@techierathore/techieflow 1.1.1 → 1.2.1

package/.claude/commands/TechieFlow/tasks/_smoke-test-policy.md

@@ -12,23 +12,25 @@ A screen passes only if all three hold, at a desktop width and a mobile width:
 
 A failure on any of the three is a defect: write it into the row's Remarks (prefix `⚠ visual:` for 2 and 3) and do not report the row done. A smoke earns a row at most `Implemented`; only an executed verify run writes `Verified`.
 
-The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives an embedded-browser desktop head Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
+The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives a Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
 
 ## Run it yourself
 
-The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. A dependent service that is down is something you start, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
+The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. Start a dependent service that is down, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
 
 ## Test users
 
-Resolve credentials in this order and stop at the first that works:
+Take credentials from the first that works:
 
 1. The Test users table in `docs/<App>-UsageGuide.md`.
-2. An existing account in the database, read with the connection string from the configuration.
+2. An existing account in the database, read with the configured connection string.
 3. Ask the owner, showing what you would create.
-4. Only after a yes, create it and add it to the Test users table.
+4. Only after a yes, create it and add it to the table.
 
 Never invent a throwaway account.
 
+An AppManager app skips steps 2 to 4 (stack answer Q4a): register through its register call, passwords in git-ignored secrets, never the owner's account.
+
 ## Say what ran
 
 Name the exact command and where it ran: which host, which rung, focused tests or the full build, your own smoke or an executed verify. A green intermediate step is not a pass of the whole.

package/.tfcore/hooks/block-git.sh

@@ -21,7 +21,9 @@
 #     the only place that decides. Outside YOLO it returns permissionDecision=ask
 #     for them (same prompt the owner always had). In YOLO it stays silent and the
 #     bare "Bash" allow rule lets them run — an unattended goal run never stalls on
-#     a delete. Catastrophic `rm -rf /|~` stay in settings.json `deny` (every mode).
+#     a delete. A delete of the whole disk or home folder (rm -rf / , /* , ~ , ~/*)
+#     is refused here in every mode; settings.json deny keeps only the exact
+#     `rm -rf /` and `rm -rf ~` (a deny `*` matched every absolute path).
 #
 # YOLO is ON when any of: env TF_YOLO=1 · .tfcore/.session/yolo.json exists
 # (tf-yolo.sh on) · the hook payload's permission_mode is bypassPermissions/auto.
@@ -198,6 +200,20 @@ def classify_gh(args):
 found = {"read": 0, "write": 0}
 found_rm = [False]
 found_sudo = [False]
+found_wipe = [False]
+
+# A delete whose target is the whole disk or the home folder is refused in every mode. These
+# lived in settings.json deny as "rm -rf /*" and "rm -rf ~/*", but a deny rule's * matches any
+# text, so they also refused every delete of an absolute path (rm -rf /mnt/c/...), even in
+# bypass mode (Lekhak scratch folder, 2026-10-18).
+HOME_DIR = os.path.expanduser("~").rstrip("/")
+WIPE = {"/", "/*", "/.", "/..", "~", "~/", "~/*", "~/.", "$HOME", "$HOME/", "$HOME/*",
+        "${HOME}", "${HOME}/", "${HOME}/*"}
+def is_wipe(t):
+    t = t.strip()
+    if t in WIPE or re.fullmatch(r"/+\*?", t):
+        return True
+    return bool(HOME_DIR) and t.rstrip("/*") == HOME_DIR
 
 def scan(cmdline, depth=0):
     if depth > 4:
@@ -263,6 +279,8 @@ def scan(cmdline, depth=0):
             found[classify_gh(args)] += 1
         elif head in ("rm", "rmdir", "unlink", "shred"):
             found_rm[0] = True
+            if any(is_wipe(a) for a in args if not a.startswith("-") or a == "-"):
+                found_wipe[0] = True
         elif head in ("find",) and ("-delete" in args or "-exec" in args and any(basename(x) == "rm" for x in args)):
             found_rm[0] = True
 
@@ -276,7 +294,9 @@ except Exception:
         print("ALLOW")
     sys.exit(0)
 
-if found["write"]:
+if found_wipe[0]:
+    print("BLOCK_WIPE")
+elif found["write"]:
     print("BLOCK_WRITE")
 elif found["read"] and (strict_git or not yolo):
     print("BLOCK_READ")
@@ -290,6 +310,9 @@ VERDICT="$(TF_HOOK_INPUT="$INPUT" TF_YOLO_ON="$YOLO" python3 -c "$GIT_GUARD_PY"
 case "$VERDICT" in
   BLOCK_WRITE) block_git_msg; exit 2 ;;
   BLOCK_READ)  block_read_msg; exit 2 ;;
+  BLOCK_WIPE)
+    echo "BLOCKED by TechieFlow policy: this deletes the whole disk or the home folder. Never run it, in any mode. Delete the folder you mean by its own path." >&2
+    exit 2 ;;
   ASK_RM)
     # Claude Code: surface the owner's usual delete/sudo prompt (hook "ask"
     # beats the bare "Bash" allow). OpenCode: its own `rm *: ask` map prompts.

package/.tfcore/hooks/guard-db.sh

@@ -43,8 +43,8 @@ if not isinstance(cmd, str) or not cmd.strip():
 WRITE_VERBS = r"\b(insert|update|delete|create|alter|drop|truncate|grant|revoke|replace|merge|upsert)\b"
 CLIENTS = r"\b(psql|pgcli|sqlite3|mysql|mariadb|sqlcmd|mongosh|mongo)\b"
 MIGRATORS = (r"\bdotnet\s+ef\s+database\s+(update|drop)\b"
-             r"|\bdotnet\s+run\b[^|;&]*--project\s+\S*(db|migration|migrations)\b"
-             r"|\bdbup\b|\bflyway\s+(migrate|clean|undo)\b|\bliquibase\s+(update|rollback|drop-all)\b"
+             r"|\bdotnet\s+run\b[^|;&]*--project\s+\S*(db|dbup|migration|migrations)\b"
+             r"|\bflyway\s+(migrate|clean|undo)\b|\bliquibase\s+(update|rollback|drop-all)\b"
              r"|\balembic\s+(upgrade|downgrade)\b|\bprisma\s+(migrate|db\s+push)\b|\bknex\s+migrate\b"
              r"|\brails\s+db:(migrate|reset|drop|schema:load)\b|\bsequelize\s+db:migrate\b|\bgoose\s+(up|down|reset)\b")
 DROP_DB = r"\b(dropdb|drop\s+database|mongo(sh)?\b[^|;&]*dropDatabase)\b"
@@ -75,6 +75,10 @@ def phase():
 SEG = (r"(?:^|[;&|(`\n]|\$\()\s*(?:sudo\s+(?:-\S+\s+)*)?(?:env\s+(?:\S+=\S*\s+)*)?"
        r"(?:[\w./\\-]*\bexec\s+(?:-\S+\s+)*\S+\s+)?")
 CLIENT_AT = SEG + r"(?:\S*/)?" + CLIENTS
+# DbUp is a library: it runs as the command word of a segment (`dbup upgrade`, `./App.DbUp.exe`,
+# `dotnet App.DbUp.dll`) or through `dotnet run --project …DbUp`. A bare word "dbup" anywhere blocked a
+# miss sentence naming DbUp and every grep for it (Chatur TF-014).
+MIGRATORS += r"|" + SEG + r"(?:dotnet\s+)?(?:\S*[/\\.])?dbup(?:-cli)?\b"
 INTERP = r"(?:python3?|py|node|deno|bun|ruby|perl|pwsh|powershell(?:\.exe)?|tsx|ts-node)"
 INTERP_AT = SEG + r"(?:\S*/)?" + INTERP + r"\b"
 DB_LIBS = (r"\bsqlite3\b|better-sqlite3|\bsql\.js\b|node:sqlite|\bpsycopg|\bpymysql\b|mysql\.connector|\bmysql2\b"
@@ -171,7 +175,14 @@ if direct_write or re.search(DROP_DB, low):
           "is fine. Owner rule 2026-09-05.", file=sys.stderr)
     sys.exit(2)
 
-if re.search(MIGRATORS, low):
+# a quoted argument is a mention (a miss sentence, a search pattern), unless it is the code a shell runs
+# (`bash -c "…"`) or the project `dotnet run --project` builds (Chatur TF-014)
+def _mention(m):
+    keep = re.search(r"(?:\s-c|\s/c|\s-command|--project|-p)\s*=?\s*$", low[:m.start()])
+    return m.group(0) if keep else '""'
+
+
+if re.search(MIGRATORS, re.sub(r"\"(?:[^\"\\]|\\.)*\"|'[^']*'", _mention, low)):
     ph = phase()
     # triage-and-fix step 3 is fix-issues steps 2 to 5 under its own marker (AppManager TF-027)
     if ph in ("build-phase", "fix-issues", "triage-and-fix"):

package/.tfcore/hooks/guard-status-html.sh

@@ -149,7 +149,11 @@ if written_this_session:
             app = os.path.basename(cl)[: -len("-Checklist.md")]
             brd = os.path.join(root, "docs", f"{app}-BRD.md")
             if os.path.isfile(brd) and os.path.getmtime(cl) > os.path.getmtime(brd):
-                problems.append(f"docs/{app}-BRD.md is older than docs/{app}-Checklist.md. Run: bash .tfcore/utils/tf-brd-status.sh {app}")
+                # the stem of a phase file is "<App>-P<n>": the command takes the app and --phase n
+                # (Lekhak TF-034, TechieRag TF-007)
+                m = re.match(r"^(.+)-P(\d+)$", app)
+                cmd = f"{m.group(1)} --phase {m.group(2)}" if m else app
+                problems.append(f"docs/{app}-BRD.md is older than docs/{app}-Checklist.md. Run: bash .tfcore/utils/tf-brd-status.sh {cmd}")
     except Exception:
         pass
 

package/.tfcore/tasks/_smoke-test-policy.md

@@ -12,23 +12,25 @@ A screen passes only if all three hold, at a desktop width and a mobile width:
 
 A failure on any of the three is a defect: write it into the row's Remarks (prefix `⚠ visual:` for 2 and 3) and do not report the row done. A smoke earns a row at most `Implemented`; only an executed verify run writes `Verified`.
 
-The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives an embedded-browser desktop head Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
+The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives a Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
 
 ## Run it yourself
 
-The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. A dependent service that is down is something you start, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
+The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. Start a dependent service that is down, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
 
 ## Test users
 
-Resolve credentials in this order and stop at the first that works:
+Take credentials from the first that works:
 
 1. The Test users table in `docs/<App>-UsageGuide.md`.
-2. An existing account in the database, read with the connection string from the configuration.
+2. An existing account in the database, read with the configured connection string.
 3. Ask the owner, showing what you would create.
-4. Only after a yes, create it and add it to the Test users table.
+4. Only after a yes, create it and add it to the table.
 
 Never invent a throwaway account.
 
+An AppManager app skips steps 2 to 4 (stack answer Q4a): register through its register call, passwords in git-ignored secrets, never the owner's account.
+
 ## Say what ran
 
 Name the exact command and where it ran: which host, which rung, focused tests or the full build, your own smoke or an executed verify. A green intermediate step is not a pass of the whole.

package/.tfcore/templates/stack-defaults/dotnet.md

@@ -17,6 +17,7 @@
 | Q2 | Secrets in development | Project user secrets (`dotnet user-secrets`), visible to the developer, never committed. `appsettings.Development.json` is committed and therefore never holds a real secret. A `secrets.example.json` in the project lists every key the application reads. | No |
 | Q3 | Database | PostgreSQL, running in Docker, for development and production. Docker is always running on the development machine because WSL, where the harness runs, depends on it. If PostgreSQL is unreachable the container is stopped: the agent starts it and continues. Only if no PostgreSQL container exists at all does the agent stop and ask the owner for connection details. It never substitutes another engine and never creates its own database container. | No, unless no container exists |
 | Q4 | Authentication | Two choices only: **AppManager**, the author's shared platform for identity, roles, licences and subscriptions, which counts as part of the application and not as an external integration; or a different mechanism named by the owner. | **Yes**: "AppManager, or something else?" |
+| Q4a | Test users of an AppManager app | An app that signs in through AppManager registers its own test users on AppManager, through AppManager's register call (`POST /AuthSvc/register`, or `device-register` for a device-bound app), under the app's own application id: one for the owner's walkthrough (`{app}-owner@…`), a second user (`{app}-second@…`), and one for unattended runs (`{app}-yolo-tester@…`). A script in the project does it (for example `tests/verify/register-test-users.mjs`): it generates each password and writes it only to the project's git-ignored secrets (user secrets, or a git-ignored `.env.local`). The UsageGuide's Test users table lists the three, names where each password is kept, and never holds a password. An agent never asks for, stores or uses the owner's personal AppManager account. `tf-doc-check.sh` holds the UsageGuide to this. | No |
 | Q5 | Logging | Serilog, always, with file logging wired at startup before anything else can fail. | No |
 | Q6 | Tests | xUnit, always. A test project exists from day-1. | No |
 | Q7 | Layout and naming | `src/` and `tests/` at the root. The primary executable project is named exactly `<App>`; `<App>.App` is banned. Secondary heads take a descriptive suffix (`<App>.Api`, `<App>.Desktop`). | No |
@@ -32,6 +33,7 @@ Required packages: `TrBlazeUI.Components` — for a project with a Blazor or MAU
 ## Notes
 
 - Q4 is asked on purpose even with this answer set, because the choice differs per product.
+- Q4a follows from an AppManager answer to Q4 and is never asked (owner, 2026-10-18).
 - Q3's "start the container, never create one" replaces the behaviour that produced TfLens's own database container: an agent that cannot reach the expected database restarts it or asks, and never builds an alternative.
 - Q11.5 replaces the `database` folder of loose migration scripts that TfLens accumulated.
 - Q11.3 is a standing framework convention restated as a stack rule so that it is recorded per project and its violations can be counted.

package/.tfcore/templates/v4custom/app-usageguide-tmpl.md

@@ -13,13 +13,16 @@ entries: How to test, screen by screen |
 per-entry: 90 120
 budget: S 2500 3500 | M 4000 6000 | L 4000 6000
 rule: test-users-table
+rule: appmanager-test-users
 rule: execution-code
 rule: entry-steps
 rule: entry-expected
 -->
 <!-- Authoring notes (agent only; never visible text).
      The owner's test plan. Every agent (smoke, verify) and the owner's UAT use the SAME test users and
-     the SAME walkthrough; nobody invents accounts. One `###` per screen in navigation order, at most
+     the SAME walkthrough; nobody invents accounts. An app that signs in through AppManager lists its own three users
+     (owner walkthrough, second user, unattended runs), registered through AppManager's register call, each password named by
+     where the git-ignored secrets keep it, never written here; never the owner's personal AppManager account. One `###` per screen in navigation order, at most
      120 words: who to sign in as, numbered steps, the expected result, the REQ ids covered.
      The Execution guide is copy-pasteable commands, one per line, no narrative. Hosting and production
      deployment are not here; they are in the Deployment Checklist after UAT.

package/.tfcore/utils/tf-brd-status.py

@@ -5,7 +5,8 @@
 
 On a Large project the pair is the phase being worked: --phase N, else appPhase in
 .tfcore/core-config.yaml (phase 1 is docs/<App>-BRD.md and -Checklist.md, phase n is
-docs/<App>-Pn-BRD.md and docs/<App>-Pn-Checklist.md).
+docs/<App>-Pn-BRD.md and docs/<App>-Pn-Checklist.md). A name that carries the phase, as the file
+stem does (<App>-P3), is read as <App> --phase 3.
 
 Reads docs/<App>-Checklist.md: every REQ row of the Requirements Status table, and
 the "## Page: …" section its detail entry sits under, which names the screen.
@@ -127,10 +128,18 @@ def main(argv):
     render = "--no-render" not in argv
     root = os.getcwd()
     phase = None
+    # A name that already carries the phase, as the file stem reads ("Lekhak-P3"), is the app and that
+    # phase: adding appPhase again looked for docs/Lekhak-P3-P3-Checklist.md (Lekhak TF-034,
+    # TechieRag TF-007).
+    m = re.match(r"^(.+)-P(\d+)$", app)
+    if m:
+        app, phase = m.group(1), int(m.group(2))
     if "--phase" in argv:
         i = argv.index("--phase")
         if i + 1 >= len(argv) or not argv[i + 1].isdigit() or int(argv[i + 1]) < 1:
             die("--phase needs a number from 1 upwards")
+        if phase is not None and phase != int(argv[i + 1]):
+            die(f"{argv[1]} names phase {phase} but --phase says {argv[i + 1]}")
         phase = int(argv[i + 1])
     if phase is None:
         cfg = os.path.join(root, ".tfcore", "core-config.yaml")

package/.tfcore/utils/tf-build.sh

@@ -201,6 +201,31 @@ cross_side() { # side: clear what another side built with its own paths in it, t
   done
   [[ $cleared -eq 1 ]] && echo "note  the scoped stylesheets and static asset lists were built on the other side of this machine; cleared so the $1 build writes them itself"
 }
+# Lekhak TF-036: on WSL a target with no MAUI head starts on the WSL rungs. A test project inside a solution
+# that has a MAUI head is built Windows-side with that solution, and ~/.dotnet/dotnet then could not write
+# the obj/ Windows owns (MSB3491): tf-doc-tests.sh said NOT-RUN where `tf-build.sh test` on the solution
+# had just passed. Such a target starts on the side its solution builds on, the Windows side. Outside such
+# a solution, a target whose obj/ (or a referenced project's) was last built Windows-side starts there.
+# The record alone is not enough: a failed WSL attempt writes it before it fails.
+if [[ "$PLATFORM" == "wsl" && $maui -eq 0 && "$TARGET" == *.csproj ]]; then
+  won=""; tname="$(basename "$TARGET")"
+  for sln in *.slnx *.sln; do
+    [[ -f "$sln" ]] && grep -q "$tname" "$sln" || continue
+    while IFS= read -r p; do
+      [[ -f "$p" ]] && grep -qiE '<UseMaui>[[:space:]]*true|Microsoft\.NET\.Sdk\.Maui|net[0-9.]+-(android|ios|maccatalyst|windows10)' "$p" \
+        && { won="$sln has a MAUI head, so it builds on the Windows side"; break 2; }
+    done < <(grep -oE '"[^"]+\.csproj"|Path="[^"]+\.csproj"' "$sln" | sed 's/^Path=//' | tr -d '"' | tr '\\' '/')
+  done
+  if [[ -z "$won" ]]; then
+    for d in ${pdirs[@]+"${pdirs[@]}"}; do
+      [[ "$(cat "$d/obj/.tf-build-side" 2>/dev/null)" == windows ]] && { won="$d/obj was last built on the Windows side"; break; }
+    done
+  fi
+  if [[ -n "$won" ]]; then
+    rungs=("cmd.exe" "winrun" "powershell.exe" "dotnet" "$HOME/.dotnet/dotnet")
+    echo "note  $won; this $MODE starts there too (rungs: cmd.exe, winrun, powershell.exe, then the WSL ones)"
+  fi
+fi
 WRONG_RUNG='NETSDK1178|Microsoft\.(iOS|Android|MacCatalyst|tvOS)\.Sdk|Workload ID|not recognized|WindowsAppSDK|command not found|No such file or directory|is not recognized as an internal or external command|The term .* is not recognized|workload.*not installed|Inadequate permissions'
 
 # A Mac Catalyst build after Platforms/MacCatalyst/Info.plist (or an .entitlements file) changed: the

package/.tfcore/utils/tf-checklist-edit.py

@@ -86,6 +86,13 @@ def siblings(path):
     return [os.path.join(d, n) for n in sorted(names) if n != f and re.match(rf"^{app}(?:-P\d+)?-Checklist\.md$", n)]
 
 
+def streams(path):
+    """the telemetry streams beside the checklists: an id a miss or gate record carries is taken even
+    after its row was renamed, since a record cannot be amended (TechieRag TF-005)"""
+    d = os.path.join(os.path.dirname(path) or ".", "metrics")
+    return [os.path.join(d, n) for n in ("gates.jsonl", "misses.jsonl", "runs.jsonl") if os.path.isfile(os.path.join(d, n))]
+
+
 def next_id(text, prefix, others=()):
     """one past the highest id of that prefix in this checklist AND every other checklist of the app:
     counting this one alone gave REQ-UI-055 twice, once in phase 1 and once in phase 3 (Chatur TF-011)"""
@@ -99,7 +106,7 @@ def add_row(path, prefix, title, acceptance, section=None, remark=None, status="
     """append a row to the Requirements Status table and a detail entry under `section`
     (a new section at the end when it does not exist); returns the new id"""
     text = read(path)
-    rid = next_id(text, prefix, siblings(path))
+    rid = next_id(text, prefix, siblings(path) + streams(path))
     nl = "\r\n" if "\r\n" in text else "\n"
     lines = text.split(nl)
     # the table: after the last REQ row

package/.tfcore/utils/tf-doc-check.py

@@ -30,6 +30,7 @@ Schema grammar (one `key: value` per line inside the comment):
 from __future__ import annotations
 
 import argparse
+import glob
 import json
 import os
 import re
@@ -412,6 +413,17 @@ def resolve_kind(header, brd_header, cfg) -> str:
     return "library" if raw.startswith("lib") else "app"
 
 
+def signs_in_through_appmanager(root, app):
+    """the Architecture's authentication row (Q4, Auth…, Identity) names AppManager"""
+    for f in glob.glob(os.path.join(root or ".", "docs", f"{app}-Architecture.md")):
+        for _h, rows in tables_in(open(f, encoding="utf-8", errors="replace").read()):
+            for r in rows:
+                head = " ".join(r[:2]).lower()
+                if re.search(r"\bq4\b|auth|identity|sign-in", head) and re.search(r"(?i)app ?manager", " ".join(r[1:3])):
+                    return True
+    return False
+
+
 def section_text(present, name):
     key = norm_heading(name)
     return next((txt for k, _h, txt in present if key_matches(key, k)), None)
@@ -799,6 +811,35 @@ def check_doc_rule(rule, c, rep):
         if txt is not None and not has_table_with(txt, "user", "role"):
             rep.fail(rel, 'the "Test users" section needs a table with User and Role columns')
 
+    elif rule == "appmanager-test-users":
+        # An app that signs in through AppManager has its own three test users there, registered through
+        # AppManager's register call, each password kept in the git-ignored secrets and never written in
+        # the guide; never the owner's personal account (stack answer Q4a, owner 2026-10-18).
+        txt = section_text(present, "Test users")
+        app = c.get("app")
+        if txt is None or c["kind"] != "app" or not app or app.lower() == "appmanager" or not signs_in_through_appmanager(c["root"], app):
+            return
+        users = []
+        for hdr, rows in tables_in(txt):
+            low = [h.lower() for h in hdr]
+            if not any("user" in h for h in low):
+                continue
+            pw = next((i for i, h in enumerate(low) if "password" in h), None)
+            users += [(r, r[pw] if pw is not None and pw < len(r) else "") for r in rows if "@" in " ".join(r)]
+        whole = lambda r: " ".join(r).lower()
+        want = (("owner", r"owner|account holder"), ("second user", r"second"), ("unattended-run user", r"unattended|yolo"))
+        missing = [n for n, pat in want if not any(re.search(pat, whole(r)) for r, _p in users)]
+        if missing:
+            rep.fail(rel, f'{app} signs in through AppManager: the Test users table lists no {", no ".join(missing)} '
+                          f'(stack answer Q4a: owner walkthrough, second user, unattended runs, registered through AppManager\'s register call)')
+        for r, cell in users:
+            if not re.search(r"(?i)secret|\.env|credential|keychain", cell):
+                who = re.search(r"[\w.+-]+@[\w-]+(?:\.[\w-]+)*", " ".join(r)).group(0)
+                rep.fail(rel, f'test user {who}: the Password cell names no git-ignored secret; keep the password in the project\'s '
+                              f'secrets and name the key here, never the password (stack answer Q4a)')
+        if users and not re.search(r"(?i)regist", txt):
+            rep.fail(rel, "the Test users section does not say the users were registered through AppManager's register call (stack answer Q4a)")
+
     elif rule == "next-command-blocks":
         seg = re.search(r"(?ms)^## Next command to run\s*\n(.*?)(?=^## |\Z)", nocomment)
         if not seg:

package/.tfcore/utils/tf-mockup-parity.mjs

@@ -246,7 +246,9 @@ const PROBE = (wanted = []) => {
     if (!c) return null;
     const { r, g, b } = c;
     const mx = Math.max(r, g, b), mn = Math.min(r, g, b);
-    if (mx - mn < 28) return 'neutral';
+    // a grey with a tint is still a grey: Sevak's dark nav text #a6adc5 (spread 31, saturation 21%) read as
+    // accent beside the app's near-white, once TF-007 had the mockup read settled and not mid-fade
+    if (mx - mn < 28 || (mx - mn) / (255 - Math.abs(mx + mn - 255)) < 0.25) return 'neutral';
     // By hue, never by one channel. "Red is highest, so green above 120 is a warning" put a deep
     // amber (180, 83, 9) in `negative` beside a light amber in `warning` — one warning tone on two
     // sides of the line, reported as a colour difference on TfLens /misses (TF-045).
@@ -275,7 +277,12 @@ const PROBE = (wanted = []) => {
   // reads every other border property but not this one keeps missing that whole
   // vocabulary. Quantised to the three values that carry meaning rather than the
   // full CSS keyword set, so the clause stays as noise-free as the colour buckets.
+  // A checkbox, switch or radio is not compared by its border (Lekhak TF-035): a native
+  // <input type="checkbox"> computes border-style none because the browser draws its box, while a
+  // library's role="checkbox" draws the same box as a CSS border. Same control, so not applicable.
+  const TOGGLE = 'input[type="checkbox"],input[type="radio"],[role="checkbox"],[role="switch"],[role="radio"]';
   const strokeOf = (el) => {
+    if (el.matches(TOGGLE)) return null;
     const cs = getComputedStyle(el);
     const q = (s) => (s === 'none' || s === 'hidden' ? 'none'
       : s === 'dashed' || s === 'dotted' ? 'dashed' : 'solid');
@@ -465,7 +472,7 @@ const PROBE = (wanted = []) => {
       // the badge and the visible border one element away, for the clauses to accept (TF-047)
       near: {
         badge: near.some((n) => chromeOn(n)?.badge === true),
-        stroke: near.map(strokeOf).find((s) => s.visible) || null,
+        stroke: near.map(strokeOf).find((s) => s && s.visible) || null,
       },
       tag: el.tagName.toLowerCase(),
       text: ownText(el).trim().replace(/\s+/g, ' ').slice(0, 60),
@@ -657,7 +664,13 @@ const CLAUSES = {
     : m.token.fits && !a.token.fits
       ? `value cell is narrower than its longest unbreakable token ("${a.token.token}") — it breaks mid-token`
       : false),
+  // Sevak TF-010: a sample box the app draws is graded on being there with a size, nothing it says
+  size: (m, a) => (!m.in_sample ? null
+    : m.w > 0 && m.h > 0 && (!(a.w > 0) || !(a.h > 0)) ? `the mockup draws this sample box ${m.w}×${m.h}; the app draws it ${a.w ?? 0}×${a.h ?? 0}` : false),
 };
+// Sevak TF-010: inside a box the mockup marks data-tf-sample, what the sample says is the app's real data
+// ("Yes, it can run" against this PC's truthful "No"), so its colour, its text and its badge are not graded
+const SAMPLE_SKIP = new Set(['color', 'badge', 'wrap', 'token']);
 
 // Which clauses require having reached INSIDE a container rather than merely
 // touching its outer box. TF-011's `harness` screen graded three column CONTAINERS
@@ -795,8 +808,10 @@ function diff(mock, app, screen, width, skip = null) {
     return false;
   };
 
+  const sampleKeys = Object.keys(mock.index).filter((k) => mock.index[k].sample);
   for (const key of Object.keys(mock.index)) {
-    const m = mock.index[key];
+    const inSample = sampleKeys.some((k) => key === k || key.startsWith(k + ' > '));
+    const m = inSample ? { ...mock.index[key], in_sample: true } : mock.index[key];
     let a = app.index[key];
     let appKey = key;
 
@@ -824,6 +839,7 @@ function diff(mock, app, screen, width, skip = null) {
     // wrapper div and become the always-present finding TF-012 warns about — the
     // fastest way to train a reader to skim the whole report.
     if (!a) {
+      if (inSample && m.badge === true) continue;   // a sample badge reading otherwise in the app is its data (TF-010)
       const parentKey = key.includes(' > ') ? key.slice(0, key.lastIndexOf(' > ')) : null;
       const parentPaired = parentKey ? !!app.index[parentKey] : false;
       // an icon is missing only when the paired parent carries fewer icons than the mockup's
@@ -865,6 +881,7 @@ function diff(mock, app, screen, width, skip = null) {
     compared++;
     for (const [name, fn] of Object.entries(CLAUSES)) {
       if (skip && skip.has(name)) continue;     // a clause the mockup says nothing about in this theme (TF-024)
+      if (inSample && SAMPLE_SKIP.has(name)) continue;
       const r = fn(m, a);
       if (r === null) continue;
       clauseCoverage[name]++;

package/.tfcore/utils/tf-owner-text.py

@@ -59,13 +59,31 @@ def load_words(root):
 
 
 def upstream_state(root):
-    """Every entry id in the project's feedback files -> (state, where), from the one reader
-    every script uses (tf_feedback.py), so this check and PROJECT-STATUS can never disagree."""
+    """Every entry id in the project's feedback files -> [(state, where, names)], one per file, from
+    the one reader every script uses (tf_feedback.py), so this check and PROJECT-STATUS can never disagree."""
     sys.path.insert(0, HERE)
     import tf_feedback
     return tf_feedback.state_map(root)
 
 
+def resolve(rid, cands, unit, text):
+    """The feedback file an id in this unit means (TrBlazeUI TF-006). One file holding it: that one.
+    Several: the files whose project the unit names ("Lekhak TR-002"), else the files the whole text
+    names. -> (state, where), or (None, the files) when it stays several that disagree."""
+    if len(cands) == 1:
+        return cands[0][:2]
+    for txt in (unit, text):
+        # a name every candidate file shares (the library's own) says nothing about which one
+        shared = set.intersection(*(set(c[2]) for c in cands))
+        hit = [c for c in cands if any(n not in shared and re.search(rf"(?<![\w-]){re.escape(n)}(?![\w-])", txt) for n in c[2])]
+        if hit:
+            cands = hit
+            break
+    if len({c[0] for c in cands}) == 1:
+        return cands[0][:2]
+    return None, ", ".join(c[1].split(",")[0] for c in cands)
+
+
 def split_text(text):
     """-> (prose lines [(n, line)], the text inside code blocks)."""
     prose, fenced, fence = [], [], None
@@ -142,9 +160,13 @@ def check(text, label, root, final=False, words=None, ups=None):
     for n, txt, header in us:
         for rid in dict.fromkeys(ANY_ID.findall(txt)):
             if rid in ups:
-                mentions.setdefault(rid, []).append((n, txt, header))
-    for rid, ms in sorted(mentions.items(), key=lambda kv: kv[1][0][0]):
-        st, where = ups[rid]
+                st, where = resolve(rid, ups[rid], txt, text)
+                if st is None:
+                    fail(n, f'{rid} is an entry in several feedback files ({where}); name whose it is with the id, '
+                            f'as in "{ups[rid][0][2][0]} {rid}"')
+                    continue
+                mentions.setdefault((rid, st, where), []).append((n, txt, header))
+    for (rid, st, where), ms in sorted(mentions.items(), key=lambda kv: kv[1][0][0]):
         if st in ("fixed", "closed"):
             # read the sentence that names it, or its table row: "TF-901 is filed. X is fixed." is wrong
             said = lambda txt, h: [txt] if h is not None else [s for s in re.split(r"(?<=[.!?])\s+", txt) if rid in s]

package/.tfcore/utils/tf-theme.mjs

@@ -72,11 +72,23 @@ const RESTORE = (before) => {
   }
 };
 
+const SETTLE_ANIMATIONS = () => {
+  let n = 0;
+  for (const a of document.getAnimations()) {   // getAnimations() flushes style, so a fade the change just started is in it
+    try { if (Number.isFinite(a.effect?.getComputedTiming().endTime)) { a.finish(); n++; } } catch (e) { /* not finishable */ }
+  }
+  return n;
+};
+
 // Draws the page in `want` and returns the function that puts it back.
 export async function useTheme(page, want, settle = 350) {
   await page.emulateMedia({ colorScheme: want }).catch(() => {});
   const before = await page.evaluate(FORCE, want).catch(() => null);
   if (settle) await page.waitForTimeout(settle);
+  // Sevak TF-007: a theme change starts the page's CSS fades (`transition: all .12s`), and the mockup,
+  // read with no settle, gave its light colour in dark mode. Every fade and finite animation is run to
+  // its end, so what is read is the colour the page settles on; a spinner (infinite) is left running.
+  await page.evaluate(SETTLE_ANIMATIONS).catch(() => {});
   return async () => {
     if (before) await page.evaluate(RESTORE, before).catch(() => {});
     await page.emulateMedia({ colorScheme: null }).catch(() => {});

package/.tfcore/utils/tf-triage.py

@@ -13,8 +13,10 @@ row in whichever docs/<App>-Checklist.md or docs/<App>-P<N>-Checklist.md holds i
 
 demote  the row goes to Needs re-verify (% capped at 75) with a dated Remark holding the symptom in the
         reporter's words, the evidence path and the kind.
-new     a defect no row covers: the next free id in the prefix, a Not Started row, a detail entry with the
-        acceptance line and the marker BRD-pending (*amend-docs gives it its BRD item).
+new     a defect no row covers: the next free id in the prefix, across every checklist of the app and the
+        telemetry streams, a Not Started row, a detail entry with the acceptance line and the marker
+        BRD-pending (*amend-docs gives it its BRD item). Without --prefix: FN, or the one prefix a
+        checklist with no FN row uses; with several such prefixes it asks for --prefix.
 note    a dated remark on the nearest row, no status change (could not reproduce).
 close   what triage owes the telemetry, from the actions above (tests/.artifacts/verify/triage.json):
         one gate record per demoted or new row with gate "escaped" (no check caught it), one miss per row
@@ -31,6 +33,7 @@ import datetime
 import importlib.util
 import json
 import os
+import re
 import subprocess
 import sys
 
@@ -176,7 +179,19 @@ def main(argv):
             die("new needs \"<title>\" \"<acceptance>\"")
         title, acc = argv[3], argv[4]
         cl = checklist(app, argv, ce)
-        prefix = opt(argv, "--prefix", "FN").upper(); section = opt(argv, "--section"); ev = opt(argv, "--evidence")
+        prefix = opt(argv, "--prefix")
+        if prefix is None:
+            # FN unless this checklist has no FN row: then the one prefix it uses is the default, and
+            # several are asked for (TechieRag TF-005: phase 3 is all RAG, and FN was a slip)
+            used = sorted(set(re.findall(r"(?m)^\|\s*REQ-([A-Z]+)-\d{3,}", ce.read(cl))))
+            if not used or "FN" in used:
+                prefix = "FN"
+            elif len(used) == 1:
+                prefix = used[0]
+                print(f"note: every row of {cl} is REQ-{prefix}-…, so the new row is one too; pass --prefix to choose another")
+            else:
+                die(f"{cl} has no REQ-FN rows; name the prefix: --prefix {'|'.join(used)}")
+        prefix = prefix.upper(); section = opt(argv, "--section"); ev = opt(argv, "--evidence")
         src = opt(argv, "--source", "owner"); mockup = opt(argv, "--mockup")
         if prefix == "UI" and not mockup and cfg_project_type() not in ("library", "docs"):   # TrBlazeUI TF-003
             print("note: a UI row needs a mockup link; pass --mockup docs/mockups/<screen>.html or the checker will flag it")

package/.tfcore/utils/tf-verify-boot.sh

@@ -13,7 +13,8 @@
 #            side that built it, reading its settings from the project folder as `dotnet run` does.
 #            Builders side by side never serve each other's half-written build (TF-043). A standalone
 #            WebAssembly project is still started with `dotnet run`. Prints BOOTED mode=base url=….
-#   windows  a MAUI Blazor Hybrid head (UseMaui + a net*-windows target): started Windows-side with
+#   windows  a MAUI Blazor Hybrid head (UseMaui + a net*-windows target + a BlazorWebView; a plain MAUI
+#            app is refused at once, NONE kind=no-webview, TechieRag TF-006): started Windows-side with
 #            WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=--remote-debugging-port=9222, the DevTools port
 #            relayed to every interface by tf-cdp-relay.ps1, and reached from WSL over CDP. Prints
 #            BOOTED mode=cdp url=http://<host>:9223. Proven on MyDiary, 2026-09-06.
@@ -85,6 +86,13 @@ find_projects() { # prints csproj paths under src/, source/, the root and one le
 }
 is_web()  { grep -qE 'Microsoft\.NET\.Sdk\.Web|Microsoft\.NET\.Sdk\.BlazorWebAssembly' "$1"; }
 is_maui_win() { grep -qiE '<UseMaui>[[:space:]]*true|Microsoft\.NET\.Sdk\.Maui' "$1" && grep -qE 'net[0-9.]+-windows' "$1"; }
+# A Windows head is driven over its web view's DevTools port, so only a Blazor Hybrid app has one. A
+# plain MAUI app (TechieRag's samples/TechieRag.Probe) was picked as the windows head and waited the
+# full 300 s for a port it can never open (TechieRag TF-006).
+is_hybrid() {
+  grep -qE 'Microsoft\.AspNetCore\.Components\.WebView\.Maui' "$1" && return 0
+  grep -rqlE 'AddMauiBlazorWebView|BlazorWebView' --include='*.cs' --include='*.xaml' --exclude-dir=bin --exclude-dir=obj "$(dirname "$1")" 2>/dev/null
+}
 is_maui_mac() { grep -qiE '<UseMaui>[[:space:]]*true|Microsoft\.NET\.Sdk\.Maui' "$1" && grep -qE 'net[0-9.]+-maccatalyst' "$1"; }
 
 poll_http() { # url seconds pid-to-watch(optional) -> 0 when it answers
@@ -285,7 +293,11 @@ fi
 # ---- pick the project and the head ------------------------------------------------------
 tf_read_lines ALL < <(find_projects)
 WEB=(); WIN=(); MAC=()
-for p in ${ALL[@]+"${ALL[@]}"}; do is_web "$p" && WEB+=("$p"); is_maui_win "$p" && WIN+=("$p"); is_maui_mac "$p" && MAC+=("$p"); done
+WIN_NATIVE=()
+for p in ${ALL[@]+"${ALL[@]}"}; do
+  is_web "$p" && WEB+=("$p"); is_maui_mac "$p" && MAC+=("$p")
+  if is_maui_win "$p"; then if is_hybrid "$p"; then WIN+=("$p"); else WIN_NATIVE+=("$p"); fi; fi
+done
 # a Mac Catalyst head is picked unasked only on a Mac, the one host that runs it
 [[ "$PLATFORM" == "macos" ]] || MAC=()
 # Several web projects: the one that serves screens. The first in sorted order booted AppManager's
@@ -325,9 +337,14 @@ if [[ -n "$PROJECT" ]]; then
 elif [[ -z "$HEAD" ]]; then
   if [[ ${#WEB[@]} -gt 0 ]]; then HEAD=web; pick_web
   elif [[ ${#MAC[@]} -gt 0 ]]; then HEAD=maccatalyst; PROJECT="${MAC[0]}"
-  elif [[ ${#WIN[@]} -gt 0 ]]; then HEAD=windows; PROJECT="${WIN[0]}"; fi
+  elif [[ ${#WIN[@]} -gt 0 ]]; then HEAD=windows; PROJECT="${WIN[0]}"
+  elif [[ ${#WIN_NATIVE[@]} -gt 0 ]]; then HEAD=windows; PROJECT="${WIN_NATIVE[0]}"; fi
 else
-  case "$HEAD" in web) pick_web ;; windows) PROJECT="${WIN[0]:-}" ;; maccatalyst) PROJECT="${MAC[0]:-}" ;; esac
+  case "$HEAD" in web) pick_web ;; windows) PROJECT="${WIN[0]:-${WIN_NATIVE[0]:-}}" ;; maccatalyst) PROJECT="${MAC[0]:-}" ;; esac
+fi
+if [[ "$HEAD" == windows && -n "$PROJECT" ]] && ! is_hybrid "$PROJECT"; then
+  [[ $DRYRUN -eq 1 ]] || write_state windows none "" "" "" "$PROJECT" "a MAUI app with no BlazorWebView: no web view, not drivable over CDP" no-webview "$PLATFORM"
+  echo "NONE head=windows kind=no-webview reason=$PROJECT is a MAUI app with no BlazorWebView (no AddMauiBlazorWebView, no <BlazorWebView>): it has no web view, so it is not drivable over CDP; its rows are graded by their tests"; exit 2
 fi
 if [[ $DRYRUN -eq 1 ]]; then echo "PICK head=${HEAD:-none} project=${PROJECT:-none}"; exit 0; fi
 case "$HEAD" in
@@ -714,6 +731,9 @@ MINE="$(comm -13 <(printf '%s\n' "$BEFORE_IDS") <(win_ids) | tr '\n' ' ')"
 if [[ -z "$URL" ]]; then
   pkill -P "$APP_PID" 2>/dev/null; kill "$APP_PID" "$RELAY_PID" 2>/dev/null
   for w in $MINE; do taskkill.exe /F /T /PID "$w" >/dev/null 2>&1; done
+  # the relay runs Windows-side and outlives its WSL parent: a second try then failed "Only one usage
+  # of each socket address" (TechieRag TF-006)
+  powershell.exe -NoProfile -Command "Get-NetTCPConnection -LocalPort $RELAY_PORT -State Listen -ErrorAction SilentlyContinue | ForEach-Object { Stop-Process -Id \$_.OwningProcess -Force -ErrorAction SilentlyContinue }" >/dev/null 2>&1
   write_state windows none "" "" "cmd.exe /c dotnet run -f $TFM" "$PROJECT" "the DevTools port $RELAY_PORT never answered within 300 s" host "$PLATFORM"
   echo "NONE head=windows kind=host reason=the app's DevTools port never answered on ${HOSTS[*]}:$RELAY_PORT within 300 s (log $LOG, relay $DIR/relay.log)"; exit 2
 fi

package/.tfcore/utils/tf-verify-screens.mjs

@@ -366,8 +366,14 @@ async function inspect(page, anchors, attr, errorSelectors) {
         return !/^(transparent|rgba\(0, 0, 0, 0\))$/.test(cs.backgroundColor) || cs.backgroundImage !== 'none'
           || ['Top', 'Right', 'Bottom', 'Left'].some((s) => parseFloat(cs[`border${s}Width`]) > 0 && cs[`border${s}Style`] !== 'none');
       };
+      // A checkbox, switch or radio drawn by a library (TrBlazeUI: <button role="checkbox"
+      // aria-checked="false">, no text, no child while unticked) paints its own box, the way a native
+      // <input type="checkbox"> does (Lekhak TF-035). Counted filled when it paints; an unpainted one
+      // with no size is still empty.
+      const toggle = '[role="checkbox"],[role="switch"],[role="radio"],[aria-checked]';
       const filled = text.length > 0 || ['input', 'select', 'textarea', 'img', 'svg', 'canvas', 'video', 'iframe', 'progress', 'meter'].includes(tag)
         || el.matches(bar) || el.querySelector(`img,svg,canvas,input,select,textarea,button,a,${bar}`) !== null
+        || (el.matches(toggle) && paints(el)) || [...el.querySelectorAll(toggle)].some(paints)
         || [...el.children].some(paints);
       const c = clipRect(el);
       out.anchors.push({ id, present: true, visible: vis(el), filled, tag, w: Math.round(r.width), h: Math.round(r.height), x: Math.round(r.left), y: Math.round(r.top),

package/.tfcore/utils/tf-verify-verdict.py

@@ -24,7 +24,8 @@ For each row, the seven checks in order, and the first that fails is the verdict
 Verdicts: PASS · FAIL (acceptance) · BUILD-FAIL · RENDER-FAIL · ASSET-FAIL · VISUAL-FAIL · MOCKUP-FAIL ·
 PERF-FAIL · NOT-TESTED (no test carried the id, or every test carrying it was skipped; the screen
 checks passed or did not run) ·
-NOT-OBSERVABLE (an NFR row with no budget and no unit test) · NOT-DRIVEN (its screen was never driven:
+NOT-OBSERVABLE (an NFR row with no budget and no unit test) · NOT-BUILT (a Not Started row whose only
+failing check is its route answering 404: it keeps Not Started and emits no miss, Chatur TF-013) · NOT-DRIVEN (its screen was never driven:
 the head could not be booted, or has no driver) · DEFECT-OPEN (every check passed, but the old Remarks
 carry a defect no verify can see, tf_defect.py: the row goes to Needs re-verify, and so to a fix, with
 the defect kept; AppManager TF-021). A row is Verified only on PASS. NOT-* rows keep their
@@ -174,8 +175,16 @@ def main(argv):
         # it. It is neither a pass nor a defect, so it grades exactly like a row with no test at
         # all — never Verified, no gate record (TF-022). `t` is kept for the note.
         skipped_only = bool(t) and t.get("result") == "NOT-TESTED"
+        # Sevak TF-009: a row whose unit tests passed while its on-app test was skipped (Sevak TF-004)
+        # was written "no unit test carrying its id"; the tests ran, they just do not count
+        unit_only = ""
+        if skipped_only and t.get("passed"):
+            why = re.sub(r"^on-app test skipped [(](.*)[)]; a unit test.*$", r"\1", t.get("reason") or "")
+            unit_only = f"{t['passed']} unit test(s) named {rid} passed but do not count while its on-app test was skipped" \
+                + (f": {why}" if why else "")
         if skipped_only:
-            notes.append(f"acceptance not measured ({len(t.get('skipped') or [])} test(s) skipped, none ran)")
+            if not unit_only:
+                notes.append(f"acceptance not measured ({len(t.get('skipped') or [])} test(s) skipped, none ran)")
             t = None
         # the OS zoom keys (coding-standards-dotnet.md §9b): a row whose acceptance carries "zoom-check: keys"
         # or "zoom-check: kept" is graded by tf-verify-zoom.sh --json-out zoom/<REQ>.json, which stands as its
@@ -201,6 +210,7 @@ def main(argv):
         if t:
             checks.append(("acceptance", True, t["result"] != "PASS", "FAIL", "assert-fail", quoted(t.get("reason")) or "test failed", t.get("screenshot") or ""))
         # 3 render
+        bad = []   # Chatur TF-015: an UNREACHABLE first screen left it unset for the Mac note below
         if scr:
             if scr.get("render") == "UNREACHABLE":
                 f = next((x for w in scr["widths"] for x in w.get("findings", [])), {})
@@ -280,12 +290,25 @@ def main(argv):
                     notes.append(f"perf not measured: {g['reason']}")
 
         ran = [c[0] for c in checks if c[1]]
-        first = next((c for c in checks if c[1] and c[2]), None)
+        failed = [c for c in checks if c[1] and c[2]]
+        first = failed[0] if failed else None
         verdict, cls, detail, evidence = (first[3], first[4], first[5], first[6]) if first else (None, None, "", "")
+        # Chatur TF-013: a Not Started row whose only failing check is its route answering 404 (the mockup
+        # comparison could not open it either, for the same reason) was never built; it is not a defect to
+        # re-verify, so it keeps Not Started and emits no miss
+        if verdict == "RENDER-FAIL" and all(re.search(r"HTTP 404\b", c[5] or "") for c in failed) \
+                and scr and scr.get("render") == "UNREACHABLE" \
+                and (r.get("status") or prior).strip("`* ").lower().startswith("not started") \
+                and all(re.search(r"answered HTTP 404\b", f.get("detail", "")) for w in scr["widths"] for f in w.get("findings", [])[:1]):
+            verdict, cls, evidence = "NOT-BUILT", None, ""
+            detail = f"{detail}: the screen is not built yet, nothing to re-verify"
 
         # the honest non-verdicts
         if verdict is None:
-            if r["class"] == "NFR" and not r.get("perf_budget") and not t:
+            if unit_only:
+                verdict = "NOT-TESTED"
+                detail = unit_only + (f"; screen {r['screen']} renders and looks right{nonames}" if driven else "")
+            elif r["class"] == "NFR" and not r.get("perf_budget") and not t:
                 verdict = "NOT-OBSERVABLE"
                 detail = "NFR row with no perf-budget and no unit test carrying its id"
             elif not t and r.get("screen") and not driven:
@@ -338,6 +361,7 @@ def main(argv):
         marks = {"FAIL": "⚠ acceptance", "BUILD-FAIL": "⚠ build", "RENDER-FAIL": "⚠ render", "ASSET-FAIL": "⚠ assets",
                  "VISUAL-FAIL": "⚠ visual", "MOCKUP-FAIL": "⚠ mockup-parity", "PERF-FAIL": "⚠ perf",
                  "NOT-TESTED": "not verified", "NOT-OBSERVABLE": "not observable", "NOT-DRIVEN": "not verified", "PASS": "PASS",
+                 "NOT-BUILT": "not built",
                  "DEFECT-OPEN": "checks pass, defect open"}
         remark = f"{today} verify: {marks[verdict]} — {detail}"
         if evidence:

package/.tfcore/utils/tf_feedback.py

@@ -195,12 +195,17 @@ def upstream_of(path, app=None):
 
 
 def state_map(root):
-    """Every entry id across the project's feedback files -> (state, "<file>, <date>")."""
+    """Every entry id across the project's feedback files -> [(state, "<file>, <date>", names)], one
+    item per file holding it. Every consumer numbers its own entries from 1, so a library with nine
+    consumer files can hold nine TR-002s (TrBlazeUI TF-006); `names` are the two project names in the
+    file's name (Lekhak and TrBlazeUI in Lekhak-TrBlazeUI-Feedback.md), which a line names to say whose."""
     out = {}
     for f in files(root):
         rel = os.path.relpath(f, root).replace(os.sep, "/")
+        names = tuple(os.path.basename(f)[: -len("-Feedback.md")].split("-"))
         for e in entries(f):
-            out[e["id"]] = (e["state"], f"{rel}" + (f", Resolution status {e['since']}" if e["since"] else ""))
+            out.setdefault(e["id"], []).append(
+                (e["state"], f"{rel}" + (f", Resolution status {e['since']}" if e["since"] else ""), names))
     return out
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techierathore/techieflow",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "TechieFlow: a spec-driven development framework for AI coding agents, for Claude Code and OpenCode. One command installs it into any project.",
   "license": "Apache-2.0",
   "repository": {

package/scripts/install.mjs

@@ -313,7 +313,7 @@ const canonicalSettings = String.raw`{
     ],
     "ask": [],
     "deny": [
-      "Bash(rm -rf /)", "Bash(rm -rf /*)", "Bash(rm -rf ~)", "Bash(rm -rf ~/*)",
+      "Bash(rm -rf /)", "Bash(rm -rf ~)",
       "Bash(git commit*)", "Bash(git push*)", "Bash(git add*)", "Bash(git rm*)",
       "Bash(git mv*)", "Bash(git reset*)", "Bash(git checkout*)", "Bash(git switch*)",
       "Bash(git restore*)", "Bash(git merge*)", "Bash(git rebase*)", "Bash(git cherry-pick*)",