@techierathore/techieflow 1.0.4 → 1.1.1

package/.tfcore/utils/tf-harness.sh

@@ -48,13 +48,18 @@ _detect() {
   fi
   local k
   for k in $(compgen -v | grep '^OPENCODE' 2>/dev/null); do printf 'opencode'; return; done
-  # /proc ancestry walk (Linux/WSL); bounded
+  # ancestry walk, bounded: /proc on Linux/WSL, ps where there is no /proc (macOS)
   local pid=$PPID name ppid seen=0 stat
   while [[ -n "$pid" && "$pid" -gt 1 && $seen -lt 12 ]]; do
     seen=$((seen + 1))
-    stat="$(cat /proc/$pid/stat 2>/dev/null)" || break
-    name="${stat#*(}"; name="${name%%)*}"
-    ppid="$(printf '%s' "${stat##*) }" | awk '{print $2}')"
+    if [[ -d /proc/self ]]; then
+      stat="$(cat /proc/$pid/stat 2>/dev/null)" || break
+      name="${stat#*(}"; name="${name%%)*}"
+      ppid="$(printf '%s' "${stat##*) }" | awk '{print $2}')"
+    else
+      ppid="$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ')"; [[ -n "$ppid" ]] || break
+      name="$(ps -o comm= -p "$pid" 2>/dev/null)"; name="${name##*/}"
+    fi
     case "$name" in
       *opencode*) printf 'opencode'; return ;;
       *claude*)   printf 'claude-code'; return ;;

package/.tfcore/utils/tf-lock.sh

@@ -0,0 +1,29 @@
+# tf-lock.sh — one build or browser check at a time per repository. Sourced, not run.
+#   source "$HERE/tf-lock.sh"; tf_take_lock <label>     waits for the lock, then holds it until exit
+# A directory, because mkdir is atomic on every drive this runs on. A lock whose process has gone
+# is taken over. A script started by the holder (tf-verify-tests.sh running tf-build.sh) shares it
+# through TF_REPO_LOCK_PID. TF_BUILD_LOCK_MAX seconds to wait (1800). (TF-043, TfLens TF-048)
+TF_LOCK="tests/.artifacts/build/.lock"
+tf_release_lock() { [[ "$(cut -d' ' -f1 "$TF_LOCK/owner" 2>/dev/null)" == "$$" ]] && rm -rf "$TF_LOCK"; }
+tf_take_lock() {
+  local label="${1:-}" waited=0 max="${TF_BUILD_LOCK_MAX:-1800}" said=0 owner opid ohost
+  if [[ -n "${TF_REPO_LOCK_PID:-}" ]] && kill -0 "$TF_REPO_LOCK_PID" 2>/dev/null; then return 0; fi
+  mkdir -p "$(dirname "$TF_LOCK")"
+  while ! mkdir "$TF_LOCK" 2>/dev/null; do
+    owner="$(cat "$TF_LOCK/owner" 2>/dev/null)"; opid="$(cut -d' ' -f1 <<<"$owner")"; ohost="$(cut -d' ' -f2 <<<"$owner")"
+    if [[ -z "$owner" ]]; then
+      [[ -n "$(find "$TF_LOCK" -maxdepth 0 -mmin +1 2>/dev/null)" ]] && { rm -rf "$TF_LOCK"; continue; }
+    elif [[ "$ohost" == "$(hostname)" ]] && ! kill -0 "$opid" 2>/dev/null; then
+      rm -rf "$TF_LOCK"; continue
+    fi
+    [[ $said -eq 0 ]] && { echo "wait  another build or browser check is running in this repository (${owner:-starting}); this one starts when it finishes" >&2; said=1; }
+    if [[ $waited -ge $max ]]; then
+      echo "NOT-RUN another build or browser check held this repository for $((max / 60)) minutes ($owner). If nothing is running, remove $TF_LOCK and run again. Not a code error"
+      exit 2
+    fi
+    sleep 3; waited=$((waited + 3))
+  done
+  echo "$$ $(hostname) $label $(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$TF_LOCK/owner"
+  export TF_REPO_LOCK_PID=$$
+  trap tf_release_lock EXIT
+}

package/.tfcore/utils/tf-log-miss.py

@@ -16,7 +16,8 @@ re-logged; a null why_missed or sort on it is completed with --amend); the origi
 (tf-emit.sh --origin-of); the miss record with the sentence as `what` and the sort; the checklist line
 (the row demoted to Needs re-verify with "⚠ miss <date>: <sentence>", or a new Not Started row with
 BRD-pending when nothing owns it; nothing when the repo has no checklist); with --fixed, a miss-fix
-record instead of a demotion; then the run record (cmd log-miss). The emitter rewrites the readable
+record instead of a demotion; then the run record (cmd log-miss) — none when another command is
+running, because that command's own record covers the time (TF-029). The emitter rewrites the readable
 docs/<App>-Misses.md. Prints the report block. Exit 0 · 2 could not run.
 """
 import datetime
@@ -91,11 +92,31 @@ def main(argv):
     found_by = opt(argv, "--found-by", "owner")
     fixed = "--fixed" in argv
     started = opt(argv, "--started") or ""
+    now = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    # The command whose run record covers this time. Called inside another command (*amend-docs
+    # step 10), that command's record covers it, so this script writes none: a log-miss run over
+    # the enclosing command's window made the enclosing record overlap and be refused (TF-029).
+    # A marker older than 24 h belongs to a session that died, and is ignored as every reader does.
+    running = "log-miss"
     if not started:
+        # The marker's own cmd and started, never its "outer" block: a command started after another
+        # one keeps that one as "outer", written first, and a first-match read took it for this one
+        # (TF-052 follow-up: log-miss after *triage-issues wrote no run record).
         mk = subprocess.run(["bash", os.path.join(HERE, "tf-phase.sh"), "show"], capture_output=True, text=True).stdout
-        m = re.search(r'"started":"([^"]*)"', mk)
-        started = m.group(1) if m else datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-    now = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+        try:
+            marker = json.loads(mk) if mk.strip().startswith("{") else {}
+        except ValueError:
+            marker = {}
+        m_started, m_cmd = marker.get("started") or "", marker.get("cmd") or ""
+        try:
+            age = (datetime.datetime.now(datetime.timezone.utc)
+                   - datetime.datetime.strptime(m_started, "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=datetime.timezone.utc))
+            fresh = age < datetime.timedelta(hours=24)
+        except ValueError:
+            fresh = False
+        started = m_started if fresh else now
+        if fresh and m_cmd and m_cmd not in ("log-miss", "goal"):
+            running = m_cmd
 
     spec = importlib.util.spec_from_file_location("tf_checklist_edit", os.path.join(HERE, "tf-checklist-edit.py"))
     ce = importlib.util.module_from_spec(spec)
@@ -165,10 +186,14 @@ def main(argv):
         fix_ok, _ = emit("misses", fr)
         fix_line = ("closed in the same run" + (f" against run {fr['fix_run_id']}" if "fix_run_id" in fr else " (fix run unknown: costed none)")) if fix_ok else "miss-fix not written"
 
-    # 5. the run record
-    run = {"kind": "run", "app": app, "cmd": "log-miss", "mode": None, "started": started, "ended": now,
-           "reqs_touched": [req] if req else [], "reqs_count": 1 if req else 0, "subagents": [], "files_written": 1 if has_cl else 0, "build_result": "not-run"}
-    emit("runs", run)
+    # 5. the run record — only when log-miss is the command running
+    if running == "log-miss":
+        run = {"kind": "run", "app": app, "cmd": "log-miss", "mode": None, "started": started, "ended": now,
+               "reqs_touched": [req] if req else [], "reqs_count": 1 if req else 0, "subagents": [], "files_written": 1 if has_cl else 0, "build_result": "not-run"}
+        emit("runs", run)
+        run_line = f"log-miss, {started} to {now}"
+    else:
+        run_line = f"none written — the running *{running}'s own record covers this time"
 
     if not ok:
         print(f"# Miss NOT recorded — {app}")
@@ -189,6 +214,7 @@ def main(argv):
     print(f"Docs       : {doc_line}; docs/{app}-Misses.md rewritten")
     if fix_line:
         print(f"Fix        : {fix_line}")
+    print(f"Run record : {run_line}")
     print(f"Next       : *fix-issues {app}" + (f" {req}" if req and not fixed else ""))
     return 0
 

package/.tfcore/utils/tf-login.mjs

@@ -0,0 +1,167 @@
+// TechieFlow — the one sign-in recipe the browser-driven checks share (AppManager TF-011, 2026-09-14).
+//
+// tf-verify-screens.mjs learned to sign in through a page's own form (TF-033, TF-044) and to reach a
+// screen whose document answers 401 because the sign-in lives in the page, not in a cookie
+// (AppManager TF-006). tf-mockup-parity.mjs and tf-assets took only --cookie, so on such an app they
+// could not get past the sign-in at all. The recipe lives here so every check reaches a screen the
+// same way, and a lesson learned in one is learned in all.
+//
+//   signIn(page, o)          -> { attempted, ok, url, attempts, error }
+//   signedOut(page, o)       -> true when the page is the sign-in page
+//   navigateInApp(page, o, route) -> true when the page drew something different
+//   reach(page, o, route)    -> { status, url, reached, signedOut, error }: open a route, signed in
+//
+// o = { base, loginPath, user, password, attr = 'data-testid', settle = 1500, renderWait = 5000 }
+
+// The first visible, usable match, trying the selectors IN ORDER. `.first()` over one selector list
+// takes whichever match comes first in the page, so `input[type="text"]` at the end of the list
+// picked a header search box standing before the email field (TF-044).
+export async function pick(scope, selectors) {
+  for (const sel of selectors) {
+    const c = scope.locator(sel).first();
+    if (await c.count() && await c.isVisible().catch(() => false)) return c;
+  }
+  return null;
+}
+
+const LOGIN_ATTEMPTS = 4;
+const opts = (o) => ({ attr: 'data-testid', settle: 1500, renderWait: 5000, ...o, base: (o.base || '').replace(/\/$/, '') });
+
+export async function signIn(page, o) {
+  const { base, loginPath, user, password, attr, settle } = opts(o);
+  if (!loginPath || !user) return { attempted: false };
+  const onLogin = () => page.url().startsWith(base + loginPath);
+  try {
+    await page.goto(base + loginPath, { waitUntil: 'domcontentloaded', timeout: 30000 });
+    await page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
+    // a page that draws its form a moment after it arrives has no field to pick yet
+    await page.waitForSelector('input', { state: 'visible', timeout: 15000 }).catch(() => {});
+    const INPUT = ':is(input, textarea)';
+    const USER_FIELD = [`${INPUT}[${attr}*="email" i]`, `${INPUT}[${attr}*="user" i]`, 'input[type="email"]', 'input[autocomplete="username"]',
+                        'input[name*="email" i]', 'input[name*="user" i]', 'input[id*="email" i]', 'input[id*="user" i]', 'form input[type="text"]'];
+    const PASS_FIELD = ['input[type="password"]', `${INPUT}[${attr}*="pass" i]`];
+    // The button, never a field: "login-email" and "login-pass" contain "login" too, and taking the
+    // first test id with "login" in it clicked the email box, so sign-in never submitted (TF-033).
+    const BTN = `:is(button, a, [role="button"], input[type="submit"], input[type="button"])`;
+    const BUTTON = ['button[type="submit"]', 'input[type="submit"]', `${BTN}[${attr}*="submit" i]`, `${BTN}[${attr}*="signin" i]`,
+                    `${BTN}[${attr}*="sign-in" i]`, `${BTN}[${attr}*="login" i]`, 'button'];
+    // A page drawn on the server first and made interactive a moment later replaces its fields when
+    // it becomes interactive: what was typed before that is gone, and a press before it does nothing.
+    // Waiting for the network proves neither, and every stack takes its own time. So the test is the
+    // result: the typed values are still in the fields when the button is pressed, and the page then
+    // leaves the sign-in address. Otherwise type again and press again. TfLens, 2026-09-12: the email
+    // read back empty the instant after it was typed, and the second attempt signed in (TF-044).
+    let why = 'the typed values did not stay in the fields';
+    for (let attempt = 1; attempt <= LOGIN_ATTEMPTS; attempt++) {
+      if (!onLogin()) break;
+      const u = await pick(page, USER_FIELD);
+      if (!u) return { attempted: true, ok: false, error: 'no user or email field found on the sign-in page' };
+      const p = await pick(page, PASS_FIELD);
+      try {
+        await u.fill(user, { timeout: 10000 });
+        if (p) await p.fill(password || '', { timeout: 10000 });
+        await page.waitForTimeout(400);
+        const kept = (await u.inputValue()) === user && (!p || (await p.inputValue()) === (password || ''));
+        if (!kept) { why = 'the typed values did not stay in the fields'; continue; }
+        const form = u.locator('xpath=ancestor::form[1]');
+        const btn = (await form.count() ? await pick(form, BUTTON) : null) || await pick(page, BUTTON);
+        if (!btn) return { attempted: true, ok: false, error: 'no sign-in button found (a submit button, or a button whose test id says submit, signin or login)' };
+        await btn.click({ timeout: 10000 });
+        await page.waitForURL((x) => !x.href.startsWith(base + loginPath), { timeout: 6000 }).catch(() => {});
+        why = 'the form was submitted with the values in place and the page stayed on the sign-in address';
+      } catch (e) {
+        if (onLogin()) why = e.message.split('\n')[0];
+      }
+      if (!onLogin()) {
+        await page.waitForLoadState('networkidle', { timeout: 15000 }).catch(() => {});
+        await page.waitForTimeout(settle);
+        return { attempted: true, ok: true, url: page.url(), attempts: attempt };
+      }
+    }
+    if (!onLogin()) return { attempted: true, ok: true, url: page.url(), attempts: 1 };
+    return { attempted: true, ok: false, url: page.url(), attempts: LOGIN_ATTEMPTS, error: `still on the sign-in page after ${LOGIN_ATTEMPTS} attempts: ${why}` };
+  } catch (e) {
+    return { attempted: true, ok: false, error: e.message.split('\n')[0] };
+  }
+}
+
+// The page is signed out when it sits on the sign-in address, or when it draws a sign-in form: a
+// password field WITH a button that says sign in / log in beside it. A password field alone is not
+// the sign-in page — AppManager's signed-in "Create user" form has one for the new account, and
+// reading it as the sign-in page graded that screen unreachable (AppManager TF-012).
+export async function signedOut(page, o) {
+  const { loginPath, attr } = opts(o);
+  try {
+    if (loginPath && new URL(page.url()).pathname.startsWith(loginPath)) return true;
+    const pw = page.locator('input[type="password"]').first();
+    if (!(await pw.count()) || !(await pw.isVisible().catch(() => false))) return false;
+    const form = pw.locator('xpath=ancestor::form[1]');
+    const scope = (await form.count()) ? form : page;
+    const BTN = ':is(button, a, [role="button"], input[type="submit"], input[type="button"])';
+    const said = scope.locator(`${BTN}:visible`).filter({ hasText: /^\s*(sign\s*in|log\s*in|login|signin)\s*$/i }).first();
+    if (await said.count()) return true;
+    const named = scope.locator(`${BTN}[${attr}*="signin" i], ${BTN}[${attr}*="sign-in" i], ${BTN}[${attr}*="login" i]`).first();
+    return (await named.count()) > 0 && (await named.isVisible().catch(() => false));
+  } catch (e) { return true; }
+}
+
+// Open a route from inside the page, the way its own links do, so a sign-in held by the page survives.
+// It counts only when the page drew something different: a server-drawn page has no router to answer
+// the event, and grading the page it was already on under another screen's name would be a false pass.
+export async function navigateInApp(page, o, route) {
+  const { settle } = opts(o);
+  try {
+    const before = await page.evaluate(() => document.body ? document.body.innerText : '');
+    await page.evaluate((r) => { history.pushState({}, '', r); window.dispatchEvent(new PopStateEvent('popstate', { state: {} })); }, route);
+    await page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
+    await page.waitForTimeout(settle);
+    const after = await page.evaluate(() => document.body ? document.body.innerText : '');
+    return after !== before;
+  } catch (e) { return false; }
+}
+
+// Wait for the page to draw something: an anchored control, text, or a form control (TF-021).
+export async function waitForRender(page, o, anchors = []) {
+  const { attr, renderWait } = opts(o);
+  if (renderWait <= 0) return 0;
+  const t0 = Date.now();
+  try {
+    await page.waitForFunction(({ anchors, attr }) => {
+      if (anchors && anchors.length) return anchors.some((id) => document.querySelector(`[${attr}="${CSS.escape(id)}"]`));
+      return (document.body && (document.body.innerText || '').trim().length > 0)
+        || document.querySelectorAll('input, select, textarea, img, svg, canvas, video').length > 0;
+    }, { anchors, attr }, { timeout: renderWait, polling: 100 });
+  } catch (e) { /* nothing appeared in time: grade what is there */ }
+  return Date.now() - t0;
+}
+
+// Open a route signed in. The document of a signed-in screen may answer 401 or 403 when the sign-in
+// lives in the page's own connection and not in a cookie (AppManager TF-006): then the page is judged
+// by what it draws. Signed in, the screen is reached and `reached` says how. Still signed out, the
+// tool signs in again and opens the screen from inside the page. Returns the status to grade on:
+// 200 when the page drew the screen signed in, whatever the document answered.
+export async function reach(page, o, route) {
+  const { base, loginPath, user, settle } = opts(o);
+  let status = 0, url = '', error = '';
+  try {
+    const resp = await page.goto(base + route, { waitUntil: 'domcontentloaded', timeout: 30000 });
+    await page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
+    await page.waitForTimeout(settle);
+    status = resp ? resp.status() : 0; url = page.url();
+  } catch (e) { return { status: 0, url: '', reached: '', signedOut: false, error: e.message.split('\n')[0] }; }
+  const out = { status, document_status: status, url, reached: '', signedOut: false, error };
+  if (loginPath && user && (status === 401 || status === 403)) {
+    await waitForRender(page, o);
+    let how = `answered HTTP ${status}, then drew the screen signed in`;
+    if (await signedOut(page, o)) {
+      how = '';
+      const again = await signIn(page, o);
+      if (again.ok && await navigateInApp(page, o, route) && !(await signedOut(page, o))) how = `answered HTTP ${status}; opened from inside the page after signing in`;
+    }
+    if (how) { out.reached = how; out.status = 200; out.url = page.url(); }
+    else out.signedOut = true;
+  } else if (loginPath && url && new URL(url).pathname.startsWith(loginPath) && !route.startsWith(loginPath)) {
+    out.signedOut = true;
+  }
+  return out;
+}

package/.tfcore/utils/tf-maccatalyst-check.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# tf-maccatalyst-check.sh — the Mac Catalyst rules a MAUI project must meet before its Mac app can
+# start (coding-standards-dotnet.md §9; 2026-10-07). Reads files only: runs the same on Windows (WSL,
+# Git Bash), Linux and a Mac, so a team without a Mac finds these before the Mac build does.
+#
+#   bash .tfcore/utils/tf-maccatalyst-check.sh [<csproj> ...]   (default: every project with a
+#                                                                net*-maccatalyst target)
+#
+# FAIL  the scene manifest: Platforms/MacCatalyst/Info.plist has no UIApplicationSceneManifest, or
+#       names a scene delegate no class in the project registers as a MauiUISceneDelegate. On
+#       macOS 27 such an app quits at its first window (the stock `dotnet new maui` template has none).
+# WARN  the keychain: an entitlements file asks for keychain-access-groups and the project names no
+#       provisioning profile and no Debug entitlements file without it. macOS refuses to start a
+#       locally signed (ad hoc) build that asks for it ("Launch failed", POSIX 163).
+# WARN  zoom (§9b): a project drawing its screens in a BlazorWebView, Mac or Windows head, whose code has
+#       no zoom wiring for that head: Mac, WKWebView.PageZoom and a "Zoom In" menu command; Windows,
+#       WebView2's IsZoomControlEnabled set by the app; either, the level kept through Preferences. Copy
+#       .tfcore/standards/blazor-zoom.cs.txt. A WARN, so tf-verify-boot.sh still boots such a head.
+# Prints one line per finding and an OK line per clean project. A Windows-only MAUI project is read
+# for the zoom rule alone.
+# Exit 0 no FAIL (WARNs allowed) · 1 a FAIL · 3 usage.
+set -u
+case "${1:-}" in -h|--help) sed -n '2,22p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;; esac
+
+PROJECTS=("$@")
+if [[ ${#PROJECTS[@]} -eq 0 ]]; then
+  while IFS= read -r p; do PROJECTS+=("$p"); done < <(
+    find . -maxdepth 5 -name '*.csproj' -not -path '*/bin/*' -not -path '*/obj/*' -not -path '*/node_modules/*' \
+         -not -path './tests/.artifacts/*' 2>/dev/null | sed 's#^\./##' | sort)
+fi
+fails=0; seen=0
+for P in ${PROJECTS[@]+"${PROJECTS[@]}"}; do
+  [[ -f "$P" ]] || { echo "tf-maccatalyst-check: $P does not exist" >&2; exit 3; }
+  grep -qiE '<UseMaui>[[:space:]]*true|Microsoft\.NET\.Sdk\.Maui' "$P" || continue
+  mac=0; win=0
+  grep -qE 'net[0-9.]+-maccatalyst' "$P" && mac=1
+  grep -qE 'net[0-9.]+-windows' "$P" && win=1
+  [[ $mac -eq 1 || $win -eq 1 ]] || continue
+  seen=$((seen+1)); D="$(dirname "$P")"; M="$D/Platforms/MacCatalyst"; found=0
+  # --- zoom in a Blazor Hybrid head (§9b): read before the Mac-only rules, which a Windows-only project skips
+  CODE=(-rqs --include='*.cs' --exclude-dir=bin --exclude-dir=obj)
+  if grep "${CODE[@]}" --include='*.xaml' -E '<BlazorWebView|new BlazorWebView' "$D" \
+     || grep -qs 'Microsoft.AspNetCore.Components.WebView.Maui' "$P"; then
+    heads=()
+    if [[ $mac -eq 1 ]] && ! { grep "${CODE[@]}" 'PageZoom' "$D" && grep "${CODE[@]}" '"Zoom In"' "$D"; }; then heads+=("Mac (no WKWebView.PageZoom and View › Zoom In)"); fi
+    if [[ $win -eq 1 ]] && ! grep "${CODE[@]}" 'IsZoomControlEnabled' "$D"; then heads+=("Windows (WebView2's zoom not handled)"); fi
+    if [[ ${#heads[@]} -eq 0 ]] && ! grep -rlis --include='*.cs' --exclude-dir=bin --exclude-dir=obj 'zoom' "$D" | xargs grep -ls 'Preferences' >/dev/null 2>&1; then heads+=("the level is not kept in Preferences"); fi
+    if [[ ${#heads[@]} -gt 0 ]]; then
+      echo "WARN $P: a Blazor Hybrid head without OS zoom: $(IFS=';'; echo "${heads[*]}" | sed 's/;/; /g'). Cmd/Ctrl+=, -, 0 must zoom 50% to 300% and keep the level; copy .tfcore/standards/blazor-zoom.cs.txt (coding-standards-dotnet.md §9b)"
+      found=1
+    fi
+  fi
+  if [[ $mac -eq 0 ]]; then
+    [[ $found -eq 0 ]] && echo "OK   $P: zoom wired (no Mac Catalyst target)"
+    continue
+  fi
+  # --- the scene manifest and its delegate
+  PL="$M/Info.plist"
+  if [[ ! -f "$PL" ]]; then
+    echo "FAIL $P: $PL is missing"; fails=$((fails+1)); found=1
+  elif ! grep -q 'UIApplicationSceneManifest' "$PL"; then
+    echo "FAIL $P: $PL has no UIApplicationSceneManifest; on macOS 27 the app quits at its first window. Add the manifest and a SceneDelegate : MauiUISceneDelegate (coding-standards-dotnet.md §9)"
+    fails=$((fails+1)); found=1
+  else
+    # the delegate the manifest names: the <string> after UISceneDelegateClassName
+    DEL="$(tr -d '\n\r' < "$PL" | grep -oE '<key>UISceneDelegateClassName</key>[[:space:]]*<string>[^<]+' | head -1 | sed 's/.*<string>//')"
+    if [[ -n "$DEL" ]] && ! grep -rqsE "Register\(\"$DEL\"\)" "$D" --include='*.cs'; then
+      echo "FAIL $P: Info.plist names the scene delegate $DEL, and no class in the project carries [Register(\"$DEL\")] (a class deriving from MauiUISceneDelegate)"
+      fails=$((fails+1)); found=1
+    elif [[ -n "$DEL" ]] && ! grep -rqs 'MauiUISceneDelegate' "$D" --include='*.cs'; then
+      echo "FAIL $P: [Register(\"$DEL\")] is there, but no class derives from MauiUISceneDelegate"
+      fails=$((fails+1)); found=1
+    fi
+  fi
+  # --- the keychain permission on a locally signed build
+  ENTS=()
+  while IFS= read -r e; do [[ -n "$e" ]] && ENTS+=("$D/$(tr '\\' '/' <<<"$e")"); done < <(
+    grep -oE '<CodesignEntitlements[^>]*>[^<]+' "$P" | sed 's/<CodesignEntitlements[^>]*>//')   # a Condition= one too
+  [[ ${#ENTS[@]} -eq 0 && -f "$M/Entitlements.plist" ]] && ENTS=("$M/Entitlements.plist")
+  with=0; without=0
+  for e in ${ENTS[@]+"${ENTS[@]}"}; do
+    [[ -f "$e" ]] || continue
+    if grep -q 'keychain-access-groups' "$e"; then with=1; else without=1; fi
+  done
+  if [[ $with -eq 1 && $without -eq 0 ]] && ! grep -q '<CodesignProvisioningProfile>' "$P"; then
+    echo "WARN $P: the entitlements ask for keychain-access-groups and the project names no provisioning profile; macOS will not start a locally signed build that asks for it. Sign with a development certificate and profile, or give Debug builds an entitlements file without it (coding-standards-dotnet.md §9)"
+    found=1
+  fi
+  [[ $found -eq 0 ]] && echo "OK   $P: scene manifest and delegate in place; no keychain permission a local build cannot have; zoom wired or not a Blazor Hybrid head"
+done
+[[ $seen -eq 0 ]] && echo "NONE no MAUI project with a Mac Catalyst or Windows target"
+[[ $fails -eq 0 ]]