devrites 5.14.3 → 6.0.0

package/engine/internal/overhaul/packet/packet_test.go

@@ -0,0 +1,263 @@
+package packet
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func jsonString(s string) string {
+	b, _ := json.Marshal(s)
+	return string(b)
+}
+
+func runArea(t *testing.T) string {
+	t.Helper()
+	return filepath.Join(t.TempDir(), "full-1")
+}
+
+func writeArgs(run string, extra ...string) []string {
+	base := []string{"write", run, "TASK-1", "a1", "implementer",
+		"--phase", "REMEDIATING", "--lane", "backend", "--snapshot", "abc",
+		"--authorized-by", "APPROVAL-1", "--brief", "packets/BRIEF.md"}
+	return append(base, extra...)
+}
+
+func mustMkdir(t *testing.T, dir string) {
+	t.Helper()
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestWriteThenLoadRoundTrip(t *testing.T) {
+	run := runArea(t)
+	mustMkdir(t, run)
+	var out, errb bytes.Buffer
+	if code := Run(writeArgs(run, "--write-path", "a.go", "--write-path", "b.go"), &out, &errb); code != 0 {
+		t.Fatalf("exit %d: %s", code, errb.String())
+	}
+	path := filepath.Join(run, "packets", "full-1__TASK-1__a1__implementer.json")
+	if got := strings.TrimSpace(out.String()); got != path {
+		t.Fatalf("printed %q, want %q", got, path)
+	}
+	p, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p["receipt_path"] != filepath.Join(run, "receipts", "full-1__TASK-1__a1__implementer.json") {
+		t.Errorf("receipt_path = %v", p["receipt_path"])
+	}
+	if wp, _ := p["write_paths"].([]any); len(wp) != 2 || wp[0] != "a.go" || wp[1] != "b.go" {
+		t.Errorf("write_paths = %v", p["write_paths"])
+	}
+	if p["run_id"] != "full-1" || p["lane"] != "backend" || p["authorized_by"] != "APPROVAL-1" {
+		t.Errorf("fields not carried: %v", p)
+	}
+}
+
+func TestWriteRefusesToOverwrite(t *testing.T) {
+	run := runArea(t)
+	mustMkdir(t, run)
+	if code := Run(writeArgs(run), &bytes.Buffer{}, &bytes.Buffer{}); code != 0 {
+		t.Fatalf("first write exit %d", code)
+	}
+	path := filepath.Join(run, "packets", "full-1__TASK-1__a1__implementer.json")
+	before, _ := os.ReadFile(path)
+	var errb bytes.Buffer
+	if code := Run(writeArgs(run, "--lane", "frontend"), &bytes.Buffer{}, &errb); code != 1 {
+		t.Fatalf("second write exit %d, want 1", code)
+	}
+	if !strings.Contains(errb.String(), "already exists") {
+		t.Errorf("stderr = %q", errb.String())
+	}
+	if after, _ := os.ReadFile(path); !bytes.Equal(before, after) {
+		t.Error("existing packet was modified")
+	}
+	if ents, _ := os.ReadDir(filepath.Dir(path)); len(ents) != 1 {
+		t.Errorf("packets dir has %d entries, want 1", len(ents))
+	}
+}
+
+func TestWriteRejectsBadIDs(t *testing.T) {
+	for _, bad := range []string{"../x", "a/b", `a\b`, "..", "a__b"} {
+		run := runArea(t)
+		mustMkdir(t, run)
+		args := writeArgs(run)
+		args[2] = bad
+		var errb bytes.Buffer
+		if code := Run(args, &bytes.Buffer{}, &errb); code != 1 {
+			t.Errorf("task %q: exit %d, want 1", bad, code)
+		}
+		if _, err := os.Stat(filepath.Join(run, "packets")); err == nil {
+			t.Errorf("task %q: packets dir created", bad)
+		}
+	}
+}
+
+func TestWriteRejectsMissingFieldAndMissingRun(t *testing.T) {
+	run := runArea(t)
+	mustMkdir(t, run)
+	args := []string{"write", run, "TASK-1", "a1", "implementer", "--phase", "P"}
+	var errb bytes.Buffer
+	if code := Run(args, &bytes.Buffer{}, &errb); code != 1 || !strings.Contains(errb.String(), "missing or empty lane") {
+		t.Errorf("exit/stderr = %q", errb.String())
+	}
+	if code := Run(writeArgs(filepath.Join(t.TempDir(), "nope")), &bytes.Buffer{}, &bytes.Buffer{}); code != 2 {
+		t.Errorf("missing run area exit %d, want 2", code)
+	}
+}
+
+func TestFromFileSuppliesPlanAndFlagsOverride(t *testing.T) {
+	run := runArea(t)
+	mustMkdir(t, run)
+	from := filepath.Join(t.TempDir(), "extra.json")
+	if err := os.WriteFile(from, []byte(`{"lane":"other","plan":{"file":"revisions/plan-r1.json","rev":1},"write_paths":["x.go"]}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if code := Run(writeArgs(run, "--from", from), &bytes.Buffer{}, &bytes.Buffer{}); code != 0 {
+		t.Fatalf("exit %d", code)
+	}
+	p, err := Load(filepath.Join(run, "packets", "full-1__TASK-1__a1__implementer.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p["lane"] != "backend" {
+		t.Errorf("lane = %v, flag should override file", p["lane"])
+	}
+	if wp, _ := p["write_paths"].([]any); len(wp) != 1 || wp[0] != "x.go" {
+		t.Errorf("write_paths = %v, want file value kept", p["write_paths"])
+	}
+	if p["plan"] == nil {
+		t.Error("plan from file lost")
+	}
+}
+
+func TestLoadRejectsMismatchedNameAndBadPlan(t *testing.T) {
+	run := runArea(t)
+	mustMkdir(t, run)
+	Run(writeArgs(run), &bytes.Buffer{}, &bytes.Buffer{})
+	src := filepath.Join(run, "packets", "full-1__TASK-1__a1__implementer.json")
+	b, _ := os.ReadFile(src)
+	moved := filepath.Join(run, "packets", "full-1__TASK-2__a1__implementer.json")
+	if err := os.WriteFile(moved, b, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Load(moved); err == nil || !strings.Contains(err.Error(), "file name does not match") {
+		t.Errorf("Load of renamed packet: %v", err)
+	}
+	p := map[string]any{"plan": map[string]any{}}
+	if why := Validate("", p); !strings.Contains(strings.Join(why, ";"), "plan must be an object with a file") {
+		t.Errorf("Validate plan: %v", why)
+	}
+}
+
+func TestUsage(t *testing.T) {
+	var errb bytes.Buffer
+	if code := Run([]string{"write", "run"}, &bytes.Buffer{}, &errb); code != 2 || !strings.Contains(errb.String(), "usage:") {
+		t.Errorf("exit/stderr = %q", errb.String())
+	}
+}
+
+func TestWriteRejectsReceiptPathOutsideRunArea(t *testing.T) {
+	for i, bad := range []string{"/etc/evil.json", "../../outside/evil.json", "receipts/other.json", ""} {
+		run := runArea(t)
+		mustMkdir(t, run)
+		from := filepath.Join(t.TempDir(), "extra.json")
+		body := `{"receipt_path":"` + bad + `"}`
+		if err := os.WriteFile(from, []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		var errb bytes.Buffer
+		code := Run(writeArgs(run, "--from", from), &bytes.Buffer{}, &errb)
+		if bad == "" {
+			// An empty receipt_path falls back to the derived default.
+			if code != 0 {
+				t.Errorf("case %d: exit %d, want 0", i, code)
+			}
+			continue
+		}
+		if code != 1 || !strings.Contains(errb.String(), "receipt_path") {
+			t.Errorf("receipt_path %q: exit %d stderr %q, want 1 naming receipt_path", bad, code, errb.String())
+		}
+		if _, err := os.Stat(filepath.Join(run, "packets")); err == nil {
+			t.Errorf("receipt_path %q: packet written", bad)
+		}
+	}
+}
+
+func TestLoadRejectsReceiptPathOutsideRunArea(t *testing.T) {
+	run := runArea(t)
+	mustMkdir(t, run)
+	if code := Run(writeArgs(run), &bytes.Buffer{}, &bytes.Buffer{}); code != 0 {
+		t.Fatalf("exit %d", code)
+	}
+	path := filepath.Join(run, "packets", "full-1__TASK-1__a1__implementer.json")
+	if _, err := Load(path); err != nil {
+		t.Fatalf("derived receipt_path rejected: %v", err)
+	}
+	b, _ := os.ReadFile(path)
+	good := filepath.Join(run, "receipts", "full-1__TASK-1__a1__implementer.json")
+	for _, bad := range []string{"/etc/evil.json", "../../outside/evil.json", filepath.Join(run, "receipts", "..", "x.json")} {
+		// The packet is JSON, so match the encoded form (Windows paths carry escaped separators).
+		edited := strings.Replace(string(b), jsonString(good), jsonString(bad), 1)
+		if edited == string(b) {
+			t.Fatal("receipt_path not found in packet")
+		}
+		if err := os.WriteFile(path, []byte(edited), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := Load(path); err == nil || !strings.Contains(err.Error(), "receipt_path") {
+			t.Errorf("Load accepted receipt_path %q: %v", bad, err)
+		}
+	}
+}
+
+func TestWriteRefusesSymlinkedRunOrPacketsDir(t *testing.T) {
+	outside := t.TempDir()
+	base := t.TempDir()
+
+	linkedRun := filepath.Join(base, "full-1")
+	if err := os.Symlink(outside, linkedRun); err != nil {
+		t.Skip("symlinks unavailable:", err)
+	}
+	if code := Run(writeArgs(linkedRun), &bytes.Buffer{}, &bytes.Buffer{}); code != 2 {
+		t.Errorf("symlinked run dir: exit %d, want 2", code)
+	}
+	if ents, _ := os.ReadDir(outside); len(ents) != 0 {
+		t.Errorf("symlinked run dir: wrote %d entries outside", len(ents))
+	}
+
+	run := filepath.Join(base, "full-2")
+	mustMkdir(t, run)
+	if err := os.Symlink(outside, filepath.Join(run, "packets")); err != nil {
+		t.Fatal(err)
+	}
+	if code := Run(writeArgs(run), &bytes.Buffer{}, &bytes.Buffer{}); code != 2 {
+		t.Errorf("symlinked packets dir: exit %d, want 2", code)
+	}
+	if ents, _ := os.ReadDir(outside); len(ents) != 0 {
+		t.Errorf("symlinked packets dir: wrote %d entries outside", len(ents))
+	}
+}
+
+func TestWriteRejectsExtraPositionals(t *testing.T) {
+	for _, tc := range [][]string{
+		append(writeArgs("RUN"), "stray"),
+		append([]string{"write", "RUN", "TASK-1", "a1", "implementer", "stray"}, writeArgs("RUN")[5:]...),
+	} {
+		run := runArea(t)
+		mustMkdir(t, run)
+		tc[1] = run
+		var errb bytes.Buffer
+		if code := Run(tc, &bytes.Buffer{}, &errb); code != 2 || !strings.Contains(errb.String(), "unexpected argument") {
+			t.Errorf("%v: exit %d stderr %q, want 2 unexpected argument", tc[5:], code, errb.String())
+		}
+		if _, err := os.Stat(filepath.Join(run, "packets")); err == nil {
+			t.Errorf("%v: packet written", tc[5:])
+		}
+	}
+}

package/engine/internal/overhaul/records/check.go

@@ -8,6 +8,7 @@ import (
 	"path"
 	"path/filepath"
 	"reflect"
+	"regexp"
 	"sort"
 	"strings"
 
@@ -15,6 +16,8 @@ import (
 	"github.com/devrites/devrites/internal/overhaul/snapshot"
 )
 
+var taskID = regexp.MustCompile(`^[A-Z][A-Z0-9]*-[A-Za-z0-9._-]+$`)
+
 func set(vals ...string) map[string]bool {
 	m := map[string]bool{}
 	for _, v := range vals {
@@ -528,6 +531,9 @@ func Check(run, genDir, prevDir string) ([]string, error) {
 		}
 		for _, tid := range order {
 			t, ts := tasks[Repr(tid)], PyStr(tid)
+			if !taskID.MatchString(ts) {
+				add("task %s: id must match %s", Repr(tid), taskID)
+			}
 			for _, d := range ovio.List(t["deps"]) {
 				if _, ok := tasks[Repr(d)]; !ok {
 					add("task %s: unknown dependency %s", ts, PyStr(d))

package/engine/internal/overhaul/records/init.go

@@ -1,6 +1,7 @@
 package records
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -10,11 +11,17 @@ import (
 	"path/filepath"
 	"regexp"
 	"strings"
+	"time"
 
 	"github.com/devrites/devrites/internal/gitenv"
 	"github.com/devrites/devrites/internal/overhaul/snapshot"
 )
 
+const (
+	gitTimeout   = 60 * time.Second
+	gitWaitDelay = 5 * time.Second
+)
+
 var runIDPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`)
 
 // excludeLine is what init adds to the local .git/info/exclude when git does
@@ -104,8 +111,9 @@ func addExclude(top string) error {
 
 // gitIgnores reports whether git's ignore rules match rel (tracked or not).
 func gitIgnores(top, rel string) (bool, error) {
-	cmd := gitCmd(top, "check-ignore", "-q", "--no-index", rel)
-	err := cmd.Run()
+	ctx, cancel := context.WithTimeout(context.Background(), gitTimeout)
+	defer cancel()
+	err := gitCmd(ctx, top, "check-ignore", "-q", "--no-index", rel).Run()
 	var ee *exec.ExitError
 	switch {
 	case err == nil:
@@ -118,15 +126,18 @@ func gitIgnores(top, rel string) (bool, error) {
 }
 
 func gitText(dir string, args ...string) (string, error) {
-	out, err := gitCmd(dir, args...).Output()
+	ctx, cancel := context.WithTimeout(context.Background(), gitTimeout)
+	defer cancel()
+	out, err := gitCmd(ctx, dir, args...).Output()
 	if err != nil {
 		return "", err
 	}
 	return strings.TrimSpace(string(out)), nil
 }
 
-func gitCmd(dir string, args ...string) *exec.Cmd {
-	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...) // #nosec G204 -- fixed git binary; arguments passed as argv, no shell
+func gitCmd(ctx context.Context, dir string, args ...string) *exec.Cmd {
+	cmd := exec.CommandContext(ctx, "git", append([]string{"-C", dir}, args...)...) // #nosec G204 -- fixed git binary; arguments passed as argv, no shell
 	cmd.Env = append(gitenv.Sanitize(os.Environ()), "GIT_OPTIONAL_LOCKS=0", "GIT_TERMINAL_PROMPT=0")
+	cmd.WaitDelay = gitWaitDelay
 	return cmd
 }

package/engine/internal/overhaul/records/records_test.go

@@ -265,6 +265,10 @@ func TestSingleGenerationRules(t *testing.T) {
 			approval(r)["plan_digest"] = digest(f.t, filepath.Join(f.run, "revisions/plan-r1.json"))
 			approval(r)["tasks"] = L{"T-1", "T-2"}
 		}, "task dependencies contain a cycle"},
+		{"task id breaks the approval fence", func(f *fixture, r map[string]J) {
+			f.writePlan(L{task("T-1", L{}, "src/a.py"), task("T-2\n```\n<img src=x>", L{"T-1"}, "src/b.py")})
+			approval(r)["plan_digest"] = digest(f.t, filepath.Join(f.run, "revisions/plan-r1.json"))
+		}, "id must match"},
 		{"bracket path accepted", func(f *fixture, r map[string]J) {
 			f.writePlan(L{task("T-1", L{}, "src/a.py"), task("T-2", L{"T-1"}, "app/blog/[slug]/page.tsx")})
 			approval(r)["plan_digest"] = digest(f.t, filepath.Join(f.run, "revisions/plan-r1.json"))

package/engine/internal/overhaul/records/run.go

@@ -6,6 +6,7 @@
 //	stage RUN       copy current generation to RUN/g<N+1>.tmp (prints path)
 //	publish RUN     validate staged generation, write manifest, swap CURRENT last
 //	validate RUN    verify CURRENT generation integrity + cross-record rules
+//	prune RUN [--keep K]  delete generations older than the newest K (default 2, minimum 2)
 //
 // Exit: 0 ok, 1 rule violations (listed), 2 usage/IO error.
 package records
@@ -31,6 +32,7 @@ const usage = `usage: overhaul records <command> ...
   stage RUN       copy current generation to RUN/g<N+1>.tmp (prints path)
   publish RUN     validate staged generation, write manifest, swap CURRENT last
   validate RUN    verify CURRENT generation integrity + cross-record rules
+  prune RUN [--keep K]  delete generations older than the newest K (default 2, minimum 2)
 Exit: 0 ok, 1 rule violations (listed), 2 usage/IO error.
 `
 
@@ -60,6 +62,8 @@ func Run(args []string, stdout, stderr io.Writer) int {
 		code, err = publish(args[1], stdout, stderr)
 	case "validate":
 		code, err = validate(args[1], stdout)
+	case "prune":
+		code, err = prune(args[1:], stdout, stderr)
 	default:
 		fmt.Fprint(stderr, usage)
 		return 2
@@ -398,3 +402,65 @@ func validate(run string, stdout io.Writer) (int, error) {
 	fmt.Fprintln(stdout, "valid "+gen)
 	return 0, nil
 }
+
+var generationName = regexp.MustCompile(`^g[0-9]{4}$`)
+
+// prune deletes published generations outside the newest keep, never touching
+// CURRENT, its manifest.previous, newer or staged generations.
+func prune(args []string, stdout, stderr io.Writer) (int, error) {
+	run, keep := args[0], 2
+	if len(args) == 3 && args[1] == "--keep" {
+		k, err := strconv.Atoi(args[2])
+		if err != nil || k < 2 {
+			fmt.Fprint(stderr, "--keep must be an integer of at least 2\n")
+			return 2, nil
+		}
+		keep = k
+	} else if len(args) != 1 {
+		fmt.Fprint(stderr, usage)
+		return 2, nil
+	}
+	cur, has, err := current(run)
+	if err != nil {
+		return 0, err
+	}
+	if !has {
+		return 0, fmt.Errorf("no CURRENT in %s", run)
+	}
+	n, err := genNumber(cur)
+	if err != nil {
+		return 0, err
+	}
+	m, err := ovio.LoadObject(join(run, cur, "manifest.json"))
+	if err != nil {
+		return 0, err
+	}
+	prev := ""
+	if p := m["previous"]; ovio.Truthy(p) {
+		prev = PyStr(p)
+	}
+	entries, err := os.ReadDir(run)
+	if err != nil {
+		return 0, err
+	}
+	var removed []string
+	for _, e := range entries {
+		name := e.Name()
+		if !generationName.MatchString(name) || name == cur || name == prev {
+			continue
+		}
+		g, err := genNumber(name)
+		if err != nil {
+			return 0, err
+		}
+		if g > n-keep {
+			continue
+		}
+		if err := os.RemoveAll(join(run, name)); err != nil {
+			return 0, err
+		}
+		removed = append(removed, name)
+	}
+	fmt.Fprintf(stdout, "pruned %d: %s\n", len(removed), strings.Join(removed, " "))
+	return 0, nil
+}

package/engine/internal/overhaul/records/run_test.go

@@ -0,0 +1,77 @@
+package records
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func generations(t *testing.T, run string) []string {
+	t.Helper()
+	m, err := filepath.Glob(filepath.Join(run, "g[0-9][0-9][0-9][0-9]"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := range m {
+		m[i] = filepath.Base(m[i])
+	}
+	return m
+}
+
+func TestPruneKeepsCurrentAndPrevious(t *testing.T) {
+	f := newFixture(t)
+	for i := 0; i < 5; i++ {
+		f.mustPublish(f.records())
+	}
+	if got := generations(t, f.run); len(got) != 5 {
+		t.Fatalf("publish must not prune on its own: %v", got)
+	}
+	if code, out, errs := f.cmd("prune", f.run, "--keep", "2"); code != 0 {
+		t.Fatalf("prune: %d %s %s", code, out, errs)
+	}
+	if got := strings.Join(generations(t, f.run), " "); got != "g0004 g0005" {
+		t.Fatalf("generations after prune = %q", got)
+	}
+	if code, out, _ := f.cmd("validate", f.run); code != 0 || strings.TrimSpace(out) != "valid g0005" {
+		t.Fatalf("validate: %d %s", code, out)
+	}
+	f.mustPublish(f.records())
+	if got := strings.Join(generations(t, f.run), " "); got != "g0004 g0005 g0006" {
+		t.Fatalf("generations after publish = %q", got)
+	}
+}
+
+func TestPruneKeepWindowAndGuards(t *testing.T) {
+	f := newFixture(t)
+	for i := 0; i < 5; i++ {
+		f.mustPublish(f.records())
+	}
+	if code, _, _ := f.cmd("prune", f.run, "--keep", "1"); code != 2 {
+		t.Fatalf("keep below 2 must be a usage error, got %d", code)
+	}
+	if code, _, _ := f.cmd("prune", f.run, "--keep", "x"); code != 2 {
+		t.Fatalf("non-numeric keep must be a usage error, got %d", code)
+	}
+	if got := generations(t, f.run); len(got) != 5 {
+		t.Fatalf("rejected prune removed generations: %v", got)
+	}
+	if code, _, errs := f.cmd("prune", f.run, "--keep", "3"); code != 0 {
+		t.Fatalf("prune: %d %s", code, errs)
+	}
+	if got := strings.Join(generations(t, f.run), " "); got != "g0003 g0004 g0005" {
+		t.Fatalf("generations after prune = %q", got)
+	}
+	if err := os.MkdirAll(filepath.Join(f.run, "g0006.tmp"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if code, _, errs := f.cmd("prune", f.run); code != 0 {
+		t.Fatalf("default prune: %d %s", code, errs)
+	}
+	if got := strings.Join(generations(t, f.run), " "); got != "g0004 g0005" {
+		t.Fatalf("generations after default prune = %q", got)
+	}
+	if _, err := os.Stat(filepath.Join(f.run, "g0006.tmp")); err != nil {
+		t.Fatalf("staged generation must survive prune: %v", err)
+	}
+}

package/engine/internal/overhaul/render/run.go

@@ -38,7 +38,7 @@ html{scroll-padding-top:4.5rem;-webkit-text-size-adjust:100%}
 @media (prefers-reduced-motion:no-preference){html{scroll-behavior:smooth}}
 body{margin:0;background:var(--bg);color:var(--fg);font:15px/1.5 var(--sans)}
 h1,h2,h3,h4{font-weight:600;line-height:1.25;margin:0;text-wrap:balance}
-h2{font-size:1.25rem;margin:0 0 .25rem}h4{font-size:.8125rem;color:var(--muted);margin:0 0 .25rem}
+h2{font-size:1.25rem;margin:0 0 .25rem}.blk>h3{font-size:.8125rem;color:var(--muted);margin:0 0 .25rem}
 p{margin:0 0 1rem}a{color:var(--accent);text-underline-offset:2px}
 code,pre,textarea,.m{font-family:var(--mono);font-size:.8125rem}code{overflow-wrap:anywhere}
 :focus-visible{outline:2px solid var(--accent);outline-offset:2px}
@@ -53,7 +53,7 @@ code,pre,textarea,.m{font-family:var(--mono);font-size:.8125rem}code{overflow-wr
 .toc a{display:block;white-space:nowrap;padding:.25rem .75rem;border:1px solid var(--line);border-radius:999px;text-decoration:none;color:var(--fg);font-size:.875rem}
 .toc a:hover{background:var(--raised)}
 @media (min-width:64rem){.shell{display:grid;grid-template-columns:12rem minmax(0,1fr);gap:2.5rem}.toc{position:sticky;top:4.5rem;align-self:start}.toc ul{flex-direction:column;gap:0;overflow:visible;margin:0}.toc a{white-space:normal;border:0;border-radius:8px;padding:.3rem .5rem}}
-main>section,.records>section{margin:0 0 1.5rem;padding:1.5rem;background:var(--surface);border:1px solid var(--line);border-radius:12px}
+main>section,.rec>section{margin:0 0 1.5rem;padding:1.5rem;background:var(--surface);border:1px solid var(--line);border-radius:12px}
 .hero{margin:0 0 1.5rem;padding:1.5rem;background:var(--surface);border:1px solid var(--line);border-radius:12px}
 .hero>p[role=status]{font-size:.8125rem;color:var(--muted);margin:0 0 1rem}.hero>p[role=status] strong{font-weight:500}
 .answer{display:grid;gap:2rem;grid-template-columns:minmax(0,1fr)}
@@ -63,7 +63,7 @@ main>section,.records>section{margin:0 0 1.5rem;padding:1.5rem;background:var(--
 .hero .score>.bar{height:18px;margin:.5rem 0 1.25rem}
 svg.bar{display:block;width:100%;height:12px;overflow:visible}
 .trk{fill:var(--track)}.tgt{fill:var(--fg)}.was{fill:var(--muted)}
-.g0,.c-pass,.c-part{fill:var(--pass)}.g4{fill:var(--sev4)}.g3{fill:var(--sev3)}.g2{fill:var(--sev2)}.g1{fill:var(--sev1)}.c-fail{fill:var(--fail)}.c-unk{fill:var(--unk)}
+.g0,.c-pass,.c-part{fill:var(--pass)}.g4{fill:var(--sev4)}.g3{fill:var(--sev3)}.g2{fill:var(--sev2)}.g1{fill:var(--sev1)}.c-fail{fill:var(--fail)}.c-unk,.gx{fill:var(--unk)}
 .s-critical{fill:var(--sev1)}.s-high{fill:var(--sev2)}.s-medium{fill:var(--sev3)}.s-low{fill:var(--sev4)}.s-informational,.s-none{fill:var(--info)}
 .rows{list-style:none;margin:0;padding:0;display:grid;gap:.75rem}
 .rows li{display:grid;grid-template-columns:minmax(0,1fr) auto;grid-template-areas:"l v" "b b";gap:.25rem .75rem;align-items:center}
@@ -74,7 +74,7 @@ svg.bar{display:block;width:100%;height:12px;overflow:visible}
 .legend{list-style:none;display:flex;flex-wrap:wrap;gap:.25rem 1.25rem;margin:1rem 0 0;padding:0;font-size:.8125rem;color:var(--muted)}
 .legend li{display:flex;align-items:center;gap:.4rem}.legend strong{color:var(--fg)}
 .key{display:inline-block;width:.7rem;height:.7rem;border-radius:2px;background:var(--c,var(--muted));flex:none}
-.key.g0,.key.c-pass,.key.c-part{--c:var(--pass)}.key.g4,.key.s-low{--c:var(--sev4)}.key.g3,.key.s-medium{--c:var(--sev3)}.key.g2,.key.s-high{--c:var(--sev2)}.key.g1,.key.s-critical{--c:var(--sev1)}.key.c-fail{--c:var(--fail)}.key.c-unk{--c:var(--unk)}.key.s-informational,.key.s-none{--c:var(--info)}.key.was{--c:var(--muted);width:3px}.key.tgt{--c:var(--fg);width:2px;height:.9rem;border-radius:0}
+.key.g0,.key.c-pass,.key.c-part{--c:var(--pass)}.key.g4,.key.s-low{--c:var(--sev4)}.key.g3,.key.s-medium{--c:var(--sev3)}.key.g2,.key.s-high{--c:var(--sev2)}.key.g1,.key.s-critical{--c:var(--sev1)}.key.c-fail{--c:var(--fail)}.key.c-unk{--c:var(--unk)}.key.gx{--c:var(--track);box-shadow:inset 0 0 0 1px var(--muted)}.key.s-informational,.key.s-none{--c:var(--info)}.key.was{--c:var(--muted);width:3px}.key.tgt{--c:var(--fg);width:2px;height:.9rem;border-radius:0}
 .blockers h2{font-size:1rem;margin:0 0 .75rem}
 .gates{list-style:none;margin:0 0 .75rem;padding:0;display:grid;gap:.6rem}
 .gates li{display:flex;gap:.6rem;align-items:flex-start}.gates code{color:var(--muted);font-size:.75rem}
@@ -94,15 +94,19 @@ svg.bar{display:block;width:100%;height:12px;overflow:visible}
 .filter input:checked+label{background:var(--fg);color:var(--bg);border-color:var(--fg)}.filter input:checked+label .count{color:inherit}
 .filter input:focus-visible+label{outline:2px solid var(--accent);outline-offset:2px}
 @supports not selector(:has(a)){.filter{display:none}}
-#findings:has(#sev-critical:checked) .finding:not(.s-critical),#findings:has(#sev-high:checked) .finding:not(.s-high),#findings:has(#sev-medium:checked) .finding:not(.s-medium),#findings:has(#sev-low:checked) .finding:not(.s-low),#findings:has(#sev-informational:checked) .finding:not(.s-informational){display:none}
+@media screen{#findings:has(#sev-critical:checked) .finding:not(.s-critical):not(:target),#findings:has(#sev-high:checked) .finding:not(.s-high):not(:target),#findings:has(#sev-medium:checked) .finding:not(.s-medium):not(:target),#findings:has(#sev-low:checked) .finding:not(.s-low):not(:target),#findings:has(#sev-informational:checked) .finding:not(.s-informational):not(:target){display:none}}
 .cards{border:1px solid var(--line);border-radius:10px;overflow:hidden}
 .finding,.task{border-bottom:1px solid var(--line-2)}.finding:last-child,.task:last-child{border-bottom:0}.sub{font-size:1rem;margin:1.5rem 0 .5rem}
 .finding>summary,.task>summary{list-style:none;cursor:pointer;display:grid;grid-template-columns:5.5rem 4.5rem minmax(0,1fr);gap:.25rem .75rem;align-items:baseline;padding:.6rem .9rem}.task>summary{grid-template-columns:4.5rem 6.5rem minmax(0,1fr) auto}.task>summary>.pill:nth-child(2){justify-self:start}
 .finding>summary::-webkit-details-marker,.task>summary::-webkit-details-marker{display:none}.finding>summary:hover,.task>summary:hover{background:var(--raised)}
 .finding .where{grid-column:3;color:var(--muted);font-size:.75rem}
 @media (min-width:60rem){.finding>summary{grid-template-columns:5.5rem 4.5rem minmax(0,1fr) minmax(0,16rem)}.finding .where{grid-column:auto;text-align:right;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}}
+@media (max-width:40rem){.finding>summary,.task>summary{grid-template-columns:auto auto minmax(0,1fr)}.ftitle,.finding .where{grid-column:1/-1}}
+@media (forced-colors:active){.filter input:checked+label{forced-color-adjust:none;background:Highlight;color:HighlightText;border-color:Highlight}.key{forced-color-adjust:none}}
 .sev{display:inline-flex;align-items:center;gap:.4rem;font-size:.8125rem;font-weight:600}
 .fid{font-weight:600}.ftitle{overflow-wrap:anywhere}
+.finding>summary .fid::before,.task>summary .fid::before,.records>summary::before{content:"\25B8\00A0"/"";color:var(--muted)}
+.finding[open]>summary .fid::before,.task[open]>summary .fid::before,.records[open]>summary::before{content:"\25BE\00A0"/""}
 .finding[open]>summary,.task[open]>summary{background:var(--raised)}.fbody{padding:.75rem .9rem 1rem;display:grid;gap:.9rem}
 .kv{display:grid;grid-template-columns:minmax(0,9rem) minmax(0,1fr);gap:.25rem 1rem;margin:0}
 .kv dt{color:var(--muted);font-size:.8125rem}.kv dd{margin:0;overflow-wrap:anywhere}
@@ -122,17 +126,17 @@ tr:target,.finding:target,.task:target{outline:2px solid var(--accent);outline-o
 #decide label{display:block;font-weight:600;margin:0 0 .5rem}
 textarea{display:block;width:100%;min-height:7rem;padding:.75rem;border:1px solid var(--line);border-radius:8px;background:var(--bg);color:var(--fg);resize:vertical}
 @media print{.top,.toc,.skip,.filter{display:none}.shell{display:block;padding:0}.scroll{max-height:none;overflow:visible}thead th{position:static}.scroll:has(th:nth-child(6)) table{min-width:0}.finding,tr,.rows li{break-inside:avoid}body{font-size:10pt}}
-@media print{details::details-content{content-visibility:visible}}`
+@media print{details::details-content{content-visibility:visible}details.records:not([open])::details-content{content-visibility:hidden}}`
 
 var (
 	rowID    = regexp.MustCompile(`^[A-Z][A-Z0-9]*-[A-Za-z0-9._-]+$`)
 	unsafeID = regexp.MustCompile(`[^A-Za-z0-9_-]`)
 	flags    = set("PASS", "FAIL", "UNKNOWN", "NOT_READY", "MEETS_TARGETS", "NOT_ASSESSABLE", "BLOCKED")
 	leads    = set("candidate", "needs-validation")
-	reviewed = set("semantically-reviewed", "cross-boundary-reviewed", "verified")
+	reviewed = set("semantically-reviewed", "cross-boundary-reviewed", "verified", "excluded")
 	// esc matches Python html.escape(quote=True) byte for byte.
 	esc   = strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;", `"`, "&quot;", "'", "&#x27;").Replace
-	mdEsc = strings.NewReplacer(`\`, `\\`, "|", `\|`, "\n", " ", "<", "&lt;").Replace
+	mdEsc = strings.NewReplacer(`\`, `\\`, "|", `\|`, "\r\n", " ", "\r", " ", "\n", " ", "<", "&lt;").Replace
 
 	// HTML-only presentation: severity scale, status order, typed table cells.
 	sevOrder = []string{"critical", "high", "medium", "low", "informational"}
@@ -941,11 +945,11 @@ func (v view) page(b *built, kind, title, summary, csp string, decide bool) []st
 			rest++
 		}
 	}
-	out = append(out, fmt.Sprintf(`<details id="records" class="records"><summary>All records <span class="count">%d tables</span></summary>`+
+	out = append(out, fmt.Sprintf(`<details id="records" class="records"><summary>All records <span class="count">%d sections</span></summary>`+
 		`<p class="muted">Every canonical record behind the charts above, as tables.</p>`, rest))
 	for _, s := range b.secs {
 		if !shown[s.anchor] {
-			out = append(out, v.section(b, s))
+			out = append(out, `<details class="rec"><summary>`+esc(s.heading)+`</summary>`+v.section(b, s)+`</details>`)
 		}
 	}
 	return append(out, "</details></main></div></body></html>")
@@ -1204,7 +1208,7 @@ func (v view) details(summary, body string) string {
 	if body == "" {
 		return ""
 	}
-	return `<div class="blk"><h4>` + esc(summary) + `</h4>` + body + `</div>`
+	return `<div class="blk"><h3>` + esc(summary) + `</h3>` + body + `</div>`
 }
 
 // threshold returns one scorecard threshold row: value, minimum and result.