@techierathore/techieflow 1.1.0 → 1.2.0

package/.tfcore/hooks/guard-db.sh

@@ -15,6 +15,10 @@
 #   - a migration runner: dotnet ef database update, dotnet run --project <…Db|…Migration(s)…>,
 #     dbup, flyway migrate, liquibase update, alembic upgrade, prisma migrate, knex migrate,
 #     rails db:migrate, sequelize db:migrate
+#   - code a python / node / deno / bun / ruby / perl / pwsh run executes, inline or from a script
+#     file, that uses a database library and holds a SQL write, unless every database path it names
+#     is a throw-away (tests/.artifacts/, /tmp, :memory:) (Sevak TF-002)
+# A client or a SQL verb that is only mentioned (a grep pattern, a note written to a file) passes.
 # Reads (SELECT, \d, .tables, dumps to stdout) pass. YOLO does not relax this.
 #
 # Wired in .claude/settings.json → hooks.PreToolUse (matcher "Bash"); OpenCode via
@@ -55,17 +59,110 @@ def phase():
     except Exception:
         return None
 
-# Words inside an echo/printf string or a comment line are not commands: an echo naming the
-# migration tool refused a verify run's read on 2026-09-06 (MISS-TechieFlow-20260906-20).
-# Strip them before matching, so only a command that runs a migrator or writes through a
-# client is refused.
+# What counts is what RUNS, not what a command mentions (Sevak TF-002, 2026-10-06).
+#  - A client is a write only when it is the command word of a segment (after a start, ; & | ( or
+#    a backtick, past sudo / env / `exec <container>`), so a grep or a note naming a client and a
+#    SQL verb passes, while `<client> app.db "<write>"` does not.
+#  - A heredoc's body is SQL when it feeds a client, code when it feeds an interpreter, and data
+#    (dropped) when it feeds anything else (`cat > notes.md <<EOF`).
+#  - An interpreter (python, node, deno, bun, ruby, perl, pwsh) running inline code or a script
+#    file has that code read: a database library together with a SQL write is refused unless every
+#    database path it names is a throw-away one (tests/.artifacts/, /tmp, :memory:). A sub-agent's
+#    script deleted four owner settings from Sevak's app database because the guard saw only
+#    `python3 x.py`.
+# Words inside an echo/printf string or a comment line are not commands (MISS-TechieFlow-20260906-20),
+# unless the string is redirected into a file, which may then be run.
+SEG = (r"(?:^|[;&|(`\n]|\$\()\s*(?:sudo\s+(?:-\S+\s+)*)?(?:env\s+(?:\S+=\S*\s+)*)?"
+       r"(?:[\w./\\-]*\bexec\s+(?:-\S+\s+)*\S+\s+)?")
+CLIENT_AT = SEG + r"(?:\S*/)?" + CLIENTS
+INTERP = r"(?:python3?|py|node|deno|bun|ruby|perl|pwsh|powershell(?:\.exe)?|tsx|ts-node)"
+INTERP_AT = SEG + r"(?:\S*/)?" + INTERP + r"\b"
+DB_LIBS = (r"\bsqlite3\b|better-sqlite3|\bsql\.js\b|node:sqlite|\bpsycopg|\bpymysql\b|mysql\.connector|\bmysql2\b"
+           r"|require\(\s*['\"]pg['\"]\s*\)|from\s+['\"]pg['\"]|\bsqlalchemy\b|microsoft\.data\.sqlite|system\.data\.sqlite"
+           r"|\bpymongo\b|\bmongodb\b|\baiosqlite\b|\bduckdb\b|invoke-sqlcmd")
+SQL_WRITE = (r"\binsert\s+(?:or\s+\w+\s+)?into\b|\bupdate\s+[\w\"`\[\].]+\s+set\b|\bdelete\s+from\b"
+             r"|\bdrop\s+(?:table|index|view|database)\b|\bcreate\s+(?:table|index|view|trigger)\b|\balter\s+table\b"
+             r"|\btruncate\b|\breplace\s+into\b|\bexecutescript\b"
+             r"|\.(?:delete_many|delete_one|insert_one|insert_many|update_one|update_many|replace_one|drop)\s*\(")
+DB_PATH = r"['\"]([^'\"\n]*\.(?:db|sqlite3?|mdf)|:memory:)['\"]"
+SCRIPT_EXT = r"\.(?:py|js|mjs|cjs|ts|mts|rb|pl|ps1)\b"
+
+
+def throwaway(path):
+    q = path.replace("\\", "/").lower()
+    return q == ":memory:" or "tests/.artifacts/" in q or q.startswith("/tmp/") or "/tmp/" in q or q.startswith("tmp/")
+
+
+def code_writes(code):
+    """A database library and a SQL write in the same code, against a database that is not a throw-away."""
+    c = code.lower()
+    if not (re.search(DB_LIBS, c) and re.search(SQL_WRITE, c)):
+        return False
+    paths = re.findall(DB_PATH, c)
+    return not paths or not all(throwaway(x) for x in paths)
+
+
 low = cmd.lower()
 low = re.sub(r"(?m)^\s*#.*$", "", low)
-low = re.sub(r"\b(echo|printf)\s+(\"[^\"]*\"|'[^']*'|[^\n;|&]*)", r"\1", low)
-direct_write = (re.search(CLIENTS, low)
-                and (re.search(WRITE_VERBS, low)
-                     or re.search(r"\s-(f|i)\s+\S+\.sql\b", low)
-                     or re.search(r"<\s*\S+\.sql\b", low)))
+
+# heredocs first: keep the body only where it is SQL (fed to a client) or code (fed to an interpreter)
+code_bits, body_sql = [], []
+
+
+runs_code = bool(re.search(INTERP_AT, low))
+
+
+def _heredoc(m):
+    head, body = m.group(1), m.group(4)
+    if re.search(CLIENT_AT, head):
+        body_sql.append(body)
+    elif re.search(INTERP_AT, head) or runs_code:
+        # fed to an interpreter, or written to a file in a command that also runs one
+        # (`cat > s.py <<EOF … EOF; python3 s.py`): the file does not exist when this hook runs
+        code_bits.append(body)
+    return head + "\n"
+
+
+low = re.sub(r"(?ms)^([^\n]*?)<<-?\s*(['\"]?)(\w+)\2[^\n]*\n(.*?)^\s*\3\s*$", _heredoc, low)
+if runs_code:
+    code_bits.append(low)   # printf '…' > s.py && python3 s.py: the code is in the command itself
+# an echo/printf string is dropped unless it is redirected into a file
+low = re.sub(r"\b(echo|printf)\s+(?:\"[^\"]*\"|'[^']*'|[^\n;|&>]*)(?!\s*>)", r"\1", low)
+
+direct_write = bool(re.search(CLIENT_AT, low)
+                    and (re.search(WRITE_VERBS, low)
+                         or re.search(r"\s-(f|i)\s+\S+\.sql\b", low)
+                         or re.search(r"<\s*\S+\.sql\b", low))) or any(re.search(WRITE_VERBS, b) for b in body_sql)
+
+# inline code (-c / -e / --eval / -Command) and script files run by an interpreter
+script_write, script_name = False, ""
+if re.search(INTERP_AT, low) or code_bits:
+    for m in re.finditer(INTERP_AT + r"[^\n;|&]*?\s(?:-c|-e|--eval|-p|-command)\s+(\"(?:[^\"\\]|\\.)*\"|'[^']*')", low):
+        code_bits.append(m.group(1))
+    roots = [data.get("cwd") or "", os.environ.get("TF_ROOT", ".")]
+    # `cd tools && python3 seed.py`: the script is found from the folder the command moved to
+    for cdir in re.findall(r"(?:^|[;&|(]\s*)cd\s+(['\"]?)([^\s'\";&|]+)\1", cmd):
+        roots += [os.path.join(r, cdir[1]) for r in list(roots) if r] + [cdir[1]]
+    for seg in re.finditer(INTERP_AT + r"([^\n;|&]*)", cmd, flags=re.I):
+        for tok in re.findall(r"[^\s'\"]+" + SCRIPT_EXT, seg.group(1), flags=re.I):
+            for cand in [tok] + [os.path.join(r, tok) for r in roots if r]:
+                try:
+                    if os.path.isfile(cand) and os.path.getsize(cand) < 2_000_000:
+                        with open(cand, encoding="utf-8", errors="replace") as fh:
+                            if code_writes(fh.read()):
+                                script_write, script_name = True, tok
+                        break
+                except Exception:
+                    pass
+    script_write = script_write or any(code_writes(b) for b in code_bits)
+
+if script_write:
+    print("BLOCKED by TechieFlow policy: this runs code that writes to a database directly "
+          f"({script_name or 'inline code'}: a database library and an INSERT / UPDATE / DELETE / DROP / CREATE). "
+          "The app's database changes only through its migration path or through the app itself. For a "
+          "smoke or a seed, point the script at a throw-away copy whose path names tests/.artifacts/, /tmp "
+          "or :memory:, written literally in the script. Owner rule 2026-09-05; Sevak TF-002.", file=sys.stderr)
+    sys.exit(2)
 if direct_write or re.search(DROP_DB, low):
     print("BLOCKED by TechieFlow policy: a direct database write (SQL through a client, or dropping "
           "a database) is not allowed from any command. Schema and data changes go through the "

package/.tfcore/hooks/guard-status-html.sh

@@ -149,7 +149,11 @@ if written_this_session:
             app = os.path.basename(cl)[: -len("-Checklist.md")]
             brd = os.path.join(root, "docs", f"{app}-BRD.md")
             if os.path.isfile(brd) and os.path.getmtime(cl) > os.path.getmtime(brd):
-                problems.append(f"docs/{app}-BRD.md is older than docs/{app}-Checklist.md. Run: bash .tfcore/utils/tf-brd-status.sh {app}")
+                # the stem of a phase file is "<App>-P<n>": the command takes the app and --phase n
+                # (Lekhak TF-034, TechieRag TF-007)
+                m = re.match(r"^(.+)-P(\d+)$", app)
+                cmd = f"{m.group(1)} --phase {m.group(2)}" if m else app
+                problems.append(f"docs/{app}-BRD.md is older than docs/{app}-Checklist.md. Run: bash .tfcore/utils/tf-brd-status.sh {cmd}")
     except Exception:
         pass
 

package/.tfcore/hooks/guard-verify-deps.sh

@@ -26,7 +26,8 @@
 #   - any `|| docker compose up` fallback, which widens the command precisely when it failed
 #   - `docker compose run|create`, `docker run`, `docker volume create` — creating, not starting
 #   - an inline or exported connection-string variable in front of a test/run command
-# ALLOWS: `docker start <name>`, `docker compose up <service>`, `docker compose start`,
+# ALLOWS: during *develop-end-to-end only, one `docker run|create --name <app>-db …` (_develop-mode.md);
+#   always: `docker start <name>`, `docker compose up <service>`, `docker compose start`,
 #   `docker ps|logs|inspect`, and anything that is not one of the above.
 #
 # Wired in .claude/settings.json -> hooks.PreToolUse (matcher "Bash"); OpenCode via
@@ -97,6 +98,20 @@ if re.search(r"\|\|\s*" + COMPOSE + r"\s+up\b", cmd, re.I):
           "Drop the fallback. If the named service does not exist, the name is wrong — fix "
           "the name or ask; do not start everything instead.")
 
+# *develop-end-to-end (_develop-mode.md): the owner asked for the database to be created when none is
+# reachable. While that run is on (.tfcore/.session/develop.json), ONE command is allowed through: a single
+# `docker run|create` of the container that rule names, `--name <app>-db`, nothing else in the command.
+# Found by the first proof run, which stopped "blocked" because this hook refused it (2026-10-08).
+root = os.environ.get("CLAUDE_PROJECT_DIR") or os.environ.get("TF_PROJECT_DIR") or os.getcwd()
+dev = os.path.join(root, ".tfcore", ".session", "develop.json")
+if os.path.isfile(dev):
+    try: app = (json.load(open(dev)).get("app") or "").lower()
+    except Exception: app = ""
+    one = not re.search(r"(?:&&|\|\||;|\||\n|\$\(|`)", cmd)   # && first: the portability check reads a pipe-ampersand pair as bash 4
+    if app and one and re.match(r"\s*docker\s+(?:run|create)\b", cmd, re.I) \
+            and re.search(r"--name[ =]%s-db(?:\s|$)" % re.escape(app), cmd):
+        sys.exit(0)
+
 if re.search(COMPOSE + r"\s+(?:run|create)\b", cmd, re.I) or \
    re.search(r"\bdocker\s+(?:run|create)\b", cmd, re.I) or \
    re.search(r"\bdocker\s+volume\s+create\b", cmd, re.I):

package/.tfcore/hooks/yolo-allow.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# TechieFlow PreToolUse hook — while YOLO is on, nothing asks (owner, 2026-10-14: "When I am running
+# something in YOLO mode I am expecting that it doesn't ask me for permission whatever the case is").
+#
+# While the flag is live (TF_YOLO=1, or .tfcore/.session/yolo.json not expired — tf-yolo.sh is-on
+# decides) it answers every tool call with permissionDecision "allow", in the session already
+# running. A refusal still wins: the other PreToolUse hooks (block-git.sh for version-control
+# writes, guard-build.sh, guard-db.sh …) exit 2 and the call is blocked, and the deny rules in
+# settings.json still apply. Claude Code still asks where a hook's allow is not enough (an ask rule,
+# its own safety checks); only a session started with `claude --permission-mode bypassPermissions`
+# drops those, and project settings cannot set that mode (Claude Code refuses it there).
+# While YOLO is off it says nothing, and puts the OpenCode config back if a flag expired or went
+# away without `off` (tf-yolo.sh sync).
+#
+# Wired in .claude/settings.json → hooks.PreToolUse (matcher "*"). OpenCode's side is the plugin's
+# permission.ask and the OpenCode config tf-yolo.sh rewrites. Fails OPEN: no output, exit 0.
+
+cat >/dev/null
+ROOT="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+YOLO="$ROOT/.tfcore/utils/tf-yolo.sh"
+[[ -f "$YOLO" ]] || exit 0
+if CLAUDE_PROJECT_DIR="$ROOT" bash "$YOLO" is-on >/dev/null 2>&1; then
+  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"TechieFlow YOLO is on: no permission prompts (tf-yolo.sh off to end it)"}}'
+elif [[ -f "$ROOT/.tfcore/.session/yolo-perms.json" ]]; then
+  CLAUDE_PROJECT_DIR="$ROOT" bash "$YOLO" sync >/dev/null 2>&1
+fi
+exit 0

package/.tfcore/standards/blazor-zoom.cs.txt

@@ -0,0 +1,191 @@
+// blazor-zoom.cs.txt — copy to the MAUI project's root as BlazorZoom.cs and set the namespace
+// (coding-standards-dotnet.md §9b). Kept as .txt so a project whose .csproj sits at the repository root
+// does not compile the framework's copy. Then two hooks:
+//   MainPage (the page holding the BlazorWebView):
+//     blazorWebView.BlazorWebViewInitialized += (sender, args) => BlazorZoom.Attach(args.WebView);
+//   Platforms/MacCatalyst/AppDelegate.cs (inside the MauiUIApplicationDelegate class):
+//     public override void BuildMenu(UIKit.IUIMenuBuilder builder) { base.BuildMenu(builder); BlazorZoom.BuildMenu(builder); }
+//     [Export("tfZoomIn:")] public void ZoomIn(NSObject aSender) => BlazorZoom.ZoomBy(1);
+//     [Export("tfZoomOut:")] public void ZoomOut(NSObject aSender) => BlazorZoom.ZoomBy(-1);
+//     [Export("tfZoomReset:")] public void ZoomReset(NSObject aSender) => BlazorZoom.Reset();
+// Optional: set BlazorZoom.FirstLevel before the page is built (for example from the screen size) to open
+// at more than 100% before anyone has zoomed; Cmd/Ctrl+0 still means 100%.
+// Proved on Lekhak's BlogAdmin (macOS 27, 2026-10-11): bash .tfcore/utils/tf-verify-zoom.sh checks it.
+
+#nullable enable
+#if MACCATALYST
+using Foundation;
+using UIKit;
+using WebKit;
+#endif
+
+namespace YourApp;
+
+/// <summary>
+/// Zoom in, zoom out and actual size for the BlazorWebView, with the operating system's keys.
+/// </summary>
+/// <remarks>
+/// <para><b>Purpose:</b> [coding-standards-dotnet.md §9b] On a high-resolution Mac the text was too small and
+/// Cmd+= did nothing: a Mac Catalyst WKWebView has no zoom of its own. Every Blazor Hybrid head zooms from 50% to
+/// 300% in 10% steps, and the level is kept in MAUI Preferences across restarts.</para>
+/// <para><b>Code Flow:</b> <c>MainPage</c> hands the platform web view to <see cref="Attach"/> once the BlazorWebView is
+/// initialised, which applies the saved level. Mac Catalyst: the View menu's Zoom In (Cmd+=), Zoom Out (Cmd+-) and
+/// Actual Size (Cmd+0), added by <see cref="BuildMenu"/> from the app delegate, call <see cref="ZoomBy"/> and
+/// <see cref="Reset"/>, which set <c>WKWebView.PageZoom</c> on every attached web view, one per window. Windows: WebView2's own zoom (25% to 500%, uneven steps,
+/// not kept) is turned off, and a script run on every page handles Ctrl+plus, Ctrl+minus, Ctrl+0 and Ctrl+wheel with
+/// the same steps, posting each new level back to be saved (and keeping it for the session, so a page reload keeps
+/// it). The WinUI WebView2 control does not expose WebView2's own ZoomFactor, so that cannot be saved instead.</para>
+/// </remarks>
+public static class BlazorZoom
+{
+    /// <summary>The Preferences key the zoom level is kept under.</summary>
+    public const string PreferenceKey = "tf.zoom";
+
+    /// <summary>Smallest zoom, 50%.</summary>
+    public const double Min = 0.5;
+
+    /// <summary>Largest zoom, 300%.</summary>
+    public const double Max = 3.0;
+
+    /// <summary>One step, 10%.</summary>
+    public const double Step = 0.1;
+
+    /// <summary>The level used until one is saved; 1.0 unless the app sets it before the page is built.</summary>
+    public static double FirstLevel { get; set; } = 1.0;
+
+    /// <summary>The zoom level now in use, 1.0 being actual size.</summary>
+    public static double Level { get; private set; } = 1.0;
+
+    /// <summary>Rounds to a whole step and keeps the level inside 50% to 300%.</summary>
+    /// <param name="aLevel">The level asked for.</param>
+    /// <returns>The level that will be used.</returns>
+    public static double Clamp(double aLevel) => Math.Round(Math.Clamp(aLevel, Min, Max) * 10) / 10;
+
+#if MACCATALYST
+    // every window's web view, weakly, so a Mac app with several BlazorWebView windows zooms them all (Chatur TF-010)
+    private static readonly List<WeakReference<WKWebView>> lstWebViews = new();
+    private static bool blnMenuSet;
+
+    /// <summary>Takes the platform web view and applies the saved level.</summary>
+    /// <param name="aPlatformWebView">The <c>BlazorWebViewInitializedEventArgs.WebView</c>.</param>
+    public static void Attach(object aPlatformWebView)
+    {
+        if (aPlatformWebView is WKWebView objWebView)
+        {
+            lstWebViews.Add(new WeakReference<WKWebView>(objWebView));
+        }
+
+        Apply(Preferences.Default.Get(PreferenceKey, FirstLevel));
+        if (!blnMenuSet && OperatingSystem.IsMacCatalystVersionAtLeast(26))
+        {
+            // From macOS 26 the main menu is built here: what an app delegate's BuildMenu changes is ignored.
+            // Format is off because its Font › Bigger and Smaller already own Cmd+= and Cmd+-, and UIKit
+            // silently drops a menu whose shortcut repeats one; Inspector is off because the app has none.
+            blnMenuSet = true;
+            var objConfig = new UIMainMenuSystemConfiguration
+            {
+                TextFormattingPreference = UIMenuSystemElementGroupPreference.Removed,
+                InspectorPreference = UIMenuSystemElementGroupPreference.Removed,
+            };
+            UIMainMenuSystem.SharedSystem.SetBuildConfiguration(objConfig, AddCommands);
+        }
+    }
+
+    /// <summary>Adds Zoom In, Zoom Out and Actual Size to the top of the View menu, before macOS 26.</summary>
+    /// <param name="aBuilder">The builder the app delegate's <c>BuildMenu</c> receives.</param>
+    /// <remarks>The selectors are answered by <c>[Export]</c> methods on the app delegate, which is on the
+    /// responder chain whatever has focus inside the web view. From macOS 26 <see cref="Attach"/> does this.</remarks>
+    public static void BuildMenu(IUIMenuBuilder aBuilder)
+    {
+        if (!OperatingSystem.IsMacCatalystVersionAtLeast(26) && aBuilder.System?.Handle == UIMenuSystem.MainSystem.Handle)
+        {
+            aBuilder.RemoveMenu(UIMenuIdentifier.Format.GetConstant()!);
+            AddCommands(aBuilder);
+        }
+    }
+
+    /// <summary>Zooms in (a positive step) or out (a negative one).</summary>
+    /// <param name="aSteps">How many 10% steps.</param>
+    public static void ZoomBy(int aSteps) => Apply(Level + (aSteps * Step));
+
+    /// <summary>Back to actual size.</summary>
+    public static void Reset() => Apply(1.0);
+
+    private static void AddCommands(IUIMenuBuilder aBuilder)
+    {
+        var objView = aBuilder.GetMenu(UIMenuIdentifier.View.GetConstant()!);
+        if (objView == null || objView.Children.Any(c => c.Title == "Zoom In"))
+        {
+            return;
+        }
+
+        var objZoom = UIMenu.Create(string.Empty, null, UIMenuIdentifier.None, UIMenuOptions.DisplayInline, new UIMenuElement[]
+        {
+            UIKeyCommand.Create("Zoom In", null, new ObjCRuntime.Selector("tfZoomIn:"), "=", UIKeyModifierFlags.Command, null),
+            UIKeyCommand.Create("Zoom Out", null, new ObjCRuntime.Selector("tfZoomOut:"), "-", UIKeyModifierFlags.Command, null),
+            UIKeyCommand.Create("Actual Size", null, new ObjCRuntime.Selector("tfZoomReset:"), "0", UIKeyModifierFlags.Command, null),
+        });
+        aBuilder.ReplaceMenu(UIMenuIdentifier.View.GetConstant()!, objView.GetMenuByReplacingChildren(new UIMenuElement[] { objZoom }.Concat(objView.Children).ToArray()));
+    }
+
+    private static void Apply(double aLevel)
+    {
+        Level = Clamp(aLevel);
+        Preferences.Default.Set(PreferenceKey, Level);
+        lstWebViews.RemoveAll(w => !w.TryGetTarget(out _));
+        foreach (var objRef in lstWebViews)
+        {
+            if (objRef.TryGetTarget(out var objWebView))
+            {
+                objWebView.PageZoom = (nfloat)Level;
+            }
+        }
+    }
+#elif WINDOWS
+    private const string MessagePrefix = "tfzoom:";
+
+    /// <summary>Takes the platform web view, turns WebView2's own zoom off and installs the key and wheel handler.</summary>
+    /// <param name="aPlatformWebView">The <c>BlazorWebViewInitializedEventArgs.WebView</c>.</param>
+    public static async void Attach(object aPlatformWebView)
+    {
+        if (aPlatformWebView is not Microsoft.UI.Xaml.Controls.WebView2 objWebView || objWebView.CoreWebView2 == null)
+        {
+            return;
+        }
+
+        var objCore = objWebView.CoreWebView2;
+        Level = Clamp(Preferences.Default.Get(PreferenceKey, FirstLevel));
+        objCore.Settings.IsZoomControlEnabled = false;
+        objCore.WebMessageReceived += (sender, args) =>
+        {
+            var strMessage = args.TryGetWebMessageAsString();
+            if (strMessage != null && strMessage.StartsWith(MessagePrefix, StringComparison.Ordinal)
+                && double.TryParse(strMessage[MessagePrefix.Length..], System.Globalization.NumberStyles.Float, System.Globalization.CultureInfo.InvariantCulture, out var dblLevel))
+            {
+                Level = Clamp(dblLevel);
+                Preferences.Default.Set(PreferenceKey, Level);
+            }
+        };
+        var strLevel = Level.ToString(System.Globalization.CultureInfo.InvariantCulture);
+        await objCore.AddScriptToExecuteOnDocumentCreatedAsync(
+            "(function(){var z=parseFloat(sessionStorage.getItem('tfzoom'))||" + strLevel + ",min=0.5,max=3;"
+            + "function set(v){z=Math.round(Math.min(max,Math.max(min,v))*10)/10;document.documentElement.style.zoom=z;"
+            + "sessionStorage.setItem('tfzoom',z);window.chrome.webview.postMessage('" + MessagePrefix + "'+z);}"
+            + "function apply(){document.documentElement.style.zoom=z;}"
+            + "if(document.documentElement){apply();}document.addEventListener('DOMContentLoaded',apply);"
+            + "window.addEventListener('keydown',function(e){if(!e.ctrlKey||e.altKey||e.metaKey)return;"
+            + "if(e.key==='='||e.key==='+'){set(z+0.1);}else if(e.key==='-'){set(z-0.1);}else if(e.key==='0'){set(1);}else return;"
+            + "e.preventDefault();},true);"
+            + "window.addEventListener('wheel',function(e){if(!e.ctrlKey)return;e.preventDefault();set(z+(e.deltaY<0?0.1:-0.1));},{passive:false});"
+            + "})();");
+        // the page already loaded before the script was added: give it the level too
+        await objCore.ExecuteScriptAsync("document.documentElement.style.zoom=" + strLevel + ";");
+    }
+#else
+    /// <summary>No zoom on this head.</summary>
+    /// <param name="aPlatformWebView">Unused.</param>
+    public static void Attach(object aPlatformWebView)
+    {
+    }
+#endif
+}

package/.tfcore/standards/coding-standards-dotnet.md

@@ -69,13 +69,33 @@ Controller actions: the `a` prefix applies to `[FromRoute]`, `[FromQuery]` and `
 ## 7. Testability
 
 - Blazor: a stable `data-testid` (or element id) on every control the verifier must reach.
-- MAUI: a stable, unique `AutomationId` on every interactive or data-bound control, named by intent (`LoginSubmitButton`, `ClientsGrid`), set on the element whose data the gate asserts.
+- MAUI: a stable, unique `AutomationId` on every interactive or data-bound control, named by intent (`LoginSubmitButton`, `ClientsGrid`), set on the element whose data the gate asserts. The tab, menu item or button that opens a screen carries `AutomationId="nav-<screen>"` (the screen's name, lower case, words joined by `-`), or a label equal to the screen's name; the Mac check reaches screens that way.
 
 ## 8. Security
 
 - No credentials in code. Parameterised queries. Validate inputs. Log security events.
 
-## 9. Enforcement
+## 9. Mac Catalyst heads
+
+Every MAUI project with a `net*-maccatalyst` target, Blazor Hybrid included:
+
+- **Scene manifest.** `Platforms/MacCatalyst/Info.plist` carries `UIApplicationSceneManifest` with a `UIWindowSceneSessionRoleApplication` configuration named `__MAUI_DEFAULT_SCENE_CONFIGURATION__` whose `UISceneDelegateClassName` is `SceneDelegate`, and the project has `[Register("SceneDelegate")] public class SceneDelegate : MauiUISceneDelegate { }` beside the `AppDelegate`. On macOS 27 an app without it quits at its first window; the stock `dotnet new maui` template has none, so add it when the project is created.
+- **Keychain and signing.** An app that asks for `keychain-access-groups` (MAUI `SecureStorage` needs it) must be signed with a development certificate and provisioning profile (`CodesignKey`, `CodesignProvisioningProfile`), or give Debug builds a second entitlements file without it and a Debug credential store that does not use the keychain. macOS refuses to start a locally signed build that asks for it. Decide which before the first Mac build.
+- **Clean after an update.** After a .NET SDK or MAUI workload update, build the Mac head from clean (`--no-incremental`, or delete its `bin/` and `obj/`): an old precompiled build stops at start in `load_aot_module`.
+- **Launching it.** Open the built `.app` with `open`, never its binary: macOS kills a sandboxed app started from its binary.
+- **Blazor Hybrid.** On a Mac, `data-testid` and HTML `id` do not reach the test driver, so the Mac screens are checked without control names (blank window, error bar, overlap, screenshot) and the control-by-control check is the Windows head's. Keep the stock error bar (`#blazor-error-ui`, "An unhandled error has occurred"), or pass its text with `--error-text`.
+
+## 9b. Zoom in Blazor Hybrid heads
+
+Every head that draws its screens in a `BlazorWebView` (Mac Catalyst and Windows) zooms with the operating system's keys: Cmd on the Mac, Ctrl on Windows, `=` in, `-` out, `0` actual size, and Ctrl+wheel on Windows. The Mac menu bar shows View › Zoom In, Zoom Out, Actual Size. The level runs from 50% to 300% in 10% steps and is kept in MAUI `Preferences` (key `tf.zoom`) across restarts.
+
+- **Copy, do not rewrite.** `.tfcore/standards/blazor-zoom.cs.txt` is the code: copy it to the project as `BlazorZoom.cs`, set its namespace, and add the hooks its header names (one line in the page holding the `BlazorWebView`, four members on the Mac app delegate).
+- **Mac Catalyst.** It sets `WKWebView.PageZoom`. From macOS 26 the main menu ignores what an app delegate's `BuildMenu` changes, so the commands are added through `UIMainMenuSystem.SharedSystem.SetBuildConfiguration`, with the Format menu off: its Font › Bigger and Smaller own Cmd+= and Cmd+-, and UIKit silently drops a menu whose shortcut repeats one.
+- **Windows.** The WinUI `WebView2` control does not expose WebView2's `ZoomFactor`, and WebView2's own zoom steps unevenly from 25% to 500% and keeps nothing. So its zoom control is turned off and a script added to every page handles the keys and the wheel, and posts each level back to be saved.
+
+`tf-maccatalyst-check.sh` warns about a Blazor Hybrid head without this; `tf-verify-zoom.sh` presses the keys on a booted head.
+
+## 10. Enforcement
 
 `.editorconfig` at the repository root (created at day-1) enforces: file-scoped namespaces (warning), `Async` suffix (warning), `var` for locals (warning), nullable enabled, no `_` prefix on private fields (custom naming rule, warning). `StyleCop.Analyzers` is optional and off by default.
 
@@ -90,4 +110,12 @@ grep -rE "public\s+(async\s+)?Task\s+\w+_\w+\s*\(" tests/ 2>/dev/null
 grep -rPE "private(\s+readonly)?\s+\w+\s+(?!obj)[A-Z]\w+\s*[;=]" src/ 2>/dev/null | grep -v "static\|const"
 ```
 
-Severity: error for file-scoped namespace and underscore field prefix; warning for nullable and the `Async` suffix; the rest informational.
+A MAUI project with a Mac Catalyst target or a Blazor Hybrid head also runs, on any host (it only reads files):
+
+```bash
+bash .tfcore/utils/tf-maccatalyst-check.sh    # FAIL: scene manifest or delegate missing; WARN: keychain on a local build, or a Blazor Hybrid head without zoom (§9b)
+```
+
+`tf-verify-boot.sh --head maccatalyst` runs it first and stops on a FAIL on macOS 27 or later.
+
+Severity: error for file-scoped namespace and underscore field prefix; error for a Mac Catalyst FAIL; warning for nullable and the `Async` suffix; the rest informational.

package/.tfcore/tasks/_develop-mode.md

@@ -0,0 +1,34 @@
+# _develop-mode (shared rule — *develop-end-to-end: a brief to a UAT-ready app, nobody asked)
+
+Develop mode is on while `.tfcore/.session/develop.json` exists. `tf-develop.sh` writes it when `*develop-end-to-end` starts and removes it when the run ends. Everything in `_yolo-mode.md` applies, and on top of it:
+
+## What changes
+
+- **No question to the owner, ever.** Every question a task would ask is answered here, or by the brief (`docs/{App}-Brief.md`), or decided by you. A decision the owner would normally make is written down where the owner will see it: in the Architecture's Stack Decisions, or in the document it belongs to, under a line starting `Decided in develop mode:`, with one reason. Never stop to ask, and never write `done blocked` for a question you could decide.
+- **The mockups are yours.** In this command you drew them on Day 1, so a difference between a mockup and what the stack mandates (a library's own control, a required layout) is never an owner decision: redraw the mockup to match the mandated component, write `Decided in develop mode:` with the reason in the UIDesign, re-render it, and verify again. The same for any document you wrote in this run. Only a thing the owner alone can supply is a blocker.
+- **No owner-review stop.** This is the one command that crosses the reviews: `*day1-greenfield` stage 1 ends without "review them, then run --stage2"; the supervisor starts stage 2 itself. Everything else about each stage is unchanged.
+- **Git is the supervisor's.** `tf-develop.sh` commits and pushes after each phase from its own shell. You still never run a git write: the guard is unchanged, and you do not need to.
+
+## Day 1 answers
+
+| Question in `day1-greenfield.md` | Answer in develop mode |
+|---|---|
+| 1. The app name | `{App}` from `develop.json` |
+| 2. The concept | `docs/{App}-Brief.md`, all of it |
+| 3. Hints | none, unless the brief names notes or mockups to harvest |
+| 4. The stack | the stack the brief names; when it names none, the owner's answer set under `.tfcore/templates/stack-defaults/` (the one `core-config.yaml` names, or the only one there). Each question that answer set leaves open is decided as below, and every answer is written into the Architecture's Stack Decisions |
+| 5. The size | the size you propose from your count; a Large brief is built as its phase 1 only, and the other phases are listed in the Build Report as not built |
+
+Questions an answer set commonly leaves open:
+
+- **Authentication.** The mechanism the brief names. When it names none: the app's own sign-in with local accounts, stored in the app's database; a shared identity platform needs credentials an unattended run does not have.
+- **Rendering or hosting model of the UI.** The one the brief implies; otherwise the answer set's first choice.
+- **Hosting and production secrets.** Not asked: they belong after UAT.
+
+## The database
+
+When the Architecture names a database server and none is reachable, create it locally and continue: a container named `{app}-db` (lower case) on a free port, with a development password kept in the app's development secrets, never in a committed file. Write the connection details into the UsageGuide's setup section. Create the schema only through the migration path the Stack Decisions name, during `*build-phase` (the database guard allows it there). This overrides the answer set's "never creates its own database container" for this command only.
+
+## What does not change
+
+The status gate, the smoke policy, the verifier's checks and the guard hooks. A row is `Verified` only from an executed verify. A thing only the owner can supply (a paid account, a device, a credential for a third-party service the brief requires) is still a blocker: finish everything else first, list it under PROJECT-STATUS "Known blockers", then `done blocked`.

package/.tfcore/tasks/_smoke-test-policy.md

@@ -12,23 +12,25 @@ A screen passes only if all three hold, at a desktop width and a mobile width:
 
 A failure on any of the three is a defect: write it into the row's Remarks (prefix `⚠ visual:` for 2 and 3) and do not report the row done. A smoke earns a row at most `Implemented`; only an executed verify run writes `Verified`.
 
-The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives an embedded-browser desktop head Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
+The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives a Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
 
 ## Run it yourself
 
-The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. A dependent service that is down is something you start, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
+The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. Start a dependent service that is down, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
 
 ## Test users
 
-Resolve credentials in this order and stop at the first that works:
+Take credentials from the first that works:
 
 1. The Test users table in `docs/<App>-UsageGuide.md`.
-2. An existing account in the database, read with the connection string from the configuration.
+2. An existing account in the database, read with the configured connection string.
 3. Ask the owner, showing what you would create.
-4. Only after a yes, create it and add it to the Test users table.
+4. Only after a yes, create it and add it to the table.
 
 Never invent a throwaway account.
 
+An AppManager app skips steps 2 to 4 (stack answer Q4a): register through its register call, passwords in git-ignored secrets, never the owner's account.
+
 ## Say what ran
 
 Name the exact command and where it ran: which host, which rung, focused tests or the full build, your own smoke or an executed verify. A green intermediate step is not a pass of the whole.

package/.tfcore/tasks/_yolo-mode.md

@@ -1,6 +1,6 @@
 # _yolo-mode (shared rule — YOLO / goal mode: run unattended to completion)
 
-YOLO means all permissions and all access are granted: run one command to completion and never stop to check in. It never crosses an owner review into the next phase; `*day1-greenfield` runs one stage, and stage 2 needs `--stage2`. `*build-phase` and `*verify` are in YOLO by default; every other command honours it when it is on.
+YOLO means all permissions and all access are granted: run one command to completion and never stop to check in. It never crosses an owner review into the next phase; `*day1-greenfield` runs one stage, and stage 2 needs `--stage2`. The one command that does is `*develop-end-to-end`, under its own rule (`_develop-mode.md`). `*build-phase` and `*verify` are in YOLO by default; every other command honours it when it is on.
 
 ## When it is on
 
@@ -14,7 +14,7 @@ YOLO means all permissions and all access are granted: run one command to comple
 
 ## What changes
 
-- Deletes and `sudo` run without a prompt. Read-only git is allowed. Git writes stay refused in every mode; the owner commits.
+- Nothing asks. Deletes and `sudo` run without a prompt; `tf-yolo.sh on` also makes OpenCode stop asking (from its next session) and the `yolo-allow.sh` hook approves every Claude Code call. Claude Code's own safety checks still ask unless the session was started with `tfyolo` (`tfyolo -c` keeps the conversation); say that in one line when one asks. Read-only git is allowed. Git writes stay refused in every mode; the owner commits.
 - No question, confirmation or pause: take the documented default and record it in the checklist Remarks. The one question that survives is a new test user (`_smoke-test-policy.md`): use a documented account; if none exists, create one named `{App}-yolo-tester`, record it in the UsageGuide, and continue.
 - Never end a turn with a question, a plan or "shall I". End only when the command is complete or everything left is owner-only.
 - A failed build, a dead port, a stopped service: fix it and continue. A `429` from a sub-agent or an API: wait 60 seconds, retry once, then route around it.

package/.tfcore/tasks/amend-docs.md

@@ -18,7 +18,7 @@ First: `bash .tfcore/utils/tf-phase.sh start amend-docs {App}` prints the start
 4. BRD. ADD: append a ledger item with the next id, its screen, its mockup link and its acceptance line "When <actor> <does what> on <screen>, then <observable result>"; a new screen gets a row in the Screens and flow table and a Planned row in the Development status table. MODIFY: edit the item in place, same id. REMOVE: `~~BRD-N~~ (removed {date}: reason)`, never deleted. If the additions would take a Small project past 50 requirements, raise it to Medium: `bash .tfcore/utils/tf-day1-files.sh {App} --size M` and the Size in every document header. If they would take a Medium project, or one phase, past 100 requirements or 20 screens, stop and propose a phase split: a new row in `docs/{App}-Phases.md` (written with `--size L` when absent) and a new `docs/{App}-Pn-BRD.md`, instead of growing this one.
 5. Architecture, when in scope and ARCH items exist: edit the affected sections in place, and add a Decisions log row (date, decision, why, status `planned` naming the BRD item) for every new decision or package. A reversed decision gets a new row; the old row stays.
 6. Mockups: when a screen was added or changed, run `.tfcore/tasks/mockups.md` with `--update`, so every screen in the BRD has a current mockup before the checklist changes.
-7. Checklist, only if it exists. ADD: `bash .tfcore/utils/tf-split-brd.sh {App} --add-missing` appends rows for the new items; correct their class. MODIFY: set the rows derived from that item to `Needs re-verify` with a Remark saying what changed. REMOVE: set them to `N/A (removed {date})` and keep the rows. Where the mapping from an item to its rows is unclear, ask, do not guess. If the checklist does not exist yet, the next day-1 stage 2 picks everything up.
+7. Checklist, only if it exists. ADD: `bash .tfcore/utils/tf-split-brd.sh {App} --add-missing` appends rows for the new items; correct their class. MODIFY: set the rows derived from that item to `Needs re-verify` with a Remark saying what changed. REMOVE: set Status to `N/A`, `%` to `0` and the Remark to `removed {date}: <reason>`, and keep the rows; the check does not ask a removed row for an acceptance line, BRD item, mockup or detail entry. Where the mapping from an item to its rows is unclear, ask, do not guess. If the checklist does not exist yet, the next day-1 stage 2 picks everything up.
 8. If the amendment changed code-level flows, say that `*devguide {App} --update` is due after the next build.
 9. Close what this amendment fixed: `bash .tfcore/utils/tf-emit.sh --open-misses {App} --artifact-class doc` lists the open misses whose deficient artifact is a document. Close the ones this amendment resolves in one call: `bash .tfcore/utils/tf-fix-close.sh {App} --misses <id>,<id> --fix-cmd amend-docs --verdict Verified`. Where the mapping from a miss to this amendment is unclear, ask, do not guess. Without this a document miss can never close: `*fix-issues` and `*build-phase` close off checklist rows the verifier touched, which a BRD edit never is.
 10. Decide whether this amendment is a miss: should the original documents plainly have said this (a behaviour that was always required, or two sections that contradicted each other)? Then run `*log-miss {App} "<one sentence>"`. A change of mind or a feature decided today is scope arriving late, not a miss.

package/.tfcore/tasks/day1-brownfield.md

@@ -13,7 +13,7 @@ First, before anything else: `bash .tfcore/utils/tf-phase.sh start day1-brownfie
 
 ## Steps, in this order
 
-1. `bash .tfcore/utils/tf-day1-files.sh {App} --size {S|M|L} --kind {app|library}` writes the size, the kind and the document paths into `core-config.yaml`; for Large it also writes `docs/{App}-Phases.md`, whose table you fill first: one row per phase, each within Medium, every screen in exactly one phase. Before rewriting any document that already exists, `bash .tfcore/utils/tf-day1-files.sh --archive <file> ...` moves it to `docs/OldDocs/`. Never write a `-v2` variant.
+1. `bash .tfcore/utils/tf-day1-files.sh {App} --size {S|M|L} --kind {app|library}` writes the size and the kind into `core-config.yaml` and nothing else; for Large it also writes `docs/{App}-Phases.md`, whose table you fill first: one row per phase, each within Medium, every screen in exactly one phase. Before rewriting any document that already exists, `bash .tfcore/utils/tf-day1-files.sh --archive <file> ...` moves it to `docs/OldDocs/`. Never write a `-v2` variant.
 2. `bash .tfcore/utils/tf-mockups-locate.sh` moves every mockup found elsewhere in the repository into `docs/mockups/`, the only mockup folder, and lists what is there.
 3. Architecture: `docs/{App}-Architecture.md` from `.tfcore/templates/v4custom/app-architecture-tmpl.md`, in the template's order, Status "Current". Harvest architecture material from the hint documents first, attributed; scan the code only for what they do not cover. Stack decisions come from the project files, citing the source per row; the Solution structure from the projects; the Component map from project references; the Data model from the migrations or entity classes; the Decisions log opens with "current stack as-is" and adds a `planned` row for every structural change the BRD calls for. Scan the instance fields for the dominant naming style; if none reaches about 80 percent, record the drift under Open questions. Quote every mermaid label; never use `end` as a node id.
 4. BRD, first half: `docs/{App}-BRD.md` from `app-brd-tmpl.md`: the header (App, Kind, Size, Stack answer set, Status, Date), Summary, Scope, Users and roles, and the Screens and flow table, one row per routed page found in the code. A dialog is a row under its parent screen with `on /route` in the Route column.
@@ -22,7 +22,7 @@ First, before anything else: `bash .tfcore/utils/tf-phase.sh start day1-brownfie
    Large: steps 4 to 6 run once per phase of the Phases table, phase 1 in `docs/{App}-BRD.md` and `docs/{App}-UIDesign.md`, phase n in `docs/{App}-Pn-BRD.md` (from `app-phase-brd-tmpl.md`: this phase's screens and requirements only, linking back to phase 1) and `docs/{App}-Pn-UIDesign.md` (from `app-phase-uidesign-tmpl.md`, the same way), each header carrying `Phase | n of m` and its own Size, ids running on across phases.
 7. Checklist: run `.tfcore/tasks/split-brd.md` for `{App}` (Large: with `--all-phases`, one checklist per phase). If a phased plan is among the harvested documents, split-brd migrates its statuses; the plan then moves to `docs/OldDocs/`.
 8. Coding Standards: `docs/{App}-Coding-Standards.md` from `app-coding-standards-tmpl.md`. "Standards applied" names `.tfcore/standards/coding-standards-core.md` and the stack file, plus the choices the stack file leaves open. Where the stack file leaves a naming convention open, it follows the drift scan of step 3: the dominant style if one reaches 80 percent, else the stack file's default; a drafting instruction overrides. "Project rules" holds only rules true of this project alone.
-9. `bash .tfcore/utils/tf-day1-files.sh {App} --prefix {obj|none}` writes `.editorconfig`, `AGENTS.md` and `CLAUDE.md`.
+9. `bash .tfcore/utils/tf-day1-files.sh {App} --prefix {obj|none}` writes `.editorconfig`, `AGENTS.md` and `CLAUDE.md` and adds the document paths to `core-config.yaml`.
 10. `bash .tfcore/utils/tf-gitignore-audit.sh . --fix`. Read its output. Any untracking commands it prints go into your summary for the owner to run; agents never run git.
 11. Build once through `.tfcore/templates/v4custom/build-invocation-ladder.md`. A real compile error becomes one line under Known blockers; a wrong-rung error never does.
 12. UsageGuide: `docs/{App}-UsageGuide.md` from `app-usageguide-tmpl.md`. Test users: read the users table through the connection string in the configuration and list the existing accounts, one per role, marked as existing, with "ask owner" where a password is unknown; if the database is unreachable, list the intended accounts as planned. Create no user. The Execution guide from the code; one "How to test" section per screen in navigation order, naming the user, the steps, the expected result and the REQ ids.

package/.tfcore/tasks/day1-greenfield.md

@@ -1,12 +1,12 @@
 # day1-greenfield
 
-`*day1-greenfield {App}` starts a product that has no code. It runs in two stages with one owner review between them. Stage 1 produces the Architecture, the mockups and the BRD, then stops for review. `*day1-greenfield {App} --stage2` runs only after the owner has approved them and produces the checklist and the remaining documents. No mode skips the review: YOLO runs one stage to completion, never both.
+`*day1-greenfield {App}` starts a product that has no code. It runs in two stages with one owner review between them. Stage 1 produces the Architecture, the mockups and the BRD, then stops for review. `*day1-greenfield {App} --stage2` runs only after the owner has approved them and produces the checklist and the remaining documents. No mode skips the review: YOLO runs one stage to completion, never both. The one exception is `*develop-end-to-end`, which runs both stages itself (`.tfcore/tasks/_develop-mode.md`).
 
 First, before anything else: `bash .tfcore/utils/tf-phase.sh start day1-greenfield {App}` prints the start time and marks the command running.
 
 ## Stage 1 — Architecture, mockups, BRD
 
-Ask once each, and nothing per section:
+Ask once each, and nothing per section (in develop mode ask nothing: `_develop-mode.md` gives every answer):
 
 1. `{App}` if missing. PascalCase, no spaces.
 2. The concept: "Describe the app, any length: a sentence, paragraphs, bullets, half-baked notes, comparisons to other apps. You will edit the document afterwards." Read all of it. Never cap or summarise the owner's input.
@@ -16,7 +16,7 @@ Ask once each, and nothing per section:
 
 Then, in this order:
 
-6. `bash .tfcore/utils/tf-day1-files.sh {App} --size {S|M|L} --kind {app|library}` writes the size, the kind and the document paths into `core-config.yaml`; for Large it also writes `docs/{App}-Phases.md`, whose table you fill first: one row per phase, each within Medium, every screen in exactly one phase. On a re-run of stage 1, first `bash .tfcore/utils/tf-day1-files.sh --archive docs/{App}-BRD.md docs/{App}-Architecture.md docs/{App}-UIDesign.md` moves the old copies to `docs/OldDocs/`. Never write a `-v2` variant; never ask merge-or-new.
+6. `bash .tfcore/utils/tf-day1-files.sh {App} --size {S|M|L} --kind {app|library}` writes the size and the kind into `core-config.yaml` and nothing else; for Large it also writes `docs/{App}-Phases.md`, whose table you fill first: one row per phase, each within Medium, every screen in exactly one phase. On a re-run of stage 1, first `bash .tfcore/utils/tf-day1-files.sh --archive docs/{App}-BRD.md docs/{App}-Architecture.md docs/{App}-UIDesign.md` moves the old copies to `docs/OldDocs/`. Never write a `-v2` variant; never ask merge-or-new.
 7. Architecture: `docs/{App}-Architecture.md` from `.tfcore/templates/v4custom/app-architecture-tmpl.md`, in the template's order. Stack decisions come from the answer set and the owner's answers, each row citing its source. Harvested notes carry into the sections attributed, never summarised away. Quote every mermaid label; never use `end` as a node id.
 8. BRD, first half: `docs/{App}-BRD.md` from `app-brd-tmpl.md`: the header (App, Kind, Size, Stack answer set, Status, Date), Summary, Scope, Users and roles, and the Screens and flow table. A dialog is a row under its parent screen with `on /route` in the Route column.
 9. Mockups: run `.tfcore/tasks/mockups.md` for `{App}`. It reads the Screens and flow table and produces `docs/{App}-UIDesign.md` and one `docs/mockups/<screen>.html` per screen. An app with no screens records "skipped — no UI".
@@ -33,7 +33,7 @@ Only with `--stage2`, and only when `docs/{App}-BRD.md` exists. Ask nothing.
 0. If the owner gave corrections at the review, apply them to the stage-1 documents first (ids never renumbered; `bash .tfcore/utils/tf-doc-check.sh --app {App}` must pass), count them, and after this run's record append a `review` record: `{"kind":"review","phase":"day1-review","reviewed_run_id":"<stage 1 started>","correction_run_id":"<this run's started>","corrections":N,"what":"<one sentence>"}` through `tf-emit.sh misses`.
 1. Checklist: run `.tfcore/tasks/split-brd.md` for `{App}` (Large: with `--all-phases`, one checklist per phase). The owner never types `*split-brd`.
 2. Coding Standards: `docs/{App}-Coding-Standards.md` from `app-coding-standards-tmpl.md`. "Standards applied" names `.tfcore/standards/coding-standards-core.md` and the stack file, plus the choices the stack file leaves open, taking that file's stated default for each. "Project rules" stays empty unless the concept demands a rule true of this project alone.
-3. `bash .tfcore/utils/tf-day1-files.sh {App} --prefix {obj|none}` writes `.editorconfig`, `AGENTS.md` and `CLAUDE.md` from their templates.
+3. `bash .tfcore/utils/tf-day1-files.sh {App} --prefix {obj|none}` writes `.editorconfig`, `AGENTS.md` and `CLAUDE.md` from their templates and adds the document paths to `core-config.yaml`.
 4. UsageGuide: `docs/{App}-UsageGuide.md` from `app-usageguide-tmpl.md`. The Test users table lists the intended accounts, one per role, none created. The Execution guide is at roadmap level, marking commands that depend on projects not yet built. One "How to test" section per screen in navigation order, naming the user, the steps, the expected result and the REQ ids.
 5. `bash .tfcore/utils/tf-gitignore-audit.sh . --fix`. Read its output. Any untracking commands it prints go into your summary for the owner to run; agents never run git.
 6. Run the status gate; the run record carries `"mode":"stage2"`. The next command is `*build-phase {App}`.