@techierathore/techieflow 1.0.4 → 1.1.1

package/.tfcore/utils/tf-yolo-alias.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# tf-yolo-alias.sh — put the `tfyolo` command in this machine's shell profile, once (owner, 2026-10-14).
+#
+#   bash .tfcore/utils/tf-yolo-alias.sh install    add it to ~/.bashrc and/or ~/.zshrc (idempotent)
+#   bash .tfcore/utils/tf-yolo-alias.sh remove     take it out again
+#   bash .tfcore/utils/tf-yolo-alias.sh status     say where it is
+#
+# `tfyolo` is a small shell function, the same text in bash and zsh. Typed anywhere inside a
+# TechieFlow project, it finds the project's .tfcore/utils/tf-yolo-start.sh above the current folder
+# and runs it: YOLO on, Claude Code started in bypass mode in this terminal, YOLO off when the session
+# ends. `tfyolo -c` continues the last conversation. It never opens or closes a window: exit the
+# session you are in (/exit), then type it in the same terminal, or type it in another tab.
+# The function lives between two marker lines and is replaced whole on a second install, so an update
+# to it reaches the profile by running install again. Profiles: ~/.zshrc when the login shell is zsh
+# or the file exists (macOS), ~/.bashrc when the login shell is bash or the file exists (WSL, Linux).
+# A new terminal picks it up; an open one needs `source ~/.bashrc` (or ~/.zshrc). Exit 0; 2 bad use.
+
+set -u
+BEGIN="# >>> TechieFlow tfyolo >>>"
+END="# <<< TechieFlow tfyolo <<<"
+HOME_DIR="${TF_HOME:-$HOME}"
+
+block() {
+  cat <<'FN'
+# >>> TechieFlow tfyolo >>>
+# Start Claude Code in bypass mode with TechieFlow YOLO on, in the project around this folder.
+# `tfyolo -c` continues the last conversation. Added by .tfcore/utils/tf-yolo-alias.sh; remove with
+# `bash .tfcore/utils/tf-yolo-alias.sh remove`.
+tfyolo() {
+  _tf_d="$PWD"
+  while [ "$_tf_d" != "/" ] && [ ! -f "$_tf_d/.tfcore/utils/tf-yolo-start.sh" ]; do _tf_d="$(dirname "$_tf_d")"; done
+  if [ ! -f "$_tf_d/.tfcore/utils/tf-yolo-start.sh" ]; then
+    echo "tfyolo: no TechieFlow project around $PWD (no .tfcore/utils/tf-yolo-start.sh above it)" >&2
+    unset _tf_d; return 2
+  fi
+  bash "$_tf_d/.tfcore/utils/tf-yolo-start.sh" "$@"
+  _tf_rc=$?; unset _tf_d; return $_tf_rc
+}
+# <<< TechieFlow tfyolo <<<
+FN
+}
+
+profiles() {
+  local sh; sh="$(basename "${SHELL:-}")"
+  [[ "$sh" == zsh || -f "$HOME_DIR/.zshrc" ]] && echo "$HOME_DIR/.zshrc"
+  [[ "$sh" == bash || -f "$HOME_DIR/.bashrc" ]] && echo "$HOME_DIR/.bashrc"
+  [[ "$sh" != zsh && "$sh" != bash && ! -f "$HOME_DIR/.zshrc" && ! -f "$HOME_DIR/.bashrc" ]] && echo "$HOME_DIR/.bashrc"
+  return 0
+}
+
+strip() {  # the file without our block
+  awk -v b="$BEGIN" -v e="$END" '$0==b{skip=1;next} $0==e{skip=0;next} !skip' "$1"
+}
+
+case "${1:-status}" in
+  install)
+    while IFS= read -r p; do
+      [[ -n "$p" ]] || continue
+      tmp="$p.tftmp.$$"
+      if [[ -f "$p" ]]; then strip "$p" > "$tmp"; else : > "$tmp"; fi
+      # one blank line before the block, never a growing run of them
+      [[ -s "$tmp" && -n "$(tail -c 1 "$tmp")" ]] && echo "" >> "$tmp"
+      block >> "$tmp"
+      cat "$tmp" > "$p"; rm -f "$tmp"
+      echo "tfyolo: installed in $p (open a new terminal, or: source $p)"
+    done < <(profiles)
+    ;;
+  remove)
+    for p in "$HOME_DIR/.bashrc" "$HOME_DIR/.zshrc"; do
+      [[ -f "$p" ]] && grep -qxF "$BEGIN" "$p" || continue
+      tmp="$p.tftmp.$$"; strip "$p" > "$tmp"; cat "$tmp" > "$p"; rm -f "$tmp"
+      echo "tfyolo: removed from $p"
+    done
+    ;;
+  status)
+    found=0
+    for p in "$HOME_DIR/.bashrc" "$HOME_DIR/.zshrc"; do
+      [[ -f "$p" ]] && grep -qxF "$BEGIN" "$p" && { echo "tfyolo: in $p"; found=1; }
+    done
+    [[ $found -eq 1 ]] || echo "tfyolo: not installed (bash .tfcore/utils/tf-yolo-alias.sh install)"
+    ;;
+  *) echo "usage: tf-yolo-alias.sh install|remove|status" >&2; exit 2 ;;
+esac
+exit 0

package/.tfcore/utils/tf-yolo-perms.py

@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+"""tf-yolo-perms.py — switch OpenCode to never ask, and back (owner, 2026-10-14). Run by tf-yolo.sh.
+
+    python3 .tfcore/utils/tf-yolo-perms.py on  <project-root>
+    python3 .tfcore/utils/tf-yolo-perms.py off <project-root>
+
+on   OpenCode: the config file it reads LAST (it reads opencode.json, opencode.jsonc,
+     .opencode/opencode.json, .opencode/opencode.jsonc, in that order, the last matching rule
+     winning; checked on OpenCode 2.0.27) is rewritten with every "ask" made "allow", every "deny"
+     kept in its place, and edit, webfetch, external_directory and doom_loop allowed, in the root map
+     and in every agent's. In a project that file is the framework's own .opencode/opencode.jsonc.
+     Its exact text is saved once, in .tfcore/.session/yolo-perms.json; a second `on` keeps the
+     first saving.
+     Claude Code is NOT switched here: it ignores permissions.defaultMode "bypassPermissions" in
+     project and local settings ("only policy/user/flag settings may grant bypass mode", Claude Code
+     2.1.299, 2026-10-14). Its side is the hook .tfcore/hooks/yolo-allow.sh, and for the prompts a
+     hook cannot clear (ask rules, safety checks), a session started with
+     `claude --permission-mode bypassPermissions` (tf-goal.sh always starts it so).
+off  Puts the OpenCode file back as it was (one the updater replaced meanwhile is left as the updater
+     wrote it) and removes the saving. Without a saving it does nothing.
+Exit 0 always: YOLO never fails a phase.
+"""
+import json
+import os
+import re
+import sys
+
+MARK = "// tf-yolo.sh on rewrote this file so nothing asks while YOLO is on; tf-yolo.sh off puts the original back"
+OPEN_ALLOW = ("edit", "webfetch", "external_directory", "doom_loop")
+
+
+def jsonc(text):
+    """JSON with // and /* */ comments and trailing commas, as opencode.jsonc is written"""
+    out, i, n, s = [], 0, len(text), None
+    while i < n:
+        c = text[i]
+        if s:
+            out.append(c)
+            if c == "\\" and i + 1 < n:
+                out.append(text[i + 1]); i += 2; continue
+            if c == s:
+                s = None
+        elif c == '"':
+            s = c; out.append(c)
+        elif text.startswith("//", i):
+            while i < n and text[i] != "\n":
+                i += 1
+            continue
+        elif text.startswith("/*", i):
+            j = text.find("*/", i + 2)
+            i = n if j < 0 else j + 2
+            continue
+        else:
+            out.append(c)
+        i += 1
+    return json.loads(re.sub(r",(\s*[}\]])", r"\1", "".join(out)))
+
+
+def never_ask(perm):
+    """a permission map with every "ask" made "allow"; order (and so every deny's place) kept"""
+    if perm == "ask":
+        return "allow"
+    if isinstance(perm, dict):
+        out = {k: never_ask(v) for k, v in perm.items()}
+        for k in OPEN_ALLOW:
+            if k not in out or out[k] == "ask":
+                out[k] = "allow"
+        return out
+    return perm
+
+
+def read(p):
+    try:
+        with open(p, encoding="utf-8") as f:
+            return f.read()
+    except OSError:
+        return None
+
+
+def write(p, text):
+    os.makedirs(os.path.dirname(p), exist_ok=True)
+    with open(p, "w", encoding="utf-8") as f:
+        f.write(text)
+
+
+def main(argv):
+    if len(argv) < 3 or argv[1] not in ("on", "off"):
+        print(__doc__)
+        return 0
+    verb, root = argv[1], argv[2]
+    saving = os.path.join(root, ".tfcore", ".session", "yolo-perms.json")
+    oc = next((os.path.join(root, *p) for p in ((".opencode", "opencode.jsonc"), (".opencode", "opencode.json"),
+                                                 ("opencode.jsonc",), ("opencode.json",))
+               if os.path.isfile(os.path.join(root, *p))), None)
+
+    if verb == "on":
+        if not os.path.isfile(saving):
+            write(saving, json.dumps({"opencode_file": oc, "opencode_text": read(oc) if oc else None}, indent=1))
+        # OpenCode
+        text = read(oc) if oc else None
+        if text is not None and MARK not in text:
+            try:
+                cfg = jsonc(text)
+            except ValueError:
+                cfg = None
+            if isinstance(cfg, dict):
+                cfg["permission"] = never_ask(cfg.get("permission") or {})
+                for a in (cfg.get("agent") or {}).values():
+                    if isinstance(a, dict) and a.get("permission"):
+                        a["permission"] = never_ask(a["permission"])
+                write(oc, MARK + "\n" + json.dumps(cfg, indent=2) + "\n")
+        print("permissions: OpenCode set to never ask; Claude Code: the yolo-allow hook")
+        return 0
+
+    # off
+    if not os.path.isfile(saving):
+        return 0
+    try:
+        before = json.loads(read(saving) or "{}")
+    except ValueError:
+        before = {}
+    oc_file, oc_text = before.get("opencode_file"), before.get("opencode_text")
+    if oc_file and oc_text is not None and MARK in (read(oc_file) or ""):
+        write(oc_file, oc_text)
+    os.remove(saving)
+    print("permissions: OpenCode config put back as it was")
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main(sys.argv))
+    except Exception as e:   # never a veto
+        print(f"tf-yolo-perms: {e}", file=sys.stderr)
+        sys.exit(0)

package/.tfcore/utils/tf-yolo-start.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# tf-yolo-start.sh — what `tfyolo` runs: Claude Code in bypass mode with YOLO on (owner, 2026-10-14).
+#
+#   tfyolo                start a new Claude Code session here, nothing asks
+#   tfyolo -c             the same, continuing the last conversation in this folder (claude --continue)
+#   tfyolo <claude args>  any other claude arguments are passed through unchanged
+#
+# Why it exists: Claude Code drops its permission prompts only for a session STARTED in bypass mode
+# (`claude --permission-mode bypassPermissions`). Project settings cannot grant that mode (Claude Code
+# 2.1.299 ignores it there), and `*yolo` typed into an open session cannot switch it. So `tfyolo`
+# turns YOLO on (tf-yolo.sh on: the git-write ban stays, OpenCode stops asking too), starts Claude in
+# this terminal, and turns YOLO off again when that session ends, however it ends.
+#
+# It refuses outside a TechieFlow project: the hooks that keep git writes refused live in the
+# project, and bypass mode without them would let a commit through.
+# The `tfyolo` command itself is a shell function put in ~/.bashrc / ~/.zshrc by tf-yolo-alias.sh.
+# Exit: claude's own exit code; 2 when it could not start.
+
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+if [[ ! -f "$ROOT/.tfcore/hooks/block-git.sh" || ! -f "$ROOT/.claude/settings.json" ]]; then
+  echo "tfyolo: $ROOT is not a TechieFlow project with its Claude Code hooks (no .tfcore/hooks/block-git.sh or .claude/settings.json); not starting in bypass mode." >&2
+  exit 2
+fi
+grep -q 'block-git.sh' "$ROOT/.claude/settings.json" 2>/dev/null || {
+  echo "tfyolo: $ROOT/.claude/settings.json does not register block-git.sh, so git writes would not be refused; run update-framework.sh on this project first." >&2
+  exit 2
+}
+CLAUDE_BIN="${TF_CLAUDE_BIN:-$(command -v claude 2>/dev/null)}"
+[[ -n "$CLAUDE_BIN" ]] || { echo "tfyolo: the claude command is not on PATH" >&2; exit 2; }
+
+export CLAUDE_PROJECT_DIR="$ROOT"
+bash "$HERE/tf-yolo.sh" on --source tfyolo >/dev/null
+off() { CLAUDE_PROJECT_DIR="$ROOT" bash "$HERE/tf-yolo.sh" off >/dev/null 2>&1; }
+trap 'off' EXIT
+trap 'off; exit 130' INT TERM
+
+echo "tfyolo: YOLO on, Claude Code starting in bypass mode in $ROOT (git writes stay refused; YOLO goes off when this session ends)"
+cd "$ROOT" || exit 2
+"$CLAUDE_BIN" --permission-mode bypassPermissions "$@"
+rc=$?
+echo "tfyolo: session ended; YOLO off"
+exit $rc

package/.tfcore/utils/tf-yolo.sh

@@ -8,6 +8,26 @@
 #   bash .tfcore/utils/tf-yolo.sh done [complete|blocked] ["<summary>"]   goal finished → write the sentinel
 #                                                                         the tf-goal.sh supervisor stops on
 #   bash .tfcore/utils/tf-yolo.sh clear-done                              remove the sentinel (supervisor does this)
+#   bash .tfcore/utils/tf-yolo.sh sync                                    put the harness permissions back when
+#                                                                         the flag has gone or expired (hooks call it)
+#
+# YOLO NEVER ASKS (owner, 2026-10-14: "if it's still asking for permission, what's the purpose of
+# YOLO mode?"). While the flag is live both harnesses stop asking, and `off`, `done` and an expired
+# flag put them back:
+#   - Claude Code: the hook .tfcore/hooks/yolo-allow.sh approves every tool call, in the session
+#     already running. Claude Code still asks where a hook's allow is not enough — an ask rule or one
+#     of its own safety checks ("requires the full permission pipeline") — and it refuses bypass mode
+#     from project or local settings ("only policy/user/flag settings may grant bypass mode"; both
+#     seen in its debug log, 2.1.299, 2026-10-14). Those prompts go only in a session started with
+#     `claude --permission-mode bypassPermissions`, which tf-goal.sh always uses.
+#   - OpenCode: the config file it reads last (.opencode/opencode.jsonc in a project) is rewritten
+#     with each "ask" turned to "allow" and every deny kept, and edits, web fetches, folders outside
+#     the project and repeated calls allowed; `off` puts its exact text back. OpenCode reads it when
+#     a session starts; the plugin's permission.ask approves everything while the flag is live
+#     (OpenCode 1.x).
+# Version-control WRITES stay refused in both: the deny rules are kept, and block-git.sh refuses
+# them before any permission check. What each file held before is kept under .tfcore/.session/ and
+# restored exactly.
 #
 # YOLO is ON when ANY of these holds (checked in this order by block-git.sh too):
 #   1. env TF_YOLO=1                      (tf-goal.sh exports it for the whole run)
@@ -54,6 +74,8 @@ flag_live() {  # exit 0 = flag present AND not expired
   [[ -n "$(find "$FLAG" -mmin "+$(( TTL_HOURS * 60 ))" 2>/dev/null)" ]] && return 1
   return 0
 }
+PERM_PY="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/tf-yolo-perms.py"
+perms() { python3 "$PERM_PY" "$1" "$ROOT" 2>/dev/null || true; }   # on | off; never fails the caller
 json_escape() { printf '%s' "$1" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))' 2>/dev/null || printf '"%s"' "${1//\"/\\\"}"; }
 
 cmd="${1:-status}"; shift || true
@@ -74,11 +96,16 @@ case "$cmd" in
         "$(now_utc)" "$(json_escape "$SOURCE")" "$(json_escape "$GOAL")" "$(json_escape "${TF_HARNESS:-claude-code}")"
     } > "$FLAG" 2>/dev/null || true
     rm -f "$DONE" 2>/dev/null || true
-    echo "YOLO: ON (source=$SOURCE) — no confirmations; deletes + read-only git allowed; git WRITES still blocked; run to completion."
+    perms on
+    echo "YOLO: ON (source=$SOURCE) — no confirmations; OpenCode never asks (from its next session); Claude Code approves every call it can (its own safety checks still ask unless the session was started with: claude --permission-mode bypassPermissions); deletes + read-only git allowed; git WRITES still blocked; run to completion."
     ;;
   off)
     rm -f "$FLAG" 2>/dev/null || true
-    echo "YOLO: OFF — back to ask-on-delete, no-git, confirm-at-phase-boundaries."
+    perms off
+    echo "YOLO: OFF — back to ask-on-delete, no-git, confirm-at-phase-boundaries; OpenCode's asks restored."
+    ;;
+  sync)
+    if [[ "${TF_YOLO:-0}" == "1" ]] || flag_live; then :; else perms off; fi
     ;;
   is-on)
     if [[ "${TF_YOLO:-0}" == "1" ]] || flag_live; then exit 0; else exit 1; fi
@@ -166,13 +193,14 @@ PY2
     # unprompted and read-only git open and nothing on screen saying so. The
     # supervisor reads $DONE, never $FLAG, so clearing it here stops nothing.
     rm -f "$FLAG" 2>/dev/null || true
+    perms off
     echo "GOAL-DONE ($OUTCOME) recorded at $DONE — the supervisor (tf-goal.sh) will stop. YOLO flag cleared."
     ;;
   clear-done)
     rm -f "$DONE" 2>/dev/null || true
     ;;
   *)
-    echo "usage: tf-yolo.sh on|off|status|is-on|done [complete|blocked] [summary]|clear-done" >&2
+    echo "usage: tf-yolo.sh on|off|status|is-on|done [complete|blocked] [summary]|clear-done|sync" >&2
     ;;
 esac
 exit 0

package/.tfcore/utils/tf_defect.py

@@ -0,0 +1,27 @@
+"""tf_defect.py — the defect marks the framework's own writers put in a checklist row's Remarks.
+
+devguide.md writes `⚠ DevGuide`, tf-checklist-edit's demote `⚠ UAT bug` / `⚠ prod bug` / `⚠ miss`,
+tf-verify-verdict one mark per failing check, the smoke policy `⚠ visual`, security findings
+`⚠ SECURITY`. A bare ⚠ is not a defect: hand-written remarks use it for "not verifiable here".
+
+Imported by tf-status-facts.py (TF-019), tf-build-list.py (TF-020) and tf-verify-verdict.py (TF-021).
+tests/regression/run.sh am_019, am_020, am_021.
+"""
+import re
+
+# found by a verify check: a new verify grades it again, so its verdict replaces the old mark
+VERIFY = r"acceptance|build|render|assets|visual|mockup-parity|perf"
+# found by another step (guide, owner's testing, production, a miss, a review): no verify sees it
+OTHER = r"DevGuide|UAT bug|prod bug|miss \d{4}-|SECURITY"
+DEFECT = re.compile(rf"⚠\s*(?:{OTHER}|{VERIFY})\b")
+UNSEEN = re.compile(rf"⚠\s*(?:{OTHER})\b")
+
+
+def clauses(remarks, pattern=DEFECT):
+    """The defect clauses of a Remarks cell: each runs from its ⚠ mark to the next ⚠ or the end."""
+    return [c.strip().rstrip(";").strip() for c in re.split(r"(?=⚠)", remarks or "") if pattern.match(c)]
+
+
+def unseen(remarks):
+    """The clauses a verify cannot see, so a verify must neither erase them nor pass over them."""
+    return clauses(remarks, UNSEEN)

package/.tfcore/utils/tf_feedback.py

@@ -0,0 +1,272 @@
+#!/usr/bin/env python3
+"""tf_feedback.py — the one reader of a project's upstream feedback files (2026-09-11).
+
+    bash .tfcore/utils/tf-feedback.sh <App>                       every entry and its state
+    bash .tfcore/utils/tf-feedback.sh <App> --waiting             fixed upstream, not yet re-checked here
+    bash .tfcore/utils/tf-feedback.sh <App> --close <ID> "<what you ran and what it showed>"
+
+An entry is one of three things, and every script that reports on these files reads them here:
+
+  open     nobody upstream has answered it
+  fixed    the upstream team's reply ("## Resolution status (…, <date>)") lists it, or its own body
+           says "fixed upstream" — the fix exists, and this project has not yet re-checked it
+  closed   this project re-checked it and marked it closed (✅, "Closed <date>", "will not fix")
+
+Why one reader. Until 2026-09-11 three scripts read these files three ways, and the one that writes
+PROJECT-STATUS counted every `###` heading as an entry and accepted only a closing format no file
+used: TfLens's status read "TechieFlow: 62 open of 62" for a file of 27 entries with 16 fixed, and
+the agent reported two fixed problems to the owner as open (MISS-TechieFlow-20260911-04).
+
+--close writes one line under the entry's heading and nothing else. Python 3 standard library only.
+"""
+from __future__ import annotations
+
+import datetime
+import glob
+import os
+import re
+import sys
+
+# a heading is one line: [ \t], never \s, which runs past the line break and makes the next line
+# of a bare "## TF-013" its title — its closing line included (TF-028)
+ENTRY_HEAD = re.compile(r"(?m)^(#{2,3})[ \t]+`?([A-Z][A-Z0-9]*(?:-[A-Z0-9]+)*-\d+)\b[` \t—–-]*(.*)$")
+REPLY_HEAD = re.compile(r"(?mi)^([ \t]*>[ \t]*)?#{2,3}[ \t]+[^\n]*\b(?:resolution status|resolved|repl(?:y|ies) from)\b[^\n]*")
+ANY_ID = re.compile(r"(?<![\w-])([A-Z][A-Z0-9]*(?:-[A-Z]+)*-\d{2,})(?!\d)")
+FIXED_WORDS = re.compile(r"(?i)\b(fixed|resolved|corrected|closes|closed|wired)\b")
+EVERYTHING = re.compile(r"(?i)\beverything else is (?:now )?fixed\b|\ball (?:the )?others? (?:are )?(?:now )?fixed\b")
+# a project's own mark that it re-checked the fix, that it will never be fixed, or that the entry
+# was folded into another
+CLOSED = re.compile(r"(?i)(✅|\bclosed (?:on )?\d{4}-\d{2}-\d{2}|is \*\*closed\*\*|\bwill not fix\b|\bwont-fix\b)")
+MERGED = re.compile(r"(?i)^\s*merged into\b")
+FIXED_IN_BODY = re.compile(r"(?i)\bfixed upstream\b")
+STILL_OPEN = re.compile(r"(?i)\bopen\b|\bnot (?:yet )?(?:fixed|resolved)\b|\bunfixed\b")
+BLOCKS = re.compile(r"(?im)^\s*[-*]\s*\*\*Blocks:?\*\*:?\s*(yes|no)\b")
+
+
+def ids_in(t):
+    """Every id the text names, shorthand included: "TR-RAG-028/029/030" and "TR-RAG-031..034"
+    (or "031–034") name each id they cover, not only the first."""
+    out = []
+    for m in re.finditer(r"(?<![\w-])([A-Z][A-Z0-9]*(?:-[A-Z]+)*)-(\d{2,})(?!\d)((?:/\d{2,})+|(?:\.\.|…|–|—)\d{2,})?", t):
+        pre, n, tail = m.group(1), m.group(2), m.group(3) or ""
+        out.append(f"{pre}-{n}")
+        w = len(n)
+        if tail.startswith("/"):
+            out += [f"{pre}-{x.zfill(w)}" for x in tail.strip("/").split("/")]
+        elif tail:
+            hi = int(re.sub(r"^\D+", "", tail))
+            if int(n) < hi <= int(n) + 50:
+                out += [f"{pre}-{str(x).zfill(w)}" for x in range(int(n) + 1, hi + 1)]
+    return out
+
+
+def unquoted(t):
+    """The text without fenced code, inline code and double-quoted phrases."""
+    t = re.sub(r"(?ms)^[ \t]*```.*?^[ \t]*```", "", t)
+    t = re.sub(r"`[^`\n]*`", "", t)
+    return re.sub(r"[\"“][^\"”\n]*[\"”]", "", t)
+
+
+def entries(path):
+    """-> [{id, title, state, since, blocks, start, end}] in file order."""
+    text = open(path, encoding="utf-8", errors="replace").read()
+    heads = list(ENTRY_HEAD.finditer(text))
+    out = {}
+    for i, m in enumerate(heads):
+        end = heads[i + 1].start() if i + 1 < len(heads) else len(text)
+        nxt = re.search(r"(?m)^#{1,%d}\s" % len(m.group(1)), text[m.end():end])
+        body = text[m.end(): m.end() + nxt.start()] if nxt else text[m.end():end]
+        # quoted or code text is somebody's words, not a mark: `fixed upstream` in a repro, a test name
+        head = unquoted(body[:2500])
+        title = unquoted(m.group(3))
+        # the mark is read in the heading as well (TechieRag TF-001: "— **fixed upstream 2026-10-03**")
+        state = ("closed" if CLOSED.search(head) or CLOSED.search(title) or MERGED.search(m.group(3))
+                 else "fixed" if FIXED_IN_BODY.search(head) or FIXED_IN_BODY.search(title) else "open")
+        b = BLOCKS.search(body)
+        out.setdefault(m.group(2), {"id": m.group(2), "title": m.group(3).strip(" `"), "state": state,
+                                    "since": "", "blocks": b.group(1).lower() if b else "",
+                                    "start": m.start(), "end": m.end() + len(body)})
+    # the upstream team's replies, in the shapes they have actually been written in
+    for rid, date in replied_fixed(text, list(out)):
+        e = out.get(rid)
+        if e and e["state"] == "open":
+            e["state"] = "fixed"
+        if e and not e["since"] and date:
+            e["since"] = date
+    return list(out.values())
+
+
+def reply_blocks(text):
+    """-> [(date, block text)]. A reply is a heading naming a resolution or a reply —
+    "## Resolution status (TechieFlow team, 2026-09-09)", "## Replies from …", or a quoted
+    "> ## ✅ RESOLVED LIBRARY-SIDE 2026-08-31" — and runs to the next heading of its level,
+    or, when quoted, to the end of the quote."""
+    out, seen = [], set()
+    date_of = lambda h: (re.search(r"\d{4}-\d{2}-\d{2}", h) or [""])[0]
+    for m in REPLY_HEAD.finditer(text):
+        if m.start() in seen:
+            continue
+        rest = text[m.end():]
+        if m.group(1):   # quoted: the block is the run of '>' lines after the heading's own line
+            rest = rest[1:] if rest.startswith("\n") else rest
+            q = re.match(r"(?:[ \t]*>[^\n]*\n?)*", rest)
+            out.append((date_of(m.group(0)), re.sub(r"(?m)^[ \t]*>[ \t]?", "", q.group(0))))
+            continue
+        level = len(re.match(r"[ \t]*(#+)", m.group(0)).group(1))
+        nxt = re.search(r"(?m)^#{1,%d}\s" % level, rest)
+        section = rest[: nxt.start()] if nxt else rest
+        if level == 2:
+            # A "## Replies from …" section holds dated "### " blocks, written months apart. Each is its
+            # own reply: an "all others fixed" kept in an old one must not reach entries a newer block
+            # merely names (TechieRag TF-001: Sevak's TR-RAG-047 read fixed when TR-RAG-048 was replied to).
+            subs = list(re.finditer(r"(?m)^###[ \t]+[^\n]*", section))
+            out.append((date_of(m.group(0)), section[: subs[0].start()] if subs else section))
+            for j, sm in enumerate(subs):
+                end = subs[j + 1].start() if j + 1 < len(subs) else len(section)
+                seen.add(m.end() + sm.start())
+                # the heading line stays in: "### TF-025 — fixed 2026-09-19" names the entry it answers
+                out.append((date_of(sm.group(0)) or date_of(m.group(0)), section[sm.start(): end]))
+        else:
+            out.append((date_of(m.group(0)), section))
+    return out
+
+
+def replied_fixed(text, known):
+    """-> [(id, date)] for every entry a reply says is fixed. Inside a reply, an item — a table
+    row, a bullet, or a paragraph — fixes the ids it names when it is a table row or says fixed,
+    resolved, corrected or closes; "everything else is fixed" covers every entry up to the highest
+    number the reply mentions (entries filed after it stay open)."""
+    out = []
+    for date, body in reply_blocks(text):
+        items = re.split(r"\n\s*\n|\n(?=\s*[-*]\s)|\n(?=\s*\|)", body)
+        mentioned = []
+        for it in items:
+            ids = ids_in(it)
+            mentioned += ids
+            if not ids:
+                continue
+            if it.lstrip().startswith("|"):
+                first = ids_in(it.split("|")[1] if it.count("|") > 1 else "")
+                out += [(i, date) for i in first]
+            elif FIXED_WORDS.search(unquoted(it)) and not EVERYTHING.search(unquoted(it)):
+                # "Open: TR-RAG-001, TR-RAG-002. All others fixed": the ids are the exceptions.
+                # Read clause by clause: "1 OPEN: TR-RAG-001 …; 2 FIXED: TR-RAG-005 …" fixes 005 only,
+                # and "TR-RAG-035 (minor, OPEN)" beside "TR-RAG-034 (minor, FIXED)" stays open.
+                # A "fixed" clause naming no id answers the clause before it: "TR-RAG-010: every
+                # assembly carries its version. Fixed in 1.1.2." And "TR-RAG-017/019 → BRD-126 (fixed);
+                # TR-RAG-020…022 → BRD-127" fixes 017 and 019 only.
+                prev = []
+                for cl in re.split(r"(?<=[.;])\s+|\s+·\s+", it):
+                    own_ids = ids_in(cl)
+                    bare = unquoted(cl)
+                    if FIXED_WORDS.search(bare) and not STILL_OPEN.search(bare):
+                        out += [(i, date) for i in (own_ids or prev)]
+                    if own_ids:
+                        prev = [] if STILL_OPEN.search(bare) else own_ids
+        for it in items:
+            # a quoted or code "all others fixed" is somebody's words being cited, not this reply's
+            # claim: "…only because of the July "All others fixed app-side" line" fixed 13 entries the
+            # same block listed as still open (TechieRag TF-002)
+            if EVERYTHING.search(unquoted(it)) and mentioned:
+                # bounded by the ids of its own item, which it never covers ("all others"); an item
+                # naming none takes the block's. A running log in one block once let a July "all
+                # others fixed" reach every entry its later lines named (TechieRag TF-001).
+                own = ids_in(it)
+                top = {}
+                for i in own or mentioned:
+                    p, n = i.rsplit("-", 1)
+                    top[p] = max(top.get(p, 0), int(n))
+                for k in known:
+                    p, n = k.rsplit("-", 1)
+                    if p in top and int(n) <= top[p] and k not in own:
+                        out.append((k, date))
+    return out
+
+
+def files(root, app=None):
+    pat = f"{app}-*-Feedback.md" if app else "*-Feedback.md"
+    return sorted(glob.glob(os.path.join(root, "docs", pat)))
+
+
+def upstream_of(path, app=None):
+    base = os.path.basename(path)
+    m = re.match(rf"^{re.escape(app)}-(.+)-Feedback\.md$", base) if app else re.match(r"^[^-]+-(.+)-Feedback\.md$", base)
+    return m.group(1) if m else base
+
+
+def state_map(root):
+    """Every entry id across the project's feedback files -> (state, "<file>, <date>")."""
+    out = {}
+    for f in files(root):
+        rel = os.path.relpath(f, root).replace(os.sep, "/")
+        for e in entries(f):
+            out[e["id"]] = (e["state"], f"{rel}" + (f", Resolution status {e['since']}" if e["since"] else ""))
+    return out
+
+
+def summary_line(path, app):
+    es = entries(path)
+    n = {s: [e["id"] for e in es if e["state"] == s] for s in ("open", "fixed", "closed")}
+    rel = "docs/" + os.path.basename(path)
+    parts = [f"{len(n['open'])} open"]
+    if n["fixed"]:
+        ids = ", ".join(n["fixed"][:3]) + (" …" if len(n["fixed"]) > 3 else "")
+        parts.append(f"{len(n['fixed'])} fixed upstream, not yet re-checked ({ids})")
+    parts.append(f"{len(n['closed'])} closed")
+    return f"- {upstream_of(path, app)}: " + " · ".join(parts) + f" — {rel}"
+
+
+def close(path, rid, evidence):
+    text = open(path, encoding="utf-8").read()
+    e = next((x for x in entries(path) if x["id"] == rid), None)
+    if not e:
+        return f"tf-feedback: no entry {rid} in {os.path.basename(path)}", 2
+    if e["state"] == "closed":
+        return f"tf-feedback: {rid} is already closed; nothing written", 0
+    if not evidence.strip():
+        return "tf-feedback: say what you ran and what it showed; a close with no evidence is refused", 2
+    line_end = text.index("\n", e["start"]) + 1
+    today = datetime.date.today().isoformat()
+    mark = f"\n> ✅ **Closed {today}** — re-checked here: {evidence.strip()}\n"
+    open(path, "w", encoding="utf-8").write(text[:line_end] + mark + text[line_end:])
+    return f"tf-feedback: {rid} closed in {os.path.basename(path)}", 0
+
+
+def main(argv):
+    if not argv or argv[0] in ("-h", "--help"):
+        print(__doc__)
+        return 0 if argv else 2
+    app, rest = argv[0], argv[1:]
+    root = os.getcwd()
+    fs = files(root, app)
+    if not fs:
+        print(f"tf-feedback: no docs/{app}-*-Feedback.md here")
+        return 0
+    if rest[:1] == ["--close"]:
+        if len(rest) < 3:
+            print('usage: tf-feedback.sh <App> --close <ID> "<what you ran and what it showed>"')
+            return 2
+        for f in fs:
+            if any(e["id"] == rest[1] for e in entries(f)):
+                msg, rc = close(f, rest[1], rest[2])
+                print(msg)
+                return rc
+        print(f"tf-feedback: no entry {rest[1]} in any docs/{app}-*-Feedback.md")
+        return 2
+    waiting = rest[:1] == ["--waiting"]
+    for f in fs:
+        es = entries(f)
+        if waiting:
+            for e in es:
+                if e["state"] == "fixed":
+                    print(f"{e['id']}  fixed upstream{' ' + e['since'] if e['since'] else ''}, waiting to be "
+                          f"re-checked here — {os.path.basename(f)}")
+            continue
+        print(summary_line(f, app))
+        for e in es:
+            print(f"  {e['id']:<12} {e['state']:<7} {e['since'] or '':<10} {e['title'][:80]}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))