
+  );
+}
+// Only scripts the match-harness recipe INSTALLS may be named here: this is the
+// first thing an operator is told to run on a failing agenda, and on every site
+// but this one \`probe-anchor-parity.mjs\` (a site-specific probe, never shipped)
+// failed module-not-found \u2014 reddoorla/reddoor-maintenance#732, #767.
+console.log(\`\\nBefore treating any of these as geometry:\`);
+console.log(
+  \`  node matching/strikes.mjs \${worst}               # has it stalled? then change the MODEL\`,
+);
+console.log(
+  \`\\nRound continues. Do not hand back control with work outstanding.\`,
+);
+process.exit(1);
+`;
+var STRIKES_MJS_RELATIVE = "matching/strikes.mjs";
+var STRIKES_MJS_TEMPLATE = `// The 3-strike rule, made countable.
+//
+//   node matching/strikes.mjs [page]
+//
+// The matching skill says: "A region that has not improved after 3 fix ->
+// re-run cycles: stop. Present the three attempts. Do not widen the threshold,
+// mask it, or reclassify it \u2014 a stuck region means your model of it is wrong."
+//
+// That rule was blown twice on this project (services \`top\`, yfv \`top\`) purely
+// because nobody was counting. This reads every matching/out-*/report.json,
+// reconstructs each region's history in chronological order, and prints the
+// regions that are OUT OF STRIKES. Exit 1 when any exist, so a round that
+// starts by running this cannot quietly attempt a fourth cycle.
+//
+// WHAT THIS ACTUALLY MEASURES (read before trusting a number): report.json
+// cannot record INTENT, so a "cycle" here is any completed gate run in which
+// the region was still failing and did not improve by IMPROVE_PP. Runs aimed at
+// a different region on the same page therefore count too. That makes this a
+// STALL detector, not a literal attempt counter \u2014 "this has been failing,
+// unchanged, across N gate runs while you were working on this page." That is
+// the more useful discipline number anyway, and it is honest about being an
+// upper bound. Improvement resets the count: real progress earns a fresh start.
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { FLOORS, ACCEPTED } from "./floors.mjs";
+import {
+  DIR,
+  PAGES,
+  THRESHOLD,
+  MAX_HEIGHT_DELTA,
+  REPORT_SCHEMA,
+} from "./harness.mjs";
+
+// PAUSE SWITCH \u2014 see matching/next.mjs for why this is an exit code. Round
+// protocol step 1 is "run strikes.mjs; the stalled regions are the agenda", so
+// this is the second door into the backlog and has to be shut too. Exits 0:
+// there are no strikes to spend when no round is being played.
+//
+// DIR is harness.mjs's fileURLToPath'd directory, not URL#pathname: pathname
+// percent-encodes, so under a checkout path with a space this \`existsSync\` was
+// false and the pause switch failed OPEN \u2014 an agenda handed out mid-pause (#47).
+const PAUSED = join(DIR, "PAUSED");
+if (existsSync(PAUSED)) {
+  console.log("MATCHING PAUSED \u2014 no agenda, and none is to be inferred.\\n");
+  console.log(readFileSync(PAUSED, "utf8").trimEnd());
+  process.exit(0);
+}
+
+const IMPROVE_PP = 0.01; // 1 percentage point = the smallest move worth calling progress
+const MAX_STRIKES = 3;
+const only = process.argv[2] ?? null;
+
+// The gate key for a report, from its ref path. Deriving it by string surgery
+// disagreed with the gate on exactly six of the nine rows \u2014 yfv, contact, atd,
+// svc, qa and team (measured 2026-09-09 against harness.json); the table knows.
+// keyOf (below) stays as the fallback for a run whose ref was rewritten.
+const pageOf = (ref) => {
+  const path = new URL(ref).pathname.replace(/\\/$/, "") || "/";
+  return PAGES.find((p) => p.ref === path)?.key ?? null;
+};
+
+const runs = [];
+const unreadable = [];
+for (const dir of readdirSync(DIR).filter((d) => d.startsWith("out-"))) {
+  let report;
+  try {
+    report = JSON.parse(readFileSync(join(DIR, dir, "report.json"), "utf8"));
+  } catch {
+    continue; // not a completed run dir
+  }
+  if (!report.meta?.ref || !Array.isArray(report.regions)) continue;
+  // A report from another schema is still usable for a STALL count as long as
+  // it carries the two fields this reads. Anything else is counted and named,
+  // never silently dropped \u2014 an under-counted history reads as "clear".
+  const usable = report.regions.every(
+    (r) =>
+      typeof r.mismatchFraction === "number" && typeof r.pass === "boolean",
+  );
+  if (!usable) {
+    unreadable.push(\`\${dir} (schema \${report.meta.schemaVersion ?? 0})\`);
+    continue;
+  }
+  runs.push({
+    dir,
+    at: report.meta.generatedAt,
+    meta: report.meta,
+    regions: report.regions,
+  });
+}
+
+// The failure mode of a stall detector is always "clear", which is exactly the
+// answer that stops nobody. A corpus this could not read is not a clean one.
+if (runs.length === 0) {
+  console.error(
+    \`strikes: no parseable gate run under matching/ \u2014 refusing to report "clear".\` +
+      (unreadable.length
+        ? \`\\n         \${unreadable.length} report(s) unreadable at schema \${REPORT_SCHEMA}: \${unreadable.slice(0, 5).join(", ")}\`
+        : ""),
+  );
+  process.exit(2);
+}
+if (unreadable.length) {
+  console.error(
+    \`strikes: ignored \${unreadable.length} unreadable report(s) \u2014 the history below is incomplete.\` +
+      \`\\n         \${unreadable.slice(0, 5).join(", ")}\`,
+  );
+}
+
+runs.sort((a, b) => a.at.localeCompare(b.at));
+
+// The gate page KEY, recovered from the run dir the way next.mjs does it
+// (out-<TAG>-<page>, split on the first hyphen \u2014 the tag is hyphen-free by
+// gate.sh's own preflight). \`pageOf\` now returns that same key off the table,
+// so the two vocabularies agree and the round protocol in CLAUDE.md \u2014 "run
+// \`strikes.mjs <page>\` with the key you just passed to gate.sh", which until
+// 2026-08-13 silently matched nothing \u2014 works either way. This stays because
+// a dir key is not always a gate key: 69 of this corpus's 377 run dirs are
+// hand-named probes (out-band3, out-390masked), and FLOORS matches on it.
+const keyOf = (dir) => /^out-[^-]+-(.+)$/.exec(dir)?.[1] ?? null;
+
+// key -> chronological list of {dir, at, mm, pass, masked}
+const history = new Map();
+// Regions the OPERATOR accepted, by key \u2014 counted so the skip is visible, never
+// silent (next.mjs prints them under their own heading for the same reason).
+const acceptedKeys = new Set();
+for (const run of runs) {
+  const page = pageOf(run.meta.ref) ?? keyOf(run.dir) ?? "unknown";
+  const gateKey = keyOf(run.dir);
+  if (only && page !== only && gateKey !== only) continue;
+  for (const r of run.regions) {
+    // A DECLARED FLOOR is flat by definition \u2014 reporting it as stalled is noise
+    // that hides a real stall. It stays in the LEDGER; it does not belong here.
+    if (FLOORS.some((fl) => fl.match(r, gateKey || page))) continue;
+    const key = \`\${page}|\${r.viewport}|\${r.label}\`;
+    // An operator-ACCEPTED region will not move either \u2014 that is what accepting
+    // it meant \u2014 so it is flat by definition too. Left in, it tripped this
+    // detector on every run from the decision onward, and the one lever that
+    // silenced it was the reclassification rule 3 forbids: moving the entry to
+    // FLOORS (reddoorla/reddoor-maintenance#772).
+    if (ACCEPTED.some((a) => a.match(r, gateKey || page))) {
+      acceptedKeys.add(key);
+      continue;
+    }
+    if (!history.has(key)) history.set(key, []);
+    history.get(key).push({
+      dir: run.dir,
+      at: run.at,
+      mm: r.mismatchFraction,
+      dh: r.heightDeltaFraction,
+      pass: r.pass,
+      // a run with masks/neutralised media is not comparable to a clean one
+      dirty:
+        (run.meta.mask?.length ?? 0) > 0 ||
+        run.meta.neutralizeMedia ||
+        run.meta.maskPhotos,
+    });
+  }
+}
+
+// A name that matches no run must NOT report "clear". This check exists to stop
+// work on a stalled region, so failing open is the one thing it may never do \u2014
+// a typo'd or wrong-vocabulary page silently greened rule 3 for six of the nine
+// pages. Fail loud instead, and say what the vocabulary is \u2014 the TABLE's keys,
+// which is all a user should ever type. This used to list every name seen in
+// the corpus (pageOf AND keyOf of every run dir): 26 names on this site, of
+// which 9 were pages, 3 were a retired vocabulary each backed by one legacy run
+// that read as *clear*, and 14 were probe dirs. keyOf stays as the LOOKUP
+// fallback for exactly those dirs; it was never the vocabulary (#48).
+if (only && history.size === 0) {
+  console.error(
+    \`strikes: "\${only}" matches no gate run \u2014 refusing to report "clear".\\n\` +
+      \`         known pages: \${PAGES.map((p) => p.key).sort().join(", ")}\`,
+  );
+  process.exit(2);
+}
+
+if (acceptedKeys.size)
+  console.log(
+    \`strikes: \${acceptedKeys.size} region(s) skipped as operator-accepted (floors.mjs ACCEPTED).\`,
+  );
+
+const stuck = [];
+for (const [key, all] of history) {
+  const h = all.filter((e) => !e.dirty); // compare like with like
+  if (h.length === 0) continue;
+  const last = h[h.length - 1];
+  if (last.pass) continue;
+
+  let best = Infinity;
+  let strikes = 0;
+  let sinceIdx = 0;
+  for (let i = 0; i < h.length; i++) {
+    if (h[i].mm < best - IMPROVE_PP) {
+      best = Math.min(best, h[i].mm);
+      strikes = 0;
+      sinceIdx = i;
+    } else {
+      best = Math.min(best, h[i].mm);
+      strikes++;
+    }
+  }
+  if (strikes >= MAX_STRIKES) stuck.push({ key, strikes, h, sinceIdx, last });
+}
+
+// Triage order: the worst-matching region that has never moved is the one whose
+// model is most wrong. Sorting by strike count instead would put a 0.3% region
+// that only fails on height above a 76% region that fails on everything.
+stuck.sort((a, b) => b.last.mm - a.last.mm);
+
+if (stuck.length === 0) {
+  console.log(
+    \`strikes: clear \u2014 no failing region has stalled for \${MAX_STRIKES}+ gate runs\` +
+      (only ? \` on \${only}\` : "") +
+      ".",
+  );
+  process.exit(0);
+}
+
+const why = (e) => {
+  const reasons = [];
+  if (e.mm > THRESHOLD) reasons.push(\`pixels \${(e.mm * 100).toFixed(1)}%\`);
+  if (Math.abs(e.dh ?? 0) > MAX_HEIGHT_DELTA)
+    reasons.push(\`height \${((e.dh ?? 0) * 100).toFixed(1)}%\`);
+  return reasons.join(" + ") || "marginal";
+};
+
+console.log(
+  \`STALLED \u2014 \${stuck.length} failing region(s) have not moved in \${MAX_STRIKES}+ gate runs.\\n\` +
+    \`These need a new model or the operator, not another attempt. Worst first:\\n\`,
+);
+for (const { key, strikes, h, sinceIdx, last } of stuck.slice(0, 20)) {
+  const [page, vw, label] = key.split("|");
+  console.log(
+    \`\${page} @\${vw}  "\${label}"  \u2014 \${why(last)}, flat across \${strikes} runs\`,
+  );
+  const window = h.slice(Math.max(0, sinceIdx));
+  const shown = window.length > 4 ? [window[0], ...window.slice(-3)] : window;
+  for (const [i, e] of shown.entries()) {
+    const gap =
+      window.length > 4 && i === 1
+        ? \`    ... \${window.length - 4} more ...\\n\`
+        : "";
+    console.log(
+      gap +
+        \`    \${(e.mm * 100).toFixed(1).padStart(5)}%  \${e.at.slice(0, 16).replace("T", " ")}  \${e.dir}\`,
+    );
+  }
+  console.log();
+}
+if (stuck.length > 20) console.log(\`... and \${stuck.length - 20} more.\\n\`);
+console.log(
+  "Per the matching skill: present the attempts to the operator.\\n" +
+    "Do NOT widen the threshold, add a mask, or reclassify them as a floor.",
+);
+process.exit(1);
+`;
+var BUILD_SPEC_MJS_RELATIVE = "matching/build-spec.mjs";
+var BUILD_SPEC_MJS_TEMPLATE = `// Assemble matching/SPEC.md from the per-page sections in spec-sections/.
+//
+//   node matching/build-spec.mjs
+//
+// SPEC.md is the Phase 1 deliverable and the thing matching/gate.sh preflights
+// against, so it is GENERATED rather than hand-maintained: edit the section
+// file, rebuild. The page list comes from matching/harness.mjs (the same
+// reader gate.sh's \`--table\` loop uses) and the heading test from its
+// specHeadingRe, whose pattern is has_spec's grep verbatim \u2014 so a section can
+// no longer build fine here and then re-block its own page at the gate.
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+// DIR too: harness.mjs resolves it with fileURLToPath, and the URL#pathname
+// form this file used percent-encodes a space in the checkout path (#47).
+import { DIR, PAGES, specHeadingRe } from "./harness.mjs";
+
+const SECTIONS = join(DIR, "spec-sections");
+
+// Order = live's nav order, then the detail templates. Both fall out of the
+// table's own order within each group, so this is not a second list to keep.
+const KEYS = [
+  ...PAGES.filter((p) => p.group === "nav"),
+  ...PAGES.filter((p) => p.group !== "nav"),
+].map((p) => p.spec ?? p.key);
+
+const parts = [];
+const missing = [];
+
+const chrome = join(SECTIONS, "_chrome.md");
+if (existsSync(chrome)) parts.push(readFileSync(chrome, "utf8").trim());
+else missing.push("_chrome");
+
+for (const page of KEYS) {
+  const file = join(SECTIONS, \`\${page}.md\`);
+  if (!existsSync(file)) {
+    missing.push(page);
+    continue;
+  }
+  const body = readFileSync(file, "utf8").trim();
+  // The preflight greps \`^##+ +<page>\`; a section that does not open with its
+  // own key would build fine here and then refuse at the gate, which is the
+  // most confusing possible failure. Catch it now.
+  if (!specHeadingRe(page).test(body)) {
+    console.error(
+      \`WARNING: \${page}.md does not open with a '## \${page}' heading \u2014 gate.sh will still refuse this page.\`,
+    );
+  }
+  parts.push(body);
+}
+
+// The header is a spec-section like any other, so a site can say what a
+// citation looks like there and what its own ladders are. DEFAULT_HEADER is
+// what a site gets before it writes one: the two paragraphs that are true of
+// every project, and nothing that is not.
+const DEFAULT_HEADER = \`# Reference spec
+
+GENERATED by \\\`node matching/build-spec.mjs\\\` from \\\`matching/spec-sections/\\\`.
+Edit the section files, not this one.
+
+This is the Phase 1 deliverable of the \\\`matching-a-page\\\` skill and the
+precondition \\\`matching/gate.sh\\\` enforces: a page with no section here does not
+get a geometry round (see the matching rules in CLAUDE.md).
+
+\`;
+const headerFile = join(SECTIONS, "_header.md");
+const header = existsSync(headerFile)
+  ? readFileSync(headerFile, "utf8").trimEnd() + "\\n\\n"
+  : DEFAULT_HEADER;
+
+writeFileSync(join(DIR, "SPEC.md"), header + parts.join("\\n\\n---\\n\\n") + "\\n");
+
+const built = KEYS.length - missing.filter((m) => m !== "_chrome").length;
+console.log(
+  \`SPEC.md built \u2014 \${built}/\${KEYS.length} pages\${missing.length ? \`, MISSING: \${missing.join(", ")}\` : ""}\`,
+);
+process.exit(missing.length ? 1 : 0);
+`;
+var CENSUS_COUNT_MJS_RELATIVE = "matching/census-count.mjs";
+var CENSUS_COUNT_MJS_TEMPLATE = `// Count one style-census log, splitting declared deviations out of the total.
+//
+//   node matching/census-count.mjs matching/census-home-1440.log
+//   -> "<real> <ambiguous> <declared>"
+//
+// census.sh calls this per page/viewport. Parsing the log rather than importing
+// style-census keeps the project's declared-deviation policy out of the shared
+// skill \u2014 the skill reports what it sees; the project decides what it has
+// already agreed to.
+import { readFileSync } from "node:fs";
+import { DECLARED } from "./census-deviations.mjs";
+
+const path = process.argv[2];
+if (!path) {
+  console.error("usage: census-count.mjs <census log>");
+  process.exit(2);
+}
+
+// A log that cannot be READ is not a log with nothing IN it. This printed
+// "0 0 0" and exited 0, and census.sh added that to its total \u2014 the same green
+// it used to grant for a style-census that never ran. There is no count to
+// give here; say so and let the caller decide, which is never zero.
+let text = "";
+try {
+  text = readFileSync(path, "utf8");
+} catch (e) {
+  console.error(\`census-count: cannot read \${path} \u2014 \${e.message}\`);
+  console.error("              a missing log is not a census with no findings.");
+  process.exit(2);
+}
+
+const [head, tail = ""] = text.split("--- AMBIGUOUS");
+
+/** Pull \`{label, ref, cand}\` rows out of a census section. */
+function rows(section) {
+  const out = [];
+  const lines = section.split("\\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^ {2}y=/.test(lines[i])) continue;
+    const label = lines[i].replace(/^\\s*y=\\s*\\d+\\s*/, "").trim();
+    const refs = [];
+    const cands = [];
+    for (
+      let j = i + 1;
+      j < lines.length && /^ {4}(ref|cand):/.test(lines[j]);
+      j++
+    ) {
+      const v = lines[j].replace(/^\\s*(ref|cand):\\s*/, "").trim();
+      (lines[j].trim().startsWith("ref:") ? refs : cands).push(v);
+    }
+    if (refs.length && cands.length)
+      out.push({ label, ref: refs[0], cand: cands[0] });
+    else out.push({ label, ref: refs[0] ?? "", cand: cands[0] ?? "" });
+  }
+  return out;
+}
+
+const mism = rows(head);
+const amb = rows(tail);
+const declared = mism.filter((r) => DECLARED.some((d) => d.match(r)));
+console.log(
+  \`\${mism.length - declared.length} \${amb.length} \${declared.length}\`,
+);
+`;
+var HARNESS_JSON_RELATIVE = "matching/harness.json";
+var HARNESS_JSON_TEMPLATE = `{
+  "ref": "__REF__",
+  "cand": "http://localhost:5173",
+  "matrix": [
+    1440,
+    834,
+    390
+  ],
+  "threshold": 0.1,
+  "maxHeightDelta": 0.05,
+  "refMark": "",
+  "candMark": "_app/immutable",
+  "selfHosts": [],
+  "pages": {
+    "home": {
+      "uid": "home",
+      "ref": "/",
+      "cand": "/dev/match/home",
+      "published": "/",
+      "anchors": [],
+      "spec": "home",
+      "group": "nav"
+    }
+  }
+}
+`;
+var FLOORS_MJS_RELATIVE = "matching/floors.mjs";
+var FLOORS_MJS_TEMPLATE = `// The failures we have already established are NOT geometry. Shared by
+// next.mjs (which reports them separately from the backlog) and strikes.mjs
+// (which must not report them as stalled \u2014 a region that cannot move is flat
+// by definition, and three strikes on one is noise that hides a real stall).
+// Every entry needs a matching LEDGER entry to stay honest.
+//
+// NOTE the second matcher argument. Region records carry \`label\` and
+// \`viewport\` but not the page, so an entry keyed on label+viewport alone is
+// safe only where the label is unique site-wide. "top" is not \u2014 every page has
+// one \u2014 so such an entry would silently accept the \`top\` failure on EVERY page
+// and hide every real one. next.mjs and strikes.mjs pass the page key as the
+// second argument: take \`(r, page)\` unless you have checked the label.
+
+/** Reference behaviour we cannot reproduce (declared floors). */
+export const FLOORS = [];
+
+/** Regions the OPERATOR has looked at and chosen to leave failing. These are
+ *  not floors and are not silently dropped: next.mjs prints them under their
+ *  own heading with the decision, so the number never quietly improves. */
+export const ACCEPTED = [];
+`;
+var CENSUS_DEVIATIONS_MJS_RELATIVE = "matching/census-deviations.mjs";
+var CENSUS_DEVIATIONS_MJS_TEMPLATE = `// Style-census rows the OPERATOR has looked at and chosen to keep. Same
+// contract as matching/floors.mjs: nothing is hidden, everything is counted
+// under its own heading, and every entry needs a LEDGER entry to stay honest.
+//
+//   node matching/census-count.mjs <log>   -> "<real> <ambiguous> <declared>"
+//
+// Without this, \`census.sh\` can never reach zero and an "N remaining" figure
+// says nothing about how much work is left \u2014 one permanent decision is counted
+// once per page per viewport, so a single ACK can account for dozens of rows.
+
+/** A row is \`{ label, ref, cand }\`, each of ref/cand a "fam | wt | size | lh |
+ *  ls | transform | colour" tuple string. */
+export const DECLARED = [];
+`;
+var SPEC_CHROME_MD_RELATIVE = "matching/spec-sections/_chrome.md";
+var SPEC_CHROME_MD_TEMPLATE = `## shared chrome
+
+Site-wide furniture that renders identically on every page \u2014 header, footer, and
+anything else the per-page sections would otherwise restate. Phase 1 of the
+\`matching-a-page\` skill fills this in; until it does, this section is a
+placeholder and \`matching/SPEC.md\` has no shared-chrome contract to cite.
+`;
+var SPEC_HEADER_MD_RELATIVE = "matching/spec-sections/_header.md";
+var SPEC_HEADER_MD_TEMPLATE = `# Reference spec
+
+GENERATED by \`node matching/build-spec.mjs\` from \`matching/spec-sections/\`.
+Edit the section files, not this one.
+
+This is the Phase 1 deliverable of the \`matching-a-page\` skill and the
+precondition \`matching/gate.sh\` enforces: a page with no section here does not
+get a geometry round (see the matching rules in CLAUDE.md).
+`;
+var LEDGER_MD_RELATIVE = "matching/LEDGER.md";
+var LEDGER_MD_TEMPLATE = `# Deviations / masks / floors ledger
+
+Append-only, and written at the moment a decision is made \u2014 not reconstructed at
+the end of a round, when the reason has already been lost. An entry is never
+edited to be right: a later entry corrects an earlier one and says which.
+
+Every entry in \`matching/floors.mjs\` and \`matching/census-deviations.mjs\`, and
+every mask in \`matching/harness.json\`, needs a line here. Without one the gate
+has been quietly widened and nothing records who widened it, or why.
+
+- [deviation | floor | mask | a11y] \`<region or selector>\` \u2014 what differs, why
+  it is accepted, and the evidence: a spec citation, a census row, a gate run.
+`;
+var MATCH_ROUTE_SERVER_RELATIVE = "src/routes/dev/match/[uid]/+page.server.ts";
+var MATCH_ROUTE_SERVER_TEMPLATE = `import { error } from "@sveltejs/kit";
+import { dev } from "$app/environment";
+import { documents } from "$lib/site-pages.js";
+
+// Local matching surface: renders the assemblies in $lib/site-pages.js \u2014 the
+// same module a Prismic Migration API script publishes from (start from the
+// starter's scripts/import/migrate.example.ts; no \`reddoor-maint\` command does
+// this, the seed is per-site work) \u2014 so a fix made to pass a gate is a fix to
+// what ships. Not prerendered, SSR-on-demand, dev-only.
+export const prerender = false;
+
+// A migration script resolves images to asset ids (migration.createAsset);
+// here they only need a URL. Dimensions are nominal \u2014 slices size their own
+// image boxes in CSS.
+const devImg = (u: string) => ({
+  url: u,
+  alt: null,
+  copyright: null,
+  dimensions: { width: 1600, height: 1067 },
+  edit: { x: 0, y: 0, zoom: 1, background: "transparent" },
+  id: u,
+});
+
+export async function load({ params }) {
+  // FIRST statement: everything below reads fixtures that must not be reachable
+  // from a production build. The launch recipe asserts this route 404s on the
+  // deployed URL, with /dev/a11y-fixtures as the 200 control.
+  if (!dev) error(404, { message: "Not found" });
+
+  const docs = documents(devImg) as Array<{ uid: string; data: { slices?: unknown[] } }>;
+  const doc = docs.find((d) => d.uid === params.uid);
+  // The leading token is a MACHINE tell for the launch recipe's dev-guard. This
+  // 404 renders through the site's own +error.svelte exactly like a guarded
+  // route's does, so on a site whose uids lack "home" an UNGUARDED twin would
+  // pass the deployed check forever; the token is what tells the two apart.
+  // Reword the prose freely \u2014 the token is the contract (#719).
+  if (!doc)
+    error(404, {
+      message: \`reddoor-match-twin:no-assembly: no assembly for "\${params.uid}" (have: \${docs.map((d) => d.uid).join(", ") || "none"})\`,
+    });
+
+  return { uid: params.uid, slices: doc.data.slices ?? [] };
+}
+`;
+var MATCH_ROUTE_PAGE_RELATIVE = "src/routes/dev/match/[uid]/+page.svelte";
+var MATCH_ROUTE_PAGE_TEMPLATE = `<script lang="ts">
+  import { SliceZone } from "@prismicio/svelte";
+  import { components } from "$lib/slices";
+
+  let { data } = $props();
+</script>
+
+<SliceZone slices={data.slices as never} {components} />
+`;
+var SITE_PAGES_JS_RELATIVE = "src/lib/site-pages.js";
+var SITE_PAGES_JS_TEMPLATE = `// The page assemblies for this site \u2014 the SINGLE source of truth for both
+// consumers: a Prismic Migration API script, which publishes them (start from
+// the starter's scripts/import/migrate.example.ts \u2014 no \`reddoor-maint\` command
+// does this; the seed is per-site work), and src/routes/dev/match/[uid], the
+// local matching surface. Because both read from here, any fix made to pass a
+// gate is a fix to what ships.
+//
+// THE MIGRATION API DROPS SILENTLY. It validates against the slice models
+// registered in Prismic and discards every field the model does not declare \u2014
+// HTTP 200, no warning. A fixture field with no model behind it renders here and
+// vanishes on the published route. src/lib/site-pages.test.ts is the mechanical
+// check; run it before every seed.
+//
+// PURE by contract: no node:*, no fetch, no token, no side effects at import,
+// so Vite can bundle it into the dev route and node can import it into the seed.
+
+export const lang = "en-us";
+
+/**
+ * @param {(url: string) => unknown} img resolves an image URL to whatever the
+ *   caller needs \u2014 an asset \`{id}\` for the seed, a \`{url}\` for the dev route.
+ * @returns {Array<{type: string, uid: string, title: string, data: Record<string, unknown>}>}
+ */
+export function documents(img) {
+  void img;
+  return [];
+}
+`;
+var SITE_PAGES_TEST_RELATIVE = "src/lib/site-pages.test.ts";
+var SITE_PAGES_TEST_TEMPLATE = `// The page assemblies in src/lib/site-pages.js are the SINGLE source of truth
+// shared by two consumers: the local matching route (src/routes/dev/match/[uid])
+// and a Prismic Migration API script, which publishes them (start from the
+// starter's scripts/import/migrate.example.ts \u2014 no \`reddoor-maint\` command does
+// this; the seed is per-site work).
+//
+// Those two consumers do NOT validate the same way. The dev route hands the
+// object straight to the slice components, so any field a fixture sets is
+// simply there. The Migration API validates against the slice models registered
+// in Prismic and SILENTLY DROPS every field the model does not declare \u2014 no
+// error, no warning, a 200. A page can gate green locally and publish wrong.
+//
+// This test is the mechanical check. It fails the moment a fixture carries a
+// field its slice model does not declare \u2014 before the seed runs, not after the
+// content is published. Run it before every seed.
+import { describe, expect, it } from "vitest";
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { documents } from "./site-pages.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SLICES = join(HERE, "slices");
+
+type Variation = { primary: string[]; items: string[] };
+type Slice = {
+  slice_type: string;
+  variation: string;
+  primary?: Record<string, unknown>;
+  items?: Array<Record<string, unknown>>;
+};
+
+/** Every slice model in src/lib/slices, indexed by its Prismic slice id. */
+function loadModels(): Record<string, Record<string, Variation>> {
+  const out: Record<string, Record<string, Variation>> = {};
+  if (!existsSync(SLICES)) return out;
+  for (const dir of readdirSync(SLICES)) {
+    const file = join(SLICES, dir, "model.json");
+    if (!existsSync(file)) continue;
+    const model = JSON.parse(readFileSync(file, "utf8"));
+    out[model.id] = Object.fromEntries(
+      (model.variations ?? []).map((v: Record<string, unknown>) => [
+        v.id,
+        {
+          primary: Object.keys((v.primary as object) ?? {}),
+          items: Object.keys((v.items as object) ?? {}),
+        },
+      ]),
+    );
+  }
+  return out;
+}
+
+/** Image resolver stub \u2014 shape only; this test never reads image values. */
+const stubImg = () => ({ url: "https://example.test/x.jpg" });
+
+describe("site-pages documents vs slice models", () => {
+  const models = loadModels();
+  const docs = documents(stubImg) as Array<{ uid: string; data: { slices?: Slice[] } }>;
+  const pages: Array<[string, Slice[]]> = docs.map((d) => [d.uid, d.data.slices ?? []]);
+
+  it("declares every slice type the documents use", () => {
+    const missing = new Set<string>();
+    for (const [, slices] of pages)
+      for (const s of slices) if (!models[s.slice_type]) missing.add(s.slice_type);
+    expect([...missing]).toEqual([]);
+  });
+
+  it("declares every variation the documents use", () => {
+    const missing: string[] = [];
+    for (const [uid, slices] of pages)
+      for (const s of slices) {
+        const model = models[s.slice_type];
+        if (model && !model[s.variation]) missing.push(\`\${uid}: \${s.slice_type}/\${s.variation}\`);
+      }
+    expect(missing).toEqual([]);
+  });
+
+  // The one that catches a silent Migration-API drop.
+  it("declares every field the documents set, so Prismic strips nothing", () => {
+    const stripped: string[] = [];
+    for (const [uid, slices] of pages)
+      for (const s of slices) {
+        const variation = models[s.slice_type]?.[s.variation];
+        if (!variation) continue;
+        for (const key of Object.keys(s.primary ?? {}))
+          if (!variation.primary.includes(key))
+            stripped.push(\`\${uid} \${s.slice_type}/\${s.variation} primary.\${key}\`);
+        const itemKeys = new Set((s.items ?? []).flatMap((i) => Object.keys(i)));
+        for (const key of itemKeys)
+          if (!variation.items.includes(key))
+            stripped.push(\`\${uid} \${s.slice_type}/\${s.variation} items.\${key}\`);
+      }
+    expect(stripped).toEqual([]);
+  });
+});
+`;
+var MATCH_HARNESS_FILES = [
+  { rel: HARNESS_MJS_RELATIVE, template: HARNESS_MJS_TEMPLATE, owner: "recipe" },
+  { rel: GATE_SH_RELATIVE, template: GATE_SH_TEMPLATE, owner: "recipe" },
+  { rel: CENSUS_SH_RELATIVE, template: CENSUS_SH_TEMPLATE, owner: "recipe" },
+  { rel: NEXT_MJS_RELATIVE, template: NEXT_MJS_TEMPLATE, owner: "recipe" },
+  { rel: STRIKES_MJS_RELATIVE, template: STRIKES_MJS_TEMPLATE, owner: "recipe" },
+  { rel: BUILD_SPEC_MJS_RELATIVE, template: BUILD_SPEC_MJS_TEMPLATE, owner: "recipe" },
+  { rel: CENSUS_COUNT_MJS_RELATIVE, template: CENSUS_COUNT_MJS_TEMPLATE, owner: "recipe" },
+  { rel: HARNESS_JSON_RELATIVE, template: HARNESS_JSON_TEMPLATE, owner: "site" },
+  { rel: FLOORS_MJS_RELATIVE, template: FLOORS_MJS_TEMPLATE, owner: "site" },
+  { rel: CENSUS_DEVIATIONS_MJS_RELATIVE, template: CENSUS_DEVIATIONS_MJS_TEMPLATE, owner: "site" },
+  { rel: SPEC_CHROME_MD_RELATIVE, template: SPEC_CHROME_MD_TEMPLATE, owner: "site" },
+  { rel: SPEC_HEADER_MD_RELATIVE, template: SPEC_HEADER_MD_TEMPLATE, owner: "site" },
+  { rel: LEDGER_MD_RELATIVE, template: LEDGER_MD_TEMPLATE, owner: "site" },
+  { rel: MATCH_ROUTE_SERVER_RELATIVE, template: MATCH_ROUTE_SERVER_TEMPLATE, owner: "recipe" },
+  { rel: MATCH_ROUTE_PAGE_RELATIVE, template: MATCH_ROUTE_PAGE_TEMPLATE, owner: "recipe" },
+  { rel: SITE_PAGES_JS_RELATIVE, template: SITE_PAGES_JS_TEMPLATE, owner: "site" },
+  { rel: SITE_PAGES_TEST_RELATIVE, template: SITE_PAGES_TEST_TEMPLATE, owner: "recipe" }
+];
+var HARNESS_MJS_PREV_0_95_0 = `// The single source for everything the matching gates need to know about this
+// site. DATA lives in matching/harness.json (site-edited); this file is the
+// READ LAYER \u2014 edit harness.json, not this. (It is installed and upgraded by
+// the \`reddoor-maint match-harness\` recipe, which owns these bytes: a hand
+// edit here is flagged on the next run and never silently overwritten.)
+//
+// It exists because the page table, the two hosts, the matrix, the threshold
+// and the skill path were hand-copied all over matching/. Re-measured
+// 2026-09-09 AFTER the six-probe conversion, over the 216 tracked scripts under
+// matching/ (214 top-level \u2014 212 .mjs + 2 .sh \u2014 plus 2 in states/):
+//
+//   \u2022 a hand-typed copy of the page table (three or more gate keys sitting next
+//     to their route): 8 files. Exactly ONE of them, probe-chrome-count.mjs,
+//     still carries all nine rows; probe-anchors.mjs carries five; the other
+//     six are three-row detail triples (team/svc/qa).
+//   \u2022 the skill path (~/.claude/skills/matching-a-page): 193 copies
+//   \u2022 the viewport matrix (1440/834/390): 51 copies
+//   \u2022 REF pointed at a host listed in selfHosts \u2014 i.e. comparing the candidate
+//     with itself: 12 scripts, one of which (probe-chrome-count.mjs) is also
+//     the last nine-row table carrier
+//
+// The first bullet read "the nine-row page table: 5 copies \u2014 gate.sh,
+// probe-anchor-parity.mjs, sweep-all10.sh, sweep-all16.sh, sweep-final.sh" when
+// it was written here at 922dde3. It was wrong within the hour and wrong on two
+// counts: 4e2cd7b took the table out of gate.sh, and the list never named
+// states/index.mjs or probe-chrome-count.mjs, which were both carrying nine-row
+// copies at the time. A census is a claim about code; it has to be measured
+// against the tree, not recalled.
+//
+//   node matching/harness.mjs --env        shell-safe KEY='value' lines
+//   node matching/harness.mjs --table      key<TAB>ref<TAB>cand<TAB>anchors
+//   node matching/harness.mjs --check-ref  the D11 preflight; exit 2 on failure
+import { readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// fileURLToPath, not URL#pathname: pathname is percent-encoded, so a checkout
+// under a directory with a space in it would resolve to a path that does not
+// exist.
+const DIR = fileURLToPath(new URL(".", import.meta.url));
+const CFG = JSON.parse(readFileSync(join(DIR, "harness.json"), "utf8"));
+
+// Env overrides exist for one-off probes only. They are NOT how a site is
+// configured \u2014 harness.json is, so that what a gate ran against is committed.
+export const REF = process.env.MATCH_REF ?? CFG.ref;
+export const CAND = process.env.MATCH_CAND ?? process.env.CAND_BASE ?? CFG.cand;
+export const MATRIX = CFG.matrix;
+export const THRESHOLD = CFG.threshold;
+export const MAX_HEIGHT_DELTA = CFG.maxHeightDelta;
+export const REF_MARK = CFG.refMark;
+export const CAND_MARK = CFG.candMark;
+export const SELF_HOSTS = CFG.selfHosts ?? [];
+
+/** One record per gated page, in harness.json order. \`key\` is the gate key
+ *  (out-<TAG>-<key>, the SPEC heading, spec-sections/<key>.md); \`uid\` is the
+ *  Prismic uid or null where the page has no /dev/match twin. */
+export const PAGES = Object.entries(CFG.pages).map(([key, p]) => ({ key, ...p }));
+export const byKey = Object.fromEntries(PAGES.map((p) => [p.key, p]));
+
+// DERIVED, never hand-typed: page-diff cuts one region before the first anchor
+// ("top") plus one per anchor, at every viewport. The old hand-written map went
+// stale the moment an anchor list changed, and a wrong denominator makes the
+// score a lie in the flattering direction.
+export const TOTALS = Object.fromEntries(
+  PAGES.map((p) => [p.key, (p.anchors.length + 1) * MATRIX.length]),
+);
+
+/** The SPEC.md heading predicate, shared by gate.sh's preflight and
+ *  build-spec.mjs so a section can never build fine and then refuse at the
+ *  gate. Matches the key followed by any non-key character (\`## team\` matches,
+ *  \`## teamfoo\` does not, \`## our-team\` cannot match \`team\`). */
+export const specHeadingRe = (key) => new RegExp(\`^##+ +\${key}([^A-Za-z0-9_-]|$)\`, "m");
+
+export const SKILL_DIR =
+  process.env.MATCHING_SKILL_DIR ?? join(homedir(), ".claude/skills/matching-a-page");
+export const PD = join(SKILL_DIR, "page-diff.mjs");
+export const SC = join(SKILL_DIR, "style-census.mjs");
+export const PLAYWRIGHT = pathToFileURL(join(SKILL_DIR, "node_modules/playwright/index.mjs")).href;
+
+/** The report format this site's scripts can read, so gate.sh can compare it
+ *  with \`page-diff --version\` before spending a run and next.mjs can refuse
+ *  rather than quietly drop a page whose newest report came from another
+ *  schema. Both do that now \u2014 gate.sh preflights \`page-diff --version\` against
+ *  this value before spending a run, and next.mjs counts a foreign-schema
+ *  report as MISSING rather than skipping it. (This said "neither does that
+ *  yet" \u2014 true at 922dde3 where it was written, false from 4e2cd7b, which
+ *  gave gate.sh the preflight and did not come back here.) Checked 2026-09-09
+ *  against the installed skill: \`page-diff --version\` \u2192 \`page-diff 0.1.0
+ *  report-schema 1\`. */
+export const REPORT_SCHEMA = 1;
+
+/**
+ * Fail-closed reference preflight. A 200 is NOT evidence: a host that has been
+ * repointed at our own build answers 200, and so does a staging host serving a
+ * 404 page. Both have happened on a real site \u2014 see the dated measurement in
+ * LEDGER.md. A pass here requires an artefact only the reference produces.
+ */
+export async function checkRef() {
+  if (!REF_MARK) {
+    return {
+      ok: false,
+      why: "harness.json refMark is empty \u2014 set it to a string only the reference serves (a Webflow site id, a build hash). A 200 is not evidence.",
+    };
+  }
+  const host = new URL(REF).host;
+  if (SELF_HOSTS.includes(host)) return { ok: false, why: \`REF host \${host} is in selfHosts\` };
+  if (host === new URL(CAND).host) return { ok: false, why: \`REF host \${host} equals CAND's host\` };
+  let res;
+  try {
+    res = await fetch(\`\${REF}/\`, { redirect: "manual" });
+  } catch (e) {
+    return { ok: false, why: \`GET \${REF}/ failed: \${e.message}\` };
+  }
+  if (res.status !== 200)
+    return { ok: false, why: \`GET \${REF}/ \u2192 HTTP \${res.status}, expected 200\` };
+  const loc = res.headers.get("location");
+  if (loc) return { ok: false, why: \`GET \${REF}/ \u2192 \${res.status} redirect to \${loc}\` };
+  const body = await res.text();
+  if (!body.includes(REF_MARK))
+    return {
+      ok: false,
+      why: \`\${REF}/ served 200 but WITHOUT refMark \${JSON.stringify(REF_MARK)} \u2014 that is not the reference\`,
+    };
+  if (CAND_MARK && body.includes(CAND_MARK))
+    return {
+      ok: false,
+      why: \`\${REF}/ contains candMark \${JSON.stringify(CAND_MARK)} \u2014 REF is serving OUR build\`,
+    };
+  return { ok: true, why: \`\${REF}/ \u2192 200, no redirect, refMark present, candMark absent\` };
+}
+
+// CLI. Both sides go through realpathSync. \`import.meta.url\` is ALREADY the
+// resolved real path (node resolves symlinks unless --preserve-symlinks) while
+// process.argv[1] is the path as typed, so a plain pathToFileURL compare goes
+// false the moment any component of the invoked path is a symlink \u2014 and then
+// the CLI prints nothing and exits 0, which every caller reads as success.
+// page-diff.mjs:184-189 records exactly that defect and the same fix: "The
+// pathToFileURL compare that replaced the old template string is still false
+// whenever ANY component of the invoked path is a symlink \u2014 which is how this
+// skill is installed now (~/.claude/skills/matching-a-page -> the claude-skills
+// checkout). isMain() resolves the real path on both sides."
+const isMain = () => {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+};
+
+if (isMain()) {
+  const mode = process.argv[2];
+  const q = (v) => \`'\${String(v).replace(/'/g, \`'\\\\''\`)}'\`;
+  if (mode === "--env") {
+    const pairs = [
+      ["REF", REF],
+      ["CAND", CAND],
+      ["MATRIX", MATRIX.join(",")],
+      ["VIEWPORTS_SP", MATRIX.join(" ")],
+      ["THRESHOLD", THRESHOLD],
+      ["MAX_HEIGHT_DELTA", MAX_HEIGHT_DELTA],
+      ["PD", PD],
+      ["SC", SC],
+      ["REPORT_SCHEMA", REPORT_SCHEMA],
+    ];
+    for (const [k, v] of pairs) console.log(\`\${k}=\${q(v)}\`);
+  } else if (mode === "--table") {
+    for (const p of PAGES) console.log([p.key, p.ref, p.cand, p.anchors.join(",")].join("\\t"));
+  } else if (mode === "--check-ref") {
+    const r = await checkRef();
+    console.log(\`\${r.ok ? "REF OK" : "REF REFUSED"} \u2014 \${r.why}\`);
+    process.exit(r.ok ? 0 : 2);
+  } else {
+    console.error("usage: harness.mjs --env | --table | --check-ref");
+    process.exit(2);
+  }
+}
+`;
+var GATE_SH_PREV_0_95_0 = `#!/usr/bin/env bash
+# The matching gate. This file is generic \u2014 everything specific to a site lives
+# in matching/harness.json (the data) and matching/LEDGER.md (the why). It is
+# installed and upgraded by the \`reddoor-maint match-harness\` recipe, which
+# owns these bytes: a hand edit here is flagged on the next run, never
+# silently overwritten.
+#
+#   bash matching/gate.sh <round-tag> [page ...]
+#
+# Runs page-diff for every page in the table (or just the named ones) at the
+# full breakpoint matrix and writes matching/out-<round-tag>-<page>/.
+#
+# The matrix, the anchor lists, the reference and the candidate are DATA. Why a
+# site chose them \u2014 which live breakpoint band hid what, why an anchor is a
+# heading and not a button label \u2014 belongs in matching/LEDGER.md, which is dated
+# and append-only, because JSON holds no comments.
+#
+# NO MASKS and the threshold from harness.json everywhere: the numbers stay
+# honest and a known floor stays visible as its own region. A media-neutralised
+# secondary read is \`node "$PD" ... --neutralize-media\`; next.mjs ignores such
+# runs on purpose (next.mjs:57-64).
+#
+# PREFLIGHT (see the matching rules in CLAUDE.md): a page with no section in
+# matching/SPEC.md has not had Phase 1 done, and its geometry must not be
+# touched. Skipping the spec is how a reference's root-font ladder and its
+# per-component height ladders get found reactively, after the region has
+# already failed several rounds. This refuses the run instead of trusting anyone
+# to remember.
+set -u
+# Everything configurable lives in matching/harness.json; harness.mjs is the one
+# reader. --env emits shell-safe assignments (REF, CAND, MATRIX, VIEWPORTS_SP,
+# THRESHOLD, MAX_HEIGHT_DELTA, PD, SC, REPORT_SCHEMA).
+eval "$(node "$(dirname "$0")/harness.mjs" --env)"
+
+# The skill must be able to write reports this site's scripts can read. Cheap,
+# local, and it fails before any browser starts.
+PD_SCHEMA="$(node "$PD" --version 2>/dev/null | awk '{print $4}')"
+if [ "$PD_SCHEMA" != "$REPORT_SCHEMA" ]; then
+  echo "gate.sh: page-diff writes report schema '\${PD_SCHEMA:-none}', this harness reads $REPORT_SCHEMA." >&2
+  echo "         Update matching/harness.mjs REPORT_SCHEMA or the matching-a-page skill." >&2
+  exit 2
+fi
+SPEC="$(dirname "$0")/SPEC.md"
+TAG="\${1:?usage: gate.sh <round-tag> [page ...]}"
+# The tag must not contain a hyphen. Output dirs are "out-<TAG>-<page>", and
+# next.mjs recovers the page with /^out-[^-]+-(.+)$/ \u2014 it splits on the FIRST
+# hyphen, so a tag like "r-forms-2026-08-07" yields the page key
+# "forms-2026-08-07-yfv" and that run is silently never counted. It cannot split
+# on the last hyphen instead, because page keys have hyphens of their own
+# ("our-team", "ask-the-doctor"). Failing here is the cheap end of that: a
+# mis-tagged round otherwise LOOKS green because next.mjs keeps reading an older
+# report for the page you just changed. (Cost this once, 2026-08-07.)
+case "$TAG" in
+  *-*)
+    echo "gate.sh: round tag must not contain a hyphen (got '$TAG')." >&2
+    echo "         out-<TAG>-<page> is parsed on the first hyphen, so a" >&2
+    echo "         hyphenated tag hides the run from next.mjs. Try '\${TAG//-/}'." >&2
+    exit 2
+    ;;
+esac
+shift || true
+WANT=("$@")
+
+# Fail closed on the reference before spending a single run. A 200 is NOT
+# evidence: a production host that has cut over to OUR build answers 200, and
+# every region then scores near zero against itself. --check-ref requires an
+# artefact only the reference serves (harness.json refMark) and refuses a
+# redirect, a host listed in selfHosts, and a body carrying candMark. Measured
+# on the site this harness was cut from, 2026-09-09 AFTER the consolidation:
+# 12 of its 214 top-level matching scripts still assign REF a host listed in
+# selfHosts \u2014 i.e. compare the candidate with itself. It was 33 of 229 before.
+# (This comment read "33 of its 230" while sitting in the post-consolidation
+# tree, contradicting harness.mjs's 12 three files away.)
+if ! node "$(dirname "$0")/harness.mjs" --check-ref; then
+  echo "gate.sh: refusing to gate against an unverified reference." >&2
+  exit 2
+fi
+
+# Set SPEC_OPTIONAL=1 only for a read-only baseline sweep of pages you are not
+# about to edit. It is recorded in the round tag so the exemption is visible.
+SPEC_OPTIONAL="\${SPEC_OPTIONAL:-0}"
+
+has_spec() { # page
+  # NB: the obvious \`( |$|\\b)\` guard is rejected by ugrep as an empty
+  # subexpression, and a preflight that errors out fails CLOSED \u2014 it refused all
+  # 9 pages while SPEC.md was complete. Match the page key followed by any
+  # non-key character (so \`## team\` matches but \`## teamfoo\` does not; \`##
+  # our-team\` cannot match \`team\` because the key must follow the spaces).
+  [ -f "$SPEC" ] && grep -qE "^##+ +$1([^A-Za-z0-9_-]|$)" "$SPEC"
+}
+
+run() { # tag refpath candpath sections
+  local page="$1" refpath="$2" candpath="$3" sections="$4"
+  if [ \${#WANT[@]} -gt 0 ]; then
+    local hit=0
+    for w in "\${WANT[@]}"; do [ "$w" = "$page" ] && hit=1; done
+    [ $hit -eq 1 ] || return 0
+  fi
+  if ! has_spec "$page"; then
+    if [ "$SPEC_OPTIONAL" = "1" ]; then
+      echo "########## $page ##########"
+      echo "WARNING: no '## $page' section in matching/SPEC.md \u2014 Phase 1 not done."
+      echo "         Running anyway because SPEC_OPTIONAL=1 (baseline read only)."
+      echo "         Do NOT apply geometry fixes off this run."
+    else
+      echo "########## $page ##########"
+      echo "REFUSED: no '## $page' section in matching/SPEC.md."
+      echo "         Phase 1 (section census + per-section spec, read from"
+      echo "         matching/spec/) comes before geometry."
+      echo "         See CLAUDE.md rule 2. SPEC_OPTIONAL=1 for a baseline read."
+      FAILED_PREFLIGHT=1
+      return 0
+    fi
+  fi
+  echo "########## $page ##########"
+  node "$PD" --ref "$REF$refpath" --cand "$CAND$candpath" \\
+    --viewports "$MATRIX" --threshold "$THRESHOLD" \\
+    --sections "$sections" --out "matching/out-$TAG-$page" \\
+    > "matching/out-$TAG-$page.log" 2>&1
+  echo "$page exit=$?"
+}
+
+# The page table is matching/harness.json. Process substitution, NOT a pipe:
+# a pipe would run this loop in a subshell and FAILED_PREFLIGHT would not
+# survive to the check below, so a refused page would exit 0.
+while IFS=$'\\t' read -r key refpath candpath anchors; do
+  run "$key" "$refpath" "$candpath" "$anchors"
+done < <(node "$(dirname "$0")/harness.mjs" --table)
+
+if [ "\${FAILED_PREFLIGHT:-0}" = "1" ]; then
+  echo
+  echo "GATE INCOMPLETE ($TAG) \u2014 one or more pages were refused for a missing"
+  echo "SPEC.md section. Those pages have NOT been measured; do not report a"
+  echo "score for them."
+  exit 2
+fi
+echo "ALL DONE ($TAG)"
+`;
+var NEXT_MJS_PREV_0_95_0 = `// What is still broken, ranked. Exits 1 while work remains.
+//
+//   node matching/next.mjs
+//
+// Round protocol step 0 (repo CLAUDE.md rule 5). A commit is a CHECKPOINT, not
+// a stopping point: after committing, run this. If it exits 1 there is a named
+// next action and the round continues without handing control back.
+//
+// Reads the most recent gate log per page rather than the whole corpus, so it
+// reflects HEAD rather than history (that is strikes.mjs's job).
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+const DIR = new URL(".", import.meta.url).pathname;
+
+// PAUSE SWITCH. While matching/PAUSED exists this hands out no agenda and
+// exits 0. It is deliberately the FIRST thing that runs: no report is read, no
+// score is printed, nothing tempting is put on screen to argue with.
+//
+// Why an exit code and not a note somewhere: rule 5 is a LOOP \u2014 "after
+// committing, run next.mjs; while it exits 1 there is a named next action and
+// the round continues". A pause written as prose loses to that loop, because
+// the loop is mechanical and the prose is not. Exiting 0 satisfies rule 5
+// truthfully rather than suspending it: there is no next action.
+const PAUSE = join(DIR, "PAUSED");
+if (existsSync(PAUSE)) {
+  console.log("MATCHING PAUSED \u2014 no agenda, and none is to be inferred.\\n");
+  console.log(readFileSync(PAUSE, "utf8").trimEnd());
+  process.exit(0);
+}
+
+import { FLOORS, ACCEPTED } from "./floors.mjs";
+import { TOTALS, THRESHOLD, MAX_HEIGHT_DELTA, REPORT_SCHEMA } from "./harness.mjs";
+
+// Reports written by a different page-diff, by page key. Kept rather than
+// dropped: silently ignoring them is how a page vanishes from the score.
+const schemaMismatch = new Set();
+
+const latest = new Map();
+for (const d of readdirSync(DIR).filter((d) => d.startsWith("out-"))) {
+  const m = /^out-[^-]+-(.+)$/.exec(d);
+  if (!m || !TOTALS[m[1]]) continue;
+  let report, mtime;
+  try {
+    const p = join(DIR, d, "report.json");
+    report = JSON.parse(readFileSync(p, "utf8"));
+    mtime = statSync(p).mtimeMs;
+  } catch {
+    continue;
+  }
+  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the
+  // page. Picking one up as "latest" silently reports scores nobody can ship \u2014
+  // it happened immediately: an --mask-photos probe of yfv made \`top\` @834 read
+  // 43.9% here while the real gate had it passing at 1.3%.
+  const meta = report.meta ?? {};
+  // Missing schemaVersion means "written before the field existed" = 0. It is
+  // not an error on its own; it is only fatal when it would blank a page.
+  if ((meta.schemaVersion ?? 0) !== REPORT_SCHEMA) {
+    schemaMismatch.add(m[1]);
+    continue;
+  }
+  if (
+    (meta.mask?.length ?? 0) > 0 ||
+    meta.neutralizeMedia ||
+    meta.maskPhotos ||
+    meta.truncated
+  )
+    continue;
+  if (meta.threshold !== THRESHOLD) continue;
+  const prev = latest.get(m[1]);
+  if (!prev || mtime > prev.mtime) latest.set(m[1], { dir: d, mtime, report });
+}
+
+const blanked = [...schemaMismatch].filter((p) => !latest.has(p));
+if (blanked.length) {
+  console.error(
+    \`next: \${blanked.length} page(s) have no run at report schema \${REPORT_SCHEMA} \u2014 \` +
+      \`their newest reports came from a different page-diff (\${blanked.sort().join(", ")}).\\n\` +
+      \`      Re-run: bash matching/gate.sh <tag> \${blanked.sort().join(" ")}\`,
+  );
+  process.exit(2);
+}
+if (latest.size === 0) {
+  console.error(
+    "next: no parseable gate run under matching/ \u2014 refusing to report a score.\\n" +
+      "      Run bash matching/gate.sh <tag> first.",
+  );
+  process.exit(2);
+}
+
+const rows = [];
+const accepted = [];
+let openTotal = 0;
+let floorTotal = 0;
+for (const [page, { dir, report }] of latest) {
+  const fails = report.regions.filter((r) => !r.pass);
+  for (const f of fails) {
+    const floor = FLOORS.find((fl) => fl.match(f, page));
+    if (floor) {
+      floorTotal++;
+      continue;
+    }
+    const ack = ACCEPTED.find((a) => a.match(f, page));
+    if (ack) {
+      accepted.push({ page, vw: f.viewport, label: f.label, why: ack.why });
+      continue;
+    }
+    openTotal++;
+    rows.push({
+      page,
+      vw: f.viewport,
+      label: f.label,
+      mm: f.mismatchFraction,
+      dh: f.heightDeltaFraction ?? 0,
+      dir,
+    });
+  }
+}
+
+const scored = [...latest.entries()]
+  .map(([p, v]) => ({
+    p,
+    pass: v.report.regions.filter((r) => r.pass).length,
+    total: TOTALS[p],
+  }))
+  .sort((a, b) => a.pass / a.total - b.pass / b.total);
+
+const sum = scored.reduce((a, s) => a + s.pass, 0);
+const max = scored.reduce((a, s) => a + s.total, 0);
+console.log(\`SCORE \${sum}/\${max} regions passing\\n\`);
+console.log(
+  scored
+    .map((s) => \`  \${s.p.padEnd(9)} \${String(s.pass).padStart(2)}/\${s.total}\`)
+    .join("\\n"),
+);
+
+if (accepted.length) {
+  console.log(\`\\nOperator-ACCEPTED failures (left failing on purpose):\`);
+  for (const a of accepted)
+    console.log(\`  \${a.page} @\${a.vw} "\${a.label}" \u2014 \${a.why.slice(0, 96)}\u2026\`);
+}
+
+if (!rows.length) {
+  console.log(
+    \`\\nNo open geometry failures. \${floorTotal} declared floor(s) remain.\`,
+  );
+  console.log(
+    "Backlog is empty \u2014 Phases 5 (states) and 6 (adversarial review) are what is left.",
+  );
+  process.exit(0);
+}
+
+// Worst page first, then worst region inside it: fix where the model is most wrong.
+const worst = scored[0].p;
+rows.sort(
+  (a, b) =>
+    (a.page === worst ? -1 : 0) - (b.page === worst ? -1 : 0) || b.mm - a.mm,
+);
+
+console.log(
+  \`\\n\${openTotal} open failure(s) + \${floorTotal} declared floor(s).\`,
+);
+console.log(\`\\nNEXT: \${worst} \u2014 worst page. Its open regions:\\n\`);
+for (const r of rows.filter((r) => r.page === worst)) {
+  const why = [];
+  if (r.mm > THRESHOLD) why.push(\`pixels \${(r.mm * 100).toFixed(1)}%\`);
+  if (Math.abs(r.dh) > MAX_HEIGHT_DELTA)
+    why.push(\`height \${(r.dh * 100).toFixed(1)}%\`);
+  console.log(
+    \`  @\${String(r.vw).padEnd(5)} \${r.label.slice(0, 44).padEnd(45)} \${why.join(" + ")}\`,
+  );
+}
+console.log(\`\\nBefore treating any of these as geometry:\`);
+console.log(
+  \`  node matching/probe-anchor-parity.mjs \${worst}   # is the gate cutting comparably?\`,
+);
+console.log(
+  \`  node matching/strikes.mjs \${worst}               # has it stalled? then change the MODEL\`,
+);
+console.log(
+  \`\\nRound continues. Do not hand back control with work outstanding.\`,
+);
+process.exit(1);
+`;
+var HARNESS_MJS_PREV_0_95_1 = `// The single source for everything the matching gates need to know about this
+// site. DATA lives in matching/harness.json (site-edited); this file is the
+// READ LAYER \u2014 edit harness.json, not this. (It is installed and upgraded by
+// the \`reddoor-maint match-harness\` recipe, which owns these bytes: a hand
+// edit here is flagged on the next run and never silently overwritten.)
+//
+// It exists because the page table, the two hosts, the matrix, the threshold
+// and the skill path were hand-copied all over matching/. Re-measured
+// 2026-09-09 AFTER the six-probe conversion, over the 216 tracked scripts under
+// matching/ (214 top-level \u2014 212 .mjs + 2 .sh \u2014 plus 2 in states/):
+//
+//   \u2022 a hand-typed copy of the page table (three or more gate keys sitting next
+//     to their route): 8 files. Exactly ONE of them, probe-chrome-count.mjs,
+//     still carries all nine rows; probe-anchors.mjs carries five; the other
+//     six are three-row detail triples (team/svc/qa).
+//   \u2022 the skill path (~/.claude/skills/matching-a-page): 193 copies
+//   \u2022 the viewport matrix (1440/834/390): 51 copies
+//   \u2022 REF pointed at a host listed in selfHosts \u2014 i.e. comparing the candidate
+//     with itself: 12 scripts, one of which (probe-chrome-count.mjs) is also
+//     the last nine-row table carrier
+//
+// The first bullet read "the nine-row page table: 5 copies \u2014 gate.sh,
+// probe-anchor-parity.mjs, sweep-all10.sh, sweep-all16.sh, sweep-final.sh" when
+// it was written here at 922dde3. It was wrong within the hour and wrong on two
+// counts: 4e2cd7b took the table out of gate.sh, and the list never named
+// states/index.mjs or probe-chrome-count.mjs, which were both carrying nine-row
+// copies at the time. A census is a claim about code; it has to be measured
+// against the tree, not recalled.
+//
+//   node matching/harness.mjs --env        shell-safe KEY='value' lines
+//   node matching/harness.mjs --table      key<TAB>ref<TAB>cand<TAB>anchors
+//   node matching/harness.mjs --check-ref  the D11 preflight; exit 2 on failure
+//   node matching/harness.mjs --check-run <page> <out-dir> <startedAt-iso>
+//                                         did THIS run leave a countable report?
+//                                         exit 2 when it did not
+import { readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// fileURLToPath, not URL#pathname: pathname is percent-encoded, so a checkout
+// under a directory with a space in it would resolve to a path that does not
+// exist.
+const DIR = fileURLToPath(new URL(".", import.meta.url));
+const CFG = JSON.parse(readFileSync(join(DIR, "harness.json"), "utf8"));
+
+// Env overrides exist for one-off probes only. They are NOT how a site is
+// configured \u2014 harness.json is, so that what a gate ran against is committed.
+export const REF = process.env.MATCH_REF ?? CFG.ref;
+export const CAND = process.env.MATCH_CAND ?? process.env.CAND_BASE ?? CFG.cand;
+export const MATRIX = CFG.matrix;
+export const THRESHOLD = CFG.threshold;
+export const MAX_HEIGHT_DELTA = CFG.maxHeightDelta;
+export const REF_MARK = CFG.refMark;
+export const CAND_MARK = CFG.candMark;
+export const SELF_HOSTS = CFG.selfHosts ?? [];
+
+/** One record per gated page, in harness.json order. \`key\` is the gate key
+ *  (out-<TAG>-<key>, the SPEC heading, spec-sections/<key>.md); \`uid\` is the
+ *  Prismic uid or null where the page has no /dev/match twin. */
+export const PAGES = Object.entries(CFG.pages).map(([key, p]) => ({ key, ...p }));
+export const byKey = Object.fromEntries(PAGES.map((p) => [p.key, p]));
+
+/** Can this page's region count be PREDICTED at all? It needs anchors \u2014 see
+ *  TOTALS below \u2014 AND a matrix to measure them at. Exported beside TOTALS
+ *  rather than left for each consumer to re-derive, because "remember to ask
+ *  first" is exactly what failed: checkRun remembered, next.mjs did not, for
+ *  two releases.
+ *
+ *  \`MATRIX.length > 0\` is not defensive padding. TOTALS is
+ *  \`(anchors + 1) * MATRIX.length\`, so an ANCHORED page with \`matrix: []\`
+ *  yields 0 \u2014 truthy-adjacent, arithmetically fatal. Measured on a page with 3
+ *  anchors, an empty matrix and 8 passing regions: without this clause the
+ *  scorer printed \`SCORE 8/0 regions passing\` and \`Backlog is empty \u2014 Phases 5
+ *  and 6 are what is left\`, exit 0. The absurd fraction would be questioned;
+ *  the sentence would not. \`pass/0\` is also Infinity, so such a page sorts
+ *  BEST and can never be named \`worst\` \u2014 the same ranking bug this change set
+ *  removed for unanchored pages, one input along. */
+export const scorable = (key) =>
+  (byKey[key]?.anchors?.length ?? 0) > 0 && MATRIX.length > 0;
+
+/** WHY a page is not scorable, in the words of the thing that is actually
+ *  missing. A refusal that states a cause it did not check is the shape
+ *  CLAUDE.md names: a field must never be named after something it cannot
+ *  observe. "no anchors" printed for a page carrying three of them sends the
+ *  operator to edit the one part of harness.json that was already right. */
+export const unscorableWhy = (key) =>
+  (byKey[key]?.anchors?.length ?? 0) === 0
+    ? "no anchors"
+    : MATRIX.length === 0
+      ? "matrix is empty"
+      : null;
+
+// DERIVED, never hand-typed: page-diff cuts one region before the first anchor
+// ("top") plus one per anchor, at every viewport. The old hand-written map went
+// stale the moment an anchor list changed, and a wrong denominator makes the
+// score a lie in the flattering direction.
+//
+// THAT IDENTITY HOLDS ONLY WITH ANCHORS. \`splitRegions\` (page-diff.mjs:103-110)
+// only cuts by anchor when there are anchors to cut by; with none it falls back
+// to the page's own <section> boxes, and with none of those to an even four-row
+// grid (lib/regions.mjs:27-35, gridRows = 4, labels \`grid-<r>-<c>\`). So the
+// count is DATA-DEPENDENT, the two pages need not even agree, and no formula
+// over anchors can predict it.
+//
+// \`checkRun\` below already reaches this conclusion \u2014 its \`if (secs.length)\`
+// guard declines to assert a region count without anchors, and says why. That
+// fix was applied to the VALIDATOR and never carried to the DENOMINATOR, so
+// next.mjs went on dividing a real pass count by an imaginary total. Measured
+// 2026-09-09 on a seed harness (anchors: [], matrix of 3): page-diff produced
+// 12 grid regions, all passing, and next.mjs printed \`SCORE 12/3 regions
+// passing\` followed by "Backlog is empty \u2014 Phases 5 and 6 are what is left",
+// exit 0. On a matrix of 4 the same seed prints \`SCORE 16/4\`. The absurd
+// fraction would have been questioned; the sentence would not.
+//
+// So an unpredictable page gets NO NUMBER \u2014 \`null\`, not a plausible-looking
+// integer. That is a SIGNAL, not a barrier: \`a + null\` is \`a\`, so a consumer
+// that sums TOTALS without asking \`scorable()\` still gets a too-small
+// denominator. The barrier is \`scorable()\` plus next.mjs's exit-2 refusal.
+export const TOTALS = Object.fromEntries(
+  PAGES.map((p) => [p.key, scorable(p.key) ? (p.anchors.length + 1) * MATRIX.length : null]),
+);
+
+/** The SPEC.md heading predicate, shared by gate.sh's preflight and
+ *  build-spec.mjs so a section can never build fine and then refuse at the
+ *  gate. Matches the key followed by any non-key character (\`## team\` matches,
+ *  \`## teamfoo\` does not, \`## our-team\` cannot match \`team\`). */
+export const specHeadingRe = (key) => new RegExp(\`^##+ +\${key}([^A-Za-z0-9_-]|$)\`, "m");
+
+export const SKILL_DIR =
+  process.env.MATCHING_SKILL_DIR ?? join(homedir(), ".claude/skills/matching-a-page");
+export const PD = join(SKILL_DIR, "page-diff.mjs");
+export const SC = join(SKILL_DIR, "style-census.mjs");
+export const PLAYWRIGHT = pathToFileURL(join(SKILL_DIR, "node_modules/playwright/index.mjs")).href;
+
+/** The report format this site's scripts can read, so gate.sh can compare it
+ *  with \`page-diff --version\` before spending a run and next.mjs can refuse
+ *  rather than quietly drop a page whose newest report came from another
+ *  schema. Both do that now \u2014 gate.sh preflights \`page-diff --version\` against
+ *  this value before spending a run, and next.mjs counts a foreign-schema
+ *  report as MISSING rather than skipping it. (This said "neither does that
+ *  yet" \u2014 true at 922dde3 where it was written, false from 4e2cd7b, which
+ *  gave gate.sh the preflight and did not come back here.) Checked 2026-09-09
+ *  against the installed skill: \`page-diff --version\` \u2192 \`page-diff 0.1.0
+ *  report-schema 1\`. */
+export const REPORT_SCHEMA = 1;
+
+/**
+ * Fail-closed reference preflight. A 200 is NOT evidence: a host that has been
+ * repointed at our own build answers 200, and so does a staging host serving a
+ * 404 page. Both have happened on a real site \u2014 see the dated measurement in
+ * LEDGER.md. A pass here requires an artefact only the reference produces.
+ */
+export async function checkRef() {
+  if (!REF_MARK) {
+    return {
+      ok: false,
+      why: "harness.json refMark is empty \u2014 set it to a string only the reference serves (a Webflow site id, a build hash). A 200 is not evidence.",
+    };
+  }
+  const host = new URL(REF).host;
+  if (SELF_HOSTS.includes(host)) return { ok: false, why: \`REF host \${host} is in selfHosts\` };
+  if (host === new URL(CAND).host) return { ok: false, why: \`REF host \${host} equals CAND's host\` };
+  let res;
+  try {
+    res = await fetch(\`\${REF}/\`, { redirect: "manual" });
+  } catch (e) {
+    return { ok: false, why: \`GET \${REF}/ failed: \${e.message}\` };
+  }
+  if (res.status !== 200)
+    return { ok: false, why: \`GET \${REF}/ \u2192 HTTP \${res.status}, expected 200\` };
+  const loc = res.headers.get("location");
+  if (loc) return { ok: false, why: \`GET \${REF}/ \u2192 \${res.status} redirect to \${loc}\` };
+  const body = await res.text();
+  if (!body.includes(REF_MARK))
+    return {
+      ok: false,
+      why: \`\${REF}/ served 200 but WITHOUT refMark \${JSON.stringify(REF_MARK)} \u2014 that is not the reference\`,
+    };
+  if (CAND_MARK && body.includes(CAND_MARK))
+    return {
+      ok: false,
+      why: \`\${REF}/ contains candMark \${JSON.stringify(CAND_MARK)} \u2014 REF is serving OUR build\`,
+    };
+  return { ok: true, why: \`\${REF}/ \u2192 200, no redirect, refMark present, candMark absent\` };
+}
+
+/**
+ * Would next.mjs COUNT a run with this meta? Returns the reason it would not,
+ * as a string, or null when it would.
+ *
+ * A reason string and not a boolean, because the two callers must tell the
+ * cases apart: next.mjs treats "schema" as a page BLANKED (it has its own
+ * message and its own exit) and merely skips the rest of the diagnostics,
+ * while gate.sh prints whatever this says.
+ *
+ * It lives HERE rather than inside next.mjs because gate.sh now asks the same
+ * question, and a question asked twice drifts: a gate that greens a run
+ * next.mjs then drops is the same false green one step along. census.sh's
+ * GUARD 2c (census.sh:153-168) records exactly that drift between
+ * style-census's printer and census-count.mjs's parser \u2014 a COMPLETE census
+ * reported as 0 mismatches because the two had versioned apart.
+ */
+export function uncountable(m) {
+  // Missing schemaVersion means "written before the field existed" = 0. It is
+  // not an error on its own; it is only fatal when it would blank a page,
+  // which is next.mjs's call to make, not this predicate's.
+  if ((m.schemaVersion ?? 0) !== REPORT_SCHEMA) return "schema";
+  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the
+  // page. An --mask-photos probe of yfv made \`top\` @834 read 43.9% while the
+  // real gate had it passing at 1.3%.
+  if ((m.mask?.length ?? 0) > 0) return \`mask=[\${m.mask.join(", ")}]\`;
+  if (m.neutralizeMedia) return "neutralize-media";
+  if (m.maskPhotos) return "mask-photos";
+  if (m.truncated) return "truncated";
+  if (m.threshold !== THRESHOLD) return \`threshold \${m.threshold} != \${THRESHOLD}\`;
+  return null;
+}
+
+/**
+ * Did THIS run of page-diff leave a report the scorer will actually count?
+ *
+ * gate.sh cannot use page-diff's exit status for this. page-diff exits 1 for a
+ * region that legitimately FAILED (page-diff.mjs:227) and node exits 1 for the
+ * bare \`throw e\` one line below it, so the status cannot tell a finding from a
+ * crash-before-looking \u2014 census.sh:17-32 records the same shape for
+ * style-census. Measured on 29 Navy with the reference alive and no dev
+ * server: every page-diff died in \`page.goto\`, the gate printed \`home exit=1\`
+ * and \`ALL DONE\`, exited 0, and wrote no report at all.
+ *
+ * So the evidence is the artefact only a completed run leaves: the report
+ * next.mjs will read, fresh, over the matrix and anchors the table declares.
+ * Cheapest and most specific arm first.
+ */
+export function checkRun(page, dir, startedAt) {
+  const path = join(dir, "report.json");
+  let report;
+  try {
+    report = JSON.parse(readFileSync(path, "utf8"));
+  } catch (e) {
+    if (e.code === "ENOENT")
+      return { ok: false, why: \`\${path}: no report.json \u2014 the run wrote nothing\` };
+    return { ok: false, why: \`\${path}: \${e.message}\` };
+  }
+  const meta = report.meta ?? {};
+
+  const uncount = uncountable(meta);
+  if (uncount)
+    return { ok: false, why: \`\${path}: next.mjs would not count this run (\${uncount})\` };
+
+  // FRESHNESS. lib/report.mjs:45 is \`mkdirSync(outDir, {recursive:true})\` and
+  // nothing ever clears the directory, so a crashed re-run under a tag used
+  // before leaves the PREVIOUS round's report exactly where it was \u2014 measured
+  // 2026-09-09, sha unchanged across the crash. Requiring report.json without
+  // this arm reproduces the green one step along. meta.generatedAt is built
+  // after \`finally { await browser.close() }\` (page-diff.mjs:163-176), so it
+  // is an artefact of the run that wrote it and not of the file's mtime.
+  const since = Date.parse(startedAt);
+  // NOT skipped when startedAt is unusable: a fail-open default is the exact
+  // shape this guard exists to stop.
+  if (!Number.isFinite(since))
+    return {
+      ok: false,
+      why: \`startedAt \${JSON.stringify(startedAt)} is not a timestamp \u2014 cannot tell this run's report from a previous round's\`,
+    };
+  const at = Date.parse(meta.generatedAt ?? "");
+  if (!Number.isFinite(at))
+    return {
+      ok: false,
+      why: \`\${path}: no usable meta.generatedAt \u2014 cannot tell this run's report from a previous round's\`,
+    };
+  if (at < since)
+    return {
+      ok: false,
+      why: \`\${path}: STALE \u2014 written \${meta.generatedAt}, this run started \${startedAt}. page-diff never cleared the directory.\`,
+    };
+
+  // COVERAGE \u2014 what the run was ASKED for, against the table.
+  const vws = meta.viewports ?? [];
+  if (vws.join(",") !== MATRIX.join(","))
+    return {
+      ok: false,
+      why: \`\${path}: ran viewports [\${vws.join(",")}], harness.json matrix is [\${MATRIX.join(",")}]\`,
+    };
+  const secs = meta.sections ?? [];
+  const want = byKey[page]?.anchors ?? [];
+  if (secs.join("\\0") !== want.join("\\0"))
+    return {
+      ok: false,
+      why: \`\${path}: ran sections [\${secs.join(" | ")}], harness.json anchors are [\${want.join(" | ")}]\`,
+    };
+
+  // ...and what it actually PRODUCED. Every viewport the run says it covered
+  // has to appear in the regions. Deliberately compared against the run's own
+  // meta.viewports and not against MATRIX: the arm above owns "the run used the
+  // wrong matrix", and folding the two together would make either one
+  // unfalsifiable on its own.
+  if (!Array.isArray(report.regions) || report.regions.length === 0)
+    return { ok: false, why: \`\${path}: no regions \u2014 nothing was compared\` };
+  const seen = new Set(report.regions.map((r) => r.viewport));
+  const missing = vws.filter((v) => !seen.has(v));
+  if (missing.length)
+    return {
+      ok: false,
+      why: \`\${path}: no region at viewport(s) [\${missing.join(",")}] \u2014 the run covered [\${[...seen].join(",")}]\`,
+    };
+
+  // With anchors the region count is an exact identity: page-diff cuts one
+  // region before the first anchor plus one per anchor, at every viewport
+  // (regionsFromAnchors, page-diff.mjs:105-109). Measured over the 298 clean
+  // gate-shaped runs in the corpus this harness was cut from, all of them
+  // anchored: regions.length === (sections + 1) * viewports holds 298/298,
+  // while regions.length === TOTALS[page] holds only 260/298 \u2014 the 38 are
+  // legitimately narrower HAND rounds. So the identity is checked against the
+  // run's OWN meta and the matrix/anchors are checked against the table above.
+  //
+  // WITHOUT anchors there is no such identity, and asserting one is a FALSE
+  // REFUSAL of the shape every new site starts in. page-diff falls back to each
+  // page's own <section> boxes and, with none, an even four-row grid
+  // (splitRegions, page-diff.mjs:103-110), so the count is data-dependent and
+  // the two pages need not even agree. Measured 2026-09-09 against the real
+  // page-diff on a seed harness (anchors: [], matrix of 4): 16 regions labelled
+  // grid-0-0 \u2026 grid-3-0, not the 4 this identity predicted. The 298/298 above
+  // was measured over anchored runs only and never covered this case.
+  if (secs.length) {
+    const expected = (secs.length + 1) * vws.length;
+    if (report.regions.length !== expected)
+      return {
+        ok: false,
+        why: \`\${path}: \${report.regions.length} region(s), expected \${expected} = (\${secs.length} anchors + 1) x \${vws.length} viewport(s)\`,
+      };
+  }
+
+  // A green that STATES what it is made of, so a green over nothing reads
+  // differently from a green over the matrix (census.sh:219's habit).
+  return {
+    ok: true,
+    why: \`\${report.regions.length} region(s) over \${vws.length} viewport(s), written \${meta.generatedAt}\`,
+  };
+}
+
+// CLI. Both sides go through realpathSync. \`import.meta.url\` is ALREADY the
+// resolved real path (node resolves symlinks unless --preserve-symlinks) while
+// process.argv[1] is the path as typed, so a plain pathToFileURL compare goes
+// false the moment any component of the invoked path is a symlink \u2014 and then
+// the CLI prints nothing and exits 0, which every caller reads as success.
+// page-diff.mjs:184-189 records exactly that defect and the same fix: "The
+// pathToFileURL compare that replaced the old template string is still false
+// whenever ANY component of the invoked path is a symlink \u2014 which is how this
+// skill is installed now (~/.claude/skills/matching-a-page -> the claude-skills
+// checkout). isMain() resolves the real path on both sides."
+const isMain = () => {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch {
+    return false;
+  }
+};
+
+if (isMain()) {
+  const mode = process.argv[2];
+  const q = (v) => \`'\${String(v).replace(/'/g, \`'\\\\''\`)}'\`;
+  if (mode === "--env") {
+    const pairs = [
+      ["REF", REF],
+      ["CAND", CAND],
+      ["MATRIX", MATRIX.join(",")],
+      ["VIEWPORTS_SP", MATRIX.join(" ")],
+      ["THRESHOLD", THRESHOLD],
+      ["MAX_HEIGHT_DELTA", MAX_HEIGHT_DELTA],
+      ["PD", PD],
+      ["SC", SC],
+      ["REPORT_SCHEMA", REPORT_SCHEMA],
+    ];
+    for (const [k, v] of pairs) console.log(\`\${k}=\${q(v)}\`);
+  } else if (mode === "--table") {
+    for (const p of PAGES) console.log([p.key, p.ref, p.cand, p.anchors.join(",")].join("\\t"));
+  } else if (mode === "--check-ref") {
+    const r = await checkRef();
+    console.log(\`\${r.ok ? "REF OK" : "REF REFUSED"} \u2014 \${r.why}\`);
+    process.exit(r.ok ? 0 : 2);
+  } else if (mode === "--check-run") {
+    // startedAt is REQUIRED, never defaulted: an optional one is a fail-open
+    // door in the one guard that decides whether a page was measured at all.
+    const [page, dir, startedAt] = process.argv.slice(3);
+    if (!page || !dir || !startedAt) {
+      console.error("usage: harness.mjs --check-run <page> <out-dir> <startedAt-iso>");
+      process.exit(2);
+    }
+    const r = checkRun(page, dir, startedAt);
+    console.log(\`\${r.ok ? "RUN OK" : "NO RUN"} \u2014 \${r.why}\`);
+    process.exit(r.ok ? 0 : 2);
+  } else {
+    console.error("usage: harness.mjs --env | --table | --check-ref | --check-run");
+    process.exit(2);
+  }
+}
+`;
+var CENSUS_SH_PREV_0_95_1 = `#!/usr/bin/env bash
+# Phase 3 style gate \u2014 the mechanical net for the type spec.
+#
+#   bash matching/census.sh            # all 9 pages, all 3 viewports
+#   bash matching/census.sh home yfv   # just these
+#
+# style-census diffs the computed type tuple (family, weight, size,
+# line-height, letter-spacing, transform, colour) of every text snippet present
+# on BOTH pages. It is the only gate that catches the 11px footer line and the
+# cyan-vs-teal link that page-diff is structurally blind to \u2014 a region can be
+# pixel-clean at 0.10 and still be wearing the wrong colour on small text.
+#
+# Prints a per-page/per-viewport mismatch count and leaves the full runs in
+# matching/census-<page>-<vw>.log. Exits 1 while any count is non-zero, and 2
+# when it cannot honestly report a count at all.
+#
+# EVIDENCE \u2014 read before adding a guard here, or removing one. A green here
+# has to be produced by a census that RAN. It was not: with style-census.mjs
+# absent this gate printed "Phase 3 CLEAN \u2014 0 undeclared type mismatches" and
+# exited 0. Every run died on module resolution, census-count.mjs read each
+# crash log as "0 0 0" (it counts \`  y=\` rows and a stack trace has none \u2014
+# census-count.mjs:35-56), and no rows was reported as no mismatches. Measured
+# again with style-census.mjs PRESENT and the candidate host down: identical
+# output, because style-census exits 1 both when it finds mismatches
+# (style-census.mjs:187) and when it dies before it looks \u2014 so the exit status
+# cannot tell a finding from a crash and may not grant a green either.
+#
+# The guards below are what next.mjs:83-89 (no parseable gate run \u2014 refusing to
+# report a score), strikes.mjs:87-97 (refusing to report "clear") and
+# gate.sh:37-42 (preflight page-diff before spending a run) already do. Each
+# demands an artefact only a working census produces; none of them can turn a
+# red green.
+set -uo pipefail
+# Resolved BEFORE the cd. $0 is the path as TYPED, so a relatively invoked
+# census.sh that resolved the harness afterwards would look for it under
+# whatever root the cd landed on.
+HARNESS="$(cd "$(dirname "$0")" && pwd)/harness.mjs"
+cd "$(dirname "$0")/.."
+
+# Everything configurable lives in matching/harness.json; harness.mjs is the one
+# reader. --env supplies REF, CAND, SC and VIEWPORTS_SP \u2014 this gate held its own
+# copy of all four, and its REF went stale when production cut over to our own
+# build (LEDGER "REFERENCE MOVED", verified 2026-08-10) while gate.sh's was
+# repointed the same day.
+eval "$(node "$HARNESS" --env)"
+NODE="\${NODE:-node}"
+
+# The matrix is DATA, read as VIEWPORTS_SP, the way gate.sh reads MATRIX. The
+# old VIEWPORTS override is retired rather than silently ignored: a census run
+# over a matrix harness.json does not name is a column set the pixel gate never
+# measured, and it would look exactly like a clean one.
+if [ -n "\${VIEWPORTS:-}" ]; then
+  echo "census.sh: the VIEWPORTS override is retired \u2014 the matrix is data now." >&2
+  echo "           Edit \\"matrix\\" in matching/harness.json, then unset it." >&2
+  exit 2
+fi
+
+# GUARD 1 \u2014 the tool is there and it starts. gate.sh compares \`page-diff
+# --version\` with the harness's REPORT_SCHEMA before spending a run
+# (gate.sh:37-42); style-census has no --version to compare (page-diff.mjs
+# defines one at 191-195; nothing in style-census.mjs writes one), so the
+# artefact demanded here is the other one only it produces: the usage banner it
+# prints on exit 2 when --ref/--cand are missing (style-census.mjs:151-157).
+# That banner is not free \u2014 \`import { chromium } from "playwright"\` runs first
+# (style-census.mjs:19) \u2014 so a skill directory with no playwright installed
+# fails HERE, once, instead of writing one crash log per page per viewport that
+# every reader downstream counts as zero.
+if [ ! -f "$SC" ]; then
+  echo "census.sh: no style-census at $SC \u2014 refusing to report a count." >&2
+  echo "           Install the matching-a-page skill, or point MATCHING_SKILL_DIR" >&2
+  echo "           at a checkout that has style-census.mjs." >&2
+  exit 2
+fi
+SC_USAGE="$("$NODE" "$SC" 2>&1)"
+case "$SC_USAGE" in
+  *"style-census"*"--ref"*"--cand"*"--vw"*) ;;
+  *)
+    echo "census.sh: $SC did not answer with a style-census --ref/--cand/--vw usage" >&2
+    echo "           banner \u2014 refusing to report a count. It printed:" >&2
+    echo "           \${SC_USAGE:-(nothing at all)}" >&2
+    exit 2
+    ;;
+esac
+
+declare -a WANT=("$@")
+
+# page -> "refpath candpath": the same table gate.sh drives, from the same file.
+# cut drops the anchors column, which the style census has no argument for
+# (style-census.mjs: --ref <url> --cand <url> [--vw 1440]).
+pages() { node "$HARNESS" --table | cut -f1-3; }
+
+TOTAL=0
+AMB=0
+DECL=0
+ROWS=0
+RUNS=0
+BROKEN=0
+SEEN=""
+# One column per viewport, from the matrix. Flush with the data rows below, at
+# last: the old header hardcoded four fixed fields separated by a literal space,
+# which the rows do not have, so its labels sat 1/2/3 columns right of them.
+printf '%-10s' page
+for vw in $VIEWPORTS_SP; do printf '%8s' "$vw"; done
+printf '\\n'
+while read -r page refpath candpath; do
+  [ -z "$page" ] && continue
+  SEEN="$SEEN $page"
+  if [ \${#WANT[@]} -gt 0 ]; then
+    hit=0
+    for w in "\${WANT[@]}"; do [ "$w" = "$page" ] && hit=1; done
+    [ $hit -eq 1 ] || continue
+  fi
+  ROWS=$((ROWS + 1))
+  line=$(printf '%-10s' "$page")
+  for vw in $VIEWPORTS_SP; do
+    log="matching/census-$page-$vw.log"
+    RUNS=$((RUNS + 1))
+    "$NODE" "$SC" --ref "$REF$refpath" --cand "$CAND$candpath" --vw "$vw" >"$log" 2>&1
+    # GUARD 2 \u2014 this run produced a census. The header and the counts line are
+    # written together at style-census.mjs:166-169 and only after both pages
+    # have been walked, so they are the artefact a completed run leaves and a
+    # crashed one cannot. The viewport is read back out of the header because a
+    # --vw that did not take would otherwise fill three differently named logs
+    # with the same 1440 census. \`ref runs\`/\`cand runs\` must be non-zero: two
+    # pages that rendered no text at all agree perfectly and mean nothing.
+    if ! grep -qE "^=== style census, viewport $vw ===\\$" "$log" ||
+      ! grep -qE "^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+\\$" "$log"; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: $page @$vw produced no usable census \u2014 see $log" >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    # census-count splits the log three ways: REAL mismatches, AMBIGUOUS
+    # same-text collisions (style-census's own split), and DECLARED rows the
+    # operator has already ruled on (matching/census-deviations.mjs, the same
+    # contract as floors.mjs). Only the first is outstanding work \u2014 without the
+    # third, this gate can never reach zero and its number means nothing.
+    read -r n a d <<<"$("$NODE" matching/census-count.mjs "$log")"
+    # GUARD 2b \u2014 three integers, or the counter did not count. census-count.mjs
+    # is the reader that turned a stack trace into "0 0 0"; a run of it that
+    # dies (a broken census-deviations.mjs, a bad path) prints nothing at all,
+    # and bash reads an empty $n as zero in the arithmetic below.
+    counted=1
+    for v in "\${n:-}" "\${a:-}" "\${d:-}"; do
+      case "$v" in "" | *[!0-9]*) counted=0 ;; esac
+    done
+    if [ "$counted" -eq 0 ]; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: census-count.mjs did not return three counts for $log" >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    # GUARD 2c \u2014 the number reported is the number the census MEASURED. GUARD 2
+    # matched the counts line for PRESENCE and threw its numbers away, so the
+    # count printed below came from census-count's row parse and nothing ever
+    # compared the two. Measured 2026-09-09: a COMPLETE census whose counts line
+    # said "mismatches: 3", whose \`y=\` rows carried one leading space instead of
+    # two (census-count.mjs:39 matches /^ {2}y=/), was reported as 0 and this
+    # gate printed "Phase 3 CLEAN \u2014 0 undeclared type mismatches", exit 0. The
+    # printer lives in the SKILL (style-census.mjs:171-173) and the parser is
+    # copied into every site, so the two version independently and drift needs
+    # nobody to touch either repo.
+    #
+    # The identity is exact for mismatches: style-census prints at most 100 rows
+    # and states the remainder on its own line (style-census.mjs:175-177), so
+    # parsed + remainder == reported. Ambiguous rows are capped the same way
+    # (:184) but the remainder is NOT stated, so only a floor is checkable
+    # there \u2014 any is not none, and the parse may never exceed the report.
+    counts=$(grep -E "^ref runs: [1-9][0-9]* +cand runs: [1-9][0-9]* +mismatches: [0-9]+ +ambiguous: [0-9]+$" "$log" | tail -1)
+    said_m=\${counts##*mismatches: }
+    said_m=\${said_m%% *}
+    said_a=\${counts##*ambiguous: }
+    more=$(sed -n 's/^ *\u2026 and \\([0-9][0-9]*\\) more (truncated print, all counted)$/\\1/p' "$log" | tail -1)
+    if [ $((n + d + \${more:-0})) -ne "$said_m" ] ||
+      [ "$a" -gt "$said_a" ] ||
+      { [ "$said_a" -gt 0 ] && [ "$a" -eq 0 ]; }; then
+      BROKEN=$((BROKEN + 1))
+      echo "census.sh: $log reports mismatches: $said_m ambiguous: $said_a, but" >&2
+      echo "           census-count.mjs read $((n + d)) mismatch row(s)\${more:+ (+ $more truncated)} and $a ambiguous." >&2
+      echo "           The census and its reader disagree; there is no count to report." >&2
+      line="$line$(printf '%8s' '!!')"
+      continue
+    fi
+    AMB=$((AMB + a))
+    DECL=$((DECL + d))
+    TOTAL=$((TOTAL + n))
+    line="$line$(printf '%8s' "$n")"
+  done
+  echo "$line"
+done < <(pages)
+
+echo
+# GUARD 3 \u2014 something was actually censused. Process substitution above, NOT a
+# pipe: a pipe runs the loop in a subshell and every counter here would still
+# read 0, which is exactly the green this file exists to stop (gate.sh:123-125
+# records the same trap for FAILED_PREFLIGHT). A page name that matches nothing
+# must not report CLEAN either \u2014 strikes.mjs:147-156 is the same refusal, and
+# it was written because a typo silently greened rule 3 on six of nine pages.
+if [ "$ROWS" -eq 0 ]; then
+  if [ -n "$SEEN" ]; then
+    echo "census.sh: \\"\${WANT[*]:-}\\" matches no page \u2014 refusing to report CLEAN." >&2
+    echo "           known pages:$SEEN" >&2
+  else
+    echo "census.sh: the page table is empty \u2014 refusing to report CLEAN." >&2
+    echo "           node matching/harness.mjs --table printed no rows; check" >&2
+    echo "           \\"pages\\" in matching/harness.json." >&2
+  fi
+  exit 2
+fi
+if [ "$BROKEN" -gt 0 ]; then
+  echo "CENSUS INCOMPLETE \u2014 $BROKEN of $RUNS run(s) produced no usable census (marked !!)."
+  echo "Those page/viewport pairs have NOT been measured; there is no count to"
+  echo "report for them, and the totals below would be a floor, not a score."
+  echo "Full runs: matching/census-<page>-<vw>.log"
+  exit 2
+fi
+if [ "$TOTAL" -eq 0 ]; then
+  echo "Phase 3 CLEAN \u2014 0 undeclared type mismatches ($DECL declared, $AMB ambiguous)."
+  echo "($RUNS censused run(s) over $ROWS page(s), each one counted.)"
+  [ "$AMB" -gt 0 ] && echo "($AMB ambiguous same-text rows remain: each needs ADJUDICATING," &&
+    echo " not fixing \u2014 our element matches, another sharing its text does not.)"
+  exit 0
+fi
+echo "$TOTAL type mismatch(es) remain (+ $AMB ambiguous, $DECL declared)."
+echo "Full runs: matching/census-<page>-<vw>.log"
+echo "A mismatch is a defect or a ledgered deviation. An ambiguous row is neither"
+echo "until you look: the census keys on TEXT, so two different elements sharing a"
+echo "string land under one key and only one of them may be wrong."
+exit 1
+`;
+var NEXT_MJS_PREV_0_95_1 = `// What is still broken, ranked. Exits 1 while work remains.
+//
+//   node matching/next.mjs
+//
+// Round protocol step 0 (repo CLAUDE.md rule 5). A commit is a CHECKPOINT, not
+// a stopping point: after committing, run this. If it exits 1 there is a named
+// next action and the round continues without handing control back.
+//
+// Reads the most recent gate log per page rather than the whole corpus, so it
+// reflects HEAD rather than history (that is strikes.mjs's job).
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+const DIR = new URL(".", import.meta.url).pathname;
+
+// PAUSE SWITCH. While matching/PAUSED exists this hands out no agenda and
+// exits 0. It is deliberately the FIRST thing that runs: no report is read, no
+// score is printed, nothing tempting is put on screen to argue with.
+//
+// Why an exit code and not a note somewhere: rule 5 is a LOOP \u2014 "after
+// committing, run next.mjs; while it exits 1 there is a named next action and
+// the round continues". A pause written as prose loses to that loop, because
+// the loop is mechanical and the prose is not. Exiting 0 satisfies rule 5
+// truthfully rather than suspending it: there is no next action.
+const PAUSE = join(DIR, "PAUSED");
+if (existsSync(PAUSE)) {
+  console.log("MATCHING PAUSED \u2014 no agenda, and none is to be inferred.\\n");
+  console.log(readFileSync(PAUSE, "utf8").trimEnd());
+  process.exit(0);
+}
+
+import { FLOORS, ACCEPTED } from "./floors.mjs";
+import {
+  TOTALS,
+  THRESHOLD,
+  MAX_HEIGHT_DELTA,
+  REPORT_SCHEMA,
+  uncountable,
+  scorable,
+  unscorableWhy,
+  byKey,
+} from "./harness.mjs";
+
+// Reports written by a different page-diff, by page key. Kept rather than
+// dropped: silently ignoring them is how a page vanishes from the score.
+const schemaMismatch = new Set();
+
+const latest = new Map();
+for (const d of readdirSync(DIR).filter((d) => d.startsWith("out-"))) {
+  const m = /^out-[^-]+-(.+)$/.exec(d);
+  // Membership in the page table is asked of the TABLE. \`!TOTALS[m[1]]\` was a
+  // NUMBER standing in for a fact: it is null for an unanchored page and 0 for
+  // an empty matrix, and either dropped the page out of \`latest\` while
+  // \`Object.keys(TOTALS)\` still listed it \u2014 so a gate run that had just
+  // SUCCEEDED came back as "no countable gate run".
+  if (!m || !byKey[m[1]]) continue;
+  let report, mtime;
+  try {
+    const p = join(DIR, d, "report.json");
+    report = JSON.parse(readFileSync(p, "utf8"));
+    mtime = statSync(p).mtimeMs;
+  } catch {
+    continue;
+  }
+  // A masked / media-neutralised run is a DIAGNOSTIC, never the state of the
+  // page. Picking one up as "latest" silently reports scores nobody can ship \u2014
+  // it happened immediately: an --mask-photos probe of yfv made \`top\` @834 read
+  // 43.9% here while the real gate had it passing at 1.3%. Missing
+  // schemaVersion means "written before the field existed" = 0; it is not an
+  // error on its own, only when it would blank a page.
+  //
+  // The predicate itself lives in harness.mjs now, because gate.sh asks the
+  // same question per run and two copies of one question drift \u2014 a gate that
+  // greens a run this file then drops is the same false green one step along.
+  const why = uncountable(report.meta ?? {});
+  if (why === "schema") {
+    schemaMismatch.add(m[1]);
+    continue;
+  }
+  if (why) continue;
+  const prev = latest.get(m[1]);
+  if (!prev || mtime > prev.mtime) latest.set(m[1], { dir: d, mtime, report });
+}
+
+const blanked = [...schemaMismatch].filter((p) => !latest.has(p));
+if (blanked.length) {
+  console.error(
+    \`next: \${blanked.length} page(s) have no run at report schema \${REPORT_SCHEMA} \u2014 \` +
+      \`their newest reports came from a different page-diff (\${blanked.sort().join(", ")}).\\n\` +
+      \`      Re-run: bash matching/gate.sh <tag> \${blanked.sort().join(" ")}\`,
+  );
+  process.exit(2);
+}
+if (latest.size === 0) {
+  console.error(
+    "next: no parseable gate run under matching/ \u2014 refusing to report a score.\\n" +
+      "      Run bash matching/gate.sh <tag> first.",
+  );
+  process.exit(2);
+}
+
+const rows = [];
+const accepted = [];
+let openTotal = 0;
+let floorTotal = 0;
+for (const [page, { dir, report }] of latest) {
+  const fails = report.regions.filter((r) => !r.pass);
+  for (const f of fails) {
+    const floor = FLOORS.find((fl) => fl.match(f, page));
+    if (floor) {
+      floorTotal++;
+      continue;
+    }
+    const ack = ACCEPTED.find((a) => a.match(f, page));
+    if (ack) {
+      accepted.push({ page, vw: f.viewport, label: f.label, why: ack.why });
+      continue;
+    }
+    openTotal++;
+    rows.push({
+      page,
+      vw: f.viewport,
+      label: f.label,
+      mm: f.mismatchFraction,
+      dh: f.heightDeltaFraction ?? 0,
+      dir,
+    });
+  }
+}
+
+// Pages that REPORTED but cannot be scored: no anchors, so their regions are
+// whatever page-diff's fallback cut and there is no model for one to be right
+// against. Kept separate from \`scored\` and never ranked with it.
+const unscorable = [...latest.entries()]
+  .filter(([p]) => !scorable(p))
+  .map(([p, v]) => ({ p, regions: v.report.regions.length }))
+  .sort((a, b) => a.p.localeCompare(b.p));
+
+// \`.filter(scorable)\` before \`.map\`, because the sort below divides by \`total\`
+// and an unanchored page's ratio is NOT BOUNDED BY 1. A passing one scored
+// 16/4 = 4.0 and sorted LAST, i.e. best, so \`worst\` could never name the one
+// page whose Phase 1 was not done; a failing one scored 0/4 = 0.0, sorted
+// FIRST, and put \`grid-0-0\`, \`grid-1-0\` \u2026 on the agenda \u2014 an instruction to fix
+// geometry against regions page-diff invented.
+const scored = [...latest.entries()]
+  .filter(([p]) => scorable(p))
+  .map(([p, v]) => ({
+    p,
+    pass: v.report.regions.filter((r) => r.pass).length,
+    total: TOTALS[p],
+  }))
+  .sort((a, b) => a.pass / a.total - b.pass / b.total);
+
+// The denominator is the DECLARED site, not the pages that happened to report.
+// Summed over \`scored\` it shrank to match the numerator: 8 of 9 pages reporting
+// read SCORE 160/160 while the ninth, whose page-diff had crashed, was in
+// neither the numerator nor the denominator nor the list below. harness.mjs:61-67
+// already gives the reason \u2014 "a wrong denominator makes the score a lie in the
+// flattering direction" \u2014 and that fix was applied per REGION (\`total:
+// TOTALS[p]\`) and never per PAGE.
+const unmeasured = Object.keys(TOTALS)
+  .filter((p) => !latest.has(p))
+  .sort();
+const sum = scored.reduce((a, s) => a + s.pass, 0);
+// Summed EXPLICITLY over the scorable pages rather than over TOTALS' values:
+// \`a + null\` is silently \`a\`, and a denominator that is right only because of a
+// coercion is the same lie one refactor away.
+const pagesAll = Object.keys(TOTALS).length;
+const pagesScorable = Object.keys(TOTALS).filter((p) => scorable(p)).length;
+const max = Object.keys(TOTALS).reduce((a, p) => a + (scorable(p) ? TOTALS[p] : 0), 0);
+
+// A score is printed only if SOMETHING can carry one. \`SCORE 0/0\` is a third
+// lie and the one that reads best of all, so it is never printed: with nothing
+// scorable the line says so in words and gives no fraction to quote.
+console.log(
+  (pagesScorable === 0
+    ? \`NO SCORE \u2014 0 of \${pagesAll} page(s) can carry one.\`
+    : \`SCORE \${sum}/\${max} regions passing over \${pagesScorable} of \${pagesAll} page(s)\` +
+      (unmeasured.length ? \` \u2014 \${unmeasured.length} page(s) NOT MEASURED\` : "")) + "\\n",
+);
+console.log(
+  [
+    ...scored.map((s) => \`  \${s.p.padEnd(9)} \${String(s.pass).padStart(2)}/\${s.total}\`),
+    // The run's OWN region count, as EVIDENCE FOR THE REFUSAL \u2014 it proves a run
+    // happened and explains why it cannot be scored, so a refusal is not
+    // mistaken for a crash. The pass FRACTION is deliberately withheld: it is
+    // the number with no referent, and the number that gets quoted.
+    ...unscorable.map(
+      (u) =>
+        \`  \${u.p.padEnd(9)} \${String(u.regions).padStart(2)} region(s)  NOT SCORABLE \u2014 \${unscorableWhy(u.p)}\`,
+    ),
+    // \`?/N\`, never \`0/N\`: an unmeasured page is not a page that scored zero,
+    // and printing zero would be a different lie. \`?/?\` when the page is ALSO
+    // unanchored \u2014 \`?/null\` would name the denominator "null", which is worse
+    // than the number it replaced.
+    ...unmeasured.map((p) => \`  \${p.padEnd(9)}  ?/\${TOTALS[p] ?? "?"}   NOT MEASURED\`),
+  ].join("\\n"),
+);
+
+if (accepted.length) {
+  console.log(\`\\nOperator-ACCEPTED failures (left failing on purpose):\`);
+  for (const a of accepted)
+    console.log(\`  \${a.page} @\${a.vw} "\${a.label}" \u2014 \${a.why.slice(0, 96)}\u2026\`);
+}
+
+// BEFORE the \`!rows.length\` branch, and deliberately so: an unmeasured page
+// contributes no failing region, so that branch would print "Backlog is empty"
+// and exit 0 over a page nobody had looked at. Exit 2 matches the two guards
+// above (\`blanked\`, \`latest.size === 0\`) \u2014 neither "clean" nor "work remains"
+// but "this cannot be scored", the one answer rule 5's while-it-exits-1 loop
+// cannot swallow. The score print stays above it so the partial state is still
+// visible.
+// A page with no anchors has not finished Phase 1, so a score has no referent
+// and this refuses to invent one \u2014 the same answer \`refMark: ""\` gets from
+// checkRef and an absent \`## <page>\` SPEC section gets from gate.sh. All three
+// are seed sentinels, and this was the one that failed OPEN. Repo CLAUDE.md
+// rule 1's corollary is the whole argument: a field that can only observe
+// configuration must never be named after the thing it cannot observe, and
+// "12 of 12 grid rows passed" observes a screenshot cut into quarters, not a
+// design anyone specced.
+//
+// PRINTED here, EXITED below: \`unmeasured\` and \`unscorable\` are different pages
+// with different remedies, and exiting inside the first block would hide the
+// second from an operator who then fixes only what was printed.
+if (unscorable.length) {
+  console.error(
+    \`\\nnext: \${unscorable.length} page(s) have no anchors, so their regions are page-diff's own\\n\` +
+      \`      fallback cut and cannot be scored \u2014 \` +
+      unscorable.map((u) => \`\${u.p} (\${u.regions} region(s))\`).join(", ") +
+      \`.\\n      Set "anchors" for them in matching/harness.json to section texts that exist on\\n\` +
+      \`      BOTH the reference and the candidate, then re-run: bash matching/gate.sh <tag> \` +
+      unscorable.map((u) => u.p).join(" "),
+  );
+}
+
+if (unmeasured.length) {
+  console.error(
+    \`\\nnext: \${unmeasured.length} page(s) have no countable gate run \u2014 \${unmeasured.join(", ")}.\\n\` +
+      \`      Re-run: bash matching/gate.sh <tag> \${unmeasured.join(" ")}\`,
+  );
+  process.exit(2);
+}
+
+// See above: deliberately a second statement, not an \`else\`.
+if (unscorable.length) process.exit(2);
+
+if (!rows.length) {
+  console.log(
+    \`\\nNo open geometry failures. \${floorTotal} declared floor(s) remain.\`,
+  );
+  console.log(
+    "Backlog is empty \u2014 Phases 5 (states) and 6 (adversarial review) are what is left.",
+  );
+  process.exit(0);
+}
+
+// Worst page first, then worst region inside it: fix where the model is most wrong.
+//
+// INVARIANT, documented rather than guarded because no test could redden a
+// guard here: \`scored[0]\` is safe because \`scored\` is empty only when every
+// page in \`latest\` is unanchored \u2014 and that means \`unscorable.length > 0\`, so
+// the exit above already fired. (\`latest\` being empty is caught further up.)
+// \`rows\` likewise still contains unanchored pages' failing regions; they are
+// never printed because that same exit fires first. Both facts depend on the
+// exit staying ABOVE this line \u2014 a second filter here would be a second place
+// to keep in sync, which is how checkRun and next.mjs drifted apart to begin
+// with. If that exit ever moves, this becomes a TypeError.
+const worst = scored[0].p;
+rows.sort(
+  (a, b) =>
+    (a.page === worst ? -1 : 0) - (b.page === worst ? -1 : 0) || b.mm - a.mm,
+);
+
+console.log(
+  \`\\n\${openTotal} open failure(s) + \${floorTotal} declared floor(s).\`,
+);
+console.log(\`\\nNEXT: \${worst} \u2014 worst page. Its open regions:\\n\`);
+for (const r of rows.filter((r) => r.page === worst)) {
+  const why = [];
+  if (r.mm > THRESHOLD) why.push(\`pixels \${(r.mm * 100).toFixed(1)}%\`);
+  if (Math.abs(r.dh) > MAX_HEIGHT_DELTA)
+    why.push(\`height \${(r.dh * 100).toFixed(1)}%\`);
+  console.log(
+    \`  @\${String(r.vw).padEnd(5)} \${r.label.slice(0, 44).padEnd(45)} \${why.join(" + ")}\`,
+  );
+}
+console.log(\`\\nBefore treating any of these as geometry:\`);
+console.log(
+  \`  node matching/probe-anchor-parity.mjs \${worst}   # is the gate cutting comparably?\`,
+);
+console.log(
+  \`  node matching/strikes.mjs \${worst}               # has it stalled? then change the MODEL\`,
+);
+console.log(
+  \`\\nRound continues. Do not hand back control with work outstanding.\`,
+);
+process.exit(1);
+`;
+var STRIKES_MJS_PREV_0_95_1 = `// The 3-strike rule, made countable.
+//
+//   node matching/strikes.mjs [page]
+//
+// The matching skill says: "A region that has not improved after 3 fix ->
+// re-run cycles: stop. Present the three attempts. Do not widen the threshold,
+// mask it, or reclassify it \u2014 a stuck region means your model of it is wrong."
+//
+// That rule was blown twice on this project (services \`top\`, yfv \`top\`) purely
+// because nobody was counting. This reads every matching/out-*/report.json,
+// reconstructs each region's history in chronological order, and prints the
+// regions that are OUT OF STRIKES. Exit 1 when any exist, so a round that
+// starts by running this cannot quietly attempt a fourth cycle.
+//
+// WHAT THIS ACTUALLY MEASURES (read before trusting a number): report.json
+// cannot record INTENT, so a "cycle" here is any completed gate run in which
+// the region was still failing and did not improve by IMPROVE_PP. Runs aimed at
+// a different region on the same page therefore count too. That makes this a
+// STALL detector, not a literal attempt counter \u2014 "this has been failing,
+// unchanged, across N gate runs while you were working on this page." That is
+// the more useful discipline number anyway, and it is honest about being an
+// upper bound. Improvement resets the count: real progress earns a fresh start.
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { FLOORS } from "./floors.mjs";
+import {
+  PAGES,
+  THRESHOLD,
+  MAX_HEIGHT_DELTA,
+  REPORT_SCHEMA,
+} from "./harness.mjs";
+
+// PAUSE SWITCH \u2014 see matching/next.mjs for why this is an exit code. Round
+// protocol step 1 is "run strikes.mjs; the stalled regions are the agenda", so
+// this is the second door into the backlog and has to be shut too. Exits 0:
+// there are no strikes to spend when no round is being played.
+const PAUSED = join(new URL(".", import.meta.url).pathname, "PAUSED");
+if (existsSync(PAUSED)) {
+  console.log("MATCHING PAUSED \u2014 no agenda, and none is to be inferred.\\n");
+  console.log(readFileSync(PAUSED, "utf8").trimEnd());
+  process.exit(0);
+}
+
+const IMPROVE_PP = 0.01; // 1 percentage point = the smallest move worth calling progress
+const MAX_STRIKES = 3;
+const ROOT = new URL(".", import.meta.url).pathname;
+const only = process.argv[2] ?? null;
+
+// The gate key for a report, from its ref path. Deriving it by string surgery
+// disagreed with the gate on exactly six of the nine rows \u2014 yfv, contact, atd,
+// svc, qa and team (measured 2026-09-09 against harness.json); the table knows.
+// keyOf (below) stays as the fallback for a run whose ref was rewritten.
+const pageOf = (ref) => {
+  const path = new URL(ref).pathname.replace(/\\/$/, "") || "/";
+  return PAGES.find((p) => p.ref === path)?.key ?? null;
+};
+
+const runs = [];
+const unreadable = [];
+for (const dir of readdirSync(ROOT).filter((d) => d.startsWith("out-"))) {
+  let report;
+  try {
+    report = JSON.parse(readFileSync(join(ROOT, dir, "report.json"), "utf8"));
+  } catch {
+    continue; // not a completed run dir
+  }
+  if (!report.meta?.ref || !Array.isArray(report.regions)) continue;
+  // A report from another schema is still usable for a STALL count as long as
+  // it carries the two fields this reads. Anything else is counted and named,
+  // never silently dropped \u2014 an under-counted history reads as "clear".
+  const usable = report.regions.every(
+    (r) =>
+      typeof r.mismatchFraction === "number" && typeof r.pass === "boolean",
+  );
+  if (!usable) {
+    unreadable.push(\`\${dir} (schema \${report.meta.schemaVersion ?? 0})\`);
+    continue;
+  }
+  runs.push({
+    dir,
+    at: report.meta.generatedAt,
+    meta: report.meta,
+    regions: report.regions,
+  });
+}
+
+// The failure mode of a stall detector is always "clear", which is exactly the
+// answer that stops nobody. A corpus this could not read is not a clean one.
+if (runs.length === 0) {
+  console.error(
+    \`strikes: no parseable gate run under matching/ \u2014 refusing to report "clear".\` +
+      (unreadable.length
+        ? \`\\n         \${unreadable.length} report(s) unreadable at schema \${REPORT_SCHEMA}: \${unreadable.slice(0, 5).join(", ")}\`
+        : ""),
+  );
+  process.exit(2);
+}
+if (unreadable.length) {
+  console.error(
+    \`strikes: ignored \${unreadable.length} unreadable report(s) \u2014 the history below is incomplete.\` +
+      \`\\n         \${unreadable.slice(0, 5).join(", ")}\`,
+  );
+}
+
+runs.sort((a, b) => a.at.localeCompare(b.at));
+
+// The gate page KEY, recovered from the run dir the way next.mjs does it
+// (out-<TAG>-<page>, split on the first hyphen \u2014 the tag is hyphen-free by
+// gate.sh's own preflight). \`pageOf\` now returns that same key off the table,
+// so the two vocabularies agree and the round protocol in CLAUDE.md \u2014 "run
+// \`strikes.mjs <page>\` with the key you just passed to gate.sh", which until
+// 2026-08-13 silently matched nothing \u2014 works either way. This stays because
+// a dir key is not always a gate key: 69 of this corpus's 377 run dirs are
+// hand-named probes (out-band3, out-390masked), and FLOORS matches on it.
+const keyOf = (dir) => /^out-[^-]+-(.+)$/.exec(dir)?.[1] ?? null;
+
+// key -> chronological list of {dir, at, mm, pass, masked}
+const history = new Map();
+const seenNames = new Set();
+for (const run of runs) {
+  const page = pageOf(run.meta.ref) ?? keyOf(run.dir) ?? "unknown";
+  const gateKey = keyOf(run.dir);
+  seenNames.add(page);
+  if (gateKey) seenNames.add(gateKey);
+  if (only && page !== only && gateKey !== only) continue;
+  for (const r of run.regions) {
+    // A DECLARED FLOOR is flat by definition \u2014 reporting it as stalled is noise
+    // that hides a real stall. It stays in the LEDGER; it does not belong here.
+    if (FLOORS.some((fl) => fl.match(r, gateKey || page))) continue;
+    const key = \`\${page}|\${r.viewport}|\${r.label}\`;
+    if (!history.has(key)) history.set(key, []);
+    history.get(key).push({
+      dir: run.dir,
+      at: run.at,
+      mm: r.mismatchFraction,
+      dh: r.heightDeltaFraction,
+      pass: r.pass,
+      // a run with masks/neutralised media is not comparable to a clean one
+      dirty:
+        (run.meta.mask?.length ?? 0) > 0 ||
+        run.meta.neutralizeMedia ||
+        run.meta.maskPhotos,
+    });
+  }
+}
+
+// A name that matches no run must NOT report "clear". This check exists to stop
+// work on a stalled region, so failing open is the one thing it may never do \u2014
+// a typo'd or wrong-vocabulary page silently greened rule 3 for six of the nine
+// pages. Fail loud instead, and say what the vocabulary is.
+if (only && history.size === 0) {
+  console.error(
+    \`strikes: "\${only}" matches no gate run \u2014 refusing to report "clear".\\n\` +
+      \`         known pages: \${[...seenNames].sort().join(", ")}\`,
+  );
+  process.exit(2);
+}
+
+const stuck = [];
+for (const [key, all] of history) {
+  const h = all.filter((e) => !e.dirty); // compare like with like
+  if (h.length === 0) continue;
+  const last = h[h.length - 1];
+  if (last.pass) continue;
+
+  let best = Infinity;
+  let strikes = 0;
+  let sinceIdx = 0;
+  for (let i = 0; i < h.length; i++) {
+    if (h[i].mm < best - IMPROVE_PP) {
+      best = Math.min(best, h[i].mm);
+      strikes = 0;
+      sinceIdx = i;
+    } else {
+      best = Math.min(best, h[i].mm);
+      strikes++;
+    }
+  }
+  if (strikes >= MAX_STRIKES) stuck.push({ key, strikes, h, sinceIdx, last });
+}
+
+// Triage order: the worst-matching region that has never moved is the one whose
+// model is most wrong. Sorting by strike count instead would put a 0.3% region
+// that only fails on height above a 76% region that fails on everything.
+stuck.sort((a, b) => b.last.mm - a.last.mm);
+
+if (stuck.length === 0) {
+  console.log(
+    \`strikes: clear \u2014 no failing region has stalled for \${MAX_STRIKES}+ gate runs\` +
+      (only ? \` on \${only}\` : "") +
+      ".",
+  );
+  process.exit(0);
+}
+
+const why = (e) => {
+  const reasons = [];
+  if (e.mm > THRESHOLD) reasons.push(\`pixels \${(e.mm * 100).toFixed(1)}%\`);
+  if (Math.abs(e.dh ?? 0) > MAX_HEIGHT_DELTA)
+    reasons.push(\`height \${((e.dh ?? 0) * 100).toFixed(1)}%\`);
+  return reasons.join(" + ") || "marginal";
+};
+
+console.log(
+  \`STALLED \u2014 \${stuck.length} failing region(s) have not moved in \${MAX_STRIKES}+ gate runs.\\n\` +
+    \`These need a new model or the operator, not another attempt. Worst first:\\n\`,
+);
+for (const { key, strikes, h, sinceIdx, last } of stuck.slice(0, 20)) {
+  const [page, vw, label] = key.split("|");
+  console.log(
+    \`\${page} @\${vw}  "\${label}"  \u2014 \${why(last)}, flat across \${strikes} runs\`,
+  );
+  const window = h.slice(Math.max(0, sinceIdx));
+  const shown = window.length > 4 ? [window[0], ...window.slice(-3)] : window;
+  for (const [i, e] of shown.entries()) {
+    const gap =
+      window.length > 4 && i === 1
+        ? \`    ... \${window.length - 4} more ...\\n\`
+        : "";
+    console.log(
+      gap +
+        \`    \${(e.mm * 100).toFixed(1).padStart(5)}%  \${e.at.slice(0, 16).replace("T", " ")}  \${e.dir}\`,
+    );
+  }
+  console.log();
+}
+if (stuck.length > 20) console.log(\`... and \${stuck.length - 20} more.\\n\`);
+console.log(
+  "Per the matching skill: present the attempts to the operator.\\n" +
+    "Do NOT widen the threshold, add a mask, or reclassify them as a floor.",
+);
+process.exit(1);
+`;
+var BUILD_SPEC_MJS_PREV_0_95_1 = `// Assemble matching/SPEC.md from the per-page sections in spec-sections/.
+//
+//   node matching/build-spec.mjs
+//
+// SPEC.md is the Phase 1 deliverable and the thing matching/gate.sh preflights
+// against, so it is GENERATED rather than hand-maintained: edit the section
+// file, rebuild. The page list comes from matching/harness.mjs (the same
+// reader gate.sh's \`--table\` loop uses) and the heading test from its
+// specHeadingRe, whose pattern is has_spec's grep verbatim \u2014 so a section can
+// no longer build fine here and then re-block its own page at the gate.
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { PAGES, specHeadingRe } from "./harness.mjs";
+
+const DIR = new URL(".", import.meta.url).pathname;
+const SECTIONS = join(DIR, "spec-sections");
+
+// Order = live's nav order, then the detail templates. Both fall out of the
+// table's own order within each group, so this is not a second list to keep.
+const KEYS = [
+  ...PAGES.filter((p) => p.group === "nav"),
+  ...PAGES.filter((p) => p.group !== "nav"),
+].map((p) => p.spec ?? p.key);
+
+const parts = [];
+const missing = [];
+
+const chrome = join(SECTIONS, "_chrome.md");
+if (existsSync(chrome)) parts.push(readFileSync(chrome, "utf8").trim());
+else missing.push("_chrome");
+
+for (const page of KEYS) {
+  const file = join(SECTIONS, \`\${page}.md\`);
+  if (!existsSync(file)) {
+    missing.push(page);
+    continue;
+  }
+  const body = readFileSync(file, "utf8").trim();
+  // The preflight greps \`^##+ +<page>\`; a section that does not open with its
+  // own key would build fine here and then refuse at the gate, which is the
+  // most confusing possible failure. Catch it now.
+  if (!specHeadingRe(page).test(body)) {
+    console.error(
+      \`WARNING: \${page}.md does not open with a '## \${page}' heading \u2014 gate.sh will still refuse this page.\`,
+    );
+  }
+  parts.push(body);
+}
+
+// The header is a spec-section like any other, so a site can say what a
+// citation looks like there and what its own ladders are. DEFAULT_HEADER is
+// what a site gets before it writes one: the two paragraphs that are true of
+// every project, and nothing that is not.
+const DEFAULT_HEADER = \`# Reference spec
+
+GENERATED by \\\`node matching/build-spec.mjs\\\` from \\\`matching/spec-sections/\\\`.
+Edit the section files, not this one.
+
+This is the Phase 1 deliverable of the \\\`matching-a-page\\\` skill and the
+precondition \\\`matching/gate.sh\\\` enforces: a page with no section here does not
+get a geometry round (see the matching rules in CLAUDE.md).
+
+\`;
+const headerFile = join(SECTIONS, "_header.md");
+const header = existsSync(headerFile)
+  ? readFileSync(headerFile, "utf8").trimEnd() + "\\n\\n"
+  : DEFAULT_HEADER;
+
+writeFileSync(join(DIR, "SPEC.md"), header + parts.join("\\n\\n---\\n\\n") + "\\n");
+
+const built = KEYS.length - missing.filter((m) => m !== "_chrome").length;
+console.log(
+  \`SPEC.md built \u2014 \${built}/\${KEYS.length} pages\${missing.length ? \`, MISSING: \${missing.join(", ")}\` : ""}\`,
+);
+process.exit(missing.length ? 1 : 0);
+`;
+var MATCH_ROUTE_SERVER_PREV_0_95_1 = `import { error } from "@sveltejs/kit";
+import { dev } from "$app/environment";
+import { documents } from "$lib/site-pages.js";
+
+// Local matching surface: renders the EXACT assembly \`reddoor-maint
+// prismic-seed\` publishes, from the same module, so a fix made to pass a gate
+// is a fix to what ships. Not prerendered, SSR-on-demand, dev-only.
+export const prerender = false;
+
+// The seed resolves images to asset ids; here they only need a URL. Dimensions
+// are nominal \u2014 slices size their own image boxes in CSS.
+const devImg = (u: string) => ({
+  url: u,
+  alt: null,
+  copyright: null,
+  dimensions: { width: 1600, height: 1067 },
+  edit: { x: 0, y: 0, zoom: 1, background: "transparent" },
+  id: u,
+});
+
+export async function load({ params }) {
+  // FIRST statement: everything below reads fixtures that must not be reachable
+  // from a production build. The launch recipe asserts this route 404s on the
+  // deployed URL, with /dev/a11y-fixtures as the 200 control.
+  if (!dev) error(404, { message: "Not found" });
+
+  const docs = documents(devImg) as Array<{ uid: string; data: { slices?: unknown[] } }>;
+  const doc = docs.find((d) => d.uid === params.uid);
+  if (!doc)
+    error(404, {
+      message: \`no assembly for "\${params.uid}" (have: \${docs.map((d) => d.uid).join(", ") || "none"})\`,
+    });
+
+  return { uid: params.uid, slices: doc.data.slices ?? [] };
+}
+`;
+var SITE_PAGES_TEST_PREV_0_95_1 = `// The page assemblies in src/lib/site-pages.js are the SINGLE source of truth
+// shared by two consumers: the local matching route (src/routes/dev/match/[uid])
+// and \`reddoor-maint prismic-seed\`, which publishes them to Prismic.
+//
+// Those two consumers do NOT validate the same way. The dev route hands the
+// object straight to the slice components, so any field a fixture sets is
+// simply there. The Migration API validates against the slice models registered
+// in Prismic and SILENTLY DROPS every field the model does not declare \u2014 no
+// error, no warning, a 200. A page can gate green locally and publish wrong.
+//
+// This test is the mechanical check. It fails the moment a fixture carries a
+// field its slice model does not declare \u2014 before the seed runs, not after the
+// content is published. Run it before every seed.
+import { describe, expect, it } from "vitest";
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { documents } from "./site-pages.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SLICES = join(HERE, "slices");
+
+type Variation = { primary: string[]; items: string[] };
+type Slice = {
+  slice_type: string;
+  variation: string;
+  primary?: Record<string, unknown>;
+  items?: Array<Record<string, unknown>>;
+};
+
+/** Every slice model in src/lib/slices, indexed by its Prismic slice id. */
+function loadModels(): Record<string, Record<string, Variation>> {
+  const out: Record<string, Record<string, Variation>> = {};
+  if (!existsSync(SLICES)) return out;
+  for (const dir of readdirSync(SLICES)) {
+    const file = join(SLICES, dir, "model.json");
+    if (!existsSync(file)) continue;
+    const model = JSON.parse(readFileSync(file, "utf8"));
+    out[model.id] = Object.fromEntries(
+      (model.variations ?? []).map((v: Record<string, unknown>) => [
+        v.id,
+        {
+          primary: Object.keys((v.primary as object) ?? {}),
+          items: Object.keys((v.items as object) ?? {}),
+        },
+      ]),
+    );
+  }
+  return out;
+}
+
+/** Image resolver stub \u2014 shape only; this test never reads image values. */
+const stubImg = () => ({ url: "https://example.test/x.jpg" });
+
+describe("site-pages documents vs slice models", () => {
+  const models = loadModels();
+  const docs = documents(stubImg) as Array<{ uid: string; data: { slices?: Slice[] } }>;
+  const pages: Array<[string, Slice[]]> = docs.map((d) => [d.uid, d.data.slices ?? []]);
+
+  it("declares every slice type the documents use", () => {
+    const missing = new Set<string>();
+    for (const [, slices] of pages)
+      for (const s of slices) if (!models[s.slice_type]) missing.add(s.slice_type);
+    expect([...missing]).toEqual([]);
+  });
+
+  it("declares every variation the documents use", () => {
+    const missing: string[] = [];
+    for (const [uid, slices] of pages)
+      for (const s of slices) {
+        const model = models[s.slice_type];
+        if (model && !model[s.variation]) missing.push(\`\${uid}: \${s.slice_type}/\${s.variation}\`);
+      }
+    expect(missing).toEqual([]);
+  });
+
+  // The one that catches a silent Migration-API drop.
+  it("declares every field the documents set, so Prismic strips nothing", () => {
+    const stripped: string[] = [];
+    for (const [uid, slices] of pages)
+      for (const s of slices) {
+        const variation = models[s.slice_type]?.[s.variation];
+        if (!variation) continue;
+        for (const key of Object.keys(s.primary ?? {}))
+          if (!variation.primary.includes(key))
+            stripped.push(\`\${uid} \${s.slice_type}/\${s.variation} primary.\${key}\`);
+        const itemKeys = new Set((s.items ?? []).flatMap((i) => Object.keys(i)));
+        for (const key of itemKeys)
+          if (!variation.items.includes(key))
+            stripped.push(\`\${uid} \${s.slice_type}/\${s.variation} items.\${key}\`);
+      }
+    expect(stripped).toEqual([]);
+  });
+});
+`;
+var MATCH_HARNESS_PREVIOUS = {
+  "matching/harness.mjs": [HARNESS_MJS_PREV_0_95_0, HARNESS_MJS_PREV_0_95_1],
+  "matching/gate.sh": [GATE_SH_PREV_0_95_0],
+  "matching/next.mjs": [NEXT_MJS_PREV_0_95_0, NEXT_MJS_PREV_0_95_1],
+  "matching/census.sh": [CENSUS_SH_PREV_0_95_1],
+  "matching/strikes.mjs": [STRIKES_MJS_PREV_0_95_1],
+  "matching/build-spec.mjs": [BUILD_SPEC_MJS_PREV_0_95_1],
+  "src/routes/dev/match/[uid]/+page.server.ts": [MATCH_ROUTE_SERVER_PREV_0_95_1],
+  "src/lib/site-pages.test.ts": [SITE_PAGES_TEST_PREV_0_95_1]
+};
+var MATCH_HARNESS_COUPLED = [
+  "matching/harness.mjs",
+  "matching/gate.sh",
+  "matching/census.sh",
+  "matching/next.mjs",
+  "matching/strikes.mjs",
+  "matching/build-spec.mjs"
+];
+var UNGUARDED_TWIN_TELL = "reddoor-match-twin:no-assembly";
+var GITIGNORE_MARKER = "# reddoor-maint match-harness: scripts + records tracked, workspace ignored";
+var GITIGNORE_BLOCK = `scratch-diff*/
+matching/*
+!matching/*.sh
+!matching/*.mjs
+!matching/*.md
+# The pause switch. Extensionless on purpose (it is a sentinel, not a doc), so
+# the whitelist above misses it \u2014 and an ignored switch is not a switch: it
+# would work on one machine and be absent from every fresh clone, CI run and
+# agent that most needs to see it.
+!matching/PAUSED
+!matching/spec-sections/
+!matching/states/
+matching/states/*
+!matching/states/*.mjs
+# derived artefacts, even where the extensions above would catch them
+matching/*.log
+matching/*.json
+# ...except the page table itself, which is the harness's configuration and the
+# one thing a fresh clone cannot reconstruct.
+!matching/harness.json
+matching/*.png
+`;
+var PRETTIERIGNORE_MARKER = "# reddoor-maint match-harness";
+var PRETTIERIGNORE_BLOCK = `# Matching harness \u2014 every file the \`match-harness\` recipe OWNS. It installs
+# them byte-for-byte and byte-compares them on the next install, so a site whose
+# prettier config differs must not reformat them: a reformatted file is
+# indistinguishable from a hand edit, and the recipe refuses to overwrite a hand
+# edit. Measured on a \`useTabs\`/\`singleQuote\` site, all three src/ entries
+# below are rewritten by \`prettier --write .\`, and the next upgrade is refused
+# for all three.
+#
+# The bracketed route segment MUST stay backslash-escaped. This file is
+# gitignore glob syntax, in which \`[uid]\` is a CHARACTER CLASS matching one of
+# \`u\`, \`i\`, \`d\` \u2014 an unescaped entry silently ignores nothing at all.
+#
+# \`matching/*.mjs\` also catches two SITE-owned records (floors.mjs,
+# census-deviations.mjs). Accepted, not overlooked: eslint lints .mjs, so those
+# two keep a style check either way, and naming seven scripts instead of one
+# glob goes stale on the next script the harness gains.
+#
+# harness.json is here because it is a TABLE, not prose: it carries a
+# hand-chosen row layout that prettier reflows.
+#
+# Everything else under matching/ (SPEC.md, LEDGER.md, spec-sections/,
+# states/*.mjs) stays inside \`prettier --check .\`. That is deliberately narrow:
+# eslint does not lint Markdown, so for the records prettier is the ONLY style
+# check there is, and a blanket \`matching/\` entry would leave them with none.
+matching/*.mjs
+matching/*.sh
+matching/harness.json
+src/routes/dev/match/\\[uid\\]/+page.server.ts
+src/routes/dev/match/\\[uid\\]/+page.svelte
+src/lib/site-pages.test.ts
+`;
+var CLAUDE_MD_MARKER = "## Matching rules (installed by reddoor-maint match-harness)";
+var CLAUDE_MD_BLOCK = `
+The \`matching-a-page\` skill governs a live-reference rebuild. These five rules
+exist because the skill alone did not hold on the project this harness came
+from \u2014 each one is a drift that actually happened, with the mechanical check
+that now catches it. \`matching/harness.json\` is this site's configuration;
+\`matching/LEDGER.md\` is the dated record of every deviation, floor and mask.
+
+### 1. Source prescribes, rects only verify
+
+Every geometry fix must cite the rule it came from: a line in the captured
+reference stylesheet under \`matching/spec/\`, or the reference's HTML. "The probe
+says the gap is 40px" is not a source. If you cannot name the line you are
+guessing \u2014 go read the stylesheet first.
+
+**Check:** the commit body must name the file:line for each fix.
+**Operator's challenge:** _"which line of the reference stylesheet says that?"_
+
+### 2. Phase 1 before Phase 4
+
+A page gets its section census and per-section spec in \`matching/SPEC.md\` BEFORE
+its geometry is touched. No SPEC section, no geometry round. The census is the
+coverage denominator; skipping it is how a reference's root-font ladder and its
+per-component height ladders get discovered reactively, after the region has
+already failed several rounds.
+
+**Check:** \`matching/gate.sh\` refuses to run a page with no \`SPEC.md\` section.
+**Operator's challenge:** _"show me the SPEC section for that region."_
+
+### 3. Three strikes, then stop
+
+A failing region that has not improved across 3+ gate runs does not get a fourth
+attempt. Present the attempts. Never widen the threshold, add a mask, or
+reclassify it as a floor to make it go away.
+
+**Check:** \`node matching/strikes.mjs <page>\` \u2014 exits 1 while any region is
+stalled, and is the first thing a geometry round runs.
+**Operator's challenge:** _"how many runs has that region been flat?"_
+
+### 4. A gate closes an item, nothing else
+
+No fix is "done" because the code changed. Paste the gate header \u2014 it is
+self-describing, so a nonstandard threshold or an undisclosed mask is visible.
+The threshold and the matrix are whatever \`matching/harness.json\` says, on every
+page, never a subset.
+
+**Check:** \`bash matching/census.sh <page>\` exits 0 \u2014 the Phase 3 style gate,
+and the only one that sees an 11px footer line or a cyan-vs-teal link the pixel
+diff is structurally blind to. A remaining row is fixed at its source or
+declared in \`matching/census-deviations.mjs\` with a LEDGER line, never ignored.
+**Operator's challenge:** _"paste the gate header."_
+
+### 5. A commit is a checkpoint, not a stopping point
+
+Do not hand control back between rounds. After committing, run
+\`node matching/next.mjs\`: while it exits 1 there is a named next action, and the
+round continues. Report when the backlog is empty, when a decision is genuinely
+the operator's (three strikes, a novel floor, a threshold change), or when
+asked \u2014 not because a commit felt like a natural place to summarise.
+
+This exists because the failure was habitual, not deliberate: a turn ends when
+user-facing prose gets written, and "I just committed something good" is the
+moment that invites writing it. The gate stops incorrect work; this stops
+premature stopping.
+
+**Pausing:** create \`matching/PAUSED\` holding a note that says what the pause
+means; \`next.mjs\` and \`strikes.mjs\` then exit 0 while it exists. This rule says
+"do not stop while work is named"; it never said "find work to name". An empty
+agenda and a paused one end the round the same way. Deleting the switch is the
+operator's call.
+
+**Check:** \`node matching/next.mjs\` \u2014 exits 1 while any non-floor region fails.
+**Operator's challenge:** _"what does next.mjs say?"_
+
+### Round protocol
+
+1. \`node matching/strikes.mjs <page>\` \u2014 if it exits 1, the stalled regions are
+   the agenda, and stalled ones get escalated rather than re-attempted.
+2. Confirm the page has a \`matching/SPEC.md\` section; write
+   \`matching/spec-sections/<page>.md\` and run \`node matching/build-spec.mjs\` if
+   not.
+3. Fix, each change citing its source line.
+4. \`bash matching/gate.sh <tag> <page>\` \u2014 paste the header.
+5. \`bash matching/census.sh <page>\` \u2014 exits 0 or the round is not closed; a
+   remaining row is fixed at its source or declared with a LEDGER line.
+6. Append to \`matching/LEDGER.md\` at the moment a deviation, floor or mask is
+   decided, not reconstructed at the end.
+7. \`pnpm verify\`, then commit and push.
+`;
+
+export {
+  HARNESS_JSON_RELATIVE,
+  MATCH_HARNESS_FILES,
+  MATCH_HARNESS_PREVIOUS,
+  MATCH_HARNESS_COUPLED,
+  UNGUARDED_TWIN_TELL,
+  GITIGNORE_MARKER,
+  GITIGNORE_BLOCK,
+  PRETTIERIGNORE_MARKER,
+  PRETTIERIGNORE_BLOCK,
+  CLAUDE_MD_MARKER,
+  CLAUDE_MD_BLOCK
+};
+//# sourceMappingURL=chunk-Y6FCXRIC.js.map