@techierathore/techieflow 1.0.4 → 1.1.1

package/.tfcore/hooks/guard-status-html.sh

@@ -10,9 +10,14 @@
 #   Only when PROJECT-STATUS.md was written in this session (newer than the
 #   session pointer .tfcore/.session/<harness>.json):
 #   2. tf-doc-check.sh FAILs on PROJECT-STATUS.md      -> fix the file, re-run the check
+#   2c. a BRD or UI design written this session leaves a screen with no row, UI design
+#       entry or mockup                               -> add it, re-run the check (TF-030)
 #   3. docs/<App>-BRD.md older than docs/<App>-Checklist.md
 #        -> bash .tfcore/utils/tf-brd-status.sh <App>
 #   4. no runs.jsonl record after the status write     -> the run record (_metrics-emit-gate.md)
+#   Only on the turn that wrote PROJECT-STATUS.md (a command's closing turn):
+#   5. tf-owner-text.sh FAILs on the closing message or a free-form document it
+#      hands the owner                                  -> rewrite it for the owner
 #
 # Wired in .claude/settings.json -> hooks.Stop; OpenCode via
 # .opencode/plugin/techieflow.js session.idle (a nudge: OpenCode has no blocking
@@ -28,6 +33,7 @@ import datetime
 import glob
 import json
 import os
+import re
 import subprocess
 import sys
 
@@ -58,10 +64,18 @@ elif md_mtime > os.path.getmtime(html):
 def session_start():
     """mtime of the harness's session pointer; None when there is none (checks 2-4 skipped)."""
     d = os.path.join(root, ".tfcore", ".session")
-    if any(k.startswith("OPENCODE") for k in os.environ):
+    # The harness in the order tf-harness.sh and tf-emit.sh take it: TF_HARNESS (the OpenCode
+    # plugin sets it on every guard it spawns), then Claude Code's own variables, then OPENCODE*.
+    # OpenCode first let any OPENCODE_* in the owner's shell (an API key, a config path) send a
+    # Claude Code turn to opencode.json; with no such file, checks 2-5 never ran (2026-09-27).
+    tf = os.environ.get("TF_HARNESS")
+    if tf == "opencode":
         cands = [os.path.join(d, "opencode.json")]
-    elif os.environ.get("CLAUDECODE") or any(k.startswith("CLAUDE_CODE") for k in os.environ):
+    elif tf == "claude-code" or any(os.environ.get(k) for k in (
+            "CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_SESSION_ID", "CLAUDE_PROJECT_DIR")):
         cands = [os.path.join(d, "claude-code.json")]
+    elif any(k.startswith("OPENCODE") for k in os.environ):
+        cands = [os.path.join(d, "opencode.json")]
     else:
         cands = [os.path.join(d, "claude-code.json"), os.path.join(d, "opencode.json")]
     times = [os.path.getmtime(p) for p in cands if os.path.isfile(p)]
@@ -104,6 +118,31 @@ if written_this_session:
     except Exception:
         pass
 
+    # 2c. a screen is not finished until it has its row, its UI design entry and its mockup. An
+    # amendment added a Price providers screen inside a requirement with none of the three, the
+    # checker's one finding was on the checklist and passed as old, and the page was built with no
+    # design (TfLens TF-030, 2026-09-11). On a turn that wrote a BRD or a UI design, those findings
+    # block; a BRD's other findings stay with *amend-docs, as before.
+    try:
+        chk = os.path.join(root, ".tfcore", "utils", "tf-doc-check.sh")
+        chain = re.compile(r'names the screen "|has no "### Screen:" entry|is in the UIDesign but not in the BRD'
+                           r'|has no mockup link \(docs/mockups')
+        apps = set()
+        for f in glob.glob(os.path.join(root, "docs", "*.md")):
+            m = re.match(r"^(.+?)-(?:P\d+-)?(?:BRD|UIDesign)\.md$", os.path.basename(f))
+            if m and os.path.getmtime(f) >= start:
+                apps.add(m.group(1))
+        for app in sorted(apps) if os.path.isfile(chk) else ():
+            out = subprocess.run(["bash", chk, "--quiet", "--app", app], cwd=root,
+                                 capture_output=True, text=True, timeout=180).stdout
+            fails = [l for l in out.splitlines() if l.startswith("FAIL") and chain.search(l)]
+            if fails:
+                problems.append(f"a screen in {app}'s documents has no row, UI design entry or mockup ({len(fails)} line(s)). "
+                                f"Add what is missing, then run: bash .tfcore/utils/tf-doc-check.sh --app {app}")
+                problems.extend("  " + l for l in fails[:5])
+    except Exception:
+        pass
+
     # 3. the BRD's Development status table is not older than the checklist
     try:
         for cl in glob.glob(os.path.join(root, "docs", "*-Checklist.md")):
@@ -136,6 +175,51 @@ if written_this_session:
     except Exception:
         pass
 
+    # 5. what the owner reads when a command ends: the closing message, and every free-form
+    # document it hands over that this turn wrote, through tf-owner-text.sh. TfLens's hand-off of
+    # 2026-09-11 reached the owner in jargon, named upstream problems with no word on what they
+    # touch, called two fixed ones open, and gave no prompt (MISS-TechieFlow-20260911-03). Only on
+    # the turn that closed a command -- PROJECT-STATUS written after this turn's prompt -- so an
+    # ordinary conversation is never held to a hand-off's shape. Claude Code hands the hook the
+    # message; the OpenCode plugin passes the same two fields.
+    try:
+        message = data.get("last_assistant_message") or ""
+        turn = data.get("turn_started")
+        if turn is None and data.get("transcript_path") and os.path.isfile(data["transcript_path"]):
+            with open(data["transcript_path"], encoding="utf-8", errors="replace") as f:
+                for line in f:
+                    try:
+                        r = json.loads(line)
+                    except Exception:
+                        continue
+                    c = (r.get("message") or {}).get("content")
+                    prompt = r.get("type") == "user" and not r.get("isMeta") and (
+                        isinstance(c, str) or (isinstance(c, list) and any(isinstance(x, dict) and x.get("type") == "text" for x in c)))
+                    if prompt and r.get("timestamp"):
+                        turn = r["timestamp"]
+        if isinstance(turn, str):
+            turn = datetime.datetime.strptime(turn[:19], "%Y-%m-%dT%H:%M:%S").replace(
+                tzinfo=datetime.timezone.utc).timestamp()
+        elif isinstance(turn, (int, float)) and turn > 1e12:
+            turn = turn / 1000.0
+        chk = os.path.join(root, ".tfcore", "utils", "tf-owner-text.sh")
+        if message.strip() and turn and md_mtime >= turn - 2 and os.path.isfile(chk):
+            handed = []
+            for m in set(re.findall(r"(?<![\w/.-])((?:docs/)?[\w.-]+\.md)\b", message)):
+                p = os.path.join(root, m if m.startswith("docs/") else os.path.join("docs", m))
+                if os.path.isfile(p) and os.path.getmtime(p) >= turn - 2:
+                    handed.append(os.path.relpath(p, root))
+            res = subprocess.run(["bash", chk, "--root", root, "--final", "--stdin"] + sorted(handed), cwd=root,
+                                 input=message, capture_output=True, text=True, timeout=60)
+            fails = [l for l in res.stdout.splitlines() if l.startswith("FAIL")]
+            if fails:
+                problems.append(f"what you are handing the owner is not written for the owner ({len(fails)} line(s)). "
+                                "Fix each, then write the closing message again — plain words, every upstream problem "
+                                "with what it affects and its prompt, and the next prompt in a code block:")
+                problems.extend("  " + l for l in fails[:8])
+    except Exception:
+        pass
+
 if not problems:
     sys.exit(0)
 

package/.tfcore/hooks/guard-verify-deps.sh

@@ -26,7 +26,8 @@
 #   - any `|| docker compose up` fallback, which widens the command precisely when it failed
 #   - `docker compose run|create`, `docker run`, `docker volume create` — creating, not starting
 #   - an inline or exported connection-string variable in front of a test/run command
-# ALLOWS: `docker start <name>`, `docker compose up <service>`, `docker compose start`,
+# ALLOWS: during *develop-end-to-end only, one `docker run|create --name <app>-db …` (_develop-mode.md);
+#   always: `docker start <name>`, `docker compose up <service>`, `docker compose start`,
 #   `docker ps|logs|inspect`, and anything that is not one of the above.
 #
 # Wired in .claude/settings.json -> hooks.PreToolUse (matcher "Bash"); OpenCode via
@@ -97,6 +98,20 @@ if re.search(r"\|\|\s*" + COMPOSE + r"\s+up\b", cmd, re.I):
           "Drop the fallback. If the named service does not exist, the name is wrong — fix "
           "the name or ask; do not start everything instead.")
 
+# *develop-end-to-end (_develop-mode.md): the owner asked for the database to be created when none is
+# reachable. While that run is on (.tfcore/.session/develop.json), ONE command is allowed through: a single
+# `docker run|create` of the container that rule names, `--name <app>-db`, nothing else in the command.
+# Found by the first proof run, which stopped "blocked" because this hook refused it (2026-10-08).
+root = os.environ.get("CLAUDE_PROJECT_DIR") or os.environ.get("TF_PROJECT_DIR") or os.getcwd()
+dev = os.path.join(root, ".tfcore", ".session", "develop.json")
+if os.path.isfile(dev):
+    try: app = (json.load(open(dev)).get("app") or "").lower()
+    except Exception: app = ""
+    one = not re.search(r"(?:&&|\|\||;|\||\n|\$\(|`)", cmd)   # && first: the portability check reads a pipe-ampersand pair as bash 4
+    if app and one and re.match(r"\s*docker\s+(?:run|create)\b", cmd, re.I) \
+            and re.search(r"--name[ =]%s-db(?:\s|$)" % re.escape(app), cmd):
+        sys.exit(0)
+
 if re.search(COMPOSE + r"\s+(?:run|create)\b", cmd, re.I) or \
    re.search(r"\bdocker\s+(?:run|create)\b", cmd, re.I) or \
    re.search(r"\bdocker\s+volume\s+create\b", cmd, re.I):

package/.tfcore/hooks/guard-verify.sh

@@ -99,14 +99,19 @@ if ledger is not None:
         sys.exit(0)  # a same-day ledger from a framework version before Sitting 4c: date unlocks
     else:
         rows = ledger.get("rows") or {}
-        not_listed = sorted(i for i in introduced if rows.get(i) != "PASS")
+        # a ledger kept row by row holds older runs' rows too (Lekhak TF-007): only a row graded
+        # today unlocks
+        dates = ledger.get("row_dates")
+        not_listed = sorted(i for i in introduced if rows.get(i) != "PASS"
+                            or (isinstance(dates, dict) and str(dates.get(i, "")) != today))
         if not introduced:
             # a Verified cell without a readable row id (a malformed line): refuse, nothing can vouch for it
             not_listed = ["(row id not readable)"]
         if not not_listed:
             sys.exit(0)
-        problem = ("lists these rows as " + ", ".join(f"{i}: {rows.get(i, 'absent')}" for i in not_listed)
-                   + ", not PASS")
+        problem = ("lists these rows as " + ", ".join(
+            f"{i}: {rows.get(i, 'absent')}" + (f" (graded {dates.get(i)})" if isinstance(dates, dict) and dates.get(i) and dates.get(i) != today else "")
+            for i in not_listed) + ", not PASS today")
 
 print(
     "BLOCKED by TechieFlow policy: this write INTRODUCES a `Verified` status, "

package/.tfcore/hooks/sweep-artifacts.sh

@@ -26,6 +26,8 @@
 #     test-results/  test-results-*/  scripts-*/  playwright-report/
 #   The project's own tracked scripts/ is never touched (needs the hyphen).
 #   tests/verify/ (promoted, tracked specs) is never touched (outside the roots).
+#   A file under the roots that a test names by path (tests/.artifacts/<folder>/<name>) is kept at
+#   any age, with everything below it (Lekhak TF-004); the summary says how many were kept.
 #
 # RETENTION: default 7 days. Override per project with `artifactRetentionDays: N`
 # in .tfcore/core-config.yaml, or per run with TF_ARTIFACT_RETENTION_DAYS=N.
@@ -98,6 +100,42 @@ DAYS = retention_days()
 CUTOFF = time.time() - DAYS * 86400
 
 SWEEP_ROOTS = [os.path.join("tests", ".artifacts"), ".verify"]
+
+# ---- what a test names is not litter (Lekhak TF-004) ---------------------------
+# A spec that reads tests/.artifacts/harness/hindi-src lost it on the eighth day, and two rows failed
+# "the crawl produced no result" on a working product. Any path under the sweep roots that a file of
+# the project's tests (or its Playwright config) names is kept, with everything below it, whatever its
+# age. The right home for a fixture is still tests/verify/fixtures/, outside the sweep.
+# Only a NAMED thing inside a folder counts (tests/.artifacts/<folder>/<name>): a folder a test writes
+# into is named with a variable after it (`shots/${name}.png`), which the pattern stops at, and the
+# framework's own output folders are never kept. The Playwright config is not read: it names outputs.
+KEEP_RE = re.compile(r"(?:tests[/\\]+\.artifacts|\.verify)[/\\]+[^'\"`\s)\]},;*?<>|${}+]+")
+OUTPUTS = ("tests/.artifacts/verify/", "tests/.artifacts/build/", "tests/.artifacts/test-results",
+           "tests/.artifacts/playwright", "tests/.artifacts/regression", "tests/.artifacts/doc-check/")
+TEXT_EXT = (".ts", ".js", ".mjs", ".cjs", ".cs", ".py", ".json", ".sh", ".cmd", ".ps1", ".yaml", ".yml", ".txt", ".md")
+keep = set()
+def scan_refs(fp):
+    try:
+        if os.path.getsize(fp) > 2 * 1024 * 1024:
+            return
+        with open(fp, encoding="utf-8", errors="replace") as fh:
+            for m in KEEP_RE.finditer(fh.read()):
+                k = re.sub(r"/+", "/", m.group(0).replace("\\", "/")).rstrip("/.")
+                if k.count("/") >= (2 if k.startswith(".verify/") else 3) and not (k + "/").startswith(OUTPUTS):
+                    keep.add(k)
+    except Exception:
+        pass
+tests_dir = os.path.join(root, "tests")
+if os.path.isdir(tests_dir) and not os.path.islink(tests_dir):
+    for dp, dns, fns in os.walk(tests_dir, followlinks=False):
+        dns[:] = [d for d in dns if d not in (".artifacts", "node_modules", "bin", "obj", ".git")]
+        for f in fns:
+            if f.endswith(TEXT_EXT):
+                scan_refs(os.path.join(dp, f))
+kept_n = 0
+def kept(fp):
+    rel = os.path.relpath(fp, root).replace(os.sep, "/")
+    return any(rel == k or rel.startswith(k + "/") for k in keep)
 LEGACY_ROOT_GLOBS = ["test-results", "test-results-*", "scripts-*", "playwright-report"]
 
 removed_files = 0
@@ -162,6 +200,9 @@ if DAYS > 0:
                 except Exception:
                     continue
                 if st.st_mtime < CUTOFF:
+                    if keep and kept(fp):
+                        kept_n += 1
+                        continue
                     rm_file(fp)
             # remove dirs emptied by this sweep (never the root itself)
             if dp != top:
@@ -193,6 +234,11 @@ if removed_files or removed_dirs or legacy:
              f"tests/.artifacts/ and .verify/"]
     if legacy:
         parts.append("banned repo-root legacy dirs removed: " + ", ".join(sorted(legacy)))
+    if kept_n:
+        parts.append(f"kept {kept_n} old file(s) a test names by path (move them to tests/verify/fixtures/)")
     print("; ".join(parts))
+elif kept_n:
+    print(f"TechieFlow sweep-artifacts: kept {kept_n} file(s) older than {DAYS}d because a test names them by path; "
+          "move them to tests/verify/fixtures/")
 PY
 exit 0

package/.tfcore/hooks/yolo-allow.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# TechieFlow PreToolUse hook — while YOLO is on, nothing asks (owner, 2026-10-14: "When I am running
+# something in YOLO mode I am expecting that it doesn't ask me for permission whatever the case is").
+#
+# While the flag is live (TF_YOLO=1, or .tfcore/.session/yolo.json not expired — tf-yolo.sh is-on
+# decides) it answers every tool call with permissionDecision "allow", in the session already
+# running. A refusal still wins: the other PreToolUse hooks (block-git.sh for version-control
+# writes, guard-build.sh, guard-db.sh …) exit 2 and the call is blocked, and the deny rules in
+# settings.json still apply. Claude Code still asks where a hook's allow is not enough (an ask rule,
+# its own safety checks); only a session started with `claude --permission-mode bypassPermissions`
+# drops those, and project settings cannot set that mode (Claude Code refuses it there).
+# While YOLO is off it says nothing, and puts the OpenCode config back if a flag expired or went
+# away without `off` (tf-yolo.sh sync).
+#
+# Wired in .claude/settings.json → hooks.PreToolUse (matcher "*"). OpenCode's side is the plugin's
+# permission.ask and the OpenCode config tf-yolo.sh rewrites. Fails OPEN: no output, exit 0.
+
+cat >/dev/null
+ROOT="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+YOLO="$ROOT/.tfcore/utils/tf-yolo.sh"
+[[ -f "$YOLO" ]] || exit 0
+if CLAUDE_PROJECT_DIR="$ROOT" bash "$YOLO" is-on >/dev/null 2>&1; then
+  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"TechieFlow YOLO is on: no permission prompts (tf-yolo.sh off to end it)"}}'
+elif [[ -f "$ROOT/.tfcore/.session/yolo-perms.json" ]]; then
+  CLAUDE_PROJECT_DIR="$ROOT" bash "$YOLO" sync >/dev/null 2>&1
+fi
+exit 0

package/.tfcore/standards/blazor-zoom.cs.txt

@@ -0,0 +1,191 @@
+// blazor-zoom.cs.txt — copy to the MAUI project's root as BlazorZoom.cs and set the namespace
+// (coding-standards-dotnet.md §9b). Kept as .txt so a project whose .csproj sits at the repository root
+// does not compile the framework's copy. Then two hooks:
+//   MainPage (the page holding the BlazorWebView):
+//     blazorWebView.BlazorWebViewInitialized += (sender, args) => BlazorZoom.Attach(args.WebView);
+//   Platforms/MacCatalyst/AppDelegate.cs (inside the MauiUIApplicationDelegate class):
+//     public override void BuildMenu(UIKit.IUIMenuBuilder builder) { base.BuildMenu(builder); BlazorZoom.BuildMenu(builder); }
+//     [Export("tfZoomIn:")] public void ZoomIn(NSObject aSender) => BlazorZoom.ZoomBy(1);
+//     [Export("tfZoomOut:")] public void ZoomOut(NSObject aSender) => BlazorZoom.ZoomBy(-1);
+//     [Export("tfZoomReset:")] public void ZoomReset(NSObject aSender) => BlazorZoom.Reset();
+// Optional: set BlazorZoom.FirstLevel before the page is built (for example from the screen size) to open
+// at more than 100% before anyone has zoomed; Cmd/Ctrl+0 still means 100%.
+// Proved on Lekhak's BlogAdmin (macOS 27, 2026-10-11): bash .tfcore/utils/tf-verify-zoom.sh checks it.
+
+#nullable enable
+#if MACCATALYST
+using Foundation;
+using UIKit;
+using WebKit;
+#endif
+
+namespace YourApp;
+
+/// <summary>
+/// Zoom in, zoom out and actual size for the BlazorWebView, with the operating system's keys.
+/// </summary>
+/// <remarks>
+/// <para><b>Purpose:</b> [coding-standards-dotnet.md §9b] On a high-resolution Mac the text was too small and
+/// Cmd+= did nothing: a Mac Catalyst WKWebView has no zoom of its own. Every Blazor Hybrid head zooms from 50% to
+/// 300% in 10% steps, and the level is kept in MAUI Preferences across restarts.</para>
+/// <para><b>Code Flow:</b> <c>MainPage</c> hands the platform web view to <see cref="Attach"/> once the BlazorWebView is
+/// initialised, which applies the saved level. Mac Catalyst: the View menu's Zoom In (Cmd+=), Zoom Out (Cmd+-) and
+/// Actual Size (Cmd+0), added by <see cref="BuildMenu"/> from the app delegate, call <see cref="ZoomBy"/> and
+/// <see cref="Reset"/>, which set <c>WKWebView.PageZoom</c> on every attached web view, one per window. Windows: WebView2's own zoom (25% to 500%, uneven steps,
+/// not kept) is turned off, and a script run on every page handles Ctrl+plus, Ctrl+minus, Ctrl+0 and Ctrl+wheel with
+/// the same steps, posting each new level back to be saved (and keeping it for the session, so a page reload keeps
+/// it). The WinUI WebView2 control does not expose WebView2's own ZoomFactor, so that cannot be saved instead.</para>
+/// </remarks>
+public static class BlazorZoom
+{
+    /// <summary>The Preferences key the zoom level is kept under.</summary>
+    public const string PreferenceKey = "tf.zoom";
+
+    /// <summary>Smallest zoom, 50%.</summary>
+    public const double Min = 0.5;
+
+    /// <summary>Largest zoom, 300%.</summary>
+    public const double Max = 3.0;
+
+    /// <summary>One step, 10%.</summary>
+    public const double Step = 0.1;
+
+    /// <summary>The level used until one is saved; 1.0 unless the app sets it before the page is built.</summary>
+    public static double FirstLevel { get; set; } = 1.0;
+
+    /// <summary>The zoom level now in use, 1.0 being actual size.</summary>
+    public static double Level { get; private set; } = 1.0;
+
+    /// <summary>Rounds to a whole step and keeps the level inside 50% to 300%.</summary>
+    /// <param name="aLevel">The level asked for.</param>
+    /// <returns>The level that will be used.</returns>
+    public static double Clamp(double aLevel) => Math.Round(Math.Clamp(aLevel, Min, Max) * 10) / 10;
+
+#if MACCATALYST
+    // every window's web view, weakly, so a Mac app with several BlazorWebView windows zooms them all (Chatur TF-010)
+    private static readonly List<WeakReference<WKWebView>> lstWebViews = new();
+    private static bool blnMenuSet;
+
+    /// <summary>Takes the platform web view and applies the saved level.</summary>
+    /// <param name="aPlatformWebView">The <c>BlazorWebViewInitializedEventArgs.WebView</c>.</param>
+    public static void Attach(object aPlatformWebView)
+    {
+        if (aPlatformWebView is WKWebView objWebView)
+        {
+            lstWebViews.Add(new WeakReference<WKWebView>(objWebView));
+        }
+
+        Apply(Preferences.Default.Get(PreferenceKey, FirstLevel));
+        if (!blnMenuSet && OperatingSystem.IsMacCatalystVersionAtLeast(26))
+        {
+            // From macOS 26 the main menu is built here: what an app delegate's BuildMenu changes is ignored.
+            // Format is off because its Font › Bigger and Smaller already own Cmd+= and Cmd+-, and UIKit
+            // silently drops a menu whose shortcut repeats one; Inspector is off because the app has none.
+            blnMenuSet = true;
+            var objConfig = new UIMainMenuSystemConfiguration
+            {
+                TextFormattingPreference = UIMenuSystemElementGroupPreference.Removed,
+                InspectorPreference = UIMenuSystemElementGroupPreference.Removed,
+            };
+            UIMainMenuSystem.SharedSystem.SetBuildConfiguration(objConfig, AddCommands);
+        }
+    }
+
+    /// <summary>Adds Zoom In, Zoom Out and Actual Size to the top of the View menu, before macOS 26.</summary>
+    /// <param name="aBuilder">The builder the app delegate's <c>BuildMenu</c> receives.</param>
+    /// <remarks>The selectors are answered by <c>[Export]</c> methods on the app delegate, which is on the
+    /// responder chain whatever has focus inside the web view. From macOS 26 <see cref="Attach"/> does this.</remarks>
+    public static void BuildMenu(IUIMenuBuilder aBuilder)
+    {
+        if (!OperatingSystem.IsMacCatalystVersionAtLeast(26) && aBuilder.System?.Handle == UIMenuSystem.MainSystem.Handle)
+        {
+            aBuilder.RemoveMenu(UIMenuIdentifier.Format.GetConstant()!);
+            AddCommands(aBuilder);
+        }
+    }
+
+    /// <summary>Zooms in (a positive step) or out (a negative one).</summary>
+    /// <param name="aSteps">How many 10% steps.</param>
+    public static void ZoomBy(int aSteps) => Apply(Level + (aSteps * Step));
+
+    /// <summary>Back to actual size.</summary>
+    public static void Reset() => Apply(1.0);
+
+    private static void AddCommands(IUIMenuBuilder aBuilder)
+    {
+        var objView = aBuilder.GetMenu(UIMenuIdentifier.View.GetConstant()!);
+        if (objView == null || objView.Children.Any(c => c.Title == "Zoom In"))
+        {
+            return;
+        }
+
+        var objZoom = UIMenu.Create(string.Empty, null, UIMenuIdentifier.None, UIMenuOptions.DisplayInline, new UIMenuElement[]
+        {
+            UIKeyCommand.Create("Zoom In", null, new ObjCRuntime.Selector("tfZoomIn:"), "=", UIKeyModifierFlags.Command, null),
+            UIKeyCommand.Create("Zoom Out", null, new ObjCRuntime.Selector("tfZoomOut:"), "-", UIKeyModifierFlags.Command, null),
+            UIKeyCommand.Create("Actual Size", null, new ObjCRuntime.Selector("tfZoomReset:"), "0", UIKeyModifierFlags.Command, null),
+        });
+        aBuilder.ReplaceMenu(UIMenuIdentifier.View.GetConstant()!, objView.GetMenuByReplacingChildren(new UIMenuElement[] { objZoom }.Concat(objView.Children).ToArray()));
+    }
+
+    private static void Apply(double aLevel)
+    {
+        Level = Clamp(aLevel);
+        Preferences.Default.Set(PreferenceKey, Level);
+        lstWebViews.RemoveAll(w => !w.TryGetTarget(out _));
+        foreach (var objRef in lstWebViews)
+        {
+            if (objRef.TryGetTarget(out var objWebView))
+            {
+                objWebView.PageZoom = (nfloat)Level;
+            }
+        }
+    }
+#elif WINDOWS
+    private const string MessagePrefix = "tfzoom:";
+
+    /// <summary>Takes the platform web view, turns WebView2's own zoom off and installs the key and wheel handler.</summary>
+    /// <param name="aPlatformWebView">The <c>BlazorWebViewInitializedEventArgs.WebView</c>.</param>
+    public static async void Attach(object aPlatformWebView)
+    {
+        if (aPlatformWebView is not Microsoft.UI.Xaml.Controls.WebView2 objWebView || objWebView.CoreWebView2 == null)
+        {
+            return;
+        }
+
+        var objCore = objWebView.CoreWebView2;
+        Level = Clamp(Preferences.Default.Get(PreferenceKey, FirstLevel));
+        objCore.Settings.IsZoomControlEnabled = false;
+        objCore.WebMessageReceived += (sender, args) =>
+        {
+            var strMessage = args.TryGetWebMessageAsString();
+            if (strMessage != null && strMessage.StartsWith(MessagePrefix, StringComparison.Ordinal)
+                && double.TryParse(strMessage[MessagePrefix.Length..], System.Globalization.NumberStyles.Float, System.Globalization.CultureInfo.InvariantCulture, out var dblLevel))
+            {
+                Level = Clamp(dblLevel);
+                Preferences.Default.Set(PreferenceKey, Level);
+            }
+        };
+        var strLevel = Level.ToString(System.Globalization.CultureInfo.InvariantCulture);
+        await objCore.AddScriptToExecuteOnDocumentCreatedAsync(
+            "(function(){var z=parseFloat(sessionStorage.getItem('tfzoom'))||" + strLevel + ",min=0.5,max=3;"
+            + "function set(v){z=Math.round(Math.min(max,Math.max(min,v))*10)/10;document.documentElement.style.zoom=z;"
+            + "sessionStorage.setItem('tfzoom',z);window.chrome.webview.postMessage('" + MessagePrefix + "'+z);}"
+            + "function apply(){document.documentElement.style.zoom=z;}"
+            + "if(document.documentElement){apply();}document.addEventListener('DOMContentLoaded',apply);"
+            + "window.addEventListener('keydown',function(e){if(!e.ctrlKey||e.altKey||e.metaKey)return;"
+            + "if(e.key==='='||e.key==='+'){set(z+0.1);}else if(e.key==='-'){set(z-0.1);}else if(e.key==='0'){set(1);}else return;"
+            + "e.preventDefault();},true);"
+            + "window.addEventListener('wheel',function(e){if(!e.ctrlKey)return;e.preventDefault();set(z+(e.deltaY<0?0.1:-0.1));},{passive:false});"
+            + "})();");
+        // the page already loaded before the script was added: give it the level too
+        await objCore.ExecuteScriptAsync("document.documentElement.style.zoom=" + strLevel + ";");
+    }
+#else
+    /// <summary>No zoom on this head.</summary>
+    /// <param name="aPlatformWebView">Unused.</param>
+    public static void Attach(object aPlatformWebView)
+    {
+    }
+#endif
+}

package/.tfcore/standards/coding-standards-dotnet.md

@@ -69,13 +69,33 @@ Controller actions: the `a` prefix applies to `[FromRoute]`, `[FromQuery]` and `
 ## 7. Testability
 
 - Blazor: a stable `data-testid` (or element id) on every control the verifier must reach.
-- MAUI: a stable, unique `AutomationId` on every interactive or data-bound control, named by intent (`LoginSubmitButton`, `ClientsGrid`), set on the element whose data the gate asserts.
+- MAUI: a stable, unique `AutomationId` on every interactive or data-bound control, named by intent (`LoginSubmitButton`, `ClientsGrid`), set on the element whose data the gate asserts. The tab, menu item or button that opens a screen carries `AutomationId="nav-<screen>"` (the screen's name, lower case, words joined by `-`), or a label equal to the screen's name; the Mac check reaches screens that way.
 
 ## 8. Security
 
 - No credentials in code. Parameterised queries. Validate inputs. Log security events.
 
-## 9. Enforcement
+## 9. Mac Catalyst heads
+
+Every MAUI project with a `net*-maccatalyst` target, Blazor Hybrid included:
+
+- **Scene manifest.** `Platforms/MacCatalyst/Info.plist` carries `UIApplicationSceneManifest` with a `UIWindowSceneSessionRoleApplication` configuration named `__MAUI_DEFAULT_SCENE_CONFIGURATION__` whose `UISceneDelegateClassName` is `SceneDelegate`, and the project has `[Register("SceneDelegate")] public class SceneDelegate : MauiUISceneDelegate { }` beside the `AppDelegate`. On macOS 27 an app without it quits at its first window; the stock `dotnet new maui` template has none, so add it when the project is created.
+- **Keychain and signing.** An app that asks for `keychain-access-groups` (MAUI `SecureStorage` needs it) must be signed with a development certificate and provisioning profile (`CodesignKey`, `CodesignProvisioningProfile`), or give Debug builds a second entitlements file without it and a Debug credential store that does not use the keychain. macOS refuses to start a locally signed build that asks for it. Decide which before the first Mac build.
+- **Clean after an update.** After a .NET SDK or MAUI workload update, build the Mac head from clean (`--no-incremental`, or delete its `bin/` and `obj/`): an old precompiled build stops at start in `load_aot_module`.
+- **Launching it.** Open the built `.app` with `open`, never its binary: macOS kills a sandboxed app started from its binary.
+- **Blazor Hybrid.** On a Mac, `data-testid` and HTML `id` do not reach the test driver, so the Mac screens are checked without control names (blank window, error bar, overlap, screenshot) and the control-by-control check is the Windows head's. Keep the stock error bar (`#blazor-error-ui`, "An unhandled error has occurred"), or pass its text with `--error-text`.
+
+## 9b. Zoom in Blazor Hybrid heads
+
+Every head that draws its screens in a `BlazorWebView` (Mac Catalyst and Windows) zooms with the operating system's keys: Cmd on the Mac, Ctrl on Windows, `=` in, `-` out, `0` actual size, and Ctrl+wheel on Windows. The Mac menu bar shows View › Zoom In, Zoom Out, Actual Size. The level runs from 50% to 300% in 10% steps and is kept in MAUI `Preferences` (key `tf.zoom`) across restarts.
+
+- **Copy, do not rewrite.** `.tfcore/standards/blazor-zoom.cs.txt` is the code: copy it to the project as `BlazorZoom.cs`, set its namespace, and add the hooks its header names (one line in the page holding the `BlazorWebView`, four members on the Mac app delegate).
+- **Mac Catalyst.** It sets `WKWebView.PageZoom`. From macOS 26 the main menu ignores what an app delegate's `BuildMenu` changes, so the commands are added through `UIMainMenuSystem.SharedSystem.SetBuildConfiguration`, with the Format menu off: its Font › Bigger and Smaller own Cmd+= and Cmd+-, and UIKit silently drops a menu whose shortcut repeats one.
+- **Windows.** The WinUI `WebView2` control does not expose WebView2's `ZoomFactor`, and WebView2's own zoom steps unevenly from 25% to 500% and keeps nothing. So its zoom control is turned off and a script added to every page handles the keys and the wheel, and posts each level back to be saved.
+
+`tf-maccatalyst-check.sh` warns about a Blazor Hybrid head without this; `tf-verify-zoom.sh` presses the keys on a booted head.
+
+## 10. Enforcement
 
 `.editorconfig` at the repository root (created at day-1) enforces: file-scoped namespaces (warning), `Async` suffix (warning), `var` for locals (warning), nullable enabled, no `_` prefix on private fields (custom naming rule, warning). `StyleCop.Analyzers` is optional and off by default.
 
@@ -90,4 +110,12 @@ grep -rE "public\s+(async\s+)?Task\s+\w+_\w+\s*\(" tests/ 2>/dev/null
 grep -rPE "private(\s+readonly)?\s+\w+\s+(?!obj)[A-Z]\w+\s*[;=]" src/ 2>/dev/null | grep -v "static\|const"
 ```
 
-Severity: error for file-scoped namespace and underscore field prefix; warning for nullable and the `Async` suffix; the rest informational.
+A MAUI project with a Mac Catalyst target or a Blazor Hybrid head also runs, on any host (it only reads files):
+
+```bash
+bash .tfcore/utils/tf-maccatalyst-check.sh    # FAIL: scene manifest or delegate missing; WARN: keychain on a local build, or a Blazor Hybrid head without zoom (§9b)
+```
+
+`tf-verify-boot.sh --head maccatalyst` runs it first and stops on a FAIL on macOS 27 or later.
+
+Severity: error for file-scoped namespace and underscore field prefix; error for a Mac Catalyst FAIL; warning for nullable and the `Async` suffix; the rest informational.

package/.tfcore/standards/owner-words.txt

@@ -0,0 +1,23 @@
+# Words the owner should never have to look up, and what to say instead.
+# Read by .tfcore/utils/tf-owner-text.py. One per line:  word | say instead
+# A line is added when the owner has had to ask what a word meant, or when the framework's own
+# rules name it (_owner-language.md). Adding a word is cheap; a word the owner knows is a false alarm,
+# so do not add ordinary English or the owner's own vocabulary (parity, checklist, verify, phase).
+oracle | the framework's own script
+denominator | the number you divide by
+numerator | the number being divided
+idempotent | safe to run twice
+invariant | a rule that always holds
+orthogonal | unrelated
+heuristic | a rule of thumb
+canonical | the standard one
+provenance | where the number came from
+cardinality | how many
+semantics | meaning
+deterministic | gives the same answer every time
+tuple | list
+enum | fixed list of values
+rollup | the combined report
+taint | marked unreliable
+short-circuit | stops early
+payload | the data sent

package/.tfcore/tasks/_develop-mode.md

@@ -0,0 +1,34 @@
+# _develop-mode (shared rule — *develop-end-to-end: a brief to a UAT-ready app, nobody asked)
+
+Develop mode is on while `.tfcore/.session/develop.json` exists. `tf-develop.sh` writes it when `*develop-end-to-end` starts and removes it when the run ends. Everything in `_yolo-mode.md` applies, and on top of it:
+
+## What changes
+
+- **No question to the owner, ever.** Every question a task would ask is answered here, or by the brief (`docs/{App}-Brief.md`), or decided by you. A decision the owner would normally make is written down where the owner will see it: in the Architecture's Stack Decisions, or in the document it belongs to, under a line starting `Decided in develop mode:`, with one reason. Never stop to ask, and never write `done blocked` for a question you could decide.
+- **The mockups are yours.** In this command you drew them on Day 1, so a difference between a mockup and what the stack mandates (a library's own control, a required layout) is never an owner decision: redraw the mockup to match the mandated component, write `Decided in develop mode:` with the reason in the UIDesign, re-render it, and verify again. The same for any document you wrote in this run. Only a thing the owner alone can supply is a blocker.
+- **No owner-review stop.** This is the one command that crosses the reviews: `*day1-greenfield` stage 1 ends without "review them, then run --stage2"; the supervisor starts stage 2 itself. Everything else about each stage is unchanged.
+- **Git is the supervisor's.** `tf-develop.sh` commits and pushes after each phase from its own shell. You still never run a git write: the guard is unchanged, and you do not need to.
+
+## Day 1 answers
+
+| Question in `day1-greenfield.md` | Answer in develop mode |
+|---|---|
+| 1. The app name | `{App}` from `develop.json` |
+| 2. The concept | `docs/{App}-Brief.md`, all of it |
+| 3. Hints | none, unless the brief names notes or mockups to harvest |
+| 4. The stack | the stack the brief names; when it names none, the owner's answer set under `.tfcore/templates/stack-defaults/` (the one `core-config.yaml` names, or the only one there). Each question that answer set leaves open is decided as below, and every answer is written into the Architecture's Stack Decisions |
+| 5. The size | the size you propose from your count; a Large brief is built as its phase 1 only, and the other phases are listed in the Build Report as not built |
+
+Questions an answer set commonly leaves open:
+
+- **Authentication.** The mechanism the brief names. When it names none: the app's own sign-in with local accounts, stored in the app's database; a shared identity platform needs credentials an unattended run does not have.
+- **Rendering or hosting model of the UI.** The one the brief implies; otherwise the answer set's first choice.
+- **Hosting and production secrets.** Not asked: they belong after UAT.
+
+## The database
+
+When the Architecture names a database server and none is reachable, create it locally and continue: a container named `{app}-db` (lower case) on a free port, with a development password kept in the app's development secrets, never in a committed file. Write the connection details into the UsageGuide's setup section. Create the schema only through the migration path the Stack Decisions name, during `*build-phase` (the database guard allows it there). This overrides the answer set's "never creates its own database container" for this command only.
+
+## What does not change
+
+The status gate, the smoke policy, the verifier's checks and the guard hooks. A row is `Verified` only from an executed verify. A thing only the owner can supply (a paid account, a device, a credential for a third-party service the brief requires) is still a blocker: finish everything else first, list it under PROJECT-STATUS "Known blockers", then `done blocked`.

package/.tfcore/tasks/_owner-language.md

@@ -9,6 +9,7 @@ Everything the owner reads — a terminal reply, a document, a status line, the
 - **No coined terms, no shorthand.** "the framework's own script", not "the oracle". "the number you divide by", not "the denominator". If the owner would have to look a word up, it is the wrong word.
 - **Writing a glossary means the words are wrong.** Change the words. `tf-doc-check.sh` refuses a glossary section.
 - First sentence carries the answer. Name the thing, not its id. Short sentences. Never dramatise.
+- **A command's closing message is checked before the turn can end** (`tf-owner-text.sh`, run by the Stop hook on it and on any free-form document it hands over): no word from `.tfcore/standards/owner-words.txt`; each open upstream problem in a table row saying what it affects and whether it blocks or breaks anything, with the prompt that fixes it; one recorded as fixed upstream called fixed; each command still to run given as the line to paste; and the next prompt in a code block.
 
 ## 2. A question for the owner goes in a file, not in the conversation
 

package/.tfcore/tasks/_status-update-gate.md

@@ -7,8 +7,9 @@ Steps, in this order:
 1. `bash .tfcore/utils/tf-status-facts.sh {App} "{command}"` prints today's date, the phase line, the last verified build, the Open requirements section, the Verification log with its new row, the library feedback lines, and the next command in both harness forms. Copy them as printed.
 2. Write `PROJECT-STATUS.md` with the Write tool in the shape of `.tfcore/templates/v4custom/app-project-status-tmpl.md`: replace every section in place, add none. You write two parts yourself: "Where I am" (at most 80 words, state not story) and "Known blockers". A refused write means the content is mis-shaped: trim it, do not reword it.
 3. `bash .tfcore/utils/tf-doc-check.sh PROJECT-STATUS.md <every document this command wrote>`; day-1 and `*amend-docs` run `--app {App}` instead, because they own every document. A `FAIL` line means the phase is not closed: fix the document and re-run. A line printed as `OLD` was already there when the command started (the phase marker records them); it does not block and is repaired through `*amend-docs`. Never edit a schema to make a document pass. Documents this command did not write are reported with `--warn`, not fixed here: an older project is repaired through `*amend-docs` when it is next worked on (Schemas §7.1, decision 8).
-4. `bash .tfcore/utils/tf-render-html.sh PROJECT-STATUS.md`, and the same for every human document this command wrote. The checklist is never rendered.
-5. `bash .tfcore/utils/tf-brd-status.sh {App}` rewrites the BRD's Development status table from the checklist and re-renders the BRD.
-6. Append the run record: `.tfcore/tasks/_metrics-emit-gate.md`.
+4. When this command changed a file under `docs/`, `bash .tfcore/utils/tf-doc-tests.sh <every document it changed>`. A unit test may read a document and guard its text; when one does, this runs the unit tests. `NONE` or `PASS` goes on. `FAIL` means the phase is not closed: put the guarded text back, or, when the change is meant, name the test under "Known blockers" for `*triage-and-fix` to update, since a document command never edits code. `NOT-RUN` is reported as it is printed (Lekhak TF-016).
+5. `bash .tfcore/utils/tf-render-html.sh PROJECT-STATUS.md`, and the same for every human document this command wrote. The checklist, the miss log and feedback files are never rendered.
+6. `bash .tfcore/utils/tf-brd-status.sh {App}` rewrites the BRD's Development status table from the checklist and re-renders the BRD.
+7. Append the run record: `.tfcore/tasks/_metrics-emit-gate.md`.
 
 Evidence for every line is the checklist's Requirements Status table and the files on disk, never git. Check a framework file by reading its literal path under `.tfcore/`; search tools skip that folder.