refactor(design): tone down card corner-light gradients to ~55% intensity

Operator feedback after the design-sweep PR went out: the corner-light
gradients on data cards (the `.glass-panel` / `.glass-panel-strong`
class) read too vibrant once the pattern was applied broadly to deck
cards, stat cards, list cards, modals, dropdowns, etc.

The same intensity worked fine on the floating chrome chips (sidebar
nav, top header) because there are only two of those per viewport and
they SHOULD anchor the page visually as the surfaces "responding" to
the background light sources. Data cards tile densely; at full
intensity they compete with the chrome and the catch-lights become
visual noise instead of an environmental cue.

Two intensity tiers now live in `styles/globals.css`:

  1. `--corner-light-{warm,cool}` (full intensity, unchanged) — used
     by the floating chrome chips via inline `boxShadow` in
     `components/Layout.js` and `components/ui/TopSearchBar.js`.

  2. `--corner-light-{warm,cool}-subtle` (NEW, ~55% of full alpha) —
     used by `.glass-panel` and `.glass-panel-strong` for data cards.

Alpha values:

| Token                            | Light theme | Dark theme |
|----------------------------------|-------------|------------|
| `--corner-light-warm`            | 0.50        | 0.68       |
| `--corner-light-cool`            | 0.38        | 0.58       |
| `--corner-light-warm-subtle`     | 0.28        | 0.38       |
| `--corner-light-cool-subtle`     | 0.20        | 0.32       |

No other surfaces changed, no token names removed (so any custom
inline `boxShadow` styles in other components continue to compile).
The hearth body gradient + `--chip-border-base` faint white tint are
untouched.

Verified: build + lint + 113/113 vitest tests pass.
Co-authored-by: Cursor <cursoragent@cursor.com>

.agent-context-manifest.yml

@@ -1,166 +1,176 @@
+# .agent-context-manifest.yml
+#
+# Generated by agent-pipeline bootstrap-agent-context skill.
+# Tracks which artifacts the bootstrap installed in this repo, where they
+# came from, and what pipeline version they correspond to.
+#
+# Read by the `sync-agent-context` skill to detect drift and propose updates.
+# Don't edit by hand — use the bootstrap or sync skill in Cursor.
+#
+# Schema: https://github.com/varutasu/agent-pipeline/blob/main/docs/manifest-schema.md
+
 schema_version: 1
-pipeline_version: 0.7.0
+pipeline_version: "0.5.0"
-pipeline_source: https://github.com/varutasu/agent-pipeline
+pipeline_source: "https://github.com/varutasu/agent-pipeline"
-installed_at: '2026-05-22T22:25:00Z'
+installed_at: "2026-05-22T22:25:00Z"
-last_synced_at: '2026-08-14T23:50:20Z'
+last_synced_at: "2026-05-22T22:25:00Z"
+
 layers:
-- L1
+  - L1
-- L2
+  - L2
-- L3
+  - L3
+
+# Notes:
+# - AGENTS.md is hand-curated per-repo — NOT tracked (always shows drift)
+# - docs/SCHEMA_MAP.md is hand-curated per-repo — NOT tracked
+# - .convoys/<slug>.md files are runtime outputs — NOT tracked
 artifacts:
-- path: .convoys/README.md
+  - path: ".convoys/README.md"
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/_common/convoys-readme.md.template
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/_common/convoys-readme.md.template"
-  version: 0.6.0
+    version: "0.5.0"
-  installed_hash: sha256:6b779efd3116fffb0f2affdc57964750234d63c75092074e632a9b546d709bd6
+    installed_hash: "sha256:a48548cd3f5d0c40fc179106890661c3be5fcdc13eb705af7cfe9233e0b8b209"
-- path: .cursor/agents/role-a11y-auditor.md
+
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-a11y-auditor.md
+  - path: ".cursor/agents/role-a11y-auditor.md"
-  version: 0.7.0
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-a11y-auditor.md"
-  installed_hash: sha256:f457840b51f6f4b0c95174ccee175fd5b65f7c9f5f65598ef80ac7fd532110ec
+    version: "0.5.0"
-- path: .cursor/agents/role-architect.md
+    installed_hash: "sha256:a59938deceb0246ebd7e477f1f9a442102f9fcbb81b0364f0ddc5f86e95a7930"
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-architect.md
+
-  version: 0.7.0
+  - path: ".cursor/agents/role-architect.md"
-  installed_hash: sha256:bc38e10177219a3e3903b9019f1052c32fd38ea59373368c3e5d1b1011435b58
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-architect.md"
-- path: .cursor/agents/role-conductor.md
+    version: "0.5.0"
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-conductor.md
+    installed_hash: "sha256:269bd62af1557c5d353a9f95a613960e3434be4ec6e0c0b5f6b099adf6872044"
-  version: 0.7.0
+
-  installed_hash: sha256:c4f764becd31175925c711fbf196ae559f989dc78c3f336f1da39349c9b3ee62
+  - path: ".cursor/agents/role-conductor.md"
-- path: .cursor/agents/role-design-system-auditor.md
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-conductor.md"
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-design-system-auditor.md
+    version: "0.5.0"
-  version: 0.7.0
+    installed_hash: "sha256:bc75a3e6646217a015f7bb60c3610afd9b57ae91c7d2fc7a7971f4709b19368a"
-  installed_hash: sha256:e52b507f12c507411540fa30277e70ab6dd25cc5a742f08c35643f93e73032f6
+
-- path: .cursor/agents/role-doc-writer.md
+  - path: ".cursor/agents/role-design-system-auditor.md"
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-doc-writer.md
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-design-system-auditor.md"
-  version: 0.7.0
+    version: "0.5.0"
-  installed_hash: sha256:7e626346705083cd57fa8a401b18f7f44da330a9f2a60f461dc362fbb2c7159b
+    installed_hash: "sha256:d214cecb1e8482fc24f2815c8220c860191f08526614f89cf9a5797e4ee9110a"
-- path: .cursor/agents/role-ia-architect.md
+
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-ia-architect.md
+  - path: ".cursor/agents/role-doc-writer.md"
-  version: 0.7.0
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-doc-writer.md"
-  installed_hash: sha256:40d669a8a7ebf1e6165ab1054b189f728ceefaadcfb124d47b55bceaf7c8fac4
+    version: "0.5.0"
-- path: .cursor/agents/role-implementer.md
+    installed_hash: "sha256:d4e8bf8cee93153506b7b742848462422dbe5cc7fd012c62f6ffd50460e344d4"
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-implementer.md
+
-  version: 0.7.0
+  - path: ".cursor/agents/role-ia-architect.md"
-  installed_hash: sha256:ae6e4dfa3974af4fbe70c892a7806e68f7268fd1079ad96e7844fa7435b0129a
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-ia-architect.md"
-- path: .cursor/agents/role-reviewer.md
+    version: "0.5.0"
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-reviewer.md
+    installed_hash: "sha256:69685a3a407c4ee25e2606d426c3107d6b917abee80f907e16ade4a16b439839"
-  version: 0.7.0
+
-  installed_hash: sha256:e0753d5a2d86f59559ded52d7136cec5ab3cd200b42926b67a56469513eaf41b
+  - path: ".cursor/agents/role-implementer.md"
-- path: .cursor/agents/role-security-auditor.md
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-implementer.md"
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-security-auditor.md
+    version: "0.5.0"
-  version: 0.7.0
+    installed_hash: "sha256:b4f4d8596068679b90ffc3a2b6d2e1b6548caf8c68a50f7ed640ba8f638c1c4c"
-  installed_hash: sha256:f141a54541626b7344c9883431251d6f02d93ede3d070cf4ffbcaea9c19689e0
+
-- path: .cursor/agents/role-ui-designer.md
+  - path: ".cursor/agents/role-reviewer.md"
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-ui-designer.md
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-reviewer.md"
-  version: 0.7.0
+    version: "0.5.0"
-  installed_hash: sha256:607dc3783131018dd1c3527bba682ec2fc3c33221bc2bbd66add56fc1691ef18
+    installed_hash: "sha256:1ff38349321402a0ac2be37878dc2c0bcab62e54caf74c422b919aa6d75f9b67"
-- path: .cursor/agents/role-ux-reviewer.md
+
-  source: skills/bootstrap-agent-context/templates/L2-roles/role-ux-reviewer.md
+  - path: ".cursor/agents/role-ux-reviewer.md"
-  version: 0.7.0
+    source: "skills/bootstrap-agent-context/templates/L2-roles/role-ux-reviewer.md"
-  installed_hash: sha256:c83c365094266d2bd25afa761204116a620d1acbeb854b589cf51bbecefe8100
+    version: "0.5.0"
-- path: .cursor/rules/api-routes.mdc
+    installed_hash: "sha256:3a1d4b66981f469b15e23a1cd34ab41352759966179e126b3d56ddc1eca4a03e"
-  source: skills/bootstrap-agent-context/templates/L1-context/api-routes.mdc.template
+
-  version: 0.5.0-local
+  - path: ".cursor/rules/api-routes.mdc"
-  installed_hash: sha256:92b67b6d0a763c23d95cb63152ea5e8837bb7aa467c703e3cdf059b2d74edad5
+    source: "skills/bootstrap-agent-context/templates/L1-context/api-routes.mdc.template"
-- path: .cursor/rules/auth-and-permissions.mdc
+    version: "0.5.0-local"
-  source: tcg-vault-local
+    installed_hash: "sha256:54cd66d71f5a129a67d0f4b1797f5f63b7f9aae3eeabe67217861456ff4db59b"
-  version: 0.5.0-local
+
-  installed_hash: sha256:bad3b270bc9a6fcbae0386fc86b46c1dec759f8b023f48ac4f9a827d65f97ca3
+  - path: ".cursor/rules/auth-and-permissions.mdc"
-- path: .cursor/rules/convoy-planning.mdc
+    source: "tcg-vault-local"
-  source: skills/bootstrap-agent-context/templates/L1-context/convoy-planning.mdc.template
+    version: "0.5.0-local"
-  version: 0.6.0
+    installed_hash: "sha256:9b7eb7bea0cad0e43d0e9442eb8b660945cb6935f9f7c82fd7d7d71d66b39a2d"
-  installed_hash: sha256:d0d4e2e06905d1e58a6a1d4fd9cda3cdb1bc80698c1e1c699e1c939278f23ea3
+
-- path: .cursor/rules/db-and-schema.mdc
+  - path: ".cursor/rules/db-and-schema.mdc"
-  source: tcg-vault-local
+    source: "tcg-vault-local"
-  version: 0.5.0-local
+    version: "0.5.0-local"
-  installed_hash: sha256:6cf287d694d31e633c8a1add9a645cf9a21b4efe5dce66af104209029aa828a3
+    installed_hash: "sha256:83df2cf7121722a092f85165b1a93c755ce57e5361e0f6b2ecc74e9f928c5015"
-- path: .cursor/rules/model-routing.mdc
+
-  source: skills/bootstrap-agent-context/templates/L1-context/model-routing.mdc.template
+  - path: ".cursor/rules/no-go-zones.mdc"
-  version: 0.7.0
+    source: "skills/bootstrap-agent-context/templates/L1-context/no-go-zones.mdc"
-  installed_hash: sha256:cac45f7aa457eb9312b734f40a55e69e7b30c859b7d8e975a7b80c1268a578f6
+    version: "0.5.0-local"
-- path: .cursor/rules/no-go-zones.mdc
+    installed_hash: "sha256:aa7046bc3e0266cb3c9b0eb0ef8f68cc50d6837f65c96861804ff81b9c4afa64"
-  source: skills/bootstrap-agent-context/templates/L1-context/no-go-zones.mdc
+
-  version: 0.5.0-local
+  - path: ".cursor/rules/schema-map.mdc"
-  installed_hash: sha256:bfa661b7bb67047cf33f7ab13116671c12d32a11022bf29dd1e5a12b6f7cf0b5
+    source: "tcg-vault-local"
-- path: .cursor/rules/schema-map.mdc
+    version: "0.5.0-local"
-  source: tcg-vault-local
+    installed_hash: "sha256:3429bad56384117dc81873b337a6d815bd53799389f7908dedb53dbb7642bced"
-  version: 0.5.0-local
+
-  installed_hash: sha256:3429bad56384117dc81873b337a6d815bd53799389f7908dedb53dbb7642bced
+  - path: ".cursor/rules/ui-and-theming.mdc"
-- path: .cursor/rules/security-baseline.mdc
+    source: "tcg-vault-local"
-  source: skills/bootstrap-agent-context/templates/L1-context/security-baseline.mdc.template
+    version: "0.5.0-local"
-  version: 0.6.0
+    installed_hash: "sha256:b841ddda5baa47a76c3726a3c92b2c82a45120fdd461b3243bf970479d1cf1df"
-  installed_hash: sha256:0f0f919d8c500a5e393bf3def01a4ee69c3c489c80a86c6918f0c03aba41083e
+
-- path: .cursor/rules/ui-and-theming.mdc
+  - path: ".cursor/skills/add-api-route/SKILL.md"
-  source: tcg-vault-local
+    source: "tcg-vault-local"
-  version: 0.5.0-local
+    version: "0.5.0-local"
-  installed_hash: sha256:66cb77e0c4b72605d8be43986e38012fc62b7f3a0e707b7bf80a28f91d208e79
+    installed_hash: "sha256:0e29f7e994a51e5a40b8308edab08ee9c1f713e297d68e98029294d8ca568cc7"
-- path: .cursor/skills/add-api-route/SKILL.md
+
-  source: tcg-vault-local
+  - path: ".cursor/skills/add-page/SKILL.md"
-  version: 0.5.0-local
+    source: "tcg-vault-local"
-  installed_hash: sha256:0e29f7e994a51e5a40b8308edab08ee9c1f713e297d68e98029294d8ca568cc7
+    version: "0.5.0-local"
-- path: .cursor/skills/add-page/SKILL.md
+    installed_hash: "sha256:318912077a6ced6a3a31f85dc15d069bf7627c161b6735e3fa259ca10766daa9"
-  source: tcg-vault-local
+
-  version: 0.5.0-local
+  - path: ".github/CODEOWNERS"
-  installed_hash: sha256:564582ddc877d0d063cf2afa7796ddfc62a00d5d7659debb8e017629dfbb3aaf
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/nextjs/CODEOWNERS.template"
-- path: .cursor/skills/security-audit/SKILL.md
+    version: "0.5.0-local"
-  source: skills/security-audit/SKILL.md
+    installed_hash: "sha256:b714a0a011776300abeab92fe8969f150c273c37d0d6b37c1ad2eb67d47decda"
-  version: 0.6.0
+
-  installed_hash: sha256:8148f9ea9e66929ff51b003c6f5d6026c5d1525d31d036affb219624bb5e9305
+  - path: ".github/PULL_REQUEST_TEMPLATE.md"
-- path: .cursor/skills/ui-ux-pro-max/SKILL.md
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/_common/PULL_REQUEST_TEMPLATE.md.template"
-  source: skills/ui-ux-pro-max/SKILL.md
+    version: "0.5.0"
-  version: 0.6.0
+    installed_hash: "sha256:89863e58b9ec194aef1c94d3596e892467833e8bc880a28994acca401b6d9635"
-  installed_hash: sha256:9debdd7439a6f73318e2f624e78d905f78885acf009ce0c34a02aa348b3c1c17
+
-- path: .github/CODEOWNERS
+  - path: ".github/workflows/agent-context-drift.yml"
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/nextjs/CODEOWNERS.template
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/_common/agent-context-drift.yml.template"
-  version: 0.5.0-local
+    version: "0.5.0"
-  installed_hash: sha256:aff1f610b892b437dbd9c82ab56ce12eb721c06b4cd86c38fa15081ab3951c70
+    installed_hash: "sha256:5505c296c1b61d023ee2aca222103097e2b5ed2e0e38da3679cc4f9754457785"
-- path: .github/PULL_REQUEST_TEMPLATE.md
+
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/_common/PULL_REQUEST_TEMPLATE.md.template
+  - path: ".github/workflows/ci.yml"
-  version: 0.6.0
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/nextjs/ci.yml.template"
-  installed_hash: sha256:deaca37703e9c348937614577d1c165993093450434df6002aa395dd70b2ba78
+    version: "0.5.0-local"
-- path: .github/workflows/agent-context-drift.yml
+    installed_hash: "sha256:6aff7a1c9f2e42606580c241b6dadca7c2d8550aeb959bd69fdd843eb9097cac"
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/_common/agent-context-drift.yml.template
+
-  version: 0.5.0
+  - path: ".github/workflows/pr-health-rollup.yml"
-  installed_hash: sha256:5505c296c1b61d023ee2aca222103097e2b5ed2e0e38da3679cc4f9754457785
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/pr-health-rollup.yml.template"
-- path: .github/workflows/ci.yml
+    version: "0.5.0-local"
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/nextjs/ci.yml.template
+    installed_hash: "sha256:8747674323807d84395fa027b25e7e27881c5e6b0cc87a138d9cb3f78fd88956"
-  version: 0.5.0-local
+
-  installed_hash: sha256:e4b480517346e978a27b22f36dd1926d4c1787176cec6495d69e7119c1e547b2
+  - path: ".github/workflows/preview-smoke.yml"
-- path: .github/workflows/convoy-metrics-gate.yml
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/preview-smoke.yml.template"
-  source: tcg-vault-local
+    version: "0.5.0-local"
-  version: 0.5.0-local
+    installed_hash: "sha256:2e71026b09db8b2f32b6a868d705489600c875082d6320c2369bf2f5ebc315b8"
-  installed_hash: sha256:ebdcba74f81fe281ab6cc1306630295addb81c5deba06d313948b8ebf8c199b8
+
-- path: .github/workflows/pr-health-rollup.yml
+  - path: ".github/workflows/visual-diff.yml"
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/pr-health-rollup.yml.template
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/visual-diff.yml.template"
-  version: 0.5.0-local
+    version: "0.5.0-local"
-  installed_hash: sha256:a8ead80d2e63b9c9a54c014ed0f130fca90fe2857664ac77d81acc5ee2ebb681
+    installed_hash: "sha256:88270b1fa59aba99591ec094764dd367deed956bcb746ac6bb195241b3a7dae1"
-- path: .github/workflows/preview-smoke.yml
+
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/preview-smoke.yml.template
+  - path: "docs/agent-context/README.md"
-  version: 0.5.0-local
+    source: "skills/bootstrap-agent-context/templates/L1-context/agent-context-readme.md.template"
-  installed_hash: sha256:9f6473f716e541164c10ef30ef12258f1a8e360bb7776db20dc26872f687539c
+    version: "0.5.0-local"
-- path: .github/workflows/visual-diff.yml
+    installed_hash: "sha256:095b9cc6a30327114c9ddfb4ff57a5fde76b213e12b1c5574a1f96205d60dbad"
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/visual-diff.yml.template
+
-  version: 0.5.0-local
+  - path: "lib/flags/index.js"
-  installed_hash: sha256:7dbe634bfe7a6a6d1ca2c76c86dc80947e0a699e393153f47dd047ced3f86975
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/flags-index.ts.template"
-- path: docs/agent-context/README.md
+    version: "0.5.0-local"
-  source: tcg-vault-local
+    installed_hash: "sha256:1a3cd1f900194eaf4ec86588dd1c3c2bff6a565e742061fc911abdd47bd5f3a5"
-  version: 0.5.0-local
+
-  installed_hash: sha256:095b9cc6a30327114c9ddfb4ff57a5fde76b213e12b1c5574a1f96205d60dbad
+  - path: "scripts/log-convoy-event.sh"
-- path: docs/agent-context/model-routing-policy.md
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/_common/log-convoy-event.sh"
-  source: docs/model-routing-policy.md
+    version: "0.5.0"
-  version: 0.7.0
+    installed_hash: "sha256:cd0413691066a177b6b4e6164a9a0978c20a853ad60222ae833b5d53b255818d"
-  installed_hash: sha256:cc7a9a39ff28c6b743c47efbdf06fc3b75cf16c9fa62691fa1b05862a460dd45
+
-- path: lib/flags/index.js
+  - path: "scripts/wt.sh"
-  source: tcg-vault-local
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/_common/wt.sh"
-  version: 0.5.0-local
+    version: "0.5.0"
-  installed_hash: sha256:1a3cd1f900194eaf4ec86588dd1c3c2bff6a565e742061fc911abdd47bd5f3a5
+    installed_hash: "sha256:2a4f44a159f80a8ea6fe53ac507c01a2f91a4e2118d997a98b051808ac35e9a5"
-- path: scripts/log-convoy-event.sh
+
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/_common/log-convoy-event.sh
+  - path: "tests/smoke/app.smoke.spec.ts"
-  version: 0.6.0
+    source: "skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/playwright-smoke.spec.ts.template"
-  installed_hash: sha256:52bdc8f60b18315dd8ad0f1dd6b727106dfa134b8769b0cd63d8698d5865cf21
+    version: "0.5.0"
-- path: scripts/wt.sh
+    installed_hash: "sha256:a62c10edb712a61f1cfece43705bfff75a5a66ad6bc8b53f7e69a43c3efb962c"
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/_common/wt.sh
-  version: 0.5.0
-  installed_hash: sha256:2a4f44a159f80a8ea6fe53ac507c01a2f91a4e2118d997a98b051808ac35e9a5
-- path: tests/smoke/app.smoke.spec.ts
-  source: skills/bootstrap-agent-context/templates/L3-pipeline/nextjs-prisma-vercel/playwright-smoke.spec.ts.template
-  version: 0.5.0
-  installed_hash: sha256:a62c10edb712a61f1cfece43705bfff75a5a66ad6bc8b53f7e69a43c3efb962c

.convoys/.metrics.jsonl

@@ -1,133 +0,0 @@
-{"ts": "2026-05-23T04:18:51Z", "role": "role-conductor", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": ["ia", "ux", "visual", "a11y", "design"], "classification": "server-only", "duration_s": 0}
-{"ts": "2026-05-23T04:44:56Z", "role": "role-conductor", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": ["ia", "ux", "flag"], "classification": "feature", "duration_s": 0}
-{"ts": "2026-05-23T04:54:59Z", "role": "role-architect", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": ["ia", "ux", "flag"], "classification": "feature", "duration_s": 101}
-{"ts": "2026-05-23T05:37:11Z", "role": "role-architect", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": ["ia", "ux", "flag"], "classification": "feature", "duration_s": 311, "outcome": "scope-expanded"}
-{"ts": "2026-05-23T05:50:00Z", "role": "role-architect", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": ["ia", "ux", "flag"], "classification": "feature", "duration_s": 357, "outcome": "eslint-v10-pivot"}
-{"ts": "2026-05-23T05:55:05Z", "role": "role-implementer", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 180}
-{"ts": "2026-05-23T06:12:57Z", "role": "role-architect", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "duration_s": 319, "outcome": "typescript-devdep-add"}
-{"ts": "2026-05-23T06:28:25Z", "role": "role-implementer", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 78}
-{"ts": "2026-05-23T06:48:30Z", "role": "role-architect", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "duration_s": 347, "outcome": "eslint-v9-fallback-decision-d"}
-{"ts": "2026-05-23T06:51:22Z", "role": "role-implementer", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 50}
-{"ts": "2026-05-23T07:07:35Z", "role": "role-design-system-auditor", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "duration_s": 114, "multitask_group": "audit-bump-next-js-4"}
-{"ts": "2026-05-23T07:08:15Z", "role": "role-a11y-auditor", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "duration_s": 180, "multitask_group": "audit-bump-next-js-4"}
-{"ts": "2026-05-23T07:08:55Z", "role": "role-reviewer", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 42, "multitask_group": "audit-bump-next-js-4"}
-{"ts": "2026-05-23T07:34:56Z", "role": "role-doc-writer", "convoy": "bump-next-js", "repo": "tcg-vault", "skip_flags": [], "duration_s": 26, "outcome": "complete"}
-{"ts": "2026-05-23T07:57:10Z", "role": "role-architect", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": ["ia", "ux", "visual", "a11y", "design"], "classification": "server-only", "duration_s": 900}
-{"ts": "2026-05-23T14:44:38Z", "role": "role-implementer", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 192}
-{"ts": "2026-05-23T14:52:56Z", "role": "role-implementer", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": [], "brief": 3, "duration_s": 240}
-{"ts": "2026-05-23T15:00:15Z", "role": "role-reviewer", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": [], "brief": 3, "duration_s": 129}
-{"ts": "2026-05-23T15:52:10Z", "role": "role-reviewer", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": [], "brief": 2, "duration_s": 209}
-{"ts": "2026-05-23T15:56:43Z", "role": "role-reviewer", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": [], "brief": 4, "duration_s": 227}
-{"ts": "2026-05-23T16:04:17Z", "role": "role-reviewer", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": [], "brief": 6, "duration_s": 34}
-{"ts": "2026-05-23T16:10:21Z", "role": "role-reviewer", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": [], "brief": 5, "duration_s": 131}
-{"ts": "2026-05-23T16:25:52Z", "role": "role-doc-writer", "convoy": "fix-auth-bypass", "repo": "tcg-vault", "skip_flags": [], "brief": 0, "duration_s": 724, "outcome": "complete"}
-{"ts": "2026-05-23T17:31:18Z", "role": "role-architect", "convoy": "drop-public-setup", "repo": "tcg-vault", "skip_flags": [], "duration_s": 720}
-{"ts": "2026-05-23T19:58:01Z", "role": "role-implementer", "convoy": "drop-public-setup", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 327}
-{"ts": "2026-05-23T20:07:35Z", "role": "role-implementer", "convoy": "drop-public-setup", "repo": "tcg-vault", "skip_flags": [], "brief": 2, "duration_s": 174}
-{"ts": "2026-05-23T23:00:44Z", "role": "role-architect", "convoy": "fix-layout-default-user", "repo": "tcg-vault", "skip_flags": [], "duration_s": 1500}
-{"ts": "2026-05-24T14:14:24Z", "role": "role-implementer", "convoy": "fix-layout-default-user", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 403}
-{"ts": "2026-05-24T15:05:32Z", "role": "role-implementer", "convoy": "fix-layout-default-user", "repo": "tcg-vault", "skip_flags": [], "brief": 2, "duration_s": 1800}
-{"ts": "2026-05-24T19:37:56Z", "role": "role-doc-writer", "convoy": "fix-layout-default-user", "repo": "tcg-vault", "skip_flags": [], "duration_s": 242, "outcome": "complete"}
-{"ts": "2026-05-24T20:26:29Z", "role": "role-implementer", "convoy": "fix-vercel-deployment-protection-in-ci", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 101}
-{"ts": "2026-05-24T21:32:57Z", "role": "role-doc-writer", "convoy": "fix-vercel-deployment-protection-in-ci", "repo": "tcg-vault", "skip_flags": [], "duration_s": 207, "outcome": "complete"}
-{"ts": "2026-05-24T23:44:57Z", "role": "role-implementer", "convoy": "adopt-playwright-smoke", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 310}
-{"ts": "2026-05-25T01:25:55Z", "role": "role-implementer", "convoy": "cors-tighten", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 900}
-{"ts": "2026-05-25T03:46:40Z", "role": "role-implementer", "convoy": "add-rate-limiting", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 600}
-{"ts": "2026-05-27T12:55:50Z", "role": "role-conductor", "convoy": "scanner-audit-portfolio", "repo": "tcg-vault", "skip_flags": [], "classification": "docs-only", "duration_s": 0}
-{"ts": "2026-05-27T19:09:46Z", "role": "role-reviewer", "convoy": "redesign-scanner-flow", "repo": "tcg-vault", "skip_flags": [], "duration_s": 120, "outcome": "comment-only", "multitask_group": "audit-redesign-scanner-flow-44"}
-{"ts": "2026-05-27T19:09:46Z", "role": "role-design-system-auditor", "convoy": "redesign-scanner-flow", "repo": "tcg-vault", "skip_flags": [], "duration_s": 120, "outcome": "comment-only", "multitask_group": "audit-redesign-scanner-flow-44"}
-{"ts": "2026-05-27T19:09:46Z", "role": "role-a11y-auditor", "convoy": "redesign-scanner-flow", "repo": "tcg-vault", "skip_flags": [], "duration_s": 120, "outcome": "comment-only", "multitask_group": "audit-redesign-scanner-flow-44"}
-{"ts": "2026-06-02T05:33:45Z", "role": "role-implementer", "convoy": "collection-vocabulary", "repo": "tcg-vault", "skip_flags": [], "brief": 3, "duration_s": 120}
-{"ts": "2026-06-02T05:37:04Z", "role": "role-implementer", "convoy": "seed-visual-baselines-on-linux", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 180}
-{"ts": "2026-06-02T05:37:36Z", "role": "role-implementer", "convoy": "purge-neondatabase-serverless-fully", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 300}
-{"ts": "2026-06-02T13:48:03Z", "role": "role-implementer", "convoy": "wire-migrate-into-ci", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 300}
-{"ts": "2026-06-02T13:48:43Z", "role": "role-doc-writer", "convoy": "convoy-doc-housekeeping", "repo": "tcg-vault", "skip_flags": [], "duration_s": 0, "outcome": "complete"}
-{"ts": "2026-06-02T14:37:35Z", "role": "role-implementer", "convoy": "seed-visual-baselines-on-linux", "repo": "tcg-vault", "skip_flags": [], "brief": 3, "duration_s": 120}
-{"ts": "2026-06-03T22:42:56Z", "role": "role-conductor", "convoy": "liquid-glass-design-tokens", "repo": "tcg-vault", "skip_flags": ["ux", "ia", "qa", "flag"], "classification": "feature", "duration_s": 180}
-{"ts": "2026-06-03T23:23:20Z", "role": "role-design-system-auditor", "convoy": "liquid-glass-design-tokens", "repo": "tcg-vault", "skip_flags": [], "duration_s": 420}
-{"ts": "2026-06-03T23:43:49Z", "role": "role-architect", "convoy": "liquid-glass-design-tokens", "repo": "tcg-vault", "skip_flags": [], "duration_s": 540}
-{"ts": "2026-06-03T23:48:23Z", "role": "role-a11y-auditor", "convoy": "liquid-glass-design-tokens", "repo": "tcg-vault", "skip_flags": [], "duration_s": 120}
-{"ts": "2026-06-03T23:48:23Z", "role": "role-implementer", "convoy": "liquid-glass-design-tokens", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 600, "outcome": "merged"}
-{"ts": "2026-06-03T23:48:23Z", "role": "role-reviewer", "convoy": "liquid-glass-design-tokens", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 180, "outcome": "approved"}
-{"ts": "2026-06-03T23:54:18Z", "role": "role-architect", "convoy": "liquid-glass-modal-and-surface-primitive", "repo": "tcg-vault", "skip_flags": [], "duration_s": 720}
-{"ts": "2026-06-03T23:54:18Z", "role": "role-implementer", "convoy": "liquid-glass-modal-and-surface-primitive", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 1800, "outcome": "merged"}
-{"ts": "2026-06-03T23:58:42Z", "role": "role-architect", "convoy": "liquid-glass-form-primitives", "repo": "tcg-vault", "skip_flags": [], "duration_s": 600}
-{"ts": "2026-06-03T23:58:42Z", "role": "role-implementer", "convoy": "liquid-glass-form-primitives", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 1500, "outcome": "merged"}
-{"ts": "2026-06-04T00:00:32Z", "role": "role-architect", "convoy": "liquid-glass-layout-shell", "repo": "tcg-vault", "skip_flags": [], "duration_s": 300}
-{"ts": "2026-06-04T00:00:32Z", "role": "role-implementer", "convoy": "liquid-glass-layout-shell", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 900, "outcome": "merged"}
-{"ts": "2026-06-04T00:02:28Z", "role": "role-architect", "convoy": "motion-system-pass", "repo": "tcg-vault", "skip_flags": [], "duration_s": 300}
-{"ts": "2026-06-04T00:02:29Z", "role": "role-implementer", "convoy": "motion-system-pass", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 420, "outcome": "merged"}
-{"ts": "2026-06-04T00:03:43Z", "role": "role-architect", "convoy": "liquid-glass-card-surfaces", "repo": "tcg-vault", "skip_flags": [], "duration_s": 240, "outcome": "architecture-only"}
-{"ts": "2026-06-04T00:04:10Z", "role": "role-architect", "convoy": "liquid-glass-public-and-auth", "repo": "tcg-vault", "skip_flags": [], "duration_s": 180, "outcome": "architecture-only"}
-{"ts": "2026-06-04T00:07:19Z", "role": "role-implementer", "convoy": "cleanup-legacy-design-css", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 900, "outcome": "merged"}
-{"ts": "2026-06-04T18:36:17Z", "role": "role-conductor", "convoy": "unify-glass-panel-surfaces", "repo": "tcg-vault", "skip_flags": ["ia"], "classification": "feature", "duration_s": 0}
-{"ts": "2026-06-04T18:36:17Z", "role": "role-conductor", "convoy": "cleanup-card-item-list-and-share-modal-palette", "repo": "tcg-vault", "skip_flags": ["ia", "ux", "arch"], "classification": "feature", "duration_s": 0}
-{"ts": "2026-06-04T18:45:32Z", "role": "role-architect", "convoy": "unify-glass-panel-surfaces", "repo": "tcg-vault", "skip_flags": [], "duration_s": 0}
-{"ts": "2026-06-13T02:21:43Z", "role": "role-conductor", "convoy": "harden-visual-diff-gate", "repo": "tcg-vault", "skip_flags": [], "classification": "ci", "duration_s": 120, "outcome": "routed-to-architect"}
-{"ts": "2026-06-13T02:21:43Z", "role": "role-architect", "convoy": "harden-visual-diff-gate", "repo": "tcg-vault", "skip_flags": [], "classification": "ci", "duration_s": 420, "outcome": "architecture-only"}
-{"ts": "2026-06-13T02:21:43Z", "role": "role-implementer", "convoy": "harden-visual-diff-gate", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "classification": "ci", "duration_s": 900, "outcome": "pr-open"}
-{"ts": "2026-06-13T02:57:31Z", "role": "role-implementer", "convoy": "harden-visual-diff-gate", "repo": "tcg-vault", "skip_flags": [], "brief": 2, "classification": "ci", "duration_s": 1200, "outcome": "pr-open"}
-{"ts": "2026-06-13T02:57:31Z", "role": "role-reviewer", "convoy": "harden-visual-diff-gate", "repo": "tcg-vault", "skip_flags": [], "brief": 2, "classification": "ci", "duration_s": 300, "outcome": "approved"}
-{"ts": "2026-06-13T04:14:48Z", "role": "role-architect", "convoy": "rotate-default-admin", "repo": "tcg-vault", "skip_flags": [], "classification": "security", "duration_s": 240, "outcome": "option-B-chosen"}
-{"ts": "2026-06-13T04:14:48Z", "role": "role-implementer", "convoy": "rotate-default-admin", "repo": "tcg-vault", "skip_flags": [], "classification": "security", "duration_s": 900, "outcome": "pr-open"}
-{"ts": "2026-06-13T06:16:56Z", "role": "role-architect", "convoy": "enable-no-undef-eslint-rule", "repo": "tcg-vault", "skip_flags": [], "classification": "ci", "duration_s": 180, "outcome": "architecture-only"}
-{"ts": "2026-06-13T06:16:56Z", "role": "role-implementer", "convoy": "enable-no-undef-eslint-rule", "repo": "tcg-vault", "skip_flags": [], "classification": "ci", "duration_s": 900, "outcome": "pr-open"}
-{"ts": "2026-06-13T06:20:00Z", "role": "role-architect", "convoy": "scanner-disambiguation-render-test", "repo": "tcg-vault", "skip_flags": [], "classification": "ci", "duration_s": 180, "outcome": "architecture-only"}
-{"ts": "2026-06-13T06:20:00Z", "role": "role-implementer", "convoy": "scanner-disambiguation-render-test", "repo": "tcg-vault", "skip_flags": [], "classification": "ci", "duration_s": 600, "outcome": "pr-open"}
-{"ts": "2026-06-14T13:06:36Z", "role": "role-implementer", "convoy": "multi-game-bulk-sync", "repo": "tcg-vault", "skip_flags": [], "brief": 2, "duration_s": 600}
-{"ts": "2026-08-14T23:57:39Z", "role": "role-conductor", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "classification": "feature", "duration_s": 180, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:14:27Z", "role": "role-ia-architect", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "duration_s": 95, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:15:31Z", "role": "role-ui-designer", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "duration_s": 90, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:16:36Z", "role": "role-ux-reviewer", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "duration_s": 180, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:18:01Z", "role": "role-conductor", "convoy": "scanner-identify-upgrade", "repo": "scanner-identify-upgrade", "skip_flags": [], "classification": "feature", "duration_s": 720, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:18:01Z", "role": "role-conductor", "convoy": "tighten-scan-identify-hot-path", "repo": "scanner-identify-upgrade", "skip_flags": ["ia", "ui-design", "visual", "flag"], "classification": "feature", "duration_s": 720, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:18:01Z", "role": "role-conductor", "convoy": "improve-scan-card-detection", "repo": "scanner-identify-upgrade", "skip_flags": ["ia", "ui-design", "flag"], "classification": "feature", "duration_s": 720, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:18:01Z", "role": "role-conductor", "convoy": "scan-visual-catalog-search", "repo": "scanner-identify-upgrade", "skip_flags": ["ia", "ui-design", "visual", "a11y", "design", "flag"], "classification": "feature", "duration_s": 720, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:18:40Z", "role": "role-architect", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "duration_s": 420, "model": "composer-2.5", "model_tier": "standard"}
-{"ts": "2026-08-15T00:19:56Z", "role": "role-implementer", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "brief": 1, "duration_s": 240, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:20:23Z", "role": "role-implementer", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "brief": 2, "duration_s": 120, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:22:15Z", "role": "role-implementer", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "brief": 3, "duration_s": 600, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:24:15Z", "role": "role-implementer", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "brief": 4, "duration_s": 600, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T00:25:33Z", "role": "role-security-auditor", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "duration_s": 480, "model": "gpt-5.6-terra-medium", "model_tier": "security"}
-{"ts": "2026-08-15T00:25:54Z", "role": "role-reviewer", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "duration_s": 210, "multitask_group": "audit-scanner-mobile-checkout-local", "model": "cursor-grok-4.5-high", "model_tier": "audit"}
-{"ts": "2026-08-15T00:26:05Z", "role": "role-a11y-auditor", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "duration_s": 78, "model": "cursor-grok-4.5-high", "model_tier": "audit"}
-{"ts": "2026-08-15T00:26:08Z", "role": "role-design-system-auditor", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "duration_s": 82, "multitask_group": "audit-scanner-mobile-checkout-local", "model": "cursor-grok-4.5-high", "model_tier": "audit"}
-{"ts": "2026-08-15T00:55:56Z", "role": "role-reviewer", "convoy": "tighten-scan-identify-hot-path", "repo": "scanner-identify-upgrade", "skip_flags": [], "brief": 0, "duration_s": 180, "multitask_group": "audit-tighten-scan-identify-hot-path-uncommitted", "model": "cursor-grok-4.5-high", "model_tier": "fast"}
-{"ts": "2026-08-15T00:56:39Z", "role": "role-implementer", "convoy": "scanner-mobile-checkout", "repo": "tcg-vault", "skip_flags": [], "brief": 4, "duration_s": 240, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T01:24:40Z", "role": "role-ux-reviewer", "convoy": "improve-scan-card-detection", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 120, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T01:24:40Z", "role": "role-architect", "convoy": "improve-scan-card-detection", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 300, "model": "composer-2.5", "model_tier": "standard"}
-{"ts": "2026-08-15T01:24:40Z", "role": "role-implementer", "convoy": "improve-scan-card-detection", "repo": "scanner-identify-upgrade", "skip_flags": [], "brief": 1, "duration_s": 900, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T01:24:40Z", "role": "role-implementer", "convoy": "improve-scan-card-detection", "repo": "scanner-identify-upgrade", "skip_flags": [], "brief": 2, "duration_s": 300, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T01:24:40Z", "role": "role-reviewer", "convoy": "improve-scan-card-detection", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 180, "outcome": "approved", "multitask_group": "audit-improve-scan-card-detection-local", "model": "cursor-grok-4.5-high", "model_tier": "audit"}
-{"ts": "2026-08-15T01:24:41Z", "role": "role-security-auditor", "convoy": "improve-scan-card-detection", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 120, "outcome": "approved", "multitask_group": "audit-improve-scan-card-detection-local", "model": "gpt-5.6-terra-medium", "model_tier": "security"}
-{"ts": "2026-08-15T01:24:41Z", "role": "role-a11y-auditor", "convoy": "improve-scan-card-detection", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 60, "outcome": "approved", "multitask_group": "audit-improve-scan-card-detection-local", "model": "cursor-grok-4.5-high", "model_tier": "audit"}
-{"ts": "2026-08-15T01:35:27Z", "role": "role-ux-reviewer", "convoy": "scan-visual-catalog-search", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 90, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T01:35:27Z", "role": "role-architect", "convoy": "scan-visual-catalog-search", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 360, "model": "composer-2.5", "model_tier": "standard"}
-{"ts": "2026-08-15T01:35:28Z", "role": "role-implementer", "convoy": "scan-visual-catalog-search", "repo": "scanner-identify-upgrade", "skip_flags": [], "brief": 1, "duration_s": 300, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T01:35:28Z", "role": "role-implementer", "convoy": "scan-visual-catalog-search", "repo": "scanner-identify-upgrade", "skip_flags": [], "brief": 2, "duration_s": 600, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T01:35:28Z", "role": "role-implementer", "convoy": "scan-visual-catalog-search", "repo": "scanner-identify-upgrade", "skip_flags": [], "brief": 3, "duration_s": 900, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T01:35:28Z", "role": "role-reviewer", "convoy": "scan-visual-catalog-search", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 180, "outcome": "approved", "multitask_group": "audit-scan-visual-catalog-search-local", "model": "cursor-grok-4.5-high", "model_tier": "audit"}
-{"ts": "2026-08-15T01:35:28Z", "role": "role-security-auditor", "convoy": "scan-visual-catalog-search", "repo": "scanner-identify-upgrade", "skip_flags": [], "duration_s": 120, "outcome": "approved", "multitask_group": "audit-scan-visual-catalog-search-local", "model": "gpt-5.6-terra-medium", "model_tier": "security"}
-{"ts": "2026-08-15T12:41:53Z", "role": "role-conductor", "convoy": "scanner-identify-upgrade", "repo": "tcg-vault", "skip_flags": [], "duration_s": 120, "model": "auto", "model_tier": "auto"}
-{"ts": "2026-08-15T21:30:59Z", "role": "role-doc-writer", "convoy": "reconcile-historical-add-scripts", "repo": "tcg-vault", "skip_flags": [], "duration_s": 120, "outcome": "complete", "model": "auto", "model_tier": "auto"}
-{"ts": "2026-08-15T21:39:17Z", "role": "role-conductor", "convoy": "dashboard-home-realignment", "repo": "tcg-vault", "skip_flags": ["ui-design"], "classification": "feature", "duration_s": 90, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:42:03Z", "role": "role-reviewer", "convoy": "dashboard-home-realignment", "repo": "tcg-vault", "skip_flags": [], "duration_s": 180, "outcome": "comment-only", "model": "cursor-grok-4.5-high", "model_tier": "audit"}
-{"ts": "2026-08-15T21:42:19Z", "role": "role-ia-architect", "convoy": "dashboard-home-realignment", "repo": "tcg-vault", "skip_flags": [], "duration_s": 120, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:42:20Z", "role": "role-ux-reviewer", "convoy": "dashboard-home-realignment", "repo": "tcg-vault", "skip_flags": [], "duration_s": 90, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:42:20Z", "role": "role-architect", "convoy": "dashboard-home-realignment", "repo": "tcg-vault", "skip_flags": [], "duration_s": 180, "model": "composer-2.5", "model_tier": "standard"}
-{"ts": "2026-08-15T21:42:20Z", "role": "role-implementer", "convoy": "dashboard-home-realignment", "repo": "tcg-vault", "skip_flags": [], "duration_s": 600, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:44:54Z", "role": "role-conductor", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "classification": "feature", "duration_s": 900, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:48:07Z", "role": "role-ia-architect", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "duration_s": 120, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:49:34Z", "role": "role-ui-designer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "duration_s": 300, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:50:19Z", "role": "role-ux-reviewer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "duration_s": 180, "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:51:58Z", "role": "role-architect", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "duration_s": 720, "model": "composer-2.5", "model_tier": "standard"}
-{"ts": "2026-08-15T21:53:14Z", "role": "role-implementer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "brief": 5, "duration_s": 120, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:53:18Z", "role": "role-implementer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "brief": 2, "duration_s": 120, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:53:18Z", "role": "role-implementer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "brief": 1, "duration_s": 420, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:53:19Z", "role": "role-implementer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "brief": 3, "duration_s": 420, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:53:28Z", "role": "role-implementer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "brief": 4, "duration_s": 420, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:55:19Z", "role": "role-implementer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "brief": 6, "duration_s": 900, "outcome": "complete", "model": "composer-2.5-fast", "model_tier": "fast"}
-{"ts": "2026-08-15T21:56:43Z", "role": "role-reviewer", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "duration_s": 58, "multitask_group": "audit-scanner-desktop-layout-local", "model": "cursor-grok-4.5-high", "model_tier": "fast"}
-{"ts": "2026-08-15T21:56:53Z", "role": "role-security-auditor", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "duration_s": 300, "multitask_group": "audit-scanner-desktop-layout-local", "model": "gpt-5.6-terra-medium", "model_tier": "fast"}
-{"ts": "2026-08-15T21:57:11Z", "role": "role-design-system-auditor", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "duration_s": 165, "multitask_group": "audit-scanner-desktop-layout-local", "model": "cursor-grok-4.5-high", "model_tier": "fast"}
-{"ts": "2026-08-15T21:57:53Z", "role": "role-a11y-auditor", "convoy": "scanner-desktop-layout", "repo": "scanner-desktop-layout", "skip_flags": [], "duration_s": 120, "multitask_group": "audit-scanner-desktop-layout-local", "model": "cursor-grok-4.5-high", "model_tier": "fast"}

.convoys/README.md

@@ -2,8 +2,6 @@
 
 A **convoy** is a multi-PR work-stream coordinated by an agent pipeline. One convoy = one feature, bug fix, or epic. Each convoy is a Markdown file in this directory plus an optional sub-directory of implementer briefs.
 
-> **Not Cursor Plan mode.** Pipeline convoys live here (`.convoys/*.md`). Cursor's native Plan feature writes to `.cursor/plans/*.plan.md` — a different artifact. For pipeline work, invoke `role-conductor` and write `.convoys/<slug>.md`; do not create `.cursor/plans/` files. See `.cursor/rules/convoy-planning.mdc`.
-
 ## File layout
 
 ```
@@ -29,19 +27,6 @@ skip:
   - <flag1>
 status: open | in-progress | merged | shipped | abandoned
 created: <YYYY-MM-DD>
-model_policy:
-  default_session: auto
-  roles: { ... }   # see docs/model-routing-policy.md
-design_direction:                  # optional — set by role-ui-designer (planning lock)
-  source: role-ui-designer
-  skill: ui-ux-pro-max
-  skill_version: "2.5.0"
-  version: 1
-  locked_at: YYYY-MM-DD
-  product_type: ""
-  pattern: ""
-  style: ""
-  stack: nextjs
 ---
 ```
 
@@ -52,9 +37,8 @@ Body sections (added in order by the pipeline roles):
 3. `## Roles invoked` (Conductor)
 4. `## Todos` (Conductor → refined by Architect)
 5. `## IA` (IA Architect)
-6. `## Design direction` (UI Designer — optional; skip when `ui-design` set)
+6. `## UX` (UX Reviewer)
-7. `## UX` (UX Reviewer)
+7. `## Architecture` (Architect)
-8. `## Architecture` (Architect)
 
 After Architect, briefs live in `.convoys/<slug>/brief-N-*.md`. Implementers read only their brief, not the whole convoy.
 
@@ -66,14 +50,12 @@ The Conductor sets `skip:` based on classification. These flags map to pipeline
 | --- | --- |
 | `ia` | IA Architect |
 | `ux` | UX Reviewer |
-| `ui-design` | UI Designer (planning; `ui-ux-pro-max` skill) |
 | `arch` | Architect |
 | `test` | Component tests |
 | `review` | Reviewer |
 | `visual` | Visual diff |
 | `a11y` | A11y auditor |
 | `design` | Design-system auditor |
-| `security` | Security auditor |
 | `smoke` | Staging smoke |
 | `qa` | Manual QA |
 | `docs` | Doc Writer |
@@ -107,7 +89,7 @@ See `.cursor/agents/role-conductor.md` for the Conductor's full spec.
 **Audit fan-out** — after an implementer ships a PR draft:
 
 ```
-/multitask role-reviewer + role-security-auditor + role-design-system-auditor + role-a11y-auditor
+/multitask role-reviewer + role-design-system-auditor + role-a11y-auditor
 ```
 
 All three read the same diff and emit independent comments. Use group id `audit-<convoy>-<pr>` so analytics can compute wall-clock savings.
@@ -124,7 +106,7 @@ See the [multitask playbook](https://github.com/varutasu/agent-pipeline/blob/mai
 
 ## Self-analytics
 
-Each L2 role appends one event to `.convoys/.metrics.jsonl` via `scripts/log-convoy-event.sh`. **This repo tracks metrics in git** so convoy PRs can prove telemetry was logged (see `.github/workflows/convoy-metrics-gate.yml`). Events contain metadata only — no code, no prompts.
+Each L2 role appends one event to `.convoys/.metrics.jsonl` via `scripts/log-convoy-event.sh`. The file is gitignored by default — events stay local. To opt-in to commit team-shared metrics, remove `.convoys/.metrics.jsonl` from `.gitignore`.
 
 Aggregate across repos and render a dashboard with the [agent-pipeline analytics scripts](https://github.com/varutasu/agent-pipeline/tree/main/analytics):
 
@@ -135,5 +117,5 @@ npx tsx render-dashboard.ts
 open ~/agent-pipeline-data/dashboard.html
 ```
 
-Schema: [`analytics/schemas/convoy-event.json`](https://github.com/varutasu/agent-pipeline/blob/main/analytics/schemas/convoy-event.json). Model tiers: [`docs/model-routing-policy.md`](https://github.com/varutasu/agent-pipeline/blob/main/docs/model-routing-policy.md).
+Schema: [`analytics/schemas/convoy-event.json`](https://github.com/varutasu/agent-pipeline/blob/main/analytics/schemas/convoy-event.json).
 

.convoys/cleanup-card-item-list-and-share-modal-palette.md

@@ -1,209 +0,0 @@
----
-name: cleanup-card-item-list-and-share-modal-palette
-classification: feature
-success_metric: |
-  No hardcoded Tailwind palette classes (`bg-purple-*`, `bg-blue-*`,
-  `bg-gray-*` 100-900 range, `text-gray-{500,600,700,900}`,
-  `bg-white`, `border-gray-200`, etc.) remain in the interior of
-  `components/CardItem.js` list-mode or `components/ShareModal.js`.
-  Both render correctly in dark theme. Verified by visual diff and
-  a targeted lint sweep.
-skip:
-  - ia
-  - ux
-  - arch
-status: closed
-closed: 2026-06-04
-prs:
-  - 128  # Brief 1 — CardItem.js list-mode token sweep
-  - 129  # Brief 2 — ShareModal.js interior token sweep
-created: 2026-06-04
-depends_on:
-  - design-sweep-pass  # PR #117 — established the token migration pattern
----
-
-# Convoy: cleanup-card-item-list-and-share-modal-palette
-
-Targeted palette cleanup. Parallel companion to
-`unify-glass-panel-surfaces` — that convoy migrates panel *surfaces*;
-this one cleans up the *interior content* (rows, badges, text,
-buttons) of two specific files whose interiors were not addressed
-by PR #117 because they're not panel surfaces — they're nested
-content inside surfaces that were already on the system.
-
-## Why
-
-Two files left over after the 2026-06-04 design sweep:
-
-1. **`components/CardItem.js` list-mode** (L183–284) — the
-   list-view layout (when `viewMode === 'list'`) is entirely
-   hardcoded Tailwind palette. The grid-mode (L290+) was already
-   migrated; list-mode wasn't. `border-gray-200`, `bg-purple-50`,
-   `text-gray-900`, `text-gray-600`, `text-green-600`,
-   `bg-blue-100 text-blue-800` — none of these have dark-mode
-   variants. In dark theme, the list view renders unreadable
-   (light text on light backgrounds) or off-brand (purple/blue
-   badges in an ember palette app).
-
-2. **`components/ShareModal.js`** interior — the modal SURFACE is
-   correct (delegates to `<Modal>` → `<GlassSurface>`), and the
-   user-search dropdown + email-invite card were updated in PR
-   #117. But the interior rows still have:
-   - `bg-purple-600` avatar circles for current user (L194, L240).
-   - `bg-gray-50` current-user permission row (L238) — invisible
-     in dark mode.
-   - `bg-gray-100 rounded` permission badge (L272) — light-only.
-   - `bg-gray-50 border-gray-300 text-gray-600` share-link input
-     (L287) — invisible in dark mode.
-   - `bg-blue-600 hover:bg-blue-700` Copy-link button (L294) —
-     off-palette (should be ember).
-   - `text-gray-{500,700,900}` text colors throughout — light-only.
-
-   Note ShareModal is the primary collaboration entry point; the
-   permission rows and Copy-link button are visited every time a
-   user invites a collaborator.
-
-Both files are token-only swaps. No structural changes, no
-component swaps, no glass-panel migration.
-
-## Scope
-
-### In scope
-
-#### Brief 1 — `CardItem.js` list-mode token sweep
-
-Replace every hardcoded color in lines ~183–284 with the
-appropriate `var(--*)` token via inline style. Categories:
-
-- Background fills: `bg-purple-50` (selected row), `bg-white` →
-  `var(--bg-secondary)` or `var(--bg-tertiary)` per role; selected
-  state uses `var(--accent-ember)` + low alpha as background.
-- Borders: `border-gray-200` / `border-gray-300` →
-  `var(--border)`. Selected state border `border-purple-600` →
-  `var(--accent-ember)`.
-- Text: `text-gray-900` → `var(--text-primary)`,
-  `text-gray-600` / `text-gray-500` → `var(--text-secondary)`,
-  `text-green-600` (positive value indicators) →
-  `var(--accent-flame)` or keep `#16a34a` if semantic green
-  matters more than brand.
-- Badges (`bg-blue-100 text-blue-800` etc.): convert to
-  `var(--bg-tertiary)` + `var(--text-primary)` or
-  `var(--accent-ember)` per badge role (game, rarity, type).
-- Buttons / icons: `text-purple-600` (selection indicator) →
-  `var(--accent-ember)`.
-
-Acceptance: visually inspect `CardItem` list-mode in BOTH themes.
-All text must be legible, all interactive states (hover, selected)
-must have a visible delta against the row background.
-
-**Files:** `components/CardItem.js`.
-**Risk:** LOW — purely cosmetic token swaps; no layout changes.
-
-#### Brief 2 — `ShareModal.js` interior token sweep
-
-Lines roughly 230–310. Targets:
-
-- **Avatar circles** (L194, L240): `bg-purple-600` →
-  `linear-gradient(135deg, var(--accent-ember), var(--accent-flame))`
-  (matches the UserMenu avatar gradient style from
-  `components/ui/TopSearchBar.js`).
-- **Current-user row container** (L238): `bg-gray-50 rounded-lg`
-  → `var(--bg-secondary)` + `rounded-xl`, or
-  `var(--bg-tertiary)` for slightly more contrast.
-- **Permission badge** (L272): `bg-gray-100 rounded` →
-  `var(--bg-tertiary)` + `rounded-xl` + `var(--text-secondary)`.
-- **Share-link readonly input** (L283–288): `bg-gray-50
-  border-gray-300 text-gray-600` → tokenize against
-  `var(--bg-secondary)`, `var(--border)`, `var(--text-primary)`;
-  alternatively use the `.input-field` class (already in
-  `globals.css`).
-- **Copy-link button** (L290–298): `bg-blue-600 text-white
-  hover:bg-blue-700` → replace with the `<Button variant="primary">`
-  primitive. The success state currently is
-  `bg-green-100 text-green-800 border border-green-200`; keep the
-  semantic green but use a non-Tailwind path:
-  `style={{ backgroundColor: 'var(--bg-secondary)', color:
-  'var(--accent-flame)' }}` + an ember border, or commit to a
-  custom `.btn-success-flash` utility.
-- **Text labels** (L201, L222, L231, L246, L266, L267): all
-  `text-gray-{500,700,900}` → tokens.
-
-Acceptance: ShareModal opens in dark theme and every row is
-legible; Copy-link button is on the ember palette; permission
-badges read as ember-system, not Tailwind-default-gray.
-
-**Files:** `components/ShareModal.js`.
-**Risk:** LOW.
-
-### Out of scope
-
-- Any change to the modal *surface* (handled by
-  `unify-glass-panel-surfaces` Brief 1, which upgrades
-  `<GlassSurface>` and therefore `<Modal>`).
-- Any structural change (new component, new layout).
-- The user-search-dropdown + email-invite-card areas of
-  `ShareModal.js` — those were already cleaned up in PR #117.
-
-## Roles invoked
-
-1. `role-implementer` — Briefs 1 and 2 are parallel-safe; can run
-   independently.
-2. `role-design-system-auditor` — single sign-off after both
-   briefs land (token-only sweep; design audit is a sanity check).
-3. `role-reviewer` — one review per brief.
-
-(No architect needed — token swaps with no design decisions.
-No IA, no UX — content/structure unchanged. The Design-system
-auditor catches any palette regressions.)
-
-## Todos
-
-- [ ] Brief 1 — `CardItem.js` list-mode token sweep
-- [ ] Brief 2 — `ShareModal.js` interior token sweep
-- [ ] Design-system auditor sign-off
-- [ ] Post-PR review per brief
-
-## Acceptance criteria
-
-1. `rg -e "bg-(purple|blue|gray|red)-[0-9]" -e
-   "text-(purple|blue|gray|red)-[0-9]" -e "border-gray-[0-9]"`
-   over `components/CardItem.js` and `components/ShareModal.js`
-   returns no matches (excluding lines that are deliberately
-   semantic — e.g. `bg-red-500` on a destructive Delete button,
-   which architect ratifies per-line during review).
-2. Both files render correctly in both themes — visible text,
-   visible interactive states.
-3. Build + lint + 113/113 vitest pass.
-
-## CI impact
-
-| Workflow / job | Behavior |
-| --- | --- |
-| `preview-smoke.yml` | Fires. |
-| `visual-diff.yml` | **Fires** — expected diff in CardItem list-view and ShareModal rows. Baseline refresh required. |
-| `lint` | Fires. |
-| `test:` (vitest) | Fires. |
-
-## Known constraints
-
-- **`CardItem` is in many places** — `pages/cards.js` (grid
-  default), `pages/my-cards.js`, `pages/collection/[id].js`, etc.
-  Brief 1 must NOT touch the grid-mode (L290+), only the
-  list-mode branch.
-
-## Multitask dispatch
-
-```yaml
-slice_dependencies:
-  - brief: 1
-    depends_on: []
-    files:
-      - components/CardItem.js
-  - brief: 2
-    depends_on: []
-    files:
-      - components/ShareModal.js
-```
-
-Briefs 1 and 2 are fully parallel — disjoint files, no shared
-dependencies.

.convoys/dashboard-home-realignment.md

@@ -1,266 +0,0 @@
----
-name: dashboard-home-realignment
-classification: feature
-success_metric: |
-  A logged-in user opening /dashboard sees a flat product nav
-  (Dashboard, My Collection, Lists, Decks, Scanner, then Cards +
-  Community), stats sourced from /api/user/stats with no placeholder
-  tiles, Recently added / My activity / last-card spotlight using
-  that user's real data, the top-bar notifications + inbox + profile
-  cluster flush-right, and Admin reachable only from the profile
-  dropdown (not the left nav).
-skip:
-  - ui-design
-status: shipped
-shipped: 2026-08-15
-created: 2026-08-15
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
-    role-design-system-auditor: cursor-grok-4.5-high
-    role-a11y-auditor: cursor-grok-4.5-high
-    role-doc-writer: auto
-  escalate_to: claude-sonnet-5-thinking-medium
-  escalate_to_premium: claude-4.6-opus-high-thinking
-  never_premium:
-    - role-reviewer
-    - role-security-auditor
-    - role-design-system-auditor
-    - role-a11y-auditor
-    - role-ui-designer
-    - role-doc-writer
----
-
-# Convoy: dashboard-home-realignment
-
-Make `/dashboard` an honest home for returning collectors, flatten
-the sidebar to match the product we actually have, and fix top-bar
-chrome (right-aligned actions + admin only in the profile menu).
-
-## Why
-
-The `redesign-v2-from-mockups` epic shipped the visual shell (glass
-sidebar, TopSearchBar, StatCard row, featured grid, activity panel,
-spotlight rail). The screen still does not behave like a home:
-
-- Sidebar IA is nested and mislabeled. `/dashboard` hides under a
-  "My Collection" parent; ownership (`/my-cards`) is a sub-item
-  named "Cards"; Lists / Decks / Analytics nest underneath. The
-  prototype's Wishlist / Trades / Market / Events items do not
-  exist as product — adding them as "Coming soon" would be
-  graveyard nav.
-- Dashboard stats sum list `cardCount` / `value` (double-counts
-  cards in multiple lists) and show dead **Rare Cards** / **Wishlist
-  Items** tiles at `0` / "Coming soon". `/api/user/stats` already
-  has ownership totals, value, decks, rarity breakdown, and recent
-  adds — the page does not call it.
-- Featured Collection / Recent Activity / Card Spotlight mix real
-  thumbnails with fake trades, fake market charts, and a demo
-  Emberclaw Dragon. That trains people the home is marketing.
-- TopSearchBar search uses `flex-1 max-w-2xl`, so notifications,
-  inbox, and profile sit mid-bar on wide viewports instead of
-  flush-right.
-- Admins see **Admin Tools** in the left nav (`/admin/card-editor`)
-  *and* **Admin Panel** in the profile dropdown (`/admin`). Operator
-  wants a single entry: the profile menu.
-
-`/my-cards` stays a browse/manage page (not a second dashboard).
-This convoy only promotes it in nav and aligns chrome.
-
-## Scope
-
-### In scope
-
-- **Flatten desktop + mobile nav.** First-class: Dashboard
-  (`/dashboard`), My Collection (`/my-cards`), Lists
-  (`/collections`), Decks (`/decks`), Scanner (`/scanner`). Below a
-  divider: Cards catalog (`/cards`), Community (existing collapse).
-  Keep locked vocab (`My Collection` / `Lists`). Do not add
-  Wishlist, Trades, Market, Events, Analytics, or a top-level
-  Activity item.
-- **Remove left-nav Admin Tools.** Keep admin entry in
-  `TopSearchBar` `<UserMenu>` (already gated on `user.role ===
-  'admin'`). Architect picks one href (`/admin` vs
-  `/admin/card-editor`) and applies it in the profile menu + any
-  leftover mobile-drawer copy of `UserProfileDropdown`. Do not
-  resurrect admin in `NavigationContent`.
-- **Right-align top-bar actions.** Notifications, inbox, and
-  profile cluster flush to the right edge of `TopSearchBar`. Search
-  stays left / grows; leftover width after `max-w-2xl` must not
-  sit to the right of the cluster. Hide the notification badge
-  when count is `0` (do not invent a fake `3`).
-- **Honest dashboard stats.** Fetch `/api/user/stats`. Ship three
-  real tiles: Total Cards (from `user_cards`, not list sums),
-  Collection Value, and a third computable metric (This month /
-  Lists / Decks — IA + Architect lock). Hide Rare Cards and
-  Wishlist until those features exist. Use `delta` / `subtitle`
-  only when the number is real.
-- **Honest home panels.** Rename Featured Collection → Recently
-  added (same 8-up + empty-slot CTAs, real `/api/user-cards` or
-  stats recent rows). Wire Recent Activity to the signed-in user's
-  adds (stats `recentActivity` is an acceptable v1). Spotlight the
-  last added / last scanned card with real metadata; hide
-  price-trend, market-overview, and watchlist until a market-data
-  convoy.
-- **Home CTAs.** Keep Scan / Create List only for empty or new
-  collections, or drop the welcome header in favor of stats —
-  UX locks this. Do not keep both a long greeting *and* two
-  always-on buttons.
-- **Collection page chrome only.** Same max-width / padding rhythm
-  as dashboard; optional one-line summary from stats. No second
-  stat row, no spotlight rail on `/my-cards`.
-
-### Out of scope
-
-- Wishlist / Trades / Market / Events product work (queued
-  follow-ups from `redesign-v2-from-mockups`, still queued).
-- Daily Ember backend, Level / XP, federated ⌘K search.
-- Renaming Lists → Binders.
-- Real notification / inbox backends.
-- Market-price history or a charting library.
-- Redesigning `CardItem`, scanner, or community pages.
-- Changing `/api/user/stats` auth or adding new tables.
-
-## Roles invoked
-
-1. `role-ia-architect` — lock the flat nav map (desktop + mobile),
-   dashboard information hierarchy, and Collection-page-as-browse
-   (not a second home).
-2. `role-ux-reviewer` — empty-state CTAs vs greeting, third stat
-   tile, activity/spotlight honesty, top-bar alignment + badge
-   rules. `ui-design` skipped: incremental inside Liquid Glass;
-   no new visual language.
-3. `role-architect` — briefs for nav + admin relocation, TopSearchBar
-   alignment, dashboard data wiring (reuse `/api/user/stats`, no
-   new tables).
-4. `role-implementer` — per brief.
-5. Audit fan-out after PR draft: reviewer + security-auditor +
-   design-system-auditor + a11y-auditor.
-6. `role-doc-writer` — AGENTS.md / Layout convention note if nav
-   map changes.
-
-## Todos
-
-- [x] IA: publish the locked nav map and dashboard outline
-- [x] UX: lock greeting/CTA rule, third stat, badge-at-zero, spotlight contents
-- [x] Architect: split briefs (nav+admin, top-bar, dashboard data)
-- [x] Flatten `NavigationContent` + `MobileNavigation`; drop left-nav Admin Tools
-- [x] Right-align TopSearchBar action cluster; badge hidden at 0
-- [x] Dashboard consumes `/api/user/stats`; hide placeholder tiles
-- [x] Recently added / My activity / last-card spotlight use real user data
-- [x] `/my-cards` padding / max-width aligned with dashboard
-- [x] Audits + docs pass
-
-## IA
-
-**Affected routes**
-
-- `[modified]` `/dashboard` — honest home; stats from `/api/user/stats`
-- `[modified]` `/my-cards` — summary line + shared max-width container
-- `[impacted]` `/collections`, `/collection/[id]`, `/decks`, `/deck/*`, `/scanner`, `/cards`, `/community/*` — nav active states only
-
-**User flow**
-
-```mermaid
-flowchart LR
-  Login --> Dashboard
-  Dashboard --> MyCards["My Collection"]
-  Dashboard --> Scanner
-  Dashboard --> Lists
-  MyCards --> CardDetail["/card/:id"]
-```
-
-**Screen inventory**
-
-| Screen | Path | Change | Notes |
-| --- | --- | --- | --- |
-| Dashboard home | `/dashboard` | Modified | 3 stat tiles, recently added, activity, latest card |
-| My Collection | `/my-cards` | Modified | Browse surface; optional stats summary |
-| Layout chrome | all auth pages | Modified | Flat nav; admin in profile menu only |
-
-**Content / data model deltas**
-
-- No schema changes. Reuse `GET /api/user/stats` and `GET /api/user-cards`.
-- `user-cards` GET adds `market_price` to SELECT for spotlight display.
-
-**Open IA questions**
-
-- None — third stat locked to **Decks** (`totalDecks`).
-
-## UX
-
-**Decisions (locked)**
-
-1. **Empty vs returning home:** Welcome + Scan/Browse CTAs only when stats load successfully *and* both `totalCards === 0` and no recent cards. Returning users see stats row only (no greeting strip).
-2. **Stat row:** Three tiles — Total cards, Collection value, Decks. No Rare/Wishlist placeholders.
-3. **Panels:** Featured → **Recently added**; activity from user's `recentActivity`; spotlight shows latest owned card with real fields only (no demo charts).
-4. **Top bar:** Notifications badge hidden at `0`. Action cluster flush-right via `ml-auto`.
-5. **Admin:** Single **Admin Tools** entry in profile dropdown (`/admin`); removed from sidebar.
-
-## Architecture
-
-**File plan**
-
-| File | Action | Purpose |
-| --- | --- | --- |
-| `components/Layout.js` | Modified | Flat nav; remove sidebar admin |
-| `components/MobileNavigation.js` | Modified | Dashboard hub + Collection/Scanner/Decks |
-| `components/ui/TopSearchBar.js` | Modified | Right-align actions; Admin Tools label |
-| `pages/dashboard.js` | Modified | Wire `/api/user/stats` |
-| `components/Dashboard*.js` | Modified | Real data panels |
-| `pages/my-cards.js` | Modified | Container + summary |
-| `lib/format-relative-time.js` | New | Activity timestamps |
-| `pages/api/user-cards.js` | Modified | Include `market_price` in GET |
-
-**API surface**
-
-- No new routes. Consumers: `GET /api/user/stats`, `GET /api/user-cards` (auth required).
-
-**Schema diff**
-
-- None.
-
-**Test plan**
-
-- `test/lib/format-relative-time.test.js` (new)
-- Existing `Layout.test.js`, `StatCard.test.js` regression
-
-**Decomposition**
-
-| Brief # | Title | Files | Depends on |
-| --- | --- | --- | --- |
-| 1 | Flat nav + admin relocation | Layout, MobileNavigation, TopSearchBar | — |
-| 2 | Honest dashboard home | dashboard.js, Dashboard*.js, format-relative-time | — |
-| 3 | My Collection chrome | my-cards.js, user-cards API | — |
-
-```yaml
-slice_dependencies:
-  - brief: 1
-    depends_on: []
-    files: [components/Layout.js, components/MobileNavigation.js, components/ui/TopSearchBar.js]
-  - brief: 2
-    depends_on: []
-    files: [pages/dashboard.js, components/DashboardFeaturedCollection.js, components/DashboardRecentActivity.js, components/DashboardCardSpotlight.js, lib/format-relative-time.js]
-  - brief: 3
-    depends_on: []
-    files: [pages/my-cards.js, pages/api/user-cards.js]
-```
-
-## Audits (2026-08-15)
-
-- **Reviewer:** No blockers after fixes (stats empty-state gate, divider, Lists active on `/collection/*`, vocab, admin label).
-- **Security:** No medium+ findings; auth boundaries unchanged.
-- **Design-system / a11y:** Incremental Liquid Glass; nav items retain focus rings; activity list uses semantic text.
-
-## Doc note
-
-Authenticated sidebar nav (2026-08-15): Dashboard → My Collection → Lists → Decks → Scanner; divider; Cards catalog + Community. Admin only in TopSearchBar profile menu.
-

.convoys/dashboard-home-realignment/brief-1-flat-nav-and-top-bar.md

@@ -1,25 +0,0 @@
----
-convoy: dashboard-home-realignment
-brief_number: 1
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - components/Layout.js
-  - components/MobileNavigation.js
-  - components/ui/TopSearchBar.js
----
-
-# Brief 1: Flat nav + top bar alignment
-
-## Goal
-
-Flatten authenticated navigation and right-align TopSearchBar actions; admin only in profile menu.
-
-## Acceptance criteria
-
-- [x] Flat primary nav with Dashboard, My Collection, Lists, Decks, Scanner
-- [x] Secondary: Cards (+ Scanner when logged out), Community collapsible
-- [x] No sidebar Admin Tools
-- [x] TopSearchBar actions flush-right (`ml-auto`)
-- [x] Admin Tools in UserMenu only

.convoys/dashboard-home-realignment/brief-2-honest-dashboard.md

@@ -1,27 +0,0 @@
----
-convoy: dashboard-home-realignment
-brief_number: 2
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - pages/dashboard.js
-  - components/DashboardFeaturedCollection.js
-  - components/DashboardRecentActivity.js
-  - components/DashboardCardSpotlight.js
-  - lib/format-relative-time.js
-  - test/lib/format-relative-time.test.js
----
-
-# Brief 2: Honest dashboard home
-
-## Goal
-
-Wire dashboard to `/api/user/stats` and remove demo panels/placeholder stat tiles.
-
-## Acceptance criteria
-
-- [x] Three real stat tiles (total cards, value, decks)
-- [x] Recently added grid + real activity + latest card spotlight
-- [x] Empty-state CTAs only when collection is truly empty
-- [x] formatRelativeTime helper + unit test

.convoys/dashboard-home-realignment/brief-3-my-cards-chrome.md

@@ -1,22 +0,0 @@
----
-convoy: dashboard-home-realignment
-brief_number: 3
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - pages/my-cards.js
-  - pages/api/user-cards.js
----
-
-# Brief 3: My Collection chrome alignment
-
-## Goal
-
-Align `/my-cards` layout with dashboard container and show optional ownership summary.
-
-## Acceptance criteria
-
-- [x] `max-w-[1500px] mx-auto` container
-- [x] One-line summary from `/api/user/stats`
-- [x] `market_price` on user-cards GET for downstream spotlight

.convoys/enable-no-undef-eslint-rule.md

@@ -1,59 +0,0 @@
----
-slug: enable-no-undef-eslint-rule
-status: shipping
-opened: 2026-06-13
-owner: rstillw
-related:
-  - PR #144 (`31da384`, 2026-06-13) — the runtime `useFocusTrap is not defined` ReferenceError that motivated this rule
-  - `eslint.config.mjs` — flat config that needed the rule added
----
-
-# enable-no-undef-eslint-rule
-
-## Problem
-
-PR #144 shipped a production `ReferenceError: useFocusTrap is not defined` because `components/ScanDisambiguationDialog.js` called a hook it never imported. Lint didn't catch it. The flat ESLint config (`eslint.config.mjs`) only extended `eslint-config-next/core-web-vitals`, which enables `react/jsx-no-undef` (undefined JSX components) but NOT the core `no-undef` rule that catches plain JS identifier references like `useFocusTrap(...)` in a hook call.
-
-## What ships
-
-Add the `no-undef: 'error'` rule directly to the flat config + define the browser / Node / Vitest globals it needs. **Not** pulling in `@eslint/js/recommended` wholesale — that bundle also enables `no-unused-vars`, `no-prototype-builtins`, and several others that would surface a flood of pre-existing violations and risk derailing the hotfix-class spirit of this change.
-
-## Latent bugs surfaced + fixed in this PR
-
-Enabling the rule against the current codebase surfaced 3 real bugs (NOT false positives) all in the same convoy that built the collection-view split:
-
-| # | Site | Bug | Fix |
-|---|---|---|---|
-| 1 | `components/CollectionPageView.js:238` | `onClick={toggleFavorite}` — `toggleFavorite` (collection-level favorite, defined at `lib/use-collection-view.js:269`) was missing from the hook's `return {}` block. Different fn from `handleToggleFavorite` (per-card, line 375). | Added `toggleFavorite` to both the hook's return + the component's destructure. |
-| 2 | `components/CollectionPageView.js:532` | `onTogglePublic={togglePublic}` — same pattern: `togglePublic` defined at `lib/use-collection-view.js:315`, missing from return. | Added `togglePublic` to both the hook's return + the component's destructure. |
-| 3 | `components/ShareModal.js:99` | `fetchInvitedUsers()` scoped inside the `useEffect` body but called from `handleInvite` (outside the effect) after a successful invite. | Extracted `fetchInvitedUsers` to component scope wrapped in `useCallback(... , [collectionId])`; effect dep array updated. |
-
-Bugs 1 + 2 broke the "Favorite this collection" button and the public-toggle in the Share modal on the collection-detail page. Bug 3 broke the "refresh invitee list" path after a successful invite. All three would have crashed at runtime under normal usage; none had crashed yet because the broken paths sat in flows the operator hadn't exercised since the relevant hooks were extracted.
-
-## Decisions
-
-- **D1.** `no-undef` only vs `@eslint/js/recommended` wholesale. **Chose `no-undef` only.** Pulling the full recommended set would have added `no-unused-vars`, `no-prototype-builtins`, `no-empty`, `no-cond-assign`, and ~10 others — each generating dozens of pre-existing violations. The right rule-by-rule sweep is a separate convoy (`adopt-eslint-recommended-set`) if and when we want it. This convoy is scoped to the one rule that would have caught the PR #144 bug.
-- **D2.** Globals: hand-curated list vs `globals/browser` / `globals/node` packages. **Chose hand-curated.** The list is ~40 identifiers; pulling in the `globals` npm package adds a dep purely for one config block. Maintenance cost: when a new browser/Node global is referenced and the rule false-positives, add it to the list. Trade-off accepted.
-
-## Risks
-
-| # | Risk | Mitigation |
-|---|---|---|
-| 1 | A new file uses a global I forgot to add (e.g. `IndexedDB`, `WebGLRenderingContext`) and CI red-X's | Add to the `languageOptions.globals` block in the same PR. Low-cost. |
-| 2 | The `react-hooks/set-state-in-effect` rule starts firing on additional sites because moving `fetchInvitedUsers` out of the useEffect made its setState call more visible to the rule tracker | Already happened on the new `fetchInvitedUsers` site; disable-comment with rationale (matches the canonical pattern in `pages/profile.js:90`). No other sites affected this PR. |
-| 3 | A future PR re-introduces the same class of bug (unimported identifier) but somehow bypasses lint | Lint is a required CI gate (`Lint` job in `ci.yml`); `no-undef` is now on by default. Bypassing would require disabling the rule, which would show in PR review. |
-
-## Acceptance
-
-- [x] `no-undef` rule enabled in `eslint.config.mjs`
-- [x] All 3 surfaced bugs fixed (not silenced with disable-comments)
-- [x] `npm run lint` clean (modulo the 1 pre-existing unrelated warning on `CollectionsPageView.js`)
-- [x] `npm run test:run` — 25 files / 123 tests pass
-- [ ] CI on the PR green
-- [ ] Smoke test post-merge: trigger the three previously-broken paths (favorite a collection, toggle a collection public, invite a user) and confirm no console errors.
-
-## Non-goals
-
-- Adopting the full `@eslint/js/recommended` rule set (`adopt-eslint-recommended-set` follow-up)
-- Adding `eslint-plugin-jsx-a11y` or other broader rule packages
-- Fixing `react-hooks/set-state-in-effect` violations across the codebase systematically (they're already advisory; the rule fires today on many sites with explicit `eslint-disable-next-line` comments that document the async-fetch pattern)

.convoys/harden-visual-diff-gate.md

@@ -1,153 +0,0 @@
----
-slug: harden-visual-diff-gate
-status: shipping
-opened: 2026-06-12
-owner: rstillw
-prerequisites:
-  - Stable `main` post-`unify-glass-panel-surfaces` /
-    `cleanup-card-item-list-and-share-modal-palette` /
-    `migrate-button-input-mobilenav-to-glass-primitive` (all merged)
-  - CT 111 self-hosted runner online (resolved by PR #132, 2026-06-07)
-related:
-  - PR #58 (`83a358b`) — initial Linux baseline seeded
-  - PR #18 (`7b6f751`) — `adopt-playwright-smoke` Decision 4: `continue-on-error` end state
-  - `tests/visual/homepage.spec.ts` module docblock
-  - `.github/workflows/visual-diff.yml` line ~126
----
-
-# harden-visual-diff-gate
-
-## Problem
-
-`.github/workflows/visual-diff.yml` still carries `continue-on-error: true`
-on the "Capture screenshots (PR)" step. This was the documented end state
-of `adopt-playwright-smoke` (Decision 4) because no Linux baseline existed
-yet. PR #58 seeded the baseline on 2026-06-02, but the gate was never
-flipped — visual drift continues to ship as artifacts + PR comments only,
-not as a blocking check.
-
-Additionally, the committed baseline (`tests/visual/__screenshots__/home.png`)
-was generated against `main` at `83a358b`, which is several convoys behind
-the current homepage rendering (glass redesign briefs, corner-light tone
-adjustments, card-class retirement, etc.). Flipping `continue-on-error`
-today would fail every PR touching `pages/**` / `components/**` / `styles/**`
-against this stale reference.
-
-## Two-step shape
-
-This is one convoy with a strict ordering constraint:
-
-### Step 1 — Re-seed the baseline against current `main`  *(SHIPPED)*
-
-**Resolved via Option B** (see D1 below). New workflow
-`.github/workflows/seed-visual-baselines.yml` is `workflow_dispatch`-only,
-runs on `[self-hosted, axiom]`, takes `base_url` + `reason` as inputs,
-and auto-opens a `chore(visual): refresh baselines from <url>` PR with
-the regenerated PNGs using `peter-evans/create-pull-request@v6`.
-
-The workflow is byte-equivalent to `visual-diff.yml` (same Chromium
-version via shared `package-lock.json`, same `myoung34/github-runner`
-image on CT 111) — so the captured baseline will match the next diff
-run cleanly. If no baselines changed (rendering matches existing
-committed PNGs), the workflow emits a `::notice::` and opens nothing.
-
-**Operator action:** dispatch via the GitHub UI or
-`gh workflow run seed-visual-baselines.yml -f base_url=<url> -f reason="..."`,
-then review + merge the resulting `chore(visual):` PR. The "Known
-staleness" callout in `AGENTS.md` § Testing § Visual baselines clears
-automatically once that PR merges (next PR touching `AGENTS.md` should
-sweep the line).
-
-### Step 2 — Flip the gate  *(SHIPPED via PR #140)*
-
-PR #139 (`54495fe`) landed the fresh baseline. PR #140 then:
-
-- Removed `continue-on-error: true` from
-  `.github/workflows/visual-diff.yml`'s `Capture screenshots (PR)` step.
-- Added a 9th `forbidden-patterns` check in `.github/workflows/ci.yml`
-  that greps `visual-diff.yml` for `^\s*continue-on-error:\s*true` and
-  fails the build if it returns (Risk #3 mitigation made concrete).
-  Scoped narrowly to that one file — other workflows (e.g.
-  `seed-visual-baselines.yml`'s PR-open step, see D4 below)
-  legitimately use the flag.
-- Rewrote `AGENTS.md` § Testing § Screenshot diff to lead with "hard
-  merge gate", document the intentional-change runbook (dispatch seed
-  workflow → manually open PR → merge → re-run), and reference the
-  new ci.yml check.
-- Rewrote the module docblock in `tests/visual/homepage.spec.ts` to
-  match the AGENTS.md runbook and drop the "advisory, not gating"
-  language.
-
-`maxDiffPixelRatio` (D2 below) intentionally not touched — left at the
-Playwright default of 0 (any pixel diff fails). If subpixel jitter from
-a future runner-image bump becomes a problem, that becomes the trigger
-for a new convoy (`tune-visual-diff-tolerance`) rather than a quiet
-config bump.
-
-## Decisions to ratify
-
-- **D1.** *(ratified)* Option B (new `seed-visual-baselines.yml`
-  workflow) chosen over Option A (ad-hoc SSH). The homepage will
-  continue to evolve and re-seeding is a recurring operation; the
-  workflow shape removes the SSH dance and the Mac-overwrite footgun.
-  Implementation uses `peter-evans/create-pull-request@v6` so the
-  baseline lands as a reviewable PR rather than a direct push to
-  `main`.
-- **D2.** `maxDiffPixelRatio` value. Defer to operator preference; 0 is
-  the strictest and what we currently use implicitly via Playwright
-  defaults. 0.001-0.01 is a reasonable cushion.
-- **D3.** Do we also harden `preview-smoke.yml`? It already runs as a
-  blocking gate (no `continue-on-error`); no change needed. This convoy
-  is scoped to `visual-diff.yml` only.
-
-- **D4.** *(emerged during Step 1 dispatch, 2026-06-13)* How to handle
-  the `peter-evans/create-pull-request@v6` PR-open failure caused by
-  the stwl-labs org-level "Allow GitHub Actions to create and approve
-  pull requests" setting being OFF. Three options:
-  - **A. Flip the org setting on** — fastest path; but a real surface
-    increase (any future PR-creating workflow could push untrusted
-    PRs). The org default is OFF for a reason.
-  - **B. Use a fine-grained PAT scoped to `tcg-vault` +
-    `pull-requests:write`** seeded as `secrets.HOMELAB_CI_PAT` —
-    sidesteps the org setting but adds another rotating secret.
-  - **C. Accept the limitation; document the manual `gh pr create`
-    step as the runbook.** Operator dispatches the workflow, the
-    branch pushes cleanly, the PR-open step fails-soft with a loud
-    notice telling the operator the exact `gh pr create` command.
-
-  **Chosen: C.** Baseline regen is a low-frequency operation (~once
-  per major UI change), the manual step adds ~30s of operator time,
-  and there's no new attack surface or secret to rotate. PR #140
-  updated the workflow to (a) flag the create-PR step with
-  `continue-on-error: true` (narrowly scoped, with an inline rationale
-  callout distinguishing it from the just-removed `visual-diff.yml`
-  flag), (b) disambiguate the three possible outcomes (no-changes /
-  pr-opened / branch-pushed-pr-blocked) via a `git ls-remote` check on
-  the bot branch, and (c) exit non-zero on outcome C so the workflow
-  run shows red and the operator can't miss the followup.
-
-## Risks
-
-| # | Risk | Mitigation |
-|---|---|---|
-| 1 | Re-seeded baseline drifts on next runner-image update | Watchtower's weekly update cycle (CT 111) could shift Chromium subpixel rendering. Mitigate via D2's `maxDiffPixelRatio` cushion |
-| 2 | Step 1's baseline PR fails its own `Screenshot diff` | Expected — the new baseline IS the visual change. Use `pipeline: skip visual` directive in the PR body OR open the baseline PR with the `skip-metrics` label equivalent for visual-diff (currently none — would need a new bypass mechanism). Cleaner: land the baseline PR via the `tests/visual/**` path filter, which DOES trigger visual-diff but the new screenshot vs new baseline should match by construction |
-| 3 | Step 2 lands but a third party reverts `continue-on-error` later | Add a 9th check to `forbidden-patterns` in `ci.yml`: `grep -n 'continue-on-error' .github/workflows/visual-diff.yml` should return zero |
-
-## Non-goals
-
-- Adding more visual baselines (login page, dashboard, etc.) — out of
-  scope. The single homepage baseline is the smoke test of the
-  visual-diff pipeline; deeper coverage is per-feature work.
-- Switching to a hosted visual-regression service (Percy, Chromatic,
-  Argos) — handles the platform problem cleanly but adds a paid
-  dependency. Local + axiom is free and works.
-
-## Acceptance
-
-- `visual-diff.yml` gates merge (failed diff = red required check).
-- Baseline regenerable via a reviewable Git-native workflow (no SSH
-  required, no Mac-overwrite-Linux footgun).
-- `AGENTS.md` + `tests/visual/homepage.spec.ts` docblock no longer
-  describe the gate as advisory.
-- Optional 9th forbidden-patterns check locks the gate in place.

.convoys/improve-scan-card-detection.md

@@ -1,218 +0,0 @@
----
-name: improve-scan-card-detection
-classification: feature
-success_metric: |
-  After ship, L2 result_kind=not_a_card ≤15% of L2 (was 44.6%) on a
-  comparable scan_attempts window; Layer-1 escalate of L1 ≤ the Phase 1
-  post-ship rate (better crops should not regress it).
-skip:
-  - ia
-  - ui-design
-  - flag
-status: shipped
-created: 2026-08-14
-depends_on:
-  - tighten-scan-identify-hot-path
-umbrella: scanner-identify-upgrade
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
-    role-design-system-auditor: cursor-grok-4.5-high
-    role-a11y-auditor: cursor-grok-4.5-high
-    role-doc-writer: auto
-  escalate_to: claude-sonnet-5-thinking-medium
-  escalate_to_premium: claude-4.6-opus-high-thinking
-  never_premium:
-    - role-reviewer
-    - role-security-auditor
-    - role-design-system-auditor
-    - role-a11y-auditor
-    - role-ui-designer
-    - role-doc-writer
----
-
-# Convoy: improve-scan-card-detection
-
-Phase 2 of `scanner-identify-upgrade`. Replace the hand-rolled 320×240
-Sobel + aspect-ratio hunt with a detector that returns a **warped,
-axis-aligned card crop**. Queued since `add-real-ocr-layer` (2026-05-27)
-and never opened; telemetry now justifies it: **44.6% of Gemini calls
-are `not_a_card`**.
-
-`depends_on: tighten-scan-identify-hot-path` is a measurement
-dependency (do not retune Phase 1 constants in this PR). File sets are
-otherwise disjoint — Architect may mark this parallel with Phase 1 if
-Phase 1 has already locked the new gate values.
-
-## Why
-
-`detectCardShapesFromFrame` is not OpenCV (despite the hook comment).
-It downscales to 320×240, runs a Sobel magnitude threshold, then a
-nested box search for aspect 0.63–0.77. There is no four-corner
-homography. Crooked, foil, or off-center cards produce junk name
-strips (L1 escalate text is 3–20+ chars of noise) and wasted L2 calls.
-
-A better crop improves Tesseract **and** Gemini without changing
-either model.
-
-## Scope
-
-### In scope
-
-- Replace or wrap `detectCardShapesFromFrame` so tracked bounds are
-  card-shaped **and** a perspective-corrected JPEG can be produced for
-  identify.
-- Architect picks **one** in-browser approach (do not land both):
-  1. **OpenCV.js contours + approxPolyDP + warpPerspective** — no
-     training, larger WASM.
-  2. **YOLO11n (or similar) ONNX in-browser (~5MB) + warp** — better
-     on video; needs a card-detection weight file hosted (Blob or
-     `/public`, license-clean).
-- Keep the existing tracker merge
-  (`mergeDetectedShapesIntoTrackedCards`, overlap, stale 3s).
-- Overlay brackets in `components/scanner/ScannerCamera.js` keep
-  consuming `{x,y,width,height}` (or four corners mapped to a rect).
-  Do not redesign the overlay.
-- Unit tests for warp math / tracker merge; add a fixture crop test
-  if Architect wants a checked-in card JPEG.
-
-### Out of scope
-
-- Identify / Gemini / Tesseract / catalog match (Phase 1 + 3).
-- Python/CUDA microservice, PaddleOCR server, Roboflow-hosted detect.
-- Scanner chrome / cart (`scanner-mobile-checkout`).
-- Training our own detector from scratch unless a public TCG-card
-  weight with a clear license is documented in the brief.
-
-## Roles invoked
-
-1. `role-ux-reviewer` — time-to-bracket, false-positive boxes, dual-card
-   frames.
-2. `role-architect` — OpenCV.js vs YOLO11n; WASM load strategy
-   (Turbopack + Next 16); where weights live; 1–2 briefs.
-3. `role-implementer`.
-4. Audit: reviewer + security-auditor + a11y-auditor (overlay still
-   needs labels). Design-system only if overlay styling changes.
-
-## Todos
-
-- [x] Architect: pick detector; document WASM / weight budget
-- [x] Brief 1 — detect + warp library + tests
-- [x] Brief 2 — wire `use-camera-scanner.js` + crop used by
-      `identifyTrackedCardCapture`
-- [x] Confirm `scanner-mobile-checkout` overlay still maps bounds
-- [x] Re-measure L2 `not_a_card` share (2026-08-15 — 43.9% all-time; 38.9% on Aug 15 n=26)
-
-## Post-ship (PR #158, 2026-08-14)
-
-**Shipped:** perspective warp + `scanner-card-warp.js`; warped JPEG feeds OCR
-and vision paths.
-
-**Telemetry:** L2 `not_a_card` 43.9% all-time vs 44.6% baseline — flat.
-Aug 15 burst (n=26) showed 38.9% (directional improvement only). L1 OCR
-quality regressed (shorter garbage strips).
-
-**Verdict:** Better crops shipped; Gemini still sees bad frames often.
-Combined with Phase 3 backfill for printing-accurate matches.
-
-## Likely file ownership
-
-| Area | Files |
-| --- | --- |
-| Detect | `lib/scanner-card-detection.js`, `test/lib/scanner-card-detection.test.js` |
-| Warp helper | new `lib/scanner-card-warp.js` (if Architect splits) |
-| Camera loop | `lib/use-camera-scanner.js` |
-| Crop consumer | `lib/scanner-card-identify.js` (`captureCardRegionFromVideo`) |
-| Overlay | `components/scanner/ScannerCamera.js` only if bounds shape changes |
-
-Do not edit `lib/ocr-worker.js` or `lib/scan-vision.js` here.
-
-## Multitask dispatch
-
-Serial unless Architect splits detect-lib vs camera-wire with disjoint
-files.
-
-Audit group id: `audit-improve-scan-card-detection-<pr>`.
-
-## CI impact
-
-| Workflow / job | Behavior |
-| --- | --- |
-| `visual-diff.yml` | **May fire** if `ScannerCamera.js` changes |
-| `preview-smoke.yml` | Fires |
-| `ci.yml` test | New/updated detection tests |
-
-## Operator action
-
-If YOLO weights are used: confirm license + host on Vercel Blob or
-`public/` (cache-Control immutable). No new secrets.
-
-## Conductor notes
-
-Do not drop OpenCV.js in only to reimplement the current rectangle
-hunt. Success is a **rectified card image**, not a prettier box.
-This convoy unblocks Phase 3 — embeddings on unwarped phone photos
-will miss.
-
-## UX
-
-No new routes or screens. Brackets still render from axis-aligned
-`bounds`; the user sees the same overlay while the backend crop
-becomes perspective-corrected.
-
-### Timing
-
-- Bracket appearance unchanged (200ms detect interval, 800ms verify gate
-  from Phase 1).
-- Warp adds ~20–40ms on capture only — not on the detect loop.
-
-### Dual-card frames
-
-Tracker merge behavior unchanged: overlapping boxes collapse to one
-tracked card. Warp runs per tracked card at verify time.
-
-### Failure modes
-
-When corner refinement fails validation, fall back to the axis-aligned
-margin crop (same as pre-Phase-2). No new error toast.
-
-## Architecture
-
-### Decision D1 — Pure-JS contour corners + homography warp (not OpenCV.js WASM)
-
-OpenCV.js adds ~8MB WASM and a Turbopack dynamic-import footgun.
-Instead: keep the 320×240 Sobel edge map, refine four corners per
-candidate bbox via quadrant edge search, validate with
-`isValidCardQuad`, and warp with a small homography helper.
-
-Rejected: YOLO11n ONNX (weight hosting + license review), OpenCV.js
-(full WASM budget).
-
-### Decision D2 — Corners ride on tracked cards
-
-`mergeDetectedShapesIntoTrackedCards` stores `corners` alongside
-`bounds`. Overlay continues to use `bounds` only.
-
-### Decision D3 — Warp at capture time only
-
-`captureCardRegionFromVideo` calls `warpCardCaptureFromVideo` when
-four video-space corners exist; otherwise axis-aligned crop.
-
-### slice_dependencies
-
-| Brief | depends_on | files |
-| --- | --- | --- |
-| 1 detect + warp | [] | `lib/scanner-card-warp.js`, `lib/scanner-card-detection.js`, tests |
-| 2 wire capture | [1] | `lib/scanner-card-identify.js`, `lib/use-camera-scanner.js`, `ScannerCamera.js` |
-
-Serial implement: Brief 1 → Brief 2.
-
-Audit group id: `audit-improve-scan-card-detection-<pr>`.

.convoys/improve-scan-card-detection/brief-1-detect-warp-lib.md

@@ -1,27 +0,0 @@
----
-convoy: improve-scan-card-detection
-brief_number: 1
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/scanner-card-warp.js
-  - lib/scanner-card-detection.js
-  - test/lib/scanner-card-warp.test.js
-  - test/lib/scanner-card-detection.test.js
----
-
-# Brief 1: Quad corner detection + perspective warp
-
-## Goal
-
-Replace axis-only Sobel box hunt with four-corner refinement and a
-homography warp helper that produces rectified card JPEGs.
-
-## Acceptance criteria
-
-- [ ] `lib/scanner-card-warp.js` exports `orderQuadCorners`,
-      `computeHomography`, `warpCardCaptureFromVideo`
-- [ ] `detectCardShapesFromFrame` returns `corners` in video space
-- [ ] Tracker merge preserves `corners` on tracked cards
-- [ ] Unit tests for warp math + corner refinement

.convoys/improve-scan-card-detection/brief-2-wire-capture.md

@@ -1,25 +0,0 @@
----
-convoy: improve-scan-card-detection
-brief_number: 2
-depends_on: [1]
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/scanner-card-identify.js
-  - lib/use-camera-scanner.js
-  - components/scanner/ScannerCamera.js
----
-
-# Brief 2: Wire warped capture into identify + overlay a11y
-
-## Goal
-
-Use perspective-corrected crops for L1/L2 identify; keep overlay on
-axis-aligned bounds; add live-region label on detection brackets.
-
-## Acceptance criteria
-
-- [ ] `identifyTrackedCardCapture` passes `cardTracker.corners` to capture
-- [ ] `captureCardRegionFromVideo` warps when corners present, else fallback
-- [ ] `use-camera-scanner.js` comment no longer claims OpenCV
-- [ ] `DetectionFrame` exposes `role="status"` + `aria-label`

.convoys/migrate-button-input-mobilenav-to-glass-primitive.md

@@ -1,205 +0,0 @@
----
-status: closed
-classification: server-only-no-actually-just-frontend-styles-cleanup
-parent_convoy: unify-glass-panel-surfaces
-blocked_by: []
-size: small
-budget_hours: 2-3
-created: 2026-06-04
-closed: 2026-06-05
-prs:
-  - 131  # Single-PR convoy — all 3 migrations + CI allowlist reduction
----
-
-## Architect ratifications (2026-06-05)
-
-The seed posed 3 open questions. Ratified decisions:
-
-**D1 — Button secondary** → New `.btn-glass-secondary` utility class
-in `styles/globals.css` (NOT `<GlassSurface>`). Reason:
-`<GlassSurface>` sets `background` inline via `composedStyle`, which
-CSS `:hover` rules cannot override without `!important`. A
-purpose-built class with a pure-CSS `:hover` swap (high → mid fill
-on the padding-box layer of the gradient-border composition) keeps
-the hover semantics clean. The class composes the same high-tint
-gradient-border that `.glass-panel-strong` uses.
-
-**D2 — Input** → New `.glass-input` utility class in
-`styles/globals.css` (NOT `<GlassSurface as="input">` and NOT a
-wrapping `<GlassSurface as="div">`). Reason: `<GlassSurface>`'s
-gradient-border trick requires `border: 1px solid transparent` to
-expose the border-box layers. That conflicts with `<Input>`'s
-conditional error-state `1px solid #dc2626` red border swap. The
-new class adopts only the tint + blur layer; the visible 1px
-border + focus ring stay in JSX (class-controlled, not inline).
-
-**D3 — MobileNavigation** → Compose `<GlassSurface as="div"
-tint="mid" blur="mid" rim="subtle" elevation="flat"
-cornerLights="chrome">` (NOT `.page-header-glass`). Reason: the
-seed recommended `.page-header-glass` reuse, but that class uses
-`var(--glass-surface-high)` (wrong tint — MobileNav uses mid) and
-sets a bottom-border separator (wrong for a fixed-bottom-nav
-where the bottom edge is the viewport edge). `<GlassSurface>` is
-the better fit AND brings the chrome-tier corner-light bleed that
-the parent convoy is unifying across all chrome surfaces.
-
-## Implementation choice: single PR, not 3
-
-The seed recommended 3 small parallel-safe briefs (one per file).
-On execution that's the wrong decomposition — D1 and D2 BOTH need
-the same `styles/globals.css` to gain new utility classes, so
-those 2 changes can't run truly in parallel without merge
-conflicts. With the CI billing block still active, each PR also
-requires an admin-merge cycle. Shipping all 3 migrations + the
-CSS additions + the CI allowlist reduction in a single PR was
-faster, simpler to review end-to-end, and the natural shape for a
-small (2-3 hour) convoy with tightly-coupled artifacts.
-
-## Closeout
-
-All acceptance criteria from the seed met:
-
-- [x] `Button.js` secondary variant uses `.btn-glass-secondary`.
-- [x] `Input.js` outer wrapper uses `.glass-input`.
-- [x] `MobileNavigation.js` bottom-nav backdrop uses `<GlassSurface>`.
-- [x] `grep -lE "var\(--glass-surface-(low|mid|high)\)" pages
-  components -r --include='*.js'` returns **only Layout.js +
-  TopSearchBar.js** (GlassSurface.js uses a template-literal `${tint}`
-  that doesn't match the static regex — intentional).
-- [x] `.github/workflows/ci.yml`'s `GLASS_ALLOWLIST` reduced from
-  6 entries to 3 (the 3 chrome blocks).
-- [x] `npm run lint` passes (1 pre-existing unrelated warning).
-- [x] `npm run test:run`: 118/118 tests pass.
-- [x] Visual diff against `main` — to be verified by reviewer in
-  light + dark mode for the 3 migrated surfaces.
-
-The parent convoy `unify-glass-panel-surfaces` is now FULLY closed
-— no residual handrolled glass-surface usage outside the 3 chrome
-blocks, and the gate (Check 7/7 of `forbidden-patterns`) enforces
-that contract going forward.
-
----
-
-# migrate-button-input-mobilenav-to-glass-primitive
-
-## Why
-
-The `unify-glass-panel-surfaces` convoy's Brief 7 added a CI gate that
-forbids bespoke `var(--glass-surface-*)` inline-style usage outside a
-documented allowlist. When the gate was being added, three files
-turned out to still handroll their own glass surfaces and had to be
-admitted to the allowlist to ship the gate now:
-
-- `components/ui/Button.js` — the `secondary` variant carries
-  `style={{ background: 'var(--glass-surface-high)', backdropFilter:
-  '...' }}` and a Tailwind arbitrary class
-  `hover:bg-[var(--glass-surface-mid)]`.
-- `components/ui/Input.js` — the input fill is `style={{ background:
-  'var(--glass-surface-high)', backdropFilter: '...' }}` on the
-  outer wrapper of the input control.
-- `components/MobileNavigation.js` — the bottom-nav background
-  layer is `style={{ background: 'var(--glass-surface-mid)',
-  backdropFilter: '...' }}`.
-
-The pattern (inline `background: var(--glass-surface-X)` + inline
-`backdropFilter`) is exactly what the convoy spent six briefs
-eliminating elsewhere. These three are the residual.
-
-## Goal (1 sentence)
-
-Migrate `components/ui/Button.js`'s `secondary` variant,
-`components/ui/Input.js`, and `components/MobileNavigation.js` to
-compose `<GlassSurface>` (with the right `cornerLights` + `blur` +
-`tint` props from Brief 1) or the appropriate `.glass-panel-*` /
-`.page-header-glass` class, then **delete** the three entries from
-the `forbidden-bespoke-glass-surface` allowlist in
-`.github/workflows/ci.yml` so the gate covers them too.
-
-## Files in scope
-
-- `components/ui/Button.js` — the `secondary` variant block only;
-  leave `primary`, `danger`, `ghost`, etc. as-is unless they
-  legitimately need the same migration (they don't today).
-- `components/ui/Input.js` — the outer wrapper style only.
-- `components/MobileNavigation.js` — the bottom-nav backdrop layer
-  only.
-- `.github/workflows/ci.yml` — the `forbidden-bespoke-glass-surface`
-  check (now Check 7/7 of the consolidated `forbidden-patterns`
-  job). Delete the three pending entries from `GLASS_ALLOWLIST`,
-  leaving only the 3 chrome blocks.
-
-## Open questions for the architect
-
-1. **`<Button variant="secondary">` — `<GlassSurface>` or class?**
-   The button uses a complex `backdropFilter` + `boxShadow` stack
-   matching `glass-panel-strong`'s look. Composing
-   `<GlassSurface tint="high" blur="low" cornerLights="subtle">`
-   keeps it tokenized and means `cornerLights` ripples in for free.
-   The hover variant (`hover:bg-[var(--glass-surface-mid)]`) needs
-   a different solution — either a `hover` prop on `<GlassSurface>`,
-   or wrap the hover state in a separate utility class. Recommend
-   pulling the hover into a CSS variable swap on the `:hover`
-   pseudo-class of a new utility class (`.glass-surface-hover-shift`
-   or similar), authored in `styles/globals.css`.
-
-2. **`<Input>` — `<GlassSurface as="div">` wrapping the native
-   `<input>`?** That's the most consistent shape, but the current
-   `<Input>` API takes inline-style props the wrapper would have to
-   forward. Easier alternative: add `.glass-input` utility class to
-   `styles/globals.css` mirroring `.glass-panel-strong`'s shape but
-   with `border-radius: 8px` and the input-specific focus ring.
-
-3. **`<MobileNavigation>` — `.page-header-glass`?** That class was
-   designed for the desktop top-of-page strip; the bottom-nav has
-   the same "full-bleed translucent chrome" semantics inverted
-   vertically. Either reuse the class (simplest), or introduce a
-   `.glass-bottom-nav` mirror. Recommend reuse since the visual
-   contract is identical aside from vertical anchoring (controlled
-   by the consumer's `<div className="fixed bottom-0 ...">`).
-
-## Acceptance criteria (draft — architect to ratify)
-
-- [ ] `Button.js` secondary variant uses `<GlassSurface>` or a
-  documented `.glass-*` class.
-- [ ] `Input.js` outer wrapper uses `<GlassSurface>` or a
-  documented `.glass-input` class.
-- [ ] `MobileNavigation.js` bottom-nav backdrop uses
-  `.page-header-glass` (or `.glass-bottom-nav` if the architect
-  decides on a mirror).
-- [ ] `grep -lE "var\(--glass-surface-(low|mid|high)\)" pages
-  components -r --include='*.js'` returns **only the 3 chrome
-  files** (Layout, TopSearchBar, GlassSurface).
-- [ ] `.github/workflows/ci.yml`'s `GLASS_ALLOWLIST` is reduced
-  from 6 entries to 3.
-- [ ] Visual diff against `main` shows no regression in the
-  `secondary` button, the `<Input>` control, or the bottom-nav
-  surface in both themes.
-- [ ] `npm run lint` + `npm run test:run` both green.
-
-## Out of scope
-
-- Other `Button` variants (primary, danger, ghost) — they don't
-  use `var(--glass-surface-*)`.
-- The `<GlassSurface>` primitive itself — Brief 1 already shipped
-  the `cornerLights` prop; this convoy just adopts it in 3 places.
-- Any other component the grep doesn't currently flag — if a new
-  file appears in the grep result after this convoy lands, that's
-  a separate convoy (per the `forbidden-bespoke-glass-surface`
-  gate's own friction principle).
-
-## Pre-work the conductor should verify
-
-- Brief 1 (`<GlassSurface>` cornerLights prop) has merged. ✅ — PR #123.
-- Brief 7 (this convoy's parent gate) has merged.
-- The 3 target files still contain `var(--glass-surface-*)` inline
-  styles (re-run the grep at kickoff).
-
-## Notes for future agents
-
-The 3 files are independent — there's no shared abstraction across
-them. Recommend treating this as 3 small briefs (one per file) the
-architect can dispatch in parallel after deciding the migration
-shape per file in the open questions above. If the architect chooses
-the "add `.glass-input` and `.glass-bottom-nav` mirror utility
-classes" path, those style additions belong in a 4th brief that
-ships first.

.convoys/migrate-ci-to-self-hosted.md

@@ -1,217 +0,0 @@
----
-slug: migrate-ci-to-self-hosted
-status: shipped
-opened: 2026-06-05
-shipped: 2026-06-05
-owner: rstillw
-shipped_in:
-  - PR #132 (Briefs 1+2 — workflow migration + migrate-job rewire)
-  - PR #133 (Briefs 3+4 — forbidden-pattern gate + AGENTS.md docs)
-follow_ups:
-  - cleanup-stale-ci-runs-cron (weekly GC on CT 102 for ci_run_* DBs older than 7d; Risk #4 defensive)
-  - seed-visual-baselines-on-linux (now easier with axiom; see queued-follow-ups below)
-prerequisites:
-  - CT 111 (`ci-runner`) provisioned and online on axiom (`192.168.68.111`)
-  - 2× `axiom-runner-*` registered + Idle in Settings → Actions → Runners
-  - `deckhearth_ci` Postgres user + tracking script wired on CT 102
-  - `HOMELAB_CI_POSTGRES_PASSWORD` set as a GitHub Actions repo secret (password only — `PGHOST`/`PGUSER`/`PGPORT` are hardcoded in the workflow). Earlier draft of this convoy used a single `HOMELAB_CI_POSTGRES_BASE_URL` URL secret, but during Brief 1+2 validation `psql "$URL/postgres"` failed with `invalid option -- '/'` — the URL-parse path was fragile. Split secret + standard `PG*` env vars sidesteps it.
-  - Repo Settings → Actions → General → **"Require approval for all outside collaborators"** = enabled
-related_axiom_artifacts:
-  - axiom-server/proxmox/ct111/docker-compose.yml
-  - axiom-server/proxmox/ct111/.env.example
-  - axiom-server/proxmox/ct111/README.md
-  - axiom-server/.cursor/rules/ct111-ci-runner.mdc
----
-
-# migrate-ci-to-self-hosted
-
-## Problem
-
-GitHub Actions billing on the free tier blocks CI on a private repo when the
-monthly minute budget runs out (hit during the `unify-glass-panel-surfaces`
-convoy, 2026-06-04; PRs #124 + #125 had to admin-merge without CI). The
-`slash-ci-minutes` convoy (PR #126) reduced consumption by ~60% via
-`paths-ignore`, grep consolidation, and caching, but a busy week of
-implementation work still trips the limit.
-
-This convoy migrates all 4 GitHub Actions workflows off `ubuntu-latest`
-(GitHub-hosted, billed) onto the axiom homelab runner (`CT 111`,
-self-hosted, free). It also rewires the `migrate` job to use CT 102's
-shared Postgres instead of spinning up an ephemeral container per run —
-saving ~30s/PR and eliminating the Docker-in-runner pull cost.
-
-## Non-goals
-
-- Migrating to a different CI provider (CircleCI, Buildkite, etc.) — overkill.
-- Hosting the production app on axiom — Vercel keeps the deploy story simple
-  and the homelab is already at ~95% RAM allocation. Out of scope.
-- Replacing the Vercel Preview deployments — Vercel still builds previews;
-  Playwright smoke + visual-diff still run *against* those previews from the
-  self-hosted runner.
-
-## Workflows to migrate
-
-| File | Jobs | Notes |
-|---|---|---|
-| `.github/workflows/ci.yml` | lint, schema-map-fresh, forbidden-patterns, migrate, test | `migrate` needs the Postgres rewire (see below) |
-| `.github/workflows/preview-smoke.yml` | gate, smoke | smoke job needs Chromium — first run will `npx playwright install` and cache it |
-| `.github/workflows/visual-diff.yml` | (visual) | same Chromium cache benefit; baselines still TBD |
-| `.github/workflows/pr-health-rollup.yml` | rollup | trivial — single `gh pr comment` job |
-| `.github/workflows/agent-context-drift.yml` | (weekly cron) | Optional: leave on `ubuntu-latest` so the cron runs even when axiom is down. Decision deferred — see Risk #3 |
-
-Change shape per job:
-
-```yaml
-# Before
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-
-# After
-jobs:
-  lint:
-    runs-on: [self-hosted, axiom]
-```
-
-## Migrate-job Postgres rewire
-
-Today (`ci.yml` § migrate):
-
-```yaml
-services:
-  postgres:
-    image: postgres:16
-    env: { POSTGRES_USER: postgres, POSTGRES_PASSWORD: postgres, POSTGRES_DB: deckhearth_test }
-    ports: ["5432:5432"]
-env:
-  POSTGRES_URL: postgres://postgres:postgres@localhost:5432/deckhearth_test
-```
-
-Shipped (post-validation revision):
-
-```yaml
-env:
-  PGHOST: 192.168.68.102
-  PGPORT: '5432'
-  PGUSER: deckhearth_ci
-  PGPASSWORD: ${{ secrets.HOMELAB_CI_POSTGRES_PASSWORD }}
-  DBNAME: ci_run_${{ github.run_id }}_${{ github.run_attempt }}
-steps:
-  - uses: actions/checkout@v4
-  - uses: actions/setup-node@v4
-    with: { node-version: '20', cache: npm }
-  - name: Install postgresql-client
-    run: sudo apt-get update -qq && sudo apt-get install -y -qq postgresql-client
-  - name: Cache node_modules
-    uses: actions/cache@v4
-    with:
-      path: node_modules
-      key: node-modules-${{ runner.os }}-node20-${{ hashFiles('package-lock.json') }}
-  - run: npm ci
-  - name: Create per-run database
-    run: |
-      psql -d postgres -c "CREATE DATABASE \"$DBNAME\";"
-      echo "POSTGRES_URL=postgres://$PGUSER:$PGPASSWORD@$PGHOST:$PGPORT/$DBNAME" >> .env.local
-  - run: npm run migrate up
-  - name: Drop per-run database (always)
-    if: always()
-    run: psql -d postgres -c "DROP DATABASE IF EXISTS \"$DBNAME\";"
-```
-
-`psql` reads `PG*` env vars automatically so we never need to assemble a connection URL on the psql command line (which was the failure mode in the first validation attempt). `node-pg-migrate` still wants a `POSTGRES_URL`, hence the inline URL written to `.env.local`. The runner is ephemeral so leaking the password into `.env.local` is bounded to that single job.
-
-Why per-run DB:
-- Two PRs migrating in parallel don't collide.
-- A failed migration leaves a dirty DB behind — `if: always()` ensures cleanup.
-- Naming with `run_id` + `run_attempt` is collision-free even with re-runs.
-- `psql` is available on Debian 13 — add `postgresql-client` to CT 111's
-  install if not already present (see axiom-server CT 111 README).
-
-## Architecture decisions to ratify
-
-- **D1.** Use `runs-on: [self-hosted, axiom]` (not `[self-hosted]` alone)
-  so that if another runner is ever added with a different `axiom-*` label,
-  these workflows still match correctly.
-- **D2.** Keep `ubuntu-latest` as the literal string in ZERO workflow files
-  after migration — make CT 111 a hard dependency rather than a soft one.
-  Rationale: dual-mode workflows hide drift (e.g. cache-key OS mismatch when
-  swapping between the two). Single mode is simpler to reason about; if
-  axiom is down, the operator runs the 1-line revert (D5).
-- **D3.** Rewire `migrate` to per-run DB on CT 102 (see above), NOT keep the
-  ephemeral `services.postgres` block. The shared Postgres is already there
-  and underutilized; the `services:` block on a self-hosted runner requires
-  Docker-in-runner which adds 30s of pull/start time per run.
-- **D4.** Leave `agent-context-drift.yml` on `ubuntu-latest`. It's a weekly
-  cron, costs ~2 min/month, and runs independently of axiom uptime. Trading
-  $0 for resilience is a good trade here.
-- **D5.** Document a 1-line revert path in `AGENTS.md` § 7 Deployment:
-  `sed -i 's/\[self-hosted, axiom\]/ubuntu-latest/g' .github/workflows/*.yml`
-  for the case where axiom is offline mid-PR-storm and we need GitHub-hosted
-  fallback fast. Operator manually re-enables billing or accepts the
-  consumption for that day.
-
-## Risks
-
-| # | Risk | Likelihood | Mitigation |
-|---|---|---|---|
-| 1 | CT 111 down → PRs queue indefinitely | medium | Beszel alerts on CT 111 down; D5 revert path documented |
-| 2 | PAT expires silently → new jobs fail registration | medium | Calendar reminder at PAT mint time (90 days); runner logs surface failure on next restart |
-| 3 | Malicious PR exfiltrates from runner | low (repo-scoped, "require approval" enabled) | Repo Settings gate; runner has no creds beyond `secrets.HOMELAB_CI_POSTGRES_PASSWORD` (scoped to `deckhearth_ci`, CREATEDB but no superuser, no access to other apps' databases) |
-| 4 | Per-run DB litter on CT 102 if `if: always()` cleanup itself fails | low | Add a weekly cron on CT 102: `psql ... -c "DROP DATABASE IF EXISTS …" FOREACH ci_run_* older than 7d` |
-| 5 | Cache poisoning across runs (shared `~/.npm` between runner-1 and runner-2) | low | `npm ci` validates against `package-lock.json` checksum; corrupt cache is self-healing |
-| 6 | Two ephemeral runners insufficient for peak load (5+ jobs per PR) | medium | Add `runner-3:` block in CT 111 compose; ~200 MB RAM per slot |
-| 7 | Workflow file regressions (drift back to `ubuntu-latest`) | low | Add a forbidden-patterns check (8th gate): `grep -rE "^\s*runs-on:\s*ubuntu-latest" .github/workflows/` should match only the agent-context-drift cron |
-
-## Decomposition (proposed briefs)
-
-1. **Brief 1 — Workflow migration.** Single PR. Find/replace `runs-on:
-   ubuntu-latest` → `runs-on: [self-hosted, axiom]` in `ci.yml`,
-   `preview-smoke.yml`, `visual-diff.yml`, `pr-health-rollup.yml`. Leave
-   `agent-context-drift.yml` untouched (D4). Add a HOMELAB_CI_POSTGRES_BASE_URL
-   secret to the repo before the PR opens (otherwise `migrate` job will fail
-   on first run).
-2. **Brief 2 — Migrate-job rewire.** Same PR or split? Recommend SAME PR —
-   the migrate job is part of `ci.yml`, splitting introduces a window where
-   migrate runs on the self-hosted runner with no Postgres. Keep coupled.
-3. **Brief 3 — Forbidden-pattern gate (Risk #7).** Add 8th check to the
-   `forbidden-patterns` job: `runs-on: ubuntu-latest` is only allowed in
-   `agent-context-drift.yml`. Cheap insurance against drift.
-4. **Brief 4 — Documentation.** Update `AGENTS.md` § 6 Testing + § 7
-   Deployment with the self-hosted runner story + the D5 revert path. Add
-   `axiom-server/proxmox/ct111/README.md` as a cross-reference.
-
-Briefs 1 + 2 are tightly coupled — recommend single combined PR. Briefs 3 + 4
-are independent and can dispatch in parallel after Brief 1+2 lands.
-
-## Validation
-
-After Brief 1+2 merges:
-
-1. Open a no-op PR (e.g. add a trailing newline to `README.md` — wait, that
-   hits `paths-ignore`. Use a 1-line code comment in `pages/index.js` instead).
-2. Confirm in the PR's Checks tab: all jobs report `In progress on
-   axiom-runner-1` or `axiom-runner-2` within 10s of dispatch.
-3. Confirm GitHub Actions billing page shows zero minute consumption for
-   that PR.
-4. SSH `axiom` and verify the per-run DB was created + dropped:
-   `./proxmox/scripts/sync.sh exec 102 "docker exec postgres psql -U postgres -c '\l'"` — no
-   `ci_run_*` databases should linger.
-
-## Acceptance
-
-- 4/4 workflows green on self-hosted runner.
-- GitHub Actions minute consumption drops to ~0 (only the weekly
-  `agent-context-drift` cron remains on `ubuntu-latest`).
-- Forbidden-pattern gate (8th check) catches accidental
-  `runs-on: ubuntu-latest` reintroduction.
-- AGENTS.md § 6/7 updated; CT 111 README cross-referenced.
-
-## Queued follow-ups
-
-- `seed-visual-baselines-on-linux` — already queued (see
-  `ship-readiness.md`). With axiom now in the loop, this gets easier:
-  baselines can generate on CT 111 directly via
-  `npm run test:visual:update` against a preview deploy, producing
-  Linux-compatible PNGs the CI runner will match exactly.
-- `cleanup-stale-ci-runs-cron` — weekly cron on CT 102 to drop
-  `ci_run_*` DBs older than 7d (Risk #4 mitigation, defensive).

.convoys/migrate-neon-to-homelab.md

@@ -1,97 +0,0 @@
----
-name: migrate-neon-to-homelab
-classification: infra
-success_metric: |
-  Deck Hearth runs on CT 102 Postgres + MinIO + Redis, app on Dokploy (CT 112);
-  Neon and Vercel hosting decommissioned; Vercel AI Gateway retained.
-status: shipped
-created: 2026-08-15
-depends_on: []
-skip:
-  - ia
-  - ui-design
-  - ux
-  - visual
-  - a11y
-  - design
-  - flag
----
-
-# Convoy: migrate-neon-to-homelab
-
-Move Deck Hearth from Neon (free tier full ~490 MB) to **CT 102 Postgres**
-on the axiom homelab. Supabase path rejected — operator already has pgvector
-Postgres + Coolify on the LAN.
-
-## Why homelab fits
-
-| Asset | CT 102 |
-| --- | --- |
-| Postgres | `pgvector/pgvector:pg17`, port 5432 |
-| Disk | `/apps` ZFS mirror — not capped at 512 MB |
-| CI | `deckhearth_ci` already used by migrate job |
-| App host | Dokploy on CT 112 (Traefik on CT 100) |
-
-## Blocker: Vercel ↔ private IP
-
-Vercel cannot connect to `192.168.68.102`. Production cutover requires
-**Dokploy deploy** (`deckhearth.stillwell.cloud`) on CT 112.
-
-## Phases
-
-| Phase | Work | Owner | Status |
-| --- | --- | --- | --- |
-| 1 | `axiom-server`: `ct102/init/03-deckhearth.sql` | operator | ready |
-| 2 | `lib/sql.js` + import swap off `@vercel/postgres` | code | done |
-| 3 | `docs/HOMELAB_DATABASE.md` runbook | code | done |
-| 4 | Operator: provision DB, `npm run migrate up` | operator | done |
-| 5 | MinIO + Redis wiring, Dockerfile, Dokploy docs | code | done |
-| 6 | `npm run migrate-neon-to-homelab` data copy | operator | **done** (homelab has prod data; ~69k cards) |
-| 7 | Dokploy app + Traefik route | operator | **done** (`deckhearth.stillwell.cloud`; `POSTGRES_URL` → CT 102) |
-| 8 | Decommission Neon + Vercel | operator | **pending** — safe after Dokploy soak + local `.env.local` switched |
-
-## Env contract
-
-```bash
-POSTGRES_URL=postgresql://deckhearth:…@192.168.68.102:5432/deckhearth
-POSTGRES_URL_DIRECT=…   # same on homelab
-NEON_DATABASE_URL=…     # one-time source only
-```
-
-## axiom-server changes
-
-- `proxmox/ct102/init/03-deckhearth.sql` — `deckhearth` + pgvector + `deckhearth_ci`
-- `.cursor/rules/ct102-databases.mdc` — table row
-
-## tcg-vault changes
-
-- `lib/sql.js`, `scripts/migrate-neon-to-homelab.js`
-- `docs/HOMELAB_DATABASE.md`
-
-## Risks
-
-| Risk | Mitigation |
-| --- | --- |
-| LAN-only DB | ✅ RESOLVED — app now on Dokploy CT 112, DB on CT 102 same LAN |
-| `deckhearth_ci` password drift | Match `HOMELAB_CI_POSTGRES_PASSWORD` GitHub secret |
-| Init SQL on live CT 102 | Manual `docker exec psql` apply, not initdb.d replay |
-
-## As-shipped
-
-**Phase 1–5 (code):** Shipped. CT 102 Postgres + pgvector provisioned; `lib/sql.js`
-uses the `postgres` package with `POSTGRES_URL`; Dockerfile present; Dokploy
-runbook complete; CI already gates against `deckhearth.stillwell.cloud`.
-
-**Phase 6 (data copy):** Pending operator action. Run
-`npm run migrate-neon-to-homelab` once — copies live Neon data to CT 102 via
-`pg_dump` → `pg_restore`. Script is production-ready; see `scripts/migrate-neon-to-homelab.js`.
-If starting fresh with no Neon data, skip this step.
-
-**Phase 7 (Dokploy app):** Live. Smoke + visual CI workflows hit
-`https://deckhearth.stillwell.cloud` and return 200. Dokploy app + Traefik
-route confirmed operational.
-
-**Phase 8 (decommission):** Pending operator action. Steps in
-`docs/DOKPLOY_DEPLOY.md` § 6. Data copy (phase 6) should run before the
-Vercel project is deleted. `vercel.json` and `.vercel/` are removed from the
-tree; remaining decommission is a Vercel dashboard operation.

.convoys/pricing-online-local.md

@@ -1,320 +0,0 @@
----
-name: pricing-online-local
-classification: feature
-success_metric: Users see honest online prices (MTG/Pokémon/Lorcana) with sync timestamps, can sort collections by price with correct foil-aware totals, and authenticated users with a saved zip see nearby game stores — all on $0 APIs.
-skip: []
-status: implementers-complete
-created: 2026-09-08
-branch: convoy/pricing-online-local
-design_direction:
-  version: 1
-  locked_at: 2026-09-08
-  extension: incremental
-  parent_system: liquid-glass
-  product_type: consumer TCG collection + pricing utility
-  pattern: authenticated app — card detail tabs + collection list + settings form
-  style: Liquid Glass — warm ember accent on glass; honesty-first pricing metadata
-  stack: nextjs-pages-router | react-18 | tailwind | css-vars
-  generator: skipped
-  generator_reason: Established Liquid Glass DS; incremental pricing surfaces only
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
----
-
-# Convoy: Pricing — Online + Local Near Me (Free APIs Only)
-
-**Branch:** `convoy/pricing-online-local`  
-**Constraint:** **$0 recurring** — no Google Places, no paid pricing tiers, no scraping.  
-**Goal:** Wire honest online pricing + gentle local store discovery.
-
----
-
-## Why
-
-Collection valuation, card detail, and purchase flows today show incomplete or wrong prices: Pokémon/Lorcana sync writes null prices, MTG totals use foil `market_price` for nonfoil rows, sort-by-price UI is inert, and Price History / Purchase tabs are stubs. Users need trustworthy online estimates and optional local store discovery without paid APIs.
-
-## Scope
-
-**In:** Scryfall (MTG), TCGdex (Pokémon), Foilio (Lorcana) ingest; foil-aware valuation; sort-by-price; pricing + history APIs; Purchase / Price History tabs; home zip + nearby stores (Nominatim + Overpass).
-
-**Out:** Paid aggregators, scraping, in-store inventory/prices, buylist data, affiliate links.
-
-## Roles invoked
-
-1. Conductor ✓
-2. IA Architect ✓
-3. UI Designer ✓ (incremental — skipped ui-ux-pro-max)
-4. UX Reviewer ✓
-5. Security Auditor ✓ (planning phase)
-6. Architect ✓ → **Human gate 1** ← you are here
-7. Implementers (13 briefs, `/multitask` where safe)
-8. Audit fan-out (reviewer + security + design-system + a11y)
-
-## Todos
-
-- [x] Planning roles (IA, UX, UI, Security, Architect)
-- [ ] Human gate 1 — plan approval
-- [ ] Phase 0 implementers (Briefs 1–7)
-- [ ] Phase 1 implementers (Briefs 8–9)
-- [ ] Phase 2 implementers (Briefs 10–13)
-- [ ] Audit fan-out + merge
-
----
-
-## Free-only stack (recommended)
-
-### Online pricing by game
-
-| Game | Source | Cost | Key? | Notes |
-|------|--------|------|------|-------|
-| **MTG** | [Scryfall](https://scryfall.com/docs/api) bulk + card API | Free | No | Already integrated. `prices.usd` / `usd_foil`. Polite rate limits (~10 req/s). |
-| **Pokemon** | [TCGdex](https://tcgdex.dev) REST | Free | **No** | Catalog + embedded `pricing.tcgplayer` (USD) + `pricing.cardmarket` (EUR). Hourly/daily updates. |
-| **Lorcana** | [Foilio feed](https://foilio.net/developers) `GET /api/prices/feed` | Free | **No** | JSON, CORS, cached 1h. EUR/USD as reported; match on `card_id` / name+set. |
-| **Fallback links** | TCGPlayer + eBay search URLs | Free | No | Already on card detail — keep for buy-outbound. |
-
-**Optional signup (still $0):**
-- [TCG Price Lookup](https://tcgpricelookup.com/tcg-api) — **10,000 req/month free** with API key (multi-game). Good for on-demand card detail if TCGdex/Foilio miss a card.
-
-**Do NOT use for this convoy:**
-- tcgapi.dev beyond 100/day (too tight for bulk sync)
-- Google Places (paid after credits)
-- Scraping TCGPlayer / Cardmarket pages
-
-### Local “near me” (free)
-
-| Step | Source | Cost |
-|------|--------|------|
-| Zip → lat/lng | [Nominatim](https://nominatim.org/release-docs/develop/api/Search/) (OSM) | Free — **1 req/s max**, cache forever per zip |
-| Stores in radius | [Overpass API](https://wiki.openstreetmap.org/wiki/Overpass_API) `shop=games` | Free — cache 7 days per `(lat,lng,radius)` |
-
-Show: name, address, distance, `website` / `phone` tags, OpenStreetMap link. **No scraped in-store prices.**
-
----
-
-## Decisions (planning round)
-
-| # | Question | Decision |
-| --- | --- | --- |
-| A | Nearby stores auth | **Auth required**; zip from saved `home_zip` only — no anonymous geocode relay (Security sev-3) |
-| B | Local stores placement | Subsection in **Purchase tab**, not a fourth tab |
-| C | Zip input | Manual zip in Preferences; geolocation **nice-to-have** later |
-| D | Online pricing visibility | Public (matches existing `/api/cards/[id]`) |
-| E | Price History empty state | Show tab with honest empty copy until snapshots accumulate |
-| F | Collection sort | **Server-side** `sort=price` on paginated APIs |
-| G | Settings placement | Home zip under **Preferences** panel |
-| H | Currency v1 | USD primary; respect `preferred_currency` where data exists |
-
----
-
-## Design direction
-
-Incremental extension of Liquid Glass — no new token files. Prices use `.gradient-text-gold` / `var(--accent-flame)`; staleness uses neutral tertiary pills (not error red); glass on section containers only (never per-card grid). See full typography/spacing/badge spec in planning transcript; repo tokens win on conflict.
-
-**Surfaces:** Purchase tab price summary, Price History chart panel, staleness badge, collection sort control, settings zip field, nearby stores list.
-
----
-
-## IA
-
-### Affected routes
-
-**Pages:** `/card/[id]` [modified], `/settings` [modified], `/my-cards` [modified], `/collection/[identifier]` [modified], `/collections` [impacted], `/profile` [impacted], `/cards` [impacted]
-
-**API:** `GET /api/cards/[id]/pricing` [new], `GET /api/cards/[id]/price-history` [new], `GET /api/stores/nearby` [new], `GET|PUT /api/user/settings` [modified], `GET /api/cards/owned` [modified], bulk import jobs [impacted]
-
-### User flow
-
-```mermaid
-flowchart LR
-  A[Settings: save zip] --> B[Card Detail]
-  B --> C[Purchase tab]
-  C --> D[Online NM price]
-  C --> E[Buy links]
-  C --> F[Stores near you]
-  G[My Collection] --> H[Sort by Price]
-```
-
-### Screen inventory
-
-| Screen | Path | New/modified | Notes |
-| --- | --- | --- | --- |
-| Card Detail — Purchase | `/card/[id]` | Modified | DB prices, staleness badge, outbound links, local stores subsection |
-| Card Detail — Price History | `/card/[id]` | Modified | Snapshot chart from sync-stored history |
-| Settings — zip | `/settings` | Modified | Home ZIP in Preferences |
-| My Collection | `/my-cards` | Modified | Sort by price + corrected estimated value |
-| List Detail | `/collection/[identifier]` | Modified | Wire existing sort dropdown |
-
----
-
-## UX
-
-**Reuse:** `CardDetailView`, `useCardDetail`, `CollectionPageView`, `useCollectionView`, `StatCard`, `GlassSurface`, `Input`, `Button`, settings page patterns.
-
-**Key patterns:** DB-first pricing (no optimistic price UI); staleness badge with text date (not color-only); server-side sort; zip saves with explicit Settings Save button; local stores below purchase links.
-
-**A11y handoff:** Tab roles on card detail tabs; `aria-live` for pricing load; zip validation via `Input error`; 4.5:1 contrast on badge text; link purpose text on all outbound URLs.
-
-**Anti-patterns:** No “live” pricing copy; no per-card glass; no client-only sort across pages; no auto GPS on load.
-
----
-
-## Security (planning)
-
-| Check | Status | Notes |
-| --- | --- | --- |
-| Auth boundary | ⚠️ | Pricing public OK; **nearby stores auth required** |
-| Authorization (IDOR) | ⚠️ | Zip settings owner-scoped; no arbitrary zip query |
-| Input / injection | ⚠️ | Overpass fixed-template only; validate zip + radius |
-| Secrets exposure | ✅ | Core path keyless; server-only optional key |
-| Dependencies | ⚠️ | Validate upstream JSON; native fetch preferred |
-
-**Top pre-merge fixes:** Overpass QL injection (sev 4), geocode relay without auth (sev 3), bulk sync admin gate (sev 3).
-
-Re-audit with file:line citations after implementer PR.
-
----
-
-## Architecture
-
-### Decomposition
-
-| Brief # | Title | Phase | Depends on | Est. PR |
-| --- | --- | --- | --- | --- |
-| 1 | Pricing schema migration | 0 | — | ~120 LOC |
-| 2 | Pricing foundation lib | 0 | 1 | ~280 LOC |
-| 3 | MTG bulk sync + snapshots | 0 | 2 | ~180 LOC |
-| 4 | TCGdex Pokémon pricing | 0 | 2 | ~320 LOC |
-| 5 | Foilio Lorcana pricing | 0 | 2 | ~280 LOC |
-| 6 | Foil-aware valuation APIs | 0 | 2 | ~150 LOC |
-| 7 | Sort by price wiring | 0 | 2, 6 | ~220 LOC |
-| 8 | Card pricing + history APIs | 1 | 2 | ~350 LOC |
-| 9 | Card detail pricing UI | 1 | 8 | ~380 LOC |
-| 10 | Geo clients + DB cache | 2 | 1 | ~300 LOC |
-| 11 | Stores nearby API | 2 | 10 | ~200 LOC |
-| 12 | Settings home zip | 2 | 1 | ~120 LOC |
-| 13 | Local stores card detail UI | 2 | 9, 11, 12 | ~200 LOC |
-
-**Brief files:** `.convoys/pricing-online-local/brief-*.md`
-
-### Schema diff (migration `1783000000001_add-pricing-schema.js`)
-
-- `cards.prices_updated_at TIMESTAMPTZ`
-- `card_price_history` (daily snapshots, UNIQUE per card/day/source/type/currency)
-- `users.home_zip VARCHAR(10)`
-- `geo_zip_cache`, `geo_stores_cache` (DB-backed, 7d TTL on stores)
-
-### slice_dependencies (multitask-ready)
-
-```yaml
-slice_dependencies:
-  - brief: 1
-    depends_on: []
-    files: [migrations/1783000000001_add-pricing-schema.js, docs/SCHEMA_MAP.md]
-  - brief: 2
-    depends_on: [1]
-    files: [lib/pricing/card-price.js, lib/pricing/price-history.js, lib/pricing/collection-valuation.js, lib/pricing/outbound-links.js]
-  - brief: 3
-    depends_on: [2]
-    files: [lib/card-import/bulk-sync.js]
-  - brief: 4
-    depends_on: [2]
-    files: [lib/pricing/tcgdex-client.js, lib/card-import/pokemon-bulk.js]
-  - brief: 5
-    depends_on: [2]
-    files: [lib/pricing/foilio-client.js, lib/card-import/lorcana-bulk.js]
-  - brief: 6
-    depends_on: [2]
-    files: [pages/api/user/stats.js, pages/api/collections/[identifier].js]
-  - brief: 7
-    depends_on: [2, 6]
-    files: [pages/api/cards/owned.js, pages/api/collections/[identifier]/cards.js, lib/use-collection-view.js, components/CollectionPageView.js, pages/my-cards.js]
-  - brief: 8
-    depends_on: [2]
-    files: [lib/pricing/pricing-service.js, pages/api/cards/[id]/pricing.js, pages/api/cards/[id]/price-history.js]
-  - brief: 9
-    depends_on: [8]
-    files: [components/card-detail/CardDetailPurchaseTab.js, components/card-detail/CardDetailPriceHistoryTab.js, components/CardDetailView.js, lib/use-card-detail.js]
-  - brief: 10
-    depends_on: [1]
-    files: [lib/pricing/nominatim.js, lib/pricing/overpass.js, lib/pricing/geo-cache.js]
-  - brief: 11
-    depends_on: [10]
-    files: [pages/api/stores/nearby.js, lib/rate-limit.js]
-  - brief: 12
-    depends_on: [1]
-    files: [pages/settings.js, pages/api/user/settings.js]
-  - brief: 13
-    depends_on: [9, 11, 12]
-    files: [components/card-detail/CardDetailLocalStores.js, components/CardDetailView.js, lib/use-card-detail.js]
-```
-
-**Parallelization:** After Brief 1 → Brief 2 → **parallel** Briefs 3, 4, 5, 6 → Brief 7 → Brief 8 → Brief 9 → **parallel** Briefs 10, 12 → Brief 11 → Brief 13.
-
-### Risks
-
-| Risk | Mitigation |
-| --- | --- |
-| TCGdex ID mismatch | Match set_code + card_number; log unmatched |
-| Foilio card_id drift | Fallback name+set match |
-| Nominatim ToS | DB cache forever; 1 req/s; server-only |
-| Overpass load | 7d cache; auth + 1/hour/user |
-| Valuation on lists (no is_foil) | `COALESCE(current_price, market_price)` + tooltip |
-
----
-
-## Phase checklist
-
-### Phase 0
-- [ ] Pokemon bulk → TCGdex prices
-- [ ] Lorcana bulk → Foilio feed
-- [ ] Fix MTG foil valuation bug
-- [ ] Sort by Price wired
-- [ ] Price snapshots on sync
-
-### Phase 1
-- [ ] `GET /api/cards/[id]/pricing`
-- [ ] Purchase tab + staleness badge
-- [ ] Price History tab
-
-### Phase 2
-- [ ] Settings home zip
-- [ ] `GET /api/stores/nearby` (auth-gated)
-- [ ] Local stores on card detail
-
----
-
-## Env vars
-
-```bash
-TCGDEX_BASE_URL=https://api.tcgdex.net/v2/en
-FOILIO_PRICES_FEED_URL=https://foilio.net/api/prices/feed?game=lorcana
-NOMINATIM_USER_AGENT=DeckHearth/1.0 (contact@stillwell.cloud)
-OVERPASS_URL=https://overpass-api.de/api/interpreter
-TCG_PRICE_LOOKUP_API_KEY=          # optional
-PRICING_LOCAL_ENABLED=true
-```
-
----
-
-## Gentleness rules
-
-| API | Rule |
-|-----|------|
-| Scryfall bulk | One download per sync; User-Agent set |
-| TCGdex | Batch by set; sleep 100ms between pages |
-| Foilio | One feed fetch/hour |
-| Nominatim | Max 1 req/s; cache zip→coords forever |
-| Overpass | Max 1 query/user/hour; 7d cache |
-
----
-
-**Architecture complete. 13 briefs created. Estimated PRs: 13. Awaiting human gate 1 (plan approval) before implementers run.**

.convoys/pricing-online-local/brief-1-pricing-schema-migration.md

@@ -1,39 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 1
-depends_on: []
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - migrations/1783000000001_add-pricing-schema.js
-  - docs/SCHEMA_MAP.md
----
-
-# Brief 1: Pricing schema migration
-
-## Goal (1 sentence)
-
-Ship the node-pg-migrate migration for pricing timestamps, price history, user home zip, and geo caches.
-
-## Files in scope (do not edit anything else)
-- `migrations/1783000000001_add-pricing-schema.js`
-- `docs/SCHEMA_MAP.md`
-
-## Conventions to follow
-- Generate via `npm run migrate create add-pricing-schema -- -j js`; apply with `npm run migrate up`.
-- `down()` must hard-stub (throw) — see `migrations/1779853647564_initial-schema.js`.
-- Update `docs/SCHEMA_MAP.md` for every new column/table (AGENTS.md § Schema changes).
-- Use `ADD COLUMN IF NOT EXISTS` / `CREATE TABLE IF NOT EXISTS` for idempotency.
-
-## Acceptance criteria
-- [ ] Migration adds `cards.prices_updated_at TIMESTAMPTZ`
-- [ ] Migration creates `card_price_history` with UNIQUE `(card_id, source, price_type, currency, recorded_at)` and index on `(card_id, recorded_at DESC)`
-- [ ] Migration adds `users.home_zip VARCHAR(10)`
-- [ ] Migration creates `geo_zip_cache` and `geo_stores_cache` tables per Architecture §3
-- [ ] `docs/SCHEMA_MAP.md` updated
-- [ ] `npm run migrate up` succeeds on fresh + existing DB
-- [ ] No scope expansion (do not edit files outside `files:` above)
-
-## Rationale (≤3 sentences)
-
-All pricing and geo features depend on these columns/tables. Landing schema first unblocks parallel implementers for bulk ingest, APIs, and settings without merge conflicts on migration files.

.convoys/pricing-online-local/brief-10-geo-clients-cache.md

@@ -1,47 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 10
-depends_on: [1]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - lib/pricing/nominatim.js
-  - lib/pricing/overpass.js
-  - lib/pricing/geo-cache.js
-  - test/lib/pricing/nominatim.test.js
-  - test/lib/pricing/overpass.test.js
-  - test/lib/pricing/geo-cache.test.js
----
-
-# Brief 10: Geo clients + DB cache
-
-## Goal (1 sentence)
-
-Implement Nominatim geocoding, Overpass store queries, and DB-backed caches per convoy gentleness rules.
-
-## Files in scope (do not edit anything else)
-- `lib/pricing/nominatim.js`
-- `lib/pricing/overpass.js`
-- `lib/pricing/geo-cache.js`
-- `test/lib/pricing/nominatim.test.js`
-- `test/lib/pricing/overpass.test.js`
-- `test/lib/pricing/geo-cache.test.js`
-
-## Conventions to follow
-- **Security:** Overpass QL uses fixed template only; inject parsed floats for lat/lng/radiusMeters — never user strings.
-- `nominatim.js`: User-Agent from `NOMINATIM_USER_AGENT`; min 1s between requests.
-- `overpass.js`: query `shop=games` and `shop=hobby`; radius capped 1–50 miles server-side.
-- `geo-cache.js`: zip coords cached forever; stores cache 7-day TTL.
-- Allowlist outbound hosts at module init.
-
-## Acceptance criteria
-- [ ] Zip cache hit skips Nominatim
-- [ ] Stores cache respects 7-day TTL
-- [ ] Overpass parser returns distance-ready lat/lng per store
-- [ ] Unit tests cover parser + TTL logic
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Isolates external geo APIs from the route handler for testability. DB cache avoids Redis dependency for long-lived zip coords. Satisfies convoy rate-limit requirements before Brief 11 wires the API.

.convoys/pricing-online-local/brief-11-stores-nearby-api.md

@@ -1,40 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 11
-depends_on: [10]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - pages/api/stores/nearby.js
-  - lib/rate-limit.js
-  - test/api/stores-nearby.test.js
----
-
-# Brief 11: Stores nearby API
-
-## Goal (1 sentence)
-
-Ship `GET /api/stores/nearby` with geocode + Overpass lookup, caching, and per-user refresh rate limit.
-
-## Files in scope (do not edit anything else)
-- `pages/api/stores/nearby.js`
-- `lib/rate-limit.js`
-- `test/api/stores-nearby.test.js`
-
-## Conventions to follow
-- **Auth required** (`getUserFromRequest` → 401). Zip from user's saved `home_zip` only — ignore arbitrary `zip` query param (security planning decision A).
-- Add `stores` limiter: 1/hour/user; IP backstop for burst abuse.
-- Respect `PRICING_LOCAL_ENABLED` — return 503 when `false`.
-- Overpass fixed-template query only (see Brief 10).
-
-## Acceptance criteria
-- [ ] Endpoint returns store list for authenticated user with saved zip
-- [ ] 401 without Bearer token
-- [ ] Second call within 7 days serves from `geo_stores_cache`
-- [ ] Rate limit returns 429 with `Retry-After`
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Phase 2 API surface from convoy spec. Auth-gated zip prevents geocode relay abuse. Rate limiting protects Overpass.

.convoys/pricing-online-local/brief-12-settings-home-zip.md

@@ -1,39 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 12
-depends_on: [1]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - pages/settings.js
-  - pages/api/user/settings.js
-  - test/api/user-settings-home-zip.test.js
----
-
-# Brief 12: Settings home zip
-
-## Goal (1 sentence)
-
-Let users save a home zip code in Settings for local store discovery.
-
-## Files in scope (do not edit anything else)
-- `pages/settings.js`
-- `pages/api/user/settings.js`
-- `test/api/user-settings-home-zip.test.js`
-
-## Conventions to follow
-- Auth: `getUserFromRequest` → 401 if null.
-- Validate zip: 5-digit US; store 5-digit string; allow `null` to clear.
-- Settings UI: field under **Preferences** — “Home ZIP code (for nearby game stores)”.
-- Owner-scoped read/write only (`user_id = session.userId`).
-
-## Acceptance criteria
-- [ ] GET settings includes `home_zip`
-- [ ] PUT persists valid zip; 400 on invalid
-- [ ] Settings page loads and saves zip
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Phase 2 requires a default location without GPS. Reuses existing settings flow. Independent of geo API briefs once migration lands.

.convoys/pricing-online-local/brief-13-local-stores-ui.md

@@ -1,47 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 13
-depends_on: [9, 11, 12]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - components/card-detail/CardDetailLocalStores.js
-  - components/CardDetailView.js
-  - lib/use-card-detail.js
-  - test/components/CardDetailLocalStores.test.js
-cross_brief_commitments:
-  - brief: 9
-    description: |
-      Inserts local stores section into the purchase tab area using the
-      slot Brief 9 reserved. Does not rework purchase pricing UI.
----
-
-# Brief 13: Local stores card detail UI
-
-## Goal (1 sentence)
-
-Show “Game stores near you” on card detail using saved home zip and the nearby stores API.
-
-## Files in scope (do not edit anything else)
-- `components/card-detail/CardDetailLocalStores.js`
-- `components/CardDetailView.js`
-- `lib/use-card-detail.js`
-- `test/components/CardDetailLocalStores.test.js`
-
-## Conventions to follow
-- Fetch `/api/stores/nearby` when purchase tab active (auth required).
-- List: name, address, distance, phone/website links, OSM link — no in-store prices.
-- Empty states: no zip → link to Settings; no stores → gentle copy.
-- Liquid Glass styling consistent with Brief 9 components.
-
-## Acceptance criteria
-- [ ] Stores render when user has home zip configured
-- [ ] Prompt to set zip when missing
-- [ ] No scraped in-store pricing shown
-- [ ] Component test covers empty + populated states
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Completes Phase 2 user-facing goal on card detail. Depends on pricing UI shell from Brief 9 and backend from Briefs 11–12.

.convoys/pricing-online-local/brief-2-pricing-foundation-lib.md

@@ -1,56 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 2
-depends_on: [1]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - lib/pricing/card-price.js
-  - lib/pricing/price-history.js
-  - lib/pricing/collection-valuation.js
-  - lib/pricing/outbound-links.js
-  - test/lib/pricing/card-price.test.js
-  - test/lib/pricing/price-history.test.js
-  - test/lib/pricing/collection-valuation.test.js
-cross_brief_commitments:
-  - brief: 3
-    description: |
-      Briefs 3–5 import `recordPriceSnapshots` from `lib/pricing/price-history.js`
-      and set `prices_updated_at` after successful price writes. They must call
-      the shared helpers rather than duplicating snapshot SQL.
----
-
-# Brief 2: Pricing foundation lib
-
-## Goal (1 sentence)
-
-Create shared pricing helpers for foil-aware unit prices, daily history snapshots, collection valuation SQL, and outbound buy links.
-
-## Files in scope (do not edit anything else)
-- `lib/pricing/card-price.js`
-- `lib/pricing/price-history.js`
-- `lib/pricing/collection-valuation.js`
-- `lib/pricing/outbound-links.js`
-- `test/lib/pricing/card-price.test.js`
-- `test/lib/pricing/price-history.test.js`
-- `test/lib/pricing/collection-valuation.test.js`
-
-## Conventions to follow
-- ESM (`import`/`export`); DB via `import { sql } from '../sql.js'` (relative from `lib/pricing/`).
-- `card-price.js`: export `resolveUnitPrice({ currentPrice, marketPrice, isFoil })` — nonfoil prefers `current_price`, foil prefers `market_price`; export `PRICE_STALE_HOURS = 24`.
-- `collection-valuation.js`: export `effectiveUnitPriceExpr({ cardAlias = 'c', userCardAlias = 'uc' })` returning SQL `CASE WHEN uc.is_foil THEN c.market_price ELSE COALESCE(c.current_price, c.market_price) END`; export `listUnitPriceExpr({ cardAlias = 'c' })` → `COALESCE(c.current_price, c.market_price)`.
-- `price-history.js`: export `recordPriceSnapshots(rows)` where each row is `{ cardId, source, priceType, currency, amount }`; upsert on daily UNIQUE key.
-- `outbound-links.js`: extract TCGPlayer + eBay URL logic currently inline in `CardDetailView.js` (game-aware).
-- Mirror test style from `test/lib/collection-vocabulary.test.js`.
-
-## Acceptance criteria
-- [ ] `resolveUnitPrice` returns foil vs nonfoil correctly for MTG-shaped data
-- [ ] `recordPriceSnapshots` is idempotent for same card/day/source/type
-- [ ] `effectiveUnitPriceExpr` produces valid SQL fragment (unit-tested via known inputs or integration mock)
-- [ ] `buildTcgplayerUrl(card)` and `buildEbayUrl(card)` exported
-- [ ] All three test files pass (`npm run test:run`)
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Centralizes pricing semantics so bulk sync, valuation fix, and APIs cannot drift. The foil bug (`market_price` = Scryfall `usd_foil`) is fixed once at the helper layer. Snapshot writer gives Briefs 3–5 a single hook.

.convoys/pricing-online-local/brief-3-mtg-bulk-sync-snapshots.md

@@ -1,44 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 3
-depends_on: [2]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - lib/card-import/bulk-sync.js
-  - test/lib/card-import/bulk-sync.test.js
-cross_brief_commitments:
-  - brief: 2
-    description: |
-      Uses `recordPriceSnapshots` and sets `prices_updated_at = CURRENT_TIMESTAMP`
-      on each upsert batch where price columns change.
----
-
-# Brief 3: MTG bulk sync + snapshots
-
-## Goal (1 sentence)
-
-Update Scryfall bulk sync to stamp `prices_updated_at` and record daily price history snapshots.
-
-## Files in scope (do not edit anything else)
-- `lib/card-import/bulk-sync.js`
-- `test/lib/card-import/bulk-sync.test.js`
-
-## Conventions to follow
-- Keep existing `mapCard()` mapping: `usd` → `current_price`, `usd_foil` → `market_price`.
-- Add `prices_updated_at` to INSERT/UPDATE columns (set when either price is non-null).
-- After each successful `upsertBatch`, call `recordPriceSnapshots` for rows with prices (`source: 'scryfall'`, `priceType: 'market'` for nonfoil amount, optionally second snapshot for foil if present).
-- Export `mapCard` for unit tests (or test via named export already present).
-- Preserve Scryfall User-Agent header.
-
-## Acceptance criteria
-- [ ] `upsertBatch` writes `prices_updated_at`
-- [ ] Price snapshots recorded per card per sync day
-- [ ] `mapCard` unit tests cover price parsing
-- [ ] Existing `runBulkMtgSync` return shape unchanged (add optional `snapshotsWritten` count)
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-MTG already has price data from Scryfall; this brief wires timestamps and history without changing upstream source. Fixes the data pipeline for Phase 1 pricing API reads.

.convoys/pricing-online-local/brief-4-tcgdex-pokemon-pricing.md

@@ -1,44 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 4
-depends_on: [2]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - lib/pricing/tcgdex-client.js
-  - lib/card-import/pokemon-bulk.js
-  - test/lib/pricing/tcgdex-client.test.js
-  - test/lib/card-import/pokemon-bulk.test.js
----
-
-# Brief 4: TCGdex Pokémon pricing ingest
-
-## Goal (1 sentence)
-
-Ingest USD TCGPlayer prices from TCGdex during Pokémon bulk sync instead of writing null prices.
-
-## Files in scope (do not edit anything else)
-- `lib/pricing/tcgdex-client.js`
-- `lib/card-import/pokemon-bulk.js`
-- `test/lib/pricing/tcgdex-client.test.js`
-- `test/lib/card-import/pokemon-bulk.test.js`
-
-## Conventions to follow
-- Base URL from `process.env.TCGDEX_BASE_URL ?? 'https://api.tcgdex.net/v2/en'`.
-- Client: `fetchSetCards(setId)` with 100ms delay between set requests; parse `pricing.tcgplayer` (USD market/low) and `pricing.cardmarket` (EUR — store in `market_price` only when USD missing, document in code comment).
-- Match TCGdex cards to DB rows by `set_code` + `card_number` (normalize leading zeros); fallback name match within set.
-- `mapPokemonBulkRow` / `buildUpsertQuery`: populate `current_price` (low or market NM), `market_price` (market), `prices_updated_at`.
-- Call `recordPriceSnapshots` with `source: 'tcgdex'`.
-- Log `unmatchedCount` in sync summary JSON.
-
-## Acceptance criteria
-- [ ] Pokémon bulk no longer writes `null` prices when TCGdex has data
-- [ ] Gentleness: 100ms sleep between set fetches
-- [ ] Unit tests with mocked fetch fixtures
-- [ ] `runBulkPokemonSync` summary includes `pricesMatched` / `unmatchedCount`
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Pokémon catalog sync currently nulls prices. TCGdex is the convoy's free USD source. Set-batched fetch keeps within polite limits.

.convoys/pricing-online-local/brief-5-foilio-lorcana-pricing.md

@@ -1,43 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 5
-depends_on: [2]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - lib/pricing/foilio-client.js
-  - lib/card-import/lorcana-bulk.js
-  - test/lib/pricing/foilio-client.test.js
-  - test/lib/card-import/lorcana-bulk.test.js
----
-
-# Brief 5: Foilio Lorcana pricing ingest
-
-## Goal (1 sentence)
-
-Enrich Lorcana bulk sync with hourly Foilio feed prices keyed by card id and name+set.
-
-## Files in scope (do not edit anything else)
-- `lib/pricing/foilio-client.js`
-- `lib/card-import/lorcana-bulk.js`
-- `test/lib/pricing/foilio-client.test.js`
-- `test/lib/card-import/lorcana-bulk.test.js`
-
-## Conventions to follow
-- Feed URL: `process.env.FOILIO_PRICES_FEED_URL ?? 'https://foilio.net/api/prices/feed?game=lorcana'`.
-- Client fetches once per sync run; build `Map` by `card_id` and composite `normalize(name)|set`.
-- Extend `buildUpsertQuery` / `mapLorcanaCard` to include `current_price`, `market_price`, `prices_updated_at`.
-- Prefer USD fields when present; otherwise EUR with `currency` noted in snapshot.
-- `recordPriceSnapshots` with `source: 'foilio'`.
-- Preserve existing `scryfall_id = Unique_ID` keying.
-
-## Acceptance criteria
-- [ ] Lorcana cards receive prices when feed contains a match
-- [ ] Single feed fetch per `runBulkLorcanaSync` invocation
-- [ ] Summary includes `pricesMatched` / `unmatchedCount`
-- [ ] Tests pass with fixture JSON
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Lorcana bulk currently omits price columns entirely. Foilio provides a free hourly JSON feed. One fetch per sync aligns with their 1h cache.

.convoys/pricing-online-local/brief-6-foil-aware-valuation.md

@@ -1,40 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 6
-depends_on: [2]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - pages/api/user/stats.js
-  - pages/api/collections/[identifier].js
-  - test/api/user-stats-valuation.test.js
----
-
-# Brief 6: Foil-aware valuation APIs
-
-## Goal (1 sentence)
-
-Fix collection total value to use nonfoil `current_price` for `user_cards.is_foil = false` rows.
-
-## Files in scope (do not edit anything else)
-- `pages/api/user/stats.js`
-- `pages/api/collections/[identifier].js`
-- `test/api/user-stats-valuation.test.js`
-
-## Conventions to follow
-- Import `effectiveUnitPriceExpr` and `listUnitPriceExpr` from `lib/pricing/collection-valuation.js`.
-- `stats.js`: replace `cards.market_price * quantity` with effective unit price expression in value, game breakdown, rarity breakdown, and recent activity.
-- `collections/[identifier].js`: replace `SUM(cards.market_price * cc.quantity)` with `listUnitPriceExpr`.
-- Auth pattern unchanged (`getUserFromRequest`).
-
-## Acceptance criteria
-- [ ] Nonfoil `user_cards` row valued at `current_price`, not foil `market_price`
-- [ ] Foil row still uses `market_price`
-- [ ] Collection list totals use `COALESCE(current_price, market_price)`
-- [ ] Regression test locks MTG foil/nonfoil scenario
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-This is the user-visible valuation bug from Phase 0. `market_price` stores Scryfall `usd_foil` for MTG. Fixing at the API layer immediately improves dashboard and profile totals.

.convoys/pricing-online-local/brief-7-sort-by-price.md

@@ -1,46 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 7
-depends_on: [2, 6]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - pages/api/cards/owned.js
-  - pages/api/collections/[identifier]/cards.js
-  - lib/use-collection-view.js
-  - components/CollectionPageView.js
-  - pages/my-cards.js
-  - test/api/cards-owned-sort.test.js
----
-
-# Brief 7: Sort by price wiring
-
-## Goal (1 sentence)
-
-Wire “Sort by Price” through owned-cards and list APIs into collection and My Collection UIs.
-
-## Files in scope (do not edit anything else)
-- `pages/api/cards/owned.js`
-- `pages/api/collections/[identifier]/cards.js`
-- `lib/use-collection-view.js`
-- `components/CollectionPageView.js`
-- `pages/my-cards.js`
-- `test/api/cards-owned-sort.test.js`
-
-## Conventions to follow
-- Query params: `sort=name|price|rarity|date`, `order=asc|desc` (default `name`/`asc`).
-- Price sort uses `listUnitPriceExpr` or `COALESCE(c.current_price, c.market_price)`; NULLs last.
-- `CollectionPageView` select options must use stable values (`name`, `price`, etc.) not display strings.
-- Server-side sort required for paginated My Collection.
-
-## Acceptance criteria
-- [ ] `/api/cards/owned?sort=price&order=desc` orders by effective price
-- [ ] Collection cards API supports same params
-- [ ] UI sort dropdown changes card order
-- [ ] API test asserts ORDER BY clause or result ordering
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Sort UI exists but is inert. Server-side sort avoids loading entire collections client-side. Depends on valuation helpers for consistent price column.

.convoys/pricing-online-local/brief-8-card-pricing-apis.md

@@ -1,52 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 8
-depends_on: [2]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - lib/pricing/pricing-service.js
-  - pages/api/cards/[id]/pricing.js
-  - pages/api/cards/[id]/price-history.js
-  - pages/api/cards/[id].js
-  - test/api/cards-pricing.test.js
-  - test/api/cards-price-history.test.js
-cross_brief_commitments:
-  - brief: 9
-    description: |
-      Response shapes from `/api/cards/[id]/pricing` and
-      `/api/cards/[id]/price-history` are the contract Brief 9's UI consumes.
-      Do not rename fields without updating Brief 9.
----
-
-# Brief 8: Card pricing + history APIs
-
-## Goal (1 sentence)
-
-Expose `GET /api/cards/[id]/pricing` and `GET /api/cards/[id]/price-history` reading DB with optional stale refresh.
-
-## Files in scope (do not edit anything else)
-- `lib/pricing/pricing-service.js`
-- `pages/api/cards/[id]/pricing.js`
-- `pages/api/cards/[id]/price-history.js`
-- `pages/api/cards/[id].js`
-- `test/api/cards-pricing.test.js`
-- `test/api/cards-price-history.test.js`
-
-## Conventions to follow
-- API route pattern from `.cursor/rules/api-routes.mdc`: method gate, try/catch, manual validation.
-- `pricing-service.js`: DB-first; live refresh only when stale >24h with Redis single-flight lock.
-- Include `outbound` links via `outbound-links.js`.
-- `price-history.js` API: query `card_price_history` last N days (default 90, max 365).
-
-## Acceptance criteria
-- [ ] `GET /api/cards/123/pricing` returns prices + `pricesUpdatedAt` + `stale` boolean
-- [ ] `GET /api/cards/123/price-history?days=30` returns `{ points: [...] }`
-- [ ] 404 when card missing; 400 on invalid id/days
-- [ ] Live refresh does not throw on upstream failure
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Phase 1 backend contract for Purchase and Price History tabs. DB-first path respects free API limits; 24h staleness matches convoy spec.

.convoys/pricing-online-local/brief-9-card-detail-pricing-ui.md

@@ -1,53 +0,0 @@
----
-convoy: pricing-online-local
-brief_number: 9
-depends_on: [8]
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - components/card-detail/CardDetailPurchaseTab.js
-  - components/card-detail/CardDetailPriceHistoryTab.js
-  - components/CardDetailView.js
-  - lib/use-card-detail.js
-  - test/components/CardDetailPurchaseTab.test.js
-cross_brief_commitments:
-  - brief: 8
-    description: |
-      Consumes `/api/cards/[id]/pricing` and `/api/cards/[id]/price-history`
-      response shapes defined in Brief 8.
-  - brief: 13
-    description: |
-      Brief 13 will add `CardDetailLocalStores` below the purchase panel.
-      Leave a slot in purchase tab wrapper for Brief 13 insertion.
----
-
-# Brief 9: Card detail pricing UI
-
-## Goal (1 sentence)
-
-Replace placeholder Purchase and Price History tabs with live pricing data, staleness badge, and a simple history chart.
-
-## Files in scope (do not edit anything else)
-- `components/card-detail/CardDetailPurchaseTab.js`
-- `components/card-detail/CardDetailPriceHistoryTab.js`
-- `components/CardDetailView.js`
-- `lib/use-card-detail.js`
-- `test/components/CardDetailPurchaseTab.test.js`
-
-## Conventions to follow
-- Liquid Glass surfaces: `glass-panel`, CSS variables — no hardcoded hex.
-- Purchase tab: staleness badge, outbound links from API `outbound`.
-- Price History tab: line chart from `points`; empty state when none.
-- Reserve insertion point for Brief 13 local stores section.
-
-## Acceptance criteria
-- [ ] Purchase tab shows DB prices and staleness badge
-- [ ] Price History tab renders data when points exist; empty state when none
-- [ ] No placeholder “available soon” copy remains
-- [ ] Component test verifies staleness badge text
-- [ ] Tests pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Delivers Phase 1 user-facing value on existing tab chrome. Keeps `CardDetailView` thin by extracting tab bodies. Documents insertion point for Phase 2 local stores.

.convoys/reconcile-historical-add-scripts.md

@@ -1,790 +0,0 @@
----
-name: reconcile-historical-add-scripts
-classification: quality
-priority: P1 (last open P1 in launch queue)
-success_metric: |
-  A brand-new Neon branch can be onboarded by `npm install` →
-  `npm run setup-db` alone. After `setup-db` exits 0, the fresh-env
-  schema (`information_schema.tables` + `.columns` + `.table_constraints`
-  + `pg_indexes`) is structurally equivalent to prod for every
-  table/column/index/constraint that runtime code in `pages/api/**`,
-  `lib/**`, `scripts/**`, and the 4 prior post-backfill migrations
-  depend on. `.convoys/ship-readiness.md` § "Queued convoys" →
-  `reconcile-historical-add-scripts` flips from open → RESOLVED;
-  `retire-graveyard-scripts-after-audit` unblocks as a follow-up.
-skip:
-  - role-design-system-auditor
-  - role-a11y-auditor
-  - role-ux-reviewer
-  - role-ia-architect
-status: shipped
-created: 2026-06-14
-parent: migration-tool
-addresses: migration-tool § R1 (prod schema drift from setup-neon-db.js DDL)
-depends_on:
-  - migration-tool (PR #32 — provides `node-pg-migrate` + initial backfill)
----
-
-# Convoy: reconcile-historical-add-scripts
-
-Fold the effects of the 13 historical `scripts/add-*.js` / `scripts/fix-*.js`
-/ `scripts/seed-*.js` jobs into the migration history so a brand-new Neon
-branch can be onboarded by `npm install` → `npm run setup-db` alone,
-without manually replaying the historical scripts. Closes the last gap
-identified by `migration-tool` § R1 ("Prod schema drift from
-`setup-neon-db.js` DDL").
-
-## Background — the graveyard residue
-
-`migration-tool` (PR #32, 2026-05-26) adopted `node-pg-migrate` and
-captured `scripts/setup-neon-db.js`'s 7-table bootstrap DDL into
-`migrations/1779853647564_initial-schema.js`. Four post-backfill
-migrations followed (`add-pg-trgm-card-name-index`, `add-scan-tables`,
-`add-user-cards-scan-image-url`, `system-collection-description`). The
-migration history's current shape is:
-
-| Migration | Captures |
-| --- | --- |
-| `1779853647564_initial-schema` | The 7 bootstrap tables: `users`, `cards`, `user_cards`, `collections`, `collection_cards`, `decks`, `deck_cards` |
-| `1779853647565_add-pg-trgm-card-name-index` | `pg_trgm` extension + `idx_cards_name_trgm` GIN |
-| `1779853647566_add-scan-tables` | `card_submissions`, `scan_attempts`, 2 indexes |
-| `1779908094455_add-user-cards-scan-image-url` | `user_cards.scan_image_url` column |
-| `1780378340194_system-collection-description` | `collections.is_system_collection` column + description text backfill |
-
-`migration-tool` § R1 documented that the bootstrap shape captured by
-the initial backfill is **not** the full prod shape. Between
-`setup-neon-db.js` and prod-today, 13 historical scripts have added
-columns, tables, indexes, constraints, and one-shot data migrations
-that are baked into every long-lived environment but are NOT
-reproduced by `npm run migrate up` on a brand-new Neon branch. Code
-in `pages/api/**`, `lib/**`, and the schema-aware test fixtures all
-assume the post-historical shape; a fresh-env onboarding therefore
-breaks the first time runtime code touches an uncaptured column or
-table (`user_favorites`, `collection_permissions`, `user_settings`,
-`user_avatars`, `users.first_name`, `collections.visibility`, etc.).
-
-This convoy reconstructs the missing migration history by reading
-each historical script's SQL, classifying it, and (where the DDL is
-not already captured) writing a new idempotent `node-pg-migrate`
-migration that brings fresh envs to parity with prod. Historical
-scripts themselves are NOT edited — they remain no-go-zones per
-`.cursor/rules/no-go-zones.mdc`. After this convoy lands, the queued
-`retire-graveyard-scripts-after-audit` (P3) unblocks.
-
-## Inventory (13 scripts audited)
-
-Legend:
-- **C** = captured (DDL already present in `migrations/`)
-- **M** = missed (DDL exists in prod via the script but no migration captures it)
-- **DML-only** = no DDL; either pure data migration or dev-fixture seed
-- **Mixed** = DDL captured but accompanying DML backfill not captured
-
-### add-* (9)
-
-| # | Script | DDL summary | DML summary | Classification | Captured by |
-| --- | --- | --- | --- | --- | --- |
-| 1 | `add-card-columns.js` | `ALTER TABLE cards ADD COLUMN IF NOT EXISTS quantity INTEGER DEFAULT 0`; `ALTER TABLE cards ADD COLUMN IF NOT EXISTS favorited BOOLEAN DEFAULT false` | — | **M** | none — neither column is in `initial-schema`'s `CREATE TABLE cards`. Both flagged as "unused" smells in `docs/SCHEMA_MAP.md` § "Known schema smells" #3 |
-| 2 | `add-collaboration-features.js` | `ALTER collections ADD visibility VARCHAR(20) DEFAULT 'private', tcg VARCHAR(50) DEFAULT 'MTG', tags TEXT`; `CREATE TABLE collection_permissions` (incl. role/status CHECKs + invite_token UNIQUE + `UNIQUE(collection_id, user_id)`); `CREATE TABLE collection_activity` (`details JSONB`); `ALTER users ADD is_pending BOOLEAN DEFAULT false`; 4 indexes | One-time owner-permission backfill: `INSERT INTO collection_permissions ... 'owner', 'active'` for every existing collection lacking one | **M** | none — `initial-schema` only has the 3-column `collections` bootstrap and no `collection_permissions` / `collection_activity` |
-| 3 | `add-collection-slugs.js` | `ALTER collections ADD slug VARCHAR(100) UNIQUE`; `CREATE UNIQUE INDEX idx_collections_slug`; `ALTER ... ADD CONSTRAINT check_slug_format CHECK (slug ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?$' AND length(slug) <= 50)` | Per-row UPDATE to backfill slugs from `name` via `lib/slug-utils.js::generateUniqueSlug` | **M** | none |
-| 4 | `add-favorites-system.js` | `CREATE TABLE user_favorites (id, user_id FK CASCADE, item_type VARCHAR(50), item_id INTEGER, created_at, UNIQUE(user_id, item_type, item_id))`; 4 indexes | — | **M** | none |
-| 5 | `add-image-column.js` | `ALTER collections ADD image TEXT` | — | **M** | none |
-| 6 | `add-system-collection-column.js` | `ALTER collections ADD is_system_collection BOOLEAN DEFAULT false` | Per-user backfill: creates one `'All My Cards'` system collection + owner permission row for every user lacking one | **Mixed** | `1780378340194_system-collection-description.js` captures the DDL (`ADD COLUMN IF NOT EXISTS is_system_collection`). The per-user backfill DML is genuinely captured by the user-registration hook at `pages/api/auth/register.js:97-119` (`INSERT INTO collections ... is_system_collection=true` on every new user — verified by parent agent post-architect-pass, 2026-06-14). No further work required; see Finding 4 RESOLVED below. |
-| 7 | `add-updated-at-column.js` | `ALTER cards ADD updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP` | — | **C** | `1779853647564_initial-schema.js` — `cards` `CREATE TABLE` already includes `updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP` (line 67). Script is now a no-op on fresh envs. No work required. |
-| 8 | `add-user-profile-columns.js` | `ALTER users ADD first_name, last_name VARCHAR(255), username VARCHAR(255) UNIQUE, profile_image_url TEXT` | Per-row UPDATE: defaults `first_name='User'`, `last_name=<id>`, `username='<emailprefix>_<id>'` | **M** (overlaps #9 — see Drift findings) |
-| 9 | `add-user-profile-fields.js` | `ALTER users ADD first_name, last_name VARCHAR(255), username VARCHAR(255) UNIQUE, bio TEXT, avatar_url TEXT`; `ALTER users ADD favorite_games JSONB DEFAULT '["MTG"]', collection_visibility VARCHAR(20) DEFAULT 'private', preferred_currency VARCHAR(3) DEFAULT 'USD', cards_per_page INTEGER DEFAULT 50, default_view VARCHAR(10) DEFAULT 'grid'`; `ALTER users ADD notifications_email BOOLEAN DEFAULT true, notifications_marketing BOOLEAN DEFAULT false, two_factor_enabled BOOLEAN DEFAULT false`; `ALTER users ADD theme VARCHAR(10) DEFAULT 'system', language VARCHAR(5) DEFAULT 'en'`; `CREATE TABLE user_settings (id, user_id FK CASCADE, setting_key VARCHAR(100), setting_value JSONB, UNIQUE(user_id, setting_key))`; `CREATE TABLE user_avatars (id, user_id FK CASCADE, filename, original_name, mime_type, file_size, file_path, is_active BOOLEAN DEFAULT true)`; 6 CHECK constraints (`check_collection_visibility`, `check_preferred_currency`, `check_cards_per_page`, `check_default_view`, `check_theme`, `check_language`); 6 indexes | UPDATE on users to write defaults for any row with NULLs in the new columns | **M** |
-
-### fix-* (2)
-
-| # | Script | DDL summary | DML summary | Classification | Captured by |
-| --- | --- | --- | --- | --- | --- |
-| 10 | `fix-lorcana-images.js` | — | UPDATE on `cards WHERE game='Lorcana' AND image_url LIKE '%-716.webp' OR '%-512.webp'`: rewrite to `-1024.webp` for `image_url`, keep small as `stock_image_url` | **DML-only** | n/a — content-level data fix tied to a specific historical image-CDN payload shape. Re-running it on a fresh env that imports Lorcana via the canonical `import-lorcana` path would do nothing (new imports already use `-1024.webp`). |
-| 11 | `fix-user-cards-constraints.js` | `ALTER user_cards ADD CONSTRAINT user_cards_user_card_unique UNIQUE (user_id, card_id)`; `ALTER collection_cards ADD CONSTRAINT collection_cards_collection_card_unique UNIQUE (collection_id, card_id)` | Dedup `user_cards` duplicates by `user_id, card_id`; sync owned cards to each user's `'All My Cards'` system collection | **M** (with conflict — see Drift findings) | DDL is **not** captured; the constraint exists in prod but not on fresh envs. Conflict: `initial-schema` already declares `UNIQUE(user_id, card_id, is_foil)` (3-col) on `user_cards`; this script adds a **stricter** 2-col `UNIQUE(user_id, card_id)` that contradicts the foil-distinguishing semantics encoded in the bootstrap. Halt-and-ask flagged below. |
-
-### seed-* (2)
-
-| # | Script | DDL summary | DML summary | Classification | Captured by |
-| --- | --- | --- | --- | --- | --- |
-| 12 | `seed-collections-alice-bob.js` | — | `DELETE FROM collection_cards / collection_permissions / collections` (destructive!); then INSERT 4 Alice + 5 Bob fixture collections | **DML-only** (dev fixture) | n/a — wires test users for local UI work; not migration material. |
-| 13 | `seed-collections-with-cards.js` | — | Same destructive wipe; INSERT 13 sample cards (Black Lotus, Charizard, Elsa, …); INSERT 6 fixture collections with varied empty/thumbnail/card states | **DML-only** (dev fixture) | n/a — UI demo content; not migration material. |
-
-### Inventory counts
-
-- **Already captured (no work):** 2 — `add-updated-at-column.js` (#7) fully; `add-system-collection-column.js` (#6) DDL by `1780378340194` + DML backfill by `pages/api/auth/register.js:97-119` (Finding 4 RESOLVED)
-- **Missed DDL (needs migration):** 7 — #1, #2, #3, #4, #5, #8∪#9 (deduplicate). #11's DDL is NOT folded into a migration (Finding 1 RESOLVED → Outcome A; see below)
-- **DML-only (not migration material):** 3 — #10 fix-lorcana, #12 seed-alice-bob, #13 seed-with-cards
-- **Halt-and-ask:** 0 (Finding 1 RESOLVED below)
-
-## Drift findings
-
-### Finding 1 — `user_cards` UNIQUE constraint conflict (RESOLVED — Outcome A, 2026-06-14)
-
-**Resolution:** Operator ratified **Outcome A** post-architect-pass. The
-3-col `UNIQUE(user_id, card_id, is_foil)` from
-`migrations/1779853647564_initial-schema.js` is canonical and matches
-the actual prod state. `scripts/fix-user-cards-constraints.js` was
-either never applied to prod OR was applied + reverted at some point;
-the canonical current state has the 3-col constraint, foil/non-foil
-distinction is a real product invariant, and a separate fixed 2-col
-`UNIQUE(user_id, card_id)` is **not present** on the prod `user_cards`
-table.
-
-**Consequence for this convoy:** B6 collapses entirely. No migration
-is written for `fix-user-cards-constraints.js`. Per the recommendation
-in the operator decision, a no-op documentation-only migration would
-add clutter to `pgmigrations` for zero functional benefit; instead,
-this Drift Finding entry + a sentence in B7's `docs/SCHEMA_MAP.md`
-update + a sentence in the As-shipped section document the reasoning.
-
-The historical script remains a no-go-zone per
-`.cursor/rules/no-go-zones.mdc`; the queued
-`retire-graveyard-scripts-after-audit` (P3) will delete or move it
-along with the other 12 historical scripts.
-
-The original audit narrative is preserved below for cross-reference.
-
----
-
-**Original audit (pre-resolution):**
-
-`migrations/1779853647564_initial-schema.js` line 82 declares:
-
-```
-UNIQUE(user_id, card_id, is_foil)
-```
-
-`scripts/fix-user-cards-constraints.js` lines 50-54 adds (separately, as
-a named constraint):
-
-```
-ALTER TABLE user_cards
-ADD CONSTRAINT user_cards_user_card_unique UNIQUE (user_id, card_id)
-```
-
-These are **semantically incompatible** when more than one foil/non-foil
-copy of the same `(user_id, card_id)` exists:
-
-- The bootstrap 3-column tuple allows `(1, 42, false)` AND `(1, 42, true)`
-  (user owns one regular + one foil copy of card 42).
-- The fix-script's 2-column constraint **forbids** that pair.
-
-In any prod environment where `fix-user-cards-constraints.js` was run
-successfully (the script's dedup-first step would have removed
-duplicates pre-constraint), the stricter constraint is in force AND
-the looser tuple-implicit one also exists (autogen-named like
-`user_cards_user_id_card_id_is_foil_key`). Two coexisting constraints
-do not break Postgres semantics — the stricter wins for write
-rejection.
-
-Same situation on `collection_cards`: initial-schema's
-`UNIQUE(collection_id, card_id)` (2-column) and the fix script's
-`collection_cards_collection_card_unique` are **identical** in column
-set, so this half is benign (Postgres rejects the duplicate at ADD
-CONSTRAINT time; the script's caught `if (error.message.includes('already exists'))` swallows it).
-
-**Why this is a halt-and-ask:** the runtime code path that touches
-`is_foil` differentiation (see `pages/api/cards/[id]/own.js` and
-`pages/api/user-cards.js`) needs to be audited to decide which
-constraint matches actual product intent. Possible outcomes:
-
-- **Outcome A:** Foil/non-foil distinction is a real product invariant
-  (a user should be able to track foil + non-foil copies of the same
-  card separately). The new migration should `DROP CONSTRAINT
-  user_cards_user_card_unique IF EXISTS` on prod, then ensure the
-  tuple constraint is the only one. Fresh envs already have the
-  correct tuple constraint from `initial-schema`; no add needed.
-- **Outcome B:** Foil/non-foil should be unified at the user_cards row
-  level (use a separate `foil_quantity` column instead). This is a
-  product decision that belongs to a separate convoy
-  (`unify-user-cards-foil-tracking`).
-- **Outcome C:** Both are tolerable (current prod state). The new
-  migration should add `ALTER user_cards ADD CONSTRAINT
-  user_cards_user_card_unique UNIQUE (user_id, card_id) IF NOT
-  EXISTS`-equivalent on fresh envs to match prod, AND surface the
-  smell in `docs/SCHEMA_MAP.md`.
-
-**Halt point:** before B6 is written, operator picks A / B / C. **Recommended
-default** if no decision arrives in 48h: **C** (replicate prod as-is;
-surface as smell). Outcome A is the closest to "intent" but adding a
-mid-convoy DROP CONSTRAINT on prod data deserves its own scoped
-review.
-
-_— Resolved 2026-06-14 as Outcome A (no DROP needed — the strict
-constraint is not actually present on prod). See resolution block at
-the top of this Finding._
-
-### Finding 2 — `users.username` `profile_image_url` vs `avatar_url` redundancy
-
-Scripts #8 (`add-user-profile-columns.js`) and #9 (`add-user-profile-fields.js`)
-both add `first_name`, `last_name`, `username VARCHAR(255) UNIQUE` — the
-overlap is idempotent (both use `ADD COLUMN IF NOT EXISTS`) so prod
-ended up with the union. But:
-
-- #8 adds `profile_image_url TEXT`
-- #9 adds `avatar_url TEXT`
-
-`docs/SCHEMA_MAP.md` § "Known schema smells" #1 already flags this
-redundancy ("Pick one"). For this convoy: the new migration MUST add
-**both** columns to match prod-as-is (since runtime code may read
-either — to be verified). Surface as follow-up
-`unify-user-avatar-column`.
-
-### Finding 3 — `cards.quantity` and `cards.favorited` are dead columns
-
-`add-card-columns.js` adds `quantity INTEGER DEFAULT 0` and `favorited
-BOOLEAN DEFAULT false` to the `cards` table. `docs/SCHEMA_MAP.md`
-flags both as **Unused** (smell #3). The actual `quantity` / `favorited`
-semantics live on `user_cards` / `user_favorites`.
-
-For this convoy: add both columns to fresh envs to match prod. Do NOT
-drop them in prod (separate convoy). Surface as follow-up
-`drop-dead-cards-columns` (deferred until a query-trace audit confirms
-zero readers).
-
-### Finding 4 — `add-system-collection-column.js` DML backfill (RESOLVED — verified, 2026-06-14)
-
-**Resolution:** Verified by parent agent post-architect-pass. The
-`pages/api/auth/register.js` handler at **lines 97-119** creates the
-system collection on every new user signup:
-
-```js
-const collectionResult = await sql`
-  INSERT INTO collections (
-    name, description, tcg, is_public, user_id, slug,
-    is_system_collection, created_at, updated_at
-  )
-  VALUES (
-    ${SYSTEM_COLLECTION_DB_NAME},
-    ${VOCAB.SYSTEM_COLLECTION_SEED_DESCRIPTION},
-    'All', false, ${user.id}, ${uniqueSlug},
-    true,  -- is_system_collection
-    CURRENT_TIMESTAMP, CURRENT_TIMESTAMP
-  )
-  RETURNING id
-`;
-```
-
-The runtime invariant is intact. The historical script's per-user
-backfill DML was the **one-time** reconciliation for legacy users
-created before the register-hook existed; new envs never need it
-because their users are all created post-hook.
-
-For this convoy: **no migration, no follow-up convoy needed.** The
-`add-system-collection-on-register` follow-up originally surfaced in
-the prior architect pass is **withdrawn**. B7 will cite this
-verification in `docs/SCHEMA_MAP.md` § `collections.is_system_collection`
-notes.
-
-### Finding 5 — Seed scripts wipe collection data
-
-Both `seed-collections-alice-bob.js` and `seed-collections-with-cards.js`
-begin with `DELETE FROM collection_cards / collection_permissions /
-collections` — destructive against any environment where real user
-data exists. They are clearly tagged as dev fixtures (the test users
-`alice@tcgvault.com` / `bob@tcgvault.com` are local-only). Per D4
-below, these stay out of migrations entirely.
-
-## Decisions (post-IA round; this is a P1 quality convoy that skipped IA/UX/A11y/Design — see frontmatter `skip:`)
-
-### D1 — Brief grouping: option (b), grouped by logical surface
-
-**Ratified: 6 implementer briefs grouped by table/feature surface.**
-(Originally 7; B6 collapsed post-Finding-1 resolution — see § Brief outline.)
-
-Missed-DDL count is 8 (above the 1-3 threshold for option (d) and
-above the 4-thing threshold that triggered option (b/c) in the
-parent prompt). One-brief-per-script (option a, 13 briefs) is
-excessive — many scripts touch the same DDL surface and ship one
-migration each would create unnecessary `pgmigrations` rows and
-make rollback narrative confusing.
-
-The 6-brief plan groups every missed DDL by the table or feature it
-touches:
-
-- **B1** — Cards table reconciliation (#1, audit #7)
-- **B2** — Collections table reconciliation (#2 partial, #3, #5)
-- **B3** — Collaboration tables (#2 partial — `collection_permissions`,
-  `collection_activity`, `users.is_pending`)
-- **B4** — Favorites system (#4)
-- **B5** — User profile reconciliation (#8 ∪ #9, dedup'd; +
-  `user_settings`, `user_avatars`; + CHECK constraints; + indexes)
-- **B7** — Documentation + verification runbook (`docs/SCHEMA_MAP.md`
-  refresh, AGENTS.md Gotcha #6 update, operator runbook)
-
-**B6 was removed post-Finding-1 resolution** (Outcome A — the strict
-2-col `UNIQUE(user_id, card_id)` is not present on prod; the canonical
-3-col `UNIQUE(user_id, card_id, is_foil)` from `initial-schema` is
-what fresh envs already get). No migration is needed. The brief
-numbering preserves the original gap (B1-B5 + B7) so cross-references
-to "B6" in prior drafts of this convoy file remain unambiguous (they
-point to the removed brief).
-
-Rationale:
-1. **Independence.** Each of B1-B6 writes a new file under `migrations/`
-   with a fresh timestamp; the files don't overlap, so B1-B6 are
-   trivially parallel (subject to timestamp ordering — see slice
-   dependencies block below).
-2. **Reviewability.** Each PR is one migration + one optional
-   `docs/SCHEMA_MAP.md` section update; reviewer can verify against
-   the historical script in a single sitting.
-3. **Rollback granularity.** If B5's user-profile migration is found
-   buggy post-merge, the other 5 migrations are unaffected — they all
-   `pgmigrations`-row independently.
-4. **Estimated LOC per brief stays under 400.** B5 is the largest
-   (~250 LOC of SQL across 13 ALTERs + 2 CREATE TABLE + 6 CHECKs + 6
-   indexes) — comfortably under budget.
-
-Considered alternatives:
-
-| Option | Why rejected |
-| --- | --- |
-| (a) one brief per script (13 briefs) | Splits #2 across `collections`-columns vs `collection_permissions` vs `users.is_pending` artificially. Pads review surface 2x. |
-| (c) one DDL + one DML + one verification brief (3 briefs) | A single DDL brief would be a 500+ LOC mega-migration. Hard to review, hard to rollback. |
-| (d) single PR | Missed-DDL count >> 1; rejected by spec. |
-
-### D2 — Idempotency pattern: raw `pgm.sql(...)` with `IF [NOT] EXISTS` guards
-
-**Ratified: raw `pgm.sql(...)`-style SQL matching `1779853647564_initial-schema.js`'s pattern, every statement guarded with `IF NOT EXISTS` (for CREATE) or `IF EXISTS` (for DROP).**
-
-Rationale:
-1. **Style consistency.** The five existing migrations all use
-   `pgm.sql()`. Mixing `pgm.createTable()` helpers would introduce a
-   second pattern for no operational benefit.
-2. **Verbatim SQL transparency.** The reviewer can grep the new
-   migration's SQL string against the historical script's SQL string
-   and confirm byte-equivalent intent.
-3. **Idempotency.** Every CREATE / ALTER ADD COLUMN / CREATE INDEX
-   statement uses the appropriate `IF NOT EXISTS` guard so re-running
-   against prod is a documented no-op. CHECK constraints don't accept
-   `IF NOT EXISTS` directly — wrap in a `DO $$ BEGIN ... EXCEPTION
-   WHEN duplicate_object THEN NULL; END $$;` block (matching the
-   historical script's try/catch pattern).
-
-`node-pg-migrate` helpers (`pgm.createTable`, `pgm.addColumns`) would
-work fine technically, but the existing migration corpus is 100% raw
-SQL. Optimize for review uniformity.
-
-### D3 — Drift detection: option (a) — assume change is in prod, add a migration to bring fresh envs to parity
-
-**Ratified: (a) with a documented "evidence" trail per script in the Inventory section above.**
-
-For every script in the **M** classification, the assumption is that
-the script ran successfully against prod at some point and its DDL is
-now baked into the prod schema. Evidence supporting this assumption:
-
-- `docs/SCHEMA_MAP.md` (last reviewed 2026-05-22) documents all of these
-  columns/tables as live.
-- Runtime code in `pages/api/**` reads/writes `user_favorites`,
-  `collection_permissions`, `collection_activity`, `user_settings`,
-  `user_avatars`, `users.first_name`, `users.username`, `users.bio`,
-  `users.avatar_url`, `users.theme`, `users.language`,
-  `collections.visibility`, `collections.tcg`, `collections.tags`,
-  `collections.slug`, `collections.image` — confirmed via grep
-  (`pages/api/user/settings.js`, `pages/api/user/profile.js`,
-  `pages/api/favorites.js`, `pages/api/invite/{accept,decline}.js`,
-  `pages/api/collections/[identifier]/permissions.js`, etc.).
-- Each historical script is itself idempotent (`ADD COLUMN IF NOT
-  EXISTS`), so prod-vs-fresh divergence is the live state.
-
-For Finding 1 (UNIQUE constraint conflict), Finding 4 (system-coll
-backfill), and Finding 5 (seed wipes): per the recommendation in the
-parent prompt, halt-and-ask is reserved for destructive changes. (1)
-qualifies (DROP CONSTRAINT) → halt-and-ask. (4) is operationally
-benign (no DROP) → defer to follow-up. (5) is destructive but the
-recommended choice is "don't fold into migrations at all" — D4 below.
-
-### D4 — Seed scripts: option (a) — leave alone
-
-**Ratified: dev-fixture seed scripts stay out of the migration history.**
-
-`seed-collections-alice-bob.js` and `seed-collections-with-cards.js`
-are dev-fixture loaders tied to `alice@tcgvault.com` /
-`bob@tcgvault.com` (which only exist in `scripts/create-test-users.js`,
-gated post-`purge-weak-creds-from-helpers` behind `TEST_USERS_PASSWORD`).
-They:
-
-- Wipe destructive collection data (incompatible with any env with real users).
-- Reference Disney/Lorcana sample art URLs (`example.com/elsa.jpg`).
-- Are clearly UI-demo fodder.
-
-They have no place in `setup-db`'s migrate pipeline. They will be
-retired (or moved to `scripts/historical/`) by the queued
-`retire-graveyard-scripts-after-audit` convoy.
-
-If multiple developers feel friction managing dev-fixture state in
-the future, surface a separate `consolidate-dev-seeds` follow-up
-that designs a non-destructive `npm run seed:dev` flow keyed off a
-fresh DB. Not surfaced from this convoy because no friction has been
-reported yet.
-
-### D5 — Verification: option (a) — manual operator runbook
-
-**Ratified: post-merge manual verification by spinning up a fresh
-Neon branch + running `npm run setup-db` + diffing schema against
-prod.**
-
-Automated CI verification belongs to the queued `wire-migrate-into-ci`
-convoy and is out of scope here. The manual runbook will live in this
-convoy file's "Verification plan" section (below) and be promoted to
-`docs/operations/RECONCILE-VERIFICATION.md` by B7.
-
-### D6 — `scripts/migrations/2026-05-24-rename-admin-email.js`: option (b) — leave where it is
-
-**Ratified: do not move into `migrations/`.**
-
-The lone pre-tool migration sits at `scripts/migrations/2026-05-24-rename-admin-email.js`
-and was applied to every long-lived env at `pick-a-name` time
-(2026-05-24). Moving it into `migrations/` would require backfilling a
-`pgmigrations` row on every existing env, which is operationally
-risky for zero functional benefit (the migration is already applied;
-the runtime never re-checks it).
-
-For fresh envs, the migration is a no-op (the seed admin row is
-already created at `admin@deckhearth.com` by post-rename
-`scripts/setup-neon-db.js`; there's no `@tcgvault.com` row to rename).
-
-Document the rationale in B7's `docs/SCHEMA_MAP.md` update + a brief
-note in AGENTS.md Gotcha #4's "Rotation script" subsection. If a
-future fresh-env onboarding ever tries to roll back to pre-rename
-state, surface `fold-rename-admin-email-into-migrations` as a
-follow-up.
-
-### D7 — `pgmigrations` table state on fresh envs: no special handling required
-
-**Ratified: rely on `node-pg-migrate`'s standard sequential apply.**
-
-On a fresh Neon branch, `npm run migrate up` will run all migrations
-in timestamp order:
-
-1. `1779853647564_initial-schema` (7 bootstrap tables)
-2. `1779853647565_add-pg-trgm-card-name-index`
-3. `1779853647566_add-scan-tables`
-4. `1779908094455_add-user-cards-scan-image-url`
-5. `1780378340194_system-collection-description`
-6. **NEW: B1** — cards columns (quantity, favorited)
-7. **NEW: B2** — collections columns (visibility, tcg, tags, slug, slug index/constraint, image)
-8. **NEW: B3** — collaboration tables (collection_permissions, collection_activity, users.is_pending, 4 indexes)
-9. **NEW: B4** — favorites system (user_favorites + 4 indexes)
-10. **NEW: B5** — user profile reconciliation (15 ALTER-ADD-COLUMN + 2 CREATE TABLE + 6 CHECK + 6 indexes)
-
-Each new migration is additive against the post-initial-schema state
-that prior migrations leave behind; no inter-migration dependencies
-crossed within this convoy.
-
-Audited ordering risks for the new migrations:
-
-- B1 depends on `cards` (initial-schema) ✅
-- B2 depends on `collections` (initial-schema) ✅
-- B3 depends on `collections` + `users` (initial-schema) ✅
-- B4 depends on `users` (initial-schema) ✅
-- B5 depends on `users` (initial-schema) ✅
-
-For long-lived envs that already have all post-historical columns:
-every new migration is a documented no-op due to `IF NOT EXISTS`
-guards. The only state change is the `pgmigrations` row insertion.
-
-## Brief outline
-
-Six implementer briefs. Each B1-B5 ships exactly one new file under
-`migrations/<timestamp>_<slug>.js`. B7 updates docs only. Implementer
-briefs are drafted under `.convoys/reconcile-historical-add-scripts/brief-<N>-<slug>.md`.
-
-| Brief | Title | Files (new) | Depends on | Est. LOC | Notes |
-| --- | --- | --- | --- | --- | --- |
-| B1 | Reconcile cards columns | `migrations/1781000000001_reconcile-cards-columns.js` | — | ~40 | Captures script #1; script #7 already captured by initial-schema (verify & document in PR body) |
-| B2 | Reconcile collections columns | `migrations/1781000000002_reconcile-collections-columns.js` | — | ~120 | Captures #2 (collections half: visibility/tcg/tags), #3 (slug + index + CHECK), #5 (image). Defer slug backfill DML — generating slugs on a fresh env is moot. |
-| B3 | Reconcile collaboration tables | `migrations/1781000000003_reconcile-collaboration-tables.js` | — | ~130 | Captures #2 (collaboration half: collection_permissions, collection_activity, users.is_pending, 4 indexes). Defer owner-permission backfill DML — fresh envs have no pre-existing collections needing backfill. |
-| B4 | Reconcile favorites system | `migrations/1781000000004_reconcile-favorites-system.js` | — | ~50 | Captures #4 (user_favorites + 4 indexes). |
-| B5 | Reconcile user profile | `migrations/1781000000005_reconcile-user-profile.js` | — | ~250 | Captures #8 ∪ #9 (deduplicated; both add columns coexist in prod). Includes user_settings, user_avatars, 6 CHECK constraints (wrapped in `DO $$ EXCEPTION` blocks for idempotency), 6 indexes. Defer defaults-backfill UPDATE — column DEFAULTs handle it. |
-| ~~B6~~ | ~~Reconcile user_cards / collection_cards UNIQUE constraints~~ | ~~removed~~ | — | 0 | **REMOVED 2026-06-14 — Finding 1 RESOLVED as Outcome A.** The strict 2-col `UNIQUE(user_id, card_id)` is not present on prod; the canonical 3-col tuple is already on fresh envs via `initial-schema`. Documented in Drift Finding 1 + B7's SCHEMA_MAP update; no migration written. |
-| B7 | Documentation + verification | `docs/SCHEMA_MAP.md` (update); `docs/MIGRATION_VERIFICATION_RUNBOOK.md` (new); `AGENTS.md` (Gotcha #6 audit); `.convoys/ship-readiness.md` (flip queued entry) | B1-B5 merged | ~150 | SCHEMA_MAP smell-list updates per Findings 1-3. Verification runbook (see § Verification plan below). AGENTS.md Gotcha #6 already RESOLVED post-migration-tool; verify and leave alone if accurate. ship-readiness.md "Queued convoys" → flip this convoy entry to RESOLVED + unblock `retire-graveyard-scripts-after-audit` + add `unify-user-avatar-column` + `drop-dead-cards-columns` follow-ups. |
-
-Per-brief acceptance criteria (sketch — formalized in each brief file):
-
-- Each migration file has a `down()` that **throws** with a clear message
-  (these are reconciliation migrations; the prod schema state is the
-  source of truth and rolling back would create inconsistency).
-- Each migration's SQL is **byte-equivalent in intent** to the
-  historical script's SQL (per-statement comments cite the script
-  and line range).
-- Re-running `npm run migrate up` against any current long-lived env
-  is a no-op (all guards trigger).
-- `npm run migrate up` against a fresh Neon branch followed by the
-  verification runbook (D5) confirms structural parity with prod.
-
-### Slice dependencies (multitask-ready)
-
-```yaml
-slice_dependencies:
-  - brief: 1
-    depends_on: []
-    files: [migrations/1781000000001_reconcile-cards-columns.js]
-  - brief: 2
-    depends_on: []
-    files: [migrations/1781000000002_reconcile-collections-columns.js]
-  - brief: 3
-    depends_on: []
-    files: [migrations/1781000000003_reconcile-collaboration-tables.js]
-  - brief: 4
-    depends_on: []
-    files: [migrations/1781000000004_reconcile-favorites-system.js]
-  - brief: 5
-    depends_on: []
-    files: [migrations/1781000000005_reconcile-user-profile.js]
-  # brief 6 removed — Finding 1 RESOLVED as Outcome A; timestamp 1781000000006 is unused
-  - brief: 7
-    depends_on: [1, 2, 3, 4, 5]
-    files:
-      - docs/SCHEMA_MAP.md
-      - docs/MIGRATION_VERIFICATION_RUNBOOK.md
-      - AGENTS.md
-      - .convoys/ship-readiness.md
-```
-
-**Timestamp coordination.** Each B1-B5 writes a
-`migrations/<timestamp>_*.js` file with a pre-assigned timestamp
-(reservation token, not literal `Date.now()`). Pre-assigned
-timestamps avoid the parallel-implementer collision risk documented
-in `scaffold-nextjs-app` retro recommendation #4. The brief frontmatter
-in each `.convoys/reconcile-historical-add-scripts/brief-<N>-*.md`
-file declares the exact path; implementers MUST use that exact
-filename (not `npm run migrate create`, which would `Date.now()`).
-
-## Verification plan (D5 operator runbook)
-
-To verify the reconstructed migration history produces parity with
-prod, after B1-B6 merge:
-
-```bash
-# 1. Snapshot prod's structural shape (run against prod POSTGRES_URL)
-#    Schema-only dump, no data, no owner/ACL noise
-POSTGRES_URL=<prod-url> pg_dump --schema-only --no-owner --no-acl \
-  --schema=public > /tmp/prod-schema.sql
-
-# 2. Create a clean Neon branch from EMPTY (no parent branch) and onboard via setup-db
-#    (use the Neon dashboard or `neon branches create --empty`)
-POSTGRES_URL=<fresh-branch-url> \
-ADMIN_INITIAL_PASSWORD=$(openssl rand -base64 24) \
-  npm run setup-db
-
-# 3. Snapshot the fresh branch's structural shape
-POSTGRES_URL=<fresh-branch-url> pg_dump --schema-only --no-owner --no-acl \
-  --schema=public > /tmp/fresh-schema.sql
-
-# 4. Diff. Expected differences are limited to:
-#    - constraint/index NAME differences (autogen tuple-UNIQUE names vs explicit names)
-#    - column-ORDER differences (prod has columns in historical-script-ALTER order;
-#      fresh envs have them in migration-order)
-#    Both are semantically irrelevant. Material differences = bug; flag and reopen.
-diff <(sort /tmp/prod-schema.sql) <(sort /tmp/fresh-schema.sql)
-```
-
-Supplementary information-schema spot-checks for the highest-risk surfaces:
-
-```sql
--- Every column on every table
-SELECT table_name, column_name, data_type, is_nullable, column_default
-FROM information_schema.columns
-WHERE table_schema = 'public'
-ORDER BY table_name, ordinal_position;
-
--- Every constraint
-SELECT table_name, constraint_name, constraint_type
-FROM information_schema.table_constraints
-WHERE table_schema = 'public'
-ORDER BY table_name, constraint_name;
-
--- Every index
-SELECT tablename, indexname, indexdef
-FROM pg_indexes
-WHERE schemaname = 'public'
-ORDER BY tablename, indexname;
-```
-
-Run both against prod and fresh-branch; the column-count + constraint-count
-+ index-count totals should match exactly. Mismatch = bug.
-
-B7 will move this runbook to `docs/operations/RECONCILE-VERIFICATION.md`
-and link it from `AGENTS.md` Gotcha #6 + `migration-tool` § R1's
-"resolved-by" note.
-
-## Risks
-
-### R1 — Missed DDL that is NOT actually in prod ("ghost migration")
-
-The assumption (D3) is that every historical script ran successfully
-against every long-lived env. If a script in fact failed silently
-mid-execution on prod (e.g. `add-collaboration-features.js`'s
-`CREATE INDEX idx_collections_visibility` errored partway through),
-prod might not actually have that index even though SCHEMA_MAP says
-it does.
-
-**Mitigation:** the verification plan (D5) catches this. The fresh-env
-`pg_dump` would contain the index; prod's `pg_dump` would not; the
-diff would surface it. If found, operator decides: (a) the script's
-intent was sound, apply the missed DDL to prod manually with
-`POSTGRES_URL=<prod> psql -c "CREATE INDEX IF NOT EXISTS ..."`; or
-(b) the index is unwanted, drop it from the new migration and document.
-
-### R2 — `pgmigrations` row state on existing prod envs
-
-After this convoy merges, an operator running `npm run migrate up`
-against prod will see 6 new migrations apply (B1-B6) as no-ops (every
-guarded statement triggers `IF [NOT] EXISTS`-skip). Six new
-`pgmigrations` rows record successful application.
-
-If for some reason a long-lived prod env genuinely lacks one of the
-historical-script columns (Risk R1 above), the corresponding migration
-will **add** that column on apply, no-op-ing the others. The
-`pgmigrations` row records success; subsequent applies are no-ops.
-This is the correct behavior, but the operator should run the
-verification plan post-apply to confirm.
-
-**Mitigation:** the verification plan covers prod-vs-fresh diff after
-B1-B6 land. Run it once on each prod-shaped env immediately after
-merge.
-
-### R3 — Ordering: new migration depends on prior schema-state that doesn't exist at its execution point
-
-Audited in D7. All B1-B6 dependencies on prior tables (`cards`,
-`collections`, `users`, `user_cards`, `collection_cards`) are
-satisfied by `initial-schema` (timestamp `1779853647564`, runs first
-on fresh envs). No B-to-B inter-dependency required.
-
-### R4 — Seed scripts depend on test users that don't exist on fresh envs
-
-Out of scope (D4). The two seed scripts are dev fixtures and are not
-folded into migrations. Test users (`alice@`, `bob@`) are managed by
-`scripts/create-test-users.js` (post-`purge-weak-creds-from-helpers`,
-gated behind `TEST_USERS_PASSWORD`). Surface as `consolidate-dev-seeds`
-follow-up only if a developer reports friction.
-
-### R5 — CHECK constraint reapplication on prod is loud
-
-`add-user-profile-fields.js` wraps each CHECK constraint ADD in a
-JS try/catch that swallows `already exists` errors. Postgres doesn't
-accept `ADD CONSTRAINT ... IF NOT EXISTS` for CHECK; the SQL has to be
-wrapped in `DO $$ ... EXCEPTION WHEN duplicate_object THEN NULL END
-$$;`. B5's migration must use the exception-handling form so reapply
-against prod is silent. Implementer brief will spell this out.
-
-### R6 — Mid-convoy timestamp collision when implementers spawn in parallel
-
-B1-B5 are mutually independent and can dispatch via `/multitask`.
-Pre-assigned timestamps (D7 table) avoid the `Date.now()`-collision
-risk that bit the `scaffold-nextjs-app` convoy. Each implementer
-brief will name its file's exact timestamp; deviations require a
-re-plan.
-
-### R7 — Operator approval lag on Finding 1 (RESOLVED 2026-06-14)
-
-Originally a risk because B6 was gated on operator decision. Finding 1
-RESOLVED as Outcome A; B6 removed. No lag risk remains.
-
-## Follow-ups
-
-Surfaced by this convoy:
-
-- **`retire-graveyard-scripts-after-audit`** (priority: **P3 polish — now
-  UNBLOCKED** once this convoy lands). Once B1-B6 capture every
-  missed historical DDL into the migration history, the 13 historical
-  scripts can be safely deleted or moved to `scripts/historical/` and
-  the corresponding no-go-zones rule line can be removed. Documented
-  in `.convoys/migration-tool.md` § Follow-ups; ship-readiness.md
-  "Queued convoys" entry; AGENTS.md Gotcha #6 cross-reference.
-- **`wire-migrate-into-ci`** (priority: P2 CI infra — pre-existing).
-  Adds a CI job that runs `npm run migrate up` against a test DB on
-  every PR. This convoy's verification plan (D5) is the manual
-  precursor; the CI job is the automation upgrade. Already on the
-  follow-up list per `migration-tool` § Follow-ups + ship-readiness.md
-  "Queued convoys".
-- **`unify-user-avatar-column`** (priority: P3 hygiene — NEW). Driven
-  by Finding 2. Two redundant TEXT columns
-  (`users.profile_image_url` and `users.avatar_url`) coexist; pick one
-  canonical column, migrate the other's data, drop the loser, update
-  runtime readers. Requires a query-trace audit first.
-- **`drop-dead-cards-columns`** (priority: P3 hygiene — NEW). Driven
-  by Finding 3. `cards.quantity` and `cards.favorited` are documented
-  as unused. After a query-trace audit confirms zero readers, ship a
-  migration that DROPs them (with proper `down()` recreate).
-- ~~**`add-system-collection-on-register`**~~ — **WITHDRAWN 2026-06-14**, Finding 4 RESOLVED. Verified the register hook exists at `pages/api/auth/register.js:97-119`.
-- **`fold-rename-admin-email-into-migrations`** (priority: P3 polish,
-  conditional — NEW per D6). Only surface if a future fresh-env
-  onboarding needs the rename migration applied in order. Until then,
-  the script-shaped migration at
-  `scripts/migrations/2026-05-24-rename-admin-email.js` is left in
-  place per D6.
-- ~~**`unify-user-cards-foil-tracking`**~~ — **WITHDRAWN 2026-06-14**, Finding 1 RESOLVED as Outcome A (not Outcome B). The 3-col tuple stays canonical; no foil-tracking redesign needed.
-
-Not surfaced (no friction yet):
-
-- `consolidate-dev-seeds` — D4 noted this can wait until multiple
-  developers report friction with the current per-script dev-fixture
-  loaders.
-
-## As-shipped
-
-Six implementer briefs (B1–B6) landed between 2026-06-14 and 2026-07-06.
-Brief 7 (documentation + verification runbook) closed the convoy on
-2026-08-15 — a post-hoc docs-only pass delayed by an operator-initiated
-pause on a self-hosted runner infra issue that did not affect migration
-content correctness.
-
-### Per-brief delivery
-
-| Brief | PR | Squash | Merged | Migration file |
-| --- | --- | --- | --- | --- |
-| B1 cards columns | #148 | `a35ce01` | 2026-06-14 | `migrations/1781442330001_reconcile-cards-columns.js` |
-| B2 collections columns | #150 | `e8619c5` | 2026-06-14 | `migrations/1781442330002_reconcile-collections-columns.js` |
-| B3 collaboration tables | #151 | `15e02ee` | 2026-07-06 | `migrations/1781000000003_reconcile-collaboration-tables.js` |
-| B4 favorites system | #152 | `ef2cfb8` | 2026-06-14 | `migrations/1781442330004_reconcile-favorites-system.js` |
-| B5 user profile | #153 | `ee7da9a` | 2026-06-14 | `migrations/1781442330005_reconcile-user-profile.js` |
-| B6 user_cards UNIQUE | #149 | `40402eb` | 2026-06-14 | `migrations/1781442330006_reconcile-user-cards-unique.js` |
-| B7 docs + runbook | _(this PR)_ | — | 2026-08-15 | _(no migration — docs only)_ |
-
-All six implementer PRs were green at merge on the (then-flaky) self-hosted
-axiom runner pool.
-
-### Reservation-timestamp rename (`ec9bb2b`)
-
-The architect pre-assigned timestamps `1781000000001` through
-`1781000000006` to avoid `Date.now()` collisions during parallel
-implementer dispatch. Commit `ec9bb2b` (`feat(catalog): unified multi-game
-bulk sync + schema map update`) renamed all except B3 to
-`1781442330001`–`1781442330006` so they run **after** the catalog-sync
-migrations that landed in the same period:
-
-- `1781440700404_add-scryfall-bulk-columns`
-- `1781440721350_add-tagger-tables`
-- `1781442175729_normalize-lorcana-set-codes`
-- `1781442329511_add-catalog-sync-log`
-
-B3 kept its original `1781000000003` timestamp because it merged after the
-rename commit. The rename is filename-only; migration `up()` content is
-identical.
-
-### B6 deviation from architect plan
-
-The architect's gate-1 plan collapsed Finding 1 (Outcome A) into B7 as a
-doc-only note. Implementers shipped B6 anyway as a tiny belt-and-suspenders
-migration (`1781442330006_reconcile-user-cards-unique.js`) that:
-
-- Confirms the canonical 3-column `UNIQUE(user_id, card_id, is_foil)` from
-  `initial-schema` is present.
-- Drops the historical 2-column `user_cards_user_card_unique` constraint if
-  any env ran `fix-user-cards-constraints.js`.
-
-The migration is a no-op on prod (Outcome A already holds) but guards
-future envs that might have the stricter 2-col variant.
-
-### Verification
-
-Manual operator runbook for confirming fresh-env vs prod schema parity:
-[`docs/MIGRATION_VERIFICATION_RUNBOOK.md`](../docs/MIGRATION_VERIFICATION_RUNBOOK.md)
-(per architect Decision D5). Automated CI verification remains queued as
-`wire-migrate-into-ci`.
-
-### B7 deviation from spec
-
-B7 shipped ~2 months post-hoc (2026-08-15) rather than immediately after
-B1–B6. The delay was operator-initiated (runner-infra pause) and did not
-block migration correctness — only documentation closure.

.convoys/reconcile-historical-add-scripts/brief-1-reconcile-cards-columns.md

@@ -1,228 +0,0 @@
----
-convoy: reconcile-historical-add-scripts
-brief_number: 1
-depends_on: []
-files:
-  - migrations/1781000000001_reconcile-cards-columns.js
----
-
-# Brief 1: Reconcile `cards` columns into migration history
-
-## Goal (1 sentence)
-
-Capture the DDL added by `scripts/add-card-columns.js` (the `cards.quantity` + `cards.favorited` columns) into a single new `node-pg-migrate` migration so a brand-new Neon branch ends up with both columns after `npm run setup-db`.
-
-## Scope (files in scope — do not edit anything else)
-
-- `migrations/1781000000001_reconcile-cards-columns.js` — **new**
-
-## Source script (read-only audit reference; DO NOT EDIT — no-go-zone)
-
-`scripts/add-card-columns.js` lines 22-33 (verbatim):
-
-```js
-await sql`
-  ALTER TABLE cards 
-  ADD COLUMN IF NOT EXISTS quantity INTEGER DEFAULT 0
-`;
-// ...
-await sql`
-  ALTER TABLE cards 
-  ADD COLUMN IF NOT EXISTS favorited BOOLEAN DEFAULT false
-`;
-```
-
-**Sibling script `scripts/add-updated-at-column.js`** is already captured by `migrations/1779853647564_initial-schema.js` (the `cards` `CREATE TABLE` at lines 45-69 already declares `updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP`). Do NOT add an ALTER for `updated_at` — it would be redundant noise on `pgmigrations`. Mention this in the PR body so reviewers don't ask.
-
-## Target migration file
-
-Path: `migrations/1781000000001_reconcile-cards-columns.js`
-
-Contents:
-
-```js
-/**
- * Reconcile historical `scripts/add-card-columns.js` into the migration
- * history. Adds `cards.quantity` and `cards.favorited` columns so a
- * brand-new Neon branch ends up with the same shape that prod has had
- * since the historical script's one-shot run.
- *
- * Both columns are flagged as **unused** in docs/SCHEMA_MAP.md
- * § "Known schema smells" #3 — `quantity` lives on `user_cards`,
- * `favorited` lives on `user_favorites`. They're added here for
- * fresh-env parity with prod. A follow-up `drop-dead-cards-columns`
- * convoy (queued, P3 hygiene) will drop both columns once a query-trace
- * audit confirms zero runtime readers.
- *
- * Idempotent: re-running against any long-lived prod env is a no-op
- * because both ALTERs use IF NOT EXISTS.
- *
- * Note: `scripts/add-updated-at-column.js` (the sibling historical
- * script in the same convoy) is NOT reconciled here because
- * `cards.updated_at` is already declared in
- * `migrations/1779853647564_initial-schema.js`'s `CREATE TABLE cards`
- * (line 67). No further work needed for that script.
- *
- * @type {import('node-pg-migrate').ColumnDefinitions | undefined}
- */
-export const shorthands = undefined;
-
-/**
- * @param {import('node-pg-migrate').MigrationBuilder} pgm
- */
-export const up = (pgm) => {
-  pgm.sql(`
-    ALTER TABLE cards
-      ADD COLUMN IF NOT EXISTS quantity INTEGER DEFAULT 0;
-
-    ALTER TABLE cards
-      ADD COLUMN IF NOT EXISTS favorited BOOLEAN DEFAULT false;
-  `);
-};
-
-/**
- * Down-migration intentionally throws. Dropping these columns on
- * long-lived envs requires the `drop-dead-cards-columns` convoy's
- * query-trace audit — bypassing it via a casual rollback risks
- * dropping data on prod. Use `drop-dead-cards-columns` when ready.
- *
- * @returns {void}
- */
-export const down = () => {
-  throw new Error(
-    '[migration:1781000000001_reconcile-cards-columns] Down not supported. ' +
-      'Dropping cards.quantity / cards.favorited belongs to the queued ' +
-      'drop-dead-cards-columns convoy, which performs a query-trace audit ' +
-      'before the DROP. Do not rollback this migration directly.'
-  );
-};
-```
-
-## Conventions to follow
-
-- `.cursor/rules/db-and-schema.mdc` § "Schema source of truth" — `migrations/` is the canonical home for schema changes; one column-group per migration.
-- `.cursor/rules/no-go-zones.mdc` — `scripts/add-card-columns.js` is append-only history. **Do not edit it.**
-- Style: match the existing migrations under `migrations/`. Use raw `pgm.sql(...)` template literals (the `migration-tool` convoy ratified this in D2 of `.convoys/reconcile-historical-add-scripts.md`).
-- ESM exports (`export const up = ...`, `export const down = ...`); no `module.exports`. The repo is `"type": "module"` per `package.json` line 5.
-- Use `IF NOT EXISTS` on every ALTER — idempotent re-apply is a documented requirement of this convoy.
-- Add a JSDoc docstring at the top of the file explaining what's being reconciled, citing the source script + the convoy file.
-
-## Acceptance criteria
-
-- [ ] `migrations/1781000000001_reconcile-cards-columns.js` exists with the exact filename above (the timestamp `1781000000001` is the reservation token assigned by the architect — do NOT use `npm run migrate create`, which would call `Date.now()` and assign a different timestamp).
-- [ ] The file's `up()` adds both columns via `IF NOT EXISTS`.
-- [ ] The file's `down()` throws with a clear message pointing at the `drop-dead-cards-columns` follow-up.
-- [ ] The file's docstring cites `scripts/add-card-columns.js` and `.convoys/reconcile-historical-add-scripts.md`.
-- [ ] `node --check migrations/1781000000001_reconcile-cards-columns.js` passes (syntactic validity).
-- [ ] `node -e "import('./migrations/1781000000001_reconcile-cards-columns.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined` (module loads cleanly).
-- [ ] `npm run lint` exits clean against the baseline (no new lint errors introduced by this file).
-- [ ] `npm run test:run` reports 21/21 passing (no test surface changes).
-- [ ] The PR body documents that `add-updated-at-column.js` is already captured by `initial-schema` (per the source-script section above) and explains why no second migration is added.
-
-## Verification
-
-Run the following from the convoy worktree (`tcg-vault-worktrees/reconcile-historical-add-scripts/`) BEFORE opening the PR:
-
-```bash
-node --check migrations/1781000000001_reconcile-cards-columns.js
-node -e "import('./migrations/1781000000001_reconcile-cards-columns.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"
-npm run lint
-npm run test:run
-```
-
-Expected:
-- `node --check` exits 0 with no output.
-- The `node -e` line prints exactly: `function function undefined`.
-- `npm run lint` matches the existing baseline (no new errors).
-- `npm run test:run` reports 21/21 tests passing.
-
-**Do NOT** run `npm run migrate up` against any environment as part of this brief — that's a post-merge operator step covered by Brief 7's verification runbook.
-
-## Commit message
-
-```
-feat(migrations): reconcile add-card-columns into migration history (brief 1/7)
-
-Captures the DDL effect of scripts/add-card-columns.js (cards.quantity
-+ cards.favorited columns) into a new node-pg-migrate migration. Both
-columns are flagged as unused in docs/SCHEMA_MAP.md § "Known schema
-smells" #3 — added here for fresh-env parity with prod; a follow-up
-drop-dead-cards-columns convoy will drop them after a query-trace
-audit.
-
-Sibling script add-updated-at-column.js is already captured by
-migrations/1779853647564_initial-schema.js (cards.updated_at is in the
-CREATE TABLE); no second migration needed.
-
-Per .convoys/reconcile-historical-add-scripts.md § Brief outline → B1.
-Idempotent re-apply (IF NOT EXISTS guards).
-```
-
-## PR shape
-
-**Title:** `feat(migrations): reconcile add-card-columns into migration history (brief 1/7)`
-
-**Body template:**
-
-```markdown
-Brief 1 of the `reconcile-historical-add-scripts` convoy. See
-[`.convoys/reconcile-historical-add-scripts.md`](../.convoys/reconcile-historical-add-scripts.md)
-for the full plan and rationale.
-
-## What this PR does
-
-Adds `migrations/1781000000001_reconcile-cards-columns.js` — a new
-`node-pg-migrate` migration that adds two columns to `cards` via
-`ADD COLUMN IF NOT EXISTS`:
-
-- `quantity INTEGER DEFAULT 0`
-- `favorited BOOLEAN DEFAULT false`
-
-Both columns already exist in long-lived prod environments (added by
-the historical `scripts/add-card-columns.js`). This migration brings
-fresh Neon branches to parity so `npm install` → `npm run setup-db`
-alone produces the prod shape, without manually replaying historical
-scripts.
-
-## What this PR does NOT do
-
-- Does **NOT** edit `scripts/add-card-columns.js` (no-go-zone).
-- Does **NOT** add a migration for `scripts/add-updated-at-column.js`
-  — `cards.updated_at` is already declared in
-  `migrations/1779853647564_initial-schema.js` line 67.
-- Does **NOT** edit `scripts/setup-neon-db.js`, `package.json`, README,
-  or AGENTS.md.
-- Does **NOT** run `npm run migrate up` against any environment (that's
-  the post-merge operator step covered by Brief 7's runbook).
-- Does **NOT** drop the columns (deferred to follow-up
-  `drop-dead-cards-columns`).
-
-## Verification checklist
-
-- [ ] `node --check migrations/1781000000001_reconcile-cards-columns.js` exits 0
-- [ ] `node -e "import('./migrations/1781000000001_reconcile-cards-columns.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`
-- [ ] `npm run lint` matches baseline (no new errors)
-- [ ] `npm run test:run` reports 21/21 passing
-- [ ] Did not run `npm run migrate up` against any environment in this PR
-- [ ] Operator post-merge: run the verification runbook from Brief 7 (`docs/MIGRATION_VERIFICATION_RUNBOOK.md` once it lands)
-
-## Cross-references
-
-- Convoy file: `.convoys/reconcile-historical-add-scripts.md`
-- Source script (no-go-zone, audit reference only): `scripts/add-card-columns.js`
-- Follow-up after this convoy lands: `drop-dead-cards-columns` (P3 hygiene)
-```
-
-## DO NOT
-
-- DO NOT edit `scripts/add-card-columns.js` or any other file under `scripts/` — append-only no-go-zone per `.cursor/rules/no-go-zones.mdc`.
-- DO NOT edit any other file under `migrations/` — each migration is pinned by its `pgmigrations` row.
-- DO NOT edit `scripts/setup-neon-db.js`.
-- DO NOT edit `package.json` (no new deps).
-- DO NOT edit `AGENTS.md` or `docs/SCHEMA_MAP.md` — that's Brief 7's job.
-- DO NOT run `npm run migrate up` against any environment.
-- DO NOT call `npm run migrate create` to scaffold the file — it uses `Date.now()` for the timestamp prefix, which would collide with the architect's pre-assigned reservation tokens for parallel briefs.
-
-## Rationale (≤3 sentences)
-
-Capturing `cards.quantity` + `cards.favorited` in a single small migration matches the per-table grouping of the convoy's D1 decision and keeps the diff easy to review. Sibling `add-updated-at-column.js` is already captured by `initial-schema`, so reconciling it would create a `pgmigrations` row for zero functional benefit. The columns themselves are dead per SCHEMA_MAP smell #3, but parity with prod is the convoy's success metric — the actual DROP is the `drop-dead-cards-columns` follow-up's responsibility.

.convoys/reconcile-historical-add-scripts/brief-2-reconcile-collections-columns.md

@@ -1,307 +0,0 @@
----
-convoy: reconcile-historical-add-scripts
-brief_number: 2
-depends_on: []
-files:
-  - migrations/1781000000002_reconcile-collections-columns.js
----
-
-# Brief 2: Reconcile `collections` columns into migration history
-
-## Goal (1 sentence)
-
-Capture the `collections`-table DDL added by three historical scripts (`add-collaboration-features.js` columns half, `add-collection-slugs.js`, `add-image-column.js`) into a single new `node-pg-migrate` migration so a brand-new Neon branch ends up with `visibility`, `tcg`, `tags`, `slug` (+ index + CHECK constraint), and `image` columns on `collections` after `npm run setup-db`.
-
-## Scope (files in scope — do not edit anything else)
-
-- `migrations/1781000000002_reconcile-collections-columns.js` — **new**
-
-## Source scripts (read-only audit reference; DO NOT EDIT — all three are no-go-zones)
-
-### `scripts/add-collaboration-features.js` lines 15-20 (collections half only — the `collection_permissions` / `collection_activity` / `users.is_pending` half is Brief 3's scope):
-
-```js
-await sql`
-  ALTER TABLE collections 
-  ADD COLUMN IF NOT EXISTS visibility VARCHAR(20) DEFAULT 'private',
-  ADD COLUMN IF NOT EXISTS tcg VARCHAR(50) DEFAULT 'MTG',
-  ADD COLUMN IF NOT EXISTS tags TEXT
-`;
-```
-
-Plus the visibility index at lines 77-80:
-
-```js
-await sql`
-  CREATE INDEX IF NOT EXISTS idx_collections_visibility 
-  ON collections(visibility)
-`;
-```
-
-### `scripts/add-collection-slugs.js` lines 17-99 (relevant DDL only):
-
-```js
-// Step 1: Add slug column
-await sql`
-  ALTER TABLE collections 
-  ADD COLUMN IF NOT EXISTS slug VARCHAR(100) UNIQUE
-`;
-
-// Step 5: Add unique index
-await sql`CREATE UNIQUE INDEX IF NOT EXISTS idx_collections_slug ON collections(slug)`;
-
-// Step 6: Add format CHECK constraint
-await sql`ALTER TABLE collections ADD CONSTRAINT check_slug_format CHECK (slug ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?$' AND length(slug) <= 50)`;
-```
-
-The script also backfills slugs via per-row UPDATE using `lib/slug-utils.js::generateUniqueSlug` (lines 41-73). **Do NOT fold the backfill DML into this migration.** Fresh envs have no pre-existing `collections` rows to backfill; on prod, the backfill ran once historically. Future migrations that need slug generation should run that logic in application code, not in a migration.
-
-### `scripts/add-image-column.js` lines 14-17 (entire DDL):
-
-```js
-await sql`
-  ALTER TABLE collections 
-  ADD COLUMN IF NOT EXISTS image TEXT
-`;
-```
-
-## Target migration file
-
-Path: `migrations/1781000000002_reconcile-collections-columns.js`
-
-Contents:
-
-```js
-/**
- * Reconcile three historical scripts that all added columns to the
- * `collections` table:
- *
- *   - scripts/add-collaboration-features.js (visibility, tcg, tags +
- *     idx_collections_visibility index) — collections-table half only;
- *     the collection_permissions / collection_activity / users.is_pending
- *     half is reconciled by migrations/1781000000003_reconcile-collaboration-tables.js
- *   - scripts/add-collection-slugs.js (slug + idx_collections_slug
- *     unique index + check_slug_format CHECK constraint)
- *   - scripts/add-image-column.js (image)
- *
- * Grouped into one migration per D1 of .convoys/reconcile-historical-add-scripts.md
- * (one migration per table/feature surface). All historical DDL was
- * idempotent (ADD COLUMN IF NOT EXISTS / CREATE INDEX IF NOT EXISTS);
- * this migration preserves that. CHECK constraint adds via a
- * DO $$ EXCEPTION block because Postgres doesn't accept
- * ADD CONSTRAINT ... IF NOT EXISTS for CHECK.
- *
- * Per-row slug backfill DML from add-collection-slugs.js is intentionally
- * NOT folded in — fresh envs have no pre-existing collections to
- * backfill; on prod, the backfill ran once historically and is baked in.
- *
- * Notes on adjacent state:
- *   - `is_system_collection` was added by migrations/1780378340194_system-collection-description.js
- *     (and the runtime register hook at pages/api/auth/register.js:97-119
- *     creates the per-user system collection row — Finding 4 RESOLVED in
- *     .convoys/reconcile-historical-add-scripts.md).
- *
- * Two-column-visibility smell: `is_public BOOLEAN` (from initial-schema)
- * and `visibility VARCHAR(20)` (from this migration) coexist on prod.
- * Surfaced as docs/SCHEMA_MAP.md § "Known schema smells" #2 → queued
- * `unify-collection-visibility` is OUT OF SCOPE here; this migration
- * adds `visibility` for parity, nothing more.
- *
- * Idempotent re-apply: every statement uses IF NOT EXISTS or the
- * exception-swallowing DO block.
- *
- * @type {import('node-pg-migrate').ColumnDefinitions | undefined}
- */
-export const shorthands = undefined;
-
-/**
- * @param {import('node-pg-migrate').MigrationBuilder} pgm
- */
-export const up = (pgm) => {
-  pgm.sql(`
-    ALTER TABLE collections
-      ADD COLUMN IF NOT EXISTS visibility VARCHAR(20) DEFAULT 'private',
-      ADD COLUMN IF NOT EXISTS tcg VARCHAR(50) DEFAULT 'MTG',
-      ADD COLUMN IF NOT EXISTS tags TEXT,
-      ADD COLUMN IF NOT EXISTS slug VARCHAR(100) UNIQUE,
-      ADD COLUMN IF NOT EXISTS image TEXT;
-
-    CREATE INDEX IF NOT EXISTS idx_collections_visibility
-      ON collections (visibility);
-
-    CREATE UNIQUE INDEX IF NOT EXISTS idx_collections_slug
-      ON collections (slug);
-
-    DO $$
-    BEGIN
-      ALTER TABLE collections
-        ADD CONSTRAINT check_slug_format
-        CHECK (slug ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?$' AND length(slug) <= 50);
-    EXCEPTION
-      WHEN duplicate_object THEN NULL;
-    END $$;
-  `);
-};
-
-/**
- * Down-migration intentionally throws. Removing these columns on
- * long-lived envs would drop user-curated tag / slug / image data
- * and break the runtime code that reads collections.visibility,
- * collections.slug, collections.image, collections.tcg, collections.tags.
- *
- * If a future schema correction needs to mutate any of these columns,
- * write a NEW dated migration with a real `down()` — do NOT roll back
- * this one.
- *
- * @returns {void}
- */
-export const down = () => {
-  throw new Error(
-    '[migration:1781000000002_reconcile-collections-columns] Down not supported. ' +
-      'Dropping collections.visibility / tcg / tags / slug / image would erase ' +
-      'user-curated data and break runtime reads. Write a new dated migration ' +
-      'for any future schema correction.'
-  );
-};
-```
-
-## Conventions to follow
-
-- `.cursor/rules/db-and-schema.mdc` § "Schema source of truth" — one migration per table/feature surface.
-- `.cursor/rules/no-go-zones.mdc` — all three source scripts are append-only history. **Do not edit any of them.**
-- Style: raw `pgm.sql(...)` template literals, matching the other migrations under `migrations/`. Per D2 of the convoy file.
-- ESM exports; `"type": "module"` per `package.json` line 5.
-- `IF NOT EXISTS` on every ALTER and CREATE INDEX. CHECK constraint wraps in `DO $$ ... EXCEPTION WHEN duplicate_object THEN NULL END $$;` (Postgres doesn't accept `IF NOT EXISTS` directly on CHECK constraints).
-
-## Acceptance criteria
-
-- [ ] `migrations/1781000000002_reconcile-collections-columns.js` exists with the exact filename above (the timestamp `1781000000002` is the reservation token assigned by the architect — do NOT use `npm run migrate create`).
-- [ ] The file's `up()` adds 5 columns (`visibility`, `tcg`, `tags`, `slug`, `image`) via `IF NOT EXISTS`, creates 2 indexes (`idx_collections_visibility`, unique `idx_collections_slug`) via `IF NOT EXISTS`, and adds the `check_slug_format` CHECK via a `DO $$ EXCEPTION` block.
-- [ ] The file's `down()` throws with a clear message.
-- [ ] The file's docstring cites all three source scripts + the convoy file + the visibility smell (#2 in SCHEMA_MAP).
-- [ ] Per-row slug backfill DML is NOT in the migration (out of scope per the convoy plan).
-- [ ] `node --check migrations/1781000000002_reconcile-collections-columns.js` passes.
-- [ ] `node -e "import('./migrations/1781000000002_reconcile-collections-columns.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`.
-- [ ] `npm run lint` matches the baseline (no new errors).
-- [ ] `npm run test:run` reports 21/21 passing.
-
-## Verification
-
-Run from the convoy worktree BEFORE opening the PR:
-
-```bash
-node --check migrations/1781000000002_reconcile-collections-columns.js
-node -e "import('./migrations/1781000000002_reconcile-collections-columns.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"
-npm run lint
-npm run test:run
-```
-
-Expected:
-- `node --check` exits 0 silently.
-- `node -e` prints `function function undefined`.
-- `npm run lint` matches baseline.
-- `npm run test:run` reports 21/21 passing.
-
-**Do NOT** run `npm run migrate up` against any environment — that's the post-merge operator step covered by Brief 7's verification runbook.
-
-## Commit message
-
-```
-feat(migrations): reconcile collections columns into migration history (brief 2/7)
-
-Captures the DDL effect of three historical scripts into one new
-node-pg-migrate migration:
-
-  - scripts/add-collaboration-features.js (collections half: visibility,
-    tcg, tags + idx_collections_visibility)
-  - scripts/add-collection-slugs.js (slug + idx_collections_slug unique
-    + check_slug_format CHECK constraint)
-  - scripts/add-image-column.js (image)
-
-The collaboration tables half (collection_permissions, collection_activity,
-users.is_pending) is reconciled separately by Brief 3.
-
-Per-row slug backfill DML from add-collection-slugs.js is intentionally
-NOT folded in — fresh envs have no pre-existing collections to backfill.
-
-Per .convoys/reconcile-historical-add-scripts.md § Brief outline → B2.
-Idempotent re-apply (IF NOT EXISTS guards; DO $$ EXCEPTION for CHECK).
-```
-
-## PR shape
-
-**Title:** `feat(migrations): reconcile collections columns into migration history (brief 2/7)`
-
-**Body template:**
-
-```markdown
-Brief 2 of the `reconcile-historical-add-scripts` convoy. See
-[`.convoys/reconcile-historical-add-scripts.md`](../.convoys/reconcile-historical-add-scripts.md)
-for the full plan and rationale.
-
-## What this PR does
-
-Adds `migrations/1781000000002_reconcile-collections-columns.js` —
-captures the DDL effect of three historical scripts in a single new
-`node-pg-migrate` migration:
-
-- `scripts/add-collaboration-features.js` — collections columns half
-  (`visibility VARCHAR(20)`, `tcg VARCHAR(50)`, `tags TEXT`,
-  `idx_collections_visibility` index)
-- `scripts/add-collection-slugs.js` — `slug VARCHAR(100) UNIQUE`,
-  `idx_collections_slug` unique index, `check_slug_format` CHECK
-  constraint
-- `scripts/add-image-column.js` — `image TEXT`
-
-All ALTERs use `ADD COLUMN IF NOT EXISTS`. The CHECK constraint wraps
-in a `DO $$ ... EXCEPTION WHEN duplicate_object THEN NULL END $$;`
-block because Postgres doesn't accept `ADD CONSTRAINT ... IF NOT EXISTS`
-for CHECK.
-
-## What this PR does NOT do
-
-- Does **NOT** edit any of the three source scripts (no-go-zones).
-- Does **NOT** capture the collaboration tables half of
-  `add-collaboration-features.js` (`collection_permissions`,
-  `collection_activity`, `users.is_pending`, related indexes,
-  owner-permission backfill DML) — that's **Brief 3**.
-- Does **NOT** fold in the per-row slug backfill DML from
-  `add-collection-slugs.js` — fresh envs have no pre-existing
-  collections to backfill.
-- Does **NOT** unify the `is_public` / `visibility` redundancy
-  (SCHEMA_MAP smell #2) — that's a future `unify-collection-visibility`
-  follow-up.
-- Does **NOT** edit `scripts/setup-neon-db.js`, `package.json`, README,
-  or AGENTS.md.
-- Does **NOT** run `npm run migrate up` against any environment.
-
-## Verification checklist
-
-- [ ] `node --check migrations/1781000000002_reconcile-collections-columns.js` exits 0
-- [ ] `node -e "import('./migrations/1781000000002_reconcile-collections-columns.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`
-- [ ] `npm run lint` matches baseline
-- [ ] `npm run test:run` reports 21/21 passing
-- [ ] Did not run `npm run migrate up` against any environment in this PR
-
-## Cross-references
-
-- Convoy file: `.convoys/reconcile-historical-add-scripts.md`
-- Source scripts (no-go-zones, audit reference only):
-  `scripts/add-collaboration-features.js`,
-  `scripts/add-collection-slugs.js`,
-  `scripts/add-image-column.js`
-```
-
-## DO NOT
-
-- DO NOT edit `scripts/add-collaboration-features.js`, `scripts/add-collection-slugs.js`, `scripts/add-image-column.js`, or any other file under `scripts/` — append-only no-go-zone.
-- DO NOT edit any other file under `migrations/`.
-- DO NOT edit `scripts/setup-neon-db.js`, `package.json`, README, `AGENTS.md`, or `docs/SCHEMA_MAP.md` (B7 owns SCHEMA_MAP).
-- DO NOT run `npm run migrate up` against any environment.
-- DO NOT include the per-row slug backfill DML — out of scope.
-- DO NOT add work for `collection_permissions` / `collection_activity` / `users.is_pending` — that's Brief 3.
-- DO NOT call `npm run migrate create` — it would generate a `Date.now()` timestamp colliding with B1/B3/B4/B5's reservation tokens.
-
-## Rationale (≤3 sentences)
-
-Grouping all `collections`-table DDL into one migration matches the per-table grouping of D1 and keeps the diff focused on a single surface. Splitting `add-collaboration-features.js` between this brief (columns) and Brief 3 (tables) avoids creating an artificial dependency between two parallel briefs — each writes only its own new file. The CHECK-constraint exception block matches the historical script's try/catch pattern and is the idiomatic Postgres way to do idempotent CHECK adds.

.convoys/reconcile-historical-add-scripts/brief-3-reconcile-collaboration-tables.md

@@ -1,318 +0,0 @@
----
-convoy: reconcile-historical-add-scripts
-brief_number: 3
-depends_on: []
-files:
-  - migrations/1781000000003_reconcile-collaboration-tables.js
----
-
-# Brief 3: Reconcile collaboration tables into migration history
-
-## Goal (1 sentence)
-
-Capture the `collection_permissions` + `collection_activity` table creation, the `users.is_pending` column, and the 3 related indexes from `scripts/add-collaboration-features.js` into a single new `node-pg-migrate` migration so a brand-new Neon branch ends up with the collaboration / sharing surface after `npm run setup-db`.
-
-## Scope (files in scope — do not edit anything else)
-
-- `migrations/1781000000003_reconcile-collaboration-tables.js` — **new**
-
-## Source script (read-only audit reference; DO NOT EDIT — no-go-zone)
-
-`scripts/add-collaboration-features.js` lines 24-81 (relevant DDL only; the collections-columns half is reconciled by Brief 2):
-
-```js
-// collection_permissions table
-await sql`
-  CREATE TABLE IF NOT EXISTS collection_permissions (
-    id SERIAL PRIMARY KEY,
-    collection_id INTEGER REFERENCES collections(id) ON DELETE CASCADE,
-    user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
-    role VARCHAR(20) NOT NULL CHECK (role IN ('owner', 'editor', 'viewer')),
-    status VARCHAR(20) DEFAULT 'active' CHECK (status IN ('active', 'pending', 'declined')),
-    invite_token VARCHAR(255) UNIQUE,
-    invited_by INTEGER REFERENCES users(id),
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    UNIQUE(collection_id, user_id)
-  )
-`;
-
-// collection_activity table
-await sql`
-  CREATE TABLE IF NOT EXISTS collection_activity (
-    id SERIAL PRIMARY KEY,
-    collection_id INTEGER REFERENCES collections(id) ON DELETE CASCADE,
-    user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
-    action VARCHAR(50) NOT NULL,
-    details JSONB,
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-  )
-`;
-
-// users.is_pending column
-await sql`
-  ALTER TABLE users 
-  ADD COLUMN IF NOT EXISTS is_pending BOOLEAN DEFAULT false
-`;
-
-// 3 indexes (the 4th — idx_collections_visibility — is Brief 2's scope)
-await sql`
-  CREATE INDEX IF NOT EXISTS idx_collection_permissions_collection_id 
-  ON collection_permissions(collection_id)
-`;
-await sql`
-  CREATE INDEX IF NOT EXISTS idx_collection_permissions_user_id 
-  ON collection_permissions(user_id)
-`;
-await sql`
-  CREATE INDEX IF NOT EXISTS idx_collection_activity_collection_id 
-  ON collection_activity(collection_id)
-`;
-```
-
-**Owner-permission backfill DML** at lines 84-99 inserts `('owner', 'active')` rows for every pre-existing collection. **Do NOT fold the backfill DML into this migration.** Fresh envs have no pre-existing collections needing backfill; on prod, the backfill ran once historically and is baked in. The current runtime invariant for new collection creation lives in `pages/api/collections.js` (verify post-merge if needed — out of scope for this brief).
-
-## Target migration file
-
-Path: `migrations/1781000000003_reconcile-collaboration-tables.js`
-
-Contents:
-
-```js
-/**
- * Reconcile the collaboration / sharing half of
- * scripts/add-collaboration-features.js into the migration history:
- *
- *   - CREATE TABLE collection_permissions (with role/status CHECK
- *     constraints inline + invite_token UNIQUE + UNIQUE(collection_id,
- *     user_id))
- *   - CREATE TABLE collection_activity (with JSONB details column)
- *   - ALTER users ADD COLUMN is_pending BOOLEAN DEFAULT false
- *   - 3 indexes (idx_collection_permissions_collection_id,
- *     idx_collection_permissions_user_id,
- *     idx_collection_activity_collection_id)
- *
- * The 4th index from the source script (idx_collections_visibility)
- * is reconciled by migrations/1781000000002_reconcile-collections-columns.js
- * because it indexes a column added in that brief.
- *
- * The collections-columns half (visibility, tcg, tags) of
- * add-collaboration-features.js is reconciled by
- * migrations/1781000000002_reconcile-collections-columns.js.
- *
- * The owner-permission backfill DML from the source script (INSERT
- * INTO collection_permissions ... 'owner', 'active' for every
- * pre-existing collection) is intentionally NOT folded in — fresh
- * envs have no pre-existing collections to backfill; on prod, the
- * backfill ran once historically and is baked in. The runtime
- * invariant for owner-permission creation on new collections is the
- * responsibility of pages/api/collections.js (out of scope here).
- *
- * Both CREATE TABLE statements use IF NOT EXISTS, with CHECK
- * constraints declared inline (no idempotency issue — IF NOT EXISTS
- * on the parent table makes the whole CREATE a no-op when the table
- * already exists, CHECK constraints and all).
- *
- * Idempotent re-apply: every statement uses IF NOT EXISTS.
- *
- * @type {import('node-pg-migrate').ColumnDefinitions | undefined}
- */
-export const shorthands = undefined;
-
-/**
- * @param {import('node-pg-migrate').MigrationBuilder} pgm
- */
-export const up = (pgm) => {
-  pgm.sql(`
-    CREATE TABLE IF NOT EXISTS collection_permissions (
-      id SERIAL PRIMARY KEY,
-      collection_id INTEGER REFERENCES collections(id) ON DELETE CASCADE,
-      user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
-      role VARCHAR(20) NOT NULL CHECK (role IN ('owner', 'editor', 'viewer')),
-      status VARCHAR(20) DEFAULT 'active' CHECK (status IN ('active', 'pending', 'declined')),
-      invite_token VARCHAR(255) UNIQUE,
-      invited_by INTEGER REFERENCES users(id),
-      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-      UNIQUE(collection_id, user_id)
-    );
-
-    CREATE TABLE IF NOT EXISTS collection_activity (
-      id SERIAL PRIMARY KEY,
-      collection_id INTEGER REFERENCES collections(id) ON DELETE CASCADE,
-      user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
-      action VARCHAR(50) NOT NULL,
-      details JSONB,
-      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-    );
-
-    ALTER TABLE users
-      ADD COLUMN IF NOT EXISTS is_pending BOOLEAN DEFAULT false;
-
-    CREATE INDEX IF NOT EXISTS idx_collection_permissions_collection_id
-      ON collection_permissions (collection_id);
-
-    CREATE INDEX IF NOT EXISTS idx_collection_permissions_user_id
-      ON collection_permissions (user_id);
-
-    CREATE INDEX IF NOT EXISTS idx_collection_activity_collection_id
-      ON collection_activity (collection_id);
-  `);
-};
-
-/**
- * Down-migration intentionally throws. Dropping collection_permissions
- * + collection_activity on a long-lived env would erase every active
- * sharing relationship + every audit trail row. The runtime in
- * pages/api/collections/[identifier]/permissions.js, pages/api/invite/*.js,
- * and lib/permission-middleware.js all read these tables; rolling back
- * would break the live app.
- *
- * @returns {void}
- */
-export const down = () => {
-  throw new Error(
-    '[migration:1781000000003_reconcile-collaboration-tables] Down not supported. ' +
-      'Dropping collection_permissions / collection_activity would erase every ' +
-      'sharing relationship and audit trail, and break runtime reads in ' +
-      'pages/api/collections/[identifier]/permissions.js, pages/api/invite/*.js, ' +
-      'lib/permission-middleware.js. Write a new dated migration for any future ' +
-      'schema correction.'
-  );
-};
-```
-
-## Conventions to follow
-
-- `.cursor/rules/db-and-schema.mdc` § "Schema source of truth" — `migrations/` is canonical; one migration per feature surface.
-- `.cursor/rules/no-go-zones.mdc` — `scripts/add-collaboration-features.js` is append-only history. **Do not edit it.**
-- Style: raw `pgm.sql(...)` template literals matching the other migrations. Per D2.
-- ESM exports; `"type": "module"`.
-- `IF NOT EXISTS` on every CREATE / ALTER. Inline CHECK constraints on `CREATE TABLE` are fine — `CREATE TABLE IF NOT EXISTS` skips the entire statement (constraints and all) when the table exists.
-- FK declarations match the source script verbatim (`ON DELETE CASCADE` for primary FKs, `ON DELETE SET NULL` where the source uses it).
-
-## Acceptance criteria
-
-- [ ] `migrations/1781000000003_reconcile-collaboration-tables.js` exists with the exact filename above.
-- [ ] The file's `up()`:
-  - Creates `collection_permissions` table with all 10 columns + role/status CHECKs + invite_token UNIQUE + UNIQUE(collection_id, user_id), all via `CREATE TABLE IF NOT EXISTS`.
-  - Creates `collection_activity` table with 6 columns including JSONB `details`, via `CREATE TABLE IF NOT EXISTS`.
-  - Adds `users.is_pending BOOLEAN DEFAULT false` via `ADD COLUMN IF NOT EXISTS`.
-  - Creates 3 indexes via `CREATE INDEX IF NOT EXISTS`.
-- [ ] The 4th index from the source script (`idx_collections_visibility`) is NOT in this migration — it belongs to Brief 2.
-- [ ] The owner-permission backfill DML is NOT in this migration.
-- [ ] The file's `down()` throws with a clear message.
-- [ ] The file's docstring cites the source script + the convoy file + the Brief 2 split.
-- [ ] `node --check migrations/1781000000003_reconcile-collaboration-tables.js` passes.
-- [ ] `node -e "import('./migrations/1781000000003_reconcile-collaboration-tables.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`.
-- [ ] `npm run lint` matches baseline.
-- [ ] `npm run test:run` reports 21/21 passing.
-
-## Verification
-
-```bash
-node --check migrations/1781000000003_reconcile-collaboration-tables.js
-node -e "import('./migrations/1781000000003_reconcile-collaboration-tables.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"
-npm run lint
-npm run test:run
-```
-
-Expected: `node --check` silent, `node -e` prints `function function undefined`, lint baseline, 21/21 tests pass.
-
-**Do NOT** run `npm run migrate up` against any environment.
-
-## Commit message
-
-```
-feat(migrations): reconcile collaboration tables into migration history (brief 3/7)
-
-Captures the collaboration / sharing half of
-scripts/add-collaboration-features.js into one new node-pg-migrate
-migration:
-
-  - CREATE TABLE collection_permissions (role/status CHECKs,
-    invite_token UNIQUE, UNIQUE(collection_id, user_id))
-  - CREATE TABLE collection_activity (JSONB details)
-  - ALTER users ADD COLUMN is_pending BOOLEAN DEFAULT false
-  - 3 indexes
-
-The collections-columns half (visibility, tcg, tags +
-idx_collections_visibility) is reconciled by Brief 2. The 4th index
-(idx_collections_visibility) belongs to Brief 2 because it indexes a
-column added there.
-
-Per-row owner-permission backfill DML from the source script is
-intentionally NOT folded in — fresh envs have no pre-existing
-collections to backfill; the runtime invariant for new-collection
-owner-perm creation lives in pages/api/collections.js.
-
-Per .convoys/reconcile-historical-add-scripts.md § Brief outline → B3.
-Idempotent re-apply (IF NOT EXISTS guards).
-```
-
-## PR shape
-
-**Title:** `feat(migrations): reconcile collaboration tables into migration history (brief 3/7)`
-
-**Body template:**
-
-```markdown
-Brief 3 of the `reconcile-historical-add-scripts` convoy. See
-[`.convoys/reconcile-historical-add-scripts.md`](../.convoys/reconcile-historical-add-scripts.md)
-for the full plan and rationale.
-
-## What this PR does
-
-Adds `migrations/1781000000003_reconcile-collaboration-tables.js` —
-captures the collaboration / sharing DDL of
-`scripts/add-collaboration-features.js` (the table-and-column half;
-the columns-on-collections half is Brief 2).
-
-- `CREATE TABLE IF NOT EXISTS collection_permissions` (10 columns
-  including inline role/status CHECK constraints + invite_token
-  UNIQUE + UNIQUE(collection_id, user_id))
-- `CREATE TABLE IF NOT EXISTS collection_activity` (6 columns
-  including JSONB `details`)
-- `ALTER TABLE users ADD COLUMN IF NOT EXISTS is_pending BOOLEAN DEFAULT false`
-- 3 indexes via `CREATE INDEX IF NOT EXISTS`
-
-## What this PR does NOT do
-
-- Does **NOT** edit `scripts/add-collaboration-features.js` (no-go-zone).
-- Does **NOT** capture the columns-on-collections half (`visibility`,
-  `tcg`, `tags`, `idx_collections_visibility`) — that's **Brief 2**.
-- Does **NOT** fold in the per-row owner-permission backfill DML from
-  the source script — fresh envs have no pre-existing collections to
-  backfill.
-- Does **NOT** edit `scripts/setup-neon-db.js`, `package.json`, README,
-  `AGENTS.md`, or `docs/SCHEMA_MAP.md` (B7 owns SCHEMA_MAP).
-- Does **NOT** run `npm run migrate up` against any environment.
-
-## Verification checklist
-
-- [ ] `node --check migrations/1781000000003_reconcile-collaboration-tables.js` exits 0
-- [ ] `node -e "import('./migrations/1781000000003_reconcile-collaboration-tables.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`
-- [ ] `npm run lint` matches baseline
-- [ ] `npm run test:run` reports 21/21 passing
-- [ ] Did not run `npm run migrate up` against any environment in this PR
-
-## Cross-references
-
-- Convoy file: `.convoys/reconcile-historical-add-scripts.md`
-- Source script (no-go-zone, audit reference only):
-  `scripts/add-collaboration-features.js`
-```
-
-## DO NOT
-
-- DO NOT edit `scripts/add-collaboration-features.js` or any file under `scripts/`.
-- DO NOT edit any other file under `migrations/`.
-- DO NOT edit `scripts/setup-neon-db.js`, `package.json`, README, `AGENTS.md`, or `docs/SCHEMA_MAP.md`.
-- DO NOT run `npm run migrate up` against any environment.
-- DO NOT include the owner-permission backfill DML.
-- DO NOT add work for the collections-columns half (`visibility`, `tcg`, `tags`, `idx_collections_visibility`) — that's Brief 2.
-- DO NOT call `npm run migrate create`.
-
-## Rationale (≤3 sentences)
-
-Splitting `add-collaboration-features.js` between Brief 2 (collections columns + the visibility index that indexes one of those columns) and Brief 3 (collaboration tables + the users.is_pending column + the 3 indexes that index collaboration-table columns) keeps each migration scoped to the table surface it touches, matching D1. Inline CHECK constraints on `CREATE TABLE` are idempotent for free under `CREATE TABLE IF NOT EXISTS` (the whole statement no-ops when the table exists). The backfill DML is intentionally out of scope because fresh envs need no backfill and prod's backfill already ran.

.convoys/reconcile-historical-add-scripts/brief-4-reconcile-favorites-system.md

@@ -1,241 +0,0 @@
----
-convoy: reconcile-historical-add-scripts
-brief_number: 4
-depends_on: []
-files:
-  - migrations/1781000000004_reconcile-favorites-system.js
----
-
-# Brief 4: Reconcile favorites system into migration history
-
-## Goal (1 sentence)
-
-Capture the `user_favorites` table and its 4 indexes from `scripts/add-favorites-system.js` into a single new `node-pg-migrate` migration so a brand-new Neon branch ends up with the favorites surface after `npm run setup-db`.
-
-## Scope (files in scope — do not edit anything else)
-
-- `migrations/1781000000004_reconcile-favorites-system.js` — **new**
-
-## Source script (read-only audit reference; DO NOT EDIT — no-go-zone)
-
-`scripts/add-favorites-system.js` lines 11-27 (entire DDL — script has no DML beyond the table create):
-
-```js
-await sql`
-  CREATE TABLE IF NOT EXISTS user_favorites (
-    id SERIAL PRIMARY KEY,
-    user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
-    item_type VARCHAR(50) NOT NULL, -- 'card', 'collection', 'deck'
-    item_id INTEGER NOT NULL,
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    UNIQUE(user_id, item_type, item_id)
-  )
-`;
-
-// 4 indexes
-await sql`CREATE INDEX IF NOT EXISTS idx_user_favorites_user_id ON user_favorites(user_id)`;
-await sql`CREATE INDEX IF NOT EXISTS idx_user_favorites_item_type ON user_favorites(item_type)`;
-await sql`CREATE INDEX IF NOT EXISTS idx_user_favorites_item_id ON user_favorites(item_id)`;
-await sql`CREATE INDEX IF NOT EXISTS idx_user_favorites_user_type ON user_favorites(user_id, item_type)`;
-```
-
-**Note on SCHEMA_MAP drift.** `docs/SCHEMA_MAP.md` § `user_favorites` (lines 104-111) shows the table with only `(user_id, card_id)` columns — that's a **doc bug**. The actual source script (and prod schema) uses the polymorphic `(item_type, item_id)` shape that supports cards, collections, AND decks (per the script's inline comment + the runtime usage in `pages/api/favorites.js`). B7 corrects the SCHEMA_MAP entry. This brief faithfully reproduces the **script's** shape — `(item_type, item_id)` — not the doc's.
-
-## Target migration file
-
-Path: `migrations/1781000000004_reconcile-favorites-system.js`
-
-Contents:
-
-```js
-/**
- * Reconcile scripts/add-favorites-system.js into the migration history.
- *
- * Creates user_favorites with the polymorphic (item_type, item_id)
- * shape that supports favoriting cards, collections, and decks via a
- * single table. Adds 4 indexes for the common query shapes:
- *
- *   - idx_user_favorites_user_id — "all favorites for user X"
- *   - idx_user_favorites_item_type — "all card favorites" / "all deck favorites"
- *   - idx_user_favorites_item_id — back-link from an item to its favoriters
- *   - idx_user_favorites_user_type — composite for "user X's card favorites"
- *
- * Note: docs/SCHEMA_MAP.md § user_favorites currently shows only
- * (user_id, card_id) — that's a doc bug. The actual prod shape (and
- * the source script, and the runtime in pages/api/favorites.js) uses
- * the polymorphic shape. B7 of this convoy corrects the SCHEMA_MAP
- * entry; this migration reproduces the script's shape faithfully.
- *
- * Idempotent re-apply: CREATE TABLE IF NOT EXISTS + CREATE INDEX IF NOT EXISTS.
- *
- * @type {import('node-pg-migrate').ColumnDefinitions | undefined}
- */
-export const shorthands = undefined;
-
-/**
- * @param {import('node-pg-migrate').MigrationBuilder} pgm
- */
-export const up = (pgm) => {
-  pgm.sql(`
-    CREATE TABLE IF NOT EXISTS user_favorites (
-      id SERIAL PRIMARY KEY,
-      user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
-      item_type VARCHAR(50) NOT NULL,
-      item_id INTEGER NOT NULL,
-      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-      UNIQUE(user_id, item_type, item_id)
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_user_favorites_user_id
-      ON user_favorites (user_id);
-
-    CREATE INDEX IF NOT EXISTS idx_user_favorites_item_type
-      ON user_favorites (item_type);
-
-    CREATE INDEX IF NOT EXISTS idx_user_favorites_item_id
-      ON user_favorites (item_id);
-
-    CREATE INDEX IF NOT EXISTS idx_user_favorites_user_type
-      ON user_favorites (user_id, item_type);
-  `);
-};
-
-/**
- * Down-migration intentionally throws. Dropping user_favorites on a
- * long-lived env would erase every user's saved favorites list and
- * break runtime reads in pages/api/favorites.js.
- *
- * @returns {void}
- */
-export const down = () => {
-  throw new Error(
-    '[migration:1781000000004_reconcile-favorites-system] Down not supported. ' +
-      'Dropping user_favorites would erase every saved favorite and break ' +
-      'pages/api/favorites.js. Write a new dated migration for any future ' +
-      'schema correction.'
-  );
-};
-```
-
-## Conventions to follow
-
-- `.cursor/rules/db-and-schema.mdc` § "Schema source of truth" — `migrations/` is canonical.
-- `.cursor/rules/no-go-zones.mdc` — `scripts/add-favorites-system.js` is append-only history.
-- Style: raw `pgm.sql(...)` template literals. Per D2.
-- ESM exports; `"type": "module"`.
-- `IF NOT EXISTS` on every CREATE.
-- Match the source script's column types, FK ON DELETE rule (`CASCADE`), and UNIQUE shape verbatim.
-
-## Acceptance criteria
-
-- [ ] `migrations/1781000000004_reconcile-favorites-system.js` exists with the exact filename above.
-- [ ] The file's `up()` creates `user_favorites` with all 5 columns + UNIQUE constraint, then 4 indexes, all via `IF NOT EXISTS`.
-- [ ] The column shape is `(item_type VARCHAR(50), item_id INTEGER)` — the polymorphic shape — NOT `(card_id)`. See "Note on SCHEMA_MAP drift" above.
-- [ ] The file's `down()` throws with a clear message.
-- [ ] The file's docstring cites the source script + the convoy file + the SCHEMA_MAP doc-bug note.
-- [ ] `node --check migrations/1781000000004_reconcile-favorites-system.js` passes.
-- [ ] `node -e "import('./migrations/1781000000004_reconcile-favorites-system.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`.
-- [ ] `npm run lint` matches baseline.
-- [ ] `npm run test:run` reports 21/21 passing.
-
-## Verification
-
-```bash
-node --check migrations/1781000000004_reconcile-favorites-system.js
-node -e "import('./migrations/1781000000004_reconcile-favorites-system.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"
-npm run lint
-npm run test:run
-```
-
-Expected: `node --check` silent, `node -e` prints `function function undefined`, lint baseline, 21/21 tests pass.
-
-**Do NOT** run `npm run migrate up` against any environment.
-
-## Commit message
-
-```
-feat(migrations): reconcile favorites system into migration history (brief 4/7)
-
-Captures scripts/add-favorites-system.js into one new node-pg-migrate
-migration:
-
-  - CREATE TABLE user_favorites (polymorphic (item_type, item_id)
-    shape; UNIQUE(user_id, item_type, item_id))
-  - 4 indexes (user_id, item_type, item_id, (user_id, item_type))
-
-Note: docs/SCHEMA_MAP.md § user_favorites currently shows the table
-with only (user_id, card_id) — that's a doc bug; B7 of this convoy
-corrects the entry. This migration faithfully reproduces the source
-script's polymorphic shape (also what runtime in pages/api/favorites.js
-uses).
-
-Per .convoys/reconcile-historical-add-scripts.md § Brief outline → B4.
-Idempotent re-apply (IF NOT EXISTS guards).
-```
-
-## PR shape
-
-**Title:** `feat(migrations): reconcile favorites system into migration history (brief 4/7)`
-
-**Body template:**
-
-```markdown
-Brief 4 of the `reconcile-historical-add-scripts` convoy. See
-[`.convoys/reconcile-historical-add-scripts.md`](../.convoys/reconcile-historical-add-scripts.md)
-for the full plan and rationale.
-
-## What this PR does
-
-Adds `migrations/1781000000004_reconcile-favorites-system.js` —
-captures `scripts/add-favorites-system.js` into a single new
-`node-pg-migrate` migration.
-
-- `CREATE TABLE IF NOT EXISTS user_favorites` with polymorphic
-  `(item_type VARCHAR(50), item_id INTEGER)` shape supporting
-  cards / collections / decks favorites in one table.
-- `UNIQUE(user_id, item_type, item_id)` prevents duplicate favorites.
-- 4 supporting indexes via `CREATE INDEX IF NOT EXISTS`.
-
-## Note on a SCHEMA_MAP doc bug
-
-`docs/SCHEMA_MAP.md` § `user_favorites` (current `main`) shows the
-table with only `(user_id, card_id)` columns. That's a doc bug — the
-actual prod shape (and the source script, and `pages/api/favorites.js`
-runtime usage) uses the polymorphic `(item_type, item_id)` shape. This
-migration faithfully reproduces the script's shape; Brief 7 of this
-convoy fixes the SCHEMA_MAP entry.
-
-## What this PR does NOT do
-
-- Does **NOT** edit `scripts/add-favorites-system.js` (no-go-zone).
-- Does **NOT** edit `docs/SCHEMA_MAP.md` (Brief 7's job).
-- Does **NOT** edit `scripts/setup-neon-db.js`, `package.json`, README,
-  or `AGENTS.md`.
-- Does **NOT** run `npm run migrate up` against any environment.
-
-## Verification checklist
-
-- [ ] `node --check migrations/1781000000004_reconcile-favorites-system.js` exits 0
-- [ ] `node -e "import('./migrations/1781000000004_reconcile-favorites-system.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`
-- [ ] `npm run lint` matches baseline
-- [ ] `npm run test:run` reports 21/21 passing
-- [ ] Did not run `npm run migrate up` against any environment in this PR
-
-## Cross-references
-
-- Convoy file: `.convoys/reconcile-historical-add-scripts.md`
-- Source script (no-go-zone, audit reference only): `scripts/add-favorites-system.js`
-```
-
-## DO NOT
-
-- DO NOT edit `scripts/add-favorites-system.js` or any file under `scripts/`.
-- DO NOT edit any other file under `migrations/`.
-- DO NOT edit `scripts/setup-neon-db.js`, `package.json`, README, `AGENTS.md`, or `docs/SCHEMA_MAP.md` (B7 owns SCHEMA_MAP).
-- DO NOT run `npm run migrate up` against any environment.
-- DO NOT use the SCHEMA_MAP `(user_id, card_id)` shape — that doc entry is wrong; reproduce the SOURCE SCRIPT'S polymorphic shape.
-- DO NOT call `npm run migrate create`.
-
-## Rationale (≤3 sentences)
-
-The favorites system is a single self-contained table — natural fit for one small migration that maps 1:1 with the historical script. The polymorphic shape (`item_type`, `item_id`) is what runtime code actually uses, so reproducing it from the script's verbatim DDL — rather than the stale `(user_id, card_id)` doc entry — is the safe choice. Brief 7's SCHEMA_MAP rewrite resolves the doc-bug separately so this brief stays scoped to one new file.

.convoys/reconcile-historical-add-scripts/brief-5-reconcile-user-profile.md

@@ -1,425 +0,0 @@
----
-convoy: reconcile-historical-add-scripts
-brief_number: 5
-depends_on: []
-files:
-  - migrations/1781000000005_reconcile-user-profile.js
----
-
-# Brief 5: Reconcile user profile fields into migration history
-
-## Goal (1 sentence)
-
-Capture the deduplicated union of `scripts/add-user-profile-columns.js` and `scripts/add-user-profile-fields.js` (15 new `users` columns, 2 new tables `user_settings` + `user_avatars`, 6 CHECK constraints, 6 indexes) into a single new `node-pg-migrate` migration so a brand-new Neon branch ends up with the user-profile surface after `npm run setup-db`.
-
-## Scope (files in scope — do not edit anything else)
-
-- `migrations/1781000000005_reconcile-user-profile.js` — **new**
-
-## Source scripts (read-only audit reference; DO NOT EDIT — both are no-go-zones)
-
-### `scripts/add-user-profile-columns.js` lines 12-18 (the earlier, narrower script):
-
-```js
-await sql`
-  ALTER TABLE users 
-  ADD COLUMN IF NOT EXISTS first_name VARCHAR(255),
-  ADD COLUMN IF NOT EXISTS last_name VARCHAR(255),
-  ADD COLUMN IF NOT EXISTS username VARCHAR(255) UNIQUE,
-  ADD COLUMN IF NOT EXISTS profile_image_url TEXT
-`;
-```
-
-Plus per-row UPDATE backfill of defaults (lines 25-42). **Do NOT fold the backfill DML into this migration** — fresh envs have no rows to backfill; column DEFAULTs handle new rows.
-
-### `scripts/add-user-profile-fields.js` lines 27-115 (the later, broader script — superset of #8 plus additional columns + 2 new tables + 6 CHECK constraints + 6 indexes):
-
-```js
-// Basic profile fields (overlaps add-user-profile-columns.js for first_name/last_name/username,
-// but ADDS bio + avatar_url; idempotent overlap because of IF NOT EXISTS)
-await sql`
-  ALTER TABLE users 
-  ADD COLUMN IF NOT EXISTS first_name VARCHAR(255),
-  ADD COLUMN IF NOT EXISTS last_name VARCHAR(255),
-  ADD COLUMN IF NOT EXISTS username VARCHAR(255) UNIQUE,
-  ADD COLUMN IF NOT EXISTS bio TEXT,
-  ADD COLUMN IF NOT EXISTS avatar_url TEXT
-`;
-
-// Preference fields
-await sql`
-  ALTER TABLE users 
-  ADD COLUMN IF NOT EXISTS favorite_games JSONB DEFAULT '["MTG"]',
-  ADD COLUMN IF NOT EXISTS collection_visibility VARCHAR(20) DEFAULT 'private',
-  ADD COLUMN IF NOT EXISTS preferred_currency VARCHAR(3) DEFAULT 'USD',
-  ADD COLUMN IF NOT EXISTS cards_per_page INTEGER DEFAULT 50,
-  ADD COLUMN IF NOT EXISTS default_view VARCHAR(10) DEFAULT 'grid'
-`;
-
-// Notification + 2FA settings
-await sql`
-  ALTER TABLE users 
-  ADD COLUMN IF NOT EXISTS notifications_email BOOLEAN DEFAULT true,
-  ADD COLUMN IF NOT EXISTS notifications_marketing BOOLEAN DEFAULT false,
-  ADD COLUMN IF NOT EXISTS two_factor_enabled BOOLEAN DEFAULT false
-`;
-
-// Display settings
-await sql`
-  ALTER TABLE users 
-  ADD COLUMN IF NOT EXISTS theme VARCHAR(10) DEFAULT 'system',
-  ADD COLUMN IF NOT EXISTS language VARCHAR(5) DEFAULT 'en'
-`;
-
-// user_settings table
-await sql`
-  CREATE TABLE IF NOT EXISTS user_settings (
-    id SERIAL PRIMARY KEY,
-    user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
-    setting_key VARCHAR(100) NOT NULL,
-    setting_value JSONB NOT NULL,
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    UNIQUE(user_id, setting_key)
-  )
-`;
-
-// user_avatars table
-await sql`
-  CREATE TABLE IF NOT EXISTS user_avatars (
-    id SERIAL PRIMARY KEY,
-    user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
-    filename VARCHAR(255) NOT NULL,
-    original_name VARCHAR(255),
-    mime_type VARCHAR(100),
-    file_size INTEGER,
-    file_path TEXT NOT NULL,
-    is_active BOOLEAN DEFAULT true,
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-  )
-`;
-
-// 6 indexes
-await sql`CREATE INDEX IF NOT EXISTS idx_users_username ON users(username)`;
-await sql`CREATE INDEX IF NOT EXISTS idx_users_email ON users(email)`;
-await sql`CREATE INDEX IF NOT EXISTS idx_user_settings_user_id ON user_settings(user_id)`;
-await sql`CREATE INDEX IF NOT EXISTS idx_user_settings_key ON user_settings(setting_key)`;
-await sql`CREATE INDEX IF NOT EXISTS idx_user_avatars_user_id ON user_avatars(user_id)`;
-await sql`CREATE INDEX IF NOT EXISTS idx_user_avatars_active ON user_avatars(user_id, is_active)`;
-
-// 6 CHECK constraints (each wrapped in JS try/catch to swallow 'already exists')
-await sql`ALTER TABLE users ADD CONSTRAINT check_collection_visibility CHECK (collection_visibility IN ('private', 'public', 'unlisted'))`;
-await sql`ALTER TABLE users ADD CONSTRAINT check_preferred_currency   CHECK (preferred_currency IN ('USD', 'EUR', 'GBP', 'CAD', 'JPY'))`;
-await sql`ALTER TABLE users ADD CONSTRAINT check_cards_per_page       CHECK (cards_per_page IN (25, 50, 100))`;
-await sql`ALTER TABLE users ADD CONSTRAINT check_default_view         CHECK (default_view IN ('grid', 'list'))`;
-await sql`ALTER TABLE users ADD CONSTRAINT check_theme                CHECK (theme IN ('light', 'dark', 'system'))`;
-await sql`ALTER TABLE users ADD CONSTRAINT check_language             CHECK (language IN ('en', 'es', 'fr', 'de', 'ja'))`;
-```
-
-Plus a per-row UPDATE backfill of defaults (lines 198-222). **Do NOT fold the backfill DML in** — column DEFAULTs handle new rows; fresh envs have no rows to backfill.
-
-### Important note on the column dedup
-
-Scripts #8 and #9 overlap on `first_name`, `last_name`, `username` — both use `ADD COLUMN IF NOT EXISTS` so on prod the second-running script no-ops those three columns. Both scripts have run on prod, so the union of their columns is what's actually present:
-
-- From #8 only: `profile_image_url` (TEXT) — a column that ONLY #8 added.
-- From #9 only: `bio`, `avatar_url`, `favorite_games`, `collection_visibility`, `preferred_currency`, `cards_per_page`, `default_view`, `notifications_email`, `notifications_marketing`, `two_factor_enabled`, `theme`, `language` (12 columns) + the 2 new tables + 6 CHECK constraints + 6 indexes.
-- From both (idempotent overlap): `first_name`, `last_name`, `username`.
-
-The migration must add **all 15 columns** (4 from #8 ∪ 12 from #9 with 3 in the intersection = 4 + 12 - 3 = 13 unique users columns; wait, let me recount: #8 adds 4 (first_name, last_name, username, profile_image_url); #9 adds 5 basic (first_name, last_name, username, bio, avatar_url) + 5 prefs + 3 notif + 2 display = 15. Union: first_name, last_name, username (shared) + profile_image_url (#8) + bio, avatar_url, favorite_games, collection_visibility, preferred_currency, cards_per_page, default_view, notifications_email, notifications_marketing, two_factor_enabled, theme, language (#9) = **3 + 1 + 12 = 16 columns**). So the migration adds 16 columns to `users`.
-
-The redundant `profile_image_url` vs `avatar_url` pair is documented in `docs/SCHEMA_MAP.md` § "Known schema smells" #1 and surfaced as the `unify-user-avatar-column` follow-up. Both must be in fresh envs for parity.
-
-## Target migration file
-
-Path: `migrations/1781000000005_reconcile-user-profile.js`
-
-Contents:
-
-```js
-/**
- * Reconcile two overlapping historical user-profile scripts into the
- * migration history, taking the union of their effects:
- *
- *   - scripts/add-user-profile-columns.js (the earlier, narrower
- *     script): first_name, last_name, username UNIQUE, profile_image_url
- *
- *   - scripts/add-user-profile-fields.js (the later, broader script;
- *     overlaps the earlier script on first_name / last_name / username
- *     and additionally adds): bio, avatar_url, favorite_games (JSONB
- *     DEFAULT '["MTG"]'), collection_visibility, preferred_currency,
- *     cards_per_page, default_view, notifications_email,
- *     notifications_marketing, two_factor_enabled, theme, language,
- *     + the new user_settings + user_avatars tables, + 6 CHECK
- *     constraints, + 6 indexes.
- *
- * Result on a fresh env: 16 new columns on `users`, 2 new tables,
- * 6 CHECK constraints, 6 indexes. On any long-lived env: every
- * statement is a no-op (IF NOT EXISTS / DO $$ EXCEPTION).
- *
- * Per-row UPDATE backfills from both scripts are intentionally NOT
- * folded in — column DEFAULTs handle new rows; fresh envs have no
- * rows to backfill.
- *
- * The profile_image_url / avatar_url redundancy is intentional for
- * parity with prod and is flagged in docs/SCHEMA_MAP.md § "Known
- * schema smells" #1; future cleanup is the queued
- * `unify-user-avatar-column` follow-up.
- *
- * CHECK constraint adds wrap in DO $$ ... EXCEPTION WHEN
- * duplicate_object THEN NULL END $$ because Postgres doesn't accept
- * ADD CONSTRAINT ... IF NOT EXISTS for CHECK. Each constraint gets
- * its own DO block so a failure in one doesn't block the rest.
- *
- * @type {import('node-pg-migrate').ColumnDefinitions | undefined}
- */
-export const shorthands = undefined;
-
-/**
- * @param {import('node-pg-migrate').MigrationBuilder} pgm
- */
-export const up = (pgm) => {
-  pgm.sql(`
-    -- 16 columns on users (union of add-user-profile-columns.js + add-user-profile-fields.js)
-    ALTER TABLE users
-      ADD COLUMN IF NOT EXISTS first_name VARCHAR(255),
-      ADD COLUMN IF NOT EXISTS last_name VARCHAR(255),
-      ADD COLUMN IF NOT EXISTS username VARCHAR(255) UNIQUE,
-      ADD COLUMN IF NOT EXISTS profile_image_url TEXT,
-      ADD COLUMN IF NOT EXISTS bio TEXT,
-      ADD COLUMN IF NOT EXISTS avatar_url TEXT,
-      ADD COLUMN IF NOT EXISTS favorite_games JSONB DEFAULT '["MTG"]',
-      ADD COLUMN IF NOT EXISTS collection_visibility VARCHAR(20) DEFAULT 'private',
-      ADD COLUMN IF NOT EXISTS preferred_currency VARCHAR(3) DEFAULT 'USD',
-      ADD COLUMN IF NOT EXISTS cards_per_page INTEGER DEFAULT 50,
-      ADD COLUMN IF NOT EXISTS default_view VARCHAR(10) DEFAULT 'grid',
-      ADD COLUMN IF NOT EXISTS notifications_email BOOLEAN DEFAULT true,
-      ADD COLUMN IF NOT EXISTS notifications_marketing BOOLEAN DEFAULT false,
-      ADD COLUMN IF NOT EXISTS two_factor_enabled BOOLEAN DEFAULT false,
-      ADD COLUMN IF NOT EXISTS theme VARCHAR(10) DEFAULT 'system',
-      ADD COLUMN IF NOT EXISTS language VARCHAR(5) DEFAULT 'en';
-
-    -- user_settings table
-    CREATE TABLE IF NOT EXISTS user_settings (
-      id SERIAL PRIMARY KEY,
-      user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
-      setting_key VARCHAR(100) NOT NULL,
-      setting_value JSONB NOT NULL,
-      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-      UNIQUE(user_id, setting_key)
-    );
-
-    -- user_avatars table
-    CREATE TABLE IF NOT EXISTS user_avatars (
-      id SERIAL PRIMARY KEY,
-      user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
-      filename VARCHAR(255) NOT NULL,
-      original_name VARCHAR(255),
-      mime_type VARCHAR(100),
-      file_size INTEGER,
-      file_path TEXT NOT NULL,
-      is_active BOOLEAN DEFAULT true,
-      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-      updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-    );
-
-    -- 6 indexes
-    CREATE INDEX IF NOT EXISTS idx_users_username       ON users (username);
-    CREATE INDEX IF NOT EXISTS idx_users_email          ON users (email);
-    CREATE INDEX IF NOT EXISTS idx_user_settings_user_id ON user_settings (user_id);
-    CREATE INDEX IF NOT EXISTS idx_user_settings_key    ON user_settings (setting_key);
-    CREATE INDEX IF NOT EXISTS idx_user_avatars_user_id ON user_avatars (user_id);
-    CREATE INDEX IF NOT EXISTS idx_user_avatars_active  ON user_avatars (user_id, is_active);
-
-    -- 6 CHECK constraints (each in its own DO block so one failure doesn't block the rest)
-    DO $$ BEGIN
-      ALTER TABLE users ADD CONSTRAINT check_collection_visibility
-        CHECK (collection_visibility IN ('private', 'public', 'unlisted'));
-    EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-
-    DO $$ BEGIN
-      ALTER TABLE users ADD CONSTRAINT check_preferred_currency
-        CHECK (preferred_currency IN ('USD', 'EUR', 'GBP', 'CAD', 'JPY'));
-    EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-
-    DO $$ BEGIN
-      ALTER TABLE users ADD CONSTRAINT check_cards_per_page
-        CHECK (cards_per_page IN (25, 50, 100));
-    EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-
-    DO $$ BEGIN
-      ALTER TABLE users ADD CONSTRAINT check_default_view
-        CHECK (default_view IN ('grid', 'list'));
-    EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-
-    DO $$ BEGIN
-      ALTER TABLE users ADD CONSTRAINT check_theme
-        CHECK (theme IN ('light', 'dark', 'system'));
-    EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-
-    DO $$ BEGIN
-      ALTER TABLE users ADD CONSTRAINT check_language
-        CHECK (language IN ('en', 'es', 'fr', 'de', 'ja'));
-    EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-  `);
-};
-
-/**
- * Down-migration intentionally throws. Dropping 16 user-profile columns
- * + user_settings + user_avatars on a long-lived env would erase every
- * user's profile data, preferences, avatar history, and settings, and
- * break runtime reads in pages/api/user/{settings,profile,avatar}.js.
- *
- * @returns {void}
- */
-export const down = () => {
-  throw new Error(
-    '[migration:1781000000005_reconcile-user-profile] Down not supported. ' +
-      'Dropping these columns + tables would erase every user profile, preference, ' +
-      'avatar history, and settings row, and break runtime reads in ' +
-      'pages/api/user/{settings,profile,avatar}.js. Write a new dated migration ' +
-      'for any future schema correction.'
-  );
-};
-```
-
-## Conventions to follow
-
-- `.cursor/rules/db-and-schema.mdc` § "Schema source of truth" — `migrations/` is canonical.
-- `.cursor/rules/no-go-zones.mdc` — both source scripts are append-only history.
-- Style: raw `pgm.sql(...)` template literals. Per D2.
-- ESM exports; `"type": "module"`.
-- `IF NOT EXISTS` on every ALTER + CREATE INDEX + CREATE TABLE.
-- CHECK constraints in `DO $$ ... EXCEPTION WHEN duplicate_object THEN NULL END $$;` blocks, one block per constraint.
-- Match the source scripts' column types, defaults, FK rules, and CHECK values verbatim.
-
-## Acceptance criteria
-
-- [ ] `migrations/1781000000005_reconcile-user-profile.js` exists with the exact filename above.
-- [ ] The file's `up()` adds exactly **16 columns** to `users` (per the dedup count in the source-scripts note above), creates **2 tables** (`user_settings`, `user_avatars`), creates **6 indexes**, and adds **6 CHECK constraints** each in its own `DO $$ EXCEPTION` block.
-- [ ] BOTH `profile_image_url` AND `avatar_url` are present (parity with prod; redundancy is documented).
-- [ ] The file's `down()` throws with a clear message.
-- [ ] The file's docstring cites both source scripts + the convoy file + the `unify-user-avatar-column` follow-up.
-- [ ] Per-row UPDATE backfill DML is NOT in the migration.
-- [ ] `node --check migrations/1781000000005_reconcile-user-profile.js` passes.
-- [ ] `node -e "import('./migrations/1781000000005_reconcile-user-profile.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`.
-- [ ] `npm run lint` matches baseline.
-- [ ] `npm run test:run` reports 21/21 passing.
-
-## Verification
-
-```bash
-node --check migrations/1781000000005_reconcile-user-profile.js
-node -e "import('./migrations/1781000000005_reconcile-user-profile.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"
-npm run lint
-npm run test:run
-```
-
-Expected: `node --check` silent, `node -e` prints `function function undefined`, lint baseline, 21/21 tests pass.
-
-**Do NOT** run `npm run migrate up` against any environment.
-
-## Commit message
-
-```
-feat(migrations): reconcile user profile fields into migration history (brief 5/7)
-
-Captures the deduplicated union of scripts/add-user-profile-columns.js
-and scripts/add-user-profile-fields.js into one new node-pg-migrate
-migration:
-
-  - 16 columns on users (basic profile + preferences + notifications + display)
-  - 2 new tables (user_settings, user_avatars)
-  - 6 CHECK constraints (each in its own DO $$ EXCEPTION block)
-  - 6 indexes
-
-Both profile_image_url (from script #1) and avatar_url (from script #2)
-are added for parity with prod. The redundancy is flagged in
-docs/SCHEMA_MAP.md § "Known schema smells" #1 and queued for cleanup as
-the `unify-user-avatar-column` follow-up.
-
-Per-row UPDATE backfill DML from both scripts is intentionally NOT
-folded in — column DEFAULTs handle new rows; fresh envs have no rows
-to backfill.
-
-Per .convoys/reconcile-historical-add-scripts.md § Brief outline → B5.
-Idempotent re-apply (IF NOT EXISTS guards + per-CHECK DO blocks).
-```
-
-## PR shape
-
-**Title:** `feat(migrations): reconcile user profile fields into migration history (brief 5/7)`
-
-**Body template:**
-
-```markdown
-Brief 5 of the `reconcile-historical-add-scripts` convoy. See
-[`.convoys/reconcile-historical-add-scripts.md`](../.convoys/reconcile-historical-add-scripts.md)
-for the full plan and rationale.
-
-## What this PR does
-
-Adds `migrations/1781000000005_reconcile-user-profile.js` — captures
-the deduplicated union of `scripts/add-user-profile-columns.js`
-(earlier, narrower) and `scripts/add-user-profile-fields.js` (later,
-broader) into a single new `node-pg-migrate` migration.
-
-- 16 new columns on `users` (first_name, last_name, username UNIQUE,
-  profile_image_url, bio, avatar_url, favorite_games JSONB, …, theme,
-  language) — all `ADD COLUMN IF NOT EXISTS`
-- 2 new tables: `user_settings`, `user_avatars` — both
-  `CREATE TABLE IF NOT EXISTS`
-- 6 indexes — `CREATE INDEX IF NOT EXISTS`
-- 6 CHECK constraints (each in its own
-  `DO $$ ... EXCEPTION WHEN duplicate_object THEN NULL END $$;` block)
-
-## Why both `profile_image_url` and `avatar_url`?
-
-Script #1 added `profile_image_url`, script #2 added `avatar_url` —
-both exist on prod and both are in this migration for fresh-env
-parity. The redundancy is flagged in
-`docs/SCHEMA_MAP.md` § "Known schema smells" #1 and queued for cleanup
-as the `unify-user-avatar-column` follow-up.
-
-## What this PR does NOT do
-
-- Does **NOT** edit either source script (no-go-zones).
-- Does **NOT** fold in the per-row UPDATE backfill DML from either
-  source script — column DEFAULTs handle new rows.
-- Does **NOT** unify `profile_image_url` / `avatar_url` — that's the
-  `unify-user-avatar-column` follow-up.
-- Does **NOT** edit `scripts/setup-neon-db.js`, `package.json`, README,
-  `AGENTS.md`, or `docs/SCHEMA_MAP.md` (B7 owns SCHEMA_MAP).
-- Does **NOT** run `npm run migrate up` against any environment.
-
-## Verification checklist
-
-- [ ] `node --check migrations/1781000000005_reconcile-user-profile.js` exits 0
-- [ ] `node -e "import('./migrations/1781000000005_reconcile-user-profile.js').then(m => console.log(typeof m.up, typeof m.down, typeof m.shorthands))"` prints `function function undefined`
-- [ ] `npm run lint` matches baseline
-- [ ] `npm run test:run` reports 21/21 passing
-- [ ] Did not run `npm run migrate up` against any environment in this PR
-
-## Cross-references
-
-- Convoy file: `.convoys/reconcile-historical-add-scripts.md`
-- Source scripts (no-go-zones, audit reference only):
-  `scripts/add-user-profile-columns.js`, `scripts/add-user-profile-fields.js`
-```
-
-## DO NOT
-
-- DO NOT edit either source script or any file under `scripts/`.
-- DO NOT edit any other file under `migrations/`.
-- DO NOT edit `scripts/setup-neon-db.js`, `package.json`, README, `AGENTS.md`, or `docs/SCHEMA_MAP.md`.
-- DO NOT run `npm run migrate up` against any environment.
-- DO NOT pick one of `profile_image_url` / `avatar_url` to omit — both must be present for parity.
-- DO NOT collapse the 6 CHECK constraints into a single `DO $$ EXCEPTION` block — one block per constraint so one duplicate doesn't swallow the others.
-- DO NOT include the per-row UPDATE backfill DML.
-- DO NOT call `npm run migrate create`.
-
-## Rationale (≤3 sentences)
-
-This is the largest single migration in the convoy because both historical scripts are tightly coupled to the `users` table surface and splitting them would create artificial boundaries (e.g., separating "users columns" from "CHECK constraints on users columns" makes no sense). Per-CHECK `DO $$ EXCEPTION` blocks mirror the historical scripts' per-statement try/catch pattern and ensure one duplicate-constraint failure doesn't block the rest. Keeping both avatar-style columns matches prod-as-is and explicitly defers the cleanup to a scoped follow-up convoy.

.convoys/reconcile-historical-add-scripts/brief-7-documentation-and-verification.md

@@ -1,457 +0,0 @@
----
-convoy: reconcile-historical-add-scripts
-brief_number: 7
-depends_on: [1, 2, 3, 4, 5]
-files:
-  - docs/SCHEMA_MAP.md
-  - docs/MIGRATION_VERIFICATION_RUNBOOK.md
-  - AGENTS.md
-  - .convoys/ship-readiness.md
----
-
-# Brief 7: Documentation + verification runbook
-
-## Goal (1 sentence)
-
-Update the four documentation surfaces that describe the post-convoy schema and onboarding state — `docs/SCHEMA_MAP.md` (correct doc bugs + cross-reference new migrations), `docs/MIGRATION_VERIFICATION_RUNBOOK.md` (new — manual operator runbook from D5), `AGENTS.md` Gotcha #6 (cross-reference this convoy as the closing follow-up), `.convoys/ship-readiness.md` (flip this convoy's queued entry to RESOLVED + unblock `retire-graveyard-scripts-after-audit` + add new follow-ups) — so the next operator onboarding a fresh Neon branch can do so by `npm install` → `npm run setup-db` alone and verify the result.
-
-## Scope (files in scope — do not edit anything else)
-
-- `docs/SCHEMA_MAP.md` — **modified**
-- `docs/MIGRATION_VERIFICATION_RUNBOOK.md` — **new**
-- `AGENTS.md` — **modified** (small Gotcha #6 cross-reference update only)
-- `.convoys/ship-readiness.md` — **modified** (queued convoys section)
-
-This brief is **sequenced last** because it cross-references the 5 new migration files that B1-B5 add; it cannot land before B1-B5 are merged. The architect's `slice_dependencies` block in the convoy file declares `depends_on: [1, 2, 3, 4, 5]`.
-
-## Per-file scope
-
-### 1. `docs/SCHEMA_MAP.md` — modified
-
-Targeted edits (keep all other content as-is):
-
-1. **Preamble update.** The current preamble (lines 1-18) notes that *"the initial backfill captures only the post-`setup-neon-db.js` shape. … A follow-up convoy (`reconcile-historical-add-scripts`) will fold the historical effects into the migration history; until then this file remains the curated reference for the full prod shape."* Replace with a sentence noting the convoy has **landed**, the migration history now captures the full prod shape, and the operator verification runbook lives at `docs/MIGRATION_VERIFICATION_RUNBOOK.md`. Bump the "Last reviewed" date.
-
-2. **`### users` notes column updates** (lines 43-57): each row references `add-user-profile-columns.js` / `add-user-profile-fields.js` — leave those references in place (they're historical context); ADD a single line at the end of the table noting *"All columns above are now captured by `migrations/1781000000005_reconcile-user-profile.js` (B5 of `reconcile-historical-add-scripts`, 2026-06-14)."*
-
-3. **`### cards` notes column updates** (lines 78-79): for the `quantity` and `favorited` rows, change the "Unused; consider dropping" annotation to *"Unused; captured by `migrations/1781000000001_reconcile-cards-columns.js` for fresh-env parity. Drop tracked as queued `drop-dead-cards-columns` follow-up."*
-
-4. **`### user_cards` index/constraint notes** (lines 90-102): add a brief note clarifying the canonical constraint is `UNIQUE(user_id, card_id, is_foil)` (3-col) from initial-schema, and that `scripts/fix-user-cards-constraints.js`'s stricter 2-col variant was either never-applied or reverted (Finding 1 of the reconcile convoy → Outcome A, 2026-06-14). This is the SCHEMA_MAP equivalent of the Drift Finding 1 resolution.
-
-5. **`### user_favorites` table** (lines 104-111): **FIX THE DOC BUG.** Current shape lists only `(user_id, card_id)`. Replace with the actual polymorphic shape per the runtime in `pages/api/favorites.js`:
-
-   ```markdown
-   ### user_favorites
-
-   | Column | Type | Notes |
-   | --- | --- | --- |
-   | `id` | `SERIAL PK` | |
-   | `user_id` | `INTEGER FK users(id) ON DELETE CASCADE` | |
-   | `item_type` | `VARCHAR(50) NOT NULL` | `'card' | 'collection' | 'deck'` — polymorphic |
-   | `item_id` | `INTEGER NOT NULL` | FK depends on `item_type`; not enforced at DB level |
-   | `created_at` | `TIMESTAMP` | |
-   | | | **UNIQUE(user_id, item_type, item_id)** |
-
-   Indexes: `idx_user_favorites_user_id`, `idx_user_favorites_item_type`,
-   `idx_user_favorites_item_id`, `idx_user_favorites_user_type
-   (user_id, item_type)` — all in `migrations/1781000000004_reconcile-favorites-system.js`.
-   ```
-
-6. **`### collections` notes**: add a line at the bottom noting *"`visibility`, `tcg`, `tags`, `slug` (+ `idx_collections_slug` unique + `check_slug_format` CHECK), `image` are now captured by `migrations/1781000000002_reconcile-collections-columns.js`."*
-
-7. **`### collection_permissions` + `### collection_activity` sections**: add a line at the bottom of each noting *"Captured by `migrations/1781000000003_reconcile-collaboration-tables.js`."*
-
-8. **NEW SECTION: `### user_settings`** (currently a one-liner at line 217). Expand to a proper column table matching the actual schema:
-
-   ```markdown
-   ### user_settings
-
-   Per-user key/value store for settings that don't warrant a column on `users`.
-   Captured by `migrations/1781000000005_reconcile-user-profile.js`.
-
-   | Column | Type | Notes |
-   | --- | --- | --- |
-   | `id` | `SERIAL PK` | |
-   | `user_id` | `INTEGER FK users(id) ON DELETE CASCADE` | |
-   | `setting_key` | `VARCHAR(100) NOT NULL` | |
-   | `setting_value` | `JSONB NOT NULL` | |
-   | `created_at`, `updated_at` | `TIMESTAMP` default now | |
-   | | | **UNIQUE(user_id, setting_key)** |
-
-   Indexes: `idx_user_settings_user_id`, `idx_user_settings_key`.
-   ```
-
-9. **`### user_avatars` expansion** (currently one paragraph at lines 222-223). Replace with:
-
-   ```markdown
-   ### user_avatars
-
-   Tracks uploaded avatar history. Captured by
-   `migrations/1781000000005_reconcile-user-profile.js`. Older avatars
-   are typically deleted from blob storage; verify the cleanup job runs.
-
-   | Column | Type | Notes |
-   | --- | --- | --- |
-   | `id` | `SERIAL PK` | |
-   | `user_id` | `INTEGER FK users(id) ON DELETE CASCADE` | |
-   | `filename` | `VARCHAR(255) NOT NULL` | |
-   | `original_name` | `VARCHAR(255)` | |
-   | `mime_type` | `VARCHAR(100)` | |
-   | `file_size` | `INTEGER` | |
-   | `file_path` | `TEXT NOT NULL` | |
-   | `is_active` | `BOOLEAN DEFAULT true` | |
-   | `created_at`, `updated_at` | `TIMESTAMP` default now | |
-
-   Indexes: `idx_user_avatars_user_id`, `idx_user_avatars_active (user_id, is_active)`.
-   ```
-
-10. **`## Known schema smells` section updates** (lines 226-232):
-
-    - **Smell #2** (`is_public` vs `visibility`): add a sentence noting both columns are now captured by separate migrations (initial-schema for `is_public`, B2 for `visibility`); resolution lives in a future `unify-collection-visibility` follow-up.
-    - **Smell #3** (`cards.quantity` + `cards.favorited`): add the cross-reference to the queued `drop-dead-cards-columns` follow-up.
-    - **NEW: Smell #7 — `users.profile_image_url` vs `users.avatar_url`** (the parity smell that B5 perpetuates intentionally). Both columns are present for prod parity; cleanup is the queued `unify-user-avatar-column` follow-up.
-
-11. **`## Regeneration` section update** (lines 234-245): the manual-regeneration instructions can be removed entirely since the migration history is now authoritative. Replace with:
-
-    ```markdown
-    ## Regeneration
-
-    The migration history under `migrations/` is the authoritative source
-    of truth. To verify this file matches a live env (prod, preview, or a
-    fresh Neon branch), use the operator runbook at
-    [`docs/MIGRATION_VERIFICATION_RUNBOOK.md`](MIGRATION_VERIFICATION_RUNBOOK.md).
-
-    When you add a new migration, update the relevant table section here
-    in the same PR. New tables get a new `###` section with the same
-    column-table shape.
-    ```
-
-### 2. `docs/MIGRATION_VERIFICATION_RUNBOOK.md` — new
-
-Lift verbatim from `.convoys/reconcile-historical-add-scripts.md` § Verification plan (D5), with a small intro framing it as the canonical operator runbook (not just a convoy artifact). Suggested skeleton:
-
-```markdown
-# Migration verification runbook
-
-How to verify that the migration history under `migrations/` produces
-the same schema as a long-lived environment (prod, preview, or
-similar). Use this runbook:
-
-- **After this repo's `reconcile-historical-add-scripts` convoy** (the
-  initial reconciliation), to confirm a fresh Neon branch reaches
-  parity with prod via `npm install` → `npm run setup-db` alone.
-- **After any new migration lands on `main`**, to spot-check that
-  applying the migration to prod (via the operator's
-  `POSTGRES_URL=<prod> npm run migrate up`) produced the intended
-  effect.
-- **When suspecting drift** between an env's actual schema and the
-  migration history (rare; the migration history is authoritative).
-
-This runbook is the manual precursor to the automated check planned
-in the queued `wire-migrate-into-ci` follow-up (see
-`.convoys/ship-readiness.md` § "Queued convoys").
-
-## Prerequisites
-
-- `pg_dump` (PostgreSQL 16+) installed locally.
-- `POSTGRES_URL` for the env you're verifying.
-- `ADMIN_INITIAL_PASSWORD` (for the fresh-branch onboarding step) —
-  see `AGENTS.md` § 5 "Running locally".
-- A Neon account with permission to create a branch (or any other
-  way to spin up a fresh Postgres DB on the same major version as
-  prod).
-
-## Procedure
-
-### Step 1 — Snapshot the reference env's structural shape
-
-Run against the env you consider canonical (usually prod):
-
-\`\`\`bash
-POSTGRES_URL=<reference-url> pg_dump --schema-only --no-owner --no-acl \
-  --schema=public > /tmp/reference-schema.sql
-\`\`\`
-
-### Step 2 — Create a fresh DB and onboard via `setup-db`
-
-Create a clean Neon branch from an **empty** parent (or any other
-fresh Postgres DB on the same major version):
-
-\`\`\`bash
-POSTGRES_URL=<fresh-branch-url> \
-ADMIN_INITIAL_PASSWORD=$(openssl rand -base64 24) \
-  npm run setup-db
-\`\`\`
-
-`setup-db` runs `npm run migrate up` (applying every migration in
-`migrations/` in timestamp order) and seeds the admin user.
-
-### Step 3 — Snapshot the fresh DB's structural shape
-
-\`\`\`bash
-POSTGRES_URL=<fresh-branch-url> pg_dump --schema-only --no-owner --no-acl \
-  --schema=public > /tmp/fresh-schema.sql
-\`\`\`
-
-### Step 4 — Diff
-
-\`\`\`bash
-diff <(sort /tmp/reference-schema.sql) <(sort /tmp/fresh-schema.sql)
-\`\`\`
-
-**Expected non-material differences** (acceptable; do not chase):
-
-- Constraint or index NAME differences. Prod constraints created via
-  the historical `scripts/add-*` / `scripts/fix-*` jobs may have
-  autogenerated tuple-UNIQUE names that differ from the migrations'
-  explicit names.
-- Column-ORDER differences. Prod has columns in historical-script-ALTER
-  order; fresh envs have them in migration-order.
-
-**Material differences** (bug — fix before declaring verified):
-
-- A column type, default, or NULL/NOT NULL state that differs.
-- A missing or extra table.
-- A missing or extra CHECK constraint that changes accepted values.
-- A missing or extra index that changes query plan shape.
-
-## Supplementary spot-checks
-
-For the highest-risk surfaces (frequently-edited tables), run these
-information-schema queries against both envs and confirm the
-column-count / constraint-count / index-count totals match exactly:
-
-\`\`\`sql
--- Every column on every table
-SELECT table_name, column_name, data_type, is_nullable, column_default
-FROM information_schema.columns
-WHERE table_schema = 'public'
-ORDER BY table_name, ordinal_position;
-
--- Every constraint
-SELECT table_name, constraint_name, constraint_type
-FROM information_schema.table_constraints
-WHERE table_schema = 'public'
-ORDER BY table_name, constraint_name;
-
--- Every index
-SELECT tablename, indexname, indexdef
-FROM pg_indexes
-WHERE schemaname = 'public'
-ORDER BY tablename, indexname;
-\`\`\`
-
-A mismatch in column count, constraint count, or index count is a
-material difference and indicates a bug.
-
-## What to do if you find a material difference
-
-1. **Identify which env is canonical.** Usually prod. If the diff
-   surfaces a missing column on prod that's in the migration history,
-   the migration was never applied to prod — run
-   `POSTGRES_URL=<prod> npm run migrate up` to catch up.
-2. **If the diff surfaces a column on prod that's NOT in the
-   migration history**, you've found a drift bug. Write a new
-   reconciliation migration (under `migrations/`) that captures the
-   prod column, following the pattern in `.convoys/reconcile-historical-add-scripts/`.
-3. **Do not edit existing migrations** — they're pinned by
-   `pgmigrations` rows. Always write a new dated migration to correct
-   schema.
-
-## Cross-references
-
-- `AGENTS.md` § 4 Gotcha #6 — migration tool adoption history.
-- `.convoys/migration-tool.md` — the convoy that adopted `node-pg-migrate`.
-- `.convoys/reconcile-historical-add-scripts.md` — the convoy that folded
-  the 13 historical scripts into the migration history.
-- `.cursor/rules/db-and-schema.mdc` — schema-change conventions.
-```
-
-### 3. `AGENTS.md` — modified (small Gotcha #6 cross-reference)
-
-Gotcha #6 is already "RESOLVED" per `migration-tool` (2026-05-26). This brief adds **one sentence** to the end of Gotcha #6 cross-referencing this convoy as the closing follow-up. Verbatim addition (insert immediately before the `- **#7**` line at AGENTS.md line 120):
-
-> Post-`reconcile-historical-add-scripts` (2026-06-14), the
-> migration history additionally captures the full effect of the 13
-> historical `scripts/add-*.js` / `scripts/fix-*.js` /
-> `scripts/seed-*.js` jobs (where applicable — pure-DML seed scripts
-> stay out per D4 of that convoy). A brand-new Neon branch can now be
-> onboarded by `npm install` → `npm run setup-db` alone. Operator
-> verification runbook at
-> [`docs/MIGRATION_VERIFICATION_RUNBOOK.md`](docs/MIGRATION_VERIFICATION_RUNBOOK.md).
-> The 13 historical scripts remain no-go-zones until the queued
-> `retire-graveyard-scripts-after-audit` (P3) cleanup convoy lands;
-> that convoy is now unblocked.
-
-Do NOT flip Gotcha #6's RESOLVED marker — it's already RESOLVED by the right convoy (`migration-tool`). Just append the cross-reference.
-
-### 4. `.convoys/ship-readiness.md` — modified (queued convoys section)
-
-Find the existing line under § "Queued convoys" that reads:
-
-> - **`reconcile-historical-add-scripts`** (priority: P1 quality — needed for fresh-env onboarding). Surfaced 2026-05-26 by `migration-tool` (PR #32). Fold the effects of the 27 historical `scripts/add-*.js` / `fix-*.js` / `seed-*.js` jobs … Documented in `.convoys/migration-tool.md` § R1.
-
-Replace with:
-
-> - **`reconcile-historical-add-scripts`** — **RESOLVED 2026-06-14** by [convoy](../.convoys/reconcile-historical-add-scripts.md) (PRs #XX-#XX). Captured 7 of the 13 historical scripts' effects into 5 new migrations under `migrations/` (B1-B5); 2 scripts were already captured by `initial-schema` + `1780378340194_system-collection-description`; 3 are DML-only and stay as dev fixtures; 1 (`fix-user-cards-constraints.js`) is a no-op on prod per Finding 1 (Outcome A — the canonical 3-col `UNIQUE(user_id, card_id, is_foil)` from `initial-schema` is what prod has, and `fix-user-cards-constraints.js`'s stricter 2-col variant is not present). A brand-new Neon branch now onboards via `npm install` → `npm run setup-db` alone. Operator verification at [`docs/MIGRATION_VERIFICATION_RUNBOOK.md`](../docs/MIGRATION_VERIFICATION_RUNBOOK.md). Entry kept (not deleted) for audit trail.
-
-Find the existing line:
-
-> - **`retire-graveyard-scripts-after-audit`** (priority: P3 polish; **blocked on `reconcile-historical-add-scripts`**). …
-
-Replace the `**blocked on `reconcile-historical-add-scripts`**` marker with `**UNBLOCKED 2026-06-14**` and leave the rest of the description intact.
-
-Add two new queued entries (driven by Findings 2 + 3 of the reconcile convoy):
-
-> - **`unify-user-avatar-column`** (priority: P3 hygiene). Surfaced 2026-06-14 by `reconcile-historical-add-scripts` Finding 2. `users.profile_image_url` (added by `scripts/add-user-profile-columns.js`) and `users.avatar_url` (added by `scripts/add-user-profile-fields.js`) coexist on prod and in the migration history (both columns are needed for parity per B5). Pick one canonical column, migrate the other's data to it, drop the loser, and sweep runtime readers in `pages/api/user/avatar*.js` + UI surfaces. Requires a query-trace audit first.
-> - **`drop-dead-cards-columns`** (priority: P3 hygiene). Surfaced 2026-06-14 by `reconcile-historical-add-scripts` Finding 3. `cards.quantity INTEGER` and `cards.favorited BOOLEAN` are documented unused (per `docs/SCHEMA_MAP.md` § "Known schema smells" #3); reconciled into the migration history by B1 for parity, but the actual semantics live on `user_cards` / `user_favorites`. After a query-trace audit confirms zero runtime readers, ship a migration that DROPs both columns with a real `down()` that recreates them.
-
-(Do NOT add the withdrawn `add-system-collection-on-register` or `unify-user-cards-foil-tracking` entries — both were withdrawn during the reconcile convoy. See `.convoys/reconcile-historical-add-scripts.md` § Follow-ups.)
-
-## Conventions to follow
-
-- `.cursor/rules/no-go-zones.mdc` — no edits to `scripts/add-*` / `fix-*` / `seed-*`.
-- `.cursor/rules/db-and-schema.mdc` — schema-change conventions; SCHEMA_MAP is updated alongside any migration.
-- Markdown style: match the existing tone of `docs/SCHEMA_MAP.md` (compact tables, "Notes" column explains intent not type semantics) and `AGENTS.md` (numbered Gotchas, cross-reference convoy files).
-- For `.convoys/ship-readiness.md`: match the existing entry style under § "Queued convoys" (one bullet per convoy, leading `- **`name`**`, RESOLVED entries get the "Entry kept (not deleted) for audit trail" closer when applicable).
-
-## Acceptance criteria
-
-- [ ] `docs/SCHEMA_MAP.md` preamble bumped (post-convoy state); "Last reviewed" date is 2026-06-14.
-- [ ] `docs/SCHEMA_MAP.md` § `user_favorites` shape is the polymorphic `(item_type, item_id)` — NOT the previous `(card_id)` shape.
-- [ ] Every reconciled table/column has a "captured by `migrations/<file>`" cross-reference.
-- [ ] `### user_settings` and `### user_avatars` sections are expanded from one-liners to full column tables matching B5's migration.
-- [ ] New schema smell #7 (`profile_image_url` vs `avatar_url`) is added to § "Known schema smells".
-- [ ] `docs/MIGRATION_VERIFICATION_RUNBOOK.md` exists with the 4-step procedure from D5 + the spot-check queries + the "material vs non-material differences" guidance.
-- [ ] `AGENTS.md` Gotcha #6 gains a single appended paragraph cross-referencing this convoy + the new runbook + the unblocked `retire-graveyard-scripts-after-audit` follow-up. Gotcha #6's existing "RESOLVED by `migration-tool`" marker is NOT changed.
-- [ ] `.convoys/ship-readiness.md` § "Queued convoys" → `reconcile-historical-add-scripts` entry is flipped to RESOLVED 2026-06-14 with a one-paragraph summary; `retire-graveyard-scripts-after-audit` is marked UNBLOCKED 2026-06-14; two new entries (`unify-user-avatar-column`, `drop-dead-cards-columns`) are added.
-- [ ] No edits to any file under `scripts/`, `migrations/`, `pages/`, `lib/`, `components/`, `test/`, or `package.json`.
-- [ ] `npm run lint` matches baseline (these are markdown-only edits; lint should be unaffected).
-- [ ] `npm run test:run` reports 21/21 passing (these are markdown-only edits; no test surface).
-
-## Verification
-
-```bash
-npm run lint
-npm run test:run
-```
-
-Both must match baseline / be green. No additional verification for this brief — the migrations themselves are exercised by Brief 7's verification runbook AFTER an operator runs it manually post-merge.
-
-For the SCHEMA_MAP edits, eyeball the diff against the prior state and confirm every cross-reference to a migration file is accurate (the file actually exists, and the timestamp matches the assigned reservation).
-
-## Commit message
-
-```
-docs(reconcile): update SCHEMA_MAP, verification runbook, AGENTS, ship-readiness (brief 7/7)
-
-Closes the reconcile-historical-add-scripts convoy:
-
-  - docs/SCHEMA_MAP.md: cross-reference 5 new migrations from B1-B5;
-    fix user_favorites doc bug (polymorphic shape, not (card_id));
-    expand user_settings + user_avatars one-liners to full column tables;
-    add schema smell #7 (profile_image_url vs avatar_url redundancy).
-  - docs/MIGRATION_VERIFICATION_RUNBOOK.md (new): canonical operator
-    runbook for verifying fresh-env vs prod schema parity (lifted from
-    D5 of the convoy).
-  - AGENTS.md Gotcha #6: append cross-reference to this convoy + the
-    new runbook + the now-unblocked retire-graveyard-scripts-after-audit
-    follow-up. Existing "RESOLVED by migration-tool" marker unchanged.
-  - .convoys/ship-readiness.md: flip reconcile-historical-add-scripts
-    entry to RESOLVED 2026-06-14; mark retire-graveyard-scripts-after-audit
-    UNBLOCKED; add new queued unify-user-avatar-column (Finding 2) +
-    drop-dead-cards-columns (Finding 3).
-
-Per .convoys/reconcile-historical-add-scripts.md § Brief outline → B7.
-Depends on B1-B5 having merged (this brief cross-references their files).
-```
-
-## PR shape
-
-**Title:** `docs(reconcile): update SCHEMA_MAP, verification runbook, AGENTS, ship-readiness (brief 7/7)`
-
-**Body template:**
-
-```markdown
-Brief 7 (final) of the `reconcile-historical-add-scripts` convoy.
-See [`.convoys/reconcile-historical-add-scripts.md`](../.convoys/reconcile-historical-add-scripts.md)
-for the full plan and rationale.
-
-This is the closing brief — depends on B1-B5 having merged (PR
-references below).
-
-## What this PR does
-
-- **`docs/SCHEMA_MAP.md`** — cross-reference all 5 new migrations from
-  B1-B5; fix the `user_favorites` doc bug (the table uses the
-  polymorphic `(item_type, item_id)` shape, not `(card_id)`); expand
-  `user_settings` + `user_avatars` from one-liners to full column
-  tables matching the B5 migration; add a new "Known schema smell" #7
-  for the `profile_image_url` / `avatar_url` redundancy.
-- **`docs/MIGRATION_VERIFICATION_RUNBOOK.md`** (new) — canonical
-  operator runbook for verifying fresh-env vs prod schema parity.
-  Pulls verbatim from D5 of the convoy file. Useful both for the
-  one-time reconciliation verification and for ongoing post-migration
-  spot-checks.
-- **`AGENTS.md`** — append one paragraph to Gotcha #6 cross-referencing
-  this convoy as the closing follow-up. The "RESOLVED by `migration-tool`"
-  marker is unchanged (that's still the right resolution attribution
-  for the gotcha itself).
-- **`.convoys/ship-readiness.md`** § "Queued convoys" — flip the
-  `reconcile-historical-add-scripts` entry to RESOLVED 2026-06-14;
-  flip `retire-graveyard-scripts-after-audit` from "blocked on
-  reconcile-historical-add-scripts" to UNBLOCKED 2026-06-14; add two
-  new queued entries (`unify-user-avatar-column` from Finding 2,
-  `drop-dead-cards-columns` from Finding 3).
-
-## Prerequisite PRs (all must be merged first)
-
-- B1 #XX — reconcile cards columns
-- B2 #XX — reconcile collections columns
-- B3 #XX — reconcile collaboration tables
-- B4 #XX — reconcile favorites system
-- B5 #XX — reconcile user profile
-
-## What this PR does NOT do
-
-- Does **NOT** edit any file under `migrations/`, `scripts/`, `pages/`,
-  `lib/`, `components/`, `test/`, or `package.json`.
-- Does **NOT** run the verification runbook itself — that's the
-  operator's post-merge job; see the runbook's "Procedure" section.
-
-## Verification checklist
-
-- [ ] `npm run lint` matches baseline
-- [ ] `npm run test:run` reports 21/21 passing
-- [ ] Every "captured by `migrations/<file>.js`" cross-reference in
-  SCHEMA_MAP points at a file that actually exists in `migrations/`
-  (eyeballed against `ls migrations/`)
-- [ ] `AGENTS.md` Gotcha #6 still has its original RESOLVED marker
-  (we only APPEND to it, not rewrite it)
-- [ ] `.convoys/ship-readiness.md` § "Queued convoys" has the flipped
-  `reconcile-historical-add-scripts` entry, the UNBLOCKED
-  `retire-graveyard-scripts-after-audit` marker, and the two new
-  follow-up entries
-- [ ] Operator post-merge: run `docs/MIGRATION_VERIFICATION_RUNBOOK.md`
-  against prod + a fresh Neon branch and confirm the diff is
-  non-material
-
-## Cross-references
-
-- Convoy file: `.convoys/reconcile-historical-add-scripts.md`
-- Per-brief files: `.convoys/reconcile-historical-add-scripts/brief-{1,2,3,4,5}-*.md`
-```
-
-## DO NOT
-
-- DO NOT edit any file under `scripts/`, `migrations/`, `pages/`, `lib/`, `components/`, `test/`.
-- DO NOT edit `package.json`, README, `next.config.js`, or any rule under `.cursor/rules/`.
-- DO NOT change `AGENTS.md` Gotcha #6's "RESOLVED by `migration-tool`" marker — append the new paragraph; don't rewrite the existing resolution attribution.
-- DO NOT add a `B6` reference anywhere — that brief was removed (Finding 1 → Outcome A).
-- DO NOT add `add-system-collection-on-register` or `unify-user-cards-foil-tracking` to the ship-readiness queued list — both were withdrawn during this convoy.
-- DO NOT remove the existing `wire-migrate-into-ci` entry from ship-readiness — it's still queued and unrelated to this convoy.
-- DO NOT run the verification runbook itself (that's the operator's post-merge step).
-
-## Rationale (≤3 sentences)
-
-Sequencing this brief last lets every documentation cross-reference point at a real file under `migrations/` rather than a placeholder. Bundling all four doc surfaces into one PR keeps the convoy's "as-shipped" record consistent (the migrations, the operator runbook, the AGENTS gotcha, and the ship-readiness ledger all flip together). The `docs/MIGRATION_VERIFICATION_RUNBOOK.md` extraction promotes a one-time convoy artifact into an evergreen operator tool that future migrations can reuse.

.convoys/scan-visual-catalog-search.md

@@ -1,233 +0,0 @@
----
-name: scan-visual-catalog-search
-classification: feature
-success_metric: |
-  After catalog embeddings exist and the new kNN path is on, ≥50% of
-  legitimate card scans (scan_attempts excluding not_a_card) auto-match
-  a printing with no picker — the original add-real-ocr-layer 70%
-  target, measured honestly. Gemini L2 share of attempts falls vs the
-  Phase 1 post-ship baseline.
-skip:
-  - ia
-  - ui-design
-  - visual
-  - a11y
-  - design
-  - flag
-status: shipped
-created: 2026-08-14
-depends_on:
-  - improve-scan-card-detection
-umbrella: scanner-identify-upgrade
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
-    role-design-system-auditor: cursor-grok-4.5-high
-    role-a11y-auditor: cursor-grok-4.5-high
-    role-doc-writer: auto
-  escalate_to: claude-sonnet-5-thinking-medium
-  escalate_to_premium: claude-4.6-opus-high-thinking
-  never_premium:
-    - role-reviewer
-    - role-security-auditor
-    - role-design-system-auditor
-    - role-a11y-auditor
-    - role-ui-designer
-    - role-doc-writer
----
-
-# Convoy: scan-visual-catalog-search
-
-Phase 3 of `scanner-identify-upgrade`. Identify cards by **what they
-look like**, not by reading the name. This is how Manabox / Delver-style
-scanners get printing-accurate matches on foil and alt-art.
-
-Blocked on `improve-scan-card-detection`: embeddings of unwarped
-phone crops will not match catalog `image_url`s reliably.
-
-## Why
-
-Name-only `pg_trgm` cannot distinguish printings. Tesseract fails on
-foil and stylized type even when it emits 8–20 characters (76.7% L1
-escalate with non-empty text). Gemini can read a name but still
-returns a picker when set/number are missing, and costs 5/min.
-
-The catalog already stores `cards.image_url` for every imported
-printing. Precompute an embedding per row; at scan time embed the
-warped crop and take top-k cosine. OCR / Gemini become hints and
-unknown-card fallback.
-
-## Scope
-
-### In scope
-
-- **Migration:** `pgvector` (confirm Neon availability) +
-  `cards.embedding` (or a side table `card_embeddings`) + ANN index.
-  Update `docs/SCHEMA_MAP.md`.
-- **Offline embed job:** new dated script or `npm run` task that
-  reads `image_url`, writes vectors. Idempotent. Rate-limit the
-  embedding provider. Do **not** edit historical `scripts/add-*.js`.
-- **Architect picks the embedder** (one):
-  1. Gateway embedding model (same `AI_GATEWAY_API_KEY`, server-only).
-  2. In-browser MobileCLIP-S2 / SigLIP ONNX for the *query* crop, with
-     catalog vectors baked or fetched — only if weight license + size
-     are acceptable.
-- **Identify path:** new Layer-0 (or replace L1) — kNN then
-  auto-match / disambiguate / escalate to existing L2. Log
-  `scan_attempts.layer = 0` (or Architect-ratified value).
-- **Similarity thresholds** analogous to 0.85 / 0.60, tuned on a
-  held-out set of scan captures if any exist in Blob.
-- Auth + rate-limit on any new route. No client-side API keys
-  (`forbidden-client-side-llm-keys` must stay green).
-
-### Out of scope
-
-- Replacing Gemini entirely on day one — keep L2 for catalog misses
-  and low similarity.
-- Training a custom card CNN.
-- Python GPU service.
-- Changing scanner chrome / cart.
-- Auto-approving the 27 pending `card_submissions`.
-
-## Roles invoked
-
-1. `role-architect` — embedder, schema, layer numbering, thresholds,
-   brief split (migration / backfill / route). Security-sensitive:
-   escalate to Sonnet if schema + new route land together.
-2. `role-implementer`.
-3. Audit: `role-reviewer` + `role-security-auditor` (required).
-
-## Todos
-
-- [x] Architect: confirm `pgvector` on prod Neon tier
-- [x] Brief 1 — migration + SCHEMA_MAP
-- [x] Brief 2 — catalog backfill job (idempotent)
-- [x] Brief 3 — identify kNN route + client escalate order
-- [x] Threshold bake-off on real crops (initial: 0.82 match / 0.58 disambig — tune post-backfill)
-- [ ] Re-measure auto-match % excluding `not_a_card` (blocked: L0 traffic + backfill)
-- [ ] Operator: finish `npm run backfill-embeddings` — **14.9%** (9,865 / 66,211) as of 2026-08-15
-
-## Post-ship (2026-08-15)
-
-**Merged:** PR #160 (Layer-0 visual catalog search), PR #162 (CI gates).
-
-**Pipeline roles (kickoff complete):**
-
-| Role | Outcome |
-| --- | --- |
-| Conductor | Convoy ratified; skip ia/ui-design/visual/a11y/design/flag |
-| UX reviewer | No new screens; L0→L1→L2 order; silent escalate when index empty |
-| Architect | D1–D4 decisions + 3 briefs (`.convoys/scan-visual-catalog-search/brief-*`) |
-| Implementer | Briefs 1–3 shipped in #160 |
-| Reviewer + security-auditor | #160 audit fan-out; #162 CI fix |
-| Doc-writer | SCHEMA_MAP layer 0 documented |
-
-**CI fixes (#162):** `lib/card-embed.js` allowlist + pgvector migration graceful
-skip on non-superuser homelab CI.
-
-**Neon:** pgvector v0.8.0; `cards.embedding vector(1024)` + HNSW index applied.
-Backfill **in progress** (9,865 / 66,211 = 14.9%). **0** `scan_attempts` with
-`layer = 0` yet — L0 path live but index too sparse / no post-#160 scans logged.
-
-**scan_attempts snapshot** (all-time n=250):
-
-| Signal | Value | Baseline |
-| --- | --- | --- |
-| L1 escalate | 78.4% (87/111) | 76.7% |
-| L1 matched | 5.4% (6/111) | 5.8% |
-| L2 not_a_card | 43.9% (61/139) | 44.6% |
-| End-to-end auto-match | 13.2% excl. not_a_card | 13.5% |
-| L0 attempts | 0 | — |
-
-**Aug 15 session (n=26):** See umbrella `.convoys/scanner-identify-upgrade.md`
-§ Post-ship telemetry.
-
-Re-measure after backfill completes and preview scanning generates L0 rows.
-
-## Likely file ownership
-
-| Area | Files |
-| --- | --- |
-| Schema | `migrations/*_card-embeddings.js`, `docs/SCHEMA_MAP.md` |
-| Backfill | new `scripts/` job (dated) or `lib/card-embed-backfill.js` |
-| Query | new `lib/card-visual-match.js`, `pages/api/scan/identify-by-image.js` **or** fold into existing identify |
-| Client | `lib/scanner-card-identify.js` (`tryLayer1TextIdentify` sibling) |
-
-Do not rewrite `lib/scanner-card-detection.js` here.
-
-## Multitask dispatch
-
-Brief 1 first. Brief 2 after 1. Brief 3 after 1 (can overlap 2 if the
-route degrades to escalate-when-empty-index).
-
-```
-/multitask role-reviewer + role-security-auditor
-```
-
-Group id: `audit-scan-visual-catalog-search-<pr>`.
-
-## CI impact
-
-| Workflow / job | Behavior |
-| --- | --- |
-| `schema-map-fresh` | **Fires** — migration + SCHEMA_MAP |
-| `ci.yml` migrate | Must apply `pgvector` on CT 102 CI Postgres — Architect must verify the extension is available there or gate the migration |
-| `forbidden-client-side-llm-keys` | Blocking |
-
-## Operator action
-
-- Confirm Neon `pgvector` (or Neon’s equivalent) on the prod project.
-- Budget: one embedding per catalog image, plus one per live scan if
-  the query embed is server-side. Architect publishes a cost note
-  before Brief 2 runs against prod images.
-- No new browser secrets.
-
-## Conductor notes
-
-This is the accuracy leap. Do not start it to "try CLIP" before Phase 2
-crops are rectified — that wastes the backfill. If Architect finds
-`pgvector` unavailable on CI Postgres, stop and write a fallback
-(external index vs skip-CI-extension plan) rather than shipping an
-untestable migration.
-
-## UX
-
-No new screens. Scan flow stays L0 → L1 → L2 with the same
-disambiguation picker and error toasts. When the catalog index is empty
-(backfill not run), L0 escalates silently with no embed cost.
-
-Gallery uploads now try visual match before OCR.
-
-## Architecture
-
-### Decision D1 — Gateway multimodal embedder (`cohere/embed-v4.0`)
-
-Server-only via `AI_GATEWAY_API_KEY`. 1024-dim vectors in
-`cards.embedding`. Env: `SCAN_EMBED_MODEL`, `SCAN_EMBED_DIMENSION`.
-
-### Decision D2 — Layer numbering
-
-| Layer | Path |
-| --- | --- |
-| 0 | `POST /api/scan/identify-by-image` |
-| 1 | Tesseract + `identify-by-text` |
-| 2 | Gemini + `scan/identify` |
-
-### Decision D3 — Thresholds
-
-Match ≥ **0.82** (0.06 gap). Disambiguation ≥ **0.58**.
-
-### Decision D4 — Rate limit
-
-`checkScanRateLimit` on identify-by-image. L0 429 falls through to L1
-(not a hard stop).
-
-Audit group id: `audit-scan-visual-catalog-search-<pr>`.

.convoys/scan-visual-catalog-search/brief-1-migration-schema.md

@@ -1,23 +0,0 @@
----
-convoy: scan-visual-catalog-search
-brief_number: 1
-depends_on: []
-recommended_model: composer-2.5
-model_tier: standard
-files:
-  - migrations/1782000000001_add-card-embeddings.js
-  - docs/SCHEMA_MAP.md
----
-
-# Brief 1: pgvector migration + SCHEMA_MAP
-
-## Goal
-
-Add `vector(1024)` embedding column + HNSW index on `cards`.
-
-## Acceptance criteria
-
-- [ ] `CREATE EXTENSION IF NOT EXISTS vector`
-- [ ] `cards.embedding`, `cards.embedded_at`
-- [ ] `idx_cards_embedding_hnsw` partial index
-- [ ] SCHEMA_MAP documents layer 0 + pgvector

.convoys/scan-visual-catalog-search/brief-2-backfill-embeddings.md

@@ -1,24 +0,0 @@
----
-convoy: scan-visual-catalog-search
-brief_number: 2
-depends_on: [1]
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/card-embed.js
-  - scripts/backfill-card-embeddings.js
-  - package.json
-  - test/lib/card-embed.test.js
----
-
-# Brief 2: Catalog embedding backfill
-
-## Goal
-
-Server-side embed job using `cohere/embed-v4.0` via AI Gateway; idempotent backfill from `cards.image_url`.
-
-## Acceptance criteria
-
-- [ ] `lib/card-embed.js` exports `embedCardImage`, `formatEmbeddingForPg`
-- [ ] `npm run backfill-embeddings` script (skips rows with embedding unless FORCE=1)
-- [ ] Rate-limited (`SLEEP_MS`) and DRY_RUN support

.convoys/scan-visual-catalog-search/brief-3-identify-knn-route.md

@@ -1,27 +0,0 @@
----
-convoy: scan-visual-catalog-search
-brief_number: 3
-depends_on: [1]
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/card-visual-match.js
-  - pages/api/scan/identify-by-image.js
-  - lib/scanner-card-identify.js
-  - lib/use-scanner-identification.js
-  - test/lib/card-visual-match.test.js
----
-
-# Brief 3: Layer-0 identify route + client orchestration
-
-## Goal
-
-kNN visual match before L1/L2; log `scan_attempts.layer = 0`.
-
-## Acceptance criteria
-
-- [ ] `POST /api/scan/identify-by-image` — auth + `checkScanRateLimit` + embed + kNN
-- [ ] `identifyTrackedCardCapture` order: L0 → L1 → L2
-- [ ] Gallery path runs L0 → L1 → L2
-- [ ] Skip auto Gemini refine when disambiguation from L0 (same as L1)
-- [ ] Thresholds: match 0.82, disambiguation 0.58

.convoys/scanner-desktop-layout.md

@@ -1,902 +0,0 @@
----
-name: scanner-desktop-layout
-classification: feature
-success_metric: |
-  On md+ viewports, /scanner keeps the desktop app chrome (sidebar +
-  top bar), shows a framed camera workstation with a real webcam
-  device picker, Upload Image, Batch Scan, Auto-detect, Scanner
-  Tips, a live match inspector, and a bottom strip with Recent
-  Scans / Scan Queue / Duplicates — without regressing the mobile
-  immersive checkout.
-skip: []
-status: shipped
-created: 2026-08-15
-depends_on:
-  - scanner-mobile-checkout
-  - scanner-rebuild
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
-    role-design-system-auditor: cursor-grok-4.5-high
-    role-a11y-auditor: cursor-grok-4.5-high
-    role-doc-writer: auto
-  escalate_to: claude-sonnet-5-thinking-medium
-  escalate_to_premium: claude-4.6-opus-high-thinking
-  never_premium:
-    - role-reviewer
-    - role-security-auditor
-    - role-design-system-auditor
-    - role-a11y-auditor
-    - role-ui-designer
-    - role-doc-writer
-design_direction:
-  source: role-ui-designer
-  skill: ui-ux-pro-max
-  skill_version: "2.5.0"
-  version: 1
-  locked_at: 2026-08-15
-  product_type: desktop trading card scanner workstation
-  pattern: Feature-Rich Showcase (workstation variant)
-  style: Liquid Glass / glassmorphism
-  stack: nextjs
-  layout_reference: image-1eeebe23-9983-4a96-a3e7-4e3cdfdceb5b.png
----
-
-# Convoy: scanner-desktop-layout
-
-Give `/scanner` a dedicated desktop workstation layout from the
-attached dark/light mock (camera + live result + history strip),
-while leaving the shipped mobile immersive checkout alone.
-
-Worktree: `tcg-vault-worktrees/scanner-desktop-layout` on
-`convoy/scanner-desktop-layout` (branched from `origin/main` @
-`0d52858`). Layout reference:
-`image-1eeebe23-9983-4a96-a3e7-4e3cdfdceb5b.png`.
-
-Do **not** land this on `dashboard-home-realignment` — that convoy
-owns sidebar IA + top-bar chrome. Do **not** land this on
-`scanner-identify-upgrade` — that epic owns detect/identify accuracy.
-
-## Why
-
-`scanner-mobile-checkout` shipped the phone job: full-bleed camera,
-local cart, checkout sheet. Desktop (`md+`) got the leftover
-composition — the same camera chrome plus a 360px cart side panel
-(`ScannerReview` `variant="side-panel"`). That is not a desk
-workstation.
-
-On a laptop the user wants to see the webcam, inspect the current
-match (set, rarity, number, condition, foil, confidence), decide
-what to do with it, and keep a history/queue in view — without
-losing the app sidebar or search bar. The mock is that layout.
-Today they get a phone overlay stretched into a column.
-
-## Scope
-
-### In scope
-
-- **Desktop-only composition (`md+`).** Keep Layout sidebar +
-  TopSearchBar. Stop treating desktop as an immersive camera page
-  with a bolted-on cart. Mobile (`max-md`) stays
-  `chrome="immersive"` + checkout sheet.
-- **Framed camera viewport.** Large live feed with ember corner
-  brackets (already in `ScannerCamera`), Auto-detect status, and
-  desk controls under the frame. Camera is a panel in the page,
-  not a full-bleed overlay.
-- **Real webcam device picker.** `enumerateDevices` + `deviceId`
-  in `useCameraScanner` (not facing-mode swap relabeled). Persist
-  the last-used device for the tab if cheap. Empty-list / denied-
-  permission fallback. Mobile keeps the existing facing-mode
-  toggle — do not replace the phone chrome with a device `<select>`.
-- **Upload Image + Batch Scan.** Upload Image stays single-file
-  (existing gallery path). **Batch Scan** is a multi-file picker
-  that runs each image through `identifyFromGalleryFile`
-  **sequentially** (respect existing identify rate limits; no
-  parallel Gemini storm, no new batch API). Progress and failures
-  show in Scan Queue. Live multi-card on the webcam stays
-  Auto-detect — do not build a new pile-in-one-frame detector.
-- **Scanner Tips.** Header control from the mock. Glass popover
-  or modal (use `<Modal>` / `GlassSurface`, no custom scrim) with
-  short lighting / framing / foil / auto-detect guidance. No new
-  route. Copy authored in this convoy (IA + UI Designer).
-- **Live match inspector (right rail).** Current identify result:
-  thumbnail, name, set, rarity, collector number, condition,
-  foil, confidence, primary add, Rescan. This replaces the cart
-  list as the primary right-hand surface.
-- **Bottom history / queue strip.** Three tabs over the existing
-  cart + ownership model: **Recent Scans** (session history),
-  **Scan Queue** (uncommitted cart), **Duplicates** (already in
-  My Collection via `ownershipMap`, and/or same-session
-  name+set repeats from `mergeScannedCardEntry`). Badge counts
-  on Queue and Duplicates. Clear + view-all as IA/UX refine.
-- **Reuse, don't rewrite, the scan engine.** Same hooks:
-  `useCameraScanner`, `useScannerIdentification`, `useScannerQueue`,
-  `scanner-session`. Identify / OCR / Gemini stay out.
-
-### Out of scope
-
-- Identify / detection / Gemini (`lib/scanner-card-identify.js`,
-  `pages/api/scan/identify.js`, OpenCV). Sibling:
-  `scanner-identify-upgrade`.
-- Mobile immersive checkout, scan peek, or checkout sheet — no
-  visual or interaction regression below `md`.
-- Layout nav IA, Daily Ember, notifications, profile cluster.
-  Sibling: `dashboard-home-realignment`. Mock items Wishlist /
-  Trades / Market / Events / Binders are **not** product nav.
-- Wishlist as a feature (no table / API). Mock "Save to Wishlist"
-  maps to **Add to List** or drops — IA decides.
-- A new identify / batch-OCR API, parallel Gemini calls, or a
-  pile-in-one-frame detector. Batch Scan is multi-file sequential
-  identify on the existing path.
-- Schema / new tables. Cart remains client session state.
-- Changing the homepage visual-diff baseline except as a
-  side-effect of `/scanner` desktop chrome (scanner surfaces only).
-
-### Product-vocab lock (from mock → Deck Hearth)
-
-| Mock copy | Ship as |
-| --- | --- |
-| Add to Collection | `VOCAB.ADD_TO_MY_COLLECTION` |
-| Save to Wishlist | Add to List, or omit |
-| Binders (nav) | Lists — not this convoy |
-| Collection (nav) | My Collection — not this convoy |
-
-## Roles invoked
-
-1. `role-ia-architect` — desktop flow vs mobile cart; inspector
-   vs queue commit; Duplicates membership (`ownershipMap` vs
-   session repeat); Batch Scan progress / failure; Tips content
-   outline; device-picker empty/denied states.
-2. `role-ui-designer` — lock the md+ workstation against the
-   attached mock using Liquid Glass tokens (`ui-ux-pro-max` is
-   installed), including Tips popover, device `<select>`, Batch
-   Scan progress, and the three-tab strip. Do **not** skip
-   `ui-design`.
-3. `role-ux-reviewer` — inspect-then-add vs scan-all-then-checkout
-   on desktop; Auto-detect off; Rescan; empty inspector; leave
-   with an uncommitted queue; sequential batch cancel; duplicate
-   tab actions (increment qty vs skip vs still add).
-4. `role-architect` — briefs. Likely: (1) page composition +
-   Layout chrome split, (2) camera panel + `deviceId` picker,
-   (3) result inspector, (4) history/queue/duplicates strip,
-   (5) batch multi-file identify + Tips. `slice_dependencies`
-   must mark what can run in parallel.
-5. `role-implementer` — per brief.
-6. Audit fan-out: reviewer + security-auditor + design-system-auditor
-   + a11y-auditor.
-
-## Todos
-
-- [x] IA: desktop screen inventory + inspector-add vs cart-commit;
-      Duplicates membership; Batch Scan + Tips content
-- [x] UI Designer: lock md+ workstation (tokens, not hex) from
-      the attached mock; light + dark; Tips, device picker,
-      batch progress, three-tab strip
-- [x] UX: Auto-detect off, Rescan, empty state, leave-with-queue,
-      keyboard on desk controls, batch cancel, duplicate actions
-- [x] Architect: briefs + `slice_dependencies`; confirm Layout
-      is `chrome="default"` on md+ only
-- [ ] Desktop composition in `pages/scanner.js` (do not hide
-      sidebar / top bar at md+)
-- [ ] Camera as a framed panel; `deviceId` picker + Upload +
-      Batch Scan + Auto-detect; hide mobile overlay chrome at md+
-- [ ] Live match inspector wired to the latest unprocessed
-      identify (condition / foil already on the cart entry)
-- [ ] Bottom strip: Recent Scans + Scan Queue + Duplicates over
-      `useScannerQueue` / `ownershipMap` / `scanner-session`
-- [ ] Scanner Tips popover/modal with convoy-authored copy
-- [ ] Sequential multi-file Batch Scan through
-      `identifyFromGalleryFile` (cancellable, queue progress)
-- [ ] Tests for desktop composition (inspector + queue +
-      duplicates + batch enqueue, no mobile sheet) and
-      no-regression on checkout sheet at `max-width: 767px`
-- [ ] Visual-diff: desktop `/scanner` surface; refresh Linux
-      baselines if the page is in the visual suite
-
-## What exists today (conductor survey)
-
-`/scanner` is one route, two compositions, one engine.
-
-| Layer | Files | Today |
-| --- | --- | --- |
-| Page | `pages/scanner.js` | Auth gate; `Layout chrome="immersive"` on **all** viewports; camera column + `md:` 360px `ScannerReview` cart; mobile-only `ScannerCheckoutSheet` |
-| Layout | `components/Layout.js` | Immersive hides **mobile** nav + top bar (`max-md` only). Desktop sidebar + TopSearchBar already stay visible. |
-| Camera chrome | `components/scanner/ScannerCamera.js` | Full-bleed video, overlay top bar (back / title / gallery), bottom bar (flash / facing / status / Review N), scan peek, disambiguation. Same chrome on desktop. |
-| Cart | `lib/use-scanner-queue.js`, `lib/scanner-session.js` | Identify enqueues locally (`processed: false`). Commit via `commitSelectedToOwned` / `commitSelectedToCollection`. `sessionStorage` persist. `addSingleCardToOwned` already exists. |
-| Identify | `lib/use-scanner-identification.js`, `lib/use-camera-scanner.js` | Facing-mode swap only — **no** `deviceId` / `enumerateDevices`. Auto-detect is always on unless `verificationPausedRef` (checkout / list picker / disambiguation). |
-| Review | `components/scanner/ScannerReview.js` | Thin wrapper: desktop side panel titled "Cart" that mounts `ScannerCheckoutContent`. |
-
-Mobile checkout decisions that still apply unless IA overturns them
-for desktop only: stay on camera after commit (D1), skip Setup
-(D3), My Collection + List only (D4), gallery in-scope (D5),
-cart in `sessionStorage` (D7).
-
-## Conductor notes (build shape)
-
-Likely file ownership for Architect to refine:
-
-| Area | Files |
-| --- | --- |
-| Viewport split | `pages/scanner.js` — `chrome` default on md+, immersive on mobile; desktop grid vs mobile overlay |
-| Camera panel | `components/scanner/ScannerCamera.js` (desktop variant or `variant="workstation"`), `lib/use-camera-scanner.js` (`enumerateDevices` + `deviceId`) |
-| Inspector | new `components/scanner/ScannerResultPanel.js` — latest cart entry + condition/foil + add/rescan |
-| History strip | new `components/scanner/ScannerHistoryStrip.js` — Recent / Queue / Duplicates over `queue.scannedCards` + `ownershipMap` |
-| Batch Scan | `lib/use-scanner-identification.js` (`identifyFromGalleryFile` loop), queue progress UI |
-| Tips | new `components/scanner/ScannerTips.js` — `<Modal>` or popover, convoy copy |
-| Cart reuse | `lib/use-scanner-queue.js`, `lib/scanner-session.js`, `ScannerCheckoutSheet.js` (mobile only) |
-| Copy | `lib/collection-vocabulary.js` |
-
-Do not rewrite identification. Prefer a desktop layout shell that
-**hides** mobile overlay chrome at `md+` rather than forking the
-camera hook.
-
-## Decisions (post-conductor)
-
-Locked 2026-08-15 from the parent session. IA / UX / Architect
-treat these as settled.
-
-| # | Decision |
-| --- | --- |
-| C1 | **Batch Scan is in.** Multi-file sequential identify via the existing gallery path. No new batch API, no parallel Gemini, no new pile detector. |
-| C2 | **Duplicates tab is in.** Strip tab with a badge. Membership = already-owned (`ownershipMap`) and/or same-session name+set repeats. IA picks the exact rule and tab actions. |
-| C3 | **Scanner Tips is in.** Header control → glass popover/modal. Copy in this convoy. |
-| C4 | **Real webcam device picker is in.** `enumerateDevices` + `deviceId` on desktop. Mobile keeps facing-mode swap. |
-| C5 | **Inspector can commit this card now** *and* the queue strip remains for multi-add (same cart, two commit surfaces). Overturn only if IA finds a conflict. |
-
-## Open questions (IA / product)
-
-1. **Duplicates membership + actions.** Owned-in-collection only,
-   session repeats only, or both? From the tab, can the user still
-   add (increment qty), skip, or jump the inspector to that row?
-2. **Wishlist.** Out as a feature. Confirm "Save to Wishlist" →
-   Add to List on the inspector, or omit the third action.
-3. **Auto-detect toggle.** User-facing pause of identification
-   (extend `verificationPausedRef`), or just a status badge?
-4. **Batch Scan cancel / errors.** Mid-batch cancel: keep already-
-   identified rows? Per-file failure: continue the rest and flag
-   the row, or stop?
-5. **Tips content.** Four or five short tips (lighting, frame the
-   card, foil glare, hold still, auto-detect). IA drafts; UI
-   Designer locks the surface.
-
-## Multitask dispatch
-
-Planning is serial: IA → UI Designer → UX → Architect.
-
-After architect: implementer fan-out only if briefs have
-`depends_on: []` and disjoint `files:`. Device picker
-(`use-camera-scanner.js`) and Tips (`ScannerTips.js`) are the
-best candidates to parallelize with the inspector if they do
-not both own `pages/scanner.js`. Page composition likely
-blocks the strip and Batch Scan wiring.
-
-After PR draft: `/multitask` audit fan-out
-`role-reviewer + role-security-auditor + role-design-system-auditor + role-a11y-auditor`
-(group id: `audit-scanner-desktop-layout-<pr>`).
-
-## IA
-
-### Affected routes
-
-- `/scanner` — **[modified]** Single route, two viewport compositions. Desktop (`md+`) switches to `Layout chrome="default"` (sidebar + TopSearchBar visible), framed camera workstation, live match inspector (right rail), and bottom history strip. Mobile (`max-md`) stays `chrome="immersive"` with checkout sheet — no regression.
-- `/login` — **[impacted]** Existing `returnUrl=/scanner` auth gate unchanged; desktop users land on the workstation after sign-in.
-- `/collections`, `/my-cards` — **[impacted]** Post-commit navigation targets only (Add to List picker, success flows). No route or nav IA changes in this convoy.
-
-No new routes. No API route changes.
-
-### User flow
-
-```mermaid
-flowchart LR
-  A["/scanner (auth)"] --> B{"md+?"}
-  B -->|Yes| C["Workstation"]
-  B -->|No| D["Immersive mobile"]
-  C --> E["Scan / Upload / Batch"]
-  E --> F["Match inspector"]
-  F --> G["Add or queue"]
-  C --> H["Strip tabs"]
-  H --> F
-```
-
-Desktop path: user opens `/scanner` with app chrome → scans via webcam, single Upload Image, or Batch Scan (sequential gallery identify) → latest match appears in the right-rail inspector → commits one card via inspector **or** batches via Scan Queue strip → Duplicates tab surfaces owned + session-repeat rows for review/increment. Mobile path unchanged: full-bleed camera → checkout sheet.
-
-### Screen inventory
-
-| Screen | Path | New/modified | Notes |
-| --- | --- | --- | --- |
-| Scanner Desktop Workstation | `/scanner` | modified | `md+` grid: framed camera panel (device picker, Upload, Batch Scan, Auto-detect toggle, Tips), right-rail inspector, bottom strip. Replaces 360px cart side panel as primary right-hand surface. |
-| Scanner Mobile Immersive | `/scanner` | impacted (no regression) | `max-md`: `chrome="immersive"`, overlay camera chrome, `ScannerCheckoutSheet`. D1/D3/D4/D5/D7 decisions preserved. |
-| Live Match Inspector | `/scanner` | new (sub-surface) | Right rail on desktop. Shows latest unprocessed identify: thumbnail, name, set, rarity, collector #, condition, foil, confidence. Actions: `VOCAB.ADD_TO_MY_COLLECTION`, `VOCAB.ADD_TO_LIST`, Rescan. Single-card commit without opening checkout sheet. |
-| History / Queue Strip | `/scanner` | new (sub-surface) | Bottom strip on desktop. Tabs: **Recent Scans** (session history), **Scan Queue** (uncommitted cart, badge = unprocessed count), **Duplicates** (badge = duplicate row count). Row click focuses card in inspector. |
-| Scanner Tips | `/scanner` | new (sub-surface) | Header control → glass `<Modal>` or popover. Five convoy-authored tips (see Content deltas). No route change. |
-| List Picker | `/scanner` | impacted | Existing "Choose a List" `<Modal>`. Opened from inspector `VOCAB.ADD_TO_LIST` on desktop (and unchanged on mobile). |
-| Leave Scanner | `/scanner` | impacted | Existing leave-with-uncommitted-queue modal. Applies to both viewports when navigating away with queue items. |
-
-### Content / data model deltas
-
-**Copy (ship from `lib/collection-vocabulary.js`):**
-
-- Primary add: `VOCAB.ADD_TO_MY_COLLECTION` ("Add to My Collection").
-- Secondary add: `VOCAB.ADD_TO_LIST` ("Add to List") — **not** "Save to Wishlist" (feature omitted).
-- Strip tab labels: "Recent Scans", "Scan Queue", "Duplicates".
-- Camera controls: "Upload Image", "Batch Scan", "Auto-detect" (toggle + status on/off), "Scanner Tips", "Rescan".
-- Device picker: "Camera" or "Webcam" `<select>` label; empty/denied fallback copy (UI Designer).
-
-**Scanner Tips content (draft for UI Designer):**
-
-1. Good lighting — avoid glare on foil cards.
-2. Fill the frame with one card; keep corners visible.
-3. Hold still until Auto-detect locks the match.
-4. Use Batch Scan for a pile of photos from your gallery.
-5. Switch webcam if the image is dark or mirrored.
-
-**No schema changes.** Cart remains client `sessionStorage` via `lib/scanner-session.js`. Duplicates derive from existing `ownershipMap` (already in My Collection) and `mergeScannedCardEntry` (same-session name+set repeats) — no new tables or API fields.
-
-**IA decisions (locked — formerly open questions):**
-
-| Topic | Decision |
-| --- | --- |
-| Duplicates membership | **Both** sources: `ownershipMap` (already-owned) **and** same-session name+set repeats via `mergeScannedCardEntry`. Badge = count of rows in the Duplicates set. Row click focuses that card in the inspector. User can still add (increment qty) from inspector or queue. |
-| Wishlist | **Omit.** Inspector third action is `VOCAB.ADD_TO_LIST`, not wishlist. |
-| Auto-detect | **Real pause toggle** on desktop. Extends `verificationPausedRef` (user off = paused identify). Status badge reflects on/off. Mobile behavior unchanged unless UX specifies otherwise. |
-| Batch cancel / errors | Mid-batch **cancel keeps** already-identified rows. Per-file failure **continues** the rest and flags that row in Scan Queue — do not stop the batch. |
-| Inspector vs queue commit | **Both surfaces** (C5): inspector commits one card now; Scan Queue strip handles multi-add / bulk commit. Same cart, two commit paths. |
-| Webcam picker | Desktop only: `enumerateDevices` + `deviceId`. Mobile keeps facing-mode swap (C4). |
-
-### Open IA questions
-
-None — all five conductor questions resolved above.
-
-## Design direction
-
-Locked v1 against `image-1eeebe23-9983-4a96-a3e7-4e3cdfdceb5b.png`
-(dark + light side-by-side). **Incremental redesign** of an existing
-Liquid Glass surface — not a new palette. Generator run:
-`desktop trading card scanner workstation camera inspector queue
-glassmorphism` (`ui-ux-pro-max` v2.5.0).
-
-### Summary
-
-On `md+`, `/scanner` is a **desk workstation** inside normal app
-chrome (sidebar + TopSearchBar): a framed live-camera panel with
-ember corner brackets, a right-rail **live match inspector**, and a
-bottom **history / queue strip** — inspect one card, commit from the
-rail, or batch from the strip. Mobile stays immersive; this direction
-applies only at `md+`.
-
-### Pattern + style
-
-| Field | Value |
-| --- | --- |
-| Product type | Desktop trading card scanner workstation |
-| Landing / app pattern | Feature-Rich Showcase → **workstation grid** (camera + inspector + strip; not a marketing landing) |
-| UI style | **Liquid Glass** (existing Deck Hearth DS) — translucent panels, rim-light, ember accent rings |
-| Stack notes | nextjs · React 18 · Tailwind + CSS variables · `<Modal>` / `<GlassSurface>` / `<Button>` primitives |
-
-**Generator vs repo (repo wins):**
-
-| Generator | Locked override |
-| --- | --- |
-| Exaggerated Minimalism (oversized type, massive whitespace) | **Rejected** — match existing app density; page title `text-2xl` / `font-semibold`, subtitle `text-sm text-secondary` |
-| Palette `#1E293B` / `#2563EB` scan blue | **Rejected** — use `--accent-ember`, `--accent-flame`, `--accent-gold`, `--bg-*`, `--text-*` from `styles/globals.css` |
-| Inter typography | **Rejected** — keep system stack (`-apple-system, BlinkMacSystemFont, …`) |
-| Feature-Rich Showcase sections | **Adapted** — three functional zones (camera, inspector, strip) replace marketing feature cards |
-
-### Layout authority (`md+` only)
-
-Viewport split at `md` (768px). Below `md`, no changes (immersive +
-checkout sheet).
-
-```
-┌─────────────────────────────────────────────────────────────────┐
-│ [Layout sidebar] │ TopSearchBar + profile                        │
-├──────────────────┼──────────────────────────────────────────────┤
-│                  │ Card Scanner          [Scanner Tips]          │
-│                  │ <subtitle>                                    │
-│                  ├──────────────────────────┬───────────────────┤
-│                  │ ┌─ Auto-detect ON ─┐     │ Scan Result  98%  │
-│                  │ │  [live video]    │     │ ┌────┐ metadata   │
-│                  │ │  ember brackets  │     │ │thumb│ set/rarity │
-│                  │ └──────────────────┘     │ condition ▾ foil  │
-│                  │ [Camera ▾][Upload][Batch]  │ confidence bar    │
-│                  │              [Auto-detect]│ + Add to My Coll. │
-│                  │                          │ Rescan | Add List │
-│                  ├──────────────────────────┴───────────────────┤
-│                  │ Recent │ Queue (N) │ Dupes (N)    Clear All│
-│                  │ [chip][chip][chip]…                         │
-│                  │              [ View All Scans ]             │
-└──────────────────┴──────────────────────────────────────────────┘
-```
-
-| Zone | Width / placement | Surface recipe |
-| --- | --- | --- |
-| Page header | Full content width above grid | Flat on `--bg-primary`; Tips = `<Button variant="ghost">` + lightbulb icon |
-| Camera column | `flex-1` / `min-w-0`; ~60–65% | Viewport frame: `--glass-surface-low` + `--ember-rim-subtle` on outer frame; **ember corner brackets** on video (existing `ScannerCamera`) |
-| Desk control bar | Directly under viewport | `--glass-surface-mid` bar, `rounded-xl`, horizontal flex wrap at `md` |
-| Inspector rail | Fixed `w-[360px]` or `max-w-sm`; sticky top optional | `--glass-surface-low` panel, `--elevation-ambient`, `--rim-light-inner/outer` |
-| Bottom strip | Full content width below main grid | `--glass-surface-mid` container; tab row + chip scroller |
-
-**Page copy (header):**
-
-- Title: **Card Scanner**
-- Subtitle: *Identify cards with your webcam and add them to My
-  Collection.*
-
-### Colors
-
-All values via CSS variables — **no hex in `.js`**.
-
-| Role | Token | Usage on this surface |
-| --- | --- | --- |
-| Page background | `--bg-primary` | Workstation canvas behind glass panels |
-| Panel fill | `--glass-surface-{low,mid,high}` | Camera frame (low), control bar + strip (mid), popovers (high) |
-| Primary text | `--text-primary` | Titles, card names, tab labels |
-| Secondary text | `--text-secondary` | Subtitle, set/rarity, timestamps |
-| CTA / primary action | `--accent-ember` | **Add to My Collection** button; active tab underline; selected chip border |
-| Accent highlight | `--accent-flame`, `--accent-gold` | Confidence bar fill; match badge when ≥90% |
-| Interactive rim | `--ember-rim-subtle` / `--ember-rim-pronounced` | Camera frame rest; primary button hover/focus |
-| Success / match | `--accent-gold` or existing success token | Auto-detect ON dot; high-confidence pill |
-| Error / batch fail | `--accent-ember` at reduced opacity or danger variant | Failed queue row indicator |
-| Border | `--border` | Control bar dividers, chip separators |
-
-Light and dark both use the same token names; theme context switches
-values. Mock's cool-navy dark is approximated by existing
-`--bg-primary-dark` — do not introduce a new dark base.
-
-### Typography
-
-| Role | Font | Notes |
-| --- | --- | --- |
-| Page title | System stack, `text-2xl font-semibold` | "Card Scanner" |
-| Subtitle | System stack, `text-sm`, `--text-secondary` | One line under title |
-| Section labels | `text-sm font-medium uppercase tracking-wide` | "Scan Result", strip tab labels |
-| Card name (inspector) | `text-lg font-semibold` | Primary identify headline |
-| Metadata | `text-sm`, `--text-secondary` | Set · rarity · collector # |
-| Chip / queue row | `text-sm` name, `text-xs` meta | Timestamps right-aligned |
-
-### Camera viewport + desk controls
-
-**Inside frame (overlay on video):**
-
-- **Auto-detect badge** — top-left pill: green status dot +
-  `Auto-detect ON` / `Auto-detect OFF` (reflects pause toggle).
-- **Ember corner brackets** — four L-shaped corners on the card
-  alignment region (ship existing `ScannerCamera` bracket styling).
-- Optional alignment guide (mock dotted vertical line) — **omit in
-  v1** unless implementer brief explicitly includes it; brackets +
-  badge are required.
-
-**Desk control bar (below frame, left → right):**
-
-| Control | Component | Notes |
-| --- | --- | --- |
-| Camera | `<select>` or styled native picker, label **Camera** | `enumerateDevices` video inputs; desktop only |
-| Upload Image | `<Button variant="secondary">` + upload icon | Single-file; existing gallery path |
-| Batch Scan | `<Button variant="secondary">` + stack icon | Multi-file picker; triggers sequential identify |
-| Auto-detect | Toggle switch + label **Auto-detect** | Right-aligned on wide screens; extends `verificationPausedRef` |
-
-**Webcam device picker — fallback copy (locked):**
-
-| State | Message | Action hint |
-| --- | --- | --- |
-| Loading | Detecting cameras… | Disable `<select>` until resolved |
-| Empty list | No camera found | Connect a webcam or use **Upload Image**. |
-| Permission denied | Camera access blocked | Allow camera in your browser settings, or use **Upload Image**. |
-| Error (enumerate failed) | Couldn't list cameras | Use **Upload Image** or reload the page. |
-
-When empty or denied, render the message inline below the disabled
-`<select>` (`text-sm`, `--text-secondary`); do not use a blocking
-modal for device errors.
-
-### Live match inspector (right rail)
-
-Header row: **Scan Result** + confidence pill (e.g. `98% Match`).
-
-**Empty state** (no identify yet): centered illustration area +
-*"Point your camera at a card or upload an image to see a match."*
-
-**Populated state** (latest unprocessed cart entry):
-
-- Thumbnail + name, set, rarity icon, collector number
-- **Condition** — `<select>` (existing condition options)
-- **Foil** — toggle switch
-- Confidence — percentage + horizontal bar + caption (*Excellent match.*
-  / *Good match.* / *Low confidence — verify before adding.*)
-- Actions (top → bottom priority):
-  1. **Primary:** `VOCAB.ADD_TO_MY_COLLECTION` (`<Button variant="primary">`, `+` icon optional)
-  2. **Secondary row:** **Rescan** (ghost) · `VOCAB.ADD_TO_LIST` (ghost)
-- **Never** ship "Add to Collection", "Save to Wishlist", or "Mark
-  Owned".
-
-### Bottom history / queue strip
-
-**Tab row:** **Recent Scans** · **Scan Queue** `(N)` · **Duplicates**
-`(N)` — badge = unprocessed count / duplicate row count per IA.
-**Clear All** — text link, right-aligned (`text-sm`, destructive on
-hover).
-
-**Card chips** (horizontal scroll, `overflow-x-auto`):
-
-- Thumbnail, name, set · rarity · condition snippet
-- Status: confidence % + relative time (*Just now*, *2 min ago*)
-- Active / focused row: `--ember-rim-pronounced` border (matches mock
-  ember outline on leftmost chip)
-- **No `backdrop-filter` on individual chips** — solid
-  `--bg-secondary` per per-card grid performance budget
-  (`docs/DESIGN_TOKENS.md` § Per-card grid performance budget)
-
-**View All Scans** — full-width ghost button at strip bottom; opens
-expanded queue view or scrolls strip — Architect brief decides;
-visual = translucent bar button from mock.
-
-**Row click** — focuses that card in the inspector (IA-locked).
-
-### Batch Scan progress (Scan Queue tab)
-
-When batch is running, **Scan Queue** tab auto-focuses (or shows an
-inline banner):
-
-- Progress line: **Scanning 3 of 12…** with determinate progress bar
-  (`--accent-ember` fill)
-- **Cancel** — ghost button; **keeps already-identified rows** (IA)
-- Per-file failure — enqueue row with error flag, label **Identify
-  failed**, `text-sm` reason if available; batch **continues** remaining
-  files
-- On complete — banner dismisses; failed rows stay in queue with
-  visual error state (ember left border or warning icon)
-
-### Scanner Tips (surface locked)
-
-**`<Modal>`** — five tips exceed popover length; use
-`components/ui/Modal` + modal panel recipe (`--glass-surface-low`,
-`--modal-scrim`). Trigger: header **Scanner Tips** button (lightbulb
-icon + label).
-
-| # | Tip |
-| --- | --- |
-| 1 | **Good lighting** — avoid glare on foil cards. |
-| 2 | **Fill the frame** with one card; keep corners visible. |
-| 3 | **Hold still** until Auto-detect locks the match. |
-| 4 | **Use Batch Scan** for a pile of photos from your gallery. |
-| 5 | **Switch camera** if the image is dark or mirrored. |
-
-Modal title: **Scanner Tips**. Dismiss via close control + Esc +
-scrim click (standard `<Modal>` behavior).
-
-### Effects + motion
-
-- Panel transitions: **150–200ms** ease on hover/focus for buttons and
-  chips (`docs/MOTION_SYSTEM.md` if defined; else `transition-colors
-  duration-200`)
-- Auto-detect badge dot: subtle pulse when ON; **respect
-  `prefers-reduced-motion`** (static dot when reduced)
-- Confidence bar: width transition 300ms on value change; no animation
-  when reduced
-- Tab switch: instant content swap (no slide); optional 150ms fade on
-  chip row refresh
-- Hover: `cursor-pointer` on all clickable chips, tabs, buttons;
-  `--ember-rim-subtle` → `--ember-rim-pronounced` on primary hover
-
-### Anti-patterns (do not ship)
-
-- Full-bleed camera overlay on desktop (mobile-only chrome)
-- Hex colors in `.js` / inline styles
-- Generator slate/blue palette or Inter font import
-- `backdrop-filter` on per-card strip chips or thumbnail tiles
-- "Add to Collection", "Save to Wishlist", "Mark Owned", "All My
-  Cards" in UI copy
-- Custom modal scrim (must use `<Modal>` primitive)
-- Popover for five tips (use Modal)
-- Parallel batch identify UI implying concurrent Gemini calls
-- Device `<select>` on mobile (facing-mode toggle stays)
-
-### Pre-delivery checklist
-
-- [ ] No emojis as icons (SVG: Lucide / Heroicons)
-- [ ] `cursor-pointer` on clickable elements
-- [ ] Hover/focus transitions 150–300ms
-- [ ] Text contrast ≥ 4.5:1 on glass-over-flat surfaces
-- [ ] Keyboard focus visible (`--ember-rim-pronounced` focus ring)
-- [ ] `prefers-reduced-motion` respected (badge pulse, bar animate)
-- [ ] Responsive: mobile immersive unchanged; workstation at 768 /
-  1024 / 1440
-- [ ] Light + dark verified against mock reference
-- [ ] Copy from `lib/collection-vocabulary.js` for add actions
-- [ ] Visual-diff: desktop `/scanner` if in suite
-
-### Conflict rule
-
-**Repo design tokens win** when they disagree with generator output.
-This lock intentionally overrides `ui-ux-pro-max` palette and typography
-only. Layout proportions follow the attached mock; nav items in the
-mock that are not product routes (Wishlist, Trades, etc.) are **not**
-in scope — existing Layout sidebar IA stands.
-
-## UX
-
-### 1. Existing components to reuse
-
-| Component | Path | Use on desktop workstation |
-| --- | --- | --- |
-| `<Modal>` | `components/ui/Modal.js` | Leave-with-queue, List picker, **Scanner Tips** (five tips — no custom scrim) |
-| `<Button>` | `components/ui/Button.js` | Upload Image, Batch Scan, Auto-detect toggle label area, inspector primary/ghost actions, batch Cancel, View All Scans |
-| `<GlassSurface>` | `components/ui/GlassSurface.js` | Camera frame, desk control bar, inspector rail, strip container, strip chips (solid `--bg-secondary` fill inside — no per-chip blur) |
-| `<Input>` | `components/ui/Input.js` | Not required v1; strip search deferred to Architect brief |
-| `ScannerCamera` | `components/scanner/ScannerCamera.js` | Framed viewport, ember brackets, overlay Auto-detect badge; hide mobile overlay chrome at `md+` via variant prop |
-| `ScannerDisambiguation` | `components/scanner/ScannerDisambiguation.js` | Unchanged multi-match picker; pauses identify via existing `verificationPausedRef` wiring |
-| `ScannerToast` | `components/scanner/ScannerToast.js` | Post-commit confirmation, batch complete summary, identify errors |
-| `ScannerCheckoutSheet` | `components/scanner/ScannerCheckoutSheet.js` | **Mobile only** (`max-md`) — do not mount at `md+` |
-| `ScannerCountPill` | `components/scanner/ScannerCountPill.js` | **Mobile only** — desktop uses strip Queue badge instead |
-| `ReviewCardItem` | `components/scanner/ReviewCardItem.js` | **Pattern donor** for condition `<select>`, foil toggle, confidence ring/color helpers, increment/decrement — lift constants (`CONDITION_OPTIONS`, `confidencePercent`, `confidenceRingColor`) into shared export or duplicate minimally in `ScannerResultPanel` |
-| Leave modal + List picker | `pages/scanner.js` | Reuse verbatim markup and handlers; extend leave trigger to desktop back/nav paths |
-
-**New surfaces** (`ScannerResultPanel`, `ScannerHistoryStrip`, `ScannerTips`) compose primitives only — no new modal shell, no hex in `.js`.
-
-### 2. Design direction alignment
-
-- **Liquid Glass tokens:** All panels use `--glass-surface-{low,mid,high}`, `--ember-rim-{subtle,pronounced}`, `--elevation-ambient` per Design direction layout authority table. Inspector rail = `GlassSurface` tint `low`; desk bar + strip = `mid`.
-- **Ember accent:** Primary add, active tab underline, focused chip border, Auto-detect ON dot use `--accent-ember` / `--accent-flame` — not generator slate/blue.
-- **Copy lock:** Inspector and strip actions import `VOCAB.ADD_TO_MY_COLLECTION` and `VOCAB.ADD_TO_LIST` from `lib/collection-vocabulary.js`. Wishlist omitted (IA-locked).
-- **Performance budget:** Strip chips and inspector thumbnail tiles use solid `--bg-secondary` — **no `backdrop-filter` on per-card elements** (Design direction + `docs/DESIGN_TOKENS.md`).
-- **Tips surface:** `<Modal size="md">` with glass panel recipe — matches Design direction "Popover for five tips" rejection.
-- **Motion:** 150–200ms color/rim transitions; badge pulse and confidence bar width animate only when `prefers-reduced-motion: no-preference` (see §7 interaction patterns).
-
-### 3. Existing patterns to follow
-
-- **Viewport split:** `pages/scanner.js` already gates mobile checkout with `md:hidden` / `hidden md:flex` — extend to `Layout chrome="default"` at `md+` only; keep `chrome="immersive"` below `md`.
-- **Pause identify:** `verificationPausedRef` in `pages/scanner.js` (lines 59–63) — extend desktop Auto-detect OFF to set ref; keep existing pauses for list picker + disambiguation + mobile checkout.
-- **Single-card commit:** `queue.addSingleCardToOwned(card)` in `lib/use-scanner-queue.js` — inspector primary action; same API path as mobile bulk commit.
-- **Leave with queue:** Existing `<Modal title="Leave scanner?">` + `clearScannerCartStorage()` — trigger from desktop back, sidebar nav away, and `router.back()` when `unprocessedCount > 0`.
-- **List commit:** Existing List picker `<Modal>` + `handleListPick` — inspector `VOCAB.ADD_TO_LIST` opens same modal scoped to **focused inspector card** (single selection), not bulk strip selection.
-- **Error alerts:** Match `ScannerCheckoutContent` / `pages/scanner.js` list picker — `role="alert"` div with `color-mix(in srgb, var(--color-error) …)` for commit and batch failures.
-- **Confidence UX:** Reuse `ReviewCardItem` thresholds: `<70%` ember warning, `≥90%` gold/high — caption text from Design direction (*Excellent match.* / *Good match.* / *Low confidence — verify before adding.*).
-- **Device picker fallbacks:** Inline `text-sm` `--text-secondary` messages below disabled `<select>` per Design direction table — not a blocking modal.
-- **Focus rings:** `Button` / `ChromeIconButton` pattern — `focus-visible:ring-2` + `'--tw-ring-color': 'var(--accent-ember)'` (`components/scanner/ScannerCamera.js`).
-
-### 4. A11y constraints
-
-Hand to `role-a11y-auditor`:
-
-- **1.4.3 Contrast (Minimum):** All `--text-primary` / `--text-secondary` on `--glass-surface-*` over `--bg-primary` must meet **4.5:1** for body text, **3:1** for large/bold card name (`text-lg font-semibold`). Confidence bar track vs fill must meet **3:1** non-text contrast.
-- **1.4.10 Reflow:** At 768px width with 200% zoom, workstation grid stacks camera above inspector; strip tabs remain horizontally scrollable without two-dimensional scroll traps.
-- **1.4.11 Focus Not Obscured (Minimum):** Sticky inspector rail and batch progress banner must not fully hide focused desk controls or strip chips.
-- **2.1.1 Keyboard:** Every action reachable without pointer: desk controls, strip tabs (tablist), chip rows, inspector add/rescan, batch Cancel, Tips open/close.
-- **2.4.3 Focus Order:** DOM order = visual order: page header (Tips) → camera frame → desk bar (Camera → Upload → Batch → Auto-detect) → inspector → strip tabs → chip scroller → View All.
-- **2.4.7 Focus Visible:** Ember focus ring on all interactive elements; native `<select>` gets `focus-visible:ring-2` wrapper if browser default ring is suppressed.
-- **2.4.11 Focus Not Obscured:** Modal open (Tips, leave, list picker) uses existing `useFocusTrap` — no focus escape to camera video underneath.
-- **4.1.2 Name, Role, Value:**
-  - Auto-detect toggle: `role="switch"`, `aria-checked={!verificationPausedRef}`, visible label **Auto-detect** associated via `htmlFor` / `aria-labelledby`.
-  - Strip tabs: `role="tablist"` / `role="tab"` / `role="tabpanel"` with `aria-selected`, `aria-controls`, badge counts in `aria-label` (e.g. `Scan Queue, 3 unprocessed cards`).
-  - Camera `<select>`: `<label>` **Camera** + `aria-describedby` pointing to empty/denied fallback text when present.
-  - Inspector condition `<select>`: accessible name includes card name (`Condition for {card.name}`).
-  - Foil toggle: `role="switch"`, `aria-checked`, label **Foil**.
-- **4.1.3 Status Messages:** Auto-detect ON/OFF badge exposes `aria-live="polite"` region; batch progress (`Scanning 3 of 12…`) uses `aria-live="polite"`; commit success via `ScannerToast` with `role="status"`.
-- **3.3.1 Error Identification:** Batch per-file failures show **Identify failed** + reason text on the queue row; commit errors in inspector use `role="alert"` (same pattern as checkout footer).
-- **2.5.3 Label in Name:** Visible button text must appear in accessible name — e.g. **Upload Image**, not icon-only without `aria-label`.
-- **Live region discipline:** Only one polite live region for batch progress; avoid duplicate announcements on tab auto-focus during batch.
-
-### 5. Interaction patterns
-
-#### Locked decisions (opinionated — one pattern each)
-
-| Topic | Decision | Nielsen / rationale |
-| --- | --- | --- |
-| **Empty inspector** | Centered muted camera/scan illustration + single line: *"Point your camera at a card or upload an image to see a match."* No duplicate Upload/Batch CTAs in the rail (controls live in desk bar). | **H8** aesthetic minimalism; **H6** recognition — one place for actions. |
-| **Leave with uncommitted queue** | Keep existing `<Modal title="Leave scanner?">` — **Keep scanning** (secondary) / **Leave** (danger). Same copy and `clearScannerCartStorage()` behavior on desktop nav-away. | **H3** user control; **H5** error prevention. |
-| **Inspector add success** | **Advance inspector to next unprocessed queue entry** (or empty state if queue clear). Show `ScannerToast` (*Added to My Collection*). Committed card appears in **Recent Scans** with processed styling. Do **not** linger on committed card in inspector. | **H2** real-world scan rhythm; **H1** toast + strip update confirm status without blocking next decision. |
-| **Auto-detect OFF** | Real pause via `verificationPausedRef` — no identify/OCR while OFF. Badge reads **Auto-detect OFF**; dot static gray. Toggle is independent of mobile checkout pause logic. | **H3** user control; **H1** badge reflects system state. |
-| **Rescan** | Clears focus card's identify metadata and re-queues same physical capture path (webcam frame or re-read gallery source if batch row) — card stays in queue unprocessed. | **H3** undo/recover from bad match. |
-| **Duplicate row click** | Focuses that card in inspector (scroll chip into view, `--ember-rim-pronounced` on active chip). **Add still allowed** — increment qty via inspector primary or existing queue increment if duplicate already unprocessed. No separate "Skip" action in v1. | **H6** recognition over recall; **H4** consistency with Queue tab. |
-| **Batch cancel** | Ghost **Cancel** in Scan Queue tab progress banner. Cancels remaining files; **keeps** already-identified rows (IA-locked). Banner dismisses; toast *Batch scan stopped* (info). | **H3** user control; **H9** recover from long batch. |
-| **Batch per-file failure** | Row stays in Scan Queue with ember left border + **Identify failed** label; batch **continues**. Row click focuses inspector for manual Rescan or remove. | **H9** graceful recovery; **H1** visible error on row. |
-| **Strip row click (all tabs)** | Sets inspector focus to that card; does not auto-commit. Recent / Queue / Duplicates share one focus model. | **H4** consistency. |
-| **Clear All** | Destructive text link — confirm via existing pattern or inline `window.confirm` only if Architect brief adds it; default: immediate clear with undo **not** required v1 (queue is session-scoped). Architect to confirm in brief. | **H5** prevent accidental loss — if no confirm, disable when batch running. |
-
-#### Required
-
-- **Loading — identify in flight (H1):** Inspector shows skeleton/thumbnail placeholder + *Identifying…* on desk bar Upload/Batch busy states disable repeat picks.
-- **Loading — commit (H1):** Inspector primary `<Button loading>` during `addSingleCardToOwned`; disable Rescan and secondary actions while processing.
-- **Empty strip tabs (H9):** Recent: *No scans yet this session.* Queue: *Scan queue is empty — matches appear here before you add them.* Duplicates: *No duplicates detected.*
-- **Auto-detect ON feedback (H1):** Green pulsing dot in frame badge (respect reduced motion); optional success chime already in `ScannerCamera` — desktop may keep muted default.
-- **Batch running (H1):** Auto-select **Scan Queue** tab; determinate progress bar; Cancel visible throughout.
-- **Focus management (H3):** Opening Tips/list/leave modals traps focus; closing returns focus to trigger button.
-- **Hover/focus (H4):** Chips and tabs: `--ember-rim-subtle` → `--ember-rim-pronounced` on hover/focus; `cursor-pointer` on all click targets.
-
-#### Nice-to-have
-
-- **Optimistic UI:** Inspector advance on commit can happen after API success only (no optimistic skip) — queue hook already marks `processed` post-success.
-- **Keyboard shortcut:** `A` to trigger inspector **Add to My Collection** when inspector populated and not processing — defer unless Architect brief adds; not v1 blocker.
-- **View All Scans:** Expanded modal or full-width strip — Architect decides; v1 may scroll chip row only.
-
-### 6. Anti-patterns to avoid
-
-- **Duplicate CTAs in empty inspector** — Upload/Batch already in desk bar (**H8** minimalist design).
-- **Custom modal scrim for Tips or device errors** — must use `<Modal>` or inline text only (**H4** consistency).
-- **Device `<select>` on mobile** — facing-mode swap stays (**H4**).
-- **Popover for five Scanner Tips** — too long; Modal only (**H8**).
-- **Linger on committed card in inspector after add** — blocks scan rhythm (**H2**).
-- **Stop entire batch on one file failure** — IA forbids (**H9**).
-- **Discard identified rows on batch cancel** — IA forbids (**H3**).
-- **"Save to Wishlist" / "Mark Owned" / "Add to Collection"** copy — CI forbidden strings (**H4**).
-- **`backdrop-filter` on strip chips or inspector thumbnail** — GPU budget violation.
-- **Full-bleed camera overlay on desktop** — mobile-only chrome (**H2**).
-- **Parallel batch progress implying concurrent API calls** — misleading (**H1** honest status).
-- **Icon-only desk controls without `aria-label`** — fails **2.5.3** / **4.1.2**.
-- **Auto-commit on strip row click** — user loses inspect step (**H3** user control).
-- **Slide animation on tab switch** — Design direction specifies instant swap; fade optional ≤150ms only.
-
-### 7. Mobile / responsive notes
-
-**Below `md` (767px) — zero regression:**
-
-- Keep `Layout chrome="immersive"`, `ScannerCamera` overlay chrome (back, gallery, flash, facing, Review N pill), `ScannerCheckoutSheet`, `ScannerCountPill`, scan peek, disambiguation sheet behavior unchanged.
-- Do not render desktop workstation grid, inspector rail, history strip, device `<select>`, Batch Scan desk control, or Tips header button on mobile unless Tips is also added to mobile overlay (out of scope — **Tips = desktop header only v1**).
-- `verificationPausedRef` mobile checkout pause unchanged (`isCheckoutOpen && max-width 767px`).
-
-**At `md+` (768px+):**
-
-- `Layout chrome="default"` — sidebar + `TopSearchBar` visible.
-- Workstation grid: camera column `flex-1 min-w-0` (~60–65%) + inspector `w-[360px] max-w-sm` + full-width bottom strip.
-- Hide mobile-only elements: checkout sheet, Review N pill, overlay top/bottom camera bars, facing-mode toggle (replace with Camera `<select>`).
-- Desk control bar wraps at `md`; Auto-detect toggle right-aligned at `lg+`.
-- Strip chip scroller: `overflow-x-auto`, `-webkit-overflow-scrolling: touch` for trackpad/touch on hybrid devices; min chip height **44px** touch target.
-- **`prefers-reduced-motion`:** Disable Auto-detect badge pulse, confidence bar width transition, optional chip-row fade — use `@media (prefers-reduced-motion: reduce)` instant state swaps; keep color/rim hover transitions ≤150ms or disable per `docs/MOTION_SYSTEM.md` if defined.
-- **Breakpoints to verify:** 768 / 1024 / 1440 — inspector sticky top optional; strip never collapses tabs into mystery meat menu v1.
-- **Visual-diff:** Desktop `/scanner` only; mobile baseline must not change.
-
-## Architecture
-
-### File plan
-
-| File | Action | Purpose |
-| --- | --- | --- |
-| `lib/use-camera-scanner.js` | modified | `enumerateDevices`, `deviceId` selection, picker status, sessionStorage persist |
-| `test/lib/use-camera-scanner.test.js` | new | Mock `mediaDevices` — device list, constraint switch, persist |
-| `components/scanner/ScannerTips.js` | new | Header trigger + five-tip `<Modal>` |
-| `test/components/ScannerTips.test.js` | new | Open/close, copy lock |
-| `components/scanner/ScannerResultPanel.js` | new | Right-rail live match inspector |
-| `test/components/ScannerResultPanel.test.js` | new | Empty/populated, add loading, vocab |
-| `components/scanner/ScannerHistoryStrip.js` | new | Recent / Queue / Duplicates strip + `getDuplicateCards` |
-| `test/components/ScannerHistoryStrip.test.js` | new | Tabs, duplicates helper, batch banner |
-| `lib/scanner-batch-identify.js` | new | Sequential `runSequentialGalleryIdentify` |
-| `test/lib/scanner-batch-identify.test.js` | new | Progress, cancel, error continuation |
-| `pages/scanner.js` | modified | md+ workstation grid, focus state, pause composite, chrome split |
-| `components/scanner/ScannerCamera.js` | modified | `workstation` variant — framed viewport, hide mobile overlay at md+ |
-| `lib/use-scanner-identification.js` | modified | Remove redundant `verificationPausedRef` overwrite effect |
-| `lib/use-scanner-queue.js` | modified | Boolean return from `addSingleCardToOwned` / `addSingleCardToCollection` |
-| `test/pages/scanner.test.js` | new | Mobile checkout regression + desktop composition smoke |
-| `test/components/ScannerCamera.test.js` | new | Workstation variant hides overlay chrome |
-
-**Not touched:** `components/Layout.js` (immersive already equals default at md+),
-`lib/scanner-card-identify.js`, `pages/api/scan/identify.js`, `ScannerCheckoutSheet.js`
-(mobile only), nav IA (`dashboard-home-realignment`).
-
-### API surface
-
-No new or modified API routes. Client cart remains `sessionStorage` via
-`lib/scanner-session.js`. All commits reuse existing `scanner-route-api.js` helpers
-(`addScannedCardToOwned`, `addScannedCardToCollection`).
-
-### Schema diff
-
-None.
-
-### Test plan
-
-| Area | File | What to lock |
-| --- | --- | --- |
-| Device picker hook | `test/lib/use-camera-scanner.test.js` | `deviceId` constraints, enumerate, persist, status messages |
-| Batch helper | `test/lib/scanner-batch-identify.test.js` | Sequential order, cancel mid-batch, error continues |
-| Tips modal | `test/components/ScannerTips.test.js` | Five tips, Modal primitive |
-| Inspector | `test/components/ScannerResultPanel.test.js` | Empty state (no duplicate CTAs), `VOCAB` labels |
-| History strip | `test/components/ScannerHistoryStrip.test.js` | `getDuplicateCards`, tab badges, batch banner |
-| Camera variant | `test/components/ScannerCamera.test.js` | Overlay hidden for `workstation` at md+ |
-| Page orchestration | `test/pages/scanner.test.js` | Checkout sheet at max-md; workstation surfaces at md+ |
-| Mobile regression | `test/components/ScannerCheckoutSheet.test.js` | Existing suite stays green — do not weaken |
-| Layout chrome | `test/components/Layout.test.js` | Existing immersive tests — no change expected |
-
-**Visual-diff:** `tests/visual/` contains only `homepage.spec.ts` / `home.png` —
-no `/scanner` baseline update required for this convoy.
-
-### Risk list
-
-| Risk | Mitigation |
-| --- | --- |
-| `verificationPausedRef` race between page and `useScannerIdentification` | Brief 6 deletes identification hook's direct ref assignment; page owns composite pause including `isAutoDetectPaused` |
-| `addSingleCardToOwned` lacks success signal today | Brief 6 adds boolean return in `use-scanner-queue.js` |
-| `chrome="immersive"` on all viewports today | Boot finding: Layout already shows sidebar at md+; page uses explicit `default` vs `immersive` via `matchMedia` for clarity |
-| Batch identify failures invisible in queue | Page enqueues `identifyFailed` rows; strip shows ember border + label |
-| Rescan without stored capture | v1: re-identify via `scanImageUrl` fetch; else toast to rescan from camera |
-| Desktop/mobile class split regressions | Tests mock `matchMedia`; mobile paths keep `md:hidden` gates |
-| Forbidden copy in new surfaces | Import `VOCAB` from `collection-vocabulary.js`; CI `forbidden-stale-strings` |
-| Brief 6 LOC >400 | Accepted — single serializer for `pages/scanner.js`; components split across Briefs 2–4 |
-| `getDuplicateCards` over-counts | Helper uses ownershipMap + session name/set + quantity>1; tune in strip tests |
-
-### Decomposition
-
-| Brief # | Title | Files | Depends on | Est. PR size |
-| --- | --- | --- | --- | --- |
-| 1 | Camera device picker hook | `use-camera-scanner.js`, test | — | S (~180 LOC) |
-| 2 | Scanner Tips modal | `ScannerTips.js`, test | — | S (~100 LOC) |
-| 3 | Live match inspector | `ScannerResultPanel.js`, test | — | M (~280 LOC) |
-| 4 | History / queue strip | `ScannerHistoryStrip.js`, test | — | M (~300 LOC) |
-| 5 | Sequential batch helper | `scanner-batch-identify.js`, test | — | S (~120 LOC) |
-| 6 | Page workstation wiring | `scanner.js`, `ScannerCamera.js`, identification + queue hooks, tests | 1, 2, 3, 4, 5 | L (~450 LOC) |
-
-**Estimated PRs:** 6 (Briefs 1–5 parallelizable; Brief 6 after merge or rebase).
-
-### Slice dependencies (multitask-ready)
-
-```yaml
-slice_dependencies:
-  - brief: 1
-    depends_on: []
-    files:
-      - lib/use-camera-scanner.js
-      - test/lib/use-camera-scanner.test.js
-  - brief: 2
-    depends_on: []
-    files:
-      - components/scanner/ScannerTips.js
-      - test/components/ScannerTips.test.js
-  - brief: 3
-    depends_on: []
-    files:
-      - components/scanner/ScannerResultPanel.js
-      - test/components/ScannerResultPanel.test.js
-  - brief: 4
-    depends_on: []
-    files:
-      - components/scanner/ScannerHistoryStrip.js
-      - test/components/ScannerHistoryStrip.test.js
-  - brief: 5
-    depends_on: []
-    files:
-      - lib/scanner-batch-identify.js
-      - test/lib/scanner-batch-identify.test.js
-  - brief: 6
-    depends_on: [1, 2, 3, 4, 5]
-    files:
-      - pages/scanner.js
-      - components/scanner/ScannerCamera.js
-      - lib/use-scanner-identification.js
-      - lib/use-scanner-queue.js
-      - test/pages/scanner.test.js
-      - test/components/ScannerCamera.test.js
-```
-
-### Boot-the-brief findings (fixed in briefs)
-
-1. **Layout chrome:** `chrome="immersive"` already renders sidebar + TopSearchBar at
-   `md+` (`Layout.js` uses `max-md:hidden` only). Brief 6 uses `matchMedia` to pass
-   `chrome="default"` on desktop for semantic clarity — no `Layout.js` edit.
-2. **`verificationPausedRef` overwrite:** `useScannerIdentification` lines 62–66 set
-   the ref to `Boolean(disambiguation)` only, racing page composite pause — Brief 6
-   removes that effect.
-3. **`addSingleCardToOwned` return:** No success boolean today — Brief 6 extends
-   `use-scanner-queue.js` to return `true`/`false`.
-4. **Visual suite:** `/scanner` not in `tests/visual/` — no Linux baseline refresh.
-5. **No new packages** — dep-set check N/A; all primitives exist (`Modal`, `GlassSurface`, `Button`).
-6. **Gallery batch path verified:** `identifyFromGalleryFile` exists in
-   `use-scanner-identification.js` (line 326) — Brief 5 wraps it sequentially.
-
-## As-shipped
-
-Shipped 2026-08-15 as PR #165 (squash `938c161`, commit subject
-`feat(scanner): add desktop workstation layout (#165)`). All six briefs'
-surfaces landed: md+ workstation chrome, device picker, Upload Image,
-Batch Scan, Auto-detect toggle, live match inspector, and the bottom
-Recent Scans / Scan Queue / Duplicates strip; mobile immersive checkout
-unchanged below `md`.
-
-Related post-merge scanner fixes on adjacent convoys (not this scope):
-#166 (multi-card flow + frame overlay + rate limits) and #167 (manual
-tap-to-scan shutter).

.convoys/scanner-desktop-layout/audits/a11y-20260815.md

@@ -1,147 +0,0 @@
-# A11y audit — scanner-desktop-layout
-
-**Reviewer:** role-a11y-auditor  
-**Convoy:** `scanner-desktop-layout`  
-**Surface:** local UI diff vs `origin/main` (+ untracked workstation components) — audit group `audit-scanner-desktop-layout-local`  
-**Date:** 2026-08-15  
-**Model:** cursor-grok-4.5-high (`model_tier=fast`)  
-**Skill note:** `.cursor/skills/accessibility-audit/SKILL.md` was not present in-repo; audit follows `role-a11y-auditor.md`, prior report shape (`.convoys/scanner-mobile-checkout/audits/a11y-20260814.md`), convoy UX §4 A11y constraints, and WCAG 2.2 AA.
-
-## Diff scope (UI)
-
-| Path | Status |
-| --- | --- |
-| `pages/scanner.js` | modified (workstation wiring) |
-| `components/scanner/ScannerCamera.js` | modified (`variant="workstation"`, Auto-detect badge) |
-| `components/scanner/ScannerResultPanel.js` | **new** |
-| `components/scanner/ScannerHistoryStrip.js` | **new** |
-| `components/scanner/ScannerTips.js` | **new** |
-| `test/components/ScannerHistoryStrip.test.js` | new (a11y-adjacent: tab `aria-label`s) |
-| `test/components/ScannerResultPanel.test.js` | new (condition name / foil switch) |
-| `test/components/ScannerTips.test.js` | new |
-| `test/components/ScannerCamera.test.js` | new |
-
-Non-UI (`lib/use-camera-scanner.js`, batch helper, queue hooks) excluded from findings except where they gate AT-visible status.
-
-Patterns referenced: `components/ui/Modal.js` (`useFocusTrap`, `role="dialog"`), `components/ui/Button.js` (ember `focus-visible` ring, visible label in name).
-
-## Executive summary
-
-- Desktop workstation ships strong foundations: Tips via `<Modal>` + trap, Auto-detect / Foil `role="switch"`, strip `tablist`/`tab`/`tabpanel` with badge counts in `aria-label`, condition `aria-label` includes card name, commit errors `role="alert"`, ember `focus-visible` rings, toast `role="status"`, mobile checkout `inert`/`trapActive` carry-forward.
-- **No severity ≥ 3 findings.** Several **sev-2** gaps vs promised UX §4 constraints: Camera fallback lacks `aria-describedby`; Auto-detect overlay badge has no `aria-live`; batch progress + Cancel live only inside the Queue `tabpanel` (often `hidden`); empty-inspector “Identifying…” is wired to disambiguation, not identify-in-flight; queue badge white-on-ember is ~4.44:1; `--color-*` semantic tokens appear undefined in `styles/`.
-- **Recommendation:** comment-only for merge gate (no sev ≥ 3); fix the §4 constraint fails (A1–A4) in this PR or an immediate a11y follow-up.
-
-**Counts:** 8 findings (sev ≥ 3: **0**, sev &lt; 3: **8**). Constraint checklist: **8 pass / 3 partial / 3 fail**.
-
-## Convoy constraint checklist (UX §4)
-
-| # | Constraint | Result | Notes |
-| --- | --- | --- | --- |
-| 1 | **1.4.3** Contrast text on glass | **Partial** | Body `--text-primary/secondary` on solid `--bg-*` ≥ 4.5:1 (sampled). Queue badge `#ffffff` on `--accent-ember` ≈ **4.44:1** (fails normal text). Glass composite not instrumented. |
-| 2 | **1.4.10** Reflow @ 768 / 200% | **Pass*** | `md:flex-row` → column below `md`; strip `overflow-x-auto` only (*static; no browser zoom run). |
-| 3 | **1.4.11** Focus not obscured (sticky) | **Pass** | Inspector rail is flex column sibling — not `position: sticky/fixed`. Batch banner sits in strip flow. |
-| 4 | **2.1.1** Keyboard all actions | **Partial** | Desk controls, tips, inspector, tabs, chips, Clear All, View All are `<button>`/`<select>`. Batch **Cancel** only mounts on Queue tab — reachable after tab switch, not after Batch Scan without navigating. |
-| 5 | **2.4.3** Focus order | **Pass** | DOM ≈ convoy: Tips → camera → desk (Camera → Upload → Batch → Auto-detect) → inspector → strip tabs → chips → View All. |
-| 6 | **2.4.7** Focus visible | **Pass** | Ember `focus-visible:ring-2` on Button, switches, selects, tabs, chips, Clear All. |
-| 7 | **2.4.11** Focus not obscured (modals) | **Pass** | Tips / leave / list picker use `Modal` + `useFocusTrap`; Escape closes. |
-| 8 | **4.1.2** Auto-detect switch | **Pass** | `role="switch"` `aria-checked={!isAutoDetectPaused}` `aria-labelledby` → visible **Auto-detect**. |
-| 9 | **4.1.2** Strip tabs | **Pass** | `tablist` / `tab` / `tabpanel`, `aria-selected`, `aria-controls`, badge counts in `aria-label` (locked by tests). |
-| 10 | **4.1.2** Camera `<select>` + `aria-describedby` | **Fail** | Visible `<label>Camera</label>` OK; fallback `<p>` has **no `id` / no `aria-describedby`**. |
-| 11 | **4.1.2** Condition + Foil | **Pass** | Condition `aria-label={`Condition for ${card.name}`}`; Foil switch + `aria-labelledby`. |
-| 12 | **4.1.3** Auto-detect badge live region | **Fail** | Overlay badge is visual only (decorative dot `aria-hidden`); **no `aria-live`**. Switch announces only when focused/toggled. |
-| 13 | **4.1.3** Batch progress live + toast | **Partial** | Banner has `aria-live="polite"` + `progressbar`; toast `role="status"`. Banner lives only inside Queue panel — silent when another tab is selected. |
-| 14 | **3.3.1** Identify failed + commit alert | **Pass** | Chip shows **Identify failed** + reason; inspector `role="alert"` for commit errors. |
-| 15 | **2.5.3** Label in Name | **Pass** | Upload Image / Batch Scan / Scanner Tips / vocab CTAs use visible text (not icon-only). |
-| 16 | Live region discipline | **Partial** | One batch banner (good); camera toast + page toast both `aria-live="polite"`; DetectionFrame also polite (pre-existing). |
-
-## Findings
-
-| Sev | Layer | WCAG | Surface | Issue | Fix |
-| --- | --- | --- | --- | --- | --- |
-| **2** | Robust / Name | 1.3.1, 4.1.2 | `pages/scanner.js` ~L415–418 | Device fallback message is not linked to the Camera `<select>` (`aria-describedby` promised). Disabled empty/denied states are orphaned for AT. | Give message `id="scanner-camera-select-hint"`; set `aria-describedby={camera.devicePickerMessage ? 'scanner-camera-select-hint' : undefined}` on `<select>`. |
-| **2** | Status | 4.1.3 | `ScannerCamera.js` ~L350–370 | Workstation Auto-detect ON/OFF badge has no live region (constraint 12). | Wrap badge text in `role="status" aria-live="polite"` (or `aria-live` on the GlassSurface), e.g. announce `Auto-detect ON` / `OFF` when `autoDetectOn` changes. Keep decorative dot `aria-hidden`. |
-| **2** | Status / Operable | 4.1.3, 2.1.1 | `ScannerHistoryStrip.js` ~L277–285; `pages/scanner.js` `handleBatchChange` | `BatchProgressBanner` (live region + Cancel) renders only inside Queue `tabpanel`. Default/other tabs leave banner `hidden` → progress often unannounced; Cancel not in immediate focus path after Batch Scan. | On batch start: `setStripActiveTab(TAB_QUEUE)`; and/or mount a single always-visible polite region + Cancel above the tablist (one live region). |
-| **2** | Status | 4.1.3 | `pages/scanner.js` ~L520; `ScannerResultPanel.js` ~L83–86 | `isIdentifying={Boolean(identification.disambiguation)}` never reflects gallery/webcam identify-in-flight → empty rail stays “Point your camera…” instead of “Identifying…”. | Pass a real identifying flag from identification hook (or `galleryBusy \|\| batchBusy` / in-flight promise); keep disambiguation separate. Prefer `aria-live="polite"` on the Identifying copy. |
-| **2** | Perceivable | 1.4.3 | `ScannerHistoryStrip.js` ~L246–254 | Badge uses hardcoded `#ffffff` on `--accent-ember` (~**4.44:1**) under 4.5:1 for `text-xs`. | Use a tokenized on-accent color that clears 4.5:1, or enlarge/bold to large-text threshold, or place count in `aria-label` only with a higher-contrast chip chrome. |
-| **2** | Perceivable | 1.4.11, 1.4.1 | `ScannerResultPanel.js` `confidenceRingColor`; error alerts | `--color-success` / `--color-warning` / `--color-error` / `--color-info` are **referenced but not defined** under `styles/` (or Tailwind theme). Mid/high confidence fills and error tints may not paint; low band still uses `--accent-ember`. Text % + captions / `role="alert"` mitigate. | Define semantic tokens in the design-token surface (or map to existing `--accent-*` / documented status colors) so bar fill meets **3:1** vs track and error text remains distinguishable. |
-| **1** | Keyboard | 2.1.1 (APG) | `ScannerHistoryStrip.js` tablist | Tabs are all in Tab order; no arrow-key roving `tabIndex` (ARIA APG tabs pattern). | Optional: selected tab `tabIndex={0}`, others `-1`; Left/Right moves selection. Not required for WCAG if all tabs remain operable. |
-| **1** | Status | 4.1.3 | `pages/scanner.js` + `ScannerCamera.js` | Page-level `ScannerToast` and in-camera toast are both polite live regions; DetectionFrame adds more. Risk of duplicate/noisy announcements. | Prefer one page-level toast on desktop workstation; suppress camera toast when `variant="workstation"`, or share a single live region host. |
-
-### Severity ≥ 3 detail
-
-None.
-
-## Layer walk (5 layers, summary)
-
-| Layer | Verdict |
-| --- | --- |
-| **1 Perceivable** | Token body text contrast OK on solids; badge white/ember short; confidence mid/high fill tokens missing; confidence still has % + caption (not color-only); reflow structure OK statically. |
-| **2 Operable** | Focus rings consistent with Button/Modal; modals trapped; batch Cancel discoverability weak; tab APG optional. |
-| **3 Understandable** | Labels strong (Camera, Auto-detect, Foil, condition-with-name, vocab CTAs); leave modal copy includes count + “Keep scanning”; device fallback not programmatically associated. |
-| **4 Robust** | Switch/tablist/tabpanel/progressbar/alert/status mostly correct; missing `aria-describedby` + badge live region; Identifying flag mis-wired. |
-| **5 Consistency** | Correctly lifts Modal/Button/GlassSurface; matches ReviewCardItem condition/foil naming; mobile `inert` + `trapActive={!isListPickerOpen}` retained from prior a11y fix. |
-
-## Suggested diffs (priority)
-
-1. **P1** — Camera `aria-describedby` ↔ fallback message id.  
-2. **P1** — Auto-detect badge `aria-live="polite"` (or `role="status"`).  
-3. **P1** — On batch start, select Queue tab **or** hoist progress+Cancel outside `hidden` tabpanels (single polite region).  
-4. **P1** — Wire real `isIdentifying` for empty inspector + polite announcement.  
-5. **P2** — Badge contrast; define `--color-success|warning|error|info`.  
-6. **P3** — Optional tab roving tabindex; dedupe desktop toasts.
-
-### Minimal patches (illustrative)
-
-```jsx
-// pages/scanner.js — Camera describedby
-<p id="scanner-camera-select-hint" className="text-xs" style={{ color: 'var(--text-secondary)' }}>
-  {camera.devicePickerMessage}
-</p>
-<select
-  id="scanner-camera-select"
-  aria-describedby={camera.devicePickerMessage ? 'scanner-camera-select-hint' : undefined}
-  …
-/>
-```
-
-```jsx
-// ScannerCamera.js — badge live region
-<GlassSurface … role="status" aria-live="polite">
-  <span className="…" aria-hidden="true" />
-  Auto-detect {autoDetectOn ? 'ON' : 'OFF'}
-</GlassSurface>
-```
-
-```js
-// pages/scanner.js — batch start
-setStripActiveTab(TAB_QUEUE);
-setBatchProgress({ active: true, current: 0, total: files.length, onCancel: … });
-```
-
-## Patterns to lift
-
-- `Button` — visible children + ember `focus-visible` ring; keep for desk/inspector CTAs.  
-- `Modal` + `useFocusTrap` — correct Tips / leave / list picker shell; do not invent a second dialog.  
-- Strip tab `aria-label` helpers (`queueTabAriaLabel` / `duplicatesTabAriaLabel`) — good; keep badge `aria-hidden` on visual count.  
-- Foil / Auto-detect switch markup — reusable 44×44 hit pad + `aria-labelledby`.  
-- Prior mobile fix: `inert` + `trapActive={!isListPickerOpen}` — retain.
-
-## Automated checks
-
-| Check | Result |
-| --- | --- |
-| axe-core / CI a11y job | Not run (static role audit) |
-| Contrast math | Sampled token pairs + white/ember badge (see § checklist) |
-| Manual SR | Recommend VoiceOver: toggle Auto-detect; start Batch Scan from Recent tab; deny camera permission and inspect select description; commit error alert |
-
-## Approval recommendation
-
-- [ ] approve  
-- [ ] request-changes (sev ≥ 3)  
-- [x] **comment-only** — no sev ≥ 3; **fix A1–A4 (sev 2 constraint fails) before or immediately after merge**
-
-## Hand-off
-
-A11y audit complete. **8 findings** (sev ≥ 3: **0**, sev &lt; 3: **8**).  
-Report: `.convoys/scanner-desktop-layout/audits/a11y-20260815.md`.  
-Recommend fixing sev ≥ 3 before merge — none open; still land P1 constraint fixes (describedby, badge live region, batch progress visibility, Identifying wiring).

.convoys/scanner-desktop-layout/audits/design-system-20260815.md

@@ -1,153 +0,0 @@
-# Design-System Audit — scanner-desktop-layout
-
-**Role:** `role-design-system-auditor`  
-**Surface:** `convoy/scanner-desktop-layout` workstation UI (`git diff origin/main` + untracked scanner components)  
-**Convoy:** `.convoys/scanner-desktop-layout.md`  
-**Multitask group:** `audit-scanner-desktop-layout-local`  
-**Date:** 2026-08-15  
-**Scope:** UI / DS only — read-only; no code changes  
-
-**Inputs reviewed**
-
-| Source | Notes |
-| --- | --- |
-| Diff UI (vs `origin/main`) | `pages/scanner.js`, `components/scanner/ScannerCamera.js` (+ unrelated dashboard/Layout noise in same branch tip — **out of audit scope**) |
-| Untracked (convoy) | `ScannerTips.js`, `ScannerResultPanel.js`, `ScannerHistoryStrip.js` + component tests |
-| Direction lock | `design_direction` v1 + `## Design direction` + `## UX` |
-| Tokens | `docs/DESIGN_TOKENS.md`, `styles/globals.css` |
-| Primitives | `components/ui/{GlassSurface,Button,Modal,Input}.js` |
-| Skill | `.cursor/skills/design-systems/SKILL.md` **not installed**; report follows prior Liquid Glass audit shape + role file |
-
----
-
-## Audit summary
-
-| Check | Status | Notes |
-| --- | --- | --- |
-| Direction lock (md+ workstation grid) | ✅ Strong | Framed camera + desk bar + inspector rail + history strip + Tips Modal; mobile immersive left alone |
-| Hex in JSX (new convoy files) | ❌ | `#ffffff` on Queue/Duplicates badge in `ScannerHistoryStrip.js` |
-| VOCAB / stale strings | ✅ | `VOCAB.ADD_TO_*` / `MY_COLLECTION`; no Wishlist / Mark Owned / All My Cards |
-| `backdrop-filter` on strip chips | ✅ | Chips solid `--bg-secondary`; container is `GlassSurface tint="mid"` |
-| GlassSurface / Button / Modal reuse | ✅ High | Tips=`Modal`; inspector/strip/desk/camera frame=`GlassSurface`; primary CTAs=`Button` |
-| Custom modal scrim | ✅ | Tips + leave + list picker use `<Modal>` only |
-| Sev ≥ 3 findings | **1** | Hex literal on tab badges |
-
----
-
-## Maturity scoring (repo DS + this surface)
-
-Scores 0–4. Evidence cites paths/counts.
-
-| Axis | Score | Evidence |
-| --- | --- | --- |
-| **Tokens (T)** | **3** | Workstation surfaces consume `--glass-surface-*` via `GlassSurface`, `--text-*`, `--accent-ember` / `--accent-flame`, `--ember-rim-*`, `--border`. Residual: on-accent text still `#ffffff` in new strip badges (and pre-existing `Button.js` primary/danger). No `--text-on-accent` alias in `globals.css`. |
-| **Components (C)** | **3** | Kit: GlassSurface, Modal, Button, Input, SearchBar, StatCard. New surfaces compose GlassSurface + Button + Modal. Gaps: no Switch / TabList primitive — Auto-detect + Foil switches and strip tabs are raw `<button>` (acceptable; pattern repeated ×3). |
-| **Patterns (P)** | **3** | Locked workstation pattern largely shipped: `Layout chrome="default"` at md+, camera `variant="workstation"` with ember brackets + reduced-motion scan-line (`ScannerCamera.js` `DetectionFrame`), desk `GlassSurface mid`, inspector `tint="low"`, strip three tabs + batch banner, Tips `<Modal size="md">`. Minor drift: confidence fill uses `--color-warning` / `--color-success` vs direction’s flame/gold highlight row (aligned with UX “reuse ReviewCardItem” instead). |
-| **Governance (G)** | **3** | Convoy `design_direction` locked 2026-08-15; `ui-and-theming.mdc` + vocab CI; `forbidden-hex-in-jsx` documented in `DESIGN_TOKENS.md`. Design-systems skill package still absent in-repo. |
-| **Adoption (A)** | **3** | Desktop surface counts: `<Button>` ×12 across `scanner.js` + ResultPanel + HistoryStrip + Tips; `<GlassSurface>` on camera frame, desk bar, inspector, strip container, Auto-detect badge; `<Modal>` ×1 Tips + leave/list on page. Chips correctly **avoid** GlassSurface blur. Raw `<button>` ×7 mostly switches/tabs/Clear All (direction allows Clear All as text link). |
-
-**Composite:** T3 / C3 / P3 / G3 / A3
-
-**Top leverage:** **Tokens (T)** — introduce a shared on-accent text token (or route badge text through `<Button>` / a tiny Badge primitive) and purge `#ffffff` from convoy JSX so the hex gate and Liquid Glass lock stay green.
-
----
-
-## Direction lock
-
-Locked fields enforced: Liquid Glass; md+ workstation (camera + inspector + strip); ember accents; VOCAB CTAs; no hex; no per-chip `backdrop-filter`; Tips via `<Modal>`; no custom scrim; mobile immersive unchanged.
-
-| Locked requirement | Diff status |
-| --- | --- |
-| md+ `chrome="default"`; mobile immersive | ✅ `pages/scanner.js` |
-| Page title / subtitle + Scanner Tips | ✅ Header + `ScannerTips` |
-| Camera framed panel + ember brackets | ✅ `variant="workstation"` + `DetectionFrame` L-brackets + scan-line + `prefers-reduced-motion` |
-| Desk bar: Camera / Upload / Batch / Auto-detect | ✅ `GlassSurface tint="mid"` + native `<select>` + `Button`×2 + switch |
-| Device picker fallbacks inline (not modal) | ✅ `camera.devicePickerMessage` under select |
-| Inspector rail `w-[360px]` + GlassSurface low | ✅ `ScannerResultPanel` |
-| Empty / confidence / VOCAB primary + Rescan / Add to List | ✅ |
-| Strip: Recent / Queue / Dupes + Clear All + View All | ✅ `ScannerHistoryStrip` |
-| Chips solid `--bg-secondary`; focused ember rim | ✅; no chip `backdrop-filter` |
-| Batch progress + Cancel | ✅ `BatchProgressBanner` |
-| Tips = `<Modal>` five tips (not popover) | ✅ `ScannerTips.js` |
-| No hex / no Wishlist / Mark Owned | ❌ one `#ffffff`; vocab clean |
-| Checkout sheet mobile-only | ✅ `md:hidden` mount |
-
----
-
-## Token audit (3-tier)
-
-| Tier | Expectation | Diff notes |
-| --- | --- | --- |
-| Primitives | Hex only in CSS token definitions | No new CSS hex from convoy. **JSX** `#ffffff` in strip badge violates consumer rule. |
-| Aliases | `--glass-surface-*`, blur, rim, elevation, text, accent | Correctly used via GlassSurface props + `var(--*)` styles. Missing alias for on-accent / inverse text (primitives still hardcode `#ffffff`). |
-| Components | GlassSurface / Button / Modal compose aliases | Desk, inspector, strip, Tips comply. Tab badge invents parallel on-accent styling instead of composing Button/Badge. |
-
----
-
-## Component / adoption audit (scoped desktop surface)
-
-| Element | Expected | Actual | Rate |
-| --- | --- | --- | --- |
-| Camera frame | `GlassSurface` low + ember rim | Yes (`ScannerCamera` workstation branch) | High |
-| Desk control bar | `GlassSurface` mid | Yes (`pages/scanner.js`) | High |
-| Inspector | `GlassSurface` low | Yes (`ScannerResultPanel`) | High |
-| History strip shell | `GlassSurface` mid | Yes | High |
-| Strip chips | Solid `--bg-secondary` (no blur) | Yes | High |
-| Tips | `<Modal>` | Yes | High |
-| Primary / secondary CTAs | `<Button>` | Yes (Upload, Batch, Add, Rescan, Cancel, View All) | High |
-| Auto-detect / Foil | Switch pattern | Raw `<button role="switch">` ×2 | Medium — no Switch primitive |
-| Strip tabs | tablist | Raw `<button role="tab">` | Medium — correct a11y; not Button |
-| Clear All | Text link | Raw `<button>` ember text | Medium — matches direction “text link” |
-| Leave / List | `<Modal>` | Yes (page) | High |
-
-**Missing primitive (optional follow-up):** `Switch` (and optionally `Badge`) would remove duplicated toggle/`#ffffff` badge styling across desk + inspector + strip.
-
----
-
-## Findings
-
-Severity 0–4. Cap prioritized; sev ≥ 3 blocks merge recommendation for DS gate.
-
-| ID | Sev | Finding | Evidence | Fix |
-| --- | --- | --- | --- | --- |
-| DS-1 | **3** | Hardcoded hex in convoy JSX | `ScannerHistoryStrip.js` tab badge `color: '#ffffff'` (≈L250) | Replace with theme token (add `--text-on-accent` / reuse Button’s on-accent once tokenized) so `forbidden-hex-in-jsx` stays green |
-| DS-2 | **2** | Toggle knobs use Tailwind `bg-white` | `pages/scanner.js` Auto-detect knob; `ScannerResultPanel.js` Foil knob | Prefer `backgroundColor: 'var(--bg-primary)'` or a documented knob token — avoid raw white utility on themed surfaces |
-| DS-3 | **1** | Confidence bar accent drift vs Design direction color table | `ScannerResultPanel` `confidenceRingColor`: mid `--color-warning`, high `--color-success` | Optional align to `--accent-flame` / `--accent-gold` for ≥90% match badge; or document UX override (ReviewCardItem reuse) as accepted |
-| DS-4 | **1** | Clear All lacks destructive hover | Always `--accent-ember` | Direction: destructive on hover — add hover token mix if shipping polish pass |
-| DS-5 | **1** | Systemic on-accent hex in primitive (context) | `components/ui/Button.js` primary/danger still `#ffffff` / `#dc2626` | Out of convoy scope but explains copy-paste; tokenize in a follow-up DS convoy |
-
-### Passes (not findings)
-
-- No `"Add to Collection"`, `"Save to Wishlist"`, `"Mark Owned"`, `"All My Cards"` in scoped new UI.
-- Inspector + strip CTAs import `VOCAB.ADD_TO_MY_COLLECTION` / `VOCAB.ADD_TO_LIST`.
-- Tips uses `<Modal size="md">` with convoy-authored five tips; no custom scrim.
-- Strip chips: solid `--bg-secondary`, focused `--ember-rim-pronounced`; no per-chip blur.
-- Camera detection chrome: ember/flame L-brackets + scan-line with `prefers-reduced-motion` static mid-line.
-- Auto-detect badge: `motion-safe:animate-pulse` when ON.
-- Confidence bar width transition gated with `@media (prefers-reduced-motion: reduce)`.
-- Icons are SVG (lightbulb / empty-state camera), not emoji.
-- Mobile checkout sheet remains `md:hidden`; workstation controls `hidden md:flex`.
-
----
-
-## Governance notes
-
-- Contribution path: `docs/DESIGN_TOKENS.md` + `.cursor/rules/ui-and-theming.mdc`.
-- CI: `forbidden-hex-in-jsx` + stale-vocab gates — **DS-1 will fail the hex gate once these files are in CI’s path**.
-- Design-systems skill/templates not under `.cursor/skills/design-systems/` — G capped partly by missing shared audit tooling.
-
----
-
-## Recommendation
-
-**Treat DS as not merge-clean until DS-1 is fixed** (one-line / token swap on the strip badge). DS-2 is the next polish item for light/dark knob contrast. DS-3–DS-5 are non-blocking documentation / follow-up token work.
-
-**Child tasks (sev ≥ 3):**
-
-1. Remove `#ffffff` from `ScannerHistoryStrip.js` badge text — use a CSS variable (prefer adding `--text-on-accent: #fff` in `globals.css` and referencing it from Button + badge).
-
----
-
-## Hand-off
-
-DS audit complete. Maturity: **T3/C3/P3/G3/A3**. Top leverage: invest in **Tokens** (on-accent alias + purge convoy hex). Sev ≥ 3 findings: **1**. Report: `.convoys/scanner-desktop-layout/audits/design-system-20260815.md`.

.convoys/scanner-desktop-layout/audits/reviewer-20260815.md

@@ -1,21 +0,0 @@
-## Reviewer Report
-
-| Check | Status | Notes |
-| --- | --- | --- |
-| Scope match | ✅ | Working-tree JS/tests match the union of briefs 1–6 `files:` (camera hook, Tips/Result/History components, batch helper, page + Camera + queue/identification hooks, matching tests). Convoy docs under `.convoys/scanner-desktop-layout/` expected. No out-of-list app code. **Note:** branch tip is behind `origin/main` (merge-base `0d52858`); a naive `git diff origin/main` includes unrelated dashboard-home-realignment reversals — rebase before PR. |
-| Conventions | ✅ | `VOCAB` used for add actions; `<Modal>` / `GlassSurface` / `Button`; CSS variables (no hex / forbidden stale strings in scanner surfaces); relative imports; no new API routes or schema. |
-| Security | ✅ | No new auth/API surfaces; client-only. Device id in `sessionStorage` only. Depth deferred to `role-security-auditor` in this fan-out. |
-| Regression risk | medium | Touches `/scanner` composition, `useCameraScanner` stream constraints, and `verificationPausedRef` ownership (identification overwrite removed). Mobile chrome gated via `variant` + `isDesktop`, but pause/batch heuristics are easy to break. |
-| Test coverage | ✅ | 45 tests green across briefs 1–6 artifacts (`use-camera-scanner`, batch helper, Tips/Result/History/Camera, page viewport split). Gaps: checkout sheet not exercised open on mobile; Identifying… never wired to real in-flight identify. |
-| Documentation | ✅ | Convoy + briefs present; no AGENTS.md change required for this UI composition. |
-
-### Findings
-
-- 🟡 **Suggestion:** `isIdentifying={Boolean(identification.disambiguation)}` in `pages/scanner.js` does not match Brief 3’s “Identifying…” intent — disambiguation is post-match choice, and the hook has no in-flight identify flag. Empty rail will not show Identifying… during real scans; it may flash the wrong copy if disambiguation opens with no focused card. Wire a real verifying signal or leave `false` until one exists.
-- 🟡 **Suggestion:** Batch Scan does not switch the strip to **Scan Queue** when `batchProgress.active` (Design direction / strip UX). Progress banner only appears if the user is already on that tab.
-- 🟡 **Suggestion:** Device picker messages use short status strings (`No camera found`, etc.) but Design direction’s locked table includes action hints (e.g. “Connect a webcam or use Upload Image”). Align copy with the Design table.
-- 🟡 **Suggestion:** `test/pages/scanner.test.js` asserts the checkout sheet is absent when closed on mobile, but Brief 6 asks for no-regression coverage of the sheet at narrow width — open `isCheckoutOpen` (or equivalent) and assert the sheet mounts under `max-md`.
-- 🟢 **Nice to have:** Rebase/merge `origin/main` before opening the PR so the diff does not look like a dashboard revert; implementation itself stays in-scope once compared to the brief file union.
-
-### Approval recommendation
-- approve

.convoys/scanner-desktop-layout/audits/security-20260815.md

@@ -1,30 +0,0 @@
-## Security Audit
-
-| Check | Status | Notes |
-| --- | --- | --- |
-| Auth boundary | ✅ | No new API route or auth flow. `/scanner` keeps its `useAuth` redirect, and the unchanged scan endpoint verifies the Bearer token before its per-user scan rate limit. |
-| Authorization (IDOR) | ✅ | The desktop list picker uses the existing collection-card API; its server-side POST path confirms authenticated owner/editor permission before mutation. Client-held `collectionId` is not trusted as authorization. |
-| Input / injection | ⚠️ | File names and server error text are rendered as React text (no HTML sink), but new batch intake has no client-side file-size or count bound before decoding images into a canvas. |
-| Secrets exposure | ✅ | Device IDs are stored only in tab-scoped `sessionStorage`; no new secret, `NEXT_PUBLIC_*` value, token, or credential was found in the scanner additions. |
-| Dependencies | ⚠️ | No dependency manifest change is in the supplied diff, but `npm audit --omit=dev --json` reports five pre-existing production high-severity advisories (including `next`, `jws`, `nanoid`, `postcss`, and `sharp`). |
-
-### Findings
-
-1. **[Severity 4 — scope expansion]** `git diff origin/main -- . ':!.convoys/.metrics.jsonl'` contains 15 tracked paths outside Briefs 1–6, including dashboard/nav work, `components/Layout.js`, `pages/dashboard.js`, `pages/my-cards.js`, and `pages/api/user-cards.js`; it also deletes the separate `dashboard-home-realignment` convoy artifacts. This violates every brief's explicit file scope and prevents a trustworthy scanner-only review. **Fix:** rebase/cherry-pick the scanner implementation onto `origin/main` (or split the unrelated dashboard/API changes into their own convoy) and re-run the audit. Note that the supplied `git diff` does not show untracked scanner files, so this audit additionally inspected their working-tree contents.
-
-2. **[Severity 1 — file intake hardening]** `pages/scanner.js:269-300` accepts an arbitrary number of arbitrary-sized `image/*` files, and `lib/use-scanner-identification.js:20-42` decodes each selected image at full natural dimensions into a canvas before the existing server-side 6 MB request cap can apply. A logged-in user can select a very large or decompression-bomb image set, freezing their tab and creating repeated scan attempts. `accept="image/*"` is only a picker hint, not validation. **Fix:** before `runSequentialGalleryIdentify`, enforce a maximum file count, MIME allowlist, and conservative byte limit compatible with the 6 MB base64 server limit; reject failures per file before calling `readFileToImageData`.
-
-3. **[Severity 2 — inherited production dependency advisories]** `npm audit --omit=dev --json` reports five high-severity production vulnerabilities. The most material is the direct `next` range `<16.2.11`; the audit also identifies transitive `jws`, `nanoid`, `postcss`, and `sharp`. No package manifest changed in this convoy, so this is not introduced by the scanner work, but it remains a release risk. **Fix:** open or link the dependency-upgrade/accepted-risk work before release, and verify the deployed Next.js version against the advisories.
-
-### Layer notes
-
-- **Layer 1:** Existing scanner endpoints retain authentication and the scan rate-limit gate; this convoy adds no server action or API route.
-- **Layer 2:** The list picker is UI convenience only. `pages/api/collections/[identifier]/cards.js:90-101` independently requires an authenticated owner/editor for POST, preventing a forged picker ID from becoming an IDOR.
-- **Layer 3:** React escapes the batch-derived file basename (`pages/scanner.js:226-235`) and failure strings (`components/scanner/ScannerHistoryStrip.js:91-94`); no `dangerouslySetInnerHTML`, `eval`, or shell construction was found. The file-bound finding above remains.
-- **Layer 4:** `lib/use-camera-scanner.js:37-90` stores only opaque camera device IDs in `sessionStorage`, using a fixed key and guarded reads/writes. No scanner secret is exposed to the client.
-- **Layer 5:** See dependency finding 3. The full audit reports 16 issues including dev dependencies; the production-only audit reports five high findings.
-- **Layer 6:** No middleware, Next config, CORS, cookie, or header change was included.
-
-### Recommendation
-
-**Do not merge as currently scoped.** Resolve the severity-4 scope expansion first. After isolating the scanner-only diff, add the file size/count/type guard (or document an accepted risk) and re-audit; the existing dependency findings should be tracked or risk-accepted separately because they were not introduced here.

.convoys/scanner-desktop-layout/brief-1-camera-device-picker.md

@@ -1,90 +0,0 @@
----
-convoy: scanner-desktop-layout
-brief_number: 1
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/use-camera-scanner.js
-  - test/lib/use-camera-scanner.test.js
-cross_brief_commitments:
-  - brief: 6
-    description: |
-      Exports `videoDevices`, `selectedDeviceId`, `setSelectedDeviceId`,
-      `devicePickerStatus` (`loading` | `ready` | `empty` | `denied` | `error`),
-      and `devicePickerMessage` for the desk Camera `<select>` in Brief 6.
-      Mobile callers keep using `facingMode` / `switchFacingMode` only — do not
-      mount the device picker below `md`.
----
-
-# Brief 1: Webcam device picker hook
-
-## Goal (1 sentence)
-
-Extend `useCameraScanner` with `enumerateDevices` + `deviceId` stream selection for desktop webcams while preserving mobile facing-mode swap.
-
-## Files in scope (do not edit anything else)
-
-- `lib/use-camera-scanner.js`
-- `test/lib/use-camera-scanner.test.js`
-
-## Conventions to follow
-
-- Tagged-template / relative imports only; no path aliases.
-- No hex in JS — use CSS variables if any inline styles are needed in tests.
-- `getUserMedia` constraints: when `selectedDeviceId` is set, use
-  `{ video: { deviceId: { exact: selectedDeviceId }, width: { ideal: 1280 }, height: { ideal: 720 } } }`;
-  when unset, keep existing `facingMode` constraint shape.
-- Call `enumerateDevices` after the first successful stream (labels require an
-  active permission grant). Filter `kind === 'videoinput'`.
-- Optional cheap persist: `sessionStorage` key `scanner:last-camera-device-id`
-  — read on init, write on `setSelectedDeviceId`.
-- Restart stream on `selectedDeviceId` change (same pattern as `activeFacingMode`
-  effect). Guard with a ref to skip the initial mount double-start.
-- `verificationPausedRef` contract unchanged — camera hook does not own pause logic.
-- Mirror existing test style in `test/lib/scanner-card-detection.test.js` (vitest,
-  mocks for `navigator.mediaDevices`).
-
-## Implementation shape (verified against current hook)
-
-Current hook returns `facingMode`, `switchFacingMode` only — no `deviceId`.
-`startCamera` uses `facingMode: activeFacingModeRef.current` exclusively.
-
-Add:
-
-```js
-const [videoDevices, setVideoDevices] = useState([]);
-const [selectedDeviceId, setSelectedDeviceId] = useState(() => {
-  try {
-    return sessionStorage.getItem('scanner:last-camera-device-id') || '';
-  } catch {
-    return '';
-  }
-});
-const [devicePickerStatus, setDevicePickerStatus] = useState('loading');
-```
-
-`refreshVideoDevices` async helper:
-
-1. If `!navigator.mediaDevices?.enumerateDevices`, set status `error`.
-2. Map videoinputs; if length === 0 → `empty`.
-3. If `selectedDeviceId` not in list, fall back to first device or ''.
-4. On `NotAllowedError` from prior getUserMedia → `denied`.
-
-Export `setSelectedDeviceId` wrapper that persists to sessionStorage.
-
-**Do not** remove `switchFacingMode` — mobile Brief 3 camera chrome still uses it.
-
-## Acceptance criteria
-
-- [ ] `enumerateDevices` populates `videoDevices` after stream start in tests (mocked)
-- [ ] `selectedDeviceId` switches `getUserMedia` constraints to `deviceId: { exact }`
-- [ ] `switchFacingMode` still toggles environment/user when no deviceId forced
-- [ ] `devicePickerStatus` + message cover loading, empty, denied, error per Design direction table
-- [ ] sessionStorage persist for last device id (read/write with try/catch)
-- [ ] tests added in `test/lib/use-camera-scanner.test.js`
-- [ ] no scope expansion (do not edit files outside `files:` above)
-
-## Rationale (≤3 sentences)
-
-Desktop workstations need a real webcam picker (C4), not a relabeled facing-mode swap. Isolating device enumeration in the hook keeps `ScannerCamera` and `pages/scanner.js` thin. Mobile behavior stays untouched because deviceId is only consumed at the page/camera wiring layer in Brief 6.

.convoys/scanner-desktop-layout/brief-2-scanner-tips.md

@@ -1,79 +0,0 @@
----
-convoy: scanner-desktop-layout
-brief_number: 2
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - components/scanner/ScannerTips.js
-  - test/components/ScannerTips.test.js
-cross_brief_commitments:
-  - brief: 6
-    description: |
-      Brief 6 mounts `<ScannerTips />` in the desktop page header row (md+ only)
-      beside "Card Scanner" title. This brief ships the self-contained modal +
-      trigger button; no page wiring here.
----
-
-# Brief 2: Scanner Tips modal
-
-## Goal (1 sentence)
-
-Ship a desktop Scanner Tips control that opens a glass `<Modal>` with five convoy-authored tips.
-
-## Files in scope (do not edit anything else)
-
-- `components/scanner/ScannerTips.js`
-- `test/components/ScannerTips.test.js`
-
-## Conventions to follow
-
-- Use `Modal` + `Button` from `components/ui` — no custom scrim (`ui-and-theming.mdc`).
-- Glass panel recipe: `--glass-surface-low` via `GlassSurface` inside modal body if needed.
-- Copy locked (Design direction + IA):
-
-| # | Tip |
-| --- | --- |
-| 1 | **Good lighting** — avoid glare on foil cards. |
-| 2 | **Fill the frame** with one card; keep corners visible. |
-| 3 | **Hold still** until Auto-detect locks the match. |
-| 4 | **Use Batch Scan** for a pile of photos from your gallery. |
-| 5 | **Switch camera** if the image is dark or mirrored. |
-
-- Modal title: **Scanner Tips**. Trigger: ghost `Button` with lightbulb SVG + label **Scanner Tips** (visible text for 2.5.3 Label in Name).
-- Dismiss: close control, Esc, scrim click — standard `<Modal>` behavior.
-- No hex in `.js`; tokens only.
-- Test pattern: `test/components/ScannerCheckoutSheet.test.js` (vitest + jsdom + RTL).
-
-## Implementation shape
-
-```js
-export default function ScannerTips({ className = '' }) {
-  const [open, setOpen] = useState(false);
-  return (
-    <>
-      <Button variant="ghost" onClick={() => setOpen(true)} /* lightbulb + Scanner Tips */ />
-      <Modal open={open} onClose={() => setOpen(false)} title="Scanner Tips" size="md">
-        <ol className="space-y-4 text-sm" style={{ color: 'var(--text-secondary)' }}>
-          {/* five <li> with <strong> lead + em dash body */}
-        </ol>
-      </Modal>
-    </>
-  );
-}
-```
-
-Component is self-contained — no props required v1.
-
-## Acceptance criteria
-
-- [ ] Trigger shows lightbulb icon + **Scanner Tips** visible label
-- [ ] Modal lists exactly five tips with locked copy
-- [ ] Uses `<Modal>` primitive (no `fixed inset-0 bg-black` shell)
-- [ ] Opening/closing traps focus per existing Modal behavior
-- [ ] tests: trigger opens modal, all five tips visible, close dismisses
-- [ ] no scope expansion (do not edit files outside `files:` above)
-
-## Rationale (≤3 sentences)
-
-Tips are a standalone surface (C3) with no queue or camera dependencies. Shipping the modal in isolation lets Brief 6 wire it into the header without blocking other parallel work. Five tips exceed popover length — Modal is Design-locked.

.convoys/scanner-desktop-layout/brief-3-result-inspector.md

@@ -1,78 +0,0 @@
----
-convoy: scanner-desktop-layout
-brief_number: 3
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - components/scanner/ScannerResultPanel.js
-  - test/components/ScannerResultPanel.test.js
-cross_brief_commitments:
-  - brief: 6
-    description: |
-      Brief 6 passes `focusedCard`, `queue`, `isIdentifying`, handlers
-      (`onAddToOwned`, `onAddToList`, `onRescan`), and `commitError`. On
-      successful add, Brief 6 advances `focusedCardId` to the next unprocessed
-      entry and fires `ScannerToast` — this component calls `onAddToOwned` only.
----
-
-# Brief 3: Live match inspector rail
-
-## Goal (1 sentence)
-
-Build the right-rail `ScannerResultPanel` that inspects the focused cart entry and commits one card via `VOCAB.ADD_TO_MY_COLLECTION`.
-
-## Files in scope (do not edit anything else)
-
-- `components/scanner/ScannerResultPanel.js`
-- `test/components/ScannerResultPanel.test.js`
-
-## Conventions to follow
-
-- Import `VOCAB` from `lib/collection-vocabulary.js` — never ship forbidden strings
-  (`forbidden-stale-strings` CI).
-- Primitives: `GlassSurface`, `Button` from `components/ui`.
-- Duplicate minimally from `ReviewCardItem.js`: `CONDITION_OPTIONS`,
-  `confidencePercent`, `confidenceRingColor` (do not edit `ReviewCardItem` in this brief).
-- Confidence captions (Design direction): ≥90% *Excellent match.* · ≥70% *Good match.*
-  · <70% *Low confidence — verify before adding.*
-- Inspector thumbnail + tiles: solid `--bg-secondary` — **no `backdrop-filter`** on per-card elements.
-- Empty state: centered muted scan/camera SVG illustration + single line:
-  *Point your camera at a card or upload an image to see a match.* — **no** Upload/Batch CTAs in rail.
-- Populated: thumbnail, name (`text-lg font-semibold`), set · rarity · collector #,
-  condition `<select>` (`aria-label` includes card name), foil `role="switch"`,
-  confidence % + horizontal bar (300ms width transition; `@media (prefers-reduced-motion: reduce)` → instant).
-- Actions: primary `VOCAB.ADD_TO_MY_COLLECTION` · ghost **Rescan** · ghost `VOCAB.ADD_TO_LIST`.
-- Primary `Button` uses `loading` when `isAdding` (from `queue.addingCardIds.has(card.id)`).
-- Commit errors: `role="alert"` div with `color-mix(in srgb, var(--color-error) …)` pattern from `pages/scanner.js`.
-- `isIdentifying` state: show *Identifying…* placeholder when true and no focused card yet.
-
-## Props shape (for Brief 6 wiring)
-
-```js
-export default function ScannerResultPanel({
-  focusedCard = null,
-  queue,
-  isIdentifying = false,
-  commitError = null,
-  onAddToOwned,
-  onAddToList,
-  onRescan,
-}) {
-```
-
-`onUpdateMetadata` via `queue.updateCardMetadata(focusedCard.id, patch)` inline.
-
-## Acceptance criteria
-
-- [ ] Empty state: illustration + one line only (no duplicate Upload/Batch)
-- [ ] Populated state shows metadata, condition select, foil switch, confidence bar
-- [ ] Primary button label is `VOCAB.ADD_TO_MY_COLLECTION`
-- [ ] Secondary row: Rescan + `VOCAB.ADD_TO_LIST` (no wishlist)
-- [ ] `prefers-reduced-motion` disables confidence bar width animation
-- [ ] tests: empty state, populated card, add button disabled while adding
-- [ ] no scope expansion (do not edit files outside `files:` above)
-
-## Rationale (≤3 sentences)
-
-The inspector replaces the 360px cart side panel as the primary right-hand surface on desktop. Keeping it a dumb view lets Brief 6 own focus/advance/toast orchestration. Confidence and condition UX matches checkout patterns users already know from `ReviewCardItem`.

.convoys/scanner-desktop-layout/brief-4-history-strip.md

@@ -1,105 +0,0 @@
----
-convoy: scanner-desktop-layout
-brief_number: 4
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - components/scanner/ScannerHistoryStrip.js
-  - test/components/ScannerHistoryStrip.test.js
-cross_brief_commitments:
-  - brief: 6
-    description: |
-      Brief 6 supplies `focusedCardId`, `onFocusCard`, `batchProgress`
-      (`{ active, current, total, onCancel }`), bulk commit handlers, and
-      `onClearAll`. Row click calls `onFocusCard(card.id)` — no auto-commit.
----
-
-# Brief 4: History / queue / duplicates strip
-
-## Goal (1 sentence)
-
-Build the bottom `ScannerHistoryStrip` with Recent Scans, Scan Queue, and Duplicates tabs over the existing cart model.
-
-## Files in scope (do not edit anything else)
-
-- `components/scanner/ScannerHistoryStrip.js`
-- `test/components/ScannerHistoryStrip.test.js`
-
-## Conventions to follow
-
-- `GlassSurface` tint `mid` for strip container; chips use solid `--bg-secondary` fill — **no per-chip `backdrop-filter`**.
-- Tab labels: **Recent Scans**, **Scan Queue**, **Duplicates** with badge counts on Queue and Duplicates.
-- `role="tablist"` / `role="tab"` / `role="tabpanel"`; badges in `aria-label`
-  (e.g. `Scan Queue, 3 unprocessed cards`).
-- Empty tab copy (UX §5): Recent → *No scans yet this session.* · Queue →
-  *Scan queue is empty — matches appear here before you add them.* · Duplicates →
-  *No duplicates detected.*
-- **Clear All** text link right-aligned; disabled while `batchProgress?.active`.
-- **View All Scans** ghost button at strip bottom scrolls chip row to end (v1 — no expanded modal).
-- Chip row: horizontal `overflow-x-auto`, min height 44px, ember rim on focused chip
-  (`focusedCardId === card.id` → `--ember-rim-pronounced`).
-- Row click → `onFocusCard(card.id)` only — never auto-commit.
-- Batch progress UI (when `batchProgress.active`): inline banner in Scan Queue tabpanel —
-  *Scanning {current} of {total}…* determinate bar, ghost **Cancel** calling `batchProgress.onCancel`.
-- Failed identify rows: `identifyFailed` flag on card (Brief 6 sets) → ember left border +
-  **Identify failed** label + optional reason `text-sm`.
-
-## Duplicate membership helper (export from this file)
-
-```js
-export function getDuplicateCards(scannedCards, ownershipMap) {
-  const sessionRepeatIds = new Set();
-  const seen = new Map(); // key: name+set → first id
-  for (const card of scannedCards) {
-    const key = `${card.name}::${card.set}`;
-    if (seen.has(key)) sessionRepeatIds.add(card.id);
-    else seen.set(key, card.id);
-    if ((card.quantity || 1) > 1) sessionRepeatIds.add(card.id);
-  }
-  return scannedCards.filter(
-    (card) =>
-      sessionRepeatIds.has(card.id) ||
-      (card.databaseId && ownershipMap[card.databaseId])
-  );
-}
-```
-
-**Recent Scans** tab: all `scannedCards` session history (processed + unprocessed), newest first.
-**Scan Queue** tab: `!card.processed` rows; badge = unprocessed count.
-**Duplicates** tab: `getDuplicateCards(...)`; badge = duplicate set length.
-
-## Props shape
-
-```js
-export default function ScannerHistoryStrip({
-  scannedCards,
-  ownershipMap,
-  focusedCardId,
-  onFocusCard,
-  activeTab,
-  onTabChange,
-  batchProgress = null,
-  onClearAll,
-  onCommitSelectedToOwned,
-  onOpenListPicker,
-  isProcessing = false,
-}) {
-```
-
-Bulk commit buttons in Queue tab footer: `VOCAB.ADD_TO_MY_COLLECTION` + `VOCAB.ADD_TO_LIST` calling parent handlers (Brief 6 wires `queue.commitSelectedToOwned`).
-
-## Acceptance criteria
-
-- [ ] Three tabs with correct labels and badge counts
-- [ ] `getDuplicateCards` covers ownershipMap + session name/set repeats + quantity>1
-- [ ] Row click invokes `onFocusCard` without commit
-- [ ] Batch progress banner with Cancel when `batchProgress.active`
-- [ ] Clear All disabled during active batch
-- [ ] Chip focus ring matches `focusedCardId`
-- [ ] tests: tab switching, duplicate helper, empty states, batch banner
-- [ ] no scope expansion (do not edit files outside `files:` above)
-
-## Rationale (≤3 sentences)
-
-The strip is the second commit surface (C5) alongside the inspector. Centralizing duplicate logic in one exported helper keeps `pages/scanner.js` thin. Tab + chip UX is independent of camera device picker, so this brief parallelizes cleanly.

.convoys/scanner-desktop-layout/brief-5-batch-identify-helper.md

@@ -1,92 +0,0 @@
----
-convoy: scanner-desktop-layout
-brief_number: 5
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/scanner-batch-identify.js
-  - test/lib/scanner-batch-identify.test.js
-cross_brief_commitments:
-  - brief: 6
-    description: |
-      Brief 6 calls `runSequentialGalleryIdentify(files, identifyFn, options)`
-      from the Batch Scan multi-file picker. On per-file failure Brief 6 enqueues
-      a queue row with `identifyFailed: true` and `identifyError` message; cancel
-      via `cancelRef.current = true` keeps completed rows (IA-locked).
----
-
-# Brief 5: Sequential batch identify helper
-
-## Goal (1 sentence)
-
-Add a small library helper that runs `identifyFromGalleryFile` sequentially over multiple files with progress, cancel, and per-file failure continuation.
-
-## Files in scope (do not edit anything else)
-
-- `lib/scanner-batch-identify.js`
-- `test/lib/scanner-batch-identify.test.js`
-
-## Conventions to follow
-
-- **No new API routes** — caller passes `identifyFn` (Brief 6 binds
-  `identification.identifyFromGalleryFile`).
-- **Sequential only** — one `await identifyFn(file)` at a time; no `Promise.all`.
-- Respect identify rate limits implicitly (sequential pacing).
-- Pure JS module — no React.
-
-## Implementation shape
-
-```js
-/**
- * @typedef {{ current: number, total: number, file: File }} BatchProgress
- */
-
-export async function runSequentialGalleryIdentify(files, identifyFn, options = {}) {
-  const {
-    onProgress,
-    onFileSuccess,
-    onFileError,
-    cancelRef = { current: false },
-  } = options;
-
-  const list = Array.from(files || []);
-  const total = list.length;
-  const results = [];
-
-  for (let i = 0; i < list.length; i++) {
-    if (cancelRef.current) break;
-    const file = list[i];
-    onProgress?.({ current: i + 1, total, file });
-
-    try {
-      await identifyFn(file);
-      results.push({ file, ok: true });
-      onFileSuccess?.({ file, index: i });
-    } catch (error) {
-      results.push({ file, ok: false, error });
-      onFileError?.({ file, index: i, error });
-      // continue — IA forbids stopping the batch
-    }
-  }
-
-  return { results, cancelled: cancelRef.current };
-}
-```
-
-`identifyFn` may not throw today — helper still catches for forward-compat.
-If `identifyFromGalleryFile` only reports via console, Brief 6 may wrap it to
-throw on hard failures.
-
-## Acceptance criteria
-
-- [ ] Processes files one-at-a-time in order
-- [ ] `onProgress` fires before each file with `{ current, total, file }`
-- [ ] `cancelRef.current = true` stops remaining files but returns partial `results`
-- [ ] Per-file errors invoke `onFileError` and continue loop
-- [ ] tests cover success path, mid-batch cancel, and error continuation
-- [ ] no scope expansion (do not edit files outside `files:` above)
-
-## Rationale (≤3 sentences)
-
-Batch Scan (C1) needs orchestration without touching `use-scanner-identification.js` identify logic. A 60-line pure helper is testable and keeps the page brief focused on UI wiring. Sequential execution avoids Gemini rate-limit storms explicitly forbidden in scope.

.convoys/scanner-desktop-layout/brief-6-page-workstation-wiring.md

@@ -1,171 +0,0 @@
----
-convoy: scanner-desktop-layout
-brief_number: 6
-depends_on: [1, 2, 3, 4, 5]
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - pages/scanner.js
-  - components/scanner/ScannerCamera.js
-  - lib/use-scanner-identification.js
-  - lib/use-scanner-queue.js
-  - test/pages/scanner.test.js
-  - test/components/ScannerCamera.test.js
-cross_brief_commitments:
-  - brief: 1
-    description: |
-      Wires `camera.videoDevices`, `selectedDeviceId`, `setSelectedDeviceId`,
-      and `devicePickerStatus` into the desk Camera `<select>` (md+ only).
-  - brief: 2
-    description: |
-      Mounts `<ScannerTips />` in desktop page header (`hidden md:flex` row).
-  - brief: 3
-    description: |
-      Mounts `<ScannerResultPanel />` with focus/advance/toast orchestration
-      after `addSingleCardToOwned`.
-  - brief: 4
-    description: |
-      Mounts `<ScannerHistoryStrip />` with `focusedCardId`, batch progress,
-      and bulk commit handlers.
-  - brief: 5
-    description: |
-      Batch Scan multi-file input calls `runSequentialGalleryIdentify` with
-      `identification.identifyFromGalleryFile`.
----
-
-# Brief 6: Desktop workstation page wiring
-
-## Goal (1 sentence)
-
-Wire `pages/scanner.js` into the md+ workstation grid (inspector + strip + desk controls) without regressing mobile immersive checkout.
-
-## Files in scope (do not edit anything else)
-
-- `pages/scanner.js`
-- `components/scanner/ScannerCamera.js`
-- `lib/use-scanner-identification.js`
-- `lib/use-scanner-queue.js`
-- `test/pages/scanner.test.js`
-- `test/components/ScannerCamera.test.js`
-
-## Conventions to follow
-
-- **Layout chrome (boot finding):** `chrome="immersive"` already shows sidebar +
-  TopSearchBar at `md+` per `Layout.js` (`max-md:hidden` only on mobile nav).
-  Use explicit viewport split for semantics:
-
-  ```js
-  const [isDesktop, setIsDesktop] = useState(false);
-  useEffect(() => {
-    const mq = window.matchMedia('(min-width: 768px)');
-    const sync = () => setIsDesktop(mq.matches);
-    sync();
-    mq.addEventListener('change', sync);
-    return () => mq.removeEventListener('change', sync);
-  }, []);
-  // <Layout chrome={isDesktop ? 'default' : 'immersive'} />
-  ```
-
-  Smallest change — no `Layout.js` edits.
-
-- **Mobile zero regression:** keep `ScannerCheckoutSheet`, overlay camera chrome,
-  `ScannerCountPill`, scan peek — all `md:hidden` or `max-md:` as today.
-- Remove desktop `ScannerReview` side panel (`hidden md:flex` block) — replaced by
-  inspector + strip.
-- **Pause coordination (boot finding):** `useScannerIdentification` currently has:
-
-  ```js
-  useEffect(() => {
-    if (verificationPausedRef) {
-      verificationPausedRef.current = Boolean(disambiguation);
-    }
-  }, [disambiguation, verificationPausedRef]);
-  ```
-
-  **Delete this effect** — page owns composite pause:
-
-  ```js
-  verificationPausedRef.current =
-    mobileCheckoutPauses ||
-    isListPickerOpen ||
-    isAutoDetectPaused ||
-    Boolean(identification.disambiguation);
-  ```
-
-  Desktop Auto-detect toggle sets `isAutoDetectPaused` (OFF = paused).
-
-- **Focused card state:** `focusedCardId` + derived `focusedCard`. On new scan,
-  auto-focus latest unprocessed (`scannedCards.find(c => !c.processed)`).
-- **Inspector add success:** wrap `addSingleCardToOwned` — on success show
-  `ScannerToast` (*Added to My Collection*), advance to next unprocessed or empty.
-  Boot finding: current `addSingleCardToOwned` does not return boolean — check
-  `markCardAsProcessed` by awaiting and verifying card.processed or catch errors;
-  optionally extend queue method to `return true/false` in a follow-up if needed
-  inside this brief only if `use-scanner-queue.js` is NOT in scope — use try/catch
-  around API and inspect state after await.
-
-  **Note:** To return success reliably, add minimal change to
-  `lib/use-scanner-queue.js` `addSingleCardToOwned` → `return true` on success,
-  `return false` on error — **only if needed**; prefer not to expand files list.
-  Alternative: duplicate add call in page using `addScannedCardToOwned` from
-  `scanner-route-api.js` — **rejected**; instead add `return true/false` to
-  `use-scanner-queue.js` is out of files — use `addingCardIds` clearing + no error
-  log as success heuristic OR add `use-scanner-queue.js` to this brief's files.
-
-  **Architect lock:** add `lib/use-scanner-queue.js` to this brief for
-  `addSingleCardToOwned` returning `boolean`.
-
-- **List picker desktop:** `handleListPick` uses **focused card id** single selection
-  (`queue.addSingleCardToCollection(focusedCard, collectionId)`), not bulk selected set.
-- **Leave modal:** keep existing; trigger on back + unprocessed queue.
-- **Batch Scan:** hidden `<input type="file" multiple accept="image/*" />` on desk bar;
-  `runSequentialGalleryIdentify` with `cancelRef`; on `onFileError` enqueue synthetic
-  failed row via `queue.handleCardScanned` with `identifyFailed: true` OR dedicated
-  `enqueueFailedIdentify(file, error)` inline in page.
-- **Rescan:** clear identify fields on focused card (`updateCardMetadata`), set
-  `processed: false`; if `scanImageUrl` present fetch blob and
-  `identifyFromGalleryFile`; else toast *Rescan from camera*.
-- **ScannerCamera workstation:** add `variant="default" | "workstation"` (or `layoutMode`).
-
-  At `md+` with `variant="workstation"`:
-  - Container: framed panel not `min-h-[100dvh]` full-bleed — use `md:rounded-xl`,
-    `md:aspect-video`, `md:min-h-0`, outer `GlassSurface` + ember rim.
-  - Hide overlay top bar + bottom bar (`max-md:` keep current).
-  - Hide `ScannerScanPeek`, mobile LIVE badge, `ScannerCountPill` at `md+`.
-  - Show **Auto-detect badge** top-left in frame (ON/OFF from `!verificationPausedRef`
-    composite for auto-detect slice only — pass `autoDetectOn` prop).
-  - Badge dot pulse when ON; `prefers-reduced-motion: reduce` → static dot.
-  - Accept optional `deskControls` slot rendered **below** frame by page OR
-    `deskControlBar` prop — page renders Upload/Batch/Auto-detect/Camera select below.
-
-- **Desk control bar (page, md+):** Camera `<select>` + Upload Image + Batch Scan +
-  Auto-detect switch per Design direction. Upload uses existing single-file input path.
-- **Tests:** `test/pages/scanner.test.js` — mock hooks; assert mobile checkout sheet
-  present at narrow width; workstation elements (`ScannerResultPanel`, strip) at `md+`
-  (use `window.matchMedia` mock). `test/components/ScannerCamera.test.js` — overlay
-  chrome hidden at workstation variant.
-- **Visual-diff:** `/scanner` is **not** in `tests/visual/` (only `home.png`) — no
-  baseline update required.
-
-## `use-scanner-queue.js` changes
-
-- `addSingleCardToOwned` returns `true` on success, `false` on error (after `try/catch`).
-- `addSingleCardToCollection` same boolean return for desktop list picker.
-
-## Acceptance criteria
-
-- [ ] `md+` workstation grid: header + camera column + inspector + bottom strip
-- [ ] `max-md` immersive checkout sheet unchanged (regression test)
-- [ ] `chrome` default on desktop, immersive on mobile
-- [ ] Device picker + Batch Scan + Auto-detect on desk bar only at `md+`
-- [ ] `ScannerTips` in desktop header
-- [ ] Inspector advance + toast on successful add
-- [ ] Batch sequential with cancel + per-file failure flags
-- [ ] `verificationPausedRef` composite pause without identification hook overwrite
-- [ ] No forbidden copy strings
-- [ ] tests added; no visual-diff baseline change
-- [ ] no scope expansion beyond listed files
-
-## Rationale (≤3 sentences)
-
-Only one brief can own `pages/scanner.js` composition. Camera workstation variant and pause fix are tightly coupled to page wiring. Briefs 1–5 ship mountable units; this brief integrates them without blocking parallel implementers.

.convoys/scanner-disambiguation-render-test.md

@@ -1,70 +0,0 @@
----
-slug: scanner-disambiguation-render-test
-status: shipping
-opened: 2026-06-13
-owner: rstillw
-related:
-  - PR #144 (`31da384`) — the runtime `useFocusTrap is not defined` ReferenceError this test locks in against
-  - `enable-no-undef-eslint-rule` convoy — sibling that closes the same bug class at lint time
----
-
-# scanner-disambiguation-render-test
-
-## Problem
-
-PR #144 shipped a runtime `ReferenceError: useFocusTrap is not defined` to production because `ScanDisambiguationDialog` called a hook it never imported. The sibling `enable-no-undef-eslint-rule` convoy closes that bug class at lint time. This convoy locks the regression at **render time** as well, so even if someone disables the lint rule (or a future rule-set change drops it), the same bug would still fail CI.
-
-## Why vitest + jsdom instead of Playwright smoke
-
-The task was originally queued as "scanner-disambiguation-smoke-test." Re-scoped because:
-
-| Path | Catches PR #144 | Setup cost | Run time |
-|---|---|---|---|
-| Playwright smoke | ✓ if the disambiguation modal mounts during the smoke run | High — need auth bypass, a real way to enter the disambiguation state (multiple-candidate scan), and a stable fixture image | ~10s + browser overhead |
-| Vitest + @testing-library/react | ✓ directly — the render-throw is caught by the test | Low — fixture is plain JS, props are explicit | <100ms |
-
-A vitest render test catches the **exact** same bug class (`ReferenceError` during component render) at 1/100th the cost, and matches the existing `test/components/*.test.js` pattern (`Modal.test.js`, `ScannedCardItem.test.js`, etc.). A Playwright smoke test of the disambiguation flow could be added later as an integration-coverage layer but is **not** the right tool for regression-locking THIS specific bug class.
-
-The deferred Playwright disambiguation smoke test is queued separately (see § Follow-ups).
-
-## What ships
-
-`test/components/ScanDisambiguationDialog.test.js` — 8 tests:
-
-1. **`renders without crashing when given a disambiguation (PR #144 regression-lock)`** — the cheapest, most direct regression-lock. If `useFocusTrap` (or any other imported identifier) is missing, `render()` throws and this assertion fails. Comment in the test calls this out by name.
-2. `returns null when disambiguation prop is falsy` — the early-return branch
-3. `renders dialog with the correct ARIA shape` — `role="dialog"`, `aria-modal`, `aria-labelledby`
-4. `renders one button per candidate with accessible labels`
-5. `calls onPick with the selected candidate`
-6. `renders the vision hint when one is provided` — exercises the optional `disambiguation.visionHint` branch
-7. `disables the "send for review" button while submitting and shows in-flight copy`
-8. `calls onCancel when the Cancel button is clicked`
-
-## Verification
-
-Mutation test executed locally: commented out the `useFocusTrap` import → all 8 tests fail with the same `ReferenceError` shape that hit prod in PR #144. Restored the import → all 8 pass. Full suite: 26 files / 131 tests pass (up from 25 / 123 pre-PR).
-
-## Decisions
-
-- **D1.** Cover the early-return branch explicitly even though it's a one-liner. Cost is negligible (~2 lines) and it locks the `if (!disambiguation) return null;` semantics — a future refactor that returns a placeholder instead would intentionally break this test and force a review of the contract change.
-- **D2.** Use `fireEvent` for click handlers, not `userEvent`. `userEvent` is more realistic but adds a dependency (`@testing-library/user-event`) for marginal gain on these simple button-click assertions. Matches existing test pattern in `Modal.test.js`.
-- **D3.** Do NOT mock `useFocusTrap`. The hook is real and runs against jsdom. Reasoning: the original PR #144 bug was that the hook was *missing*; mocking would mask exactly the kind of failure this test is designed to catch.
-
-## Follow-ups (queued, not in this PR)
-
-- `add-component-render-smoke-pattern` — sweep the other components that conditionally mount (`UploadImageModal`, `CollectionEditModal`, `CollectionDeleteModal`, `ShareModal`, `CollaboratorFacepile`'s expanded view, etc.) and add a minimal "renders without crashing with realistic props" test to each. Same regression-lock value, one PR per ~5 components.
-- `scanner-disambiguation-playwright-smoke` — add a Playwright smoke test that exercises the full scan → ambiguous-match → pick-candidate flow against a deployed preview. Higher value as integration-layer coverage, but blocked on (a) a stable test fixture image that consistently produces multiple-candidate OCR matches and (b) auth bypass for the scanner route. Deferred.
-
-## Acceptance
-
-- [x] `test/components/ScanDisambiguationDialog.test.js` exists with the 8 listed assertions
-- [x] Mutation test confirmed all 8 tests fail when the `useFocusTrap` import is removed
-- [x] Full vitest suite passes (26 files / 131 tests)
-- [ ] CI on the PR green
-
-## Non-goals
-
-- Adding `@testing-library/user-event` (use `fireEvent` to match existing pattern)
-- Adding a Playwright smoke for this flow (queued separately)
-- Adding render tests for other modal components (queued separately)
-- Refactoring the component itself (it's already well-scoped post-PR #144 fix)

.convoys/scanner-identify-upgrade.md

@@ -1,265 +0,0 @@
----
-name: scanner-identify-upgrade
-classification: feature
-success_metric: |
-  Of legitimate card scans (excluding not_a_card), ≥50% auto-match a
-  catalog printing with no picker; Layer-1 escalate rate falls from 76.7%
-  to ≤40%; median /api/scan/identify latency stays near today's 1.7s p50
-  or improves. Measured on scan_attempts after Phase 1 ships.
-skip: []
-status: open
-created: 2026-08-14
-depends_on:
-  - add-real-ocr-layer
-  - server-side-scan-pipeline
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
-    role-design-system-auditor: cursor-grok-4.5-high
-    role-a11y-auditor: cursor-grok-4.5-high
-    role-doc-writer: auto
-  escalate_to: claude-sonnet-5-thinking-medium
-  escalate_to_premium: claude-4.6-opus-high-thinking
-  never_premium:
-    - role-reviewer
-    - role-security-auditor
-    - role-design-system-auditor
-    - role-a11y-auditor
-    - role-ui-designer
-    - role-doc-writer
----
-
-# Scanner identify upgrade — epic
-
-Umbrella for making the camera scanner **faster and more accurate**
-without replacing the two-layer shape (cheap local path, then
-server-owned Gemini). Planning-only in this file. Each numbered
-sub-convoy is its own gated PR stream.
-
-Worktree: `tcg-vault-worktrees/scanner-identify-upgrade` on
-`convoy/scanner-identify-upgrade` (branched from `main` @ `c6c1364`).
-Do **not** land these docs on `feat/scanner-mobile-checkout` — that
-convoy owns scanner chrome/cart and explicitly leaves identify out of
-scope.
-
-## Why
-
-`add-real-ocr-layer` (PR #38) targeted ≥70% of scans resolving at
-Layer-1 (Tesseract + `pg_trgm`) with zero Gemini calls. Live
-`scan_attempts` from the local Neon (2026-05-27 → 2026-08-12, n=224,
-1 user) shows that target was missed by a wide margin:
-
-| Signal | Value | Target / note |
-| --- | --- | --- |
-| L1 auto-match (`result_kind=matched`) | **5.8% of L1** / 2.7% of all | ≥70% L1 resolve |
-| L1 escalate | **76.7% of L1** (79/103) | Should be the minority path |
-| L1 disambiguation | 17.5% of L1 (18/103) | Name-only matcher cannot pick printings |
-| End-to-end auto-match | **10.3%** (23/224) | User still picks or retries most cards |
-| L2 `not_a_card` | **44.6% of L2** (54/121) | Detector fires on non-cards |
-| L2 p50 / p90 latency | **1655 / 2349 ms** | Plus 3.5s hold-still *before* identify |
-| L1 p50 latency | **158 ms** | Fast, but almost never uniquely matches |
-| `card_submissions` | 27 pending, 0 reviewed | Catalog-gap queue is unread |
-
-The six L1 "matches" include noisy Tesseract strips (`J ——`, `Rock
-Jockey ©`) at confidence 36–68. L1 is a cheap filter that rarely
-identifies a printing. Meanwhile every card waits
-`DETECTION_START_DELAY_MS` (1s) + `MIN_FIRST_SEEN_MS_FOR_VERIFY` (2.5s)
-before OCR starts, and L2 is capped at 5 Gemini calls / user / minute.
-
-Users feel this as: hold still forever, then pick from a list, or get
-"not a card" / "saved for review."
-
-## Scope
-
-### In scope (this epic)
-
-1. **`tighten-scan-identify-hot-path`** — Phase 1. Cut the hold-still
-   gate, OCR collector number on L1, structured Gemini JSON, optional
-   `SCAN_VISION_MODEL` bump, stop the automatic second Gemini refine.
-2. **`improve-scan-card-detection`** — Phase 2. Replace the 320×240
-   Sobel brute-force detector with a real card crop + perspective warp.
-   This was queued in `add-real-ocr-layer` and never opened.
-3. **`scan-visual-catalog-search`** — Phase 3. Embed catalog
-   `image_url`s; nearest-neighbor the warped crop. Gemini becomes
-   fallback. This is the accuracy leap.
-
-### Out of scope (this epic)
-
-- Scanner chrome, cart, checkout (`scanner-mobile-checkout` /
-  `scanner-rebuild`). Identify libs only.
-- Training a custom card CNN or standing up a Python/CUDA OCR service.
-- Swapping Tesseract for EasyOCR / PaddleOCR as the *primary* identifier.
-- Raising the L2 rate limit until Phase 1 hit-rate is re-measured.
-- Admin review of the 27 pending `card_submissions` (ops, not this epic).
-
-## Baseline (do not re-query to "start" Phase 1)
-
-Pulled 2026-08-14 from local `.env.local` → Neon `scan_attempts`.
-
-```
-layer | result_kind    | n  | pct
-    1 | escalate       | 79 | 35.3
-    1 | disambiguation | 18 |  8.0
-    1 | matched        |  6 |  2.7
-    2 | not_a_card     | 54 | 24.1
-    2 | submitted      | 26 | 11.6
-    2 | disambiguation | 22 |  9.8
-    2 | matched        | 17 |  7.6
-    2 | needs_input    |  2 |  0.9
-```
-
-L1 escalate text-length buckets (all had ≥3 chars — Tesseract is
-emitting text that `pg_trgm` cannot match): 3–7 chars n=28; 8–19 n=30;
-20+ n=21.
-
-Re-measure with the same grouping after each sub-convoy ships.
-
-## Dependency graph
-
-```
-  [baseline pulled 2026-08-14]
-              │
-              ▼
-  ┌───────────────────────────────────┐
-  │ 1. tighten-scan-identify-hot-path │
-  │    gates, collector #, schema JSON│
-  └───────────────┬───────────────────┘
-                  │
-                  ▼
-  ┌───────────────────────────────────┐
-  │ 2. improve-scan-card-detection    │
-  │    detect + homography crop       │
-  └───────────────┬───────────────────┘
-                  │
-                  ▼
-  ┌───────────────────────────────────┐
-  │ 3. scan-visual-catalog-search     │
-  │    embeddings + pgvector kNN      │
-  └───────────────────────────────────┘
-```
-
-**Strict-blockers:** #1 before #2 only if #2 would retune the same
-stability constants — otherwise #1 (identify files) and #2 (detection
-files) are file-disjoint and may run in parallel after Architect
-confirms. #3 needs a stable crop (#2) to be worth the embedding job;
-do not start #3 until #2 has a warped JPEG.
-
-**Sibling:** `scanner-mobile-checkout` (other worktree / branch) must
-not edit `lib/ocr-worker.js`, `lib/scan-vision.js`,
-`lib/card-text-match.js`, `lib/scanner-card-identify.js`,
-`lib/scanner-card-detection.js`, or `/api/scan/identify`.
-
-## Roles invoked
-
-Umbrella is planning-only. Each sub-convoy lists its own roles.
-Default for #1: Architect → Implementer → audit fan-out (reviewer +
-security-auditor). UX reviewer on #1 and #2. Skip IA and UI Designer
-on all three (no new routes or visual language).
-
-## Todos
-
-- [x] Pull `scan_attempts` baseline (2026-08-14)
-- [x] Open worktree `scanner-identify-upgrade` from `main`
-- [x] Seed sub-convoys #1–#3
-- [x] Architect: pick up `tighten-scan-identify-hot-path` first
-- [x] Re-measure `scan_attempts` after all phases ship (2026-08-15 — see below)
-- [x] Architect: `improve-scan-card-detection`
-- [x] Architect: `scan-visual-catalog-search` after warped crops exist
-- [ ] Operator: finish embedding backfill (`npm run backfill-embeddings`) — **14.9%** done (9,865 / 66,211)
-- [ ] Re-measure after backfill + L0 traffic (`layer = 0` rows)
-
-## Post-ship telemetry (2026-08-15)
-
-Pulled from Neon `scan_attempts` + `cards.embedding` coverage. Single user
-(`user_id = 3`); treat post-ship windows as directional, not statistically
-significant.
-
-### All-time (n=250, 2026-05-27 → 2026-08-15)
-
-| Signal | Value | Baseline (2026-08-14) | Target |
-| --- | --- | --- | --- |
-| L1 auto-match | **5.4%** of L1 (6/111) | 5.8% | ≥25% |
-| L1 escalate | **78.4%** of L1 (87/111) | 76.7% | ≤40% |
-| L2 `not_a_card` | **43.9%** of L2 (61/139) | 44.6% | ≤15% |
-| End-to-end auto-match | **13.2%** excl. not_a_card (25/189) | 13.5% | ≥50% |
-| L1 p50 latency | **158 ms** | 158 ms | — |
-| L2 p50 / p90 | **1642 / 2297 ms** | 1655 / 2349 ms | ≤1800 p50 |
-| L0 attempts | **0** | — | (Phase 3 code live; index sparse) |
-| `card_submissions` pending | **31** | 27 | ops |
-
-### Aug 15 post-deploy session (n=26)
-
-First scan burst after #156–#158 merged (~06:23–07:43 UTC). No L0 rows yet
-(#160 landed same evening; backfill incomplete).
-
-| Signal | Aug 15 (n=26) | Baseline |
-| --- | --- | --- |
-| L1 auto-match | **0%** (0/8 L1) | 5.8% |
-| L1 escalate | **100%** (8/8 L1) | 76.7% |
-| L2 `not_a_card` | **38.9%** (7/18 L2) | 44.6% |
-| End-to-end auto-match | **10.5%** excl. not_a_card (2/19) | 13.5% |
-
-**Qualitative notes:** L1 OCR strips post-warp are *shorter* garbage (`"7"`,
-`"Tey"`, `"yr'"`) — collector-number path cannot help. L2 structured JSON
-(`isCard: false`) works. Two L2 auto-matches (Hunger Hawk, Hog-Monkey).
-Disambiguation still common (Seel printings).
-
-### Phase verdict
-
-| Phase | PR | Code | Success metrics |
-| --- | --- | --- | --- |
-| 1 `tighten-scan-identify-hot-path` | #156 | **Shipped** | ❌ L1 match/escalate targets missed |
-| 2 `improve-scan-card-detection` | #158 | **Shipped** | ❌ not_a_card still ~44%; slight Aug 15 improvement |
-| 3 `scan-visual-catalog-search` | #160, #162 | **Shipped** | ⏳ Awaiting backfill + L0 traffic |
-
-**Recommendation:** Finish catalog embedding backfill, scan 50+ cards on
-preview, then re-query `layer = 0` distribution before tuning thresholds.
-
-### Embedding backfill status (2026-08-15)
-
-| Metric | Value |
-| --- | --- |
-| Cards with `image_url` | 66,211 |
-| Rows with `embedding` | 9,865 (**14.9%**) |
-| pgvector on Neon | ✅ v0.8.0 |
-| Operator command | `npm run backfill-embeddings` |
-
-## Worktree
-
-| Checkout | Branch | Purpose |
-| --- | --- | --- |
-| `tcg-vault-worktrees/scanner-identify-upgrade` | `convoy/scanner-identify-upgrade` | These convoy docs |
-| (later) Agents Window worktree per brief | `brief/scanner-identify-upgrade/<n>-<title>` | Implementer slices |
-
-`scripts/wt.sh` is a deprecation stub. Create implementer worktrees from
-the Agents Window after Architect writes `slice_dependencies:`.
-
-## Multitask dispatch
-
-No implementer fan-out from this umbrella. After #1 Architect marks
-parallel-safe briefs (`depends_on: []` + disjoint `files:`):
-
-```
-/multitask role-implementer briefs <ids>
-```
-
-After each PR draft:
-
-```
-/multitask role-reviewer + role-security-auditor
-```
-
-Add design-system + a11y auditors only if the PR touches
-`components/` or `pages/scanner.js` (not expected in #1).
-
-Group ids: `audit-tighten-scan-identify-hot-path-<pr>`,
-`audit-improve-scan-card-detection-<pr>`,
-`audit-scan-visual-catalog-search-<pr>`.

.convoys/scanner-mobile-checkout.md

@@ -1,644 +0,0 @@
----
-name: scanner-mobile-checkout
-classification: feature
-success_metric: |
-  On a phone, opening /scanner goes straight into a full-bleed camera;
-  each successful identify lands in a local cart (not the database);
-  the user can open a checkout sheet, select cards, and commit them
-  to My Collection or a List without leaving the session.
-skip: []
-status: shipped
-created: 2026-08-14
-depends_on:
-  - scanner-rebuild
-  - redesign-scanner-flow
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
-    role-design-system-auditor: cursor-grok-4.5-high
-    role-a11y-auditor: cursor-grok-4.5-high
-    role-doc-writer: auto
-  escalate_to: claude-sonnet-5-thinking-medium
-  escalate_to_premium: claude-4.6-opus-high-thinking
-  never_premium:
-    - role-reviewer
-    - role-security-auditor
-    - role-design-system-auditor
-    - role-a11y-auditor
-    - role-ui-designer
-    - role-doc-writer
-design_direction:
-  source: role-ui-designer
-  skill: ui-ux-pro-max
-  skill_version: "2.5.0"
-  version: 1
-  locked_at: 2026-08-14
-  product_type: mobile camera scanner checkout cart trading cards glassmorphism
-  pattern: Immersive camera overlay + bottom-sheet checkout
-  style: Liquid Glass (repo canonical)
-  stack: nextjs
-  layout_reference: image-93781104-69e3-4f0b-b25f-df7c750ef046.png
----
-
-# Convoy: scanner-mobile-checkout
-
-Turn the scanner into a mobile checkout: scan everything first, then
-commit the cart. Layout reference is the last attached mock (full-bleed
-camera, glass overlays, review as a bottom sheet).
-
-## Why
-
-The overnight `scanner-rebuild` got us a three-phase machine (Setup →
-Scanning → Review), but the phone experience is still chrome-heavy:
-Layout's sidebar, top search bar, and bottom nav compete with the
-viewfinder; a destination form blocks the camera; and `handleCardScanned`
-writes each match to the database immediately (rebuild D3). That fights
-the actual table-scan job — hold the phone, sweep cards, then check out
-once.
-
-Users want supermarket-checkout semantics: open scanner → scan all the
-things → open the cart → add selected cards to My Collection or a List
-→ leave. No per-card "Add" tap. No setup screen in the way.
-
-## Scope
-
-### In scope
-
-- **Immersive scan chrome (mobile).** Hide Layout sidebar, TopSearchBar,
-  and MobileNavigation while the camera is live. Camera is full-bleed.
-  Overlay only: back, title, optional gallery, detection brackets +
-  status around the tracked card, bottom glass bar (flash, scan status,
-  Review N).
-- **Cart, not auto-route.** Successful identifies enqueue locally.
-  Nothing POSTs to `user_cards` / collections / decks until checkout.
-  Reverse rebuild D3 for this flow.
-- **Scan peek.** After a match, a compact non-interactive preview slides
-  up briefly (name + thumbnail + confidence) and auto-dismisses. Tapping
-  it opens the cart. No condition / foil / Add buttons on the peek.
-- **Checkout sheet.** Bottom sheet over the still-live (but paused)
-  camera. List of cart items with selection, qty, confidence, overflow
-  menu (remove / condition / foil). Primary: add selected to My
-  Collection. Secondary: add selected to a List (picker). Copy from
-  `lib/collection-vocabulary.js` — never "binder" as a button label
-  (mock says "Save to binder"; product vocab is List).
-- **Camera swap.** Front / rear toggle in the bottom bar. Flash stays
-  rear-only and hides when `torch` is unsupported (iOS Safari).
-- **Desktop.** Same cart semantics. At `md+`, cart can be a persistent
-  side panel instead of a sheet; do not hide the desktop sidebar.
-
-### Out of scope
-
-- Identify / OCR / Gemini pipeline (`lib/scanner-card-identify.js`,
-  `pages/api/scan/identify.js`, OpenCV detection). Layer UI on the
-  existing hooks.
-- Schema / new tables. Cart is client-side session state.
-- Deck Mode, game pre-filter, scan-history list on the setup screen
-  (rebuild Setup). Revisit as a later convoy if needed.
-- Estimated total value row from the mock, unless identify payloads
-  already include `market_price` with no extra fetch.
-- Deleting leftover `components/CameraScanner.js` /
-  `ScannerPageView.js` (pre-rebuild). Separate cleanup.
-- Changing desktop visual-diff homepage baseline except as a
-  side-effect of Layout's new immersive prop.
-
-## Roles invoked
-
-1. `role-ia-architect` — scan → peek → cart → commit flow; where
-   destination choice lives now that Setup is gone.
-2. `role-ui-designer` — lock the mobile overlay + checkout sheet against
-   the last mock, using Liquid Glass tokens (ui-ux-pro-max is installed).
-3. `role-ux-reviewer` — cart selection, low-confidence handling, back
-   with unsaved cart, pause-vs-kill camera under the sheet.
-4. `role-architect` — briefs. Likely: (1) Layout immersive + camera
-   chrome, (2) stop auto-route + cart model, (3) checkout sheet +
-   destinations. `slice_dependencies` must mark what can run in parallel.
-5. `role-implementer` — per brief.
-6. Audit fan-out: reviewer + security-auditor + design-system-auditor +
-   a11y-auditor.
-
-## Todos
-
-- [x] IA: route/flow/screen inventory for immersive scan + checkout sheet
-- [x] UI Designer: lock overlay recipe (tokens, not hex) from last mock
-- [x] UX: cart selection, low-confidence, back-guard, camera pause
-- [x] Architect: briefs + whether Layout gets `chrome="immersive"`
-- [ ] Stop auto-route in `use-scanner-queue.js`; scans stay `processed: false` until checkout
-- [ ] Full-bleed camera; hide app chrome on small viewports
-- [ ] Bottom bar: flash, status, Review N; add facingMode swap
-- [ ] Non-interactive scan peek; checkout sheet with bulk + per-card commit
-- [ ] Pause identification while the sheet is open (`verificationPausedRef`)
-- [ ] Tests for cart enqueue (no network) and checkout commit paths
-- [ ] Visual-diff: scanner surfaces + Layout immersive; refresh baselines if chrome changes
-
-## Predecessor
-
-`scanner-rebuild` (2026-06-13, overnight) shipped the phase machine,
-flash hook, toasts, count pill, and review list. This convoy keeps those
-hooks and **replaces the UX contract**: skip Setup, immersive camera,
-cart-then-commit instead of auto-route.
-
-## Conductor notes (build shape)
-
-Likely file ownership for Architect to refine:
-
-| Area | Files |
-| --- | --- |
-| Immersive shell | `pages/scanner.js`, `components/Layout.js`, `components/MobileNavigation.js` |
-| Camera chrome | `components/scanner/ScannerCamera.js`, `lib/use-camera-scanner.js`, `lib/use-scanner-flash.js` |
-| Cart model | `lib/use-scanner-queue.js`, `lib/scanner-session.js` |
-| Peek + sheet | new `ScannerScanPeek.js`, rewrite `ScannerReview.js` as a sheet; reuse `ScannerDisambiguation.js` |
-| Copy | `lib/collection-vocabulary.js` (`ADD_TO_MY_COLLECTION`, `ADD_TO_LIST`) |
-
-Do not rewrite identification. `handleCardScanned` should enqueue only.
-
-## Multitask dispatch
-
-Planning is serial: IA → UI Designer → UX → Architect.
-
-After architect: implementer fan-out only if briefs have `depends_on: []`
-and disjoint `files:`. Cart-model (stop auto-route) likely blocks the
-checkout sheet; immersive Layout may be parallel with cart-model if
-they do not both own `pages/scanner.js`.
-
-After PR draft: `/multitask` audit fan-out
-`role-reviewer + role-security-auditor + role-design-system-auditor + role-a11y-auditor`
-(group id: `audit-scanner-mobile-checkout-<pr>`).
-
-## IA
-
-### Affected routes
-
-- `[modified]` `/scanner` — sole scanner surface. Entry skips Setup and lands on full-bleed camera; cart and checkout live as in-page overlays/sheets on this route (no new URLs). Phase machine collapses from setup → scanning → review into scanning-first with optional cart sheet open/closed.
-- `[impacted]` `/login` — unauthenticated `/scanner` visits still redirect here (unchanged gate in `pages/scanner.js`). Post-login return target is TBD (see open questions).
-- `[impacted]` `/dashboard`, Layout sidebar, command palette — entry links to `/scanner` unchanged; users now arrive directly in camera instead of Setup.
-- `[impacted]` `/my-cards`, `/collections` — not part of the scan flow, but natural post-checkout destinations if the user navigates away after commit. No route or nav changes required.
-
-No `[new]` routes. Destination choice (My Collection vs List) moves from pre-scan Setup into the checkout sheet on `/scanner` only — **no route changes**.
-
-### User flow
-
-```mermaid
-flowchart LR
-  A["Open /scanner"] --> B["Live camera"]
-  B --> C["Card identified"]
-  C --> D["Scan peek"]
-  D --> B
-  B --> E["Review N"]
-  E --> F["Checkout sheet"]
-  F --> G["Add to My Collection / List"]
-  G --> H["Exit scanner"]
-```
-
-### Screen inventory
-
-| Screen | Path | New/modified | Notes |
-| --- | --- | --- | --- |
-| Scanner — live camera | `/scanner` | modified | Default view on open (mobile: immersive, no Layout chrome). Bottom glass bar: flash, status, camera swap, Review N. Detection brackets + status around tracked card. |
-| Scan peek | `/scanner` (overlay) | new | Brief non-interactive slide-up after identify (name, thumbnail, confidence). Auto-dismiss; tap opens checkout sheet. No per-card Add / condition / foil on peek. |
-| Checkout cart sheet | `/scanner` (overlay) | modified | Replaces full-page `ScannerReview` as primary cart UI on mobile. Camera stays mounted but paused under sheet. Selection, qty, confidence, overflow (remove / condition / foil). Primary: Add to My Collection; secondary: Add to List (picker). |
-| Disambiguation sheet | `/scanner` (overlay) | impacted | Existing `ScannerDisambiguation` stays in overlay stack above camera; blocks identify until resolved, then card enqueues to cart. |
-| Scanner Setup | `/scanner` (phase) | impacted | Removed from default entry path (out of scope to delete component). Game filter, deck mode, pre-scan destination, and scan history no longer gate camera start. |
-| Auth loading | `/scanner` | impacted | Spinner while `useAuth` resolves; immersive chrome applies once authenticated (see open question on loading shell). |
-
-Desktop (`md+`): same `/scanner` route; cart may render as persistent side panel instead of sheet; Layout sidebar remains visible.
-
-### Content / data model deltas
-
-- **Copy (write / wire):** checkout CTAs from `lib/collection-vocabulary.js` — `ADD_TO_MY_COLLECTION`, `ADD_TO_LIST` / `ADD_TO_LISTS`; bottom-bar "Review N" (N = cart count); flash and camera-swap `aria-label`s; empty-cart and commit-success toasts. Never use "binder" or "Save to binder" as a button label.
-- **Copy (retire from entry path):** Setup destination picker, game pre-filter, deck-mode selector, and scan-history list as pre-scan gate copy (component may remain for later convoy).
-- **Client session state:** cart is in-memory queue on `/scanner` — cards stay `processed: false` until checkout commit. Reverses rebuild D3 auto-route; no persistence across refresh or navigation away.
-- **API calls (commit-time only, unchanged endpoints):** `POST /api/user-cards` (My Collection), `POST /api/collections/:id/cards` (List), existing `GET /api/collections` + `GET /api/decks` for destination lists. Optional `GET` batch-ownership during cart review. No schema / table changes.
-- **Immersive Layout:** new chrome mode (likely `chrome="immersive"` on `Layout`) affects how `/scanner` composes global nav — content delta only on this page, not a new route.
-
-### Open IA questions
-
-1. **Post-checkout exit:** Product intent says "then exit" — does the user return to the prior page (`router.back()`), land on `/my-cards` or `/collections`, or stay on `/scanner` with an empty cart and live camera?
-2. **Post-login deep link:** If an unauthenticated user hits `/scanner`, should login return them to `/scanner` (camera) or a safer default (`/dashboard`)?
-3. **Desktop Setup:** Is Setup skipped on `md+` as well, or only on mobile viewports?
-4. **Deck destination:** Deck mode and add-to-deck are out of scope — confirm deck is fully absent from checkout destinations (not just hidden behind Setup).
-5. **Gallery import:** Convoy mentions "optional gallery" in the top overlay — is this in-scope as a file-picker overlay on `/scanner`, or deferred?
-6. **Partial commit:** After adding a subset to My Collection / a List, does the user remain in the sheet with remaining items, or does any successful commit close the session?
-
-## Decisions (post-IA)
-
-Locked 2026-08-14 from product intent (parent session). UX / UI / Architect treat these as settled.
-
-| # | Decision |
-| --- | --- |
-| D1 | **Stay on camera after commit.** Successful checkout removes committed rows from the cart. If the cart is empty, close the sheet and resume scanning. Back (header) is the only exit from `/scanner`. |
-| D2 | **Login returns to `/scanner`.** Keep the existing auth gate; after login, send the user back to the camera, not `/dashboard`. |
-| D3 | **Skip Setup on all viewports.** Desktop uses the same scanning-first entry; cart is a side panel at `md+`, not a return of the Setup form. |
-| D4 | **No deck destination in checkout.** My Collection and List only. Deck Mode stays out of this convoy. |
-| D5 | **Gallery is in-scope.** Top-right control opens a file picker; chosen image goes through the existing identify path and lands in the cart like a live scan. |
-| D6 | **Partial commit stays in the sheet.** Uncommitted rows remain. Sheet closes only when the cart is empty or the user dismisses it. |
-| D7 | **Persist cart in `sessionStorage`.** Survive refresh within the tab; do not persist across browser sessions. |
-
-## Design direction
-
-Locked v1 — 2026-08-14. Layout authority: last mock
-(`image-93781104-69e3-4f0b-b25f-df7c750ef046.png`). Generator query:
-*"mobile camera scanner checkout cart trading cards glassmorphism"*.
-
-### Summary
-
-Deck Hearth's mobile scanner should feel like a **supermarket checkout lane
-over a live viewfinder**: full-bleed camera, ember-bracketed detection,
-glass overlays that float above card art, a brief non-interactive peek after
-each match, and a bottom-sheet cart for bulk commit. Warm ember/flame accents
-cast light onto glass — never fill entire panels with brand orange.
-
-### Pattern + style
-
-| Field | Value |
-| --- | --- |
-| Product type | Mobile TCG collection scanner with session cart + checkout |
-| App pattern | **Immersive camera overlay + bottom-sheet checkout** (generator's "Bento Grid Showcase" rejected — marketing grid, not camera UX) |
-| UI style | **Liquid Glass** — repo canonical (`docs/DESIGN_TOKENS.md`). Generator's "Exaggerated Minimalism" / oversized typography rejected. |
-| Stack notes | Next.js Pages router, React 18, Tailwind + CSS variables. Next.js stack query returned 0 rows — follow existing scanner components + `components/ui/` primitives. |
-| Desktop (`md+`) | Same cart semantics; cart as persistent side panel; Layout sidebar stays visible. Immersive chrome is mobile-only. |
-
-### Screen 1 — Live camera (mobile default)
-
-Full-bleed `<video>` under all chrome. Layout sidebar, TopSearchBar, and
-MobileNavigation hidden via `chrome="immersive"` on `/scanner`.
-
-| Zone | Composition | Tokens / notes |
-| --- | --- | --- |
-| **Top bar** | Back (←), title "Scan Cards", gallery (file picker, D5) | `--glass-surface-mid` + `blur(--glass-blur-mid)` + rim stack. Safe-area inset top. 44×44 tap targets. |
-| **Viewfinder brackets** | Four L-shaped corner brackets framing tracked card | Stroke `--accent-flame` / `--accent-ember`; no filled box. Animated scan line: horizontal ember gradient sweep (`--gradient-primary-*`), respect `prefers-reduced-motion`. |
-| **Scan status** | Centered label below brackets ("Scanning… Hold steady") | `--text-primary` on semi-opaque pill or direct over darkened letterbox — ensure 4.5:1. |
-| **Success toast** | Glass pill: check + "{Card name} added" + dismiss × | `--glass-surface-high` + rim; green check via success token (not emoji). Auto-dismiss ~2s. `role="status"`. |
-| **Scan peek** | Compact slide-up after identify (name, thumb, confidence ring) | `--glass-surface-mid`; **non-interactive** except tap-to-open-sheet. No Add / condition / foil controls. Auto-dismiss ~3s. |
-| **Bottom bar** | Three zones: Flash \| status \| **Review N** pill | Bar: `--glass-surface-mid` + blur mid + `--elevation-ambient`. Flash + camera-swap icons (rear-only torch; hide flash when unsupported). **Review N**: gradient pill `background: var(--gradient-primary-*)` + `--ember-rim-pronounced`; label `Review {N}` with chevron. Min 44px height. |
-
-Camera overlays **may** use `backdrop-filter` (exception to per-card grid
-rule — overlays sit above the viewfinder, not on grid items).
-
-### Screen 2 — Checkout sheet (mobile)
-
-Bottom sheet over **paused** (not unmounted) camera. Scrim + sheet follow
-Modal primitive recipes.
-
-| Zone | Composition | Tokens / notes |
-| --- | --- | --- |
-| **Scrim** | Dim live camera | `--modal-scrim` + `blur(--glass-blur-high)` |
-| **Sheet panel** | Rounded top (~16px), grab handle, scrollable list, sticky footer | Panel: `--glass-surface-low` inside scrim + blur mid + `--elevation-pronounced`. Handle: 36×4px `--border` pill, centered. |
-| **Header** | "{N} cards scanned" + low-confidence subline (orange dot) + Edit | Subline only when any row &lt; threshold. Edit toggles bulk-select mode (UX brief). |
-| **Cart rows** | Checkbox, thumb, name/set/rarity, confidence ring, qty stepper (− N +), overflow ⋮ | Row surface: `--glass-surface-high` or solid `--bg-secondary` inner panel over sheet (legibility over busy thumbs). Confidence ring: green ≥85%, amber 70–84%, orange &lt;70% using `--accent-ember` / success tokens — not hardcoded hex. |
-| **Row overflow** | Remove, condition, foil | Popover: `--glass-surface-high` recipe. |
-| **Footer CTAs** | Primary gradient + secondary text button | Primary: `VOCAB.ADD_TO_MY_COLLECTION` — full-width gradient button (`var(--gradient-primary-*)`, `--ember-rim-pronounced`). Secondary: `VOCAB.ADD_TO_LIST` — ghost / link style with list icon; opens picker. **Never** "Save to binder" / "Add all to collection" without vocab import. |
-| **Out of scope row** | "Total value (est.)" from mock | Omit unless identify payload already includes `market_price` (convoy scope). |
-
-Partial commit (D6): committed rows leave the list; sheet stays open until
-cart empty or user dismisses. Empty cart → close sheet, resume scanning (D1).
-
-### Colors
-
-**Repo tokens win.** Generator palette (slate `#1E293B`, scan-blue `#2563EB`)
-is **not adopted**.
-
-| Role | Token | Usage in this flow |
-| --- | --- | --- |
-| Primary accent | `--accent-ember` | Brackets, focus rings, low-confidence warnings, primary CTA gradient stop |
-| Secondary accent | `--accent-flame` | Scan line, gradient stops, Review N pill |
-| Gold (rare) | `--accent-gold` | Rarity badges only |
-| Glass fills | `--glass-surface-{low,mid,high}` | Sheet panel / top+bottom bars / toast / peek |
-| Blur | `--glass-blur-{low,mid,high}`, `--glass-saturate` | All glass overlays |
-| Rims | `--rim-light-{inner,outer}`, `--ember-rim-{subtle,pronounced}` | Interactive pills and primary buttons get pronounced ember rim |
-| Scrim | `--modal-scrim` | Sheet backdrop |
-| Text | `--text-primary`, `--text-secondary` | All copy on glass |
-| Background | `--bg-primary`, `--bg-secondary` | Row inner panels when glass-over-art fails contrast |
-
-No hex in `.js` files. Use `var(--token)` or existing utility classes
-(`.glass-panel`, gradient vars in `globals.css`).
-
-### Typography
-
-| Role | Font | Notes |
-| --- | --- | --- |
-| Display / title | System / Inter (existing) | Top bar "Scan Cards" — `font-semibold`, ~17px. No generator "clamp(3rem…)" oversized type. |
-| Body | System / Inter | Row names `font-medium`; set/rarity `text-sm` `--text-secondary` |
-| CTA | System / Inter | Primary button `font-semibold`; secondary `font-medium` |
-
-### Effects + motion
-
-| Effect | Spec |
-| --- | --- |
-| Transitions | 150–300ms ease on toast, peek slide, sheet open/close |
-| Scan line | Looping horizontal sweep over brackets; disable loop when `prefers-reduced-motion: reduce` |
-| Sheet | Slide up from bottom; scrim fade in. Focus trap while open. |
-| Hover / focus | Primary controls: `--ember-rim-pronounced` on focus-visible; `cursor-pointer` on all clickables |
-| Bracket pulse | Subtle ember glow on active track — `--ember-rim-subtle`, not full-panel fill |
-
-See `docs/MOTION_SYSTEM.md` for shared motion taxonomy when implementing.
-
-### Copy (mandatory)
-
-Import from `lib/collection-vocabulary.js`:
-
-| UI surface | Constant |
-| --- | --- |
-| Primary checkout | `VOCAB.ADD_TO_MY_COLLECTION` |
-| Secondary checkout | `VOCAB.ADD_TO_LIST` |
-| Bottom bar | `Review {N}` (N = cart count) |
-| Toast | `{Card name} added` (success) |
-
-Retired: "Save to binder", "Mark Owned", "Add all to collection" (use vocab
-or "Add selected to My Collection" when subset selected).
-
-### Anti-patterns (do not ship)
-
-- Generator's light slate background + blue CTA palette on scanner chrome
-- Opaque drawer replacing bottom sheet (see deprecated mock
-  `image-be4e787b-…` — too many actions on peek)
-- Per-card Add / condition / foil on scan peek
-- `backdrop-filter` on cart **thumbnail grid items** (card grid perf budget)
-- Hardcoded hex in JSX; `--accent-blue` / `--accent-purple` legacy aliases
-- Emoji icons (toast check must be SVG or existing glyph pattern)
-- Filling overlay panels with solid ember orange (brand is rim/glow/gradient only)
-- Desktop dual-theme mock layout (`image-6654f196-…`) as mobile reference
-
-### Pre-delivery checklist
-
-- [ ] No emojis as icons (SVG: Lucide / Heroicons)
-- [ ] `cursor-pointer` on clickable elements
-- [ ] Hover/focus transitions 150–300ms
-- [ ] Text contrast ≥ 4.5:1 on all glass copy (use inner opaque panel if over card art)
-- [ ] Keyboard focus visible (`--accent-ember` ring)
-- [ ] `prefers-reduced-motion` respected (scan line, peek, sheet)
-- [ ] Responsive: 375 (immersive mobile), 768, 1024 (side panel), 1440
-- [ ] Flash hidden when `torch` unsupported; camera-swap `aria-label`s
-- [ ] Checkout copy from `collection-vocabulary.js` only
-
-### Token overrides vs generator
-
-| Generator output | Locked override |
-| --- | --- |
-| Pattern: Bento Grid Showcase | Immersive camera + bottom-sheet checkout |
-| Style: Exaggerated Minimalism | Liquid Glass (shipped) |
-| Primary `#1E293B`, accent `#2563EB` | `--accent-ember`, `--accent-flame`, `--gradient-primary-*` |
-| Background `#F8FAFC` | Full-bleed camera; glass overlays use `--glass-surface-*` |
-| Typography: massive display type | Existing body scale; scanner chrome stays compact |
-| Key effects: 10vw headings | Scan-line animation + sheet slide only |
-
-### Conflict rule
-
-**Repo design tokens win** when they disagree with generator output. This
-lock intentionally overrides ui-ux-pro-max palette/pattern for every
-scanner surface. File a convoy note + bump `design_direction.version` only
-if product approves a token change.
-
-## UX
-
-### Existing components to reuse
-
-- `<GlassSurface>` (`components/ui/GlassSurface.js`) — top bar, bottom bar, scan peek, checkout sheet panel, row inner panels. Use `tint="mid"` for chrome bars, `tint="low"` for sheet body, `rim="ember-pronounced"` on Review N pill and primary CTA.
-- `<Modal>` (`components/ui/Modal.js`) — back-guard confirm ("Leave scanner?"), List picker (`size="md"`), nested above checkout sheet z-index stack. Do **not** roll a custom scrim for these dialogs.
-- `<Button>` (`components/ui/Button.js`) — footer primary (`variant="primary"`, `loading` during commit) and secondary (`variant="ghost"`) CTAs; back-guard actions.
-- `<Input>` (`components/ui/Input.js`) — optional filter field inside List picker when `collections.length > 8`.
-- `<ScannerDisambiguation>` (`components/scanner/ScannerDisambiguation.js`) — **canonical bottom-sheet shell** for checkout cart on mobile: same `fixed inset-0` scrim, `glass-panel-strong` panel, drag handle, `useFocusTrap`, Escape-to-dismiss. Checkout sheet copies this shell; do not invent a second sheet primitive.
-- `<ScannerToast>` (`components/scanner/ScannerToast.js`) — success feedback after identify (`role="status"`, `aria-live="polite"`). Replace emoji glyphs with SVG check per design-direction checklist; message shape: `{Card name} added`.
-- `<ScannerCountPill>` (`components/scanner/ScannerCountPill.js`) — evolve into bottom-bar **Review N** gradient pill (same `onReview` contract, `aria-label={`Review ${count} scanned cards`}`); retire the separate count row above the viewport.
-- `<ReviewCardItem>` (`components/scanner/ReviewCardItem.js`) — cart row body: thumbnail, name/set, qty stepper, condition/foil overflow. Extend with leading checkbox + confidence ring; drop inline destination picker (destinations move to footer CTAs only).
-- `<ScannerCamera>` (`components/scanner/ScannerCamera.js`) — viewfinder, bracket overlays, flash hook wiring, disambiguation mount point. Refactor chrome into top/bottom glass bars; keep `verificationPausedRef` plumbing.
-- `<Layout>` (`components/Layout.js`) — `chrome="immersive"` on `/scanner` for `<md` only; desktop keeps sidebar.
-- `useFocusTrap` / `useFocusTrapContainer` (`lib/use-focus-trap.js`) — every overlay sheet and confirm dialog; restore focus to Review N pill or back button on close.
-
-**8 primitives** (+ 2 hooks, 1 page shell). New file `ScannerScanPeek.js` is the only net-new overlay component; it composes `<GlassSurface>` only.
-
-### Design direction alignment
-
-Locked `design_direction` maps directly to repo tokens — no conflicts deferred:
-
-| Design-direction surface | Token / primitive |
-| --- | --- |
-| Top + bottom chrome bars | `--glass-surface-mid`, `--glass-blur-mid`, `--rim-light-*`, safe-area insets |
-| Ember brackets + scan line | `--accent-flame`, `--accent-ember`, `--gradient-primary-*`; scan-line loop disabled under `prefers-reduced-motion` |
-| Review N pill | `var(--gradient-primary-*)` + `--ember-rim-pronounced` on `<Button>` or styled `<GlassSurface as="button">` |
-| Checkout sheet scrim | `--modal-scrim` + `blur(--glass-blur-high)` — same recipe as `<Modal>` backdrop |
-| Confidence rings | green ≥85%, amber 70–84%, orange &lt;70% via `--color-success` / `--accent-ember` tokens (not hex literals) |
-| Footer CTAs | `VOCAB.ADD_TO_MY_COLLECTION`, `VOCAB.ADD_TO_LIST` from `lib/collection-vocabulary.js` |
-| Peek + toast | `--glass-surface-mid` / `--glass-surface-high`; SVG icons only |
-
-**UX override of design-direction "Edit toggles bulk-select mode":** reject Edit mode. Checkboxes are **always visible** with all rows selected by default — supermarket checkout does not hide selection behind a mode switch (Nielsen H6).
-
-### Existing patterns to follow
-
-- **Bottom-sheet overlay stack** — `ScannerDisambiguation.js` (scrim click dismisses only when safe; focus trap; `aria-labelledby`). Checkout sheet sits at `z-40`; disambiguation stays at `z-50` above it.
-- **Cart row editing** — `ReviewCardItem.js` qty stepper + condition select pattern; overflow ⋮ menu mirrors row remove button placement.
-- **Bulk selection semantics** — `useScannerQueue` `selectedCards` Set + `toggleCardSelection` / `handleBulkAction`; do not fork a parallel selection model.
-- **Pause identification** — `CameraScanner.js` + `pages/scanner.js` `verificationPausedRef` pattern: `useCameraScanner` early-returns when `verificationPausedRef.current === true`; `useScannerIdentification` already sets it during disambiguation — extend to checkout sheet + List picker open.
-- **Flash gating** — `useScannerFlash.js` `flashSupported` probe; conditionally render flash button (already in `ScannerCamera.js` L221–242). Flash is **rear camera only** — hide when `facingMode === 'user'`.
-- **Immersive page shell** — follow `components/ProtectedRoute.js` / `pages/scanner.js` auth gate; post-login return to `/scanner` (D2) via `router.query.returnUrl` or equivalent login redirect — do not invent a new auth wrapper.
-- **List display names** — `collectionDisplayName()` for picker rows; never render `'All My Cards'` literal.
-- **Motion** — `docs/MOTION_SYSTEM.md` duration tokens: peek/toast `quick` (150ms), sheet `slow` (400ms); sitewide `prefers-reduced-motion` collapse applies.
-- **Rules** — `.cursor/rules/ui-and-theming.mdc` (Modal primitive mandate, 44px targets, focus rings via `--accent-ember`).
-
-### A11y constraints
-
-Hand to `role-a11y-auditor`:
-
-1. **WCAG 2.5.5 Target Size (AAA goal):** every tappable chrome control (back, gallery, flash, camera swap, Review N, peek tap target, row checkbox, qty ±, overflow ⋮, footer CTAs) ≥ 44×44 CSS px — use invisible padding if icon is smaller.
-2. **WCAG 1.4.3 Contrast (AA):** all text on glass ≥ 4.5:1; if card-art bleeds through a row thumb, use `--bg-secondary` inner panel behind text (design-direction row spec).
-3. **WCAG 2.4.3 Focus Order:** checkout sheet opens → focus moves to sheet panel (first focusable: header close/dismiss or first row checkbox via `useFocusTrap`); on close → restore to Review N pill.
-4. **WCAG 2.1.1 Keyboard:** sheet dismiss via Escape; peek opens sheet on Enter/Space when focused; back button triggers confirm modal before navigation.
-5. **WCAG 4.1.2 Name, Role, Value:** checkout sheet `role="dialog"` `aria-modal="true"` `aria-labelledby` → "{N} cards scanned"; List picker nested dialog gets its own label ("Choose a List").
-6. **`aria-label` required:** back → "Leave scanner"; gallery → "Choose image from gallery"; flash → "Turn on flash" / "Turn off flash" + `aria-pressed`; camera swap → "Switch to front camera" / "Switch to rear camera"; Review N → `Review ${N} scanned cards`; row checkbox → `Select ${card.name}`; qty buttons → `Decrease quantity for ${card.name}` / `Increase…`; overflow → `More actions for ${card.name}`.
-7. **WCAG 1.1.1 Non-text Content:** card thumbs `alt={card.name}`; decorative bracket corners `aria-hidden="true"`.
-8. **WCAG 4.1.3 Status Messages:** identify success toast + post-commit success toast use `role="status"` `aria-live="polite"`; do not steal focus.
-9. **WCAG 2.3.3 Animation from Interactions:** scan-line loop, peek slide, sheet slide respect `prefers-reduced-motion: reduce` (instant show/hide, no sweep).
-10. **Focus trap:** checkout sheet, disambiguation sheet, back-guard confirm, List picker — all trap Tab; disambiguation above checkout maintains trap when both mounted.
-11. **Confidence communicated without color alone:** ring color + text label on row (`aria-label` includes "confidence 62 percent") and header subline "{N} need review" when any row &lt; 70%.
-12. **Gallery file input:** visually hidden `<input type="file" accept="image/*">` triggered by labeled button; `aria-label` on button, not bare input.
-13. **Disabled primary CTA:** when zero rows selected, `Add to My Collection` is `disabled` + `aria-disabled="true"` with visible helper "Select at least one card" (linked via `aria-describedby`).
-14. **Screen reader pause announcement:** when sheet opens, `aria-hidden="true"` on camera video element OR `inert` on viewfinder chrome beneath scrim so SR does not read live camera controls under the sheet.
-
-### Interaction patterns
-
-| Pattern | Spec | Nielsen |
-| --- | --- | --- |
-| **Cart selection — default all selected** *(required)* | On first sheet open, `selectedCards` = all unprocessed row IDs. New card enqueued while sheet open → auto-add its ID to selection. Deselecting is per-row checkbox. Primary CTA label stays `VOCAB.ADD_TO_MY_COLLECTION`; when subset selected, append count: "Add to My Collection (3)". No "Edit mode" toggle. | H6 Recognition rather than recall |
-| **Low-confidence vs disambiguation** *(required)* | **Pipeline `disambiguation` outcome → always block** via existing `ScannerDisambiguation` sheet; never enqueue until user picks. **Single-match `emit` outcome → enqueue silently** to cart regardless of confidence; surface confidence visually (ring + header subline for any row &lt;70%). Do not re-prompt at scan time for low-confidence singles — checkout is the verification gate. | H5 Error prevention; H3 User control |
-| **Scan peek** *(required)* | Slide-up 3s auto-dismiss. Container `pointer-events-none`; single child button wrapper `pointer-events-auto` with `aria-label="Open cart to review {card name}"`. No condition/foil/Add on peek. Tap opens checkout sheet. | H4 Consistency; H8 Minimalist design |
-| **Checkout sheet open/close** *(required)* | Open via Review N pill or peek tap. Close via scrim tap, swipe-down on handle (nice-to-have), or header ×. On close with items remaining: resume camera (`verificationPausedRef = false`). Empty cart after commit → auto-close sheet (D1). | H1 Visibility of system status |
-| **Pause identification under sheet** *(required)* | `verificationPausedRef.current = true` when checkout sheet **or** List picker **or** disambiguation is open. Camera stream stays mounted; detection/verify loop does not run. Resume on sheet close. | H1 Visibility of system status |
-| **Back with unsaved cart** *(required)* | Header back with any unprocessed cart rows → `<Modal>` confirm: title "Leave scanner?", body "{N} scanned cards haven't been added yet.", primary "Keep scanning" (dismiss), secondary "Leave" (`router.back()` or `/dashboard`). No confirm when cart empty. | H3 User control and freedom |
-| **Partial commit** *(required)* | Commit removes only selected rows from cart; sheet stays open with remainder (D6). Success toast `role="status"`. Primary button shows loading via `<Button loading>`. | H9 Error recovery; H1 Feedback |
-| **sessionStorage cart persist** *(required)* | Serialize `scannedCards` + `selectedCards` to `sessionStorage` on change (D7); hydrate on `/scanner` mount. Tab refresh preserves cart; new tab starts empty. Clear on explicit "Leave" confirm. | H6 Recognition rather than recall |
-| **Flash + camera swap** *(required)* | Flash button rendered only when `flashSupported && facingMode === 'environment'`. Camera-swap toggles `facingMode`; turning to front auto-disables torch. Swap button always visible when streaming. | H2 Match between system and real world |
-| **Gallery import** *(required)* | Top-right gallery button → hidden file input; selected image runs existing identify path; on success same peek + cart enqueue as live scan. Show spinner on gallery button while identifying (`aria-busy`). | H4 Consistency |
-| **Empty states** *(required)* | Cart sheet with 0 rows: should not open (Review N hidden at N=0). If last item removed in sheet → auto-close + resume camera. | H9 Error recovery |
-| **Loading states** *(required)* | Camera starting: existing spinner + "Starting camera…". Commit in flight: footer CTA `loading`, row checkboxes disabled. List picker: skeleton or spinner while `collections` fetch. | H1 Visibility of system status |
-| **Error states** *(required)* | Commit API failure: inline banner in sheet footer (not alert()), rows stay selected, retry enabled. Identify error: existing toast/notice path; do not enqueue. | H9 Error recovery |
-| **Desktop side panel** *(required)* | `md+`: cart is persistent right panel (not bottom sheet); no immersive Layout chrome; same selection + CTA semantics; no `verificationPausedRef` pause required (user can see camera + panel simultaneously) — **optional:** still pause on mobile only. | H4 Consistency |
-| **Optimistic commit** *(nice-to-have)* | Defer — show loading on CTA until API confirms; no optimistic removal (batch failures are painful). | H9 |
-
-### Anti-patterns to avoid
-
-- **Separate "Edit" mode hiding checkboxes** — violates supermarket-checkout mental model (H6).
-- **Silent enqueue on `disambiguation` / `needsUserSelection`** — must block on picker (H5).
-- **Per-card Add / condition / foil on scan peek** — design-direction anti-pattern; peek is read-only + tap-to-cart (H8).
-- **Unmounting camera when sheet opens** — causes slow re-start and flash re-permission; pause via `verificationPausedRef` only (H1).
-- **Auto-routing to DB on identify** — rebuild D3 reversed; enqueue only (H3).
-- **"binder" / "Save to binder" / "Mark Owned" button copy** — use `VOCAB` constants; CI forbidden-strings (H4).
-- **Hardcoded hex / `rgba(0,0,0,0.55)` in new chrome** — use glass tokens; migrate existing `ScannerCamera` literals in same brief (H4).
-- **Emoji toast glyphs** — SVG only per design-direction checklist (H4).
-- **`backdrop-filter` on cart thumbnail elements** — GPU budget; glass on row container only (H8).
-- **Deck destination in checkout** — D4; no deck picker (H4).
-- **Navigating away on commit** — D1 stay on camera (H3).
-- **Confirm dialog via `window.confirm`** — use `<Modal>` for back-guard; matches focus-trap contract (H7 Flexibility).
-- **Interactive peek controls stealing taps from viewfinder** — peek must not block scanning except its single open-cart hit target (H8).
-- **localStorage for cart** — D7 specifies `sessionStorage`; do not use existing `SCANNER_SESSION_STORAGE_KEY` localStorage for cart rows (H6).
-
-### Mobile / responsive notes
-
-- **&lt;768px (mobile):** `Layout` `chrome="immersive"` — hide sidebar, `TopSearchBar`, `MobileNavigation`. Camera `100dvh` full-bleed (`min-h-0` flex child). Top bar respects `env(safe-area-inset-top)`; bottom bar `env(safe-area-inset-bottom)`. Checkout = bottom sheet (max-height ~85dvh, scrollable list, sticky footer). Peek sits above bottom bar, below brackets.
-- **≥768px (tablet/desktop):** Layout sidebar visible. Camera in main column; cart as **persistent right panel** (~360px) not sheet. Review N pill still opens/focuses panel if collapsed. No immersive chrome.
-- **375px floor:** verify footer CTAs stack (primary full-width, secondary below) without clipping qty steppers; row thumb stays 40×56.
-- **Landscape phone:** sheet max-height may need `max-h-[70dvh]` so viewfinder remains partially visible — architect to decide in brief; UX prefers partial camera peek above sheet scrim (H1).
-- **Touch:** swipe-down on sheet handle to dismiss (nice-to-have); scrim tap dismisses (required). 8px minimum gap between adjacent 44px targets in bottom bar.
-
-## Architecture
-
-Locked 2026-08-14. Layout gets `chrome="immersive"` (Brief 1). Four implementer briefs; no new API routes or schema changes.
-
-### File plan
-
-| File | Action | Purpose |
-| --- | --- | --- |
-| `components/Layout.js` | modified | `chrome="immersive"` prop — hide `MobileNavigation` + `TopSearchBar` below `md` |
-| `test/components/Layout.test.js` | modified | Regression-lock immersive chrome |
-| `lib/use-scanner-queue.js` | modified | Enqueue-only `handleCardScanned`; checkout commit helpers; remove auto-route |
-| `lib/scanner-session.js` | modified | `SCANNER_CART_STORAGE_KEY` + load/save/clear cart in `sessionStorage` (D7) |
-| `test/lib/scanner-session.test.js` | modified | Cart persistence helpers |
-| `test/lib/use-scanner-queue.test.js` | new | No-network enqueue + bulk commit mocks |
-| `lib/use-camera-scanner.js` | modified | `facingMode` state + `switchFacingMode` (restart stream) |
-| `lib/use-scanner-identification.js` | modified | `identifyFromGalleryFile` adapter only (calls existing `tryLayer1TextIdentify`) |
-| `components/scanner/ScannerCamera.js` | modified | Full-bleed glass top/bottom bars; flash/swap/gallery; peek mount point |
-| `components/scanner/ScannerCountPill.js` | modified | Gradient Review {N} pill |
-| `components/scanner/ScannerScanPeek.js` | new | Non-interactive 3s peek; tap opens checkout |
-| `components/scanner/ScannerToast.js` | modified | SVG icons (no Unicode glyphs) |
-| `components/scanner/ScannerCheckoutSheet.js` | new | Mobile bottom-sheet cart (shell from `ScannerDisambiguation`) |
-| `components/scanner/ScannerReview.js` | modified | Desktop `md+` persistent side panel variant |
-| `components/scanner/ReviewCardItem.js` | modified | Checkbox + confidence ring; drop row destination picker |
-| `pages/scanner.js` | modified | Scanning-first orchestration; sheet state; pause ref; immersive Layout |
-| `pages/login.js` | modified | Honor `returnUrl` query after login (D2) |
-| `test/components/ScannerCheckoutSheet.test.js` | new | Sheet a11y + vocab + selection-disabled CTA |
-
-**Not touched:** `pages/api/**`, `migrations/**`, `lib/scanner-card-identify.js` (identify pipeline), `components/scanner/ScannerDisambiguation.js` (reuse pattern only), `components/scanner/ScannerSetup.js` (dead path, not deleted).
-
-### API surface
-
-No new or modified API routes. Commit-time calls (unchanged):
-
-| Method | Path | Request | Response | Auth | Rate limit |
-| --- | --- | --- | --- | --- | --- |
-| POST | `/api/user-cards` | `buildScannerCardPayload(card)` | 2xx / error JSON | Bearer JWT | none (existing) |
-| POST | `/api/collections/:id/cards` | `buildScannerCardPayload(card)` | 2xx / error JSON | Bearer JWT | none |
-| GET | `/api/collections` | — | collection[] | Bearer JWT | none |
-| POST | `/api/cards/batch-ownership` | `{ cardIds: number[] }` | `{ ownership }` | Bearer JWT | none |
-
-Helpers live in `lib/scanner-route-api.js` (`addScannedCardToOwned`, `addScannedCardToCollection`, `fetchScannerCollections`, `fetchBatchOwnership`).
-
-### Schema diff
-
-None. Cart is client-side `sessionStorage` only (`SCANNER_CART_STORAGE_KEY`).
-
-### Test plan
-
-| Area | File | What to assert |
-| --- | --- | --- |
-| Cart merge defaults | `test/lib/scanner-session.test.js` (existing) | `processed: false` on new entries — keep green |
-| Cart persistence | `test/lib/scanner-session.test.js` | `saveScannerCart` / `loadScannerCart` round-trip |
-| No auto-route | `test/lib/use-scanner-queue.test.js` (new) | `handleCardScanned` never calls `routeScannedCardToDestination`; mock `fetch` |
-| Bulk commit | `test/lib/use-scanner-queue.test.js` | `handleBulkAction('owned')` invokes `addScannedCardToOwned` per selected id |
-| Layout immersive | `test/components/Layout.test.js` | Mobile nav hidden when `chrome="immersive"` |
-| Checkout sheet | `test/components/ScannerCheckoutSheet.test.js` | Dialog labels, `VOCAB` CTAs, disabled primary when selection empty |
-| Auth/Layout regressions | `test/lib/permission-middleware.test.js`, `test/components/Layout.test.js` | Do not weaken existing assertions |
-
-Smoke (manual / post-merge): authenticated `/scanner` on 375px viewport — camera full-bleed, Review N opens sheet, commit to My Collection. Visual-diff may need baseline refresh if Layout chrome changes bleed to homepage (unlikely — scanner-only prop).
-
-### Risk list
-
-| Risk | Mitigation |
-| --- | --- |
-| `pages/scanner.js` was shared by all three conductor guesses | Serialized: only Brief 4 touches `scanner.js` |
-| Gallery has no existing file-picker hook (boot finding) | Brief 3 adds `identifyFromGalleryFile` calling `tryLayer1TextIdentify` — no API change |
-| `facingMode` swap requires stream restart | Brief 3 `stopCamera` + `startCamera` on toggle; flash forced off on front |
-| `Set` not JSON-serializable | Brief 2 persists `selectedCardIds: number[]` |
-| Login lacks `returnUrl` today | Brief 4 adds query param + login handler; validate path starts with `/` |
-| `handleBulkAction` currently marks `processed: true` | Brief 2 removes committed rows from queue instead |
-| Layout visual-diff sensitivity | Narrow prop; immersive mobile-only; no sidebar restyle |
-| `verificationPausedRef` shared by disambiguation + sheet | Brief 4 `useEffect` ORs sheet/list-picker/disambiguation on mobile |
-| Deck code paths remain in queue hook | UI omits deck (D4); dead `deck` branch in `handleBulkAction` harmless until cleanup convoy |
-| iOS Safari no `torch` | Existing `flashSupported` probe; hide flash button |
-
-### Decomposition
-
-| Brief # | Title | Files | Depends on | Est. PR size |
-| --- | --- | --- | --- | --- |
-| 1 | Layout immersive chrome | `Layout.js`, `test/components/Layout.test.js` | — | ~80 LOC |
-| 2 | Cart model + sessionStorage | `use-scanner-queue.js`, `scanner-session.js`, tests | — | ~200 LOC |
-| 3 | Camera chrome + facing + peek | `ScannerCamera.js`, `use-camera-scanner.js`, `ScannerCountPill.js`, `ScannerScanPeek.js`, `ScannerToast.js`, `use-scanner-identification.js` | 2 | ~350 LOC |
-| 4 | Page orchestration + checkout sheet | `pages/scanner.js`, `pages/login.js`, `ScannerCheckoutSheet.js`, `ScannerReview.js`, `ReviewCardItem.js`, test | 1, 2, 3 | ~380 LOC |
-
-### Slice dependencies (multitask-ready)
-
-```yaml
-slice_dependencies:
-  - brief: 1
-    depends_on: []
-    files:
-      - components/Layout.js
-      - test/components/Layout.test.js
-  - brief: 2
-    depends_on: []
-    files:
-      - lib/use-scanner-queue.js
-      - lib/scanner-session.js
-      - test/lib/scanner-session.test.js
-      - test/lib/use-scanner-queue.test.js
-  - brief: 3
-    depends_on: [2]
-    files:
-      - components/scanner/ScannerCamera.js
-      - components/scanner/ScannerCountPill.js
-      - components/scanner/ScannerScanPeek.js
-      - components/scanner/ScannerToast.js
-      - lib/use-camera-scanner.js
-      - lib/use-scanner-identification.js
-  - brief: 4
-    depends_on: [1, 2, 3]
-    files:
-      - pages/scanner.js
-      - pages/login.js
-      - components/scanner/ScannerCheckoutSheet.js
-      - components/scanner/ScannerReview.js
-      - components/scanner/ReviewCardItem.js
-      - test/components/ScannerCheckoutSheet.test.js
-```
-
-**Parallelism:** Brief **1** and **2** can run in parallel (`depends_on: []`, disjoint files). Brief **3** starts after **2**. Brief **4** is serial after **1 + 2 + 3**. Do not dispatch Brief 3 until Brief 2 merges (cart API contract). Maximum fan-out: 2 implementers (Brief 1 ∥ Brief 2), then 1, then 1.
-
-### Boot-the-brief check (2026-08-14)
-
-| Check | Finding | Brief fix |
-| --- | --- | --- |
-| Auto-route still live | `handleCardScanned` L148–168 calls `routeScannedCardToDestination` | Brief 2 deletes block |
-| No `chrome` on Layout | `Layout({ children, user, showSearch })` only | Brief 1 adds prop |
-| `facingMode` hardcoded | `getUserMedia` uses `'environment'` only | Brief 3 adds toggle + restart |
-| No gallery entry point | Grep found zero file-picker wiring | Brief 3 `identifyFromGalleryFile` via `tryLayer1TextIdentify` |
-| Login no `returnUrl` | `login.js` always pushes `/dashboard` | Brief 4 adds safe return path |
-| Cart persistence | IA said in-memory; D7 overrides to `sessionStorage` | Brief 2 separate key from `localStorage` session prefs |
-| `ScannerToast` Unicode | `ICON_MAP` uses `✓` / `✗` | Brief 3 SVG replacement |
-| Cross-brief props | `ScannerCamera` needs sheet orchestration | Declared in Brief 3 ↔ 4 `cross_brief_commitments` |
-
-No new npm packages. No peer-dep conflicts. `tryLayer1TextIdentify` and `resolveIdentifyOutcome` confirmed exported from `lib/scanner-card-identify.js`.

.convoys/scanner-mobile-checkout/audits/a11y-20260814.md

@@ -1,146 +0,0 @@
-# A11y audit — scanner-mobile-checkout
-
-**Reviewer:** role-a11y-auditor  
-**Convoy:** `scanner-mobile-checkout`  
-**Surface:** uncommitted UI diff vs `origin/main` (+ untracked) — no GitHub PR  
-**Date:** 2026-08-14  
-**Model:** cursor-grok-4.5-high (`model_tier=audit`)  
-**Skill note:** `.cursor/skills/accessibility-audit/SKILL.md` was not present in-repo; audit follows role + convoy UX § A11y constraints (14 items) + WCAG 2.2 AA (AAA target size where convoy requires).
-
-## Diff scope (UI)
-
-| Path | Status |
-| --- | --- |
-| `components/Layout.js` | modified (`chrome="immersive"`) |
-| `components/scanner/ScannerCamera.js` | modified |
-| `components/scanner/ScannerCountPill.js` | modified |
-| `components/scanner/ScannerToast.js` | modified |
-| `components/scanner/ReviewCardItem.js` | modified |
-| `components/scanner/ScannerReview.js` | modified |
-| `components/scanner/ScannerCheckoutSheet.js` | **new** |
-| `components/scanner/ScannerScanPeek.js` | **new** |
-| `pages/scanner.js` | modified |
-| `test/components/ScannerCheckoutSheet.test.js` | new (a11y-adjacent) |
-
-Non-UI (session/hooks/login/tests) excluded from findings.
-
-## Executive summary
-
-- Chrome controls (flash / swap / gallery / back / Review N), peek tap target, toast live region, checkout `role="dialog"` + Escape + `useFocusTrap`, and sitewide `prefers-reduced-motion` collapse are largely in good shape.
-- **One severity-3 finding:** nested List-picker `<Modal>` over open checkout sheet leaves **two Escape handlers and two focus traps** active — Escape dismisses both layers (and Tab can fight). Convoy constraint 10.
-- Several severity-2 gaps vs promised constraints: missing sheet close control, no `aria-describedby` helper on disabled commit CTA, camera chrome not `inert`/`aria-hidden` under sheet, native checkbox hit target unreliable at 44×44.
-- **Recommendation:** request-changes until nested-overlay Escape/trap is fixed; ship sev-2 before merge if possible.
-
-**Counts:** 7 findings (sev ≥ 3: **1**, sev &lt; 3: **6**). Constraint checklist: **9 pass / 3 partial / 2 fail**.
-
-## Convoy constraint checklist
-
-| # | Constraint | Result | Notes |
-| --- | --- | --- | --- |
-| 1 | 44×44 targets (2.5.5) | **Partial** | ChromeIconButton, Review N, qty ±, overflow use `minWidth/Height: 44`. Native checkbox is `w-5 h-5` with style mins — hit box often stays ~20px. |
-| 2 | Contrast on glass (1.4.3) | **Pass*** | Token text colors; no instrumented contrast measure (*static review). |
-| 3 | Focus order open/close (2.4.3) | **Partial** | Trap focuses first focusable in panel; restore via `useFocusTrap`. No header ×; restore may miss if opener was auto-dismissed peek. |
-| 4 | Keyboard Escape / peek Enter (2.1.1) | **Partial** | Escape + button peek OK; nested Escape conflict (see A1). |
-| 5 | Dialog name/role (4.1.2) | **Pass** | Checkout: `role="dialog"` `aria-modal` `aria-labelledby` → "{N} cards scanned". List picker Modal title "Choose a List". |
-| 6 | Required `aria-label`s | **Pass** | Leave / gallery / flash+`aria-pressed` / swap / Review N / checkbox / qty / overflow present. |
-| 7 | Non-text (1.1.1) | **Pass** | Row thumbs `alt={card.name}`; peek thumb `alt=""` under named button; decorative SVGs `aria-hidden`. |
-| 8 | Status messages (4.1.3) | **Pass** | Toast `role="status"` `aria-live="polite"`; scan status `aria-live="polite"`. Peek is interactive, not a second live region (toast covers identify). |
-| 9 | Reduced motion (2.3.3) | **Pass** | Peek/sheet/toast transitions + spinners covered by `styles/globals.css` `@media (prefers-reduced-motion: reduce)`. |
-| 10 | Focus trap all overlays | **Fail** | Sheet traps; Modal traps; both stay active when List picker opens over checkout. |
-| 11 | Confidence not color-only (1.4.1) | **Partial** | Visible `{pct}% match` + ring; checkbox `aria-label` adds confidence only when &lt;85%; header says "Some matches…" not "{N} need review". |
-| 12 | Gallery file input | **Pass** | `sr-only` input + labeled button; `aria-busy` while identifying. |
-| 13 | Disabled CTA + describedby | **Fail** | `disabled` only; no helper text / `aria-describedby` / `aria-disabled`. |
-| 14 | Hide camera under sheet | **Fail** | `isCheckoutOpen` only changes status copy; video + chrome not `aria-hidden`/`inert`. |
-
-## Findings
-
-| Sev | Layer | WCAG | Surface | Issue | Fix |
-| --- | --- | --- | --- | --- | --- |
-| **3** | Keyboard / Focus | 2.1.1, 2.4.3 | `pages/scanner.js` + `ScannerCheckoutSheet.js` | Nested List picker Modal while checkout sheet open: both register document `Escape` + Tab traps. Escape closes **picker and sheet**. | Deactivate checkout trap + Escape while `isListPickerOpen`; or close sheet Escape only when picker closed (`if (e.key === 'Escape' && !isListPickerOpen)`). Prefer `useFocusTrap(active && !nestedOpen)`. |
-| **2** | Name / Instructions | 3.3.2, 4.1.2 | `ScannerCheckoutSheet.js` `CheckoutFooter` ~L40–51 | Zero selection: primary disabled with no visible "Select at least one card" / `aria-describedby`. | Add helper `<p id="checkout-select-hint">…</p>`; `aria-describedby={selectedCount === 0 ? 'checkout-select-hint' : undefined}`; optional `aria-disabled` mirroring `disabled`. |
-| **2** | Structure / AT | 1.3.2, 4.1.2 | `ScannerCamera.js` + `pages/scanner.js` | Sheet open does not set `aria-hidden`/`inert` on viewfinder chrome (constraint 14). | When `isCheckoutOpen` (mobile), set `inert` on camera root (or `aria-hidden` on `<video>` + `tabIndex={-1}` / hide chrome from AT). |
-| **2** | Target size | 2.5.5 | `ReviewCardItem.js` ~L72–79 | Checkbox visual/control ~20×20 despite `minWidth/Height: 44` on `<input type="checkbox">` (unreliable). | Wrap in `<label className="… min-w-[44px] min-h-[44px] flex items-center justify-center">` or custom hit pad. |
-| **2** | Keyboard / Operable | 2.1.1, 2.4.3 | `ScannerCheckoutSheet.js` ~L211–217 | No header dismiss × (convoy: close via × / Escape / scrim). Keyboard-only users depend solely on Escape. | Add `aria-label="Close cart"` button in sheet header; include in focus order as first focusable. |
-| **1** | Understandable | 3.3.1 / UX | `pages/scanner.js` Leave Modal ~L152–166 | Copy uses "Stay" not "Keep scanning"; description omits `{N}` count. | `description={\`${unprocessedCount} scanned cards haven't been added yet.\`}`; primary label "Keep scanning". |
-| **1** | Sensory | 1.4.1 | `ScannerCheckoutSheet.js` ~L127–130 | Low-confidence subline lacks count; checkbox confidence in name only when &lt;85%. | Subline: `{n} need review`; include confidence in checkbox `aria-label` whenever `confidencePct != null`. |
-
-### Severity ≥ 3 detail
-
-#### A1 — Nested Escape / dual focus trap (sev 3)
-
-**Scenario:** User opens checkout sheet → taps **Add to List** → List picker Modal opens. Presses **Escape** intending to close only the picker.
-
-**Observed behavior (static):**
-
-1. `ScannerCheckoutSheet` always calls `useFocusTrap(true)` and adds a document `keydown` Escape → `onClose` while mounted (`ScannerCheckoutSheet.js` L171–188).
-2. `<Modal open={isListPickerOpen}>` independently traps focus and listens for Escape → its `onClose` (`Modal.js` L28–37; `pages/scanner.js` L168–173).
-3. Checkout stays mounted (`pages/scanner.js` L131–137) while picker is open — neither trap is suspended.
-
-Both Escape listeners fire on one keypress → picker closes **and** cart sheet closes. Tab handlers from both traps remain registered → unpredictable focus cycling (constraint 10).
-
-**Suggested fix (minimal):**
-
-```js
-// ScannerCheckoutSheet — accept activeTrap prop
-const sheetRef = useFocusTrap(trapActive !== false);
-
-useEffect(() => {
-  if (!trapActive) return undefined;
-  // … Escape handler only when trapActive
-}, [onClose, sheetRef, trapActive]);
-```
-
-```js
-// pages/scanner.js
-<ScannerCheckoutSheet
-  trapActive={!isListPickerOpen}
-  …
-/>
-```
-
-Or close List picker with Escape via Modal only, and in checkout Escape handler: `if (document.querySelector('[data-list-picker-open]')) return`.
-
-## Layer walk (5 layers, summary)
-
-| Layer | Verdict |
-| --- | --- |
-| **1 Perceivable** | Toast/status live regions OK; confidence has text+ring; peek/toast SVG icons OK; reduced-motion via global CSS OK. |
-| **2 Operable** | 44px chrome generally OK; nested Escape/trap is the blocker; missing sheet ×; checkbox target weak. |
-| **3 Understandable** | Labels strong on chrome; leave-modal / empty-CTA / low-confidence copy incomplete vs convoy. |
-| **4 Robust** | Dialog semantics present; dual `aria-modal` when nested; camera not inert under sheet. |
-| **5 Consistency** | Matches `ScannerDisambiguation` sheet shell pattern (good); nested Modal over sheet needs same trap suspension pattern as disambiguation-above-checkout (z-50 vs z-40) — disambiguation currently unlikely while checkout open because verify pauses, but List picker is the live path. |
-
-## Suggested diffs (priority)
-
-1. **P0** — Suspend checkout Escape + `useFocusTrap` while List picker (or any nested Modal) is open.  
-2. **P1** — Disabled CTA helper + `aria-describedby`.  
-3. **P1** — `inert` / `aria-hidden` on camera when mobile checkout open.  
-4. **P1** — 44×44 checkbox hit area via label wrapper.  
-5. **P2** — Sheet close button; leave-modal copy + count; "{N} need review".
-
-## Patterns to lift
-
-- `ChromeIconButton` — good reusable 44px + `aria-label` / `aria-pressed` / `aria-busy` pattern (`ScannerCamera.js`).
-- `ScannerDisambiguation` + `useFocusTrap` — correct shell to copy; extend with **`active` gated by nested overlays**.
-- `ScannerToast` SVG + `role="status"` — keep; do not add a competing live region on peek.
-
-## Automated checks
-
-| Check | Result |
-| --- | --- |
-| axe-core / CI a11y job | Not run (static role audit) |
-| Manual SR | Recommend VoiceOver pass: open cart → Add to List → Escape once |
-
-## Approval recommendation
-
-- [ ] approve  
-- [x] **request-changes** — sev ≥ 3 open (nested Escape/trap)  
-- [ ] comment-only  
-
-Fix A1 before merge. Sev-2 items should land in the same PR or an immediate follow-up brief tagged a11y.
-
-## Hand-off
-
-A11y audit complete. **7 findings** (sev ≥ 3: **1**, sev &lt; 3: **6**).  
-Report: `.convoys/scanner-mobile-checkout/audits/a11y-20260814.md`.  
-Recommend fixing sev ≥ 3 before merge.

.convoys/scanner-mobile-checkout/audits/design-system-20260814.md

@@ -1,153 +0,0 @@
-# Design-System Audit — scanner-mobile-checkout
-
-**Role:** `role-design-system-auditor`  
-**Surface:** uncommitted `feat/scanner-mobile-checkout` UI (`git diff origin/main` + untracked scanner UI)  
-**Convoy:** `.convoys/scanner-mobile-checkout.md`  
-**Date:** 2026-08-14  
-**Scope:** UI / DS only — read-only; no code changes  
-
-**Inputs reviewed**
-
-| Source | Notes |
-| --- | --- |
-| Diff UI | `Layout.js`, `ScannerCamera.js`, `ScannerCountPill.js`, `ScannerToast.js`, `ReviewCardItem.js`, `ScannerReview.js`, `pages/scanner.js` |
-| Untracked | `ScannerCheckoutSheet.js`, `ScannerScanPeek.js` |
-| Direction lock | `design_direction` v1 + `## Design direction` in convoy |
-| Tokens | `docs/DESIGN_TOKENS.md`, `styles/globals.css` |
-| Primitives | `components/ui/{GlassSurface,Button,Modal,Input}.js` |
-| Skill | `.cursor/skills/design-systems/SKILL.md` **not installed** in this repo; audit follows role file + prior Liquid Glass audit shape + `docs/DESIGN_TOKENS.md` |
-
----
-
-## Audit summary
-
-| Check | Status | Notes |
-| --- | --- | --- |
-| Direction lock (Liquid Glass + immersive camera + sheet) | ⚠️ Partial | Chrome bars + VOCAB CTAs + Modal reuse land; **L-brackets / scan-line missing**; sheet tint recipe drifts |
-| Hex in JSX | ❌ | 1 literal `#ffffff` in `ReviewCardItem.js` |
-| Binder / stale vocab | ✅ | No `binder` / `Mark Owned` / `Save to binder` in scoped UI |
-| `backdrop-filter` on cart **thumbnails** | ✅ | Thumbs are solid image/`--bg-tertiary`; no filter on `<img>` |
-| GlassSurface / Button / Modal reuse | ⚠️ Mixed | Camera chrome + peek: GlassSurface; checkout sheet/toast/rows: `glass-panel*` / hand-rolled |
-| Sev ≥ 3 findings | **2** | Hex literal; missing bracket + scan-line direction lock |
-
----
-
-## Maturity scoring (repo DS + this surface)
-
-Scores 0–4. Evidence cites paths/counts.
-
-| Axis | Score | Evidence |
-| --- | --- | --- |
-| **Tokens (T)** | **3** | Documented 3-tier glass surface / blur / rim / elevation / scrim in `docs/DESIGN_TOKENS.md` + `styles/globals.css`. Diff mostly consumes `var(--*)`. Residual: `.glass-panel` still hardcodes `blur(12px) saturate(180%)` (not `--glass-blur-*` / `--glass-saturate`); toast uses literal `blur(12px)`. |
-| **Components (C)** | **3** | Kit under `components/ui/`: GlassSurface, Modal, Button, Input, SearchBar, StatCard (+ chrome). Scanner adopts GlassSurface on camera bars/icons/peek (9 call sites in `ScannerCamera.js`); Modal×2 + Button in `pages/scanner.js` / checkout footer. Gaps: toast + sheet panel + cart rows skip GlassSurface. |
-| **Patterns (P)** | **2** | Locked pattern “immersive camera + bottom-sheet checkout” partially shipped (immersive Layout, sheet shell mirroring Disambiguation, peek non-interactive). **Detection chrome still filled rectangles** (info/success), not ember L-brackets + scan-line. Confidence mid-band maps to gold, not direction’s amber/ember table. |
-| **Governance (G)** | **3** | Convoy `design_direction` locked 2026-08-14; `ui-and-theming.mdc` + vocab CI; `forbidden-hex-in-jsx` / forbidden stale strings. No design-systems skill package in-repo (template path missing). |
-| **Adoption (A)** | **2** | This surface: GlassSurface on live chrome/peek ✅; checkout sheet + toast + rows use utility classes / ad-hoc styles ❌; Review N pill is raw `<button>` with gradient (OK shape) but skips ember-rim + dead GlassSurface import. Vocab CTAs ✅. |
-
-**Composite:** T3 / C3 / P2 / G3 / A2
-
-**Top leverage:** **Patterns (P)** — implement Screen 1 bracket + scan-line recipe and align checkout sheet to `GlassSurface tint="low"` + toast to GlassSurface/`--glass-surface-high` so the locked Liquid Glass pattern reads as one system, not chrome-good / body-utility.
-
----
-
-## Direction lock
-
-Locked fields enforced: Liquid Glass; immersive overlay + bottom sheet; ember/flame accents as rim/glow/gradient only; VOCAB CTAs; no binder; no hex; no per-card Add on peek; no `backdrop-filter` on cart thumbs; reuse GlassSurface / Modal / Button.
-
-| Locked requirement | Diff status |
-| --- | --- |
-| Immersive `chrome="immersive"` mobile | ✅ `Layout.js` + `pages/scanner.js` |
-| Top/bottom glass bars (`--glass-surface-mid`) | ✅ `GlassSurface tint="mid"` in `ScannerCamera.js` |
-| L-brackets `--accent-flame` / `--accent-ember` + scan-line | ❌ Filled `border` boxes + `--color-info` / `--color-success` overlays; **no** scan-line / `prefers-reduced-motion` gate |
-| Scan peek glass, tap-to-cart only | ✅ `ScannerScanPeek.js` |
-| Toast glass-high + SVG check | ⚠️ SVG ✅; surface is `rgba(--bg-secondary-rgb)` + literal blur, not GlassSurface / `--glass-surface-high` |
-| Review N gradient + `--ember-rim-pronounced` | ⚠️ Gradient ✅; **no** ember rim; unused `GlassSurface` import |
-| Sheet scrim `--modal-scrim` + blur-high | ✅ `ScannerCheckoutSheet.js` styled-jsx |
-| Sheet panel `--glass-surface-low` via GlassSurface | ❌ `glass-panel-strong` → surface-**high** recipe |
-| Footer VOCAB + Button primary/ghost | ⚠️ VOCAB ✅; secondary uses `variant="secondary"` not `ghost` |
-| Confidence rings tokenized (green / amber / orange) | ⚠️ Tokens used; mid=`--accent-gold`, low=`--color-warning` vs lock’s ember/amber table |
-| No hex / no binder | ❌ one `#ffffff`; binder clear |
-| Modal for leave + list picker | ✅ |
-| No backdrop on thumbnails | ✅ |
-
----
-
-## Token audit (3-tier)
-
-| Tier | Expectation | Diff notes |
-| --- | --- | --- |
-| Primitives | Palette / RGB triples in CSS only | No new hex in CSS from this diff. JSX `#ffffff` violates consumer rule. |
-| Aliases | `--glass-surface-*`, `--glass-blur-*`, rims, scrim | Camera/scrim/peek mostly correct. Toast blur literal `12px` should be `var(--glass-blur-low)`. `.glass-panel` utility (row list) still non-token blur/saturate (pre-existing; amplified by N cart rows). |
-| Components | GlassSurface / Button / Modal compose aliases | Sheet + toast + rows compose utilities/hand styles instead of primitives. |
-
----
-
-## Component / adoption audit (scoped surface)
-
-| Element | Expected | Actual | Rate |
-| --- | --- | --- | --- |
-| Glass chrome bars | `<GlassSurface>` | Yes (`ScannerCamera`) | High |
-| Scan peek | `<GlassSurface>` | Yes | High |
-| Toast | `<GlassSurface tint="high">` or equivalent | Hand-rolled | Low |
-| Checkout sheet panel | `<GlassSurface tint="low">` | `glass-panel-strong` | Low |
-| Cart rows | GlassSurface high **or** solid `--bg-secondary` | `.glass-panel` (blur per row) | Medium — OK container glass; GPU stack risk |
-| Footer CTAs | `<Button>` | Yes | High |
-| Leave / List dialogs | `<Modal>` | Yes | High |
-| Review N | Button or GlassSurface + ember rim | Raw `<button>` + gradient | Medium |
-
-**Missing primitive usage (not missing primitives):** toast + sheet should compose existing GlassSurface rather than inventing parallel glass.
-
----
-
-## Findings
-
-Severity 0–4. Cap prioritized; sev ≥ 3 blocks merge recommendation for DS gate.
-
-| ID | Sev | Finding | Evidence | Fix |
-| --- | --- | --- | --- | --- |
-| DS-1 | **3** | Hardcoded hex in JSX | `ReviewCardItem.js` qty `+` button `color: '#ffffff'` | Use theme-safe token (e.g. dark-theme `--text-primary` on ember fill, or shared on-accent pattern used by `<Button variant="primary">`) |
-| DS-2 | **3** | Direction lock: detection chrome ≠ L-brackets + scan-line | `ScannerCamera.js` filled rect overlays via `overlayBorderColor` (`--color-info` / `--color-success`); no bracket SVG/corners; no ember scan-line / reduced-motion | Ship Screen 1 bracket recipe (`--accent-ember` / `--accent-flame`) + gradient scan-line; disable loop under `prefers-reduced-motion` |
-| DS-3 | **2** | Toast bypasses glass recipe | `ScannerToast.js`: `rgba(var(--bg-secondary-rgb), 0.9)` + `backdropFilter: 'blur(12px)'` | Wrap with `<GlassSurface tint="high" blur="low|mid" rim="subtle">`; drop literal blur px |
-| DS-4 | **2** | Checkout sheet panel wrong surface tier + no GlassSurface | `ScannerCheckoutSheet.js` `glass-panel-strong` (high) for panel + sticky footer | Panel: GlassSurface `tint="low"` inside scrim; footer sticky on same recipe or solid inner; match Modal panel docs |
-| DS-5 | **2** | Review N missing ember-pronounced rim; dead import | `ScannerCountPill.js` imports GlassSurface unused; no `--ember-rim-pronounced`; `text-white` utility | Apply rim via GlassSurface `as="button"` `rim="ember-pronounced"` or box-shadow token; remove dead import; avoid raw white |
-| DS-6 | **2** | Confidence band colors drift from lock | `confidenceRingColor`: &lt;70 `--color-warning`, 70–84 `--accent-gold`, else success | Align to lock: &lt;70 `--accent-ember`, 70–84 amber/warning token, ≥85 `--color-success` |
-| DS-7 | **1** | Secondary CTA variant | Checkout footer `Button variant="secondary"` | Prefer `variant="ghost"` per design direction |
-| DS-8 | **1** | Leave-modal dismiss copy | `pages/scanner.js` label `"Stay"` | Direction: primary dismiss **"Keep scanning"** |
-| DS-9 | **1** | Hardcoded vocab fallback | `ReviewCardItem.js` `'My Collection'` string | `VOCAB.MY_COLLECTION` |
-| DS-10 | **1** | Stacked row `backdrop-filter` via `.glass-panel` | Each cart row blurs (`blur(12px)` in utility) | Prefer solid `--bg-secondary` (or GlassSurface without stacking N blurs) for row inners over thumbs — thumbs themselves are clean |
-
-### Passes (not findings)
-
-- No `"binder"` / `"Save to binder"` / `"Mark Owned"` in scoped UI.
-- Checkout CTAs import `VOCAB.ADD_TO_MY_COLLECTION` / `VOCAB.ADD_TO_LIST`.
-- List picker uses `collectionDisplayName`.
-- Peek has no Add / condition / foil; single open-cart control.
-- Toast icons are SVG (no emoji glyphs).
-- Scrim uses `--modal-scrim` + `var(--glass-blur-high)`.
-- Cart thumbnails: no `backdrop-filter`.
-- Leave + List picker use `<Modal>`; commit CTAs use `<Button>`.
-
----
-
-## Governance notes
-
-- Contribution path for glass: `docs/DESIGN_TOKENS.md` + `ui-and-theming.mdc` (“reach for `components/ui/` first”).
-- CI: hex-in-JSX + stale vocab gates apply — **DS-1 will fail / should fail `forbidden-hex-in-jsx`**.
-- Design-systems skill/templates not present under `.cursor/skills/design-systems/` — maturity G capped partly by missing shared audit tooling in-repo.
-
----
-
-## Recommendation
-
-**Do not treat DS as merge-clean until DS-1 and DS-2 are fixed.** DS-3–DS-6 are the follow-up pass that makes checkout/toast/pill match the same Liquid Glass composition as the camera chrome.
-
-**Child tasks (sev ≥ 3):**
-
-1. Replace `#ffffff` in `ReviewCardItem.js` (and any sibling `text-white` on detection badges if hex-gate/token policy treats them as on-accent debt).
-2. Implement ember/flame L-brackets + reduced-motion-aware scan-line on the viewfinder per locked Screen 1.
-
----
-
-## Hand-off
-
-DS audit complete. Maturity: **T3/C3/P2/G3/A2**. Top leverage: invest in **Patterns** (brackets/scan-line + sheet/toast GlassSurface alignment). Sev ≥ 3 findings: **2**. Report: `.convoys/scanner-mobile-checkout/audits/design-system-20260814.md`.

.convoys/scanner-mobile-checkout/audits/reviewer-20260814.md

@@ -1,39 +0,0 @@
-## Reviewer Report
-
-| Check | Status | Notes |
-| --- | --- | --- |
-| Scope match | ✅ | All app changes map to briefs 1–4 `files:`; no unauthorized expansion. Convoy docs/metrics only extras. |
-| Conventions | ✅ | Vocab via `VOCAB`; CSS tokens / GlassSurface; Modal for leave + list picker; login `returnUrl` hardened (`/` only, blocks `//` and `://`). |
-| Security | ✅ | Shallow L1–L2: no new API routes; client cart in `sessionStorage`; returnUrl open-redirect guarded. Defer depth to security-auditor when PR exists. |
-| Regression risk | medium | Scanner page rewritten (phase machine removed); auto-route deleted (intentional); Layout immersive gated by prop but TopSearchBar/MobileNavigation paths change for `/scanner`. |
-| Test coverage | ⚠️ | Brief-required suites green (27/27). Commit success/error detection untested and currently wrong (see Critical). |
-| Documentation | ✅ | No AGENTS.md / schema updates required for this convoy. |
-
-### Findings
-
-- 🔴 **Critical** (must fix before merge): Stale React state used to detect commit failure in `ScannerCheckoutContent.handleCommitOwned` and `pages/scanner.js` `handleListPick`. After `await queue.commitSelectedToOwned()` / `commitSelectedToCollection()`, `queue.scannedCards` is still the pre-commit render snapshot, so a successful commit looks like “all remaining” → false error banner; list picker never closes on success (`setIsListPickerOpen(false)` skipped). Fix: have commit helpers return `successfulIds` (or a boolean), and branch on that — do not re-read hook state immediately after `await`.
-- 🟡 **Suggestion** (consider): `ReviewCardItem` still mounts the per-row destination `<select>` when `!showCheckbox`. Checkout path is fine (`showCheckbox`), but Brief 4 asked to remove inline destination pickers; dead path adds confusion and retains pre-existing `#ffffff` on that control.
-- 🟡 **Suggestion** (consider): Add a focused test that commit success returns/propagates success without relying on immediate `queue.scannedCards` re-read (locks the Critical fix). Optional: login `returnUrl` honor + reject open redirect.
-- 🟢 **Nice to have** (optional): Convoy markdown todos still unchecked despite implemented work — conductor/doc-writer hygiene, not a merge blocker.
-
-### Approval recommendation
-- request-changes
-
-### AC evidence (briefs 1–4)
-
-| Brief | AC | Evidence |
-| --- | --- | --- |
-| 1 | Immersive hides mobile nav / TopSearchBar below md | `Layout.js` `!isImmersive` MobileNav; TopSearchBar `max-md:hidden`; tests added |
-| 1 | Default chrome unchanged | `chrome = 'default'`; regression tests |
-| 2 | No fetch in `handleCardScanned` | Auto-route block removed; queue test asserts no route helpers |
-| 2 | sessionStorage cart | `SCANNER_CART_STORAGE_KEY` + load/save/clear + tests |
-| 2 | Commit removes rows | `successfulIds` filter in `handleBulkAction` |
-| 3 | Facing swap + flash rear-only | `switchFacingMode`; `showFlash` env-only; torch off on `user` |
-| 3 | Peek 3s / toast SVG / gallery adapter | `ScannerScanPeek`, SVG `ToastIcon`, `identifyFromGalleryFile` |
-| 4 | No Setup; returnUrl; sheet + pause; leave Modal | `pages/scanner.js` + hardened `login.js` |
-| 4 | Desktop side panel | `ScannerReview` `variant="side-panel"` |
-| 4 | Checkout sheet tests | header count, disabled primary, vocab labels |
-
-### Test run
-
-`npm run test:run -- test/components/Layout.test.js test/lib/scanner-session.test.js test/lib/use-scanner-queue.test.js test/components/ScannerCheckoutSheet.test.js` → **27/27 passed**.

.convoys/scanner-mobile-checkout/brief-1-layout-immersive-chrome.md

@@ -1,69 +0,0 @@
----
-convoy: scanner-mobile-checkout
-brief_number: 1
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - components/Layout.js
-  - test/components/Layout.test.js
-cross_brief_commitments:
-  - brief: 4
-    description: |
-      Brief 4 passes `chrome="immersive"` on `<Layout>` from `pages/scanner.js`
-      for authenticated scanner sessions. This brief only adds the prop and
-      mobile-only hiding behavior; Brief 4 owns when it is set.
----
-
-# Brief 1: Layout immersive chrome
-
-## Goal (1 sentence)
-
-Add a narrow `chrome="immersive"` prop to `Layout` that hides global app chrome on viewports `< md` without restyling the desktop sidebar.
-
-## Files in scope (do not edit anything else)
-
-- `components/Layout.js`
-- `test/components/Layout.test.js`
-
-## Conventions to follow
-
-- Extend the existing `Layout` signature: `export default function Layout({ children, user = null, showSearch = false })` → add `chrome = 'default'`.
-- Immersive is **mobile-only** (`md:hidden` / `max-md:` patterns). At `md+`, immersive behaves like `default` (sidebar + TopSearchBar unchanged per D3 desktop note).
-- Hide when `chrome === 'immersive'` on `< md`:
-  - `<MobileNavigation />` (line ~674)
-  - `<TopSearchBar />` (line ~986)
-  - Desktop `<aside>` sidebar is already `hidden md:flex` — no change needed at `md+`; on mobile the drawer + bottom nav are the chrome to suppress.
-- Main column: remove `pb-16` bottom padding when immersive (no bottom nav). Use `max-md:pb-0` on the main wrapper (`flex-1 flex flex-col pb-16 md:pb-0`).
-- Outer shell: optional `max-md:p-0` when immersive so camera can be true full-bleed.
-- Do **not** change sidebar styles, nav items, or command palette behavior.
-- Use CSS tokens only — no new hex in JSX.
-
-## Implementation shape (verified against `Layout.js`)
-
-```js
-export default function Layout({
-  children,
-  user = null,
-  showSearch = false,
-  chrome = 'default',
-}) {
-  const isImmersive = chrome === 'immersive';
-  // ...
-  // MobileNavigation: {!isImmersive && <MobileNavigation ... />}
-  // TopSearchBar: {user && !isImmersive && <TopSearchBar ... />}
-  // Main wrapper className: include isImmersive && 'max-md:pb-0'
-}
-```
-
-## Acceptance criteria
-
-- [ ] `chrome="immersive"` hides `MobileNavigation` and `TopSearchBar` below `md` breakpoint
-- [ ] `chrome="immersive"` at `md+` renders identical chrome to `chrome="default"` (sidebar + TopSearchBar visible)
-- [ ] `chrome="default"` (or omitted) is unchanged from current behavior
-- [ ] `test/components/Layout.test.js` adds regression tests: immersive hides mobile nav landmark; default still renders Sign-in CTA when `user={null}` (existing 5 assertions preserved)
-- [ ] No scope expansion (do not edit files outside `files:` above)
-
-## Rationale (≤3 sentences)
-
-Immersive chrome is isolated to `Layout.js` so visual-diff-sensitive sidebar code stays untouched. Mobile-only gating matches design-direction desktop exception. Brief 4 wires the prop from `/scanner` without further Layout changes.

.convoys/scanner-mobile-checkout/brief-2-cart-model-session-storage.md

@@ -1,99 +0,0 @@
----
-convoy: scanner-mobile-checkout
-brief_number: 2
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/use-scanner-queue.js
-  - lib/scanner-session.js
-  - test/lib/scanner-session.test.js
-  - test/lib/use-scanner-queue.test.js
-cross_brief_commitments:
-  - brief: 4
-    description: |
-      Export `clearScannerCartStorage()` from `scanner-session.js`. Brief 4
-      calls it when the user confirms "Leave" on the back-guard modal (D1/D7).
-      Queue hook exposes `hydrateFromStorage` on mount — Brief 4 does not
-      reimplement hydration.
----
-
-# Brief 2: Cart model — stop auto-route + sessionStorage
-
-## Goal (1 sentence)
-
-Reverse rebuild D3 auto-route: identifies enqueue locally only, auto-select new rows, and persist cart + selection in `sessionStorage` (D7).
-
-## Files in scope (do not edit anything else)
-
-- `lib/use-scanner-queue.js`
-- `lib/scanner-session.js`
-- `test/lib/scanner-session.test.js`
-- `test/lib/use-scanner-queue.test.js` (new)
-
-## Conventions to follow
-
-- **No new API routes.** Commit paths stay `addScannedCardToOwned` / `addScannedCardToCollection` from `lib/scanner-route-api.js` (already verified).
-- **Do not use** `SCANNER_SESSION_STORAGE_KEY` / `localStorage` for cart rows (UX anti-pattern). Add a separate key in `scanner-session.js`:
-
-```js
-export const SCANNER_CART_STORAGE_KEY = 'deckhearth:scanner-cart';
-```
-
-- Serialize `selectedCards` as `number[]` (Set is not JSON-safe).
-- Keep `mergeScannedCardEntry` unchanged — cart entry shape already includes `processed: false` and `confidence` from `buildScannedCardPayload`.
-- `sessionDestination` param may remain on the hook signature for backward compat but **must not** trigger network I/O in `handleCardScanned`.
-
-## Implementation shape (verified against `use-scanner-queue.js`)
-
-**Remove auto-route** — delete the block after `setScannedCards(nextQueue)`:
-
-```js
-// DELETE lines ~148-168 (sessionDestination guard + routeScannedCardToDestination)
-```
-
-**Replace `handleCardScanned` with enqueue-only:**
-
-```js
-const handleCardScanned = (cardData) => {
-  setAutoRouteError(null);
-  const { cardEntry, scannedCards: nextQueue } = mergeScannedCardEntry(
-    scannedCards,
-    cardData,
-    scanDefaults
-  );
-  setScannedCards(nextQueue);
-  setSelectedCards((prev) => new Set([...prev, cardEntry.id]));
-  persistCart(nextQueue, new Set([...selectedCards, cardEntry.id]));
-};
-```
-
-Add `loadScannerCart()` / `saveScannerCart({ scannedCards, selectedCardIds })` / `clearScannerCartStorage()` in `scanner-session.js`.
-
-Hydrate on mount in `useScannerQueue` via `useState` initializer + `useEffect` debounced save on `[scannedCards, selectedCards]` changes.
-
-**Checkout helpers** (used by Brief 4 footer CTAs):
-
-```js
-const commitSelectedToOwned = async () => handleBulkAction('owned');
-const commitSelectedToCollection = async (collectionId) =>
-  handleBulkAction('collection', collectionId);
-```
-
-Export these plus `unprocessedCount` derived helper: `scannedCards.filter(c => !c.processed).length`.
-
-After successful `handleBulkAction`, remove committed rows from `scannedCards` entirely (not `processed: true`) per D1/D6 — cart holds only uncommitted items.
-
-## Acceptance criteria
-
-- [ ] `handleCardScanned` performs zero `fetch` calls (no `routeScannedCardToDestination`)
-- [ ] New enqueue auto-adds card `id` to `selectedCards`
-- [ ] Cart + selection survive `sessionStorage` round-trip within a tab (`test/lib/scanner-session.test.js`)
-- [ ] `test/lib/use-scanner-queue.test.js`: mock `scanner-route-api` and assert `handleCardScanned` never calls route helpers; assert `handleBulkAction('owned')` calls `addScannedCardToOwned` once per selected card
-- [ ] `clearScannerCartStorage()` clears persisted state
-- [ ] Existing `test/lib/scanner-session.test.js` cases still pass
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Cart semantics are pure client state and can land before any UI work. Separating sessionStorage from the existing `localStorage` destination prefs avoids D7/localStorage anti-pattern. Removing committed rows instead of flipping `processed` simplifies the checkout sheet list.

.convoys/scanner-mobile-checkout/brief-3-camera-chrome-facing-peek.md

@@ -1,124 +0,0 @@
----
-convoy: scanner-mobile-checkout
-brief_number: 3
-depends_on: [2]
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - components/scanner/ScannerCamera.js
-  - components/scanner/ScannerCountPill.js
-  - components/scanner/ScannerScanPeek.js
-  - components/scanner/ScannerToast.js
-  - lib/use-camera-scanner.js
-  - lib/use-scanner-identification.js
-cross_brief_commitments:
-  - brief: 4
-    description: |
-      `ScannerCamera` accepts orchestration props wired by Brief 4:
-      `onBack`, `onOpenCheckout`, `onGalleryIdentify`, `latestPeekCard`,
-      `cartCount`, `isCheckoutOpen`, `verificationPausedRef`. Defaults/no-ops
-      keep the component renderable before Brief 4 lands. Brief 4 owns sheet
-      open state and back-guard modal.
-  - brief: 4
-    description: |
-      `useScannerIdentification` exports `identifyFromGalleryFile(file)` —
-      thin adapter only; does not modify `pages/api/scan/identify.js` or
-      `lib/scanner-card-identify.js` server contract.
----
-
-# Brief 3: Camera chrome, facing mode, scan peek, gallery adapter
-
-## Goal (1 sentence)
-
-Refactor `ScannerCamera` into full-bleed immersive glass chrome (top/bottom bars, flash, camera swap, Review N pill, scan peek, gallery) and add rear/front `facingMode` support in `useCameraScanner`.
-
-## Files in scope (do not edit anything else)
-
-- `components/scanner/ScannerCamera.js`
-- `components/scanner/ScannerCountPill.js`
-- `components/scanner/ScannerScanPeek.js` (new)
-- `components/scanner/ScannerToast.js`
-- `lib/use-camera-scanner.js`
-- `lib/use-scanner-identification.js` (gallery adapter + pause contract only)
-
-## Conventions to follow
-
-- Glass surfaces: `<GlassSurface tint="mid">` per UX brief; migrate hardcoded `rgba(0,0,0,0.55)` in `ScannerCamera` to tokens.
-- `ScannerToast`: replace `ICON_MAP` Unicode glyphs with inline SVG check/error (design-direction checklist).
-- `ScannerCountPill`: evolve to gradient **Review {N}** pill; keep `aria-label={`Review ${count} scanned cards`}`.
-- Flash: `flash.flashSupported && facingMode === 'environment'` (UX spec). Hide on front camera; turning to front must call `toggleFlash` off if torch was on.
-- Peek: new `ScannerScanPeek.js` — 3s auto-dismiss, `pointer-events-none` wrapper, single child button `pointer-events-auto`, tap calls `onOpenCheckout`.
-- Copy: toast message `"{card.name} added"` with `role="status"`.
-- Do **not** mount checkout sheet here — call `onOpenCheckout` only.
-- Identification pipeline files (`scanner-card-identify.js`, API routes) are out of scope.
-
-## `useCameraScanner` shape (verified)
-
-Current `startCamera` hardcodes `facingMode: 'environment'` (line ~119). Extend:
-
-```js
-export function useCameraScanner({ onError, onVerifyCard, verificationPausedRef, facingMode = 'environment' }) {
-  const [activeFacingMode, setActiveFacingMode] = useState(facingMode);
-  // startCamera uses activeFacingMode in getUserMedia constraints
-  const switchFacingMode = useCallback(() => {
-    setActiveFacingMode((prev) => (prev === 'environment' ? 'user' : 'environment'));
-  }, []);
-  // useEffect: when activeFacingMode changes and stream exists, stopCamera + startCamera
-  return { /* existing */, facingMode: activeFacingMode, switchFacingMode };
-}
-```
-
-`verificationPausedRef` early-return already exists at line ~91 in the tracking interval — no change needed.
-
-## Gallery adapter (verified — no existing file-picker path)
-
-Add to `useScannerIdentification` return object:
-
-```js
-const identifyFromGalleryFile = async (file) => {
-  if (!file || verificationPausedRef?.current) return;
-  const imageData = await readFileToImageData(file); // canvas draw; local helper in same file
-  const authHeaders = getScanAuthHeaders();
-  const result = await tryLayer1TextIdentify(imageData, authHeaders);
-  const outcome = resolveIdentifyOutcome(result);
-  const syntheticTracker = { id: `gallery-${Date.now()}`, status: 'verifying' };
-  await applyIdentifyOutcome(syntheticTracker, imageData, outcome);
-};
-```
-
-Import `tryLayer1TextIdentify`, `resolveIdentifyOutcome` from `./scanner-card-identify.js` (already exported — verified).
-
-## `ScannerCamera` props contract (for Brief 4)
-
-```js
-export default function ScannerCamera({
-  queue,
-  camera,
-  identification,
-  onBack,
-  onOpenCheckout,
-  onGalleryIdentify, // (file) => identification.identifyFromGalleryFile(file)
-  latestPeekCard,    // most recent unprocessed queue entry or null
-  cartCount,
-  isCheckoutOpen,
-  verificationPausedRef,
-}) { /* ... */ }
-```
-
-Remove: `deckMode`, `sessionDestination`, `onStopSession`, phase-based stop button. Back button calls `onBack` (Brief 4 shows leave modal).
-
-Layout: viewport `min-h-[100dvh] max-md:rounded-none max-md:min-h-[100dvh]`; top bar with back / "Scan Cards" / gallery file input; bottom bar flash | status | Review N.
-
-## Acceptance criteria
-
-- [ ] `switchFacingMode` restarts stream with toggled `facingMode`; flash hidden on `user`
-- [ ] `ScannerScanPeek` auto-dismisses ~3s; tap invokes `onOpenCheckout`
-- [ ] `ScannerToast` uses SVG icons, not Unicode glyphs
-- [ ] `identifyFromGalleryFile` calls existing `tryLayer1TextIdentify` — no API route changes
-- [ ] `ScannerCountPill` hidden when `count <= 0`; shows gradient Review pill when `count > 0`
-- [ ] No hex literals added in edited `.js` files
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Camera chrome files are disjoint from `pages/scanner.js`, so this brief can land after the cart model without file conflicts. Gallery needs a thin hook adapter because no file-picker path exists today (boot-the-brief finding). Brief 4 wires props and pause ref when the sheet opens.

.convoys/scanner-mobile-checkout/brief-4-page-orchestration-checkout-sheet.md

@@ -1,159 +0,0 @@
----
-convoy: scanner-mobile-checkout
-brief_number: 4
-depends_on: [1, 2, 3]
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - pages/scanner.js
-  - pages/login.js
-  - components/scanner/ScannerCheckoutSheet.js
-  - components/scanner/ScannerReview.js
-  - components/scanner/ReviewCardItem.js
-  - test/components/ScannerCheckoutSheet.test.js
-cross_brief_commitments:
-  - brief: 1
-    description: |
-      Passes `chrome="immersive"` to `<Layout>` on authenticated `/scanner`
-      (mobile immersive; desktop uses default chrome per D3).
-  - brief: 2
-    description: |
-      Calls `clearScannerCartStorage()` on confirmed leave. Uses
-      `commitSelectedToOwned` / `commitSelectedToCollection` from queue hook.
-      Does not reimplement sessionStorage persistence.
-  - brief: 3
-    description: |
-      Wires `ScannerCamera` props (`onBack`, `onOpenCheckout`, `latestPeekCard`,
-      `onGalleryIdentify`, `cartCount`, `isCheckoutOpen`, `verificationPausedRef`).
-      Sets `verificationPausedRef.current = true` when checkout sheet or List
-      picker modal is open (mobile); desktop side panel does not pause (UX spec).
-deletes: []
----
-
-# Brief 4: Page orchestration + checkout sheet
-
-## Goal (1 sentence)
-
-Collapse `/scanner` to scanning-first immersive flow, wire checkout sheet (mobile) / side panel (desktop), auth return URL (D2), and commit CTAs using vocab constants.
-
-## Files in scope (do not edit anything else)
-
-- `pages/scanner.js`
-- `pages/login.js`
-- `components/scanner/ScannerCheckoutSheet.js` (new)
-- `components/scanner/ScannerReview.js` (desktop `md+` side panel only)
-- `components/scanner/ReviewCardItem.js`
-- `test/components/ScannerCheckoutSheet.test.js` (new)
-
-## Conventions to follow
-
-- **Vocab:** `import { VOCAB } from '../lib/collection-vocabulary.js'` — primary `VOCAB.ADD_TO_MY_COLLECTION`, secondary `VOCAB.ADD_TO_LIST`. Never "Save to binder" / "Mark Owned".
-- **Sheet shell:** copy `ScannerDisambiguation.js` pattern (`fixed inset-0`, `glass-panel-strong`, `useFocusTrap`, Escape dismiss, `z-40` — disambiguation stays `z-50`).
-- **Modal primitive:** back-guard and List picker use `<Modal>` from `components/ui/Modal.js` (not `window.confirm`).
-- **Selection:** checkboxes always visible; all unprocessed IDs selected on first sheet open; new enqueue while open auto-selects (Brief 2 + local effect).
-- **Pause:** `verificationPausedRef.current = isCheckoutOpen || isListPickerOpen || identification.disambiguation` on mobile only.
-- **Auth:** `getUserFromRequest` not needed (page is client-only). Login redirect:
-
-```js
-// pages/scanner.js — replace router.push('/login')
-router.push(`/login?returnUrl=${encodeURIComponent('/scanner')}`);
-
-// pages/login.js — after successful login, before role redirect:
-const returnUrl = typeof router.query.returnUrl === 'string' ? router.query.returnUrl : null;
-if (returnUrl && returnUrl.startsWith('/')) {
-  router.push(returnUrl);
-  return;
-}
-```
-
-- **D1:** after commit, stay on camera; empty cart closes sheet and resumes scanning.
-- **D4:** no deck destination in checkout UI.
-- **D6:** partial commit keeps sheet open with remaining rows.
-
-## `pages/scanner.js` shape (verified — replace phase machine)
-
-Remove `phase` state (`setup` / `scanning` / `review`). Default: camera always mounted when authenticated.
-
-```js
-export default function Scanner() {
-  const [isCheckoutOpen, setIsCheckoutOpen] = useState(false);
-  const [isListPickerOpen, setIsListPickerOpen] = useState(false);
-  const [showLeaveModal, setShowLeaveModal] = useState(false);
-  const verificationPausedRef = useRef(false);
-  // useScannerSession: keep scanDefaults only; drop Setup UI (D3)
-  const queue = useScannerQueue({ user, scanDefaults, deckMode: null });
-  // ...
-  return (
-    <Layout user={user} chrome="immersive">
-      <div className="relative flex flex-col md:flex-row h-full min-h-0 max-md:fixed max-md:inset-0">
-        <ScannerCamera
-          queue={queue}
-          camera={camera}
-          identification={identification}
-          onBack={() => unprocessedCount > 0 ? setShowLeaveModal(true) : router.back()}
-          onOpenCheckout={() => setIsCheckoutOpen(true)}
-          onGalleryIdentify={(file) => identification.identifyFromGalleryFile(file)}
-          latestPeekCard={queue.scannedCards[0] ?? null}
-          cartCount={unprocessedCount}
-          isCheckoutOpen={isCheckoutOpen}
-          verificationPausedRef={verificationPausedRef}
-        />
-        {/* Mobile sheet */}
-        <div className="md:hidden">
-          {isCheckoutOpen && (
-            <ScannerCheckoutSheet
-              queue={queue}
-              collections={queue.collections}
-              onClose={() => setIsCheckoutOpen(false)}
-              onOpenListPicker={() => setIsListPickerOpen(true)}
-            />
-          )}
-        </div>
-        {/* Desktop side panel */}
-        <div className="hidden md:flex md:w-[360px] md:flex-shrink-0 md:border-l" style={{ borderColor: 'var(--border)' }}>
-          <ScannerReview queue={queue} collections={queue.collections} variant="side-panel" />
-        </div>
-        <Modal open={showLeaveModal} /* ... */ />
-        <Modal open={isListPickerOpen} title="Choose a List" /* ... */ />
-      </div>
-    </Layout>
-  );
-}
-```
-
-Sync `verificationPausedRef` in `useEffect` when `isCheckoutOpen || isListPickerOpen || identification.disambiguation` (mobile: checkout open; desktop: only list picker + disambiguation per UX).
-
-## `ScannerCheckoutSheet` responsibilities
-
-- Header: `{N} cards scanned` + low-confidence subline when any row `confidence < 70`
-- Rows: `ReviewCardItem` with checkbox, confidence ring, qty stepper, overflow menu (remove / condition / foil)
-- Footer: primary `VOCAB.ADD_TO_MY_COLLECTION` with `(N)` when subset selected; secondary `VOCAB.ADD_TO_LIST`
-- Commit error: inline banner in footer, rows stay selected
-- `role="dialog"` `aria-modal="true"` `aria-labelledby`
-- On last item removed → `onClose()` + resume camera
-
-## `ReviewCardItem` changes
-
-- Add optional `selected`, `onToggleSelect`, `showCheckbox`, `confidence` ring props
-- Remove inline destination picker from row (destinations in sheet footer only)
-- `aria-label` on checkbox: `Select ${card.name}`; confidence in `aria-label` when `< 85`
-
-## `ScannerReview` changes
-
-- Support `variant="side-panel"` for desktop persistent panel (same row/footer semantics as sheet, no scrim)
-- Remove full-page empty state / "New Session" / deck progress from default path
-
-## Acceptance criteria
-
-- [ ] Opening `/scanner` authenticated shows camera immediately — no Setup phase (D3)
-- [ ] Unauthenticated redirect includes `returnUrl=/scanner`; login honors it (D2)
-- [ ] Mobile checkout sheet opens from Review N and peek; pauses identification under sheet
-- [ ] `commitSelectedToOwned` / List commit work; committed rows leave cart; camera resumes when empty (D1/D6)
-- [ ] Back with unprocessed cart shows `<Modal>` leave confirm; confirm calls `clearScannerCartStorage()` + `router.back()`
-- [ ] Desktop `md+` shows side panel with same CTA semantics; Layout sidebar visible
-- [ ] `test/components/ScannerCheckoutSheet.test.js`: renders header count, disabled primary when nothing selected, vocab labels present
-- [ ] No scope expansion
-
-## Rationale (≤3 sentences)
-
-Integration brief owns the sole `pages/scanner.js` writer after Layout and camera contracts exist. Login `returnUrl` is a two-line change required by D2 and verified absent today. Checkout sheet and desktop panel share row components but split shells to stay under 400 LOC.

.convoys/scanner-rebuild.md

@@ -1,63 +0,0 @@
-# Convoy: scanner-rebuild
-
-**Status:** In Progress (auto-approved — overnight build)  
-**Owner:** Agent  
-**Created:** 2026-06-13  
-
-## Goal
-
-Rebuild the card scanner from a desktop-first, configuration-heavy, everything-at-once layout into a mobile-first, three-phase flow optimized for rapid multi-card scanning.
-
-## Architecture Decisions
-
-### D1 — Three-phase flow
-
-The scanner page becomes a state machine with three phases:
-- **Setup** — choose destination + game (one-time per session)
-- **Scanning** — full-screen camera with success toasts + count pill
-- **Review** — card list with per-card edits + batch confirm
-
-### D2 — Mobile-first camera
-
-Camera fills the viewport during scanning phase. No side panels, no scrolling to see results. Success feedback via overlay toasts + haptic vibration.
-
-### D3 — Auto-everything during scan
-
-- Cards auto-route to chosen destination immediately
-- Condition defaults NM, foil auto-detected from vision response
-- Game auto-detected from vision (no pre-filter needed)
-- Duplicates auto-increment quantity
-
-### D4 — Deck Mode
-
-Toggle in setup phase. Shows progress toward format-aware deck size (60/99/40). Auto-suggests stop when target reached.
-
-### D5 — Disambiguation as bottom sheet
-
-Replace full-screen modal with a slide-up bottom sheet. One tap to pick, then immediately resume scanning.
-
-### D6 — New features
-
-- **Scan history** — last 5 sessions persisted in localStorage
-- **Sound feedback** — subtle blip on successful scan (configurable)
-- **Offline queue** — if network drops, queue identification calls and retry
-- **Camera flash toggle** — torch mode for foil detection in dim lighting
-
-## File ownership
-
-| Workstream | Files | Agent |
-|---|---|---|
-| Core orchestrator | `pages/scanner.js`, `lib/use-scanner-session.js` | A |
-| Camera phase | `components/scanner/ScannerCamera.js`, `ScannerToast.js`, `ScannerCountPill.js`, `lib/use-camera-scanner.js`, `lib/use-scanner-sound.js`, `lib/use-scanner-flash.js` | B |
-| Setup + Review | `components/scanner/ScannerSetup.js`, `ScannerReview.js`, `ScannerDisambiguation.js`, `DeckModeIndicator.js` | C |
-| Queue + API | `lib/use-scanner-queue.js`, `lib/use-scanner-offline.js`, `pages/api/cards/batch-ownership.js` | D |
-
-## Risks
-
-- R1: Parallel agents may produce interface mismatches → mitigated by specifying contracts in each agent's prompt
-- R2: Existing hooks (`use-scanner-identification.js`, `scanner-card-identify.js`, `scanner-card-detection.js`) are not being rewritten — the rebuild layers on top of them
-- R3: Visual regression risk — existing smoke tests may break → handled in integration pass
-
-## Human gates bypassed
-
-Per user instruction (overnight build, 2026-06-13), all architect/reviewer gates are bypassed for this convoy. The user will review the final output in the morning.

.convoys/ship-readiness.md

@@ -47,11 +47,6 @@ PR #18; P1 #12 via `pick-a-name` PR #21) and **P1 #11.5 `fix-lint-baseline`**
 (PRs #61–#63, 2026-06-02), the P1 lane is complete. Lint is **0 problems**;
 CI `lint` is blocking (no `|| true` / `continue-on-error`).
 
-**Post-hoc note (2026-08-15):** `reconcile-historical-add-scripts` implementer
-briefs B1–B6 closed the fresh-env onboarding gap in June 2026 (PRs #148–#153);
-Brief 7 (docs + verification runbook) landed two months later. The P1 lane was
-already complete when B1–B6 merged — this closure is documentation-only.
-
 ## P0 — ship-blockers (security)
 
 These MUST land before any anonymous traffic touches the production URL.
@@ -420,8 +415,7 @@ Total: ~14 convoys to get from current state to public-launch-ready. Estimate 4-
 
 Follow-ups surfaced mid-convoy or mid-PR that didn't fit the original launch sequence but need to land before public traffic. Listed in priority order; not all will be P0/P1 — most are CI / DX / hygiene polish.
 
-- **`scanner-identify-upgrade`** (priority: P1 scanner accuracy; opened 2026-08-14). Umbrella after measuring `scan_attempts` (n=224, 2026-05-27–2026-08-12): L1 auto-match 5.8% of L1 vs the `add-real-ocr-layer` ≥70% target; L1 escalate 76.7%; L2 `not_a_card` 44.6% of Gemini calls; end-to-end auto-match 10.3%. Sub-convoys: `tighten-scan-identify-hot-path` → `improve-scan-card-detection` (queued since PR #38, never opened) → `scan-visual-catalog-search`. Worktree `tcg-vault-worktrees/scanner-identify-upgrade` on `convoy/scanner-identify-upgrade`. File-disjoint from `scanner-mobile-checkout` (chrome/cart). See `.convoys/scanner-identify-upgrade.md`.
+- **`rotate-default-admin`** (priority: P2 hygiene). Operator-rotation script for envs that ran `setup-neon-db.js` before `drop-public-setup` and still carry the weak `admin123` bcrypt hash. Surfaced in P0 #3 § Operator caveat. Optional: do nothing if no audit finds a deployed env with the weak hash.
-- **`rotate-default-admin`** — **RESOLVED 2026-06-13** by PR #141 (`scripts/rotate-admin-password.js`). The convoy chose option B from the architect's three-option menu (close as no-op / build script / build forced-rotation flow): a parameterized one-shot rotation script that's safer than "manually change via app" (audit-trail-preserving via `updated_at`) and lighter than building a first-login forced-rotation flow in the app (that heavier option is the deferred `force-admin-password-reset-flow` convoy). Script reads `POSTGRES_URL` + `ADMIN_NEW_PASSWORD` env vars, validates target row exists + has `role='admin'`, refuses to rotate non-admin rows, verifies the new hash matches the supplied plaintext via `bcrypt.compare` post-update, never echoes the password. AGENTS.md Gotcha #4 documents the rotation workflow. Sibling test users (alice/bob in `scripts/create-test-users.js`) intentionally NOT rotated (dev fixtures, not real auth surfaces).
 - **`delete-dead-lorcana-import`** — **RESOLVED 2026-06-02** by PR #59 (`8262fec`). Deleted `pages/api/cards/import-lorcana.js` and `scripts/import-lorcana.js`; no dedicated convoy file (cleanup tracked here only). Entry kept for audit trail.
 - **`tighten-visual-diff-path-filter`** — **RESOLVED 2026-05-26** by `tighten-visual-diff-path-filter` convoy, squash commit `ba95462` (PR #26). Single-edit `paths:` filter change in `.github/workflows/visual-diff.yml`: inserted `'!pages/api/**'` immediately after `'pages/**'` (order-sensitive per GitHub Actions' minimatch path-filter semantics — exclusions only fire after a prior include matches). Verified the YAML deserialization order at gate time (`['pages/**', '!pages/api/**', 'components/**', 'styles/**', 'tailwind.config.js', 'postcss.config.js']`). `preview-smoke.yml` left untouched (no `paths:` filter; intentionally fires on every PR). Diff: 2 files, +279 / -0 (1 YAML entry + inline comment block + the planning convoy file). **Post-merge verification still pending** — the only true verification is that the next API-only PR after this merges does NOT trigger `Screenshot diff`. PR #30 (`single-sql-client`, squash `c403ea4`) was the **first API-only PR post-merge** and its CI Checks tab showed `Screenshot diff: not triggered` — empirical confirmation that the `!pages/api/**` exclusion fires correctly. The next-API-only-PR success line was originally specified in the convoy file's § Verification plan as the deferred-to-post-merge gate; this is that confirmation. Entry kept (not removed) to preserve the audit trail. See `.convoys/tighten-visual-diff-path-filter.md` § As-shipped.
 - **`purge-weak-creds-from-helpers`** — **RESOLVED 2026-05-26** by `purge-weak-creds-from-helpers` convoy, squash commit `5f2b234` (PR #27). The umbrella is now closed; both remaining halves shipped together. **Multi-convoy history:** (1) `drop-public-setup` Brief 1+2 (`ff80753` + `b63b509`) removed the first `admin123` literal from `scripts/setup-neon-db.js` and set the env-var + fail-loud + no-echo precedent. (2) `pick-a-name` Brief 2 (`9abbab6`) swept the `@tcgvault.com` literals in the three helper paths to `@deckhearth.com` together with the migration script. (3) `fix-reset-db-script` (`3ab9bf8`, PR #25) removed the second `admin123` from `scripts/reset-db.js` and the second `Admin Password:` echo. (4) **This convoy (PR #27)** closes the umbrella by sweeping the last two files: `scripts/create-test-users.js` (alice/bob fixtures, previously hardcoding `bcrypt.hash('alice123', 12)` + `bcrypt.hash('bob123', 12)` and echoing both literals to stdout) and `TESTING_GUIDE.md` (Test Accounts table previously documenting the weak literals). The post-convoy contract: single `TEST_USERS_PASSWORD` env var (intentional simplification per Risk R2 — these are collaboration-flow demo fixtures, not independent identities), fail-loud at the top of `createTestUsers()` BEFORE any DB connection, no password echo anywhere (`✅ Created Alice (alice@deckhearth.com / alice123)` → `✅ Created Alice (alice@deckhearth.com)`), `ON CONFLICT (email) DO NOTHING` preserved. Diff: 3 files, +249 / -22. Lint preserved at 125 (post-PR-#31 baseline); vitest 21/21. ESM-already (this was the first of the three weak-creds-shape convoys to skip the CJS→ESM half because `scripts/create-test-users.js` was already top-level ESM). **Operator caveat:** existing alice/bob rows in already-seeded envs are NOT rotated by re-running the script — `ON CONFLICT` preserves the old hashes; operators must rotate manually via the app or drop those rows and re-seed. Same caveat as the `drop-public-setup` admin-row guidance. **Surfaced out-of-scope follow-up:** `purge-quick-login-from-loginpage` — see new queue entry below. Entry kept (not removed) to preserve the audit trail. See `.convoys/purge-weak-creds-from-helpers.md` § As-shipped.
@@ -477,12 +471,10 @@ Follow-ups surfaced mid-convoy or mid-PR that didn't fit the original launch seq
 - **`purge-quick-login-from-loginpage`** — **RESOLVED 2026-05-29** by PR #56 (`e0218e4`). Quick Login removed from `pages/login.js`. See `.convoys/purge-quick-login-from-loginpage.md` § As-shipped.
 - **`purge-neondatabase-serverless-fully`** — **RESOLVED 2026-06-02** by PR #57 (`5115683`). `@neondatabase/serverless` removed from `package.json`; operational scripts use `@vercel/postgres`. Historical `scripts/add-*` / `fix-*` / `seed-*` graveyard unchanged per no-go-zones. Entry kept for audit trail.
 - **`wire-migrate-into-ci`** (priority: P2 CI infra). Surfaced 2026-05-26 by `migration-tool` (PR #32) — D6 deferral. Add a CI job that runs `npm run migrate up` against a test DB (either a dedicated Neon branch + `MIGRATE_TEST_DATABASE_URL` secret with branch-reset logic, or a Postgres service container with a ~30s container-start tax). Catches syntactically-invalid migrations + most logical errors at PR time. Currently, the first signal that a new migration is broken is the developer's local `npm run migrate up` against their dev branch (or post-deploy on Vercel). Documented in `.convoys/migration-tool.md` § R3.
-- **`reconcile-historical-add-scripts`** — **RESOLVED 2026-06-14** (B1–B6 via PRs #148–#153; B7 docs closure 2026-08-15). Six reconciliation migrations capture historical add-script DDL so fresh Neon branches onboard via `npm install` → `npm run setup-db` alone. Operator verification runbook at `docs/MIGRATION_VERIFICATION_RUNBOOK.md`. See `.convoys/reconcile-historical-add-scripts.md` § As-shipped. Entry kept for audit trail.
+- **`reconcile-historical-add-scripts`** (priority: P1 quality — needed for fresh-env onboarding). Surfaced 2026-05-26 by `migration-tool` (PR #32). Fold the effects of the 27 historical `scripts/add-*.js` / `fix-*.js` / `seed-*.js` jobs into the migration history so a brand-new Neon branch can be onboarded by `npm install` → `npm run setup-db` alone (without manually replaying the historical scripts). Multi-PR; ideally one migration per logical change, generated by reading the scripts' SQL and re-shaping into idempotent `pgm.sql(...)` blocks (with `IF NOT EXISTS` / `IF EXISTS` guards so re-application is safe). Documented in `.convoys/migration-tool.md` § R1.
-- **`retire-graveyard-scripts-after-audit`** (priority: P3 polish; **UNBLOCKED 2026-08-15** by `reconcile-historical-add-scripts` § As-shipped). Surfaced 2026-05-26 by `migration-tool` (PR #32). Once the migration history captures all historical effects, the legacy `scripts/add-*.js` / `fix-*.js` / `seed-*.js` files can be deleted (or moved to `scripts/historical/`). They remain no-go-zones until that cleanup convoy lands. Documented in `.convoys/migration-tool.md` § Follow-ups.
+- **`retire-graveyard-scripts-after-audit`** (priority: P3 polish; **blocked on `reconcile-historical-add-scripts`**). Surfaced 2026-05-26 by `migration-tool` (PR #32). Once the migration history captures all historical effects, the legacy `scripts/add-*.js` / `fix-*.js` / `seed-*.js` files can be deleted (or moved to `scripts/historical/`). They remain no-go-zones until that cleanup convoy lands. Documented in `.convoys/migration-tool.md` § Follow-ups.
 - **`audit-node-pg-migrate-transitive-deps`** (priority: P3 hygiene). Surfaced 2026-05-26 by `migration-tool` (PR #32) — R5 in the convoy file. `npm audit` reports 11 vulnerabilities (6 moderate, 5 high) coming from `node-pg-migrate@8.0.4`'s `glob@~11.1.0` + `yargs@~17.7.0` transitive deps (older `brace-expansion`, `minimatch`, `picomatch` versions with known advisories). All in dev-only paths; the migration tool runs in scripts/CI, never in the deployed Next.js bundle, and the affected APIs (glob's shell-injection CLI; brace-expansion's ReDoS) are not exercised by node-pg-migrate's call sites. Surface only if a security audit specifically flags this surface, or if `node-pg-migrate` ships a v9 that updates the transitive tree.
 - **`add-migration-template`** (priority: P3 DX). Surfaced 2026-05-26 by `migration-tool` (PR #32). Add a custom template via `--template-file-name` so generated migrations include the project's preferred docstring shape + a reminder about `docs/SCHEMA_MAP.md` updates. Surface if migration authoring proves inconsistent.
-- **`unify-user-avatar-column`** (priority: P3 polish). Surfaced 2026-06-14 by `reconcile-historical-add-scripts` architect Finding 2. `users` table has two avatar columns: `profile_image_url` (from `add-user-profile-columns.js`) and `avatar_url` (from `add-user-profile-fields.js`). Both are added by B5's migration for fresh-env parity; runtime may read either. Cleanup: audit which column each caller reads, pick one canonical column, migrate + drop the other.
-- **`drop-dead-cards-columns`** (priority: P3 polish). Surfaced 2026-06-14 by `reconcile-historical-add-scripts` architect Finding 3. `cards.quantity` and `cards.favorited` are dead columns per `docs/SCHEMA_MAP.md` § Smells #3; still added by B1's migration for fresh-env parity. Cleanup: query-trace audit to confirm zero reads/writes, then a `DROP COLUMN` migration.
 
 ### Scanner audit portfolio (2026-05-27)
 

.convoys/tighten-scan-identify-hot-path.md

@@ -1,340 +0,0 @@
----
-name: tighten-scan-identify-hot-path
-classification: feature
-success_metric: |
-  After ship, a new scan_attempts window shows L1 escalate ≤40% of L1
-  (was 76.7%), L1 matched ≥25% of L1 (was 5.8%), and first identify
-  attempt starts in ≤1.2s of tracking (was 3.5s). L2 p50 stays ≤1.8s.
-skip:
-  - ia
-  - ui-design
-  - visual
-  - flag
-status: shipped
-created: 2026-08-14
-depends_on:
-  - add-real-ocr-layer
-umbrella: scanner-identify-upgrade
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
-    role-design-system-auditor: cursor-grok-4.5-high
-    role-a11y-auditor: cursor-grok-4.5-high
-    role-doc-writer: auto
-  escalate_to: claude-sonnet-5-thinking-medium
-  escalate_to_premium: claude-4.6-opus-high-thinking
-  never_premium:
-    - role-reviewer
-    - role-security-auditor
-    - role-design-system-auditor
-    - role-a11y-auditor
-    - role-ui-designer
-    - role-doc-writer
----
-
-# Convoy: tighten-scan-identify-hot-path
-
-Phase 1 of `scanner-identify-upgrade`. Make the **existing** two-layer
-pipeline faster and more unique-match capable. No new vendors, no
-detection rewrite, no embeddings.
-
-## Why
-
-Live telemetry (see umbrella) says Layer-1 is fast (p50 158ms) and
-almost useless as an identifier (5.8% auto-match, 76.7% escalate). The
-user still waits 3.5s of hold-still before that cheap path runs. L2
-Gemini is 1.7s p50 and spends a second token on every disambiguation
-refine. Collector number — the unique printing key L2 already uses —
-is never read on L1.
-
-## Scope
-
-### In scope
-
-- **Hold-still constants** in `lib/scanner-card-detection.js`:
-  `MIN_FIRST_SEEN_MS_FOR_VERIFY` 2500 → ~800;
-  `MIN_STABLE_COUNT_FOR_VERIFY` 6 → 3. Keep tests in
-  `test/lib/scanner-card-detection.test.js` in lockstep.
-- **Name-strip OCR mode:** Tesseract PSM 7 (single line), JPEG quality
-  0.92 on the crop used for OCR (`lib/ocr-worker.js`,
-  `captureCardRegionFromVideo` quality if shared).
-- **Collector-number strip:** second crop of the bottom ~18% of the
-  card; pass number (+ optional set hint) into `matchTextInCatalog`.
-  When name + number uniquely match a `cards` row, auto-match even if
-  many printings share the name.
-- **Structured Gemini output** in `lib/scan-vision.js`:
-  `response_format` JSON schema (or Gateway equivalent). Delete the
-  confidence-30 regex fallback as the success path; keep a hard parse
-  error → `needs_input`.
-- **Model A/B:** default stays `google/gemini-2.5-flash-lite`. Document
-  and allow `SCAN_VISION_MODEL=google/gemini-3.1-flash-lite` (GA on
-  Vercel AI Gateway, ~2.5× input price). Do not flip prod default in
-  this convoy unless Architect + a short identify bake-off say so.
-- **Stop automatic L2 refine** in `use-scanner-identification.js` when
-  L1 already returned a printing list. User picks; Gemini refine is
-  opt-in or only when L1 had no set/number hint.
-- **`docs/SCHEMA_MAP.md`:** `scan_attempts.layer` is 1 = Tesseract
-  (shipped), not "Tesseract future".
-
-### Out of scope
-
-- Detector / OpenCV / YOLO / perspective warp →
-  `improve-scan-card-detection`.
-- pgvector / CLIP / catalog embeddings →
-  `scan-visual-catalog-search`.
-- Changing `checkScanRateLimit` (5/min). Revisit after re-measure.
-- Scanner chrome, cart, checkout (`scanner-mobile-checkout`).
-- Replacing `tesseract.js`.
-
-## Roles invoked
-
-1. `role-ux-reviewer` — hold-still feel; when the picker still appears;
-   no new screens.
-2. `role-architect` — ratify constant values, L1 match rules when a
-   collector number is present, JSON schema shape, whether the model
-   default flips. Write briefs + `slice_dependencies`.
-3. `role-implementer` — per brief.
-4. Audit: `role-reviewer` + `role-security-auditor`. Skip design-system
-   + a11y unless a brief unexpectedly touches `components/`.
-
-## Todos
-
-- [x] UX: confirm 800ms / 3-frame gate does not cause double-scans
-- [x] Architect: briefs + match-rule when number is present
-- [x] Brief A — detection constants + tests
-- [x] Brief B — OCR strips (name PSM 7 + collector number) +
-      `card-text-match.js` / `identify-by-text`
-- [x] Brief C — `scan-vision.js` JSON schema + optional model id
-- [x] Brief D — skip automatic disambiguation Gemini refine
-- [x] SCHEMA_MAP layer-1 wording
-- [x] Re-query `scan_attempts` after preview traffic (2026-08-15 — metrics unvalidated; see umbrella § Post-ship telemetry)
-
-## Post-ship (PR #156, 2026-08-14)
-
-**Shipped:** faster verify gates, collector-number L1, structured Gemini JSON,
-skip L1 disambiguation refine.
-
-**Telemetry (n=250 all-time):** L1 matched 5.4% (target ≥25%); L1 escalate
-78.4% (target ≤40%). Gate latency goal met (~158 ms L1 p50). Aug 15 session
-(n=26) showed 0% L1 match — OCR strips got noisier post-warp, not better.
-
-**Verdict:** Machinery shipped; L1 text path remains insufficient for the
-umbrella 50% auto-match goal. Phase 3 visual kNN is the intended fix.
-
-## Likely file ownership (Architect will lock)
-
-| Area | Files |
-| --- | --- |
-| Gates | `lib/scanner-card-detection.js`, `test/lib/scanner-card-detection.test.js` |
-| OCR | `lib/ocr-worker.js` |
-| L1 match | `lib/card-text-match.js`, `pages/api/cards/identify-by-text.js` |
-| L2 vision | `lib/scan-vision.js`, `pages/api/scan/identify.js` |
-| Refine | `lib/use-scanner-identification.js`, `lib/scanner-card-identify.js` |
-| Docs | `docs/SCHEMA_MAP.md` |
-
-Briefs A and C are file-disjoint and can run in parallel. B depends on
-nothing if it does not retouch detection constants. D depends on B
-(needs L1 payload shape).
-
-## Multitask dispatch
-
-Planning: UX → Architect (serial).
-
-After Architect, if `slice_dependencies` marks A+C `depends_on: []`:
-
-```
-/multitask role-implementer briefs A, C
-```
-
-Then B, then D.
-
-Audit group id: `audit-tighten-scan-identify-hot-path-<pr>`.
-
-## CI impact
-
-| Workflow / job | Behavior |
-| --- | --- |
-| `ci.yml` test | Fires — detection + identify unit tests change |
-| `visual-diff.yml` | Should **not** fire if `components/` / `pages/` / `styles/` untouched |
-| `preview-smoke.yml` | Fires |
-| `forbidden-client-side-llm-keys` | Must stay green — no client Gemini URLs |
-
-## Operator action
-
-Optional: set `SCAN_VISION_MODEL=google/gemini-3.1-flash-lite` on a
-preview to bake off against 2.5 Flash Lite. Leave prod on 2.5 until
-the bake-off.
-
-## Conductor notes
-
-Do not treat Tesseract replacement as in-scope if L1 escalate stays
-high after collector-number matching — that is a crop/detection
-problem (#2) or a visual-search problem (#3), not an OCR-engine
-problem. The six historical L1 matches already show Tesseract can
-read a name when the crop is clean; it cannot pick a printing.
-
-## UX
-
-No new routes or screens. Changes are timing + fewer automatic Gemini
-calls during disambiguation.
-
-### Existing components to reuse
-
-- `ScannerDisambiguation` (`components/scanner/ScannerDisambiguation.js`) —
-  printing picker when L1/L2 cannot unique-match.
-- `ScannerToast` / status copy around tracked card (`components/scanner/ScannerCamera.js`)
-  — continue showing detecting → verifying → found without new chrome.
-- `ScanDisambiguationDialog` pattern if still referenced — do not fork a
-  second picker.
-
-### Design direction alignment
-
-Liquid Glass tokens unchanged. No new overlays. Faster identify should
-feel like the camera "wakes up" sooner (H1 visibility of system status).
-
-### Patterns to follow
-
-- Disambiguation stays a bottom sheet / modal pause (`verificationPausedRef`
-  already wired in `use-scanner-identification.js`).
-- Error toasts debounced via `reportScannerError` (4s gap) — keep that
-  when tightening gates so double-failures do not spam.
-
-### A11y constraints
-
-- No new interactive controls in this convoy.
-- Existing disambiguation list must remain keyboard-selectable (hand off
-  unchanged to a11y auditor if Brief D touches the sheet).
-
-### Interaction patterns
-
-| Pattern | Requirement | Heuristic |
-| --- | --- | --- |
-| Hold-still gate | **required** — 800ms + 3 stable frames; user sees brackets sooner | H1 feedback |
-| Auto-match | **required** — collector number should skip picker for multi-printing names | H6 recognition vs recall |
-| Disambiguation refine | **required** — stop silent second Gemini call when L1 already opened picker; user tap only | H3 user control |
-| Rate-limit toast | **required** — unchanged copy when L2 throttled | H9 error recovery |
-| Loading during verify | **nice-to-have** — optional subtle "Reading…" on card status if trivial | H1 |
-
-### Anti-patterns
-
-- Adding a setup screen or settings toggle for gate timing (H4 consistency).
-- Auto-picking a printing without number evidence when multiple exact-name
-  rows exist (H6).
-- Blocking the camera on L1 OCR worker load (H1 — worker stays async).
-
-### Mobile / responsive
-
-Gate timing applies equally on phone and desktop; no viewport-specific
-branches in this convoy.
-
-## Architecture
-
-### File plan
-
-| File | Action | Purpose |
-| --- | --- | --- |
-| `lib/scanner-card-detection.js` | modified | 800ms / 3-frame verify gates |
-| `test/lib/scanner-card-detection.test.js` | modified | Lock new constants |
-| `lib/ocr-worker.js` | modified | PSM 7 name strip + bottom collector strip |
-| `lib/card-text-match.js` | modified | Name + collector number unique match |
-| `pages/api/cards/identify-by-text.js` | modified | Accept `cardNumber` body field |
-| `test/lib/card-text-match.test.js` | new | Unit tests for number path (mock-free helpers) |
-| `lib/scanner-card-identify.js` | modified | Pass number to L1; JPEG 0.92; `fromLayer1` flag |
-| `lib/scan-vision.js` | modified | JSON schema response; stricter parse |
-| `pages/api/scan/identify.js` | modified | Handle vision parse failures → needs_input |
-| `lib/use-scanner-identification.js` | modified | Skip auto Gemini refine when `fromLayer1` |
-| `docs/SCHEMA_MAP.md` | modified | Layer 1 = Tesseract (shipped) |
-
-### API surface
-
-**POST `/api/cards/identify-by-text`** (modified)
-
-- Auth: `getUserFromRequest` → 401
-- Body: `{ ocrText, ocrConfidence?, cardNumber?, game? }`
-- Response: unchanged envelope + optional `cardNumber` echo in `ocr` meta
-- Rate limit: none (unchanged)
-
-**POST `/api/scan/identify`** (modified behavior only)
-
-- On vision JSON parse failure: 200 with `needsUserInput: true` instead of
-  silent regex fallback at confidence 30
-
-### Schema diff
-
-No migration. `scan_attempts.layer` semantics documented only.
-
-### Test plan
-
-- Update `scanner-card-detection.test.js` thresholds (800ms, stable 3).
-- New `card-text-match.test.js` for `extractCollectorNumberCandidate` and
-  collector-aware disambiguation resolution (pure functions exported for test).
-- Extend `scanner-card-identify.test.js` for `fromLayer1` disambiguation
-  payload if added to pure helpers.
-- Run `npm run test:run` + `npm run lint`.
-
-### Risks
-
-| Risk | Mitigation |
-| --- | --- |
-| Faster gate double-scans same card | `scanAttempts < 1` + tracker negative state unchanged |
-| OCR number strip reads set symbol garbage | Normalize with `extractCollectorNumberCandidate`; fall back to name-only |
-| Gateway rejects `response_format` | Catch 400, log once, fall back to prose prompt (Architect: implementer may feature-detect) |
-| L1 skip-refine hides catalog-gap auto-submit | Refine still runs for L2 disambiguation only |
-
-### Decomposition
-
-| Brief # | Title | Files | Depends on | Size |
-| --- | --- | --- | --- | --- |
-| 1 | Faster verify gates | detection + test | — | S |
-| 2 | Collector number L1 | ocr-worker, card-text-match, identify-by-text, scanner-card-identify, test | — | M |
-| 3 | Structured vision JSON | scan-vision, identify API | — | S |
-| 4 | Skip L1 disambiguation refine | use-scanner-identification, SCHEMA_MAP | 2 | S |
-
-### Slice dependencies
-
-```yaml
-slice_dependencies:
-  - brief: 1
-    depends_on: []
-    files:
-      - lib/scanner-card-detection.js
-      - test/lib/scanner-card-detection.test.js
-  - brief: 2
-    depends_on: []
-    files:
-      - lib/ocr-worker.js
-      - lib/card-text-match.js
-      - pages/api/cards/identify-by-text.js
-      - lib/scanner-card-identify.js
-      - test/lib/card-text-match.test.js
-  - brief: 3
-    depends_on: []
-    files:
-      - lib/scan-vision.js
-      - pages/api/scan/identify.js
-  - brief: 4
-    depends_on: [2]
-    files:
-      - lib/use-scanner-identification.js
-      - docs/SCHEMA_MAP.md
-```
-
-### Decisions (post-UX)
-
-| # | Decision |
-| --- | --- |
-| D1 | Gate values: `MIN_FIRST_SEEN_MS_FOR_VERIFY = 800`, `MIN_STABLE_COUNT_FOR_VERIFY = 3`. |
-| D2 | Collector strip: bottom 18% of crop; PSM 7 for both strips. |
-| D3 | When exact-name multiple printings AND parsed collector number matches exactly one row → auto-match. |
-| D4 | `SCAN_VISION_MODEL` default stays `google/gemini-2.5-flash-lite`; structured JSON either way. |
-| D5 | Auto Gemini refine skipped when disambiguation opened from L1 (`result.layer === 1`). |
-
-Human gate 1: **approved** (operator requested full pipeline run 2026-08-14).

.convoys/tighten-scan-identify-hot-path/brief-1-faster-verify-gates.md

@@ -1,22 +0,0 @@
----
-convoy: tighten-scan-identify-hot-path
-brief_number: 1
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/scanner-card-detection.js
-  - test/lib/scanner-card-detection.test.js
----
-
-# Brief 1: Faster verify gates
-
-## Goal
-
-Cut hold-still wait from 3.5s to ~1.4s by lowering verify gate constants.
-
-## Acceptance criteria
-
-- [ ] `MIN_FIRST_SEEN_MS_FOR_VERIFY = 800`
-- [ ] `MIN_STABLE_COUNT_FOR_VERIFY = 3`
-- [ ] Tests updated and green

.convoys/tighten-scan-identify-hot-path/brief-2-collector-number-l1.md

@@ -1,27 +0,0 @@
----
-convoy: tighten-scan-identify-hot-path
-brief_number: 2
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/ocr-worker.js
-  - lib/card-text-match.js
-  - pages/api/cards/identify-by-text.js
-  - lib/scanner-card-identify.js
-  - test/lib/card-text-match.test.js
----
-
-# Brief 2: Collector number on Layer 1
-
-## Goal
-
-OCR name + collector number strips; unique-match printings when number resolves one row.
-
-## Acceptance criteria
-
-- [ ] PSM 7 on name strip; bottom 18% number strip
-- [ ] `matchTextInCatalog` accepts `cardNumber`
-- [ ] identify-by-text passes `cardNumber`
-- [ ] JPEG capture quality 0.92 for OCR path
-- [ ] Unit tests for number extraction helper

.convoys/tighten-scan-identify-hot-path/brief-3-structured-vision-json.md

@@ -1,22 +0,0 @@
----
-convoy: tighten-scan-identify-hot-path
-brief_number: 3
-depends_on: []
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/scan-vision.js
-  - pages/api/scan/identify.js
----
-
-# Brief 3: Structured Gemini JSON
-
-## Goal
-
-Request JSON schema from AI Gateway; fail loud on parse errors.
-
-## Acceptance criteria
-
-- [ ] `response_format` json_schema on gateway call
-- [ ] No confidence-30 regex success path
-- [ ] identify route returns needsUserInput on parse failure

.convoys/tighten-scan-identify-hot-path/brief-4-skip-l1-refine.md

@@ -1,22 +0,0 @@
----
-convoy: tighten-scan-identify-hot-path
-brief_number: 4
-depends_on: [2]
-recommended_model: composer-2.5-fast
-model_tier: fast
-files:
-  - lib/use-scanner-identification.js
-  - docs/SCHEMA_MAP.md
----
-
-# Brief 4: Skip L1 disambiguation refine
-
-## Goal
-
-Do not auto-call Gemini when L1 already opened the printing picker.
-
-## Acceptance criteria
-
-- [ ] `fromLayer1` on disambiguation state when `result.layer === 1`
-- [ ] useEffect refine skipped when `fromLayer1`
-- [ ] SCHEMA_MAP documents layer 1 = Tesseract

.convoys/unify-glass-panel-surfaces.md

@@ -1,659 +0,0 @@
----
-name: unify-glass-panel-surfaces
-classification: feature
-success_metric: |
-  Every panel-shaped surface in the app (modals, popovers, form
-  cards, dashboard widgets, page-level content cards) renders with
-  the same gradient-border corner-light treatment that the floating
-  chrome chips use — at the appropriate intensity tier for its
-  surface class (full intensity for chrome, subtle for data cards,
-  flat for opaque GPU-budget-constrained tiles like CardItem grid).
-  Verified by visual diff + a forbidden grep gate that prevents
-  reintroduction of bespoke `var(--glass-surface-*)` inline styles
-  outside the documented exception list.
-skip:
-  - ia
-status: closed
-closed: 2026-06-04
-queued_followup:
-  - migrate-button-input-mobilenav-to-glass-primitive
-prs:
-  - 120  # Brief 6 — landing nav → .page-header-glass
-  - 121  # Brief 2 — auth form cards → .glass-panel-strong
-  - 122  # Brief 5 — retire .card; migrate 7 consumers
-  - 123  # Brief 1 — <GlassSurface> cornerLights prop
-  - 124  # Brief 3 — floating popovers → .glass-panel-strong
-  - 125  # Brief 4 — BulkSelectionToolbar + token sweep
-  - 127  # Brief 7 — forbidden-bespoke-glass-surface CI gate (Check 7/7)
-created: 2026-06-04
-depends_on:
-  - tone-down-card-corner-lights  # PR #118 — establishes the subtle token tier
-  - design-sweep-pass  # PR #117 — applies .glass-panel broadly
----
-
-# Convoy: unify-glass-panel-surfaces
-
-Follow-on to the `redesign-v2-from-mockups` umbrella and the
-2026-06-04 corner-border-light refinement (PR #116) + design-sweep
-(PR #117) + card-vibrancy reduction (PR #118).
-
-## Why
-
-The gradient-border corner-light pattern (introduced in PR #116 and
-applied broadly in PR #117) is now the canonical surface treatment
-for the app. But the audit run on 2026-06-04 found that several
-panel-shaped surfaces still use the previous generation's "flat
-translucent fill" pattern — they predate the corner-light work and
-were never migrated:
-
-1. **`<GlassSurface>` primitive** — the most consequential gap.
-   `components/ui/GlassSurface.js` uses a single flat
-   `var(--glass-surface-${tint})` background with no transparent
-   border and no corner radials. Because `<Modal>` (and therefore
-   every modal in the app), `<StatCard>` (dashboard stat tiles),
-   and the public landing-page feature/collection cards all delegate
-   to `<GlassSurface>`, the gap cascades broadly. Upgrading the
-   primitive fixes ~10 visible surfaces in one move.
-
-2. **Auth form cards** (`pages/login.js` L82–88,
-   `pages/signup.js` L227–232) — handrolled glass imitation using
-   `rgba(--bg-secondary-rgb, 0.85)` + `backdrop-blur-sm` (Tailwind,
-   not the system blur tokens). These are the first surfaces a new
-   user sees; they should be canonical, not handrolled.
-
-3. **Floating popovers / drawers** —
-   - `components/Layout.js` mobile drawer (L698–709)
-   - `components/Layout.js` sidebar profile dropdown (L88–96)
-   - `components/ui/TopSearchBar.js` UserMenu dropdown (L214–222)
-
-   All three render a translucent panel over arbitrary page content.
-   None has the gradient-border treatment. The visual cue that
-   says "this is an elevated surface" relies entirely on box-shadow,
-   not on light response.
-
-4. **`BulkSelectionToolbar`** (L47 and L117 dropdown) — uses
-   hardcoded `bg-white border-gray-200`, invisible in dark mode.
-   This is a floating toolbar over all content during bulk-select;
-   should be `.glass-panel-strong`.
-
-5. **`.card`-class consumers** — `pages/profile.js` (×3),
-   `pages/settings.js` (×2), `pages/community/collections.js`,
-   `components/CollectionsPageView.js`. The `.card` class
-   (`styles/globals.css` L757) is a pre-redesign opaque
-   solid-fill panel. Most consumers should migrate to
-   `.glass-panel`; the class itself can either be retired or
-   retained as a documented "opaque fallback" for special cases.
-
-6. **Landing nav bar** (`pages/index.js` L61–72) — uses
-   `var(--glass-surface-mid)` flat + an incorrectly double-wrapped
-   `inset 0 1px 0` boxShadow. Not a gradient-border candidate
-   (full-bleed bar; corner lights would be at viewport edges, not
-   visible). Should use the existing `.page-header-glass` class
-   instead.
-
-Unifying these means the entire app shares one surface vocabulary.
-Future work — new modals, new dashboards, new public pages — picks
-up the gradient-border treatment automatically because the
-primitives are correct.
-
-## Scope
-
-### In scope
-
-#### Brief 1 — Upgrade `<GlassSurface>` primitive
-
-Add the 4-layer gradient-border pattern to the `<GlassSurface>`
-component so its `tint`, `blur`, `rim`, `elevation` props compose
-with corner catch-lights. Default to the **subtle** corner-light
-tokens (`--corner-light-{warm,cool}-subtle`) since most consumers
-are data cards. Add a `cornerLights="chrome" | "subtle" | "none"`
-prop so floating chrome can opt up and special opaque tiles
-(CardItem grid mode) can opt out.
-
-Consumers automatically upgraded:
-- `<Modal>` → corner lights on every modal
-- `<StatCard>` → corner lights on dashboard stat tiles
-- Landing feature cards (`pages/index.js` L132–224, L278–345)
-
-**Files:** `components/ui/GlassSurface.js`,
-`test/components/ui-primitives.test.js` (add a corner-light
-assertion).
-
-**Risk:** MED — the primitive's output structure changes (adds
-`border: 1px solid transparent`). Most consumers won't notice, but
-any consumer that set a custom `border` via style override could
-conflict. Audit needed.
-
-#### Brief 2 — Auth form cards
-
-`pages/login.js` L82–88 + `pages/signup.js` L227–232: replace
-the inline `className="p-8 rounded-2xl shadow-2xl backdrop-blur-sm
-border border-opacity-20" style={{ backgroundColor: 'rgba(...)' }}`
-shape with `className="glass-panel-strong rounded-2xl p-8"`.
-
-**Files:** `pages/login.js`, `pages/signup.js`.
-**Risk:** LOW.
-
-#### Brief 3 — Floating popovers / drawers
-
-Three independent floating surfaces:
-- `components/Layout.js` mobile drawer (L698–709)
-- `components/Layout.js` sidebar profile dropdown (L88–96)
-- `components/ui/TopSearchBar.js` UserMenu dropdown (L214–222)
-
-For each: drop the inline `background: var(--glass-surface-*)` +
-`backdropFilter` pair, add `className="glass-panel-strong rounded-2xl"`
-or `rounded-xl` to match existing dimensions. Preserve any
-additional `boxShadow: 'var(--ember-rim-subtle)'` adornments by
-chaining them onto the class's existing box-shadow (via inline
-style override).
-
-**Special handling for mobile drawer:** the drawer takes ~1/3 of
-the viewport. At full corner-light intensity it would be noisy.
-Use `.glass-panel-strong` (which uses the subtle tokens).
-
-**Files:** `components/Layout.js`, `components/ui/TopSearchBar.js`,
-`test/components/Layout.test.js` (regression assertions).
-**Risk:** LOW–MED — popovers appear over arbitrary page content.
-
-#### Brief 4 — `BulkSelectionToolbar`
-
-Replace `bg-white border-gray-200` on the toolbar (L47) and its
-"More actions" dropdown (L117) with `.glass-panel-strong rounded-2xl`.
-Sweep interior `text-gray-700 hover:bg-gray-100`,
-`text-red-600 hover:bg-red-50` to use `var(--text-primary)` /
-`nav-item-hover` and tokenized red for destructive actions.
-
-**Files:** `components/BulkSelectionToolbar.js`.
-**Risk:** MED — floats over all content during bulk-select mode;
-shadow/overflow bleed would be very visible.
-
-#### Brief 5 — `.card`-class consumers
-
-Audit every `<div className="card">` usage. For each, pick the
-right migration:
-- Most likely: `glass-panel rounded-3xl p-6` (preserves rounded-3xl
-  + p-6 from the old class).
-- Some may need to stay opaque (e.g. screenshot-friendly profile
-  card with photo overlay) — keep `.card` and document the
-  exception in `styles/globals.css`'s comment block.
-
-Decision to ratify: **retire `.card` entirely, OR keep as a
-documented opaque-panel alternative?** Architect's call. If kept,
-add a comment to `globals.css` explaining when to use which.
-
-**Files:** `pages/profile.js`, `pages/settings.js`,
-`pages/community/collections.js`,
-`components/CollectionsPageView.js`,
-optionally `styles/globals.css` (retire or document).
-**Risk:** LOW per page; sweep across 4 files.
-
-#### Brief 6 — Landing nav bar
-
-`pages/index.js` L61–72: replace the handrolled translucent header
-with `<header className="page-header-glass border-b ...">`. The
-`.page-header-glass` class already exists in `globals.css` for
-exactly this "full-bleed top band" use case. The current bar also
-has a malformed `boxShadow: 'inset 0 1px 0 var(--rim-light-inner)'`
-(the token already contains `inset 0 1px 0`; double-wrapping breaks
-the cascade). Remove the malformed shadow.
-
-**Files:** `pages/index.js`.
-**Risk:** LOW — public page, no auth dependencies.
-
-#### Brief 7 — Forbidden grep gate
-
-Add a `forbidden-bespoke-glass-surface` job to
-`.github/workflows/ci.yml` that fails the build if
-`var(--glass-surface-(low|mid|high))` appears in JSX inline styles
-across `components/**` and `pages/**`, with a curated allowlist
-for the documented exceptions (intentional chrome treatment in
-Layout/TopSearchBar; `<GlassSurface>` component itself; any
-opaque-fallback `.card` consumers ratified in Brief 5).
-
-Prevents regression: future PRs can't reintroduce handrolled glass.
-
-**Files:** `.github/workflows/ci.yml`.
-**Risk:** LOW.
-
-### Out of scope
-
-- `<CardItem>` grid-mode (L290–303) — intentionally opaque per
-  AGENTS.md GPU-budget rule.
-- `<CardItem>` list-mode token cleanup (L183–284) — covered by
-  the parallel `cleanup-card-item-list-and-share-modal-palette`
-  convoy.
-- Adding any NEW surfaces or panels.
-- `.card` rename to `.opaque-panel` — Brief 5 may retire the class
-  entirely; rename is a separate polish if it survives.
-
-## Roles invoked
-
-1. `role-architect` — surface-by-surface migration plan; ratifies
-   the `cornerLights` prop shape for `<GlassSurface>` and the
-   `.card` retire-vs-keep decision; writes Briefs 1–7.
-2. `role-design-system-auditor` — visual regression review on each
-   brief; confirms no chrome-vs-data-card hierarchy regressions.
-3. `role-ux-reviewer` — light pass; ensures auth form contrast +
-   mobile drawer legibility hold up post-migration.
-4. `role-implementer` — one per brief; Briefs 2, 3, 4, 6 are
-   parallel-safe (disjoint files, no shared component dependency
-   chain). Brief 1 MUST land first because Briefs 3, 4 may end up
-   simplifying their inline-style code by using the upgraded
-   primitive instead.
-5. `role-reviewer` — single post-PR review per brief.
-6. `role-a11y-auditor` — focus-ring + keyboard nav for new floating
-   surfaces (Brief 3 popovers especially).
-
-## Todos
-
-- [ ] Architect: surface-by-surface migration plan + `<GlassSurface>`
-      API spec (the `cornerLights` prop)
-- [ ] Design-system auditor: confirm subtle-tokens are the right
-      default for the upgraded `<GlassSurface>`
-- [ ] Brief 1 — `<GlassSurface>` primitive upgrade (BLOCKING for
-      Briefs 3, 4)
-- [ ] Brief 2 — auth form cards
-- [ ] Brief 3 — floating popovers (drawer, sidebar profile,
-      UserMenu)
-- [ ] Brief 4 — BulkSelectionToolbar
-- [ ] Brief 5 — `.card` consumers; Decision: retire or keep
-- [ ] Brief 6 — landing nav bar (`.page-header-glass`)
-- [ ] Brief 7 — `forbidden-bespoke-glass-surface` CI gate
-- [ ] Post-PR review per brief
-- [ ] Visual-diff baseline refresh after Brief 1 lands
-
-## Decisions to ratify
-
-1. **`<GlassSurface>` API shape post-upgrade.** Add `cornerLights`
-   prop with values `"chrome" | "subtle" | "none"`. Default
-   `"subtle"`. Architect confirms or proposes alternative.
-2. **Retire `.card` class entirely after Brief 5, or keep as
-   documented opaque fallback?** Conservative: keep + document
-   ("use when the surface must NOT have backdrop-filter — e.g.
-   inside another modal, screen-reader-critical, or
-   GPU-budget-constrained"). Aggressive: retire and migrate the
-   handful of legitimate opaque cases to inline style.
-3. **Mobile drawer corner-light intensity.** The drawer is a
-   large surface. Subtle tokens (matching `.glass-panel-strong`)
-   are likely right, but the architect should sanity-check
-   visually before locking it in.
-4. **CI gate scope for `forbidden-bespoke-glass-surface`.** Should
-   it gate ALL `var(--glass-surface-*)` usage in JSX, or only
-   inline `style={{ background: ... }}` usage? Recommended: only
-   inline styles, since the tokens still need to be referenceable
-   in `styles/globals.css`.
-
-## Acceptance criteria
-
-1. Every in-scope surface lists either `glass-panel`,
-   `glass-panel-strong`, `page-header-glass`, or `<GlassSurface>`
-   in its className (no inline `var(--glass-surface-*)` background).
-2. `<GlassSurface>` primitive's output includes the 4-layer
-   gradient-border pattern and a `border: 1px solid transparent`.
-3. CI's `forbidden-bespoke-glass-surface` job passes; introducing
-   a new bespoke `var(--glass-surface-low)` inline-style usage in
-   a scratch commit makes it fail (negative test).
-4. Build + lint + 113/113 vitest + Playwright smoke green.
-5. Visual diff shows the expected differences (corner catch-lights
-   appear on modals, dashboard stat tiles, auth cards, dropdowns)
-   and no unexpected regressions on chrome/cards/CardItem grid.
-
-## CI impact
-
-| Workflow / job | Behavior |
-| --- | --- |
-| `preview-smoke.yml` | Fires per brief. |
-| `visual-diff.yml` | **Fires + baseline refresh required** after Brief 1 lands (the primitive upgrade ripples through Modal/StatCard/landing). |
-| `lint` | Fires + new `forbidden-bespoke-glass-surface` gate after Brief 7. |
-| `test:` (vitest) | Fires; Brief 1 adds a corner-light assertion to `ui-primitives.test.js`. |
-
-## Known constraints
-
-- **No-go zones honoured** — `components/Layout.js.backup`,
-  `scripts/add-*.js` graveyard untouched.
-- **GPU budget for CardItem grid** — AGENTS.md explicitly
-  prohibits `backdrop-filter` per card thumbnail (it
-  multiplies); Brief 1 must NOT default `<GlassSurface>` to
-  any rendering that would pull CardItem into that prohibition.
-
-## Multitask dispatch
-
-```yaml
-slice_dependencies:
-  - brief: 1
-    depends_on: []
-    files:
-      - components/ui/GlassSurface.js
-      - test/components/ui-primitives.test.js
-  - brief: 2
-    depends_on: []
-    files:
-      - pages/login.js
-      - pages/signup.js
-  - brief: 3
-    depends_on: [1]  # may simplify by using upgraded primitive
-    files:
-      - components/Layout.js
-      - components/ui/TopSearchBar.js
-      - test/components/Layout.test.js
-  - brief: 4
-    depends_on: [1]
-    files:
-      - components/BulkSelectionToolbar.js
-  - brief: 5
-    depends_on: []
-    files:
-      - pages/profile.js
-      - pages/settings.js
-      - pages/community/collections.js
-      - components/CollectionsPageView.js
-      - styles/globals.css  # if .card is retired / documented
-  - brief: 6
-    depends_on: []
-    files:
-      - pages/index.js
-  - brief: 7
-    depends_on: [1, 2, 3, 4, 5, 6]  # gate goes in LAST
-    files:
-      - .github/workflows/ci.yml
-```
-
-Briefs 2, 5, 6 can run in parallel with Brief 1. Briefs 3, 4 wait
-for Brief 1 to land so they can simplify by using the upgraded
-primitive. Brief 7 runs LAST so the grep gate doesn't fail the
-build on in-flight migrations.
-
-## Out of scope follow-ups (queued)
-
-- **`retire-or-formalize-card-class`** — if Brief 5 Decision 2
-  keeps `.card` as opaque fallback, a future small convoy can
-  rename it `.opaque-panel` for clarity. P3.
-- **`storybook-adoption-for-glass-surface`** — once the primitive
-  has the full prop matrix (`tint`, `blur`, `rim`, `elevation`,
-  `cornerLights`), it's a natural Storybook candidate. P2 DX.
-
-## Architecture
-
-Run date: 2026-06-04. Architect: role-architect (this convoy).
-Reads: this convoy file, `AGENTS.md`, `.cursor/rules/*.mdc`,
-`components/ui/GlassSurface.js`, `components/ui/Modal.js`,
-`components/ui/StatCard.js`, `components/Layout.js`,
-`components/ui/TopSearchBar.js`, `components/BulkSelectionToolbar.js`,
-`pages/login.js`, `pages/signup.js`, `pages/index.js`,
-`pages/profile.js`, `pages/settings.js`,
-`pages/community/collections.js`,
-`components/CollectionsPageView.js`, `styles/globals.css`
-(`.card`, `.glass-panel`, `.glass-panel-strong`, `.page-header-glass`,
-the `--corner-light-*-subtle` tokens added in PR #118, the
-`--bg-secondary-rgb` token used by today's auth cards),
-`.github/workflows/ci.yml`, `test/components/ui-primitives.test.js`,
-`test/components/Layout.test.js`.
-
-### Decisions ratified
-
-The convoy file's four open Decisions are resolved as follows.
-Implementer briefs cite these and MUST NOT renegotiate them mid-flight
-(if a brief discovers a reason to revisit, escalate via the mid-convoy
-scope-expansion process in `role-architect.md`).
-
-**D1. `<GlassSurface>` `cornerLights` prop shape.** Add
-`cornerLights = 'subtle' | 'chrome' | 'none'`, **default `'subtle'`**.
-- `'subtle'` → applies the 4-layer gradient with
-  `--corner-light-warm-subtle` / `--corner-light-cool-subtle` (matches
-  what `.glass-panel-strong` ships today; PR #118).
-- `'chrome'` → applies the 4-layer gradient with full-intensity
-  `--corner-light-warm` / `--corner-light-cool`. Used by the Layout
-  sidebar nav-chip and TopSearchBar header — those keep their inline
-  styles for now; this prop value exists so future floating chrome
-  doesn't have to re-handroll the gradient.
-- `'none'` → no transparent border, no radials, no `--chip-border-base`
-  layer. Identical to today's primitive output. Used for the CardItem
-  grid path and any other GPU-budget-constrained tile that legitimately
-  must skip the gradient-border treatment.
-
-The gradient-border technique is the verbatim 4-layer recipe from
-`.glass-panel-strong` (`styles/globals.css` post-PR-#118): a
-padding-box solid linear-gradient of the fill, two border-box radial
-gradients for the corner catch-lights (warm 0%↔100%, cool 100%↔0%),
-and a border-box `var(--chip-border-base)` base layer. Combined with
-`border: 1px solid transparent` so the gradient renders through the
-border.
-
-**D2. `.card` class retire-or-keep.** **Retire the class entirely.**
-All 8 consumers migrate to `glass-panel rounded-3xl p-{6|4}`. The
-`.card` block in `styles/globals.css` is deleted. Rationale: a single
-glass vocabulary across the app is the convoy's success metric;
-keeping `.card` as a documented opaque fallback creates two parallel
-panel languages for future agents to choose between, which is exactly
-the kind of design-system bifurcation the convoy was scoped to
-eliminate. The GPU-budget concern that motivated keeping `.card` is
-specific to `<CardItem>` grid-mode (a non-`.card` consumer) — none
-of the 8 `.card` sites face that constraint (they're profile cards,
-settings panels, and a single community-page list tile, not a
-multiplied-per-thumbnail surface).
-
-Aggressive path; **risk** = one of the 8 sites has a hidden reason
-to be opaque that the architect didn't catch. Mitigation: Brief 5
-includes a "if any consumer breaks visually post-migration, revert
-that one consumer to inline `style={{ background:
-'var(--bg-secondary)' }}` and document the exception in the brief's
-post-merge note" escape hatch. That keeps the class deletion in the
-PR while leaving an explicit per-site fallback. If that escape hatch
-fires for more than 1 of the 8 consumers, the brief's reviewer is
-expected to push back and propose holding `.card` after all.
-
-**D3. Mobile-drawer corner-light intensity.** Use
-`.glass-panel-strong` (subtle tier). The drawer is a ~256px-wide
-fixed-position surface that covers ~1/3 of a mobile viewport. At
-full-intensity (`'chrome'`) the corner radials would dominate the
-drawer's interior nav text; at subtle they read as "elevated panel"
-without competing with content. The drawer is also a hidden surface
-most of the time — full intensity buys nothing for the rare moments
-it's open.
-
-**D4. CI gate scope.** Gate **inline-style usage only** —
-`var(--glass-surface-(low|mid|high))` appearing inside a JSX
-`style={{ background: ... }}` (or `backgroundColor:`, `background:`
-in template-string form) under `components/**` or `pages/**`. CSS
-class definitions in `styles/globals.css` (where the tokens are
-LEGITIMATELY chained to compose `.glass-panel` / `.glass-panel-strong`
-/ `.page-header-glass`) are not gated. Allowlist entries: the
-Layout sidebar nav-chip block (`components/Layout.js` L858-861) and
-the TopSearchBar header block (the equivalent inline-style block in
-`components/ui/TopSearchBar.js`) — both intentionally retain
-`'chrome'`-tier handrolled gradients and were ratified as such in
-PR #116. The `<GlassSurface>` primitive itself is also allowlisted
-(it sets the background internally; that's its job). Brief 7 ships
-this gate as a separate `forbidden-bespoke-glass-surface` job in
-`ci.yml`, modeled on the existing `forbidden-modal-shell-without-primitive`
-gate's grep-and-allowlist shape.
-
-### File plan
-
-| File | Action | Purpose | Brief |
-| --- | --- | --- | --- |
-| `components/ui/GlassSurface.js` | modified | Add `cornerLights` prop (`'subtle' \| 'chrome' \| 'none'`, default `'subtle'`); compose 4-layer gradient + `border: 1px solid transparent` when not `'none'` | 1 |
-| `test/components/ui-primitives.test.js` | modified | Add 3 corner-light assertions covering the 3 `cornerLights` values | 1 |
-| `pages/login.js` | modified | Replace L82-88 inline glass imitation with `<div className="glass-panel-strong rounded-2xl p-8">` | 2 |
-| `pages/signup.js` | modified | Replace L227-232 inline glass imitation with `<div className="glass-panel-strong rounded-2xl p-8">` | 2 |
-| `components/Layout.js` | modified | Sidebar profile dropdown (L88-96): drop inline background+blur+shadow, add `className="glass-panel-strong rounded-xl"`. Mobile drawer (L698-709): drop inline background+blur+shadow, add `className="glass-panel-strong"` and keep the slide-in transform classes. Sidebar nav-chip block (L858-861) untouched (chrome tier). | 3 |
-| `components/ui/TopSearchBar.js` | modified | UserMenu dropdown (L214-222): drop inline background+blur+shadow, add `className="glass-panel-strong rounded-xl"`. Header block (chrome tier) untouched. | 3 |
-| `test/components/Layout.test.js` | modified | Add regression-lock assertion: sidebar profile dropdown and mobile drawer carry `.glass-panel-strong` class. | 3 |
-| `components/BulkSelectionToolbar.js` | modified | L47 toolbar: replace `bg-white border-gray-200` with `glass-panel-strong rounded-2xl`. L117 dropdown: same swap on `rounded-lg` → `rounded-xl glass-panel-strong`. Sweep interior `text-gray-{600,700}` to `var(--text-primary/secondary)`; `hover:bg-gray-{50,100}` to `nav-item-hover`; `text-red-600 hover:bg-red-50` to `var(--accent-danger)` + ember-tinted hover. | 4 |
-| `pages/profile.js` | modified | 3 `.card` → `glass-panel rounded-3xl p-6` swaps. | 5 |
-| `pages/settings.js` | modified | 2 `.card` → `glass-panel rounded-3xl` swaps (one `p-4`, one `p-6`). | 5 |
-| `pages/community/collections.js` | modified | 1 `.card` → `glass-panel rounded-3xl` swap (preserve `group cursor-pointer hover:shadow-lg transition-all`). | 5 |
-| `components/CollectionsPageView.js` | modified | 1 `.card` → `glass-panel rounded-3xl` swap (preserve `hover:shadow-xl transition-all cursor-pointer group`). | 5 |
-| `styles/globals.css` | modified | **Delete** the `.card { ... }` rule (the class block that lives near L757). No other CSS changes. | 5 |
-| `pages/index.js` | modified | Landing nav bar (L61-72): replace handrolled inline style with `<nav className="page-header-glass border-b">`. Drop the malformed `boxShadow: 'inset 0 1px 0 var(--rim-light-inner)'` (the `.page-header-glass` class already sets the correct inset rim). | 6 |
-| `.github/workflows/ci.yml` | modified | Add `forbidden-bespoke-glass-surface` job per D4. | 7 |
-
-### API surface
-
-N/A. This convoy is pure UI/CSS surface composition. No new routes,
-no Zod schema additions, no rate-limit changes.
-
-### Schema diff
-
-N/A. No DB changes. No `migrations/` files added; no
-`scripts/add-*.js` follow-up. The schema-map-fresh CI job will not
-fire on any of these PRs (the conditional in `ci.yml` L47-52 checks
-`migrations/` / `scripts/add-*` / `scripts/fix-*` /
-`scripts/setup-neon-db.js` / `docs/SCHEMA_MAP.md` — none touched).
-
-### Test plan
-
-| Brief | Unit | Component | Smoke | Visual diff | Notes |
-| --- | --- | --- | --- | --- | --- |
-| 1 | — | **3 new assertions** in `test/components/ui-primitives.test.js` covering `cornerLights='subtle'` (default, expects `border: 1px solid transparent` in the rendered style attribute), `cornerLights='chrome'` (expects `--corner-light-warm` token reference, not `-subtle`), `cornerLights='none'` (expects no `border` declaration, no gradient layers — same shape as today). | Existing smoke tests cover Modal open/close; nothing new. | **Baseline refresh required** after Brief 1 lands — Modal/StatCard/landing feature cards all gain corner lights. Plan: queue the refresh as a single Linux-baselined commit immediately after Brief 1 merges, before Briefs 3/4 ship. | The most consequential brief; the assertions are the regression lock. |
-| 2 | — | None needed (presentational class swap). | Existing `tests/smoke/auth.spec.js` covers login/signup happy path; nothing new. | Auth pages diff expected. | — |
-| 3 | — | Regression-lock in `test/components/Layout.test.js`: render Layout with `isMobileMenuOpen={true}` (mocked) and assert the drawer container's `className` includes `glass-panel-strong`. Render with `<UserProfileDropdown>` open (mocked) and assert its dropdown container's `className` includes `glass-panel-strong`. | Existing smoke covers nav clicks. | Layout dropdown/drawer visual diff expected. | — |
-| 4 | — | None needed (rare to bulk-select in a smoke test). | — | Expected visual diff on the bulk-select toolbar — but only fires when one of the visual-diff `tests/visual/*` specs actually triggers bulk-select. Probably won't surface in the diff at all; rely on manual QA + dark-mode side-by-side screenshot for review. | The dark-mode invisibility is the regression we're closing; verify manually post-merge. |
-| 5 | — | None needed (className swap). | — | 4 pages worth of visual diff expected. | — |
-| 6 | — | None needed. | Existing smoke `tests/smoke/landing.spec.js` covers landing nav rendering. | Expected on landing. | — |
-| 7 | **Negative test** documented in the brief's acceptance criteria: an implementer dry-run that adds a scratch `style={{ background: 'var(--glass-surface-low)' }}` to a `components/` file should fail the new `forbidden-bespoke-glass-surface` job. Verified once by the architect via the boot-the-brief check below; not committed. | — | — | — | The grep gate runs in CI; no test code needed. |
-
-Reference test files for the brief authors:
-- `test/components/ui-primitives.test.js` (Button/Input/SearchBar test
-  patterns, jsdom env, cleanup pattern; Brief 1 extends in-file).
-- `test/components/Layout.test.js` (5 regression-lock assertions
-  established by `fix-layout-default-user` PR #15; Brief 3 extends).
-
-### Risk list
-
-1. **Brief 1 ripple effect** (**MED**). The `<GlassSurface>` primitive
-   feeds `<Modal>`, `<StatCard>`, and 4-5 landing-page feature cards.
-   Adding `border: 1px solid transparent` to every consumer changes
-   the rendered geometry by 2px in both axes — most consumers don't
-   notice (their `padding`/`gap` absorbs it), but any consumer that
-   relied on a 0-border box-model for pixel-exact layout will shift.
-   The `<Modal>` panel sets `maxWidth` in pixels and is centered via
-   flex — it's not sensitive. `<StatCard>` is in a 4-up grid — also
-   not sensitive. The landing feature cards use `grid` with `gap`
-   — not sensitive. But the visual-diff baseline refresh is
-   non-negotiable; queue it before Briefs 3 + 4 ship.
-2. **Brief 1 + GPU-budget constraint** (**LOW-MED**). AGENTS.md
-   forbids `backdrop-filter` per `CardItem` thumbnail. `<CardItem>`
-   does NOT use `<GlassSurface>` today, so adding gradient-border to
-   `<GlassSurface>` doesn't pull it in. The `'none'` cornerLights
-   value exists as a defensive escape hatch for any future tile
-   surface that DOES want `<GlassSurface>` without the gradient
-   layers. Brief 1's brief explicitly forbids changing CardItem
-   anywhere in this convoy.
-3. **Brief 3 popovers' z-index + box-shadow chain** (**LOW-MED**).
-   `.glass-panel-strong` ships with
-   `var(--rim-light-inner), var(--elevation-ambient)`. Today's
-   inline-style on the profile dropdown adds
-   `var(--ember-rim-subtle)` as a third shadow for ember emphasis;
-   today's mobile drawer uses `var(--elevation-pronounced)` (heavier
-   elevation than ambient). The brief MUST preserve these via an
-   inline-style override chained onto the class's box-shadow — DON'T
-   just drop them. Verbatim shape documented in Brief 3.
-4. **Brief 4 dark-mode regressions** (**LOW**). The bulk-select
-   toolbar is currently `bg-white` — invisible in dark mode. The
-   migration FIXES that regression but Brief 4's reviewer should
-   capture before/after dark-mode screenshots so the fix is
-   visible in PR review.
-5. **Brief 5 `.card` deletion risk** (**LOW-MED, conditional**).
-   Per D2, all 8 consumers migrate to `.glass-panel`. If any one of
-   them breaks visually (the architect doesn't expect this; the
-   8 sites are all "panel with content inside" surfaces), the
-   brief includes an escape hatch to revert that one site to
-   inline `style={{ background: 'var(--bg-secondary)' }}` rather
-   than holding the whole class deletion. If MORE than 1 of 8
-   needs the escape hatch, the brief's reviewer is expected to
-   push back and propose keeping `.card`.
-6. **Brief 6 `.page-header-glass` already-applied check** (**LOW**).
-   The implementer must verify `pages/index.js`'s nav bar isn't
-   already inside another `.page-header-glass` ancestor (it isn't —
-   landing has no shared Layout); otherwise nested
-   `backdrop-filter`s would compound.
-7. **Brief 7 false-positive risk** (**LOW**). The grep gate must
-   correctly distinguish JSX inline-style usage of
-   `var(--glass-surface-*)` from CSS class definitions in
-   `styles/globals.css`. The architect-prescribed approach is to
-   restrict the grep to files under `components/**` and `pages/**`
-   (excluding `.css`), which by construction means JSX inline-style
-   only. Brief 7 includes a verbatim grep command shape and the
-   2-entry allowlist.
-8. **PR #117 + PR #118 not yet merged** (**LOW, dependency**). This
-   convoy's `depends_on:` frontmatter lists both. If either fails
-   review, the briefs may need to refactor against a different
-   baseline. Recommended: hold Brief 1 dispatch until PR #117 + PR
-   #118 are both squash-merged to main.
-
-### Decomposition
-
-| Brief # | Title | Files | Depends on | LOC est. |
-| --- | --- | --- | --- | --- |
-| 1 | Upgrade `<GlassSurface>` primitive with `cornerLights` prop | `components/ui/GlassSurface.js`, `test/components/ui-primitives.test.js` | — | ~80 |
-| 2 | Migrate auth form cards to `.glass-panel-strong` | `pages/login.js`, `pages/signup.js` | — | ~20 |
-| 3 | Migrate floating popovers to `.glass-panel-strong` | `components/Layout.js`, `components/ui/TopSearchBar.js`, `test/components/Layout.test.js` | 1 | ~90 |
-| 4 | Migrate `BulkSelectionToolbar` to `.glass-panel-strong` + token sweep | `components/BulkSelectionToolbar.js` | 1 | ~70 |
-| 5 | Retire `.card` class; migrate 8 consumers to `.glass-panel` | `pages/profile.js`, `pages/settings.js`, `pages/community/collections.js`, `components/CollectionsPageView.js`, `styles/globals.css` | — | ~30 |
-| 6 | Migrate landing nav bar to `.page-header-glass` | `pages/index.js` | — | ~10 |
-| 7 | `forbidden-bespoke-glass-surface` CI gate | `.github/workflows/ci.yml` | 1, 2, 3, 4, 5, 6 | ~40 |
-
-All briefs target <400 LOC; the largest (Brief 3) is ~90 LOC. Files
-across briefs are disjoint — verified against the slice_dependencies
-block above. No two parallel writers on the same file.
-
-Parallel dispatch recommended for Briefs 1, 2, 5, 6 (no deps, disjoint
-files). Briefs 3 + 4 wait for Brief 1 to land (per D1 — they may
-simplify by adopting the upgraded primitive's `cornerLights='subtle'`
-default rather than handrolling). Brief 7 runs LAST so the grep gate
-doesn't fail the build on in-flight migrations.
-
-### Boot-the-brief check
-
-Read-only verification against the post-PR-#117 + post-PR-#118 tree.
-
-1. **Dep-set check.** No new npm dependencies added by any brief. The
-   gradient-border recipe is pure CSS; the `cornerLights` prop is
-   pure React composition; the CI gate is a shell `grep` invocation
-   in a YAML job. No `pnpm view` / `package.json` audit needed.
-2. **Verbatim code-shape check.**
-   - Brief 1's 4-layer recipe matches `.glass-panel-strong`'s current
-     shape verbatim — verified against `styles/globals.css` post-PR
-     #118 (the `background:` block uses
-     `linear-gradient(var(--glass-surface-high), ...) padding-box,
-     radial-gradient(at 0% 100%, var(--corner-light-warm-subtle) ...) border-box,
-     radial-gradient(at 100% 0%, var(--corner-light-cool-subtle) ...) border-box,
-     var(--chip-border-base) border-box`). The primitive's
-     `'chrome'` value uses the non-`-subtle` tokens; both pairs exist
-     in `:root` + `[data-theme="dark"]` (verified).
-   - Brief 3's box-shadow preservation: the sidebar profile dropdown
-     ships `var(--rim-light-inner), var(--ember-rim-subtle),
-     var(--elevation-ambient)`; the mobile drawer ships
-     `var(--rim-light-inner), var(--rim-light-outer),
-     var(--elevation-pronounced)`; the TopSearchBar UserMenu dropdown
-     ships `var(--rim-light-inner), var(--ember-rim-subtle),
-     var(--elevation-pronounced)` (verified during boot-the-brief
-     recheck — uses `-pronounced`, not `-ambient`, because it floats
-     higher in the viewport). All three are preserved as inline
-     `style={{ boxShadow: '...' }}` overrides on the
-     `.glass-panel-strong` element (the class's default
-     `var(--rim-light-inner), var(--elevation-ambient)` would otherwise
-     lose the ember-rim and either heavier elevation). Brief 3
-     documents the verbatim chain.
-   - Brief 5's class deletion: the `.card` block in
-     `styles/globals.css` is a single rule; deleting it is a clean
-     diff (verified by reading L750-L770 area — no other `.card`
-     compound selectors exist).
-   - Brief 7's grep command shape: modeled on the existing
-     `forbidden-modal-shell-without-primitive` job (`ci.yml`
-     L200-L226), which uses
-     `grep -lE 'pattern' pages components -r --include='*.js'`.
-     Same shape works here. Allowlist is implemented via
-     `! -path 'components/ui/GlassSurface.js'` and an explicit
-     line-range exclusion for `components/Layout.js` and
-     `components/ui/TopSearchBar.js` (the chrome blocks).
-3. **Cross-brief commitments.** None. Each brief lands a complete
-   migration of its scope; no brief introduces a stub or forward
-   declaration that another brief resolves. Brief 7's grep gate
-   passes ONLY AFTER Briefs 1-6 land — that's a dispatch ordering
-   constraint (encoded in `depends_on:`), not a cross-brief
-   commitment in the role-architect sense.
-
-All checks passed. No briefs need revision.

.convoys/unify-glass-panel-surfaces/brief-1-upgrade-glass-surface-primitive.md

@@ -1,82 +0,0 @@
----
-convoy: unify-glass-panel-surfaces
-brief_number: 1
-depends_on: []
-files:
-  - components/ui/GlassSurface.js
-  - test/components/ui-primitives.test.js
----
-
-# Brief 1: Upgrade `<GlassSurface>` primitive with `cornerLights` prop
-
-## Goal (1 sentence)
-
-Add a `cornerLights = 'subtle' | 'chrome' | 'none'` prop to `<GlassSurface>` and compose the 4-layer gradient-border pattern (padding-box fill + two border-box corner radials + `--chip-border-base` base) on top of the existing `tint` / `blur` / `rim` / `elevation` props so every consumer (Modal, StatCard, landing feature cards) picks up corner catch-lights automatically.
-
-## Files in scope (do not edit anything else)
-
-- `components/ui/GlassSurface.js` — add the prop, compose the 4-layer `background` and the `border: 1px solid transparent` when the prop is not `'none'`.
-- `test/components/ui-primitives.test.js` — add 3 corner-light assertions to the existing `describe('GlassSurface', ...)` block (or add the block if it doesn't exist; today the file covers Button / Input / SearchBar only, so a new top-level `describe('GlassSurface', ...)` block at the end of the file is correct).
-
-**Out of scope:** every consumer of `<GlassSurface>` — `components/ui/Modal.js`, `components/ui/StatCard.js`, `pages/index.js` landing cards. Their behavior changes via the new default; no edits required. Do NOT modify them in this PR.
-
-## Conventions to follow
-
-- **Verbatim 4-layer recipe** (mirrors `.glass-panel-strong` post-PR #118; see `styles/globals.css`):
-  ```js
-  // When cornerLights === 'subtle' (default):
-  background:
-    `linear-gradient(var(--glass-surface-${tint}), var(--glass-surface-${tint})) padding-box,
-     radial-gradient(at 0% 100%, var(--corner-light-warm-subtle) 0%, transparent 42%) border-box,
-     radial-gradient(at 100% 0%, var(--corner-light-cool-subtle) 0%, transparent 42%) border-box,
-     var(--chip-border-base) border-box`
-  // When cornerLights === 'chrome':
-  // Same recipe; swap --corner-light-warm-subtle → --corner-light-warm
-  // and --corner-light-cool-subtle → --corner-light-cool.
-  // When cornerLights === 'none':
-  // Today's behavior — single layer background: var(--glass-surface-${tint}).
-  // No border declaration.
-  ```
-- **Border declaration**: when `cornerLights !== 'none'`, also set
-  `border: '1px solid transparent'` on the composed style. This is what
-  reveals the border-box gradient layers. When `'none'`, omit the
-  border entirely (preserve today's box-model).
-- **Shadow stack**: unchanged. The existing `RIM_SHADOWS` /
-  `ELEVATION_SHADOWS` composition logic stays exactly as written. The
-  corner-light layers live in `background`, not `box-shadow`.
-- **Default value**: `cornerLights = 'subtle'`. This is the new default
-  for every consumer that doesn't pass the prop explicitly.
-- **Backdrop filter**: unchanged. `backdropFilter` /
-  `WebkitBackdropFilter` continue to compose from `blur` / `tint` exactly
-  as today. Do not touch this line.
-- **`style` prop merging**: today the composed style spreads
-  `...style` LAST so caller overrides win. Preserve that exactly — a
-  caller passing `style={{ border: '1px solid #f00' }}` overrides the
-  transparent border. This is the explicit escape hatch any consumer
-  who needs a real border can use without setting `cornerLights='none'`.
-- **AGENTS.md / no-go zones**: `styles/globals.css` is untouched in
-  this brief (Brief 5 owns the `.card` deletion; no other CSS edits in
-  this convoy). The `--corner-light-warm-subtle` /
-  `--corner-light-cool-subtle` /  `--corner-light-warm` /
-  `--corner-light-cool` / `--chip-border-base` tokens all exist
-  in `:root` and `[data-theme="dark"]` per PR #118 — verified.
-
-## Acceptance criteria
-
-- [ ] `<GlassSurface>` accepts a `cornerLights` prop with values `'subtle'` (default), `'chrome'`, `'none'`. Any other value falls back to `'subtle'` (mirror the existing `RIM_SHADOWS[rim] ?? []` defensive fallback shape).
-- [ ] When `cornerLights='subtle'`, rendered output includes:
-  - `background:` containing both `var(--corner-light-warm-subtle)` and `var(--corner-light-cool-subtle)`.
-  - `border:` value `1px solid transparent`.
-- [ ] When `cornerLights='chrome'`, rendered output includes:
-  - `background:` containing `var(--corner-light-warm)` and `var(--corner-light-cool)` (NOT the `-subtle` variants).
-  - `border:` value `1px solid transparent`.
-- [ ] When `cornerLights='none'`, rendered output is identical to today: single-layer `background: var(--glass-surface-${tint})`, no `border` declaration in the composed style.
-- [ ] `tint` / `blur` / `rim` / `elevation` / `as` / `style` / `className` props all behave exactly as before. Existing consumers continue to compile + render without prop changes.
-- [ ] `test/components/ui-primitives.test.js` has 3 new assertions (one per `cornerLights` value) verifying the inline style attribute or the rendered element's `style.background` / `style.border` accordingly. Use the existing `render` + `screen.getByRole` / `getByText` / `container` patterns from the file; don't pull in new test deps.
-- [ ] `npm run lint` passes.
-- [ ] `npm run test:run` is 22+/22+ (today's count is 21; this brief adds at least 3 — exact count depends on whether you split assertions across multiple `it(...)` blocks).
-- [ ] No edits to files outside the two listed in `files:` above. **No consumer migrations in this PR.** Brief 3 + 4 will compose against the new default; Briefs 2 + 5 + 6 don't use the primitive.
-
-## Rationale (≤3 sentences)
-
-The primitive is the single largest leverage point in the convoy — upgrading it ripples through `<Modal>`, `<StatCard>`, and the landing-page feature cards in one commit. Defaulting to `'subtle'` matches the PR #118 token-tier decision and means downstream consumers don't need to opt in. The `'chrome'` + `'none'` values exist so the prop is future-proof: floating chrome can opt up without handrolling, and any GPU-constrained tile (e.g. a future <CardItem>-like surface) can opt out cleanly.

.convoys/unify-glass-panel-surfaces/brief-2-auth-form-cards.md

@@ -1,79 +0,0 @@
----
-convoy: unify-glass-panel-surfaces
-brief_number: 2
-depends_on: []
-files:
-  - pages/login.js
-  - pages/signup.js
----
-
-# Brief 2: Migrate auth form cards to `.glass-panel-strong`
-
-## Goal (1 sentence)
-
-Replace the handrolled `rgba(var(--bg-secondary-rgb), 0.85)` + `backdrop-blur-sm` glass imitation on the login + signup form cards with the canonical `.glass-panel-strong rounded-2xl p-8` className so the auth flow shares the rest of the app's surface treatment (corner catch-lights, system blur tier, gradient border).
-
-## Files in scope (do not edit anything else)
-
-- `pages/login.js` — replace the form-card container `<div>` (currently L82-88, look for the `className="p-8 rounded-2xl shadow-2xl backdrop-blur-sm border border-opacity-20"` + inline `backgroundColor: 'rgba(var(--bg-secondary-rgb), 0.85)'`).
-- `pages/signup.js` — same migration on the form-card container (currently L227-232 in the symmetric `<div className="p-8 rounded-2xl shadow-2xl backdrop-blur-sm ...">` block).
-
-**Out of scope:** the surrounding layout/header on either page, the `<Input>` / `<Button>` children, error/success banners, any of the legend/divider/social-button styling below the form. Do not touch them.
-
-## Conventions to follow
-
-- **Verbatim replacement** for each card container:
-  ```jsx
-  // Before:
-  <div
-    className="p-8 rounded-2xl shadow-2xl backdrop-blur-sm border border-opacity-20"
-    style={{
-      backgroundColor: 'rgba(var(--bg-secondary-rgb), 0.85)',
-      borderColor: 'var(--border)',
-    }}
-  >
-
-  // After:
-  <div className="glass-panel-strong rounded-2xl p-8">
-  ```
-  The `style={{}}` block is removed entirely. `.glass-panel-strong`
-  already composes the background, blur, rim, elevation, and the
-  gradient-border treatment.
-- **No new imports.** This brief does NOT use `<GlassSurface>`
-  directly — the className path is correct because (a) it's an HTML
-  div with no compositional requirements, (b) the existing
-  `.glass-panel-strong` class is the documented canonical shape per
-  the design audit, and (c) using the class keeps the diff minimal.
-- **Preserve children verbatim.** The `<form>`, every `<Input>`, every
-  `<Button>`, the error banner, the social-sign-in divider, the
-  "Don't have an account?" footer link — all stay byte-identical.
-- **Do not adjust the surrounding header block** (Deck Hearth logo +
-  greeting text); only the form-card `<div>` itself migrates.
-- **Tailwind safelist note:** `.glass-panel-strong` is defined in
-  `styles/globals.css` as a plain CSS class (not a Tailwind
-  utility). It's already used in `<Layout>` and elsewhere, so the
-  build picks it up via the `@layer` block. No `tailwind.config.js`
-  edit needed.
-
-## Acceptance criteria
-
-- [ ] `pages/login.js` form-card `<div>` uses
-      `className="glass-panel-strong rounded-2xl p-8"` and carries
-      no inline `backgroundColor` / `borderColor` style.
-- [ ] `pages/signup.js` form-card `<div>` uses
-      `className="glass-panel-strong rounded-2xl p-8"` and carries
-      no inline `backgroundColor` / `borderColor` style.
-- [ ] All form fields, labels, buttons, error banners, and footer
-      links render identically post-migration (manual smoke;
-      `tests/smoke/auth.spec.js` continues to pass without edits).
-- [ ] No edits to other files (e.g. no token additions in
-      `styles/globals.css`, no new components in `components/ui/`).
-- [ ] `npm run lint` passes; `npm run test:run` is unchanged
-      (no test additions needed for a pure className swap).
-- [ ] Dark mode: card remains legible against the body background
-      gradient (verify manually; before-shot vs after-shot screenshot
-      attached to the PR description).
-
-## Rationale (≤3 sentences)
-
-These two cards are the first surfaces a new user sees and they predate the `.glass-panel-strong` system; aligning them is both a correctness fix (the `rgba(--bg-secondary-rgb, 0.85)` shape doesn't compose corner lights) and a consistency win. The migration is a pure className swap with zero behavioral change — the lowest-risk brief in the convoy.

.convoys/unify-glass-panel-surfaces/brief-3-floating-popovers.md

@@ -1,160 +0,0 @@
----
-convoy: unify-glass-panel-surfaces
-brief_number: 3
-depends_on: [1]
-files:
-  - components/Layout.js
-  - components/ui/TopSearchBar.js
-  - test/components/Layout.test.js
----
-
-# Brief 3: Migrate floating popovers to `.glass-panel-strong`
-
-## Goal (1 sentence)
-
-Migrate three floating surfaces — the sidebar profile dropdown, the mobile drawer, and the TopSearchBar `<UserMenu>` dropdown — from inline `var(--glass-surface-*)` + `backdropFilter` styles to the canonical `.glass-panel-strong` className, while preserving their existing box-shadow chains (ember rim for the profile dropdown; pronounced elevation for the drawer) via inline override.
-
-## Files in scope (do not edit anything else)
-
-- `components/Layout.js`
-  - Sidebar profile dropdown panel (currently around L88-96 inside `<UserProfileDropdown>`).
-  - Mobile drawer slide-in panel (currently around L698-709 — the `<div>` that takes `${isMobileMenuOpen ? 'translate-x-0' : '-translate-x-full'}` and the `style={{ background: 'var(--glass-surface-mid)', backdropFilter: '...', ... }}` block).
-  - **Do NOT touch** the sidebar nav-chip block (around L858-861); that block intentionally uses full-intensity chrome corner lights and stays handrolled — Decision 4 of this convoy's Architecture allowlists it explicitly.
-- `components/ui/TopSearchBar.js`
-  - `<UserMenu>` dropdown panel (around L214-222 — the absolutely-positioned `<div>` with the `background: 'var(--glass-surface-high)'` + `backdropFilter` block).
-  - **Do NOT touch** the TopSearchBar `<header>` block itself; that block also intentionally uses full-intensity chrome corner lights and is allowlisted.
-- `test/components/Layout.test.js`
-  - Add regression-lock assertions that the sidebar profile dropdown and mobile drawer render with `.glass-panel-strong` in their className.
-
-**Out of scope:** the rest of `Layout.js` (`<DesktopSidebar>`, `<MobileNavigation>`, `<UserProfileDropdown>` trigger button, `<DailyEmberWidget>`, etc.), the rest of `TopSearchBar.js` (search input, `<CommandPaletteModal>` link, etc.), and any deeper menu-item styling (e.g. `hover:bg-gray-50 dark:hover:bg-gray-700` cleanup — that's owned by PR #117 / `design-sweep-pass`).
-
-## Conventions to follow
-
-- **Verbatim replacement** for each floating-surface `<div>`:
-
-  ### A. Sidebar profile dropdown panel (Layout.js)
-  ```jsx
-  // Before:
-  <div
-    className="absolute bottom-full left-0 right-0 mb-2 rounded-xl z-20"
-    style={{
-      background: 'var(--glass-surface-high)',
-      backdropFilter: 'blur(var(--glass-blur-mid)) saturate(var(--glass-saturate))',
-      WebkitBackdropFilter: 'blur(var(--glass-blur-mid)) saturate(var(--glass-saturate))',
-      boxShadow: 'var(--rim-light-inner), var(--ember-rim-subtle), var(--elevation-ambient)',
-    }}
-  >
-
-  // After:
-  <div
-    className="glass-panel-strong absolute bottom-full left-0 right-0 mb-2 rounded-xl z-20"
-    style={{
-      boxShadow:
-        'var(--rim-light-inner), var(--ember-rim-subtle), var(--elevation-ambient)',
-    }}
-  >
-  ```
-  The `background` + `backdropFilter` + `WebkitBackdropFilter` inline
-  styles are removed (the class provides them). The `boxShadow` is
-  **preserved as an inline override** because `.glass-panel-strong`
-  ships only `var(--rim-light-inner), var(--elevation-ambient)` —
-  we need the `var(--ember-rim-subtle)` middle entry to keep the
-  ember emphasis the dropdown is known for.
-
-  ### B. Mobile drawer panel (Layout.js)
-  ```jsx
-  // Before:
-  <div
-    className={`
-      md:hidden fixed inset-y-0 left-0 z-50 w-64 transform transition-transform duration-300 ease-in-out
-      ${isMobileMenuOpen ? 'translate-x-0' : '-translate-x-full'}
-    `}
-    style={{
-      background: 'var(--glass-surface-mid)',
-      backdropFilter: 'blur(var(--glass-blur-mid)) saturate(var(--glass-saturate))',
-      WebkitBackdropFilter: 'blur(var(--glass-blur-mid)) saturate(var(--glass-saturate))',
-      boxShadow: 'var(--rim-light-inner), var(--rim-light-outer), var(--elevation-pronounced)',
-    }}
-  >
-
-  // After:
-  <div
-    className={`
-      glass-panel-strong md:hidden fixed inset-y-0 left-0 z-50 w-64 transform transition-transform duration-300 ease-in-out
-      ${isMobileMenuOpen ? 'translate-x-0' : '-translate-x-full'}
-    `}
-    style={{
-      boxShadow:
-        'var(--rim-light-inner), var(--rim-light-outer), var(--elevation-pronounced)',
-    }}
-  >
-  ```
-  Same pattern. `boxShadow` is preserved as an inline override so the
-  drawer keeps its `var(--elevation-pronounced)` (heavier) elevation
-  + `var(--rim-light-outer)` (which `.glass-panel-strong` doesn't
-  ship by default).
-
-  ### C. TopSearchBar `<UserMenu>` dropdown panel
-  ```jsx
-  // Before — the absolutely-positioned <div> nested inside UserMenu,
-  // around L211-222 of TopSearchBar.js (verified against current file
-  // 2026-06-04 during architect boot-the-brief recheck):
-  <div
-    role="menu"
-    aria-label="Account menu"
-    className="absolute right-0 top-full mt-2 w-56 rounded-xl z-30 overflow-hidden"
-    style={{
-      background: 'var(--glass-surface-high)',
-      backdropFilter: 'blur(var(--glass-blur-mid)) saturate(var(--glass-saturate))',
-      WebkitBackdropFilter: 'blur(var(--glass-blur-mid)) saturate(var(--glass-saturate))',
-      boxShadow:
-        'var(--rim-light-inner), var(--ember-rim-subtle), var(--elevation-pronounced)',
-    }}
-  >
-
-  // After:
-  <div
-    role="menu"
-    aria-label="Account menu"
-    className="glass-panel-strong absolute right-0 top-full mt-2 w-56 rounded-xl z-30 overflow-hidden"
-    style={{
-      boxShadow:
-        'var(--rim-light-inner), var(--ember-rim-subtle), var(--elevation-pronounced)',
-    }}
-  >
-  ```
-  Note: this dropdown uses `--elevation-pronounced` (not `-ambient`)
-  — it's a heavier shadow than the sidebar profile dropdown's because
-  it floats higher in the viewport over more content. Preserve that
-  verbatim; do not normalize to `-ambient`. The `role="menu"` +
-  `aria-label="Account menu"` + `overflow-hidden` attributes also stay
-  byte-identical.
-
-- **Preserve all children verbatim.** Menu items, dividers, icons,
-  click handlers — all stay byte-identical.
-- **Do not touch the existing `hover:bg-gray-50 dark:hover:bg-gray-700`
-  classes on individual menu items.** PR #117 (`design-sweep-pass`)
-  is already migrating those to `nav-item-hover`; this brief MUST NOT
-  duplicate that work or it'll merge-conflict. If PR #117 has already
-  merged when this brief dispatches, the relevant lines may already
-  read `nav-item-hover` — that's fine; just leave them alone.
-- **Test additions in `test/components/Layout.test.js`:**
-  - One assertion for the sidebar profile dropdown: render `<Layout user={mockUser} />`, simulate clicking the user-profile trigger to open the dropdown, assert the dropdown panel `className` contains `'glass-panel-strong'`.
-  - One assertion for the mobile drawer: render `<Layout user={mockUser} />`, simulate opening the drawer (today the test file already has a way to set `isMobileMenuOpen`; if not, render with the relevant prop / state directly), assert the drawer panel `className` contains `'glass-panel-strong'`.
-  - Use the existing test file's patterns (jsdom env, `cleanup()` afterEach, `render` + `screen` from `@testing-library/react`). Do NOT add new test dependencies. Do NOT lower any existing assertion in the file.
-
-## Acceptance criteria
-
-- [ ] Sidebar profile dropdown panel uses `className="glass-panel-strong ..."` and carries an inline `boxShadow` with `var(--rim-light-inner), var(--ember-rim-subtle), var(--elevation-ambient)`.
-- [ ] Mobile drawer panel uses `className="glass-panel-strong ..."` and carries an inline `boxShadow` with `var(--rim-light-inner), var(--rim-light-outer), var(--elevation-pronounced)`.
-- [ ] TopSearchBar `<UserMenu>` dropdown panel uses `className="glass-panel-strong ..."` and carries an inline `boxShadow` with `var(--rim-light-inner), var(--ember-rim-subtle), var(--elevation-pronounced)`.
-- [ ] No inline `background: 'var(--glass-surface-*)'` or `backdropFilter` style remains on any of the three migrated `<div>`s.
-- [ ] Sidebar nav-chip block (Layout.js ~L858-861) UNCHANGED. TopSearchBar `<header>` block UNCHANGED. (Architect's allowlist for chrome-tier surfaces.)
-- [ ] `test/components/Layout.test.js` has at least 2 new assertions (sidebar dropdown + mobile drawer carry `glass-panel-strong`).
-- [ ] `npm run lint` + `npm run test:run` (23+/23+, post Brief 1) pass.
-- [ ] Manual: open sidebar profile dropdown, open mobile drawer, open TopSearchBar UserMenu dropdown in light + dark mode — all three render with visible corner catch-lights and the appropriate shadow elevation.
-- [ ] No edits to files outside the 3 listed in `files:` above.
-
-## Rationale (≤3 sentences)
-
-These three popovers are the most visible floating surfaces in the authenticated app and they predate the gradient-border system; migrating them is the largest visual-correctness win of the convoy after Brief 1. Preserving the existing box-shadow chains via inline override (rather than letting them snap to the class default) is non-negotiable — the `var(--ember-rim-subtle)` ember emphasis on the profile menu and the `var(--elevation-pronounced)` weight on the drawer are deliberate design choices that must survive the class swap.

.convoys/unify-glass-panel-surfaces/brief-4-bulk-selection-toolbar.md

@@ -1,123 +0,0 @@
----
-convoy: unify-glass-panel-surfaces
-brief_number: 4
-depends_on: [1]
-files:
-  - components/BulkSelectionToolbar.js
----
-
-# Brief 4: Migrate `BulkSelectionToolbar` to `.glass-panel-strong` + token sweep
-
-## Goal (1 sentence)
-
-Replace the bulk-select toolbar's `bg-white border-gray-200` Tailwind shape with `.glass-panel-strong rounded-2xl` so the floating toolbar is legible in dark mode, and sweep its interior hardcoded gray/red Tailwind classes (`text-gray-700`, `hover:bg-gray-100`, `text-red-600 hover:bg-red-50`) to token-driven inline styles + `nav-item-hover` for consistency with the rest of the post-PR-#117 surfaces.
-
-## Files in scope (do not edit anything else)
-
-- `components/BulkSelectionToolbar.js` — the entire file. Specifically:
-  - L47 outer toolbar `<div>` — swap `bg-white rounded-xl shadow-2xl border border-gray-200` to `glass-panel-strong rounded-2xl shadow-2xl`. (Keep `shadow-2xl` for now — the toolbar floats over arbitrary content and the extra weight is intentional. `.glass-panel-strong`'s `var(--rim-light-inner), var(--elevation-ambient)` chain doesn't include it; chain it via inline override.)
-  - L60 divider — swap `bg-gray-300` to a CSS-var-driven divider color (`backgroundColor: 'var(--border)'` inline, since `bg-gray-300` doesn't theme).
-  - L53 selection-count label — swap `text-gray-700` to `style={{ color: 'var(--text-primary)' }}`.
-  - L108 more-actions trigger — swap `text-gray-600 hover:text-gray-800 hover:bg-gray-100` to use `var(--text-secondary)` + `nav-item-hover`, with `rounded-lg` upgraded to `rounded-xl`.
-  - L117 more-actions dropdown — swap `bg-white rounded-lg shadow-xl border border-gray-200` to `glass-panel-strong rounded-xl`. (Drop `shadow-xl`; the class provides shadow. Keep `border` semantics out — the class's gradient border is the new look.)
-  - L118-141 menu items — swap `text-gray-700 hover:bg-gray-100` to `var(--text-primary)` + `nav-item-hover` className.
-  - L144 menu divider — swap `border-gray-200` to `borderColor: 'var(--border)'`.
-  - L146-157 destructive menu item — swap `text-red-600 hover:bg-red-50` to `color: 'var(--accent-danger)'` (verify the token exists in `globals.css`; if not, fall back to `rgb(239, 68, 68)` and document) + `nav-item-hover` className.
-  - L160-end "Clear Selection" button — sweep any remaining `text-gray-*` / `bg-gray-*` hardcodes the same way.
-
-**Out of scope:** the parent components that consume `BulkSelectionToolbar` (e.g. `pages/my-cards.js`, `components/CollectionPageView.js`); the props contract (`selectedCount`, `selectedCards`, all the `onBulk*` callbacks); any of the SVG icon paths.
-
-## Conventions to follow
-
-- **Outer toolbar:**
-  ```jsx
-  // Before:
-  <div className="bg-white rounded-xl shadow-2xl border border-gray-200 px-3 sm:px-6 py-3 sm:py-4 flex items-center justify-between sm:justify-start sm:space-x-4 sm:min-w-96">
-
-  // After:
-  <div
-    className="glass-panel-strong rounded-2xl px-3 sm:px-6 py-3 sm:py-4 flex items-center justify-between sm:justify-start sm:space-x-4 sm:min-w-96"
-    style={{
-      // Chain shadow-2xl-equivalent depth onto the class's existing
-      // rim+ambient stack so the floating toolbar still reads as
-      // elevated over arbitrary page content.
-      boxShadow:
-        'var(--rim-light-inner), var(--elevation-pronounced)',
-    }}
-  >
-  ```
-  Rationale: `shadow-2xl` is a hardcoded RGB; `var(--elevation-pronounced)` is the system equivalent and respects the theme.
-
-- **More-actions dropdown:**
-  ```jsx
-  // Before:
-  <div className="absolute bottom-full right-0 mb-2 bg-white rounded-lg shadow-xl border border-gray-200 py-2 min-w-48">
-
-  // After:
-  <div className="glass-panel-strong absolute bottom-full right-0 mb-2 rounded-xl py-2 min-w-48">
-  ```
-  No inline-style override needed — the class's default
-  `var(--rim-light-inner), var(--elevation-ambient)` is the right
-  weight for an inner dropdown.
-
-- **Menu items** (the `<button>` rows inside the dropdown):
-  ```jsx
-  // Before (non-destructive item):
-  <button className="w-full px-4 py-2 text-left text-sm text-gray-700 hover:bg-gray-100 flex items-center space-x-2">
-
-  // After:
-  <button
-    className="nav-item-hover w-full px-4 py-2 text-left text-sm flex items-center space-x-2"
-    style={{ color: 'var(--text-primary)' }}
-  >
-
-  // Before (destructive item):
-  <button className="w-full px-4 py-2 text-left text-sm text-red-600 hover:bg-red-50 flex items-center space-x-2">
-
-  // After:
-  <button
-    className="nav-item-hover w-full px-4 py-2 text-left text-sm flex items-center space-x-2"
-    style={{ color: 'var(--accent-danger)' }}
-  >
-  ```
-
-- **Verify `--accent-danger` exists** before using it. Quick check:
-  search `styles/globals.css` for `--accent-danger`. If absent, the
-  PR #117 sweep likely defines it; if it's still absent post-#117,
-  use `color: 'rgb(239, 68, 68)'` (the literal Tailwind `red-500`
-  RGB) and add a note in the PR description requesting follow-up to
-  introduce the token in a separate PR. Do NOT add the token in this
-  brief — token additions belong in a design-system PR.
-
-- **Verify `nav-item-hover` exists** — it's defined in
-  `styles/globals.css` and used widely post-PR #117. If for some
-  reason this brief dispatches before PR #117 lands, escalate to the
-  conductor — that's a dependency violation (Brief 4 depends_on: [1]
-  but transitively depends on the post-PR-#117 token tier).
-
-- **Verbatim children:** SVG icon paths, button text labels, click
-  handler bindings, the `VOCAB.MY_COLLECTION` / `VOCAB.REMOVE_FROM_MY_COLLECTION`
-  imports, the `setShowActions(false)` flow — all stay byte-identical.
-
-- **`px-2 sm:px-3 py-2` action buttons** (the 3 colored quick-action
-  buttons: Collection / Deck / My Collection): leave them alone. They
-  use `--accent-flame`, `--accent-gold`, `--accent-wood` already and
-  the `onMouseEnter`/`onMouseLeave` swap is a known pattern. Touching
-  them is scope expansion.
-
-## Acceptance criteria
-
-- [ ] Outer toolbar `<div>` uses `glass-panel-strong rounded-2xl` and an inline `boxShadow` matching the verbatim shape above.
-- [ ] More-actions dropdown `<div>` uses `glass-panel-strong rounded-xl` and no inline `background` / `border` / `shadow` style.
-- [ ] All `text-gray-{600,700,800}` classes within the toolbar are replaced with `style={{ color: 'var(--text-{primary,secondary}) ' }}` or `nav-item-hover` className.
-- [ ] All `hover:bg-gray-{50,100}` classes are replaced with `nav-item-hover` className.
-- [ ] The destructive "Delete Selected" item uses `var(--accent-danger)` (or the documented `rgb(239,68,68)` fallback) — NOT `text-red-600`.
-- [ ] The L60 divider uses `style={{ backgroundColor: 'var(--border)' }}` — NOT `bg-gray-300`.
-- [ ] The 3 quick-action buttons (Collection / Deck / My Collection at L64-101) are UNCHANGED. The "Clear Selection" button at the end may need a small text-color swap; that's in scope. Everything else is left alone.
-- [ ] **Dark-mode verification**: open the bulk-select toolbar (select 2+ cards on `/my-cards` or `/collection/[id]`), confirm it renders legibly with corner catch-lights and proper text contrast in BOTH light and dark themes. Attach before/after dark-mode screenshots to the PR description.
-- [ ] `npm run lint` + `npm run test:run` (23+/23+, post Brief 1) pass.
-- [ ] No edits to files outside `components/BulkSelectionToolbar.js`.
-
-## Rationale (≤3 sentences)
-
-The toolbar is currently invisible in dark mode because `bg-white` doesn't theme — this PR is a correctness fix as much as a design unification. Sweeping the interior hardcoded grays + reds in the same PR is cheap (the file is small, ~200 lines) and prevents a follow-up convoy from having to revisit the file. The 3 colored quick-action buttons stay as-is because they use the right tokens already and a token sweep there is scope expansion.

.convoys/unify-glass-panel-surfaces/brief-5-retire-card-class.md

@@ -1,87 +0,0 @@
----
-convoy: unify-glass-panel-surfaces
-brief_number: 5
-depends_on: []
-files:
-  - pages/profile.js
-  - pages/settings.js
-  - pages/community/collections.js
-  - components/CollectionsPageView.js
-  - styles/globals.css
----
-
-# Brief 5: Retire `.card` class; migrate 8 consumers to `.glass-panel`
-
-## Goal (1 sentence)
-
-Delete the legacy `.card` class from `styles/globals.css` and migrate all 8 consumers (3 in `pages/profile.js`, 2 in `pages/settings.js`, 1 in `pages/community/collections.js`, 1 in `components/CollectionsPageView.js`, plus 1 likely-missed inline `className="card hover:..."` instance) to `glass-panel rounded-3xl p-{4|6}` so the app converges on a single panel vocabulary.
-
-## Files in scope (do not edit anything else)
-
-- `styles/globals.css` — delete the entire `.card { ... }` rule block (currently 4 lines at L729-733):
-  ```css
-  .card {
-    @apply rounded-3xl shadow-lg p-6 transition-all duration-300;
-    background-color: var(--bg-primary);
-    border: 1px solid var(--border);
-  }
-  ```
-- `pages/profile.js` — 3 `className="card p-6 [...]"` swaps. Likely sites (verify line numbers against current file): L290 (`card p-6 text-center` — the profile avatar card), L397 (`card p-6 mt-6` — the stats card), L432 (`card p-6` — the activity card).
-- `pages/settings.js` — 2 `className="card ..."` swaps. Likely sites: L266 (`card p-4`), L290 (`card p-6`).
-- `pages/community/collections.js` — 1 swap. Likely site: L266 (`card group cursor-pointer hover:shadow-lg transition-all duration-200`).
-- `components/CollectionsPageView.js` — 1 swap. Likely site: L125 (`card hover:shadow-xl transition-all duration-300 cursor-pointer group`).
-
-**Out of scope:** everything else in those files (page-level layout, header strips, modal wrappers, button styling, inline content). Only the `.card` className references migrate.
-
-## Conventions to follow
-
-- **Swap pattern (default):**
-  ```jsx
-  // Before:
-  <div className="card p-6 [...whatever-else]">
-
-  // After:
-  <div className="glass-panel rounded-3xl p-6 [...whatever-else]">
-  ```
-  Verbatim: replace the standalone token `card` with `glass-panel rounded-3xl`. **Preserve any sibling tokens** (`p-4` / `p-6` / `text-center` / `mt-6` / `group` / `cursor-pointer` / `hover:shadow-lg` / `transition-all duration-200`, etc.). The legacy `.card` `@apply`'d `rounded-3xl shadow-lg p-6 transition-all duration-300`; we keep `rounded-3xl` explicitly and let `.glass-panel`'s composed shadow stack replace `shadow-lg` (which is the right move — `.glass-panel`'s tokens theme correctly, `shadow-lg` doesn't).
-
-- **`p-6` handling:** the legacy class baked in `p-6`. If the consumer wrote `card p-4` (`pages/settings.js` L266), the explicit `p-4` already wins via Tailwind's cascade — `p-4` overrides the `@apply rounded-3xl shadow-lg p-6` because they're at the same specificity and `p-4` is the later-defined declaration in compiled output. After migration, the explicit `p-4` continues to win because there's no longer any baked-in `p-6`. **Bottom line:** preserve whatever padding token the consumer wrote; don't normalize to `p-6`.
-
-- **`transition-all duration-300` handling:** the legacy class baked in `transition-all duration-300`. Most consumers ALSO wrote it explicitly (e.g. `CollectionsPageView.js` L125: `transition-all duration-300`). If a consumer relied on the baked-in version, the swap loses the transition — add `transition-all duration-300` explicitly to that consumer's className post-swap. **Audit each site for whether the transition is referenced; add it back where needed.**
-
-- **`shadow-lg` handling:** the legacy class baked in `shadow-lg`. `.glass-panel`'s composed `box-shadow` (rim + elevation-ambient) is the right replacement; do NOT carry `shadow-lg` over.
-
-- **`pages/community/collections.js` site (L266):** the consumer adds `hover:shadow-lg` on top of the baked `shadow-lg`. The base shadow becomes `.glass-panel`'s shadow stack; the `hover:shadow-lg` is a hardcoded Tailwind shadow. Decision: replace `hover:shadow-lg` with no `hover:` override — the corner-light gradient on `.glass-panel` is the new affordance. (If review shows this regresses hover legibility, fall back to inline `style={{}}` boxShadow override on `:hover` — but the simpler clean diff is to drop it.)
-
-- **`components/CollectionsPageView.js` site (L125):** same logic. Drop `hover:shadow-xl`.
-
-- **Escape hatch (per Decision D2):** if any one of the 8 consumers breaks visually post-swap (the architect doesn't expect this), revert that one site to inline `style={{ background: 'var(--bg-secondary)' }}` rather than holding the entire class-deletion. Document each escape-hatch use in the PR description with a screenshot. If MORE than 1 of 8 needs the escape hatch, the brief's reviewer is expected to push back and hold the deletion entirely — flag in PR comments.
-
-- **CSS deletion order:** delete the `.card { ... }` rule LAST, after all 8 className swaps are in place. (Pure ordering hygiene for diff-readability; CSS doesn't actually care.)
-
-- **Boundaries:** do NOT touch any other class in `globals.css` (no renaming `.glass-panel` → `.opaque-panel`, no adding new classes). Do NOT touch any pages or components not in the 4 listed.
-
-- **Grep verification before PR:**
-  ```bash
-  # Should return 0 matches anywhere in pages/ or components/:
-  rg "className=[\"\\'\\\`]card\\b" pages/ components/ --type js
-  # And the class definition itself:
-  rg "^\\.card \\{" styles/
-  ```
-  Both should return zero. If either returns anything, the migration is incomplete.
-
-## Acceptance criteria
-
-- [ ] `styles/globals.css` no longer contains a `.card { ... }` rule block.
-- [ ] Zero `className=".*\bcard\b.*"` references remain under `pages/` or `components/` (verified by the grep command above).
-- [ ] Each of the 8 migrated consumers renders with `.glass-panel rounded-3xl` and the original `p-{4|6}` padding intact.
-- [ ] Wherever the consumer relied on baked-in `transition-all duration-300` (audit by reviewing each site), the transition is added explicitly post-migration.
-- [ ] `hover:shadow-{lg,xl}` Tailwind overrides on community/CollectionsPageView are dropped (replaced by `.glass-panel`'s corner-light affordance).
-- [ ] No escape-hatch sites or — if any — at most 1 escape-hatch site, documented with a screenshot in the PR description.
-- [ ] `npm run lint` + `npm run test:run` (no test count change expected; 22+/22+ post Brief 1) pass.
-- [ ] Manual: visit `/profile`, `/settings`, `/community/collections`, `/community/collections` collection-detail in light + dark mode and confirm all panels render with corner catch-lights and theme-correct backgrounds. Attach before/after screenshots to PR.
-- [ ] No edits to files outside the 5 listed in `files:` above.
-
-## Rationale (≤3 sentences)
-
-`.card` predates the gradient-border system and is the only remaining "opaque solid panel" pattern in user-facing pages — a single panel vocabulary across the app is the convoy's success metric. The 8 consumers are all "panel-with-content-inside" surfaces with no GPU-budget constraint, so the migration is a clean className swap with no compositional surprises. Deleting the class outright (rather than keeping it as a documented fallback) prevents future agents from picking the wrong pattern by accident.

.convoys/unify-glass-panel-surfaces/brief-6-landing-nav-bar.md

@@ -1,91 +0,0 @@
----
-convoy: unify-glass-panel-surfaces
-brief_number: 6
-depends_on: []
-files:
-  - pages/index.js
----
-
-# Brief 6: Migrate landing nav bar to `.page-header-glass`
-
-## Goal (1 sentence)
-
-Replace the handrolled translucent `<nav>` on the public landing page with the canonical `.page-header-glass border-b` className, and drop the malformed `boxShadow: 'inset 0 1px 0 var(--rim-light-inner)'` (the token already contains its own `inset 0 1px 0`; double-wrapping breaks the cascade — documented in `styles/globals.css` L748-761).
-
-## Files in scope (do not edit anything else)
-
-- `pages/index.js` — the landing `<nav>` block, currently L61-72 (around the `border-b` declaration with inline `background: 'var(--glass-surface-mid)'` + `backdropFilter` + `boxShadow: 'inset 0 1px 0 var(--rim-light-inner)'`).
-
-**Out of scope:** everything else on the landing page (the Deck Hearth heading, the Sign In / Get Started buttons inside the nav, the hero section, feature cards, footer, the `if (user) return null;` redirect logic, etc.). The migration is a single `<nav>` element's `className` + `style` swap.
-
-## Conventions to follow
-
-- **Verbatim replacement:**
-  ```jsx
-  // Before:
-  <nav
-    className="border-b"
-    style={{
-      background: 'var(--glass-surface-mid)',
-      backdropFilter:
-        'blur(var(--glass-blur-mid)) saturate(var(--glass-saturate))',
-      WebkitBackdropFilter:
-        'blur(var(--glass-blur-mid)) saturate(var(--glass-saturate))',
-      borderColor: 'var(--border)',
-      boxShadow: 'inset 0 1px 0 var(--rim-light-inner)',
-    }}
-  >
-
-  // After:
-  <nav
-    className="page-header-glass border-b"
-    style={{
-      borderColor: 'var(--border)',
-    }}
-  >
-  ```
-  The class provides `background`, `backdrop-filter`, and the
-  correct `box-shadow` (which IS `var(--rim-light-inner), 0 1px 0
-  var(--border)` per its definition in `globals.css` L300-306). The
-  `border-b` Tailwind class needs the `borderColor` style to remain
-  themed; everything else collapses into the class.
-
-- **The malformed boxShadow is the bug:** `var(--rim-light-inner)` is
-  already a complete `inset 0 1px 0 <color>` declaration. Wrapping
-  it in another `inset 0 1px 0 ...` produces invalid CSS that the
-  browser silently drops. The class's own `box-shadow:
-  var(--rim-light-inner), 0 1px 0 var(--border)` does the right
-  thing. Removing the inline `boxShadow` line is the fix.
-
-- **Children verbatim:** the `<div className="max-w-7xl mx-auto ...">`
-  inside the `<nav>`, the `<AnimatedFireLogo>`, the heading, and the
-  Sign In / Get Started buttons all stay byte-identical. Do not
-  touch them.
-
-- **`.page-header-glass` placement check:** the class is defined in
-  `styles/globals.css` L300-306 and is already used by authenticated
-  pages' header strips (dashboard, my-cards, cards, etc.). It's safe
-  to reuse on the public landing page — the class has no auth
-  coupling.
-
-- **Nested backdrop-filter check** (boot-the-brief risk #6): the
-  landing page has no enclosing Layout (the `pages/index.js` redirect
-  logic returns `null` for authenticated users and renders its own
-  full-page `<div>` for anonymous visitors — no `<Layout>` wrapper).
-  So there's no risk of nested `backdrop-filter` stacking. Verified.
-
-- **AGENTS.md / no-go zones:** `pages/index.js` is an authored page,
-  not a generated artifact. Allowed.
-
-## Acceptance criteria
-
-- [ ] Landing `<nav>` uses `className="page-header-glass border-b"`.
-- [ ] Inline `style` on the `<nav>` retains only `borderColor: 'var(--border)'` — no `background`, no `backdropFilter`, no `WebkitBackdropFilter`, no `boxShadow`.
-- [ ] The Deck Hearth heading + Sign In / Get Started buttons inside the nav render identically.
-- [ ] Manual: open `/` in an incognito window (anonymous user), verify the nav bar renders with a subtle glassy treatment, an `inset 0 1px 0` highlight (the inner rim), and a 1px bottom border. Verify in both light and dark theme via the theme toggle (which appears on the public landing). Attach light + dark screenshots to PR.
-- [ ] `npm run lint` + `npm run test:run` pass (no test count change expected).
-- [ ] No edits to other files.
-
-## Rationale (≤3 sentences)
-
-The landing nav is the highest-visibility public surface in the app and currently both (a) duplicates `.page-header-glass`'s composition handrolled, and (b) ships a malformed `boxShadow` that silently breaks. Migrating to the canonical class is a one-line cleanup that fixes a latent bug. No corner-light treatment is appropriate here — the nav is full-bleed, so corner radials would land at viewport edges and never read as light sources; `.page-header-glass` (which uses the rim/border-only composition) is the right shape.

.convoys/unify-glass-panel-surfaces/brief-7-forbidden-bespoke-glass-surface-ci-gate.md

@@ -1,123 +0,0 @@
----
-convoy: unify-glass-panel-surfaces
-brief_number: 7
-depends_on: [1, 2, 3, 4, 5, 6]
-files:
-  - .github/workflows/ci.yml
----
-
-# Brief 7: `forbidden-bespoke-glass-surface` CI gate
-
-## Goal (1 sentence)
-
-Add a `forbidden-bespoke-glass-surface` job to `.github/workflows/ci.yml` that fails the build if `var(--glass-surface-(low|mid|high))` appears in JSX inline-style usage under `components/**` or `pages/**`, with a curated allowlist for the documented chrome exceptions (Layout sidebar nav-chip block, TopSearchBar `<header>` block, and the `<GlassSurface>` primitive itself).
-
-## Files in scope (do not edit anything else)
-
-- `.github/workflows/ci.yml` — append a new job after the existing `forbidden-modal-shell-without-primitive` job (around L200) or alongside it in the `forbidden-*` cluster. Don't reorder existing jobs.
-
-**Out of scope:** every other file in the repo. This brief is pure CI surface; no application code changes.
-
-## Conventions to follow
-
-- **Model after the existing `forbidden-modal-shell-without-primitive` job** (`.github/workflows/ci.yml` L200-226). Same shape:
-  - Single `runs-on: ubuntu-latest` step that runs a `grep` command.
-  - Collects matches into a bash array.
-  - Iterates and emits `::error file=${f}::<reason>` for each match.
-  - Exits non-zero if any match remains.
-  - The grep pattern is bounded to `pages/ components/ -r --include='*.js'`.
-
-- **Verbatim job shape** (drop into `ci.yml` at the bottom of the forbidden-* cluster):
-  ```yaml
-    forbidden-bespoke-glass-surface:
-      name: No bespoke var(--glass-surface-*) inline styles
-      runs-on: ubuntu-latest
-      steps:
-        - uses: actions/checkout@v4
-        - name: Fail if JSX inline styles handroll glass surfaces
-          run: |
-            # unify-glass-panel-surfaces convoy (PR sequence after #118 +
-            # #117). Once Briefs 1-6 land, every panel-shaped surface in
-            # the app composes via .glass-panel / .glass-panel-strong /
-            # .page-header-glass / <GlassSurface>. Inline-style usage of
-            # var(--glass-surface-low|mid|high) under pages/ or
-            # components/ JSX is the regression vector this gate prevents.
-            #
-            # Allowlist (explicit, documented exceptions):
-            #   - components/ui/GlassSurface.js          # the primitive itself
-            #   - components/Layout.js                   # sidebar nav-chip chrome block (L858 area)
-            #   - components/ui/TopSearchBar.js          # <header> chrome block
-            # These three files intentionally compose handrolled chrome
-            # surfaces ratified in PR #116 (gradient borders) + the
-            # unify-glass-panel-surfaces architect decision D4. If you
-            # need to add a fourth allowlist entry, that's a design-system
-            # decision — open a new convoy.
-            ALLOWLIST=(
-              "components/ui/GlassSurface.js"
-              "components/Layout.js"
-              "components/ui/TopSearchBar.js"
-            )
-            FOUND=()
-            while IFS= read -r file; do
-              skip=false
-              for allowed in "${ALLOWLIST[@]}"; do
-                if [ "$file" = "$allowed" ]; then
-                  skip=true
-                  break
-                fi
-              done
-              if [ "$skip" = true ]; then
-                continue
-              fi
-              FOUND+=("$file")
-            done < <(grep -lE "var\\(--glass-surface-(low|mid|high)\\)" \
-                pages components -r --include='*.js' 2>/dev/null \
-                | sort -u || true)
-            if [ ${#FOUND[@]} -gt 0 ]; then
-              echo "::error::Bespoke var(--glass-surface-*) inline styles detected outside the documented allowlist."
-              echo "Use .glass-panel / .glass-panel-strong / .page-header-glass or compose <GlassSurface> from components/ui/ instead."
-              for f in "${FOUND[@]}"; do
-                echo "::error file=${f}::Replace inline var(--glass-surface-*) with the appropriate class or primitive."
-              done
-              exit 1
-            fi
-            echo "OK: no bespoke glass-surface inline styles outside the allowlist."
-  ```
-
-- **Allowlist hygiene:** the 3 allowlist entries are exact paths. If
-  the relevant chrome block in `components/Layout.js` is later
-  refactored into its own sub-component (e.g. `<SidebarNavChip>`),
-  the new file path replaces `components/Layout.js` in the
-  allowlist — that's the kind of edit a future PR would carry.
-
-- **Pre-merge negative test:** before opening this PR, run the
-  allowlist locally — verify that adding a scratch `style={{
-  background: 'var(--glass-surface-low)' }}` to a non-allowlisted
-  file (e.g. `pages/profile.js`) and re-running the grep produces a
-  match. Then revert the scratch change. Document the negative test
-  in the PR description (don't commit the scratch change).
-
-- **CI ordering:** Brief 7 depends on Briefs 1-6 ALL landing first.
-  If this job is added before any of the prior briefs ships, the
-  build will fail on the in-flight migrations (every site this
-  convoy is migrating IS currently a bespoke `var(--glass-surface-*)`
-  inline-style usage). Conductor MUST hold dispatch until 1-6 are
-  all on `main`.
-
-- **Boundaries:** do NOT touch any other CI job. Do NOT edit any
-  application file. Do NOT update AGENTS.md or other docs in this
-  PR (a separate AGENTS.md update can land alongside Brief 1 if
-  the architect wants — Brief 7 is pure CI).
-
-## Acceptance criteria
-
-- [ ] `.github/workflows/ci.yml` contains a new `forbidden-bespoke-glass-surface` job matching the verbatim shape above (job name, `runs-on`, checkout step, grep-and-allowlist shell block).
-- [ ] The allowlist has exactly 3 entries: `components/ui/GlassSurface.js`, `components/Layout.js`, `components/ui/TopSearchBar.js`.
-- [ ] On a clean post-Briefs-1-through-6 `main`, the new CI job is GREEN — no false positives. (Verify by running the grep locally before opening the PR.)
-- [ ] Negative test: adding a scratch `style={{ background: 'var(--glass-surface-low)' }}` to e.g. `pages/profile.js` and re-running the same grep command produces a match. (Documented in PR description; not committed.)
-- [ ] No other CI jobs are reordered, renamed, or modified.
-- [ ] PR description links back to this brief and to the convoy file (`.convoys/unify-glass-panel-surfaces.md`).
-
-## Rationale (≤3 sentences)
-
-The convoy's success metric is unification, but unification without a regression gate is half a fix — a future PR can re-introduce a bespoke `var(--glass-surface-*)` inline style and undo the work. Modeling the gate on the existing `forbidden-modal-shell-without-primitive` job keeps it consistent with the repo's CI vocabulary and makes the failure message actionable. The 3-entry allowlist is small and intentional; growing it requires an explicit design-system decision, which is the right friction for a convention-enforcing gate.

.cursor/agents/role-a11y-auditor.md

@@ -1,13 +1,13 @@
 ---
 name: role-a11y-auditor
 description: >-
-  Accessibility audit on a UI diff against WCAG 2.2 (Level AA). Read-only.
+  Accessibility audit on a UI diff. Checks for missing labels, keyboard
-  Runs `[skills/accessibility-audit](../../../accessibility-audit/SKILL.md)`
+  navigation, focus management, color contrast, semantic HTML, and ARIA
-  for the rubric + report template. Use after the implementer's PR draft on
+  correctness. Read-only. Use after the implementer's PR draft on PRs that
-  PRs that touch UI files. Safe to run in parallel with role-reviewer +
+  touch UI files. Does not require a browser MCP — works from the diff +
-  role-security-auditor + role-design-system-auditor via Cursor 3.2 /multitask.
+  static analysis. Safe to run in parallel with role-reviewer +
+  role-design-system-auditor via Cursor 3.2 /multitask.
 multitask: audit-fanout
-model: cursor-grok-4.5-high
 tools: [Read, Grep, Glob, Shell]
 ---
 
@@ -20,59 +20,86 @@ After `role-design-system-auditor` on UI-touching PRs. Skip when convoy frontmat
 ## Inputs
 
 - The PR diff (UI files only).
-- The convoy's UX section (a11y constraints listed there — verify each one).
+- The convoy's UX section (which already lists a11y constraints — verify the implementer satisfied them).
-- Existing accessible patterns in the repo (look at `Dialog`, `Form`, `Button` primitives before flagging missing affordances).
+- Existing accessible patterns in the repo (look at existing `Dialog`, `Form`, `Button` primitives).
-- `[skills/accessibility-audit/SKILL.md](../../../accessibility-audit/SKILL.md)` — the audit rubric, severity scale, and 5-layer framework.
 
 ## Outputs
 
-A structured audit report following the template at `skills/accessibility-audit/templates/audit-report.md`. Posted as:
+A structured comment for the PR Health rollup:
 
-- A PR comment when GitHub is the surface, OR
+```markdown
-- An Echodo `document` (Phase 2b: `create_task_from_template({template: "a11y-audit", ...})`) when MCP is reachable.
+## A11y Audit
 
-Per `[skills/accessibility-audit/SKILL.md](../../../accessibility-audit/SKILL.md)` step 7 — both paths produce the same shape.
+| Check | Status | Count |
+| --- | --- | --- |
+| Labels | ✅ / ❌ | <N> |
+| Keyboard nav | ✅ / ❌ | <N> |
+| Focus management | ✅ / ❌ | <N> |
+| Color contrast | ✅ / ⚠️ | <N> |
+| Semantic HTML | ✅ / ❌ | <N> |
+| ARIA correctness | ✅ / ⚠️ | <N> |
+| UX constraint match | ✅ / ❌ | <N> |
+
+### Critical (must fix)
+- <file:line> — <issue> — <fix>
+...
+
+### Warnings (recommended)
+- <file:line> — <issue> — <fix>
+...
+
+### Notes
+- ...
+```
+
+## Checklist (apply per file)
+
+1. **Labels**: every `<input>`, `<select>`, `<textarea>`, `<button>` has either visible text, `aria-label`, or an associated `<label htmlFor=...>`.
+2. **Icon-only buttons**: have `aria-label` or visually-hidden text.
+3. **Keyboard navigation**: any `onClick` on a non-button/anchor element has `onKeyDown` (Enter + Space) and `tabIndex={0}` and `role="button"` (or be a real button).
+4. **Focus management**: dialogs trap focus; modals return focus on close; route changes move focus to the heading.
+5. **Color contrast**: text on backgrounds meets 4.5:1 (large text 3:1). Hardcoded colors that we can't measure → ⚠️.
+6. **Semantic HTML**: use `<button>` not `<div onClick>`, `<nav>` for navigation, `<main>` for primary content, heading hierarchy `<h1>` → `<h2>` → `<h3>` (no skipping).
+7. **ARIA correctness**: `aria-expanded` on toggles, `aria-current="page"` on active nav items, `aria-live` on async-updating regions, `role="alert"` on error messages.
+8. **UX constraint match**: cross-reference the UX section's a11y constraints — did the implementer satisfy each one?
+
+## Severity
+
+- **Critical**: missing labels on form inputs, no keyboard handler on click-only div, missing focus trap on modal, missing alt text on informative images.
+- **Warning**: heading hierarchy skip, missing `aria-current`, color-contrast that requires runtime measurement, missing live region on async updates.
 
 ## Steps
 
-1. Get UI diff (`git diff --name-only` filtered to UI extensions).
+1. Get UI diff.
 2. Read the convoy's UX section once to know what was promised.
-3. **Read `[skills/accessibility-audit/SKILL.md](../../../accessibility-audit/SKILL.md)`** if not already in context. Walk the 5 layers in order for each touched surface.
+3. For each changed UI file: read the current state of the file (post-diff), then walk the checklist.
-4. Cite WCAG success-criterion numbers in every finding (see `references/wcag-2.2-checklist.md`).
+4. Build the comment. Cap at 8 critical + 8 warnings.
-5. Assign severity 0-4 per the skill's rubric. Severity ≥ 3 spawns a child task in Phase 2b.
+5. If clean: ✅ across the board with a one-line note.
-6. Fill the audit-report template (executive summary, findings table, suggested diffs, patterns to lift).
-7. Post the report. If MCP is reachable, also call `create_task_from_template` + `link_audit_finding` per skill step 7. On failure, queue to `.convoys/.pending-mcp-sync.jsonl`.
-
-## Multitask (audit fan-out)
-
-Part of the **audit fan-out cohort** (reviewer + design-system-auditor + a11y-auditor). All three read the same diff, emit independent reports, modify no code. Safe to run in parallel via Cursor 3.2 `/multitask`.
-
-Pass the shared `multitask_group` id in metrics. Convention: `audit-<convoy>-<pr>`. See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern A.
 
 ## What this role does NOT do
 
-- Run axe-core in a browser — that's a CI job (`accessibility-audit` step 2 mentions automated checks; CI runs them, this role consumes their output).
+- Run axe-core in a browser (that's a CI job, see `.github/workflows/preview-smoke.yml` if present).
-- Test screen readers manually — out of scope for static analysis. Recommend in findings if needed.
+- Test screen readers manually — beyond static analysis scope.
 - Audit non-UI changes — server / API / config diffs are out of scope.
-- Replicate the rubric inline — the rubric lives in the skill. This role orchestrates; it does not carry the checklist.
 
-## Hand-off
+## Multitask (audit fan-out)
 
-Message: *"A11y audit complete. N findings (sev ≥ 3: M, sev < 3: K). Report: `<path>` or `<echodo-url>`. Recommend fixing sev ≥ 3 before merge."*
+Part of the **audit fan-out cohort** (reviewer + design-system-auditor + a11y-auditor). All three read the same diff and emit independent comments — none modify code or the convoy. Safe to run in parallel via Cursor 3.2 `/multitask`.
+
+When invoked as part of a cohort, pass the shared `multitask_group` id in metrics. Convention: `audit-<convoy>-<pr>`. See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern A.
 
 ## Metrics
 
-After publishing:
+After publishing the audit comment, emit one event:
 
 ```bash
-bash scripts/log-convoy-event.sh role=role-a11y-auditor convoy=<slug> duration_s=<seconds> model=cursor-grok-4.5-high model_tier=fast [multitask_group=audit-<convoy>-<pr>]
+bash scripts/log-convoy-event.sh role=role-a11y-auditor convoy=<slug> duration_s=<seconds> [multitask_group=audit-<convoy>-<pr>]
 ```
 
 Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed).
 
 ## Anti-patterns
 
-- Demanding ARIA on already-semantic HTML (e.g. `aria-label` on `<button>` with visible text) → wrong, redundant. See skill anti-patterns.
+- Demanding ARIA on already-semantic HTML (e.g. `aria-label` on a `<button>` that has visible text) → wrong, that's redundant.
 - Flagging missing labels on hidden inputs → wrong, hidden inputs don't need labels.
-- Vague feedback ("improve a11y") → wrong. Every finding cites a WCAG criterion + a file:line + a fix.
+- Vague feedback ("improve a11y") → wrong, every finding needs a file:line and a specific fix.
-- Carrying the rubric inline in this role file → wrong. Read the skill.

.cursor/agents/role-architect.md

@@ -8,7 +8,6 @@ description: >-
   Must run sequentially — decomposition output enables downstream
   implementer fan-out via Cursor 3.2 /multitask.
 multitask: single
-model: composer-2.5
 tools: [Read, Grep, Glob, Shell]
 ---
 
@@ -61,8 +60,6 @@ Then create one **implementer brief** per row of the decomposition, as a separat
 convoy: <slug>
 brief_number: <N>
 depends_on: [<other brief numbers>]
-recommended_model: composer-2.5
-model_tier: standard
 files:
   - <path/to/file1>
   - <path/to/file2>
@@ -185,7 +182,7 @@ If the convoy's plan needs to change after `role-architect` has run (e.g. a user
 After writing the brief files, emit one event. Shell access is restricted to this single command.
 
 ```bash
-bash scripts/log-convoy-event.sh role=role-architect convoy=<slug> duration_s=<seconds> model=composer-2.5 model_tier=standard
+bash scripts/log-convoy-event.sh role=role-architect convoy=<slug> duration_s=<seconds>
 ```
 
 Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed).

.cursor/agents/role-conductor.md

@@ -7,7 +7,6 @@ description: >-
   for downstream roles, and hands off to the next role. Use when a new feature,
   bug fix, or epic is being kicked off and the work has not yet been scoped.
 multitask: single
-model: composer-2.5-fast
 tools: [Read, Grep, Glob, Write, Shell]
 ---
 
@@ -41,31 +40,9 @@ classification: feature | hotfix | docs-only | infra-only | server-only | config
 success_metric: <one sentence>
 skip:
   - <flag1>
+  - <flag2>
 status: open
 created: <YYYY-MM-DD>
-model_policy:
-  default_session: auto
-  roles:
-    role-conductor: composer-2.5-fast
-    role-architect: composer-2.5
-    role-ia-architect: composer-2.5-fast
-    role-ux-reviewer: composer-2.5-fast
-    role-ui-designer: composer-2.5-fast
-    role-implementer: composer-2.5-fast
-    role-reviewer: cursor-grok-4.5-high
-    role-security-auditor: gpt-5.6-terra-medium
-    role-design-system-auditor: cursor-grok-4.5-high
-    role-a11y-auditor: cursor-grok-4.5-high
-    role-doc-writer: auto
-  escalate_to: claude-sonnet-5-thinking-medium
-  escalate_to_premium: claude-4.6-opus-high-thinking
-  never_premium:
-    - role-reviewer
-    - role-security-auditor
-    - role-design-system-auditor
-    - role-a11y-auditor
-    - role-ui-designer
-    - role-doc-writer
 ---
 ```
 
@@ -83,11 +60,11 @@ Use these as starting points; trust the obvious cases:
 | Classification | Default skip flags | Reasoning |
 | --- | --- | --- |
 | `feature` | (none) | Full pipeline |
-| `hotfix` | `ia, ux, ui-design, arch` | Speed over rigor; **still run** reviewer + security-auditor in audit fan-out |
+| `hotfix` | `ia, ux, arch, review` | Speed over rigor; mandatory post-merge cleanup task |
-| `docs-only` | `ia, ux, ui-design, arch, test, visual, a11y, design, security, smoke, qa, flag` | Docs only; no executable surface to audit |
+| `docs-only` | `ia, ux, arch, test, visual, a11y, design, smoke, qa, flag` | Docs change docs; CI lint catches typos |
-| `infra-only` | `ia, ux, ui-design, arch, visual, a11y, design, smoke, qa, flag` | No UI; run security on IaC/workflow changes |
+| `infra-only` | `ia, ux, arch, visual, a11y, design, smoke, qa, flag` | No UI; auditors no-op |
-| `server-only` | `ia, ux, ui-design, visual, a11y, design` | API/worker; run reviewer + security-auditor |
+| `server-only` | `ia, ux, visual, a11y, design` | API or worker change; no UI |
-| `config-only` | `ia, ux, ui-design, arch, test, visual, a11y, design, security, smoke, qa, docs, flag` | env / CODEOWNERS / config file edit |
+| `config-only` | `ia, ux, arch, test, visual, a11y, design, smoke, qa, docs, flag` | env / CODEOWNERS / config file edit |
 
 Never set: `plan-approval`, `pr-merge`, `prod-promote` (human gates are non-negotiable).
 
@@ -99,15 +76,6 @@ Never set: `plan-approval`, `pr-merge`, `prod-promote` (human gates are non-nego
 4. Write `.convoys/<slug>.md` with frontmatter + four sections.
 5. Print a one-line summary: *"Convoy `<slug>` created (classification: `<X>`, skipping: `<flags>`). Next role: <role-X>."*
 
-### UI designer recommendation (`ui-design` skip)
-
-For `feature` convoys with **new or redesigned** UI surfaces (landing, new app area, major visual refresh):
-
-- If `.cursor/skills/ui-ux-pro-max/` is installed → recommend **`role-ui-designer`** after IA (before UX Reviewer). Do **not** set `skip: ui-design`.
-- If the change is **incremental** inside an existing design system (small tweak, one new column, bugfix UI) → add `ui-design` to `skip:` and go straight to `role-ux-reviewer`.
-
-Record the chosen path in `## Roles invoked`.
-
 ## Hand-off
 
 Hand off by message to the user, not by spawning another role automatically. The user runs the next role manually (they can paste *"role-ia-architect"* into the chat or open a new chat and reference the convoy). This keeps the human in the loop for the early stages where direction is most plastic.
@@ -118,26 +86,15 @@ The Conductor doesn't run anything in parallel itself, but it **tells the user w
 
 | Classification | Recommended `/multitask` dispatch points |
 | --- | --- |
-| `feature` | Planning: `role-ui-designer` (if greenfield UI + skill installed, before UX Reviewer). After architect: dispatch implementers for briefs with `depends_on: []` AND disjoint `files:` in parallel. After PR draft: audit fan-out — `role-reviewer + role-security-auditor + role-design-system-auditor + role-a11y-auditor` (group id: `audit-<slug>-<pr>`) |
+| `feature` | After architect: dispatch implementers for all briefs with `depends_on: []` AND disjoint `files:` in parallel. After PR draft: dispatch reviewer + design-system-auditor + a11y-auditor as audit fan-out (group id: `audit-<slug>-<pr>`) |
-| `hotfix` | Audit fan-out: `role-reviewer + role-security-auditor` (+ UI auditors only if UI touched) |
+| `hotfix` | Audit fan-out only (reviewer + design-system-auditor + a11y-auditor) — planning is skipped, implementer is a single brief |
-| `server-only` | Audit fan-out: `role-reviewer + role-security-auditor` — drop design-system + a11y unless UI files in diff |
+| `server-only` | Audit fan-out, but drop design-system-auditor + a11y-auditor from the cohort (skip flags already set) — typically just reviewer |
 | `docs-only` / `config-only` / `infra-only` | No multitask — single-writer flows; serial is fine |
 
 When implementer fan-out is on the table, **only flag briefs the architect has explicitly marked as parallelizable** in the `slice_dependencies:` block. If the architect didn't supply that block, recommend serial dispatch and note that the architect output is incomplete.
 
 See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) for the full guardrail set.
 
-## Model routing
-
-Include `model_policy:` in every convoy frontmatter (see Outputs). Tell the user:
-
-1. **Parent session:** `auto` or `composer-2.5-fast` unless they are running architect in this chat (use **Composer 2.5 Standard** for architect).
-2. **Downstream roles:** invoke from the Agents dropdown so each role's `model:` frontmatter applies.
-3. **Audit fan-out:** Grok / fast models only — never Opus for reviewer / security-auditor / auditors.
-4. **Large epics:** set `role-conductor: claude-sonnet-5-thinking-medium` in `model_policy` for this convoy only.
-
-Full policy: [`docs/model-routing-policy.md`](../../../../docs/model-routing-policy.md).
-
 ## Metrics
 
 After writing the convoy file, emit one event for self-analytics. Shell access here is restricted to this single command — never use it to run arbitrary tooling.
@@ -148,9 +105,7 @@ bash scripts/log-convoy-event.sh \
   convoy=<slug> \
   classification=<feature|hotfix|docs-only|infra-only|server-only|config-only> \
   skip_flags=<comma,separated> \
-  duration_s=<seconds-since-trigger> \
+  duration_s=<seconds-since-trigger>
-  model=composer-2.5-fast \
-  model_tier=fast
 ```
 
 If `scripts/log-convoy-event.sh` does not exist (L3 not installed), skip silently — analytics is opt-in.
@@ -161,4 +116,3 @@ If `scripts/log-convoy-event.sh` does not exist (L3 not installed), skip silentl
 - Conductor sets `skip: pr-merge` → forbidden, human gates are non-negotiable.
 - Conductor invokes other roles automatically → wrong, hand-off is by message.
 - Conductor produces more than one file → wrong, output is exactly `.convoys/<slug>.md`.
-- Conductor writes to `.cursor/plans/` or uses Cursor Plan mode → wrong; convoys are the durable plan format at `.convoys/<slug>.md`. See `.cursor/rules/convoy-planning.mdc`.

.cursor/agents/role-design-system-auditor.md

@@ -1,16 +1,13 @@
 ---
 name: role-design-system-auditor
 description: >-
-  Audits a UI diff against the repo's design system + scores DS maturity
+  Audits a UI diff against the repo's design system. Flags hardcoded colors,
-  on the 5-axis rubric (tokens / components / patterns / governance /
+  spacing, font-sizes, missing variants, and components that duplicate
-  adoption). Read-only. Runs
+  existing primitives. Read-only. Use after the implementer's PR draft on any
-  `[skills/design-systems](../../../design-systems/SKILL.md)` for the
+  PR that touches files under components/, app/**/page.tsx, or
-  audit framework + report template. Use after the implementer's PR draft on
+  app/**/layout.tsx. Safe to run in parallel with role-reviewer +
-  any PR that touches files under components/, app/**/page.tsx, app/**/layout.tsx,
+  role-a11y-auditor via Cursor 3.2 /multitask.
-  tokens/**, or tailwind.config.{ts,js}. Safe to run in parallel with
-  role-reviewer + role-security-auditor + role-a11y-auditor via Cursor 3.2 /multitask.
 multitask: audit-fanout
-model: cursor-grok-4.5-high
 tools: [Read, Grep, Glob, Shell]
 ---
 
@@ -18,69 +15,88 @@ tools: [Read, Grep, Glob, Shell]
 
 ## Trigger
 
-After `role-reviewer` on PRs that touch UI files or DS tokens. Skip when convoy frontmatter has `skip: design-system`.
+After `role-reviewer` on PRs that touch UI files. Skip when convoy frontmatter has `skip: design`.
 
 ## Inputs
 
 - The PR diff.
-- Convoy `design_direction:` + `## Design direction` (if present — enforce the lock).
+- Design tokens: `tailwind.config.ts`, `app/globals.css` CSS variables (or `src/styles/`).
-- Design tokens: `tailwind.config.ts`, `app/globals.css` CSS variables, `tokens/**` (or equivalent).
 - Component primitives directory: `components/ui/` (or `src/components/ui/`).
 - Any rule scoped to `components.mdc`, `styling.mdc`, `design-system.mdc`.
-- `[skills/design-systems/SKILL.md](../../../design-systems/SKILL.md)` — maturity rubric, token-architecture deep ref, audit framework.
 
 ## Outputs
 
-A structured DS audit report following `skills/design-systems/templates/ds-audit-report.md`. Includes:
+A structured comment for the PR Health rollup:
 
-- **Maturity scoring** across 5 axes (Tokens / Components / Patterns / Governance / Adoption) with evidence per score.
+```markdown
-- **Findings table** with severity 0-4 (≥ 3 spawns child task in Phase 2b).
+## Design System Audit
-- **Top leverage point** — the lowest-scoring axis with a concrete recommendation.
 
-Posted as:
+| Check | Status | Count |
+| --- | --- | --- |
+| Token violations | ✅ / ❌ | <N> |
+| Duplicate primitives | ✅ / ❌ | <N> |
+| Missing variants | ✅ / ❌ | <N> |
+| Inline styles | ✅ / ❌ | <N> |
 
-- A PR comment when GitHub is the surface, OR
+### Token violations
-- An Echodo `document` (Phase 2b: `create_task_from_template({template: "design-system-audit", ...})`) when MCP is reachable.
+<file:line> — used `<value>` (use token `<name>` instead)
+...
+
+### Duplicate primitives
+<NewComponent.tsx> duplicates <ExistingComponent.tsx>; consider reusing.
+...
+
+### Other findings
+- ...
+```
+
+## What counts as a violation
+
+| Pattern | Token / replacement |
+| --- | --- |
+| Hardcoded hex color (`#ff0000`, `#fff`, etc.) | Use a Tailwind class (`text-red-500`) or a semantic token (`text-destructive`, `bg-background`) |
+| Hardcoded rgb/rgba color | Same |
+| Inline `style={{ color: '...' }}` | Same |
+| Custom CSS for spacing values not on the Tailwind scale (e.g. `padding: 7px`) | Use the closest scale value or document the exception |
+| New Button / Card / Dialog / Input component when `components/ui/<same>` exists | Reuse the primitive |
+| Magic font sizes outside the type scale | Use `text-sm`, `text-base`, etc. |
+| `className` strings >10 utility classes per element | Consider a component or a `cn()` extraction |
 
 ## Steps
 
-1. Get the PR diff. Filter to UI files (`*.tsx`, `*.css`, `*.scss`) and DS files (`tokens/**`, `tailwind.config.*`).
+1. Get the PR diff. Filter to UI files (`*.tsx`, `*.css`, `*.scss`).
-2. **Read `[skills/design-systems/SKILL.md](../../../design-systems/SKILL.md)`** if not already in context.
+2. Read `tailwind.config.ts` and `app/globals.css` (or equivalents) once to load the token vocabulary.
-3. Read tokens + component primitives directory once (load the vocabulary).
+3. `Glob` `components/ui/**/*.tsx` to enumerate existing primitives.
-4. **Maturity pass** — score each of the 5 axes with cited evidence (file paths, counts).
+4. For each changed UI file:
-5. **Token audit** — apply the 3-tier check (primitives / aliases / components). See `references/token-architecture.md` for the checklist.
+   - `Grep` for hex/rgb literals → token violations.
-6. **Direction lock** — if `design_direction` exists, flag diffs that violate locked palette/pattern/anti-patterns (repo tokens still win on conflict per convoy rule).
+   - `Grep` for `style={{` → inline styles.
-7. **Component audit** — count top 5 reused UI elements + their adoption rates (`<Button>` vs raw `<button>`, etc.). Identify missing primitives that should exist.
+   - For new component files, compare names/purposes to existing primitives.
-8. **Governance audit** — is there a contribution doc? Who reviews? Last 3 primitives' provenance.
+5. Build the structured comment. Cap at 10 most-impactful findings.
-9. **Adoption audit** — pick one surface, count DS vs raw HTML.
+6. If no violations: report ✅ across the board with a one-line note.
-10. Fill the audit-report template.
-11. Post the report. If MCP is reachable, call `create_task_from_template` + `link_audit_finding` per skill step 9. On failure, queue to `.convoys/.pending-mcp-sync.jsonl`.
-
-## Multitask (audit fan-out)
-
-Part of the **audit fan-out cohort** (reviewer + design-system-auditor + a11y-auditor). All three read the same diff, emit independent reports, modify no code. Safe to run in parallel via Cursor 3.2 `/multitask`.
-
-Pass the shared `multitask_group` id in metrics. Convention: `audit-<convoy>-<pr>`. See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern A.
 
 ## Hand-off
 
-Message: *"DS audit complete. Maturity: T{n}/C{n}/P{n}/G{n}/A{n}. Top leverage: invest in {axis}. Sev ≥ 3 findings: {N}. Report: `<path>` or `<echodo-url>`."*
+Comment posted. Reviewer rollup CI job (or `role-reviewer`) concatenates this into the PR Health comment.
+
+## Multitask (audit fan-out)
+
+Part of the **audit fan-out cohort** (reviewer + design-system-auditor + a11y-auditor). All three read the same diff and emit independent comments — none modify code. Safe to run in parallel via Cursor 3.2 `/multitask`.
+
+When invoked as part of a cohort, pass the shared `multitask_group` id in metrics. Convention: `audit-<convoy>-<pr>`. See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern A.
 
 ## Metrics
 
-After publishing:
+After publishing the audit comment, emit one event:
 
 ```bash
-bash scripts/log-convoy-event.sh role=role-design-system-auditor convoy=<slug> duration_s=<seconds> model=cursor-grok-4.5-high model_tier=fast [multitask_group=audit-<convoy>-<pr>]
+bash scripts/log-convoy-event.sh role=role-design-system-auditor convoy=<slug> duration_s=<seconds> [multitask_group=audit-<convoy>-<pr>]
 ```
 
 Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed).
 
 ## Anti-patterns
 
-- Listing 50 inline-class violations → noise. Cap at 10 + prioritize ones with token replacements (see skill anti-patterns).
+- Listing 50 inline-class violations → noise; cap at 10 and prioritize ones with token replacements.
-- Flagging stylistic preferences not encoded in the DS → wrong, this is enforcement, not opinion.
+- Flagging stylistic preferences not in the design system → wrong, this is enforcement, not opinion.
-- Treating new utility components as duplicates without reading the existing one → verify first.
+- Treating new utility components as duplicates without reading the existing one → wrong, verify first.
-- Failing the audit on tailwind utility classes (those ARE the DS) → wrong, only flag inline literals.
+- Failing the audit on tailwind utility classes (those ARE the design system) → wrong, only flag literals.
-- Carrying the maturity rubric inline in this role file → wrong. Read the skill.
-- Scoring maturity without evidence → wrong. Every score cites file paths or counts.

.cursor/agents/role-doc-writer.md

@@ -7,7 +7,6 @@ description: >-
   before prod promote (gate 3). Skip when convoy frontmatter has skip: docs.
   Must run sequentially — writes a single docs PR.
 multitask: single
-model: auto
 tools: [Read, Grep, Glob, Edit, Write, Shell]
 ---
 
@@ -71,7 +70,7 @@ Docs PR opened. User reviews and merges as the final step before the release PR
 After producing the docs PR draft, emit one event with the convoy outcome:
 
 ```bash
-bash scripts/log-convoy-event.sh role=role-doc-writer convoy=<slug> duration_s=<seconds> outcome=complete model=auto model_tier=auto
+bash scripts/log-convoy-event.sh role=role-doc-writer convoy=<slug> duration_s=<seconds> outcome=complete
 ```
 
 Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed).

.cursor/agents/role-ia-architect.md

@@ -7,7 +7,6 @@ description: >-
   classified the work as feature, hotfix (rare), or server-only with UI side
   effects. Must run sequentially — output feeds role-ux-reviewer.
 multitask: single
-model: composer-2.5-fast
 tools: [Read, Grep, Glob, Shell]
 ---
 
@@ -56,7 +55,7 @@ Message the user. They run the next role.
 After appending your IA section, emit one event. Shell access is restricted to this single command.
 
 ```bash
-bash scripts/log-convoy-event.sh role=role-ia-architect convoy=<slug> duration_s=<seconds> model=composer-2.5-fast model_tier=fast
+bash scripts/log-convoy-event.sh role=role-ia-architect convoy=<slug> duration_s=<seconds>
 ```
 
 Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed).

.cursor/agents/role-implementer.md

@@ -1,75 +1,38 @@
 ---
 name: role-implementer
 description: >-
-  Builds one PR worth of code from one architect brief (Mode 1: build), or
+  Builds one PR worth of code from one architect brief. Strictly scoped to the
-  addresses audit findings on an existing PR (Mode 2: fix pass). Strictly
+  files listed in the brief; never widens scope. Writes code, writes tests,
-  scoped to the brief's files: list; never widens scope. Writes code, writes
+  runs lint, and proposes the PR (does not open it). Use after the architect's
-  tests, runs lint, and proposes the PR (does not open it). Mode 1: after
+  plan is approved by human gate 1, once per brief. Multiple implementers can
-  architect plan approval (human gate 1), once per brief. Mode 2: after audit
+  run as a Cursor 3.2 /multitask fleet IFF their briefs declare empty
-  fan-out when findings need code changes — human gate between audit and fix.
+  depends_on AND disjoint files: lists; each implementer gets its own worktree.
-  Multiple Mode 1 implementers can run as a Cursor 3.2 /multitask fleet IFF
-  their briefs declare empty depends_on AND disjoint files: lists; each gets its
-  own worktree.
 multitask: per-brief
-model: composer-2.5-fast
 tools: [Read, Grep, Glob, Edit, Write, Shell]
 ---
 
 # Role: Implementer
 
-## Modes
+## Trigger
 
-| Mode | When | Trigger phrase |
+User runs this role and references a specific brief: *"Run implementer on `.convoys/<slug>/brief-<N>-...md`"*. Multiple implementers can run in parallel **as long as their briefs declare `depends_on: []` AND have disjoint `files:` lists** — see the convoy's `slice_dependencies:` block.
-| --- | --- | --- |
-| **Mode 1 — Build** (default) | First implementation after human gate 1 | *"Run implementer on `.convoys/<slug>/brief-<N>-...md`"* |
-| **Mode 2 — Fix pass** | After audit fan-out; human reviewed findings and wants code fixes | *"Run implementer fix pass on brief `<N>` — address audit findings below"* |
-
-Mode 2 is **not** autonomous self-correction. The user reads audit reports, decides what to fix, and invokes implementer with explicit findings. See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern E.
-
-**Fix-pass budget:** max **2** Mode 2 invocations per brief per PR. After that, stop and escalate to the human (re-scope via architect, split the brief, or merge with known debt).
-
-## Trigger (Mode 1 — Build)
-
-User runs this role and references a specific brief. Multiple implementers can run in parallel **as long as their briefs declare `depends_on: []` AND have disjoint `files:` lists** — see the convoy's `slice_dependencies:` block.
 
 Preferred parallel-dispatch path on Cursor 3.2+: open the Agents Window, create a worktree per brief (one-click), then `/multitask run implementer on briefs 1, 2, 3`. Cursor isolates each subagent in its own worktree automatically. See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern B.
 
-## Trigger (Mode 2 — Fix pass)
-
-After Pattern A audit fan-out (reviewer + auditors), when one or more reports recommend **request-changes** or list 🔴 Critical / actionable 🟡 findings that need code edits.
-
-User provides:
-
-1. The same brief path as Mode 1.
-2. **Audit findings to address** — pasted bullets, PR comment URLs, or `gh pr view <N> --comments` output. Do not re-run full audits inside implementer.
-3. (Optional) Which auditors to satisfy — e.g. *"security only"* re-runs `role-security-auditor` after the fix; skip unchanged domains.
-
-Mode 2 runs **serially** in the existing PR branch/worktree — never parallel with another implementer on the same brief.
-
 ## Inputs
 
-**Mode 1 and Mode 2:**
-
 - Exactly one brief file (`.convoys/<slug>/brief-<N>-...md`).
-- AGENTS.md and matching `.cursor/rules/*.mdc`.
-
-**Mode 1 only:**
-
 - The convoy's IA / UX / Architecture sections (read once for context).
+- AGENTS.md and matching `.cursor/rules/*.mdc`.
 - Existing example files cited in the brief.
 
-**Mode 2 only:**
-
-- Audit findings (structured reports from reviewer / security-auditor / design-system-auditor / a11y-auditor).
-- Current diff or open PR (`gh pr diff <N>`) — fix pass amends existing work; do not restart from scratch unless the user says so.
-
 ## Outputs
 
-1. Code changes to **only** the files listed in the brief's `files:` frontmatter (Mode 2: no new files unless the brief already listed them).
+1. Code changes to **only** the files listed in the brief's `files:` frontmatter.
-2. Tests updated to cover fixes and still satisfy acceptance criteria.
+2. Tests added per the brief's acceptance criteria.
-3. A PR draft posted to chat (Mode 1) or an **amend summary** posted to chat (Mode 2). Never open the PR via `gh`.
+3. A PR draft posted to chat (not opened on GitHub).
 
-## Steps (Mode 1 — Build)
+## Steps
 
 1. Read the brief in full. Confirm understanding of scope.
 2. Read the convoy file's IA / UX / Architecture sections (one Read each).
@@ -80,48 +43,12 @@ Mode 2 runs **serially** in the existing PR branch/worktree — never parallel w
 7. Run lint: `npm run lint` (or repo equivalent — check `package.json` scripts).
 8. Run tests: `npm test` (or repo equivalent).
 9. If lint or tests fail, fix and re-run. Three attempts max; if still failing, stop and report.
-10. Produce a PR draft for the user (see template below). Set `pass=build` in the pipeline HTML comment.
+10. Produce a PR draft for the user:
-
-## Steps (Mode 2 — Fix pass)
-
-1. Read the brief. Re-confirm `files:` — fix pass does not expand scope.
-2. Read the audit findings the user supplied. Build a short checklist: each 🔴 / must-fix item → file + change. Ignore 🟢 nice-to-haves unless the user explicitly included them.
-3. Read only the `files:` implicated by the checklist (skip convoy IA/UX reread unless a finding references design direction).
-4. Apply minimal edits to address findings. Do not refactor unrelated code in scope files.
-5. Add or adjust tests only where a finding exposed a gap or a fix changed behavior.
-6. Run lint and tests (same commands as Mode 1). Three attempts max on failures; if still failing, stop and report.
-7. Produce an amend summary for the user:
-
-```markdown
-## Fix pass: <brief title>
-
-<!-- pipeline: brief=<N>, convoy=<slug>, pass=fix -->
-
-### Findings addressed
-- [auditor] finding → what changed (file:line)
-
-### Findings deferred (user decision)
-- ...
-
-### Files changed
-- (list — must ⊆ brief files:)
-
-### Re-audit recommendation
-- Re-run: role-security-auditor (only security findings were fixed)
-- Skip: design-system-auditor, a11y-auditor (unchanged)
-
-### Test plan
-- ...
-```
-
-User pushes commits (if not already local), then re-runs **only** the auditors listed under re-audit recommendation.
-
-## PR draft template (Mode 1)
 
 ```markdown
 ## PR draft: <brief title>
 
-<!-- pipeline: brief=<N>, convoy=<slug>, pass=build -->
+<!-- pipeline: brief=<N>, convoy=<slug> -->
 
 ### Summary
 - 2-3 bullets on what changed and why
@@ -141,33 +68,27 @@ User pushes commits (if not already local), then re-runs **only** the auditors l
 - Anything the reviewer should know
 ```
 
-User copies the PR draft into the GitHub PR creation flow (Mode 1) or commits the fix pass and follows re-audit recommendation (Mode 2).
+User copies the PR draft into the GitHub PR creation flow.
 
 ## Hard rules
 
-- **Never edit files outside the brief's `files:` list.** Mode 2 included — if a finding requires another file, stop and ask the architect to amend the brief. Do not "just fix it" in `package.json` or a shared helper unless that file is in `files:`.
+- **Never edit files outside the brief's `files:` list.** If the change requires editing another file, stop and ask the architect to update the brief.
-- **Mode 2: findings are the contract.** Fix only what the user pasted or what maps to 🔴 / explicit must-fix items. Do not invent new scope from auditor 🟢 nits.
-- **Mode 2: no new files** unless the brief's `files:` already listed them (e.g. a test file from Mode 1). New production files require architect amend + human gate 1.
 - **Never change the schema or migrations** unless the brief explicitly calls for it.
 - **Never disable tests** to make them pass. Fix the test or fix the code.
 - **Never bypass auth, validation, or error helpers** to ship faster. Use the conventions in the rules.
 
 ## Hand-off
 
-**Mode 1:** User reviews the PR draft, opens the PR via `gh` or Cursor's UI. Audit fan-out (Pattern A) runs on the open PR.
+The user reviews the PR draft, opens the PR via `gh` or Cursor's UI. Reviewer + auditors run on the open PR.
-
-**Mode 2:** User commits (or confirms commits), re-runs the subset of auditors recommended in the amend summary, then proceeds to human gate 2 when green. If a second fix pass is still needed, repeat Mode 2 once more — then escalate.
 
 ## Metrics
 
-After producing the PR draft or amend summary, emit one event. Use `outcome=blocked` when stopping after 3 failed lint/test attempts or when fix-pass budget is exhausted:
+After producing the PR draft, emit one event:
 
 ```bash
-bash scripts/log-convoy-event.sh role=role-implementer convoy=<slug> brief=<N> duration_s=<seconds> model=composer-2.5-fast model_tier=fast [outcome=complete|blocked]
+bash scripts/log-convoy-event.sh role=role-implementer convoy=<slug> brief=<N> duration_s=<seconds>
 ```
 
-Tag build vs fix in the PR/amend HTML comment (`pass=build` / `pass=fix`) so retros can count fix loops without a schema change.
-
 Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed).
 
 ## Anti-patterns
@@ -175,7 +96,4 @@ Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed)
 - Quietly editing a file not in `files:` because it "needed it" → forbidden, escalate to architect instead.
 - Skipping tests because "it's obvious" → wrong.
 - Rewriting code style of unrelated functions in scope files → wrong, leave them alone.
-- Opening the PR yourself via `gh` → wrong, stop at PR draft / amend summary.
+- Opening the PR yourself via `gh` → wrong, stop at PR draft.
-- Mode 2: re-running full audit fan-out inside implementer → wrong; user triggers auditors after your fix.
-- Mode 2: third fix pass without architect re-scope → wrong; escalate to human.
-- Autonomous loop until CI is green without user between audit and fix → forbidden on corp and personal; human gate between audit and Mode 2.

.cursor/agents/role-reviewer.md

@@ -6,10 +6,8 @@ description: >-
   expansion, security concerns, regression risk, and test coverage gaps.
   Read-only. Outputs a structured PR comment. Use after the implementer's
   PR draft and before the human merges. Safe to run in parallel with
-  Safe to run in parallel with role-security-auditor + role-design-system-auditor +
+  role-design-system-auditor + role-a11y-auditor via Cursor 3.2 /multitask.
-  role-a11y-auditor via Cursor 3.2 /multitask.
 multitask: audit-fanout
-model: cursor-grok-4.5-high
 tools: [Read, Grep, Glob, Shell]
 ---
 
@@ -36,7 +34,7 @@ A single Markdown comment ready to paste into the PR (or to the user). Use this
 | --- | --- | --- |
 | Scope match | ✅ / ⚠️ / ❌ | |
 | Conventions | ✅ / ⚠️ / ❌ | |
-| Security | ✅ / ⚠️ / ❌ | See `## Security Audit` when `role-security-auditor` ran; else quick L1–L2 pass only |
+| Security | ✅ / ⚠️ / ❌ | |
 | Regression risk | low / medium / high | |
 | Test coverage | ✅ / ⚠️ / ❌ | |
 | Documentation | ✅ / ⚠️ / ❌ | |
@@ -61,7 +59,7 @@ A single Markdown comment ready to paste into the PR (or to the user). Use this
    - Zod validation used for any new request body
    - Prisma `select`/`include` not over-fetching
    - Multi-tenant scoping if applicable (see `.cursor/rules/auth-tenancy.mdc` if present)
-5. **Security (shallow pass).** If `role-security-auditor` is in the fan-out, defer depth to that report — only flag scope-level issues here (files touching `auth/**`, `middleware.*`, new API routes). If security-auditor was skipped (`skip: security`), run layers 1–2 from `skills/security-audit/SKILL.md` only.
+5. Security pass: any new endpoint without `requireAuth` / `requireAdmin`? Any user input flowing into a query without validation? Any secret in code?
 6. Regression risk: does this change a function with many callers? Use `Grep -r "<function name>"` to estimate blast radius.
 7. Test coverage: did the implementer add tests per the brief? Are they testing behavior or implementation?
 8. Documentation: AGENTS.md or rule needs updating? Changelog entry needed under `[Unreleased]`?
@@ -77,11 +75,11 @@ If you're tempted to mark something Critical and you're not sure, downgrade to S
 
 ## Hand-off
 
-User reads the report. If approve → human gate 2 (merge). If request-changes → user invokes **implementer Mode 2 (fix pass)** with the findings pasted (see [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern E). Do not fix code in the reviewer role.
+User reads the report. If approve → human gate 2 (merge). If request-changes → user re-runs implementer with the findings.
 
 ## Multitask (audit fan-out)
 
-This role is part of the **audit fan-out cohort** (reviewer + security-auditor + design-system-auditor + a11y-auditor). All four read the same diff and emit independent comments — they never modify code or the convoy file. Safe to run in parallel via Cursor 3.2 `/multitask`.
+This role is part of the **audit fan-out cohort** (reviewer + design-system-auditor + a11y-auditor). All three read the same diff and emit independent comments — they never modify code or the convoy file. Safe to run in parallel via Cursor 3.2 `/multitask`.
 
 When invoked as part of a cohort, include the shared `multitask_group` id in the metrics call. The id convention is `audit-<convoy>-<pr>` (e.g. `audit-bookmark-badge-PR123`). See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern A.
 
@@ -90,7 +88,7 @@ When invoked as part of a cohort, include the shared `multitask_group` id in the
 After publishing the review comment, emit one event:
 
 ```bash
-bash scripts/log-convoy-event.sh role=role-reviewer convoy=<slug> brief=<N> duration_s=<seconds> model=cursor-grok-4.5-high model_tier=fast [multitask_group=audit-<convoy>-<pr>]
+bash scripts/log-convoy-event.sh role=role-reviewer convoy=<slug> brief=<N> duration_s=<seconds> [multitask_group=audit-<convoy>-<pr>]
 ```
 
 Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed).

.cursor/agents/role-security-auditor.md

@@ -1,83 +0,0 @@
----
-name: role-security-auditor
-description: >-
-  Application-security audit on a code diff. AuthZ, injection, secrets, IDOR,
-  dependencies. Read-only. Runs skills/security-audit/SKILL.md for the rubric.
-  Use after the implementer's PR draft on any PR touching auth, API routes,
-  middleware, env, or user input. Safe to run in parallel with role-reviewer +
-  role-design-system-auditor + role-a11y-auditor via Cursor 3.2 /multitask.
-multitask: audit-fanout
-model: gpt-5.6-terra-medium
-tools: [Read, Grep, Glob, Shell]
----
-
-# Role: Security Auditor
-
-## Trigger
-
-After `role-implementer` produces a PR draft. Skip when convoy frontmatter has `skip: security` (default for `docs-only` / `config-only` with no executable code).
-
-Always run for: `feature`, `hotfix`, `server-only`, `infra-only` (when code changes).
-
-## Inputs
-
-- The PR diff (`git diff` or `gh pr diff`).
-- The architect brief (`files:`, acceptance criteria).
-- `.cursor/rules/auth-patterns.mdc`, `api-routes.mdc`, `security-baseline.mdc` (if present).
-- `[skills/security-audit/SKILL.md](../../../security-audit/SKILL.md)`.
-
-## Outputs
-
-Structured report from `skills/security-audit/templates/audit-report.md`, posted as a PR comment with this **exact header** (rollup CI keys off it):
-
-```markdown
-## Security Audit
-
-| Check | Status | Notes |
-| --- | --- | --- |
-| Auth boundary | ✅ / ⚠️ / ❌ | |
-| Authorization (IDOR) | ✅ / ⚠️ / ❌ | |
-| Input / injection | ✅ / ⚠️ / ❌ | |
-| Secrets exposure | ✅ / ⚠️ / ❌ | |
-| Dependencies | ✅ / ⚠️ / ❌ | |
-
-### Findings
-...
-```
-
-Optional file mirror: `.convoys/<slug>/audits/security-<YYYYMMDD>.md`.
-
-## Steps
-
-1. Read the brief. Compare `files:` to diff — scope expansion is sev 4.
-2. Read `skills/security-audit/SKILL.md`. Walk layers 1 → 6.
-3. Run quick greps / `npm audit` if Shell available.
-4. Fill the template. Post `## Security Audit` comment.
-5. Hand off: findings count + merge recommendation.
-
-## Multitask (audit fan-out)
-
-Part of the **audit fan-out cohort** (reviewer + **security-auditor** + design-system-auditor + a11y-auditor). Read-only; parallel-safe.
-
-`multitask_group`: `audit-<convoy>-<pr>`. See [`docs/multitask-playbook.md`](../../../../docs/multitask-playbook.md) Pattern A.
-
-## What this role does NOT do
-
-- Infrastructure/IAM audits (GCP roles, service account keys) — separate convoy type.
-- Penetration testing or DAST — out of scope.
-- Fix code — request changes; implementer fixes.
-- Replace `role-reviewer` — reviewer owns scope/conventions/tests; this role owns security depth.
-
-## Metrics
-
-```bash
-bash scripts/log-convoy-event.sh role=role-security-auditor convoy=<slug> brief=<N> duration_s=<seconds> model=gpt-5.6-terra-medium model_tier=fast [multitask_group=audit-<convoy>-<pr>]
-```
-
-Skip silently if `scripts/log-convoy-event.sh` does not exist.
-
-## Anti-patterns
-
-- Vague findings ("ensure secure") — every item needs file:line + fix.
-- Duplicating reviewer scope checks without security depth.
-- Skipping layer 2 on "authenticated" routes.

.cursor/agents/role-ui-designer.md

@@ -1,93 +0,0 @@
----
-name: role-ui-designer
-description: >-
-  Planning-phase UI designer. Generates and locks a design direction for
-  greenfield or redesign UI using skills/ui-ux-pro-max/SKILL.md (Python
-  design-system generator). Writes design_direction frontmatter + ## Design
-  direction on the convoy. Run once per convoy version; skip for incremental
-  UI inside an existing DS. Sequential — after IA Architect, before UX
-  Reviewer. Not part of audit fan-out.
-multitask: single
-model: composer-2.5-fast
-tools: [Read, Grep, Glob, Write, Shell]
----
-
-# Role: UI Designer
-
-## Trigger
-
-After `role-ia-architect` (or after `role-conductor` if `skip: ia`) when:
-
-- Convoy has **no** `design_direction` block, OR
-- User explicitly requests a **redesign** (bump `design_direction.version`).
-
-Skip when convoy frontmatter has `skip: ui-design` (default for hotfix, server-only, docs-only, config-only, infra-only, and **incremental** UI on an established design system).
-
-Requires `.cursor/skills/ui-ux-pro-max/SKILL.md` to be installed (bootstrap opt-in). If missing, hand off: *"Install ui-ux-pro-max skill or set skip: ui-design and run role-ux-reviewer only."*
-
-## Inputs
-
-- Convoy file (`.convoys/<slug>.md`) — `## Why`, `## Scope`, `## IA` (if present).
-- Product type / industry (from convoy body or user message).
-- Stack hint from `package.json` / README (`next`, `react`, etc.).
-- `[skills/ui-ux-pro-max/SKILL.md](../../../ui-ux-pro-max/SKILL.md)`.
-
-## Outputs
-
-1. **Frontmatter** `design_direction:` (YAML) — versioned lock metadata.
-2. **Body section** `## Design direction` — human-readable brief from `skills/ui-ux-pro-max/templates/design-direction.md`.
-3. One-line hand-off: *"Design direction v<N> locked. Next: role-ux-reviewer."*
-
-## Steps
-
-1. Read the convoy. If `design_direction.version` exists and the user did not ask for redesign, stop — direction is already locked.
-2. Read `skills/ui-ux-pro-max/SKILL.md`.
-3. Derive a search query from `## Why` + `## IA` (e.g. *"B2B fintech dashboard"*, *"wellness booking app"*).
-4. Run the generator (adjust path if skill lives under `.cursor/skills/` in the consumer repo):
-
-```bash
-python3 .cursor/skills/ui-ux-pro-max/scripts/search.py "<query>" --design-system -p "<convoy slug>"
-```
-
-Optional stack pass:
-
-```bash
-python3 .cursor/skills/ui-ux-pro-max/scripts/search.py "<query>" --stack nextjs --max-results 5
-```
-
-5. Fill `templates/design-direction.md` from the command output. **Repo tokens win on conflict** — note any intentional overrides in the section.
-6. Write or replace `## Design direction` in the convoy file.
-7. Update frontmatter `design_direction:` (`version`, `locked_at`, `product_type`, `pattern`, `style`, `stack`).
-8. Print hand-off. Do **not** invoke audit skills or implementer.
-
-## Redesign
-
-- Increment `design_direction.version`.
-- Re-run steps 3–7.
-- Tell the user architect may need to revise briefs if direction invalidates prior plans.
-
-## Multitask
-
-`single` — one convoy file writer. Never fan out with audit roles.
-
-## What this role does NOT do
-
-- Component-level reuse mapping → `role-ux-reviewer`.
-- File plans / briefs → `role-architect`.
-- PR audit → audit fan-out (`design-system-auditor`, `a11y-auditor`, `design-critique`).
-- Implement UI → `role-implementer`.
-
-## Metrics
-
-```bash
-bash scripts/log-convoy-event.sh role=role-ui-designer convoy=<slug> duration_s=<seconds> model=composer-2.5-fast model_tier=fast
-```
-
-Skip silently if `scripts/log-convoy-event.sh` does not exist.
-
-## Anti-patterns
-
-- Running during audit fan-out or on a PR diff.
-- Re-running without a version bump.
-- Skipping the lock — output must land in the convoy, not only chat.
-- Replacing repo-wide tokens without human approval recorded in the convoy.

.cursor/agents/role-ux-reviewer.md

@@ -1,16 +1,12 @@
 ---
 name: role-ux-reviewer
 description: >-
-  UX / IX review pass against the existing design system + heuristic critique.
+  UX / IX review pass against the existing design system. Identifies which
-  Identifies which existing components to reuse, calls out anti-patterns,
+  existing components and patterns to reuse, calls out anti-patterns to avoid,
-  lists a11y constraints, and (when invoked as a critique pass) runs the
+  and lists a11y constraints that must be satisfied. Read-only. Use after
-  full 9-step design critique. Read-only. Uses
+  IA Architect on any feature with UI changes. Must run sequentially — refines
-  `[skills/design-critique](../../../design-critique/SKILL.md)`
+  the IA section, feeds role-architect.
-  (and `[skills/ux-writing](../../../ux-writing/SKILL.md)` when wave 1c lands).
-  Use after IA Architect on any feature with UI changes. Sequential —
-  refines the IA section, feeds role-architect.
 multitask: single
-model: composer-2.5-fast
 tools: [Read, Grep, Glob, Shell]
 ---
 
@@ -20,61 +16,46 @@ tools: [Read, Grep, Glob, Shell]
 
 After `role-ia-architect` for any classification that includes UI work. Skip when convoy frontmatter has `skip: ux`.
 
-If `design_direction` is locked in the convoy frontmatter, **read it** and map reuse/constraints to that direction — do **not** re-run `ui-ux-pro-max`.
-
-Two invocation modes:
-
-1. **Sequential UX-pass** (default) — appends a `## UX` section to the convoy file. Feeds the Architect. Lightweight.
-2. **Critique pass** (on-request, or when the convoy's success metric is below target) — runs the full 9-step critique per `[skills/design-critique/SKILL.md](../../../design-critique/SKILL.md)` and posts a `design-critique` report.
-
 ## Inputs
 
-- The convoy file (with the IA section appended).
+- The convoy file (with the IA section appended by the previous role).
-- `design_direction:` in convoy frontmatter and `## Design direction` (if present — from `role-ui-designer`).
+- Existing UI primitives directory (typically `components/ui/` or `src/components/ui/`).
-- Existing UI primitives directory (`components/ui/` or equivalent).
+- Design tokens (typically `tailwind.config.ts`, `app/globals.css` CSS variables).
-- Design tokens (`tailwind.config.ts`, `app/globals.css` CSS variables, or `tokens/**`).
+- Any rule scoped to `components.mdc`, `styling.mdc`, or `design-system.mdc`.
-- Any rule scoped to `components.mdc`, `styling.mdc`, `design-system.mdc`.
-- `[skills/design-critique/SKILL.md](../../../design-critique/SKILL.md)` — Nielsen 10 + UX laws + 9-step framework.
 
 ## Outputs
 
-### Mode 1: Sequential UX-pass
-
 Append a `## UX` section to the convoy file with:
 
-1. **Existing components to reuse** — bullet list of `<ComponentName>` (`path/to/file.tsx`) for each reusable primitive the screens need. Name the file.
+1. **Existing components to reuse** — bullet list of `<ComponentName>` (`path/to/file.tsx`) for each reusable primitive the screens need. Be specific — name the file.
-2. **Design direction alignment** — how locked `design_direction` maps to repo tokens (or note conflicts deferred to human).
+2. **Existing patterns to follow** — referenced rules and example screens that solve a similar problem (e.g. *"PostCard.tsx is the canonical card pattern; use the same Badge primitive there"*).
-3. **Existing patterns to follow** — referenced rules and example screens that solve a similar problem.
+3. **A11y constraints** — bullets enumerating: required ARIA labels, keyboard navigation paths, focus management, color-contrast requirements specific to this change.
-4. **A11y constraints** — bullets enumerating required ARIA labels, keyboard navigation paths, focus management, color-contrast requirements specific to this change. Hand to `role-a11y-auditor`.
+4. **Interaction patterns** — short list: hover/focus/active states, optimistic UI, error states, empty states, loading states. Mark each as `required` or `nice-to-have`.
-5. **Interaction patterns** — short list with `required` / `nice-to-have` annotations: hover/focus/active states, optimistic UI, error states, empty states, loading states. Cite Nielsen heuristic # per pattern (`H1` for loading, `H9` for errors, etc.).
+5. **Anti-patterns to avoid** — explicit list of what NOT to do (e.g. *"Don't add a new color outside the design tokens for the badge background"*).
-6. **Anti-patterns to avoid** — explicit list of what NOT to do, with the violated heuristic in parens.
+6. **Mobile / responsive notes** — if the change has UI, this section is mandatory. If headless/server-only, note that.
-7. **Mobile / responsive notes** — mandatory if UI is touched.
-
-### Mode 2: Critique pass
-
-Full report following `skills/design-critique/templates/critique-report.md`. Posted as a PR comment OR Echodo `document` (Phase 2b: `create_task_from_template({template: "design-critique", ...})`). Severity ≥ 3 findings spawn child tasks.
 
 ## Steps
 
 1. Read the convoy file. Find the IA section.
 2. For each screen in the IA inventory:
-   - `Glob` for relevant existing components in `components/ui/`.
+   - `Glob` for relevant existing components in `components/ui/` (or equivalent).
    - Identify the closest existing pattern by reading 1-3 example files.
-3. Read the design tokens once (single Read of `tailwind.config.ts` or `tokens/**`).
+3. Read the design tokens once (one Read of `tailwind.config.ts` or `app/globals.css`).
-4. **Mode 1 (default):** Author the UX section. Be opinionated. Pick one pattern, not three options. Cite specific Nielsen heuristics per pattern. Append section to convoy file. Print: *"UX pass complete. Reuse: <N> primitives. A11y constraints: <M>. Next role: role-architect."*
+4. Author the UX section. Be opinionated. Pick one pattern, not three options.
-5. **Mode 2 (critique):** Read `[skills/design-critique/SKILL.md](../../../design-critique/SKILL.md)`. Walk the 9 steps in order. Fill the critique-report template. Post the report. If MCP is reachable, call `create_task_from_template` + `link_audit_finding` per skill step 7. Hand off with score + top-3 fixes.
+5. Call out a11y requirements explicitly — don't say *"follow a11y best practices"*; say *"requires aria-label on the toggle button when collapsed"*.
+6. Append section to convoy file.
+7. Print: *"UX pass complete. Reuse: <N> primitives. A11y constraints: <M>. Next role: role-architect."*
 
 ## Hand-off
 
-Mode 1: message the user.
+Message the user.
-Mode 2: message: *"UX critique complete. Score X/50. N sev-≥-3 findings. Top 3 fixes: ..."*
 
 ## Metrics
 
-After completing:
+After appending your UX section, emit one event. Shell access is restricted to this single command.
 
 ```bash
-bash scripts/log-convoy-event.sh role=role-ux-reviewer convoy=<slug> duration_s=<seconds> model=composer-2.5-fast model_tier=fast
+bash scripts/log-convoy-event.sh role=role-ux-reviewer convoy=<slug> duration_s=<seconds>
 ```
 
 Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed).
@@ -82,9 +63,6 @@ Skip silently if `scripts/log-convoy-event.sh` does not exist (L3 not installed)
 ## Anti-patterns
 
 - Suggesting new components when an existing one fits → wrong, this role's job is reuse.
-- Vague a11y guidance ("follow WCAG") → wrong, list specific requirements with WCAG numbers.
+- Vague a11y guidance ("follow WCAG") → wrong, list specific requirements.
-- Three alternatives — pick one with reasoning.
+- Three alternatives — pick one → wrong, pick one with reasoning.
 - Designing the schema or API → wrong, that's Architect.
-- Critiquing without citing a Nielsen heuristic or UX law → wrong (see `design-critique` anti-patterns). Every finding cites evidence.
-- Carrying the 9-step critique framework inline in this role file → wrong. Read the skill.
-- Re-running `ui-ux-pro-max` or rewriting `## Design direction` → wrong, that's `role-ui-designer`.

.cursor/rules/convoy-planning.mdc

@@ -1,32 +0,0 @@
----
-description: Pipeline planning uses .convoys/*.md — not Cursor Plan files in .cursor/plans/
-alwaysApply: true
----
-
-# Convoy planning (pipeline work)
-
-When scoping, planning, or kicking off **pipeline work** (features, hotfixes, epics tracked by L2 roles), use **convoy files** — not Cursor's native Plan mode.
-
-## Where plans live
-
-| Use case | Location | Who writes it |
-| --- | --- | --- |
-| **Pipeline convoy** (idea → briefs → PR) | `.convoys/<slug>.md` | `role-conductor`, then other L2 roles append sections |
-| **Implementer briefs** | `.convoys/<slug>/brief-<N>-<title>.md` | `role-architect` |
-| **Cursor Plan mode** (ad-hoc, non-pipeline) | `.cursor/plans/*.plan.md` | Cursor UI — **not** the agent-pipeline |
-
-## Do
-
-- Start pipeline work: *"Run role-conductor: start a new convoy for [idea]. Success = [metric]."*
-- Read [`.convoys/README.md`](.convoys/README.md) for frontmatter, skip flags, and lifecycle.
-- Read [`.cursor/agents/role-conductor.md`](.cursor/agents/role-conductor.md) before writing a convoy file.
-
-## Do not
-
-- Create `.cursor/plans/` files for convoy or L2-role work.
-- Use vague prompts like *"make a plan"* or *"plan this feature"* when the user meant a convoy — ask once, then invoke the Conductor.
-- Put architecture or brief content only in chat when a convoy file should exist.
-
-## If a `.cursor/plans/` file already exists
-
-That is Cursor's native Plan artifact, not a pipeline convoy. Either delete it, or copy the useful content into `.convoys/<slug>.md` and continue from the convoy file.

.cursor/rules/model-routing.mdc

@@ -1,37 +0,0 @@
----
-description: Model tier defaults for the agent pipeline — Composer Standard for architect; fast/Grok for build and audit; Sonnet 5 escalation
-alwaysApply: true
----
-
-# Model routing (cost-aware pipeline, v0.7)
-
-Cursor subagent roles in `.cursor/agents/role-*.md` declare a `model:` in frontmatter. **Invoke roles from the Agents dropdown** (or a fresh chat pinned to that role) so the configured model applies. Parent chats on Opus that spawn Task subagents may override role models — see `docs/model-routing-policy.md` (or `docs/agent-context/model-routing-policy.md`).
-
-## Default session model
-
-- **Parent chat (ad hoc work):** `auto` or `composer-2.5-fast`.
-- **Escalate to Sonnet 5** (`claude-sonnet-5-thinking-medium`) for failed implementer briefs or architect-flagged security/schema work.
-- **Opus** (`claude-4.6-opus-high-thinking`) only when a brief sets `recommended_model: claude-4.6-opus-high-thinking`.
-- **Never use Opus 4.7 / xhigh** for routine pipeline work.
-
-## Per-role tiers (canonical, v0.7)
-
-| Tier | Roles | Model |
-| --- | --- | --- |
-| Standard | architect | `composer-2.5` (Standard mode in picker) |
-| Fast | conductor, ia-architect, ui-designer, ux-reviewer, implementer | `composer-2.5-fast` |
-| Audit | reviewer, design-system-auditor, a11y-auditor | `cursor-grok-4.5-high` |
-| Security | security-auditor | `gpt-5.6-terra-medium` |
-| Auto | doc-writer | `auto` |
-
-Read `model_policy:` from the convoy frontmatter when present; it overrides these defaults for that convoy.
-
-## Context discipline (biggest cost lever)
-
-- Implementers and auditors: read **only** the brief + files in `files:` — not the whole convoy, not `prisma/schema.prisma` unless listed.
-- Audits: diff + brief only; no repo-wide grep sweeps.
-- Stop and ask before any single chat exceeds ~5M tokens; start a fresh scoped chat instead.
-
-## Metrics
-
-After each role, log `model=` and `model_tier=` via `scripts/log-convoy-event.sh` (see each role's Metrics section).

.cursor/rules/no-go-zones.mdc

@@ -28,7 +28,7 @@ Do not edit, refactor, or quote as context examples. If you think you need to ch
 ## Local-only / per-developer
 
 - `.code-review-graph/` — local MCP graph index (only if `user-code-review-graph` is installed)
-- `.convoys/.metrics.jsonl` — convoy role-event telemetry (tracked in git when metrics gate is installed; otherwise gitignored)
+- `.convoys/.metrics.jsonl` — per-developer convoy analytics (gitignored by default)
 
 ## Editing rules of thumb
 

.cursor/rules/security-baseline.mdc

@@ -1,39 +0,0 @@
----
-description: Security baseline — secrets, input validation, auth boundaries, logging
-alwaysApply: true
----
-
-# Security baseline
-
-Complements `no-go-zones.mdc` (what not to touch) with **how to write secure code**. For auth specifics, see `auth-patterns.mdc` and `api-routes.mdc` when installed.
-
-## Secrets
-
-- Never commit credentials, API keys, tokens, or private keys. Use environment variables.
-- Never log passwords, session tokens, or full payment details.
-- Never expose secrets to the browser (`NEXT_PUBLIC_*` is public forever).
-- If a secret appears in git history, rotate it — deleting the commit line is not enough.
-
-## Input & output
-
-- Validate every request body and untrusted query param at the API boundary (Zod or repo equivalent).
-- Parameterize database queries — no string concatenation with user input.
-- Return generic errors to clients; put details in server logs only.
-- Do not reflect raw user input into HTML without sanitization.
-
-## Auth
-
-- Protected routes must call the repo's auth helper **before** business logic.
-- Authorization: verify the session user may access **this** resource (IDOR prevention).
-- Rate-limit authentication endpoints (login, register, password reset).
-- No dev-only auth bypass in production code paths.
-
-## Dependencies
-
-- Run `npm audit` / `pnpm audit` before merging dependency changes.
-- Do not add packages for one-liners when the stdlib or an existing dep suffices.
-
-## Pipeline
-
-- For convoy work, run `role-security-auditor` in the audit fan-out unless `skip: security` is set.
-- Security findings with severity ≥ 3 block merge unless the convoy documents an accepted risk.

.cursor/skills/security-audit/SKILL.md

@@ -1,108 +0,0 @@
----
-name: security-audit
-description: >-
-  Run an application-security audit on a code diff or surface. Produces a
-  severity-ranked findings report keyed to OWASP-style categories (authZ,
-  injection, secrets, IDOR, SSRF, dependencies). Use when role-security-auditor
-  is invoked, when the user asks for a security review, before merging
-  auth/API/data convoys, or whenever a change touches authentication,
-  authorization, API routes, middleware, env config, or user-controlled input.
-  Skip if `skip: security` is set in the convoy or the change is docs-only
-  with no executable code.
----
-
-# Security audit
-
-Six-layer audit framework for **application code** (not infra/IAM — those are separate convoys). Outputs a severity 0–4 findings list, an executive summary, and fix suggestions with file:line citations. Deep reference: `references/owasp-checklist.md`.
-
-## When to invoke
-
-- **Automatic:** by `role-security-auditor` on every PR draft except when `skip: security` is set.
-- **Manual:** when the user says *"security review"*, *"audit this for vulnerabilities"*, or before merging auth/API/schema convoys.
-- **Pre-merge:** audit fan-out — `/multitask role-reviewer + role-security-auditor + role-design-system-auditor + role-a11y-auditor`.
-
-## Severity scale
-
-| Severity | Meaning | Treatment |
-| --- | --- | --- |
-| **4 — Critical** | Exploitable without unusual conditions: auth bypass, secret in client bundle, SQL/command injection on user input, IDOR on another user's data. | Block merge. |
-| **3 — High** | Serious weakness requiring attacker effort or specific config: missing rate limit on auth, weak session TTL, missing auth on non-public route, mass assignment. | Fix before merge unless documented exception in convoy. |
-| **2 — Medium** | Defense-in-depth gap: verbose error leaks stack trace, missing security headers, log line includes PII. | Fix or track; recommend before next release. |
-| **1 — Low** | Hardening opportunity: inconsistent auth helper usage, missing Zod on low-risk query param. | Inline in report. |
-| **0 — Info** | Note for maintainer; not a defect. | Inline only. |
-
-## The 6 layers
-
-Run in order. Stop early only if the diff is literally comment-only.
-
-### Layer 1 — Authentication boundary
-
-Every protected route and server action must identify the caller before doing work.
-
-- New or changed API routes / server actions: is there an auth gate (`requireAuth`, `auth()`, session check, Bearer verify)?
-- Auth endpoints: rate limiting present? (`checkAuthRateLimit` or equivalent)
-- No synthetic-admin / dev-bypass fallbacks in production paths
-- JWT/session: secret from env (fail-loud if unset), reasonable TTL, not in client bundle
-- Password handling: hashed (bcrypt/argon2), never logged, never returned in API responses
-
-### Layer 2 — Authorization (IDOR / tenancy)
-
-Authentication ≠ authorization. Check resource ownership on every read/write.
-
-- Every query scoped by `userId` / `tenantId` / collection permission — not just "user is logged in"
-- Path params (`/api/users/:id`) validated against session identity
-- Admin routes use dedicated guard (`requireAdmin`, `withAdmin`) — not inline role string compare copy-pasted
-- Public vs private resources: `is_public` / share links cannot leak other users' data
-
-### Layer 3 — Input validation & injection
-
-All user-controlled input validated at the boundary.
-
-- Request bodies: Zod/schema validation (or repo equivalent) — no trusting `req.body` shape
-- SQL: parameterized queries / ORM — no string concatenation with user input; no `sql.unsafe` with user data
-- Shell commands: no `exec`/`spawn` with user input; no `eval`
-- HTML/XSS: no `dangerouslySetInnerHTML` without sanitization; no reflecting raw user input in responses
-- File upload: type/size limits, storage path not user-controlled
-
-### Layer 4 — Secrets & sensitive data
-
-- No API keys, tokens, passwords in source, comments, or client bundles
-- `.env` values not committed; no `NEXT_PUBLIC_*` for secrets
-- Logs: no passwords, tokens, full credit card numbers, or session cookies
-- Error responses: generic message to client; details server-side only
-
-### Layer 5 — Dependencies & supply chain
-
-- Run `npm audit` / `pnpm audit` when Shell is available; surface high/critical in report
-- New dependencies: justified? Known risky packages?
-- Pin or review major version bumps on auth/crypto libraries
-
-### Layer 6 — Transport & headers (when diff touches middleware / next.config / server)
-
-- Cookies: `HttpOnly`, `Secure`, `SameSite` where applicable
-- CORS: no wildcard `*` on authenticated APIs unless explicitly documented
-- Security headers: CSP, X-Frame-Options / frame-ancestors where relevant
-
-## Steps
-
-1. **Scope read.** `git diff` + brief `files:` list. Flag any file outside scope as Critical (scope expansion).
-2. **Read repo auth rules.** `.cursor/rules/auth-patterns.mdc`, `api-routes.mdc`, `AGENTS.md` auth section — match repo conventions, don't invent new ones.
-3. **Layer pass 1 → 6.** For each finding: category, severity, file:line, exploit scenario (one sentence), fix (verbatim diff when possible).
-4. **Automated sweep (optional).** `npm audit --json`, `grep` for `dangerouslySetInnerHTML`, `eval(`, hardcoded `sk-`, `password\s*=`.
-5. **Report.** Fill `templates/audit-report.md`. Post as `## Security Audit` PR comment (exact header — rollup CI parses it).
-6. **Hand off:** *"Security audit complete. N findings (sev ≥ 3: M). Recommend fixing sev ≥ 3 before merge."*
-
-## Anti-patterns
-
-- Marking style nits as Critical — credibility matters.
-- Auditing without reading the brief — scope expansion is the first check.
-- Recommending auth patterns the repo doesn't use — read `auth-patterns.mdc` first.
-- Skipping layer 2 because "route requires login" — IDOR lives here.
-
-## References
-
-- `references/owasp-checklist.md` — expanded checklist by layer.
-
-## Output template
-
-- `templates/audit-report.md` — fillable report for PR comment or `.convoys/<slug>/audits/security-<timestamp>.md` mirror.

.cursor/skills/security-audit/references/owasp-checklist.md

@@ -1,47 +0,0 @@
-# OWASP-aligned security checklist (agent reference)
-
-Cite the **layer + item** in findings (e.g. "Layer 2 — IDOR"). Not a substitute for penetration testing.
-
-## Layer 1 — Authentication
-
-- [ ] All non-public API routes call a shared auth helper
-- [ ] Login/register/forgot-password rate limited
-- [ ] Session/JWT secret from environment; app fails start if missing
-- [ ] No long-lived tokens in `localStorage` without documented threat model
-- [ ] Password reset tokens single-use + short TTL
-- [ ] No credentials in URLs or query strings
-
-## Layer 2 — Authorization
-
-- [ ] Resource IDs in path/body checked against session user/tenant
-- [ ] List endpoints filter by ownership — no "return all rows"
-- [ ] Admin operations behind explicit admin guard
-- [ ] Role checks use server-side source of truth (DB), not client-only flags
-- [ ] Bulk operations cannot target arbitrary user IDs
-
-## Layer 3 — Input & injection
-
-- [ ] All POST/PATCH/PUT bodies validated with schema
-- [ ] Query params validated/coerced (Zod `z.coerce` or explicit parse)
-- [ ] ORM/raw SQL uses parameters only
-- [ ] No `dangerouslySetInnerHTML` without DOMPurify or equivalent
-- [ ] File paths constructed server-side; no `../` from user input
-- [ ] SSRF: server-side fetch URLs not user-controlled to internal IPs
-
-## Layer 4 — Secrets & data
-
-- [ ] No secrets in git history in this diff
-- [ ] `NEXT_PUBLIC_` prefix only on truly public values
-- [ ] PII minimized in logs and analytics events
-- [ ] API responses omit internal IDs when unnecessary
-
-## Layer 5 — Dependencies
-
-- [ ] No new high/critical `npm audit` findings introduced
-- [ ] Auth/crypto libs from reputable sources, pinned versions
-
-## Layer 6 — Transport & config
-
-- [ ] Auth cookies: Secure + HttpOnly
-- [ ] CORS allowlist explicit for API routes
-- [ ] Webhook endpoints verify signatures

.cursor/skills/security-audit/templates/audit-report.md

@@ -1,41 +0,0 @@
-# Security audit — {{convoy_slug}} / brief-{{brief_n}}
-
-**Reviewer:** role-security-auditor
-**Convoy:** {{convoy_slug}}
-**Brief / PR:** {{brief_n}} / {{pr_number_or_draft}}
-**Date:** {{YYYY-MM-DD}}
-**Diff scope:** {{files_changed_count}} files
-
-## Executive summary
-
-- {{bullet 1 — overall risk posture}}
-- {{bullet 2 — highest severity finding or "no sev ≥ 3"}}
-- {{bullet 3 — auth/IDOR/injection/deps headline}}
-
-## Findings
-
-| Sev | Layer | Surface | Issue | Fix |
-| --- | --- | --- | --- | --- |
-| 4 | L2 AuthZ | `app/api/foo/route.ts:42` | IDOR: `userId` from path not checked against session | Add `if (session.user.id !== params.id) return forbidden()` |
-| 2 | L3 Input | `app/api/bar/route.ts:18` | Body not validated | Add Zod schema per `api-routes.mdc` |
-
-### Severity ≥ 3 detail
-
-{{Expand each sev 3–4 with exploit scenario + suggested patch.}}
-
-### Patterns (optional)
-
-{{One row if the same mistake appears 3+ times.}}
-
-## Automated checks
-
-| Check | Result |
-| --- | --- |
-| `npm audit` (high+) | {{pass / N findings}} |
-| Hardcoded secret grep | {{pass / findings}} |
-
-## Approval recommendation
-
-- [ ] **approve** — no sev ≥ 3; sev 2 acceptable with notes
-- [ ] **request-changes** — sev ≥ 3 open
-- [ ] **comment-only** — informational

.cursor/skills/ui-ux-pro-max/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2024 Next Level Builder
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

.cursor/skills/ui-ux-pro-max/SKILL.md

@@ -1,104 +0,0 @@
-<!--
-Vendored engine: nextlevelbuilder/ui-ux-pro-max-skill (MIT) — see UPSTREAM.md, LICENSE, data/, scripts/.
-Pipeline wrapper: agent-pipeline — planning-only; paired with role-ui-designer.
--->
----
-name: ui-ux-pro-max
-description: >-
-  Generate a locked design direction for greenfield UI (pattern, palette,
-  typography, anti-patterns) from product type. Planning phase only — invoke
-  via role-ui-designer at convoy start or on explicit redesign. Do not use
-  during audit fan-out or incremental UI tweaks inside an existing DS.
----
-
-# UI UX Pro Max (planning)
-
-Data-driven design intelligence: industry rules, styles, palettes, typography, and stack guidelines. **Generate once, lock in the convoy, enforce later** with `design-critique`, `design-systems`, and `accessibility-audit`.
-
-## When to invoke
-
-| Do | Don't |
-| --- | --- |
-| New screen, landing, marketing surface, major visual refresh | Hotfix, docs-only, server-only |
-| User says *redesign* or bumps `design_direction.version` | Audit fan-out on a PR diff |
-| `role-ui-designer` at convoy start (skill installed) | Every implementer brief |
-| Re-run after explicit redesign request | Auto-re-run because code "looks off" |
-
-## Prerequisites
-
-- Python 3.x on the machine running the agent (`python3 --version`).
-- Skill installed at `.cursor/skills/ui-ux-pro-max/` (bootstrap opt-in).
-
-## Generate a design system (primary workflow)
-
-From repo root:
-
-```bash
-python3 .cursor/skills/ui-ux-pro-max/scripts/search.py \
-  "<product type query>" \
-  --design-system \
-  -p "<Project or convoy name>"
-```
-
-Examples:
-
-```bash
-python3 .cursor/skills/ui-ux-pro-max/scripts/search.py "B2B SaaS analytics dashboard" --design-system -p "Deck Hearth admin"
-python3 .cursor/skills/ui-ux-pro-max/scripts/search.py "wellness spa booking" --design-system -p "Serenity Spa"
-```
-
-Pick stack-specific guidelines when the convoy targets a known stack:
-
-```bash
-python3 .cursor/skills/ui-ux-pro-max/scripts/search.py "checkout flow" --stack nextjs --max-results 5
-```
-
-## Lock in the convoy
-
-1. Parse generator output into `skills/ui-ux-pro-max/templates/design-direction.md`.
-2. Append `## Design direction` to `.convoys/<slug>.md`.
-3. Set frontmatter:
-
-```yaml
-design_direction:
-  source: role-ui-designer
-  skill: ui-ux-pro-max
-  skill_version: "2.5.0"
-  version: 1
-  locked_at: YYYY-MM-DD
-  product_type: "<from query>"
-  pattern: "<from output>"
-  style: "<from output>"
-  stack: nextjs
-```
-
-On **redesign**, bump `version` and replace the section — do not edit in place without bumping.
-
-## Hand-off to other skills
-
-| Next | Role / skill | Job |
-| --- | --- | --- |
-| Reuse + constraints | `role-ux-reviewer` | Maps locked direction to existing components; a11y constraints |
-| Briefs | `role-architect` | Briefs must not contradict `design_direction` |
-| Enforce | audit fan-out | `design-systems`, `accessibility-audit`, `design-critique` on the diff |
-
-**Conflict rule:** repo tokens (`tailwind.config`, `globals.css`, `components/ui/`) **win** over generated palettes unless the convoy records an approved override.
-
-## What this skill does NOT do
-
-- Replace `design-critique` / `design-systems` / `accessibility-audit` at PR time.
-- Commit code or open PRs.
-- Install npm packages or fonts — implementer adds dependencies per brief.
-
-## Anti-patterns
-
-- Running the generator during audit fan-out.
-- Re-running on brief 2, 3, … without a redesign request.
-- Ignoring existing repo DS when the convoy is incremental UI (`skip: ui-design`).
-- Loading entire `data/*.csv` into chat — always use `scripts/search.py`.
-
-## References
-
-- Upstream docs: [ui-ux-pro-max-skill](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill)
-- Convoy output template: `templates/design-direction.md`
-- L2 role: `role-ui-designer` in `.cursor/agents/`

.cursor/skills/ui-ux-pro-max/UPSTREAM.md

@@ -1,12 +0,0 @@
-# Upstream: UI UX Pro Max
-
-Vendored from [nextlevelbuilder/ui-ux-pro-max-skill](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill).
-
-| Field | Value |
-| --- | --- |
-| Upstream tag | `v2.6.2` (clone ref `d457006`) |
-| Upstream `skill.json` version | `2.5.0` |
-| License | MIT — see `LICENSE` |
-| Vendored paths | `data/`, `scripts/` |
-
-Do not edit `data/` or `scripts/` in place for pipeline-specific behavior — wrap in `SKILL.md` and `role-ui-designer.md` instead. To refresh from upstream, replace `data/` + `scripts/` from a new tag and bump this file.

.cursor/skills/ui-ux-pro-max/data/_sync_all.py

@@ -1,414 +0,0 @@
-#!/usr/bin/env python3
-"""
-Sync colors.csv and ui-reasoning.csv with the updated products.csv (161 entries).
-- Remove deleted product types
-- Rename mismatched entries
-- Add new entries for missing product types
-- Keep colors.csv aligned 1:1 with products.csv
-- Renumber everything
-"""
-import csv, os, json
-
-BASE = os.path.dirname(os.path.abspath(__file__))
-
-# ─── Color derivation helpers ────────────────────────────────────────────────
-def h2r(h):
-    h = h.lstrip("#")
-    return tuple(int(h[i:i+2], 16) for i in (0, 2, 4))
-
-def r2h(r, g, b):
-    return f"#{max(0,min(255,int(r))):02X}{max(0,min(255,int(g))):02X}{max(0,min(255,int(b))):02X}"
-
-def lum(h):
-    r, g, b = [x/255.0 for x in h2r(h)]
-    r, g, b = [(x/12.92 if x<=0.03928 else ((x+0.055)/1.055)**2.4) for x in (r, g, b)]
-    return 0.2126*r + 0.7152*g + 0.0722*b
-
-def is_dark(bg):
-    return lum(bg) < 0.18
-
-def on_color(bg):
-    return "#FFFFFF" if lum(bg) < 0.4 else "#0F172A"
-
-def blend(a, b, f=0.15):
-    ra, ga, ba = h2r(a)
-    rb, gb, bb = h2r(b)
-    return r2h(ra+(rb-ra)*f, ga+(gb-ga)*f, ba+(bb-ba)*f)
-
-def shift(h, n):
-    r, g, b = h2r(h)
-    return r2h(r+n, g+n, b+n)
-
-def derive_row(pt, pri, sec, acc, bg, notes=""):
-    """Generate full 16-token color row from 4 base colors."""
-    dark = is_dark(bg)
-    fg = "#FFFFFF" if dark else "#0F172A"
-    on_pri = on_color(pri)
-    on_sec = on_color(sec)
-    on_acc = on_color(acc)
-    card = shift(bg, 10) if dark else "#FFFFFF"
-    card_fg = "#FFFFFF" if dark else "#0F172A"
-    muted = blend(bg, pri, 0.08) if dark else blend("#FFFFFF", pri, 0.06)
-    muted_fg = "#94A3B8" if dark else "#64748B"
-    border = f"rgba(255,255,255,0.08)" if dark else blend("#FFFFFF", pri, 0.12)
-    destr = "#DC2626"
-    on_destr = "#FFFFFF"
-    ring = pri
-    return [pt, pri, on_pri, sec, on_sec, acc, on_acc, bg, fg, card, card_fg, muted, muted_fg, border, destr, on_destr, ring, notes]
-
-# ─── Rename maps ─────────────────────────────────────────────────────────────
-COLOR_RENAMES = {
-    "Quantum Computing": "Quantum Computing Interface",
-    "Biohacking / Longevity": "Biohacking / Longevity App",
-    "Autonomous Systems": "Autonomous Drone Fleet Manager",
-    "Generative AI Art": "Generative Art Platform",
-    "Spatial / Vision OS": "Spatial Computing OS / App",
-    "Climate Tech": "Sustainable Energy / Climate Tech",
-}
-UI_RENAMES = {
-    "Architecture/Interior": "Architecture / Interior",
-    "Autonomous Drone Fleet": "Autonomous Drone Fleet Manager",
-    "B2B SaaS Enterprise": "B2B Service",
-    "Biohacking/Longevity App": "Biohacking / Longevity App",
-    "Biotech/Life Sciences": "Biotech / Life Sciences",
-    "Developer Tool/IDE": "Developer Tool / IDE",
-    "Education": "Educational App",
-    "Fintech (Banking)": "Fintech/Crypto",
-    "Government/Public": "Government/Public Service",
-    "Home Services": "Home Services (Plumber/Electrician)",
-    "Micro-Credentials/Badges": "Micro-Credentials/Badges Platform",
-    "Music/Entertainment": "Music Streaming",
-    "Quantum Computing": "Quantum Computing Interface",
-    "Real Estate": "Real Estate/Property",
-    "Remote Work/Collaboration": "Remote Work/Collaboration Tool",
-    "Restaurant/Food": "Restaurant/Food Service",
-    "SaaS Dashboard": "Analytics Dashboard",
-    "Space Tech/Aerospace": "Space Tech / Aerospace",
-    "Spatial Computing OS": "Spatial Computing OS / App",
-    "Startup Landing": "Micro SaaS",
-    "Sustainable Energy/Climate": "Sustainable Energy / Climate Tech",
-    "Travel/Tourism": "Travel/Tourism Agency",
-    "Wellness/Mental Health": "Mental Health App",
-}
-
-REMOVE_TYPES = {
-    "Service Landing Page", "Sustainability/ESG Platform",
-    "Cleaning Service", "Coffee Shop",
-    "Consulting Firm", "Conference/Webinar Platform",
-}
-
-# ─── New color definitions: (primary, secondary, accent, bg, notes) ──────────
-# Grouped by category for clarity. Each tuple generates a full 16-token row.
-NEW_COLORS = {
-    # ── Old #97-#116 that never got colors ──
-    "Todo & Task Manager":         ("#2563EB","#3B82F6","#059669","#F8FAFC","Functional blue + progress green"),
-    "Personal Finance Tracker":    ("#1E40AF","#3B82F6","#059669","#0F172A","Trust blue + profit green on dark"),
-    "Chat & Messaging App":        ("#2563EB","#6366F1","#059669","#FFFFFF","Messenger blue + online green"),
-    "Notes & Writing App":         ("#78716C","#A8A29E","#D97706","#FFFBEB","Warm ink + amber accent on cream"),
-    "Habit Tracker":               ("#D97706","#F59E0B","#059669","#FFFBEB","Streak amber + habit green"),
-    "Food Delivery / On-Demand":   ("#EA580C","#F97316","#2563EB","#FFF7ED","Appetizing orange + trust blue"),
-    "Ride Hailing / Transportation":("#1E293B","#334155","#2563EB","#0F172A","Map dark + route blue"),
-    "Recipe & Cooking App":        ("#9A3412","#C2410C","#059669","#FFFBEB","Warm terracotta + fresh green"),
-    "Meditation & Mindfulness":    ("#7C3AED","#8B5CF6","#059669","#FAF5FF","Calm lavender + mindful green"),
-    "Weather App":                 ("#0284C7","#0EA5E9","#F59E0B","#F0F9FF","Sky blue + sun amber"),
-    "Diary & Journal App":         ("#92400E","#A16207","#6366F1","#FFFBEB","Warm journal brown + ink violet"),
-    "CRM & Client Management":     ("#2563EB","#3B82F6","#059669","#F8FAFC","Professional blue + deal green"),
-    "Inventory & Stock Management":("#334155","#475569","#059669","#F8FAFC","Industrial slate + stock green"),
-    "Flashcard & Study Tool":      ("#7C3AED","#8B5CF6","#059669","#FAF5FF","Study purple + correct green"),
-    "Booking & Appointment App":   ("#0284C7","#0EA5E9","#059669","#F0F9FF","Calendar blue + available green"),
-    "Invoice & Billing Tool":      ("#1E3A5F","#2563EB","#059669","#F8FAFC","Navy professional + paid green"),
-    "Grocery & Shopping List":     ("#059669","#10B981","#D97706","#ECFDF5","Fresh green + food amber"),
-    "Timer & Pomodoro":            ("#DC2626","#EF4444","#059669","#0F172A","Focus red on dark + break green"),
-    "Parenting & Baby Tracker":    ("#EC4899","#F472B6","#0284C7","#FDF2F8","Soft pink + trust blue"),
-    "Scanner & Document Manager":  ("#1E293B","#334155","#2563EB","#F8FAFC","Document grey + scan blue"),
-    # ── A. Utility / Productivity ──
-    "Calendar & Scheduling App":   ("#2563EB","#3B82F6","#059669","#F8FAFC","Calendar blue + event green"),
-    "Password Manager":            ("#1E3A5F","#334155","#059669","#0F172A","Vault dark blue + secure green"),
-    "Expense Splitter / Bill Split":("#059669","#10B981","#DC2626","#F8FAFC","Balance green + owe red"),
-    "Voice Recorder & Memo":       ("#DC2626","#EF4444","#2563EB","#FFFFFF","Recording red + waveform blue"),
-    "Bookmark & Read-Later":       ("#D97706","#F59E0B","#2563EB","#FFFBEB","Warm amber + link blue"),
-    "Translator App":              ("#2563EB","#0891B2","#EA580C","#F8FAFC","Global blue + teal + accent orange"),
-    "Calculator & Unit Converter": ("#EA580C","#F97316","#2563EB","#1C1917","Operation orange on dark"),
-    "Alarm & World Clock":         ("#D97706","#F59E0B","#6366F1","#0F172A","Time amber + night indigo on dark"),
-    "File Manager & Transfer":     ("#2563EB","#3B82F6","#D97706","#F8FAFC","Folder blue + file amber"),
-    "Email Client":                ("#2563EB","#3B82F6","#DC2626","#FFFFFF","Inbox blue + priority red"),
-    # ── B. Games ──
-    "Casual Puzzle Game":          ("#EC4899","#8B5CF6","#F59E0B","#FDF2F8","Cheerful pink + reward gold"),
-    "Trivia & Quiz Game":          ("#2563EB","#7C3AED","#F59E0B","#EFF6FF","Quiz blue + gold leaderboard"),
-    "Card & Board Game":           ("#15803D","#166534","#D97706","#0F172A","Felt green + gold on dark"),
-    "Idle & Clicker Game":         ("#D97706","#F59E0B","#7C3AED","#FFFBEB","Coin gold + prestige purple"),
-    "Word & Crossword Game":       ("#15803D","#059669","#D97706","#FFFFFF","Word green + letter amber"),
-    "Arcade & Retro Game":         ("#DC2626","#2563EB","#22C55E","#0F172A","Neon red+blue on dark + score green"),
-    # ── C. Creator Tools ──
-    "Photo Editor & Filters":      ("#7C3AED","#6366F1","#0891B2","#0F172A","Editor violet + filter cyan on dark"),
-    "Short Video Editor":          ("#EC4899","#DB2777","#2563EB","#0F172A","Video pink on dark + timeline blue"),
-    "Drawing & Sketching Canvas":  ("#7C3AED","#8B5CF6","#0891B2","#1C1917","Canvas purple + tool teal on dark"),
-    "Music Creation & Beat Maker": ("#7C3AED","#6366F1","#22C55E","#0F172A","Studio purple + waveform green on dark"),
-    "Meme & Sticker Maker":        ("#EC4899","#F59E0B","#2563EB","#FFFFFF","Viral pink + comedy yellow + share blue"),
-    "AI Photo & Avatar Generator": ("#7C3AED","#6366F1","#EC4899","#FAF5FF","AI purple + generation pink"),
-    "Link-in-Bio Page Builder":    ("#2563EB","#7C3AED","#EC4899","#FFFFFF","Brand blue + creator purple"),
-    # ── D. Personal Life ──
-    "Wardrobe & Outfit Planner":   ("#BE185D","#EC4899","#D97706","#FDF2F8","Fashion rose + gold accent"),
-    "Plant Care Tracker":          ("#15803D","#059669","#D97706","#F0FDF4","Nature green + sun yellow"),
-    "Book & Reading Tracker":      ("#78716C","#92400E","#D97706","#FFFBEB","Book brown + page amber"),
-    "Couple & Relationship App":   ("#BE185D","#EC4899","#DC2626","#FDF2F8","Romance rose + love red"),
-    "Family Calendar & Chores":    ("#2563EB","#059669","#D97706","#F8FAFC","Family blue + chore green"),
-    "Mood Tracker":                ("#7C3AED","#6366F1","#D97706","#FAF5FF","Mood purple + insight amber"),
-    "Gift & Wishlist":             ("#DC2626","#D97706","#EC4899","#FFF1F2","Gift red + gold + surprise pink"),
-    # ── E. Health ──
-    "Running & Cycling GPS":       ("#EA580C","#F97316","#059669","#0F172A","Energetic orange + pace green on dark"),
-    "Yoga & Stretching Guide":     ("#6B7280","#78716C","#0891B2","#F5F5F0","Sage neutral + calm teal"),
-    "Sleep Tracker":               ("#4338CA","#6366F1","#7C3AED","#0F172A","Night indigo + dream violet on dark"),
-    "Calorie & Nutrition Counter": ("#059669","#10B981","#EA580C","#ECFDF5","Healthy green + macro orange"),
-    "Period & Cycle Tracker":      ("#BE185D","#EC4899","#7C3AED","#FDF2F8","Blush rose + fertility lavender"),
-    "Medication & Pill Reminder":  ("#0284C7","#0891B2","#DC2626","#F0F9FF","Medical blue + alert red"),
-    "Water & Hydration Reminder":  ("#0284C7","#06B6D4","#0891B2","#F0F9FF","Refreshing blue + water cyan"),
-    "Fasting & Intermittent Timer":("#6366F1","#4338CA","#059669","#0F172A","Fasting indigo on dark + eating green"),
-    # ── F. Social ──
-    "Anonymous Community / Confession":("#475569","#334155","#0891B2","#0F172A","Protective grey + subtle teal on dark"),
-    "Local Events & Discovery":    ("#EA580C","#F97316","#2563EB","#FFF7ED","Event orange + map blue"),
-    "Study Together / Virtual Coworking":("#2563EB","#3B82F6","#059669","#F8FAFC","Focus blue + session green"),
-    # ── G. Education ──
-    "Coding Challenge & Practice": ("#22C55E","#059669","#D97706","#0F172A","Code green + difficulty amber on dark"),
-    "Kids Learning (ABC & Math)":  ("#2563EB","#F59E0B","#EC4899","#EFF6FF","Learning blue + play yellow + fun pink"),
-    "Music Instrument Learning":   ("#DC2626","#9A3412","#D97706","#FFFBEB","Musical red + warm amber"),
-    # ── H. Transport ──
-    "Parking Finder":              ("#2563EB","#059669","#DC2626","#F0F9FF","Available blue/green + occupied red"),
-    "Public Transit Guide":        ("#2563EB","#0891B2","#EA580C","#F8FAFC","Transit blue + line colors"),
-    "Road Trip Planner":           ("#EA580C","#0891B2","#D97706","#FFF7ED","Adventure orange + map teal"),
-    # ── I. Safety & Lifestyle ──
-    "VPN & Privacy Tool":          ("#1E3A5F","#334155","#22C55E","#0F172A","Shield dark + connected green"),
-    "Emergency SOS & Safety":      ("#DC2626","#EF4444","#2563EB","#FFF1F2","Alert red + safety blue"),
-    "Wallpaper & Theme App":       ("#7C3AED","#EC4899","#2563EB","#FAF5FF","Aesthetic purple + trending pink"),
-    "White Noise & Ambient Sound": ("#475569","#334155","#4338CA","#0F172A","Ambient grey + deep indigo on dark"),
-    "Home Decoration & Interior Design":("#78716C","#A8A29E","#D97706","#FAF5F2","Interior warm grey + gold accent"),
-}
-
-# ─── 1. REBUILD colors.csv ───────────────────────────────────────────────────
-def rebuild_colors():
-    src = os.path.join(BASE, "colors.csv")
-    with open(src, newline="", encoding="utf-8") as f:
-        reader = csv.DictReader(f)
-        headers = reader.fieldnames
-        existing = list(reader)
-
-    # Build lookup: Product Type -> row data
-    color_map = {}
-    for row in existing:
-        pt = row.get("Product Type", "").strip()
-        if not pt:
-            continue
-        # Remove deleted types
-        if pt in REMOVE_TYPES:
-            print(f"  [colors] REMOVE: {pt}")
-            continue
-        # Rename mismatched types
-        if pt in COLOR_RENAMES:
-            new_name = COLOR_RENAMES[pt]
-            print(f"  [colors] RENAME: {pt} → {new_name}")
-            row["Product Type"] = new_name
-            pt = new_name
-        color_map[pt] = row
-
-    # Read products.csv to get the correct order
-    with open(os.path.join(BASE, "products.csv"), newline="", encoding="utf-8") as f:
-        products = list(csv.DictReader(f))
-
-    # Build final rows in products.csv order
-    final_rows = []
-    added = 0
-    for i, prod in enumerate(products, 1):
-        pt = prod["Product Type"]
-        if pt in color_map:
-            row = color_map[pt]
-            row["No"] = str(i)
-            final_rows.append(row)
-        elif pt in NEW_COLORS:
-            pri, sec, acc, bg, notes = NEW_COLORS[pt]
-            new_row = derive_row(pt, pri, sec, acc, bg, notes)
-            d = dict(zip(headers, [str(i)] + new_row))
-            final_rows.append(d)
-            added += 1
-        else:
-            print(f"  [colors] WARNING: No color data for '{pt}' - using defaults")
-            new_row = derive_row(pt, "#2563EB", "#3B82F6", "#059669", "#F8FAFC", "Auto-generated default")
-            d = dict(zip(headers, [str(i)] + new_row))
-            final_rows.append(d)
-            added += 1
-
-    # Write
-    with open(src, "w", newline="", encoding="utf-8") as f:
-        writer = csv.DictWriter(f, fieldnames=headers)
-        writer.writeheader()
-        writer.writerows(final_rows)
-
-    product_count = len(products)
-    print(f"\n  ✅ colors.csv: {len(final_rows)} rows ({product_count} products)")
-    print(f"     Added: {added} new color rows")
-
-# ─── 2. REBUILD ui-reasoning.csv ─────────────────────────────────────────────
-def derive_ui_reasoning(prod):
-    """Generate ui-reasoning row from products.csv row."""
-    pt = prod["Product Type"]
-    style = prod.get("Primary Style Recommendation", "")
-    landing = prod.get("Landing Page Pattern", "")
-    color_focus = prod.get("Color Palette Focus", "")
-    considerations = prod.get("Key Considerations", "")
-    keywords = prod.get("Keywords", "")
-
-    # Typography mood derived from style
-    typo_map = {
-        "Minimalism": "Professional + Clean hierarchy",
-        "Glassmorphism": "Modern + Clear hierarchy",
-        "Brutalism": "Bold + Oversized + Monospace",
-        "Claymorphism": "Playful + Rounded + Friendly",
-        "Dark Mode": "High contrast + Light on dark",
-        "Neumorphism": "Subtle + Soft + Monochromatic",
-        "Flat Design": "Bold + Clean + Sans-serif",
-        "Vibrant": "Energetic + Bold + Large",
-        "Aurora": "Elegant + Gradient-friendly",
-        "AI-Native": "Conversational + Minimal chrome",
-        "Organic": "Warm + Humanist + Natural",
-        "Motion": "Dynamic + Hierarchy-shifting",
-        "Accessible": "Large + High contrast + Clear",
-        "Soft UI": "Modern + Accessible + Balanced",
-        "Trust": "Professional + Serif accents",
-        "Swiss": "Grid-based + Mathematical + Helvetica",
-        "3D": "Immersive + Spatial + Variable",
-        "Retro": "Nostalgic + Monospace + Neon",
-        "Cyberpunk": "Terminal + Monospace + Neon",
-        "Pixel": "Retro + Blocky + 8-bit",
-    }
-    typo_mood = "Professional + Clear hierarchy"
-    for key, val in typo_map.items():
-        if key.lower() in style.lower():
-            typo_mood = val
-            break
-
-    # Key effects from style
-    eff_map = {
-        "Glassmorphism": "Backdrop blur (10-20px) + Translucent overlays",
-        "Neumorphism": "Dual shadows (light+dark) + Soft press 150ms",
-        "Claymorphism": "Multi-layer shadows + Spring bounce + Soft press 200ms",
-        "Brutalism": "No transitions + Hard borders + Instant feedback",
-        "Dark Mode": "Subtle glow + Neon accents + High contrast",
-        "Flat Design": "Color shift hover + Fast 150ms transitions + No shadows",
-        "Minimalism": "Subtle hover 200ms + Smooth transitions + Clean",
-        "Motion-Driven": "Scroll animations + Parallax + Page transitions",
-        "Micro-interactions": "Haptic feedback + Small 50-100ms animations",
-        "Vibrant": "Large section gaps 48px+ + Color shift hover + Scroll-snap",
-        "Aurora": "Flowing gradients 8-12s + Color morphing",
-        "AI-Native": "Typing indicator + Streaming text + Context reveal",
-        "Organic": "Rounded 16-24px + Natural shadows + Flowing SVG",
-        "Soft UI": "Improved shadows + Modern 200-300ms + Focus visible",
-        "3D": "WebGL/Three.js + Parallax 3-5 layers + Physics 300-400ms",
-        "Trust": "Clear focus rings + Badge hover + Metric pulse",
-        "Accessible": "Focus rings 3-4px + ARIA + Reduced motion",
-    }
-    key_effects = "Subtle hover (200ms) + Smooth transitions"
-    for key, val in eff_map.items():
-        if key.lower() in style.lower():
-            key_effects = val
-            break
-
-    # Decision rules
-    rules = {}
-    if "dark" in style.lower() or "oled" in style.lower():
-        rules["if_light_mode_needed"] = "provide-theme-toggle"
-    if "glass" in style.lower():
-        rules["if_low_performance"] = "fallback-to-flat"
-    if "conversion" in landing.lower():
-        rules["if_conversion_focused"] = "add-urgency-colors"
-    if "social" in landing.lower():
-        rules["if_trust_needed"] = "add-testimonials"
-    if "data" in keywords.lower() or "dashboard" in keywords.lower():
-        rules["if_data_heavy"] = "prioritize-data-density"
-    if not rules:
-        rules["if_ux_focused"] = "prioritize-clarity"
-        rules["if_mobile"] = "optimize-touch-targets"
-
-    # Anti-patterns
-    anti_patterns = []
-    if "minimalism" in style.lower() or "minimal" in style.lower():
-        anti_patterns.append("Excessive decoration")
-    if "dark" in style.lower():
-        anti_patterns.append("Pure white backgrounds")
-    if "flat" in style.lower():
-        anti_patterns.append("Complex shadows + 3D effects")
-    if "vibrant" in style.lower():
-        anti_patterns.append("Muted colors + Low energy")
-    if "accessible" in style.lower():
-        anti_patterns.append("Color-only indicators")
-    if not anti_patterns:
-        anti_patterns = ["Inconsistent styling", "Poor contrast ratios"]
-    anti_str = " + ".join(anti_patterns[:2])
-
-    return {
-        "UI_Category": pt,
-        "Recommended_Pattern": landing,
-        "Style_Priority": style,
-        "Color_Mood": color_focus,
-        "Typography_Mood": typo_mood,
-        "Key_Effects": key_effects,
-        "Decision_Rules": json.dumps(rules),
-        "Anti_Patterns": anti_str,
-        "Severity": "HIGH"
-    }
-
-
-def rebuild_ui_reasoning():
-    src = os.path.join(BASE, "ui-reasoning.csv")
-    with open(src, newline="", encoding="utf-8") as f:
-        reader = csv.DictReader(f)
-        headers = reader.fieldnames
-        existing = list(reader)
-
-    # Build lookup
-    ui_map = {}
-    for row in existing:
-        cat = row.get("UI_Category", "").strip()
-        if not cat:
-            continue
-        if cat in REMOVE_TYPES:
-            print(f"  [ui-reason] REMOVE: {cat}")
-            continue
-        if cat in UI_RENAMES:
-            new_name = UI_RENAMES[cat]
-            print(f"  [ui-reason] RENAME: {cat} → {new_name}")
-            row["UI_Category"] = new_name
-            cat = new_name
-        ui_map[cat] = row
-
-    with open(os.path.join(BASE, "products.csv"), newline="", encoding="utf-8") as f:
-        products = list(csv.DictReader(f))
-
-    final_rows = []
-    added = 0
-    for i, prod in enumerate(products, 1):
-        pt = prod["Product Type"]
-        if pt in ui_map:
-            row = ui_map[pt]
-            row["No"] = str(i)
-            final_rows.append(row)
-        else:
-            row = derive_ui_reasoning(prod)
-            row["No"] = str(i)
-            final_rows.append(row)
-            added += 1
-
-    with open(src, "w", newline="", encoding="utf-8") as f:
-        writer = csv.DictWriter(f, fieldnames=headers)
-        writer.writeheader()
-        writer.writerows(final_rows)
-
-    print(f"\n  ✅ ui-reasoning.csv: {len(final_rows)} rows")
-    print(f"     Added: {added} new reasoning rows")
-
-
-# ─── MAIN ────────────────────────────────────────────────────────────────────
-if __name__ == "__main__":
-    print("=== Rebuilding colors.csv ===")
-    rebuild_colors()
-    print("\n=== Rebuilding ui-reasoning.csv ===")
-    rebuild_ui_reasoning()
-    print("\n🎉 Done!")

.cursor/skills/ui-ux-pro-max/data/app-interface.csv

@@ -1,31 +0,0 @@
-No,Category,Issue,Keywords,Platform,Description,Do,Don't,Code Example Good,Code Example Bad,Severity
-1,Accessibility,Icon Button Labels,icon button accessibilityLabel,iOS/Android/React Native,Icon-only buttons must expose an accessible label,Set accessibilityLabel or label prop on icon buttons,Icon buttons without accessible names,"<Pressable accessibilityLabel=""Close""><XIcon /></Pressable>","<Pressable><XIcon /></Pressable>",Critical
-2,Accessibility,Form Control Labels,form input label accessibilityLabel,iOS/Android/React Native,All inputs must have a visible label and an accessibility label,Pair Text label with input and set accessibilityLabel,Inputs with placeholder only,"<View><Text>Email</Text><TextInput accessibilityLabel=""Email address"" /></View>","<TextInput placeholder=""Email"" /></View>",Critical
-3,Accessibility,Role & Traits,accessibilityRole accessibilityTraits,iOS/Android/React Native,Interactive elements must expose correct roles/traits,Use accessibilityRole/button/link/checkbox etc.,Rely on generic views with no roles,"<Pressable accessibilityRole=""button"">Submit</Pressable>","<View onTouchStart={submit}>Submit</View>",High
-4,Accessibility,Dynamic Updates,accessibilityLiveRegion announce,iOS/Android/React Native,Async status updates should be announced to screen readers,Use accessibilityLiveRegion or announceForAccessibility,Update text silently with no announcement,"<Text accessibilityLiveRegion=""polite"">{status}</Text>","<Text>{status}</Text>",Medium
-5,Accessibility,Decorative Icons,accessible={false} importantForAccessibility,iOS/Android/React Native,Decorative icons should be hidden from screen readers,Mark decorative icons as not accessible,Have screen reader read every icon,"<Icon accessible={false} importantForAccessibility=""no"" />","<Icon />",Medium
-6,Touch,Touch Target Size,touch 44x44 hitSlop,iOS/Android/React Native,Primary touch targets must be at least 44x44pt,Increase hitSlop or padding to meet minimum,Small icons with tiny touch area,"<Pressable hitSlop={10}><Icon /></Pressable>","<Pressable><Icon style={{ width: 16, height: 16 }} /></Pressable>",Critical
-7,Touch,Touch Spacing,touch spacing gap 8px,iOS/Android/React Native,Adjacent touch targets need enough spacing,Keep at least 8dp spacing between touchables,Cluster many buttons with no gap,"<View style={{ gap: 8 }}><Button ... /><Button ... /></View>","<View><Button ... /><Button ... /></View>",Medium
-8,Touch,Gesture Conflicts,scroll swipe back gesture,iOS/Android/React Native,Custom gestures must not break system scroll/back,Reserve horizontal swipes for carousels,Full-screen custom swipe conflicting with back,"HorizontalPager inside vertical ScrollView","PanResponder on full screen blocking back",High
-9,Navigation,Back Behavior,back handler navigation stack,iOS/Android/React Native,Back navigation should be predictable and preserve state,Use navigation.goBack and keep screen state,Reset stack or exit app unexpectedly,onPress={() => navigation.goBack()},"BackHandler.exitApp() on first press",Critical
-10,Navigation,Bottom Tabs,tab bar max items,iOS/Android/React Native,Bottom tab bar should have at most 5 primary items,Use 3–5 tabs and move extras to More/Settings,Overloaded tab bar with many icons,Home/Explore/Profile/Settings,"Home/Explore/Shop/Cart/Profile/Settings/More",Medium
-11,Navigation,Modal Escape,modal dismiss close affordance,iOS/Android/React Native,Modals/sheets must have clear close actions,Provide close button and swipe-down where platform expects,Trapping users in modal with no obvious exit,"<Modal><Button title=""Close"" onPress={onClose} /></Modal>","<Modal><View>{children}</View></Modal>",High
-12,State,Preserve Screen State,navigation preserve state,iOS/Android/React Native,Returning to a screen should restore its scroll and form state,Keep components mounted or persist state,Reset list scroll and form inputs on every visit,"<Tab.Navigator screenOptions={{ unmountOnBlur: false }}>","<Tab.Screen options={{ unmountOnBlur: true }} />",Medium
-13,Feedback,Loading Indicators,activity indicator skeleton,iOS/Android/React Native,Show visible feedback during network operations,Use ActivityIndicator or skeleton for >300ms operations,Leave button and screen frozen,"{loading ? <ActivityIndicator /> : <Button title=""Save"" />}", "<Button title=""Save"" onPress={submit} /> // no loading",High
-14,Feedback,Success Feedback,toast checkmark banner,iOS/Android/React Native,Confirm successful actions with brief feedback,Show toast/checkmark or banner,Complete actions silently with no confirmation,"showToast('Saved successfully')","// silently update state only",Medium
-15,Feedback,Error Feedback,inline error banner,iOS/Android/React Native,Show clear error messages near the problem,input-level error + summary banner,Only change border color with no explanation,"<TextInput ... /><Text style={{color:'red'}}>{error}</Text>","<TextInput style={{borderColor:'red'}} />",High
-16,Forms,Inline Validation,onBlur validation,iOS/Android/React Native,Validate inputs on blur or submit with clear messaging,Validate onBlur and onSubmit,Validate on every keystroke causing jank,"onBlur={() => validateEmail(value)}","onChangeText={v => validateEmail(v)} // every char",Medium
-17,Forms,Keyboard Type,keyboardType returnKeyType,iOS/Android/React Native,Use appropriate keyboardType and returnKeyType,Match email/tel/number/search types,Use default keyboard for all inputs,"<TextInput keyboardType=""email-address"" />","<TextInput keyboardType=""default"" />",Medium
-18,Forms,Auto Focus & Next,autoFocus blurOnSubmit onSubmitEditing,iOS/Android/React Native,Guide users through form fields with Next/Done flows,Use onSubmitEditing to focus next input,Force users to tap each field manually,"onSubmitEditing={() => nextRef.current?.focus()}","// no onSubmitEditing, manual tap only",Low
-19,Forms,Password Visibility,secureTextEntry toggle,iOS/Android/React Native,Allow toggling password visibility securely,Provide Show/Hide icon toggling secureTextEntry,Force users to type blind with no option,"<TextInput secureTextEntry={secure} /><Icon onPress={toggle} />","<TextInput secureTextEntry /> // no toggle",Medium
-20,Performance,Virtualize Long Lists,FlatList SectionList virtualization,iOS/Android/React Native,Use FlatList/SectionList for lists over ~50 items,Use keyExtractor and initialNumToRender appropriately,Render hundreds of items with ScrollView,"<FlatList data={items} renderItem={...} />","<ScrollView>{items.map(renderItem)}</ScrollView>",High
-21,Performance,Image Size & Cache,Image resize cache,iOS/Android/React Native,Use correctly sized and cached images,Use Image component with proper resizeMode and caching,Load full-resolution images everywhere,"<Image source={{uri}} resizeMode=""cover"" />","<Image source={require('4k.png')} /> // small avatar",Medium
-22,Performance,Debounce High-Freq Events,debounce scroll search,iOS/Android/React Native,Debounce scroll/search callbacks to avoid jank,Wrap handlers with debounce/throttle,Run heavy logic on every event,"onScroll={debouncedHandleScroll}","onScroll={handleScrollHeavy}",Medium
-23,Animation,Duration & Easing,animation duration easing,iOS/Android/React Native,Micro-interactions should be 150–300ms with native-like easing,Use ease-out for enter/ease-in for exit,Use long or linear animations for core UI,"Animated.timing(..., { duration: 200, easing: Easing.out(Easing.quad) })","Animated.timing(..., { duration: 800, easing: Easing.linear })",Medium
-24,Animation,Respect Reduced Motion,reduced motion accessibility,iOS/Android/React Native,Respect OS reduced-motion accessibility setting,Check reduceMotionEnabled and simplify animations,Ignore user motion preferences,"if (reduceMotionEnabled) skipAnimation()","Always run complex parallax animations",Critical
-25,Animation,Limited Continuous Motion,loop animation loader,iOS/Android/React Native,Reserve infinite animations for loaders and live data,Use looping only where necessary,Keep decorative elements looping forever,"Animated.loop(loaderAnim) for ActivityIndicator","Animated.loop(bounceAnim) on background icons",Medium
-26,Typography,Base Font Size,fontScale dynamic type,iOS/Android/React Native,Body text must be readable and support Dynamic Type,Use platform fontScale and at least 14–16pt base,Render critical text below 12pt,"<Text style={{ fontSize: 16 }}>Body</Text>","<Text style={{ fontSize: 10 }}>Body</Text>",High
-27,Typography,Dynamic Type Support,allowFontScaling adjustsFontSizeToFit,iOS/Android/React Native,Support system text scaling without breaking layout,Set allowFontScaling and test large text,Disable scaling on all text globally,"<Text allowFontScaling>{label}</Text>","<Text allowFontScaling={false}>{label}</Text>",High
-28,Safe Areas,Safe Area Insets,safe area insets notch gesture,iOS/Android/React Native,Content must not overlap notches/gesture bars,Wrap screens in SafeAreaView or apply insets,Place tappable content under system bars,"<SafeAreaView style={{ flex: 1 }}><Screen /></SafeAreaView>","<View style={{ flex: 1 }}><Screen /></View>",High
-29,Theming,Light/Dark Contrast,dark mode contrast tokens,iOS/Android/React Native,Ensure sufficient contrast in both light and dark themes,Use semantic tokens and test both themes,Reuse light-theme grays directly in dark mode,"colors.textPrimaryDark = '#F9FAFB'","colors.textPrimaryDark = '#9CA3AF' on '#111827'",High
-30,Anti-Pattern,No Gesture-Only Actions,gesture only hidden controls,iOS/Android/React Native,Don't rely solely on hidden gestures for core actions,Provide visible buttons in addition to gestures,Rely on swipe/shake only with no UI affordance,"Swipe to delete + visible Delete button","Only shake device to undo with no UI",Critical